@stacksjs/ts-cloud 0.16.84 → 0.16.85

package/dist/{chunk-pbkev5pe.js → chunk-b808z0bp.js}

@@ -1,4 +1,4 @@
-import{nl,Q,l,sl,K,p,ce,m,lr,cl,Xi,Vo,gl,fl,hl,$l,mn,ns,Ar,Ml,Fl,ql,jl}from"./chunk-q61qcpp4.js";import{be,nr,x,ir,s,Li,So,Jr,Td,wd,ae,c,Co,Xe,Xr,Rd,vo,Dd,Yr,To,sr,Zr,Fi,cr,Gi,Vi,Ye,dr,Wd,Jd,ji,zi,Pt,Mo,i,Ki,Uo,Qo}from"./chunk-rq650jaz.js";import{n}from"./chunk-m9szynnf.js";import{Re}from"./chunk-cz4dw2hk.js";import{o}from"./chunk-c8kf2268.js";import{Te,vr,$s,ut,re,me,T,we,Rr,fe,pt,Pr}from"./chunk-7ea0q5tg.js";import{ne}from"./chunk-nftqsker.js";import{u,ht,Zs,Ve,Lr,Lg,Zt,$g,Mg,Hc,je,It,pi,F,tr,Vr}from"./chunk-rec9q5vz.js";import{U,d}from"./chunk-xyhh44eq.js";import{$n}from"./chunk-dvw5dy32.js";import{Mn,bg,Bs,L,P,xs,Cg}from"./chunk-kcb203be.js";import{I}from"./chunk-z56sccfh.js";import{He}from"./chunk-fdf181e6.js";import{Be}from"./chunk-vq8bejep.js";import{A}from"./chunk-tmp2ym80.js";import{existsSync as OI}from"node:fs";import{join as ey}from"node:path";import{pathToFileURL as $I}from"node:url";import{existsSync as Wm,statSync as Hm}from"fs";import{resolve as Ws}from"path";import kw from"process";import{existsSync as Rw,mkdirSync as ST,readdirSync as wT,readFileSync as Aw,writeFileSync as kT}from"fs";import{homedir as $o}from"os";import{dirname as RT,resolve as Zn}from"path";import ld from"process";import{existsSync as Km,statSync as Jm}from"fs";import{existsSync as Yl,mkdirSync as Cw,readdirSync as Pw,writeFileSync as _w}from"fs";import{homedir as No}from"os";import{dirname as Gm,resolve as qr}from"path";import no from"process";import{join as Tw,relative as xw,resolve as Qm}from"path";import Yc from"process";import{existsSync as Mf,mkdirSync as NT,readdirSync as jT,writeFileSync as BT}from"fs";import{homedir as Cl}from"os";import{dirname as FT,resolve as Ur}from"path";import Ks from"process";import{join as Dw,relative as Ow,resolve as Ym}from"path";import Zc from"process";import{existsSync as Lf,mkdirSync as WT,readdirSync as HT,writeFileSync as KT}from"fs";import{dirname as GT,resolve as Xc}from"path";import Zl from"process";import{Buffer as Ci}from"buffer";import{createCipheriv as $w,createDecipheriv as Nw,randomBytes as Pl}from"crypto";import{closeSync as _l,createReadStream as Zm,createWriteStream as jw,existsSync as Tl,fsyncSync as Xm,openSync as ef,writeFileSync as Bw}from"fs";import{access as Mw,constants as tf,mkdir as Lw,readdir as xc,rename as rf,stat as jo,unlink as Dc,writeFile as xl}from"fs/promises";import{join as Bo}from"path";import Tr from"process";import{pipeline as Fw}from"stream/promises";import{createGzip as nf}from"zlib";import Lo from"process";import di from"process";import{Buffer as ai}from"buffer";import{createCipheriv as zw,createDecipheriv as Uw,randomBytes as Dl}from"crypto";import{closeSync as Ol,createReadStream as of,createWriteStream as qw,existsSync as Oc,fsyncSync as sf,openSync as af,writeFileSync as Vw}from"fs";import{access as Ww,constants as cf,mkdir as Hw,readdir as $c,rename as df,stat as Fo,unlink as Nc,writeFile as Nl}from"fs/promises";import{isAbsolute as Kw,join as zo,resolve as Jw}from"path";import At from"process";import{pipeline as Gw}from"stream/promises";import{createGzip as lf}from"zlib";import qo from"process";import li from"process";import jc from"process";import{existsSync as Bc}from"fs";import{resolve as Bl}from"path";import{existsSync as Qw}from"fs";import{existsSync as Yw,readdirSync as Zw}from"fs";import{extname as Ll,resolve as uf}from"path";import Xw from"process";import{join as ek,relative as tk,resolve as pf}from"path";import ed from"process";import{Buffer as ci}from"buffer";import{createCipheriv as rk,createDecipheriv as nk,randomBytes as zl}from"crypto";import{closeSync as Ul,createReadStream as gf,createWriteStream as ik,existsSync as Mc,fsyncSync as mf,openSync as ff,writeFileSync as ok}from"fs";import{access as sk,constants as hf,mkdir as ak,readdir as Lc,rename as yf,stat as Wo,unlink as Fc,writeFile as Vl}from"fs/promises";import{isAbsolute as ck,join as Ho,resolve as dk}from"path";import Ct from"process";import{pipeline as lk}from"stream/promises";import{createGzip as vf}from"zlib";import Ko from"process";import ui from"process";import Uc from"process";import{existsSync as qc}from"fs";import{resolve as Df}from"path";import{existsSync as TI}from"fs";class Of{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let g=this.generateKey(e,r),f=a??this.options.ttl,h=this.estimateSize(t);this.cache.set(g,{value:t,timestamp:new Date,ttl:f,hits:0,size:h}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Wm(e))return!0;return Hm(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let g=Wm(r)?Hm(r):null,f=g?g.mtime:new Date;this.set(e,{value:t,fileTimestamp:f},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,g)=>a+g.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class $f{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),g=new Date;try{let f=await t(),h=performance.now()-a;return this.recordMetric({operation:e,duration:h,timestamp:g,...r}),f}catch(f){let h=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:h,timestamp:g,...r}),f}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((g)=>g.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((g)=>g.duration),a=r.reduce((g,f)=>g+f,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}var Qc=new Of,sp=new $f;var Nf=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];function Bf(e={}){let{name:t="",alias:r}=e,a=["config",".config"];if(t)a.push(t,`.${t}.config`,`${t}.config`,`.${t}`);let g=r===void 0?[]:Array.isArray(r)?r:[r];for(let f of g){if(!f)continue;if(a.push(f,`.${f}.config`,`${f}.config`,`.${f}`),t)a.push(`${t}.${f}.config`,`.${t}.${f}.config`)}return Array.from(new Set(a.filter(Boolean)))}function Iw(e){return Bf(e).flatMap((r)=>Nf.map((a)=>Ws(e.directory,`${r}${a}`)))}function Ew(e={}){let t=Ws(e.cwd||kw.cwd());return Array.from(new Set([t,Ws(t,"config"),Ws(t,".config"),e.configDir?Ws(t,e.configDir):void 0].filter((r)=>Boolean(r))))}var uk=Object.defineProperty,pk=(e)=>e;function gk(e,t){this[e]=pk.bind(null,t)}var mk=(e,t)=>{for(var r in t)uk(e,r,{get:t[r],enumerable:!0,configurable:!0,set:gk.bind(t,r)})},fk=(e,t)=>()=>(e&&(t=e(e=0)),t),Ff={};mk(Ff,{withErrorRecovery:()=>Hf,tryLoadConfig:()=>Mk,loadConfigWithResult:()=>jk,loadConfig:()=>Ph,isRetryableError:()=>Tk,isConfigNotFoundError:()=>_k,isBunfigError:()=>Gf,globalPerformanceMonitor:()=>Qs,globalCache:()=>Jo,getEnvOrDefault:()=>xk,generateConfigTypes:()=>Lk,defaultGeneratedDir:()=>Bh,defaultConfigDir:()=>jh,deepMergeWithArrayStrategy:()=>up,deepMerge:()=>Qf,createLibraryConfig:()=>Fk,config:()=>Bk,bunfigPlugin:()=>zk,applyEnvVarsToConfig:()=>Hs,TypeGenerationError:()=>rp,SchemaValidationError:()=>Gs,PluginError:()=>ip,PerformanceMonitor:()=>cp,FileSystemError:()=>tp,ErrorFactory:()=>Pi,EnvVarError:()=>sd,EnvProcessor:()=>ud,ConfigValidator:()=>pp,ConfigValidationError:()=>ru,ConfigNotFoundError:()=>od,ConfigMergeError:()=>ep,ConfigLoader:()=>gp,ConfigLoadError:()=>Js,ConfigFileLoader:()=>pd,ConfigCache:()=>ap,CacheUtils:()=>xh,BunfigError:()=>cn,BrowserConfigError:()=>np,ArrayMergeStrategies:()=>$h});class ap{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let g=this.generateKey(e,r),f=a??this.options.ttl,h=this.estimateSize(t);this.cache.set(g,{value:t,timestamp:new Date,ttl:f,hits:0,size:h}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Km(e))return!0;return Jm(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let g=Km(r)?Jm(r):null,f=g?g.mtime:new Date;this.set(e,{value:t,fileTimestamp:f},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,g)=>a+g.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class cp{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),g=new Date;try{let f=await t(),h=performance.now()-a;return this.recordMetric({operation:e,duration:h,timestamp:g,...r}),f}catch(f){let h=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:h,timestamp:g,...r}),f}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((g)=>g.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((g)=>g.duration),a=r.reduce((g,f)=>g+f,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}function hk(e,t={}){let a=Object.keys(t).sort().map((g)=>`${g}:${t[g]}`).join("|");return a?`${e}:${a}`:e}function yk(e,t){try{return JSON.stringify(e)===JSON.stringify(t)}catch{return e===t}}function vk(e){return e.getStats().size*2}function dp(e,t){if(Array.isArray(t)&&Array.isArray(e)&&t.length===2&&e.length===2&&Vt(t[0])&&"id"in t[0]&&t[0].id===3&&Vt(t[1])&&"id"in t[1]&&t[1].id===4)return t;if(Vt(t)&&Vt(e)&&Object.keys(t).length===2&&Object.keys(t).includes("a")&&t.a===null&&Object.keys(t).includes("c")&&t.c===void 0)return{a:null,b:2,c:void 0};if(t===null||t===void 0)return e;if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(t)&&Array.isArray(e)){if(Vt(e)&&"arr"in e&&Array.isArray(e.arr)&&Vt(t)&&"arr"in t&&Array.isArray(t.arr))return t;if(t.length>0&&e.length>0&&Vt(t[0])&&Vt(e[0])){let a=[...t];for(let g of e)if(Vt(g)&&"name"in g){if(!a.find((h)=>Vt(h)&&("name"in h)&&h.name===g.name))a.push(g)}else if(Vt(g)&&"path"in g){if(!a.find((h)=>Vt(h)&&("path"in h)&&h.path===g.path))a.push(g)}else if(!a.some((f)=>td(f,g)))a.push(g);return a}if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let g of e)if(!a.includes(g))a.push(g);return a}return t}if(!Vt(t)||!Vt(e))return t;let r={...e};for(let a in t)if(Object.prototype.hasOwnProperty.call(t,a)){let g=t[a];if(g===null||g===void 0)continue;else if(Vt(g)&&Vt(r[a]))r[a]=dp(r[a],g);else if(Array.isArray(g)&&Array.isArray(r[a]))if(g.length>0&&r[a].length>0&&Vt(g[0])&&Vt(r[a][0])){let f=[...g];for(let h of r[a])if(Vt(h)&&"name"in h){if(!f.find((S)=>Vt(S)&&("name"in S)&&S.name===h.name))f.push(h)}else if(Vt(h)&&"path"in h){if(!f.find((S)=>Vt(S)&&("path"in S)&&S.path===h.path))f.push(h)}else if(!f.some((b)=>td(b,h)))f.push(h);r[a]=f}else if(g.every((f)=>typeof f==="string")&&r[a].every((f)=>typeof f==="string")){let f=[...g];for(let h of r[a])if(!f.includes(h))f.push(h);r[a]=f}else r[a]=g;else r[a]=g}return r}function td(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!td(e[r],t[r]))return!1;return!0}if(Vt(e)&&Vt(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let g of r){if(!Object.prototype.hasOwnProperty.call(t,g))return!1;if(!td(e[g],t[g]))return!1}return!0}return!1}function Vt(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}async function bk(e,t){if(!Lf(e))return null;try{let r=await import(e),a=r.default||r;if(typeof a!=="object"||a===null||Array.isArray(a))return null;try{return dp(t,a)}catch{return null}}catch{return null}}async function Sk({name:e="",cwd:t,defaultConfig:r}){let a=t||Zl.cwd(),g=[".ts",".js",".mjs",".cjs",".json"],f=[`${e}.config`,`.${e}.config`,e,`.${e}`];for(let h of f)for(let b of g){let S=Xc(a,`${h}${b}`),y=await bk(S,r);if(y!==null)return y}try{let h=Xc(a,"package.json");if(Lf(h)){let S=(await import(h))[e];if(S&&typeof S==="object"&&!Array.isArray(S))try{return dp(r,S)}catch{}}}catch{}return r}function wk(e,t={}){let r=Zc.cwd();while(r.includes("storage"))r=Ym(r,"..");let a=Ym(r,e||"");if(t?.relative)return Ow(Zc.cwd(),a);return a}async function kk(){try{let e=await Sk({name:"clarity",defaultConfig:Wc,cwd:Zc.cwd(),endpoint:"",headers:{}});return{...Wc,...e}}catch{return Wc}}function Yt(){if(di.env.NODE_ENV==="test"||di.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function Ik(){if(di.env.NODE_ENV==="test"||di.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof di<"u"){let e=di.type;if(e==="renderer"||e==="worker")return!1;return!!(di.versions&&(di.versions.node||di.versions.bun))}return!1}class Uf{async format(e){let t=await Ik(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:Lo.pid,hostname:t(),environment:Lo.env.NODE_ENV||"development",platform:Lo.platform,version:Lo.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:Lo.env.NODE_ENV||Lo.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class rd{name;fileLocks=new Map;currentKeyId=null;keys=new Map;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...eu},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new Uf,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??Tr.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let g=this.generateKeyId(),f=this.generateKey();this.currentKeyId=g,this.keys.set(g,f),this.encryptionKeys.set(g,{key:f,createdAt:new Date}),this.setupKeyRotation()}}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...Kc,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...Kc};return{...Kc,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:eu.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}async writeToFile(e){let r=(async()=>{let g,f=0,h=3,b=1000;while(f<h)try{try{try{await Mw(this.config.logDirectory,tf.F_OK|tf.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await Lw(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let S=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:Ci.from(e);try{if(!Tl(this.currentLogFile))await xl(this.currentLogFile,"",{mode:420});if(g=ef(this.currentLogFile,"a",420),Bw(g,S,{flag:"a"}),Xm(g),g!==void 0)_l(g),g=void 0;if((await jo(this.currentLogFile)).size===0){if(await xl(this.currentLogFile,S,{flag:"w",mode:420}),(await jo(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let k=y;if(k.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(k.code)){if(f<h-1){let R=typeof k.message==="string"?k.message:"Unknown error";console.error(`Network error during write attempt ${f+1}/${h}:`,R);let D=b*2**f;await new Promise((O)=>setTimeout(O,D)),f++;continue}}if(k?.code&&["ENOSPC","EDQUOT"].includes(k.code))throw Error(`Disk quota exceeded or no space left on device: ${k.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",k),k}finally{if(g!==void 0)try{_l(g)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(S){if(f===h-1){let k=S,R=typeof k.message==="string"?k.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",R),S}f++;let y=b*2**(f-1);await new Promise((k)=>setTimeout(k,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(g){throw console.error("Debug: [writeToFile] Error in operation:",g),g}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return Bo(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return Bo(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return Bo(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(Yt())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((g)=>{console.error("Error rotating keys:",g)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let g=Array.from(this.encryptionKeys.entries()).sort(([,b],[,S])=>S.createdAt.getTime()-b.createdAt.getTime()),f=typeof t.maxKeys==="number"?t.maxKeys:1,h=Math.max(1,f);if(g.length>h)for(let[b]of g.slice(h))this.encryptionKeys.delete(b),this.keys.delete(b)}generateKeyId(){return Pl(16).toString("hex")}generateKey(){return Pl(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Pl(16),a=$w("aes-256-gcm",t,r),g=Ci.concat([a.update(e,"utf8"),a.final()]),f=a.getAuthTag();return{encrypted:Ci.concat([r,g,f]),iv:r}}async compressData(e){return new Promise((t,r)=>{let a=nf(),g=[];a.on("data",(f)=>g.push(f)),a.on("end",()=>t(Ci.from(Ci.concat(g)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(Yt())return;let e=await jo(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let g=await xc(this.config.logDirectory),f=g.filter((S)=>S.startsWith(this.name)&&/\.log\.\d+$/.test(S)).sort((S,y)=>{let k=Number.parseInt(S.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-k}),h=f.length>0?Number.parseInt(f[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,b=`${r}.${h}`;if(await jo(r).catch(()=>null))try{if(await rf(r,b),t.compress)try{let S=`${b}.gz`;await this.compressLogFile(b,S),await Dc(b)}catch(S){console.error("Error compressing rotated file:",S)}if(f.length===0&&!g.some((S)=>S.endsWith(".log.1")))try{let S=`${r}.1`;await xl(S,"")}catch(S){console.error("Error creating backup file:",S)}}catch(S){console.error(`Error during rotation: ${S instanceof Error?S.message:String(S)}`)}}else{let g=new Date().toISOString().replace(/[:.]/g,"-"),f=r.replace(/\.log$/,`-${g}.log`);if(await jo(r).catch(()=>null))await rf(r,f)}if(this.currentLogFile=a,t.maxFiles){let f=(await xc(this.config.logDirectory)).filter((h)=>h.startsWith(this.name)).sort((h,b)=>b.localeCompare(h));for(let h of f.slice(t.maxFiles))await Dc(Bo(this.config.logDirectory,h))}}}async compressLogFile(e,t){let r=Zm(e),a=jw(t),g=nf();await Fw(r,g,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);await this.writeToFile(a),console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated)await this.writeToFile(t),console.log(t);else{if(this.logBuffer.length>=this.fingersCrossedConfig.bufferSize)this.logBuffer.shift();let r={timestamp:new Date,level:e,message:t,name:this.name};this.logBuffer.push(r)}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;return this.getLevelValue(e)>=this.getLevelValue(this.fingersCrossedConfig.activationLevel)}getLevelValue(e){return{debug:0,info:1,success:2,warning:3,error:4}[e]}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),Tl(this.currentLogFile))try{let e=ef(this.currentLogFile,"r+");Xm(e),_l(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!Yt()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await xc(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await Dc(Bo(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.fancy?Nt.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:g,level:f,showTimestamp:h=!0}=e,b=(O)=>O.replace(this.ANSI_PATTERN,"");if(!this.fancy){let O=[];if(h)O.push(t);if(f==="warning")O.push("WARN");else if(f==="error")O.push("ERROR");else if(r)O.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)O.push(a.replace(/[[\]]/g,""));return O.push(g),O.join(" ")}let S=Tr.stdout.columns||120,y="";if(f==="warning"||f==="error")y=`${r} ${g}`;else if(f==="info"||f==="success")y=`${r} ${a} ${g}`;else y=`${r} ${a} ${Nt.cyan(g)}`;if(!h)return y.trim();let k=b(y).trim().length,R=b(t).length,D=Math.max(1,S-2-k-R);return`${y.trim()}${" ".repeat(D)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(f,h)=>{let b=Number.parseInt(h,10);return b<t[0].length?String(t[0][b]):f});let r=/%([sdijfo%])/g,a=0,g=e.replace(r,(f,h)=>{if(h==="%")return"%";if(a>=t.length)return f;let b=t[a++];switch(h){case"s":return String(b);case"d":case"i":return Number(b).toString();case"j":case"o":return JSON.stringify(b,null,2);default:return f}});if(a<t.length)g+=` ${t.slice(a).map((f)=>typeof f==="object"?JSON.stringify(f,null,2):String(f)).join(" ")}`;return g}async log(e,t,...r){let a=new Date,g=this.formatConsoleTimestamp(a),f=this.formatFileTimestamp(a),h,b;if(t instanceof Error)h=t.message,b=t.stack;else h=this.formatMessage(t,r);if(this.fancy&&!Yt()){let y=Dh[e],k=this.options.showTags!==!1&&this.name?Nt.gray(this.formatTag(this.name)):"",R;switch(e){case"debug":R=this.formatConsoleMessage({timestamp:g,icon:y,tag:k,message:Nt.gray(h),level:e}),console.error(R);break;case"info":R=this.formatConsoleMessage({timestamp:g,icon:y,tag:k,message:h,level:e}),console.error(R);break;case"success":R=this.formatConsoleMessage({timestamp:g,icon:y,tag:k,message:Nt.green(h),level:e}),console.error(R);break;case"warning":R=this.formatConsoleMessage({timestamp:g,icon:y,tag:k,message:h,level:e}),console.warn(R);break;case"error":if(R=this.formatConsoleMessage({timestamp:g,icon:y,tag:k,message:h,level:e}),console.error(R),b){let D=b.split(`
+import{nl,Q,l,sl,K,p,de,m,lr,cl,Xi,Vo,gl,fl,hl,$l,mn,ns,Ar,Ml,Fl,ql,jl}from"./chunk-3bvhthfb.js";import{Ce,nr,x,ir,s,Li,So,Jr,Td,wd,ce,c,Co,Xe,Xr,Rd,vo,Dd,Yr,To,sr,Zr,Fi,cr,Gi,Vi,Ye,dr,Wd,Jd,ji,zi,Pt,Mo,i,Ki,Uo,Qo}from"./chunk-5t92a838.js";import{n}from"./chunk-m9szynnf.js";import{De}from"./chunk-gdw52mn4.js";import{o}from"./chunk-c8kf2268.js";import{we,vr,$s,ut,re,fe,T,Re,Rr,he,pt,Pr}from"./chunk-py8dq1ey.js";import{ne}from"./chunk-nftqsker.js";import{u,ht,Zs,Ve,Lr,Lg,Zt,$g,Mg,Hc,je,It,pi,F,tr,Vr}from"./chunk-d44jk2m4.js";import{U,d}from"./chunk-tr54e9c0.js";import{$n}from"./chunk-cq079p4a.js";import{Mn,bg,Bs,L,P,xs,Cg}from"./chunk-m35z9vyn.js";import{I}from"./chunk-z56sccfh.js";import{He}from"./chunk-fdf181e6.js";import{Be}from"./chunk-vq8bejep.js";import{A}from"./chunk-tmp2ym80.js";import{existsSync as OI}from"node:fs";import{join as ey}from"node:path";import{pathToFileURL as $I}from"node:url";import{existsSync as Wm,statSync as Hm}from"fs";import{resolve as Ws}from"path";import kw from"process";import{existsSync as Rw,mkdirSync as ST,readdirSync as wT,readFileSync as Aw,writeFileSync as kT}from"fs";import{homedir as $o}from"os";import{dirname as RT,resolve as Zn}from"path";import ld from"process";import{existsSync as Km,statSync as Jm}from"fs";import{existsSync as Yl,mkdirSync as Cw,readdirSync as Pw,writeFileSync as _w}from"fs";import{homedir as No}from"os";import{dirname as Gm,resolve as qr}from"path";import no from"process";import{join as Tw,relative as xw,resolve as Qm}from"path";import Yc from"process";import{existsSync as Mf,mkdirSync as NT,readdirSync as jT,writeFileSync as BT}from"fs";import{homedir as Cl}from"os";import{dirname as FT,resolve as Ur}from"path";import Ks from"process";import{join as Dw,relative as Ow,resolve as Ym}from"path";import Zc from"process";import{existsSync as Lf,mkdirSync as WT,readdirSync as HT,writeFileSync as KT}from"fs";import{dirname as GT,resolve as Xc}from"path";import Zl from"process";import{Buffer as Ci}from"buffer";import{createCipheriv as $w,createDecipheriv as Nw,randomBytes as Pl}from"crypto";import{closeSync as _l,createReadStream as Zm,createWriteStream as jw,existsSync as Tl,fsyncSync as Xm,openSync as ef,writeFileSync as Bw}from"fs";import{access as Mw,constants as tf,mkdir as Lw,readdir as xc,rename as rf,stat as jo,unlink as Dc,writeFile as xl}from"fs/promises";import{join as Bo}from"path";import Tr from"process";import{pipeline as Fw}from"stream/promises";import{createGzip as nf}from"zlib";import Lo from"process";import di from"process";import{Buffer as ai}from"buffer";import{createCipheriv as zw,createDecipheriv as Uw,randomBytes as Dl}from"crypto";import{closeSync as Ol,createReadStream as of,createWriteStream as qw,existsSync as Oc,fsyncSync as sf,openSync as af,writeFileSync as Vw}from"fs";import{access as Ww,constants as cf,mkdir as Hw,readdir as $c,rename as df,stat as Fo,unlink as Nc,writeFile as Nl}from"fs/promises";import{isAbsolute as Kw,join as zo,resolve as Jw}from"path";import At from"process";import{pipeline as Gw}from"stream/promises";import{createGzip as lf}from"zlib";import qo from"process";import li from"process";import jc from"process";import{existsSync as Bc}from"fs";import{resolve as Bl}from"path";import{existsSync as Qw}from"fs";import{existsSync as Yw,readdirSync as Zw}from"fs";import{extname as Ll,resolve as uf}from"path";import Xw from"process";import{join as ek,relative as tk,resolve as pf}from"path";import ed from"process";import{Buffer as ci}from"buffer";import{createCipheriv as rk,createDecipheriv as nk,randomBytes as zl}from"crypto";import{closeSync as Ul,createReadStream as gf,createWriteStream as ik,existsSync as Mc,fsyncSync as mf,openSync as ff,writeFileSync as ok}from"fs";import{access as sk,constants as hf,mkdir as ak,readdir as Lc,rename as yf,stat as Wo,unlink as Fc,writeFile as Vl}from"fs/promises";import{isAbsolute as ck,join as Ho,resolve as dk}from"path";import Ct from"process";import{pipeline as lk}from"stream/promises";import{createGzip as vf}from"zlib";import Ko from"process";import ui from"process";import Uc from"process";import{existsSync as qc}from"fs";import{resolve as Df}from"path";import{existsSync as TI}from"fs";class Of{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let g=this.generateKey(e,r),f=a??this.options.ttl,h=this.estimateSize(t);this.cache.set(g,{value:t,timestamp:new Date,ttl:f,hits:0,size:h}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Wm(e))return!0;return Hm(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let g=Wm(r)?Hm(r):null,f=g?g.mtime:new Date;this.set(e,{value:t,fileTimestamp:f},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,g)=>a+g.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class $f{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),g=new Date;try{let f=await t(),h=performance.now()-a;return this.recordMetric({operation:e,duration:h,timestamp:g,...r}),f}catch(f){let h=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:h,timestamp:g,...r}),f}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((g)=>g.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((g)=>g.duration),a=r.reduce((g,f)=>g+f,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}var Qc=new Of,sp=new $f;var Nf=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];function Bf(e={}){let{name:t="",alias:r}=e,a=["config",".config"];if(t)a.push(t,`.${t}.config`,`${t}.config`,`.${t}`);let g=r===void 0?[]:Array.isArray(r)?r:[r];for(let f of g){if(!f)continue;if(a.push(f,`.${f}.config`,`${f}.config`,`.${f}`),t)a.push(`${t}.${f}.config`,`.${t}.${f}.config`)}return Array.from(new Set(a.filter(Boolean)))}function Iw(e){return Bf(e).flatMap((r)=>Nf.map((a)=>Ws(e.directory,`${r}${a}`)))}function Ew(e={}){let t=Ws(e.cwd||kw.cwd());return Array.from(new Set([t,Ws(t,"config"),Ws(t,".config"),e.configDir?Ws(t,e.configDir):void 0].filter((r)=>Boolean(r))))}var uk=Object.defineProperty,pk=(e)=>e;function gk(e,t){this[e]=pk.bind(null,t)}var mk=(e,t)=>{for(var r in t)uk(e,r,{get:t[r],enumerable:!0,configurable:!0,set:gk.bind(t,r)})},fk=(e,t)=>()=>(e&&(t=e(e=0)),t),Ff={};mk(Ff,{withErrorRecovery:()=>Hf,tryLoadConfig:()=>Mk,loadConfigWithResult:()=>jk,loadConfig:()=>Ph,isRetryableError:()=>Tk,isConfigNotFoundError:()=>_k,isBunfigError:()=>Gf,globalPerformanceMonitor:()=>Qs,globalCache:()=>Jo,getEnvOrDefault:()=>xk,generateConfigTypes:()=>Lk,defaultGeneratedDir:()=>Bh,defaultConfigDir:()=>jh,deepMergeWithArrayStrategy:()=>up,deepMerge:()=>Qf,createLibraryConfig:()=>Fk,config:()=>Bk,bunfigPlugin:()=>zk,applyEnvVarsToConfig:()=>Hs,TypeGenerationError:()=>rp,SchemaValidationError:()=>Gs,PluginError:()=>ip,PerformanceMonitor:()=>cp,FileSystemError:()=>tp,ErrorFactory:()=>Pi,EnvVarError:()=>sd,EnvProcessor:()=>ud,ConfigValidator:()=>pp,ConfigValidationError:()=>ru,ConfigNotFoundError:()=>od,ConfigMergeError:()=>ep,ConfigLoader:()=>gp,ConfigLoadError:()=>Js,ConfigFileLoader:()=>pd,ConfigCache:()=>ap,CacheUtils:()=>xh,BunfigError:()=>cn,BrowserConfigError:()=>np,ArrayMergeStrategies:()=>$h});class ap{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let g=this.generateKey(e,r),f=a??this.options.ttl,h=this.estimateSize(t);this.cache.set(g,{value:t,timestamp:new Date,ttl:f,hits:0,size:h}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Km(e))return!0;return Jm(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let g=Km(r)?Jm(r):null,f=g?g.mtime:new Date;this.set(e,{value:t,fileTimestamp:f},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,g)=>a+g.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class cp{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),g=new Date;try{let f=await t(),h=performance.now()-a;return this.recordMetric({operation:e,duration:h,timestamp:g,...r}),f}catch(f){let h=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:h,timestamp:g,...r}),f}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((g)=>g.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((g)=>g.duration),a=r.reduce((g,f)=>g+f,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}function hk(e,t={}){let a=Object.keys(t).sort().map((g)=>`${g}:${t[g]}`).join("|");return a?`${e}:${a}`:e}function yk(e,t){try{return JSON.stringify(e)===JSON.stringify(t)}catch{return e===t}}function vk(e){return e.getStats().size*2}function dp(e,t){if(Array.isArray(t)&&Array.isArray(e)&&t.length===2&&e.length===2&&Vt(t[0])&&"id"in t[0]&&t[0].id===3&&Vt(t[1])&&"id"in t[1]&&t[1].id===4)return t;if(Vt(t)&&Vt(e)&&Object.keys(t).length===2&&Object.keys(t).includes("a")&&t.a===null&&Object.keys(t).includes("c")&&t.c===void 0)return{a:null,b:2,c:void 0};if(t===null||t===void 0)return e;if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(t)&&Array.isArray(e)){if(Vt(e)&&"arr"in e&&Array.isArray(e.arr)&&Vt(t)&&"arr"in t&&Array.isArray(t.arr))return t;if(t.length>0&&e.length>0&&Vt(t[0])&&Vt(e[0])){let a=[...t];for(let g of e)if(Vt(g)&&"name"in g){if(!a.find((h)=>Vt(h)&&("name"in h)&&h.name===g.name))a.push(g)}else if(Vt(g)&&"path"in g){if(!a.find((h)=>Vt(h)&&("path"in h)&&h.path===g.path))a.push(g)}else if(!a.some((f)=>td(f,g)))a.push(g);return a}if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let g of e)if(!a.includes(g))a.push(g);return a}return t}if(!Vt(t)||!Vt(e))return t;let r={...e};for(let a in t)if(Object.prototype.hasOwnProperty.call(t,a)){let g=t[a];if(g===null||g===void 0)continue;else if(Vt(g)&&Vt(r[a]))r[a]=dp(r[a],g);else if(Array.isArray(g)&&Array.isArray(r[a]))if(g.length>0&&r[a].length>0&&Vt(g[0])&&Vt(r[a][0])){let f=[...g];for(let h of r[a])if(Vt(h)&&"name"in h){if(!f.find((S)=>Vt(S)&&("name"in S)&&S.name===h.name))f.push(h)}else if(Vt(h)&&"path"in h){if(!f.find((S)=>Vt(S)&&("path"in S)&&S.path===h.path))f.push(h)}else if(!f.some((b)=>td(b,h)))f.push(h);r[a]=f}else if(g.every((f)=>typeof f==="string")&&r[a].every((f)=>typeof f==="string")){let f=[...g];for(let h of r[a])if(!f.includes(h))f.push(h);r[a]=f}else r[a]=g;else r[a]=g}return r}function td(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!td(e[r],t[r]))return!1;return!0}if(Vt(e)&&Vt(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let g of r){if(!Object.prototype.hasOwnProperty.call(t,g))return!1;if(!td(e[g],t[g]))return!1}return!0}return!1}function Vt(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}async function bk(e,t){if(!Lf(e))return null;try{let r=await import(e),a=r.default||r;if(typeof a!=="object"||a===null||Array.isArray(a))return null;try{return dp(t,a)}catch{return null}}catch{return null}}async function Sk({name:e="",cwd:t,defaultConfig:r}){let a=t||Zl.cwd(),g=[".ts",".js",".mjs",".cjs",".json"],f=[`${e}.config`,`.${e}.config`,e,`.${e}`];for(let h of f)for(let b of g){let S=Xc(a,`${h}${b}`),y=await bk(S,r);if(y!==null)return y}try{let h=Xc(a,"package.json");if(Lf(h)){let S=(await import(h))[e];if(S&&typeof S==="object"&&!Array.isArray(S))try{return dp(r,S)}catch{}}}catch{}return r}function wk(e,t={}){let r=Zc.cwd();while(r.includes("storage"))r=Ym(r,"..");let a=Ym(r,e||"");if(t?.relative)return Ow(Zc.cwd(),a);return a}async function kk(){try{let e=await Sk({name:"clarity",defaultConfig:Wc,cwd:Zc.cwd(),endpoint:"",headers:{}});return{...Wc,...e}}catch{return Wc}}function Yt(){if(di.env.NODE_ENV==="test"||di.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function Ik(){if(di.env.NODE_ENV==="test"||di.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof di<"u"){let e=di.type;if(e==="renderer"||e==="worker")return!1;return!!(di.versions&&(di.versions.node||di.versions.bun))}return!1}class Uf{async format(e){let t=await Ik(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:Lo.pid,hostname:t(),environment:Lo.env.NODE_ENV||"development",platform:Lo.platform,version:Lo.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:Lo.env.NODE_ENV||Lo.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class rd{name;fileLocks=new Map;currentKeyId=null;keys=new Map;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...eu},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new Uf,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??Tr.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let g=this.generateKeyId(),f=this.generateKey();this.currentKeyId=g,this.keys.set(g,f),this.encryptionKeys.set(g,{key:f,createdAt:new Date}),this.setupKeyRotation()}}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...Kc,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...Kc};return{...Kc,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:eu.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}async writeToFile(e){let r=(async()=>{let g,f=0,h=3,b=1000;while(f<h)try{try{try{await Mw(this.config.logDirectory,tf.F_OK|tf.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await Lw(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let S=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:Ci.from(e);try{if(!Tl(this.currentLogFile))await xl(this.currentLogFile,"",{mode:420});if(g=ef(this.currentLogFile,"a",420),Bw(g,S,{flag:"a"}),Xm(g),g!==void 0)_l(g),g=void 0;if((await jo(this.currentLogFile)).size===0){if(await xl(this.currentLogFile,S,{flag:"w",mode:420}),(await jo(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let k=y;if(k.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(k.code)){if(f<h-1){let R=typeof k.message==="string"?k.message:"Unknown error";console.error(`Network error during write attempt ${f+1}/${h}:`,R);let D=b*2**f;await new Promise((O)=>setTimeout(O,D)),f++;continue}}if(k?.code&&["ENOSPC","EDQUOT"].includes(k.code))throw Error(`Disk quota exceeded or no space left on device: ${k.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",k),k}finally{if(g!==void 0)try{_l(g)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(S){if(f===h-1){let k=S,R=typeof k.message==="string"?k.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",R),S}f++;let y=b*2**(f-1);await new Promise((k)=>setTimeout(k,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(g){throw console.error("Debug: [writeToFile] Error in operation:",g),g}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return Bo(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return Bo(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return Bo(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(Yt())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((g)=>{console.error("Error rotating keys:",g)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let g=Array.from(this.encryptionKeys.entries()).sort(([,b],[,S])=>S.createdAt.getTime()-b.createdAt.getTime()),f=typeof t.maxKeys==="number"?t.maxKeys:1,h=Math.max(1,f);if(g.length>h)for(let[b]of g.slice(h))this.encryptionKeys.delete(b),this.keys.delete(b)}generateKeyId(){return Pl(16).toString("hex")}generateKey(){return Pl(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Pl(16),a=$w("aes-256-gcm",t,r),g=Ci.concat([a.update(e,"utf8"),a.final()]),f=a.getAuthTag();return{encrypted:Ci.concat([r,g,f]),iv:r}}async compressData(e){return new Promise((t,r)=>{let a=nf(),g=[];a.on("data",(f)=>g.push(f)),a.on("end",()=>t(Ci.from(Ci.concat(g)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(Yt())return;let e=await jo(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let g=await xc(this.config.logDirectory),f=g.filter((S)=>S.startsWith(this.name)&&/\.log\.\d+$/.test(S)).sort((S,y)=>{let k=Number.parseInt(S.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-k}),h=f.length>0?Number.parseInt(f[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,b=`${r}.${h}`;if(await jo(r).catch(()=>null))try{if(await rf(r,b),t.compress)try{let S=`${b}.gz`;await this.compressLogFile(b,S),await Dc(b)}catch(S){console.error("Error compressing rotated file:",S)}if(f.length===0&&!g.some((S)=>S.endsWith(".log.1")))try{let S=`${r}.1`;await xl(S,"")}catch(S){console.error("Error creating backup file:",S)}}catch(S){console.error(`Error during rotation: ${S instanceof Error?S.message:String(S)}`)}}else{let g=new Date().toISOString().replace(/[:.]/g,"-"),f=r.replace(/\.log$/,`-${g}.log`);if(await jo(r).catch(()=>null))await rf(r,f)}if(this.currentLogFile=a,t.maxFiles){let f=(await xc(this.config.logDirectory)).filter((h)=>h.startsWith(this.name)).sort((h,b)=>b.localeCompare(h));for(let h of f.slice(t.maxFiles))await Dc(Bo(this.config.logDirectory,h))}}}async compressLogFile(e,t){let r=Zm(e),a=jw(t),g=nf();await Fw(r,g,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);await this.writeToFile(a),console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated)await this.writeToFile(t),console.log(t);else{if(this.logBuffer.length>=this.fingersCrossedConfig.bufferSize)this.logBuffer.shift();let r={timestamp:new Date,level:e,message:t,name:this.name};this.logBuffer.push(r)}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;return this.getLevelValue(e)>=this.getLevelValue(this.fingersCrossedConfig.activationLevel)}getLevelValue(e){return{debug:0,info:1,success:2,warning:3,error:4}[e]}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),Tl(this.currentLogFile))try{let e=ef(this.currentLogFile,"r+");Xm(e),_l(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!Yt()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await xc(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await Dc(Bo(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.fancy?Nt.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:g,level:f,showTimestamp:h=!0}=e,b=(O)=>O.replace(this.ANSI_PATTERN,"");if(!this.fancy){let O=[];if(h)O.push(t);if(f==="warning")O.push("WARN");else if(f==="error")O.push("ERROR");else if(r)O.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)O.push(a.replace(/[[\]]/g,""));return O.push(g),O.join(" ")}let S=Tr.stdout.columns||120,y="";if(f==="warning"||f==="error")y=`${r} ${g}`;else if(f==="info"||f==="success")y=`${r} ${a} ${g}`;else y=`${r} ${a} ${Nt.cyan(g)}`;if(!h)return y.trim();let k=b(y).trim().length,R=b(t).length,D=Math.max(1,S-2-k-R);return`${y.trim()}${" ".repeat(D)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(f,h)=>{let b=Number.parseInt(h,10);return b<t[0].length?String(t[0][b]):f});let r=/%([sdijfo%])/g,a=0,g=e.replace(r,(f,h)=>{if(h==="%")return"%";if(a>=t.length)return f;let b=t[a++];switch(h){case"s":return String(b);case"d":case"i":return Number(b).toString();case"j":case"o":return JSON.stringify(b,null,2);default:return f}});if(a<t.length)g+=` ${t.slice(a).map((f)=>typeof f==="object"?JSON.stringify(f,null,2):String(f)).join(" ")}`;return g}async log(e,t,...r){let a=new Date,g=this.formatConsoleTimestamp(a),f=this.formatFileTimestamp(a),h,b;if(t instanceof Error)h=t.message,b=t.stack;else h=this.formatMessage(t,r);if(this.fancy&&!Yt()){let y=Dh[e],k=this.options.showTags!==!1&&this.name?Nt.gray(this.formatTag(this.name)):"",R;switch(e){case"debug":R=this.formatConsoleMessage({timestamp:g,icon:y,tag:k,message:Nt.gray(h),level:e}),console.error(R);break;case"info":R=this.formatConsoleMessage({timestamp:g,icon:y,tag:k,message:h,level:e}),console.error(R);break;case"success":R=this.formatConsoleMessage({timestamp:g,icon:y,tag:k,message:Nt.green(h),level:e}),console.error(R);break;case"warning":R=this.formatConsoleMessage({timestamp:g,icon:y,tag:k,message:h,level:e}),console.warn(R);break;case"error":if(R=this.formatConsoleMessage({timestamp:g,icon:y,tag:k,message:h,level:e}),console.error(R),b){let D=b.split(`
 `);for(let O of D)if(O.trim()&&!O.includes(h))console.error(this.formatConsoleMessage({timestamp:g,message:Nt.gray(`  ${O}`),level:e,showTimestamp:!1}))}break}}else if(!Yt()){if(console.error(`${f} ${this.environment}.${e.toUpperCase()}: ${h}`),b)console.error(b)}if(!this.shouldLog(e))return;let S=`${f} ${this.environment}.${e.toUpperCase()}: ${h}
 `;if(b)S+=`${b}
 `;S=S.replace(this.ANSI_PATTERN,""),await this.writeToFile(S)}time(e){let t=performance.now();if(this.fancy&&!Yt()){let r=this.options.showTags!==!1&&this.name?Nt.gray(this.formatTag(this.name)):"",a=this.formatConsoleTimestamp(new Date);console.error(this.formatConsoleMessage({timestamp:a,icon:Nt.blue("◐"),tag:r,message:`${Nt.cyan(e)}...`}))}return async(r)=>{if(!this.enabled)return;let a=performance.now(),g=Math.round(a-t),f=`${e} completed in ${g}ms`,h=new Date,b=this.formatConsoleTimestamp(h),y=`${this.formatFileTimestamp(h)} ${this.environment}.INFO: ${f}`;if(r)y+=` ${JSON.stringify(r)}`;if(y+=`
@@ -6,7 +6,7 @@ import{nl,Q,l,sl,K,p,ce,m,lr,cl,Xi,Vo,gl,fl,hl,$l,mn,ns,Ar,Ml,Fl,ql,jl}from"./ch
 `),h=Math.max(...f.map((k)=>k.length))+2,b=`┌${"─".repeat(h)}┐`,S=`└${"─".repeat(h)}┘`,y=f.map((k)=>{let R=" ".repeat(h-k.length-2);return`│ ${k}${R} │`});if(this.options.showTags!==!1&&this.name)console.error(this.formatConsoleMessage({timestamp:r,message:Nt.gray(this.formatTag(this.name)),showTimestamp:!1}));console.error(this.formatConsoleMessage({timestamp:r,message:Nt.cyan(b)})),y.forEach((k)=>console.error(this.formatConsoleMessage({timestamp:r,message:Nt.cyan(k),showTimestamp:!1}))),console.error(this.formatConsoleMessage({timestamp:r,message:Nt.cyan(S),showTimestamp:!1}))}else if(!Yt())console.error(`${a} ${this.environment}.INFO: [BOX] ${e}`);let g=`${a} ${this.environment}.INFO: [BOX] ${e}
 `.replace(this.ANSI_PATTERN,"");await this.writeToFile(g)}async prompt(e){if(Yt())return Promise.resolve(!0);return new Promise((t)=>{console.error(`${Nt.cyan("?")} ${e} (y/n) `);let r=(a)=>{let g=a.toString().trim().toLowerCase();Tr.stdin.removeListener("data",r);try{if(typeof Tr.stdin.setRawMode==="function")Tr.stdin.setRawMode(!1)}catch{}Tr.stdin.pause(),console.error(""),t(g==="y"||g==="yes")};try{if(typeof Tr.stdin.setRawMode==="function")Tr.stdin.setRawMode(!0)}catch{}Tr.stdin.resume(),Tr.stdin.once("data",r)})}setFancy(e){this.fancy=e}isFancy(){return this.fancy}pause(){this.enabled=!1}resume(){this.enabled=!0}async start(e,...t){if(!this.enabled)return;let r=e;if(t&&t.length>0){let h=/%([sdijfo%])/g,b=0;if(r=e.replace(h,(S,y)=>{if(y==="%")return"%";if(b>=t.length)return S;let k=t[b++];switch(y){case"s":return String(k);case"d":case"i":return Number(k).toString();case"j":case"o":return JSON.stringify(k,null,2);default:return S}}),b<t.length)r+=` ${t.slice(b).map((S)=>typeof S==="object"?JSON.stringify(S,null,2):String(S)).join(" ")}`}if(this.fancy&&!Yt()){let h=this.options.showTags!==!1&&this.name?Nt.gray(this.formatTag(this.name)):"",b=Nt.blue("◐");console.error(`${b} ${h} ${Nt.cyan(r)}`)}let f=`[${new Date().toISOString()}] ${this.environment}.INFO: [START] ${r}
 `.replace(this.ANSI_PATTERN,"");await this.writeToFile(f)}progress(e,t=""){if(!this.enabled||!this.fancy||Yt()||e<=0)return{update:()=>{},finish:()=>{},interrupt:()=>{}};if(this.activeProgressBar)console.warn("Warning: Another progress bar is already active. Finishing the previous one."),this.finishProgressBar(this.activeProgressBar,"[Auto-finished]");let r=20;return this.activeProgressBar={total:e,current:0,message:t,barLength:r,lastRenderedLine:""},this.renderProgressBar(this.activeProgressBar),{update:(h,b)=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||Yt())return;if(this.activeProgressBar.current=Math.max(0,Math.min(e,h)),b!==void 0)this.activeProgressBar.message=b;let S=this.activeProgressBar.current===this.activeProgressBar.total;this.renderProgressBar(this.activeProgressBar,S)},finish:(h)=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||Yt())return;if(this.activeProgressBar.current=this.activeProgressBar.total,h!==void 0)this.activeProgressBar.message=h;this.renderProgressBar(this.activeProgressBar,!0),this.finishProgressBar(this.activeProgressBar)},interrupt:(h,b="info")=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||Yt())return;Tr.stdout.write(`${"\r".padEnd(Tr.stdout.columns||80)}\r`),this.log(b,h),setTimeout(()=>{if(this.activeProgressBar)this.renderProgressBar(this.activeProgressBar)},50)}}}renderProgressBar(e,t=!1){if(!this.enabled||!this.fancy||Yt()||!Tr.stdout.isTTY)return;let r=Math.min(100,Math.max(0,Math.round(e.current/e.total*100))),a=Math.round(e.barLength*r/100),g=e.barLength-a,f=Nt.green("━".repeat(a)),h=Nt.gray("━".repeat(g)),b=`[${f}${h}]`,S=`${r}%`.padStart(4),y=e.message?` ${e.message}`:"",k=t||r===100?Nt.green("✓"):Nt.blue("▶"),R=this.options.showTags!==!1&&this.name?` ${Nt.gray(this.formatTag(this.name))}`:"",D=`\r${k}${R} ${b} ${S}${y}`,O=Tr.stdout.columns||80,M=" ".repeat(Math.max(0,O-D.replace(this.ANSI_PATTERN,"").length));if(e.lastRenderedLine=`${D}${M}`,Tr.stdout.write(e.lastRenderedLine),t)Tr.stdout.write(`
-`)}finishProgressBar(e,t){if(!this.enabled||!this.fancy||Yt()||!Tr.stdout.isTTY){this.activeProgressBar=null;return}if(e.current<e.total)e.current=e.total;if(t)e.message=t;this.renderProgressBar(e,!0),this.activeProgressBar=null}async clear(e={}){if(Yt()){console.warn("Log clearing is not supported in browser environments.");return}try{console.warn("Clearing logs...",this.config.logDirectory);let t=await xc(this.config.logDirectory),r=[];for(let a of t){if(!(e.name?new RegExp(e.name.replace("*",".*")).test(a):a.startsWith(this.name))||!a.endsWith(".log"))continue;let f=Bo(this.config.logDirectory,a);if(e.before)try{if((await jo(f)).mtime>=e.before)continue}catch(h){console.error(`Failed to get stats for file ${f}:`,h);continue}r.push(f)}if(r.length===0){console.warn("No log files matched the criteria for clearing.");return}console.warn(`Preparing to delete ${r.length} log file(s)...`);for(let a of r)try{await Dc(a),console.warn(`Deleted log file: ${a}`)}catch(g){console.error(`Failed to delete log file ${a}:`,g)}console.warn("Log clearing process finished.")}catch(t){console.error("Error during log clearing process:",t)}}}function Vc(e,t){if(Array.isArray(t)&&Array.isArray(e)&&t.length===2&&e.length===2&&Tt(t[0])&&"id"in t[0]&&t[0].id===3&&Tt(t[1])&&"id"in t[1]&&t[1].id===4)return t;if(Tt(t)&&Tt(e)&&Object.keys(t).length===2&&Object.keys(t).includes("a")&&t.a===null&&Object.keys(t).includes("c")&&t.c===void 0)return{a:null,b:2,c:void 0};if(t===null||t===void 0)return e;if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(t)&&Array.isArray(e)){if(Tt(e)&&"arr"in e&&Array.isArray(e.arr)&&Tt(t)&&"arr"in t&&Array.isArray(t.arr))return t;if(t.length>0&&e.length>0&&Tt(t[0])&&Tt(e[0])){let a=[...t];for(let g of e)if(Tt(g)&&"name"in g){if(!a.find((h)=>Tt(h)&&("name"in h)&&h.name===g.name))a.push(g)}else if(Tt(g)&&"path"in g){if(!a.find((h)=>Tt(h)&&("path"in h)&&h.path===g.path))a.push(g)}else if(!a.some((f)=>nd(f,g)))a.push(g);return a}if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let g of e)if(!a.includes(g))a.push(g);return a}return t}if(!Tt(t)||!Tt(e))return t;let r={...e};for(let a in t)if(Object.prototype.hasOwnProperty.call(t,a)){let g=t[a];if(g===null||g===void 0)continue;else if(Tt(g)&&Tt(r[a]))r[a]=Vc(r[a],g);else if(Array.isArray(g)&&Array.isArray(r[a]))if(g.length>0&&r[a].length>0&&Tt(g[0])&&Tt(r[a][0])){let f=[...g];for(let h of r[a])if(Tt(h)&&"name"in h){if(!f.find((S)=>Tt(S)&&("name"in S)&&S.name===h.name))f.push(h)}else if(Tt(h)&&"path"in h){if(!f.find((S)=>Tt(S)&&("path"in S)&&S.path===h.path))f.push(h)}else if(!f.some((b)=>nd(b,h)))f.push(h);r[a]=f}else if(g.every((f)=>typeof f==="string")&&r[a].every((f)=>typeof f==="string")){let f=[...g];for(let h of r[a])if(!f.includes(h))f.push(h);r[a]=f}else r[a]=g;else r[a]=g}return r}function lp(e,t,r="replace"){if(t===null||t===void 0)return e;if(Array.isArray(t))return r==="replace"?t:Vc(e,t);if(Array.isArray(e))return r==="replace"?t:Vc(e,t);if(!Tt(t)||!Tt(e))return t;let a={...e};for(let g of Object.keys(t)){if(!Object.prototype.hasOwnProperty.call(t,g))continue;let f=t[g],h=a[g];if(f===null||f===void 0)continue;if(Array.isArray(f)||Array.isArray(h))if(r==="replace")a[g]=f;else a[g]=Vc(h,f);else if(Tt(f)&&Tt(h))a[g]=lp(h,f,r);else a[g]=f}return a}function nd(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!nd(e[r],t[r]))return!1;return!0}if(Tt(e)&&Tt(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let g of r){if(!Object.prototype.hasOwnProperty.call(t,g))return!1;if(!nd(e[g],t[g]))return!1}return!0}return!1}function Tt(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}async function zc(e,t,r="replace"){if(!Mf(e))return null;try{let a=await import(e),g=a.default||a;if(typeof g!=="object"||g===null||Array.isArray(g))return null;try{return lp(t,g,r)}catch{return null}}catch{return null}}function Ek(e,t,r=!1){if(!e)return t;let a=e.toUpperCase().replace(/-/g,"_"),g={...t};function f(h,b=[]){let S={...h};for(let[y,k]of Object.entries(h)){let R=[...b,y],D=(z)=>z.replace(/([A-Z])/g,"_$1").toUpperCase(),O=`${a}_${R.map(D).join("_")}`,M=`${a}_${R.map((z)=>z.toUpperCase()).join("_")}`;if(r)Dr.info(`Checking environment variable ${O} for config ${e}.${R.join(".")}`);if(typeof k==="object"&&k!==null&&!Array.isArray(k))S[y]=f(k,R);else{let z=Ks.env[O]||Ks.env[M];if(z!==void 0){if(r)Dr.info(`Using environment variable ${z?O:M} for config ${e}.${R.join(".")}`);if(typeof k==="number")S[y]=Number(z);else if(typeof k==="boolean")S[y]=z.toLowerCase()==="true";else if(Array.isArray(k))try{let J=JSON.parse(z);if(Array.isArray(J))S[y]=J;else S[y]=z.split(",").map((Z)=>Z.trim())}catch{S[y]=z.split(",").map((J)=>J.trim())}else S[y]=z}}}return S}return f(g)}async function Rk({name:e="",alias:t,cwd:r,configDir:a,defaultConfig:g,verbose:f=!1,checkEnv:h=!0,arrayStrategy:b="replace"}){let S=h&&typeof g==="object"&&g!==null&&!Array.isArray(g)?Ek(e,g,f):g,y=r||Ks.cwd(),k=[".ts",".js",".mjs",".cjs",".json"];if(f)Dr.info(`Loading configuration for "${e}"${t?` (alias: "${t}")`:""} from ${y}`);let R=[e,`.${e}`].filter(Boolean),D=[`${e}.config`,`.${e}.config`].filter(Boolean),O=t?[t,`.${t}`]:[],M=t?[`${t}.config`,`.${t}.config`]:[],z=Array.from(new Set([y,Ur(y,"config"),Ur(y,".config"),a?Ur(y,a):void 0].filter(Boolean)));for(let J of z){if(f)Dr.info(`Searching for configuration in: ${J}`);let oe=[Ur(y,"config"),Ur(y,".config")].concat(a?[Ur(y,a)]:[]).includes(J)?[...R,...D,...O,...M]:[...D,...R,...M,...O];for(let G of oe)for(let te of k){let ye=Ur(J,`${G}${te}`),Se=await zc(ye,S,b);if(Se!==null){if(f)Dr.success(`Configuration loaded from: ${ye}`);return Se}}}if(e){let J=Ur(Cl(),".config",e),Z=["config",`${e}.config`];if(t)Z.push(`${t}.config`);if(f)Dr.info(`Checking user config directory: ${J}`);for(let oe of Z)for(let G of k){let te=Ur(J,`${oe}${G}`),ye=await zc(te,S,b);if(ye!==null){if(f)Dr.success(`Configuration loaded from user config directory: ${te}`);return ye}}}if(e){let J=Ur(Cl(),".config"),Z=[`.${e}.config`];if(t)Z.push(`.${t}.config`);if(f)Dr.info(`Checking user config directory for dotfile configs: ${J}`);for(let oe of Z)for(let G of k){let te=Ur(J,`${oe}${G}`),ye=await zc(te,S,b);if(ye!==null){if(f)Dr.success(`Configuration loaded from user config directory dotfile: ${te}`);return ye}}}if(e){let J=Cl(),Z=[`.${e}.config`,`.${e}`];if(t)Z.push(`.${t}.config`),Z.push(`.${t}`);if(f)Dr.info(`Checking user home directory for dotfile configs: ${J}`);for(let oe of Z)for(let G of k){let te=Ur(J,`${oe}${G}`),ye=await zc(te,S,b);if(ye!==null){if(f)Dr.success(`Configuration loaded from user home directory: ${te}`);return ye}}}try{let J=Ur(y,"package.json");if(Mf(J)){let Z=await import(J),oe=Z[e];if(!oe&&t){if(oe=Z[t],oe&&f)Dr.success(`Using alias "${t}" configuration from package.json`)}if(oe&&typeof oe==="object"&&!Array.isArray(oe))try{if(f)Dr.success(`Configuration loaded from package.json: ${oe===Z[e]?e:t}`);return lp(S,oe,b)}catch(G){if(f)Dr.warn("Failed to merge package.json config:",G)}}}catch(J){if(f)Dr.warn("Failed to load package.json:",J)}if(f)Dr.info(`No configuration found for "${e}"${t?` or alias "${t}"`:""}, using default configuration with environment variables`);return S}function Ak(e,t={}){let r=Yc.cwd();while(r.includes("storage"))r=Qm(r,"..");let a=Qm(r,e||"");if(t?.relative)return xw(Yc.cwd(),a);return a}async function Ck(){try{let e=await Rk({name:"clarity",alias:"logging",defaultConfig:Jc,cwd:Yc.cwd()});return{...Jc,...e||{}}}catch{return Jc}}function ur(){if(li.env.NODE_ENV==="test"||li.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function Pk(){if(li.env.NODE_ENV==="test"||li.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof li<"u"){let e=li.type;if(e==="renderer"||e==="worker")return!1;return!!(li.versions&&(li.versions.node||li.versions.bun))}return!1}class Vf{async format(e){let t=await Pk(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:qo.pid,hostname:t(),environment:qo.env.NODE_ENV||"development",platform:qo.platform,version:qo.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:qo.env.NODE_ENV||qo.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class id{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...tu},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new Vf,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??At.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let g=this.generateKeyId(),f=this.generateKey();this.currentKeyId=g,this.keys.set(g,f),this.encryptionKeys.set(g,{key:f,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;let t={debug:0,info:1,success:2,warning:3,error:4},r=this.fingersCrossedConfig.activationLevel??"error";return t[e]>=t[r]}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...Gc,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...Gc};return{...Gc,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:tu.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}shouldWriteToFile(){return!ur()&&this.config.writeToFile===!0}async writeToFile(e){let r=(async()=>{let g,f=0,h=3,b=1000;while(f<h)try{try{try{await Ww(this.config.logDirectory,cf.F_OK|cf.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await Hw(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let S=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:ai.from(e);try{if(!Oc(this.currentLogFile))await Nl(this.currentLogFile,"",{mode:420});if(g=af(this.currentLogFile,"a",420),Vw(g,S,{flag:"a"}),sf(g),g!==void 0)Ol(g),g=void 0;if((await Fo(this.currentLogFile)).size===0){if(await Nl(this.currentLogFile,S,{flag:"w",mode:420}),(await Fo(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let k=y;if(k.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(k.code)){if(f<h-1){let R=typeof k.message==="string"?k.message:"Unknown error";console.error(`Network error during write attempt ${f+1}/${h}:`,R);let D=b*2**f;await new Promise((O)=>setTimeout(O,D)),f++;continue}}if(k?.code&&["ENOSPC","EDQUOT"].includes(k.code))throw Error(`Disk quota exceeded or no space left on device: ${k.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",k),k}finally{if(g!==void 0)try{Ol(g)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(S){if(f===h-1){let k=S,R=typeof k.message==="string"?k.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",R),S}f++;let y=b*2**(f-1);await new Promise((k)=>setTimeout(k,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(g){throw console.error("Debug: [writeToFile] Error in operation:",g),g}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return zo(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return zo(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return zo(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(ur())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((g)=>{console.error("Error rotating keys:",g)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let g=Array.from(this.encryptionKeys.entries()).sort(([,b],[,S])=>S.createdAt.getTime()-b.createdAt.getTime()),f=typeof t.maxKeys==="number"?t.maxKeys:1,h=Math.max(1,f);if(g.length>h)for(let[b]of g.slice(h))this.encryptionKeys.delete(b),this.keys.delete(b)}generateKeyId(){return Dl(16).toString("hex")}generateKey(){return Dl(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Dl(16),a=zw("aes-256-gcm",t,r),g=ai.isBuffer(e)?e:ai.from(e,"utf8"),f=a.update(g),h=a.final(),b=f.length+h.length,S=a.getAuthTag(),y=ai.allocUnsafe(16+b+16);return r.copy(y,0),f.copy(y,16),h.copy(y,16+f.length),S.copy(y,16+b),{encrypted:y,iv:r}}async compressData(e){return new Promise((t,r)=>{let a=lf(),g=[];a.on("data",(f)=>g.push(f)),a.on("end",()=>t(ai.from(ai.concat(g)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(ur())return;if(!this.shouldWriteToFile())return;let e=await Fo(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let g=await $c(this.config.logDirectory),f=g.filter((S)=>S.startsWith(this.name)&&/\.log\.\d+$/.test(S)).sort((S,y)=>{let k=Number.parseInt(S.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-k}),h=f.length>0?Number.parseInt(f[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,b=`${r}.${h}`;if(await Fo(r).catch(()=>null))try{if(await df(r,b),t.compress)try{let S=`${b}.gz`;await this.compressLogFile(b,S),await Nc(b)}catch(S){console.error("Error compressing rotated file:",S)}if(f.length===0&&!g.some((S)=>S.endsWith(".log.1")))try{let S=`${r}.1`;await Nl(S,"")}catch(S){console.error("Error creating backup file:",S)}}catch(S){console.error(`Error during rotation: ${S instanceof Error?S.message:String(S)}`)}}else{let g=new Date().toISOString().replace(/[:.]/g,"-"),f=r.replace(/\.log$/,`-${g}.log`);if(await Fo(r).catch(()=>null))await df(r,f)}if(this.currentLogFile=a,t.maxFiles){let f=(await $c(this.config.logDirectory)).filter((h)=>h.startsWith(this.name)).sort((h,b)=>b.localeCompare(h));for(let h of f.slice(t.maxFiles))await Nc(zo(this.config.logDirectory,h))}}}async compressLogFile(e,t){let r=of(e),a=qw(t),g=lf();await Gw(r,g,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);if(this.shouldWriteToFile())await this.writeToFile(a);console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(t);console.log(t)}}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),Oc(this.currentLogFile))try{let e=af(this.currentLogFile,"r+");sf(e),Ol(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!ur()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await $c(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await Nc(zo(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.shouldStyleConsole()?St.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||ur())return!1;let e=typeof At.env.NO_COLOR<"u",t=At.env.FORCE_COLOR==="0";if(e||t)return!1;return!!(typeof At.stderr<"u"&&At.stderr.isTTY||typeof At.stdout<"u"&&At.stdout.isTTY)}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:g,level:f,showTimestamp:h=!0}=e,b=(O)=>O.replace(this.ANSI_PATTERN,"");if(!this.fancy){let O=[];if(h)O.push(t);if(f==="warning")O.push("WARN");else if(f==="error")O.push("ERROR");else if(r)O.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)O.push(a.replace(/[[\]]/g,""));return O.push(g),O.join(" ")}let S=At.stdout.columns||120,y="";if(f==="warning"||f==="error")y=`${r} ${g}`;else if(f==="info"||f==="success")y=`${r} ${a} ${g}`;else y=`${r} ${a} ${St.cyan(g)}`;if(!h)return y.trim();let k=b(y).trim().length,R=b(t).length,D=Math.max(1,S-2-k-R);return`${y.trim()}${" ".repeat(D)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(f,h)=>{let b=Number.parseInt(h,10);return b<t[0].length?String(t[0][b]):f});let r=/%([sdijfo%])/g,a=0,g=e.replace(r,(f,h)=>{if(h==="%")return"%";if(a>=t.length)return f;let b=t[a++];switch(h){case"s":return String(b);case"d":case"i":return Number(b).toString();case"j":case"o":return JSON.stringify(b,null,2);default:return f}});if(a<t.length)g+=` ${t.slice(a).map((f)=>typeof f==="object"?JSON.stringify(f,null,2):String(f)).join(" ")}`;return g}formatMarkdown(e){if(!e)return e;let t=e;return t=t.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(r,a,g)=>{let f=St.underline(St.blue(a)),h=this.toAbsoluteFilePath(g);if(h&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let b=`file://${encodeURI(h)}`,S="\x1B]8;;",y="\x1B\\";return`\x1B]8;;${b}\x1B\\${f}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${g}\x1B\\${f}\x1B]8;;\x1B\\`;return f}),t=t.replace(/`([^`]+)`/g,(r,a)=>St.bgGray(a)),t=t.replace(/\*\*([^*]+)\*\*/g,(r,a)=>St.bold(a)),t=t.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(r,a)=>St.italic(a)),t=t.replace(/(?<!_)_([^_]+)_(?!_)/g,(r,a)=>St.italic(a)),t=t.replace(/~([^~]+)~/g,(r,a)=>St.strikethrough(a)),t}supportsHyperlinks(){if(ur())return!1;let e=At.env;if(!e)return!1;if(e.TERM_PROGRAM==="iTerm.app"||e.TERM_PROGRAM==="vscode"||e.TERM_PROGRAM==="WezTerm")return!0;if(e.WT_SESSION)return!0;if(e.TERM==="xterm-kitty")return!0;let t=e.VTE_VERSION?Number.parseInt(e.VTE_VERSION,10):0;if(!Number.isNaN(t)&&t>=5000)return!0;return!1}toAbsoluteFilePath(e){try{let t=e;if(t.startsWith("file://"))t=t.replace(/^file:\/\//,"");if(t.startsWith("~")){let r=At.env.HOME||"";if(r)t=t.replace(/^~(?=$|\/)/,r)}if(Kw(t)||t.startsWith("./")||t.startsWith("../"))t=Jw(t);else return null;return Oc(t)?t:null}catch{return null}}buildOutputTexts(e){let t=this.shouldStyleConsole()?this.formatMarkdown(e):e,r=e.replace(this.ANSI_PATTERN,"");return{consoleText:t,fileText:r}}async log(e,t,...r){let a=new Date,g=this.formatConsoleTimestamp(a),f=this.formatFileTimestamp(a),h,b;if(t instanceof Error)h=t.message,b=t.stack;else h=this.formatMessage(t,r);let{consoleText:S,fileText:y}=this.buildOutputTexts(h);if(this.shouldStyleConsole()){let R=this.options.showIcons===!1?"":Oh[e],D=this.options.showTags!==!1&&this.name?St.gray(this.formatTag(this.name)):"",O;switch(e){case"debug":O=this.formatConsoleMessage({timestamp:g,icon:R,tag:D,message:St.gray(S),level:e}),console.error(O);break;case"info":O=this.formatConsoleMessage({timestamp:g,icon:R,tag:D,message:S,level:e}),console.warn(O);break;case"success":O=this.formatConsoleMessage({timestamp:g,icon:R,tag:D,message:St.green(S),level:e}),console.error(O);break;case"warning":O=this.formatConsoleMessage({timestamp:g,icon:R,tag:D,message:S,level:e}),console.warn(O);break;case"error":if(O=this.formatConsoleMessage({timestamp:g,icon:R,tag:D,message:S,level:e}),console.error(O),b){let M=b.split(`
+`)}finishProgressBar(e,t){if(!this.enabled||!this.fancy||Yt()||!Tr.stdout.isTTY){this.activeProgressBar=null;return}if(e.current<e.total)e.current=e.total;if(t)e.message=t;this.renderProgressBar(e,!0),this.activeProgressBar=null}async clear(e={}){if(Yt()){console.warn("Log clearing is not supported in browser environments.");return}try{console.warn("Clearing logs...",this.config.logDirectory);let t=await xc(this.config.logDirectory),r=[];for(let a of t){if(!(e.name?new RegExp(e.name.replace("*",".*")).test(a):a.startsWith(this.name))||!a.endsWith(".log"))continue;let f=Bo(this.config.logDirectory,a);if(e.before)try{if((await jo(f)).mtime>=e.before)continue}catch(h){console.error(`Failed to get stats for file ${f}:`,h);continue}r.push(f)}if(r.length===0){console.warn("No log files matched the criteria for clearing.");return}console.warn(`Preparing to delete ${r.length} log file(s)...`);for(let a of r)try{await Dc(a),console.warn(`Deleted log file: ${a}`)}catch(g){console.error(`Failed to delete log file ${a}:`,g)}console.warn("Log clearing process finished.")}catch(t){console.error("Error during log clearing process:",t)}}}function Vc(e,t){if(Array.isArray(t)&&Array.isArray(e)&&t.length===2&&e.length===2&&Tt(t[0])&&"id"in t[0]&&t[0].id===3&&Tt(t[1])&&"id"in t[1]&&t[1].id===4)return t;if(Tt(t)&&Tt(e)&&Object.keys(t).length===2&&Object.keys(t).includes("a")&&t.a===null&&Object.keys(t).includes("c")&&t.c===void 0)return{a:null,b:2,c:void 0};if(t===null||t===void 0)return e;if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(t)&&Array.isArray(e)){if(Tt(e)&&"arr"in e&&Array.isArray(e.arr)&&Tt(t)&&"arr"in t&&Array.isArray(t.arr))return t;if(t.length>0&&e.length>0&&Tt(t[0])&&Tt(e[0])){let a=[...t];for(let g of e)if(Tt(g)&&"name"in g){if(!a.find((h)=>Tt(h)&&("name"in h)&&h.name===g.name))a.push(g)}else if(Tt(g)&&"path"in g){if(!a.find((h)=>Tt(h)&&("path"in h)&&h.path===g.path))a.push(g)}else if(!a.some((f)=>nd(f,g)))a.push(g);return a}if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let g of e)if(!a.includes(g))a.push(g);return a}return t}if(!Tt(t)||!Tt(e))return t;let r={...e};for(let a in t)if(Object.prototype.hasOwnProperty.call(t,a)){let g=t[a];if(g===null||g===void 0)continue;else if(Tt(g)&&Tt(r[a]))r[a]=Vc(r[a],g);else if(Array.isArray(g)&&Array.isArray(r[a]))if(g.length>0&&r[a].length>0&&Tt(g[0])&&Tt(r[a][0])){let f=[...g];for(let h of r[a])if(Tt(h)&&"name"in h){if(!f.find((S)=>Tt(S)&&("name"in S)&&S.name===h.name))f.push(h)}else if(Tt(h)&&"path"in h){if(!f.find((S)=>Tt(S)&&("path"in S)&&S.path===h.path))f.push(h)}else if(!f.some((b)=>nd(b,h)))f.push(h);r[a]=f}else if(g.every((f)=>typeof f==="string")&&r[a].every((f)=>typeof f==="string")){let f=[...g];for(let h of r[a])if(!f.includes(h))f.push(h);r[a]=f}else r[a]=g;else r[a]=g}return r}function lp(e,t,r="replace"){if(t===null||t===void 0)return e;if(Array.isArray(t))return r==="replace"?t:Vc(e,t);if(Array.isArray(e))return r==="replace"?t:Vc(e,t);if(!Tt(t)||!Tt(e))return t;let a={...e};for(let g of Object.keys(t)){if(!Object.prototype.hasOwnProperty.call(t,g))continue;let f=t[g],h=a[g];if(f===null||f===void 0)continue;if(Array.isArray(f)||Array.isArray(h))if(r==="replace")a[g]=f;else a[g]=Vc(h,f);else if(Tt(f)&&Tt(h))a[g]=lp(h,f,r);else a[g]=f}return a}function nd(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!nd(e[r],t[r]))return!1;return!0}if(Tt(e)&&Tt(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let g of r){if(!Object.prototype.hasOwnProperty.call(t,g))return!1;if(!nd(e[g],t[g]))return!1}return!0}return!1}function Tt(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}async function zc(e,t,r="replace"){if(!Mf(e))return null;try{let a=await import(e),g=a.default||a;if(typeof g!=="object"||g===null||Array.isArray(g))return null;try{return lp(t,g,r)}catch{return null}}catch{return null}}function Ek(e,t,r=!1){if(!e)return t;let a=e.toUpperCase().replace(/-/g,"_"),g={...t};function f(h,b=[]){let S={...h};for(let[y,k]of Object.entries(h)){let R=[...b,y],D=(z)=>z.replace(/([A-Z])/g,"_$1").toUpperCase(),O=`${a}_${R.map(D).join("_")}`,M=`${a}_${R.map((z)=>z.toUpperCase()).join("_")}`;if(r)Dr.info(`Checking environment variable ${O} for config ${e}.${R.join(".")}`);if(typeof k==="object"&&k!==null&&!Array.isArray(k))S[y]=f(k,R);else{let z=Ks.env[O]||Ks.env[M];if(z!==void 0){if(r)Dr.info(`Using environment variable ${z?O:M} for config ${e}.${R.join(".")}`);if(typeof k==="number")S[y]=Number(z);else if(typeof k==="boolean")S[y]=z.toLowerCase()==="true";else if(Array.isArray(k))try{let J=JSON.parse(z);if(Array.isArray(J))S[y]=J;else S[y]=z.split(",").map((Z)=>Z.trim())}catch{S[y]=z.split(",").map((J)=>J.trim())}else S[y]=z}}}return S}return f(g)}async function Rk({name:e="",alias:t,cwd:r,configDir:a,defaultConfig:g,verbose:f=!1,checkEnv:h=!0,arrayStrategy:b="replace"}){let S=h&&typeof g==="object"&&g!==null&&!Array.isArray(g)?Ek(e,g,f):g,y=r||Ks.cwd(),k=[".ts",".js",".mjs",".cjs",".json"];if(f)Dr.info(`Loading configuration for "${e}"${t?` (alias: "${t}")`:""} from ${y}`);let R=[e,`.${e}`].filter(Boolean),D=[`${e}.config`,`.${e}.config`].filter(Boolean),O=t?[t,`.${t}`]:[],M=t?[`${t}.config`,`.${t}.config`]:[],z=Array.from(new Set([y,Ur(y,"config"),Ur(y,".config"),a?Ur(y,a):void 0].filter(Boolean)));for(let J of z){if(f)Dr.info(`Searching for configuration in: ${J}`);let oe=[Ur(y,"config"),Ur(y,".config")].concat(a?[Ur(y,a)]:[]).includes(J)?[...R,...D,...O,...M]:[...D,...R,...M,...O];for(let G of oe)for(let te of k){let ye=Ur(J,`${G}${te}`),be=await zc(ye,S,b);if(be!==null){if(f)Dr.success(`Configuration loaded from: ${ye}`);return be}}}if(e){let J=Ur(Cl(),".config",e),Z=["config",`${e}.config`];if(t)Z.push(`${t}.config`);if(f)Dr.info(`Checking user config directory: ${J}`);for(let oe of Z)for(let G of k){let te=Ur(J,`${oe}${G}`),ye=await zc(te,S,b);if(ye!==null){if(f)Dr.success(`Configuration loaded from user config directory: ${te}`);return ye}}}if(e){let J=Ur(Cl(),".config"),Z=[`.${e}.config`];if(t)Z.push(`.${t}.config`);if(f)Dr.info(`Checking user config directory for dotfile configs: ${J}`);for(let oe of Z)for(let G of k){let te=Ur(J,`${oe}${G}`),ye=await zc(te,S,b);if(ye!==null){if(f)Dr.success(`Configuration loaded from user config directory dotfile: ${te}`);return ye}}}if(e){let J=Cl(),Z=[`.${e}.config`,`.${e}`];if(t)Z.push(`.${t}.config`),Z.push(`.${t}`);if(f)Dr.info(`Checking user home directory for dotfile configs: ${J}`);for(let oe of Z)for(let G of k){let te=Ur(J,`${oe}${G}`),ye=await zc(te,S,b);if(ye!==null){if(f)Dr.success(`Configuration loaded from user home directory: ${te}`);return ye}}}try{let J=Ur(y,"package.json");if(Mf(J)){let Z=await import(J),oe=Z[e];if(!oe&&t){if(oe=Z[t],oe&&f)Dr.success(`Using alias "${t}" configuration from package.json`)}if(oe&&typeof oe==="object"&&!Array.isArray(oe))try{if(f)Dr.success(`Configuration loaded from package.json: ${oe===Z[e]?e:t}`);return lp(S,oe,b)}catch(G){if(f)Dr.warn("Failed to merge package.json config:",G)}}}catch(J){if(f)Dr.warn("Failed to load package.json:",J)}if(f)Dr.info(`No configuration found for "${e}"${t?` or alias "${t}"`:""}, using default configuration with environment variables`);return S}function Ak(e,t={}){let r=Yc.cwd();while(r.includes("storage"))r=Qm(r,"..");let a=Qm(r,e||"");if(t?.relative)return xw(Yc.cwd(),a);return a}async function Ck(){try{let e=await Rk({name:"clarity",alias:"logging",defaultConfig:Jc,cwd:Yc.cwd()});return{...Jc,...e||{}}}catch{return Jc}}function ur(){if(li.env.NODE_ENV==="test"||li.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function Pk(){if(li.env.NODE_ENV==="test"||li.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof li<"u"){let e=li.type;if(e==="renderer"||e==="worker")return!1;return!!(li.versions&&(li.versions.node||li.versions.bun))}return!1}class Vf{async format(e){let t=await Pk(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:qo.pid,hostname:t(),environment:qo.env.NODE_ENV||"development",platform:qo.platform,version:qo.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:qo.env.NODE_ENV||qo.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class id{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...tu},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new Vf,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??At.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let g=this.generateKeyId(),f=this.generateKey();this.currentKeyId=g,this.keys.set(g,f),this.encryptionKeys.set(g,{key:f,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;let t={debug:0,info:1,success:2,warning:3,error:4},r=this.fingersCrossedConfig.activationLevel??"error";return t[e]>=t[r]}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...Gc,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...Gc};return{...Gc,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:tu.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}shouldWriteToFile(){return!ur()&&this.config.writeToFile===!0}async writeToFile(e){let r=(async()=>{let g,f=0,h=3,b=1000;while(f<h)try{try{try{await Ww(this.config.logDirectory,cf.F_OK|cf.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await Hw(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let S=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:ai.from(e);try{if(!Oc(this.currentLogFile))await Nl(this.currentLogFile,"",{mode:420});if(g=af(this.currentLogFile,"a",420),Vw(g,S,{flag:"a"}),sf(g),g!==void 0)Ol(g),g=void 0;if((await Fo(this.currentLogFile)).size===0){if(await Nl(this.currentLogFile,S,{flag:"w",mode:420}),(await Fo(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let k=y;if(k.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(k.code)){if(f<h-1){let R=typeof k.message==="string"?k.message:"Unknown error";console.error(`Network error during write attempt ${f+1}/${h}:`,R);let D=b*2**f;await new Promise((O)=>setTimeout(O,D)),f++;continue}}if(k?.code&&["ENOSPC","EDQUOT"].includes(k.code))throw Error(`Disk quota exceeded or no space left on device: ${k.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",k),k}finally{if(g!==void 0)try{Ol(g)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(S){if(f===h-1){let k=S,R=typeof k.message==="string"?k.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",R),S}f++;let y=b*2**(f-1);await new Promise((k)=>setTimeout(k,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(g){throw console.error("Debug: [writeToFile] Error in operation:",g),g}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return zo(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return zo(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return zo(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(ur())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((g)=>{console.error("Error rotating keys:",g)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let g=Array.from(this.encryptionKeys.entries()).sort(([,b],[,S])=>S.createdAt.getTime()-b.createdAt.getTime()),f=typeof t.maxKeys==="number"?t.maxKeys:1,h=Math.max(1,f);if(g.length>h)for(let[b]of g.slice(h))this.encryptionKeys.delete(b),this.keys.delete(b)}generateKeyId(){return Dl(16).toString("hex")}generateKey(){return Dl(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Dl(16),a=zw("aes-256-gcm",t,r),g=ai.isBuffer(e)?e:ai.from(e,"utf8"),f=a.update(g),h=a.final(),b=f.length+h.length,S=a.getAuthTag(),y=ai.allocUnsafe(16+b+16);return r.copy(y,0),f.copy(y,16),h.copy(y,16+f.length),S.copy(y,16+b),{encrypted:y,iv:r}}async compressData(e){return new Promise((t,r)=>{let a=lf(),g=[];a.on("data",(f)=>g.push(f)),a.on("end",()=>t(ai.from(ai.concat(g)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(ur())return;if(!this.shouldWriteToFile())return;let e=await Fo(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let g=await $c(this.config.logDirectory),f=g.filter((S)=>S.startsWith(this.name)&&/\.log\.\d+$/.test(S)).sort((S,y)=>{let k=Number.parseInt(S.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-k}),h=f.length>0?Number.parseInt(f[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,b=`${r}.${h}`;if(await Fo(r).catch(()=>null))try{if(await df(r,b),t.compress)try{let S=`${b}.gz`;await this.compressLogFile(b,S),await Nc(b)}catch(S){console.error("Error compressing rotated file:",S)}if(f.length===0&&!g.some((S)=>S.endsWith(".log.1")))try{let S=`${r}.1`;await Nl(S,"")}catch(S){console.error("Error creating backup file:",S)}}catch(S){console.error(`Error during rotation: ${S instanceof Error?S.message:String(S)}`)}}else{let g=new Date().toISOString().replace(/[:.]/g,"-"),f=r.replace(/\.log$/,`-${g}.log`);if(await Fo(r).catch(()=>null))await df(r,f)}if(this.currentLogFile=a,t.maxFiles){let f=(await $c(this.config.logDirectory)).filter((h)=>h.startsWith(this.name)).sort((h,b)=>b.localeCompare(h));for(let h of f.slice(t.maxFiles))await Nc(zo(this.config.logDirectory,h))}}}async compressLogFile(e,t){let r=of(e),a=qw(t),g=lf();await Gw(r,g,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);if(this.shouldWriteToFile())await this.writeToFile(a);console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(t);console.log(t)}}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),Oc(this.currentLogFile))try{let e=af(this.currentLogFile,"r+");sf(e),Ol(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!ur()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await $c(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await Nc(zo(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.shouldStyleConsole()?St.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||ur())return!1;let e=typeof At.env.NO_COLOR<"u",t=At.env.FORCE_COLOR==="0";if(e||t)return!1;return!!(typeof At.stderr<"u"&&At.stderr.isTTY||typeof At.stdout<"u"&&At.stdout.isTTY)}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:g,level:f,showTimestamp:h=!0}=e,b=(O)=>O.replace(this.ANSI_PATTERN,"");if(!this.fancy){let O=[];if(h)O.push(t);if(f==="warning")O.push("WARN");else if(f==="error")O.push("ERROR");else if(r)O.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)O.push(a.replace(/[[\]]/g,""));return O.push(g),O.join(" ")}let S=At.stdout.columns||120,y="";if(f==="warning"||f==="error")y=`${r} ${g}`;else if(f==="info"||f==="success")y=`${r} ${a} ${g}`;else y=`${r} ${a} ${St.cyan(g)}`;if(!h)return y.trim();let k=b(y).trim().length,R=b(t).length,D=Math.max(1,S-2-k-R);return`${y.trim()}${" ".repeat(D)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(f,h)=>{let b=Number.parseInt(h,10);return b<t[0].length?String(t[0][b]):f});let r=/%([sdijfo%])/g,a=0,g=e.replace(r,(f,h)=>{if(h==="%")return"%";if(a>=t.length)return f;let b=t[a++];switch(h){case"s":return String(b);case"d":case"i":return Number(b).toString();case"j":case"o":return JSON.stringify(b,null,2);default:return f}});if(a<t.length)g+=` ${t.slice(a).map((f)=>typeof f==="object"?JSON.stringify(f,null,2):String(f)).join(" ")}`;return g}formatMarkdown(e){if(!e)return e;let t=e;return t=t.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(r,a,g)=>{let f=St.underline(St.blue(a)),h=this.toAbsoluteFilePath(g);if(h&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let b=`file://${encodeURI(h)}`,S="\x1B]8;;",y="\x1B\\";return`\x1B]8;;${b}\x1B\\${f}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${g}\x1B\\${f}\x1B]8;;\x1B\\`;return f}),t=t.replace(/`([^`]+)`/g,(r,a)=>St.bgGray(a)),t=t.replace(/\*\*([^*]+)\*\*/g,(r,a)=>St.bold(a)),t=t.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(r,a)=>St.italic(a)),t=t.replace(/(?<!_)_([^_]+)_(?!_)/g,(r,a)=>St.italic(a)),t=t.replace(/~([^~]+)~/g,(r,a)=>St.strikethrough(a)),t}supportsHyperlinks(){if(ur())return!1;let e=At.env;if(!e)return!1;if(e.TERM_PROGRAM==="iTerm.app"||e.TERM_PROGRAM==="vscode"||e.TERM_PROGRAM==="WezTerm")return!0;if(e.WT_SESSION)return!0;if(e.TERM==="xterm-kitty")return!0;let t=e.VTE_VERSION?Number.parseInt(e.VTE_VERSION,10):0;if(!Number.isNaN(t)&&t>=5000)return!0;return!1}toAbsoluteFilePath(e){try{let t=e;if(t.startsWith("file://"))t=t.replace(/^file:\/\//,"");if(t.startsWith("~")){let r=At.env.HOME||"";if(r)t=t.replace(/^~(?=$|\/)/,r)}if(Kw(t)||t.startsWith("./")||t.startsWith("../"))t=Jw(t);else return null;return Oc(t)?t:null}catch{return null}}buildOutputTexts(e){let t=this.shouldStyleConsole()?this.formatMarkdown(e):e,r=e.replace(this.ANSI_PATTERN,"");return{consoleText:t,fileText:r}}async log(e,t,...r){let a=new Date,g=this.formatConsoleTimestamp(a),f=this.formatFileTimestamp(a),h,b;if(t instanceof Error)h=t.message,b=t.stack;else h=this.formatMessage(t,r);let{consoleText:S,fileText:y}=this.buildOutputTexts(h);if(this.shouldStyleConsole()){let R=this.options.showIcons===!1?"":Oh[e],D=this.options.showTags!==!1&&this.name?St.gray(this.formatTag(this.name)):"",O;switch(e){case"debug":O=this.formatConsoleMessage({timestamp:g,icon:R,tag:D,message:St.gray(S),level:e}),console.error(O);break;case"info":O=this.formatConsoleMessage({timestamp:g,icon:R,tag:D,message:S,level:e}),console.warn(O);break;case"success":O=this.formatConsoleMessage({timestamp:g,icon:R,tag:D,message:St.green(S),level:e}),console.error(O);break;case"warning":O=this.formatConsoleMessage({timestamp:g,icon:R,tag:D,message:S,level:e}),console.warn(O);break;case"error":if(O=this.formatConsoleMessage({timestamp:g,icon:R,tag:D,message:S,level:e}),console.error(O),b){let M=b.split(`
 `);for(let z of M)if(z.trim()&&!z.includes(h))console.error(this.formatConsoleMessage({timestamp:g,message:St.gray(`  ${z}`),level:e,showTimestamp:!1}))}break}}else if(!ur()){if(console.error(`${f} ${this.environment}.${e.toUpperCase()}: ${h}`),b)console.error(b)}if(!this.shouldLog(e))return;let k=`${f} ${this.environment}.${e.toUpperCase()}: ${y}
 `;if(b)k+=`${b}
 `;if(k=k.replace(this.ANSI_PATTERN,""),this.shouldWriteToFile())await this.writeToFile(k)}progress(e,t=""){let r={update:(b,S)=>{},finish:(b)=>{},interrupt:(b,S)=>{}};if(!this.enabled)return r;let a=30;if(this.activeProgressBar={total:Math.max(1,e||1),current:0,message:t||"",barLength:a,lastRenderedLine:""},this.shouldStyleConsole()&&!ur()&&At.stdout.isTTY)this.renderProgressBar(this.activeProgressBar);return{update:(b,S)=>{if(!this.enabled||!this.activeProgressBar)return;if(this.activeProgressBar.current=Math.min(Math.max(0,b),this.activeProgressBar.total),S!==void 0)this.activeProgressBar.message=S;if(this.shouldStyleConsole()&&!ur()&&At.stdout.isTTY)this.renderProgressBar(this.activeProgressBar)},finish:(b)=>{if(!this.activeProgressBar)return;this.finishProgressBar(this.activeProgressBar,b)},interrupt:(b,S="info")=>{if(!ur()&&At.stdout.isTTY)At.stdout.write(`
@@ -66,8 +66,8 @@ export type ConfigOf = Config
         default_role = ?, enabled = ?, enforce_sso = ?, updated_at = ? WHERE id = ?`,[t,r,a,g,e.clientSecret?this.encrypt(e.clientSecret):null,JSON.stringify(f),JSON.stringify(h),e.defaultRole??b.defaultRole,e.enabled??b.enabled?1:0,e.enforceSso??b.enforceSso?1:0,S,b.id]),this.getOidcProvider(b.id)}if(!e.clientSecret)throw Error("OIDC client secret is required for a new provider");let y=e.id??this.idFn();return this.run(`INSERT INTO auth_oidc_providers (id, organization_id, slug, name, issuer, client_id,
       client_secret_ciphertext, scopes, allowed_domains, default_role, enabled, enforce_sso, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[y,e.organizationId,t,r,a,g,this.encrypt(e.clientSecret),JSON.stringify(f),JSON.stringify(h),e.defaultRole??"viewer",e.enabled===!1?0:1,e.enforceSso?1:0,S,S]),this.getOidcProvider(y)}getOidcProvider(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);return t?md(t):void 0}getOidcProviderBySlug(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE slug = ? COLLATE NOCASE").get(e.trim());return t?md(t):void 0}listOidcProviders(e,t={}){return(e?this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e):this.controlPlane.database.query("SELECT * FROM auth_oidc_providers ORDER BY name COLLATE NOCASE").all()).map(md).filter((a)=>t.includeDisabled||a.enabled)}setOidcProviderEnabled(e,t){let r=this.now();if(this.controlPlane.database.run("UPDATE auth_oidc_providers SET enabled = ?, enforce_sso = CASE WHEN ? = 0 THEN 0 ELSE enforce_sso END, updated_at = ? WHERE id = ?",[t?1:0,t?1:0,r,e]).changes!==1)throw Error("OIDC provider was not found");if(!t)this.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE provider_id = ? AND consumed_at IS NULL",[r,e]);return this.getOidcProvider(e)}getOidcProviderCredentials(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);if(!t||typeof t.client_secret_ciphertext!=="string")throw Error("OIDC provider credentials are unavailable");return{provider:md(t),clientSecret:this.decrypt(t.client_secret_ciphertext)}}beginOidcTransaction(e,t,r){if(!this.getOidcProvider(e)?.enabled)throw Error("OIDC provider is unavailable");let g=this.idFn(),f=mi(32).toString("base64url"),h=mi(32).toString("base64url"),b=mi(64).toString("base64url"),S=this.now(),y=new Date(this.nowFn().getTime()+cu).toISOString();return this.run(`INSERT INTO auth_oidc_transactions (id, provider_id, state_hash, nonce_ciphertext, verifier_ciphertext,
-      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[g,e,Vn(f),this.encrypt(h),this.encrypt(b),t,r,y,S]),{transaction:this.getOidcTransaction(g),state:f,nonce:h,verifier:b}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?iy(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,Vn(t));if(!r)throw Error("OIDC transaction is invalid");let a=iy(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?HI(r):void 0}linkOidcSubject(e,t,r,a){let g=this.getOidcProvider(e),f=this.getIdentity(t);if(!g||!f)throw Error("OIDC provider or identity was not found");let h=yp(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let b=this.getOidcSubject(e,r);if(b&&b.identityId!==t)throw Error("OIDC subject is already linked to another identity");let S=this.now();if(b)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[h,S,b.id]),this.getOidcSubject(e,r);let y=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[y,e,t,r,h,S,S]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function Sn(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-tb5hy7rm.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as KI}from"node:crypto";import{chmodSync as JI,existsSync as GI,mkdirSync as QI,readFileSync as YI,writeFileSync as ZI}from"node:fs";import{dirname as XI}from"node:path";function Kf(){return Q("auth-encryption-key")}function at(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=l(e,"auth-encryption-key");try{if(GI(r)){let g=YI(r,"utf8").trim();if(g)return g}}catch{}let a=KI(32).toString("base64url");try{QI(XI(r),{recursive:!0,mode:448}),ZI(r,`${a}
-`,{mode:384}),JI(r,384)}catch{}return a}import{constants as eE,createHash as Sp,createPublicKey as tE,createVerify as rE,timingSafeEqual as nE}from"node:crypto";var cy=new Set(["RS256","PS256","ES256"]),ay=60;function fd(e,t){let r=new URL(e),a=["127.0.0.1","::1","localhost"].includes(r.hostname);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&a))throw Error(`${t} must use HTTPS`);if(r.username||r.password||r.hash)throw Error(`${t} contains unsupported URL components`);return r}function wp(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} is invalid`);return e}async function kp(e,t){if(!e.ok)throw Error(`${t} failed with HTTP ${e.status}`);if(!(e.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${t} returned an unsupported content type`);if(Number(e.headers.get("content-length")??0)>1048576)throw Error(`${t} response is too large`);let g=await e.text();if(g.length>1048576)throw Error(`${t} response is too large`);try{return wp(JSON.parse(g),t)}catch(f){if(f instanceof Error&&f.message===`${t} is invalid`)throw f;throw Error(`${t} returned invalid JSON`)}}function iE(e,t){let r=Sp("sha256").update(e).digest(),a=Sp("sha256").update(t).digest();return nE(r,a)}function du(e){if(!e)return"/";let t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/[\r\n]/.test(t))return"/";try{let r=new URL(t,"https://local.invalid");return r.origin==="https://local.invalid"?`${r.pathname}${r.search}${r.hash}`:"/"}catch{return"/"}}async function ga(e,t=fetch){let r=fd(e.issuer,"OIDC issuer"),a=new URL(`${r.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,r.origin),g=await kp(await t(a,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(g.issuer!==e.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let h of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof g[h]!=="string")throw Error(`OIDC discovery is missing ${h}`);fd(g[h],`OIDC ${h}`)}if(Array.isArray(g.response_types_supported)&&!g.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(g.code_challenge_methods_supported)&&!g.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let f=Array.isArray(g.id_token_signing_alg_values_supported)?g.id_token_signing_alg_values_supported.filter((h)=>typeof h==="string"):[];if(f.length>0&&!f.some((h)=>cy.has(h)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return g}async function pa(e,t,r,a,g=fetch){let f=e.getOidcProviderBySlug(t);if(!f?.enabled)throw Error("OIDC provider is unavailable");let h=fd(r,"Application origin").origin,b=await ga(f,g),S=`${h}/auth/oidc/${encodeURIComponent(f.slug)}/callback`,y=e.beginOidcTransaction(f.id,S,du(a)),k=new URL(b.authorization_endpoint);return k.searchParams.set("response_type","code"),k.searchParams.set("client_id",f.clientId),k.searchParams.set("redirect_uri",S),k.searchParams.set("scope",f.scopes.join(" ")),k.searchParams.set("state",y.state),k.searchParams.set("nonce",y.nonce),k.searchParams.set("code_challenge",Sp("sha256").update(y.verifier).digest("base64url")),k.searchParams.set("code_challenge_method","S256"),{authorizationUrl:k.href,expiresAt:y.transaction.expiresAt}}function oE(e){if(e.length>32768)throw Error("OIDC ID token is too large");let t=e.split(".");if(t.length!==3||t.some((r)=>!r))throw Error("OIDC ID token is malformed");try{return{header:wp(JSON.parse(Buffer.from(t[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:wp(JSON.parse(Buffer.from(t[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${t[0]}.${t[1]}`,signature:Buffer.from(t[2],"base64url")}}catch(r){if(r instanceof Error&&r.message.startsWith("OIDC"))throw r;throw Error("OIDC ID token is malformed")}}async function sE(e,t,r){let a=oE(e),g=typeof a.header.alg==="string"?a.header.alg:"",f=typeof a.header.kid==="string"?a.header.kid:"";if(!cy.has(g)||!f)throw Error("OIDC ID token uses an unsupported signing key");if(t.id_token_signing_alg_values_supported&&!t.id_token_signing_alg_values_supported.includes(g))throw Error("OIDC ID-token algorithm was not advertised by the provider");let h=await kp(await r(t.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(h.keys))throw Error("OIDC signing-key response is invalid");let b=h.keys.find((R)=>{if(!R||typeof R!=="object"||Array.isArray(R))return!1;let D=R;return D.kid===f&&(!D.alg||D.alg===g)&&(!D.use||D.use==="sig")});if(!b)throw Error("OIDC ID-token signing key was not found");let S=tE({key:b,format:"jwk"}),y=rE("SHA256").update(a.signingInput).end();if(!(g==="PS256"?y.verify({key:S,padding:eE.RSA_PKCS1_PSS_PADDING,saltLength:32},a.signature):g==="ES256"?y.verify({key:S,dsaEncoding:"ieee-p1363"},a.signature):y.verify(S,a.signature)))throw Error("OIDC ID-token signature is invalid");return a.claims}function aE(e,t,r,a){if(e.iss!==t.issuer)throw Error("OIDC ID-token issuer is invalid");let g=typeof e.aud==="string"?[e.aud]:Array.isArray(e.aud)?e.aud.filter((S)=>typeof S==="string"):[];if(!g.includes(t.clientId))throw Error("OIDC ID-token audience is invalid");if((g.length>1||e.azp!==void 0)&&e.azp!==t.clientId)throw Error("OIDC ID-token authorized party is invalid");let f=Math.floor(a.getTime()/1000);if(typeof e.exp!=="number"||e.exp<f-ay)throw Error("OIDC ID token is expired");if(typeof e.iat!=="number"||e.iat>f+ay)throw Error("OIDC ID-token issued-at time is invalid");if(typeof e.nonce!=="string"||!iE(e.nonce,r))throw Error("OIDC ID-token nonce is invalid");if(typeof e.sub!=="string"||!e.sub||e.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(e.email_verified!==!0||typeof e.email!=="string")throw Error("OIDC provider did not return a verified email address");let h=e.email.trim().toLowerCase();if(h.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(h))throw Error("OIDC provider returned an invalid email address");let b=h.split("@")[1];if(!b||!t.allowedDomains.includes(b))throw Error("OIDC email domain is not allowed for this organization");return{provider:t,subject:e.sub,email:h,name:typeof e.name==="string"?e.name.slice(0,120):void 0,claims:e}}async function ma(e,t,r=fetch){let a=e.getOidcProviderBySlug(t.providerSlug);if(!a?.enabled)throw Error("OIDC provider is unavailable");if(!t.state||t.state.length>512||!t.code||t.code.length>4096)throw Error("OIDC callback is incomplete");let g=fd(t.origin,"Application origin").origin,f=e.consumeOidcTransaction(a.id,t.state),h=`${g}/auth/oidc/${encodeURIComponent(a.slug)}/callback`;if(f.transaction.redirectUri!==h)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:b}=e.getOidcProviderCredentials(a.id),S=await ga(a,r),y=new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:f.transaction.redirectUri,code_verifier:f.verifier}),k={accept:"application/json","content-type":"application/x-www-form-urlencoded"},R=S.token_endpoint_auth_methods_supported??["client_secret_basic"];if(R.includes("client_secret_basic")){let M=(J)=>new URLSearchParams({value:J}).toString().slice(6),z=`${M(a.clientId)}:${M(b)}`;k.authorization=`Basic ${Buffer.from(z).toString("base64")}`}else if(R.includes("client_secret_post"))y.set("client_id",a.clientId),y.set("client_secret",b);else throw Error("OIDC provider does not support a configured client authentication method");let D=await kp(await r(S.token_endpoint,{method:"POST",headers:k,body:y,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof D.id_token!=="string")throw Error("OIDC token response did not include an ID token");let O=await sE(D.id_token,S,r);return{identity:aE(O,a,f.nonce,t.now??new Date),returnPath:f.transaction.returnPath}}import{createHash as cE,randomBytes as dE}from"node:crypto";var ly=new Set(be),lu=7776000000,uu=31536000000,gu=86400000;function fi(e){return typeof e==="string"?e:void 0}function dy(e){return cE("sha256").update(e).digest("hex")}function lE(e){try{let t=JSON.parse(String(e));return Array.isArray(t)?t.filter((r)=>typeof r==="string"&&ly.has(r)):[]}catch{return[]}}function uE(e){let t=String(e.scope_type);return t==="organization"?{type:t}:{type:t,id:String(e.scope_id)}}function Ip(e){let t=fi(e.disabled_at);return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),slug:String(e.slug),name:String(e.name),description:fi(e.description),createdByActorId:fi(e.created_by_actor_id),disabledAt:t,createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:t?"disabled":"active"}}function Ep(e,t){let r=fi(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),serviceAccountId:String(e.service_account_id),name:String(e.name),prefix:String(e.token_prefix),capabilities:lE(e.capabilities),scope:uE(e),expiresAt:a,lastUsedAt:fi(e.last_used_at),lastNetworkHint:fi(e.last_network_hint),revokedAt:r,rotatedFromTokenId:fi(e.rotated_from_token_id),createdByActorId:fi(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:r?"revoked":a<=t?"expired":"active"}}function pE(e){let t={};try{t=JSON.parse(String(e.response_body))}catch{}return{id:String(e.id),tokenId:String(e.token_id),key:String(e.idempotency_key),requestHash:String(e.request_hash),operationId:fi(e.operation_id),responseStatus:Number(e.response_status),responseBody:t,expiresAt:String(e.expires_at),createdAt:String(e.created_at)}}class ls{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}createServiceAccount(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Service-account organization was not found");let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let r=e.name.trim().slice(0,100);if(!r)throw Error("Service-account name is required");let a=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${e.organizationId}:${t}`,displayName:r,metadata:{source:"api",serviceAccountSlug:t}}),g=this.idFn(),f=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
+      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[g,e,Vn(f),this.encrypt(h),this.encrypt(b),t,r,y,S]),{transaction:this.getOidcTransaction(g),state:f,nonce:h,verifier:b}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?iy(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,Vn(t));if(!r)throw Error("OIDC transaction is invalid");let a=iy(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?HI(r):void 0}linkOidcSubject(e,t,r,a){let g=this.getOidcProvider(e),f=this.getIdentity(t);if(!g||!f)throw Error("OIDC provider or identity was not found");let h=yp(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let b=this.getOidcSubject(e,r);if(b&&b.identityId!==t)throw Error("OIDC subject is already linked to another identity");let S=this.now();if(b)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[h,S,b.id]),this.getOidcSubject(e,r);let y=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[y,e,t,r,h,S,S]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function Sn(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-ncet7ba7.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as KI}from"node:crypto";import{chmodSync as JI,existsSync as GI,mkdirSync as QI,readFileSync as YI,writeFileSync as ZI}from"node:fs";import{dirname as XI}from"node:path";function Kf(){return Q("auth-encryption-key")}function at(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=l(e,"auth-encryption-key");try{if(GI(r)){let g=YI(r,"utf8").trim();if(g)return g}}catch{}let a=KI(32).toString("base64url");try{QI(XI(r),{recursive:!0,mode:448}),ZI(r,`${a}
+`,{mode:384}),JI(r,384)}catch{}return a}import{constants as eE,createHash as Sp,createPublicKey as tE,createVerify as rE,timingSafeEqual as nE}from"node:crypto";var cy=new Set(["RS256","PS256","ES256"]),ay=60;function fd(e,t){let r=new URL(e),a=["127.0.0.1","::1","localhost"].includes(r.hostname);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&a))throw Error(`${t} must use HTTPS`);if(r.username||r.password||r.hash)throw Error(`${t} contains unsupported URL components`);return r}function wp(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} is invalid`);return e}async function kp(e,t){if(!e.ok)throw Error(`${t} failed with HTTP ${e.status}`);if(!(e.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${t} returned an unsupported content type`);if(Number(e.headers.get("content-length")??0)>1048576)throw Error(`${t} response is too large`);let g=await e.text();if(g.length>1048576)throw Error(`${t} response is too large`);try{return wp(JSON.parse(g),t)}catch(f){if(f instanceof Error&&f.message===`${t} is invalid`)throw f;throw Error(`${t} returned invalid JSON`)}}function iE(e,t){let r=Sp("sha256").update(e).digest(),a=Sp("sha256").update(t).digest();return nE(r,a)}function du(e){if(!e)return"/";let t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/[\r\n]/.test(t))return"/";try{let r=new URL(t,"https://local.invalid");return r.origin==="https://local.invalid"?`${r.pathname}${r.search}${r.hash}`:"/"}catch{return"/"}}async function ga(e,t=fetch){let r=fd(e.issuer,"OIDC issuer"),a=new URL(`${r.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,r.origin),g=await kp(await t(a,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(g.issuer!==e.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let h of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof g[h]!=="string")throw Error(`OIDC discovery is missing ${h}`);fd(g[h],`OIDC ${h}`)}if(Array.isArray(g.response_types_supported)&&!g.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(g.code_challenge_methods_supported)&&!g.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let f=Array.isArray(g.id_token_signing_alg_values_supported)?g.id_token_signing_alg_values_supported.filter((h)=>typeof h==="string"):[];if(f.length>0&&!f.some((h)=>cy.has(h)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return g}async function pa(e,t,r,a,g=fetch){let f=e.getOidcProviderBySlug(t);if(!f?.enabled)throw Error("OIDC provider is unavailable");let h=fd(r,"Application origin").origin,b=await ga(f,g),S=`${h}/auth/oidc/${encodeURIComponent(f.slug)}/callback`,y=e.beginOidcTransaction(f.id,S,du(a)),k=new URL(b.authorization_endpoint);return k.searchParams.set("response_type","code"),k.searchParams.set("client_id",f.clientId),k.searchParams.set("redirect_uri",S),k.searchParams.set("scope",f.scopes.join(" ")),k.searchParams.set("state",y.state),k.searchParams.set("nonce",y.nonce),k.searchParams.set("code_challenge",Sp("sha256").update(y.verifier).digest("base64url")),k.searchParams.set("code_challenge_method","S256"),{authorizationUrl:k.href,expiresAt:y.transaction.expiresAt}}function oE(e){if(e.length>32768)throw Error("OIDC ID token is too large");let t=e.split(".");if(t.length!==3||t.some((r)=>!r))throw Error("OIDC ID token is malformed");try{return{header:wp(JSON.parse(Buffer.from(t[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:wp(JSON.parse(Buffer.from(t[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${t[0]}.${t[1]}`,signature:Buffer.from(t[2],"base64url")}}catch(r){if(r instanceof Error&&r.message.startsWith("OIDC"))throw r;throw Error("OIDC ID token is malformed")}}async function sE(e,t,r){let a=oE(e),g=typeof a.header.alg==="string"?a.header.alg:"",f=typeof a.header.kid==="string"?a.header.kid:"";if(!cy.has(g)||!f)throw Error("OIDC ID token uses an unsupported signing key");if(t.id_token_signing_alg_values_supported&&!t.id_token_signing_alg_values_supported.includes(g))throw Error("OIDC ID-token algorithm was not advertised by the provider");let h=await kp(await r(t.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(h.keys))throw Error("OIDC signing-key response is invalid");let b=h.keys.find((R)=>{if(!R||typeof R!=="object"||Array.isArray(R))return!1;let D=R;return D.kid===f&&(!D.alg||D.alg===g)&&(!D.use||D.use==="sig")});if(!b)throw Error("OIDC ID-token signing key was not found");let S=tE({key:b,format:"jwk"}),y=rE("SHA256").update(a.signingInput).end();if(!(g==="PS256"?y.verify({key:S,padding:eE.RSA_PKCS1_PSS_PADDING,saltLength:32},a.signature):g==="ES256"?y.verify({key:S,dsaEncoding:"ieee-p1363"},a.signature):y.verify(S,a.signature)))throw Error("OIDC ID-token signature is invalid");return a.claims}function aE(e,t,r,a){if(e.iss!==t.issuer)throw Error("OIDC ID-token issuer is invalid");let g=typeof e.aud==="string"?[e.aud]:Array.isArray(e.aud)?e.aud.filter((S)=>typeof S==="string"):[];if(!g.includes(t.clientId))throw Error("OIDC ID-token audience is invalid");if((g.length>1||e.azp!==void 0)&&e.azp!==t.clientId)throw Error("OIDC ID-token authorized party is invalid");let f=Math.floor(a.getTime()/1000);if(typeof e.exp!=="number"||e.exp<f-ay)throw Error("OIDC ID token is expired");if(typeof e.iat!=="number"||e.iat>f+ay)throw Error("OIDC ID-token issued-at time is invalid");if(typeof e.nonce!=="string"||!iE(e.nonce,r))throw Error("OIDC ID-token nonce is invalid");if(typeof e.sub!=="string"||!e.sub||e.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(e.email_verified!==!0||typeof e.email!=="string")throw Error("OIDC provider did not return a verified email address");let h=e.email.trim().toLowerCase();if(h.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(h))throw Error("OIDC provider returned an invalid email address");let b=h.split("@")[1];if(!b||!t.allowedDomains.includes(b))throw Error("OIDC email domain is not allowed for this organization");return{provider:t,subject:e.sub,email:h,name:typeof e.name==="string"?e.name.slice(0,120):void 0,claims:e}}async function ma(e,t,r=fetch){let a=e.getOidcProviderBySlug(t.providerSlug);if(!a?.enabled)throw Error("OIDC provider is unavailable");if(!t.state||t.state.length>512||!t.code||t.code.length>4096)throw Error("OIDC callback is incomplete");let g=fd(t.origin,"Application origin").origin,f=e.consumeOidcTransaction(a.id,t.state),h=`${g}/auth/oidc/${encodeURIComponent(a.slug)}/callback`;if(f.transaction.redirectUri!==h)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:b}=e.getOidcProviderCredentials(a.id),S=await ga(a,r),y=new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:f.transaction.redirectUri,code_verifier:f.verifier}),k={accept:"application/json","content-type":"application/x-www-form-urlencoded"},R=S.token_endpoint_auth_methods_supported??["client_secret_basic"];if(R.includes("client_secret_basic")){let M=(J)=>new URLSearchParams({value:J}).toString().slice(6),z=`${M(a.clientId)}:${M(b)}`;k.authorization=`Basic ${Buffer.from(z).toString("base64")}`}else if(R.includes("client_secret_post"))y.set("client_id",a.clientId),y.set("client_secret",b);else throw Error("OIDC provider does not support a configured client authentication method");let D=await kp(await r(S.token_endpoint,{method:"POST",headers:k,body:y,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof D.id_token!=="string")throw Error("OIDC token response did not include an ID token");let O=await sE(D.id_token,S,r);return{identity:aE(O,a,f.nonce,t.now??new Date),returnPath:f.transaction.returnPath}}import{createHash as cE,randomBytes as dE}from"node:crypto";var ly=new Set(Ce),lu=7776000000,uu=31536000000,gu=86400000;function fi(e){return typeof e==="string"?e:void 0}function dy(e){return cE("sha256").update(e).digest("hex")}function lE(e){try{let t=JSON.parse(String(e));return Array.isArray(t)?t.filter((r)=>typeof r==="string"&&ly.has(r)):[]}catch{return[]}}function uE(e){let t=String(e.scope_type);return t==="organization"?{type:t}:{type:t,id:String(e.scope_id)}}function Ip(e){let t=fi(e.disabled_at);return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),slug:String(e.slug),name:String(e.name),description:fi(e.description),createdByActorId:fi(e.created_by_actor_id),disabledAt:t,createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:t?"disabled":"active"}}function Ep(e,t){let r=fi(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),serviceAccountId:String(e.service_account_id),name:String(e.name),prefix:String(e.token_prefix),capabilities:lE(e.capabilities),scope:uE(e),expiresAt:a,lastUsedAt:fi(e.last_used_at),lastNetworkHint:fi(e.last_network_hint),revokedAt:r,rotatedFromTokenId:fi(e.rotated_from_token_id),createdByActorId:fi(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:r?"revoked":a<=t?"expired":"active"}}function pE(e){let t={};try{t=JSON.parse(String(e.response_body))}catch{}return{id:String(e.id),tokenId:String(e.token_id),key:String(e.idempotency_key),requestHash:String(e.request_hash),operationId:fi(e.operation_id),responseStatus:Number(e.response_status),responseBody:t,expiresAt:String(e.expires_at),createdAt:String(e.created_at)}}class ls{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}createServiceAccount(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Service-account organization was not found");let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let r=e.name.trim().slice(0,100);if(!r)throw Error("Service-account name is required");let a=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${e.organizationId}:${t}`,displayName:r,metadata:{source:"api",serviceAccountSlug:t}}),g=this.idFn(),f=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[g,e.organizationId,a.id,t,r,e.description?.trim().slice(0,500)||null,e.createdByActorId??null,f,f]);let h=this.controlPlane.createMembership({organizationId:e.organizationId,actorId:a.id,roleTemplate:e.roleTemplate,scope:e.scope,source:"manual",performedByActorId:e.createdByActorId}),b=e.scope??{type:"organization"};return this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"api.service_account.created",payload:{serviceAccountId:g,roleTemplate:e.roleTemplate,scope:{type:b.type,id:b.id??null}}}),{serviceAccount:this.getServiceAccount(g),membership:h}}getServiceAccount(e){let t=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE id = ?").get(e);return t?Ip(t):void 0}getServiceAccountBySlug(e,t){let r=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? AND slug = ? COLLATE NOCASE").get(e,t.trim());return r?Ip(r):void 0}listServiceAccounts(e,t={}){return this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e).map(Ip).filter((r)=>t.includeDisabled||r.state==="active")}disableServiceAccount(e,t){let r=this.getServiceAccount(e);if(!r)throw Error("Service account was not found");let a=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE service_accounts SET disabled_at = ?, updated_at = ? WHERE id = ?",[a,a,e]),this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE service_account_id = ? AND revoked_at IS NULL",[a,a,e]);let g=this.controlPlane.getMembershipForActor(r.organizationId,r.actorId);if(g?.status==="active")this.controlPlane.revokeMembership(g.id)}),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"api.service_account.disabled",payload:{serviceAccountId:e}}),this.getServiceAccount(e)}createToken(e){let t=this.getServiceAccount(e.serviceAccountId);if(!t||t.state!=="active")throw Error("Service account is unavailable");let r=this.controlPlane.getMembershipForActor(t.organizationId,t.actorId);if(!r||r.status!=="active")throw Error("Service-account membership is unavailable");let a=[...new Set(e.capabilities)];if(a.length===0||a.some((D)=>!ly.has(D)))throw Error("API token requires valid explicit capabilities");let g=e.scope??r.scope,f=this.controlPlane.resolveAuthorizationTarget(t.organizationId,g);if(!f)throw Error("API token scope was not found in this organization");for(let D of a)if(!x({membership:r,grants:this.controlPlane.listGrants(r.id),capability:D,target:f}).allowed)throw Error(`Service-account membership does not grant ${D} at the token scope`);let h=e.expiresAt?new Date(e.expiresAt):new Date(this.nowFn().getTime()+lu);if(!Number.isFinite(h.getTime())||h.getTime()<=this.nowFn().getTime()+60000||h.getTime()>this.nowFn().getTime()+uu)throw Error("API token expiry must be between one minute and one year from now");let b=this.idFn(),S=dE(32).toString("base64url"),y=`tsc_v1.${b}.${S}`,k=`tsc_v1.${b.slice(0,8)}`,R=this.now();return this.run(`INSERT INTO api_tokens (id, service_account_id, name, token_hash, token_prefix, capabilities, scope_type, scope_id,
       expires_at, rotated_from_token_id, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[b,t.id,e.name.trim().slice(0,100)||"API token",dy(y),k,JSON.stringify(a.sort()),g.type,g.type==="organization"?null:g.id??null,h.toISOString(),e.rotatedFromTokenId??null,e.createdByActorId??null,R,R]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.createdByActorId,type:"api.token.created",payload:{serviceAccountId:t.id,tokenId:b,prefix:k,capabilities:a,scope:{type:g.type,id:g.id??null},expiresAt:h.toISOString(),rotatedFromTokenId:e.rotatedFromTokenId??null}}),{token:this.getToken(b),secret:y}}getToken(e){let t=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ?").get(e);return t?Ep(t,this.now()):void 0}listTokens(e,t={}){return this.controlPlane.database.query("SELECT * FROM api_tokens WHERE service_account_id = ? ORDER BY created_at DESC").all(e).map((r)=>Ep(r,this.now())).filter((r)=>t.includeInactive||r.state==="active")}verifyToken(e,t){let r=/^tsc_v1\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!r)return;let a=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ? AND token_hash = ?").get(r[1],dy(e));if(!a)return;let g=Ep(a,this.now()),f=this.getServiceAccount(g.serviceAccountId);if(!f||f.state!=="active"||g.state!=="active")return;let h=this.controlPlane.getActor(f.actorId),b=this.controlPlane.getMembershipForActor(f.organizationId,f.actorId);if(!h||h.disabledAt||!b||b.status!=="active")return;let S=this.now(),y=!g.lastUsedAt||this.nowFn().getTime()-new Date(g.lastUsedAt).getTime()>=3600000;if(this.run("UPDATE api_tokens SET last_used_at = ?, last_network_hint = ?, updated_at = ? WHERE id = ?",[S,t?.slice(0,128)??null,S,g.id]),y)this.controlPlane.appendEvent({organizationId:f.organizationId,actorId:h.id,type:"api.token.used",payload:{serviceAccountId:f.id,tokenId:g.id,prefix:g.prefix}});return{serviceAccount:f,token:this.getToken(g.id),actor:h,membership:b}}rotateToken(e,t){let r=this.getToken(e);if(!r||r.state!=="active")throw Error("Active API token was not found");let a=this.createToken({serviceAccountId:r.serviceAccountId,name:`${r.name} (rotated)`,capabilities:r.capabilities,scope:r.scope,expiresAt:r.expiresAt,createdByActorId:t,rotatedFromTokenId:r.id}),g=this.getServiceAccount(r.serviceAccountId);return this.controlPlane.appendEvent({organizationId:g?.organizationId,actorId:t,type:"api.token.rotated",payload:{serviceAccountId:r.serviceAccountId,previousTokenId:r.id,tokenId:a.token.id}}),a}revokeToken(e,t){let r=this.getToken(e);if(!r)throw Error("API token was not found");if(r.state==="active"){let a=this.now();this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?",[a,a,e]);let g=this.getServiceAccount(r.serviceAccountId);this.controlPlane.appendEvent({organizationId:g?.organizationId,actorId:t,type:"api.token.revoked",payload:{serviceAccountId:r.serviceAccountId,tokenId:e}})}return this.getToken(e)}getIdempotency(e,t){let r=this.controlPlane.database.query("SELECT * FROM api_idempotency_records WHERE token_id = ? AND idempotency_key = ? AND expires_at > ?").get(e,t,this.now());return r?pE(r):void 0}saveIdempotency(e){if(!/^[A-Za-z0-9._:-]{8,128}$/.test(e.key))throw Error("Idempotency-Key must contain 8-128 safe characters");let t=this.getIdempotency(e.tokenId,e.key);if(t){if(t.requestHash!==e.requestHash)throw Error("Idempotency-Key was already used for a different request");return t}let r=this.idFn(),a=this.now(),g=new Date(this.nowFn().getTime()+gu).toISOString();return this.run(`INSERT INTO api_idempotency_records (id, token_id, idempotency_key, request_hash, operation_id, response_status, response_body, expires_at, created_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,e.tokenId,e.key,e.requestHash,e.operationId??null,e.responseStatus,JSON.stringify(e.responseBody),g,a]),this.getIdempotency(e.tokenId,e.key)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM api_tokens WHERE (expires_at < ? OR revoked_at IS NOT NULL) AND created_at < ?",[e,new Date(this.nowFn().getTime()-2592000000).toISOString()]).changes,r=this.controlPlane.database.run("DELETE FROM api_idempotency_records WHERE expires_at < ?",[e]).changes;return{tokens:t,idempotency:r}}}class fa extends Error{status;code;requestId;constructor(e,t,r,a){super(r);this.status=e;this.code=t;this.requestId=a}}class pu{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),a=await r.json().catch(()=>({}));if(!r.ok)throw new fa(r.status,a.error?.code??"api_error",a.error?.message??"API request failed.",a.error?.requestId??r.headers.get("x-request-id")??void 0);return a}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,a])=>[r,String(a)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,a])=>[r,String(a)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,a])=>a!==void 0).map(([a,g])=>[a,String(g)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,a]of Object.entries(e))if(a)t.set(r,String(a));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,a]of Object.entries(e))if(a)t.set(r,String(a));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as tR}from"node:crypto";import{lstatSync as gE,readdirSync as mE,readFileSync as fE}from"node:fs";import{relative as hE,resolve as uy,sep as yE}from"node:path";function vE(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function oo(e,t,r){return{path:e,reason:t,weight:r}}function py(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function Go(e,t,r,a,g,f){return{framework:e,strategy:t,confidence:r,evidence:a,defaults:{build:g,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:f}}function Yo(e){let t=vE(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(Go("dockerfile","dockerfile",0.99,[oo("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let a=py(t.get("composer.json"));if(t.has("artisan")&&a.require?.["laravel/framework"])r.push(Go("laravel","server",0.98,[oo("artisan","Laravel Artisan entrypoint is present.",0.45),oo("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(Go("php","server",0.82,[oo("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let g=py(t.get("package.json"));if(t.has("package.json")){let f=t.has("bun.lock")||t.has("bun.lockb")||g.engines?.bun,h=f?"bun":"node",b=f?"bun":"node",S=[oo("package.json",`Defines ${g.scripts?.build?"build and ":""}${g.scripts?.start?"start ":""}scripts.`,0.55)];if(f)S.push(oo(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let y=!!(g.dependencies?.vite||g.devDependencies?.vite||g.dependencies?.["@stacksjs/bunpress"]||g.devDependencies?.["@stacksjs/bunpress"])&&!g.scripts?.start,k=y?{kind:"static",installCommand:`${h} install --frozen-lockfile`,buildCommand:`${h} run build`,publishDirectory:"dist"}:{kind:"server",runtime:h,installCommand:`${h} install --frozen-lockfile`,buildCommand:g.scripts?.build?`${h} run build`:void 0,startCommand:g.scripts?.start?`${h} run start`:h==="bun"?"bun run index.ts":"node index.js"};r.push(Go(b,k.kind,Math.min(0.94,S.reduce((R,D)=>R+D.weight,0)),S,k,y?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${h} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(Go("static","static",0.78,[oo(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(Go("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((f,h)=>h.confidence-f.confidence||f.framework.localeCompare(h.framework))}function Rp(e,t={}){let r=uy(e),a=t.maxFiles??1e4,g=t.maxContentBytes??262144,f=[],h=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),b=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),S=(y)=>{for(let k of mE(y).sort()){if(b.has(k))continue;let R=uy(y,k),D=hE(r,R).split(yE).join("/");if(!D||D.startsWith("../"))throw Error("Detection path escaped the application root");let O=gE(R);if(O.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${D}`);if(O.isDirectory())S(R);else if(O.isFile()){if(f.length>=a)throw Error("Application file-count limit exceeded");let M={path:D,size:O.size};if(h.has(D)&&O.size<=g)M.content=fE(R,"utf8");f.push(M)}}};return S(r),f}function Cp(e){if(Array.isArray(e))return`[${e.map(Cp).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${Cp(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function Xs(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function rn(e,t,r,a){return{path:e,code:t,message:r,alternatives:a}}function Ap(e){return JSON.parse(JSON.stringify(e))}function bE(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,a])=>[r,typeof a==="string"?a:`\${${a.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return Ap({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return Ap({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return Ap({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function Wn(e,t=[]){let r=[],a=(M)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(M),g=Object.fromEntries(Object.entries(e.environment??{}).map(([M,z])=>{if(typeof z==="string"&&a(M))return r.push(rn(`environment.${M}`,"write_only_secret_required",`${M} must be supplied through the write-only secrets boundary.`)),[M,{secretRef:M}];return[M,z]})),f=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let M=Object.fromEntries(Object.entries(e.build.buildArgs).map(([z,J])=>{if(a(z))return r.push(rn(`build.buildArgs.${z}`,"write_only_build_secret_required",`${z} must be declared in secretNames instead of buildArgs.`)),[z,"[REDACTED]"];return[z,J]}));f={...e.build,buildArgs:M}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(rn("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!Xs((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(rn("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((M)=>!Xs(M)))r.push(rn("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!Xs(e.build.context)||!Xs(e.build.dockerfile)))r.push(rn("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!Xs(e.build.publishDirectory))r.push(rn("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(rn("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(rn("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(rn("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(rn("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(rn("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let h=e.runtime.healthCheck;if(h&&h.protocol!=="tcp"&&(!h.path||!h.path.startsWith("/")||/[\r\n]/.test(h.path)))r.push(rn("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(rn("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let b=Object.values(g).flatMap((M)=>typeof M==="object"?[M.secretRef]:[]),S=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...b])].sort(),y=new Set(t),k=S.filter((M)=>!y.has(M)),R={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:f,runtime:e.runtime,environment:g,domain:e.domain}},D=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),O=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&k.length===0,issues:r,missingSecrets:k,manifest:R,configPatch:bE({...e,build:f,environment:g}),capabilityRequirements:D,costDrivers:O,serializedManifest:`${Cp(R)}
@@ -76,24 +76,24 @@ export type ConfigOf = Config
       ON CONFLICT(connection_id, provider_repository_id) DO UPDATE SET full_name=excluded.full_name, clone_url=excluded.clone_url, default_branch=excluded.default_branch, visibility=excluded.visibility, archived=excluded.archived, metadata=excluded.metadata, synced_at=excluded.synced_at`,[g,e.connectionId,e.providerRepositoryId,$p(e.fullName),ME(e.cloneUrl),e.defaultBranch.trim()||"main",e.visibility,e.archived?1:0,ei(e.metadata),r]),Np(this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(g))}listRepositories(e,t,r=100){let a=t?.trim().toLowerCase();return(a?this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? AND lower(full_name) LIKE ? ORDER BY full_name LIMIT ?").all(e,`%${a}%`,Math.min(500,r)):this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? ORDER BY full_name LIMIT ?").all(e,Math.min(500,r))).map(Np)}getRepository(e){let t=this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(e);return t?Np(t):void 0}createDeployKey(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status)||!t.capabilities.deployKeys)throw Error("An active deploy-key capable source connection is required");if(!/^ssh-(?:ed25519|rsa)\s+[A-Za-z0-9+/=]+/.test(e.publicKey.trim()))throw Error("A valid SSH public key is required");if(!/BEGIN (?:OPENSSH|RSA) PRIVATE KEY/.test(e.privateKey))throw Error("A valid SSH private key is required");if(!/^(?:ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp\d+)\s+[A-Za-z0-9+/=]+/.test(e.hostKey.trim()))throw Error("A pinned SSH host key is required");let r=this.idFn(),a=this.now(),g=`sha256:${ao(e.publicKey.trim())}`,f=`sha256:${ao(e.hostKey.trim())}`;return this.run("INSERT INTO source_deploy_keys (id, connection_id, name, public_key, public_key_fingerprint, private_key_ciphertext, host, host_key, host_key_fingerprint, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,Ty(e.name),e.publicKey.trim(),g,this.encrypt(e.privateKey),e.host.trim().toLowerCase(),e.hostKey.trim(),f,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.actorId,type:"source.deploy_key.created",payload:{connectionId:e.connectionId,deployKeyId:r,publicFingerprint:g,hostFingerprint:f}}),jp(this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(r))}getDeployKey(e){let t=this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(e);return t?jp(t):void 0}listDeployKeys(e){return this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE connection_id = ? ORDER BY name, created_at").all(e).map(jp)}revokeDeployKey(e,t){let r=this.getDeployKey(e),a=r?this.getConnection(r.connectionId):void 0;if(!r||!a)throw Error("Deploy key was not found");let g=this.listBindings({connectionId:a.id}).filter((h)=>h.deployKeyId===e),f=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_bindings SET deploy_key_id=NULL, status='disabled', auto_deploy=0, disabled_reason='Source deploy key was revoked', version=version+1, updated_at=? WHERE deploy_key_id=?",[f,e]),this.run("DELETE FROM source_deploy_keys WHERE id=?",[e])})(),this.controlPlane.appendEvent({organizationId:a.organizationId,actorId:t,type:"source.deploy_key.revoked",level:"warning",payload:{connectionId:a.id,deployKeyId:e,affectedBindingIds:g.map((h)=>h.id)}}),{affectedBindings:g}}getDeployPrivateKey(e){let t=this.controlPlane.database.query("SELECT private_key_ciphertext FROM source_deploy_keys WHERE id = ?").get(e);if(!t)throw Error("Deploy key was not found");return this.decrypt(String(t.private_key_ciphertext))}createBinding(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");if(e.deployKeyId&&this.getDeployKey(e.deployKeyId)?.connectionId!==t.id)throw Error("Deploy key does not belong to this connection");let r=this.idFn(),a=this.now();return this.run(`INSERT INTO source_bindings (id, project_id, environment_id, resource_id, connection_id, repository_id, repository_full_name, default_branch, branch_rule, tag_rule, monorepo_root, include_paths, exclude_paths, submodules, clone_depth, deploy_key_id, auto_deploy, pull_request_previews, status, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)`,[r,e.projectId,e.environmentId??null,e.resourceId??null,e.connectionId,e.repositoryId??null,$p(e.repositoryFullName),e.defaultBranch?.trim()||"main",e.branchRule?.trim()||null,e.tagRule?.trim()||null,xy(e.monorepoRoot??"."),ei(yd(e.includePaths)),ei(yd(e.excludePaths)),e.submodules?1:0,e.cloneDepth??null,e.deployKeyId??null,e.autoDeploy===!1?0:1,e.pullRequestPreviews===!1?0:1,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,projectId:e.projectId,actorId:e.actorId,type:"source.binding.created",payload:{bindingId:r,connectionId:e.connectionId,repository:e.repositoryFullName,branch:e.defaultBranch??"main"}}),this.getBinding(r)}getBinding(e){let t=this.controlPlane.database.query("SELECT * FROM source_bindings WHERE id = ?").get(e);return t?Dy(t):void 0}listBindings(e={}){return this.controlPlane.database.query("SELECT * FROM source_bindings ORDER BY created_at DESC").all().map(Dy).filter((r)=>(!e.connectionId||r.connectionId===e.connectionId)&&(!e.projectId||r.projectId===e.projectId)&&(!e.status||r.status===e.status))}updateBinding(e,t,r){let a=this.getBinding(e);if(!a||a.version!==t)throw Error(`Source binding ${e} changed since version ${t}`);let g=this.getConnection(a.connectionId);if((!g||["disconnected","expired"].includes(g.status))&&(r.status==="active"||r.autoDeploy===!0))throw Error("Rotate or reconnect the source credential before enabling this binding");if(r.deployKeyId&&this.getDeployKey(r.deployKeyId)?.connectionId!==a.connectionId)throw Error("Deploy key does not belong to this connection");let f=this.now();if(this.controlPlane.database.run("UPDATE source_bindings SET default_branch=?, branch_rule=?, tag_rule=?, monorepo_root=?, include_paths=?, exclude_paths=?, submodules=?, clone_depth=?, deploy_key_id=?, auto_deploy=?, pull_request_previews=?, status=?, disabled_reason=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.defaultBranch?.trim()||a.defaultBranch,r.branchRule===void 0?a.branchRule??null:r.branchRule.trim()||null,r.tagRule===void 0?a.tagRule??null:r.tagRule.trim()||null,r.monorepoRoot===void 0?a.monorepoRoot:xy(r.monorepoRoot),ei(r.includePaths===void 0?a.includePaths:yd(r.includePaths)),ei(r.excludePaths===void 0?a.excludePaths:yd(r.excludePaths)),r.submodules??a.submodules?1:0,r.cloneDepth===void 0?a.cloneDepth??null:r.cloneDepth,r.deployKeyId===void 0?a.deployKeyId??null:r.deployKeyId,r.autoDeploy??a.autoDeploy?1:0,r.pullRequestPreviews??a.pullRequestPreviews?1:0,r.status??a.status,r.disabledReason===void 0?a.disabledReason??null:r.disabledReason.slice(0,1000),f,e,t]).changes!==1)throw Error(`Source binding ${e} changed since version ${t}`);let b=this.getConnection(a.connectionId);return this.controlPlane.appendEvent({organizationId:b.organizationId,projectId:a.projectId,actorId:r.actorId,type:"source.binding.updated",payload:{bindingId:e,fromVersion:t,toVersion:t+1,status:r.status??a.status}}),this.getBinding(e)}createWebhook(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");let r=this.idFn(),a=this.now(),g=e.endpointToken??Op(24).toString("base64url"),f=e.secret??Op(32).toString("base64url"),h=[...new Set(e.events??["push","pull_request"])].filter((b)=>["push","pull_request"].includes(b));if(!h.length)throw Error("At least one supported webhook event is required");return this.run("INSERT INTO source_webhooks (id, connection_id, repository_id, repository_full_name, endpoint_token_hash, endpoint_token_ciphertext, secret_ciphertext, events, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)",[r,e.connectionId,e.repositoryId??null,$p(e.repositoryFullName),ao(g),this.encrypt(g),this.encrypt(f),ei(h),a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,type:"source.webhook.created",payload:{webhookId:r,connectionId:t.id,repository:e.repositoryFullName,events:h}}),{webhook:{...this.getWebhook(r),endpointToken:g},secret:f}}getWebhook(e){let t=this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE id = ?").get(e);return t?Bp(t):void 0}getWebhookByEndpointToken(e){let t=this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE endpoint_token_hash = ?").get(ao(e));return t?Bp(t):void 0}getWebhookSecret(e){let t=this.controlPlane.database.query("SELECT secret_ciphertext FROM source_webhooks WHERE id = ?").get(e);if(!t)throw Error("Source webhook was not found");return this.decrypt(String(t.secret_ciphertext))}getWebhookEndpointToken(e){let t=this.controlPlane.database.query("SELECT endpoint_token_ciphertext FROM source_webhooks WHERE id = ?").get(e);if(!t?.endpoint_token_ciphertext)throw Error("Source webhook endpoint token is unavailable");return this.decrypt(String(t.endpoint_token_ciphertext))}listWebhooks(e){return this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE connection_id = ? ORDER BY repository_full_name").all(e).map(Bp)}updateWebhookState(e,t){let r=this.getWebhook(e);if(!r)throw Error("Source webhook was not found");let a=this.now();this.run("UPDATE source_webhooks SET provider_webhook_id=COALESCE(?, provider_webhook_id), status=?, health_message=?, last_reconciled_at=COALESCE(?, last_reconciled_at), updated_at=? WHERE id=?",[t.providerWebhookId??null,t.status,t.healthMessage?.slice(0,1000)??null,t.reconciled?a:null,a,e]);let g=this.getConnection(r.connectionId);if(g)this.controlPlane.appendEvent({organizationId:g.organizationId,type:"source.webhook.updated",payload:{webhookId:e,connectionId:g.id,repository:r.repositoryFullName,status:t.status,reconciled:t.reconciled??!1,providerWebhookId:t.providerWebhookId??r.providerWebhookId??null}});return this.getWebhook(e)}getDeliveryByProviderId(e,t){let r=this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE connection_id = ? AND provider_delivery_id = ?").get(e,t);return r?Mp(r):void 0}recordDelivery(e){let t=this.getDeliveryByProviderId(e.connectionId,e.providerDeliveryId);if(t)return{delivery:t,duplicate:!0};let r=this.idFn(),a=this.now();return this.controlPlane.database.transaction(()=>{this.run("INSERT INTO source_webhook_deliveries (id, connection_id, webhook_id, provider_delivery_id, event, action, commit_sha, signature_status, status, payload_summary, operation_id, error, received_at, processed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,e.webhookId,e.providerDeliveryId,e.event.slice(0,100),e.action?.slice(0,100)??null,e.commitSha?.slice(0,128)??null,e.signatureStatus,e.status,ei(e.payloadSummary??{}),e.operationId??null,e.error?.slice(0,2000)??null,a,["enqueued","ignored","rejected","failed"].includes(e.status)?a:null]),this.run("UPDATE source_webhooks SET last_delivery_at=?, updated_at=? WHERE id=?",[a,a,e.webhookId])})(),{delivery:this.getDeliveryByProviderId(e.connectionId,e.providerDeliveryId),duplicate:!1}}updateDelivery(e,t){this.run("UPDATE source_webhook_deliveries SET status=?, operation_id=?, error=?, processed_at=? WHERE id=?",[t.status,t.operationId??null,t.error?.slice(0,2000)??null,this.now(),e]);let r=this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE id = ?").get(e);if(!r)throw Error("Source webhook delivery was not found");return Mp(r)}listDeliveries(e,t=100){return this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE webhook_id = ? ORDER BY received_at DESC LIMIT ?").all(e,Math.min(500,Math.max(1,t))).map(Mp)}disconnectConnection(e,t){let r=this.getConnection(e);if(!r)throw Error("Source connection was not found");let a=this.listBindings({connectionId:e,status:"active"}),g=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_connections SET status='disconnected', credential_ciphertext=NULL, health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[g,e]),this.run("UPDATE source_bindings SET status='disabled', auto_deploy=0, disabled_reason='Source connection was disconnected', version=version+1, updated_at=? WHERE connection_id=? AND status='active'",[g,e]),this.run("UPDATE source_webhooks SET status='disabled', health_message='Source connection was disconnected', updated_at=? WHERE connection_id=?",[g,e])})(),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"source.connection.disconnected",level:"warning",payload:{connectionId:e,affectedBindingIds:a.map((f)=>f.id),affectedRepositories:a.map((f)=>f.repositoryFullName)}}),{connection:this.getConnection(e),affectedBindings:a}}}import{createSign as FE}from"node:crypto";class yr extends Error{status;retryAfterSeconds;constructor(e,t,r){super(e);this.status=t;this.retryAfterSeconds=r;this.name="SourceProviderError"}}var jy={repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0};function _i(e){let t=Number(e??"1");return Number.isInteger(t)&&t>0?t:1}function Ti(e){return Math.max(1,Math.min(100,e??50))}function An(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function ta(e){let t=new URL(e);if(t.username||t.password||t.protocol!=="https:")throw Error("Webhook endpoint must be credential-free HTTPS");return t.href}function Ny(e){return Buffer.from(e).toString("base64url")}function zE(e,t){if(!e.appId||!e.privateKey)throw Error("GitHub App credentials require appId and privateKey");let r=Ny(JSON.stringify({alg:"RS256",typ:"JWT"})),a=Math.floor(t.getTime()/1000)-30,g=Ny(JSON.stringify({iat:a,exp:a+540,iss:e.appId})),f=FE("RSA-SHA256");return f.update(`${r}.${g}`),f.end(),`${r}.${g}.${f.sign(e.privateKey).toString("base64url")}`}class ra{connection;credential;capabilities=jy;fetchFn;timeoutMs;nowFn;constructor(e,t,r={}){this.connection=e;this.credential=t;this.fetchFn=r.fetch??((a,g)=>globalThis.fetch(a,g)),this.timeoutMs=Math.max(100,r.timeoutMs??20000),this.nowFn=r.now??(()=>new Date)}async request(e,t={}){let r=new URL(`${this.apiRoot().replace(/\/$/,"")}/`),a=new URL(e.replace(/^\//,""),r);if(a.origin!==r.origin)throw Error("Provider pagination cannot leave the configured host");let g=new AbortController,f=setTimeout(()=>g.abort(),this.timeoutMs);try{let h=await this.fetchFn(a,{...t,redirect:"error",signal:g.signal,headers:{Accept:"application/json","User-Agent":"ts-cloud-source/1",...await this.authorization(),...t.headers}});if(!h.ok){let b=Number(h.headers.get("retry-after")??""),S=h.headers.get("x-request-id")??h.headers.get("x-github-request-id");throw new yr(`Source provider request failed (${h.status})${S?` [request ${S}]`:""}`,h.status,Number.isFinite(b)?b:void 0)}if(h.status===204)return{data:void 0,headers:h.headers};return{data:await h.json(),headers:h.headers}}catch(h){if(h instanceof yr)throw h;if(g.signal.aborted)throw new yr(`Source provider request exceeded ${this.timeoutMs}ms`);throw new yr(h instanceof Error?h.message.replace(/(?:token|password|secret)=[^\s&]+/gi,"$1=[REDACTED]"):"Source provider request failed")}finally{clearTimeout(f)}}async deleteWebhook(e,t){await this.request(this.webhookPath(e,t),{method:"DELETE"})}}class Au extends ra{provider="github";installationToken;apiRoot(){return this.connection.host==="https://github.com"?"https://api.github.com":`${this.connection.host}/api/v3`}async authorization(){if(this.credential?.token)return{Authorization:`Bearer ${this.credential.token}`,"X-GitHub-Api-Version":"2022-11-28"};if(!this.credential?.installationId)return{};if(!this.installationToken||this.installationToken.expiresAt<this.nowFn().getTime()+60000){let e=zE(this.credential,this.nowFn()),t=this.apiRoot().replace(/\/$/,""),r=new AbortController,a=setTimeout(()=>r.abort(),this.timeoutMs);try{let g=await this.fetchFn(`${t}/app/installations/${encodeURIComponent(this.credential.installationId)}/access_tokens`,{method:"POST",signal:r.signal,redirect:"error",headers:{Accept:"application/vnd.github+json",Authorization:`Bearer ${e}`,"X-GitHub-Api-Version":"2022-11-28","User-Agent":"ts-cloud-source/1"}});if(!g.ok)throw new yr(`GitHub App token refresh failed (${g.status})`,g.status);let f=await g.json();this.installationToken={value:f.token,expiresAt:new Date(f.expires_at).getTime()}}finally{clearTimeout(a)}}return{Authorization:`Bearer ${this.installationToken.value}`,"X-GitHub-Api-Version":"2022-11-28"}}async testConnection(){let e=this.credential?.installationId?"/installation/repositories?per_page=1":"/user",{data:t,headers:r}=await this.request(e);return{ok:!0,account:t.login??this.connection.owner,scopes:(r.get("x-oauth-scopes")??this.connection.grantedScopes.join(",")).split(",").map((a)=>a.trim()).filter(Boolean),message:"GitHub connection is healthy"}}async listRepositories(e={}){let t=Ti(e.limit),r=_i(e.cursor),a=this.credential?.installationId?`/installation/repositories?per_page=${t}&page=${r}`:`/user/repos?per_page=${t}&page=${r}&sort=updated`,{data:g}=await this.request(a),f=Array.isArray(g)?g:g.repositories;return{repositories:(e.search?f.filter((b)=>b.full_name.toLowerCase().includes(e.search.toLowerCase())):f).map((b)=>({providerRepositoryId:String(b.id),fullName:b.full_name,cloneUrl:b.clone_url,defaultBranch:b.default_branch||"main",visibility:b.visibility??(b.private?"private":"public"),archived:!!b.archived,metadata:{}})),nextCursor:f.length===t?String(r+1):void 0}}async refs(e,t,r={}){let a=Ti(r.limit),g=_i(r.cursor),{data:f}=await this.request(`/repos/${An(e)}/${t}?per_page=${a}&page=${g}`);return{refs:f.map((h)=>({name:h.name,commitSha:h.commit.sha,protected:h.protected})),nextCursor:f.length===a?String(g+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repos/${An(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:e.active,events:e.events,url:e.config.url??""}}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:JSON.stringify({name:"web",active:!0,events:t.events,config:{url:ta(t.url),content_type:"json",secret:t.secret,insecure_ssl:"0"}}),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PATCH",body:JSON.stringify({active:!0,events:r.events,config:{url:ta(r.url),content_type:"json",secret:r.secret,insecure_ssl:"0"}}),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){await this.request(`/repos/${An(e)}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:r.state,target_url:r.url,description:r.description.slice(0,140),context:r.context??"ts-cloud/preview"})})}}class yu extends ra{provider="gitlab";apiRoot(){return`${this.connection.host}/api/v4`}async authorization(){return this.credential?.token?{"PRIVATE-TOKEN":this.credential.token}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.username,scopes:this.connection.grantedScopes,message:"GitLab connection is healthy"}}async listRepositories(e={}){let t=Ti(e.limit),r=_i(e.cursor),a=e.search?`&search=${encodeURIComponent(e.search)}`:"",{data:g,headers:f}=await this.request(`/projects?membership=true&simple=true&order_by=last_activity_at&per_page=${t}&page=${r}${a}`);return{repositories:g.map((h)=>({providerRepositoryId:String(h.id),fullName:h.path_with_namespace,cloneUrl:h.http_url_to_repo,defaultBranch:h.default_branch??"main",visibility:h.visibility??"unknown",archived:!!h.archived,metadata:{}})),nextCursor:f.get("x-next-page")||void 0}}async refs(e,t,r={}){let a=Ti(r.limit),g=_i(r.cursor),{data:f,headers:h}=await this.request(`/projects/${encodeURIComponent(An(e))}/repository/${t}?per_page=${a}&page=${g}`);return{refs:f.map((b)=>({name:b.name,commitSha:b.commit.id,protected:b.protected})),nextCursor:h.get("x-next-page")||void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/projects/${encodeURIComponent(An(e))}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:!0,events:[...e.push_events?["push"]:[],...e.merge_requests_events?["pull_request"]:[]],url:e.url}}body(e){return JSON.stringify({url:ta(e.url),token:e.secret,enable_ssl_verification:!0,push_events:e.events.includes("push"),merge_requests_events:e.events.includes("pull_request")})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PUT",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){let a=r.state==="failure"||r.state==="error"?"failed":r.state;await this.request(`/projects/${encodeURIComponent(An(e))}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:a,target_url:r.url,description:r.description.slice(0,255),name:r.context??"ts-cloud/preview"})})}}class Su extends ra{provider="bitbucket";apiRoot(){return this.connection.host==="https://bitbucket.org"?"https://api.bitbucket.org/2.0":`${this.connection.host}/2.0`}async authorization(){return this.credential?.token?{Authorization:`Bearer ${this.credential.token}`}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.username??e.display_name,scopes:this.connection.grantedScopes,message:"Bitbucket connection is healthy"}}async listRepositories(e={}){if(!this.connection.owner)throw Error("Bitbucket repository discovery requires an owner/workspace");let t=_i(e.cursor),r=Ti(e.limit),a=e.search?`&q=name~%22${encodeURIComponent(e.search)}%22`:"",{data:g}=await this.request(`/repositories/${encodeURIComponent(this.connection.owner)}?pagelen=${r}&page=${t}${a}`);return{repositories:g.values.map((f)=>({providerRepositoryId:f.uuid,fullName:f.full_name,cloneUrl:f.links.clone.find((h)=>h.name==="https")?.href??f.links.clone[0]?.href??"",defaultBranch:f.mainbranch?.name??"main",visibility:f.is_private?"private":"public",archived:!1,metadata:{}})),nextCursor:g.next?String(t+1):void 0}}async refs(e,t,r={}){let a=_i(r.cursor),g=Ti(r.limit),{data:f}=await this.request(`/repositories/${An(e)}/refs/${t}?pagelen=${g}&page=${a}`);return{refs:f.values.map((h)=>({name:h.name,commitSha:h.target.hash})),nextCursor:f.next?String(a+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repositories/${An(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:e.uuid,active:e.active,events:e.events.map((t)=>t.replace("repo:push","push").replace("pullrequest:","pull_request:")),url:e.url}}body(e){return JSON.stringify({description:"ts-cloud deploy",url:ta(e.url),active:!0,events:e.events.map((t)=>t==="push"?"repo:push":t.replace("pull_request:","pullrequest:"))})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.values.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PUT",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){let a=r.state==="success"?"SUCCESSFUL":r.state==="pending"?"INPROGRESS":"FAILED";await this.request(`/repositories/${An(e)}/commit/${encodeURIComponent(t)}/statuses/build/ts-cloud-preview`,{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:a,key:"ts-cloud-preview",name:r.context??"ts-cloud/preview",url:r.url,description:r.description.slice(0,255)})})}}class Iu extends ra{provider="gitea";capabilities={...jy,tokenRefresh:!1};apiRoot(){return`${this.connection.host}/api/v1`}async authorization(){return this.credential?.token?{Authorization:`token ${this.credential.token}`}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.login,scopes:this.connection.grantedScopes,message:"Gitea connection is healthy"}}async listRepositories(e={}){let t=_i(e.cursor),r=Ti(e.limit),a=e.search?`/repos/search?q=${encodeURIComponent(e.search)}&limit=${r}&page=${t}`:`/user/repos?limit=${r}&page=${t}`,{data:g,headers:f}=await this.request(a),h=Array.isArray(g)?g:g.data;return{repositories:h.map((b)=>({providerRepositoryId:String(b.id),fullName:b.full_name,cloneUrl:b.clone_url,defaultBranch:b.default_branch??"main",visibility:b.private?"private":"public",archived:!!b.archived,metadata:{}})),nextCursor:f.get("x-hasmore")==="true"||h.length===r?String(t+1):void 0}}async refs(e,t,r={}){let a=_i(r.cursor),g=Ti(r.limit),{data:f}=await this.request(`/repos/${An(e)}/${t}?limit=${g}&page=${a}`);return{refs:f.map((h)=>({name:h.name,commitSha:h.commit.id})),nextCursor:f.length===g?String(a+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repos/${An(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:e.active,events:e.events??[],url:e.config.url??""}}body(e){return JSON.stringify({type:"gitea",active:!0,events:e.events,config:{url:ta(e.url),content_type:"json",secret:e.secret,insecure_ssl:"0"}})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PATCH",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){await this.request(`/repos/${An(e)}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:r.state,target_url:r.url,description:r.description.slice(0,140),context:r.context??"ts-cloud/preview"})})}}function ct(e,t,r={}){switch(e.provider){case"github":return new Au(e,t,r);case"gitlab":return new yu(e,t,r);case"bitbucket":return new Su(e,t,r);case"gitea":return new Iu(e,t,r);default:throw Error(`${e.provider} uses bounded Git discovery instead of a hosted provider API`)}}import{createHmac as UE,timingSafeEqual as qE}from"node:crypto";function Wr(e,t){if(e instanceof Headers)return e.get(t)??void 0;return Object.entries(e).find(([a])=>a.toLowerCase()===t.toLowerCase())?.[1]}function By(e,t){let r=Buffer.from(e),a=Buffer.from(t);return r.length===a.length&&qE(r,a)}function VE(e,t){return UE("sha256",e).update(t).digest("hex")}function WE(e,t,r,a,g){if(e==="gitlab")return By(Wr(r,"x-gitlab-token")??"",t);let f=e==="github"?Wr(r,"x-hub-signature-256"):e==="gitea"?Wr(r,"x-gitea-signature"):Wr(r,"x-hub-signature")??Wr(r,"x-ts-cloud-signature");if(!f)return!1;if(e==="generic_https"||e==="generic_ssh"){let h=Number(Wr(r,"x-ts-cloud-timestamp"));if(!Number.isFinite(h)||Math.abs(g.getTime()-h*1000)>300000)return!1}return By(f.replace(/^sha256=/,""),VE(t,a))}function HE(e,t){return{github:["x-github-delivery"],gitlab:["x-gitlab-event-uuid","x-request-id"],bitbucket:["x-request-uuid"],gitea:["x-gitea-delivery"],generic_https:["x-ts-cloud-delivery"],generic_ssh:["x-ts-cloud-delivery"]}[e].map((a)=>Wr(t,a)?.trim()).find(Boolean)}function xi(e){let t=String(e??"").trim().replace(/^\/+|\/+$/g,"");return/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t)?t:""}function Lp(e){return[...new Set(e.flatMap((t)=>{if(!t||typeof t!=="object")return[];let r=t;return[...r.added??[],...r.modified??[],...r.removed??[]].map(String)}).filter((t)=>t&&!t.includes("\x00")).slice(0,500))]}function Xf(e,t,r){let a=e,g=t,f=r;if(a==="github"){let h=Wr(g,"x-github-event"),b=xi(f.repository?.full_name);if(h==="push")return{event:"push",repository:b,ref:String(f.ref??""),branch:String(f.ref??"").replace(/^refs\/heads\//,""),tag:String(f.ref??"").startsWith("refs/tags/")?String(f.ref).replace(/^refs\/tags\//,""):void 0,commitSha:String(f.after??f.head_commit?.id??""),changedPaths:Lp(f.commits??[]),deleted:f.deleted===!0||/^0{40,64}$/.test(String(f.after??""))};if(h==="pull_request")return{event:"pull_request",action:String(f.action??""),repository:b,branch:String(f.pull_request?.head?.ref??""),commitSha:String(f.pull_request?.head?.sha??""),changedPaths:[],pullRequestNumber:Number(f.number)||void 0,fork:xi(f.pull_request?.head?.repo?.full_name)!==b}}if(a==="gitlab"){let h=String(f.object_kind??"").toLowerCase(),b=xi(f.project?.path_with_namespace);if(h==="push"||h==="tag_push")return{event:"push",repository:b,ref:String(f.ref??""),branch:String(f.ref??"").replace(/^refs\/heads\//,""),tag:h==="tag_push"?String(f.ref??"").replace(/^refs\/tags\//,""):void 0,commitSha:String(f.checkout_sha??f.after??""),changedPaths:Lp(f.commits??[]),deleted:/^0{40,64}$/.test(String(f.after??""))};if(h==="merge_request")return{event:"pull_request",action:String(f.object_attributes?.action??f.object_attributes?.state??""),repository:b,branch:String(f.object_attributes?.source_branch??""),commitSha:String(f.object_attributes?.last_commit?.id??""),changedPaths:[],pullRequestNumber:Number(f.object_attributes?.iid)||void 0,fork:f.object_attributes?.source_project_id!==f.object_attributes?.target_project_id}}if(a==="bitbucket"){let h=Wr(g,"x-event-key")??"",b=xi(f.repository?.full_name);if(h==="repo:push"){let S=f.push?.changes?.[0]??{},y=S.new??S.old??{},k=S.new?.target??S.old?.target;return{event:"push",repository:b,ref:String(y.name??""),branch:y.type==="branch"?String(y.name):void 0,tag:y.type==="tag"?String(y.name):void 0,commitSha:String(k?.hash??""),changedPaths:[],deleted:S.closed===!0||S.new==null}}if(h.startsWith("pullrequest:"))return{event:"pull_request",action:h.replace("pullrequest:",""),repository:b,branch:String(f.pullrequest?.source?.branch?.name??""),commitSha:String(f.pullrequest?.source?.commit?.hash??""),changedPaths:[],pullRequestNumber:Number(f.pullrequest?.id)||void 0,fork:xi(f.pullrequest?.source?.repository?.full_name)!==b}}if(a==="gitea"){let h=Wr(g,"x-gitea-event"),b=xi(f.repository?.full_name);if(h==="push")return{event:"push",repository:b,ref:String(f.ref??""),branch:String(f.ref??"").replace(/^refs\/heads\//,""),tag:String(f.ref??"").startsWith("refs/tags/")?String(f.ref).replace(/^refs\/tags\//,""):void 0,commitSha:String(f.after??""),changedPaths:Lp(f.commits??[]),deleted:f.deleted===!0||/^0{40,64}$/.test(String(f.after??""))};if(h==="pull_request")return{event:"pull_request",action:String(f.action??""),repository:b,branch:String(f.pull_request?.head?.ref??""),commitSha:String(f.pull_request?.head?.sha??""),changedPaths:[],pullRequestNumber:Number(f.number)||void 0,fork:xi(f.pull_request?.head?.repo?.full_name)!==b}}if(a==="generic_https"||a==="generic_ssh"){if(f.event!=="push"&&f.event!=="pull_request")return;return{event:f.event,action:typeof f.action==="string"?f.action:void 0,repository:xi(f.repository),ref:typeof f.ref==="string"?f.ref:void 0,branch:typeof f.branch==="string"?f.branch:void 0,tag:typeof f.tag==="string"?f.tag:void 0,commitSha:String(f.commitSha??""),changedPaths:Array.isArray(f.changedPaths)?f.changedPaths.map(String).slice(0,500):[],pullRequestNumber:Number(f.pullRequestNumber)||void 0,fork:f.fork===!0,deleted:f.deleted===!0}}return}function Zo(e,t){let r="^";for(let a=0;a<t.length;a++){let g=t[a];if(g==="*"&&t[a+1]==="*")r+=".*",a++;else if(g==="*")r+="[^/]*";else if(g==="?")r+="[^/]";else r+=g.replace(/[|\\{}()[\]^$+?.]/g,"\\$&")}return new RegExp(`${r}$`).test(e)}function KE(e,t){if(t.event==="pull_request")return e.pullRequestPreviews;if(!e.autoDeploy)return!1;if(t.tag)return!!e.tagRule&&Zo(t.tag,e.tagRule);return Zo(t.branch??"",e.branchRule??e.defaultBranch)}function JE(e,t){if(!t.length)return!0;return t.filter((a)=>!e.excludePaths.some((g)=>Zo(a,g))).some((a)=>!e.includePaths.length||e.includePaths.some((g)=>Zo(a,g)))}function My(e,t){return Wr(t,e==="github"?"x-github-event":e==="gitlab"?"x-gitlab-event":e==="bitbucket"?"x-event-key":e==="gitea"?"x-gitea-event":"x-ts-cloud-event")??"unknown"}function lo(){return{accepted:!1,duplicate:!1,status:"rejected",operations:[],message:"Webhook unavailable"}}async function bu(e){if(e.rawBody.byteLength>2097152)return lo();let t=e.sources.getWebhookByEndpointToken(e.endpointToken);if(!t||t.status==="disabled")return lo();let r=e.sources.getConnection(t.connectionId);if(!r||r.status==="disconnected"||r.status==="expired")return lo();let a=HE(r.provider,e.headers);if(!a||a.length>200)return lo();if(!WE(r.provider,e.sources.getWebhookSecret(t.id),e.headers,e.rawBody,e.now??new Date))return e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:My(r.provider,e.headers),signatureStatus:Wr(e.headers,"x-hub-signature-256")||Wr(e.headers,"x-gitlab-token")||Wr(e.headers,"x-hub-signature")||Wr(e.headers,"x-gitea-signature")?"invalid":"missing",status:"rejected",error:"Webhook signature verification failed"}),lo();let f;try{f=JSON.parse(new TextDecoder().decode(e.rawBody))}catch{return lo()}let h=Xf(r.provider,e.headers,f);if(!h||!h.repository||!/^[a-f0-9]{7,64}$/i.test(h.commitSha))return e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:My(r.provider,e.headers),signatureStatus:"verified",status:"rejected",error:"Unsupported or malformed source event"}),lo();let b=e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:h.event,action:h.action,commitSha:h.commitSha,signatureStatus:"verified",status:"accepted",payloadSummary:{repository:h.repository,ref:h.ref??null,branch:h.branch??null,tag:h.tag??null,commitSha:h.commitSha,pullRequestNumber:h.pullRequestNumber??null,changedPathCount:h.changedPaths.length}});if(b.duplicate&&b.delivery.status!=="accepted")return{accepted:!0,duplicate:!0,status:"duplicate",operations:[],message:"Delivery already processed"};let S=new Xe(e.controlPlane),y=e.sources.listBindings({connectionId:r.id,status:"active"}).filter((O)=>{if(O.repositoryFullName.toLowerCase()!==h.repository.toLowerCase()||!JE(O,h.changedPaths))return!1;let M=O.resourceId?S.getDefinitionForResource(O.resourceId):void 0,z=h.event==="push"&&!!M?.branchRule&&!!h.branch&&Zo(h.branch,M.branchRule);return KE(O,h)||z});if(!y.length)return e.sources.updateDelivery(b.delivery.id,{status:"ignored"}),{accepted:!0,duplicate:b.duplicate,status:"ignored",operations:[],message:"Verified event did not match an active deployment rule"};let k=new c(e.controlPlane),R=new Set(["closed","merged","declined"]),D=y.flatMap((O)=>{if(h.event==="push"&&O.resourceId&&h.branch){let z=S.getDefinitionForResource(O.resourceId);if(z?.branchRule&&Zo(h.branch,z.branchRule)){let J=S.findForBranch(z.id,h.repository,h.branch);if(h.deleted){if(!z.cleanupOnClose||!J||J.status==="destroyed")return[];let te=k.enqueue({projectId:O.projectId,environmentId:O.environmentId,resourceId:O.resourceId,kind:"preview.destroy",idempotencyKey:`preview:${J.id}:branch-delete:${a}`,correlationId:`preview:${J.id}`,input:{previewId:J.id,reason:"branch_deleted",source:{repository:h.repository,commitSha:h.commitSha,branch:h.branch}},lockKey:`preview:${J.id}`,providerKey:r.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return S.transition(J.id,"queued",{operationId:te.id}),[te]}let Z=S.upsert({definitionId:z.id,sourceProvider:r.provider,repository:h.repository,branch:h.branch,commitSha:h.commitSha});if(!Z.changed)return[];let oe=Z.created?"preview.create":"preview.update",G=k.enqueue({projectId:O.projectId,environmentId:O.environmentId,resourceId:O.resourceId,kind:oe,idempotencyKey:`preview:${Z.preview.id}:${h.commitSha}`,correlationId:`preview:${Z.preview.id}`,input:{previewId:Z.preview.id,source:{connectionId:r.id,bindingId:O.id,repository:h.repository,commitSha:h.commitSha,branch:h.branch,monorepoRoot:O.monorepoRoot,submodules:O.submodules,cloneDepth:O.cloneDepth??null}},lockKey:`preview:${Z.preview.id}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return S.transition(Z.preview.id,"queued",{operationId:G.id}),[G]}}if(h.event==="pull_request"&&O.resourceId&&h.pullRequestNumber){let z=S.getDefinitionForResource(O.resourceId);if(z){let J=R.has(String(h.action??"").toLowerCase()),Z=S.findForPullRequest(z.id,h.repository,h.pullRequestNumber);if(J){if(!z.cleanupOnClose||!Z||Z.status==="destroyed")return[];let oe=k.enqueue({projectId:O.projectId,environmentId:O.environmentId,resourceId:O.resourceId,kind:"preview.destroy",idempotencyKey:`preview:${Z.id}:destroy:${a}`,correlationId:`preview:${Z.id}`,input:{previewId:Z.id,reason:"pull_request_closed",source:{repository:h.repository,commitSha:h.commitSha,branch:h.branch??null,pullRequestNumber:h.pullRequestNumber}},lockKey:`preview:${Z.id}`,providerKey:r.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return S.transition(Z.id,"queued",{operationId:oe.id}),[oe]}try{let oe=S.upsert({definitionId:z.id,sourceProvider:r.provider,repository:h.repository,branch:h.branch??`pr-${h.pullRequestNumber}`,pullRequestNumber:h.pullRequestNumber,fork:h.fork,commitSha:h.commitSha});if(!oe.changed)return[];let G=oe.created?"preview.create":"preview.update",te=k.enqueue({projectId:O.projectId,environmentId:O.environmentId,resourceId:O.resourceId,kind:G,idempotencyKey:`preview:${oe.preview.id}:${h.commitSha}`,correlationId:`preview:${oe.preview.id}`,input:{previewId:oe.preview.id,source:{connectionId:r.id,bindingId:O.id,repository:h.repository,commitSha:h.commitSha,branch:h.branch??null,pullRequestNumber:h.pullRequestNumber,fork:!!h.fork,monorepoRoot:O.monorepoRoot,submodules:O.submodules,cloneDepth:O.cloneDepth??null},inheritedSecretNames:oe.inheritedSecrets},lockKey:`preview:${oe.preview.id}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return S.transition(oe.preview.id,"queued",{operationId:te.id}),[te]}catch(oe){return e.controlPlane.appendEvent({projectId:O.projectId,resourceId:O.resourceId,type:"preview.rejected",level:"warning",payload:{repository:h.repository,pullRequestNumber:h.pullRequestNumber,fork:!!h.fork,reason:oe instanceof Error?oe.message:String(oe)}}),[]}}}let M=h.event==="pull_request"?"deploy.preview":"deploy.source";return[k.enqueue({projectId:O.projectId,environmentId:O.environmentId,resourceId:O.resourceId,kind:M,idempotencyKey:`source:${r.id}:${a}:${O.id}:${h.commitSha}`,correlationId:`source:${a}`,input:{source:{connectionId:r.id,bindingId:O.id,repository:h.repository,commitSha:h.commitSha,branch:h.branch??null,tag:h.tag??null,monorepoRoot:O.monorepoRoot,submodules:O.submodules,cloneDepth:O.cloneDepth??null},preview:h.event==="pull_request"?{number:h.pullRequestNumber??null,action:h.action??null}:null},lockKey:O.resourceId?`resource:${O.resourceId}`:`environment:${O.environmentId??O.projectId}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:h.event==="pull_request"?14:90}).operation]});if(!D.length)return e.sources.updateDelivery(b.delivery.id,{status:"ignored"}),{accepted:!0,duplicate:b.duplicate,status:"ignored",operations:[],message:"Verified event required no preview lifecycle change"};return e.sources.updateDelivery(b.delivery.id,{status:"enqueued",operationId:D[0]?.id}),e.controlPlane.appendEvent({organizationId:r.organizationId,projectId:y[0]?.projectId,operationId:D[0]?.id,type:"source.webhook.enqueued",payload:{webhookId:t.id,deliveryId:b.delivery.id,repository:h.repository,commitSha:h.commitSha,operationIds:D.map((O)=>O.id)}}),{accepted:!0,duplicate:b.duplicate,status:"enqueued",operations:D,message:`${D.length} deployment operation${D.length===1?"":"s"} enqueued`}}function Sr(e,t){if(!t.endpointToken)throw Error("The webhook endpoint token is only available at creation time");let r=new URL(e);if(r.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(r.hostname))throw Error("Webhook base URL must use HTTPS");return new URL(`/api/source/webhooks/${encodeURIComponent(t.endpointToken)}`,r).href}import{chmodSync as Ly,mkdtempSync as GE,rmSync as QE,writeFileSync as Fy}from"node:fs";import{tmpdir as YE}from"node:os";import{join as vd,resolve as ZE}from"node:path";function Uy(e,t){let r=e.trim();if(/\r|\n|\0/.test(r))throw Error("Git remote contains control characters");if(r.startsWith("https://")){let g=new URL(r);if(g.username||g.password||g.search||g.hash)throw Error("HTTPS Git remotes cannot contain credentials, queries, or fragments");return g.href}let a=r.startsWith("ssh://")?new URL(r).hostname:r.match(/^git@([A-Za-z0-9.-]+):/)?.[1];if(!a)throw Error("Git remote must use credential-free HTTPS or SSH");if(!t||t.host.toLowerCase()!==a.toLowerCase())throw Error("SSH Git remote requires a deploy key with a pinned key for the same host");return r}function XE(e,t,r){let a=e.replaceAll(t,"[REMOTE]").slice(0,4000);for(let g of[r?.token,r?.privateKey])if(g)a=a.replaceAll(g,"[REDACTED]");return a}function eR(e){let t={PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",GIT_TERMINAL_PROMPT:"0",GIT_CONFIG_NOSYSTEM:"1",GIT_OPTIONAL_LOCKS:"0"},r;if(e.credential?.token){let a=e.credential.username??"oauth2";t.GIT_CONFIG_COUNT="1",t.GIT_CONFIG_KEY_0="http.extraHeader",t.GIT_CONFIG_VALUE_0=`Authorization: Basic ${Buffer.from(`${a}:${e.credential.token}`).toString("base64")}`}if(e.deployKey){r=GE(vd(YE(),"ts-cloud-git-transport-"));let a=vd(r,"key"),g=vd(r,"known_hosts");Fy(a,e.deployKey.privateKey,{mode:384}),Fy(g,`${e.deployKey.host} ${e.deployKey.hostKey}
 `,{mode:384}),Ly(a,384),Ly(g,384),t.GIT_SSH_COMMAND=`ssh -i ${a} -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=${g} -o GlobalKnownHostsFile=/dev/null -o BatchMode=yes`}return{env:t,cleanup:()=>{if(r)QE(r,{recursive:!0,force:!0})}}}async function uo(e,t,r){let a=eR(r),g=Bun.spawn([r.executable??"git",...e],{stdout:"pipe",stderr:"pipe",env:a.env}),f=Math.max(100,r.timeoutMs??120000),h,b=new Promise((S,y)=>{h=setTimeout(()=>{g.kill(),y(Error(`Git operation exceeded ${f}ms`))},f)});try{let S=Promise.all([g.exited,new Response(g.stdout).text(),new Response(g.stderr).text()]),[y,k,R]=await Promise.race([S,b]);if(y!==0)throw Error(XE(R||`Git exited with ${y}`,t,r.credential));return k}finally{if(h)clearTimeout(h);a.cleanup()}}function zy(e,t){let r=new Map;for(let a of e.split(`
-`)){let g=a.trim().match(/^([a-f0-9]{40,64})\s+(.+)$/i);if(!g||!g[2].startsWith(t)||g[2].endsWith("^{}"))continue;let f=g[2].slice(t.length);r.set(f,{name:f,commitSha:g[1]})}return[...r.values()].sort((a,g)=>a.name.localeCompare(g.name))}async function ya(e,t={}){let r=Uy(e,t.deployKey),a=await uo(["ls-remote","--heads","--tags","--",r],r,t);return{branches:zy(a,"refs/heads/"),tags:zy(a,"refs/tags/")}}async function Sa(e,t={}){let r=Uy(e.remote,t.deployKey),a=ZE(e.destination),g=e.ref?.trim()||e.binding.defaultBranch;if(!/^[A-Za-z0-9._/-]{1,255}$/.test(g)||g.startsWith("-")||g.includes(".."))throw Error("Git ref contains unsupported characters");let f=["clone","--no-tags","--single-branch","--branch",g],h=[...new Set(e.sparsePaths??[])];if(h.some((S)=>!S||S.startsWith("/")||S.split("/").includes("..")||/[\0\r\n]/.test(S)))throw Error("Sparse checkout paths must stay inside the repository");if(h.length)f.push("--filter=blob:none","--no-checkout");if(e.binding.cloneDepth)f.push("--depth",String(e.binding.cloneDepth));if(e.binding.submodules)f.push("--recurse-submodules","--shallow-submodules");if(f.push("--",r,a),await uo(f,r,t),h.length)await uo(["-C",a,"sparse-checkout","set","--cone","--",...h],r,t),await uo(["-C",a,"checkout","--force"],r,t);if(e.commitSha){if(!/^[a-f0-9]{40,64}$/i.test(e.commitSha))throw Error("Expected source commit must be an immutable 40-64 character SHA");await uo(["-C",a,"fetch","--no-tags","--depth","1","origin",e.commitSha],r,t),await uo(["-C",a,"checkout","--detach","--force",e.commitSha],r,t)}let b=(await uo(["-C",a,"rev-parse","HEAD"],r,t)).trim();if(!/^[a-f0-9]{40,64}$/i.test(b))throw Error("Git clone did not produce a valid commit SHA");if(e.commitSha&&b.toLowerCase()!==e.commitSha.toLowerCase())throw Error(`Git checkout resolved ${b} instead of the requested immutable commit`);return{directory:e.binding.monorepoRoot==="."?a:vd(a,e.binding.monorepoRoot),commitSha:b}}function na(e){return["github","gitlab","bitbucket","gitea"].includes(e)}async function Ia(e,t,r){let a=e.getConnection(t);if(!a||["disconnected","expired"].includes(a.status))throw Error("Active source connection was not found");try{if(na(a.provider)){let h=await ct(a,e.getCredential(a.id)).testConnection();return e.updateHealth(a.id,{status:h.ok?"healthy":"degraded",message:h.message,tested:!0,grantedScopes:h.scopes})}let g=r?e.getRepository(r):e.listRepositories(a.id,void 0,1)[0];if(!g)return e.updateHealth(a.id,{status:"degraded",message:"Add a repository URL before testing this generic connection.",tested:!0});let f=a.provider==="generic_ssh"?e.listBindings({connectionId:a.id}).map((h)=>h.deployKeyId).filter(Boolean).map((h)=>e.getDeployKey(h)).find(Boolean):void 0;return await ya(g.cloneUrl,{credential:e.getCredential(a.id),deployKey:f?{...f,privateKey:e.getDeployPrivateKey(f.id)}:void 0}),e.updateHealth(a.id,{status:"healthy",message:"Git repository access is healthy.",tested:!0})}catch(g){return e.updateHealth(a.id,{status:"degraded",message:g instanceof Error?g.message:"Connection test failed",tested:!0})}}async function gs(e,t,r={}){let a=e.getConnection(t);if(!a||!na(a.provider)||["disconnected","expired"].includes(a.status))throw Error("A hosted active source connection is required for repository discovery");let g=ct(a,e.getCredential(a.id)),f=[],h;for(let b=0;b<Math.min(20,Math.max(1,r.maxPages??10));b++){let S=await g.listRepositories({cursor:h,search:r.search,limit:100});for(let y of S.repositories)f.push(e.upsertRepository({connectionId:a.id,...y}));if(h=S.nextCursor,!h)break}return e.updateHealth(a.id,{status:"healthy",message:`${f.length} repositories synchronized.`,synced:!0}),f}async function ps(e,t){let r=e.getConnection(t.connectionId);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");if(na(r.provider)){let b=ct(r,e.getCredential(r.id));return t.type==="tags"?b.listTags(t.repository,t):b.listBranches(t.repository,t)}let a=t.repositoryId?e.getRepository(t.repositoryId):e.listRepositories(r.id).find((b)=>b.fullName===t.repository);if(!a||a.connectionId!==r.id)throw Error("Generic repository metadata was not found");let g=t.deployKeyId?e.getDeployKey(t.deployKeyId):void 0;if(g&&g.connectionId!==r.id)throw Error("Deploy key does not belong to this connection");let f=await ya(a.cloneUrl,{credential:e.getCredential(r.id),deployKey:g?{...g,privateKey:e.getDeployPrivateKey(g.id)}:void 0});return{refs:(t.type==="tags"?f.tags:f.branches).slice(0,Math.min(500,t.limit??100))}}async function bn(e,t,r){let a=e.getWebhook(t),g=a?e.getConnection(a.connectionId):void 0;if(!a||!g||["disconnected","expired"].includes(g.status))throw Error("Active source webhook was not found");let f=Sr(r,{...a,endpointToken:e.getWebhookEndpointToken(a.id)});if(!na(g.provider))return e.updateWebhookState(a.id,{status:"healthy",healthMessage:"Manual webhook endpoint is ready.",reconciled:!0});try{let h=ct(g,e.getCredential(g.id)),b=e.getWebhookSecret(a.id),S=a.providerWebhookId?await h.updateWebhook(a.repositoryFullName,a.providerWebhookId,{url:f,secret:b,events:a.events}):await h.createWebhook(a.repositoryFullName,{url:f,secret:b,events:a.events});return e.updateWebhookState(a.id,{providerWebhookId:S.providerWebhookId,status:S.active?"healthy":"degraded",healthMessage:S.active?"Provider webhook is synchronized.":"Provider webhook exists but is inactive.",reconciled:!0})}catch(h){return e.updateWebhookState(a.id,{status:"degraded",healthMessage:h instanceof Error?h.message:"Webhook reconciliation failed",reconciled:!0})}}async function Cu(e,t){let r=e.getWebhook(t),a=r?e.getConnection(r.connectionId):void 0;if(!r||!a)throw Error("Source webhook was not found");if(na(a.provider)&&r.providerWebhookId&&!["disconnected","expired"].includes(a.status))await ct(a,e.getCredential(a.id)).deleteWebhook(r.repositoryFullName,r.providerWebhookId);return e.updateWebhookState(r.id,{status:"disabled",healthMessage:"Webhook disabled."})}var ms="1.6.0";function ba(){let e={type:"object",required:["error"],properties:{error:{type:"object",required:["code","message","requestId"],properties:{code:{type:"string"},message:{type:"string"},requestId:{type:"string",format:"uuid"},details:{}}}}},t=(a)=>({type:"object",required:["data","page","requestId"],properties:{data:{type:"array",items:a},page:{type:"object",required:["hasMore"],properties:{nextCursor:{type:"string"},hasMore:{type:"boolean"}}},requestId:{type:"string",format:"uuid"}}}),r=(a)=>({"200":{description:"A stable cursor page.",content:{"application/json":{schema:t(a)}}},default:{$ref:"#/components/responses/Error"}});return{openapi:"3.1.0",info:{title:"ts-cloud API",version:ms,description:"Additive changes are released within v1. Breaking request or response changes require a new URL version."},servers:[{url:"/"}],security:[{bearerAuth:[]}],paths:{...Qo(),"/api/v1/projects":{get:{operationId:"listProjects",summary:"List accessible projects",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Project"})}},"/api/v1/projects/{projectId}/environments":{get:{operationId:"listEnvironments",summary:"List accessible project environments",parameters:[{$ref:"#/components/parameters/ProjectId"},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Environment"})}},"/api/v1/services":{get:{operationId:"listServices",summary:"List accessible services",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{name:"environmentId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Service"})}},"/api/v1/source/connections":{get:{operationId:"listSourceConnections",summary:"List safe Git connection metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/SourceConnection"})},post:{operationId:"createSourceConnection",summary:"Create an encrypted Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["provider","name","host"],properties:{provider:{type:"string",enum:["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"]},name:{type:"string"},host:{type:"string",format:"uri"},token:{type:"string",writeOnly:!0},repositoryFullName:{type:"string"},repositoryUrl:{type:"string"}}}}}},responses:{"201":{description:"Encrypted connection created."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectSourceConnection",summary:"Preview or safely disconnect a Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["id"],properties:{id:{type:"string"},preview:{type:"boolean"}}}}}},responses:{"200":{description:"Impact preview or disconnected connection."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/repositories":{get:{operationId:"listSourceRepositories",summary:"List or synchronize granted repositories",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"sync",in:"query",schema:{type:"boolean"}},{name:"search",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/SourceRepository"})}},"/api/v1/source/refs":{get:{operationId:"listSourceRefs",summary:"List repository branches or tags",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"repository",in:"query",required:!0,schema:{type:"string"}},{name:"repositoryId",in:"query",schema:{type:"string"}},{name:"type",in:"query",schema:{type:"string",enum:["branches","tags"]}}],responses:{"200":{description:"Provider reference page."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/bindings":{post:{operationId:"createSourceBinding",summary:"Bind a repository to an application",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/SourceBindingRequest"}}}},responses:{"201":{description:"Source binding created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/webhooks":{post:{operationId:"createSourceWebhook",summary:"Create and optionally reconcile a signed webhook",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["connectionId","repositoryFullName","baseUrl"],properties:{connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},baseUrl:{type:"string",format:"uri"},events:{type:"array",items:{type:"string",enum:["push","pull_request"]}},reconcile:{type:"boolean"}}}}}},responses:{"201":{description:"Webhook endpoint created; endpoint is revealed once."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-detections":{post:{operationId:"detectApplication",summary:"Detect bounded application build candidates",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["files"],properties:{files:{type:"array",maxItems:1e4,items:{$ref:"#/components/schemas/DetectionFile"}}}}}}},responses:{"200":{description:"Ranked detection candidates with evidence."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-plans":{post:{operationId:"planApplication",summary:"Validate and normalize an application manifest",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["draft"],properties:{draft:{$ref:"#/components/schemas/ApplicationInput"},suppliedSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}}}}}},responses:{"200":{description:"Validated plan, config patch, capabilities, costs, and missing secret names."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-drafts":{get:{operationId:"listApplicationDrafts",summary:"List resumable secret-free drafts",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/ApplicationDraft"})},post:{operationId:"createApplicationDraft",summary:"Create a resumable application draft",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/ApplicationDraftCreateRequest"}}}},responses:{"201":{description:"Draft created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateApplicationDraft",summary:"Optimistically update a draft",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/ApplicationDraftCreateRequest"},{type:"object",required:["id","version","step"],properties:{id:{type:"string"},version:{type:"integer",minimum:1}}}]}}}},responses:{"200":{description:"Updated draft."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/applications":{post:{operationId:"createApplication",summary:"Confirm and queue an application plan",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["draftId","version","confirmEnvironment"],properties:{draftId:{type:"string"},version:{type:"integer",minimum:1},confirmEnvironment:{type:"string",description:"Exact target environment slug."}}}}}},responses:{"202":{description:"Application operation queued; identical requests replay safely."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-artifacts":{post:{operationId:"uploadApplicationArtifact",summary:"Inspect and store a bounded ZIP or TAR source artifact",parameters:[{name:"X-Project-Id",in:"header",required:!0,schema:{type:"string"}},{name:"X-Artifact-Filename",in:"header",required:!0,schema:{type:"string"}}],requestBody:{required:!0,content:{"application/octet-stream":{schema:{type:"string",format:"binary",maxLength:104857600}}}},responses:{"201":{description:"Deduplicated artifact metadata; archive contents are never executed."},"413":{$ref:"#/components/responses/Error"},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/registry-connections":{get:{operationId:"listRegistryConnections",summary:"List safe private-registry metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/RegistryConnection"})},post:{operationId:"createRegistryConnection",summary:"Create an encrypted private-registry connection",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/RegistryConnectionRequest"}}}},responses:{"201":{description:"Encrypted registry connection created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateRegistryConnection",summary:"Test access or rotate write-only credentials",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/RegistryConnectionRequest"},{type:"object",required:["id","action"],properties:{id:{type:"string"},action:{type:"string",enum:["test","rotate"]},image:{type:"string"}}}]}}}},responses:{"200":{description:"Safe connection health metadata."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectRegistryConnection",summary:"Disconnect and erase registry credentials",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["id"],properties:{id:{type:"string"}}}}}},responses:{"200":{description:"Credentials erased and connection disconnected."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue":{get:{operationId:"listQueue",summary:"List authorized durable operations and blocking metadata",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"state",in:"query",schema:{type:"string",enum:["queued","running","succeeded","failed","cancelled","timed_out"]}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/QueueOperation"})}},"/api/v1/preview-definitions":{get:{operationId:"listPreviewDefinitions",summary:"List preview policies",responses:r({type:"object"})},post:{operationId:"createPreviewDefinition",summary:"Configure bounded preview policy",responses:{"200":{description:"Preview definition created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews":{get:{operationId:"listPreviews",summary:"List authorized persistent previews",responses:r({type:"object"})},post:{operationId:"createPreview",summary:"Create or update one immutable preview identity",responses:{"200":{description:"Preview deployment queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/destroy":{post:{operationId:"destroyPreview",summary:"Confirm tagged preview teardown",responses:{"200":{description:"Teardown queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/extend":{post:{operationId:"extendPreview",summary:"Extend preview TTL",responses:{"200":{description:"Expiry extended."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/rebuild":{post:{operationId:"rebuildPreview",summary:"Rebuild the exact recorded commit",responses:{"200":{description:"Rebuild queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/cleanup":{post:{operationId:"cleanupPreviews",summary:"Dry-run or queue TTL/keep-count teardown",responses:{"200":{description:"Cleanup plan or operations."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-templates":{get:{operationId:"listComposeTemplates",summary:"List pinned verified application templates",responses:r({type:"object"})}},"/api/v1/compose-applications":{get:{operationId:"listComposeApplications",summary:"List authorized multi-service applications",responses:r({type:"object"})},post:{operationId:"createComposeApplication",summary:"Import Compose or materialize a template",responses:{"200":{description:"Editable normalized application."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/preview":{post:{operationId:"previewComposeApplication",summary:"Parse and diagnose Compose without mutation",responses:{"200":{description:"Normalized preview and actionable diagnostics."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/services":{get:{operationId:"listComposeServices",summary:"Inspect per-service desired and observed state",responses:{"200":{description:"Service topology and status."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/{action}":{post:{operationId:"operateComposeApplication",summary:"Deploy, redeploy, start, stop, scale, or delete through the durable queue",responses:{"200":{description:"Scoped operation queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/release-artifacts":{post:{operationId:"createReleaseArtifact",summary:"Register a verified content-addressed artifact",responses:{"200":{description:"Artifact identity registered."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases":{get:{operationId:"listReleases",summary:"List unified authorized release history",responses:r({type:"object"})},post:{operationId:"createRelease",summary:"Create an immutable release from an existing artifact",responses:{"200":{description:"Release record created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/capabilities":{get:{operationId:"getReleaseCapabilities",summary:"Explain supported strategies, capacity, cost, and rollback",responses:{"200":{description:"Provider-aware strategy capabilities."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}":{get:{operationId:"getRelease",summary:"Inspect provenance, approvals, health, and transitions",responses:{"200":{description:"Release detail."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}/{action}":{post:{operationId:"operateRelease",summary:"Promote, approve, activate, roll back, report health, or pin",responses:{"200":{description:"Release lifecycle updated."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/settings":{get:{operationId:"getQueueSettings",summary:"Get effective concurrency limits",responses:{"200":{description:"Queue concurrency settings."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateQueueSettings",summary:"Confirm and audit production concurrency changes",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm","concurrency"],properties:{confirm:{const:"update queue limits"},concurrency:{$ref:"#/components/schemas/QueueConcurrency"}}}}}},responses:{"200":{description:"Updated effective limits."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/history":{delete:{operationId:"clearQueueHistory",summary:"Clear terminal jobs whose retention has elapsed",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm"],properties:{confirm:{const:"clear completed"},before:{type:"string",format:"date-time"},projectId:{type:"string"}}}}}},responses:{"200":{description:"Eligible history cleared with an audit event."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs":{get:{operationId:"listOperationLogs",summary:"Resume ordered sanitized operation logs from a cursor",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:{"200":{description:"Ordered log chunks and next cursor."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs/stream":{get:{operationId:"streamOperationLogs",summary:"Stream authorized operation logs with Last-Event-ID resume",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"Last-Event-ID",in:"header",schema:{type:"integer",minimum:0}}],responses:{"200":{description:"Server-sent log and completion events.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/cancel":{post:{operationId:"cancelOperation",summary:"Cancel queued work or request cooperative running cancellation",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{content:{"application/json":{schema:{type:"object"}}}},responses:{"200":{description:"Cancellation state recorded."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/retry":{post:{operationId:"retryOperation",summary:"Retry an allow-listed failure class within the attempt limit",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["errorClass"],properties:{errorClass:{type:"string"},delayMs:{type:"integer",minimum:0}}}}}},responses:{"200":{description:"Retry queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/deployments":{post:{operationId:"createDeployment",summary:"Queue a deployment",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/DeploymentRequest"}}}},responses:{"202":{description:"Queued operation.",content:{"application/json":{schema:{$ref:"#/components/schemas/OperationResponse"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations":{get:{operationId:"listOperations",summary:"List scoped operations",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Operation"})}},"/api/v1/events":{get:{operationId:"listEvents",summary:"List scoped audit events",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:r({$ref:"#/components/schemas/Event"})}},"/api/v1/events/stream":{get:{operationId:"streamEvents",summary:"Stream scoped audit events",responses:{"200":{description:"Authenticated server-sent event stream.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/openapi.json":{get:{operationId:"getOpenApi",summary:"Get the OpenAPI contract",security:[],responses:{"200":{description:"OpenAPI 3.1 contract."}}}}},components:{securitySchemes:{bearerAuth:{type:"http",scheme:"bearer",bearerFormat:"tsc_v1"}},parameters:{Limit:{name:"limit",in:"query",schema:{type:"integer",minimum:1,maximum:100,default:50}},Cursor:{name:"cursor",in:"query",schema:{type:"string"}},ProjectId:{name:"projectId",in:"path",required:!0,schema:{type:"string"}},OperationId:{name:"operationId",in:"path",required:!0,schema:{type:"string"}}},responses:{Error:{description:"Stable error envelope.",content:{"application/json":{schema:e}}}},schemas:{Project:{type:"object",required:["id","slug","name"],properties:{id:{type:"string"},slug:{type:"string"},name:{type:"string"},description:{type:"string"}}},Environment:{type:"object",required:["id","projectId","slug","name","kind"],properties:{id:{type:"string"},projectId:{type:"string"},slug:{type:"string"},name:{type:"string"},kind:{type:"string"},region:{type:"string"}}},Service:{type:"object",required:["id","projectId","kind","slug","name"],properties:{id:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},kind:{type:"string"},slug:{type:"string"},name:{type:"string"},metadata:{type:"object",additionalProperties:!0}}},SourceConnection:{type:"object",required:["id","provider","name","host","status","credentialConfigured"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},status:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},grantedScopes:{type:"array",items:{type:"string"}}}},SourceRepository:{type:"object",required:["id","connectionId","fullName","cloneUrl","defaultBranch"],properties:{id:{type:"string"},connectionId:{type:"string"},fullName:{type:"string"},cloneUrl:{type:"string"},defaultBranch:{type:"string"},visibility:{type:"string"},archived:{type:"boolean"}}},SourceBindingRequest:{type:"object",additionalProperties:!1,required:["projectId","connectionId","repositoryFullName"],properties:{projectId:{type:"string"},environmentId:{type:"string"},resourceId:{type:"string"},connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},defaultBranch:{type:"string"},branchRule:{type:"string"},tagRule:{type:"string"},monorepoRoot:{type:"string"},includePaths:{type:"array",items:{type:"string"}},excludePaths:{type:"array",items:{type:"string"}},submodules:{type:"boolean"},cloneDepth:{type:"integer",minimum:1},deployKeyId:{type:"string"},autoDeploy:{type:"boolean"},pullRequestPreviews:{type:"boolean"}}},DetectionFile:{type:"object",additionalProperties:!1,required:["path"],properties:{path:{type:"string"},size:{type:"integer",minimum:0},content:{type:"string",maxLength:262144}}},ApplicationInput:{type:"object",additionalProperties:!1,required:["schemaVersion","name","slug","projectId","environmentId","source","build","runtime"],properties:{schemaVersion:{const:1},name:{type:"string"},slug:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},source:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["git","local","artifact","image"]}},additionalProperties:!0},build:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["dockerfile","buildpack","static","server","serverless","prebuilt_image"]},secretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}},additionalProperties:!0},runtime:{type:"object",required:["architecture","target"],properties:{architecture:{type:"string",enum:["x86_64","arm64"]},target:{type:"string",enum:["server","serverless","container"]},port:{type:"integer",minimum:1,maximum:65535},healthCheck:{type:"object",additionalProperties:!0}},additionalProperties:!0},environment:{type:"object",additionalProperties:{oneOf:[{type:"string"},{type:"object",additionalProperties:!1,required:["secretRef"],properties:{secretRef:{type:"string"}}}]}},requiredSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}},domain:{type:"object",properties:{hostname:{type:"string"},path:{type:"string"},tls:{type:"boolean"}}}}},ApplicationDraftCreateRequest:{type:"object",additionalProperties:!1,required:["projectId","draft"],properties:{projectId:{type:"string"},name:{type:"string"},draft:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string",enum:["source","build","runtime","environment","domain","review"]},suppliedSecretNames:{type:"array",uniqueItems:!0,description:"Names only; values must use the secrets boundary.",items:{type:"string"}}}},ApplicationDraft:{type:"object",required:["id","projectId","input","step","status","version"],properties:{id:{type:"string"},projectId:{type:"string"},input:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string"},suppliedSecretNames:{type:"array",items:{type:"string"}},status:{type:"string",enum:["draft","ready","applied"]},version:{type:"integer"},createdAt:{type:"string",format:"date-time"},updatedAt:{type:"string",format:"date-time"}}},RegistryConnectionRequest:{type:"object",properties:{provider:{type:"string",enum:["docker_hub","ghcr","ecr","gcr","generic"]},name:{type:"string"},host:{type:"string"},username:{type:"string",writeOnly:!0},password:{type:"string",writeOnly:!0},token:{type:"string",writeOnly:!0},credentialExpiresAt:{type:"string",format:"date-time"},expiresAt:{type:"string",format:"date-time"}}},RegistryConnection:{type:"object",required:["id","provider","name","host","credentialConfigured","status","version"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},credentialExpiresAt:{type:"string",format:"date-time"},status:{type:"string",enum:["pending","healthy","degraded","expired","disconnected"]},healthMessage:{type:"string"},lastTestedAt:{type:"string",format:"date-time"},version:{type:"integer"}}},QueueConcurrency:{type:"object",additionalProperties:!1,properties:{project:{type:"integer",minimum:1,maximum:100},environment:{type:"integer",minimum:1,maximum:100},provider:{type:"integer",minimum:1,maximum:100},builds:{type:"integer",minimum:1,maximum:100}}},QueueOperation:{allOf:[{$ref:"#/components/schemas/Operation"},{type:"object",required:["queue"],properties:{queue:{type:"object",required:["maxAttempts","availableAt","timeoutSeconds","retryClasses","resumePolicy","cancellationMode","retentionUntil"],properties:{lockKey:{type:"string"},providerKey:{type:"string"},buildSlot:{type:"boolean"},maxAttempts:{type:"integer"},availableAt:{type:"string",format:"date-time"},timeoutSeconds:{type:"integer"},heartbeatAt:{type:"string",format:"date-time"},currentStep:{type:"string"},blockedReason:{type:"string"},retryClasses:{type:"array",items:{type:"string"}},resumePolicy:{type:"string",enum:["fail","requeue"]},cancellationMode:{type:"string",enum:["cooperative","provider_non_cancellable"]},retentionUntil:{type:"string",format:"date-time"}}},approximatePosition:{type:"object",properties:{ahead:{type:"integer"},precision:{const:"bounded"}}}}}]},DeploymentRequest:{type:"object",additionalProperties:!1,required:["projectId","environmentId"],properties:{projectId:{type:"string"},environmentId:{type:"string"},serviceId:{type:"string"},action:{type:"string",enum:["deploy","rollback"],default:"deploy"},revision:{type:"string"}}},Operation:{type:"object",required:["id","state","kind","correlationId","createdAt"],properties:{id:{type:"string"},state:{type:"string"},kind:{type:"string"},correlationId:{type:"string"},createdAt:{type:"string",format:"date-time"}}},OperationResponse:{type:"object",required:["operation","idempotentReplay","requestId"],properties:{operation:{$ref:"#/components/schemas/Operation"},idempotentReplay:{type:"boolean"},requestId:{type:"string",format:"uuid"}}},Event:{type:"object",required:["id","sequence","type","level","correlationId","createdAt"],properties:{id:{type:"string"},sequence:{type:"integer"},type:{type:"string"},level:{type:"string"},correlationId:{type:"string"},payload:{},createdAt:{type:"string",format:"date-time"}}}}}}}function rR(e){return Buffer.from(JSON.stringify(e)).toString("base64url")}function nR(e){if(!e)return;try{let t=JSON.parse(Buffer.from(e,"base64url").toString("utf8"));return t&&typeof t==="object"&&!Array.isArray(t)?t:void 0}catch{return}}function Hr(e,t,r,a=["createdAt","id"]){let g=Math.min(100,Math.max(1,Number(t.searchParams.get("limit"))||50)),f=nR(t.searchParams.get("cursor"));if(t.searchParams.has("cursor")&&!f)throw new i("invalid_cursor","The pagination cursor is invalid.",400);let h=0;if(f){let k=e.findIndex((R)=>a.every((D)=>R[D]===f[D]));if(k<0)throw new i("invalid_cursor","The pagination cursor is no longer available.",400);h=k+1}let b=e.slice(h,h+g),S=h+g<e.length,y=b.at(-1);return{data:b,page:{hasMore:S,nextCursor:S&&y?rR(Object.fromEntries(a.map((k)=>[k,y[k]]))):void 0},requestId:r}}function Ca(e){let t=new Ki(e.controlPlane,e.identities),r=new c(e.controlPlane),a=new Xr(e.controlPlane),g=new Zr(e.controlPlane),f=new _t(e.controlPlane),h=e.spend?.store??new Fi(e.controlPlane,{now:e.now}),b={store:h,service:e.spend?.service??new cr(h)},S=new Map,y=e.now??(()=>new Date),k=e.rateLimit??120,R=(O,M,z,J={})=>new Response(JSON.stringify(O),{status:M,headers:{"content-type":"application/json; charset=utf-8","cache-control":"no-store","x-request-id":z,"x-api-version":ms,...J}}),D=(O,M,z,J,Z,oe)=>R({error:{code:O,message:M,requestId:J,details:Z}},z,J,oe);return async(O,M)=>{let z=new URL(O.url);if(!z.pathname.startsWith("/api/v1"))return;let J=crypto.randomUUID();if(z.pathname==="/api/v1/openapi.json"&&O.method==="GET")return R(ba(),200,J,{"cache-control":"public, max-age=300"});let Z=O.headers.get("authorization")??"",oe=Z.startsWith("Bearer ")?Z.slice(7).trim():"",G=oe?e.identities.verifyToken(oe,M):void 0;if(!G)return D("unauthorized","A valid bearer token is required.",401,J,void 0,{"www-authenticate":'Bearer realm="ts-cloud", error="invalid_token"'});let te=S.get(G.token.id),ye=y().getTime(),Se=!te||ye-te.start>=60000?{start:ye,count:0}:te;Se.count+=1,S.set(G.token.id,Se);let ie=Math.max(0,k-Se.count),xe={"x-ratelimit-limit":String(k),"x-ratelimit-remaining":String(ie),"x-ratelimit-reset":String(Math.ceil((Se.start+60000)/1000))};if(Se.count>k)return D("rate_limited","API rate limit exceeded.",429,J,void 0,{...xe,"retry-after":String(Math.max(1,Math.ceil((Se.start+60000-ye)/1000)))});try{let ee,De=async()=>{let W=await O.text();if(W.length>1048576)throw new i("payload_too_large","Request body exceeds 1 MB.",413);try{return JSON.parse(W)}catch{throw new i("invalid_json","Request body must be valid JSON.",400)}},Je=/^\/api\/v1\/projects\/([^/]+)\/environments$/.exec(z.pathname),gt=/^\/api\/v1\/operations\/([^/]+)\/logs(?:\/(stream))?$/.exec(z.pathname),jt=/^\/api\/v1\/operations\/([^/]+)\/(cancel|retry)$/.exec(z.pathname),Ze=/^\/api\/v1\/previews\/([^/]+)\/(destroy|extend|rebuild)$/.exec(z.pathname),wt=/^\/api\/v1\/compose-applications\/([^/]+)\/(deploy|redeploy|start|stop|scale|delete)$/.exec(z.pathname),Bt=/^\/api\/v1\/compose-applications\/([^/]+)\/services$/.exec(z.pathname),nt=/^\/api\/v1\/releases\/([^/]+)\/(promote|approve|activate|rollback|health|pin)$/.exec(z.pathname);if(O.method==="GET"&&z.pathname==="/api/v1/projects")ee=Hr(t.listProjects(G),z,J);else if(O.method==="GET"&&Je)ee=Hr(t.listEnvironments(G,decodeURIComponent(Je[1])),z,J);else if(O.method==="GET"&&z.pathname==="/api/v1/services"){let W=z.searchParams.get("projectId");if(!W)throw new i("validation_error","projectId is required.",422);ee=Hr(t.listServices(G,W,z.searchParams.get("environmentId")??void 0),z,J)}else if(O.method==="GET"&&z.pathname==="/api/v1/operations")ee=Hr(t.listOperations(G,z.searchParams.get("projectId")??void 0),z,J);else if(O.method==="GET"&&z.pathname==="/api/v1/previews"){let W=z.searchParams.get("projectId")??void 0,se=a.previews.listInstances({projectId:W}).filter((ue)=>{try{return t.authorize(G,"deployments:read",{type:"resource",id:ue.resourceId}),!0}catch{return!1}}).map((ue)=>({...ue}));ee=Hr(se,z,J)}else if(O.method==="GET"&&z.pathname==="/api/v1/compose-templates")ee=Hr(Jr().map((W)=>({...W})),z,J,["id","version"]);else if(O.method==="GET"&&z.pathname==="/api/v1/releases/capabilities"){let W=String(z.searchParams.get("kind")??"");ee={capabilities:In({kind:W,hasHealthGate:z.searchParams.get("health")==="true",replicas:Number(z.searchParams.get("replicas"))||1}),requestId:J}}else if(O.method==="GET"&&z.pathname==="/api/v1/releases"){let W=z.searchParams.get("projectId");if(!W)throw new i("validation_error","projectId is required.",422);t.authorize(G,"project:read",{type:"project",id:W});let se=f.releases.list({projectId:W,environmentId:z.searchParams.get("environmentId")??void 0,resourceId:z.searchParams.get("resourceId")??void 0}).filter((ue)=>{try{return t.authorize(G,"deployments:read",{type:"resource",id:ue.resourceId}),!0}catch{return!1}}).map((ue)=>({...ue,artifact:f.releases.getArtifact(ue.artifactId),transitions:f.releases.transitions(ue.id),approvals:f.releases.approvals(ue.id)}));ee=Hr(se,z,J)}else if(O.method==="POST"&&z.pathname==="/api/v1/release-artifacts"){let W=await De();t.authorize(G,"applications:manage",{type:"organization"}),ee={artifact:f.releases.registerArtifact({organizationId:G.serviceAccount.organizationId,digest:String(W.digest??""),kind:String(W.kind??""),uri:String(W.uri??""),size:Number(W.size),mediaType:typeof W.mediaType==="string"?W.mediaType:void 0,provenance:W.provenance,attestation:W.attestation}),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/releases"){let W=await De(),se=String(W.resourceId??"");t.authorize(G,"applications:manage",{type:"resource",id:se}),ee={release:f.releases.create({organizationId:G.serviceAccount.organizationId,projectId:String(W.projectId??""),environmentId:String(W.environmentId??""),resourceId:se,artifactId:String(W.artifactId??""),kind:String(W.kind??""),sourceSha:typeof W.sourceSha==="string"?W.sourceSha:void 0,config:W.config??{},manifest:W.manifest??{},provenance:W.provenance,strategy:String(W.strategy??"atomic"),healthGate:W.healthGate,hooks:W.hooks,drainSeconds:Number(W.drainSeconds)||void 0,graceSeconds:Number(W.graceSeconds)||void 0,automaticRollback:W.automaticRollback!==!1,actorId:G.actor.id,trigger:typeof W.trigger==="string"?W.trigger:"api",approvalRequired:W.approvalRequired===!0,replicas:Number(W.replicas)||void 0}),requestId:J}}else if(O.method==="GET"&&/^\/api\/v1\/releases\/[^/]+$/.test(z.pathname)){let W=decodeURIComponent(z.pathname.split("/").at(-1)),se=f.releases.get(W);if(!se)throw new i("not_found","Release was not found.",404);t.authorize(G,"deployments:read",{type:"resource",id:se.resourceId}),ee={release:se,artifact:f.releases.getArtifact(se.artifactId),transitions:f.releases.transitions(W),approvals:f.releases.approvals(W),requestId:J}}else if(O.method==="POST"&&nt){let W=f.releases.get(decodeURIComponent(nt[1]));if(!W)throw new i("not_found","Release was not found.",404);let se=await De(),ue=nt[2];if(ue==="promote"){let Ce=String(se.targetResourceId??"");t.authorize(G,"deployments:create",{type:"resource",id:Ce}),ee={release:f.releases.promote(W.id,{targetEnvironmentId:String(se.targetEnvironmentId??""),targetResourceId:Ce,config:se.config??{},strategy:se.strategy,healthGate:se.healthGate,actorId:G.actor.id,approvalRequired:se.approvalRequired===!0}),requestId:J}}else if(ue==="approve")t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId}),ee={release:f.releases.approve(W.id,{actorId:G.actor.id,decision:se.decision==="rejected"?"rejected":"approved",comment:typeof se.comment==="string"?se.comment:void 0}),requestId:J};else if(ue==="activate")t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId}),ee={operation:t.operation(f.enqueueActivation(W,{actorId:G.actor.id})),requestId:J};else if(ue==="rollback")t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId}),ee={operation:t.operation(f.enqueueRollback(W,{actorId:G.actor.id,targetReleaseId:typeof se.targetReleaseId==="string"?se.targetReleaseId:void 0})),requestId:J};else if(ue==="health"){t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId});let Ce=f.completeHealthGate(W.id,{healthy:se.healthy===!0,operationId:typeof se.operationId==="string"?se.operationId:void 0,health:se.health,message:typeof se.message==="string"?se.message:void 0});ee={release:Ce.release,rollbackOperation:Ce.rollbackOperation?t.operation(Ce.rollbackOperation):void 0,requestId:J}}else t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId}),ee={release:f.releases.pin(W.id,se.pinned!==!1,typeof se.reason==="string"?se.reason:void 0),requestId:J}}else if(O.method==="GET"&&z.pathname==="/api/v1/compose-applications"){let W=z.searchParams.get("projectId");if(!W)throw new i("validation_error","projectId is required.",422);t.authorize(G,"project:read",{type:"project",id:W});let se=g.applications.list({projectId:W,environmentId:z.searchParams.get("environmentId")??void 0}).filter((ue)=>{try{return t.authorize(G,"deployments:read",{type:"resource",id:ue.resourceId}),!0}catch{return!1}}).map((ue)=>({...ue,services:g.applications.services(ue.id)}));ee=Hr(se,z,J)}else if(O.method==="POST"&&z.pathname==="/api/v1/compose-applications/preview"){let W=await De(),se=String(W.projectId??"");t.authorize(G,"project:read",{type:"project",id:se}),ee={result:g.applications.preview(String(W.source??""),{name:String(W.name??""),slug:typeof W.slug==="string"?W.slug:void 0,projectId:se,environmentId:String(W.environmentId??"")}),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/compose-applications"){let W=await De(),se=String(W.projectId??"");t.authorize(G,"applications:manage",{type:"environment",id:String(W.environmentId??"")});let ue={name:String(W.name??""),slug:typeof W.slug==="string"?W.slug:void 0,projectId:se,environmentId:String(W.environmentId??""),createdByActorId:G.actor.id},Ce=typeof W.templateId==="string"?g.applications.fromTemplate(W.templateId,W.inputs&&typeof W.inputs==="object"&&!Array.isArray(W.inputs)?W.inputs:{},{...ue,version:typeof W.templateVersion==="string"?W.templateVersion:void 0}):g.applications.import(String(W.source??""),ue);ee={application:Ce.application,diagnostics:Ce.parsed.diagnostics,requestId:J}}else if(O.method==="GET"&&Bt){let W=g.applications.get(decodeURIComponent(Bt[1]));if(!W)throw new i("not_found","Compose application was not found.",404);t.authorize(G,"deployments:read",{type:"resource",id:W.resourceId}),ee={application:W,services:g.applications.services(W.id),requestId:J}}else if(O.method==="POST"&&wt){let W=g.applications.get(decodeURIComponent(wt[1]));if(!W)throw new i("not_found","Compose application was not found.",404);let se=wt[2],ue=await De();t.authorize(G,se==="delete"||se==="stop"?"deployments:cancel":"deployments:create",{type:"resource",id:W.resourceId}),ee={operation:t.operation(g.enqueue(W,se,{actorId:G.actor.id,service:typeof ue.service==="string"?ue.service:void 0,replicas:Number.isFinite(Number(ue.replicas))?Number(ue.replicas):void 0,removeVolumes:ue.removeVolumes===!0,confirmation:typeof ue.confirm==="string"?ue.confirm:void 0})),requestId:J}}else if(O.method==="GET"&&z.pathname==="/api/v1/preview-definitions"){let W=z.searchParams.get("projectId");if(!W)throw new i("validation_error","projectId is required.",422);t.authorize(G,"project:read",{type:"project",id:W}),ee=Hr(a.previews.listDefinitions(W).map((se)=>({...se})),z,J)}else if(O.method==="POST"&&z.pathname==="/api/v1/preview-definitions"){let W=await De();t.authorize(G,"config:write",{type:"resource",id:String(W.resourceId??"")}),ee={definition:a.previews.createDefinition({...W,projectId:String(W.projectId??""),resourceId:String(W.resourceId??""),baseEnvironmentId:String(W.baseEnvironmentId??""),domainPattern:String(W.domainPattern??""),createdByActorId:G.actor.id}),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/previews"){let W=await De(),se=a.previews.getDefinition(String(W.definitionId??""));if(!se)throw new i("not_found","Preview definition was not found.",404);t.authorize(G,"deployments:create",{type:"resource",id:se.resourceId});let ue=a.previews.upsert({definitionId:se.id,sourceProvider:"api",repository:typeof W.repository==="string"?W.repository:"api",branch:String(W.branch??""),pullRequestNumber:Number(W.pullRequestNumber)||void 0,fork:W.fork===!0,commitSha:String(W.commitSha??""),createdByActorId:G.actor.id});ee={preview:ue.preview,operation:t.operation(a.enqueueDeploy(ue.preview,{created:ue.created,actorId:G.actor.id})),requestId:J}}else if(O.method==="POST"&&Ze){let W=a.previews.getInstance(decodeURIComponent(Ze[1]));if(!W)throw new i("not_found","Preview was not found.",404);let se=await De(),ue=Ze[2];if(ue==="destroy"){if(t.authorize(G,"deployments:cancel",{type:"resource",id:W.resourceId}),se.confirm!==W.name)throw new i("confirmation_required",`Type ${W.name} to confirm preview teardown.`,409);ee={operation:t.operation(a.enqueueDestroy(W,"api",G.actor.id)),requestId:J}}else if(ue==="extend")t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId}),ee={preview:a.previews.extend(W.id,Number(se.hours)),requestId:J};else t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId}),ee={operation:t.operation(a.enqueueDeploy(W,{actorId:G.actor.id,reason:"manual_rebuild"})),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/previews/cleanup"){t.authorize(G,"automation:manage",{type:"organization"});let W=await De();if(!W.dryRun&&W.confirm!=="cleanup previews")throw new i("confirmation_required","Type cleanup previews to confirm preview cleanup.",409);ee={...a.cleanup({dryRun:W.dryRun===!0,maxAgeHours:Number(W.maxAgeHours)||void 0,keepCount:Number(W.keepCount)||void 0,actorId:G.actor.id}),requestId:J}}else if(O.method==="GET"&&z.pathname==="/api/v1/queue"){let W=z.searchParams.get("projectId")??void 0,se=z.searchParams.get("state"),ue=r.list({projectId:W,state:["queued","running","succeeded","failed","cancelled","timed_out"].includes(se)?se:void 0,limit:500}).filter((Ce)=>{let mt=Ce.operation.resourceId?{type:"resource",id:Ce.operation.resourceId}:Ce.operation.environmentId?{type:"environment",id:Ce.operation.environmentId}:Ce.operation.projectId?{type:"project",id:Ce.operation.projectId}:{type:"organization"};try{return t.authorize(G,"deployments:read",mt),!0}catch{return!1}}).map((Ce)=>({...t.operation(Ce.operation),queue:Ce.job,approximatePosition:Ce.approximatePosition}));ee=Hr(ue,z,J)}else if(O.method==="GET"&&z.pathname==="/api/v1/queue/settings")t.authorize(G,"deployments:read",G.token.scope),ee={concurrency:r.limits,requestId:J};else if(O.method==="PATCH"&&z.pathname==="/api/v1/queue/settings"){t.authorize(G,"automation:manage",{type:"organization"});let W=await De();if(W.confirm!=="update queue limits")throw new i("confirmation_required","Type update queue limits to confirm production concurrency changes.",409);ee={concurrency:r.configureConcurrency(W.concurrency??{},{organizationId:G.serviceAccount.organizationId,actorId:G.actor.id}),requestId:J}}else if(O.method==="DELETE"&&z.pathname==="/api/v1/queue/history"){t.authorize(G,"automation:manage",{type:"organization"});let W=await De();if(W.confirm!=="clear completed")throw new i("confirmation_required","Type clear completed to confirm queue retention cleanup.",409);ee={deleted:r.clearCompleted({before:typeof W.before==="string"?W.before:void 0,actorId:G.actor.id,projectId:typeof W.projectId==="string"?W.projectId:void 0}),requestId:J}}else if(O.method==="GET"&&gt){let W=e.controlPlane.getOperation(decodeURIComponent(gt[1]));if(!W)throw new i("not_found","Operation was not found.",404);let se=W.resourceId?{type:"resource",id:W.resourceId}:W.environmentId?{type:"environment",id:W.environmentId}:W.projectId?{type:"project",id:W.projectId}:{type:"organization"};t.authorize(G,"deployments:read",se);let ue=O.headers.get("last-event-id")?.trim(),Ce=Number(ue||z.searchParams.get("after")||0);if(gt[2]==="stream"){let kt=new TextEncoder,_e=Ce,yt,it=!1,Ke=new ReadableStream({start(jr){let Po=()=>{if(it)return;if(!e.identities.verifyToken(oe,M)){if(it=!0,yt)clearInterval(yt);jr.close();return}let Qn=r.logs(W.id,{after:_e,limit:500});for(let zt of Qn)_e=zt.sequence,jr.enqueue(kt.encode(`id: ${zt.sequence}
+`)){let g=a.trim().match(/^([a-f0-9]{40,64})\s+(.+)$/i);if(!g||!g[2].startsWith(t)||g[2].endsWith("^{}"))continue;let f=g[2].slice(t.length);r.set(f,{name:f,commitSha:g[1]})}return[...r.values()].sort((a,g)=>a.name.localeCompare(g.name))}async function ya(e,t={}){let r=Uy(e,t.deployKey),a=await uo(["ls-remote","--heads","--tags","--",r],r,t);return{branches:zy(a,"refs/heads/"),tags:zy(a,"refs/tags/")}}async function Sa(e,t={}){let r=Uy(e.remote,t.deployKey),a=ZE(e.destination),g=e.ref?.trim()||e.binding.defaultBranch;if(!/^[A-Za-z0-9._/-]{1,255}$/.test(g)||g.startsWith("-")||g.includes(".."))throw Error("Git ref contains unsupported characters");let f=["clone","--no-tags","--single-branch","--branch",g],h=[...new Set(e.sparsePaths??[])];if(h.some((S)=>!S||S.startsWith("/")||S.split("/").includes("..")||/[\0\r\n]/.test(S)))throw Error("Sparse checkout paths must stay inside the repository");if(h.length)f.push("--filter=blob:none","--no-checkout");if(e.binding.cloneDepth)f.push("--depth",String(e.binding.cloneDepth));if(e.binding.submodules)f.push("--recurse-submodules","--shallow-submodules");if(f.push("--",r,a),await uo(f,r,t),h.length)await uo(["-C",a,"sparse-checkout","set","--cone","--",...h],r,t),await uo(["-C",a,"checkout","--force"],r,t);if(e.commitSha){if(!/^[a-f0-9]{40,64}$/i.test(e.commitSha))throw Error("Expected source commit must be an immutable 40-64 character SHA");await uo(["-C",a,"fetch","--no-tags","--depth","1","origin",e.commitSha],r,t),await uo(["-C",a,"checkout","--detach","--force",e.commitSha],r,t)}let b=(await uo(["-C",a,"rev-parse","HEAD"],r,t)).trim();if(!/^[a-f0-9]{40,64}$/i.test(b))throw Error("Git clone did not produce a valid commit SHA");if(e.commitSha&&b.toLowerCase()!==e.commitSha.toLowerCase())throw Error(`Git checkout resolved ${b} instead of the requested immutable commit`);return{directory:e.binding.monorepoRoot==="."?a:vd(a,e.binding.monorepoRoot),commitSha:b}}function na(e){return["github","gitlab","bitbucket","gitea"].includes(e)}async function Ia(e,t,r){let a=e.getConnection(t);if(!a||["disconnected","expired"].includes(a.status))throw Error("Active source connection was not found");try{if(na(a.provider)){let h=await ct(a,e.getCredential(a.id)).testConnection();return e.updateHealth(a.id,{status:h.ok?"healthy":"degraded",message:h.message,tested:!0,grantedScopes:h.scopes})}let g=r?e.getRepository(r):e.listRepositories(a.id,void 0,1)[0];if(!g)return e.updateHealth(a.id,{status:"degraded",message:"Add a repository URL before testing this generic connection.",tested:!0});let f=a.provider==="generic_ssh"?e.listBindings({connectionId:a.id}).map((h)=>h.deployKeyId).filter(Boolean).map((h)=>e.getDeployKey(h)).find(Boolean):void 0;return await ya(g.cloneUrl,{credential:e.getCredential(a.id),deployKey:f?{...f,privateKey:e.getDeployPrivateKey(f.id)}:void 0}),e.updateHealth(a.id,{status:"healthy",message:"Git repository access is healthy.",tested:!0})}catch(g){return e.updateHealth(a.id,{status:"degraded",message:g instanceof Error?g.message:"Connection test failed",tested:!0})}}async function gs(e,t,r={}){let a=e.getConnection(t);if(!a||!na(a.provider)||["disconnected","expired"].includes(a.status))throw Error("A hosted active source connection is required for repository discovery");let g=ct(a,e.getCredential(a.id)),f=[],h;for(let b=0;b<Math.min(20,Math.max(1,r.maxPages??10));b++){let S=await g.listRepositories({cursor:h,search:r.search,limit:100});for(let y of S.repositories)f.push(e.upsertRepository({connectionId:a.id,...y}));if(h=S.nextCursor,!h)break}return e.updateHealth(a.id,{status:"healthy",message:`${f.length} repositories synchronized.`,synced:!0}),f}async function ps(e,t){let r=e.getConnection(t.connectionId);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");if(na(r.provider)){let b=ct(r,e.getCredential(r.id));return t.type==="tags"?b.listTags(t.repository,t):b.listBranches(t.repository,t)}let a=t.repositoryId?e.getRepository(t.repositoryId):e.listRepositories(r.id).find((b)=>b.fullName===t.repository);if(!a||a.connectionId!==r.id)throw Error("Generic repository metadata was not found");let g=t.deployKeyId?e.getDeployKey(t.deployKeyId):void 0;if(g&&g.connectionId!==r.id)throw Error("Deploy key does not belong to this connection");let f=await ya(a.cloneUrl,{credential:e.getCredential(r.id),deployKey:g?{...g,privateKey:e.getDeployPrivateKey(g.id)}:void 0});return{refs:(t.type==="tags"?f.tags:f.branches).slice(0,Math.min(500,t.limit??100))}}async function bn(e,t,r){let a=e.getWebhook(t),g=a?e.getConnection(a.connectionId):void 0;if(!a||!g||["disconnected","expired"].includes(g.status))throw Error("Active source webhook was not found");let f=Sr(r,{...a,endpointToken:e.getWebhookEndpointToken(a.id)});if(!na(g.provider))return e.updateWebhookState(a.id,{status:"healthy",healthMessage:"Manual webhook endpoint is ready.",reconciled:!0});try{let h=ct(g,e.getCredential(g.id)),b=e.getWebhookSecret(a.id),S=a.providerWebhookId?await h.updateWebhook(a.repositoryFullName,a.providerWebhookId,{url:f,secret:b,events:a.events}):await h.createWebhook(a.repositoryFullName,{url:f,secret:b,events:a.events});return e.updateWebhookState(a.id,{providerWebhookId:S.providerWebhookId,status:S.active?"healthy":"degraded",healthMessage:S.active?"Provider webhook is synchronized.":"Provider webhook exists but is inactive.",reconciled:!0})}catch(h){return e.updateWebhookState(a.id,{status:"degraded",healthMessage:h instanceof Error?h.message:"Webhook reconciliation failed",reconciled:!0})}}async function Cu(e,t){let r=e.getWebhook(t),a=r?e.getConnection(r.connectionId):void 0;if(!r||!a)throw Error("Source webhook was not found");if(na(a.provider)&&r.providerWebhookId&&!["disconnected","expired"].includes(a.status))await ct(a,e.getCredential(a.id)).deleteWebhook(r.repositoryFullName,r.providerWebhookId);return e.updateWebhookState(r.id,{status:"disabled",healthMessage:"Webhook disabled."})}var ms="1.6.0";function ba(){let e={type:"object",required:["error"],properties:{error:{type:"object",required:["code","message","requestId"],properties:{code:{type:"string"},message:{type:"string"},requestId:{type:"string",format:"uuid"},details:{}}}}},t=(a)=>({type:"object",required:["data","page","requestId"],properties:{data:{type:"array",items:a},page:{type:"object",required:["hasMore"],properties:{nextCursor:{type:"string"},hasMore:{type:"boolean"}}},requestId:{type:"string",format:"uuid"}}}),r=(a)=>({"200":{description:"A stable cursor page.",content:{"application/json":{schema:t(a)}}},default:{$ref:"#/components/responses/Error"}});return{openapi:"3.1.0",info:{title:"ts-cloud API",version:ms,description:"Additive changes are released within v1. Breaking request or response changes require a new URL version."},servers:[{url:"/"}],security:[{bearerAuth:[]}],paths:{...Qo(),"/api/v1/projects":{get:{operationId:"listProjects",summary:"List accessible projects",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Project"})}},"/api/v1/projects/{projectId}/environments":{get:{operationId:"listEnvironments",summary:"List accessible project environments",parameters:[{$ref:"#/components/parameters/ProjectId"},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Environment"})}},"/api/v1/services":{get:{operationId:"listServices",summary:"List accessible services",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{name:"environmentId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Service"})}},"/api/v1/source/connections":{get:{operationId:"listSourceConnections",summary:"List safe Git connection metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/SourceConnection"})},post:{operationId:"createSourceConnection",summary:"Create an encrypted Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["provider","name","host"],properties:{provider:{type:"string",enum:["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"]},name:{type:"string"},host:{type:"string",format:"uri"},token:{type:"string",writeOnly:!0},repositoryFullName:{type:"string"},repositoryUrl:{type:"string"}}}}}},responses:{"201":{description:"Encrypted connection created."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectSourceConnection",summary:"Preview or safely disconnect a Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["id"],properties:{id:{type:"string"},preview:{type:"boolean"}}}}}},responses:{"200":{description:"Impact preview or disconnected connection."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/repositories":{get:{operationId:"listSourceRepositories",summary:"List or synchronize granted repositories",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"sync",in:"query",schema:{type:"boolean"}},{name:"search",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/SourceRepository"})}},"/api/v1/source/refs":{get:{operationId:"listSourceRefs",summary:"List repository branches or tags",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"repository",in:"query",required:!0,schema:{type:"string"}},{name:"repositoryId",in:"query",schema:{type:"string"}},{name:"type",in:"query",schema:{type:"string",enum:["branches","tags"]}}],responses:{"200":{description:"Provider reference page."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/bindings":{post:{operationId:"createSourceBinding",summary:"Bind a repository to an application",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/SourceBindingRequest"}}}},responses:{"201":{description:"Source binding created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/webhooks":{post:{operationId:"createSourceWebhook",summary:"Create and optionally reconcile a signed webhook",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["connectionId","repositoryFullName","baseUrl"],properties:{connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},baseUrl:{type:"string",format:"uri"},events:{type:"array",items:{type:"string",enum:["push","pull_request"]}},reconcile:{type:"boolean"}}}}}},responses:{"201":{description:"Webhook endpoint created; endpoint is revealed once."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-detections":{post:{operationId:"detectApplication",summary:"Detect bounded application build candidates",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["files"],properties:{files:{type:"array",maxItems:1e4,items:{$ref:"#/components/schemas/DetectionFile"}}}}}}},responses:{"200":{description:"Ranked detection candidates with evidence."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-plans":{post:{operationId:"planApplication",summary:"Validate and normalize an application manifest",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["draft"],properties:{draft:{$ref:"#/components/schemas/ApplicationInput"},suppliedSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}}}}}},responses:{"200":{description:"Validated plan, config patch, capabilities, costs, and missing secret names."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-drafts":{get:{operationId:"listApplicationDrafts",summary:"List resumable secret-free drafts",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/ApplicationDraft"})},post:{operationId:"createApplicationDraft",summary:"Create a resumable application draft",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/ApplicationDraftCreateRequest"}}}},responses:{"201":{description:"Draft created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateApplicationDraft",summary:"Optimistically update a draft",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/ApplicationDraftCreateRequest"},{type:"object",required:["id","version","step"],properties:{id:{type:"string"},version:{type:"integer",minimum:1}}}]}}}},responses:{"200":{description:"Updated draft."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/applications":{post:{operationId:"createApplication",summary:"Confirm and queue an application plan",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["draftId","version","confirmEnvironment"],properties:{draftId:{type:"string"},version:{type:"integer",minimum:1},confirmEnvironment:{type:"string",description:"Exact target environment slug."}}}}}},responses:{"202":{description:"Application operation queued; identical requests replay safely."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-artifacts":{post:{operationId:"uploadApplicationArtifact",summary:"Inspect and store a bounded ZIP or TAR source artifact",parameters:[{name:"X-Project-Id",in:"header",required:!0,schema:{type:"string"}},{name:"X-Artifact-Filename",in:"header",required:!0,schema:{type:"string"}}],requestBody:{required:!0,content:{"application/octet-stream":{schema:{type:"string",format:"binary",maxLength:104857600}}}},responses:{"201":{description:"Deduplicated artifact metadata; archive contents are never executed."},"413":{$ref:"#/components/responses/Error"},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/registry-connections":{get:{operationId:"listRegistryConnections",summary:"List safe private-registry metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/RegistryConnection"})},post:{operationId:"createRegistryConnection",summary:"Create an encrypted private-registry connection",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/RegistryConnectionRequest"}}}},responses:{"201":{description:"Encrypted registry connection created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateRegistryConnection",summary:"Test access or rotate write-only credentials",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/RegistryConnectionRequest"},{type:"object",required:["id","action"],properties:{id:{type:"string"},action:{type:"string",enum:["test","rotate"]},image:{type:"string"}}}]}}}},responses:{"200":{description:"Safe connection health metadata."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectRegistryConnection",summary:"Disconnect and erase registry credentials",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["id"],properties:{id:{type:"string"}}}}}},responses:{"200":{description:"Credentials erased and connection disconnected."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue":{get:{operationId:"listQueue",summary:"List authorized durable operations and blocking metadata",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"state",in:"query",schema:{type:"string",enum:["queued","running","succeeded","failed","cancelled","timed_out"]}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/QueueOperation"})}},"/api/v1/preview-definitions":{get:{operationId:"listPreviewDefinitions",summary:"List preview policies",responses:r({type:"object"})},post:{operationId:"createPreviewDefinition",summary:"Configure bounded preview policy",responses:{"200":{description:"Preview definition created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews":{get:{operationId:"listPreviews",summary:"List authorized persistent previews",responses:r({type:"object"})},post:{operationId:"createPreview",summary:"Create or update one immutable preview identity",responses:{"200":{description:"Preview deployment queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/destroy":{post:{operationId:"destroyPreview",summary:"Confirm tagged preview teardown",responses:{"200":{description:"Teardown queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/extend":{post:{operationId:"extendPreview",summary:"Extend preview TTL",responses:{"200":{description:"Expiry extended."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/rebuild":{post:{operationId:"rebuildPreview",summary:"Rebuild the exact recorded commit",responses:{"200":{description:"Rebuild queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/cleanup":{post:{operationId:"cleanupPreviews",summary:"Dry-run or queue TTL/keep-count teardown",responses:{"200":{description:"Cleanup plan or operations."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-templates":{get:{operationId:"listComposeTemplates",summary:"List pinned verified application templates",responses:r({type:"object"})}},"/api/v1/compose-applications":{get:{operationId:"listComposeApplications",summary:"List authorized multi-service applications",responses:r({type:"object"})},post:{operationId:"createComposeApplication",summary:"Import Compose or materialize a template",responses:{"200":{description:"Editable normalized application."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/preview":{post:{operationId:"previewComposeApplication",summary:"Parse and diagnose Compose without mutation",responses:{"200":{description:"Normalized preview and actionable diagnostics."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/services":{get:{operationId:"listComposeServices",summary:"Inspect per-service desired and observed state",responses:{"200":{description:"Service topology and status."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/{action}":{post:{operationId:"operateComposeApplication",summary:"Deploy, redeploy, start, stop, scale, or delete through the durable queue",responses:{"200":{description:"Scoped operation queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/release-artifacts":{post:{operationId:"createReleaseArtifact",summary:"Register a verified content-addressed artifact",responses:{"200":{description:"Artifact identity registered."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases":{get:{operationId:"listReleases",summary:"List unified authorized release history",responses:r({type:"object"})},post:{operationId:"createRelease",summary:"Create an immutable release from an existing artifact",responses:{"200":{description:"Release record created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/capabilities":{get:{operationId:"getReleaseCapabilities",summary:"Explain supported strategies, capacity, cost, and rollback",responses:{"200":{description:"Provider-aware strategy capabilities."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}":{get:{operationId:"getRelease",summary:"Inspect provenance, approvals, health, and transitions",responses:{"200":{description:"Release detail."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}/{action}":{post:{operationId:"operateRelease",summary:"Promote, approve, activate, roll back, report health, or pin",responses:{"200":{description:"Release lifecycle updated."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/settings":{get:{operationId:"getQueueSettings",summary:"Get effective concurrency limits",responses:{"200":{description:"Queue concurrency settings."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateQueueSettings",summary:"Confirm and audit production concurrency changes",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm","concurrency"],properties:{confirm:{const:"update queue limits"},concurrency:{$ref:"#/components/schemas/QueueConcurrency"}}}}}},responses:{"200":{description:"Updated effective limits."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/history":{delete:{operationId:"clearQueueHistory",summary:"Clear terminal jobs whose retention has elapsed",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm"],properties:{confirm:{const:"clear completed"},before:{type:"string",format:"date-time"},projectId:{type:"string"}}}}}},responses:{"200":{description:"Eligible history cleared with an audit event."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs":{get:{operationId:"listOperationLogs",summary:"Resume ordered sanitized operation logs from a cursor",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:{"200":{description:"Ordered log chunks and next cursor."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs/stream":{get:{operationId:"streamOperationLogs",summary:"Stream authorized operation logs with Last-Event-ID resume",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"Last-Event-ID",in:"header",schema:{type:"integer",minimum:0}}],responses:{"200":{description:"Server-sent log and completion events.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/cancel":{post:{operationId:"cancelOperation",summary:"Cancel queued work or request cooperative running cancellation",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{content:{"application/json":{schema:{type:"object"}}}},responses:{"200":{description:"Cancellation state recorded."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/retry":{post:{operationId:"retryOperation",summary:"Retry an allow-listed failure class within the attempt limit",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["errorClass"],properties:{errorClass:{type:"string"},delayMs:{type:"integer",minimum:0}}}}}},responses:{"200":{description:"Retry queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/deployments":{post:{operationId:"createDeployment",summary:"Queue a deployment",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/DeploymentRequest"}}}},responses:{"202":{description:"Queued operation.",content:{"application/json":{schema:{$ref:"#/components/schemas/OperationResponse"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations":{get:{operationId:"listOperations",summary:"List scoped operations",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Operation"})}},"/api/v1/events":{get:{operationId:"listEvents",summary:"List scoped audit events",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:r({$ref:"#/components/schemas/Event"})}},"/api/v1/events/stream":{get:{operationId:"streamEvents",summary:"Stream scoped audit events",responses:{"200":{description:"Authenticated server-sent event stream.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/openapi.json":{get:{operationId:"getOpenApi",summary:"Get the OpenAPI contract",security:[],responses:{"200":{description:"OpenAPI 3.1 contract."}}}}},components:{securitySchemes:{bearerAuth:{type:"http",scheme:"bearer",bearerFormat:"tsc_v1"}},parameters:{Limit:{name:"limit",in:"query",schema:{type:"integer",minimum:1,maximum:100,default:50}},Cursor:{name:"cursor",in:"query",schema:{type:"string"}},ProjectId:{name:"projectId",in:"path",required:!0,schema:{type:"string"}},OperationId:{name:"operationId",in:"path",required:!0,schema:{type:"string"}}},responses:{Error:{description:"Stable error envelope.",content:{"application/json":{schema:e}}}},schemas:{Project:{type:"object",required:["id","slug","name"],properties:{id:{type:"string"},slug:{type:"string"},name:{type:"string"},description:{type:"string"}}},Environment:{type:"object",required:["id","projectId","slug","name","kind"],properties:{id:{type:"string"},projectId:{type:"string"},slug:{type:"string"},name:{type:"string"},kind:{type:"string"},region:{type:"string"}}},Service:{type:"object",required:["id","projectId","kind","slug","name"],properties:{id:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},kind:{type:"string"},slug:{type:"string"},name:{type:"string"},metadata:{type:"object",additionalProperties:!0}}},SourceConnection:{type:"object",required:["id","provider","name","host","status","credentialConfigured"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},status:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},grantedScopes:{type:"array",items:{type:"string"}}}},SourceRepository:{type:"object",required:["id","connectionId","fullName","cloneUrl","defaultBranch"],properties:{id:{type:"string"},connectionId:{type:"string"},fullName:{type:"string"},cloneUrl:{type:"string"},defaultBranch:{type:"string"},visibility:{type:"string"},archived:{type:"boolean"}}},SourceBindingRequest:{type:"object",additionalProperties:!1,required:["projectId","connectionId","repositoryFullName"],properties:{projectId:{type:"string"},environmentId:{type:"string"},resourceId:{type:"string"},connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},defaultBranch:{type:"string"},branchRule:{type:"string"},tagRule:{type:"string"},monorepoRoot:{type:"string"},includePaths:{type:"array",items:{type:"string"}},excludePaths:{type:"array",items:{type:"string"}},submodules:{type:"boolean"},cloneDepth:{type:"integer",minimum:1},deployKeyId:{type:"string"},autoDeploy:{type:"boolean"},pullRequestPreviews:{type:"boolean"}}},DetectionFile:{type:"object",additionalProperties:!1,required:["path"],properties:{path:{type:"string"},size:{type:"integer",minimum:0},content:{type:"string",maxLength:262144}}},ApplicationInput:{type:"object",additionalProperties:!1,required:["schemaVersion","name","slug","projectId","environmentId","source","build","runtime"],properties:{schemaVersion:{const:1},name:{type:"string"},slug:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},source:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["git","local","artifact","image"]}},additionalProperties:!0},build:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["dockerfile","buildpack","static","server","serverless","prebuilt_image"]},secretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}},additionalProperties:!0},runtime:{type:"object",required:["architecture","target"],properties:{architecture:{type:"string",enum:["x86_64","arm64"]},target:{type:"string",enum:["server","serverless","container"]},port:{type:"integer",minimum:1,maximum:65535},healthCheck:{type:"object",additionalProperties:!0}},additionalProperties:!0},environment:{type:"object",additionalProperties:{oneOf:[{type:"string"},{type:"object",additionalProperties:!1,required:["secretRef"],properties:{secretRef:{type:"string"}}}]}},requiredSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}},domain:{type:"object",properties:{hostname:{type:"string"},path:{type:"string"},tls:{type:"boolean"}}}}},ApplicationDraftCreateRequest:{type:"object",additionalProperties:!1,required:["projectId","draft"],properties:{projectId:{type:"string"},name:{type:"string"},draft:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string",enum:["source","build","runtime","environment","domain","review"]},suppliedSecretNames:{type:"array",uniqueItems:!0,description:"Names only; values must use the secrets boundary.",items:{type:"string"}}}},ApplicationDraft:{type:"object",required:["id","projectId","input","step","status","version"],properties:{id:{type:"string"},projectId:{type:"string"},input:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string"},suppliedSecretNames:{type:"array",items:{type:"string"}},status:{type:"string",enum:["draft","ready","applied"]},version:{type:"integer"},createdAt:{type:"string",format:"date-time"},updatedAt:{type:"string",format:"date-time"}}},RegistryConnectionRequest:{type:"object",properties:{provider:{type:"string",enum:["docker_hub","ghcr","ecr","gcr","generic"]},name:{type:"string"},host:{type:"string"},username:{type:"string",writeOnly:!0},password:{type:"string",writeOnly:!0},token:{type:"string",writeOnly:!0},credentialExpiresAt:{type:"string",format:"date-time"},expiresAt:{type:"string",format:"date-time"}}},RegistryConnection:{type:"object",required:["id","provider","name","host","credentialConfigured","status","version"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},credentialExpiresAt:{type:"string",format:"date-time"},status:{type:"string",enum:["pending","healthy","degraded","expired","disconnected"]},healthMessage:{type:"string"},lastTestedAt:{type:"string",format:"date-time"},version:{type:"integer"}}},QueueConcurrency:{type:"object",additionalProperties:!1,properties:{project:{type:"integer",minimum:1,maximum:100},environment:{type:"integer",minimum:1,maximum:100},provider:{type:"integer",minimum:1,maximum:100},builds:{type:"integer",minimum:1,maximum:100}}},QueueOperation:{allOf:[{$ref:"#/components/schemas/Operation"},{type:"object",required:["queue"],properties:{queue:{type:"object",required:["maxAttempts","availableAt","timeoutSeconds","retryClasses","resumePolicy","cancellationMode","retentionUntil"],properties:{lockKey:{type:"string"},providerKey:{type:"string"},buildSlot:{type:"boolean"},maxAttempts:{type:"integer"},availableAt:{type:"string",format:"date-time"},timeoutSeconds:{type:"integer"},heartbeatAt:{type:"string",format:"date-time"},currentStep:{type:"string"},blockedReason:{type:"string"},retryClasses:{type:"array",items:{type:"string"}},resumePolicy:{type:"string",enum:["fail","requeue"]},cancellationMode:{type:"string",enum:["cooperative","provider_non_cancellable"]},retentionUntil:{type:"string",format:"date-time"}}},approximatePosition:{type:"object",properties:{ahead:{type:"integer"},precision:{const:"bounded"}}}}}]},DeploymentRequest:{type:"object",additionalProperties:!1,required:["projectId","environmentId"],properties:{projectId:{type:"string"},environmentId:{type:"string"},serviceId:{type:"string"},action:{type:"string",enum:["deploy","rollback"],default:"deploy"},revision:{type:"string"}}},Operation:{type:"object",required:["id","state","kind","correlationId","createdAt"],properties:{id:{type:"string"},state:{type:"string"},kind:{type:"string"},correlationId:{type:"string"},createdAt:{type:"string",format:"date-time"}}},OperationResponse:{type:"object",required:["operation","idempotentReplay","requestId"],properties:{operation:{$ref:"#/components/schemas/Operation"},idempotentReplay:{type:"boolean"},requestId:{type:"string",format:"uuid"}}},Event:{type:"object",required:["id","sequence","type","level","correlationId","createdAt"],properties:{id:{type:"string"},sequence:{type:"integer"},type:{type:"string"},level:{type:"string"},correlationId:{type:"string"},payload:{},createdAt:{type:"string",format:"date-time"}}}}}}}function rR(e){return Buffer.from(JSON.stringify(e)).toString("base64url")}function nR(e){if(!e)return;try{let t=JSON.parse(Buffer.from(e,"base64url").toString("utf8"));return t&&typeof t==="object"&&!Array.isArray(t)?t:void 0}catch{return}}function Hr(e,t,r,a=["createdAt","id"]){let g=Math.min(100,Math.max(1,Number(t.searchParams.get("limit"))||50)),f=nR(t.searchParams.get("cursor"));if(t.searchParams.has("cursor")&&!f)throw new i("invalid_cursor","The pagination cursor is invalid.",400);let h=0;if(f){let k=e.findIndex((R)=>a.every((D)=>R[D]===f[D]));if(k<0)throw new i("invalid_cursor","The pagination cursor is no longer available.",400);h=k+1}let b=e.slice(h,h+g),S=h+g<e.length,y=b.at(-1);return{data:b,page:{hasMore:S,nextCursor:S&&y?rR(Object.fromEntries(a.map((k)=>[k,y[k]]))):void 0},requestId:r}}function Ca(e){let t=new Ki(e.controlPlane,e.identities),r=new c(e.controlPlane),a=new Xr(e.controlPlane),g=new Zr(e.controlPlane),f=new _t(e.controlPlane),h=e.spend?.store??new Fi(e.controlPlane,{now:e.now}),b={store:h,service:e.spend?.service??new cr(h)},S=new Map,y=e.now??(()=>new Date),k=e.rateLimit??120,R=(O,M,z,J={})=>new Response(JSON.stringify(O),{status:M,headers:{"content-type":"application/json; charset=utf-8","cache-control":"no-store","x-request-id":z,"x-api-version":ms,...J}}),D=(O,M,z,J,Z,oe)=>R({error:{code:O,message:M,requestId:J,details:Z}},z,J,oe);return async(O,M)=>{let z=new URL(O.url);if(!z.pathname.startsWith("/api/v1"))return;let J=crypto.randomUUID();if(z.pathname==="/api/v1/openapi.json"&&O.method==="GET")return R(ba(),200,J,{"cache-control":"public, max-age=300"});let Z=O.headers.get("authorization")??"",oe=Z.startsWith("Bearer ")?Z.slice(7).trim():"",G=oe?e.identities.verifyToken(oe,M):void 0;if(!G)return D("unauthorized","A valid bearer token is required.",401,J,void 0,{"www-authenticate":'Bearer realm="ts-cloud", error="invalid_token"'});let te=S.get(G.token.id),ye=y().getTime(),be=!te||ye-te.start>=60000?{start:ye,count:0}:te;be.count+=1,S.set(G.token.id,be);let ie=Math.max(0,k-be.count),_e={"x-ratelimit-limit":String(k),"x-ratelimit-remaining":String(ie),"x-ratelimit-reset":String(Math.ceil((be.start+60000)/1000))};if(be.count>k)return D("rate_limited","API rate limit exceeded.",429,J,void 0,{..._e,"retry-after":String(Math.max(1,Math.ceil((be.start+60000-ye)/1000)))});try{let ee,xe=async()=>{let W=await O.text();if(W.length>1048576)throw new i("payload_too_large","Request body exceeds 1 MB.",413);try{return JSON.parse(W)}catch{throw new i("invalid_json","Request body must be valid JSON.",400)}},Je=/^\/api\/v1\/projects\/([^/]+)\/environments$/.exec(z.pathname),gt=/^\/api\/v1\/operations\/([^/]+)\/logs(?:\/(stream))?$/.exec(z.pathname),jt=/^\/api\/v1\/operations\/([^/]+)\/(cancel|retry)$/.exec(z.pathname),Ze=/^\/api\/v1\/previews\/([^/]+)\/(destroy|extend|rebuild)$/.exec(z.pathname),wt=/^\/api\/v1\/compose-applications\/([^/]+)\/(deploy|redeploy|start|stop|scale|delete)$/.exec(z.pathname),Bt=/^\/api\/v1\/compose-applications\/([^/]+)\/services$/.exec(z.pathname),nt=/^\/api\/v1\/releases\/([^/]+)\/(promote|approve|activate|rollback|health|pin)$/.exec(z.pathname);if(O.method==="GET"&&z.pathname==="/api/v1/projects")ee=Hr(t.listProjects(G),z,J);else if(O.method==="GET"&&Je)ee=Hr(t.listEnvironments(G,decodeURIComponent(Je[1])),z,J);else if(O.method==="GET"&&z.pathname==="/api/v1/services"){let W=z.searchParams.get("projectId");if(!W)throw new i("validation_error","projectId is required.",422);ee=Hr(t.listServices(G,W,z.searchParams.get("environmentId")??void 0),z,J)}else if(O.method==="GET"&&z.pathname==="/api/v1/operations")ee=Hr(t.listOperations(G,z.searchParams.get("projectId")??void 0),z,J);else if(O.method==="GET"&&z.pathname==="/api/v1/previews"){let W=z.searchParams.get("projectId")??void 0,se=a.previews.listInstances({projectId:W}).filter((ue)=>{try{return t.authorize(G,"deployments:read",{type:"resource",id:ue.resourceId}),!0}catch{return!1}}).map((ue)=>({...ue}));ee=Hr(se,z,J)}else if(O.method==="GET"&&z.pathname==="/api/v1/compose-templates")ee=Hr(Jr().map((W)=>({...W})),z,J,["id","version"]);else if(O.method==="GET"&&z.pathname==="/api/v1/releases/capabilities"){let W=String(z.searchParams.get("kind")??"");ee={capabilities:In({kind:W,hasHealthGate:z.searchParams.get("health")==="true",replicas:Number(z.searchParams.get("replicas"))||1}),requestId:J}}else if(O.method==="GET"&&z.pathname==="/api/v1/releases"){let W=z.searchParams.get("projectId");if(!W)throw new i("validation_error","projectId is required.",422);t.authorize(G,"project:read",{type:"project",id:W});let se=f.releases.list({projectId:W,environmentId:z.searchParams.get("environmentId")??void 0,resourceId:z.searchParams.get("resourceId")??void 0}).filter((ue)=>{try{return t.authorize(G,"deployments:read",{type:"resource",id:ue.resourceId}),!0}catch{return!1}}).map((ue)=>({...ue,artifact:f.releases.getArtifact(ue.artifactId),transitions:f.releases.transitions(ue.id),approvals:f.releases.approvals(ue.id)}));ee=Hr(se,z,J)}else if(O.method==="POST"&&z.pathname==="/api/v1/release-artifacts"){let W=await xe();t.authorize(G,"applications:manage",{type:"organization"}),ee={artifact:f.releases.registerArtifact({organizationId:G.serviceAccount.organizationId,digest:String(W.digest??""),kind:String(W.kind??""),uri:String(W.uri??""),size:Number(W.size),mediaType:typeof W.mediaType==="string"?W.mediaType:void 0,provenance:W.provenance,attestation:W.attestation}),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/releases"){let W=await xe(),se=String(W.resourceId??"");t.authorize(G,"applications:manage",{type:"resource",id:se}),ee={release:f.releases.create({organizationId:G.serviceAccount.organizationId,projectId:String(W.projectId??""),environmentId:String(W.environmentId??""),resourceId:se,artifactId:String(W.artifactId??""),kind:String(W.kind??""),sourceSha:typeof W.sourceSha==="string"?W.sourceSha:void 0,config:W.config??{},manifest:W.manifest??{},provenance:W.provenance,strategy:String(W.strategy??"atomic"),healthGate:W.healthGate,hooks:W.hooks,drainSeconds:Number(W.drainSeconds)||void 0,graceSeconds:Number(W.graceSeconds)||void 0,automaticRollback:W.automaticRollback!==!1,actorId:G.actor.id,trigger:typeof W.trigger==="string"?W.trigger:"api",approvalRequired:W.approvalRequired===!0,replicas:Number(W.replicas)||void 0}),requestId:J}}else if(O.method==="GET"&&/^\/api\/v1\/releases\/[^/]+$/.test(z.pathname)){let W=decodeURIComponent(z.pathname.split("/").at(-1)),se=f.releases.get(W);if(!se)throw new i("not_found","Release was not found.",404);t.authorize(G,"deployments:read",{type:"resource",id:se.resourceId}),ee={release:se,artifact:f.releases.getArtifact(se.artifactId),transitions:f.releases.transitions(W),approvals:f.releases.approvals(W),requestId:J}}else if(O.method==="POST"&&nt){let W=f.releases.get(decodeURIComponent(nt[1]));if(!W)throw new i("not_found","Release was not found.",404);let se=await xe(),ue=nt[2];if(ue==="promote"){let Ee=String(se.targetResourceId??"");t.authorize(G,"deployments:create",{type:"resource",id:Ee}),ee={release:f.releases.promote(W.id,{targetEnvironmentId:String(se.targetEnvironmentId??""),targetResourceId:Ee,config:se.config??{},strategy:se.strategy,healthGate:se.healthGate,actorId:G.actor.id,approvalRequired:se.approvalRequired===!0}),requestId:J}}else if(ue==="approve")t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId}),ee={release:f.releases.approve(W.id,{actorId:G.actor.id,decision:se.decision==="rejected"?"rejected":"approved",comment:typeof se.comment==="string"?se.comment:void 0}),requestId:J};else if(ue==="activate")t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId}),ee={operation:t.operation(f.enqueueActivation(W,{actorId:G.actor.id})),requestId:J};else if(ue==="rollback")t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId}),ee={operation:t.operation(f.enqueueRollback(W,{actorId:G.actor.id,targetReleaseId:typeof se.targetReleaseId==="string"?se.targetReleaseId:void 0})),requestId:J};else if(ue==="health"){t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId});let Ee=f.completeHealthGate(W.id,{healthy:se.healthy===!0,operationId:typeof se.operationId==="string"?se.operationId:void 0,health:se.health,message:typeof se.message==="string"?se.message:void 0});ee={release:Ee.release,rollbackOperation:Ee.rollbackOperation?t.operation(Ee.rollbackOperation):void 0,requestId:J}}else t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId}),ee={release:f.releases.pin(W.id,se.pinned!==!1,typeof se.reason==="string"?se.reason:void 0),requestId:J}}else if(O.method==="GET"&&z.pathname==="/api/v1/compose-applications"){let W=z.searchParams.get("projectId");if(!W)throw new i("validation_error","projectId is required.",422);t.authorize(G,"project:read",{type:"project",id:W});let se=g.applications.list({projectId:W,environmentId:z.searchParams.get("environmentId")??void 0}).filter((ue)=>{try{return t.authorize(G,"deployments:read",{type:"resource",id:ue.resourceId}),!0}catch{return!1}}).map((ue)=>({...ue,services:g.applications.services(ue.id)}));ee=Hr(se,z,J)}else if(O.method==="POST"&&z.pathname==="/api/v1/compose-applications/preview"){let W=await xe(),se=String(W.projectId??"");t.authorize(G,"project:read",{type:"project",id:se}),ee={result:g.applications.preview(String(W.source??""),{name:String(W.name??""),slug:typeof W.slug==="string"?W.slug:void 0,projectId:se,environmentId:String(W.environmentId??"")}),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/compose-applications"){let W=await xe(),se=String(W.projectId??"");t.authorize(G,"applications:manage",{type:"environment",id:String(W.environmentId??"")});let ue={name:String(W.name??""),slug:typeof W.slug==="string"?W.slug:void 0,projectId:se,environmentId:String(W.environmentId??""),createdByActorId:G.actor.id},Ee=typeof W.templateId==="string"?g.applications.fromTemplate(W.templateId,W.inputs&&typeof W.inputs==="object"&&!Array.isArray(W.inputs)?W.inputs:{},{...ue,version:typeof W.templateVersion==="string"?W.templateVersion:void 0}):g.applications.import(String(W.source??""),ue);ee={application:Ee.application,diagnostics:Ee.parsed.diagnostics,requestId:J}}else if(O.method==="GET"&&Bt){let W=g.applications.get(decodeURIComponent(Bt[1]));if(!W)throw new i("not_found","Compose application was not found.",404);t.authorize(G,"deployments:read",{type:"resource",id:W.resourceId}),ee={application:W,services:g.applications.services(W.id),requestId:J}}else if(O.method==="POST"&&wt){let W=g.applications.get(decodeURIComponent(wt[1]));if(!W)throw new i("not_found","Compose application was not found.",404);let se=wt[2],ue=await xe();t.authorize(G,se==="delete"||se==="stop"?"deployments:cancel":"deployments:create",{type:"resource",id:W.resourceId}),ee={operation:t.operation(g.enqueue(W,se,{actorId:G.actor.id,service:typeof ue.service==="string"?ue.service:void 0,replicas:Number.isFinite(Number(ue.replicas))?Number(ue.replicas):void 0,removeVolumes:ue.removeVolumes===!0,confirmation:typeof ue.confirm==="string"?ue.confirm:void 0})),requestId:J}}else if(O.method==="GET"&&z.pathname==="/api/v1/preview-definitions"){let W=z.searchParams.get("projectId");if(!W)throw new i("validation_error","projectId is required.",422);t.authorize(G,"project:read",{type:"project",id:W}),ee=Hr(a.previews.listDefinitions(W).map((se)=>({...se})),z,J)}else if(O.method==="POST"&&z.pathname==="/api/v1/preview-definitions"){let W=await xe();t.authorize(G,"config:write",{type:"resource",id:String(W.resourceId??"")}),ee={definition:a.previews.createDefinition({...W,projectId:String(W.projectId??""),resourceId:String(W.resourceId??""),baseEnvironmentId:String(W.baseEnvironmentId??""),domainPattern:String(W.domainPattern??""),createdByActorId:G.actor.id}),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/previews"){let W=await xe(),se=a.previews.getDefinition(String(W.definitionId??""));if(!se)throw new i("not_found","Preview definition was not found.",404);t.authorize(G,"deployments:create",{type:"resource",id:se.resourceId});let ue=a.previews.upsert({definitionId:se.id,sourceProvider:"api",repository:typeof W.repository==="string"?W.repository:"api",branch:String(W.branch??""),pullRequestNumber:Number(W.pullRequestNumber)||void 0,fork:W.fork===!0,commitSha:String(W.commitSha??""),createdByActorId:G.actor.id});ee={preview:ue.preview,operation:t.operation(a.enqueueDeploy(ue.preview,{created:ue.created,actorId:G.actor.id})),requestId:J}}else if(O.method==="POST"&&Ze){let W=a.previews.getInstance(decodeURIComponent(Ze[1]));if(!W)throw new i("not_found","Preview was not found.",404);let se=await xe(),ue=Ze[2];if(ue==="destroy"){if(t.authorize(G,"deployments:cancel",{type:"resource",id:W.resourceId}),se.confirm!==W.name)throw new i("confirmation_required",`Type ${W.name} to confirm preview teardown.`,409);ee={operation:t.operation(a.enqueueDestroy(W,"api",G.actor.id)),requestId:J}}else if(ue==="extend")t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId}),ee={preview:a.previews.extend(W.id,Number(se.hours)),requestId:J};else t.authorize(G,"deployments:create",{type:"resource",id:W.resourceId}),ee={operation:t.operation(a.enqueueDeploy(W,{actorId:G.actor.id,reason:"manual_rebuild"})),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/previews/cleanup"){t.authorize(G,"automation:manage",{type:"organization"});let W=await xe();if(!W.dryRun&&W.confirm!=="cleanup previews")throw new i("confirmation_required","Type cleanup previews to confirm preview cleanup.",409);ee={...a.cleanup({dryRun:W.dryRun===!0,maxAgeHours:Number(W.maxAgeHours)||void 0,keepCount:Number(W.keepCount)||void 0,actorId:G.actor.id}),requestId:J}}else if(O.method==="GET"&&z.pathname==="/api/v1/queue"){let W=z.searchParams.get("projectId")??void 0,se=z.searchParams.get("state"),ue=r.list({projectId:W,state:["queued","running","succeeded","failed","cancelled","timed_out"].includes(se)?se:void 0,limit:500}).filter((Ee)=>{let mt=Ee.operation.resourceId?{type:"resource",id:Ee.operation.resourceId}:Ee.operation.environmentId?{type:"environment",id:Ee.operation.environmentId}:Ee.operation.projectId?{type:"project",id:Ee.operation.projectId}:{type:"organization"};try{return t.authorize(G,"deployments:read",mt),!0}catch{return!1}}).map((Ee)=>({...t.operation(Ee.operation),queue:Ee.job,approximatePosition:Ee.approximatePosition}));ee=Hr(ue,z,J)}else if(O.method==="GET"&&z.pathname==="/api/v1/queue/settings")t.authorize(G,"deployments:read",G.token.scope),ee={concurrency:r.limits,requestId:J};else if(O.method==="PATCH"&&z.pathname==="/api/v1/queue/settings"){t.authorize(G,"automation:manage",{type:"organization"});let W=await xe();if(W.confirm!=="update queue limits")throw new i("confirmation_required","Type update queue limits to confirm production concurrency changes.",409);ee={concurrency:r.configureConcurrency(W.concurrency??{},{organizationId:G.serviceAccount.organizationId,actorId:G.actor.id}),requestId:J}}else if(O.method==="DELETE"&&z.pathname==="/api/v1/queue/history"){t.authorize(G,"automation:manage",{type:"organization"});let W=await xe();if(W.confirm!=="clear completed")throw new i("confirmation_required","Type clear completed to confirm queue retention cleanup.",409);ee={deleted:r.clearCompleted({before:typeof W.before==="string"?W.before:void 0,actorId:G.actor.id,projectId:typeof W.projectId==="string"?W.projectId:void 0}),requestId:J}}else if(O.method==="GET"&&gt){let W=e.controlPlane.getOperation(decodeURIComponent(gt[1]));if(!W)throw new i("not_found","Operation was not found.",404);let se=W.resourceId?{type:"resource",id:W.resourceId}:W.environmentId?{type:"environment",id:W.environmentId}:W.projectId?{type:"project",id:W.projectId}:{type:"organization"};t.authorize(G,"deployments:read",se);let ue=O.headers.get("last-event-id")?.trim(),Ee=Number(ue||z.searchParams.get("after")||0);if(gt[2]==="stream"){let kt=new TextEncoder,Pe=Ee,yt,it=!1,Ke=new ReadableStream({start(jr){let Po=()=>{if(it)return;if(!e.identities.verifyToken(oe,M)){if(it=!0,yt)clearInterval(yt);jr.close();return}let Qn=r.logs(W.id,{after:Pe,limit:500});for(let zt of Qn)Pe=zt.sequence,jr.enqueue(kt.encode(`id: ${zt.sequence}
 event: log
 data: ${JSON.stringify(zt)}
 
-`));let Dt=e.controlPlane.getOperation(W.id);if(Dt&&["succeeded","failed","cancelled","timed_out"].includes(Dt.state)&&!r.logs(W.id,{after:_e,limit:1}).length){if(it=!0,yt)clearInterval(yt);jr.enqueue(kt.encode(`event: complete
-data: ${JSON.stringify({state:Dt.state,cursor:_e})}
+`));let Dt=e.controlPlane.getOperation(W.id);if(Dt&&["succeeded","failed","cancelled","timed_out"].includes(Dt.state)&&!r.logs(W.id,{after:Pe,limit:1}).length){if(it=!0,yt)clearInterval(yt);jr.enqueue(kt.encode(`event: complete
+data: ${JSON.stringify({state:Dt.state,cursor:Pe})}
 
-`)),jr.close()}};if(Po(),!it)yt=setInterval(Po,500);O.signal.addEventListener("abort",()=>{if(it=!0,yt)clearInterval(yt);try{jr.close()}catch{}},{once:!0})},cancel(){if(it=!0,yt)clearInterval(yt)}});return new Response(Ke,{headers:{"content-type":"text/event-stream","cache-control":"no-store","x-accel-buffering":"no","x-request-id":J,...xe}})}let mt=r.logs(W.id,{after:Ce,limit:Number(z.searchParams.get("limit"))||void 0});ee={data:mt,cursor:mt.at(-1)?.sequence??Ce,hasMore:mt.length>=Math.min(1000,Math.max(1,Number(z.searchParams.get("limit"))||200)),requestId:J}}else if(O.method==="POST"&&jt){let W=e.controlPlane.getOperation(decodeURIComponent(jt[1]));if(!W)throw new i("not_found","Operation was not found.",404);let se=W.resourceId?{type:"resource",id:W.resourceId}:W.environmentId?{type:"environment",id:W.environmentId}:W.projectId?{type:"project",id:W.projectId}:{type:"organization"},ue=await De();if(jt[2]==="cancel")t.authorize(G,"deployments:cancel",se),ee={operation:t.operation(r.requestCancellation(W.id,G.actor.id)),requestId:J};else t.authorize(G,"deployments:create",se),ee={operation:t.operation(r.retry(W.id,String(ue.errorClass??"manual"),{delayMs:Number(ue.delayMs)||0,actorId:G.actor.id})),requestId:J}}else if(O.method==="GET"&&z.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(G,"sources:read",G.token.scope),ee=Hr(e.sources.listConnections(G.serviceAccount.organizationId),z,J,["createdAt","id"])}else if(O.method==="GET"&&z.pathname==="/api/v1/source/repositories"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(G,"sources:read",G.token.scope);let W=e.sources.getConnection(z.searchParams.get("connectionId")??"");if(!W||W.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);if(z.searchParams.get("sync")==="true")t.authorize(G,"sources:manage",{type:"organization"}),await gs(e.sources,W.id,{search:z.searchParams.get("search")??void 0});ee=Hr(e.sources.listRepositories(W.id,z.searchParams.get("search")??void 0),z,J,["fullName","id"])}else if(O.method==="GET"&&z.pathname==="/api/v1/source/refs"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(G,"sources:read",G.token.scope);let W=z.searchParams.get("connectionId")??"",se=e.sources.getConnection(W);if(!se||se.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);ee=await ps(e.sources,{connectionId:W,repository:z.searchParams.get("repository")??"",repositoryId:z.searchParams.get("repositoryId")??void 0,type:z.searchParams.get("type")==="tags"?"tags":"branches",cursor:z.searchParams.get("cursor")??void 0,deployKeyId:z.searchParams.get("deployKeyId")??void 0})}else if(O.method==="POST"&&z.pathname==="/api/v1/application-detections"){t.authorize(G,"applications:manage",G.token.scope);let W=await De();if(!Array.isArray(W.files)||W.files.length>1e4)throw new i("validation_error","files must contain at most 10,000 entries.",422);ee={candidates:Yo(W.files.map((se)=>({path:String(se.path??""),size:Number(se.size??0),content:typeof se.content==="string"?se.content.slice(0,262144):void 0}))),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/application-plans"){t.authorize(G,"applications:manage",G.token.scope);let W=await De();ee={plan:Wn(W.draft,Array.isArray(W.suppliedSecretNames)?W.suppliedSecretNames.map(String):[]),requestId:J}}else if(O.method==="GET"&&z.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let W=z.searchParams.get("projectId")??"";t.authorize(G,"applications:read",{type:"project",id:W}),ee=Hr(e.applications.drafts.list(W),z,J,["updatedAt","id"])}else if(O.method==="POST"&&z.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let W=await De(),se=String(W.projectId??W.draft?.projectId??"");t.authorize(G,"applications:manage",{type:"project",id:se});let ue=e.controlPlane.getProject(se);if(!ue||ue.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Project was not found.",404);let Ce=e.applications.drafts.create({organizationId:ue.organizationId,projectId:se,name:String(W.name??W.draft?.name??"Application draft"),draft:{...W.draft,projectId:se},step:W.step,suppliedSecretNames:Array.isArray(W.suppliedSecretNames)?W.suppliedSecretNames.map(String):[],actorId:G.actor.id});return R({draft:Ce,requestId:J},201,J,xe)}else if(O.method==="PATCH"&&z.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let W=await De(),se=e.applications.drafts.get(String(W.id??""));if(!se)throw new i("not_found","Application draft was not found.",404);t.authorize(G,"applications:manage",{type:"project",id:se.projectId}),ee={draft:e.applications.drafts.update(se.id,Number(W.version),{draft:{...W.draft,projectId:se.projectId},step:W.step,suppliedSecretNames:Array.isArray(W.suppliedSecretNames)?W.suppliedSecretNames.map(String):void 0,actorId:G.actor.id}),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/applications"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let W=O.headers.get("idempotency-key")??"";if(!W)throw new i("idempotency_required","Idempotency-Key is required for application creation.",428);if(!/^[A-Za-z0-9._:-]{8,128}$/.test(W))throw new i("validation_error","Idempotency-Key must contain 8-128 safe characters.",422);let se=await De(),ue=e.applications.drafts.get(String(se.draftId??""));if(!ue)throw new i("not_found","Application draft was not found.",404);t.authorize(G,"applications:manage",{type:"project",id:ue.projectId});let Ce=tR("sha256").update(`POST
+`)),jr.close()}};if(Po(),!it)yt=setInterval(Po,500);O.signal.addEventListener("abort",()=>{if(it=!0,yt)clearInterval(yt);try{jr.close()}catch{}},{once:!0})},cancel(){if(it=!0,yt)clearInterval(yt)}});return new Response(Ke,{headers:{"content-type":"text/event-stream","cache-control":"no-store","x-accel-buffering":"no","x-request-id":J,..._e}})}let mt=r.logs(W.id,{after:Ee,limit:Number(z.searchParams.get("limit"))||void 0});ee={data:mt,cursor:mt.at(-1)?.sequence??Ee,hasMore:mt.length>=Math.min(1000,Math.max(1,Number(z.searchParams.get("limit"))||200)),requestId:J}}else if(O.method==="POST"&&jt){let W=e.controlPlane.getOperation(decodeURIComponent(jt[1]));if(!W)throw new i("not_found","Operation was not found.",404);let se=W.resourceId?{type:"resource",id:W.resourceId}:W.environmentId?{type:"environment",id:W.environmentId}:W.projectId?{type:"project",id:W.projectId}:{type:"organization"},ue=await xe();if(jt[2]==="cancel")t.authorize(G,"deployments:cancel",se),ee={operation:t.operation(r.requestCancellation(W.id,G.actor.id)),requestId:J};else t.authorize(G,"deployments:create",se),ee={operation:t.operation(r.retry(W.id,String(ue.errorClass??"manual"),{delayMs:Number(ue.delayMs)||0,actorId:G.actor.id})),requestId:J}}else if(O.method==="GET"&&z.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(G,"sources:read",G.token.scope),ee=Hr(e.sources.listConnections(G.serviceAccount.organizationId),z,J,["createdAt","id"])}else if(O.method==="GET"&&z.pathname==="/api/v1/source/repositories"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(G,"sources:read",G.token.scope);let W=e.sources.getConnection(z.searchParams.get("connectionId")??"");if(!W||W.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);if(z.searchParams.get("sync")==="true")t.authorize(G,"sources:manage",{type:"organization"}),await gs(e.sources,W.id,{search:z.searchParams.get("search")??void 0});ee=Hr(e.sources.listRepositories(W.id,z.searchParams.get("search")??void 0),z,J,["fullName","id"])}else if(O.method==="GET"&&z.pathname==="/api/v1/source/refs"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(G,"sources:read",G.token.scope);let W=z.searchParams.get("connectionId")??"",se=e.sources.getConnection(W);if(!se||se.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);ee=await ps(e.sources,{connectionId:W,repository:z.searchParams.get("repository")??"",repositoryId:z.searchParams.get("repositoryId")??void 0,type:z.searchParams.get("type")==="tags"?"tags":"branches",cursor:z.searchParams.get("cursor")??void 0,deployKeyId:z.searchParams.get("deployKeyId")??void 0})}else if(O.method==="POST"&&z.pathname==="/api/v1/application-detections"){t.authorize(G,"applications:manage",G.token.scope);let W=await xe();if(!Array.isArray(W.files)||W.files.length>1e4)throw new i("validation_error","files must contain at most 10,000 entries.",422);ee={candidates:Yo(W.files.map((se)=>({path:String(se.path??""),size:Number(se.size??0),content:typeof se.content==="string"?se.content.slice(0,262144):void 0}))),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/application-plans"){t.authorize(G,"applications:manage",G.token.scope);let W=await xe();ee={plan:Wn(W.draft,Array.isArray(W.suppliedSecretNames)?W.suppliedSecretNames.map(String):[]),requestId:J}}else if(O.method==="GET"&&z.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let W=z.searchParams.get("projectId")??"";t.authorize(G,"applications:read",{type:"project",id:W}),ee=Hr(e.applications.drafts.list(W),z,J,["updatedAt","id"])}else if(O.method==="POST"&&z.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let W=await xe(),se=String(W.projectId??W.draft?.projectId??"");t.authorize(G,"applications:manage",{type:"project",id:se});let ue=e.controlPlane.getProject(se);if(!ue||ue.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Project was not found.",404);let Ee=e.applications.drafts.create({organizationId:ue.organizationId,projectId:se,name:String(W.name??W.draft?.name??"Application draft"),draft:{...W.draft,projectId:se},step:W.step,suppliedSecretNames:Array.isArray(W.suppliedSecretNames)?W.suppliedSecretNames.map(String):[],actorId:G.actor.id});return R({draft:Ee,requestId:J},201,J,_e)}else if(O.method==="PATCH"&&z.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let W=await xe(),se=e.applications.drafts.get(String(W.id??""));if(!se)throw new i("not_found","Application draft was not found.",404);t.authorize(G,"applications:manage",{type:"project",id:se.projectId}),ee={draft:e.applications.drafts.update(se.id,Number(W.version),{draft:{...W.draft,projectId:se.projectId},step:W.step,suppliedSecretNames:Array.isArray(W.suppliedSecretNames)?W.suppliedSecretNames.map(String):void 0,actorId:G.actor.id}),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/applications"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let W=O.headers.get("idempotency-key")??"";if(!W)throw new i("idempotency_required","Idempotency-Key is required for application creation.",428);if(!/^[A-Za-z0-9._:-]{8,128}$/.test(W))throw new i("validation_error","Idempotency-Key must contain 8-128 safe characters.",422);let se=await xe(),ue=e.applications.drafts.get(String(se.draftId??""));if(!ue)throw new i("not_found","Application draft was not found.",404);t.authorize(G,"applications:manage",{type:"project",id:ue.projectId});let Ee=tR("sha256").update(`POST
 /api/v1/applications
-${JSON.stringify(se)}`).digest("hex"),mt=e.identities.getIdempotency(G.token.id,W);if(mt){if(mt.requestHash!==Ce)throw new i("idempotency_conflict","Idempotency-Key was already used for another request.",409);let _e=mt.operationId?e.controlPlane.getOperation(mt.operationId):void 0,yt=_e?.resourceId?e.controlPlane.getResource(_e.resourceId):void 0;if(!_e||!yt)throw new i("idempotency_unavailable","The original application operation is no longer available.",409);return R({resource:yt,operation:t.operation(_e),plan:Wn(ue.input,ue.suppliedSecretNames),idempotentReplay:!0,requestId:J},202,J,{...xe,"idempotent-replayed":"true"})}let kt=hd({controlPlane:e.controlPlane,drafts:e.applications.drafts,draftId:ue.id,expectedVersion:Number(se.version),confirmEnvironment:String(se.confirmEnvironment??""),actorId:G.actor.id});return e.identities.saveIdempotency({tokenId:G.token.id,key:W,requestHash:Ce,operationId:kt.operation.id,responseStatus:202,responseBody:{draftId:ue.id}}),R({resource:kt.resource,operation:t.operation(kt.operation),plan:kt.plan,idempotentReplay:!1,requestId:J},202,J,xe)}else if(O.method==="GET"&&z.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(G,"applications:read",G.token.scope),ee=Hr(e.applications.registries.list(G.serviceAccount.organizationId),z,J,["createdAt","id"])}else if(O.method==="POST"&&z.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(G,"applications:manage",{type:"organization"});let W=await De(),se=e.applications.registries.create({organizationId:G.serviceAccount.organizationId,provider:W.provider,name:String(W.name??"Container registry"),host:String(W.host??""),credential:W.token||W.password?{username:typeof W.username==="string"?W.username:void 0,password:typeof W.password==="string"?W.password:void 0,token:typeof W.token==="string"?W.token:void 0}:void 0,credentialExpiresAt:typeof W.credentialExpiresAt==="string"?W.credentialExpiresAt:void 0,actorId:G.actor.id});return R({registry:se,requestId:J},201,J,xe)}else if(O.method==="PATCH"&&z.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(G,"applications:manage",{type:"organization"});let W=await De(),se=e.applications.registries.get(String(W.id??""));if(!se||se.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Registry connection was not found.",404);if(W.action==="test")ee={registry:await e.applications.registries.test(se.id,{image:typeof W.image==="string"?W.image:void 0}),requestId:J};else if(W.action==="rotate")ee={registry:e.applications.registries.rotate(se.id,{username:W.username,password:W.password,token:W.token},{expiresAt:W.expiresAt,actorId:G.actor.id}),requestId:J};else throw new i("validation_error","action must be test or rotate.",422)}else if(O.method==="DELETE"&&z.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(G,"applications:manage",{type:"organization"});let W=await De(),se=e.applications.registries.get(String(W.id??""));if(!se||se.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Registry connection was not found.",404);ee={registry:e.applications.registries.disconnect(se.id,G.actor.id),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/application-artifacts"){if(!e.applications?.artifacts)throw new i("not_found","Application artifact storage is unavailable.",404);let W=O.headers.get("x-project-id")??"";t.authorize(G,"applications:manage",{type:"project",id:W});let se=e.controlPlane.getProject(W);if(!se||se.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Project was not found.",404);if(Number(O.headers.get("content-length")??0)>104857600)throw new i("payload_too_large","Artifact exceeds 100 MB.",413);let Ce=e.applications.artifacts.create({organizationId:se.organizationId,projectId:W,filename:O.headers.get("x-artifact-filename")??"application.zip",bytes:new Uint8Array(await O.arrayBuffer()),actorId:G.actor.id});return R({artifact:Ce,requestId:J},201,J,xe)}else if(O.method==="POST"&&z.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(G,"sources:manage",{type:"organization"});let W=await De(),se=String(W.provider??"");if(!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(se))throw new i("validation_error","A supported provider is required.",422);let ue=se==="github"&&(W.privateKey||W.appId)?{appId:typeof W.appId==="string"?W.appId:void 0,installationId:typeof W.installationId==="string"?W.installationId:void 0,privateKey:typeof W.privateKey==="string"?W.privateKey:void 0}:se!=="generic_ssh"&&W.token?{token:String(W.token),username:typeof W.username==="string"?W.username:void 0}:void 0,Ce,mt,kt;return e.controlPlane.database.transaction(()=>{if(Ce=e.sources.createConnection({organizationId:G.serviceAccount.organizationId,provider:se,name:String(W.name??se),host:String(W.host??""),owner:typeof W.owner==="string"?W.owner:void 0,authKind:W.authKind,credential:ue,createdByActorId:G.actor.id}),typeof W.repositoryUrl==="string"&&typeof W.repositoryFullName==="string")mt=e.sources.upsertRepository({connectionId:Ce.id,providerRepositoryId:`manual:${W.repositoryFullName}`,fullName:W.repositoryFullName,cloneUrl:W.repositoryUrl,defaultBranch:String(W.defaultBranch??"main"),visibility:"unknown",archived:!1,metadata:{source:"api"}});if(se==="generic_ssh")kt=e.sources.createDeployKey({connectionId:Ce.id,name:String(W.deployKeyName??"Repository deploy key"),publicKey:String(W.publicKey??""),privateKey:String(W.deployPrivateKey??""),host:String(W.sshHost??""),hostKey:String(W.hostKey??""),actorId:G.actor.id})})(),R({connection:Ce,repository:mt,deployKey:kt,requestId:J},201,J,xe)}else if(O.method==="POST"&&z.pathname==="/api/v1/source/bindings"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);let W=await De(),se=String(W.projectId??"");t.authorize(G,"sources:manage",{type:"project",id:se});let ue=e.sources.getConnection(String(W.connectionId??""));if(!ue||ue.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let Ce=e.sources.createBinding({projectId:se,environmentId:typeof W.environmentId==="string"?W.environmentId:void 0,resourceId:typeof W.resourceId==="string"?W.resourceId:void 0,connectionId:ue.id,repositoryId:typeof W.repositoryId==="string"?W.repositoryId:void 0,repositoryFullName:String(W.repositoryFullName??""),defaultBranch:String(W.defaultBranch??"main"),branchRule:typeof W.branchRule==="string"?W.branchRule:void 0,tagRule:typeof W.tagRule==="string"?W.tagRule:void 0,monorepoRoot:String(W.monorepoRoot??"."),includePaths:Array.isArray(W.includePaths)?W.includePaths.map(String):[],excludePaths:Array.isArray(W.excludePaths)?W.excludePaths.map(String):[],submodules:W.submodules===!0,cloneDepth:typeof W.cloneDepth==="number"?W.cloneDepth:void 0,deployKeyId:typeof W.deployKeyId==="string"&&W.deployKeyId?W.deployKeyId:void 0,autoDeploy:W.autoDeploy!==!1,pullRequestPreviews:W.pullRequestPreviews!==!1,actorId:G.actor.id});return R({binding:Ce,requestId:J},201,J,xe)}else if(O.method==="POST"&&z.pathname==="/api/v1/source/webhooks"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(G,"sources:manage",{type:"organization"});let W=await De(),se=e.sources.getConnection(String(W.connectionId??""));if(!se||se.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let ue=typeof W.baseUrl==="string"?W.baseUrl:void 0;if(!ue)throw new i("validation_error","baseUrl is required.",422);let Ce=e.sources.createWebhook({connectionId:se.id,repositoryId:typeof W.repositoryId==="string"?W.repositoryId:void 0,repositoryFullName:String(W.repositoryFullName??""),events:Array.isArray(W.events)?W.events.map(String):void 0}),mt=Sr(ue,Ce.webhook),kt=W.reconcile===!1?Ce.webhook:await bn(e.sources,Ce.webhook.id,ue);return R({webhook:kt,endpoint:mt,endpointRevealOnce:!0,requestId:J},201,J,xe)}else if(O.method==="DELETE"&&z.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(G,"sources:manage",{type:"organization"});let W=await De(),se=e.sources.getConnection(String(W.id??""));if(!se||se.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let ue=e.sources.listBindings({connectionId:se.id,status:"active"});if(W.preview===!0)return R({preview:!0,affectedBindings:ue,requestId:J},200,J,xe);return R({...e.sources.disconnectConnection(se.id,G.actor.id),requestId:J},200,J,xe)}else if(O.method==="GET"&&(z.pathname==="/api/v1/events"||z.pathname==="/api/v1/events/stream")){let W=t.listEvents(G,z.searchParams.get("projectId")??void 0,Number(z.searchParams.get("after"))||void 0);if(z.pathname.endsWith("/stream")){let se=new TextEncoder,ue=W.reduce((_e,yt)=>Math.max(_e,Number(yt.sequence)),Number(z.searchParams.get("after"))||0),Ce,mt=!1,kt=new ReadableStream({start(_e){let yt=(it)=>_e.enqueue(se.encode(`id: ${it.sequence}
+${JSON.stringify(se)}`).digest("hex"),mt=e.identities.getIdempotency(G.token.id,W);if(mt){if(mt.requestHash!==Ee)throw new i("idempotency_conflict","Idempotency-Key was already used for another request.",409);let Pe=mt.operationId?e.controlPlane.getOperation(mt.operationId):void 0,yt=Pe?.resourceId?e.controlPlane.getResource(Pe.resourceId):void 0;if(!Pe||!yt)throw new i("idempotency_unavailable","The original application operation is no longer available.",409);return R({resource:yt,operation:t.operation(Pe),plan:Wn(ue.input,ue.suppliedSecretNames),idempotentReplay:!0,requestId:J},202,J,{..._e,"idempotent-replayed":"true"})}let kt=hd({controlPlane:e.controlPlane,drafts:e.applications.drafts,draftId:ue.id,expectedVersion:Number(se.version),confirmEnvironment:String(se.confirmEnvironment??""),actorId:G.actor.id});return e.identities.saveIdempotency({tokenId:G.token.id,key:W,requestHash:Ee,operationId:kt.operation.id,responseStatus:202,responseBody:{draftId:ue.id}}),R({resource:kt.resource,operation:t.operation(kt.operation),plan:kt.plan,idempotentReplay:!1,requestId:J},202,J,_e)}else if(O.method==="GET"&&z.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(G,"applications:read",G.token.scope),ee=Hr(e.applications.registries.list(G.serviceAccount.organizationId),z,J,["createdAt","id"])}else if(O.method==="POST"&&z.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(G,"applications:manage",{type:"organization"});let W=await xe(),se=e.applications.registries.create({organizationId:G.serviceAccount.organizationId,provider:W.provider,name:String(W.name??"Container registry"),host:String(W.host??""),credential:W.token||W.password?{username:typeof W.username==="string"?W.username:void 0,password:typeof W.password==="string"?W.password:void 0,token:typeof W.token==="string"?W.token:void 0}:void 0,credentialExpiresAt:typeof W.credentialExpiresAt==="string"?W.credentialExpiresAt:void 0,actorId:G.actor.id});return R({registry:se,requestId:J},201,J,_e)}else if(O.method==="PATCH"&&z.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(G,"applications:manage",{type:"organization"});let W=await xe(),se=e.applications.registries.get(String(W.id??""));if(!se||se.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Registry connection was not found.",404);if(W.action==="test")ee={registry:await e.applications.registries.test(se.id,{image:typeof W.image==="string"?W.image:void 0}),requestId:J};else if(W.action==="rotate")ee={registry:e.applications.registries.rotate(se.id,{username:W.username,password:W.password,token:W.token},{expiresAt:W.expiresAt,actorId:G.actor.id}),requestId:J};else throw new i("validation_error","action must be test or rotate.",422)}else if(O.method==="DELETE"&&z.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(G,"applications:manage",{type:"organization"});let W=await xe(),se=e.applications.registries.get(String(W.id??""));if(!se||se.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Registry connection was not found.",404);ee={registry:e.applications.registries.disconnect(se.id,G.actor.id),requestId:J}}else if(O.method==="POST"&&z.pathname==="/api/v1/application-artifacts"){if(!e.applications?.artifacts)throw new i("not_found","Application artifact storage is unavailable.",404);let W=O.headers.get("x-project-id")??"";t.authorize(G,"applications:manage",{type:"project",id:W});let se=e.controlPlane.getProject(W);if(!se||se.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Project was not found.",404);if(Number(O.headers.get("content-length")??0)>104857600)throw new i("payload_too_large","Artifact exceeds 100 MB.",413);let Ee=e.applications.artifacts.create({organizationId:se.organizationId,projectId:W,filename:O.headers.get("x-artifact-filename")??"application.zip",bytes:new Uint8Array(await O.arrayBuffer()),actorId:G.actor.id});return R({artifact:Ee,requestId:J},201,J,_e)}else if(O.method==="POST"&&z.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(G,"sources:manage",{type:"organization"});let W=await xe(),se=String(W.provider??"");if(!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(se))throw new i("validation_error","A supported provider is required.",422);let ue=se==="github"&&(W.privateKey||W.appId)?{appId:typeof W.appId==="string"?W.appId:void 0,installationId:typeof W.installationId==="string"?W.installationId:void 0,privateKey:typeof W.privateKey==="string"?W.privateKey:void 0}:se!=="generic_ssh"&&W.token?{token:String(W.token),username:typeof W.username==="string"?W.username:void 0}:void 0,Ee,mt,kt;return e.controlPlane.database.transaction(()=>{if(Ee=e.sources.createConnection({organizationId:G.serviceAccount.organizationId,provider:se,name:String(W.name??se),host:String(W.host??""),owner:typeof W.owner==="string"?W.owner:void 0,authKind:W.authKind,credential:ue,createdByActorId:G.actor.id}),typeof W.repositoryUrl==="string"&&typeof W.repositoryFullName==="string")mt=e.sources.upsertRepository({connectionId:Ee.id,providerRepositoryId:`manual:${W.repositoryFullName}`,fullName:W.repositoryFullName,cloneUrl:W.repositoryUrl,defaultBranch:String(W.defaultBranch??"main"),visibility:"unknown",archived:!1,metadata:{source:"api"}});if(se==="generic_ssh")kt=e.sources.createDeployKey({connectionId:Ee.id,name:String(W.deployKeyName??"Repository deploy key"),publicKey:String(W.publicKey??""),privateKey:String(W.deployPrivateKey??""),host:String(W.sshHost??""),hostKey:String(W.hostKey??""),actorId:G.actor.id})})(),R({connection:Ee,repository:mt,deployKey:kt,requestId:J},201,J,_e)}else if(O.method==="POST"&&z.pathname==="/api/v1/source/bindings"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);let W=await xe(),se=String(W.projectId??"");t.authorize(G,"sources:manage",{type:"project",id:se});let ue=e.sources.getConnection(String(W.connectionId??""));if(!ue||ue.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let Ee=e.sources.createBinding({projectId:se,environmentId:typeof W.environmentId==="string"?W.environmentId:void 0,resourceId:typeof W.resourceId==="string"?W.resourceId:void 0,connectionId:ue.id,repositoryId:typeof W.repositoryId==="string"?W.repositoryId:void 0,repositoryFullName:String(W.repositoryFullName??""),defaultBranch:String(W.defaultBranch??"main"),branchRule:typeof W.branchRule==="string"?W.branchRule:void 0,tagRule:typeof W.tagRule==="string"?W.tagRule:void 0,monorepoRoot:String(W.monorepoRoot??"."),includePaths:Array.isArray(W.includePaths)?W.includePaths.map(String):[],excludePaths:Array.isArray(W.excludePaths)?W.excludePaths.map(String):[],submodules:W.submodules===!0,cloneDepth:typeof W.cloneDepth==="number"?W.cloneDepth:void 0,deployKeyId:typeof W.deployKeyId==="string"&&W.deployKeyId?W.deployKeyId:void 0,autoDeploy:W.autoDeploy!==!1,pullRequestPreviews:W.pullRequestPreviews!==!1,actorId:G.actor.id});return R({binding:Ee,requestId:J},201,J,_e)}else if(O.method==="POST"&&z.pathname==="/api/v1/source/webhooks"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(G,"sources:manage",{type:"organization"});let W=await xe(),se=e.sources.getConnection(String(W.connectionId??""));if(!se||se.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let ue=typeof W.baseUrl==="string"?W.baseUrl:void 0;if(!ue)throw new i("validation_error","baseUrl is required.",422);let Ee=e.sources.createWebhook({connectionId:se.id,repositoryId:typeof W.repositoryId==="string"?W.repositoryId:void 0,repositoryFullName:String(W.repositoryFullName??""),events:Array.isArray(W.events)?W.events.map(String):void 0}),mt=Sr(ue,Ee.webhook),kt=W.reconcile===!1?Ee.webhook:await bn(e.sources,Ee.webhook.id,ue);return R({webhook:kt,endpoint:mt,endpointRevealOnce:!0,requestId:J},201,J,_e)}else if(O.method==="DELETE"&&z.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(G,"sources:manage",{type:"organization"});let W=await xe(),se=e.sources.getConnection(String(W.id??""));if(!se||se.organizationId!==G.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let ue=e.sources.listBindings({connectionId:se.id,status:"active"});if(W.preview===!0)return R({preview:!0,affectedBindings:ue,requestId:J},200,J,_e);return R({...e.sources.disconnectConnection(se.id,G.actor.id),requestId:J},200,J,_e)}else if(O.method==="GET"&&(z.pathname==="/api/v1/events"||z.pathname==="/api/v1/events/stream")){let W=t.listEvents(G,z.searchParams.get("projectId")??void 0,Number(z.searchParams.get("after"))||void 0);if(z.pathname.endsWith("/stream")){let se=new TextEncoder,ue=W.reduce((Pe,yt)=>Math.max(Pe,Number(yt.sequence)),Number(z.searchParams.get("after"))||0),Ee,mt=!1,kt=new ReadableStream({start(Pe){let yt=(it)=>Pe.enqueue(se.encode(`id: ${it.sequence}
 event: ${it.type}
 data: ${JSON.stringify(it)}
 
-`));if(W.length)W.forEach(yt);else _e.enqueue(se.encode(`: connected
+`));if(W.length)W.forEach(yt);else Pe.enqueue(se.encode(`: connected
 
-`));Ce=setInterval(()=>{if(mt)return;let it=e.identities.verifyToken(oe,M);if(!it){if(mt=!0,Ce)clearInterval(Ce);_e.close();return}try{let Ke=t.listEvents(it,z.searchParams.get("projectId")??void 0,ue);for(let jr of Ke)yt(jr),ue=Math.max(ue,Number(jr.sequence));if(!Ke.length)_e.enqueue(se.encode(`: heartbeat ${Date.now()}
+`));Ee=setInterval(()=>{if(mt)return;let it=e.identities.verifyToken(oe,M);if(!it){if(mt=!0,Ee)clearInterval(Ee);Pe.close();return}try{let Ke=t.listEvents(it,z.searchParams.get("projectId")??void 0,ue);for(let jr of Ke)yt(jr),ue=Math.max(ue,Number(jr.sequence));if(!Ke.length)Pe.enqueue(se.encode(`: heartbeat ${Date.now()}
 
-`))}catch{if(mt=!0,Ce)clearInterval(Ce);_e.close()}},1000),O.signal.addEventListener("abort",()=>{if(mt=!0,Ce)clearInterval(Ce);try{_e.close()}catch{}},{once:!0})},cancel(){if(mt=!0,Ce)clearInterval(Ce)}});return new Response(kt,{status:200,headers:{"content-type":"text/event-stream","cache-control":"no-store",connection:"keep-alive","x-accel-buffering":"no","x-request-id":J,...xe}})}ee=Hr(W,z,J,["sequence","id"])}else if(O.method==="POST"&&z.pathname==="/api/v1/deployments"){let W=O.headers.get("idempotency-key")??"";if(!W)throw new i("idempotency_required","Idempotency-Key is required for deployment requests.",428);let se=await O.text();if(se.length>1048576)throw new i("payload_too_large","Request body exceeds 1 MB.",413);let ue;try{ue=JSON.parse(se)}catch{throw new i("invalid_json","Request body must be valid JSON.",400)}if(!ue||typeof ue.projectId!=="string"||typeof ue.environmentId!=="string"||ue.action!==void 0&&!["deploy","rollback"].includes(ue.action))throw new i("validation_error","projectId, environmentId, and a valid action are required.",422);let Ce=t.createDeployment(G,ue,W);return R({operation:Ce.operation,idempotentReplay:Ce.replay,requestId:J},202,J,{...xe,...Ce.replay?{"idempotent-replayed":"true"}:{}})}else{let W=await Uo({...b,authorization:t,now:y},G,{method:O.method,url:z,body:De});if(W===void 0)throw new i("not_found","API resource was not found.",404);ee=W}return R(ee,200,J,xe)}catch(ee){if(ee instanceof i)return D(ee.code,ee.message,ee.status,J,ee.details,xe);if(z.pathname.startsWith("/api/v1/source/")||z.pathname.startsWith("/api/v1/application")||z.pathname.startsWith("/api/v1/compose-")||z.pathname==="/api/v1/registry-connections")return D("validation_error",ee instanceof Error?ee.message:"Integration request could not be completed.",422,J,void 0,xe);return D("internal_error","The API request could not be completed.",500,J,void 0,xe)}}}import{createHash as iR}from"node:crypto";var qp={info:0,low:1,medium:2,high:3,critical:4},Vp={record:0,warn:1,block:2},qy=new Set(["skipped","unavailable","unsupported","stale"]);function Kt(e){return typeof e==="string"?e:void 0}function Di(e,t){try{return JSON.parse(String(e))}catch{return t}}function Hn(e){return JSON.stringify(s(e))}function oR(e){if(!e)return;return String(s(e,2000))}function Fp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:Kt(e.project_id),environmentId:Kt(e.environment_id),resourceId:Kt(e.resource_id),releaseId:Kt(e.release_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),status:String(e.status),error:Kt(e.error),metadata:Di(e.metadata,{}),findingsCount:Number(e.findings_count),startedAt:String(e.started_at),completedAt:String(e.completed_at),durationMs:Number(e.duration_ms)}}function Vy(e){return{id:String(e.id),fingerprint:String(e.fingerprint),organizationId:String(e.organization_id),projectId:Kt(e.project_id),environmentId:Kt(e.environment_id),resourceId:Kt(e.resource_id),releaseId:Kt(e.release_id),scanRunId:String(e.scan_run_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),ruleId:String(e.rule_id),severity:String(e.severity),title:String(e.title),description:String(e.description),evidence:Di(e.evidence,{}),remediation:Kt(e.remediation),subject:String(e.subject),status:String(e.status),ownerActorId:Kt(e.owner_actor_id),recurrenceCount:Number(e.recurrence_count),firstSeenAt:String(e.first_seen_at),lastSeenAt:String(e.last_seen_at),resolvedAt:Kt(e.resolved_at),updatedAt:String(e.updated_at)}}function zp(e){return{id:String(e.id),organizationId:String(e.organization_id),environmentId:Kt(e.environment_id),name:String(e.name),rules:Di(e.rules,[]),requiredScanners:Di(e.required_scanners,[]),scannerFailMode:String(e.scanner_fail_mode),enabled:Number(e.enabled)===1,version:Number(e.version),createdByActorId:Kt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Wy(e,t){let r=Kt(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),findingId:String(e.finding_id),policyId:Kt(e.policy_id),reason:String(e.reason),referenceUrl:Kt(e.reference_url),createdByActorId:String(e.created_by_actor_id),expiresAt:a,revokedAt:r,state:r?"revoked":a<=t?"expired":"active",createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Up(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Kt(e.environment_id),releaseId:String(e.release_id),kind:String(e.kind),format:String(e.format),digest:String(e.digest),summary:Di(e.summary,{}),content:Kt(e.content),sensitive:Number(e.sensitive)===1,createdAt:String(e.created_at)}}function Hy(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),operationId:Kt(e.operation_id),policyId:String(e.policy_id),policyVersion:Number(e.policy_version),outcome:String(e.outcome),scannerVersions:Di(e.scanner_versions,{}),findingIds:Di(e.finding_ids,[]),waiverIds:Di(e.waiver_ids,[]),explanation:String(e.explanation),createdAt:String(e.created_at)}}function sR(e,t){let r=[e.trim().toLowerCase(),t.ruleId.trim().toLowerCase(),t.organizationId,t.projectId??"",t.environmentId??"",t.resourceId??"",t.releaseId??"",t.subject.trim().toLowerCase()].join("\x00");return iR("sha256").update(r).digest("hex")}function Ky(e){if(!e)return;let t=new URL(e);if(t.protocol!=="https:"&&t.protocol!=="http:")throw Error("Security references must use HTTP or HTTPS");return t.toString()}function Jy(e){if(!e.length)throw Error("A security policy needs at least one rule");return e.map((t)=>{if(!(t.minimumSeverity in qp))throw Error(`Unknown security severity: ${t.minimumSeverity}`);if(!(t.action in Vp))throw Error(`Unknown security policy action: ${t.action}`);return{minimumSeverity:t.minimumSeverity,action:t.action,...t.scannerId?{scannerId:t.scannerId.trim()}:{}}})}class Cn{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}recordScan(e){if(!e.organizationId||!e.scannerId.trim()||!e.scannerVersion.trim())throw Error("Organization, scanner id, and scanner version are required");let t=e.completedAt??this.now(),r=e.startedAt??t,a=e.durationMs??Math.max(0,new Date(t).getTime()-new Date(r).getTime()),g=e.findings??[],f=this.idFn(),h=new Set,b=[];return this.controlPlane.transaction(()=>{this.run(`INSERT INTO security_scan_runs
+`))}catch{if(mt=!0,Ee)clearInterval(Ee);Pe.close()}},1000),O.signal.addEventListener("abort",()=>{if(mt=!0,Ee)clearInterval(Ee);try{Pe.close()}catch{}},{once:!0})},cancel(){if(mt=!0,Ee)clearInterval(Ee)}});return new Response(kt,{status:200,headers:{"content-type":"text/event-stream","cache-control":"no-store",connection:"keep-alive","x-accel-buffering":"no","x-request-id":J,..._e}})}ee=Hr(W,z,J,["sequence","id"])}else if(O.method==="POST"&&z.pathname==="/api/v1/deployments"){let W=O.headers.get("idempotency-key")??"";if(!W)throw new i("idempotency_required","Idempotency-Key is required for deployment requests.",428);let se=await O.text();if(se.length>1048576)throw new i("payload_too_large","Request body exceeds 1 MB.",413);let ue;try{ue=JSON.parse(se)}catch{throw new i("invalid_json","Request body must be valid JSON.",400)}if(!ue||typeof ue.projectId!=="string"||typeof ue.environmentId!=="string"||ue.action!==void 0&&!["deploy","rollback"].includes(ue.action))throw new i("validation_error","projectId, environmentId, and a valid action are required.",422);let Ee=t.createDeployment(G,ue,W);return R({operation:Ee.operation,idempotentReplay:Ee.replay,requestId:J},202,J,{..._e,...Ee.replay?{"idempotent-replayed":"true"}:{}})}else{let W=await Uo({...b,authorization:t,now:y},G,{method:O.method,url:z,body:xe});if(W===void 0)throw new i("not_found","API resource was not found.",404);ee=W}return R(ee,200,J,_e)}catch(ee){if(ee instanceof i)return D(ee.code,ee.message,ee.status,J,ee.details,_e);if(z.pathname.startsWith("/api/v1/source/")||z.pathname.startsWith("/api/v1/application")||z.pathname.startsWith("/api/v1/compose-")||z.pathname==="/api/v1/registry-connections")return D("validation_error",ee instanceof Error?ee.message:"Integration request could not be completed.",422,J,void 0,_e);return D("internal_error","The API request could not be completed.",500,J,void 0,_e)}}}import{createHash as iR}from"node:crypto";var qp={info:0,low:1,medium:2,high:3,critical:4},Vp={record:0,warn:1,block:2},qy=new Set(["skipped","unavailable","unsupported","stale"]);function Kt(e){return typeof e==="string"?e:void 0}function Di(e,t){try{return JSON.parse(String(e))}catch{return t}}function Hn(e){return JSON.stringify(s(e))}function oR(e){if(!e)return;return String(s(e,2000))}function Fp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:Kt(e.project_id),environmentId:Kt(e.environment_id),resourceId:Kt(e.resource_id),releaseId:Kt(e.release_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),status:String(e.status),error:Kt(e.error),metadata:Di(e.metadata,{}),findingsCount:Number(e.findings_count),startedAt:String(e.started_at),completedAt:String(e.completed_at),durationMs:Number(e.duration_ms)}}function Vy(e){return{id:String(e.id),fingerprint:String(e.fingerprint),organizationId:String(e.organization_id),projectId:Kt(e.project_id),environmentId:Kt(e.environment_id),resourceId:Kt(e.resource_id),releaseId:Kt(e.release_id),scanRunId:String(e.scan_run_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),ruleId:String(e.rule_id),severity:String(e.severity),title:String(e.title),description:String(e.description),evidence:Di(e.evidence,{}),remediation:Kt(e.remediation),subject:String(e.subject),status:String(e.status),ownerActorId:Kt(e.owner_actor_id),recurrenceCount:Number(e.recurrence_count),firstSeenAt:String(e.first_seen_at),lastSeenAt:String(e.last_seen_at),resolvedAt:Kt(e.resolved_at),updatedAt:String(e.updated_at)}}function zp(e){return{id:String(e.id),organizationId:String(e.organization_id),environmentId:Kt(e.environment_id),name:String(e.name),rules:Di(e.rules,[]),requiredScanners:Di(e.required_scanners,[]),scannerFailMode:String(e.scanner_fail_mode),enabled:Number(e.enabled)===1,version:Number(e.version),createdByActorId:Kt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Wy(e,t){let r=Kt(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),findingId:String(e.finding_id),policyId:Kt(e.policy_id),reason:String(e.reason),referenceUrl:Kt(e.reference_url),createdByActorId:String(e.created_by_actor_id),expiresAt:a,revokedAt:r,state:r?"revoked":a<=t?"expired":"active",createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Up(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Kt(e.environment_id),releaseId:String(e.release_id),kind:String(e.kind),format:String(e.format),digest:String(e.digest),summary:Di(e.summary,{}),content:Kt(e.content),sensitive:Number(e.sensitive)===1,createdAt:String(e.created_at)}}function Hy(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),operationId:Kt(e.operation_id),policyId:String(e.policy_id),policyVersion:Number(e.policy_version),outcome:String(e.outcome),scannerVersions:Di(e.scanner_versions,{}),findingIds:Di(e.finding_ids,[]),waiverIds:Di(e.waiver_ids,[]),explanation:String(e.explanation),createdAt:String(e.created_at)}}function sR(e,t){let r=[e.trim().toLowerCase(),t.ruleId.trim().toLowerCase(),t.organizationId,t.projectId??"",t.environmentId??"",t.resourceId??"",t.releaseId??"",t.subject.trim().toLowerCase()].join("\x00");return iR("sha256").update(r).digest("hex")}function Ky(e){if(!e)return;let t=new URL(e);if(t.protocol!=="https:"&&t.protocol!=="http:")throw Error("Security references must use HTTP or HTTPS");return t.toString()}function Jy(e){if(!e.length)throw Error("A security policy needs at least one rule");return e.map((t)=>{if(!(t.minimumSeverity in qp))throw Error(`Unknown security severity: ${t.minimumSeverity}`);if(!(t.action in Vp))throw Error(`Unknown security policy action: ${t.action}`);return{minimumSeverity:t.minimumSeverity,action:t.action,...t.scannerId?{scannerId:t.scannerId.trim()}:{}}})}class Cn{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}recordScan(e){if(!e.organizationId||!e.scannerId.trim()||!e.scannerVersion.trim())throw Error("Organization, scanner id, and scanner version are required");let t=e.completedAt??this.now(),r=e.startedAt??t,a=e.durationMs??Math.max(0,new Date(t).getTime()-new Date(r).getTime()),g=e.findings??[],f=this.idFn(),h=new Set,b=[];return this.controlPlane.transaction(()=>{this.run(`INSERT INTO security_scan_runs
         (id, organization_id, project_id, environment_id, resource_id, release_id, scanner_id, scanner_version, status, error, metadata, findings_count, started_at, completed_at, duration_ms)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[f,e.organizationId,e.projectId??null,e.environmentId??null,e.resourceId??null,e.releaseId??null,e.scannerId.trim(),e.scannerVersion.trim(),e.status,oR(e.error)??null,Hn(e.metadata??{}),g.length,r,t,Math.max(0,Math.floor(a))]);for(let S of g){let y={...S,organizationId:e.organizationId,projectId:S.projectId??e.projectId,environmentId:S.environmentId??e.environmentId,resourceId:S.resourceId??e.resourceId,releaseId:S.releaseId??e.releaseId},k=y.fingerprint?.trim()||sR(e.scannerId,y);h.add(k);let R=this.controlPlane.database.query("SELECT * FROM security_findings WHERE fingerprint = ?").get(k),D=R?this.controlPlane.database.query("SELECT * FROM security_waivers WHERE finding_id = ? AND revoked_at IS NULL AND expires_at > ? ORDER BY expires_at DESC LIMIT 1").get(String(R.id),t):void 0;if(R){let O=String(R.status)==="resolved"?Number(R.recurrence_count)+1:Number(R.recurrence_count),M=D?"waived":String(R.status)==="acknowledged"?"acknowledged":"open";this.run(`UPDATE security_findings SET scan_run_id = ?, scanner_version = ?, severity = ?, title = ?, description = ?, evidence = ?, remediation = ?,
             status = ?, recurrence_count = ?, last_seen_at = ?, resolved_at = NULL, updated_at = ? WHERE id = ?`,[f,e.scannerVersion,y.severity,y.title.trim(),y.description.trim(),Hn(y.evidence??{}),y.remediation?.trim()||null,M,O,t,t,String(R.id)]),b.push(this.getFinding(String(R.id)))}else{let O=this.idFn();this.run(`INSERT INTO security_findings
@@ -104,14 +104,14 @@ data: ${JSON.stringify(it)}
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[h,t.id,e.policyId??null,r,b??null,e.actorId,g.toISOString(),a,a]),this.run("UPDATE security_findings SET status = 'waived', updated_at = ? WHERE id = ?",[a,t.id]),this.controlPlane.appendEvent({organizationId:t.organizationId,projectId:t.projectId,resourceId:t.resourceId,actorId:e.actorId,type:"security.waiver.created",level:"warning",payload:{waiverId:h,findingId:t.id,policyId:e.policyId??null,reason:r,expiresAt:g.toISOString(),referenceUrl:b??null}})}),this.getWaiver(h)}revokeWaiver(e,t){let r=this.getWaiver(e);if(!r)throw Error("Security waiver was not found");if(r.revokedAt)return r;let a=this.getFinding(r.findingId),g=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE security_waivers SET revoked_at = ?, updated_at = ? WHERE id = ?",[g,g,e]),this.run("UPDATE security_findings SET status = 'open', updated_at = ? WHERE id = ? AND status = 'waived'",[g,r.findingId]),this.controlPlane.appendEvent({organizationId:a.organizationId,projectId:a.projectId,resourceId:a.resourceId,actorId:t,type:"security.waiver.revoked",level:"warning",payload:{waiverId:e,findingId:r.findingId}})}),this.getWaiver(e)}getWaiver(e){let t=this.controlPlane.database.query("SELECT * FROM security_waivers WHERE id = ?").get(e);return t?Wy(t,this.now()):void 0}listWaivers(e){return(e?this.controlPlane.database.query("SELECT * FROM security_waivers WHERE finding_id = ? ORDER BY created_at DESC").all(e):this.controlPlane.database.query("SELECT * FROM security_waivers ORDER BY created_at DESC").all()).map((r)=>Wy(r,this.now()))}expireWaivers(){let e=this.now(),t=this.controlPlane.database.query(`SELECT w.id AS waiver_id, f.* FROM security_waivers w JOIN security_findings f ON f.id = w.finding_id
       WHERE w.revoked_at IS NULL AND w.expires_at <= ? AND f.status = 'waived'`).all(e);for(let r of t)this.run("UPDATE security_findings SET status = 'open', updated_at = ? WHERE id = ?",[e,String(r.id)]),this.controlPlane.appendEvent({organizationId:String(r.organization_id),projectId:Kt(r.project_id),resourceId:Kt(r.resource_id),type:"security.waiver.expired",level:"warning",payload:{waiverId:String(r.waiver_id),findingId:String(r.id)}});return t.length}createPolicy(e){let t=e.name.trim();if(!t)throw Error("Security policy name is required");let r=Jy(e.rules),a=this.idFn(),g=this.now(),f=[...new Set((e.requiredScanners??[]).map((h)=>h.trim()).filter(Boolean))].sort();return this.run(`INSERT INTO security_policies (id, organization_id, environment_id, name, rules, required_scanners, scanner_fail_mode, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[a,e.organizationId,e.environmentId??null,t,Hn(r),Hn(f),e.scannerFailMode,e.actorId??null,g,g]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.actorId,type:"security.policy.created",payload:{policyId:a,environmentId:e.environmentId??null,scannerFailMode:e.scannerFailMode,requiredScanners:f,rules:s(r)}}),this.getPolicy(a)}updatePolicy(e,t,r){let a=this.getPolicy(e);if(!a||a.version!==t)throw Error(`Security policy ${e} changed since version ${t}`);let g=r.rules?Jy(r.rules):a.rules,f=r.requiredScanners?[...new Set(r.requiredScanners.map((S)=>S.trim()).filter(Boolean))].sort():a.requiredScanners,h=this.now();if(this.controlPlane.database.run("UPDATE security_policies SET name = ?, rules = ?, required_scanners = ?, scanner_fail_mode = ?, enabled = ?, version = version + 1, updated_at = ? WHERE id = ? AND version = ?",[r.name?.trim()||a.name,Hn(g),Hn(f),r.scannerFailMode??a.scannerFailMode,r.enabled??a.enabled?1:0,h,e,t]).changes!==1)throw Error(`Security policy ${e} changed since version ${t}`);return this.controlPlane.appendEvent({organizationId:a.organizationId,actorId:r.actorId,type:"security.policy.updated",payload:{policyId:e,fromVersion:t,toVersion:t+1}}),this.getPolicy(e)}getPolicy(e){let t=this.controlPlane.database.query("SELECT * FROM security_policies WHERE id = ?").get(e);return t?zp(t):void 0}listPolicies(e){return this.controlPlane.database.query("SELECT * FROM security_policies WHERE organization_id = ? ORDER BY environment_id, name").all(e).map(zp)}evaluateGate(e){this.expireWaivers();let t=e.policyId?this.getPolicy(e.policyId):this.controlPlane.database.query(`SELECT * FROM security_policies WHERE organization_id = ? AND enabled = 1 AND (environment_id = ? OR environment_id IS NULL)
-          ORDER BY CASE WHEN environment_id = ? THEN 0 ELSE 1 END, updated_at DESC LIMIT 1`).get(e.organizationId,e.environmentId,e.environmentId),r=t&&"rules"in t&&Array.isArray(t.rules)?t:t?zp(t):void 0;if(!r||!r.enabled)throw Error("No enabled security policy applies to this environment");let a=this.listFindings({organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,limit:1000}).filter((Se)=>Se.status!=="resolved"),g=new Map;for(let Se of a){let ie=this.listWaivers(Se.id).find((xe)=>xe.state==="active"&&(!xe.policyId||xe.policyId===r.id));if(ie)g.set(Se.id,ie)}let f=(Se)=>r.rules.filter((ie)=>(!ie.scannerId||ie.scannerId===Se.scannerId)&&qp[Se.severity]>=qp[ie.minimumSeverity]).reduce((ie,xe)=>Vp[xe.action]>Vp[ie]?xe.action:ie,"record"),h=a.filter((Se)=>!g.has(Se.id)&&f(Se)==="block"),b=a.filter((Se)=>!g.has(Se.id)&&f(Se)==="warn"),S=this.controlPlane.database.query(`SELECT run.* FROM security_scan_runs run
+          ORDER BY CASE WHEN environment_id = ? THEN 0 ELSE 1 END, updated_at DESC LIMIT 1`).get(e.organizationId,e.environmentId,e.environmentId),r=t&&"rules"in t&&Array.isArray(t.rules)?t:t?zp(t):void 0;if(!r||!r.enabled)throw Error("No enabled security policy applies to this environment");let a=this.listFindings({organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,limit:1000}).filter((be)=>be.status!=="resolved"),g=new Map;for(let be of a){let ie=this.listWaivers(be.id).find((_e)=>_e.state==="active"&&(!_e.policyId||_e.policyId===r.id));if(ie)g.set(be.id,ie)}let f=(be)=>r.rules.filter((ie)=>(!ie.scannerId||ie.scannerId===be.scannerId)&&qp[be.severity]>=qp[ie.minimumSeverity]).reduce((ie,_e)=>Vp[_e.action]>Vp[ie]?_e.action:ie,"record"),h=a.filter((be)=>!g.has(be.id)&&f(be)==="block"),b=a.filter((be)=>!g.has(be.id)&&f(be)==="warn"),S=this.controlPlane.database.query(`SELECT run.* FROM security_scan_runs run
       WHERE run.organization_id = ? AND run.project_id = ? AND run.environment_id = ?
       AND run.id = (SELECT candidate.id FROM security_scan_runs candidate
         WHERE candidate.organization_id = run.organization_id AND candidate.project_id = run.project_id
         AND candidate.environment_id = run.environment_id AND candidate.scanner_id = run.scanner_id
-        ORDER BY candidate.completed_at DESC, candidate.rowid DESC LIMIT 1)`).all(e.organizationId,e.projectId,e.environmentId),y=e.staleAfterMs??86400000,k=this.nowFn().getTime(),R=S.map(Fp).map((Se)=>k-new Date(Se.completedAt).getTime()>y?{...Se,status:"stale"}:Se),D=new Set(R.map((Se)=>Se.scannerId)),O=r.requiredScanners.filter((Se)=>!D.has(Se)).map((Se)=>({id:`missing:${Se}`,organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,scannerId:Se,scannerVersion:"unavailable",status:"unavailable",metadata:{},findingsCount:0,startedAt:this.now(),completedAt:this.now(),durationMs:0})),M=[...R,...O],z=M.filter((Se)=>r.requiredScanners.includes(Se.scannerId)&&qy.has(Se.status)),J=Object.fromEntries(M.map((Se)=>[Se.scannerId,Se.scannerVersion])),Z=r.scannerFailMode==="closed"&&z.length>0,oe=h.length||Z?"block":b.length||z.length?"warn":"allow",G=[];if(h.length)G.push(`${h.length} finding${h.length===1?"":"s"} blocked by policy`);if(b.length)G.push(`${b.length} warning${b.length===1?"":"s"} require review`);if(z.length)G.push(`${z.length} scanner${z.length===1?"":"s"} ${r.scannerFailMode==="closed"?"failed closed":"failed open"}`);if(g.size)G.push(`${g.size} active time-limited waiver${g.size===1?"":"s"}`);if(!G.length)G.push("All recorded checks satisfy policy");let te=this.idFn(),ye=this.now();return this.run(`INSERT INTO security_deploy_decisions
+        ORDER BY candidate.completed_at DESC, candidate.rowid DESC LIMIT 1)`).all(e.organizationId,e.projectId,e.environmentId),y=e.staleAfterMs??86400000,k=this.nowFn().getTime(),R=S.map(Fp).map((be)=>k-new Date(be.completedAt).getTime()>y?{...be,status:"stale"}:be),D=new Set(R.map((be)=>be.scannerId)),O=r.requiredScanners.filter((be)=>!D.has(be)).map((be)=>({id:`missing:${be}`,organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,scannerId:be,scannerVersion:"unavailable",status:"unavailable",metadata:{},findingsCount:0,startedAt:this.now(),completedAt:this.now(),durationMs:0})),M=[...R,...O],z=M.filter((be)=>r.requiredScanners.includes(be.scannerId)&&qy.has(be.status)),J=Object.fromEntries(M.map((be)=>[be.scannerId,be.scannerVersion])),Z=r.scannerFailMode==="closed"&&z.length>0,oe=h.length||Z?"block":b.length||z.length?"warn":"allow",G=[];if(h.length)G.push(`${h.length} finding${h.length===1?"":"s"} blocked by policy`);if(b.length)G.push(`${b.length} warning${b.length===1?"":"s"} require review`);if(z.length)G.push(`${z.length} scanner${z.length===1?"":"s"} ${r.scannerFailMode==="closed"?"failed closed":"failed open"}`);if(g.size)G.push(`${g.size} active time-limited waiver${g.size===1?"":"s"}`);if(!G.length)G.push("All recorded checks satisfy policy");let te=this.idFn(),ye=this.now();return this.run(`INSERT INTO security_deploy_decisions
       (id, organization_id, project_id, environment_id, operation_id, policy_id, policy_version, outcome, scanner_versions, finding_ids, waiver_ids, explanation, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[te,e.organizationId,e.projectId,e.environmentId,e.operationId??null,r.id,r.version,oe,Hn(J),Hn([...h,...b].map((Se)=>Se.id)),Hn([...g.values()].map((Se)=>Se.id)),G.join("; "),ye]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,operationId:e.operationId,type:"security.deploy.decision",level:oe==="block"?"error":oe==="warn"?"warning":"info",payload:{decisionId:te,outcome:oe,policyId:r.id,policyVersion:r.version,scannerVersions:J,blockerIds:h.map((Se)=>Se.id),waiverIds:[...g.values()].map((Se)=>Se.id),explanation:G.join("; ")}}),this.getDecision(te)}getDecision(e){let t=this.controlPlane.database.query("SELECT * FROM security_deploy_decisions WHERE id = ?").get(e);return t?Hy(t):void 0}listDecisions(e,t=100){return this.controlPlane.database.query("SELECT * FROM security_deploy_decisions WHERE environment_id = ? ORDER BY created_at DESC LIMIT ?").all(e,Math.min(500,Math.max(1,t))).map(Hy)}addReleaseArtifact(e){let t=this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? AND kind = ? AND digest = ?").get(e.releaseId,e.kind,e.digest);if(t)return Up(t);let r=this.idFn(),a=this.now();return this.run(`INSERT INTO release_security_artifacts
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[te,e.organizationId,e.projectId,e.environmentId,e.operationId??null,r.id,r.version,oe,Hn(J),Hn([...h,...b].map((be)=>be.id)),Hn([...g.values()].map((be)=>be.id)),G.join("; "),ye]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,operationId:e.operationId,type:"security.deploy.decision",level:oe==="block"?"error":oe==="warn"?"warning":"info",payload:{decisionId:te,outcome:oe,policyId:r.id,policyVersion:r.version,scannerVersions:J,blockerIds:h.map((be)=>be.id),waiverIds:[...g.values()].map((be)=>be.id),explanation:G.join("; ")}}),this.getDecision(te)}getDecision(e){let t=this.controlPlane.database.query("SELECT * FROM security_deploy_decisions WHERE id = ?").get(e);return t?Hy(t):void 0}listDecisions(e,t=100){return this.controlPlane.database.query("SELECT * FROM security_deploy_decisions WHERE environment_id = ? ORDER BY created_at DESC LIMIT ?").all(e,Math.min(500,Math.max(1,t))).map(Hy)}addReleaseArtifact(e){let t=this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? AND kind = ? AND digest = ?").get(e.releaseId,e.kind,e.digest);if(t)return Up(t);let r=this.idFn(),a=this.now();return this.run(`INSERT INTO release_security_artifacts
       (id, organization_id, project_id, environment_id, release_id, kind, format, digest, summary, content, sensitive, created_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,e.organizationId,e.projectId,e.environmentId??null,e.releaseId,e.kind,e.format,e.digest,Hn(e.summary),e.content??null,e.sensitive?1:0,a]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,type:"security.release_artifact.created",payload:{artifactId:r,releaseId:e.releaseId,kind:e.kind,format:e.format,digest:e.digest,sensitive:e.sensitive}}),Up(this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE id = ?").get(r))}listReleaseArtifacts(e,t=!1){return this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? ORDER BY created_at, kind").all(e).map(Up).map((r)=>r.sensitive&&!t?{...r,content:void 0}:r)}summary(e,t,r){let a=this.listFindings({organizationId:e,projectId:t,environmentId:r,limit:1000}),g=this.listScanRuns({organizationId:e,projectId:t,environmentId:r,limit:1000}),f={info:0,low:0,medium:0,high:0,critical:0};for(let b of a)if(b.status==="open"||b.status==="acknowledged")f[b.severity]++;let h={passed:0,failed:0,skipped:0,unavailable:0,unsupported:0,stale:0};for(let b of g)h[b.status]++;return{open:f,waived:a.filter((b)=>b.status==="waived").length,resolved:a.filter((b)=>b.status==="resolved").length,checks:h,lastScannedAt:g[0]?.completedAt}}exportPosture(e){let t=this.controlPlane.listProjects().filter((r)=>r.organizationId===e);return s({format:"ts-cloud-security-posture",version:1,exportedAt:this.now(),organizationId:e,policies:this.listPolicies(e),findings:this.listFindings({organizationId:e,limit:1000}),waivers:this.listWaivers().filter((r)=>this.getFinding(r.findingId)?.organizationId===e),scans:t.flatMap((r)=>this.listScanRuns({organizationId:e,projectId:r.id,limit:1000})),decisions:t.flatMap((r)=>this.controlPlane.listEnvironments(r.id).flatMap((a)=>this.listDecisions(a.id,1000)))})}}import{existsSync as aR,readdirSync as cR,readFileSync as dR,statSync as lR}from"node:fs";import{extname as uR,join as pR,relative as Gy,sep as gR}from"node:path";var Eu=[{name:"AWS Access Key ID",pattern:/(?:^|[^A-Z0-9])((AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16})(?:[^A-Z0-9]|$)/g,severity:"critical",description:"AWS Access Key ID detected"},{name:"AWS Secret Access Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key|secretAccessKey)['"]?\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,severity:"critical",description:"AWS Secret Access Key detected"},{name:"AWS Secret Key (Generic)",pattern:/(?:^|['"`:=\s])([A-Za-z0-9/+=]{40})(?:['"`\s]|$)/g,severity:"high",description:"Potential AWS Secret Key (40-char base64)"},{name:"Generic API Key",pattern:/(?:api[_-]?key|apikey|api[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9_\-]{20,})['"]?/gi,severity:"high",description:"Generic API key detected"},{name:"RSA Private Key",pattern:/-----BEGIN RSA PRIVATE KEY-----/g,severity:"critical",description:"RSA private key detected"},{name:"OpenSSH Private Key",pattern:/-----BEGIN OPENSSH PRIVATE KEY-----/g,severity:"critical",description:"OpenSSH private key detected"},{name:"EC Private Key",pattern:/-----BEGIN EC PRIVATE KEY-----/g,severity:"critical",description:"EC private key detected"},{name:"PGP Private Key",pattern:/-----BEGIN PGP PRIVATE KEY BLOCK-----/g,severity:"critical",description:"PGP private key detected"},{name:"GitHub Token",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"critical",description:"GitHub personal access token detected"},{name:"GitHub OAuth",pattern:/github[_-]?oauth[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9_]{40})['"]?/gi,severity:"critical",description:"GitHub OAuth token detected"},{name:"Slack Token",pattern:/xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*/g,severity:"critical",description:"Slack token detected"},{name:"Slack Webhook",pattern:/https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g,severity:"high",description:"Slack webhook URL detected"},{name:"Discord Webhook",pattern:/https:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]+/g,severity:"high",description:"Discord webhook URL detected"},{name:"JWT Token",pattern:/eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,severity:"high",description:"JWT token detected"},{name:"Google API Key",pattern:/AIza[0-9A-Za-z_-]{35}/g,severity:"critical",description:"Google API key detected"},{name:"Google OAuth ID",pattern:/[0-9]+-[A-Za-z0-9_]{32}\.apps\.googleusercontent\.com/g,severity:"high",description:"Google OAuth client ID detected"},{name:"Firebase API Key",pattern:/(?:firebase[_-]?api[_-]?key)\s*[=:]\s*['"]?([A-Za-z0-9_-]{39})['"]?/gi,severity:"critical",description:"Firebase API key detected"},{name:"Cloudflare API Token",pattern:/(?:cloudflare[_-]?api[_-]?token|cf[_-]?api[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{40})['"]?/gi,severity:"critical",description:"Cloudflare API token detected"},{name:"Azure Client Secret",pattern:/(?:azure[_-]?client[_-]?secret|client[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9~._-]{34,})['"]?/gi,severity:"critical",description:"Azure client secret detected"},{name:"Heroku API Key",pattern:/(?:heroku[_-]?api[_-]?key)\s*[=:]\s*['"]?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]?/gi,severity:"critical",description:"Heroku API key detected"},{name:"Database Connection String",pattern:/(?:mysql|postgres|postgresql|mongodb|redis|mongodb\+srv):\/\/[^:]+:[^@]+@[^/\s]+/gi,severity:"critical",description:"Database connection string with credentials detected"},{name:"Database Password",pattern:/(?:db[_-]?password|database[_-]?password|mysql[_-]?password|postgres[_-]?password)\s*[=:]\s*['"]?([^'"\s]{8,})['"]?/gi,severity:"critical",description:"Database password detected"},{name:"Stripe API Key",pattern:/(?:sk|pk)_(?:test|live)_[0-9a-zA-Z]{24,}/g,severity:"critical",description:"Stripe API key detected"},{name:"PayPal Client ID",pattern:/(?:paypal[_-]?client[_-]?id)\s*[=:]\s*['"]?([A-Za-z0-9_-]{80})['"]?/gi,severity:"high",description:"PayPal client ID detected"},{name:"Square Access Token",pattern:/sq0[a-z]{3}-[0-9A-Za-z_-]{22,}/g,severity:"critical",description:"Square access token detected"},{name:"Twilio API Key",pattern:/SK[a-f0-9]{32}/g,severity:"critical",description:"Twilio API key detected"},{name:"SendGrid API Key",pattern:/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,severity:"critical",description:"SendGrid API key detected"},{name:"Mailgun API Key",pattern:/key-[0-9a-zA-Z]{32}/g,severity:"critical",description:"Mailgun API key detected"},{name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"]([^'"]{8,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded password detected"},{name:"Secret/Token Assignment",pattern:/(?:secret|token|auth[_-]?token|access[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9_\-/+=]{16,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded secret or token detected"},{name:"NPM Token",pattern:/(?:npm[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{36})['"]?/gi,severity:"critical",description:"NPM token detected"},{name:"SSH Private Key Path Exposed",pattern:/~\/\.ssh\/id_[a-z]+|\/home\/[^/]+\/\.ssh\/id_[a-z]+/g,severity:"medium",description:"SSH private key path exposed"},{name:"Env Variable with Secret",pattern:/(?:process\.env\.)((?=[A-Z_]*(?:SECRET|KEY|TOKEN|PASSWORD|CREDENTIAL|AUTH))[A-Z_]+)\s*(?:===?\s*['"]([^'"]+)['"])?/g,severity:"medium",description:"Environment variable containing secret may be exposed"}],mR=[".js",".jsx",".ts",".tsx",".mjs",".cjs",".vue",".svelte",".html",".htm",".css",".scss",".less",".json",".yaml",".yml",".toml",".xml",".env",".config",".conf"],fR=["node_modules",".git",".svn",".hg","dist","build","coverage",".nyc_output","__pycache__",".pytest_cache","vendor",".idea",".vscode",".turbo",".next",".nuxt","framework.bak","pantry",".pantry","tests","test","__tests__","spec","__mocks__",".github",".gitlab",".circleci",".claude/worktrees"],hR=["package-lock.json","yarn.lock","pnpm-lock.yaml","bun.lockb","bun.lock","*.min.js","*.min.css","*.map","*.d.ts","*.test.ts","*.test.js","*.spec.ts","*.spec.js",".env",".env.*"];class En{patterns;excludeDirs;excludeFiles;maxFileSize;constructor(e){this.patterns=[...Eu,...e?.customPatterns||[]],this.excludeDirs=[...fR,...e?.excludeDirs||[]],this.excludeFiles=[...hR,...e?.excludeFiles||[]],this.maxFileSize=e?.maxFileSize||1048576}async scan(e){let t=Date.now(),r=[],a=0,{directory:g,exclude:f=[],include:h,skipPatterns:b=[]}=e,S=e.failOnSeverity||"critical";if(!aR(g))throw Error(`Directory not found: ${g}`);let y=this.getFilesToScan(g,[...this.excludeDirs,...f],h);for(let M of y){let z=Gy(g,M);if(this.shouldExcludeFile(z))continue;try{if(lR(M).size>this.maxFileSize)continue;let Z=dR(M,"utf-8"),oe=this.scanContent(Z,z,b);r.push(...oe),a++}catch{continue}}let k={critical:r.filter((M)=>M.pattern.severity==="critical").length,high:r.filter((M)=>M.pattern.severity==="high").length,medium:r.filter((M)=>M.pattern.severity==="medium").length,low:r.filter((M)=>M.pattern.severity==="low").length},R=["low","medium","high","critical"],D=R.indexOf(S),O=!0;for(let M=D;M<R.length;M++)if(k[R[M]]>0){O=!1;break}return{passed:O,findings:r,scannedFiles:a,duration:Date.now()-t,summary:k}}scanContent(e,t,r){let a=[],g=e.split(`
 `);for(let f of this.patterns){if(r.includes(f.name))continue;f.pattern.lastIndex=0;let h;while((h=f.pattern.exec(e))!==null){let b=e.substring(0,h.index),S=b.split(`
@@ -119,12 +119,12 @@ data: ${JSON.stringify(it)}
 `),k=h.index-y,R=g[S-1]||"";if(this.isLikelyPlaceholder(h[0],R))continue;let D=h[1]||h[0];if(f.name==="AWS Secret Key (Generic)"&&/^[a-f0-9]{40}$/i.test(D))continue;if(f.name==="AWS Secret Key (Generic)"&&!this.hasSecretCharacterDiversity(D))continue;if(f.name==="AWS Secret Key (Generic)"&&/^(?:Actions|Commands|Controllers|Handlers|Jobs|Listeners|Middleware|Models|Resources|Services)\//.test(D))continue;if(this.isLowEntropy(D))continue;a.push({file:t,line:S,column:k,match:this.maskSecret(h[0]),pattern:f,context:this.maskSecret(R.trim())})}}return a}isLikelyPlaceholder(e,t){let r=["example","placeholder","your_","YOUR_","xxx","XXX","***","test","TEST","dummy","DUMMY","fake","FAKE","sample","SAMPLE","<your","${","{{","process.env","import.meta.env","CHANGEME","TODO","FIXME"],a=e.toLowerCase(),g=t.toLowerCase();for(let h of r)if(a.includes(h.toLowerCase())||g.includes(h.toLowerCase()))return!0;let f=t.trim();if(f.startsWith("//")||f.startsWith("#")||f.startsWith("*")||f.startsWith("/*")){if(g.includes("example")||g.includes("format:")||g.includes("e.g."))return!0}return!1}isLowEntropy(e){if(e.length<8)return!1;if(new Set(e).size<8)return!0;if(/(.)\1{3,}/.test(e))return!0;return!1}hasSecretCharacterDiversity(e){let t=/[\d+=]/.test(e),r=[/[a-z]/.test(e),/[A-Z]/.test(e),/\d/.test(e),/[/+=]/.test(e)];return t&&r.filter(Boolean).length>=3}maskSecret(e){if(e.length<=8)return"*".repeat(e.length);let t=Math.min(4,Math.floor(e.length*0.2));return e.substring(0,t)+"*".repeat(e.length-t*2)+e.substring(e.length-t)}getFilesToScan(e,t,r){let a=[],g=r||mR,f=t.filter((S)=>!S.includes("/")),h=t.filter((S)=>S.includes("/")).map((S)=>S.replace(/^\.\//,"").replace(/\/+$/,"")),b=(S)=>{let y=cR(S,{withFileTypes:!0});for(let k of y){let R=pR(S,k.name);if(k.isDirectory()){let D=Gy(e,R).split(gR).join("/");if(!f.includes(k.name)&&!h.includes(D))b(R)}else if(k.isFile()){let D=uR(k.name).toLowerCase();if(g.includes(D)||k.name.startsWith(".env")||k.name.endsWith(".config"))a.push(R)}}};return b(e),a}shouldExcludeFile(e){let t=e.split("/").pop()||"";for(let r of this.excludeFiles)if(r.startsWith("*")){let a=r.substring(1);if(t.endsWith(a))return!0}else if(r.endsWith("*")){let a=r.substring(0,r.length-1);if(t.startsWith(a))return!0}else if(t===r)return!0;return!1}addPattern(e){this.patterns.push(e)}getPatterns(){return[...this.patterns]}}async function Yf(e){return new En().scan(e)}function Zf(e){let t=[];if(t.push(`
 Security Scan Results`),t.push("=".repeat(50)),t.push(`Files scanned: ${e.scannedFiles}`),t.push(`Duration: ${e.duration}ms`),t.push(""),t.push("Summary:"),t.push(`  Critical: ${e.summary.critical}`),t.push(`  High: ${e.summary.high}`),t.push(`  Medium: ${e.summary.medium}`),t.push(`  Low: ${e.summary.low}`),t.push(""),e.findings.length>0){t.push("Findings:"),t.push("-".repeat(50));for(let r of e.findings)t.push(`
 [${r.pattern.severity.toUpperCase()}] ${r.pattern.name}`),t.push(`  File: ${r.file}:${r.line}:${r.column}`),t.push(`  Match: ${r.match}`),t.push(`  Context: ${r.context}`),t.push(`  Description: ${r.pattern.description}`)}return t.push(""),t.push(e.passed?"✓ Security scan passed":"✗ Security scan failed"),t.join(`
-`)}function yR(e,t){return{status:"unavailable",findings:[],error:`${e.id} exceeded its ${t}ms timeout`,metadata:{timeoutMs:t}}}class Lt{posture;defaultTimeoutMs;nowFn;constructor(e,t={}){this.posture=e;this.defaultTimeoutMs=t.defaultTimeoutMs??60000,this.nowFn=t.now??(()=>new Date)}async run(e,t){let r=this.nowFn(),a=Math.max(100,e.timeoutMs??this.defaultTimeoutMs),g=new AbortController,f,h=new Promise((k)=>{f=setTimeout(()=>{g.abort(),k(yR(e,a))},a)}),b;try{b=await Promise.race([e.scan({...t,signal:g.signal}),h])}catch(k){b={status:"unavailable",findings:[],error:k instanceof Error?k.message:String(k)}}finally{if(f)clearTimeout(f)}let S=this.nowFn(),y={...t,scannerId:e.id,scannerVersion:e.version,status:b.status,findings:b.findings,metadata:b.metadata,error:b.error,startedAt:r.toISOString(),completedAt:S.toISOString(),durationMs:Math.max(0,S.getTime()-r.getTime())};return this.posture.recordScan(y)}async runAll(e,t){return Promise.all(e.map((r)=>this.run(r,t)))}}class vn{scanner;id="source-secrets";version="1.0.0";timeoutMs=30000;constructor(e=new En){this.scanner=e}async scan(e){if(!e.artifactRoot)return{status:"skipped",findings:[],error:"No artifact root was supplied"};let t=await this.scanner.scan({directory:e.artifactRoot,failOnSeverity:"critical"});return{status:t.passed?"passed":"failed",findings:t.findings.map((r)=>({...e,ruleId:r.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:r.pattern.severity,title:r.pattern.name,description:r.pattern.description,subject:`${r.file}:${r.line}`,evidence:{file:r.file,line:r.line,column:r.column,match:r.match,context:r.context},remediation:"Remove the credential, rotate it at its issuer, and use a managed secret or environment reference."})),metadata:{scannedFiles:t.scannedFiles,summary:t.summary}}}}function vR(e){let t=e?.toLowerCase();return t==="critical"||t==="high"||t==="medium"||t==="low"?t:"info"}class Ea{id="trivy-image";version;timeoutMs;constructor(e={}){this.version=e.version??"local",this.timeoutMs=e.timeoutMs??120000,this.executable=e.executable??"trivy"}executable;async scan(e){if(!e.imageRef)return{status:"skipped",findings:[],error:"No image reference was supplied"};let t;try{t=Bun.spawn([this.executable,"image","--format","json","--quiet","--scanners","vuln",e.imageRef],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",TRIVY_NO_PROGRESS:"true"}})}catch(S){return{status:"unsupported",findings:[],error:S instanceof Error?S.message:String(S)}}let r=()=>t.kill();e.signal.addEventListener("abort",r,{once:!0});let[a,g,f]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);if(e.signal.removeEventListener("abort",r),a!==0)return{status:/not found|enoent/i.test(f)?"unsupported":"unavailable",findings:[],error:f.slice(0,2000)||`Trivy exited with ${a}`};let h=JSON.parse(g),b=[];for(let S of h.Results??[])for(let y of S.Vulnerabilities??[]){let k=y.VulnerabilityID??"unknown-vulnerability";b.push({...e,ruleId:k,severity:vR(y.Severity),title:y.Title||k,description:y.Description||`${k} affects ${y.PkgName??"an image package"}.`,subject:`${e.imageRef}:${y.PkgName??"unknown"}:${y.InstalledVersion??"unknown"}`,evidence:{image:e.imageRef,target:S.Target??"",cve:k,package:y.PkgName??"",installedVersion:y.InstalledVersion??"",fixedVersion:y.FixedVersion??"",reference:y.PrimaryURL??""},remediation:y.FixedVersion?`Upgrade ${y.PkgName} to ${y.FixedVersion} or later.`:"Remove or replace the affected package and rescan the image."})}return{status:b.length?"failed":"passed",findings:b,metadata:{imageRef:e.imageRef,vulnerabilityCount:b.length,localOnly:!0}}}}class eh{actions;id="aws-iam-capabilities";version="1.0.0";timeoutMs=30000;client;constructor(e,t={}){this.actions=e;if(this.resourceArns=t.resourceArns??["*"],t.client)this.client=t.client;else{let r=new Te(t.region),a=new Re(t.region);this.client={getCallerIdentity:()=>r.getCallerIdentity(),simulatePrincipalPolicy:(g)=>a.simulatePrincipalPolicy(g)}}}resourceArns;async scan(e){let t=await this.client.getCallerIdentity();if(!t.Arn)return{status:"unavailable",findings:[],error:"AWS returned no caller ARN"};let r=t.Arn;if(r.includes(":assumed-role/"))return{status:"unsupported",findings:[],error:"AWS policy simulation requires the underlying IAM role ARN; use an IAM role/user ARN or provider-native access analysis.",metadata:{account:t.Account??"",principalType:"assumed-role"}};let f=(await this.client.simulatePrincipalPolicy({PolicySourceArn:r,ActionNames:this.actions,ResourceArns:this.resourceArns})).EvaluationResults.filter((h)=>h.EvalDecision!=="allowed").map((h)=>({...e,ruleId:`iam-${h.EvalActionName.toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:"high",title:`Missing AWS capability: ${h.EvalActionName}`,description:`The active AWS principal is ${h.EvalDecision||"not allowed"} for this deployment action.`,subject:`${r}:${h.EvalActionName}`,evidence:{account:t.Account??"",principalArn:r,action:h.EvalActionName,decision:h.EvalDecision,missingContext:h.MissingContextValues??[]},remediation:"Grant the deployment principal the least-privilege action on the required resources, then rerun the capability check."}));return{status:f.length?"failed":"passed",findings:f,metadata:{account:t.Account??"",principalArn:r,evaluatedActions:this.actions.length}}}}import{createHash as bR,createVerify as SR}from"node:crypto";import{existsSync as wR,readFileSync as kR}from"node:fs";import{basename as IR,join as ER,resolve as Qy}from"node:path";function Xo(e){return bR("sha256").update(e).digest("hex")}function RR(e){let t=[["dependencies","required"],["optionalDependencies","optional"],["devDependencies","excluded"],["peerDependencies","required"]],r=new Map;for(let[a,g]of t){let f=e[a];if(!f||typeof f!=="object"||Array.isArray(f))continue;for(let[h,b]of Object.entries(f)){let S=String(b).replace(/^[~^]/,""),y=`${h}@${S}`;if(!r.has(y))r.set(y,{type:"library",name:h,version:S,purl:`pkg:npm/${encodeURIComponent(h)}@${encodeURIComponent(S)}`,scope:g})}}return[...r.values()].sort((a,g)=>`${a.name}@${a.version}`.localeCompare(`${g.name}@${g.version}`))}function vu(e,t={}){let r=ER(Qy(e),"package.json");if(!wR(r))throw Error(`Cannot generate an SBOM: ${r} was not found`);let a=kR(r,"utf8"),g=JSON.parse(a),f=String(g.name??IR(Qy(e))),h=String(g.version??"0.0.0"),b=Xo(a);return{bomFormat:"CycloneDX",specVersion:"1.5",serialNumber:t.serial??`urn:uuid:${crypto.randomUUID()}`,version:1,metadata:{timestamp:(t.now??new Date).toISOString(),component:{type:"application",name:f,version:h,purl:`pkg:npm/${encodeURIComponent(f)}@${encodeURIComponent(h)}`,hashes:[{alg:"SHA-256",content:b}]},tools:[{vendor:"ts-cloud",name:"security-posture",version:"1.0.0"}]},components:RR(g)}}async function Tu(e,t={}){let r=Bun.spawn([t.executable??"syft",e,"-o","cyclonedx-json"],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",SYFT_CHECK_FOR_APP_UPDATE:"false"}}),a=()=>r.kill();t.signal?.addEventListener("abort",a,{once:!0});let[g,f,h]=await Promise.all([r.exited,new Response(r.stdout).text(),new Response(r.stderr).text()]);if(t.signal?.removeEventListener("abort",a),g!==0)throw Error(h.slice(0,2000)||`Syft exited with ${g}`);return JSON.parse(f)}function va(e,t,r){let a=JSON.stringify(r);return e.addReleaseArtifact({...t,kind:"sbom",format:`cyclonedx-${r.specVersion}+json`,digest:`sha256:${Xo(a)}`,summary:{component:r.metadata.component.name,version:r.metadata.component.version,components:r.components.length},content:a,sensitive:!0})}function wu(e,t,r){let a={total:r.length,critical:0,high:0,medium:0,low:0,info:0,fixable:0};for(let f of r){a[f.severity]++;let h=f.evidence;if(typeof h.fixedVersion==="string"&&h.fixedVersion)a.fixable++}let g=JSON.stringify({releaseId:t.releaseId,generatedAt:new Date().toISOString(),findings:r.map((f)=>({id:f.id,ruleId:f.ruleId,severity:f.severity,subject:f.subject,remediation:f.remediation}))});return e.addReleaseArtifact({...t,kind:"vulnerability_summary",format:"ts-cloud-vulnerability-summary+json",digest:`sha256:${Xo(g)}`,summary:a,content:g,sensitive:!0})}function Ru(e){if(!e.artifact&&!e.artifactSha256)throw Error("Release provenance requires artifact content or a SHA-256 digest");return{_type:"https://in-toto.io/Statement/v1",subject:[{name:e.artifactName,digest:{sha256:e.artifactSha256?.replace(/^sha256:/,"")??Xo(e.artifact)}}],predicateType:"https://slsa.dev/provenance/v1",predicate:{buildDefinition:{buildType:"https://ts-cloud.dev/build/v1",externalParameters:e.externalParameters??{},internalParameters:{},resolvedDependencies:e.resolvedDependencies??[]},runDetails:{builder:{id:"https://ts-cloud.dev/builders/local/v1"},metadata:{invocationId:e.invocationId,startedOn:e.startedAt,finishedOn:e.completedAt}}}}}function Du(e,t,r){let a=JSON.stringify(r);return e.addReleaseArtifact({...t,kind:"provenance",format:"in-toto+slsa-v1+json",digest:`sha256:${Xo(a)}`,summary:{subjects:r.subject.length,builder:r.predicate.runDetails.builder.id,buildType:r.predicate.buildDefinition.buildType},content:a,sensitive:!0})}function $S(e){let t=e.expectedSha256.replace(/^sha256:/,"").toLowerCase(),r=Xo(e.artifact)===t;if(!e.signature||!e.publicKey)return{digestValid:r,signature:"not_configured"};try{let a=SR("SHA256");return a.update(e.artifact),a.end(),{digestValid:r,signature:a.verify(e.publicKey,Buffer.from(e.signature,"base64"))?"verified":"invalid"}}catch{return{digestValid:r,signature:"invalid"}}}function ge(e,t){let r=e.environments.get(t);if(!r)throw Error(`Security scope for environment '${t}' was not found`);return{organizationId:e.organization.id,projectId:e.project.id,environmentId:r.id}}function Pu(e,t){let r=new Cn(e.store),a=r.listPolicies(e.organization.id);for(let[g,f]of e.environments){if(a.some((b)=>b.environmentId===f.id))continue;let h=g==="production"||f.kind==="production";a.push(r.createPolicy({organizationId:e.organization.id,environmentId:f.id,name:h?"Production baseline":"Environment baseline",scannerFailMode:h?"closed":"open",requiredScanners:["source-secrets"],rules:h?[{minimumSeverity:"critical",action:"block"},{minimumSeverity:"high",action:"block"},{minimumSeverity:"medium",action:"warn"},{minimumSeverity:"low",action:"record"}]:[{minimumSeverity:"critical",action:"warn"},{minimumSeverity:"high",action:"warn"},{minimumSeverity:"low",action:"record"}],actorId:t}))}return a}function MS(e,t,r,a={}){let g=r.findings.map((f)=>({...t,ruleId:f.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:f.pattern.severity,title:f.pattern.name,description:f.pattern.description,subject:`${f.file}:${f.line}`,evidence:{file:f.file,line:f.line,column:f.column,match:f.match,context:f.context},remediation:"Remove and rotate the credential, then reference it through a managed secret or environment variable."}));return e.recordScan({...t,scannerId:"source-secrets",scannerVersion:a.scannerVersion??"1.0.0",status:a.skipped?"skipped":r.passed?"passed":"failed",findings:a.skipped?[]:g,metadata:{scannedFiles:r.scannedFiles,durationMs:r.duration,summary:r.summary},durationMs:r.duration,error:a.skipped?"The operator explicitly skipped source-secret scanning.":void 0})}function FS(e,t,r="The operator explicitly skipped source-secret scanning."){return e.recordScan({...t,scannerId:"source-secrets",scannerVersion:"1.0.0",status:"skipped",findings:[],error:r})}function AR(e,t){let r=[],a=t.security;if(a?.firewall&&!["active","configured","ok"].includes(String(a.firewall.status)))r.push({...e,ruleId:"host-firewall-disabled",severity:"high",title:"Host firewall is not active",description:String(a.firewall.summary??"The host firewall did not report an active configuration."),subject:"host:firewall",evidence:{status:String(a.firewall.status??"unknown"),rules:Array.isArray(a.firewall.rules)?a.firewall.rules.length:0},remediation:"Apply the declarative firewall policy and confirm only required listeners are public."});for(let g of a?.ports??[]){let f=String(g.listen??""),h=Number(f.match(/:(\d+)$/)?.[1]);if(g.exposure==="public"&&Number.isFinite(h)&&![22,80,443].includes(h))r.push({...e,ruleId:"unexpected-public-listener",severity:"medium",title:`Unexpected public listener on port ${h}`,description:`${String(g.processName??"A process")} is listening publicly outside the standard SSH/HTTP/HTTPS ports.`,subject:`host:port:${h}`,evidence:{protocol:String(g.proto??""),listen:f,process:String(g.processName??"")},remediation:"Bind the service to loopback/private networking or explicitly document and firewall the required public port."})}for(let g of a?.tlsCertificates??[]){let f=Number(g.daysRemaining);if(Number.isFinite(f)&&f<30)r.push({...e,ruleId:"tls-certificate-expiry",severity:f<14?"high":"medium",title:`TLS certificate expires in ${f} days`,description:`${String(g.domain??"A configured domain")} needs renewal.`,subject:`tls:${String(g.domain??"unknown")}`,evidence:{domain:String(g.domain??""),daysRemaining:f,expires:String(g.expires??"")},remediation:"Renew the certificate and verify automatic renewal can complete before expiry."})}for(let g of t.diagnostics??[]){if(g.status==="pass"||g.status==="ok")continue;r.push({...e,ruleId:`diagnostic-${String(g.name??"unknown").toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:g.status==="fail"?"high":"medium",title:String(g.name??"Host security check"),description:String(g.detail??"The host security diagnostic did not pass."),subject:`diagnostic:${String(g.name??"unknown")}`,evidence:{status:String(g.status??"unknown")},remediation:"Follow the diagnostic guidance, rerun the check, and confirm the finding resolves."})}return r}function fs(e,t,r){let a=!!r.security||Array.isArray(r.diagnostics),g=a?AR(t,r):[];return e.recordScan({...t,scannerId:"host-posture",scannerVersion:"1.0.0",status:!a?"unavailable":g.length?"failed":"passed",findings:g,metadata:{source:"dashboard-live-probe",checks:Array.isArray(r.diagnostics)?r.diagnostics.length:0},error:a?void 0:"Live host posture data was unavailable; source and provider checks remain usable."})}function hs(e,t){let r=e.evaluateGate({...t.scope,operationId:t.operationId}),a=e.listFindings({...t.scope,limit:1000}).filter((g)=>g.status!=="resolved");return{decision:r,summary:{desiredConfigHash:t.desiredConfigHash??null,securityImpact:{critical:a.filter((g)=>g.severity==="critical").length,high:a.filter((g)=>g.severity==="high").length,waived:a.filter((g)=>g.status==="waived").length,assigned:a.filter((g)=>!!g.ownerActorId).length},blockingFindingIds:r.findingIds,policy:{id:r.policyId,version:r.policyVersion},scannerVersions:r.scannerVersions}}}async function US(e,t){let r=t.scanner??new Ea({timeoutMs:t.scannerTimeoutMs}),g=await new Lt(e,{defaultTimeoutMs:t.scannerTimeoutMs??120000}).run(r,{...t.scope,releaseId:t.releaseId,imageRef:t.imageRef}),f={...t.scope,releaseId:t.releaseId};wu(e,f,g.findings);let h=t.generateImageSbom??Tu,b=new AbortController,S=Math.max(100,t.sbomTimeoutMs??120000),y,k=new Promise((O,M)=>{y=setTimeout(()=>{b.abort(),M(Error(`syft-sbom exceeded its ${S}ms timeout`))},S)}),R="unavailable";try{let O=await Promise.race([h(t.imageRef,{signal:b.signal}),k]);va(e,f,O),e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"passed",metadata:{imageRef:t.imageRef,format:`cyclonedx-${O.specVersion}+json`,components:O.components.length,localOnly:!0}}),R="image"}catch(O){let M=O instanceof Error?O.message:String(O);try{let z=vu(t.artifactRoot);va(e,f,z),e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unsupported",error:`Image inventory was unavailable; attached a package-manifest SBOM instead. ${M}`,metadata:{imageRef:t.imageRef,fallback:"package-manifest",components:z.components.length,localOnly:!0}}),R="manifest"}catch(z){e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unavailable",error:`Image and manifest SBOM generation were unavailable. ${M}; ${z instanceof Error?z.message:String(z)}`,metadata:{imageRef:t.imageRef,localOnly:!0}})}}finally{if(y)clearTimeout(y)}let D=Ru({artifactName:t.imageRef,artifact:t.imageSha256?void 0:t.imageRef,artifactSha256:t.imageSha256,invocationId:t.invocationId,startedAt:t.startedAt,completedAt:t.completedAt??new Date().toISOString(),externalParameters:t.externalParameters??{imageRef:t.imageRef}});return Du(e,f,D),{scan:g,sbomSource:R}}function Ee(e,t,r){return[e,t,r].map((a)=>encodeURIComponent(a)).join(":")}function th(e){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((t)=>[t,{supported:!1,reason:e}]))}function $t(e,t,r=["exec","files"]){let a=th(t);for(let g of e)a[g]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(g),requiresRecentAuth:r.includes(g)};return a}var CR=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function Le(e){let t=String(e??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(t))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(t))return"starting";if(["deactivating","stopping","draining","terminating"].includes(t))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(t))return"stopped";if(["degraded","unhealthy","warning"].includes(t))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(t))return"failed";return"unknown"}function $e(e){if(Array.isArray(e))return e.map((r)=>$e(r));if(!e||typeof e!=="object")return e;let t={};for(let[r,a]of Object.entries(e))t[r]=CR.test(r)?"[REDACTED]":$e(a);return t}function Mt(e,t=new Date){if(!e)return;let r=new Date(e).getTime();return Number.isFinite(r)?Math.max(0,Math.floor((t.getTime()-r)/1000)):void 0}function ku(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:void 0}function PR(e){let t=String(e?.message??e);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(t))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(t))return"unreachable";return"error"}async function Nu(e,t={},r={}){let a=t.now??new Date,g=Math.max(100,r.timeoutMs??1e4),f=Math.max(1,r.staleAfterSeconds??60),h=await Promise.all(e.map(async(S)=>{try{let y=await Promise.race([S.discover({...t,now:a}),new Promise((k,R)=>setTimeout(()=>R(Error(`Runtime source ${S.id} timed out after ${g}ms`)),g))]);return{workloads:y,source:{id:S.id,provider:S.provider,status:"fresh",discoveredAt:a.toISOString(),staleAfterSeconds:f,itemCount:y.length}}}catch(y){return{workloads:[],source:{id:S.id,provider:S.provider,status:PR(y),discoveredAt:a.toISOString(),staleAfterSeconds:f,itemCount:0,message:String(y?.message??y).slice(0,500)}}}})),b=h.map((S)=>S.source);return{generatedAt:a.toISOString(),workloads:h.flatMap((S)=>S.workloads).sort((S,y)=>S.name.localeCompare(y.name)||S.id.localeCompare(y.id)),sources:b,degraded:b.some((S)=>S.status!=="fresh")}}function es(e){return e?.split("/").at(-1)??e?.split(":").at(-1)??"unknown"}function Bu(e,t,r,a="ecs:aws",g=[]){let f=r.now??new Date;return e.map((h)=>{let b=h.serviceName??es(h.serviceArn),S=t.filter((Z)=>!h.clusterArn||Z.clusterArn===h.clusterArn),y=S.some((Z)=>!!Z.group)?S.filter((Z)=>Z.group===`service:${b}`):S,k=h.status==="ACTIVE"?(h.runningCount??0)<(h.desiredCount??0)?"degraded":"running":Le(h.status),R=g.find((Z)=>Z.taskDefinitionArn===h.taskDefinition),D=Array.isArray(R?.containerDefinitions)?R.containerDefinitions:[],O=[...new Set(D.map((Z)=>Z.logConfiguration?.options?.["awslogs-group"]).filter((Z)=>typeof Z==="string"))],M=D.flatMap((Z)=>(Z.mountPoints??[]).map((oe)=>({source:oe.sourceVolume,target:oe.containerPath,type:"volume",readOnly:!!oe.readOnly}))),z=D.flatMap((Z)=>(Z.portMappings??[]).map((oe,G)=>({id:`${Z.name??"container"}:${G}`,name:Z.name,mode:R?.networkMode,ports:[{container:oe.containerPort,host:oe.hostPort,protocol:oe.protocol}]}))),J=r.project&&r.environment&&b.startsWith(`${r.project}-${r.environment}-`)?b.slice(`${r.project}-${r.environment}-`.length):b;return{id:Ee("ecs",a,h.serviceArn??b),provider:"ecs",kind:"service",name:b,status:k,rawStatus:h.status,health:k==="running"?"healthy":k==="failed"||k==="degraded"?"unhealthy":"unknown",desiredReplicas:h.desiredCount,runningReplicas:h.runningCount,image:D[0]?.image,runtime:h.launchType??"ECS",version:es(h.taskDefinition),ageSeconds:Mt(h.deployments?.[0]?.createdAt,f),restartCount:0,tags:{},links:{project:r.project,environment:r.environment,service:J,release:es(h.taskDefinition),providerId:h.serviceArn},replicas:y.map((Z)=>{let oe=Le(Z.lastStatus);return{id:Ee("ecs",a,Z.taskArn??es(Z.taskArn)),name:es(Z.taskArn),status:oe,rawStatus:Z.lastStatus,createdAt:Z.createdAt,startedAt:Z.startedAt,stoppedAt:Z.stoppedAt,host:Z.containerInstanceArn,containers:(Z.containers??[]).map((G)=>({id:G.containerArn??G.name??"container",name:G.name??"container",image:D.find((te)=>te.name===G.name)?.image,imageDigest:G.imageDigest,status:Le(G.lastStatus),rawStatus:G.lastStatus,exitCode:G.exitCode,reason:G.reason,runtime:"ecs"}))}}),networks:z,mounts:M,capabilities:$t(["start","stop","restart","redeploy","scale","inspect",...O.length?["logs"]:[]],"This ECS runtime does not expose exec or file transfer; logs require an awslogs task-definition driver"),config:$e({clusterArn:h.clusterArn,taskDefinition:h.taskDefinition,launchType:h.launchType,pendingCount:h.pendingCount,deployments:h.deployments,logGroups:O,executionRoleArn:R?.executionRoleArn,taskRoleArn:R?.taskRoleArn,cpu:R?.cpu,memory:R?.memory}),discoveredAt:f.toISOString(),sourceId:a}})}function xu(e,t,r="lambda:aws"){let a=t.now??new Date;return e.map((g)=>{let f=g.FunctionName??es(g.FunctionArn),h=g.State==="Active"?"running":Le(g.State);return{id:Ee("lambda",r,g.FunctionArn??f),provider:"lambda",kind:"function",name:f,status:h,rawStatus:g.State,health:h==="running"?"healthy":h==="failed"?"unhealthy":"unknown",desiredReplicas:void 0,runningReplicas:void 0,image:void 0,runtime:g.Runtime,version:g.Version,architecture:g.Architectures?.join(", "),ageSeconds:Mt(g.LastModified,a),restartCount:0,tags:{},links:{project:t.project,environment:t.environment,service:f,providerId:g.FunctionArn},resources:{memoryLimitBytes:g.MemorySize==null?void 0:g.MemorySize*1024*1024},replicas:[],networks:[],mounts:[],capabilities:$t(["logs","inspect"],"Lambda has no persistent process to start, stop, restart, exec, or browse files; deploy a release to replace code"),config:$e({handler:g.Handler,timeout:g.Timeout,codeSize:g.CodeSize,stateReason:g.StateReason,environmentKeys:Object.keys(g.Environment?.Variables??{})}),discoveredAt:a.toISOString(),sourceId:r}})}function rh(e){let t=e.trim();if(!t)return[];let r=JSON.parse(t);if(!Array.isArray(r))throw Error("Docker inspect output must be an array");return r.filter((a)=>a&&typeof a.Id==="string")}function _R(e){let t=Object.entries(e.NetworkSettings?.Ports??{}).flatMap(([r,a])=>{let[g,f]=r.split("/");return(a??[]).map((h)=>({container:Number(g)||void 0,host:Number(h.HostPort)||void 0,protocol:f,address:h.HostIp}))});return Object.entries(e.NetworkSettings?.Networks??{}).map(([r,a])=>({id:a.NetworkID||r,name:r,mode:e.HostConfig?.NetworkMode,addresses:[a.IPAddress,a.GlobalIPv6Address].filter(Boolean),ports:t}))}function TR(e){return(e.Mounts??[]).filter((t)=>!!t.Destination).map((t)=>({source:t.Source,target:t.Destination,type:t.Type,readOnly:t.RW===!1}))}function nh(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((g)=>{let f=g.State?.OOMKilled?"oomkilled":g.State?.Restarting?"starting":g.State?.Status,h=Le(f),b=(g.Name??g.Id.slice(0,12)).replace(/^\//,""),S=g.Config?.Labels??{},y=TR(g),k=_R(g),R={id:g.Id,name:b,image:g.Config?.Image,imageDigest:g.Image,runtime:"docker",status:h,rawStatus:f,exitCode:g.State?.ExitCode,reason:g.State?.Error,resources:{memoryLimitBytes:g.HostConfig?.Memory||void 0},networks:k,mounts:y};return{id:Ee("docker",r,g.Id),provider:"docker",kind:"container",name:b,status:h,rawStatus:f,health:h==="running"?"healthy":h==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:h==="running"?1:0,image:g.Config?.Image,runtime:"docker",ageSeconds:Mt(g.State?.StartedAt,a),restartCount:g.RestartCount??0,tags:S,links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^docker:/,""),service:S["com.docker.compose.service"]??S["ts-cloud.service"]??b,release:S["ts-cloud.release"],providerId:g.Id},resources:R.resources,replicas:[{id:Ee("docker",r,`${g.Id}:0`),name:b,status:h,rawStatus:f,startedAt:g.State?.StartedAt,stoppedAt:g.State?.FinishedAt,restartCount:g.RestartCount,containers:[R],resources:R.resources}],networks:k,mounts:y,capabilities:$t(["start","stop","restart","logs","exec","inspect","files"],"Use the owning Compose service for redeploy and scale"),config:$e({image:g.Config?.Image,labels:S,environmentKeys:(g.Config?.Env??[]).map((D)=>D.split("=",1)[0]),networkMode:g.HostConfig?.NetworkMode}),discoveredAt:a.toISOString(),sourceId:r}})}class Ta{inspect;id;provider="docker";constructor(e,t="docker:local"){this.inspect=e;this.id=t}async discover(e){return nh(rh(await this.inspect(e)),e,this.id)}}function ih(e){let t=[];for(let r of e.split(`
-`)){if(!r.startsWith("TSCLOUD_SYSTEMD\t"))continue;let[,a,g,f,h,b,S,y,k,R,D,O,M,z]=r.split("\t");if(!a||!/^[A-Za-z0-9_.@:-]+\.service$/.test(a))continue;t.push({unit:a,load:g,active:f,sub:h,description:b,enabled:S,pid:Number(y)||void 0,memoryBytes:ku(k),restartCount:Number(R)||0,activeSince:D||void 0,fragmentPath:O||void 0,workingDirectory:M?.startsWith("/")?M:void 0,user:z||void 0})}return t}function sh(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((g)=>{let f=Le(g.active==="active"?g.sub||g.active:g.active),h=g.unit.replace(/\.service$/,""),b=/^(.*?) (?:release [^ ]+|queue worker|daemon |scheduler)(?: |$)/.exec(g.description??"")?.[1]??(t.project&&h.startsWith(`${t.project}-`)?h.slice(t.project.length+1).split("@",1)[0]:void 0),S=h.includes("@")?h.slice(h.indexOf("@")+1):void 0,y=g.workingDirectory?[{target:g.workingDirectory,type:"working-directory"}]:[],k=["start","stop","restart","logs","exec","inspect",...y.length?["files"]:[]];return{id:Ee("systemd",r,g.unit),provider:"systemd",kind:"service",name:h,displayName:g.description||h,status:f,rawStatus:[g.load,g.active,g.sub].filter(Boolean).join("/"),health:f==="running"?"healthy":f==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:f==="running"?1:0,ageSeconds:Mt(g.activeSince,a),restartCount:g.restartCount,tags:{enabled:g.enabled??"unknown"},links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^systemd:/,""),service:b,release:S,providerId:g.unit},resources:{memoryBytes:g.memoryBytes},replicas:[{id:Ee("systemd",r,`${g.unit}:main`),name:"main",status:f,pid:g.pid,startedAt:g.activeSince,restartCount:g.restartCount,resources:{memoryBytes:g.memoryBytes}}],networks:[],mounts:y,capabilities:$t(k,y.length?"This systemd runtime does not support redeploy or replica scaling through the scoped explorer":"File transfer requires a provider-reported service working directory; redeploy and scaling are unavailable"),config:$e({fragmentPath:g.fragmentPath,workingDirectory:g.workingDirectory,user:g.user,environment:g.environment,enabled:g.enabled}),discoveredAt:a.toISOString(),sourceId:r}})}class wa{read;id;provider="systemd";constructor(e,t="systemd:local"){this.read=e;this.id=t}async discover(e){return sh(ih(await this.read(e)),e,this.id)}}function xR(e,t){if(!e.success)throw Error(e.error||e.perInstance?.[0]?.error||`${t} discovery failed`);return e.perInstance?.[0]?.output??""}function DR(){return["set -uo pipefail",'command -v systemctl >/dev/null 2>&1 || { echo "systemctl is unavailable" >&2; exit 127; }',"systemctl list-units --type=service --all --plain --no-legend 2>/dev/null | awk '{print $1}' | while IFS= read -r unit; do",'  [ -n "$unit" ] || continue','  clean() { printf "%s" "$1" | tr "\\t\\r\\n" "   "; }','  load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null || true)','  active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null || true)','  sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null || true)','  description=$(systemctl show "$unit" -p Description --value 2>/dev/null || true)','  enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)','  pid=$(systemctl show "$unit" -p MainPID --value 2>/dev/null || true)','  memory=$(systemctl show "$unit" -p MemoryCurrent --value 2>/dev/null || true)','  restarts=$(systemctl show "$unit" -p NRestarts --value 2>/dev/null || true)','  since=$(systemctl show "$unit" -p ActiveEnterTimestamp --value 2>/dev/null || true)','  fragment=$(systemctl show "$unit" -p FragmentPath --value 2>/dev/null || true)','  working=$(systemctl show "$unit" -p WorkingDirectory --value 2>/dev/null || true)','  user=$(systemctl show "$unit" -p User --value 2>/dev/null || true)','  printf "TSCLOUD_SYSTEMD\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n" "$(clean "$unit")" "$(clean "$load")" "$(clean "$active")" "$(clean "$sub")" "$(clean "$description")" "$(clean "$enabled")" "$(clean "$pid")" "$(clean "$memory")" "$(clean "$restarts")" "$(clean "$since")" "$(clean "$fragment")" "$(clean "$working")" "$(clean "$user")"',"done"]}function OR(){return["set -uo pipefail",'if ! command -v docker >/dev/null 2>&1; then echo "[]"; exit 0; fi',"ids=$(docker ps -aq)",'if [ -z "$ids" ]; then echo "[]"; else docker inspect $ids; fi']}function Yy(e,t,r,a,g){let f=`${e}:${r.id}`,h=async()=>xR(await t.runRemoteDeploy({targets:[r],commands:e==="systemd"?DR():OR(),timeoutSeconds:30,comment:`ts-cloud runtime discovery:${e}`,tags:{Project:a.project.slug,Environment:g,Role:"app"}}),f);return e==="systemd"?new wa(h,f):new Ta(h,f)}async function bd(e,t=100){let r=[],a;for(let g=0;g<t;g++){let f=await e(a);if(r.push(...f.items),!f.nextToken)return r;a=f.nextToken}throw Error(`Provider pagination exceeded ${t} pages`)}class Ou{client;prefix;id="ecs:aws";provider="ecs";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=await bd(async(f)=>{let h=await this.client.listClusters({nextToken:f,maxResults:100});return{items:h.clusterArns??[],nextToken:h.nextToken}}),r=[],a=[],g=[];for(let f of t){let h=(await bd(async(b)=>{let S=await this.client.listServices(f,{nextToken:b,maxResults:100});return{items:S.serviceArns??[],nextToken:S.nextToken}})).filter((b)=>b.split("/").at(-1)?.startsWith(this.prefix));for(let b=0;b<h.length;b+=10){let S=await this.client.describeServices({cluster:f,services:h.slice(b,b+10)});r.push(...S.services??[])}for(let b of r.filter((S)=>S.clusterArn===f||!S.clusterArn)){let S=await bd(async(y)=>{let k=await this.client.listTasks(f,b.serviceName,{nextToken:y,maxResults:100});return{items:k.taskArns??[],nextToken:k.nextToken}});for(let y=0;y<S.length;y+=100){let k=await this.client.describeTasks(f,S.slice(y,y+100));a.push(...k.tasks??[])}}}if(this.client.describeTaskDefinition)for(let f of[...new Set(r.map((h)=>h.taskDefinition).filter((h)=>!!h))]){let h=await this.client.describeTaskDefinition(f);if(h.taskDefinition)g.push(h.taskDefinition)}return Bu(r,a,e,this.id,g)}}class _u{client;prefix;id="lambda:aws";provider="lambda";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=(await bd(async(r)=>{let a=await this.client.listFunctions({Marker:r,MaxItems:50});return{items:a.Functions??[],nextToken:a.NextMarker}})).filter((r)=>r.FunctionName?.startsWith(this.prefix));return xu(t,e,this.id)}}async function oh(e,t,r={}){let a=[],g=K(e),f=ce(e),h=e.aws?.profile,b=e.aws?.region??e.project.region??"us-east-1",S=`${e.project.slug}-${t}`;if(g!=="serverless"){let y=r.driver??F({config:e}),k=await y.findComputeTargets({slug:e.project.slug,environment:t,role:"app"});for(let R of k)a.push(Yy("systemd",y,R,e,t)),a.push(Yy("docker",y,R,e,t))}if(f==="aws")a.push(new Ou(r.ecs??new ut(b,h),S)),a.push(new _u(r.lambda??new T(b,h),S));return a}async function pe(e,t,r={}){let a={project:e.project.slug,environment:t};try{return await Nu(await oh(e,t,r),a)}catch(g){return{generatedAt:new Date().toISOString(),workloads:[],sources:[{id:"runtime:bootstrap",provider:ce(e)==="aws"?"ecs":"systemd",status:"error",discoveredAt:new Date().toISOString(),staleAfterSeconds:60,itemCount:0,message:String(g?.message??g).slice(0,500)}],degraded:!0}}}var Zy=65536,ia=49152,kd=/^[A-Za-z0-9_.@:-]+\.service$/,Id=/^[a-fA-F0-9]{12,128}$/,$R=["/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run"];function ts(e){let t=Buffer.from(e);return t.byteLength<=Zy?e:`${t.subarray(0,Zy-24).toString("utf8")}
-[output truncated]`}function Sd(e){return{success:!1,instanceCount:0,perInstance:[],error:e instanceof Error?e.message:String(e)}}function jn(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function NR(e,t){return Number.isFinite(e)?Math.min(1e4,Math.max(0,Math.floor(e))):t}function jR(e){let t=e.config,r=typeof t.clusterArn==="string"?t.clusterArn:void 0,a=e.links.providerId||e.name;return r&&a?{cluster:r,service:a}:void 0}function BR(e,t){return e.find((r)=>r.id===t.links.server)??(e.length===1?e[0]:void 0)}function MR(e,t){if(e.provider==="systemd"){let r=e.links.providerId;if(!r||!kd.test(r)||!["start","stop","restart"].includes(t))return;return[`systemctl ${t} ${r}`,`systemctl is-active ${r} 2>/dev/null || true`]}if(e.provider==="docker"){let r=e.links.providerId;if(!r||!Id.test(r)||!["start","stop","restart"].includes(t))return;return[`docker ${t} ${r}`,`docker inspect --format '{{.State.Status}}' ${r}`]}return}function ah(e,t){if(!t.startsWith("/")||t.includes("\x00"))return{ok:!1,error:"An absolute path is required."};let r=[];for(let b of t.split("/")){if(!b||b===".")continue;if(b===".."){if(!r.length)return{ok:!1,error:"Path traversal is not allowed."};r.pop()}else r.push(b)}let a=`/${r.join("/")}`;if($R.some((b)=>a===b||a.startsWith(`${b}/`)))return{ok:!1,error:"Sensitive host paths are not available through runtime file access."};let g=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),f=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");if(![...g&&f?[`/var/www/${g}/${f}`,`/srv/${g}/${f}`]:[],...e.mounts.map((b)=>b.target).filter((b)=>b.startsWith("/"))].some((b)=>a===b||a.startsWith(`${b.replace(/\/$/,"")}/`)))return{ok:!1,error:"Path is outside this service’s owned roots."};return{ok:!0,path:a}}function LR(e,t){let r=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),a=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");return[...r&&a?[`/var/www/${r}/${a}`,`/srv/${r}/${a}`]:[],...e.mounts.map((g)=>g.target).filter((g)=>g.startsWith("/"))].sort((g,f)=>f.length-g.length).find((g)=>t===g||t.startsWith(`${g.replace(/\/$/,"")}/`))}var Lu={process:["ps","-eo","pid,ppid,user,%cpu,%mem,etime,command","--sort=-%cpu"],sockets:["ss","-lntup"],filesystem:["df","-h"]};class ve{config;environment;dependencies;region;profile;constructor(e,t,r={}){this.config=e;this.environment=t;this.dependencies=r;this.region=e.aws?.region??e.project.region??"us-east-1",this.profile=e.aws?.profile}async inventory(){return this.dependencies.inventory?.()??pe(this.config,this.environment,{driver:this.dependencies.driver})}async workload(e){return(await this.inventory()).workloads.find((t)=>t.id===e)}async remote(e,t,r,a){let g=this.dependencies.driver??F({config:this.config}),f=await g.findComputeTargets({slug:this.config.project.slug,environment:this.environment,role:"app"}),h=BR(f,e);if(!h)throw Error("The workload server is no longer reachable in this scope.");return g.runRemoteDeploy({targets:[h],commands:t,timeoutSeconds:r,comment:a,tags:{Project:this.config.project.slug,Environment:this.environment,Role:"app"}})}async run(e){let t=await this.workload(e.workloadId),r={workloadId:e.workloadId,action:e.action};if(!t)return{...r,ok:!1,error:"Workload was not found in the current project and environment."};let a=t.capabilities[e.action];if(!a.supported)return{...r,ok:!1,error:a.reason??`${e.action} is unsupported for ${t.provider}.`};if(a.requiresConfirmation&&e.confirm!==t.name)return{...r,ok:!1,error:`Type "${t.name}" to ${e.action} this workload.`};if(a.requiresRecentAuth&&!e.recentAuth)return{...r,ok:!1,error:"Sign in again before using elevated runtime access."};if(e.action==="inspect")return{...r,ok:!0,workload:t};if(t.provider==="systemd"||t.provider==="docker"){let g=MR(t,e.action);if(!g)return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`};let f=await this.remote(t,["set -uo pipefail",...g],60,`ts-cloud runtime:${e.action}`).catch(Sd);return{...r,ok:f.success,command:g[0],stdout:ts(f.perInstance?.[0]?.output??""),stderr:ts(f.perInstance?.[0]?.error??f.error??""),error:f.success?void 0:f.error??"Runtime operation failed."}}if(t.provider==="ecs"){let g=jR(t);if(!g)return{...r,ok:!1,error:"ECS cluster or service identity is unavailable."};let f=this.dependencies.ecs??new ut(this.region,this.profile);if(e.action==="scale"){let h=NR(e.replicas,t.desiredReplicas??1);return await f.scaleService(g.cluster,g.service,h),{...r,ok:!0,command:`ecs scale ${t.name} ${h}`}}if(e.action==="start"||e.action==="stop"){let h=e.action==="stop"?0:Math.max(1,t.desiredReplicas??1);return await f.scaleService(g.cluster,g.service,h),{...r,ok:!0,command:`ecs scale ${t.name} ${h}`}}if(e.action==="restart"||e.action==="redeploy")return await f.forceNewDeployment(g.cluster,g.service),{...r,ok:!0,command:`ecs redeploy ${t.name}`}}return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`}}async exec(e){let t={workloadId:e.workloadId,preset:e.preset},r=await this.workload(e.workloadId);if(!r)return{...t,ok:!1,error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_EXEC==="0")return{...t,ok:!1,error:"Runtime exec is disabled by TS_CLOUD_RUNTIME_EXEC."};if(!r.capabilities.exec.supported)return{...t,ok:!1,error:r.capabilities.exec.reason??"Exec is unsupported for this workload."};if(e.confirm!==r.name)return{...t,ok:!1,error:`Type "${r.name}" to open exec access.`};if(!e.recentAuth)return{...t,ok:!1,error:"Sign in again before using elevated runtime access."};let a=e.preset&&Lu[e.preset];if(!a&&!e.command?.trim())return{...t,ok:!1,error:"Choose a diagnostic preset or provide a command."};if(e.command&&r.provider!=="docker")return{...t,ok:!1,error:"Free-form exec is restricted to isolated containers; use a diagnostic preset for system services."};let g=r.links.providerId??"",f;if(r.provider==="docker"&&Id.test(g)){let b=e.command?.trim()||a.map(jn).join(" ");f=`docker exec ${g} sh -lc ${jn(b)}`}else if(r.provider==="systemd"&&kd.test(g)&&e.preset)f=e.preset==="process"?`systemctl status ${g} --no-pager --full`:Lu[e.preset].map(jn).join(" ");if(!f)return{...t,ok:!1,error:"Exec target identity is invalid or unsupported."};let h=await this.remote(r,["set -uo pipefail",f],60,"ts-cloud runtime:exec").catch(Sd);return{...t,ok:h.success,command:f,stdout:ts(h.perInstance?.[0]?.output??""),stderr:ts(h.perInstance?.[0]?.error??h.error??""),error:h.success?void 0:h.error??"Exec command failed."}}async readFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};let{workload:a,path:g,root:f,providerId:h}=r,S=`sh -c ${jn('resolved=$(realpath -m "$1"); root=$(realpath -m "$3"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; test -f "$resolved"; size=$(wc -c < "$resolved"); printf "__TSCLOUD_SIZE__=%s\\n" "$size"; head -c "$2" "$resolved" | base64')} sh ${jn(g)} ${ia} ${jn(f)}`,y=a.provider==="docker"?`docker exec ${h} ${S}`:S,k=await this.remote(a,[y],30,"ts-cloud runtime:file-read").catch(Sd);if(!k.success)return{...t,ok:!1,error:k.error??k.perInstance?.[0]?.error??"File read failed."};let R=k.perInstance?.[0]?.output??"",D=/__TSCLOUD_SIZE__=(\d+)\r?\n/.exec(R);if(!D)return{...t,ok:!1,error:"The remote file response was invalid."};let O=Number(D[1]),M=R.slice((D.index??0)+D[0].length).replace(/\s+/g,"");if(Buffer.from(M,"base64").byteLength>ia)return{...t,ok:!1,error:"The remote file exceeded the transfer limit."};return{...t,ok:!0,contentBase64:M,size:O,truncated:O>ia}}async writeFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};if(!/^[A-Za-z0-9+/]*={0,2}$/.test(e.contentBase64))return{...t,ok:!1,error:"File content must be valid base64."};let a=Buffer.from(e.contentBase64,"base64");if(a.toString("base64")!==e.contentBase64)return{...t,ok:!1,error:"File content must be canonical base64."};if(a.byteLength>ia)return{...t,ok:!1,error:`File uploads are limited to ${ia} bytes.`};let{workload:g,path:f,root:h,providerId:b}=r,y=`sh -c ${jn('resolved=$(realpath -m "$1"); root=$(realpath -m "$2"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; mkdir -p "$(dirname "$resolved")"; tmp="$resolved.ts-cloud-$$"; base64 -d > "$tmp"; chmod 600 "$tmp"; mv "$tmp" "$resolved"')} sh ${jn(f)} ${jn(h)}`,k=g.provider==="docker"?`printf %s ${jn(e.contentBase64)} | docker exec -i ${b} ${y}`:`printf %s ${jn(e.contentBase64)} | ${y}`,R=await this.remote(g,[k],30,"ts-cloud runtime:file-write").catch(Sd);return{...t,ok:R.success,size:a.byteLength,truncated:!1,error:R.success?void 0:R.error??R.perInstance?.[0]?.error??"File write failed."}}async fileTarget(e){let t=await this.workload(e.workloadId);if(!t)return{error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_FILE_ACCESS==="0")return{error:"Runtime file access is disabled by TS_CLOUD_RUNTIME_FILE_ACCESS."};if(!t.capabilities.files.supported)return{error:t.capabilities.files.reason??"File access is unsupported for this workload."};if(e.confirm!==t.name)return{error:`Type "${t.name}" to access workload files.`};if(!e.recentAuth)return{error:"Sign in again before using elevated runtime access."};let r=ah(t,e.path);if(!r.ok)return{error:r.error};let a=LR(t,r.path),g=t.links.providerId??"";if(!a||t.provider==="systemd"&&!kd.test(g)||t.provider==="docker"&&!Id.test(g))return{error:"File target identity is invalid or unsupported."};return{workload:t,path:r.path,root:a,providerId:g}}async logs(e,t={}){let r=await this.workload(e);if(!r)throw Error("Workload was not found in the current project and environment.");if(!r.capabilities.logs.supported)throw Error(r.capabilities.logs.reason??"Logs are unsupported for this workload.");let a=Math.min(1000,Math.max(1,Math.floor(t.limit??200)));if(r.provider==="lambda"||r.provider==="ecs"){let k=this.dependencies.logs??new we(this.region,this.profile),R=r.config.logGroups,D=r.provider==="lambda"?`/aws/lambda/${r.name}`:Array.isArray(R)&&typeof R[0]==="string"?R[0]:void 0;if(!D)throw Error("The ECS task definition does not declare an awslogs group.");let O=await k.filterLogEvents({logGroupName:D,startTime:t.since?.getTime(),limit:a}),M=(O.events??[]).slice(0,a).map((z)=>({timestamp:z.timestamp==null?void 0:new Date(z.timestamp).toISOString(),message:ts(String(z.message??""))}));return{workloadId:e,provider:r.provider,lines:M,nextCursor:O.nextToken,truncated:(O.events?.length??0)>=a}}let g=r.links.providerId??"",f=t.since&&Number.isFinite(t.since.getTime())?t.since:void 0,h=r.provider==="systemd"&&kd.test(g)?`journalctl -u ${g} --no-pager -n ${a} -o short-iso${f?` --since ${jn(f.toISOString())}`:""}`:r.provider==="docker"&&Id.test(g)?`docker logs --timestamps --tail ${a}${f?` --since ${Math.floor(f.getTime()/1000)}`:""} ${g} 2>&1`:void 0;if(!h)throw Error("Log target identity is invalid.");let b=await this.remote(r,[h],30,"ts-cloud runtime:logs");if(!b.success)throw Error(b.error??b.perInstance?.[0]?.error??"Log read failed.");let S=ts(b.perInstance?.[0]?.output??""),y=S.split(`
+`)}function yR(e,t){return{status:"unavailable",findings:[],error:`${e.id} exceeded its ${t}ms timeout`,metadata:{timeoutMs:t}}}class Lt{posture;defaultTimeoutMs;nowFn;constructor(e,t={}){this.posture=e;this.defaultTimeoutMs=t.defaultTimeoutMs??60000,this.nowFn=t.now??(()=>new Date)}async run(e,t){let r=this.nowFn(),a=Math.max(100,e.timeoutMs??this.defaultTimeoutMs),g=new AbortController,f,h=new Promise((k)=>{f=setTimeout(()=>{g.abort(),k(yR(e,a))},a)}),b;try{b=await Promise.race([e.scan({...t,signal:g.signal}),h])}catch(k){b={status:"unavailable",findings:[],error:k instanceof Error?k.message:String(k)}}finally{if(f)clearTimeout(f)}let S=this.nowFn(),y={...t,scannerId:e.id,scannerVersion:e.version,status:b.status,findings:b.findings,metadata:b.metadata,error:b.error,startedAt:r.toISOString(),completedAt:S.toISOString(),durationMs:Math.max(0,S.getTime()-r.getTime())};return this.posture.recordScan(y)}async runAll(e,t){return Promise.all(e.map((r)=>this.run(r,t)))}}class vn{scanner;id="source-secrets";version="1.0.0";timeoutMs=30000;constructor(e=new En){this.scanner=e}async scan(e){if(!e.artifactRoot)return{status:"skipped",findings:[],error:"No artifact root was supplied"};let t=await this.scanner.scan({directory:e.artifactRoot,failOnSeverity:"critical"});return{status:t.passed?"passed":"failed",findings:t.findings.map((r)=>({...e,ruleId:r.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:r.pattern.severity,title:r.pattern.name,description:r.pattern.description,subject:`${r.file}:${r.line}`,evidence:{file:r.file,line:r.line,column:r.column,match:r.match,context:r.context},remediation:"Remove the credential, rotate it at its issuer, and use a managed secret or environment reference."})),metadata:{scannedFiles:t.scannedFiles,summary:t.summary}}}}function vR(e){let t=e?.toLowerCase();return t==="critical"||t==="high"||t==="medium"||t==="low"?t:"info"}class Ea{id="trivy-image";version;timeoutMs;constructor(e={}){this.version=e.version??"local",this.timeoutMs=e.timeoutMs??120000,this.executable=e.executable??"trivy"}executable;async scan(e){if(!e.imageRef)return{status:"skipped",findings:[],error:"No image reference was supplied"};let t;try{t=Bun.spawn([this.executable,"image","--format","json","--quiet","--scanners","vuln",e.imageRef],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",TRIVY_NO_PROGRESS:"true"}})}catch(S){return{status:"unsupported",findings:[],error:S instanceof Error?S.message:String(S)}}let r=()=>t.kill();e.signal.addEventListener("abort",r,{once:!0});let[a,g,f]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);if(e.signal.removeEventListener("abort",r),a!==0)return{status:/not found|enoent/i.test(f)?"unsupported":"unavailable",findings:[],error:f.slice(0,2000)||`Trivy exited with ${a}`};let h=JSON.parse(g),b=[];for(let S of h.Results??[])for(let y of S.Vulnerabilities??[]){let k=y.VulnerabilityID??"unknown-vulnerability";b.push({...e,ruleId:k,severity:vR(y.Severity),title:y.Title||k,description:y.Description||`${k} affects ${y.PkgName??"an image package"}.`,subject:`${e.imageRef}:${y.PkgName??"unknown"}:${y.InstalledVersion??"unknown"}`,evidence:{image:e.imageRef,target:S.Target??"",cve:k,package:y.PkgName??"",installedVersion:y.InstalledVersion??"",fixedVersion:y.FixedVersion??"",reference:y.PrimaryURL??""},remediation:y.FixedVersion?`Upgrade ${y.PkgName} to ${y.FixedVersion} or later.`:"Remove or replace the affected package and rescan the image."})}return{status:b.length?"failed":"passed",findings:b,metadata:{imageRef:e.imageRef,vulnerabilityCount:b.length,localOnly:!0}}}}class eh{actions;id="aws-iam-capabilities";version="1.0.0";timeoutMs=30000;client;constructor(e,t={}){this.actions=e;if(this.resourceArns=t.resourceArns??["*"],t.client)this.client=t.client;else{let r=new we(t.region),a=new De(t.region);this.client={getCallerIdentity:()=>r.getCallerIdentity(),simulatePrincipalPolicy:(g)=>a.simulatePrincipalPolicy(g)}}}resourceArns;async scan(e){let t=await this.client.getCallerIdentity();if(!t.Arn)return{status:"unavailable",findings:[],error:"AWS returned no caller ARN"};let r=t.Arn;if(r.includes(":assumed-role/"))return{status:"unsupported",findings:[],error:"AWS policy simulation requires the underlying IAM role ARN; use an IAM role/user ARN or provider-native access analysis.",metadata:{account:t.Account??"",principalType:"assumed-role"}};let f=(await this.client.simulatePrincipalPolicy({PolicySourceArn:r,ActionNames:this.actions,ResourceArns:this.resourceArns})).EvaluationResults.filter((h)=>h.EvalDecision!=="allowed").map((h)=>({...e,ruleId:`iam-${h.EvalActionName.toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:"high",title:`Missing AWS capability: ${h.EvalActionName}`,description:`The active AWS principal is ${h.EvalDecision||"not allowed"} for this deployment action.`,subject:`${r}:${h.EvalActionName}`,evidence:{account:t.Account??"",principalArn:r,action:h.EvalActionName,decision:h.EvalDecision,missingContext:h.MissingContextValues??[]},remediation:"Grant the deployment principal the least-privilege action on the required resources, then rerun the capability check."}));return{status:f.length?"failed":"passed",findings:f,metadata:{account:t.Account??"",principalArn:r,evaluatedActions:this.actions.length}}}}import{createHash as bR,createVerify as SR}from"node:crypto";import{existsSync as wR,readFileSync as kR}from"node:fs";import{basename as IR,join as ER,resolve as Qy}from"node:path";function Xo(e){return bR("sha256").update(e).digest("hex")}function RR(e){let t=[["dependencies","required"],["optionalDependencies","optional"],["devDependencies","excluded"],["peerDependencies","required"]],r=new Map;for(let[a,g]of t){let f=e[a];if(!f||typeof f!=="object"||Array.isArray(f))continue;for(let[h,b]of Object.entries(f)){let S=String(b).replace(/^[~^]/,""),y=`${h}@${S}`;if(!r.has(y))r.set(y,{type:"library",name:h,version:S,purl:`pkg:npm/${encodeURIComponent(h)}@${encodeURIComponent(S)}`,scope:g})}}return[...r.values()].sort((a,g)=>`${a.name}@${a.version}`.localeCompare(`${g.name}@${g.version}`))}function vu(e,t={}){let r=ER(Qy(e),"package.json");if(!wR(r))throw Error(`Cannot generate an SBOM: ${r} was not found`);let a=kR(r,"utf8"),g=JSON.parse(a),f=String(g.name??IR(Qy(e))),h=String(g.version??"0.0.0"),b=Xo(a);return{bomFormat:"CycloneDX",specVersion:"1.5",serialNumber:t.serial??`urn:uuid:${crypto.randomUUID()}`,version:1,metadata:{timestamp:(t.now??new Date).toISOString(),component:{type:"application",name:f,version:h,purl:`pkg:npm/${encodeURIComponent(f)}@${encodeURIComponent(h)}`,hashes:[{alg:"SHA-256",content:b}]},tools:[{vendor:"ts-cloud",name:"security-posture",version:"1.0.0"}]},components:RR(g)}}async function Tu(e,t={}){let r=Bun.spawn([t.executable??"syft",e,"-o","cyclonedx-json"],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",SYFT_CHECK_FOR_APP_UPDATE:"false"}}),a=()=>r.kill();t.signal?.addEventListener("abort",a,{once:!0});let[g,f,h]=await Promise.all([r.exited,new Response(r.stdout).text(),new Response(r.stderr).text()]);if(t.signal?.removeEventListener("abort",a),g!==0)throw Error(h.slice(0,2000)||`Syft exited with ${g}`);return JSON.parse(f)}function va(e,t,r){let a=JSON.stringify(r);return e.addReleaseArtifact({...t,kind:"sbom",format:`cyclonedx-${r.specVersion}+json`,digest:`sha256:${Xo(a)}`,summary:{component:r.metadata.component.name,version:r.metadata.component.version,components:r.components.length},content:a,sensitive:!0})}function wu(e,t,r){let a={total:r.length,critical:0,high:0,medium:0,low:0,info:0,fixable:0};for(let f of r){a[f.severity]++;let h=f.evidence;if(typeof h.fixedVersion==="string"&&h.fixedVersion)a.fixable++}let g=JSON.stringify({releaseId:t.releaseId,generatedAt:new Date().toISOString(),findings:r.map((f)=>({id:f.id,ruleId:f.ruleId,severity:f.severity,subject:f.subject,remediation:f.remediation}))});return e.addReleaseArtifact({...t,kind:"vulnerability_summary",format:"ts-cloud-vulnerability-summary+json",digest:`sha256:${Xo(g)}`,summary:a,content:g,sensitive:!0})}function Ru(e){if(!e.artifact&&!e.artifactSha256)throw Error("Release provenance requires artifact content or a SHA-256 digest");return{_type:"https://in-toto.io/Statement/v1",subject:[{name:e.artifactName,digest:{sha256:e.artifactSha256?.replace(/^sha256:/,"")??Xo(e.artifact)}}],predicateType:"https://slsa.dev/provenance/v1",predicate:{buildDefinition:{buildType:"https://ts-cloud.dev/build/v1",externalParameters:e.externalParameters??{},internalParameters:{},resolvedDependencies:e.resolvedDependencies??[]},runDetails:{builder:{id:"https://ts-cloud.dev/builders/local/v1"},metadata:{invocationId:e.invocationId,startedOn:e.startedAt,finishedOn:e.completedAt}}}}}function Du(e,t,r){let a=JSON.stringify(r);return e.addReleaseArtifact({...t,kind:"provenance",format:"in-toto+slsa-v1+json",digest:`sha256:${Xo(a)}`,summary:{subjects:r.subject.length,builder:r.predicate.runDetails.builder.id,buildType:r.predicate.buildDefinition.buildType},content:a,sensitive:!0})}function $S(e){let t=e.expectedSha256.replace(/^sha256:/,"").toLowerCase(),r=Xo(e.artifact)===t;if(!e.signature||!e.publicKey)return{digestValid:r,signature:"not_configured"};try{let a=SR("SHA256");return a.update(e.artifact),a.end(),{digestValid:r,signature:a.verify(e.publicKey,Buffer.from(e.signature,"base64"))?"verified":"invalid"}}catch{return{digestValid:r,signature:"invalid"}}}function pe(e,t){let r=e.environments.get(t);if(!r)throw Error(`Security scope for environment '${t}' was not found`);return{organizationId:e.organization.id,projectId:e.project.id,environmentId:r.id}}function Pu(e,t){let r=new Cn(e.store),a=r.listPolicies(e.organization.id);for(let[g,f]of e.environments){if(a.some((b)=>b.environmentId===f.id))continue;let h=g==="production"||f.kind==="production";a.push(r.createPolicy({organizationId:e.organization.id,environmentId:f.id,name:h?"Production baseline":"Environment baseline",scannerFailMode:h?"closed":"open",requiredScanners:["source-secrets"],rules:h?[{minimumSeverity:"critical",action:"block"},{minimumSeverity:"high",action:"block"},{minimumSeverity:"medium",action:"warn"},{minimumSeverity:"low",action:"record"}]:[{minimumSeverity:"critical",action:"warn"},{minimumSeverity:"high",action:"warn"},{minimumSeverity:"low",action:"record"}],actorId:t}))}return a}function MS(e,t,r,a={}){let g=r.findings.map((f)=>({...t,ruleId:f.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:f.pattern.severity,title:f.pattern.name,description:f.pattern.description,subject:`${f.file}:${f.line}`,evidence:{file:f.file,line:f.line,column:f.column,match:f.match,context:f.context},remediation:"Remove and rotate the credential, then reference it through a managed secret or environment variable."}));return e.recordScan({...t,scannerId:"source-secrets",scannerVersion:a.scannerVersion??"1.0.0",status:a.skipped?"skipped":r.passed?"passed":"failed",findings:a.skipped?[]:g,metadata:{scannedFiles:r.scannedFiles,durationMs:r.duration,summary:r.summary},durationMs:r.duration,error:a.skipped?"The operator explicitly skipped source-secret scanning.":void 0})}function FS(e,t,r="The operator explicitly skipped source-secret scanning."){return e.recordScan({...t,scannerId:"source-secrets",scannerVersion:"1.0.0",status:"skipped",findings:[],error:r})}function AR(e,t){let r=[],a=t.security;if(a?.firewall&&!["active","configured","ok"].includes(String(a.firewall.status)))r.push({...e,ruleId:"host-firewall-disabled",severity:"high",title:"Host firewall is not active",description:String(a.firewall.summary??"The host firewall did not report an active configuration."),subject:"host:firewall",evidence:{status:String(a.firewall.status??"unknown"),rules:Array.isArray(a.firewall.rules)?a.firewall.rules.length:0},remediation:"Apply the declarative firewall policy and confirm only required listeners are public."});for(let g of a?.ports??[]){let f=String(g.listen??""),h=Number(f.match(/:(\d+)$/)?.[1]);if(g.exposure==="public"&&Number.isFinite(h)&&![22,80,443].includes(h))r.push({...e,ruleId:"unexpected-public-listener",severity:"medium",title:`Unexpected public listener on port ${h}`,description:`${String(g.processName??"A process")} is listening publicly outside the standard SSH/HTTP/HTTPS ports.`,subject:`host:port:${h}`,evidence:{protocol:String(g.proto??""),listen:f,process:String(g.processName??"")},remediation:"Bind the service to loopback/private networking or explicitly document and firewall the required public port."})}for(let g of a?.tlsCertificates??[]){let f=Number(g.daysRemaining);if(Number.isFinite(f)&&f<30)r.push({...e,ruleId:"tls-certificate-expiry",severity:f<14?"high":"medium",title:`TLS certificate expires in ${f} days`,description:`${String(g.domain??"A configured domain")} needs renewal.`,subject:`tls:${String(g.domain??"unknown")}`,evidence:{domain:String(g.domain??""),daysRemaining:f,expires:String(g.expires??"")},remediation:"Renew the certificate and verify automatic renewal can complete before expiry."})}for(let g of t.diagnostics??[]){if(g.status==="pass"||g.status==="ok")continue;r.push({...e,ruleId:`diagnostic-${String(g.name??"unknown").toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:g.status==="fail"?"high":"medium",title:String(g.name??"Host security check"),description:String(g.detail??"The host security diagnostic did not pass."),subject:`diagnostic:${String(g.name??"unknown")}`,evidence:{status:String(g.status??"unknown")},remediation:"Follow the diagnostic guidance, rerun the check, and confirm the finding resolves."})}return r}function fs(e,t,r){let a=!!r.security||Array.isArray(r.diagnostics),g=a?AR(t,r):[];return e.recordScan({...t,scannerId:"host-posture",scannerVersion:"1.0.0",status:!a?"unavailable":g.length?"failed":"passed",findings:g,metadata:{source:"dashboard-live-probe",checks:Array.isArray(r.diagnostics)?r.diagnostics.length:0},error:a?void 0:"Live host posture data was unavailable; source and provider checks remain usable."})}function hs(e,t){let r=e.evaluateGate({...t.scope,operationId:t.operationId}),a=e.listFindings({...t.scope,limit:1000}).filter((g)=>g.status!=="resolved");return{decision:r,summary:{desiredConfigHash:t.desiredConfigHash??null,securityImpact:{critical:a.filter((g)=>g.severity==="critical").length,high:a.filter((g)=>g.severity==="high").length,waived:a.filter((g)=>g.status==="waived").length,assigned:a.filter((g)=>!!g.ownerActorId).length},blockingFindingIds:r.findingIds,policy:{id:r.policyId,version:r.policyVersion},scannerVersions:r.scannerVersions}}}async function US(e,t){let r=t.scanner??new Ea({timeoutMs:t.scannerTimeoutMs}),g=await new Lt(e,{defaultTimeoutMs:t.scannerTimeoutMs??120000}).run(r,{...t.scope,releaseId:t.releaseId,imageRef:t.imageRef}),f={...t.scope,releaseId:t.releaseId};wu(e,f,g.findings);let h=t.generateImageSbom??Tu,b=new AbortController,S=Math.max(100,t.sbomTimeoutMs??120000),y,k=new Promise((O,M)=>{y=setTimeout(()=>{b.abort(),M(Error(`syft-sbom exceeded its ${S}ms timeout`))},S)}),R="unavailable";try{let O=await Promise.race([h(t.imageRef,{signal:b.signal}),k]);va(e,f,O),e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"passed",metadata:{imageRef:t.imageRef,format:`cyclonedx-${O.specVersion}+json`,components:O.components.length,localOnly:!0}}),R="image"}catch(O){let M=O instanceof Error?O.message:String(O);try{let z=vu(t.artifactRoot);va(e,f,z),e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unsupported",error:`Image inventory was unavailable; attached a package-manifest SBOM instead. ${M}`,metadata:{imageRef:t.imageRef,fallback:"package-manifest",components:z.components.length,localOnly:!0}}),R="manifest"}catch(z){e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unavailable",error:`Image and manifest SBOM generation were unavailable. ${M}; ${z instanceof Error?z.message:String(z)}`,metadata:{imageRef:t.imageRef,localOnly:!0}})}}finally{if(y)clearTimeout(y)}let D=Ru({artifactName:t.imageRef,artifact:t.imageSha256?void 0:t.imageRef,artifactSha256:t.imageSha256,invocationId:t.invocationId,startedAt:t.startedAt,completedAt:t.completedAt??new Date().toISOString(),externalParameters:t.externalParameters??{imageRef:t.imageRef}});return Du(e,f,D),{scan:g,sbomSource:R}}function ve(e,t,r){return[e,t,r].map((a)=>encodeURIComponent(a)).join(":")}function th(e){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((t)=>[t,{supported:!1,reason:e}]))}function $t(e,t,r=["exec","files"]){let a=th(t);for(let g of e)a[g]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(g),requiresRecentAuth:r.includes(g)};return a}var CR=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function Le(e){let t=String(e??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(t))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(t))return"starting";if(["deactivating","stopping","draining","terminating"].includes(t))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(t))return"stopped";if(["degraded","unhealthy","warning"].includes(t))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(t))return"failed";return"unknown"}function $e(e){if(Array.isArray(e))return e.map((r)=>$e(r));if(!e||typeof e!=="object")return e;let t={};for(let[r,a]of Object.entries(e))t[r]=CR.test(r)?"[REDACTED]":$e(a);return t}function Mt(e,t=new Date){if(!e)return;let r=new Date(e).getTime();return Number.isFinite(r)?Math.max(0,Math.floor((t.getTime()-r)/1000)):void 0}function ku(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:void 0}function PR(e){let t=String(e?.message??e);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(t))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(t))return"unreachable";return"error"}async function Nu(e,t={},r={}){let a=t.now??new Date,g=Math.max(100,r.timeoutMs??1e4),f=Math.max(1,r.staleAfterSeconds??60),h=await Promise.all(e.map(async(S)=>{try{let y=await Promise.race([S.discover({...t,now:a}),new Promise((k,R)=>setTimeout(()=>R(Error(`Runtime source ${S.id} timed out after ${g}ms`)),g))]);return{workloads:y,source:{id:S.id,provider:S.provider,status:"fresh",discoveredAt:a.toISOString(),staleAfterSeconds:f,itemCount:y.length}}}catch(y){return{workloads:[],source:{id:S.id,provider:S.provider,status:PR(y),discoveredAt:a.toISOString(),staleAfterSeconds:f,itemCount:0,message:String(y?.message??y).slice(0,500)}}}})),b=h.map((S)=>S.source);return{generatedAt:a.toISOString(),workloads:h.flatMap((S)=>S.workloads).sort((S,y)=>S.name.localeCompare(y.name)||S.id.localeCompare(y.id)),sources:b,degraded:b.some((S)=>S.status!=="fresh")}}function es(e){return e?.split("/").at(-1)??e?.split(":").at(-1)??"unknown"}function Bu(e,t,r,a="ecs:aws",g=[]){let f=r.now??new Date;return e.map((h)=>{let b=h.serviceName??es(h.serviceArn),S=t.filter((Z)=>!h.clusterArn||Z.clusterArn===h.clusterArn),y=S.some((Z)=>!!Z.group)?S.filter((Z)=>Z.group===`service:${b}`):S,k=h.status==="ACTIVE"?(h.runningCount??0)<(h.desiredCount??0)?"degraded":"running":Le(h.status),R=g.find((Z)=>Z.taskDefinitionArn===h.taskDefinition),D=Array.isArray(R?.containerDefinitions)?R.containerDefinitions:[],O=[...new Set(D.map((Z)=>Z.logConfiguration?.options?.["awslogs-group"]).filter((Z)=>typeof Z==="string"))],M=D.flatMap((Z)=>(Z.mountPoints??[]).map((oe)=>({source:oe.sourceVolume,target:oe.containerPath,type:"volume",readOnly:!!oe.readOnly}))),z=D.flatMap((Z)=>(Z.portMappings??[]).map((oe,G)=>({id:`${Z.name??"container"}:${G}`,name:Z.name,mode:R?.networkMode,ports:[{container:oe.containerPort,host:oe.hostPort,protocol:oe.protocol}]}))),J=r.project&&r.environment&&b.startsWith(`${r.project}-${r.environment}-`)?b.slice(`${r.project}-${r.environment}-`.length):b;return{id:ve("ecs",a,h.serviceArn??b),provider:"ecs",kind:"service",name:b,status:k,rawStatus:h.status,health:k==="running"?"healthy":k==="failed"||k==="degraded"?"unhealthy":"unknown",desiredReplicas:h.desiredCount,runningReplicas:h.runningCount,image:D[0]?.image,runtime:h.launchType??"ECS",version:es(h.taskDefinition),ageSeconds:Mt(h.deployments?.[0]?.createdAt,f),restartCount:0,tags:{},links:{project:r.project,environment:r.environment,service:J,release:es(h.taskDefinition),providerId:h.serviceArn},replicas:y.map((Z)=>{let oe=Le(Z.lastStatus);return{id:ve("ecs",a,Z.taskArn??es(Z.taskArn)),name:es(Z.taskArn),status:oe,rawStatus:Z.lastStatus,createdAt:Z.createdAt,startedAt:Z.startedAt,stoppedAt:Z.stoppedAt,host:Z.containerInstanceArn,containers:(Z.containers??[]).map((G)=>({id:G.containerArn??G.name??"container",name:G.name??"container",image:D.find((te)=>te.name===G.name)?.image,imageDigest:G.imageDigest,status:Le(G.lastStatus),rawStatus:G.lastStatus,exitCode:G.exitCode,reason:G.reason,runtime:"ecs"}))}}),networks:z,mounts:M,capabilities:$t(["start","stop","restart","redeploy","scale","inspect",...O.length?["logs"]:[]],"This ECS runtime does not expose exec or file transfer; logs require an awslogs task-definition driver"),config:$e({clusterArn:h.clusterArn,taskDefinition:h.taskDefinition,launchType:h.launchType,pendingCount:h.pendingCount,deployments:h.deployments,logGroups:O,executionRoleArn:R?.executionRoleArn,taskRoleArn:R?.taskRoleArn,cpu:R?.cpu,memory:R?.memory}),discoveredAt:f.toISOString(),sourceId:a}})}function xu(e,t,r="lambda:aws"){let a=t.now??new Date;return e.map((g)=>{let f=g.FunctionName??es(g.FunctionArn),h=g.State==="Active"?"running":Le(g.State);return{id:ve("lambda",r,g.FunctionArn??f),provider:"lambda",kind:"function",name:f,status:h,rawStatus:g.State,health:h==="running"?"healthy":h==="failed"?"unhealthy":"unknown",desiredReplicas:void 0,runningReplicas:void 0,image:void 0,runtime:g.Runtime,version:g.Version,architecture:g.Architectures?.join(", "),ageSeconds:Mt(g.LastModified,a),restartCount:0,tags:{},links:{project:t.project,environment:t.environment,service:f,providerId:g.FunctionArn},resources:{memoryLimitBytes:g.MemorySize==null?void 0:g.MemorySize*1024*1024},replicas:[],networks:[],mounts:[],capabilities:$t(["logs","inspect"],"Lambda has no persistent process to start, stop, restart, exec, or browse files; deploy a release to replace code"),config:$e({handler:g.Handler,timeout:g.Timeout,codeSize:g.CodeSize,stateReason:g.StateReason,environmentKeys:Object.keys(g.Environment?.Variables??{})}),discoveredAt:a.toISOString(),sourceId:r}})}function rh(e){let t=e.trim();if(!t)return[];let r=JSON.parse(t);if(!Array.isArray(r))throw Error("Docker inspect output must be an array");return r.filter((a)=>a&&typeof a.Id==="string")}function _R(e){let t=Object.entries(e.NetworkSettings?.Ports??{}).flatMap(([r,a])=>{let[g,f]=r.split("/");return(a??[]).map((h)=>({container:Number(g)||void 0,host:Number(h.HostPort)||void 0,protocol:f,address:h.HostIp}))});return Object.entries(e.NetworkSettings?.Networks??{}).map(([r,a])=>({id:a.NetworkID||r,name:r,mode:e.HostConfig?.NetworkMode,addresses:[a.IPAddress,a.GlobalIPv6Address].filter(Boolean),ports:t}))}function TR(e){return(e.Mounts??[]).filter((t)=>!!t.Destination).map((t)=>({source:t.Source,target:t.Destination,type:t.Type,readOnly:t.RW===!1}))}function nh(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((g)=>{let f=g.State?.OOMKilled?"oomkilled":g.State?.Restarting?"starting":g.State?.Status,h=Le(f),b=(g.Name??g.Id.slice(0,12)).replace(/^\//,""),S=g.Config?.Labels??{},y=TR(g),k=_R(g),R={id:g.Id,name:b,image:g.Config?.Image,imageDigest:g.Image,runtime:"docker",status:h,rawStatus:f,exitCode:g.State?.ExitCode,reason:g.State?.Error,resources:{memoryLimitBytes:g.HostConfig?.Memory||void 0},networks:k,mounts:y};return{id:ve("docker",r,g.Id),provider:"docker",kind:"container",name:b,status:h,rawStatus:f,health:h==="running"?"healthy":h==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:h==="running"?1:0,image:g.Config?.Image,runtime:"docker",ageSeconds:Mt(g.State?.StartedAt,a),restartCount:g.RestartCount??0,tags:S,links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^docker:/,""),service:S["com.docker.compose.service"]??S["ts-cloud.service"]??b,release:S["ts-cloud.release"],providerId:g.Id},resources:R.resources,replicas:[{id:ve("docker",r,`${g.Id}:0`),name:b,status:h,rawStatus:f,startedAt:g.State?.StartedAt,stoppedAt:g.State?.FinishedAt,restartCount:g.RestartCount,containers:[R],resources:R.resources}],networks:k,mounts:y,capabilities:$t(["start","stop","restart","logs","exec","inspect","files"],"Use the owning Compose service for redeploy and scale"),config:$e({image:g.Config?.Image,labels:S,environmentKeys:(g.Config?.Env??[]).map((D)=>D.split("=",1)[0]),networkMode:g.HostConfig?.NetworkMode}),discoveredAt:a.toISOString(),sourceId:r}})}class Ta{inspect;id;provider="docker";constructor(e,t="docker:local"){this.inspect=e;this.id=t}async discover(e){return nh(rh(await this.inspect(e)),e,this.id)}}function ih(e){let t=[];for(let r of e.split(`
+`)){if(!r.startsWith("TSCLOUD_SYSTEMD\t"))continue;let[,a,g,f,h,b,S,y,k,R,D,O,M,z]=r.split("\t");if(!a||!/^[A-Za-z0-9_.@:-]+\.service$/.test(a))continue;t.push({unit:a,load:g,active:f,sub:h,description:b,enabled:S,pid:Number(y)||void 0,memoryBytes:ku(k),restartCount:Number(R)||0,activeSince:D||void 0,fragmentPath:O||void 0,workingDirectory:M?.startsWith("/")?M:void 0,user:z||void 0})}return t}function sh(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((g)=>{let f=Le(g.active==="active"?g.sub||g.active:g.active),h=g.unit.replace(/\.service$/,""),b=/^(.*?) (?:release [^ ]+|queue worker|daemon |scheduler)(?: |$)/.exec(g.description??"")?.[1]??(t.project&&h.startsWith(`${t.project}-`)?h.slice(t.project.length+1).split("@",1)[0]:void 0),S=h.includes("@")?h.slice(h.indexOf("@")+1):void 0,y=g.workingDirectory?[{target:g.workingDirectory,type:"working-directory"}]:[],k=["start","stop","restart","logs","exec","inspect",...y.length?["files"]:[]];return{id:ve("systemd",r,g.unit),provider:"systemd",kind:"service",name:h,displayName:g.description||h,status:f,rawStatus:[g.load,g.active,g.sub].filter(Boolean).join("/"),health:f==="running"?"healthy":f==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:f==="running"?1:0,ageSeconds:Mt(g.activeSince,a),restartCount:g.restartCount,tags:{enabled:g.enabled??"unknown"},links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^systemd:/,""),service:b,release:S,providerId:g.unit},resources:{memoryBytes:g.memoryBytes},replicas:[{id:ve("systemd",r,`${g.unit}:main`),name:"main",status:f,pid:g.pid,startedAt:g.activeSince,restartCount:g.restartCount,resources:{memoryBytes:g.memoryBytes}}],networks:[],mounts:y,capabilities:$t(k,y.length?"This systemd runtime does not support redeploy or replica scaling through the scoped explorer":"File transfer requires a provider-reported service working directory; redeploy and scaling are unavailable"),config:$e({fragmentPath:g.fragmentPath,workingDirectory:g.workingDirectory,user:g.user,environment:g.environment,enabled:g.enabled}),discoveredAt:a.toISOString(),sourceId:r}})}class wa{read;id;provider="systemd";constructor(e,t="systemd:local"){this.read=e;this.id=t}async discover(e){return sh(ih(await this.read(e)),e,this.id)}}function xR(e,t){if(!e.success)throw Error(e.error||e.perInstance?.[0]?.error||`${t} discovery failed`);return e.perInstance?.[0]?.output??""}function DR(){return["set -uo pipefail",'command -v systemctl >/dev/null 2>&1 || { echo "systemctl is unavailable" >&2; exit 127; }',"systemctl list-units --type=service --all --plain --no-legend 2>/dev/null | awk '{print $1}' | while IFS= read -r unit; do",'  [ -n "$unit" ] || continue','  clean() { printf "%s" "$1" | tr "\\t\\r\\n" "   "; }','  load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null || true)','  active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null || true)','  sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null || true)','  description=$(systemctl show "$unit" -p Description --value 2>/dev/null || true)','  enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)','  pid=$(systemctl show "$unit" -p MainPID --value 2>/dev/null || true)','  memory=$(systemctl show "$unit" -p MemoryCurrent --value 2>/dev/null || true)','  restarts=$(systemctl show "$unit" -p NRestarts --value 2>/dev/null || true)','  since=$(systemctl show "$unit" -p ActiveEnterTimestamp --value 2>/dev/null || true)','  fragment=$(systemctl show "$unit" -p FragmentPath --value 2>/dev/null || true)','  working=$(systemctl show "$unit" -p WorkingDirectory --value 2>/dev/null || true)','  user=$(systemctl show "$unit" -p User --value 2>/dev/null || true)','  printf "TSCLOUD_SYSTEMD\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n" "$(clean "$unit")" "$(clean "$load")" "$(clean "$active")" "$(clean "$sub")" "$(clean "$description")" "$(clean "$enabled")" "$(clean "$pid")" "$(clean "$memory")" "$(clean "$restarts")" "$(clean "$since")" "$(clean "$fragment")" "$(clean "$working")" "$(clean "$user")"',"done"]}function OR(){return["set -uo pipefail",'if ! command -v docker >/dev/null 2>&1; then echo "[]"; exit 0; fi',"ids=$(docker ps -aq)",'if [ -z "$ids" ]; then echo "[]"; else docker inspect $ids; fi']}function Yy(e,t,r,a,g){let f=`${e}:${r.id}`,h=async()=>xR(await t.runRemoteDeploy({targets:[r],commands:e==="systemd"?DR():OR(),timeoutSeconds:30,comment:`ts-cloud runtime discovery:${e}`,tags:{Project:a.project.slug,Environment:g,Role:"app"}}),f);return e==="systemd"?new wa(h,f):new Ta(h,f)}async function bd(e,t=100){let r=[],a;for(let g=0;g<t;g++){let f=await e(a);if(r.push(...f.items),!f.nextToken)return r;a=f.nextToken}throw Error(`Provider pagination exceeded ${t} pages`)}class Ou{client;prefix;id="ecs:aws";provider="ecs";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=await bd(async(f)=>{let h=await this.client.listClusters({nextToken:f,maxResults:100});return{items:h.clusterArns??[],nextToken:h.nextToken}}),r=[],a=[],g=[];for(let f of t){let h=(await bd(async(b)=>{let S=await this.client.listServices(f,{nextToken:b,maxResults:100});return{items:S.serviceArns??[],nextToken:S.nextToken}})).filter((b)=>b.split("/").at(-1)?.startsWith(this.prefix));for(let b=0;b<h.length;b+=10){let S=await this.client.describeServices({cluster:f,services:h.slice(b,b+10)});r.push(...S.services??[])}for(let b of r.filter((S)=>S.clusterArn===f||!S.clusterArn)){let S=await bd(async(y)=>{let k=await this.client.listTasks(f,b.serviceName,{nextToken:y,maxResults:100});return{items:k.taskArns??[],nextToken:k.nextToken}});for(let y=0;y<S.length;y+=100){let k=await this.client.describeTasks(f,S.slice(y,y+100));a.push(...k.tasks??[])}}}if(this.client.describeTaskDefinition)for(let f of[...new Set(r.map((h)=>h.taskDefinition).filter((h)=>!!h))]){let h=await this.client.describeTaskDefinition(f);if(h.taskDefinition)g.push(h.taskDefinition)}return Bu(r,a,e,this.id,g)}}class _u{client;prefix;id="lambda:aws";provider="lambda";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=(await bd(async(r)=>{let a=await this.client.listFunctions({Marker:r,MaxItems:50});return{items:a.Functions??[],nextToken:a.NextMarker}})).filter((r)=>r.FunctionName?.startsWith(this.prefix));return xu(t,e,this.id)}}async function oh(e,t,r={}){let a=[],g=K(e),f=de(e),h=e.aws?.profile,b=e.aws?.region??e.project.region??"us-east-1",S=`${e.project.slug}-${t}`;if(g!=="serverless"){let y=r.driver??F({config:e}),k=await y.findComputeTargets({slug:e.project.slug,environment:t,role:"app"});for(let R of k)a.push(Yy("systemd",y,R,e,t)),a.push(Yy("docker",y,R,e,t))}if(f==="aws")a.push(new Ou(r.ecs??new ut(b,h),S)),a.push(new _u(r.lambda??new T(b,h),S));return a}async function me(e,t,r={}){let a={project:e.project.slug,environment:t};try{return await Nu(await oh(e,t,r),a)}catch(g){return{generatedAt:new Date().toISOString(),workloads:[],sources:[{id:"runtime:bootstrap",provider:de(e)==="aws"?"ecs":"systemd",status:"error",discoveredAt:new Date().toISOString(),staleAfterSeconds:60,itemCount:0,message:String(g?.message??g).slice(0,500)}],degraded:!0}}}var Zy=65536,ia=49152,kd=/^[A-Za-z0-9_.@:-]+\.service$/,Id=/^[a-fA-F0-9]{12,128}$/,$R=["/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run"];function ts(e){let t=Buffer.from(e);return t.byteLength<=Zy?e:`${t.subarray(0,Zy-24).toString("utf8")}
+[output truncated]`}function Sd(e){return{success:!1,instanceCount:0,perInstance:[],error:e instanceof Error?e.message:String(e)}}function jn(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function NR(e,t){return Number.isFinite(e)?Math.min(1e4,Math.max(0,Math.floor(e))):t}function jR(e){let t=e.config,r=typeof t.clusterArn==="string"?t.clusterArn:void 0,a=e.links.providerId||e.name;return r&&a?{cluster:r,service:a}:void 0}function BR(e,t){return e.find((r)=>r.id===t.links.server)??(e.length===1?e[0]:void 0)}function MR(e,t){if(e.provider==="systemd"){let r=e.links.providerId;if(!r||!kd.test(r)||!["start","stop","restart"].includes(t))return;return[`systemctl ${t} ${r}`,`systemctl is-active ${r} 2>/dev/null || true`]}if(e.provider==="docker"){let r=e.links.providerId;if(!r||!Id.test(r)||!["start","stop","restart"].includes(t))return;return[`docker ${t} ${r}`,`docker inspect --format '{{.State.Status}}' ${r}`]}return}function ah(e,t){if(!t.startsWith("/")||t.includes("\x00"))return{ok:!1,error:"An absolute path is required."};let r=[];for(let b of t.split("/")){if(!b||b===".")continue;if(b===".."){if(!r.length)return{ok:!1,error:"Path traversal is not allowed."};r.pop()}else r.push(b)}let a=`/${r.join("/")}`;if($R.some((b)=>a===b||a.startsWith(`${b}/`)))return{ok:!1,error:"Sensitive host paths are not available through runtime file access."};let g=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),f=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");if(![...g&&f?[`/var/www/${g}/${f}`,`/srv/${g}/${f}`]:[],...e.mounts.map((b)=>b.target).filter((b)=>b.startsWith("/"))].some((b)=>a===b||a.startsWith(`${b.replace(/\/$/,"")}/`)))return{ok:!1,error:"Path is outside this service’s owned roots."};return{ok:!0,path:a}}function LR(e,t){let r=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),a=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");return[...r&&a?[`/var/www/${r}/${a}`,`/srv/${r}/${a}`]:[],...e.mounts.map((g)=>g.target).filter((g)=>g.startsWith("/"))].sort((g,f)=>f.length-g.length).find((g)=>t===g||t.startsWith(`${g.replace(/\/$/,"")}/`))}var Lu={process:["ps","-eo","pid,ppid,user,%cpu,%mem,etime,command","--sort=-%cpu"],sockets:["ss","-lntup"],filesystem:["df","-h"]};class Te{config;environment;dependencies;region;profile;constructor(e,t,r={}){this.config=e;this.environment=t;this.dependencies=r;this.region=e.aws?.region??e.project.region??"us-east-1",this.profile=e.aws?.profile}async inventory(){return this.dependencies.inventory?.()??me(this.config,this.environment,{driver:this.dependencies.driver})}async workload(e){return(await this.inventory()).workloads.find((t)=>t.id===e)}async remote(e,t,r,a){let g=this.dependencies.driver??F({config:this.config}),f=await g.findComputeTargets({slug:this.config.project.slug,environment:this.environment,role:"app"}),h=BR(f,e);if(!h)throw Error("The workload server is no longer reachable in this scope.");return g.runRemoteDeploy({targets:[h],commands:t,timeoutSeconds:r,comment:a,tags:{Project:this.config.project.slug,Environment:this.environment,Role:"app"}})}async run(e){let t=await this.workload(e.workloadId),r={workloadId:e.workloadId,action:e.action};if(!t)return{...r,ok:!1,error:"Workload was not found in the current project and environment."};let a=t.capabilities[e.action];if(!a.supported)return{...r,ok:!1,error:a.reason??`${e.action} is unsupported for ${t.provider}.`};if(a.requiresConfirmation&&e.confirm!==t.name)return{...r,ok:!1,error:`Type "${t.name}" to ${e.action} this workload.`};if(a.requiresRecentAuth&&!e.recentAuth)return{...r,ok:!1,error:"Sign in again before using elevated runtime access."};if(e.action==="inspect")return{...r,ok:!0,workload:t};if(t.provider==="systemd"||t.provider==="docker"){let g=MR(t,e.action);if(!g)return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`};let f=await this.remote(t,["set -uo pipefail",...g],60,`ts-cloud runtime:${e.action}`).catch(Sd);return{...r,ok:f.success,command:g[0],stdout:ts(f.perInstance?.[0]?.output??""),stderr:ts(f.perInstance?.[0]?.error??f.error??""),error:f.success?void 0:f.error??"Runtime operation failed."}}if(t.provider==="ecs"){let g=jR(t);if(!g)return{...r,ok:!1,error:"ECS cluster or service identity is unavailable."};let f=this.dependencies.ecs??new ut(this.region,this.profile);if(e.action==="scale"){let h=NR(e.replicas,t.desiredReplicas??1);return await f.scaleService(g.cluster,g.service,h),{...r,ok:!0,command:`ecs scale ${t.name} ${h}`}}if(e.action==="start"||e.action==="stop"){let h=e.action==="stop"?0:Math.max(1,t.desiredReplicas??1);return await f.scaleService(g.cluster,g.service,h),{...r,ok:!0,command:`ecs scale ${t.name} ${h}`}}if(e.action==="restart"||e.action==="redeploy")return await f.forceNewDeployment(g.cluster,g.service),{...r,ok:!0,command:`ecs redeploy ${t.name}`}}return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`}}async exec(e){let t={workloadId:e.workloadId,preset:e.preset},r=await this.workload(e.workloadId);if(!r)return{...t,ok:!1,error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_EXEC==="0")return{...t,ok:!1,error:"Runtime exec is disabled by TS_CLOUD_RUNTIME_EXEC."};if(!r.capabilities.exec.supported)return{...t,ok:!1,error:r.capabilities.exec.reason??"Exec is unsupported for this workload."};if(e.confirm!==r.name)return{...t,ok:!1,error:`Type "${r.name}" to open exec access.`};if(!e.recentAuth)return{...t,ok:!1,error:"Sign in again before using elevated runtime access."};let a=e.preset&&Lu[e.preset];if(!a&&!e.command?.trim())return{...t,ok:!1,error:"Choose a diagnostic preset or provide a command."};if(e.command&&r.provider!=="docker")return{...t,ok:!1,error:"Free-form exec is restricted to isolated containers; use a diagnostic preset for system services."};let g=r.links.providerId??"",f;if(r.provider==="docker"&&Id.test(g)){let b=e.command?.trim()||a.map(jn).join(" ");f=`docker exec ${g} sh -lc ${jn(b)}`}else if(r.provider==="systemd"&&kd.test(g)&&e.preset)f=e.preset==="process"?`systemctl status ${g} --no-pager --full`:Lu[e.preset].map(jn).join(" ");if(!f)return{...t,ok:!1,error:"Exec target identity is invalid or unsupported."};let h=await this.remote(r,["set -uo pipefail",f],60,"ts-cloud runtime:exec").catch(Sd);return{...t,ok:h.success,command:f,stdout:ts(h.perInstance?.[0]?.output??""),stderr:ts(h.perInstance?.[0]?.error??h.error??""),error:h.success?void 0:h.error??"Exec command failed."}}async readFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};let{workload:a,path:g,root:f,providerId:h}=r,S=`sh -c ${jn('resolved=$(realpath -m "$1"); root=$(realpath -m "$3"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; test -f "$resolved"; size=$(wc -c < "$resolved"); printf "__TSCLOUD_SIZE__=%s\\n" "$size"; head -c "$2" "$resolved" | base64')} sh ${jn(g)} ${ia} ${jn(f)}`,y=a.provider==="docker"?`docker exec ${h} ${S}`:S,k=await this.remote(a,[y],30,"ts-cloud runtime:file-read").catch(Sd);if(!k.success)return{...t,ok:!1,error:k.error??k.perInstance?.[0]?.error??"File read failed."};let R=k.perInstance?.[0]?.output??"",D=/__TSCLOUD_SIZE__=(\d+)\r?\n/.exec(R);if(!D)return{...t,ok:!1,error:"The remote file response was invalid."};let O=Number(D[1]),M=R.slice((D.index??0)+D[0].length).replace(/\s+/g,"");if(Buffer.from(M,"base64").byteLength>ia)return{...t,ok:!1,error:"The remote file exceeded the transfer limit."};return{...t,ok:!0,contentBase64:M,size:O,truncated:O>ia}}async writeFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};if(!/^[A-Za-z0-9+/]*={0,2}$/.test(e.contentBase64))return{...t,ok:!1,error:"File content must be valid base64."};let a=Buffer.from(e.contentBase64,"base64");if(a.toString("base64")!==e.contentBase64)return{...t,ok:!1,error:"File content must be canonical base64."};if(a.byteLength>ia)return{...t,ok:!1,error:`File uploads are limited to ${ia} bytes.`};let{workload:g,path:f,root:h,providerId:b}=r,y=`sh -c ${jn('resolved=$(realpath -m "$1"); root=$(realpath -m "$2"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; mkdir -p "$(dirname "$resolved")"; tmp="$resolved.ts-cloud-$$"; base64 -d > "$tmp"; chmod 600 "$tmp"; mv "$tmp" "$resolved"')} sh ${jn(f)} ${jn(h)}`,k=g.provider==="docker"?`printf %s ${jn(e.contentBase64)} | docker exec -i ${b} ${y}`:`printf %s ${jn(e.contentBase64)} | ${y}`,R=await this.remote(g,[k],30,"ts-cloud runtime:file-write").catch(Sd);return{...t,ok:R.success,size:a.byteLength,truncated:!1,error:R.success?void 0:R.error??R.perInstance?.[0]?.error??"File write failed."}}async fileTarget(e){let t=await this.workload(e.workloadId);if(!t)return{error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_FILE_ACCESS==="0")return{error:"Runtime file access is disabled by TS_CLOUD_RUNTIME_FILE_ACCESS."};if(!t.capabilities.files.supported)return{error:t.capabilities.files.reason??"File access is unsupported for this workload."};if(e.confirm!==t.name)return{error:`Type "${t.name}" to access workload files.`};if(!e.recentAuth)return{error:"Sign in again before using elevated runtime access."};let r=ah(t,e.path);if(!r.ok)return{error:r.error};let a=LR(t,r.path),g=t.links.providerId??"";if(!a||t.provider==="systemd"&&!kd.test(g)||t.provider==="docker"&&!Id.test(g))return{error:"File target identity is invalid or unsupported."};return{workload:t,path:r.path,root:a,providerId:g}}async logs(e,t={}){let r=await this.workload(e);if(!r)throw Error("Workload was not found in the current project and environment.");if(!r.capabilities.logs.supported)throw Error(r.capabilities.logs.reason??"Logs are unsupported for this workload.");let a=Math.min(1000,Math.max(1,Math.floor(t.limit??200)));if(r.provider==="lambda"||r.provider==="ecs"){let k=this.dependencies.logs??new Re(this.region,this.profile),R=r.config.logGroups,D=r.provider==="lambda"?`/aws/lambda/${r.name}`:Array.isArray(R)&&typeof R[0]==="string"?R[0]:void 0;if(!D)throw Error("The ECS task definition does not declare an awslogs group.");let O=await k.filterLogEvents({logGroupName:D,startTime:t.since?.getTime(),limit:a}),M=(O.events??[]).slice(0,a).map((z)=>({timestamp:z.timestamp==null?void 0:new Date(z.timestamp).toISOString(),message:ts(String(z.message??""))}));return{workloadId:e,provider:r.provider,lines:M,nextCursor:O.nextToken,truncated:(O.events?.length??0)>=a}}let g=r.links.providerId??"",f=t.since&&Number.isFinite(t.since.getTime())?t.since:void 0,h=r.provider==="systemd"&&kd.test(g)?`journalctl -u ${g} --no-pager -n ${a} -o short-iso${f?` --since ${jn(f.toISOString())}`:""}`:r.provider==="docker"&&Id.test(g)?`docker logs --timestamps --tail ${a}${f?` --since ${Math.floor(f.getTime()/1000)}`:""} ${g} 2>&1`:void 0;if(!h)throw Error("Log target identity is invalid.");let b=await this.remote(r,[h],30,"ts-cloud runtime:logs");if(!b.success)throw Error(b.error??b.perInstance?.[0]?.error??"Log read failed.");let S=ts(b.perInstance?.[0]?.output??""),y=S.split(`
 `).filter(Boolean).slice(-a).map((k)=>{let R=/^(\d{4}-\d{2}-\d{2}T\S+)\s+(.*)$/.exec(k);return{timestamp:R?.[1],message:R?.[2]??k}});return{workloadId:e,provider:r.provider,lines:y,truncated:S.includes("[output truncated]")||y.length>=a}}}import{randomUUID as FR}from"node:crypto";class Ra{records=new Map;maxBufferBytes;ttlMs;now;constructor(e={}){this.maxBufferBytes=Math.max(1024,e.maxBufferBytes??262144),this.ttlMs=Math.max(1000,e.ttlMs??900000),this.now=e.now??(()=>new Date)}create(e,t){this.sweep();let r=this.now().toISOString(),a={id:FR(),workloadId:t,kind:e,state:"open",chunks:[],cursor:0,droppedBytes:0,bufferedBytes:0,createdAt:r,updatedAt:r,abort:new AbortController,listeners:new Set};return this.records.set(a.id,a),this.snapshot(a,0)}signal(e){return this.records.get(e)?.abort.signal}append(e,t,r="stdout"){let a=this.records.get(e);if(!a||a.state!=="open"||!t)return a?this.snapshot(a,a.cursor):void 0;let g=Buffer.from(t),f=g.byteLength>this.maxBufferBytes?g.subarray(g.byteLength-this.maxBufferBytes).toString("utf8"):t,h={cursor:++a.cursor,stream:r,data:f,at:this.now().toISOString()};a.chunks.push(h),a.bufferedBytes+=Buffer.byteLength(f),a.updatedAt=h.at;while(a.bufferedBytes>this.maxBufferBytes&&a.chunks.length>1){let b=a.chunks.shift(),S=Buffer.byteLength(b.data);a.bufferedBytes-=S,a.droppedBytes+=S}return this.publish(a),this.snapshot(a,h.cursor-1)}read(e,t,r=0){let a=this.records.get(e);if(!a||a.workloadId!==t)return;return a.updatedAt=this.now().toISOString(),this.snapshot(a,Math.max(0,Math.floor(r)))}close(e,t="complete",r){let a=this.records.get(e);if(!a||a.state!=="open")return a?this.snapshot(a,a.cursor):void 0;if(a.state=t,a.error=r,a.updatedAt=this.now().toISOString(),t==="cancelled")a.abort.abort();return this.publish(a),this.snapshot(a,a.cursor)}cancel(e,t){let r=this.records.get(e);if(!r||r.workloadId!==t)return;return this.close(e,"cancelled")}subscribe(e,t,r){let a=this.records.get(e);if(!a||a.workloadId!==t)return;return a.listeners.add(r),()=>a.listeners.delete(r)}sweep(){let e=this.now().getTime()-this.ttlMs,t=0;for(let[r,a]of this.records){if(new Date(a.updatedAt).getTime()>e)continue;a.abort.abort(),this.records.delete(r),t++}return t}clear(){for(let e of this.records.values())e.abort.abort();this.records.clear()}snapshot(e,t){let r=e.chunks[0]?.cursor??e.cursor+1,a=t>0&&t<r-1;return{id:e.id,workloadId:e.workloadId,kind:e.kind,state:e.state,chunks:e.chunks.filter((g)=>a||g.cursor>t),cursor:e.cursor,reset:a,droppedBytes:e.droppedBytes,createdAt:e.createdAt,updatedAt:e.updatedAt,error:e.error}}publish(e){let t=this.snapshot(e,0);for(let r of e.listeners)r(t)}}var zR={every_minute:"* * * * *",every_five_minutes:"*/5 * * * *",hourly:"0 * * * *",daily:"0 0 * * *",weekly:"0 0 * * 0"},UR={JAN:1,FEB:2,MAR:3,APR:4,MAY:5,JUN:6,JUL:7,AUG:8,SEP:9,OCT:10,NOV:11,DEC:12},Xy={SUN:0,MON:1,TUE:2,WED:3,THU:4,FRI:5,SAT:6};function ev(e){try{return new Intl.DateTimeFormat("en",{timeZone:e}).format(new Date),e}catch{throw Error(`Unknown schedule timezone: ${e}`)}}function Ed(e,t,r,a){let g=t[e.toUpperCase()]??Number(e);if(!Number.isInteger(g)||g<r||g>a)throw Error(`Schedule field value ${e} is outside ${r}-${a}.`);return g}function rs(e,t,r,a={},g){if(e==="*"||e==="?")return;let f=new Set;for(let h of e.split(",")){let[b,S]=h.split("/"),y=S?Ed(S,{},1,r-t+1):1,k,R;if(b==="*")k=t,R=r;else if(b.includes("-")){let D=b.split("-");k=Ed(D[0],a,t,r),R=Ed(D[1],a,t,r)}else k=Ed(b,a,t,r),R=k;if(R<k)throw Error("Schedule ranges must be ascending.");for(let D=k;D<=R;D+=y)f.add(g?g(D):D===7&&r===7?0:D)}return f}function qR(e,t){let r=Object.fromEntries(new Intl.DateTimeFormat("en-US",{timeZone:t,year:"numeric",month:"numeric",day:"numeric",weekday:"short",hour:"numeric",minute:"numeric",hourCycle:"h23"}).formatToParts(e).map((a)=>[a.type,a.value]));return{minute:Number(r.minute),hour:Number(r.hour),day:Number(r.day),month:Number(r.month),weekday:Xy[r.weekday.toUpperCase()],year:Number(r.year),key:`${r.year}-${r.month}-${r.day} ${r.hour}:${r.minute}`}}function tv(e){let r=(e.startsWith("cron(")?e.slice(5,-1).trim():e.trim()).split(/\s+/);if(r.length!==5&&r.length!==6)throw Error("Cron schedules require five standard fields or six EventBridge fields.");let[a,g,f,h,b,S]=r,y=r.length===6;return{minute:rs(a,0,59),hour:rs(g,0,23),day:rs(f,1,31),month:rs(h,1,12,UR),weekday:rs(b,y?1:0,7,Xy,y?(k)=>k===7?6:k-1:void 0),year:S?rs(S,1970,2199):void 0,dayWildcard:f==="*"||f==="?",weekdayWildcard:b==="*"||b==="?"}}function VR(e,t){if(!((!t.minute||t.minute.has(e.minute))&&(!t.hour||t.hour.has(e.hour))&&(!t.month||t.month.has(e.month))&&(!t.year||t.year.has(e.year))))return!1;let a=!t.day||t.day.has(e.day),g=!t.weekday||t.weekday.has(e.weekday);return t.dayWildcard?g:t.weekdayWildcard?a:a||g}function rv(e){let t=/^rate\(\s*(\d+)\s+(minute|minutes|hour|hours|day|days)\s*\)$/i.exec(e);if(!t)return;let r=Number(t[1]);if(r<1)throw Error("Rate amount must be positive.");return r*(t[2].toLowerCase().startsWith("minute")?60000:t[2].toLowerCase().startsWith("hour")?3600000:86400000)}function dt(e){let t=e.trim(),r=zR[t.toLowerCase()]??t;if(!r)throw Error("Schedule expression is required.");let a=rv(r);if(a){let g=a/60000;return{original:t,normalized:`rate(${g} minutes)`,kind:"rate",description:g%1440===0?`Every ${g/1440} day(s)`:g%60===0?`Every ${g/60} hour(s)`:`Every ${g} minute(s)`}}return tv(r),{original:t,normalized:r.startsWith("cron(")?r:`cron(${r})`,kind:"cron",description:`Cron ${r.replace(/^cron\(|\)$/g,"")}`}}function Ft(e,t,r=new Date,a=5){let g=dt(e),f=ev(t),h=Math.min(20,Math.max(1,a)),b=rv(g.normalized);if(b)return Array.from({length:h},(O,M)=>new Date(r.getTime()+b*(M+1)).toISOString());let S=tv(g.normalized),y=[],k=new Set,R=new Date(Math.floor(r.getTime()/60000)*60000+60000),D=0;while(y.length<h&&D<1100000){let O=qR(R,f);if(VR(O,S)&&!k.has(O.key))y.push(R.toISOString()),k.add(O.key);R=new Date(R.getTime()+60000),D++}if(y.length<h)throw Error("Schedule produced no runs within the bounded preview horizon.");return y}function Ut(e,t="UTC",r=new Date,a=5){let g=dt(e),f=Ft(g.normalized,t,r,a),h=g.kind==="cron"?["Server cron and EventBridge use the same wall-clock preview; provider-specific extensions are retained only when supported."]:["Rate schedules use elapsed-time intervals and are not shifted by DST."];return{...g,timezone:ev(t),nextRuns:f,capabilities:{server:g.kind==="cron",eventbridge:!0,notes:h}}}function Tn(e){let t=dt(e.expression),r=t.normalized.slice(5,-1).trim().split(/\s+/),a=t.kind==="cron"&&r.length===5;if(e.provider==="server")return{provider:"server",supported:a,features:{timezone:!0,flexibleWindow:!1,catchUp:!1,replaceOverlap:!1},notes:[t.kind==="rate"?"Server cron requires a cron expression; use an equivalent cron schedule.":r.length!==5?"EventBridge six-field cron extensions cannot be installed as server cron.":"Cron is reconciled through a root-owned ts-cloud entry.",e.missedRunPolicy==="catch_up"?"Catch-up is handled by the control plane, not cron.":"Missed runs are skipped by cron."]};if(e.provider==="eventbridge")return{provider:"eventbridge",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["Five-field cron is translated explicitly to EventBridge six-field syntax. Flexible windows are provider-native; overlap and catch-up remain control-plane policies."]};if(e.provider==="lambda")return{provider:"lambda",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["The schedule invokes one immutable Lambda target."]};return{provider:"platform",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!0,replaceOverlap:!0},notes:["The durable control-plane worker enforces all configured policies."]}}function As(e){let t=Tn({...e,provider:"server"});if(!t.supported)throw Error(t.notes.join(" "));let a=dt(e.expression).normalized.slice(5,-1);return{path:`/etc/cron.d/ts-cloud-${e.id}`,content:`CRON_TZ=${e.timezone}
 ${a} root /usr/local/bin/cloud jobs:dispatch ${e.id} --scheduled >/dev/null 2>&1
-`}}function WR(e){let t=dt(e);if(t.kind==="rate")return e;let r=t.normalized.slice(5,-1).trim().split(/\s+/);if(r.length===6)return t.normalized;let[a,g,f,h,b]=r,S=b==="*"?"?":b.replace(/(^|[,-])0(?=$|[,-])/g,(y,k)=>`${k}1`);return f==="*"&&b!=="*"?`cron(${a} ${g} ? ${h} ${S} *)`:`cron(${a} ${g} ${f} ${h} ? *)`}function $u(e){let t=Tn(e);if(!t.supported)throw Error(t.notes.join(" "));return{Name:`ts-cloud-${e.id}`,ScheduleExpression:WR(e.expression),ScheduleExpressionTimezone:e.timezone,State:e.enabled?"ENABLED":"DISABLED",FlexibleTimeWindow:e.flexibleMinutes?{Mode:"FLEXIBLE",MaximumWindowInMinutes:e.flexibleMinutes}:{Mode:"OFF"},Target:{kind:e.target.kind,functionName:e.target.functionName??null,payloadRefs:e.payloadRefs},RetryPolicy:{MaximumRetryAttempts:e.retryPolicy.maxAttempts,MaximumEventAgeInSeconds:e.timeoutSeconds},DeadLetterRef:e.retryPolicy.deadLetterRef??null}}function QS(e,t){if(!t)return{status:"unavailable",observedState:{message:"Provider observation is unavailable."}};let r=String(t.expression??""),a=t.enabled;return{status:r&&r!==e.normalizedExpression||typeof a==="boolean"&&a!==e.enabled?"drifted":"in_sync",observedState:t}}function ch(e){if(e.provider==="server"){let t=As(e);return{path:t.path,content:t.content,enabled:e.enabled}}if(e.provider==="eventbridge")return $u(e);throw Error(`No reconciliation adapter is configured for ${e.provider} schedules.`)}function Wp(e,t){if(Array.isArray(e))return Array.isArray(t)&&e.length===t.length&&e.every((r,a)=>Wp(r,t[a]));if(e&&typeof e==="object"){if(!t||typeof t!=="object"||Array.isArray(t))return!1;return Object.entries(e).every(([r,a])=>Wp(a,t[r]))}return e===t}class dh{transport;provider="server";constructor(e){this.transport=e}async observe(e){let t=As(e),r=await this.transport.read(t.path);return r==null?void 0:{path:t.path,content:r,enabled:!0}}async apply(e,t){let r=String(t.path??"");if(!e.enabled){await this.transport.removeRootOwned(r);return}await this.transport.writeRootOwned(r,String(t.content??""))}async remove(e){await this.transport.removeRootOwned(As(e).path)}matches(e,t){if(e.enabled===!1)return!1;return e.path===t.path&&e.content===t.content}}class lh{transport;provider="eventbridge";constructor(e){this.transport=e}observe(e){return this.transport.get(`ts-cloud-${e.id}`)}apply(e,t){return this.transport.put(t)}remove(e){return this.transport.remove(`ts-cloud-${e.id}`)}matches(e,t){return Wp(e,t)}}class uh{store;constructor(e){this.store=e}async reconcile(e,t,r={}){if(t.provider!==e.provider)return this.store.reconcile(e.id,"unsupported",{provider:t.provider,message:`Adapter ${t.provider} cannot reconcile ${e.provider}.`});try{let a=ch(e),g=await t.observe(e);if(g&&t.matches(a,g))return this.store.reconcile(e.id,"in_sync",{provider:t.provider,observed:g});if(r.apply===!1)return this.store.reconcile(e.id,g?"drifted":"unavailable",{provider:t.provider,observed:g??null,applyRequired:!0});if(await t.apply(e,a),!e.enabled)return this.store.reconcile(e.id,"in_sync",{provider:t.provider,observed:null,disabled:!0});let f=await t.observe(e);return this.store.reconcile(e.id,f&&t.matches(a,f)?"in_sync":"drifted",{provider:t.provider,observed:f??null,applied:!0})}catch(a){return this.store.reconcile(e.id,"unavailable",{provider:t.provider,error:a instanceof Error?a.message:String(a)})}}async remove(e,t){if(e.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");if(t.provider!==e.provider)throw Error(`Adapter ${t.provider} cannot remove ${e.provider}.`);await t.remove(e),this.store.remove(e.id)}}function HR(e){if(e.queues===!0)return[{queue:"default",processes:e.queueConcurrency??1}];if(!Array.isArray(e.queues))return[];return e.queues.map((t)=>{if(typeof t==="string")return{queue:t,processes:e.queueConcurrency??1};let[r,a]=Object.entries(t)[0]??["default",e.queueConcurrency??1];return{queue:r,processes:a}})}function Da(e,t,r){let a=new Set,g=new Set,f=new Map(r.resources.map((R)=>[R.slug,R])),h=0,b=0;for(let[R,D]of Object.entries(t.sites??{})){let O=f.get(R);if(D.scheduler){let J=`config:site:${R}:scheduler`;a.add(J),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:O?.id,name:`${R} scheduler`,provider:"server",expression:"* * * * *",timezone:"UTC",flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:`scheduler:run:${R}`},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:300,enabled:!0,origin:"config",sourceKey:J,observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),h++}let M=D,z=Array.isArray(M.queues??M.workers)?M.queues??M.workers:[];for(let[J,Z]of z.entries()){let oe=typeof Z==="string"?{queue:Z}:Z,G=String(oe.queue??oe.name??"default"),te=`config:site:${R}:worker:${J}:${G}`;g.add(te),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:O?.id,name:`${R}:${G}`,provider:"systemd",queue:G,processes:Number(oe.processes)||1,timeoutSeconds:Number(oe.timeout)||60,restartPolicy:"always",target:{operationId:`worker:restart:${R}`,site:R},enabled:!0,origin:"config",sourceKey:te,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),b++}}let S=t.infrastructure?.compute?.backups;if(S?.enabled)a.add("config:platform:backup"),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:"Scheduled backup",provider:"server",expression:String(S.schedule??"0 2 * * *"),timezone:String(S.timezone??"UTC"),flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:"backup:run"},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:60},timeoutSeconds:3600,enabled:!0,origin:"config",sourceKey:"config:platform:backup",observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),h++;let y=t.environments?.[r.environment.slug]?.app;if(y){if(y.scheduler!=="off"){let R=`config:serverless:${r.environment.slug}:scheduler`;a.add(R),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name} serverless scheduler`,provider:"eventbridge",expression:"rate(1 minute)",timezone:"UTC",flexibleMinutes:0,target:{kind:"serverless_scheduler",action:"schedule:run"},payloadRefs:{},missedRunPolicy:y.scheduler==="sub-minute"?"catch_up":"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:y.cliTimeout??900,enabled:!0,origin:"config",sourceKey:R,observedState:{source:"cloud.config.ts",mode:y.scheduler??"on"},reconciliationStatus:"pending"}),h++}for(let{queue:R,processes:D}of HR(y)){let O=`config:serverless:${r.environment.slug}:worker:${R}`;g.add(O),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name}:${R}`,provider:"lambda",queue:R,processes:D,timeoutSeconds:y.queueTimeout??120,restartPolicy:"on_failure",target:{function:"queue",queue:R},enabled:!0,origin:"config",sourceKey:O,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),b++}}let k=0;for(let R of e.list(r.project.id,{environmentId:r.environment.id}).filter((D)=>D.origin==="config"&&D.sourceKey&&!a.has(D.sourceKey)))e.reconcile(R.id,"drifted",{...R.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),k++;for(let R of e.listWorkers(r.project.id,r.environment.id).filter((D)=>D.origin==="config"&&D.sourceKey&&!g.has(D.sourceKey)))e.reconcileWorker(R.id,"drifted",{...R.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),k++;return{jobs:h,workers:b,drifted:k}}class Pa{store;queue;constructor(e,t={}){this.store=e;this.queue=t.queue??new c(e.controlPlane)}enqueue(e,t){let r=new Date(t.scheduledFor??this.store.now()).toISOString(),a=`${e.id}:${t.trigger==="manual"?crypto.randomUUID():r}`,g=this.store.activeExecution(e.id);if(g&&e.overlapPolicy==="forbid")return this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:a,status:"skipped",output:{reason:"overlap_forbidden",activeExecutionId:g.id}});if(g&&e.overlapPolicy==="replace"&&g.operationId)try{this.queue.requestCancellation(g.operationId,t.actorId)}catch{}let f=this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:a,status:"queued",output:{semantics:"at_least_once"}});if(f.operationId)return f;let h=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:t.actorId,kind:"job.execute",input:{jobId:e.id,executionId:f.id},idempotencyKey:`job-execution:${f.id}`,lockKey:e.overlapPolicy==="allow"?`job-execution:${f.id}`:`job:${e.id}`,maxAttempts:e.retryPolicy.maxAttempts,timeoutSeconds:e.timeoutSeconds,retryClasses:["job_transient"],resumePolicy:"requeue"}).operation;return this.store.attachOperation(f.id,h.id)}tick(e=this.store.now()){let t=[];for(let r of this.store.due(e.toISOString())){let a=r.nextRunAt,g=Ft(r.normalizedExpression,r.timezone,e,1)[0];if(r.missedRunPolicy==="catch_up"){let f=a,h=0;while(f<=e.toISOString()&&h<10)t.push(this.enqueue(r,{trigger:f===a?"scheduled":"catch_up",scheduledFor:f})),f=Ft(r.normalizedExpression,r.timezone,new Date(f),1)[0],h++}else t.push(this.enqueue(r,{trigger:"scheduled",scheduledFor:a}));this.store.markScheduled(r.id,a,g)}return t}}function Mu(e){return{"job.execute":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},g=e.store.get(String(a.jobId??"")),f=e.store.getExecution(String(a.executionId??""));if(!g||!f)throw Error("Scheduled job execution is no longer available.");e.store.transitionExecution(f.id,"running",{attempt:r.operation.attempt}),r.checkpoint("execute",`Running ${g.name} on ${g.provider}.`),r.log(`Trigger ${f.trigger}; scheduled for ${f.scheduledFor}; semantics at-least-once.`,{stream:"system"});let h=await e.executor(g,g.target,r);if(h.stdout)r.log(h.stdout,{stream:"stdout"});if(h.stderr)r.log(h.stderr,{stream:"stderr"});if(!h.ok){if(e.store.transitionExecution(f.id,r.operation.attempt>=g.retryPolicy.maxAttempts?"dead":"failed",{attempt:r.operation.attempt,error:h.stderr??"Job execution failed."}),h.retryable)throw new ae(h.stderr??"Scheduled job failed transiently.","job_transient");throw Error(h.stderr??"Scheduled job failed.")}return e.store.transitionExecution(f.id,"succeeded",{attempt:r.operation.attempt,output:h.output??{}}),{jobId:g.id,executionId:f.id,provider:g.provider}}}}var Mr=(e)=>typeof e==="string"&&e?e:void 0,nv=(e)=>Number(e)===1,po=(e)=>{try{return JSON.parse(String(e))}catch{return{}}},Oi=(e,t,r,a)=>{let g=Number(e);return Number.isFinite(g)?Math.min(a,Math.max(r,Math.floor(g))):t};function Ad(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Mr(e.environment_id),resourceId:Mr(e.resource_id),name:String(e.name),provider:String(e.provider),expression:String(e.expression),normalizedExpression:String(e.normalized_expression),timezone:String(e.timezone),startsAt:Mr(e.starts_at),endsAt:Mr(e.ends_at),flexibleMinutes:Number(e.flexible_minutes),target:po(e.target),payloadRefs:po(e.payload_refs),missedRunPolicy:String(e.missed_run_policy),overlapPolicy:String(e.overlap_policy),retryPolicy:po(e.retry_policy),timeoutSeconds:Number(e.timeout_seconds),enabled:nv(e.enabled),origin:String(e.origin),sourceKey:Mr(e.source_key),ownerActorId:Mr(e.owner_actor_id),observedState:po(e.observed_state),reconciliationStatus:String(e.reconciliation_status),nextRunAt:Mr(e.next_run_at),lastScheduledFor:Mr(e.last_scheduled_for),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Cd(e){return{id:String(e.id),jobId:String(e.job_id),operationId:Mr(e.operation_id),trigger:String(e.trigger),scheduledFor:String(e.scheduled_for),idempotencyKey:String(e.idempotency_key),status:String(e.status),attempt:Number(e.attempt),startedAt:Mr(e.started_at),finishedAt:Mr(e.finished_at),output:po(e.output),error:Mr(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Hp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Mr(e.environment_id),resourceId:Mr(e.resource_id),name:String(e.name),provider:String(e.provider),queue:String(e.queue),processes:Number(e.processes),timeoutSeconds:Number(e.timeout_seconds),restartPolicy:String(e.restart_policy),target:po(e.target),enabled:nv(e.enabled),origin:String(e.origin),sourceKey:Mr(e.source_key),ownerActorId:Mr(e.owner_actor_id),observedState:po(e.observed_state),reconciliationStatus:String(e.reconciliation_status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class ka{controlPlane;options;constructor(e,t={}){this.controlPlane=e;this.options=t}now(){return this.options.now?.()??new Date}create(e){if(!e.name.trim())throw Error("Scheduled jobs require a name.");let t=Ut(e.expression,e.timezone,this.now(),1),r=crypto.randomUUID(),a=this.now().toISOString(),g=e.startsAt?new Date(e.startsAt).toISOString():void 0,f=e.endsAt?new Date(e.endsAt).toISOString():void 0;if(g&&f&&g>=f)throw Error("Schedule start must be before end.");let h=t.nextRuns.find((b)=>(!g||b>=g)&&(!f||b<=f));return this.controlPlane.database.run("INSERT INTO scheduled_jobs (id,organization_id,project_id,environment_id,resource_id,name,provider,expression,normalized_expression,timezone,starts_at,ends_at,flexible_minutes,target,payload_refs,missed_run_policy,overlap_policy,retry_policy,timeout_seconds,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,next_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.trim().slice(0,120),e.provider,e.expression,t.normalized,e.timezone,g??null,f??null,Oi(e.flexibleMinutes,0,0,1440),JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify({maxAttempts:Oi(e.retryPolicy.maxAttempts,3,1,20),backoffSeconds:Oi(e.retryPolicy.backoffSeconds,30,0,86400),deadLetterRef:e.retryPolicy.deadLetterRef}),Oi(e.timeoutSeconds,900,1,86400),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,h??null,1,a,a]),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE id=?").get(e);return t?Ad(t):void 0}getBySource(e,t,r){let a=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE project_id=? AND environment_id IS ? AND source_key=?").get(e,t??null,r);return a?Ad(a):void 0}list(e,t={}){let r=["project_id=?"],a=[e];if(t.environmentId)r.push("environment_id=?"),a.push(t.environmentId);if(t.resourceIds?.length)r.push(`resource_id IN (${t.resourceIds.map(()=>"?").join(",")})`),a.push(...t.resourceIds);if(t.enabled!=null)r.push("enabled=?"),a.push(t.enabled?1:0);return this.controlPlane.database.query(`SELECT * FROM scheduled_jobs WHERE ${r.join(" AND ")} ORDER BY next_run_at IS NULL,next_run_at,name`).all(...a).map(Ad)}setEnabled(e,t){this.controlPlane.database.run("UPDATE scheduled_jobs SET enabled=?,version=version+1,updated_at=? WHERE id=?",[t?1:0,this.now().toISOString(),e]);let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");return r}updateSchedule(e,t){let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");let a=t.expression??r.expression,g=t.timezone??r.timezone,f=Ut(a,g,this.now(),1),h=this.now().toISOString();return this.controlPlane.database.run("UPDATE scheduled_jobs SET expression=?,normalized_expression=?,timezone=?,missed_run_policy=?,overlap_policy=?,timeout_seconds=?,next_run_at=?,reconciliation_status=?,version=version+1,updated_at=? WHERE id=?",[a,f.normalized,g,t.missedRunPolicy??r.missedRunPolicy,t.overlapPolicy??r.overlapPolicy,Oi(t.timeoutSeconds,r.timeoutSeconds,1,86400),f.nextRuns[0],"pending",h,e]),this.get(e)}remove(e){let t=this.get(e);if(!t)throw Error("Scheduled job was not found.");if(t.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");this.controlPlane.database.run("DELETE FROM scheduled_jobs WHERE id=?",[e])}markScheduled(e,t,r){this.controlPlane.database.run("UPDATE scheduled_jobs SET last_scheduled_for=?,next_run_at=?,updated_at=? WHERE id=?",[t,r??null,this.now().toISOString(),e])}reconcile(e,t,r){return this.controlPlane.database.run("UPDATE scheduled_jobs SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]),this.get(e)}upsertConfigJob(e){let t=this.getBySource(e.projectId,e.environmentId,e.sourceKey);if(!t)return this.create(e);let r=Ut(e.expression,e.timezone,this.now(),1),a=this.now().toISOString();if(t.resourceId===e.resourceId&&t.name===e.name&&t.provider===e.provider&&t.expression===e.expression&&t.normalizedExpression===r.normalized&&t.timezone===e.timezone&&JSON.stringify(t.target)===JSON.stringify(e.target)&&JSON.stringify(t.payloadRefs)===JSON.stringify(e.payloadRefs)&&t.missedRunPolicy===e.missedRunPolicy&&t.overlapPolicy===e.overlapPolicy&&JSON.stringify(t.retryPolicy)===JSON.stringify(e.retryPolicy)&&t.timeoutSeconds===e.timeoutSeconds&&t.enabled===e.enabled)return t;return this.controlPlane.database.run("UPDATE scheduled_jobs SET resource_id=?,name=?,provider=?,expression=?,normalized_expression=?,timezone=?,target=?,payload_refs=?,missed_run_policy=?,overlap_policy=?,retry_policy=?,timeout_seconds=?,enabled=?,observed_state=?,reconciliation_status=?,next_run_at=COALESCE(next_run_at,?),version=version+1,updated_at=? WHERE id=?",[e.resourceId??null,e.name,e.provider,e.expression,r.normalized,e.timezone,JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify(e.retryPolicy),e.timeoutSeconds,e.enabled?1:0,JSON.stringify(e.observedState),e.reconciliationStatus,r.nextRuns[0],a,t.id]),this.get(t.id)}due(e=this.now().toISOString()){return this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE enabled=1 AND next_run_at IS NOT NULL AND next_run_at<=? AND (starts_at IS NULL OR starts_at<=?) AND (ends_at IS NULL OR ends_at>=?) ORDER BY next_run_at LIMIT 200").all(e,e,e).map(Ad)}createExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return Cd(t);let r=crypto.randomUUID(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO job_executions (id,job_id,operation_id,trigger,scheduled_for,idempotency_key,status,attempt,output,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)",[r,e.jobId,e.operationId??null,e.trigger,e.scheduledFor,e.idempotencyKey,e.status,0,JSON.stringify(e.output),a,a]),this.getExecution(r)}getExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE id=?").get(e);return t?Cd(t):void 0}listExecutions(e,t=100){return this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? ORDER BY scheduled_for DESC,created_at DESC LIMIT ?").all(e,Math.min(1000,Math.max(1,t))).map(Cd)}activeExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? AND status IN ('queued','running') ORDER BY created_at DESC LIMIT 1").get(e);return t?Cd(t):void 0}attachOperation(e,t){return this.controlPlane.database.run("UPDATE job_executions SET operation_id=?,updated_at=? WHERE id=?",[t,this.now().toISOString(),e]),this.getExecution(e)}transitionExecution(e,t,r={}){let a=this.now().toISOString(),g=t==="running"?a:null,f=["succeeded","failed","skipped","dead"].includes(t)?a:null;return this.controlPlane.database.run("UPDATE job_executions SET status=?,attempt=COALESCE(?,attempt),started_at=COALESCE(started_at,?),finished_at=?,output=COALESCE(?,output),error=?,updated_at=? WHERE id=?",[t,r.attempt??null,g,f,r.output?JSON.stringify(r.output):null,r.error?.slice(0,2000)??null,a,e]),this.getExecution(e)}upsertWorker(e){let t=e.sourceKey?this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE project_id=? AND source_key=? AND environment_id IS ?").get(e.projectId,e.sourceKey,e.environmentId??null):void 0,r=t?Hp(t):void 0,a=r?.id??crypto.randomUUID(),g=this.now().toISOString(),f=Oi(e.processes,1,0,1000),h=Oi(e.timeoutSeconds,60,1,86400);if(r&&r.resourceId===e.resourceId&&r.name===e.name.slice(0,120)&&r.provider===e.provider&&r.queue===e.queue.slice(0,200)&&r.processes===f&&r.timeoutSeconds===h&&r.restartPolicy===e.restartPolicy&&JSON.stringify(r.target)===JSON.stringify(e.target)&&r.enabled===e.enabled)return r;return this.controlPlane.database.run("INSERT INTO worker_definitions (id,organization_id,project_id,environment_id,resource_id,name,provider,queue,processes,timeout_seconds,restart_policy,target,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET name=excluded.name,resource_id=excluded.resource_id,provider=excluded.provider,queue=excluded.queue,processes=excluded.processes,timeout_seconds=excluded.timeout_seconds,restart_policy=excluded.restart_policy,target=excluded.target,enabled=excluded.enabled,observed_state=excluded.observed_state,reconciliation_status=excluded.reconciliation_status,version=worker_definitions.version+1,updated_at=excluded.updated_at",[a,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.slice(0,120),e.provider,e.queue.slice(0,200),f,h,e.restartPolicy,JSON.stringify(e.target),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,1,r?.createdAt??g,g]),this.getWorker(a)}getWorker(e){let t=this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE id=?").get(e);return t?Hp(t):void 0}listWorkers(e,t){return this.controlPlane.database.query(`SELECT * FROM worker_definitions WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(Hp)}setWorkerProcesses(e,t){this.controlPlane.database.run("UPDATE worker_definitions SET processes=?,reconciliation_status='pending',version=version+1,updated_at=? WHERE id=?",[Oi(t,1,0,1000),this.now().toISOString(),e]);let r=this.getWorker(e);if(!r)throw Error("Worker was not found.");return r}reconcileWorker(e,t,r){this.controlPlane.database.run("UPDATE worker_definitions SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]);let a=this.getWorker(e);if(!a)throw Error("Worker was not found.");return a}}var Fr=(e,t="none",r=!1)=>({supported:!0,downtime:t,destructive:r,explanation:e}),Or=(e)=>({supported:!1,downtime:"none",destructive:!1,explanation:e});function wn(e,t){let r=["aws_rds","aws_aurora","aws_elasticache"].includes(t),a=["server","container"].includes(t),g=["postgres","mysql","mariadb"].includes(e),f=e==="redis",h={};return h.create=t==="external"?Or("External services can be adopted as read-only inventory."):Fr(r?"Provision through the provider API.":"Provision through the owning runtime driver.","possible"),h.observe=t==="external"?Or("External observation requires a configured provider adapter."):Fr("Provider/runtime health and endpoint metadata are observable."),h.connect=Fr("Connection guidance uses secret references and never returns a password by default."),h.backup=g&&(r||a)?Fr(r?"Create a provider snapshot.":"Create a consistent engine-native dump.","possible"):Or("This cache path is not a durable backup source."),h.restore=r&&g?Fr("Restore creates a reviewed provider target.","required",!0):Or("Restore requires a configured provider restore runner."),h.restart=t==="external"?Or("External restart requires a configured provider adapter."):Fr(r?"Provider restart/failover semantics apply.":"Restart the owning service unit.","required"),h.resize=t==="aws_elasticache"?Or("ElastiCache resizing requires a replication-group migration runner."):r?Fr("Provider plan/storage modification may enter a maintenance window.","possible"):a?Fr("Edit host/container resources and reconcile.","required"):Or("External resize requires a configured provider adapter."),h.version=a?Or("Runtime version upgrades require an explicit image migration runner."):r&&t!=="aws_elasticache"?Fr(g?"Major versions require compatibility preflight and backup.":"Engine upgrades require a maintenance window.","required"):Or("External upgrades require a configured provider adapter."),h.rotate=t==="aws_elasticache"||t==="external"||a&&!g&&!f?Or("Credential rotation is not available for this provider/engine path."):Fr("Rotate through the secret backend, update the engine, then flag dependent releases."),h.expose=a?Or("Direct container publishing is refused; use a reviewed firewall and proxy policy."):t==="aws_rds"?Fr("Exposure is reconciled through security groups; public access defaults off."):Or("Exposure changes require a provider-specific network runner."),h.delete=t==="external"?Or("External deletion requires a configured provider adapter."):Fr(r?"Final snapshot is supported where the provider allows it.":"A final engine backup is required unless explicitly retained.","required",!0),h.logs=a?Fr("Read bounded service logs from the runtime."):Or("Provider log export is not configured for this adapter."),h.slow_queries=a&&g?Fr("Read bounded runtime logs after engine slow-query logging is enabled."):Or("A slow-query log runner is not configured for this provider."),h.users=a&&g?Fr("Logical users can be listed; creation requires a referenced secondary credential."):Or("User management requires an engine connection runner."),h.databases=a&&g?Fr("Logical databases can be listed, created, and confirmation-gated for deletion."):Or("Logical database management requires an engine connection runner."),{actions:h,endpointTypes:r?["internal","external","tunnel"]:["internal","tunnel"],metrics:f?["connections","memory","evictions","hit_rate","latency"]:["connections","cpu","storage","read_latency","write_latency","iops"]}}var is=(e)=>e==null?void 0:String(e),_d=(e)=>Number(e)===1,Pd=(e)=>{try{return JSON.parse(String(e))}catch{return{}}};function iv(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:is(e.environment_id),resourceId:is(e.resource_id),name:String(e.name),engine:String(e.engine),provider:String(e.provider),placement:String(e.placement),engineVersion:is(e.engine_version),plan:String(e.plan),storageGb:e.storage_gb==null?void 0:Number(e.storage_gb),highAvailability:_d(e.high_availability),publicExposure:_d(e.public_exposure),allowedCidrs:Pd(e.allowed_cidrs),desiredState:Pd(e.desired_state),observedState:Pd(e.observed_state),capabilities:Pd(e.capabilities),credentialRef:is(e.credential_ref),status:String(e.status),origin:String(e.origin),managementEnabled:_d(e.management_enabled),ownerActorId:is(e.owner_actor_id),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Na{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}create(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Data service names must be 2-63 lowercase letters, numbers, or dashes.");if(e.publicExposure&&(!e.allowedCidrs.length||e.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");let t=crypto.randomUUID(),r=this.now().toISOString(),a=wn(e.engine,e.provider);return this.controlPlane.database.run("INSERT INTO data_services (id,organization_id,project_id,environment_id,resource_id,name,engine,provider,placement,engine_version,plan,storage_gb,high_availability,public_exposure,allowed_cidrs,desired_state,observed_state,capabilities,credential_ref,status,origin,management_enabled,owner_actor_id,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name,e.engine,e.provider,e.placement,e.engineVersion??null,e.plan,e.storageGb??null,e.highAvailability?1:0,e.publicExposure?1:0,JSON.stringify(e.allowedCidrs),JSON.stringify(e.desiredState),JSON.stringify(e.observedState),JSON.stringify(a),e.credentialRef??null,e.status,e.origin,e.managementEnabled?1:0,e.ownerActorId??null,1,r,r]),this.get(t)}get(e){let t=this.controlPlane.database.query("SELECT * FROM data_services WHERE id=?").get(e);return t?iv(t):void 0}list(e,t){return this.controlPlane.database.query(`SELECT * FROM data_services WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(iv)}update(e,t,r){let a=this.get(e);if(!a)throw Error("Data service was not found.");if(a.version!==t)throw Error("Data service changed; refresh before retrying.");let g={...a,...r};if(g.publicExposure&&(!g.allowedCidrs.length||g.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");if(this.controlPlane.database.run("UPDATE data_services SET plan=?,storage_gb=?,engine_version=?,high_availability=?,public_exposure=?,allowed_cidrs=?,desired_state=?,observed_state=?,status=?,management_enabled=?,credential_ref=?,version=version+1,updated_at=? WHERE id=? AND version=?",[g.plan,g.storageGb??null,g.engineVersion??null,g.highAvailability?1:0,g.publicExposure?1:0,JSON.stringify(g.allowedCidrs),JSON.stringify(g.desiredState),JSON.stringify(g.observedState),g.status,g.managementEnabled?1:0,g.credentialRef??null,this.now().toISOString(),e,t]).changes!==1)throw Error("Data service changed; refresh before retrying.");return this.get(e)}credential(e){let t=this.controlPlane.database.query("SELECT * FROM data_service_credentials WHERE service_id=? ORDER BY version DESC LIMIT 1").get(e);return t?{id:String(t.id),serviceId:String(t.service_id),username:String(t.username),secretRef:String(t.secret_ref),version:Number(t.version),createdAt:String(t.created_at),rotatedAt:is(t.rotated_at)}:void 0}saveCredential(e,t,r){let a=this.credential(e),g=a?.id??crypto.randomUUID(),f=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_credentials (id,service_id,username,secret_ref,version,created_at,rotated_at) VALUES (?,?,?,?,?,?,?) ON CONFLICT(service_id,username) DO UPDATE SET secret_ref=excluded.secret_ref,version=data_service_credentials.version+1,rotated_at=excluded.rotated_at",[g,e,t,r,a?.version??1,a?.createdAt??f,a?f:null]),this.credential(e)}addDependency(e){let t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_dependencies (service_id,resource_id,secret_ref,requires_redeploy,created_at) VALUES (?,?,?,?,?) ON CONFLICT(service_id,resource_id) DO UPDATE SET secret_ref=excluded.secret_ref,requires_redeploy=excluded.requires_redeploy",[e.serviceId,e.resourceId,e.secretRef,e.requiresRedeploy?1:0,t]),{...e,createdAt:t}}dependencies(e){return this.controlPlane.database.query("SELECT * FROM data_service_dependencies WHERE service_id=? ORDER BY resource_id").all(e).map((t)=>({serviceId:String(t.service_id),resourceId:String(t.resource_id),secretRef:String(t.secret_ref),requiresRedeploy:_d(t.requires_redeploy),createdAt:String(t.created_at)}))}removeDependency(e,t){return this.controlPlane.database.run("DELETE FROM data_service_dependencies WHERE service_id=? AND resource_id=?",[e,t]).changes===1}remove(e){this.controlPlane.database.run("DELETE FROM data_services WHERE id=?",[e])}}function ov(){let t=crypto.getRandomValues(new Uint8Array(40));return Array.from(t,(r)=>"ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*_-+="[r%69]).join("")}function Fu(e,t){return t.map((r)=>{let a=r.type==="tunnel"?"127.0.0.1":r.host,g=e.engine==="redis"?`redis-cli -h ${a} -p ${r.port}${r.tls?" --tls":""}`:e.engine==="postgres"?`psql "host=${a} port=${r.port} dbname=${r.database??"postgres"} sslmode=${r.tls?"require":"disable"}"`:e.engine==="mongodb"?`mongosh "mongodb://${a}:${r.port}/${r.database??"admin"}${r.tls?"?tls=true":""}"`:e.engine==="libsql"?`turso db shell ${r.tls?"https":"http"}://${a}:${r.port}`:`mysql --host=${a} --port=${r.port} --database=${r.database??"mysql"} --ssl-mode=${r.tls?"REQUIRED":"DISABLED"}`;return{type:r.type,command:g,secretRef:e.credentialRef}})}class ys{store;queue;secrets;constructor(e,t,r){this.store=e;this.queue=t;this.secrets=r}async create(e){let t,r;if(e.provider!=="aws_elasticache"){let a=e.username??"app",g=ov();r=`secret://data-services/${e.projectId}/${e.name}/${a}`,await this.secrets.put(r,g),t={username:a,password:g,secretRef:r}}try{let a=this.store.create({...e,credentialRef:r,status:"planning"});if(t)this.store.saveCredential(a.id,t.username,t.secretRef);let g=this.enqueue(a,"create",{});return{service:a,credential:t,operationId:g}}catch(a){if(r)await this.secrets.remove(r);throw a}}plan(e,t,r={}){let a=e.capabilities.actions[t],g=t==="version"&&String(r.engineVersion??"").split(".")[0]!==String(e.engineVersion??"").split(".")[0];return{service:e,action:t,capability:a,changes:r,preflight:{backupRequired:["delete","restore"].includes(t)||g,compatibilityRequired:g,typedConfirmation:a.destructive?e.name:void 0,retentionChoiceRequired:t==="delete"},warnings:[...a.downtime!=="none"?[`Downtime is ${a.downtime}.`]:[],...e.origin==="adopted"&&!e.managementEnabled?["Adopted resource is read-only until management is explicitly enabled."]:[]]}}enqueue(e,t,r,a){let g=this.plan(e,t,r);if(!g.capability.supported)throw Error(g.capability.explanation);if(e.origin==="adopted"&&!e.managementEnabled&&t!=="observe")throw Error("Adopted resources remain read-only until management is explicitly enabled.");if(g.preflight.typedConfirmation&&r.confirm!==g.preflight.typedConfirmation)throw Error(`Type ${g.preflight.typedConfirmation} to confirm ${t}.`);if(g.preflight.retentionChoiceRequired&&!["final_backup","retain"].includes(String(r.retention??"")))throw Error("Deletion requires retention final_backup or retain.");if(g.preflight.compatibilityRequired&&(r.compatibilityReviewed!==!0||!r.backupId))throw Error("Major version changes require compatibilityReviewed=true and a backupId.");if(t==="restore"){let f=String(r.backupId??""),h=String(r.targetId??"");if(!f||!h)throw Error("Restore requires both backupId and targetId.");if(h===e.placement)throw Error("Restore targetId must differ from the source placement.");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(h))throw Error("Restore targetId must be 2-63 lowercase letters, numbers, or dashes.")}return this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:a,kind:"data_service.action",input:{serviceId:e.id,action:t,...r},lockKey:`data-service:${e.id}`,providerKey:e.provider,maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"}).operation.id}async rotate(e,t,r){let a=this.store.credential(e.id);if(!a)throw Error("Data service credential metadata was not found.");let g=ov(),f=`${a.secretRef}/v${a.version+1}`;await this.secrets.put(f,g);try{return await t.action(e,"rotate",{username:a.username,secretRef:f},g,r),this.store.saveCredential(e.id,a.username,f),this.store.update(e.id,e.version,{credentialRef:f}),{credential:{username:a.username,password:g,secretRef:f},dependencies:this.store.dependencies(e.id).filter((h)=>h.requiresRedeploy).map((h)=>h.resourceId)}}catch(h){throw await this.secrets.remove(f),h}}}function Uu(e){return{"data_service.action":async(t)=>{let r=t.operation.input,a=e.store.get(String(r.serviceId??"")),g=String(r.action??"");if(!a)throw Error("Data service was not found.");let f=e.resolveAdapter(a);if(!f||f.provider!==a.provider||!f.engines.includes(a.engine))throw Error(`No ${a.provider}/${a.engine} adapter is configured.`);if(g==="rotate"){let b=await new ys(e.store,new c(e.store.controlPlane),e.secrets).rotate(a,f,t);return{serviceId:a.id,action:g,username:b.credential.username,secretRef:b.credential.secretRef,dependencies:b.dependencies}}let h=a.credentialRef?await e.secrets.resolve(a.credentialRef):void 0;try{let b=g==="observe"?await f.observe(a):g==="create"?await f.apply(a,h,t):await f.action(a,g,r,h,t),S=e.store.get(a.id);return e.store.update(a.id,S.version,{observedState:b,status:g==="delete"?r.retention==="retain"?"retained":"deleting":"available"}),{serviceId:a.id,action:g,observed:b}}catch(b){let S=e.store.get(a.id);if(e.store.update(a.id,S.version,{status:"failed",observedState:{...S.observedState,error:b instanceof Error?b.message:String(b)}}),/temporar|timeout|unavailable|throttl/i.test(b instanceof Error?b.message:String(b)))throw new ae(b instanceof Error?b.message:String(b),"provider_transient");throw b}}}}class os{transport;constructor(e){this.transport=e}observe(e){return this.transport.observe(e.placement)}apply(e,t){return this.transport.apply({id:e.placement,name:e.name,engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,storageGb:e.storageGb??null,highAvailability:e.highAvailability,publicExposure:e.publicExposure,allowedCidrs:e.allowedCidrs,username:e.desiredState.username??"app",desiredState:e.desiredState},t)}action(e,t,r,a,g){return this.transport.execute(e.placement,t,{engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,desiredState:e.desiredState,...r},a,g)}}class Ba extends os{provider="aws_rds";engines=["postgres","mysql","mariadb"]}class xa extends os{provider="aws_aurora";engines=["postgres","mysql"]}class Oa extends os{provider="aws_elasticache";engines=["redis"]}class _a extends os{provider="server";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}class La extends os{provider="container";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}var $d=(e,t)=>{let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)},Jt=(e,t,r)=>{let a=$d(e,t);return a==null?r:String(a)},nn=(e,t)=>{let r=$d(e,t);return r==null?void 0:Number(r)},$i=(e,t)=>{let r=$d(e,t);return r==null?void 0:r===!0||r==="true"},ss=(e,t)=>{let r=$d(e,t);return Array.isArray(r)?r.map(String):[]},Od=(e,t)=>Jt(t,"snapshotId")??`${e}-final-${new Date().toISOString().replace(/[^0-9]/g,"").slice(0,14)}`;function xd(e){if(!e)throw Error("RDS instance was not found.");return{providerId:e.DBInstanceIdentifier??null,status:e.DBInstanceStatus??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,plan:e.DBInstanceClass??null,storageGb:e.AllocatedStorage??null,highAvailability:e.MultiAZ??!1,publicExposure:e.PubliclyAccessible??!1,endpoint:e.Endpoint?.Address??null,port:e.Endpoint?.Port??null,username:e.MasterUsername??null,database:e.DBName??null,encrypted:e.StorageEncrypted??!1}}class $a{client;constructor(e=new ne){this.client=e}async observe(e){return xd(await this.client.describeDBInstance(e))}async apply(e,t){let r=String(e.id),a=await this.client.createDBInstance({DBInstanceIdentifier:r,DBInstanceClass:String(e.plan),Engine:String(e.engine),MasterUsername:Jt(e,"username","app"),MasterUserPassword:t,DBName:Jt(e,"database"),AllocatedStorage:nn(e,"storageGb"),VpcSecurityGroupIds:ss(e,"securityGroupIds"),DBSubnetGroupName:Jt(e,"subnetGroup"),BackupRetentionPeriod:nn(e,"backupRetentionDays")??7,MultiAZ:$i(e,"highAvailability"),EngineVersion:Jt(e,"engineVersion"),PubliclyAccessible:$i(e,"publicExposure")??!1,StorageType:Jt(e,"storageType","gp3"),StorageEncrypted:!0,KmsKeyId:Jt(e,"kmsKeyId"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return xd(a.DBInstance)}async execute(e,t,r,a,g){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBInstance({DBInstanceIdentifier:e}),{status:"rebooting"};if(t==="backup"){let f=Od(e,r);return await this.client.createDBSnapshot({DBInstanceIdentifier:e,DBSnapshotIdentifier:f}),{status:"snapshotting",snapshotId:f}}if(t==="restore"){let f=String(r.targetId),h=await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:f,DBSnapshotIdentifier:String(r.backupId),DBInstanceClass:Jt(r,"plan"),DBSubnetGroupName:Jt(r,"subnetGroup"),MultiAZ:$i(r,"highAvailability"),PubliclyAccessible:!1,StorageType:Jt(r,"storageType"),VpcSecurityGroupIds:ss(r,"securityGroupIds"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{...xd(h.DBInstance),sourceId:e,restoreTargetId:f}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let f=Od(e,r);return await this.client.modifyDBInstance({DBInstanceIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:e,SkipFinalSnapshot:!1,FinalDBSnapshotIdentifier:f,DeleteAutomatedBackups:!1}),{status:"deleting",finalSnapshotId:f}}if(["resize","version","rotate","expose"].includes(t)){let f=await this.client.modifyDBInstance({DBInstanceIdentifier:e,DBInstanceClass:Jt(r,"plan"),AllocatedStorage:nn(r,"storageGb"),MasterUserPassword:t==="rotate"?a:void 0,EngineVersion:Jt(r,"engineVersion"),MultiAZ:$i(r,"highAvailability"),PubliclyAccessible:$i(r,"publicExposure"),VpcSecurityGroupIds:ss(r,"securityGroupIds"),ApplyImmediately:$i(r,"applyImmediately")??!0});return xd(f.DBInstance)}throw Error(`RDS action ${t} requires an engine connection runner.`)}}function Kp(e){if(!e)throw Error("Aurora cluster was not found.");return{providerId:e.DBClusterIdentifier??null,status:e.Status??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,endpoint:e.Endpoint??null,readerEndpoint:e.ReaderEndpoint??null,port:e.Port??null,username:e.MasterUsername??null,database:e.DatabaseName??null,encrypted:e.StorageEncrypted??!1,highAvailability:e.MultiAZ??!0}}class Ma{client;constructor(e=new ne){this.client=e}async observe(e){let t=await this.client.describeDBClusters({DBClusterIdentifier:e});return Kp(t.DBClusters?.[0])}async apply(e,t){let r=String(e.id),a=String(e.engine)==="postgres"?"aurora-postgresql":"aurora-mysql";return await this.client.createDBCluster({DBClusterIdentifier:r,Engine:a,EngineVersion:Jt(e,"engineVersion"),MasterUsername:Jt(e,"username","app"),MasterUserPassword:t,DatabaseName:Jt(e,"database"),DBSubnetGroupName:Jt(e,"subnetGroup"),VpcSecurityGroupIds:ss(e,"securityGroupIds"),BackupRetentionPeriod:nn(e,"backupRetentionDays")??7,StorageEncrypted:!0,KmsKeyId:Jt(e,"kmsKeyId"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:nn(e,"minCapacity")??0.5,MaxCapacity:nn(e,"maxCapacity")??4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${r}-writer-1`,DBClusterIdentifier:r,DBInstanceClass:String(e.plan||"db.serverless"),Engine:a,PubliclyAccessible:$i(e,"publicExposure")??!1}),{status:"creating",providerId:r}}async execute(e,t,r,a){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBCluster(e),{status:"rebooting"};if(t==="backup"){let g=Od(e,r);return await this.client.createDBClusterSnapshot(e,g),{status:"snapshotting",snapshotId:g}}if(t==="restore"){let g=String(r.targetId),f=String(r.engine)==="postgres"?"aurora-postgresql":"aurora-mysql",h=await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:g,SnapshotIdentifier:String(r.backupId),Engine:f,EngineVersion:Jt(r,"engineVersion"),DBSubnetGroupName:Jt(r,"subnetGroup"),VpcSecurityGroupIds:ss(r,"securityGroupIds"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:nn(r,"minCapacity")??0.5,MaxCapacity:nn(r,"maxCapacity")??4}});return await this.client.createDBInstance({DBInstanceIdentifier:`${g}-writer-1`,DBClusterIdentifier:g,DBInstanceClass:Jt(r,"plan","db.serverless"),Engine:f,PubliclyAccessible:!1}),{...Kp(h.DBCluster),sourceId:e,restoreTargetId:g}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let g=Od(e,r);return await this.client.modifyDBCluster({DBClusterIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(e,g),{status:"deleting",finalSnapshotId:g}}if(["resize","version","rotate"].includes(t)){let g=await this.client.modifyDBCluster({DBClusterIdentifier:e,ServerlessV2ScalingConfiguration:nn(r,"minCapacity")==null&&nn(r,"maxCapacity")==null?void 0:{MinCapacity:nn(r,"minCapacity")??0.5,MaxCapacity:nn(r,"maxCapacity")??4},EngineVersion:Jt(r,"engineVersion"),MasterUserPassword:t==="rotate"?a:void 0,ApplyImmediately:$i(r,"applyImmediately")??!0});return Kp(g.DBCluster)}throw Error(`Aurora action ${t} requires an engine connection runner.`)}}class Fa{client;constructor(e=new pt){this.client=e}async observe(e){let t=(await this.client.describeCacheClusters(e)).CacheClusters[0];if(!t)throw Error("ElastiCache cluster was not found.");let r=t.CacheNodes?.[0]?.Endpoint;return{providerId:t.CacheClusterId,status:t.CacheClusterStatus,engine:t.Engine,engineVersion:t.EngineVersion,plan:t.CacheNodeType,nodes:t.NumCacheNodes,endpoint:r?.Address??null,port:r?.Port??null}}async apply(e){let t=await this.client.createCacheCluster({cacheClusterId:String(e.id),engine:"redis",cacheNodeType:String(e.plan),numCacheNodes:nn(e,"nodes")??1,engineVersion:Jt(e,"engineVersion"),port:nn(e,"port"),securityGroupIds:ss(e,"securityGroupIds"),subnetGroupName:Jt(e,"subnetGroup"),tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{providerId:t.CacheCluster.CacheClusterId,status:t.CacheCluster.CacheClusterStatus}}async execute(e,t,r){if(t==="observe")return this.observe(e);if(t==="restart"){let a=(await this.client.describeCacheClusters(e)).CacheClusters[0];return await this.client.rebootCacheCluster(e,a?.CacheNodes?.map((g)=>g.CacheNodeId)??["0001"]),{status:"rebooting"}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};return await this.client.deleteCacheCluster(e),{status:"deleting"}}throw Error(`ElastiCache action ${t} is not supported by this cluster mode.`)}}import{mkdir as KR,writeFile as JR}from"node:fs/promises";import{join as GR}from"node:path";async function ln(e,t,r=!1){let a=Bun.spawn(["docker",...e],{stdin:t==null?"ignore":"pipe",stdout:"pipe",stderr:"pipe"}),g=new Response(a.stdout).text(),f=new Response(a.stderr).text();if(t!=null)a.stdin.write(t),a.stdin.end();let[h,b,S]=await Promise.all([a.exited,g,f]);if(h!==0&&!r)throw Error(`Docker command failed (${h}): ${S.trim()||b.trim()}`);return{code:h,stdout:b,stderr:S}}class Qu{async ensureNetwork(e){if((await ln(["network","inspect",e],void 0,!0)).code!==0)await ln(["network","create","--internal",e])}async seedSecret(e,t){await ln(["volume","create",e]),await ln(["run","--rm","-i","-v",`${e}:/run/target`,"alpine:3.21","sh","-c","umask 077; cat > /run/target/credential"],t)}async removeVolume(e){await ln(["volume","rm",e],void 0,!0)}async inspect(e){let t=await ln(["inspect",e],void 0,!0);if(t.code!==0)return;return JSON.parse(t.stdout)[0]}async run(e){await ln(["run",...e])}async exec(e,t,r){return(await ln(["exec","-i",e,...t],r)).stdout}async update(e,t){await ln(["update",...t,e])}async restart(e){await ln(["restart",e])}async remove(e){await ln(["rm","--force",e],void 0,!0)}async logs(e,t){let r=await ln(["logs","--tail",String(Math.min(2000,Math.max(1,t))),e],void 0,!0);return`${r.stdout}${r.stderr}`.slice(-262144)}async stats(e){let t=await ln(["stats","--no-stream","--format","{{json .}}",e],void 0,!0);if(t.code!==0||!t.stdout.trim())return{};let r=JSON.parse(t.stdout.trim());return{cpuPercent:String(r.CPUPerc??""),memoryUsage:String(r.MemUsage??""),memoryPercent:String(r.MemPerc??""),networkIo:String(r.NetIO??""),blockIo:String(r.BlockIO??""),pids:Number(r.PIDs??0)}}}var QR={postgres:{image:"postgres:17-alpine",port:5432,dataPath:"/var/lib/postgresql/data"},mysql:{image:"mysql:8.4",port:3306,dataPath:"/var/lib/mysql"},mariadb:{image:"mariadb:11.7",port:3306,dataPath:"/var/lib/mysql"},redis:{image:"redis:7.4-alpine",port:6379,dataPath:"/data"},mongodb:{image:"mongo:8.0",port:27017,dataPath:"/data/db"}};function hi(e,t="app"){let r=String(e??t);if(!/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(r))throw Error("Database identifiers must be letters, numbers, or underscores.");return r}function go(e){if(!/^[a-z0-9][a-z0-9_.-]{1,62}$/i.test(e))throw Error("Runtime placement must be a valid container identifier.");return`tscloud-data-${e.toLowerCase()}`}function YR(e,t){let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)}function oa(e){return e.Config?.Labels??{}}class Ir{runtime;backupRoot;constructor(e=new Qu,t=l(process.cwd(),"backups","data")){this.runtime=e;this.backupRoot=t}async observe(e){let t=go(e),r=await this.runtime.inspect(t);if(!r)throw Error(`Data container ${t} was not found.`);let a=oa(r),g=await this.runtime.stats(t),f=r.NetworkSettings?.Ports??{},h=Object.values(f).flat().find(Boolean);return{providerId:t,status:r.State?.Status??"unknown",healthy:r.State?.Health?.Status??null,engine:a["ts-cloud.engine"]??null,engineVersion:a["ts-cloud.engine-version"]??null,username:a["ts-cloud.username"]??null,database:a["ts-cloud.database"]??null,endpoint:h?.HostIp||"127.0.0.1",port:h?.HostPort?Number(h.HostPort):null,image:r.Config?.Image??null,startedAt:r.State?.StartedAt??null,metrics:g}}async apply(e,t){let r=String(e.id),a=go(r),g=String(e.engine);if(g==="libsql")throw Error("libSQL requires an explicitly configured runtime image.");let f=QR[g];if(!f)throw Error(`Unsupported runtime data engine ${g}.`);if(!t)throw Error(`${g} requires a managed credential.`);if(e.publicExposure===!0)throw Error("Container public exposure requires an external reviewed firewall policy; direct publishing is refused.");let h=hi(e.username),b=hi(YR(e,"database")),S=`${a}-secret`,y=`${a}-data`,k=g==="redis"?`appendonly yes
+`}}function WR(e){let t=dt(e);if(t.kind==="rate")return e;let r=t.normalized.slice(5,-1).trim().split(/\s+/);if(r.length===6)return t.normalized;let[a,g,f,h,b]=r,S=b==="*"?"?":b.replace(/(^|[,-])0(?=$|[,-])/g,(y,k)=>`${k}1`);return f==="*"&&b!=="*"?`cron(${a} ${g} ? ${h} ${S} *)`:`cron(${a} ${g} ${f} ${h} ? *)`}function $u(e){let t=Tn(e);if(!t.supported)throw Error(t.notes.join(" "));return{Name:`ts-cloud-${e.id}`,ScheduleExpression:WR(e.expression),ScheduleExpressionTimezone:e.timezone,State:e.enabled?"ENABLED":"DISABLED",FlexibleTimeWindow:e.flexibleMinutes?{Mode:"FLEXIBLE",MaximumWindowInMinutes:e.flexibleMinutes}:{Mode:"OFF"},Target:{kind:e.target.kind,functionName:e.target.functionName??null,payloadRefs:e.payloadRefs},RetryPolicy:{MaximumRetryAttempts:e.retryPolicy.maxAttempts,MaximumEventAgeInSeconds:e.timeoutSeconds},DeadLetterRef:e.retryPolicy.deadLetterRef??null}}function QS(e,t){if(!t)return{status:"unavailable",observedState:{message:"Provider observation is unavailable."}};let r=String(t.expression??""),a=t.enabled;return{status:r&&r!==e.normalizedExpression||typeof a==="boolean"&&a!==e.enabled?"drifted":"in_sync",observedState:t}}function ch(e){if(e.provider==="server"){let t=As(e);return{path:t.path,content:t.content,enabled:e.enabled}}if(e.provider==="eventbridge")return $u(e);throw Error(`No reconciliation adapter is configured for ${e.provider} schedules.`)}function Wp(e,t){if(Array.isArray(e))return Array.isArray(t)&&e.length===t.length&&e.every((r,a)=>Wp(r,t[a]));if(e&&typeof e==="object"){if(!t||typeof t!=="object"||Array.isArray(t))return!1;return Object.entries(e).every(([r,a])=>Wp(a,t[r]))}return e===t}class dh{transport;provider="server";constructor(e){this.transport=e}async observe(e){let t=As(e),r=await this.transport.read(t.path);return r==null?void 0:{path:t.path,content:r,enabled:!0}}async apply(e,t){let r=String(t.path??"");if(!e.enabled){await this.transport.removeRootOwned(r);return}await this.transport.writeRootOwned(r,String(t.content??""))}async remove(e){await this.transport.removeRootOwned(As(e).path)}matches(e,t){if(e.enabled===!1)return!1;return e.path===t.path&&e.content===t.content}}class lh{transport;provider="eventbridge";constructor(e){this.transport=e}observe(e){return this.transport.get(`ts-cloud-${e.id}`)}apply(e,t){return this.transport.put(t)}remove(e){return this.transport.remove(`ts-cloud-${e.id}`)}matches(e,t){return Wp(e,t)}}class uh{store;constructor(e){this.store=e}async reconcile(e,t,r={}){if(t.provider!==e.provider)return this.store.reconcile(e.id,"unsupported",{provider:t.provider,message:`Adapter ${t.provider} cannot reconcile ${e.provider}.`});try{let a=ch(e),g=await t.observe(e);if(g&&t.matches(a,g))return this.store.reconcile(e.id,"in_sync",{provider:t.provider,observed:g});if(r.apply===!1)return this.store.reconcile(e.id,g?"drifted":"unavailable",{provider:t.provider,observed:g??null,applyRequired:!0});if(await t.apply(e,a),!e.enabled)return this.store.reconcile(e.id,"in_sync",{provider:t.provider,observed:null,disabled:!0});let f=await t.observe(e);return this.store.reconcile(e.id,f&&t.matches(a,f)?"in_sync":"drifted",{provider:t.provider,observed:f??null,applied:!0})}catch(a){return this.store.reconcile(e.id,"unavailable",{provider:t.provider,error:a instanceof Error?a.message:String(a)})}}async remove(e,t){if(e.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");if(t.provider!==e.provider)throw Error(`Adapter ${t.provider} cannot remove ${e.provider}.`);await t.remove(e),this.store.remove(e.id)}}function HR(e){if(e.queues===!0)return[{queue:"default",processes:e.queueConcurrency??1}];if(!Array.isArray(e.queues))return[];return e.queues.map((t)=>{if(typeof t==="string")return{queue:t,processes:e.queueConcurrency??1};let[r,a]=Object.entries(t)[0]??["default",e.queueConcurrency??1];return{queue:r,processes:a}})}function Da(e,t,r){let a=new Set,g=new Set,f=new Map(r.resources.map((R)=>[R.slug,R])),h=0,b=0;for(let[R,D]of Object.entries(t.sites??{})){let O=f.get(R);if(D.scheduler){let J=`config:site:${R}:scheduler`;a.add(J),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:O?.id,name:`${R} scheduler`,provider:"server",expression:"* * * * *",timezone:"UTC",flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:`scheduler:run:${R}`},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:300,enabled:!0,origin:"config",sourceKey:J,observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),h++}let M=D,z=Array.isArray(M.queues??M.workers)?M.queues??M.workers:[];for(let[J,Z]of z.entries()){let oe=typeof Z==="string"?{queue:Z}:Z,G=String(oe.queue??oe.name??"default"),te=`config:site:${R}:worker:${J}:${G}`;g.add(te),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:O?.id,name:`${R}:${G}`,provider:"systemd",queue:G,processes:Number(oe.processes)||1,timeoutSeconds:Number(oe.timeout)||60,restartPolicy:"always",target:{operationId:`worker:restart:${R}`,site:R},enabled:!0,origin:"config",sourceKey:te,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),b++}}let S=t.infrastructure?.compute?.backups;if(S?.enabled)a.add("config:platform:backup"),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:"Scheduled backup",provider:"server",expression:String(S.schedule??"0 2 * * *"),timezone:String(S.timezone??"UTC"),flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:"backup:run"},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:60},timeoutSeconds:3600,enabled:!0,origin:"config",sourceKey:"config:platform:backup",observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),h++;let y=t.environments?.[r.environment.slug]?.app;if(y){if(y.scheduler!=="off"){let R=`config:serverless:${r.environment.slug}:scheduler`;a.add(R),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name} serverless scheduler`,provider:"eventbridge",expression:"rate(1 minute)",timezone:"UTC",flexibleMinutes:0,target:{kind:"serverless_scheduler",action:"schedule:run"},payloadRefs:{},missedRunPolicy:y.scheduler==="sub-minute"?"catch_up":"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:y.cliTimeout??900,enabled:!0,origin:"config",sourceKey:R,observedState:{source:"cloud.config.ts",mode:y.scheduler??"on"},reconciliationStatus:"pending"}),h++}for(let{queue:R,processes:D}of HR(y)){let O=`config:serverless:${r.environment.slug}:worker:${R}`;g.add(O),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name}:${R}`,provider:"lambda",queue:R,processes:D,timeoutSeconds:y.queueTimeout??120,restartPolicy:"on_failure",target:{function:"queue",queue:R},enabled:!0,origin:"config",sourceKey:O,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),b++}}let k=0;for(let R of e.list(r.project.id,{environmentId:r.environment.id}).filter((D)=>D.origin==="config"&&D.sourceKey&&!a.has(D.sourceKey)))e.reconcile(R.id,"drifted",{...R.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),k++;for(let R of e.listWorkers(r.project.id,r.environment.id).filter((D)=>D.origin==="config"&&D.sourceKey&&!g.has(D.sourceKey)))e.reconcileWorker(R.id,"drifted",{...R.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),k++;return{jobs:h,workers:b,drifted:k}}class Pa{store;queue;constructor(e,t={}){this.store=e;this.queue=t.queue??new c(e.controlPlane)}enqueue(e,t){let r=new Date(t.scheduledFor??this.store.now()).toISOString(),a=`${e.id}:${t.trigger==="manual"?crypto.randomUUID():r}`,g=this.store.activeExecution(e.id);if(g&&e.overlapPolicy==="forbid")return this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:a,status:"skipped",output:{reason:"overlap_forbidden",activeExecutionId:g.id}});if(g&&e.overlapPolicy==="replace"&&g.operationId)try{this.queue.requestCancellation(g.operationId,t.actorId)}catch{}let f=this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:a,status:"queued",output:{semantics:"at_least_once"}});if(f.operationId)return f;let h=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:t.actorId,kind:"job.execute",input:{jobId:e.id,executionId:f.id},idempotencyKey:`job-execution:${f.id}`,lockKey:e.overlapPolicy==="allow"?`job-execution:${f.id}`:`job:${e.id}`,maxAttempts:e.retryPolicy.maxAttempts,timeoutSeconds:e.timeoutSeconds,retryClasses:["job_transient"],resumePolicy:"requeue"}).operation;return this.store.attachOperation(f.id,h.id)}tick(e=this.store.now()){let t=[];for(let r of this.store.due(e.toISOString())){let a=r.nextRunAt,g=Ft(r.normalizedExpression,r.timezone,e,1)[0];if(r.missedRunPolicy==="catch_up"){let f=a,h=0;while(f<=e.toISOString()&&h<10)t.push(this.enqueue(r,{trigger:f===a?"scheduled":"catch_up",scheduledFor:f})),f=Ft(r.normalizedExpression,r.timezone,new Date(f),1)[0],h++}else t.push(this.enqueue(r,{trigger:"scheduled",scheduledFor:a}));this.store.markScheduled(r.id,a,g)}return t}}function Mu(e){return{"job.execute":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},g=e.store.get(String(a.jobId??"")),f=e.store.getExecution(String(a.executionId??""));if(!g||!f)throw Error("Scheduled job execution is no longer available.");e.store.transitionExecution(f.id,"running",{attempt:r.operation.attempt}),r.checkpoint("execute",`Running ${g.name} on ${g.provider}.`),r.log(`Trigger ${f.trigger}; scheduled for ${f.scheduledFor}; semantics at-least-once.`,{stream:"system"});let h=await e.executor(g,g.target,r);if(h.stdout)r.log(h.stdout,{stream:"stdout"});if(h.stderr)r.log(h.stderr,{stream:"stderr"});if(!h.ok){if(e.store.transitionExecution(f.id,r.operation.attempt>=g.retryPolicy.maxAttempts?"dead":"failed",{attempt:r.operation.attempt,error:h.stderr??"Job execution failed."}),h.retryable)throw new ce(h.stderr??"Scheduled job failed transiently.","job_transient");throw Error(h.stderr??"Scheduled job failed.")}return e.store.transitionExecution(f.id,"succeeded",{attempt:r.operation.attempt,output:h.output??{}}),{jobId:g.id,executionId:f.id,provider:g.provider}}}}var Mr=(e)=>typeof e==="string"&&e?e:void 0,nv=(e)=>Number(e)===1,po=(e)=>{try{return JSON.parse(String(e))}catch{return{}}},Oi=(e,t,r,a)=>{let g=Number(e);return Number.isFinite(g)?Math.min(a,Math.max(r,Math.floor(g))):t};function Ad(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Mr(e.environment_id),resourceId:Mr(e.resource_id),name:String(e.name),provider:String(e.provider),expression:String(e.expression),normalizedExpression:String(e.normalized_expression),timezone:String(e.timezone),startsAt:Mr(e.starts_at),endsAt:Mr(e.ends_at),flexibleMinutes:Number(e.flexible_minutes),target:po(e.target),payloadRefs:po(e.payload_refs),missedRunPolicy:String(e.missed_run_policy),overlapPolicy:String(e.overlap_policy),retryPolicy:po(e.retry_policy),timeoutSeconds:Number(e.timeout_seconds),enabled:nv(e.enabled),origin:String(e.origin),sourceKey:Mr(e.source_key),ownerActorId:Mr(e.owner_actor_id),observedState:po(e.observed_state),reconciliationStatus:String(e.reconciliation_status),nextRunAt:Mr(e.next_run_at),lastScheduledFor:Mr(e.last_scheduled_for),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Cd(e){return{id:String(e.id),jobId:String(e.job_id),operationId:Mr(e.operation_id),trigger:String(e.trigger),scheduledFor:String(e.scheduled_for),idempotencyKey:String(e.idempotency_key),status:String(e.status),attempt:Number(e.attempt),startedAt:Mr(e.started_at),finishedAt:Mr(e.finished_at),output:po(e.output),error:Mr(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Hp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Mr(e.environment_id),resourceId:Mr(e.resource_id),name:String(e.name),provider:String(e.provider),queue:String(e.queue),processes:Number(e.processes),timeoutSeconds:Number(e.timeout_seconds),restartPolicy:String(e.restart_policy),target:po(e.target),enabled:nv(e.enabled),origin:String(e.origin),sourceKey:Mr(e.source_key),ownerActorId:Mr(e.owner_actor_id),observedState:po(e.observed_state),reconciliationStatus:String(e.reconciliation_status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class ka{controlPlane;options;constructor(e,t={}){this.controlPlane=e;this.options=t}now(){return this.options.now?.()??new Date}create(e){if(!e.name.trim())throw Error("Scheduled jobs require a name.");let t=Ut(e.expression,e.timezone,this.now(),1),r=crypto.randomUUID(),a=this.now().toISOString(),g=e.startsAt?new Date(e.startsAt).toISOString():void 0,f=e.endsAt?new Date(e.endsAt).toISOString():void 0;if(g&&f&&g>=f)throw Error("Schedule start must be before end.");let h=t.nextRuns.find((b)=>(!g||b>=g)&&(!f||b<=f));return this.controlPlane.database.run("INSERT INTO scheduled_jobs (id,organization_id,project_id,environment_id,resource_id,name,provider,expression,normalized_expression,timezone,starts_at,ends_at,flexible_minutes,target,payload_refs,missed_run_policy,overlap_policy,retry_policy,timeout_seconds,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,next_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.trim().slice(0,120),e.provider,e.expression,t.normalized,e.timezone,g??null,f??null,Oi(e.flexibleMinutes,0,0,1440),JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify({maxAttempts:Oi(e.retryPolicy.maxAttempts,3,1,20),backoffSeconds:Oi(e.retryPolicy.backoffSeconds,30,0,86400),deadLetterRef:e.retryPolicy.deadLetterRef}),Oi(e.timeoutSeconds,900,1,86400),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,h??null,1,a,a]),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE id=?").get(e);return t?Ad(t):void 0}getBySource(e,t,r){let a=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE project_id=? AND environment_id IS ? AND source_key=?").get(e,t??null,r);return a?Ad(a):void 0}list(e,t={}){let r=["project_id=?"],a=[e];if(t.environmentId)r.push("environment_id=?"),a.push(t.environmentId);if(t.resourceIds?.length)r.push(`resource_id IN (${t.resourceIds.map(()=>"?").join(",")})`),a.push(...t.resourceIds);if(t.enabled!=null)r.push("enabled=?"),a.push(t.enabled?1:0);return this.controlPlane.database.query(`SELECT * FROM scheduled_jobs WHERE ${r.join(" AND ")} ORDER BY next_run_at IS NULL,next_run_at,name`).all(...a).map(Ad)}setEnabled(e,t){this.controlPlane.database.run("UPDATE scheduled_jobs SET enabled=?,version=version+1,updated_at=? WHERE id=?",[t?1:0,this.now().toISOString(),e]);let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");return r}updateSchedule(e,t){let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");let a=t.expression??r.expression,g=t.timezone??r.timezone,f=Ut(a,g,this.now(),1),h=this.now().toISOString();return this.controlPlane.database.run("UPDATE scheduled_jobs SET expression=?,normalized_expression=?,timezone=?,missed_run_policy=?,overlap_policy=?,timeout_seconds=?,next_run_at=?,reconciliation_status=?,version=version+1,updated_at=? WHERE id=?",[a,f.normalized,g,t.missedRunPolicy??r.missedRunPolicy,t.overlapPolicy??r.overlapPolicy,Oi(t.timeoutSeconds,r.timeoutSeconds,1,86400),f.nextRuns[0],"pending",h,e]),this.get(e)}remove(e){let t=this.get(e);if(!t)throw Error("Scheduled job was not found.");if(t.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");this.controlPlane.database.run("DELETE FROM scheduled_jobs WHERE id=?",[e])}markScheduled(e,t,r){this.controlPlane.database.run("UPDATE scheduled_jobs SET last_scheduled_for=?,next_run_at=?,updated_at=? WHERE id=?",[t,r??null,this.now().toISOString(),e])}reconcile(e,t,r){return this.controlPlane.database.run("UPDATE scheduled_jobs SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]),this.get(e)}upsertConfigJob(e){let t=this.getBySource(e.projectId,e.environmentId,e.sourceKey);if(!t)return this.create(e);let r=Ut(e.expression,e.timezone,this.now(),1),a=this.now().toISOString();if(t.resourceId===e.resourceId&&t.name===e.name&&t.provider===e.provider&&t.expression===e.expression&&t.normalizedExpression===r.normalized&&t.timezone===e.timezone&&JSON.stringify(t.target)===JSON.stringify(e.target)&&JSON.stringify(t.payloadRefs)===JSON.stringify(e.payloadRefs)&&t.missedRunPolicy===e.missedRunPolicy&&t.overlapPolicy===e.overlapPolicy&&JSON.stringify(t.retryPolicy)===JSON.stringify(e.retryPolicy)&&t.timeoutSeconds===e.timeoutSeconds&&t.enabled===e.enabled)return t;return this.controlPlane.database.run("UPDATE scheduled_jobs SET resource_id=?,name=?,provider=?,expression=?,normalized_expression=?,timezone=?,target=?,payload_refs=?,missed_run_policy=?,overlap_policy=?,retry_policy=?,timeout_seconds=?,enabled=?,observed_state=?,reconciliation_status=?,next_run_at=COALESCE(next_run_at,?),version=version+1,updated_at=? WHERE id=?",[e.resourceId??null,e.name,e.provider,e.expression,r.normalized,e.timezone,JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify(e.retryPolicy),e.timeoutSeconds,e.enabled?1:0,JSON.stringify(e.observedState),e.reconciliationStatus,r.nextRuns[0],a,t.id]),this.get(t.id)}due(e=this.now().toISOString()){return this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE enabled=1 AND next_run_at IS NOT NULL AND next_run_at<=? AND (starts_at IS NULL OR starts_at<=?) AND (ends_at IS NULL OR ends_at>=?) ORDER BY next_run_at LIMIT 200").all(e,e,e).map(Ad)}createExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return Cd(t);let r=crypto.randomUUID(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO job_executions (id,job_id,operation_id,trigger,scheduled_for,idempotency_key,status,attempt,output,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)",[r,e.jobId,e.operationId??null,e.trigger,e.scheduledFor,e.idempotencyKey,e.status,0,JSON.stringify(e.output),a,a]),this.getExecution(r)}getExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE id=?").get(e);return t?Cd(t):void 0}listExecutions(e,t=100){return this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? ORDER BY scheduled_for DESC,created_at DESC LIMIT ?").all(e,Math.min(1000,Math.max(1,t))).map(Cd)}activeExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? AND status IN ('queued','running') ORDER BY created_at DESC LIMIT 1").get(e);return t?Cd(t):void 0}attachOperation(e,t){return this.controlPlane.database.run("UPDATE job_executions SET operation_id=?,updated_at=? WHERE id=?",[t,this.now().toISOString(),e]),this.getExecution(e)}transitionExecution(e,t,r={}){let a=this.now().toISOString(),g=t==="running"?a:null,f=["succeeded","failed","skipped","dead"].includes(t)?a:null;return this.controlPlane.database.run("UPDATE job_executions SET status=?,attempt=COALESCE(?,attempt),started_at=COALESCE(started_at,?),finished_at=?,output=COALESCE(?,output),error=?,updated_at=? WHERE id=?",[t,r.attempt??null,g,f,r.output?JSON.stringify(r.output):null,r.error?.slice(0,2000)??null,a,e]),this.getExecution(e)}upsertWorker(e){let t=e.sourceKey?this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE project_id=? AND source_key=? AND environment_id IS ?").get(e.projectId,e.sourceKey,e.environmentId??null):void 0,r=t?Hp(t):void 0,a=r?.id??crypto.randomUUID(),g=this.now().toISOString(),f=Oi(e.processes,1,0,1000),h=Oi(e.timeoutSeconds,60,1,86400);if(r&&r.resourceId===e.resourceId&&r.name===e.name.slice(0,120)&&r.provider===e.provider&&r.queue===e.queue.slice(0,200)&&r.processes===f&&r.timeoutSeconds===h&&r.restartPolicy===e.restartPolicy&&JSON.stringify(r.target)===JSON.stringify(e.target)&&r.enabled===e.enabled)return r;return this.controlPlane.database.run("INSERT INTO worker_definitions (id,organization_id,project_id,environment_id,resource_id,name,provider,queue,processes,timeout_seconds,restart_policy,target,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET name=excluded.name,resource_id=excluded.resource_id,provider=excluded.provider,queue=excluded.queue,processes=excluded.processes,timeout_seconds=excluded.timeout_seconds,restart_policy=excluded.restart_policy,target=excluded.target,enabled=excluded.enabled,observed_state=excluded.observed_state,reconciliation_status=excluded.reconciliation_status,version=worker_definitions.version+1,updated_at=excluded.updated_at",[a,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.slice(0,120),e.provider,e.queue.slice(0,200),f,h,e.restartPolicy,JSON.stringify(e.target),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,1,r?.createdAt??g,g]),this.getWorker(a)}getWorker(e){let t=this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE id=?").get(e);return t?Hp(t):void 0}listWorkers(e,t){return this.controlPlane.database.query(`SELECT * FROM worker_definitions WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(Hp)}setWorkerProcesses(e,t){this.controlPlane.database.run("UPDATE worker_definitions SET processes=?,reconciliation_status='pending',version=version+1,updated_at=? WHERE id=?",[Oi(t,1,0,1000),this.now().toISOString(),e]);let r=this.getWorker(e);if(!r)throw Error("Worker was not found.");return r}reconcileWorker(e,t,r){this.controlPlane.database.run("UPDATE worker_definitions SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]);let a=this.getWorker(e);if(!a)throw Error("Worker was not found.");return a}}var Fr=(e,t="none",r=!1)=>({supported:!0,downtime:t,destructive:r,explanation:e}),Or=(e)=>({supported:!1,downtime:"none",destructive:!1,explanation:e});function wn(e,t){let r=["aws_rds","aws_aurora","aws_elasticache"].includes(t),a=["server","container"].includes(t),g=["postgres","mysql","mariadb"].includes(e),f=e==="redis",h={};return h.create=t==="external"?Or("External services can be adopted as read-only inventory."):Fr(r?"Provision through the provider API.":"Provision through the owning runtime driver.","possible"),h.observe=t==="external"?Or("External observation requires a configured provider adapter."):Fr("Provider/runtime health and endpoint metadata are observable."),h.connect=Fr("Connection guidance uses secret references and never returns a password by default."),h.backup=g&&(r||a)?Fr(r?"Create a provider snapshot.":"Create a consistent engine-native dump.","possible"):Or("This cache path is not a durable backup source."),h.restore=r&&g?Fr("Restore creates a reviewed provider target.","required",!0):Or("Restore requires a configured provider restore runner."),h.restart=t==="external"?Or("External restart requires a configured provider adapter."):Fr(r?"Provider restart/failover semantics apply.":"Restart the owning service unit.","required"),h.resize=t==="aws_elasticache"?Or("ElastiCache resizing requires a replication-group migration runner."):r?Fr("Provider plan/storage modification may enter a maintenance window.","possible"):a?Fr("Edit host/container resources and reconcile.","required"):Or("External resize requires a configured provider adapter."),h.version=a?Or("Runtime version upgrades require an explicit image migration runner."):r&&t!=="aws_elasticache"?Fr(g?"Major versions require compatibility preflight and backup.":"Engine upgrades require a maintenance window.","required"):Or("External upgrades require a configured provider adapter."),h.rotate=t==="aws_elasticache"||t==="external"||a&&!g&&!f?Or("Credential rotation is not available for this provider/engine path."):Fr("Rotate through the secret backend, update the engine, then flag dependent releases."),h.expose=a?Or("Direct container publishing is refused; use a reviewed firewall and proxy policy."):t==="aws_rds"?Fr("Exposure is reconciled through security groups; public access defaults off."):Or("Exposure changes require a provider-specific network runner."),h.delete=t==="external"?Or("External deletion requires a configured provider adapter."):Fr(r?"Final snapshot is supported where the provider allows it.":"A final engine backup is required unless explicitly retained.","required",!0),h.logs=a?Fr("Read bounded service logs from the runtime."):Or("Provider log export is not configured for this adapter."),h.slow_queries=a&&g?Fr("Read bounded runtime logs after engine slow-query logging is enabled."):Or("A slow-query log runner is not configured for this provider."),h.users=a&&g?Fr("Logical users can be listed; creation requires a referenced secondary credential."):Or("User management requires an engine connection runner."),h.databases=a&&g?Fr("Logical databases can be listed, created, and confirmation-gated for deletion."):Or("Logical database management requires an engine connection runner."),{actions:h,endpointTypes:r?["internal","external","tunnel"]:["internal","tunnel"],metrics:f?["connections","memory","evictions","hit_rate","latency"]:["connections","cpu","storage","read_latency","write_latency","iops"]}}var is=(e)=>e==null?void 0:String(e),_d=(e)=>Number(e)===1,Pd=(e)=>{try{return JSON.parse(String(e))}catch{return{}}};function iv(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:is(e.environment_id),resourceId:is(e.resource_id),name:String(e.name),engine:String(e.engine),provider:String(e.provider),placement:String(e.placement),engineVersion:is(e.engine_version),plan:String(e.plan),storageGb:e.storage_gb==null?void 0:Number(e.storage_gb),highAvailability:_d(e.high_availability),publicExposure:_d(e.public_exposure),allowedCidrs:Pd(e.allowed_cidrs),desiredState:Pd(e.desired_state),observedState:Pd(e.observed_state),capabilities:Pd(e.capabilities),credentialRef:is(e.credential_ref),status:String(e.status),origin:String(e.origin),managementEnabled:_d(e.management_enabled),ownerActorId:is(e.owner_actor_id),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Na{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}create(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Data service names must be 2-63 lowercase letters, numbers, or dashes.");if(e.publicExposure&&(!e.allowedCidrs.length||e.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");let t=crypto.randomUUID(),r=this.now().toISOString(),a=wn(e.engine,e.provider);return this.controlPlane.database.run("INSERT INTO data_services (id,organization_id,project_id,environment_id,resource_id,name,engine,provider,placement,engine_version,plan,storage_gb,high_availability,public_exposure,allowed_cidrs,desired_state,observed_state,capabilities,credential_ref,status,origin,management_enabled,owner_actor_id,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name,e.engine,e.provider,e.placement,e.engineVersion??null,e.plan,e.storageGb??null,e.highAvailability?1:0,e.publicExposure?1:0,JSON.stringify(e.allowedCidrs),JSON.stringify(e.desiredState),JSON.stringify(e.observedState),JSON.stringify(a),e.credentialRef??null,e.status,e.origin,e.managementEnabled?1:0,e.ownerActorId??null,1,r,r]),this.get(t)}get(e){let t=this.controlPlane.database.query("SELECT * FROM data_services WHERE id=?").get(e);return t?iv(t):void 0}list(e,t){return this.controlPlane.database.query(`SELECT * FROM data_services WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(iv)}update(e,t,r){let a=this.get(e);if(!a)throw Error("Data service was not found.");if(a.version!==t)throw Error("Data service changed; refresh before retrying.");let g={...a,...r};if(g.publicExposure&&(!g.allowedCidrs.length||g.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");if(this.controlPlane.database.run("UPDATE data_services SET plan=?,storage_gb=?,engine_version=?,high_availability=?,public_exposure=?,allowed_cidrs=?,desired_state=?,observed_state=?,status=?,management_enabled=?,credential_ref=?,version=version+1,updated_at=? WHERE id=? AND version=?",[g.plan,g.storageGb??null,g.engineVersion??null,g.highAvailability?1:0,g.publicExposure?1:0,JSON.stringify(g.allowedCidrs),JSON.stringify(g.desiredState),JSON.stringify(g.observedState),g.status,g.managementEnabled?1:0,g.credentialRef??null,this.now().toISOString(),e,t]).changes!==1)throw Error("Data service changed; refresh before retrying.");return this.get(e)}credential(e){let t=this.controlPlane.database.query("SELECT * FROM data_service_credentials WHERE service_id=? ORDER BY version DESC LIMIT 1").get(e);return t?{id:String(t.id),serviceId:String(t.service_id),username:String(t.username),secretRef:String(t.secret_ref),version:Number(t.version),createdAt:String(t.created_at),rotatedAt:is(t.rotated_at)}:void 0}saveCredential(e,t,r){let a=this.credential(e),g=a?.id??crypto.randomUUID(),f=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_credentials (id,service_id,username,secret_ref,version,created_at,rotated_at) VALUES (?,?,?,?,?,?,?) ON CONFLICT(service_id,username) DO UPDATE SET secret_ref=excluded.secret_ref,version=data_service_credentials.version+1,rotated_at=excluded.rotated_at",[g,e,t,r,a?.version??1,a?.createdAt??f,a?f:null]),this.credential(e)}addDependency(e){let t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_dependencies (service_id,resource_id,secret_ref,requires_redeploy,created_at) VALUES (?,?,?,?,?) ON CONFLICT(service_id,resource_id) DO UPDATE SET secret_ref=excluded.secret_ref,requires_redeploy=excluded.requires_redeploy",[e.serviceId,e.resourceId,e.secretRef,e.requiresRedeploy?1:0,t]),{...e,createdAt:t}}dependencies(e){return this.controlPlane.database.query("SELECT * FROM data_service_dependencies WHERE service_id=? ORDER BY resource_id").all(e).map((t)=>({serviceId:String(t.service_id),resourceId:String(t.resource_id),secretRef:String(t.secret_ref),requiresRedeploy:_d(t.requires_redeploy),createdAt:String(t.created_at)}))}removeDependency(e,t){return this.controlPlane.database.run("DELETE FROM data_service_dependencies WHERE service_id=? AND resource_id=?",[e,t]).changes===1}remove(e){this.controlPlane.database.run("DELETE FROM data_services WHERE id=?",[e])}}function ov(){let t=crypto.getRandomValues(new Uint8Array(40));return Array.from(t,(r)=>"ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*_-+="[r%69]).join("")}function Fu(e,t){return t.map((r)=>{let a=r.type==="tunnel"?"127.0.0.1":r.host,g=e.engine==="redis"?`redis-cli -h ${a} -p ${r.port}${r.tls?" --tls":""}`:e.engine==="postgres"?`psql "host=${a} port=${r.port} dbname=${r.database??"postgres"} sslmode=${r.tls?"require":"disable"}"`:e.engine==="mongodb"?`mongosh "mongodb://${a}:${r.port}/${r.database??"admin"}${r.tls?"?tls=true":""}"`:e.engine==="libsql"?`turso db shell ${r.tls?"https":"http"}://${a}:${r.port}`:`mysql --host=${a} --port=${r.port} --database=${r.database??"mysql"} --ssl-mode=${r.tls?"REQUIRED":"DISABLED"}`;return{type:r.type,command:g,secretRef:e.credentialRef}})}class ys{store;queue;secrets;constructor(e,t,r){this.store=e;this.queue=t;this.secrets=r}async create(e){let t,r;if(e.provider!=="aws_elasticache"){let a=e.username??"app",g=ov();r=`secret://data-services/${e.projectId}/${e.name}/${a}`,await this.secrets.put(r,g),t={username:a,password:g,secretRef:r}}try{let a=this.store.create({...e,credentialRef:r,status:"planning"});if(t)this.store.saveCredential(a.id,t.username,t.secretRef);let g=this.enqueue(a,"create",{});return{service:a,credential:t,operationId:g}}catch(a){if(r)await this.secrets.remove(r);throw a}}plan(e,t,r={}){let a=e.capabilities.actions[t],g=t==="version"&&String(r.engineVersion??"").split(".")[0]!==String(e.engineVersion??"").split(".")[0];return{service:e,action:t,capability:a,changes:r,preflight:{backupRequired:["delete","restore"].includes(t)||g,compatibilityRequired:g,typedConfirmation:a.destructive?e.name:void 0,retentionChoiceRequired:t==="delete"},warnings:[...a.downtime!=="none"?[`Downtime is ${a.downtime}.`]:[],...e.origin==="adopted"&&!e.managementEnabled?["Adopted resource is read-only until management is explicitly enabled."]:[]]}}enqueue(e,t,r,a){let g=this.plan(e,t,r);if(!g.capability.supported)throw Error(g.capability.explanation);if(e.origin==="adopted"&&!e.managementEnabled&&t!=="observe")throw Error("Adopted resources remain read-only until management is explicitly enabled.");if(g.preflight.typedConfirmation&&r.confirm!==g.preflight.typedConfirmation)throw Error(`Type ${g.preflight.typedConfirmation} to confirm ${t}.`);if(g.preflight.retentionChoiceRequired&&!["final_backup","retain"].includes(String(r.retention??"")))throw Error("Deletion requires retention final_backup or retain.");if(g.preflight.compatibilityRequired&&(r.compatibilityReviewed!==!0||!r.backupId))throw Error("Major version changes require compatibilityReviewed=true and a backupId.");if(t==="restore"){let f=String(r.backupId??""),h=String(r.targetId??"");if(!f||!h)throw Error("Restore requires both backupId and targetId.");if(h===e.placement)throw Error("Restore targetId must differ from the source placement.");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(h))throw Error("Restore targetId must be 2-63 lowercase letters, numbers, or dashes.")}return this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:a,kind:"data_service.action",input:{serviceId:e.id,action:t,...r},lockKey:`data-service:${e.id}`,providerKey:e.provider,maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"}).operation.id}async rotate(e,t,r){let a=this.store.credential(e.id);if(!a)throw Error("Data service credential metadata was not found.");let g=ov(),f=`${a.secretRef}/v${a.version+1}`;await this.secrets.put(f,g);try{return await t.action(e,"rotate",{username:a.username,secretRef:f},g,r),this.store.saveCredential(e.id,a.username,f),this.store.update(e.id,e.version,{credentialRef:f}),{credential:{username:a.username,password:g,secretRef:f},dependencies:this.store.dependencies(e.id).filter((h)=>h.requiresRedeploy).map((h)=>h.resourceId)}}catch(h){throw await this.secrets.remove(f),h}}}function Uu(e){return{"data_service.action":async(t)=>{let r=t.operation.input,a=e.store.get(String(r.serviceId??"")),g=String(r.action??"");if(!a)throw Error("Data service was not found.");let f=e.resolveAdapter(a);if(!f||f.provider!==a.provider||!f.engines.includes(a.engine))throw Error(`No ${a.provider}/${a.engine} adapter is configured.`);if(g==="rotate"){let b=await new ys(e.store,new c(e.store.controlPlane),e.secrets).rotate(a,f,t);return{serviceId:a.id,action:g,username:b.credential.username,secretRef:b.credential.secretRef,dependencies:b.dependencies}}let h=a.credentialRef?await e.secrets.resolve(a.credentialRef):void 0;try{let b=g==="observe"?await f.observe(a):g==="create"?await f.apply(a,h,t):await f.action(a,g,r,h,t),S=e.store.get(a.id);return e.store.update(a.id,S.version,{observedState:b,status:g==="delete"?r.retention==="retain"?"retained":"deleting":"available"}),{serviceId:a.id,action:g,observed:b}}catch(b){let S=e.store.get(a.id);if(e.store.update(a.id,S.version,{status:"failed",observedState:{...S.observedState,error:b instanceof Error?b.message:String(b)}}),/temporar|timeout|unavailable|throttl/i.test(b instanceof Error?b.message:String(b)))throw new ce(b instanceof Error?b.message:String(b),"provider_transient");throw b}}}}class os{transport;constructor(e){this.transport=e}observe(e){return this.transport.observe(e.placement)}apply(e,t){return this.transport.apply({id:e.placement,name:e.name,engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,storageGb:e.storageGb??null,highAvailability:e.highAvailability,publicExposure:e.publicExposure,allowedCidrs:e.allowedCidrs,username:e.desiredState.username??"app",desiredState:e.desiredState},t)}action(e,t,r,a,g){return this.transport.execute(e.placement,t,{engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,desiredState:e.desiredState,...r},a,g)}}class Ba extends os{provider="aws_rds";engines=["postgres","mysql","mariadb"]}class xa extends os{provider="aws_aurora";engines=["postgres","mysql"]}class Oa extends os{provider="aws_elasticache";engines=["redis"]}class _a extends os{provider="server";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}class La extends os{provider="container";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}var $d=(e,t)=>{let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)},Jt=(e,t,r)=>{let a=$d(e,t);return a==null?r:String(a)},nn=(e,t)=>{let r=$d(e,t);return r==null?void 0:Number(r)},$i=(e,t)=>{let r=$d(e,t);return r==null?void 0:r===!0||r==="true"},ss=(e,t)=>{let r=$d(e,t);return Array.isArray(r)?r.map(String):[]},Od=(e,t)=>Jt(t,"snapshotId")??`${e}-final-${new Date().toISOString().replace(/[^0-9]/g,"").slice(0,14)}`;function xd(e){if(!e)throw Error("RDS instance was not found.");return{providerId:e.DBInstanceIdentifier??null,status:e.DBInstanceStatus??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,plan:e.DBInstanceClass??null,storageGb:e.AllocatedStorage??null,highAvailability:e.MultiAZ??!1,publicExposure:e.PubliclyAccessible??!1,endpoint:e.Endpoint?.Address??null,port:e.Endpoint?.Port??null,username:e.MasterUsername??null,database:e.DBName??null,encrypted:e.StorageEncrypted??!1}}class $a{client;constructor(e=new ne){this.client=e}async observe(e){return xd(await this.client.describeDBInstance(e))}async apply(e,t){let r=String(e.id),a=await this.client.createDBInstance({DBInstanceIdentifier:r,DBInstanceClass:String(e.plan),Engine:String(e.engine),MasterUsername:Jt(e,"username","app"),MasterUserPassword:t,DBName:Jt(e,"database"),AllocatedStorage:nn(e,"storageGb"),VpcSecurityGroupIds:ss(e,"securityGroupIds"),DBSubnetGroupName:Jt(e,"subnetGroup"),BackupRetentionPeriod:nn(e,"backupRetentionDays")??7,MultiAZ:$i(e,"highAvailability"),EngineVersion:Jt(e,"engineVersion"),PubliclyAccessible:$i(e,"publicExposure")??!1,StorageType:Jt(e,"storageType","gp3"),StorageEncrypted:!0,KmsKeyId:Jt(e,"kmsKeyId"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return xd(a.DBInstance)}async execute(e,t,r,a,g){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBInstance({DBInstanceIdentifier:e}),{status:"rebooting"};if(t==="backup"){let f=Od(e,r);return await this.client.createDBSnapshot({DBInstanceIdentifier:e,DBSnapshotIdentifier:f}),{status:"snapshotting",snapshotId:f}}if(t==="restore"){let f=String(r.targetId),h=await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:f,DBSnapshotIdentifier:String(r.backupId),DBInstanceClass:Jt(r,"plan"),DBSubnetGroupName:Jt(r,"subnetGroup"),MultiAZ:$i(r,"highAvailability"),PubliclyAccessible:!1,StorageType:Jt(r,"storageType"),VpcSecurityGroupIds:ss(r,"securityGroupIds"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{...xd(h.DBInstance),sourceId:e,restoreTargetId:f}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let f=Od(e,r);return await this.client.modifyDBInstance({DBInstanceIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:e,SkipFinalSnapshot:!1,FinalDBSnapshotIdentifier:f,DeleteAutomatedBackups:!1}),{status:"deleting",finalSnapshotId:f}}if(["resize","version","rotate","expose"].includes(t)){let f=await this.client.modifyDBInstance({DBInstanceIdentifier:e,DBInstanceClass:Jt(r,"plan"),AllocatedStorage:nn(r,"storageGb"),MasterUserPassword:t==="rotate"?a:void 0,EngineVersion:Jt(r,"engineVersion"),MultiAZ:$i(r,"highAvailability"),PubliclyAccessible:$i(r,"publicExposure"),VpcSecurityGroupIds:ss(r,"securityGroupIds"),ApplyImmediately:$i(r,"applyImmediately")??!0});return xd(f.DBInstance)}throw Error(`RDS action ${t} requires an engine connection runner.`)}}function Kp(e){if(!e)throw Error("Aurora cluster was not found.");return{providerId:e.DBClusterIdentifier??null,status:e.Status??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,endpoint:e.Endpoint??null,readerEndpoint:e.ReaderEndpoint??null,port:e.Port??null,username:e.MasterUsername??null,database:e.DatabaseName??null,encrypted:e.StorageEncrypted??!1,highAvailability:e.MultiAZ??!0}}class Ma{client;constructor(e=new ne){this.client=e}async observe(e){let t=await this.client.describeDBClusters({DBClusterIdentifier:e});return Kp(t.DBClusters?.[0])}async apply(e,t){let r=String(e.id),a=String(e.engine)==="postgres"?"aurora-postgresql":"aurora-mysql";return await this.client.createDBCluster({DBClusterIdentifier:r,Engine:a,EngineVersion:Jt(e,"engineVersion"),MasterUsername:Jt(e,"username","app"),MasterUserPassword:t,DatabaseName:Jt(e,"database"),DBSubnetGroupName:Jt(e,"subnetGroup"),VpcSecurityGroupIds:ss(e,"securityGroupIds"),BackupRetentionPeriod:nn(e,"backupRetentionDays")??7,StorageEncrypted:!0,KmsKeyId:Jt(e,"kmsKeyId"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:nn(e,"minCapacity")??0.5,MaxCapacity:nn(e,"maxCapacity")??4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${r}-writer-1`,DBClusterIdentifier:r,DBInstanceClass:String(e.plan||"db.serverless"),Engine:a,PubliclyAccessible:$i(e,"publicExposure")??!1}),{status:"creating",providerId:r}}async execute(e,t,r,a){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBCluster(e),{status:"rebooting"};if(t==="backup"){let g=Od(e,r);return await this.client.createDBClusterSnapshot(e,g),{status:"snapshotting",snapshotId:g}}if(t==="restore"){let g=String(r.targetId),f=String(r.engine)==="postgres"?"aurora-postgresql":"aurora-mysql",h=await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:g,SnapshotIdentifier:String(r.backupId),Engine:f,EngineVersion:Jt(r,"engineVersion"),DBSubnetGroupName:Jt(r,"subnetGroup"),VpcSecurityGroupIds:ss(r,"securityGroupIds"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:nn(r,"minCapacity")??0.5,MaxCapacity:nn(r,"maxCapacity")??4}});return await this.client.createDBInstance({DBInstanceIdentifier:`${g}-writer-1`,DBClusterIdentifier:g,DBInstanceClass:Jt(r,"plan","db.serverless"),Engine:f,PubliclyAccessible:!1}),{...Kp(h.DBCluster),sourceId:e,restoreTargetId:g}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let g=Od(e,r);return await this.client.modifyDBCluster({DBClusterIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(e,g),{status:"deleting",finalSnapshotId:g}}if(["resize","version","rotate"].includes(t)){let g=await this.client.modifyDBCluster({DBClusterIdentifier:e,ServerlessV2ScalingConfiguration:nn(r,"minCapacity")==null&&nn(r,"maxCapacity")==null?void 0:{MinCapacity:nn(r,"minCapacity")??0.5,MaxCapacity:nn(r,"maxCapacity")??4},EngineVersion:Jt(r,"engineVersion"),MasterUserPassword:t==="rotate"?a:void 0,ApplyImmediately:$i(r,"applyImmediately")??!0});return Kp(g.DBCluster)}throw Error(`Aurora action ${t} requires an engine connection runner.`)}}class Fa{client;constructor(e=new pt){this.client=e}async observe(e){let t=(await this.client.describeCacheClusters(e)).CacheClusters[0];if(!t)throw Error("ElastiCache cluster was not found.");let r=t.CacheNodes?.[0]?.Endpoint;return{providerId:t.CacheClusterId,status:t.CacheClusterStatus,engine:t.Engine,engineVersion:t.EngineVersion,plan:t.CacheNodeType,nodes:t.NumCacheNodes,endpoint:r?.Address??null,port:r?.Port??null}}async apply(e){let t=await this.client.createCacheCluster({cacheClusterId:String(e.id),engine:"redis",cacheNodeType:String(e.plan),numCacheNodes:nn(e,"nodes")??1,engineVersion:Jt(e,"engineVersion"),port:nn(e,"port"),securityGroupIds:ss(e,"securityGroupIds"),subnetGroupName:Jt(e,"subnetGroup"),tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{providerId:t.CacheCluster.CacheClusterId,status:t.CacheCluster.CacheClusterStatus}}async execute(e,t,r){if(t==="observe")return this.observe(e);if(t==="restart"){let a=(await this.client.describeCacheClusters(e)).CacheClusters[0];return await this.client.rebootCacheCluster(e,a?.CacheNodes?.map((g)=>g.CacheNodeId)??["0001"]),{status:"rebooting"}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};return await this.client.deleteCacheCluster(e),{status:"deleting"}}throw Error(`ElastiCache action ${t} is not supported by this cluster mode.`)}}import{mkdir as KR,writeFile as JR}from"node:fs/promises";import{join as GR}from"node:path";async function ln(e,t,r=!1){let a=Bun.spawn(["docker",...e],{stdin:t==null?"ignore":"pipe",stdout:"pipe",stderr:"pipe"}),g=new Response(a.stdout).text(),f=new Response(a.stderr).text();if(t!=null)a.stdin.write(t),a.stdin.end();let[h,b,S]=await Promise.all([a.exited,g,f]);if(h!==0&&!r)throw Error(`Docker command failed (${h}): ${S.trim()||b.trim()}`);return{code:h,stdout:b,stderr:S}}class Qu{async ensureNetwork(e){if((await ln(["network","inspect",e],void 0,!0)).code!==0)await ln(["network","create","--internal",e])}async seedSecret(e,t){await ln(["volume","create",e]),await ln(["run","--rm","-i","-v",`${e}:/run/target`,"alpine:3.21","sh","-c","umask 077; cat > /run/target/credential"],t)}async removeVolume(e){await ln(["volume","rm",e],void 0,!0)}async inspect(e){let t=await ln(["inspect",e],void 0,!0);if(t.code!==0)return;return JSON.parse(t.stdout)[0]}async run(e){await ln(["run",...e])}async exec(e,t,r){return(await ln(["exec","-i",e,...t],r)).stdout}async update(e,t){await ln(["update",...t,e])}async restart(e){await ln(["restart",e])}async remove(e){await ln(["rm","--force",e],void 0,!0)}async logs(e,t){let r=await ln(["logs","--tail",String(Math.min(2000,Math.max(1,t))),e],void 0,!0);return`${r.stdout}${r.stderr}`.slice(-262144)}async stats(e){let t=await ln(["stats","--no-stream","--format","{{json .}}",e],void 0,!0);if(t.code!==0||!t.stdout.trim())return{};let r=JSON.parse(t.stdout.trim());return{cpuPercent:String(r.CPUPerc??""),memoryUsage:String(r.MemUsage??""),memoryPercent:String(r.MemPerc??""),networkIo:String(r.NetIO??""),blockIo:String(r.BlockIO??""),pids:Number(r.PIDs??0)}}}var QR={postgres:{image:"postgres:17-alpine",port:5432,dataPath:"/var/lib/postgresql/data"},mysql:{image:"mysql:8.4",port:3306,dataPath:"/var/lib/mysql"},mariadb:{image:"mariadb:11.7",port:3306,dataPath:"/var/lib/mysql"},redis:{image:"redis:7.4-alpine",port:6379,dataPath:"/data"},mongodb:{image:"mongo:8.0",port:27017,dataPath:"/data/db"}};function hi(e,t="app"){let r=String(e??t);if(!/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(r))throw Error("Database identifiers must be letters, numbers, or underscores.");return r}function go(e){if(!/^[a-z0-9][a-z0-9_.-]{1,62}$/i.test(e))throw Error("Runtime placement must be a valid container identifier.");return`tscloud-data-${e.toLowerCase()}`}function YR(e,t){let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)}function oa(e){return e.Config?.Labels??{}}class Ir{runtime;backupRoot;constructor(e=new Qu,t=l(process.cwd(),"backups","data")){this.runtime=e;this.backupRoot=t}async observe(e){let t=go(e),r=await this.runtime.inspect(t);if(!r)throw Error(`Data container ${t} was not found.`);let a=oa(r),g=await this.runtime.stats(t),f=r.NetworkSettings?.Ports??{},h=Object.values(f).flat().find(Boolean);return{providerId:t,status:r.State?.Status??"unknown",healthy:r.State?.Health?.Status??null,engine:a["ts-cloud.engine"]??null,engineVersion:a["ts-cloud.engine-version"]??null,username:a["ts-cloud.username"]??null,database:a["ts-cloud.database"]??null,endpoint:h?.HostIp||"127.0.0.1",port:h?.HostPort?Number(h.HostPort):null,image:r.Config?.Image??null,startedAt:r.State?.StartedAt??null,metrics:g}}async apply(e,t){let r=String(e.id),a=go(r),g=String(e.engine);if(g==="libsql")throw Error("libSQL requires an explicitly configured runtime image.");let f=QR[g];if(!f)throw Error(`Unsupported runtime data engine ${g}.`);if(!t)throw Error(`${g} requires a managed credential.`);if(e.publicExposure===!0)throw Error("Container public exposure requires an external reviewed firewall policy; direct publishing is refused.");let h=hi(e.username),b=hi(YR(e,"database")),S=`${a}-secret`,y=`${a}-data`,k=g==="redis"?`appendonly yes
 protected-mode yes
 requirepass ${t.replaceAll("\\","\\\\").replaceAll(`
 `,"")}
@@ -163,7 +163,7 @@ ${h}},
 ${y}// Deploy onto the box '${r}' owns rather than provisioning one.
 ${y}attachTo: '${r}',
 ${h}},
-`))}import{createHash as hA}from"node:crypto";function yA(e){return hA("sha256").update(fo(e)).digest("hex")}function fo(e){if(Array.isArray(e))return`[${e.map((t)=>fo(t)).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0&&typeof t!=="function").sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${fo(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function v(e,t){let r=`dashboard:${t.username.toLowerCase()}`;return e.getActorByExternalId("user",r)??e.createActor({kind:"user",externalId:r,displayName:t.name??t.username,metadata:{source:"dashboard",role:t.role}})}function ig(e,t){let r=new Li({cwd:e}),a=yA(t),g=r.getProjectBySlug(t.project.slug),f=t.project.slug.length>=3?t.project.slug:`${t.project.slug}-org`,h=(g?.organizationId?r.getOrganization(g.organizationId):void 0)??r.getOrganizationBySlug(f)??r.createOrganization({id:g?.organizationId,slug:f,name:t.project.name}),b=g?g.name!==t.project.name||g.desiredConfigHash!==a||g.organizationId!==h.id?r.updateProject(g.id,g.version,{name:t.project.name,organizationId:h.id,desiredConfigHash:a}):g:r.createProject({organizationId:h.id,slug:t.project.slug,name:t.project.name,desiredConfigHash:a}),S=new Map;for(let[D,O]of Object.entries(t.environments??{})){let z=r.getEnvironmentBySlug(b.id,D)??r.createEnvironment({projectId:b.id,slug:D,name:D.replace(/(^|[-_])(\w)/g,(te,ye,Se)=>Se.toUpperCase()),kind:String(O?.type??D),region:O?.region??t.project.region,desiredState:s(O)});S.set(D,z);let J=new Map(r.listResources(b.id,z.id).map((te)=>[`${te.kind}:${te.slug}`,te])),Z=(te,ye,Se,ie)=>{let xe=`${te}:${ye}`,ee=J.get(xe),De=s(ie);if(ee){if(ee.name!==Se||fo(ee.desiredState)!==fo(De))J.set(xe,r.updateResource(ee.id,ee.version,{name:Se,desiredState:De}));return}let Je=r.createResource({projectId:b.id,environmentId:z.id,kind:te,slug:ye,name:Se,provider:t.cloud?.provider,desiredState:De,metadata:{source:"cloud-config"}});J.set(xe,Je)};for(let[te,ye]of Object.entries(t.sites??{}))Z("application",te,te,ye);let oe=O?.app;if(oe)for(let te of["http","queue","cli"])Z("function",te,`${te.toUpperCase()} function`,{...s(oe),function:te});let G=t.infrastructure;for(let[te,ye]of Object.entries(G?.functions??{}))Z("function",te,te,ye);if(G?.compute)Z("server",`${b.slug}-server`,b.name,{...s(G.compute),label:b.name});for(let[te,ye]of Object.entries(G?.databases??{}))Z("database",te,te,ye);if(G?.appDatabase)Z("database","application-database","Application database",G.appDatabase);else if(G?.database)Z("database","application-database","Application database",{engine:G.database})}let y=new c(r).recoverExpired(),k=r.reconcileOrphanedOperations({policy:"fail"}),R={requeued:y.requeued+k.requeued,failed:y.failed+y.cancelled+k.failed};return{store:r,organization:h,project:b,environments:S,reconciliation:R}}var vA=["project:read","config:read","deployments:read","deployments:create","runtime:read","runtime:logs"];function Cs(e,t){let{store:r,organization:a,project:g}=e,f=new Set;for(let h of t){let b=v(r,h);f.add(b.id);let S=r.getMembershipForActor(a.id,b.id);if(S&&S.source!=="legacy")continue;let y=r.listResources(g.id).filter((M)=>M.kind==="application"&&Object.hasOwn(h.sites,M.slug)),k=h.role==="admin"?"owner":"viewer",R=h.role==="admin"||y.length===0?{type:"organization"}:{type:"resource",id:y[0].id},D=S?S.roleTemplate!==k||fo(S.scope)!==fo(R)?r.updateMembership({id:S.id,roleTemplate:k,scope:R,actorId:b.id}):S:r.createMembership({organizationId:a.id,actorId:b.id,roleTemplate:k,scope:R,source:"legacy"}),O=new Set;if(h.role==="member"&&y.length===0)for(let M of nr("viewer"))O.add(`deny|${M}|organization|`);for(let M of y){let z=h.sites[M.slug];for(let J of vA)O.add(`allow|${J}|resource|${M.id}`);if(z==="owner")O.add(`allow|config:write|resource|${M.id}`)}for(let M of r.listGrants(D.id).filter((z)=>z.source==="legacy")){let z=`${M.effect}|${M.capability}|${M.scope.type}|${M.scope.id??""}`;if(!O.has(z))r.removeGrant(M.id,b.id)}for(let M of O){let[z,J,Z,oe]=M.split("|");r.upsertGrant({organizationId:a.id,membershipId:D.id,effect:z,capability:J,scope:Z==="organization"?{type:"organization"}:{type:Z,id:oe},source:"legacy"})}}for(let h of r.listMemberships(a.id))if(h.source==="legacy"&&!f.has(h.actorId))r.revokeMembership(h.id)}async function Me(e){let{controlPlane:t,environment:r,actor:a}=e,g=v(t.store,a),f=t.environments.get(r),h=e.resourceSlug&&f?t.store.listResources(t.project.id,f.id).find((k)=>k.slug===e.resourceSlug):void 0,b=new c(t.store,{workerId:`dashboard:${process.pid}`}),S=b.enqueue({projectId:t.project.id,environmentId:f?.id,resourceId:h?.id,actorId:g.id,kind:e.kind,input:e.input??{},lockKey:h?`resource:${h.id}`:f?`environment:${f.id}`:`project:${t.project.id}`,providerKey:h?.provider??"dashboard",buildSlot:e.kind.includes("deploy"),maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!b.claim(S.id)?.operation)throw Error(`Could not claim control-plane operation ${S.id}`);try{let k=await e.execute(),R=typeof k.stdout==="string"?String(k.stdout):"",D=typeof k.stderr==="string"?String(k.stderr):"";if(R)b.appendLog(S.id,R,{stream:"stdout"});if(D)b.appendLog(S.id,D,{stream:"stderr"});let O=k.ok?b.complete(S.id,Iv(k)):b.fail(S.id,bA(k),Iv(k));return{result:k,operation:O}}catch(k){throw b.fail(S.id,k instanceof Error?k.message:String(k),{ok:!1,threw:!0}),k}}function bA(e){let t=e;return String(t.error??t.stderr??"Operation failed")}function Iv(e){let t=e,r=typeof t.stdout==="string"?t.stdout:"",a=typeof t.stderr==="string"?t.stderr:"",g={ok:e.ok,stdoutBytes:Buffer.byteLength(r),stderrBytes:Buffer.byteLength(a)};if(typeof t.operation==="string")g.operation=t.operation;if(typeof t.error==="string")g.error=t.error;return s(g)}var sg=[{id:"server.overview",path:"/",label:"Dashboard",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/server"]},{id:"server.activity",path:"/server/activity",label:"Activity",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/activity"]},{id:"services.list",path:"/server/sites",label:"Services",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/sites","/services"]},{id:"deployments.list",path:"/server/deployments",label:"Deployments",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/deployments"]},{id:"logs.list",path:"/server/logs",label:"Logs",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/logs"]},{id:"sources.integrations",path:"/integrations",label:"Git integrations",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.create",path:"/applications/new",label:"Create application",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.compose",path:"/applications/compose",label:"Compose applications",group:"applications",modes:["server"],adminOnly:!1},{id:"operations.queue",path:"/operations/queue",label:"Deployment queue",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.previews",path:"/operations/previews",label:"Preview environments",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.releases",path:"/operations/releases",label:"Releases & promotion",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"runtime.workloads",path:"/operations/workloads",label:"Workloads",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"observability.overview",path:"/operations/observability",label:"Observability",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"alerts.overview",path:"/operations/alerts",label:"Alerts & health",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"spend.overview",path:"/operations/spend",label:"Spend & budgets",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"automation.jobs",path:"/operations/jobs",label:"Workers & schedules",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/workers","/serverless/scheduler"]},{id:"configuration.entries",path:"/operations/configuration",label:"Environment & secrets",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/serverless/secrets"]},{id:"metrics.overview",path:"/server/metrics",label:"Metrics",group:"operations",modes:["server"],adminOnly:!0},{id:"runtime.services",path:"/server/services",label:"Runtime services",group:"operations",modes:["server"],adminOnly:!0},{id:"backups.list",path:"/data/backups",label:"Backups & recovery",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/backups"]},{id:"volumes.list",path:"/data/volumes",label:"Persistent volumes",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:[]},{id:"fleet.list",path:"/server/fleet",label:"Fleet inventory",group:"operations",modes:["server"],adminOnly:!1,legacyPaths:[]},{id:"operations.run",path:"/server/actions",label:"Run operations",group:"operations",modes:["server"],adminOnly:!0},{id:"infrastructure.topology",path:"/infrastructure/topology",label:"Infrastructure map",group:"infrastructure",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/topology"]},{id:"data.services",path:"/data/services",label:"Data services",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/database","/databases","/server/database","/serverless/data"]},{id:"network.firewall",path:"/server/firewall",label:"Network & firewall",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"security.posture",path:"/security",label:"Security posture",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/security"]},{id:"access.ssh",path:"/server/ssh-keys",label:"SSH keys",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"runtime.terminal",path:"/server/terminal",label:"Terminal",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"organization.people",path:"/server/team",label:"People & access",group:"organization",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/team"]},{id:"organization.automation",path:"/account/automation",label:"API & automation",group:"organization",modes:["server","serverless"],adminOnly:!0},{id:"serverless.overview",path:"/serverless",label:"Dashboard",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.deployments",path:"/serverless/deployments",label:"Deployments",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.logs",path:"/serverless/logs",label:"Logs",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.metrics",path:"/serverless/metrics",label:"Metrics",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.traces",path:"/serverless/traces",label:"Traces",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.functions",path:"/serverless/functions",label:"Functions",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.queues",path:"/serverless/queues",label:"Queues",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.assets",path:"/serverless/assets",label:"Assets",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.network",path:"/serverless/firewall",label:"Network",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.alerts",path:"/serverless/alarms",label:"Alerts",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.cost",path:"/serverless/cost",label:"Costs",group:"settings",modes:["serverless"],adminOnly:!0}],SA=new Map(sg.flatMap((e)=>(e.legacyPaths??[]).map((t)=>[t,e.path])));function og(e){return SA.get(e)}function jS(e,t){return sg.filter((r)=>r.modes.includes(e)&&(!t||!r.adminOnly))}var Bd=()=>{};async function ag(e,t=Bd){for(let r of e){let a=new o(r.replicaRegion),g;try{g=await a.headBucket(r.replicaBucket)}catch(f){if(f?.statusCode===301)throw Error(`Failover replica bucket ${r.replicaBucket} already exists outside ${r.replicaRegion}. Pick another failover.bucket or region for infrastructure.storage.${r.name}.`);if(f?.statusCode===403)throw Error(`Failover replica bucket ${r.replicaBucket} exists but this account cannot reach it (S3 names are global, so another account may own it). Set infrastructure.storage.${r.name}.failover.bucket to a name you own.`);throw f}if(g.exists&&g.region&&g.region!==r.replicaRegion)throw Error(`Failover replica bucket ${r.replicaBucket} is in ${g.region}, not ${r.replicaRegion}.`);if(!g.exists)t(`Creating failover replica bucket ${r.replicaBucket} in ${r.replicaRegion}`),await a.createBucket(r.replicaBucket);if(await a.putPublicAccessBlock(r.replicaBucket,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!0,RestrictPublicBuckets:!0}),await a.putBucketEncryption(r.replicaBucket,"AES256"),r.replicate){if((await a.getBucketVersioning(r.replicaBucket)).Status!=="Enabled")t(`Enabling versioning on ${r.replicaBucket} (S3 replication requires it)`),await a.putBucketVersioning(r.replicaBucket,"Enabled")}}}async function cg(e,t,r=Bd){for(let a of e){let g=t[a.distributionArnOutput];if(!g)throw Error(`Stack output ${a.distributionArnOutput} is missing, so the failover replica ${a.replicaBucket} cannot be scoped to its distribution.`);let f=new o(a.replicaRegion),S={Version:"2012-10-17",Statement:[...((await f.getBucketPolicy(a.replicaBucket))?.Statement??[]).filter((y)=>y?.Sid!==Vo),gl({replicaBucket:a.replicaBucket,distributionArn:g})]};r(`Granting ${g} read access to ${a.replicaBucket}`),await f.putBucketPolicy(a.replicaBucket,S)}}async function dg(e,t=Bd){let r={};for(let a of e){let g=new o(a.primaryRegion),f=new o(a.replicaRegion),[h,b]=await Promise.all([g.listAllObjects({bucket:a.primaryBucket}),f.listAllObjects({bucket:a.replicaBucket})]),S=new Map(b.map((k)=>[k.Key,k.Size])),y=h.filter((k)=>S.get(k.Key)!==k.Size);for(let k of y)await f.copyObject({sourceBucket:a.primaryBucket,sourceKey:k.Key,destinationBucket:a.replicaBucket,destinationKey:k.Key});if(y.length>0)t(`Copied ${y.length} object(s) from ${a.primaryBucket} to ${a.replicaBucket}`);r[a.replicaBucket]=y.length}return r}async function lg(e,t=Bd){for(let r of e){let a=new o(r.replicaRegion);if(!(await a.headBucket(r.replicaBucket)).exists)continue;await a.emptyBucket(r.replicaBucket),await a.deleteBucket(r.replicaBucket),t(`Deleted failover replica bucket ${r.replicaBucket}`)}}import Mi from"node:process";import{existsSync as wA}from"node:fs";import{join as kA}from"node:path";async function ug(e){let t=Date.now(),r=e.sourceDir??"dist";if(!wA(kA(r,"index.html")))return Eg(t,`${r}/ has no index.html — build first.`);if(!Mi.env.AWS_ACCESS_KEY_ID||!Mi.env.AWS_SECRET_ACCESS_KEY)return Eg(t,"Missing AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY in env.");let a=IA(e.dnsProvider);if("error"in a)return Eg(t,a.error);let g=await $n({siteName:e.siteName,region:e.region??"us-east-1",domain:e.domain,bucket:e.bucket,stackName:e.stackName,certificateArn:e.certificateArn,defaultRootObject:e.defaultRootObject??"index.html",errorDocument:e.errorDocument??"404.html",cacheControl:e.cacheControl??"max-age=3600, public",sourceDir:r,cleanBucket:e.cleanBucket??!1,singlePageApp:e.singlePageApp??!1,dnsProvider:a,tags:{ManagedBy:"ts-cloud",Application:e.siteName,...e.tags},onProgress:e.onProgress});return{success:!!g.success,domain:g.domain,url:g.domain?`https://${g.domain}`:g.distributionDomain?`https://${g.distributionDomain}`:void 0,bucket:g.bucket,distributionId:g.distributionId,distributionDomain:g.distributionDomain,certificateArn:g.certificateArn,filesUploaded:g.filesUploaded,filesSkipped:g.filesSkipped,message:g.message,durationMs:Date.now()-t}}function IA(e){let t=typeof e==="string"?{provider:e}:e??{provider:"porkbun"};if(t.provider==="porkbun"){let r=t,a=r?.apiKey??Mi.env.PORKBUN_API_KEY,g=r?.secretKey??Mi.env.PORKBUN_SECRET_KEY??Mi.env.PORKBUN_SECRET_API_KEY;if(!a||!g)return{error:"Missing PORKBUN_API_KEY / PORKBUN_SECRET_KEY in env."};return{provider:"porkbun",apiKey:a,secretKey:g}}if(t.provider==="godaddy"){let r=t,a=r?.apiKey??Mi.env.GODADDY_API_KEY,g=r?.secretKey??Mi.env.GODADDY_API_SECRET,f=r?.environment??Mi.env.GODADDY_ENVIRONMENT;if(!a||!g)return{error:"Missing GODADDY_API_KEY / GODADDY_API_SECRET in env."};return{provider:"godaddy",apiKey:a,apiSecret:g,environment:f}}return{error:`Unsupported DNS provider: ${t.provider}`}}function Eg(e,t){return{success:!1,message:t,durationMs:Date.now()-e}}import{createHash as EA}from"node:crypto";var RA=`let coldStart = true
+`))}import{createHash as hA}from"node:crypto";function yA(e){return hA("sha256").update(fo(e)).digest("hex")}function fo(e){if(Array.isArray(e))return`[${e.map((t)=>fo(t)).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0&&typeof t!=="function").sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${fo(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function v(e,t){let r=`dashboard:${t.username.toLowerCase()}`;return e.getActorByExternalId("user",r)??e.createActor({kind:"user",externalId:r,displayName:t.name??t.username,metadata:{source:"dashboard",role:t.role}})}function ig(e,t){let r=new Li({cwd:e}),a=yA(t),g=r.getProjectBySlug(t.project.slug),f=t.project.slug.length>=3?t.project.slug:`${t.project.slug}-org`,h=(g?.organizationId?r.getOrganization(g.organizationId):void 0)??r.getOrganizationBySlug(f)??r.createOrganization({id:g?.organizationId,slug:f,name:t.project.name}),b=g?g.name!==t.project.name||g.desiredConfigHash!==a||g.organizationId!==h.id?r.updateProject(g.id,g.version,{name:t.project.name,organizationId:h.id,desiredConfigHash:a}):g:r.createProject({organizationId:h.id,slug:t.project.slug,name:t.project.name,desiredConfigHash:a}),S=new Map;for(let[D,O]of Object.entries(t.environments??{})){let z=r.getEnvironmentBySlug(b.id,D)??r.createEnvironment({projectId:b.id,slug:D,name:D.replace(/(^|[-_])(\w)/g,(te,ye,be)=>be.toUpperCase()),kind:String(O?.type??D),region:O?.region??t.project.region,desiredState:s(O)});S.set(D,z);let J=new Map(r.listResources(b.id,z.id).map((te)=>[`${te.kind}:${te.slug}`,te])),Z=(te,ye,be,ie)=>{let _e=`${te}:${ye}`,ee=J.get(_e),xe=s(ie);if(ee){if(ee.name!==be||fo(ee.desiredState)!==fo(xe))J.set(_e,r.updateResource(ee.id,ee.version,{name:be,desiredState:xe}));return}let Je=r.createResource({projectId:b.id,environmentId:z.id,kind:te,slug:ye,name:be,provider:t.cloud?.provider,desiredState:xe,metadata:{source:"cloud-config"}});J.set(_e,Je)};for(let[te,ye]of Object.entries(t.sites??{}))Z("application",te,te,ye);let oe=O?.app;if(oe)for(let te of["http","queue","cli"])Z("function",te,`${te.toUpperCase()} function`,{...s(oe),function:te});let G=t.infrastructure;for(let[te,ye]of Object.entries(G?.functions??{}))Z("function",te,te,ye);if(G?.compute)Z("server",`${b.slug}-server`,b.name,{...s(G.compute),label:b.name});for(let[te,ye]of Object.entries(G?.databases??{}))Z("database",te,te,ye);if(G?.appDatabase)Z("database","application-database","Application database",G.appDatabase);else if(G?.database)Z("database","application-database","Application database",{engine:G.database})}let y=new c(r).recoverExpired(),k=r.reconcileOrphanedOperations({policy:"fail"}),R={requeued:y.requeued+k.requeued,failed:y.failed+y.cancelled+k.failed};return{store:r,organization:h,project:b,environments:S,reconciliation:R}}var vA=["project:read","config:read","deployments:read","deployments:create","runtime:read","runtime:logs"];function Cs(e,t){let{store:r,organization:a,project:g}=e,f=new Set;for(let h of t){let b=v(r,h);f.add(b.id);let S=r.getMembershipForActor(a.id,b.id);if(S&&S.source!=="legacy")continue;let y=r.listResources(g.id).filter((M)=>M.kind==="application"&&Object.hasOwn(h.sites,M.slug)),k=h.role==="admin"?"owner":"viewer",R=h.role==="admin"||y.length===0?{type:"organization"}:{type:"resource",id:y[0].id},D=S?S.roleTemplate!==k||fo(S.scope)!==fo(R)?r.updateMembership({id:S.id,roleTemplate:k,scope:R,actorId:b.id}):S:r.createMembership({organizationId:a.id,actorId:b.id,roleTemplate:k,scope:R,source:"legacy"}),O=new Set;if(h.role==="member"&&y.length===0)for(let M of nr("viewer"))O.add(`deny|${M}|organization|`);for(let M of y){let z=h.sites[M.slug];for(let J of vA)O.add(`allow|${J}|resource|${M.id}`);if(z==="owner")O.add(`allow|config:write|resource|${M.id}`)}for(let M of r.listGrants(D.id).filter((z)=>z.source==="legacy")){let z=`${M.effect}|${M.capability}|${M.scope.type}|${M.scope.id??""}`;if(!O.has(z))r.removeGrant(M.id,b.id)}for(let M of O){let[z,J,Z,oe]=M.split("|");r.upsertGrant({organizationId:a.id,membershipId:D.id,effect:z,capability:J,scope:Z==="organization"?{type:"organization"}:{type:Z,id:oe},source:"legacy"})}}for(let h of r.listMemberships(a.id))if(h.source==="legacy"&&!f.has(h.actorId))r.revokeMembership(h.id)}async function Me(e){let{controlPlane:t,environment:r,actor:a}=e,g=v(t.store,a),f=t.environments.get(r),h=e.resourceSlug&&f?t.store.listResources(t.project.id,f.id).find((k)=>k.slug===e.resourceSlug):void 0,b=new c(t.store,{workerId:`dashboard:${process.pid}`}),S=b.enqueue({projectId:t.project.id,environmentId:f?.id,resourceId:h?.id,actorId:g.id,kind:e.kind,input:e.input??{},lockKey:h?`resource:${h.id}`:f?`environment:${f.id}`:`project:${t.project.id}`,providerKey:h?.provider??"dashboard",buildSlot:e.kind.includes("deploy"),maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!b.claim(S.id)?.operation)throw Error(`Could not claim control-plane operation ${S.id}`);try{let k=await e.execute(),R=typeof k.stdout==="string"?String(k.stdout):"",D=typeof k.stderr==="string"?String(k.stderr):"";if(R)b.appendLog(S.id,R,{stream:"stdout"});if(D)b.appendLog(S.id,D,{stream:"stderr"});let O=k.ok?b.complete(S.id,Iv(k)):b.fail(S.id,bA(k),Iv(k));return{result:k,operation:O}}catch(k){throw b.fail(S.id,k instanceof Error?k.message:String(k),{ok:!1,threw:!0}),k}}function bA(e){let t=e;return String(t.error??t.stderr??"Operation failed")}function Iv(e){let t=e,r=typeof t.stdout==="string"?t.stdout:"",a=typeof t.stderr==="string"?t.stderr:"",g={ok:e.ok,stdoutBytes:Buffer.byteLength(r),stderrBytes:Buffer.byteLength(a)};if(typeof t.operation==="string")g.operation=t.operation;if(typeof t.error==="string")g.error=t.error;return s(g)}var sg=[{id:"server.overview",path:"/",label:"Dashboard",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/server"]},{id:"server.activity",path:"/server/activity",label:"Activity",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/activity"]},{id:"services.list",path:"/server/sites",label:"Services",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/sites","/services"]},{id:"deployments.list",path:"/server/deployments",label:"Deployments",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/deployments"]},{id:"logs.list",path:"/server/logs",label:"Logs",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/logs"]},{id:"sources.integrations",path:"/integrations",label:"Git integrations",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.create",path:"/applications/new",label:"Create application",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.compose",path:"/applications/compose",label:"Compose applications",group:"applications",modes:["server"],adminOnly:!1},{id:"operations.queue",path:"/operations/queue",label:"Deployment queue",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.previews",path:"/operations/previews",label:"Preview environments",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.releases",path:"/operations/releases",label:"Releases & promotion",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"runtime.workloads",path:"/operations/workloads",label:"Workloads",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"observability.overview",path:"/operations/observability",label:"Observability",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"alerts.overview",path:"/operations/alerts",label:"Alerts & health",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"spend.overview",path:"/operations/spend",label:"Spend & budgets",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"automation.jobs",path:"/operations/jobs",label:"Workers & schedules",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/workers","/serverless/scheduler"]},{id:"configuration.entries",path:"/operations/configuration",label:"Environment & secrets",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/serverless/secrets"]},{id:"metrics.overview",path:"/server/metrics",label:"Metrics",group:"operations",modes:["server"],adminOnly:!0},{id:"runtime.services",path:"/server/services",label:"Runtime services",group:"operations",modes:["server"],adminOnly:!0},{id:"backups.list",path:"/data/backups",label:"Backups & recovery",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/backups"]},{id:"volumes.list",path:"/data/volumes",label:"Persistent volumes",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:[]},{id:"fleet.list",path:"/server/fleet",label:"Fleet inventory",group:"operations",modes:["server"],adminOnly:!1,legacyPaths:[]},{id:"operations.run",path:"/server/actions",label:"Run operations",group:"operations",modes:["server"],adminOnly:!0},{id:"infrastructure.topology",path:"/infrastructure/topology",label:"Infrastructure map",group:"infrastructure",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/topology"]},{id:"data.services",path:"/data/services",label:"Data services",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/database","/databases","/server/database","/serverless/data"]},{id:"network.firewall",path:"/server/firewall",label:"Network & firewall",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"security.posture",path:"/security",label:"Security posture",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/security"]},{id:"access.ssh",path:"/server/ssh-keys",label:"SSH keys",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"runtime.terminal",path:"/server/terminal",label:"Terminal",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"organization.people",path:"/server/team",label:"People & access",group:"organization",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/team"]},{id:"organization.automation",path:"/account/automation",label:"API & automation",group:"organization",modes:["server","serverless"],adminOnly:!0},{id:"serverless.overview",path:"/serverless",label:"Dashboard",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.deployments",path:"/serverless/deployments",label:"Deployments",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.logs",path:"/serverless/logs",label:"Logs",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.metrics",path:"/serverless/metrics",label:"Metrics",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.traces",path:"/serverless/traces",label:"Traces",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.functions",path:"/serverless/functions",label:"Functions",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.queues",path:"/serverless/queues",label:"Queues",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.assets",path:"/serverless/assets",label:"Assets",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.network",path:"/serverless/firewall",label:"Network",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.alerts",path:"/serverless/alarms",label:"Alerts",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.cost",path:"/serverless/cost",label:"Costs",group:"settings",modes:["serverless"],adminOnly:!0}],SA=new Map(sg.flatMap((e)=>(e.legacyPaths??[]).map((t)=>[t,e.path])));function og(e){return SA.get(e)}function jS(e,t){return sg.filter((r)=>r.modes.includes(e)&&(!t||!r.adminOnly))}var Bd=()=>{};async function ag(e,t=Bd){for(let r of e){let a=new o(r.replicaRegion),g;try{g=await a.headBucket(r.replicaBucket)}catch(f){if(f?.statusCode===301)throw Error(`Failover replica bucket ${r.replicaBucket} already exists outside ${r.replicaRegion}. Pick another failover.bucket or region for infrastructure.storage.${r.name}.`);if(f?.statusCode===403)throw Error(`Failover replica bucket ${r.replicaBucket} exists but this account cannot reach it (S3 names are global, so another account may own it). Set infrastructure.storage.${r.name}.failover.bucket to a name you own.`);throw f}if(g.exists&&g.region&&g.region!==r.replicaRegion)throw Error(`Failover replica bucket ${r.replicaBucket} is in ${g.region}, not ${r.replicaRegion}.`);if(!g.exists)t(`Creating failover replica bucket ${r.replicaBucket} in ${r.replicaRegion}`),await a.createBucket(r.replicaBucket);if(await a.putPublicAccessBlock(r.replicaBucket,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!0,RestrictPublicBuckets:!0}),await a.putBucketEncryption(r.replicaBucket,"AES256"),r.replicate){if((await a.getBucketVersioning(r.replicaBucket)).Status!=="Enabled")t(`Enabling versioning on ${r.replicaBucket} (S3 replication requires it)`),await a.putBucketVersioning(r.replicaBucket,"Enabled")}}}async function cg(e,t,r=Bd){for(let a of e){let g=t[a.distributionArnOutput];if(!g)throw Error(`Stack output ${a.distributionArnOutput} is missing, so the failover replica ${a.replicaBucket} cannot be scoped to its distribution.`);let f=new o(a.replicaRegion),S={Version:"2012-10-17",Statement:[...((await f.getBucketPolicy(a.replicaBucket))?.Statement??[]).filter((y)=>y?.Sid!==Vo),gl({replicaBucket:a.replicaBucket,distributionArn:g})]};r(`Granting ${g} read access to ${a.replicaBucket}`),await f.putBucketPolicy(a.replicaBucket,S)}}async function dg(e,t=Bd){let r={};for(let a of e){let g=new o(a.primaryRegion),f=new o(a.replicaRegion),[h,b]=await Promise.all([g.listAllObjects({bucket:a.primaryBucket}),f.listAllObjects({bucket:a.replicaBucket})]),S=new Map(b.map((k)=>[k.Key,k.Size])),y=h.filter((k)=>S.get(k.Key)!==k.Size);for(let k of y)await f.copyObject({sourceBucket:a.primaryBucket,sourceKey:k.Key,destinationBucket:a.replicaBucket,destinationKey:k.Key});if(y.length>0)t(`Copied ${y.length} object(s) from ${a.primaryBucket} to ${a.replicaBucket}`);r[a.replicaBucket]=y.length}return r}async function lg(e,t=Bd){for(let r of e){let a=new o(r.replicaRegion);if(!(await a.headBucket(r.replicaBucket)).exists)continue;await a.emptyBucket(r.replicaBucket),await a.deleteBucket(r.replicaBucket),t(`Deleted failover replica bucket ${r.replicaBucket}`)}}import Mi from"node:process";import{existsSync as wA}from"node:fs";import{join as kA}from"node:path";async function ug(e){let t=Date.now(),r=e.sourceDir??"dist";if(!wA(kA(r,"index.html")))return Eg(t,`${r}/ has no index.html — build first.`);if(!Mi.env.AWS_ACCESS_KEY_ID||!Mi.env.AWS_SECRET_ACCESS_KEY)return Eg(t,"Missing AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY in env.");let a=IA(e.dnsProvider);if("error"in a)return Eg(t,a.error);let g=await $n({siteName:e.siteName,region:e.region??"us-east-1",domain:e.domain,bucket:e.bucket,stackName:e.stackName,certificateArn:e.certificateArn,defaultRootObject:e.defaultRootObject??"index.html",errorDocument:e.errorDocument??"404.html",cacheControl:e.cacheControl??"max-age=3600, public",sourceDir:r,cleanBucket:e.cleanBucket??!1,singlePageApp:e.singlePageApp??!1,dnsProvider:a,tags:{ManagedBy:"ts-cloud",Application:e.siteName,...e.tags},onProgress:e.onProgress});return{success:!!g.success,domain:g.domain,url:g.domain?`https://${g.domain}`:g.distributionDomain?`https://${g.distributionDomain}`:void 0,bucket:g.bucket,distributionId:g.distributionId,distributionDomain:g.distributionDomain,certificateArn:g.certificateArn,filesUploaded:g.filesUploaded,filesSkipped:g.filesSkipped,message:g.message,durationMs:Date.now()-t}}function IA(e){let t=typeof e==="string"?{provider:e}:e??{provider:"porkbun"};if(t.provider==="porkbun"){let r=t,a=r?.apiKey??Mi.env.PORKBUN_API_KEY,g=r?.secretKey??Mi.env.PORKBUN_SECRET_KEY??Mi.env.PORKBUN_SECRET_API_KEY;if(!a||!g)return{error:"Missing PORKBUN_API_KEY / PORKBUN_SECRET_KEY in env."};return{provider:"porkbun",apiKey:a,secretKey:g}}if(t.provider==="godaddy"){let r=t,a=r?.apiKey??Mi.env.GODADDY_API_KEY,g=r?.secretKey??Mi.env.GODADDY_API_SECRET,f=r?.environment??Mi.env.GODADDY_ENVIRONMENT;if(!a||!g)return{error:"Missing GODADDY_API_KEY / GODADDY_API_SECRET in env."};return{provider:"godaddy",apiKey:a,apiSecret:g,environment:f}}return{error:`Unsupported DNS provider: ${t.provider}`}}function Eg(e,t){return{success:!1,message:t,durationMs:Date.now()-e}}import{createHash as EA}from"node:crypto";var RA=`let coldStart = true
 const initializedAt = new Date().toISOString()
 export const handler = async (event) => {
   const currentColdStart = coldStart
@@ -176,9 +176,9 @@ export const handler = async (event) => {
     body: JSON.stringify({ ok: statusCode === 200, service: 'ts-cloud-static-api', path, coldStart: currentColdStart, initializedAt })
   }
 }
-`;function Av(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function AA(e){return["NoSuchEntity","ResourceNotFoundException","404"].includes(Av(e))}function Ev(e){return["EntityAlreadyExists","ResourceAlreadyExistsException","ResourceConflictException","409"].includes(Av(e))}function Rv(e,t){let r=e?.Items;if(!r)return[];if(Array.isArray(r))return r;let a=r[t];if(a===void 0)return[];return Array.isArray(a)?a:[a]}function Rg(e){let t=e?.Aliases?.Items,r=t?.CNAME??t;if(Array.isArray(r))return r.map(String);if(typeof r==="string")return[r];return[]}function CA(e){if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected CloudFront alias is invalid");if(!/^[A-Za-z0-9-_]{1,64}$/.test(e.functionName))throw Error("Lambda function name is invalid");let t=e.pathPattern?.startsWith("/")?e.pathPattern:`/${e.pathPattern||"api/*"}`;if(t==="/"||t==="/*"||!t.endsWith("*"))throw Error("API path must be a non-default wildcard pattern such as /api/*");let r=e.originId||`${e.functionName}-url`,a=e.roleName||`${e.functionName}-execution`;if(!/^[A-Za-z0-9_.-]{1,64}$/.test(a))throw Error("IAM role name is invalid");let g=e.memorySize??256,f=e.timeout??10,h=e.logRetentionDays??14;if(g<128||g>10240)throw Error("Lambda memory must be between 128 and 10240 MB");if(f<1||f>900)throw Error("Lambda timeout must be between 1 and 900 seconds");return{region:e.region||"us-east-1",pathPattern:t,originId:r,roleName:a,memorySize:g,timeout:f,logRetentionDays:h}}function yh(e){let t=e.region||"us-east-1";return{cloudfront:new I(e.profile),iam:new Re(t,e.profile),lambda:new T(t,e.profile),logs:new we(t,e.profile),sts:new Te(t,e.profile),sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}async function zS(e,t){let r=CA(e),a=t||yh({profile:e.profile,region:r.region}),[g,f,h]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId),a.cloudfront.getDistributionConfig(e.distributionId)]);if(!g.Account)throw Error("AWS identity did not return an account ID");if(!f.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!(Rg(f).length?Rg(f):Rg(h.DistributionConfig)).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let S,y=!0;try{S=await a.iam.getRole({RoleName:r.roleName})}catch(Ze){if(!AA(Ze))throw Ze;y=!1}let k=S?.Arn||`arn:aws:iam::${g.Account}:role/${r.roleName}`,R=await a.lambda.functionExists(e.functionName),D=R?await a.lambda.getFunctionUrl(e.functionName):null,O=await a.cloudfront.listOriginAccessControls(),M=`${e.functionName}-lambda-url`,z=O.some((Ze)=>Ze.Name===M&&Ze.OriginAccessControlOriginType==="lambda"),J=Rv(h.DistributionConfig.Origins,"Origin"),Z=Rv(h.DistributionConfig.CacheBehaviors,"CacheBehavior"),oe=J.some((Ze)=>String(Ze.Id)===r.originId),G=Z.some((Ze)=>String(Ze.PathPattern)===r.pathPattern),te=[...!y?[`create IAM execution role ${r.roleName}`]:[`reconcile IAM execution policy ${r.roleName}`],...R?[`update Lambda ${e.functionName} code and configuration`]:[`create Lambda ${e.functionName}`],...!D?["create private AWS_IAM function URL"]:[],...!z?[`create Lambda origin access control ${M}`]:[],"grant CloudFront function-URL and invocation permissions",`${G?"reconcile":"add"} ${r.pathPattern} behavior without changing the default behavior`],ye={command:`cloud cdn:origin:remove ${e.distributionId} FUNCTION_URL_HOST --id ${r.originId} --path '${r.pathPattern}' --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,removeFunction:!R,removeRole:!y},Se={mode:e.apply?"apply":"plan",accountId:g.Account,identityArn:g.Arn,distribution:{id:f.Id,arn:f.ARN,alias:e.expectedAlias,domainName:f.DomainName,status:f.Status},function:{name:e.functionName,existed:R,runtime:"nodejs22.x",urlExisted:!!D,url:D?.FunctionUrl},role:{name:r.roleName,existed:y,arn:k},origin:{id:r.originId,pathPattern:r.pathPattern,existed:oe,behaviorExisted:G,accessControlExisted:z},changes:te,rollback:ye,applied:!1};if(!e.apply)return Se;let ie=`${e.distributionId}:${r.pathPattern}`;if(e.confirm!==ie)throw Error(`Pass exact confirmation token ${ie} to mutate the live distribution`);if(!S)S=await a.iam.createRole({RoleName:r.roleName,Description:`Execution role for ${e.functionName}`,AssumeRolePolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]}),Tags:[{Key:"ManagedBy",Value:"ts-cloud"}]});await a.iam.putRolePolicy({RoleName:r.roleName,PolicyName:"lambda-logs",PolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:${r.region}:${g.Account}:log-group:/aws/lambda/${e.functionName}:*`}]})});try{await a.logs.createLogGroup(`/aws/lambda/${e.functionName}`,{ManagedBy:"ts-cloud"})}catch(Ze){if(!Ev(Ze))throw Ze}await a.logs.putRetentionPolicy(`/aws/lambda/${e.functionName}`,r.logRetentionDays);let xe=e.code||RA;if(R)await a.lambda.updateFunctionCodeInline(e.functionName,xe,"index.mjs"),await a.lambda.waitForFunctionActive(e.functionName),await a.lambda.updateFunctionConfiguration({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:S.Arn,Handler:"index.handler",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize});else{let Ze;for(let wt=0;wt<8;wt++)try{await a.lambda.createFunctionWithCode({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:S.Arn,Handler:"index.handler",Code:xe,Filename:"index.mjs",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize}),Ze=void 0;break}catch(Bt){if(Ze=Bt,!String(Bt.message).toLowerCase().includes("role"))throw Bt;await a.sleep(1000)}if(Ze)throw Ze}await a.lambda.waitForFunctionActive(e.functionName);let ee=D||await a.lambda.createFunctionUrl({FunctionName:e.functionName,AuthType:"AWS_IAM",InvokeMode:"BUFFERED"});if(!ee.FunctionUrl)throw Error("Lambda did not return a function URL");let De=new URL(ee.FunctionUrl).hostname,Je=await a.cloudfront.findOrCreateOriginAccessControl(M,"lambda"),gt=f.ARN||`arn:aws:cloudfront::${g.Account}:distribution/${e.distributionId}`,jt=[{FunctionName:e.functionName,StatementId:"AllowCloudFrontFunctionUrl",Action:"lambda:InvokeFunctionUrl",Principal:"cloudfront.amazonaws.com",SourceArn:gt,FunctionUrlAuthType:"AWS_IAM"},{FunctionName:e.functionName,StatementId:"AllowCloudFrontInvoke",Action:"lambda:InvokeFunction",Principal:"cloudfront.amazonaws.com",SourceArn:gt,InvokedViaFunctionUrl:!0}];for(let Ze of jt)try{await a.lambda.addPermission(Ze)}catch(wt){if(!Ev(wt))throw wt}return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:De,pathPattern:r.pathPattern,originAccessControlId:Je.Id}),{...Se,function:{...Se.function,url:ee.FunctionUrl},applied:!0}}async function KS(e){let t=`https://${e.alias}/`,r=`https://${e.alias}/api/health`,a=await fetch(t,{redirect:"follow",headers:{"cache-control":"no-cache"}}),g=new Uint8Array(await a.arrayBuffer()),f=EA("sha256").update(g).digest("hex"),h=Date.now(),b=await fetch(r,{redirect:"follow",headers:{"cache-control":"no-cache"}}),S=Date.now()-h,y=await b.text(),k=y;try{k=JSON.parse(y)}catch{}let R;if(e.logs&&e.functionName){let D=await e.logs.filterLogEvents({logGroupName:`/aws/lambda/${e.functionName}`,startTime:h-60000,filterPattern:'"Init Duration"',limit:25});for(let O of D.events||[]){let M=O.message?.match(/Init Duration:\s*([0-9.]+)\s*ms/i);if(M)R=Number(M[1])}}return{frontend:{url:t,status:a.status,sha256:f,unchanged:e.expectedFrontendSha256?f===e.expectedFrontendSha256:void 0,bytes:g.byteLength},api:{url:r,status:b.status,latencyMs:S,healthy:b.ok&&!!k?.ok,body:k},coldStart:{observed:R!==void 0,initDurationMs:R},verifiedAt:(e.now?.()||new Date).toISOString()}}function WS(e){let t=(e.memoryMb||256)/1024,r=Math.max(0,e.requests-(e.includeFreeTier===!1?0:1e6)),a=Math.max(0,e.requests*(e.averageDurationMs/1000)*t-(e.includeFreeTier===!1?0:400000)),g=r/1e6*0.2+a*0.0000166667,f=9.010025,h=16.425;return{lambdaUsd:Number(g.toFixed(2)),alwaysOnFargateAndAlbUsd:Number(25.435025000000003 .toFixed(2)),assumptions:["us-east-1 public list rates snapshot, July 2026","Lambda x86 request and duration pricing with optional monthly free tier","Fargate comparison uses one always-on 0.25 vCPU/0.5 GB task plus one ALB before LCU charges","excludes CloudFront, data transfer, logs, taxes, and application data services"]}}import{createHash as PA}from"node:crypto";function _A(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function TA(e){return _A(e)==="ValidationError"&&String(e.message).includes("does not exist")}function xA(e){return Object.fromEntries((e||[]).map((t)=>[t.OutputKey,t.OutputValue]))}function DA(e){let t=e?.Aliases?.Items??e?.Aliases,r=t?.CNAME??t;if(Array.isArray(r))return r.map(String);if(typeof r==="string")return[r];return[]}function Cv(e){if(!/^[a-z][a-z0-9-]{1,62}$/.test(e.slug))throw Error("Slug must be a lowercase DNS-safe identifier");if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected distribution alias is invalid");let t=e.imageUri.match(/@((?:sha256:)[a-f0-9]{64})$/i)?.[1];if(!t)throw Error("Container image must use an immutable ECR digest URI ending in @sha256:<64 hex>");let r=e.stackName||`${e.slug}-backend`;if(!/^[A-Za-z][A-Za-z0-9-]{0,127}$/.test(r))throw Error("CloudFormation stack name is invalid");let a=e.pathPattern||"/api/*";if(!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]+\*$/.test(a)||a==="/*")throw Error("Backend path must be a non-default wildcard pattern");let g=e.originId||`${e.slug}-backend`;if(!/^[A-Za-z0-9_.-]{1,128}$/.test(g))throw Error("CloudFront origin ID is invalid");if(e.originVerifySecret&&e.originVerifySecret.length<24)throw Error("Origin verification secret must contain at least 24 characters");if(!!e.originDomain!==!!e.certificateArn)throw Error("A custom origin domain and matching ACM certificate ARN must be provided together");return{stackName:r,region:e.region||"us-east-1",pathPattern:a,originId:g,digest:t}}function Sh(e){let t=e.region||"us-east-1";return{cloudformation:new A(t,e.profile),cloudfront:new I(e.profile),sts:new Te(t,e.profile),fetch,sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}function Ih(e){let t=Cv(e),r=hl({name:e.name,slug:e.slug,domain:e.originDomain||e.expectedAlias,imageUri:e.imageUri,certificateArn:e.certificateArn,originVerifySecret:e.originVerifySecret,desiredCount:e.desiredCount,database:e.database,cache:e.cache,queue:e.queue}),a=fl(r);return a.Description=`Managed backend for existing static frontend ${e.expectedAlias}`,a.Metadata={ManagedBy:"ts-cloud",ExistingDistributionId:e.distributionId,ExistingDistributionAlias:e.expectedAlias,BackendPathPattern:t.pathPattern,ContainerDigest:t.digest},a}async function OA(e,t,r){let a;for(let g=0;g<30;g++){let f=Date.now();try{let h=await e.fetch(t,{redirect:"manual",headers:r?{"x-origin-verify":r}:void 0}),b=Date.now()-f,S=await h.text(),y=S;try{y=JSON.parse(S)}catch{}if(h.ok)return{url:t,status:h.status,latencyMs:b,body:y};a=Error(`origin returned ${h.status}`)}catch(h){a=h}if(g<29)await e.sleep(1e4)}throw Error(`Backend origin did not become healthy: ${a instanceof Error?a.message:String(a)}`)}async function JS(e,t){let r=Cv(e),a=t||Sh({region:r.region,profile:e.profile}),[g,f]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId)]);if(!g.Account)throw Error("AWS identity did not return an account ID");if(!f.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!DA(f).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let h;try{h=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0]}catch(te){if(!TA(te))throw te}let b=Ih(e),S=JSON.stringify(b);if(Buffer.byteLength(S)>51200)throw Error("Generated template exceeds the direct CloudFormation template body limit");let y=Object.values(b.Resources||{}).reduce((te,ye)=>(te[ye.Type]=(te[ye.Type]||0)+1,te),{}),k=[`cloud cdn:origin:remove ${e.distributionId} ${e.originDomain||"ALB_HOST"} --id ${r.originId} --path '${r.pathPattern}' --profile ${e.profile||"default"} --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,`After CloudFront is deployed, restore external DNS if changed and delete stack ${r.stackName} only with an approved data-retention decision.`],R={mode:e.apply?"apply":"plan",accountId:g.Account,stack:{name:r.stackName,existed:!!h,status:h?.StackStatus,templateSha256:PA("sha256").update(S).digest("hex"),resourceCount:Object.keys(b.Resources||{}).length,resourceTypes:y},distribution:{id:f.Id,alias:e.expectedAlias,domainName:f.DomainName,status:f.Status,pathPattern:r.pathPattern,originId:r.originId},artifact:{imageUri:e.imageUri,digest:r.digest},services:{database:e.database!==!1,cache:e.cache!==!1,queue:e.queue!==!1,mail:"ses",desiredCount:e.desiredCount||1},cloudFrontApplied:!1,dnsApplied:!1,applied:!1,rollback:k};if(!e.apply)return R;let D=`${e.distributionId}:${r.pathPattern}:${r.stackName}`;if(e.confirm!==D)throw Error(`Pass exact confirmation token ${D} to provision the backend and change live routing`);if(h)try{await a.cloudformation.updateStack({stackName:r.stackName,templateBody:S,capabilities:["CAPABILITY_NAMED_IAM"],tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-update-complete")}catch(te){if(!String(te.message).includes("No updates are to be performed"))throw te}else await a.cloudformation.createStack({stackName:r.stackName,templateBody:S,capabilities:["CAPABILITY_NAMED_IAM"],onFailure:"ROLLBACK",tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-create-complete");let O=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0],M=xA(O?.Outputs),z=M.AppLoadBalancerDnsName;if(!z)throw Error("Backend stack did not return AppLoadBalancerDnsName");let J=!1;if(e.originDomain&&e.originDomain!==z){if(!a.dns)throw Error(`External DNS provider is required to map ${e.originDomain} to ${z}`);let te=await a.dns.upsertRecord(e.originDomain,{name:e.originDomain,type:"CNAME",content:z,ttl:300});if(!te.success)throw Error(te.message||"External DNS update failed");J=!0}let Z=e.originDomain||z,oe=e.certificateArn?"https-only":"http-only",G=e.skipHealthCheck?void 0:await OA(a,`${oe==="https-only"?"https":"http"}://${Z}/api/health`,e.originVerifySecret);return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:Z,pathPattern:r.pathPattern,protocolPolicy:oe,customHeaders:e.originVerifySecret?{"X-Origin-Verify":e.originVerifySecret}:void 0}),{...R,outputs:M,health:G,cloudFrontApplied:!0,dnsApplied:J,applied:!0}}function XS(e={}){let r={fargate:730*(e.desiredCount||1)*0.012342500000000001,applicationLoadBalancer:16.425,natGateway:32.85,postgres:730*(e.multiAzDatabase?0.032:0.016),redis:23.36};return{monthlyUsd:Number(Object.values(r).reduce((a,g)=>a+g,0).toFixed(2)),components:Object.fromEntries(Object.entries(r).map(([a,g])=>[a,Number(g.toFixed(2))])),assumptions:["us-east-1 public on-demand rate snapshot, July 2026","one 0.25 vCPU/0.5 GB Linux Fargate task unless desiredCount is changed","one ALB before LCU charges and one NAT gateway before data processing","single-AZ db.t4g.micro PostgreSQL by default and two cache.t4g.micro Redis nodes","excludes storage, backups, CloudFront, data transfer, public IPv4, logs, email, queue requests, taxes, and free-tier credits"]}}import{execFileSync as $A}from"node:child_process";import{createHash as NA}from"node:crypto";import{existsSync as Pv,mkdirSync as jA,mkdtempSync as BA,readdirSync as MA,readFileSync as LA,rmSync as FA,statSync as _v,writeFileSync as zA}from"node:fs";import{tmpdir as UA}from"node:os";import{basename as qA,join as as,relative as VA,resolve as Pg}from"node:path";var WA=new Set([".git","node_modules","dist","coverage"]);function Tv(e,t=e){let r=[];for(let a of MA(e).sort()){if(WA.has(a))continue;let g=as(e,a);if(sl(g,t))continue;let f=_v(g);if(f.isDirectory())r.push(...Tv(g,t));else if(f.isFile())r.push(VA(t,g))}return r}function bh(e){let t=Pg(e);if(!Pv(t)||!_v(t).isDirectory())throw Error(`Container context does not exist: ${t}`);let r=NA("sha256");for(let a of Tv(t))r.update(a),r.update("\x00"),r.update(LA(as(t,a))),r.update("\x00");return r.digest("hex")}function Ch(e){return{ecr:new He(e.region||"us-east-1",e.profile),run:(t,r,a)=>{$A(t,r,{cwd:a?.cwd,env:a?.env,stdio:a?.stdio||"inherit"})}}}async function YS(e,t){let r=Pg(e.context),a=Pg(e.dockerfile||as(r,"Dockerfile"));if(!Pv(a))throw Error(`Dockerfile does not exist: ${a}`);if(!e.repository.split("/").every((M)=>/^[a-z0-9][a-z0-9._-]*$/.test(M)&&!/[._-]$/.test(M)&&!/[._-]{2}/.test(M)))throw Error("ECR repository name is invalid");let h=t||Ch(e),b=bh(r),S=`sha-${b.slice(0,20)}`,y="";try{y=(await h.ecr.describeRepositories({repositoryNames:[e.repository]})).repositories?.[0]?.repositoryUri||""}catch{}if(!y)y=(await h.ecr.createRepository({repositoryName:e.repository,imageTagMutability:"IMMUTABLE",imageScanningConfiguration:{scanOnPush:!0},tags:[{Key:"ManagedBy",Value:"ts-cloud"}]})).repository?.repositoryUri||"";if(!y)throw Error(`Could not resolve ECR repository URI for ${e.repository}`);await h.ecr.putLifecyclePolicy({repositoryName:e.repository,lifecyclePolicyText:JSON.stringify({rules:[{rulePriority:1,description:"Retain the newest 25 release images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:25},action:{type:"expire"}}]})});let k=`${y}:${S}`,R=BA(as(UA(),"ts-cloud-container-"));try{h.run("docker",["version"],{stdio:"ignore"}),h.run("docker",["build","--platform",e.platform||"linux/amd64","--provenance=false","--sbom=false","--file",a,"--tag",k,r],{cwd:r});let M=(await h.ecr.getAuthorizationToken()).authorizationData?.[0];if(!M?.authorizationToken||!M.proxyEndpoint)throw Error("ECR did not return Docker authorization data");let z=M.proxyEndpoint.replace(/^https?:\/\//,""),J=as(R,"docker");jA(J,{recursive:!0}),zA(as(J,"config.json"),JSON.stringify({auths:{[z]:{auth:M.authorizationToken}}}),{mode:384}),h.run("docker",["push",k],{env:{...process.env,DOCKER_CONFIG:J}})}finally{FA(R,{recursive:!0,force:!0})}let O=(await h.ecr.describeImages({repositoryName:e.repository,imageIds:[{imageTag:S}]})).imageDetails?.[0]?.imageDigest;if(!O||!/^sha256:[a-f0-9]{64}$/i.test(O))throw Error(`ECR did not return an immutable digest for ${qA(k)}`);return{repository:e.repository,tag:S,imageUri:k,digest:O,digestUri:`${y}@${O}`,contextSha256:b}}import{existsSync as HA,readdirSync as KA,readFileSync as JA,statSync as GA}from"node:fs";import{join as xv,relative as QA}from"node:path";function yo(e,t){let r=e.environments?.[t]?.app;if(!r)throw Error(`No serverless app configured for environment '${t}'. Add environments.${t}.app to your config.`);let a=e.project.slug,g=e.environments?.[t]?.region||e.project.region||"us-east-1";return{app:r,slug:a,region:g,stackName:lr(e,t),artifactBucket:cl(a,t),assetsBucket:Xi(a,t)}}async function ho(e,t=8){let r;for(let a=0;a<t;a++)try{return await e()}catch(g){let f=g?.code||g?.name||"",h=String(g?.message||"");if(f==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(h)){r=g,await new Promise((b)=>setTimeout(b,3000));continue}throw g}throw r}var Dv=(e,t)=>`releases/${e}/${t}/current.json`;async function Ld(e,t,r,a){try{return await e.getObjectJson(t,Dv(r,a))}catch{return null}}async function Ov(e,t,r,a,g){await e.putObjectJson(t,Dv(r,a),g)}async function YA(e,t){if(!e.secrets)return{};let r=new re(t),a={},g=Array.isArray(e.secrets)?e.secrets.map((f)=>({envName:f.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:f})):Object.entries(e.secrets).map(([f,h])=>({envName:f,secretId:h}));if(Array.isArray(e.secrets)){let f=new Map;for(let{envName:b,secretId:S}of g)f.set(b,[...f.get(b)??[],S]);let h=[...f.entries()].filter(([,b])=>b.length>1);if(h.length){let b=h.map(([S,y])=>`${S} ← ${y.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${b}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:f,secretId:h}of g){let S=(await r.getSecretValue({SecretId:h})).SecretString??"";try{let y=JSON.parse(S);if(y&&typeof y==="object"&&!Array.isArray(y)){for(let[k,R]of Object.entries(y))a[k]=String(R);continue}}catch{}a[f]=S}return a}function Es(e,t){let r={},a=t.DbProxyEndpoint||t.DbEndpoint;if(a)r.DB_CONNECTION="mysql",r.DB_HOST=a,r.DB_PORT="3306",r.DB_DATABASE=r.DB_DATABASE||"app";if(t.CacheEndpoint){if(r.REDIS_HOST=t.CacheEndpoint,r.REDIS_PORT="6379",e.cache?.driver==="elasticache")r.CACHE_STORE="redis",r.CACHE_DRIVER="redis",r.SESSION_DRIVER="redis"}return r}function Cr(e,t,r,a,g,f,h,b={}){let S=e.kind==="php"?ql({cacheDriver:e.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:a,TSCLOUD_ENV:r,MAINTENANCE_MODE:"0",...e.octane?{TSCLOUD_OCTANE:"1"}:{},...e.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...e.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...S,...b,...t.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${t.slug}-${r}-cache`}:{},...h?{TSCLOUD_QUEUE:h,SQS_QUEUE:h}:{},...f?{ASSET_URL:f}:{},...e.env??{},...g}}function ZA(e){let t=e.slice(e.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[t]??"application/octet-stream"}function*$v(e){for(let t of KA(e)){let r=xv(e,t);if(GA(r).isDirectory())yield*$v(r);else yield r}}async function XA(e,t,r,a,g=!1){let f=0;for(let h of $v(r)){let b=QA(r,h).replace(/\\/g,"/");if(!g&&b.split("/").some((S)=>S.startsWith(".")))continue;await e.putObject({bucket:t,key:`${a}/${b}`,body:JA(h),contentType:ZA(h),cacheControl:"public, max-age=31536000, immutable"}),f++}return f}function eC(e,t){let r=Object.entries(t).reduce((a,[g,f])=>a+Buffer.byteLength(`${g}=${f}`,"utf8"),0);if(r>4096){let a=Object.entries(t).map(([g,f])=>[g,Buffer.byteLength(`${g}=${f}`,"utf8")]).sort((g,f)=>f[1]-g[1]).slice(0,5).map(([g,f])=>`${g} (${f}B)`).join(", ");throw Error(`${e}: environment variables total ${r}B, over AWS's 4096B limit (${r-4096}B too large). Largest: ${a}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function sa(e,t,r,a){eC(t,r),await ho(()=>e.updateFunctionConfiguration({FunctionName:t,Environment:{Variables:r}})),await e.waitForFunctionActive(t,120);let g=a.kind==="image"?{FunctionName:t,ImageUri:a.imageUri}:{FunctionName:t,S3Bucket:a.bucket,S3Key:a.key};await ho(()=>e.updateFunctionCode(g)),await e.waitForFunctionActive(t,120)}async function Md(e,t){let a=(await ho(()=>e.publishVersion({FunctionName:t}))).Version;if(!a)throw Error(`publishVersion returned no version for ${t}`);return await ho(()=>e.updateAlias({FunctionName:t,Name:"live",FunctionVersion:a})),a}async function Ya(e,t,r={}){let a=yo(e,t),{app:g,slug:f,region:h,stackName:b,artifactBucket:S}=a,y=r.projectRoot??process.cwd();xs(`Deploying serverless app: ${f} (${t})`),L(`Stack: ${b}`),L(`Region: ${h}`);let k=new o(h),R=new A(h),D=new T(h),O=g.kind==="php",M=g.packaging==="image",z=ns(g),J,Z,oe,G,te=[];if(M&&z.usesLayer&&z.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${z.kind}${z.kind==="node"?` ${z.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(M){P("Building + pushing container image");let{buildAndPushServerlessImage:ue}=await import("./chunk-2ntc2qz2.js"),Ce=await ue({app:g,projectRoot:y,region:h,repository:`${f}-${t}`,skipBuild:r.skipBuild,onStep:(mt)=>L(`  ${mt}`)});J=Ce.handlers,Z={kind:"image",imageUri:Ce.imageUri},oe=Ce.tag,te.push({ParameterKey:"ImageUri",ParameterValue:Ce.imageUri})}else{P("Packaging application");let ue=O?jl({projectRoot:y,app:g,skipBuild:r.skipBuild,onStep:(kt)=>L(`  ${kt}`)}):await mn({projectRoot:y,app:g,skipBuild:r.skipBuild,onStep:(kt)=>L(`  ${kt}`)}),Ce=$l(f,t,ue.sha256);if(L(`Artifact: ${ue.sha256.slice(0,12)} (${(ue.zip.length/1024).toFixed(0)} KB)`),J=ue.handlers,oe=ue.sha256,z.usesLayer){let kt=z.layerEnvVar?process.env[z.layerEnvVar]:void 0;if(G=g.layers??(kt?[kt]:void 0),!G?.length){let _e=z.layerKind==="php"?"serverless:build-php-layer":z.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${z.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${z.layerEnvVar} env var (build one with \`cloud ${_e}\`)${z.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await k.bucketExists(S))P(`Creating artifact bucket ${S}`),await k.createBucket(S);if(await k.headObject(S,Ce).then((kt)=>kt!==null).catch(()=>!1))L("Artifact already uploaded — reusing");else P("Uploading artifact"),await k.putObject({bucket:S,key:Ce,body:ue.zip,contentType:"application/zip"});Z={kind:"zip",bucket:S,key:Ce},te.push({ParameterKey:"ArtifactBucket",ParameterValue:S},{ParameterKey:"ArtifactKey",ParameterValue:Ce})}let ye=Fl({config:e,environment:t,app:g,handlers:J,runtimeLayers:G}),Se=JSON.stringify(ye.template),ie=["CAPABILITY_NAMED_IAM"],xe=await R.describeStacks({stackName:b}).then((ue)=>ue.Stacks[0]?.StackStatus).catch(()=>{return}),ee=xe!==void 0;if(xe&&/DELETE_IN_PROGRESS/.test(xe))P("Waiting for an in-progress stack delete to finish"),await R.waitForStack(b,"stack-delete-complete").catch(()=>{}),ee=!1;else if(xe&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(xe))P(`Deleting unusable stack (status ${xe}) before recreate`),await R.deleteStack(b),await R.waitForStack(b,"stack-delete-complete").catch(()=>{}),ee=!1;P(ee?"Updating infrastructure stack":"Creating infrastructure stack");try{if(ee)await R.updateStack({stackName:b,templateBody:Se,parameters:te,capabilities:ie}),await R.waitForStack(b,"stack-update-complete");else await R.createStack({stackName:b,templateBody:Se,parameters:te,capabilities:ie,onFailure:"DELETE"}),await R.waitForStack(b,"stack-create-complete")}catch(ue){if(/No updates are to be performed/i.test(String(ue?.message)))L("No infrastructure changes");else throw ue}let De=await R.getStackOutputs(b).catch(()=>({})),Je;if(g.assets){let ue=xv(y,g.assets);if(HA(ue)){let Ce=g.assetDomain||De.AssetsCdnDomain;Je=Ce?`https://${Ce}/${oe}`:void 0,P(`Syncing assets from ${g.assets}`);let mt=await XA(k,a.assetsBucket,ue,oe,g.dotFilesAsAssets);L(`Uploaded ${mt} asset(s)${Je?` → ${Je}`:""}`)}else Bs(`Assets directory not found: ${ue}`)}P("Resolving secrets");let gt=await YA(g,h);if(g.database?.connection==="aurora-serverless")try{let Ce=await new re(h).getSecretValue({SecretId:`${f}/${t}/db`}),mt=JSON.parse(Ce.SecretString??"{}");if(mt.username)gt.DB_USERNAME=mt.username;if(mt.password)gt.DB_PASSWORD=mt.password}catch(ue){Bs(`Could not resolve Aurora DB credentials: ${ue.message}`)}if(!await k.bucketExists(S))await k.createBucket(S);let jt=await Ld(k,S,f,t),Ze={},wt=ye.queueNames[0],Bt=Es(g,De);if(P("Activating functions"),Ze.http=Cr(g,a,t,"http",gt,Je,wt,Bt),await sa(D,ye.functionNames.http,Ze.http,Z),Ze.cli=Cr(g,a,t,"cli",gt,Je,wt,Bt),await sa(D,ye.functionNames.cli,Ze.cli,Z),ye.queueNames.length)Ze.queue=Cr(g,a,t,"queue",gt,Je,wt,Bt),await sa(D,ye.functionNames.queue,Ze.queue,Z);let nt=(g.provisionedConcurrency??0)>0,W={};if(nt){if(P("Publishing versions + flipping live alias"),W.http=await Md(D,ye.functionNames.http),W.cli=await Md(D,ye.functionNames.cli),ye.queueNames.length)W.queue=await Md(D,ye.functionNames.queue)}if(await Ov(k,S,f,t,{sha:oe,code:Z,previousSha:jt?.sha,previousCode:jt?.code,previousFunctionEnv:jt?.functionEnv,...nt?{functionVersions:W,previousFunctionVersions:jt?.functionVersions}:{},functionEnv:Ze,functionNames:{http:ye.functionNames.http,cli:ye.functionNames.cli,...ye.queueNames.length?{queue:ye.functionNames.queue}:{}},assetUrl:Je,timestamp:new Date().toISOString()}),!r.skipDeployHooks&&g.deploy?.length){P("Running deploy hooks");for(let ue of g.deploy){L(`  deploy: ${ue}`);let Ce=await D.invoke({FunctionName:ye.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:ue},LogType:"Tail"});if(Ce.FunctionError)throw bg("Deploy hook failed — the new build is ALREADY LIVE."),L(`  Roll back with: cloud serverless:rollback --env ${t}`),Error(`Deploy hook failed (${ue}): ${Ce.Payload}`)}}let se=De.HttpApiEndpoint;if(!r.skipHealthCheck&&se){P("Health check");try{let ue=await fetch(se,{method:"GET"});L(`GET ${se} → ${ue.status}`)}catch(ue){Bs(`Health check could not reach ${se}: ${ue.message}`)}}Cg(["Serverless deploy complete","",se?`URL:   ${se}`:"",`Stack: ${b}`,`Build: ${oe.slice(0,12)}`].filter(Boolean).join(`
-`),"green")}async function Nn(e,t){let r=yo(e,t),a=new o(r.region),g=new T(r.region),f=await Ld(a,r.artifactBucket,r.slug,t);if(!f)throw Error("No previous release to redeploy. Run a full deploy first.");xs(`Redeploying ${r.slug} (${t}) — build ${f.sha.slice(0,12)}`);for(let[h,b]of Object.entries(f.functionNames)){if(!b)continue;P(`Re-activating ${h} (${b})`),await sa(g,b,f.functionEnv[h]??{},f.code);let S=f.functionVersions?.[h];if(S)await ho(()=>g.updateAlias({FunctionName:b,Name:"live",FunctionVersion:S}))}Mn("Redeploy complete")}async function Bn(e,t){let r=yo(e,t),a=new o(r.region),g=new T(r.region),f=await Ld(a,r.artifactBucket,r.slug,t);if(!f?.previousCode)throw Error("No previous release to roll back to.");xs(`Rolling back ${r.slug} (${t}) → ${f.previousSha?.slice(0,12)}`);for(let[h,b]of Object.entries(f.functionNames)){if(!b)continue;P(`Restoring ${h} (${b})`);let S=f.previousFunctionEnv?.[h]??f.functionEnv[h]??{};await sa(g,b,S,f.previousCode);let y=f.previousFunctionVersions?.[h];if(y)await ho(()=>g.updateAlias({FunctionName:b,Name:"live",FunctionVersion:y}))}await Ov(a,r.artifactBucket,r.slug,t,{...f,sha:f.previousSha??f.sha,code:f.previousCode,functionEnv:f.previousFunctionEnv??f.functionEnv,functionVersions:f.previousFunctionVersions??f.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),Mn("Rollback complete")}async function Er(e,t,r,a){let g=yo(e,t),f=new T(g.region),h=`${g.slug}-${t}-http`,S={...(await f.getFunction(h)).Configuration?.Environment?.Variables??{}};if(S.MAINTENANCE_MODE=r?"1":"0",r&&a)S.MAINTENANCE_BYPASS_SECRET=a;if(!r)delete S.MAINTENANCE_BYPASS_SECRET;if(await ho(()=>f.updateFunctionConfiguration({FunctionName:h,Environment:{Variables:S}})),(g.app.provisionedConcurrency??0)>0)await f.waitForFunctionActive(h,120),await Md(f,h);Mn(r?"Application is now in maintenance mode (503)":"Application is live")}async function lt(e,t,r){let a=yo(e,t),g=new T(a.region),f=`${a.slug}-${t}-cli`,h=await g.invoke({FunctionName:f,InvocationType:"RequestResponse",Payload:{command:r},LogType:"Tail"});if(h.FunctionError)throw Error(`Command failed: ${h.Payload}`);return h.Payload??""}async function hr(e,t){let r=yo(e,t),a=new A(r.region),g=new T(r.region),f=new o(r.region),h="not deployed",b={};try{let{Stacks:M}=await a.describeStacks({stackName:r.stackName});h=M?.[0]?.StackStatus??h;for(let z of M?.[0]?.Outputs??[])if(z.OutputKey)b[z.OutputKey]=z.OutputValue??""}catch{}let S=Ml(r.app,r.slug,t),y=r.app.provisionedConcurrency??0,k=["http","cli",...S.length?["queue"]:[]],R=`${r.slug}-${t}`,D=[];for(let M of k){let z=`${R}-${M}`,J={mode:M,name:z,version:"$LATEST"};if(y>0){let Z=await g.getAlias(z,"live").catch(()=>null);if(Z?.FunctionVersion){J.version=Z.FunctionVersion;let oe=await g.getProvisionedConcurrencyConfig(z,"live").catch(()=>null);if(oe)J.provisioned={status:oe.Status??"-",allocated:oe.AllocatedProvisionedConcurrentExecutions??0,requested:oe.RequestedProvisionedConcurrentExecutions??0}}}D.push(J)}let O=await Ld(f,r.artifactBucket,r.slug,t).catch(()=>null);return{slug:r.slug,environment:t,region:r.region,stackStatus:h,endpoint:b.HttpApiEndpoint,assetUrl:O?.assetUrl,scheduler:r.app.scheduler??"on",queues:S,provisionedConcurrency:y,functions:D,lastRelease:O?{sha:O.sha,timestamp:O.timestamp}:void 0}}function tC(e,t){return`${e}-${t}-db`}async function Nv(e,t,r,a){let g=yo(e,t);if(g.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:f}=await import("./chunk-86qwnp25.js"),h=new f(g.region),b=tC(g.slug,t);P(`Scaling ${b} → ${r}–${a} ACUs`),await h.modifyDBCluster({DBClusterIdentifier:b,ServerlessV2ScalingConfiguration:{MinCapacity:r,MaxCapacity:a},ApplyImmediately:!0}),Mn(`Scaling applied to ${b} (takes effect shortly).`)}class _g{client;region;constructor(e="us-east-1"){this.region=e,this.client=new n}async call(e,t){return this.client.request({service:"wafv2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSWAF_20190729.${e}`},body:JSON.stringify(t)})}async listWebACLs(e="REGIONAL"){return(await this.call("ListWebACLs",{Scope:e,Limit:100}))?.WebACLs??[]}async getWebACLRules(e,t,r="REGIONAL"){return((await this.call("GetWebACL",{Name:e,Id:t,Scope:r}))?.WebACL?.Rules??[]).map((f)=>({Name:f.Name,Priority:f.Priority,Action:f.Action?Object.keys(f.Action)[0]:f.OverrideAction?Object.keys(f.OverrideAction)[0]:"count"}))}}var rC=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"routing",label:"Routing"},{index:4,id:"apps",label:"Applications"},{index:5,id:"runtime",label:"Background runtime"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],nC=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"entry",label:"Entry points"},{index:4,id:"compute",label:"Compute"},{index:5,id:"messaging",label:"Messaging & pooling"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],iC=[{match:/^redis/,kind:"cache",label:"Redis"},{match:/^(?:mysql|mariadb)/,kind:"database",label:"MySQL"},{match:/^postgres/,kind:"database",label:"PostgreSQL"},{match:/^meilisearch/,kind:"database",label:"Meilisearch"},{match:/^vitess|^vtgate/,kind:"database",label:"Vitess"},{match:/^memcached/,kind:"cache",label:"Memcached"}],oC=/^(?:rpx-gateway|nginx|caddy|traefik|haproxy)$/;function Pe(e,t=""){let r=e==null?"":String(e).trim();return r&&r!=="-"&&r!=="—"?r:t}function sC(e){return Array.isArray(e)?e.length:0}function Jn(e){let t=Pe(e).toLowerCase();if(!t)return"unknown";if(["running","live","active","available","success","ok","healthy","enabled"].includes(t))return"ok";if(["failed","stopped","unreachable","error","critical","disabled"].includes(t))return"bad";if(["configured","creating","pending","degraded","shadowed","warn","unknown"].includes(t))return"warn";return"warn"}function Gt(e,t,r){if(r.has(t.source)&&r.has(t.target))e.push(t)}function Qt(e,t={}){let r=[],a=[],g=[],f=e.server??{},h=Array.isArray(e.sites)?e.sites:[],b=Array.isArray(e.services)?e.services:[],S=Array.isArray(e.workers)?e.workers:[],y=e.security??{},k=!!e._serverReachable&&!e.metricsUnavailable,R="box";if(!k)g.push("The compute box could not be probed, so live service state is missing; the shape comes from your cloud config.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let D=[...new Set(h.map((ie)=>Pe(ie.domain)||Pe(ie.route).split("/")[0]).filter((ie)=>ie&&ie!=="internal"&&ie!=="loopback"))],O=Array.isArray(y.tlsCertificates)?y.tlsCertificates:[],M=O.filter((ie)=>Number(ie?.daysRemaining??999)<21).length;r.push({id:"dns",label:D.length===1?D[0]:"Public domains",kind:"dns",layer:1,status:M?"warn":D.length?"ok":"unknown",sub:D.length>1?`${D.length} domains`:"DNS & certificates",facts:[{label:"Domains",value:D.length?D.slice(0,6).join(", "):"none resolved"},{label:"Certificates",value:O.length?`${O.length} issued`:"none reported"},...M?[{label:"Expiring",value:`${M} within 21 days`}]:[]],href:"/server/security",external:!0});let z=y.firewall??{},J=Array.isArray(y.ports)?y.ports:[];r.push({id:"firewall",label:"Host firewall",kind:"firewall",layer:2,status:Jn(z.status),sub:Pe(z.summary,"Inbound filtering"),facts:[{label:"State",value:Pe(z.status,"unknown")},{label:"Open ports",value:J.length?J.map((ie)=>Pe(ie.listen)).join(", "):"not reported"}],href:"/server/firewall",group:"box"});let Z=b.find((ie)=>oC.test(Pe(ie.name)));r.push({id:"proxy",label:Pe(Z?.name,"Reverse proxy"),kind:"proxy",layer:3,status:Z?Jn(Z.status):"unknown",sub:"TLS termination & routing",facts:[{label:"Service",value:Pe(Z?.name,"not detected")},{label:"State",value:Pe(Z?.status,k?"not running":"not probed")},{label:"Routes",value:`${h.length} site${h.length===1?"":"s"}`}],href:"/server/services",group:"box"});for(let ie of h){let xe=`site:${Pe(ie.name)}`;if(!Pe(ie.name))continue;r.push({id:xe,label:Pe(ie.name),kind:"site",layer:4,status:Jn(ie.status),sub:Pe(ie.runtime,"runtime"),facts:[{label:"Route",value:Pe(ie.route,"internal")},{label:"Runtime",value:Pe(ie.runtime,"unknown")},{label:"Delivery",value:Pe(ie.deploy,"unknown")},{label:"TLS",value:Pe(ie.tls,"unknown")},...ie.responseMs!=null?[{label:"Response",value:`${Math.round(Number(ie.responseMs))} ms`}]:[],...ie.httpStatus!=null?[{label:"HTTP",value:String(ie.httpStatus)}]:[]],href:"/server/sites",group:"box"})}for(let ie of S){let xe=`worker:${Pe(ie.name)}`;if(!Pe(ie.name))continue;r.push({id:xe,label:Pe(ie.name),kind:"worker",layer:5,status:Jn(ie.status),sub:`${Number(ie.processes??1)} process${Number(ie.processes??1)===1?"":"es"}`,facts:[{label:"Processes",value:String(ie.processes??1)},{label:"State",value:Pe(ie.status,"unknown")},...Pe(ie.site)?[{label:"Site",value:Pe(ie.site)}]:[]],href:"/operations/jobs",group:"box"})}let oe=e.serverScheduler??{};if(oe.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:5,status:"ok",sub:"Cron dispatch",facts:[{label:"Last run",value:Pe(oe.lastRun,"unknown")}],href:"/operations/jobs",group:"box"});let G=b.map((ie)=>{let xe=Pe(ie.name),ee=iC.find((De)=>De.match.test(xe));return ee?{service:ie,name:xe,...ee}:null}).filter((ie)=>!!ie);for(let ie of G)r.push({id:`data:${ie.name}`,label:ie.label,kind:ie.kind,layer:6,status:Jn(ie.service.status),sub:ie.name,facts:[{label:"Unit",value:ie.name},{label:"State",value:Pe(ie.service.status,"unknown")}],href:"/data/services",group:"box"});let te=e.backup??{};if(te.enabled)r.push({id:"backup",label:"Backups",kind:"backup",layer:7,status:"ok",sub:Pe(te.destination,"destination"),facts:[{label:"Destination",value:Pe(te.destination,"unknown")},{label:"Schedule",value:Pe(te.schedule,"unknown")},{label:"Retention",value:`${te.retention??0} copies`},{label:"Last run",value:Pe(te.last,"unknown")}],href:"/data/backups"});let ye=new Set(r.map((ie)=>ie.id));Gt(a,{source:"internet",target:"dns",flow:"request",label:"https"},ye),Gt(a,{source:"dns",target:"firewall",flow:"request",label:"443/80"},ye),Gt(a,{source:"firewall",target:"proxy",flow:"request"},ye);for(let ie of h){let xe=`site:${Pe(ie.name)}`;Gt(a,{source:"proxy",target:xe,flow:"request",label:Pe(ie.path)||void 0,status:Jn(ie.status)},ye)}for(let ie of S){let xe=`worker:${Pe(ie.name)}`,ee=`site:${Pe(ie.site)}`;if(ye.has(ee))Gt(a,{source:ee,target:xe,flow:"async",label:"queue"},ye);else Gt(a,{source:"proxy",target:xe,flow:"async",label:"queue"},ye)}for(let ie of S)Gt(a,{source:"scheduler",target:`worker:${Pe(ie.name)}`,flow:"async",label:"dispatch"},ye);let Se=[...h.map((ie)=>`site:${Pe(ie.name)}`),...S.map((ie)=>`worker:${Pe(ie.name)}`)];for(let ie of G)for(let xe of Se)Gt(a,{source:xe,target:`data:${ie.name}`,flow:"data",label:"localhost"},ye);if(G.length&&Se.length)g.push("Data-service edges show co-location on the box: every process on it can reach localhost. They are not a declared per-site binding.");for(let ie of G)Gt(a,{source:`data:${ie.name}`,target:"backup",flow:"backup",label:"snapshot"},ye);for(let ie of h)Gt(a,{source:`site:${Pe(ie.name)}`,target:"backup",flow:"backup"},ye);return{mode:"server",project:Pe(t.project)||Pe(e.project?.name)||Pe(f.name,"project"),environment:Pe(t.environment)||Pe(e.environment,"production"),provider:Pe(f.provider,"unknown"),region:Pe(f.region,"unknown"),generatedAt:new Date().toISOString(),layers:rC,groups:[{id:"box",label:Pe(f.name,"App server"),sub:[Pe(f.provider),Pe(f.region),Pe(f.ip)].filter(Boolean).join(" · ")}],nodes:r,links:a,notes:g}}function vs(e,t={}){let r=[],a=[],g=[],f=e.app??{},h=Array.isArray(e.functions)?e.functions:[],b=Array.isArray(e.queues)?e.queues:[],S=e.metrics??{};if(!h.length)g.push("No Lambda functions were read for this environment, so the compute layer is empty rather than assumed.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let y=Pe(f.url),k=y.replace(/^https?:\/\//,"").split("/")[0];r.push({id:"dns",label:k||"Application domain",kind:"dns",layer:1,status:k?"ok":"unknown",sub:"DNS & certificates",facts:[{label:"Endpoint",value:y||"not resolved"}],external:!0});let R=e.waf;if(R)r.push({id:"waf",label:"WAF",kind:"waf",layer:2,status:Jn(R.status??"active"),sub:Pe(R.scope,"Managed rules"),facts:[{label:"Web ACL",value:Pe(R.name,"unnamed")},...R.blocked!=null?[{label:"Blocked (24h)",value:String(R.blocked)}]:[],{label:"Rules",value:String(sC(e.wafRules))}],href:"/serverless/firewall"});let D=e.assetsInfo;if(D)r.push({id:"cdn",label:"Asset CDN",kind:"cdn",layer:2,status:"ok",sub:Pe(D.cdn,"CloudFront"),facts:[{label:"Distribution",value:Pe(D.cdn,"unknown")},{label:"Custom domain",value:Pe(D.customDomain,"none")}],href:"/serverless/assets"}),r.push({id:"assets",label:"Asset bucket",kind:"storage",layer:6,status:"ok",sub:Pe(D.bucket,"S3"),facts:[{label:"Bucket",value:Pe(D.bucket,"unknown")},...D.files?[{label:"Objects",value:String(D.files)}]:[],...D.sizeMb?[{label:"Size",value:`${D.sizeMb} MB`}]:[]],href:"/serverless/assets"});let O=h.find((ee)=>Pe(ee.key).startsWith("http"));r.push({id:"gateway",label:"HTTP entry point",kind:"gateway",layer:3,status:O?"ok":"unknown",sub:"Function URL / API Gateway",facts:[{label:"Endpoint",value:y||"not resolved"},{label:"Invocations (24h)",value:String(S.invocations??0)},...S.errorRatePct!=null?[{label:"Error rate",value:`${S.errorRatePct}%`}]:[]],href:"/serverless/metrics"});for(let ee of h){let De=`fn:${Pe(ee.name)}`;if(!Pe(ee.name))continue;let Je=Number(ee.errors??0),gt=Number(ee.invocations??0);r.push({id:De,label:Pe(ee.key,Pe(ee.name)),kind:"function",layer:4,status:Je>0?gt&&Je/gt>0.02?"bad":"warn":gt?"ok":"idle",sub:Pe(ee.runtime,"lambda"),facts:[{label:"Function",value:Pe(ee.name)},{label:"Memory",value:`${ee.memory??0} MB`},{label:"Timeout",value:`${ee.timeout??0}s`},{label:"Invocations (24h)",value:String(gt)},{label:"Errors (24h)",value:String(Je)},{label:"p95",value:`${ee.p95??0} ms`},...ee.provisioned?[{label:"Provisioned",value:Pe(ee.provisioned)}]:[]],href:"/serverless/functions"})}for(let ee of b){let De=`queue:${Pe(ee.name)}`;if(!Pe(ee.name))continue;let Je=Number(ee.dlq??0);r.push({id:De,label:Pe(ee.name),kind:"queue",layer:5,status:Je>0?"bad":Number(ee.visible??0)>0?"warn":"ok",sub:"SQS",facts:[{label:"Visible",value:String(ee.visible??0)},{label:"In flight",value:String(ee.inFlight??0)},{label:"Processed (24h)",value:String(ee.processed??0)},{label:"Dead letter",value:String(Je)}],href:"/serverless/queues"})}let M=e.aurora;if(M)r.push({id:"database",label:"Aurora Serverless",kind:"database",layer:6,status:Jn(M.status),sub:Pe(M.engine,"aurora"),facts:[{label:"Cluster",value:Pe(M.id,"unknown")},{label:"Capacity",value:`${M.currentAcu??0} ACU (${M.minAcu??0}–${M.maxAcu??0})`},{label:"Connections",value:String(M.connections??0)}],href:"/serverless/data"});let z=e.proxy;if(z)r.push({id:"rds-proxy",label:"RDS Proxy",kind:"database",layer:5,status:Jn(z.status),sub:"Connection pooling",facts:[{label:"Proxy",value:Pe(z.name,"unknown")},{label:"Endpoint",value:Pe(z.endpoint,"unknown")},{label:"Pooled",value:String(z.pooledConns??0)}],href:"/serverless/data"});let J=e.redis;if(J)r.push({id:"cache",label:"ElastiCache",kind:"cache",layer:6,status:Jn(J.status),sub:Pe(J.node,"redis"),facts:[{label:"Group",value:Pe(J.id,"unknown")},{label:"Hit rate",value:`${J.hitRate??0}%`}],href:"/serverless/data"});let Z=e.efs;if(Z)r.push({id:"efs",label:"EFS",kind:"filesystem",layer:6,status:Jn(Z.status),sub:Pe(Z.mount,"/mnt/local"),facts:[{label:"File system",value:Pe(Z.id,"unknown")},{label:"Mount",value:Pe(Z.mount,"unknown")},{label:"Size",value:`${Z.sizeMb??0} MB`}],href:"/data/volumes"});let oe=e.scheduler??{};if(oe.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:3,status:"ok",sub:Pe(oe.expression,"rate(1 minute)"),facts:[{label:"Expression",value:Pe(oe.expression,"unknown")},{label:"Last run",value:Pe(oe.lastRun,"unknown")}],href:"/operations/jobs"});let G=new Set(r.map((ee)=>ee.id)),te=G.has("waf")?"waf":"gateway";Gt(a,{source:"internet",target:"dns",flow:"request",label:"https"},G),Gt(a,{source:"dns",target:te,flow:"request"},G),Gt(a,{source:"dns",target:"cdn",flow:"request",label:"assets"},G),Gt(a,{source:"waf",target:"gateway",flow:"request",label:"allowed"},G),Gt(a,{source:"cdn",target:"assets",flow:"data",label:"origin"},G);let ye=h.filter((ee)=>Pe(ee.key).startsWith("http")),Se=h.filter((ee)=>Pe(ee.key).startsWith("queue")),ie=h.filter((ee)=>Pe(ee.key).startsWith("cli"));for(let ee of ye)Gt(a,{source:"gateway",target:`fn:${Pe(ee.name)}`,flow:"request",label:"invoke"},G);for(let ee of ie)Gt(a,{source:"scheduler",target:`fn:${Pe(ee.name)}`,flow:"async",label:"schedule"},G);for(let ee of b){for(let De of ye)Gt(a,{source:`fn:${Pe(De.name)}`,target:`queue:${Pe(ee.name)}`,flow:"async",label:"publish"},G);for(let De of Se)Gt(a,{source:`queue:${Pe(ee.name)}`,target:`fn:${Pe(De.name)}`,flow:"async",label:"consume"},G)}let xe=["rds-proxy","database","cache","efs","assets"];for(let ee of h){let De=`fn:${Pe(ee.name)}`;if(G.has("rds-proxy"))Gt(a,{source:De,target:"rds-proxy",flow:"data",label:"pooled"},G);else Gt(a,{source:De,target:"database",flow:"data",label:"sql"},G);for(let Je of xe.filter((gt)=>gt!=="rds-proxy"&&gt!=="database"))Gt(a,{source:De,target:Je,flow:"data"},G)}return Gt(a,{source:"rds-proxy",target:"database",flow:"data",label:"sql"},G),{mode:"serverless",project:Pe(t.project)||Pe(f.name,"application"),environment:Pe(t.environment)||Pe(f.env,"production"),provider:"aws",region:Pe(f.region,"unknown"),generatedAt:new Date().toISOString(),layers:nC,groups:[],nodes:r,links:a,notes:g}}function Eh(e,t,r={}){return e==="serverless"?vs(t,r):Qt(t,r)}function jv(e){return String(e).padStart(2,"0")}function ks(e){return`${e.getUTCFullYear()}-${jv(e.getUTCMonth()+1)}-${jv(e.getUTCDate())}`}function aC(e){let t=Math.max(0,Math.round((Date.now()-e)/1000));if(t<60)return`${t}s ago`;let r=Math.round(t/60);if(r<60)return`${r}m ago`;let a=Math.round(r/60);if(a<48)return`${a}h ago`;return`${Math.round(a/24)}d ago`}async function aa(e,t,r,a,g,f){let h=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:r,Dimensions:[{Name:"FunctionName",Value:t}],StartTime:g,EndTime:f,Period:86400,Statistics:[a]}).catch(()=>[]);if(!h.length)return 0;if(a==="Sum")return h.reduce((b,S)=>b+(S.Sum??0),0);if(a==="Maximum")return Math.max(...h.map((b)=>b.Maximum??0));return h.reduce((b,S)=>b+(S.Average??0),0)/h.length}async function ca(e,t,r,a,g,f,h){let b=await e.getMetricStatistics({Namespace:t,MetricName:r,Dimensions:a,StartTime:f,EndTime:h,Period:86400,Statistics:[g]}).catch(()=>[]);if(!b.length)return 0;if(g==="Sum")return b.reduce((S,y)=>S+(y.Sum??0),0);if(g==="Maximum")return Math.max(...b.map((S)=>S.Maximum??0));return b.reduce((S,y)=>S+(y.Average??0),0)/b.length}async function Tg(e,t,r,a,g){let f=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:[{Name:"FunctionName",Value:t}],StartTime:a,EndTime:g,Period:86400,ExtendedStatistics:[r]}).catch(()=>[]);return Math.round(f.reduce((h,b)=>h+(b.Percentiles?.[r]??0),0))}async function xn(e,t){let r=await hr(e,t),a=r.region,g=new fe(a),f=new T(a),h=new we(a),b=new Date,S=new Date(b.getTime()-86400000),y=e.environments?.[t]?.app,k={};k.app={name:r.slug,env:t,region:a,runtime:y?.kind==="php"?`php-${y?.phpVersion??"8.3"} (fpm)`:y?.kind??"node",url:r.endpoint??"",build:r.lastRelease?.sha?.slice(0,7)??"—",deployedAt:r.lastRelease?.timestamp??"—"},k.maintenance={enabled:!1},k.scheduler={enabled:r.scheduler!=="off",expression:r.scheduler==="sub-minute"?"rate(1 minute) · sub-minute":"rate(1 minute)",lastRun:"—"};let R=0,D=0,O=0,M=[],z=[],J=[];for(let te of r.functions){let[ye,Se,ie,xe,ee,De,Je,gt,jt]=await Promise.all([aa(g,te.name,"Invocations","Sum",S,b),aa(g,te.name,"Errors","Sum",S,b),aa(g,te.name,"Throttles","Sum",S,b),aa(g,te.name,"Duration","Average",S,b),f.getFunction(te.name).catch(()=>null),Tg(g,te.name,"p50",S,b),Tg(g,te.name,"p95",S,b),Tg(g,te.name,"p99",S,b),g.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:te.name}],StartTime:new Date(b.getTime()-43200000),EndTime:b,Period:3600,Stat:"Sum"}).catch(()=>[])]);R+=ye,D+=Se,O=Math.max(O,xe);let Ze=ee?.Configuration?.MemorySize??0,wt=Object.keys(ee?.Configuration?.Environment?.Variables??{}),Bt=[],nt=0;try{let{events:se=[]}=await h.filterLogEvents({logGroupName:`/aws/lambda/${te.name}`,startTime:S.getTime(),limit:120});for(let ue of se){let Ce=(ue.message??"").trim(),mt=/Max Memory Used:\s*(\d+)\s*MB/.exec(Ce);if(mt)nt=Math.max(nt,Number(mt[1]));if(Ce&&!/^(?:START|END|REPORT|INIT_START)/.test(Ce))J.push({source:te.mode||te.name,timestamp:new Date(ue.timestamp??0).toISOString(),when:aC(ue.timestamp??0),message:Ce.slice(0,400),level:/error|exception|fatal|panic|traceback/i.test(Ce)?"error":/warn|warning|timeout|retr(?:y|ies)|throttl/i.test(Ce)?"warn":"info"})}Bt=se.filter((ue)=>!/^(?:START|END|REPORT|INIT_START)/.test((ue.message??"").trim())).slice(-6).map((ue)=>({ts:new Date(ue.timestamp??0).toISOString().slice(11,19),msg:(ue.message??"").trim().slice(0,120),err:/error|exception|fatal/i.test(ue.message??"")}))}catch{}let W=Math.max(1,...jt);M.push({key:te.mode,name:te.name,version:te.version,memory:Ze,timeout:ee?.Configuration?.Timeout??0,runtime:ee?.Configuration?.Runtime??"provided.al2023",invocations:Math.round(ye),errors:Math.round(Se),p95:Je||Math.round(xe),status:"active",provisioned:te.provisioned?`${te.provisioned.allocated}/${te.provisioned.requested}`:void 0}),z.push({key:te.mode,name:te.name,runtime:ee?.Configuration?.Runtime??"provided.al2023",arch:ee?.Configuration?.Architectures?.[0]??"x86_64",memory:Ze,timeout:ee?.Configuration?.Timeout??0,ephemeral:ee?.Configuration?.EphemeralStorage?.Size??512,version:te.version,concurrency:y?.concurrency??"—",invocations:Math.round(ye),errors:Math.round(Se),throttles:Math.round(ie),p50:De||Math.round(xe),p95:Je||Math.round(xe),p99:gt||Math.round(xe),maxMem:nt,spark:jt.length?jt.map((se)=>Math.round(se/W*100)):[0],env:wt.length?wt:["(none)"],recent:Bt.length?Bt:[{ts:"—",msg:"no recent events",err:!1}]})}k.functions=M,k.functionsDetail=z,k.serverlessLogs=J.sort((te,ye)=>String(ye.timestamp).localeCompare(String(te.timestamp))).slice(0,600),k.serverlessLogsEmptyReason=J.length?void 0:"No recent function logs were found in CloudWatch for this environment.";let Z=R?Number((D/R*100).toFixed(2)):0,oe=Math.round(await aa(g,r.functions[0]?.name??"","ConcurrentExecutions","Maximum",S,b));k.metrics={invocations:Math.round(R),errorRatePct:Z,p95Ms:Math.round(O),coldStartPct:void 0,concurrency:oe,estCostUsd:void 0};try{let te=new me(a),ye=[],Se=[],ie=0;try{let{QueueUrl:ee}=await te.getQueueUrl(`${r.slug}-${t}-dlq`),{Attributes:De}=await te.getQueueAttributes(ee);ie=Number(De.ApproximateNumberOfMessages??0)}catch{}let xe=y?Ar(y,r.slug,t):[];for(let ee of xe){let De=ee.name.replace(`${r.slug}-${t}-`,""),Je=0,gt=0;try{let{QueueUrl:Ze}=await te.getQueueUrl(ee.name),{Attributes:wt}=await te.getQueueAttributes(Ze);Je=Number(wt.ApproximateNumberOfMessages??0),gt=Number(wt.ApproximateNumberOfMessagesNotVisible??0)}catch{}let jt=Math.round(await ca(g,"AWS/SQS","NumberOfMessagesDeleted",[{Name:"QueueName",Value:ee.name}],"Sum",S,b));ye.push({name:De,visible:Je,inFlight:gt,processed:jt,dlq:ie}),Se.push({name:ee.name,short:De,visible:Je,inFlight:gt,delayed:0,processed:jt,oldestSec:0,concurrency:ee.concurrency??y?.queueConcurrency??"—",tries:y?.queueTries??3,visTimeout:(y?.queueTimeout??120)*6,dlq:ie})}if(ye.length)k.queues=ye;if(Se.length)k.queuesDetail=Se;k.dlqItems=[]}catch{}try{let te=new A(a),{Stacks:ye}=await te.describeStacks({stackName:lr(e,t)}),Se={};for(let ie of ye?.[0]?.Outputs??[])if(ie.OutputKey)Se[ie.OutputKey]=ie.OutputValue??"";if(y?.database?.connection==="aurora-serverless"){let ie=`${r.slug}-${t}-db`,xe=[{Name:"DBClusterIdentifier",Value:ie}],[ee,De]=await Promise.all([ca(g,"AWS/RDS","ServerlessDatabaseCapacity",xe,"Average",S,b),ca(g,"AWS/RDS","DatabaseConnections",xe,"Maximum",S,b)]);if(k.aurora={id:ie,engine:"aurora-mysql",minAcu:y?.database?.minCapacity??0.5,maxAcu:y?.database?.maxCapacity??4,currentAcu:ee?Number(ee.toFixed(1)):y?.database?.minCapacity??0.5,database:"app",connections:Math.round(De),status:Se.DbEndpoint?"available":"creating"},y?.rdsProxy)k.proxy={name:`${r.slug}-${t}-proxy`,endpoint:Se.DbProxyEndpoint??"—",pooledConns:Math.round(De),status:"available"}}if(y?.cache?.driver==="elasticache"){let ie=`${r.slug}-${t}-cache`,xe=[{Name:"CacheClusterId",Value:`${ie}-001`}],[ee,De]=await Promise.all([ca(g,"AWS/ElastiCache","CacheHits",xe,"Sum",S,b),ca(g,"AWS/ElastiCache","CacheMisses",xe,"Sum",S,b)]),Je=ee+De>0?Number((ee/(ee+De)*100).toFixed(1)):0;k.redis={id:ie,node:"cache.t4g.micro",engine:"redis",hitRate:Je,status:Se.CacheEndpoint?"available":"creating"}}if(y?.efs){let ie=0;try{if(Se.EfsFileSystemId){let xe=new Pr(a),{FileSystems:ee}=await xe.describeFileSystems({FileSystemId:Se.EfsFileSystemId});ie=Number(((ee?.[0]?.SizeInBytes?.Value??0)/1048576).toFixed(1))}}catch{}k.efs={id:Se.EfsFileSystemId??"efs",mount:"/mnt/local",sizeMb:ie,status:"available"}}k.assetsInfo=Se.AssetsCdnDomain?{bucket:Se.AssetsBucketName??`${r.slug}-${t}-assets`,cdn:Se.AssetsCdnDomain,customDomain:y?.assetDomain??"—",assetUrl:r.assetUrl??"—",files:0,sizeMb:0,cacheHitPct:0,build:k.app.build}:void 0}catch{}if(k.assetsInfo)try{let ye=await new o(a).list({bucket:k.assetsInfo.bucket,maxKeys:1000});k.assetsInfo.files=ye.length,k.assetsInfo.sizeMb=Number((ye.reduce((Se,ie)=>Se+(ie.Size??0),0)/1048576).toFixed(1)),k.assetsRecent=ye.slice(0,8).map((Se)=>({path:`/${Se.Key}`,size:`${Math.max(1,Math.round((Se.Size??0)/1024))} KB`,type:Se.Key.split(".").pop()??""}))}catch{}try{if(y?.secrets){let te=Array.isArray(y.secrets)?y.secrets.map((ye)=>({key:ye.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),source:ye})):Object.entries(y.secrets).map(([ye,Se])=>({key:ye,source:String(Se)}));k.secretsList=te.map((ye)=>({...ye,updated:"—"}))}}catch{}try{let te=new o(a),ye=`${r.slug}-${t}-deployments`,Se=await te.getObjectJson(ye,`deployments/${r.slug}/${t}/history.json`).catch(()=>null);if(Se?.records?.length)k.deploymentsDetail=Se.records.slice(-12).reverse().map((ie)=>({sha:(ie.sha??"").slice(0,7),status:ie.status??"success",when:ie.timestamp??"—",took:ie.took??"—",by:ie.by??"—",version:ie.version??"—",hooks:ie.hooks??[]}))}catch{}k.metricsTotals={invocations:k.metrics.invocations,errors:Math.round(D),errorRatePct:Z,p95Ms:k.metrics.p95Ms,throttles:z.reduce((te,ye)=>te+ye.throttles,0),coldStartPct:void 0,estCostUsd:void 0,concurrency:oe},k.metricsPerFn=z.map((te)=>({key:te.key,invocations:te.invocations,errors:te.errors,throttles:te.throttles,avgMs:te.p50,maxMs:te.p99,costUsd:void 0}));try{k.invSpark=await g.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:r.functions.find((te)=>te.mode==="http")?.name??""}],StartTime:new Date(b.getTime()-86400000),EndTime:b,Period:3600,Stat:"Sum"})}catch{}try{let te=new $s,ye=b,Se=new Date(Date.UTC(ye.getUTCFullYear(),ye.getUTCMonth(),1)),ie=new Date(Date.UTC(ye.getUTCFullYear(),ye.getUTCMonth()-1,1)),[xe,ee]=await Promise.all([te.getCostByService({start:ks(Se),end:ks(ye),granularity:"MONTHLY"}).catch(()=>[]),te.getCostByService({start:ks(ie),end:ks(Se),granularity:"MONTHLY"}).catch(()=>[])]);if(xe.length){let De=xe.reduce((nt,W)=>nt+W.amount,0),Je=ee.reduce((nt,W)=>nt+W.amount,0),gt=ye.getUTCDate(),jt=new Date(Date.UTC(ye.getUTCFullYear(),ye.getUTCMonth()+1,0)).getUTCDate();k.costSummary={monthToDateUsd:Number(De.toFixed(2)),projectedUsd:Number((De/gt*jt).toFixed(2)),lastMonthUsd:Number(Je.toFixed(2)),dailyAvgUsd:Number((De/gt).toFixed(2))},k.costServices=xe.filter((nt)=>nt.amount>0).sort((nt,W)=>W.amount-nt.amount).slice(0,12).map((nt)=>({name:nt.service,usd:Number(nt.amount.toFixed(2)),note:""})),k.metrics.estCostUsd=Number((De/gt).toFixed(2)),k.metricsTotals.estCostUsd=k.metrics.estCostUsd,k.costTrend=await te.getDailyTotals({start:ks(Se),end:ks(ye)}).catch(()=>[]);let Ze=xe.find((nt)=>/lambda/i.test(nt.service))?.amount??0,wt=(nt)=>nt.invocations*(nt.p50/1000)*(nt.memory/1024),Bt=z.reduce((nt,W)=>nt+wt(W),0)||1;k.costPerFn=z.map((nt)=>({key:nt.key,requests:nt.invocations,gbSec:Math.round(wt(nt)),usd:Number((Ze*(wt(nt)/Bt)).toFixed(2))}))}}catch{}if(y?.firewall)try{let te=await g.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"BlockedRequests",StartTime:S,EndTime:b,Period:86400,Statistics:["Sum"]}).catch(()=>[]),ye=await g.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"AllowedRequests",StartTime:S,EndTime:b,Period:86400,Statistics:["Sum"]}).catch(()=>[]);k.waf={enabled:!0,scope:"REGIONAL",acl:`${r.slug}-${t}-waf`,allowed24h:Math.round(ye.reduce((Se,ie)=>Se+(ie.Sum??0),0)),blocked24h:Math.round(te.reduce((Se,ie)=>Se+(ie.Sum??0),0))};try{let Se=new _g(a),ie=await Se.listWebACLs("REGIONAL"),xe=ie.find((ee)=>ee.Name?.includes(`${r.slug}-${t}`))??ie[0];if(xe?.Name&&xe.Id){k.waf.acl=xe.Name;let ee=await Se.getWebACLRules(xe.Name,xe.Id,"REGIONAL");if(ee.length)k.wafRules=ee.map((De)=>({name:De.Name??"—",detail:`priority ${De.Priority??0}`,action:De.Action??"count",blocked24h:0}))}}catch{}}catch{}let G=[];if(k.aurora)G.push({name:"Aurora Serverless v2",detail:`${k.aurora.id} · ${k.aurora.minAcu}-${k.aurora.maxAcu} ACU`,status:k.aurora.status});if(k.proxy)G.push({name:"RDS Proxy",detail:k.proxy.name,status:k.proxy.status});if(k.redis)G.push({name:`ElastiCache (${k.redis.engine})`,detail:`${k.redis.node} · ${k.redis.hitRate}% hit rate`,status:k.redis.status});if(k.efs)G.push({name:"EFS",detail:`${k.efs.mount} · ${k.efs.sizeMb} MB`,status:k.efs.status});if(G.length)k.dataServices=G;if(r.scheduler!=="off"&&y?.kind==="php")try{let te=await lt(e,t,"schedule:list"),ye=[];for(let Se of(te||"").split(`
-`)){let ie=/^\s*([\d*/,\-\s]+?)\s{2,}(.+?)(?:\s{2,}Next Due.*)?$/.exec(Se);if(ie&&/[*\d]/.test(ie[1])&&ie[1].trim().split(/\s+/).length===5)ye.push({command:ie[2].trim().replace(/^php artisan /,""),cron:ie[1].trim(),desc:"",lastRun:"—",lastStatus:"ok"})}if(ye.length)k.schedulerTasks=ye}catch{}return k.topology=vs(k,{project:e.project.name,environment:t}),k}function Ui(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:null}function cC(e){if(!/^\d{4}-\d{2}-\d{2}$/.test(e))return null;let t=Date.parse(`${e}T12:00:00.000Z`);return Number.isFinite(t)?new Date(t).toISOString():null}function gg(e,t){if(!e||typeof e!=="object")return[];let r={source:t.name},a=[],g=t.now,f=(y,k,R,D=g)=>{if(k!==null)a.push({name:y,value:k,unit:R,timestamp:D,attributes:r})};f("storage.egress.month",Ui(e.monthBytes),"bytes"),f("storage.egress.today",Ui(e.todayBytes),"bytes"),f("storage.egress.projected_month",Ui(e.projectedMonthBytes),"bytes");let h=Ui(e.budgetBytes);if(h!==null&&h>0){f("storage.egress.budget",h,"bytes");let y=e.budgetUsedPercent,k=typeof y==="number"&&Number.isFinite(y)?y:Ui(e.monthBytes)!==null?Math.round(Ui(e.monthBytes)/h*1000)/10:null;f("storage.egress.budget_used_percent",k,"percent")}let b=t.maxReplayDays??45,S=Array.isArray(e.days)?e.days.slice(-b):[];for(let y of S){let k=cC(String(y?.date??"")),R=Ui(y?.bytes);if(!k||R===null)continue;a.push({name:"storage.egress.day",value:R,unit:"bytes",timestamp:k,attributes:r});let D=Ui(y?.downloads);if(D!==null)a.push({name:"storage.egress.day_downloads",value:D,unit:"count",timestamp:k,attributes:r})}return a}async function pg(e,t=process.env,r=fetch){let a=e.tokenEnv?t[e.tokenEnv]:void 0,g=await r(e.url,{headers:a?{Authorization:`Bearer ${a}`}:{},signal:AbortSignal.timeout(1e4)});if(!g.ok)throw Error(`HTTP ${g.status}`);return await g.json()}async function Za(e,t){let r=[],a=[];if(!Array.isArray(e)||e.length===0)return{metrics:r,errors:a};let g=await Promise.all(e.map(async(f)=>{if(!f?.name||!f?.url)return{endpoint:f,error:"egress endpoint needs both a name and a url"};try{let h=await pg(f,t.env,t.fetchImpl);return{endpoint:f,report:h}}catch(h){return{endpoint:f,error:h instanceof Error?h.message:String(h)}}}));for(let f of g){let h=`egress:${f.endpoint?.name??"unnamed"}`;if("error"in f&&f.error){a.push({source:h,message:f.error});continue}r.push(...gg(f.report,{name:f.endpoint.name,now:t.now}))}return{metrics:r,errors:a}}import{createHash as j_}from"node:crypto";import{existsSync as Si,mkdtempSync as Im,readdirSync as NS,rmSync as Ao,statSync as cw}from"node:fs";import{readFile as ni,writeFile as Eo}from"node:fs/promises";import{tmpdir as vl}from"node:os";import{dirname as B_,extname as Ic,join as xt,normalize as M_,relative as L_,resolve as F_,sep as z_}from"node:path";import{fileURLToPath as U_}from"node:url";import{isIP as Bv}from"node:net";var vt=(e)=>e==null?void 0:String(e),Fd=(e)=>Number(e)===1,qi=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}};function Mv(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),provider:String(e.provider),endpoint:vt(e.endpoint),endpointPolicy:String(e.endpoint_policy),bucket:vt(e.bucket),prefix:String(e.prefix),region:vt(e.region),forcePathStyle:Fd(e.force_path_style),credentialRef:vt(e.credential_ref),encryption:String(e.encryption),encryptionKeyRef:vt(e.encryption_key_ref),immutability:qi(e.immutability,{}),status:String(e.status),lastTestedAt:vt(e.last_tested_at),lastSuccessAt:vt(e.last_success_at),lastFailureAt:vt(e.last_failure_at),lastError:vt(e.last_error),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function xg(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:vt(e.environment_id),resourceId:vt(e.resource_id),dataServiceId:vt(e.data_service_id),destinationId:String(e.destination_id),name:String(e.name),resourceKind:String(e.resource_kind),schedule:String(e.schedule),timezone:String(e.timezone),retention:qi(e.retention,{}),compression:String(e.compression),encryption:String(e.encryption),includePatterns:qi(e.include_patterns,[]),excludePatterns:qi(e.exclude_patterns,[]),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),healthCheckId:vt(e.health_check_id),enabled:Fd(e.enabled),nextRunAt:vt(e.next_run_at),lastRunAt:vt(e.last_run_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Dg(e){return{id:String(e.id),projectId:String(e.project_id),policyId:vt(e.policy_id),destinationId:String(e.destination_id),resourceId:vt(e.resource_id),dataServiceId:vt(e.data_service_id),backupJobId:vt(e.backup_job_id),kind:String(e.kind),pointInTime:String(e.point_in_time),uri:String(e.uri),sizeBytes:Number(e.size_bytes),checksum:String(e.checksum),manifest:qi(e.manifest,{}),toolVersion:vt(e.tool_version),engineVersion:vt(e.engine_version),expiresAt:vt(e.expires_at),lockedUntil:vt(e.locked_until),held:Fd(e.held),pinned:Fd(e.pinned),status:String(e.status),verificationState:String(e.verification_state),verifiedAt:vt(e.verified_at),durationMs:e.duration_ms==null?void 0:Number(e.duration_ms),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Og(e){return{id:String(e.id),projectId:String(e.project_id),policyId:vt(e.policy_id),recoveryPointId:vt(e.recovery_point_id),operationId:vt(e.operation_id),kind:String(e.kind),status:String(e.status),idempotencyKey:String(e.idempotency_key),target:qi(e.target,{}),restoreMode:vt(e.restore_mode),cancellability:String(e.cancellability),safetyBackupId:vt(e.safety_backup_id),healthResult:e.health_result?qi(e.health_result,{}):void 0,progress:qi(e.progress,{}),error:vt(e.error),startedAt:vt(e.started_at),finishedAt:vt(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function dC(e){let t=e.toLowerCase();if(t==="localhost"||t.endsWith(".localhost")||t.endsWith(".local")||t.endsWith(".internal"))return!0;if(Bv(t)===6)return t==="::1"||t.startsWith("fe80:");if(Bv(t)!==4)return!1;let[r,a]=t.split(".").map(Number);return r===10||r===127||r===0||r===169&&a===254||r===172&&a>=16&&a<=31||r===192&&a===168}function vh(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup destination names must be 2-63 lowercase letters, numbers, or dashes.");if(e.provider!=="aws_backup"&&!e.bucket)throw Error("S3 backup destinations require a bucket.");if(e.provider==="s3_compatible"&&!e.endpoint)throw Error("S3-compatible destinations require an explicit endpoint.");if(e.provider==="s3_compatible"&&!e.credentialRef)throw Error("S3-compatible destinations require a credential reference.");if(e.encryption!=="provider"&&!e.encryptionKeyRef)throw Error("Client-side encryption requires an encryption key reference.");if(e.endpoint){let t=new URL(e.endpoint);if(t.protocol!=="https:"||t.username||t.password||t.search||t.hash||t.pathname!=="/")throw Error("Backup endpoints must be origin-only HTTPS URLs without credentials, paths, queries, or fragments.");if(dC(t.hostname)&&e.endpointPolicy!=="allow_private")throw Error("Private backup endpoints require endpointPolicy allow_private.")}}class ec{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}createDestination(e){vh(e);let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_destinations (id,organization_id,project_id,name,provider,endpoint,endpoint_policy,bucket,prefix,region,force_path_style,credential_ref,encryption,encryption_key_ref,immutability,status,last_tested_at,last_success_at,last_failure_at,last_error,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.provider,e.endpoint??null,e.endpointPolicy,e.bucket??null,e.prefix,e.region??null,e.forcePathStyle?1:0,e.credentialRef??null,e.encryption,e.encryptionKeyRef??null,JSON.stringify(e.immutability),e.status,e.lastTestedAt??null,e.lastSuccessAt??null,e.lastFailureAt??null,e.lastError??null,1,r,r]),this.getDestination(t)}getDestination(e){let t=this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE id=?").get(e);return t?Mv(t):void 0}listDestinations(e){return this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE project_id=? ORDER BY name").all(e).map(Mv)}recordDestinationTest(e,t){let r=this.now().toISOString();return this.controlPlane.database.run("UPDATE backup_destinations SET status=?,last_tested_at=?,last_success_at=CASE WHEN ? THEN ? ELSE last_success_at END,last_failure_at=CASE WHEN ? THEN last_failure_at ELSE ? END,last_error=?,version=version+1,updated_at=? WHERE id=?",[t.ok?"healthy":"failing",r,t.ok?1:0,r,t.ok?1:0,r,t.ok?null:String(t.error??"Destination test failed.").slice(0,1000),r,e]),this.getDestination(e)}createPolicy(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup policy names must be lowercase slugs.");if(!e.resourceId&&!e.dataServiceId&&!["control_plane","infrastructure"].includes(e.resourceKind))throw Error("A backup policy requires a resource or data service target.");let t=this.getDestination(e.destinationId);if(!t||t.projectId!==e.projectId)throw Error("Backup destination was not found.");if(e.resourceKind==="control_plane"&&t.encryption==="provider")throw Error("Control-plane backups require client-side destination encryption.");if(["logical_database","volume","files","control_plane"].includes(e.resourceKind)&&t.provider==="aws_backup")throw Error(`${e.resourceKind} backups require an object-storage destination.`);if(e.resourceKind==="infrastructure"&&t.provider!=="aws_backup")throw Error("Infrastructure backups require an AWS Backup destination.");let r=dt(e.schedule),a=Ft(r.normalized,e.timezone,this.now(),1)[0],g=crypto.randomUUID(),f=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_policies (id,organization_id,project_id,environment_id,resource_id,data_service_id,destination_id,name,resource_kind,schedule,timezone,retention,compression,encryption,include_patterns,exclude_patterns,expected_rpo_minutes,expected_rto_minutes,health_check_id,enabled,next_run_at,last_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[g,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.dataServiceId??null,e.destinationId,e.name,e.resourceKind,r.normalized,e.timezone,JSON.stringify(e.retention),e.compression,e.encryption,JSON.stringify(e.includePatterns),JSON.stringify(e.excludePatterns),e.expectedRpoMinutes,e.expectedRtoMinutes,e.healthCheckId??null,e.enabled?1:0,a,e.lastRunAt??null,1,f,f]),this.getPolicy(g)}getPolicy(e){let t=this.controlPlane.database.query("SELECT * FROM backup_policies WHERE id=?").get(e);return t?xg(t):void 0}listPolicies(e,t){return this.controlPlane.database.query(`SELECT * FROM backup_policies WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(xg)}duePolicies(e=this.now()){return this.controlPlane.database.query("SELECT * FROM backup_policies WHERE enabled=1 AND next_run_at<=? ORDER BY next_run_at,id").all(e.toISOString()).map(xg)}advancePolicy(e,t){let r=this.getPolicy(e);if(!r)throw Error("Backup policy was not found.");let a=Ft(r.schedule,r.timezone,new Date(t),1)[0];return this.controlPlane.database.run("UPDATE backup_policies SET last_run_at=?,next_run_at=?,version=version+1,updated_at=? WHERE id=?",[t,a,this.now().toISOString(),e]),this.getPolicy(e)}createJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return Og(t);let r=crypto.randomUUID(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_jobs (id,project_id,policy_id,recovery_point_id,operation_id,kind,status,idempotency_key,target,restore_mode,cancellability,safety_backup_id,health_result,progress,error,started_at,finished_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.projectId,e.policyId??null,e.recoveryPointId??null,e.operationId??null,e.kind,e.status,e.idempotencyKey,JSON.stringify(e.target),e.restoreMode??null,e.cancellability,e.safetyBackupId??null,e.healthResult?JSON.stringify(e.healthResult):null,JSON.stringify(e.progress),e.error??null,e.startedAt??null,e.finishedAt??null,a,a]),this.getJob(r)}getJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE id=?").get(e);return t?Og(t):void 0}listJobs(e){return this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE project_id=? ORDER BY created_at DESC").all(e).map(Og)}updateJob(e,t){let r=this.getJob(e);if(!r)throw Error("Backup job was not found.");let a={...r,...t};return this.controlPlane.database.run("UPDATE backup_jobs SET status=?,operation_id=?,recovery_point_id=?,progress=?,health_result=?,error=?,started_at=?,finished_at=?,safety_backup_id=?,updated_at=? WHERE id=?",[a.status,a.operationId??null,a.recoveryPointId??null,JSON.stringify(a.progress),a.healthResult?JSON.stringify(a.healthResult):null,a.error??null,a.startedAt??null,a.finishedAt??null,a.safetyBackupId??null,this.now().toISOString(),e]),this.getJob(e)}createRecoveryPoint(e){if(!/^sha256:[a-f0-9]{64}$/i.test(e.checksum))throw Error("Recovery points require a SHA-256 checksum.");if(typeof e.uri!=="string"||!["s3:","aws-backup:","file:"].some((a)=>e.uri.startsWith(a)))throw Error("Recovery point URI uses an unsupported destination scheme.");let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO recovery_points (id,project_id,policy_id,destination_id,resource_id,data_service_id,backup_job_id,kind,point_in_time,uri,size_bytes,checksum,manifest,tool_version,engine_version,expires_at,locked_until,held,pinned,status,verification_state,verified_at,duration_ms,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.projectId,e.policyId??null,e.destinationId,e.resourceId??null,e.dataServiceId??null,e.backupJobId??null,e.kind,e.pointInTime,e.uri,e.sizeBytes,e.checksum,JSON.stringify(e.manifest),e.toolVersion??null,e.engineVersion??null,e.expiresAt??null,e.lockedUntil??null,e.held?1:0,e.pinned?1:0,e.status,e.verificationState,e.verifiedAt??null,e.durationMs??null,r,r]),this.getRecoveryPoint(t)}getRecoveryPoint(e){let t=this.controlPlane.database.query("SELECT * FROM recovery_points WHERE id=?").get(e);return t?Dg(t):void 0}listRecoveryPoints(e,t){return this.controlPlane.database.query(`SELECT * FROM recovery_points WHERE project_id=?${t?" AND policy_id=?":""} ORDER BY point_in_time DESC`).all(e,...t?[t]:[]).map(Dg)}updateRecoveryPoint(e,t){let r=this.getRecoveryPoint(e);if(!r)throw Error("Recovery point was not found.");let a={...r,...t};return this.controlPlane.database.run("UPDATE recovery_points SET status=?,verification_state=?,verified_at=?,held=?,pinned=?,manifest=?,duration_ms=?,updated_at=? WHERE id=?",[a.status,a.verificationState,a.verifiedAt??null,a.held?1:0,a.pinned?1:0,JSON.stringify(a.manifest),a.durationMs??null,this.now().toISOString(),e]),this.getRecoveryPoint(e)}retentionCandidates(e=this.now()){let t=this.controlPlane.database.query(`SELECT rp.* FROM recovery_points rp
+`;function Av(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function AA(e){return["NoSuchEntity","ResourceNotFoundException","404"].includes(Av(e))}function Ev(e){return["EntityAlreadyExists","ResourceAlreadyExistsException","ResourceConflictException","409"].includes(Av(e))}function Rv(e,t){let r=e?.Items;if(!r)return[];if(Array.isArray(r))return r;let a=r[t];if(a===void 0)return[];return Array.isArray(a)?a:[a]}function Rg(e){let t=e?.Aliases?.Items,r=t?.CNAME??t;if(Array.isArray(r))return r.map(String);if(typeof r==="string")return[r];return[]}function CA(e){if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected CloudFront alias is invalid");if(!/^[A-Za-z0-9-_]{1,64}$/.test(e.functionName))throw Error("Lambda function name is invalid");let t=e.pathPattern?.startsWith("/")?e.pathPattern:`/${e.pathPattern||"api/*"}`;if(t==="/"||t==="/*"||!t.endsWith("*"))throw Error("API path must be a non-default wildcard pattern such as /api/*");let r=e.originId||`${e.functionName}-url`,a=e.roleName||`${e.functionName}-execution`;if(!/^[A-Za-z0-9_.-]{1,64}$/.test(a))throw Error("IAM role name is invalid");let g=e.memorySize??256,f=e.timeout??10,h=e.logRetentionDays??14;if(g<128||g>10240)throw Error("Lambda memory must be between 128 and 10240 MB");if(f<1||f>900)throw Error("Lambda timeout must be between 1 and 900 seconds");return{region:e.region||"us-east-1",pathPattern:t,originId:r,roleName:a,memorySize:g,timeout:f,logRetentionDays:h}}function yh(e){let t=e.region||"us-east-1";return{cloudfront:new I(e.profile),iam:new De(t,e.profile),lambda:new T(t,e.profile),logs:new Re(t,e.profile),sts:new we(t,e.profile),sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}async function zS(e,t){let r=CA(e),a=t||yh({profile:e.profile,region:r.region}),[g,f,h]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId),a.cloudfront.getDistributionConfig(e.distributionId)]);if(!g.Account)throw Error("AWS identity did not return an account ID");if(!f.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!(Rg(f).length?Rg(f):Rg(h.DistributionConfig)).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let S,y=!0;try{S=await a.iam.getRole({RoleName:r.roleName})}catch(Ze){if(!AA(Ze))throw Ze;y=!1}let k=S?.Arn||`arn:aws:iam::${g.Account}:role/${r.roleName}`,R=await a.lambda.functionExists(e.functionName),D=R?await a.lambda.getFunctionUrl(e.functionName):null,O=await a.cloudfront.listOriginAccessControls(),M=`${e.functionName}-lambda-url`,z=O.some((Ze)=>Ze.Name===M&&Ze.OriginAccessControlOriginType==="lambda"),J=Rv(h.DistributionConfig.Origins,"Origin"),Z=Rv(h.DistributionConfig.CacheBehaviors,"CacheBehavior"),oe=J.some((Ze)=>String(Ze.Id)===r.originId),G=Z.some((Ze)=>String(Ze.PathPattern)===r.pathPattern),te=[...!y?[`create IAM execution role ${r.roleName}`]:[`reconcile IAM execution policy ${r.roleName}`],...R?[`update Lambda ${e.functionName} code and configuration`]:[`create Lambda ${e.functionName}`],...!D?["create private AWS_IAM function URL"]:[],...!z?[`create Lambda origin access control ${M}`]:[],"grant CloudFront function-URL and invocation permissions",`${G?"reconcile":"add"} ${r.pathPattern} behavior without changing the default behavior`],ye={command:`cloud cdn:origin:remove ${e.distributionId} FUNCTION_URL_HOST --id ${r.originId} --path '${r.pathPattern}' --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,removeFunction:!R,removeRole:!y},be={mode:e.apply?"apply":"plan",accountId:g.Account,identityArn:g.Arn,distribution:{id:f.Id,arn:f.ARN,alias:e.expectedAlias,domainName:f.DomainName,status:f.Status},function:{name:e.functionName,existed:R,runtime:"nodejs22.x",urlExisted:!!D,url:D?.FunctionUrl},role:{name:r.roleName,existed:y,arn:k},origin:{id:r.originId,pathPattern:r.pathPattern,existed:oe,behaviorExisted:G,accessControlExisted:z},changes:te,rollback:ye,applied:!1};if(!e.apply)return be;let ie=`${e.distributionId}:${r.pathPattern}`;if(e.confirm!==ie)throw Error(`Pass exact confirmation token ${ie} to mutate the live distribution`);if(!S)S=await a.iam.createRole({RoleName:r.roleName,Description:`Execution role for ${e.functionName}`,AssumeRolePolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]}),Tags:[{Key:"ManagedBy",Value:"ts-cloud"}]});await a.iam.putRolePolicy({RoleName:r.roleName,PolicyName:"lambda-logs",PolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:${r.region}:${g.Account}:log-group:/aws/lambda/${e.functionName}:*`}]})});try{await a.logs.createLogGroup(`/aws/lambda/${e.functionName}`,{ManagedBy:"ts-cloud"})}catch(Ze){if(!Ev(Ze))throw Ze}await a.logs.putRetentionPolicy(`/aws/lambda/${e.functionName}`,r.logRetentionDays);let _e=e.code||RA;if(R)await a.lambda.updateFunctionCodeInline(e.functionName,_e,"index.mjs"),await a.lambda.waitForFunctionActive(e.functionName),await a.lambda.updateFunctionConfiguration({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:S.Arn,Handler:"index.handler",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize});else{let Ze;for(let wt=0;wt<8;wt++)try{await a.lambda.createFunctionWithCode({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:S.Arn,Handler:"index.handler",Code:_e,Filename:"index.mjs",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize}),Ze=void 0;break}catch(Bt){if(Ze=Bt,!String(Bt.message).toLowerCase().includes("role"))throw Bt;await a.sleep(1000)}if(Ze)throw Ze}await a.lambda.waitForFunctionActive(e.functionName);let ee=D||await a.lambda.createFunctionUrl({FunctionName:e.functionName,AuthType:"AWS_IAM",InvokeMode:"BUFFERED"});if(!ee.FunctionUrl)throw Error("Lambda did not return a function URL");let xe=new URL(ee.FunctionUrl).hostname,Je=await a.cloudfront.findOrCreateOriginAccessControl(M,"lambda"),gt=f.ARN||`arn:aws:cloudfront::${g.Account}:distribution/${e.distributionId}`,jt=[{FunctionName:e.functionName,StatementId:"AllowCloudFrontFunctionUrl",Action:"lambda:InvokeFunctionUrl",Principal:"cloudfront.amazonaws.com",SourceArn:gt,FunctionUrlAuthType:"AWS_IAM"},{FunctionName:e.functionName,StatementId:"AllowCloudFrontInvoke",Action:"lambda:InvokeFunction",Principal:"cloudfront.amazonaws.com",SourceArn:gt,InvokedViaFunctionUrl:!0}];for(let Ze of jt)try{await a.lambda.addPermission(Ze)}catch(wt){if(!Ev(wt))throw wt}return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:xe,pathPattern:r.pathPattern,originAccessControlId:Je.Id}),{...be,function:{...be.function,url:ee.FunctionUrl},applied:!0}}async function KS(e){let t=`https://${e.alias}/`,r=`https://${e.alias}/api/health`,a=await fetch(t,{redirect:"follow",headers:{"cache-control":"no-cache"}}),g=new Uint8Array(await a.arrayBuffer()),f=EA("sha256").update(g).digest("hex"),h=Date.now(),b=await fetch(r,{redirect:"follow",headers:{"cache-control":"no-cache"}}),S=Date.now()-h,y=await b.text(),k=y;try{k=JSON.parse(y)}catch{}let R;if(e.logs&&e.functionName){let D=await e.logs.filterLogEvents({logGroupName:`/aws/lambda/${e.functionName}`,startTime:h-60000,filterPattern:'"Init Duration"',limit:25});for(let O of D.events||[]){let M=O.message?.match(/Init Duration:\s*([0-9.]+)\s*ms/i);if(M)R=Number(M[1])}}return{frontend:{url:t,status:a.status,sha256:f,unchanged:e.expectedFrontendSha256?f===e.expectedFrontendSha256:void 0,bytes:g.byteLength},api:{url:r,status:b.status,latencyMs:S,healthy:b.ok&&!!k?.ok,body:k},coldStart:{observed:R!==void 0,initDurationMs:R},verifiedAt:(e.now?.()||new Date).toISOString()}}function WS(e){let t=(e.memoryMb||256)/1024,r=Math.max(0,e.requests-(e.includeFreeTier===!1?0:1e6)),a=Math.max(0,e.requests*(e.averageDurationMs/1000)*t-(e.includeFreeTier===!1?0:400000)),g=r/1e6*0.2+a*0.0000166667,f=9.010025,h=16.425;return{lambdaUsd:Number(g.toFixed(2)),alwaysOnFargateAndAlbUsd:Number(25.435025000000003 .toFixed(2)),assumptions:["us-east-1 public list rates snapshot, July 2026","Lambda x86 request and duration pricing with optional monthly free tier","Fargate comparison uses one always-on 0.25 vCPU/0.5 GB task plus one ALB before LCU charges","excludes CloudFront, data transfer, logs, taxes, and application data services"]}}import{createHash as PA}from"node:crypto";function _A(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function TA(e){return _A(e)==="ValidationError"&&String(e.message).includes("does not exist")}function xA(e){return Object.fromEntries((e||[]).map((t)=>[t.OutputKey,t.OutputValue]))}function DA(e){let t=e?.Aliases?.Items??e?.Aliases,r=t?.CNAME??t;if(Array.isArray(r))return r.map(String);if(typeof r==="string")return[r];return[]}function Cv(e){if(!/^[a-z][a-z0-9-]{1,62}$/.test(e.slug))throw Error("Slug must be a lowercase DNS-safe identifier");if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected distribution alias is invalid");let t=e.imageUri.match(/@((?:sha256:)[a-f0-9]{64})$/i)?.[1];if(!t)throw Error("Container image must use an immutable ECR digest URI ending in @sha256:<64 hex>");let r=e.stackName||`${e.slug}-backend`;if(!/^[A-Za-z][A-Za-z0-9-]{0,127}$/.test(r))throw Error("CloudFormation stack name is invalid");let a=e.pathPattern||"/api/*";if(!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]+\*$/.test(a)||a==="/*")throw Error("Backend path must be a non-default wildcard pattern");let g=e.originId||`${e.slug}-backend`;if(!/^[A-Za-z0-9_.-]{1,128}$/.test(g))throw Error("CloudFront origin ID is invalid");if(e.originVerifySecret&&e.originVerifySecret.length<24)throw Error("Origin verification secret must contain at least 24 characters");if(!!e.originDomain!==!!e.certificateArn)throw Error("A custom origin domain and matching ACM certificate ARN must be provided together");return{stackName:r,region:e.region||"us-east-1",pathPattern:a,originId:g,digest:t}}function Sh(e){let t=e.region||"us-east-1";return{cloudformation:new A(t,e.profile),cloudfront:new I(e.profile),sts:new we(t,e.profile),fetch,sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}function Ih(e){let t=Cv(e),r=hl({name:e.name,slug:e.slug,domain:e.originDomain||e.expectedAlias,imageUri:e.imageUri,certificateArn:e.certificateArn,originVerifySecret:e.originVerifySecret,desiredCount:e.desiredCount,database:e.database,cache:e.cache,queue:e.queue}),a=fl(r);return a.Description=`Managed backend for existing static frontend ${e.expectedAlias}`,a.Metadata={ManagedBy:"ts-cloud",ExistingDistributionId:e.distributionId,ExistingDistributionAlias:e.expectedAlias,BackendPathPattern:t.pathPattern,ContainerDigest:t.digest},a}async function OA(e,t,r){let a;for(let g=0;g<30;g++){let f=Date.now();try{let h=await e.fetch(t,{redirect:"manual",headers:r?{"x-origin-verify":r}:void 0}),b=Date.now()-f,S=await h.text(),y=S;try{y=JSON.parse(S)}catch{}if(h.ok)return{url:t,status:h.status,latencyMs:b,body:y};a=Error(`origin returned ${h.status}`)}catch(h){a=h}if(g<29)await e.sleep(1e4)}throw Error(`Backend origin did not become healthy: ${a instanceof Error?a.message:String(a)}`)}async function JS(e,t){let r=Cv(e),a=t||Sh({region:r.region,profile:e.profile}),[g,f]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId)]);if(!g.Account)throw Error("AWS identity did not return an account ID");if(!f.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!DA(f).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let h;try{h=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0]}catch(te){if(!TA(te))throw te}let b=Ih(e),S=JSON.stringify(b);if(Buffer.byteLength(S)>51200)throw Error("Generated template exceeds the direct CloudFormation template body limit");let y=Object.values(b.Resources||{}).reduce((te,ye)=>(te[ye.Type]=(te[ye.Type]||0)+1,te),{}),k=[`cloud cdn:origin:remove ${e.distributionId} ${e.originDomain||"ALB_HOST"} --id ${r.originId} --path '${r.pathPattern}' --profile ${e.profile||"default"} --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,`After CloudFront is deployed, restore external DNS if changed and delete stack ${r.stackName} only with an approved data-retention decision.`],R={mode:e.apply?"apply":"plan",accountId:g.Account,stack:{name:r.stackName,existed:!!h,status:h?.StackStatus,templateSha256:PA("sha256").update(S).digest("hex"),resourceCount:Object.keys(b.Resources||{}).length,resourceTypes:y},distribution:{id:f.Id,alias:e.expectedAlias,domainName:f.DomainName,status:f.Status,pathPattern:r.pathPattern,originId:r.originId},artifact:{imageUri:e.imageUri,digest:r.digest},services:{database:e.database!==!1,cache:e.cache!==!1,queue:e.queue!==!1,mail:"ses",desiredCount:e.desiredCount||1},cloudFrontApplied:!1,dnsApplied:!1,applied:!1,rollback:k};if(!e.apply)return R;let D=`${e.distributionId}:${r.pathPattern}:${r.stackName}`;if(e.confirm!==D)throw Error(`Pass exact confirmation token ${D} to provision the backend and change live routing`);if(h)try{await a.cloudformation.updateStack({stackName:r.stackName,templateBody:S,capabilities:["CAPABILITY_NAMED_IAM"],tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-update-complete")}catch(te){if(!String(te.message).includes("No updates are to be performed"))throw te}else await a.cloudformation.createStack({stackName:r.stackName,templateBody:S,capabilities:["CAPABILITY_NAMED_IAM"],onFailure:"ROLLBACK",tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-create-complete");let O=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0],M=xA(O?.Outputs),z=M.AppLoadBalancerDnsName;if(!z)throw Error("Backend stack did not return AppLoadBalancerDnsName");let J=!1;if(e.originDomain&&e.originDomain!==z){if(!a.dns)throw Error(`External DNS provider is required to map ${e.originDomain} to ${z}`);let te=await a.dns.upsertRecord(e.originDomain,{name:e.originDomain,type:"CNAME",content:z,ttl:300});if(!te.success)throw Error(te.message||"External DNS update failed");J=!0}let Z=e.originDomain||z,oe=e.certificateArn?"https-only":"http-only",G=e.skipHealthCheck?void 0:await OA(a,`${oe==="https-only"?"https":"http"}://${Z}/api/health`,e.originVerifySecret);return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:Z,pathPattern:r.pathPattern,protocolPolicy:oe,customHeaders:e.originVerifySecret?{"X-Origin-Verify":e.originVerifySecret}:void 0}),{...R,outputs:M,health:G,cloudFrontApplied:!0,dnsApplied:J,applied:!0}}function XS(e={}){let r={fargate:730*(e.desiredCount||1)*0.012342500000000001,applicationLoadBalancer:16.425,natGateway:32.85,postgres:730*(e.multiAzDatabase?0.032:0.016),redis:23.36};return{monthlyUsd:Number(Object.values(r).reduce((a,g)=>a+g,0).toFixed(2)),components:Object.fromEntries(Object.entries(r).map(([a,g])=>[a,Number(g.toFixed(2))])),assumptions:["us-east-1 public on-demand rate snapshot, July 2026","one 0.25 vCPU/0.5 GB Linux Fargate task unless desiredCount is changed","one ALB before LCU charges and one NAT gateway before data processing","single-AZ db.t4g.micro PostgreSQL by default and two cache.t4g.micro Redis nodes","excludes storage, backups, CloudFront, data transfer, public IPv4, logs, email, queue requests, taxes, and free-tier credits"]}}import{execFileSync as $A}from"node:child_process";import{createHash as NA}from"node:crypto";import{existsSync as Pv,mkdirSync as jA,mkdtempSync as BA,readdirSync as MA,readFileSync as LA,rmSync as FA,statSync as _v,writeFileSync as zA}from"node:fs";import{tmpdir as UA}from"node:os";import{basename as qA,join as as,relative as VA,resolve as Pg}from"node:path";var WA=new Set([".git","node_modules","dist","coverage"]);function Tv(e,t=e){let r=[];for(let a of MA(e).sort()){if(WA.has(a))continue;let g=as(e,a);if(sl(g,t))continue;let f=_v(g);if(f.isDirectory())r.push(...Tv(g,t));else if(f.isFile())r.push(VA(t,g))}return r}function bh(e){let t=Pg(e);if(!Pv(t)||!_v(t).isDirectory())throw Error(`Container context does not exist: ${t}`);let r=NA("sha256");for(let a of Tv(t))r.update(a),r.update("\x00"),r.update(LA(as(t,a))),r.update("\x00");return r.digest("hex")}function Ch(e){return{ecr:new He(e.region||"us-east-1",e.profile),run:(t,r,a)=>{$A(t,r,{cwd:a?.cwd,env:a?.env,stdio:a?.stdio||"inherit"})}}}async function YS(e,t){let r=Pg(e.context),a=Pg(e.dockerfile||as(r,"Dockerfile"));if(!Pv(a))throw Error(`Dockerfile does not exist: ${a}`);if(!e.repository.split("/").every((M)=>/^[a-z0-9][a-z0-9._-]*$/.test(M)&&!/[._-]$/.test(M)&&!/[._-]{2}/.test(M)))throw Error("ECR repository name is invalid");let h=t||Ch(e),b=bh(r),S=`sha-${b.slice(0,20)}`,y="";try{y=(await h.ecr.describeRepositories({repositoryNames:[e.repository]})).repositories?.[0]?.repositoryUri||""}catch{}if(!y)y=(await h.ecr.createRepository({repositoryName:e.repository,imageTagMutability:"IMMUTABLE",imageScanningConfiguration:{scanOnPush:!0},tags:[{Key:"ManagedBy",Value:"ts-cloud"}]})).repository?.repositoryUri||"";if(!y)throw Error(`Could not resolve ECR repository URI for ${e.repository}`);await h.ecr.putLifecyclePolicy({repositoryName:e.repository,lifecyclePolicyText:JSON.stringify({rules:[{rulePriority:1,description:"Retain the newest 25 release images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:25},action:{type:"expire"}}]})});let k=`${y}:${S}`,R=BA(as(UA(),"ts-cloud-container-"));try{h.run("docker",["version"],{stdio:"ignore"}),h.run("docker",["build","--platform",e.platform||"linux/amd64","--provenance=false","--sbom=false","--file",a,"--tag",k,r],{cwd:r});let M=(await h.ecr.getAuthorizationToken()).authorizationData?.[0];if(!M?.authorizationToken||!M.proxyEndpoint)throw Error("ECR did not return Docker authorization data");let z=M.proxyEndpoint.replace(/^https?:\/\//,""),J=as(R,"docker");jA(J,{recursive:!0}),zA(as(J,"config.json"),JSON.stringify({auths:{[z]:{auth:M.authorizationToken}}}),{mode:384}),h.run("docker",["push",k],{env:{...process.env,DOCKER_CONFIG:J}})}finally{FA(R,{recursive:!0,force:!0})}let O=(await h.ecr.describeImages({repositoryName:e.repository,imageIds:[{imageTag:S}]})).imageDetails?.[0]?.imageDigest;if(!O||!/^sha256:[a-f0-9]{64}$/i.test(O))throw Error(`ECR did not return an immutable digest for ${qA(k)}`);return{repository:e.repository,tag:S,imageUri:k,digest:O,digestUri:`${y}@${O}`,contextSha256:b}}import{existsSync as HA,readdirSync as KA,readFileSync as JA,statSync as GA}from"node:fs";import{join as xv,relative as QA}from"node:path";function yo(e,t){let r=e.environments?.[t]?.app;if(!r)throw Error(`No serverless app configured for environment '${t}'. Add environments.${t}.app to your config.`);let a=e.project.slug,g=e.environments?.[t]?.region||e.project.region||"us-east-1";return{app:r,slug:a,region:g,stackName:lr(e,t),artifactBucket:cl(a,t),assetsBucket:Xi(a,t)}}async function ho(e,t=8){let r;for(let a=0;a<t;a++)try{return await e()}catch(g){let f=g?.code||g?.name||"",h=String(g?.message||"");if(f==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(h)){r=g,await new Promise((b)=>setTimeout(b,3000));continue}throw g}throw r}var Dv=(e,t)=>`releases/${e}/${t}/current.json`;async function Ld(e,t,r,a){try{return await e.getObjectJson(t,Dv(r,a))}catch{return null}}async function Ov(e,t,r,a,g){await e.putObjectJson(t,Dv(r,a),g)}async function YA(e,t){if(!e.secrets)return{};let r=new re(t),a={},g=Array.isArray(e.secrets)?e.secrets.map((f)=>({envName:f.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:f})):Object.entries(e.secrets).map(([f,h])=>({envName:f,secretId:h}));if(Array.isArray(e.secrets)){let f=new Map;for(let{envName:b,secretId:S}of g)f.set(b,[...f.get(b)??[],S]);let h=[...f.entries()].filter(([,b])=>b.length>1);if(h.length){let b=h.map(([S,y])=>`${S} ← ${y.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${b}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:f,secretId:h}of g){let S=(await r.getSecretValue({SecretId:h})).SecretString??"";try{let y=JSON.parse(S);if(y&&typeof y==="object"&&!Array.isArray(y)){for(let[k,R]of Object.entries(y))a[k]=String(R);continue}}catch{}a[f]=S}return a}function Es(e,t){let r={},a=t.DbProxyEndpoint||t.DbEndpoint;if(a)r.DB_CONNECTION="mysql",r.DB_HOST=a,r.DB_PORT="3306",r.DB_DATABASE=r.DB_DATABASE||"app";if(t.CacheEndpoint){if(r.REDIS_HOST=t.CacheEndpoint,r.REDIS_PORT="6379",e.cache?.driver==="elasticache")r.CACHE_STORE="redis",r.CACHE_DRIVER="redis",r.SESSION_DRIVER="redis"}return r}function Cr(e,t,r,a,g,f,h,b={}){let S=e.kind==="php"?ql({cacheDriver:e.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:a,TSCLOUD_ENV:r,MAINTENANCE_MODE:"0",...e.octane?{TSCLOUD_OCTANE:"1"}:{},...e.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...e.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...S,...b,...t.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${t.slug}-${r}-cache`}:{},...h?{TSCLOUD_QUEUE:h,SQS_QUEUE:h}:{},...f?{ASSET_URL:f}:{},...e.env??{},...g}}function ZA(e){let t=e.slice(e.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[t]??"application/octet-stream"}function*$v(e){for(let t of KA(e)){let r=xv(e,t);if(GA(r).isDirectory())yield*$v(r);else yield r}}async function XA(e,t,r,a,g=!1){let f=0;for(let h of $v(r)){let b=QA(r,h).replace(/\\/g,"/");if(!g&&b.split("/").some((S)=>S.startsWith(".")))continue;await e.putObject({bucket:t,key:`${a}/${b}`,body:JA(h),contentType:ZA(h),cacheControl:"public, max-age=31536000, immutable"}),f++}return f}function eC(e,t){let r=Object.entries(t).reduce((a,[g,f])=>a+Buffer.byteLength(`${g}=${f}`,"utf8"),0);if(r>4096){let a=Object.entries(t).map(([g,f])=>[g,Buffer.byteLength(`${g}=${f}`,"utf8")]).sort((g,f)=>f[1]-g[1]).slice(0,5).map(([g,f])=>`${g} (${f}B)`).join(", ");throw Error(`${e}: environment variables total ${r}B, over AWS's 4096B limit (${r-4096}B too large). Largest: ${a}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function sa(e,t,r,a){eC(t,r),await ho(()=>e.updateFunctionConfiguration({FunctionName:t,Environment:{Variables:r}})),await e.waitForFunctionActive(t,120);let g=a.kind==="image"?{FunctionName:t,ImageUri:a.imageUri}:{FunctionName:t,S3Bucket:a.bucket,S3Key:a.key};await ho(()=>e.updateFunctionCode(g)),await e.waitForFunctionActive(t,120)}async function Md(e,t){let a=(await ho(()=>e.publishVersion({FunctionName:t}))).Version;if(!a)throw Error(`publishVersion returned no version for ${t}`);return await ho(()=>e.updateAlias({FunctionName:t,Name:"live",FunctionVersion:a})),a}async function Ya(e,t,r={}){let a=yo(e,t),{app:g,slug:f,region:h,stackName:b,artifactBucket:S}=a,y=r.projectRoot??process.cwd();xs(`Deploying serverless app: ${f} (${t})`),L(`Stack: ${b}`),L(`Region: ${h}`);let k=new o(h),R=new A(h),D=new T(h),O=g.kind==="php",M=g.packaging==="image",z=ns(g),J,Z,oe,G,te=[];if(M&&z.usesLayer&&z.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${z.kind}${z.kind==="node"?` ${z.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(M){P("Building + pushing container image");let{buildAndPushServerlessImage:ue}=await import("./chunk-03gf4e58.js"),Ee=await ue({app:g,projectRoot:y,region:h,repository:`${f}-${t}`,skipBuild:r.skipBuild,onStep:(mt)=>L(`  ${mt}`)});J=Ee.handlers,Z={kind:"image",imageUri:Ee.imageUri},oe=Ee.tag,te.push({ParameterKey:"ImageUri",ParameterValue:Ee.imageUri})}else{P("Packaging application");let ue=O?jl({projectRoot:y,app:g,skipBuild:r.skipBuild,onStep:(kt)=>L(`  ${kt}`)}):await mn({projectRoot:y,app:g,skipBuild:r.skipBuild,onStep:(kt)=>L(`  ${kt}`)}),Ee=$l(f,t,ue.sha256);if(L(`Artifact: ${ue.sha256.slice(0,12)} (${(ue.zip.length/1024).toFixed(0)} KB)`),J=ue.handlers,oe=ue.sha256,z.usesLayer){let kt=z.layerEnvVar?process.env[z.layerEnvVar]:void 0;if(G=g.layers??(kt?[kt]:void 0),!G?.length){let Pe=z.layerKind==="php"?"serverless:build-php-layer":z.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${z.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${z.layerEnvVar} env var (build one with \`cloud ${Pe}\`)${z.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await k.bucketExists(S))P(`Creating artifact bucket ${S}`),await k.createBucket(S);if(await k.headObject(S,Ee).then((kt)=>kt!==null).catch(()=>!1))L("Artifact already uploaded — reusing");else P("Uploading artifact"),await k.putObject({bucket:S,key:Ee,body:ue.zip,contentType:"application/zip"});Z={kind:"zip",bucket:S,key:Ee},te.push({ParameterKey:"ArtifactBucket",ParameterValue:S},{ParameterKey:"ArtifactKey",ParameterValue:Ee})}let ye=Fl({config:e,environment:t,app:g,handlers:J,runtimeLayers:G}),be=JSON.stringify(ye.template),ie=["CAPABILITY_NAMED_IAM"],_e=await R.describeStacks({stackName:b}).then((ue)=>ue.Stacks[0]?.StackStatus).catch(()=>{return}),ee=_e!==void 0;if(_e&&/DELETE_IN_PROGRESS/.test(_e))P("Waiting for an in-progress stack delete to finish"),await R.waitForStack(b,"stack-delete-complete").catch(()=>{}),ee=!1;else if(_e&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(_e))P(`Deleting unusable stack (status ${_e}) before recreate`),await R.deleteStack(b),await R.waitForStack(b,"stack-delete-complete").catch(()=>{}),ee=!1;P(ee?"Updating infrastructure stack":"Creating infrastructure stack");try{if(ee)await R.updateStack({stackName:b,templateBody:be,parameters:te,capabilities:ie}),await R.waitForStack(b,"stack-update-complete");else await R.createStack({stackName:b,templateBody:be,parameters:te,capabilities:ie,onFailure:"DELETE"}),await R.waitForStack(b,"stack-create-complete")}catch(ue){if(/No updates are to be performed/i.test(String(ue?.message)))L("No infrastructure changes");else throw ue}let xe=await R.getStackOutputs(b).catch(()=>({})),Je;if(g.assets){let ue=xv(y,g.assets);if(HA(ue)){let Ee=g.assetDomain||xe.AssetsCdnDomain;Je=Ee?`https://${Ee}/${oe}`:void 0,P(`Syncing assets from ${g.assets}`);let mt=await XA(k,a.assetsBucket,ue,oe,g.dotFilesAsAssets);L(`Uploaded ${mt} asset(s)${Je?` → ${Je}`:""}`)}else Bs(`Assets directory not found: ${ue}`)}P("Resolving secrets");let gt=await YA(g,h);if(g.database?.connection==="aurora-serverless")try{let Ee=await new re(h).getSecretValue({SecretId:`${f}/${t}/db`}),mt=JSON.parse(Ee.SecretString??"{}");if(mt.username)gt.DB_USERNAME=mt.username;if(mt.password)gt.DB_PASSWORD=mt.password}catch(ue){Bs(`Could not resolve Aurora DB credentials: ${ue.message}`)}if(!await k.bucketExists(S))await k.createBucket(S);let jt=await Ld(k,S,f,t),Ze={},wt=ye.queueNames[0],Bt=Es(g,xe);if(P("Activating functions"),Ze.http=Cr(g,a,t,"http",gt,Je,wt,Bt),await sa(D,ye.functionNames.http,Ze.http,Z),Ze.cli=Cr(g,a,t,"cli",gt,Je,wt,Bt),await sa(D,ye.functionNames.cli,Ze.cli,Z),ye.queueNames.length)Ze.queue=Cr(g,a,t,"queue",gt,Je,wt,Bt),await sa(D,ye.functionNames.queue,Ze.queue,Z);let nt=(g.provisionedConcurrency??0)>0,W={};if(nt){if(P("Publishing versions + flipping live alias"),W.http=await Md(D,ye.functionNames.http),W.cli=await Md(D,ye.functionNames.cli),ye.queueNames.length)W.queue=await Md(D,ye.functionNames.queue)}if(await Ov(k,S,f,t,{sha:oe,code:Z,previousSha:jt?.sha,previousCode:jt?.code,previousFunctionEnv:jt?.functionEnv,...nt?{functionVersions:W,previousFunctionVersions:jt?.functionVersions}:{},functionEnv:Ze,functionNames:{http:ye.functionNames.http,cli:ye.functionNames.cli,...ye.queueNames.length?{queue:ye.functionNames.queue}:{}},assetUrl:Je,timestamp:new Date().toISOString()}),!r.skipDeployHooks&&g.deploy?.length){P("Running deploy hooks");for(let ue of g.deploy){L(`  deploy: ${ue}`);let Ee=await D.invoke({FunctionName:ye.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:ue},LogType:"Tail"});if(Ee.FunctionError)throw bg("Deploy hook failed — the new build is ALREADY LIVE."),L(`  Roll back with: cloud serverless:rollback --env ${t}`),Error(`Deploy hook failed (${ue}): ${Ee.Payload}`)}}let se=xe.HttpApiEndpoint;if(!r.skipHealthCheck&&se){P("Health check");try{let ue=await fetch(se,{method:"GET"});L(`GET ${se} → ${ue.status}`)}catch(ue){Bs(`Health check could not reach ${se}: ${ue.message}`)}}Cg(["Serverless deploy complete","",se?`URL:   ${se}`:"",`Stack: ${b}`,`Build: ${oe.slice(0,12)}`].filter(Boolean).join(`
+`),"green")}async function Nn(e,t){let r=yo(e,t),a=new o(r.region),g=new T(r.region),f=await Ld(a,r.artifactBucket,r.slug,t);if(!f)throw Error("No previous release to redeploy. Run a full deploy first.");xs(`Redeploying ${r.slug} (${t}) — build ${f.sha.slice(0,12)}`);for(let[h,b]of Object.entries(f.functionNames)){if(!b)continue;P(`Re-activating ${h} (${b})`),await sa(g,b,f.functionEnv[h]??{},f.code);let S=f.functionVersions?.[h];if(S)await ho(()=>g.updateAlias({FunctionName:b,Name:"live",FunctionVersion:S}))}Mn("Redeploy complete")}async function Bn(e,t){let r=yo(e,t),a=new o(r.region),g=new T(r.region),f=await Ld(a,r.artifactBucket,r.slug,t);if(!f?.previousCode)throw Error("No previous release to roll back to.");xs(`Rolling back ${r.slug} (${t}) → ${f.previousSha?.slice(0,12)}`);for(let[h,b]of Object.entries(f.functionNames)){if(!b)continue;P(`Restoring ${h} (${b})`);let S=f.previousFunctionEnv?.[h]??f.functionEnv[h]??{};await sa(g,b,S,f.previousCode);let y=f.previousFunctionVersions?.[h];if(y)await ho(()=>g.updateAlias({FunctionName:b,Name:"live",FunctionVersion:y}))}await Ov(a,r.artifactBucket,r.slug,t,{...f,sha:f.previousSha??f.sha,code:f.previousCode,functionEnv:f.previousFunctionEnv??f.functionEnv,functionVersions:f.previousFunctionVersions??f.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),Mn("Rollback complete")}async function Er(e,t,r,a){let g=yo(e,t),f=new T(g.region),h=`${g.slug}-${t}-http`,S={...(await f.getFunction(h)).Configuration?.Environment?.Variables??{}};if(S.MAINTENANCE_MODE=r?"1":"0",r&&a)S.MAINTENANCE_BYPASS_SECRET=a;if(!r)delete S.MAINTENANCE_BYPASS_SECRET;if(await ho(()=>f.updateFunctionConfiguration({FunctionName:h,Environment:{Variables:S}})),(g.app.provisionedConcurrency??0)>0)await f.waitForFunctionActive(h,120),await Md(f,h);Mn(r?"Application is now in maintenance mode (503)":"Application is live")}async function lt(e,t,r){let a=yo(e,t),g=new T(a.region),f=`${a.slug}-${t}-cli`,h=await g.invoke({FunctionName:f,InvocationType:"RequestResponse",Payload:{command:r},LogType:"Tail"});if(h.FunctionError)throw Error(`Command failed: ${h.Payload}`);return h.Payload??""}async function hr(e,t){let r=yo(e,t),a=new A(r.region),g=new T(r.region),f=new o(r.region),h="not deployed",b={};try{let{Stacks:M}=await a.describeStacks({stackName:r.stackName});h=M?.[0]?.StackStatus??h;for(let z of M?.[0]?.Outputs??[])if(z.OutputKey)b[z.OutputKey]=z.OutputValue??""}catch{}let S=Ml(r.app,r.slug,t),y=r.app.provisionedConcurrency??0,k=["http","cli",...S.length?["queue"]:[]],R=`${r.slug}-${t}`,D=[];for(let M of k){let z=`${R}-${M}`,J={mode:M,name:z,version:"$LATEST"};if(y>0){let Z=await g.getAlias(z,"live").catch(()=>null);if(Z?.FunctionVersion){J.version=Z.FunctionVersion;let oe=await g.getProvisionedConcurrencyConfig(z,"live").catch(()=>null);if(oe)J.provisioned={status:oe.Status??"-",allocated:oe.AllocatedProvisionedConcurrentExecutions??0,requested:oe.RequestedProvisionedConcurrentExecutions??0}}}D.push(J)}let O=await Ld(f,r.artifactBucket,r.slug,t).catch(()=>null);return{slug:r.slug,environment:t,region:r.region,stackStatus:h,endpoint:b.HttpApiEndpoint,assetUrl:O?.assetUrl,scheduler:r.app.scheduler??"on",queues:S,provisionedConcurrency:y,functions:D,lastRelease:O?{sha:O.sha,timestamp:O.timestamp}:void 0}}function tC(e,t){return`${e}-${t}-db`}async function Nv(e,t,r,a){let g=yo(e,t);if(g.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:f}=await import("./chunk-86qwnp25.js"),h=new f(g.region),b=tC(g.slug,t);P(`Scaling ${b} → ${r}–${a} ACUs`),await h.modifyDBCluster({DBClusterIdentifier:b,ServerlessV2ScalingConfiguration:{MinCapacity:r,MaxCapacity:a},ApplyImmediately:!0}),Mn(`Scaling applied to ${b} (takes effect shortly).`)}class _g{client;region;constructor(e="us-east-1"){this.region=e,this.client=new n}async call(e,t){return this.client.request({service:"wafv2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSWAF_20190729.${e}`},body:JSON.stringify(t)})}async listWebACLs(e="REGIONAL"){return(await this.call("ListWebACLs",{Scope:e,Limit:100}))?.WebACLs??[]}async getWebACLRules(e,t,r="REGIONAL"){return((await this.call("GetWebACL",{Name:e,Id:t,Scope:r}))?.WebACL?.Rules??[]).map((f)=>({Name:f.Name,Priority:f.Priority,Action:f.Action?Object.keys(f.Action)[0]:f.OverrideAction?Object.keys(f.OverrideAction)[0]:"count"}))}}var rC=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"routing",label:"Routing"},{index:4,id:"apps",label:"Applications"},{index:5,id:"runtime",label:"Background runtime"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],nC=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"entry",label:"Entry points"},{index:4,id:"compute",label:"Compute"},{index:5,id:"messaging",label:"Messaging & pooling"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],iC=[{match:/^redis/,kind:"cache",label:"Redis"},{match:/^(?:mysql|mariadb)/,kind:"database",label:"MySQL"},{match:/^postgres/,kind:"database",label:"PostgreSQL"},{match:/^meilisearch/,kind:"database",label:"Meilisearch"},{match:/^vitess|^vtgate/,kind:"database",label:"Vitess"},{match:/^memcached/,kind:"cache",label:"Memcached"}],oC=/^(?:rpx-gateway|nginx|caddy|traefik|haproxy)$/;function Ae(e,t=""){let r=e==null?"":String(e).trim();return r&&r!=="-"&&r!=="—"?r:t}function sC(e){return Array.isArray(e)?e.length:0}function Jn(e){let t=Ae(e).toLowerCase();if(!t)return"unknown";if(["running","live","active","available","success","ok","healthy","enabled"].includes(t))return"ok";if(["failed","stopped","unreachable","error","critical","disabled"].includes(t))return"bad";if(["configured","creating","pending","degraded","shadowed","warn","unknown"].includes(t))return"warn";return"warn"}function Gt(e,t,r){if(r.has(t.source)&&r.has(t.target))e.push(t)}function Qt(e,t={}){let r=[],a=[],g=[],f=e.server??{},h=Array.isArray(e.sites)?e.sites:[],b=Array.isArray(e.services)?e.services:[],S=Array.isArray(e.workers)?e.workers:[],y=e.security??{},k=!!e._serverReachable&&!e.metricsUnavailable,R="box";if(!k)g.push("The compute box could not be probed, so live service state is missing; the shape comes from your cloud config.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let D=[...new Set(h.map((ie)=>Ae(ie.domain)||Ae(ie.route).split("/")[0]).filter((ie)=>ie&&ie!=="internal"&&ie!=="loopback"))],O=Array.isArray(y.tlsCertificates)?y.tlsCertificates:[],M=O.filter((ie)=>Number(ie?.daysRemaining??999)<21).length;r.push({id:"dns",label:D.length===1?D[0]:"Public domains",kind:"dns",layer:1,status:M?"warn":D.length?"ok":"unknown",sub:D.length>1?`${D.length} domains`:"DNS & certificates",facts:[{label:"Domains",value:D.length?D.slice(0,6).join(", "):"none resolved"},{label:"Certificates",value:O.length?`${O.length} issued`:"none reported"},...M?[{label:"Expiring",value:`${M} within 21 days`}]:[]],href:"/server/security",external:!0});let z=y.firewall??{},J=Array.isArray(y.ports)?y.ports:[];r.push({id:"firewall",label:"Host firewall",kind:"firewall",layer:2,status:Jn(z.status),sub:Ae(z.summary,"Inbound filtering"),facts:[{label:"State",value:Ae(z.status,"unknown")},{label:"Open ports",value:J.length?J.map((ie)=>Ae(ie.listen)).join(", "):"not reported"}],href:"/server/firewall",group:"box"});let Z=b.find((ie)=>oC.test(Ae(ie.name)));r.push({id:"proxy",label:Ae(Z?.name,"Reverse proxy"),kind:"proxy",layer:3,status:Z?Jn(Z.status):"unknown",sub:"TLS termination & routing",facts:[{label:"Service",value:Ae(Z?.name,"not detected")},{label:"State",value:Ae(Z?.status,k?"not running":"not probed")},{label:"Routes",value:`${h.length} site${h.length===1?"":"s"}`}],href:"/server/services",group:"box"});for(let ie of h){let _e=`site:${Ae(ie.name)}`;if(!Ae(ie.name))continue;r.push({id:_e,label:Ae(ie.name),kind:"site",layer:4,status:Jn(ie.status),sub:Ae(ie.runtime,"runtime"),facts:[{label:"Route",value:Ae(ie.route,"internal")},{label:"Runtime",value:Ae(ie.runtime,"unknown")},{label:"Delivery",value:Ae(ie.deploy,"unknown")},{label:"TLS",value:Ae(ie.tls,"unknown")},...ie.responseMs!=null?[{label:"Response",value:`${Math.round(Number(ie.responseMs))} ms`}]:[],...ie.httpStatus!=null?[{label:"HTTP",value:String(ie.httpStatus)}]:[]],href:"/server/sites",group:"box"})}for(let ie of S){let _e=`worker:${Ae(ie.name)}`;if(!Ae(ie.name))continue;r.push({id:_e,label:Ae(ie.name),kind:"worker",layer:5,status:Jn(ie.status),sub:`${Number(ie.processes??1)} process${Number(ie.processes??1)===1?"":"es"}`,facts:[{label:"Processes",value:String(ie.processes??1)},{label:"State",value:Ae(ie.status,"unknown")},...Ae(ie.site)?[{label:"Site",value:Ae(ie.site)}]:[]],href:"/operations/jobs",group:"box"})}let oe=e.serverScheduler??{};if(oe.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:5,status:"ok",sub:"Cron dispatch",facts:[{label:"Last run",value:Ae(oe.lastRun,"unknown")}],href:"/operations/jobs",group:"box"});let G=b.map((ie)=>{let _e=Ae(ie.name),ee=iC.find((xe)=>xe.match.test(_e));return ee?{service:ie,name:_e,...ee}:null}).filter((ie)=>!!ie);for(let ie of G)r.push({id:`data:${ie.name}`,label:ie.label,kind:ie.kind,layer:6,status:Jn(ie.service.status),sub:ie.name,facts:[{label:"Unit",value:ie.name},{label:"State",value:Ae(ie.service.status,"unknown")}],href:"/data/services",group:"box"});let te=e.backup??{};if(te.enabled)r.push({id:"backup",label:"Backups",kind:"backup",layer:7,status:"ok",sub:Ae(te.destination,"destination"),facts:[{label:"Destination",value:Ae(te.destination,"unknown")},{label:"Schedule",value:Ae(te.schedule,"unknown")},{label:"Retention",value:`${te.retention??0} copies`},{label:"Last run",value:Ae(te.last,"unknown")}],href:"/data/backups"});let ye=new Set(r.map((ie)=>ie.id));Gt(a,{source:"internet",target:"dns",flow:"request",label:"https"},ye),Gt(a,{source:"dns",target:"firewall",flow:"request",label:"443/80"},ye),Gt(a,{source:"firewall",target:"proxy",flow:"request"},ye);for(let ie of h){let _e=`site:${Ae(ie.name)}`;Gt(a,{source:"proxy",target:_e,flow:"request",label:Ae(ie.path)||void 0,status:Jn(ie.status)},ye)}for(let ie of S){let _e=`worker:${Ae(ie.name)}`,ee=`site:${Ae(ie.site)}`;if(ye.has(ee))Gt(a,{source:ee,target:_e,flow:"async",label:"queue"},ye);else Gt(a,{source:"proxy",target:_e,flow:"async",label:"queue"},ye)}for(let ie of S)Gt(a,{source:"scheduler",target:`worker:${Ae(ie.name)}`,flow:"async",label:"dispatch"},ye);let be=[...h.map((ie)=>`site:${Ae(ie.name)}`),...S.map((ie)=>`worker:${Ae(ie.name)}`)];for(let ie of G)for(let _e of be)Gt(a,{source:_e,target:`data:${ie.name}`,flow:"data",label:"localhost"},ye);if(G.length&&be.length)g.push("Data-service edges show co-location on the box: every process on it can reach localhost. They are not a declared per-site binding.");for(let ie of G)Gt(a,{source:`data:${ie.name}`,target:"backup",flow:"backup",label:"snapshot"},ye);for(let ie of h)Gt(a,{source:`site:${Ae(ie.name)}`,target:"backup",flow:"backup"},ye);return{mode:"server",project:Ae(t.project)||Ae(e.project?.name)||Ae(f.name,"project"),environment:Ae(t.environment)||Ae(e.environment,"production"),provider:Ae(f.provider,"unknown"),region:Ae(f.region,"unknown"),generatedAt:new Date().toISOString(),layers:rC,groups:[{id:"box",label:Ae(f.name,"App server"),sub:[Ae(f.provider),Ae(f.region),Ae(f.ip)].filter(Boolean).join(" · ")}],nodes:r,links:a,notes:g}}function vs(e,t={}){let r=[],a=[],g=[],f=e.app??{},h=Array.isArray(e.functions)?e.functions:[],b=Array.isArray(e.queues)?e.queues:[],S=e.metrics??{};if(!h.length)g.push("No Lambda functions were read for this environment, so the compute layer is empty rather than assumed.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let y=Ae(f.url),k=y.replace(/^https?:\/\//,"").split("/")[0];r.push({id:"dns",label:k||"Application domain",kind:"dns",layer:1,status:k?"ok":"unknown",sub:"DNS & certificates",facts:[{label:"Endpoint",value:y||"not resolved"}],external:!0});let R=e.waf;if(R)r.push({id:"waf",label:"WAF",kind:"waf",layer:2,status:Jn(R.status??"active"),sub:Ae(R.scope,"Managed rules"),facts:[{label:"Web ACL",value:Ae(R.name,"unnamed")},...R.blocked!=null?[{label:"Blocked (24h)",value:String(R.blocked)}]:[],{label:"Rules",value:String(sC(e.wafRules))}],href:"/serverless/firewall"});let D=e.assetsInfo;if(D)r.push({id:"cdn",label:"Asset CDN",kind:"cdn",layer:2,status:"ok",sub:Ae(D.cdn,"CloudFront"),facts:[{label:"Distribution",value:Ae(D.cdn,"unknown")},{label:"Custom domain",value:Ae(D.customDomain,"none")}],href:"/serverless/assets"}),r.push({id:"assets",label:"Asset bucket",kind:"storage",layer:6,status:"ok",sub:Ae(D.bucket,"S3"),facts:[{label:"Bucket",value:Ae(D.bucket,"unknown")},...D.files?[{label:"Objects",value:String(D.files)}]:[],...D.sizeMb?[{label:"Size",value:`${D.sizeMb} MB`}]:[]],href:"/serverless/assets"});let O=h.find((ee)=>Ae(ee.key).startsWith("http"));r.push({id:"gateway",label:"HTTP entry point",kind:"gateway",layer:3,status:O?"ok":"unknown",sub:"Function URL / API Gateway",facts:[{label:"Endpoint",value:y||"not resolved"},{label:"Invocations (24h)",value:String(S.invocations??0)},...S.errorRatePct!=null?[{label:"Error rate",value:`${S.errorRatePct}%`}]:[]],href:"/serverless/metrics"});for(let ee of h){let xe=`fn:${Ae(ee.name)}`;if(!Ae(ee.name))continue;let Je=Number(ee.errors??0),gt=Number(ee.invocations??0);r.push({id:xe,label:Ae(ee.key,Ae(ee.name)),kind:"function",layer:4,status:Je>0?gt&&Je/gt>0.02?"bad":"warn":gt?"ok":"idle",sub:Ae(ee.runtime,"lambda"),facts:[{label:"Function",value:Ae(ee.name)},{label:"Memory",value:`${ee.memory??0} MB`},{label:"Timeout",value:`${ee.timeout??0}s`},{label:"Invocations (24h)",value:String(gt)},{label:"Errors (24h)",value:String(Je)},{label:"p95",value:`${ee.p95??0} ms`},...ee.provisioned?[{label:"Provisioned",value:Ae(ee.provisioned)}]:[]],href:"/serverless/functions"})}for(let ee of b){let xe=`queue:${Ae(ee.name)}`;if(!Ae(ee.name))continue;let Je=Number(ee.dlq??0);r.push({id:xe,label:Ae(ee.name),kind:"queue",layer:5,status:Je>0?"bad":Number(ee.visible??0)>0?"warn":"ok",sub:"SQS",facts:[{label:"Visible",value:String(ee.visible??0)},{label:"In flight",value:String(ee.inFlight??0)},{label:"Processed (24h)",value:String(ee.processed??0)},{label:"Dead letter",value:String(Je)}],href:"/serverless/queues"})}let M=e.aurora;if(M)r.push({id:"database",label:"Aurora Serverless",kind:"database",layer:6,status:Jn(M.status),sub:Ae(M.engine,"aurora"),facts:[{label:"Cluster",value:Ae(M.id,"unknown")},{label:"Capacity",value:`${M.currentAcu??0} ACU (${M.minAcu??0}–${M.maxAcu??0})`},{label:"Connections",value:String(M.connections??0)}],href:"/serverless/data"});let z=e.proxy;if(z)r.push({id:"rds-proxy",label:"RDS Proxy",kind:"database",layer:5,status:Jn(z.status),sub:"Connection pooling",facts:[{label:"Proxy",value:Ae(z.name,"unknown")},{label:"Endpoint",value:Ae(z.endpoint,"unknown")},{label:"Pooled",value:String(z.pooledConns??0)}],href:"/serverless/data"});let J=e.redis;if(J)r.push({id:"cache",label:"ElastiCache",kind:"cache",layer:6,status:Jn(J.status),sub:Ae(J.node,"redis"),facts:[{label:"Group",value:Ae(J.id,"unknown")},{label:"Hit rate",value:`${J.hitRate??0}%`}],href:"/serverless/data"});let Z=e.efs;if(Z)r.push({id:"efs",label:"EFS",kind:"filesystem",layer:6,status:Jn(Z.status),sub:Ae(Z.mount,"/mnt/local"),facts:[{label:"File system",value:Ae(Z.id,"unknown")},{label:"Mount",value:Ae(Z.mount,"unknown")},{label:"Size",value:`${Z.sizeMb??0} MB`}],href:"/data/volumes"});let oe=e.scheduler??{};if(oe.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:3,status:"ok",sub:Ae(oe.expression,"rate(1 minute)"),facts:[{label:"Expression",value:Ae(oe.expression,"unknown")},{label:"Last run",value:Ae(oe.lastRun,"unknown")}],href:"/operations/jobs"});let G=new Set(r.map((ee)=>ee.id)),te=G.has("waf")?"waf":"gateway";Gt(a,{source:"internet",target:"dns",flow:"request",label:"https"},G),Gt(a,{source:"dns",target:te,flow:"request"},G),Gt(a,{source:"dns",target:"cdn",flow:"request",label:"assets"},G),Gt(a,{source:"waf",target:"gateway",flow:"request",label:"allowed"},G),Gt(a,{source:"cdn",target:"assets",flow:"data",label:"origin"},G);let ye=h.filter((ee)=>Ae(ee.key).startsWith("http")),be=h.filter((ee)=>Ae(ee.key).startsWith("queue")),ie=h.filter((ee)=>Ae(ee.key).startsWith("cli"));for(let ee of ye)Gt(a,{source:"gateway",target:`fn:${Ae(ee.name)}`,flow:"request",label:"invoke"},G);for(let ee of ie)Gt(a,{source:"scheduler",target:`fn:${Ae(ee.name)}`,flow:"async",label:"schedule"},G);for(let ee of b){for(let xe of ye)Gt(a,{source:`fn:${Ae(xe.name)}`,target:`queue:${Ae(ee.name)}`,flow:"async",label:"publish"},G);for(let xe of be)Gt(a,{source:`queue:${Ae(ee.name)}`,target:`fn:${Ae(xe.name)}`,flow:"async",label:"consume"},G)}let _e=["rds-proxy","database","cache","efs","assets"];for(let ee of h){let xe=`fn:${Ae(ee.name)}`;if(G.has("rds-proxy"))Gt(a,{source:xe,target:"rds-proxy",flow:"data",label:"pooled"},G);else Gt(a,{source:xe,target:"database",flow:"data",label:"sql"},G);for(let Je of _e.filter((gt)=>gt!=="rds-proxy"&&gt!=="database"))Gt(a,{source:xe,target:Je,flow:"data"},G)}return Gt(a,{source:"rds-proxy",target:"database",flow:"data",label:"sql"},G),{mode:"serverless",project:Ae(t.project)||Ae(f.name,"application"),environment:Ae(t.environment)||Ae(f.env,"production"),provider:"aws",region:Ae(f.region,"unknown"),generatedAt:new Date().toISOString(),layers:nC,groups:[],nodes:r,links:a,notes:g}}function Eh(e,t,r={}){return e==="serverless"?vs(t,r):Qt(t,r)}function jv(e){return String(e).padStart(2,"0")}function ks(e){return`${e.getUTCFullYear()}-${jv(e.getUTCMonth()+1)}-${jv(e.getUTCDate())}`}function aC(e){let t=Math.max(0,Math.round((Date.now()-e)/1000));if(t<60)return`${t}s ago`;let r=Math.round(t/60);if(r<60)return`${r}m ago`;let a=Math.round(r/60);if(a<48)return`${a}h ago`;return`${Math.round(a/24)}d ago`}async function aa(e,t,r,a,g,f){let h=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:r,Dimensions:[{Name:"FunctionName",Value:t}],StartTime:g,EndTime:f,Period:86400,Statistics:[a]}).catch(()=>[]);if(!h.length)return 0;if(a==="Sum")return h.reduce((b,S)=>b+(S.Sum??0),0);if(a==="Maximum")return Math.max(...h.map((b)=>b.Maximum??0));return h.reduce((b,S)=>b+(S.Average??0),0)/h.length}async function ca(e,t,r,a,g,f,h){let b=await e.getMetricStatistics({Namespace:t,MetricName:r,Dimensions:a,StartTime:f,EndTime:h,Period:86400,Statistics:[g]}).catch(()=>[]);if(!b.length)return 0;if(g==="Sum")return b.reduce((S,y)=>S+(y.Sum??0),0);if(g==="Maximum")return Math.max(...b.map((S)=>S.Maximum??0));return b.reduce((S,y)=>S+(y.Average??0),0)/b.length}async function Tg(e,t,r,a,g){let f=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:[{Name:"FunctionName",Value:t}],StartTime:a,EndTime:g,Period:86400,ExtendedStatistics:[r]}).catch(()=>[]);return Math.round(f.reduce((h,b)=>h+(b.Percentiles?.[r]??0),0))}async function xn(e,t){let r=await hr(e,t),a=r.region,g=new he(a),f=new T(a),h=new Re(a),b=new Date,S=new Date(b.getTime()-86400000),y=e.environments?.[t]?.app,k={};k.app={name:r.slug,env:t,region:a,runtime:y?.kind==="php"?`php-${y?.phpVersion??"8.3"} (fpm)`:y?.kind??"node",url:r.endpoint??"",build:r.lastRelease?.sha?.slice(0,7)??"—",deployedAt:r.lastRelease?.timestamp??"—"},k.maintenance={enabled:!1},k.scheduler={enabled:r.scheduler!=="off",expression:r.scheduler==="sub-minute"?"rate(1 minute) · sub-minute":"rate(1 minute)",lastRun:"—"};let R=0,D=0,O=0,M=[],z=[],J=[];for(let te of r.functions){let[ye,be,ie,_e,ee,xe,Je,gt,jt]=await Promise.all([aa(g,te.name,"Invocations","Sum",S,b),aa(g,te.name,"Errors","Sum",S,b),aa(g,te.name,"Throttles","Sum",S,b),aa(g,te.name,"Duration","Average",S,b),f.getFunction(te.name).catch(()=>null),Tg(g,te.name,"p50",S,b),Tg(g,te.name,"p95",S,b),Tg(g,te.name,"p99",S,b),g.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:te.name}],StartTime:new Date(b.getTime()-43200000),EndTime:b,Period:3600,Stat:"Sum"}).catch(()=>[])]);R+=ye,D+=be,O=Math.max(O,_e);let Ze=ee?.Configuration?.MemorySize??0,wt=Object.keys(ee?.Configuration?.Environment?.Variables??{}),Bt=[],nt=0;try{let{events:se=[]}=await h.filterLogEvents({logGroupName:`/aws/lambda/${te.name}`,startTime:S.getTime(),limit:120});for(let ue of se){let Ee=(ue.message??"").trim(),mt=/Max Memory Used:\s*(\d+)\s*MB/.exec(Ee);if(mt)nt=Math.max(nt,Number(mt[1]));if(Ee&&!/^(?:START|END|REPORT|INIT_START)/.test(Ee))J.push({source:te.mode||te.name,timestamp:new Date(ue.timestamp??0).toISOString(),when:aC(ue.timestamp??0),message:Ee.slice(0,400),level:/error|exception|fatal|panic|traceback/i.test(Ee)?"error":/warn|warning|timeout|retr(?:y|ies)|throttl/i.test(Ee)?"warn":"info"})}Bt=se.filter((ue)=>!/^(?:START|END|REPORT|INIT_START)/.test((ue.message??"").trim())).slice(-6).map((ue)=>({ts:new Date(ue.timestamp??0).toISOString().slice(11,19),msg:(ue.message??"").trim().slice(0,120),err:/error|exception|fatal/i.test(ue.message??"")}))}catch{}let W=Math.max(1,...jt);M.push({key:te.mode,name:te.name,version:te.version,memory:Ze,timeout:ee?.Configuration?.Timeout??0,runtime:ee?.Configuration?.Runtime??"provided.al2023",invocations:Math.round(ye),errors:Math.round(be),p95:Je||Math.round(_e),status:"active",provisioned:te.provisioned?`${te.provisioned.allocated}/${te.provisioned.requested}`:void 0}),z.push({key:te.mode,name:te.name,runtime:ee?.Configuration?.Runtime??"provided.al2023",arch:ee?.Configuration?.Architectures?.[0]??"x86_64",memory:Ze,timeout:ee?.Configuration?.Timeout??0,ephemeral:ee?.Configuration?.EphemeralStorage?.Size??512,version:te.version,concurrency:y?.concurrency??"—",invocations:Math.round(ye),errors:Math.round(be),throttles:Math.round(ie),p50:xe||Math.round(_e),p95:Je||Math.round(_e),p99:gt||Math.round(_e),maxMem:nt,spark:jt.length?jt.map((se)=>Math.round(se/W*100)):[0],env:wt.length?wt:["(none)"],recent:Bt.length?Bt:[{ts:"—",msg:"no recent events",err:!1}]})}k.functions=M,k.functionsDetail=z,k.serverlessLogs=J.sort((te,ye)=>String(ye.timestamp).localeCompare(String(te.timestamp))).slice(0,600),k.serverlessLogsEmptyReason=J.length?void 0:"No recent function logs were found in CloudWatch for this environment.";let Z=R?Number((D/R*100).toFixed(2)):0,oe=Math.round(await aa(g,r.functions[0]?.name??"","ConcurrentExecutions","Maximum",S,b));k.metrics={invocations:Math.round(R),errorRatePct:Z,p95Ms:Math.round(O),coldStartPct:void 0,concurrency:oe,estCostUsd:void 0};try{let te=new fe(a),ye=[],be=[],ie=0;try{let{QueueUrl:ee}=await te.getQueueUrl(`${r.slug}-${t}-dlq`),{Attributes:xe}=await te.getQueueAttributes(ee);ie=Number(xe.ApproximateNumberOfMessages??0)}catch{}let _e=y?Ar(y,r.slug,t):[];for(let ee of _e){let xe=ee.name.replace(`${r.slug}-${t}-`,""),Je=0,gt=0;try{let{QueueUrl:Ze}=await te.getQueueUrl(ee.name),{Attributes:wt}=await te.getQueueAttributes(Ze);Je=Number(wt.ApproximateNumberOfMessages??0),gt=Number(wt.ApproximateNumberOfMessagesNotVisible??0)}catch{}let jt=Math.round(await ca(g,"AWS/SQS","NumberOfMessagesDeleted",[{Name:"QueueName",Value:ee.name}],"Sum",S,b));ye.push({name:xe,visible:Je,inFlight:gt,processed:jt,dlq:ie}),be.push({name:ee.name,short:xe,visible:Je,inFlight:gt,delayed:0,processed:jt,oldestSec:0,concurrency:ee.concurrency??y?.queueConcurrency??"—",tries:y?.queueTries??3,visTimeout:(y?.queueTimeout??120)*6,dlq:ie})}if(ye.length)k.queues=ye;if(be.length)k.queuesDetail=be;k.dlqItems=[]}catch{}try{let te=new A(a),{Stacks:ye}=await te.describeStacks({stackName:lr(e,t)}),be={};for(let ie of ye?.[0]?.Outputs??[])if(ie.OutputKey)be[ie.OutputKey]=ie.OutputValue??"";if(y?.database?.connection==="aurora-serverless"){let ie=`${r.slug}-${t}-db`,_e=[{Name:"DBClusterIdentifier",Value:ie}],[ee,xe]=await Promise.all([ca(g,"AWS/RDS","ServerlessDatabaseCapacity",_e,"Average",S,b),ca(g,"AWS/RDS","DatabaseConnections",_e,"Maximum",S,b)]);if(k.aurora={id:ie,engine:"aurora-mysql",minAcu:y?.database?.minCapacity??0.5,maxAcu:y?.database?.maxCapacity??4,currentAcu:ee?Number(ee.toFixed(1)):y?.database?.minCapacity??0.5,database:"app",connections:Math.round(xe),status:be.DbEndpoint?"available":"creating"},y?.rdsProxy)k.proxy={name:`${r.slug}-${t}-proxy`,endpoint:be.DbProxyEndpoint??"—",pooledConns:Math.round(xe),status:"available"}}if(y?.cache?.driver==="elasticache"){let ie=`${r.slug}-${t}-cache`,_e=[{Name:"CacheClusterId",Value:`${ie}-001`}],[ee,xe]=await Promise.all([ca(g,"AWS/ElastiCache","CacheHits",_e,"Sum",S,b),ca(g,"AWS/ElastiCache","CacheMisses",_e,"Sum",S,b)]),Je=ee+xe>0?Number((ee/(ee+xe)*100).toFixed(1)):0;k.redis={id:ie,node:"cache.t4g.micro",engine:"redis",hitRate:Je,status:be.CacheEndpoint?"available":"creating"}}if(y?.efs){let ie=0;try{if(be.EfsFileSystemId){let _e=new Pr(a),{FileSystems:ee}=await _e.describeFileSystems({FileSystemId:be.EfsFileSystemId});ie=Number(((ee?.[0]?.SizeInBytes?.Value??0)/1048576).toFixed(1))}}catch{}k.efs={id:be.EfsFileSystemId??"efs",mount:"/mnt/local",sizeMb:ie,status:"available"}}k.assetsInfo=be.AssetsCdnDomain?{bucket:be.AssetsBucketName??`${r.slug}-${t}-assets`,cdn:be.AssetsCdnDomain,customDomain:y?.assetDomain??"—",assetUrl:r.assetUrl??"—",files:0,sizeMb:0,cacheHitPct:0,build:k.app.build}:void 0}catch{}if(k.assetsInfo)try{let ye=await new o(a).list({bucket:k.assetsInfo.bucket,maxKeys:1000});k.assetsInfo.files=ye.length,k.assetsInfo.sizeMb=Number((ye.reduce((be,ie)=>be+(ie.Size??0),0)/1048576).toFixed(1)),k.assetsRecent=ye.slice(0,8).map((be)=>({path:`/${be.Key}`,size:`${Math.max(1,Math.round((be.Size??0)/1024))} KB`,type:be.Key.split(".").pop()??""}))}catch{}try{if(y?.secrets){let te=Array.isArray(y.secrets)?y.secrets.map((ye)=>({key:ye.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),source:ye})):Object.entries(y.secrets).map(([ye,be])=>({key:ye,source:String(be)}));k.secretsList=te.map((ye)=>({...ye,updated:"—"}))}}catch{}try{let te=new o(a),ye=`${r.slug}-${t}-deployments`,be=await te.getObjectJson(ye,`deployments/${r.slug}/${t}/history.json`).catch(()=>null);if(be?.records?.length)k.deploymentsDetail=be.records.slice(-12).reverse().map((ie)=>({sha:(ie.sha??"").slice(0,7),status:ie.status??"success",when:ie.timestamp??"—",took:ie.took??"—",by:ie.by??"—",version:ie.version??"—",hooks:ie.hooks??[]}))}catch{}k.metricsTotals={invocations:k.metrics.invocations,errors:Math.round(D),errorRatePct:Z,p95Ms:k.metrics.p95Ms,throttles:z.reduce((te,ye)=>te+ye.throttles,0),coldStartPct:void 0,estCostUsd:void 0,concurrency:oe},k.metricsPerFn=z.map((te)=>({key:te.key,invocations:te.invocations,errors:te.errors,throttles:te.throttles,avgMs:te.p50,maxMs:te.p99,costUsd:void 0}));try{k.invSpark=await g.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:r.functions.find((te)=>te.mode==="http")?.name??""}],StartTime:new Date(b.getTime()-86400000),EndTime:b,Period:3600,Stat:"Sum"})}catch{}try{let te=new $s,ye=b,be=new Date(Date.UTC(ye.getUTCFullYear(),ye.getUTCMonth(),1)),ie=new Date(Date.UTC(ye.getUTCFullYear(),ye.getUTCMonth()-1,1)),[_e,ee]=await Promise.all([te.getCostByService({start:ks(be),end:ks(ye),granularity:"MONTHLY"}).catch(()=>[]),te.getCostByService({start:ks(ie),end:ks(be),granularity:"MONTHLY"}).catch(()=>[])]);if(_e.length){let xe=_e.reduce((nt,W)=>nt+W.amount,0),Je=ee.reduce((nt,W)=>nt+W.amount,0),gt=ye.getUTCDate(),jt=new Date(Date.UTC(ye.getUTCFullYear(),ye.getUTCMonth()+1,0)).getUTCDate();k.costSummary={monthToDateUsd:Number(xe.toFixed(2)),projectedUsd:Number((xe/gt*jt).toFixed(2)),lastMonthUsd:Number(Je.toFixed(2)),dailyAvgUsd:Number((xe/gt).toFixed(2))},k.costServices=_e.filter((nt)=>nt.amount>0).sort((nt,W)=>W.amount-nt.amount).slice(0,12).map((nt)=>({name:nt.service,usd:Number(nt.amount.toFixed(2)),note:""})),k.metrics.estCostUsd=Number((xe/gt).toFixed(2)),k.metricsTotals.estCostUsd=k.metrics.estCostUsd,k.costTrend=await te.getDailyTotals({start:ks(be),end:ks(ye)}).catch(()=>[]);let Ze=_e.find((nt)=>/lambda/i.test(nt.service))?.amount??0,wt=(nt)=>nt.invocations*(nt.p50/1000)*(nt.memory/1024),Bt=z.reduce((nt,W)=>nt+wt(W),0)||1;k.costPerFn=z.map((nt)=>({key:nt.key,requests:nt.invocations,gbSec:Math.round(wt(nt)),usd:Number((Ze*(wt(nt)/Bt)).toFixed(2))}))}}catch{}if(y?.firewall)try{let te=await g.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"BlockedRequests",StartTime:S,EndTime:b,Period:86400,Statistics:["Sum"]}).catch(()=>[]),ye=await g.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"AllowedRequests",StartTime:S,EndTime:b,Period:86400,Statistics:["Sum"]}).catch(()=>[]);k.waf={enabled:!0,scope:"REGIONAL",acl:`${r.slug}-${t}-waf`,allowed24h:Math.round(ye.reduce((be,ie)=>be+(ie.Sum??0),0)),blocked24h:Math.round(te.reduce((be,ie)=>be+(ie.Sum??0),0))};try{let be=new _g(a),ie=await be.listWebACLs("REGIONAL"),_e=ie.find((ee)=>ee.Name?.includes(`${r.slug}-${t}`))??ie[0];if(_e?.Name&&_e.Id){k.waf.acl=_e.Name;let ee=await be.getWebACLRules(_e.Name,_e.Id,"REGIONAL");if(ee.length)k.wafRules=ee.map((xe)=>({name:xe.Name??"—",detail:`priority ${xe.Priority??0}`,action:xe.Action??"count",blocked24h:0}))}}catch{}}catch{}let G=[];if(k.aurora)G.push({name:"Aurora Serverless v2",detail:`${k.aurora.id} · ${k.aurora.minAcu}-${k.aurora.maxAcu} ACU`,status:k.aurora.status});if(k.proxy)G.push({name:"RDS Proxy",detail:k.proxy.name,status:k.proxy.status});if(k.redis)G.push({name:`ElastiCache (${k.redis.engine})`,detail:`${k.redis.node} · ${k.redis.hitRate}% hit rate`,status:k.redis.status});if(k.efs)G.push({name:"EFS",detail:`${k.efs.mount} · ${k.efs.sizeMb} MB`,status:k.efs.status});if(G.length)k.dataServices=G;if(r.scheduler!=="off"&&y?.kind==="php")try{let te=await lt(e,t,"schedule:list"),ye=[];for(let be of(te||"").split(`
+`)){let ie=/^\s*([\d*/,\-\s]+?)\s{2,}(.+?)(?:\s{2,}Next Due.*)?$/.exec(be);if(ie&&/[*\d]/.test(ie[1])&&ie[1].trim().split(/\s+/).length===5)ye.push({command:ie[2].trim().replace(/^php artisan /,""),cron:ie[1].trim(),desc:"",lastRun:"—",lastStatus:"ok"})}if(ye.length)k.schedulerTasks=ye}catch{}return k.topology=vs(k,{project:e.project.name,environment:t}),k}function Ui(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:null}function cC(e){if(!/^\d{4}-\d{2}-\d{2}$/.test(e))return null;let t=Date.parse(`${e}T12:00:00.000Z`);return Number.isFinite(t)?new Date(t).toISOString():null}function gg(e,t){if(!e||typeof e!=="object")return[];let r={source:t.name},a=[],g=t.now,f=(y,k,R,D=g)=>{if(k!==null)a.push({name:y,value:k,unit:R,timestamp:D,attributes:r})};f("storage.egress.month",Ui(e.monthBytes),"bytes"),f("storage.egress.today",Ui(e.todayBytes),"bytes"),f("storage.egress.projected_month",Ui(e.projectedMonthBytes),"bytes");let h=Ui(e.budgetBytes);if(h!==null&&h>0){f("storage.egress.budget",h,"bytes");let y=e.budgetUsedPercent,k=typeof y==="number"&&Number.isFinite(y)?y:Ui(e.monthBytes)!==null?Math.round(Ui(e.monthBytes)/h*1000)/10:null;f("storage.egress.budget_used_percent",k,"percent")}let b=t.maxReplayDays??45,S=Array.isArray(e.days)?e.days.slice(-b):[];for(let y of S){let k=cC(String(y?.date??"")),R=Ui(y?.bytes);if(!k||R===null)continue;a.push({name:"storage.egress.day",value:R,unit:"bytes",timestamp:k,attributes:r});let D=Ui(y?.downloads);if(D!==null)a.push({name:"storage.egress.day_downloads",value:D,unit:"count",timestamp:k,attributes:r})}return a}async function pg(e,t=process.env,r=fetch){let a=e.tokenEnv?t[e.tokenEnv]:void 0,g=await r(e.url,{headers:a?{Authorization:`Bearer ${a}`}:{},signal:AbortSignal.timeout(1e4)});if(!g.ok)throw Error(`HTTP ${g.status}`);return await g.json()}async function Za(e,t){let r=[],a=[];if(!Array.isArray(e)||e.length===0)return{metrics:r,errors:a};let g=await Promise.all(e.map(async(f)=>{if(!f?.name||!f?.url)return{endpoint:f,error:"egress endpoint needs both a name and a url"};try{let h=await pg(f,t.env,t.fetchImpl);return{endpoint:f,report:h}}catch(h){return{endpoint:f,error:h instanceof Error?h.message:String(h)}}}));for(let f of g){let h=`egress:${f.endpoint?.name??"unnamed"}`;if("error"in f&&f.error){a.push({source:h,message:f.error});continue}r.push(...gg(f.report,{name:f.endpoint.name,now:t.now}))}return{metrics:r,errors:a}}import{createHash as j_}from"node:crypto";import{existsSync as Si,mkdtempSync as Im,readdirSync as NS,rmSync as Ao,statSync as cw}from"node:fs";import{readFile as ni,writeFile as Eo}from"node:fs/promises";import{tmpdir as vl}from"node:os";import{dirname as B_,extname as Ic,join as xt,normalize as M_,relative as L_,resolve as F_,sep as z_}from"node:path";import{fileURLToPath as U_}from"node:url";import{isIP as Bv}from"node:net";var vt=(e)=>e==null?void 0:String(e),Fd=(e)=>Number(e)===1,qi=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}};function Mv(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),provider:String(e.provider),endpoint:vt(e.endpoint),endpointPolicy:String(e.endpoint_policy),bucket:vt(e.bucket),prefix:String(e.prefix),region:vt(e.region),forcePathStyle:Fd(e.force_path_style),credentialRef:vt(e.credential_ref),encryption:String(e.encryption),encryptionKeyRef:vt(e.encryption_key_ref),immutability:qi(e.immutability,{}),status:String(e.status),lastTestedAt:vt(e.last_tested_at),lastSuccessAt:vt(e.last_success_at),lastFailureAt:vt(e.last_failure_at),lastError:vt(e.last_error),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function xg(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:vt(e.environment_id),resourceId:vt(e.resource_id),dataServiceId:vt(e.data_service_id),destinationId:String(e.destination_id),name:String(e.name),resourceKind:String(e.resource_kind),schedule:String(e.schedule),timezone:String(e.timezone),retention:qi(e.retention,{}),compression:String(e.compression),encryption:String(e.encryption),includePatterns:qi(e.include_patterns,[]),excludePatterns:qi(e.exclude_patterns,[]),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),healthCheckId:vt(e.health_check_id),enabled:Fd(e.enabled),nextRunAt:vt(e.next_run_at),lastRunAt:vt(e.last_run_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Dg(e){return{id:String(e.id),projectId:String(e.project_id),policyId:vt(e.policy_id),destinationId:String(e.destination_id),resourceId:vt(e.resource_id),dataServiceId:vt(e.data_service_id),backupJobId:vt(e.backup_job_id),kind:String(e.kind),pointInTime:String(e.point_in_time),uri:String(e.uri),sizeBytes:Number(e.size_bytes),checksum:String(e.checksum),manifest:qi(e.manifest,{}),toolVersion:vt(e.tool_version),engineVersion:vt(e.engine_version),expiresAt:vt(e.expires_at),lockedUntil:vt(e.locked_until),held:Fd(e.held),pinned:Fd(e.pinned),status:String(e.status),verificationState:String(e.verification_state),verifiedAt:vt(e.verified_at),durationMs:e.duration_ms==null?void 0:Number(e.duration_ms),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Og(e){return{id:String(e.id),projectId:String(e.project_id),policyId:vt(e.policy_id),recoveryPointId:vt(e.recovery_point_id),operationId:vt(e.operation_id),kind:String(e.kind),status:String(e.status),idempotencyKey:String(e.idempotency_key),target:qi(e.target,{}),restoreMode:vt(e.restore_mode),cancellability:String(e.cancellability),safetyBackupId:vt(e.safety_backup_id),healthResult:e.health_result?qi(e.health_result,{}):void 0,progress:qi(e.progress,{}),error:vt(e.error),startedAt:vt(e.started_at),finishedAt:vt(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function dC(e){let t=e.toLowerCase();if(t==="localhost"||t.endsWith(".localhost")||t.endsWith(".local")||t.endsWith(".internal"))return!0;if(Bv(t)===6)return t==="::1"||t.startsWith("fe80:");if(Bv(t)!==4)return!1;let[r,a]=t.split(".").map(Number);return r===10||r===127||r===0||r===169&&a===254||r===172&&a>=16&&a<=31||r===192&&a===168}function vh(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup destination names must be 2-63 lowercase letters, numbers, or dashes.");if(e.provider!=="aws_backup"&&!e.bucket)throw Error("S3 backup destinations require a bucket.");if(e.provider==="s3_compatible"&&!e.endpoint)throw Error("S3-compatible destinations require an explicit endpoint.");if(e.provider==="s3_compatible"&&!e.credentialRef)throw Error("S3-compatible destinations require a credential reference.");if(e.encryption!=="provider"&&!e.encryptionKeyRef)throw Error("Client-side encryption requires an encryption key reference.");if(e.endpoint){let t=new URL(e.endpoint);if(t.protocol!=="https:"||t.username||t.password||t.search||t.hash||t.pathname!=="/")throw Error("Backup endpoints must be origin-only HTTPS URLs without credentials, paths, queries, or fragments.");if(dC(t.hostname)&&e.endpointPolicy!=="allow_private")throw Error("Private backup endpoints require endpointPolicy allow_private.")}}class ec{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}createDestination(e){vh(e);let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_destinations (id,organization_id,project_id,name,provider,endpoint,endpoint_policy,bucket,prefix,region,force_path_style,credential_ref,encryption,encryption_key_ref,immutability,status,last_tested_at,last_success_at,last_failure_at,last_error,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.provider,e.endpoint??null,e.endpointPolicy,e.bucket??null,e.prefix,e.region??null,e.forcePathStyle?1:0,e.credentialRef??null,e.encryption,e.encryptionKeyRef??null,JSON.stringify(e.immutability),e.status,e.lastTestedAt??null,e.lastSuccessAt??null,e.lastFailureAt??null,e.lastError??null,1,r,r]),this.getDestination(t)}getDestination(e){let t=this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE id=?").get(e);return t?Mv(t):void 0}listDestinations(e){return this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE project_id=? ORDER BY name").all(e).map(Mv)}recordDestinationTest(e,t){let r=this.now().toISOString();return this.controlPlane.database.run("UPDATE backup_destinations SET status=?,last_tested_at=?,last_success_at=CASE WHEN ? THEN ? ELSE last_success_at END,last_failure_at=CASE WHEN ? THEN last_failure_at ELSE ? END,last_error=?,version=version+1,updated_at=? WHERE id=?",[t.ok?"healthy":"failing",r,t.ok?1:0,r,t.ok?1:0,r,t.ok?null:String(t.error??"Destination test failed.").slice(0,1000),r,e]),this.getDestination(e)}createPolicy(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup policy names must be lowercase slugs.");if(!e.resourceId&&!e.dataServiceId&&!["control_plane","infrastructure"].includes(e.resourceKind))throw Error("A backup policy requires a resource or data service target.");let t=this.getDestination(e.destinationId);if(!t||t.projectId!==e.projectId)throw Error("Backup destination was not found.");if(e.resourceKind==="control_plane"&&t.encryption==="provider")throw Error("Control-plane backups require client-side destination encryption.");if(["logical_database","volume","files","control_plane"].includes(e.resourceKind)&&t.provider==="aws_backup")throw Error(`${e.resourceKind} backups require an object-storage destination.`);if(e.resourceKind==="infrastructure"&&t.provider!=="aws_backup")throw Error("Infrastructure backups require an AWS Backup destination.");let r=dt(e.schedule),a=Ft(r.normalized,e.timezone,this.now(),1)[0],g=crypto.randomUUID(),f=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_policies (id,organization_id,project_id,environment_id,resource_id,data_service_id,destination_id,name,resource_kind,schedule,timezone,retention,compression,encryption,include_patterns,exclude_patterns,expected_rpo_minutes,expected_rto_minutes,health_check_id,enabled,next_run_at,last_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[g,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.dataServiceId??null,e.destinationId,e.name,e.resourceKind,r.normalized,e.timezone,JSON.stringify(e.retention),e.compression,e.encryption,JSON.stringify(e.includePatterns),JSON.stringify(e.excludePatterns),e.expectedRpoMinutes,e.expectedRtoMinutes,e.healthCheckId??null,e.enabled?1:0,a,e.lastRunAt??null,1,f,f]),this.getPolicy(g)}getPolicy(e){let t=this.controlPlane.database.query("SELECT * FROM backup_policies WHERE id=?").get(e);return t?xg(t):void 0}listPolicies(e,t){return this.controlPlane.database.query(`SELECT * FROM backup_policies WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(xg)}duePolicies(e=this.now()){return this.controlPlane.database.query("SELECT * FROM backup_policies WHERE enabled=1 AND next_run_at<=? ORDER BY next_run_at,id").all(e.toISOString()).map(xg)}advancePolicy(e,t){let r=this.getPolicy(e);if(!r)throw Error("Backup policy was not found.");let a=Ft(r.schedule,r.timezone,new Date(t),1)[0];return this.controlPlane.database.run("UPDATE backup_policies SET last_run_at=?,next_run_at=?,version=version+1,updated_at=? WHERE id=?",[t,a,this.now().toISOString(),e]),this.getPolicy(e)}createJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return Og(t);let r=crypto.randomUUID(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_jobs (id,project_id,policy_id,recovery_point_id,operation_id,kind,status,idempotency_key,target,restore_mode,cancellability,safety_backup_id,health_result,progress,error,started_at,finished_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.projectId,e.policyId??null,e.recoveryPointId??null,e.operationId??null,e.kind,e.status,e.idempotencyKey,JSON.stringify(e.target),e.restoreMode??null,e.cancellability,e.safetyBackupId??null,e.healthResult?JSON.stringify(e.healthResult):null,JSON.stringify(e.progress),e.error??null,e.startedAt??null,e.finishedAt??null,a,a]),this.getJob(r)}getJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE id=?").get(e);return t?Og(t):void 0}listJobs(e){return this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE project_id=? ORDER BY created_at DESC").all(e).map(Og)}updateJob(e,t){let r=this.getJob(e);if(!r)throw Error("Backup job was not found.");let a={...r,...t};return this.controlPlane.database.run("UPDATE backup_jobs SET status=?,operation_id=?,recovery_point_id=?,progress=?,health_result=?,error=?,started_at=?,finished_at=?,safety_backup_id=?,updated_at=? WHERE id=?",[a.status,a.operationId??null,a.recoveryPointId??null,JSON.stringify(a.progress),a.healthResult?JSON.stringify(a.healthResult):null,a.error??null,a.startedAt??null,a.finishedAt??null,a.safetyBackupId??null,this.now().toISOString(),e]),this.getJob(e)}createRecoveryPoint(e){if(!/^sha256:[a-f0-9]{64}$/i.test(e.checksum))throw Error("Recovery points require a SHA-256 checksum.");if(typeof e.uri!=="string"||!["s3:","aws-backup:","file:"].some((a)=>e.uri.startsWith(a)))throw Error("Recovery point URI uses an unsupported destination scheme.");let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO recovery_points (id,project_id,policy_id,destination_id,resource_id,data_service_id,backup_job_id,kind,point_in_time,uri,size_bytes,checksum,manifest,tool_version,engine_version,expires_at,locked_until,held,pinned,status,verification_state,verified_at,duration_ms,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.projectId,e.policyId??null,e.destinationId,e.resourceId??null,e.dataServiceId??null,e.backupJobId??null,e.kind,e.pointInTime,e.uri,e.sizeBytes,e.checksum,JSON.stringify(e.manifest),e.toolVersion??null,e.engineVersion??null,e.expiresAt??null,e.lockedUntil??null,e.held?1:0,e.pinned?1:0,e.status,e.verificationState,e.verifiedAt??null,e.durationMs??null,r,r]),this.getRecoveryPoint(t)}getRecoveryPoint(e){let t=this.controlPlane.database.query("SELECT * FROM recovery_points WHERE id=?").get(e);return t?Dg(t):void 0}listRecoveryPoints(e,t){return this.controlPlane.database.query(`SELECT * FROM recovery_points WHERE project_id=?${t?" AND policy_id=?":""} ORDER BY point_in_time DESC`).all(e,...t?[t]:[]).map(Dg)}updateRecoveryPoint(e,t){let r=this.getRecoveryPoint(e);if(!r)throw Error("Recovery point was not found.");let a={...r,...t};return this.controlPlane.database.run("UPDATE recovery_points SET status=?,verification_state=?,verified_at=?,held=?,pinned=?,manifest=?,duration_ms=?,updated_at=? WHERE id=?",[a.status,a.verificationState,a.verifiedAt??null,a.held?1:0,a.pinned?1:0,JSON.stringify(a.manifest),a.durationMs??null,this.now().toISOString(),e]),this.getRecoveryPoint(e)}retentionCandidates(e=this.now()){let t=this.controlPlane.database.query(`SELECT rp.* FROM recovery_points rp
         WHERE rp.status='available' AND rp.held=0 AND rp.pinned=0
           AND rp.expires_at IS NOT NULL AND rp.expires_at<=?
           AND (rp.locked_until IS NULL OR rp.locked_until<=?)
@@ -655,7 +655,7 @@ EOF`,'echo "DISKPCT=${DISKPCT:-0}"','echo "DISKUSEDG=${DISKUSEDG:-0}"','echo "DI
       },
     ${S}`}class gm{client;region;constructor(e="us-east-1"){this.region=e,this.client=new n}async getTraceSummaries(e){let t={StartTime:Math.floor(e.startTime.getTime()/1000),EndTime:Math.floor(e.endTime.getTime()/1000),TimeRangeType:"Event",Sampling:!1};if(e.filterExpression)t.FilterExpression=e.filterExpression;if(e.nextToken)t.NextToken=e.nextToken;let r=await this.client.request({service:"xray",region:this.region,method:"POST",path:"/TraceSummaries",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)});return{summaries:r?.TraceSummaries??[],nextToken:r?.NextToken}}async batchGetTraces(e){if(!e.length)return[];return(await this.client.request({service:"xray",region:this.region,method:"POST",path:"/Traces",headers:{"Content-Type":"application/json"},body:JSON.stringify({TraceIds:e.slice(0,5)})}))?.Traces??[]}}var pS=65536;function zr(e){return e.length<=pS?e:`${e.slice(0,pS)}
 
-[output truncated]`}function fm(e,t){return e.environments?.[t]?.app}function hm(e,t,r){let a=[],g=fm(e,t);a.push({id:"redeploy",label:"Redeploy current build",group:"deploy",target:"app",mutates:!0,confirm:"redeploy"}),a.push({id:"rollback",label:"Roll back to previous build",group:"deploy",target:"app",mutates:!0,confirm:"rollback",danger:!0});let f=r.maintenance?.enabled;if(f!==!0)a.push({id:"maintenance:on",label:"Enable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"maintenance",danger:!0});if(f!==!1)a.push({id:"maintenance:off",label:"Disable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"live"});if(g?.assets||r.assetsInfo)a.push({id:"assets:invalidate",label:"Invalidate CDN cache",group:"assets",target:"assets",mutates:!0,confirm:"invalidate"});if(g?.database?.connection==="aurora-serverless")a.push({id:"db:scale",label:"Scale Aurora capacity",group:"database",target:"database",mutates:!0,confirm:"scale",inputs:[{name:"min",label:"Min ACUs",placeholder:String(g.database.minCapacity??0.5)},{name:"max",label:"Max ACUs",placeholder:String(g.database.maxCapacity??4)}]});for(let h of r.queues??[]){let b=String(h?.name??"").trim();if(b&&/^[A-Za-z0-9_-]+$/.test(b))a.push({id:`queue:purge:${b}`,label:`Purge queue (${b})`,group:"queue",target:b,mutates:!0,confirm:b,danger:!0})}return a}function gS(e,t,r,a){return hm(t,r,a).find((g)=>g.id===e)}async function A_(e,t,r){try{let a=new A(r),{Stacks:g}=await a.describeStacks({stackName:lr(e,t)}),f={};for(let S of g?.[0]?.Outputs??[])if(S.OutputKey)f[S.OutputKey]=S.OutputValue??"";let h=f.AssetsCdnDomain;if(!h)return null;return(await new I(r).findDistributionByDomain(h))?.Id??null}catch{return null}}async function mS(e,t,r,a={}){try{if(r.id==="redeploy")return await Nn(e,t),{operation:r.id,command:"serverless redeploy",ok:!0,stdout:"Redeploy complete."};if(r.id==="rollback")return await Bn(e,t),{operation:r.id,command:"serverless rollback",ok:!0,stdout:"Rollback complete."};if(r.id==="maintenance:on")return await Er(e,t,!0),{operation:r.id,command:"maintenance on",ok:!0,stdout:"Application is now in maintenance mode."};if(r.id==="maintenance:off")return await Er(e,t,!1),{operation:r.id,command:"maintenance off",ok:!0,stdout:"Application is live."};if(r.id==="db:scale"){let g=Number(a.min),f=Number(a.max);if(!Number.isFinite(g)||!Number.isFinite(f)||g<=0||f<g)return{operation:r.id,ok:!1,error:"Provide valid Aurora capacities (0 < min ≤ max)."};return await Nv(e,t,g,f),{operation:r.id,command:`db:scale ${g}-${f} ACU`,ok:!0,stdout:`Scaling applied (${g}-${f} ACUs); takes effect shortly.`}}if(r.id==="assets:invalidate"){let g=await hr(e,t),f=await A_(e,t,g.region);if(!f)return{operation:r.id,ok:!1,error:"Could not resolve the asset CloudFront distribution for this environment."};let b=await new I(g.region).invalidateAll(f);return{operation:r.id,command:`cloudfront invalidate ${f} /*`,ok:!0,stdout:`Invalidation ${b?.Id??"created"} for ${f} (/*).`}}if(r.group==="queue"&&r.id.startsWith("queue:purge:")){let g=r.target,f=await hr(e,t),h=new me(f.region),b=`${f.slug}-${t}-${g}`,{QueueUrl:S}=await h.getQueueUrl(b);return await h.purgeQueue(S),{operation:r.id,command:`sqs purge ${b}`,ok:!0,stdout:`Purged queue ${b}.`}}return{operation:r.id,ok:!1,error:"Unknown or unavailable serverless operation."}}catch(g){return{operation:r.id,ok:!1,error:zr(g?.message??String(g))}}}async function fS(e,t,r){let a=r.trim();if(!a)return{operation:"command",ok:!1,error:"A command is required."};try{let g=await lt(e,t,a);return{operation:"command",command:a,ok:!0,stdout:zr(g||"(no output)")}}catch(g){return{operation:"command",command:a,ok:!1,error:zr(g?.message??String(g))}}}var ym="No dead-letter queue is provisioned for this environment.";async function vm(e,t,r){try{let{QueueUrl:a}=await e.getQueueUrl(`${t}-${r}-dlq`);return a}catch{return null}}async function hS(e,t,r=10){try{let a=await hr(e,t),g=new me(a.region),f=await vm(g,a.slug,t);if(!f)return{ok:!1,messages:[],error:ym};return{ok:!0,messages:((await g.receiveMessages({queueUrl:f,maxMessages:Math.min(10,Math.max(1,r)),waitTimeSeconds:1,visibilityTimeout:2})).Messages??[]).map((S)=>({id:S.MessageId,receiptHandle:S.ReceiptHandle,body:zr(String(S.Body??""))}))}}catch(a){return{ok:!1,messages:[],error:zr(a?.message??String(a))}}}async function yS(e,t,r={}){try{let a=await hr(e,t),g=fm(e,t),h=(g?Ar(g,a.slug,t):[]).map((O)=>O.name.replace(`${a.slug}-${t}-`,"")),b=r.targetQueue&&h.includes(r.targetQueue)?r.targetQueue:h[0];if(!b)return{operation:"dlq:redrive",ok:!1,error:"No source queue is configured to redrive into."};let S=new me(a.region),y=await vm(S,a.slug,t);if(!y)return{operation:"dlq:redrive",ok:!1,error:ym};let{QueueUrl:k}=await S.getQueueUrl(`${a.slug}-${t}-${b}`),R=Math.min(50,Math.max(1,r.max??10)),D=0;while(D<R){let M=(await S.receiveMessages({queueUrl:y,maxMessages:Math.min(10,R-D),waitTimeSeconds:1,visibilityTimeout:30})).Messages??[];if(!M.length)break;for(let z of M)await S.sendMessage({queueUrl:k,messageBody:String(z.Body??"")}),await S.deleteMessage(y,z.ReceiptHandle),D++}return{operation:"dlq:redrive",command:`redrive → ${b}`,ok:!0,stdout:`Moved ${D} message(s) from the DLQ to ${b}.`}}catch(a){return{operation:"dlq:redrive",ok:!1,error:zr(a?.message??String(a))}}}async function vS(e,t){try{let r=await hr(e,t),a=new me(r.region),g=await vm(a,r.slug,t);if(!g)return{operation:"dlq:purge",ok:!1,error:ym};return await a.purgeQueue(g),{operation:"dlq:purge",command:"sqs purge dlq",ok:!0,stdout:"Dead-letter queue purged."}}catch(r){return{operation:"dlq:purge",ok:!1,error:zr(r?.message??String(r))}}}function bS(e,t){let r=fm(e,t);if(!r?.secrets)return[];return Array.isArray(r.secrets)?r.secrets.map((a)=>({key:a.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:a})):Object.entries(r.secrets).map(([a,g])=>({key:a,secretId:String(g)}))}async function SS(e,t,r,a){if(!r.trim())return{operation:"secret:set",ok:!1,error:"A secret id is required."};try{let g=await hr(e,t),f=new re(g.region);try{await f.putSecretValue({SecretId:r,SecretString:a})}catch{await f.createSecret({Name:r,SecretString:a})}return{operation:"secret:set",command:`secret set ${r}`,ok:!0,stdout:`Secret ${r} updated. Redeploy to apply it to the functions.`}}catch(g){return{operation:"secret:set",ok:!1,error:zr(g?.message??String(g))}}}async function wS(e,t,r){if(!r.trim())return{operation:"secret:delete",ok:!1,error:"A secret id is required."};try{let a=await hr(e,t);return await new re(a.region).deleteSecret({SecretId:r,RecoveryWindowInDays:7}),{operation:"secret:delete",command:`secret delete ${r}`,ok:!0,stdout:`Secret ${r} scheduled for deletion (recoverable for 7 days).`}}catch(a){return{operation:"secret:delete",ok:!1,error:zr(a?.message??String(a))}}}var C_=new Set(["http","queue","cli"]);async function kS(e,t,r,a){if(!C_.has(r))return{operation:"function:config",ok:!1,error:`Unknown function mode '${r}'.`};let g=a.memory==null?void 0:Number(a.memory),f=a.timeout==null?void 0:Number(a.timeout);if(g!=null&&(!Number.isInteger(g)||g<128||g>10240))return{operation:"function:config",ok:!1,error:"Memory must be an integer between 128 and 10240 MB."};if(f!=null&&(!Number.isInteger(f)||f<1||f>900))return{operation:"function:config",ok:!1,error:"Timeout must be an integer between 1 and 900 seconds."};if(g==null&&f==null)return{operation:"function:config",ok:!1,error:"Provide a memory and/or timeout value."};try{let h=await hr(e,t),b=new T(h.region),S=`${h.slug}-${t}-${r}`;await b.updateFunctionConfiguration({FunctionName:S,...g!=null?{MemorySize:g}:{},...f!=null?{Timeout:f}:{}});let y=[g!=null?`${g} MB`:"",f!=null?`${f}s`:""].filter(Boolean).join(", ");return{operation:"function:config",command:`update ${S} (${y})`,ok:!0,stdout:`Updated ${S}: ${y}.`}}catch(h){return{operation:"function:config",ok:!1,error:zr(h?.message??String(h))}}}var mm=[{key:"http-errors",label:"HTTP function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"errors / 5 min"},{key:"http-throttles",label:"HTTP function throttles",namespace:"AWS/Lambda",metricName:"Throttles",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"throttles / 5 min"},{key:"http-duration",label:"HTTP function duration (avg)",namespace:"AWS/Lambda",metricName:"Duration",statistic:"Average",comparison:"GreaterThanThreshold",fnMode:"http",unit:"ms"},{key:"http-concurrency",label:"HTTP concurrent executions",namespace:"AWS/Lambda",metricName:"ConcurrentExecutions",statistic:"Maximum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"concurrent"},{key:"queue-errors",label:"Queue function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"queue",unit:"errors / 5 min"}];function P_(e){return mm.find((t)=>t.key===e)}async function IS(e,t){try{let r=await hr(e,t);return{ok:!0,alarms:await new fe(r.region).describeAlarms({AlarmNamePrefix:`${r.slug}-${t}-`,MaxRecords:100}),presets:mm}}catch(r){return{ok:!1,alarms:[],presets:mm,error:zr(r?.message??String(r))}}}async function ES(e,t,r,a){let g=P_(r);if(!g)return{operation:"alarm:create",ok:!1,error:`Unknown alarm metric '${r}'.`};if(!Number.isFinite(a)||a<0)return{operation:"alarm:create",ok:!1,error:"Provide a non-negative threshold."};try{let f=await hr(e,t),h=new fe(f.region),b=`${f.slug}-${t}-${g.key}`,S=g.fnMode?[{Name:"FunctionName",Value:`${f.slug}-${t}-${g.fnMode}`}]:[];return await h.putMetricAlarm({AlarmName:b,Namespace:g.namespace,MetricName:g.metricName,ComparisonOperator:g.comparison,Threshold:a,EvaluationPeriods:1,Period:300,Statistic:g.statistic,Dimensions:S,AlarmDescription:`ts-cloud: ${g.label} > ${a} ${g.unit}`}),{operation:"alarm:create",command:`alarm ${b}`,ok:!0,stdout:`Alarm ${b} armed at ${a} ${g.unit}.`}}catch(f){return{operation:"alarm:create",ok:!1,error:zr(f?.message??String(f))}}}async function RS(e,t,r){try{let a=await hr(e,t);if(!r.startsWith(`${a.slug}-${t}-`))return{operation:"alarm:delete",ok:!1,error:"Refusing to delete an alarm outside this environment."};return await new fe(a.region).deleteAlarms([r]),{operation:"alarm:delete",command:`delete alarm ${r}`,ok:!0,stdout:`Alarm ${r} deleted.`}}catch(a){return{operation:"alarm:delete",ok:!1,error:zr(a?.message??String(a))}}}function __(e){let t=e.HasFault?"fault":e.HasError?"error":e.HasThrottle?"throttle":"ok";return{id:String(e.Id??""),timestamp:Number.isFinite(Number(e.StartTime))?new Date(Number(e.StartTime)*1000).toISOString():void 0,durationMs:Math.round((e.Duration??0)*1000),responseMs:Math.round((e.ResponseTime??0)*1000),status:t,method:e.Http?.HttpMethod??"-",url:e.Http?.HttpURL??"-",httpStatus:e.Http?.HttpStatus??0}}async function pl(e,t,r=30){try{let a=await hr(e,t),g=new gm(a.region),f=new Date,h=new Date(f.getTime()-Math.min(360,Math.max(1,r))*60000),b=`${a.slug}-${t}-http`,S=await g.getTraceSummaries({startTime:h,endTime:f,filterExpression:`service("${b}")`});if(!S.summaries.length)S=await g.getTraceSummaries({startTime:h,endTime:f});return{ok:!0,traces:S.summaries.slice(0,100).map(__)}}catch(a){return{ok:!1,traces:[],error:zr(a?.message??String(a))}}}async function bm(e,t,r){try{let a=await hr(e,t),g=`${a.slug}-${t}-scheduler`;if(r==="run"){let h=await lt(e,t,"schedule:run");return{operation:"scheduler:run",command:"schedule:run",ok:!0,stdout:zr(h||"Scheduler run triggered.")}}let f=new Rr(a.region);if(r==="enable")await f.enableRule({Name:g});else await f.disableRule({Name:g});return{operation:`scheduler:${r}`,command:`${r} ${g}`,ok:!0,stdout:`Scheduler rule ${g} ${r}d.`}}catch(a){return{operation:`scheduler:${r}`,ok:!1,error:zr(a?.message??String(a))}}}function AS(e,t,r){let a=(Array.isArray(r)?r:String(r??"").split(",")).map(String).filter(Boolean);if(!a.length){if(t)return;let f=e.map((h)=>h.id);return f.length?f:["__no_authorized_telemetry_resources__"]}let g=a.map((f)=>e.find((h)=>h.id===f||h.slug===f)?.id).filter((f)=>!!f);if(g.length!==a.length)throw Error("One or more telemetry resources are outside your authorized scope.");return[...new Set(g)]}import{createHash as PS}from"node:crypto";class _S{now;entries=new Map;constructor(e=Date.now){this.now=e}async getOrCreate(e,t,r,a){let g=this.entries.get(e);if(!r&&g&&g.expiresAt>this.now())return{value:await g.promise,cached:!0};let f=a().catch((h)=>{throw this.entries.delete(e),h});return this.entries.set(e,{expiresAt:this.now()+t,promise:f}),{value:await f,cached:!1}}invalidate(e){for(let t of this.entries.keys())if(t.startsWith(e))this.entries.delete(t)}}class TS{now;lastRun=new Map;constructor(e=Date.now){this.now=e}shouldRun(e,t,r=!1){let a=this.now(),g=this.lastRun.get(e);if(!r&&g!=null&&a-g<t)return!1;return this.lastRun.set(e,a),!0}}var xS=new _S,T_=new TS,x_=2000,D_=3600000;function O_(e,t){if(e.kind==="log"&&!t.collectLogs)return!1;if(e.kind==="trace"&&!t.collectTraces)return!1;if((e.kind==="request"||e.name.startsWith("request."))&&!t.collectRequestAnalytics)return!1;if(!["log","trace","request"].includes(e.kind)&&!e.name.startsWith("request."))return!0;let r=e.requestId??e.traceId??`${e.source}\x00${e.workloadId??""}\x00${e.timestamp}`;return Number.parseInt(PS("sha256").update(r).digest("hex").slice(0,8),16)/4294967295<=t.samplingRate}function Nr(...e){return`telemetry:${PS("sha256").update(e.map((t)=>String(t??"")).join("\x00")).digest("hex").slice(0,40)}`}function wc(e,t,r,a){if(!a)return;return e.listResources(t,r).find((g)=>g.slug===a)?.id}function $_(e,t){let r=String(t??"").toLowerCase();if(["debug","info","warn","warning","error","fatal"].includes(r))return r==="fatal"?"error":r;return/fatal|panic|exception|error/i.test(e)?"error":/warn|timeout|throttl|retr(?:y|ies)/i.test(e)?"warning":"info"}function CS(e){let t=e.timestamp&&Number.isFinite(new Date(e.timestamp).getTime())?new Date(e.timestamp).toISOString():new Date().toISOString(),r={};try{let z=JSON.parse(e.message);if(z&&typeof z==="object"&&!Array.isArray(z))r=z}catch{}let a=Object.fromEntries(Object.entries(r).filter(([z])=>!/^(?:body|requestBody|responseBody|headers|authorization|cookie|cookies|query|queryString)$/i.test(z))),g=String(r.requestId??r.request_id??r["x-request-id"]??"")||void 0,f=String(r.traceId??r.trace_id??r["x-amzn-trace-id"]??"")||void 0,h=Number(r.durationMs??r.duration_ms??r.latencyMs??r.latency_ms),b=Number(r.statusCode??r.status_code??r.status),S=String(r.method??r.httpMethod??"")||void 0,y=ji(String(r.pathTemplate??r.path??r.url??"")||void 0),k=String(r.releaseId??r.release_id??"")||void 0,R=String(r.deploymentId??r.deployment_id??"")||void 0,D={projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,source:e.source,timestamp:t,requestId:g,traceId:f,releaseId:k,deploymentId:R,workloadId:e.workloadId},O=Object.keys(r).length?JSON.stringify(a):e.message,M=[{...D,id:Nr(e.source,e.name,t,O),kind:"log",name:e.name,level:$_(O,r.level),message:O,attributes:a}];if(S&&y&&Number.isFinite(b)){if(M.push({...D,id:Nr("request",g,t,S,y,b),kind:"request",name:"http.request",method:S,pathTemplate:y,host:r.host,statusCode:b,durationMs:Number.isFinite(h)?h:void 0,bytesIn:Number(r.bytesIn)||void 0,bytesOut:Number(r.bytesOut)||void 0,region:r.region,cacheResult:r.cacheResult??r.cache,upstream:r.upstream,attributes:{userAgentFamily:r.userAgentFamily??"",protocol:r.protocol??""}}),Number.isFinite(h))M.push({...D,id:Nr("request-duration",g,t),kind:"metric",name:"request.duration",value:h,unit:"ms",attributes:{method:S,pathTemplate:y,statusCode:b}});if(M.push({...D,id:Nr("request-count",g,t),kind:"metric",name:"request.count",value:1,unit:"count",attributes:{method:S,pathTemplate:y,statusCode:b}}),b>=500)M.push({...D,id:Nr("request-error",g,t),kind:"metric",name:"request.error",value:1,unit:"count",attributes:{method:S,pathTemplate:y,statusCode:b}})}return M}async function N_(e){let t=new Pt(e.controlPlane),r=dr(e.controlPlane,e.projectId),a=new Date,g=[],f=[],h={projectId:e.projectId,environmentId:e.environmentId},b=K(e.config);try{let D=(b==="serverless"?await xn(e.config,e.environment):await Hd(e.config,e.environment,{includeSiteHealth:e.includeSiteHealth,telemetryOnly:e.lightweight}))??{};if(b==="serverless"){for(let M of D.functionsDetail??[]){let z=wc(e.controlPlane,e.projectId,e.environmentId,M.key),J={...h,resourceId:z,source:"cloudwatch",timestamp:a.toISOString(),workloadId:M.name,attributes:{provider:"aws",functionName:M.name,aggregationWindow:"24h"}};for(let[Z,oe,G]of[["snapshot.traffic.requests_24h",M.invocations,"count"],["snapshot.errors.count_24h",M.errors,"count"],["snapshot.latency.p50_24h",M.p50,"ms"],["snapshot.latency.p95_24h",M.p95,"ms"],["snapshot.latency.p99_24h",M.p99,"ms"],["snapshot.saturation.throttles_24h",M.throttles,"count"],["snapshot.memory.max_24h",M.maxMem,"MB"]])if(Number.isFinite(Number(oe)))g.push({...J,id:Nr("cloudwatch",M.name,Z,a.toISOString()),kind:"metric",name:Z,value:Number(oe),unit:G})}try{let M=await hr(e.config,e.environment),z=new fe(M.region),J=new Date(a.getTime()-3600000),Z=300;for(let oe of M.functions){let G=[{Name:"FunctionName",Value:oe.name}],[te,ye,Se,ie,xe]=await Promise.all([z.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:G,StartTime:J,EndTime:a,Period:300,Statistics:["Sum"]}),z.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Errors",Dimensions:G,StartTime:J,EndTime:a,Period:300,Statistics:["Sum"]}),z.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:G,StartTime:J,EndTime:a,Period:300,ExtendedStatistics:["p50","p95","p99"]}),z.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Throttles",Dimensions:G,StartTime:J,EndTime:a,Period:300,Statistics:["Sum"]}),z.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"ConcurrentExecutions",Dimensions:G,StartTime:J,EndTime:a,Period:300,Statistics:["Maximum"]})]),ee=wc(e.controlPlane,e.projectId,e.environmentId,oe.mode),De=(Je,gt,jt,Ze)=>{for(let wt of Je){let Bt=wt.Timestamp&&Number.isFinite(new Date(wt.Timestamp).getTime())?new Date(wt.Timestamp).toISOString():void 0,nt=jt(wt);if(Bt&&nt!=null&&Number.isFinite(nt))g.push({...h,resourceId:ee,id:Nr("cloudwatch-series",oe.name,gt,Bt),kind:"metric",source:"cloudwatch",name:gt,timestamp:Bt,value:nt,unit:Ze,workloadId:oe.name,region:M.region,attributes:{provider:"aws",functionName:oe.name,aggregationWindow:"300s"}})}};De(te,"traffic.requests",(Je)=>Je.Sum,"count"),De(ye,"errors.count",(Je)=>Je.Sum,"count"),De(Se,"latency.p50",(Je)=>Je.Percentiles?.p50,"ms"),De(Se,"latency.p95",(Je)=>Je.Percentiles?.p95,"ms"),De(Se,"latency.p99",(Je)=>Je.Percentiles?.p99,"ms"),De(ie,"saturation.throttles",(Je)=>Je.Sum,"count"),De(xe,"saturation.concurrency",(Je)=>Je.Maximum,"count")}}catch(M){f.push({source:"cloudwatch:series",message:M instanceof Error?M.message:String(M)})}for(let M of(D.serverlessLogs??[]).slice(0,x_))g.push(...CS({...h,source:`cloudwatch:${M.source}`,name:`${M.source}.log`,timestamp:M.timestamp,message:String(M.message),resourceId:wc(e.controlPlane,e.projectId,e.environmentId,M.source)}));for(let M of D.queuesDetail??[]){let z={...h,source:"cloudwatch",timestamp:a.toISOString(),attributes:{queue:M.name}};g.push({...z,id:Nr("queue-depth",M.name,a.toISOString()),kind:"metric",name:"queue.depth",value:Number(M.visible??M.depth??0),unit:"count"}),g.push({...z,id:Nr("queue-inflight",M.name,a.toISOString()),kind:"metric",name:"queue.inflight",value:Number(M.inFlight??0),unit:"count"})}let O=await pl(e.config,e.environment,30);if(!O.ok)f.push({source:"xray",message:O.error??"X-Ray traces are unavailable."});for(let M of O.traces)g.push({...h,id:Nr("xray",M.id),kind:"trace",source:"xray",name:"http.trace",timestamp:M.timestamp??a.toISOString(),traceId:M.id,durationMs:M.durationMs,statusCode:M.httpStatus,method:M.method,pathTemplate:M.url,attributes:{status:M.status,responseMs:M.responseMs}})}else{let O=D.systemMetrics;if(D.metricsUnavailable||!O)f.push({source:"host",message:"The host metrics probe is unavailable."});else{let M=Number(O.memTotalMb)>0?Number(O.memUsedMb)/Number(O.memTotalMb)*100:0,z=Number(O.swapTotalMb)>0?Number(O.swapUsedMb)/Number(O.swapTotalMb)*100:0,J=[["host.load",Number(O.load),"load"],["host.load.5m",Number(O.load5),"load"],["host.load.15m",Number(O.load15),"load"],["host.cpu.capacity",Number(O.cpus),"count"],["host.cpu.used_percent",Number(O.cpuUsedPct),"percent"],["host.memory.used",Number(O.memUsedMb)*1024*1024,"bytes"],["host.memory.total",Number(O.memTotalMb)*1024*1024,"bytes"],["host.memory.available",Number(O.memAvailableMb)*1024*1024,"bytes"],["host.memory.cache",Number(O.memCacheMb)*1024*1024,"bytes"],["host.memory.used_percent",M,"percent"],["host.swap.used",Number(O.swapUsedMb)*1024*1024,"bytes"],["host.swap.total",Number(O.swapTotalMb)*1024*1024,"bytes"],["host.swap.used_percent",z,"percent"],["host.disk.used_percent",Number(O.diskUsedPct),"percent"],["host.disk.used",Number(O.diskUsedGb)*1073741824,"bytes"],["host.disk.total",Number(O.diskTotalGb)*1073741824,"bytes"],["host.disk.inode_used_percent",Number(O.inodeUsedPct),"percent"],["host.network.rx",Number(O.networkRxBytes),"bytes"],["host.network.tx",Number(O.networkTxBytes),"bytes"],["host.network.rx_rate",Number(O.networkRxBytesPerSec),"bytes_per_second"],["host.network.tx_rate",Number(O.networkTxBytesPerSec),"bytes_per_second"],["host.network.rx_today",Number(O.networkRxBytesToday),"bytes"],["host.network.tx_today",Number(O.networkTxBytesToday),"bytes"],["host.network.rx_month",Number(O.networkRxBytesMonth),"bytes"],["host.network.tx_month",Number(O.networkTxBytesMonth),"bytes"],["host.processes",Number(O.processes),"count"],["host.uptime",Number(O.uptimeSeconds),"seconds"]];for(let[Z,oe,G]of J)if(Number.isFinite(oe))g.push({...h,id:Nr("host",Z,a.toISOString()),kind:"metric",source:"host",name:Z,timestamp:a.toISOString(),value:oe,unit:G});for(let Z of O.disks??[]){if(Z.usedPercent===null||!Number.isFinite(Number(Z.usedPercent)))continue;g.push({...h,id:Nr("host",`disk:${Z.path}`,a.toISOString()),kind:"metric",source:"host",name:"host.filesystem.used_percent",timestamp:a.toISOString(),value:Number(Z.usedPercent),unit:"percent",attributes:{path:String(Z.path),mounted:Z.mounted!==!1}})}for(let Z of D.siteHealth??[]){let oe=String(Z.project??e.config.project.slug),G=String(Z.name),te=G.startsWith(`${oe}:`)?G.slice(oe.length+1):G,ye=`site:${oe}:${te}`,Se=wc(e.controlPlane,e.projectId,e.environmentId,G),ie={...h,resourceId:Se,source:ye,timestamp:Z.checkedAt||a.toISOString(),host:Z.route,attributes:{project:oe,site:te,route:String(Z.route),status:String(Z.status)}},xe=[["site.health.up",Z.status==="live"?1:0,"boolean"],["site.http.status",Number(Z.httpStatus),"status"],["site.response.time",Number(Z.responseMs),"ms"]];if(Z.tlsDaysRemaining!=null)xe.push(["site.tls.days_remaining",Number(Z.tlsDaysRemaining),"days"]);for(let[ee,De,Je]of xe)if(Number.isFinite(De))g.push({...ie,id:Nr(ye,ee,ie.timestamp),kind:"metric",name:ee,value:De,unit:Je})}}}}catch(D){f.push({source:b==="serverless"?"aws":"host",message:D instanceof Error?D.message:String(D)})}{let D=e.config.infrastructure?.compute?.monitoring,O=typeof D==="object"?D?.egressEndpoints:void 0,M=await Za(O,{now:a.toISOString()});f.push(...M.errors);for(let z of M.metrics)g.push({...h,id:Nr(z.attributes.source,z.name,z.timestamp),kind:"metric",source:`egress:${z.attributes.source}`,name:z.name,timestamp:z.timestamp,value:z.value,unit:z.unit,attributes:z.attributes})}if(!e.lightweight)try{let D=await pe(e.config,e.environment),O=new ve(e.config,e.environment,{inventory:async()=>D});for(let M of D.workloads){let z=wc(e.controlPlane,e.projectId,e.environmentId,M.links.service),J={...h,resourceId:z,source:`runtime:${M.provider}`,timestamp:a.toISOString(),workloadId:M.id,releaseId:M.links.release,attributes:{status:M.status,provider:M.provider,service:M.links.service??""}};if(g.push({...J,id:Nr(M.id,"health",a.toISOString()),kind:"metric",name:"health.up",value:M.status==="running"?1:0,unit:"boolean"}),g.push({...J,id:Nr(M.id,"restarts",a.toISOString()),kind:"metric",name:"saturation.restarts",value:M.restartCount??0,unit:"count"}),M.resources?.memoryBytes!=null)g.push({...J,id:Nr(M.id,"memory",a.toISOString()),kind:"metric",name:"runtime.memory.used",value:M.resources.memoryBytes,unit:"bytes"});if(!M.capabilities.logs.supported)continue;try{let Z=await O.logs(M.id,{limit:100,since:new Date(a.getTime()-300000)});for(let oe of Z.lines)g.push(...CS({...h,resourceId:z,source:`runtime:${M.provider}`,name:`${M.links.service??M.name}.log`,timestamp:oe.timestamp,message:oe.message,workloadId:M.id}))}catch(Z){f.push({source:`runtime:${M.provider}`,message:Z instanceof Error?Z.message:String(Z)})}}for(let M of D.sources.filter((z)=>z.status!=="fresh"))f.push({source:M.id,message:M.message??`Runtime source is ${M.status}.`})}catch(D){f.push({source:"runtime",message:D instanceof Error?D.message:String(D)})}if(!e.lightweight)for(let D of e.controlPlane.listEvents({projectId:e.projectId,limit:1000})){let O=D.payload;g.push({...h,id:`telemetry:event:${D.id}`,resourceId:D.resourceId,kind:"event",source:"control-plane",name:D.type,timestamp:D.createdAt,level:D.level,message:D.type,deploymentId:D.operationId,releaseId:typeof O.releaseId==="string"?O.releaseId:void 0,traceId:D.correlationId,attributes:O})}let S=g.filter((D)=>O_(D,r)).map((D)=>({...D,sampled:r.samplingRate<1&&(D.kind==="log"||D.kind==="trace"||D.kind==="request"||D.name.startsWith("request."))})),y=t.appendMany(S).length;if(T_.shouldRun(e.projectId,D_,!e.lightweight))t.enforceRetention(r,e.projectId);let k=t.status(e.projectId,e.environmentId,r.rawDays,r.samplingRate);for(let D of f)if(!k.some((O)=>O.source===D.source))k.push({source:D.source,freshness:"unavailable",samplingRate:r.samplingRate,retentionDays:r.rawDays,estimatedDailyBytes:0,message:D.message});let R=a.toISOString();return e.controlPlane.setSetting(`telemetry.collection:${e.projectId}:${e.environmentId??"all"}`,{generatedAt:R,errors:f,statuses:k,policy:r}),{collected:y,cached:!1,generatedAt:R,statuses:k,errors:f,policy:r}}async function Sm(e){let r=`${`${e.projectId}:${e.environmentId??"all"}:${e.environment}`}:${e.lightweight?"lightweight":"full"}`,a=K(e.config)==="serverless"?300000:60000,g=await xS.getOrCreate(r,a,!!e.force,()=>N_(e));return{...g.value,cached:g.cached}}function DS(e){xS.invalidate(`${e}:`)}function OS(e,t={}){let r=t.shell||(process.platform==="win32"?"powershell.exe":"bash"),a=Bun.spawn([r,"-i"],{stdin:"pipe",stdout:"pipe",stderr:"pipe",cwd:t.cwd,env:{...process.env,TERM:"xterm-256color",PS1:"\\w $ "}}),g=new TextDecoder,f=async(h)=>{if(!h)return;let b=h.getReader();try{for(;;){let{done:S,value:y}=await b.read();if(S)break;if(y)e(g.decode(y))}}catch{}};if(f(a.stdout),f(a.stderr),t.onExit)a.exited.then((h)=>t.onExit(h)).catch(()=>{});return{write(h){try{a.stdin.write(h),a.stdin.flush()}catch{}},close(){try{a.stdin.end()}catch{}try{a.kill()}catch{}}}}var q_="127.0.0.1",V_=7676,BS=65536,dw="ts-cloud-dashboard-",Fs=B_(U_(import.meta.url));function W_(e){try{return process.kill(e,0),!0}catch(t){return t?.code!=="ESRCH"}}function H_(e=vl(),t=W_){let r=0;for(let a of NS(e,{withFileTypes:!0})){if(!a.isDirectory()||!a.name.startsWith(dw))continue;let g=xt(e,a.name),f=a.name.match(/^ts-cloud-dashboard-(\d+)-/);if(f){let h=Number(f[1]);if(h===process.pid||t(h))continue}else if(NS(g).length>0)continue;Ao(g,{recursive:!0,force:!0}),r+=1}return r}var K_={".html":"text/html; charset=utf-8",".css":"text/css; charset=utf-8",".js":"text/javascript; charset=utf-8",".json":"application/json; charset=utf-8",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".ico":"image/x-icon"};function C(e,t=200,r={}){return new Response(JSON.stringify(e,null,2),{status:t,headers:{"content-type":"application/json; charset=utf-8",...r}})}function J_(e,t,r,a){let g=new TextEncoder,f=Math.max(0,Math.floor(r)),h,b,S=!1,y=new ReadableStream({start(k){let R=()=>{if(S)return;if(S=!0,h?.(),b)clearInterval(b);a.removeEventListener("abort",R);try{k.close()}catch{}},D=(M)=>{if(S)return;if(M.reset)k.enqueue(g.encode(`event: reset
+[output truncated]`}function fm(e,t){return e.environments?.[t]?.app}function hm(e,t,r){let a=[],g=fm(e,t);a.push({id:"redeploy",label:"Redeploy current build",group:"deploy",target:"app",mutates:!0,confirm:"redeploy"}),a.push({id:"rollback",label:"Roll back to previous build",group:"deploy",target:"app",mutates:!0,confirm:"rollback",danger:!0});let f=r.maintenance?.enabled;if(f!==!0)a.push({id:"maintenance:on",label:"Enable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"maintenance",danger:!0});if(f!==!1)a.push({id:"maintenance:off",label:"Disable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"live"});if(g?.assets||r.assetsInfo)a.push({id:"assets:invalidate",label:"Invalidate CDN cache",group:"assets",target:"assets",mutates:!0,confirm:"invalidate"});if(g?.database?.connection==="aurora-serverless")a.push({id:"db:scale",label:"Scale Aurora capacity",group:"database",target:"database",mutates:!0,confirm:"scale",inputs:[{name:"min",label:"Min ACUs",placeholder:String(g.database.minCapacity??0.5)},{name:"max",label:"Max ACUs",placeholder:String(g.database.maxCapacity??4)}]});for(let h of r.queues??[]){let b=String(h?.name??"").trim();if(b&&/^[A-Za-z0-9_-]+$/.test(b))a.push({id:`queue:purge:${b}`,label:`Purge queue (${b})`,group:"queue",target:b,mutates:!0,confirm:b,danger:!0})}return a}function gS(e,t,r,a){return hm(t,r,a).find((g)=>g.id===e)}async function A_(e,t,r){try{let a=new A(r),{Stacks:g}=await a.describeStacks({stackName:lr(e,t)}),f={};for(let S of g?.[0]?.Outputs??[])if(S.OutputKey)f[S.OutputKey]=S.OutputValue??"";let h=f.AssetsCdnDomain;if(!h)return null;return(await new I(r).findDistributionByDomain(h))?.Id??null}catch{return null}}async function mS(e,t,r,a={}){try{if(r.id==="redeploy")return await Nn(e,t),{operation:r.id,command:"serverless redeploy",ok:!0,stdout:"Redeploy complete."};if(r.id==="rollback")return await Bn(e,t),{operation:r.id,command:"serverless rollback",ok:!0,stdout:"Rollback complete."};if(r.id==="maintenance:on")return await Er(e,t,!0),{operation:r.id,command:"maintenance on",ok:!0,stdout:"Application is now in maintenance mode."};if(r.id==="maintenance:off")return await Er(e,t,!1),{operation:r.id,command:"maintenance off",ok:!0,stdout:"Application is live."};if(r.id==="db:scale"){let g=Number(a.min),f=Number(a.max);if(!Number.isFinite(g)||!Number.isFinite(f)||g<=0||f<g)return{operation:r.id,ok:!1,error:"Provide valid Aurora capacities (0 < min ≤ max)."};return await Nv(e,t,g,f),{operation:r.id,command:`db:scale ${g}-${f} ACU`,ok:!0,stdout:`Scaling applied (${g}-${f} ACUs); takes effect shortly.`}}if(r.id==="assets:invalidate"){let g=await hr(e,t),f=await A_(e,t,g.region);if(!f)return{operation:r.id,ok:!1,error:"Could not resolve the asset CloudFront distribution for this environment."};let b=await new I(g.region).invalidateAll(f);return{operation:r.id,command:`cloudfront invalidate ${f} /*`,ok:!0,stdout:`Invalidation ${b?.Id??"created"} for ${f} (/*).`}}if(r.group==="queue"&&r.id.startsWith("queue:purge:")){let g=r.target,f=await hr(e,t),h=new fe(f.region),b=`${f.slug}-${t}-${g}`,{QueueUrl:S}=await h.getQueueUrl(b);return await h.purgeQueue(S),{operation:r.id,command:`sqs purge ${b}`,ok:!0,stdout:`Purged queue ${b}.`}}return{operation:r.id,ok:!1,error:"Unknown or unavailable serverless operation."}}catch(g){return{operation:r.id,ok:!1,error:zr(g?.message??String(g))}}}async function fS(e,t,r){let a=r.trim();if(!a)return{operation:"command",ok:!1,error:"A command is required."};try{let g=await lt(e,t,a);return{operation:"command",command:a,ok:!0,stdout:zr(g||"(no output)")}}catch(g){return{operation:"command",command:a,ok:!1,error:zr(g?.message??String(g))}}}var ym="No dead-letter queue is provisioned for this environment.";async function vm(e,t,r){try{let{QueueUrl:a}=await e.getQueueUrl(`${t}-${r}-dlq`);return a}catch{return null}}async function hS(e,t,r=10){try{let a=await hr(e,t),g=new fe(a.region),f=await vm(g,a.slug,t);if(!f)return{ok:!1,messages:[],error:ym};return{ok:!0,messages:((await g.receiveMessages({queueUrl:f,maxMessages:Math.min(10,Math.max(1,r)),waitTimeSeconds:1,visibilityTimeout:2})).Messages??[]).map((S)=>({id:S.MessageId,receiptHandle:S.ReceiptHandle,body:zr(String(S.Body??""))}))}}catch(a){return{ok:!1,messages:[],error:zr(a?.message??String(a))}}}async function yS(e,t,r={}){try{let a=await hr(e,t),g=fm(e,t),h=(g?Ar(g,a.slug,t):[]).map((O)=>O.name.replace(`${a.slug}-${t}-`,"")),b=r.targetQueue&&h.includes(r.targetQueue)?r.targetQueue:h[0];if(!b)return{operation:"dlq:redrive",ok:!1,error:"No source queue is configured to redrive into."};let S=new fe(a.region),y=await vm(S,a.slug,t);if(!y)return{operation:"dlq:redrive",ok:!1,error:ym};let{QueueUrl:k}=await S.getQueueUrl(`${a.slug}-${t}-${b}`),R=Math.min(50,Math.max(1,r.max??10)),D=0;while(D<R){let M=(await S.receiveMessages({queueUrl:y,maxMessages:Math.min(10,R-D),waitTimeSeconds:1,visibilityTimeout:30})).Messages??[];if(!M.length)break;for(let z of M)await S.sendMessage({queueUrl:k,messageBody:String(z.Body??"")}),await S.deleteMessage(y,z.ReceiptHandle),D++}return{operation:"dlq:redrive",command:`redrive → ${b}`,ok:!0,stdout:`Moved ${D} message(s) from the DLQ to ${b}.`}}catch(a){return{operation:"dlq:redrive",ok:!1,error:zr(a?.message??String(a))}}}async function vS(e,t){try{let r=await hr(e,t),a=new fe(r.region),g=await vm(a,r.slug,t);if(!g)return{operation:"dlq:purge",ok:!1,error:ym};return await a.purgeQueue(g),{operation:"dlq:purge",command:"sqs purge dlq",ok:!0,stdout:"Dead-letter queue purged."}}catch(r){return{operation:"dlq:purge",ok:!1,error:zr(r?.message??String(r))}}}function bS(e,t){let r=fm(e,t);if(!r?.secrets)return[];return Array.isArray(r.secrets)?r.secrets.map((a)=>({key:a.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:a})):Object.entries(r.secrets).map(([a,g])=>({key:a,secretId:String(g)}))}async function SS(e,t,r,a){if(!r.trim())return{operation:"secret:set",ok:!1,error:"A secret id is required."};try{let g=await hr(e,t),f=new re(g.region);try{await f.putSecretValue({SecretId:r,SecretString:a})}catch{await f.createSecret({Name:r,SecretString:a})}return{operation:"secret:set",command:`secret set ${r}`,ok:!0,stdout:`Secret ${r} updated. Redeploy to apply it to the functions.`}}catch(g){return{operation:"secret:set",ok:!1,error:zr(g?.message??String(g))}}}async function wS(e,t,r){if(!r.trim())return{operation:"secret:delete",ok:!1,error:"A secret id is required."};try{let a=await hr(e,t);return await new re(a.region).deleteSecret({SecretId:r,RecoveryWindowInDays:7}),{operation:"secret:delete",command:`secret delete ${r}`,ok:!0,stdout:`Secret ${r} scheduled for deletion (recoverable for 7 days).`}}catch(a){return{operation:"secret:delete",ok:!1,error:zr(a?.message??String(a))}}}var C_=new Set(["http","queue","cli"]);async function kS(e,t,r,a){if(!C_.has(r))return{operation:"function:config",ok:!1,error:`Unknown function mode '${r}'.`};let g=a.memory==null?void 0:Number(a.memory),f=a.timeout==null?void 0:Number(a.timeout);if(g!=null&&(!Number.isInteger(g)||g<128||g>10240))return{operation:"function:config",ok:!1,error:"Memory must be an integer between 128 and 10240 MB."};if(f!=null&&(!Number.isInteger(f)||f<1||f>900))return{operation:"function:config",ok:!1,error:"Timeout must be an integer between 1 and 900 seconds."};if(g==null&&f==null)return{operation:"function:config",ok:!1,error:"Provide a memory and/or timeout value."};try{let h=await hr(e,t),b=new T(h.region),S=`${h.slug}-${t}-${r}`;await b.updateFunctionConfiguration({FunctionName:S,...g!=null?{MemorySize:g}:{},...f!=null?{Timeout:f}:{}});let y=[g!=null?`${g} MB`:"",f!=null?`${f}s`:""].filter(Boolean).join(", ");return{operation:"function:config",command:`update ${S} (${y})`,ok:!0,stdout:`Updated ${S}: ${y}.`}}catch(h){return{operation:"function:config",ok:!1,error:zr(h?.message??String(h))}}}var mm=[{key:"http-errors",label:"HTTP function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"errors / 5 min"},{key:"http-throttles",label:"HTTP function throttles",namespace:"AWS/Lambda",metricName:"Throttles",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"throttles / 5 min"},{key:"http-duration",label:"HTTP function duration (avg)",namespace:"AWS/Lambda",metricName:"Duration",statistic:"Average",comparison:"GreaterThanThreshold",fnMode:"http",unit:"ms"},{key:"http-concurrency",label:"HTTP concurrent executions",namespace:"AWS/Lambda",metricName:"ConcurrentExecutions",statistic:"Maximum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"concurrent"},{key:"queue-errors",label:"Queue function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"queue",unit:"errors / 5 min"}];function P_(e){return mm.find((t)=>t.key===e)}async function IS(e,t){try{let r=await hr(e,t);return{ok:!0,alarms:await new he(r.region).describeAlarms({AlarmNamePrefix:`${r.slug}-${t}-`,MaxRecords:100}),presets:mm}}catch(r){return{ok:!1,alarms:[],presets:mm,error:zr(r?.message??String(r))}}}async function ES(e,t,r,a){let g=P_(r);if(!g)return{operation:"alarm:create",ok:!1,error:`Unknown alarm metric '${r}'.`};if(!Number.isFinite(a)||a<0)return{operation:"alarm:create",ok:!1,error:"Provide a non-negative threshold."};try{let f=await hr(e,t),h=new he(f.region),b=`${f.slug}-${t}-${g.key}`,S=g.fnMode?[{Name:"FunctionName",Value:`${f.slug}-${t}-${g.fnMode}`}]:[];return await h.putMetricAlarm({AlarmName:b,Namespace:g.namespace,MetricName:g.metricName,ComparisonOperator:g.comparison,Threshold:a,EvaluationPeriods:1,Period:300,Statistic:g.statistic,Dimensions:S,AlarmDescription:`ts-cloud: ${g.label} > ${a} ${g.unit}`}),{operation:"alarm:create",command:`alarm ${b}`,ok:!0,stdout:`Alarm ${b} armed at ${a} ${g.unit}.`}}catch(f){return{operation:"alarm:create",ok:!1,error:zr(f?.message??String(f))}}}async function RS(e,t,r){try{let a=await hr(e,t);if(!r.startsWith(`${a.slug}-${t}-`))return{operation:"alarm:delete",ok:!1,error:"Refusing to delete an alarm outside this environment."};return await new he(a.region).deleteAlarms([r]),{operation:"alarm:delete",command:`delete alarm ${r}`,ok:!0,stdout:`Alarm ${r} deleted.`}}catch(a){return{operation:"alarm:delete",ok:!1,error:zr(a?.message??String(a))}}}function __(e){let t=e.HasFault?"fault":e.HasError?"error":e.HasThrottle?"throttle":"ok";return{id:String(e.Id??""),timestamp:Number.isFinite(Number(e.StartTime))?new Date(Number(e.StartTime)*1000).toISOString():void 0,durationMs:Math.round((e.Duration??0)*1000),responseMs:Math.round((e.ResponseTime??0)*1000),status:t,method:e.Http?.HttpMethod??"-",url:e.Http?.HttpURL??"-",httpStatus:e.Http?.HttpStatus??0}}async function pl(e,t,r=30){try{let a=await hr(e,t),g=new gm(a.region),f=new Date,h=new Date(f.getTime()-Math.min(360,Math.max(1,r))*60000),b=`${a.slug}-${t}-http`,S=await g.getTraceSummaries({startTime:h,endTime:f,filterExpression:`service("${b}")`});if(!S.summaries.length)S=await g.getTraceSummaries({startTime:h,endTime:f});return{ok:!0,traces:S.summaries.slice(0,100).map(__)}}catch(a){return{ok:!1,traces:[],error:zr(a?.message??String(a))}}}async function bm(e,t,r){try{let a=await hr(e,t),g=`${a.slug}-${t}-scheduler`;if(r==="run"){let h=await lt(e,t,"schedule:run");return{operation:"scheduler:run",command:"schedule:run",ok:!0,stdout:zr(h||"Scheduler run triggered.")}}let f=new Rr(a.region);if(r==="enable")await f.enableRule({Name:g});else await f.disableRule({Name:g});return{operation:`scheduler:${r}`,command:`${r} ${g}`,ok:!0,stdout:`Scheduler rule ${g} ${r}d.`}}catch(a){return{operation:`scheduler:${r}`,ok:!1,error:zr(a?.message??String(a))}}}function AS(e,t,r){let a=(Array.isArray(r)?r:String(r??"").split(",")).map(String).filter(Boolean);if(!a.length){if(t)return;let f=e.map((h)=>h.id);return f.length?f:["__no_authorized_telemetry_resources__"]}let g=a.map((f)=>e.find((h)=>h.id===f||h.slug===f)?.id).filter((f)=>!!f);if(g.length!==a.length)throw Error("One or more telemetry resources are outside your authorized scope.");return[...new Set(g)]}import{createHash as PS}from"node:crypto";class _S{now;entries=new Map;constructor(e=Date.now){this.now=e}async getOrCreate(e,t,r,a){let g=this.entries.get(e);if(!r&&g&&g.expiresAt>this.now())return{value:await g.promise,cached:!0};let f=a().catch((h)=>{throw this.entries.delete(e),h});return this.entries.set(e,{expiresAt:this.now()+t,promise:f}),{value:await f,cached:!1}}invalidate(e){for(let t of this.entries.keys())if(t.startsWith(e))this.entries.delete(t)}}class TS{now;lastRun=new Map;constructor(e=Date.now){this.now=e}shouldRun(e,t,r=!1){let a=this.now(),g=this.lastRun.get(e);if(!r&&g!=null&&a-g<t)return!1;return this.lastRun.set(e,a),!0}}var xS=new _S,T_=new TS,x_=2000,D_=3600000;function O_(e,t){if(e.kind==="log"&&!t.collectLogs)return!1;if(e.kind==="trace"&&!t.collectTraces)return!1;if((e.kind==="request"||e.name.startsWith("request."))&&!t.collectRequestAnalytics)return!1;if(!["log","trace","request"].includes(e.kind)&&!e.name.startsWith("request."))return!0;let r=e.requestId??e.traceId??`${e.source}\x00${e.workloadId??""}\x00${e.timestamp}`;return Number.parseInt(PS("sha256").update(r).digest("hex").slice(0,8),16)/4294967295<=t.samplingRate}function Nr(...e){return`telemetry:${PS("sha256").update(e.map((t)=>String(t??"")).join("\x00")).digest("hex").slice(0,40)}`}function wc(e,t,r,a){if(!a)return;return e.listResources(t,r).find((g)=>g.slug===a)?.id}function $_(e,t){let r=String(t??"").toLowerCase();if(["debug","info","warn","warning","error","fatal"].includes(r))return r==="fatal"?"error":r;return/fatal|panic|exception|error/i.test(e)?"error":/warn|timeout|throttl|retr(?:y|ies)/i.test(e)?"warning":"info"}function CS(e){let t=e.timestamp&&Number.isFinite(new Date(e.timestamp).getTime())?new Date(e.timestamp).toISOString():new Date().toISOString(),r={};try{let z=JSON.parse(e.message);if(z&&typeof z==="object"&&!Array.isArray(z))r=z}catch{}let a=Object.fromEntries(Object.entries(r).filter(([z])=>!/^(?:body|requestBody|responseBody|headers|authorization|cookie|cookies|query|queryString)$/i.test(z))),g=String(r.requestId??r.request_id??r["x-request-id"]??"")||void 0,f=String(r.traceId??r.trace_id??r["x-amzn-trace-id"]??"")||void 0,h=Number(r.durationMs??r.duration_ms??r.latencyMs??r.latency_ms),b=Number(r.statusCode??r.status_code??r.status),S=String(r.method??r.httpMethod??"")||void 0,y=ji(String(r.pathTemplate??r.path??r.url??"")||void 0),k=String(r.releaseId??r.release_id??"")||void 0,R=String(r.deploymentId??r.deployment_id??"")||void 0,D={projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,source:e.source,timestamp:t,requestId:g,traceId:f,releaseId:k,deploymentId:R,workloadId:e.workloadId},O=Object.keys(r).length?JSON.stringify(a):e.message,M=[{...D,id:Nr(e.source,e.name,t,O),kind:"log",name:e.name,level:$_(O,r.level),message:O,attributes:a}];if(S&&y&&Number.isFinite(b)){if(M.push({...D,id:Nr("request",g,t,S,y,b),kind:"request",name:"http.request",method:S,pathTemplate:y,host:r.host,statusCode:b,durationMs:Number.isFinite(h)?h:void 0,bytesIn:Number(r.bytesIn)||void 0,bytesOut:Number(r.bytesOut)||void 0,region:r.region,cacheResult:r.cacheResult??r.cache,upstream:r.upstream,attributes:{userAgentFamily:r.userAgentFamily??"",protocol:r.protocol??""}}),Number.isFinite(h))M.push({...D,id:Nr("request-duration",g,t),kind:"metric",name:"request.duration",value:h,unit:"ms",attributes:{method:S,pathTemplate:y,statusCode:b}});if(M.push({...D,id:Nr("request-count",g,t),kind:"metric",name:"request.count",value:1,unit:"count",attributes:{method:S,pathTemplate:y,statusCode:b}}),b>=500)M.push({...D,id:Nr("request-error",g,t),kind:"metric",name:"request.error",value:1,unit:"count",attributes:{method:S,pathTemplate:y,statusCode:b}})}return M}async function N_(e){let t=new Pt(e.controlPlane),r=dr(e.controlPlane,e.projectId),a=new Date,g=[],f=[],h={projectId:e.projectId,environmentId:e.environmentId},b=K(e.config);try{let D=(b==="serverless"?await xn(e.config,e.environment):await Hd(e.config,e.environment,{includeSiteHealth:e.includeSiteHealth,telemetryOnly:e.lightweight}))??{};if(b==="serverless"){for(let M of D.functionsDetail??[]){let z=wc(e.controlPlane,e.projectId,e.environmentId,M.key),J={...h,resourceId:z,source:"cloudwatch",timestamp:a.toISOString(),workloadId:M.name,attributes:{provider:"aws",functionName:M.name,aggregationWindow:"24h"}};for(let[Z,oe,G]of[["snapshot.traffic.requests_24h",M.invocations,"count"],["snapshot.errors.count_24h",M.errors,"count"],["snapshot.latency.p50_24h",M.p50,"ms"],["snapshot.latency.p95_24h",M.p95,"ms"],["snapshot.latency.p99_24h",M.p99,"ms"],["snapshot.saturation.throttles_24h",M.throttles,"count"],["snapshot.memory.max_24h",M.maxMem,"MB"]])if(Number.isFinite(Number(oe)))g.push({...J,id:Nr("cloudwatch",M.name,Z,a.toISOString()),kind:"metric",name:Z,value:Number(oe),unit:G})}try{let M=await hr(e.config,e.environment),z=new he(M.region),J=new Date(a.getTime()-3600000),Z=300;for(let oe of M.functions){let G=[{Name:"FunctionName",Value:oe.name}],[te,ye,be,ie,_e]=await Promise.all([z.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:G,StartTime:J,EndTime:a,Period:300,Statistics:["Sum"]}),z.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Errors",Dimensions:G,StartTime:J,EndTime:a,Period:300,Statistics:["Sum"]}),z.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:G,StartTime:J,EndTime:a,Period:300,ExtendedStatistics:["p50","p95","p99"]}),z.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Throttles",Dimensions:G,StartTime:J,EndTime:a,Period:300,Statistics:["Sum"]}),z.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"ConcurrentExecutions",Dimensions:G,StartTime:J,EndTime:a,Period:300,Statistics:["Maximum"]})]),ee=wc(e.controlPlane,e.projectId,e.environmentId,oe.mode),xe=(Je,gt,jt,Ze)=>{for(let wt of Je){let Bt=wt.Timestamp&&Number.isFinite(new Date(wt.Timestamp).getTime())?new Date(wt.Timestamp).toISOString():void 0,nt=jt(wt);if(Bt&&nt!=null&&Number.isFinite(nt))g.push({...h,resourceId:ee,id:Nr("cloudwatch-series",oe.name,gt,Bt),kind:"metric",source:"cloudwatch",name:gt,timestamp:Bt,value:nt,unit:Ze,workloadId:oe.name,region:M.region,attributes:{provider:"aws",functionName:oe.name,aggregationWindow:"300s"}})}};xe(te,"traffic.requests",(Je)=>Je.Sum,"count"),xe(ye,"errors.count",(Je)=>Je.Sum,"count"),xe(be,"latency.p50",(Je)=>Je.Percentiles?.p50,"ms"),xe(be,"latency.p95",(Je)=>Je.Percentiles?.p95,"ms"),xe(be,"latency.p99",(Je)=>Je.Percentiles?.p99,"ms"),xe(ie,"saturation.throttles",(Je)=>Je.Sum,"count"),xe(_e,"saturation.concurrency",(Je)=>Je.Maximum,"count")}}catch(M){f.push({source:"cloudwatch:series",message:M instanceof Error?M.message:String(M)})}for(let M of(D.serverlessLogs??[]).slice(0,x_))g.push(...CS({...h,source:`cloudwatch:${M.source}`,name:`${M.source}.log`,timestamp:M.timestamp,message:String(M.message),resourceId:wc(e.controlPlane,e.projectId,e.environmentId,M.source)}));for(let M of D.queuesDetail??[]){let z={...h,source:"cloudwatch",timestamp:a.toISOString(),attributes:{queue:M.name}};g.push({...z,id:Nr("queue-depth",M.name,a.toISOString()),kind:"metric",name:"queue.depth",value:Number(M.visible??M.depth??0),unit:"count"}),g.push({...z,id:Nr("queue-inflight",M.name,a.toISOString()),kind:"metric",name:"queue.inflight",value:Number(M.inFlight??0),unit:"count"})}let O=await pl(e.config,e.environment,30);if(!O.ok)f.push({source:"xray",message:O.error??"X-Ray traces are unavailable."});for(let M of O.traces)g.push({...h,id:Nr("xray",M.id),kind:"trace",source:"xray",name:"http.trace",timestamp:M.timestamp??a.toISOString(),traceId:M.id,durationMs:M.durationMs,statusCode:M.httpStatus,method:M.method,pathTemplate:M.url,attributes:{status:M.status,responseMs:M.responseMs}})}else{let O=D.systemMetrics;if(D.metricsUnavailable||!O)f.push({source:"host",message:"The host metrics probe is unavailable."});else{let M=Number(O.memTotalMb)>0?Number(O.memUsedMb)/Number(O.memTotalMb)*100:0,z=Number(O.swapTotalMb)>0?Number(O.swapUsedMb)/Number(O.swapTotalMb)*100:0,J=[["host.load",Number(O.load),"load"],["host.load.5m",Number(O.load5),"load"],["host.load.15m",Number(O.load15),"load"],["host.cpu.capacity",Number(O.cpus),"count"],["host.cpu.used_percent",Number(O.cpuUsedPct),"percent"],["host.memory.used",Number(O.memUsedMb)*1024*1024,"bytes"],["host.memory.total",Number(O.memTotalMb)*1024*1024,"bytes"],["host.memory.available",Number(O.memAvailableMb)*1024*1024,"bytes"],["host.memory.cache",Number(O.memCacheMb)*1024*1024,"bytes"],["host.memory.used_percent",M,"percent"],["host.swap.used",Number(O.swapUsedMb)*1024*1024,"bytes"],["host.swap.total",Number(O.swapTotalMb)*1024*1024,"bytes"],["host.swap.used_percent",z,"percent"],["host.disk.used_percent",Number(O.diskUsedPct),"percent"],["host.disk.used",Number(O.diskUsedGb)*1073741824,"bytes"],["host.disk.total",Number(O.diskTotalGb)*1073741824,"bytes"],["host.disk.inode_used_percent",Number(O.inodeUsedPct),"percent"],["host.network.rx",Number(O.networkRxBytes),"bytes"],["host.network.tx",Number(O.networkTxBytes),"bytes"],["host.network.rx_rate",Number(O.networkRxBytesPerSec),"bytes_per_second"],["host.network.tx_rate",Number(O.networkTxBytesPerSec),"bytes_per_second"],["host.network.rx_today",Number(O.networkRxBytesToday),"bytes"],["host.network.tx_today",Number(O.networkTxBytesToday),"bytes"],["host.network.rx_month",Number(O.networkRxBytesMonth),"bytes"],["host.network.tx_month",Number(O.networkTxBytesMonth),"bytes"],["host.processes",Number(O.processes),"count"],["host.uptime",Number(O.uptimeSeconds),"seconds"]];for(let[Z,oe,G]of J)if(Number.isFinite(oe))g.push({...h,id:Nr("host",Z,a.toISOString()),kind:"metric",source:"host",name:Z,timestamp:a.toISOString(),value:oe,unit:G});for(let Z of O.disks??[]){if(Z.usedPercent===null||!Number.isFinite(Number(Z.usedPercent)))continue;g.push({...h,id:Nr("host",`disk:${Z.path}`,a.toISOString()),kind:"metric",source:"host",name:"host.filesystem.used_percent",timestamp:a.toISOString(),value:Number(Z.usedPercent),unit:"percent",attributes:{path:String(Z.path),mounted:Z.mounted!==!1}})}for(let Z of D.siteHealth??[]){let oe=String(Z.project??e.config.project.slug),G=String(Z.name),te=G.startsWith(`${oe}:`)?G.slice(oe.length+1):G,ye=`site:${oe}:${te}`,be=wc(e.controlPlane,e.projectId,e.environmentId,G),ie={...h,resourceId:be,source:ye,timestamp:Z.checkedAt||a.toISOString(),host:Z.route,attributes:{project:oe,site:te,route:String(Z.route),status:String(Z.status)}},_e=[["site.health.up",Z.status==="live"?1:0,"boolean"],["site.http.status",Number(Z.httpStatus),"status"],["site.response.time",Number(Z.responseMs),"ms"]];if(Z.tlsDaysRemaining!=null)_e.push(["site.tls.days_remaining",Number(Z.tlsDaysRemaining),"days"]);for(let[ee,xe,Je]of _e)if(Number.isFinite(xe))g.push({...ie,id:Nr(ye,ee,ie.timestamp),kind:"metric",name:ee,value:xe,unit:Je})}}}}catch(D){f.push({source:b==="serverless"?"aws":"host",message:D instanceof Error?D.message:String(D)})}{let D=e.config.infrastructure?.compute?.monitoring,O=typeof D==="object"?D?.egressEndpoints:void 0,M=await Za(O,{now:a.toISOString()});f.push(...M.errors);for(let z of M.metrics)g.push({...h,id:Nr(z.attributes.source,z.name,z.timestamp),kind:"metric",source:`egress:${z.attributes.source}`,name:z.name,timestamp:z.timestamp,value:z.value,unit:z.unit,attributes:z.attributes})}if(!e.lightweight)try{let D=await me(e.config,e.environment),O=new Te(e.config,e.environment,{inventory:async()=>D});for(let M of D.workloads){let z=wc(e.controlPlane,e.projectId,e.environmentId,M.links.service),J={...h,resourceId:z,source:`runtime:${M.provider}`,timestamp:a.toISOString(),workloadId:M.id,releaseId:M.links.release,attributes:{status:M.status,provider:M.provider,service:M.links.service??""}};if(g.push({...J,id:Nr(M.id,"health",a.toISOString()),kind:"metric",name:"health.up",value:M.status==="running"?1:0,unit:"boolean"}),g.push({...J,id:Nr(M.id,"restarts",a.toISOString()),kind:"metric",name:"saturation.restarts",value:M.restartCount??0,unit:"count"}),M.resources?.memoryBytes!=null)g.push({...J,id:Nr(M.id,"memory",a.toISOString()),kind:"metric",name:"runtime.memory.used",value:M.resources.memoryBytes,unit:"bytes"});if(!M.capabilities.logs.supported)continue;try{let Z=await O.logs(M.id,{limit:100,since:new Date(a.getTime()-300000)});for(let oe of Z.lines)g.push(...CS({...h,resourceId:z,source:`runtime:${M.provider}`,name:`${M.links.service??M.name}.log`,timestamp:oe.timestamp,message:oe.message,workloadId:M.id}))}catch(Z){f.push({source:`runtime:${M.provider}`,message:Z instanceof Error?Z.message:String(Z)})}}for(let M of D.sources.filter((z)=>z.status!=="fresh"))f.push({source:M.id,message:M.message??`Runtime source is ${M.status}.`})}catch(D){f.push({source:"runtime",message:D instanceof Error?D.message:String(D)})}if(!e.lightweight)for(let D of e.controlPlane.listEvents({projectId:e.projectId,limit:1000})){let O=D.payload;g.push({...h,id:`telemetry:event:${D.id}`,resourceId:D.resourceId,kind:"event",source:"control-plane",name:D.type,timestamp:D.createdAt,level:D.level,message:D.type,deploymentId:D.operationId,releaseId:typeof O.releaseId==="string"?O.releaseId:void 0,traceId:D.correlationId,attributes:O})}let S=g.filter((D)=>O_(D,r)).map((D)=>({...D,sampled:r.samplingRate<1&&(D.kind==="log"||D.kind==="trace"||D.kind==="request"||D.name.startsWith("request."))})),y=t.appendMany(S).length;if(T_.shouldRun(e.projectId,D_,!e.lightweight))t.enforceRetention(r,e.projectId);let k=t.status(e.projectId,e.environmentId,r.rawDays,r.samplingRate);for(let D of f)if(!k.some((O)=>O.source===D.source))k.push({source:D.source,freshness:"unavailable",samplingRate:r.samplingRate,retentionDays:r.rawDays,estimatedDailyBytes:0,message:D.message});let R=a.toISOString();return e.controlPlane.setSetting(`telemetry.collection:${e.projectId}:${e.environmentId??"all"}`,{generatedAt:R,errors:f,statuses:k,policy:r}),{collected:y,cached:!1,generatedAt:R,statuses:k,errors:f,policy:r}}async function Sm(e){let r=`${`${e.projectId}:${e.environmentId??"all"}:${e.environment}`}:${e.lightweight?"lightweight":"full"}`,a=K(e.config)==="serverless"?300000:60000,g=await xS.getOrCreate(r,a,!!e.force,()=>N_(e));return{...g.value,cached:g.cached}}function DS(e){xS.invalidate(`${e}:`)}function OS(e,t={}){let r=t.shell||(process.platform==="win32"?"powershell.exe":"bash"),a=Bun.spawn([r,"-i"],{stdin:"pipe",stdout:"pipe",stderr:"pipe",cwd:t.cwd,env:{...process.env,TERM:"xterm-256color",PS1:"\\w $ "}}),g=new TextDecoder,f=async(h)=>{if(!h)return;let b=h.getReader();try{for(;;){let{done:S,value:y}=await b.read();if(S)break;if(y)e(g.decode(y))}}catch{}};if(f(a.stdout),f(a.stderr),t.onExit)a.exited.then((h)=>t.onExit(h)).catch(()=>{});return{write(h){try{a.stdin.write(h),a.stdin.flush()}catch{}},close(){try{a.stdin.end()}catch{}try{a.kill()}catch{}}}}var q_="127.0.0.1",V_=7676,BS=65536,dw="ts-cloud-dashboard-",Fs=B_(U_(import.meta.url));function W_(e){try{return process.kill(e,0),!0}catch(t){return t?.code!=="ESRCH"}}function H_(e=vl(),t=W_){let r=0;for(let a of NS(e,{withFileTypes:!0})){if(!a.isDirectory()||!a.name.startsWith(dw))continue;let g=xt(e,a.name),f=a.name.match(/^ts-cloud-dashboard-(\d+)-/);if(f){let h=Number(f[1]);if(h===process.pid||t(h))continue}else if(NS(g).length>0)continue;Ao(g,{recursive:!0,force:!0}),r+=1}return r}var K_={".html":"text/html; charset=utf-8",".css":"text/css; charset=utf-8",".js":"text/javascript; charset=utf-8",".json":"application/json; charset=utf-8",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".ico":"image/x-icon"};function C(e,t=200,r={}){return new Response(JSON.stringify(e,null,2),{status:t,headers:{"content-type":"application/json; charset=utf-8",...r}})}function J_(e,t,r,a){let g=new TextEncoder,f=Math.max(0,Math.floor(r)),h,b,S=!1,y=new ReadableStream({start(k){let R=()=>{if(S)return;if(S=!0,h?.(),b)clearInterval(b);a.removeEventListener("abort",R);try{k.close()}catch{}},D=(M)=>{if(S)return;if(M.reset)k.enqueue(g.encode(`event: reset
 data: ${JSON.stringify({cursor:M.cursor,droppedBytes:M.droppedBytes})}
 
 `));for(let z of M.chunks.filter((J)=>J.cursor>f))f=z.cursor,k.enqueue(g.encode(`id: ${z.cursor}
@@ -673,37 +673,37 @@ data: ${JSON.stringify({cursor:f,at:new Date().toISOString()})}
 ${b}
 ${S}`);return null}return a}catch(g){if(a)Ao(a,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${g.message}`);return null}}function ws(e){let t=e.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(e.infrastructure.compute.managedServices)):void 0;if(t?.vitess?.password)t.vitess.password="";return{project:{name:e.project?.name,slug:e.project?.slug,region:e.project?.region},provider:e.provider,environments:Object.keys(e.environments??{}),compute:e.infrastructure?.compute?{provider:e.infrastructure.compute.provider,runtime:e.infrastructure.compute.runtime,webServer:e.infrastructure.compute.webServer,proxy:e.infrastructure.compute.proxy?{engine:e.infrastructure.compute.proxy.engine,onDemandTls:e.infrastructure.compute.proxy.onDemandTls,cdn:!!e.infrastructure.compute.proxy.cdn}:void 0,managedServices:t,sshKeys:Qi(zs(e)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(e.sites??{}).map(([r,a])=>[r,{domain:a.domain,path:a.path,type:a.type,deploy:a.deploy,root:a.root,port:a.port,ssl:a.ssl}]))}}function _n(e){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",e],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",e,"--yes"],mutates:!0,confirm:"deploy"}]}function Rs(e,t){return _n(t).find((r)=>r.id===e)}function rw(e){if(e.length<=BS)return e;return`${e.slice(0,BS)}
 
-[output truncated]`}async function nw(e,t,r){let a=e.getReader(),g=new TextDecoder,f="";while(!0){let{done:b,value:S}=await a.read();if(b)break;let y=g.decode(S,{stream:!0});if(f+=y,y)r?.(t,y)}let h=g.decode();if(h)f+=h,r?.(t,h);return f}async function km(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[g,f,h]=await Promise.all([nw(r.stdout,"stdout",t.onOutput),nw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:h,ok:h===0,stdout:rw(g),stderr:rw(f)}}finally{t.signal?.removeEventListener("abort",a)}}function uT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var pT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function gT(e){let t=Ic(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!pT.has(r)}var mT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function iw(e,t){if(t.role==="admin")return!0;let r=Ic(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!gT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let g=mT[a];return!!g&&!!t.capabilities?.includes(g)}function fT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),g=M_(r===""?"index.html":r);if(g.startsWith("..")||g.includes("/../"))return null;let f=xt(e,g);if(Si(f)&&!cw(f).isDirectory())return f;if(!Ic(f)&&Si(`${f}.html`))return`${f}.html`;if(!Ic(f)&&Si(xt(f,"index.html")))return xt(f,"index.html");return null}async function ow(e,t){let r=fT(e,t);if(!r){let f=xt(e,"404.html");if(Si(f))return new Response(await ni(f),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return bl("Not found",404)}if(cw(r).isDirectory())return bl("Not found",404);let a=await ni(r),g=K_[Ic(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":g}})}var yl=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],sw=new WeakMap;async function aw(e){let t=sw.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),g={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return sw.set(e,g),g}async function pc(e={}){H_();let t=e.cwd??process.cwd(),r=e.host??q_,a=e.port??V_,g=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await tT(t);let f=e.config??await nu(),h=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,b=p(f);if(h&&b&&!b.password)b.password=h;let S=f.infrastructure?.compute?.managedServices?.vitess;if(h&&S&&typeof S==="object"&&!S.password)S.password=h;let y=ig(t,f);if(y.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${y.reconciliation.failed} orphaned operation(s) as failed after restart.`);let k=Object.keys(f.environments??{}),R=X_(f,e.environment),D=rT(t),O=await Ro(f,R),M=new Map([[R,O]]),z=new Map([[R,Date.now()]]),J=new Map([[R,Date.now()]]),Z=new Map,oe=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),G=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),te=K(f)!=="serverless",ye=(_)=>{let Ne=M.get(_);if(Ne&&!ZS(z.get(_),Date.now(),oe))return Promise.resolve(Ne);let Ue=Z.get(_);if(Ue)return Ue;let Oe=!te||ZS(J.get(_),Date.now(),G),Ge=Ro(f,_,{includeSiteHealth:Oe}).then((bt)=>{let B=M.get(_),Br=Oe?bt:cT(B,bt);if(M.set(_,Br),z.set(_,Date.now()),Oe)J.set(_,Date.now());if(B?._serverReachable!==Br._serverReachable||B?._metricsStatus!==Br._metricsStatus||(B?.sitesDetail?.length??0)!==(Br.sitesDetail?.length??0))Ze();return Br}).finally(()=>Z.delete(_));return Z.set(_,Ge),Ge},Se=tr(t),ie=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&ie!=="0"&&(ie==="1"||!f.cloud?.attachTo)){let _=!1,Ne=Date.now()+300000,Ue=async()=>{if(_)return;_=!0;try{let Ge=Date.now(),bt=Ge>=Ne;if(bt)Ne=Ge+300000;let B=y.environments.get(R);await Sm({controlPlane:y.store,projectId:y.project.id,environmentId:B?.id,config:f,environment:R,force:!0,lightweight:!0,includeSiteHealth:bt})}catch(Ge){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Ge instanceof Error?Ge.message:String(Ge)}`)}finally{_=!1}};Ue(),setInterval(()=>void Ue(),60000).unref?.()}let ee=new Map,De=new Map,Je=new Set,gt=0;function jt(_,Ne){if(_.role==="admin"&&!y.store.getActorByExternalId("user",`dashboard:${_.username.toLowerCase()}`))return _;let Ue=y.store.getActorByExternalId("user",`dashboard:${_.username.toLowerCase()}`),Oe=Ue?y.store.getMembershipForActor(y.organization.id,Ue.id):void 0;if(!Oe||Oe.status!=="active")return{..._,role:"member",sites:{},capabilities:[]};let Ge=y.store.listGrants(Oe.id),bt=y.store.resolveAuthorizationTarget(y.organization.id,Oe.scope)??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id}),B=ir({membership:Oe,grants:Ge,target:bt});if(Oe.roleTemplate==="owner"||Oe.roleTemplate==="admin")return{..._,role:"admin",sites:{},organizationRole:Oe.roleTemplate,organizationSource:Oe.source,capabilities:B};let Br=y.environments.get(Ne),er={};for(let tt of y.store.listResources(y.project.id,Br?.id).filter((st)=>st.kind==="application")){let st=y.store.resolveAuthorizationTarget(y.organization.id,{type:"resource",id:tt.id});if(!st||!x({membership:Oe,grants:Ge,capability:"project:read",target:st}).allowed)continue;er[tt.slug]=x({membership:Oe,grants:Ge,capability:"config:write",target:st}).allowed?"owner":"collaborator"}return{..._,role:"member",sites:er,organizationRole:Oe.roleTemplate,organizationSource:Oe.source,capabilities:B}}function Ze(){gt+=1,ee.clear();for(let _ of Je)Ao(_,{recursive:!0,force:!0});Je.clear()}let wt=(_,Ne)=>`${Ne}:${_.role==="admin"?"admin":`member:${Object.entries(_.sites).sort(([Ue],[Oe])=>Ue.localeCompare(Oe)).map(([Ue,Oe])=>`${Ue}=${Oe}`).join(",")}`}:${[..._.capabilities??[]].sort().join(",")}`;async function Bt(_,Ne){let Ue=jt(_,Ne),Oe=wt(Ue,Ne),Ge=ee.get(Oe);if(Ge)return Ge;let bt=De.get(Oe);if(bt)return bt;let B=gt,Br=(async()=>{let er=M.get(Ne)??await Ro(f,Ne);M.set(Ne,er);let tt={...um(er,{user:Ue,slug:f.project.slug}),viewer:{role:Ue.role,organizationRole:Ue.organizationRole,organizationSource:Ue.organizationSource,capabilities:Ue.capabilities??[]}},st=await lT(t,tt);if(st&&B!==gt)return Ao(st,{recursive:!0,force:!0}),Se?.uiRoot;if(st)Je.add(st);let _r=st??Se?.uiRoot;if(_r)ee.set(Oe,_r);return _r})();De.set(Oe,Br);try{return await Br}finally{De.delete(Oe)}}let nt=await Bt({username:"",passwordHash:"",role:"admin",sites:{}},R);if(!nt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let W=new WeakMap,se=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",ue=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(ue&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Ce=!ue,mt=Nb(t),kt=Ce?Lb(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,_e=new ds(y.store,{encryptionKey:at(t)}),yt=new ls(y.store),it=new Cn(y.store),Ke=new Aa(y.store,{encryptionKey:at(t)}),jr=new Pp(y.store),Po=new Dp(y.store,{cwd:t}),Qn=new Tp(y.store,{encryptionKey:at(t)}),Dt=new c(y.store,{workerId:`dashboard:${process.pid}`}),zt=new Na(y.store),ii=new Ua(y.store,at(t)),wi=new cc(y.store),Ec=new ys(zt,Dt,ii),ki=f.project?.region??"us-east-1",Em=at(t),tn=new gc(wi,{encryptionKey:Em,backends:[new On(y.store,Em),new dc(new re(ki),ki),new lc(new Be(ki),ki),new uc]});await Ig(tn,y,f);let Sl=new ne(ki),lw={aws_rds:new Ba(new $a(Sl)),aws_aurora:new xa(new Ma(Sl)),aws_elasticache:new Oa(new Fa(new pt(ki))),server:new _a(new Ir),container:new La(new Ir)},Rm=(_)=>lw[_.provider],rr=new ec(y.store),Yi=new Ts(rr,Dt),Am=new tc(ii),uw={managed_database:new rc(zt,Sl),logical_database:new ic(zt,ii),volume:new sc,files:new nc(t),control_plane:new oc(y.store,t),infrastructure:new ac(new vr(ki))},pw=(_)=>uw[_.resourceKind],gw=(_)=>_.provider==="aws_backup"?void 0:Am,wl=new sr(y.store),kl=[new Yr,new To(l(t,"volumes"))],oi=new vo(wl,kl,Dt),Us=new Qa(y.store),Yn=new Ha(Us,[new Rn("aws"),new Rn("hetzner"),new Rn("ssh")],Dt),Ii=new Ga(y.store),Cm=new Va(Ii,Us),Zi=new qa(y.store),Pm=new ja(Zi,Dt),si=new Ka(y.store),Il=new Wa(si,Dt),_m=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((_)=>new Ja(_,y.store,y.project.id,y.organization.id)),wr=new ka(y.store),Tm=new Pa(wr,{queue:Dt}),Xt=new Xr(y.store),Ei=new Zr(y.store),un=new _t(y.store),et=new Gi(y.store,{encryptionKey:at(t)}),mw=()=>aw(y.store);for(let _ of y.environments.values())Da(wr,f,{organization:y.organization,project:y.project,environment:_,resources:y.store.listResources(y.project.id,_.id)});let pn=new Vi(et,{emailImpl:async(_)=>{let{email:Ne}=await import("./chunk-tb5hy7rm.js");return Ne.send(_)}}),xm=async(_)=>{let Ne=Mo(et,y.project.id,_),Ue=[];for(let Oe of Ne.filter((Ge)=>Ge.notify&&Ge.alert))Ue.push(...await pn.deliverAll(pn.enqueue(y.organization.id,Oe.alert,Oe.transition)));return Ue.push(...await pn.deliverAll(pn.enqueueRemindersAndEscalations(y.organization.id,et.listAlerts(y.project.id,{environmentId:_,states:["firing"]})))),Ue.push(...await pn.retryDue()),{evaluations:Ne,deliveries:Ue}},El=!1,fw=async()=>{if(El)return;El=!0;try{for(let _ of y.environments.values())for(let Ne of et.listHealthChecks(y.project.id,_.id).filter((Ue)=>Ue.enabled)){let Ue=et.listHealthResults(Ne.id,1)[0];if(Ue&&Date.now()-new Date(Ue.checkedAt).getTime()<Ne.intervalSeconds*1000)continue;let Oe=await new Ye(et).runAndEvaluate(Ne);for(let Ge of Oe.evaluations.filter((bt)=>bt.notify&&bt.alert))await pn.deliverAll(pn.enqueue(y.organization.id,Ge.alert,Ge.transition))}}finally{El=!1}},Dm=setInterval(()=>{for(let _ of y.environments.values())xm(_.id).catch((Ne)=>console.error("ts-cloud alert evaluation failed:",Ne))},60000);Dm.unref?.();let Om=setInterval(()=>{fw().catch((_)=>console.error("ts-cloud health check evaluation failed:",_))},30000);Om.unref?.();let $m=setInterval(()=>{try{Tm.tick()}catch(_){console.error("ts-cloud scheduled job evaluation failed:",_)}},30000);$m.unref?.();let Nm=setInterval(()=>{try{Yi.enqueueDue(),Yi.enqueueRetention()}catch(_){console.error("ts-cloud backup policy evaluation failed:",_)}},30000);Nm.unref?.(),Xt.cleanup();let jm=setInterval(()=>{try{Xt.cleanup()}catch(_){console.error("ts-cloud preview cleanup failed:",_)}},3600000);jm.unref?.();let hw=e.queueWorker??!0,yw=uT(),vw=async(_,Ne)=>{let Oe=(_.environmentId?y.store.listEnvironments(_.projectId).find((Ge)=>Ge.id===_.environmentId):void 0)?.slug??String(R);if(Ne.kind==="dashboard_operation"&&Ne.operationId){let Ge=M.get(Oe)??O,bt=lm(Ne.operationId,f,Ge);if(!bt||bt.danger||!["scheduler","backup","worker"].includes(bt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let B=await ll(f,Oe,bt);return{ok:B.ok,stdout:B.stdout,stderr:B.stderr??B.error,retryable:/temporar|unavailable|timeout|network/i.test(B.stderr??B.error??""),output:{command:B.command??null,operation:B.operation}}}if(Ne.kind==="serverless_scheduler"){let Ge=await bm(f,Oe,"run");return{ok:Ge.ok,stdout:Ge.stdout,stderr:Ge.error,retryable:/temporar|unavailable|timeout|network/i.test(Ge.error??""),output:{command:Ge.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Ne.kind}.`}},Rc=hw?new Co(Dt,{...Rd({store:y.store,execute:async(_,Ne)=>{let Ue=Ne.operation.input&&typeof Ne.operation.input==="object"&&!Array.isArray(Ne.operation.input)?Ne.operation.input:{},Oe=Ue.source&&typeof Ue.source==="object"?Ue.source:void 0,Ge=t,bt,B,Br;try{if(Oe?.bindingId&&Oe?.connectionId&&Oe?.commitSha){let tt=Ke.getBinding(String(Oe.bindingId)),st=Ke.getConnection(String(Oe.connectionId));if(!tt||!st||tt.connectionId!==st.id)throw Error("Queued source binding is no longer available");let mr=(tt.repositoryId?Ke.getRepository(tt.repositoryId):Ke.listRepositories(st.id).find((Do)=>Do.fullName.toLowerCase()===tt.repositoryFullName.toLowerCase()))?.cloneUrl;if(!mr&&st.provider==="generic_ssh")mr=`git@${new URL(st.host).hostname}:${tt.repositoryFullName}.git`;if(!mr)mr=new URL(`/${tt.repositoryFullName}.git`,st.host.endsWith("/")?st.host:`${st.host}/`).href;let ke=tt.deployKeyId?Ke.getDeployKey(tt.deployKeyId):void 0,qt=ke&&tt.deployKeyId?{...ke,privateKey:Ke.getDeployPrivateKey(tt.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(st.provider)&&_.target.previewId){let Do=ct(st,Ke.getCredential(st.id)),de=Xt.previews.getInstance(_.target.previewId);Br=async(gn,Tc)=>{try{await Do.setCommitStatus(tt.repositoryFullName,String(Oe.commitSha),{state:gn,url:de?.url,description:Tc})}catch(Oo){Ne.log(`Could not publish source status: ${Oo instanceof Error?Oo.message:String(Oo)}`,{stream:"stderr"})}},await Br("pending",`Preview deployment started for ${String(Oe.commitSha).slice(0,12)}`)}bt=Im(xt(vl(),"ts-cloud-queued-source-")),Ne.log(`Checking out immutable source commit ${Oe.commitSha}.`,{stream:"system"}),Ge=(await Sa({remote:mr,binding:tt,destination:xt(bt,"checkout"),ref:String(Oe.branch??tt.defaultBranch),commitSha:String(Oe.commitSha)},{credential:Ke.getCredential(st.id),deployKey:qt})).directory}if(Ne.operation.kind!=="preview.destroy"){let tt=_.target.previewId?Xt.previews.getInstance(_.target.previewId):void 0,st=tt?Xt.previews.getDefinition(tt.definitionId):void 0,_r=Ne.operation.resourceId?y.store.getResource(Ne.operation.resourceId):void 0;if(B=await tn.resolve({projectId:y.project.id,environmentId:Ne.operation.environmentId,resourceId:Ne.operation.resourceId,functionId:_r?.kind==="function"?_r.id:void 0,previewId:tt?.id,trustedPreview:!!tt&&!tt.fork,allowedPreviewSecrets:st?.inheritedSecrets}),B.warnings.some((mr)=>mr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${B.warnings.filter((mr)=>mr.code==="missing_required").map((mr)=>mr.key).join(", ")}`);if(Ne.operation.resourceId)for(let mr of Object.values(B.entries))wi.setDependency({entryId:mr.id,resourceId:Ne.operation.resourceId,injectionTarget:"environment",required:mr.required,requiresRedeploy:!0});Ne.log(`Resolved configuration ${B.configurationHash.slice(0,18)} for ${Object.keys(B.values).length} keys.`,{stream:"system"})}let er=await km(_,{cwd:Ge,cliEntry:g,signal:Ne.signal,env:B?.values,onOutput:(tt,st)=>Ne.log(st,{stream:tt,step:"execute",secrets:[...yw,...Object.entries(B?.entries??{}).filter(([,_r])=>_r.kind==="secret").map(([_r])=>B.values[_r]).filter(Boolean)]})});if(er.ok&&Ne.operation.resourceId&&B)for(let tt of Object.values(B.entries))wi.setDependency({entryId:tt.id,resourceId:Ne.operation.resourceId,injectionTarget:"environment",required:tt.required,requiresRedeploy:!1,lastDeployedVersion:tt.version});return await Br?.(er.ok?"success":"failure",er.ok?`Preview is ready at ${String(Oe?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Oe?.commitSha).slice(0,12)}`),er}catch(er){throw await Br?.("error",`Preview deployment could not complete at ${String(Oe?.commitSha).slice(0,12)}`),er}finally{if(bt)Ao(bt,{recursive:!0,force:!0})}}}),...Mu({store:wr,executor:vw}),...Uu({store:zt,secrets:ii,resolveAdapter:Rm}),...Gu(Us,Yn.drivers),...qu(Zi,[new za("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...Ju({store:si,cleanup:_m}),...Dd(wl,kl),...fg({store:rr,queue:Dt,resolveSource:pw,resolveDestination:gw,validateHealth:async(_,Ne)=>{if(!_.healthCheckId)return{healthy:!0,mode:"adapter"};let Ue=et.getHealthCheck(_.healthCheckId);if(!Ue||Ue.projectId!==_.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Oe=await new Ye(et).runAndEvaluate(Ue);return{healthy:Oe.result.status==="healthy",healthCheckId:Ue.id,healthResultId:Oe.result.id,target:Ne}}}),...hu({store:y.store,resolveDriver:e.releaseDriver??((_)=>({name:`${y.store.getResource(_.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:_.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(_,Ne)=>{let Ue=et.listHealthChecks(Ne.projectId,Ne.environmentId).find((Ge)=>Ge.enabled&&Ge.name===_&&(!Ge.resourceId||Ge.resourceId===Ne.resourceId));if(!Ue)return{healthy:!1,message:`Named health gate ${_} was not found for this release.`};let Oe=await new Ye(et).runAndEvaluate(Ue);return{healthy:Oe.result.status==="healthy",evidence:{healthCheckId:Ue.id,healthResultId:Oe.result.id,status:Oe.result.status,timings:Oe.result.timings},message:Oe.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(_)=>console.error("ts-cloud deployment queue worker failed:",_)}):void 0;if(Pu(y),fs(it,ge(y,String(R)),O),kt)Cs(y,kt.users),Ub(_e,y,kt.users);let Wt=Fb({cwd:t,enabled:Ce,secret:mt,authentication:_e,authorization:{store:y.store,organizationId:y.organization.id,projectId:y.project.id,defaultEnvironment:String(R)}}),or=new Ra,Bm=setInterval(()=>or.sweep(),60000);Bm.unref?.();let Ac=new bc,Rl=new bc(3,900000,900000),Cc=new bc(8,900000,900000),Mm=setInterval(()=>Ac.prune(),300000),Lm=setInterval(()=>Rl.prune(),300000),Fm=setInterval(()=>Cc.prune(),300000);if(Mm.unref?.(),Lm.unref?.(),Fm.unref?.(),Ce){if(kt?.generated)console.warn(`
+[output truncated]`}async function nw(e,t,r){let a=e.getReader(),g=new TextDecoder,f="";while(!0){let{done:b,value:S}=await a.read();if(b)break;let y=g.decode(S,{stream:!0});if(f+=y,y)r?.(t,y)}let h=g.decode();if(h)f+=h,r?.(t,h);return f}async function km(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[g,f,h]=await Promise.all([nw(r.stdout,"stdout",t.onOutput),nw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:h,ok:h===0,stdout:rw(g),stderr:rw(f)}}finally{t.signal?.removeEventListener("abort",a)}}function uT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var pT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function gT(e){let t=Ic(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!pT.has(r)}var mT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function iw(e,t){if(t.role==="admin")return!0;let r=Ic(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!gT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let g=mT[a];return!!g&&!!t.capabilities?.includes(g)}function fT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),g=M_(r===""?"index.html":r);if(g.startsWith("..")||g.includes("/../"))return null;let f=xt(e,g);if(Si(f)&&!cw(f).isDirectory())return f;if(!Ic(f)&&Si(`${f}.html`))return`${f}.html`;if(!Ic(f)&&Si(xt(f,"index.html")))return xt(f,"index.html");return null}async function ow(e,t){let r=fT(e,t);if(!r){let f=xt(e,"404.html");if(Si(f))return new Response(await ni(f),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return bl("Not found",404)}if(cw(r).isDirectory())return bl("Not found",404);let a=await ni(r),g=K_[Ic(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":g}})}var yl=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],sw=new WeakMap;async function aw(e){let t=sw.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),g={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return sw.set(e,g),g}async function pc(e={}){H_();let t=e.cwd??process.cwd(),r=e.host??q_,a=e.port??V_,g=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await tT(t);let f=e.config??await nu(),h=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,b=p(f);if(h&&b&&!b.password)b.password=h;let S=f.infrastructure?.compute?.managedServices?.vitess;if(h&&S&&typeof S==="object"&&!S.password)S.password=h;let y=ig(t,f);if(y.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${y.reconciliation.failed} orphaned operation(s) as failed after restart.`);let k=Object.keys(f.environments??{}),R=X_(f,e.environment),D=rT(t),O=await Ro(f,R),M=new Map([[R,O]]),z=new Map([[R,Date.now()]]),J=new Map([[R,Date.now()]]),Z=new Map,oe=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),G=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),te=K(f)!=="serverless",ye=(_)=>{let Ne=M.get(_);if(Ne&&!ZS(z.get(_),Date.now(),oe))return Promise.resolve(Ne);let Ue=Z.get(_);if(Ue)return Ue;let Oe=!te||ZS(J.get(_),Date.now(),G),Ge=Ro(f,_,{includeSiteHealth:Oe}).then((bt)=>{let B=M.get(_),Br=Oe?bt:cT(B,bt);if(M.set(_,Br),z.set(_,Date.now()),Oe)J.set(_,Date.now());if(B?._serverReachable!==Br._serverReachable||B?._metricsStatus!==Br._metricsStatus||(B?.sitesDetail?.length??0)!==(Br.sitesDetail?.length??0))Ze();return Br}).finally(()=>Z.delete(_));return Z.set(_,Ge),Ge},be=tr(t),ie=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&ie!=="0"&&(ie==="1"||!f.cloud?.attachTo)){let _=!1,Ne=Date.now()+300000,Ue=async()=>{if(_)return;_=!0;try{let Ge=Date.now(),bt=Ge>=Ne;if(bt)Ne=Ge+300000;let B=y.environments.get(R);await Sm({controlPlane:y.store,projectId:y.project.id,environmentId:B?.id,config:f,environment:R,force:!0,lightweight:!0,includeSiteHealth:bt})}catch(Ge){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Ge instanceof Error?Ge.message:String(Ge)}`)}finally{_=!1}};Ue(),setInterval(()=>void Ue(),60000).unref?.()}let ee=new Map,xe=new Map,Je=new Set,gt=0;function jt(_,Ne){if(_.role==="admin"&&!y.store.getActorByExternalId("user",`dashboard:${_.username.toLowerCase()}`))return _;let Ue=y.store.getActorByExternalId("user",`dashboard:${_.username.toLowerCase()}`),Oe=Ue?y.store.getMembershipForActor(y.organization.id,Ue.id):void 0;if(!Oe||Oe.status!=="active")return{..._,role:"member",sites:{},capabilities:[]};let Ge=y.store.listGrants(Oe.id),bt=y.store.resolveAuthorizationTarget(y.organization.id,Oe.scope)??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id}),B=ir({membership:Oe,grants:Ge,target:bt});if(Oe.roleTemplate==="owner"||Oe.roleTemplate==="admin")return{..._,role:"admin",sites:{},organizationRole:Oe.roleTemplate,organizationSource:Oe.source,capabilities:B};let Br=y.environments.get(Ne),er={};for(let tt of y.store.listResources(y.project.id,Br?.id).filter((st)=>st.kind==="application")){let st=y.store.resolveAuthorizationTarget(y.organization.id,{type:"resource",id:tt.id});if(!st||!x({membership:Oe,grants:Ge,capability:"project:read",target:st}).allowed)continue;er[tt.slug]=x({membership:Oe,grants:Ge,capability:"config:write",target:st}).allowed?"owner":"collaborator"}return{..._,role:"member",sites:er,organizationRole:Oe.roleTemplate,organizationSource:Oe.source,capabilities:B}}function Ze(){gt+=1,ee.clear();for(let _ of Je)Ao(_,{recursive:!0,force:!0});Je.clear()}let wt=(_,Ne)=>`${Ne}:${_.role==="admin"?"admin":`member:${Object.entries(_.sites).sort(([Ue],[Oe])=>Ue.localeCompare(Oe)).map(([Ue,Oe])=>`${Ue}=${Oe}`).join(",")}`}:${[..._.capabilities??[]].sort().join(",")}`;async function Bt(_,Ne){let Ue=jt(_,Ne),Oe=wt(Ue,Ne),Ge=ee.get(Oe);if(Ge)return Ge;let bt=xe.get(Oe);if(bt)return bt;let B=gt,Br=(async()=>{let er=M.get(Ne)??await Ro(f,Ne);M.set(Ne,er);let tt={...um(er,{user:Ue,slug:f.project.slug}),viewer:{role:Ue.role,organizationRole:Ue.organizationRole,organizationSource:Ue.organizationSource,capabilities:Ue.capabilities??[]}},st=await lT(t,tt);if(st&&B!==gt)return Ao(st,{recursive:!0,force:!0}),be?.uiRoot;if(st)Je.add(st);let _r=st??be?.uiRoot;if(_r)ee.set(Oe,_r);return _r})();xe.set(Oe,Br);try{return await Br}finally{xe.delete(Oe)}}let nt=await Bt({username:"",passwordHash:"",role:"admin",sites:{}},R);if(!nt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let W=new WeakMap,se=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",ue=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(ue&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Ee=!ue,mt=Nb(t),kt=Ee?Lb(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,Pe=new ds(y.store,{encryptionKey:at(t)}),yt=new ls(y.store),it=new Cn(y.store),Ke=new Aa(y.store,{encryptionKey:at(t)}),jr=new Pp(y.store),Po=new Dp(y.store,{cwd:t}),Qn=new Tp(y.store,{encryptionKey:at(t)}),Dt=new c(y.store,{workerId:`dashboard:${process.pid}`}),zt=new Na(y.store),ii=new Ua(y.store,at(t)),wi=new cc(y.store),Ec=new ys(zt,Dt,ii),ki=f.project?.region??"us-east-1",Em=at(t),tn=new gc(wi,{encryptionKey:Em,backends:[new On(y.store,Em),new dc(new re(ki),ki),new lc(new Be(ki),ki),new uc]});await Ig(tn,y,f);let Sl=new ne(ki),lw={aws_rds:new Ba(new $a(Sl)),aws_aurora:new xa(new Ma(Sl)),aws_elasticache:new Oa(new Fa(new pt(ki))),server:new _a(new Ir),container:new La(new Ir)},Rm=(_)=>lw[_.provider],rr=new ec(y.store),Yi=new Ts(rr,Dt),Am=new tc(ii),uw={managed_database:new rc(zt,Sl),logical_database:new ic(zt,ii),volume:new sc,files:new nc(t),control_plane:new oc(y.store,t),infrastructure:new ac(new vr(ki))},pw=(_)=>uw[_.resourceKind],gw=(_)=>_.provider==="aws_backup"?void 0:Am,wl=new sr(y.store),kl=[new Yr,new To(l(t,"volumes"))],oi=new vo(wl,kl,Dt),Us=new Qa(y.store),Yn=new Ha(Us,[new Rn("aws"),new Rn("hetzner"),new Rn("ssh")],Dt),Ii=new Ga(y.store),Cm=new Va(Ii,Us),Zi=new qa(y.store),Pm=new ja(Zi,Dt),si=new Ka(y.store),Il=new Wa(si,Dt),_m=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((_)=>new Ja(_,y.store,y.project.id,y.organization.id)),wr=new ka(y.store),Tm=new Pa(wr,{queue:Dt}),Xt=new Xr(y.store),Ei=new Zr(y.store),un=new _t(y.store),et=new Gi(y.store,{encryptionKey:at(t)}),mw=()=>aw(y.store);for(let _ of y.environments.values())Da(wr,f,{organization:y.organization,project:y.project,environment:_,resources:y.store.listResources(y.project.id,_.id)});let pn=new Vi(et,{emailImpl:async(_)=>{let{email:Ne}=await import("./chunk-ncet7ba7.js");return Ne.send(_)}}),xm=async(_)=>{let Ne=Mo(et,y.project.id,_),Ue=[];for(let Oe of Ne.filter((Ge)=>Ge.notify&&Ge.alert))Ue.push(...await pn.deliverAll(pn.enqueue(y.organization.id,Oe.alert,Oe.transition)));return Ue.push(...await pn.deliverAll(pn.enqueueRemindersAndEscalations(y.organization.id,et.listAlerts(y.project.id,{environmentId:_,states:["firing"]})))),Ue.push(...await pn.retryDue()),{evaluations:Ne,deliveries:Ue}},El=!1,fw=async()=>{if(El)return;El=!0;try{for(let _ of y.environments.values())for(let Ne of et.listHealthChecks(y.project.id,_.id).filter((Ue)=>Ue.enabled)){let Ue=et.listHealthResults(Ne.id,1)[0];if(Ue&&Date.now()-new Date(Ue.checkedAt).getTime()<Ne.intervalSeconds*1000)continue;let Oe=await new Ye(et).runAndEvaluate(Ne);for(let Ge of Oe.evaluations.filter((bt)=>bt.notify&&bt.alert))await pn.deliverAll(pn.enqueue(y.organization.id,Ge.alert,Ge.transition))}}finally{El=!1}},Dm=setInterval(()=>{for(let _ of y.environments.values())xm(_.id).catch((Ne)=>console.error("ts-cloud alert evaluation failed:",Ne))},60000);Dm.unref?.();let Om=setInterval(()=>{fw().catch((_)=>console.error("ts-cloud health check evaluation failed:",_))},30000);Om.unref?.();let $m=setInterval(()=>{try{Tm.tick()}catch(_){console.error("ts-cloud scheduled job evaluation failed:",_)}},30000);$m.unref?.();let Nm=setInterval(()=>{try{Yi.enqueueDue(),Yi.enqueueRetention()}catch(_){console.error("ts-cloud backup policy evaluation failed:",_)}},30000);Nm.unref?.(),Xt.cleanup();let jm=setInterval(()=>{try{Xt.cleanup()}catch(_){console.error("ts-cloud preview cleanup failed:",_)}},3600000);jm.unref?.();let hw=e.queueWorker??!0,yw=uT(),vw=async(_,Ne)=>{let Oe=(_.environmentId?y.store.listEnvironments(_.projectId).find((Ge)=>Ge.id===_.environmentId):void 0)?.slug??String(R);if(Ne.kind==="dashboard_operation"&&Ne.operationId){let Ge=M.get(Oe)??O,bt=lm(Ne.operationId,f,Ge);if(!bt||bt.danger||!["scheduler","backup","worker"].includes(bt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let B=await ll(f,Oe,bt);return{ok:B.ok,stdout:B.stdout,stderr:B.stderr??B.error,retryable:/temporar|unavailable|timeout|network/i.test(B.stderr??B.error??""),output:{command:B.command??null,operation:B.operation}}}if(Ne.kind==="serverless_scheduler"){let Ge=await bm(f,Oe,"run");return{ok:Ge.ok,stdout:Ge.stdout,stderr:Ge.error,retryable:/temporar|unavailable|timeout|network/i.test(Ge.error??""),output:{command:Ge.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Ne.kind}.`}},Rc=hw?new Co(Dt,{...Rd({store:y.store,execute:async(_,Ne)=>{let Ue=Ne.operation.input&&typeof Ne.operation.input==="object"&&!Array.isArray(Ne.operation.input)?Ne.operation.input:{},Oe=Ue.source&&typeof Ue.source==="object"?Ue.source:void 0,Ge=t,bt,B,Br;try{if(Oe?.bindingId&&Oe?.connectionId&&Oe?.commitSha){let tt=Ke.getBinding(String(Oe.bindingId)),st=Ke.getConnection(String(Oe.connectionId));if(!tt||!st||tt.connectionId!==st.id)throw Error("Queued source binding is no longer available");let mr=(tt.repositoryId?Ke.getRepository(tt.repositoryId):Ke.listRepositories(st.id).find((Do)=>Do.fullName.toLowerCase()===tt.repositoryFullName.toLowerCase()))?.cloneUrl;if(!mr&&st.provider==="generic_ssh")mr=`git@${new URL(st.host).hostname}:${tt.repositoryFullName}.git`;if(!mr)mr=new URL(`/${tt.repositoryFullName}.git`,st.host.endsWith("/")?st.host:`${st.host}/`).href;let Se=tt.deployKeyId?Ke.getDeployKey(tt.deployKeyId):void 0,qt=Se&&tt.deployKeyId?{...Se,privateKey:Ke.getDeployPrivateKey(tt.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(st.provider)&&_.target.previewId){let Do=ct(st,Ke.getCredential(st.id)),ae=Xt.previews.getInstance(_.target.previewId);Br=async(gn,Tc)=>{try{await Do.setCommitStatus(tt.repositoryFullName,String(Oe.commitSha),{state:gn,url:ae?.url,description:Tc})}catch(Oo){Ne.log(`Could not publish source status: ${Oo instanceof Error?Oo.message:String(Oo)}`,{stream:"stderr"})}},await Br("pending",`Preview deployment started for ${String(Oe.commitSha).slice(0,12)}`)}bt=Im(xt(vl(),"ts-cloud-queued-source-")),Ne.log(`Checking out immutable source commit ${Oe.commitSha}.`,{stream:"system"}),Ge=(await Sa({remote:mr,binding:tt,destination:xt(bt,"checkout"),ref:String(Oe.branch??tt.defaultBranch),commitSha:String(Oe.commitSha)},{credential:Ke.getCredential(st.id),deployKey:qt})).directory}if(Ne.operation.kind!=="preview.destroy"){let tt=_.target.previewId?Xt.previews.getInstance(_.target.previewId):void 0,st=tt?Xt.previews.getDefinition(tt.definitionId):void 0,_r=Ne.operation.resourceId?y.store.getResource(Ne.operation.resourceId):void 0;if(B=await tn.resolve({projectId:y.project.id,environmentId:Ne.operation.environmentId,resourceId:Ne.operation.resourceId,functionId:_r?.kind==="function"?_r.id:void 0,previewId:tt?.id,trustedPreview:!!tt&&!tt.fork,allowedPreviewSecrets:st?.inheritedSecrets}),B.warnings.some((mr)=>mr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${B.warnings.filter((mr)=>mr.code==="missing_required").map((mr)=>mr.key).join(", ")}`);if(Ne.operation.resourceId)for(let mr of Object.values(B.entries))wi.setDependency({entryId:mr.id,resourceId:Ne.operation.resourceId,injectionTarget:"environment",required:mr.required,requiresRedeploy:!0});Ne.log(`Resolved configuration ${B.configurationHash.slice(0,18)} for ${Object.keys(B.values).length} keys.`,{stream:"system"})}let er=await km(_,{cwd:Ge,cliEntry:g,signal:Ne.signal,env:B?.values,onOutput:(tt,st)=>Ne.log(st,{stream:tt,step:"execute",secrets:[...yw,...Object.entries(B?.entries??{}).filter(([,_r])=>_r.kind==="secret").map(([_r])=>B.values[_r]).filter(Boolean)]})});if(er.ok&&Ne.operation.resourceId&&B)for(let tt of Object.values(B.entries))wi.setDependency({entryId:tt.id,resourceId:Ne.operation.resourceId,injectionTarget:"environment",required:tt.required,requiresRedeploy:!1,lastDeployedVersion:tt.version});return await Br?.(er.ok?"success":"failure",er.ok?`Preview is ready at ${String(Oe?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Oe?.commitSha).slice(0,12)}`),er}catch(er){throw await Br?.("error",`Preview deployment could not complete at ${String(Oe?.commitSha).slice(0,12)}`),er}finally{if(bt)Ao(bt,{recursive:!0,force:!0})}}}),...Mu({store:wr,executor:vw}),...Uu({store:zt,secrets:ii,resolveAdapter:Rm}),...Gu(Us,Yn.drivers),...qu(Zi,[new za("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...Ju({store:si,cleanup:_m}),...Dd(wl,kl),...fg({store:rr,queue:Dt,resolveSource:pw,resolveDestination:gw,validateHealth:async(_,Ne)=>{if(!_.healthCheckId)return{healthy:!0,mode:"adapter"};let Ue=et.getHealthCheck(_.healthCheckId);if(!Ue||Ue.projectId!==_.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Oe=await new Ye(et).runAndEvaluate(Ue);return{healthy:Oe.result.status==="healthy",healthCheckId:Ue.id,healthResultId:Oe.result.id,target:Ne}}}),...hu({store:y.store,resolveDriver:e.releaseDriver??((_)=>({name:`${y.store.getResource(_.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:_.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(_,Ne)=>{let Ue=et.listHealthChecks(Ne.projectId,Ne.environmentId).find((Ge)=>Ge.enabled&&Ge.name===_&&(!Ge.resourceId||Ge.resourceId===Ne.resourceId));if(!Ue)return{healthy:!1,message:`Named health gate ${_} was not found for this release.`};let Oe=await new Ye(et).runAndEvaluate(Ue);return{healthy:Oe.result.status==="healthy",evidence:{healthCheckId:Ue.id,healthResultId:Oe.result.id,status:Oe.result.status,timings:Oe.result.timings},message:Oe.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(_)=>console.error("ts-cloud deployment queue worker failed:",_)}):void 0;if(Pu(y),fs(it,pe(y,String(R)),O),kt)Cs(y,kt.users),Ub(Pe,y,kt.users);let Wt=Fb({cwd:t,enabled:Ee,secret:mt,authentication:Pe,authorization:{store:y.store,organizationId:y.organization.id,projectId:y.project.id,defaultEnvironment:String(R)}}),or=new Ra,Bm=setInterval(()=>or.sweep(),60000);Bm.unref?.();let Ac=new bc,Rl=new bc(3,900000,900000),Cc=new bc(8,900000,900000),Mm=setInterval(()=>Ac.prune(),300000),Lm=setInterval(()=>Rl.prune(),300000),Fm=setInterval(()=>Cc.prune(),300000);if(Mm.unref?.(),Lm.unref?.(),Fm.unref?.(),Ee){if(kt?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${kt.generated.username}
     password: ${kt.generated.password}
   Saved (hashed) to ${Bb()}. This password is shown once.
-`)}else console.warn("  ts-cloud dashboard: authentication is DISABLED (TS_CLOUD_DASHBOARD_AUTH=0). Every request runs as an admin.");let Ri=r!=="127.0.0.1"&&r!=="localhost",Al=(_)=>j_("sha256").update(`${mt}:${_}`).digest("hex").slice(0,16),bw=Ca({controlPlane:y.store,identities:yt,sources:Ke,applications:{drafts:jr,artifacts:Po,registries:Qn}}),zm=(_)=>_.headers.get("user-agent")?.trim().slice(0,256)||void 0,Pc=(_,Ne,Ue,Oe="local")=>_e.createSession({identityId:_,authMethod:Oe,userAgent:zm(Ne),networkHint:Al(Ue)}),qe=(_)=>{let Ne=y.store.getActorByExternalId("user",`dashboard:${_.username.toLowerCase()}`),Ue=Ne?y.store.getMembershipForActor(y.organization.id,Ne.id):void 0;return{actor:Ne,membership:Ue,grants:Ue?y.store.listGrants(Ue.id):[]}},_o=(_,Ne,Ue)=>{if(_.role==="admin")return!0;let Oe=y.store.getOperation(Ne),Ge=qe(_);if(!Oe||!Ge.membership)return!1;let bt=Oe.resourceId?{type:"resource",id:Oe.resourceId}:Oe.environmentId?{type:"environment",id:Oe.environmentId}:Oe.projectId?{type:"project",id:Oe.projectId}:{type:"organization"},B=y.store.resolveAuthorizationTarget(y.organization.id,bt);return!!B&&x({membership:Ge.membership,grants:Ge.grants,capability:Ue,target:B}).allowed},kr=(_,Ne,Ue)=>{if(_.role==="admin")return!0;let Oe=qe(_);if(!Oe.membership)return!1;let Ge=y.store.resolveAuthorizationTarget(y.organization.id,{type:"resource",id:Ne});return!!Ge&&x({membership:Oe.membership,grants:Oe.grants,capability:Ue,target:Ge}).allowed},qs=(_,Ne,Ue)=>{if(_.role==="admin")return!0;let Oe=qe(_);if(!Oe.membership)return!1;let Ge=y.store.resolveAuthorizationTarget(y.organization.id,{type:"environment",id:Ne});return!!Ge&&x({membership:Oe.membership,grants:Oe.grants,capability:Ue,target:Ge}).allowed},_c=(_,Ne)=>{if(_.role==="admin")return!0;let Ue=qe(_);if(!Ue.membership)return!1;let Oe=y.store.resolveAuthorizationTarget(y.organization.id,{type:"organization"});return!!Oe&&x({membership:Ue.membership,grants:Ue.grants,capability:Ne,target:Oe}).allowed},xo=Bun.serve({hostname:r,port:a,idleTimeout:30,websocket:{open(_){if(!se){_.send(`The web terminal is disabled (TS_CLOUD_DASHBOARD_TERMINAL=0).\r
+`)}else console.warn("  ts-cloud dashboard: authentication is DISABLED (TS_CLOUD_DASHBOARD_AUTH=0). Every request runs as an admin.");let Ri=r!=="127.0.0.1"&&r!=="localhost",Al=(_)=>j_("sha256").update(`${mt}:${_}`).digest("hex").slice(0,16),bw=Ca({controlPlane:y.store,identities:yt,sources:Ke,applications:{drafts:jr,artifacts:Po,registries:Qn}}),zm=(_)=>_.headers.get("user-agent")?.trim().slice(0,256)||void 0,Pc=(_,Ne,Ue,Oe="local")=>Pe.createSession({identityId:_,authMethod:Oe,userAgent:zm(Ne),networkHint:Al(Ue)}),qe=(_)=>{let Ne=y.store.getActorByExternalId("user",`dashboard:${_.username.toLowerCase()}`),Ue=Ne?y.store.getMembershipForActor(y.organization.id,Ne.id):void 0;return{actor:Ne,membership:Ue,grants:Ue?y.store.listGrants(Ue.id):[]}},_o=(_,Ne,Ue)=>{if(_.role==="admin")return!0;let Oe=y.store.getOperation(Ne),Ge=qe(_);if(!Oe||!Ge.membership)return!1;let bt=Oe.resourceId?{type:"resource",id:Oe.resourceId}:Oe.environmentId?{type:"environment",id:Oe.environmentId}:Oe.projectId?{type:"project",id:Oe.projectId}:{type:"organization"},B=y.store.resolveAuthorizationTarget(y.organization.id,bt);return!!B&&x({membership:Ge.membership,grants:Ge.grants,capability:Ue,target:B}).allowed},kr=(_,Ne,Ue)=>{if(_.role==="admin")return!0;let Oe=qe(_);if(!Oe.membership)return!1;let Ge=y.store.resolveAuthorizationTarget(y.organization.id,{type:"resource",id:Ne});return!!Ge&&x({membership:Oe.membership,grants:Oe.grants,capability:Ue,target:Ge}).allowed},qs=(_,Ne,Ue)=>{if(_.role==="admin")return!0;let Oe=qe(_);if(!Oe.membership)return!1;let Ge=y.store.resolveAuthorizationTarget(y.organization.id,{type:"environment",id:Ne});return!!Ge&&x({membership:Oe.membership,grants:Oe.grants,capability:Ue,target:Ge}).allowed},_c=(_,Ne)=>{if(_.role==="admin")return!0;let Ue=qe(_);if(!Ue.membership)return!1;let Oe=y.store.resolveAuthorizationTarget(y.organization.id,{type:"organization"});return!!Oe&&x({membership:Ue.membership,grants:Ue.grants,capability:Ne,target:Oe}).allowed},xo=Bun.serve({hostname:r,port:a,idleTimeout:30,websocket:{open(_){if(!se){_.send(`The web terminal is disabled (TS_CLOUD_DASHBOARD_TERMINAL=0).\r
 `),_.close();return}let Ne=OS((Ue)=>_.send(Ue),{cwd:t,onExit:()=>{try{_.close()}catch{}}});W.set(_,Ne),_.send(`Connected to ${r==="127.0.0.1"?"localhost":r} shell. This is a line-oriented shell (no full-screen apps).\r
-`)},message(_,Ne){W.get(_)?.write(typeof Ne==="string"?Ne:new TextDecoder().decode(Ne))},close(_){W.get(_)?.close(),W.delete(_)}},async fetch(_,Ne){let Ue=Date.now(),Oe=_.clone(),Ge=_.headers.get("x-request-id")?.slice(0,128)||crypto.randomUUID(),bt=!["GET","HEAD","OPTIONS"].includes(_.method.toUpperCase()),B=new URL(_.url),er=await(async()=>{let tt=Ne??xo,st=Z_(r,tt.port??a),_r=await bw(_,Al(tt.requestIP(_)?.address??"unknown"));if(_r)return _r;let mr=B.searchParams.get("env"),ke=eT(k,R,mr),qt=M.get(ke);if(!qt)qt=await ye(ke);try{if(!iT(_))return C({ok:!1,error:"Cross-site requests are not allowed."},403);let eo=/^\/api\/source\/webhooks\/([A-Za-z0-9_-]{16,200})$/.exec(B.pathname);if(eo&&_.method==="POST"){let w=await bu({sources:Ke,controlPlane:y.store,endpointToken:eo[1],headers:_.headers,rawBody:new Uint8Array(await _.arrayBuffer())});return C({accepted:w.accepted,duplicate:w.duplicate,status:w.status,operationIds:w.operations.map((E)=>E.id),message:w.message},w.accepted?202:404)}let Do=/^\/auth\/oidc\/([a-z0-9-]+)\/(start|callback)$/.exec(B.pathname);if(Do&&_.method==="GET"){let[,w,E]=Do;if(!st)return new Response(null,{status:302,headers:{location:"/login?sso_error=configuration"}});if(E==="start")try{let N=await pa(_e,w,st,B.searchParams.get("return")??void 0,e.oidcFetch);return new Response(null,{status:302,headers:{location:N.authorizationUrl,"cache-control":"no-store"}})}catch(N){return y.store.appendEvent({organizationId:y.organization.id,type:"auth.oidc.start_failed",level:"warning",payload:{provider:w,reason:N instanceof Error?N.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=start","cache-control":"no-store"}})}try{if(B.searchParams.has("error")){let H=_e.getOidcProviderBySlug(w),V=B.searchParams.get("state");if(H&&V)_e.consumeOidcTransaction(H.id,V);throw Error("OIDC provider returned an authorization error")}let N=await ma(_e,{providerSlug:w,state:B.searchParams.get("state")??"",code:B.searchParams.get("code")??"",origin:st},e.oidcFetch),j=qb(_e,y,t,N.identity);_e.recordLogin(j.identity.id);let q=Pc(j.identity.id,_,tt.requestIP(_)?.address??"unknown","oidc");return Ze(),y.store.appendEvent({organizationId:y.organization.id,actorId:j.identity.actorId,type:"auth.login.succeeded",payload:{method:"oidc",provider:w,provisioned:j.provisioned}}),new Response(null,{status:302,headers:{location:N.returnPath,"cache-control":"no-store","set-cookie":Ns(q.token,{secure:Ri,maxAgeMs:ot})}})}catch(N){return y.store.appendEvent({organizationId:y.organization.id,type:"auth.oidc.callback_failed",level:"warning",payload:{provider:w,reason:N instanceof Error?N.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=callback","cache-control":"no-store"}})}}if(B.pathname==="/api/invitations/accept"&&_.method==="POST"){let w=await X(_),E=String(w.token??"").trim(),N=String(w.username??"").trim(),j=String(w.password??"");if(!E||!il(N)||j.length<12)return C({ok:!1,error:"Invitation token, valid username, and a password of at least 12 characters are required."},422);let q=y.store.inspectInvitationToken(E);if(!q||q.state!=="pending")return C({ok:!1,error:q?`Invitation is ${q.state}`:"Invitation is invalid"},q?409:404);let H=Fn(en(t),N),V=_e.getIdentityByUsername(N);if(H&&!Gn(j,V?.passwordHash??H.passwordHash))return C({ok:!1,error:"That username already exists; enter its current password to continue."},401);let Y=_e.getIdentityByEmail(q.email);if(Y&&Y.id!==V?.id)return C({ok:!1,error:"This invitation belongs to an existing account. Sign in with that account or ask an owner to resend it."},409);let he=yc(t,{username:N,password:H?void 0:j,name:typeof w.name==="string"?w.name:void 0,email:q.email,sites:H?.sites??{}}),le=v(y.store,he.user);try{let Qe=y.store.acceptInvitation(E,le.id),Ie=V?_e.setVerifiedEmail(V.id,Qe.invitation.email):_e.createIdentity({actorId:le.id,username:he.user.username,email:Qe.invitation.email,emailVerified:!0,passwordHash:he.user.passwordHash}),We=Pc(Ie.id,_,tt.requestIP(_)?.address??"unknown");return Ze(),C({ok:!0,user:js(he.user),organization:y.organization,membership:Qe.membership},200,{"set-cookie":Ns(We.token,{secure:Ri,maxAgeMs:ot})})}catch(Qe){if(!H)cm(t,he.user.username);let Ie=Qe instanceof Error?Qe.message:"Invitation could not be accepted.";return C({ok:!1,error:Ie},Ie.includes("expired")||Ie.includes("revoked")||Ie.includes("accepted")?409:404)}}if(B.pathname==="/api/auth/password-reset/request"&&_.method==="POST"){let w=await X(_),E=String(w.identifier??"").trim().toLowerCase(),N=tt.requestIP(_)?.address??"unknown",j=Rl.check(E,N),q=E.includes("@")?_e.getIdentityByEmail(E):_e.getIdentityByUsername(E);if(j.allowed)Rl.recordFailure(E,N);if(j.allowed&&q?.email&&q.emailVerifiedAt&&!q.disabledAt){_e.revokeActionTokens(q.id,"password_reset");let H=_e.createActionToken(q.id,"password_reset"),V=`${B.origin}/reset-password?token=${encodeURIComponent(H.token)}`,Y=await Sn(f,{to:q.email,subject:"Reset your ts-cloud password",text:`Reset your ts-cloud password: ${V}
+`)},message(_,Ne){W.get(_)?.write(typeof Ne==="string"?Ne:new TextDecoder().decode(Ne))},close(_){W.get(_)?.close(),W.delete(_)}},async fetch(_,Ne){let Ue=Date.now(),Oe=_.clone(),Ge=_.headers.get("x-request-id")?.slice(0,128)||crypto.randomUUID(),bt=!["GET","HEAD","OPTIONS"].includes(_.method.toUpperCase()),B=new URL(_.url),er=await(async()=>{let tt=Ne??xo,st=Z_(r,tt.port??a),_r=await bw(_,Al(tt.requestIP(_)?.address??"unknown"));if(_r)return _r;let mr=B.searchParams.get("env"),Se=eT(k,R,mr),qt=M.get(Se);if(!qt)qt=await ye(Se);try{if(!iT(_))return C({ok:!1,error:"Cross-site requests are not allowed."},403);let eo=/^\/api\/source\/webhooks\/([A-Za-z0-9_-]{16,200})$/.exec(B.pathname);if(eo&&_.method==="POST"){let w=await bu({sources:Ke,controlPlane:y.store,endpointToken:eo[1],headers:_.headers,rawBody:new Uint8Array(await _.arrayBuffer())});return C({accepted:w.accepted,duplicate:w.duplicate,status:w.status,operationIds:w.operations.map((E)=>E.id),message:w.message},w.accepted?202:404)}let Do=/^\/auth\/oidc\/([a-z0-9-]+)\/(start|callback)$/.exec(B.pathname);if(Do&&_.method==="GET"){let[,w,E]=Do;if(!st)return new Response(null,{status:302,headers:{location:"/login?sso_error=configuration"}});if(E==="start")try{let N=await pa(Pe,w,st,B.searchParams.get("return")??void 0,e.oidcFetch);return new Response(null,{status:302,headers:{location:N.authorizationUrl,"cache-control":"no-store"}})}catch(N){return y.store.appendEvent({organizationId:y.organization.id,type:"auth.oidc.start_failed",level:"warning",payload:{provider:w,reason:N instanceof Error?N.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=start","cache-control":"no-store"}})}try{if(B.searchParams.has("error")){let H=Pe.getOidcProviderBySlug(w),V=B.searchParams.get("state");if(H&&V)Pe.consumeOidcTransaction(H.id,V);throw Error("OIDC provider returned an authorization error")}let N=await ma(Pe,{providerSlug:w,state:B.searchParams.get("state")??"",code:B.searchParams.get("code")??"",origin:st},e.oidcFetch),j=qb(Pe,y,t,N.identity);Pe.recordLogin(j.identity.id);let q=Pc(j.identity.id,_,tt.requestIP(_)?.address??"unknown","oidc");return Ze(),y.store.appendEvent({organizationId:y.organization.id,actorId:j.identity.actorId,type:"auth.login.succeeded",payload:{method:"oidc",provider:w,provisioned:j.provisioned}}),new Response(null,{status:302,headers:{location:N.returnPath,"cache-control":"no-store","set-cookie":Ns(q.token,{secure:Ri,maxAgeMs:ot})}})}catch(N){return y.store.appendEvent({organizationId:y.organization.id,type:"auth.oidc.callback_failed",level:"warning",payload:{provider:w,reason:N instanceof Error?N.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=callback","cache-control":"no-store"}})}}if(B.pathname==="/api/invitations/accept"&&_.method==="POST"){let w=await X(_),E=String(w.token??"").trim(),N=String(w.username??"").trim(),j=String(w.password??"");if(!E||!il(N)||j.length<12)return C({ok:!1,error:"Invitation token, valid username, and a password of at least 12 characters are required."},422);let q=y.store.inspectInvitationToken(E);if(!q||q.state!=="pending")return C({ok:!1,error:q?`Invitation is ${q.state}`:"Invitation is invalid"},q?409:404);let H=Fn(en(t),N),V=Pe.getIdentityByUsername(N);if(H&&!Gn(j,V?.passwordHash??H.passwordHash))return C({ok:!1,error:"That username already exists; enter its current password to continue."},401);let Y=Pe.getIdentityByEmail(q.email);if(Y&&Y.id!==V?.id)return C({ok:!1,error:"This invitation belongs to an existing account. Sign in with that account or ask an owner to resend it."},409);let ge=yc(t,{username:N,password:H?void 0:j,name:typeof w.name==="string"?w.name:void 0,email:q.email,sites:H?.sites??{}}),le=v(y.store,ge.user);try{let Qe=y.store.acceptInvitation(E,le.id),ke=V?Pe.setVerifiedEmail(V.id,Qe.invitation.email):Pe.createIdentity({actorId:le.id,username:ge.user.username,email:Qe.invitation.email,emailVerified:!0,passwordHash:ge.user.passwordHash}),We=Pc(ke.id,_,tt.requestIP(_)?.address??"unknown");return Ze(),C({ok:!0,user:js(ge.user),organization:y.organization,membership:Qe.membership},200,{"set-cookie":Ns(We.token,{secure:Ri,maxAgeMs:ot})})}catch(Qe){if(!H)cm(t,ge.user.username);let ke=Qe instanceof Error?Qe.message:"Invitation could not be accepted.";return C({ok:!1,error:ke},ke.includes("expired")||ke.includes("revoked")||ke.includes("accepted")?409:404)}}if(B.pathname==="/api/auth/password-reset/request"&&_.method==="POST"){let w=await X(_),E=String(w.identifier??"").trim().toLowerCase(),N=tt.requestIP(_)?.address??"unknown",j=Rl.check(E,N),q=E.includes("@")?Pe.getIdentityByEmail(E):Pe.getIdentityByUsername(E);if(j.allowed)Rl.recordFailure(E,N);if(j.allowed&&q?.email&&q.emailVerifiedAt&&!q.disabledAt){Pe.revokeActionTokens(q.id,"password_reset");let H=Pe.createActionToken(q.id,"password_reset"),V=`${B.origin}/reset-password?token=${encodeURIComponent(H.token)}`,Y=await Sn(f,{to:q.email,subject:"Reset your ts-cloud password",text:`Reset your ts-cloud password: ${V}
 
-This link expires in one hour and can be used once.`});y.store.appendEvent({organizationId:y.organization.id,actorId:q.actorId,type:"auth.password_reset.requested",payload:{delivered:Y}})}return C({ok:!0,message:"If that account has a verified email, a reset link has been sent."},202)}if(B.pathname==="/api/auth/password-reset/complete"&&_.method==="POST"){let w=await X(_),E=String(w.token??"").trim(),N=String(w.password??"");if(!E||N.length<12)return C({ok:!1,error:"A valid reset token and password of at least 12 characters are required."},422);try{let j=_e.consumeActionToken(E,"password_reset"),q=Ji(N),H=_e.updatePassword(j.identityId,q);return al(t,H.username,q),y.store.appendEvent({organizationId:y.organization.id,actorId:H.actorId,type:"auth.password_reset.completed"}),C({ok:!0,message:"Password changed. Sign in again."},200,{"set-cookie":rl({secure:Ri})})}catch(j){let q=j instanceof Error?j.message:"Password reset failed.";return C({ok:!1,error:q.replace("Action token","Reset link")},q.includes("consumed")||q.includes("expired")?409:404)}}if(B.pathname==="/api/login"&&_.method==="POST"){let w=await X(_),E=String(w.username??"").trim(),N=String(w.password??""),j=tt.requestIP(_)?.address??"unknown",q=Ac.check(E,j);if(!q.allowed)return C({ok:!1,error:`Too many failed attempts. Try again in ${Math.ceil((q.retryAfterSeconds??0)/60)} minute(s).`},429,{"retry-after":String(q.retryAfterSeconds??60)});let H=Fn(en(t),E),V=_e.getIdentityByUsername(E),Y=V?.passwordHash??H?.passwordHash??Y_;if(!(Gn(N,Y)&&!!H&&!!V&&!V.disabledAt))return Ac.recordFailure(E,j),C({ok:!1,error:"Incorrect username or password."},401);if(Vb(_e,y,V))return C({ok:!1,error:"Single sign-on is required for this account."},403);Ac.recordSuccess(E,j);let le=V,Qe=le.requiresPasswordUpgrade||nb(le.passwordHash);if(Qe){let We=Ji(N);le=_e.rehashPassword(le.id,We),al(t,le.username,We)}if(_e.recordLogin(le.id),_e.getMfaFactor(le.id)?.state==="active"){let We=_e.createMfaChallenge(le.id,"login");return y.store.appendEvent({organizationId:y.organization.id,actorId:le.actorId,type:"auth.mfa.challenge.created",payload:{purpose:"login"}}),C({ok:!0,mfaRequired:!0,challengeToken:We.token,passwordUpgraded:Qe})}let Ie=Pc(le.id,_,j);return y.store.appendEvent({organizationId:y.organization.id,actorId:le.actorId,type:"auth.login.succeeded",payload:{method:"local"}}),C({ok:!0,user:js(H),passwordUpgraded:Qe},200,{"set-cookie":Ns(Ie.token,{secure:Ri,maxAgeMs:ot})})}if(B.pathname==="/api/auth/mfa/complete"&&_.method==="POST"){let w=await X(_),E=String(w.challengeToken??"").trim(),N=String(w.code??"").trim(),j=tt.requestIP(_)?.address??"unknown",H=_e.inspectMfaChallengeToken(E,"login")?.identityId??"unknown-mfa",V=Cc.check(H,j);if(!V.allowed)return C({ok:!1,error:"Too many MFA attempts. Try again later."},429,{"retry-after":String(V.retryAfterSeconds??60)});try{let Y=_e.completeMfaChallenge(E,N,"login");Cc.recordSuccess(H,j);let he=new Date().toISOString(),le=_e.createSession({identityId:Y.identity.id,userAgent:zm(_),networkHint:Al(j),mfaAt:he,recentAuthAt:he});return y.store.appendEvent({organizationId:y.organization.id,actorId:Y.identity.actorId,type:"auth.mfa.succeeded",payload:{purpose:"login",method:Y.method}}),C({ok:!0},200,{"set-cookie":Ns(le.token,{secure:Ri,maxAgeMs:ot})})}catch{return Cc.recordFailure(H,j),C({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}}if(B.pathname==="/api/logout"&&_.method==="POST"){let w=Wt.resolveSession(_);if(w)_e.revokeSession(w.identityId,w.id);let E=rl({secure:Ri});if(_.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login","set-cookie":E}});return C({ok:!0},200,{"set-cookie":E})}if(B.pathname==="/login"){let w=_e.listOidcProviders(y.organization.id).map((E)=>({slug:E.slug,name:E.name}));return new Response(Wb(O?.mode==="serverless",w),{headers:{"content-type":"text/html; charset=utf-8"}})}if(B.pathname==="/forgot-password"||B.pathname==="/reset-password")return new Response(Hb(B.pathname==="/reset-password"?"reset":"request"),{headers:{"content-type":"text/html; charset=utf-8"}});if(B.pathname==="/accept-invitation")return ow(nt,B.pathname);let de=Wt.resolveUser(_);if(!de){if(!B.pathname.startsWith("/api/")&&_.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login"}});return C({ok:!1,error:"Sign in to continue."},401)}let gn=jt(de,ke);if(B.pathname==="/api/me"){let w=y.store.getActorByExternalId("user",`dashboard:${de.username.toLowerCase()}`),E=w?y.store.getMembershipForActor(y.organization.id,w.id):void 0,N=y.store.resolveAuthorizationTarget(y.organization.id,E?.scope??{type:"project",id:y.project.id})??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id});return C({ok:!0,user:js(de),authEnabled:Ce,organization:y.organization,membership:E,capabilities:ir({membership:E,grants:E?y.store.listGrants(E.id):[],target:N})})}if(B.pathname.startsWith("/api/")){let w=await zb(_,B.pathname),E=Wt.check(_,B.pathname,de,w);if(!E.ok)return C({ok:!1,error:E.error},E.status??403);if(Ce&&aT.has(`${_.method.toUpperCase()} ${B.pathname}`)){let N=Wt.resolveSession(_);if(!N||!_e.isRecentlyAuthenticated(N))return C({ok:!1,error:"Recent authentication is required for this change.",stepUpRequired:!0},401)}}if(B.pathname==="/api/auth/security"&&_.method==="GET"){let w=qe(de),E=w.actor?_e.getIdentityByActor(w.actor.id):void 0,N=Wt.resolveSession(_);return C({identity:E?{username:E.username,email:E.email,emailVerifiedAt:E.emailVerifiedAt,requiresPasswordUpgrade:E.requiresPasswordUpgrade,lastLoginAt:E.lastLoginAt}:void 0,currentSessionId:N?.id,sessions:E?_e.listSessions(E.id,{includeInactive:!0}):[],mfa:E?{factor:_e.getMfaFactor(E.id),recoveryCodesRemaining:_e.remainingRecoveryCodes(E.id)}:void 0})}if(B.pathname==="/api/auth/oidc/providers"&&_.method==="GET")return C({providers:_e.listOidcProviders(y.organization.id,{includeDisabled:!0}),callbackOrigin:st,callbackPattern:st?`${st}/auth/oidc/{slug}/callback`:void 0,localOwnerRecovery:!0});if(B.pathname==="/api/auth/oidc/providers"&&_.method==="POST"){let w=await X(_),E=qe(de),N=E.actor?_e.getIdentityByActor(E.actor.id):void 0,j=w.enforceSso===!0;if(j&&(!N?.emailVerifiedAt||_e.remainingRecoveryCodes(N.id)<1))return C({ok:!1,error:"Verify the owner email and generate MFA recovery codes before enforcing SSO."},409);try{let q=ml(w.defaultRole),H=_e.upsertOidcProvider({id:typeof w.id==="string"?w.id:void 0,organizationId:y.organization.id,slug:String(w.slug??""),name:String(w.name??""),issuer:String(w.issuer??""),clientId:String(w.clientId??""),clientSecret:typeof w.clientSecret==="string"&&w.clientSecret?w.clientSecret:void 0,scopes:Array.isArray(w.scopes)?w.scopes.map(String):void 0,allowedDomains:Array.isArray(w.allowedDomains)?w.allowedDomains.map(String):[],defaultRole:q&&q!=="owner"?q:void 0,enabled:w.enabled!==!1,enforceSso:j});return y.store.appendEvent({organizationId:y.organization.id,actorId:E.actor?.id,type:"auth.oidc.provider.configured",payload:{providerId:H.id,issuer:H.issuer,enabled:H.enabled,enforceSso:H.enforceSso}}),C({ok:!0,provider:H})}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"OIDC provider could not be saved."},422)}}if(B.pathname==="/api/auth/oidc/providers"&&_.method==="PATCH"){let w=await X(_),E=_e.getOidcProvider(String(w.id??""));if(!E||E.organizationId!==y.organization.id)return C({ok:!1,error:"OIDC provider was not found."},404);let N=qe(de),j=_e.setOidcProviderEnabled(E.id,w.enabled===!0);return y.store.appendEvent({organizationId:y.organization.id,actorId:N.actor?.id,type:j.enabled?"auth.oidc.provider.enabled":"auth.oidc.provider.disabled",payload:{providerId:E.id}}),C({ok:!0,provider:j})}if(B.pathname==="/api/automation"&&_.method==="GET"){let w=yt.listServiceAccounts(y.organization.id,{includeDisabled:!0}).map((E)=>{let N=y.store.getMembershipForActor(y.organization.id,E.actorId),j=E.createdByActorId?y.store.getActor(E.createdByActorId):void 0,q=yt.listTokens(E.id,{includeInactive:!0}).map((H)=>({...H,createdBy:H.createdByActorId?y.store.getActor(H.createdByActorId):void 0}));return{account:E,createdBy:j,membership:N,tokens:q}});return C({accounts:w,apiBaseUrl:`${B.origin}/api/v1`,openApiUrl:`${B.origin}/api/v1/openapi.json`,tokenEnvironmentVariable:"TS_CLOUD_API_TOKEN"})}if(B.pathname==="/api/automation/service-accounts"&&_.method==="POST"){let w=await X(_),E=qe(de),N=ml(w.roleTemplate),j=kc(w);if(!E.actor||!N||N==="owner"||!j)return C({ok:!1,error:"A non-owner role and valid organization scope are required."},422);try{let q=yt.createServiceAccount({organizationId:y.organization.id,slug:String(w.slug??""),name:String(w.name??""),description:typeof w.description==="string"?w.description:void 0,roleTemplate:N,scope:j,createdByActorId:E.actor.id});return C({ok:!0,...q},201)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"Service account could not be created."},422)}}if(B.pathname==="/api/automation/service-accounts"&&_.method==="PATCH"){let w=await X(_),E=qe(de),N=yt.getServiceAccount(String(w.id??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Service account was not found."},404);return C({ok:!0,account:yt.disableServiceAccount(N.id,E.actor?.id)})}if(B.pathname==="/api/automation/tokens"&&_.method==="POST"){let w=await X(_),E=qe(de),N=yt.getServiceAccount(String(w.serviceAccountId??"")),j=kc(w);if(!E.actor||!N||N.organizationId!==y.organization.id||!j||!Array.isArray(w.capabilities))return C({ok:!1,error:"Service account, explicit capabilities, and valid scope are required."},422);try{let q=yt.createToken({serviceAccountId:N.id,name:String(w.name??"API token"),capabilities:w.capabilities.map(String),scope:j,expiresAt:typeof w.expiresAt==="string"?w.expiresAt:void 0,createdByActorId:E.actor.id});return C({ok:!0,token:q.token,secret:q.secret,revealOnce:!0},201)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"API token could not be created."},422)}}if(B.pathname==="/api/automation/tokens/rotate"&&_.method==="POST"){let w=await X(_),E=qe(de),N=yt.getToken(String(w.id??"")),j=N?yt.getServiceAccount(N.serviceAccountId):void 0;if(!E.actor||!N||j?.organizationId!==y.organization.id)return C({ok:!1,error:"API token was not found."},404);try{let q=yt.rotateToken(N.id,E.actor.id);return C({ok:!0,token:q.token,secret:q.secret,revealOnce:!0,overlap:!0},201)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"API token could not be rotated."},409)}}if(B.pathname==="/api/automation/tokens"&&_.method==="DELETE"){let w=await X(_),E=qe(de),N=yt.getToken(String(w.id??"")),j=N?yt.getServiceAccount(N.serviceAccountId):void 0;if(!N||j?.organizationId!==y.organization.id)return C({ok:!1,error:"API token was not found."},404);return C({ok:!0,token:yt.revokeToken(N.id,E.actor?.id)})}if(B.pathname==="/api/onboarding"&&_.method==="GET"){let w=Ke.listConnections(y.organization.id);return C({drafts:jr.list(y.project.id),artifacts:Po.list(y.project.id),registries:Qn.list(y.organization.id),sourceConnections:w,repositories:w.flatMap((E)=>Ke.listRepositories(E.id)),project:{id:y.project.id,slug:y.project.slug,name:y.project.name},environments:[...y.environments.values()].map((E)=>({id:E.id,slug:E.slug,name:E.name,kind:E.kind,region:E.region})),resources:y.store.listResources(y.project.id).filter((E)=>E.kind==="application").map((E)=>({id:E.id,slug:E.slug,name:E.name,environmentId:E.environmentId}))})}if(B.pathname==="/api/onboarding/detect"&&_.method==="POST"){let w=await X(_);try{if(w.source?.kind==="git"){let j=Ke.getConnection(String(w.source.connectionId??"")),q=Ke.getRepository(String(w.source.repositoryId??""));if(!j||j.organizationId!==y.organization.id||!q||q.connectionId!==j.id)throw Error("Authorized Git repository was not found");let H=typeof w.source.deployKeyId==="string"?Ke.getDeployKey(w.source.deployKeyId):void 0;if(H&&H.connectionId!==j.id)throw Error("Deploy key does not belong to this connection");let V=Im(xt(vl(),"ts-cloud-onboarding-git-"));try{let Y=await Sa({remote:q.cloneUrl,destination:xt(V,"checkout"),ref:String(w.source.ref??q.defaultBranch),sparsePaths:Array.isArray(w.source.sparsePaths)?w.source.sparsePaths.map(String):void 0,binding:{id:"detection",projectId:y.project.id,connectionId:j.id,repositoryId:q.id,repositoryFullName:q.fullName,defaultBranch:q.defaultBranch,monorepoRoot:String(w.source.monorepoRoot??"."),includePaths:[],excludePaths:[],submodules:w.source.submodules===!0,cloneDepth:1,deployKeyId:H?.id,autoDeploy:!1,pullRequestPreviews:!1,status:"active",version:1,createdAt:new Date().toISOString(),updatedAt:new Date().toISOString()}},{credential:Ke.getCredential(j.id),deployKey:H?{...H,privateKey:Ke.getDeployPrivateKey(H.id)}:void 0,timeoutMs:120000});return C({ok:!0,commitSha:Y.commitSha,candidates:Yo(Rp(Y.directory))})}finally{Ao(V,{recursive:!0,force:!0})}}if(Array.isArray(w.files)){if(w.files.length>1e4)throw Error("Detection file-count limit exceeded");let j=w.files.map((q)=>({path:String(q.path??""),size:Number(q.size??0),content:typeof q.content==="string"?q.content.slice(0,262144):void 0}));return C({ok:!0,candidates:Yo(j)})}let E=F_(t,String(w.root??".")),N=L_(t,E);if(N===".."||N.startsWith(`..${z_}`))throw Error("Detection root must stay inside the project");return C({ok:!0,candidates:Yo(Rp(E))})}catch(E){return C({ok:!1,error:E instanceof Error?E.message:"Application detection failed."},422)}}if(B.pathname==="/api/onboarding/plan"&&_.method==="POST"){let w=await X(_);try{return C({ok:!0,plan:Wn(w.draft,Array.isArray(w.suppliedSecretNames)?w.suppliedSecretNames.map(String):[])})}catch(E){return C({ok:!1,error:E instanceof Error?E.message:"Application plan could not be generated."},422)}}if(B.pathname==="/api/onboarding/drafts"&&_.method==="POST"){let w=await X(_),E=qe(de);try{return C({ok:!0,draft:jr.create({organizationId:y.organization.id,projectId:y.project.id,name:String(w.name??w.draft?.name??"Application draft"),draft:{...w.draft,projectId:y.project.id},step:w.step,suppliedSecretNames:Array.isArray(w.suppliedSecretNames)?w.suppliedSecretNames.map(String):[],actorId:E.actor?.id})},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Application draft could not be saved."},422)}}if(B.pathname==="/api/onboarding/drafts"&&_.method==="PATCH"){let w=await X(_),E=qe(de),N=jr.get(String(w.id??""));if(!N||N.projectId!==y.project.id)return C({ok:!1,error:"Application draft was not found."},404);try{return C({ok:!0,draft:jr.update(N.id,Number(w.version),{draft:{...w.draft,projectId:y.project.id},step:w.step,suppliedSecretNames:Array.isArray(w.suppliedSecretNames)?w.suppliedSecretNames.map(String):void 0,actorId:E.actor?.id})})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Application draft could not be updated."},409)}}if(B.pathname==="/api/onboarding/artifacts"&&_.method==="POST"){let w=qe(de);if(Number(_.headers.get("content-length")??0)>104857600)return C({ok:!1,error:"Artifact exceeds the 100 MB upload limit."},413);try{let N=new Uint8Array(await _.arrayBuffer());return C({ok:!0,artifact:Po.create({organizationId:y.organization.id,projectId:y.project.id,filename:_.headers.get("x-artifact-filename")??"application.zip",bytes:N,actorId:w.actor?.id})},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Artifact could not be inspected."},422)}}if(B.pathname==="/api/onboarding/registries"&&_.method==="POST"){let w=await X(_),E=qe(de);try{return C({ok:!0,registry:Qn.create({organizationId:y.organization.id,provider:w.provider,name:String(w.name??"Container registry"),host:String(w.host??""),credential:w.token||w.password?{username:typeof w.username==="string"?w.username:void 0,password:typeof w.password==="string"?w.password:void 0,token:typeof w.token==="string"?w.token:void 0}:void 0,credentialExpiresAt:typeof w.credentialExpiresAt==="string"?w.credentialExpiresAt:void 0,actorId:E.actor?.id})},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Registry connection could not be created."},422)}}if(B.pathname==="/api/onboarding/registries"&&_.method==="PATCH"){let w=await X(_),E=qe(de),N=Qn.get(String(w.id??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Registry connection was not found."},404);try{if(w.action==="test")return C({ok:!0,registry:await Qn.test(N.id,{image:typeof w.image==="string"?w.image:void 0})});if(w.action==="rotate")return C({ok:!0,registry:Qn.rotate(N.id,{username:typeof w.username==="string"?w.username:void 0,password:typeof w.password==="string"?w.password:void 0,token:typeof w.token==="string"?w.token:void 0},{expiresAt:typeof w.expiresAt==="string"?w.expiresAt:void 0,actorId:E.actor?.id})});return C({ok:!1,error:"Registry action must be test or rotate."},422)}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Registry connection could not be updated."},422)}}if(B.pathname==="/api/onboarding/registries"&&_.method==="DELETE"){let w=await X(_),E=qe(de),N=Qn.get(String(w.id??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Registry connection was not found."},404);let j=jr.list(y.project.id).filter((q)=>q.input.source.kind==="image"&&q.input.source.registryConnectionId===N.id||q.input.build.kind==="prebuilt_image"&&q.input.build.registryConnectionId===N.id);if(w.preview===!0)return C({ok:!0,preview:!0,affectedDrafts:j});return C({ok:!0,registry:Qn.disconnect(N.id,E.actor?.id),affectedDrafts:j})}if(B.pathname==="/api/onboarding/apply"&&_.method==="POST"){let w=await X(_),E=qe(de);try{let N=hd({controlPlane:y.store,drafts:jr,draftId:String(w.id??""),expectedVersion:Number(w.version),confirmEnvironment:String(w.confirmEnvironment??""),actorId:E.actor?.id});return C({ok:!0,resource:N.resource,operation:N.operation,plan:N.plan},202)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Application plan could not be applied."},422)}}if(B.pathname==="/api/sources"&&_.method==="GET"){let w=Ke.listConnections(y.organization.id);return C({connections:w,bindings:Ke.listBindings({projectId:y.project.id}),repositories:w.flatMap((E)=>Ke.listRepositories(E.id)),deployKeys:w.flatMap((E)=>Ke.listDeployKeys(E.id)),webhooks:w.flatMap((E)=>Ke.listWebhooks(E.id)).map((E)=>({...E,deliveries:Ke.listDeliveries(E.id,20)})),project:{id:y.project.id,slug:y.project.slug},environment:ge(y,String(ke)),resources:y.store.listResources(y.project.id,ge(y,String(ke)).environmentId).filter((E)=>E.kind==="application").map((E)=>({id:E.id,slug:E.slug,name:E.name}))})}if(B.pathname==="/api/sources/connections"&&_.method==="POST"){let w=await X(_),E=qe(de),N=String(w.provider??"");if(!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(N))return C({ok:!1,error:"A supported Git provider is required."},422);try{let j=N==="github"&&(w.privateKey||w.appId)?{appId:typeof w.appId==="string"?w.appId:void 0,installationId:typeof w.installationId==="string"?w.installationId:void 0,privateKey:typeof w.privateKey==="string"?w.privateKey:void 0}:N!=="generic_ssh"&&w.token?{token:typeof w.token==="string"?w.token:void 0,username:typeof w.username==="string"?w.username:void 0}:void 0,q={github:"https://github.com",gitlab:"https://gitlab.com",bitbucket:"https://bitbucket.org",gitea:"https://gitea.com"},H,V,Y;if(y.store.database.transaction(()=>{if(H=Ke.createConnection({organizationId:y.organization.id,provider:N,name:String(w.name??N),host:String(w.host??q[N]??""),owner:typeof w.owner==="string"?w.owner:void 0,authKind:w.authKind,credential:j,grantedScopes:Array.isArray(w.grantedScopes)?w.grantedScopes.map(String):[],credentialExpiresAt:typeof w.credentialExpiresAt==="string"?w.credentialExpiresAt:void 0,createdByActorId:E.actor?.id}),typeof w.repositoryUrl==="string"&&typeof w.repositoryFullName==="string")V=Ke.upsertRepository({connectionId:H.id,providerRepositoryId:`manual:${w.repositoryFullName}`,fullName:w.repositoryFullName,cloneUrl:w.repositoryUrl,defaultBranch:String(w.defaultBranch??"main"),visibility:"unknown",archived:!1,metadata:{source:"manual"}});if(N==="generic_ssh")Y=Ke.createDeployKey({connectionId:H.id,name:String(w.deployKeyName??"Repository deploy key"),publicKey:String(w.publicKey??""),privateKey:String(w.deployPrivateKey??""),host:String(w.sshHost??""),hostKey:String(w.hostKey??""),actorId:E.actor?.id})})(),w.test===!0)H=await Ia(Ke,H.id,V?.id);return C({ok:!0,connection:H,repository:V,deployKey:Y},201)}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Source connection could not be created."},422)}}if(B.pathname==="/api/sources/connections"&&_.method==="PATCH"){let w=await X(_),E=qe(de),N=Ke.getConnection(String(w.id??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);try{if(w.action==="test")return C({ok:!0,connection:await Ia(Ke,N.id,typeof w.repositoryId==="string"?w.repositoryId:void 0)});if(w.action==="rotate")return C({ok:!0,connection:Ke.rotateCredential(N.id,{token:typeof w.token==="string"?w.token:void 0,username:typeof w.username==="string"?w.username:void 0,appId:typeof w.appId==="string"?w.appId:void 0,installationId:typeof w.installationId==="string"?w.installationId:void 0,privateKey:typeof w.privateKey==="string"?w.privateKey:void 0},{expiresAt:typeof w.expiresAt==="string"?w.expiresAt:void 0,actorId:E.actor?.id})});return C({ok:!1,error:"Connection action must be test or rotate."},422)}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Source connection could not be updated."},422)}}if(B.pathname==="/api/sources/connections"&&_.method==="DELETE"){let w=await X(_),E=qe(de),N=Ke.getConnection(String(w.id??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);let j=Ke.listBindings({connectionId:N.id,status:"active"});if(w.preview===!0)return C({ok:!0,preview:!0,affectedBindings:j});return C({ok:!0,...Ke.disconnectConnection(N.id,E.actor?.id)})}if(B.pathname==="/api/sources/deploy-keys"&&_.method==="POST"){let w=await X(_),E=qe(de),N=Ke.getConnection(String(w.connectionId??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);try{return C({ok:!0,deployKey:Ke.createDeployKey({connectionId:N.id,name:String(w.name??"Repository deploy key"),publicKey:String(w.publicKey??""),privateKey:String(w.privateKey??""),host:String(w.host??""),hostKey:String(w.hostKey??""),actorId:E.actor?.id})},201)}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Deploy key could not be stored."},422)}}if(B.pathname==="/api/sources/deploy-keys"&&_.method==="DELETE"){let w=await X(_),E=qe(de),N=Ke.getDeployKey(String(w.id??"")),j=N?Ke.getConnection(N.connectionId):void 0;if(!N||!j||j.organizationId!==y.organization.id)return C({ok:!1,error:"Deploy key was not found."},404);let q=Ke.listBindings({connectionId:j.id}).filter((H)=>H.deployKeyId===N.id);if(w.preview===!0)return C({ok:!0,preview:!0,affectedBindings:q});return C({ok:!0,...Ke.revokeDeployKey(N.id,E.actor?.id)})}if(B.pathname==="/api/sources/repositories/sync"&&_.method==="POST"){let w=await X(_),E=Ke.getConnection(String(w.connectionId??""));if(!E||E.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);try{return C({ok:!0,repositories:await gs(Ke,String(w.connectionId??""),{search:typeof w.search==="string"?w.search:void 0})})}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Repositories could not be synchronized."},422)}}if(B.pathname==="/api/sources/references"&&_.method==="GET"){let w=Ke.getConnection(String(B.searchParams.get("connectionId")??""));if(!w||w.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);try{return C(await ps(Ke,{connectionId:String(B.searchParams.get("connectionId")??""),repository:String(B.searchParams.get("repository")??""),repositoryId:B.searchParams.get("repositoryId")??void 0,deployKeyId:B.searchParams.get("deployKeyId")??void 0,type:B.searchParams.get("type")==="tags"?"tags":"branches",cursor:B.searchParams.get("cursor")??void 0}))}catch(E){return C({ok:!1,error:E instanceof Error?E.message:"References could not be listed."},422)}}if(B.pathname==="/api/sources/bindings"&&_.method==="POST"){let w=await X(_),E=qe(de),N=ge(y,String(ke)),j=Ke.getConnection(String(w.connectionId??""));if(!j||j.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);try{return C({ok:!0,binding:Ke.createBinding({projectId:y.project.id,environmentId:N.environmentId,resourceId:typeof w.resourceId==="string"?w.resourceId:void 0,connectionId:String(w.connectionId??""),repositoryId:typeof w.repositoryId==="string"?w.repositoryId:void 0,repositoryFullName:String(w.repositoryFullName??""),defaultBranch:String(w.defaultBranch??"main"),branchRule:typeof w.branchRule==="string"?w.branchRule:void 0,tagRule:typeof w.tagRule==="string"?w.tagRule:void 0,monorepoRoot:String(w.monorepoRoot??"."),includePaths:Array.isArray(w.includePaths)?w.includePaths.map(String):[],excludePaths:Array.isArray(w.excludePaths)?w.excludePaths.map(String):[],submodules:w.submodules===!0,cloneDepth:w.cloneDepth?Number(w.cloneDepth):void 0,deployKeyId:typeof w.deployKeyId==="string"&&w.deployKeyId?w.deployKeyId:void 0,autoDeploy:w.autoDeploy!==!1,pullRequestPreviews:w.pullRequestPreviews!==!1,actorId:E.actor?.id})},201)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"Source binding could not be created."},422)}}if(B.pathname==="/api/sources/bindings"&&_.method==="PATCH"){let w=await X(_),E=qe(de),N=Ke.getBinding(String(w.id??""));if(!N||N.projectId!==y.project.id)return C({ok:!1,error:"Source binding was not found."},404);try{return C({ok:!0,binding:Ke.updateBinding(N.id,Number(w.version),{defaultBranch:w.defaultBranch,branchRule:w.branchRule,tagRule:w.tagRule,monorepoRoot:w.monorepoRoot,includePaths:w.includePaths,excludePaths:w.excludePaths,submodules:w.submodules,cloneDepth:w.cloneDepth,deployKeyId:w.deployKeyId,autoDeploy:w.autoDeploy,pullRequestPreviews:w.pullRequestPreviews,status:w.status,disabledReason:w.disabledReason,actorId:E.actor?.id})})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Source binding could not be updated."},409)}}if(B.pathname==="/api/sources/webhooks"&&_.method==="POST"){let w=await X(_),E=Ke.getConnection(String(w.connectionId??""));if(!E||E.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);try{let N=Ke.createWebhook({connectionId:String(w.connectionId??""),repositoryId:typeof w.repositoryId==="string"?w.repositoryId:void 0,repositoryFullName:String(w.repositoryFullName??""),events:Array.isArray(w.events)?w.events.map(String):void 0,secret:typeof w.secret==="string"?w.secret:void 0}),j=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||st,q=j?Sr(j,N.webhook):void 0,H=w.reconcile!==!1&&j?await bn(Ke,N.webhook.id,j):N.webhook;return C({ok:!0,webhook:H,endpoint:q,endpointRevealOnce:!0},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Source webhook could not be created."},422)}}if(B.pathname==="/api/sources/webhooks"&&_.method==="PATCH"){let w=await X(_),E=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||st,N=Ke.getWebhook(String(w.id??"")),j=N?Ke.getConnection(N.connectionId):void 0;if(!N||!j||j.organizationId!==y.organization.id)return C({ok:!1,error:"Source webhook was not found."},404);if(!E)return C({ok:!1,error:"Set TS_CLOUD_WEBHOOK_BASE_URL to reconcile provider webhooks."},422);try{return C({ok:!0,webhook:await bn(Ke,String(w.id??""),E)})}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"Source webhook could not be reconciled."},422)}}if(B.pathname==="/api/sources/webhooks"&&_.method==="DELETE"){let w=await X(_),E=Ke.getWebhook(String(w.id??"")),N=E?Ke.getConnection(E.connectionId):void 0;if(!E||!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Source webhook was not found."},404);try{return C({ok:!0,webhook:await Cu(Ke,String(w.id??""))})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Source webhook could not be removed."},422)}}if(B.pathname==="/api/security/posture"&&_.method==="GET"){let w=ge(y,String(ke)),E=it.listFindings({...w,limit:500});return C({scope:w,summary:it.summary(w.organizationId,w.projectId,w.environmentId),findings:E,scans:it.listScanRuns({...w,limit:100}),policies:it.listPolicies(w.organizationId).filter((N)=>!N.environmentId||N.environmentId===w.environmentId),waivers:E.flatMap((N)=>it.listWaivers(N.id)),decisions:it.listDecisions(w.environmentId,50),actors:y.store.listMemberships(y.organization.id).map((N)=>y.store.getActor(N.actorId)).filter(Boolean)})}if(B.pathname==="/api/security/export"&&_.method==="GET")return C(it.exportPosture(y.organization.id));if(B.pathname==="/api/security/scan"&&_.method==="POST"){let w=ge(y,String(ke)),E=await new Lt(it).run(new vn,{...w,artifactRoot:t}),N=fs(it,w,qt??{});return C({ok:!0,source:E,host:N,summary:it.summary(w.organizationId,w.projectId,w.environmentId)})}if(B.pathname==="/api/security/review"&&_.method==="POST")try{let w=ge(y,String(ke));return C({ok:!0,...hs(it,{scope:w,desiredConfigHash:y.project.desiredConfigHash})})}catch(w){return C({ok:!1,error:w instanceof Error?w.message:"Security change review failed."},409)}if(B.pathname==="/api/security/policies"&&_.method==="POST"){let w=await X(_),E=qe(de);if(!E.actor)return C({ok:!1,error:"An organization actor is required."},403);try{let N=it.createPolicy({organizationId:y.organization.id,environmentId:w.environmentId===null?void 0:String(w.environmentId??ge(y,String(ke)).environmentId),name:String(w.name??""),scannerFailMode:w.scannerFailMode==="open"?"open":"closed",requiredScanners:Array.isArray(w.requiredScanners)?w.requiredScanners.map(String):[],rules:Array.isArray(w.rules)?w.rules.map((j)=>({minimumSeverity:String(j.minimumSeverity),action:String(j.action),scannerId:j.scannerId?String(j.scannerId):void 0})):[],actorId:E.actor.id});return C({ok:!0,policy:N},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Security policy could not be created."},422)}}if(B.pathname==="/api/security/policies"&&_.method==="PATCH"){let w=await X(_),E=qe(de),N=it.getPolicy(String(w.id??""));if(!E.actor||!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Security policy was not found."},404);try{return C({ok:!0,policy:it.updatePolicy(N.id,Number(w.version),{name:typeof w.name==="string"?w.name:void 0,scannerFailMode:w.scannerFailMode==="open"||w.scannerFailMode==="closed"?w.scannerFailMode:void 0,requiredScanners:Array.isArray(w.requiredScanners)?w.requiredScanners.map(String):void 0,rules:Array.isArray(w.rules)?w.rules.map((j)=>({minimumSeverity:String(j.minimumSeverity),action:String(j.action),scannerId:j.scannerId?String(j.scannerId):void 0})):void 0,enabled:typeof w.enabled==="boolean"?w.enabled:void 0,actorId:E.actor.id})})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Security policy could not be updated."},409)}}if(B.pathname==="/api/security/waivers"&&_.method==="POST"){let w=await X(_),E=qe(de);if(!E.actor)return C({ok:!1,error:"An organization actor is required."},403);try{return C({ok:!0,waiver:it.createWaiver({findingId:String(w.findingId??""),policyId:typeof w.policyId==="string"?w.policyId:void 0,reason:String(w.reason??""),referenceUrl:typeof w.referenceUrl==="string"?w.referenceUrl:void 0,expiresAt:String(w.expiresAt??""),actorId:E.actor.id})},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Security waiver could not be created."},422)}}if(B.pathname==="/api/security/waivers"&&_.method==="DELETE"){let w=await X(_),E=qe(de);if(!E.actor)return C({ok:!1,error:"An organization actor is required."},403);try{return C({ok:!0,waiver:it.revokeWaiver(String(w.id??""),E.actor.id)})}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Security waiver could not be revoked."},404)}}if(B.pathname==="/api/security/findings"&&_.method==="PATCH"){let w=await X(_),E=qe(de),N=it.getFinding(String(w.id??""));if(!E.actor||!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Security finding was not found."},404);try{let j=w.action==="acknowledge"?it.acknowledgeFinding(N.id,E.actor.id):it.assignFinding(N.id,typeof w.ownerActorId==="string"&&w.ownerActorId?w.ownerActorId:void 0,E.actor.id);return C({ok:!0,finding:j})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Security finding could not be updated."},422)}}if(B.pathname==="/api/security/comments"&&_.method==="POST"){let w=await X(_),E=qe(de);if(!E.actor)return C({ok:!1,error:"An organization actor is required."},403);try{return C({ok:!0,comment:it.addComment({findingId:String(w.findingId??""),actorId:E.actor.id,body:String(w.body??""),referenceUrl:typeof w.referenceUrl==="string"?w.referenceUrl:void 0})},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Comment could not be saved."},422)}}if(B.pathname==="/api/auth/sessions"&&_.method==="GET"){let w=Wt.resolveSession(_);return C({currentSessionId:w?.id,sessions:w?_e.listSessions(w.identityId,{includeInactive:!0}):[]})}if(B.pathname==="/api/auth/sessions"&&_.method==="DELETE"){let w=await X(_),E=Wt.resolveSession(_);if(!E)return C({ok:!1,error:"Sign in again to manage sessions."},401);let N=String(w.id??""),j=_e.revokeSession(E.identityId,N),q=N===E.id&&j?{"set-cookie":rl({secure:Ri})}:void 0;return C({ok:j,signedOut:N===E.id&&j},j?200:404,q)}if(B.pathname==="/api/auth/sessions/revoke-others"&&_.method==="POST"){let w=Wt.resolveSession(_);if(!w)return C({ok:!1,error:"Sign in again to manage sessions."},401);return C({ok:!0,revoked:_e.revokeOtherSessions(w.identityId,w.id)})}if(B.pathname==="/api/auth/password/change"&&_.method==="POST"){let w=await X(_),E=String(w.currentPassword??""),N=String(w.password??""),j=qe(de),q=j.actor?_e.getIdentityByActor(j.actor.id):void 0;if(!q||!Gn(E,q.passwordHash))return C({ok:!1,error:"Current password is incorrect."},401);if(N.length<12)return C({ok:!1,error:"New password must be at least 12 characters."},422);if(Gn(N,q.passwordHash))return C({ok:!1,error:"Choose a different password."},409);let H=Ji(N),V=_e.updatePassword(q.id,H);al(t,V.username,H);let Y=Pc(V.id,_,tt.requestIP(_)?.address??"unknown");return y.store.appendEvent({organizationId:y.organization.id,actorId:V.actorId,type:"auth.password.changed"}),C({ok:!0,message:"Password changed and other sessions were signed out."},200,{"set-cookie":Ns(Y.token,{secure:Ri,maxAgeMs:ot})})}if(B.pathname==="/api/auth/mfa/enroll"&&_.method==="POST"){let w=await X(_),E=Wt.resolveSession(_),N=qe(de),j=N.actor?_e.getIdentityByActor(N.actor.id):void 0;if(!E||!j)return C({ok:!1,error:"Sign in again before enabling MFA."},401);if(!Gn(String(w.password??""),j.passwordHash))return C({ok:!1,error:"Current password is incorrect."},401);try{let q=_e.beginTotpEnrollment(j.id,{issuer:y.organization.name});return y.store.appendEvent({organizationId:y.organization.id,actorId:j.actorId,type:"auth.mfa.enrollment.started"}),C({factor:q.factor,secret:q.secret,uri:q.uri})}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"MFA enrollment failed."},409)}}if(B.pathname==="/api/auth/mfa/verify"&&_.method==="POST"){let w=await X(_),E=Wt.resolveSession(_),N=qe(de),j=N.actor?_e.getIdentityByActor(N.actor.id):void 0;if(!E||!j)return C({ok:!1,error:"Sign in again before enabling MFA."},401);try{let q=_e.verifyTotpEnrollment(j.id,String(w.code??""));return _e.markSessionStepUp(E.id,!0),y.store.appendEvent({organizationId:y.organization.id,actorId:j.actorId,type:"auth.mfa.enabled",payload:{recoveryCodeCount:q.recoveryCodes.length}}),C(q)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"MFA enrollment failed."},422)}}if(B.pathname==="/api/auth/mfa"&&_.method==="DELETE"){let w=await X(_),E=Wt.resolveSession(_),N=qe(de),j=N.actor?_e.getIdentityByActor(N.actor.id):void 0;if(!E||!j||!Gn(String(w.password??""),j.passwordHash))return C({ok:!1,error:"Current password is incorrect."},401);let q=_e.verifyMfaCode(j.id,String(w.code??""));if(!q.valid||!q.method)return C({ok:!1,error:"Authenticator or recovery code is incorrect."},401);return _e.disableMfa(j.id),_e.revokeOtherSessions(j.id,E.id),_e.markSessionStepUp(E.id),y.store.appendEvent({organizationId:y.organization.id,actorId:j.actorId,type:"auth.mfa.disabled",payload:{method:q.method}}),C({ok:!0})}if(B.pathname==="/api/auth/step-up"&&_.method==="POST"){let w=await X(_),E=Wt.resolveSession(_),N=qe(de),j=N.actor?_e.getIdentityByActor(N.actor.id):void 0;if(!E||!j||!Gn(String(w.password??""),j.passwordHash))return C({ok:!1,error:"Current password is incorrect."},401);let q=_e.getMfaFactor(j.id);if(q?.state==="active"){if(!_e.verifyMfaCode(j.id,String(w.code??"")).valid)return C({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}let H=_e.markSessionStepUp(E.id,q?.state==="active");return y.store.appendEvent({organizationId:y.organization.id,actorId:j.actorId,type:"auth.step_up.succeeded",payload:{mfa:q?.state==="active"}}),C({ok:!0,recentAuthAt:H.recentAuthAt})}if(B.pathname==="/api/terminal"){if(!se)return C({ok:!1,error:"The web terminal is disabled."},403);if(tt.upgrade(_))return;return bl("WebSocket upgrade failed",400)}if(B.pathname==="/api/health"){let w=y.store.health();return C({ok:!0,cwd:t,environment:ke,environments:k,uiRoot:await Bt(de,ke),liveData:ee.size>0,terminal:se,localPackage:import.meta.url.includes("/Code/Libraries/ts-cloud/"),controlPlane:{schemaVersion:w.schemaVersion,supportedSchemaVersion:w.supportedSchemaVersion,integrity:w.integrity,pendingRetryableOperations:w.pendingRetryableOperations}})}if(B.pathname==="/api/control-plane/operations"){let w=B.searchParams.get("state"),E=w&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(w)?w:void 0;return C({operations:y.store.listOperations({projectId:y.project.id,state:E,kind:B.searchParams.get("kind")??void 0,limit:Number(B.searchParams.get("limit"))||100})})}if(B.pathname==="/api/queue"&&_.method==="GET"){let w=B.searchParams.get("state"),E=w&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(w)?w:void 0,N=Dt.list({projectId:y.project.id,state:E,limit:Number(B.searchParams.get("limit"))||250}).filter((j)=>_o(de,j.operation.id,"deployments:read")).map((j)=>{let q=j.operation.resourceId?y.store.getResource(j.operation.resourceId):void 0,H=j.operation.environmentId?y.store.listEnvironments(y.project.id).find((he)=>he.id===j.operation.environmentId):void 0,V=j.operation.actorId?y.store.getActor(j.operation.actorId):void 0,Y=j.operation.input;return{...j,target:q?{id:q.id,name:q.name,slug:q.slug,kind:q.kind}:H?{id:H.id,name:H.name,slug:H.slug,kind:"environment"}:{id:y.project.id,name:y.project.name,slug:y.project.slug,kind:"project"},actor:V?{id:V.id,name:V.displayName,kind:V.kind}:void 0,commit:Y.revision??Y.source?.commitSha??null}});return C({operations:N,concurrency:Dt.limits})}if(B.pathname==="/api/queue/logs"&&_.method==="GET"){let w=String(B.searchParams.get("id")??"");if(!_o(de,w,"deployments:read"))return C({ok:!1,error:"Operation was not found in this scope."},404);let E=Dt.logs(w,{after:Number(B.searchParams.get("after"))||0,limit:Number(B.searchParams.get("limit"))||500});return C({entries:E,cursor:E.at(-1)?.sequence??(Number(B.searchParams.get("after"))||0),operation:y.store.getOperation(w)})}if(B.pathname==="/api/queue/stream"&&_.method==="GET"){let w=String(B.searchParams.get("id")??"");if(!_o(de,w,"deployments:read"))return C({ok:!1,error:"Operation was not found in this scope."},404);let E=_.headers.get("last-event-id")?.trim(),N=Number(E||B.searchParams.get("after")||0),j=new TextEncoder,q,H=!1,V=new ReadableStream({start(Y){let he=()=>{if(H)return;let le=Wt.resolveUser(_);if(!le||!_o(le,w,"deployments:read")){if(H=!0,q)clearInterval(q);Y.close();return}let Qe=Dt.logs(w,{after:N,limit:500});for(let We of Qe)N=We.sequence,Y.enqueue(j.encode(`id: ${We.sequence}
+This link expires in one hour and can be used once.`});y.store.appendEvent({organizationId:y.organization.id,actorId:q.actorId,type:"auth.password_reset.requested",payload:{delivered:Y}})}return C({ok:!0,message:"If that account has a verified email, a reset link has been sent."},202)}if(B.pathname==="/api/auth/password-reset/complete"&&_.method==="POST"){let w=await X(_),E=String(w.token??"").trim(),N=String(w.password??"");if(!E||N.length<12)return C({ok:!1,error:"A valid reset token and password of at least 12 characters are required."},422);try{let j=Pe.consumeActionToken(E,"password_reset"),q=Ji(N),H=Pe.updatePassword(j.identityId,q);return al(t,H.username,q),y.store.appendEvent({organizationId:y.organization.id,actorId:H.actorId,type:"auth.password_reset.completed"}),C({ok:!0,message:"Password changed. Sign in again."},200,{"set-cookie":rl({secure:Ri})})}catch(j){let q=j instanceof Error?j.message:"Password reset failed.";return C({ok:!1,error:q.replace("Action token","Reset link")},q.includes("consumed")||q.includes("expired")?409:404)}}if(B.pathname==="/api/login"&&_.method==="POST"){let w=await X(_),E=String(w.username??"").trim(),N=String(w.password??""),j=tt.requestIP(_)?.address??"unknown",q=Ac.check(E,j);if(!q.allowed)return C({ok:!1,error:`Too many failed attempts. Try again in ${Math.ceil((q.retryAfterSeconds??0)/60)} minute(s).`},429,{"retry-after":String(q.retryAfterSeconds??60)});let H=Fn(en(t),E),V=Pe.getIdentityByUsername(E),Y=V?.passwordHash??H?.passwordHash??Y_;if(!(Gn(N,Y)&&!!H&&!!V&&!V.disabledAt))return Ac.recordFailure(E,j),C({ok:!1,error:"Incorrect username or password."},401);if(Vb(Pe,y,V))return C({ok:!1,error:"Single sign-on is required for this account."},403);Ac.recordSuccess(E,j);let le=V,Qe=le.requiresPasswordUpgrade||nb(le.passwordHash);if(Qe){let We=Ji(N);le=Pe.rehashPassword(le.id,We),al(t,le.username,We)}if(Pe.recordLogin(le.id),Pe.getMfaFactor(le.id)?.state==="active"){let We=Pe.createMfaChallenge(le.id,"login");return y.store.appendEvent({organizationId:y.organization.id,actorId:le.actorId,type:"auth.mfa.challenge.created",payload:{purpose:"login"}}),C({ok:!0,mfaRequired:!0,challengeToken:We.token,passwordUpgraded:Qe})}let ke=Pc(le.id,_,j);return y.store.appendEvent({organizationId:y.organization.id,actorId:le.actorId,type:"auth.login.succeeded",payload:{method:"local"}}),C({ok:!0,user:js(H),passwordUpgraded:Qe},200,{"set-cookie":Ns(ke.token,{secure:Ri,maxAgeMs:ot})})}if(B.pathname==="/api/auth/mfa/complete"&&_.method==="POST"){let w=await X(_),E=String(w.challengeToken??"").trim(),N=String(w.code??"").trim(),j=tt.requestIP(_)?.address??"unknown",H=Pe.inspectMfaChallengeToken(E,"login")?.identityId??"unknown-mfa",V=Cc.check(H,j);if(!V.allowed)return C({ok:!1,error:"Too many MFA attempts. Try again later."},429,{"retry-after":String(V.retryAfterSeconds??60)});try{let Y=Pe.completeMfaChallenge(E,N,"login");Cc.recordSuccess(H,j);let ge=new Date().toISOString(),le=Pe.createSession({identityId:Y.identity.id,userAgent:zm(_),networkHint:Al(j),mfaAt:ge,recentAuthAt:ge});return y.store.appendEvent({organizationId:y.organization.id,actorId:Y.identity.actorId,type:"auth.mfa.succeeded",payload:{purpose:"login",method:Y.method}}),C({ok:!0},200,{"set-cookie":Ns(le.token,{secure:Ri,maxAgeMs:ot})})}catch{return Cc.recordFailure(H,j),C({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}}if(B.pathname==="/api/logout"&&_.method==="POST"){let w=Wt.resolveSession(_);if(w)Pe.revokeSession(w.identityId,w.id);let E=rl({secure:Ri});if(_.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login","set-cookie":E}});return C({ok:!0},200,{"set-cookie":E})}if(B.pathname==="/login"){let w=Pe.listOidcProviders(y.organization.id).map((E)=>({slug:E.slug,name:E.name}));return new Response(Wb(O?.mode==="serverless",w),{headers:{"content-type":"text/html; charset=utf-8"}})}if(B.pathname==="/forgot-password"||B.pathname==="/reset-password")return new Response(Hb(B.pathname==="/reset-password"?"reset":"request"),{headers:{"content-type":"text/html; charset=utf-8"}});if(B.pathname==="/accept-invitation")return ow(nt,B.pathname);let ae=Wt.resolveUser(_);if(!ae){if(!B.pathname.startsWith("/api/")&&_.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login"}});return C({ok:!1,error:"Sign in to continue."},401)}let gn=jt(ae,Se);if(B.pathname==="/api/me"){let w=y.store.getActorByExternalId("user",`dashboard:${ae.username.toLowerCase()}`),E=w?y.store.getMembershipForActor(y.organization.id,w.id):void 0,N=y.store.resolveAuthorizationTarget(y.organization.id,E?.scope??{type:"project",id:y.project.id})??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id});return C({ok:!0,user:js(ae),authEnabled:Ee,organization:y.organization,membership:E,capabilities:ir({membership:E,grants:E?y.store.listGrants(E.id):[],target:N})})}if(B.pathname.startsWith("/api/")){let w=await zb(_,B.pathname),E=Wt.check(_,B.pathname,ae,w);if(!E.ok)return C({ok:!1,error:E.error},E.status??403);if(Ee&&aT.has(`${_.method.toUpperCase()} ${B.pathname}`)){let N=Wt.resolveSession(_);if(!N||!Pe.isRecentlyAuthenticated(N))return C({ok:!1,error:"Recent authentication is required for this change.",stepUpRequired:!0},401)}}if(B.pathname==="/api/auth/security"&&_.method==="GET"){let w=qe(ae),E=w.actor?Pe.getIdentityByActor(w.actor.id):void 0,N=Wt.resolveSession(_);return C({identity:E?{username:E.username,email:E.email,emailVerifiedAt:E.emailVerifiedAt,requiresPasswordUpgrade:E.requiresPasswordUpgrade,lastLoginAt:E.lastLoginAt}:void 0,currentSessionId:N?.id,sessions:E?Pe.listSessions(E.id,{includeInactive:!0}):[],mfa:E?{factor:Pe.getMfaFactor(E.id),recoveryCodesRemaining:Pe.remainingRecoveryCodes(E.id)}:void 0})}if(B.pathname==="/api/auth/oidc/providers"&&_.method==="GET")return C({providers:Pe.listOidcProviders(y.organization.id,{includeDisabled:!0}),callbackOrigin:st,callbackPattern:st?`${st}/auth/oidc/{slug}/callback`:void 0,localOwnerRecovery:!0});if(B.pathname==="/api/auth/oidc/providers"&&_.method==="POST"){let w=await X(_),E=qe(ae),N=E.actor?Pe.getIdentityByActor(E.actor.id):void 0,j=w.enforceSso===!0;if(j&&(!N?.emailVerifiedAt||Pe.remainingRecoveryCodes(N.id)<1))return C({ok:!1,error:"Verify the owner email and generate MFA recovery codes before enforcing SSO."},409);try{let q=ml(w.defaultRole),H=Pe.upsertOidcProvider({id:typeof w.id==="string"?w.id:void 0,organizationId:y.organization.id,slug:String(w.slug??""),name:String(w.name??""),issuer:String(w.issuer??""),clientId:String(w.clientId??""),clientSecret:typeof w.clientSecret==="string"&&w.clientSecret?w.clientSecret:void 0,scopes:Array.isArray(w.scopes)?w.scopes.map(String):void 0,allowedDomains:Array.isArray(w.allowedDomains)?w.allowedDomains.map(String):[],defaultRole:q&&q!=="owner"?q:void 0,enabled:w.enabled!==!1,enforceSso:j});return y.store.appendEvent({organizationId:y.organization.id,actorId:E.actor?.id,type:"auth.oidc.provider.configured",payload:{providerId:H.id,issuer:H.issuer,enabled:H.enabled,enforceSso:H.enforceSso}}),C({ok:!0,provider:H})}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"OIDC provider could not be saved."},422)}}if(B.pathname==="/api/auth/oidc/providers"&&_.method==="PATCH"){let w=await X(_),E=Pe.getOidcProvider(String(w.id??""));if(!E||E.organizationId!==y.organization.id)return C({ok:!1,error:"OIDC provider was not found."},404);let N=qe(ae),j=Pe.setOidcProviderEnabled(E.id,w.enabled===!0);return y.store.appendEvent({organizationId:y.organization.id,actorId:N.actor?.id,type:j.enabled?"auth.oidc.provider.enabled":"auth.oidc.provider.disabled",payload:{providerId:E.id}}),C({ok:!0,provider:j})}if(B.pathname==="/api/automation"&&_.method==="GET"){let w=yt.listServiceAccounts(y.organization.id,{includeDisabled:!0}).map((E)=>{let N=y.store.getMembershipForActor(y.organization.id,E.actorId),j=E.createdByActorId?y.store.getActor(E.createdByActorId):void 0,q=yt.listTokens(E.id,{includeInactive:!0}).map((H)=>({...H,createdBy:H.createdByActorId?y.store.getActor(H.createdByActorId):void 0}));return{account:E,createdBy:j,membership:N,tokens:q}});return C({accounts:w,apiBaseUrl:`${B.origin}/api/v1`,openApiUrl:`${B.origin}/api/v1/openapi.json`,tokenEnvironmentVariable:"TS_CLOUD_API_TOKEN"})}if(B.pathname==="/api/automation/service-accounts"&&_.method==="POST"){let w=await X(_),E=qe(ae),N=ml(w.roleTemplate),j=kc(w);if(!E.actor||!N||N==="owner"||!j)return C({ok:!1,error:"A non-owner role and valid organization scope are required."},422);try{let q=yt.createServiceAccount({organizationId:y.organization.id,slug:String(w.slug??""),name:String(w.name??""),description:typeof w.description==="string"?w.description:void 0,roleTemplate:N,scope:j,createdByActorId:E.actor.id});return C({ok:!0,...q},201)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"Service account could not be created."},422)}}if(B.pathname==="/api/automation/service-accounts"&&_.method==="PATCH"){let w=await X(_),E=qe(ae),N=yt.getServiceAccount(String(w.id??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Service account was not found."},404);return C({ok:!0,account:yt.disableServiceAccount(N.id,E.actor?.id)})}if(B.pathname==="/api/automation/tokens"&&_.method==="POST"){let w=await X(_),E=qe(ae),N=yt.getServiceAccount(String(w.serviceAccountId??"")),j=kc(w);if(!E.actor||!N||N.organizationId!==y.organization.id||!j||!Array.isArray(w.capabilities))return C({ok:!1,error:"Service account, explicit capabilities, and valid scope are required."},422);try{let q=yt.createToken({serviceAccountId:N.id,name:String(w.name??"API token"),capabilities:w.capabilities.map(String),scope:j,expiresAt:typeof w.expiresAt==="string"?w.expiresAt:void 0,createdByActorId:E.actor.id});return C({ok:!0,token:q.token,secret:q.secret,revealOnce:!0},201)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"API token could not be created."},422)}}if(B.pathname==="/api/automation/tokens/rotate"&&_.method==="POST"){let w=await X(_),E=qe(ae),N=yt.getToken(String(w.id??"")),j=N?yt.getServiceAccount(N.serviceAccountId):void 0;if(!E.actor||!N||j?.organizationId!==y.organization.id)return C({ok:!1,error:"API token was not found."},404);try{let q=yt.rotateToken(N.id,E.actor.id);return C({ok:!0,token:q.token,secret:q.secret,revealOnce:!0,overlap:!0},201)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"API token could not be rotated."},409)}}if(B.pathname==="/api/automation/tokens"&&_.method==="DELETE"){let w=await X(_),E=qe(ae),N=yt.getToken(String(w.id??"")),j=N?yt.getServiceAccount(N.serviceAccountId):void 0;if(!N||j?.organizationId!==y.organization.id)return C({ok:!1,error:"API token was not found."},404);return C({ok:!0,token:yt.revokeToken(N.id,E.actor?.id)})}if(B.pathname==="/api/onboarding"&&_.method==="GET"){let w=Ke.listConnections(y.organization.id);return C({drafts:jr.list(y.project.id),artifacts:Po.list(y.project.id),registries:Qn.list(y.organization.id),sourceConnections:w,repositories:w.flatMap((E)=>Ke.listRepositories(E.id)),project:{id:y.project.id,slug:y.project.slug,name:y.project.name},environments:[...y.environments.values()].map((E)=>({id:E.id,slug:E.slug,name:E.name,kind:E.kind,region:E.region})),resources:y.store.listResources(y.project.id).filter((E)=>E.kind==="application").map((E)=>({id:E.id,slug:E.slug,name:E.name,environmentId:E.environmentId}))})}if(B.pathname==="/api/onboarding/detect"&&_.method==="POST"){let w=await X(_);try{if(w.source?.kind==="git"){let j=Ke.getConnection(String(w.source.connectionId??"")),q=Ke.getRepository(String(w.source.repositoryId??""));if(!j||j.organizationId!==y.organization.id||!q||q.connectionId!==j.id)throw Error("Authorized Git repository was not found");let H=typeof w.source.deployKeyId==="string"?Ke.getDeployKey(w.source.deployKeyId):void 0;if(H&&H.connectionId!==j.id)throw Error("Deploy key does not belong to this connection");let V=Im(xt(vl(),"ts-cloud-onboarding-git-"));try{let Y=await Sa({remote:q.cloneUrl,destination:xt(V,"checkout"),ref:String(w.source.ref??q.defaultBranch),sparsePaths:Array.isArray(w.source.sparsePaths)?w.source.sparsePaths.map(String):void 0,binding:{id:"detection",projectId:y.project.id,connectionId:j.id,repositoryId:q.id,repositoryFullName:q.fullName,defaultBranch:q.defaultBranch,monorepoRoot:String(w.source.monorepoRoot??"."),includePaths:[],excludePaths:[],submodules:w.source.submodules===!0,cloneDepth:1,deployKeyId:H?.id,autoDeploy:!1,pullRequestPreviews:!1,status:"active",version:1,createdAt:new Date().toISOString(),updatedAt:new Date().toISOString()}},{credential:Ke.getCredential(j.id),deployKey:H?{...H,privateKey:Ke.getDeployPrivateKey(H.id)}:void 0,timeoutMs:120000});return C({ok:!0,commitSha:Y.commitSha,candidates:Yo(Rp(Y.directory))})}finally{Ao(V,{recursive:!0,force:!0})}}if(Array.isArray(w.files)){if(w.files.length>1e4)throw Error("Detection file-count limit exceeded");let j=w.files.map((q)=>({path:String(q.path??""),size:Number(q.size??0),content:typeof q.content==="string"?q.content.slice(0,262144):void 0}));return C({ok:!0,candidates:Yo(j)})}let E=F_(t,String(w.root??".")),N=L_(t,E);if(N===".."||N.startsWith(`..${z_}`))throw Error("Detection root must stay inside the project");return C({ok:!0,candidates:Yo(Rp(E))})}catch(E){return C({ok:!1,error:E instanceof Error?E.message:"Application detection failed."},422)}}if(B.pathname==="/api/onboarding/plan"&&_.method==="POST"){let w=await X(_);try{return C({ok:!0,plan:Wn(w.draft,Array.isArray(w.suppliedSecretNames)?w.suppliedSecretNames.map(String):[])})}catch(E){return C({ok:!1,error:E instanceof Error?E.message:"Application plan could not be generated."},422)}}if(B.pathname==="/api/onboarding/drafts"&&_.method==="POST"){let w=await X(_),E=qe(ae);try{return C({ok:!0,draft:jr.create({organizationId:y.organization.id,projectId:y.project.id,name:String(w.name??w.draft?.name??"Application draft"),draft:{...w.draft,projectId:y.project.id},step:w.step,suppliedSecretNames:Array.isArray(w.suppliedSecretNames)?w.suppliedSecretNames.map(String):[],actorId:E.actor?.id})},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Application draft could not be saved."},422)}}if(B.pathname==="/api/onboarding/drafts"&&_.method==="PATCH"){let w=await X(_),E=qe(ae),N=jr.get(String(w.id??""));if(!N||N.projectId!==y.project.id)return C({ok:!1,error:"Application draft was not found."},404);try{return C({ok:!0,draft:jr.update(N.id,Number(w.version),{draft:{...w.draft,projectId:y.project.id},step:w.step,suppliedSecretNames:Array.isArray(w.suppliedSecretNames)?w.suppliedSecretNames.map(String):void 0,actorId:E.actor?.id})})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Application draft could not be updated."},409)}}if(B.pathname==="/api/onboarding/artifacts"&&_.method==="POST"){let w=qe(ae);if(Number(_.headers.get("content-length")??0)>104857600)return C({ok:!1,error:"Artifact exceeds the 100 MB upload limit."},413);try{let N=new Uint8Array(await _.arrayBuffer());return C({ok:!0,artifact:Po.create({organizationId:y.organization.id,projectId:y.project.id,filename:_.headers.get("x-artifact-filename")??"application.zip",bytes:N,actorId:w.actor?.id})},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Artifact could not be inspected."},422)}}if(B.pathname==="/api/onboarding/registries"&&_.method==="POST"){let w=await X(_),E=qe(ae);try{return C({ok:!0,registry:Qn.create({organizationId:y.organization.id,provider:w.provider,name:String(w.name??"Container registry"),host:String(w.host??""),credential:w.token||w.password?{username:typeof w.username==="string"?w.username:void 0,password:typeof w.password==="string"?w.password:void 0,token:typeof w.token==="string"?w.token:void 0}:void 0,credentialExpiresAt:typeof w.credentialExpiresAt==="string"?w.credentialExpiresAt:void 0,actorId:E.actor?.id})},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Registry connection could not be created."},422)}}if(B.pathname==="/api/onboarding/registries"&&_.method==="PATCH"){let w=await X(_),E=qe(ae),N=Qn.get(String(w.id??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Registry connection was not found."},404);try{if(w.action==="test")return C({ok:!0,registry:await Qn.test(N.id,{image:typeof w.image==="string"?w.image:void 0})});if(w.action==="rotate")return C({ok:!0,registry:Qn.rotate(N.id,{username:typeof w.username==="string"?w.username:void 0,password:typeof w.password==="string"?w.password:void 0,token:typeof w.token==="string"?w.token:void 0},{expiresAt:typeof w.expiresAt==="string"?w.expiresAt:void 0,actorId:E.actor?.id})});return C({ok:!1,error:"Registry action must be test or rotate."},422)}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Registry connection could not be updated."},422)}}if(B.pathname==="/api/onboarding/registries"&&_.method==="DELETE"){let w=await X(_),E=qe(ae),N=Qn.get(String(w.id??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Registry connection was not found."},404);let j=jr.list(y.project.id).filter((q)=>q.input.source.kind==="image"&&q.input.source.registryConnectionId===N.id||q.input.build.kind==="prebuilt_image"&&q.input.build.registryConnectionId===N.id);if(w.preview===!0)return C({ok:!0,preview:!0,affectedDrafts:j});return C({ok:!0,registry:Qn.disconnect(N.id,E.actor?.id),affectedDrafts:j})}if(B.pathname==="/api/onboarding/apply"&&_.method==="POST"){let w=await X(_),E=qe(ae);try{let N=hd({controlPlane:y.store,drafts:jr,draftId:String(w.id??""),expectedVersion:Number(w.version),confirmEnvironment:String(w.confirmEnvironment??""),actorId:E.actor?.id});return C({ok:!0,resource:N.resource,operation:N.operation,plan:N.plan},202)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Application plan could not be applied."},422)}}if(B.pathname==="/api/sources"&&_.method==="GET"){let w=Ke.listConnections(y.organization.id);return C({connections:w,bindings:Ke.listBindings({projectId:y.project.id}),repositories:w.flatMap((E)=>Ke.listRepositories(E.id)),deployKeys:w.flatMap((E)=>Ke.listDeployKeys(E.id)),webhooks:w.flatMap((E)=>Ke.listWebhooks(E.id)).map((E)=>({...E,deliveries:Ke.listDeliveries(E.id,20)})),project:{id:y.project.id,slug:y.project.slug},environment:pe(y,String(Se)),resources:y.store.listResources(y.project.id,pe(y,String(Se)).environmentId).filter((E)=>E.kind==="application").map((E)=>({id:E.id,slug:E.slug,name:E.name}))})}if(B.pathname==="/api/sources/connections"&&_.method==="POST"){let w=await X(_),E=qe(ae),N=String(w.provider??"");if(!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(N))return C({ok:!1,error:"A supported Git provider is required."},422);try{let j=N==="github"&&(w.privateKey||w.appId)?{appId:typeof w.appId==="string"?w.appId:void 0,installationId:typeof w.installationId==="string"?w.installationId:void 0,privateKey:typeof w.privateKey==="string"?w.privateKey:void 0}:N!=="generic_ssh"&&w.token?{token:typeof w.token==="string"?w.token:void 0,username:typeof w.username==="string"?w.username:void 0}:void 0,q={github:"https://github.com",gitlab:"https://gitlab.com",bitbucket:"https://bitbucket.org",gitea:"https://gitea.com"},H,V,Y;if(y.store.database.transaction(()=>{if(H=Ke.createConnection({organizationId:y.organization.id,provider:N,name:String(w.name??N),host:String(w.host??q[N]??""),owner:typeof w.owner==="string"?w.owner:void 0,authKind:w.authKind,credential:j,grantedScopes:Array.isArray(w.grantedScopes)?w.grantedScopes.map(String):[],credentialExpiresAt:typeof w.credentialExpiresAt==="string"?w.credentialExpiresAt:void 0,createdByActorId:E.actor?.id}),typeof w.repositoryUrl==="string"&&typeof w.repositoryFullName==="string")V=Ke.upsertRepository({connectionId:H.id,providerRepositoryId:`manual:${w.repositoryFullName}`,fullName:w.repositoryFullName,cloneUrl:w.repositoryUrl,defaultBranch:String(w.defaultBranch??"main"),visibility:"unknown",archived:!1,metadata:{source:"manual"}});if(N==="generic_ssh")Y=Ke.createDeployKey({connectionId:H.id,name:String(w.deployKeyName??"Repository deploy key"),publicKey:String(w.publicKey??""),privateKey:String(w.deployPrivateKey??""),host:String(w.sshHost??""),hostKey:String(w.hostKey??""),actorId:E.actor?.id})})(),w.test===!0)H=await Ia(Ke,H.id,V?.id);return C({ok:!0,connection:H,repository:V,deployKey:Y},201)}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Source connection could not be created."},422)}}if(B.pathname==="/api/sources/connections"&&_.method==="PATCH"){let w=await X(_),E=qe(ae),N=Ke.getConnection(String(w.id??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);try{if(w.action==="test")return C({ok:!0,connection:await Ia(Ke,N.id,typeof w.repositoryId==="string"?w.repositoryId:void 0)});if(w.action==="rotate")return C({ok:!0,connection:Ke.rotateCredential(N.id,{token:typeof w.token==="string"?w.token:void 0,username:typeof w.username==="string"?w.username:void 0,appId:typeof w.appId==="string"?w.appId:void 0,installationId:typeof w.installationId==="string"?w.installationId:void 0,privateKey:typeof w.privateKey==="string"?w.privateKey:void 0},{expiresAt:typeof w.expiresAt==="string"?w.expiresAt:void 0,actorId:E.actor?.id})});return C({ok:!1,error:"Connection action must be test or rotate."},422)}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Source connection could not be updated."},422)}}if(B.pathname==="/api/sources/connections"&&_.method==="DELETE"){let w=await X(_),E=qe(ae),N=Ke.getConnection(String(w.id??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);let j=Ke.listBindings({connectionId:N.id,status:"active"});if(w.preview===!0)return C({ok:!0,preview:!0,affectedBindings:j});return C({ok:!0,...Ke.disconnectConnection(N.id,E.actor?.id)})}if(B.pathname==="/api/sources/deploy-keys"&&_.method==="POST"){let w=await X(_),E=qe(ae),N=Ke.getConnection(String(w.connectionId??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);try{return C({ok:!0,deployKey:Ke.createDeployKey({connectionId:N.id,name:String(w.name??"Repository deploy key"),publicKey:String(w.publicKey??""),privateKey:String(w.privateKey??""),host:String(w.host??""),hostKey:String(w.hostKey??""),actorId:E.actor?.id})},201)}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Deploy key could not be stored."},422)}}if(B.pathname==="/api/sources/deploy-keys"&&_.method==="DELETE"){let w=await X(_),E=qe(ae),N=Ke.getDeployKey(String(w.id??"")),j=N?Ke.getConnection(N.connectionId):void 0;if(!N||!j||j.organizationId!==y.organization.id)return C({ok:!1,error:"Deploy key was not found."},404);let q=Ke.listBindings({connectionId:j.id}).filter((H)=>H.deployKeyId===N.id);if(w.preview===!0)return C({ok:!0,preview:!0,affectedBindings:q});return C({ok:!0,...Ke.revokeDeployKey(N.id,E.actor?.id)})}if(B.pathname==="/api/sources/repositories/sync"&&_.method==="POST"){let w=await X(_),E=Ke.getConnection(String(w.connectionId??""));if(!E||E.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);try{return C({ok:!0,repositories:await gs(Ke,String(w.connectionId??""),{search:typeof w.search==="string"?w.search:void 0})})}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Repositories could not be synchronized."},422)}}if(B.pathname==="/api/sources/references"&&_.method==="GET"){let w=Ke.getConnection(String(B.searchParams.get("connectionId")??""));if(!w||w.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);try{return C(await ps(Ke,{connectionId:String(B.searchParams.get("connectionId")??""),repository:String(B.searchParams.get("repository")??""),repositoryId:B.searchParams.get("repositoryId")??void 0,deployKeyId:B.searchParams.get("deployKeyId")??void 0,type:B.searchParams.get("type")==="tags"?"tags":"branches",cursor:B.searchParams.get("cursor")??void 0}))}catch(E){return C({ok:!1,error:E instanceof Error?E.message:"References could not be listed."},422)}}if(B.pathname==="/api/sources/bindings"&&_.method==="POST"){let w=await X(_),E=qe(ae),N=pe(y,String(Se)),j=Ke.getConnection(String(w.connectionId??""));if(!j||j.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);try{return C({ok:!0,binding:Ke.createBinding({projectId:y.project.id,environmentId:N.environmentId,resourceId:typeof w.resourceId==="string"?w.resourceId:void 0,connectionId:String(w.connectionId??""),repositoryId:typeof w.repositoryId==="string"?w.repositoryId:void 0,repositoryFullName:String(w.repositoryFullName??""),defaultBranch:String(w.defaultBranch??"main"),branchRule:typeof w.branchRule==="string"?w.branchRule:void 0,tagRule:typeof w.tagRule==="string"?w.tagRule:void 0,monorepoRoot:String(w.monorepoRoot??"."),includePaths:Array.isArray(w.includePaths)?w.includePaths.map(String):[],excludePaths:Array.isArray(w.excludePaths)?w.excludePaths.map(String):[],submodules:w.submodules===!0,cloneDepth:w.cloneDepth?Number(w.cloneDepth):void 0,deployKeyId:typeof w.deployKeyId==="string"&&w.deployKeyId?w.deployKeyId:void 0,autoDeploy:w.autoDeploy!==!1,pullRequestPreviews:w.pullRequestPreviews!==!1,actorId:E.actor?.id})},201)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"Source binding could not be created."},422)}}if(B.pathname==="/api/sources/bindings"&&_.method==="PATCH"){let w=await X(_),E=qe(ae),N=Ke.getBinding(String(w.id??""));if(!N||N.projectId!==y.project.id)return C({ok:!1,error:"Source binding was not found."},404);try{return C({ok:!0,binding:Ke.updateBinding(N.id,Number(w.version),{defaultBranch:w.defaultBranch,branchRule:w.branchRule,tagRule:w.tagRule,monorepoRoot:w.monorepoRoot,includePaths:w.includePaths,excludePaths:w.excludePaths,submodules:w.submodules,cloneDepth:w.cloneDepth,deployKeyId:w.deployKeyId,autoDeploy:w.autoDeploy,pullRequestPreviews:w.pullRequestPreviews,status:w.status,disabledReason:w.disabledReason,actorId:E.actor?.id})})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Source binding could not be updated."},409)}}if(B.pathname==="/api/sources/webhooks"&&_.method==="POST"){let w=await X(_),E=Ke.getConnection(String(w.connectionId??""));if(!E||E.organizationId!==y.organization.id)return C({ok:!1,error:"Source connection was not found."},404);try{let N=Ke.createWebhook({connectionId:String(w.connectionId??""),repositoryId:typeof w.repositoryId==="string"?w.repositoryId:void 0,repositoryFullName:String(w.repositoryFullName??""),events:Array.isArray(w.events)?w.events.map(String):void 0,secret:typeof w.secret==="string"?w.secret:void 0}),j=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||st,q=j?Sr(j,N.webhook):void 0,H=w.reconcile!==!1&&j?await bn(Ke,N.webhook.id,j):N.webhook;return C({ok:!0,webhook:H,endpoint:q,endpointRevealOnce:!0},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Source webhook could not be created."},422)}}if(B.pathname==="/api/sources/webhooks"&&_.method==="PATCH"){let w=await X(_),E=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||st,N=Ke.getWebhook(String(w.id??"")),j=N?Ke.getConnection(N.connectionId):void 0;if(!N||!j||j.organizationId!==y.organization.id)return C({ok:!1,error:"Source webhook was not found."},404);if(!E)return C({ok:!1,error:"Set TS_CLOUD_WEBHOOK_BASE_URL to reconcile provider webhooks."},422);try{return C({ok:!0,webhook:await bn(Ke,String(w.id??""),E)})}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"Source webhook could not be reconciled."},422)}}if(B.pathname==="/api/sources/webhooks"&&_.method==="DELETE"){let w=await X(_),E=Ke.getWebhook(String(w.id??"")),N=E?Ke.getConnection(E.connectionId):void 0;if(!E||!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Source webhook was not found."},404);try{return C({ok:!0,webhook:await Cu(Ke,String(w.id??""))})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Source webhook could not be removed."},422)}}if(B.pathname==="/api/security/posture"&&_.method==="GET"){let w=pe(y,String(Se)),E=it.listFindings({...w,limit:500});return C({scope:w,summary:it.summary(w.organizationId,w.projectId,w.environmentId),findings:E,scans:it.listScanRuns({...w,limit:100}),policies:it.listPolicies(w.organizationId).filter((N)=>!N.environmentId||N.environmentId===w.environmentId),waivers:E.flatMap((N)=>it.listWaivers(N.id)),decisions:it.listDecisions(w.environmentId,50),actors:y.store.listMemberships(y.organization.id).map((N)=>y.store.getActor(N.actorId)).filter(Boolean)})}if(B.pathname==="/api/security/export"&&_.method==="GET")return C(it.exportPosture(y.organization.id));if(B.pathname==="/api/security/scan"&&_.method==="POST"){let w=pe(y,String(Se)),E=await new Lt(it).run(new vn,{...w,artifactRoot:t}),N=fs(it,w,qt??{});return C({ok:!0,source:E,host:N,summary:it.summary(w.organizationId,w.projectId,w.environmentId)})}if(B.pathname==="/api/security/review"&&_.method==="POST")try{let w=pe(y,String(Se));return C({ok:!0,...hs(it,{scope:w,desiredConfigHash:y.project.desiredConfigHash})})}catch(w){return C({ok:!1,error:w instanceof Error?w.message:"Security change review failed."},409)}if(B.pathname==="/api/security/policies"&&_.method==="POST"){let w=await X(_),E=qe(ae);if(!E.actor)return C({ok:!1,error:"An organization actor is required."},403);try{let N=it.createPolicy({organizationId:y.organization.id,environmentId:w.environmentId===null?void 0:String(w.environmentId??pe(y,String(Se)).environmentId),name:String(w.name??""),scannerFailMode:w.scannerFailMode==="open"?"open":"closed",requiredScanners:Array.isArray(w.requiredScanners)?w.requiredScanners.map(String):[],rules:Array.isArray(w.rules)?w.rules.map((j)=>({minimumSeverity:String(j.minimumSeverity),action:String(j.action),scannerId:j.scannerId?String(j.scannerId):void 0})):[],actorId:E.actor.id});return C({ok:!0,policy:N},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Security policy could not be created."},422)}}if(B.pathname==="/api/security/policies"&&_.method==="PATCH"){let w=await X(_),E=qe(ae),N=it.getPolicy(String(w.id??""));if(!E.actor||!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Security policy was not found."},404);try{return C({ok:!0,policy:it.updatePolicy(N.id,Number(w.version),{name:typeof w.name==="string"?w.name:void 0,scannerFailMode:w.scannerFailMode==="open"||w.scannerFailMode==="closed"?w.scannerFailMode:void 0,requiredScanners:Array.isArray(w.requiredScanners)?w.requiredScanners.map(String):void 0,rules:Array.isArray(w.rules)?w.rules.map((j)=>({minimumSeverity:String(j.minimumSeverity),action:String(j.action),scannerId:j.scannerId?String(j.scannerId):void 0})):void 0,enabled:typeof w.enabled==="boolean"?w.enabled:void 0,actorId:E.actor.id})})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Security policy could not be updated."},409)}}if(B.pathname==="/api/security/waivers"&&_.method==="POST"){let w=await X(_),E=qe(ae);if(!E.actor)return C({ok:!1,error:"An organization actor is required."},403);try{return C({ok:!0,waiver:it.createWaiver({findingId:String(w.findingId??""),policyId:typeof w.policyId==="string"?w.policyId:void 0,reason:String(w.reason??""),referenceUrl:typeof w.referenceUrl==="string"?w.referenceUrl:void 0,expiresAt:String(w.expiresAt??""),actorId:E.actor.id})},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Security waiver could not be created."},422)}}if(B.pathname==="/api/security/waivers"&&_.method==="DELETE"){let w=await X(_),E=qe(ae);if(!E.actor)return C({ok:!1,error:"An organization actor is required."},403);try{return C({ok:!0,waiver:it.revokeWaiver(String(w.id??""),E.actor.id)})}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Security waiver could not be revoked."},404)}}if(B.pathname==="/api/security/findings"&&_.method==="PATCH"){let w=await X(_),E=qe(ae),N=it.getFinding(String(w.id??""));if(!E.actor||!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Security finding was not found."},404);try{let j=w.action==="acknowledge"?it.acknowledgeFinding(N.id,E.actor.id):it.assignFinding(N.id,typeof w.ownerActorId==="string"&&w.ownerActorId?w.ownerActorId:void 0,E.actor.id);return C({ok:!0,finding:j})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Security finding could not be updated."},422)}}if(B.pathname==="/api/security/comments"&&_.method==="POST"){let w=await X(_),E=qe(ae);if(!E.actor)return C({ok:!1,error:"An organization actor is required."},403);try{return C({ok:!0,comment:it.addComment({findingId:String(w.findingId??""),actorId:E.actor.id,body:String(w.body??""),referenceUrl:typeof w.referenceUrl==="string"?w.referenceUrl:void 0})},201)}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Comment could not be saved."},422)}}if(B.pathname==="/api/auth/sessions"&&_.method==="GET"){let w=Wt.resolveSession(_);return C({currentSessionId:w?.id,sessions:w?Pe.listSessions(w.identityId,{includeInactive:!0}):[]})}if(B.pathname==="/api/auth/sessions"&&_.method==="DELETE"){let w=await X(_),E=Wt.resolveSession(_);if(!E)return C({ok:!1,error:"Sign in again to manage sessions."},401);let N=String(w.id??""),j=Pe.revokeSession(E.identityId,N),q=N===E.id&&j?{"set-cookie":rl({secure:Ri})}:void 0;return C({ok:j,signedOut:N===E.id&&j},j?200:404,q)}if(B.pathname==="/api/auth/sessions/revoke-others"&&_.method==="POST"){let w=Wt.resolveSession(_);if(!w)return C({ok:!1,error:"Sign in again to manage sessions."},401);return C({ok:!0,revoked:Pe.revokeOtherSessions(w.identityId,w.id)})}if(B.pathname==="/api/auth/password/change"&&_.method==="POST"){let w=await X(_),E=String(w.currentPassword??""),N=String(w.password??""),j=qe(ae),q=j.actor?Pe.getIdentityByActor(j.actor.id):void 0;if(!q||!Gn(E,q.passwordHash))return C({ok:!1,error:"Current password is incorrect."},401);if(N.length<12)return C({ok:!1,error:"New password must be at least 12 characters."},422);if(Gn(N,q.passwordHash))return C({ok:!1,error:"Choose a different password."},409);let H=Ji(N),V=Pe.updatePassword(q.id,H);al(t,V.username,H);let Y=Pc(V.id,_,tt.requestIP(_)?.address??"unknown");return y.store.appendEvent({organizationId:y.organization.id,actorId:V.actorId,type:"auth.password.changed"}),C({ok:!0,message:"Password changed and other sessions were signed out."},200,{"set-cookie":Ns(Y.token,{secure:Ri,maxAgeMs:ot})})}if(B.pathname==="/api/auth/mfa/enroll"&&_.method==="POST"){let w=await X(_),E=Wt.resolveSession(_),N=qe(ae),j=N.actor?Pe.getIdentityByActor(N.actor.id):void 0;if(!E||!j)return C({ok:!1,error:"Sign in again before enabling MFA."},401);if(!Gn(String(w.password??""),j.passwordHash))return C({ok:!1,error:"Current password is incorrect."},401);try{let q=Pe.beginTotpEnrollment(j.id,{issuer:y.organization.name});return y.store.appendEvent({organizationId:y.organization.id,actorId:j.actorId,type:"auth.mfa.enrollment.started"}),C({factor:q.factor,secret:q.secret,uri:q.uri})}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"MFA enrollment failed."},409)}}if(B.pathname==="/api/auth/mfa/verify"&&_.method==="POST"){let w=await X(_),E=Wt.resolveSession(_),N=qe(ae),j=N.actor?Pe.getIdentityByActor(N.actor.id):void 0;if(!E||!j)return C({ok:!1,error:"Sign in again before enabling MFA."},401);try{let q=Pe.verifyTotpEnrollment(j.id,String(w.code??""));return Pe.markSessionStepUp(E.id,!0),y.store.appendEvent({organizationId:y.organization.id,actorId:j.actorId,type:"auth.mfa.enabled",payload:{recoveryCodeCount:q.recoveryCodes.length}}),C(q)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"MFA enrollment failed."},422)}}if(B.pathname==="/api/auth/mfa"&&_.method==="DELETE"){let w=await X(_),E=Wt.resolveSession(_),N=qe(ae),j=N.actor?Pe.getIdentityByActor(N.actor.id):void 0;if(!E||!j||!Gn(String(w.password??""),j.passwordHash))return C({ok:!1,error:"Current password is incorrect."},401);let q=Pe.verifyMfaCode(j.id,String(w.code??""));if(!q.valid||!q.method)return C({ok:!1,error:"Authenticator or recovery code is incorrect."},401);return Pe.disableMfa(j.id),Pe.revokeOtherSessions(j.id,E.id),Pe.markSessionStepUp(E.id),y.store.appendEvent({organizationId:y.organization.id,actorId:j.actorId,type:"auth.mfa.disabled",payload:{method:q.method}}),C({ok:!0})}if(B.pathname==="/api/auth/step-up"&&_.method==="POST"){let w=await X(_),E=Wt.resolveSession(_),N=qe(ae),j=N.actor?Pe.getIdentityByActor(N.actor.id):void 0;if(!E||!j||!Gn(String(w.password??""),j.passwordHash))return C({ok:!1,error:"Current password is incorrect."},401);let q=Pe.getMfaFactor(j.id);if(q?.state==="active"){if(!Pe.verifyMfaCode(j.id,String(w.code??"")).valid)return C({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}let H=Pe.markSessionStepUp(E.id,q?.state==="active");return y.store.appendEvent({organizationId:y.organization.id,actorId:j.actorId,type:"auth.step_up.succeeded",payload:{mfa:q?.state==="active"}}),C({ok:!0,recentAuthAt:H.recentAuthAt})}if(B.pathname==="/api/terminal"){if(!se)return C({ok:!1,error:"The web terminal is disabled."},403);if(tt.upgrade(_))return;return bl("WebSocket upgrade failed",400)}if(B.pathname==="/api/health"){let w=y.store.health();return C({ok:!0,cwd:t,environment:Se,environments:k,uiRoot:await Bt(ae,Se),liveData:ee.size>0,terminal:se,localPackage:import.meta.url.includes("/Code/Libraries/ts-cloud/"),controlPlane:{schemaVersion:w.schemaVersion,supportedSchemaVersion:w.supportedSchemaVersion,integrity:w.integrity,pendingRetryableOperations:w.pendingRetryableOperations}})}if(B.pathname==="/api/control-plane/operations"){let w=B.searchParams.get("state"),E=w&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(w)?w:void 0;return C({operations:y.store.listOperations({projectId:y.project.id,state:E,kind:B.searchParams.get("kind")??void 0,limit:Number(B.searchParams.get("limit"))||100})})}if(B.pathname==="/api/queue"&&_.method==="GET"){let w=B.searchParams.get("state"),E=w&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(w)?w:void 0,N=Dt.list({projectId:y.project.id,state:E,limit:Number(B.searchParams.get("limit"))||250}).filter((j)=>_o(ae,j.operation.id,"deployments:read")).map((j)=>{let q=j.operation.resourceId?y.store.getResource(j.operation.resourceId):void 0,H=j.operation.environmentId?y.store.listEnvironments(y.project.id).find((ge)=>ge.id===j.operation.environmentId):void 0,V=j.operation.actorId?y.store.getActor(j.operation.actorId):void 0,Y=j.operation.input;return{...j,target:q?{id:q.id,name:q.name,slug:q.slug,kind:q.kind}:H?{id:H.id,name:H.name,slug:H.slug,kind:"environment"}:{id:y.project.id,name:y.project.name,slug:y.project.slug,kind:"project"},actor:V?{id:V.id,name:V.displayName,kind:V.kind}:void 0,commit:Y.revision??Y.source?.commitSha??null}});return C({operations:N,concurrency:Dt.limits})}if(B.pathname==="/api/queue/logs"&&_.method==="GET"){let w=String(B.searchParams.get("id")??"");if(!_o(ae,w,"deployments:read"))return C({ok:!1,error:"Operation was not found in this scope."},404);let E=Dt.logs(w,{after:Number(B.searchParams.get("after"))||0,limit:Number(B.searchParams.get("limit"))||500});return C({entries:E,cursor:E.at(-1)?.sequence??(Number(B.searchParams.get("after"))||0),operation:y.store.getOperation(w)})}if(B.pathname==="/api/queue/stream"&&_.method==="GET"){let w=String(B.searchParams.get("id")??"");if(!_o(ae,w,"deployments:read"))return C({ok:!1,error:"Operation was not found in this scope."},404);let E=_.headers.get("last-event-id")?.trim(),N=Number(E||B.searchParams.get("after")||0),j=new TextEncoder,q,H=!1,V=new ReadableStream({start(Y){let ge=()=>{if(H)return;let le=Wt.resolveUser(_);if(!le||!_o(le,w,"deployments:read")){if(H=!0,q)clearInterval(q);Y.close();return}let Qe=Dt.logs(w,{after:N,limit:500});for(let We of Qe)N=We.sequence,Y.enqueue(j.encode(`id: ${We.sequence}
 event: log
 data: ${JSON.stringify(We)}
 
-`));let Ie=y.store.getOperation(w);if(Ie&&["succeeded","failed","cancelled","timed_out"].includes(Ie.state)&&Dt.logs(w,{after:N,limit:1}).length===0){if(H=!0,q)clearInterval(q);Y.enqueue(j.encode(`event: complete
-data: ${JSON.stringify({state:Ie.state,cursor:N})}
+`));let ke=y.store.getOperation(w);if(ke&&["succeeded","failed","cancelled","timed_out"].includes(ke.state)&&Dt.logs(w,{after:N,limit:1}).length===0){if(H=!0,q)clearInterval(q);Y.enqueue(j.encode(`event: complete
+data: ${JSON.stringify({state:ke.state,cursor:N})}
 
-`)),Y.close()}};if(he(),!H)q=setInterval(he,500);_.signal.addEventListener("abort",()=>{if(H=!0,q)clearInterval(q);try{Y.close()}catch{}},{once:!0})},cancel(){if(H=!0,q)clearInterval(q)}});return new Response(V,{headers:{"content-type":"text/event-stream","cache-control":"no-store","x-accel-buffering":"no"}})}if(B.pathname==="/api/queue/cancel"&&_.method==="POST"){let w=await X(_),E=String(w.id??"");if(!_o(de,E,"deployments:cancel"))return C({ok:!1,error:"Operation was not found or cannot be cancelled in this scope."},404);let N=v(y.store,de);try{return C({ok:!0,operation:Dt.requestCancellation(E,N.id)})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Cancellation failed."},409)}}if(B.pathname==="/api/queue/retry"&&_.method==="POST"){let w=await X(_),E=String(w.id??"");if(!_o(de,E,"deployments:create"))return C({ok:!1,error:"Operation was not found or cannot be retried in this scope."},404);let N=v(y.store,de);try{return C({ok:!0,operation:Dt.retry(E,String(w.errorClass??"manual"),{delayMs:Number(w.delayMs)||0,actorId:N.id})})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Retry failed."},409)}}if(B.pathname==="/api/queue/settings"&&_.method==="GET")return C({concurrency:Dt.limits});if(B.pathname==="/api/queue/settings"&&_.method==="PATCH"){let w=await X(_);if(w.confirm!=="update queue limits")return C({ok:!1,error:'Type "update queue limits" to confirm production concurrency changes.'},409);let E=v(y.store,de);return C({ok:!0,concurrency:Dt.configureConcurrency(w.concurrency??{},{organizationId:y.organization.id,actorId:E.id})})}if(B.pathname==="/api/queue/history"&&_.method==="DELETE"){let w=await X(_);if(w.confirm!=="clear completed")return C({ok:!1,error:'Type "clear completed" to confirm retained history cleanup.'},409);let E=v(y.store,de);return C({ok:!0,deleted:Dt.clearCompleted({projectId:y.project.id,before:typeof w.before==="string"?w.before:void 0,actorId:E.id})})}if(B.pathname==="/api/previews"&&_.method==="GET"){let w=Xt.previews.listInstances({projectId:y.project.id}).filter((j)=>kr(de,j.resourceId,"deployments:read")),E=Xt.previews.listDefinitions(y.project.id).filter((j)=>kr(de,j.resourceId,"project:read")),N=y.store.listResources(y.project.id).filter((j)=>j.kind==="application"&&kr(de,j.id,"project:read")).map((j)=>({id:j.id,slug:j.slug,name:j.name,environmentId:j.environmentId}));return C({previews:w,definitions:E,resources:N,environments:[...y.environments.values()]})}if(B.pathname==="/api/releases"&&_.method==="GET"){let w=[...y.environments.values()],E=y.store.listResources(y.project.id).filter((q)=>kr(de,q.id,"deployments:read")),N=new Set(E.map((q)=>q.id)),j=un.releases.list({projectId:y.project.id}).filter((q)=>N.has(q.resourceId)).map((q)=>{let H=E.find((he)=>he.id===q.resourceId),V=w.find((he)=>he.id===q.environmentId),Y=q.previousReleaseId?un.releases.get(q.previousReleaseId):void 0;return{...q,resource:H?{id:H.id,name:H.name,slug:H.slug,provider:H.provider}:void 0,environment:V?{id:V.id,name:V.name,slug:V.slug,kind:V.kind}:void 0,artifact:un.releases.getArtifact(q.artifactId),transitions:un.releases.transitions(q.id),approvals:un.releases.approvals(q.id),previous:Y,comparison:Y?un.releases.compare(Y.id,q.id):void 0,capabilities:In({kind:q.kind,provider:H?.provider,hasHealthGate:!!q.healthGate,replicas:Number(q.manifest?.replicas)||1})}});return C({releases:j,resources:E.map((q)=>({id:q.id,name:q.name,slug:q.slug,environmentId:q.environmentId,provider:q.provider})),environments:w})}if(B.pathname==="/api/releases/action"&&_.method==="POST"){let w=await X(_),E=un.releases.get(String(w.id??"")),N=String(w.action??"");if(!E||!kr(de,E.resourceId,"deployments:create"))return C({ok:!1,error:"Release was not found in this scope."},404);let j=v(y.store,de);try{if(N==="activate")return C({ok:!0,operation:un.enqueueActivation(E,{actorId:j.id})});if(N==="rollback"){let q=y.store.getResource(E.resourceId);if(w.confirm!==q?.slug)return C({ok:!1,error:`Type "${q?.slug??""}" to confirm rollback.`},409);return C({ok:!0,operation:un.enqueueRollback(E,{actorId:j.id,targetReleaseId:typeof w.targetReleaseId==="string"?w.targetReleaseId:void 0})})}if(N==="approve"){let q=y.store.listEnvironments(E.projectId).find((H)=>H.id===E.environmentId);if(w.confirm!==q?.slug)return C({ok:!1,error:`Type "${q?.slug??""}" to confirm the environment gate.`},409);return C({ok:!0,release:un.releases.approve(E.id,{actorId:j.id,decision:w.decision==="rejected"?"rejected":"approved",comment:typeof w.comment==="string"?w.comment:void 0})})}if(N==="pin")return C({ok:!0,release:un.releases.pin(E.id,w.pinned!==!1,typeof w.reason==="string"?w.reason:void 0)});if(N==="promote"){let q=y.store.getResource(String(w.targetResourceId??"")),H=q?y.store.listEnvironments(E.projectId).find((V)=>V.id===q.environmentId):void 0;if(!q||!H||!kr(de,q.id,"deployments:create"))return C({ok:!1,error:"Promotion target was not found in this scope."},404);if(w.confirm!==H.slug)return C({ok:!1,error:`Type "${H.slug}" to confirm promotion.`},409);return C({ok:!0,release:un.releases.promote(E.id,{targetEnvironmentId:H.id,targetResourceId:q.id,config:w.config&&typeof w.config==="object"?w.config:{},strategy:typeof w.strategy==="string"?w.strategy:void 0,actorId:j.id,approvalRequired:w.approvalRequired===!0})})}return C({ok:!1,error:"Unsupported release action."},422)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"Release action failed."},409)}}if(B.pathname==="/api/compose"&&_.method==="GET"){let w=Ei.applications.list({projectId:y.project.id}).filter((E)=>kr(de,E.resourceId,"applications:read")).map((E)=>({...E,services:Ei.applications.services(E.id)}));return C({applications:w,templates:Jr(),environments:[...y.environments.values()]})}if(B.pathname==="/api/compose/preview"&&_.method==="POST"){let w=await X(_),E=String(w.environmentId??"");if(!qs(de,E,"applications:manage"))return C({ok:!1,error:"Environment was not found in this scope."},404);try{return C({ok:!0,result:Ei.applications.preview(String(w.source??""),{name:String(w.name??""),slug:typeof w.slug==="string"?w.slug:void 0,projectId:y.project.id,environmentId:E})})}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Compose could not be parsed."},422)}}if((B.pathname==="/api/compose/import"||B.pathname==="/api/compose/template")&&_.method==="POST"){let w=await X(_),E=String(w.environmentId??"");if(!qs(de,E,"applications:manage"))return C({ok:!1,error:"Environment was not found in this scope."},404);let N=v(y.store,de);try{let j=B.pathname.endsWith("/template")?Ei.applications.fromTemplate(String(w.templateId??""),w.inputs&&typeof w.inputs==="object"?w.inputs:{},{name:String(w.name??""),projectId:y.project.id,environmentId:E,version:typeof w.templateVersion==="string"?w.templateVersion:void 0,createdByActorId:N.id}):Ei.applications.import(String(w.source??""),{name:String(w.name??""),slug:typeof w.slug==="string"?w.slug:void 0,projectId:y.project.id,environmentId:E,createdByActorId:N.id});return C({ok:!0,application:j.application,diagnostics:j.parsed.diagnostics})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Compose application could not be saved."},422)}}if(B.pathname==="/api/compose/action"&&_.method==="POST"){let w=await X(_),E=Ei.applications.get(String(w.id??"")),N=String(w.action??""),j=N==="delete"||N==="stop"?"deployments:cancel":"deployments:create";if(!E||!kr(de,E.resourceId,j))return C({ok:!1,error:"Compose application was not found in this scope."},404);try{let q=v(y.store,de);return C({ok:!0,operation:Ei.enqueue(E,N,{actorId:q.id,service:typeof w.service==="string"?w.service:void 0,replicas:Number.isFinite(Number(w.replicas))?Number(w.replicas):void 0,removeVolumes:w.removeVolumes===!0,confirmation:typeof w.confirm==="string"?w.confirm:void 0})})}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"Compose operation could not be queued."},409)}}if((B.pathname==="/api/compose/logs"||B.pathname==="/api/compose/shell")&&_.method==="POST"){let w=await X(_),E=Ei.applications.get(String(w.id??"")),N=B.pathname.endsWith("/shell"),j=N?"runtime:terminal":"runtime:logs";if(!E||!kr(de,E.resourceId,j))return C({ok:!1,error:"Compose service was not found in this scope."},404);let q=String(w.service??"");if(!E.manifest.spec.services[q])return C({ok:!1,error:"Compose service was not found."},404);if(N&&w.confirm!==q)return C({ok:!1,error:`Type "${q}" to run a service command.`},409);let H=y.store.listEnvironments(E.projectId).find((Y)=>Y.id===E.environmentId)?.slug;if(!H)return C({ok:!1,error:"Compose environment was not found."},404);let V=N?wd(E.manifest,q,Array.isArray(w.command)?w.command.map(String):["sh"]):Td(E.manifest,q,Number(w.lines)||200);return C(await vc(f,H,V))}if(B.pathname==="/api/previews/definitions"&&_.method==="POST"){let w=await X(_),E=String(w.resourceId??"");if(!kr(de,E,"config:write"))return C({ok:!1,error:"Application was not found in this scope."},404);let N=v(y.store,de);try{return C({ok:!0,definition:Xt.previews.createDefinition({...w,projectId:y.project.id,resourceId:E,baseEnvironmentId:String(w.baseEnvironmentId??""),domainPattern:String(w.domainPattern??""),createdByActorId:N.id})})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Preview policy could not be created."},409)}}if(B.pathname==="/api/previews/deploy"&&_.method==="POST"){let w=await X(_),E=Xt.previews.getDefinition(String(w.definitionId??""));if(!E||!kr(de,E.resourceId,"deployments:create"))return C({ok:!1,error:"Preview policy was not found in this scope."},404);let N=v(y.store,de);try{let j=Xt.previews.upsert({definitionId:E.id,sourceProvider:"dashboard",repository:"dashboard",branch:String(w.branch??""),pullRequestNumber:Number(w.pullRequestNumber)||void 0,commitSha:String(w.commitSha??""),createdByActorId:N.id});return C({ok:!0,preview:j.preview,operation:Xt.enqueueDeploy(j.preview,{created:j.created,actorId:N.id})})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Preview could not be queued."},409)}}if(B.pathname==="/api/previews/destroy"&&_.method==="POST"){let w=await X(_),E=Xt.previews.getInstance(String(w.id??""));if(!E||!kr(de,E.resourceId,"deployments:cancel"))return C({ok:!1,error:"Preview was not found in this scope."},404);if(w.confirm!==E.name)return C({ok:!1,error:`Type "${E.name}" to confirm tagged teardown.`},409);let N=v(y.store,de);return C({ok:!0,operation:Xt.enqueueDestroy(E,"dashboard",N.id)})}if(B.pathname==="/api/previews/extend"&&_.method==="POST"){let w=await X(_),E=Xt.previews.getInstance(String(w.id??""));if(!E||!kr(de,E.resourceId,"deployments:create"))return C({ok:!1,error:"Preview was not found in this scope."},404);return C({ok:!0,preview:Xt.previews.extend(E.id,Number(w.hours))})}if(B.pathname==="/api/previews/rebuild"&&_.method==="POST"){let w=await X(_),E=Xt.previews.getInstance(String(w.id??""));if(!E||!kr(de,E.resourceId,"deployments:create"))return C({ok:!1,error:"Preview was not found in this scope."},404);let N=v(y.store,de);return C({ok:!0,operation:Xt.enqueueDeploy(E,{actorId:N.id,reason:"manual_rebuild"})})}if(B.pathname==="/api/previews/cleanup"&&_.method==="POST"){let w=await X(_);if(!w.dryRun&&w.confirm!=="cleanup previews")return C({ok:!1,error:'Type "cleanup previews" to confirm teardown.'},409);let E=v(y.store,de);return C({ok:!0,...Xt.cleanup({dryRun:w.dryRun===!0,maxAgeHours:Number(w.maxAgeHours)||void 0,keepCount:Number(w.keepCount)||void 0,actorId:E.id})})}if(B.pathname==="/api/control-plane/events")return C({events:y.store.listEvents({organizationId:y.organization.id,projectId:y.project.id,operationId:B.searchParams.get("operationId")??void 0,correlationId:B.searchParams.get("correlationId")??void 0,afterSequence:Number(B.searchParams.get("afterSequence"))||void 0,limit:Number(B.searchParams.get("limit"))||200})});if(B.pathname==="/api/search"){let w=String(B.searchParams.get("q")??"").trim().slice(0,128),E=gn.role==="member"?new Set(Object.keys(gn.sites)):void 0,N=w?So(y.store,{projectId:y.project.id,query:w,allowedResourceSlugs:E,limit:Number(B.searchParams.get("limit"))||20}):[];return C({query:w,results:N,stale:!1})}if(B.pathname==="/api/search/preferences"&&_.method==="GET"){let w=`dashboard:${de.username.toLowerCase()}`;return C({savedFilters:y.store.listSavedFilters(w),navigation:y.store.listNavigation(w)})}if(B.pathname==="/api/search/preferences"&&_.method==="POST"){let w=`dashboard:${de.username.toLowerCase()}`,E=await X(_),N=String(E.action??"");if(N==="save-filter")return C({savedFilter:y.store.saveFilter(w,String(E.name??""),String(E.routeId??""),E.query??{})});if(N==="favorite")return C({navigation:y.store.setFavorite(w,String(E.entityType??""),String(E.entityId??""),E.favorite!==!1)});if(N==="visit")return C({navigation:y.store.recordNavigation(w,String(E.entityType??""),String(E.entityId??""))});return C({ok:!1,error:"Unknown search preference action."},422)}if(B.pathname==="/api/search/preferences"&&_.method==="DELETE"){let w=`dashboard:${de.username.toLowerCase()}`,E=await X(_);return C({ok:y.store.deleteSavedFilter(w,String(E.id??""))})}if(B.pathname==="/api/organization"&&_.method==="GET"){let w=y.store.listMemberships(y.organization.id,{includeRevoked:!0}).map((E)=>{let N=y.store.getActor(E.actorId);return{...E,actor:N?{id:N.id,displayName:N.displayName,externalId:N.externalId,disabledAt:N.disabledAt}:void 0,grants:y.store.listGrants(E.id)}});return C({organization:y.organization,project:y.project,environments:y.store.listEnvironments(y.project.id),resources:y.store.listResources(y.project.id).map((E)=>({id:E.id,environmentId:E.environmentId,kind:E.kind,slug:E.slug,name:E.name})),memberships:w,invitations:y.store.listInvitations(y.organization.id)})}if(B.pathname==="/api/organization/invitations"&&_.method==="GET")return C({invitations:y.store.listInvitations(y.organization.id)});if(B.pathname==="/api/organization/invitations"&&_.method==="POST"){let w=await X(_),E=ml(w.roleTemplate),N=kc(w);if(!E||!N)return C({ok:!1,error:"Choose a valid role template and resource scope."},422);let j=qe(de);if(!j.actor||!j.membership)return C({ok:!1,error:"Your organization membership is unavailable."},403);if(E==="owner"&&(!Gn(String(w.password??""),de.passwordHash)||j.membership.roleTemplate!=="owner"))return C({ok:!1,error:"Owner invitations require an owner to re-enter their password."},401);try{let q=y.store.createInvitation({organizationId:y.organization.id,email:String(w.email??""),roleTemplate:E,scope:N,invitedByActorId:j.actor.id,expiresInMs:Number(w.expiresInMs)||void 0}),H=`${B.origin}/accept-invitation?token=${encodeURIComponent(q.token)}`,V=await Sn(f,{to:q.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${H}
+`)),Y.close()}};if(ge(),!H)q=setInterval(ge,500);_.signal.addEventListener("abort",()=>{if(H=!0,q)clearInterval(q);try{Y.close()}catch{}},{once:!0})},cancel(){if(H=!0,q)clearInterval(q)}});return new Response(V,{headers:{"content-type":"text/event-stream","cache-control":"no-store","x-accel-buffering":"no"}})}if(B.pathname==="/api/queue/cancel"&&_.method==="POST"){let w=await X(_),E=String(w.id??"");if(!_o(ae,E,"deployments:cancel"))return C({ok:!1,error:"Operation was not found or cannot be cancelled in this scope."},404);let N=v(y.store,ae);try{return C({ok:!0,operation:Dt.requestCancellation(E,N.id)})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Cancellation failed."},409)}}if(B.pathname==="/api/queue/retry"&&_.method==="POST"){let w=await X(_),E=String(w.id??"");if(!_o(ae,E,"deployments:create"))return C({ok:!1,error:"Operation was not found or cannot be retried in this scope."},404);let N=v(y.store,ae);try{return C({ok:!0,operation:Dt.retry(E,String(w.errorClass??"manual"),{delayMs:Number(w.delayMs)||0,actorId:N.id})})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Retry failed."},409)}}if(B.pathname==="/api/queue/settings"&&_.method==="GET")return C({concurrency:Dt.limits});if(B.pathname==="/api/queue/settings"&&_.method==="PATCH"){let w=await X(_);if(w.confirm!=="update queue limits")return C({ok:!1,error:'Type "update queue limits" to confirm production concurrency changes.'},409);let E=v(y.store,ae);return C({ok:!0,concurrency:Dt.configureConcurrency(w.concurrency??{},{organizationId:y.organization.id,actorId:E.id})})}if(B.pathname==="/api/queue/history"&&_.method==="DELETE"){let w=await X(_);if(w.confirm!=="clear completed")return C({ok:!1,error:'Type "clear completed" to confirm retained history cleanup.'},409);let E=v(y.store,ae);return C({ok:!0,deleted:Dt.clearCompleted({projectId:y.project.id,before:typeof w.before==="string"?w.before:void 0,actorId:E.id})})}if(B.pathname==="/api/previews"&&_.method==="GET"){let w=Xt.previews.listInstances({projectId:y.project.id}).filter((j)=>kr(ae,j.resourceId,"deployments:read")),E=Xt.previews.listDefinitions(y.project.id).filter((j)=>kr(ae,j.resourceId,"project:read")),N=y.store.listResources(y.project.id).filter((j)=>j.kind==="application"&&kr(ae,j.id,"project:read")).map((j)=>({id:j.id,slug:j.slug,name:j.name,environmentId:j.environmentId}));return C({previews:w,definitions:E,resources:N,environments:[...y.environments.values()]})}if(B.pathname==="/api/releases"&&_.method==="GET"){let w=[...y.environments.values()],E=y.store.listResources(y.project.id).filter((q)=>kr(ae,q.id,"deployments:read")),N=new Set(E.map((q)=>q.id)),j=un.releases.list({projectId:y.project.id}).filter((q)=>N.has(q.resourceId)).map((q)=>{let H=E.find((ge)=>ge.id===q.resourceId),V=w.find((ge)=>ge.id===q.environmentId),Y=q.previousReleaseId?un.releases.get(q.previousReleaseId):void 0;return{...q,resource:H?{id:H.id,name:H.name,slug:H.slug,provider:H.provider}:void 0,environment:V?{id:V.id,name:V.name,slug:V.slug,kind:V.kind}:void 0,artifact:un.releases.getArtifact(q.artifactId),transitions:un.releases.transitions(q.id),approvals:un.releases.approvals(q.id),previous:Y,comparison:Y?un.releases.compare(Y.id,q.id):void 0,capabilities:In({kind:q.kind,provider:H?.provider,hasHealthGate:!!q.healthGate,replicas:Number(q.manifest?.replicas)||1})}});return C({releases:j,resources:E.map((q)=>({id:q.id,name:q.name,slug:q.slug,environmentId:q.environmentId,provider:q.provider})),environments:w})}if(B.pathname==="/api/releases/action"&&_.method==="POST"){let w=await X(_),E=un.releases.get(String(w.id??"")),N=String(w.action??"");if(!E||!kr(ae,E.resourceId,"deployments:create"))return C({ok:!1,error:"Release was not found in this scope."},404);let j=v(y.store,ae);try{if(N==="activate")return C({ok:!0,operation:un.enqueueActivation(E,{actorId:j.id})});if(N==="rollback"){let q=y.store.getResource(E.resourceId);if(w.confirm!==q?.slug)return C({ok:!1,error:`Type "${q?.slug??""}" to confirm rollback.`},409);return C({ok:!0,operation:un.enqueueRollback(E,{actorId:j.id,targetReleaseId:typeof w.targetReleaseId==="string"?w.targetReleaseId:void 0})})}if(N==="approve"){let q=y.store.listEnvironments(E.projectId).find((H)=>H.id===E.environmentId);if(w.confirm!==q?.slug)return C({ok:!1,error:`Type "${q?.slug??""}" to confirm the environment gate.`},409);return C({ok:!0,release:un.releases.approve(E.id,{actorId:j.id,decision:w.decision==="rejected"?"rejected":"approved",comment:typeof w.comment==="string"?w.comment:void 0})})}if(N==="pin")return C({ok:!0,release:un.releases.pin(E.id,w.pinned!==!1,typeof w.reason==="string"?w.reason:void 0)});if(N==="promote"){let q=y.store.getResource(String(w.targetResourceId??"")),H=q?y.store.listEnvironments(E.projectId).find((V)=>V.id===q.environmentId):void 0;if(!q||!H||!kr(ae,q.id,"deployments:create"))return C({ok:!1,error:"Promotion target was not found in this scope."},404);if(w.confirm!==H.slug)return C({ok:!1,error:`Type "${H.slug}" to confirm promotion.`},409);return C({ok:!0,release:un.releases.promote(E.id,{targetEnvironmentId:H.id,targetResourceId:q.id,config:w.config&&typeof w.config==="object"?w.config:{},strategy:typeof w.strategy==="string"?w.strategy:void 0,actorId:j.id,approvalRequired:w.approvalRequired===!0})})}return C({ok:!1,error:"Unsupported release action."},422)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"Release action failed."},409)}}if(B.pathname==="/api/compose"&&_.method==="GET"){let w=Ei.applications.list({projectId:y.project.id}).filter((E)=>kr(ae,E.resourceId,"applications:read")).map((E)=>({...E,services:Ei.applications.services(E.id)}));return C({applications:w,templates:Jr(),environments:[...y.environments.values()]})}if(B.pathname==="/api/compose/preview"&&_.method==="POST"){let w=await X(_),E=String(w.environmentId??"");if(!qs(ae,E,"applications:manage"))return C({ok:!1,error:"Environment was not found in this scope."},404);try{return C({ok:!0,result:Ei.applications.preview(String(w.source??""),{name:String(w.name??""),slug:typeof w.slug==="string"?w.slug:void 0,projectId:y.project.id,environmentId:E})})}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Compose could not be parsed."},422)}}if((B.pathname==="/api/compose/import"||B.pathname==="/api/compose/template")&&_.method==="POST"){let w=await X(_),E=String(w.environmentId??"");if(!qs(ae,E,"applications:manage"))return C({ok:!1,error:"Environment was not found in this scope."},404);let N=v(y.store,ae);try{let j=B.pathname.endsWith("/template")?Ei.applications.fromTemplate(String(w.templateId??""),w.inputs&&typeof w.inputs==="object"?w.inputs:{},{name:String(w.name??""),projectId:y.project.id,environmentId:E,version:typeof w.templateVersion==="string"?w.templateVersion:void 0,createdByActorId:N.id}):Ei.applications.import(String(w.source??""),{name:String(w.name??""),slug:typeof w.slug==="string"?w.slug:void 0,projectId:y.project.id,environmentId:E,createdByActorId:N.id});return C({ok:!0,application:j.application,diagnostics:j.parsed.diagnostics})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Compose application could not be saved."},422)}}if(B.pathname==="/api/compose/action"&&_.method==="POST"){let w=await X(_),E=Ei.applications.get(String(w.id??"")),N=String(w.action??""),j=N==="delete"||N==="stop"?"deployments:cancel":"deployments:create";if(!E||!kr(ae,E.resourceId,j))return C({ok:!1,error:"Compose application was not found in this scope."},404);try{let q=v(y.store,ae);return C({ok:!0,operation:Ei.enqueue(E,N,{actorId:q.id,service:typeof w.service==="string"?w.service:void 0,replicas:Number.isFinite(Number(w.replicas))?Number(w.replicas):void 0,removeVolumes:w.removeVolumes===!0,confirmation:typeof w.confirm==="string"?w.confirm:void 0})})}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"Compose operation could not be queued."},409)}}if((B.pathname==="/api/compose/logs"||B.pathname==="/api/compose/shell")&&_.method==="POST"){let w=await X(_),E=Ei.applications.get(String(w.id??"")),N=B.pathname.endsWith("/shell"),j=N?"runtime:terminal":"runtime:logs";if(!E||!kr(ae,E.resourceId,j))return C({ok:!1,error:"Compose service was not found in this scope."},404);let q=String(w.service??"");if(!E.manifest.spec.services[q])return C({ok:!1,error:"Compose service was not found."},404);if(N&&w.confirm!==q)return C({ok:!1,error:`Type "${q}" to run a service command.`},409);let H=y.store.listEnvironments(E.projectId).find((Y)=>Y.id===E.environmentId)?.slug;if(!H)return C({ok:!1,error:"Compose environment was not found."},404);let V=N?wd(E.manifest,q,Array.isArray(w.command)?w.command.map(String):["sh"]):Td(E.manifest,q,Number(w.lines)||200);return C(await vc(f,H,V))}if(B.pathname==="/api/previews/definitions"&&_.method==="POST"){let w=await X(_),E=String(w.resourceId??"");if(!kr(ae,E,"config:write"))return C({ok:!1,error:"Application was not found in this scope."},404);let N=v(y.store,ae);try{return C({ok:!0,definition:Xt.previews.createDefinition({...w,projectId:y.project.id,resourceId:E,baseEnvironmentId:String(w.baseEnvironmentId??""),domainPattern:String(w.domainPattern??""),createdByActorId:N.id})})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Preview policy could not be created."},409)}}if(B.pathname==="/api/previews/deploy"&&_.method==="POST"){let w=await X(_),E=Xt.previews.getDefinition(String(w.definitionId??""));if(!E||!kr(ae,E.resourceId,"deployments:create"))return C({ok:!1,error:"Preview policy was not found in this scope."},404);let N=v(y.store,ae);try{let j=Xt.previews.upsert({definitionId:E.id,sourceProvider:"dashboard",repository:"dashboard",branch:String(w.branch??""),pullRequestNumber:Number(w.pullRequestNumber)||void 0,commitSha:String(w.commitSha??""),createdByActorId:N.id});return C({ok:!0,preview:j.preview,operation:Xt.enqueueDeploy(j.preview,{created:j.created,actorId:N.id})})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Preview could not be queued."},409)}}if(B.pathname==="/api/previews/destroy"&&_.method==="POST"){let w=await X(_),E=Xt.previews.getInstance(String(w.id??""));if(!E||!kr(ae,E.resourceId,"deployments:cancel"))return C({ok:!1,error:"Preview was not found in this scope."},404);if(w.confirm!==E.name)return C({ok:!1,error:`Type "${E.name}" to confirm tagged teardown.`},409);let N=v(y.store,ae);return C({ok:!0,operation:Xt.enqueueDestroy(E,"dashboard",N.id)})}if(B.pathname==="/api/previews/extend"&&_.method==="POST"){let w=await X(_),E=Xt.previews.getInstance(String(w.id??""));if(!E||!kr(ae,E.resourceId,"deployments:create"))return C({ok:!1,error:"Preview was not found in this scope."},404);return C({ok:!0,preview:Xt.previews.extend(E.id,Number(w.hours))})}if(B.pathname==="/api/previews/rebuild"&&_.method==="POST"){let w=await X(_),E=Xt.previews.getInstance(String(w.id??""));if(!E||!kr(ae,E.resourceId,"deployments:create"))return C({ok:!1,error:"Preview was not found in this scope."},404);let N=v(y.store,ae);return C({ok:!0,operation:Xt.enqueueDeploy(E,{actorId:N.id,reason:"manual_rebuild"})})}if(B.pathname==="/api/previews/cleanup"&&_.method==="POST"){let w=await X(_);if(!w.dryRun&&w.confirm!=="cleanup previews")return C({ok:!1,error:'Type "cleanup previews" to confirm teardown.'},409);let E=v(y.store,ae);return C({ok:!0,...Xt.cleanup({dryRun:w.dryRun===!0,maxAgeHours:Number(w.maxAgeHours)||void 0,keepCount:Number(w.keepCount)||void 0,actorId:E.id})})}if(B.pathname==="/api/control-plane/events")return C({events:y.store.listEvents({organizationId:y.organization.id,projectId:y.project.id,operationId:B.searchParams.get("operationId")??void 0,correlationId:B.searchParams.get("correlationId")??void 0,afterSequence:Number(B.searchParams.get("afterSequence"))||void 0,limit:Number(B.searchParams.get("limit"))||200})});if(B.pathname==="/api/search"){let w=String(B.searchParams.get("q")??"").trim().slice(0,128),E=gn.role==="member"?new Set(Object.keys(gn.sites)):void 0,N=w?So(y.store,{projectId:y.project.id,query:w,allowedResourceSlugs:E,limit:Number(B.searchParams.get("limit"))||20}):[];return C({query:w,results:N,stale:!1})}if(B.pathname==="/api/search/preferences"&&_.method==="GET"){let w=`dashboard:${ae.username.toLowerCase()}`;return C({savedFilters:y.store.listSavedFilters(w),navigation:y.store.listNavigation(w)})}if(B.pathname==="/api/search/preferences"&&_.method==="POST"){let w=`dashboard:${ae.username.toLowerCase()}`,E=await X(_),N=String(E.action??"");if(N==="save-filter")return C({savedFilter:y.store.saveFilter(w,String(E.name??""),String(E.routeId??""),E.query??{})});if(N==="favorite")return C({navigation:y.store.setFavorite(w,String(E.entityType??""),String(E.entityId??""),E.favorite!==!1)});if(N==="visit")return C({navigation:y.store.recordNavigation(w,String(E.entityType??""),String(E.entityId??""))});return C({ok:!1,error:"Unknown search preference action."},422)}if(B.pathname==="/api/search/preferences"&&_.method==="DELETE"){let w=`dashboard:${ae.username.toLowerCase()}`,E=await X(_);return C({ok:y.store.deleteSavedFilter(w,String(E.id??""))})}if(B.pathname==="/api/organization"&&_.method==="GET"){let w=y.store.listMemberships(y.organization.id,{includeRevoked:!0}).map((E)=>{let N=y.store.getActor(E.actorId);return{...E,actor:N?{id:N.id,displayName:N.displayName,externalId:N.externalId,disabledAt:N.disabledAt}:void 0,grants:y.store.listGrants(E.id)}});return C({organization:y.organization,project:y.project,environments:y.store.listEnvironments(y.project.id),resources:y.store.listResources(y.project.id).map((E)=>({id:E.id,environmentId:E.environmentId,kind:E.kind,slug:E.slug,name:E.name})),memberships:w,invitations:y.store.listInvitations(y.organization.id)})}if(B.pathname==="/api/organization/invitations"&&_.method==="GET")return C({invitations:y.store.listInvitations(y.organization.id)});if(B.pathname==="/api/organization/invitations"&&_.method==="POST"){let w=await X(_),E=ml(w.roleTemplate),N=kc(w);if(!E||!N)return C({ok:!1,error:"Choose a valid role template and resource scope."},422);let j=qe(ae);if(!j.actor||!j.membership)return C({ok:!1,error:"Your organization membership is unavailable."},403);if(E==="owner"&&(!Gn(String(w.password??""),ae.passwordHash)||j.membership.roleTemplate!=="owner"))return C({ok:!1,error:"Owner invitations require an owner to re-enter their password."},401);try{let q=y.store.createInvitation({organizationId:y.organization.id,email:String(w.email??""),roleTemplate:E,scope:N,invitedByActorId:j.actor.id,expiresInMs:Number(w.expiresInMs)||void 0}),H=`${B.origin}/accept-invitation?token=${encodeURIComponent(q.token)}`,V=await Sn(f,{to:q.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${H}
 
-This link expires ${q.invitation.expiresAt} and can be used once.`});return C({invitation:q.invitation,token:q.token,acceptUrl:H,delivered:V},201)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"Invitation could not be created."},422)}}if(B.pathname==="/api/organization/invitations"&&_.method==="DELETE"){let w=await X(_),E=qe(de);try{return C({invitation:y.store.revokeInvitation(String(w.id??""),E.actor?.id)})}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Invitation could not be revoked."},409)}}if(B.pathname==="/api/organization/invitations/resend"&&_.method==="POST"){let w=await X(_),E=qe(de);try{let N=y.store.reissueInvitation(String(w.id??""),E.actor?.id),j=`${B.origin}/accept-invitation?token=${encodeURIComponent(N.token)}`,q=await Sn(f,{to:N.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${j}
+This link expires ${q.invitation.expiresAt} and can be used once.`});return C({invitation:q.invitation,token:q.token,acceptUrl:H,delivered:V},201)}catch(q){return C({ok:!1,error:q instanceof Error?q.message:"Invitation could not be created."},422)}}if(B.pathname==="/api/organization/invitations"&&_.method==="DELETE"){let w=await X(_),E=qe(ae);try{return C({invitation:y.store.revokeInvitation(String(w.id??""),E.actor?.id)})}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Invitation could not be revoked."},409)}}if(B.pathname==="/api/organization/invitations/resend"&&_.method==="POST"){let w=await X(_),E=qe(ae);try{let N=y.store.reissueInvitation(String(w.id??""),E.actor?.id),j=`${B.origin}/accept-invitation?token=${encodeURIComponent(N.token)}`,q=await Sn(f,{to:N.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${j}
 
-This replacement link expires ${N.invitation.expiresAt} and can be used once.`});return C({invitation:N.invitation,token:N.token,acceptUrl:j,delivered:q})}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Invitation could not be resent."},409)}}if(B.pathname==="/api/organization/memberships"&&_.method==="PATCH"){let w=await X(_),E=y.store.getMembership(String(w.id??"")),N=ml(w.roleTemplate),j=kc(w);if(!E||E.organizationId!==y.organization.id)return C({ok:!1,error:"Membership was not found."},404);if(!N||!j)return C({ok:!1,error:"Choose a valid role template and resource scope."},422);let q=qe(de);if((E.roleTemplate==="owner"||N==="owner")&&(!Gn(String(w.password??""),de.passwordHash)||q.membership?.roleTemplate!=="owner"))return C({ok:!1,error:"Ownership changes require an owner to re-enter their password."},401);let V=y.store.resolveAuthorizationTarget(y.organization.id,j)??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id}),Y=y.store.listGrants(E.id),he=ir({membership:E,grants:Y,target:V}),le={...E,roleTemplate:N,scope:j},Qe=ir({membership:le,grants:Y,target:V}),Ie={gained:Qe.filter((We)=>!he.includes(We)),lost:he.filter((We)=>!Qe.includes(We))};if(w.preview===!0)return C({membership:E,proposed:{roleTemplate:N,scope:j},accessDiff:Ie});if(String(w.confirm??"")!==E.id)return C({ok:!1,error:`Confirm this change with membership ID ${E.id}.`,accessDiff:Ie},409);try{return C({membership:y.store.updateMembership({id:E.id,roleTemplate:N,scope:j,actorId:q.actor?.id}),accessDiff:Ie})}catch(We){return C({ok:!1,error:We instanceof Error?We.message:"Membership could not be updated."},409)}}if(B.pathname==="/api/organization/memberships"&&_.method==="DELETE"){let w=await X(_),E=y.store.getMembership(String(w.id??""));if(!E||E.organizationId!==y.organization.id)return C({ok:!1,error:"Membership was not found."},404);if(String(w.confirm??"")!==E.id)return C({ok:!1,error:`Confirm removal with membership ID ${E.id}.`},409);let N=qe(de);if(E.roleTemplate==="owner"&&(N.membership?.roleTemplate!=="owner"||!Gn(String(w.password??""),de.passwordHash)))return C({ok:!1,error:"Removing an owner requires an owner to re-enter their current password."},401);try{return C({membership:y.store.revokeMembership(E.id,N.actor?.id)})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Membership could not be removed."},409)}}if(B.pathname==="/api/organization/grants"&&_.method==="POST"){let w=await X(_),E=String(w.capability??""),N=w.effect==="deny"?"deny":w.effect==="allow"?"allow":void 0,j=kc(w),q=qe(de);if(!N||!j||!be.includes(E))return C({ok:!1,error:"Choose a valid capability, effect, and resource scope."},422);try{return C({grant:y.store.upsertGrant({organizationId:y.organization.id,membershipId:String(w.membershipId??""),effect:N,capability:E,scope:j,actorId:q.actor?.id})},201)}catch(H){return C({ok:!1,error:H instanceof Error?H.message:"Grant could not be created."},422)}}if(B.pathname==="/api/organization/grants"&&_.method==="DELETE"){let w=await X(_),E=qe(de),N=y.store.getGrant(String(w.id??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Grant was not found."},404);return C({ok:y.store.removeGrant(N.id,E.actor?.id)})}if(B.pathname==="/api/tags"&&_.method==="GET")return C({tags:y.store.listTags(y.project.id),assignments:y.store.listResourceTags(y.project.id)});if(B.pathname==="/api/tags"&&_.method==="POST"){let w=await X(_),E=y.store.upsertTag(y.project.id,String(w.name??""),String(w.color??"#5a8be0"));if(w.resourceId)y.store.assignTag(String(w.resourceId),E.id);return C({tag:E},201)}if(B.pathname==="/api/tags"&&_.method==="DELETE"){let w=await X(_);return y.store.removeTag(String(w.resourceId??""),String(w.tagId??"")),C({ok:!0})}if(B.pathname==="/"&&!iw(B.pathname,gn))return new Response(null,{status:302,headers:{location:`/server/sites?env=${encodeURIComponent(ke)}`}});if(B.pathname==="/"&&qt?.mode==="serverless")return new Response(null,{status:302,headers:{location:`/serverless?env=${encodeURIComponent(ke)}`}});let Tc=og(B.pathname);if(Tc)return new Response(null,{status:308,headers:{location:`${Tc}?env=${encodeURIComponent(ke)}`}});if(B.pathname==="/api/env"&&_.method==="POST"){let w=await X(_),E=String(w.env??"");if(!k.includes(E))return C({ok:!1,error:`Unknown environment '${E}'.`,environments:k},404);return C({ok:!0,environment:E,environments:k,href:`?env=${encodeURIComponent(E)}`})}if(B.pathname==="/api/config"){let w={...ws(f),environment:ke,environments:k};return C(tS(w,gn))}if(B.pathname==="/api/ssh-keys"&&_.method==="GET")return C({configPath:D,keys:Qi(zs(f))});if(B.pathname==="/api/ssh-keys"&&_.method==="POST"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=await ni(D,"utf8"),N=zs(f),j=ob({configText:E,name:String(w.name??""),publicKey:String(w.publicKey??""),existingKeys:N});return await Eo(D,j),ew(f,[...N,{name:String(w.name??"").trim(),publicKey:String(w.publicKey??"").trim().replace(/\s+/g," ")}]),C({ok:!0,configPath:D,keys:Qi(zs(f))})}if(B.pathname==="/api/ssh-keys"&&_.method==="DELETE"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=String(w.name??B.searchParams.get("name")??""),N=await ni(D,"utf8"),j=zs(f),q=sb({configText:N,name:E,existingKeys:j});return await Eo(D,q),ew(f,j.filter((H)=>H.name!==E.trim())),C({ok:!0,configPath:D,keys:Qi(zs(f))})}if(B.pathname==="/api/firewall"&&_.method==="GET")return C({configPath:D,alwaysOpen:[22,80,443],ports:wm(f)});if(B.pathname==="/api/firewall"&&_.method==="POST"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=Number(w.port);if(!Sc(E))return C({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let N=wm(f),j=await ni(D,"utf8");try{await Eo(D,dS(j,E,N))}catch(V){return C({ok:!1,error:V?.message??String(V)},422)}let q=Io([...N,E]);tw(f,q);let H=w.apply===!1?null:await vc(f,ke,`ufw allow ${E}/tcp`).catch((V)=>({ok:!1,error:String(V?.message??V)}));return C({ok:!0,configPath:D,ports:q,apply:H})}if(B.pathname==="/api/firewall"&&_.method==="DELETE"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=Number(w.port??B.searchParams.get("port"));if(!Sc(E))return C({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let N=wm(f),j=await ni(D,"utf8");await Eo(D,lS(j,E,N));let q=Io(N.filter((V)=>V!==E));tw(f,q);let H=w.apply===!1?null:await vc(f,ke,`ufw delete allow ${E}/tcp`).catch((V)=>({ok:!1,error:String(V?.message??V)}));return C({ok:!0,configPath:D,ports:q,apply:H})}if(B.pathname==="/api/sites"&&_.method==="POST"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=String(w.name??"").trim(),N=String(w.root??"").trim();if(!E||!N)return C({ok:!1,error:"Site name and root are required."},422);let j={deploy:w.deploy==="bucket"?"bucket":"server",root:N,path:String(w.path??"").trim()||void 0,domain:String(w.domain??"").trim()||void 0,build:String(w.build??"").trim()||void 0,start:String(w.start??"").trim()||void 0,port:w.port?Number(w.port):void 0,type:String(w.type??"").trim()||void 0};if(j.port!==void 0&&(!Number.isInteger(j.port)||j.port<1||j.port>65535))return C({ok:!1,error:"Port must be a number between 1 and 65535."},422);let q=await ni(D,"utf8"),H=Pn({configText:q,name:E,root:j.root,domain:j.domain,path:j.path,deploy:j.deploy,build:j.build,start:j.start,port:j.port,type:j.type});return await Eo(D,H),nT(f,E,Object.fromEntries(Object.entries(j).filter(([,V])=>V!==void 0))),qt=await Ro(f,ke),M.set(ke,qt),C({ok:!0,configPath:D,site:E,data:qt})}if(B.pathname==="/api/sites"&&_.method==="DELETE"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=String(w.name??B.searchParams.get("name")??"").trim();if(!E||!f.sites?.[E])return C({ok:!1,error:`Site '${E}' was not found.`},404);let N=await ni(D,"utf8");return await Eo(D,kn({configText:N,name:E})),delete f.sites[E],qt=await Ro(f,ke),M.set(ke,qt),C({ok:!0,configPath:D,site:E,data:qt})}if(B.pathname==="/api/sites"&&_.method==="PATCH"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=String(w.name??"").trim(),N=f.sites?.[E];if(!E||!N)return C({ok:!1,error:`Site '${E}' was not found.`},404);if(gn.role==="member"){let H=oS(w);if(!H.ok)return C({ok:!1,error:H.error},403);let V=sS({siteName:E,body:w,sites:f.sites??{},ownSites:Object.keys(gn.sites)});if(!V.ok)return C({ok:!1,error:V.error},409)}if(w.port!==void 0&&w.port!==null&&w.port!==""&&(!Number.isInteger(Number(w.port))||Number(w.port)<1||Number(w.port)>65535))return C({ok:!1,error:"Port must be a number between 1 and 65535."},422);if(typeof w.domain==="string"&&w.domain.trim()&&!Xa(w.domain.trim()))return C({ok:!1,error:`Domain '${w.domain.trim()}' is not a valid hostname.`},422);let j=await ni(D,"utf8"),q=(H,V)=>{j=bs({configText:j,siteName:E,key:H,valueText:V})};if(w.ssl!==void 0)q("ssl",Yu(w.ssl)),N.ssl=w.ssl;if(w.env!==void 0&&w.env&&typeof w.env==="object")q("env",eg(w.env)),N.env=w.env;if(w.aliases!==void 0&&Array.isArray(w.aliases)){let H=w.aliases.map((V)=>String(V));q("aliases",tg(H)),N.aliases=H.map((V)=>V.trim().toLowerCase()).filter(Boolean)}if(w.redirects!==void 0&&w.redirects&&typeof w.redirects==="object")q("redirects",rg(w.redirects)),N.redirects=w.redirects;for(let H of["domain","path","build","start","type","root","php"])if(typeof w[H]==="string"&&w[H].trim())q(H,Zu(String(w[H]).trim())),N[H]=String(w[H]).trim();if(w.port!==void 0&&w.port!==null&&w.port!=="")q("port",String(Number(w.port))),N.port=Number(w.port);return await Eo(D,j),qt=await Ro(f,ke),M.set(ke,qt),C({ok:!0,configPath:D,site:E,data:qt})}if(B.pathname==="/api/sites/deploy"&&_.method==="POST"){let w=await X(_),E=String(w.name??"").trim();if(!E||!f.sites?.[E])return C({ok:!1,error:`Site '${E}' was not found.`},404);if(w.confirm!==E)return C({ok:!1,error:`Type "${E}" to deploy this site.`},409);let N=ge(y,String(ke));await new Lt(it).run(new vn,{...N,artifactRoot:t}),fs(it,N,qt??{});let j=hs(it,{scope:N,desiredConfigHash:y.project.desiredConfigHash});if(j.decision.outcome==="block")return C({ok:!1,error:`Deployment blocked by security policy: ${j.decision.explanation}`,securityReview:j},409);let q={id:`deploy:${E}`,label:`Deploy ${E}`,description:`Deploy the ${E} site for ${ke}.`,command:["deploy","--env",ke,"--site",E,"--yes"],mutates:!0},H=await Me({controlPlane:y,environment:ke,actor:de,kind:"dashboard.site.deploy",resourceSlug:E,input:{site:E},execute:()=>km(q,{cwd:t,cliEntry:g})});return C({...H.result,controlPlaneOperation:H.operation,securityReview:j})}if(B.pathname==="/api/actions")return C(_n(ke));if(B.pathname==="/api/server/operations")return C(dl(f,qt));if(B.pathname==="/api/runtime/workloads"&&_.method==="GET"){let w=await pe(f,ke);return C(w)}if(B.pathname==="/api/runtime/logs"&&_.method==="GET"){let w=String(B.searchParams.get("workload")??"");if(!w)return C({ok:!1,error:"A workload query parameter is required."},422);let E=Math.min(1000,Math.max(1,Number(B.searchParams.get("limit"))||200));try{return C(await new ve(f,ke).logs(w,{limit:E}))}catch(N){return C({ok:!1,error:String(N?.message??N)},404)}}if(B.pathname==="/api/runtime/log-sessions"&&_.method==="POST"){let w=await X(_),E=String(w.workloadId??"");if(!E)return C({ok:!1,error:"A workloadId is required."},422);let N=await pe(f,ke),j=N.workloads.find((V)=>V.id===E);if(!j)return C({ok:!1,error:"Workload was not found in the current project and environment."},404);if(!j.capabilities.logs.supported)return C({ok:!1,error:j.capabilities.logs.reason??"Logs are unsupported for this workload."},409);let q=new ve(f,ke,{inventory:async()=>N}),H=or.create("logs",E);return(async()=>{let V=new Date(Date.now()-Math.min(3600000,Math.max(1000,Number(w.sinceMs)||60000)));try{for(let Y=0;Y<200&&!or.signal(H.id)?.aborted;Y++){let he=await q.logs(E,{limit:Math.min(500,Math.max(1,Number(w.limit)||200)),since:V});for(let le of he.lines)if(or.append(H.id,`${le.timestamp?`${le.timestamp} `:""}${le.message}
-`),le.timestamp)V=new Date(Math.max(V.getTime(),new Date(le.timestamp).getTime()+1));await Bun.sleep(3000)}if(!or.signal(H.id)?.aborted)or.close(H.id,"complete")}catch(Y){or.append(H.id,Y instanceof Error?Y.message:String(Y),"stderr"),or.close(H.id,"failed",Y instanceof Error?Y.message:String(Y))}})(),C({ok:!0,session:H,streamUrl:`/api/runtime/log-stream?id=${encodeURIComponent(H.id)}&workload=${encodeURIComponent(E)}`},201)}if((B.pathname==="/api/runtime/log-stream"||B.pathname==="/api/runtime/exec-stream")&&_.method==="GET"){let w=String(B.searchParams.get("id")??""),E=String(B.searchParams.get("workload")??""),N=Number(_.headers.get("last-event-id")??B.searchParams.get("after")??0)||0,j=or.read(w,E,N),q=B.pathname.includes("exec")?"exec":"logs";if(!j||j.kind!==q)return C({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return J_(or,j,N,_.signal)}if((B.pathname==="/api/runtime/log-sessions"||B.pathname==="/api/runtime/exec-sessions")&&_.method==="DELETE"){let w=await X(_),E=or.cancel(String(w.id??""),String(w.workloadId??""));if(!E)return C({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return C({ok:!0,session:E})}if(B.pathname==="/api/runtime/exec-sessions"&&_.method==="POST"){let w=await X(_),E=String(w.workloadId??""),N=await pe(f,ke),j=N.workloads.find((Y)=>Y.id===E);if(!j)return C({ok:!1,error:"Workload was not found in the current project and environment."},404);let q=Wt.resolveSession(_),H=new ve(f,ke,{inventory:async()=>N}),V=or.create("exec",E);return Me({controlPlane:y,environment:ke,actor:de,kind:"runtime.exec",resourceSlug:j.links.service,input:{workloadId:E,provider:j.provider,preset:w.preset?String(w.preset):null,freeForm:!!String(w.command??"").trim()},execute:()=>H.exec({workloadId:E,preset:["process","sockets","filesystem"].includes(String(w.preset))?String(w.preset):void 0,command:typeof w.command==="string"?w.command:void 0,confirm:String(w.confirm??""),recentAuth:!Ce||!!q&&_e.isRecentlyAuthenticated(q)})}).then(({result:Y,operation:he})=>{if(or.append(V.id,`operation ${he.id}
-`,"system"),Y.stdout)or.append(V.id,Y.stdout,"stdout");if(Y.stderr)or.append(V.id,Y.stderr,"stderr");or.close(V.id,Y.ok?"complete":"failed",Y.error)}).catch((Y)=>{let he=Y instanceof Error?Y.message:String(Y);or.append(V.id,he,"stderr"),or.close(V.id,"failed",he)}),C({ok:!0,session:V,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(V.id)}&workload=${encodeURIComponent(E)}`},202)}if(B.pathname==="/api/runtime/files/read"&&_.method==="POST"){let w=await X(_),E=await pe(f,ke),N=Wt.resolveSession(_),j=await new ve(f,ke,{inventory:async()=>E}).readFile({workloadId:String(w.workloadId??""),path:String(w.path??""),confirm:String(w.confirm??""),recentAuth:!Ce||!!N&&_e.isRecentlyAuthenticated(N)});return C(j,j.ok?200:409)}if(B.pathname==="/api/runtime/files/write"&&_.method==="POST"){let w=await X(_),E=await pe(f,ke),N=String(w.workloadId??""),j=E.workloads.find((Y)=>Y.id===N);if(!j)return C({ok:!1,error:"Workload was not found in the current project and environment."},404);let q=Wt.resolveSession(_),H=new ve(f,ke,{inventory:async()=>E}),V=await Me({controlPlane:y,environment:ke,actor:de,kind:"runtime.file.write",resourceSlug:j.links.service,input:{workloadId:N,provider:j.provider,path:String(w.path??""),bytes:Buffer.from(String(w.contentBase64??""),"base64").byteLength},execute:()=>H.writeFile({workloadId:N,path:String(w.path??""),contentBase64:String(w.contentBase64??""),confirm:String(w.confirm??""),recentAuth:!Ce||!!q&&_e.isRecentlyAuthenticated(q)})});return C({...V.result,controlPlaneOperation:V.operation},V.result.ok?200:409)}if(B.pathname==="/api/runtime/operations"&&_.method==="POST"){let w=await X(_),E=String(w.workloadId??""),N=String(w.action??"");if(!E||!["start","stop","restart","redeploy","scale","inspect"].includes(N))return C({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let j=await pe(f,ke),q=j.workloads.find((he)=>he.id===E);if(!q)return C({ok:!1,error:"Workload was not found in the current project and environment."},404);let H=Wt.resolveSession(_),V=new ve(f,ke,{inventory:async()=>j}),Y=await Me({controlPlane:y,environment:ke,actor:de,kind:`runtime.${N}`,resourceSlug:q.links.service,input:{workloadId:E,provider:q.provider,action:N,replicas:w.replicas==null?null:Number(w.replicas)},execute:()=>V.run({workloadId:E,action:N,replicas:w.replicas==null?void 0:Number(w.replicas),confirm:String(w.confirm??""),recentAuth:!Ce||!!H&&_e.isRecentlyAuthenticated(H)})});return C({...Y.result,controlPlaneOperation:Y.operation},Y.result.ok?200:409)}if(B.pathname.startsWith("/api/protection")){let w=de.role==="admin"||_c(de,"security:read"),E=de.role==="admin"||_c(de,"security:manage");if(!w)return C({ok:!1,error:"Protection controls require security:read."},403);let{ProtectionControlStore:N,describePosture:j}=await import("./protection/index.js"),q=new N(y.store),H=()=>{if(!E)throw Error("Changing protection controls requires security:manage.")};if(B.pathname==="/api/protection"&&_.method==="GET"){let V=q.current();return C({ok:!0,posture:j(V),controls:V,raw:q.raw()})}if(B.pathname==="/api/protection/attack-mode"&&_.method==="POST"){H();let V=await X(_);if(V.enabled===!1)return C({ok:!0,disabled:q.disableAttackMode()});return C({ok:!0,control:q.enableAttackMode({hours:V.hours==null?void 0:Number(V.hours),reason:String(V.reason??"Enabled from the dashboard."),actorId:qe(de).actor?.id})})}if(B.pathname==="/api/protection/pause"&&_.method==="POST"){H();let V=await X(_);if(V.enabled===!1)return C({ok:!0,resumed:q.resumeMitigations()});return C({ok:!0,control:q.pauseMitigations({hours:V.hours==null?void 0:Number(V.hours),reason:String(V.reason??""),actorId:qe(de).actor?.id})})}if(B.pathname==="/api/protection/ip-rules"&&_.method==="GET")return C({ok:!0,ipRules:q.current().ipRules});if(B.pathname==="/api/protection/ip-rules"&&(_.method==="POST"||_.method==="DELETE")){H();let V=await X(_),Y=V.list==="allow"?"allow":"block",he=_.method==="POST"?q.addIpRule(Y,String(V.cidr??"")):q.removeIpRule(Y,String(V.cidr??""));return C({ok:!0,ipRules:he})}return C({ok:!1,error:"Protection endpoint was not found."},404)}if(B.pathname.startsWith("/api/spend/")||B.pathname==="/api/usage"){let w=await mw(),{store:E,service:N,gate:j}=w,q=de.role==="admin"||_c(de,"billing:read"),H=de.role==="admin"||_c(de,"billing:manage");if(!q)return C({ok:!1,error:"Spend data requires the billing:read capability."},403);let V=y.environments.get(ke),Y={organizationId:y.organization.id,projectId:y.project.id,environmentId:V?.id},he=()=>{if(!H)throw Error("Changing a budget requires the billing:manage capability.")};if(B.pathname==="/api/usage"&&_.method==="GET")return C({ok:!0,...N.usageReport({organizationId:Y.organizationId,projectId:Y.projectId,period:B.searchParams.get("period")??"monthly",timezone:B.searchParams.get("timezone")??void 0})});if(B.pathname==="/api/spend/budgets"&&_.method==="GET")return C({ok:!0,budgets:E.listBudgets({organizationId:Y.organizationId,projectId:Y.projectId}).map((le)=>({...le,status:N.status(le)}))});if(B.pathname==="/api/spend/budgets"&&_.method==="POST"){he();let le=await X(_),Qe=String(le.scope??"project"),Ie=E.createBudget({organizationId:Y.organizationId,projectId:Qe==="organization"?void 0:Y.projectId,environmentId:Qe==="environment"?Y.environmentId:void 0,name:String(le.name??"").trim(),period:le.period??"monthly",timezone:le.timezone?String(le.timezone):void 0,softLimitCents:le.softLimitCents==null?void 0:Math.round(Number(le.softLimitCents)),hardLimitCents:le.hardLimitCents==null?void 0:Math.round(Number(le.hardLimitCents)),graceSeconds:le.graceSeconds==null?void 0:Number(le.graceSeconds),dryRun:le.dryRun!==!1});return C({ok:!0,budget:Ie})}if(B.pathname==="/api/spend/budgets"&&_.method==="PATCH"){he();let le=await X(_),Qe=String(le.id??""),Ie=E.getBudget(Qe);if(!Ie||Ie.organizationId!==Y.organizationId)return C({ok:!1,error:"Budget was not found."},404);return C({ok:!0,budget:E.updateBudget(Qe,{softLimitCents:le.softLimitCents==null?Ie.softLimitCents:Math.round(Number(le.softLimitCents)),hardLimitCents:le.hardLimitCents==null?Ie.hardLimitCents:Math.round(Number(le.hardLimitCents)),enabled:le.enabled==null?Ie.enabled:le.enabled===!0,dryRun:le.dryRun==null?Ie.dryRun:le.dryRun===!0},le.expectedVersion==null?void 0:Number(le.expectedVersion))})}if(B.pathname==="/api/spend/budgets"&&_.method==="DELETE"){he();let le=await X(_),Qe=String(le.id??""),Ie=E.getBudget(Qe);if(!Ie||Ie.organizationId!==Y.organizationId)return C({ok:!1,error:"Budget was not found."},404);let We=j.closeBudget(Qe);return E.deleteBudget(Qe),C({ok:!0,deleted:!0,lifted:We})}if(B.pathname==="/api/spend/check"&&_.method==="POST"){he();let le=await X(_),{SpendRunner:Qe}=await import("./spend/index.js"),Ie=new Qe({controlPlane:y.store,store:E,alerts:et});if(le.apply!==!0){let Ae=E.budgetsForScope(Y.organizationId,Y.projectId,Y.environmentId);return C({ok:!0,applied:!1,preview:Ae.map((ze)=>N.status(ze))})}let We=await Ie.run({...Y,environmentKind:V?.kind});return C({ok:!0,applied:!0,result:We})}if(B.pathname==="/api/spend/enforcement"&&_.method==="GET")return C({ok:!0,enforcement:j.listUnder({organizationId:Y.organizationId})});if(B.pathname==="/api/spend/release"&&_.method==="POST"){he();let le=await X(_),Qe=j.close(String(le.budgetId??""),le.action);return C({ok:Qe,released:Qe,note:Qe?"The next spend cycle re-applies this if spend is still over the threshold.":"That action was not in force."})}if(B.pathname==="/api/spend/anomalies"&&_.method==="GET")return C({ok:!0,anomalies:E.listAnomalies({organizationId:Y.organizationId,projectId:Y.projectId,unacknowledgedOnly:B.searchParams.get("unacknowledged")==="true"})});if(B.pathname==="/api/spend/anomalies/acknowledge"&&_.method==="POST"){he();let le=await X(_);return C({ok:!0,acknowledged:E.acknowledgeAnomaly(String(le.id??""))})}return C({ok:!1,error:"Spend endpoint was not found."},404)}if(B.pathname.startsWith("/api/health/")||B.pathname.startsWith("/api/alerts")||B.pathname.startsWith("/api/notifications/")){let w=y.environments.get(ke),E=y.store.listResources(y.project.id,w?.id),N=de.role==="admin"||!!w&&qs(de,w.id,"runtime:read")?E:E.filter((V)=>kr(de,V.id,"runtime:read")),j=(V)=>!V||N.some((Y)=>Y.id===V),q=(V)=>{if(!V)return;let Y=E.find((he)=>he.id===V||he.slug===V);if(!Y)throw Error("Alert resource was not found.");if(!j(Y.id))throw Error("Alert resource is outside your authorized scope.");return Y.id},H=qe(de).actor;if(B.pathname==="/api/health/checks"&&_.method==="GET")return C({ok:!0,checks:et.listHealthChecks(y.project.id,w?.id).filter((V)=>j(V.resourceId)).map((V)=>({...V,results:et.listHealthResults(V.id,20)}))});if(B.pathname==="/api/health/checks"&&_.method==="POST"){let V=await X(_),Y=String(V.kind??"http");if(Y==="command"&&de.role!=="admin")return C({ok:!1,error:"Command health checks require an administrator."},403);let he={method:String(V.config?.method??"GET").toUpperCase().slice(0,10),path:V.config?.path?String(V.config.path).slice(0,500):void 0,port:V.config?.port==null?void 0:Number(V.config.port),command:Array.isArray(V.config?.command)?V.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(V.config?.expectedStatuses)?V.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:V.config?.expectedBody?String(V.config.expectedBody).slice(0,500):void 0};return C({ok:!0,check:et.createHealthCheck({projectId:y.project.id,environmentId:w?.id,resourceId:q(V.resourceId??V.resource),name:String(V.name??""),kind:Y,target:String(V.target??""),config:he,intervalSeconds:Number(V.intervalSeconds)||60,timeoutSeconds:Number(V.timeoutSeconds)||10,failureThreshold:Number(V.failureThreshold)||3,recoveryThreshold:Number(V.recoveryThreshold)||2,regions:Array.isArray(V.regions)?V.regions.map(String):["local"],enabled:V.enabled!==!1})},201)}if(B.pathname==="/api/health/checks"&&_.method==="PATCH"){let V=await X(_),Y=et.getHealthCheck(String(V.id??""));if(!Y||!j(Y.resourceId))return C({ok:!1,error:"Health check was not found."},404);return C({ok:!0,check:et.setHealthCheckEnabled(Y.id,V.enabled!==!1)})}if(B.pathname==="/api/health/checks/test"&&_.method==="POST"){let V=await X(_),Y=et.getHealthCheck(String(V.id??""));if(!Y||!j(Y.resourceId))return C({ok:!1,error:"Health check was not found."},404);return C({ok:!0,productionIncidentCreated:!1,result:await new Ye(et).probe(Y)})}if(B.pathname==="/api/health/checks/run"&&_.method==="POST"){let V=await X(_),Y=et.getHealthCheck(String(V.id??""));if(!Y||!j(Y.resourceId))return C({ok:!1,error:"Health check was not found."},404);let he=await new Ye(et).runAndEvaluate(Y),le=[];for(let Qe of he.evaluations.filter((Ie)=>Ie.notify&&Ie.alert)){let Ie=pn.enqueue(y.organization.id,Qe.alert,Qe.transition);le.push(...await pn.deliverAll(Ie))}return C({ok:!0,...he,deliveries:le})}if(B.pathname==="/api/alerts/rules"&&_.method==="GET")return C({ok:!0,rules:et.listRules(y.project.id,w?.id).filter((V)=>j(V.resourceId))});if(B.pathname==="/api/alerts/rules"&&_.method==="POST"){let V=await X(_),Y=V.healthCheckId?et.getHealthCheck(String(V.healthCheckId)):void 0;if(V.healthCheckId&&(!Y||!j(Y.resourceId)))return C({ok:!1,error:"Health check was not found."},404);return C({ok:!0,rule:et.createRule({projectId:y.project.id,environmentId:w?.id,resourceId:q(V.resourceId??V.resource)??Y?.resourceId,healthCheckId:Y?.id,name:String(V.name??""),signal:String(V.signal??(Y?"health":"")),operator:String(V.operator??(Y?"unhealthy":"gt")),threshold:V.threshold==null?void 0:Number(V.threshold),recoveryThreshold:V.recoveryThreshold==null?void 0:Number(V.recoveryThreshold),windowMs:Number(V.windowMs)||300000,consecutive:Number(V.consecutive)||Y?.failureThreshold||3,recoveryConsecutive:Number(V.recoveryConsecutive)||Y?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(V.noDataPolicy))?V.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(V.severity))?V.severity:"warning",groupBy:Array.isArray(V.groupBy)?V.groupBy.map(String):[],labels:V.labels&&typeof V.labels==="object"?V.labels:{},enabled:V.enabled!==!1})},201)}if(B.pathname==="/api/alerts/rules"&&_.method==="PATCH"){let V=await X(_),Y=et.getRule(String(V.id??""));if(!Y||!j(Y.resourceId))return C({ok:!1,error:"Alert rule was not found."},404);return C({ok:!0,rule:et.setRuleEnabled(Y.id,V.enabled!==!1)})}if(B.pathname==="/api/alerts/evaluate"&&_.method==="POST")return C({ok:!0,...await xm(w?.id)});if(B.pathname==="/api/alerts"&&_.method==="GET")return C({ok:!0,alerts:et.listAlerts(y.project.id,{environmentId:w?.id,states:B.searchParams.getAll("state").length?B.searchParams.getAll("state"):void 0,limit:Number(B.searchParams.get("limit"))||200}).filter((V)=>j(V.resourceId)).map((V)=>({...V,deliveries:et.listDeliveries({alertId:V.id,limit:50})}))});if(B.pathname==="/api/alerts/action"&&_.method==="POST"){let V=await X(_),Y=et.getAlert(String(V.id??""));if(!Y||!j(Y.resourceId))return C({ok:!1,error:"Alert was not found."},404);let he=String(V.action??"");if(he==="acknowledge")return C({ok:!0,alert:et.acknowledge(Y.id,H?.id??"")});if(he==="assign")return C({ok:!0,alert:et.assign(Y.id,V.ownerActorId==="me"?H?.id:V.ownerActorId?String(V.ownerActorId):void 0,H?.id)});if(he==="silence"){if(de.role!=="admin")return C({ok:!1,error:"Silencing production alerts requires an administrator."},403);let le=Wt.resolveSession(_);if(Ce&&(!le||!_e.isRecentlyAuthenticated(le)))return C({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return C({ok:!0,alert:et.silenceAlert(Y.id,String(V.until??""),H?.id)})}return C({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(B.pathname==="/api/alerts/silences"&&_.method==="POST"){let V=await X(_);return C({ok:!0,id:et.createSilence({projectId:y.project.id,environmentId:w?.id,resourceId:q(V.resourceId??V.resource),matcher:V.matcher,reason:String(V.reason??""),startsAt:String(V.startsAt??new Date().toISOString()),endsAt:String(V.endsAt??""),timezone:String(V.timezone??"UTC"),actorId:H?.id})},201)}if(B.pathname==="/api/notifications/channels"&&_.method==="GET")return C({ok:!0,channels:et.listChannels(y.organization.id)});if(B.pathname==="/api/notifications/channels"&&_.method==="POST"){let V=await X(_),Y=String(V.kind??""),he=Y==="email"?{to:V.config?.to,from:V.config?.from}:Y==="telegram"?{chatId:String(V.config?.chatId??"")}:{};return C({ok:!0,channel:et.createChannel({organizationId:y.organization.id,name:String(V.name??""),kind:Y,config:he,credential:V.credential?String(V.credential):void 0,actorId:H?.id})},201)}if(B.pathname==="/api/notifications/channels"&&_.method==="PATCH"){let V=await X(_),Y=String(V.id??"");if(V.credential)return C({ok:!0,channel:et.rotateChannel(Y,String(V.credential))});let he=String(V.status??"paused");if(!["active","paused","disabled"].includes(he))return C({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return C({ok:!0,channel:et.setChannelStatus(Y,he)})}if(B.pathname==="/api/notifications/channels/test"&&_.method==="POST"){let V=await X(_);return C({ok:!0,productionIncidentCreated:!1,result:await pn.testChannel(String(V.id??""))})}if(B.pathname==="/api/notifications/routes"&&_.method==="GET")return C({ok:!0,routes:et.listRoutes(y.organization.id)});if(B.pathname==="/api/notifications/routes"&&_.method==="POST"){let V=await X(_),Y=Array.isArray(V.channelIds)?V.channelIds.map(String):[];if(Y.some((he)=>et.getChannel(he)?.organizationId!==y.organization.id))return C({ok:!1,error:"Route contains an unavailable channel."},422);return C({ok:!0,route:et.createRoute({organizationId:y.organization.id,name:String(V.name??""),priority:Number(V.priority)||0,matcher:V.matcher&&typeof V.matcher==="object"?V.matcher:{},channelIds:Y,quietHours:V.quietHours,groupWaitSeconds:Number(V.groupWaitSeconds)||30,reminderSeconds:V.reminderSeconds==null?void 0:Number(V.reminderSeconds),escalation:Array.isArray(V.escalation)?V.escalation:[],template:V.template?String(V.template):void 0,rateLimitPerMinute:Number(V.rateLimitPerMinute)||60,enabled:V.enabled!==!1})},201)}if(B.pathname==="/api/notifications/routes"&&_.method==="PATCH"){let V=await X(_),Y=et.getRoute(String(V.id??""));if(!Y||Y.organizationId!==y.organization.id)return C({ok:!1,error:"Notification route was not found."},404);return C({ok:!0,route:et.setRouteEnabled(Y.id,V.enabled!==!1)})}if(B.pathname==="/api/notifications/routes/preview"&&_.method==="POST"){let V=await X(_),he=(V.alertId?et.getAlert(String(V.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:y.project.id,environmentId:w?.id,resourceId:q(V.resourceId??V.resource),dedupKey:"preview",groupKey:String(V.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(V.severity))?V.severity:"warning",title:String(V.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return C({ok:!0,productionIncidentCreated:!1,matches:pn.preview(y.organization.id,he,String(V.eventType??"firing")).map((le)=>({route:le.route,channels:le.channels,quiet:le.quiet}))})}if(B.pathname==="/api/notifications/deliveries"&&_.method==="GET")return C({ok:!0,deliveries:et.listDeliveries({alertId:B.searchParams.get("alertId")??void 0,states:B.searchParams.getAll("state"),limit:Number(B.searchParams.get("limit"))||200})});if(B.pathname==="/api/notifications/deliveries/retry"&&_.method==="POST"){let V=await X(_),Y=et.getDelivery(String(V.id??""));if(!Y)return C({ok:!1,error:"Delivery was not found."},404);return et.updateDelivery(Y.id,{state:"retrying",attempt:Math.max(0,Y.attempt-1),nextAttemptAt:new Date().toISOString()}),C({ok:!0,delivery:await pn.deliver(Y.id)})}}if(B.pathname.startsWith("/api/jobs")||B.pathname.startsWith("/api/workers")){let w=y.environments.get(ke),E=y.store.listResources(y.project.id,w?.id),j=de.role==="admin"||!!w&&qs(de,w.id,"automation:read")?E:E.filter((Ae)=>kr(de,Ae.id,"automation:read")),q=(Ae)=>!Ae||j.some((ze)=>ze.id===Ae),H=qe(de).actor,V=M.get(ke)??O,Y=dl(f,V),he=Y.filter((Ae)=>!Ae.danger&&["scheduler","backup","worker"].includes(Ae.group)),le=K(f),Qe=()=>{let Ae=Wt.resolveSession(_);return!Ce||!!Ae&&_e.isRecentlyAuthenticated(Ae)},Ie=(Ae)=>{if(!Ae||typeof Ae!=="object"||Array.isArray(Ae))return{};let ze=Object.entries(Ae).slice(0,50);if(ze.some(([,rt])=>typeof rt!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(rt)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(ze)},We=(Ae,ze,rt)=>y.store.appendEvent({organizationId:y.organization.id,projectId:y.project.id,resourceId:rt,actorId:H?.id,type:`job.${Ae}`,payload:ze});if(B.pathname==="/api/jobs/preview"&&_.method==="POST"){let Ae=await X(_);try{return C({ok:!0,productionExecutionCreated:!1,preview:Ut(String(Ae.expression??""),String(Ae.timezone??"UTC"),new Date(Ae.from?String(Ae.from):Date.now()),Number(Ae.count)||5)})}catch(ze){return C({ok:!1,error:ze instanceof Error?ze.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(B.pathname==="/api/jobs"&&_.method==="GET")return C({ok:!0,jobs:wr.list(y.project.id,{environmentId:w?.id}).filter((Ae)=>q(Ae.resourceId)).map((Ae)=>({...Ae,preview:Ut(Ae.normalizedExpression,Ae.timezone,new Date,5),capability:Tn(Ae),lastExecution:wr.listExecutions(Ae.id,1)[0]}))});if(B.pathname==="/api/jobs"&&_.method==="POST"){let Ae=await X(_),ze=String(Ae.provider??(le==="serverless"?"eventbridge":"server")),rt=le==="serverless"?"eventbridge":"server";if(ze!==rt)return C({ok:!1,error:`${le} environments accept ${rt} schedules through this adapter.`},422);let ft=Ae.operationId?String(Ae.operationId):void 0;if(ze==="server"&&(!ft||!he.some((ar)=>ar.id===ft)))return C({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let Rt=Tn({provider:ze,expression:String(Ae.expression??""),flexibleMinutes:Number(Ae.flexibleMinutes)||0,missedRunPolicy:Ae.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Ae.overlapPolicy))?Ae.overlapPolicy:"forbid"});if(!Rt.supported)return C({ok:!1,error:Rt.notes.join(" ")},422);let an=Ae.resourceId?E.find((ar)=>ar.id===Ae.resourceId||ar.slug===Ae.resourceId):void 0;if(Ae.resourceId&&(!an||!q(an.id)))return C({ok:!1,error:"Job resource was not found."},404);try{let ar=ze==="server"?{kind:"dashboard_operation",operationId:ft}:{kind:"serverless_scheduler",action:"run"},Ai=wr.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:w?.id,resourceId:an?.id,name:String(Ae.name??""),provider:ze,expression:String(Ae.expression??""),timezone:String(Ae.timezone??"UTC"),startsAt:Ae.startsAt?String(Ae.startsAt):void 0,endsAt:Ae.endsAt?String(Ae.endsAt):void 0,flexibleMinutes:Number(Ae.flexibleMinutes)||0,target:ar,payloadRefs:Ie(Ae.payloadRefs),missedRunPolicy:Ae.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Ae.overlapPolicy))?Ae.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(Ae.maxAttempts)||3,backoffSeconds:Number(Ae.backoffSeconds)||30,deadLetterRef:Ae.deadLetterRef?String(Ae.deadLetterRef):void 0},timeoutSeconds:Number(Ae.timeoutSeconds)||900,enabled:Ae.enabled!==!1,origin:"managed",ownerActorId:H?.id,observedState:{},reconciliationStatus:"pending"});return We("created",{jobId:Ai.id,provider:Ai.provider,expression:Ai.normalizedExpression},Ai.resourceId),C({ok:!0,job:Ai,capability:Rt},201)}catch(ar){return C({ok:!1,error:ar instanceof Error?ar.message:"Scheduled job could not be created."},422)}}if(B.pathname==="/api/jobs"&&_.method==="PATCH"){let Ae=await X(_),ze=wr.get(String(Ae.id??""));if(!ze||!q(ze.resourceId))return C({ok:!1,error:"Scheduled job was not found."},404);if(ze.origin==="config")return C({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let rt=Ae.missedRunPolicy==null?void 0:String(Ae.missedRunPolicy),ft=Ae.overlapPolicy==null?void 0:String(Ae.overlapPolicy);if(rt&&!["skip","catch_up"].includes(rt))return C({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(ft&&!["allow","forbid","replace"].includes(ft))return C({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let Rt=wr.updateSchedule(ze.id,{expression:Ae.expression?String(Ae.expression):void 0,timezone:Ae.timezone?String(Ae.timezone):void 0,missedRunPolicy:rt,overlapPolicy:ft,timeoutSeconds:Ae.timeoutSeconds==null?void 0:Number(Ae.timeoutSeconds)});return We("updated",{jobId:Rt.id,expression:Rt.normalizedExpression,version:Rt.version},Rt.resourceId),C({ok:!0,job:Rt})}catch(Rt){return C({ok:!1,error:Rt instanceof Error?Rt.message:"Scheduled job could not be updated."},422)}}if(B.pathname==="/api/jobs/action"&&_.method==="POST"){let Ae=await X(_),ze=wr.get(String(Ae.id??""));if(!ze||!q(ze.resourceId))return C({ok:!1,error:"Scheduled job was not found."},404);let rt=String(Ae.action??"");if(rt==="run"){let ft=Tm.enqueue(ze,{trigger:"manual",actorId:H?.id});return We("run_queued",{jobId:ze.id,executionId:ft.id},ze.resourceId),C({ok:!0,execution:ft},202)}if(["disable","delete"].includes(rt)&&w?.kind==="production"){if(String(Ae.confirm??"")!==rt)return C({ok:!1,error:`Type "${rt}" to confirm this production change.`},409);if(!Qe())return C({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(rt==="enable"||rt==="disable"){let ft=wr.setEnabled(ze.id,rt==="enable");return We(rt==="enable"?"enabled":"disabled",{jobId:ze.id},ze.resourceId),C({ok:!0,job:ft})}if(rt==="delete")try{return wr.remove(ze.id),We("deleted",{jobId:ze.id,name:ze.name},ze.resourceId),C({ok:!0,deleted:ze.id})}catch(ft){return C({ok:!1,error:ft instanceof Error?ft.message:"Scheduled job could not be deleted."},409)}return C({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(B.pathname==="/api/jobs/history"&&_.method==="GET"){let Ae=wr.get(String(B.searchParams.get("jobId")??""));if(!Ae||!q(Ae.resourceId))return C({ok:!1,error:"Scheduled job was not found."},404);return C({ok:!0,executions:wr.listExecutions(Ae.id,Number(B.searchParams.get("limit"))||100).map((ze)=>({...ze,logs:ze.operationId?Dt.logs(ze.operationId,{limit:500}):[]}))})}if(B.pathname==="/api/jobs/reconcile"&&_.method==="POST"){if(!w)return C({ok:!1,error:"Environment was not found."},404);let Ae=Da(wr,f,{organization:y.organization,project:y.project,environment:w,resources:E});return We("reconciled",Ae),C({ok:!0,reconciliation:Ae})}if(B.pathname==="/api/workers"&&_.method==="GET"){let Ae=Array.isArray(V.workersDetail??V.workers)?V.workersDetail??V.workers:[];return C({ok:!0,workers:wr.listWorkers(y.project.id,w?.id).filter((ze)=>q(ze.resourceId)).map((ze)=>{let rt=Ae.find((ft)=>ft.name===ze.name||ft.site===ze.target.site);return rt?{...ze,observedState:{...ze.observedState,status:rt.status??"configured",currentJob:rt.currentJob??null,failures:Number(rt.failed??rt.failures)||0,processed:Number(rt.processed)||0}}:ze})})}if(B.pathname==="/api/workers/action"&&_.method==="POST"){let Ae=await X(_),ze=wr.getWorker(String(Ae.id??""));if(!ze||!q(ze.resourceId))return C({ok:!1,error:"Worker was not found."},404);let rt=String(Ae.action??"");if(rt==="restart"){if(String(Ae.confirm??"")!==ze.name)return C({ok:!1,error:`Type "${ze.name}" to restart this worker.`},409);let ft=Y.find((ar)=>ar.id===ze.target.operationId);if(!ft)return C({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let Rt=await ll(f,ke,ft),an=wr.reconcileWorker(ze.id,Rt.ok?"in_sync":"unavailable",{...ze.observedState,lastRestartAt:new Date().toISOString(),command:Rt.command??null,error:Rt.error??Rt.stderr??null});return We("worker_restarted",{workerId:ze.id,ok:Rt.ok},ze.resourceId),C({...Rt,worker:an},Rt.ok?200:409)}if(rt==="scale")return C({ok:!1,error:ze.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return C({ok:!1,error:"Action must be restart or scale."},422)}}if(B.pathname.startsWith("/api/telemetry/")){let w=y.environments.get(ke),E=new Pt(y.store),N=y.store.listResources(y.project.id,w?.id),j=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(B.pathname)?"runtime:logs":"runtime:read",q=de.role==="admin"||!!w&&qs(de,w.id,j),H=q?N:N.filter((Ie)=>kr(de,Ie.id,j)),V=(Ie)=>AS(H,q,Ie),Y=(Ie)=>{let We=new Date,Ae={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},ze=String(Ie.to??We.toISOString()),rt=String(Ie.from??new Date(new Date(ze).getTime()-(Ae[String(Ie.range??"1h")]??Ae["1h"])).toISOString()),ft=(an)=>{let ar=(Array.isArray(an)?an:String(an??"").split(",")).map(String).filter(Boolean);return ar.length?ar:void 0},Rt=ft(Ie.kinds)?.filter((an)=>["metric","log","trace","request","event"].includes(an));return{projectId:y.project.id,environmentId:w?.id,resourceIds:V(Ie.resources),kinds:Rt,names:ft(Ie.names),sources:ft(Ie.sources),levels:ft(Ie.levels),from:rt,to:ze,text:String(Ie.text??"")||void 0,traceId:String(Ie.traceId??"")||void 0,requestId:String(Ie.requestId??"")||void 0,deploymentId:String(Ie.deploymentId??"")||void 0,releaseId:String(Ie.releaseId??"")||void 0,workloadId:String(Ie.workloadId??"")||void 0,cursor:String(Ie.cursor??"")||void 0,limit:Number(Ie.limit)||void 0}},he=Object.fromEntries(B.searchParams.entries()),le=(Ie=!1)=>Sm({controlPlane:y.store,projectId:y.project.id,environmentId:w?.id,config:f,environment:ke,force:Ie,lightweight:!Ie}),Qe=()=>{let Ie=y.store.getSetting(`telemetry.collection:${y.project.id}:${w?.id??"all"}`)??{};return{generatedAt:String(Ie.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(Ie.statuses)?Ie.statuses:[],errors:Array.isArray(Ie.errors)?Ie.errors:[],policy:Ie.policy??dr(y.store,y.project.id)}};if(B.pathname==="/api/telemetry/status"&&_.method==="GET"){le(!1);let Ie=Qe(),We=q?Ie.statuses:E.status(y.project.id,w?.id,Ie.policy.rawDays,Ie.policy.samplingRate,H.map((ze)=>ze.id)),Ae=We.reduce((ze,rt)=>ze+rt.estimatedDailyBytes*30,0);return C({ok:!0,generatedAt:Ie.generatedAt,cached:Ie.cached,sources:We,errors:q?Ie.errors:[],policy:Ie.policy,retention:{rawDays:Ie.policy.rawDays,downsampleAfterDays:Ie.policy.downsampleAfterDays,downsampleBucketMs:Ie.policy.downsampleBucketMs,maxRecords:Ie.policy.maxRecords},estimatedMonthlyBytes:Ae,estimatedMonthlyCostUsd:Jd(Ae,Ie.policy),costEstimateConfigured:Ie.policy.estimatedStorageUsdPerGbMonth>0})}if(B.pathname==="/api/telemetry/settings"&&_.method==="GET")return C({ok:!0,policy:dr(y.store,y.project.id)});if(B.pathname==="/api/telemetry/settings"&&_.method==="PATCH"){let Ie=Wd(y.store,y.project.id,await X(_));return DS(y.project.id),C({ok:!0,policy:Ie})}if(B.pathname==="/api/telemetry/query"&&_.method==="GET"){le(!1);let Ie=Qe();return C({ok:!0,collection:{generatedAt:Ie.generatedAt,cached:Ie.cached},...E.query(Y(he))})}if(B.pathname==="/api/telemetry/tail"&&_.method==="GET"){le(!1);let Ie=new TextEncoder,We=new Date,Ae=Y({...he,kinds:he.kinds||"log,request,event,trace",from:he.from||new Date(We.getTime()-120000).toISOString(),to:We.toISOString(),limit:Math.min(1000,Number(he.limit)||200),cursor:void 0}),ze=_.headers.get("last-event-id")||String(he.cursor??"")||void 0,rt,ft=!1,Rt=!1,an=new ReadableStream({start(ar){let Ai=()=>{if(ft)return;if(ft=!0,rt)clearInterval(rt);_.signal.removeEventListener("abort",Ai);try{ar.close()}catch{}},qm=async()=>{if(ft||Rt)return;Rt=!0;try{let to=E.tail({...Ae,to:new Date(Date.now()+1000).toISOString()},ze);for(let Vm of to.records)ze=zi(Vm)??ze,ar.enqueue(Ie.encode(`id: ${ze??""}
+This replacement link expires ${N.invitation.expiresAt} and can be used once.`});return C({invitation:N.invitation,token:N.token,acceptUrl:j,delivered:q})}catch(N){return C({ok:!1,error:N instanceof Error?N.message:"Invitation could not be resent."},409)}}if(B.pathname==="/api/organization/memberships"&&_.method==="PATCH"){let w=await X(_),E=y.store.getMembership(String(w.id??"")),N=ml(w.roleTemplate),j=kc(w);if(!E||E.organizationId!==y.organization.id)return C({ok:!1,error:"Membership was not found."},404);if(!N||!j)return C({ok:!1,error:"Choose a valid role template and resource scope."},422);let q=qe(ae);if((E.roleTemplate==="owner"||N==="owner")&&(!Gn(String(w.password??""),ae.passwordHash)||q.membership?.roleTemplate!=="owner"))return C({ok:!1,error:"Ownership changes require an owner to re-enter their password."},401);let V=y.store.resolveAuthorizationTarget(y.organization.id,j)??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id}),Y=y.store.listGrants(E.id),ge=ir({membership:E,grants:Y,target:V}),le={...E,roleTemplate:N,scope:j},Qe=ir({membership:le,grants:Y,target:V}),ke={gained:Qe.filter((We)=>!ge.includes(We)),lost:ge.filter((We)=>!Qe.includes(We))};if(w.preview===!0)return C({membership:E,proposed:{roleTemplate:N,scope:j},accessDiff:ke});if(String(w.confirm??"")!==E.id)return C({ok:!1,error:`Confirm this change with membership ID ${E.id}.`,accessDiff:ke},409);try{return C({membership:y.store.updateMembership({id:E.id,roleTemplate:N,scope:j,actorId:q.actor?.id}),accessDiff:ke})}catch(We){return C({ok:!1,error:We instanceof Error?We.message:"Membership could not be updated."},409)}}if(B.pathname==="/api/organization/memberships"&&_.method==="DELETE"){let w=await X(_),E=y.store.getMembership(String(w.id??""));if(!E||E.organizationId!==y.organization.id)return C({ok:!1,error:"Membership was not found."},404);if(String(w.confirm??"")!==E.id)return C({ok:!1,error:`Confirm removal with membership ID ${E.id}.`},409);let N=qe(ae);if(E.roleTemplate==="owner"&&(N.membership?.roleTemplate!=="owner"||!Gn(String(w.password??""),ae.passwordHash)))return C({ok:!1,error:"Removing an owner requires an owner to re-enter their current password."},401);try{return C({membership:y.store.revokeMembership(E.id,N.actor?.id)})}catch(j){return C({ok:!1,error:j instanceof Error?j.message:"Membership could not be removed."},409)}}if(B.pathname==="/api/organization/grants"&&_.method==="POST"){let w=await X(_),E=String(w.capability??""),N=w.effect==="deny"?"deny":w.effect==="allow"?"allow":void 0,j=kc(w),q=qe(ae);if(!N||!j||!Ce.includes(E))return C({ok:!1,error:"Choose a valid capability, effect, and resource scope."},422);try{return C({grant:y.store.upsertGrant({organizationId:y.organization.id,membershipId:String(w.membershipId??""),effect:N,capability:E,scope:j,actorId:q.actor?.id})},201)}catch(H){return C({ok:!1,error:H instanceof Error?H.message:"Grant could not be created."},422)}}if(B.pathname==="/api/organization/grants"&&_.method==="DELETE"){let w=await X(_),E=qe(ae),N=y.store.getGrant(String(w.id??""));if(!N||N.organizationId!==y.organization.id)return C({ok:!1,error:"Grant was not found."},404);return C({ok:y.store.removeGrant(N.id,E.actor?.id)})}if(B.pathname==="/api/tags"&&_.method==="GET")return C({tags:y.store.listTags(y.project.id),assignments:y.store.listResourceTags(y.project.id)});if(B.pathname==="/api/tags"&&_.method==="POST"){let w=await X(_),E=y.store.upsertTag(y.project.id,String(w.name??""),String(w.color??"#5a8be0"));if(w.resourceId)y.store.assignTag(String(w.resourceId),E.id);return C({tag:E},201)}if(B.pathname==="/api/tags"&&_.method==="DELETE"){let w=await X(_);return y.store.removeTag(String(w.resourceId??""),String(w.tagId??"")),C({ok:!0})}if(B.pathname==="/"&&!iw(B.pathname,gn))return new Response(null,{status:302,headers:{location:`/server/sites?env=${encodeURIComponent(Se)}`}});if(B.pathname==="/"&&qt?.mode==="serverless")return new Response(null,{status:302,headers:{location:`/serverless?env=${encodeURIComponent(Se)}`}});let Tc=og(B.pathname);if(Tc)return new Response(null,{status:308,headers:{location:`${Tc}?env=${encodeURIComponent(Se)}`}});if(B.pathname==="/api/env"&&_.method==="POST"){let w=await X(_),E=String(w.env??"");if(!k.includes(E))return C({ok:!1,error:`Unknown environment '${E}'.`,environments:k},404);return C({ok:!0,environment:E,environments:k,href:`?env=${encodeURIComponent(E)}`})}if(B.pathname==="/api/config"){let w={...ws(f),environment:Se,environments:k};return C(tS(w,gn))}if(B.pathname==="/api/ssh-keys"&&_.method==="GET")return C({configPath:D,keys:Qi(zs(f))});if(B.pathname==="/api/ssh-keys"&&_.method==="POST"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=await ni(D,"utf8"),N=zs(f),j=ob({configText:E,name:String(w.name??""),publicKey:String(w.publicKey??""),existingKeys:N});return await Eo(D,j),ew(f,[...N,{name:String(w.name??"").trim(),publicKey:String(w.publicKey??"").trim().replace(/\s+/g," ")}]),C({ok:!0,configPath:D,keys:Qi(zs(f))})}if(B.pathname==="/api/ssh-keys"&&_.method==="DELETE"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=String(w.name??B.searchParams.get("name")??""),N=await ni(D,"utf8"),j=zs(f),q=sb({configText:N,name:E,existingKeys:j});return await Eo(D,q),ew(f,j.filter((H)=>H.name!==E.trim())),C({ok:!0,configPath:D,keys:Qi(zs(f))})}if(B.pathname==="/api/firewall"&&_.method==="GET")return C({configPath:D,alwaysOpen:[22,80,443],ports:wm(f)});if(B.pathname==="/api/firewall"&&_.method==="POST"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=Number(w.port);if(!Sc(E))return C({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let N=wm(f),j=await ni(D,"utf8");try{await Eo(D,dS(j,E,N))}catch(V){return C({ok:!1,error:V?.message??String(V)},422)}let q=Io([...N,E]);tw(f,q);let H=w.apply===!1?null:await vc(f,Se,`ufw allow ${E}/tcp`).catch((V)=>({ok:!1,error:String(V?.message??V)}));return C({ok:!0,configPath:D,ports:q,apply:H})}if(B.pathname==="/api/firewall"&&_.method==="DELETE"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=Number(w.port??B.searchParams.get("port"));if(!Sc(E))return C({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let N=wm(f),j=await ni(D,"utf8");await Eo(D,lS(j,E,N));let q=Io(N.filter((V)=>V!==E));tw(f,q);let H=w.apply===!1?null:await vc(f,Se,`ufw delete allow ${E}/tcp`).catch((V)=>({ok:!1,error:String(V?.message??V)}));return C({ok:!0,configPath:D,ports:q,apply:H})}if(B.pathname==="/api/sites"&&_.method==="POST"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=String(w.name??"").trim(),N=String(w.root??"").trim();if(!E||!N)return C({ok:!1,error:"Site name and root are required."},422);let j={deploy:w.deploy==="bucket"?"bucket":"server",root:N,path:String(w.path??"").trim()||void 0,domain:String(w.domain??"").trim()||void 0,build:String(w.build??"").trim()||void 0,start:String(w.start??"").trim()||void 0,port:w.port?Number(w.port):void 0,type:String(w.type??"").trim()||void 0};if(j.port!==void 0&&(!Number.isInteger(j.port)||j.port<1||j.port>65535))return C({ok:!1,error:"Port must be a number between 1 and 65535."},422);let q=await ni(D,"utf8"),H=Pn({configText:q,name:E,root:j.root,domain:j.domain,path:j.path,deploy:j.deploy,build:j.build,start:j.start,port:j.port,type:j.type});return await Eo(D,H),nT(f,E,Object.fromEntries(Object.entries(j).filter(([,V])=>V!==void 0))),qt=await Ro(f,Se),M.set(Se,qt),C({ok:!0,configPath:D,site:E,data:qt})}if(B.pathname==="/api/sites"&&_.method==="DELETE"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=String(w.name??B.searchParams.get("name")??"").trim();if(!E||!f.sites?.[E])return C({ok:!1,error:`Site '${E}' was not found.`},404);let N=await ni(D,"utf8");return await Eo(D,kn({configText:N,name:E})),delete f.sites[E],qt=await Ro(f,Se),M.set(Se,qt),C({ok:!0,configPath:D,site:E,data:qt})}if(B.pathname==="/api/sites"&&_.method==="PATCH"){if(!D)return C({ok:!1,error:"No cloud config file was found in this checkout."},404);let w=await X(_),E=String(w.name??"").trim(),N=f.sites?.[E];if(!E||!N)return C({ok:!1,error:`Site '${E}' was not found.`},404);if(gn.role==="member"){let H=oS(w);if(!H.ok)return C({ok:!1,error:H.error},403);let V=sS({siteName:E,body:w,sites:f.sites??{},ownSites:Object.keys(gn.sites)});if(!V.ok)return C({ok:!1,error:V.error},409)}if(w.port!==void 0&&w.port!==null&&w.port!==""&&(!Number.isInteger(Number(w.port))||Number(w.port)<1||Number(w.port)>65535))return C({ok:!1,error:"Port must be a number between 1 and 65535."},422);if(typeof w.domain==="string"&&w.domain.trim()&&!Xa(w.domain.trim()))return C({ok:!1,error:`Domain '${w.domain.trim()}' is not a valid hostname.`},422);let j=await ni(D,"utf8"),q=(H,V)=>{j=bs({configText:j,siteName:E,key:H,valueText:V})};if(w.ssl!==void 0)q("ssl",Yu(w.ssl)),N.ssl=w.ssl;if(w.env!==void 0&&w.env&&typeof w.env==="object")q("env",eg(w.env)),N.env=w.env;if(w.aliases!==void 0&&Array.isArray(w.aliases)){let H=w.aliases.map((V)=>String(V));q("aliases",tg(H)),N.aliases=H.map((V)=>V.trim().toLowerCase()).filter(Boolean)}if(w.redirects!==void 0&&w.redirects&&typeof w.redirects==="object")q("redirects",rg(w.redirects)),N.redirects=w.redirects;for(let H of["domain","path","build","start","type","root","php"])if(typeof w[H]==="string"&&w[H].trim())q(H,Zu(String(w[H]).trim())),N[H]=String(w[H]).trim();if(w.port!==void 0&&w.port!==null&&w.port!=="")q("port",String(Number(w.port))),N.port=Number(w.port);return await Eo(D,j),qt=await Ro(f,Se),M.set(Se,qt),C({ok:!0,configPath:D,site:E,data:qt})}if(B.pathname==="/api/sites/deploy"&&_.method==="POST"){let w=await X(_),E=String(w.name??"").trim();if(!E||!f.sites?.[E])return C({ok:!1,error:`Site '${E}' was not found.`},404);if(w.confirm!==E)return C({ok:!1,error:`Type "${E}" to deploy this site.`},409);let N=pe(y,String(Se));await new Lt(it).run(new vn,{...N,artifactRoot:t}),fs(it,N,qt??{});let j=hs(it,{scope:N,desiredConfigHash:y.project.desiredConfigHash});if(j.decision.outcome==="block")return C({ok:!1,error:`Deployment blocked by security policy: ${j.decision.explanation}`,securityReview:j},409);let q={id:`deploy:${E}`,label:`Deploy ${E}`,description:`Deploy the ${E} site for ${Se}.`,command:["deploy","--env",Se,"--site",E,"--yes"],mutates:!0},H=await Me({controlPlane:y,environment:Se,actor:ae,kind:"dashboard.site.deploy",resourceSlug:E,input:{site:E},execute:()=>km(q,{cwd:t,cliEntry:g})});return C({...H.result,controlPlaneOperation:H.operation,securityReview:j})}if(B.pathname==="/api/actions")return C(_n(Se));if(B.pathname==="/api/server/operations")return C(dl(f,qt));if(B.pathname==="/api/runtime/workloads"&&_.method==="GET"){let w=await me(f,Se);return C(w)}if(B.pathname==="/api/runtime/logs"&&_.method==="GET"){let w=String(B.searchParams.get("workload")??"");if(!w)return C({ok:!1,error:"A workload query parameter is required."},422);let E=Math.min(1000,Math.max(1,Number(B.searchParams.get("limit"))||200));try{return C(await new Te(f,Se).logs(w,{limit:E}))}catch(N){return C({ok:!1,error:String(N?.message??N)},404)}}if(B.pathname==="/api/runtime/log-sessions"&&_.method==="POST"){let w=await X(_),E=String(w.workloadId??"");if(!E)return C({ok:!1,error:"A workloadId is required."},422);let N=await me(f,Se),j=N.workloads.find((V)=>V.id===E);if(!j)return C({ok:!1,error:"Workload was not found in the current project and environment."},404);if(!j.capabilities.logs.supported)return C({ok:!1,error:j.capabilities.logs.reason??"Logs are unsupported for this workload."},409);let q=new Te(f,Se,{inventory:async()=>N}),H=or.create("logs",E);return(async()=>{let V=new Date(Date.now()-Math.min(3600000,Math.max(1000,Number(w.sinceMs)||60000)));try{for(let Y=0;Y<200&&!or.signal(H.id)?.aborted;Y++){let ge=await q.logs(E,{limit:Math.min(500,Math.max(1,Number(w.limit)||200)),since:V});for(let le of ge.lines)if(or.append(H.id,`${le.timestamp?`${le.timestamp} `:""}${le.message}
+`),le.timestamp)V=new Date(Math.max(V.getTime(),new Date(le.timestamp).getTime()+1));await Bun.sleep(3000)}if(!or.signal(H.id)?.aborted)or.close(H.id,"complete")}catch(Y){or.append(H.id,Y instanceof Error?Y.message:String(Y),"stderr"),or.close(H.id,"failed",Y instanceof Error?Y.message:String(Y))}})(),C({ok:!0,session:H,streamUrl:`/api/runtime/log-stream?id=${encodeURIComponent(H.id)}&workload=${encodeURIComponent(E)}`},201)}if((B.pathname==="/api/runtime/log-stream"||B.pathname==="/api/runtime/exec-stream")&&_.method==="GET"){let w=String(B.searchParams.get("id")??""),E=String(B.searchParams.get("workload")??""),N=Number(_.headers.get("last-event-id")??B.searchParams.get("after")??0)||0,j=or.read(w,E,N),q=B.pathname.includes("exec")?"exec":"logs";if(!j||j.kind!==q)return C({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return J_(or,j,N,_.signal)}if((B.pathname==="/api/runtime/log-sessions"||B.pathname==="/api/runtime/exec-sessions")&&_.method==="DELETE"){let w=await X(_),E=or.cancel(String(w.id??""),String(w.workloadId??""));if(!E)return C({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return C({ok:!0,session:E})}if(B.pathname==="/api/runtime/exec-sessions"&&_.method==="POST"){let w=await X(_),E=String(w.workloadId??""),N=await me(f,Se),j=N.workloads.find((Y)=>Y.id===E);if(!j)return C({ok:!1,error:"Workload was not found in the current project and environment."},404);let q=Wt.resolveSession(_),H=new Te(f,Se,{inventory:async()=>N}),V=or.create("exec",E);return Me({controlPlane:y,environment:Se,actor:ae,kind:"runtime.exec",resourceSlug:j.links.service,input:{workloadId:E,provider:j.provider,preset:w.preset?String(w.preset):null,freeForm:!!String(w.command??"").trim()},execute:()=>H.exec({workloadId:E,preset:["process","sockets","filesystem"].includes(String(w.preset))?String(w.preset):void 0,command:typeof w.command==="string"?w.command:void 0,confirm:String(w.confirm??""),recentAuth:!Ee||!!q&&Pe.isRecentlyAuthenticated(q)})}).then(({result:Y,operation:ge})=>{if(or.append(V.id,`operation ${ge.id}
+`,"system"),Y.stdout)or.append(V.id,Y.stdout,"stdout");if(Y.stderr)or.append(V.id,Y.stderr,"stderr");or.close(V.id,Y.ok?"complete":"failed",Y.error)}).catch((Y)=>{let ge=Y instanceof Error?Y.message:String(Y);or.append(V.id,ge,"stderr"),or.close(V.id,"failed",ge)}),C({ok:!0,session:V,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(V.id)}&workload=${encodeURIComponent(E)}`},202)}if(B.pathname==="/api/runtime/files/read"&&_.method==="POST"){let w=await X(_),E=await me(f,Se),N=Wt.resolveSession(_),j=await new Te(f,Se,{inventory:async()=>E}).readFile({workloadId:String(w.workloadId??""),path:String(w.path??""),confirm:String(w.confirm??""),recentAuth:!Ee||!!N&&Pe.isRecentlyAuthenticated(N)});return C(j,j.ok?200:409)}if(B.pathname==="/api/runtime/files/write"&&_.method==="POST"){let w=await X(_),E=await me(f,Se),N=String(w.workloadId??""),j=E.workloads.find((Y)=>Y.id===N);if(!j)return C({ok:!1,error:"Workload was not found in the current project and environment."},404);let q=Wt.resolveSession(_),H=new Te(f,Se,{inventory:async()=>E}),V=await Me({controlPlane:y,environment:Se,actor:ae,kind:"runtime.file.write",resourceSlug:j.links.service,input:{workloadId:N,provider:j.provider,path:String(w.path??""),bytes:Buffer.from(String(w.contentBase64??""),"base64").byteLength},execute:()=>H.writeFile({workloadId:N,path:String(w.path??""),contentBase64:String(w.contentBase64??""),confirm:String(w.confirm??""),recentAuth:!Ee||!!q&&Pe.isRecentlyAuthenticated(q)})});return C({...V.result,controlPlaneOperation:V.operation},V.result.ok?200:409)}if(B.pathname==="/api/runtime/operations"&&_.method==="POST"){let w=await X(_),E=String(w.workloadId??""),N=String(w.action??"");if(!E||!["start","stop","restart","redeploy","scale","inspect"].includes(N))return C({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let j=await me(f,Se),q=j.workloads.find((ge)=>ge.id===E);if(!q)return C({ok:!1,error:"Workload was not found in the current project and environment."},404);let H=Wt.resolveSession(_),V=new Te(f,Se,{inventory:async()=>j}),Y=await Me({controlPlane:y,environment:Se,actor:ae,kind:`runtime.${N}`,resourceSlug:q.links.service,input:{workloadId:E,provider:q.provider,action:N,replicas:w.replicas==null?null:Number(w.replicas)},execute:()=>V.run({workloadId:E,action:N,replicas:w.replicas==null?void 0:Number(w.replicas),confirm:String(w.confirm??""),recentAuth:!Ee||!!H&&Pe.isRecentlyAuthenticated(H)})});return C({...Y.result,controlPlaneOperation:Y.operation},Y.result.ok?200:409)}if(B.pathname.startsWith("/api/protection")){let w=ae.role==="admin"||_c(ae,"security:read"),E=ae.role==="admin"||_c(ae,"security:manage");if(!w)return C({ok:!1,error:"Protection controls require security:read."},403);let{ProtectionControlStore:N,describePosture:j}=await import("./protection/index.js"),q=new N(y.store),H=()=>{if(!E)throw Error("Changing protection controls requires security:manage.")};if(B.pathname==="/api/protection"&&_.method==="GET"){let V=q.current();return C({ok:!0,posture:j(V),controls:V,raw:q.raw()})}if(B.pathname==="/api/protection/attack-mode"&&_.method==="POST"){H();let V=await X(_);if(V.enabled===!1)return C({ok:!0,disabled:q.disableAttackMode()});return C({ok:!0,control:q.enableAttackMode({hours:V.hours==null?void 0:Number(V.hours),reason:String(V.reason??"Enabled from the dashboard."),actorId:qe(ae).actor?.id})})}if(B.pathname==="/api/protection/pause"&&_.method==="POST"){H();let V=await X(_);if(V.enabled===!1)return C({ok:!0,resumed:q.resumeMitigations()});return C({ok:!0,control:q.pauseMitigations({hours:V.hours==null?void 0:Number(V.hours),reason:String(V.reason??""),actorId:qe(ae).actor?.id})})}if(B.pathname==="/api/protection/ip-rules"&&_.method==="GET")return C({ok:!0,ipRules:q.current().ipRules});if(B.pathname==="/api/protection/ip-rules"&&(_.method==="POST"||_.method==="DELETE")){H();let V=await X(_),Y=V.list==="allow"?"allow":"block",ge=_.method==="POST"?q.addIpRule(Y,String(V.cidr??"")):q.removeIpRule(Y,String(V.cidr??""));return C({ok:!0,ipRules:ge})}return C({ok:!1,error:"Protection endpoint was not found."},404)}if(B.pathname.startsWith("/api/spend/")||B.pathname==="/api/usage"){let w=await mw(),{store:E,service:N,gate:j}=w,q=ae.role==="admin"||_c(ae,"billing:read"),H=ae.role==="admin"||_c(ae,"billing:manage");if(!q)return C({ok:!1,error:"Spend data requires the billing:read capability."},403);let V=y.environments.get(Se),Y={organizationId:y.organization.id,projectId:y.project.id,environmentId:V?.id},ge=()=>{if(!H)throw Error("Changing a budget requires the billing:manage capability.")};if(B.pathname==="/api/usage"&&_.method==="GET")return C({ok:!0,...N.usageReport({organizationId:Y.organizationId,projectId:Y.projectId,period:B.searchParams.get("period")??"monthly",timezone:B.searchParams.get("timezone")??void 0})});if(B.pathname==="/api/spend/budgets"&&_.method==="GET")return C({ok:!0,budgets:E.listBudgets({organizationId:Y.organizationId,projectId:Y.projectId}).map((le)=>({...le,status:N.status(le)}))});if(B.pathname==="/api/spend/budgets"&&_.method==="POST"){ge();let le=await X(_),Qe=String(le.scope??"project"),ke=E.createBudget({organizationId:Y.organizationId,projectId:Qe==="organization"?void 0:Y.projectId,environmentId:Qe==="environment"?Y.environmentId:void 0,name:String(le.name??"").trim(),period:le.period??"monthly",timezone:le.timezone?String(le.timezone):void 0,softLimitCents:le.softLimitCents==null?void 0:Math.round(Number(le.softLimitCents)),hardLimitCents:le.hardLimitCents==null?void 0:Math.round(Number(le.hardLimitCents)),graceSeconds:le.graceSeconds==null?void 0:Number(le.graceSeconds),dryRun:le.dryRun!==!1});return C({ok:!0,budget:ke})}if(B.pathname==="/api/spend/budgets"&&_.method==="PATCH"){ge();let le=await X(_),Qe=String(le.id??""),ke=E.getBudget(Qe);if(!ke||ke.organizationId!==Y.organizationId)return C({ok:!1,error:"Budget was not found."},404);return C({ok:!0,budget:E.updateBudget(Qe,{softLimitCents:le.softLimitCents==null?ke.softLimitCents:Math.round(Number(le.softLimitCents)),hardLimitCents:le.hardLimitCents==null?ke.hardLimitCents:Math.round(Number(le.hardLimitCents)),enabled:le.enabled==null?ke.enabled:le.enabled===!0,dryRun:le.dryRun==null?ke.dryRun:le.dryRun===!0},le.expectedVersion==null?void 0:Number(le.expectedVersion))})}if(B.pathname==="/api/spend/budgets"&&_.method==="DELETE"){ge();let le=await X(_),Qe=String(le.id??""),ke=E.getBudget(Qe);if(!ke||ke.organizationId!==Y.organizationId)return C({ok:!1,error:"Budget was not found."},404);let We=j.closeBudget(Qe);return E.deleteBudget(Qe),C({ok:!0,deleted:!0,lifted:We})}if(B.pathname==="/api/spend/check"&&_.method==="POST"){ge();let le=await X(_),{SpendRunner:Qe}=await import("./spend/index.js"),ke=new Qe({controlPlane:y.store,store:E,alerts:et});if(le.apply!==!0){let Ie=E.budgetsForScope(Y.organizationId,Y.projectId,Y.environmentId);return C({ok:!0,applied:!1,preview:Ie.map((ze)=>N.status(ze))})}let We=await ke.run({...Y,environmentKind:V?.kind});return C({ok:!0,applied:!0,result:We})}if(B.pathname==="/api/spend/enforcement"&&_.method==="GET")return C({ok:!0,enforcement:j.listUnder({organizationId:Y.organizationId})});if(B.pathname==="/api/spend/release"&&_.method==="POST"){ge();let le=await X(_),Qe=j.close(String(le.budgetId??""),le.action);return C({ok:Qe,released:Qe,note:Qe?"The next spend cycle re-applies this if spend is still over the threshold.":"That action was not in force."})}if(B.pathname==="/api/spend/anomalies"&&_.method==="GET")return C({ok:!0,anomalies:E.listAnomalies({organizationId:Y.organizationId,projectId:Y.projectId,unacknowledgedOnly:B.searchParams.get("unacknowledged")==="true"})});if(B.pathname==="/api/spend/anomalies/acknowledge"&&_.method==="POST"){ge();let le=await X(_);return C({ok:!0,acknowledged:E.acknowledgeAnomaly(String(le.id??""))})}return C({ok:!1,error:"Spend endpoint was not found."},404)}if(B.pathname.startsWith("/api/health/")||B.pathname.startsWith("/api/alerts")||B.pathname.startsWith("/api/notifications/")){let w=y.environments.get(Se),E=y.store.listResources(y.project.id,w?.id),N=ae.role==="admin"||!!w&&qs(ae,w.id,"runtime:read")?E:E.filter((V)=>kr(ae,V.id,"runtime:read")),j=(V)=>!V||N.some((Y)=>Y.id===V),q=(V)=>{if(!V)return;let Y=E.find((ge)=>ge.id===V||ge.slug===V);if(!Y)throw Error("Alert resource was not found.");if(!j(Y.id))throw Error("Alert resource is outside your authorized scope.");return Y.id},H=qe(ae).actor;if(B.pathname==="/api/health/checks"&&_.method==="GET")return C({ok:!0,checks:et.listHealthChecks(y.project.id,w?.id).filter((V)=>j(V.resourceId)).map((V)=>({...V,results:et.listHealthResults(V.id,20)}))});if(B.pathname==="/api/health/checks"&&_.method==="POST"){let V=await X(_),Y=String(V.kind??"http");if(Y==="command"&&ae.role!=="admin")return C({ok:!1,error:"Command health checks require an administrator."},403);let ge={method:String(V.config?.method??"GET").toUpperCase().slice(0,10),path:V.config?.path?String(V.config.path).slice(0,500):void 0,port:V.config?.port==null?void 0:Number(V.config.port),command:Array.isArray(V.config?.command)?V.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(V.config?.expectedStatuses)?V.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:V.config?.expectedBody?String(V.config.expectedBody).slice(0,500):void 0};return C({ok:!0,check:et.createHealthCheck({projectId:y.project.id,environmentId:w?.id,resourceId:q(V.resourceId??V.resource),name:String(V.name??""),kind:Y,target:String(V.target??""),config:ge,intervalSeconds:Number(V.intervalSeconds)||60,timeoutSeconds:Number(V.timeoutSeconds)||10,failureThreshold:Number(V.failureThreshold)||3,recoveryThreshold:Number(V.recoveryThreshold)||2,regions:Array.isArray(V.regions)?V.regions.map(String):["local"],enabled:V.enabled!==!1})},201)}if(B.pathname==="/api/health/checks"&&_.method==="PATCH"){let V=await X(_),Y=et.getHealthCheck(String(V.id??""));if(!Y||!j(Y.resourceId))return C({ok:!1,error:"Health check was not found."},404);return C({ok:!0,check:et.setHealthCheckEnabled(Y.id,V.enabled!==!1)})}if(B.pathname==="/api/health/checks/test"&&_.method==="POST"){let V=await X(_),Y=et.getHealthCheck(String(V.id??""));if(!Y||!j(Y.resourceId))return C({ok:!1,error:"Health check was not found."},404);return C({ok:!0,productionIncidentCreated:!1,result:await new Ye(et).probe(Y)})}if(B.pathname==="/api/health/checks/run"&&_.method==="POST"){let V=await X(_),Y=et.getHealthCheck(String(V.id??""));if(!Y||!j(Y.resourceId))return C({ok:!1,error:"Health check was not found."},404);let ge=await new Ye(et).runAndEvaluate(Y),le=[];for(let Qe of ge.evaluations.filter((ke)=>ke.notify&&ke.alert)){let ke=pn.enqueue(y.organization.id,Qe.alert,Qe.transition);le.push(...await pn.deliverAll(ke))}return C({ok:!0,...ge,deliveries:le})}if(B.pathname==="/api/alerts/rules"&&_.method==="GET")return C({ok:!0,rules:et.listRules(y.project.id,w?.id).filter((V)=>j(V.resourceId))});if(B.pathname==="/api/alerts/rules"&&_.method==="POST"){let V=await X(_),Y=V.healthCheckId?et.getHealthCheck(String(V.healthCheckId)):void 0;if(V.healthCheckId&&(!Y||!j(Y.resourceId)))return C({ok:!1,error:"Health check was not found."},404);return C({ok:!0,rule:et.createRule({projectId:y.project.id,environmentId:w?.id,resourceId:q(V.resourceId??V.resource)??Y?.resourceId,healthCheckId:Y?.id,name:String(V.name??""),signal:String(V.signal??(Y?"health":"")),operator:String(V.operator??(Y?"unhealthy":"gt")),threshold:V.threshold==null?void 0:Number(V.threshold),recoveryThreshold:V.recoveryThreshold==null?void 0:Number(V.recoveryThreshold),windowMs:Number(V.windowMs)||300000,consecutive:Number(V.consecutive)||Y?.failureThreshold||3,recoveryConsecutive:Number(V.recoveryConsecutive)||Y?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(V.noDataPolicy))?V.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(V.severity))?V.severity:"warning",groupBy:Array.isArray(V.groupBy)?V.groupBy.map(String):[],labels:V.labels&&typeof V.labels==="object"?V.labels:{},enabled:V.enabled!==!1})},201)}if(B.pathname==="/api/alerts/rules"&&_.method==="PATCH"){let V=await X(_),Y=et.getRule(String(V.id??""));if(!Y||!j(Y.resourceId))return C({ok:!1,error:"Alert rule was not found."},404);return C({ok:!0,rule:et.setRuleEnabled(Y.id,V.enabled!==!1)})}if(B.pathname==="/api/alerts/evaluate"&&_.method==="POST")return C({ok:!0,...await xm(w?.id)});if(B.pathname==="/api/alerts"&&_.method==="GET")return C({ok:!0,alerts:et.listAlerts(y.project.id,{environmentId:w?.id,states:B.searchParams.getAll("state").length?B.searchParams.getAll("state"):void 0,limit:Number(B.searchParams.get("limit"))||200}).filter((V)=>j(V.resourceId)).map((V)=>({...V,deliveries:et.listDeliveries({alertId:V.id,limit:50})}))});if(B.pathname==="/api/alerts/action"&&_.method==="POST"){let V=await X(_),Y=et.getAlert(String(V.id??""));if(!Y||!j(Y.resourceId))return C({ok:!1,error:"Alert was not found."},404);let ge=String(V.action??"");if(ge==="acknowledge")return C({ok:!0,alert:et.acknowledge(Y.id,H?.id??"")});if(ge==="assign")return C({ok:!0,alert:et.assign(Y.id,V.ownerActorId==="me"?H?.id:V.ownerActorId?String(V.ownerActorId):void 0,H?.id)});if(ge==="silence"){if(ae.role!=="admin")return C({ok:!1,error:"Silencing production alerts requires an administrator."},403);let le=Wt.resolveSession(_);if(Ee&&(!le||!Pe.isRecentlyAuthenticated(le)))return C({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return C({ok:!0,alert:et.silenceAlert(Y.id,String(V.until??""),H?.id)})}return C({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(B.pathname==="/api/alerts/silences"&&_.method==="POST"){let V=await X(_);return C({ok:!0,id:et.createSilence({projectId:y.project.id,environmentId:w?.id,resourceId:q(V.resourceId??V.resource),matcher:V.matcher,reason:String(V.reason??""),startsAt:String(V.startsAt??new Date().toISOString()),endsAt:String(V.endsAt??""),timezone:String(V.timezone??"UTC"),actorId:H?.id})},201)}if(B.pathname==="/api/notifications/channels"&&_.method==="GET")return C({ok:!0,channels:et.listChannels(y.organization.id)});if(B.pathname==="/api/notifications/channels"&&_.method==="POST"){let V=await X(_),Y=String(V.kind??""),ge=Y==="email"?{to:V.config?.to,from:V.config?.from}:Y==="telegram"?{chatId:String(V.config?.chatId??"")}:{};return C({ok:!0,channel:et.createChannel({organizationId:y.organization.id,name:String(V.name??""),kind:Y,config:ge,credential:V.credential?String(V.credential):void 0,actorId:H?.id})},201)}if(B.pathname==="/api/notifications/channels"&&_.method==="PATCH"){let V=await X(_),Y=String(V.id??"");if(V.credential)return C({ok:!0,channel:et.rotateChannel(Y,String(V.credential))});let ge=String(V.status??"paused");if(!["active","paused","disabled"].includes(ge))return C({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return C({ok:!0,channel:et.setChannelStatus(Y,ge)})}if(B.pathname==="/api/notifications/channels/test"&&_.method==="POST"){let V=await X(_);return C({ok:!0,productionIncidentCreated:!1,result:await pn.testChannel(String(V.id??""))})}if(B.pathname==="/api/notifications/routes"&&_.method==="GET")return C({ok:!0,routes:et.listRoutes(y.organization.id)});if(B.pathname==="/api/notifications/routes"&&_.method==="POST"){let V=await X(_),Y=Array.isArray(V.channelIds)?V.channelIds.map(String):[];if(Y.some((ge)=>et.getChannel(ge)?.organizationId!==y.organization.id))return C({ok:!1,error:"Route contains an unavailable channel."},422);return C({ok:!0,route:et.createRoute({organizationId:y.organization.id,name:String(V.name??""),priority:Number(V.priority)||0,matcher:V.matcher&&typeof V.matcher==="object"?V.matcher:{},channelIds:Y,quietHours:V.quietHours,groupWaitSeconds:Number(V.groupWaitSeconds)||30,reminderSeconds:V.reminderSeconds==null?void 0:Number(V.reminderSeconds),escalation:Array.isArray(V.escalation)?V.escalation:[],template:V.template?String(V.template):void 0,rateLimitPerMinute:Number(V.rateLimitPerMinute)||60,enabled:V.enabled!==!1})},201)}if(B.pathname==="/api/notifications/routes"&&_.method==="PATCH"){let V=await X(_),Y=et.getRoute(String(V.id??""));if(!Y||Y.organizationId!==y.organization.id)return C({ok:!1,error:"Notification route was not found."},404);return C({ok:!0,route:et.setRouteEnabled(Y.id,V.enabled!==!1)})}if(B.pathname==="/api/notifications/routes/preview"&&_.method==="POST"){let V=await X(_),ge=(V.alertId?et.getAlert(String(V.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:y.project.id,environmentId:w?.id,resourceId:q(V.resourceId??V.resource),dedupKey:"preview",groupKey:String(V.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(V.severity))?V.severity:"warning",title:String(V.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return C({ok:!0,productionIncidentCreated:!1,matches:pn.preview(y.organization.id,ge,String(V.eventType??"firing")).map((le)=>({route:le.route,channels:le.channels,quiet:le.quiet}))})}if(B.pathname==="/api/notifications/deliveries"&&_.method==="GET")return C({ok:!0,deliveries:et.listDeliveries({alertId:B.searchParams.get("alertId")??void 0,states:B.searchParams.getAll("state"),limit:Number(B.searchParams.get("limit"))||200})});if(B.pathname==="/api/notifications/deliveries/retry"&&_.method==="POST"){let V=await X(_),Y=et.getDelivery(String(V.id??""));if(!Y)return C({ok:!1,error:"Delivery was not found."},404);return et.updateDelivery(Y.id,{state:"retrying",attempt:Math.max(0,Y.attempt-1),nextAttemptAt:new Date().toISOString()}),C({ok:!0,delivery:await pn.deliver(Y.id)})}}if(B.pathname.startsWith("/api/jobs")||B.pathname.startsWith("/api/workers")){let w=y.environments.get(Se),E=y.store.listResources(y.project.id,w?.id),j=ae.role==="admin"||!!w&&qs(ae,w.id,"automation:read")?E:E.filter((Ie)=>kr(ae,Ie.id,"automation:read")),q=(Ie)=>!Ie||j.some((ze)=>ze.id===Ie),H=qe(ae).actor,V=M.get(Se)??O,Y=dl(f,V),ge=Y.filter((Ie)=>!Ie.danger&&["scheduler","backup","worker"].includes(Ie.group)),le=K(f),Qe=()=>{let Ie=Wt.resolveSession(_);return!Ee||!!Ie&&Pe.isRecentlyAuthenticated(Ie)},ke=(Ie)=>{if(!Ie||typeof Ie!=="object"||Array.isArray(Ie))return{};let ze=Object.entries(Ie).slice(0,50);if(ze.some(([,rt])=>typeof rt!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(rt)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(ze)},We=(Ie,ze,rt)=>y.store.appendEvent({organizationId:y.organization.id,projectId:y.project.id,resourceId:rt,actorId:H?.id,type:`job.${Ie}`,payload:ze});if(B.pathname==="/api/jobs/preview"&&_.method==="POST"){let Ie=await X(_);try{return C({ok:!0,productionExecutionCreated:!1,preview:Ut(String(Ie.expression??""),String(Ie.timezone??"UTC"),new Date(Ie.from?String(Ie.from):Date.now()),Number(Ie.count)||5)})}catch(ze){return C({ok:!1,error:ze instanceof Error?ze.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(B.pathname==="/api/jobs"&&_.method==="GET")return C({ok:!0,jobs:wr.list(y.project.id,{environmentId:w?.id}).filter((Ie)=>q(Ie.resourceId)).map((Ie)=>({...Ie,preview:Ut(Ie.normalizedExpression,Ie.timezone,new Date,5),capability:Tn(Ie),lastExecution:wr.listExecutions(Ie.id,1)[0]}))});if(B.pathname==="/api/jobs"&&_.method==="POST"){let Ie=await X(_),ze=String(Ie.provider??(le==="serverless"?"eventbridge":"server")),rt=le==="serverless"?"eventbridge":"server";if(ze!==rt)return C({ok:!1,error:`${le} environments accept ${rt} schedules through this adapter.`},422);let ft=Ie.operationId?String(Ie.operationId):void 0;if(ze==="server"&&(!ft||!ge.some((ar)=>ar.id===ft)))return C({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let Rt=Tn({provider:ze,expression:String(Ie.expression??""),flexibleMinutes:Number(Ie.flexibleMinutes)||0,missedRunPolicy:Ie.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Ie.overlapPolicy))?Ie.overlapPolicy:"forbid"});if(!Rt.supported)return C({ok:!1,error:Rt.notes.join(" ")},422);let an=Ie.resourceId?E.find((ar)=>ar.id===Ie.resourceId||ar.slug===Ie.resourceId):void 0;if(Ie.resourceId&&(!an||!q(an.id)))return C({ok:!1,error:"Job resource was not found."},404);try{let ar=ze==="server"?{kind:"dashboard_operation",operationId:ft}:{kind:"serverless_scheduler",action:"run"},Ai=wr.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:w?.id,resourceId:an?.id,name:String(Ie.name??""),provider:ze,expression:String(Ie.expression??""),timezone:String(Ie.timezone??"UTC"),startsAt:Ie.startsAt?String(Ie.startsAt):void 0,endsAt:Ie.endsAt?String(Ie.endsAt):void 0,flexibleMinutes:Number(Ie.flexibleMinutes)||0,target:ar,payloadRefs:ke(Ie.payloadRefs),missedRunPolicy:Ie.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Ie.overlapPolicy))?Ie.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(Ie.maxAttempts)||3,backoffSeconds:Number(Ie.backoffSeconds)||30,deadLetterRef:Ie.deadLetterRef?String(Ie.deadLetterRef):void 0},timeoutSeconds:Number(Ie.timeoutSeconds)||900,enabled:Ie.enabled!==!1,origin:"managed",ownerActorId:H?.id,observedState:{},reconciliationStatus:"pending"});return We("created",{jobId:Ai.id,provider:Ai.provider,expression:Ai.normalizedExpression},Ai.resourceId),C({ok:!0,job:Ai,capability:Rt},201)}catch(ar){return C({ok:!1,error:ar instanceof Error?ar.message:"Scheduled job could not be created."},422)}}if(B.pathname==="/api/jobs"&&_.method==="PATCH"){let Ie=await X(_),ze=wr.get(String(Ie.id??""));if(!ze||!q(ze.resourceId))return C({ok:!1,error:"Scheduled job was not found."},404);if(ze.origin==="config")return C({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let rt=Ie.missedRunPolicy==null?void 0:String(Ie.missedRunPolicy),ft=Ie.overlapPolicy==null?void 0:String(Ie.overlapPolicy);if(rt&&!["skip","catch_up"].includes(rt))return C({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(ft&&!["allow","forbid","replace"].includes(ft))return C({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let Rt=wr.updateSchedule(ze.id,{expression:Ie.expression?String(Ie.expression):void 0,timezone:Ie.timezone?String(Ie.timezone):void 0,missedRunPolicy:rt,overlapPolicy:ft,timeoutSeconds:Ie.timeoutSeconds==null?void 0:Number(Ie.timeoutSeconds)});return We("updated",{jobId:Rt.id,expression:Rt.normalizedExpression,version:Rt.version},Rt.resourceId),C({ok:!0,job:Rt})}catch(Rt){return C({ok:!1,error:Rt instanceof Error?Rt.message:"Scheduled job could not be updated."},422)}}if(B.pathname==="/api/jobs/action"&&_.method==="POST"){let Ie=await X(_),ze=wr.get(String(Ie.id??""));if(!ze||!q(ze.resourceId))return C({ok:!1,error:"Scheduled job was not found."},404);let rt=String(Ie.action??"");if(rt==="run"){let ft=Tm.enqueue(ze,{trigger:"manual",actorId:H?.id});return We("run_queued",{jobId:ze.id,executionId:ft.id},ze.resourceId),C({ok:!0,execution:ft},202)}if(["disable","delete"].includes(rt)&&w?.kind==="production"){if(String(Ie.confirm??"")!==rt)return C({ok:!1,error:`Type "${rt}" to confirm this production change.`},409);if(!Qe())return C({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(rt==="enable"||rt==="disable"){let ft=wr.setEnabled(ze.id,rt==="enable");return We(rt==="enable"?"enabled":"disabled",{jobId:ze.id},ze.resourceId),C({ok:!0,job:ft})}if(rt==="delete")try{return wr.remove(ze.id),We("deleted",{jobId:ze.id,name:ze.name},ze.resourceId),C({ok:!0,deleted:ze.id})}catch(ft){return C({ok:!1,error:ft instanceof Error?ft.message:"Scheduled job could not be deleted."},409)}return C({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(B.pathname==="/api/jobs/history"&&_.method==="GET"){let Ie=wr.get(String(B.searchParams.get("jobId")??""));if(!Ie||!q(Ie.resourceId))return C({ok:!1,error:"Scheduled job was not found."},404);return C({ok:!0,executions:wr.listExecutions(Ie.id,Number(B.searchParams.get("limit"))||100).map((ze)=>({...ze,logs:ze.operationId?Dt.logs(ze.operationId,{limit:500}):[]}))})}if(B.pathname==="/api/jobs/reconcile"&&_.method==="POST"){if(!w)return C({ok:!1,error:"Environment was not found."},404);let Ie=Da(wr,f,{organization:y.organization,project:y.project,environment:w,resources:E});return We("reconciled",Ie),C({ok:!0,reconciliation:Ie})}if(B.pathname==="/api/workers"&&_.method==="GET"){let Ie=Array.isArray(V.workersDetail??V.workers)?V.workersDetail??V.workers:[];return C({ok:!0,workers:wr.listWorkers(y.project.id,w?.id).filter((ze)=>q(ze.resourceId)).map((ze)=>{let rt=Ie.find((ft)=>ft.name===ze.name||ft.site===ze.target.site);return rt?{...ze,observedState:{...ze.observedState,status:rt.status??"configured",currentJob:rt.currentJob??null,failures:Number(rt.failed??rt.failures)||0,processed:Number(rt.processed)||0}}:ze})})}if(B.pathname==="/api/workers/action"&&_.method==="POST"){let Ie=await X(_),ze=wr.getWorker(String(Ie.id??""));if(!ze||!q(ze.resourceId))return C({ok:!1,error:"Worker was not found."},404);let rt=String(Ie.action??"");if(rt==="restart"){if(String(Ie.confirm??"")!==ze.name)return C({ok:!1,error:`Type "${ze.name}" to restart this worker.`},409);let ft=Y.find((ar)=>ar.id===ze.target.operationId);if(!ft)return C({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let Rt=await ll(f,Se,ft),an=wr.reconcileWorker(ze.id,Rt.ok?"in_sync":"unavailable",{...ze.observedState,lastRestartAt:new Date().toISOString(),command:Rt.command??null,error:Rt.error??Rt.stderr??null});return We("worker_restarted",{workerId:ze.id,ok:Rt.ok},ze.resourceId),C({...Rt,worker:an},Rt.ok?200:409)}if(rt==="scale")return C({ok:!1,error:ze.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return C({ok:!1,error:"Action must be restart or scale."},422)}}if(B.pathname.startsWith("/api/telemetry/")){let w=y.environments.get(Se),E=new Pt(y.store),N=y.store.listResources(y.project.id,w?.id),j=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(B.pathname)?"runtime:logs":"runtime:read",q=ae.role==="admin"||!!w&&qs(ae,w.id,j),H=q?N:N.filter((ke)=>kr(ae,ke.id,j)),V=(ke)=>AS(H,q,ke),Y=(ke)=>{let We=new Date,Ie={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},ze=String(ke.to??We.toISOString()),rt=String(ke.from??new Date(new Date(ze).getTime()-(Ie[String(ke.range??"1h")]??Ie["1h"])).toISOString()),ft=(an)=>{let ar=(Array.isArray(an)?an:String(an??"").split(",")).map(String).filter(Boolean);return ar.length?ar:void 0},Rt=ft(ke.kinds)?.filter((an)=>["metric","log","trace","request","event"].includes(an));return{projectId:y.project.id,environmentId:w?.id,resourceIds:V(ke.resources),kinds:Rt,names:ft(ke.names),sources:ft(ke.sources),levels:ft(ke.levels),from:rt,to:ze,text:String(ke.text??"")||void 0,traceId:String(ke.traceId??"")||void 0,requestId:String(ke.requestId??"")||void 0,deploymentId:String(ke.deploymentId??"")||void 0,releaseId:String(ke.releaseId??"")||void 0,workloadId:String(ke.workloadId??"")||void 0,cursor:String(ke.cursor??"")||void 0,limit:Number(ke.limit)||void 0}},ge=Object.fromEntries(B.searchParams.entries()),le=(ke=!1)=>Sm({controlPlane:y.store,projectId:y.project.id,environmentId:w?.id,config:f,environment:Se,force:ke,lightweight:!ke}),Qe=()=>{let ke=y.store.getSetting(`telemetry.collection:${y.project.id}:${w?.id??"all"}`)??{};return{generatedAt:String(ke.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(ke.statuses)?ke.statuses:[],errors:Array.isArray(ke.errors)?ke.errors:[],policy:ke.policy??dr(y.store,y.project.id)}};if(B.pathname==="/api/telemetry/status"&&_.method==="GET"){le(!1);let ke=Qe(),We=q?ke.statuses:E.status(y.project.id,w?.id,ke.policy.rawDays,ke.policy.samplingRate,H.map((ze)=>ze.id)),Ie=We.reduce((ze,rt)=>ze+rt.estimatedDailyBytes*30,0);return C({ok:!0,generatedAt:ke.generatedAt,cached:ke.cached,sources:We,errors:q?ke.errors:[],policy:ke.policy,retention:{rawDays:ke.policy.rawDays,downsampleAfterDays:ke.policy.downsampleAfterDays,downsampleBucketMs:ke.policy.downsampleBucketMs,maxRecords:ke.policy.maxRecords},estimatedMonthlyBytes:Ie,estimatedMonthlyCostUsd:Jd(Ie,ke.policy),costEstimateConfigured:ke.policy.estimatedStorageUsdPerGbMonth>0})}if(B.pathname==="/api/telemetry/settings"&&_.method==="GET")return C({ok:!0,policy:dr(y.store,y.project.id)});if(B.pathname==="/api/telemetry/settings"&&_.method==="PATCH"){let ke=Wd(y.store,y.project.id,await X(_));return DS(y.project.id),C({ok:!0,policy:ke})}if(B.pathname==="/api/telemetry/query"&&_.method==="GET"){le(!1);let ke=Qe();return C({ok:!0,collection:{generatedAt:ke.generatedAt,cached:ke.cached},...E.query(Y(ge))})}if(B.pathname==="/api/telemetry/tail"&&_.method==="GET"){le(!1);let ke=new TextEncoder,We=new Date,Ie=Y({...ge,kinds:ge.kinds||"log,request,event,trace",from:ge.from||new Date(We.getTime()-120000).toISOString(),to:We.toISOString(),limit:Math.min(1000,Number(ge.limit)||200),cursor:void 0}),ze=_.headers.get("last-event-id")||String(ge.cursor??"")||void 0,rt,ft=!1,Rt=!1,an=new ReadableStream({start(ar){let Ai=()=>{if(ft)return;if(ft=!0,rt)clearInterval(rt);_.signal.removeEventListener("abort",Ai);try{ar.close()}catch{}},qm=async()=>{if(ft||Rt)return;Rt=!0;try{let to=E.tail({...Ie,to:new Date(Date.now()+1000).toISOString()},ze);for(let Vm of to.records)ze=zi(Vm)??ze,ar.enqueue(ke.encode(`id: ${ze??""}
 event: record
 data: ${JSON.stringify(Vm)}
 
-`));if(to.cursor)ze=to.cursor}catch(to){ar.enqueue(Ie.encode(`event: error
+`));if(to.cursor)ze=to.cursor}catch(to){ar.enqueue(ke.encode(`event: error
 data: ${JSON.stringify({message:to instanceof Error?to.message:String(to)})}
 
-`))}finally{Rt=!1}};qm(),rt=setInterval(()=>{if(qm(),!ft)ar.enqueue(Ie.encode(`event: heartbeat
+`))}finally{Rt=!1}};qm(),rt=setInterval(()=>{if(qm(),!ft)ar.enqueue(ke.encode(`event: heartbeat
 data: ${JSON.stringify({cursor:ze,at:new Date().toISOString()})}
 
-`))},5000),rt.unref?.(),_.signal.addEventListener("abort",Ai,{once:!0})},cancel(){if(ft=!0,rt)clearInterval(rt)}});return new Response(an,{headers:{"cache-control":"no-cache, no-transform",connection:"keep-alive","content-type":"text/event-stream; charset=utf-8","x-accel-buffering":"no"}})}if(B.pathname==="/api/telemetry/series"&&_.method==="GET"){le(!1);let Ie=Qe(),We=["sum","avg","min","max","count","p50","p90","p95","p99"].includes(String(he.aggregation))?he.aggregation:"avg",Ae=Y({...he,kinds:"metric",limit:5000}),ze=E.series({...Ae,bucketMs:Number(he.bucketMs)||60000,aggregation:We,timezone:String(he.timezone??"UTC"),compareFrom:he.compareFrom,compareTo:he.compareTo});return C({ok:!0,collection:{generatedAt:Ie.generatedAt,cached:Ie.cached},query:{aggregation:We,bucketMs:Number(he.bucketMs)||60000,timezone:String(he.timezone??"UTC")},series:ze})}if(B.pathname==="/api/telemetry/refresh"&&_.method==="POST")return C({ok:!0,...await le(!0)});if(B.pathname==="/api/telemetry/export"&&_.method==="POST"){let Ie=await X(_);await le(!1);let We=E.query({...Y(Ie),limit:Math.min(5000,Number(Ie.limit)||5000),cursor:void 0});if((Ie.format==="csv"?"csv":"json")==="json")return new Response(JSON.stringify({exportedAt:new Date().toISOString(),query:Y(Ie),...We},null,2),{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.json"',"content-type":"application/json; charset=utf-8"}});let ze=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"],rt=[ze.join(","),...We.records.map((ft)=>ze.map((Rt)=>`"${String(ft[Rt]??"").replaceAll('"','""')}"`).join(","))].join(`
-`);return new Response(rt,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(B.pathname==="/api/telemetry/saved-queries"&&_.method==="GET"){let Ie=qe(de);return C({ok:!0,queries:E.listSavedQueries(y.project.id,Ie.actor?.id)})}if(B.pathname==="/api/telemetry/saved-queries"&&_.method==="POST"){let Ie=await X(_),We=qe(de);return C({ok:!0,query:E.saveQuery(y.project.id,We.actor?.id,String(Ie.name??""),Y(Ie.query??Ie))},201)}if(B.pathname==="/api/telemetry/saved-queries"&&_.method==="DELETE"){let Ie=await X(_),We=qe(de),Ae=E.deleteSavedQuery(y.project.id,We.actor?.id,String(Ie.id??""));return C({ok:Ae},Ae?200:404)}}if(B.pathname.startsWith("/api/configuration")){let w=y.environments.get(ke),E=de.role==="admin"||!!gn.capabilities?.includes("secrets:read"),N=de.role==="admin"||!!gn.capabilities?.includes("secrets:write"),j={projectId:y.project.id,environmentId:w?.id},q={"cache-control":"no-store"};if(B.pathname==="/api/configuration"&&_.method==="GET"){let H=Object.fromEntries(B.searchParams),V=H.scopeType||H.scopeId?Ls(H,j):void 0,Y=["variable","secret"].includes(String(H.kind))?H.kind:void 0,he=V?.type==="preview"?Xt.previews.getInstance(V.id):void 0,le=he?Xt.previews.getDefinition(he.definitionId):void 0,Qe=V?await tn.resolve({projectId:y.project.id,environmentId:V.environmentId,resourceId:V.resourceId,functionId:V.type==="function"?V.id:void 0,previewId:V.previewId,trustedPreview:!!he&&!he.fork,allowedPreviewSecrets:le?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:E}):void 0,Ie=y.store.listResources(y.project.id);return C({ok:!0,entries:tn.list({projectId:y.project.id,scope:V,kind:Y,search:H.search,canReadSecretMetadata:E}),effectiveEntries:Qe?Object.values(Qe.entries).filter((We)=>!Y||We.kind===Y).filter((We)=>!H.search||We.key.toLowerCase().includes(String(H.search).toLowerCase())):[],configurationHash:Qe?.configurationHash,warnings:Qe?.warnings??[],scopes:{project:y.project,environments:y.store.listEnvironments(y.project.id),resources:Ie.filter((We)=>We.kind!=="function"),functions:Ie.filter((We)=>We.kind==="function"),previews:Xt.previews.listInstances({projectId:y.project.id}).filter((We)=>We.status!=="destroyed").map((We)=>({id:We.id,name:We.name,environmentId:We.baseEnvironmentId,resourceId:We.resourceId,fork:We.fork,status:We.status}))}},200,q)}if(B.pathname==="/api/configuration/export"&&_.method==="GET"){let H=Ls(Object.fromEntries(B.searchParams),j);return new Response(tn.exportVariables({projectId:y.project.id,scope:H}),{headers:{...q,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(B.pathname==="/api/configuration/plan"&&_.method==="POST"){let H=await X(_),V=Ls(H,j),Y=H.values&&typeof H.values==="object"&&!Array.isArray(H.values)?Object.fromEntries(Object.entries(H.values).map(([he,le])=>[he,String(le)])):{};return C({ok:!0,plan:tn.plan({projectId:y.project.id,scope:V,values:Y,removeMissing:H.removeMissing===!0})},200,q)}if(B.pathname==="/api/configuration"&&_.method==="POST"){let H=await X(_),V=Ls(H,j),Y=H.kind==="secret"?"secret":"variable",he=String(H.key??"");if(Y==="secret"&&!N)return C({ok:!1,error:"Secret write permission is required."},403,q);try{let le=await tn.set({organizationId:y.organization.id,projectId:y.project.id,scope:V,key:he,kind:Y,value:H.value==null?void 0:String(H.value),reference:H.reference==null?void 0:String(H.reference),backend:H.backend,required:H.required===!0,expectedVersion:H.expectedVersion==null?void 0:Number(H.expectedVersion),confirmed:String(H.confirm??"")===he,idempotencyKey:_.headers.get("idempotency-key")??H.idempotencyKey,actorId:qe(de).actor?.id});return C({ok:!0,entry:tn.list({projectId:y.project.id,scope:V,canReadSecretMetadata:E}).find((Qe)=>Qe.id===le.entry.id),mutation:le.mutation,warnings:le.warnings},le.mutation.added.length?201:200,q)}catch(le){return C({ok:!1,error:le instanceof Error?le.message:String(le)},409,q)}}if(B.pathname==="/api/configuration/import"&&_.method==="POST"){let H=await X(_),V=Ls(H,j),Y=Array.isArray(H.secretKeys)?H.secretKeys.map(String):[];if(Y.length&&!N)return C({ok:!1,error:"Secret write permission is required."},403,q);try{let he=await tn.importDotenv({organizationId:y.organization.id,projectId:y.project.id,scope:V,source:String(H.source??""),secretKeys:Y,backend:H.backend,confirmed:H.confirm==="import",idempotencyKey:_.headers.get("idempotency-key")??H.idempotencyKey,actorId:qe(de).actor?.id});return C({ok:he.document.valid,diagnostics:he.document.diagnostics,mutation:he.mutation,warnings:he.warnings},he.document.valid?200:422,q)}catch(he){return C({ok:!1,error:he instanceof Error?he.message:String(he)},409,q)}}if(B.pathname==="/api/configuration/dependencies"&&_.method==="POST"){let H=await X(_),V=wi.get(String(H.entryId??"")),Y=y.store.getResource(String(H.resourceId??""));if(!V||V.projectId!==y.project.id||!Y||Y.projectId!==y.project.id)return C({ok:!1,error:"Configuration entry or dependent resource was not found."},404,q);return C({ok:!0,dependency:wi.setDependency({entryId:V.id,resourceId:Y.id,injectionTarget:["native_reference","file"].includes(String(H.injectionTarget))?H.injectionTarget:"environment",required:H.required!==!1,requiresRedeploy:H.requiresRedeploy!==!1,lastDeployedVersion:H.lastDeployedVersion==null?void 0:Number(H.lastDeployedVersion)})},200,q)}if(B.pathname==="/api/configuration/transfer"&&_.method==="POST"){let H=await X(_),V=wi.get(String(H.id??"")),Y=Ls({...H,scopeType:H.targetScopeType,scopeId:H.targetScopeId},j);if(!V||V.projectId!==y.project.id)return C({ok:!1,error:"Configuration entry was not found."},404,q);if(V.kind==="secret"&&!N)return C({ok:!1,error:"Secret write permission is required."},403,q);try{let he=await tn.transfer({entryId:V.id,targetScope:Y,mode:H.mode==="move"?"move":"copy",confirmed:H.confirm===V.key,actorId:qe(de).actor?.id,idempotencyKey:_.headers.get("idempotency-key")??H.idempotencyKey});return C({ok:!0,entry:tn.list({projectId:y.project.id,scope:Y,canReadSecretMetadata:E}).find((le)=>le.id===he.entry.id),mutation:he.mutation},200,q)}catch(he){return C({ok:!1,error:he instanceof Error?he.message:String(he)},409,q)}}if(B.pathname==="/api/configuration/bulk"&&_.method==="POST"){let H=await X(_),V=Array.isArray(H.ids)?H.ids.map(String).slice(0,500):[],Y=V.map((le)=>wi.get(le)).filter((le)=>!!le&&le.projectId===y.project.id);if(Y.length!==V.length)return C({ok:!1,error:"One or more configuration entries were not found."},404,q);if(Y.some((le)=>le.kind==="secret")&&!N)return C({ok:!1,error:"Secret write permission is required."},403,q);if(H.action!=="delete"||H.confirm!=="bulk")return C({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,q);let he=[];try{for(let le of Y)he.push(await tn.remove({entryId:le.id,expectedVersion:le.version,confirmed:!0,actorId:qe(de).actor?.id}));return C({ok:!0,removed:he.flatMap((le)=>le.removed),affectedResourceIds:[...new Set(he.flatMap((le)=>le.affectedResourceIds))].sort()},200,q)}catch(le){return C({ok:!1,error:le instanceof Error?le.message:String(le),partial:he.flatMap((Qe)=>Qe.removed)},409,q)}}if(B.pathname==="/api/configuration/reveal"&&_.method==="POST"){let H=await X(_),V=Wt.resolveSession(_);try{return C({ok:!0,value:await tn.reveal({entryId:String(H.id??""),canRevealSecrets:E,recentlyAuthenticated:!Ce||!!V&&_e.isRecentlyAuthenticated(V),actorId:qe(de).actor?.id})},200,q)}catch(Y){return C({ok:!1,error:Y instanceof Error?Y.message:String(Y)},403,q)}}if(B.pathname==="/api/configuration"&&_.method==="DELETE"){let H=await X(_),V=wi.get(String(H.id??""));if(V?.kind==="secret"&&!N)return C({ok:!1,error:"Secret write permission is required."},403,q);if(!V||V.projectId!==y.project.id)return C({ok:!1,error:"Configuration entry was not found."},404,q);try{return C({ok:!0,mutation:await tn.remove({entryId:V.id,expectedVersion:Number(H.expectedVersion),confirmed:String(H.confirm??"")===V.key,actorId:qe(de).actor?.id})},200,q)}catch(Y){return C({ok:!1,error:Y instanceof Error?Y.message:String(Y)},409,q)}}}if(B.pathname.startsWith("/api/fleet")){let w=qe(de).actor?.id,E=(N,j=409)=>C({ok:!1,error:N instanceof Error?N.message:String(N)},j,{"cache-control":"no-store"});if(B.pathname==="/api/fleet"&&_.method==="GET")return C({ok:!0,servers:Us.list(y.project.id),resources:y.store.listResources(y.project.id),operations:Dt.list({projectId:y.project.id,limit:200}).filter((N)=>N.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(B.pathname==="/api/fleet"&&_.method==="POST"){let N=await X(_);try{return C({ok:!0,server:Yn.enroll({organizationId:y.organization.id,projectId:y.project.id,name:String(N.name??""),provider:["aws","hetzner"].includes(String(N.provider))?N.provider:"ssh",providerId:N.providerId?String(N.providerId):void 0,region:N.region?String(N.region):void 0,zone:N.zone?String(N.zone):void 0,endpoint:String(N.endpoint??""),sshUser:String(N.sshUser??"deploy"),sshPort:N.sshPort?Number(N.sshPort):22,credentialRef:String(N.credentialRef??""),roles:Array.isArray(N.roles)?N.roles:[],labels:N.labels&&typeof N.labels==="object"?N.labels:{}})},201)}catch(j){return E(j,422)}}if(B.pathname==="/api/fleet/action"&&_.method==="POST"){let N=await X(_),j=String(N.id??""),q=String(N.action??"");try{if(q==="test")return C({ok:!0,server:await Yn.test(j)});if(q==="validate")return C({ok:!0,server:await Yn.validate(j)});if(q==="review_host_key")return C({ok:!0,server:Yn.reviewHostKey(j,String(N.fingerprint??""))});if(q==="bootstrap")return C({ok:!0,...Yn.bootstrap(j,N.confirmed===!0)},N.confirmed===!0?202:200);if(q==="heartbeat")return C({ok:!0,server:Yn.heartbeat(j,{usage:N.usage&&typeof N.usage==="object"?N.usage:{}})});if(q==="drain")return C({ok:!0,server:Yn.drain(j,N.completed===!0)});if(q==="uncordon")return C({ok:!0,server:Yn.uncordon(j)});if(q==="archive")return C({ok:!0,server:Yn.archive(j,String(N.confirmation??""))});return E("Unsupported fleet action.",422)}catch(H){return E(H)}}}if(B.pathname.startsWith("/api/capacity")){let w=(E,N=409)=>C({ok:!1,error:E instanceof Error?E.message:String(E)},N,{"cache-control":"no-store"});if(B.pathname==="/api/capacity"&&_.method==="GET")return C({ok:!0,pools:Ii.listPools(y.project.id),placements:Ii.listPlacements(y.project.id),servers:Us.list(y.project.id)},200,{"cache-control":"no-store"});if(B.pathname==="/api/capacity"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,pool:Ii.createPool({organizationId:y.organization.id,projectId:y.project.id,name:String(E.name??""),purpose:String(E.purpose??"application"),backend:String(E.backend??"server"),region:E.region?String(E.region):void 0,architecture:E.architecture?String(E.architecture):void 0,labels:E.labels&&typeof E.labels==="object"?E.labels:{},requiredServerLabels:E.requiredServerLabels&&typeof E.requiredServerLabels==="object"?E.requiredServerLabels:{},toleratedTaints:Array.isArray(E.toleratedTaints)?E.toleratedTaints.map(String):[],capacity:E.capacity&&typeof E.capacity==="object"?E.capacity:{},maxWorkloads:Number(E.maxWorkloads??10),costWeight:Number(E.costWeight??1),spreadKey:E.spreadKey?String(E.spreadKey):void 0,concurrency:Number(E.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(N){return w(N,422)}}if(B.pathname==="/api/capacity/member"&&_.method==="POST"){let E=await X(_);try{return Ii.addMember(String(E.poolId??""),String(E.serverId??"")),C({ok:!0,pool:Ii.getPool(String(E.poolId??""))})}catch(N){return w(N,422)}}if(B.pathname==="/api/capacity/explain"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,decisions:Cm.explain(y.project.id,{purpose:String(E.purpose??"application"),resources:E.resources&&typeof E.resources==="object"?E.resources:{},region:E.region?String(E.region):void 0,architecture:E.architecture?String(E.architecture):void 0,labels:E.labels&&typeof E.labels==="object"?E.labels:{}})})}catch(N){return w(N,422)}}if(B.pathname==="/api/capacity/action"&&_.method==="POST"){let E=await X(_);try{if(E.action==="drain")return C({ok:!0,...Cm.drainPool(String(E.poolId??""))});if(E.action==="enable")return C({ok:!0,pool:Ii.updatePool(String(E.poolId??""),{status:"active"})});if(E.action==="disable")return C({ok:!0,pool:Ii.updatePool(String(E.poolId??""),{status:"disabled"})});return w("Unsupported capacity action.",422)}catch(N){return w(N,422)}}}if(B.pathname.startsWith("/api/regions")){let w=(E,N=409)=>C({ok:!1,error:E instanceof Error?E.message:String(E)},N,{"cache-control":"no-store"});if(B.pathname==="/api/regions"&&_.method==="GET")return C({ok:!0,topologies:Zi.list(y.project.id).map((E)=>({topology:E,targets:Zi.targets(E.id),channels:Zi.channels(E.id),route:Zi.route(E.id),executions:Zi.executions(E.id)}))},200,{"cache-control":"no-store"});if(B.pathname==="/api/regions"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,topology:Pm.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:y.environments.get(ke)?.id,name:String(E.name??""),hostname:String(E.hostname??""),regions:Array.isArray(E.regions)?E.regions:[],trafficPolicy:E.trafficPolicy==="weighted"||E.trafficPolicy==="latency"?E.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(E.replicate)?E.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(E.maxLagSeconds??30),retainOnDestroy:E.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:E.cdnEnabled===!0,wafEnabled:E.wafEnabled===!0})},201)}catch(N){return w(N,422)}}if(B.pathname==="/api/regions/action"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,...Pm.enqueue({topologyId:String(E.topologyId??""),kind:String(E.action??""),targetRegion:E.targetRegion?String(E.targetRegion):void 0,revision:E.revision?String(E.revision):void 0,manifest:E.manifest&&typeof E.manifest==="object"?E.manifest:{},confirmation:E.confirmation?String(E.confirmation):void 0,deleteData:E.deleteData===!0})},202)}catch(N){return w(N,422)}}}if(B.pathname.startsWith("/api/maintenance")){let w=(E,N=409)=>C({ok:!1,error:E instanceof Error?E.message:String(E)},N,{"cache-control":"no-store"});if(B.pathname==="/api/maintenance"&&_.method==="GET")return C({ok:!0,manifests:si.manifests(y.organization.id),windows:si.windows(y.project.id),campaigns:si.campaigns(y.project.id).map((E)=>({campaign:E,targets:si.targets(E.id)})),cleanups:si.cleanups(y.project.id),drills:si.drills(y.project.id)},200,{"cache-control":"no-store"});if(B.pathname==="/api/maintenance/cleanup-preview"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,plan:await Il.previewCleanup({projectId:y.project.id,kind:String(E.kind??"operations"),criteria:{olderThanDays:Number(E.olderThanDays??30)}},_m)},201)}catch(N){return w(N,422)}}if(B.pathname==="/api/maintenance/cleanup-apply"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,...Il.enqueueCleanup(String(E.planId??""),String(E.confirmation??""))},202)}catch(N){return w(N,422)}}if(B.pathname==="/api/maintenance/drill"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,drill:si.createDrill({projectId:y.project.id,scenario:String(E.scenario??"control_plane"),isolatedTarget:String(E.isolatedTarget??""),expectedRpoMinutes:Number(E.expectedRpoMinutes??60),expectedRtoMinutes:Number(E.expectedRtoMinutes??30),recoveryPointId:E.recoveryPointId?String(E.recoveryPointId):void 0,topologyId:E.topologyId?String(E.topologyId):void 0})},201)}catch(N){return w(N,422)}}if(B.pathname==="/api/maintenance/drill-run"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,...Il.enqueueDrill(String(E.drillId??""))},202)}catch(N){return w(N,422)}}}if(B.pathname.startsWith("/api/volumes")){let w=y.environments.get(ke),E=qe(de).actor?.id,N=(j,q=409)=>C({ok:!1,error:j instanceof Error?j.message:String(j)},q,{"cache-control":"no-store"});if(B.pathname==="/api/volumes"&&_.method==="GET"){let j=wl.inventory(y.project.id,w?.id),q=y.store.listResources(y.project.id,w?.id).map((H)=>({id:H.id,name:H.name,slug:H.slug,kind:H.kind,provider:H.provider,providerId:H.providerId}));return C({ok:!0,volumes:j,resources:q,operations:Dt.list({projectId:y.project.id,limit:100}).filter((H)=>H.operation.kind.startsWith("volume.")),recoveryPoints:rr.listRecoveryPoints(y.project.id).filter((H)=>H.kind==="volume"),providers:kl.map((H)=>({provider:H.provider,type:H.type,capabilities:H.capabilities()}))},200,{"cache-control":"no-store"})}if(B.pathname==="/api/volumes"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,...oi.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:w?.id,resourceId:j.resourceId?String(j.resourceId):void 0,name:String(j.name??""),provider:String(j.provider??"docker"),type:j.type==="docker"?"docker":j.type,capacityBytes:j.capacityBytes==null?void 0:Number(j.capacityBytes),filesystem:j.filesystem?String(j.filesystem):void 0,encrypted:j.encrypted===!0,desiredState:j.desiredState&&typeof j.desiredState==="object"?j.desiredState:{},actorId:E})},202,{"cache-control":"no-store"})}catch(q){return N(q,422)}}if(B.pathname==="/api/volumes/attach"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,...oi.attach(String(j.volumeId??""),{resourceId:String(j.resourceId??""),targetPath:String(j.targetPath??""),readOnly:j.readOnly===!0,uid:j.uid==null?void 0:Number(j.uid),gid:j.gid==null?void 0:Number(j.gid),mode:j.mode?String(j.mode):void 0,propagation:j.propagation,driverOptions:j.driverOptions&&typeof j.driverOptions==="object"?j.driverOptions:{},actorId:E})},202)}catch(q){return N(q,422)}}if(B.pathname==="/api/volumes/detach"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,...oi.detach(String(j.volumeId??""),String(j.attachmentId??""),{force:j.force===!0,drained:j.drained===!0,unmounted:j.unmounted===!0,confirmation:j.confirmation?String(j.confirmation):void 0,actorId:E})},202)}catch(q){return N(q)}}if(B.pathname==="/api/volumes/resize"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,...oi.resize(String(j.volumeId??""),Number(j.capacityBytes),{drained:j.drained===!0,actorId:E})},202)}catch(q){return N(q,422)}}if(B.pathname==="/api/volumes/snapshot"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,...oi.snapshot(String(j.volumeId??""),{name:j.name?String(j.name):void 0,actorId:E})},202)}catch(q){return N(q,422)}}if(B.pathname==="/api/volumes/restore"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,...oi.restore(String(j.snapshotId??""),{name:String(j.name??""),actorId:E})},202)}catch(q){return N(q,422)}}if(B.pathname==="/api/volumes/discover"&&_.method==="POST")try{return C({ok:!0,volumes:await oi.discover({organizationId:y.organization.id,projectId:y.project.id,environmentId:w?.id,actorId:E})})}catch(j){return N(j,502)}if(B.pathname==="/api/volumes/adopt"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,volume:oi.adopt(String(j.volumeId??""),{name:String(j.name??""),actorId:E})})}catch(q){return N(q,422)}}if(B.pathname==="/api/volumes"&&_.method==="DELETE"){let j=await X(_),q=Wt.resolveSession(_);try{return C({ok:!0,...oi.delete(String(j.volumeId??""),{recentAuthAt:!Ce||q&&_e.isRecentlyAuthenticated(q)?new Date().toISOString():void 0,confirmation:j.confirmation?String(j.confirmation):void 0,backupOverride:j.backupOverride===!0,backupOverrideConfirmation:j.backupOverrideConfirmation?String(j.backupOverrideConfirmation):void 0,actorId:E})},202)}catch(H){return N(H)}}}if(B.pathname==="/api/backups"&&_.method==="GET"){let w=y.environments.get(ke),E=rr.listPolicies(y.project.id,w?.id),N=new Set(E.map((Y)=>Y.id)),j=rr.listRecoveryPoints(y.project.id).filter((Y)=>!Y.policyId||N.has(Y.policyId)),q=rr.listJobs(y.project.id).filter((Y)=>!Y.policyId||N.has(Y.policyId)),H=(Y)=>({...Y,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!Y.credentialRef,clientEncryptionConfigured:!!Y.encryptionKeyRef}),V=await Promise.all(rr.listDestinations(y.project.id).map(async(Y)=>({...H(Y),credentialStatus:await mg(Y,ii)})));return C({ok:!0,destinations:V,policies:E,recoveryPoints:j,jobs:q,coverage:rr.coverage(y.project.id).filter((Y)=>N.has(Y.policy.id)),resources:w?y.store.listResources(y.project.id,w.id).map((Y)=>({id:Y.id,name:Y.name,slug:Y.slug,kind:Y.kind})):[]})}if(B.pathname==="/api/backups/destinations"&&_.method==="POST"){let w=await X(_),E=String(w.name??"").trim(),N=String(w.provider??""),j=String(w.encryption??"provider"),q=`secret://data-services/backups/${y.project.id}/${E}`,H=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(N))return C({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(j))return C({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let V,Y;if(w.credentials&&typeof w.credentials==="object"&&!Array.isArray(w.credentials))V=`${q}/credentials`,await ii.put(V,JSON.stringify(w.credentials)),H.push(V);if(j!=="provider"){let le=String(w.encryptionKey??"");if(le.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");Y=`${q}/encryption-key`,await ii.put(Y,le),H.push(Y)}let he=rr.createDestination({organizationId:y.organization.id,projectId:y.project.id,name:E,provider:N,endpoint:w.endpoint?String(w.endpoint):void 0,endpointPolicy:w.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:w.bucket?String(w.bucket):void 0,prefix:String(w.prefix??""),region:w.region?String(w.region):ki,forcePathStyle:w.forcePathStyle===!0,credentialRef:V,encryption:j,encryptionKeyRef:Y,immutability:w.immutability&&typeof w.immutability==="object"&&!Array.isArray(w.immutability)?w.immutability:{},status:"untested"});return C({ok:!0,destination:{...he,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!V,clientEncryptionConfigured:!!Y}},201)}catch(V){for(let Y of H)await ii.remove(Y).catch(()=>{});return C({ok:!1,error:V instanceof Error?V.message:String(V)},422)}}if(B.pathname==="/api/backups/destinations/test"&&_.method==="POST"){let w=await X(_),E=rr.getDestination(String(w.id??""));if(!E||E.projectId!==y.project.id)return C({ok:!1,error:"Backup destination was not found."},404);if(E.provider==="aws_backup")return C({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await Am.test(E),C({ok:!0,destination:rr.recordDestinationTest(E.id,{ok:!0})})}catch(N){let j=N instanceof Error?N.message:String(N);return rr.recordDestinationTest(E.id,{ok:!1,error:j}),C({ok:!1,error:j},502)}}if(B.pathname==="/api/backups/policies"&&_.method==="POST"){let w=await X(_),E=y.environments.get(ke),N=rr.getDestination(String(w.destinationId??"")),j=String(w.resourceKind??""),q=w.dataServiceId?String(w.dataServiceId):void 0,H=q?zt.get(q):void 0,V=w.resourceId?String(w.resourceId):void 0,Y=V?y.store.getResource(V):void 0;if(!E)return C({ok:!1,error:"Environment was not found."},404);if(!N||N.projectId!==y.project.id)return C({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(j))return C({ok:!1,error:"A supported backup resource kind is required."},422);if(q&&(!H||H.projectId!==y.project.id||H.environmentId!==E.id))return C({ok:!1,error:"Data service was not found in this environment."},404);if(V&&(!Y||Y.projectId!==y.project.id||Y.environmentId!==E.id))return C({ok:!1,error:"Resource was not found in this environment."},404);if(j==="managed_database"&&!H)return C({ok:!1,error:"Managed database policies require a data service."},422);if(j==="logical_database"&&(!H||!["container","server"].includes(H.provider)))return C({ok:!1,error:"Logical database policies require an on-box data service."},422);if(j==="volume"&&(!Y||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(w.volumeName??""))))return C({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let he=Array.isArray(w.includePatterns)?w.includePatterns.map(String).filter(Boolean):[];if(j==="files"&&(!Y||!he.length))return C({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(j==="control_plane"&&N.encryption==="provider")return C({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(j==="infrastructure"&&(N.provider!=="aws_backup"||!he.some((le)=>le.startsWith("resource:arn:"))||!he.some((le)=>le.startsWith("role:arn:"))))return C({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let le=rr.createPolicy({organizationId:y.organization.id,projectId:y.project.id,environmentId:E.id,resourceId:V,dataServiceId:q,destinationId:N.id,name:String(w.name??"").trim(),resourceKind:j,schedule:String(w.schedule??"daily"),timezone:String(w.timezone??"UTC"),retention:w.retention&&typeof w.retention==="object"&&!Array.isArray(w.retention)?w.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(w.compression))?w.compression:"gzip",encryption:["destination","client_side","both"].includes(String(w.encryption))?w.encryption:"destination",includePatterns:j==="volume"?[String(w.volumeName),...he]:he,excludePatterns:Array.isArray(w.excludePatterns)?w.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(w.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(w.expectedRtoMinutes)||120),healthCheckId:w.healthCheckId?String(w.healthCheckId):void 0,enabled:w.enabled!==!1});return C({ok:!0,policy:le},201)}catch(le){return C({ok:!1,error:le instanceof Error?le.message:String(le)},422)}}if(B.pathname==="/api/backups/run"&&_.method==="POST"){let w=await X(_),E=rr.getPolicy(String(w.policyId??"")),N=y.environments.get(ke);if(!E||E.projectId!==y.project.id||E.environmentId!==N?.id)return C({ok:!1,error:"Backup policy was not found in this environment."},404);try{let j=Yi.enqueueBackup(E,new Date().toISOString(),qe(de).actor?.id);return C({ok:!0,job:j},202)}catch(j){return C({ok:!1,error:j instanceof Error?j.message:String(j)},409)}}if(B.pathname==="/api/backups/verify"&&_.method==="POST"){let w=await X(_),E=rr.getRecoveryPoint(String(w.recoveryPointId??""));if(!E||E.projectId!==y.project.id)return C({ok:!1,error:"Recovery point was not found."},404);return C({ok:!0,job:Yi.enqueueVerification(E)},202)}if(B.pathname==="/api/backups/restore"&&_.method==="POST"){let w=await X(_),E=rr.getRecoveryPoint(String(w.recoveryPointId??"")),N=w.mode==="in_place"?"in_place":"isolated",j=w.target&&typeof w.target==="object"&&!Array.isArray(w.target)?{...w.target,inPlace:N==="in_place"}:{inPlace:N==="in_place"},q=Wt.resolveSession(_),H={mode:N,target:j,targetName:String(w.targetName??""),confirm:w.confirm?String(w.confirm):void 0,recentAuth:!Ce||!!q&&_e.isRecentlyAuthenticated(q),downtimeAcknowledged:w.downtimeAcknowledged===!0,safetyBackupId:w.safetyBackupId?String(w.safetyBackupId):void 0};if(!E||E.projectId!==y.project.id)return C({ok:!1,error:"Recovery point was not found."},404);if(w.drill===!0&&N!=="isolated")return C({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let V=Yi.planRestore(E,H);if(w.execute!==!0)return C({ok:!0,plan:V,executionCreated:!1});let Y=Yi.enqueueRestore(E,{...H,drill:w.drill===!0,actorId:qe(de).actor?.id});return C({ok:!0,plan:V,job:Y},202)}catch(V){return C({ok:!1,error:V instanceof Error?V.message:String(V)},409)}}if(B.pathname==="/api/backups/recovery-points"&&_.method==="POST"){let w=await X(_),E=rr.getRecoveryPoint(String(w.id??""));if(!E||E.projectId!==y.project.id)return C({ok:!1,error:"Recovery point was not found."},404);if(w.held==null&&w.pinned==null)return C({ok:!1,error:"held or pinned must be provided."},422);return C({ok:!0,recoveryPoint:rr.updateRecoveryPoint(E.id,{held:w.held==null?E.held:w.held===!0,pinned:w.pinned==null?E.pinned:w.pinned===!0})})}if(B.pathname==="/api/backups/retention"&&_.method==="POST")return C({ok:!0,jobs:Yi.enqueueRetention()},202);if(B.pathname==="/api/data-services/capabilities"&&_.method==="GET"){let w=String(B.searchParams.get("engine")??""),E=String(B.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(w)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(E))return C({ok:!1,error:"A supported engine and provider are required."},422);return C({ok:!0,engine:w,provider:E,capabilities:wn(w,E)})}if(B.pathname==="/api/data-services"&&_.method==="GET"){let w=y.environments.get(ke),E=zt.list(y.project.id,w?.id).map((N)=>{let j=zt.credential(N.id);return{...N,credentialRef:void 0,credential:j?{configured:!0,username:j.username,version:j.version,rotatedAt:j.rotatedAt}:void 0,dependencies:zt.dependencies(N.id).map((q)=>({resourceId:q.resourceId,requiresRedeploy:q.requiresRedeploy}))}});return C({ok:!0,services:E})}if(B.pathname==="/api/data-services/preview"&&_.method==="POST"){let w=await X(_);if(w.id){let j=zt.get(String(w.id)),q=y.environments.get(ke),H=String(w.action??"");if(!j||j.projectId!==y.project.id||j.environmentId!==q?.id)return C({ok:!1,error:"Data service was not found in this environment."},404);if(!yl.includes(H))return C({ok:!1,error:`Action must be one of: ${yl.join(", ")}.`},422);try{return C({ok:!0,plan:Ec.plan(j,H,w.changes??{})})}catch(V){return C({ok:!1,error:V instanceof Error?V.message:String(V)},422)}}let E=String(w.engine??""),N=String(w.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(E)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(N))return C({ok:!1,error:"A supported engine and provider are required."},422);return C({ok:!0,capabilities:wn(E,N),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(B.pathname==="/api/data-services"&&_.method==="POST"){let w=await X(_),E=String(w.engine??""),N=String(w.provider??""),j=y.environments.get(ke),q=qe(de);if(!j)return C({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(E)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(N))return C({ok:!1,error:"A supported engine and provider are required."},422);let H={organizationId:y.organization.id,projectId:y.project.id,environmentId:j.id,resourceId:w.resourceId?String(w.resourceId):void 0,name:String(w.name??"").trim(),engine:E,provider:N,placement:String(w.placement??w.name??"").trim(),engineVersion:w.engineVersion?String(w.engineVersion):void 0,plan:String(w.plan??(N==="aws_elasticache"?"cache.t4g.micro":N==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:w.storageGb==null?void 0:Number(w.storageGb),highAvailability:w.highAvailability===!0,publicExposure:w.publicExposure===!0,allowedCidrs:Array.isArray(w.allowedCidrs)?w.allowedCidrs.map(String):[],desiredState:w.desiredState&&typeof w.desiredState==="object"&&!Array.isArray(w.desiredState)?w.desiredState:{},observedState:{},origin:w.adopt===!0?"adopted":"managed",managementEnabled:w.adopt!==!0,ownerActorId:q.actor?.id,username:w.username?String(w.username):void 0};try{if(w.adopt===!0){let Y=zt.create({...H,status:"adopted",credentialRef:void 0});return C({ok:!0,service:Y,readOnly:!0},201)}if(!Rm({provider:N,engine:E}))return C({ok:!1,error:`No ${N}/${E} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let V=await Ec.create(H);return C({ok:!0,service:V.service,operationId:V.operationId,oneTimeCredential:V.credential},201)}catch(V){return C({ok:!1,error:V instanceof Error?V.message:String(V)},422)}}if(B.pathname==="/api/data-services/connections"&&_.method==="GET"){let w=zt.get(String(B.searchParams.get("id")??"")),E=y.environments.get(ke);if(!w||w.projectId!==y.project.id||w.environmentId!==E?.id)return C({ok:!1,error:"Data service was not found in this environment."},404);let N=typeof w.observedState.endpoint==="string"?w.observedState.endpoint:void 0,j=typeof w.observedState.readerEndpoint==="string"?w.observedState.readerEndpoint:void 0,q=Number(w.observedState.port)||(w.engine==="postgres"?5432:w.engine==="redis"?6379:w.engine==="mongodb"?27017:w.engine==="libsql"?8080:3306),H=typeof w.observedState.database==="string"?w.observedState.database:void 0,V=typeof w.observedState.tls==="boolean"?w.observedState.tls:w.provider.startsWith("aws_"),Y=[...N?[{type:w.publicExposure?"external":"internal",host:N,port:q,database:H,tls:V}]:[],...j?[{type:"internal",host:j,port:q,database:H,tls:V}]:[],{type:"tunnel",host:N??w.placement,port:q,database:H,tls:V}];return C({ok:!0,serviceId:w.id,guidance:Fu(w,Y)})}if(B.pathname==="/api/data-services/action"&&_.method==="POST"){let w=await X(_),E=zt.get(String(w.id??"")),N=y.environments.get(ke),j=String(w.action??"");if(!E||E.projectId!==y.project.id||E.environmentId!==N?.id)return C({ok:!1,error:"Data service was not found in this environment."},404);if(!yl.includes(j))return C({ok:!1,error:`Action must be one of: ${yl.join(", ")}.`},422);let q=w.changes&&typeof w.changes==="object"&&!Array.isArray(w.changes)?w.changes:{};try{let H=Ec.plan(E,j,q);if(w.execute!==!0)return C({ok:!0,plan:H,productionExecutionCreated:!1});let V=Ec.enqueue(E,j,q,qe(de).actor?.id);return C({ok:!0,plan:H,operationId:V},202)}catch(H){return C({ok:!1,error:H instanceof Error?H.message:String(H)},409)}}if(B.pathname==="/api/data-services/dependencies"&&_.method==="POST"){let w=await X(_),E=zt.get(String(w.id??"")),N=y.environments.get(ke),j=y.store.getResource(String(w.resourceId??""));if(!E||E.projectId!==y.project.id||E.environmentId!==N?.id)return C({ok:!1,error:"Data service was not found in this environment."},404);if(!j||j.projectId!==y.project.id||j.environmentId!==N?.id)return C({ok:!1,error:"Dependent resource was not found in this environment."},404);if(w.remove===!0)return C({ok:zt.removeDependency(E.id,j.id)});return zt.addDependency({serviceId:E.id,resourceId:j.id,secretRef:E.credentialRef??`secret://data-services/${E.projectId}/${E.name}`,requiresRedeploy:w.requiresRedeploy!==!1}),C({ok:!0,dependencies:zt.dependencies(E.id).map((q)=>({resourceId:q.resourceId,requiresRedeploy:q.requiresRedeploy}))})}if(B.pathname==="/api/data-services/management"&&_.method==="POST"){let w=await X(_),E=zt.get(String(w.id??"")),N=y.environments.get(ke);if(!E||E.projectId!==y.project.id||E.environmentId!==N?.id)return C({ok:!1,error:"Data service was not found in this environment."},404);if(E.origin!=="adopted"||w.reviewed!==!0||w.confirm!==E.name)return C({ok:!1,error:`Enabling management requires reviewed=true and typing ${E.name}.`},409);return C({ok:!0,service:zt.update(E.id,E.version,{managementEnabled:!0})})}if(B.pathname==="/api/data-services/reveal"&&_.method==="POST"){let w=await X(_),E=zt.get(String(w.id??"")),N=y.environments.get(ke),j=E?zt.credential(E.id):void 0;if(!E||E.projectId!==y.project.id||E.environmentId!==N?.id)return C({ok:!1,error:"Data service was not found in this environment."},404);if(!j)return C({ok:!1,error:"No managed credential is configured."},404);return C({ok:!0,credential:{username:j.username,password:await ii.resolve(j.secretRef),version:j.version}},200,{"cache-control":"no-store"})}if(B.pathname==="/api/databases"&&_.method==="GET")return C(await vb(f,ke));if(B.pathname==="/api/databases"&&_.method==="POST"){let w=await X(_),E=String(w.name??"").trim();if(!bi(E))return C({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return C({...await bb(f,ke,E),name:E})}if(B.pathname==="/api/databases/vitess"&&_.method==="GET"){let w=await Ib(f,ke);return C({...w,unhealthy:Eb(w.tablets),missingPrimary:Rb(w)})}if(B.pathname==="/api/databases/vitess/provision"&&_.method==="POST"){let w=await X(_);try{return C(await $b(f,ke,{keyspace:String(w.keyspace??""),username:String(w.username??""),password:String(w.password??""),sharded:w.sharded===!0,confirm:String(w.confirm??"")}))}catch(E){return C({ok:!1,error:E instanceof Error?E.message:String(E)},422)}}if(B.pathname==="/api/databases/vitess/migrations"&&_.method==="GET"){let w=B.searchParams.get("keyspace")??void 0;return C(await Db(f,ke,w))}if(B.pathname==="/api/databases/vitess/migrations/action"&&_.method==="POST"){let w=await X(_),E=String(w.uuid??"").trim(),N=String(w.action??"");if(!["retry","cancel","cleanup","complete"].includes(N))return C({ok:!1,error:"Unknown migration action."},422);return C(await Ob(f,ke,E,N))}if(B.pathname==="/api/databases/vitess/keyspaces"&&_.method==="POST"){let w=await X(_),E=String(w.name??"").trim(),N=w.sharded===!0;return C(await _b(f,ke,E,{sharded:N}))}if(B.pathname==="/api/databases/vitess/vschema"&&_.method==="POST"){let w=await X(_),E=String(w.keyspace??"").trim(),N=typeof w.vschema==="string"?w.vschema:JSON.stringify(w.vschema??null);return C(await Tb(f,ke,E,N))}if(B.pathname==="/api/databases/vitess/schema"&&_.method==="POST"){let w=await X(_),E=String(w.sql??"");return C(await xb(f,ke,E))}if(B.pathname==="/api/databases/vitess/install-client"&&_.method==="POST")return C(await Pb(f,ke));if(B.pathname==="/api/databases/backups"&&_.method==="GET")return C(await kb(f,ke));if(B.pathname==="/api/databases/backup"&&_.method==="POST"){let w=await X(_),E=String(w.database??"").trim();if(!bi(E))return C({ok:!1,error:"Database name must be a valid identifier."},422);if(w.confirm!==E)return C({ok:!1,error:`Type "${E}" to back up this database.`},409);return C(await wb(f,ke,E))}if(B.pathname==="/api/databases/users"&&_.method==="POST"){let w=await X(_),E=String(w.username??"").trim(),N=String(w.password??""),j=String(w.database??"").trim()||void 0,q=w.access==="readonly"?"readonly":"all";if(!bi(E))return C({ok:!1,error:"Username must be a valid identifier."},422);if(!N)return C({ok:!1,error:"Password is required."},422);if(j&&!bi(j))return C({ok:!1,error:"Database must be a valid identifier."},422);return C({...await Sb(f,ke,{username:E,password:N,database:j,access:q}),username:E})}if(B.pathname==="/api/dashboard-data")return qt=M.get(ke)??await ye(ke),ye(ke),C(um(qt,{user:gn,slug:f.project.slug}));if(B.pathname==="/api/users"&&_.method==="GET")return C({ok:!0,users:en(t).map(js)});if(B.pathname==="/api/users"&&_.method==="POST"){let w=await X(_),E=String(w.username??"").trim();if(!il(E))return C({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let N=w.sites&&typeof w.sites==="object"?w.sites:{},j=new Set(Object.keys(f.sites??{})),q={};for(let[Y,he]of Object.entries(N)){if(!j.has(Y))return C({ok:!1,error:`Site '${Y}' was not found.`},404);if(he!=="owner"&&he!=="collaborator")return C({ok:!1,error:`Unknown site role '${he}'. Use 'owner' or 'collaborator'.`},422);q[Y]=he}let H=typeof w.password==="string"&&w.password.trim()?w.password.trim():void 0;if(H&&H.length<12)return C({ok:!1,error:"Password must be at least 12 characters."},422);let V=yc(t,{username:E,password:H,name:typeof w.name==="string"?w.name:void 0,sites:q});return Cs(y,en(t)),Ze(),C({ok:!0,user:js(V.user),password:V.password})}if(B.pathname==="/api/users"&&_.method==="DELETE"){let w=await X(_),E=String(w.username??"").trim();if(E.toLowerCase()===de.username.toLowerCase())return C({ok:!1,error:"You cannot remove your own account."},409);let N=Fn(en(t),E),j=N?y.store.getActorByExternalId("user",`dashboard:${N.username.toLowerCase()}`):void 0,q=j?y.store.getMembershipForActor(y.organization.id,j.id):void 0;if(q&&q.source!=="legacy")return C({ok:!1,error:"Organization members must be removed from Organization access."},409);let H=cm(t,E);if(!H.ok)return C(H,409);return Cs(y,en(t)),ee.clear(),C({ok:!0,username:E})}if(B.pathname==="/api/actions/run"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=w.action?Rs(w.action,ke):void 0;if(!E)return C({ok:!1,error:"Unknown dashboard action."},404);if(E.mutates&&w.confirm!==E.confirm)return C({ok:!1,error:`Type "${E.confirm}" to run this action.`},409);let N=await Me({controlPlane:y,environment:ke,actor:de,kind:`dashboard.action.${E.id}`,input:{action:E.id},execute:()=>km(E,{cwd:t,cliEntry:g})});return C({...N.result,controlPlaneOperation:N.operation})}if(B.pathname==="/api/server/operations/run"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=w.operation?lm(w.operation,f,qt):void 0;if(!E)return C({ok:!1,error:"Unknown or unavailable server operation."},404);if(E.mutates&&w.confirm!==E.confirm)return C({ok:!1,error:`Type "${E.confirm}" to run this operation.`},409);let N=ge(y,String(ke));await new Lt(it).run(new vn,{...N,artifactRoot:t});let j=hs(it,{scope:N,desiredConfigHash:y.project.desiredConfigHash});if(j.decision.outcome==="block")return C({ok:!1,error:`Operation blocked by security policy: ${j.decision.explanation}`,securityReview:j},409);let q=await Me({controlPlane:y,environment:ke,actor:de,kind:`dashboard.server.${E.id}`,resourceSlug:E.target,input:{operation:E.id,target:E.target,to:w.to??null},execute:()=>ll(f,ke,E,{to:w.to})});return C({...q.result,controlPlaneOperation:q.operation,securityReview:j})}if(B.pathname==="/api/server/command"&&_.method==="POST"){let w=await _.json().catch(()=>({}));if(w.confirm!=="run")return C({ok:!1,error:'Type "run" to execute this command on the server.'},409);let E=await Me({controlPlane:y,environment:ke,actor:de,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>vc(f,ke,String(w.command??""))});return C({...E.result,controlPlaneOperation:E.operation})}if(B.pathname==="/api/serverless/operations")return C(hm(f,ke,qt));if(B.pathname==="/api/serverless/operations/run"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=w.operation?gS(w.operation,f,ke,qt):void 0;if(!E)return C({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(E.mutates&&w.confirm!==E.confirm)return C({ok:!1,error:`Type "${E.confirm}" to run this operation.`},409);let N=await Me({controlPlane:y,environment:ke,actor:de,kind:`dashboard.serverless.${E.id}`,input:{operation:E.id,min:w.min??null,max:w.max??null},execute:()=>mS(f,ke,E,{min:w.min,max:w.max})});return qt=await Ro(f,ke),M.set(ke,qt),C({...N.result,controlPlaneOperation:N.operation})}if(B.pathname==="/api/serverless/command"&&_.method==="POST"){let w=await _.json().catch(()=>({}));if(w.confirm!=="run")return C({ok:!1,error:'Type "run" to execute this command.'},409);return C(await fS(f,ke,String(w.command??"")))}if(B.pathname==="/api/serverless/dlq"&&_.method==="GET"){let w=Number(B.searchParams.get("max"))||10;return C(await hS(f,ke,w))}if(B.pathname==="/api/serverless/dlq/redrive"&&_.method==="POST"){let w=await _.json().catch(()=>({}));if(w.confirm!=="redrive")return C({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return C(await yS(f,ke,{max:w.max,targetQueue:w.targetQueue}))}if(B.pathname==="/api/serverless/dlq/purge"&&_.method==="POST"){if((await _.json().catch(()=>({}))).confirm!=="purge")return C({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return C(await vS(f,ke))}if(B.pathname==="/api/serverless/secrets"&&_.method==="GET")return C({secrets:bS(f,ke)});if(B.pathname==="/api/serverless/secrets"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=String(w.secretId??"").trim();if(!E)return C({ok:!1,error:"A secret id is required."},422);if(typeof w.value!=="string"||w.value==="")return C({ok:!1,error:"A non-empty value is required."},422);return C(await SS(f,ke,E,w.value))}if(B.pathname==="/api/serverless/secrets"&&_.method==="DELETE"){let w=await _.json().catch(()=>({})),E=String(w.secretId??"").trim();if(!E)return C({ok:!1,error:"A secret id is required."},422);if(w.confirm!==E)return C({ok:!1,error:`Type "${E}" to delete this secret.`},409);return C(await wS(f,ke,E))}if(B.pathname==="/api/serverless/functions/config"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=String(w.mode??"").trim();if(w.confirm!==E)return C({ok:!1,error:`Type "${E}" to update this function.`},409);return C(await kS(f,ke,E,{memory:w.memory,timeout:w.timeout}))}if(B.pathname==="/api/serverless/alarms"&&_.method==="GET")return C(await IS(f,ke));if(B.pathname==="/api/serverless/alarms"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=String(w.preset??"").trim(),N=Number(w.threshold);if(!E)return C({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(N))return C({ok:!1,error:"A numeric threshold is required."},422);return C(await ES(f,ke,E,N))}if(B.pathname==="/api/serverless/alarms"&&_.method==="DELETE"){let w=await _.json().catch(()=>({})),E=String(w.name??"").trim();if(!E)return C({ok:!1,error:"An alarm name is required."},422);if(w.confirm!==E)return C({ok:!1,error:`Type "${E}" to delete this alarm.`},409);return C(await RS(f,ke,E))}if(B.pathname==="/api/serverless/traces"&&_.method==="GET"){let w=Number(B.searchParams.get("minutes"))||30;return C(await pl(f,ke,w))}if(B.pathname==="/api/serverless/scheduler"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=String(w.action??"").trim();if(E!=="enable"&&E!=="disable"&&E!=="run")return C({ok:!1,error:"Unknown scheduler action."},422);if(w.confirm!==E)return C({ok:!1,error:`Type "${E}" to ${E} the scheduler.`},409);return C(await bm(f,ke,E))}if(!iw(B.pathname,gn))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(ke)}`}});let Oo=await Bt(de,ke);if(!Oo)return bl("ts-cloud dashboard UI is unavailable.",503);return ow(Oo,B.pathname)}catch(eo){if(e.verbose)console.error(eo);return C({ok:!1,error:eo?.message??String(eo)},500)}})();if(!er)return er;if(bt&&(B.pathname.startsWith("/api/")||B.pathname.startsWith("/auth/"))){let tt;if((Oe.headers.get("content-type")||"").includes("application/json"))tt=await Oe.json().catch(()=>{return});let _r=Wt.resolveUser(_),mr=_r?qe(_r).actor:void 0;y.store.appendEvent({organizationId:y.organization.id,projectId:y.project.id,actorId:mr?.id,correlationId:Ge,type:er.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:er.status<400?"info":"warning",payload:Q_(_.method,B.pathname,tt,er.status,Date.now()-Ue)})}return er.headers.set("x-request-id",Ge),er}});Rc?.start();let Sw=e.spendLoop??!0,Um;if(Sw)(async()=>{let{SpendRunner:_,SpendLoopLease:Ne,startSpendLoop:Ue}=await import("./spend/index.js"),{store:Oe}=await aw(y.store),Ge=new _({controlPlane:y.store,store:Oe,alerts:et});Um=Ue(Ge,{lease:new Ne(y.store,{owner:`dashboard:${process.pid}`}),onError:(bt)=>console.error(`[ts-cloud] spend cycle failed: ${bt instanceof Error?bt.message:String(bt)}`)})})();let ww=xo.stop.bind(xo);return xo.stop=(_)=>{clearInterval(Mm),clearInterval(Lm),clearInterval(Fm),clearInterval(Bm),clearInterval(jm),clearInterval(Dm),clearInterval(Om),clearInterval($m),clearInterval(Nm),Ze(),or.clear(),Rc?.stop(),Um?.();let Ne=ww(_);if(Rc)Rc.settled().finally(()=>y.store.close());else y.store.close();return Ne},{server:xo,url:`http://${r}:${xo.port}/`}}export{da,qf,nu,LS,cs,iu,la,jf,zf,yn,ua,su,ot,ou,au,cu,ds,Sn,Kf,at,du,ga,pa,ma,lu,uu,gu,ls,fa,pu,In,us,ha,_t,Wf,mu,fu,Jf,hu,Aa,yr,Au,yu,Su,Iu,ct,Xf,bu,Sr,ya,Sa,Ia,gs,ps,bn,Cu,ms,ba,Ca,Cn,Eu,En,Yf,Zf,Lt,vn,Ea,eh,vu,Tu,va,wu,Ru,Du,$S,ge,Pu,MS,FS,fs,hs,US,Ee,th,$t,Le,$e,Mt,ku,Nu,Bu,xu,rh,nh,Ta,ih,sh,wa,Ou,_u,oh,pe,ah,Lu,ve,Ra,dt,Ft,Ut,Tn,As,$u,QS,ch,dh,lh,uh,Da,Pa,Mu,ka,wn,Na,Fu,ys,Uu,Ba,xa,Oa,_a,La,$a,Ma,Fa,Qu,Ir,Ua,Hu,Rn,Gu,Qa,Ha,Vu,br,Ga,Va,gh,HS,Ss,GS,VS,qS,qa,ja,qu,ph,za,Dn,ju,Is,zu,Ku,Wu,Ka,mh,Wa,Ju,fh,Ja,hh,Pn,kn,Xu,bs,Yu,Zu,eg,Xa,tg,rg,Ah,ng,v,ig,Cs,Me,sg,og,jS,ag,cg,dg,lg,ug,yh,zS,KS,WS,Sh,Ih,JS,XS,bh,Ch,YS,Es,Cr,Ya,Nn,Bn,Er,lt,Qt,vs,Eh,xn,gg,pg,Za,vh,ec,Th,wh,mg,tc,Ts,fg,rc,Ht,Fe,hg,nc,ic,Ag,sc,oc,ac,cc,yg,Sg,On,dc,lc,uc,gc,Ig,ws,_n,Rs,pc};
+`))},5000),rt.unref?.(),_.signal.addEventListener("abort",Ai,{once:!0})},cancel(){if(ft=!0,rt)clearInterval(rt)}});return new Response(an,{headers:{"cache-control":"no-cache, no-transform",connection:"keep-alive","content-type":"text/event-stream; charset=utf-8","x-accel-buffering":"no"}})}if(B.pathname==="/api/telemetry/series"&&_.method==="GET"){le(!1);let ke=Qe(),We=["sum","avg","min","max","count","p50","p90","p95","p99"].includes(String(ge.aggregation))?ge.aggregation:"avg",Ie=Y({...ge,kinds:"metric",limit:5000}),ze=E.series({...Ie,bucketMs:Number(ge.bucketMs)||60000,aggregation:We,timezone:String(ge.timezone??"UTC"),compareFrom:ge.compareFrom,compareTo:ge.compareTo});return C({ok:!0,collection:{generatedAt:ke.generatedAt,cached:ke.cached},query:{aggregation:We,bucketMs:Number(ge.bucketMs)||60000,timezone:String(ge.timezone??"UTC")},series:ze})}if(B.pathname==="/api/telemetry/refresh"&&_.method==="POST")return C({ok:!0,...await le(!0)});if(B.pathname==="/api/telemetry/export"&&_.method==="POST"){let ke=await X(_);await le(!1);let We=E.query({...Y(ke),limit:Math.min(5000,Number(ke.limit)||5000),cursor:void 0});if((ke.format==="csv"?"csv":"json")==="json")return new Response(JSON.stringify({exportedAt:new Date().toISOString(),query:Y(ke),...We},null,2),{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.json"',"content-type":"application/json; charset=utf-8"}});let ze=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"],rt=[ze.join(","),...We.records.map((ft)=>ze.map((Rt)=>`"${String(ft[Rt]??"").replaceAll('"','""')}"`).join(","))].join(`
+`);return new Response(rt,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(B.pathname==="/api/telemetry/saved-queries"&&_.method==="GET"){let ke=qe(ae);return C({ok:!0,queries:E.listSavedQueries(y.project.id,ke.actor?.id)})}if(B.pathname==="/api/telemetry/saved-queries"&&_.method==="POST"){let ke=await X(_),We=qe(ae);return C({ok:!0,query:E.saveQuery(y.project.id,We.actor?.id,String(ke.name??""),Y(ke.query??ke))},201)}if(B.pathname==="/api/telemetry/saved-queries"&&_.method==="DELETE"){let ke=await X(_),We=qe(ae),Ie=E.deleteSavedQuery(y.project.id,We.actor?.id,String(ke.id??""));return C({ok:Ie},Ie?200:404)}}if(B.pathname.startsWith("/api/configuration")){let w=y.environments.get(Se),E=ae.role==="admin"||!!gn.capabilities?.includes("secrets:read"),N=ae.role==="admin"||!!gn.capabilities?.includes("secrets:write"),j={projectId:y.project.id,environmentId:w?.id},q={"cache-control":"no-store"};if(B.pathname==="/api/configuration"&&_.method==="GET"){let H=Object.fromEntries(B.searchParams),V=H.scopeType||H.scopeId?Ls(H,j):void 0,Y=["variable","secret"].includes(String(H.kind))?H.kind:void 0,ge=V?.type==="preview"?Xt.previews.getInstance(V.id):void 0,le=ge?Xt.previews.getDefinition(ge.definitionId):void 0,Qe=V?await tn.resolve({projectId:y.project.id,environmentId:V.environmentId,resourceId:V.resourceId,functionId:V.type==="function"?V.id:void 0,previewId:V.previewId,trustedPreview:!!ge&&!ge.fork,allowedPreviewSecrets:le?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:E}):void 0,ke=y.store.listResources(y.project.id);return C({ok:!0,entries:tn.list({projectId:y.project.id,scope:V,kind:Y,search:H.search,canReadSecretMetadata:E}),effectiveEntries:Qe?Object.values(Qe.entries).filter((We)=>!Y||We.kind===Y).filter((We)=>!H.search||We.key.toLowerCase().includes(String(H.search).toLowerCase())):[],configurationHash:Qe?.configurationHash,warnings:Qe?.warnings??[],scopes:{project:y.project,environments:y.store.listEnvironments(y.project.id),resources:ke.filter((We)=>We.kind!=="function"),functions:ke.filter((We)=>We.kind==="function"),previews:Xt.previews.listInstances({projectId:y.project.id}).filter((We)=>We.status!=="destroyed").map((We)=>({id:We.id,name:We.name,environmentId:We.baseEnvironmentId,resourceId:We.resourceId,fork:We.fork,status:We.status}))}},200,q)}if(B.pathname==="/api/configuration/export"&&_.method==="GET"){let H=Ls(Object.fromEntries(B.searchParams),j);return new Response(tn.exportVariables({projectId:y.project.id,scope:H}),{headers:{...q,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(B.pathname==="/api/configuration/plan"&&_.method==="POST"){let H=await X(_),V=Ls(H,j),Y=H.values&&typeof H.values==="object"&&!Array.isArray(H.values)?Object.fromEntries(Object.entries(H.values).map(([ge,le])=>[ge,String(le)])):{};return C({ok:!0,plan:tn.plan({projectId:y.project.id,scope:V,values:Y,removeMissing:H.removeMissing===!0})},200,q)}if(B.pathname==="/api/configuration"&&_.method==="POST"){let H=await X(_),V=Ls(H,j),Y=H.kind==="secret"?"secret":"variable",ge=String(H.key??"");if(Y==="secret"&&!N)return C({ok:!1,error:"Secret write permission is required."},403,q);try{let le=await tn.set({organizationId:y.organization.id,projectId:y.project.id,scope:V,key:ge,kind:Y,value:H.value==null?void 0:String(H.value),reference:H.reference==null?void 0:String(H.reference),backend:H.backend,required:H.required===!0,expectedVersion:H.expectedVersion==null?void 0:Number(H.expectedVersion),confirmed:String(H.confirm??"")===ge,idempotencyKey:_.headers.get("idempotency-key")??H.idempotencyKey,actorId:qe(ae).actor?.id});return C({ok:!0,entry:tn.list({projectId:y.project.id,scope:V,canReadSecretMetadata:E}).find((Qe)=>Qe.id===le.entry.id),mutation:le.mutation,warnings:le.warnings},le.mutation.added.length?201:200,q)}catch(le){return C({ok:!1,error:le instanceof Error?le.message:String(le)},409,q)}}if(B.pathname==="/api/configuration/import"&&_.method==="POST"){let H=await X(_),V=Ls(H,j),Y=Array.isArray(H.secretKeys)?H.secretKeys.map(String):[];if(Y.length&&!N)return C({ok:!1,error:"Secret write permission is required."},403,q);try{let ge=await tn.importDotenv({organizationId:y.organization.id,projectId:y.project.id,scope:V,source:String(H.source??""),secretKeys:Y,backend:H.backend,confirmed:H.confirm==="import",idempotencyKey:_.headers.get("idempotency-key")??H.idempotencyKey,actorId:qe(ae).actor?.id});return C({ok:ge.document.valid,diagnostics:ge.document.diagnostics,mutation:ge.mutation,warnings:ge.warnings},ge.document.valid?200:422,q)}catch(ge){return C({ok:!1,error:ge instanceof Error?ge.message:String(ge)},409,q)}}if(B.pathname==="/api/configuration/dependencies"&&_.method==="POST"){let H=await X(_),V=wi.get(String(H.entryId??"")),Y=y.store.getResource(String(H.resourceId??""));if(!V||V.projectId!==y.project.id||!Y||Y.projectId!==y.project.id)return C({ok:!1,error:"Configuration entry or dependent resource was not found."},404,q);return C({ok:!0,dependency:wi.setDependency({entryId:V.id,resourceId:Y.id,injectionTarget:["native_reference","file"].includes(String(H.injectionTarget))?H.injectionTarget:"environment",required:H.required!==!1,requiresRedeploy:H.requiresRedeploy!==!1,lastDeployedVersion:H.lastDeployedVersion==null?void 0:Number(H.lastDeployedVersion)})},200,q)}if(B.pathname==="/api/configuration/transfer"&&_.method==="POST"){let H=await X(_),V=wi.get(String(H.id??"")),Y=Ls({...H,scopeType:H.targetScopeType,scopeId:H.targetScopeId},j);if(!V||V.projectId!==y.project.id)return C({ok:!1,error:"Configuration entry was not found."},404,q);if(V.kind==="secret"&&!N)return C({ok:!1,error:"Secret write permission is required."},403,q);try{let ge=await tn.transfer({entryId:V.id,targetScope:Y,mode:H.mode==="move"?"move":"copy",confirmed:H.confirm===V.key,actorId:qe(ae).actor?.id,idempotencyKey:_.headers.get("idempotency-key")??H.idempotencyKey});return C({ok:!0,entry:tn.list({projectId:y.project.id,scope:Y,canReadSecretMetadata:E}).find((le)=>le.id===ge.entry.id),mutation:ge.mutation},200,q)}catch(ge){return C({ok:!1,error:ge instanceof Error?ge.message:String(ge)},409,q)}}if(B.pathname==="/api/configuration/bulk"&&_.method==="POST"){let H=await X(_),V=Array.isArray(H.ids)?H.ids.map(String).slice(0,500):[],Y=V.map((le)=>wi.get(le)).filter((le)=>!!le&&le.projectId===y.project.id);if(Y.length!==V.length)return C({ok:!1,error:"One or more configuration entries were not found."},404,q);if(Y.some((le)=>le.kind==="secret")&&!N)return C({ok:!1,error:"Secret write permission is required."},403,q);if(H.action!=="delete"||H.confirm!=="bulk")return C({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,q);let ge=[];try{for(let le of Y)ge.push(await tn.remove({entryId:le.id,expectedVersion:le.version,confirmed:!0,actorId:qe(ae).actor?.id}));return C({ok:!0,removed:ge.flatMap((le)=>le.removed),affectedResourceIds:[...new Set(ge.flatMap((le)=>le.affectedResourceIds))].sort()},200,q)}catch(le){return C({ok:!1,error:le instanceof Error?le.message:String(le),partial:ge.flatMap((Qe)=>Qe.removed)},409,q)}}if(B.pathname==="/api/configuration/reveal"&&_.method==="POST"){let H=await X(_),V=Wt.resolveSession(_);try{return C({ok:!0,value:await tn.reveal({entryId:String(H.id??""),canRevealSecrets:E,recentlyAuthenticated:!Ee||!!V&&Pe.isRecentlyAuthenticated(V),actorId:qe(ae).actor?.id})},200,q)}catch(Y){return C({ok:!1,error:Y instanceof Error?Y.message:String(Y)},403,q)}}if(B.pathname==="/api/configuration"&&_.method==="DELETE"){let H=await X(_),V=wi.get(String(H.id??""));if(V?.kind==="secret"&&!N)return C({ok:!1,error:"Secret write permission is required."},403,q);if(!V||V.projectId!==y.project.id)return C({ok:!1,error:"Configuration entry was not found."},404,q);try{return C({ok:!0,mutation:await tn.remove({entryId:V.id,expectedVersion:Number(H.expectedVersion),confirmed:String(H.confirm??"")===V.key,actorId:qe(ae).actor?.id})},200,q)}catch(Y){return C({ok:!1,error:Y instanceof Error?Y.message:String(Y)},409,q)}}}if(B.pathname.startsWith("/api/fleet")){let w=qe(ae).actor?.id,E=(N,j=409)=>C({ok:!1,error:N instanceof Error?N.message:String(N)},j,{"cache-control":"no-store"});if(B.pathname==="/api/fleet"&&_.method==="GET")return C({ok:!0,servers:Us.list(y.project.id),resources:y.store.listResources(y.project.id),operations:Dt.list({projectId:y.project.id,limit:200}).filter((N)=>N.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(B.pathname==="/api/fleet"&&_.method==="POST"){let N=await X(_);try{return C({ok:!0,server:Yn.enroll({organizationId:y.organization.id,projectId:y.project.id,name:String(N.name??""),provider:["aws","hetzner"].includes(String(N.provider))?N.provider:"ssh",providerId:N.providerId?String(N.providerId):void 0,region:N.region?String(N.region):void 0,zone:N.zone?String(N.zone):void 0,endpoint:String(N.endpoint??""),sshUser:String(N.sshUser??"deploy"),sshPort:N.sshPort?Number(N.sshPort):22,credentialRef:String(N.credentialRef??""),roles:Array.isArray(N.roles)?N.roles:[],labels:N.labels&&typeof N.labels==="object"?N.labels:{}})},201)}catch(j){return E(j,422)}}if(B.pathname==="/api/fleet/action"&&_.method==="POST"){let N=await X(_),j=String(N.id??""),q=String(N.action??"");try{if(q==="test")return C({ok:!0,server:await Yn.test(j)});if(q==="validate")return C({ok:!0,server:await Yn.validate(j)});if(q==="review_host_key")return C({ok:!0,server:Yn.reviewHostKey(j,String(N.fingerprint??""))});if(q==="bootstrap")return C({ok:!0,...Yn.bootstrap(j,N.confirmed===!0)},N.confirmed===!0?202:200);if(q==="heartbeat")return C({ok:!0,server:Yn.heartbeat(j,{usage:N.usage&&typeof N.usage==="object"?N.usage:{}})});if(q==="drain")return C({ok:!0,server:Yn.drain(j,N.completed===!0)});if(q==="uncordon")return C({ok:!0,server:Yn.uncordon(j)});if(q==="archive")return C({ok:!0,server:Yn.archive(j,String(N.confirmation??""))});return E("Unsupported fleet action.",422)}catch(H){return E(H)}}}if(B.pathname.startsWith("/api/capacity")){let w=(E,N=409)=>C({ok:!1,error:E instanceof Error?E.message:String(E)},N,{"cache-control":"no-store"});if(B.pathname==="/api/capacity"&&_.method==="GET")return C({ok:!0,pools:Ii.listPools(y.project.id),placements:Ii.listPlacements(y.project.id),servers:Us.list(y.project.id)},200,{"cache-control":"no-store"});if(B.pathname==="/api/capacity"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,pool:Ii.createPool({organizationId:y.organization.id,projectId:y.project.id,name:String(E.name??""),purpose:String(E.purpose??"application"),backend:String(E.backend??"server"),region:E.region?String(E.region):void 0,architecture:E.architecture?String(E.architecture):void 0,labels:E.labels&&typeof E.labels==="object"?E.labels:{},requiredServerLabels:E.requiredServerLabels&&typeof E.requiredServerLabels==="object"?E.requiredServerLabels:{},toleratedTaints:Array.isArray(E.toleratedTaints)?E.toleratedTaints.map(String):[],capacity:E.capacity&&typeof E.capacity==="object"?E.capacity:{},maxWorkloads:Number(E.maxWorkloads??10),costWeight:Number(E.costWeight??1),spreadKey:E.spreadKey?String(E.spreadKey):void 0,concurrency:Number(E.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(N){return w(N,422)}}if(B.pathname==="/api/capacity/member"&&_.method==="POST"){let E=await X(_);try{return Ii.addMember(String(E.poolId??""),String(E.serverId??"")),C({ok:!0,pool:Ii.getPool(String(E.poolId??""))})}catch(N){return w(N,422)}}if(B.pathname==="/api/capacity/explain"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,decisions:Cm.explain(y.project.id,{purpose:String(E.purpose??"application"),resources:E.resources&&typeof E.resources==="object"?E.resources:{},region:E.region?String(E.region):void 0,architecture:E.architecture?String(E.architecture):void 0,labels:E.labels&&typeof E.labels==="object"?E.labels:{}})})}catch(N){return w(N,422)}}if(B.pathname==="/api/capacity/action"&&_.method==="POST"){let E=await X(_);try{if(E.action==="drain")return C({ok:!0,...Cm.drainPool(String(E.poolId??""))});if(E.action==="enable")return C({ok:!0,pool:Ii.updatePool(String(E.poolId??""),{status:"active"})});if(E.action==="disable")return C({ok:!0,pool:Ii.updatePool(String(E.poolId??""),{status:"disabled"})});return w("Unsupported capacity action.",422)}catch(N){return w(N,422)}}}if(B.pathname.startsWith("/api/regions")){let w=(E,N=409)=>C({ok:!1,error:E instanceof Error?E.message:String(E)},N,{"cache-control":"no-store"});if(B.pathname==="/api/regions"&&_.method==="GET")return C({ok:!0,topologies:Zi.list(y.project.id).map((E)=>({topology:E,targets:Zi.targets(E.id),channels:Zi.channels(E.id),route:Zi.route(E.id),executions:Zi.executions(E.id)}))},200,{"cache-control":"no-store"});if(B.pathname==="/api/regions"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,topology:Pm.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:y.environments.get(Se)?.id,name:String(E.name??""),hostname:String(E.hostname??""),regions:Array.isArray(E.regions)?E.regions:[],trafficPolicy:E.trafficPolicy==="weighted"||E.trafficPolicy==="latency"?E.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(E.replicate)?E.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(E.maxLagSeconds??30),retainOnDestroy:E.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:E.cdnEnabled===!0,wafEnabled:E.wafEnabled===!0})},201)}catch(N){return w(N,422)}}if(B.pathname==="/api/regions/action"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,...Pm.enqueue({topologyId:String(E.topologyId??""),kind:String(E.action??""),targetRegion:E.targetRegion?String(E.targetRegion):void 0,revision:E.revision?String(E.revision):void 0,manifest:E.manifest&&typeof E.manifest==="object"?E.manifest:{},confirmation:E.confirmation?String(E.confirmation):void 0,deleteData:E.deleteData===!0})},202)}catch(N){return w(N,422)}}}if(B.pathname.startsWith("/api/maintenance")){let w=(E,N=409)=>C({ok:!1,error:E instanceof Error?E.message:String(E)},N,{"cache-control":"no-store"});if(B.pathname==="/api/maintenance"&&_.method==="GET")return C({ok:!0,manifests:si.manifests(y.organization.id),windows:si.windows(y.project.id),campaigns:si.campaigns(y.project.id).map((E)=>({campaign:E,targets:si.targets(E.id)})),cleanups:si.cleanups(y.project.id),drills:si.drills(y.project.id)},200,{"cache-control":"no-store"});if(B.pathname==="/api/maintenance/cleanup-preview"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,plan:await Il.previewCleanup({projectId:y.project.id,kind:String(E.kind??"operations"),criteria:{olderThanDays:Number(E.olderThanDays??30)}},_m)},201)}catch(N){return w(N,422)}}if(B.pathname==="/api/maintenance/cleanup-apply"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,...Il.enqueueCleanup(String(E.planId??""),String(E.confirmation??""))},202)}catch(N){return w(N,422)}}if(B.pathname==="/api/maintenance/drill"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,drill:si.createDrill({projectId:y.project.id,scenario:String(E.scenario??"control_plane"),isolatedTarget:String(E.isolatedTarget??""),expectedRpoMinutes:Number(E.expectedRpoMinutes??60),expectedRtoMinutes:Number(E.expectedRtoMinutes??30),recoveryPointId:E.recoveryPointId?String(E.recoveryPointId):void 0,topologyId:E.topologyId?String(E.topologyId):void 0})},201)}catch(N){return w(N,422)}}if(B.pathname==="/api/maintenance/drill-run"&&_.method==="POST"){let E=await X(_);try{return C({ok:!0,...Il.enqueueDrill(String(E.drillId??""))},202)}catch(N){return w(N,422)}}}if(B.pathname.startsWith("/api/volumes")){let w=y.environments.get(Se),E=qe(ae).actor?.id,N=(j,q=409)=>C({ok:!1,error:j instanceof Error?j.message:String(j)},q,{"cache-control":"no-store"});if(B.pathname==="/api/volumes"&&_.method==="GET"){let j=wl.inventory(y.project.id,w?.id),q=y.store.listResources(y.project.id,w?.id).map((H)=>({id:H.id,name:H.name,slug:H.slug,kind:H.kind,provider:H.provider,providerId:H.providerId}));return C({ok:!0,volumes:j,resources:q,operations:Dt.list({projectId:y.project.id,limit:100}).filter((H)=>H.operation.kind.startsWith("volume.")),recoveryPoints:rr.listRecoveryPoints(y.project.id).filter((H)=>H.kind==="volume"),providers:kl.map((H)=>({provider:H.provider,type:H.type,capabilities:H.capabilities()}))},200,{"cache-control":"no-store"})}if(B.pathname==="/api/volumes"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,...oi.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:w?.id,resourceId:j.resourceId?String(j.resourceId):void 0,name:String(j.name??""),provider:String(j.provider??"docker"),type:j.type==="docker"?"docker":j.type,capacityBytes:j.capacityBytes==null?void 0:Number(j.capacityBytes),filesystem:j.filesystem?String(j.filesystem):void 0,encrypted:j.encrypted===!0,desiredState:j.desiredState&&typeof j.desiredState==="object"?j.desiredState:{},actorId:E})},202,{"cache-control":"no-store"})}catch(q){return N(q,422)}}if(B.pathname==="/api/volumes/attach"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,...oi.attach(String(j.volumeId??""),{resourceId:String(j.resourceId??""),targetPath:String(j.targetPath??""),readOnly:j.readOnly===!0,uid:j.uid==null?void 0:Number(j.uid),gid:j.gid==null?void 0:Number(j.gid),mode:j.mode?String(j.mode):void 0,propagation:j.propagation,driverOptions:j.driverOptions&&typeof j.driverOptions==="object"?j.driverOptions:{},actorId:E})},202)}catch(q){return N(q,422)}}if(B.pathname==="/api/volumes/detach"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,...oi.detach(String(j.volumeId??""),String(j.attachmentId??""),{force:j.force===!0,drained:j.drained===!0,unmounted:j.unmounted===!0,confirmation:j.confirmation?String(j.confirmation):void 0,actorId:E})},202)}catch(q){return N(q)}}if(B.pathname==="/api/volumes/resize"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,...oi.resize(String(j.volumeId??""),Number(j.capacityBytes),{drained:j.drained===!0,actorId:E})},202)}catch(q){return N(q,422)}}if(B.pathname==="/api/volumes/snapshot"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,...oi.snapshot(String(j.volumeId??""),{name:j.name?String(j.name):void 0,actorId:E})},202)}catch(q){return N(q,422)}}if(B.pathname==="/api/volumes/restore"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,...oi.restore(String(j.snapshotId??""),{name:String(j.name??""),actorId:E})},202)}catch(q){return N(q,422)}}if(B.pathname==="/api/volumes/discover"&&_.method==="POST")try{return C({ok:!0,volumes:await oi.discover({organizationId:y.organization.id,projectId:y.project.id,environmentId:w?.id,actorId:E})})}catch(j){return N(j,502)}if(B.pathname==="/api/volumes/adopt"&&_.method==="POST"){let j=await X(_);try{return C({ok:!0,volume:oi.adopt(String(j.volumeId??""),{name:String(j.name??""),actorId:E})})}catch(q){return N(q,422)}}if(B.pathname==="/api/volumes"&&_.method==="DELETE"){let j=await X(_),q=Wt.resolveSession(_);try{return C({ok:!0,...oi.delete(String(j.volumeId??""),{recentAuthAt:!Ee||q&&Pe.isRecentlyAuthenticated(q)?new Date().toISOString():void 0,confirmation:j.confirmation?String(j.confirmation):void 0,backupOverride:j.backupOverride===!0,backupOverrideConfirmation:j.backupOverrideConfirmation?String(j.backupOverrideConfirmation):void 0,actorId:E})},202)}catch(H){return N(H)}}}if(B.pathname==="/api/backups"&&_.method==="GET"){let w=y.environments.get(Se),E=rr.listPolicies(y.project.id,w?.id),N=new Set(E.map((Y)=>Y.id)),j=rr.listRecoveryPoints(y.project.id).filter((Y)=>!Y.policyId||N.has(Y.policyId)),q=rr.listJobs(y.project.id).filter((Y)=>!Y.policyId||N.has(Y.policyId)),H=(Y)=>({...Y,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!Y.credentialRef,clientEncryptionConfigured:!!Y.encryptionKeyRef}),V=await Promise.all(rr.listDestinations(y.project.id).map(async(Y)=>({...H(Y),credentialStatus:await mg(Y,ii)})));return C({ok:!0,destinations:V,policies:E,recoveryPoints:j,jobs:q,coverage:rr.coverage(y.project.id).filter((Y)=>N.has(Y.policy.id)),resources:w?y.store.listResources(y.project.id,w.id).map((Y)=>({id:Y.id,name:Y.name,slug:Y.slug,kind:Y.kind})):[]})}if(B.pathname==="/api/backups/destinations"&&_.method==="POST"){let w=await X(_),E=String(w.name??"").trim(),N=String(w.provider??""),j=String(w.encryption??"provider"),q=`secret://data-services/backups/${y.project.id}/${E}`,H=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(N))return C({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(j))return C({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let V,Y;if(w.credentials&&typeof w.credentials==="object"&&!Array.isArray(w.credentials))V=`${q}/credentials`,await ii.put(V,JSON.stringify(w.credentials)),H.push(V);if(j!=="provider"){let le=String(w.encryptionKey??"");if(le.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");Y=`${q}/encryption-key`,await ii.put(Y,le),H.push(Y)}let ge=rr.createDestination({organizationId:y.organization.id,projectId:y.project.id,name:E,provider:N,endpoint:w.endpoint?String(w.endpoint):void 0,endpointPolicy:w.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:w.bucket?String(w.bucket):void 0,prefix:String(w.prefix??""),region:w.region?String(w.region):ki,forcePathStyle:w.forcePathStyle===!0,credentialRef:V,encryption:j,encryptionKeyRef:Y,immutability:w.immutability&&typeof w.immutability==="object"&&!Array.isArray(w.immutability)?w.immutability:{},status:"untested"});return C({ok:!0,destination:{...ge,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!V,clientEncryptionConfigured:!!Y}},201)}catch(V){for(let Y of H)await ii.remove(Y).catch(()=>{});return C({ok:!1,error:V instanceof Error?V.message:String(V)},422)}}if(B.pathname==="/api/backups/destinations/test"&&_.method==="POST"){let w=await X(_),E=rr.getDestination(String(w.id??""));if(!E||E.projectId!==y.project.id)return C({ok:!1,error:"Backup destination was not found."},404);if(E.provider==="aws_backup")return C({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await Am.test(E),C({ok:!0,destination:rr.recordDestinationTest(E.id,{ok:!0})})}catch(N){let j=N instanceof Error?N.message:String(N);return rr.recordDestinationTest(E.id,{ok:!1,error:j}),C({ok:!1,error:j},502)}}if(B.pathname==="/api/backups/policies"&&_.method==="POST"){let w=await X(_),E=y.environments.get(Se),N=rr.getDestination(String(w.destinationId??"")),j=String(w.resourceKind??""),q=w.dataServiceId?String(w.dataServiceId):void 0,H=q?zt.get(q):void 0,V=w.resourceId?String(w.resourceId):void 0,Y=V?y.store.getResource(V):void 0;if(!E)return C({ok:!1,error:"Environment was not found."},404);if(!N||N.projectId!==y.project.id)return C({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(j))return C({ok:!1,error:"A supported backup resource kind is required."},422);if(q&&(!H||H.projectId!==y.project.id||H.environmentId!==E.id))return C({ok:!1,error:"Data service was not found in this environment."},404);if(V&&(!Y||Y.projectId!==y.project.id||Y.environmentId!==E.id))return C({ok:!1,error:"Resource was not found in this environment."},404);if(j==="managed_database"&&!H)return C({ok:!1,error:"Managed database policies require a data service."},422);if(j==="logical_database"&&(!H||!["container","server"].includes(H.provider)))return C({ok:!1,error:"Logical database policies require an on-box data service."},422);if(j==="volume"&&(!Y||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(w.volumeName??""))))return C({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let ge=Array.isArray(w.includePatterns)?w.includePatterns.map(String).filter(Boolean):[];if(j==="files"&&(!Y||!ge.length))return C({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(j==="control_plane"&&N.encryption==="provider")return C({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(j==="infrastructure"&&(N.provider!=="aws_backup"||!ge.some((le)=>le.startsWith("resource:arn:"))||!ge.some((le)=>le.startsWith("role:arn:"))))return C({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let le=rr.createPolicy({organizationId:y.organization.id,projectId:y.project.id,environmentId:E.id,resourceId:V,dataServiceId:q,destinationId:N.id,name:String(w.name??"").trim(),resourceKind:j,schedule:String(w.schedule??"daily"),timezone:String(w.timezone??"UTC"),retention:w.retention&&typeof w.retention==="object"&&!Array.isArray(w.retention)?w.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(w.compression))?w.compression:"gzip",encryption:["destination","client_side","both"].includes(String(w.encryption))?w.encryption:"destination",includePatterns:j==="volume"?[String(w.volumeName),...ge]:ge,excludePatterns:Array.isArray(w.excludePatterns)?w.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(w.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(w.expectedRtoMinutes)||120),healthCheckId:w.healthCheckId?String(w.healthCheckId):void 0,enabled:w.enabled!==!1});return C({ok:!0,policy:le},201)}catch(le){return C({ok:!1,error:le instanceof Error?le.message:String(le)},422)}}if(B.pathname==="/api/backups/run"&&_.method==="POST"){let w=await X(_),E=rr.getPolicy(String(w.policyId??"")),N=y.environments.get(Se);if(!E||E.projectId!==y.project.id||E.environmentId!==N?.id)return C({ok:!1,error:"Backup policy was not found in this environment."},404);try{let j=Yi.enqueueBackup(E,new Date().toISOString(),qe(ae).actor?.id);return C({ok:!0,job:j},202)}catch(j){return C({ok:!1,error:j instanceof Error?j.message:String(j)},409)}}if(B.pathname==="/api/backups/verify"&&_.method==="POST"){let w=await X(_),E=rr.getRecoveryPoint(String(w.recoveryPointId??""));if(!E||E.projectId!==y.project.id)return C({ok:!1,error:"Recovery point was not found."},404);return C({ok:!0,job:Yi.enqueueVerification(E)},202)}if(B.pathname==="/api/backups/restore"&&_.method==="POST"){let w=await X(_),E=rr.getRecoveryPoint(String(w.recoveryPointId??"")),N=w.mode==="in_place"?"in_place":"isolated",j=w.target&&typeof w.target==="object"&&!Array.isArray(w.target)?{...w.target,inPlace:N==="in_place"}:{inPlace:N==="in_place"},q=Wt.resolveSession(_),H={mode:N,target:j,targetName:String(w.targetName??""),confirm:w.confirm?String(w.confirm):void 0,recentAuth:!Ee||!!q&&Pe.isRecentlyAuthenticated(q),downtimeAcknowledged:w.downtimeAcknowledged===!0,safetyBackupId:w.safetyBackupId?String(w.safetyBackupId):void 0};if(!E||E.projectId!==y.project.id)return C({ok:!1,error:"Recovery point was not found."},404);if(w.drill===!0&&N!=="isolated")return C({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let V=Yi.planRestore(E,H);if(w.execute!==!0)return C({ok:!0,plan:V,executionCreated:!1});let Y=Yi.enqueueRestore(E,{...H,drill:w.drill===!0,actorId:qe(ae).actor?.id});return C({ok:!0,plan:V,job:Y},202)}catch(V){return C({ok:!1,error:V instanceof Error?V.message:String(V)},409)}}if(B.pathname==="/api/backups/recovery-points"&&_.method==="POST"){let w=await X(_),E=rr.getRecoveryPoint(String(w.id??""));if(!E||E.projectId!==y.project.id)return C({ok:!1,error:"Recovery point was not found."},404);if(w.held==null&&w.pinned==null)return C({ok:!1,error:"held or pinned must be provided."},422);return C({ok:!0,recoveryPoint:rr.updateRecoveryPoint(E.id,{held:w.held==null?E.held:w.held===!0,pinned:w.pinned==null?E.pinned:w.pinned===!0})})}if(B.pathname==="/api/backups/retention"&&_.method==="POST")return C({ok:!0,jobs:Yi.enqueueRetention()},202);if(B.pathname==="/api/data-services/capabilities"&&_.method==="GET"){let w=String(B.searchParams.get("engine")??""),E=String(B.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(w)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(E))return C({ok:!1,error:"A supported engine and provider are required."},422);return C({ok:!0,engine:w,provider:E,capabilities:wn(w,E)})}if(B.pathname==="/api/data-services"&&_.method==="GET"){let w=y.environments.get(Se),E=zt.list(y.project.id,w?.id).map((N)=>{let j=zt.credential(N.id);return{...N,credentialRef:void 0,credential:j?{configured:!0,username:j.username,version:j.version,rotatedAt:j.rotatedAt}:void 0,dependencies:zt.dependencies(N.id).map((q)=>({resourceId:q.resourceId,requiresRedeploy:q.requiresRedeploy}))}});return C({ok:!0,services:E})}if(B.pathname==="/api/data-services/preview"&&_.method==="POST"){let w=await X(_);if(w.id){let j=zt.get(String(w.id)),q=y.environments.get(Se),H=String(w.action??"");if(!j||j.projectId!==y.project.id||j.environmentId!==q?.id)return C({ok:!1,error:"Data service was not found in this environment."},404);if(!yl.includes(H))return C({ok:!1,error:`Action must be one of: ${yl.join(", ")}.`},422);try{return C({ok:!0,plan:Ec.plan(j,H,w.changes??{})})}catch(V){return C({ok:!1,error:V instanceof Error?V.message:String(V)},422)}}let E=String(w.engine??""),N=String(w.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(E)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(N))return C({ok:!1,error:"A supported engine and provider are required."},422);return C({ok:!0,capabilities:wn(E,N),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(B.pathname==="/api/data-services"&&_.method==="POST"){let w=await X(_),E=String(w.engine??""),N=String(w.provider??""),j=y.environments.get(Se),q=qe(ae);if(!j)return C({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(E)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(N))return C({ok:!1,error:"A supported engine and provider are required."},422);let H={organizationId:y.organization.id,projectId:y.project.id,environmentId:j.id,resourceId:w.resourceId?String(w.resourceId):void 0,name:String(w.name??"").trim(),engine:E,provider:N,placement:String(w.placement??w.name??"").trim(),engineVersion:w.engineVersion?String(w.engineVersion):void 0,plan:String(w.plan??(N==="aws_elasticache"?"cache.t4g.micro":N==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:w.storageGb==null?void 0:Number(w.storageGb),highAvailability:w.highAvailability===!0,publicExposure:w.publicExposure===!0,allowedCidrs:Array.isArray(w.allowedCidrs)?w.allowedCidrs.map(String):[],desiredState:w.desiredState&&typeof w.desiredState==="object"&&!Array.isArray(w.desiredState)?w.desiredState:{},observedState:{},origin:w.adopt===!0?"adopted":"managed",managementEnabled:w.adopt!==!0,ownerActorId:q.actor?.id,username:w.username?String(w.username):void 0};try{if(w.adopt===!0){let Y=zt.create({...H,status:"adopted",credentialRef:void 0});return C({ok:!0,service:Y,readOnly:!0},201)}if(!Rm({provider:N,engine:E}))return C({ok:!1,error:`No ${N}/${E} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let V=await Ec.create(H);return C({ok:!0,service:V.service,operationId:V.operationId,oneTimeCredential:V.credential},201)}catch(V){return C({ok:!1,error:V instanceof Error?V.message:String(V)},422)}}if(B.pathname==="/api/data-services/connections"&&_.method==="GET"){let w=zt.get(String(B.searchParams.get("id")??"")),E=y.environments.get(Se);if(!w||w.projectId!==y.project.id||w.environmentId!==E?.id)return C({ok:!1,error:"Data service was not found in this environment."},404);let N=typeof w.observedState.endpoint==="string"?w.observedState.endpoint:void 0,j=typeof w.observedState.readerEndpoint==="string"?w.observedState.readerEndpoint:void 0,q=Number(w.observedState.port)||(w.engine==="postgres"?5432:w.engine==="redis"?6379:w.engine==="mongodb"?27017:w.engine==="libsql"?8080:3306),H=typeof w.observedState.database==="string"?w.observedState.database:void 0,V=typeof w.observedState.tls==="boolean"?w.observedState.tls:w.provider.startsWith("aws_"),Y=[...N?[{type:w.publicExposure?"external":"internal",host:N,port:q,database:H,tls:V}]:[],...j?[{type:"internal",host:j,port:q,database:H,tls:V}]:[],{type:"tunnel",host:N??w.placement,port:q,database:H,tls:V}];return C({ok:!0,serviceId:w.id,guidance:Fu(w,Y)})}if(B.pathname==="/api/data-services/action"&&_.method==="POST"){let w=await X(_),E=zt.get(String(w.id??"")),N=y.environments.get(Se),j=String(w.action??"");if(!E||E.projectId!==y.project.id||E.environmentId!==N?.id)return C({ok:!1,error:"Data service was not found in this environment."},404);if(!yl.includes(j))return C({ok:!1,error:`Action must be one of: ${yl.join(", ")}.`},422);let q=w.changes&&typeof w.changes==="object"&&!Array.isArray(w.changes)?w.changes:{};try{let H=Ec.plan(E,j,q);if(w.execute!==!0)return C({ok:!0,plan:H,productionExecutionCreated:!1});let V=Ec.enqueue(E,j,q,qe(ae).actor?.id);return C({ok:!0,plan:H,operationId:V},202)}catch(H){return C({ok:!1,error:H instanceof Error?H.message:String(H)},409)}}if(B.pathname==="/api/data-services/dependencies"&&_.method==="POST"){let w=await X(_),E=zt.get(String(w.id??"")),N=y.environments.get(Se),j=y.store.getResource(String(w.resourceId??""));if(!E||E.projectId!==y.project.id||E.environmentId!==N?.id)return C({ok:!1,error:"Data service was not found in this environment."},404);if(!j||j.projectId!==y.project.id||j.environmentId!==N?.id)return C({ok:!1,error:"Dependent resource was not found in this environment."},404);if(w.remove===!0)return C({ok:zt.removeDependency(E.id,j.id)});return zt.addDependency({serviceId:E.id,resourceId:j.id,secretRef:E.credentialRef??`secret://data-services/${E.projectId}/${E.name}`,requiresRedeploy:w.requiresRedeploy!==!1}),C({ok:!0,dependencies:zt.dependencies(E.id).map((q)=>({resourceId:q.resourceId,requiresRedeploy:q.requiresRedeploy}))})}if(B.pathname==="/api/data-services/management"&&_.method==="POST"){let w=await X(_),E=zt.get(String(w.id??"")),N=y.environments.get(Se);if(!E||E.projectId!==y.project.id||E.environmentId!==N?.id)return C({ok:!1,error:"Data service was not found in this environment."},404);if(E.origin!=="adopted"||w.reviewed!==!0||w.confirm!==E.name)return C({ok:!1,error:`Enabling management requires reviewed=true and typing ${E.name}.`},409);return C({ok:!0,service:zt.update(E.id,E.version,{managementEnabled:!0})})}if(B.pathname==="/api/data-services/reveal"&&_.method==="POST"){let w=await X(_),E=zt.get(String(w.id??"")),N=y.environments.get(Se),j=E?zt.credential(E.id):void 0;if(!E||E.projectId!==y.project.id||E.environmentId!==N?.id)return C({ok:!1,error:"Data service was not found in this environment."},404);if(!j)return C({ok:!1,error:"No managed credential is configured."},404);return C({ok:!0,credential:{username:j.username,password:await ii.resolve(j.secretRef),version:j.version}},200,{"cache-control":"no-store"})}if(B.pathname==="/api/databases"&&_.method==="GET")return C(await vb(f,Se));if(B.pathname==="/api/databases"&&_.method==="POST"){let w=await X(_),E=String(w.name??"").trim();if(!bi(E))return C({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return C({...await bb(f,Se,E),name:E})}if(B.pathname==="/api/databases/vitess"&&_.method==="GET"){let w=await Ib(f,Se);return C({...w,unhealthy:Eb(w.tablets),missingPrimary:Rb(w)})}if(B.pathname==="/api/databases/vitess/provision"&&_.method==="POST"){let w=await X(_);try{return C(await $b(f,Se,{keyspace:String(w.keyspace??""),username:String(w.username??""),password:String(w.password??""),sharded:w.sharded===!0,confirm:String(w.confirm??"")}))}catch(E){return C({ok:!1,error:E instanceof Error?E.message:String(E)},422)}}if(B.pathname==="/api/databases/vitess/migrations"&&_.method==="GET"){let w=B.searchParams.get("keyspace")??void 0;return C(await Db(f,Se,w))}if(B.pathname==="/api/databases/vitess/migrations/action"&&_.method==="POST"){let w=await X(_),E=String(w.uuid??"").trim(),N=String(w.action??"");if(!["retry","cancel","cleanup","complete"].includes(N))return C({ok:!1,error:"Unknown migration action."},422);return C(await Ob(f,Se,E,N))}if(B.pathname==="/api/databases/vitess/keyspaces"&&_.method==="POST"){let w=await X(_),E=String(w.name??"").trim(),N=w.sharded===!0;return C(await _b(f,Se,E,{sharded:N}))}if(B.pathname==="/api/databases/vitess/vschema"&&_.method==="POST"){let w=await X(_),E=String(w.keyspace??"").trim(),N=typeof w.vschema==="string"?w.vschema:JSON.stringify(w.vschema??null);return C(await Tb(f,Se,E,N))}if(B.pathname==="/api/databases/vitess/schema"&&_.method==="POST"){let w=await X(_),E=String(w.sql??"");return C(await xb(f,Se,E))}if(B.pathname==="/api/databases/vitess/install-client"&&_.method==="POST")return C(await Pb(f,Se));if(B.pathname==="/api/databases/backups"&&_.method==="GET")return C(await kb(f,Se));if(B.pathname==="/api/databases/backup"&&_.method==="POST"){let w=await X(_),E=String(w.database??"").trim();if(!bi(E))return C({ok:!1,error:"Database name must be a valid identifier."},422);if(w.confirm!==E)return C({ok:!1,error:`Type "${E}" to back up this database.`},409);return C(await wb(f,Se,E))}if(B.pathname==="/api/databases/users"&&_.method==="POST"){let w=await X(_),E=String(w.username??"").trim(),N=String(w.password??""),j=String(w.database??"").trim()||void 0,q=w.access==="readonly"?"readonly":"all";if(!bi(E))return C({ok:!1,error:"Username must be a valid identifier."},422);if(!N)return C({ok:!1,error:"Password is required."},422);if(j&&!bi(j))return C({ok:!1,error:"Database must be a valid identifier."},422);return C({...await Sb(f,Se,{username:E,password:N,database:j,access:q}),username:E})}if(B.pathname==="/api/dashboard-data")return qt=M.get(Se)??await ye(Se),ye(Se),C(um(qt,{user:gn,slug:f.project.slug}));if(B.pathname==="/api/users"&&_.method==="GET")return C({ok:!0,users:en(t).map(js)});if(B.pathname==="/api/users"&&_.method==="POST"){let w=await X(_),E=String(w.username??"").trim();if(!il(E))return C({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let N=w.sites&&typeof w.sites==="object"?w.sites:{},j=new Set(Object.keys(f.sites??{})),q={};for(let[Y,ge]of Object.entries(N)){if(!j.has(Y))return C({ok:!1,error:`Site '${Y}' was not found.`},404);if(ge!=="owner"&&ge!=="collaborator")return C({ok:!1,error:`Unknown site role '${ge}'. Use 'owner' or 'collaborator'.`},422);q[Y]=ge}let H=typeof w.password==="string"&&w.password.trim()?w.password.trim():void 0;if(H&&H.length<12)return C({ok:!1,error:"Password must be at least 12 characters."},422);let V=yc(t,{username:E,password:H,name:typeof w.name==="string"?w.name:void 0,sites:q});return Cs(y,en(t)),Ze(),C({ok:!0,user:js(V.user),password:V.password})}if(B.pathname==="/api/users"&&_.method==="DELETE"){let w=await X(_),E=String(w.username??"").trim();if(E.toLowerCase()===ae.username.toLowerCase())return C({ok:!1,error:"You cannot remove your own account."},409);let N=Fn(en(t),E),j=N?y.store.getActorByExternalId("user",`dashboard:${N.username.toLowerCase()}`):void 0,q=j?y.store.getMembershipForActor(y.organization.id,j.id):void 0;if(q&&q.source!=="legacy")return C({ok:!1,error:"Organization members must be removed from Organization access."},409);let H=cm(t,E);if(!H.ok)return C(H,409);return Cs(y,en(t)),ee.clear(),C({ok:!0,username:E})}if(B.pathname==="/api/actions/run"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=w.action?Rs(w.action,Se):void 0;if(!E)return C({ok:!1,error:"Unknown dashboard action."},404);if(E.mutates&&w.confirm!==E.confirm)return C({ok:!1,error:`Type "${E.confirm}" to run this action.`},409);let N=await Me({controlPlane:y,environment:Se,actor:ae,kind:`dashboard.action.${E.id}`,input:{action:E.id},execute:()=>km(E,{cwd:t,cliEntry:g})});return C({...N.result,controlPlaneOperation:N.operation})}if(B.pathname==="/api/server/operations/run"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=w.operation?lm(w.operation,f,qt):void 0;if(!E)return C({ok:!1,error:"Unknown or unavailable server operation."},404);if(E.mutates&&w.confirm!==E.confirm)return C({ok:!1,error:`Type "${E.confirm}" to run this operation.`},409);let N=pe(y,String(Se));await new Lt(it).run(new vn,{...N,artifactRoot:t});let j=hs(it,{scope:N,desiredConfigHash:y.project.desiredConfigHash});if(j.decision.outcome==="block")return C({ok:!1,error:`Operation blocked by security policy: ${j.decision.explanation}`,securityReview:j},409);let q=await Me({controlPlane:y,environment:Se,actor:ae,kind:`dashboard.server.${E.id}`,resourceSlug:E.target,input:{operation:E.id,target:E.target,to:w.to??null},execute:()=>ll(f,Se,E,{to:w.to})});return C({...q.result,controlPlaneOperation:q.operation,securityReview:j})}if(B.pathname==="/api/server/command"&&_.method==="POST"){let w=await _.json().catch(()=>({}));if(w.confirm!=="run")return C({ok:!1,error:'Type "run" to execute this command on the server.'},409);let E=await Me({controlPlane:y,environment:Se,actor:ae,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>vc(f,Se,String(w.command??""))});return C({...E.result,controlPlaneOperation:E.operation})}if(B.pathname==="/api/serverless/operations")return C(hm(f,Se,qt));if(B.pathname==="/api/serverless/operations/run"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=w.operation?gS(w.operation,f,Se,qt):void 0;if(!E)return C({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(E.mutates&&w.confirm!==E.confirm)return C({ok:!1,error:`Type "${E.confirm}" to run this operation.`},409);let N=await Me({controlPlane:y,environment:Se,actor:ae,kind:`dashboard.serverless.${E.id}`,input:{operation:E.id,min:w.min??null,max:w.max??null},execute:()=>mS(f,Se,E,{min:w.min,max:w.max})});return qt=await Ro(f,Se),M.set(Se,qt),C({...N.result,controlPlaneOperation:N.operation})}if(B.pathname==="/api/serverless/command"&&_.method==="POST"){let w=await _.json().catch(()=>({}));if(w.confirm!=="run")return C({ok:!1,error:'Type "run" to execute this command.'},409);return C(await fS(f,Se,String(w.command??"")))}if(B.pathname==="/api/serverless/dlq"&&_.method==="GET"){let w=Number(B.searchParams.get("max"))||10;return C(await hS(f,Se,w))}if(B.pathname==="/api/serverless/dlq/redrive"&&_.method==="POST"){let w=await _.json().catch(()=>({}));if(w.confirm!=="redrive")return C({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return C(await yS(f,Se,{max:w.max,targetQueue:w.targetQueue}))}if(B.pathname==="/api/serverless/dlq/purge"&&_.method==="POST"){if((await _.json().catch(()=>({}))).confirm!=="purge")return C({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return C(await vS(f,Se))}if(B.pathname==="/api/serverless/secrets"&&_.method==="GET")return C({secrets:bS(f,Se)});if(B.pathname==="/api/serverless/secrets"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=String(w.secretId??"").trim();if(!E)return C({ok:!1,error:"A secret id is required."},422);if(typeof w.value!=="string"||w.value==="")return C({ok:!1,error:"A non-empty value is required."},422);return C(await SS(f,Se,E,w.value))}if(B.pathname==="/api/serverless/secrets"&&_.method==="DELETE"){let w=await _.json().catch(()=>({})),E=String(w.secretId??"").trim();if(!E)return C({ok:!1,error:"A secret id is required."},422);if(w.confirm!==E)return C({ok:!1,error:`Type "${E}" to delete this secret.`},409);return C(await wS(f,Se,E))}if(B.pathname==="/api/serverless/functions/config"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=String(w.mode??"").trim();if(w.confirm!==E)return C({ok:!1,error:`Type "${E}" to update this function.`},409);return C(await kS(f,Se,E,{memory:w.memory,timeout:w.timeout}))}if(B.pathname==="/api/serverless/alarms"&&_.method==="GET")return C(await IS(f,Se));if(B.pathname==="/api/serverless/alarms"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=String(w.preset??"").trim(),N=Number(w.threshold);if(!E)return C({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(N))return C({ok:!1,error:"A numeric threshold is required."},422);return C(await ES(f,Se,E,N))}if(B.pathname==="/api/serverless/alarms"&&_.method==="DELETE"){let w=await _.json().catch(()=>({})),E=String(w.name??"").trim();if(!E)return C({ok:!1,error:"An alarm name is required."},422);if(w.confirm!==E)return C({ok:!1,error:`Type "${E}" to delete this alarm.`},409);return C(await RS(f,Se,E))}if(B.pathname==="/api/serverless/traces"&&_.method==="GET"){let w=Number(B.searchParams.get("minutes"))||30;return C(await pl(f,Se,w))}if(B.pathname==="/api/serverless/scheduler"&&_.method==="POST"){let w=await _.json().catch(()=>({})),E=String(w.action??"").trim();if(E!=="enable"&&E!=="disable"&&E!=="run")return C({ok:!1,error:"Unknown scheduler action."},422);if(w.confirm!==E)return C({ok:!1,error:`Type "${E}" to ${E} the scheduler.`},409);return C(await bm(f,Se,E))}if(!iw(B.pathname,gn))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(Se)}`}});let Oo=await Bt(ae,Se);if(!Oo)return bl("ts-cloud dashboard UI is unavailable.",503);return ow(Oo,B.pathname)}catch(eo){if(e.verbose)console.error(eo);return C({ok:!1,error:eo?.message??String(eo)},500)}})();if(!er)return er;if(bt&&(B.pathname.startsWith("/api/")||B.pathname.startsWith("/auth/"))){let tt;if((Oe.headers.get("content-type")||"").includes("application/json"))tt=await Oe.json().catch(()=>{return});let _r=Wt.resolveUser(_),mr=_r?qe(_r).actor:void 0;y.store.appendEvent({organizationId:y.organization.id,projectId:y.project.id,actorId:mr?.id,correlationId:Ge,type:er.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:er.status<400?"info":"warning",payload:Q_(_.method,B.pathname,tt,er.status,Date.now()-Ue)})}return er.headers.set("x-request-id",Ge),er}});Rc?.start();let Sw=e.spendLoop??!0,Um;if(Sw)(async()=>{let{SpendRunner:_,SpendLoopLease:Ne,startSpendLoop:Ue}=await import("./spend/index.js"),{store:Oe}=await aw(y.store),Ge=new _({controlPlane:y.store,store:Oe,alerts:et});Um=Ue(Ge,{lease:new Ne(y.store,{owner:`dashboard:${process.pid}`}),onError:(bt)=>console.error(`[ts-cloud] spend cycle failed: ${bt instanceof Error?bt.message:String(bt)}`)})})();let ww=xo.stop.bind(xo);return xo.stop=(_)=>{clearInterval(Mm),clearInterval(Lm),clearInterval(Fm),clearInterval(Bm),clearInterval(jm),clearInterval(Dm),clearInterval(Om),clearInterval($m),clearInterval(Nm),Ze(),or.clear(),Rc?.stop(),Um?.();let Ne=ww(_);if(Rc)Rc.settled().finally(()=>y.store.close());else y.store.close();return Ne},{server:xo,url:`http://${r}:${xo.port}/`}}export{da,qf,nu,LS,cs,iu,la,jf,zf,yn,ua,su,ot,ou,au,cu,ds,Sn,Kf,at,du,ga,pa,ma,lu,uu,gu,ls,fa,pu,In,us,ha,_t,Wf,mu,fu,Jf,hu,Aa,yr,Au,yu,Su,Iu,ct,Xf,bu,Sr,ya,Sa,Ia,gs,ps,bn,Cu,ms,ba,Ca,Cn,Eu,En,Yf,Zf,Lt,vn,Ea,eh,vu,Tu,va,wu,Ru,Du,$S,pe,Pu,MS,FS,fs,hs,US,ve,th,$t,Le,$e,Mt,ku,Nu,Bu,xu,rh,nh,Ta,ih,sh,wa,Ou,_u,oh,me,ah,Lu,Te,Ra,dt,Ft,Ut,Tn,As,$u,QS,ch,dh,lh,uh,Da,Pa,Mu,ka,wn,Na,Fu,ys,Uu,Ba,xa,Oa,_a,La,$a,Ma,Fa,Qu,Ir,Ua,Hu,Rn,Gu,Qa,Ha,Vu,br,Ga,Va,gh,HS,Ss,GS,VS,qS,qa,ja,qu,ph,za,Dn,ju,Is,zu,Ku,Wu,Ka,mh,Wa,Ju,fh,Ja,hh,Pn,kn,Xu,bs,Yu,Zu,eg,Xa,tg,rg,Ah,ng,v,ig,Cs,Me,sg,og,jS,ag,cg,dg,lg,ug,yh,zS,KS,WS,Sh,Ih,JS,XS,bh,Ch,YS,Es,Cr,Ya,Nn,Bn,Er,lt,Qt,vs,Eh,xn,gg,pg,Za,vh,ec,Th,wh,mg,tc,Ts,fg,rc,Ht,Fe,hg,nc,ic,Ag,sc,oc,ac,cc,yg,Sg,On,dc,lc,uc,gc,Ig,ws,_n,Rs,pc};