@stacksjs/ts-cloud 0.16.90 → 0.16.92

package/dist/bin/cli.js

@@ -1,34 +1,34 @@
 #!/usr/bin/env bun
-import{C,Kt,n,r,a,_r,e,u,i,s,P,d,Ko,c,vn,Ee,ia,oa,sa,aa,f}from"./chunk-qpasspad.js";import{ga,H,Fr,w,U,Qo,l,o,T,ha,ya,ba,$e,He,st,Zo,An,ji,Rn,es,Ta,Ea,wa,Aa,Ia,j,b,M,at,N,ye,rs,qe,Yt,Vi,Ie,ns,zi,Zt,Nt,Pa,Da}from"./chunk-9bmaq8q7.js";import"./chunk-8rkfwgb4.js";import{Me,_,$n,y,Ln,Zi,Mn,us,qr,lt,xe,Un,Bn,jn,Vn,zn,Hn,Gn,qn,se,sr,ar,Wn,Wr,Kn,Jn,Xn,Qn,Yn,Zn,ei,ti,dt,cr,lr,$t,Kr,dr,ur,eo,Lt,ri,ue,ni,ii,oi,Jr,Xr,si,Qr,pr,mr,ut,Mt,Ut,Yr,pe,ai,gc,fc,gr,hc,G,to,We,pt,mt,ci,Zr,li,en,di,ui,tn,ps,me,ve,Ue,Ce,pi,fr}from"./chunk-52snxrsx.js";import{p,la}from"./chunk-btrxye8p.js";import{le,h,Br}from"./chunk-xycxw00z.js";import{Or,Pt,$r,Lr,Mr,Ur,Cn}from"./chunk-ndvma07s.js";import{S,Bt,mi,gs,hr,yc,bc,Sc,gi,fi,rn,Ft,nn,gt,ft,Ke,Fe,Je,ht,yr,je,Xe,hi,yi,Qe,on,sn,io,so,vr,jt,yt,Vt,ee,uo,vi,Ci,Rs}from"./chunk-v1a0b9yq.js";import{ot,Gt,Dr,Qs,Ys,kr,he,Mi,Nr,Lo,Mo,Uo,Bo,Fo,jo,K,qt,B,Ui}from"./chunk-qmwqntnx.js";import{W,A,Io,Fs,js,Wc,Kc,gn,wt,_i}from"./chunk-88s5w4yt.js";import{v}from"./chunk-yf2drw7r.js";import{Q}from"./chunk-cgyk48s5.js";import{It,g}from"./chunk-1wgyq50e.js";import{Ze,Ns,te,mo,Ei,go,fo,cn,ho,yo,Te,re,et,_e,ln,St,Oe,Cr,dn,tt,rt,Tr,un,wi,Ai,ge,vt,Ri,wr,Ar,Rr,pn,Ir,O,So,vo,zc,Co,xs,_s,Os,$s,Ct,Ls,To,Eo,wo}from"./chunk-dkdgwm13.js";import"./chunk-4mep3m41.js";import{D}from"./chunk-19mhwmfp.js";import{fe}from"./chunk-zfn3a9sx.js";import{J,Rt,qo}from"./chunk-76ekkat8.js";import{ce,q,jc,Vc,Ye}from"./chunk-v3trt4q1.js";import{ir,_n,or,Qi,On,ds}from"./chunk-w40r35vn.js";import"./chunk-ye2gymsr.js";import{E}from"./chunk-jqs2ywj2.js";import{bt}from"./chunk-t0r1rdj2.js";import{ne,we}from"./chunk-bxks81wn.js";import{V}from"./chunk-89v3ec9n.js";import"./chunk-zn9wmqd1.js";import"./chunk-35325988.js";import{Yi}from"./chunk-f7jzs1h1.js";import"./chunk-0e56zmps.js";import"./chunk-bycbwddj.js";import{Di}from"./chunk-83tt2t15.js";import{Pr}from"./chunk-b1cb27m8.js";import{At}from"./chunk-z9g7fa1w.js";import{F}from"./chunk-69mejej3.js";import{x}from"./chunk-bkx2kapc.js";import{existsSync as _u}from"node:fs";import Oa from"node:fs/promises";import Vl from"node:os";import La from"node:path";import Xi from"node:process";import{EventEmitter as Mu}from"node:events";import Li from"node:process";import ql from"node:process";import Ba from"node:process";import Ts from"node:process";import Jo from"node:process";import Jl from"node:tty";import Pm,{stdin as sy,stdout as ay}from"node:process";class Yl{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let R=Vl.homedir(),t=La.join(R,".config","clapp");this.configPath=La.join(t,"telemetry.json")}async isEnabled(){if(Xi.env.DO_NOT_TRACK==="1"||Xi.env.DO_NOT_TRACK==="true")return!1;if(Xi.env.NO_TELEMETRY==="1"||Xi.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let R=await this.loadConfig();if(R.enabled=!0,!R.userId)R.userId=this.generateUserId();await this.saveConfig(R)}async disable(){let R=await this.loadConfig();R.enabled=!1,await this.saveConfig(R)}async track(R,t){if(!await this.isEnabled())return;let k={event:R,...t,timestamp:Date.now(),platform:Vl.platform(),nodeVersion:Xi.version};if(this.events.push(k),this.events.length>=10)await this.send()}async trackCommand(R,t){await this.track("command",{command:R,duration:t})}async trackError(R,t){await this.track("error",{error:R,command:t})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let t=await this.loadConfig();return t.lastSent=Date.now(),await this.saveConfig(t),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let t=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(t),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(R){return new Promise((t)=>setTimeout(t,R))}async status(){let R=await this.loadConfig();return{enabled:R.enabled,doNotTrack:Xi.env.DO_NOT_TRACK==="1"||Xi.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:R.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(_u(this.configPath)){let R=await Oa.readFile(this.configPath,"utf-8");return this.config=JSON.parse(R),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(R){this.config=R;try{let t=La.dirname(this.configPath);await Oa.mkdir(t,{recursive:!0}),await Oa.writeFile(this.configPath,JSON.stringify(R,null,2),"utf-8")}catch{}}generateUserId(){let R=Math.random().toString(36).substring(2,15),t=Date.now().toString(36);return`${R}-${t}`}}var Gh=new Yl;function ja(R){return R.replace(/[<[].+/,"").trim()}function zu(R){let t=/<([^>]+)>/g,m=/\[([^\]]+)\]/g,k=[],I=(Y)=>{let Z=!1,X=Y[1];if(X.startsWith("..."))X=X.slice(3),Z=!0;return{required:Y[0].startsWith("<"),value:X,variadic:Z}},L;while(L=t.exec(R))k.push(I(L));let z;while(z=m.exec(R))k.push(I(z));return k}function Uu(R){let t={alias:{},boolean:[]};for(let[m,k]of R.entries()){if(k.names.length>1)t.alias[k.names[0]]=k.names.slice(1);if(k.isBoolean)if(k.negated){if(!R.some((L,z)=>z!==m&&L.names.some((Y)=>k.names.includes(Y))&&typeof L.required==="boolean"))t.boolean.push(k.names[0])}else t.boolean.push(k.names[0])}return t}function Hl(R){return R.reduce((t,m)=>t.length>=m.length?t:m,"")}function Fa(R,t){return R.length>=t?R:`${R}${" ".repeat(t-R.length)}`}function Es(R){return R.replace(/([a-z])-([a-z])/g,(t,m,k)=>m+k.toUpperCase())}function Wu(R,t,m){let k=0,I=t.length,L=R,z;for(;k<I;++k)z=L[t[k]],L=L[t[k]]=k===I-1?m:z!=null?z:!!~t[k+1].indexOf(".")||!(+t[k+1]>-1)?{}:[]}function Vu(R,t){for(let m of Object.keys(t)){let k=t[m];if(k.shouldTransform){if(R[m]=Array.prototype.concat.call([],R[m]),typeof k.transformFunction==="function")R[m]=R[m].map(k.transformFunction)}}}function qu(R){let t=/([^\\/]+)$/.exec(R);return t?t[1]:""}function Yo(R){return R.split(".").map((t,m)=>m===0?Es(t):t).join(".")}class Xo extends Error{exitCode=2;isUsageError=!0;usage;constructor(R,t){super(R);if(this.name=this.constructor.name,t!==void 0)this.usage=t;if(typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(R).stack}format(R=!1){if(R&&this.stack)return`${this.message}
+import{C,Xt,n,r,a,Or,e,u,i,s,P,d,Zo,c,Cn,we,pa,ma,ga,fa,f}from"./chunk-32dr1fym.js";import{Ta,H,Vr,w,U,rs,l,o,T,wa,Aa,Ra,Le,Ge,ct,is,Rn,zi,In,os,ka,Na,xa,_a,$a,j,b,M,lt,N,be,as,We,er,Hi,Pe,cs,Gi,tr,_t,La,Ma}from"./chunk-cb0yqrpk.js";import"./chunk-8ctmc30y.js";import{Ue,_,Mn,y,Un,io,Bn,Ss,Wr,ut,_e,jn,Vn,zn,Hn,Gn,qn,Wn,Kn,ae,ar,cr,Jn,Kr,Xn,Qn,Yn,Zn,ei,ti,ri,ni,pt,lr,dr,Mt,Jr,ur,pr,oo,Ut,ii,pe,oi,si,ai,Xr,Qr,ci,Yr,mr,gr,mt,Bt,Ft,Zr,me,li,Tc,Ec,fr,wc,G,so,Je,gt,ft,di,en,ui,tn,pi,mi,rn,vs,ge,Ce,Be,Te,gi,hr}from"./chunk-00arzt4m.js";import{p,ya}from"./chunk-0qzt0swj.js";import{J,Pt,Qo}from"./chunk-kefwtr8r.js";import{tt,Bs,re,bo,Ai,So,vo,ln,Co,To,Ee,ne,rt,Oe,dn,Ct,$e,Tr,un,nt,it,Er,pn,Ri,Ii,fe,Tt,Pi,Ar,Rr,Ir,mn,Pr,O,wo,Ao,Qc,Ro,Fs,js,Vs,zs,Et,Hs,Io,Po,Do}from"./chunk-v72zwetk.js";import{de,h,Fr}from"./chunk-42nh9ac7.js";import{$r,kt,Lr,Mr,Ur,Br,Tn}from"./chunk-pat56kbr.js";import{S,jt,fi,Ts,yr,Ac,Rc,Ic,hi,yi,nn,Vt,on,ht,yt,Xe,je,Qe,bt,br,Ve,Ye,bi,Si,Ze,sn,an,lo,po,Cr,zt,St,Ht,te,ho,Ti,Ei,Os}from"./chunk-kp84kged.js";import{F}from"./chunk-407wz1f4.js";import{at,Wt,kr,oa,sa,Nr,ye,Bi,xr,jo,Vo,zo,Ho,Go,qo,K,Kt,B,Fi}from"./chunk-1p7rtk98.js";import{W,A,xo,Ks,Js,tl,rl,fn,Rt,$i}from"./chunk-zpk7fn1s.js";import{v}from"./chunk-r1q343bm.js";import{Q}from"./chunk-fcst782q.js";import{Dt,g}from"./chunk-kbtx3q9m.js";import"./chunk-57yxbyh6.js";import{le,q,Jc,Xc,et}from"./chunk-3h7gmatb.js";import{D}from"./chunk-fmgv99xw.js";import{he}from"./chunk-j34ask5s.js";import{or,$n,sr,ro,Ln,bs}from"./chunk-p6swcv5y.js";import"./chunk-gkgqss71.js";import{E}from"./chunk-55mv5w3m.js";import{It}from"./chunk-0zepgwq9.js";import{vt}from"./chunk-kdjrcvr6.js";import{no}from"./chunk-j7j7gffr.js";import{ie,Ae}from"./chunk-chx779q9.js";import{V}from"./chunk-xk8nrvjz.js";import"./chunk-xhqfha32.js";import"./chunk-sjzzx539.js";import"./chunk-g1s5s95g.js";import"./chunk-6ty1wegm.js";import{Ni}from"./chunk-mrkrn8dk.js";import{Dr}from"./chunk-eqqqbsjm.js";import{x}from"./chunk-ncj8dpdp.js";import{existsSync as _u}from"node:fs";import Pa from"node:fs/promises";import Vl from"node:os";import Da from"node:path";import Yi from"node:process";import{EventEmitter as Mu}from"node:events";import ji from"node:process";import ql from"node:process";import Fa from"node:process";import Ps from"node:process";import Wo from"node:process";import Jl from"node:tty";import Pm,{stdin as sy,stdout as ay}from"node:process";class Yl{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let R=Vl.homedir(),t=Da.join(R,".config","clapp");this.configPath=Da.join(t,"telemetry.json")}async isEnabled(){if(Yi.env.DO_NOT_TRACK==="1"||Yi.env.DO_NOT_TRACK==="true")return!1;if(Yi.env.NO_TELEMETRY==="1"||Yi.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let R=await this.loadConfig();if(R.enabled=!0,!R.userId)R.userId=this.generateUserId();await this.saveConfig(R)}async disable(){let R=await this.loadConfig();R.enabled=!1,await this.saveConfig(R)}async track(R,t){if(!await this.isEnabled())return;let k={event:R,...t,timestamp:Date.now(),platform:Vl.platform(),nodeVersion:Yi.version};if(this.events.push(k),this.events.length>=10)await this.send()}async trackCommand(R,t){await this.track("command",{command:R,duration:t})}async trackError(R,t){await this.track("error",{error:R,command:t})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let t=await this.loadConfig();return t.lastSent=Date.now(),await this.saveConfig(t),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let t=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(t),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(R){return new Promise((t)=>setTimeout(t,R))}async status(){let R=await this.loadConfig();return{enabled:R.enabled,doNotTrack:Yi.env.DO_NOT_TRACK==="1"||Yi.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:R.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(_u(this.configPath)){let R=await Pa.readFile(this.configPath,"utf-8");return this.config=JSON.parse(R),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(R){this.config=R;try{let t=Da.dirname(this.configPath);await Pa.mkdir(t,{recursive:!0}),await Pa.writeFile(this.configPath,JSON.stringify(R,null,2),"utf-8")}catch{}}generateUserId(){let R=Math.random().toString(36).substring(2,15),t=Date.now().toString(36);return`${R}-${t}`}}var Gh=new Yl;function Oa(R){return R.replace(/[<[].+/,"").trim()}function zu(R){let t=/<([^>]+)>/g,m=/\[([^\]]+)\]/g,k=[],I=(Y)=>{let Z=!1,X=Y[1];if(X.startsWith("..."))X=X.slice(3),Z=!0;return{required:Y[0].startsWith("<"),value:X,variadic:Z}},L;while(L=t.exec(R))k.push(I(L));let z;while(z=m.exec(R))k.push(I(z));return k}function Uu(R){let t={alias:{},boolean:[]};for(let[m,k]of R.entries()){if(k.names.length>1)t.alias[k.names[0]]=k.names.slice(1);if(k.isBoolean)if(k.negated){if(!R.some((L,z)=>z!==m&&L.names.some((Y)=>k.names.includes(Y))&&typeof L.required==="boolean"))t.boolean.push(k.names[0])}else t.boolean.push(k.names[0])}return t}function Hl(R){return R.reduce((t,m)=>t.length>=m.length?t:m,"")}function Ea(R,t){return R.length>=t?R:`${R}${" ".repeat(t-R.length)}`}function Is(R){return R.replace(/([a-z])-([a-z])/g,(t,m,k)=>m+k.toUpperCase())}function Wu(R,t,m){let k=0,I=t.length,L=R,z;for(;k<I;++k)z=L[t[k]],L=L[t[k]]=k===I-1?m:z!=null?z:!!~t[k+1].indexOf(".")||!(+t[k+1]>-1)?{}:[]}function Vu(R,t){for(let m of Object.keys(t)){let k=t[m];if(k.shouldTransform){if(R[m]=Array.prototype.concat.call([],R[m]),typeof k.transformFunction==="function")R[m]=R[m].map(k.transformFunction)}}}function qu(R){let t=/([^\\/]+)$/.exec(R);return t?t[1]:""}function Ko(R){return R.split(".").map((t,m)=>m===0?Is(t):t).join(".")}class Jo extends Error{exitCode=2;isUsageError=!0;usage;constructor(R,t){super(R);if(this.name=this.constructor.name,t!==void 0)this.usage=t;if(typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(R).stack}format(R=!1){if(R&&this.stack)return`${this.message}
 
 Stack trace:
-${this.stack}`;return this.message}}function Hu(R){if(R instanceof Xo)return!0;return!!R&&typeof R==="object"&&R.name==="ClappError"&&typeof R.message==="string"}function Gu(){let{env:R}=ql,{TERM:t,TERM_PROGRAM:m}=R;if(ql.platform!=="win32")return t!=="linux";return Boolean(R.WT_SESSION)||Boolean(R.TERMINUS_SUBLIME)||R.ConEmuTask==="{cmd::Cmder}"||m==="Terminus-Sublime"||m==="vscode"||t==="xterm-256color"||t==="alacritty"||t==="rxvt-unicode"||t==="rxvt-unicode-256color"||R.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var Bs="\x1B",mn=`${Bs}[`;var Gl={to(R,t){if(!t)return`${mn}${R+1}G`;return`${mn}${t+1};${R+1}H`},move(R,t){let m="";if(R<0)m+=`${mn}${-R}D`;else if(R>0)m+=`${mn}${R}C`;if(t<0)m+=`${mn}${-t}A`;else if(t>0)m+=`${mn}${t}B`;return m},up:(R=1)=>`${mn}${R}A`,down:(R=1)=>`${mn}${R}B`,forward:(R=1)=>`${mn}${R}C`,backward:(R=1)=>`${mn}${R}D`,nextLine:(R=1)=>`${mn}E`.repeat(R),prevLine:(R=1)=>`${mn}F`.repeat(R),left:`${mn}G`,hide:`${mn}?25l`,show:`${mn}?25h`,save:`${Bs}7`,restore:`${Bs}8`};var Zh={screen:`${mn}2J`,up:(R=1)=>`${mn}1J`.repeat(R),down:(R=1)=>`${mn}J`.repeat(R),line:`${mn}2K`,lineEnd:`${mn}K`,lineStart:`${mn}1K`,lines(R){let t="";for(let m=0;m<R;m++)t+=this.line+(m<R-1?Gl.up():"");if(R)t+=Gl.left;return t}},Qh={screen:`${Bs}c`};function Ku(R,t){let m=[];for(let k=0;k<=t.length;k++)m[k]=[k];for(let k=0;k<=R.length;k++)m[0][k]=k;for(let k=1;k<=t.length;k++)for(let I=1;I<=R.length;I++)if(t.charAt(k-1)===R.charAt(I-1))m[k][I]=m[k-1][I-1];else m[k][I]=Math.min(m[k-1][I-1]+1,m[k][I-1]+1,m[k-1][I]+1);return m[t.length][R.length]}function Zl(R,t,m=2,k=3){return t.map((I)=>({cmd:I,distance:Ku(R,I)})).filter(({distance:I})=>I<=m).sort((I,L)=>I.distance-L.distance).slice(0,k).map(({cmd:I})=>I)}function Ju(R,t={}){let m={_:[]},k=t.alias||{},I=new Set(t.boolean||[]),L={};for(let Z of Object.keys(k))for(let X of k[Z])L[X]=Z;for(let Z of I)if(k[Z])for(let X of k[Z])I.add(X);function z(Z,X){if(Z===void 0)return X;if(typeof X==="boolean")return X;return Array.isArray(Z)?[...Z,X]:[Z,X]}function Y(Z,X){let ie=L[Z]||Z,oe=z(m[ie],X);if(m[ie]=oe,k[ie])for(let ae of k[ie])m[ae]=oe;if(L[Z]&&k[L[Z]])for(let ae of k[L[Z]])m[ae]=oe;m[Z]=oe}for(let Z=0;Z<R.length;Z++){let X=R[Z];if(X==="--"){m._.push(...R.slice(Z+1));break}if(X.startsWith("--")){let ie=X.indexOf("=");if(ie!==-1){let oe=Es(X.slice(2,ie)),ae=X.slice(ie+1);Y(oe,ae)}else{let oe=X.slice(2);if(oe.startsWith("no-")){let Ae=Es(oe.slice(3));Y(Ae,!1);continue}let ae=Es(oe),be=L[ae]||ae;if(I.has(be)||I.has(ae))Y(ae,!0);else{let Ae=R[Z+1];if(Ae!==void 0&&!Ae.startsWith("-"))Y(ae,Ae),Z++;else Y(ae,!0)}}}else if(X.startsWith("-")&&X.length>1){let ie=X.slice(1);for(let oe=0;oe<ie.length;oe++){let ae=ie[oe],be=L[ae]||ae;if(oe===ie.length-1&&!I.has(be)&&!I.has(ae)){let Ae=R[Z+1];if(Ae!==void 0&&!Ae.startsWith("-"))Y(ae,Ae),Z++;else Y(ae,!0)}else Y(ae,!0)}}else m._.push(X)}return m}class Ql{rawName;description;name;names;isBoolean;required;config;negated;constructor(R,t,m){if(this.rawName=R,this.description=t,this.config=Object.assign({},m),R=R.replace(/\.\*/g,""),this.negated=!1,this.names=ja(R).split(",").map((k)=>{let I=k.trim().replace(/^-{1,2}/,"");if(I.startsWith("no-"))this.negated=!0,I=I.replace(/^no-/,"");return Yo(I)}).sort((k,I)=>k.length>I.length?1:-1),this.name=this.names[this.names.length-1],this.negated&&this.config.default==null)this.config.default=!0;if(R.includes("<"))this.required=!0;else if(R.includes("["))this.required=!1;else this.isBoolean=!0}}var ey=Ba.argv,Yu=`${Ba.platform}-${Ba.arch} bun-v${typeof Bun<"u"?Bun.version:"unknown"}`,Kl=Ts.argv,Zu=`${Ts.platform}-${Ts.arch} node-${Ts.version}`;class _a{rawName;description;config;cli;options;aliasNames;name;namespace;args;commandAction;usageText;versionNumber;examples;helpCallback;globalCommand;beforeHooks;afterHooks;middleware;constructor(R,t,m,k){this.rawName=R,this.description=t,this.config=m,this.cli=k,this.options=[],this.aliasNames=[],this.name=ja(R);let I=ja(R),L=I.indexOf(":");if(L>0)this.namespace=I.substring(0,L),this.name=I.substring(L+1);if(this.args=zu(R),this.examples=[],this.beforeHooks=[],this.afterHooks=[],this.middleware=[],!m)this.config={}}usage(R){return this.usageText=R,this}allowUnknownOptions(){return this.config.allowUnknownOptions=!0,this}ignoreOptionDefaultValue(){return this.config.ignoreOptionDefaultValue=!0,this}version(R,t="-v, --version"){return this.versionNumber=R,this.option(t,"Display version number"),this}example(R){return this.examples.push(R),this}option(R,t,m){let k=new Ql(R,t,m);return this.options.push(k),this}alias(R){return this.aliasNames.push(R),this}action(R){return this.commandAction=R,this}before(R){return this.beforeHooks.push(R),this}after(R){return this.afterHooks.push(R),this}use(R){return this.middleware.push(R),this}isMatched(R){if(this.aliasNames.includes(R))return!0;if(this.namespace)return`${this.namespace}:${this.name}`===R;return this.name===R}get isDefaultCommand(){return this.name===""||this.aliasNames.includes("!")}get isGlobalCommand(){return this instanceof Ma}get displayName(){return this.namespace?`${this.namespace}:${this.name}`:this.name}hasOption(R){let t=Yo(R.split(".")[0]);return!!this.options.find((m)=>m.names.some((k)=>Yo(k)===t))}outputHelp(){let{name:R,commands:t}=this.cli,{versionNumber:m,options:k,helpCallback:I}=this.cli.globalCommand,L=[{body:`${R}${m?`/${m}`:""}`}];if(L.push({title:"Usage",body:`  $ ${R} ${this.usageText||this.rawName}`}),(this.isGlobalCommand||this.isDefaultCommand)&&t.length>0){let X=Hl(t.map((Ae)=>Ae.rawName)),ie=new Map,oe=[];for(let Ae of t)if(Ae.namespace){if(!ie.has(Ae.namespace))ie.set(Ae.namespace,[]);ie.get(Ae.namespace).push(Ae)}else oe.push(Ae);let ae="";if(oe.sort((Ae,de)=>Ae.rawName<de.rawName?-1:Ae.rawName>de.rawName?1:0),oe.length>0)ae+=oe.map((Ae)=>`  ${Fa(Ae.rawName,X.length)}  ${Ae.description}`).join(`
-`);let be=Array.from(ie.keys()).sort();for(let Ae of be){let de=ie.get(Ae);if(ae.length>0)ae+=`
+${this.stack}`;return this.message}}function Hu(R){if(R instanceof Jo)return!0;return!!R&&typeof R==="object"&&R.name==="ClappError"&&typeof R.message==="string"}function Gu(){let{env:R}=ql,{TERM:t,TERM_PROGRAM:m}=R;if(ql.platform!=="win32")return t!=="linux";return Boolean(R.WT_SESSION)||Boolean(R.TERMINUS_SUBLIME)||R.ConEmuTask==="{cmd::Cmder}"||m==="Terminus-Sublime"||m==="vscode"||t==="xterm-256color"||t==="alacritty"||t==="rxvt-unicode"||t==="rxvt-unicode-256color"||R.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var xs="\x1B",Qt=`${xs}[`;var Gl={to(R,t){if(!t)return`${Qt}${R+1}G`;return`${Qt}${t+1};${R+1}H`},move(R,t){let m="";if(R<0)m+=`${Qt}${-R}D`;else if(R>0)m+=`${Qt}${R}C`;if(t<0)m+=`${Qt}${-t}A`;else if(t>0)m+=`${Qt}${t}B`;return m},up:(R=1)=>`${Qt}${R}A`,down:(R=1)=>`${Qt}${R}B`,forward:(R=1)=>`${Qt}${R}C`,backward:(R=1)=>`${Qt}${R}D`,nextLine:(R=1)=>`${Qt}E`.repeat(R),prevLine:(R=1)=>`${Qt}F`.repeat(R),left:`${Qt}G`,hide:`${Qt}?25l`,show:`${Qt}?25h`,save:`${xs}7`,restore:`${xs}8`};var Zh={screen:`${Qt}2J`,up:(R=1)=>`${Qt}1J`.repeat(R),down:(R=1)=>`${Qt}J`.repeat(R),line:`${Qt}2K`,lineEnd:`${Qt}K`,lineStart:`${Qt}1K`,lines(R){let t="";for(let m=0;m<R;m++)t+=this.line+(m<R-1?Gl.up():"");if(R)t+=Gl.left;return t}},Qh={screen:`${xs}c`};function Ku(R,t){let m=[];for(let k=0;k<=t.length;k++)m[k]=[k];for(let k=0;k<=R.length;k++)m[0][k]=k;for(let k=1;k<=t.length;k++)for(let I=1;I<=R.length;I++)if(t.charAt(k-1)===R.charAt(I-1))m[k][I]=m[k-1][I-1];else m[k][I]=Math.min(m[k-1][I-1]+1,m[k][I-1]+1,m[k-1][I]+1);return m[t.length][R.length]}function Zl(R,t,m=2,k=3){return t.map((I)=>({cmd:I,distance:Ku(R,I)})).filter(({distance:I})=>I<=m).sort((I,L)=>I.distance-L.distance).slice(0,k).map(({cmd:I})=>I)}function Ju(R,t={}){let m={_:[]},k=t.alias||{},I=new Set(t.boolean||[]),L={};for(let Z of Object.keys(k))for(let X of k[Z])L[X]=Z;for(let Z of I)if(k[Z])for(let X of k[Z])I.add(X);function z(Z,X){if(Z===void 0)return X;if(typeof X==="boolean")return X;return Array.isArray(Z)?[...Z,X]:[Z,X]}function Y(Z,X){let ee=L[Z]||Z,oe=z(m[ee],X);if(m[ee]=oe,k[ee])for(let se of k[ee])m[se]=oe;if(L[Z]&&k[L[Z]])for(let se of k[L[Z]])m[se]=oe;m[Z]=oe}for(let Z=0;Z<R.length;Z++){let X=R[Z];if(X==="--"){m._.push(...R.slice(Z+1));break}if(X.startsWith("--")){let ee=X.indexOf("=");if(ee!==-1){let oe=Is(X.slice(2,ee)),se=X.slice(ee+1);Y(oe,se)}else{let oe=X.slice(2);if(oe.startsWith("no-")){let ke=Is(oe.slice(3));Y(ke,!1);continue}let se=Is(oe),ue=L[se]||se;if(I.has(ue)||I.has(se))Y(se,!0);else{let ke=R[Z+1];if(ke!==void 0&&!ke.startsWith("-"))Y(se,ke),Z++;else Y(se,!0)}}}else if(X.startsWith("-")&&X.length>1){let ee=X.slice(1);for(let oe=0;oe<ee.length;oe++){let se=ee[oe],ue=L[se]||se;if(oe===ee.length-1&&!I.has(ue)&&!I.has(se)){let ke=R[Z+1];if(ke!==void 0&&!ke.startsWith("-"))Y(se,ke),Z++;else Y(se,!0)}else Y(se,!0)}}else m._.push(X)}return m}class Ql{rawName;description;name;names;isBoolean;required;config;negated;constructor(R,t,m){if(this.rawName=R,this.description=t,this.config=Object.assign({},m),R=R.replace(/\.\*/g,""),this.negated=!1,this.names=Oa(R).split(",").map((k)=>{let I=k.trim().replace(/^-{1,2}/,"");if(I.startsWith("no-"))this.negated=!0,I=I.replace(/^no-/,"");return Ko(I)}).sort((k,I)=>k.length>I.length?1:-1),this.name=this.names[this.names.length-1],this.negated&&this.config.default==null)this.config.default=!0;if(R.includes("<"))this.required=!0;else if(R.includes("["))this.required=!1;else this.isBoolean=!0}}var ey=Fa.argv,Yu=`${Fa.platform}-${Fa.arch} bun-v${typeof Bun<"u"?Bun.version:"unknown"}`,Kl=Ps.argv,Zu=`${Ps.platform}-${Ps.arch} node-${Ps.version}`;class ja{rawName;description;config;cli;options;aliasNames;name;namespace;args;commandAction;usageText;versionNumber;examples;helpCallback;globalCommand;beforeHooks;afterHooks;middleware;constructor(R,t,m,k){this.rawName=R,this.description=t,this.config=m,this.cli=k,this.options=[],this.aliasNames=[],this.name=Oa(R);let I=Oa(R),L=I.indexOf(":");if(L>0)this.namespace=I.substring(0,L),this.name=I.substring(L+1);if(this.args=zu(R),this.examples=[],this.beforeHooks=[],this.afterHooks=[],this.middleware=[],!m)this.config={}}usage(R){return this.usageText=R,this}allowUnknownOptions(){return this.config.allowUnknownOptions=!0,this}ignoreOptionDefaultValue(){return this.config.ignoreOptionDefaultValue=!0,this}version(R,t="-v, --version"){return this.versionNumber=R,this.option(t,"Display version number"),this}example(R){return this.examples.push(R),this}option(R,t,m){let k=new Ql(R,t,m);return this.options.push(k),this}alias(R){return this.aliasNames.push(R),this}action(R){return this.commandAction=R,this}before(R){return this.beforeHooks.push(R),this}after(R){return this.afterHooks.push(R),this}use(R){return this.middleware.push(R),this}isMatched(R){if(this.aliasNames.includes(R))return!0;if(this.namespace)return`${this.namespace}:${this.name}`===R;return this.name===R}get isDefaultCommand(){return this.name===""||this.aliasNames.includes("!")}get isGlobalCommand(){return this instanceof Ba}get displayName(){return this.namespace?`${this.namespace}:${this.name}`:this.name}hasOption(R){let t=Ko(R.split(".")[0]);return!!this.options.find((m)=>m.names.some((k)=>Ko(k)===t))}outputHelp(){let{name:R,commands:t}=this.cli,{versionNumber:m,options:k,helpCallback:I}=this.cli.globalCommand,L=[{body:`${R}${m?`/${m}`:""}`}];if(L.push({title:"Usage",body:`  $ ${R} ${this.usageText||this.rawName}`}),(this.isGlobalCommand||this.isDefaultCommand)&&t.length>0){let X=Hl(t.map((ke)=>ke.rawName)),ee=new Map,oe=[];for(let ke of t)if(ke.namespace){if(!ee.has(ke.namespace))ee.set(ke.namespace,[]);ee.get(ke.namespace).push(ke)}else oe.push(ke);let se="";if(oe.sort((ke,ce)=>ke.rawName<ce.rawName?-1:ke.rawName>ce.rawName?1:0),oe.length>0)se+=oe.map((ke)=>`  ${Ea(ke.rawName,X.length)}  ${ke.description}`).join(`
+`);let ue=Array.from(ee.keys()).sort();for(let ke of ue){let ce=ee.get(ke);if(se.length>0)se+=`
 
-`;ae+=`  ${Ae}:
-`,ae+=de.map((ke)=>`    ${Fa(ke.rawName,X.length-2)}  ${ke.description}`).join(`
-`)}L.push({title:"Commands",body:ae}),L.push({body:`Run \`${R} <command> --help\` for command details.`})}let Y=new Set(this.options.flatMap((X)=>X.names)),Z=this.isGlobalCommand?k:[...this.options,...(k||[]).filter((X)=>!X.names.some((ie)=>Y.has(ie)))];if(!this.isGlobalCommand&&!this.isDefaultCommand)Z=Z.filter((X)=>X.name!=="version");if(Z.length>0){let X=Hl(Z.map((ie)=>ie.rawName));L.push({title:"Options",body:Z.map((ie)=>`  ${Fa(ie.rawName,X.length)}  ${ie.description} ${ie.config.default===void 0?"":`(default: ${ie.config.default})`}`).join(`
+`;se+=`  ${ke}:
+`,se+=ce.map((Se)=>`    ${Ea(Se.rawName,X.length-2)}  ${Se.description}`).join(`
+`)}L.push({title:"Commands",body:se}),L.push({body:`Run \`${R} <command> --help\` for command details.`})}let Y=new Set(this.options.flatMap((X)=>X.names)),Z=this.isGlobalCommand?k:[...this.options,...(k||[]).filter((X)=>!X.names.some((ee)=>Y.has(ee)))];if(!this.isGlobalCommand&&!this.isDefaultCommand)Z=Z.filter((X)=>X.name!=="version");if(Z.length>0){let X=Hl(Z.map((ee)=>ee.rawName));L.push({title:"Options",body:Z.map((ee)=>`  ${Ea(ee.rawName,X.length)}  ${ee.description} ${ee.config.default===void 0?"":`(default: ${ee.config.default})`}`).join(`
 `)})}if(this.examples.length>0)L.push({title:"Examples",body:this.examples.map((X)=>{if(typeof X==="function")return X(R);return X}).join(`
 `)});if(I)L=I(L)||L;console.log(L.map((X)=>X.title?`${X.title}:
 ${X.body}`:X.body).join(`
 
-`))}outputVersion(){let{name:R}=this.cli,{versionNumber:t}=this.cli.globalCommand;if(t)console.log(`${R}/${t} ${typeof Bun<"u"?Yu:Zu}`)}get usageLine(){return`$ ${this.cli.name} ${this.usageText||this.rawName}`}checkRequiredArgs(){let R=this.args.filter((t)=>t.required).length;if(this.cli.args.length<R){let m=this.args.filter((I)=>I.required).slice(this.cli.args.length),k=m.map((I)=>`<${I.value}>`).join(" ");throw new Xo(`Missing required argument${m.length>1?"s":""}: ${k}
+`))}outputVersion(){let{name:R}=this.cli,{versionNumber:t}=this.cli.globalCommand;if(t)console.log(`${R}/${t} ${typeof Bun<"u"?Yu:Zu}`)}get usageLine(){return`$ ${this.cli.name} ${this.usageText||this.rawName}`}checkRequiredArgs(){let R=this.args.filter((t)=>t.required).length;if(this.cli.args.length<R){let m=this.args.filter((I)=>I.required).slice(this.cli.args.length),k=m.map((I)=>`<${I.value}>`).join(" ");throw new Jo(`Missing required argument${m.length>1?"s":""}: ${k}
 
-Run \`${this.cli.name} ${this.rawName} --help\` for usage information.`,this.usageLine)}}checkUnknownOptions(){let{options:R,globalCommand:t}=this.cli;if(!this.config.allowUnknownOptions){for(let m of Object.keys(R))if(m!=="--"&&!this.hasOption(m)&&!t.hasOption(m)){let I=[...t.options,...this.options].flatMap((X)=>X.names),L=Yo(m.split(".")[0]),z=m.length>1?`--${m}`:`-${m}`,Y=Zl(L,I),Z=`Unknown option \`${z}\``;if(Y.length>0)Z+=`
+Run \`${this.cli.name} ${this.rawName} --help\` for usage information.`,this.usageLine)}}checkUnknownOptions(){let{options:R,globalCommand:t}=this.cli;if(!this.config.allowUnknownOptions){for(let m of Object.keys(R))if(m!=="--"&&!this.hasOption(m)&&!t.hasOption(m)){let I=[...t.options,...this.options].flatMap((X)=>X.names),L=Ko(m.split(".")[0]),z=m.length>1?`--${m}`:`-${m}`,Y=Zl(L,I),Z=`Unknown option \`${z}\``;if(Y.length>0)Z+=`
 
-Did you mean one of these?`,Y.forEach((X)=>{let ie=X.length>1?`--${X}`:`-${X}`;Z+=`
-  • ${ie}`});throw Z+=`
+Did you mean one of these?`,Y.forEach((X)=>{let ee=X.length>1?`--${X}`:`-${X}`;Z+=`
+  • ${ee}`});throw Z+=`
 
-Run \`${this.cli.name} ${this.rawName} --help\` to see available options.`,new Xo(Z,this.usageLine)}}}checkOptionValue(){let{options:R,globalCommand:t}=this.cli,m=[...t.options,...this.options];for(let k of m){let I=R[k.name.split(".")[0]];if(k.required){let L=m.some((z)=>z.negated&&z.names.includes(k.name));if(I===!0||I===!1&&!L)throw new Xo(`Option \`${k.rawName}\` requires a value.
+Run \`${this.cli.name} ${this.rawName} --help\` to see available options.`,new Jo(Z,this.usageLine)}}}checkOptionValue(){let{options:R,globalCommand:t}=this.cli,m=[...t.options,...this.options];for(let k of m){let I=R[k.name.split(".")[0]];if(k.required){let L=m.some((z)=>z.negated&&z.names.includes(k.name));if(I===!0||I===!1&&!L)throw new Jo(`Option \`${k.rawName}\` requires a value.
 
-Example: ${this.cli.name} ${this.rawName} ${k.rawName} <value>`,this.usageLine)}}}}class Ma extends _a{constructor(R){super("@@global@@","",{},R)}}var Qu=_a,Fi={red:["\x1B[31m","\x1B[39m"],green:["\x1B[32m","\x1B[39m"],blue:["\x1B[34m","\x1B[39m"],yellow:["\x1B[33m","\x1B[39m"],cyan:["\x1B[36m","\x1B[39m"],magenta:["\x1B[35m","\x1B[39m"],white:["\x1B[37m","\x1B[39m"],gray:["\x1B[90m","\x1B[39m"],bgRed:["\x1B[41m","\x1B[49m"],bgGreen:["\x1B[42m","\x1B[49m"],bgBlue:["\x1B[44m","\x1B[49m"],bgYellow:["\x1B[43m","\x1B[49m"],bgCyan:["\x1B[46m","\x1B[49m"],bgMagenta:["\x1B[45m","\x1B[49m"],bold:["\x1B[1m","\x1B[22m"],italic:["\x1B[3m","\x1B[23m"],underline:["\x1B[4m","\x1B[24m"],dim:["\x1B[2m","\x1B[22m"],inverse:["\x1B[7m","\x1B[27m"],hidden:["\x1B[8m","\x1B[28m"],strikethrough:["\x1B[9m","\x1B[29m"]};var Ho={primary:"blue",secondary:"cyan",success:"green",warning:"yellow",error:"red",info:"magenta",muted:"gray"};function Xu(){return!0}function em(){let R={};R.supportsColor=Xu();function t(k,I=[]){let L=k===""?[]:[...I,k],z=function(Z){if(!R.supportsColor)return Z;let X="",ie="";for(let oe of L)if(oe in Ho&&Ho[oe]in Fi){let ae=Ho[oe];X+=Fi[ae][0],ie=Fi[ae][1]+ie}else if(oe in Fi)X+=Fi[oe][0],ie=Fi[oe][1]+ie;return X+Z+ie},Y=[...Object.keys(Fi),...Object.keys(Ho)];for(let Z of Y)if(!(Z in z))Object.defineProperty(z,Z,{get(){return t(Z,L)}});return z}let m=[...Object.keys(Fi),...Object.keys(Ho)];for(let k of m)if(!(k in R))Object.defineProperty(R,k,{get(){return t(k)}});return R}var Go=em();class za extends Mu{name;commands;globalCommand;matchedCommand;matchedCommandName;rawArgs;args;options;showHelpOnExit;showVersionOnExit;enableDidYouMean=!0;signalHandlersSet=!1;isVerbose=!1;isQuiet=!1;isDebug=!1;isNoInteraction=!1;environment;isDryRun=!1;isForce=!1;useEmoji=!0;theme;isNoCache=!1;constructor(R=""){super();this.name=R,this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.globalCommand=new Ma(this),this.globalCommand.usage("<command> [options]")}handleSignals(R){if(this.signalHandlersSet)return this;let t=async(m)=>{if(console.log(`
+Example: ${this.cli.name} ${this.rawName} ${k.rawName} <value>`,this.usageLine)}}}}class Ba extends ja{constructor(R){super("@@global@@","",{},R)}}var Qu=ja,_i={red:["\x1B[31m","\x1B[39m"],green:["\x1B[32m","\x1B[39m"],blue:["\x1B[34m","\x1B[39m"],yellow:["\x1B[33m","\x1B[39m"],cyan:["\x1B[36m","\x1B[39m"],magenta:["\x1B[35m","\x1B[39m"],white:["\x1B[37m","\x1B[39m"],gray:["\x1B[90m","\x1B[39m"],bgRed:["\x1B[41m","\x1B[49m"],bgGreen:["\x1B[42m","\x1B[49m"],bgBlue:["\x1B[44m","\x1B[49m"],bgYellow:["\x1B[43m","\x1B[49m"],bgCyan:["\x1B[46m","\x1B[49m"],bgMagenta:["\x1B[45m","\x1B[49m"],bold:["\x1B[1m","\x1B[22m"],italic:["\x1B[3m","\x1B[23m"],underline:["\x1B[4m","\x1B[24m"],dim:["\x1B[2m","\x1B[22m"],inverse:["\x1B[7m","\x1B[27m"],hidden:["\x1B[8m","\x1B[28m"],strikethrough:["\x1B[9m","\x1B[29m"]};var Mo={primary:"blue",secondary:"cyan",success:"green",warning:"yellow",error:"red",info:"magenta",muted:"gray"};function Xu(){return!0}function em(){let R={};R.supportsColor=Xu();function t(k,I=[]){let L=k===""?[]:[...I,k],z=function(Z){if(!R.supportsColor)return Z;let X="",ee="";for(let oe of L)if(oe in Mo&&Mo[oe]in _i){let se=Mo[oe];X+=_i[se][0],ee=_i[se][1]+ee}else if(oe in _i)X+=_i[oe][0],ee=_i[oe][1]+ee;return X+Z+ee},Y=[...Object.keys(_i),...Object.keys(Mo)];for(let Z of Y)if(!(Z in z))Object.defineProperty(z,Z,{get(){return t(Z,L)}});return z}let m=[...Object.keys(_i),...Object.keys(Mo)];for(let k of m)if(!(k in R))Object.defineProperty(R,k,{get(){return t(k)}});return R}var Uo=em();class za extends Mu{name;commands;globalCommand;matchedCommand;matchedCommandName;rawArgs;args;options;showHelpOnExit;showVersionOnExit;enableDidYouMean=!0;signalHandlersSet=!1;isVerbose=!1;isQuiet=!1;isDebug=!1;isNoInteraction=!1;environment;isDryRun=!1;isForce=!1;useEmoji=!0;theme;isNoCache=!1;constructor(R=""){super();this.name=R,this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.globalCommand=new Ba(this),this.globalCommand.usage("<command> [options]")}handleSignals(R){if(this.signalHandlersSet)return this;let t=async(m)=>{if(console.log(`
 
-Received ${m}, cleaning up...`),R)try{await R()}catch(k){console.error("Error during cleanup:",k)}Li.exit(0)};return Li.on("SIGINT",()=>t("SIGINT")),Li.on("SIGTERM",()=>t("SIGTERM")),this.signalHandlersSet=!0,this}didYouMean(R=!0){return this.enableDidYouMean=R,this}verbose(){return this.globalCommand.option("-v, --verbose","Enable verbose output"),this}quiet(){return this.globalCommand.option("-q, --quiet","Suppress non-essential output"),this}debug(){return this.globalCommand.option("--debug","Enable debug mode with detailed error information"),this}noInteraction(){return this.globalCommand.option("-n, --no-interaction","Do not ask any interactive questions (for CI/CD)"),this}env(){return this.globalCommand.option("--env <environment>","Target environment (e.g., production, staging, local)"),this}dryRun(){return this.globalCommand.option("--dry-run","Preview actions without executing them"),this}force(){return this.globalCommand.option("-f, --force","Skip confirmation prompts"),this}emoji(){return this.globalCommand.option("--no-emoji","Disable emoji in output"),this}themes(){return this.globalCommand.option("--theme <theme>","Color theme (default, dracula, nord, solarized, monokai)"),this}cache(){return this.globalCommand.option("--no-cache","Disable caching"),this}usage(R){return this.globalCommand.usage(R),this}command(R,t,m){if(!m)m={};let k=new Qu(R,t||"",m,this);return k.globalCommand=this.globalCommand,this.commands.push(k),k}option(R,t,m){return this.globalCommand.option(R,t,m),this}help(R){return this.globalCommand.option("-h, --help","Display this message"),this.globalCommand.helpCallback=R,this.showHelpOnExit=!0,this}version(R,t="-v, --version"){return this.globalCommand.version(R,t),this.showVersionOnExit=!0,this}example(R){return this.globalCommand.example(R),this}outputHelp(){if(this.matchedCommand)this.matchedCommand.outputHelp();else this.globalCommand.outputHelp()}outputVersion(){this.globalCommand.outputVersion()}setParsedInfo({args:R,options:t},m,k){if(this.args=R,this.options=t,m)this.matchedCommand=m;if(k)this.matchedCommandName=k;return this}unsetMatchedCommand(){this.matchedCommand=void 0,this.matchedCommandName=void 0}showCommandNotFound(R){if(console.log(Go.red(`
+Received ${m}, cleaning up...`),R)try{await R()}catch(k){console.error("Error during cleanup:",k)}ji.exit(0)};return ji.on("SIGINT",()=>t("SIGINT")),ji.on("SIGTERM",()=>t("SIGTERM")),this.signalHandlersSet=!0,this}didYouMean(R=!0){return this.enableDidYouMean=R,this}verbose(){return this.globalCommand.option("-v, --verbose","Enable verbose output"),this}quiet(){return this.globalCommand.option("-q, --quiet","Suppress non-essential output"),this}debug(){return this.globalCommand.option("--debug","Enable debug mode with detailed error information"),this}noInteraction(){return this.globalCommand.option("-n, --no-interaction","Do not ask any interactive questions (for CI/CD)"),this}env(){return this.globalCommand.option("--env <environment>","Target environment (e.g., production, staging, local)"),this}dryRun(){return this.globalCommand.option("--dry-run","Preview actions without executing them"),this}force(){return this.globalCommand.option("-f, --force","Skip confirmation prompts"),this}emoji(){return this.globalCommand.option("--no-emoji","Disable emoji in output"),this}themes(){return this.globalCommand.option("--theme <theme>","Color theme (default, dracula, nord, solarized, monokai)"),this}cache(){return this.globalCommand.option("--no-cache","Disable caching"),this}usage(R){return this.globalCommand.usage(R),this}command(R,t,m){if(!m)m={};let k=new Qu(R,t||"",m,this);return k.globalCommand=this.globalCommand,this.commands.push(k),k}option(R,t,m){return this.globalCommand.option(R,t,m),this}help(R){return this.globalCommand.option("-h, --help","Display this message"),this.globalCommand.helpCallback=R,this.showHelpOnExit=!0,this}version(R,t="-v, --version"){return this.globalCommand.version(R,t),this.showVersionOnExit=!0,this}example(R){return this.globalCommand.example(R),this}outputHelp(){if(this.matchedCommand)this.matchedCommand.outputHelp();else this.globalCommand.outputHelp()}outputVersion(){this.globalCommand.outputVersion()}setParsedInfo({args:R,options:t},m,k){if(this.args=R,this.options=t,m)this.matchedCommand=m;if(k)this.matchedCommandName=k;return this}unsetMatchedCommand(){this.matchedCommand=void 0,this.matchedCommandName=void 0}showCommandNotFound(R){if(console.log(Uo.red(`
 ✗ Command "${R}" not found.
-`)),this.enableDidYouMean){let t=[];for(let k of this.commands){if(k.displayName)t.push(k.displayName);if(k.aliasNames)t.push(...k.aliasNames)}let m=Zl(R,t);if(m.length>0)console.log(Go.yellow("Did you mean one of these?")),m.forEach((k)=>console.log(`  ${Go.dim("•")} ${this.name} ${k}`)),console.log("")}console.log(Go.dim("Run"),`${this.name} --help`,Go.dim("to see all available commands")),Li.exit(1)}async parse(R=Kl,t={}){let{run:m=!0,exitOnError:k=!1}=t;if(k)try{return await this.parse(R,{run:m})}catch(Z){throw this.handleUsageError(Z),Z}if(this.rawArgs=R,!this.name)this.name=R[1]?qu(R[1]):"cli";let I=!0,L=R.slice(2),z=L[0];if(z&&!z.startsWith("-")){for(let Z of this.commands)if(Z.isMatched(z)){let X=this.mri(L,Z);I=!1;let ie={...X,args:X.args.slice(1)};this.setParsedInfo(ie,Z,z),this.emit(`command:${z}`,Z);break}if(I){let Z=L[1];if(Z&&!Z.startsWith("-")){let X=`${z}:${Z}`;for(let ie of this.commands)if(ie.isMatched(X)){let oe=this.mri(L,ie);I=!1;let ae={...oe,args:oe.args.slice(2)};this.setParsedInfo(ae,ie,X),this.emit(`command:${X}`,ie);break}}}}if(I){for(let Z of this.commands)if(Z.name===""){I=!1;let X=this.mri(L,Z);this.setParsedInfo(X,Z),this.emit("command:!",Z);break}}if(I){let Z=this.mri(R.slice(2));this.setParsedInfo(Z)}if(this.options.verbose)this.isVerbose=!0;if(this.options.quiet)this.isQuiet=!0;if(this.options.debug)this.isDebug=!0;if(this.options.noInteraction||this.options.interaction===!1)this.isNoInteraction=!0;if(this.options.env)this.environment=String(this.options.env);if(this.options.dryRun)this.isDryRun=!0;if(this.options.force)this.isForce=!0;if(this.options.noEmoji||this.options.emoji===!1)this.useEmoji=!1;if(this.options.theme)this.theme=String(this.options.theme);if(this.options.noCache||this.options.cache===!1)this.isNoCache=!0;if(this.options.help&&this.showHelpOnExit)this.outputHelp(),m=!1,this.unsetMatchedCommand();if(this.options.version&&this.showVersionOnExit&&this.matchedCommandName==null)this.outputVersion(),m=!1,this.unsetMatchedCommand();let Y={args:this.args,options:this.options};if(m)await this.runMatchedCommand();if(!this.matchedCommand&&this.args[0]){if(this.emit("command:*"),!(this.listenerCount("command:*")>0))this.showCommandNotFound(this.args[0])}return Y}mri(R,t){let m=[...this.globalCommand.options,...t?t.options:[]],k=Uu(m),I=[],L=R.indexOf("--");if(L>-1)I=R.slice(L+1),R=R.slice(0,L);let z=Ju(R,k),Y={_:z._};for(let ae of Object.keys(z))if(ae!=="_")Y[Yo(ae)]=z[ae];let Z=Y._,X={"--":I},ie=t&&t.config.ignoreOptionDefaultValue?t.config.ignoreOptionDefaultValue:this.globalCommand.config.ignoreOptionDefaultValue,oe=Object.create(null);for(let ae of m){if(!ie&&ae.config.default!==void 0)for(let be of ae.names)X[be]=ae.config.default;if(Array.isArray(ae.config.type)){if(oe[ae.name]===void 0)oe[ae.name]={shouldTransform:!0,transformFunction:ae.config.type[0]}}}for(let ae of Object.keys(Y))if(ae!=="_"){let be=ae.split(".");Wu(X,be,Y[ae]),Vu(X,oe)}return{args:Z,options:X}}async run(R=Kl){return this.parse(R,{run:!0,exitOnError:!0})}handleUsageError(R){if(!Hu(R)||R.isUsageError===!1)return;let t=R.message||"command-line error",m=this.name?`${this.name}: `:"",k=/--help/.test(t)?"":R.usage?`
+`)),this.enableDidYouMean){let t=[];for(let k of this.commands){if(k.displayName)t.push(k.displayName);if(k.aliasNames)t.push(...k.aliasNames)}let m=Zl(R,t);if(m.length>0)console.log(Uo.yellow("Did you mean one of these?")),m.forEach((k)=>console.log(`  ${Uo.dim("•")} ${this.name} ${k}`)),console.log("")}console.log(Uo.dim("Run"),`${this.name} --help`,Uo.dim("to see all available commands")),ji.exit(1)}async parse(R=Kl,t={}){let{run:m=!0,exitOnError:k=!1}=t;if(k)try{return await this.parse(R,{run:m})}catch(Z){throw this.handleUsageError(Z),Z}if(this.rawArgs=R,!this.name)this.name=R[1]?qu(R[1]):"cli";let I=!0,L=R.slice(2),z=L[0];if(z&&!z.startsWith("-")){for(let Z of this.commands)if(Z.isMatched(z)){let X=this.mri(L,Z);I=!1;let ee={...X,args:X.args.slice(1)};this.setParsedInfo(ee,Z,z),this.emit(`command:${z}`,Z);break}if(I){let Z=L[1];if(Z&&!Z.startsWith("-")){let X=`${z}:${Z}`;for(let ee of this.commands)if(ee.isMatched(X)){let oe=this.mri(L,ee);I=!1;let se={...oe,args:oe.args.slice(2)};this.setParsedInfo(se,ee,X),this.emit(`command:${X}`,ee);break}}}}if(I){for(let Z of this.commands)if(Z.name===""){I=!1;let X=this.mri(L,Z);this.setParsedInfo(X,Z),this.emit("command:!",Z);break}}if(I){let Z=this.mri(R.slice(2));this.setParsedInfo(Z)}if(this.options.verbose)this.isVerbose=!0;if(this.options.quiet)this.isQuiet=!0;if(this.options.debug)this.isDebug=!0;if(this.options.noInteraction||this.options.interaction===!1)this.isNoInteraction=!0;if(this.options.env)this.environment=String(this.options.env);if(this.options.dryRun)this.isDryRun=!0;if(this.options.force)this.isForce=!0;if(this.options.noEmoji||this.options.emoji===!1)this.useEmoji=!1;if(this.options.theme)this.theme=String(this.options.theme);if(this.options.noCache||this.options.cache===!1)this.isNoCache=!0;if(this.options.help&&this.showHelpOnExit)this.outputHelp(),m=!1,this.unsetMatchedCommand();if(this.options.version&&this.showVersionOnExit&&this.matchedCommandName==null)this.outputVersion(),m=!1,this.unsetMatchedCommand();let Y={args:this.args,options:this.options};if(m)await this.runMatchedCommand();if(!this.matchedCommand&&this.args[0]){if(this.emit("command:*"),!(this.listenerCount("command:*")>0))this.showCommandNotFound(this.args[0])}return Y}mri(R,t){let m=[...this.globalCommand.options,...t?t.options:[]],k=Uu(m),I=[],L=R.indexOf("--");if(L>-1)I=R.slice(L+1),R=R.slice(0,L);let z=Ju(R,k),Y={_:z._};for(let se of Object.keys(z))if(se!=="_")Y[Ko(se)]=z[se];let Z=Y._,X={"--":I},ee=t&&t.config.ignoreOptionDefaultValue?t.config.ignoreOptionDefaultValue:this.globalCommand.config.ignoreOptionDefaultValue,oe=Object.create(null);for(let se of m){if(!ee&&se.config.default!==void 0)for(let ue of se.names)X[ue]=se.config.default;if(Array.isArray(se.config.type)){if(oe[se.name]===void 0)oe[se.name]={shouldTransform:!0,transformFunction:se.config.type[0]}}}for(let se of Object.keys(Y))if(se!=="_"){let ue=se.split(".");Wu(X,ue,Y[se]),Vu(X,oe)}return{args:Z,options:X}}async run(R=Kl){return this.parse(R,{run:!0,exitOnError:!0})}handleUsageError(R){if(!Hu(R)||R.isUsageError===!1)return;let t=R.message||"command-line error",m=this.name?`${this.name}: `:"",k=/--help/.test(t)?"":R.usage?`
 Usage: ${R.usage}`:`
-Run \`${this.name??"cli"} --help\` for usage.`;Li.stderr.write(`${m}${t}${k}
-`),Li.exit(R.exitCode??2)}async runMatchedCommand(){let{args:R,options:t,matchedCommand:m}=this;if(!m||!m.commandAction)return;m.checkUnknownOptions(),m.checkOptionValue(),m.checkRequiredArgs();let k=[];m.args.forEach((Y,Z)=>{if(Y.variadic)k.push(R.slice(Z));else k.push(R[Z])}),k.push(t);let I={command:m,args:k,options:t};for(let Y of m.beforeHooks)await Y(I);let L,z=async()=>{let Y=m.commandAction.apply(this,k);if(Y instanceof Promise)L=await Y;else L=Y;return L};if(m.middleware.length>0){let Y=0,Z=async()=>{if(Y<m.middleware.length){let X=m.middleware[Y++];await X({...I,next:Z})}else await z()};await Z()}else await z();for(let Y of m.afterHooks)await Y(I);return L}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return Li.removeAllListeners("SIGINT"),Li.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class Xl{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(R){if(!this.enabled){this.misses++;return}let t=this.cache.get(R);if(!t){this.misses++;return}if(Date.now()-t.timestamp>t.ttl){this.cache.delete(R),this.misses++;return}return this.hits++,t.value}set(R,t,m=5000){if(!this.enabled)return;this.cache.set(R,{value:t,timestamp:Date.now(),ttl:m})}has(R){if(!this.enabled)return!1;let t=this.cache.get(R);if(!t)return!1;if(Date.now()-t.timestamp>t.ttl)return this.cache.delete(R),!1;return!0}delete(R){this.cache.delete(R)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let R=Date.now();for(let[t,m]of this.cache.entries())if(R-m.timestamp>m.ttl)this.cache.delete(t)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var ny=new Xl;function tm(){if("FORCE_COLOR"in Jo.env)return Jo.env.FORCE_COLOR!=="0";if("NO_COLOR"in Jo.env||Jo.env.TERM==="dumb")return!1;if(Jo.platform==="win32")return!0;return Jl.isatty(1)&&Jl.isatty(2)}var ed=tm();function an(R,t){if(!ed)return(m)=>m;return(m)=>R+m+t}var nm=an("\x1B[0m","\x1B[0m"),rm=an("\x1B[31m","\x1B[39m"),im=an("\x1B[32m","\x1B[39m"),om=an("\x1B[33m","\x1B[39m"),sm=an("\x1B[34m","\x1B[39m"),am=an("\x1B[35m","\x1B[39m"),cm=an("\x1B[36m","\x1B[39m"),lm=an("\x1B[37m","\x1B[39m"),dm=an("\x1B[90m","\x1B[39m"),um=an("\x1B[1m","\x1B[22m"),mm=an("\x1B[3m","\x1B[23m"),pm=an("\x1B[4m","\x1B[24m"),fm=an("\x1B[2m","\x1B[22m"),gm=an("\x1B[7m","\x1B[27m"),hm=an("\x1B[8m","\x1B[28m"),ym=an("\x1B[9m","\x1B[29m"),vm=an("\x1B[41m","\x1B[49m"),bm=an("\x1B[42m","\x1B[49m"),wm=an("\x1B[43m","\x1B[49m"),Sm=an("\x1B[44m","\x1B[49m"),Cm=an("\x1B[45m","\x1B[49m"),$m=an("\x1B[46m","\x1B[49m"),km=an("\x1B[47m","\x1B[49m"),Am=ed,Rm={reset:nm,red:rm,green:im,yellow:om,blue:sm,magenta:am,cyan:cm,white:lm,gray:dm,bold:um,italic:mm,underline:pm,dim:fm,inverse:gm,hidden:hm,strikethrough:ym,bgRed:vm,bgGreen:bm,bgYellow:wm,bgBlue:Sm,bgMagenta:Cm,bgCyan:$m,bgWhite:km,isColorSupported:Am},Im=Rm,xm=["up","down","left","right","space","enter","cancel"],cy={actions:new Set(xm),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var ly=Pm.platform.startsWith("win"),dy=Symbol("clapp:cancel");var Dm=Gu();var Xt=(R,t)=>Dm?R:t,uy=Xt("◆","*"),my=Xt("■","x"),py=Xt("▲","x"),fy=Xt("◇","o"),gy=Xt("┌","T"),Em=Xt("│","|"),hy=Xt("└","—"),yy=Xt("●",">"),vy=Xt("○"," "),by=Xt("◻","[•]"),wy=Xt("◼","[+]"),Sy=Xt("◻","[ ]"),Cy=Xt("▪","•"),$y=Xt("─","-"),ky=Xt("╮","+"),Ay=Xt("├","+"),Ry=Xt("╯","+"),Iy=Xt("●","•"),Py=Xt("◆","*"),xy=Xt("▲","!"),Dy=Xt("■","x");var Ey={light:Xt("─","-"),heavy:Xt("━","="),block:Xt("█","#")};function Tm(){return`${Im.gray(Em)}  `}var Ty=Tm();var Ua="0.16.90";function td(R,t,m=process.env){let k=t?.options.find((z)=>z.name==="profile");if((!k||/\baws\b/i.test(k.description))&&typeof R.profile==="string"&&R.profile)m.AWS_PROFILE=R.profile,delete m.AWS_ACCESS_KEY_ID,delete m.AWS_SECRET_ACCESS_KEY,delete m.AWS_SESSION_TOKEN;if(!t?.options.some((z)=>z.name==="region")&&typeof R.region==="string"&&R.region)m.AWS_REGION=R.region,m.AWS_DEFAULT_REGION=R.region}import{existsSync as Wa}from"node:fs";import{mkdir as Om,writeFile as nd}from"node:fs/promises";function Va(R){R.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(t)=>{if(i("Initializing ts-cloud Project"),Wa("cloud.config.ts")){if(!await d("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let m=t?.name||await P("Project name","my-app"),k=t?.mode||await Ko("Select deployment mode",["serverless","server"]),I=t?.region||await Ko("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),L=new s("Creating configuration file...");L.start();let z=`import { defineConfig } from '@ts-cloud/core'
+Run \`${this.name??"cli"} --help\` for usage.`;ji.stderr.write(`${m}${t}${k}
+`),ji.exit(R.exitCode??2)}async runMatchedCommand(){let{args:R,options:t,matchedCommand:m}=this;if(!m||!m.commandAction)return;m.checkUnknownOptions(),m.checkOptionValue(),m.checkRequiredArgs();let k=[];m.args.forEach((Y,Z)=>{if(Y.variadic)k.push(R.slice(Z));else k.push(R[Z])}),k.push(t);let I={command:m,args:k,options:t};for(let Y of m.beforeHooks)await Y(I);let L,z=async()=>{let Y=m.commandAction.apply(this,k);if(Y instanceof Promise)L=await Y;else L=Y;return L};if(m.middleware.length>0){let Y=0,Z=async()=>{if(Y<m.middleware.length){let X=m.middleware[Y++];await X({...I,next:Z})}else await z()};await Z()}else await z();for(let Y of m.afterHooks)await Y(I);return L}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return ji.removeAllListeners("SIGINT"),ji.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class Xl{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(R){if(!this.enabled){this.misses++;return}let t=this.cache.get(R);if(!t){this.misses++;return}if(Date.now()-t.timestamp>t.ttl){this.cache.delete(R),this.misses++;return}return this.hits++,t.value}set(R,t,m=5000){if(!this.enabled)return;this.cache.set(R,{value:t,timestamp:Date.now(),ttl:m})}has(R){if(!this.enabled)return!1;let t=this.cache.get(R);if(!t)return!1;if(Date.now()-t.timestamp>t.ttl)return this.cache.delete(R),!1;return!0}delete(R){this.cache.delete(R)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let R=Date.now();for(let[t,m]of this.cache.entries())if(R-m.timestamp>m.ttl)this.cache.delete(t)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var ny=new Xl;function tm(){if("FORCE_COLOR"in Wo.env)return Wo.env.FORCE_COLOR!=="0";if("NO_COLOR"in Wo.env||Wo.env.TERM==="dumb")return!1;if(Wo.platform==="win32")return!0;return Jl.isatty(1)&&Jl.isatty(2)}var ed=tm();function Zt(R,t){if(!ed)return(m)=>m;return(m)=>R+m+t}var nm=Zt("\x1B[0m","\x1B[0m"),rm=Zt("\x1B[31m","\x1B[39m"),im=Zt("\x1B[32m","\x1B[39m"),om=Zt("\x1B[33m","\x1B[39m"),sm=Zt("\x1B[34m","\x1B[39m"),am=Zt("\x1B[35m","\x1B[39m"),cm=Zt("\x1B[36m","\x1B[39m"),lm=Zt("\x1B[37m","\x1B[39m"),dm=Zt("\x1B[90m","\x1B[39m"),um=Zt("\x1B[1m","\x1B[22m"),mm=Zt("\x1B[3m","\x1B[23m"),pm=Zt("\x1B[4m","\x1B[24m"),fm=Zt("\x1B[2m","\x1B[22m"),gm=Zt("\x1B[7m","\x1B[27m"),hm=Zt("\x1B[8m","\x1B[28m"),ym=Zt("\x1B[9m","\x1B[29m"),vm=Zt("\x1B[41m","\x1B[49m"),bm=Zt("\x1B[42m","\x1B[49m"),wm=Zt("\x1B[43m","\x1B[49m"),Sm=Zt("\x1B[44m","\x1B[49m"),Cm=Zt("\x1B[45m","\x1B[49m"),$m=Zt("\x1B[46m","\x1B[49m"),km=Zt("\x1B[47m","\x1B[49m"),Am=ed,Rm={reset:nm,red:rm,green:im,yellow:om,blue:sm,magenta:am,cyan:cm,white:lm,gray:dm,bold:um,italic:mm,underline:pm,dim:fm,inverse:gm,hidden:hm,strikethrough:ym,bgRed:vm,bgGreen:bm,bgYellow:wm,bgBlue:Sm,bgMagenta:Cm,bgCyan:$m,bgWhite:km,isColorSupported:Am},Im=Rm,xm=["up","down","left","right","space","enter","cancel"],cy={actions:new Set(xm),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var ly=Pm.platform.startsWith("win"),dy=Symbol("clapp:cancel");var Dm=Gu();var Yt=(R,t)=>Dm?R:t,uy=Yt("◆","*"),my=Yt("■","x"),py=Yt("▲","x"),fy=Yt("◇","o"),gy=Yt("┌","T"),Em=Yt("│","|"),hy=Yt("└","—"),yy=Yt("●",">"),vy=Yt("○"," "),by=Yt("◻","[•]"),wy=Yt("◼","[+]"),Sy=Yt("◻","[ ]"),Cy=Yt("▪","•"),$y=Yt("─","-"),ky=Yt("╮","+"),Ay=Yt("├","+"),Ry=Yt("╯","+"),Iy=Yt("●","•"),Py=Yt("◆","*"),xy=Yt("▲","!"),Dy=Yt("■","x");var Ey={light:Yt("─","-"),heavy:Yt("━","="),block:Yt("█","#")};function Tm(){return`${Im.gray(Em)}  `}var Ty=Tm();var Ua="0.16.92";function td(R,t,m=process.env){let k=t?.options.find((z)=>z.name==="profile");if((!k||/\baws\b/i.test(k.description))&&typeof R.profile==="string"&&R.profile)m.AWS_PROFILE=R.profile,delete m.AWS_ACCESS_KEY_ID,delete m.AWS_SECRET_ACCESS_KEY,delete m.AWS_SESSION_TOKEN;if(!t?.options.some((z)=>z.name==="region")&&typeof R.region==="string"&&R.region)m.AWS_REGION=R.region,m.AWS_DEFAULT_REGION=R.region}import{existsSync as Wa}from"node:fs";import{mkdir as Om,writeFile as nd}from"node:fs/promises";function Va(R){R.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(t)=>{if(i("Initializing ts-cloud Project"),Wa("cloud.config.ts")){if(!await d("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let m=t?.name||await P("Project name","my-app"),k=t?.mode||await Zo("Select deployment mode",["serverless","server"]),I=t?.region||await Zo("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),L=new s("Creating configuration file...");L.start();let z=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -59,45 +59,45 @@ dist/
 cloudformation/
 *.log
 .DS_Store
-`),n("Created .gitignore");if(!Wa("cloudformation"))await Om("cloudformation",{recursive:!0}),n("Created cloudformation/ directory");Ee(`ts-cloud project initialized!
+`),n("Created .gitignore");if(!Wa("cloudformation"))await Om("cloudformation",{recursive:!0}),n("Created cloudformation/ directory");we(`ts-cloud project initialized!
 
 Next steps:
   1. Edit cloud.config.ts to configure your infrastructure
   2. Run 'cloud generate' to create CloudFormation templates
-  3. Run 'cloud deploy' to deploy your infrastructure`,"green")}),R.command("init:server","Initialize server-based (EC2) project").action(async()=>{i("Initializing Server-Based Project"),await R.parse(["init","--mode","server"])}),R.command("init:serverless","Initialize serverless (Fargate/Lambda) project").action(async()=>{i("Initializing Serverless Project"),await R.parse(["init","--mode","serverless"])}),R.command("init:hybrid","Initialize hybrid project").action(async()=>{i("Initializing Hybrid Project"),await R.parse(["init","--mode","hybrid"])})}import{readFile as rd,writeFile as Lm}from"node:fs/promises";import{resolve as Ms}from"node:path";async function Ne(){let R=await Zi();if(!R.project)throw Error("Missing required project configuration in cloud.config.ts");return R}function bn(R){if(R)switch(R.toLowerCase()){case"porkbun":{let k=process.env.PORKBUN_API_KEY,I=process.env.PORKBUN_SECRET_KEY;if(!k||!I)throw Error("PORKBUN_API_KEY and PORKBUN_SECRET_KEY environment variables are required for Porkbun provider");return{provider:"porkbun",apiKey:k,secretKey:I}}case"godaddy":{let k=process.env.GODADDY_API_KEY,I=process.env.GODADDY_API_SECRET;if(!k||!I)throw Error("GODADDY_API_KEY and GODADDY_API_SECRET environment variables are required for GoDaddy provider");let L=process.env.GODADDY_ENVIRONMENT||"production";return{provider:"godaddy",apiKey:k,apiSecret:I,environment:L}}case"route53":{let k=process.env.AWS_REGION||"us-east-1",I=process.env.AWS_HOSTED_ZONE_ID;return{provider:"route53",region:k,hostedZoneId:I}}case"cloudflare":{let k=process.env.CLOUDFLARE_API_TOKEN;if(!k)throw Error("CLOUDFLARE_API_TOKEN environment variable is required for Cloudflare provider");return{provider:"cloudflare",apiToken:k,zoneId:process.env.CLOUDFLARE_ZONE_ID,accountId:process.env.CLOUDFLARE_ACCOUNT_ID}}default:throw Error(`Unknown DNS provider: ${R}. Supported: porkbun, godaddy, route53, cloudflare`)}if(new Ui().loadFromEnv().getAllProviders().length===0)return null;if(process.env.PORKBUN_API_KEY&&process.env.PORKBUN_SECRET_KEY)return{provider:"porkbun",apiKey:process.env.PORKBUN_API_KEY,secretKey:process.env.PORKBUN_SECRET_KEY};if(process.env.GODADDY_API_KEY&&process.env.GODADDY_API_SECRET)return{provider:"godaddy",apiKey:process.env.GODADDY_API_KEY,apiSecret:process.env.GODADDY_API_SECRET,environment:process.env.GODADDY_ENVIRONMENT||"production"};if(process.env.AWS_ACCESS_KEY_ID||process.env.AWS_PROFILE||process.env.AWS_REGION)return{provider:"route53",region:process.env.AWS_REGION||"us-east-1",hostedZoneId:process.env.AWS_HOSTED_ZONE_ID};if(process.env.CLOUDFLARE_API_TOKEN)return{provider:"cloudflare",apiToken:process.env.CLOUDFLARE_API_TOKEN,zoneId:process.env.CLOUDFLARE_ZONE_ID,accountId:process.env.CLOUDFLARE_ACCOUNT_ID};return null}function Vr(R){let t=bn(R);if(!t)throw Error("No DNS provider configured. Set environment variables for Porkbun (PORKBUN_API_KEY, PORKBUN_SECRET_KEY), GoDaddy (GODADDY_API_KEY, GODADDY_API_SECRET), Cloudflare (CLOUDFLARE_API_TOKEN), or Route53 (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)");return B(t)}async function Fm(R){let t=await Ne(),m=y(process.cwd(),t),k=R??Object.keys(t.environments??{})[0]??"production",I=m.environments.get(k);if(!I)throw m.store.close(),Error(`Environment ${k} was not found.`);let L=t.project?.region??"us-east-1",z=_(process.cwd()),Y=new Or(m.store),Z=new Ur(Y,{encryptionKey:z,backends:[new Pt(m.store,z),new $r(new J(L),L),new Lr(new Ze(L),L),new Mr]}),X=m.store.getActorByExternalId("system","cli")??m.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});return await Cn(Z,m,t,X.id),{config:t,controlPlane:m,env:k,environmentRecord:I,store:Y,service:Z,actor:X}}async function Hr(R,t){let m=await Fm(R);try{return await t(m)}finally{m.controlPlane.store.close()}}async function Dn(R){try{await R()}catch(t){r(t instanceof Error?t.message:String(t))}}function jm(R){return R.map((t)=>[t.key,t.kind,t.scope.type,t.inherited?"inherited":t.overridden?"override":"direct",t.kind==="secret"?t.backend??"restricted":t.value??"",t.backendVersion??"—",t.required?"required":"optional",t.updatedAt])}function id(R,t=process.env){if(R.value!=null)throw Error("Secret values are not accepted in command arguments; use --from-env or the interactive prompt.");if(!R.fromEnv)return;let m=t[R.fromEnv];if(!m)throw Error(`${R.fromEnv} is empty or unavailable.`);return m}function nr(R,t){let m=t.scope??"environment";if(m==="project")return{type:m,id:R.controlPlane.project.id};if(m==="environment"){let k=t.target?R.controlPlane.store.listEnvironments(R.controlPlane.project.id).find((I)=>I.id===t.target||I.slug===t.target):R.environmentRecord;if(!k)throw Error(`Environment ${t.target} was not found.`);return{type:m,id:k.id,environmentId:k.id}}if(m==="service"){let k=R.controlPlane.store.listResources(R.controlPlane.project.id),I=k.find((L)=>L.id===t.target||L.slug===t.target);if(!I)throw Error("Service scope requires --target with a resource ID or slug.");return{type:m,id:I.id,environmentId:I.environmentId,resourceId:I.id}}if(m==="function"){let k=R.controlPlane.store.listResources(R.controlPlane.project.id),I=k.find((L)=>L.kind==="function"&&(L.id===t.target||L.slug===t.target));if(!I)throw Error("Function scope requires --target with a function resource ID or slug.");return{type:m,id:I.id,environmentId:I.environmentId,resourceId:I.id}}if(m==="preview"){let k=new Fe(R.controlPlane.store).listInstances({projectId:R.controlPlane.project.id}).find((I)=>I.id===t.target||I.name===t.target);if(!k)throw Error("Preview scope requires --target with a preview ID or name.");return{type:m,id:k.id,environmentId:k.baseEnvironmentId,resourceId:k.resourceId,previewId:k.id}}throw Error("--scope must be project, environment, service, function, or preview.")}function qa(R){let t=R??"local_encrypted";if(!["local_encrypted","aws_secrets_manager","aws_ssm","external"].includes(t))throw Error("--backend must be local_encrypted, aws_secrets_manager, aws_ssm, or external.");return t}function $o(R,t,m){let k=R.store.find(R.controlPlane.project.id,m,t);if(!k)throw Error(`${t} was not found in the selected scope.`);return k}async function Bm(R,t){if(R==="secret")return id(t)??await P("Enter secret value (input is write-only)","");if(t.fromEnv){let m=process.env[t.fromEnv];if(m==null)throw Error(`${t.fromEnv} is unavailable.`);return m}if(t.value!=null)return t.value;return await P("Enter variable value","")}function Gr(R){return R.option("--env <environment>","Dashboard environment").option("--scope <scope>","project, environment, service, function, or preview",{default:"environment"}).option("--target <id>","Environment, resource, function, or preview ID/name")}function Ha(R){R.command("config","Show validated file configuration").action(async()=>Dn(async()=>{let t=await Ne();console.log(JSON.stringify(t,null,2))})),R.command("config:validate","Validate configuration file").action(async()=>Dn(async()=>{let t=await Ne();if(!t.project?.name||!t.project?.slug||!t.mode)throw Error("project.name, project.slug, and mode are required.");n(`Configuration is valid: ${t.project.name} · ${t.mode} · ${t.project.region||"us-east-1"}`)})),Gr(R.command("config:list","List scoped variables and write-only secret metadata")).option("--kind <kind>","variable or secret").option("--search <text>","Filter key names").option("--json","Print structured JSON").action(async(t)=>Dn(async()=>Hr(t.env,async(m)=>{let k=nr(m,t),I=["variable","secret"].includes(t.kind??"")?t.kind:void 0,L=m.service.list({projectId:m.controlPlane.project.id,scope:k,kind:I,search:t.search,canReadSecretMetadata:!0});if(t.json)console.log(JSON.stringify(L,null,2));else c(["Key","Kind","Scope","Precedence","Value/backend","Backend version","Requirement","Updated"],jm(L))}))),Gr(R.command("config:set <key>","Create or replace a scoped variable or secret")).option("--value <value>","Plaintext variable value only").option("--from-env <name>","Read the value from an environment variable").option("--secret","Store a write-only secret").option("--backend <backend>","local_encrypted, aws_secrets_manager, aws_ssm, or external").option("--reference <uri>","External provider reference").option("--required","Fail deployments when unavailable").option("--confirm <key>","Exact key confirmation for production replacements").option("--json","Print structured JSON").action(async(t,m)=>Dn(async()=>Hr(m.env,async(k)=>{let I=nr(k,m),L=m.secret?"secret":"variable",z=L==="secret"?qa(m.backend):void 0,Y=z==="external"?void 0:await Bm(L,m),Z=await k.service.set({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,scope:I,key:t,kind:L,value:Y,reference:m.reference,backend:z,required:!!m.required,confirmed:m.confirm===t,actorId:k.actor.id,idempotencyKey:`cli:${crypto.randomUUID()}`});if(m.json)console.log(JSON.stringify({entry:k.service.list({projectId:k.controlPlane.project.id,scope:I,canReadSecretMetadata:!0}).find((X)=>X.id===Z.entry.id),mutation:Z.mutation,warnings:Z.warnings},null,2));else n(`${t}: ${Z.mutation.added.length?"created":Z.mutation.changed.length?"updated":"unchanged"}; ${Z.mutation.affectedResourceIds.length} affected service(s).`)}))),Gr(R.command("config:delete <key>","Delete a scoped variable or secret")).option("--confirm <key>","Exact key confirmation").action(async(t,m)=>Dn(async()=>Hr(m.env,async(k)=>{let I=$o(k,t,nr(k,m));await k.service.remove({entryId:I.id,expectedVersion:I.version,confirmed:m.confirm===t,actorId:k.actor.id}),n(`Deleted ${t}.`)}))),Gr(R.command("config:import <file>","Validate and import a dotenv file")).option("--secret-keys <keys>","Comma-separated secret keys").option("--backend <backend>","Secret backend").option("--confirm <word>","Use import for production replacement confirmation").option("--json","Print structured JSON").action(async(t,m)=>Dn(async()=>Hr(m.env,async(k)=>{let I=await k.service.importDotenv({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,scope:nr(k,m),source:await rd(Ms(t),"utf8"),secretKeys:m.secretKeys?.split(",").map((L)=>L.trim()).filter(Boolean),backend:qa(m.backend),confirmed:m.confirm==="import",actorId:k.actor.id,idempotencyKey:`cli-import:${crypto.randomUUID()}`});if(!I.document.valid)throw Error(I.document.diagnostics.map((L)=>`line ${L.line}: ${L.message}`).join(`
-`));if(m.json)console.log(JSON.stringify({mutation:I.mutation,diagnostics:I.document.diagnostics,warnings:I.warnings},null,2));else n(`Imported ${I.mutation?.added.length??0} new, ${I.mutation?.changed.length??0} changed, and ${I.mutation?.unchanged.length??0} unchanged entries.`)}))),Gr(R.command("config:plan <file>","Preview dotenv drift using key names only")).option("--remove-missing","Include managed keys absent from the file").option("--json","Print structured JSON").action(async(t,m)=>Dn(async()=>Hr(m.env,async(k)=>{let{parseDotenv:I}=await import("./chunk-4k2x5x3k.js"),L=I(await rd(Ms(t),"utf8"));if(!L.valid)throw Error(L.diagnostics.map((Y)=>`line ${Y.line}: ${Y.message}`).join(`
-`));let z=k.service.plan({projectId:k.controlPlane.project.id,scope:nr(k,m),values:L.values,removeMissing:!!m.removeMissing});if(m.json)console.log(JSON.stringify(z,null,2));else c(["Action","Keys"],[["Add",z.added.join(", ")||"—"],["Change",z.changed.join(", ")||"—"],["Remove",z.removed.join(", ")||"—"],["Unchanged",z.unchanged.join(", ")||"—"]]),e(`${z.affectedResourceIds.length} affected service(s); no secret values were printed.`)}))),Gr(R.command("config:export [file]","Export plaintext variables only as dotenv")).action(async(t,m)=>Dn(async()=>Hr(m.env,async(k)=>{let I=k.service.exportVariables({projectId:k.controlPlane.project.id,scope:nr(k,m)});if(t)await Lm(Ms(t),I,{mode:384}),n(`Exported variables to ${Ms(t)}; secrets were excluded.`);else process.stdout.write(I)}))),Gr(R.command("config:transfer <key>","Copy or move an entry between scopes")).option("--to-scope <scope>","Destination scope").option("--to-target <id>","Destination ID or slug").option("--move","Remove the source after copying").option("--confirm <key>","Exact key confirmation").action(async(t,m)=>Dn(async()=>Hr(m.env,async(k)=>{let I=nr(k,m),L=$o(k,t,I),z=nr(k,{env:m.env,scope:m.toScope,target:m.toTarget}),Y=await k.service.transfer({entryId:L.id,targetScope:z,mode:m.move?"move":"copy",confirmed:m.confirm===t,actorId:k.actor.id,idempotencyKey:`cli-transfer:${crypto.randomUUID()}`});n(`${t} ${m.move?"moved":"copied"}; ${Y.mutation.affectedResourceIds.length} affected service(s).`)}))),Gr(R.command("config:reveal <key>","Reveal a secret after exact confirmation")).option("--confirm <key>","Exact key confirmation").action(async(t,m)=>Dn(async()=>Hr(m.env,async(k)=>{if(m.confirm!==t)throw Error(`Use --confirm ${t} to reveal this secret.`);let I=$o(k,t,nr(k,m));console.log(await k.service.reveal({entryId:I.id,canRevealSecrets:!0,recentlyAuthenticated:!0,actorId:k.actor.id}))}))),Gr(R.command("config:env","Backward-compatible variable management")).option("--list","List variables").option("--set <key=value>","Set a variable").option("--unset <key>","Delete a variable").option("--environment <environment>","Target environment").action(async(t)=>Dn(async()=>Hr(t.environment??t.env,async(m)=>{let k=nr(m,{env:t.environment,scope:"environment",target:t.environment});if(t.list)c(["Key","Value","Updated"],m.service.list({projectId:m.controlPlane.project.id,scope:k,kind:"variable"}).map((I)=>[I.key,I.value??"",I.updatedAt]));else if(t.set){let I=t.set.indexOf("=");if(I<1)throw Error("Use --set KEY=VALUE.");let L=t.set.slice(0,I),z=t.set.slice(I+1);await m.service.set({organizationId:m.controlPlane.organization.id,projectId:m.controlPlane.project.id,scope:k,key:L,kind:"variable",value:z,confirmed:!1,actorId:m.actor.id}),n(`Set ${L}.`)}else if(t.unset){let I=$o(m,t.unset,k);await m.service.remove({entryId:I.id,expectedVersion:I.version,confirmed:await d(`Delete ${I.key}?`,!1),actorId:m.actor.id}),n(`Deleted ${I.key}.`)}else e("Use --list, --set KEY=VALUE, or --unset KEY.")}))),Gr(R.command("config:secrets","Backward-compatible write-only secret management")).option("--list","List secret metadata").option("--create <key>","Create a secret").option("--update <key>","Rotate a secret").option("--get <key>","Reveal a secret").option("--delete <key>","Delete a secret").option("--from-env <name>","Read new value from an environment variable").option("--backend <backend>","Secret backend").option("--confirm <key>","Exact key confirmation").action(async(t)=>Dn(async()=>Hr(t.env,async(m)=>{let k=nr(m,t);if(t.list)c(["Key","Backend","Version","Rotated"],m.service.list({projectId:m.controlPlane.project.id,scope:k,kind:"secret",canReadSecretMetadata:!0}).map((I)=>[I.key,I.backend??"restricted",I.backendVersion??"—",I.rotatedAt??"never"]));else if(t.create||t.update){let I=t.create??t.update,L=id(t)??await P("Enter secret value (write-only)","");await m.service.set({organizationId:m.controlPlane.organization.id,projectId:m.controlPlane.project.id,scope:k,key:I,kind:"secret",value:L,backend:qa(t.backend),confirmed:t.confirm===I,actorId:m.actor.id}),n(`${I} ${t.update?"rotated":"created"}.`)}else if(t.get){if(t.confirm!==t.get)throw Error(`Use --confirm ${t.get} to reveal.`);let I=$o(m,t.get,k);console.log(await m.service.reveal({entryId:I.id,canRevealSecrets:!0,recentlyAuthenticated:!0,actorId:m.actor.id}))}else if(t.delete){let I=$o(m,t.delete,k);await m.service.remove({entryId:I.id,expectedVersion:I.version,confirmed:t.confirm===I.key,actorId:m.actor.id}),n(`Deleted ${I.key}.`)}else e("Use --list, --create, --update, --get, or --delete.")})))}import{existsSync as Zm}from"node:fs";import{readFile as Qm,writeFile as Xm}from"node:fs/promises";async function zs(R){let t=[];for(let m of R.steps)try{t.push({step:m,state:await m.satisfied()?"satisfied":"pending"})}catch(k){t.push({step:m,state:"unknown",reason:k instanceof Error?k.message:String(k)})}return t}function od(R){return R.filter((t)=>t.state!=="satisfied")}function _m(R){return od(R).some((t)=>t.step.destructive===!0)}function Us(R,t){let m=od(t),k=[`${R.operation} ${R.target}`];if(m.length===0)return k.push("  Nothing to do — every step is already satisfied."),k;for(let{step:L,state:z,reason:Y}of t){let Z=z==="satisfied"?"ok  ":z==="unknown"?"?   ":"→   ",X=[L.destructive?"DESTRUCTIVE":"",z==="satisfied"?"already done":""].filter(Boolean);if(k.push(`  ${Z}${L.title}${X.length>0?` [${X.join(", ")}]`:""}`),L.change)k.push(`        ${L.change.from} → ${L.change.to}`);if(Y)k.push(`        could not check: ${Y}`)}let I=m.filter((L)=>L.step.destructive).length;return k.push(`  ${m.length} step(s) would run`+(I>0?`, ${I} irreversible — re-run with --confirm ${R.target}`:"")),k}async function Ws(R,t,m={}){let k={operation:R.operation,target:R.target,steps:[],success:!0};if(_m(t)&&m.confirm!==R.target)throw Error(`${R.operation} includes an irreversible step. Re-run with --confirm ${R.target} to authorize it.`);for(let{step:I,state:L}of t){if(L==="satisfied"){k.steps.push({id:I.id,title:I.title,state:"skipped"}),m.log?.(`skip  ${I.title} (already done)`);continue}m.audit?.({operation:R.operation,target:R.target,step:I.id,state:"started"});try{await I.apply(),k.steps.push({id:I.id,title:I.title,state:"applied"}),m.log?.(`done  ${I.title}`),m.audit?.({operation:R.operation,target:R.target,step:I.id,state:"applied"})}catch(z){let Y=z instanceof Error?z.message:String(z);return k.steps.push({id:I.id,title:I.title,state:"failed",error:Y}),k.success=!1,m.log?.(`FAIL  ${I.title}: ${Y}`),m.audit?.({operation:R.operation,target:R.target,step:I.id,state:"failed",error:Y}),k}}return k}function ko(R,t){return`/tmp/ts-cloud-move-${R}-${t}.tar.gz`}function sd(R,t){return`${R}-${t}*.service`}function _t(R){return`'${R.split("'").join("'\\''")}'`}function Mm(R,t){return["set -eu",`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E ${_t(ad(R,t))} || true); do`,'  systemctl stop "$unit" 2>/dev/null || true',"done"].join(`
-`)}function ad(R,t){return`^${R}-${t}-((queue|daemon)-.*|scheduler)\\.service$`}function zm(R,t){return cd(ad(R,t))}function cd(R){return[`ls /etc/systemd/system/ 2>/dev/null | grep -E ${_t(R)} | while read -r unit; do`,'  systemctl is-active "$unit" >/dev/null 2>&1 && echo "active:$unit" || true',"done"].join(`
+  3. Run 'cloud deploy' to deploy your infrastructure`,"green")}),R.command("init:server","Initialize server-based (EC2) project").action(async()=>{i("Initializing Server-Based Project"),await R.parse(["init","--mode","server"])}),R.command("init:serverless","Initialize serverless (Fargate/Lambda) project").action(async()=>{i("Initializing Serverless Project"),await R.parse(["init","--mode","serverless"])}),R.command("init:hybrid","Initialize hybrid project").action(async()=>{i("Initializing Hybrid Project"),await R.parse(["init","--mode","hybrid"])})}import{readFile as rd,writeFile as Lm}from"node:fs/promises";import{resolve as Ds}from"node:path";async function De(){let R=await io();if(!R.project)throw Error("Missing required project configuration in cloud.config.ts");return R}function yn(R){if(R)switch(R.toLowerCase()){case"porkbun":{let k=process.env.PORKBUN_API_KEY,I=process.env.PORKBUN_SECRET_KEY;if(!k||!I)throw Error("PORKBUN_API_KEY and PORKBUN_SECRET_KEY environment variables are required for Porkbun provider");return{provider:"porkbun",apiKey:k,secretKey:I}}case"godaddy":{let k=process.env.GODADDY_API_KEY,I=process.env.GODADDY_API_SECRET;if(!k||!I)throw Error("GODADDY_API_KEY and GODADDY_API_SECRET environment variables are required for GoDaddy provider");let L=process.env.GODADDY_ENVIRONMENT||"production";return{provider:"godaddy",apiKey:k,apiSecret:I,environment:L}}case"route53":{let k=process.env.AWS_REGION||"us-east-1",I=process.env.AWS_HOSTED_ZONE_ID;return{provider:"route53",region:k,hostedZoneId:I}}case"cloudflare":{let k=process.env.CLOUDFLARE_API_TOKEN;if(!k)throw Error("CLOUDFLARE_API_TOKEN environment variable is required for Cloudflare provider");return{provider:"cloudflare",apiToken:k,zoneId:process.env.CLOUDFLARE_ZONE_ID,accountId:process.env.CLOUDFLARE_ACCOUNT_ID}}default:throw Error(`Unknown DNS provider: ${R}. Supported: porkbun, godaddy, route53, cloudflare`)}if(new Fi().loadFromEnv().getAllProviders().length===0)return null;if(process.env.PORKBUN_API_KEY&&process.env.PORKBUN_SECRET_KEY)return{provider:"porkbun",apiKey:process.env.PORKBUN_API_KEY,secretKey:process.env.PORKBUN_SECRET_KEY};if(process.env.GODADDY_API_KEY&&process.env.GODADDY_API_SECRET)return{provider:"godaddy",apiKey:process.env.GODADDY_API_KEY,apiSecret:process.env.GODADDY_API_SECRET,environment:process.env.GODADDY_ENVIRONMENT||"production"};if(process.env.AWS_ACCESS_KEY_ID||process.env.AWS_PROFILE||process.env.AWS_REGION)return{provider:"route53",region:process.env.AWS_REGION||"us-east-1",hostedZoneId:process.env.AWS_HOSTED_ZONE_ID};if(process.env.CLOUDFLARE_API_TOKEN)return{provider:"cloudflare",apiToken:process.env.CLOUDFLARE_API_TOKEN,zoneId:process.env.CLOUDFLARE_ZONE_ID,accountId:process.env.CLOUDFLARE_ACCOUNT_ID};return null}function _r(R){let t=yn(R);if(!t)throw Error("No DNS provider configured. Set environment variables for Porkbun (PORKBUN_API_KEY, PORKBUN_SECRET_KEY), GoDaddy (GODADDY_API_KEY, GODADDY_API_SECRET), Cloudflare (CLOUDFLARE_API_TOKEN), or Route53 (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)");return B(t)}async function Fm(R){let t=await De(),m=y(process.cwd(),t),k=R??Object.keys(t.environments??{})[0]??"production",I=m.environments.get(k);if(!I)throw m.store.close(),Error(`Environment ${k} was not found.`);let L=t.project?.region??"us-east-1",z=_(process.cwd()),Y=new $r(m.store),Z=new Br(Y,{encryptionKey:z,backends:[new kt(m.store,z),new Lr(new J(L),L),new Mr(new tt(L),L),new Ur]}),X=m.store.getActorByExternalId("system","cli")??m.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});return await Tn(Z,m,t,X.id),{config:t,controlPlane:m,env:k,environmentRecord:I,store:Y,service:Z,actor:X}}async function zr(R,t){let m=await Fm(R);try{return await t(m)}finally{m.controlPlane.store.close()}}async function Pn(R){try{await R()}catch(t){r(t instanceof Error?t.message:String(t))}}function jm(R){return R.map((t)=>[t.key,t.kind,t.scope.type,t.inherited?"inherited":t.overridden?"override":"direct",t.kind==="secret"?t.backend??"restricted":t.value??"",t.backendVersion??"—",t.required?"required":"optional",t.updatedAt])}function id(R,t=process.env){if(R.value!=null)throw Error("Secret values are not accepted in command arguments; use --from-env or the interactive prompt.");if(!R.fromEnv)return;let m=t[R.fromEnv];if(!m)throw Error(`${R.fromEnv} is empty or unavailable.`);return m}function _n(R,t){let m=t.scope??"environment";if(m==="project")return{type:m,id:R.controlPlane.project.id};if(m==="environment"){let k=t.target?R.controlPlane.store.listEnvironments(R.controlPlane.project.id).find((I)=>I.id===t.target||I.slug===t.target):R.environmentRecord;if(!k)throw Error(`Environment ${t.target} was not found.`);return{type:m,id:k.id,environmentId:k.id}}if(m==="service"){let k=R.controlPlane.store.listResources(R.controlPlane.project.id),I=k.find((L)=>L.id===t.target||L.slug===t.target);if(!I)throw Error("Service scope requires --target with a resource ID or slug.");return{type:m,id:I.id,environmentId:I.environmentId,resourceId:I.id}}if(m==="function"){let k=R.controlPlane.store.listResources(R.controlPlane.project.id),I=k.find((L)=>L.kind==="function"&&(L.id===t.target||L.slug===t.target));if(!I)throw Error("Function scope requires --target with a function resource ID or slug.");return{type:m,id:I.id,environmentId:I.environmentId,resourceId:I.id}}if(m==="preview"){let k=new je(R.controlPlane.store).listInstances({projectId:R.controlPlane.project.id}).find((I)=>I.id===t.target||I.name===t.target);if(!k)throw Error("Preview scope requires --target with a preview ID or name.");return{type:m,id:k.id,environmentId:k.baseEnvironmentId,resourceId:k.resourceId,previewId:k.id}}throw Error("--scope must be project, environment, service, function, or preview.")}function qa(R){let t=R??"local_encrypted";if(!["local_encrypted","aws_secrets_manager","aws_ssm","external"].includes(t))throw Error("--backend must be local_encrypted, aws_secrets_manager, aws_ssm, or external.");return t}function mo(R,t,m){let k=R.store.find(R.controlPlane.project.id,m,t);if(!k)throw Error(`${t} was not found in the selected scope.`);return k}async function Bm(R,t){if(R==="secret")return id(t)??await P("Enter secret value (input is write-only)","");if(t.fromEnv){let m=process.env[t.fromEnv];if(m==null)throw Error(`${t.fromEnv} is unavailable.`);return m}if(t.value!=null)return t.value;return await P("Enter variable value","")}function qr(R){return R.option("--env <environment>","Dashboard environment").option("--scope <scope>","project, environment, service, function, or preview",{default:"environment"}).option("--target <id>","Environment, resource, function, or preview ID/name")}function Ha(R){R.command("config","Show validated file configuration").action(async()=>Pn(async()=>{let t=await De();console.log(JSON.stringify(t,null,2))})),R.command("config:validate","Validate configuration file").action(async()=>Pn(async()=>{let t=await De();if(!t.project?.name||!t.project?.slug||!t.mode)throw Error("project.name, project.slug, and mode are required.");n(`Configuration is valid: ${t.project.name} · ${t.mode} · ${t.project.region||"us-east-1"}`)})),qr(R.command("config:list","List scoped variables and write-only secret metadata")).option("--kind <kind>","variable or secret").option("--search <text>","Filter key names").option("--json","Print structured JSON").action(async(t)=>Pn(async()=>zr(t.env,async(m)=>{let k=_n(m,t),I=["variable","secret"].includes(t.kind??"")?t.kind:void 0,L=m.service.list({projectId:m.controlPlane.project.id,scope:k,kind:I,search:t.search,canReadSecretMetadata:!0});if(t.json)console.log(JSON.stringify(L,null,2));else c(["Key","Kind","Scope","Precedence","Value/backend","Backend version","Requirement","Updated"],jm(L))}))),qr(R.command("config:set <key>","Create or replace a scoped variable or secret")).option("--value <value>","Plaintext variable value only").option("--from-env <name>","Read the value from an environment variable").option("--secret","Store a write-only secret").option("--backend <backend>","local_encrypted, aws_secrets_manager, aws_ssm, or external").option("--reference <uri>","External provider reference").option("--required","Fail deployments when unavailable").option("--confirm <key>","Exact key confirmation for production replacements").option("--json","Print structured JSON").action(async(t,m)=>Pn(async()=>zr(m.env,async(k)=>{let I=_n(k,m),L=m.secret?"secret":"variable",z=L==="secret"?qa(m.backend):void 0,Y=z==="external"?void 0:await Bm(L,m),Z=await k.service.set({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,scope:I,key:t,kind:L,value:Y,reference:m.reference,backend:z,required:!!m.required,confirmed:m.confirm===t,actorId:k.actor.id,idempotencyKey:`cli:${crypto.randomUUID()}`});if(m.json)console.log(JSON.stringify({entry:k.service.list({projectId:k.controlPlane.project.id,scope:I,canReadSecretMetadata:!0}).find((X)=>X.id===Z.entry.id),mutation:Z.mutation,warnings:Z.warnings},null,2));else n(`${t}: ${Z.mutation.added.length?"created":Z.mutation.changed.length?"updated":"unchanged"}; ${Z.mutation.affectedResourceIds.length} affected service(s).`)}))),qr(R.command("config:delete <key>","Delete a scoped variable or secret")).option("--confirm <key>","Exact key confirmation").action(async(t,m)=>Pn(async()=>zr(m.env,async(k)=>{let I=mo(k,t,_n(k,m));await k.service.remove({entryId:I.id,expectedVersion:I.version,confirmed:m.confirm===t,actorId:k.actor.id}),n(`Deleted ${t}.`)}))),qr(R.command("config:import <file>","Validate and import a dotenv file")).option("--secret-keys <keys>","Comma-separated secret keys").option("--backend <backend>","Secret backend").option("--confirm <word>","Use import for production replacement confirmation").option("--json","Print structured JSON").action(async(t,m)=>Pn(async()=>zr(m.env,async(k)=>{let I=await k.service.importDotenv({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,scope:_n(k,m),source:await rd(Ds(t),"utf8"),secretKeys:m.secretKeys?.split(",").map((L)=>L.trim()).filter(Boolean),backend:qa(m.backend),confirmed:m.confirm==="import",actorId:k.actor.id,idempotencyKey:`cli-import:${crypto.randomUUID()}`});if(!I.document.valid)throw Error(I.document.diagnostics.map((L)=>`line ${L.line}: ${L.message}`).join(`
+`));if(m.json)console.log(JSON.stringify({mutation:I.mutation,diagnostics:I.document.diagnostics,warnings:I.warnings},null,2));else n(`Imported ${I.mutation?.added.length??0} new, ${I.mutation?.changed.length??0} changed, and ${I.mutation?.unchanged.length??0} unchanged entries.`)}))),qr(R.command("config:plan <file>","Preview dotenv drift using key names only")).option("--remove-missing","Include managed keys absent from the file").option("--json","Print structured JSON").action(async(t,m)=>Pn(async()=>zr(m.env,async(k)=>{let{parseDotenv:I}=await import("./chunk-q2hg6hmg.js"),L=I(await rd(Ds(t),"utf8"));if(!L.valid)throw Error(L.diagnostics.map((Y)=>`line ${Y.line}: ${Y.message}`).join(`
+`));let z=k.service.plan({projectId:k.controlPlane.project.id,scope:_n(k,m),values:L.values,removeMissing:!!m.removeMissing});if(m.json)console.log(JSON.stringify(z,null,2));else c(["Action","Keys"],[["Add",z.added.join(", ")||"—"],["Change",z.changed.join(", ")||"—"],["Remove",z.removed.join(", ")||"—"],["Unchanged",z.unchanged.join(", ")||"—"]]),e(`${z.affectedResourceIds.length} affected service(s); no secret values were printed.`)}))),qr(R.command("config:export [file]","Export plaintext variables only as dotenv")).action(async(t,m)=>Pn(async()=>zr(m.env,async(k)=>{let I=k.service.exportVariables({projectId:k.controlPlane.project.id,scope:_n(k,m)});if(t)await Lm(Ds(t),I,{mode:384}),n(`Exported variables to ${Ds(t)}; secrets were excluded.`);else process.stdout.write(I)}))),qr(R.command("config:transfer <key>","Copy or move an entry between scopes")).option("--to-scope <scope>","Destination scope").option("--to-target <id>","Destination ID or slug").option("--move","Remove the source after copying").option("--confirm <key>","Exact key confirmation").action(async(t,m)=>Pn(async()=>zr(m.env,async(k)=>{let I=_n(k,m),L=mo(k,t,I),z=_n(k,{env:m.env,scope:m.toScope,target:m.toTarget}),Y=await k.service.transfer({entryId:L.id,targetScope:z,mode:m.move?"move":"copy",confirmed:m.confirm===t,actorId:k.actor.id,idempotencyKey:`cli-transfer:${crypto.randomUUID()}`});n(`${t} ${m.move?"moved":"copied"}; ${Y.mutation.affectedResourceIds.length} affected service(s).`)}))),qr(R.command("config:reveal <key>","Reveal a secret after exact confirmation")).option("--confirm <key>","Exact key confirmation").action(async(t,m)=>Pn(async()=>zr(m.env,async(k)=>{if(m.confirm!==t)throw Error(`Use --confirm ${t} to reveal this secret.`);let I=mo(k,t,_n(k,m));console.log(await k.service.reveal({entryId:I.id,canRevealSecrets:!0,recentlyAuthenticated:!0,actorId:k.actor.id}))}))),qr(R.command("config:env","Backward-compatible variable management")).option("--list","List variables").option("--set <key=value>","Set a variable").option("--unset <key>","Delete a variable").option("--environment <environment>","Target environment").action(async(t)=>Pn(async()=>zr(t.environment??t.env,async(m)=>{let k=_n(m,{env:t.environment,scope:"environment",target:t.environment});if(t.list)c(["Key","Value","Updated"],m.service.list({projectId:m.controlPlane.project.id,scope:k,kind:"variable"}).map((I)=>[I.key,I.value??"",I.updatedAt]));else if(t.set){let I=t.set.indexOf("=");if(I<1)throw Error("Use --set KEY=VALUE.");let L=t.set.slice(0,I),z=t.set.slice(I+1);await m.service.set({organizationId:m.controlPlane.organization.id,projectId:m.controlPlane.project.id,scope:k,key:L,kind:"variable",value:z,confirmed:!1,actorId:m.actor.id}),n(`Set ${L}.`)}else if(t.unset){let I=mo(m,t.unset,k);await m.service.remove({entryId:I.id,expectedVersion:I.version,confirmed:await d(`Delete ${I.key}?`,!1),actorId:m.actor.id}),n(`Deleted ${I.key}.`)}else e("Use --list, --set KEY=VALUE, or --unset KEY.")}))),qr(R.command("config:secrets","Backward-compatible write-only secret management")).option("--list","List secret metadata").option("--create <key>","Create a secret").option("--update <key>","Rotate a secret").option("--get <key>","Reveal a secret").option("--delete <key>","Delete a secret").option("--from-env <name>","Read new value from an environment variable").option("--backend <backend>","Secret backend").option("--confirm <key>","Exact key confirmation").action(async(t)=>Pn(async()=>zr(t.env,async(m)=>{let k=_n(m,t);if(t.list)c(["Key","Backend","Version","Rotated"],m.service.list({projectId:m.controlPlane.project.id,scope:k,kind:"secret",canReadSecretMetadata:!0}).map((I)=>[I.key,I.backend??"restricted",I.backendVersion??"—",I.rotatedAt??"never"]));else if(t.create||t.update){let I=t.create??t.update,L=id(t)??await P("Enter secret value (write-only)","");await m.service.set({organizationId:m.controlPlane.organization.id,projectId:m.controlPlane.project.id,scope:k,key:I,kind:"secret",value:L,backend:qa(t.backend),confirmed:t.confirm===I,actorId:m.actor.id}),n(`${I} ${t.update?"rotated":"created"}.`)}else if(t.get){if(t.confirm!==t.get)throw Error(`Use --confirm ${t.get} to reveal.`);let I=mo(m,t.get,k);console.log(await m.service.reveal({entryId:I.id,canRevealSecrets:!0,recentlyAuthenticated:!0,actorId:m.actor.id}))}else if(t.delete){let I=mo(m,t.delete,k);await m.service.remove({entryId:I.id,expectedVersion:I.version,confirmed:t.confirm===I.key,actorId:m.actor.id}),n(`Deleted ${I.key}.`)}else e("Use --list, --create, --update, --get, or --delete.")})))}import{existsSync as Zm}from"node:fs";import{readFile as Qm,writeFile as Xm}from"node:fs/promises";async function Es(R){let t=[];for(let m of R.steps)try{t.push({step:m,state:await m.satisfied()?"satisfied":"pending"})}catch(k){t.push({step:m,state:"unknown",reason:k instanceof Error?k.message:String(k)})}return t}function od(R){return R.filter((t)=>t.state!=="satisfied")}function _m(R){return od(R).some((t)=>t.step.destructive===!0)}function Ns(R,t){let m=od(t),k=[`${R.operation} ${R.target}`];if(m.length===0)return k.push("  Nothing to do — every step is already satisfied."),k;for(let{step:L,state:z,reason:Y}of t){let Z=z==="satisfied"?"ok  ":z==="unknown"?"?   ":"→   ",X=[L.destructive?"DESTRUCTIVE":"",z==="satisfied"?"already done":""].filter(Boolean);if(k.push(`  ${Z}${L.title}${X.length>0?` [${X.join(", ")}]`:""}`),L.change)k.push(`        ${L.change.from} → ${L.change.to}`);if(Y)k.push(`        could not check: ${Y}`)}let I=m.filter((L)=>L.step.destructive).length;return k.push(`  ${m.length} step(s) would run`+(I>0?`, ${I} irreversible — re-run with --confirm ${R.target}`:"")),k}async function Ls(R,t,m={}){let k={operation:R.operation,target:R.target,steps:[],success:!0};if(_m(t)&&m.confirm!==R.target)throw Error(`${R.operation} includes an irreversible step. Re-run with --confirm ${R.target} to authorize it.`);for(let{step:I,state:L}of t){if(L==="satisfied"){k.steps.push({id:I.id,title:I.title,state:"skipped"}),m.log?.(`skip  ${I.title} (already done)`);continue}m.audit?.({operation:R.operation,target:R.target,step:I.id,state:"started"});try{await I.apply(),k.steps.push({id:I.id,title:I.title,state:"applied"}),m.log?.(`done  ${I.title}`),m.audit?.({operation:R.operation,target:R.target,step:I.id,state:"applied"})}catch(z){let Y=z instanceof Error?z.message:String(z);return k.steps.push({id:I.id,title:I.title,state:"failed",error:Y}),k.success=!1,m.log?.(`FAIL  ${I.title}: ${Y}`),m.audit?.({operation:R.operation,target:R.target,step:I.id,state:"failed",error:Y}),k}}return k}function fo(R,t){return`/tmp/ts-cloud-move-${R}-${t}.tar.gz`}function sd(R,t){return`${R}-${t}*.service`}function Nt(R){return`'${R.split("'").join("'\\''")}'`}function Mm(R,t){return["set -eu",`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E ${Nt(ad(R,t))} || true); do`,'  systemctl stop "$unit" 2>/dev/null || true',"done"].join(`
+`)}function ad(R,t){return`^${R}-${t}-((queue|daemon)-.*|scheduler)\\.service$`}function zm(R,t){return cd(ad(R,t))}function cd(R){return[`ls /etc/systemd/system/ 2>/dev/null | grep -E ${Nt(R)} | while read -r unit; do`,'  systemctl is-active "$unit" >/dev/null 2>&1 && echo "active:$unit" || true',"done"].join(`
 `)}function Um(R){return!R.split(`
-`).some((t)=>t.trim().startsWith("active:"))}function Wm(R,t,m){let k=ko(R,t);return["set -eu",`test -d ${_t(m)} || { echo "no site tree at ${m}" >&2; exit 1; }`,`rm -f ${_t(k)}`,`tar czf ${_t(k)} -C "$(dirname ${_t(m)})" "$(basename ${_t(m)})" -C /etc/systemd/system $(cd /etc/systemd/system && ls ${sd(R,t)} 2>/dev/null | tr '\\n' ' ')`,`sha256sum ${_t(k)} | cut -d' ' -f1`].join(`
-`)}function Vm(R,t,m){let k=ko(R,t);return["set -eu",`test -f ${_t(k)} || { echo "archive not staged at ${k}" >&2; exit 1; }`,`mkdir -p "$(dirname ${_t(m)})"`,`tar xzf ${_t(k)} -C "$(dirname ${_t(m)})" "$(basename ${_t(m)})"`,`tar xzf ${_t(k)} -C /etc/systemd/system --wildcards ${_t(sd(R,t))} 2>/dev/null || true`,"systemctl daemon-reload",`systemctl enable ${R}-${t}.service 2>/dev/null || true`,`systemctl restart ${R}-${t}.service`,`rm -f ${_t(k)}`].join(`
-`)}function qm(R,t,m){return[`test -d ${_t(m)} && echo tree:present || echo tree:absent`,`systemctl is-active ${R}-${t}.service >/dev/null 2>&1 && echo unit:active || echo unit:inactive`].join(`
-`)}function Hm(R){return R.includes("tree:present")&&R.includes("unit:active")}function Gm(R,t="/",m=10){let k=`http://127.0.0.1:${R}${t.startsWith("/")?t:`/${t}`}`;return["set -eu",`for i in $(seq 1 ${m}); do`,`  if curl -fsS -o /dev/null --max-time 5 ${_t(k)}; then echo healthy; exit 0; fi`,"  sleep 3","done",`echo "no healthy response from ${k}" >&2`,"exit 1"].join(`
-`)}function Km(R,t){return["set -eu",`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E ${_t(ld(R,t))} || true); do`,'  systemctl disable --now "$unit" 2>/dev/null || true',"done",`rm -f /etc/rpx/sites.d/${R}.json 2>/dev/null || true`,"systemctl reload rpx-gateway.service 2>/dev/null || systemctl restart rpx-gateway.service 2>/dev/null || true"].join(`
+`).some((t)=>t.trim().startsWith("active:"))}function Wm(R,t,m){let k=fo(R,t);return["set -eu",`test -d ${Nt(m)} || { echo "no site tree at ${m}" >&2; exit 1; }`,`rm -f ${Nt(k)}`,`tar czf ${Nt(k)} -C "$(dirname ${Nt(m)})" "$(basename ${Nt(m)})" -C /etc/systemd/system $(cd /etc/systemd/system && ls ${sd(R,t)} 2>/dev/null | tr '\\n' ' ')`,`sha256sum ${Nt(k)} | cut -d' ' -f1`].join(`
+`)}function Vm(R,t,m){let k=fo(R,t);return["set -eu",`test -f ${Nt(k)} || { echo "archive not staged at ${k}" >&2; exit 1; }`,`mkdir -p "$(dirname ${Nt(m)})"`,`tar xzf ${Nt(k)} -C "$(dirname ${Nt(m)})" "$(basename ${Nt(m)})"`,`tar xzf ${Nt(k)} -C /etc/systemd/system --wildcards ${Nt(sd(R,t))} 2>/dev/null || true`,"systemctl daemon-reload",`systemctl enable ${R}-${t}.service 2>/dev/null || true`,`systemctl restart ${R}-${t}.service`,`rm -f ${Nt(k)}`].join(`
+`)}function qm(R,t,m){return[`test -d ${Nt(m)} && echo tree:present || echo tree:absent`,`systemctl is-active ${R}-${t}.service >/dev/null 2>&1 && echo unit:active || echo unit:inactive`].join(`
+`)}function Hm(R){return R.includes("tree:present")&&R.includes("unit:active")}function Gm(R,t="/",m=10){let k=`http://127.0.0.1:${R}${t.startsWith("/")?t:`/${t}`}`;return["set -eu",`for i in $(seq 1 ${m}); do`,`  if curl -fsS -o /dev/null --max-time 5 ${Nt(k)}; then echo healthy; exit 0; fi`,"  sleep 3","done",`echo "no healthy response from ${k}" >&2`,"exit 1"].join(`
+`)}function Km(R,t){return["set -eu",`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E ${Nt(ld(R,t))} || true); do`,'  systemctl disable --now "$unit" 2>/dev/null || true',"done",`rm -f /etc/rpx/sites.d/${R}.json 2>/dev/null || true`,"systemctl reload rpx-gateway.service 2>/dev/null || systemctl restart rpx-gateway.service 2>/dev/null || true"].join(`
 `)}function ld(R,t){return`^${R}-${t}[-@.]`}function Jm(R,t){return cd(ld(R,t))}function Ym(R){return!R.split(`
-`).some((t)=>t.trim().startsWith("active:"))}function dd(R,t){return`/tmp/ts-cloud-move-${R}-${t}-certs.tar.gz`}function ud(R,t){return["set -u",...t.map((m)=>`if [ -s ${_t(`${R}/${m}.crt`)} ]; then echo "cert:${m}:$(sha256sum ${_t(`${R}/${m}.crt`)} | cut -d' ' -f1)"; else echo "cert:${m}:absent"; fi`)].join(`
+`).some((t)=>t.trim().startsWith("active:"))}function dd(R,t){return`/tmp/ts-cloud-move-${R}-${t}-certs.tar.gz`}function ud(R,t){return["set -u",...t.map((m)=>`if [ -s ${Nt(`${R}/${m}.crt`)} ]; then echo "cert:${m}:$(sha256sum ${Nt(`${R}/${m}.crt`)} | cut -d' ' -f1)"; else echo "cert:${m}:absent"; fi`)].join(`
 `)}function Ga(R){let t=new Map;for(let m of R.split(`
-`)){let k=m.trim();if(!k.startsWith("cert:"))continue;let[,I,L]=k.split(":");if(I&&L)t.set(I,L)}return t}function md(R,t){for(let[m,k]of R){if(k==="absent")continue;if(t.get(m)!==k)return!1}return!0}function pd(R,t,m){let k=t.flatMap((I)=>[`${I}.crt`,`${I}.key`]);return["set -eu",`rm -f ${_t(m)}`,`cd ${_t(R)} 2>/dev/null || { echo "no certs dir at ${R}" >&2; exit 0; }`,`TS_CLOUD_CERTS="$(ls ${k.map(_t).join(" ")} 2>/dev/null | tr '\\n' ' ' || true)"`,'[ -n "$TS_CLOUD_CERTS" ] || { echo "no certificates to carry"; exit 0; }',`tar czf ${_t(m)} $TS_CLOUD_CERTS`].join(`
-`)}function fd(R,t){return["set -eu",`[ -s ${_t(t)} ] || { echo "no certificate archive staged"; exit 0; }`,`mkdir -p ${_t(R)}`,`tar xzf ${_t(t)} -C ${_t(R)}`,`chmod 600 ${_t(R)}/*.key 2>/dev/null || true`,`rm -f ${_t(t)}`].join(`
-`)}async function gd(R,t){let{slug:m,siteName:k,appBase:I,from:L,to:z,targetAddress:Y}=R;if(L===z)throw Error(`'${k}' is already on ${z}.`);if(R.database&&!t.database)throw Error(`'${k}' uses the on-box database '${R.database.name}', which lives in the engine's own data directory rather than in the site tree, and this move has no way to carry it. Moving the site without it would cut traffic over to an empty database.`);if(R.database&&t.database&&await t.database.targetHasData())throw Error(`${z} already has a database named '${R.database.name}' with tables in it. Restoring this site's dump over it would destroy that data. Rename or drop it on the target first, or point this project at a different database name.`);let Z=[{id:"pause-workers",title:`Stop background work on ${L} so the snapshot is consistent`,satisfied:async()=>Um(await t.runOnSource(zm(m,k))),apply:async()=>{await t.runOnSource(Mm(m,k))}},...t.database?[{id:"database-dump",title:`Dump the '${R.database?.name}' database on ${L}`,satisfied:async()=>!1,apply:()=>t.database.dump()}]:[],{id:"snapshot",title:`Archive the site's tree and units on ${L}`,change:{from:`${L}:${I}`,to:ko(m,k)},satisfied:async()=>!1,apply:async()=>{await t.runOnSource(Wm(m,k,I))}},{id:"transfer",title:`Carry the archive to ${z}`,change:{from:L,to:z},satisfied:()=>t.archiveStaged(),apply:()=>t.transferArchive()},...t.database?[{id:"database-transfer",title:`Carry the database dump to ${z}`,change:{from:L,to:z},satisfied:()=>t.database.dumpStaged(),apply:()=>t.database.transferDump()},{id:"database-restore",title:`Create and load '${R.database?.name}' on ${z}`,satisfied:async()=>!1,apply:()=>t.database.restore()}]:[],{id:"restore",title:`Unpack the site on ${z} and start it`,change:{from:ko(m,k),to:`${z}:${I}`},satisfied:async()=>Hm(await t.runOnTarget(qm(m,k,I))),apply:async()=>{await t.runOnTarget(Vm(m,k,I))}}];if(R.port!=null){let{port:X}=R;Z.push({id:"health",title:`Wait for the site to answer on ${z} (127.0.0.1:${X})`,satisfied:async()=>!1,apply:async()=>{await t.runOnTarget(Gm(X,R.healthCheckPath??"/"))}})}return Z.push(...t.certificates?[{id:"certificates",title:`Carry the site's TLS material to ${z}`,satisfied:()=>t.certificates.inPlace(),apply:()=>t.certificates.carry()}]:[],{id:"gateway",title:`Route the site on ${z}`,satisfied:()=>t.targetRoutesSite(),apply:()=>t.refreshTargetGateway()},{id:"dns",title:`Point DNS at ${z}`,change:{from:`${L}`,to:Y},satisfied:async()=>await t.publishedAddress()===Y,apply:async()=>{let X=await t.cutoverDns();if(X.length>0)throw Error(X.join("; "))}},{id:"drain-source",title:`Stop the site on ${L}, leaving its files in place`,satisfied:async()=>Ym(await t.runOnSource(Jm(m,k))),apply:async()=>{await t.runOnSource(Km(m,k))}}),{operation:"site:move",target:k,steps:Z}}async function no(R,t,m){let k=await R.exec(t,m);if(k.code!==0)throw Error(`${t.name}: ${k.stderr.trim()||k.stdout.trim()||`exited ${k.code}`}`);return k.stdout}async function Ao(R,t,m){let k=Bun.spawn(["scp","-P",String(R.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes",t,m],{stdout:"pipe",stderr:"pipe"}),[I,L]=await Promise.all([k.exited,new Response(k.stderr).text()]);if(I!==0)throw Error(`scp failed: ${L.trim()||`exited ${I}`}`)}async function ep(R,t){if(!t.to)throw Error("Name the target server with --to <server>.");let m=await Ne(),k=m.sites?.[R];if(!k)throw Error(`Site '${R}' is not in cloud.config.ts.`);let I=m.project.slug,L=y(process.cwd(),m);try{let Y=new xe(L.store).list(L.project.id),Z=(Ge)=>{let Ot=Y.find((zt)=>zt.id===Ge||zt.name===Ge);if(!Ot)throw Error(`Server ${Ge} was not found. Run \`cloud server:list\`.`);if(Ot.trustState!=="pinned")throw Error(`${Ot.name} has no pinned host key. Run \`cloud server:validate ${Ot.name}\` first.`);return Ot},X=Z(t.to),ie=Y.filter((Ge)=>Ge.id!==X.id);if(!t.from&&ie.length!==1)throw Error(`Name the source server with --from <server> — ${ie.length} others are enrolled.`);let oe=Z(t.from??ie[0].name),ae=new qr,be=W(I,R),Ae=ko(I,R),de=k.domain,ke=m.infrastructure?.dns?.provider,De=m.infrastructure?.compute?.proxy?.engine==="rpx"?m.infrastructure.compute.proxy:void 0,Se=m.infrastructure?.dns?.domain,Re=(Ge)=>Se&&Ge.endsWith(Se)?Se:Ge.split(".").slice(-2).join("."),Pe=w(m),ze=Pe?.name&&gn(Pe)?{name:Pe.name}:void 0,Le=`/tmp/ts-cloud-move-${I}-${R}.sql.gz`,Be=dd(I,R),Ve=De?.certsDir??cn,ct=[de,...k.aliases??[]].filter((Ge)=>!!Ge),Dt=Pe?.engine??"mysql",nt={runOnSource:(Ge)=>no(ae,oe,Ge),runOnTarget:(Ge)=>no(ae,X,Ge),archiveStaged:async()=>(await ae.exec(X,`test -f ${Ae} && echo staged || true`)).stdout.includes("staged"),transferArchive:async()=>{let Ge=`${process.cwd()}/.ts-cloud-move-${I}-${R}.tar.gz`;await Ao(oe,`${oe.sshUser}@${oe.endpoint}:${Ae}`,Ge),await Ao(X,Ge,`${X.sshUser}@${X.endpoint}:${Ae}`),await Bun.file(Ge).delete().catch(()=>{})},targetRoutesSite:async()=>{if(!De||!de)return!0;return(await ae.exec(X,`grep -qF ${JSON.stringify(de)} /etc/rpx/sites.d/${I}.json 2>/dev/null && echo routed || true`)).stdout.includes("routed")},refreshTargetGateway:async()=>{if(!De)throw Error(`This project does not run the rpx gateway, so the move cannot publish a route. Point ${X.name}'s web server at ${be}/current yourself, then re-run to continue.`);await no(ae,X,et({config:Te(m.sites??{},{proxy:De,slug:I,lan:yo(m)}),slug:I,preserveManagementDashboardRoutes:!0}).join(`
-`))},publishedAddress:async()=>{if(!de||!ke)return X.endpoint;let Ge=bn(ke);if(!Ge)return;return await go(B(Ge),Re(de),de,X.endpoint,"A")?X.endpoint:void 0},...ze?{database:{dump:async()=>{await no(ae,oe,["set -euo pipefail",'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',...us(Dt,ze.name,"/tmp",Pe),`mv -f "$(ls -1t /tmp/${ze.name}-*.sql.gz | head -1)" ${Le}`].join(`
-`))},dumpStaged:async()=>(await ae.exec(X,`test -s ${Le} && echo staged || true`)).stdout.includes("staged"),transferDump:async()=>{let Ge=`${process.cwd()}/.ts-cloud-move-${I}-${R}.sql.gz`;await Ao(oe,`${oe.sshUser}@${oe.endpoint}:${Le}`,Ge),await Ao(X,Ge,`${X.sshUser}@${X.endpoint}:${Le}`),await Bun.file(Ge).delete().catch(()=>{})},restore:async()=>{await no(ae,X,[...wt(Pe,m.infrastructure?.compute?.managedServices??{}),..._i(Pe,{from:Le}),`rm -f ${Le}`].join(`
-`))},targetHasData:async()=>{let Ge=Dt==="postgres"?`psql -tAc "select count(*) from information_schema.tables where table_schema='public'" -d ${ze.name} 2>/dev/null || echo 0`:`mysql -N -B -e "select count(*) from information_schema.tables where table_schema='${ze.name}'" 2>/dev/null || echo 0`,Ot=await ae.exec(X,`eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true
-${Ge}`);return Number.parseInt(Ot.stdout.trim().split(`
-`).pop()??"0",10)>0}}}:{},...De?{certificates:{inPlace:async()=>{let Ge=ud(Ve,ct),[Ot,zt]=await Promise.all([ae.exec(oe,Ge),ae.exec(X,Ge)]);return md(Ga(Ot.stdout),Ga(zt.stdout))},carry:async()=>{await no(ae,oe,pd(Ve,ct,Be));let Ge=`${process.cwd()}/.ts-cloud-move-${I}-${R}-certs.tar.gz`;if(!(await ae.exec(oe,`test -s ${Be} && echo staged || true`)).stdout.includes("staged"))return;await Ao(oe,`${oe.sshUser}@${oe.endpoint}:${Be}`,Ge),await Ao(X,Ge,`${X.sshUser}@${X.endpoint}:${Be}`),await Bun.file(Ge).delete().catch(()=>{}),await no(ae,X,fd(Ve,Be)),await ae.exec(oe,`rm -f ${Be}`)}}}:{},cutoverDns:async()=>{if(!de)return[];if(!ke)return[`No DNS provider configured — point ${de} at ${X.endpoint} manually.`];let Ge=bn(ke);if(!Ge)return[`DNS provider '${ke}' is not configured.`];return(await Ei({provider:B(Ge),zone:Re(de),fqdn:de,ipv4:X.endpoint,ipv6:te(void 0)})).warnings}},xt=await gd({slug:I,siteName:R,appBase:be,from:oe.name,to:X.name,targetAddress:X.endpoint,port:k.port,healthCheckPath:k.healthCheck?.path,database:ze},nt),Qt=await zs(xt);if(!t.apply){if(t.json){console.log(JSON.stringify({schemaVersion:1,operation:xt.operation,target:xt.target,move:{site:R,from:oe.name,to:X.name,address:X.endpoint},steps:Qt.map((Ge)=>({id:Ge.step.id,title:Ge.step.title,state:Ge.state,change:Ge.step.change,reason:Ge.reason}))},null,2));return}for(let Ge of Us(xt,Qt))console.log(Ge);console.log(`  The source keeps its files either way — reversible until ${oe.name} is destroyed.`),console.log("  Re-run with --apply to perform it.");return}let Tt=await Ws(xt,Qt,{log:(Ge)=>e(Ge),audit:(Ge)=>L.store.appendEvent({projectId:L.project.id,type:`${Ge.operation}.${Ge.step}.${Ge.state}`,level:Ge.state==="failed"?"error":"info",payload:{site:R,from:oe.name,to:X.name,...Ge.error?{error:Ge.error}:{}}})});if(t.json)console.log(JSON.stringify({schemaVersion:1,outcome:Tt},null,2));if(!Tt.success){let Ge=Tt.steps.find((Ot)=>Ot.state==="failed");throw Error(`${xt.operation} stopped at '${Ge?.title}': ${Ge?.error}. ${oe.name} still has the site and its files; re-run the same command to continue from here.`)}if(!t.json)n(`Moved ${R} from ${oe.name} to ${X.name}. ${oe.name} keeps its copy until you destroy it.`)}finally{L.store.close()}}function Ka(R){R.command("site:move <name>","Move a deployed site to another server").option("--to <server>","Target server (enrolled name or id)").option("--from <server>","Source server; inferred when only one other is enrolled").option("--apply","Perform the reviewed move plan").option("--json","Print structured JSON").action(async(t,m)=>{try{await ep(t,m)}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}}),R.command("site:add <name>","Add a site entry to cloud.config.ts").option("--config <path>","Path to cloud config file").option("--root <path>","Directory to deploy").option("--domain <domain>","Domain for the site").option("--path <path>","Path prefix for the site").option("--deploy <target>","Deployment target: server or bucket").option("--build <command>","Build command to run before deployment").option("--start <command>","Start command for server apps").option("--port <port>","Port for server apps").option("--type <type>","Site type, e.g. static, laravel, php").option("--path-rewrite-style <style>","Static rewrite style: directory or flat").option("--dry-run","Print the updated config without writing").action(async(t,m)=>{let k=m?.config||"cloud.config.ts",I=m?.root;if(!I){r("Missing --root <path>");return}if(!Zm(k)){r(`Config file not found: ${k}`);return}try{let L=Mn({configText:await Qm(k,"utf8"),name:t,root:I,domain:m?.domain,path:m?.path,deploy:tp(m?.deploy),build:m?.build,start:m?.start,port:rp(m?.port),type:m?.type,pathRewriteStyle:np(m?.pathRewriteStyle)});if(m?.dryRun){console.log(L);return}await Xm(k,L),n(`Added site '${t}' to ${k}`)}catch(L){r(L instanceof Error?L.message:String(L))}})}function tp(R){if(!R)return;if(R==="bucket"||R==="server")return R;throw Error(`Invalid --deploy '${R}'. Expected 'server' or 'bucket'.`)}function np(R){if(!R)return;if(R==="directory"||R==="flat")return R;throw Error(`Invalid --path-rewrite-style '${R}'. Expected 'directory' or 'flat'.`)}function rp(R){if(!R)return;let t=Number.parseInt(R,10);if(!Number.isInteger(t)||t<1||t>65535)throw Error(`Invalid --port '${R}'. Expected a TCP port between 1 and 65535.`);return t}import{existsSync as cp}from"node:fs";import{mkdir as lp,writeFile as dp}from"node:fs/promises";import{join as up}from"node:path";class Ro{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(R){this.config=R.config,this.environment=R.environment,this.builder=new Qo(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let t=this.config.environments[this.environment]?.infrastructure;if(!t)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...t,compute:{...this.config.infrastructure?.compute,...t.compute},storage:{...this.config.infrastructure?.storage,...t.storage},functions:{...this.config.infrastructure?.functions,...t.functions},servers:{...this.config.infrastructure?.servers,...t.servers},databases:{...this.config.infrastructure?.databases,...t.databases},cdn:{...this.config.infrastructure?.cdn,...t.cdn},sftp:t.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...t.queues},redirects:{...this.config.infrastructure?.redirects,...t.redirects},realtime:{...this.config.infrastructure?.realtime,...t.realtime},cache:{...this.config.infrastructure?.cache,...t.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...t.fileSystem},email:{...this.config.infrastructure?.email,...t.email},search:{...this.config.infrastructure?.search,...t.search},ai:{...this.config.infrastructure?.ai,...t.ai}}}}shouldDeploy(R){if(R.environments&&!R.environments.includes(this.environment))return!1;if(R.requiresFeatures){let t=this.config.features||{};if(!R.requiresFeatures.every((k)=>t[k]===!0))return!1}if(R.regions){let t=this.config.environments[this.environment]?.region||this.config.project.region;if(!R.regions.includes(t))return!1}if(R.condition&&typeof R.condition==="function")return R.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let R=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,t=Number(R||3008);return Number.isFinite(t)&&t>0?t:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(R,t){return R==="public"||t.routeCompute===!0}storageBucketName(R,t,m){return this.mergedConfig.infrastructure?.storage?.[m]?.bucket??`${R}-${t}-${m}`}fileSystemLogicalId(R,t,m){return o(l({slug:`${R}-${m}`,environment:t,resourceType:"efs"}))}resolveSftpStorage(R,t,m){let k=R.storage;if(k?.type==="efs"&&k.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[k.fileSystem])throw Error(`sftp: storage.fileSystem "${k.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(t,m,k.fileSystem)},posixProfile:k.posixProfile}}if(k?.type==="s3"&&k.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[k.storageBucket])throw Error(`sftp: storage.storageBucket "${k.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(t,m,k.storageBucket)}}return}resolveComputeCachePathPatterns(R){if(R&&R.length>0)return R;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(R,t){return{PathPattern:R,TargetOriginId:t,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(R,t,m,k,I,L){let z=this.serverEipLogicalIds.get("app"),Y=this.serverEipLogicalIds.get("appInstance");if(!z)return;let Z=`EC2-${k}-${I}-api`,X=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",ie=X==="us-east-1"?".compute-1.amazonaws.com":`.${X}.compute.amazonaws.com`,oe={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:z}]}]},ie]]},ae=this.resolveApiOriginPort();if(R.push({Id:Z,DomainName:oe,CustomOriginConfig:{HTTPPort:ae,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),m.push(z),Y)m.push(Y);for(let be of L)t.push(this.createComputeCacheBehavior(be,Z))}buildCaddyfile(R){let t=R.filter(([,I])=>typeof I.domain==="string"&&I.domain&&typeof I.port==="number");if(t.length===0)return;let m=new Map;for(let[,I]of t){let L=m.get(I.domain)??[];L.push({port:I.port,path:I.path}),m.set(I.domain,L)}let k=[];for(let[I,L]of m){let Y=[...L].sort((Z,X)=>{let ie=!Z.path||Z.path==="/",oe=!X.path||X.path==="/";if(ie&&!oe)return 1;if(!ie&&oe)return-1;return(X.path?.length??0)-(Z.path?.length??0)}).map((Z)=>{let X=!Z.path||Z.path==="/",ie=`reverse_proxy localhost:${Z.port}`;return X?`  handle {
-    ${ie}
+`)){let k=m.trim();if(!k.startsWith("cert:"))continue;let[,I,L]=k.split(":");if(I&&L)t.set(I,L)}return t}function md(R,t){for(let[m,k]of R){if(k==="absent")continue;if(t.get(m)!==k)return!1}return!0}function pd(R,t,m){let k=t.flatMap((I)=>[`${I}.crt`,`${I}.key`]);return["set -eu",`rm -f ${Nt(m)}`,`cd ${Nt(R)} 2>/dev/null || { echo "no certs dir at ${R}" >&2; exit 0; }`,`TS_CLOUD_CERTS="$(ls ${k.map(Nt).join(" ")} 2>/dev/null | tr '\\n' ' ' || true)"`,'[ -n "$TS_CLOUD_CERTS" ] || { echo "no certificates to carry"; exit 0; }',`tar czf ${Nt(m)} $TS_CLOUD_CERTS`].join(`
+`)}function fd(R,t){return["set -eu",`[ -s ${Nt(t)} ] || { echo "no certificate archive staged"; exit 0; }`,`mkdir -p ${Nt(R)}`,`tar xzf ${Nt(t)} -C ${Nt(R)}`,`chmod 600 ${Nt(R)}/*.key 2>/dev/null || true`,`rm -f ${Nt(t)}`].join(`
+`)}async function gd(R,t){let{slug:m,siteName:k,appBase:I,from:L,to:z,targetAddress:Y}=R;if(L===z)throw Error(`'${k}' is already on ${z}.`);if(R.database&&!t.database)throw Error(`'${k}' uses the on-box database '${R.database.name}', which lives in the engine's own data directory rather than in the site tree, and this move has no way to carry it. Moving the site without it would cut traffic over to an empty database.`);if(R.database&&t.database&&await t.database.targetHasData())throw Error(`${z} already has a database named '${R.database.name}' with tables in it. Restoring this site's dump over it would destroy that data. Rename or drop it on the target first, or point this project at a different database name.`);let Z=[{id:"pause-workers",title:`Stop background work on ${L} so the snapshot is consistent`,satisfied:async()=>Um(await t.runOnSource(zm(m,k))),apply:async()=>{await t.runOnSource(Mm(m,k))}},...t.database?[{id:"database-dump",title:`Dump the '${R.database?.name}' database on ${L}`,satisfied:async()=>!1,apply:()=>t.database.dump()}]:[],{id:"snapshot",title:`Archive the site's tree and units on ${L}`,change:{from:`${L}:${I}`,to:fo(m,k)},satisfied:async()=>!1,apply:async()=>{await t.runOnSource(Wm(m,k,I))}},{id:"transfer",title:`Carry the archive to ${z}`,change:{from:L,to:z},satisfied:()=>t.archiveStaged(),apply:()=>t.transferArchive()},...t.database?[{id:"database-transfer",title:`Carry the database dump to ${z}`,change:{from:L,to:z},satisfied:()=>t.database.dumpStaged(),apply:()=>t.database.transferDump()},{id:"database-restore",title:`Create and load '${R.database?.name}' on ${z}`,satisfied:async()=>!1,apply:()=>t.database.restore()}]:[],{id:"restore",title:`Unpack the site on ${z} and start it`,change:{from:fo(m,k),to:`${z}:${I}`},satisfied:async()=>Hm(await t.runOnTarget(qm(m,k,I))),apply:async()=>{await t.runOnTarget(Vm(m,k,I))}}];if(R.port!=null){let{port:X}=R;Z.push({id:"health",title:`Wait for the site to answer on ${z} (127.0.0.1:${X})`,satisfied:async()=>!1,apply:async()=>{await t.runOnTarget(Gm(X,R.healthCheckPath??"/"))}})}return Z.push(...t.certificates?[{id:"certificates",title:`Carry the site's TLS material to ${z}`,satisfied:()=>t.certificates.inPlace(),apply:()=>t.certificates.carry()}]:[],{id:"gateway",title:`Route the site on ${z}`,satisfied:()=>t.targetRoutesSite(),apply:()=>t.refreshTargetGateway()},{id:"dns",title:`Point DNS at ${z}`,change:{from:`${L}`,to:Y},satisfied:async()=>await t.publishedAddress()===Y,apply:async()=>{let X=await t.cutoverDns();if(X.length>0)throw Error(X.join("; "))}},{id:"drain-source",title:`Stop the site on ${L}, leaving its files in place`,satisfied:async()=>Ym(await t.runOnSource(Jm(m,k))),apply:async()=>{await t.runOnSource(Km(m,k))}}),{operation:"site:move",target:k,steps:Z}}async function Zi(R,t,m){let k=await R.exec(t,m);if(k.code!==0)throw Error(`${t.name}: ${k.stderr.trim()||k.stdout.trim()||`exited ${k.code}`}`);return k.stdout}async function go(R,t,m){let k=Bun.spawn(["scp","-P",String(R.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes",t,m],{stdout:"pipe",stderr:"pipe"}),[I,L]=await Promise.all([k.exited,new Response(k.stderr).text()]);if(I!==0)throw Error(`scp failed: ${L.trim()||`exited ${I}`}`)}async function ep(R,t){if(!t.to)throw Error("Name the target server with --to <server>.");let m=await De(),k=m.sites?.[R];if(!k)throw Error(`Site '${R}' is not in cloud.config.ts.`);let I=m.project.slug,L=y(process.cwd(),m);try{let Y=new _e(L.store).list(L.project.id),Z=(qe)=>{let xt=Y.find((Ot)=>Ot.id===qe||Ot.name===qe);if(!xt)throw Error(`Server ${qe} was not found. Run \`cloud server:list\`.`);if(xt.trustState!=="pinned")throw Error(`${xt.name} has no pinned host key. Run \`cloud server:validate ${xt.name}\` first.`);return xt},X=Z(t.to),ee=Y.filter((qe)=>qe.id!==X.id);if(!t.from&&ee.length!==1)throw Error(`Name the source server with --from <server> — ${ee.length} others are enrolled.`);let oe=Z(t.from??ee[0].name),se=new Wr,ue=W(I,R),ke=fo(I,R),ce=k.domain,Se=m.infrastructure?.dns?.provider,xe=m.infrastructure?.compute?.proxy?.engine==="rpx"?m.infrastructure.compute.proxy:void 0,ve=m.infrastructure?.dns?.domain,Re=(qe)=>ve&&qe.endsWith(ve)?ve:qe.split(".").slice(-2).join("."),Ie=w(m),Me=Ie?.name&&fn(Ie)?{name:Ie.name}:void 0,Ne=`/tmp/ts-cloud-move-${I}-${R}.sql.gz`,Fe=dd(I,R),ze=xe?.certsDir??ln,ot=[ce,...k.aliases??[]].filter((qe)=>!!qe),wt=Ie?.engine??"mysql",He={runOnSource:(qe)=>Zi(se,oe,qe),runOnTarget:(qe)=>Zi(se,X,qe),archiveStaged:async()=>(await se.exec(X,`test -f ${ke} && echo staged || true`)).stdout.includes("staged"),transferArchive:async()=>{let qe=`${process.cwd()}/.ts-cloud-move-${I}-${R}.tar.gz`;await go(oe,`${oe.sshUser}@${oe.endpoint}:${ke}`,qe),await go(X,qe,`${X.sshUser}@${X.endpoint}:${ke}`),await Bun.file(qe).delete().catch(()=>{})},targetRoutesSite:async()=>{if(!xe||!ce)return!0;return(await se.exec(X,`grep -qF ${JSON.stringify(ce)} /etc/rpx/sites.d/${I}.json 2>/dev/null && echo routed || true`)).stdout.includes("routed")},refreshTargetGateway:async()=>{if(!xe)throw Error(`This project does not run the rpx gateway, so the move cannot publish a route. Point ${X.name}'s web server at ${ue}/current yourself, then re-run to continue.`);await Zi(se,X,rt({config:Ee(m.sites??{},{proxy:xe,slug:I,lan:To(m)}),slug:I,preserveManagementDashboardRoutes:!0}).join(`
+`))},publishedAddress:async()=>{if(!ce||!Se)return X.endpoint;let qe=yn(Se);if(!qe)return;return await So(B(qe),Re(ce),ce,X.endpoint,"A")?X.endpoint:void 0},...Me?{database:{dump:async()=>{await Zi(se,oe,["set -euo pipefail",'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',...Ss(wt,Me.name,"/tmp",Ie),`mv -f "$(ls -1t /tmp/${Me.name}-*.sql.gz | head -1)" ${Ne}`].join(`
+`))},dumpStaged:async()=>(await se.exec(X,`test -s ${Ne} && echo staged || true`)).stdout.includes("staged"),transferDump:async()=>{let qe=`${process.cwd()}/.ts-cloud-move-${I}-${R}.sql.gz`;await go(oe,`${oe.sshUser}@${oe.endpoint}:${Ne}`,qe),await go(X,qe,`${X.sshUser}@${X.endpoint}:${Ne}`),await Bun.file(qe).delete().catch(()=>{})},restore:async()=>{await Zi(se,X,[...Rt(Ie,m.infrastructure?.compute?.managedServices??{}),...$i(Ie,{from:Ne}),`rm -f ${Ne}`].join(`
+`))},targetHasData:async()=>{let qe=wt==="postgres"?`psql -tAc "select count(*) from information_schema.tables where table_schema='public'" -d ${Me.name} 2>/dev/null || echo 0`:`mysql -N -B -e "select count(*) from information_schema.tables where table_schema='${Me.name}'" 2>/dev/null || echo 0`,xt=await se.exec(X,`eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true
+${qe}`);return Number.parseInt(xt.stdout.trim().split(`
+`).pop()??"0",10)>0}}}:{},...xe?{certificates:{inPlace:async()=>{let qe=ud(ze,ot),[xt,Ot]=await Promise.all([se.exec(oe,qe),se.exec(X,qe)]);return md(Ga(xt.stdout),Ga(Ot.stdout))},carry:async()=>{await Zi(se,oe,pd(ze,ot,Fe));let qe=`${process.cwd()}/.ts-cloud-move-${I}-${R}-certs.tar.gz`;if(!(await se.exec(oe,`test -s ${Fe} && echo staged || true`)).stdout.includes("staged"))return;await go(oe,`${oe.sshUser}@${oe.endpoint}:${Fe}`,qe),await go(X,qe,`${X.sshUser}@${X.endpoint}:${Fe}`),await Bun.file(qe).delete().catch(()=>{}),await Zi(se,X,fd(ze,Fe)),await se.exec(oe,`rm -f ${Fe}`)}}}:{},cutoverDns:async()=>{if(!ce)return[];if(!Se)return[`No DNS provider configured — point ${ce} at ${X.endpoint} manually.`];let qe=yn(Se);if(!qe)return[`DNS provider '${Se}' is not configured.`];return(await Ai({provider:B(qe),zone:Re(ce),fqdn:ce,ipv4:X.endpoint,ipv6:re(void 0)})).warnings}},dt=await gd({slug:I,siteName:R,appBase:ue,from:oe.name,to:X.name,targetAddress:X.endpoint,port:k.port,healthCheckPath:k.healthCheck?.path,database:Me},He),Jt=await Es(dt);if(!t.apply){if(t.json){console.log(JSON.stringify({schemaVersion:1,operation:dt.operation,target:dt.target,move:{site:R,from:oe.name,to:X.name,address:X.endpoint},steps:Jt.map((qe)=>({id:qe.step.id,title:qe.step.title,state:qe.state,change:qe.step.change,reason:qe.reason}))},null,2));return}for(let qe of Ns(dt,Jt))console.log(qe);console.log(`  The source keeps its files either way — reversible until ${oe.name} is destroyed.`),console.log("  Re-run with --apply to perform it.");return}let At=await Ls(dt,Jt,{log:(qe)=>e(qe),audit:(qe)=>L.store.appendEvent({projectId:L.project.id,type:`${qe.operation}.${qe.step}.${qe.state}`,level:qe.state==="failed"?"error":"info",payload:{site:R,from:oe.name,to:X.name,...qe.error?{error:qe.error}:{}}})});if(t.json)console.log(JSON.stringify({schemaVersion:1,outcome:At},null,2));if(!At.success){let qe=At.steps.find((xt)=>xt.state==="failed");throw Error(`${dt.operation} stopped at '${qe?.title}': ${qe?.error}. ${oe.name} still has the site and its files; re-run the same command to continue from here.`)}if(!t.json)n(`Moved ${R} from ${oe.name} to ${X.name}. ${oe.name} keeps its copy until you destroy it.`)}finally{L.store.close()}}function Ka(R){R.command("site:move <name>","Move a deployed site to another server").option("--to <server>","Target server (enrolled name or id)").option("--from <server>","Source server; inferred when only one other is enrolled").option("--apply","Perform the reviewed move plan").option("--json","Print structured JSON").action(async(t,m)=>{try{await ep(t,m)}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}}),R.command("site:add <name>","Add a site entry to cloud.config.ts").option("--config <path>","Path to cloud config file").option("--root <path>","Directory to deploy").option("--domain <domain>","Domain for the site").option("--path <path>","Path prefix for the site").option("--deploy <target>","Deployment target: server or bucket").option("--build <command>","Build command to run before deployment").option("--start <command>","Start command for server apps").option("--port <port>","Port for server apps").option("--type <type>","Site type, e.g. static, laravel, php").option("--path-rewrite-style <style>","Static rewrite style: directory or flat").option("--dry-run","Print the updated config without writing").action(async(t,m)=>{let k=m?.config||"cloud.config.ts",I=m?.root;if(!I){r("Missing --root <path>");return}if(!Zm(k)){r(`Config file not found: ${k}`);return}try{let L=Bn({configText:await Qm(k,"utf8"),name:t,root:I,domain:m?.domain,path:m?.path,deploy:tp(m?.deploy),build:m?.build,start:m?.start,port:rp(m?.port),type:m?.type,pathRewriteStyle:np(m?.pathRewriteStyle)});if(m?.dryRun){console.log(L);return}await Xm(k,L),n(`Added site '${t}' to ${k}`)}catch(L){r(L instanceof Error?L.message:String(L))}})}function tp(R){if(!R)return;if(R==="bucket"||R==="server")return R;throw Error(`Invalid --deploy '${R}'. Expected 'server' or 'bucket'.`)}function np(R){if(!R)return;if(R==="directory"||R==="flat")return R;throw Error(`Invalid --path-rewrite-style '${R}'. Expected 'directory' or 'flat'.`)}function rp(R){if(!R)return;let t=Number.parseInt(R,10);if(!Number.isInteger(t)||t<1||t>65535)throw Error(`Invalid --port '${R}'. Expected a TCP port between 1 and 65535.`);return t}import{existsSync as cp}from"node:fs";import{mkdir as lp,writeFile as dp}from"node:fs/promises";import{join as up}from"node:path";class yo{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(R){this.config=R.config,this.environment=R.environment,this.builder=new rs(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let t=this.config.environments[this.environment]?.infrastructure;if(!t)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...t,compute:{...this.config.infrastructure?.compute,...t.compute},storage:{...this.config.infrastructure?.storage,...t.storage},functions:{...this.config.infrastructure?.functions,...t.functions},servers:{...this.config.infrastructure?.servers,...t.servers},databases:{...this.config.infrastructure?.databases,...t.databases},cdn:{...this.config.infrastructure?.cdn,...t.cdn},sftp:t.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...t.queues},redirects:{...this.config.infrastructure?.redirects,...t.redirects},realtime:{...this.config.infrastructure?.realtime,...t.realtime},cache:{...this.config.infrastructure?.cache,...t.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...t.fileSystem},email:{...this.config.infrastructure?.email,...t.email},search:{...this.config.infrastructure?.search,...t.search},ai:{...this.config.infrastructure?.ai,...t.ai}}}}shouldDeploy(R){if(R.environments&&!R.environments.includes(this.environment))return!1;if(R.requiresFeatures){let t=this.config.features||{};if(!R.requiresFeatures.every((k)=>t[k]===!0))return!1}if(R.regions){let t=this.config.environments[this.environment]?.region||this.config.project.region;if(!R.regions.includes(t))return!1}if(R.condition&&typeof R.condition==="function")return R.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let R=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,t=Number(R||3008);return Number.isFinite(t)&&t>0?t:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(R,t){return R==="public"||t.routeCompute===!0}storageBucketName(R,t,m){return this.mergedConfig.infrastructure?.storage?.[m]?.bucket??`${R}-${t}-${m}`}fileSystemLogicalId(R,t,m){return o(l({slug:`${R}-${m}`,environment:t,resourceType:"efs"}))}resolveSftpStorage(R,t,m){let k=R.storage;if(k?.type==="efs"&&k.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[k.fileSystem])throw Error(`sftp: storage.fileSystem "${k.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(t,m,k.fileSystem)},posixProfile:k.posixProfile}}if(k?.type==="s3"&&k.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[k.storageBucket])throw Error(`sftp: storage.storageBucket "${k.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(t,m,k.storageBucket)}}return}resolveComputeCachePathPatterns(R){if(R&&R.length>0)return R;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(R,t){return{PathPattern:R,TargetOriginId:t,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(R,t,m,k,I,L){let z=this.serverEipLogicalIds.get("app"),Y=this.serverEipLogicalIds.get("appInstance");if(!z)return;let Z=`EC2-${k}-${I}-api`,X=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",ee=X==="us-east-1"?".compute-1.amazonaws.com":`.${X}.compute.amazonaws.com`,oe={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:z}]}]},ee]]},se=this.resolveApiOriginPort();if(R.push({Id:Z,DomainName:oe,CustomOriginConfig:{HTTPPort:se,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),m.push(z),Y)m.push(Y);for(let ue of L)t.push(this.createComputeCacheBehavior(ue,Z))}buildCaddyfile(R){let t=R.filter(([,I])=>typeof I.domain==="string"&&I.domain&&typeof I.port==="number");if(t.length===0)return;let m=new Map;for(let[,I]of t){let L=m.get(I.domain)??[];L.push({port:I.port,path:I.path}),m.set(I.domain,L)}let k=[];for(let[I,L]of m){let Y=[...L].sort((Z,X)=>{let ee=!Z.path||Z.path==="/",oe=!X.path||X.path==="/";if(ee&&!oe)return 1;if(!ee&&oe)return-1;return(X.path?.length??0)-(Z.path?.length??0)}).map((Z)=>{let X=!Z.path||Z.path==="/",ee=`reverse_proxy localhost:${Z.port}`;return X?`  handle {
+    ${ee}
   }`:`  handle ${Z.path} {
-    ${ie}
+    ${ee}
   }`});k.push(`${I} {
 ${Y.join(`
 `)}
 }`)}return k.join(`
 
-`)}normalizeMountPath(R){let t=R?.mountPath||R?.path;if(!t||t==="/")return;let m=`/${t}`.replace(/\/+/g,"/").replace(/\/$/,"");return m==="/"?void 0:m}storageBucketLogicalId(R,t,m){return`${R}-${t}-s3-${m}`.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((k)=>k.charAt(0).toUpperCase()+k.slice(1)).join("")}pathMountRewriteFunctionCode(R,t="directory"){return`function handler(event) { var request = event.request; var prefix = ${JSON.stringify(R)}; var rewriteStyle = ${JSON.stringify(t)}; var uri = request.uri; if (uri === prefix) { uri = '/'; } else if (uri.indexOf(prefix + '/') === 0) { uri = uri.substring(prefix.length); } if (uri === '' || uri === '/') { request.uri = '/index.html'; return request; } if (uri.endsWith('/')) { request.uri = uri + 'index.html'; return request; } var lastSegment = uri.substring(uri.lastIndexOf('/') + 1); if (lastSegment.indexOf('.') === -1) { request.uri = rewriteStyle === 'flat' ? uri + '.html' : uri + '/index.html'; return request; } request.uri = uri; return request; }`}generate(){let R=this.mergedConfig.project.slug,t=this.environment,m=!!(this.mergedConfig.infrastructure?.functions&&Object.keys(this.mergedConfig.infrastructure.functions).length>0||this.mergedConfig.infrastructure?.api),k=!!(this.mergedConfig.infrastructure?.servers&&Object.keys(this.mergedConfig.infrastructure.servers).length>0),I=!!this.mergedConfig.infrastructure?.compute;if(!!((this.mergedConfig.mode||"server")==="serverless"&&this.mergedConfig.infrastructure?.containers&&Object.keys(this.mergedConfig.infrastructure.containers).length>0))this.generateNetworkInfrastructure(R,t),this.generateContainerInfrastructure(R,t);if(m)this.generateServerless(R,t);if(k)this.generateServer(R,t);if(I)this.generateComputeApp(R,t);if(this.mergedConfig.infrastructure?.jumpBox)this.generateJumpBox(R,t);if(this.storageFailoverReplicas=[],this.generateSharedInfrastructure(R,t),this.storageFailoverReplicas.length>0)this.builder.addMetadata(es,this.storageFailoverReplicas);if(this.config.tags)this.applyGlobalTags(this.config.tags);return this}getStorageFailoverReplicas(){return[...this.storageFailoverReplicas]}applyGlobalTags(R){}generateNetworkInfrastructure(R,t){if(this.builder.hasResource("VPC"))return;let k=this.mergedConfig.infrastructure?.network?.cidr||"10.0.0.0/16",{vpc:I,logicalId:L}=M.createVpc({slug:R,environment:t,cidr:k,enableDnsHostnames:!0,enableDnsSupport:!0});this.builder.addResource("VPC",I);let z=`${R}${t}IGW`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(z,{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:`${R}-${t}-igw`},{Key:"Environment",Value:t}]}});let Y=`${R}${t}IGWAttach`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Y,{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:{Ref:"VPC"},InternetGatewayId:{Ref:z}}});let Z=`${R}${t}PublicRT`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Z,{Type:"AWS::EC2::RouteTable",Properties:{VpcId:{Ref:"VPC"},Tags:[{Key:"Name",Value:`${R}-${t}-public-rt`},{Key:"Environment",Value:t}]}}),this.builder.addResource(`${R}${t}PublicRoute`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::EC2::Route",Properties:{RouteTableId:{Ref:Z},DestinationCidrBlock:"0.0.0.0/0",GatewayId:{Ref:z}},DependsOn:Y});let X=this.mergedConfig.environments[t]?.region||this.mergedConfig.project.region||"us-east-1",ie=["a","b"];for(let oe=0;oe<2;oe++){let ae=`PublicSubnet${oe+1}`;this.builder.addResource(ae,{Type:"AWS::EC2::Subnet",Properties:{VpcId:{Ref:"VPC"},CidrBlock:`10.0.${oe}.0/24`,AvailabilityZone:`${X}${ie[oe]}`,MapPublicIpOnLaunch:!0,Tags:[{Key:"Name",Value:`${R}-${t}-public-${ie[oe]}`},{Key:"Environment",Value:t}]}}),this.builder.addResource(`${ae}RTAssoc`,{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:{Ref:ae},RouteTableId:{Ref:Z}}})}}generateContainerInfrastructure(R,t){let m=this.mergedConfig.infrastructure?.containers;if(!m)return;let k=this.mergedConfig.infrastructure?.loadBalancer,I=this.mergedConfig.infrastructure?.ssl,L=this.mergedConfig.infrastructure?.dns,z;if(I?.enabled&&I.domains?.length)if(I.certificateArn);else{let ie=I.domains[0],oe=I.domains.slice(1).map((Ae)=>{if(Ae.includes(".")&&Ae.endsWith(ie))return Ae.replace(`.${ie}`,"");return Ae}),{certificate:ae,logicalId:be}=j.createCertificate({domain:ie,subdomains:oe,slug:R,environment:t,validationMethod:"DNS",hostedZoneId:L?.hostedZoneId});z=be,this.builder.addResource(be,ae)}let Y="ECSCluster";this.builder.addResource(Y,{Type:"AWS::ECS::Cluster",Properties:{ClusterName:`${R}-${t}`,ClusterSettings:[{Name:"containerInsights",Value:"enabled"}],Tags:[{Key:"Name",Value:`${R}-${t}`},{Key:"Environment",Value:t}]}});let Z=`${R}${t}ALBSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Z,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ALB security group for ${R}-${t}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:80,ToPort:80,CidrIp:"0.0.0.0/0",Description:"HTTP"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${R}-${t}-alb-sg`},{Key:"Environment",Value:t}]}});let X=`${R}${t}ECSSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");for(let[ie,oe]of Object.entries(m)){let ae=oe.port||3000;this.builder.addResource(X,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ECS tasks security group for ${R}-${t}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:ae,ToPort:ae,SourceSecurityGroupId:{Ref:Z},Description:"Allow traffic from ALB"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${R}-${t}-ecs-sg`},{Key:"Environment",Value:t}]}});let be=`${R}${t}TaskExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(be,{Type:"AWS::IAM::Role",Properties:{RoleName:`${R}-${t}-ecs-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"],Policies:[{PolicyName:"ECRPullPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"}]}}]}});let Ae=`${R}${t}TaskRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ae,{Type:"AWS::IAM::Role",Properties:{RoleName:`${R}-${t}-ecs-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"TaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:ListBucket"],Resource:"*"}]}}]}});let de=`${R}${t}${ie}LogGroup`.replace(/[^a-zA-Z0-9]/g,""),ke=`/ecs/${R}-${t}-${ie}`;this.builder.addResource(de,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:ke,RetentionInDays:30}});let De=`${R}${t}${ie}TaskDef`.replace(/[^a-zA-Z0-9]/g,""),Se=String(oe.cpu||512),Re=String(oe.memory||1024);this.builder.addResource(De,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${R}-${t}-${ie}`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:Se,Memory:Re,ExecutionRoleArn:{"Fn::GetAtt":[be,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[Ae,"Arn"]},ContainerDefinitions:[{Name:ie,Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${R}:latest`},Essential:!0,PortMappings:[{ContainerPort:ae,Protocol:"tcp"}],LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":ke,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":ie}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${ae}${oe.healthCheck||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${R}-${t}-${ie}`},{Key:"Environment",Value:t}]},DependsOn:[be,Ae,de]});let Pe=`${R}${t}ALB`.replace(/[^a-zA-Z0-9]/g,"");if(k?.enabled!==!1){this.builder.addResource(Pe,{Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:`${R}-${t}-alb`,Scheme:"internet-facing",Type:"application",Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],SecurityGroups:[{Ref:Z}],Tags:[{Key:"Name",Value:`${R}-${t}-alb`},{Key:"Environment",Value:t}]}});let ze=`${R}${t}TargetGroup`.replace(/[^a-zA-Z0-9]/g,""),Le=k?.healthCheck?.path||oe.healthCheck||"/health";this.builder.addResource(ze,{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:`${R}-${t}-tg`,Port:ae,Protocol:"HTTP",VpcId:{Ref:"VPC"},TargetType:"ip",HealthCheckPath:Le,HealthCheckIntervalSeconds:k?.healthCheck?.interval||30,HealthyThresholdCount:k?.healthCheck?.healthyThreshold||2,UnhealthyThresholdCount:k?.healthCheck?.unhealthyThreshold||5,HealthCheckTimeoutSeconds:10,Tags:[{Key:"Name",Value:`${R}-${t}-tg`},{Key:"Environment",Value:t}]}});let Be=`${R}${t}HTTPListener`.replace(/[^a-zA-Z0-9]/g,"");if(I?.enabled&&I?.redirectHttp)this.builder.addResource(Be,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Pe},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"redirect",RedirectConfig:{Protocol:"HTTPS",Port:"443",StatusCode:"HTTP_301"}}]}});else this.builder.addResource(Be,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Pe},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:ze}}]}});if(I?.enabled){let nt=I.certificateArn||(z?{Ref:z}:void 0);if(nt){let xt=`${R}${t}HTTPSListener`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(xt,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Pe},Port:443,Protocol:"HTTPS",Certificates:[{CertificateArn:nt}],DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:ze}}],SslPolicy:"ELBSecurityPolicy-TLS13-1-2-2021-06"}})}}let Ve=`${R}${t}${ie}Service`.replace(/[^a-zA-Z0-9]/g,""),ct=oe.desiredCount||1;this.builder.addResource(Ve,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${R}-${t}-${ie}`,Cluster:{Ref:Y},TaskDefinition:{Ref:De},DesiredCount:ct,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:X}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},LoadBalancers:[{ContainerName:ie,ContainerPort:ae,TargetGroupArn:{Ref:ze}}],HealthCheckGracePeriodSeconds:120,Tags:[{Key:"Name",Value:`${R}-${t}-${ie}`},{Key:"Environment",Value:t}]},DependsOn:[De,Be,ze]});let Dt=oe.autoScaling;if(Dt){let nt=`${R}${t}${ie}ScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(nt,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:Dt.max||10,MinCapacity:Dt.min||1,ResourceId:{"Fn::Sub":`service/\${${Y}}/${R}-${t}-${ie}`},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs",RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"}},DependsOn:Ve}),Dt.targetCpuUtilization)this.builder.addResource(`${R}${t}${ie}CPUScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${R}-${t}-${ie}-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:nt},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:Dt.targetCpuUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}});if(Dt.targetMemoryUtilization)this.builder.addResource(`${R}${t}${ie}MemoryScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${R}-${t}-${ie}-memory-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:nt},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageMemoryUtilization"},TargetValue:Dt.targetMemoryUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(L?.domain&&L?.hostedZoneId)this.builder.addResource(`${R}${t}ApiDnsRecord`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:L.hostedZoneId,Name:`api.${L.domain}`,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[Pe,"DNSName"]},HostedZoneId:{"Fn::GetAtt":[Pe,"CanonicalHostedZoneID"]}}}});this.builder.addOutput("ECSClusterArn",{Description:"ECS Cluster ARN",Value:{"Fn::GetAtt":[Y,"Arn"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-cluster-arn"}}}),this.builder.addOutput("ECSServiceName",{Description:"ECS Service Name",Value:`${R}-${t}-${ie}`,Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-service-name"}}}),this.builder.addOutput("LoadBalancerDNS",{Description:"Application Load Balancer DNS Name",Value:{"Fn::GetAtt":[Pe,"DNSName"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-alb-dns"}}})}else{let ze=`${R}${t}${ie}Service`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ze,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${R}-${t}-${ie}`,Cluster:{Ref:Y},TaskDefinition:{Ref:De},DesiredCount:oe.desiredCount||1,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:X}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},Tags:[{Key:"Name",Value:`${R}-${t}-${ie}`},{Key:"Environment",Value:t}]},DependsOn:[De]})}break}}generateServerless(R,t){if(this.mergedConfig.infrastructure?.functions)for(let[m,k]of Object.entries(this.mergedConfig.infrastructure.functions)){if(!this.shouldDeploy(k))continue;let{role:I,logicalId:L}=Ie.createRole({slug:R,environment:t,roleName:`${R}-${t}-${m}-role`,servicePrincipal:"lambda.amazonaws.com",managedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]});this.builder.addResource(L,I);let{lambdaFunction:z,logicalId:Y}=b.createLambdaFunction({slug:R,environment:t,functionName:`${R}-${t}-${m}`,handler:k.handler||"index.handler",runtime:k.runtime||"nodejs20.x",code:{zipFile:k.code||"export const handler = async () => ({ statusCode: 200 });"},role:L,timeout:k.timeout,memorySize:k.memorySize});this.builder.addResource(Y,z)}if(this.mergedConfig.infrastructure?.api){let{restApi:m,logicalId:k}=ns.createRestApi({slug:R,environment:t,apiName:`${R}-${t}-api`});this.builder.addResource(k,m)}}generateServer(R,t){if(!this.mergedConfig.infrastructure?.servers)return;let m=this.mergedConfig.infrastructure.servers,k=this.mergedConfig.infrastructure?.compute,I=this.mergedConfig.infrastructure?.ssl;if(Object.values(m).some((z)=>!z.privateNetwork||z.privateNetwork==="create"))this.generateNetworkInfrastructure(R,t);for(let[z,Y]of Object.entries(m)){let Z=Y.instanceType||Y.size||k?.size,ie=(Z?b.InstanceSize.specs[Z]:void 0)?.instanceType||Z||"t3.micro",oe=Y.type||"app",ae=Y.userData||Y.startupScript;if(!ae)ae=b.UserData.generateAppServerScript({runtime:"bun",runtimeVersion:Y.bunVersion||"latest",webServer:"none",domain:Y.domain,enableSsl:!!I?.enabled,sslEmail:I?.letsEncrypt?.email,installRedis:oe==="cache",installDatabaseClients:!!Y.database});let be=Y.privateNetwork&&Y.privateNetwork!=="create"?Y.privateNetwork:{Ref:"VPC"},Ae=Y.subnet||{Ref:"PublicSubnet1"},ke=!!this.mergedConfig.infrastructure?.email?.server?.enabled,De=[22,80,443,this.resolveApiOriginPort()];if(ke)De.push(25,465,587,143,993);let Se=b.createServerModeStack({slug:`${R}-${z}`,environment:t,vpcId:be,subnetId:Ae,instanceType:ie,keyName:Y.keyName||`${R}-${t}`,domain:Y.domain,userData:ae,volumeSize:Y.diskSize||20,imageId:Y.image,allowedPorts:De});for(let[Re,Pe]of Object.entries(Se.resources))this.builder.addResource(Re,Pe);this.serverEipLogicalIds.set(z,Se.outputs.eipLogicalId),this.serverEipLogicalIds.set(`${z}Instance`,Se.outputs.instanceLogicalId),this.builder.addOutput(`${z}InstanceId`,{Value:{Ref:Se.outputs.instanceLogicalId},Description:`Instance ID for ${z} server`}),this.builder.addOutput(`${z}PublicIp`,{Value:{Ref:Se.outputs.eipLogicalId},Description:`Public IP for ${z} server`})}}generateComputeApp(R,t){let m=this.mergedConfig.infrastructure?.compute;if(!m)return;let k=this.mergedConfig.sites||{},I=Object.entries(k),z=this.mergedConfig.infrastructure?.dns?.domain,Y=this.mergedConfig.infrastructure?.database,Z=m.size,ie=(Z?b.InstanceSize.specs[Z]:void 0)?.instanceType||Z||"t3.micro";if(!this.builder.hasResource("VPC"))this.generateNetworkInfrastructure(R,t);let oe=this.buildCaddyfile(I),ae=b.UserData.generateBunAppScript({runtime:m.runtime||"bun",runtimeVersion:m.runtimeVersion||"latest",systemPackages:m.systemPackages,database:Y,caddyfile:oe}),be=fo(m.appUpdates),Ae=be.length>0?`${ae}
-${be.join(`
+`)}normalizeMountPath(R){let t=R?.mountPath||R?.path;if(!t||t==="/")return;let m=`/${t}`.replace(/\/+/g,"/").replace(/\/$/,"");return m==="/"?void 0:m}storageBucketLogicalId(R,t,m){return`${R}-${t}-s3-${m}`.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((k)=>k.charAt(0).toUpperCase()+k.slice(1)).join("")}pathMountRewriteFunctionCode(R,t="directory"){return`function handler(event) { var request = event.request; var prefix = ${JSON.stringify(R)}; var rewriteStyle = ${JSON.stringify(t)}; var uri = request.uri; if (uri === prefix) { uri = '/'; } else if (uri.indexOf(prefix + '/') === 0) { uri = uri.substring(prefix.length); } if (uri === '' || uri === '/') { request.uri = '/index.html'; return request; } if (uri.endsWith('/')) { request.uri = uri + 'index.html'; return request; } var lastSegment = uri.substring(uri.lastIndexOf('/') + 1); if (lastSegment.indexOf('.') === -1) { request.uri = rewriteStyle === 'flat' ? uri + '.html' : uri + '/index.html'; return request; } request.uri = uri; return request; }`}generate(){let R=this.mergedConfig.project.slug,t=this.environment,m=!!(this.mergedConfig.infrastructure?.functions&&Object.keys(this.mergedConfig.infrastructure.functions).length>0||this.mergedConfig.infrastructure?.api),k=!!(this.mergedConfig.infrastructure?.servers&&Object.keys(this.mergedConfig.infrastructure.servers).length>0),I=!!this.mergedConfig.infrastructure?.compute;if(!!((this.mergedConfig.mode||"server")==="serverless"&&this.mergedConfig.infrastructure?.containers&&Object.keys(this.mergedConfig.infrastructure.containers).length>0))this.generateNetworkInfrastructure(R,t),this.generateContainerInfrastructure(R,t);if(m)this.generateServerless(R,t);if(k)this.generateServer(R,t);if(I)this.generateComputeApp(R,t);if(this.mergedConfig.infrastructure?.jumpBox)this.generateJumpBox(R,t);if(this.storageFailoverReplicas=[],this.generateSharedInfrastructure(R,t),this.storageFailoverReplicas.length>0)this.builder.addMetadata(os,this.storageFailoverReplicas);if(this.config.tags)this.applyGlobalTags(this.config.tags);return this}getStorageFailoverReplicas(){return[...this.storageFailoverReplicas]}applyGlobalTags(R){}generateNetworkInfrastructure(R,t){if(this.builder.hasResource("VPC"))return;let k=this.mergedConfig.infrastructure?.network?.cidr||"10.0.0.0/16",{vpc:I,logicalId:L}=M.createVpc({slug:R,environment:t,cidr:k,enableDnsHostnames:!0,enableDnsSupport:!0});this.builder.addResource("VPC",I);let z=`${R}${t}IGW`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(z,{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:`${R}-${t}-igw`},{Key:"Environment",Value:t}]}});let Y=`${R}${t}IGWAttach`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Y,{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:{Ref:"VPC"},InternetGatewayId:{Ref:z}}});let Z=`${R}${t}PublicRT`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Z,{Type:"AWS::EC2::RouteTable",Properties:{VpcId:{Ref:"VPC"},Tags:[{Key:"Name",Value:`${R}-${t}-public-rt`},{Key:"Environment",Value:t}]}}),this.builder.addResource(`${R}${t}PublicRoute`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::EC2::Route",Properties:{RouteTableId:{Ref:Z},DestinationCidrBlock:"0.0.0.0/0",GatewayId:{Ref:z}},DependsOn:Y});let X=this.mergedConfig.environments[t]?.region||this.mergedConfig.project.region||"us-east-1",ee=["a","b"];for(let oe=0;oe<2;oe++){let se=`PublicSubnet${oe+1}`;this.builder.addResource(se,{Type:"AWS::EC2::Subnet",Properties:{VpcId:{Ref:"VPC"},CidrBlock:`10.0.${oe}.0/24`,AvailabilityZone:`${X}${ee[oe]}`,MapPublicIpOnLaunch:!0,Tags:[{Key:"Name",Value:`${R}-${t}-public-${ee[oe]}`},{Key:"Environment",Value:t}]}}),this.builder.addResource(`${se}RTAssoc`,{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:{Ref:se},RouteTableId:{Ref:Z}}})}}generateContainerInfrastructure(R,t){let m=this.mergedConfig.infrastructure?.containers;if(!m)return;let k=this.mergedConfig.infrastructure?.loadBalancer,I=this.mergedConfig.infrastructure?.ssl,L=this.mergedConfig.infrastructure?.dns,z;if(I?.enabled&&I.domains?.length)if(I.certificateArn);else{let ee=I.domains[0],oe=I.domains.slice(1).map((ke)=>{if(ke.includes(".")&&ke.endsWith(ee))return ke.replace(`.${ee}`,"");return ke}),{certificate:se,logicalId:ue}=j.createCertificate({domain:ee,subdomains:oe,slug:R,environment:t,validationMethod:"DNS",hostedZoneId:L?.hostedZoneId});z=ue,this.builder.addResource(ue,se)}let Y="ECSCluster";this.builder.addResource(Y,{Type:"AWS::ECS::Cluster",Properties:{ClusterName:`${R}-${t}`,ClusterSettings:[{Name:"containerInsights",Value:"enabled"}],Tags:[{Key:"Name",Value:`${R}-${t}`},{Key:"Environment",Value:t}]}});let Z=`${R}${t}ALBSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Z,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ALB security group for ${R}-${t}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:80,ToPort:80,CidrIp:"0.0.0.0/0",Description:"HTTP"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${R}-${t}-alb-sg`},{Key:"Environment",Value:t}]}});let X=`${R}${t}ECSSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");for(let[ee,oe]of Object.entries(m)){let se=oe.port||3000;this.builder.addResource(X,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ECS tasks security group for ${R}-${t}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:se,ToPort:se,SourceSecurityGroupId:{Ref:Z},Description:"Allow traffic from ALB"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${R}-${t}-ecs-sg`},{Key:"Environment",Value:t}]}});let ue=`${R}${t}TaskExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ue,{Type:"AWS::IAM::Role",Properties:{RoleName:`${R}-${t}-ecs-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"],Policies:[{PolicyName:"ECRPullPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"}]}}]}});let ke=`${R}${t}TaskRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ke,{Type:"AWS::IAM::Role",Properties:{RoleName:`${R}-${t}-ecs-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"TaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:ListBucket"],Resource:"*"}]}}]}});let ce=`${R}${t}${ee}LogGroup`.replace(/[^a-zA-Z0-9]/g,""),Se=`/ecs/${R}-${t}-${ee}`;this.builder.addResource(ce,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:Se,RetentionInDays:30}});let xe=`${R}${t}${ee}TaskDef`.replace(/[^a-zA-Z0-9]/g,""),ve=String(oe.cpu||512),Re=String(oe.memory||1024);this.builder.addResource(xe,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${R}-${t}-${ee}`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:ve,Memory:Re,ExecutionRoleArn:{"Fn::GetAtt":[ue,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[ke,"Arn"]},ContainerDefinitions:[{Name:ee,Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${R}:latest`},Essential:!0,PortMappings:[{ContainerPort:se,Protocol:"tcp"}],LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":Se,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":ee}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${se}${oe.healthCheck||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${R}-${t}-${ee}`},{Key:"Environment",Value:t}]},DependsOn:[ue,ke,ce]});let Ie=`${R}${t}ALB`.replace(/[^a-zA-Z0-9]/g,"");if(k?.enabled!==!1){this.builder.addResource(Ie,{Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:`${R}-${t}-alb`,Scheme:"internet-facing",Type:"application",Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],SecurityGroups:[{Ref:Z}],Tags:[{Key:"Name",Value:`${R}-${t}-alb`},{Key:"Environment",Value:t}]}});let Me=`${R}${t}TargetGroup`.replace(/[^a-zA-Z0-9]/g,""),Ne=k?.healthCheck?.path||oe.healthCheck||"/health";this.builder.addResource(Me,{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:`${R}-${t}-tg`,Port:se,Protocol:"HTTP",VpcId:{Ref:"VPC"},TargetType:"ip",HealthCheckPath:Ne,HealthCheckIntervalSeconds:k?.healthCheck?.interval||30,HealthyThresholdCount:k?.healthCheck?.healthyThreshold||2,UnhealthyThresholdCount:k?.healthCheck?.unhealthyThreshold||5,HealthCheckTimeoutSeconds:10,Tags:[{Key:"Name",Value:`${R}-${t}-tg`},{Key:"Environment",Value:t}]}});let Fe=`${R}${t}HTTPListener`.replace(/[^a-zA-Z0-9]/g,"");if(I?.enabled&&I?.redirectHttp)this.builder.addResource(Fe,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Ie},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"redirect",RedirectConfig:{Protocol:"HTTPS",Port:"443",StatusCode:"HTTP_301"}}]}});else this.builder.addResource(Fe,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Ie},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:Me}}]}});if(I?.enabled){let He=I.certificateArn||(z?{Ref:z}:void 0);if(He){let dt=`${R}${t}HTTPSListener`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(dt,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Ie},Port:443,Protocol:"HTTPS",Certificates:[{CertificateArn:He}],DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:Me}}],SslPolicy:"ELBSecurityPolicy-TLS13-1-2-2021-06"}})}}let ze=`${R}${t}${ee}Service`.replace(/[^a-zA-Z0-9]/g,""),ot=oe.desiredCount||1;this.builder.addResource(ze,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${R}-${t}-${ee}`,Cluster:{Ref:Y},TaskDefinition:{Ref:xe},DesiredCount:ot,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:X}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},LoadBalancers:[{ContainerName:ee,ContainerPort:se,TargetGroupArn:{Ref:Me}}],HealthCheckGracePeriodSeconds:120,Tags:[{Key:"Name",Value:`${R}-${t}-${ee}`},{Key:"Environment",Value:t}]},DependsOn:[xe,Fe,Me]});let wt=oe.autoScaling;if(wt){let He=`${R}${t}${ee}ScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(He,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:wt.max||10,MinCapacity:wt.min||1,ResourceId:{"Fn::Sub":`service/\${${Y}}/${R}-${t}-${ee}`},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs",RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"}},DependsOn:ze}),wt.targetCpuUtilization)this.builder.addResource(`${R}${t}${ee}CPUScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${R}-${t}-${ee}-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:He},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:wt.targetCpuUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}});if(wt.targetMemoryUtilization)this.builder.addResource(`${R}${t}${ee}MemoryScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${R}-${t}-${ee}-memory-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:He},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageMemoryUtilization"},TargetValue:wt.targetMemoryUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(L?.domain&&L?.hostedZoneId)this.builder.addResource(`${R}${t}ApiDnsRecord`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:L.hostedZoneId,Name:`api.${L.domain}`,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[Ie,"DNSName"]},HostedZoneId:{"Fn::GetAtt":[Ie,"CanonicalHostedZoneID"]}}}});this.builder.addOutput("ECSClusterArn",{Description:"ECS Cluster ARN",Value:{"Fn::GetAtt":[Y,"Arn"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-cluster-arn"}}}),this.builder.addOutput("ECSServiceName",{Description:"ECS Service Name",Value:`${R}-${t}-${ee}`,Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-service-name"}}}),this.builder.addOutput("LoadBalancerDNS",{Description:"Application Load Balancer DNS Name",Value:{"Fn::GetAtt":[Ie,"DNSName"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-alb-dns"}}})}else{let Me=`${R}${t}${ee}Service`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Me,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${R}-${t}-${ee}`,Cluster:{Ref:Y},TaskDefinition:{Ref:xe},DesiredCount:oe.desiredCount||1,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:X}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},Tags:[{Key:"Name",Value:`${R}-${t}-${ee}`},{Key:"Environment",Value:t}]},DependsOn:[xe]})}break}}generateServerless(R,t){if(this.mergedConfig.infrastructure?.functions)for(let[m,k]of Object.entries(this.mergedConfig.infrastructure.functions)){if(!this.shouldDeploy(k))continue;let{role:I,logicalId:L}=Pe.createRole({slug:R,environment:t,roleName:`${R}-${t}-${m}-role`,servicePrincipal:"lambda.amazonaws.com",managedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]});this.builder.addResource(L,I);let{lambdaFunction:z,logicalId:Y}=b.createLambdaFunction({slug:R,environment:t,functionName:`${R}-${t}-${m}`,handler:k.handler||"index.handler",runtime:k.runtime||"nodejs20.x",code:{zipFile:k.code||"export const handler = async () => ({ statusCode: 200 });"},role:L,timeout:k.timeout,memorySize:k.memorySize});this.builder.addResource(Y,z)}if(this.mergedConfig.infrastructure?.api){let{restApi:m,logicalId:k}=cs.createRestApi({slug:R,environment:t,apiName:`${R}-${t}-api`});this.builder.addResource(k,m)}}generateServer(R,t){if(!this.mergedConfig.infrastructure?.servers)return;let m=this.mergedConfig.infrastructure.servers,k=this.mergedConfig.infrastructure?.compute,I=this.mergedConfig.infrastructure?.ssl;if(Object.values(m).some((z)=>!z.privateNetwork||z.privateNetwork==="create"))this.generateNetworkInfrastructure(R,t);for(let[z,Y]of Object.entries(m)){let Z=Y.instanceType||Y.size||k?.size,ee=(Z?b.InstanceSize.specs[Z]:void 0)?.instanceType||Z||"t3.micro",oe=Y.type||"app",se=Y.userData||Y.startupScript;if(!se)se=b.UserData.generateAppServerScript({runtime:"bun",runtimeVersion:Y.bunVersion||"latest",webServer:"none",domain:Y.domain,enableSsl:!!I?.enabled,sslEmail:I?.letsEncrypt?.email,installRedis:oe==="cache",installDatabaseClients:!!Y.database});let ue=Y.privateNetwork&&Y.privateNetwork!=="create"?Y.privateNetwork:{Ref:"VPC"},ke=Y.subnet||{Ref:"PublicSubnet1"},Se=!!this.mergedConfig.infrastructure?.email?.server?.enabled,xe=[22,80,443,this.resolveApiOriginPort()];if(Se)xe.push(25,465,587,143,993);let ve=b.createServerModeStack({slug:`${R}-${z}`,environment:t,vpcId:ue,subnetId:ke,instanceType:ee,keyName:Y.keyName||`${R}-${t}`,domain:Y.domain,userData:se,volumeSize:Y.diskSize||20,imageId:Y.image,allowedPorts:xe});for(let[Re,Ie]of Object.entries(ve.resources))this.builder.addResource(Re,Ie);this.serverEipLogicalIds.set(z,ve.outputs.eipLogicalId),this.serverEipLogicalIds.set(`${z}Instance`,ve.outputs.instanceLogicalId),this.builder.addOutput(`${z}InstanceId`,{Value:{Ref:ve.outputs.instanceLogicalId},Description:`Instance ID for ${z} server`}),this.builder.addOutput(`${z}PublicIp`,{Value:{Ref:ve.outputs.eipLogicalId},Description:`Public IP for ${z} server`})}}generateComputeApp(R,t){let m=this.mergedConfig.infrastructure?.compute;if(!m)return;let k=this.mergedConfig.sites||{},I=Object.entries(k),z=this.mergedConfig.infrastructure?.dns?.domain,Y=this.mergedConfig.infrastructure?.database,Z=m.size,ee=(Z?b.InstanceSize.specs[Z]:void 0)?.instanceType||Z||"t3.micro";if(!this.builder.hasResource("VPC"))this.generateNetworkInfrastructure(R,t);let oe=this.buildCaddyfile(I),se=b.UserData.generateBunAppScript({runtime:m.runtime||"bun",runtimeVersion:m.runtimeVersion||"latest",systemPackages:m.systemPackages,database:Y,caddyfile:oe}),ue=vo(m.appUpdates),ke=ue.length>0?`${se}
+${ue.join(`
 `)}
-`:ae,de=I.map(([,Le])=>Le.port).filter((Le)=>typeof Le==="number"&&![80,443].includes(Le)),ke=this.resolveApiOriginPort(),De=`${R}${t}DeployBucket`.replace(/[^a-zA-Z0-9]/g,""),Se=`${R}-${t}-deploy`;this.builder.addResource(De,{Type:"AWS::S3::Bucket",Properties:{BucketName:Se,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"expire-old-releases",Status:"Enabled",ExpirationInDays:7,Prefix:"releases/"}]},Tags:[{Key:"Project",Value:R},{Key:"Environment",Value:t},{Key:"ManagedBy",Value:"ts-cloud"}]}});let Re=b.createServerModeStack({slug:`${R}-app`,environment:t,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},instanceType:ie,keyName:m.allowSsh?`${R}-${t}`:void 0,domain:z,userData:Ae,volumeSize:m.disk?.size||20,imageId:m.image,allowedPorts:[...m.allowSsh?[22]:[],80,443,ke,...de]}),Pe=Re.resources[Re.outputs.instanceLogicalId];if(Pe?.Properties){let Le=Pe.Properties.Tags||[];Pe.Properties.Tags=[...Le,{Key:"Project",Value:R},{Key:"Environment",Value:t},{Key:"Role",Value:"app"},{Key:"ManagedBy",Value:"ts-cloud"}]}let ze=Re.resources[Re.outputs.roleLogicalId];if(ze?.Properties)ze.Properties.Policies=ze.Properties.Policies||[],ze.Properties.Policies.push({PolicyName:"DeployBucketRead",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetObject","s3:ListBucket"],Resource:[`arn:aws:s3:::${Se}`,`arn:aws:s3:::${Se}/*`]}]}});for(let[Le,Be]of Object.entries(Re.resources))this.builder.addResource(Le,Be);this.builder.addOutput("deployBucketName",{Value:{Ref:De},Description:"S3 bucket where release tarballs are uploaded"}),this.builder.addOutput("appInstanceId",{Value:{Ref:Re.outputs.instanceLogicalId},Description:"EC2 instance ID for the app server"}),this.builder.addOutput("appPublicIp",{Value:{Ref:Re.outputs.eipLogicalId},Description:"Public IP for the app server"}),this.serverEipLogicalIds.set("app",Re.outputs.eipLogicalId),this.serverEipLogicalIds.set("appInstance",Re.outputs.instanceLogicalId)}jumpBoxFileSystemId(R,t,m){let k=Object.keys(this.mergedConfig.infrastructure?.fileSystem??{});if(typeof m==="string")return k.includes(m)?{Ref:this.fileSystemLogicalId(R,t,m)}:m;if(k.length===1)return{Ref:this.fileSystemLogicalId(R,t,k[0])};throw Error(k.length===0?"infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares no file system. Declare one, or set mountEfs to an EFS id.":`infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares ${k.length} (${k.join(", ")}). Set mountEfs to the name of the one to mount.`)}generateJumpBox(R,t){let m=this.mergedConfig.infrastructure?.jumpBox;if(!m)return;let k=m===!0?{}:m;if(k.enabled===!1)return;this.generateNetworkInfrastructure(R,t);let I=k.size||"micro",z=b.InstanceSize.specs[I]?.instanceType||I||"t3.micro",Y=b.createJumpBox({slug:R,environment:t,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:k.keyName,instanceType:z,allowedCidrs:k.allowedCidrs,mountEfs:k.mountEfs?{fileSystemId:this.jumpBoxFileSystemId(R,t,k.mountEfs),mountPath:k.mountPath||"/mnt/efs"}:void 0,databaseTools:k.databaseTools});for(let[Z,X]of Object.entries(Y.resources))this.builder.addResource(Z,X);this.builder.addOutput("JumpBoxInstanceId",{Value:{Ref:Y.instanceLogicalId},Description:"The ID of the JumpBox EC2 instance (use with SSM Session Manager or SSH)"})}generateSharedInfrastructure(R,t){let m=this.mergedConfig.infrastructure?.ssl,k=this.mergedConfig.infrastructure?.dns,I=k?.domain,L=k?.hostedZoneId,z=[],Y,Z;if(m?.certificateArn)Z=m.certificateArn;else if(m?.enabled&&I&&L){let de=m.domains||[I],ke=de[0],De=de.slice(1).map((Pe)=>{if(Pe.includes(".")&&Pe.endsWith(ke))return Pe.replace(`.${ke}`,"");return Pe}),{certificate:Se,logicalId:Re}=j.createCertificate({domain:ke,subdomains:De,slug:R,environment:t,validationMethod:"DNS",hostedZoneId:L});Y=Re,this.builder.addResource(Re,Se)}if(this.mergedConfig.infrastructure?.storage){let de=Object.entries(this.mergedConfig.infrastructure.storage).some(([,Se])=>Se.website),ke;if(de&&(Y||Z))ke=`${R}${t}CloudFrontOAC`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(ke,{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${R}-${t}-s3-oac`,Description:`OAC for ${R} ${t} S3 website buckets`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}});let De=Object.entries(this.mergedConfig.infrastructure.storage).map(([Se,Re])=>({name:Se,config:Re,mountPath:this.normalizeMountPath(Re),rewriteStyle:Re.pathRewriteStyle||"directory",logicalId:this.storageBucketLogicalId(R,t,Se)})).filter((Se)=>Se.name!=="public"&&Se.config.website&&Se.mountPath);for(let[Se,Re]of Object.entries(this.mergedConfig.infrastructure.storage)){let Pe=!!(Re.website&&ke),ze=this.storageBucketName(R,t,Se),{bucket:Le,logicalId:Be}=He.createBucket({slug:R,name:Se,environment:t,bucketName:ze,versioning:Re.versioning,encryption:Re.encryption,public:Pe?!1:Re.public}),Ve=this.normalizeMountPath(Re),ct;if(Re.failover){let nt=`infrastructure.storage.${Se}`;if(!Pe||!I||Ve&&Se!=="public")throw Error(`${nt}.failover needs this bucket to be served by its own CloudFront distribution: a website bucket (website: true), not mounted under the path of another site, with infrastructure.dns.domain set and SSL configured (infrastructure.ssl.certificateArn, or ssl.enabled with dns.hostedZoneId).`);if(ct=Ta({failover:Re.failover,primaryBucket:ze,primaryRegion:this.mergedConfig.project.region||"us-east-1",where:nt}),ct.replicate&&Le.Properties){let xt=`${Be}FailoverReplicationRole`;this.builder.addResource(xt,wa({primaryBucket:ze,replicaBucket:ct.replicaBucket}));let Qt=Le.Properties;Qt.VersioningConfiguration={Status:"Enabled"},Qt.ReplicationConfiguration=Aa({replicaBucket:ct.replicaBucket,roleArn:{"Fn::GetAtt":[xt,"Arn"]}})}}if(Pe&&Le.Properties)Le.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1};if(this.builder.addResource(Be,Le),Re.website){let nt=typeof Re.website==="object"?Re.website:{},xt=He.enableWebsiteHosting(Le,nt.indexDocument||"index.html",nt.errorDocument);this.builder.addResource(Be,xt)}let Dt=this.normalizeMountPath(Re);if(Pe&&ke&&I&&!(Dt&&Se!=="public")){let nt=`${R}${t}${Se}CDN`.replace(/[^a-zA-Z0-9]/g,""),xt=[];if(Re.aliases&&Re.aliases.length>0)xt.push(...Re.aliases);else if(Se==="public"){if(xt.push(I),m?.domains?.includes(`www.${I}`))xt.push(`www.${I}`)}else if(Se==="docs")xt.push(`docs.${I}`);else if(Se==="blog")xt.push(`blog.${I}`);let Qt=typeof Re.website==="object"?Re.website:{},Tt=Re.spa===!0,Ge=Qt.errorDocument||(Tt?"index.html":"404.html"),Ot=[];if(Tt)Ot.push({ErrorCode:403,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300});else Ot.push({ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${Ge}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${Ge}`,ErrorCachingMinTTL:300});let zt=Z&&xt.length>0?{AcmCertificateArn:Z,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:Y&&xt.length>0?{AcmCertificateArn:{Ref:Y},SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},it=`S3-${R}-${t}-${Se}`,Et=this.mergedConfig.project.region||"us-east-1",hn;if(!Tt)hn=`${R}${t}${Se}UrlRewrite`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(hn,{Type:"AWS::CloudFront::Function",Properties:{Name:`${R}-${t}-${Se}-url-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`URL rewrite for ${R} ${t} ${Se} - appends .html to extensionless paths`,Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) { var request = event.request; var uri = request.uri; if (uri.endsWith('/')) { request.uri += 'index.html'; }
-else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`}});let yn=[{Id:it,DomainName:{"Fn::Sub":`\${${Be}}.s3.${Et}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:ke}}],tr=[],Oi=[];if(this.shouldRouteStorageBucketToCompute(Se,Re)){this.appendComputeAppOrigin(yn,tr,Oi,R,t,this.resolveComputeCachePathPatterns(Re.computeRoutes));for(let Ht of De){let Ds=`S3-${R}-${t}-${Ht.name}`,Na=`${R}${t}${Ht.name}PathMountRewrite`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Na,{Type:"AWS::CloudFront::Function",Properties:{Name:`${R}-${t}-${Ht.name}-path-mount-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`Path mount rewrite for ${R} ${t} ${Ht.name} at ${Ht.mountPath}`,Runtime:"cloudfront-js-2.0"},FunctionCode:this.pathMountRewriteFunctionCode(Ht.mountPath,Ht.rewriteStyle)}}),yn.push({Id:Ds,DomainName:{"Fn::Sub":`\${${Ht.logicalId}}.s3.${Et}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:ke}}),Oi.push(Ht.logicalId,Na);for(let Bu of[Ht.mountPath,`${Ht.mountPath}/*`])tr.push({PathPattern:Bu,TargetOriginId:Ds,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[Na,"FunctionARN"]}}]})}}let wn,Wt=it;if(ct){let Ht=`${it}-failover`;Object.assign(yn[0],ct.primaryConnection),yn.push({Id:Ht,DomainName:Ea(ct.replicaBucket,ct.replicaRegion),OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:ke}}),wn=Zo({primaryOriginId:it,secondaryOriginId:Ht,statusCodes:ct.statusCodes}),Wt=wn.Items[0].Id}let Pn={Type:"AWS::CloudFront::Distribution",DependsOn:[Be,ke,...hn?[hn]:[],...Oi],Properties:{DistributionConfig:{Enabled:!0,Comment:`${R} ${t} ${Se} site`,DefaultRootObject:"index.html",Origins:yn,...wn?{OriginGroups:wn}:{},DefaultCacheBehavior:{TargetOriginId:Wt,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...hn?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[hn,"FunctionARN"]}}]}:{}},...tr.length>0?{CacheBehaviors:tr}:{},...xt.length>0?{Aliases:xt}:{},ViewerCertificate:zt,PriceClass:"PriceClass_100",HttpVersion:"http2and3",IPV6Enabled:!0,CustomErrorResponses:Ot}}};if(Y)Pn.DependsOn.push(Y);if(ct)Rn(Pn.Properties.DistributionConfig,`infrastructure.storage.${Se}`),this.storageFailoverReplicas.push({name:Se,primaryBucket:ze,primaryRegion:Et,replicaBucket:ct.replicaBucket,replicaRegion:ct.replicaRegion,replicate:ct.replicate,distributionArnOutput:`${Se}CloudFrontDistributionArn`}),this.builder.addOutput(`${Se}CloudFrontDistributionArn`,{Value:{"Fn::Sub":`arn:\${AWS::Partition}:cloudfront::\${AWS::AccountId}:distribution/\${${nt}}`},Description:`CloudFront distribution ARN for ${Se} (scopes the bucket policy of the failover replica)`}),this.builder.addOutput(`${Se}FailoverBucketName`,{Value:ct.replicaBucket,Description:`Failover replica bucket for ${Se} (${ct.replicaRegion}), outside this stack`});this.builder.addResource(nt,Pn);let xn=`${Be}CloudFrontPolicy`;if(this.builder.addResource(xn,{Type:"AWS::S3::BucketPolicy",DependsOn:[Be,nt],Properties:{Bucket:{Ref:Be},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${Be}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${nt}}`}}}}]}}}),this.shouldRouteStorageBucketToCompute(Se,Re))for(let Ht of De){let Ds=`${Ht.logicalId}CloudFrontPolicy`;this.builder.addResource(Ds,{Type:"AWS::S3::BucketPolicy",DependsOn:[Ht.logicalId,nt],Properties:{Bucket:{Ref:Ht.logicalId},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${Ht.logicalId}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${nt}}`}}}}]}}})}if(xt.length>0)z.push({name:Se,bucketLogicalId:Be,distLogicalId:nt,oacLogicalId:ke,aliases:xt});this.builder.addOutput(`${Se}CloudFrontDomain`,{Value:{"Fn::GetAtt":[nt,"DomainName"]},Description:`CloudFront domain for ${Se}`}),this.builder.addOutput(`${Se}CloudFrontDistributionId`,{Value:{Ref:nt},Description:`CloudFront distribution ID for ${Se}`})}if(this.builder.addOutput(`${Se}BucketName`,{Value:{Ref:Be},Description:`S3 bucket name for ${Se}`}),Se==="public")this.builder.addOutput("FrontendBucketName",{Value:{Ref:Be},Description:"Frontend S3 bucket name"});if(Se==="docs")this.builder.addOutput("DocsBucketName",{Value:{Ref:Be},Description:"Documentation S3 bucket name"});if(Se==="blog")this.builder.addOutput("BlogBucketName",{Value:{Ref:Be},Description:"Blog S3 bucket name"})}}if(this.mergedConfig.infrastructure?.sftp){let de=this.mergedConfig.infrastructure.sftp,ke=rs.create({...de,storage:this.resolveSftpStorage(de,R,t)??de.storage,slug:R,environment:t});for(let[De,Se]of Object.entries(ke.resources))this.builder.addResource(De,Se);this.builder.addOutput("SftpServerId",{Value:{Ref:ke.serverLogicalId},Description:"AWS Transfer Family SFTP server ID"}),this.builder.addOutput("SftpEndpoint",{Value:{"Fn::Sub":`\${${ke.serverLogicalId}}.server.transfer.\${AWS::Region}.amazonaws.com`},Description:"AWS Transfer Family SFTP endpoint"}),this.builder.addOutput("SftpStorageDomain",{Value:ke.domain,Description:"Storage backing the SFTP server (EFS or S3)"})}if(L&&z.length>0)for(let{name:de,distLogicalId:ke,aliases:De}of z)for(let Se of De){let Re=Se.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${Re}ARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[ke],Properties:{HostedZoneId:L,Name:Se,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[ke,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}}),this.builder.addResource(`${Re}AAAARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[ke],Properties:{HostedZoneId:L,Name:Se,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":[ke,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}})}if(this.mergedConfig.infrastructure?.databases){for(let[de,ke]of Object.entries(this.mergedConfig.infrastructure.databases))if(ke.engine==="dynamodb"){let{table:De,logicalId:Se}=Yt.createTable({slug:R,environment:t,tableName:`${R}-${t}-${de}`,partitionKey:ke.partitionKey||{name:"id",type:"S"},sortKey:ke.sortKey});this.builder.addResource(Se,De)}else if(ke.engine==="postgres"){let{dbInstance:De,logicalId:Se}=Yt.createPostgres({slug:R,environment:t,dbInstanceIdentifier:`${R}-${t}-${de}`,masterUsername:ke.username||"admin",masterUserPassword:ke.password||"changeme123",allocatedStorage:ke.storage||20,dbInstanceClass:ke.instanceClass||"db.t3.micro"});this.builder.addResource(Se,De)}else if(ke.engine==="mysql"){let{dbInstance:De,logicalId:Se}=Yt.createMysql({slug:R,environment:t,dbInstanceIdentifier:`${R}-${t}-${de}`,masterUsername:ke.username||"admin",masterUserPassword:ke.password||"changeme123",allocatedStorage:ke.storage||20,dbInstanceClass:ke.instanceClass||"db.t3.micro"});this.builder.addResource(Se,De)}}if(this.mergedConfig.infrastructure?.cdn)for(let[de,ke]of Object.entries(this.mergedConfig.infrastructure.cdn)){if(!ke.origin)continue;let De=typeof ke.customDomain==="string"?ke.customDomain:ke.customDomain?.domain||ke.domain,Se=typeof ke.customDomain==="object"?ke.customDomain?.certificateArn:ke.certificateArn,Re=Se||Z,Pe=`${R}${t}${de}CDN`.replace(/[^a-zA-Z0-9]/g,""),ze=`S3-${R}-${t}-${de}-cdn`,Le=[{Id:ze,DomainName:ke.origin,OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginShield:ke.originShield?{Enabled:!0,OriginShieldRegion:ke.originShieldRegion||this.mergedConfig.environments[t]?.region||this.mergedConfig.project.region||"us-east-1"}:{Enabled:!1},...st(ke,`infrastructure.cdn.${de}`)}],Be=[],Ve=[],ct=["GET","HEAD","OPTIONS"],Dt=ze,nt;if(ke.failoverOrigin){An(ct,`the default cache behavior of infrastructure.cdn.${de}`);let Ge=`${ze}-failover`,Ot=typeof ke.failoverOrigin==="string"?{domain:ke.failoverOrigin}:ke.failoverOrigin;if(!Ot.domain)throw Error(`infrastructure.cdn.${de}.failoverOrigin.domain is required`);if(Ot.domain===ke.origin)throw Error(`infrastructure.cdn.${de}: failoverOrigin must differ from origin (both are ${ke.origin})`);Le.push({Id:Ge,DomainName:Ot.domain,OriginPath:Ot.originPath||"",...ji(Ot.domain)?{S3OriginConfig:{OriginAccessIdentity:""}}:{CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"}},OriginShield:{Enabled:!1},...st(Ot,`infrastructure.cdn.${de}.failoverOrigin`)}),nt=Zo({primaryOriginId:ze,secondaryOriginId:Ge,statusCodes:ke.failoverStatusCodes}),Dt=nt.Items[0].Id}else if(ke.failoverStatusCodes)throw Error(`infrastructure.cdn.${de}: failoverStatusCodes needs failoverOrigin to fail over to`);if(ke.routeCompute)this.appendComputeAppOrigin(Le,Be,Ve,R,t,this.resolveComputeCachePathPatterns(ke.computeRoutes));let xt=Re&&De?{AcmCertificateArn:Y&&!Se?{Ref:Y}:Re,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},Qt=[...Ve];if(Y&&!Se&&De)Qt.push(Y);let Tt={Type:"AWS::CloudFront::Distribution",...Qt.length>0?{DependsOn:Qt}:{},Properties:{DistributionConfig:{Enabled:!0,Comment:`${R} ${t} ${de} CDN`,DefaultRootObject:"index.html",Origins:Le,...nt?{OriginGroups:nt}:{},DefaultCacheBehavior:{TargetOriginId:Dt,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:ct,CachedMethods:["GET","HEAD","OPTIONS"],Compress:ke.compress!==!1,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},...Be.length>0?{CacheBehaviors:Be}:{},...De&&Re?{Aliases:[De]}:{},ViewerCertificate:xt,PriceClass:"PriceClass_100",HttpVersion:ke.http3?"http2and3":"http2"}}};if(Rn(Tt.Properties.DistributionConfig,`infrastructure.cdn.${de}`),this.builder.addResource(Pe,Tt),L&&De&&Re){let Ge=De.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${Ge}CdnARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Pe,...Y&&!Se?[Y]:[]],Properties:{HostedZoneId:L,Name:De,Type:"A",AliasTarget:{HostedZoneId:"Z2FDTNDATAQYW2",DNSName:{"Fn::GetAtt":[Pe,"DomainName"]}}}})}}if(this.mergedConfig.infrastructure?.queues)for(let[de,ke]of Object.entries(this.mergedConfig.infrastructure.queues)){if(!this.shouldDeploy(ke))continue;let{queue:De,logicalId:Se}=ye.createQueue({slug:R,environment:t,name:`${R}-${t}-${de}`,fifo:ke.fifo,visibilityTimeout:ke.visibilityTimeout,messageRetentionPeriod:ke.messageRetentionPeriod,delaySeconds:ke.delaySeconds,maxMessageSize:ke.maxMessageSize,receiveMessageWaitTime:ke.receiveMessageWaitTime,contentBasedDeduplication:ke.contentBasedDeduplication,encrypted:ke.encrypted,kmsKeyId:ke.kmsKeyId});this.builder.addResource(Se,De);let Re;if(ke.deadLetterQueue){let{deadLetterQueue:Pe,updatedSourceQueue:ze,deadLetterLogicalId:Le}=ye.createDeadLetterQueue(Se,{slug:R,environment:t,maxReceiveCount:ke.maxReceiveCount});Re=Le,this.builder.addResource(Le,Pe);let Ve=this.builder.getResources()[Se];if(Ve?.Properties)Ve.Properties.RedrivePolicy=ze.Properties?.RedrivePolicy}if(ke.trigger){let Pe=ke.trigger,ze=`${R}${t}${Pe.functionName}`.replace(/[^a-zA-Z0-9]/g,""),Le={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:{"Fn::GetAtt":[Se,"Arn"]},FunctionName:{Ref:ze},BatchSize:Pe.batchSize||10,MaximumBatchingWindowInSeconds:Pe.batchWindow||0,Enabled:!0,...Pe.reportBatchItemFailures!==!1&&{FunctionResponseTypes:["ReportBatchItemFailures"]},...Pe.maxConcurrency&&{ScalingConfig:{MaximumConcurrency:Pe.maxConcurrency}},...Pe.filterPattern&&{FilterCriteria:{Filters:[{Pattern:JSON.stringify(Pe.filterPattern)}]}}},DependsOn:[Se,ze]};this.builder.addResource(`${Se}Trigger`,Le)}if(ke.alarms?.enabled){let Pe=ke.alarms,ze=Pe.notificationTopicArn;if(!ze&&Pe.notificationEmails?.length){let Ve=`${Se}AlarmTopic`;this.builder.addResource(Ve,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${R}-${t}-${de}-alarms`,DisplayName:`${de} Queue Alarms`}}),Pe.notificationEmails.forEach((ct,Dt)=>{this.builder.addResource(`${Ve}Sub${Dt}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Ve},Protocol:"email",Endpoint:ct}})}),ze={Ref:Ve}}let Le=Pe.queueDepthThreshold||1000;this.builder.addResource(`${Se}DepthAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-${de}-queue-depth`,AlarmDescription:`Queue ${de} depth exceeds ${Le} messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:Le,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[Se,"QueueName"]}}],...ze&&{AlarmActions:[ze],OKActions:[ze]}}});let Be=Pe.messageAgeThreshold||3600;if(this.builder.addResource(`${Se}AgeAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-${de}-message-age`,AlarmDescription:`Queue ${de} oldest message exceeds ${Be} seconds`,MetricName:"ApproximateAgeOfOldestMessage",Namespace:"AWS/SQS",Statistic:"Maximum",Period:300,EvaluationPeriods:2,Threshold:Be,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[Se,"QueueName"]}}],...ze&&{AlarmActions:[ze],OKActions:[ze]}}}),Re&&Pe.dlqAlarm!==!1)this.builder.addResource(`${Re}Alarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-${de}-dlq-messages`,AlarmDescription:`Dead letter queue for ${de} has messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Sum",Period:300,EvaluationPeriods:1,Threshold:0,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[Re,"QueueName"]}}],...ze&&{AlarmActions:[ze]}}})}if(ke.subscribe){let Pe=ke.subscribe,ze=Pe.topicArn;if(!ze&&Pe.topicName)ze={Ref:Pe.topicName};if(ze){this.builder.addResource(`${Se}SnsPolicy`,{Type:"AWS::SQS::QueuePolicy",Properties:{Queues:[{Ref:Se}],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"sns.amazonaws.com"},Action:"sqs:SendMessage",Resource:{"Fn::GetAtt":[Se,"Arn"]},Condition:{ArnEquals:{"aws:SourceArn":ze}}}]}}});let Le={TopicArn:ze,Protocol:"sqs",Endpoint:{"Fn::GetAtt":[Se,"Arn"]},RawMessageDelivery:Pe.rawMessageDelivery||!1};if(Pe.filterPolicy)Le.FilterPolicy=Pe.filterPolicy,Le.FilterPolicyScope=Pe.filterPolicyScope||"MessageAttributes";this.builder.addResource(`${Se}SnsSub`,{Type:"AWS::SNS::Subscription",Properties:Le,DependsOn:`${Se}SnsPolicy`})}}}if(this.mergedConfig.infrastructure?.realtime?.enabled)if((this.mergedConfig.infrastructure.realtime.mode||"serverless")==="server")this.generateRealtimeServerResources(R,t);else this.generateRealtimeResources(R,t);let X=this.mergedConfig.infrastructure?.redirects;if(X){let de=X.target||this.mergedConfig.infrastructure?.dns?.domain||"",ke=X.protocol||"https";if(X.domains?.length&&de)for(let De of X.domains){let{bucket:Se,bucketPolicy:Re,logicalId:Pe,policyLogicalId:ze}=Nt.createDomainRedirectBucket({slug:R,environment:t,sourceDomain:De,targetDomain:de,protocol:ke});this.builder.addResource(Pe,Se),this.builder.addResource(ze,Re)}if(X.paths&&Object.keys(X.paths).length>0){let De=Nt.fromMapping(X.paths,{statusCode:X.statusCode||301}),{function:Se,logicalId:Re}=Nt.createPathRedirectFunction({slug:R,environment:t,rules:De});this.builder.addResource(Re,Se)}}if(this.mergedConfig.infrastructure?.monitoring?.alarms)for(let[de,ke]of Object.entries(this.mergedConfig.infrastructure.monitoring.alarms)){let{alarm:De,logicalId:Se}=zi.createAlarm({slug:R,environment:t,alarmName:`${R}-${t}-${de}`,metricName:ke.metricName||"Errors",namespace:ke.namespace||"AWS/Lambda",threshold:ke.threshold||1,comparisonOperator:ke.comparisonOperator||"GreaterThanThreshold"});this.builder.addResource(Se,De)}let ie=this.mergedConfig.infrastructure?.cache;if(ie){let de=ie.type||"redis";if(de==="redis"){this.generateNetworkInfrastructure(R,t);let ke=ie.redis||{},{replicationGroup:De,subnetGroup:Se,logicalId:Re,subnetGroupId:Pe}=Vi.createRedis({slug:R,environment:t,nodeType:ke.nodeType||ie.nodeType||"cache.t3.micro",engineVersion:ke.engineVersion||"7.1",port:ke.port||6379,numCacheClusters:ke.numCacheNodes||2,automaticFailover:ke.automaticFailoverEnabled!==!1,atRestEncryption:!0,transitEncryption:!0,snapshotRetentionDays:ke.snapshotRetentionLimit||7,snapshotWindow:ke.snapshotWindow,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(Re,De),Se&&Pe)this.builder.addResource(Pe,Se);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[Re,"PrimaryEndPoint.Address"]},Description:"Redis primary endpoint address"}),this.builder.addOutput("CachePort",{Value:{"Fn::GetAtt":[Re,"PrimaryEndPoint.Port"]},Description:"Redis primary endpoint port"})}else if(de==="memcached"){this.generateNetworkInfrastructure(R,t);let ke=ie.elasticache||{},{cluster:De,subnetGroup:Se,logicalId:Re,subnetGroupId:Pe}=Vi.createMemcached({slug:R,environment:t,nodeType:ke.nodeType||ie.nodeType||"cache.t3.micro",engineVersion:ke.engineVersion||"1.6.22",numCacheNodes:ke.numCacheNodes||2,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(Re,De),Se&&Pe)this.builder.addResource(Pe,Se);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[Re,"ConfigurationEndpoint.Address"]},Description:"Memcached configuration endpoint address"})}}let oe=this.mergedConfig.infrastructure?.email;if(oe){let de=oe.domain||this.mergedConfig.infrastructure?.dns?.domain;if(de){let{emailIdentity:ke,logicalId:De}=N.verifyDomain({domain:de,slug:R,environment:t,enableDkim:oe.enableDkim!==!1,dkimKeyLength:oe.dkimKeyLength||"RSA_2048_BIT"});if(this.builder.addResource(De,ke),oe.configurationSet!==!1){let{configurationSet:Pe,logicalId:ze}=N.createConfigurationSet({slug:R,environment:t});this.builder.addResource(ze,Pe)}let Se=oe.hostedZoneId||this.mergedConfig.infrastructure?.dns?.hostedZoneId;if(Se){if(oe.enableDkim!==!1)for(let Ve=1;Ve<=3;Ve++){let ct=`DkimRecord${Ve}${de.replace(/\./g,"")}`;this.builder.addResource(ct,{Type:"AWS::Route53::RecordSet",DependsOn:[De],Properties:{HostedZoneId:Se,Name:{"Fn::GetAtt":[De,`DkimDNSTokenName${Ve}`]},Type:"CNAME",TTL:1800,ResourceRecords:[{"Fn::GetAtt":[De,`DkimDNSTokenValue${Ve}`]}]}})}let{record:Pe,logicalId:ze}=N.createSpfRecord(de,Se);this.builder.addResource(ze,Pe);let{record:Le,logicalId:Be}=N.createDmarcRecord(de,Se,{policy:"none",reportingEmail:oe.dmarcReportingEmail||`dmarc-reports@${de}`});this.builder.addResource(Be,Le)}this.builder.addOutput("EmailDomain",{Value:de,Description:"SES verified email domain"});let Re=oe.server;if(Re?.enabled&&Se){let Pe=this.mergedConfig.environments[t]?.region||this.mergedConfig.project.region||"us-east-1",ze=`${R}-${t}-email`,{role:Le,policy:Be,roleLogicalId:Ve,policyLogicalId:ct}=N.createEmailLambdaRole({slug:R,environment:t,s3BucketArn:`arn:aws:s3:::${ze}`,sesIdentityArn:`arn:aws:ses:${Pe}:*:identity/${de}`});this.builder.addResource(Ve,Le),this.builder.addResource(ct,Be);let{function:Dt,permission:nt,logicalId:xt,permissionLogicalId:Qt}=N.createInboundEmailLambda({slug:R,environment:t,roleArn:{"Fn::GetAtt":[Ve,"Arn"]},s3BucketName:ze,organizedPrefix:"mailboxes/"});this.builder.addResource(xt,Dt),this.builder.addResource(Qt,nt);let Tt=N.createInboundEmailSetup({slug:R,environment:t,domain:de,s3BucketName:ze,s3KeyPrefix:"inbox/",region:Pe,hostedZoneId:Se,lambdaFunctionArn:{"Fn::GetAtt":[xt,"Arn"]}});for(let[Ot,zt]of Object.entries(Tt.resources)){if(zt.Type==="AWS::SES::ReceiptRule")zt.DependsOn=[Qt,xt];this.builder.addResource(Ot,zt)}this.builder.addOutput("InboundEmailLambda",{Value:{Ref:xt},Description:"Inbound email processing Lambda function"}),this.builder.addOutput("EmailBucket",{Value:ze,Description:"S3 bucket for email storage"});let Ge=this.serverEipLogicalIds.get("app");if(Ge&&Se){let zt=`${Re?.subdomain||"mail"}.${de}`,it=zt.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${it}ARecord`,{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:Se,Name:zt,Type:"A",TTL:"300",ResourceRecords:[{Ref:Ge}]}})}this.builder.addOutput("MailHost",{Value:`mail.${de}`,Description:"Mail server hostname for SMTP/IMAP clients"})}}}let ae=this.mergedConfig.infrastructure?.search;if(ae){let de=ae.vpc?{subnetIds:[{Ref:"PublicSubnet1"}],securityGroupIds:[]}:void 0;if(de)this.generateNetworkInfrastructure(R,t);let{domain:ke,logicalId:De}=Zt.createDomain({slug:R,environment:t,engineVersion:ae.engineVersion||"OpenSearch_2.11",instanceType:ae.instanceType||"t3.small.search",instanceCount:ae.instanceCount||1,volumeSize:ae.volumeSize||10,volumeType:ae.volumeType||"gp3",dedicatedMaster:ae.dedicatedMaster||!1,dedicatedMasterType:ae.dedicatedMasterType,dedicatedMasterCount:ae.dedicatedMasterCount||3,multiAz:ae.multiAz||!1,encryption:ae.encryption||{atRest:!0,nodeToNode:!0},advancedSecurity:ae.advancedSecurity,autoTune:ae.autoTune!==!1,vpc:de});this.builder.addResource(De,ke),this.builder.addOutput("SearchDomainEndpoint",{Value:{"Fn::GetAtt":[De,"DomainEndpoint"]},Description:"OpenSearch domain endpoint"}),this.builder.addOutput("SearchDomainArn",{Value:{"Fn::GetAtt":[De,"Arn"]},Description:"OpenSearch domain ARN"})}let be=this.mergedConfig.infrastructure?.fileSystem;if(be&&Object.keys(be).length>0){this.generateNetworkInfrastructure(R,t);for(let[de,ke]of Object.entries(be)){let{fileSystem:De,logicalId:Se}=at.createFileSystem({slug:`${R}-${de}`,environment:t,encrypted:ke.encrypted!==!1,performanceMode:ke.performanceMode||"generalPurpose",throughputMode:ke.throughputMode||"bursting",enableBackup:!0});this.builder.addResource(Se,De);let{securityGroup:Re,logicalId:Pe}=at.createEfsSecurityGroup({slug:`${R}-${de}`,environment:t,vpcId:{Ref:"VPC"},sourceCidrBlocks:["10.0.0.0/16"]});this.builder.addResource(Pe,Re);let{mountTargets:ze,logicalIds:Le}=at.createMultiAzMountTargets(Se,{slug:`${R}-${de}`,environment:t,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],securityGroupId:{Ref:Pe}});for(let Be=0;Be<ze.length;Be++)this.builder.addResource(Le[Be],ze[Be]);this.builder.addOutput(`${de}FileSystemId`,{Value:{Ref:Se},Description:`EFS file system ID for ${de}`})}}let Ae=this.mergedConfig.infrastructure?.ai;if(Ae){let de=Ae.service||"ecs",ke=Ae.models||["*"],De=Ae.allowStreaming!==!1,Se;if(de==="ecs")Se=qe.enableBedrockForEcs({slug:R,environment:t,models:ke,allowStreaming:De});else if(de==="ec2")Se=qe.enableBedrockForEc2({slug:R,environment:t,models:ke,allowStreaming:De});else if(de==="lambda")Se=qe.enableBedrockForLambda({slug:R,environment:t,models:ke,allowStreaming:De});else Se=qe.createBedrockRole(de,{slug:R,environment:t,models:ke,allowStreaming:De});if(this.builder.addResource(Se.logicalId,Se.role),Ae.allowAsync){let{policy:Re,logicalId:Pe}=qe.createBedrockPolicy({slug:R,environment:t,models:ke,allowStreaming:De,allowAsync:!0});this.builder.addResource(Pe,Re)}this.builder.addOutput("BedrockRoleArn",{Value:{"Fn::GetAtt":[Se.logicalId,"Arn"]},Description:"IAM role ARN with Bedrock permissions"})}}generateRealtimeResources(R,t){let m=this.mergedConfig.infrastructure?.realtime;if(!m)return;let k=m.name||`${R}-${t}-realtime`,I=m.scaling||{},L=m.storage||{type:"dynamodb"},z=I.handlerMemory||256,Y=I.handlerTimeout||30,Z=`${R}${t}RealtimeConnections`.replace(/[^a-zA-Z0-9]/g,""),X=`${R}${t}RealtimeChannels`.replace(/[^a-zA-Z0-9]/g,"");if(L.type==="dynamodb"){let Le=L.dynamodb||{},Be=Le.billingMode||"PAY_PER_REQUEST";this.builder.addResource(Z,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${R}-${t}-realtime-connections`,BillingMode:Be,AttributeDefinitions:[{AttributeName:"connectionId",AttributeType:"S"},{AttributeName:"userId",AttributeType:"S"}],KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],GlobalSecondaryIndexes:[{IndexName:"userId-index",KeySchema:[{AttributeName:"userId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...Be==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Le.readCapacity||5,WriteCapacityUnits:Le.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...Be==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Le.readCapacity||5,WriteCapacityUnits:Le.writeCapacity||5}},...Le.pointInTimeRecovery&&{PointInTimeRecoverySpecification:{PointInTimeRecoveryEnabled:!0}},Tags:[{Key:"Name",Value:`${R}-${t}-realtime-connections`},{Key:"Environment",Value:t}]}}),this.builder.addResource(X,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${R}-${t}-realtime-channels`,BillingMode:Be,AttributeDefinitions:[{AttributeName:"channel",AttributeType:"S"},{AttributeName:"connectionId",AttributeType:"S"}],KeySchema:[{AttributeName:"channel",KeyType:"HASH"},{AttributeName:"connectionId",KeyType:"RANGE"}],GlobalSecondaryIndexes:[{IndexName:"connectionId-index",KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...Be==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Le.readCapacity||5,WriteCapacityUnits:Le.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...Be==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Le.readCapacity||5,WriteCapacityUnits:Le.writeCapacity||5}},Tags:[{Key:"Name",Value:`${R}-${t}-realtime-channels`},{Key:"Environment",Value:t}]}})}let ie=`${R}${t}RealtimeRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ie,{Type:"AWS::IAM::Role",Properties:{RoleName:`${R}-${t}-realtime-handler-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"RealtimeHandlerPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:UpdateItem"],Resource:[{"Fn::GetAtt":[Z,"Arn"]},{"Fn::Sub":`\${${Z}.Arn}/index/*`},{"Fn::GetAtt":[X,"Arn"]},{"Fn::Sub":`\${${X}.Arn}/index/*`}]},{Effect:"Allow",Action:"execute-api:ManageConnections",Resource:{"Fn::Sub":"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/*"}}]}}]}});let oe=`${R}${t}RealtimeConnect`.replace(/[^a-zA-Z0-9]/g,""),ae=`${R}${t}RealtimeDisconnect`.replace(/[^a-zA-Z0-9]/g,""),be=`${R}${t}RealtimeMessage`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(oe,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${R}-${t}-realtime-connect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[ie,"Arn"]},MemorySize:z,Timeout:Y,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:Z},CHANNELS_TABLE:{Ref:X},ENVIRONMENT:t}},Code:{ZipFile:this.generateConnectHandlerCode()}},DependsOn:[ie,Z]}),this.builder.addResource(ae,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${R}-${t}-realtime-disconnect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[ie,"Arn"]},MemorySize:z,Timeout:Y,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:Z},CHANNELS_TABLE:{Ref:X},ENVIRONMENT:t}},Code:{ZipFile:this.generateDisconnectHandlerCode()}},DependsOn:[ie,Z,X]}),this.builder.addResource(be,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${R}-${t}-realtime-message`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[ie,"Arn"]},MemorySize:z,Timeout:Y,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:Z},CHANNELS_TABLE:{Ref:X},ENVIRONMENT:t}},Code:{ZipFile:this.generateMessageHandlerCode()}},DependsOn:[ie,Z,X]});let Ae=`${R}${t}RealtimeApi`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ae,{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:k,ProtocolType:"WEBSOCKET",RouteSelectionExpression:"$request.body.action",Tags:{Name:k,Environment:t}}});let de=`${oe}Permission`,ke=`${ae}Permission`,De=`${be}Permission`;this.builder.addResource(de,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:oe},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Ae}}/*/$connect`}}}),this.builder.addResource(ke,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:ae},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Ae}}/*/$disconnect`}}}),this.builder.addResource(De,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:be},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Ae}}/*/$default`}}});let Se=`${Ae}ConnectInteg`,Re=`${Ae}DisconnectInteg`,Pe=`${Ae}MessageInteg`;this.builder.addResource(Se,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Ae},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${oe}.Arn}/invocations`}}}),this.builder.addResource(Re,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Ae},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${ae}.Arn}/invocations`}}}),this.builder.addResource(Pe,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Ae},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${be}.Arn}/invocations`}}}),this.builder.addResource(`${Ae}ConnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Ae},RouteKey:"$connect",AuthorizationType:"NONE",Target:{"Fn::Sub":`integrations/\${${Se}}`}}}),this.builder.addResource(`${Ae}DisconnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Ae},RouteKey:"$disconnect",Target:{"Fn::Sub":`integrations/\${${Re}}`}}}),this.builder.addResource(`${Ae}DefaultRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Ae},RouteKey:"$default",Target:{"Fn::Sub":`integrations/\${${Pe}}`}}});let ze=`${Ae}Stage`;if(this.builder.addResource(ze,{Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:{Ref:Ae},StageName:t,AutoDeploy:!0,DefaultRouteSettings:{ThrottlingBurstLimit:I.messagesPerSecond||1000,ThrottlingRateLimit:I.messagesPerSecond||1000}}}),m.monitoring?.enabled){let Le=m.monitoring,Be=Le.notificationTopicArn;if(!Be&&Le.notificationEmails?.length){let Ve=`${Ae}AlarmTopic`;this.builder.addResource(Ve,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${R}-${t}-realtime-alarms`,DisplayName:"Realtime WebSocket Alarms"}}),Le.notificationEmails.forEach((ct,Dt)=>{this.builder.addResource(`${Ve}Sub${Dt}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Ve},Protocol:"email",Endpoint:ct}})}),Be={Ref:Ve}}if(Le.connectionThreshold)this.builder.addResource(`${Ae}ConnectionAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-realtime-connections`,AlarmDescription:`WebSocket connections exceed ${Le.connectionThreshold}`,MetricName:"ConnectCount",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:300,EvaluationPeriods:2,Threshold:Le.connectionThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:Ae}}],...Be&&{AlarmActions:[Be]}}});if(Le.errorThreshold)this.builder.addResource(`${Ae}ErrorAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-realtime-errors`,AlarmDescription:`WebSocket errors exceed ${Le.errorThreshold}/min`,MetricName:"ExecutionError",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:60,EvaluationPeriods:3,Threshold:Le.errorThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:Ae}}],...Be&&{AlarmActions:[Be]}}})}this.builder.addOutput(`${Ae}Endpoint`,{Description:"WebSocket API endpoint URL",Value:{"Fn::Sub":`wss://\${${Ae}}.execute-api.\${AWS::Region}.amazonaws.com/${t}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}}),this.builder.addOutput(`${Ae}Id`,{Description:"WebSocket API ID",Value:{Ref:Ae},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-api-id"}}})}generateConnectHandlerCode(){return`
+`:se,ce=I.map(([,Ne])=>Ne.port).filter((Ne)=>typeof Ne==="number"&&![80,443].includes(Ne)),Se=this.resolveApiOriginPort(),xe=`${R}${t}DeployBucket`.replace(/[^a-zA-Z0-9]/g,""),ve=`${R}-${t}-deploy`;this.builder.addResource(xe,{Type:"AWS::S3::Bucket",Properties:{BucketName:ve,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"expire-old-releases",Status:"Enabled",ExpirationInDays:7,Prefix:"releases/"}]},Tags:[{Key:"Project",Value:R},{Key:"Environment",Value:t},{Key:"ManagedBy",Value:"ts-cloud"}]}});let Re=b.createServerModeStack({slug:`${R}-app`,environment:t,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},instanceType:ee,keyName:m.allowSsh?`${R}-${t}`:void 0,domain:z,userData:ke,volumeSize:m.disk?.size||20,imageId:m.image,allowedPorts:[...m.allowSsh?[22]:[],80,443,Se,...ce]}),Ie=Re.resources[Re.outputs.instanceLogicalId];if(Ie?.Properties){let Ne=Ie.Properties.Tags||[];Ie.Properties.Tags=[...Ne,{Key:"Project",Value:R},{Key:"Environment",Value:t},{Key:"Role",Value:"app"},{Key:"ManagedBy",Value:"ts-cloud"}]}let Me=Re.resources[Re.outputs.roleLogicalId];if(Me?.Properties)Me.Properties.Policies=Me.Properties.Policies||[],Me.Properties.Policies.push({PolicyName:"DeployBucketRead",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetObject","s3:ListBucket"],Resource:[`arn:aws:s3:::${ve}`,`arn:aws:s3:::${ve}/*`]}]}});for(let[Ne,Fe]of Object.entries(Re.resources))this.builder.addResource(Ne,Fe);this.builder.addOutput("deployBucketName",{Value:{Ref:xe},Description:"S3 bucket where release tarballs are uploaded"}),this.builder.addOutput("appInstanceId",{Value:{Ref:Re.outputs.instanceLogicalId},Description:"EC2 instance ID for the app server"}),this.builder.addOutput("appPublicIp",{Value:{Ref:Re.outputs.eipLogicalId},Description:"Public IP for the app server"}),this.serverEipLogicalIds.set("app",Re.outputs.eipLogicalId),this.serverEipLogicalIds.set("appInstance",Re.outputs.instanceLogicalId)}jumpBoxFileSystemId(R,t,m){let k=Object.keys(this.mergedConfig.infrastructure?.fileSystem??{});if(typeof m==="string")return k.includes(m)?{Ref:this.fileSystemLogicalId(R,t,m)}:m;if(k.length===1)return{Ref:this.fileSystemLogicalId(R,t,k[0])};throw Error(k.length===0?"infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares no file system. Declare one, or set mountEfs to an EFS id.":`infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares ${k.length} (${k.join(", ")}). Set mountEfs to the name of the one to mount.`)}generateJumpBox(R,t){let m=this.mergedConfig.infrastructure?.jumpBox;if(!m)return;let k=m===!0?{}:m;if(k.enabled===!1)return;this.generateNetworkInfrastructure(R,t);let I=k.size||"micro",z=b.InstanceSize.specs[I]?.instanceType||I||"t3.micro",Y=b.createJumpBox({slug:R,environment:t,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:k.keyName,instanceType:z,allowedCidrs:k.allowedCidrs,mountEfs:k.mountEfs?{fileSystemId:this.jumpBoxFileSystemId(R,t,k.mountEfs),mountPath:k.mountPath||"/mnt/efs"}:void 0,databaseTools:k.databaseTools});for(let[Z,X]of Object.entries(Y.resources))this.builder.addResource(Z,X);this.builder.addOutput("JumpBoxInstanceId",{Value:{Ref:Y.instanceLogicalId},Description:"The ID of the JumpBox EC2 instance (use with SSM Session Manager or SSH)"})}generateSharedInfrastructure(R,t){let m=this.mergedConfig.infrastructure?.ssl,k=this.mergedConfig.infrastructure?.dns,I=k?.domain,L=k?.hostedZoneId,z=[],Y,Z;if(m?.certificateArn)Z=m.certificateArn;else if(m?.enabled&&I&&L){let ce=m.domains||[I],Se=ce[0],xe=ce.slice(1).map((Ie)=>{if(Ie.includes(".")&&Ie.endsWith(Se))return Ie.replace(`.${Se}`,"");return Ie}),{certificate:ve,logicalId:Re}=j.createCertificate({domain:Se,subdomains:xe,slug:R,environment:t,validationMethod:"DNS",hostedZoneId:L});Y=Re,this.builder.addResource(Re,ve)}if(this.mergedConfig.infrastructure?.storage){let ce=Object.entries(this.mergedConfig.infrastructure.storage).some(([,ve])=>ve.website),Se;if(ce&&(Y||Z))Se=`${R}${t}CloudFrontOAC`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(Se,{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${R}-${t}-s3-oac`,Description:`OAC for ${R} ${t} S3 website buckets`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}});let xe=Object.entries(this.mergedConfig.infrastructure.storage).map(([ve,Re])=>({name:ve,config:Re,mountPath:this.normalizeMountPath(Re),rewriteStyle:Re.pathRewriteStyle||"directory",logicalId:this.storageBucketLogicalId(R,t,ve)})).filter((ve)=>ve.name!=="public"&&ve.config.website&&ve.mountPath);for(let[ve,Re]of Object.entries(this.mergedConfig.infrastructure.storage)){let Ie=!!(Re.website&&Se),Me=this.storageBucketName(R,t,ve),{bucket:Ne,logicalId:Fe}=Ge.createBucket({slug:R,name:ve,environment:t,bucketName:Me,versioning:Re.versioning,encryption:Re.encryption,public:Ie?!1:Re.public}),ze=this.normalizeMountPath(Re),ot;if(Re.failover){let He=`infrastructure.storage.${ve}`;if(!Ie||!I||ze&&ve!=="public")throw Error(`${He}.failover needs this bucket to be served by its own CloudFront distribution: a website bucket (website: true), not mounted under the path of another site, with infrastructure.dns.domain set and SSL configured (infrastructure.ssl.certificateArn, or ssl.enabled with dns.hostedZoneId).`);if(ot=ka({failover:Re.failover,primaryBucket:Me,primaryRegion:this.mergedConfig.project.region||"us-east-1",where:He}),ot.replicate&&Ne.Properties){let dt=`${Fe}FailoverReplicationRole`;this.builder.addResource(dt,xa({primaryBucket:Me,replicaBucket:ot.replicaBucket}));let Jt=Ne.Properties;Jt.VersioningConfiguration={Status:"Enabled"},Jt.ReplicationConfiguration=_a({replicaBucket:ot.replicaBucket,roleArn:{"Fn::GetAtt":[dt,"Arn"]}})}}if(Ie&&Ne.Properties)Ne.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1};if(this.builder.addResource(Fe,Ne),Re.website){let He=typeof Re.website==="object"?Re.website:{},dt=Ge.enableWebsiteHosting(Ne,He.indexDocument||"index.html",He.errorDocument);this.builder.addResource(Fe,dt)}let wt=this.normalizeMountPath(Re);if(Ie&&Se&&I&&!(wt&&ve!=="public")){let He=`${R}${t}${ve}CDN`.replace(/[^a-zA-Z0-9]/g,""),dt=[];if(Re.aliases&&Re.aliases.length>0)dt.push(...Re.aliases);else if(ve==="public"){if(dt.push(I),m?.domains?.includes(`www.${I}`))dt.push(`www.${I}`)}else if(ve==="docs")dt.push(`docs.${I}`);else if(ve==="blog")dt.push(`blog.${I}`);let Jt=typeof Re.website==="object"?Re.website:{},At=Re.spa===!0,qe=Jt.errorDocument||(At?"index.html":"404.html"),xt=[];if(At)xt.push({ErrorCode:403,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300});else xt.push({ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${qe}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${qe}`,ErrorCachingMinTTL:300});let Ot=Z&&dt.length>0?{AcmCertificateArn:Z,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:Y&&dt.length>0?{AcmCertificateArn:{Ref:Y},SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},Ke=`S3-${R}-${t}-${ve}`,$t=this.mergedConfig.project.region||"us-east-1",gn;if(!At)gn=`${R}${t}${ve}UrlRewrite`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(gn,{Type:"AWS::CloudFront::Function",Properties:{Name:`${R}-${t}-${ve}-url-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`URL rewrite for ${R} ${t} ${ve} - appends .html to extensionless paths`,Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) { var request = event.request; var uri = request.uri; if (uri.endsWith('/')) { request.uri += 'index.html'; }
+else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`}});let hn=[{Id:Ke,DomainName:{"Fn::Sub":`\${${Fe}}.s3.${$t}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Se}}],Fn=[],Li=[];if(this.shouldRouteStorageBucketToCompute(ve,Re)){this.appendComputeAppOrigin(hn,Fn,Li,R,t,this.resolveComputeCachePathPatterns(Re.computeRoutes));for(let qt of xe){let Rs=`S3-${R}-${t}-${qt.name}`,Ia=`${R}${t}${qt.name}PathMountRewrite`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ia,{Type:"AWS::CloudFront::Function",Properties:{Name:`${R}-${t}-${qt.name}-path-mount-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`Path mount rewrite for ${R} ${t} ${qt.name} at ${qt.mountPath}`,Runtime:"cloudfront-js-2.0"},FunctionCode:this.pathMountRewriteFunctionCode(qt.mountPath,qt.rewriteStyle)}}),hn.push({Id:Rs,DomainName:{"Fn::Sub":`\${${qt.logicalId}}.s3.${$t}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Se}}),Li.push(qt.logicalId,Ia);for(let Bu of[qt.mountPath,`${qt.mountPath}/*`])Fn.push({PathPattern:Bu,TargetOriginId:Rs,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[Ia,"FunctionARN"]}}]})}}let vn,Lt=Ke;if(ot){let qt=`${Ke}-failover`;Object.assign(hn[0],ot.primaryConnection),hn.push({Id:qt,DomainName:Na(ot.replicaBucket,ot.replicaRegion),OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Se}}),vn=is({primaryOriginId:Ke,secondaryOriginId:qt,statusCodes:ot.statusCodes}),Lt=vn.Items[0].Id}let kn={Type:"AWS::CloudFront::Distribution",DependsOn:[Fe,Se,...gn?[gn]:[],...Li],Properties:{DistributionConfig:{Enabled:!0,Comment:`${R} ${t} ${ve} site`,DefaultRootObject:"index.html",Origins:hn,...vn?{OriginGroups:vn}:{},DefaultCacheBehavior:{TargetOriginId:Lt,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...gn?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[gn,"FunctionARN"]}}]}:{}},...Fn.length>0?{CacheBehaviors:Fn}:{},...dt.length>0?{Aliases:dt}:{},ViewerCertificate:Ot,PriceClass:"PriceClass_100",HttpVersion:"http2and3",IPV6Enabled:!0,CustomErrorResponses:xt}}};if(Y)kn.DependsOn.push(Y);if(ot)In(kn.Properties.DistributionConfig,`infrastructure.storage.${ve}`),this.storageFailoverReplicas.push({name:ve,primaryBucket:Me,primaryRegion:$t,replicaBucket:ot.replicaBucket,replicaRegion:ot.replicaRegion,replicate:ot.replicate,distributionArnOutput:`${ve}CloudFrontDistributionArn`}),this.builder.addOutput(`${ve}CloudFrontDistributionArn`,{Value:{"Fn::Sub":`arn:\${AWS::Partition}:cloudfront::\${AWS::AccountId}:distribution/\${${He}}`},Description:`CloudFront distribution ARN for ${ve} (scopes the bucket policy of the failover replica)`}),this.builder.addOutput(`${ve}FailoverBucketName`,{Value:ot.replicaBucket,Description:`Failover replica bucket for ${ve} (${ot.replicaRegion}), outside this stack`});this.builder.addResource(He,kn);let An=`${Fe}CloudFrontPolicy`;if(this.builder.addResource(An,{Type:"AWS::S3::BucketPolicy",DependsOn:[Fe,He],Properties:{Bucket:{Ref:Fe},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${Fe}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${He}}`}}}}]}}}),this.shouldRouteStorageBucketToCompute(ve,Re))for(let qt of xe){let Rs=`${qt.logicalId}CloudFrontPolicy`;this.builder.addResource(Rs,{Type:"AWS::S3::BucketPolicy",DependsOn:[qt.logicalId,He],Properties:{Bucket:{Ref:qt.logicalId},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${qt.logicalId}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${He}}`}}}}]}}})}if(dt.length>0)z.push({name:ve,bucketLogicalId:Fe,distLogicalId:He,oacLogicalId:Se,aliases:dt});this.builder.addOutput(`${ve}CloudFrontDomain`,{Value:{"Fn::GetAtt":[He,"DomainName"]},Description:`CloudFront domain for ${ve}`}),this.builder.addOutput(`${ve}CloudFrontDistributionId`,{Value:{Ref:He},Description:`CloudFront distribution ID for ${ve}`})}if(this.builder.addOutput(`${ve}BucketName`,{Value:{Ref:Fe},Description:`S3 bucket name for ${ve}`}),ve==="public")this.builder.addOutput("FrontendBucketName",{Value:{Ref:Fe},Description:"Frontend S3 bucket name"});if(ve==="docs")this.builder.addOutput("DocsBucketName",{Value:{Ref:Fe},Description:"Documentation S3 bucket name"});if(ve==="blog")this.builder.addOutput("BlogBucketName",{Value:{Ref:Fe},Description:"Blog S3 bucket name"})}}if(this.mergedConfig.infrastructure?.sftp){let ce=this.mergedConfig.infrastructure.sftp,Se=as.create({...ce,storage:this.resolveSftpStorage(ce,R,t)??ce.storage,slug:R,environment:t});for(let[xe,ve]of Object.entries(Se.resources))this.builder.addResource(xe,ve);this.builder.addOutput("SftpServerId",{Value:{Ref:Se.serverLogicalId},Description:"AWS Transfer Family SFTP server ID"}),this.builder.addOutput("SftpEndpoint",{Value:{"Fn::Sub":`\${${Se.serverLogicalId}}.server.transfer.\${AWS::Region}.amazonaws.com`},Description:"AWS Transfer Family SFTP endpoint"}),this.builder.addOutput("SftpStorageDomain",{Value:Se.domain,Description:"Storage backing the SFTP server (EFS or S3)"})}if(L&&z.length>0)for(let{name:ce,distLogicalId:Se,aliases:xe}of z)for(let ve of xe){let Re=ve.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${Re}ARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Se],Properties:{HostedZoneId:L,Name:ve,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[Se,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}}),this.builder.addResource(`${Re}AAAARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Se],Properties:{HostedZoneId:L,Name:ve,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":[Se,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}})}if(this.mergedConfig.infrastructure?.databases){for(let[ce,Se]of Object.entries(this.mergedConfig.infrastructure.databases))if(Se.engine==="dynamodb"){let{table:xe,logicalId:ve}=er.createTable({slug:R,environment:t,tableName:`${R}-${t}-${ce}`,partitionKey:Se.partitionKey||{name:"id",type:"S"},sortKey:Se.sortKey});this.builder.addResource(ve,xe)}else if(Se.engine==="postgres"){let{dbInstance:xe,logicalId:ve}=er.createPostgres({slug:R,environment:t,dbInstanceIdentifier:`${R}-${t}-${ce}`,masterUsername:Se.username||"admin",masterUserPassword:Se.password||"changeme123",allocatedStorage:Se.storage||20,dbInstanceClass:Se.instanceClass||"db.t3.micro"});this.builder.addResource(ve,xe)}else if(Se.engine==="mysql"){let{dbInstance:xe,logicalId:ve}=er.createMysql({slug:R,environment:t,dbInstanceIdentifier:`${R}-${t}-${ce}`,masterUsername:Se.username||"admin",masterUserPassword:Se.password||"changeme123",allocatedStorage:Se.storage||20,dbInstanceClass:Se.instanceClass||"db.t3.micro"});this.builder.addResource(ve,xe)}}if(this.mergedConfig.infrastructure?.cdn)for(let[ce,Se]of Object.entries(this.mergedConfig.infrastructure.cdn)){if(!Se.origin)continue;let xe=typeof Se.customDomain==="string"?Se.customDomain:Se.customDomain?.domain||Se.domain,ve=typeof Se.customDomain==="object"?Se.customDomain?.certificateArn:Se.certificateArn,Re=ve||Z,Ie=`${R}${t}${ce}CDN`.replace(/[^a-zA-Z0-9]/g,""),Me=`S3-${R}-${t}-${ce}-cdn`,Ne=[{Id:Me,DomainName:Se.origin,OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginShield:Se.originShield?{Enabled:!0,OriginShieldRegion:Se.originShieldRegion||this.mergedConfig.environments[t]?.region||this.mergedConfig.project.region||"us-east-1"}:{Enabled:!1},...ct(Se,`infrastructure.cdn.${ce}`)}],Fe=[],ze=[],ot=["GET","HEAD","OPTIONS"],wt=Me,He;if(Se.failoverOrigin){Rn(ot,`the default cache behavior of infrastructure.cdn.${ce}`);let qe=`${Me}-failover`,xt=typeof Se.failoverOrigin==="string"?{domain:Se.failoverOrigin}:Se.failoverOrigin;if(!xt.domain)throw Error(`infrastructure.cdn.${ce}.failoverOrigin.domain is required`);if(xt.domain===Se.origin)throw Error(`infrastructure.cdn.${ce}: failoverOrigin must differ from origin (both are ${Se.origin})`);Ne.push({Id:qe,DomainName:xt.domain,OriginPath:xt.originPath||"",...zi(xt.domain)?{S3OriginConfig:{OriginAccessIdentity:""}}:{CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"}},OriginShield:{Enabled:!1},...ct(xt,`infrastructure.cdn.${ce}.failoverOrigin`)}),He=is({primaryOriginId:Me,secondaryOriginId:qe,statusCodes:Se.failoverStatusCodes}),wt=He.Items[0].Id}else if(Se.failoverStatusCodes)throw Error(`infrastructure.cdn.${ce}: failoverStatusCodes needs failoverOrigin to fail over to`);if(Se.routeCompute)this.appendComputeAppOrigin(Ne,Fe,ze,R,t,this.resolveComputeCachePathPatterns(Se.computeRoutes));let dt=Re&&xe?{AcmCertificateArn:Y&&!ve?{Ref:Y}:Re,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},Jt=[...ze];if(Y&&!ve&&xe)Jt.push(Y);let At={Type:"AWS::CloudFront::Distribution",...Jt.length>0?{DependsOn:Jt}:{},Properties:{DistributionConfig:{Enabled:!0,Comment:`${R} ${t} ${ce} CDN`,DefaultRootObject:"index.html",Origins:Ne,...He?{OriginGroups:He}:{},DefaultCacheBehavior:{TargetOriginId:wt,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:ot,CachedMethods:["GET","HEAD","OPTIONS"],Compress:Se.compress!==!1,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},...Fe.length>0?{CacheBehaviors:Fe}:{},...xe&&Re?{Aliases:[xe]}:{},ViewerCertificate:dt,PriceClass:"PriceClass_100",HttpVersion:Se.http3?"http2and3":"http2"}}};if(In(At.Properties.DistributionConfig,`infrastructure.cdn.${ce}`),this.builder.addResource(Ie,At),L&&xe&&Re){let qe=xe.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${qe}CdnARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Ie,...Y&&!ve?[Y]:[]],Properties:{HostedZoneId:L,Name:xe,Type:"A",AliasTarget:{HostedZoneId:"Z2FDTNDATAQYW2",DNSName:{"Fn::GetAtt":[Ie,"DomainName"]}}}})}}if(this.mergedConfig.infrastructure?.queues)for(let[ce,Se]of Object.entries(this.mergedConfig.infrastructure.queues)){if(!this.shouldDeploy(Se))continue;let{queue:xe,logicalId:ve}=be.createQueue({slug:R,environment:t,name:`${R}-${t}-${ce}`,fifo:Se.fifo,visibilityTimeout:Se.visibilityTimeout,messageRetentionPeriod:Se.messageRetentionPeriod,delaySeconds:Se.delaySeconds,maxMessageSize:Se.maxMessageSize,receiveMessageWaitTime:Se.receiveMessageWaitTime,contentBasedDeduplication:Se.contentBasedDeduplication,encrypted:Se.encrypted,kmsKeyId:Se.kmsKeyId});this.builder.addResource(ve,xe);let Re;if(Se.deadLetterQueue){let{deadLetterQueue:Ie,updatedSourceQueue:Me,deadLetterLogicalId:Ne}=be.createDeadLetterQueue(ve,{slug:R,environment:t,maxReceiveCount:Se.maxReceiveCount});Re=Ne,this.builder.addResource(Ne,Ie);let ze=this.builder.getResources()[ve];if(ze?.Properties)ze.Properties.RedrivePolicy=Me.Properties?.RedrivePolicy}if(Se.trigger){let Ie=Se.trigger,Me=`${R}${t}${Ie.functionName}`.replace(/[^a-zA-Z0-9]/g,""),Ne={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:{"Fn::GetAtt":[ve,"Arn"]},FunctionName:{Ref:Me},BatchSize:Ie.batchSize||10,MaximumBatchingWindowInSeconds:Ie.batchWindow||0,Enabled:!0,...Ie.reportBatchItemFailures!==!1&&{FunctionResponseTypes:["ReportBatchItemFailures"]},...Ie.maxConcurrency&&{ScalingConfig:{MaximumConcurrency:Ie.maxConcurrency}},...Ie.filterPattern&&{FilterCriteria:{Filters:[{Pattern:JSON.stringify(Ie.filterPattern)}]}}},DependsOn:[ve,Me]};this.builder.addResource(`${ve}Trigger`,Ne)}if(Se.alarms?.enabled){let Ie=Se.alarms,Me=Ie.notificationTopicArn;if(!Me&&Ie.notificationEmails?.length){let ze=`${ve}AlarmTopic`;this.builder.addResource(ze,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${R}-${t}-${ce}-alarms`,DisplayName:`${ce} Queue Alarms`}}),Ie.notificationEmails.forEach((ot,wt)=>{this.builder.addResource(`${ze}Sub${wt}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:ze},Protocol:"email",Endpoint:ot}})}),Me={Ref:ze}}let Ne=Ie.queueDepthThreshold||1000;this.builder.addResource(`${ve}DepthAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-${ce}-queue-depth`,AlarmDescription:`Queue ${ce} depth exceeds ${Ne} messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:Ne,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ve,"QueueName"]}}],...Me&&{AlarmActions:[Me],OKActions:[Me]}}});let Fe=Ie.messageAgeThreshold||3600;if(this.builder.addResource(`${ve}AgeAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-${ce}-message-age`,AlarmDescription:`Queue ${ce} oldest message exceeds ${Fe} seconds`,MetricName:"ApproximateAgeOfOldestMessage",Namespace:"AWS/SQS",Statistic:"Maximum",Period:300,EvaluationPeriods:2,Threshold:Fe,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ve,"QueueName"]}}],...Me&&{AlarmActions:[Me],OKActions:[Me]}}}),Re&&Ie.dlqAlarm!==!1)this.builder.addResource(`${Re}Alarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-${ce}-dlq-messages`,AlarmDescription:`Dead letter queue for ${ce} has messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Sum",Period:300,EvaluationPeriods:1,Threshold:0,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[Re,"QueueName"]}}],...Me&&{AlarmActions:[Me]}}})}if(Se.subscribe){let Ie=Se.subscribe,Me=Ie.topicArn;if(!Me&&Ie.topicName)Me={Ref:Ie.topicName};if(Me){this.builder.addResource(`${ve}SnsPolicy`,{Type:"AWS::SQS::QueuePolicy",Properties:{Queues:[{Ref:ve}],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"sns.amazonaws.com"},Action:"sqs:SendMessage",Resource:{"Fn::GetAtt":[ve,"Arn"]},Condition:{ArnEquals:{"aws:SourceArn":Me}}}]}}});let Ne={TopicArn:Me,Protocol:"sqs",Endpoint:{"Fn::GetAtt":[ve,"Arn"]},RawMessageDelivery:Ie.rawMessageDelivery||!1};if(Ie.filterPolicy)Ne.FilterPolicy=Ie.filterPolicy,Ne.FilterPolicyScope=Ie.filterPolicyScope||"MessageAttributes";this.builder.addResource(`${ve}SnsSub`,{Type:"AWS::SNS::Subscription",Properties:Ne,DependsOn:`${ve}SnsPolicy`})}}}if(this.mergedConfig.infrastructure?.realtime?.enabled)if((this.mergedConfig.infrastructure.realtime.mode||"serverless")==="server")this.generateRealtimeServerResources(R,t);else this.generateRealtimeResources(R,t);let X=this.mergedConfig.infrastructure?.redirects;if(X){let ce=X.target||this.mergedConfig.infrastructure?.dns?.domain||"",Se=X.protocol||"https";if(X.domains?.length&&ce)for(let xe of X.domains){let{bucket:ve,bucketPolicy:Re,logicalId:Ie,policyLogicalId:Me}=_t.createDomainRedirectBucket({slug:R,environment:t,sourceDomain:xe,targetDomain:ce,protocol:Se});this.builder.addResource(Ie,ve),this.builder.addResource(Me,Re)}if(X.paths&&Object.keys(X.paths).length>0){let xe=_t.fromMapping(X.paths,{statusCode:X.statusCode||301}),{function:ve,logicalId:Re}=_t.createPathRedirectFunction({slug:R,environment:t,rules:xe});this.builder.addResource(Re,ve)}}if(this.mergedConfig.infrastructure?.monitoring?.alarms)for(let[ce,Se]of Object.entries(this.mergedConfig.infrastructure.monitoring.alarms)){let{alarm:xe,logicalId:ve}=Gi.createAlarm({slug:R,environment:t,alarmName:`${R}-${t}-${ce}`,metricName:Se.metricName||"Errors",namespace:Se.namespace||"AWS/Lambda",threshold:Se.threshold||1,comparisonOperator:Se.comparisonOperator||"GreaterThanThreshold"});this.builder.addResource(ve,xe)}let ee=this.mergedConfig.infrastructure?.cache;if(ee){let ce=ee.type||"redis";if(ce==="redis"){this.generateNetworkInfrastructure(R,t);let Se=ee.redis||{},{replicationGroup:xe,subnetGroup:ve,logicalId:Re,subnetGroupId:Ie}=Hi.createRedis({slug:R,environment:t,nodeType:Se.nodeType||ee.nodeType||"cache.t3.micro",engineVersion:Se.engineVersion||"7.1",port:Se.port||6379,numCacheClusters:Se.numCacheNodes||2,automaticFailover:Se.automaticFailoverEnabled!==!1,atRestEncryption:!0,transitEncryption:!0,snapshotRetentionDays:Se.snapshotRetentionLimit||7,snapshotWindow:Se.snapshotWindow,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(Re,xe),ve&&Ie)this.builder.addResource(Ie,ve);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[Re,"PrimaryEndPoint.Address"]},Description:"Redis primary endpoint address"}),this.builder.addOutput("CachePort",{Value:{"Fn::GetAtt":[Re,"PrimaryEndPoint.Port"]},Description:"Redis primary endpoint port"})}else if(ce==="memcached"){this.generateNetworkInfrastructure(R,t);let Se=ee.elasticache||{},{cluster:xe,subnetGroup:ve,logicalId:Re,subnetGroupId:Ie}=Hi.createMemcached({slug:R,environment:t,nodeType:Se.nodeType||ee.nodeType||"cache.t3.micro",engineVersion:Se.engineVersion||"1.6.22",numCacheNodes:Se.numCacheNodes||2,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(Re,xe),ve&&Ie)this.builder.addResource(Ie,ve);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[Re,"ConfigurationEndpoint.Address"]},Description:"Memcached configuration endpoint address"})}}let oe=this.mergedConfig.infrastructure?.email;if(oe){let ce=oe.domain||this.mergedConfig.infrastructure?.dns?.domain;if(ce){let{emailIdentity:Se,logicalId:xe}=N.verifyDomain({domain:ce,slug:R,environment:t,enableDkim:oe.enableDkim!==!1,dkimKeyLength:oe.dkimKeyLength||"RSA_2048_BIT"});if(this.builder.addResource(xe,Se),oe.configurationSet!==!1){let{configurationSet:Ie,logicalId:Me}=N.createConfigurationSet({slug:R,environment:t});this.builder.addResource(Me,Ie)}let ve=oe.hostedZoneId||this.mergedConfig.infrastructure?.dns?.hostedZoneId;if(ve){if(oe.enableDkim!==!1)for(let ze=1;ze<=3;ze++){let ot=`DkimRecord${ze}${ce.replace(/\./g,"")}`;this.builder.addResource(ot,{Type:"AWS::Route53::RecordSet",DependsOn:[xe],Properties:{HostedZoneId:ve,Name:{"Fn::GetAtt":[xe,`DkimDNSTokenName${ze}`]},Type:"CNAME",TTL:1800,ResourceRecords:[{"Fn::GetAtt":[xe,`DkimDNSTokenValue${ze}`]}]}})}let{record:Ie,logicalId:Me}=N.createSpfRecord(ce,ve);this.builder.addResource(Me,Ie);let{record:Ne,logicalId:Fe}=N.createDmarcRecord(ce,ve,{policy:"none",reportingEmail:oe.dmarcReportingEmail||`dmarc-reports@${ce}`});this.builder.addResource(Fe,Ne)}this.builder.addOutput("EmailDomain",{Value:ce,Description:"SES verified email domain"});let Re=oe.server;if(Re?.enabled&&ve){let Ie=this.mergedConfig.environments[t]?.region||this.mergedConfig.project.region||"us-east-1",Me=`${R}-${t}-email`,{role:Ne,policy:Fe,roleLogicalId:ze,policyLogicalId:ot}=N.createEmailLambdaRole({slug:R,environment:t,s3BucketArn:`arn:aws:s3:::${Me}`,sesIdentityArn:`arn:aws:ses:${Ie}:*:identity/${ce}`});this.builder.addResource(ze,Ne),this.builder.addResource(ot,Fe);let{function:wt,permission:He,logicalId:dt,permissionLogicalId:Jt}=N.createInboundEmailLambda({slug:R,environment:t,roleArn:{"Fn::GetAtt":[ze,"Arn"]},s3BucketName:Me,organizedPrefix:"mailboxes/"});this.builder.addResource(dt,wt),this.builder.addResource(Jt,He);let At=N.createInboundEmailSetup({slug:R,environment:t,domain:ce,s3BucketName:Me,s3KeyPrefix:"inbox/",region:Ie,hostedZoneId:ve,lambdaFunctionArn:{"Fn::GetAtt":[dt,"Arn"]}});for(let[xt,Ot]of Object.entries(At.resources)){if(Ot.Type==="AWS::SES::ReceiptRule")Ot.DependsOn=[Jt,dt];this.builder.addResource(xt,Ot)}this.builder.addOutput("InboundEmailLambda",{Value:{Ref:dt},Description:"Inbound email processing Lambda function"}),this.builder.addOutput("EmailBucket",{Value:Me,Description:"S3 bucket for email storage"});let qe=this.serverEipLogicalIds.get("app");if(qe&&ve){let Ot=`${Re?.subdomain||"mail"}.${ce}`,Ke=Ot.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${Ke}ARecord`,{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:ve,Name:Ot,Type:"A",TTL:"300",ResourceRecords:[{Ref:qe}]}})}this.builder.addOutput("MailHost",{Value:`mail.${ce}`,Description:"Mail server hostname for SMTP/IMAP clients"})}}}let se=this.mergedConfig.infrastructure?.search;if(se){let ce=se.vpc?{subnetIds:[{Ref:"PublicSubnet1"}],securityGroupIds:[]}:void 0;if(ce)this.generateNetworkInfrastructure(R,t);let{domain:Se,logicalId:xe}=tr.createDomain({slug:R,environment:t,engineVersion:se.engineVersion||"OpenSearch_2.11",instanceType:se.instanceType||"t3.small.search",instanceCount:se.instanceCount||1,volumeSize:se.volumeSize||10,volumeType:se.volumeType||"gp3",dedicatedMaster:se.dedicatedMaster||!1,dedicatedMasterType:se.dedicatedMasterType,dedicatedMasterCount:se.dedicatedMasterCount||3,multiAz:se.multiAz||!1,encryption:se.encryption||{atRest:!0,nodeToNode:!0},advancedSecurity:se.advancedSecurity,autoTune:se.autoTune!==!1,vpc:ce});this.builder.addResource(xe,Se),this.builder.addOutput("SearchDomainEndpoint",{Value:{"Fn::GetAtt":[xe,"DomainEndpoint"]},Description:"OpenSearch domain endpoint"}),this.builder.addOutput("SearchDomainArn",{Value:{"Fn::GetAtt":[xe,"Arn"]},Description:"OpenSearch domain ARN"})}let ue=this.mergedConfig.infrastructure?.fileSystem;if(ue&&Object.keys(ue).length>0){this.generateNetworkInfrastructure(R,t);for(let[ce,Se]of Object.entries(ue)){let{fileSystem:xe,logicalId:ve}=lt.createFileSystem({slug:`${R}-${ce}`,environment:t,encrypted:Se.encrypted!==!1,performanceMode:Se.performanceMode||"generalPurpose",throughputMode:Se.throughputMode||"bursting",enableBackup:!0});this.builder.addResource(ve,xe);let{securityGroup:Re,logicalId:Ie}=lt.createEfsSecurityGroup({slug:`${R}-${ce}`,environment:t,vpcId:{Ref:"VPC"},sourceCidrBlocks:["10.0.0.0/16"]});this.builder.addResource(Ie,Re);let{mountTargets:Me,logicalIds:Ne}=lt.createMultiAzMountTargets(ve,{slug:`${R}-${ce}`,environment:t,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],securityGroupId:{Ref:Ie}});for(let Fe=0;Fe<Me.length;Fe++)this.builder.addResource(Ne[Fe],Me[Fe]);this.builder.addOutput(`${ce}FileSystemId`,{Value:{Ref:ve},Description:`EFS file system ID for ${ce}`})}}let ke=this.mergedConfig.infrastructure?.ai;if(ke){let ce=ke.service||"ecs",Se=ke.models||["*"],xe=ke.allowStreaming!==!1,ve;if(ce==="ecs")ve=We.enableBedrockForEcs({slug:R,environment:t,models:Se,allowStreaming:xe});else if(ce==="ec2")ve=We.enableBedrockForEc2({slug:R,environment:t,models:Se,allowStreaming:xe});else if(ce==="lambda")ve=We.enableBedrockForLambda({slug:R,environment:t,models:Se,allowStreaming:xe});else ve=We.createBedrockRole(ce,{slug:R,environment:t,models:Se,allowStreaming:xe});if(this.builder.addResource(ve.logicalId,ve.role),ke.allowAsync){let{policy:Re,logicalId:Ie}=We.createBedrockPolicy({slug:R,environment:t,models:Se,allowStreaming:xe,allowAsync:!0});this.builder.addResource(Ie,Re)}this.builder.addOutput("BedrockRoleArn",{Value:{"Fn::GetAtt":[ve.logicalId,"Arn"]},Description:"IAM role ARN with Bedrock permissions"})}}generateRealtimeResources(R,t){let m=this.mergedConfig.infrastructure?.realtime;if(!m)return;let k=m.name||`${R}-${t}-realtime`,I=m.scaling||{},L=m.storage||{type:"dynamodb"},z=I.handlerMemory||256,Y=I.handlerTimeout||30,Z=`${R}${t}RealtimeConnections`.replace(/[^a-zA-Z0-9]/g,""),X=`${R}${t}RealtimeChannels`.replace(/[^a-zA-Z0-9]/g,"");if(L.type==="dynamodb"){let Ne=L.dynamodb||{},Fe=Ne.billingMode||"PAY_PER_REQUEST";this.builder.addResource(Z,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${R}-${t}-realtime-connections`,BillingMode:Fe,AttributeDefinitions:[{AttributeName:"connectionId",AttributeType:"S"},{AttributeName:"userId",AttributeType:"S"}],KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],GlobalSecondaryIndexes:[{IndexName:"userId-index",KeySchema:[{AttributeName:"userId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...Fe==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Ne.readCapacity||5,WriteCapacityUnits:Ne.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...Fe==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Ne.readCapacity||5,WriteCapacityUnits:Ne.writeCapacity||5}},...Ne.pointInTimeRecovery&&{PointInTimeRecoverySpecification:{PointInTimeRecoveryEnabled:!0}},Tags:[{Key:"Name",Value:`${R}-${t}-realtime-connections`},{Key:"Environment",Value:t}]}}),this.builder.addResource(X,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${R}-${t}-realtime-channels`,BillingMode:Fe,AttributeDefinitions:[{AttributeName:"channel",AttributeType:"S"},{AttributeName:"connectionId",AttributeType:"S"}],KeySchema:[{AttributeName:"channel",KeyType:"HASH"},{AttributeName:"connectionId",KeyType:"RANGE"}],GlobalSecondaryIndexes:[{IndexName:"connectionId-index",KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...Fe==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Ne.readCapacity||5,WriteCapacityUnits:Ne.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...Fe==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Ne.readCapacity||5,WriteCapacityUnits:Ne.writeCapacity||5}},Tags:[{Key:"Name",Value:`${R}-${t}-realtime-channels`},{Key:"Environment",Value:t}]}})}let ee=`${R}${t}RealtimeRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ee,{Type:"AWS::IAM::Role",Properties:{RoleName:`${R}-${t}-realtime-handler-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"RealtimeHandlerPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:UpdateItem"],Resource:[{"Fn::GetAtt":[Z,"Arn"]},{"Fn::Sub":`\${${Z}.Arn}/index/*`},{"Fn::GetAtt":[X,"Arn"]},{"Fn::Sub":`\${${X}.Arn}/index/*`}]},{Effect:"Allow",Action:"execute-api:ManageConnections",Resource:{"Fn::Sub":"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/*"}}]}}]}});let oe=`${R}${t}RealtimeConnect`.replace(/[^a-zA-Z0-9]/g,""),se=`${R}${t}RealtimeDisconnect`.replace(/[^a-zA-Z0-9]/g,""),ue=`${R}${t}RealtimeMessage`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(oe,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${R}-${t}-realtime-connect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[ee,"Arn"]},MemorySize:z,Timeout:Y,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:Z},CHANNELS_TABLE:{Ref:X},ENVIRONMENT:t}},Code:{ZipFile:this.generateConnectHandlerCode()}},DependsOn:[ee,Z]}),this.builder.addResource(se,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${R}-${t}-realtime-disconnect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[ee,"Arn"]},MemorySize:z,Timeout:Y,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:Z},CHANNELS_TABLE:{Ref:X},ENVIRONMENT:t}},Code:{ZipFile:this.generateDisconnectHandlerCode()}},DependsOn:[ee,Z,X]}),this.builder.addResource(ue,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${R}-${t}-realtime-message`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[ee,"Arn"]},MemorySize:z,Timeout:Y,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:Z},CHANNELS_TABLE:{Ref:X},ENVIRONMENT:t}},Code:{ZipFile:this.generateMessageHandlerCode()}},DependsOn:[ee,Z,X]});let ke=`${R}${t}RealtimeApi`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ke,{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:k,ProtocolType:"WEBSOCKET",RouteSelectionExpression:"$request.body.action",Tags:{Name:k,Environment:t}}});let ce=`${oe}Permission`,Se=`${se}Permission`,xe=`${ue}Permission`;this.builder.addResource(ce,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:oe},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${ke}}/*/$connect`}}}),this.builder.addResource(Se,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:se},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${ke}}/*/$disconnect`}}}),this.builder.addResource(xe,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:ue},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${ke}}/*/$default`}}});let ve=`${ke}ConnectInteg`,Re=`${ke}DisconnectInteg`,Ie=`${ke}MessageInteg`;this.builder.addResource(ve,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:ke},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${oe}.Arn}/invocations`}}}),this.builder.addResource(Re,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:ke},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${se}.Arn}/invocations`}}}),this.builder.addResource(Ie,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:ke},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${ue}.Arn}/invocations`}}}),this.builder.addResource(`${ke}ConnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:ke},RouteKey:"$connect",AuthorizationType:"NONE",Target:{"Fn::Sub":`integrations/\${${ve}}`}}}),this.builder.addResource(`${ke}DisconnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:ke},RouteKey:"$disconnect",Target:{"Fn::Sub":`integrations/\${${Re}}`}}}),this.builder.addResource(`${ke}DefaultRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:ke},RouteKey:"$default",Target:{"Fn::Sub":`integrations/\${${Ie}}`}}});let Me=`${ke}Stage`;if(this.builder.addResource(Me,{Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:{Ref:ke},StageName:t,AutoDeploy:!0,DefaultRouteSettings:{ThrottlingBurstLimit:I.messagesPerSecond||1000,ThrottlingRateLimit:I.messagesPerSecond||1000}}}),m.monitoring?.enabled){let Ne=m.monitoring,Fe=Ne.notificationTopicArn;if(!Fe&&Ne.notificationEmails?.length){let ze=`${ke}AlarmTopic`;this.builder.addResource(ze,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${R}-${t}-realtime-alarms`,DisplayName:"Realtime WebSocket Alarms"}}),Ne.notificationEmails.forEach((ot,wt)=>{this.builder.addResource(`${ze}Sub${wt}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:ze},Protocol:"email",Endpoint:ot}})}),Fe={Ref:ze}}if(Ne.connectionThreshold)this.builder.addResource(`${ke}ConnectionAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-realtime-connections`,AlarmDescription:`WebSocket connections exceed ${Ne.connectionThreshold}`,MetricName:"ConnectCount",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:300,EvaluationPeriods:2,Threshold:Ne.connectionThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:ke}}],...Fe&&{AlarmActions:[Fe]}}});if(Ne.errorThreshold)this.builder.addResource(`${ke}ErrorAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-realtime-errors`,AlarmDescription:`WebSocket errors exceed ${Ne.errorThreshold}/min`,MetricName:"ExecutionError",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:60,EvaluationPeriods:3,Threshold:Ne.errorThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:ke}}],...Fe&&{AlarmActions:[Fe]}}})}this.builder.addOutput(`${ke}Endpoint`,{Description:"WebSocket API endpoint URL",Value:{"Fn::Sub":`wss://\${${ke}}.execute-api.\${AWS::Region}.amazonaws.com/${t}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}}),this.builder.addOutput(`${ke}Id`,{Description:"WebSocket API ID",Value:{Ref:ke},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-api-id"}}})}generateConnectHandlerCode(){return`
 const { DynamoDBClient } = require('@aws-sdk/client-dynamodb');
 const { DynamoDBDocumentClient, PutCommand } = require('@aws-sdk/lib-dynamodb');
 
@@ -256,7 +256,7 @@ catch (error) {
     return { statusCode: 500, body: JSON.stringify({ error: 'Internal error' }) };
   }
 };
-`.trim()}generateRealtimeServerResources(R,t){let m=this.mergedConfig.infrastructure?.realtime;if(!m)return;let k=m.server||{},I=k.port||6001,L=k.instances||1,z=`${R}${t}RealtimeSG`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(z,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`Security group for ${R} realtime WebSocket server`,GroupName:`${R}-${t}-realtime-sg`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:I,ToPort:I,CidrIp:"0.0.0.0/0",Description:"WebSocket connections"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS/WSS connections"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${R}-${t}-realtime-sg`},{Key:"Environment",Value:t}]}});let Y=`${R}${t}RealtimeTaskDef`.replace(/[^a-zA-Z0-9]/g,""),Z=`${R}${t}RealtimeTaskRole`.replace(/[^a-zA-Z0-9]/g,""),X=`${R}${t}RealtimeExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(X,{Type:"AWS::IAM::Role",Properties:{RoleName:`${R}-${t}-realtime-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]}}),this.builder.addResource(Z,{Type:"AWS::IAM::Role",Properties:{RoleName:`${R}-${t}-realtime-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"RealtimeTaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},...k.redis?.enabled?[{Effect:"Allow",Action:["elasticache:DescribeCacheClusters","elasticache:DescribeReplicationGroups"],Resource:"*"}]:[]]}}]}});let ie=[{Name:"BROADCAST_HOST",Value:k.host||"0.0.0.0"},{Name:"BROADCAST_PORT",Value:String(I)},{Name:"NODE_ENV",Value:t==="production"?"production":"development"}];if(k.redis?.enabled){if(k.redis.useElastiCache)ie.push({Name:"REDIS_HOST",Value:{"Fn::GetAtt":["CacheCluster","RedisEndpoint.Address"]}}),ie.push({Name:"REDIS_PORT",Value:{"Fn::GetAtt":["CacheCluster","RedisEndpoint.Port"]}});else ie.push({Name:"REDIS_HOST",Value:k.redis.host||"localhost"}),ie.push({Name:"REDIS_PORT",Value:String(k.redis.port||6379)});if(k.redis.keyPrefix)ie.push({Name:"REDIS_KEY_PREFIX",Value:k.redis.keyPrefix})}this.builder.addResource(Y,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${R}-${t}-realtime`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:"512",Memory:"1024",ExecutionRoleArn:{"Fn::GetAtt":[X,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[Z,"Arn"]},ContainerDefinitions:[{Name:"realtime",Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${R}-realtime:latest`},Essential:!0,PortMappings:[{ContainerPort:I,Protocol:"tcp"}],Environment:ie,LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":`/ecs/${R}-${t}-realtime`,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":"realtime"}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${I}${k.healthCheckPath||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${R}-${t}-realtime`},{Key:"Environment",Value:t}]},DependsOn:[X,Z]});let oe=`${R}${t}RealtimeLogs`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(oe,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:`/ecs/${R}-${t}-realtime`,RetentionInDays:30}});let ae=`${R}${t}RealtimeService`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(ae,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${R}-${t}-realtime`,Cluster:{Ref:"ECSCluster"},TaskDefinition:{Ref:Y},DesiredCount:L,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:z}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},HealthCheckGracePeriodSeconds:60,Tags:[{Key:"Name",Value:`${R}-${t}-realtime`},{Key:"Environment",Value:t}]},DependsOn:[Y,z,oe]}),k.autoScaling){let be=k.autoScaling,Ae=`${R}${t}RealtimeScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(Ae,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:be.max||10,MinCapacity:be.min||1,ResourceId:{"Fn::Sub":`service/\${ECSCluster}/${R}-${t}-realtime`},RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs"},DependsOn:ae}),be.targetCPU)this.builder.addResource(`${R}${t}RealtimeCPUPolicy`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${R}-${t}-realtime-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:Ae},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:be.targetCPU,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(m.monitoring?.enabled){let be=m.monitoring,Ae=be.notificationTopicArn;if(!Ae&&be.notificationEmails?.length){let de=`${R}${t}RealtimeAlarmTopic`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(de,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${R}-${t}-realtime-alarms`,DisplayName:"Realtime Server Alarms"}}),be.notificationEmails.forEach((ke,De)=>{this.builder.addResource(`${de}Sub${De}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:de},Protocol:"email",Endpoint:ke}})}),Ae={Ref:de}}this.builder.addResource(`${R}${t}RealtimeCPUAlarm`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-realtime-high-cpu`,AlarmDescription:"Realtime server CPU utilization is high",MetricName:"CPUUtilization",Namespace:"AWS/ECS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:80,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ClusterName",Value:{Ref:"ECSCluster"}},{Name:"ServiceName",Value:`${R}-${t}-realtime`}],...Ae&&{AlarmActions:[Ae]}},DependsOn:ae}),this.builder.addResource(`${R}${t}RealtimeMemoryAlarm`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-realtime-high-memory`,AlarmDescription:"Realtime server memory utilization is high",MetricName:"MemoryUtilization",Namespace:"AWS/ECS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:80,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ClusterName",Value:{Ref:"ECSCluster"}},{Name:"ServiceName",Value:`${R}-${t}-realtime`}],...Ae&&{AlarmActions:[Ae]}},DependsOn:ae})}this.builder.addOutput(`${R}${t}RealtimeEndpoint`.replace(/[^a-zA-Z0-9]/g,""),{Description:"Realtime WebSocket server endpoint",Value:{"Fn::Sub":`wss://${R}-${t}-realtime.\${AWS::Region}.elb.amazonaws.com:${I}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}})}generateBroadcastConfig(){let R=this.mergedConfig.infrastructure?.realtime;if(!R||R.mode!=="server")return"";let t=R.server||{};return`import type { BroadcastConfig } from 'ts-broadcasting'
+`.trim()}generateRealtimeServerResources(R,t){let m=this.mergedConfig.infrastructure?.realtime;if(!m)return;let k=m.server||{},I=k.port||6001,L=k.instances||1,z=`${R}${t}RealtimeSG`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(z,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`Security group for ${R} realtime WebSocket server`,GroupName:`${R}-${t}-realtime-sg`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:I,ToPort:I,CidrIp:"0.0.0.0/0",Description:"WebSocket connections"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS/WSS connections"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${R}-${t}-realtime-sg`},{Key:"Environment",Value:t}]}});let Y=`${R}${t}RealtimeTaskDef`.replace(/[^a-zA-Z0-9]/g,""),Z=`${R}${t}RealtimeTaskRole`.replace(/[^a-zA-Z0-9]/g,""),X=`${R}${t}RealtimeExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(X,{Type:"AWS::IAM::Role",Properties:{RoleName:`${R}-${t}-realtime-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]}}),this.builder.addResource(Z,{Type:"AWS::IAM::Role",Properties:{RoleName:`${R}-${t}-realtime-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"RealtimeTaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},...k.redis?.enabled?[{Effect:"Allow",Action:["elasticache:DescribeCacheClusters","elasticache:DescribeReplicationGroups"],Resource:"*"}]:[]]}}]}});let ee=[{Name:"BROADCAST_HOST",Value:k.host||"0.0.0.0"},{Name:"BROADCAST_PORT",Value:String(I)},{Name:"NODE_ENV",Value:t==="production"?"production":"development"}];if(k.redis?.enabled){if(k.redis.useElastiCache)ee.push({Name:"REDIS_HOST",Value:{"Fn::GetAtt":["CacheCluster","RedisEndpoint.Address"]}}),ee.push({Name:"REDIS_PORT",Value:{"Fn::GetAtt":["CacheCluster","RedisEndpoint.Port"]}});else ee.push({Name:"REDIS_HOST",Value:k.redis.host||"localhost"}),ee.push({Name:"REDIS_PORT",Value:String(k.redis.port||6379)});if(k.redis.keyPrefix)ee.push({Name:"REDIS_KEY_PREFIX",Value:k.redis.keyPrefix})}this.builder.addResource(Y,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${R}-${t}-realtime`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:"512",Memory:"1024",ExecutionRoleArn:{"Fn::GetAtt":[X,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[Z,"Arn"]},ContainerDefinitions:[{Name:"realtime",Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${R}-realtime:latest`},Essential:!0,PortMappings:[{ContainerPort:I,Protocol:"tcp"}],Environment:ee,LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":`/ecs/${R}-${t}-realtime`,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":"realtime"}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${I}${k.healthCheckPath||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${R}-${t}-realtime`},{Key:"Environment",Value:t}]},DependsOn:[X,Z]});let oe=`${R}${t}RealtimeLogs`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(oe,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:`/ecs/${R}-${t}-realtime`,RetentionInDays:30}});let se=`${R}${t}RealtimeService`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(se,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${R}-${t}-realtime`,Cluster:{Ref:"ECSCluster"},TaskDefinition:{Ref:Y},DesiredCount:L,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:z}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},HealthCheckGracePeriodSeconds:60,Tags:[{Key:"Name",Value:`${R}-${t}-realtime`},{Key:"Environment",Value:t}]},DependsOn:[Y,z,oe]}),k.autoScaling){let ue=k.autoScaling,ke=`${R}${t}RealtimeScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(ke,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:ue.max||10,MinCapacity:ue.min||1,ResourceId:{"Fn::Sub":`service/\${ECSCluster}/${R}-${t}-realtime`},RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs"},DependsOn:se}),ue.targetCPU)this.builder.addResource(`${R}${t}RealtimeCPUPolicy`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${R}-${t}-realtime-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:ke},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:ue.targetCPU,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(m.monitoring?.enabled){let ue=m.monitoring,ke=ue.notificationTopicArn;if(!ke&&ue.notificationEmails?.length){let ce=`${R}${t}RealtimeAlarmTopic`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ce,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${R}-${t}-realtime-alarms`,DisplayName:"Realtime Server Alarms"}}),ue.notificationEmails.forEach((Se,xe)=>{this.builder.addResource(`${ce}Sub${xe}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:ce},Protocol:"email",Endpoint:Se}})}),ke={Ref:ce}}this.builder.addResource(`${R}${t}RealtimeCPUAlarm`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-realtime-high-cpu`,AlarmDescription:"Realtime server CPU utilization is high",MetricName:"CPUUtilization",Namespace:"AWS/ECS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:80,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ClusterName",Value:{Ref:"ECSCluster"}},{Name:"ServiceName",Value:`${R}-${t}-realtime`}],...ke&&{AlarmActions:[ke]}},DependsOn:se}),this.builder.addResource(`${R}${t}RealtimeMemoryAlarm`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${R}-${t}-realtime-high-memory`,AlarmDescription:"Realtime server memory utilization is high",MetricName:"MemoryUtilization",Namespace:"AWS/ECS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:80,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ClusterName",Value:{Ref:"ECSCluster"}},{Name:"ServiceName",Value:`${R}-${t}-realtime`}],...ke&&{AlarmActions:[ke]}},DependsOn:se})}this.builder.addOutput(`${R}${t}RealtimeEndpoint`.replace(/[^a-zA-Z0-9]/g,""),{Description:"Realtime WebSocket server endpoint",Value:{"Fn::Sub":`wss://${R}-${t}-realtime.\${AWS::Region}.elb.amazonaws.com:${I}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}})}generateBroadcastConfig(){let R=this.mergedConfig.infrastructure?.realtime;if(!R||R.mode!=="server")return"";let t=R.server||{};return`import type { BroadcastConfig } from 'ts-broadcasting'
 
 export default {
   verbose: ${this.environment!=="production"},
@@ -305,164 +305,164 @@ ${t.loadManagement?.enabled?`
   },
 `:""}
 } satisfies BroadcastConfig
-`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function ts(R){let t=[],m=[];if(!R.AWSTemplateFormatVersion)t.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(R.AWSTemplateFormatVersion!=="2010-09-09")m.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!R.Resources||Object.keys(R.Resources).length===0)t.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[k,I]of Object.entries(R.Resources))ip(k,I,t,m);if(R.Resources){let k=ap(R.Resources);if(k.length>0)t.push({path:"Resources",message:`Circular dependencies detected: ${k.join(" -> ")}`,severity:"error"})}if(R.Parameters)for(let[k,I]of Object.entries(R.Parameters))op(k,I,t,m);if(R.Outputs)for(let[k,I]of Object.entries(R.Outputs))sp(k,I,t,m);return{valid:t.length===0,errors:t,warnings:m}}function ip(R,t,m,k){if(!t.Type)m.push({path:`Resources.${R}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(R))k.push({path:`Resources.${R}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(t.Type&&!t.Type.startsWith("AWS::")&&!t.Type.startsWith("Custom::"))m.push({path:`Resources.${R}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(t.Properties){for(let[I,L]of Object.entries(t.Properties))if(L===void 0||L===null)k.push({path:`Resources.${R}.Properties.${I}`,message:"Property has undefined or null value",severity:"warning"})}if(t.DependsOn){if(typeof t.DependsOn==="string"){if(t.DependsOn===R)m.push({path:`Resources.${R}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(t.DependsOn)){if(t.DependsOn.includes(R))m.push({path:`Resources.${R}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function op(R,t,m,k){if(!t.Type)m.push({path:`Parameters.${R}.Type`,message:"Parameter Type is required",severity:"error"});let I=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(t.Type&&!I.includes(t.Type)&&!t.Type.startsWith("AWS::"))k.push({path:`Parameters.${R}.Type`,message:`Uncommon parameter type: ${t.Type}`,severity:"warning"});if(t.NoEcho&&t.Default)k.push({path:`Parameters.${R}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function sp(R,t,m,k){if(!t.Value)m.push({path:`Outputs.${R}.Value`,message:"Output Value is required",severity:"error"})}function ap(R){let t={};for(let[z,Y]of Object.entries(R)){if(t[z]=[],Y.DependsOn){if(typeof Y.DependsOn==="string")t[z].push(Y.DependsOn);else if(Array.isArray(Y.DependsOn))t[z].push(...Y.DependsOn)}let Z=Ja(Y);t[z].push(...Z)}let m=new Set,k=new Set,I=[];function L(z,Y){m.add(z),k.add(z),Y.push(z);let Z=t[z]||[];for(let X of Z)if(!m.has(X)){if(L(X,Y))return!0}else if(k.has(X)){let ie=Y.indexOf(X);return I.push(...Y.slice(ie),X),!0}return Y.pop(),k.delete(z),!1}for(let z of Object.keys(t))if(!m.has(z)){if(L(z,[]))return I}return[]}function Ja(R,t=[]){if(typeof R!=="object"||R===null)return t;if(Array.isArray(R)){for(let m of R)Ja(m,t);return t}if(R.Ref&&typeof R.Ref==="string"&&!R.Ref.startsWith("AWS::"))t.push(R.Ref);if(R["Fn::GetAtt"]){let m=R["Fn::GetAtt"];if(Array.isArray(m)&&m.length>0)t.push(m[0])}for(let m of Object.values(R))Ja(m,t);return t}function is(R){let t=[],m=[],k=new TextEncoder().encode(R).length,I=51200,L=460800;if(k>51200)if(k>460800)t.push({path:"template",message:`Template size (${k} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else m.push({path:"template",message:`Template size (${k} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:t.length===0,errors:t,warnings:m}}function os(R){let t=[],m=[],k=R.Resources?Object.keys(R.Resources).length:0,I=R.Parameters?Object.keys(R.Parameters).length:0,L=R.Outputs?Object.keys(R.Outputs).length:0;if(k>500)t.push({path:"Resources",message:`Template has ${k} resources, exceeding the limit of 500`,severity:"error"});else if(k>200)m.push({path:"Resources",message:`Template has ${k} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(I>200)t.push({path:"Parameters",message:`Template has ${I} parameters, exceeding the limit of 200`,severity:"error"});if(L>200)t.push({path:"Outputs",message:`Template has ${L} outputs, exceeding the limit of 200`,severity:"error"});return{valid:t.length===0,errors:t,warnings:m}}function En(R,t={}){let m={ok:!1,code:"unsupported_capability",exitCode:2,command:R,provider:t.provider,target:t.target,retryable:!1,nextAction:t.nextAction??"Run `cloud capabilities` and choose a supported driver operation.",message:t.message??`${R} is not supported by the selected provider driver.`};if(r(`${m.message} ${m.nextAction}`),t.setProcessExitCode!==!1)process.exitCode=m.exitCode;return m}function Ya(R){R.command("generate","Generate CloudFormation templates").alias("gen").option("--output <path>","Output directory for templates",{default:"cloudformation"}).option("--format <format>","Output format: json or yaml",{default:"json"}).option("--module <module>","Generate specific module only").action(async(t)=>{i("Generating CloudFormation Templates");let m=new s("Loading configuration...");m.start();try{let k=await Ne();m.succeed("Configuration loaded");let I=t?.output||"cloudformation",L=t?.format||"json",z=t?.env||"production";if(!cp(I))await lp(I,{recursive:!0});u("Generating infrastructure...");let Y=new Ro({config:k,environment:z,modules:t?.module?[t.module]:void 0}),Z=new s("Generating CloudFormation template...");Z.start(),Y.generate();let X=L==="yaml"?Y.toYAML():Y.toJSON();Z.succeed("Template generated"),u("Validating template...");let ie=JSON.parse(Y.toJSON()),oe=ts(ie),ae=is(X),be=os(ie),Ae=[...oe.errors,...ae.errors,...be.errors];if(Ae.length>0){r("Template validation failed:");for(let Le of Ae)r(`  - ${Le.path}: ${Le.message}`);if(k.project?.slug===Ln.project?.slug)a("No project config was loaded — this is the built-in default ("+`project.slug "${Ln.project?.slug}"). Check that cloud.config.ts is in ${process.cwd()} and is not shadowed by another config file.`);process.exitCode=1;return}n("Template validated successfully");let de=[...oe.warnings,...ae.warnings,...be.warnings];if(de.length>0)for(let Le of de)a(`  - ${Le.path}: ${Le.message}`);let ke=up(I,`${z}.${L}`);await dp(ke,X),n(`Generated ${ke}`);let De=Y.getBuilder(),Se=Object.keys(De.getResources()).length;e(`
-Generated ${Se} resources:`);let Re=De.getResources(),Pe={};for(let Le of Object.values(Re)){let Be=Le.Type;Pe[Be]=(Pe[Be]||0)+1}let ze=Object.entries(Pe).sort((Le,Be)=>Be[1]-Le[1]);for(let[Le,Be]of ze)e(`  - ${Le}: ${Be}`);e(`
+`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function Yo(R){let t=[],m=[];if(!R.AWSTemplateFormatVersion)t.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(R.AWSTemplateFormatVersion!=="2010-09-09")m.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!R.Resources||Object.keys(R.Resources).length===0)t.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[k,I]of Object.entries(R.Resources))ip(k,I,t,m);if(R.Resources){let k=ap(R.Resources);if(k.length>0)t.push({path:"Resources",message:`Circular dependencies detected: ${k.join(" -> ")}`,severity:"error"})}if(R.Parameters)for(let[k,I]of Object.entries(R.Parameters))op(k,I,t,m);if(R.Outputs)for(let[k,I]of Object.entries(R.Outputs))sp(k,I,t,m);return{valid:t.length===0,errors:t,warnings:m}}function ip(R,t,m,k){if(!t.Type)m.push({path:`Resources.${R}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(R))k.push({path:`Resources.${R}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(t.Type&&!t.Type.startsWith("AWS::")&&!t.Type.startsWith("Custom::"))m.push({path:`Resources.${R}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(t.Properties){for(let[I,L]of Object.entries(t.Properties))if(L===void 0||L===null)k.push({path:`Resources.${R}.Properties.${I}`,message:"Property has undefined or null value",severity:"warning"})}if(t.DependsOn){if(typeof t.DependsOn==="string"){if(t.DependsOn===R)m.push({path:`Resources.${R}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(t.DependsOn)){if(t.DependsOn.includes(R))m.push({path:`Resources.${R}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function op(R,t,m,k){if(!t.Type)m.push({path:`Parameters.${R}.Type`,message:"Parameter Type is required",severity:"error"});let I=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(t.Type&&!I.includes(t.Type)&&!t.Type.startsWith("AWS::"))k.push({path:`Parameters.${R}.Type`,message:`Uncommon parameter type: ${t.Type}`,severity:"warning"});if(t.NoEcho&&t.Default)k.push({path:`Parameters.${R}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function sp(R,t,m,k){if(!t.Value)m.push({path:`Outputs.${R}.Value`,message:"Output Value is required",severity:"error"})}function ap(R){let t={};for(let[z,Y]of Object.entries(R)){if(t[z]=[],Y.DependsOn){if(typeof Y.DependsOn==="string")t[z].push(Y.DependsOn);else if(Array.isArray(Y.DependsOn))t[z].push(...Y.DependsOn)}let Z=Ja(Y);t[z].push(...Z)}let m=new Set,k=new Set,I=[];function L(z,Y){m.add(z),k.add(z),Y.push(z);let Z=t[z]||[];for(let X of Z)if(!m.has(X)){if(L(X,Y))return!0}else if(k.has(X)){let ee=Y.indexOf(X);return I.push(...Y.slice(ee),X),!0}return Y.pop(),k.delete(z),!1}for(let z of Object.keys(t))if(!m.has(z)){if(L(z,[]))return I}return[]}function Ja(R,t=[]){if(typeof R!=="object"||R===null)return t;if(Array.isArray(R)){for(let m of R)Ja(m,t);return t}if(R.Ref&&typeof R.Ref==="string"&&!R.Ref.startsWith("AWS::"))t.push(R.Ref);if(R["Fn::GetAtt"]){let m=R["Fn::GetAtt"];if(Array.isArray(m)&&m.length>0)t.push(m[0])}for(let m of Object.values(R))Ja(m,t);return t}function Xo(R){let t=[],m=[],k=new TextEncoder().encode(R).length,I=51200,L=460800;if(k>51200)if(k>460800)t.push({path:"template",message:`Template size (${k} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else m.push({path:"template",message:`Template size (${k} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:t.length===0,errors:t,warnings:m}}function es(R){let t=[],m=[],k=R.Resources?Object.keys(R.Resources).length:0,I=R.Parameters?Object.keys(R.Parameters).length:0,L=R.Outputs?Object.keys(R.Outputs).length:0;if(k>500)t.push({path:"Resources",message:`Template has ${k} resources, exceeding the limit of 500`,severity:"error"});else if(k>200)m.push({path:"Resources",message:`Template has ${k} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(I>200)t.push({path:"Parameters",message:`Template has ${I} parameters, exceeding the limit of 200`,severity:"error"});if(L>200)t.push({path:"Outputs",message:`Template has ${L} outputs, exceeding the limit of 200`,severity:"error"});return{valid:t.length===0,errors:t,warnings:m}}function xn(R,t={}){let m={ok:!1,code:"unsupported_capability",exitCode:2,command:R,provider:t.provider,target:t.target,retryable:!1,nextAction:t.nextAction??"Run `cloud capabilities` and choose a supported driver operation.",message:t.message??`${R} is not supported by the selected provider driver.`};if(r(`${m.message} ${m.nextAction}`),t.setProcessExitCode!==!1)process.exitCode=m.exitCode;return m}function Ya(R){R.command("generate","Generate CloudFormation templates").alias("gen").option("--output <path>","Output directory for templates",{default:"cloudformation"}).option("--format <format>","Output format: json or yaml",{default:"json"}).option("--module <module>","Generate specific module only").action(async(t)=>{i("Generating CloudFormation Templates");let m=new s("Loading configuration...");m.start();try{let k=await De();m.succeed("Configuration loaded");let I=t?.output||"cloudformation",L=t?.format||"json",z=t?.env||"production";if(!cp(I))await lp(I,{recursive:!0});u("Generating infrastructure...");let Y=new yo({config:k,environment:z,modules:t?.module?[t.module]:void 0}),Z=new s("Generating CloudFormation template...");Z.start(),Y.generate();let X=L==="yaml"?Y.toYAML():Y.toJSON();Z.succeed("Template generated"),u("Validating template...");let ee=JSON.parse(Y.toJSON()),oe=Yo(ee),se=Xo(X),ue=es(ee),ke=[...oe.errors,...se.errors,...ue.errors];if(ke.length>0){r("Template validation failed:");for(let Ne of ke)r(`  - ${Ne.path}: ${Ne.message}`);if(k.project?.slug===Un.project?.slug)a("No project config was loaded — this is the built-in default ("+`project.slug "${Un.project?.slug}"). Check that cloud.config.ts is in ${process.cwd()} and is not shadowed by another config file.`);process.exitCode=1;return}n("Template validated successfully");let ce=[...oe.warnings,...se.warnings,...ue.warnings];if(ce.length>0)for(let Ne of ce)a(`  - ${Ne.path}: ${Ne.message}`);let Se=up(I,`${z}.${L}`);await dp(Se,X),n(`Generated ${Se}`);let xe=Y.getBuilder(),ve=Object.keys(xe.getResources()).length;e(`
+Generated ${ve} resources:`);let Re=xe.getResources(),Ie={};for(let Ne of Object.values(Re)){let Fe=Ne.Type;Ie[Fe]=(Ie[Fe]||0)+1}let Me=Object.entries(Ie).sort((Ne,Fe)=>Fe[1]-Ne[1]);for(let[Ne,Fe]of Me)e(`  - ${Ne}: ${Fe}`);e(`
 Next steps:
   1. Review the generated templates in ${I}/
-  2. Run 'cloud deploy' to deploy your infrastructure`)}catch(k){m.fail("Failed to generate templates"),r(k instanceof Error?k.message:"Unknown error")}}),R.command("generate:preview","Preview what will be generated").action(async()=>{En("generate:preview",{message:"The legacy preview renderer has no stable output contract.",nextAction:"Run `cloud generate` into a temporary output directory and inspect the generated templates."})}),R.command("diff","Show diff between local config and deployed stack").alias("generate:diff").option("--stack <name>","Stack name to compare against").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{i("Infrastructure Diff");try{let m=await Ne(),k=t?.env||"production",{resolveProjectStackName:I}=await import("./chunk-1vw6khps.js"),L=t?.stack||I(m,k),z=m.project.region||"us-east-1";e(`Stack: ${L}`),e(`Region: ${z}`),e(`Environment: ${k}`),u("Generating template from configuration...");let Y=new Ro({config:m,environment:k});Y.generate();let Z=Y.toJSON(),X=JSON.parse(Z);u("Fetching deployed template...");let ie=new v(z),oe=null;try{let Re=await ie.getTemplate(L);if(Re.TemplateBody)oe=JSON.parse(Re.TemplateBody)}catch(Re){if(Re.message?.includes("does not exist")){a(`Stack "${L}" does not exist yet`),e(`
-This will be a new deployment with the following resources:`);let Pe=Object.keys(X.Resources||{}).length;e(`
-Resources to create: ${Pe}`);let ze={};for(let Le of Object.values(X.Resources||{})){let Be=Le.Type;ze[Be]=(ze[Be]||0)+1}for(let[Le,Be]of Object.entries(ze).sort((Ve,ct)=>ct[1]-Ve[1]))e(`  + ${Le}: ${Be}`);e("\nRun `cloud deploy` to create this stack");return}throw Re}u("Comparing templates...");let ae=oe.Resources||{},be=X.Resources||{},Ae=new Set(Object.keys(ae)),de=new Set(Object.keys(be)),ke=[];for(let Re of de)if(!Ae.has(Re))ke.push(Re);let De=[];for(let Re of Ae)if(!de.has(Re))De.push(Re);let Se=[];for(let Re of de)if(Ae.has(Re)){let Pe=JSON.stringify(ae[Re]),ze=JSON.stringify(be[Re]);if(Pe!==ze)Se.push(Re)}if(ke.length===0&&De.length===0&&Se.length===0){n(`
+  2. Run 'cloud deploy' to deploy your infrastructure`)}catch(k){m.fail("Failed to generate templates"),r(k instanceof Error?k.message:"Unknown error")}}),R.command("generate:preview","Preview what will be generated").action(async()=>{xn("generate:preview",{message:"The legacy preview renderer has no stable output contract.",nextAction:"Run `cloud generate` into a temporary output directory and inspect the generated templates."})}),R.command("diff","Show diff between local config and deployed stack").alias("generate:diff").option("--stack <name>","Stack name to compare against").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{i("Infrastructure Diff");try{let m=await De(),k=t?.env||"production",{resolveProjectStackName:I}=await import("./chunk-seh19g93.js"),L=t?.stack||I(m,k),z=m.project.region||"us-east-1";e(`Stack: ${L}`),e(`Region: ${z}`),e(`Environment: ${k}`),u("Generating template from configuration...");let Y=new yo({config:m,environment:k});Y.generate();let Z=Y.toJSON(),X=JSON.parse(Z);u("Fetching deployed template...");let ee=new v(z),oe=null;try{let Re=await ee.getTemplate(L);if(Re.TemplateBody)oe=JSON.parse(Re.TemplateBody)}catch(Re){if(Re.message?.includes("does not exist")){a(`Stack "${L}" does not exist yet`),e(`
+This will be a new deployment with the following resources:`);let Ie=Object.keys(X.Resources||{}).length;e(`
+Resources to create: ${Ie}`);let Me={};for(let Ne of Object.values(X.Resources||{})){let Fe=Ne.Type;Me[Fe]=(Me[Fe]||0)+1}for(let[Ne,Fe]of Object.entries(Me).sort((ze,ot)=>ot[1]-ze[1]))e(`  + ${Ne}: ${Fe}`);e("\nRun `cloud deploy` to create this stack");return}throw Re}u("Comparing templates...");let se=oe.Resources||{},ue=X.Resources||{},ke=new Set(Object.keys(se)),ce=new Set(Object.keys(ue)),Se=[];for(let Re of ce)if(!ke.has(Re))Se.push(Re);let xe=[];for(let Re of ke)if(!ce.has(Re))xe.push(Re);let ve=[];for(let Re of ce)if(ke.has(Re)){let Ie=JSON.stringify(se[Re]),Me=JSON.stringify(ue[Re]);if(Ie!==Me)ve.push(Re)}if(Se.length===0&&xe.length===0&&ve.length===0){n(`
 No changes detected - infrastructure is up to date`);return}if(e(`
 Changes detected:
-`),ke.length>0){n(`Resources to add (${ke.length}):`);for(let Re of ke){let Pe=be[Re].Type;e(`  + ${Re} (${Pe})`)}console.log()}if(De.length>0){r(`Resources to remove (${De.length}):`);for(let Re of De){let Pe=ae[Re].Type;e(`  - ${Re} (${Pe})`)}console.log()}if(Se.length>0){a(`Resources to modify (${Se.length}):`);for(let Re of Se){let Pe=be[Re].Type;e(`  ~ ${Re} (${Pe})`)}console.log()}e("Summary:"),e(`  - Add: ${ke.length}`),e(`  - Remove: ${De.length}`),e(`  - Modify: ${Se.length}`),e("\nRun `cloud deploy` to apply these changes")}catch(m){r(`Diff failed: ${m.message}`)}})}function Bi(R,t=0){let m=Number(R);return Number.isFinite(m)?m:t}function Za(R){return Bi(R)*1024}function mp(R){let t=R?.date?.trim(),m=R?.time?.trim();if(!t||!m)return null;let k=new Date(`${t}T${m}Z`);return Number.isFinite(k.getTime())?k.toISOString():null}function pp(R,t,m){let k;try{k=JSON.parse(R)}catch{return[]}let I=(k?.sysstat?.hosts??[]).flatMap((z)=>z.statistics??[]),L=[];for(let z of I){let Y=mp(z.timestamp);if(!Y)continue;let Z=new Date(Y).getTime();if(Z<t.getTime()||Z>m.getTime())continue;let X=z["cpu-load"]?.find((oe)=>oe.cpu==="all")??z["cpu-load"]?.[0],ie=Bi(X?.idle,100);L.push({timestamp:Y,cpuUsedPercent:Math.max(0,Math.min(100,100-ie)),cpuUserPercent:Bi(X?.user),cpuSystemPercent:Bi(X?.system),cpuIowaitPercent:Bi(X?.iowait),memoryUsedPercent:Bi(z.memory?.["memused-percent"]),memoryUsedBytes:Za(z.memory?.memused),memoryAvailableBytes:Za(z.memory?.avail),swapUsedPercent:Bi(z.memory?.["swpused-percent"]),swapUsedBytes:Za(z.memory?.swpused)})}return L.sort((z,Y)=>z.timestamp.localeCompare(Y.timestamp))}function fp(R){return Object.fromEntries(Object.entries(R.time_series??{}).map(([t,m])=>[t,(m.values??[]).map(([k,I])=>({timestamp:new Date(Number(k)*1000).toISOString(),value:Bi(I,Number.NaN)})).filter((k)=>Number.isFinite(k.value))]))}function hd(R){return R.length?R.reduce((t,m)=>t+m,0)/R.length:null}function Qa(R){return R.length?Math.max(...R):null}function gp(R){return R.length?Math.min(...R):null}async function yd(R){let[t,m]=await Promise.all([R.client.getServerMetrics(R.serverId,{types:["cpu","disk","network"],start:R.from,end:R.to,step:R.step}),_e(R.remote.host,"LC_ALL=C sadf -j -- -u -r -S",R.remote).catch(()=>"")]),k=pp(m,R.from,R.to),I=fp(t),z=(I.cpu??[]).map((oe)=>Math.max(0,Math.min(100,oe.value/Math.max(1,R.cores)))),Y=k.map((oe)=>oe.cpuUsedPercent),Z=z.length?z:Y,X=k.map((oe)=>oe.memoryUsedPercent),ie=k.map((oe)=>oe.swapUsedPercent);return{from:R.from.toISOString(),to:R.to.toISOString(),cores:R.cores,host:k,provider:I,summary:{cpuAveragePercent:hd(Z),cpuPeakPercent:Qa(Z),memoryAveragePercent:hd(X),memoryPeakPercent:Qa(X),memoryMinimumAvailableBytes:gp(k.map((oe)=>oe.memoryAvailableBytes)),swapPeakPercent:Qa(ie)}}}function hp(R){if(R.length===0)throw Error("A server name cannot be empty.");if(R.length>253)throw Error(`'${R}' is longer than the 253 characters a hostname allows.`);for(let t of R.split(".")){if(t.length===0)throw Error(`'${R}' has an empty label — a hostname cannot contain '..'.`);if(t.length>63)throw Error(`'${t}' is longer than the 63 characters a hostname label allows.`);if(!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(t))throw Error(`'${t}' is not a valid hostname label. Use letters, digits and hyphens, not starting or ending with a hyphen.`)}}async function vd(R,t,m){if(hp(t),R===t)throw Error(`'${R}' is already named that.`);if((await m.takenNames()).some((L)=>L===t&&L!==R))throw Error(`'${t}' is already taken. Server names have to be unique within a provider project.`);let I=[];if(m.providerName&&m.renameProvider){let{providerName:L,renameProvider:z}=m;I.push({id:"provider",title:"Rename the server at the provider",change:{from:R,to:t},satisfied:async()=>await L()===t,apply:()=>z(t)})}if(m.stateName&&m.writeStateName){let{stateName:L,writeStateName:z}=m;I.push({id:"state-pin",title:"Update the recorded name in the local driver state",change:{from:R,to:t},satisfied:async()=>{let Y=await L();return Y===void 0||Y===t},apply:()=>z(t)})}if(m.remoteHostname&&m.setRemoteHostname){let{remoteHostname:L,setRemoteHostname:z}=m;I.push({id:"hostname",title:"Set the hostname on the box",change:{from:R,to:t},satisfied:async()=>await L()===t,apply:()=>z(t)})}return I.push({id:"inventory",title:"Rename the fleet inventory record",change:{from:R,to:t},satisfied:async()=>m.inventoryName()===t,apply:async()=>{await m.renameInventory(t)}}),{operation:"server:rename",target:R,steps:I}}function bd(R){let t=`'${R.replace(/'/g,`'"'"'`)}'`;return["set -eu",'TS_CLOUD_OLD="$(hostname)"',`hostnamectl set-hostname ${t} 2>/dev/null || { echo ${t} > /etc/hostname && hostname ${t}; }`,'if grep -q "^127.0.1.1" /etc/hosts; then',`  TS_CLOUD_HOSTS="$(sed -E "s/^127\\.0\\.1\\.1.*/127.0.1.1\\t${R}/" /etc/hosts)"`,`  printf '%s\\n' "$TS_CLOUD_HOSTS" > /etc/hosts`,"else",`  printf '127.0.1.1\\t%s\\n' ${t} >> /etc/hosts`,"fi",'printf "%s -> %s\\n" "$TS_CLOUD_OLD" "$(hostname)"'].join(`
-`)}async function yp(){let R=await Ne(),t=y(process.cwd(),R),m=new xe(t.store),k=new Un(m,[new lt("aws"),new lt("hetzner"),new lt("ssh")]);return{controlPlane:t,store:m,service:k}}async function bi(R){let t=await yp();try{return await R(t)}finally{t.controlPlane.store.close()}}var Wi=(R,t)=>{let m=R.store.list(R.controlPlane.project.id).find((k)=>k.id===t||k.name===t);if(!m)throw Error(`Server ${t} was not found.`);return m},kn=(R)=>{r(R instanceof Error?R.message:String(R)),process.exitCode=1};function Xa(R,t){let m=Number.parseInt(R??"",10);return Number.isFinite(m)&&m>=0?m:t}function vp(R="3h"){let t=R.match(/^(\d+)(m|h)$/);if(!t)throw Error("--range must use minutes or hours, for example 30m or 3h.");let m=Number(t[1])*(t[2]==="h"?3600000:60000);if(m<300000||m>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return m}function ss(R,t="%"){return R==null?"unavailable":`${R.toFixed(1)}${t}`}async function bp(R,t){let m=await Ne();if(m.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let k=t.env??process.env.CLOUD_ENV??"production",I=T(m,k),L=await ge(I);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${I}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(R))throw Error(`Refusing to read ${R}: project state is pinned to ${L.serverName}.`);let z=St(m),Y=new Oe({apiToken:Cr(z.apiToken,m)}),Z=await Y.getServer(L.serverId),X=L.publicIp??Z.public_net.ipv4?.ip;if(!X)throw Error(`Server ${Z.name} has no public IPv4 address.`);let ie=new Date,oe=new Date(ie.getTime()-vp(t.range)),ae=Math.min(3600,Math.max(60,Xa(t.step,60))),be=await yd({client:Y,serverId:Z.id,cores:Math.max(1,Number(Z.server_type.cores)||1),from:oe,to:ie,step:ae,remote:{host:X,user:L.sshUser??z.sshUser,identityFile:z.sshPrivateKeyPath,connectTimeoutSec:15}});if(t.json){console.log(JSON.stringify({schemaVersion:1,server:Z.name,result:be},null,2));return}c(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[Z.name,`${be.from} to ${be.to}`,`${ss(be.summary.cpuAveragePercent)} / ${ss(be.summary.cpuPeakPercent)}`,`${ss(be.summary.memoryAveragePercent)} / ${ss(be.summary.memoryPeakPercent)}`,be.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(be.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,ss(be.summary.swapPeakPercent)]])}function wd(R){let t=R.targetType.prices?.find((m)=>m.location===R.location);return{serverId:R.serverId,serverName:R.serverName,location:R.location,from:R.currentType.name,to:R.targetType.name,capacityAvailable:R.capacityAvailable,alreadyComplete:R.alreadyComplete,upgradeDisk:R.upgradeDisk,target:{cores:R.targetType.cores,memoryGb:R.targetType.memory,diskGb:R.targetType.disk,architecture:R.targetType.architecture,cpuType:R.targetType.cpu_type},price:t?{hourlyNet:t.price_hourly.net,hourlyGross:t.price_hourly.gross,monthlyNet:t.price_monthly.net,monthlyGross:t.price_monthly.gross}:void 0}}function wp(R){let t=wd(R);c(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${t.serverName} (${t.serverId})`,t.location,`${t.from} -> ${t.to}`,t.capacityAvailable?"available":"waiting",`${t.target.cores??0} / ${t.target.memoryGb??0} GB / ${t.target.diskGb??0} GB`,t.price?.monthlyGross??t.price?.monthlyNet??"not reported"]])}async function Sp(R,t,m){let k=await Ne();if(k.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let I=m.env??process.env.CLOUD_ENV??"production",L=T(k,I),z=await ge(L),Y=St(k),Z=new Oe({apiToken:Cr(Y.apiToken,k)}),ie=z&&(R===z.serverName||R===String(z.serverId)||R===z.stackName)?await Z.getServer(z.serverId):(await Z.listServers()).find((Le)=>Le.name===R||String(Le.id)===R);if(!ie)throw Error(`Hetzner server ${R} was not found.`);if(z?.serverId&&z.serverId!==ie.id)throw Error(`Refusing to resize ${R}: project state is pinned to server ${z.serverId}.`);let oe=tt(t),ae=m.upgradeDisk!==!1,be=await rt(Z,ie.id,oe,ae);if(m.json)console.log(JSON.stringify({schemaVersion:1,plan:wd(be)},null,2));else wp(be);if(!m.apply){if(!m.json)e(`Preview only. Re-run with --apply --confirm ${ie.name} to execute.`);return}if(m.confirm!==ie.name)throw Error(`Resize requires --confirm ${ie.name}.`);let Ae=z?.publicIp??ie.public_net.ipv4?.ip;if(!Ae)throw Error(`Server ${ie.name} has no public IPv4 address for verification.`);let de={host:Ae,user:z?.sshUser??Y.sshUser,identityFile:Y.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},ke=await $s(L),De=new Date().toISOString(),Se={schemaVersion:1,operationId:ke?.targetType===oe&&ke.serverId===ie.id?ke.operationId:crypto.randomUUID(),stackName:L,serverId:ie.id,serverName:ie.name,sourceType:be.currentType.name,targetType:oe,upgradeDisk:ae,phase:"planning",status:"running",attempts:ke?.targetType===oe?ke.attempts:0,startedAt:ke?.targetType===oe?ke.startedAt:De,updatedAt:De,manifest:ke?.targetType===oe?ke.manifest:void 0};await Ct(Se);let Re=Xa(m.pollSeconds,900)*1000,Pe=Xa(m.maxWaitMinutes,0)*60000,ze=Date.now();for(;;){let Le=await rt(Z,ie.id,oe,ae);if(!Le.capacityAvailable&&!Le.alreadyComplete){if(Se={...Se,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await Ct(Se),!m.wait){if(!m.json)e(`${oe} has no capacity in ${Le.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(Pe>0&&Date.now()-ze>=Pe)throw Error(`Timed out waiting for ${oe} capacity in ${Le.location}.`);if(!m.json)e(`Waiting ${Math.round(Re/1000)} seconds for ${oe} capacity...`);await Bun.sleep(Re);continue}let Be=await Ls(L);try{let Ve=await(async()=>{try{return Se={...Se,status:"running",attempts:Se.attempts+1,updatedAt:new Date().toISOString()},await Ct(Se),await Tr({client:Z,serverId:ie.id,targetType:oe,upgradeDisk:ae,resumeFromOff:Se.phase==="shutting-down"||Se.phase==="resizing"||Se.phase==="powering-on"||Se.phase==="verifying",manifest:Se.manifest,hooks:{preflight:async()=>{let ct=await wi(de);return Se={...Se,manifest:ct,updatedAt:new Date().toISOString()},await Ct(Se),ct},afterBoot:async(ct,Dt,nt,xt)=>Ai(de,Dt,nt,xt),onPhase:async(ct,Dt)=>{if(Se={...Se,phase:ct,status:ct==="waiting-capacity"?"waiting-capacity":ct==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await Ct(Se),!m.json)e(`${ct}${Dt?` ${JSON.stringify(Dt)}`:""}`)}}})}finally{await Be()}})();if(Se={...Se,status:Ve.status==="completed"||Ve.status==="already-complete"?"completed":Ve.status==="recovered"?"recovered":"waiting-capacity",lastError:Ve.status==="recovered"?Ve.error:void 0,updatedAt:new Date().toISOString()},await Ct(Se),m.json)console.log(JSON.stringify({schemaVersion:1,result:Ve},null,2));else if(Ve.status==="completed"||Ve.status==="already-complete")n(`${ie.name} is on ${oe} and passed full post-boot verification.`);else if(Ve.status==="recovered"&&Ve.retryable&&m.wait){e(`Capacity race recovered safely. Waiting ${Math.round(Re/1000)} seconds before retry.`),await Bun.sleep(Re);continue}else if(Ve.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${Ve.error}`);return}catch(Ve){throw Se={...Se,status:"failed",lastError:Ve instanceof Error?Ve.message:String(Ve),updatedAt:new Date().toISOString()},await Ct(Se),Ve}}}async function Cp(R,t){let m=await Ne();if(m.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let k=t.env??process.env.CLOUD_ENV??"production",I=T(m,k),L=await ge(I);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${I}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(R))throw Error(`Refusing to optimize ${R}: project state is pinned to ${L.serverName}.`);let z=St(m),Y=new Oe({apiToken:Cr(z.apiToken,m)}),Z=await Y.getServer(L.serverId),X=L.publicIp??Z.public_net.ipv4?.ip;if(!X)throw Error(`Server ${Z.name} has no public IPv4 address.`);let ie=Co(m);if(t.json)console.log(JSON.stringify({schemaVersion:1,server:Z.name,plan:ie},null,2));else c(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[Z.name,ie.firewallPorts.join(","),ie.monitoring?"on":"off",ie.autoUpdates?"on":"off",`${ie.swapGb} GB`,"disabled"]]);if(!t.apply){if(!t.json)e(`Preview only. Re-run with --apply --confirm ${Z.name} to execute.`);return}if(t.confirm!==Z.name)throw Error(`Optimization requires --confirm ${Z.name}.`);let oe={host:X,user:L.sshUser??z.sshUser,identityFile:z.sshPrivateKeyPath,connectTimeoutSec:15},ae=await un(oe),be=ae.routeProbes.filter((nt)=>!nt.ok),Ae=m.infrastructure?.compute,de=re(Ae)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,ke=ae.failedUnits.filter((nt)=>!de.has(nt));if(ke.length>0)throw Error(`Preflight found failed services: ${ke.join(", ")}`);if(be.length>0)throw Error(`Preflight found unhealthy routes: ${be.map((nt)=>nt.domain).join(", ")}`);let De=re(Ae)?[]:Object.values(m.sites??{}).flatMap((nt)=>typeof nt?.port==="number"&&![80,443].includes(nt.port)?[nt.port]:[]),Se=dn({allowSsh:Ae?.allowSsh!==!1,sitePorts:De,allowedPorts:Ae?.firewall?.allowedPorts}),Re=(L.firewallId?(await Y.listFirewalls()).find((nt)=>nt.id===L.firewallId):void 0)??(await Y.listFirewalls()).find((nt)=>nt.name===`${m.project.slug}-${k}-app-fw`);if(!Re)throw Error(`Managed firewall for ${Z.name} was not found.`);let Pe=await Y.setFirewallRules(Re.id,Se);await Promise.all(Pe.map((nt)=>Y.waitForAction(nt.id))),await xs(m,oe);let[ze,Le]=await Promise.all([un(oe),_s(oe)]),Be=Os(ie,Le),Ve=zc(ae,ze),ct=ze.routeProbes.filter((nt)=>!nt.ok);if(Ve.stoppedServices.length>0)Be.push(`services stopped: ${Ve.stoppedServices.join(", ")}`);if(Ve.changedRouteFragments.length>0)Be.push(`route fragments changed: ${Ve.changedRouteFragments.join(", ")}`);if(Ve.missingRouteIds.length>0)Be.push(`routes disappeared: ${Ve.missingRouteIds.join(", ")}`);if(Ve.changedReleaseLinks.length>0)Be.push(`release links changed: ${Ve.changedReleaseLinks.join(", ")}`);if(Ve.missingData.length>0)Be.push(`databases or volumes disappeared: ${Ve.missingData.join(", ")}`);if(ct.length>0)Be.push(`unhealthy routes: ${ct.map((nt)=>nt.domain).join(", ")}`);if(Be.length>0)throw Error(`Host optimization verification failed: ${Be.join("; ")}`);let Dt={serverId:Z.id,serverName:Z.name,services:ze.runningServices.length,routes:ze.routeIds.length,healthyDomains:ze.routeProbes.length,releaseLinks:ze.releaseLinks.length,databasesAndVolumes:ze.dataCatalog.length,report:Le};if(t.json)console.log(JSON.stringify({schemaVersion:1,result:Dt},null,2));else n(`${Z.name} passed full host, rpx route, service, release, and data verification.`)}async function $p(R,t,m){let k=await Ne(),I=m.env??"production",L=T(k,I);await bi(async(z)=>{let Y=Wi(z,R),Z=z.store.list(z.controlPlane.project.id,!0),X=Y.provider==="hetzner"&&Y.providerId?(()=>{try{let Re=St(k);return new Oe({apiToken:Cr(Re.apiToken,k)})}catch{return null}})():null,ie=Y.providerId?Number(Y.providerId):Number.NaN,oe=await ge(L),ae=oe!=null&&oe.serverId===ie,be=new qr,Ae=Y.trustState==="pinned",de={takenNames:async()=>{let Re=Z.map((Pe)=>Pe.name);if(X)Re.push(...(await X.listServers()).map((Pe)=>Pe.name));return Re},inventoryName:()=>z.store.get(Y.id)?.name??Y.name,renameInventory:(Re)=>{z.store.update(Y.id,{name:Re})},...X&&Number.isFinite(ie)?{providerName:async()=>(await X.getServer(ie)).name,renameProvider:async(Re)=>{await X.renameServer(ie,Re)}}:{},...ae?{stateName:async()=>(await ge(L))?.serverName,writeStateName:async(Re)=>{let Pe=await ge(L);if(Pe)await vt(L,{...Pe,serverName:Re})}}:{},...Ae?{remoteHostname:async()=>{let Re=await be.exec(Y,"hostname");return Re.code===0?Re.stdout.trim():void 0},setRemoteHostname:async(Re)=>{let Pe=await be.exec(Y,bd(Re));if(Pe.code!==0)throw Error(Pe.stderr.trim()||`hostname exited ${Pe.code}`)}}:{}},ke=await vd(Y.name,t,de),De=await zs(ke);if(!m.apply){let Re=[X?"":"provider record (no provider id or no API token)",ae?"":"local state pin (none points at this server)",Ae?"":"box hostname (host key is not pinned — run server:validate first)"].filter(Boolean);if(m.json){console.log(JSON.stringify({schemaVersion:1,operation:ke.operation,target:ke.target,rename:{from:Y.name,to:t},notCovered:Re,steps:De.map((Pe)=>({id:Pe.step.id,title:Pe.step.title,state:Pe.state,change:Pe.step.change,reason:Pe.reason}))},null,2));return}for(let Pe of Us(ke,De))console.log(Pe);for(let Pe of Re)console.log(`  not covered: ${Pe}`);console.log("  Re-run with --apply to perform it.");return}let Se=await Ws(ke,De,{log:(Re)=>e(Re),audit:(Re)=>z.controlPlane.store.appendEvent({projectId:z.controlPlane.project.id,resourceId:Y.resourceId,type:`${Re.operation}.${Re.step}.${Re.state}`,level:Re.state==="failed"?"error":"info",payload:{target:Re.target,renameTo:t,...Re.error?{error:Re.error}:{}}})});if(m.json)console.log(JSON.stringify({schemaVersion:1,outcome:Se},null,2));if(!Se.success){let Re=Se.steps.find((Pe)=>Pe.state==="failed");throw Error(`${ke.operation} stopped at '${Re?.title}': ${Re?.error}. Earlier steps stayed applied; re-run the same command to continue from here.`)}if(!m.json)n(`Renamed ${Y.name} to ${t}.`)})}function ec(R){R.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(t,m)=>{try{await bi(async(k)=>{let I=t?[Wi(k,t)]:k.store.list(k.controlPlane.project.id),L=I.flatMap((z)=>Object.entries(z.capabilities).map(([Y,Z])=>({server:z.name,provider:z.provider,action:Y,...Z})));if(m.json)console.log(JSON.stringify({schemaVersion:1,targets:L},null,2));else c(["Server","Provider","Action","Support","Explanation"],L.map((z)=>[z.server,z.provider,z.action,z.supported?"supported":"unsupported",z.reason??"—"]))})}catch(k){kn(k)}}),R.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(t,m,k)=>{try{await Sp(t,m,k)}catch(I){kn(I)}}),R.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(t,m)=>{try{await Cp(t,m)}catch(k){kn(k)}}),R.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(t,m)=>{try{await bp(t,m)}catch(k){kn(k)}}),R.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(t)=>{try{await bi(async(m)=>{let k=m.store.list(m.controlPlane.project.id);if(t.json)console.log(JSON.stringify(k,null,2));else c(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],k.map((I)=>[I.name,I.providerId??"—",`${I.provider} / ${I.region??"external"}`,`${I.status} / ${I.trustState}`,I.roles.join(","),`${I.capacity.cpu??0} / ${I.capacity.memoryBytes??0}`,I.heartbeatAt??"never"]))})}catch(m){kn(m)}}),R.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(t,m)=>{try{await bi(async(k)=>{let I=m.provider;if(!["aws","hetzner","ssh"].includes(I)||!m.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let L=k.service.enroll({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,name:t,provider:I,providerId:m.providerId,endpoint:m.endpoint,sshUser:m.user??"deploy",credentialRef:m.credentialRef??"secret://fleet/agent",region:m.region,roles:String(m.roles??"application").split(","),labels:Object.fromEntries(String(m.labels??"").split(",").map((z)=>z.split("=")).filter((z)=>z[0]&&z[1]))});n(`Enrolled ${L.name} as ${L.id}; no remote mutation was performed.`)})}catch(k){kn(k)}}),R.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(t,m)=>{try{await bi(async(k)=>{let I=Wi(k,t);if(I=await k.service.test(I.id),I.trustState==="rotation_pending"){if(!m.acceptHostKey)throw Error(`Host key changed to ${I.pendingHostKey}; review it first.`);I=k.service.reviewHostKey(I.id,m.acceptHostKey)}let L=await k.service.validate(I.id);if(m.json)console.log(JSON.stringify(L.validation,null,2));else c(["Severity","Code","Finding","Remediation"],(L.validation?.findings??[]).map((z)=>[z.severity,z.code,z.message,z.remediation??"—"]));if(!L.validation?.valid)process.exitCode=1})}catch(k){kn(k)}}),R.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(t,m)=>{try{await bi(async(k)=>{let I=k.service.bootstrap(Wi(k,t).id,!!m.apply);if(I.preview)c(["Step"],I.steps.map((L)=>[L]));else n(`Bootstrap queued: ${I.operation?.id}`)})}catch(k){kn(k)}}),R.command("server:rename <name> <new-name>","Rename a server in place, without recreating it").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Perform the reviewed rename plan").option("--json","Print structured JSON").action(async(t,m,k)=>{try{await $p(t,m,k)}catch(I){kn(I)}}),R.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(t,m)=>{try{await bi(async(k)=>n(k.service.drain(Wi(k,t).id,!!m.complete).status))}catch(k){kn(k)}}),R.command("server:uncordon <name>","Return a server to scheduling").action(async(t)=>{try{await bi(async(m)=>{m.service.uncordon(Wi(m,t).id),n(`Uncordoned ${t}.`)})}catch(m){kn(m)}}),R.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(t,m)=>{try{await bi(async(k)=>{k.service.archive(Wi(k,t).id,m.confirm??""),n(`Archived ${t}; provider infrastructure was not terminated.`)})}catch(k){kn(k)}}),R.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(t)=>{try{await bi(async(m)=>{let k=Wi(m,t);if(k.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let I=Bun.spawn(["ssh","-p",String(k.sshPort),"-o","StrictHostKeyChecking=yes",`${k.sshUser}@${k.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),L=await I.exited;if(L)process.exitCode=L})}catch(m){kn(m)}});for(let[t,m]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])R.command(t,m).action(async(...k)=>En(t.split(" ")[0],{target:String(k[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}import{existsSync as Sd,mkdirSync as kp,readFileSync as Ap,writeFileSync as Rp}from"node:fs";import{join as Cd,resolve as Ip}from"node:path";var tc=(R)=>{r(R instanceof Error?R.message:String(R)),process.exitCode=1};async function Pp(){try{return await Ne()}catch{return}}function xp(R){if(R===void 0)return;let t=Number(R);if(!Number.isInteger(t)||t<1||t>65535)throw Error(`--port must be a port number, not '${R}'.`);return t}function $d(R,t,m){let k=R?.ssh?.hosts?.find((I)=>I.host===t);return new Ir({hosts:t?[k??{host:t}]:R?.ssh?.hosts,user:m.user,port:xp(m.port),privateKeyPath:m.key,hostKey:R?.ssh?.hostKey,sudo:R?.ssh?.sudo,profile:m.profile??R?.ssh?.profile,publicIp:R?.ssh?.publicIp,lan:R?.ssh?.lan})}var kd=1073741824;function nc(R){R.command("ssh:preflight [host]","Check a bring-your-own Linux host before adopting it").option("--user <user>","SSH user (default: ssh.hosts[].user, then root)").option("--port <port>","SSH port (default: ssh.hosts[].port, then 22)").option("--key <path>","SSH private key (default: ssh.hosts[].privateKeyPath, then ~/.ssh/id_ed25519)").option("--profile <profile>","raspberry-pi or generic (default: ssh.profile, then generic)").option("--json","Print the facts and findings as JSON").action(async(t,m)=>{try{let k=await Pp(),I=$d(k,t,m),L=t??I.targetHost(),z=await I.ensureHostKey(L),{facts:Y,findings:Z}=await I.preflight(L);if(m.json)console.log(JSON.stringify({schemaVersion:1,host:L,hostKeyFingerprint:z.fingerprint,facts:Y,findings:Z},null,2));else{if(i(`Preflight ${L}`),z.pinnedNow)e(`Pinned host key ${z.fingerprint}`);if(e(`${Y.os} on ${Y.arch}, ${Y.cpuCores} cores, ${(Y.memoryBytes/kd).toFixed(1)} GiB memory, ${(Y.diskFreeBytes/kd).toFixed(1)} GiB free`),Y.piModel)e(Y.piModel);if(Y.lanIp)e(`LAN address ${Y.lanIp}`);if(console.log(pn(Z)),Rr(Z))r("The host is not ready; fix the errors above and run the preflight again.");else n("The host is ready to adopt.")}if(Rr(Z))process.exitCode=1}catch(k){tc(k)}}),R.command("ssh:bootstrap","Adopt the configured host: pin its key, run the preflight, then bootstrap it").option("--env <environment>","Deployment environment",{default:"production"}).option("--dry-run","Print the bootstrap script instead of running it").action(async(t)=>{try{let m=await Ne(),k=t.env??"production";if(t.dryRun){let z=Ar(m),[Y]=z.hosts;console.log(wr({config:m,environment:k,profile:z.profile,sudoUser:Y.user!=="root"?Y.user:void 0,lan:z.lan}));return}let I=$d(m,void 0,{});i(`Adopt ${I.targetHost()}`);let L=await I.provisionComputeInfrastructure({config:m,environment:k});n(`${L.appPublicIp} is bootstrapped; deploy with: cloud deploy --env ${k}`)}catch(m){tc(m)}}),R.command("ssh:first-boot","Write cloud-init first-boot files for a freshly flashed Raspberry Pi OS or Ubuntu image").option("--os <os>","raspberry-pi-os or ubuntu",{default:"raspberry-pi-os"}).option("--out <dir>","Directory to write user-data, network-config and meta-data into (never a mounted card; copy them yourself)").option("--hostname <name>","Hostname of the new host").option("--user <user>","Deploy user created on first boot (default: ssh.hosts[].user, then pi)").option("--key <path>","Public key authorized for the user",{default:"~/.ssh/id_ed25519.pub"}).option("--wifi-ssid <ssid>","Join this Wi-Fi network on first boot").option("--wifi-passphrase-env <name>","Environment variable holding the Wi-Fi passphrase",{default:"WIFI_PASSWORD"}).option("--wifi-country <cc>","Wi-Fi regulatory domain, e.g. DE").option("--timezone <tz>","IANA timezone, e.g. Europe/Berlin").option("--locale <locale>","System locale, e.g. en_US.UTF-8").option("--env <environment>","Deployment environment the embedded bootstrap is built for",{default:"production"}).option("--force","Overwrite files already in --out").action(async(t)=>{try{if(!t.out)throw Error("--out <dir> is required.");if(!t.hostname)throw Error("--hostname <name> is required.");let m=t.os??"raspberry-pi-os";if(!(m in So))throw Error(`--os must be raspberry-pi-os or ubuntu, not '${m}'.`);let k=await Ne(),I=t.env??"production",L=Ar(k,{hosts:k.ssh?.hosts?.length?void 0:[{host:t.hostname}],profile:m==="raspberry-pi-os"?"raspberry-pi":void 0}),z=t.user??(k.ssh?.hosts?.[0]?.user??"pi"),Y=ln(t.key??"~/.ssh/id_ed25519.pub");if(!Sd(Y))throw Error(`Public key not found at ${Y}; pass --key <path to a .pub file>.`);let Z=Ap(Y,"utf8").trim(),X;if(t.wifiSsid){let Ae=t.wifiPassphraseEnv??"WIFI_PASSWORD",de=process.env[Ae];if(!de)throw Error(`--wifi-ssid needs the passphrase in $${Ae} (set it in the environment, not on the command line).`);if(!t.wifiCountry)throw Error("--wifi-country <cc> is required with --wifi-ssid.");X={ssid:t.wifiSsid,passphrase:de,country:t.wifiCountry}}let ie=wr({config:k,environment:I,profile:L.profile,sudoUser:z!=="root"?z:void 0,lan:L.lan}),oe=vo({hostname:t.hostname,user:z,publicKey:Z,timezone:t.timezone,locale:t.locale,wifi:X},ie,{os:m}),ae=Ip(t.out);kp(ae,{recursive:!0});let be=Object.keys(oe.files).filter((Ae)=>Sd(Cd(ae,Ae)));if(be.length>0&&!t.force)throw Error(`${be.join(", ")} already exist in ${ae}; pass --force to overwrite.`);for(let[Ae,de]of Object.entries(oe.files))Rp(Cd(ae,Ae),de,{mode:384});i(`First boot for ${t.hostname}`),n(`Wrote ${Object.keys(oe.files).join(", ")} to ${ae}`),console.log(oe.instructions)}catch(m){tc(m)}})}async function Dp(){let R=await Ne(),t=y(process.cwd(),R),m=new Bn(t.store),k=new jn(m,new xe(t.store));return{controlPlane:t,store:m,service:k}}async function as(R){let t=await Dp();try{await R(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Vs=(R)=>Object.fromEntries(String(R??"").split(",").map((t)=>t.split("=")).filter((t)=>t[0]&&t[1])),Ad=(R)=>Object.fromEntries(Object.entries(Vs(R)).map(([t,m])=>[t,Number(m)]));function rc(R){R.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(t)=>as((m)=>{let k=m.store.listPools(m.controlPlane.project.id);if(t.json)console.log(JSON.stringify(k,null,2));else c(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],k.map((I)=>[I.name,I.purpose,I.backend,`${I.region??"any"} / ${I.architecture??"any"}`,I.status,JSON.stringify(I.capacity),String(I.concurrency)]))})),R.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(t,m)=>as((k)=>{let{purpose:I,backend:L}=m;if(!["application","build","worker","monitoring","backup"].includes(I)||!["server","ecs","asg"].includes(L))throw Error("Unsupported pool purpose or backend.");let z=k.store.createPool({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,name:t,purpose:I,backend:L,region:m.region,architecture:m.arch,labels:Vs(m.labels),requiredServerLabels:Vs(m.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...Ad(m.capacity)},maxWorkloads:Number(m.max),costWeight:1,concurrency:Number(m.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});n(`Created ${z.name} (${z.id}).`)})),R.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(t,m)=>as((k)=>{let I=k.store.listPools(k.controlPlane.project.id).find((z)=>z.id===t||z.name===t),L=new xe(k.controlPlane.store).list(k.controlPlane.project.id).find((z)=>z.id===m||z.name===m);if(!I||!L)throw Error("Pool or server was not found.");k.store.addMember(I.id,L.id),n(`Attached ${L.name} to ${I.name}.`)})),R.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(t)=>as((m)=>{let k=m.service.explain(m.controlPlane.project.id,{purpose:t.purpose,resources:Ad(t.resources),region:t.region,architecture:t.arch,labels:Vs(t.labels)});if(t.json)console.log(JSON.stringify(k,null,2));else c(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],k.map((I)=>[I.poolName,I.serverId??"provider-managed",I.eligible?"yes":"no",JSON.stringify(I.available),`${I.score.fit.toFixed(2)} / ${I.score.spread} / ${I.score.cost}`,I.reasons.join("; ")||"eligible"]))})),R.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(t)=>as((m)=>{let k=m.store.listPools(m.controlPlane.project.id).find((L)=>L.id===t||L.name===t);if(!k)throw Error("Pool was not found.");let I=m.service.drainPool(k.id);n(`Draining ${k.name}: moved ${I.moved.length}, blocked ${I.blocked.length} stateful placement(s).`)}))}async function Ep(){let R=await Ne(),t=y(process.cwd(),R),m=new Vn(t.store),k=new zn(m);return{controlPlane:t,store:m,service:k}}async function ro(R){let t=await Ep();try{await R(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}var cs=(R,t)=>{let m=R.store.list(R.controlPlane.project.id).find((k)=>k.id===t||k.name===t);if(!m)throw Error("Regional topology was not found.");return m},Tp=(R)=>R.split(",").map((t,m)=>{let[k,I="aws"]=t.split(":");return{region:String(k),provider:I,role:m===0?"primary":"secondary"}}),Np=(R)=>{let t=new Set(["s3","dynamodb","secrets"]),m=R.split(",").map((I)=>I.trim()),k=m.find((I)=>!t.has(I));if(k)throw Error(`Unsupported replication kind: ${k}`);return m};function ic(R){R.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(t)=>ro((m)=>{let k=m.store.list(m.controlPlane.project.id).map((I)=>({topology:I,targets:m.store.targets(I.id),channels:m.store.channels(I.id),route:m.store.route(I.id),executions:m.store.executions(I.id)}));if(t.json)console.log(JSON.stringify(k,null,2));else c(["Name","Hostname","Active","Status","Revision","Replication"],k.map((I)=>[I.topology.name,I.topology.hostname,I.topology.activeRegion,I.topology.status,I.topology.revision??"—",`${I.channels.filter((L)=>L.status==="in_sync").length}/${I.channels.length} in sync`]))})),R.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(t,m)=>ro((k)=>{if(!m.hostname||!m.regions)throw Error("--hostname and --regions are required.");let I=k.service.create({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,name:t,hostname:m.hostname,regions:Tp(m.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Np(String(m.replicate)),maxLagSeconds:Number(m.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!m.cdn,wafEnabled:!!m.waf});n(`Created ${I.name} (${I.id}); run region:rollout with an immutable manifest.`)})),R.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(t,m,k)=>ro((I)=>c(["Step"],I.service.plan(cs(I,t).id,m,k.target).map((L)=>[L])))),R.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(t,m,k)=>ro(async(I)=>{let L=k.manifest?await Bun.file(k.manifest).json():{},z=I.service.enqueue({topologyId:cs(I,t).id,kind:"rollout",revision:m,manifest:L});n(`Regional rollout queued: ${z.operation.id}`)})),R.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(t,m)=>ro((k)=>{let I=k.service.enqueue({topologyId:cs(k,t).id,kind:"failover",targetRegion:m});n(`Failover queued: ${I.operation.id}`)})),R.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(t,m)=>ro((k)=>{let I=k.service.enqueue({topologyId:cs(k,t).id,kind:"failback",targetRegion:m});n(`Failback queued: ${I.operation.id}`)})),R.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(t,m)=>ro((k)=>{let I=k.service.enqueue({topologyId:cs(k,t).id,kind:"destroy",confirmation:m.confirm});n(`Regional teardown queued: ${I.operation.id}; replicated data remains retained.`)}))}var ls="0.16.90";async function Lp(){let R=await Ne(),t=y(process.cwd(),R),m=new Hn(t.store),k=new Gn(m),I=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new qn(L,t.store,t.project.id,t.organization.id));return{controlPlane:t,store:m,service:k,cleanup:I}}async function Ii(R){let t=await Lp();try{await R(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}function oc(R){R.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(t)=>Ii((m)=>{let k={manifests:m.store.manifests(m.controlPlane.organization.id),windows:m.store.windows(m.controlPlane.project.id),campaigns:m.store.campaigns(m.controlPlane.project.id),cleanups:m.store.cleanups(m.controlPlane.project.id),drills:m.store.drills(m.controlPlane.project.id)},I=[...k.manifests.map((L)=>["update",L.version,L.compatibility.compatible?"compatible":"blocked",L.compatibility.reasons.join("; ")||L.channel]),...k.campaigns.map((L)=>["upgrade",L.id,L.status,L.currentStage??L.fromVersion]),...k.cleanups.map((L)=>["cleanup",L.kind,L.status,`${L.candidates.length} items / ${L.estimatedBytes} bytes`]),...k.drills.map((L)=>["DR drill",L.scenario,L.status,L.isolatedTarget])];if(t.json)console.log(JSON.stringify(k,null,2));else c(["Area","Name / version","Status","Detail"],I)})),R.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(t,m)=>Ii(async(k)=>{let I=k.store.addTrustedKey({organizationId:k.controlPlane.organization.id,name:t,publicKeyPem:await Bun.file(m).text()});n(`Trusted ${I.name}: ${I.fingerprint}`)})),R.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(t,m,k)=>Ii(async(I)=>{let L=await Bun.file(t).json(),z=(await Bun.file(m).text()).trim(),Y=I.store.importManifest({organizationId:I.controlPlane.organization.id,keyId:k,document:L,signature:z,current:{schemaVersion:I.controlPlane.store.health().schemaVersion,currentVersion:ls,platform:process.platform,architecture:process.arch}});n(`Verified ${Y.version}; ${Y.compatibility.compatible?"compatible":"blocked: "+Y.compatibility.reasons.join("; ")}`)})),R.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(t,m,k)=>Ii((I)=>{let L=I.store.createWindow({projectId:I.controlPlane.project.id,name:t,schedule:m,timezone:k.timezone,durationMinutes:Number(k.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});n(`Created ${L.name} (${L.id}).`)})),R.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(t,m,k)=>Ii((I)=>{let L=new xe(I.controlPlane.store).list(I.controlPlane.project.id).filter((Z)=>Z.status==="ready").map((Z)=>({serverId:Z.id,target:Z.name,previousVersion:Z.bootstrapVersion??ls}));if(!L.length)L.push({target:"control-plane",previousVersion:ls});let z=I.store.createCampaign({projectId:I.controlPlane.project.id,manifestId:t,fromVersion:ls,strategy:k.strategy==="rolling"?"rolling":"canary",batchSize:Number(k.batch),healthGate:{kind:"platform"},backupId:m,targets:L}),Y=I.service.enqueueCampaign(z.id);n(`Staged upgrade queued: ${Y.operation.id}`)})),R.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(t,m)=>Ii(async(k)=>{let I=await k.service.previewCleanup({projectId:k.controlPlane.project.id,kind:t,criteria:{olderThanDays:Number(m.olderThan)}},k.cleanup);c(["ID","Candidate","Bytes"],I.candidates.map((L)=>[L.id,L.label,String(L.bytes)])),e(`Apply with: cloud cleanup:apply ${I.id} --confirm "DELETE ${I.candidates.length} ${I.kind}"`)})),R.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(t,m)=>Ii((k)=>{let I=k.service.enqueueCleanup(t,String(m.confirm??""));n(`Cleanup queued: ${I.operation.id}`)})),R.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(t,m,k)=>Ii((I)=>{let L=I.store.createDrill({projectId:I.controlPlane.project.id,scenario:t,isolatedTarget:m,expectedRpoMinutes:Number(k.rpo),expectedRtoMinutes:Number(k.rto),recoveryPointId:k.recoveryPoint,topologyId:k.topology});n(`Planned isolated drill ${L.id}.`)})),R.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(t)=>Ii((m)=>{let k=m.service.enqueueDrill(t);n(`DR drill queued: ${k.operation.id}`)}))}async function sc(){try{return(await Ne()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function ac(R){R.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(t)=>{i("Lambda Functions");let m=t?.region||await sc(),k=new D(m);try{let{Functions:I=[]}=await k.listFunctions({MaxItems:50});if(!I.length){e("No functions found");return}c(["Name","Runtime","Memory","Timeout","Last Modified"],I.map((L)=>[L.FunctionName??"-",L.Runtime??"-",L.MemorySize?`${L.MemorySize} MB`:"-",L.Timeout?`${L.Timeout}s`:"-",L.LastModified??"-"]))}catch(I){r(`Failed to list functions: ${I.message}`),process.exitCode=1}}),R.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(t,m)=>{i(`Invoking ${t}`);let k=m?.region||await sc(),I=new D(k),L=new s("Invoking function...");L.start();try{let z=await I.invoke({FunctionName:t,InvocationType:m?.async?"Event":"RequestResponse",Payload:m?.payload||"{}",LogType:m?.async?"None":"Tail"});if(z.FunctionError){if(L.fail(`Function returned an error (${z.FunctionError})`),z.Payload)e(z.Payload);process.exitCode=1;return}if(L.succeed(`Invoked (status ${z.StatusCode})`),z.Payload)e(`
+`),Se.length>0){n(`Resources to add (${Se.length}):`);for(let Re of Se){let Ie=ue[Re].Type;e(`  + ${Re} (${Ie})`)}console.log()}if(xe.length>0){r(`Resources to remove (${xe.length}):`);for(let Re of xe){let Ie=se[Re].Type;e(`  - ${Re} (${Ie})`)}console.log()}if(ve.length>0){a(`Resources to modify (${ve.length}):`);for(let Re of ve){let Ie=ue[Re].Type;e(`  ~ ${Re} (${Ie})`)}console.log()}e("Summary:"),e(`  - Add: ${Se.length}`),e(`  - Remove: ${xe.length}`),e(`  - Modify: ${ve.length}`),e("\nRun `cloud deploy` to apply these changes")}catch(m){r(`Diff failed: ${m.message}`)}})}function Mi(R,t=0){let m=Number(R);return Number.isFinite(m)?m:t}function Za(R){return Mi(R)*1024}function mp(R){let t=R?.date?.trim(),m=R?.time?.trim();if(!t||!m)return null;let k=new Date(`${t}T${m}Z`);return Number.isFinite(k.getTime())?k.toISOString():null}function pp(R,t,m){let k;try{k=JSON.parse(R)}catch{return[]}let I=(k?.sysstat?.hosts??[]).flatMap((z)=>z.statistics??[]),L=[];for(let z of I){let Y=mp(z.timestamp);if(!Y)continue;let Z=new Date(Y).getTime();if(Z<t.getTime()||Z>m.getTime())continue;let X=z["cpu-load"]?.find((oe)=>oe.cpu==="all")??z["cpu-load"]?.[0],ee=Mi(X?.idle,100);L.push({timestamp:Y,cpuUsedPercent:Math.max(0,Math.min(100,100-ee)),cpuUserPercent:Mi(X?.user),cpuSystemPercent:Mi(X?.system),cpuIowaitPercent:Mi(X?.iowait),memoryUsedPercent:Mi(z.memory?.["memused-percent"]),memoryUsedBytes:Za(z.memory?.memused),memoryAvailableBytes:Za(z.memory?.avail),swapUsedPercent:Mi(z.memory?.["swpused-percent"]),swapUsedBytes:Za(z.memory?.swpused)})}return L.sort((z,Y)=>z.timestamp.localeCompare(Y.timestamp))}function fp(R){return Object.fromEntries(Object.entries(R.time_series??{}).map(([t,m])=>[t,(m.values??[]).map(([k,I])=>({timestamp:new Date(Number(k)*1000).toISOString(),value:Mi(I,Number.NaN)})).filter((k)=>Number.isFinite(k.value))]))}function hd(R){return R.length?R.reduce((t,m)=>t+m,0)/R.length:null}function Qa(R){return R.length?Math.max(...R):null}function gp(R){return R.length?Math.min(...R):null}async function yd(R){let[t,m]=await Promise.all([R.client.getServerMetrics(R.serverId,{types:["cpu","disk","network"],start:R.from,end:R.to,step:R.step}),Oe(R.remote.host,"LC_ALL=C sadf -j -- -u -r -S",R.remote).catch(()=>"")]),k=pp(m,R.from,R.to),I=fp(t),z=(I.cpu??[]).map((oe)=>Math.max(0,Math.min(100,oe.value/Math.max(1,R.cores)))),Y=k.map((oe)=>oe.cpuUsedPercent),Z=z.length?z:Y,X=k.map((oe)=>oe.memoryUsedPercent),ee=k.map((oe)=>oe.swapUsedPercent);return{from:R.from.toISOString(),to:R.to.toISOString(),cores:R.cores,host:k,provider:I,summary:{cpuAveragePercent:hd(Z),cpuPeakPercent:Qa(Z),memoryAveragePercent:hd(X),memoryPeakPercent:Qa(X),memoryMinimumAvailableBytes:gp(k.map((oe)=>oe.memoryAvailableBytes)),swapPeakPercent:Qa(ee)}}}function hp(R){if(R.length===0)throw Error("A server name cannot be empty.");if(R.length>253)throw Error(`'${R}' is longer than the 253 characters a hostname allows.`);for(let t of R.split(".")){if(t.length===0)throw Error(`'${R}' has an empty label — a hostname cannot contain '..'.`);if(t.length>63)throw Error(`'${t}' is longer than the 63 characters a hostname label allows.`);if(!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(t))throw Error(`'${t}' is not a valid hostname label. Use letters, digits and hyphens, not starting or ending with a hyphen.`)}}async function vd(R,t,m){if(hp(t),R===t)throw Error(`'${R}' is already named that.`);if((await m.takenNames()).some((L)=>L===t&&L!==R))throw Error(`'${t}' is already taken. Server names have to be unique within a provider project.`);let I=[];if(m.providerName&&m.renameProvider){let{providerName:L,renameProvider:z}=m;I.push({id:"provider",title:"Rename the server at the provider",change:{from:R,to:t},satisfied:async()=>await L()===t,apply:()=>z(t)})}if(m.stateName&&m.writeStateName){let{stateName:L,writeStateName:z}=m;I.push({id:"state-pin",title:"Update the recorded name in the local driver state",change:{from:R,to:t},satisfied:async()=>{let Y=await L();return Y===void 0||Y===t},apply:()=>z(t)})}if(m.remoteHostname&&m.setRemoteHostname){let{remoteHostname:L,setRemoteHostname:z}=m;I.push({id:"hostname",title:"Set the hostname on the box",change:{from:R,to:t},satisfied:async()=>await L()===t,apply:()=>z(t)})}return I.push({id:"inventory",title:"Rename the fleet inventory record",change:{from:R,to:t},satisfied:async()=>m.inventoryName()===t,apply:async()=>{await m.renameInventory(t)}}),{operation:"server:rename",target:R,steps:I}}function bd(R){let t=`'${R.replace(/'/g,`'"'"'`)}'`;return["set -eu",'TS_CLOUD_OLD="$(hostname)"',`hostnamectl set-hostname ${t} 2>/dev/null || { echo ${t} > /etc/hostname && hostname ${t}; }`,'if grep -q "^127.0.1.1" /etc/hosts; then',`  TS_CLOUD_HOSTS="$(sed -E "s/^127\\.0\\.1\\.1.*/127.0.1.1\\t${R}/" /etc/hosts)"`,`  printf '%s\\n' "$TS_CLOUD_HOSTS" > /etc/hosts`,"else",`  printf '127.0.1.1\\t%s\\n' ${t} >> /etc/hosts`,"fi",'printf "%s -> %s\\n" "$TS_CLOUD_OLD" "$(hostname)"'].join(`
+`)}async function yp(){let R=await De(),t=y(process.cwd(),R),m=new _e(t.store),k=new jn(m,[new ut("aws"),new ut("hetzner"),new ut("ssh")]);return{controlPlane:t,store:m,service:k}}async function Hr(R){let t=await yp();try{return await R(t)}finally{t.controlPlane.store.close()}}var Ui=(R,t)=>{let m=R.store.list(R.controlPlane.project.id).find((k)=>k.id===t||k.name===t);if(!m)throw Error(`Server ${t} was not found.`);return m},wn=(R)=>{r(R instanceof Error?R.message:String(R)),process.exitCode=1};function Xa(R,t){let m=Number.parseInt(R??"",10);return Number.isFinite(m)&&m>=0?m:t}function vp(R="3h"){let t=R.match(/^(\d+)(m|h)$/);if(!t)throw Error("--range must use minutes or hours, for example 30m or 3h.");let m=Number(t[1])*(t[2]==="h"?3600000:60000);if(m<300000||m>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return m}function ts(R,t="%"){return R==null?"unavailable":`${R.toFixed(1)}${t}`}async function bp(R,t){let m=await De();if(m.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let k=t.env??process.env.CLOUD_ENV??"production",I=T(m,k),L=await fe(I);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${I}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(R))throw Error(`Refusing to read ${R}: project state is pinned to ${L.serverName}.`);let z=Ct(m),Y=new $e({apiToken:Tr(z.apiToken,m)}),Z=await Y.getServer(L.serverId),X=L.publicIp??Z.public_net.ipv4?.ip;if(!X)throw Error(`Server ${Z.name} has no public IPv4 address.`);let ee=new Date,oe=new Date(ee.getTime()-vp(t.range)),se=Math.min(3600,Math.max(60,Xa(t.step,60))),ue=await yd({client:Y,serverId:Z.id,cores:Math.max(1,Number(Z.server_type.cores)||1),from:oe,to:ee,step:se,remote:{host:X,user:L.sshUser??z.sshUser,identityFile:z.sshPrivateKeyPath,connectTimeoutSec:15}});if(t.json){console.log(JSON.stringify({schemaVersion:1,server:Z.name,result:ue},null,2));return}c(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[Z.name,`${ue.from} to ${ue.to}`,`${ts(ue.summary.cpuAveragePercent)} / ${ts(ue.summary.cpuPeakPercent)}`,`${ts(ue.summary.memoryAveragePercent)} / ${ts(ue.summary.memoryPeakPercent)}`,ue.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(ue.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,ts(ue.summary.swapPeakPercent)]])}function wd(R){let t=R.targetType.prices?.find((m)=>m.location===R.location);return{serverId:R.serverId,serverName:R.serverName,location:R.location,from:R.currentType.name,to:R.targetType.name,capacityAvailable:R.capacityAvailable,alreadyComplete:R.alreadyComplete,upgradeDisk:R.upgradeDisk,target:{cores:R.targetType.cores,memoryGb:R.targetType.memory,diskGb:R.targetType.disk,architecture:R.targetType.architecture,cpuType:R.targetType.cpu_type},price:t?{hourlyNet:t.price_hourly.net,hourlyGross:t.price_hourly.gross,monthlyNet:t.price_monthly.net,monthlyGross:t.price_monthly.gross}:void 0}}function wp(R){let t=wd(R);c(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${t.serverName} (${t.serverId})`,t.location,`${t.from} -> ${t.to}`,t.capacityAvailable?"available":"waiting",`${t.target.cores??0} / ${t.target.memoryGb??0} GB / ${t.target.diskGb??0} GB`,t.price?.monthlyGross??t.price?.monthlyNet??"not reported"]])}async function Sp(R,t,m){let k=await De();if(k.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let I=m.env??process.env.CLOUD_ENV??"production",L=T(k,I),z=await fe(L),Y=Ct(k),Z=new $e({apiToken:Tr(Y.apiToken,k)}),ee=z&&(R===z.serverName||R===String(z.serverId)||R===z.stackName)?await Z.getServer(z.serverId):(await Z.listServers()).find((Ne)=>Ne.name===R||String(Ne.id)===R);if(!ee)throw Error(`Hetzner server ${R} was not found.`);if(z?.serverId&&z.serverId!==ee.id)throw Error(`Refusing to resize ${R}: project state is pinned to server ${z.serverId}.`);let oe=nt(t),se=m.upgradeDisk!==!1,ue=await it(Z,ee.id,oe,se);if(m.json)console.log(JSON.stringify({schemaVersion:1,plan:wd(ue)},null,2));else wp(ue);if(!m.apply){if(!m.json)e(`Preview only. Re-run with --apply --confirm ${ee.name} to execute.`);return}if(m.confirm!==ee.name)throw Error(`Resize requires --confirm ${ee.name}.`);let ke=z?.publicIp??ee.public_net.ipv4?.ip;if(!ke)throw Error(`Server ${ee.name} has no public IPv4 address for verification.`);let ce={host:ke,user:z?.sshUser??Y.sshUser,identityFile:Y.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},Se=await zs(L),xe=new Date().toISOString(),ve={schemaVersion:1,operationId:Se?.targetType===oe&&Se.serverId===ee.id?Se.operationId:crypto.randomUUID(),stackName:L,serverId:ee.id,serverName:ee.name,sourceType:ue.currentType.name,targetType:oe,upgradeDisk:se,phase:"planning",status:"running",attempts:Se?.targetType===oe?Se.attempts:0,startedAt:Se?.targetType===oe?Se.startedAt:xe,updatedAt:xe,manifest:Se?.targetType===oe?Se.manifest:void 0};await Et(ve);let Re=Xa(m.pollSeconds,900)*1000,Ie=Xa(m.maxWaitMinutes,0)*60000,Me=Date.now();for(;;){let Ne=await it(Z,ee.id,oe,se);if(!Ne.capacityAvailable&&!Ne.alreadyComplete){if(ve={...ve,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await Et(ve),!m.wait){if(!m.json)e(`${oe} has no capacity in ${Ne.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(Ie>0&&Date.now()-Me>=Ie)throw Error(`Timed out waiting for ${oe} capacity in ${Ne.location}.`);if(!m.json)e(`Waiting ${Math.round(Re/1000)} seconds for ${oe} capacity...`);await Bun.sleep(Re);continue}let Fe=await Hs(L);try{let ze=await(async()=>{try{return ve={...ve,status:"running",attempts:ve.attempts+1,updatedAt:new Date().toISOString()},await Et(ve),await Er({client:Z,serverId:ee.id,targetType:oe,upgradeDisk:se,resumeFromOff:ve.phase==="shutting-down"||ve.phase==="resizing"||ve.phase==="powering-on"||ve.phase==="verifying",manifest:ve.manifest,hooks:{preflight:async()=>{let ot=await Ri(ce);return ve={...ve,manifest:ot,updatedAt:new Date().toISOString()},await Et(ve),ot},afterBoot:async(ot,wt,He,dt)=>Ii(ce,wt,He,dt),onPhase:async(ot,wt)=>{if(ve={...ve,phase:ot,status:ot==="waiting-capacity"?"waiting-capacity":ot==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await Et(ve),!m.json)e(`${ot}${wt?` ${JSON.stringify(wt)}`:""}`)}}})}finally{await Fe()}})();if(ve={...ve,status:ze.status==="completed"||ze.status==="already-complete"?"completed":ze.status==="recovered"?"recovered":"waiting-capacity",lastError:ze.status==="recovered"?ze.error:void 0,updatedAt:new Date().toISOString()},await Et(ve),m.json)console.log(JSON.stringify({schemaVersion:1,result:ze},null,2));else if(ze.status==="completed"||ze.status==="already-complete")n(`${ee.name} is on ${oe} and passed full post-boot verification.`);else if(ze.status==="recovered"&&ze.retryable&&m.wait){e(`Capacity race recovered safely. Waiting ${Math.round(Re/1000)} seconds before retry.`),await Bun.sleep(Re);continue}else if(ze.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${ze.error}`);return}catch(ze){throw ve={...ve,status:"failed",lastError:ze instanceof Error?ze.message:String(ze),updatedAt:new Date().toISOString()},await Et(ve),ze}}}async function Cp(R,t){let m=await De();if(m.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let k=t.env??process.env.CLOUD_ENV??"production",I=T(m,k),L=await fe(I);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${I}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(R))throw Error(`Refusing to optimize ${R}: project state is pinned to ${L.serverName}.`);let z=Ct(m),Y=new $e({apiToken:Tr(z.apiToken,m)}),Z=await Y.getServer(L.serverId),X=L.publicIp??Z.public_net.ipv4?.ip;if(!X)throw Error(`Server ${Z.name} has no public IPv4 address.`);let ee=Ro(m);if(t.json)console.log(JSON.stringify({schemaVersion:1,server:Z.name,plan:ee},null,2));else c(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[Z.name,ee.firewallPorts.join(","),ee.monitoring?"on":"off",ee.autoUpdates?"on":"off",`${ee.swapGb} GB`,"disabled"]]);if(!t.apply){if(!t.json)e(`Preview only. Re-run with --apply --confirm ${Z.name} to execute.`);return}if(t.confirm!==Z.name)throw Error(`Optimization requires --confirm ${Z.name}.`);let oe={host:X,user:L.sshUser??z.sshUser,identityFile:z.sshPrivateKeyPath,connectTimeoutSec:15},se=await pn(oe),ue=se.routeProbes.filter((He)=>!He.ok),ke=m.infrastructure?.compute,ce=ne(ke)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,Se=se.failedUnits.filter((He)=>!ce.has(He));if(Se.length>0)throw Error(`Preflight found failed services: ${Se.join(", ")}`);if(ue.length>0)throw Error(`Preflight found unhealthy routes: ${ue.map((He)=>He.domain).join(", ")}`);let xe=ne(ke)?[]:Object.values(m.sites??{}).flatMap((He)=>typeof He?.port==="number"&&![80,443].includes(He.port)?[He.port]:[]),ve=un({allowSsh:ke?.allowSsh!==!1,sitePorts:xe,allowedPorts:ke?.firewall?.allowedPorts}),Re=(L.firewallId?(await Y.listFirewalls()).find((He)=>He.id===L.firewallId):void 0)??(await Y.listFirewalls()).find((He)=>He.name===`${m.project.slug}-${k}-app-fw`);if(!Re)throw Error(`Managed firewall for ${Z.name} was not found.`);let Ie=await Y.setFirewallRules(Re.id,ve);await Promise.all(Ie.map((He)=>Y.waitForAction(He.id))),await Fs(m,oe);let[Me,Ne]=await Promise.all([pn(oe),js(oe)]),Fe=Vs(ee,Ne),ze=Qc(se,Me),ot=Me.routeProbes.filter((He)=>!He.ok);if(ze.stoppedServices.length>0)Fe.push(`services stopped: ${ze.stoppedServices.join(", ")}`);if(ze.changedRouteFragments.length>0)Fe.push(`route fragments changed: ${ze.changedRouteFragments.join(", ")}`);if(ze.missingRouteIds.length>0)Fe.push(`routes disappeared: ${ze.missingRouteIds.join(", ")}`);if(ze.changedReleaseLinks.length>0)Fe.push(`release links changed: ${ze.changedReleaseLinks.join(", ")}`);if(ze.missingData.length>0)Fe.push(`databases or volumes disappeared: ${ze.missingData.join(", ")}`);if(ot.length>0)Fe.push(`unhealthy routes: ${ot.map((He)=>He.domain).join(", ")}`);if(Fe.length>0)throw Error(`Host optimization verification failed: ${Fe.join("; ")}`);let wt={serverId:Z.id,serverName:Z.name,services:Me.runningServices.length,routes:Me.routeIds.length,healthyDomains:Me.routeProbes.length,releaseLinks:Me.releaseLinks.length,databasesAndVolumes:Me.dataCatalog.length,report:Ne};if(t.json)console.log(JSON.stringify({schemaVersion:1,result:wt},null,2));else n(`${Z.name} passed full host, rpx route, service, release, and data verification.`)}async function $p(R,t,m){let k=await De(),I=m.env??"production",L=T(k,I);await Hr(async(z)=>{let Y=Ui(z,R),Z=z.store.list(z.controlPlane.project.id,!0),X=Y.provider==="hetzner"&&Y.providerId?(()=>{try{let Re=Ct(k);return new $e({apiToken:Tr(Re.apiToken,k)})}catch{return null}})():null,ee=Y.providerId?Number(Y.providerId):Number.NaN,oe=await fe(L),se=oe!=null&&oe.serverId===ee,ue=new Wr,ke=Y.trustState==="pinned",ce={takenNames:async()=>{let Re=Z.map((Ie)=>Ie.name);if(X)Re.push(...(await X.listServers()).map((Ie)=>Ie.name));return Re},inventoryName:()=>z.store.get(Y.id)?.name??Y.name,renameInventory:(Re)=>{z.store.update(Y.id,{name:Re})},...X&&Number.isFinite(ee)?{providerName:async()=>(await X.getServer(ee)).name,renameProvider:async(Re)=>{await X.renameServer(ee,Re)}}:{},...se?{stateName:async()=>(await fe(L))?.serverName,writeStateName:async(Re)=>{let Ie=await fe(L);if(Ie)await Tt(L,{...Ie,serverName:Re})}}:{},...ke?{remoteHostname:async()=>{let Re=await ue.exec(Y,"hostname");return Re.code===0?Re.stdout.trim():void 0},setRemoteHostname:async(Re)=>{let Ie=await ue.exec(Y,bd(Re));if(Ie.code!==0)throw Error(Ie.stderr.trim()||`hostname exited ${Ie.code}`)}}:{}},Se=await vd(Y.name,t,ce),xe=await Es(Se);if(!m.apply){let Re=[X?"":"provider record (no provider id or no API token)",se?"":"local state pin (none points at this server)",ke?"":"box hostname (host key is not pinned — run server:validate first)"].filter(Boolean);if(m.json){console.log(JSON.stringify({schemaVersion:1,operation:Se.operation,target:Se.target,rename:{from:Y.name,to:t},notCovered:Re,steps:xe.map((Ie)=>({id:Ie.step.id,title:Ie.step.title,state:Ie.state,change:Ie.step.change,reason:Ie.reason}))},null,2));return}for(let Ie of Ns(Se,xe))console.log(Ie);for(let Ie of Re)console.log(`  not covered: ${Ie}`);console.log("  Re-run with --apply to perform it.");return}let ve=await Ls(Se,xe,{log:(Re)=>e(Re),audit:(Re)=>z.controlPlane.store.appendEvent({projectId:z.controlPlane.project.id,resourceId:Y.resourceId,type:`${Re.operation}.${Re.step}.${Re.state}`,level:Re.state==="failed"?"error":"info",payload:{target:Re.target,renameTo:t,...Re.error?{error:Re.error}:{}}})});if(m.json)console.log(JSON.stringify({schemaVersion:1,outcome:ve},null,2));if(!ve.success){let Re=ve.steps.find((Ie)=>Ie.state==="failed");throw Error(`${Se.operation} stopped at '${Re?.title}': ${Re?.error}. Earlier steps stayed applied; re-run the same command to continue from here.`)}if(!m.json)n(`Renamed ${Y.name} to ${t}.`)})}function ec(R){R.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(t,m)=>{try{await Hr(async(k)=>{let I=t?[Ui(k,t)]:k.store.list(k.controlPlane.project.id),L=I.flatMap((z)=>Object.entries(z.capabilities).map(([Y,Z])=>({server:z.name,provider:z.provider,action:Y,...Z})));if(m.json)console.log(JSON.stringify({schemaVersion:1,targets:L},null,2));else c(["Server","Provider","Action","Support","Explanation"],L.map((z)=>[z.server,z.provider,z.action,z.supported?"supported":"unsupported",z.reason??"—"]))})}catch(k){wn(k)}}),R.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(t,m,k)=>{try{await Sp(t,m,k)}catch(I){wn(I)}}),R.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(t,m)=>{try{await Cp(t,m)}catch(k){wn(k)}}),R.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(t,m)=>{try{await bp(t,m)}catch(k){wn(k)}}),R.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(t)=>{try{await Hr(async(m)=>{let k=m.store.list(m.controlPlane.project.id);if(t.json)console.log(JSON.stringify(k,null,2));else c(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],k.map((I)=>[I.name,I.providerId??"—",`${I.provider} / ${I.region??"external"}`,`${I.status} / ${I.trustState}`,I.roles.join(","),`${I.capacity.cpu??0} / ${I.capacity.memoryBytes??0}`,I.heartbeatAt??"never"]))})}catch(m){wn(m)}}),R.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(t,m)=>{try{await Hr(async(k)=>{let I=m.provider;if(!["aws","hetzner","ssh"].includes(I)||!m.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let L=k.service.enroll({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,name:t,provider:I,providerId:m.providerId,endpoint:m.endpoint,sshUser:m.user??"deploy",credentialRef:m.credentialRef??"secret://fleet/agent",region:m.region,roles:String(m.roles??"application").split(","),labels:Object.fromEntries(String(m.labels??"").split(",").map((z)=>z.split("=")).filter((z)=>z[0]&&z[1]))});n(`Enrolled ${L.name} as ${L.id}; no remote mutation was performed.`)})}catch(k){wn(k)}}),R.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(t,m)=>{try{await Hr(async(k)=>{let I=Ui(k,t);if(I=await k.service.test(I.id),I.trustState==="rotation_pending"){if(!m.acceptHostKey)throw Error(`Host key changed to ${I.pendingHostKey}; review it first.`);I=k.service.reviewHostKey(I.id,m.acceptHostKey)}let L=await k.service.validate(I.id);if(m.json)console.log(JSON.stringify(L.validation,null,2));else c(["Severity","Code","Finding","Remediation"],(L.validation?.findings??[]).map((z)=>[z.severity,z.code,z.message,z.remediation??"—"]));if(!L.validation?.valid)process.exitCode=1})}catch(k){wn(k)}}),R.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(t,m)=>{try{await Hr(async(k)=>{let I=k.service.bootstrap(Ui(k,t).id,!!m.apply);if(I.preview)c(["Step"],I.steps.map((L)=>[L]));else n(`Bootstrap queued: ${I.operation?.id}`)})}catch(k){wn(k)}}),R.command("server:rename <name> <new-name>","Rename a server in place, without recreating it").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Perform the reviewed rename plan").option("--json","Print structured JSON").action(async(t,m,k)=>{try{await $p(t,m,k)}catch(I){wn(I)}}),R.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(t,m)=>{try{await Hr(async(k)=>n(k.service.drain(Ui(k,t).id,!!m.complete).status))}catch(k){wn(k)}}),R.command("server:uncordon <name>","Return a server to scheduling").action(async(t)=>{try{await Hr(async(m)=>{m.service.uncordon(Ui(m,t).id),n(`Uncordoned ${t}.`)})}catch(m){wn(m)}}),R.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(t,m)=>{try{await Hr(async(k)=>{k.service.archive(Ui(k,t).id,m.confirm??""),n(`Archived ${t}; provider infrastructure was not terminated.`)})}catch(k){wn(k)}}),R.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(t)=>{try{await Hr(async(m)=>{let k=Ui(m,t);if(k.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let I=Bun.spawn(["ssh","-p",String(k.sshPort),"-o","StrictHostKeyChecking=yes",`${k.sshUser}@${k.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),L=await I.exited;if(L)process.exitCode=L})}catch(m){wn(m)}});for(let[t,m]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])R.command(t,m).action(async(...k)=>xn(t.split(" ")[0],{target:String(k[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}import{existsSync as Sd,mkdirSync as kp,readFileSync as Ap,writeFileSync as Rp}from"node:fs";import{join as Cd,resolve as Ip}from"node:path";var tc=(R)=>{r(R instanceof Error?R.message:String(R)),process.exitCode=1};async function Pp(){try{return await De()}catch{return}}function xp(R){if(R===void 0)return;let t=Number(R);if(!Number.isInteger(t)||t<1||t>65535)throw Error(`--port must be a port number, not '${R}'.`);return t}function $d(R,t,m){let k=R?.ssh?.hosts?.find((I)=>I.host===t);return new Pr({hosts:t?[k??{host:t}]:R?.ssh?.hosts,user:m.user,port:xp(m.port),privateKeyPath:m.key,hostKey:R?.ssh?.hostKey,sudo:R?.ssh?.sudo,profile:m.profile??R?.ssh?.profile,publicIp:R?.ssh?.publicIp,lan:R?.ssh?.lan})}var kd=1073741824;function nc(R){R.command("ssh:preflight [host]","Check a bring-your-own Linux host before adopting it").option("--user <user>","SSH user (default: ssh.hosts[].user, then root)").option("--port <port>","SSH port (default: ssh.hosts[].port, then 22)").option("--key <path>","SSH private key (default: ssh.hosts[].privateKeyPath, then ~/.ssh/id_ed25519)").option("--profile <profile>","raspberry-pi or generic (default: ssh.profile, then generic)").option("--json","Print the facts and findings as JSON").action(async(t,m)=>{try{let k=await Pp(),I=$d(k,t,m),L=t??I.targetHost(),z=await I.ensureHostKey(L),{facts:Y,findings:Z}=await I.preflight(L);if(m.json)console.log(JSON.stringify({schemaVersion:1,host:L,hostKeyFingerprint:z.fingerprint,facts:Y,findings:Z},null,2));else{if(i(`Preflight ${L}`),z.pinnedNow)e(`Pinned host key ${z.fingerprint}`);if(e(`${Y.os} on ${Y.arch}, ${Y.cpuCores} cores, ${(Y.memoryBytes/kd).toFixed(1)} GiB memory, ${(Y.diskFreeBytes/kd).toFixed(1)} GiB free`),Y.piModel)e(Y.piModel);if(Y.lanIp)e(`LAN address ${Y.lanIp}`);if(console.log(mn(Z)),Ir(Z))r("The host is not ready; fix the errors above and run the preflight again.");else n("The host is ready to adopt.")}if(Ir(Z))process.exitCode=1}catch(k){tc(k)}}),R.command("ssh:bootstrap","Adopt the configured host: pin its key, run the preflight, then bootstrap it").option("--env <environment>","Deployment environment",{default:"production"}).option("--dry-run","Print the bootstrap script instead of running it").action(async(t)=>{try{let m=await De(),k=t.env??"production";if(t.dryRun){let z=Rr(m),[Y]=z.hosts;console.log(Ar({config:m,environment:k,profile:z.profile,sudoUser:Y.user!=="root"?Y.user:void 0,lan:z.lan}));return}let I=$d(m,void 0,{});i(`Adopt ${I.targetHost()}`);let L=await I.provisionComputeInfrastructure({config:m,environment:k});n(`${L.appPublicIp} is bootstrapped; deploy with: cloud deploy --env ${k}`)}catch(m){tc(m)}}),R.command("ssh:first-boot","Write cloud-init first-boot files for a freshly flashed Raspberry Pi OS or Ubuntu image").option("--os <os>","raspberry-pi-os or ubuntu",{default:"raspberry-pi-os"}).option("--out <dir>","Directory to write user-data, network-config and meta-data into (never a mounted card; copy them yourself)").option("--hostname <name>","Hostname of the new host").option("--user <user>","Deploy user created on first boot (default: ssh.hosts[].user, then pi)").option("--key <path>","Public key authorized for the user",{default:"~/.ssh/id_ed25519.pub"}).option("--wifi-ssid <ssid>","Join this Wi-Fi network on first boot").option("--wifi-passphrase-env <name>","Environment variable holding the Wi-Fi passphrase",{default:"WIFI_PASSWORD"}).option("--wifi-country <cc>","Wi-Fi regulatory domain, e.g. DE").option("--timezone <tz>","IANA timezone, e.g. Europe/Berlin").option("--locale <locale>","System locale, e.g. en_US.UTF-8").option("--env <environment>","Deployment environment the embedded bootstrap is built for",{default:"production"}).option("--force","Overwrite files already in --out").action(async(t)=>{try{if(!t.out)throw Error("--out <dir> is required.");if(!t.hostname)throw Error("--hostname <name> is required.");let m=t.os??"raspberry-pi-os";if(!(m in wo))throw Error(`--os must be raspberry-pi-os or ubuntu, not '${m}'.`);let k=await De(),I=t.env??"production",L=Rr(k,{hosts:k.ssh?.hosts?.length?void 0:[{host:t.hostname}],profile:m==="raspberry-pi-os"?"raspberry-pi":void 0}),z=t.user??(k.ssh?.hosts?.[0]?.user??"pi"),Y=dn(t.key??"~/.ssh/id_ed25519.pub");if(!Sd(Y))throw Error(`Public key not found at ${Y}; pass --key <path to a .pub file>.`);let Z=Ap(Y,"utf8").trim(),X;if(t.wifiSsid){let ke=t.wifiPassphraseEnv??"WIFI_PASSWORD",ce=process.env[ke];if(!ce)throw Error(`--wifi-ssid needs the passphrase in $${ke} (set it in the environment, not on the command line).`);if(!t.wifiCountry)throw Error("--wifi-country <cc> is required with --wifi-ssid.");X={ssid:t.wifiSsid,passphrase:ce,country:t.wifiCountry}}let ee=Ar({config:k,environment:I,profile:L.profile,sudoUser:z!=="root"?z:void 0,lan:L.lan}),oe=Ao({hostname:t.hostname,user:z,publicKey:Z,timezone:t.timezone,locale:t.locale,wifi:X},ee,{os:m}),se=Ip(t.out);kp(se,{recursive:!0});let ue=Object.keys(oe.files).filter((ke)=>Sd(Cd(se,ke)));if(ue.length>0&&!t.force)throw Error(`${ue.join(", ")} already exist in ${se}; pass --force to overwrite.`);for(let[ke,ce]of Object.entries(oe.files))Rp(Cd(se,ke),ce,{mode:384});i(`First boot for ${t.hostname}`),n(`Wrote ${Object.keys(oe.files).join(", ")} to ${se}`),console.log(oe.instructions)}catch(m){tc(m)}})}async function Dp(){let R=await De(),t=y(process.cwd(),R),m=new Vn(t.store),k=new zn(m,new _e(t.store));return{controlPlane:t,store:m,service:k}}async function ns(R){let t=await Dp();try{await R(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}var _s=(R)=>Object.fromEntries(String(R??"").split(",").map((t)=>t.split("=")).filter((t)=>t[0]&&t[1])),Ad=(R)=>Object.fromEntries(Object.entries(_s(R)).map(([t,m])=>[t,Number(m)]));function rc(R){R.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(t)=>ns((m)=>{let k=m.store.listPools(m.controlPlane.project.id);if(t.json)console.log(JSON.stringify(k,null,2));else c(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],k.map((I)=>[I.name,I.purpose,I.backend,`${I.region??"any"} / ${I.architecture??"any"}`,I.status,JSON.stringify(I.capacity),String(I.concurrency)]))})),R.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(t,m)=>ns((k)=>{let{purpose:I,backend:L}=m;if(!["application","build","worker","monitoring","backup"].includes(I)||!["server","ecs","asg"].includes(L))throw Error("Unsupported pool purpose or backend.");let z=k.store.createPool({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,name:t,purpose:I,backend:L,region:m.region,architecture:m.arch,labels:_s(m.labels),requiredServerLabels:_s(m.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...Ad(m.capacity)},maxWorkloads:Number(m.max),costWeight:1,concurrency:Number(m.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});n(`Created ${z.name} (${z.id}).`)})),R.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(t,m)=>ns((k)=>{let I=k.store.listPools(k.controlPlane.project.id).find((z)=>z.id===t||z.name===t),L=new _e(k.controlPlane.store).list(k.controlPlane.project.id).find((z)=>z.id===m||z.name===m);if(!I||!L)throw Error("Pool or server was not found.");k.store.addMember(I.id,L.id),n(`Attached ${L.name} to ${I.name}.`)})),R.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(t)=>ns((m)=>{let k=m.service.explain(m.controlPlane.project.id,{purpose:t.purpose,resources:Ad(t.resources),region:t.region,architecture:t.arch,labels:_s(t.labels)});if(t.json)console.log(JSON.stringify(k,null,2));else c(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],k.map((I)=>[I.poolName,I.serverId??"provider-managed",I.eligible?"yes":"no",JSON.stringify(I.available),`${I.score.fit.toFixed(2)} / ${I.score.spread} / ${I.score.cost}`,I.reasons.join("; ")||"eligible"]))})),R.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(t)=>ns((m)=>{let k=m.store.listPools(m.controlPlane.project.id).find((L)=>L.id===t||L.name===t);if(!k)throw Error("Pool was not found.");let I=m.service.drainPool(k.id);n(`Draining ${k.name}: moved ${I.moved.length}, blocked ${I.blocked.length} stateful placement(s).`)}))}async function Ep(){let R=await De(),t=y(process.cwd(),R),m=new Hn(t.store),k=new Gn(m);return{controlPlane:t,store:m,service:k}}async function Qi(R){let t=await Ep();try{await R(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}var ss=(R,t)=>{let m=R.store.list(R.controlPlane.project.id).find((k)=>k.id===t||k.name===t);if(!m)throw Error("Regional topology was not found.");return m},Tp=(R)=>R.split(",").map((t,m)=>{let[k,I="aws"]=t.split(":");return{region:String(k),provider:I,role:m===0?"primary":"secondary"}}),Np=(R)=>{let t=new Set(["s3","dynamodb","secrets"]),m=R.split(",").map((I)=>I.trim()),k=m.find((I)=>!t.has(I));if(k)throw Error(`Unsupported replication kind: ${k}`);return m};function ic(R){R.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(t)=>Qi((m)=>{let k=m.store.list(m.controlPlane.project.id).map((I)=>({topology:I,targets:m.store.targets(I.id),channels:m.store.channels(I.id),route:m.store.route(I.id),executions:m.store.executions(I.id)}));if(t.json)console.log(JSON.stringify(k,null,2));else c(["Name","Hostname","Active","Status","Revision","Replication"],k.map((I)=>[I.topology.name,I.topology.hostname,I.topology.activeRegion,I.topology.status,I.topology.revision??"—",`${I.channels.filter((L)=>L.status==="in_sync").length}/${I.channels.length} in sync`]))})),R.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(t,m)=>Qi((k)=>{if(!m.hostname||!m.regions)throw Error("--hostname and --regions are required.");let I=k.service.create({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,name:t,hostname:m.hostname,regions:Tp(m.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Np(String(m.replicate)),maxLagSeconds:Number(m.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!m.cdn,wafEnabled:!!m.waf});n(`Created ${I.name} (${I.id}); run region:rollout with an immutable manifest.`)})),R.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(t,m,k)=>Qi((I)=>c(["Step"],I.service.plan(ss(I,t).id,m,k.target).map((L)=>[L])))),R.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(t,m,k)=>Qi(async(I)=>{let L=k.manifest?await Bun.file(k.manifest).json():{},z=I.service.enqueue({topologyId:ss(I,t).id,kind:"rollout",revision:m,manifest:L});n(`Regional rollout queued: ${z.operation.id}`)})),R.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(t,m)=>Qi((k)=>{let I=k.service.enqueue({topologyId:ss(k,t).id,kind:"failover",targetRegion:m});n(`Failover queued: ${I.operation.id}`)})),R.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(t,m)=>Qi((k)=>{let I=k.service.enqueue({topologyId:ss(k,t).id,kind:"failback",targetRegion:m});n(`Failback queued: ${I.operation.id}`)})),R.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(t,m)=>Qi((k)=>{let I=k.service.enqueue({topologyId:ss(k,t).id,kind:"destroy",confirmation:m.confirm});n(`Regional teardown queued: ${I.operation.id}; replicated data remains retained.`)}))}var ls="0.16.92";async function Lp(){let R=await De(),t=y(process.cwd(),R),m=new qn(t.store),k=new Wn(m),I=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new Kn(L,t.store,t.project.id,t.organization.id));return{controlPlane:t,store:m,service:k,cleanup:I}}async function Ci(R){let t=await Lp();try{await R(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}function oc(R){R.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(t)=>Ci((m)=>{let k={manifests:m.store.manifests(m.controlPlane.organization.id),windows:m.store.windows(m.controlPlane.project.id),campaigns:m.store.campaigns(m.controlPlane.project.id),cleanups:m.store.cleanups(m.controlPlane.project.id),drills:m.store.drills(m.controlPlane.project.id)},I=[...k.manifests.map((L)=>["update",L.version,L.compatibility.compatible?"compatible":"blocked",L.compatibility.reasons.join("; ")||L.channel]),...k.campaigns.map((L)=>["upgrade",L.id,L.status,L.currentStage??L.fromVersion]),...k.cleanups.map((L)=>["cleanup",L.kind,L.status,`${L.candidates.length} items / ${L.estimatedBytes} bytes`]),...k.drills.map((L)=>["DR drill",L.scenario,L.status,L.isolatedTarget])];if(t.json)console.log(JSON.stringify(k,null,2));else c(["Area","Name / version","Status","Detail"],I)})),R.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(t,m)=>Ci(async(k)=>{let I=k.store.addTrustedKey({organizationId:k.controlPlane.organization.id,name:t,publicKeyPem:await Bun.file(m).text()});n(`Trusted ${I.name}: ${I.fingerprint}`)})),R.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(t,m,k)=>Ci(async(I)=>{let L=await Bun.file(t).json(),z=(await Bun.file(m).text()).trim(),Y=I.store.importManifest({organizationId:I.controlPlane.organization.id,keyId:k,document:L,signature:z,current:{schemaVersion:I.controlPlane.store.health().schemaVersion,currentVersion:ls,platform:process.platform,architecture:process.arch}});n(`Verified ${Y.version}; ${Y.compatibility.compatible?"compatible":"blocked: "+Y.compatibility.reasons.join("; ")}`)})),R.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(t,m,k)=>Ci((I)=>{let L=I.store.createWindow({projectId:I.controlPlane.project.id,name:t,schedule:m,timezone:k.timezone,durationMinutes:Number(k.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});n(`Created ${L.name} (${L.id}).`)})),R.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(t,m,k)=>Ci((I)=>{let L=new _e(I.controlPlane.store).list(I.controlPlane.project.id).filter((Z)=>Z.status==="ready").map((Z)=>({serverId:Z.id,target:Z.name,previousVersion:Z.bootstrapVersion??ls}));if(!L.length)L.push({target:"control-plane",previousVersion:ls});let z=I.store.createCampaign({projectId:I.controlPlane.project.id,manifestId:t,fromVersion:ls,strategy:k.strategy==="rolling"?"rolling":"canary",batchSize:Number(k.batch),healthGate:{kind:"platform"},backupId:m,targets:L}),Y=I.service.enqueueCampaign(z.id);n(`Staged upgrade queued: ${Y.operation.id}`)})),R.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(t,m)=>Ci(async(k)=>{let I=await k.service.previewCleanup({projectId:k.controlPlane.project.id,kind:t,criteria:{olderThanDays:Number(m.olderThan)}},k.cleanup);c(["ID","Candidate","Bytes"],I.candidates.map((L)=>[L.id,L.label,String(L.bytes)])),e(`Apply with: cloud cleanup:apply ${I.id} --confirm "DELETE ${I.candidates.length} ${I.kind}"`)})),R.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(t,m)=>Ci((k)=>{let I=k.service.enqueueCleanup(t,String(m.confirm??""));n(`Cleanup queued: ${I.operation.id}`)})),R.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(t,m,k)=>Ci((I)=>{let L=I.store.createDrill({projectId:I.controlPlane.project.id,scenario:t,isolatedTarget:m,expectedRpoMinutes:Number(k.rpo),expectedRtoMinutes:Number(k.rto),recoveryPointId:k.recoveryPoint,topologyId:k.topology});n(`Planned isolated drill ${L.id}.`)})),R.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(t)=>Ci((m)=>{let k=m.service.enqueueDrill(t);n(`DR drill queued: ${k.operation.id}`)}))}async function sc(){try{return(await De()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function ac(R){R.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(t)=>{i("Lambda Functions");let m=t?.region||await sc(),k=new D(m);try{let{Functions:I=[]}=await k.listFunctions({MaxItems:50});if(!I.length){e("No functions found");return}c(["Name","Runtime","Memory","Timeout","Last Modified"],I.map((L)=>[L.FunctionName??"-",L.Runtime??"-",L.MemorySize?`${L.MemorySize} MB`:"-",L.Timeout?`${L.Timeout}s`:"-",L.LastModified??"-"]))}catch(I){r(`Failed to list functions: ${I.message}`),process.exitCode=1}}),R.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(t,m)=>{i(`Invoking ${t}`);let k=m?.region||await sc(),I=new D(k),L=new s("Invoking function...");L.start();try{let z=await I.invoke({FunctionName:t,InvocationType:m?.async?"Event":"RequestResponse",Payload:m?.payload||"{}",LogType:m?.async?"None":"Tail"});if(z.FunctionError){if(L.fail(`Function returned an error (${z.FunctionError})`),z.Payload)e(z.Payload);process.exitCode=1;return}if(L.succeed(`Invoked (status ${z.StatusCode})`),z.Payload)e(`
 Response:`),e(z.Payload);if(z.LogResult)e(`
-Logs:`),e(Buffer.from(z.LogResult,"base64").toString("utf-8"))}catch(z){L.fail(`Invocation failed: ${z.message}`),process.exitCode=1}}),R.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(t,m)=>{i(`Logs for ${t}`);let k=m?.region||await sc(),I=new ce(k),L=t.startsWith("/aws/lambda/")?t:`/aws/lambda/${t}`,z=Number(m?.since??15),Y=(Z)=>{for(let X of Z){let ie=X.timestamp?new Date(X.timestamp).toISOString():"";e(`${ie}  ${(X.message??"").trimEnd()}`)}};try{let Z=Date.now()-z*60000,{events:X=[]}=await I.filterLogEvents({logGroupName:L,startTime:Z,filterPattern:m?.filter,limit:200});if(Y(X),X.length)Z=(X[X.length-1].timestamp??Z)+1;if(m?.tail){e(`
-(streaming — Ctrl+C to stop)`);for(;;){await new Promise((oe)=>setTimeout(oe,3000));let{events:ie=[]}=await I.filterLogEvents({logGroupName:L,startTime:Z,filterPattern:m?.filter,limit:200});if(ie.length)Y(ie),Z=(ie[ie.length-1].timestamp??Z)+1}}}catch(Z){r(`Failed to read logs: ${Z.message}`),process.exitCode=1}})}async function Rd(R){let t=Bun.spawn(["docker",...R],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[m,k]=await Promise.all([t.exited,new Response(t.stderr).text()]);return{ok:m===0,exitCode:m,command:["docker",...R].join(" "),stderr:k.trim()}}function cc(R){R.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(t)=>{let m=["build","--file",t.file??"Dockerfile","--tag",t.tag??"latest","."];if(t.dryRun){console.log(`docker ${m.join(" ")}`);return}let k=await Rd(m);if(t.json)console.log(JSON.stringify(k));if(!k.ok)r(k.stderr||`docker exited ${k.exitCode}`),process.exitCode=k.exitCode;else n(`Built ${t.tag??"latest"}.`)}),R.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(t)=>{if(!t.image){r("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(t.dryRun){console.log(`docker push ${t.image}`);return}let m=await Rd(["push",t.image]);if(t.json)console.log(JSON.stringify(m));if(!m.ok)r(m.stderr),process.exitCode=m.exitCode;else n(`Pushed ${t.image}.`)}),R.command("container:deploy","Deploy a container image").action(async()=>En("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}function lc(R){R.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t)=>{i("Domains");try{let m=Vr(t?.provider),k=bn(t?.provider)?.provider||"unknown",I=new s(`Fetching domains from ${k}...`);I.start();let L=await m.listDomains();if(I.succeed(`Found ${L.length} domain(s)`),L.length===0){e("No domains found in this provider");return}let z=L.map((Y)=>[Y,"Active","-",k.charAt(0).toUpperCase()+k.slice(1)]);c(["Domain","Status","SSL","Provider"],z)}catch(m){r(`Failed to list domains: ${m instanceof Error?m.message:String(m)}`)}}),R.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t,m)=>{i(`Adding Domain: ${t}`);try{let k=Vr(m?.provider),I=bn(m?.provider)?.provider||"unknown",L=new s(`Checking if ${I} can manage ${t}...`);if(L.start(),await k.canManageDomain(t))L.succeed(`Domain ${t} is already available in ${I}`),e(`
+Logs:`),e(Buffer.from(z.LogResult,"base64").toString("utf-8"))}catch(z){L.fail(`Invocation failed: ${z.message}`),process.exitCode=1}}),R.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(t,m)=>{i(`Logs for ${t}`);let k=m?.region||await sc(),I=new le(k),L=t.startsWith("/aws/lambda/")?t:`/aws/lambda/${t}`,z=Number(m?.since??15),Y=(Z)=>{for(let X of Z){let ee=X.timestamp?new Date(X.timestamp).toISOString():"";e(`${ee}  ${(X.message??"").trimEnd()}`)}};try{let Z=Date.now()-z*60000,{events:X=[]}=await I.filterLogEvents({logGroupName:L,startTime:Z,filterPattern:m?.filter,limit:200});if(Y(X),X.length)Z=(X[X.length-1].timestamp??Z)+1;if(m?.tail){e(`
+(streaming — Ctrl+C to stop)`);for(;;){await new Promise((oe)=>setTimeout(oe,3000));let{events:ee=[]}=await I.filterLogEvents({logGroupName:L,startTime:Z,filterPattern:m?.filter,limit:200});if(ee.length)Y(ee),Z=(ee[ee.length-1].timestamp??Z)+1}}}catch(Z){r(`Failed to read logs: ${Z.message}`),process.exitCode=1}})}async function Rd(R){let t=Bun.spawn(["docker",...R],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[m,k]=await Promise.all([t.exited,new Response(t.stderr).text()]);return{ok:m===0,exitCode:m,command:["docker",...R].join(" "),stderr:k.trim()}}function cc(R){R.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(t)=>{let m=["build","--file",t.file??"Dockerfile","--tag",t.tag??"latest","."];if(t.dryRun){console.log(`docker ${m.join(" ")}`);return}let k=await Rd(m);if(t.json)console.log(JSON.stringify(k));if(!k.ok)r(k.stderr||`docker exited ${k.exitCode}`),process.exitCode=k.exitCode;else n(`Built ${t.tag??"latest"}.`)}),R.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(t)=>{if(!t.image){r("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(t.dryRun){console.log(`docker push ${t.image}`);return}let m=await Rd(["push",t.image]);if(t.json)console.log(JSON.stringify(m));if(!m.ok)r(m.stderr),process.exitCode=m.exitCode;else n(`Pushed ${t.image}.`)}),R.command("container:deploy","Deploy a container image").action(async()=>xn("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}function lc(R){R.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t)=>{i("Domains");try{let m=_r(t?.provider),k=yn(t?.provider)?.provider||"unknown",I=new s(`Fetching domains from ${k}...`);I.start();let L=await m.listDomains();if(I.succeed(`Found ${L.length} domain(s)`),L.length===0){e("No domains found in this provider");return}let z=L.map((Y)=>[Y,"Active","-",k.charAt(0).toUpperCase()+k.slice(1)]);c(["Domain","Status","SSL","Provider"],z)}catch(m){r(`Failed to list domains: ${m instanceof Error?m.message:String(m)}`)}}),R.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t,m)=>{i(`Adding Domain: ${t}`);try{let k=_r(m?.provider),I=yn(m?.provider)?.provider||"unknown",L=new s(`Checking if ${I} can manage ${t}...`);if(L.start(),await k.canManageDomain(t))L.succeed(`Domain ${t} is already available in ${I}`),e(`
 The domain is ready to use. You can now:`),e(`  - Add DNS records: cloud dns:add ${t} A 192.168.1.1`),e(`  - Generate SSL: cloud domain:ssl ${t}`);else if(L.warn(`Domain ${t} is not available in ${I}`),e(`
-To add this domain:`),I==="route53")e("  - Create a hosted zone in Route53 for this domain"),e("  - Update nameservers at your registrar to point to Route53");else e(`  - Ensure the domain is registered with ${I}`),e("  - Enable API access for the domain in your provider dashboard")}catch(k){r(`Failed to check domain: ${k instanceof Error?k.message:String(k)}`)}}),R.command("domain:ssl <domain>","Generate SSL certificate via ACM with DNS validation").option("--provider <provider>","DNS provider for validation: porkbun, godaddy, or route53").option("--region <region>","AWS region for ACM (default: us-east-1 for CloudFront compatibility)").option("--wait","Wait for certificate validation to complete").action(async(t,m)=>{i(`Generating SSL Certificate for ${t}`);try{let k=bn(m?.provider);if(!k)throw Error("No DNS provider configured");let I=m?.region||"us-east-1",L=k.provider;e(`DNS Provider: ${L}`),e(`ACM Region: ${I}`);let z=new qt(k,I),Y=new s("Requesting certificate and creating validation records...");Y.start();let Z=await z.findOrCreateCertificate({domainName:t,subjectAlternativeNames:[`*.${t}`],waitForValidation:m?.wait??!0,maxWaitMinutes:10});if(Z.isNew)Y.succeed("Certificate requested and validation records created");else Y.succeed("Found existing valid certificate");if(e(`Certificate ARN: ${Z.certificateArn}`),e(`Status: ${Z.status}`),Z.status==="issued")n(`
+To add this domain:`),I==="route53")e("  - Create a hosted zone in Route53 for this domain"),e("  - Update nameservers at your registrar to point to Route53");else e(`  - Ensure the domain is registered with ${I}`),e("  - Enable API access for the domain in your provider dashboard")}catch(k){r(`Failed to check domain: ${k instanceof Error?k.message:String(k)}`)}}),R.command("domain:ssl <domain>","Generate SSL certificate via ACM with DNS validation").option("--provider <provider>","DNS provider for validation: porkbun, godaddy, or route53").option("--region <region>","AWS region for ACM (default: us-east-1 for CloudFront compatibility)").option("--wait","Wait for certificate validation to complete").action(async(t,m)=>{i(`Generating SSL Certificate for ${t}`);try{let k=yn(m?.provider);if(!k)throw Error("No DNS provider configured");let I=m?.region||"us-east-1",L=k.provider;e(`DNS Provider: ${L}`),e(`ACM Region: ${I}`);let z=new Kt(k,I),Y=new s("Requesting certificate and creating validation records...");Y.start();let Z=await z.findOrCreateCertificate({domainName:t,subjectAlternativeNames:[`*.${t}`],waitForValidation:m?.wait??!0,maxWaitMinutes:10});if(Z.isNew)Y.succeed("Certificate requested and validation records created");else Y.succeed("Found existing valid certificate");if(e(`Certificate ARN: ${Z.certificateArn}`),e(`Status: ${Z.status}`),Z.status==="issued")n(`
 SSL Certificate is ready!`),e(`
 You can now use this certificate with:`),e("  - CloudFront distributions"),e("  - Application Load Balancers"),e("  - API Gateway custom domains");else if(Z.status==="pending")e(`
 DNS validation records have been created.`),e("Certificate validation may take a few more minutes."),e(`
 Check status with: cloud domain:verify ${t}`);else r(`
-Certificate validation failed. Check ACM console for details.`)}catch(k){r(`Failed to generate SSL: ${k instanceof Error?k.message:String(k)}`)}}),R.command("domain:verify <domain>","Verify domain ownership and SSL status").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t,m)=>{i(`Verifying Domain: ${t}`);try{let k=Vr(m?.provider),I=bn(m?.provider)?.provider||"unknown",L=new s("Checking domain ownership...");if(L.start(),!await k.canManageDomain(t)){L.fail("Domain not found in provider"),r(`Domain ${t} is not available in ${I}`);return}L.succeed("Domain ownership verified"),L.text="Fetching DNS records...",L.start();let Z=(await k.listRecords(t)).records||[];L.succeed(`Found ${Z.length} DNS record(s)`),L.text="Checking SSL certificate status...",L.start();let X=new K("us-east-1"),ie="Not found",oe="";try{let Ae=(await X.listCertificates()).CertificateSummaryList.find((de)=>de.DomainName===t||de.DomainName===`*.${t}`);if(Ae)oe=Ae.CertificateArn||"",ie=(await X.describeCertificate({CertificateArn:oe})).Status||"Unknown"}catch{}if(L.succeed("SSL check complete"),e(`
-Verification details:`),e(`  - Provider: ${I}`),e(`  - DNS records found: ${Z.length}`),e("  - Domain managed: Yes"),e(`  - SSL certificate: ${ie}`),oe)e(`  - Certificate ARN: ${oe}`);let ae=new Map;for(let be of Z){let Ae=ae.get(be.type)||0;ae.set(be.type,Ae+1)}if(ae.size>0){e(`
-Record summary:`);for(let[be,Ae]of ae)e(`  - ${be}: ${Ae}`)}}catch(k){r(`Failed to verify domain: ${k instanceof Error?k.message:String(k)}`)}}),R.command("dns:migrate <domain>","Migrate a whole zone from Route53 to Cloudflare").option("--account <id>","Cloudflare account id (defaults to CLOUDFLARE_ACCOUNT_ID)").option("--hosted-zone <id>","Route53 hosted zone id (auto-discovered when omitted)").option("--region <region>","AWS region for Route53",{default:"us-east-1"}).option("--apply","Write the records. Without it this is a dry run.").action(async(t,m)=>{i(`Zone migration: ${t} (Route53 → Cloudflare)`);let k=process.env.CLOUDFLARE_API_TOKEN;if(m?.apply&&!k){r("CLOUDFLARE_API_TOKEN is not set — required for --apply.");return}let I=m?.account??process.env.CLOUDFLARE_ACCOUNT_ID;try{let L=new F(m?.region||"us-east-1"),z=m?.hostedZone;if(!z){let de=await L.findHostedZoneForDomain(t);if(!de){r(`No Route53 hosted zone found for ${t}`);return}z=de.Id.replace("/hostedzone/","")}let Y=new s(`Exporting ${t} from Route53...`);Y.start();let Z=await Uo(L,z);Y.succeed(`Exported ${Z.length} record set(s) from ${z}`);let X=Bo(Z,t);e(`Planned ${X.records.length} record(s), skipped ${X.skipped.length}`);for(let de of X.skipped)e(`  - ${de.type} ${de.name}: ${de.reason}`);for(let de of X.warnings)a(`  ⚠ ${de}`);for(let de of X.records.filter((ke)=>ke.translatedFrom))e(`  ~ ${de.name} ${de.translatedFrom} → CNAME ${de.content}`);if(!m?.apply){e(""),e("Dry run — nothing was written. Re-run with --apply to migrate.");return}let ie=new he(k,{accountId:I}),oe=await ie.createZone(t,{accountId:I});n(oe.created?`Created Cloudflare zone ${oe.name} (${oe.id})`:`Using existing Cloudflare zone ${oe.name} (${oe.id})`);let ae=new s(`Importing ${X.records.length} record(s)...`);ae.start();let be=await Fo(ie,X);ae.succeed(`Imported ${be.applied.length} record(s)`);for(let de of be.failed)r(`  ✗ ${de.record.type} ${de.record.name}: ${de.message}`);let Ae=await jo(ie,X);if(Ae.ok)n(`Parity check passed — all ${Ae.matched.length} record(s) present at Cloudflare`);else{r(`Parity check FAILED — ${Ae.missing.length} record(s) missing or different:`);for(let de of Ae.missing)r(`  ✗ ${de.record.type} ${de.record.name} → ${de.record.content}${de.found?` (found: ${de.found})`:""}`);a("Do NOT move the nameservers until this is clean.");return}e(""),e("Nameservers to set at the registrar:");for(let de of oe.nameServers)e(`  ${de}`);e(""),e(`  cloud dns:nameservers ${t} --set ${oe.nameServers.join(",")}`)}catch(L){r(`Migration failed: ${L instanceof Error?L.message:String(L)}`)}}),R.command("dns:nameservers <domain>","Show or set the nameservers a domain is delegated to").option("--registrar <name>","Registrar: godaddy or porkbun").option("--set <nameservers>","Comma-separated nameservers to delegate to").action(async(t,m)=>{i(`Nameservers for ${t}`);let k=(m?.registrar||Fp())?.toLowerCase();if(!k){r("No registrar credentials found. Set GODADDY_PAT (or GODADDY_API_KEY/GODADDY_API_SECRET) or PORKBUN_API_KEY/PORKBUN_SECRET_KEY.");return}let I=k==="porkbun"?new ot(process.env.PORKBUN_API_KEY,process.env.PORKBUN_SECRET_KEY):new Gt(process.env.GODADDY_PAT||process.env.GODADDY_API_KEY,process.env.GODADDY_PAT?"":process.env.GODADDY_API_SECRET);try{let L=await I.getNameServers(t);e(`Current (${k}):`);for(let Z of L)e(`  ${Z}`);if(!m?.set)return;let z=m.set.split(",").map((Z)=>Z.trim()).filter(Boolean);if(z.length<2){r("At least two nameservers are required.");return}if(a(""),a("Changing nameservers moves authority for the ENTIRE zone — every"),a("record on it, including mail. Make sure the destination zone is"),a("already populated and parity-checked (cloud dns:migrate)."),await I.updateNameServers(t,z)){n(`Delegated ${t} to:`);for(let Z of z)n(`  ${Z}`);e("Propagation typically takes minutes to a few hours.")}else r("The registrar rejected the nameserver update.")}catch(L){r(`Failed: ${L instanceof Error?L.message:String(L)}`)}}),R.command("dns:records <domain>","List DNS records for a domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").option("--type <type>","Filter by record type (A, AAAA, CNAME, TXT, MX, etc.)").action(async(t,m)=>{i(`DNS Records for ${t}`);try{let k=Vr(m?.provider),I=bn(m?.provider)?.provider||"unknown",L=new s(`Fetching records from ${I}...`);L.start();let Y=(await k.listRecords(t)).records||[];if(L.succeed(`Found ${Y.length} record(s)`),m?.type){let X=m.type.toUpperCase();Y=Y.filter((ie)=>ie.type.toUpperCase()===X),e(`Filtered to ${Y.length} ${X} record(s)`)}if(Y.length===0){e("No records found");return}let Z=Y.map((X)=>[X.type,X.name||"@",X.content.length>50?`${X.content.substring(0,47)}...`:X.content,String(X.ttl||300)]);c(["Type","Name","Value","TTL"],Z)}catch(k){r(`Failed to list records: ${k instanceof Error?k.message:String(k)}`)}}),R.command("dns:add <domain> <type> <value>","Add DNS record").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").option("--name <name>","Record name (subdomain)",{default:"@"}).option("--ttl <seconds>","Time to live in seconds",{default:"300"}).action(async(t,m,k,I)=>{i("Adding DNS Record");try{let L=Vr(I?.provider),z=bn(I?.provider)?.provider||"unknown",Y=I?.name||"@",Z=Number.parseInt(I?.ttl||"300",10),X=m.toUpperCase();e(`Provider: ${z}`),e(`Domain: ${t}`),e(`Type: ${X}`),e(`Name: ${Y}`),e(`Value: ${k}`),e(`TTL: ${Z}`);let ie=new s(`Adding record via ${z}...`);ie.start();let oe=await L.createRecord(t,{type:X,name:Y==="@"?"":Y,content:k,ttl:Z});if(!oe.success){ie.fail("Failed to add DNS record"),r(oe.message||"DNS provider rejected the record");return}ie.succeed("DNS record added successfully"),n(`
+Certificate validation failed. Check ACM console for details.`)}catch(k){r(`Failed to generate SSL: ${k instanceof Error?k.message:String(k)}`)}}),R.command("domain:verify <domain>","Verify domain ownership and SSL status").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t,m)=>{i(`Verifying Domain: ${t}`);try{let k=_r(m?.provider),I=yn(m?.provider)?.provider||"unknown",L=new s("Checking domain ownership...");if(L.start(),!await k.canManageDomain(t)){L.fail("Domain not found in provider"),r(`Domain ${t} is not available in ${I}`);return}L.succeed("Domain ownership verified"),L.text="Fetching DNS records...",L.start();let Z=(await k.listRecords(t)).records||[];L.succeed(`Found ${Z.length} DNS record(s)`),L.text="Checking SSL certificate status...",L.start();let X=new K("us-east-1"),ee="Not found",oe="";try{let ke=(await X.listCertificates()).CertificateSummaryList.find((ce)=>ce.DomainName===t||ce.DomainName===`*.${t}`);if(ke)oe=ke.CertificateArn||"",ee=(await X.describeCertificate({CertificateArn:oe})).Status||"Unknown"}catch{}if(L.succeed("SSL check complete"),e(`
+Verification details:`),e(`  - Provider: ${I}`),e(`  - DNS records found: ${Z.length}`),e("  - Domain managed: Yes"),e(`  - SSL certificate: ${ee}`),oe)e(`  - Certificate ARN: ${oe}`);let se=new Map;for(let ue of Z){let ke=se.get(ue.type)||0;se.set(ue.type,ke+1)}if(se.size>0){e(`
+Record summary:`);for(let[ue,ke]of se)e(`  - ${ue}: ${ke}`)}}catch(k){r(`Failed to verify domain: ${k instanceof Error?k.message:String(k)}`)}}),R.command("dns:migrate <domain>","Migrate a whole zone from Route53 to Cloudflare").option("--account <id>","Cloudflare account id (defaults to CLOUDFLARE_ACCOUNT_ID)").option("--hosted-zone <id>","Route53 hosted zone id (auto-discovered when omitted)").option("--region <region>","AWS region for Route53",{default:"us-east-1"}).option("--apply","Write the records. Without it this is a dry run.").action(async(t,m)=>{i(`Zone migration: ${t} (Route53 → Cloudflare)`);let k=process.env.CLOUDFLARE_API_TOKEN;if(m?.apply&&!k){r("CLOUDFLARE_API_TOKEN is not set — required for --apply.");return}let I=m?.account??process.env.CLOUDFLARE_ACCOUNT_ID;try{let L=new F(m?.region||"us-east-1"),z=m?.hostedZone;if(!z){let ce=await L.findHostedZoneForDomain(t);if(!ce){r(`No Route53 hosted zone found for ${t}`);return}z=ce.Id.replace("/hostedzone/","")}let Y=new s(`Exporting ${t} from Route53...`);Y.start();let Z=await zo(L,z);Y.succeed(`Exported ${Z.length} record set(s) from ${z}`);let X=Ho(Z,t);e(`Planned ${X.records.length} record(s), skipped ${X.skipped.length}`);for(let ce of X.skipped)e(`  - ${ce.type} ${ce.name}: ${ce.reason}`);for(let ce of X.warnings)a(`  ⚠ ${ce}`);for(let ce of X.records.filter((Se)=>Se.translatedFrom))e(`  ~ ${ce.name} ${ce.translatedFrom} → CNAME ${ce.content}`);if(!m?.apply){e(""),e("Dry run — nothing was written. Re-run with --apply to migrate.");return}let ee=new ye(k,{accountId:I}),oe=await ee.createZone(t,{accountId:I});n(oe.created?`Created Cloudflare zone ${oe.name} (${oe.id})`:`Using existing Cloudflare zone ${oe.name} (${oe.id})`);let se=new s(`Importing ${X.records.length} record(s)...`);se.start();let ue=await Go(ee,X);se.succeed(`Imported ${ue.applied.length} record(s)`);for(let ce of ue.failed)r(`  ✗ ${ce.record.type} ${ce.record.name}: ${ce.message}`);let ke=await qo(ee,X);if(ke.ok)n(`Parity check passed — all ${ke.matched.length} record(s) present at Cloudflare`);else{r(`Parity check FAILED — ${ke.missing.length} record(s) missing or different:`);for(let ce of ke.missing)r(`  ✗ ${ce.record.type} ${ce.record.name} → ${ce.record.content}${ce.found?` (found: ${ce.found})`:""}`);a("Do NOT move the nameservers until this is clean.");return}e(""),e("Nameservers to set at the registrar:");for(let ce of oe.nameServers)e(`  ${ce}`);e(""),e(`  cloud dns:nameservers ${t} --set ${oe.nameServers.join(",")}`)}catch(L){r(`Migration failed: ${L instanceof Error?L.message:String(L)}`)}}),R.command("dns:nameservers <domain>","Show or set the nameservers a domain is delegated to").option("--registrar <name>","Registrar: godaddy or porkbun").option("--set <nameservers>","Comma-separated nameservers to delegate to").action(async(t,m)=>{i(`Nameservers for ${t}`);let k=(m?.registrar||Fp())?.toLowerCase();if(!k){r("No registrar credentials found. Set GODADDY_PAT (or GODADDY_API_KEY/GODADDY_API_SECRET) or PORKBUN_API_KEY/PORKBUN_SECRET_KEY.");return}let I=k==="porkbun"?new at(process.env.PORKBUN_API_KEY,process.env.PORKBUN_SECRET_KEY):new Wt(process.env.GODADDY_PAT||process.env.GODADDY_API_KEY,process.env.GODADDY_PAT?"":process.env.GODADDY_API_SECRET);try{let L=await I.getNameServers(t);e(`Current (${k}):`);for(let Z of L)e(`  ${Z}`);if(!m?.set)return;let z=m.set.split(",").map((Z)=>Z.trim()).filter(Boolean);if(z.length<2){r("At least two nameservers are required.");return}if(a(""),a("Changing nameservers moves authority for the ENTIRE zone — every"),a("record on it, including mail. Make sure the destination zone is"),a("already populated and parity-checked (cloud dns:migrate)."),await I.updateNameServers(t,z)){n(`Delegated ${t} to:`);for(let Z of z)n(`  ${Z}`);e("Propagation typically takes minutes to a few hours.")}else r("The registrar rejected the nameserver update.")}catch(L){r(`Failed: ${L instanceof Error?L.message:String(L)}`)}}),R.command("dns:records <domain>","List DNS records for a domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").option("--type <type>","Filter by record type (A, AAAA, CNAME, TXT, MX, etc.)").action(async(t,m)=>{i(`DNS Records for ${t}`);try{let k=_r(m?.provider),I=yn(m?.provider)?.provider||"unknown",L=new s(`Fetching records from ${I}...`);L.start();let Y=(await k.listRecords(t)).records||[];if(L.succeed(`Found ${Y.length} record(s)`),m?.type){let X=m.type.toUpperCase();Y=Y.filter((ee)=>ee.type.toUpperCase()===X),e(`Filtered to ${Y.length} ${X} record(s)`)}if(Y.length===0){e("No records found");return}let Z=Y.map((X)=>[X.type,X.name||"@",X.content.length>50?`${X.content.substring(0,47)}...`:X.content,String(X.ttl||300)]);c(["Type","Name","Value","TTL"],Z)}catch(k){r(`Failed to list records: ${k instanceof Error?k.message:String(k)}`)}}),R.command("dns:add <domain> <type> <value>","Add DNS record").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").option("--name <name>","Record name (subdomain)",{default:"@"}).option("--ttl <seconds>","Time to live in seconds",{default:"300"}).action(async(t,m,k,I)=>{i("Adding DNS Record");try{let L=_r(I?.provider),z=yn(I?.provider)?.provider||"unknown",Y=I?.name||"@",Z=Number.parseInt(I?.ttl||"300",10),X=m.toUpperCase();e(`Provider: ${z}`),e(`Domain: ${t}`),e(`Type: ${X}`),e(`Name: ${Y}`),e(`Value: ${k}`),e(`TTL: ${Z}`);let ee=new s(`Adding record via ${z}...`);ee.start();let oe=await L.createRecord(t,{type:X,name:Y==="@"?"":Y,content:k,ttl:Z});if(!oe.success){ee.fail("Failed to add DNS record"),r(oe.message||"DNS provider rejected the record");return}ee.succeed("DNS record added successfully"),n(`
 Record created!`),e(`
-Note: DNS changes may take a few minutes to propagate`)}catch(L){r(`Failed to add record: ${L instanceof Error?L.message:String(L)}`)}}),R.command("dns:delete <domain> <type>","Delete DNS record").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").option("--name <name>","Record name (subdomain)",{default:"@"}).option("--value <value>","Record value (required for multi-value records)").action(async(t,m,k)=>{i("Deleting DNS Record");try{let I=Vr(k?.provider),L=bn(k?.provider)?.provider||"unknown",z=k?.name||"@",Y=m.toUpperCase();e(`Provider: ${L}`),e(`Domain: ${t}`),e(`Type: ${Y}`),e(`Name: ${z}`);let Z=new s("Finding record...");Z.start();let oe=((await I.listRecords(t)).records||[]).filter((Ae)=>Ae.type.toUpperCase()===Y&&(Ae.name===z||Ae.name===""&&z==="@"));if(oe.length===0){Z.fail("No matching record found");return}if(oe.length>1&&!k?.value){Z.warn("Multiple records found"),e(`
-Please specify --value to identify which record to delete:`);for(let Ae of oe)e(`  - ${Ae.content}`);return}let ae=k?.value?oe.find((Ae)=>Ae.content===k.value)||oe[0]:oe[0];if(e(`Value: ${ae.content}`),!await d("Delete this record?",!1)){e("Deletion cancelled");return}Z.text=`Deleting record via ${L}...`,Z.start(),await I.deleteRecord(t,ae),Z.succeed("DNS record deleted successfully"),n(`
-Record deleted!`)}catch(I){r(`Failed to delete record: ${I instanceof Error?I.message:String(I)}`)}})}function Fp(){if(process.env.GODADDY_PAT)return"godaddy";if(process.env.GODADDY_API_KEY&&process.env.GODADDY_API_SECRET)return"godaddy";if(process.env.PORKBUN_API_KEY&&process.env.PORKBUN_SECRET_KEY)return"porkbun";return null}var Id=["postgres","mysql","mariadb","redis","mongodb","libsql"],Pd=["aws_rds","aws_aurora","aws_elasticache","server","container","external"],xd=["observe","connect","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"];async function jp(R,t){let m=await Ne(),k=y(process.cwd(),m),I=new ar(k.store),L=!R&&t?I.get(t)??I.list(k.project.id).find((de)=>de.name===t):void 0,z=L?.environmentId?k.store.listEnvironments(k.project.id).find((de)=>de.id===L.environmentId)?.slug:void 0,Y=R??z??Object.keys(m.environments??{})[0]??"production",Z=k.environments.get(Y);if(!Z)throw k.store.close(),Error(`Environment ${Y} was not found.`);let X=new S(k.store,{workerId:`cli:${process.pid}`}),ie=new cr(k.store,_(process.cwd())),oe=new Wr(I,X,ie),ae=k.store.getActorByExternalId("system","cli")??k.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"}),be=m.project?.region??"us-east-1",Ae={aws_rds:new Kn(new Zn(new fe(be))),aws_aurora:new Jn(new ei(new fe(be))),aws_elasticache:new Xn(new ti(new se(be))),server:new Qn(new dt),container:new Yn(new dt)};return{config:m,controlPlane:k,environmentRecord:Z,env:Y,store:I,queue:X,secrets:ie,lifecycle:oe,actor:ae,resolveAdapter:(de)=>Ae[de.provider]}}async function rr(R,t,m){let k=await jp(R,m);try{return await t(k)}finally{k.controlPlane.store.close()}}async function Tn(R){try{await R()}catch(t){r(t instanceof Error?t.message:String(t))}}function dc(R){if(!Id.includes(R))throw Error(`--engine must be ${Id.join(", ")}.`);return R}function uc(R){if(!Pd.includes(R))throw Error(`--provider must be ${Pd.join(", ")}.`);return R}function oo(R,t){let m=R.store.list(R.controlPlane.project.id,R.environmentRecord.id),k=R.store.get(t)??m.find((I)=>I.name===t);if(!k||k.environmentId!==R.environmentRecord.id)throw Error(`Data service ${t} was not found in ${R.env}.`);return k}function Dd(R){return R.map((t)=>[t.id,t.name,t.engine,t.provider,t.status,t.plan,t.publicExposure?"public allowlist":"private",t.managementEnabled?"managed":"read-only"])}function Bp(R,t){return R!==null&&typeof R==="object"&&!Array.isArray(R)&&R.serviceId===t}function _p(R){let t={};if(R.plan)t.plan=R.plan;if(R.storage!=null)t.storageGb=Number(R.storage);if(R.engineVersion)t.engineVersion=R.engineVersion;if(R.retention)t.retention=R.retention;if(R.confirm)t.confirm=R.confirm;if(R.backupId)t.backupId=R.backupId;if(R.compatibilityReviewed)t.compatibilityReviewed=!0;if(R.minCapacity!=null)t.minCapacity=Number(R.minCapacity);if(R.maxCapacity!=null)t.maxCapacity=Number(R.maxCapacity);if(R.public!=null)t.publicExposure=R.public;if(R.cidrs)t.allowedCidrs=R.cidrs.split(",").map((m)=>m.trim()).filter(Boolean);return t}function Ed(R){let t=typeof R.observedState.endpoint==="string"?R.observedState.endpoint:R.placement,m=Number(R.observedState.port)||(R.engine==="postgres"?5432:R.engine==="redis"?6379:R.engine==="mongodb"?27017:R.engine==="libsql"?8080:3306),k=typeof R.observedState.database==="string"?R.observedState.database:void 0;return[{type:R.publicExposure?"external":"internal",host:t,port:m,database:k,tls:typeof R.observedState.tls==="boolean"?R.observedState.tls:R.provider.startsWith("aws_")},{type:"tunnel",host:t,port:m,database:k,tls:typeof R.observedState.tls==="boolean"?R.observedState.tls:R.provider.startsWith("aws_")}]}function Td(R){R.option("--env <environment>","Target environment").option("--engine <engine>","postgres, mysql, mariadb, redis, mongodb, or libsql",{default:"postgres"}).option("--provider <provider>","aws_rds, aws_aurora, aws_elasticache, server, container, or external",{default:"aws_rds"}).option("--placement <id>","Provider identifier or runtime placement").option("--plan <plan>","Provider plan or instance type",{default:"db.t4g.micro"}).option("--engine-version <version>","Engine version").option("--storage <gb>","Allocated storage in GB",{default:"20"}).option("--username <name>","Generated credential username",{default:"app"}).option("--database <name>","Initial logical database").option("--subnet-group <name>","Private subnet group").option("--security-groups <ids>","Comma-separated security group IDs").option("--high-availability","Enable provider high availability").option("--public","Request a public endpoint; requires narrow --cidrs").option("--cidrs <ranges>","Comma-separated narrow public CIDRs")}function mc(R){R.command("data:list","List first-class databases and caches").option("--env <environment>","Target environment").option("--json","Print structured JSON").action((k)=>Tn(()=>rr(k.env,async(I)=>{let L=I.store.list(I.controlPlane.project.id,I.environmentRecord.id);if(k.json)e(JSON.stringify(L,null,2));else c(["ID","Name","Engine","Provider","Status","Plan","Exposure","Management"],Dd(L))}))),R.command("data:capabilities <engine> <provider>","Explain lifecycle support before taking action").action((k,I)=>Tn(async()=>{e(JSON.stringify(sr(dc(k),uc(I)),null,2))}));let t=R.command("data:create <name>","Provision an encrypted, private-by-default data service");Td(t),t.action((k,I)=>Tn(()=>rr(I.env,async(L)=>{let z=dc(I.engine),Y=uc(I.provider),Z=L.resolveAdapter({provider:Y});if(!Z||!Z.engines.includes(z))throw Error(`No ${Y}/${z} provisioning adapter is configured. Use data:adopt for read-only inventory.`);let X={...I.database?{database:I.database}:{},...I.subnetGroup?{subnetGroup:I.subnetGroup}:{},...I.securityGroups?{securityGroupIds:I.securityGroups.split(",").map((oe)=>oe.trim()).filter(Boolean)}:{}},ie=await L.lifecycle.create({organizationId:L.controlPlane.organization.id,projectId:L.controlPlane.project.id,environmentId:L.environmentRecord.id,name:k,engine:z,provider:Y,placement:I.placement??k,engineVersion:I.engineVersion,plan:I.plan??"db.t4g.micro",storageGb:Number(I.storage)||void 0,highAvailability:I.highAvailability===!0,publicExposure:I.public===!0,allowedCidrs:I.cidrs?I.cidrs.split(",").map((oe)=>oe.trim()).filter(Boolean):[],desiredState:X,observedState:{},origin:"managed",managementEnabled:!0,ownerActorId:L.actor.id,username:I.username});if(n(`Queued ${ie.service.name} as operation ${ie.operationId}.`),ie.credential)_r("One-time credential — copy it now:"),e(`Username: ${ie.credential.username}`),e(`Password: ${ie.credential.password}`),e(`Reference: ${ie.credential.secretRef}`)})));let m=R.command("data:adopt <name>","Adopt an existing provider resource as read-only inventory");Td(m),m.action((k,I)=>Tn(()=>rr(I.env,async(L)=>{let z=L.store.create({organizationId:L.controlPlane.organization.id,projectId:L.controlPlane.project.id,environmentId:L.environmentRecord.id,name:k,engine:dc(I.engine),provider:uc(I.provider),placement:I.placement??k,engineVersion:I.engineVersion,plan:I.plan??"external",storageGb:Number(I.storage)||void 0,highAvailability:I.highAvailability===!0,publicExposure:I.public===!0,allowedCidrs:I.cidrs?I.cidrs.split(",").map((Y)=>Y.trim()).filter(Boolean):[],desiredState:{},observedState:{},credentialRef:void 0,status:"adopted",origin:"adopted",managementEnabled:!1,ownerActorId:L.actor.id});n(`Adopted ${z.name} (${z.id}) read-only.`)}))),R.command("data:show <service>","Show safe service, capability, dependency, and operation metadata").option("--env <environment>","Target environment").option("--reveal","Reveal the encrypted credential with exact confirmation").option("--confirm <name>","Exact service name required with --reveal").action((k,I)=>Tn(()=>rr(I.env,async(L)=>{let z=oo(L,k),Y=L.store.credential(z.id),Z={...z,credentialRef:void 0,credential:Y?{configured:!0,username:Y.username,version:Y.version,rotatedAt:Y.rotatedAt}:void 0,dependencies:L.store.dependencies(z.id).map((X)=>({resourceId:X.resourceId,requiresRedeploy:X.requiresRedeploy})),operations:L.queue.list({projectId:z.projectId,limit:250}).filter((X)=>Bp(X.operation.input,z.id))};if(e(JSON.stringify(Z,null,2)),I.reveal){if(I.confirm!==z.name)throw Error(`Credential reveal requires --confirm ${z.name}.`);if(!Y)throw Error("No managed credential is configured.");_r("Credential value follows; it will not be logged or persisted by ts-cloud:"),e(`Username: ${Y.username}`),e(`Password: ${await L.secrets.resolve(Y.secretRef)}`)}},k))),R.command("data:connect <service>","Print secret-free connection and tunnel guidance").option("--env <environment>","Target environment").action((k,I)=>Tn(()=>rr(I.env,async(L)=>{let z=oo(L,k);c(["Type","Command","Credential reference"],Wn(z,Ed(z)).map((Y)=>[Y.type,Y.command,Y.secretRef??"—"]))},k))),R.command("data:action <service> <action>","Preview or enqueue a durable lifecycle action").option("--env <environment>","Target environment").option("--execute","Enqueue after validation; default is preview only").option("--plan <plan>","New provider plan").option("--storage <gb>","New storage allocation").option("--engine-version <version>","Target engine version").option("--min-capacity <acu>","Aurora minimum capacity").option("--max-capacity <acu>","Aurora maximum capacity").option("--public","Enable public exposure").option("--cidrs <ranges>","Comma-separated narrow public CIDRs").option("--retention <choice>","final_backup or retain for deletion").option("--confirm <name>","Exact service name for destructive actions").option("--backup-id <id>","Required backup for a major version change").option("--compatibility-reviewed","Confirm major-version compatibility review").action((k,I,L)=>Tn(()=>rr(L.env,async(z)=>{if(!xd.includes(I))throw Error(`Action must be ${xd.join(", ")}.`);let Y=oo(z,k),Z=I,X=_p(L),ie=z.lifecycle.plan(Y,Z,X);if(e(JSON.stringify({...ie,productionExecutionCreated:!1},null,2)),!L.execute)return;let oe=z.lifecycle.enqueue(Y,Z,X,z.actor.id);n(`Queued ${Z} as ${oe}.`)},k))),R.command("data:management <service>","Enable reviewed management of an adopted service").option("--env <environment>","Target environment").option("--confirm <name>","Exact service name").action((k,I)=>Tn(()=>rr(I.env,async(L)=>{let z=oo(L,k);if(z.origin!=="adopted"||I.confirm!==z.name)throw Error(`Enabling adopted management requires --confirm ${z.name}.`);let Y=L.store.update(z.id,z.version,{managementEnabled:!0});n(`${Y.name} management is enabled.`)},k))),R.command("data:dependency <service> <resource>","Register or remove an application credential dependency").option("--env <environment>","Target environment").option("--dynamic","Dependency consumes a dynamic reference and does not need redeploy").option("--remove","Remove the dependency").action((k,I,L)=>Tn(()=>rr(L.env,async(z)=>{let Y=oo(z,k),Z=z.controlPlane.store.listResources(z.controlPlane.project.id,z.environmentRecord.id).find((X)=>X.id===I||X.slug===I);if(!Z)throw Error(`Resource ${I} was not found in ${z.env}.`);if(L.remove){e(z.store.removeDependency(Y.id,Z.id)?"Dependency removed.":"Dependency was not registered.");return}z.store.addDependency({serviceId:Y.id,resourceId:Z.id,secretRef:Y.credentialRef??`secret://data-services/${Y.projectId}/${Y.name}`,requiresRedeploy:!L.dynamic}),n(`Registered dependency ${Z.slug} -> ${Y.name}.`)},k))),R.command("db:list","Alias for data:list").option("--env <environment>","Target environment").action((k)=>Tn(()=>rr(k.env,async(I)=>c(["ID","Name","Engine","Provider","Status","Plan","Exposure","Management"],Dd(I.store.list(I.controlPlane.project.id,I.environmentRecord.id)))))),R.command("db:connect <service>","Alias for data:connect").option("--env <environment>","Target environment").action((k,I)=>Tn(()=>rr(I.env,async(L)=>{let z=oo(L,k);c(["Type","Command","Credential reference"],Wn(z,Ed(z)).map((Y)=>[Y.type,Y.command,Y.secretRef??"—"]))},k)));for(let k of["backup","snapshot"])R.command(`db:${k} <service>`,`Alias for data:action ${k==="backup"?"backup":"backup"}`).option("--env <environment>","Target environment").option("--execute","Enqueue the backup; default previews").action((I,L)=>Tn(()=>rr(L.env,async(z)=>{let Y=oo(z,I),Z=z.lifecycle.plan(Y,"backup");if(e(JSON.stringify({...Z,productionExecutionCreated:!1},null,2)),L.execute)n(`Queued backup as ${z.lifecycle.enqueue(Y,"backup",{},z.actor.id)}.`)},I)))}function Nd(R,t=15){if(!R)return t*60000;let m=/^(\d+)\s*([smhd])?$/.exec(R.trim());if(!m)return t*60000;let k=Number(m[1]),I=m[2]??"m";return k*({s:1000,m:60000,h:3600000,d:86400000}[I]??60000)}function Mp(R,t){for(let m of R){let k=m.timestamp?new Date(m.timestamp).toISOString():"",I=t?`[${t}] `:"";e(`${k}  ${I}${(m.message??"").trimEnd()}`)}}function pc(R){R.command("logs","Stream serverless application logs (http + queue + cli)").option("--env <environment>","Environment (production, staging, development)",{default:"production"}).option("--function <which>","Which function: http | queue | cli | all",{default:"all"}).option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <duration>","Look back (e.g. 1h, 30m, 15)",{default:"15m"}).action(async(t)=>{try{let m=await Ne(),k=t?.env||"production",{region:I,functions:L}=Rt(m,k),z=new ce(I),Y=(t?.function??"all").toLowerCase();if(Y!=="all"&&!["http","queue","cli"].includes(Y)){r("--function must be one of: http, queue, cli, all"),process.exitCode=1;return}let X=(Y==="all"?["http","queue","cli"]:[Y]).map((ae)=>({mode:ae,group:`/aws/lambda/${L[ae]}`}));i(`Logs — ${m.project.slug} (${k})`);let ie=Date.now()-Nd(t?.since),oe=async()=>{let ae=ie;for(let{mode:be,group:Ae}of X)try{let{events:de=[]}=await z.filterLogEvents({logGroupName:Ae,startTime:ie,filterPattern:t?.filter,limit:200});Mp(de,X.length>1?be:void 0);for(let ke of de)if((ke.timestamp??0)>ae)ae=ke.timestamp??ae}catch(de){if(!/ResourceNotFound/i.test(String(de?.message)))throw de}ie=ae+1};if(await oe(),t?.tail){e(`
-(streaming — Ctrl+C to stop)`);for(;;)await new Promise((ae)=>setTimeout(ae,3000)),await oe()}}catch(m){r(`Failed to read logs: ${m.message}`),process.exitCode=1}}),R.command("metrics","Show serverless function metrics (invocations, errors, duration, throttles)").option("--env <environment>","Environment (production, staging, development)",{default:"production"}).option("--since <duration>","Window (e.g. 1h, 24h)",{default:"1h"}).action(async(t)=>{try{let m=await Ne(),k=t?.env||"production",{region:I,functions:L}=Rt(m,k),z=new q(I),Y=Nd(t?.since,60),Z=new Date,X=new Date(Z.getTime()-Y),ie=Math.max(60,Math.round(Y/1000));i(`Metrics — ${m.project.slug} (${k}), last ${t?.since??"1h"}`);let oe=[];for(let ae of["http","queue","cli"]){let be=[{Name:"FunctionName",Value:L[ae]}],Ae=async(ze,Le)=>{let Be=await z.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:ze,Dimensions:be,StartTime:X,EndTime:Z,Period:ie,Statistics:[Le]});if(!Be.length)return 0;if(Le==="Sum")return Be.reduce((Ve,ct)=>Ve+(ct.Sum??0),0);if(Le==="Maximum")return Math.max(...Be.map((Ve)=>Ve.Maximum??0));return Be.reduce((Ve,ct)=>Ve+(ct.Average??0),0)/Be.length},[de,ke,De,Se,Re]=await Promise.all([Ae("Invocations","Sum"),Ae("Errors","Sum"),Ae("Throttles","Sum"),Ae("Duration","Average"),Ae("Duration","Maximum")]),Pe=de?`${(ke/de*100).toFixed(2)}%`:"—";oe.push([ae,String(de),String(ke),Pe,String(De),`${Se.toFixed(0)}ms`,`${Re.toFixed(0)}ms`])}c(["Function","Invocations","Errors","Error rate","Throttles","Avg","Max"],oe)}catch(m){r(`Failed to read metrics: ${m.message}`),process.exitCode=1}}),R.command("metrics:dashboard","Print the CloudWatch console URL for this app").option("--env <environment>","Environment (production, staging, development)",{default:"production"}).action(async(t)=>{try{let m=await Ne(),k=t?.env||"production",{region:I,functions:L}=Rt(m,k),z=encodeURIComponent(JSON.stringify({metrics:["http","queue","cli"].flatMap((Y)=>[["AWS/Lambda","Invocations","FunctionName",L[Y]],["AWS/Lambda","Errors","FunctionName",L[Y]]]),view:"timeSeries",region:I}));i("CloudWatch dashboard"),e(`https://console.aws.amazon.com/cloudwatch/home?region=${I}#metricsV2:graph=${z}`)}catch(m){r(m.message),process.exitCode=1}}),R.command("alarms","List CloudWatch alarms").option("--prefix <prefix>","Filter by alarm name prefix").option("--region <region>","AWS region").action(async(t)=>{i("CloudWatch Alarms");let m=t?.region;if(!m)try{m=(await Ne()).project.region}catch{}try{let I=await new q(m||process.env.AWS_REGION||"us-east-1").describeAlarms({AlarmNamePrefix:t?.prefix,MaxRecords:100});if(!I.length){e("No alarms found");return}c(["Name","State","Metric","Condition"],I.map((L)=>[L.AlarmName??"-",L.StateValue??"-",L.MetricName??"-",`${L.ComparisonOperator??""} ${L.Threshold??""}`.trim()]))}catch(k){r(`Failed to list alarms: ${k.message}`),process.exitCode=1}}),R.command("alarms:create","Create a CloudWatch alarm on a Lambda metric").option("--name <name>","Alarm name").option("--env <environment>","Environment",{default:"production"}).option("--function <which>","Function: http | queue | cli",{default:"http"}).option("--metric <metric>","Lambda metric (Errors, Throttles, Duration, Invocations)",{default:"Errors"}).option("--threshold <value>","Threshold value").option("--comparison <op>","GreaterThanThreshold | GreaterThanOrEqualToThreshold | LessThanThreshold",{default:"GreaterThanThreshold"}).option("--statistic <stat>","Sum | Average | Maximum | Minimum",{default:"Sum"}).action(async(t)=>{if(i("Creating CloudWatch Alarm"),!t?.name||t?.threshold==null){r("Missing required options: --name and --threshold"),process.exitCode=1;return}try{let m=await Ne(),k=t.env||"production",{region:I,functions:L}=Rt(m,k),z=t.function??"http";await new q(I).putMetricAlarm({AlarmName:t.name,Namespace:"AWS/Lambda",MetricName:t.metric??"Errors",ComparisonOperator:t.comparison??"GreaterThanThreshold",Threshold:Number(t.threshold),EvaluationPeriods:1,Period:300,Statistic:t.statistic??"Sum",Dimensions:[{Name:"FunctionName",Value:L[z]}],AlarmDescription:`ts-cloud: ${L[z]} ${t.metric} ${t.comparison} ${t.threshold}`}),n(`Alarm '${t.name}' created on ${L[z]} ${t.metric}`)}catch(m){r(`Failed to create alarm: ${m.message}`),process.exitCode=1}})}async function qs(R){let t=await Ne(),m=R||"production";return{region:t.environments?.[m]?.region||t.project.region||"us-east-1",prefix:`${t.project.slug}/${m}`}}function vc(R){R.command("secrets:list","List secrets for an environment").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{i("Secrets");try{let{region:m,prefix:k}=await qs(t?.env),I=new J(m),{SecretList:L=[]}=await I.listSecrets({Filters:[{Key:"name",Values:[`${k}/`]}],MaxResults:100});if(!L.length){e(`No secrets found under ${k}/`);return}c(["Key","Last Changed"],L.map((z)=>[(z.Name??"").replace(`${k}/`,""),z.LastChangedDate??z.LastAccessedDate??"-"]))}catch(m){r(`Failed to list secrets: ${m.message}`),process.exitCode=1}}),R.command("secrets:set <key> <value>","Set (create or update) a secret").option("--env <environment>","Environment (production, staging, development)").action(async(t,m,k)=>{i(`Setting secret ${t}`);let{region:I,prefix:L}=await qs(k?.env),z=new J(I),Y=`${L}/${t}`,Z=new s("Storing secret...");Z.start();try{try{await z.putSecretValue({SecretId:Y,SecretString:m})}catch{await z.createSecret({Name:Y,SecretString:m})}Z.succeed(`Secret ${t} stored (${Y})`),a("Redeploy for the new value to take effect in running functions.")}catch(X){Z.fail(`Failed to store secret: ${X.message}`),process.exitCode=1}}),R.command("secrets:get <key>","Reveal a secret value").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let{region:k,prefix:I}=await qs(m?.env),z=await new J(k).getSecretValue({SecretId:`${I}/${t}`});e(z.SecretString??"")}catch(k){r(`Failed to read secret: ${k.message}`),process.exitCode=1}}),R.command("secrets:delete <key>","Delete a secret").option("--env <environment>","Environment (production, staging, development)").option("--force","Delete immediately without a recovery window").action(async(t,m)=>{try{let{region:k,prefix:I}=await qs(m?.env);await new J(k).deleteSecret({SecretId:`${I}/${t}`,ForceDeleteWithoutRecovery:m?.force}),n(`Secret ${t} deleted`)}catch(k){r(`Failed to delete secret: ${k.message}`),process.exitCode=1}})}function wc(R){for(let[t,m]of[["firewall:rules","List provider firewall policy"],["firewall:block <ip>","Block an address"],["firewall:unblock <ip>","Unblock an address"],["firewall:countries","Manage geographic policy"]])R.command(t,m).action(async(...k)=>En(t.split(" ")[0],{target:String(k[0]??""),message:"No reviewed WAF/IP-set adapter is configured for this legacy command.",nextAction:"Use server firewall configuration or install a provider adapter; no rule was changed."}))}function Cc(R){R.command("ssl:list","List all SSL certificates").option("--region <region>","AWS region (default: us-east-1)").action(async(t)=>{i("SSL Certificates");let m=t?.region||"us-east-1",k=new s("Fetching certificates from ACM...");k.start();try{let I=new K(m),L=await I.listCertificates();if(L.CertificateSummaryList.length===0){k.succeed("No certificates found"),e(`
-No SSL certificates found in region ${m}`),e("Use 'cloud domain:ssl <domain>' to request a new certificate");return}let z=await Promise.all(L.CertificateSummaryList.map(async(X)=>await I.describeCertificate({CertificateArn:X.CertificateArn})));k.succeed(`Found ${z.length} certificate(s)`);let Y=(X)=>{if(!X)return"N/A";let ie=typeof X==="string"?Number.parseFloat(X):X,oe=ie<1000000000000?ie*1000:ie;return new Date(oe).toISOString().split("T")[0]},Z=z.map((X)=>{let ie=Y(X.NotAfter),oe=X.Type==="AMAZON_ISSUED"?"Amazon Issued":X.Type||"Unknown",ae=X.Status==="ISSUED"?"Available":X.Status||"Unknown";return[X.DomainName,X.Status||"Unknown",ie,oe,ae]});c(["Domain","Status","Expiry","Type","State"],Z),e(`
+Note: DNS changes may take a few minutes to propagate`)}catch(L){r(`Failed to add record: ${L instanceof Error?L.message:String(L)}`)}}),R.command("dns:delete <domain> <type>","Delete DNS record").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").option("--name <name>","Record name (subdomain)",{default:"@"}).option("--value <value>","Record value (required for multi-value records)").action(async(t,m,k)=>{i("Deleting DNS Record");try{let I=_r(k?.provider),L=yn(k?.provider)?.provider||"unknown",z=k?.name||"@",Y=m.toUpperCase();e(`Provider: ${L}`),e(`Domain: ${t}`),e(`Type: ${Y}`),e(`Name: ${z}`);let Z=new s("Finding record...");Z.start();let oe=((await I.listRecords(t)).records||[]).filter((ke)=>ke.type.toUpperCase()===Y&&(ke.name===z||ke.name===""&&z==="@"));if(oe.length===0){Z.fail("No matching record found");return}if(oe.length>1&&!k?.value){Z.warn("Multiple records found"),e(`
+Please specify --value to identify which record to delete:`);for(let ke of oe)e(`  - ${ke.content}`);return}let se=k?.value?oe.find((ke)=>ke.content===k.value)||oe[0]:oe[0];if(e(`Value: ${se.content}`),!await d("Delete this record?",!1)){e("Deletion cancelled");return}Z.text=`Deleting record via ${L}...`,Z.start(),await I.deleteRecord(t,se),Z.succeed("DNS record deleted successfully"),n(`
+Record deleted!`)}catch(I){r(`Failed to delete record: ${I instanceof Error?I.message:String(I)}`)}})}function Fp(){if(process.env.GODADDY_PAT)return"godaddy";if(process.env.GODADDY_API_KEY&&process.env.GODADDY_API_SECRET)return"godaddy";if(process.env.PORKBUN_API_KEY&&process.env.PORKBUN_SECRET_KEY)return"porkbun";return null}var Id=["postgres","mysql","mariadb","redis","mongodb","libsql"],Pd=["aws_rds","aws_aurora","aws_elasticache","server","container","external"],xd=["observe","connect","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"];async function jp(R,t){let m=await De(),k=y(process.cwd(),m),I=new cr(k.store),L=!R&&t?I.get(t)??I.list(k.project.id).find((ce)=>ce.name===t):void 0,z=L?.environmentId?k.store.listEnvironments(k.project.id).find((ce)=>ce.id===L.environmentId)?.slug:void 0,Y=R??z??Object.keys(m.environments??{})[0]??"production",Z=k.environments.get(Y);if(!Z)throw k.store.close(),Error(`Environment ${Y} was not found.`);let X=new S(k.store,{workerId:`cli:${process.pid}`}),ee=new lr(k.store,_(process.cwd())),oe=new Kr(I,X,ee),se=k.store.getActorByExternalId("system","cli")??k.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"}),ue=m.project?.region??"us-east-1",ke={aws_rds:new Xn(new ti(new he(ue))),aws_aurora:new Qn(new ri(new he(ue))),aws_elasticache:new Yn(new ni(new ae(ue))),server:new Zn(new pt),container:new ei(new pt)};return{config:m,controlPlane:k,environmentRecord:Z,env:Y,store:I,queue:X,secrets:ee,lifecycle:oe,actor:se,resolveAdapter:(ce)=>ke[ce.provider]}}async function nr(R,t,m){let k=await jp(R,m);try{return await t(k)}finally{k.controlPlane.store.close()}}async function Dn(R){try{await R()}catch(t){r(t instanceof Error?t.message:String(t))}}function dc(R){if(!Id.includes(R))throw Error(`--engine must be ${Id.join(", ")}.`);return R}function uc(R){if(!Pd.includes(R))throw Error(`--provider must be ${Pd.join(", ")}.`);return R}function Xi(R,t){let m=R.store.list(R.controlPlane.project.id,R.environmentRecord.id),k=R.store.get(t)??m.find((I)=>I.name===t);if(!k||k.environmentId!==R.environmentRecord.id)throw Error(`Data service ${t} was not found in ${R.env}.`);return k}function Dd(R){return R.map((t)=>[t.id,t.name,t.engine,t.provider,t.status,t.plan,t.publicExposure?"public allowlist":"private",t.managementEnabled?"managed":"read-only"])}function Bp(R,t){return R!==null&&typeof R==="object"&&!Array.isArray(R)&&R.serviceId===t}function _p(R){let t={};if(R.plan)t.plan=R.plan;if(R.storage!=null)t.storageGb=Number(R.storage);if(R.engineVersion)t.engineVersion=R.engineVersion;if(R.retention)t.retention=R.retention;if(R.confirm)t.confirm=R.confirm;if(R.backupId)t.backupId=R.backupId;if(R.compatibilityReviewed)t.compatibilityReviewed=!0;if(R.minCapacity!=null)t.minCapacity=Number(R.minCapacity);if(R.maxCapacity!=null)t.maxCapacity=Number(R.maxCapacity);if(R.public!=null)t.publicExposure=R.public;if(R.cidrs)t.allowedCidrs=R.cidrs.split(",").map((m)=>m.trim()).filter(Boolean);return t}function Ed(R){let t=typeof R.observedState.endpoint==="string"?R.observedState.endpoint:R.placement,m=Number(R.observedState.port)||(R.engine==="postgres"?5432:R.engine==="redis"?6379:R.engine==="mongodb"?27017:R.engine==="libsql"?8080:3306),k=typeof R.observedState.database==="string"?R.observedState.database:void 0;return[{type:R.publicExposure?"external":"internal",host:t,port:m,database:k,tls:typeof R.observedState.tls==="boolean"?R.observedState.tls:R.provider.startsWith("aws_")},{type:"tunnel",host:t,port:m,database:k,tls:typeof R.observedState.tls==="boolean"?R.observedState.tls:R.provider.startsWith("aws_")}]}function Td(R){R.option("--env <environment>","Target environment").option("--engine <engine>","postgres, mysql, mariadb, redis, mongodb, or libsql",{default:"postgres"}).option("--provider <provider>","aws_rds, aws_aurora, aws_elasticache, server, container, or external",{default:"aws_rds"}).option("--placement <id>","Provider identifier or runtime placement").option("--plan <plan>","Provider plan or instance type",{default:"db.t4g.micro"}).option("--engine-version <version>","Engine version").option("--storage <gb>","Allocated storage in GB",{default:"20"}).option("--username <name>","Generated credential username",{default:"app"}).option("--database <name>","Initial logical database").option("--subnet-group <name>","Private subnet group").option("--security-groups <ids>","Comma-separated security group IDs").option("--high-availability","Enable provider high availability").option("--public","Request a public endpoint; requires narrow --cidrs").option("--cidrs <ranges>","Comma-separated narrow public CIDRs")}function mc(R){R.command("data:list","List first-class databases and caches").option("--env <environment>","Target environment").option("--json","Print structured JSON").action((k)=>Dn(()=>nr(k.env,async(I)=>{let L=I.store.list(I.controlPlane.project.id,I.environmentRecord.id);if(k.json)e(JSON.stringify(L,null,2));else c(["ID","Name","Engine","Provider","Status","Plan","Exposure","Management"],Dd(L))}))),R.command("data:capabilities <engine> <provider>","Explain lifecycle support before taking action").action((k,I)=>Dn(async()=>{e(JSON.stringify(ar(dc(k),uc(I)),null,2))}));let t=R.command("data:create <name>","Provision an encrypted, private-by-default data service");Td(t),t.action((k,I)=>Dn(()=>nr(I.env,async(L)=>{let z=dc(I.engine),Y=uc(I.provider),Z=L.resolveAdapter({provider:Y});if(!Z||!Z.engines.includes(z))throw Error(`No ${Y}/${z} provisioning adapter is configured. Use data:adopt for read-only inventory.`);let X={...I.database?{database:I.database}:{},...I.subnetGroup?{subnetGroup:I.subnetGroup}:{},...I.securityGroups?{securityGroupIds:I.securityGroups.split(",").map((oe)=>oe.trim()).filter(Boolean)}:{}},ee=await L.lifecycle.create({organizationId:L.controlPlane.organization.id,projectId:L.controlPlane.project.id,environmentId:L.environmentRecord.id,name:k,engine:z,provider:Y,placement:I.placement??k,engineVersion:I.engineVersion,plan:I.plan??"db.t4g.micro",storageGb:Number(I.storage)||void 0,highAvailability:I.highAvailability===!0,publicExposure:I.public===!0,allowedCidrs:I.cidrs?I.cidrs.split(",").map((oe)=>oe.trim()).filter(Boolean):[],desiredState:X,observedState:{},origin:"managed",managementEnabled:!0,ownerActorId:L.actor.id,username:I.username});if(n(`Queued ${ee.service.name} as operation ${ee.operationId}.`),ee.credential)Or("One-time credential — copy it now:"),e(`Username: ${ee.credential.username}`),e(`Password: ${ee.credential.password}`),e(`Reference: ${ee.credential.secretRef}`)})));let m=R.command("data:adopt <name>","Adopt an existing provider resource as read-only inventory");Td(m),m.action((k,I)=>Dn(()=>nr(I.env,async(L)=>{let z=L.store.create({organizationId:L.controlPlane.organization.id,projectId:L.controlPlane.project.id,environmentId:L.environmentRecord.id,name:k,engine:dc(I.engine),provider:uc(I.provider),placement:I.placement??k,engineVersion:I.engineVersion,plan:I.plan??"external",storageGb:Number(I.storage)||void 0,highAvailability:I.highAvailability===!0,publicExposure:I.public===!0,allowedCidrs:I.cidrs?I.cidrs.split(",").map((Y)=>Y.trim()).filter(Boolean):[],desiredState:{},observedState:{},credentialRef:void 0,status:"adopted",origin:"adopted",managementEnabled:!1,ownerActorId:L.actor.id});n(`Adopted ${z.name} (${z.id}) read-only.`)}))),R.command("data:show <service>","Show safe service, capability, dependency, and operation metadata").option("--env <environment>","Target environment").option("--reveal","Reveal the encrypted credential with exact confirmation").option("--confirm <name>","Exact service name required with --reveal").action((k,I)=>Dn(()=>nr(I.env,async(L)=>{let z=Xi(L,k),Y=L.store.credential(z.id),Z={...z,credentialRef:void 0,credential:Y?{configured:!0,username:Y.username,version:Y.version,rotatedAt:Y.rotatedAt}:void 0,dependencies:L.store.dependencies(z.id).map((X)=>({resourceId:X.resourceId,requiresRedeploy:X.requiresRedeploy})),operations:L.queue.list({projectId:z.projectId,limit:250}).filter((X)=>Bp(X.operation.input,z.id))};if(e(JSON.stringify(Z,null,2)),I.reveal){if(I.confirm!==z.name)throw Error(`Credential reveal requires --confirm ${z.name}.`);if(!Y)throw Error("No managed credential is configured.");Or("Credential value follows; it will not be logged or persisted by ts-cloud:"),e(`Username: ${Y.username}`),e(`Password: ${await L.secrets.resolve(Y.secretRef)}`)}},k))),R.command("data:connect <service>","Print secret-free connection and tunnel guidance").option("--env <environment>","Target environment").action((k,I)=>Dn(()=>nr(I.env,async(L)=>{let z=Xi(L,k);c(["Type","Command","Credential reference"],Jn(z,Ed(z)).map((Y)=>[Y.type,Y.command,Y.secretRef??"—"]))},k))),R.command("data:action <service> <action>","Preview or enqueue a durable lifecycle action").option("--env <environment>","Target environment").option("--execute","Enqueue after validation; default is preview only").option("--plan <plan>","New provider plan").option("--storage <gb>","New storage allocation").option("--engine-version <version>","Target engine version").option("--min-capacity <acu>","Aurora minimum capacity").option("--max-capacity <acu>","Aurora maximum capacity").option("--public","Enable public exposure").option("--cidrs <ranges>","Comma-separated narrow public CIDRs").option("--retention <choice>","final_backup or retain for deletion").option("--confirm <name>","Exact service name for destructive actions").option("--backup-id <id>","Required backup for a major version change").option("--compatibility-reviewed","Confirm major-version compatibility review").action((k,I,L)=>Dn(()=>nr(L.env,async(z)=>{if(!xd.includes(I))throw Error(`Action must be ${xd.join(", ")}.`);let Y=Xi(z,k),Z=I,X=_p(L),ee=z.lifecycle.plan(Y,Z,X);if(e(JSON.stringify({...ee,productionExecutionCreated:!1},null,2)),!L.execute)return;let oe=z.lifecycle.enqueue(Y,Z,X,z.actor.id);n(`Queued ${Z} as ${oe}.`)},k))),R.command("data:management <service>","Enable reviewed management of an adopted service").option("--env <environment>","Target environment").option("--confirm <name>","Exact service name").action((k,I)=>Dn(()=>nr(I.env,async(L)=>{let z=Xi(L,k);if(z.origin!=="adopted"||I.confirm!==z.name)throw Error(`Enabling adopted management requires --confirm ${z.name}.`);let Y=L.store.update(z.id,z.version,{managementEnabled:!0});n(`${Y.name} management is enabled.`)},k))),R.command("data:dependency <service> <resource>","Register or remove an application credential dependency").option("--env <environment>","Target environment").option("--dynamic","Dependency consumes a dynamic reference and does not need redeploy").option("--remove","Remove the dependency").action((k,I,L)=>Dn(()=>nr(L.env,async(z)=>{let Y=Xi(z,k),Z=z.controlPlane.store.listResources(z.controlPlane.project.id,z.environmentRecord.id).find((X)=>X.id===I||X.slug===I);if(!Z)throw Error(`Resource ${I} was not found in ${z.env}.`);if(L.remove){e(z.store.removeDependency(Y.id,Z.id)?"Dependency removed.":"Dependency was not registered.");return}z.store.addDependency({serviceId:Y.id,resourceId:Z.id,secretRef:Y.credentialRef??`secret://data-services/${Y.projectId}/${Y.name}`,requiresRedeploy:!L.dynamic}),n(`Registered dependency ${Z.slug} -> ${Y.name}.`)},k))),R.command("db:list","Alias for data:list").option("--env <environment>","Target environment").action((k)=>Dn(()=>nr(k.env,async(I)=>c(["ID","Name","Engine","Provider","Status","Plan","Exposure","Management"],Dd(I.store.list(I.controlPlane.project.id,I.environmentRecord.id)))))),R.command("db:connect <service>","Alias for data:connect").option("--env <environment>","Target environment").action((k,I)=>Dn(()=>nr(I.env,async(L)=>{let z=Xi(L,k);c(["Type","Command","Credential reference"],Jn(z,Ed(z)).map((Y)=>[Y.type,Y.command,Y.secretRef??"—"]))},k)));for(let k of["backup","snapshot"])R.command(`db:${k} <service>`,`Alias for data:action ${k==="backup"?"backup":"backup"}`).option("--env <environment>","Target environment").option("--execute","Enqueue the backup; default previews").action((I,L)=>Dn(()=>nr(L.env,async(z)=>{let Y=Xi(z,I),Z=z.lifecycle.plan(Y,"backup");if(e(JSON.stringify({...Z,productionExecutionCreated:!1},null,2)),L.execute)n(`Queued backup as ${z.lifecycle.enqueue(Y,"backup",{},z.actor.id)}.`)},I)))}function Nd(R,t=15){if(!R)return t*60000;let m=/^(\d+)\s*([smhd])?$/.exec(R.trim());if(!m)return t*60000;let k=Number(m[1]),I=m[2]??"m";return k*({s:1000,m:60000,h:3600000,d:86400000}[I]??60000)}function Mp(R,t){for(let m of R){let k=m.timestamp?new Date(m.timestamp).toISOString():"",I=t?`[${t}] `:"";e(`${k}  ${I}${(m.message??"").trimEnd()}`)}}function pc(R){R.command("logs","Stream serverless application logs (http + queue + cli)").option("--env <environment>","Environment (production, staging, development)",{default:"production"}).option("--function <which>","Which function: http | queue | cli | all",{default:"all"}).option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <duration>","Look back (e.g. 1h, 30m, 15)",{default:"15m"}).action(async(t)=>{try{let m=await De(),k=t?.env||"production",{region:I,functions:L}=Pt(m,k),z=new le(I),Y=(t?.function??"all").toLowerCase();if(Y!=="all"&&!["http","queue","cli"].includes(Y)){r("--function must be one of: http, queue, cli, all"),process.exitCode=1;return}let X=(Y==="all"?["http","queue","cli"]:[Y]).map((se)=>({mode:se,group:`/aws/lambda/${L[se]}`}));i(`Logs — ${m.project.slug} (${k})`);let ee=Date.now()-Nd(t?.since),oe=async()=>{let se=ee;for(let{mode:ue,group:ke}of X)try{let{events:ce=[]}=await z.filterLogEvents({logGroupName:ke,startTime:ee,filterPattern:t?.filter,limit:200});Mp(ce,X.length>1?ue:void 0);for(let Se of ce)if((Se.timestamp??0)>se)se=Se.timestamp??se}catch(ce){if(!/ResourceNotFound/i.test(String(ce?.message)))throw ce}ee=se+1};if(await oe(),t?.tail){e(`
+(streaming — Ctrl+C to stop)`);for(;;)await new Promise((se)=>setTimeout(se,3000)),await oe()}}catch(m){r(`Failed to read logs: ${m.message}`),process.exitCode=1}}),R.command("metrics","Show serverless function metrics (invocations, errors, duration, throttles)").option("--env <environment>","Environment (production, staging, development)",{default:"production"}).option("--since <duration>","Window (e.g. 1h, 24h)",{default:"1h"}).action(async(t)=>{try{let m=await De(),k=t?.env||"production",{region:I,functions:L}=Pt(m,k),z=new q(I),Y=Nd(t?.since,60),Z=new Date,X=new Date(Z.getTime()-Y),ee=Math.max(60,Math.round(Y/1000));i(`Metrics — ${m.project.slug} (${k}), last ${t?.since??"1h"}`);let oe=[];for(let se of["http","queue","cli"]){let ue=[{Name:"FunctionName",Value:L[se]}],ke=async(Me,Ne)=>{let Fe=await z.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:Me,Dimensions:ue,StartTime:X,EndTime:Z,Period:ee,Statistics:[Ne]});if(!Fe.length)return 0;if(Ne==="Sum")return Fe.reduce((ze,ot)=>ze+(ot.Sum??0),0);if(Ne==="Maximum")return Math.max(...Fe.map((ze)=>ze.Maximum??0));return Fe.reduce((ze,ot)=>ze+(ot.Average??0),0)/Fe.length},[ce,Se,xe,ve,Re]=await Promise.all([ke("Invocations","Sum"),ke("Errors","Sum"),ke("Throttles","Sum"),ke("Duration","Average"),ke("Duration","Maximum")]),Ie=ce?`${(Se/ce*100).toFixed(2)}%`:"—";oe.push([se,String(ce),String(Se),Ie,String(xe),`${ve.toFixed(0)}ms`,`${Re.toFixed(0)}ms`])}c(["Function","Invocations","Errors","Error rate","Throttles","Avg","Max"],oe)}catch(m){r(`Failed to read metrics: ${m.message}`),process.exitCode=1}}),R.command("metrics:dashboard","Print the CloudWatch console URL for this app").option("--env <environment>","Environment (production, staging, development)",{default:"production"}).action(async(t)=>{try{let m=await De(),k=t?.env||"production",{region:I,functions:L}=Pt(m,k),z=encodeURIComponent(JSON.stringify({metrics:["http","queue","cli"].flatMap((Y)=>[["AWS/Lambda","Invocations","FunctionName",L[Y]],["AWS/Lambda","Errors","FunctionName",L[Y]]]),view:"timeSeries",region:I}));i("CloudWatch dashboard"),e(`https://console.aws.amazon.com/cloudwatch/home?region=${I}#metricsV2:graph=${z}`)}catch(m){r(m.message),process.exitCode=1}}),R.command("alarms","List CloudWatch alarms").option("--prefix <prefix>","Filter by alarm name prefix").option("--region <region>","AWS region").action(async(t)=>{i("CloudWatch Alarms");let m=t?.region;if(!m)try{m=(await De()).project.region}catch{}try{let I=await new q(m||process.env.AWS_REGION||"us-east-1").describeAlarms({AlarmNamePrefix:t?.prefix,MaxRecords:100});if(!I.length){e("No alarms found");return}c(["Name","State","Metric","Condition"],I.map((L)=>[L.AlarmName??"-",L.StateValue??"-",L.MetricName??"-",`${L.ComparisonOperator??""} ${L.Threshold??""}`.trim()]))}catch(k){r(`Failed to list alarms: ${k.message}`),process.exitCode=1}}),R.command("alarms:create","Create a CloudWatch alarm on a Lambda metric").option("--name <name>","Alarm name").option("--env <environment>","Environment",{default:"production"}).option("--function <which>","Function: http | queue | cli",{default:"http"}).option("--metric <metric>","Lambda metric (Errors, Throttles, Duration, Invocations)",{default:"Errors"}).option("--threshold <value>","Threshold value").option("--comparison <op>","GreaterThanThreshold | GreaterThanOrEqualToThreshold | LessThanThreshold",{default:"GreaterThanThreshold"}).option("--statistic <stat>","Sum | Average | Maximum | Minimum",{default:"Sum"}).action(async(t)=>{if(i("Creating CloudWatch Alarm"),!t?.name||t?.threshold==null){r("Missing required options: --name and --threshold"),process.exitCode=1;return}try{let m=await De(),k=t.env||"production",{region:I,functions:L}=Pt(m,k),z=t.function??"http";await new q(I).putMetricAlarm({AlarmName:t.name,Namespace:"AWS/Lambda",MetricName:t.metric??"Errors",ComparisonOperator:t.comparison??"GreaterThanThreshold",Threshold:Number(t.threshold),EvaluationPeriods:1,Period:300,Statistic:t.statistic??"Sum",Dimensions:[{Name:"FunctionName",Value:L[z]}],AlarmDescription:`ts-cloud: ${L[z]} ${t.metric} ${t.comparison} ${t.threshold}`}),n(`Alarm '${t.name}' created on ${L[z]} ${t.metric}`)}catch(m){r(`Failed to create alarm: ${m.message}`),process.exitCode=1}})}async function Ms(R){let t=await De(),m=R||"production";return{region:t.environments?.[m]?.region||t.project.region||"us-east-1",prefix:`${t.project.slug}/${m}`}}function fc(R){R.command("secrets:list","List secrets for an environment").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{i("Secrets");try{let{region:m,prefix:k}=await Ms(t?.env),I=new J(m),{SecretList:L=[]}=await I.listSecrets({Filters:[{Key:"name",Values:[`${k}/`]}],MaxResults:100});if(!L.length){e(`No secrets found under ${k}/`);return}c(["Key","Last Changed"],L.map((z)=>[(z.Name??"").replace(`${k}/`,""),z.LastChangedDate??z.LastAccessedDate??"-"]))}catch(m){r(`Failed to list secrets: ${m.message}`),process.exitCode=1}}),R.command("secrets:set <key> <value>","Set (create or update) a secret").option("--env <environment>","Environment (production, staging, development)").action(async(t,m,k)=>{i(`Setting secret ${t}`);let{region:I,prefix:L}=await Ms(k?.env),z=new J(I),Y=`${L}/${t}`,Z=new s("Storing secret...");Z.start();try{try{await z.putSecretValue({SecretId:Y,SecretString:m})}catch{await z.createSecret({Name:Y,SecretString:m})}Z.succeed(`Secret ${t} stored (${Y})`),a("Redeploy for the new value to take effect in running functions.")}catch(X){Z.fail(`Failed to store secret: ${X.message}`),process.exitCode=1}}),R.command("secrets:get <key>","Reveal a secret value").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let{region:k,prefix:I}=await Ms(m?.env),z=await new J(k).getSecretValue({SecretId:`${I}/${t}`});e(z.SecretString??"")}catch(k){r(`Failed to read secret: ${k.message}`),process.exitCode=1}}),R.command("secrets:delete <key>","Delete a secret").option("--env <environment>","Environment (production, staging, development)").option("--force","Delete immediately without a recovery window").action(async(t,m)=>{try{let{region:k,prefix:I}=await Ms(m?.env);await new J(k).deleteSecret({SecretId:`${I}/${t}`,ForceDeleteWithoutRecovery:m?.force}),n(`Secret ${t} deleted`)}catch(k){r(`Failed to delete secret: ${k.message}`),process.exitCode=1}})}function gc(R){for(let[t,m]of[["firewall:rules","List provider firewall policy"],["firewall:block <ip>","Block an address"],["firewall:unblock <ip>","Unblock an address"],["firewall:countries","Manage geographic policy"]])R.command(t,m).action(async(...k)=>xn(t.split(" ")[0],{target:String(k[0]??""),message:"No reviewed WAF/IP-set adapter is configured for this legacy command.",nextAction:"Use server firewall configuration or install a provider adapter; no rule was changed."}))}function hc(R){R.command("ssl:list","List all SSL certificates").option("--region <region>","AWS region (default: us-east-1)").action(async(t)=>{i("SSL Certificates");let m=t?.region||"us-east-1",k=new s("Fetching certificates from ACM...");k.start();try{let I=new K(m),L=await I.listCertificates();if(L.CertificateSummaryList.length===0){k.succeed("No certificates found"),e(`
+No SSL certificates found in region ${m}`),e("Use 'cloud domain:ssl <domain>' to request a new certificate");return}let z=await Promise.all(L.CertificateSummaryList.map(async(X)=>await I.describeCertificate({CertificateArn:X.CertificateArn})));k.succeed(`Found ${z.length} certificate(s)`);let Y=(X)=>{if(!X)return"N/A";let ee=typeof X==="string"?Number.parseFloat(X):X,oe=ee<1000000000000?ee*1000:ee;return new Date(oe).toISOString().split("T")[0]},Z=z.map((X)=>{let ee=Y(X.NotAfter),oe=X.Type==="AMAZON_ISSUED"?"Amazon Issued":X.Type||"Unknown",se=X.Status==="ISSUED"?"Available":X.Status||"Unknown";return[X.DomainName,X.Status||"Unknown",ee,oe,se]});c(["Domain","Status","Expiry","Type","State"],Z),e(`
 ACM certificates are automatically renewed by AWS`),e(`Region: ${m}`)}catch(I){k.fail("Failed to fetch certificates"),r(I.message)}}),R.command("ssl:renew <domain>","Renew SSL certificate").option("--region <region>","AWS region (default: us-east-1)").action(async(t,m)=>{i(`Checking SSL Certificate for ${t}`);let k=m?.region||"us-east-1";e(`Domain: ${t}`),e(`Region: ${k}`);let I=new s("Checking certificate status...");I.start();try{let z=await new K(k).findCertificateByDomain(t);if(!z){I.fail("Certificate not found"),r(`No certificate found for domain: ${t}`),e("Use 'cloud domain:ssl <domain>' to request a new certificate");return}I.succeed("Certificate found"),e(`
 Certificate is managed by AWS Certificate Manager`),e("ACM certificates are automatically renewed 60 days before expiry"),a(`
-No manual renewal needed for ACM certificates`);let Y=(ie)=>{if(!ie)return"N/A";let oe=typeof ie==="string"?Number.parseFloat(ie):ie,ae=oe<1000000000000?oe*1000:oe;return new Date(ae).toISOString().split("T")[0]},Z=Y(z.NotAfter),X=Y(z.IssuedAt);if(e(`
-Certificate details:`),e(`  - Domain: ${z.DomainName}`),e(`  - Status: ${z.Status}`),e(`  - Issued: ${X}`),e(`  - Expiry: ${Z}`),e(`  - Type: ${z.Type||"Unknown"}`),e(`  - ARN: ${z.CertificateArn}`),e(`  - Auto-renewal: ${z.Type==="AMAZON_ISSUED"?"Enabled":"N/A (imported)"}`),z.SubjectAlternativeNames&&z.SubjectAlternativeNames.length>1)e(`  - SANs: ${z.SubjectAlternativeNames.join(", ")}`)}catch(L){I.fail("Failed to check certificate"),r(L.message)}})}function qi(R){return R.toISOString().slice(0,10)}function Od(R){return new Date(Date.UTC(R.getUTCFullYear(),R.getUTCMonth(),R.getUTCDate()))}function Ld(R=new Date){let t=Od(R),m=new Date(Date.UTC(t.getUTCFullYear(),t.getUTCMonth(),1)),k=new Date(t.getTime()+86400000),I=new Date(Date.UTC(t.getUTCFullYear(),t.getUTCMonth()+1,1)),L=m,z=new Date(Date.UTC(t.getUTCFullYear(),t.getUTCMonth()-1,1));return{start:qi(m),end:qi(k),label:m.toLocaleString("en-US",{month:"long",year:"numeric",timeZone:"UTC"}),daysElapsed:t.getUTCDate(),daysInMonth:Math.round((I.getTime()-m.getTime())/86400000),previous:{start:qi(z),end:qi(L),label:z.toLocaleString("en-US",{month:"long",year:"numeric",timeZone:"UTC"})}}}function Po(R,t=new Date){if(!Number.isInteger(R)||R<1||R>366)throw Error("days must be an integer from 1 to 366");let m=new Date(Od(t).getTime()+86400000),k=new Date(m.getTime()-R*86400000),I=new Date(k.getTime()-R*86400000);return{current:{start:qi(k),end:qi(m),label:`last ${R} days`},previous:{start:qi(I),end:qi(k),label:`previous ${R} days`}}}function $c(R,t,m){return t>0?R/t*m:0}function ms(R,t){if(t===0)return R===0?0:null;return(R-t)/t*100}function kc(R,t){let m=new Map(t.map((k)=>[k.service,k.amount]));return R.map((k)=>{let I=m.get(k.service)??0;return{...k,previousAmount:I,changePercent:ms(k.amount,I)}})}var zp=/(?:data.?transfer|natgateway.*bytes|aws-(?:in|out)-bytes|regional-bytes|inter.?az|internet)/i;function Hs(R){return R.filter((t)=>zp.test(t.key)).sort((t,m)=>m.amount-t.amount)}function xo(R){if(R==null)return[];return Array.isArray(R)?R:[R]}function ao(R,t={}){let[,,m="unknown",k="",I="",L=R]=R.split(":"),z=L.includes("/")?"/":":",[Y=m,...Z]=L.split(z),X=Z.join(z)||L;return{arn:R,service:m,type:Y,id:X,name:t.Name||t.name||X,region:k||void 0,accountId:I||void 0,tags:t,metadata:{}}}function Up(R,t){if(!t)return!0;let m=t.toLowerCase().replace(/^aws[:/]/,"");return[R.service,R.type,`${R.service}:${R.type}`].some((k)=>k.toLowerCase()===m||k.toLowerCase().includes(m))}function Wp(R,t){let m=new Map;for(let k of R){let I=`${k.service}:${k.type}:${k.id}`,L=m.get(I);m.set(I,L?{...L,...k,arn:L.accountId?L.arn:k.arn,accountId:L.accountId??k.accountId,tags:{...L.tags,...k.tags},metadata:{...L.metadata,...k.metadata}}:k)}return[...m.values()].filter((k)=>Up(k,t)).sort((k,I)=>k.service.localeCompare(I.service)||k.name.localeCompare(I.name)||k.arn.localeCompare(I.arn))}class fs{client;profile;region;constructor(R,t=process.env.AWS_REGION||"us-east-1"){this.profile=R,this.region=t,this.client=new p(It(R))}async taggedResources(){let R=[],t;do{let m=await this.client.request({service:"tagging",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"ResourceGroupsTaggingAPI_20170126.GetResources"},body:JSON.stringify(t?{PaginationToken:t}:{})});for(let k of m?.ResourceTagMappingList??[]){let I=Object.fromEntries((k.Tags??[]).map((L)=>[String(L.Key),String(L.Value)]));R.push(ao(String(k.ResourceARN),I))}t=m?.PaginationToken||void 0}while(t);return R}async ec2Resources(){let R=async(L)=>this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({Action:L,Version:"2016-11-15"}).toString()}),[t,m,k]=await Promise.all([R("DescribeInstances"),R("DescribeVolumes"),R("DescribeAddresses")]),I=[];for(let L of xo(t?.reservationSet?.item))for(let z of xo(L?.instancesSet?.item)){let Y=String(z.instanceId);I.push({...ao(`arn:aws:ec2:${this.region}::instance/${Y}`),state:z.instanceState?.name,metadata:{instanceType:z.instanceType}})}for(let L of xo(m?.volumeSet?.item)){let z=String(L.volumeId);I.push({...ao(`arn:aws:ec2:${this.region}::volume/${z}`),state:L.status,metadata:{sizeGiB:Number(L.size??0),attached:xo(L.attachmentSet?.item).length>0}})}for(let L of xo(k?.addressesSet?.item)){let z=String(L.allocationId??L.publicIp);I.push({...ao(`arn:aws:ec2:${this.region}::elastic-ip/${z}`),state:L.associationId?"associated":"available",metadata:{associated:Boolean(L.associationId),publicIp:L.publicIp}})}return I}async rdsResources(){let R=new URLSearchParams({Action:"DescribeDBInstances",Version:"2014-10-31"}).toString(),t=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-www-form-urlencoded"},body:R}),m=t?.DescribeDBInstancesResult??t;return xo(m?.DBInstances?.DBInstance).map((k)=>({...ao(k.DBInstanceArn||`arn:aws:rds:${this.region}::db:${String(k.DBInstanceIdentifier)}`),state:k.DBInstanceStatus,metadata:{engine:k.Engine,instanceClass:k.DBInstanceClass}}))}async lambdaResources(){let R=[],t;do{let m=await this.client.request({service:"lambda",region:this.region,method:"GET",path:"/2015-03-31/functions",queryParams:t?{Marker:t}:void 0});for(let k of m?.Functions??[])R.push({...ao(k.FunctionArn),state:k.State,metadata:{runtime:k.Runtime,memoryMiB:Number(k.MemorySize??0)}});t=m?.NextMarker||void 0}while(t);return R}async s3Resources(){return(await new g("us-east-1",this.profile).listBuckets()).Buckets.map((t)=>({...ao(`arn:aws:s3:::${t.Name}`),metadata:{creationDate:t.CreationDate}}))}async discover(R){let t=[["tagging:GetResources",()=>this.taggedResources()],["ec2:Describe*",()=>this.ec2Resources()],["rds:DescribeDBInstances",()=>this.rdsResources()],["lambda:ListFunctions",()=>this.lambdaResources()],["s3:ListAllMyBuckets",()=>this.s3Resources()]],m=await Promise.allSettled(t.map(([,L])=>L())),k=[],I=[];return m.forEach((L,z)=>{if(L.status==="fulfilled")k.push(...L.value);else I.push(`${t[z][0]} unavailable: ${L.reason instanceof Error?L.reason.message:String(L.reason)}`)}),{resources:Wp(k,R?.type),warnings:I}}}function hs(R,t){if(R==null)return{currentCost:null,projectedCost:null,monthlySavings:null};let m=R*t;return{currentCost:R,projectedCost:R-m,monthlySavings:m}}function Fd(R,t,m,k=!1){let I=Ac(R,t,m);if(I)return[{category:"unused",resource:R,recommendation:I.recommendation,sourceSignal:I.signal,...hs(m,1)}];if((R.service==="ec2"&&R.type==="instance"||R.service==="rds"&&R.type==="db")&&t.cpuAverage!=null&&t.cpuAverage<20)return[{category:"right-size",resource:R,recommendation:"Validate memory, network, and peak demand, then test one smaller instance class.",sourceSignal:`${R.service.toUpperCase()} 30-day average CPU ${t.cpuAverage.toFixed(1)}% (<20%)`,...hs(m,0.4)}];if(k&&(R.service==="ec2"&&R.type==="instance"&&R.state==="running"||R.service==="rds"&&R.type==="db"&&R.state==="available")&&t.cpuAverage!=null&&t.cpuAverage>=20)return[{category:"commitment",resource:R,recommendation:"Compare a one-year no-upfront commitment against this steady workload before purchasing.",sourceSignal:`${R.service.toUpperCase()} remained active with 30-day average CPU ${t.cpuAverage.toFixed(1)}%`,...hs(m,0.3)}];if(R.service==="s3"&&t.storageBytes!=null&&t.storageBytes>=5368709120&&t.requests!=null&&t.requests<9000){let L=t.storageBytes/1073741824;return[{category:"storage",resource:R,recommendation:"Review object age and retrieval needs, then add Intelligent-Tiering or Glacier lifecycle rules.",sourceSignal:`${L.toFixed(1)} GiB stored with ${t.requests.toFixed(0)} requests over 90 days`,...hs(m,0.25)}]}return[]}function Vp(R,t){if(R<=0||t.length===0)return null;return{category:"cdn",resource:{arn:"arn:aws:cloudfront::account:distribution/account-wide",service:"cloudfront",type:"distribution",id:"account-wide",name:"account-wide transfer",tags:{},metadata:{}},recommendation:"Enable compression and review cache policies, TTLs, and origin cache headers for high-transfer paths.",sourceSignal:`30-day Cost Explorer transfer line items: ${t.slice(0,3).join(", ")}`,...hs(R,0.2)}}function qp(R){let t=R.map((m)=>m.Average).filter((m)=>m!=null);return t.length>0?t.reduce((m,k)=>m+k,0)/t.length:void 0}function Hp(R){let t=R.map((m)=>m.Sum).filter((m)=>m!=null);return t.length>0?t.reduce((m,k)=>m+k,0):void 0}function Ac(R,t,m=null){if(R.service==="ec2"&&R.type==="volume"&&R.metadata.attached===!1)return{resource:R,signal:"EBS volume is detached",recommendation:"Snapshot if needed, then delete the detached volume.",monthlySavings:m};if(R.service==="ec2"&&R.type==="elastic-ip"&&R.metadata.associated===!1)return{resource:R,signal:"Elastic IP is not associated",recommendation:"Release the unassociated Elastic IP.",monthlySavings:m};if(R.service==="ec2"&&R.type==="instance"&&t.cpuAverage!=null&&t.cpuAverage<5)return{resource:R,signal:`30-day average CPU ${t.cpuAverage.toFixed(1)}% (<5%)`,recommendation:"Stop/delete if unused, or right-size after validating memory and network demand.",monthlySavings:m};if(R.service==="rds"&&R.type==="db"&&t.connectionsAverage!=null&&t.iopsAverage!=null&&t.connectionsAverage===0&&t.iopsAverage<1)return{resource:R,signal:`14-day connections 0 and average IOPS ${t.iopsAverage.toFixed(2)} (<1)`,recommendation:"Take a final snapshot, validate ownership, then stop or delete the database.",monthlySavings:m};if(R.service==="lambda"&&R.type==="function"&&t.invocations===0)return{resource:R,signal:"30-day invocations 0",recommendation:"Confirm no event source depends on it, then remove the function.",monthlySavings:m};if(R.service==="s3"&&t.objectCount===0&&t.requests===0)return{resource:R,signal:"Bucket is empty with zero requests over 90 days",recommendation:"Confirm retention policy, then delete the empty bucket.",monthlySavings:m};if(R.service==="elasticache"&&t.connectionsAverage!=null&&t.cacheHitRate!=null&&t.connectionsAverage===0&&t.cacheHitRate<20)return{resource:R,signal:`14-day connections 0 and cache hit rate ${t.cacheHitRate.toFixed(1)}%`,recommendation:"Validate clients and snapshots, then delete the idle cache cluster.",monthlySavings:m};return null}class Gs{inventory;costs;profile;region;constructor(R,t=process.env.AWS_REGION||"us-east-1"){this.profile=R,this.region=t,this.inventory=new fs(R,t),this.costs=new Ye(R)}async metric(R,t,m,k,I,L,z,Y=[]){let Z=new Date,X=new Date(Z.getTime()-L*24*60*60*1000),ie=await R.getMetricStatistics({Namespace:m,MetricName:k,Dimensions:[{Name:I,Value:t.id},...Y],StartTime:X,EndTime:Z,Period:86400,Statistics:[z]});return z==="Sum"?Hp(ie):qp(ie)}async signals(R){let t=new q(R.region??this.region,this.profile);if(R.service==="ec2"&&R.type==="instance")return{cpuAverage:await this.metric(t,R,"AWS/EC2","CPUUtilization","InstanceId",30,"Average")};if(R.service==="rds"&&R.type==="db"){let[m,k,I,L]=await Promise.all([this.metric(t,R,"AWS/RDS","CPUUtilization","DBInstanceIdentifier",30,"Average"),this.metric(t,R,"AWS/RDS","DatabaseConnections","DBInstanceIdentifier",14,"Average"),this.metric(t,R,"AWS/RDS","ReadIOPS","DBInstanceIdentifier",14,"Average"),this.metric(t,R,"AWS/RDS","WriteIOPS","DBInstanceIdentifier",14,"Average")]);return{cpuAverage:m,connectionsAverage:k,iopsAverage:I!=null&&L!=null?I+L:void 0}}if(R.service==="lambda"&&R.type==="function")return{invocations:await this.metric(t,R,"AWS/Lambda","Invocations","FunctionName",30,"Sum")};if(R.service==="s3"){let[m,k,I]=await Promise.all([this.metric(t,R,"AWS/S3","NumberOfObjects","BucketName",90,"Average",[{Name:"StorageType",Value:"AllStorageTypes"}]),this.metric(t,R,"AWS/S3","AllRequests","BucketName",90,"Sum"),this.metric(t,R,"AWS/S3","BucketSizeBytes","BucketName",90,"Average",[{Name:"StorageType",Value:"StandardStorage"}])]);return{objectCount:m,requests:k,storageBytes:I}}if(R.service==="elasticache"&&R.type.includes("cluster")){let[m,k]=await Promise.all([this.metric(t,R,"AWS/ElastiCache","CurrConnections","CacheClusterId",14,"Average"),this.metric(t,R,"AWS/ElastiCache","CacheHitRate","CacheClusterId",14,"Average")]);return{connectionsAverage:m,cacheHitRate:k}}return{}}async resourceCosts(){try{let R=Po(30).current,t=await this.costs.getCostByDimension({start:R.start,end:R.end,dimension:"RESOURCE_ID",granularity:"DAILY"});return new Map(t.map((m)=>[m.key,m.amount]))}catch{return new Map}}resourceCost(R,t){return R.get(t.id)??R.get(t.arn)??null}async cloudFrontTransfer(){try{let R=Po(30).current,t=await this.costs.getCostByDimension({start:R.start,end:R.end,dimension:"USAGE_TYPE",granularity:"DAILY",filter:{Dimensions:{Key:"SERVICE",Values:["Amazon CloudFront"]}}}),m=Hs(t);return{cost:m.reduce((k,I)=>k+I.amount,0),usageTypes:m.map((k)=>k.key)}}catch{return{cost:0,usageTypes:[]}}}async unused(R){let[t,m]=await Promise.all([this.inventory.discover(R),this.resourceCosts()]),k=(await Promise.all(t.resources.map(async(I)=>{let L=this.resourceCost(m,I),z=Ac(I,{},L);if(z)return z;try{return Ac(I,await this.signals(I),L)}catch{return null}}))).filter((I)=>I!==null);return{findings:k,inventory:t,savingsAvailable:k.some((I)=>I.monthlySavings!=null)}}async optimize(R){let t=!R?.type||["cloudfront","cdn"].includes(R.type.toLowerCase()),[m,k,I]=await Promise.all([this.inventory.discover({type:R?.type}),this.resourceCosts(),t?this.cloudFrontTransfer():Promise.resolve({cost:0,usageTypes:[]})]),L=[],z=[...m.warnings];for(let Z of m.resources){let X=this.resourceCost(k,Z),ie=Fd(Z,{},X,R?.includeCommitments);if(ie.length>0){L.push(...ie);continue}try{L.push(...Fd(Z,await this.signals(Z),X,R?.includeCommitments))}catch(oe){z.push(`CloudWatch metrics unavailable for ${Z.service}:${Z.type}/${Z.name}: ${oe instanceof Error?oe.message:String(oe)}`)}}let Y=Vp(I.cost,I.usageTypes);if(Y)L.push(Y);return L.sort((Z,X)=>(X.monthlySavings??-1)-(Z.monthlySavings??-1)||Z.category.localeCompare(X.category)||Z.resource.name.localeCompare(X.resource.name)),{recommendations:L,inventory:m,savingsAvailable:L.some((Z)=>Z.monthlySavings!=null),warnings:z}}}var Rc="Amazon Simple Storage Service";function Gp(){let R=new Date,t=new Date(Date.UTC(R.getUTCFullYear(),R.getUTCMonth(),1)),m=new Date(t);m.setUTCMonth(m.getUTCMonth()-1);let k=(L)=>L.toISOString().slice(0,10),I=m.toLocaleString("en-US",{month:"long",year:"numeric",timeZone:"UTC"});return{start:k(m),end:k(t),label:I}}function fn(R){return`$${R.toFixed(2)}`}function Ks(R){if(R===null)return"new";if(Math.abs(R)<0.05)return"→ 0.0%";return`${R>0?"↑":"↓"} ${Math.abs(R).toFixed(1)}%`}function Ic(R){r(`Cost Explorer request failed: ${R instanceof Error?R.message:String(R)}`),e(`
+No manual renewal needed for ACM certificates`);let Y=(ee)=>{if(!ee)return"N/A";let oe=typeof ee==="string"?Number.parseFloat(ee):ee,se=oe<1000000000000?oe*1000:oe;return new Date(se).toISOString().split("T")[0]},Z=Y(z.NotAfter),X=Y(z.IssuedAt);if(e(`
+Certificate details:`),e(`  - Domain: ${z.DomainName}`),e(`  - Status: ${z.Status}`),e(`  - Issued: ${X}`),e(`  - Expiry: ${Z}`),e(`  - Type: ${z.Type||"Unknown"}`),e(`  - ARN: ${z.CertificateArn}`),e(`  - Auto-renewal: ${z.Type==="AMAZON_ISSUED"?"Enabled":"N/A (imported)"}`),z.SubjectAlternativeNames&&z.SubjectAlternativeNames.length>1)e(`  - SANs: ${z.SubjectAlternativeNames.join(", ")}`)}catch(L){I.fail("Failed to check certificate"),r(L.message)}})}function Wi(R){return R.toISOString().slice(0,10)}function Od(R){return new Date(Date.UTC(R.getUTCFullYear(),R.getUTCMonth(),R.getUTCDate()))}function Ld(R=new Date){let t=Od(R),m=new Date(Date.UTC(t.getUTCFullYear(),t.getUTCMonth(),1)),k=new Date(t.getTime()+86400000),I=new Date(Date.UTC(t.getUTCFullYear(),t.getUTCMonth()+1,1)),L=m,z=new Date(Date.UTC(t.getUTCFullYear(),t.getUTCMonth()-1,1));return{start:Wi(m),end:Wi(k),label:m.toLocaleString("en-US",{month:"long",year:"numeric",timeZone:"UTC"}),daysElapsed:t.getUTCDate(),daysInMonth:Math.round((I.getTime()-m.getTime())/86400000),previous:{start:Wi(z),end:Wi(L),label:z.toLocaleString("en-US",{month:"long",year:"numeric",timeZone:"UTC"})}}}function $o(R,t=new Date){if(!Number.isInteger(R)||R<1||R>366)throw Error("days must be an integer from 1 to 366");let m=new Date(Od(t).getTime()+86400000),k=new Date(m.getTime()-R*86400000),I=new Date(k.getTime()-R*86400000);return{current:{start:Wi(k),end:Wi(m),label:`last ${R} days`},previous:{start:Wi(I),end:Wi(k),label:`previous ${R} days`}}}function yc(R,t,m){return t>0?R/t*m:0}function ds(R,t){if(t===0)return R===0?0:null;return(R-t)/t*100}function vc(R,t){let m=new Map(t.map((k)=>[k.service,k.amount]));return R.map((k)=>{let I=m.get(k.service)??0;return{...k,previousAmount:I,changePercent:ds(k.amount,I)}})}var zp=/(?:data.?transfer|natgateway.*bytes|aws-(?:in|out)-bytes|regional-bytes|inter.?az|internet)/i;function Us(R){return R.filter((t)=>zp.test(t.key)).sort((t,m)=>m.amount-t.amount)}function ko(R){if(R==null)return[];return Array.isArray(R)?R:[R]}function eo(R,t={}){let[,,m="unknown",k="",I="",L=R]=R.split(":"),z=L.includes("/")?"/":":",[Y=m,...Z]=L.split(z),X=Z.join(z)||L;return{arn:R,service:m,type:Y,id:X,name:t.Name||t.name||X,region:k||void 0,accountId:I||void 0,tags:t,metadata:{}}}function Up(R,t){if(!t)return!0;let m=t.toLowerCase().replace(/^aws[:/]/,"");return[R.service,R.type,`${R.service}:${R.type}`].some((k)=>k.toLowerCase()===m||k.toLowerCase().includes(m))}function Wp(R,t){let m=new Map;for(let k of R){let I=`${k.service}:${k.type}:${k.id}`,L=m.get(I);m.set(I,L?{...L,...k,arn:L.accountId?L.arn:k.arn,accountId:L.accountId??k.accountId,tags:{...L.tags,...k.tags},metadata:{...L.metadata,...k.metadata}}:k)}return[...m.values()].filter((k)=>Up(k,t)).sort((k,I)=>k.service.localeCompare(I.service)||k.name.localeCompare(I.name)||k.arn.localeCompare(I.arn))}class us{client;profile;region;constructor(R,t=process.env.AWS_REGION||"us-east-1"){this.profile=R,this.region=t,this.client=new p(Dt(R))}async taggedResources(){let R=[],t;do{let m=await this.client.request({service:"tagging",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"ResourceGroupsTaggingAPI_20170126.GetResources"},body:JSON.stringify(t?{PaginationToken:t}:{})});for(let k of m?.ResourceTagMappingList??[]){let I=Object.fromEntries((k.Tags??[]).map((L)=>[String(L.Key),String(L.Value)]));R.push(eo(String(k.ResourceARN),I))}t=m?.PaginationToken||void 0}while(t);return R}async ec2Resources(){let R=async(L)=>this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({Action:L,Version:"2016-11-15"}).toString()}),[t,m,k]=await Promise.all([R("DescribeInstances"),R("DescribeVolumes"),R("DescribeAddresses")]),I=[];for(let L of ko(t?.reservationSet?.item))for(let z of ko(L?.instancesSet?.item)){let Y=String(z.instanceId);I.push({...eo(`arn:aws:ec2:${this.region}::instance/${Y}`),state:z.instanceState?.name,metadata:{instanceType:z.instanceType}})}for(let L of ko(m?.volumeSet?.item)){let z=String(L.volumeId);I.push({...eo(`arn:aws:ec2:${this.region}::volume/${z}`),state:L.status,metadata:{sizeGiB:Number(L.size??0),attached:ko(L.attachmentSet?.item).length>0}})}for(let L of ko(k?.addressesSet?.item)){let z=String(L.allocationId??L.publicIp);I.push({...eo(`arn:aws:ec2:${this.region}::elastic-ip/${z}`),state:L.associationId?"associated":"available",metadata:{associated:Boolean(L.associationId),publicIp:L.publicIp}})}return I}async rdsResources(){let R=new URLSearchParams({Action:"DescribeDBInstances",Version:"2014-10-31"}).toString(),t=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-www-form-urlencoded"},body:R}),m=t?.DescribeDBInstancesResult??t;return ko(m?.DBInstances?.DBInstance).map((k)=>({...eo(k.DBInstanceArn||`arn:aws:rds:${this.region}::db:${String(k.DBInstanceIdentifier)}`),state:k.DBInstanceStatus,metadata:{engine:k.Engine,instanceClass:k.DBInstanceClass}}))}async lambdaResources(){let R=[],t;do{let m=await this.client.request({service:"lambda",region:this.region,method:"GET",path:"/2015-03-31/functions",queryParams:t?{Marker:t}:void 0});for(let k of m?.Functions??[])R.push({...eo(k.FunctionArn),state:k.State,metadata:{runtime:k.Runtime,memoryMiB:Number(k.MemorySize??0)}});t=m?.NextMarker||void 0}while(t);return R}async s3Resources(){return(await new g("us-east-1",this.profile).listBuckets()).Buckets.map((t)=>({...eo(`arn:aws:s3:::${t.Name}`),metadata:{creationDate:t.CreationDate}}))}async discover(R){let t=[["tagging:GetResources",()=>this.taggedResources()],["ec2:Describe*",()=>this.ec2Resources()],["rds:DescribeDBInstances",()=>this.rdsResources()],["lambda:ListFunctions",()=>this.lambdaResources()],["s3:ListAllMyBuckets",()=>this.s3Resources()]],m=await Promise.allSettled(t.map(([,L])=>L())),k=[],I=[];return m.forEach((L,z)=>{if(L.status==="fulfilled")k.push(...L.value);else I.push(`${t[z][0]} unavailable: ${L.reason instanceof Error?L.reason.message:String(L.reason)}`)}),{resources:Wp(k,R?.type),warnings:I}}}function ms(R,t){if(R==null)return{currentCost:null,projectedCost:null,monthlySavings:null};let m=R*t;return{currentCost:R,projectedCost:R-m,monthlySavings:m}}function Fd(R,t,m,k=!1){let I=bc(R,t,m);if(I)return[{category:"unused",resource:R,recommendation:I.recommendation,sourceSignal:I.signal,...ms(m,1)}];if((R.service==="ec2"&&R.type==="instance"||R.service==="rds"&&R.type==="db")&&t.cpuAverage!=null&&t.cpuAverage<20)return[{category:"right-size",resource:R,recommendation:"Validate memory, network, and peak demand, then test one smaller instance class.",sourceSignal:`${R.service.toUpperCase()} 30-day average CPU ${t.cpuAverage.toFixed(1)}% (<20%)`,...ms(m,0.4)}];if(k&&(R.service==="ec2"&&R.type==="instance"&&R.state==="running"||R.service==="rds"&&R.type==="db"&&R.state==="available")&&t.cpuAverage!=null&&t.cpuAverage>=20)return[{category:"commitment",resource:R,recommendation:"Compare a one-year no-upfront commitment against this steady workload before purchasing.",sourceSignal:`${R.service.toUpperCase()} remained active with 30-day average CPU ${t.cpuAverage.toFixed(1)}%`,...ms(m,0.3)}];if(R.service==="s3"&&t.storageBytes!=null&&t.storageBytes>=5368709120&&t.requests!=null&&t.requests<9000){let L=t.storageBytes/1073741824;return[{category:"storage",resource:R,recommendation:"Review object age and retrieval needs, then add Intelligent-Tiering or Glacier lifecycle rules.",sourceSignal:`${L.toFixed(1)} GiB stored with ${t.requests.toFixed(0)} requests over 90 days`,...ms(m,0.25)}]}return[]}function Vp(R,t){if(R<=0||t.length===0)return null;return{category:"cdn",resource:{arn:"arn:aws:cloudfront::account:distribution/account-wide",service:"cloudfront",type:"distribution",id:"account-wide",name:"account-wide transfer",tags:{},metadata:{}},recommendation:"Enable compression and review cache policies, TTLs, and origin cache headers for high-transfer paths.",sourceSignal:`30-day Cost Explorer transfer line items: ${t.slice(0,3).join(", ")}`,...ms(R,0.2)}}function qp(R){let t=R.map((m)=>m.Average).filter((m)=>m!=null);return t.length>0?t.reduce((m,k)=>m+k,0)/t.length:void 0}function Hp(R){let t=R.map((m)=>m.Sum).filter((m)=>m!=null);return t.length>0?t.reduce((m,k)=>m+k,0):void 0}function bc(R,t,m=null){if(R.service==="ec2"&&R.type==="volume"&&R.metadata.attached===!1)return{resource:R,signal:"EBS volume is detached",recommendation:"Snapshot if needed, then delete the detached volume.",monthlySavings:m};if(R.service==="ec2"&&R.type==="elastic-ip"&&R.metadata.associated===!1)return{resource:R,signal:"Elastic IP is not associated",recommendation:"Release the unassociated Elastic IP.",monthlySavings:m};if(R.service==="ec2"&&R.type==="instance"&&t.cpuAverage!=null&&t.cpuAverage<5)return{resource:R,signal:`30-day average CPU ${t.cpuAverage.toFixed(1)}% (<5%)`,recommendation:"Stop/delete if unused, or right-size after validating memory and network demand.",monthlySavings:m};if(R.service==="rds"&&R.type==="db"&&t.connectionsAverage!=null&&t.iopsAverage!=null&&t.connectionsAverage===0&&t.iopsAverage<1)return{resource:R,signal:`14-day connections 0 and average IOPS ${t.iopsAverage.toFixed(2)} (<1)`,recommendation:"Take a final snapshot, validate ownership, then stop or delete the database.",monthlySavings:m};if(R.service==="lambda"&&R.type==="function"&&t.invocations===0)return{resource:R,signal:"30-day invocations 0",recommendation:"Confirm no event source depends on it, then remove the function.",monthlySavings:m};if(R.service==="s3"&&t.objectCount===0&&t.requests===0)return{resource:R,signal:"Bucket is empty with zero requests over 90 days",recommendation:"Confirm retention policy, then delete the empty bucket.",monthlySavings:m};if(R.service==="elasticache"&&t.connectionsAverage!=null&&t.cacheHitRate!=null&&t.connectionsAverage===0&&t.cacheHitRate<20)return{resource:R,signal:`14-day connections 0 and cache hit rate ${t.cacheHitRate.toFixed(1)}%`,recommendation:"Validate clients and snapshots, then delete the idle cache cluster.",monthlySavings:m};return null}class Ws{inventory;costs;profile;region;constructor(R,t=process.env.AWS_REGION||"us-east-1"){this.profile=R,this.region=t,this.inventory=new us(R,t),this.costs=new et(R)}async metric(R,t,m,k,I,L,z,Y=[]){let Z=new Date,X=new Date(Z.getTime()-L*24*60*60*1000),ee=await R.getMetricStatistics({Namespace:m,MetricName:k,Dimensions:[{Name:I,Value:t.id},...Y],StartTime:X,EndTime:Z,Period:86400,Statistics:[z]});return z==="Sum"?Hp(ee):qp(ee)}async signals(R){let t=new q(R.region??this.region,this.profile);if(R.service==="ec2"&&R.type==="instance")return{cpuAverage:await this.metric(t,R,"AWS/EC2","CPUUtilization","InstanceId",30,"Average")};if(R.service==="rds"&&R.type==="db"){let[m,k,I,L]=await Promise.all([this.metric(t,R,"AWS/RDS","CPUUtilization","DBInstanceIdentifier",30,"Average"),this.metric(t,R,"AWS/RDS","DatabaseConnections","DBInstanceIdentifier",14,"Average"),this.metric(t,R,"AWS/RDS","ReadIOPS","DBInstanceIdentifier",14,"Average"),this.metric(t,R,"AWS/RDS","WriteIOPS","DBInstanceIdentifier",14,"Average")]);return{cpuAverage:m,connectionsAverage:k,iopsAverage:I!=null&&L!=null?I+L:void 0}}if(R.service==="lambda"&&R.type==="function")return{invocations:await this.metric(t,R,"AWS/Lambda","Invocations","FunctionName",30,"Sum")};if(R.service==="s3"){let[m,k,I]=await Promise.all([this.metric(t,R,"AWS/S3","NumberOfObjects","BucketName",90,"Average",[{Name:"StorageType",Value:"AllStorageTypes"}]),this.metric(t,R,"AWS/S3","AllRequests","BucketName",90,"Sum"),this.metric(t,R,"AWS/S3","BucketSizeBytes","BucketName",90,"Average",[{Name:"StorageType",Value:"StandardStorage"}])]);return{objectCount:m,requests:k,storageBytes:I}}if(R.service==="elasticache"&&R.type.includes("cluster")){let[m,k]=await Promise.all([this.metric(t,R,"AWS/ElastiCache","CurrConnections","CacheClusterId",14,"Average"),this.metric(t,R,"AWS/ElastiCache","CacheHitRate","CacheClusterId",14,"Average")]);return{connectionsAverage:m,cacheHitRate:k}}return{}}async resourceCosts(){try{let R=$o(30).current,t=await this.costs.getCostByDimension({start:R.start,end:R.end,dimension:"RESOURCE_ID",granularity:"DAILY"});return new Map(t.map((m)=>[m.key,m.amount]))}catch{return new Map}}resourceCost(R,t){return R.get(t.id)??R.get(t.arn)??null}async cloudFrontTransfer(){try{let R=$o(30).current,t=await this.costs.getCostByDimension({start:R.start,end:R.end,dimension:"USAGE_TYPE",granularity:"DAILY",filter:{Dimensions:{Key:"SERVICE",Values:["Amazon CloudFront"]}}}),m=Us(t);return{cost:m.reduce((k,I)=>k+I.amount,0),usageTypes:m.map((k)=>k.key)}}catch{return{cost:0,usageTypes:[]}}}async unused(R){let[t,m]=await Promise.all([this.inventory.discover(R),this.resourceCosts()]),k=(await Promise.all(t.resources.map(async(I)=>{let L=this.resourceCost(m,I),z=bc(I,{},L);if(z)return z;try{return bc(I,await this.signals(I),L)}catch{return null}}))).filter((I)=>I!==null);return{findings:k,inventory:t,savingsAvailable:k.some((I)=>I.monthlySavings!=null)}}async optimize(R){let t=!R?.type||["cloudfront","cdn"].includes(R.type.toLowerCase()),[m,k,I]=await Promise.all([this.inventory.discover({type:R?.type}),this.resourceCosts(),t?this.cloudFrontTransfer():Promise.resolve({cost:0,usageTypes:[]})]),L=[],z=[...m.warnings];for(let Z of m.resources){let X=this.resourceCost(k,Z),ee=Fd(Z,{},X,R?.includeCommitments);if(ee.length>0){L.push(...ee);continue}try{L.push(...Fd(Z,await this.signals(Z),X,R?.includeCommitments))}catch(oe){z.push(`CloudWatch metrics unavailable for ${Z.service}:${Z.type}/${Z.name}: ${oe instanceof Error?oe.message:String(oe)}`)}}let Y=Vp(I.cost,I.usageTypes);if(Y)L.push(Y);return L.sort((Z,X)=>(X.monthlySavings??-1)-(Z.monthlySavings??-1)||Z.category.localeCompare(X.category)||Z.resource.name.localeCompare(X.resource.name)),{recommendations:L,inventory:m,savingsAvailable:L.some((Z)=>Z.monthlySavings!=null),warnings:z}}}var Sc="Amazon Simple Storage Service";function Gp(){let R=new Date,t=new Date(Date.UTC(R.getUTCFullYear(),R.getUTCMonth(),1)),m=new Date(t);m.setUTCMonth(m.getUTCMonth()-1);let k=(L)=>L.toISOString().slice(0,10),I=m.toLocaleString("en-US",{month:"long",year:"numeric",timeZone:"UTC"});return{start:k(m),end:k(t),label:I}}function cn(R){return`$${R.toFixed(2)}`}function qs(R){if(R===null)return"new";if(Math.abs(R)<0.05)return"→ 0.0%";return`${R>0?"↑":"↓"} ${Math.abs(R).toFixed(1)}%`}function Cc(R){r(`Cost Explorer request failed: ${R instanceof Error?R.message:String(R)}`),e(`
 This command needs the ce:GetCostAndUsage IAM permission.`)}function Kp(R){let{label:t,profile:m,rows:k,total:I,count:L}=R,z=`# AWS Cost Analysis — ${t}`,Y=m?`
 _Profile: \`${m}\`_
 `:`
 `,Z=`| Service | Resources | Cost | % of Total |
-|---|---|---|---|`,X=k.map(([oe,ae,be,Ae])=>`| ${oe} | ${ae} | ${be} | ${Ae} |`).join(`
-`),ie=`
-**Total: ${fn(I)} across ${L} service${L===1?"":"s"}**`;return`${z}
+|---|---|---|---|`,X=k.map(([oe,se,ue,ke])=>`| ${oe} | ${se} | ${ue} | ${ke} |`).join(`
+`),ee=`
+**Total: ${cn(I)} across ${L} service${L===1?"":"s"}**`;return`${z}
 ${Y}
 | Service | Resources | Cost | % of Total |
 |---|---|---|---|
 ${X}
-${ie}
-`}function Pc(R){R.command("cost:analyze","Rank AWS services by cost for the last full month").option("--output","Also write a markdown report to ./aws.md").option("--no-cache","Skip the local response cache (always hit AWS — costs $0.01)").action(async(t)=>{let m=t?.profile,k=t?.cache!==!1,{start:I,end:L,label:z}=Gp();i(`Cost Analysis — ${z}${m?` (profile: ${m})`:""}`);let Y=new s("Querying AWS Cost Explorer...");Y.start();let Z=new Ye(m,{useCache:k}),X;try{X=await Z.getCostByService({start:I,end:L})}catch(de){Y.stop(),r(`Cost Explorer request failed: ${de?.message??de}`),e(`
-This command needs the ce:GetCostAndUsage IAM permission.`);return}let ie=null,oe=!1;if(X.some((de)=>de.service===Rc))try{ie=(await new g("us-east-1",m).listBuckets()).Buckets?.length??0}catch{oe=!0}if(Y.stop(),X.length===0){e("No billed services in this period.");return}let ae=X.reduce((de,ke)=>de+ke.amount,0),be=X.map((de)=>{let ke="-";if(de.service===Rc){if(oe)ke="unknown (no s3:ListAllMyBuckets)";else if(ie!==null)ke=`${ie} bucket${ie===1?"":"s"}`}let De=ae>0?`${(de.amount/ae*100).toFixed(1)}%`:"—";return[de.service,ke,fn(de.amount),De]});if(c(["Service","Resources","Cost","% of Total"],be),e(`
-Total: ${fn(ae)} across ${X.length} service${X.length===1?"":"s"}`),Z.lastCacheAgeSeconds!==null)e(`(cached, ${Z.lastCacheAgeSeconds}s old — pass --no-cache to refresh)`);if((X.find((de)=>de.service===Rc)?.amount??0)>1&&ie===0)a(`
-S3 has spend but listBuckets returned 0. The buckets are likely owned by a different account in your AWS Organization (consolidated billing rolls up to the payer account, but ListBuckets only shows buckets owned by the calling account).`);if(t?.output){let de=`${process.cwd()}/aws.md`;await Bun.write(de,Kp({label:z,profile:m,rows:be,total:ae,count:X.length})),n(`
-Wrote ${de}`)}}),R.command("cost:cache:clear","Wipe the local Cost Explorer response cache").option("--all","Wipe entries for every profile (default: just the current profile)").action(async(t)=>{let m=t?.all?void 0:t?.profile,k=Vc(m),I=jc(m);e(`Cleared ${I.deletedFiles} cached response${I.deletedFiles===1?"":"s"} for ${I.scope}`),e(`(${k})`)}),R.command("cost","Show current month-to-date AWS spend and projected total").option("--env <environment>","Environment (production, staging, development)").option("--no-cache","Skip the local response cache").action(async(t)=>{let m=Ld(),k=new Ye(t?.profile,{useCache:t?.cache!==!1});i(`AWS Cost — ${m.label}${t?.profile?` (profile: ${t.profile})`:""}`);let I=new s("Querying month-to-date AWS spend...");I.start();try{let[L,z]=await Promise.all([k.getCostByService({start:m.start,end:m.end,granularity:"DAILY"}),k.getCostByService({start:m.previous.start,end:m.previous.end,granularity:"MONTHLY"})]);I.stop();let Z=kc(L,z).map((ae)=>{let be=$c(ae.amount,m.daysElapsed,m.daysInMonth);return[ae.service,fn(ae.amount),fn(be),fn(ae.previousAmount),Ks(ms(be,ae.previousAmount))]});c(["Service","MTD","Projected",m.previous.label,"Change"],Z);let X=L.reduce((ae,be)=>ae+be.amount,0),ie=z.reduce((ae,be)=>ae+be.amount,0),oe=$c(X,m.daysElapsed,m.daysInMonth);e(`
-MTD: ${fn(X)} through day ${m.daysElapsed} of ${m.daysInMonth}`),e(`Projected: ${fn(oe)} (${Ks(ms(oe,ie))} vs ${m.previous.label})`)}catch(L){I.stop(),Ic(L)}}),R.command("cost:breakdown","Cost breakdown by service").option("--env <environment>","Environment (production, staging, development)").option("--days <days>","Number of days to analyze",{default:"30"}).option("--no-cache","Skip the local response cache").action(async(t)=>{let m=Number.parseInt(t?.days??"30",10),k;try{k=Po(m)}catch(z){r(z instanceof Error?z.message:String(z));return}let I=new Ye(t?.profile,{useCache:t?.cache!==!1});i(`AWS Cost Breakdown — ${k.current.label}${t?.profile?` (profile: ${t.profile})`:""}`);let L=new s("Comparing AWS service spend...");L.start();try{let[z,Y]=await Promise.all([I.getCostByService({start:k.current.start,end:k.current.end,granularity:"DAILY"}),I.getCostByService({start:k.previous.start,end:k.previous.end,granularity:"DAILY"})]);L.stop();let Z=kc(z,Y);c(["Service",`Last ${m}d`,`Previous ${m}d`,"Trend"],Z.map((oe)=>[oe.service,fn(oe.amount),fn(oe.previousAmount),Ks(oe.changePercent)]));let X=z.reduce((oe,ae)=>oe+ae.amount,0),ie=Y.reduce((oe,ae)=>oe+ae.amount,0);e(`
-Total: ${fn(X)} (${Ks(ms(X,ie))})`)}catch(z){L.stop(),Ic(z)}}),R.command("cost:egress","Rank AWS data-transfer usage types by cost").option("--days <days>","Number of days to analyze",{default:"30"}).option("--no-cache","Skip the local response cache").action(async(t)=>{let m=Number.parseInt(t?.days??"30",10),k;try{k=Po(m).current}catch(z){r(z instanceof Error?z.message:String(z));return}let I=new Ye(t?.profile,{useCache:t?.cache!==!1});i(`AWS Egress Cost — ${k.label}${t?.profile?` (profile: ${t.profile})`:""}`);let L=new s("Querying data-transfer usage types...");L.start();try{let z=Hs(await I.getCostByDimension({start:k.start,end:k.end,dimension:"USAGE_TYPE",granularity:"DAILY"}));if(L.stop(),z.length===0){e("No billed data-transfer usage types were found in this period.");return}c(["Usage type","Cost"],z.map((Y)=>[Y.key,fn(Y.amount)])),e(`
-Total ranked egress: ${fn(z.reduce((Y,Z)=>Y+Z.amount,0))}`),e("Usage types classify NAT, internet, inter-AZ, and inter-region transfer; destination correlation requires VPC Flow Logs.")}catch(z){L.stop(),Ic(z)}}),R.command("resources","List all resources").option("--env <environment>","Environment (production, staging, development)").option("--type <type>","Resource type (ec2, rds, s3, lambda, etc.)").option("--region <region>","AWS region for regional resources").action(async(t)=>{i(`AWS Resources${t?.profile?` (profile: ${t.profile})`:""}`);let m=new s("Discovering tagged and untagged resources...");m.start();let k=new fs(t?.profile,t?.region);try{let I=await k.discover({type:t?.type});if(m.stop(),I.resources.length===0)e("No matching resources were discovered.");else c(["Type","Name","Region","State","Monthly cost"],I.resources.map((L)=>[`${L.service}:${L.type}`,L.name,L.region??"global",L.state??"unknown","— (requires CUR resource IDs)"])),e(`
-${I.resources.length} resource${I.resources.length===1?"":"s"} discovered.`);for(let L of I.warnings)a(L)}catch(I){m.stop(),r(`Resource discovery failed: ${I instanceof Error?I.message:String(I)}`)}}),R.command("resources:unused","Find unused resources").option("--env <environment>","Environment (production, staging, development)").option("--type <type>","Limit analysis to one resource type").option("--region <region>","AWS region for regional resources").action(async(t)=>{i(`Unused AWS Resources${t?.profile?` (profile: ${t.profile})`:""}`);let m=new s("Evaluating inventory and CloudWatch idle signals...");m.start();try{let k=await new Gs(t?.profile,t?.region).unused({type:t?.type});if(m.stop(),k.findings.length===0)e("No resources met the conservative unused-resource thresholds.");else{c(["Resource","Signal","Recommendation","Monthly savings"],k.findings.map((L)=>[`${L.resource.service}:${L.resource.type}/${L.resource.name}`,L.signal,L.recommendation,L.monthlySavings==null?"—":fn(L.monthlySavings)]));let I=k.findings.reduce((L,z)=>L+(z.monthlySavings??0),0);e(`
-Known monthly savings: ${k.savingsAvailable?fn(I):"unavailable (enable CUR resource IDs)"}`)}for(let I of k.inventory.warnings)a(I)}catch(k){m.stop(),r(`Unused-resource analysis failed: ${k instanceof Error?k.message:String(k)}`)}}),R.command("optimize","Suggest cost optimizations").option("--env <environment>","Environment (production, staging, development)").option("--type <type>","Limit analysis to one resource type").option("--region <region>","AWS region for regional resources").option("--include-commitments","Include estimated RI and Savings Plan candidates").action(async(t)=>{i(`AWS Cost Optimizations${t?.profile?` (profile: ${t.profile})`:""}`);let m=new s("Combining inventory, CloudWatch signals, and Cost Explorer line items...");m.start();try{let k=await new Gs(t?.profile,t?.region).optimize({type:t?.type,includeCommitments:t?.includeCommitments});if(m.stop(),k.recommendations.length===0)e("No resources met the conservative optimization thresholds.");else{c(["Category","Resource","Current","Projected","Savings","Source signal","Recommendation"],k.recommendations.map((L)=>[L.category,`${L.resource.service}:${L.resource.type}/${L.resource.name}`,L.currentCost==null?"—":fn(L.currentCost),L.projectedCost==null?"—":fn(L.projectedCost),L.monthlySavings==null?"—":fn(L.monthlySavings),L.sourceSignal,L.recommendation]));let I=k.recommendations.reduce((L,z)=>L+(z.monthlySavings??0),0);e(`
-Estimated monthly savings: ${k.savingsAvailable?fn(I):"unavailable (enable CUR resource IDs)"}`)}for(let I of k.warnings)a(I);e("Estimates are directional; validate workload peaks and current AWS pricing before applying changes.")}catch(k){m.stop(),r(`Optimization analysis failed: ${k instanceof Error?k.message:String(k)}`)}})}async function Do(R){let t=await Ne(),m=R??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let k=y(process.cwd(),t);return{config:t,env:m,controlPlane:k,controls:new or(k.store)}}function No(R){r(R instanceof Error?R.message:String(R)),process.exitCode=1}function jd(R){let t=R?.infrastructure?.compute??{};return{ddos:t.ddos===!1?void 0:typeof t.ddos==="object"?t.ddos:{ports:[80,443]},waf:t.waf===!1?void 0:typeof t.waf==="object"?t.waf:{mode:"detection"}}}function xc(R){R.command("protect:status","Show the current edge-protection posture").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{try{let m=await Do(t.env),k=m.controls.current(),I=Qi(k);if(t.json){e(JSON.stringify({posture:I,controls:m.controls.raw()},null,2));return}if(i("Edge protection"),I.mitigationPaused||I.attackMode)a(I.summary);else n(I.summary);let L=jd(m.config);if(e(`L3/L4 mitigation: ${L.ddos?"enabled":"disabled in config"}`),e(`WAF: ${L.waf?`enabled (${L.waf.mode??"detection"})`:"disabled in config"}`),e(`Allowlist: ${k.ipRules.allow.length} entry(s)`),e(`Blocklist: ${k.ipRules.block.length} entry(s)`),k.ipRules.allow.length>0||k.ipRules.block.length>0)c(["List","CIDR"],[...k.ipRules.allow.map((z)=>["allow",z]),...k.ipRules.block.map((z)=>["block",z])])}catch(m){No(m)}}),R.command("protect:attack-mode <state>","Challenge every visitor for a bounded window (on|off)").option("--hours <hours>",`How long before it lifts itself (default ${_n}, max ${ir})`).option("--reason <reason>","Why, for the record").option("--env <environment>","Target environment").action(async(t,m)=>{try{let k=await Do(m.env);if(t==="off"){n(k.controls.disableAttackMode()?"Attack mode is off.":"Attack mode was not on.");return}if(t!=="on")throw Error("State must be 'on' or 'off'.");let I=k.controls.enableAttackMode({hours:m.hours==null?void 0:Number(m.hours),reason:m.reason??"Enabled from the CLI."});a("Attack mode is ON. Every visitor is challenged, including legitimate ones."),e(`It lifts itself at ${I.expiresAt} — you do not need to remember.`)}catch(k){No(k)}}),R.command("protect:pause <state>","Pause or resume automatic mitigation (on|off)").option("--hours <hours>",`How long (max ${ir})`).option("--reason <reason>","Why — required when pausing").option("--env <environment>","Target environment").action(async(t,m)=>{try{let k=await Do(m.env);if(t==="off"){n(k.controls.resumeMitigations()?"Automatic mitigation resumed.":"Mitigation was not paused.");return}if(t!=="on")throw Error("State must be 'on' or 'off'.");if(!m.reason)throw Error("--reason is required: you are liable for the traffic this admits.");let I=k.controls.pauseMitigations({hours:m.hours==null?void 0:Number(m.hours),reason:m.reason});a("Automatic mitigation is PAUSED. All traffic is served, and billed, including attacks."),e(`It resumes automatically at ${I.expiresAt}.`)}catch(k){No(k)}}),R.command("protect:allow <cidr>","Never rate-limit or block this IP or CIDR").option("--remove","Remove the entry instead").option("--env <environment>","Target environment").action(async(t,m)=>{try{let k=await Do(m.env),I=m.remove?k.controls.removeIpRule("allow",t):k.controls.addIpRule("allow",t);n(`Allowlist now has ${I.allow.length} entry(s).`),e("It reaches the boxes on the next deploy. `cloud protect:apply` shows exactly what will land.")}catch(k){No(k)}}),R.command("protect:block <cidr>","Drop traffic from this IP or CIDR at the kernel").option("--remove","Remove the entry instead").option("--env <environment>","Target environment").action(async(t,m)=>{try{let k=await Do(m.env),I=m.remove?k.controls.removeIpRule("block",t):k.controls.addIpRule("block",t);n(`Blocklist now has ${I.block.length} entry(s).`),e("It reaches the boxes on the next deploy. `cloud protect:apply` shows exactly what will land.")}catch(k){No(k)}}),R.command("protect:apply","Print the ruleset the current controls produce").option("--env <environment>","Target environment").option("--waf","Print the WAF configuration instead of the firewall script").action(async(t)=>{try{let m=await Do(t.env),k=jd(m.config);if(t.waf){if(!k.waf)throw Error("The WAF is disabled in this configuration.");let I=Di(k.waf);for(let L of I.warnings)a(L);e(I.config);return}if(!k.ddos)throw Error("L3/L4 mitigation is disabled in this configuration.");e(Pr(On(k.ddos,m.controls.current())))}catch(m){No(m)}})}async function Nn(R){let t=await Ne(),m=R??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let k=y(process.cwd(),t),I=k.environments.get(m),L=new vr(k.store),z=new ht(k.store,{encryptionKey:_(process.cwd())});return{config:t,env:m,controlPlane:k,environmentRecord:I,store:L,alerts:z,service:new yt(L),gate:new Vt(k.store),organizationId:k.organization.id,projectId:k.project.id}}function Js(R){if(R==null)return;let t=String(R).trim().replace(/[$,\s]/g,"");if(!t)return;if(/^\d+c$/i.test(t))return Number.parseInt(t,10);let m=Number(t);if(!Number.isFinite(m)||m<0)throw Error(`Invalid amount: ${R}`);return Math.round(m*100)}function Bd(R){if(!R)return;let t=R.split(",").map((m)=>m.trim()).filter(Boolean);for(let m of t)if(!io.includes(m))throw Error(`Unknown enforcement action '${m}'. Valid: ${io.join(", ")}`);return t}function _d(R){if(R==null)return"monthly";if(R==="daily"||R==="weekly"||R==="monthly")return R;throw Error(`Unknown period '${R}'. Valid: daily, weekly, monthly`)}function Jp(R){return sn[R]?.label??R}function Yp(R,t=24){let m=Math.max(0,Math.min(t,Math.round(R/100*t)));return`${"█".repeat(m)}${"░".repeat(t-m)}`}function Fn(R){r(R instanceof Error?R.message:String(R)),process.exitCode=1}function Dc(R){R.command("usage","Show current usage, cost, and remaining budget headroom").option("--env <environment>","Target environment").option("--period <period>","daily, weekly, or monthly (default monthly)").option("--timezone <tz>","IANA timezone for period boundaries (default UTC)").option("--json","Print structured JSON").action(async(t)=>{try{let m=await Nn(t.env),k=m.service.usageReport({organizationId:m.organizationId,projectId:m.projectId,period:_d(t.period),timezone:t.timezone});if(t.json){e(JSON.stringify(k,null,2));return}if(i(`Usage — ${k.window.label}`),e(`Total: ${ee(k.totalCents,k.currency)}`),k.byMeter.length===0)e("No metered usage in this window yet.");else c(["Meter","Provider","Quantity","Cost"],k.byMeter.map((I)=>[Jp(I.meter),I.provider||"-",I.quantity.toLocaleString(void 0,{maximumFractionDigits:3}),ee(I.costCents,k.currency)]));if(k.budgets.length===0){a("No budgets are configured. Nothing is capping this project."),e("Create one with: cloud budget:create --name 'Monthly' --hard 200");return}if(i("Budgets"),c(["Name","Period","Spent","Limit","Used","Projected","Time to cap","State"],k.budgets.map((I)=>[I.name+(I.dryRun?" (dry run)":""),I.period,ee(I.spentCents,k.currency),I.limitCents==null?"-":ee(I.limitCents,k.currency),`${Yp(I.usedPercent)} ${I.usedPercent.toFixed(0)}%`,`${ee(I.projectedCents,k.currency)} (${(I.projectionConfidence*100).toFixed(0)}% conf)`,I.timeToCap||"-",I.level])),k.enforcement.strongestAction)a(`Enforcement in force: ${k.enforcement.strongestAction}`)}catch(m){Fn(m)}}),R.command("budget:list","List budgets governing this project").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{try{let m=await Nn(t.env),k=m.store.listBudgets({organizationId:m.organizationId,projectId:m.projectId});if(t.json){e(JSON.stringify(k,null,2));return}if(k.length===0){a("No budgets configured.");return}c(["ID","Name","Scope","Period","Soft","Hard","Mode","Enabled"],k.map((I)=>[I.id.slice(0,8),I.name,I.environmentId?"environment":I.projectId?"project":"organization",I.period,I.softLimitCents==null?"-":ee(I.softLimitCents,I.currency),I.hardLimitCents==null?"-":ee(I.hardLimitCents,I.currency),I.dryRun?"dry run":"enforcing",I.enabled?"yes":"no"]))}catch(m){Fn(m)}}),R.command("budget:create","Create a spend budget").option("--name <name>","Budget name").option("--soft <amount>","Soft limit in dollars (warn only)").option("--hard <amount>","Hard limit in dollars (enforces)").option("--period <period>","daily, weekly, or monthly (default monthly)").option("--timezone <tz>","IANA timezone for period boundaries (default UTC)").option("--scope <scope>","organization, project, or environment (default project)").option("--actions <list>","Comma-separated actions to run at 100% (default notify,block_builds,block_deployments)").option("--grace <seconds>","Seconds a breach must persist before enforcing").option("--dry-run","Evaluate and report but never enforce").option("--env <environment>","Target environment").action(async(t)=>{try{if(!t.name)throw Error("--name is required.");let m=await Nn(t.env),k=t.scope??"project";if(!["organization","project","environment"].includes(k))throw Error(`Unknown scope '${k}'. Valid: organization, project, environment`);let I=Bd(t.actions),L=m.store.createBudget({organizationId:m.organizationId,projectId:k==="organization"?void 0:m.projectId,environmentId:k==="environment"?m.environmentRecord?.id:void 0,name:t.name,period:_d(t.period),timezone:t.timezone,softLimitCents:Js(t.soft),hardLimitCents:Js(t.hard),graceSeconds:t.grace==null?void 0:Number(t.grace),thresholds:I?[{atPercent:80,actions:["notify"]},{atPercent:100,actions:I}]:[...so],dryRun:t.dryRun===!0});n(`Created budget '${L.name}' (${L.id}).`),e(`Mode: ${L.dryRun?"dry run — reports only, enforces nothing":"enforcing"}`),e(`Ladder: ${L.thresholds.map((z)=>`${z.atPercent}% → ${z.actions.join("+")}`).join(", ")}`)}catch(m){Fn(m)}}),R.command("budget:update <budgetId>","Update a budget").option("--soft <amount>","Soft limit in dollars").option("--hard <amount>","Hard limit in dollars").option("--enable","Enable the budget").option("--disable","Disable the budget").option("--enforce","Leave dry run and start enforcing").option("--dry-run","Return to dry run").option("--env <environment>","Target environment").action(async(t,m)=>{try{let k=await Nn(m.env),I=k.store.getBudget(t);if(!I)throw Error(`Budget '${t}' was not found.`);let L=k.store.updateBudget(t,{softLimitCents:Js(m.soft)??I.softLimitCents,hardLimitCents:Js(m.hard)??I.hardLimitCents,enabled:m.disable?!1:m.enable?!0:I.enabled,dryRun:m.enforce?!1:m.dryRun?!0:I.dryRun});n(`Updated budget '${L.name}'.`),e(`Mode: ${L.dryRun?"dry run":"enforcing"} · Enabled: ${L.enabled?"yes":"no"}`)}catch(k){Fn(k)}}),R.command("budget:delete <budgetId>","Delete a budget and lift anything it was enforcing").option("--env <environment>","Target environment").action(async(t,m)=>{try{let k=await Nn(m.env),I=k.store.getBudget(t);if(!I)throw Error(`Budget '${t}' was not found.`);let L=k.gate.closeBudget(t);if(k.store.deleteBudget(t),n(`Deleted budget '${I.name}'.`),L>0)e(`Lifted ${L} enforcement action(s) it had in force.`)}catch(k){Fn(k)}}),R.command("spend:check","Run one spend cycle now and report what it would do").option("--env <environment>","Target environment").option("--apply","Actually apply enforcement (default is a preview)").option("--json","Print structured JSON").action(async(t)=>{try{let m=await Nn(t.env),k=new vi({controlPlane:m.controlPlane.store,store:m.store,alerts:t.apply?m.alerts:void 0});if(!t.apply){let z=m.store.budgetsForScope(m.organizationId,m.projectId).map((Y)=>m.service.status(Y));if(t.json){e(JSON.stringify(z,null,2));return}if(i("Spend check (preview — nothing was applied)"),z.length===0){a("No budgets govern this project.");return}c(["Budget","Used","Projected","Level","Would apply"],z.map((Y)=>[Y.budget.name,`${Y.decision.usedPercent.toFixed(1)}%`,`${Y.decision.projectedPercent.toFixed(1)}%`,Y.decision.level,Y.decision.actions.join(", ")||"-"])),e(`
-Run with --apply to enforce.`);return}let I=await k.run({organizationId:m.organizationId,projectId:m.projectId,environmentId:m.environmentRecord?.id,environmentKind:m.environmentRecord?.kind});if(t.json){e(JSON.stringify(I,null,2));return}if(i("Spend cycle"),e(`Evaluated ${I.decisions.length} budget(s) in ${I.durationMs}ms.`),I.applied.length>0)a(`Applied: ${I.applied.join(", ")}`);if(I.released.length>0)n(`Released: ${I.released.join(", ")}`);if(I.withheld.length>0)a(`Withheld pending approval: ${I.withheld.join(", ")}`);if(I.anomalies.length>0)a(`${I.anomalies.length} anomaly(ies) detected.`);e(`Notifications queued: ${I.notificationsSent}`);for(let L of I.warnings)a(L);if(I.applied.length===0&&I.released.length===0)n("Nothing to change.")}catch(m){Fn(m)}}),R.command("spend:work","Run the spend loop continuously: meter, evaluate, enforce, notify").option("--env <environment>","Target environment").option("--interval <seconds>",`Seconds between cycles (default ${Ci})`).option("--once","Run a single cycle and exit").action(async(t)=>{try{let m=await Nn(t.env),k=new vi({controlPlane:m.controlPlane.store,store:m.store,alerts:m.alerts}),I={organizationId:m.organizationId,projectId:m.projectId,environmentId:m.environmentRecord?.id,environmentKind:m.environmentRecord?.kind};if(t.once){let X=await k.run(I);n(`Cycle finished in ${X.durationMs}ms.`);for(let ie of X.warnings)a(ie);return}let L=Math.max(10,Number(t.interval??Ci)),z=new uo(m.controlPlane.store,{owner:`cli:${process.pid}`});i(`Spend worker (every ${L}s)`),e("Press Ctrl+C to stop.");let Y=Rs(k,{intervalSeconds:L,lease:z,immediate:!0,onResult:(X)=>{let ie=X.flatMap((be)=>be.applied),oe=X.flatMap((be)=>be.released),ae=X.flatMap((be)=>be.warnings);if(ie.length>0)a(`Applied: ${ie.join(", ")}`);if(oe.length>0)n(`Released: ${oe.join(", ")}`);for(let be of ae)a(be)},onSkip:(X)=>e(`Skipped: ${X} holds the loop lease.`),onError:(X)=>r(X instanceof Error?X.message:String(X))}),Z=()=>{Y(),e(`
-Spend worker stopped; the loop lease was released.`),process.exit(0)};process.on("SIGINT",Z),process.on("SIGTERM",Z),await new Promise(()=>{})}catch(m){Fn(m)}}),R.command("spend:status","Show enforcement currently in force").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{try{let m=await Nn(t.env),k=m.gate.listUnder({organizationId:m.organizationId});if(t.json){e(JSON.stringify(k,null,2));return}if(k.length===0){n("No spend enforcement is in force.");return}c(["Action","Budget","Scope","Mode","Since","Reason"],k.map((I)=>[I.action,I.budgetId.slice(0,8),I.environmentId?"environment":I.projectId?"project":"organization",I.simulated?"dry run":"enforcing",I.appliedAt,I.reason]))}catch(m){Fn(m)}}),R.command("spend:release <budgetId> <action>","Manually lift one enforcement action").option("--env <environment>","Target environment").action(async(t,m,k)=>{try{let I=await Nn(k.env),L=Bd(m)?.[0];if(!L)throw Error("An action is required.");if(!I.gate.close(t,L))throw Error(`${L} was not in force for budget ${t}.`);n(`Lifted ${L} for budget ${t}.`),a("The next spend cycle will re-apply this if spend is still over the threshold.")}catch(I){Fn(I)}}),R.command("anomaly:config","Tune anomaly detection for a signal").option("--signal <signal>","Signal to configure (default cost)").option("--sensitivity <level>","low, medium, or high").option("--season <points>","Points per season: 24 for daily, 168 for weekly").option("--min-delta <amount>","Absolute change below which nothing is reported, in the signal's units").option("--severity <severity>","info, warning, or critical").option("--disable","Stop detecting this signal").option("--enable","Resume detecting this signal").option("--list","List configured signals instead of changing one").option("--signals","List every detectable signal and its data rules").option("--env <environment>","Target environment").action(async(t)=>{try{if(t.signals){c(["Signal","Source","Empty hour","Min samples","Unit"],jt.map((z)=>[z.key,z.source,z.gapPolicy==="zero"?"counts as zero":"ignored",String(z.minSamples),z.unit]));return}let m=await Nn(t.env),k=m.service.anomalyConfigs;if(t.list){let z=k.list({organizationId:m.organizationId,projectId:m.projectId});if(z.length===0){e("No signals are configured; every one uses its shipped defaults.");return}c(["Signal","Enabled","Sensitivity","Season","Min delta","Severity"],z.map((Y)=>[Y.signal,Y.enabled?"yes":"no",Y.sensitivity,String(Y.seasonLength),String(Y.minAbsoluteDelta),Y.severity]));return}let I=t.sensitivity;if(I&&!["low","medium","high"].includes(I))throw Error("--sensitivity must be low, medium, or high.");let L=k.upsert({organizationId:m.organizationId,projectId:m.projectId,signal:t.signal??"cost",sensitivity:I,seasonLength:t.season==null?void 0:Number(t.season),minAbsoluteDelta:t.minDelta==null?void 0:Number(t.minDelta),severity:t.severity,enabled:t.disable?!1:t.enable?!0:void 0});n(`Anomaly detection for '${L.signal}' updated.`),e(`${L.enabled?"Enabled":"Disabled"} · ${L.sensitivity} sensitivity · season ${L.seasonLength} · floor ${L.minAbsoluteDelta} · ${L.severity}`)}catch(m){Fn(m)}}),R.command("anomaly:silence","Skip detection for a signal, route, or status code").option("--signal <signal>","Signal to silence").option("--route <pattern>","Route glob, e.g. /webhooks/**").option("--status <code>","HTTP status code").option("--reason <reason>","Why — required").option("--until <timestamp>","ISO timestamp the silence expires").option("--list","List active silences").option("--remove <id>","Remove a silence").option("--env <environment>","Target environment").action(async(t)=>{try{let m=await Nn(t.env),k=m.service.anomalyConfigs;if(t.remove){n(k.removeSilence(t.remove)?"Silence removed.":"That silence was not found.");return}if(t.list){let L=k.listSilences({organizationId:m.organizationId,projectId:m.projectId});if(L.length===0){n("No active silences.");return}c(["ID","Signal","Route","Status","Expires","Reason"],L.map((z)=>[z.id.slice(0,8),z.signal??"-",z.routePattern??"-",z.statusCode==null?"-":String(z.statusCode),z.expiresAt??"never",z.reason]));return}if(!t.reason)throw Error("--reason is required: someone will ask why this stopped alerting.");let I=k.silence({organizationId:m.organizationId,projectId:m.projectId,signal:t.signal,routePattern:t.route,statusCode:t.status==null?void 0:Number(t.status),reason:t.reason,expiresAt:t.until});if(n(`Silenced (${I.id.slice(0,8)}).`),!I.expiresAt)a("This silence never expires. Pass --until to bound it, or it will outlive the reason for it.")}catch(m){Fn(m)}}),R.command("spend:anomalies","List detected spend anomalies").option("--env <environment>","Target environment").option("--unacknowledged","Only anomalies nobody has acknowledged").option("--json","Print structured JSON").action(async(t)=>{try{let m=await Nn(t.env),k=m.store.listAnomalies({organizationId:m.organizationId,projectId:m.projectId,unacknowledgedOnly:t.unacknowledged===!0});if(t.json){e(JSON.stringify(k,null,2));return}if(k.length===0){n("No anomalies detected.");return}c(["Hour","Signal","Direction","Observed","Expected","Score","Severity"],k.map((I)=>[I.bucketStart,I.signal,I.direction,ee(I.observed),ee(I.expected),I.score.toFixed(1),I.severity]))}catch(m){Fn(m)}})}import{readFileSync as Zp}from"node:fs";var Qp={github:"GITHUB_TOKEN",gitlab:"GITLAB_TOKEN",bitbucket:"BITBUCKET_TOKEN",gitea:"GITEA_TOKEN",generic_https:"GIT_TOKEN"},Xp={github:"https://github.com",gitlab:"https://gitlab.com",bitbucket:"https://bitbucket.org",gitea:"https://gitea.com"};function Ec(R,t={}){if(t.provider&&!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(t.provider))throw Error(`Unsupported Git provider: ${t.provider}`);let m=t.cloneUrl??(/^(?:https?:\/\/|ssh:\/\/|git@)/.test(R)?R:void 0),k="",I=m??R;if(m?.startsWith("git@")){let Y=/^git@([^:]+):(.+)$/.exec(m);if(!Y)throw Error("SSH repository URL must use git@host:owner/name.git");k=Y[1],I=Y[2]}else if(m){let Y=new URL(m);k=Y.hostname,I=Y.pathname}if(I=I.replace(/^\/+|\/+$/g,"").replace(/\.git$/,""),!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(I))throw Error("Repository must use owner/name or a supported clone URL");let L=t.provider??(k.includes("github")?"github":k.includes("gitlab")?"gitlab":k.includes("bitbucket")?"bitbucket":k.includes("gitea")?"gitea":m?.startsWith("git@")||m?.startsWith("ssh://")?"generic_ssh":m?"generic_https":"github"),z=t.host??Xp[L]??(k?`https://${k}`:"");if(!z)throw Error("A provider host is required");return{provider:L,host:z,fullName:I,cloneUrl:m}}async function ef(){let R=await Ne(),t=y(process.cwd(),R);return{config:R,controlPlane:t,sources:new lr(t.store,{encryptionKey:_(process.cwd())})}}async function Pi(R){let t=await ef();try{return await R(t)}finally{t.controlPlane.store.close()}}function ys(R,t,m){let k=R.listConnections(t);if(!m)return k.length===1?k[0]:void 0;return k.find((I)=>I.id===m||I.name.toLowerCase()===m.toLowerCase())}function Md(R,t){if(!R)throw Error(`${t} file is required`);return Zp(R,"utf8")}async function tf(R,t,m,k){if(["github","gitlab","bitbucket","gitea"].includes(t.provider)){let L=R.listRepositories(t.id).find((Z)=>Z.fullName.toLowerCase()===m.fullName.toLowerCase());if(L)return L;let Y=(await Kr(R,t.id,{search:m.fullName,maxPages:20})).find((Z)=>Z.fullName.toLowerCase()===m.fullName.toLowerCase());if(!Y)throw Error(`Repository ${m.fullName} is not granted to this connection`);return Y}let I=k.url??m.cloneUrl;if(!I)throw Error("Generic Git connections require --url <clone-url>");return R.upsertRepository({connectionId:t.id,providerRepositoryId:`manual:${m.fullName}`,fullName:m.fullName,cloneUrl:I,defaultBranch:k.branch??"main",visibility:"unknown",archived:!1,metadata:{source:"cli"}})}async function zd(R,t,m){let k=Ec(t,{provider:m.provider,host:m.host,cloneUrl:m.url}),I=ys(R.sources,R.controlPlane.organization.id,m.connection);if(!I){if(m.connection)throw Error(`Source connection ${m.connection} was not found`);let z=m.tokenEnv??Qp[k.provider],Y=z?process.env[z]:void 0;if(["github","gitlab","bitbucket","gitea"].includes(k.provider)&&!Y)throw Error(`Set ${z} or pass --token-env <name>; secrets are never accepted as command arguments`);let Z=k.provider==="generic_ssh"?{publicKey:Md(m.publicKey,"Public key"),privateKey:Md(m.privateKey,"Private key"),hostKey:m.hostKey??""}:void 0;R.controlPlane.store.database.transaction(()=>{if(I=R.sources.createConnection({organizationId:R.controlPlane.organization.id,provider:k.provider,name:m.name??`${k.provider.replace("_"," ")} · ${new URL(k.host).host}`,host:k.host,owner:k.fullName.split("/")[0],authKind:k.provider==="generic_ssh"?"deploy_key":Y?"access_token":"none",credential:Y?{token:Y}:void 0}),Z)R.sources.createDeployKey({connectionId:I.id,name:m.deployKey??`${k.fullName} deploy key`,...Z,host:m.sshHost??new URL(k.host).hostname,actorId:void 0})})()}if(!I)throw Error("Source connection could not be created");if(I.status==="disconnected")throw Error("The selected source connection is disconnected");let L=await tf(R.sources,I,k,m);if(m.site){let z=R.controlPlane.environments.get("production")??[...R.controlPlane.environments.values()][0],Y=R.controlPlane.store.listResources(R.controlPlane.project.id,z?.id).find((X)=>X.kind==="application"&&X.slug===m.site);if(!Y)throw Error(`Application ${m.site} was not found`);let Z=I.provider==="generic_ssh"?R.sources.listDeployKeys(I.id)[0]:void 0;R.sources.createBinding({projectId:R.controlPlane.project.id,environmentId:z?.id,resourceId:Y.id,connectionId:I.id,repositoryId:L.id,repositoryFullName:L.fullName,defaultBranch:m.branch??L.defaultBranch,branchRule:m.tag?void 0:m.branch??L.defaultBranch,tagRule:m.tag,monorepoRoot:m.root??".",includePaths:m.include?.split(",").map((X)=>X.trim()).filter(Boolean),excludePaths:m.exclude?.split(",").map((X)=>X.trim()).filter(Boolean),submodules:m.submodules,cloneDepth:m.fullClone?void 0:20,deployKeyId:Z?.id})}return{connection:I,repository:L}}function xi(R){r(R instanceof Error?R.message:"Git integration command failed")}function Tc(R){R.command("git:connections","List encrypted Git provider connections").action(async()=>{try{await Pi(async({sources:t,controlPlane:m})=>{let k=t.listConnections(m.organization.id);c(["ID","Name","Provider","Status","Credential","Last sync"],k.map((I)=>[I.id,I.name,I.provider,I.status,I.credentialConfigured?"encrypted":"none",I.lastSyncedAt??"-"]))})}catch(t){xi(t)}}),R.command("git:repositories","List repositories granted to a connection").option("--connection <id>","Connection ID or name").action(async(t)=>{try{await Pi(async({sources:m,controlPlane:k})=>{let I=ys(m,k.organization.id,t.connection);if(!I)throw Error("Choose a connection with --connection <id>");let L=m.listRepositories(I.id);c(["ID","Repository","Default branch","Visibility","Archived"],L.map((z)=>[z.id,z.fullName,z.defaultBranch,z.visibility,z.archived?"yes":"no"]))})}catch(m){xi(m)}}),R.command("git:add <repo>","Connect and optionally bind a Git repository").option("--branch <branch>","Default branch to deploy",{default:"main"}).option("--connection <id>","Reuse a connection ID or name").option("--provider <provider>","github, gitlab, bitbucket, gitea, generic_https, or generic_ssh").option("--host <url>","Provider API host").option("--name <name>","Connection name").option("--token-env <name>","Environment variable containing the access token").option("--url <clone-url>","Credential-free clone URL").option("--site <slug>","Bind the repository to an application").option("--root <path>","Monorepo root",{default:"."}).option("--include <globs>","Comma-separated watched paths").option("--exclude <globs>","Comma-separated ignored paths").option("--tag <glob>","Deploy matching tags instead of branch pushes").option("--full-clone","Use full history instead of a shallow clone").option("--submodules","Initialize repository submodules").option("--deploy-key <name>","Deploy-key display name").option("--public-key <path>","SSH public-key file").option("--private-key <path>","SSH private-key file").option("--host-key <key>","Pinned SSH host key").option("--ssh-host <host>","SSH clone host").option("--yes","Skip confirmation").action(async(t,m)=>{try{if(!m.yes&&!await d(`Connect ${t}?`,!0))return;let k=await Pi((I)=>zd(I,t,m));if(n(`Connected ${k.repository.fullName}`),e(`Connection: ${k.connection.name} (${k.connection.id})`),m.site)e(`Application binding: ${m.site}`)}catch(k){xi(k)}}),R.command("git:import","Import site.repository entries from cloud.config.ts").option("--connection <id>","Reuse a connection ID or name").option("--token-env <name>","Environment variable containing provider token").option("--yes","Skip confirmation").action(async(t)=>{try{await Pi(async(m)=>{let k=Object.entries(m.config.sites??{}).filter(([,I])=>I.repository?.url);if(!k.length)throw Error("No site.repository entries were found");if(!t.yes&&!await d(`Import ${k.length} repository configuration${k.length===1?"":"s"}?`,!0))return;for(let[I,L]of k){let z=L.repository,Y=z.provider==="custom"?void 0:z.provider;await zd(m,z.url,{connection:t.connection,tokenEnv:t.tokenEnv,site:I,provider:Y,branch:z.branch??"main",tag:z.strategy==="tag"?z.tag??z.tagPattern??"v*":void 0,url:z.url}),n(`Imported ${I} · ${z.url}`)}})}catch(m){xi(m)}}),R.command("git:branches <repo>","List branches or tags visible to a connection").option("--connection <id>","Connection ID or name").option("--tags","List tags instead of branches").option("--deploy-key <id>","SSH deploy-key ID").action(async(t,m)=>{try{await Pi(async({sources:k,controlPlane:I})=>{let L=ys(k,I.organization.id,m.connection);if(!L)throw Error("Choose a connection with --connection <id>");let z=k.listRepositories(L.id).find((Z)=>Z.id===t||Z.fullName.toLowerCase()===t.toLowerCase());if(!z)throw Error(`Repository ${t} was not found`);let Y=await dr(k,{connectionId:L.id,repository:z.fullName,repositoryId:z.id,type:m.tags?"tags":"branches",deployKeyId:m.deployKey??k.listDeployKeys(L.id)[0]?.id});c([m.tags?"Tag":"Branch","Commit","Protected"],Y.refs.map((Z)=>[Z.name,Z.commitSha,Z.protected?"yes":"no"]))})}catch(k){xi(k)}}),R.command("git:deploy <branch>","Queue an idempotent deployment from a Git branch").option("--binding <id>","Source binding ID").option("--repo <owner/name>","Bound repository").option("--env <environment>","Target environment",{default:"production"}).action(async(t,m)=>{try{await Pi(async({sources:k,controlPlane:I})=>{let L=I.environments.get(m.env??"production");if(!L)throw Error(`Environment ${m.env} was not found`);let z=k.listBindings({projectId:I.project.id,status:"active"}).find((ie)=>(!m.binding||ie.id===m.binding)&&(!m.repo||ie.repositoryFullName.toLowerCase()===m.repo.toLowerCase())&&(!ie.environmentId||ie.environmentId===L.id));if(!z)throw Error("No active source binding matched; use --binding or --repo");let Z=(await dr(k,{connectionId:z.connectionId,repository:z.repositoryFullName,repositoryId:z.repositoryId,type:"branches",deployKeyId:z.deployKeyId})).refs.find((ie)=>ie.name===t);if(!Z)throw Error(`Branch ${t} was not found`);let X=I.store.createOperation({projectId:z.projectId,environmentId:L.id,resourceId:z.resourceId,kind:"deploy.source",idempotencyKey:`cli-source:${z.id}:${Z.commitSha}`,correlationId:`cli-source:${z.id}:${Z.commitSha}`,input:{source:{connectionId:z.connectionId,bindingId:z.id,repository:z.repositoryFullName,commitSha:Z.commitSha,branch:t,monorepoRoot:z.monorepoRoot,submodules:z.submodules,cloneDepth:z.cloneDepth??null}}});n(`Deployment queued: ${X.id}`),e(`${z.repositoryFullName}@${t} · ${Z.commitSha}`)})}catch(k){xi(k)}}),R.command("git:webhook:add <repo>","Create and reconcile a signed auto-deploy webhook").option("--connection <id>","Connection ID or name").option("--base-url <url>","Public HTTPS dashboard URL").action(async(t,m)=>{try{await Pi(async({sources:k,controlPlane:I})=>{let L=ys(k,I.organization.id,m.connection);if(!L)throw Error("Choose a connection with --connection <id>");let z=k.listRepositories(L.id).find((oe)=>oe.id===t||oe.fullName.toLowerCase()===t.toLowerCase());if(!z)throw Error(`Repository ${t} was not found`);let Y=m.baseUrl??process.env.TS_CLOUD_WEBHOOK_BASE_URL;if(!Y)throw Error("Pass --base-url or set TS_CLOUD_WEBHOOK_BASE_URL");let Z=k.createWebhook({connectionId:L.id,repositoryId:z.id,repositoryFullName:z.fullName}),X=$t(Y,Z.webhook),ie=await ur(k,Z.webhook.id,Y);n(`Webhook ${ie.status}: ${X}`),e("The signing secret is encrypted and is not printed.")})}catch(k){xi(k)}}),R.command("git:webhook:remove <webhook>","Disable and remove a provider webhook").option("--yes","Skip confirmation").action(async(t,m)=>{try{await Pi(async({sources:k,controlPlane:I})=>{let L=k.listConnections(I.organization.id).flatMap((Y)=>k.listWebhooks(Y.id)).find((Y)=>Y.id===t||Y.repositoryFullName.toLowerCase()===t.toLowerCase());if(!L)throw Error(`Webhook ${t} was not found`);if(!m.yes&&!await d(`Remove webhook for ${L.repositoryFullName}?`,!0))return;let z=await eo(k,L.id);n(`Webhook disabled: ${z.id}`)})}catch(k){xi(k)}}),R.command("git:disconnect <connection>","Preview and disconnect a Git provider connection").option("--yes","Skip confirmation").action(async(t,m)=>{try{await Pi(async({sources:k,controlPlane:I})=>{let L=ys(k,I.organization.id,t);if(!L)throw Error(`Source connection ${t} was not found`);let z=k.listBindings({connectionId:L.id,status:"active"});e(`${z.length} active binding${z.length===1?"":"s"} will be disabled.`);for(let Y of z)e(`  ${Y.repositoryFullName} · ${Y.branchRule??Y.defaultBranch} · ${Y.monorepoRoot}`);if(!m.yes&&!await d(`Disconnect ${L.name}?`,!1))return;k.disconnectConnection(L.id),n(`Disconnected ${L.name}`)})}catch(k){xi(k)}})}import{readFileSync as Wd,writeFileSync as nf}from"node:fs";import{resolve as Zs}from"node:path";async function rf(){let R=await Ne(),t=y(process.cwd(),R),m=_(process.cwd());return{config:R,controlPlane:t,drafts:new ni(t.store),artifacts:new oi(t.store,{cwd:process.cwd()}),registries:new ii(t.store,{encryptionKey:m}),sources:new lr(t.store,{encryptionKey:m})}}async function br(R){let t=await rf();try{return await R(t)}finally{t.controlPlane.store.close()}}function Sn(R){r(R instanceof Error?R.message:"Application onboarding command failed")}function Ud(R){return JSON.parse(Wd(Zs(R),"utf8"))}function of(R){let t=R.site,m=["laravel","php","statamic","wordpress"].includes(t.type),k=["static","spa"].includes(t.type)||!t.start&&!m,I=k?{kind:"static",publishDirectory:t.root??t.webDirectory??"dist",buildCommand:t.build}:{kind:"server",runtime:m?"php":"bun",runtimeVersion:m?t.phpVersion:void 0,installCommand:m?"composer install --no-dev --prefer-dist --optimize-autoloader":void 0,buildCommand:t.build,startCommand:t.start??(m?"php -S 0.0.0.0:$PORT -t public":"bun run start")};return{schemaVersion:1,name:t.name??R.siteSlug,slug:R.siteSlug,projectId:R.projectId,environmentId:R.environmentId,source:R.source??{kind:"local",root:t.root??"."},build:I,runtime:{target:"server",architecture:t.architecture==="arm64"?"arm64":"x86_64",port:k?void 0:Number(t.port??3000),healthCheck:k?void 0:{protocol:"http",path:t.healthCheck?.path??"/health"}},domain:t.domain?{hostname:t.domain,tls:t.ssl?.provider!=="none"}:void 0}}function Nc(R){R.command("app:detect [root]","Detect application frameworks without executing project code").action(async(t=".")=>{try{let m=Lt(ri(Zs(t)));c(["Framework","Strategy","Confidence","Evidence"],m.map((k)=>[k.framework,k.strategy,`${Math.round(k.confidence*100)}%`,k.evidence.map((I)=>I.path).join(", ")||"manual"]));for(let k of m)e(`${k.framework}: ${k.description}`)}catch(m){Sn(m)}}),R.command("app:plan <draft>","Validate and preview a secret-free application draft").option("--secrets <names>","Comma-separated configured secret names").action(async(t,m)=>{try{let k=ue(Ud(t),m.secrets?.split(",").map((I)=>I.trim()).filter(Boolean));if(e(JSON.stringify(k,null,2)),!k.valid)Sn(Error("Plan is not deployable; resolve the reported issues and missing secrets."))}catch(k){Sn(k)}}),R.command("app:draft:save <draft>","Persist or update a resumable application draft").option("--id <id>","Existing draft ID").option("--version <version>","Expected draft version").option("--step <step>","Wizard step",{default:"source"}).option("--secrets <names>","Comma-separated configured secret names").action(async(t,m)=>{try{await br(async({drafts:k,controlPlane:I})=>{let L=Ud(t),z=m.secrets?.split(",").map((Z)=>Z.trim()).filter(Boolean)??[],Y=m.id?k.update(m.id,Number(m.version),{draft:L,step:m.step,suppliedSecretNames:z}):k.create({organizationId:I.organization.id,projectId:I.project.id,name:L.name,draft:{...L,projectId:I.project.id},step:m.step,suppliedSecretNames:z});n(`Draft saved: ${Y.id} · v${Y.version} · ${Y.status}`)})}catch(k){Sn(k)}}),R.command("app:drafts","List resumable application drafts").action(async()=>{try{await br(async({drafts:t,controlPlane:m})=>{let k=t.list(m.project.id);c(["ID","Application","Step","Status","Version","Updated"],k.map((I)=>[I.id,I.input.name,I.step,I.status,String(I.version),I.updatedAt]))})}catch(t){Sn(t)}}),R.command("app:export <draft>","Export a deterministic application manifest").option("--output <path>","Output path",{default:"application.manifest.json"}).action(async(t,m)=>{try{await br(async({drafts:k})=>{let I=k.get(t);if(!I)throw Error(`Draft ${t} was not found`);let L=ue(I.input,I.suppliedSecretNames),z=Zs(m.output??"application.manifest.json");nf(z,L.serializedManifest,{mode:384}),n(`Manifest exported: ${z}`)})}catch(k){Sn(k)}}),R.command("app:deploy <draft>","Confirm and queue a validated application plan").option("--confirm <environment>","Exact target environment slug").action(async(t,m)=>{try{await br(async({drafts:k,controlPlane:I})=>{let L=k.get(t);if(!L)throw Error(`Draft ${t} was not found`);if(!m.confirm)throw Error("Pass --confirm <environment> to acknowledge the target and recurring cost drivers");let z=Jr({controlPlane:I.store,drafts:k,draftId:t,expectedVersion:L.version,confirmEnvironment:m.confirm});n(`Application queued: ${z.operation.id}`),e(`Cost drivers: ${z.plan.costDrivers.join(", ")}`)})}catch(k){Sn(k)}}),R.command("app:import <site>","Import an existing cloud.config.ts site as a draft").option("--connection <id>","Git connection ID for repository-backed sites").option("--env <environment>","Target environment",{default:"production"}).action(async(t,m)=>{try{await br(async({config:k,controlPlane:I,sources:L,drafts:z})=>{let Y=k.sites?.[t];if(!Y)throw Error(`Site ${t} was not found`);let Z=I.environments.get(m.env??"production");if(!Z)throw Error(`Environment ${m.env} was not found`);let X;if(Y.repository?.url){if(!m.connection)throw Error("Repository-backed imports require --connection <id>");let ae=L.getConnection(m.connection);if(!ae)throw Error("Git connection was not found");let be=Ec(Y.repository.url),Ae=L.listRepositories(ae.id).find((de)=>de.fullName.toLowerCase()===be.fullName.toLowerCase());if(!Ae)throw Error(`Repository ${be.fullName} is not synchronized`);X={kind:"git",connectionId:ae.id,repositoryId:Ae.id,repositoryFullName:Ae.fullName,ref:Y.repository.branch??"main"}}let ie=of({site:Y,siteSlug:t,projectId:I.project.id,environmentId:Z.id,source:X}),oe=z.create({organizationId:I.organization.id,projectId:I.project.id,name:`Import ${t}`,draft:ie,step:"review"});n(`Imported draft: ${oe.id}`)})}catch(k){Sn(k)}}),R.command("app:artifact:add <file>","Inspect and store a bounded ZIP or TAR artifact").action(async(t)=>{try{await br(async({artifacts:m,controlPlane:k})=>{let I=Zs(t),L=m.create({organizationId:k.organization.id,projectId:k.project.id,filename:I.split("/").pop(),bytes:Wd(I)});n(`Artifact stored: ${L.id} · ${L.entryCount} entries · ${L.sha256}`)})}catch(m){Sn(m)}}),R.command("app:registry:add <host>","Create an encrypted private-registry connection").option("--name <name>","Connection name",{default:"Container registry"}).option("--provider <provider>","docker_hub, ghcr, ecr, gcr, or generic",{default:"generic"}).option("--username-env <name>","Username environment variable",{default:"REGISTRY_USERNAME"}).option("--password-env <name>","Password environment variable",{default:"REGISTRY_PASSWORD"}).option("--token-env <name>","Bearer-token environment variable",{default:"REGISTRY_TOKEN"}).action(async(t,m)=>{try{await br(async({registries:k,controlPlane:I})=>{let L={username:process.env[m.usernameEnv],password:process.env[m.passwordEnv],token:process.env[m.tokenEnv]},z=k.create({organizationId:I.organization.id,provider:m.provider,name:m.name,host:t,credential:Object.values(L).some(Boolean)?L:void 0});n(`Registry connection created: ${z.id}`)})}catch(k){Sn(k)}}),R.command("app:registries","List safe registry connection metadata").action(async()=>{try{await br(async({registries:t,controlPlane:m})=>c(["ID","Name","Provider","Host","Status"],t.list(m.organization.id).map((k)=>[k.id,k.name,k.provider,k.host,k.status])))}catch(t){Sn(t)}}),R.command("app:registry:test <id>","Test registry and optional image pull access").option("--image <image>","Image reference").action(async(t,m)=>{try{await br(async({registries:k})=>{let I=await k.test(t,{image:m.image});e(`${I.status}: ${I.healthMessage}`)})}catch(k){Sn(k)}}),R.command("app:registry:rotate <id>","Rotate write-only registry credentials").option("--username-env <name>","Username environment variable",{default:"REGISTRY_USERNAME"}).option("--password-env <name>","Password environment variable",{default:"REGISTRY_PASSWORD"}).option("--token-env <name>","Bearer-token environment variable",{default:"REGISTRY_TOKEN"}).option("--expires <date>","Credential expiry timestamp").action(async(t,m)=>{try{await br(async({registries:k})=>{let I={username:process.env[m.usernameEnv],password:process.env[m.passwordEnv],token:process.env[m.tokenEnv]};if(!Object.values(I).some(Boolean))throw Error("Set at least one configured registry credential environment variable");let L=k.rotate(t,I,{expiresAt:m.expires?new Date(m.expires).toISOString():void 0});n(`Registry credential rotated: ${L.id} · ${L.status}`)})}catch(k){Sn(k)}}),R.command("app:registry:disconnect <id>","Disconnect and erase registry credentials").option("--yes","Skip confirmation").action(async(t,m)=>{try{await br(async({registries:k,drafts:I,controlPlane:L})=>{let z=k.get(t);if(!z)throw Error(`Registry ${t} was not found`);let Y=I.list(L.project.id).filter((Z)=>Z.input.source.kind==="image"&&Z.input.source.registryConnectionId===t||Z.input.build.kind==="prebuilt_image"&&Z.input.build.registryConnectionId===t);if(e(`${Y.length} application draft${Y.length===1?"":"s"} reference this registry.`),!m.yes&&!await d(`Disconnect ${z.name}?`,!1))return;k.disconnect(t),n(`Disconnected ${z.name}`)})}catch(k){Sn(k)}})}import{existsSync as sf,readFileSync as af,writeFileSync as cf}from"node:fs";function Oc(R,t){r(`'${R}' is not implemented yet.`),e(t),process.exitCode=1}function lf(R){let t={};for(let m of R.split(`
+${ee}
+`}function $c(R){R.command("cost:analyze","Rank AWS services by cost for the last full month").option("--output","Also write a markdown report to ./aws.md").option("--no-cache","Skip the local response cache (always hit AWS — costs $0.01)").action(async(t)=>{let m=t?.profile,k=t?.cache!==!1,{start:I,end:L,label:z}=Gp();i(`Cost Analysis — ${z}${m?` (profile: ${m})`:""}`);let Y=new s("Querying AWS Cost Explorer...");Y.start();let Z=new et(m,{useCache:k}),X;try{X=await Z.getCostByService({start:I,end:L})}catch(ce){Y.stop(),r(`Cost Explorer request failed: ${ce?.message??ce}`),e(`
+This command needs the ce:GetCostAndUsage IAM permission.`);return}let ee=null,oe=!1;if(X.some((ce)=>ce.service===Sc))try{ee=(await new g("us-east-1",m).listBuckets()).Buckets?.length??0}catch{oe=!0}if(Y.stop(),X.length===0){e("No billed services in this period.");return}let se=X.reduce((ce,Se)=>ce+Se.amount,0),ue=X.map((ce)=>{let Se="-";if(ce.service===Sc){if(oe)Se="unknown (no s3:ListAllMyBuckets)";else if(ee!==null)Se=`${ee} bucket${ee===1?"":"s"}`}let xe=se>0?`${(ce.amount/se*100).toFixed(1)}%`:"—";return[ce.service,Se,cn(ce.amount),xe]});if(c(["Service","Resources","Cost","% of Total"],ue),e(`
+Total: ${cn(se)} across ${X.length} service${X.length===1?"":"s"}`),Z.lastCacheAgeSeconds!==null)e(`(cached, ${Z.lastCacheAgeSeconds}s old — pass --no-cache to refresh)`);if((X.find((ce)=>ce.service===Sc)?.amount??0)>1&&ee===0)a(`
+S3 has spend but listBuckets returned 0. The buckets are likely owned by a different account in your AWS Organization (consolidated billing rolls up to the payer account, but ListBuckets only shows buckets owned by the calling account).`);if(t?.output){let ce=`${process.cwd()}/aws.md`;await Bun.write(ce,Kp({label:z,profile:m,rows:ue,total:se,count:X.length})),n(`
+Wrote ${ce}`)}}),R.command("cost:cache:clear","Wipe the local Cost Explorer response cache").option("--all","Wipe entries for every profile (default: just the current profile)").action(async(t)=>{let m=t?.all?void 0:t?.profile,k=Xc(m),I=Jc(m);e(`Cleared ${I.deletedFiles} cached response${I.deletedFiles===1?"":"s"} for ${I.scope}`),e(`(${k})`)}),R.command("cost","Show current month-to-date AWS spend and projected total").option("--env <environment>","Environment (production, staging, development)").option("--no-cache","Skip the local response cache").action(async(t)=>{let m=Ld(),k=new et(t?.profile,{useCache:t?.cache!==!1});i(`AWS Cost — ${m.label}${t?.profile?` (profile: ${t.profile})`:""}`);let I=new s("Querying month-to-date AWS spend...");I.start();try{let[L,z]=await Promise.all([k.getCostByService({start:m.start,end:m.end,granularity:"DAILY"}),k.getCostByService({start:m.previous.start,end:m.previous.end,granularity:"MONTHLY"})]);I.stop();let Z=vc(L,z).map((se)=>{let ue=yc(se.amount,m.daysElapsed,m.daysInMonth);return[se.service,cn(se.amount),cn(ue),cn(se.previousAmount),qs(ds(ue,se.previousAmount))]});c(["Service","MTD","Projected",m.previous.label,"Change"],Z);let X=L.reduce((se,ue)=>se+ue.amount,0),ee=z.reduce((se,ue)=>se+ue.amount,0),oe=yc(X,m.daysElapsed,m.daysInMonth);e(`
+MTD: ${cn(X)} through day ${m.daysElapsed} of ${m.daysInMonth}`),e(`Projected: ${cn(oe)} (${qs(ds(oe,ee))} vs ${m.previous.label})`)}catch(L){I.stop(),Cc(L)}}),R.command("cost:breakdown","Cost breakdown by service").option("--env <environment>","Environment (production, staging, development)").option("--days <days>","Number of days to analyze",{default:"30"}).option("--no-cache","Skip the local response cache").action(async(t)=>{let m=Number.parseInt(t?.days??"30",10),k;try{k=$o(m)}catch(z){r(z instanceof Error?z.message:String(z));return}let I=new et(t?.profile,{useCache:t?.cache!==!1});i(`AWS Cost Breakdown — ${k.current.label}${t?.profile?` (profile: ${t.profile})`:""}`);let L=new s("Comparing AWS service spend...");L.start();try{let[z,Y]=await Promise.all([I.getCostByService({start:k.current.start,end:k.current.end,granularity:"DAILY"}),I.getCostByService({start:k.previous.start,end:k.previous.end,granularity:"DAILY"})]);L.stop();let Z=vc(z,Y);c(["Service",`Last ${m}d`,`Previous ${m}d`,"Trend"],Z.map((oe)=>[oe.service,cn(oe.amount),cn(oe.previousAmount),qs(oe.changePercent)]));let X=z.reduce((oe,se)=>oe+se.amount,0),ee=Y.reduce((oe,se)=>oe+se.amount,0);e(`
+Total: ${cn(X)} (${qs(ds(X,ee))})`)}catch(z){L.stop(),Cc(z)}}),R.command("cost:egress","Rank AWS data-transfer usage types by cost").option("--days <days>","Number of days to analyze",{default:"30"}).option("--no-cache","Skip the local response cache").action(async(t)=>{let m=Number.parseInt(t?.days??"30",10),k;try{k=$o(m).current}catch(z){r(z instanceof Error?z.message:String(z));return}let I=new et(t?.profile,{useCache:t?.cache!==!1});i(`AWS Egress Cost — ${k.label}${t?.profile?` (profile: ${t.profile})`:""}`);let L=new s("Querying data-transfer usage types...");L.start();try{let z=Us(await I.getCostByDimension({start:k.start,end:k.end,dimension:"USAGE_TYPE",granularity:"DAILY"}));if(L.stop(),z.length===0){e("No billed data-transfer usage types were found in this period.");return}c(["Usage type","Cost"],z.map((Y)=>[Y.key,cn(Y.amount)])),e(`
+Total ranked egress: ${cn(z.reduce((Y,Z)=>Y+Z.amount,0))}`),e("Usage types classify NAT, internet, inter-AZ, and inter-region transfer; destination correlation requires VPC Flow Logs.")}catch(z){L.stop(),Cc(z)}}),R.command("resources","List all resources").option("--env <environment>","Environment (production, staging, development)").option("--type <type>","Resource type (ec2, rds, s3, lambda, etc.)").option("--region <region>","AWS region for regional resources").action(async(t)=>{i(`AWS Resources${t?.profile?` (profile: ${t.profile})`:""}`);let m=new s("Discovering tagged and untagged resources...");m.start();let k=new us(t?.profile,t?.region);try{let I=await k.discover({type:t?.type});if(m.stop(),I.resources.length===0)e("No matching resources were discovered.");else c(["Type","Name","Region","State","Monthly cost"],I.resources.map((L)=>[`${L.service}:${L.type}`,L.name,L.region??"global",L.state??"unknown","— (requires CUR resource IDs)"])),e(`
+${I.resources.length} resource${I.resources.length===1?"":"s"} discovered.`);for(let L of I.warnings)a(L)}catch(I){m.stop(),r(`Resource discovery failed: ${I instanceof Error?I.message:String(I)}`)}}),R.command("resources:unused","Find unused resources").option("--env <environment>","Environment (production, staging, development)").option("--type <type>","Limit analysis to one resource type").option("--region <region>","AWS region for regional resources").action(async(t)=>{i(`Unused AWS Resources${t?.profile?` (profile: ${t.profile})`:""}`);let m=new s("Evaluating inventory and CloudWatch idle signals...");m.start();try{let k=await new Ws(t?.profile,t?.region).unused({type:t?.type});if(m.stop(),k.findings.length===0)e("No resources met the conservative unused-resource thresholds.");else{c(["Resource","Signal","Recommendation","Monthly savings"],k.findings.map((L)=>[`${L.resource.service}:${L.resource.type}/${L.resource.name}`,L.signal,L.recommendation,L.monthlySavings==null?"—":cn(L.monthlySavings)]));let I=k.findings.reduce((L,z)=>L+(z.monthlySavings??0),0);e(`
+Known monthly savings: ${k.savingsAvailable?cn(I):"unavailable (enable CUR resource IDs)"}`)}for(let I of k.inventory.warnings)a(I)}catch(k){m.stop(),r(`Unused-resource analysis failed: ${k instanceof Error?k.message:String(k)}`)}}),R.command("optimize","Suggest cost optimizations").option("--env <environment>","Environment (production, staging, development)").option("--type <type>","Limit analysis to one resource type").option("--region <region>","AWS region for regional resources").option("--include-commitments","Include estimated RI and Savings Plan candidates").action(async(t)=>{i(`AWS Cost Optimizations${t?.profile?` (profile: ${t.profile})`:""}`);let m=new s("Combining inventory, CloudWatch signals, and Cost Explorer line items...");m.start();try{let k=await new Ws(t?.profile,t?.region).optimize({type:t?.type,includeCommitments:t?.includeCommitments});if(m.stop(),k.recommendations.length===0)e("No resources met the conservative optimization thresholds.");else{c(["Category","Resource","Current","Projected","Savings","Source signal","Recommendation"],k.recommendations.map((L)=>[L.category,`${L.resource.service}:${L.resource.type}/${L.resource.name}`,L.currentCost==null?"—":cn(L.currentCost),L.projectedCost==null?"—":cn(L.projectedCost),L.monthlySavings==null?"—":cn(L.monthlySavings),L.sourceSignal,L.recommendation]));let I=k.recommendations.reduce((L,z)=>L+(z.monthlySavings??0),0);e(`
+Estimated monthly savings: ${k.savingsAvailable?cn(I):"unavailable (enable CUR resource IDs)"}`)}for(let I of k.warnings)a(I);e("Estimates are directional; validate workload peaks and current AWS pricing before applying changes.")}catch(k){m.stop(),r(`Optimization analysis failed: ${k instanceof Error?k.message:String(k)}`)}})}async function Eo(R){let t=await De(),m=R??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let k=y(process.cwd(),t);return{config:t,env:m,controlPlane:k,controls:new sr(k.store)}}function No(R){r(R instanceof Error?R.message:String(R)),process.exitCode=1}function jd(R){let t=R?.infrastructure?.compute??{};return{ddos:t.ddos===!1?void 0:typeof t.ddos==="object"?t.ddos:{ports:[80,443]},waf:t.waf===!1?void 0:typeof t.waf==="object"?t.waf:{mode:"detection"}}}function kc(R){R.command("protect:status","Show the current edge-protection posture").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{try{let m=await Eo(t.env),k=m.controls.current(),I=ro(k);if(t.json){e(JSON.stringify({posture:I,controls:m.controls.raw()},null,2));return}if(i("Edge protection"),I.mitigationPaused||I.attackMode)a(I.summary);else n(I.summary);let L=jd(m.config);if(e(`L3/L4 mitigation: ${L.ddos?"enabled":"disabled in config"}`),e(`WAF: ${L.waf?`enabled (${L.waf.mode??"detection"})`:"disabled in config"}`),e(`Allowlist: ${k.ipRules.allow.length} entry(s)`),e(`Blocklist: ${k.ipRules.block.length} entry(s)`),k.ipRules.allow.length>0||k.ipRules.block.length>0)c(["List","CIDR"],[...k.ipRules.allow.map((z)=>["allow",z]),...k.ipRules.block.map((z)=>["block",z])])}catch(m){No(m)}}),R.command("protect:attack-mode <state>","Challenge every visitor for a bounded window (on|off)").option("--hours <hours>",`How long before it lifts itself (default ${$n}, max ${or})`).option("--reason <reason>","Why, for the record").option("--env <environment>","Target environment").action(async(t,m)=>{try{let k=await Eo(m.env);if(t==="off"){n(k.controls.disableAttackMode()?"Attack mode is off.":"Attack mode was not on.");return}if(t!=="on")throw Error("State must be 'on' or 'off'.");let I=k.controls.enableAttackMode({hours:m.hours==null?void 0:Number(m.hours),reason:m.reason??"Enabled from the CLI."});a("Attack mode is ON. Every visitor is challenged, including legitimate ones."),e(`It lifts itself at ${I.expiresAt} — you do not need to remember.`)}catch(k){No(k)}}),R.command("protect:pause <state>","Pause or resume automatic mitigation (on|off)").option("--hours <hours>",`How long (max ${or})`).option("--reason <reason>","Why — required when pausing").option("--env <environment>","Target environment").action(async(t,m)=>{try{let k=await Eo(m.env);if(t==="off"){n(k.controls.resumeMitigations()?"Automatic mitigation resumed.":"Mitigation was not paused.");return}if(t!=="on")throw Error("State must be 'on' or 'off'.");if(!m.reason)throw Error("--reason is required: you are liable for the traffic this admits.");let I=k.controls.pauseMitigations({hours:m.hours==null?void 0:Number(m.hours),reason:m.reason});a("Automatic mitigation is PAUSED. All traffic is served, and billed, including attacks."),e(`It resumes automatically at ${I.expiresAt}.`)}catch(k){No(k)}}),R.command("protect:allow <cidr>","Never rate-limit or block this IP or CIDR").option("--remove","Remove the entry instead").option("--env <environment>","Target environment").action(async(t,m)=>{try{let k=await Eo(m.env),I=m.remove?k.controls.removeIpRule("allow",t):k.controls.addIpRule("allow",t);n(`Allowlist now has ${I.allow.length} entry(s).`),e("It reaches the boxes on the next deploy. `cloud protect:apply` shows exactly what will land.")}catch(k){No(k)}}),R.command("protect:block <cidr>","Drop traffic from this IP or CIDR at the kernel").option("--remove","Remove the entry instead").option("--env <environment>","Target environment").action(async(t,m)=>{try{let k=await Eo(m.env),I=m.remove?k.controls.removeIpRule("block",t):k.controls.addIpRule("block",t);n(`Blocklist now has ${I.block.length} entry(s).`),e("It reaches the boxes on the next deploy. `cloud protect:apply` shows exactly what will land.")}catch(k){No(k)}}),R.command("protect:apply","Print the ruleset the current controls produce").option("--env <environment>","Target environment").option("--waf","Print the WAF configuration instead of the firewall script").action(async(t)=>{try{let m=await Eo(t.env),k=jd(m.config);if(t.waf){if(!k.waf)throw Error("The WAF is disabled in this configuration.");let I=Ni(k.waf);for(let L of I.warnings)a(L);e(I.config);return}if(!k.ddos)throw Error("L3/L4 mitigation is disabled in this configuration.");e(Dr(Ln(k.ddos,m.controls.current())))}catch(m){No(m)}})}async function En(R){let t=await De(),m=R??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let k=y(process.cwd(),t),I=k.environments.get(m),L=new Cr(k.store),z=new bt(k.store,{encryptionKey:_(process.cwd())});return{config:t,env:m,controlPlane:k,environmentRecord:I,store:L,alerts:z,service:new St(L),gate:new Ht(k.store),organizationId:k.organization.id,projectId:k.project.id}}function Gs(R){if(R==null)return;let t=String(R).trim().replace(/[$,\s]/g,"");if(!t)return;if(/^\d+c$/i.test(t))return Number.parseInt(t,10);let m=Number(t);if(!Number.isFinite(m)||m<0)throw Error(`Invalid amount: ${R}`);return Math.round(m*100)}function Bd(R){if(!R)return;let t=R.split(",").map((m)=>m.trim()).filter(Boolean);for(let m of t)if(!lo.includes(m))throw Error(`Unknown enforcement action '${m}'. Valid: ${lo.join(", ")}`);return t}function _d(R){if(R==null)return"monthly";if(R==="daily"||R==="weekly"||R==="monthly")return R;throw Error(`Unknown period '${R}'. Valid: daily, weekly, monthly`)}function Jp(R){return an[R]?.label??R}function Yp(R,t=24){let m=Math.max(0,Math.min(t,Math.round(R/100*t)));return`${"█".repeat(m)}${"░".repeat(t-m)}`}function Nn(R){r(R instanceof Error?R.message:String(R)),process.exitCode=1}function Pc(R){R.command("usage","Show current usage, cost, and remaining budget headroom").option("--env <environment>","Target environment").option("--period <period>","daily, weekly, or monthly (default monthly)").option("--timezone <tz>","IANA timezone for period boundaries (default UTC)").option("--json","Print structured JSON").action(async(t)=>{try{let m=await En(t.env),k=m.service.usageReport({organizationId:m.organizationId,projectId:m.projectId,period:_d(t.period),timezone:t.timezone});if(t.json){e(JSON.stringify(k,null,2));return}if(i(`Usage — ${k.window.label}`),e(`Total: ${te(k.totalCents,k.currency)}`),k.byMeter.length===0)e("No metered usage in this window yet.");else c(["Meter","Provider","Quantity","Cost"],k.byMeter.map((I)=>[Jp(I.meter),I.provider||"-",I.quantity.toLocaleString(void 0,{maximumFractionDigits:3}),te(I.costCents,k.currency)]));if(k.budgets.length===0){a("No budgets are configured. Nothing is capping this project."),e("Create one with: cloud budget:create --name 'Monthly' --hard 200");return}if(i("Budgets"),c(["Name","Period","Spent","Limit","Used","Projected","Time to cap","State"],k.budgets.map((I)=>[I.name+(I.dryRun?" (dry run)":""),I.period,te(I.spentCents,k.currency),I.limitCents==null?"-":te(I.limitCents,k.currency),`${Yp(I.usedPercent)} ${I.usedPercent.toFixed(0)}%`,`${te(I.projectedCents,k.currency)} (${(I.projectionConfidence*100).toFixed(0)}% conf)`,I.timeToCap||"-",I.level])),k.enforcement.strongestAction)a(`Enforcement in force: ${k.enforcement.strongestAction}`)}catch(m){Nn(m)}}),R.command("budget:list","List budgets governing this project").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{try{let m=await En(t.env),k=m.store.listBudgets({organizationId:m.organizationId,projectId:m.projectId});if(t.json){e(JSON.stringify(k,null,2));return}if(k.length===0){a("No budgets configured.");return}c(["ID","Name","Scope","Period","Soft","Hard","Mode","Enabled"],k.map((I)=>[I.id.slice(0,8),I.name,I.environmentId?"environment":I.projectId?"project":"organization",I.period,I.softLimitCents==null?"-":te(I.softLimitCents,I.currency),I.hardLimitCents==null?"-":te(I.hardLimitCents,I.currency),I.dryRun?"dry run":"enforcing",I.enabled?"yes":"no"]))}catch(m){Nn(m)}}),R.command("budget:create","Create a spend budget").option("--name <name>","Budget name").option("--soft <amount>","Soft limit in dollars (warn only)").option("--hard <amount>","Hard limit in dollars (enforces)").option("--period <period>","daily, weekly, or monthly (default monthly)").option("--timezone <tz>","IANA timezone for period boundaries (default UTC)").option("--scope <scope>","organization, project, or environment (default project)").option("--actions <list>","Comma-separated actions to run at 100% (default notify,block_builds,block_deployments)").option("--grace <seconds>","Seconds a breach must persist before enforcing").option("--dry-run","Evaluate and report but never enforce").option("--env <environment>","Target environment").action(async(t)=>{try{if(!t.name)throw Error("--name is required.");let m=await En(t.env),k=t.scope??"project";if(!["organization","project","environment"].includes(k))throw Error(`Unknown scope '${k}'. Valid: organization, project, environment`);let I=Bd(t.actions),L=m.store.createBudget({organizationId:m.organizationId,projectId:k==="organization"?void 0:m.projectId,environmentId:k==="environment"?m.environmentRecord?.id:void 0,name:t.name,period:_d(t.period),timezone:t.timezone,softLimitCents:Gs(t.soft),hardLimitCents:Gs(t.hard),graceSeconds:t.grace==null?void 0:Number(t.grace),thresholds:I?[{atPercent:80,actions:["notify"]},{atPercent:100,actions:I}]:[...po],dryRun:t.dryRun===!0});n(`Created budget '${L.name}' (${L.id}).`),e(`Mode: ${L.dryRun?"dry run — reports only, enforces nothing":"enforcing"}`),e(`Ladder: ${L.thresholds.map((z)=>`${z.atPercent}% → ${z.actions.join("+")}`).join(", ")}`)}catch(m){Nn(m)}}),R.command("budget:update <budgetId>","Update a budget").option("--soft <amount>","Soft limit in dollars").option("--hard <amount>","Hard limit in dollars").option("--enable","Enable the budget").option("--disable","Disable the budget").option("--enforce","Leave dry run and start enforcing").option("--dry-run","Return to dry run").option("--env <environment>","Target environment").action(async(t,m)=>{try{let k=await En(m.env),I=k.store.getBudget(t);if(!I)throw Error(`Budget '${t}' was not found.`);let L=k.store.updateBudget(t,{softLimitCents:Gs(m.soft)??I.softLimitCents,hardLimitCents:Gs(m.hard)??I.hardLimitCents,enabled:m.disable?!1:m.enable?!0:I.enabled,dryRun:m.enforce?!1:m.dryRun?!0:I.dryRun});n(`Updated budget '${L.name}'.`),e(`Mode: ${L.dryRun?"dry run":"enforcing"} · Enabled: ${L.enabled?"yes":"no"}`)}catch(k){Nn(k)}}),R.command("budget:delete <budgetId>","Delete a budget and lift anything it was enforcing").option("--env <environment>","Target environment").action(async(t,m)=>{try{let k=await En(m.env),I=k.store.getBudget(t);if(!I)throw Error(`Budget '${t}' was not found.`);let L=k.gate.closeBudget(t);if(k.store.deleteBudget(t),n(`Deleted budget '${I.name}'.`),L>0)e(`Lifted ${L} enforcement action(s) it had in force.`)}catch(k){Nn(k)}}),R.command("spend:check","Run one spend cycle now and report what it would do").option("--env <environment>","Target environment").option("--apply","Actually apply enforcement (default is a preview)").option("--json","Print structured JSON").action(async(t)=>{try{let m=await En(t.env),k=new Ti({controlPlane:m.controlPlane.store,store:m.store,alerts:t.apply?m.alerts:void 0});if(!t.apply){let z=m.store.budgetsForScope(m.organizationId,m.projectId).map((Y)=>m.service.status(Y));if(t.json){e(JSON.stringify(z,null,2));return}if(i("Spend check (preview — nothing was applied)"),z.length===0){a("No budgets govern this project.");return}c(["Budget","Used","Projected","Level","Would apply"],z.map((Y)=>[Y.budget.name,`${Y.decision.usedPercent.toFixed(1)}%`,`${Y.decision.projectedPercent.toFixed(1)}%`,Y.decision.level,Y.decision.actions.join(", ")||"-"])),e(`
+Run with --apply to enforce.`);return}let I=await k.run({organizationId:m.organizationId,projectId:m.projectId,environmentId:m.environmentRecord?.id,environmentKind:m.environmentRecord?.kind});if(t.json){e(JSON.stringify(I,null,2));return}if(i("Spend cycle"),e(`Evaluated ${I.decisions.length} budget(s) in ${I.durationMs}ms.`),I.applied.length>0)a(`Applied: ${I.applied.join(", ")}`);if(I.released.length>0)n(`Released: ${I.released.join(", ")}`);if(I.withheld.length>0)a(`Withheld pending approval: ${I.withheld.join(", ")}`);if(I.anomalies.length>0)a(`${I.anomalies.length} anomaly(ies) detected.`);e(`Notifications queued: ${I.notificationsSent}`);for(let L of I.warnings)a(L);if(I.applied.length===0&&I.released.length===0)n("Nothing to change.")}catch(m){Nn(m)}}),R.command("spend:work","Run the spend loop continuously: meter, evaluate, enforce, notify").option("--env <environment>","Target environment").option("--interval <seconds>",`Seconds between cycles (default ${Ei})`).option("--once","Run a single cycle and exit").action(async(t)=>{try{let m=await En(t.env),k=new Ti({controlPlane:m.controlPlane.store,store:m.store,alerts:m.alerts}),I={organizationId:m.organizationId,projectId:m.projectId,environmentId:m.environmentRecord?.id,environmentKind:m.environmentRecord?.kind};if(t.once){let X=await k.run(I);n(`Cycle finished in ${X.durationMs}ms.`);for(let ee of X.warnings)a(ee);return}let L=Math.max(10,Number(t.interval??Ei)),z=new ho(m.controlPlane.store,{owner:`cli:${process.pid}`});i(`Spend worker (every ${L}s)`),e("Press Ctrl+C to stop.");let Y=Os(k,{intervalSeconds:L,lease:z,immediate:!0,onResult:(X)=>{let ee=X.flatMap((ue)=>ue.applied),oe=X.flatMap((ue)=>ue.released),se=X.flatMap((ue)=>ue.warnings);if(ee.length>0)a(`Applied: ${ee.join(", ")}`);if(oe.length>0)n(`Released: ${oe.join(", ")}`);for(let ue of se)a(ue)},onSkip:(X)=>e(`Skipped: ${X} holds the loop lease.`),onError:(X)=>r(X instanceof Error?X.message:String(X))}),Z=()=>{Y(),e(`
+Spend worker stopped; the loop lease was released.`),process.exit(0)};process.on("SIGINT",Z),process.on("SIGTERM",Z),await new Promise(()=>{})}catch(m){Nn(m)}}),R.command("spend:status","Show enforcement currently in force").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{try{let m=await En(t.env),k=m.gate.listUnder({organizationId:m.organizationId});if(t.json){e(JSON.stringify(k,null,2));return}if(k.length===0){n("No spend enforcement is in force.");return}c(["Action","Budget","Scope","Mode","Since","Reason"],k.map((I)=>[I.action,I.budgetId.slice(0,8),I.environmentId?"environment":I.projectId?"project":"organization",I.simulated?"dry run":"enforcing",I.appliedAt,I.reason]))}catch(m){Nn(m)}}),R.command("spend:release <budgetId> <action>","Manually lift one enforcement action").option("--env <environment>","Target environment").action(async(t,m,k)=>{try{let I=await En(k.env),L=Bd(m)?.[0];if(!L)throw Error("An action is required.");if(!I.gate.close(t,L))throw Error(`${L} was not in force for budget ${t}.`);n(`Lifted ${L} for budget ${t}.`),a("The next spend cycle will re-apply this if spend is still over the threshold.")}catch(I){Nn(I)}}),R.command("anomaly:config","Tune anomaly detection for a signal").option("--signal <signal>","Signal to configure (default cost)").option("--sensitivity <level>","low, medium, or high").option("--season <points>","Points per season: 24 for daily, 168 for weekly").option("--min-delta <amount>","Absolute change below which nothing is reported, in the signal's units").option("--severity <severity>","info, warning, or critical").option("--disable","Stop detecting this signal").option("--enable","Resume detecting this signal").option("--list","List configured signals instead of changing one").option("--signals","List every detectable signal and its data rules").option("--env <environment>","Target environment").action(async(t)=>{try{if(t.signals){c(["Signal","Source","Empty hour","Min samples","Unit"],zt.map((z)=>[z.key,z.source,z.gapPolicy==="zero"?"counts as zero":"ignored",String(z.minSamples),z.unit]));return}let m=await En(t.env),k=m.service.anomalyConfigs;if(t.list){let z=k.list({organizationId:m.organizationId,projectId:m.projectId});if(z.length===0){e("No signals are configured; every one uses its shipped defaults.");return}c(["Signal","Enabled","Sensitivity","Season","Min delta","Severity"],z.map((Y)=>[Y.signal,Y.enabled?"yes":"no",Y.sensitivity,String(Y.seasonLength),String(Y.minAbsoluteDelta),Y.severity]));return}let I=t.sensitivity;if(I&&!["low","medium","high"].includes(I))throw Error("--sensitivity must be low, medium, or high.");let L=k.upsert({organizationId:m.organizationId,projectId:m.projectId,signal:t.signal??"cost",sensitivity:I,seasonLength:t.season==null?void 0:Number(t.season),minAbsoluteDelta:t.minDelta==null?void 0:Number(t.minDelta),severity:t.severity,enabled:t.disable?!1:t.enable?!0:void 0});n(`Anomaly detection for '${L.signal}' updated.`),e(`${L.enabled?"Enabled":"Disabled"} · ${L.sensitivity} sensitivity · season ${L.seasonLength} · floor ${L.minAbsoluteDelta} · ${L.severity}`)}catch(m){Nn(m)}}),R.command("anomaly:silence","Skip detection for a signal, route, or status code").option("--signal <signal>","Signal to silence").option("--route <pattern>","Route glob, e.g. /webhooks/**").option("--status <code>","HTTP status code").option("--reason <reason>","Why — required").option("--until <timestamp>","ISO timestamp the silence expires").option("--list","List active silences").option("--remove <id>","Remove a silence").option("--env <environment>","Target environment").action(async(t)=>{try{let m=await En(t.env),k=m.service.anomalyConfigs;if(t.remove){n(k.removeSilence(t.remove)?"Silence removed.":"That silence was not found.");return}if(t.list){let L=k.listSilences({organizationId:m.organizationId,projectId:m.projectId});if(L.length===0){n("No active silences.");return}c(["ID","Signal","Route","Status","Expires","Reason"],L.map((z)=>[z.id.slice(0,8),z.signal??"-",z.routePattern??"-",z.statusCode==null?"-":String(z.statusCode),z.expiresAt??"never",z.reason]));return}if(!t.reason)throw Error("--reason is required: someone will ask why this stopped alerting.");let I=k.silence({organizationId:m.organizationId,projectId:m.projectId,signal:t.signal,routePattern:t.route,statusCode:t.status==null?void 0:Number(t.status),reason:t.reason,expiresAt:t.until});if(n(`Silenced (${I.id.slice(0,8)}).`),!I.expiresAt)a("This silence never expires. Pass --until to bound it, or it will outlive the reason for it.")}catch(m){Nn(m)}}),R.command("spend:anomalies","List detected spend anomalies").option("--env <environment>","Target environment").option("--unacknowledged","Only anomalies nobody has acknowledged").option("--json","Print structured JSON").action(async(t)=>{try{let m=await En(t.env),k=m.store.listAnomalies({organizationId:m.organizationId,projectId:m.projectId,unacknowledgedOnly:t.unacknowledged===!0});if(t.json){e(JSON.stringify(k,null,2));return}if(k.length===0){n("No anomalies detected.");return}c(["Hour","Signal","Direction","Observed","Expected","Score","Severity"],k.map((I)=>[I.bucketStart,I.signal,I.direction,te(I.observed),te(I.expected),I.score.toFixed(1),I.severity]))}catch(m){Nn(m)}})}import{readFileSync as Zp}from"node:fs";var Qp={github:"GITHUB_TOKEN",gitlab:"GITLAB_TOKEN",bitbucket:"BITBUCKET_TOKEN",gitea:"GITEA_TOKEN",generic_https:"GIT_TOKEN"},Xp={github:"https://github.com",gitlab:"https://gitlab.com",bitbucket:"https://bitbucket.org",gitea:"https://gitea.com"};function xc(R,t={}){if(t.provider&&!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(t.provider))throw Error(`Unsupported Git provider: ${t.provider}`);let m=t.cloneUrl??(/^(?:https?:\/\/|ssh:\/\/|git@)/.test(R)?R:void 0),k="",I=m??R;if(m?.startsWith("git@")){let Y=/^git@([^:]+):(.+)$/.exec(m);if(!Y)throw Error("SSH repository URL must use git@host:owner/name.git");k=Y[1],I=Y[2]}else if(m){let Y=new URL(m);k=Y.hostname,I=Y.pathname}if(I=I.replace(/^\/+|\/+$/g,"").replace(/\.git$/,""),!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(I))throw Error("Repository must use owner/name or a supported clone URL");let L=t.provider??(k.includes("github")?"github":k.includes("gitlab")?"gitlab":k.includes("bitbucket")?"bitbucket":k.includes("gitea")?"gitea":m?.startsWith("git@")||m?.startsWith("ssh://")?"generic_ssh":m?"generic_https":"github"),z=t.host??Xp[L]??(k?`https://${k}`:"");if(!z)throw Error("A provider host is required");return{provider:L,host:z,fullName:I,cloneUrl:m}}async function ef(){let R=await De(),t=y(process.cwd(),R);return{config:R,controlPlane:t,sources:new dr(t.store,{encryptionKey:_(process.cwd())})}}async function ki(R){let t=await ef();try{return await R(t)}finally{t.controlPlane.store.close()}}function ps(R,t,m){let k=R.listConnections(t);if(!m)return k.length===1?k[0]:void 0;return k.find((I)=>I.id===m||I.name.toLowerCase()===m.toLowerCase())}function Md(R,t){if(!R)throw Error(`${t} file is required`);return Zp(R,"utf8")}async function tf(R,t,m,k){if(["github","gitlab","bitbucket","gitea"].includes(t.provider)){let L=R.listRepositories(t.id).find((Z)=>Z.fullName.toLowerCase()===m.fullName.toLowerCase());if(L)return L;let Y=(await Jr(R,t.id,{search:m.fullName,maxPages:20})).find((Z)=>Z.fullName.toLowerCase()===m.fullName.toLowerCase());if(!Y)throw Error(`Repository ${m.fullName} is not granted to this connection`);return Y}let I=k.url??m.cloneUrl;if(!I)throw Error("Generic Git connections require --url <clone-url>");return R.upsertRepository({connectionId:t.id,providerRepositoryId:`manual:${m.fullName}`,fullName:m.fullName,cloneUrl:I,defaultBranch:k.branch??"main",visibility:"unknown",archived:!1,metadata:{source:"cli"}})}async function zd(R,t,m){let k=xc(t,{provider:m.provider,host:m.host,cloneUrl:m.url}),I=ps(R.sources,R.controlPlane.organization.id,m.connection);if(!I){if(m.connection)throw Error(`Source connection ${m.connection} was not found`);let z=m.tokenEnv??Qp[k.provider],Y=z?process.env[z]:void 0;if(["github","gitlab","bitbucket","gitea"].includes(k.provider)&&!Y)throw Error(`Set ${z} or pass --token-env <name>; secrets are never accepted as command arguments`);let Z=k.provider==="generic_ssh"?{publicKey:Md(m.publicKey,"Public key"),privateKey:Md(m.privateKey,"Private key"),hostKey:m.hostKey??""}:void 0;R.controlPlane.store.database.transaction(()=>{if(I=R.sources.createConnection({organizationId:R.controlPlane.organization.id,provider:k.provider,name:m.name??`${k.provider.replace("_"," ")} · ${new URL(k.host).host}`,host:k.host,owner:k.fullName.split("/")[0],authKind:k.provider==="generic_ssh"?"deploy_key":Y?"access_token":"none",credential:Y?{token:Y}:void 0}),Z)R.sources.createDeployKey({connectionId:I.id,name:m.deployKey??`${k.fullName} deploy key`,...Z,host:m.sshHost??new URL(k.host).hostname,actorId:void 0})})()}if(!I)throw Error("Source connection could not be created");if(I.status==="disconnected")throw Error("The selected source connection is disconnected");let L=await tf(R.sources,I,k,m);if(m.site){let z=R.controlPlane.environments.get("production")??[...R.controlPlane.environments.values()][0],Y=R.controlPlane.store.listResources(R.controlPlane.project.id,z?.id).find((X)=>X.kind==="application"&&X.slug===m.site);if(!Y)throw Error(`Application ${m.site} was not found`);let Z=I.provider==="generic_ssh"?R.sources.listDeployKeys(I.id)[0]:void 0;R.sources.createBinding({projectId:R.controlPlane.project.id,environmentId:z?.id,resourceId:Y.id,connectionId:I.id,repositoryId:L.id,repositoryFullName:L.fullName,defaultBranch:m.branch??L.defaultBranch,branchRule:m.tag?void 0:m.branch??L.defaultBranch,tagRule:m.tag,monorepoRoot:m.root??".",includePaths:m.include?.split(",").map((X)=>X.trim()).filter(Boolean),excludePaths:m.exclude?.split(",").map((X)=>X.trim()).filter(Boolean),submodules:m.submodules,cloneDepth:m.fullClone?void 0:20,deployKeyId:Z?.id})}return{connection:I,repository:L}}function xi(R){r(R instanceof Error?R.message:"Git integration command failed")}function Dc(R){R.command("git:connections","List encrypted Git provider connections").action(async()=>{try{await ki(async({sources:t,controlPlane:m})=>{let k=t.listConnections(m.organization.id);c(["ID","Name","Provider","Status","Credential","Last sync"],k.map((I)=>[I.id,I.name,I.provider,I.status,I.credentialConfigured?"encrypted":"none",I.lastSyncedAt??"-"]))})}catch(t){xi(t)}}),R.command("git:repositories","List repositories granted to a connection").option("--connection <id>","Connection ID or name").action(async(t)=>{try{await ki(async({sources:m,controlPlane:k})=>{let I=ps(m,k.organization.id,t.connection);if(!I)throw Error("Choose a connection with --connection <id>");let L=m.listRepositories(I.id);c(["ID","Repository","Default branch","Visibility","Archived"],L.map((z)=>[z.id,z.fullName,z.defaultBranch,z.visibility,z.archived?"yes":"no"]))})}catch(m){xi(m)}}),R.command("git:add <repo>","Connect and optionally bind a Git repository").option("--branch <branch>","Default branch to deploy",{default:"main"}).option("--connection <id>","Reuse a connection ID or name").option("--provider <provider>","github, gitlab, bitbucket, gitea, generic_https, or generic_ssh").option("--host <url>","Provider API host").option("--name <name>","Connection name").option("--token-env <name>","Environment variable containing the access token").option("--url <clone-url>","Credential-free clone URL").option("--site <slug>","Bind the repository to an application").option("--root <path>","Monorepo root",{default:"."}).option("--include <globs>","Comma-separated watched paths").option("--exclude <globs>","Comma-separated ignored paths").option("--tag <glob>","Deploy matching tags instead of branch pushes").option("--full-clone","Use full history instead of a shallow clone").option("--submodules","Initialize repository submodules").option("--deploy-key <name>","Deploy-key display name").option("--public-key <path>","SSH public-key file").option("--private-key <path>","SSH private-key file").option("--host-key <key>","Pinned SSH host key").option("--ssh-host <host>","SSH clone host").option("--yes","Skip confirmation").action(async(t,m)=>{try{if(!m.yes&&!await d(`Connect ${t}?`,!0))return;let k=await ki((I)=>zd(I,t,m));if(n(`Connected ${k.repository.fullName}`),e(`Connection: ${k.connection.name} (${k.connection.id})`),m.site)e(`Application binding: ${m.site}`)}catch(k){xi(k)}}),R.command("git:import","Import site.repository entries from cloud.config.ts").option("--connection <id>","Reuse a connection ID or name").option("--token-env <name>","Environment variable containing provider token").option("--yes","Skip confirmation").action(async(t)=>{try{await ki(async(m)=>{let k=Object.entries(m.config.sites??{}).filter(([,I])=>I.repository?.url);if(!k.length)throw Error("No site.repository entries were found");if(!t.yes&&!await d(`Import ${k.length} repository configuration${k.length===1?"":"s"}?`,!0))return;for(let[I,L]of k){let z=L.repository,Y=z.provider==="custom"?void 0:z.provider;await zd(m,z.url,{connection:t.connection,tokenEnv:t.tokenEnv,site:I,provider:Y,branch:z.branch??"main",tag:z.strategy==="tag"?z.tag??z.tagPattern??"v*":void 0,url:z.url}),n(`Imported ${I} · ${z.url}`)}})}catch(m){xi(m)}}),R.command("git:branches <repo>","List branches or tags visible to a connection").option("--connection <id>","Connection ID or name").option("--tags","List tags instead of branches").option("--deploy-key <id>","SSH deploy-key ID").action(async(t,m)=>{try{await ki(async({sources:k,controlPlane:I})=>{let L=ps(k,I.organization.id,m.connection);if(!L)throw Error("Choose a connection with --connection <id>");let z=k.listRepositories(L.id).find((Z)=>Z.id===t||Z.fullName.toLowerCase()===t.toLowerCase());if(!z)throw Error(`Repository ${t} was not found`);let Y=await ur(k,{connectionId:L.id,repository:z.fullName,repositoryId:z.id,type:m.tags?"tags":"branches",deployKeyId:m.deployKey??k.listDeployKeys(L.id)[0]?.id});c([m.tags?"Tag":"Branch","Commit","Protected"],Y.refs.map((Z)=>[Z.name,Z.commitSha,Z.protected?"yes":"no"]))})}catch(k){xi(k)}}),R.command("git:deploy <branch>","Queue an idempotent deployment from a Git branch").option("--binding <id>","Source binding ID").option("--repo <owner/name>","Bound repository").option("--env <environment>","Target environment",{default:"production"}).action(async(t,m)=>{try{await ki(async({sources:k,controlPlane:I})=>{let L=I.environments.get(m.env??"production");if(!L)throw Error(`Environment ${m.env} was not found`);let z=k.listBindings({projectId:I.project.id,status:"active"}).find((ee)=>(!m.binding||ee.id===m.binding)&&(!m.repo||ee.repositoryFullName.toLowerCase()===m.repo.toLowerCase())&&(!ee.environmentId||ee.environmentId===L.id));if(!z)throw Error("No active source binding matched; use --binding or --repo");let Z=(await ur(k,{connectionId:z.connectionId,repository:z.repositoryFullName,repositoryId:z.repositoryId,type:"branches",deployKeyId:z.deployKeyId})).refs.find((ee)=>ee.name===t);if(!Z)throw Error(`Branch ${t} was not found`);let X=I.store.createOperation({projectId:z.projectId,environmentId:L.id,resourceId:z.resourceId,kind:"deploy.source",idempotencyKey:`cli-source:${z.id}:${Z.commitSha}`,correlationId:`cli-source:${z.id}:${Z.commitSha}`,input:{source:{connectionId:z.connectionId,bindingId:z.id,repository:z.repositoryFullName,commitSha:Z.commitSha,branch:t,monorepoRoot:z.monorepoRoot,submodules:z.submodules,cloneDepth:z.cloneDepth??null}}});n(`Deployment queued: ${X.id}`),e(`${z.repositoryFullName}@${t} · ${Z.commitSha}`)})}catch(k){xi(k)}}),R.command("git:webhook:add <repo>","Create and reconcile a signed auto-deploy webhook").option("--connection <id>","Connection ID or name").option("--base-url <url>","Public HTTPS dashboard URL").action(async(t,m)=>{try{await ki(async({sources:k,controlPlane:I})=>{let L=ps(k,I.organization.id,m.connection);if(!L)throw Error("Choose a connection with --connection <id>");let z=k.listRepositories(L.id).find((oe)=>oe.id===t||oe.fullName.toLowerCase()===t.toLowerCase());if(!z)throw Error(`Repository ${t} was not found`);let Y=m.baseUrl??process.env.TS_CLOUD_WEBHOOK_BASE_URL;if(!Y)throw Error("Pass --base-url or set TS_CLOUD_WEBHOOK_BASE_URL");let Z=k.createWebhook({connectionId:L.id,repositoryId:z.id,repositoryFullName:z.fullName}),X=Mt(Y,Z.webhook),ee=await pr(k,Z.webhook.id,Y);n(`Webhook ${ee.status}: ${X}`),e("The signing secret is encrypted and is not printed.")})}catch(k){xi(k)}}),R.command("git:webhook:remove <webhook>","Disable and remove a provider webhook").option("--yes","Skip confirmation").action(async(t,m)=>{try{await ki(async({sources:k,controlPlane:I})=>{let L=k.listConnections(I.organization.id).flatMap((Y)=>k.listWebhooks(Y.id)).find((Y)=>Y.id===t||Y.repositoryFullName.toLowerCase()===t.toLowerCase());if(!L)throw Error(`Webhook ${t} was not found`);if(!m.yes&&!await d(`Remove webhook for ${L.repositoryFullName}?`,!0))return;let z=await oo(k,L.id);n(`Webhook disabled: ${z.id}`)})}catch(k){xi(k)}}),R.command("git:disconnect <connection>","Preview and disconnect a Git provider connection").option("--yes","Skip confirmation").action(async(t,m)=>{try{await ki(async({sources:k,controlPlane:I})=>{let L=ps(k,I.organization.id,t);if(!L)throw Error(`Source connection ${t} was not found`);let z=k.listBindings({connectionId:L.id,status:"active"});e(`${z.length} active binding${z.length===1?"":"s"} will be disabled.`);for(let Y of z)e(`  ${Y.repositoryFullName} · ${Y.branchRule??Y.defaultBranch} · ${Y.monorepoRoot}`);if(!m.yes&&!await d(`Disconnect ${L.name}?`,!1))return;k.disconnectConnection(L.id),n(`Disconnected ${L.name}`)})}catch(k){xi(k)}})}import{readFileSync as Wd,writeFileSync as nf}from"node:fs";import{resolve as Ys}from"node:path";async function rf(){let R=await De(),t=y(process.cwd(),R),m=_(process.cwd());return{config:R,controlPlane:t,drafts:new oi(t.store),artifacts:new ai(t.store,{cwd:process.cwd()}),registries:new si(t.store,{encryptionKey:m}),sources:new dr(t.store,{encryptionKey:m})}}async function rr(R){let t=await rf();try{return await R(t)}finally{t.controlPlane.store.close()}}function bn(R){r(R instanceof Error?R.message:"Application onboarding command failed")}function Ud(R){return JSON.parse(Wd(Ys(R),"utf8"))}function of(R){let t=R.site,m=["laravel","php","statamic","wordpress"].includes(t.type),k=["static","spa"].includes(t.type)||!t.start&&!m,I=k?{kind:"static",publishDirectory:t.root??t.webDirectory??"dist",buildCommand:t.build}:{kind:"server",runtime:m?"php":"bun",runtimeVersion:m?t.phpVersion:void 0,installCommand:m?"composer install --no-dev --prefer-dist --optimize-autoloader":void 0,buildCommand:t.build,startCommand:t.start??(m?"php -S 0.0.0.0:$PORT -t public":"bun run start")};return{schemaVersion:1,name:t.name??R.siteSlug,slug:R.siteSlug,projectId:R.projectId,environmentId:R.environmentId,source:R.source??{kind:"local",root:t.root??"."},build:I,runtime:{target:"server",architecture:t.architecture==="arm64"?"arm64":"x86_64",port:k?void 0:Number(t.port??3000),healthCheck:k?void 0:{protocol:"http",path:t.healthCheck?.path??"/health"}},domain:t.domain?{hostname:t.domain,tls:t.ssl?.provider!=="none"}:void 0}}function Nc(R){R.command("app:detect [root]","Detect application frameworks without executing project code").action(async(t=".")=>{try{let m=Ut(ii(Ys(t)));c(["Framework","Strategy","Confidence","Evidence"],m.map((k)=>[k.framework,k.strategy,`${Math.round(k.confidence*100)}%`,k.evidence.map((I)=>I.path).join(", ")||"manual"]));for(let k of m)e(`${k.framework}: ${k.description}`)}catch(m){bn(m)}}),R.command("app:plan <draft>","Validate and preview a secret-free application draft").option("--secrets <names>","Comma-separated configured secret names").action(async(t,m)=>{try{let k=pe(Ud(t),m.secrets?.split(",").map((I)=>I.trim()).filter(Boolean));if(e(JSON.stringify(k,null,2)),!k.valid)bn(Error("Plan is not deployable; resolve the reported issues and missing secrets."))}catch(k){bn(k)}}),R.command("app:draft:save <draft>","Persist or update a resumable application draft").option("--id <id>","Existing draft ID").option("--version <version>","Expected draft version").option("--step <step>","Wizard step",{default:"source"}).option("--secrets <names>","Comma-separated configured secret names").action(async(t,m)=>{try{await rr(async({drafts:k,controlPlane:I})=>{let L=Ud(t),z=m.secrets?.split(",").map((Z)=>Z.trim()).filter(Boolean)??[],Y=m.id?k.update(m.id,Number(m.version),{draft:L,step:m.step,suppliedSecretNames:z}):k.create({organizationId:I.organization.id,projectId:I.project.id,name:L.name,draft:{...L,projectId:I.project.id},step:m.step,suppliedSecretNames:z});n(`Draft saved: ${Y.id} · v${Y.version} · ${Y.status}`)})}catch(k){bn(k)}}),R.command("app:drafts","List resumable application drafts").action(async()=>{try{await rr(async({drafts:t,controlPlane:m})=>{let k=t.list(m.project.id);c(["ID","Application","Step","Status","Version","Updated"],k.map((I)=>[I.id,I.input.name,I.step,I.status,String(I.version),I.updatedAt]))})}catch(t){bn(t)}}),R.command("app:export <draft>","Export a deterministic application manifest").option("--output <path>","Output path",{default:"application.manifest.json"}).action(async(t,m)=>{try{await rr(async({drafts:k})=>{let I=k.get(t);if(!I)throw Error(`Draft ${t} was not found`);let L=pe(I.input,I.suppliedSecretNames),z=Ys(m.output??"application.manifest.json");nf(z,L.serializedManifest,{mode:384}),n(`Manifest exported: ${z}`)})}catch(k){bn(k)}}),R.command("app:deploy <draft>","Confirm and queue a validated application plan").option("--confirm <environment>","Exact target environment slug").action(async(t,m)=>{try{await rr(async({drafts:k,controlPlane:I})=>{let L=k.get(t);if(!L)throw Error(`Draft ${t} was not found`);if(!m.confirm)throw Error("Pass --confirm <environment> to acknowledge the target and recurring cost drivers");let z=Xr({controlPlane:I.store,drafts:k,draftId:t,expectedVersion:L.version,confirmEnvironment:m.confirm});n(`Application queued: ${z.operation.id}`),e(`Cost drivers: ${z.plan.costDrivers.join(", ")}`)})}catch(k){bn(k)}}),R.command("app:import <site>","Import an existing cloud.config.ts site as a draft").option("--connection <id>","Git connection ID for repository-backed sites").option("--env <environment>","Target environment",{default:"production"}).action(async(t,m)=>{try{await rr(async({config:k,controlPlane:I,sources:L,drafts:z})=>{let Y=k.sites?.[t];if(!Y)throw Error(`Site ${t} was not found`);let Z=I.environments.get(m.env??"production");if(!Z)throw Error(`Environment ${m.env} was not found`);let X;if(Y.repository?.url){if(!m.connection)throw Error("Repository-backed imports require --connection <id>");let se=L.getConnection(m.connection);if(!se)throw Error("Git connection was not found");let ue=xc(Y.repository.url),ke=L.listRepositories(se.id).find((ce)=>ce.fullName.toLowerCase()===ue.fullName.toLowerCase());if(!ke)throw Error(`Repository ${ue.fullName} is not synchronized`);X={kind:"git",connectionId:se.id,repositoryId:ke.id,repositoryFullName:ke.fullName,ref:Y.repository.branch??"main"}}let ee=of({site:Y,siteSlug:t,projectId:I.project.id,environmentId:Z.id,source:X}),oe=z.create({organizationId:I.organization.id,projectId:I.project.id,name:`Import ${t}`,draft:ee,step:"review"});n(`Imported draft: ${oe.id}`)})}catch(k){bn(k)}}),R.command("app:artifact:add <file>","Inspect and store a bounded ZIP or TAR artifact").action(async(t)=>{try{await rr(async({artifacts:m,controlPlane:k})=>{let I=Ys(t),L=m.create({organizationId:k.organization.id,projectId:k.project.id,filename:I.split("/").pop(),bytes:Wd(I)});n(`Artifact stored: ${L.id} · ${L.entryCount} entries · ${L.sha256}`)})}catch(m){bn(m)}}),R.command("app:registry:add <host>","Create an encrypted private-registry connection").option("--name <name>","Connection name",{default:"Container registry"}).option("--provider <provider>","docker_hub, ghcr, ecr, gcr, or generic",{default:"generic"}).option("--username-env <name>","Username environment variable",{default:"REGISTRY_USERNAME"}).option("--password-env <name>","Password environment variable",{default:"REGISTRY_PASSWORD"}).option("--token-env <name>","Bearer-token environment variable",{default:"REGISTRY_TOKEN"}).action(async(t,m)=>{try{await rr(async({registries:k,controlPlane:I})=>{let L={username:process.env[m.usernameEnv],password:process.env[m.passwordEnv],token:process.env[m.tokenEnv]},z=k.create({organizationId:I.organization.id,provider:m.provider,name:m.name,host:t,credential:Object.values(L).some(Boolean)?L:void 0});n(`Registry connection created: ${z.id}`)})}catch(k){bn(k)}}),R.command("app:registries","List safe registry connection metadata").action(async()=>{try{await rr(async({registries:t,controlPlane:m})=>c(["ID","Name","Provider","Host","Status"],t.list(m.organization.id).map((k)=>[k.id,k.name,k.provider,k.host,k.status])))}catch(t){bn(t)}}),R.command("app:registry:test <id>","Test registry and optional image pull access").option("--image <image>","Image reference").action(async(t,m)=>{try{await rr(async({registries:k})=>{let I=await k.test(t,{image:m.image});e(`${I.status}: ${I.healthMessage}`)})}catch(k){bn(k)}}),R.command("app:registry:rotate <id>","Rotate write-only registry credentials").option("--username-env <name>","Username environment variable",{default:"REGISTRY_USERNAME"}).option("--password-env <name>","Password environment variable",{default:"REGISTRY_PASSWORD"}).option("--token-env <name>","Bearer-token environment variable",{default:"REGISTRY_TOKEN"}).option("--expires <date>","Credential expiry timestamp").action(async(t,m)=>{try{await rr(async({registries:k})=>{let I={username:process.env[m.usernameEnv],password:process.env[m.passwordEnv],token:process.env[m.tokenEnv]};if(!Object.values(I).some(Boolean))throw Error("Set at least one configured registry credential environment variable");let L=k.rotate(t,I,{expiresAt:m.expires?new Date(m.expires).toISOString():void 0});n(`Registry credential rotated: ${L.id} · ${L.status}`)})}catch(k){bn(k)}}),R.command("app:registry:disconnect <id>","Disconnect and erase registry credentials").option("--yes","Skip confirmation").action(async(t,m)=>{try{await rr(async({registries:k,drafts:I,controlPlane:L})=>{let z=k.get(t);if(!z)throw Error(`Registry ${t} was not found`);let Y=I.list(L.project.id).filter((Z)=>Z.input.source.kind==="image"&&Z.input.source.registryConnectionId===t||Z.input.build.kind==="prebuilt_image"&&Z.input.build.registryConnectionId===t);if(e(`${Y.length} application draft${Y.length===1?"":"s"} reference this registry.`),!m.yes&&!await d(`Disconnect ${z.name}?`,!1))return;k.disconnect(t),n(`Disconnected ${z.name}`)})}catch(k){bn(k)}})}import{existsSync as sf,readFileSync as af,writeFileSync as cf}from"node:fs";function Oc(R,t){r(`'${R}' is not implemented yet.`),e(t),process.exitCode=1}function lf(R){let t={};for(let m of R.split(`
 `)){let k=m.trim();if(!k||k.startsWith("#"))continue;let I=k.indexOf("=");if(I===-1)continue;let L=k.slice(0,I).trim(),z=k.slice(I+1).trim();if(z.startsWith('"')&&z.endsWith('"')||z.startsWith("'")&&z.endsWith("'"))z=z.slice(1,-1);t[L]=z}return t}function df(R){return Object.entries(R).sort(([m],[k])=>m.localeCompare(k)).map(([m,k])=>{if(!/[\s#"']/.test(k))return`${m}=${k}`;let I='"'+k.replace(/"/g,"\\\"")+'"';return`${m}=${I}`}).join(`
 `)+`
-`}function Lc(R){R.command("env:list","List configured environments and their deployed stack status").action(async()=>{i("Environments");try{let t=await Ne(),m=Object.keys(t.environments??{});if(!m.length){e("No environments configured. Add environments.<env> to your cloud.config.");return}let k=[];for(let I of m){let L=t.environments[I],z=L?.region||t.project.region||"us-east-1",Y=L?.app?`serverless (${L.app.kind})`:"server/static",Z="not deployed";if(L?.app)try{let X=new v(z),{Stacks:ie}=await X.describeStacks({stackName:$e(t,I)});Z=ie?.[0]?.StackStatus??"not deployed"}catch{Z="not deployed"}k.push([I,L?.type??I,Y,z,Z])}c(["Environment","Type","Kind","Region","Stack status"],k)}catch(t){r(`Failed to list environments: ${t.message}`),process.exitCode=1}}),R.command("env:compare <env1> <env2>","Compare two environments' app configuration").action(async(t,m)=>{i(`Comparing ${t} ↔ ${m}`);try{let k=await Ne(),I=k.environments?.[t],L=k.environments?.[m];if(!I||!L){r(`Both environments must exist in config (have: ${Object.keys(k.environments??{}).join(", ")||"none"}).`),process.exitCode=1;return}let z=(oe,ae="")=>{let be={};for(let[Ae,de]of Object.entries(oe??{})){let ke=ae?`${ae}.${Ae}`:Ae;if(de&&typeof de==="object"&&!Array.isArray(de))Object.assign(be,z(de,ke));else be[ke]=Array.isArray(de)?JSON.stringify(de):String(de)}return be},Y=z(I),Z=z(L),ie=[...new Set([...Object.keys(Y),...Object.keys(Z)])].sort().filter((oe)=>Y[oe]!==Z[oe]).map((oe)=>[oe,Y[oe]??"—",Z[oe]??"—"]);if(!ie.length){n("Identical — no configuration differences.");return}c(["Setting",t,m],ie),e(`
-${ie.length} difference(s)`)}catch(k){r(`Comparison failed: ${k.message}`),process.exitCode=1}}),R.command("env:pull","Download a serverless function's environment to a .env file").option("--env <environment>","Environment (production, staging, development)",{default:"production"}).option("--function <which>","Which function: http | queue | cli",{default:"http"}).option("--file <path>","Output file (default .env.<environment>)").action(async(t)=>{try{let m=await Ne(),k=t?.env||"production",{region:I,functions:L}=Rt(m,k),z=t?.function??"http",X=(await new D(I).getFunction(L[z])).Configuration?.Environment?.Variables??{},ie=t?.file??`.env.${k}`;cf(ie,df(X)),n(`Wrote ${Object.keys(X).length} variable(s) from ${L[z]} → ${ie}`)}catch(m){r(`env:pull failed: ${m.message}`),process.exitCode=1}}),R.command("env:push","Upload a .env file to a serverless function's configuration").option("--env <environment>","Environment (production, staging, development)",{default:"production"}).option("--function <which>","Function: http | queue | cli | all",{default:"all"}).option("--file <path>","Input file (default .env.<environment>)").option("--replace","Replace the entire env instead of merging over the live config").action(async(t)=>{try{let m=await Ne(),k=t?.env||"production",{region:I,functions:L}=Rt(m,k),z=t?.file??`.env.${k}`;if(!sf(z)){r(`File not found: ${z}`),process.exitCode=1;return}let Y=lf(af(z,"utf8")),Z=(t?.function??"all").toLowerCase();if(Z!=="all"&&!["http","queue","cli"].includes(Z)){r("--function must be one of: http, queue, cli, all"),process.exitCode=1;return}let X=Z==="all"?["http","queue","cli"]:[Z],ie=(m.environments?.[k]?.app?.provisionedConcurrency??0)>0,oe=new D(I);for(let ae of X){let be=L[ae],Ae=Y;if(!t?.replace)Ae={...(await oe.getFunction(be)).Configuration?.Environment?.Variables??{},...Y};if(qo(be,Ae),await oe.updateFunctionConfiguration({FunctionName:be,Environment:{Variables:Ae}}),await oe.waitForFunctionActive(be,120),ie){let de=await oe.publishVersion({FunctionName:be});if(de.Version)await oe.updateAlias({FunctionName:be,Name:"live",FunctionVersion:de.Version})}n(`Pushed ${Object.keys(Y).length} var(s) → ${be}${t?.replace?" (replaced)":" (merged)"}${ie?" (published + flipped live alias)":""}`)}e("Note: a subsequent `cloud deploy:serverless` re-injects infra/secret env from config.")}catch(m){r(`env:push failed: ${m.message}`),process.exitCode=1}}),R.command("env:create <name>","Create new environment").action(async(t)=>{Oc(`env:create ${t}`,"Add an `environments.<name>` block to your cloud.config and run `cloud deploy:serverless --env <name>`.")}),R.command("env:switch <name>","Switch active environment").action(async(t)=>{Oc(`env:switch ${t}`,'ts-cloud has no persistent "active" environment — pass --env <name> to each command.')});for(let t of["clone","promote","sync"])R.command(`env:${t} <source> <target>`,`(${t}) environment configuration`).action(async(m,k)=>{Oc(`env:${t} ${m} ${k}`,`Copy the \`environments.${m}\` block to \`environments.${k}\` in cloud.config, then \`cloud deploy:serverless --env ${k}\`.`)});R.command("env:preview <branch>","Create, inspect, rebuild, extend, or destroy an immutable preview").option("--sha <commit>","Exact 40-64 character source commit").option("--pr <number>","Pull request number").option("--site <name>","Application site (defaults to the first site)").option("--env <environment>","Base environment",{default:"production"}).option("--domain <pattern>","HTTPS URL pattern containing {name}").option("--ttl <hours>","Preview lifetime in hours").option("--destroy","Queue teardown for this preview").option("--rebuild","Rebuild the currently recorded commit").option("--extend <hours>","Extend expiry from now/current expiry").option("--get-url","Print the stable preview URL without mutation").option("--yes","Skip destructive confirmation").action(async(t,m)=>{let k;try{let I=await Ne(),L=m.env||"production",z=m.site||Object.keys(I.sites??{})[0];if(!z)throw Error("No application site is configured; pass --site after adding one");k=y(process.cwd(),I);let Y=k.environments.get(L),Z=Y?k.store.listResources(k.project.id,Y.id).find((de)=>de.kind==="application"&&de.slug===z):void 0;if(!Y||!Z)throw Error(`Application ${z} was not found in base environment ${L}`);let X=new Je(k.store),ie=X.previews.getDefinitionForResource(Z.id);if(!ie){let de=I.sites?.[z]?.domain,ke=m.domain||(de?`https://{name}.preview.${de}`:void 0);if(!ke)throw Error("Pass --domain with an HTTPS pattern containing {name} to configure previews");ie=X.previews.createDefinition({projectId:k.project.id,resourceId:Z.id,baseEnvironmentId:Y.id,domainPattern:ke,ttlHours:Number(m.ttl)||void 0})}let oe=Number(m.pr)||void 0,ae=oe?X.previews.findForPullRequest(ie.id,"local",oe):X.previews.findForBranch(ie.id,"local",t);if(m.getUrl){if(!ae)throw Error("Preview was not found");e(ae.url??"URL unavailable");return}if(m.extend){if(!ae)throw Error("Preview was not found");let de=X.previews.extend(ae.id,Number(m.extend));n(`Extended ${de.name} until ${de.expiresAt}`);return}if(m.destroy){if(!ae)throw Error("Preview was not found");if(!m.yes&&!await d(`Destroy ${ae.name} and only its tagged resources?`,!1))return;let de=X.enqueueDestroy(ae,"manual");n(`Preview teardown queued: ${de.id}`);return}if(m.rebuild){if(!ae)throw Error("Preview was not found");let de=X.enqueueDeploy(ae,{reason:"manual_rebuild"});n(`Preview rebuild queued: ${de.id}`);return}if(!m.sha)throw Error("Pass --sha with the exact immutable commit to deploy");let be=X.previews.upsert({definitionId:ie.id,repository:"local",branch:t,pullRequestNumber:oe,commitSha:m.sha}),Ae=X.enqueueDeploy(be.preview,{created:be.created});n(`${be.created?"Preview creation":"Preview update"} queued: ${Ae.id}`),e(`${be.preview.url} · expires ${be.preview.expiresAt}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k?.store.close()}}),R.command("env:cleanup","Remove stale preview environments").option("--dry-run","List cleanup candidates without queuing teardown").option("--max-age <hours>","Also remove previews older than this age").option("--keep <count>","Keep this many newest previews per application").action(async(t)=>{let m;try{let k=await Ne();m=y(process.cwd(),k);let L=new Je(m.store).cleanup({dryRun:t.dryRun,maxAgeHours:Number(t.maxAge)||void 0,keepCount:Number(t.keep)||void 0});c(["Preview","Status","Expires","Reason"],L.candidates.map((z)=>[z.preview.name,z.preview.status,z.preview.expiresAt,z.reasons.join(", ")])),n(t.dryRun?`${L.candidates.length} cleanup candidate(s)`:`${L.operations.length} teardown job(s) queued`)}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}finally{m?.store.close()}}),R.command("env:previews","List persistent preview environments").option("--site <name>","Filter application site").action(async(t)=>{let m;try{let k=await Ne();m=y(process.cwd(),k);let I=new Je(m.store),L=t.site?new Set(m.store.listResources(m.project.id).filter((Y)=>Y.slug===t.site).map((Y)=>Y.id)):void 0,z=I.previews.listInstances({projectId:m.project.id}).filter((Y)=>!L||L.has(Y.resourceId));c(["ID","Name","Status","Branch / PR","Commit","URL","Expires","Cost"],z.map((Y)=>[Y.id,Y.name,Y.status,Y.pullRequestNumber?`PR #${Y.pullRequestNumber}`:Y.branch,Y.commitSha.slice(0,12),Y.url??"—",Y.expiresAt,Y.costEstimate==null?"—":`$${Y.costEstimate.toFixed(2)}`]))}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}finally{m?.store.close()}})}import{readFileSync as Xs}from"node:fs";async function Sr(){let R=await Ne(),t=y(process.cwd(),R);return{config:R,controlPlane:t,applications:new ft(t.store)}}async function Fc(R,t,m){let k=await Sr();try{let I=k.applications.get(R);if(!I)throw Error("Compose application was not found");let L=t??k.controlPlane.store.listEnvironments(I.projectId).find((Y)=>Y.id===I.environmentId)?.slug;if(!L)throw Error("Compose environment was not found");let z=await pr(k.config,L,m(I));if(!z.ok)throw Error(z.stderr||z.error||"Remote Compose command failed");if(z.stdout)e(z.stdout)}finally{k.controlPlane.store.close()}}function Bc(R){R.command("compose:preview <file>","Parse Compose without persistence or provider mutation").option("--name <name>","Application name",{default:"Compose application"}).option("--env <environment>","Target environment",{default:"production"}).action(async(t,m)=>{let k=await Sr();try{let I=k.controlPlane.environments.get(m.env??"production");if(!I)throw Error("Environment was not found");let L=k.applications.preview(Xs(t,"utf8"),{name:m.name??"Compose application",projectId:k.controlPlane.project.id,environmentId:I.id});if(c(["Severity","Path","Code","Message"],L.diagnostics.map((z)=>[z.severity,z.path,z.code,z.message])),!L.valid)process.exitCode=1;else n(`${Object.keys(L.manifest.spec.services).length} services are valid`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("compose:import <file>","Import and persist a validated Compose application").option("--name <name>","Application name").option("--env <environment>","Target environment",{default:"production"}).action(async(t,m)=>{let k=await Sr();try{let I=k.controlPlane.environments.get(m.env??"production");if(!I)throw Error("Environment was not found");let L=m.name??t.split("/").at(-2)??"Compose application",z=k.applications.import(Xs(t,"utf8"),{name:L,projectId:k.controlPlane.project.id,environmentId:I.id});n(`Imported ${z.application.name} (${z.application.id})`),e(`${Object.keys(z.application.manifest.spec.services).length} services · ${z.parsed.diagnostics.length} diagnostic(s)`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("compose:templates","List pinned verified Compose templates").action(()=>c(["ID","Version","Category","Architecture","Verified"],hr().map((t)=>[t.id,t.version,t.category,t.architecture,t.lastVerifiedAt]))),R.command("compose:catalog <file>","Validate and inspect a local/custom template catalog").option("--env <environment>","Target environment",{default:"production"}).action(async(t,m)=>{let k=await Sr();try{let I=k.controlPlane.environments.get(m.env??"production");if(!I)throw Error("Environment was not found");let L=yc(Xs(t,"utf8"),{projectId:k.controlPlane.project.id,environmentId:I.id});if(c(["ID","Version","Category","Services","Checksum"],L.templates.map((z)=>[z.template.id,z.template.version,z.template.category,String(Object.keys(z.parsed.manifest.spec.services).length),z.template.checksum.slice(0,12)])),L.diagnostics.length)c(["Severity","Path","Message"],L.diagnostics.map((z)=>[z.severity,z.path,z.message]));if(!L.valid)process.exitCode=1}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("compose:template <template>","Create an editable application from a template").option("--name <name>","Application name").option("--domain <domain>","Primary domain").option("--env <environment>","Target environment",{default:"production"}).option("--version <version>","Pinned template version").action(async(t,m)=>{let k=await Sr();try{let I=k.controlPlane.environments.get(m.env??"production");if(!I)throw Error("Environment was not found");let L=k.applications.fromTemplate(t,{domain:m.domain??""},{name:m.name??t,projectId:k.controlPlane.project.id,environmentId:I.id,version:m.version});n(`Created ${L.application.name} from ${t}@${L.application.templateVersion}`),e(`Export with cloud compose:export ${L.application.id}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("compose:list","List Compose applications").action(async()=>{let t=await Sr();try{c(["ID","Name","Status","Services","Source","Updated"],t.applications.list({projectId:t.controlPlane.project.id}).map((m)=>[m.id,m.name,m.status,String(Object.keys(m.manifest.spec.services).length),m.templateId?`${m.templateId}@${m.templateVersion}`:"compose",m.updatedAt]))}finally{t.controlPlane.store.close()}}),R.command("compose:export <application>","Print a normalized editable Compose file").action(async(t)=>{let m=await Sr();try{let k=m.applications.get(t);if(!k)throw Error("Compose application was not found");e(mi(k.manifest))}finally{m.controlPlane.store.close()}}),R.command("compose:diff <application> <file>","Compare persisted and proposed Compose manifests").action(async(t,m)=>{let k=await Sr();try{let I=k.applications.get(t);if(!I)throw Error("Compose application was not found");let L=Bt(Xs(m,"utf8"),I.manifest.metadata);c(["Path","Before","After"],gs(I.manifest,L.manifest).map((z)=>[z.path,JSON.stringify(z.before),JSON.stringify(z.after)]))}finally{k.controlPlane.store.close()}});for(let t of["deploy","redeploy","start","stop"])R.command(`compose:${t} <application>`,`${t} a Compose application through the durable queue`).action(async(m)=>{let k=await Sr();try{let I=k.applications.get(m);if(!I)throw Error("Compose application was not found");let L=new Ke(k.controlPlane.store).enqueue(I,t);n(`${t} queued: ${L.id}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}});R.command("compose:scale <application> <service> <replicas>","Scale one capable Compose service").action(async(t,m,k)=>{let I=await Sr();try{let L=I.applications.get(t);if(!L)throw Error("Compose application was not found");let z=new Ke(I.controlPlane.store).enqueue(L,"scale",{service:m,replicas:Number(k)});n(`Scale queued: ${z.id}`)}catch(L){r(L instanceof Error?L.message:String(L)),process.exitCode=1}finally{I.controlPlane.store.close()}}),R.command("compose:delete <application>","Delete a Compose stack; named volumes are preserved by default").option("--remove-volumes","Also permanently remove named volumes").option("--confirm <text>","Exact application confirmation").action(async(t,m)=>{let k=await Sr();try{let I=k.applications.get(t);if(!I)throw Error("Compose application was not found");let L=new Ke(k.controlPlane.store).enqueue(I,"delete",{removeVolumes:m.removeVolumes,confirmation:m.confirm});n(`Deletion queued: ${L.id}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("compose:logs <application> <service>","Read ordered service logs").option("--lines <count>","Tail line count",{default:"200"}).option("--env <environment>","Target environment").action((t,m,k)=>Fc(t,k.env,(I)=>gi(I.manifest,m,Number(k.lines)||200))),R.command("compose:shell <application> <service> [command...]","Run a command in one service").option("--env <environment>","Target environment").action((t,m,k,I)=>Fc(t,I.env,(L)=>fi(L.manifest,m,k?.length?k:["sh"]))),R.command("compose:apply <application>","Internal durable Compose runtime action").option("--action <action>","Runtime action").option("--env <environment>","Target environment").option("--service <service>","Service name").option("--replicas <count>","Replica count").option("--remove-volumes","Remove named volumes").action((t,m)=>Fc(t,m.env,(k)=>{if(m.action==="scale")return Sc(k.manifest,m.service??"",Number(m.replicas));return bc(k.manifest,m.action??"deploy",{service:m.service,removeVolumes:m.removeVolumes})}))}import{readFileSync as uf}from"node:fs";async function xr(){let R=await Ne(),t=y(process.cwd(),R);return{controlPlane:t,releases:new ut(t.store)}}function _c(R){if(!R)return{};return JSON.parse(uf(R,"utf8"))}function Mc(R){R.command("release:artifact <uri>","Register a verified content-addressed artifact").option("--digest <sha256>","Required sha256: digest").option("--kind <kind>","Deployable kind").option("--size <bytes>","Artifact size",{default:"0"}).option("--media-type <type>","Artifact media type").action(async(t,m)=>{let k=await xr();try{let I=k.releases.releases.registerArtifact({organizationId:k.controlPlane.organization.id,digest:String(m.digest??""),kind:m.kind??"compute",uri:t,size:Number(m.size),mediaType:m.mediaType});n(`Artifact registered: ${I.id}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("release:create <resource> <artifact>","Create an immutable release record").option("--env <environment>","Target environment",{default:"production"}).option("--kind <kind>","Deployable kind").option("--source-sha <sha>","Exact source commit").option("--strategy <strategy>","Activation strategy",{default:"atomic"}).option("--manifest <file>","Immutable manifest JSON").option("--config <file>","Resolved non-secret config JSON").option("--health-path <path>","HTTP health path").option("--approval","Require an environment approval").option("--trigger <trigger>","Build trigger",{default:"manual"}).action(async(t,m,k)=>{let I=await xr();try{let L=I.controlPlane.environments.get(k.env??"production"),z=L?I.controlPlane.store.listResources(I.controlPlane.project.id,L.id).find((Z)=>Z.slug===t):void 0;if(!L||!z)throw Error("Release resource was not found");let Y=I.releases.releases.create({organizationId:I.controlPlane.organization.id,projectId:I.controlPlane.project.id,environmentId:L.id,resourceId:z.id,artifactId:m,kind:k.kind??"compute",sourceSha:k.sourceSha,config:_c(k.config),manifest:_c(k.manifest),strategy:k.strategy??"atomic",healthGate:k.healthPath?{protocol:"http",path:k.healthPath,timeoutSeconds:5,intervalSeconds:5,healthyThreshold:2,unhealthyThreshold:2}:void 0,approvalRequired:k.approval,trigger:k.trigger});n(`Release created: ${Y.id} (${Y.status})`)}catch(L){r(L instanceof Error?L.message:String(L)),process.exitCode=1}finally{I.controlPlane.store.close()}}),R.command("release:list","List unified release history").option("--env <environment>","Filter environment").action(async(t)=>{let m=await xr();try{let k=t.env?m.controlPlane.environments.get(t.env):void 0;c(["ID","Resource","Status","Kind","Artifact","Strategy","Source","Created"],m.releases.releases.list({projectId:m.controlPlane.project.id,environmentId:k?.id}).map((I)=>[I.id,m.controlPlane.store.getResource(I.resourceId)?.slug??I.resourceId,I.status,I.kind,I.artifactId.slice(0,12),I.strategy,I.sourceSha?.slice(0,12)??"—",I.createdAt]))}finally{m.controlPlane.store.close()}}),R.command("release:show <release>","Show provenance, health, approvals, and transitions").action(async(t)=>{let m=await xr();try{let k=m.releases.releases.get(t);if(!k)throw Error("Release was not found");e(JSON.stringify({release:k,artifact:m.releases.releases.getArtifact(k.artifactId),approvals:m.releases.releases.approvals(t),transitions:m.releases.releases.transitions(t)},null,2))}finally{m.controlPlane.store.close()}}),R.command("release:compare <left> <right>","Compare artifact, source, config, manifest, and data caveats").action(async(t,m)=>{let k=await xr();try{let I=k.releases.releases.compare(t,m);e(JSON.stringify(I,null,2))}finally{k.controlPlane.store.close()}}),R.command("release:capabilities <kind>","Explain supported deployment strategies").option("--health","Readiness gate is configured").option("--replicas <count>","Replica count",{default:"1"}).action((t,m)=>c(["Strategy","Supported","Capacity","Cost","Explanation","Rollback"],mr({kind:t,hasHealthGate:!!m.health,replicas:Number(m.replicas)}).map((k)=>[k.strategy,k.supported?"yes":"no",`${k.capacityMultiplier}x`,k.costImpact,k.explanation,k.rollback]))),R.command("release:promote <release> <resource>","Promote the same artifact without rebuilding").option("--env <environment>","Target environment").option("--config <file>","Target non-secret config JSON").option("--approval","Require approval").action(async(t,m,k)=>{let I=await xr();try{let L=I.controlPlane.environments.get(String(k.env??"")),z=L?I.controlPlane.store.listResources(I.controlPlane.project.id,L.id).find((Z)=>Z.slug===m):void 0;if(!L||!z)throw Error("Promotion target was not found");let Y=I.releases.releases.promote(t,{targetEnvironmentId:L.id,targetResourceId:z.id,config:_c(k.config),approvalRequired:k.approval});n(`Promoted without rebuild: ${Y.id} (${Y.status})`)}catch(L){r(L instanceof Error?L.message:String(L)),process.exitCode=1}finally{I.controlPlane.store.close()}}),R.command("release:approve <release>","Approve or reject an environment gate").option("--actor <id>","Approving actor ID").option("--reject","Reject instead").option("--comment <text>","Approval comment").action(async(t,m)=>{let k=await xr();try{if(!m.actor)throw Error("--actor is required");let I=k.releases.releases.approve(t,{actorId:m.actor,decision:m.reject?"rejected":"approved",comment:m.comment});n(`Release is ${I.status}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("release:activate <release>","Queue immutable artifact activation").action(async(t)=>{let m=await xr();try{let k=m.releases.releases.get(t);if(!k)throw Error("Release was not found");let I=m.releases.enqueueActivation(k);n(`Activation queued: ${I.id}`)}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}finally{m.controlPlane.store.close()}}),R.command("release:rollback <release>","Restore the preserved prior immutable release").option("--to <release>","Explicit preserved release ID").action(async(t,m)=>{let k=await xr();try{let I=k.releases.releases.get(t);if(!I)throw Error("Release was not found");let L=k.releases.enqueueRollback(I,{targetReleaseId:m.to});n(`Rollback queued: ${L.id}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("release:health <release>","Record activation health and trigger bounded rollback").option("--healthy","Health gate passed").option("--operation <id>","Activation operation ID").option("--message <text>","Health summary").action(async(t,m)=>{let k=await xr();try{let I=k.releases.completeHealthGate(t,{healthy:!!m.healthy,operationId:m.operation,message:m.message});n(I.rollbackOperation?`Health failed; rollback queued: ${I.rollbackOperation.id}`:`Release is ${I.release.status}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("release:pin <release>","Pin or unpin a release against retention").option("--remove","Remove pin").option("--reason <text>","Pin reason").action(async(t,m)=>{let k=await xr();try{let I=k.releases.releases.pin(t,!m.remove,m.reason);n(I.pinned?"Release pinned.":"Release unpinned.")}finally{k.controlPlane.store.close()}})}import{existsSync as mf}from"node:fs";function Uc(R){R.command("assets:build","Run the configured build hooks for an environment").option("--env <environment>","Environment (production, staging, development)",{default:"production"}).action(async(t)=>{i("Building Assets");try{let m=await Ne(),k=t?.env||"production",L=m.environments?.[k]?.app?.build??[];if(!L.length){r(`No build hooks defined for '${k}'. Set environments.${k}.app.build = ['bun run build', …] in cloud.config.`),process.exitCode=1;return}let{execSync:z}=await import("node:child_process");for(let Y of L)u(`$ ${Y}`),z(Y,{stdio:"inherit"});n("Build hooks complete")}catch(m){r(`Build failed: ${m.message}`),process.exitCode=1}});for(let t of["assets:optimize:images","images:optimize"])R.command(t,"Optimize images (not implemented)").option("--dir <directory>","Directory to optimize").action(async()=>{r(`'${t}' is not implemented — ts-cloud has no built-in image optimizer.`),e("Optimize images in your own build step (e.g. sharp/squoosh), then `cloud assets:deploy`."),process.exitCode=1});R.command("assets:deploy","Deploy static assets to S3").option("--source <path>","Source directory",{default:"dist"}).option("--bucket <name>","S3 bucket name").option("--prefix <prefix>","S3 prefix/folder").option("--delete","Delete files not in source").option("--cache-control <value>","Cache-Control header",{default:"public, max-age=31536000"}).action(async(t)=>{i("Deploying Assets to S3");try{let k=(await Ne()).project.region||"us-east-1",I=t?.source||"dist",L=t?.bucket,z=t?.prefix,Y=t?.delete||!1,Z=t?.cacheControl||"public, max-age=31536000";if(!L){r("--bucket is required");return}if(!mf(I)){r(`Source directory not found: ${I}`);return}if(e(`Source: ${I}`),e(`Bucket: s3://${L}${z?`/${z}`:""}`),e(`Cache-Control: ${Z}`),Y)a("Delete mode enabled - files not in source will be removed");if(!await d(`
-Deploy assets now?`,!0)){e("Deployment cancelled");return}let ie=new g(k),oe=new s("Uploading assets to S3...");oe.start(),await ie.sync({source:I,bucket:L,prefix:z,delete:Y,cacheControl:Z,acl:"public-read"}),oe.succeed("Assets deployed successfully!");let be=(await ie.getBucketSize(L,z)/1024/1024).toFixed(2);n(`
-Deployment complete!`),e(`Total size: ${be} MB`),e(`
-Assets URL: https://${L}.s3.${k}.amazonaws.com${z?`/${z}`:""}`)}catch(m){r(`Deployment failed: ${m.message}`)}}),R.command("assets:invalidate","Invalidate CloudFront cache").option("--distribution <id>","CloudFront distribution ID").option("--paths <paths>","Paths to invalidate (comma-separated)",{default:"/*"}).option("--wait","Wait for invalidation to complete").action(async(t)=>{i("Invalidating CloudFront Cache");try{let m=t?.distribution;if(!m){r("--distribution is required");return}let I=(t?.paths||"/*").split(",").map((ie)=>ie.trim()),L=t?.wait||!1;if(e(`Distribution: ${m}`),e(`Paths: ${I.join(", ")}`),!await d(`
+`}function Lc(R){R.command("env:list","List configured environments and their deployed stack status").action(async()=>{i("Environments");try{let t=await De(),m=Object.keys(t.environments??{});if(!m.length){e("No environments configured. Add environments.<env> to your cloud.config.");return}let k=[];for(let I of m){let L=t.environments[I],z=L?.region||t.project.region||"us-east-1",Y=L?.app?`serverless (${L.app.kind})`:"server/static",Z="not deployed";if(L?.app)try{let X=new v(z),{Stacks:ee}=await X.describeStacks({stackName:Le(t,I)});Z=ee?.[0]?.StackStatus??"not deployed"}catch{Z="not deployed"}k.push([I,L?.type??I,Y,z,Z])}c(["Environment","Type","Kind","Region","Stack status"],k)}catch(t){r(`Failed to list environments: ${t.message}`),process.exitCode=1}}),R.command("env:compare <env1> <env2>","Compare two environments' app configuration").action(async(t,m)=>{i(`Comparing ${t} ↔ ${m}`);try{let k=await De(),I=k.environments?.[t],L=k.environments?.[m];if(!I||!L){r(`Both environments must exist in config (have: ${Object.keys(k.environments??{}).join(", ")||"none"}).`),process.exitCode=1;return}let z=(oe,se="")=>{let ue={};for(let[ke,ce]of Object.entries(oe??{})){let Se=se?`${se}.${ke}`:ke;if(ce&&typeof ce==="object"&&!Array.isArray(ce))Object.assign(ue,z(ce,Se));else ue[Se]=Array.isArray(ce)?JSON.stringify(ce):String(ce)}return ue},Y=z(I),Z=z(L),ee=[...new Set([...Object.keys(Y),...Object.keys(Z)])].sort().filter((oe)=>Y[oe]!==Z[oe]).map((oe)=>[oe,Y[oe]??"—",Z[oe]??"—"]);if(!ee.length){n("Identical — no configuration differences.");return}c(["Setting",t,m],ee),e(`
+${ee.length} difference(s)`)}catch(k){r(`Comparison failed: ${k.message}`),process.exitCode=1}}),R.command("env:pull","Download a serverless function's environment to a .env file").option("--env <environment>","Environment (production, staging, development)",{default:"production"}).option("--function <which>","Which function: http | queue | cli",{default:"http"}).option("--file <path>","Output file (default .env.<environment>)").action(async(t)=>{try{let m=await De(),k=t?.env||"production",{region:I,functions:L}=Pt(m,k),z=t?.function??"http",X=(await new D(I).getFunction(L[z])).Configuration?.Environment?.Variables??{},ee=t?.file??`.env.${k}`;cf(ee,df(X)),n(`Wrote ${Object.keys(X).length} variable(s) from ${L[z]} → ${ee}`)}catch(m){r(`env:pull failed: ${m.message}`),process.exitCode=1}}),R.command("env:push","Upload a .env file to a serverless function's configuration").option("--env <environment>","Environment (production, staging, development)",{default:"production"}).option("--function <which>","Function: http | queue | cli | all",{default:"all"}).option("--file <path>","Input file (default .env.<environment>)").option("--replace","Replace the entire env instead of merging over the live config").action(async(t)=>{try{let m=await De(),k=t?.env||"production",{region:I,functions:L}=Pt(m,k),z=t?.file??`.env.${k}`;if(!sf(z)){r(`File not found: ${z}`),process.exitCode=1;return}let Y=lf(af(z,"utf8")),Z=(t?.function??"all").toLowerCase();if(Z!=="all"&&!["http","queue","cli"].includes(Z)){r("--function must be one of: http, queue, cli, all"),process.exitCode=1;return}let X=Z==="all"?["http","queue","cli"]:[Z],ee=(m.environments?.[k]?.app?.provisionedConcurrency??0)>0,oe=new D(I);for(let se of X){let ue=L[se],ke=Y;if(!t?.replace)ke={...(await oe.getFunction(ue)).Configuration?.Environment?.Variables??{},...Y};if(Qo(ue,ke),await oe.updateFunctionConfiguration({FunctionName:ue,Environment:{Variables:ke}}),await oe.waitForFunctionActive(ue,120),ee){let ce=await oe.publishVersion({FunctionName:ue});if(ce.Version)await oe.updateAlias({FunctionName:ue,Name:"live",FunctionVersion:ce.Version})}n(`Pushed ${Object.keys(Y).length} var(s) → ${ue}${t?.replace?" (replaced)":" (merged)"}${ee?" (published + flipped live alias)":""}`)}e("Note: a subsequent `cloud deploy:serverless` re-injects infra/secret env from config.")}catch(m){r(`env:push failed: ${m.message}`),process.exitCode=1}}),R.command("env:create <name>","Create new environment").action(async(t)=>{Oc(`env:create ${t}`,"Add an `environments.<name>` block to your cloud.config and run `cloud deploy:serverless --env <name>`.")}),R.command("env:switch <name>","Switch active environment").action(async(t)=>{Oc(`env:switch ${t}`,'ts-cloud has no persistent "active" environment — pass --env <name> to each command.')});for(let t of["clone","promote","sync"])R.command(`env:${t} <source> <target>`,`(${t}) environment configuration`).action(async(m,k)=>{Oc(`env:${t} ${m} ${k}`,`Copy the \`environments.${m}\` block to \`environments.${k}\` in cloud.config, then \`cloud deploy:serverless --env ${k}\`.`)});R.command("env:preview <branch>","Create, inspect, rebuild, extend, or destroy an immutable preview").option("--sha <commit>","Exact 40-64 character source commit").option("--pr <number>","Pull request number").option("--site <name>","Application site (defaults to the first site)").option("--env <environment>","Base environment",{default:"production"}).option("--domain <pattern>","HTTPS URL pattern containing {name}").option("--ttl <hours>","Preview lifetime in hours").option("--destroy","Queue teardown for this preview").option("--rebuild","Rebuild the currently recorded commit").option("--extend <hours>","Extend expiry from now/current expiry").option("--get-url","Print the stable preview URL without mutation").option("--yes","Skip destructive confirmation").action(async(t,m)=>{let k;try{let I=await De(),L=m.env||"production",z=m.site||Object.keys(I.sites??{})[0];if(!z)throw Error("No application site is configured; pass --site after adding one");k=y(process.cwd(),I);let Y=k.environments.get(L),Z=Y?k.store.listResources(k.project.id,Y.id).find((ce)=>ce.kind==="application"&&ce.slug===z):void 0;if(!Y||!Z)throw Error(`Application ${z} was not found in base environment ${L}`);let X=new Qe(k.store),ee=X.previews.getDefinitionForResource(Z.id);if(!ee){let ce=I.sites?.[z]?.domain,Se=m.domain||(ce?`https://{name}.preview.${ce}`:void 0);if(!Se)throw Error("Pass --domain with an HTTPS pattern containing {name} to configure previews");ee=X.previews.createDefinition({projectId:k.project.id,resourceId:Z.id,baseEnvironmentId:Y.id,domainPattern:Se,ttlHours:Number(m.ttl)||void 0})}let oe=Number(m.pr)||void 0,se=oe?X.previews.findForPullRequest(ee.id,"local",oe):X.previews.findForBranch(ee.id,"local",t);if(m.getUrl){if(!se)throw Error("Preview was not found");e(se.url??"URL unavailable");return}if(m.extend){if(!se)throw Error("Preview was not found");let ce=X.previews.extend(se.id,Number(m.extend));n(`Extended ${ce.name} until ${ce.expiresAt}`);return}if(m.destroy){if(!se)throw Error("Preview was not found");if(!m.yes&&!await d(`Destroy ${se.name} and only its tagged resources?`,!1))return;let ce=X.enqueueDestroy(se,"manual");n(`Preview teardown queued: ${ce.id}`);return}if(m.rebuild){if(!se)throw Error("Preview was not found");let ce=X.enqueueDeploy(se,{reason:"manual_rebuild"});n(`Preview rebuild queued: ${ce.id}`);return}if(!m.sha)throw Error("Pass --sha with the exact immutable commit to deploy");let ue=X.previews.upsert({definitionId:ee.id,repository:"local",branch:t,pullRequestNumber:oe,commitSha:m.sha}),ke=X.enqueueDeploy(ue.preview,{created:ue.created});n(`${ue.created?"Preview creation":"Preview update"} queued: ${ke.id}`),e(`${ue.preview.url} · expires ${ue.preview.expiresAt}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k?.store.close()}}),R.command("env:cleanup","Remove stale preview environments").option("--dry-run","List cleanup candidates without queuing teardown").option("--max-age <hours>","Also remove previews older than this age").option("--keep <count>","Keep this many newest previews per application").action(async(t)=>{let m;try{let k=await De();m=y(process.cwd(),k);let L=new Qe(m.store).cleanup({dryRun:t.dryRun,maxAgeHours:Number(t.maxAge)||void 0,keepCount:Number(t.keep)||void 0});c(["Preview","Status","Expires","Reason"],L.candidates.map((z)=>[z.preview.name,z.preview.status,z.preview.expiresAt,z.reasons.join(", ")])),n(t.dryRun?`${L.candidates.length} cleanup candidate(s)`:`${L.operations.length} teardown job(s) queued`)}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}finally{m?.store.close()}}),R.command("env:previews","List persistent preview environments").option("--site <name>","Filter application site").action(async(t)=>{let m;try{let k=await De();m=y(process.cwd(),k);let I=new Qe(m.store),L=t.site?new Set(m.store.listResources(m.project.id).filter((Y)=>Y.slug===t.site).map((Y)=>Y.id)):void 0,z=I.previews.listInstances({projectId:m.project.id}).filter((Y)=>!L||L.has(Y.resourceId));c(["ID","Name","Status","Branch / PR","Commit","URL","Expires","Cost"],z.map((Y)=>[Y.id,Y.name,Y.status,Y.pullRequestNumber?`PR #${Y.pullRequestNumber}`:Y.branch,Y.commitSha.slice(0,12),Y.url??"—",Y.expiresAt,Y.costEstimate==null?"—":`$${Y.costEstimate.toFixed(2)}`]))}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}finally{m?.store.close()}})}import{readFileSync as Zs}from"node:fs";async function ir(){let R=await De(),t=y(process.cwd(),R);return{config:R,controlPlane:t,applications:new yt(t.store)}}async function Fc(R,t,m){let k=await ir();try{let I=k.applications.get(R);if(!I)throw Error("Compose application was not found");let L=t??k.controlPlane.store.listEnvironments(I.projectId).find((Y)=>Y.id===I.environmentId)?.slug;if(!L)throw Error("Compose environment was not found");let z=await mr(k.config,L,m(I));if(!z.ok)throw Error(z.stderr||z.error||"Remote Compose command failed");if(z.stdout)e(z.stdout)}finally{k.controlPlane.store.close()}}function jc(R){R.command("compose:preview <file>","Parse Compose without persistence or provider mutation").option("--name <name>","Application name",{default:"Compose application"}).option("--env <environment>","Target environment",{default:"production"}).action(async(t,m)=>{let k=await ir();try{let I=k.controlPlane.environments.get(m.env??"production");if(!I)throw Error("Environment was not found");let L=k.applications.preview(Zs(t,"utf8"),{name:m.name??"Compose application",projectId:k.controlPlane.project.id,environmentId:I.id});if(c(["Severity","Path","Code","Message"],L.diagnostics.map((z)=>[z.severity,z.path,z.code,z.message])),!L.valid)process.exitCode=1;else n(`${Object.keys(L.manifest.spec.services).length} services are valid`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("compose:import <file>","Import and persist a validated Compose application").option("--name <name>","Application name").option("--env <environment>","Target environment",{default:"production"}).action(async(t,m)=>{let k=await ir();try{let I=k.controlPlane.environments.get(m.env??"production");if(!I)throw Error("Environment was not found");let L=m.name??t.split("/").at(-2)??"Compose application",z=k.applications.import(Zs(t,"utf8"),{name:L,projectId:k.controlPlane.project.id,environmentId:I.id});n(`Imported ${z.application.name} (${z.application.id})`),e(`${Object.keys(z.application.manifest.spec.services).length} services · ${z.parsed.diagnostics.length} diagnostic(s)`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("compose:templates","List pinned verified Compose templates").action(()=>c(["ID","Version","Category","Architecture","Verified"],yr().map((t)=>[t.id,t.version,t.category,t.architecture,t.lastVerifiedAt]))),R.command("compose:catalog <file>","Validate and inspect a local/custom template catalog").option("--env <environment>","Target environment",{default:"production"}).action(async(t,m)=>{let k=await ir();try{let I=k.controlPlane.environments.get(m.env??"production");if(!I)throw Error("Environment was not found");let L=Ac(Zs(t,"utf8"),{projectId:k.controlPlane.project.id,environmentId:I.id});if(c(["ID","Version","Category","Services","Checksum"],L.templates.map((z)=>[z.template.id,z.template.version,z.template.category,String(Object.keys(z.parsed.manifest.spec.services).length),z.template.checksum.slice(0,12)])),L.diagnostics.length)c(["Severity","Path","Message"],L.diagnostics.map((z)=>[z.severity,z.path,z.message]));if(!L.valid)process.exitCode=1}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("compose:template <template>","Create an editable application from a template").option("--name <name>","Application name").option("--domain <domain>","Primary domain").option("--env <environment>","Target environment",{default:"production"}).option("--version <version>","Pinned template version").action(async(t,m)=>{let k=await ir();try{let I=k.controlPlane.environments.get(m.env??"production");if(!I)throw Error("Environment was not found");let L=k.applications.fromTemplate(t,{domain:m.domain??""},{name:m.name??t,projectId:k.controlPlane.project.id,environmentId:I.id,version:m.version});n(`Created ${L.application.name} from ${t}@${L.application.templateVersion}`),e(`Export with cloud compose:export ${L.application.id}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("compose:list","List Compose applications").action(async()=>{let t=await ir();try{c(["ID","Name","Status","Services","Source","Updated"],t.applications.list({projectId:t.controlPlane.project.id}).map((m)=>[m.id,m.name,m.status,String(Object.keys(m.manifest.spec.services).length),m.templateId?`${m.templateId}@${m.templateVersion}`:"compose",m.updatedAt]))}finally{t.controlPlane.store.close()}}),R.command("compose:export <application>","Print a normalized editable Compose file").action(async(t)=>{let m=await ir();try{let k=m.applications.get(t);if(!k)throw Error("Compose application was not found");e(fi(k.manifest))}finally{m.controlPlane.store.close()}}),R.command("compose:diff <application> <file>","Compare persisted and proposed Compose manifests").action(async(t,m)=>{let k=await ir();try{let I=k.applications.get(t);if(!I)throw Error("Compose application was not found");let L=jt(Zs(m,"utf8"),I.manifest.metadata);c(["Path","Before","After"],Ts(I.manifest,L.manifest).map((z)=>[z.path,JSON.stringify(z.before),JSON.stringify(z.after)]))}finally{k.controlPlane.store.close()}});for(let t of["deploy","redeploy","start","stop"])R.command(`compose:${t} <application>`,`${t} a Compose application through the durable queue`).action(async(m)=>{let k=await ir();try{let I=k.applications.get(m);if(!I)throw Error("Compose application was not found");let L=new Xe(k.controlPlane.store).enqueue(I,t);n(`${t} queued: ${L.id}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}});R.command("compose:scale <application> <service> <replicas>","Scale one capable Compose service").action(async(t,m,k)=>{let I=await ir();try{let L=I.applications.get(t);if(!L)throw Error("Compose application was not found");let z=new Xe(I.controlPlane.store).enqueue(L,"scale",{service:m,replicas:Number(k)});n(`Scale queued: ${z.id}`)}catch(L){r(L instanceof Error?L.message:String(L)),process.exitCode=1}finally{I.controlPlane.store.close()}}),R.command("compose:delete <application>","Delete a Compose stack; named volumes are preserved by default").option("--remove-volumes","Also permanently remove named volumes").option("--confirm <text>","Exact application confirmation").action(async(t,m)=>{let k=await ir();try{let I=k.applications.get(t);if(!I)throw Error("Compose application was not found");let L=new Xe(k.controlPlane.store).enqueue(I,"delete",{removeVolumes:m.removeVolumes,confirmation:m.confirm});n(`Deletion queued: ${L.id}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("compose:logs <application> <service>","Read ordered service logs").option("--lines <count>","Tail line count",{default:"200"}).option("--env <environment>","Target environment").action((t,m,k)=>Fc(t,k.env,(I)=>hi(I.manifest,m,Number(k.lines)||200))),R.command("compose:shell <application> <service> [command...]","Run a command in one service").option("--env <environment>","Target environment").action((t,m,k,I)=>Fc(t,I.env,(L)=>yi(L.manifest,m,k?.length?k:["sh"]))),R.command("compose:apply <application>","Internal durable Compose runtime action").option("--action <action>","Runtime action").option("--env <environment>","Target environment").option("--service <service>","Service name").option("--replicas <count>","Replica count").option("--remove-volumes","Remove named volumes").action((t,m)=>Fc(t,m.env,(k)=>{if(m.action==="scale")return Ic(k.manifest,m.service??"",Number(m.replicas));return Rc(k.manifest,m.action??"deploy",{service:m.service,removeVolumes:m.removeVolumes})}))}import{readFileSync as uf}from"node:fs";async function vr(){let R=await De(),t=y(process.cwd(),R);return{controlPlane:t,releases:new mt(t.store)}}function Bc(R){if(!R)return{};return JSON.parse(uf(R,"utf8"))}function _c(R){R.command("release:artifact <uri>","Register a verified content-addressed artifact").option("--digest <sha256>","Required sha256: digest").option("--kind <kind>","Deployable kind").option("--size <bytes>","Artifact size",{default:"0"}).option("--media-type <type>","Artifact media type").action(async(t,m)=>{let k=await vr();try{let I=k.releases.releases.registerArtifact({organizationId:k.controlPlane.organization.id,digest:String(m.digest??""),kind:m.kind??"compute",uri:t,size:Number(m.size),mediaType:m.mediaType});n(`Artifact registered: ${I.id}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("release:create <resource> <artifact>","Create an immutable release record").option("--env <environment>","Target environment",{default:"production"}).option("--kind <kind>","Deployable kind").option("--source-sha <sha>","Exact source commit").option("--strategy <strategy>","Activation strategy",{default:"atomic"}).option("--manifest <file>","Immutable manifest JSON").option("--config <file>","Resolved non-secret config JSON").option("--health-path <path>","HTTP health path").option("--approval","Require an environment approval").option("--trigger <trigger>","Build trigger",{default:"manual"}).action(async(t,m,k)=>{let I=await vr();try{let L=I.controlPlane.environments.get(k.env??"production"),z=L?I.controlPlane.store.listResources(I.controlPlane.project.id,L.id).find((Z)=>Z.slug===t):void 0;if(!L||!z)throw Error("Release resource was not found");let Y=I.releases.releases.create({organizationId:I.controlPlane.organization.id,projectId:I.controlPlane.project.id,environmentId:L.id,resourceId:z.id,artifactId:m,kind:k.kind??"compute",sourceSha:k.sourceSha,config:Bc(k.config),manifest:Bc(k.manifest),strategy:k.strategy??"atomic",healthGate:k.healthPath?{protocol:"http",path:k.healthPath,timeoutSeconds:5,intervalSeconds:5,healthyThreshold:2,unhealthyThreshold:2}:void 0,approvalRequired:k.approval,trigger:k.trigger});n(`Release created: ${Y.id} (${Y.status})`)}catch(L){r(L instanceof Error?L.message:String(L)),process.exitCode=1}finally{I.controlPlane.store.close()}}),R.command("release:list","List unified release history").option("--env <environment>","Filter environment").action(async(t)=>{let m=await vr();try{let k=t.env?m.controlPlane.environments.get(t.env):void 0;c(["ID","Resource","Status","Kind","Artifact","Strategy","Source","Created"],m.releases.releases.list({projectId:m.controlPlane.project.id,environmentId:k?.id}).map((I)=>[I.id,m.controlPlane.store.getResource(I.resourceId)?.slug??I.resourceId,I.status,I.kind,I.artifactId.slice(0,12),I.strategy,I.sourceSha?.slice(0,12)??"—",I.createdAt]))}finally{m.controlPlane.store.close()}}),R.command("release:show <release>","Show provenance, health, approvals, and transitions").action(async(t)=>{let m=await vr();try{let k=m.releases.releases.get(t);if(!k)throw Error("Release was not found");e(JSON.stringify({release:k,artifact:m.releases.releases.getArtifact(k.artifactId),approvals:m.releases.releases.approvals(t),transitions:m.releases.releases.transitions(t)},null,2))}finally{m.controlPlane.store.close()}}),R.command("release:compare <left> <right>","Compare artifact, source, config, manifest, and data caveats").action(async(t,m)=>{let k=await vr();try{let I=k.releases.releases.compare(t,m);e(JSON.stringify(I,null,2))}finally{k.controlPlane.store.close()}}),R.command("release:capabilities <kind>","Explain supported deployment strategies").option("--health","Readiness gate is configured").option("--replicas <count>","Replica count",{default:"1"}).action((t,m)=>c(["Strategy","Supported","Capacity","Cost","Explanation","Rollback"],gr({kind:t,hasHealthGate:!!m.health,replicas:Number(m.replicas)}).map((k)=>[k.strategy,k.supported?"yes":"no",`${k.capacityMultiplier}x`,k.costImpact,k.explanation,k.rollback]))),R.command("release:promote <release> <resource>","Promote the same artifact without rebuilding").option("--env <environment>","Target environment").option("--config <file>","Target non-secret config JSON").option("--approval","Require approval").action(async(t,m,k)=>{let I=await vr();try{let L=I.controlPlane.environments.get(String(k.env??"")),z=L?I.controlPlane.store.listResources(I.controlPlane.project.id,L.id).find((Z)=>Z.slug===m):void 0;if(!L||!z)throw Error("Promotion target was not found");let Y=I.releases.releases.promote(t,{targetEnvironmentId:L.id,targetResourceId:z.id,config:Bc(k.config),approvalRequired:k.approval});n(`Promoted without rebuild: ${Y.id} (${Y.status})`)}catch(L){r(L instanceof Error?L.message:String(L)),process.exitCode=1}finally{I.controlPlane.store.close()}}),R.command("release:approve <release>","Approve or reject an environment gate").option("--actor <id>","Approving actor ID").option("--reject","Reject instead").option("--comment <text>","Approval comment").action(async(t,m)=>{let k=await vr();try{if(!m.actor)throw Error("--actor is required");let I=k.releases.releases.approve(t,{actorId:m.actor,decision:m.reject?"rejected":"approved",comment:m.comment});n(`Release is ${I.status}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("release:activate <release>","Queue immutable artifact activation").action(async(t)=>{let m=await vr();try{let k=m.releases.releases.get(t);if(!k)throw Error("Release was not found");let I=m.releases.enqueueActivation(k);n(`Activation queued: ${I.id}`)}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}finally{m.controlPlane.store.close()}}),R.command("release:rollback <release>","Restore the preserved prior immutable release").option("--to <release>","Explicit preserved release ID").action(async(t,m)=>{let k=await vr();try{let I=k.releases.releases.get(t);if(!I)throw Error("Release was not found");let L=k.releases.enqueueRollback(I,{targetReleaseId:m.to});n(`Rollback queued: ${L.id}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("release:health <release>","Record activation health and trigger bounded rollback").option("--healthy","Health gate passed").option("--operation <id>","Activation operation ID").option("--message <text>","Health summary").action(async(t,m)=>{let k=await vr();try{let I=k.releases.completeHealthGate(t,{healthy:!!m.healthy,operationId:m.operation,message:m.message});n(I.rollbackOperation?`Health failed; rollback queued: ${I.rollbackOperation.id}`:`Release is ${I.release.status}`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}finally{k.controlPlane.store.close()}}),R.command("release:pin <release>","Pin or unpin a release against retention").option("--remove","Remove pin").option("--reason <text>","Pin reason").action(async(t,m)=>{let k=await vr();try{let I=k.releases.releases.pin(t,!m.remove,m.reason);n(I.pinned?"Release pinned.":"Release unpinned.")}finally{k.controlPlane.store.close()}})}import{existsSync as mf}from"node:fs";function Mc(R){R.command("assets:build","Run the configured build hooks for an environment").option("--env <environment>","Environment (production, staging, development)",{default:"production"}).action(async(t)=>{i("Building Assets");try{let m=await De(),k=t?.env||"production",L=m.environments?.[k]?.app?.build??[];if(!L.length){r(`No build hooks defined for '${k}'. Set environments.${k}.app.build = ['bun run build', …] in cloud.config.`),process.exitCode=1;return}let{execSync:z}=await import("node:child_process");for(let Y of L)u(`$ ${Y}`),z(Y,{stdio:"inherit"});n("Build hooks complete")}catch(m){r(`Build failed: ${m.message}`),process.exitCode=1}});for(let t of["assets:optimize:images","images:optimize"])R.command(t,"Optimize images (not implemented)").option("--dir <directory>","Directory to optimize").action(async()=>{r(`'${t}' is not implemented — ts-cloud has no built-in image optimizer.`),e("Optimize images in your own build step (e.g. sharp/squoosh), then `cloud assets:deploy`."),process.exitCode=1});R.command("assets:deploy","Deploy static assets to S3").option("--source <path>","Source directory",{default:"dist"}).option("--bucket <name>","S3 bucket name").option("--prefix <prefix>","S3 prefix/folder").option("--delete","Delete files not in source").option("--cache-control <value>","Cache-Control header",{default:"public, max-age=31536000"}).action(async(t)=>{i("Deploying Assets to S3");try{let k=(await De()).project.region||"us-east-1",I=t?.source||"dist",L=t?.bucket,z=t?.prefix,Y=t?.delete||!1,Z=t?.cacheControl||"public, max-age=31536000";if(!L){r("--bucket is required");return}if(!mf(I)){r(`Source directory not found: ${I}`);return}if(e(`Source: ${I}`),e(`Bucket: s3://${L}${z?`/${z}`:""}`),e(`Cache-Control: ${Z}`),Y)a("Delete mode enabled - files not in source will be removed");if(!await d(`
+Deploy assets now?`,!0)){e("Deployment cancelled");return}let ee=new g(k),oe=new s("Uploading assets to S3...");oe.start(),await ee.sync({source:I,bucket:L,prefix:z,delete:Y,cacheControl:Z,acl:"public-read"}),oe.succeed("Assets deployed successfully!");let ue=(await ee.getBucketSize(L,z)/1024/1024).toFixed(2);n(`
+Deployment complete!`),e(`Total size: ${ue} MB`),e(`
+Assets URL: https://${L}.s3.${k}.amazonaws.com${z?`/${z}`:""}`)}catch(m){r(`Deployment failed: ${m.message}`)}}),R.command("assets:invalidate","Invalidate CloudFront cache").option("--distribution <id>","CloudFront distribution ID").option("--paths <paths>","Paths to invalidate (comma-separated)",{default:"/*"}).option("--wait","Wait for invalidation to complete").action(async(t)=>{i("Invalidating CloudFront Cache");try{let m=t?.distribution;if(!m){r("--distribution is required");return}let I=(t?.paths||"/*").split(",").map((ee)=>ee.trim()),L=t?.wait||!1;if(e(`Distribution: ${m}`),e(`Paths: ${I.join(", ")}`),!await d(`
 Invalidate cache now?`,!0)){e("Invalidation cancelled");return}let Y=new E,Z=new s("Creating invalidation...");Z.start();let X=await Y.invalidatePaths(m,I);if(Z.succeed("Invalidation created"),n(`
-Invalidation ID: ${X.Id}`),e(`Status: ${X.Status}`),e(`Created: ${new Date(X.CreateTime).toLocaleString()}`),L){let ie=new s("Waiting for invalidation to complete...");ie.start(),await Y.waitForInvalidation(m,X.Id),ie.succeed("Invalidation completed!")}else e(`
-Invalidation is in progress. Use --wait to wait for completion.`)}catch(m){r(`Invalidation failed: ${m.message}`)}})}function qc(R){for(let[t,m]of[["team:add <email> <role>","Invite an organization member"],["team:list","List organization members"],["team:remove <email>","Revoke organization membership"]])R.command(t,m).action(async(...k)=>En(t.split(" ")[0],{target:String(k[0]??""),message:"Legacy IAM-backed team commands are deprecated and cannot safely represent organization-scoped access.",nextAction:"Use the Team dashboard or organization invitation API; this command exits without changing IAM."}))}import{execFileSync as Yf,execSync as dl}from"node:child_process";import{copyFileSync as As,existsSync as In,mkdirSync as au,readFileSync as ll,writeFileSync as Zf}from"node:fs";import{tmpdir as cu}from"node:os";import{dirname as Qf,join as lu,resolve as Xf}from"node:path";import{existsSync as Hc,readdirSync as Vd,statSync as Gc}from"node:fs";import{join as ea}from"node:path";var pf=new Set([".DS_Store","Thumbs.db",".gitkeep",".keep"]);function qd(R){return pf.has(R)}function Hd(R,t=0){if(t>8)return!0;let m;try{m=Vd(R)}catch{return!1}for(let k of m){if(qd(k))continue;let I=ea(R,k),L;try{L=Gc(I)}catch{continue}if(L.isFile())return!0;if(L.isDirectory()&&Hd(I,t+1))return!0}return!1}function ff(R){let t;try{t=Vd(R)}catch{return[]}let m=[];for(let k of t){if(qd(k))continue;let I=ea(R,k);try{if(Gc(I).isDirectory()&&Hc(ea(I,"index.html")))m.push(k)}catch{}}return m.sort((k,I)=>k.localeCompare(I))}function Gd(R){let{root:t,siteName:m,expectIndex:k}=R,I=[];if(!Hc(t))return I.push({level:"error",message:`Build output not found at ${t} for site '${m}'`}),I;if(!Gc(t).isDirectory())return I.push({level:"error",message:`Site '${m}' has root ${t}, which is a file, not a directory`}),I;if(!Hd(t))return I.push({level:"error",message:`Site '${m}' would ship an empty release: ${t} contains no files. Check that the build ran and wrote where 'root' points.`}),I;if(!k)return I;if(Hc(ea(t,"index.html")))return I;let L=ff(t);if(L.length===1){let z=`${t.replace(/\/+$/,"")}/${L[0]}`;return I.push({level:"error",message:`Site '${m}' has no index.html at the top of ${t}, but ${z} has one. The generator wrote one level down, so this release would serve 404s at the domain root. Set root: '${z}'.`}),I}if(L.length>1)return I.push({level:"warning",message:`Site '${m}' has no index.html at the top of ${t}. These subdirectories have one: ${L.join(", ")}. The domain root will 404.`}),I;return I.push({level:"warning",message:`Site '${m}' has no index.html anywhere under ${t}. The domain root will 404.`}),I}function gf(R){if(!R)return[];if(Array.isArray(R))return R.map(String);let t=R,m=t.Items??t.Item;if(!m)return[];if(Array.isArray(m))return m.map(String);if(typeof m==="object"&&m!==null){let k=m;if("Item"in k){let I=k.Item;if(!I)return[];return Array.isArray(I)?I.map(String):[String(I)]}if("CNAME"in k){let I=k.CNAME;if(!I)return[];return Array.isArray(I)?I.map(String):[String(I)]}return Object.values(k).flatMap((I)=>{if(Array.isArray(I))return I.map(String);return typeof I==="string"?[I]:[]})}return[String(m)]}async function ta(R){if(R.length===0)return;let t=new E,m=await t.listDistributions(),k=[...new Set(R.map((I)=>I.toLowerCase()))];for(let I of k){let L=m.find((Y)=>gf(Y.Aliases).some((X)=>X.toLowerCase()===I));if(!L?.Id){a(`No CloudFront distribution found for ${I} — skipping dynamic HTTP method sync`);continue}if(await t.ensureDynamicHttpMethods(L.Id))n(`CloudFront ${L.Id} (${I}): enabled POST/PUT/PATCH/DELETE on dynamic paths`);else e(`CloudFront ${L.Id} (${I}): already allows dynamic HTTP methods`)}}import{execSync as hf}from"node:child_process";async function yf(R,t,m,k={},I=process.cwd()){if(!R)return;if(k.step?.(`Running ${m} hook`),typeof R==="string"){hf(R,{stdio:"inherit",cwd:I});return}await R(t)}async function vs(R,t,m={},k){try{return await yf(R.hooks?.[t],R,t,m,k),!0}catch(I){return m.error?.(`${t} hook failed: ${I?.message||I}`),!1}}var Si=(R)=>R===void 0?void 0:R?"on":"off";function Jc(R){let t={ssl:R.ssl,always_use_https:Si(R.alwaysUseHttps),automatic_https_rewrites:Si(R.automaticHttpsRewrites),min_tls_version:R.minTlsVersion,tls_1_3:Si(R.tls13),brotli:Si(R.brotli),http3:Si(R.http3),"0rtt":Si(R.zeroRtt),early_hints:Si(R.earlyHints),browser_cache_ttl:R.browserCacheTtl,always_online:Si(R.alwaysOnline),websockets:Si(R.websockets),email_obfuscation:Si(R.emailObfuscation)};if(R.hsts)t.security_header={strict_transport_security:{enabled:R.hsts.enabled,max_age:R.hsts.maxAge??31536000,include_subdomains:R.hsts.includeSubdomains??!1,preload:R.hsts.preload??!1,nosniff:R.hsts.noSniff??!0}};for(let m of Object.keys(t))if(t[m]===void 0)delete t[m];return{...t,...R.raw??{}}}var bs={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as vf}from"node:tls";async function Yc(R){let{address:t,serverName:m,port:k=443,timeoutMs:I=5000}=R;return new Promise((L)=>{let z=!1,Y=(X)=>{if(z)return;z=!0;try{Z.destroy()}catch{}L(X)},Z=vf({host:t,port:k,servername:m,rejectUnauthorized:!1,timeout:I});Z.once("secureConnect",()=>{if(Z.authorized){Y({reachable:!0,trusted:!0});return}Y({reachable:!0,trusted:!1,reason:Z.authorizationError?String(Z.authorizationError):"origin certificate is not trusted for this hostname"})}),Z.once("timeout",()=>{Y({reachable:!1,trusted:!1,reason:`no TLS handshake within ${I}ms`})}),Z.once("error",(X)=>{Y({reachable:!1,trusted:!1,reason:X.message})})})}function bf(R,t){let m=t.replace(/\.$/,"").toLowerCase();return R.some((k)=>{let I=k.replace(/\.$/,"").toLowerCase();if(I===m)return!0;if(!I.startsWith("*."))return!1;let L=I.slice(2);if(!m.endsWith(`.${L}`))return!1;return!m.slice(0,m.length-L.length-1).includes(".")})}async function Zc(R){let{provider:t,zone:m,hosts:k,ipv4:I,ipv6:L,proxied:z=!0,settings:Y=bs,cache:Z,originGuard:X,purge:ie=!0,ttl:oe=300,skipOriginProbe:ae=!1,skipEdgeCertificateCheck:be=!1}=R,Ae={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(k.length===0)return Ae;let de=[],ke=z&&!be?await t.listEdgeCertificateHosts(m):null;for(let Se of k){let Re=z;if(Re&&ke&&!bf(ke,Se)){Re=!1;let ze=ke.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${ke.join(", ")})`;Ae.deferredProxy.push({host:Se,reason:ze}),Ae.warnings.push(`${Se}: publishing DNS-only — ${ze}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(Re&&!ae){let ze=await Yc({address:I,serverName:Se});if(!ze.trusted){Re=!1;let Le=ze.reason||"origin is not serving a trusted certificate";Ae.deferredProxy.push({host:Se,reason:Le}),Ae.warnings.push(`${Se}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${Le}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(Re)de.push(Se);let Pe=[{type:"A",content:I}];if(L&&mo(Se))Pe.push({type:"AAAA",content:L});for(let{type:ze,content:Le}of Pe){let Be=await t.upsertRecord(m,{name:Se,type:ze,content:Le,ttl:oe,proxied:Re});if(Be.success)Ae.records.push({host:Se,type:ze,content:Le,proxied:Re});else Ae.warnings.push(`${Se} ${ze} → ${Le} failed: ${Be.message||"unknown provider error"}`)}}if(de.length===0){if(z)Ae.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return Ae}try{let Se=Jc(Y),Re=await t.applyZoneSettings(m,Se);Ae.settingsChanged=Re.changed;for(let Pe of Re.failed)Ae.warnings.push(`zone setting '${Pe.id}' could not be applied: ${Pe.error}`)}catch(Se){Ae.warnings.push(`zone settings could not be read: ${Se instanceof Error?Se.message:String(Se)}`)}let De=Qs(de,Z);if(De.length>0){let Se=await t.putManagedPhaseRules(m,"http_request_cache_settings",De);if(Se.success)Ae.cacheRules=De.length;else Ae.warnings.push(`cache rules could not be written: ${Se.message}`)}if(X){let Se=Ys(de,X.header,X.value);if(Se.length>0){let Re=await t.putManagedPhaseRules(m,"http_request_late_transform",Se);if(Re.success)Ae.originGuard=!0;else Ae.warnings.push(`origin guard header could not be written: ${Re.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(ie){if(Ae.purged=await t.purgeCache(m,{hosts:de}),!Ae.purged)Ae.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return Ae}var wf=(R)=>process.env[R];function Kd(R,t){let m=R.replace(/\.$/,"").toLowerCase();if(t){let k=t.replace(/\.$/,"").toLowerCase();if(m===k||m.endsWith(`.${k}`))return k}return m.split(".").slice(-2).join(".")}function Qc(R,t={}){let m=t.env??wf,k=R.infrastructure?.compute?.proxy?.cdn,I=[];if(!k||k.provider!=="cloudflare")return{plan:null,errors:I};if(k.originDomain)I.push(`compute.proxy.cdn.originDomain (${k.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let L=m("CLOUDFLARE_API_TOKEN");if(!L)return I.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:I};let z=R.sites??{},Y=k.frontedHosts?.length?[...new Set(k.frontedHosts.map((ae)=>ae.toLowerCase()))]:ho(z,{autoWww:R.infrastructure?.compute?.proxy?.autoWww!==!1});if(Y.length===0)return I.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:I};let Z=R.infrastructure?.dns?.domain,X=new Set(Y.map((ae)=>Kd(ae,Z)));if(X.size>1)return I.push(`Fronted hosts span more than one zone (${[...X].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:I};let ie=k.cloudflare??{},oe=k.secret?{header:k.secretHeader??"X-Origin-Verify",value:k.secret}:void 0;return{plan:{zone:[...X][0],hosts:Y,apiToken:L,zoneId:ie.zoneId??m("CLOUDFLARE_ZONE_ID"),accountId:ie.accountId??m("CLOUDFLARE_ACCOUNT_ID"),proxied:ie.proxied!==!1,settings:ie.settings??bs,cache:ie.cache,originGuard:oe,purge:ie.purgeOnDeploy!==!1,skipOriginProbe:ie.skipOriginProbe===!0},errors:I}}var Sf="https://api.cloudflare.com/client/v4",Yd=10042,Cf=10006,$f=10059;class co extends Error{status;errors;constructor(R,t,m=[]){super(R);this.name="R2ApiError",this.status=t,this.errors=m}hasCode(R){return this.errors.some((t)=>t.code===R)}}class Hi extends co{accountId;constructor(R,t,m=[]){super(`R2 is not enabled on Cloudflare account ${R}. Enable it once in the Cloudflare dashboard (R2 Object Storage, then follow the prompt to activate it), then re-run the deploy.`,t,m);this.name="R2NotEnabledError",this.accountId=R}}class Oo{name="cloudflare-r2";apiToken;accountId;fetchImpl;constructor(R){if(!R.apiToken)throw Error("Cloudflare R2 needs an API token");if(!R.accountId)throw Error("Cloudflare R2 needs an account id");this.apiToken=R.apiToken,this.accountId=R.accountId,this.fetchImpl=R.fetch??((t,m)=>fetch(t,m))}async requestEnvelope(R,t,m,k={}){let I={Authorization:`Bearer ${this.apiToken}`};if(m!==void 0)I["Content-Type"]="application/json";if(k.jurisdiction&&k.jurisdiction!=="default")I["cf-r2-jurisdiction"]=k.jurisdiction;let L=await this.fetchImpl(`${Sf}/accounts/${this.accountId}/r2${t}`,{method:R,headers:I,body:m===void 0?void 0:JSON.stringify(m)}),z=await L.text(),Y;try{Y=JSON.parse(z)}catch{throw new co(`Cloudflare R2 API returned ${L.status} with a non-JSON body: ${z.slice(0,200)}`,L.status)}if(!Y.success){let Z=Y.errors??[];if(Z.some((ie)=>ie.code===Yd))throw new Hi(this.accountId,L.status,Z);let X=Z.map((ie)=>`${ie.code}: ${ie.message}`).join(", ");throw new co(`Cloudflare R2 API error (${L.status}) on ${R} ${t}: ${X||z.slice(0,200)}`,L.status,Z)}return Y}async request(R,t,m,k){return(await this.requestEnvelope(R,t,m,k)).result}bucketPath(R){return`/buckets/${encodeURIComponent(R)}`}async listBuckets(R={}){let t=[],m;do{let k=new URLSearchParams({per_page:"1000"});if(m)k.set("cursor",m);let I=await this.requestEnvelope("GET",`/buckets?${k}`,void 0,R),L=I.result?.buckets??[];t.push(...L),m=L.length>0?I.result_info?.cursor||void 0:void 0}while(m);return t}async getBucket(R,t={}){try{return await this.request("GET",this.bucketPath(R),void 0,t)}catch(m){if(m instanceof Hi)throw m;if(m instanceof co&&(m.hasCode(Cf)||m.status===404))return null;throw m}}async ensureBucket(R,t={}){let m={jurisdiction:t.jurisdiction},k=await this.getBucket(R,m);if(k)return{bucket:k,created:!1};let I={name:R};if(t.locationHint)I.locationHint=t.locationHint;let L=await this.request("POST","/buckets",I,m);return{bucket:{...L,name:L?.name||R},created:!0}}async getCors(R,t={}){try{return(await this.request("GET",`${this.bucketPath(R)}/cors`,void 0,t))?.rules??[]}catch(m){if(m instanceof co&&!(m instanceof Hi)&&(m.hasCode($f)||m.status===404))return[];throw m}}async putCors(R,t,m={}){if(t.length===0){await this.request("DELETE",`${this.bucketPath(R)}/cors`,void 0,m);return}await this.request("PUT",`${this.bucketPath(R)}/cors`,{rules:t},m)}async ensureCors(R,t,m={}){let k=await this.getCors(R,m);if(na(k,t))return!1;return await this.putCors(R,t,m),!0}async getLifecycle(R,t={}){return(await this.request("GET",`${this.bucketPath(R)}/lifecycle`,void 0,t))?.rules??[]}async putLifecycle(R,t,m={}){await this.request("PUT",`${this.bucketPath(R)}/lifecycle`,{rules:t},m)}async ensureLifecycle(R,t,m={}){let k=await this.getLifecycle(R,m);if(ra(k,t))return!1;return await this.putLifecycle(R,t,m),!0}async listCustomDomains(R,t={}){return(await this.request("GET",`${this.bucketPath(R)}/domains/custom`,void 0,t))?.domains??[]}async attachCustomDomain(R,t,m={}){return this.request("POST",`${this.bucketPath(R)}/domains/custom`,{domain:t.domain,zoneId:t.zoneId,enabled:t.enabled??!0,minTLS:t.minTLS??"1.2"},m)}async updateCustomDomain(R,t,m,k={}){return this.request("PUT",`${this.bucketPath(R)}/domains/custom/${encodeURIComponent(t)}`,m,k)}async ensureCustomDomain(R,t,m={},k){let I=t.minTLS??"1.2",z=(k??await this.listCustomDomains(R,m)).find((X)=>X.domain.toLowerCase()===t.domain.toLowerCase());if(!z){let X=await this.attachCustomDomain(R,{...t,minTLS:I,enabled:!0},m);return{action:"attached",domain:{...X,domain:X?.domain||t.domain}}}let Y=z.minTLS??"1.0";if(z.enabled&&Y===I)return{action:"unchanged",domain:z};let Z=await this.updateCustomDomain(R,z.domain,{enabled:!0,minTLS:I},m);return{action:"updated",domain:{...z,...Z}}}async getManagedDomain(R,t={}){return this.request("GET",`${this.bucketPath(R)}/domains/managed`,void 0,t)}async setManagedDomain(R,t,m={}){let k=await this.getManagedDomain(R,m);if(k?.enabled===t)return{changed:!1,domain:k};return{changed:!0,domain:await this.request("PUT",`${this.bucketPath(R)}/domains/managed`,{enabled:t},m)}}}function ws(R){if(Array.isArray(R))return`[${R.map(ws).join(",")}]`;if(R&&typeof R==="object")return`{${Object.entries(R).filter(([,m])=>m!==void 0).sort(([m],[k])=>m.localeCompare(k)).map(([m,k])=>`${JSON.stringify(m)}:${ws(k)}`).join(",")}}`;return JSON.stringify(R)}function Jd(R,t){let m=(k)=>k&&k.length>0?[...k].map(String).sort():void 0;return{id:t?R.id:void 0,allowed:{origins:m(R.allowed?.origins),methods:m(R.allowed?.methods?.map((k)=>k.toUpperCase())),headers:m(R.allowed?.headers?.map((k)=>k.toLowerCase()))},exposeHeaders:m(R.exposeHeaders?.map((k)=>k.toLowerCase())),maxAgeSeconds:R.maxAgeSeconds}}function na(R,t){if(R.length!==t.length)return!1;return t.every((m,k)=>{let I=m.id!==void 0;return ws(Jd(R[k],I))===ws(Jd(m,I))})}function ra(R,t){if(R.length!==t.length)return!1;let m=(k)=>ws([...k].map((I)=>({...I,storageClassTransitions:I.storageClassTransitions?.length?I.storageClassTransitions:void 0})).sort((I,L)=>I.id.localeCompare(L.id)));return m(R)===m(t)}var kf="r2 cache",Af=/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;async function tl(R,t={}){let m=t.log??(()=>{}),k={buckets:[],warnings:[]},I=R.infrastructure?.r2??R.r2,L=Object.entries(I?.buckets??{});if(L.length===0)return m("R2: no buckets declared, skipping."),k;if(!t.apiToken||!t.accountId){let ie=[!t.apiToken&&"CLOUDFLARE_API_TOKEN",!t.accountId&&"CLOUDFLARE_ACCOUNT_ID"].filter(Boolean).join(" and "),oe=`R2: ${L.length} bucket(s) declared but ${ie} is not set, skipping.`;return m(oe),k.warnings.push(oe),k}let z=t.dryRun===!0,Y=new Oo({apiToken:t.apiToken,accountId:t.accountId,fetch:t.fetch}),Z=new he(t.apiToken,{zoneId:t.zoneId,accountId:t.accountId}),X=new Map;for(let[ie,oe]of L){let ae=oe?.name;if(!ae||!Af.test(ae)){k.warnings.push(`R2: bucket '${ie}' has an invalid name '${ae??""}' (3-63 chars: lowercase letters, digits, hyphens), skipping.`);continue}m(`R2: ${z?"checking":"reconciling"} bucket ${ae}...`);let be={name:ae,changes:[],domains:[]};if(k.buckets.push(be),await Rf(oe,{r2:Y,cloudflare:Z,dryRun:z,summary:be,warnings:k.warnings,claimed:X,log:m}),be.changes.length===0)m(`R2: ${ae} is in sync.`);else for(let Ae of be.changes)m(`R2: ${ae}: ${Ae}`)}return k}async function Rf(R,t){let{r2:m,dryRun:k,summary:I,warnings:L}=t,z=R.name,Y={jurisdiction:R.jurisdiction},Z=(be,Ae)=>{let de=k?Ae&&`would ${Ae}`:be;if(de)I.changes.push(de)},X;if(k)X=await m.getBucket(z,Y)!==null;else{let{created:be}=await m.ensureBucket(z,{locationHint:R.locationHint,jurisdiction:R.jurisdiction});if(X=!0,be)Z("created","")}if(!X)Z("","create bucket");let ie=Pf(R.customDomains);await Ss(t,`cors on ${z}`,async()=>{if(!R.cors)return;if(!X){Z("cors updated","set cors");return}let be=await m.getCors(z,Y);if(na(be,R.cors))return;if(!k)await m.putCors(z,R.cors,Y);Z(R.cors.length===0?"cors removed":"cors updated",R.cors.length===0?"remove cors":"update cors")}),await Ss(t,`lifecycle on ${z}`,async()=>{if(!R.lifecycle)return;let be=R.lifecycle.map(Xd);if(X){let Ae=await m.getLifecycle(z,Y);if(ra(Ae,be))return}if(!k)await m.putLifecycle(z,be,Y);Z("lifecycle updated","update lifecycle")}),await Ss(t,`r2.dev URL on ${z}`,async()=>{let be=R.publicDevUrl===!0;if(!X){if(be)Z("r2.dev URL enabled","enable r2.dev URL");return}if((await m.getManagedDomain(z,Y))?.enabled===be)return;if(!k)await m.setManagedDomain(z,be,Y);Z(be?"r2.dev URL enabled":"r2.dev URL disabled",be?"enable r2.dev URL":"disable r2.dev URL")});let oe=[];if(ie.length>0&&X)try{oe=await m.listCustomDomains(z,Y)}catch(be){if(be instanceof Hi)throw be;L.push(`R2: could not list custom domains on ${z}: ${nl(be)}`)}let ae=new Map;for(let{domain:be,minTLS:Ae}of ie){let de=t.claimed.get(be);if(de&&de!==z){L.push(`R2: ${be} is declared on both ${de} and ${z}; leaving it on ${de}.`);continue}t.claimed.set(be,z);let ke=oe.find((Se)=>Se.domain.toLowerCase()===be),De=Ae??"1.2";if(ke&&ke.enabled&&(ke.minTLS??"1.0")===De){if(I.domains.push({domain:be,status:el(ke)}),ke.zoneId)ae.set(be,ke.zoneId);continue}await Ss(t,`custom domain ${be} on ${z}`,async()=>{if(ke){if(!k)await m.updateCustomDomain(z,ke.domain,{enabled:!0,minTLS:De},Y);if(Z(`custom domain ${be} updated`,`update custom domain ${be}`),I.domains.push({domain:be,status:el({...ke,enabled:!0})}),ke.zoneId)ae.set(be,ke.zoneId);return}let Se=await t.cloudflare.zoneIdFor(be);if(ae.set(be,Se),!k)await m.ensureCustomDomain(z,{domain:be,zoneId:Se,minTLS:De},Y,oe);Z(`custom domain ${be} attached`,`attach custom domain ${be}`),I.domains.push({domain:be,status:k?"not attached":"pending"})},()=>I.domains.push({domain:be,status:"error"}))}if(R.cache&&ie.length>0)await If(R,ie.map((be)=>be.domain).filter((be)=>t.claimed.get(be)===z),ae,t,Z)}async function If(R,t,m,k,I){let L=Zd(R.cache);if(!L||t.length===0)return;let z=new Map;for(let Y of t){let Z=m.get(Y);if(!Z)try{Z=await k.cloudflare.zoneIdFor(Y)}catch(X){k.warnings.push(`R2: could not resolve the zone for ${Y}, cache rule skipped: ${nl(X)}`);continue}z.set(Z,[...z.get(Z)??[],Y])}for(let Y of z.values()){let Z={action:"set_cache_settings",description:`${kr} ${kf}`,expression:`(${Dr(Y)})`,enabled:!0,action_parameters:L};await Ss(k,`cache rule for ${Y.join(", ")}`,async()=>{let X=await k.cloudflare.getPhaseRules(Y[0],"http_request_cache_settings");if(Qd(X,Z))return;if(!k.dryRun){let ie=await k.cloudflare.putManagedPhaseRules(Y[0],"http_request_cache_settings",[Z]);if(!ie.success)throw Error(ie.message||"cache rule write failed")}I(`cache rule updated for ${Y.join(", ")}`,`update cache rule for ${Y.join(", ")}`)})}}function Zd(R){if(R.edgeTtl===void 0&&R.browserTtl===void 0)return null;let t={cache:!0};if(R.edgeTtl!==void 0)t.edge_ttl={mode:"override_origin",default:R.edgeTtl};if(R.browserTtl!==void 0)t.browser_ttl={mode:"override_origin",default:R.browserTtl};return t}function Qd(R,t){let m=Nr(t.expression),k=Mi(t.expression),I=(Y)=>(Y.description||"").startsWith(kr),L=(Y)=>Y.action===t.action&&Y.description===t.description&&(Y.enabled??!0)===(t.enabled??!0)&&Mi(Y.expression)===k&&ca(Y.action_parameters)===ca(t.action_parameters),z=!1;for(let Y of R){if(!I(Y))continue;let Z=Nr(Y.expression);if(!m.some((ie)=>Z.includes(ie)))continue;if(L(Y)&&m.every((ie)=>Z.includes(ie))&&!z){z=!0;continue}return!1}return z}function Xd(R){let t={id:R.id,enabled:R.enabled??!0,conditions:{prefix:R.prefix??""}};if(R.expireAfterDays!==void 0)t.deleteObjectsTransition={condition:{type:"Age",maxAge:Xc(R.expireAfterDays)}};else if(R.expireOn!==void 0)t.deleteObjectsTransition={condition:{type:"Date",date:R.expireOn}};if(R.abortMultipartUploadsAfterDays!==void 0)t.abortMultipartUploadsTransition={condition:{type:"Age",maxAge:Xc(R.abortMultipartUploadsAfterDays)}};if(R.infrequentAccessAfterDays!==void 0)t.storageClassTransitions=[{storageClass:"InfrequentAccess",condition:{type:"Age",maxAge:Xc(R.infrequentAccessAfterDays)}}];return t}function Xc(R){return Math.round(R*86400)}function Pf(R){let t=new Set,m=[];for(let k of R??[]){let I=typeof k==="string"?{domain:k}:k,L=I.domain?.trim().replace(/\.$/,"").toLowerCase();if(!L||t.has(L))continue;t.add(L),m.push({domain:L,minTLS:I.minTLS})}return m}function el(R){if(!R.enabled)return"disabled";let t=R.status?.ownership,m=R.status?.ssl;if(t==="active"&&m==="active")return"active";for(let k of[t,m])if(k==="error"||k==="blocked"||k==="deactivated")return k;return"pending"}async function Ss(R,t,m,k){try{await m()}catch(I){if(I instanceof Hi)throw I;R.warnings.push(`R2: ${t} failed: ${nl(I)}`),k?.()}}function nl(R){return R instanceof Error?R.message:String(R)}function ca(R){if(Array.isArray(R))return`[${R.map(ca).join(",")}]`;if(R&&typeof R==="object")return`{${Object.entries(R).filter(([,m])=>m!==void 0).sort(([m],[k])=>m.localeCompare(k)).map(([m,k])=>`${JSON.stringify(m)}:${ca(k)}`).join(",")}}`;return JSON.stringify(R)}import{basename as Lf,extname as Ff}from"node:path";import{createHash as xf}from"node:crypto";var Df="https://api.cloudflare.com/client/v4",Gi="TS_CLOUD_CONTENT_HASH",Cs="2025-09-01",il="application/javascript+module",Ef=10007,Tf=[1e4,9109];class _o extends Error{status;errors;constructor(R,t,m=[]){super(R);this.name="WorkersApiError",this.status=t,this.errors=m}hasCode(R){return this.errors.some((t)=>t.code===R)}}class da extends _o{permission;constructor(R,t,m,k=[]){super(`The Cloudflare API token is missing the "${R}" permission (${t}). Edit the token in the Cloudflare dashboard (My Profile, API Tokens), add it, then re-run the deploy.`,m,k);this.name="WorkersPermissionError",this.permission=R}}class ua{name="cloudflare-workers";apiToken;accountId;fetchImpl;constructor(R){if(!R.apiToken)throw Error("Cloudflare Workers needs an API token");if(!R.accountId)throw Error("Cloudflare Workers needs an account id");this.apiToken=R.apiToken,this.accountId=R.accountId,this.fetchImpl=R.fetch??((t,m)=>fetch(t,m))}async request(R,t,m){let k={Authorization:`Bearer ${this.apiToken}`},I;if(m instanceof FormData)I=m;else if(m!==void 0)k["Content-Type"]="application/json",I=JSON.stringify(m);let L=await this.fetchImpl(`${Df}/accounts/${this.accountId}/workers${t}`,{method:R,headers:k,body:I}),z=await L.text(),Y;try{Y=JSON.parse(z)}catch{throw new _o(`Cloudflare Workers API returned ${L.status} with a non-JSON body: ${z.slice(0,200)}`,L.status)}if(!Y.success){let Z=Y.errors??[],X=Z.map((ie)=>`${ie.code}: ${ie.message}`).join(", ");if(Nf(L.status,Z))throw new da(Of(t),`${R} ${t} -> ${L.status}${X?`, ${X}`:""}`,L.status,Z);throw new _o(`Cloudflare Workers API error (${L.status}) on ${R} ${t}: ${X||z.slice(0,200)}`,L.status,Z)}return Y.result}scriptPath(R){return`/scripts/${encodeURIComponent(R)}`}async getSettings(R){try{return await this.request("GET",`${this.scriptPath(R)}/settings`)}catch(t){if(t instanceof da)throw t;if(t instanceof _o&&(t.hasCode(Ef)||t.status===404))return null;throw t}}async getScript(R){return this.getSettings(R)}async uploadModuleScript(R,t){return this.request("PUT",this.scriptPath(R),tu(t))}async ensureModuleScript(R,t){let m=ks(t),k=await this.getSettings(R);if(k&&ma(k,t,m))return{action:"unchanged",hash:m};return await this.uploadModuleScript(R,nu(t,m)),{action:k?"updated":"created",hash:m}}async listCustomDomains(R={}){let t=new URLSearchParams;if(R.service)t.set("service",R.service);if(R.hostname)t.set("hostname",R.hostname);if(R.zoneId)t.set("zone_id",R.zoneId);let m=t.toString(),k=m?`?${m}`:"";return await this.request("GET",`/domains${k}`)??[]}async attachCustomDomain(R,t){let m={hostname:R,service:t.service,environment:t.environment??"production"};if(t.zoneId)m.zone_id=t.zoneId;return this.request("PUT","/domains",m)}async detachCustomDomain(R){await this.request("DELETE",`/domains/${encodeURIComponent(R)}`)}async ensureCustomDomain(R,t,m){let I=(m??await this.listCustomDomains({hostname:R})).find((z)=>z.hostname.toLowerCase()===R.toLowerCase());if(I&&I.service===t.service)return{action:"unchanged",domain:I};if(I)throw Error(`${R} is attached to the Worker '${I.service}'. Detach it there first (Workers & Pages, ${I.service}, Settings, Domains & Routes); ts-cloud does not move it.`);let L=await this.attachCustomDomain(R,t);return{action:"attached",domain:{...L,hostname:L?.hostname||R}}}}function Nf(R,t){if(t.some((m)=>Tf.includes(m.code)))return!0;return(R===401||R===403)&&t.length===0}function Of(R){if(R.startsWith("/domains"))return"Workers Routes: Edit (zone, for Workers custom domains) and Workers Scripts: Edit (account)";return"Workers Scripts: Edit (account)"}function tu(R){if(!R.modules.some((k)=>k.name===R.mainModule))throw Error(`Worker main module '${R.mainModule}' is not one of the uploaded modules`);let t={main_module:R.mainModule,bindings:R.bindings??[],compatibility_date:R.compatibilityDate??Cs,compatibility_flags:R.compatibilityFlags??[],keep_bindings:["secret_text"]},m=new FormData;m.append("metadata",JSON.stringify(t));for(let k of R.modules)m.append(k.name,new Blob([k.content],{type:k.type}),k.name);return m}function ks(R){let t={mainModule:R.mainModule,modules:[...R.modules].sort((m,k)=>m.name.localeCompare(k.name)).map((m)=>({name:m.name,type:m.type,sha256:eu(m.content)})),bindings:[...R.bindings??[]].filter((m)=>m.name!==Gi).sort((m,k)=>m.name.localeCompare(k.name)),compatibilityDate:R.compatibilityDate??Cs,compatibilityFlags:[...R.compatibilityFlags??[]].sort()};return eu(rl(t))}function nu(R,t=ks(R)){return{...R,bindings:[...(R.bindings??[]).filter((m)=>m.name!==Gi),{type:"plain_text",name:Gi,text:t}]}}function ma(R,t,m){let k=R.bindings??[],I=k.find((L)=>L.name===Gi&&L.type==="plain_text");if(!I||I.text!==m)return!1;return(t.bindings??[]).every((L)=>{let z=k.find((Z)=>Z.name===L.name);if(!z||z.type!==L.type)return!1;let Y=L.type==="r2_bucket"?"bucket_name":L.type==="plain_text"?"text":void 0;return!Y||z[Y]===L[Y]})}function eu(R){return xf("sha256").update(R).digest("hex")}function rl(R){if(Array.isArray(R))return`[${R.map(rl).join(",")}]`;if(R&&typeof R==="object")return`{${Object.entries(R).filter(([,m])=>m!==void 0).sort(([m],[k])=>m.localeCompare(k)).map(([m,k])=>`${JSON.stringify(m)}:${rl(k)}`).join(",")}}`;return JSON.stringify(R)}async function ol(R){if(!await Bun.file(R).exists())throw Error(`Worker entry not found: ${R}`);let t;try{t=await Bun.build({entrypoints:[R],target:"browser",format:"esm",minify:!0,external:["cloudflare:*"]})}catch(I){throw Error(`Bundling Worker ${R} failed: ${jf(I)}`)}if(!t.success)throw Error(`Bundling Worker ${R} failed: ${t.logs.map((I)=>String(I.message??I)).join("; ")}`);if(t.outputs.length!==1)throw Error(`Bundling Worker ${R} produced ${t.outputs.length} files (${t.outputs.map((I)=>I.path).join(", ")}); a Worker is uploaded as a single module, so remove the dynamic imports or asset imports that split it.`);let m=t.outputs[0];if(m.kind!=="entry-point")throw Error(`Bundling Worker ${R} produced a ${m.kind} instead of an entry module`);let k=await m.text();return{name:`${Lf(R,Ff(R))}.js`,content:k,type:il,size:new TextEncoder().encode(k).byteLength}}function jf(R){if(R instanceof AggregateError&&R.errors.length>0)return R.errors.map((t)=>t instanceof Error?t.message:String(t?.message??t)).join("; ");return R instanceof Error?R.message:String(R)}import{isAbsolute as Bf,resolve as _f}from"node:path";var Mf="https://api.cloudflare.com/client/v4",zf=/^[a-z0-9][a-z0-9_-]{0,62}$/;async function sl(R,t={}){let m=t.log??(()=>{}),k={workers:[],warnings:[]},I=Object.entries(R.infrastructure?.workers??R.workers??{});if(I.length===0)return m("Workers: none declared, skipping."),k;if(!t.apiToken||!t.accountId){let Y=[!t.apiToken&&"CLOUDFLARE_API_TOKEN",!t.accountId&&"CLOUDFLARE_ACCOUNT_ID"].filter(Boolean).join(" and "),Z=`Workers: ${I.length} Worker(s) declared but ${Y} is not set, skipping.`;return m(Z),k.warnings.push(Z),k}let L=R.infrastructure?.r2??R.r2,z={workers:new ua({apiToken:t.apiToken,accountId:t.accountId,fetch:t.fetch}),r2:new Oo({apiToken:t.apiToken,accountId:t.accountId,fetch:t.fetch}),cloudflare:new he(t.apiToken,{zoneId:t.zoneId,accountId:t.accountId}),apiToken:t.apiToken,fetch:t.fetch??((Y,Z)=>fetch(Y,Z)),projectRoot:t.projectRoot??process.cwd(),dryRun:t.dryRun===!0,warnings:k.warnings,log:m,r2ConfigDomains:Gf(L),r2Buckets:L,claimed:new Map};for(let[Y,Z]of I){let X=Z?.name;if(!X||!zf.test(X)){k.warnings.push(`Workers: '${Y}' has an invalid name '${X??""}' (1-63 chars: lowercase letters, digits, '-' and '_'), skipping.`);continue}if(!Z.entry){k.warnings.push(`Workers: ${X} has no entry, skipping.`);continue}m(`Workers: ${z.dryRun?"checking":"reconciling"} ${X}...`);let ie={name:X,changes:[],domains:[]};k.workers.push(ie),await Uf(Z,ie,z);for(let oe of ie.changes)m(`Workers: ${X}: ${oe}`)}return k}async function Uf(R,t,m){let k=R.name,I=Bf(R.entry)?R.entry:_f(m.projectRoot,R.entry),L;try{L=await ol(I)}catch(Y){throw Error(`Worker ${k}: ${zo(Y)}`)}t.changes.push(`bundled ${Jf(L.size)}`);let z={mainModule:L.name,modules:[{name:L.name,content:L.content,type:L.type}],bindings:ru(R,m),compatibilityDate:R.compatibilityDate??Cs,compatibilityFlags:R.compatibilityFlags??[]};if(m.dryRun){let Y=await m.workers.getSettings(k);t.changes.push(Y&&ma(Y,z,ks(z))?"unchanged":"would upload")}else{let{action:Y}=await m.workers.ensureModuleScript(k,z);t.changes.push(Y==="unchanged"?"unchanged":"uploaded")}for(let Y of Kf(R.customDomains))await Wf(k,Y,t,m)}async function Wf(R,t,m,k){let I=(be)=>{m.domains.push({domain:t,status:be})},L=(be)=>{k.warnings.push(`Workers: ${be}`),I("conflict")},z=k.claimed.get(t);if(z&&z!==R){L(`${t} is declared on both ${z} and ${R}; leaving it on ${z}.`);return}k.claimed.set(t,R);let Y=k.r2ConfigDomains.get(t);if(Y){L(`${t} is also declared as a custom domain of the R2 bucket '${Y}' (r2.buckets). A hostname serves either a bucket or a Worker. Remove it from the bucket's customDomains and detach it in the dashboard (R2, ${Y}, Settings, Custom Domains) first; to serve the bucket through the Worker, bind it with bindings.r2Buckets instead.`);return}let Z=await Vf(k);if(Z===null){I("error");return}let X=Z.find((be)=>be.hostname.toLowerCase()===t);if(X?.service===R){I("active");return}if(X){L(`${t} is attached to the Worker '${X.service}'. Detach it there first (Workers & Pages, ${X.service}, Settings, Domains & Routes); it is not moved automatically.`);return}let ie=(await qf(k))?.get(t);if(ie){L(`${t} is attached to the R2 bucket '${ie}' as a custom domain. Detach it first (R2, ${ie}, Settings, Custom Domains, then re-run the deploy); it is not detached automatically. To serve the bucket through the Worker, bind it with bindings.r2Buckets.`);return}let oe;try{oe=await k.cloudflare.zoneIdFor(t)}catch(be){k.warnings.push(`Workers: could not resolve the zone for ${t}, not attached: ${zo(be)}`),I("error");return}let ae=await Hf(k,oe,t);if(ae.length>0){let be=ae.map((Ae)=>`${Ae.type} ${Ae.content}`).join(", ");L(`${t} already has a DNS record (${be}). A Worker custom domain creates its own record, so Cloudflare will not attach over it. Delete the record first (DNS, Records), then re-run the deploy; it is not deleted automatically.`);return}if(k.dryRun){m.changes.push(`would attach custom domain ${t}`),I("not attached");return}try{await k.workers.ensureCustomDomain(t,{service:R,zoneId:oe},Z),m.changes.push(`custom domain ${t} attached`),Z.push({id:"",hostname:t,service:R,zone_id:oe}),I("pending")}catch(be){k.warnings.push(`Workers: custom domain ${t} on ${R} failed: ${zo(be)}`),I("error")}}async function Vf(R){if(R.attached!==void 0)return R.attached;try{R.attached=await R.workers.listCustomDomains()}catch(t){R.warnings.push(`Workers: could not list Worker custom domains, none attached: ${zo(t)}`),R.attached=null}return R.attached}async function qf(R){if(R.r2AccountDomains!==void 0)return R.r2AccountDomains;let t=new Map;try{let m=(await R.r2.listBuckets()).map((k)=>({name:k.name}));for(let k of Object.values(R.r2Buckets?.buckets??{}))if(k.jurisdiction&&k.jurisdiction!=="default")m.push({name:k.name,jurisdiction:k.jurisdiction});for(let k of m){let I=await R.r2.listCustomDomains(k.name,{jurisdiction:k.jurisdiction}).catch(()=>[]);for(let L of I)t.set(L.domain.toLowerCase(),k.name)}R.r2AccountDomains=t}catch(m){R.log(`Workers: could not check R2 custom domains (${zo(m)}); relying on the DNS check.`),R.r2AccountDomains=null}return R.r2AccountDomains}async function Hf(R,t,m){try{let k=await R.fetch(`${Mf}/zones/${t}/dns_records?name=${encodeURIComponent(m)}&per_page=100`,{method:"GET",headers:{Authorization:`Bearer ${R.apiToken}`}}),I=await k.json();if(!I?.success)throw Error(`HTTP ${k.status}`);return(I.result??[]).filter((L)=>L.name?.toLowerCase()===m).map((L)=>({type:L.type??"?",content:L.content??""}))}catch(k){return R.log(`Workers: could not read DNS records for ${m} (${zo(k)}); attaching anyway.`),[]}}function ru(R,t){let m=[],k=new Set,I=(z)=>{if(z===Gi)return t.warnings.push(`Workers: ${R.name}: binding name ${Gi} is reserved for ts-cloud, ignored.`),!1;if(k.has(z))return t.warnings.push(`Workers: ${R.name}: binding ${z} is declared twice; the first one wins.`),!1;return k.add(z),!0},L=new Map;for(let z of Object.values(t.r2Buckets?.buckets??{}))if(z.jurisdiction&&z.jurisdiction!=="default")L.set(z.name,z.jurisdiction);for(let[z,Y]of Object.entries(R.bindings?.r2Buckets??{})){if(!I(z))continue;let Z=L.get(Y);m.push(Z?{type:"r2_bucket",name:z,bucket_name:Y,jurisdiction:Z}:{type:"r2_bucket",name:z,bucket_name:Y})}for(let[z,Y]of Object.entries(R.bindings?.vars??{}))if(I(z))m.push({type:"plain_text",name:z,text:String(Y)});return m}function Gf(R){let t=new Map;for(let m of Object.values(R?.buckets??{}))for(let k of m?.customDomains??[]){let I=iu(typeof k==="string"?k:k.domain);if(I)t.set(I,m.name)}return t}function Kf(R){return[...new Set((R??[]).map(iu).filter(Boolean))]}function iu(R){return(R??"").trim().replace(/\.$/,"").toLowerCase()}function Jf(R){if(R<1024)return`${R} B`;if(R<1048576)return`${(R/1024).toFixed(1)} KB`;return`${(R/1024/1024).toFixed(1)} MB`}function zo(R){return R instanceof Error?R.message:String(R)}async function eg(R){let t=la();if(t.emptyEnvKey||t.emptyEnvSecret)a("Empty AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY env var detected — likely a misconfigured .env file. Remove the empty lines or fill them in.");e(`AWS credentials: ${t.description}`);try{let k=await new bt(R).getCallerIdentity();if(k.Arn)e(`AWS identity: ${k.Arn}`)}catch(m){a(`Could not verify AWS identity: ${m.message}`)}}function tg(){try{return dl("git rev-parse --short HEAD",{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{return Date.now().toString(36)}}async function al(R,t,m,k){let{ensureManagementDashboard:I}=await import("./chunk-6wvjr3ne.js");I(R,{logger:{info:e,warn:a}});let L=R.sites||{},z=Object.entries(L);if(z.length===0)return a("infrastructure.compute is set but no sites are configured — nothing to deploy. Add sites to `cloud.config.ts`."),!0;if(k&&!L[k])return r(`Site '${k}' was not found. Configured sites: ${z.map(([De])=>De).join(", ")}`),!1;let Y=z.filter(([De,Se])=>{if(!Se)return!1;if(k&&De!==k)return!1;if(A(Se)==="bucket")return a(`Site '${De}' targets a bucket — skipping compute deploy (handled by the static-site path).`),!1;return js(Se)});if(k)e(`Deploying only '${k}'. Other sites keep their current release; proxy routes are still regenerated in full.`);let Z=R.project.slug,ie=(R.infrastructure?.compute||{}).runtime||"bun",oe=O({config:R}),ae=tg(),be=new Map,Ae=new Map,de={step:(De)=>u(De),error:(De)=>r(De)};if(!await vs(R,"beforeDeploy",de))return!1;if(!await vs(R,"beforeBuild",de))return!1;for(let[De,Se]of Y){let Re=A(Se);if(i(`Preparing site: ${De}`),e(`Domain: ${Se.domain||"(none)"}`),e(`Source: ${Se.root}`),e(`Kind: ${Re==="server-static"?"static (shipped to /var/www)":"app (systemd service)"}`),Re==="server-app")e(`Start: ${Se.start}`),e(`Port: ${Se.port??"(unset)"}`);if(Se.build){u(`Running build: ${Se.build}`);try{dl(Se.build,{stdio:"inherit",cwd:process.cwd()})}catch(Ve){return r(`Build failed for site '${De}': ${Ve.message}`),!1}}let Pe=Gd({root:Se.root,siteName:De,expectIndex:Re==="server-static"});for(let Ve of Pe)if(Ve.level==="error")r(Ve.message);else a(Ve.message);if(Pe.some((Ve)=>Ve.level==="error"))return!1;let ze=Se.build?void 0:JSON.stringify([Xf(Se.root),[...Se.exclude||[]].sort()]),Le=ze?Ae.get(ze):void 0;if(Le){u(`Reusing package for ${Se.root} → ${Le}`),be.set(De,Le);continue}let Be=lu(cu(),`${Z}-${De}-${ae}.tar.gz`);u(`Packaging ${Se.root} → ${Be}`);try{let Ve=(Se.exclude||[]).map((ct)=>`--exclude=${ct}`);Yf("tar",["czf",Be,"-C",Se.root,...Ve,"."],{stdio:"inherit",env:{...process.env,COPYFILE_DISABLE:"1"}})}catch(Ve){return r(`Failed to package '${De}': ${Ve.message}`),!1}if(be.set(De,Be),ze)Ae.set(ze,Be)}if(!await vs(R,"afterBuild",de))return!1;let ke=await Eo({config:k?{...R,sites:Object.fromEntries(Y)}:R,rpxConfig:k?R:void 0,environment:t,driver:oe,sha:ae,runtime:ie,tarballForSite:(De)=>{let Se=be.get(De);if(!Se)throw Error(`Missing tarball for site '${De}'`);return Se},logger:{info:(De)=>e(De),warn:(De)=>a(De),error:(De)=>r(De),step:(De)=>u(De),success:(De)=>n(De)}});if(ke&&!await vs(R,"afterDeploy",de))return!1;return ke}async function pa(R){let t=new Yr;if(u("Running pre-deployment security scan..."),R.exclude?.length)e(`Excluding from the scan: ${R.exclude.join(", ")}`);let m=await t.scan({directory:R.sourceDir,failOnSeverity:R.failOnSeverity||"critical",skipPatterns:R.skipPatterns,exclude:R.exclude});return{passed:m.passed,result:m}}function ng(){let R=lu(cu(),`ts-cloud-empty-scan-${process.pid}`);return au(R,{recursive:!0}),R}function fa(R){let{summary:t,findings:m,scannedFiles:k,duration:I}=R;if(e(`
+Invalidation ID: ${X.Id}`),e(`Status: ${X.Status}`),e(`Created: ${new Date(X.CreateTime).toLocaleString()}`),L){let ee=new s("Waiting for invalidation to complete...");ee.start(),await Y.waitForInvalidation(m,X.Id),ee.succeed("Invalidation completed!")}else e(`
+Invalidation is in progress. Use --wait to wait for completion.`)}catch(m){r(`Invalidation failed: ${m.message}`)}})}function zc(R){for(let[t,m]of[["team:add <email> <role>","Invite an organization member"],["team:list","List organization members"],["team:remove <email>","Revoke organization membership"]])R.command(t,m).action(async(...k)=>xn(t.split(" ")[0],{target:String(k[0]??""),message:"Legacy IAM-backed team commands are deprecated and cannot safely represent organization-scoped access.",nextAction:"Use the Team dashboard or organization invitation API; this command exits without changing IAM."}))}import{execFileSync as Yf,execSync as dl}from"node:child_process";import{copyFileSync as $s,existsSync as Sn,mkdirSync as au,readFileSync as ll,writeFileSync as Zf}from"node:fs";import{tmpdir as cu}from"node:os";import{dirname as Qf,join as lu,resolve as Xf}from"node:path";import{existsSync as Uc,readdirSync as Vd,statSync as Wc}from"node:fs";import{join as Qs}from"node:path";var pf=new Set([".DS_Store","Thumbs.db",".gitkeep",".keep"]);function qd(R){return pf.has(R)}function Hd(R,t=0){if(t>8)return!0;let m;try{m=Vd(R)}catch{return!1}for(let k of m){if(qd(k))continue;let I=Qs(R,k),L;try{L=Wc(I)}catch{continue}if(L.isFile())return!0;if(L.isDirectory()&&Hd(I,t+1))return!0}return!1}function ff(R){let t;try{t=Vd(R)}catch{return[]}let m=[];for(let k of t){if(qd(k))continue;let I=Qs(R,k);try{if(Wc(I).isDirectory()&&Uc(Qs(I,"index.html")))m.push(k)}catch{}}return m.sort((k,I)=>k.localeCompare(I))}function Gd(R){let{root:t,siteName:m,expectIndex:k}=R,I=[];if(!Uc(t))return I.push({level:"error",message:`Build output not found at ${t} for site '${m}'`}),I;if(!Wc(t).isDirectory())return I.push({level:"error",message:`Site '${m}' has root ${t}, which is a file, not a directory`}),I;if(!Hd(t))return I.push({level:"error",message:`Site '${m}' would ship an empty release: ${t} contains no files. Check that the build ran and wrote where 'root' points.`}),I;if(!k)return I;if(Uc(Qs(t,"index.html")))return I;let L=ff(t);if(L.length===1){let z=`${t.replace(/\/+$/,"")}/${L[0]}`;return I.push({level:"error",message:`Site '${m}' has no index.html at the top of ${t}, but ${z} has one. The generator wrote one level down, so this release would serve 404s at the domain root. Set root: '${z}'.`}),I}if(L.length>1)return I.push({level:"warning",message:`Site '${m}' has no index.html at the top of ${t}. These subdirectories have one: ${L.join(", ")}. The domain root will 404.`}),I;return I.push({level:"warning",message:`Site '${m}' has no index.html anywhere under ${t}. The domain root will 404.`}),I}function gf(R){if(!R)return[];if(Array.isArray(R))return R.map(String);let t=R,m=t.Items??t.Item;if(!m)return[];if(Array.isArray(m))return m.map(String);if(typeof m==="object"&&m!==null){let k=m;if("Item"in k){let I=k.Item;if(!I)return[];return Array.isArray(I)?I.map(String):[String(I)]}if("CNAME"in k){let I=k.CNAME;if(!I)return[];return Array.isArray(I)?I.map(String):[String(I)]}return Object.values(k).flatMap((I)=>{if(Array.isArray(I))return I.map(String);return typeof I==="string"?[I]:[]})}return[String(m)]}async function Xs(R){if(R.length===0)return;let t=new E,m=await t.listDistributions(),k=[...new Set(R.map((I)=>I.toLowerCase()))];for(let I of k){let L=m.find((Y)=>gf(Y.Aliases).some((X)=>X.toLowerCase()===I));if(!L?.Id){a(`No CloudFront distribution found for ${I} — skipping dynamic HTTP method sync`);continue}if(await t.ensureDynamicHttpMethods(L.Id))n(`CloudFront ${L.Id} (${I}): enabled POST/PUT/PATCH/DELETE on dynamic paths`);else e(`CloudFront ${L.Id} (${I}): already allows dynamic HTTP methods`)}}import{execSync as hf}from"node:child_process";async function yf(R,t,m,k={},I=process.cwd()){if(!R)return;if(k.step?.(`Running ${m} hook`),typeof R==="string"){hf(R,{stdio:"inherit",cwd:I});return}await R(t)}async function fs(R,t,m={},k){try{return await yf(R.hooks?.[t],R,t,m,k),!0}catch(I){return m.error?.(`${t} hook failed: ${I?.message||I}`),!1}}var Gr=(R)=>R===void 0?void 0:R?"on":"off";function Vc(R){let t={ssl:R.ssl,always_use_https:Gr(R.alwaysUseHttps),automatic_https_rewrites:Gr(R.automaticHttpsRewrites),min_tls_version:R.minTlsVersion,tls_1_3:Gr(R.tls13),brotli:Gr(R.brotli),http3:Gr(R.http3),"0rtt":Gr(R.zeroRtt),early_hints:Gr(R.earlyHints),browser_cache_ttl:R.browserCacheTtl,always_online:Gr(R.alwaysOnline),websockets:Gr(R.websockets),email_obfuscation:Gr(R.emailObfuscation)};if(R.hsts)t.security_header={strict_transport_security:{enabled:R.hsts.enabled,max_age:R.hsts.maxAge??31536000,include_subdomains:R.hsts.includeSubdomains??!1,preload:R.hsts.preload??!1,nosniff:R.hsts.noSniff??!0}};for(let m of Object.keys(t))if(t[m]===void 0)delete t[m];return{...t,...R.raw??{}}}var gs={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as vf}from"node:tls";async function qc(R){let{address:t,serverName:m,port:k=443,timeoutMs:I=5000}=R;return new Promise((L)=>{let z=!1,Y=(X)=>{if(z)return;z=!0;try{Z.destroy()}catch{}L(X)},Z=vf({host:t,port:k,servername:m,rejectUnauthorized:!1,timeout:I});Z.once("secureConnect",()=>{if(Z.authorized){Y({reachable:!0,trusted:!0});return}Y({reachable:!0,trusted:!1,reason:Z.authorizationError?String(Z.authorizationError):"origin certificate is not trusted for this hostname"})}),Z.once("timeout",()=>{Y({reachable:!1,trusted:!1,reason:`no TLS handshake within ${I}ms`})}),Z.once("error",(X)=>{Y({reachable:!1,trusted:!1,reason:X.message})})})}function bf(R,t){let m=t.replace(/\.$/,"").toLowerCase();return R.some((k)=>{let I=k.replace(/\.$/,"").toLowerCase();if(I===m)return!0;if(!I.startsWith("*."))return!1;let L=I.slice(2);if(!m.endsWith(`.${L}`))return!1;return!m.slice(0,m.length-L.length-1).includes(".")})}async function Hc(R){let{provider:t,zone:m,hosts:k,ipv4:I,ipv6:L,proxied:z=!0,settings:Y=gs,cache:Z,originGuard:X,purge:ee=!0,ttl:oe=300,skipOriginProbe:se=!1,skipEdgeCertificateCheck:ue=!1}=R,ke={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(k.length===0)return ke;let ce=[],Se=z&&!ue?await t.listEdgeCertificateHosts(m):null;for(let ve of k){let Re=z;if(Re&&Se&&!bf(Se,ve)){Re=!1;let Me=Se.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${Se.join(", ")})`;ke.deferredProxy.push({host:ve,reason:Me}),ke.warnings.push(`${ve}: publishing DNS-only — ${Me}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(Re&&!se){let Me=await qc({address:I,serverName:ve});if(!Me.trusted){Re=!1;let Ne=Me.reason||"origin is not serving a trusted certificate";ke.deferredProxy.push({host:ve,reason:Ne}),ke.warnings.push(`${ve}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${Ne}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(Re)ce.push(ve);let Ie=[{type:"A",content:I}];if(L&&bo(ve))Ie.push({type:"AAAA",content:L});for(let{type:Me,content:Ne}of Ie){let Fe=await t.upsertRecord(m,{name:ve,type:Me,content:Ne,ttl:oe,proxied:Re});if(Fe.success)ke.records.push({host:ve,type:Me,content:Ne,proxied:Re});else ke.warnings.push(`${ve} ${Me} → ${Ne} failed: ${Fe.message||"unknown provider error"}`)}}if(ce.length===0){if(z)ke.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return ke}try{let ve=Vc(Y),Re=await t.applyZoneSettings(m,ve);ke.settingsChanged=Re.changed;for(let Ie of Re.failed)ke.warnings.push(`zone setting '${Ie.id}' could not be applied: ${Ie.error}`)}catch(ve){ke.warnings.push(`zone settings could not be read: ${ve instanceof Error?ve.message:String(ve)}`)}let xe=oa(ce,Z);if(xe.length>0){let ve=await t.putManagedPhaseRules(m,"http_request_cache_settings",xe);if(ve.success)ke.cacheRules=xe.length;else ke.warnings.push(`cache rules could not be written: ${ve.message}`)}if(X){let ve=sa(ce,X.header,X.value);if(ve.length>0){let Re=await t.putManagedPhaseRules(m,"http_request_late_transform",ve);if(Re.success)ke.originGuard=!0;else ke.warnings.push(`origin guard header could not be written: ${Re.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(ee){if(ke.purged=await t.purgeCache(m,{hosts:ce}),!ke.purged)ke.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return ke}var wf=(R)=>process.env[R];function Kd(R,t){let m=R.replace(/\.$/,"").toLowerCase();if(t){let k=t.replace(/\.$/,"").toLowerCase();if(m===k||m.endsWith(`.${k}`))return k}return m.split(".").slice(-2).join(".")}function Gc(R,t={}){let m=t.env??wf,k=R.infrastructure?.compute?.proxy?.cdn,I=[];if(!k||k.provider!=="cloudflare")return{plan:null,errors:I};if(k.originDomain)I.push(`compute.proxy.cdn.originDomain (${k.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let L=m("CLOUDFLARE_API_TOKEN");if(!L)return I.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:I};let z=R.sites??{},Y=k.frontedHosts?.length?[...new Set(k.frontedHosts.map((se)=>se.toLowerCase()))]:Co(z,{autoWww:R.infrastructure?.compute?.proxy?.autoWww!==!1});if(Y.length===0)return I.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:I};let Z=R.infrastructure?.dns?.domain,X=new Set(Y.map((se)=>Kd(se,Z)));if(X.size>1)return I.push(`Fronted hosts span more than one zone (${[...X].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:I};let ee=k.cloudflare??{},oe=k.secret?{header:k.secretHeader??"X-Origin-Verify",value:k.secret}:void 0;return{plan:{zone:[...X][0],hosts:Y,apiToken:L,zoneId:ee.zoneId??m("CLOUDFLARE_ZONE_ID"),accountId:ee.accountId??m("CLOUDFLARE_ACCOUNT_ID"),proxied:ee.proxied!==!1,settings:ee.settings??gs,cache:ee.cache,originGuard:oe,purge:ee.purgeOnDeploy!==!1,skipOriginProbe:ee.skipOriginProbe===!0},errors:I}}var Sf="https://api.cloudflare.com/client/v4",Yd=10042,Cf=10006,$f=10059;class to extends Error{status;errors;constructor(R,t,m=[]){super(R);this.name="R2ApiError",this.status=t,this.errors=m}hasCode(R){return this.errors.some((t)=>t.code===R)}}class Vi extends to{accountId;constructor(R,t,m=[]){super(`R2 is not enabled on Cloudflare account ${R}. Enable it once in the Cloudflare dashboard (R2 Object Storage, then follow the prompt to activate it), then re-run the deploy.`,t,m);this.name="R2NotEnabledError",this.accountId=R}}class Oo{name="cloudflare-r2";apiToken;accountId;fetchImpl;constructor(R){if(!R.apiToken)throw Error("Cloudflare R2 needs an API token");if(!R.accountId)throw Error("Cloudflare R2 needs an account id");this.apiToken=R.apiToken,this.accountId=R.accountId,this.fetchImpl=R.fetch??((t,m)=>fetch(t,m))}async requestEnvelope(R,t,m,k={}){let I={Authorization:`Bearer ${this.apiToken}`};if(m!==void 0)I["Content-Type"]="application/json";if(k.jurisdiction&&k.jurisdiction!=="default")I["cf-r2-jurisdiction"]=k.jurisdiction;let L=await this.fetchImpl(`${Sf}/accounts/${this.accountId}/r2${t}`,{method:R,headers:I,body:m===void 0?void 0:JSON.stringify(m)}),z=await L.text(),Y;try{Y=JSON.parse(z)}catch{throw new to(`Cloudflare R2 API returned ${L.status} with a non-JSON body: ${z.slice(0,200)}`,L.status)}if(!Y.success){let Z=Y.errors??[];if(Z.some((ee)=>ee.code===Yd))throw new Vi(this.accountId,L.status,Z);let X=Z.map((ee)=>`${ee.code}: ${ee.message}`).join(", ");throw new to(`Cloudflare R2 API error (${L.status}) on ${R} ${t}: ${X||z.slice(0,200)}`,L.status,Z)}return Y}async request(R,t,m,k){return(await this.requestEnvelope(R,t,m,k)).result}bucketPath(R){return`/buckets/${encodeURIComponent(R)}`}async listBuckets(R={}){let t=[],m;do{let k=new URLSearchParams({per_page:"1000"});if(m)k.set("cursor",m);let I=await this.requestEnvelope("GET",`/buckets?${k}`,void 0,R),L=I.result?.buckets??[];t.push(...L),m=L.length>0?I.result_info?.cursor||void 0:void 0}while(m);return t}async getBucket(R,t={}){try{return await this.request("GET",this.bucketPath(R),void 0,t)}catch(m){if(m instanceof Vi)throw m;if(m instanceof to&&(m.hasCode(Cf)||m.status===404))return null;throw m}}async ensureBucket(R,t={}){let m={jurisdiction:t.jurisdiction},k=await this.getBucket(R,m);if(k)return{bucket:k,created:!1};let I={name:R};if(t.locationHint)I.locationHint=t.locationHint;let L=await this.request("POST","/buckets",I,m);return{bucket:{...L,name:L?.name||R},created:!0}}async getCors(R,t={}){try{return(await this.request("GET",`${this.bucketPath(R)}/cors`,void 0,t))?.rules??[]}catch(m){if(m instanceof to&&!(m instanceof Vi)&&(m.hasCode($f)||m.status===404))return[];throw m}}async putCors(R,t,m={}){if(t.length===0){await this.request("DELETE",`${this.bucketPath(R)}/cors`,void 0,m);return}await this.request("PUT",`${this.bucketPath(R)}/cors`,{rules:t},m)}async ensureCors(R,t,m={}){let k=await this.getCors(R,m);if(ea(k,t))return!1;return await this.putCors(R,t,m),!0}async getLifecycle(R,t={}){return(await this.request("GET",`${this.bucketPath(R)}/lifecycle`,void 0,t))?.rules??[]}async putLifecycle(R,t,m={}){await this.request("PUT",`${this.bucketPath(R)}/lifecycle`,{rules:t},m)}async ensureLifecycle(R,t,m={}){let k=await this.getLifecycle(R,m);if(ta(k,t))return!1;return await this.putLifecycle(R,t,m),!0}async listCustomDomains(R,t={}){return(await this.request("GET",`${this.bucketPath(R)}/domains/custom`,void 0,t))?.domains??[]}async attachCustomDomain(R,t,m={}){return this.request("POST",`${this.bucketPath(R)}/domains/custom`,{domain:t.domain,zoneId:t.zoneId,enabled:t.enabled??!0,minTLS:t.minTLS??"1.2"},m)}async updateCustomDomain(R,t,m,k={}){return this.request("PUT",`${this.bucketPath(R)}/domains/custom/${encodeURIComponent(t)}`,m,k)}async ensureCustomDomain(R,t,m={},k){let I=t.minTLS??"1.2",z=(k??await this.listCustomDomains(R,m)).find((X)=>X.domain.toLowerCase()===t.domain.toLowerCase());if(!z){let X=await this.attachCustomDomain(R,{...t,minTLS:I,enabled:!0},m);return{action:"attached",domain:{...X,domain:X?.domain||t.domain}}}let Y=z.minTLS??"1.0";if(z.enabled&&Y===I)return{action:"unchanged",domain:z};let Z=await this.updateCustomDomain(R,z.domain,{enabled:!0,minTLS:I},m);return{action:"updated",domain:{...z,...Z}}}async getManagedDomain(R,t={}){return this.request("GET",`${this.bucketPath(R)}/domains/managed`,void 0,t)}async setManagedDomain(R,t,m={}){let k=await this.getManagedDomain(R,m);if(k?.enabled===t)return{changed:!1,domain:k};return{changed:!0,domain:await this.request("PUT",`${this.bucketPath(R)}/domains/managed`,{enabled:t},m)}}}function hs(R){if(Array.isArray(R))return`[${R.map(hs).join(",")}]`;if(R&&typeof R==="object")return`{${Object.entries(R).filter(([,m])=>m!==void 0).sort(([m],[k])=>m.localeCompare(k)).map(([m,k])=>`${JSON.stringify(m)}:${hs(k)}`).join(",")}}`;return JSON.stringify(R)}function Jd(R,t){let m=(k)=>k&&k.length>0?[...k].map(String).sort():void 0;return{id:t?R.id:void 0,allowed:{origins:m(R.allowed?.origins),methods:m(R.allowed?.methods?.map((k)=>k.toUpperCase())),headers:m(R.allowed?.headers?.map((k)=>k.toLowerCase()))},exposeHeaders:m(R.exposeHeaders?.map((k)=>k.toLowerCase())),maxAgeSeconds:R.maxAgeSeconds}}function ea(R,t){if(R.length!==t.length)return!1;return t.every((m,k)=>{let I=m.id!==void 0;return hs(Jd(R[k],I))===hs(Jd(m,I))})}function ta(R,t){if(R.length!==t.length)return!1;let m=(k)=>hs([...k].map((I)=>({...I,storageClassTransitions:I.storageClassTransitions?.length?I.storageClassTransitions:void 0})).sort((I,L)=>I.id.localeCompare(L.id)));return m(R)===m(t)}var kf="r2 cache",Af=/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;async function Zc(R,t={}){let m=t.log??(()=>{}),k={buckets:[],warnings:[]},I=R.infrastructure?.r2??R.r2,L=Object.entries(I?.buckets??{});if(L.length===0)return m("R2: no buckets declared, skipping."),k;if(!t.apiToken||!t.accountId){let ee=[!t.apiToken&&"CLOUDFLARE_API_TOKEN",!t.accountId&&"CLOUDFLARE_ACCOUNT_ID"].filter(Boolean).join(" and "),oe=`R2: ${L.length} bucket(s) declared but ${ee} is not set, skipping.`;return m(oe),k.warnings.push(oe),k}let z=t.dryRun===!0,Y=new Oo({apiToken:t.apiToken,accountId:t.accountId,fetch:t.fetch}),Z=new ye(t.apiToken,{zoneId:t.zoneId,accountId:t.accountId}),X=new Map;for(let[ee,oe]of L){let se=oe?.name;if(!se||!Af.test(se)){k.warnings.push(`R2: bucket '${ee}' has an invalid name '${se??""}' (3-63 chars: lowercase letters, digits, hyphens), skipping.`);continue}m(`R2: ${z?"checking":"reconciling"} bucket ${se}...`);let ue={name:se,changes:[],domains:[]};if(k.buckets.push(ue),await Rf(oe,{r2:Y,cloudflare:Z,dryRun:z,summary:ue,warnings:k.warnings,claimed:X,log:m}),ue.changes.length===0)m(`R2: ${se} is in sync.`);else for(let ke of ue.changes)m(`R2: ${se}: ${ke}`)}return k}async function Rf(R,t){let{r2:m,dryRun:k,summary:I,warnings:L}=t,z=R.name,Y={jurisdiction:R.jurisdiction},Z=(ue,ke)=>{let ce=k?ke&&`would ${ke}`:ue;if(ce)I.changes.push(ce)},X;if(k)X=await m.getBucket(z,Y)!==null;else{let{created:ue}=await m.ensureBucket(z,{locationHint:R.locationHint,jurisdiction:R.jurisdiction});if(X=!0,ue)Z("created","")}if(!X)Z("","create bucket");let ee=Pf(R.customDomains);await ys(t,`cors on ${z}`,async()=>{if(!R.cors)return;if(!X){Z("cors updated","set cors");return}let ue=await m.getCors(z,Y);if(ea(ue,R.cors))return;if(!k)await m.putCors(z,R.cors,Y);Z(R.cors.length===0?"cors removed":"cors updated",R.cors.length===0?"remove cors":"update cors")}),await ys(t,`lifecycle on ${z}`,async()=>{if(!R.lifecycle)return;let ue=R.lifecycle.map(Xd);if(X){let ke=await m.getLifecycle(z,Y);if(ta(ke,ue))return}if(!k)await m.putLifecycle(z,ue,Y);Z("lifecycle updated","update lifecycle")}),await ys(t,`r2.dev URL on ${z}`,async()=>{let ue=R.publicDevUrl===!0;if(!X){if(ue)Z("r2.dev URL enabled","enable r2.dev URL");return}if((await m.getManagedDomain(z,Y))?.enabled===ue)return;if(!k)await m.setManagedDomain(z,ue,Y);Z(ue?"r2.dev URL enabled":"r2.dev URL disabled",ue?"enable r2.dev URL":"disable r2.dev URL")});let oe=[];if(ee.length>0&&X)try{oe=await m.listCustomDomains(z,Y)}catch(ue){if(ue instanceof Vi)throw ue;L.push(`R2: could not list custom domains on ${z}: ${el(ue)}`)}let se=new Map;for(let{domain:ue,minTLS:ke}of ee){let ce=t.claimed.get(ue);if(ce&&ce!==z){L.push(`R2: ${ue} is declared on both ${ce} and ${z}; leaving it on ${ce}.`);continue}t.claimed.set(ue,z);let Se=oe.find((ve)=>ve.domain.toLowerCase()===ue),xe=ke??"1.2";if(Se&&Se.enabled&&(Se.minTLS??"1.0")===xe){if(I.domains.push({domain:ue,status:Yc(Se)}),Se.zoneId)se.set(ue,Se.zoneId);continue}await ys(t,`custom domain ${ue} on ${z}`,async()=>{if(Se){if(!k)await m.updateCustomDomain(z,Se.domain,{enabled:!0,minTLS:xe},Y);if(Z(`custom domain ${ue} updated`,`update custom domain ${ue}`),I.domains.push({domain:ue,status:Yc({...Se,enabled:!0})}),Se.zoneId)se.set(ue,Se.zoneId);return}let ve=await t.cloudflare.zoneIdFor(ue);if(se.set(ue,ve),!k)await m.ensureCustomDomain(z,{domain:ue,zoneId:ve,minTLS:xe},Y,oe);Z(`custom domain ${ue} attached`,`attach custom domain ${ue}`),I.domains.push({domain:ue,status:k?"not attached":"pending"})},()=>I.domains.push({domain:ue,status:"error"}))}if(R.cache&&ee.length>0)await If(R,ee.map((ue)=>ue.domain).filter((ue)=>t.claimed.get(ue)===z),se,t,Z)}async function If(R,t,m,k,I){let L=Zd(R.cache);if(!L||t.length===0)return;let z=new Map;for(let Y of t){let Z=m.get(Y);if(!Z)try{Z=await k.cloudflare.zoneIdFor(Y)}catch(X){k.warnings.push(`R2: could not resolve the zone for ${Y}, cache rule skipped: ${el(X)}`);continue}z.set(Z,[...z.get(Z)??[],Y])}for(let Y of z.values()){let Z={action:"set_cache_settings",description:`${Nr} ${kf}`,expression:`(${kr(Y)})`,enabled:!0,action_parameters:L};await ys(k,`cache rule for ${Y.join(", ")}`,async()=>{let X=await k.cloudflare.getPhaseRules(Y[0],"http_request_cache_settings");if(Qd(X,Z))return;if(!k.dryRun){let ee=await k.cloudflare.putManagedPhaseRules(Y[0],"http_request_cache_settings",[Z]);if(!ee.success)throw Error(ee.message||"cache rule write failed")}I(`cache rule updated for ${Y.join(", ")}`,`update cache rule for ${Y.join(", ")}`)})}}function Zd(R){if(R.edgeTtl===void 0&&R.browserTtl===void 0)return null;let t={cache:!0};if(R.edgeTtl!==void 0)t.edge_ttl={mode:"override_origin",default:R.edgeTtl};if(R.browserTtl!==void 0)t.browser_ttl={mode:"override_origin",default:R.browserTtl};return t}function Qd(R,t){let m=xr(t.expression),k=Bi(t.expression),I=(Y)=>(Y.description||"").startsWith(Nr),L=(Y)=>Y.action===t.action&&Y.description===t.description&&(Y.enabled??!0)===(t.enabled??!0)&&Bi(Y.expression)===k&&na(Y.action_parameters)===na(t.action_parameters),z=!1;for(let Y of R){if(!I(Y))continue;let Z=xr(Y.expression);if(!m.some((ee)=>Z.includes(ee)))continue;if(L(Y)&&m.every((ee)=>Z.includes(ee))&&!z){z=!0;continue}return!1}return z}function Xd(R){let t={id:R.id,enabled:R.enabled??!0,conditions:{prefix:R.prefix??""}};if(R.expireAfterDays!==void 0)t.deleteObjectsTransition={condition:{type:"Age",maxAge:Kc(R.expireAfterDays)}};else if(R.expireOn!==void 0)t.deleteObjectsTransition={condition:{type:"Date",date:R.expireOn}};if(R.abortMultipartUploadsAfterDays!==void 0)t.abortMultipartUploadsTransition={condition:{type:"Age",maxAge:Kc(R.abortMultipartUploadsAfterDays)}};if(R.infrequentAccessAfterDays!==void 0)t.storageClassTransitions=[{storageClass:"InfrequentAccess",condition:{type:"Age",maxAge:Kc(R.infrequentAccessAfterDays)}}];return t}function Kc(R){return Math.round(R*86400)}function Pf(R){let t=new Set,m=[];for(let k of R??[]){let I=typeof k==="string"?{domain:k}:k,L=I.domain?.trim().replace(/\.$/,"").toLowerCase();if(!L||t.has(L))continue;t.add(L),m.push({domain:L,minTLS:I.minTLS})}return m}function Yc(R){if(!R.enabled)return"disabled";let t=R.status?.ownership,m=R.status?.ssl;if(t==="active"&&m==="active")return"active";for(let k of[t,m])if(k==="error"||k==="blocked"||k==="deactivated")return k;return"pending"}async function ys(R,t,m,k){try{await m()}catch(I){if(I instanceof Vi)throw I;R.warnings.push(`R2: ${t} failed: ${el(I)}`),k?.()}}function el(R){return R instanceof Error?R.message:String(R)}function na(R){if(Array.isArray(R))return`[${R.map(na).join(",")}]`;if(R&&typeof R==="object")return`{${Object.entries(R).filter(([,m])=>m!==void 0).sort(([m],[k])=>m.localeCompare(k)).map(([m,k])=>`${JSON.stringify(m)}:${na(k)}`).join(",")}}`;return JSON.stringify(R)}import{basename as Lf,extname as Ff}from"node:path";import{createHash as xf}from"node:crypto";var Df="https://api.cloudflare.com/client/v4",qi="TS_CLOUD_CONTENT_HASH",ws="2025-09-01",il="application/javascript+module",Ef=10007,Tf=[1e4,9109];class Lo extends Error{status;errors;constructor(R,t,m=[]){super(R);this.name="WorkersApiError",this.status=t,this.errors=m}hasCode(R){return this.errors.some((t)=>t.code===R)}}class ra extends Lo{permission;constructor(R,t,m,k=[]){super(`The Cloudflare API token is missing the "${R}" permission (${t}). Edit the token in the Cloudflare dashboard (My Profile, API Tokens), add it, then re-run the deploy.`,m,k);this.name="WorkersPermissionError",this.permission=R}}class ia{name="cloudflare-workers";apiToken;accountId;fetchImpl;constructor(R){if(!R.apiToken)throw Error("Cloudflare Workers needs an API token");if(!R.accountId)throw Error("Cloudflare Workers needs an account id");this.apiToken=R.apiToken,this.accountId=R.accountId,this.fetchImpl=R.fetch??((t,m)=>fetch(t,m))}async request(R,t,m){let k={Authorization:`Bearer ${this.apiToken}`},I;if(m instanceof FormData)I=m;else if(m!==void 0)k["Content-Type"]="application/json",I=JSON.stringify(m);let L=await this.fetchImpl(`${Df}/accounts/${this.accountId}/workers${t}`,{method:R,headers:k,body:I}),z=await L.text(),Y;try{Y=JSON.parse(z)}catch{throw new Lo(`Cloudflare Workers API returned ${L.status} with a non-JSON body: ${z.slice(0,200)}`,L.status)}if(!Y.success){let Z=Y.errors??[],X=Z.map((ee)=>`${ee.code}: ${ee.message}`).join(", ");if(Nf(L.status,Z))throw new ra(Of(t),`${R} ${t} -> ${L.status}${X?`, ${X}`:""}`,L.status,Z);throw new Lo(`Cloudflare Workers API error (${L.status}) on ${R} ${t}: ${X||z.slice(0,200)}`,L.status,Z)}return Y.result}scriptPath(R){return`/scripts/${encodeURIComponent(R)}`}async getSettings(R){try{return await this.request("GET",`${this.scriptPath(R)}/settings`)}catch(t){if(t instanceof ra)throw t;if(t instanceof Lo&&(t.hasCode(Ef)||t.status===404))return null;throw t}}async getScript(R){return this.getSettings(R)}async uploadModuleScript(R,t){return this.request("PUT",this.scriptPath(R),tu(t))}async ensureModuleScript(R,t){let m=Cs(t),k=await this.getSettings(R);if(k&&aa(k,t,m))return{action:"unchanged",hash:m};return await this.uploadModuleScript(R,nu(t,m)),{action:k?"updated":"created",hash:m}}async listCustomDomains(R={}){let t=new URLSearchParams;if(R.service)t.set("service",R.service);if(R.hostname)t.set("hostname",R.hostname);if(R.zoneId)t.set("zone_id",R.zoneId);let m=t.toString(),k=m?`?${m}`:"";return await this.request("GET",`/domains${k}`)??[]}async attachCustomDomain(R,t){let m={hostname:R,service:t.service,environment:t.environment??"production"};if(t.zoneId)m.zone_id=t.zoneId;return this.request("PUT","/domains",m)}async detachCustomDomain(R){await this.request("DELETE",`/domains/${encodeURIComponent(R)}`)}async ensureCustomDomain(R,t,m){let I=(m??await this.listCustomDomains({hostname:R})).find((z)=>z.hostname.toLowerCase()===R.toLowerCase());if(I&&I.service===t.service)return{action:"unchanged",domain:I};if(I)throw Error(`${R} is attached to the Worker '${I.service}'. Detach it there first (Workers & Pages, ${I.service}, Settings, Domains & Routes); ts-cloud does not move it.`);let L=await this.attachCustomDomain(R,t);return{action:"attached",domain:{...L,hostname:L?.hostname||R}}}}function Nf(R,t){if(t.some((m)=>Tf.includes(m.code)))return!0;return(R===401||R===403)&&t.length===0}function Of(R){if(R.startsWith("/domains"))return"Workers Routes: Edit (zone, for Workers custom domains) and Workers Scripts: Edit (account)";return"Workers Scripts: Edit (account)"}function tu(R){if(!R.modules.some((k)=>k.name===R.mainModule))throw Error(`Worker main module '${R.mainModule}' is not one of the uploaded modules`);let t={main_module:R.mainModule,bindings:R.bindings??[],compatibility_date:R.compatibilityDate??ws,compatibility_flags:R.compatibilityFlags??[],keep_bindings:["secret_text"]},m=new FormData;m.append("metadata",JSON.stringify(t));for(let k of R.modules)m.append(k.name,new Blob([k.content],{type:k.type}),k.name);return m}function Cs(R){let t={mainModule:R.mainModule,modules:[...R.modules].sort((m,k)=>m.name.localeCompare(k.name)).map((m)=>({name:m.name,type:m.type,sha256:eu(m.content)})),bindings:[...R.bindings??[]].filter((m)=>m.name!==qi).sort((m,k)=>m.name.localeCompare(k.name)),compatibilityDate:R.compatibilityDate??ws,compatibilityFlags:[...R.compatibilityFlags??[]].sort()};return eu(nl(t))}function nu(R,t=Cs(R)){return{...R,bindings:[...(R.bindings??[]).filter((m)=>m.name!==qi),{type:"plain_text",name:qi,text:t}]}}function aa(R,t,m){let k=R.bindings??[],I=k.find((L)=>L.name===qi&&L.type==="plain_text");if(!I||I.text!==m)return!1;return(t.bindings??[]).every((L)=>{let z=k.find((Z)=>Z.name===L.name);if(!z||z.type!==L.type)return!1;let Y=L.type==="r2_bucket"?"bucket_name":L.type==="plain_text"?"text":void 0;return!Y||z[Y]===L[Y]})}function eu(R){return xf("sha256").update(R).digest("hex")}function nl(R){if(Array.isArray(R))return`[${R.map(nl).join(",")}]`;if(R&&typeof R==="object")return`{${Object.entries(R).filter(([,m])=>m!==void 0).sort(([m],[k])=>m.localeCompare(k)).map(([m,k])=>`${JSON.stringify(m)}:${nl(k)}`).join(",")}}`;return JSON.stringify(R)}async function ol(R){if(!await Bun.file(R).exists())throw Error(`Worker entry not found: ${R}`);let t;try{t=await Bun.build({entrypoints:[R],target:"browser",format:"esm",minify:!0,external:["cloudflare:*"]})}catch(I){throw Error(`Bundling Worker ${R} failed: ${jf(I)}`)}if(!t.success)throw Error(`Bundling Worker ${R} failed: ${t.logs.map((I)=>String(I.message??I)).join("; ")}`);if(t.outputs.length!==1)throw Error(`Bundling Worker ${R} produced ${t.outputs.length} files (${t.outputs.map((I)=>I.path).join(", ")}); a Worker is uploaded as a single module, so remove the dynamic imports or asset imports that split it.`);let m=t.outputs[0];if(m.kind!=="entry-point")throw Error(`Bundling Worker ${R} produced a ${m.kind} instead of an entry module`);let k=await m.text();return{name:`${Lf(R,Ff(R))}.js`,content:k,type:il,size:new TextEncoder().encode(k).byteLength}}function jf(R){if(R instanceof AggregateError&&R.errors.length>0)return R.errors.map((t)=>t instanceof Error?t.message:String(t?.message??t)).join("; ");return R instanceof Error?R.message:String(R)}import{isAbsolute as Bf,resolve as _f}from"node:path";var Mf="https://api.cloudflare.com/client/v4",zf=/^[a-z0-9][a-z0-9_-]{0,62}$/;async function sl(R,t={}){let m=t.log??(()=>{}),k={workers:[],warnings:[]},I=Object.entries(R.infrastructure?.workers??R.workers??{});if(I.length===0)return m("Workers: none declared, skipping."),k;if(!t.apiToken||!t.accountId){let Y=[!t.apiToken&&"CLOUDFLARE_API_TOKEN",!t.accountId&&"CLOUDFLARE_ACCOUNT_ID"].filter(Boolean).join(" and "),Z=`Workers: ${I.length} Worker(s) declared but ${Y} is not set, skipping.`;return m(Z),k.warnings.push(Z),k}let L=R.infrastructure?.r2??R.r2,z={workers:new ia({apiToken:t.apiToken,accountId:t.accountId,fetch:t.fetch}),r2:new Oo({apiToken:t.apiToken,accountId:t.accountId,fetch:t.fetch}),cloudflare:new ye(t.apiToken,{zoneId:t.zoneId,accountId:t.accountId}),apiToken:t.apiToken,fetch:t.fetch??((Y,Z)=>fetch(Y,Z)),projectRoot:t.projectRoot??process.cwd(),dryRun:t.dryRun===!0,warnings:k.warnings,log:m,r2ConfigDomains:Gf(L),r2Buckets:L,claimed:new Map};for(let[Y,Z]of I){let X=Z?.name;if(!X||!zf.test(X)){k.warnings.push(`Workers: '${Y}' has an invalid name '${X??""}' (1-63 chars: lowercase letters, digits, '-' and '_'), skipping.`);continue}if(!Z.entry){k.warnings.push(`Workers: ${X} has no entry, skipping.`);continue}m(`Workers: ${z.dryRun?"checking":"reconciling"} ${X}...`);let ee={name:X,changes:[],domains:[]};k.workers.push(ee),await Uf(Z,ee,z);for(let oe of ee.changes)m(`Workers: ${X}: ${oe}`)}return k}async function Uf(R,t,m){let k=R.name,I=Bf(R.entry)?R.entry:_f(m.projectRoot,R.entry),L;try{L=await ol(I)}catch(Y){throw Error(`Worker ${k}: ${Fo(Y)}`)}t.changes.push(`bundled ${Jf(L.size)}`);let z={mainModule:L.name,modules:[{name:L.name,content:L.content,type:L.type}],bindings:ru(R,m),compatibilityDate:R.compatibilityDate??ws,compatibilityFlags:R.compatibilityFlags??[]};if(m.dryRun){let Y=await m.workers.getSettings(k);t.changes.push(Y&&aa(Y,z,Cs(z))?"unchanged":"would upload")}else{let{action:Y}=await m.workers.ensureModuleScript(k,z);t.changes.push(Y==="unchanged"?"unchanged":"uploaded")}for(let Y of Kf(R.customDomains))await Wf(k,Y,t,m)}async function Wf(R,t,m,k){let I=(ue)=>{m.domains.push({domain:t,status:ue})},L=(ue)=>{k.warnings.push(`Workers: ${ue}`),I("conflict")},z=k.claimed.get(t);if(z&&z!==R){L(`${t} is declared on both ${z} and ${R}; leaving it on ${z}.`);return}k.claimed.set(t,R);let Y=k.r2ConfigDomains.get(t);if(Y){L(`${t} is also declared as a custom domain of the R2 bucket '${Y}' (r2.buckets). A hostname serves either a bucket or a Worker. Remove it from the bucket's customDomains and detach it in the dashboard (R2, ${Y}, Settings, Custom Domains) first; to serve the bucket through the Worker, bind it with bindings.r2Buckets instead.`);return}let Z=await Vf(k);if(Z===null){I("error");return}let X=Z.find((ue)=>ue.hostname.toLowerCase()===t);if(X?.service===R){I("active");return}if(X){L(`${t} is attached to the Worker '${X.service}'. Detach it there first (Workers & Pages, ${X.service}, Settings, Domains & Routes); it is not moved automatically.`);return}let ee=(await qf(k))?.get(t);if(ee){L(`${t} is attached to the R2 bucket '${ee}' as a custom domain. Detach it first (R2, ${ee}, Settings, Custom Domains, then re-run the deploy); it is not detached automatically. To serve the bucket through the Worker, bind it with bindings.r2Buckets.`);return}let oe;try{oe=await k.cloudflare.zoneIdFor(t)}catch(ue){k.warnings.push(`Workers: could not resolve the zone for ${t}, not attached: ${Fo(ue)}`),I("error");return}let se=await Hf(k,oe,t);if(se.length>0){let ue=se.map((ke)=>`${ke.type} ${ke.content}`).join(", ");L(`${t} already has a DNS record (${ue}). A Worker custom domain creates its own record, so Cloudflare will not attach over it. Delete the record first (DNS, Records), then re-run the deploy; it is not deleted automatically.`);return}if(k.dryRun){m.changes.push(`would attach custom domain ${t}`),I("not attached");return}try{await k.workers.ensureCustomDomain(t,{service:R,zoneId:oe},Z),m.changes.push(`custom domain ${t} attached`),Z.push({id:"",hostname:t,service:R,zone_id:oe}),I("pending")}catch(ue){k.warnings.push(`Workers: custom domain ${t} on ${R} failed: ${Fo(ue)}`),I("error")}}async function Vf(R){if(R.attached!==void 0)return R.attached;try{R.attached=await R.workers.listCustomDomains()}catch(t){R.warnings.push(`Workers: could not list Worker custom domains, none attached: ${Fo(t)}`),R.attached=null}return R.attached}async function qf(R){if(R.r2AccountDomains!==void 0)return R.r2AccountDomains;let t=new Map;try{let m=(await R.r2.listBuckets()).map((k)=>({name:k.name}));for(let k of Object.values(R.r2Buckets?.buckets??{}))if(k.jurisdiction&&k.jurisdiction!=="default")m.push({name:k.name,jurisdiction:k.jurisdiction});for(let k of m){let I=await R.r2.listCustomDomains(k.name,{jurisdiction:k.jurisdiction}).catch(()=>[]);for(let L of I)t.set(L.domain.toLowerCase(),k.name)}R.r2AccountDomains=t}catch(m){R.log(`Workers: could not check R2 custom domains (${Fo(m)}); relying on the DNS check.`),R.r2AccountDomains=null}return R.r2AccountDomains}async function Hf(R,t,m){try{let k=await R.fetch(`${Mf}/zones/${t}/dns_records?name=${encodeURIComponent(m)}&per_page=100`,{method:"GET",headers:{Authorization:`Bearer ${R.apiToken}`}}),I=await k.json();if(!I?.success)throw Error(`HTTP ${k.status}`);return(I.result??[]).filter((L)=>L.name?.toLowerCase()===m).map((L)=>({type:L.type??"?",content:L.content??""}))}catch(k){return R.log(`Workers: could not read DNS records for ${m} (${Fo(k)}); attaching anyway.`),[]}}function ru(R,t){let m=[],k=new Set,I=(z)=>{if(z===qi)return t.warnings.push(`Workers: ${R.name}: binding name ${qi} is reserved for ts-cloud, ignored.`),!1;if(k.has(z))return t.warnings.push(`Workers: ${R.name}: binding ${z} is declared twice; the first one wins.`),!1;return k.add(z),!0},L=new Map;for(let z of Object.values(t.r2Buckets?.buckets??{}))if(z.jurisdiction&&z.jurisdiction!=="default")L.set(z.name,z.jurisdiction);for(let[z,Y]of Object.entries(R.bindings?.r2Buckets??{})){if(!I(z))continue;let Z=L.get(Y);m.push(Z?{type:"r2_bucket",name:z,bucket_name:Y,jurisdiction:Z}:{type:"r2_bucket",name:z,bucket_name:Y})}for(let[z,Y]of Object.entries(R.bindings?.vars??{}))if(I(z))m.push({type:"plain_text",name:z,text:String(Y)});return m}function Gf(R){let t=new Map;for(let m of Object.values(R?.buckets??{}))for(let k of m?.customDomains??[]){let I=iu(typeof k==="string"?k:k.domain);if(I)t.set(I,m.name)}return t}function Kf(R){return[...new Set((R??[]).map(iu).filter(Boolean))]}function iu(R){return(R??"").trim().replace(/\.$/,"").toLowerCase()}function Jf(R){if(R<1024)return`${R} B`;if(R<1048576)return`${(R/1024).toFixed(1)} KB`;return`${(R/1024/1024).toFixed(1)} MB`}function Fo(R){return R instanceof Error?R.message:String(R)}async function eg(R){let t=ya();if(t.emptyEnvKey||t.emptyEnvSecret)a("Empty AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY env var detected — likely a misconfigured .env file. Remove the empty lines or fill them in.");e(`AWS credentials: ${t.description}`);try{let k=await new vt(R).getCallerIdentity();if(k.Arn)e(`AWS identity: ${k.Arn}`)}catch(m){a(`Could not verify AWS identity: ${m.message}`)}}function tg(){try{return dl("git rev-parse --short HEAD",{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{return Date.now().toString(36)}}async function al(R,t,m,k){let{ensureManagementDashboard:I}=await import("./chunk-n6yvpj86.js");I(R,{logger:{info:e,warn:a}});let L=R.sites||{},z=Object.entries(L);if(z.length===0)return a("infrastructure.compute is set but no sites are configured — nothing to deploy. Add sites to `cloud.config.ts`."),!0;if(k&&!L[k])return r(`Site '${k}' was not found. Configured sites: ${z.map(([xe])=>xe).join(", ")}`),!1;let Y=z.filter(([xe,ve])=>{if(!ve)return!1;if(k&&xe!==k)return!1;if(A(ve)==="bucket")return a(`Site '${xe}' targets a bucket — skipping compute deploy (handled by the static-site path).`),!1;return Js(ve)});if(k)e(`Deploying only '${k}'. Other sites keep their current release; proxy routes are still regenerated in full.`);let Z=R.project.slug,ee=(R.infrastructure?.compute||{}).runtime||"bun",oe=O({config:R}),se=tg(),ue=new Map,ke=new Map,ce={step:(xe)=>u(xe),error:(xe)=>r(xe)};if(!await fs(R,"beforeDeploy",ce))return!1;if(!await fs(R,"beforeBuild",ce))return!1;for(let[xe,ve]of Y){let Re=A(ve);if(i(`Preparing site: ${xe}`),e(`Domain: ${ve.domain||"(none)"}`),e(`Source: ${ve.root}`),e(`Kind: ${Re==="server-static"?"static (shipped to /var/www)":"app (systemd service)"}`),Re==="server-app")e(`Start: ${ve.start}`),e(`Port: ${ve.port??"(unset)"}`);if(ve.build){u(`Running build: ${ve.build}`);try{dl(ve.build,{stdio:"inherit",cwd:process.cwd()})}catch(ze){return r(`Build failed for site '${xe}': ${ze.message}`),!1}}let Ie=Gd({root:ve.root,siteName:xe,expectIndex:Re==="server-static"});for(let ze of Ie)if(ze.level==="error")r(ze.message);else a(ze.message);if(Ie.some((ze)=>ze.level==="error"))return!1;let Me=ve.build?void 0:JSON.stringify([Xf(ve.root),[...ve.exclude||[]].sort()]),Ne=Me?ke.get(Me):void 0;if(Ne){u(`Reusing package for ${ve.root} → ${Ne}`),ue.set(xe,Ne);continue}let Fe=lu(cu(),`${Z}-${xe}-${se}.tar.gz`);u(`Packaging ${ve.root} → ${Fe}`);try{let ze=(ve.exclude||[]).map((ot)=>`--exclude=${ot}`);Yf("tar",["czf",Fe,"-C",ve.root,...ze,"."],{stdio:"inherit",env:{...process.env,COPYFILE_DISABLE:"1"}})}catch(ze){return r(`Failed to package '${xe}': ${ze.message}`),!1}if(ue.set(xe,Fe),Me)ke.set(Me,Fe)}if(!await fs(R,"afterBuild",ce))return!1;let Se=await Po({config:k?{...R,sites:Object.fromEntries(Y)}:R,rpxConfig:k?R:void 0,environment:t,driver:oe,sha:se,runtime:ee,tarballForSite:(xe)=>{let ve=ue.get(xe);if(!ve)throw Error(`Missing tarball for site '${xe}'`);return ve},logger:{info:(xe)=>e(xe),warn:(xe)=>a(xe),error:(xe)=>r(xe),step:(xe)=>u(xe),success:(xe)=>n(xe)}});if(Se&&!await fs(R,"afterDeploy",ce))return!1;return Se}async function ca(R){let t=new Zr;if(u("Running pre-deployment security scan..."),R.exclude?.length)e(`Excluding from the scan: ${R.exclude.join(", ")}`);let m=await t.scan({directory:R.sourceDir,failOnSeverity:R.failOnSeverity||"critical",skipPatterns:R.skipPatterns,exclude:R.exclude});return{passed:m.passed,result:m}}function ng(){let R=lu(cu(),`ts-cloud-empty-scan-${process.pid}`);return au(R,{recursive:!0}),R}function la(R){let{summary:t,findings:m,scannedFiles:k,duration:I}=R;if(e(`
 Scanned ${k} files in ${I}ms`),t.critical>0)r(`  Critical: ${t.critical}`);else e(`  Critical: ${t.critical}`);if(t.high>0)a(`  High: ${t.high}`);else e(`  High: ${t.high}`);if(e(`  Medium: ${t.medium}`),e(`  Low: ${t.low}`),m.length>0){e(`
-Findings:`);let L=m.filter((ie)=>ie.pattern.severity==="critical"),z=m.filter((ie)=>ie.pattern.severity==="high"),Y=m.filter((ie)=>ie.pattern.severity==="medium"),Z=m.filter((ie)=>ie.pattern.severity==="low"),X=(ie,oe,ae)=>{if(ie.length>0){console.log(`
-${Kt(`[${oe}]`,ae)}`);for(let be of ie.slice(0,10))e(`  ${be.pattern.name}`),e(`    File: ${be.file}:${be.line}`),e(`    Match: ${be.match}`);if(ie.length>10)e(`  ... and ${ie.length-10} more ${oe.toLowerCase()} findings`)}};X(L,"CRITICAL","red"),X(z,"HIGH","yellow"),X(Y,"MEDIUM","blue"),X(Z,"LOW","gray")}}function du(R,t){let m=Object.keys(R.environments??{});if(t&&m.includes(t))return t;if(m.includes("production"))return"production";if(m[0])return m[0];throw Error("A configured environment is required for security policy evaluation")}function cl(R,t,m){let k=du(R,t),I=y(process.cwd(),R);try{let L=new Ut(I.store);ai(I);let z=pe(I,k);if(m)gc(L,z,m);else fc(L,z);let Y=gr(L,{scope:z,desiredConfigHash:I.project.desiredConfigHash});return e(`Security policy: ${Y.decision.policyId} v${Y.decision.policyVersion} — ${Y.decision.outcome.toUpperCase()}`),e(`Security decision: ${Y.decision.explanation}`),{allowed:Y.decision.outcome!=="block",explanation:Y.decision.explanation}}finally{I.store.close()}}async function rg(R,t){let m=du(R),k=y(process.cwd(),R);try{let I=new Ut(k.store);ai(k);let L=pe(k,m),z=t.imageSha256?`${t.imageRef}@sha256:${t.imageSha256.replace(/^sha256:/,"")}`:t.imageRef;u("Scanning the built image and producing release security artifacts...");let Y=await hc(I,{scope:L,releaseId:z,imageRef:t.imageRef,imageSha256:t.imageSha256,artifactRoot:t.artifactRoot,invocationId:t.invocationId,startedAt:t.startedAt,externalParameters:{imageRef:t.imageRef,artifactRoot:t.artifactRoot}});e(`Image scanner: ${Y.scan.run.status} (${Y.scan.findings.length} findings)`),e(`Release SBOM: ${Y.sbomSource==="image"?"full image inventory":Y.sbomSource==="manifest"?"package-manifest fallback":"unavailable"}`);let Z=gr(I,{scope:L,operationId:t.invocationId,desiredConfigHash:k.project.desiredConfigHash});return e(`Release policy: ${Z.decision.policyId} v${Z.decision.policyVersion} — ${Z.decision.outcome.toUpperCase()}`),e(`Release decision: ${Z.decision.explanation}`),{allowed:Z.decision.outcome!=="block",explanation:Z.decision.explanation}}finally{k.store.close()}}function ig(R){try{let t=y(process.cwd(),R),m=new or(t.store).current();if(!m.attackMode&&!m.mitigationPause&&m.ipRules.allow.length===0&&m.ipRules.block.length===0)return R;let k=ds(R,m);return e(`Applying protection controls: ${m.ipRules.allow.length} allow, ${m.ipRules.block.length} block${m.attackMode?", attack mode ON":""}${m.mitigationPause?", mitigation PAUSED":""}`),k}catch{return R}}function ul(R){R.command("deploy:security-scan","Run pre-deployment security scan").option("--source <path>","Source directory to scan",{default:"."}).option("--fail-on <severity>","Fail on severity level (critical, high, medium, low)",{default:"critical"}).option("--skip-patterns <patterns>","Comma-separated list of pattern names to skip").action(async(t)=>{i("Pre-Deployment Security Scan");try{let m=t?.source||".",k=t?.failOn||"critical",I=t?.skipPatterns?.split(",").map((Y)=>Y.trim())||[];if(!In(m)){r(`Source directory not found: ${m}`);return}e(`Source: ${m}`),e(`Fail on: ${k} or higher severity`);let{passed:L,result:z}=await pa({sourceDir:m,failOnSeverity:k,skipPatterns:I});if(fa(z),L)n(`
+Findings:`);let L=m.filter((ee)=>ee.pattern.severity==="critical"),z=m.filter((ee)=>ee.pattern.severity==="high"),Y=m.filter((ee)=>ee.pattern.severity==="medium"),Z=m.filter((ee)=>ee.pattern.severity==="low"),X=(ee,oe,se)=>{if(ee.length>0){console.log(`
+${Xt(`[${oe}]`,se)}`);for(let ue of ee.slice(0,10))e(`  ${ue.pattern.name}`),e(`    File: ${ue.file}:${ue.line}`),e(`    Match: ${ue.match}`);if(ee.length>10)e(`  ... and ${ee.length-10} more ${oe.toLowerCase()} findings`)}};X(L,"CRITICAL","red"),X(z,"HIGH","yellow"),X(Y,"MEDIUM","blue"),X(Z,"LOW","gray")}}function du(R,t){let m=Object.keys(R.environments??{});if(t&&m.includes(t))return t;if(m.includes("production"))return"production";if(m[0])return m[0];throw Error("A configured environment is required for security policy evaluation")}function cl(R,t,m){let k=du(R,t),I=y(process.cwd(),R);try{let L=new Ft(I.store);li(I);let z=me(I,k);if(m)Tc(L,z,m);else Ec(L,z);let Y=fr(L,{scope:z,desiredConfigHash:I.project.desiredConfigHash});return e(`Security policy: ${Y.decision.policyId} v${Y.decision.policyVersion} — ${Y.decision.outcome.toUpperCase()}`),e(`Security decision: ${Y.decision.explanation}`),{allowed:Y.decision.outcome!=="block",explanation:Y.decision.explanation}}finally{I.store.close()}}async function rg(R,t){let m=du(R),k=y(process.cwd(),R);try{let I=new Ft(k.store);li(k);let L=me(k,m),z=t.imageSha256?`${t.imageRef}@sha256:${t.imageSha256.replace(/^sha256:/,"")}`:t.imageRef;u("Scanning the built image and producing release security artifacts...");let Y=await wc(I,{scope:L,releaseId:z,imageRef:t.imageRef,imageSha256:t.imageSha256,artifactRoot:t.artifactRoot,invocationId:t.invocationId,startedAt:t.startedAt,externalParameters:{imageRef:t.imageRef,artifactRoot:t.artifactRoot}});e(`Image scanner: ${Y.scan.run.status} (${Y.scan.findings.length} findings)`),e(`Release SBOM: ${Y.sbomSource==="image"?"full image inventory":Y.sbomSource==="manifest"?"package-manifest fallback":"unavailable"}`);let Z=fr(I,{scope:L,operationId:t.invocationId,desiredConfigHash:k.project.desiredConfigHash});return e(`Release policy: ${Z.decision.policyId} v${Z.decision.policyVersion} — ${Z.decision.outcome.toUpperCase()}`),e(`Release decision: ${Z.decision.explanation}`),{allowed:Z.decision.outcome!=="block",explanation:Z.decision.explanation}}finally{k.store.close()}}function ig(R){try{let t=y(process.cwd(),R),m=new sr(t.store).current();if(!m.attackMode&&!m.mitigationPause&&m.ipRules.allow.length===0&&m.ipRules.block.length===0)return R;let k=bs(R,m);return e(`Applying protection controls: ${m.ipRules.allow.length} allow, ${m.ipRules.block.length} block${m.attackMode?", attack mode ON":""}${m.mitigationPause?", mitigation PAUSED":""}`),k}catch{return R}}function ul(R){R.command("deploy:security-scan","Run pre-deployment security scan").option("--source <path>","Source directory to scan",{default:"."}).option("--fail-on <severity>","Fail on severity level (critical, high, medium, low)",{default:"critical"}).option("--skip-patterns <patterns>","Comma-separated list of pattern names to skip").action(async(t)=>{i("Pre-Deployment Security Scan");try{let m=t?.source||".",k=t?.failOn||"critical",I=t?.skipPatterns?.split(",").map((Y)=>Y.trim())||[];if(!Sn(m)){r(`Source directory not found: ${m}`);return}e(`Source: ${m}`),e(`Fail on: ${k} or higher severity`);let{passed:L,result:z}=await ca({sourceDir:m,failOnSeverity:k,skipPatterns:I});if(la(z),L)n(`
 ✓ Security scan passed - no blocking issues found`);else r(`
 ✗ Security scan failed - blocking issues detected`),e(`
-Recommendations:`),e("  1. Remove any hardcoded credentials from your code"),e("  2. Use environment variables or AWS Secrets Manager"),e("  3. Add sensitive files to .gitignore"),e("  4. Use --skip-patterns to ignore false positives"),process.exit(1)}catch(m){r(`Security scan failed: ${m.message}`),process.exit(1)}}),R.command("deploy","Deploy infrastructure").option("--stack <name>","Stack name").option("--env <environment>","Environment to deploy to").option("--site <name>","Deploy specific site only (routes are still regenerated in full)").option("--skip-security-scan","Skip pre-deployment security scan").option("--skip-dns-verification","Skip DNS provider verification and record creation (use when DNS is already configured)").option("--security-fail-on <severity>","Security scan fail threshold (critical, high, medium, low)",{default:"critical"}).option("--dry-run","Show the deployment plan without making changes").option("--yes","Skip confirmation prompts (non-interactive / CI)").action(async(t)=>{i("Deploying Infrastructure");let m=t?.yes===!0||process.env.CI==="true",k=t?.env||"staging",I=null;I=await og(k);try{let L=await Ne(),z=ig(L),{errors:Y,warnings:Z}=Fs(z);for(let it of Z)a(it);if(Y.length>0){r(`
-✗ Deployment configuration is invalid:`);for(let it of Y)r(`  • ${it}`);process.exitCode=1;return}if(t?.dryRun){if(t.site&&!z.sites?.[t.site]){r(`Site '${t.site}' was not found. Configured sites: ${Object.keys(z.sites||{}).join(", ")||"none"}`),process.exitCode=1;return}let it=H(z),Et=t.stack||T(z,k),hn=U(z),yn=z.project.region||"us-east-1",tr=t.site?[t.site]:Object.keys(z.sites||{});i("Deployment Plan"),e(`Cloud provider: ${hn}`),e(`Mode: ${it}`),e(`Stack: ${Et}`),e(`Region: ${yn}`),e(`Environment: ${k}`),e(`Sites: ${tr.length>0?tr.join(", "):"none"}`),await ou(z,{dryRun:!0}),await su(z,{dryRun:!0}),n("Dry run complete. No infrastructure, DNS, certificates, or application files were changed.");return}if(U(z)==="aws"){let it=z.project?.region||"us-east-1";await eg(it)}let X;if(!t?.skipSecurityScan){let it=Kc(z,t?.site);if(!it)e("This deploy ships no files — every site in scope is a redirect or proxy route, so only gateway routes and certificates change. Scanning an empty artifact.");let{result:Et}=await pa({sourceDir:it?process.cwd():ng(),failOnSeverity:t?.securityFailOn||"critical",exclude:z.infrastructure?.security?.scan?.exclude});fa(Et),X=Et}else a(`Security scan skipped (--skip-security-scan)
-`);let ie=cl(z,k,X);if(!ie.allowed){r(`
-✗ Deployment blocked by security policy: ${ie.explanation}`),e("Remediate the findings or create an authorized, time-limited waiver in the Security posture center."),process.exitCode=1;return}if(n(`✓ Security policy allows this deployment
-`),!await ou(z)){process.exitCode=1;return}if(!await su(z)){process.exitCode=1;return}if(H(z)==="serverless"){u("Serverless project detected: deploying the Lambda application");let{deployServerlessApp:it}=await import("./chunk-mwprtzxp.js");await it(z,k,{}),n("Serverless deployment complete");return}let oe=t?.stack||T(z,k),ae=z.project.region||"us-east-1",be=z.infrastructure?.deployStack!==!1,Ae=z.sites&&Object.keys(z.sites).length>0,de=z.infrastructure?.dns?.provider;if(Ae&&de){if(await lg(z,t?.site,de,ae,t?.skipDnsVerification,k,m),!be){if(z.infrastructure?.compute){let it=Object.values(z.sites).map((Et)=>Et.domain).filter((Et)=>!!Et);if(it.length>0)u("Syncing CloudFront dynamic HTTP methods for app domains..."),await ta(it)}return}}if(!be){e("Infrastructure stack deployment disabled (infrastructure.deployStack: false)");return}let ke=U(z);if(e(`Cloud provider: ${ke}`),e(`Stack: ${oe}`),e(`Region: ${ae}`),e(`Environment: ${k}`),(ke==="hetzner"||z.infrastructure?.compute?.mode==="server")&&Io(z)){u(`Provisioning ${ke} compute infrastructure...`);let it=O({config:z,provider:ke});if(!it.provisionComputeInfrastructure){r(`${ke} driver does not support compute provisioning`),process.exitCode=1;return}let Et=await it.provisionComputeInfrastructure({config:z,environment:k});if(n(`${ke} compute infrastructure ready`),Et.appPublicIp)e(`App server: ${Et.appPublicIp}`);if(Et.appInstanceId)e(`Server ID: ${Et.appInstanceId}`);if(!await al(z,k,ae,t?.site))r(`App deploy to ${ke} compute reported a failure`),process.exitCode=1;else{if(n(`App deployed to ${ke} compute`),t?.skipDnsVerification)e("DNS verification and record reconciliation skipped (--skip-dns-verification)");else await sg(z,Et.appPublicIp,de,Et.appPublicIpv6),await ag(z,de);let yn=await wo({config:z,environment:k,driver:it,logger:{info:e,warn:a,error:r,step:u,success:n}});if(!yn)r("App deployed, but rpx TLS certificate reconciliation failed");if(!yn)process.exitCode=1;if(!t?.skipDnsVerification)await cg(z,Et.appPublicIp,Et.appPublicIpv6)}return}u("Generating CloudFormation template...");let Se=new Ro({config:z,environment:k});Se.generate();let Re=Se.toJSON(),Pe=JSON.parse(Re);if(Object.keys(Pe.Resources||{}).length===0){e(`No infrastructure resources to deploy for environment '${k}' — skipping stack ${oe}.`);return}u("Validating template...");let Le=ts(Pe),Be=is(Re),Ve=os(Pe),ct=[...Le.errors,...Be.errors,...Ve.errors];if(ct.length>0){r("Template validation failed:");for(let it of ct)r(`  - ${it.path}: ${it.message}`);return}let Dt=[...Le.warnings,...Be.warnings,...Ve.warnings];if(Dt.length>0)for(let it of Dt)a(`  - ${it.path}: ${it.message}`);n("Template validated successfully");let nt=Object.keys(Pe.Resources).length;e(`
-Resources to deploy: ${nt}`);let xt={};for(let it of Object.values(Pe.Resources)){let Et=it.Type;xt[Et]=(xt[Et]||0)+1}for(let[it,Et]of Object.entries(xt).sort((hn,yn)=>yn[1]-hn[1]).slice(0,5))e(`  - ${it}: ${Et}`);if(!(m||await d(`
-Deploy now?`,!0))){e("Deployment cancelled");return}let Tt=new v(ae),Ge=Ia(Pe);if(Ge.length>0){let{ensureFailoverReplicaBuckets:it}=await import("./chunk-71fa7yed.js");u("Ensuring failover replica buckets..."),await it(Ge,(Et)=>e(`  ${Et}`))}u("Checking stack status...");let Ot=!1;try{let it=await Tt.describeStacks({stackName:oe});Ot=it.Stacks&&it.Stacks.length>0}catch(it){Ot=!1}if(Ot){e("Stack exists, updating...");let it=new s("Updating CloudFormation stack...");it.start();try{await Tt.updateStack({stackName:oe,templateBody:Re,capabilities:["CAPABILITY_IAM","CAPABILITY_NAMED_IAM"],tags:[{Key:"Project",Value:z.project.name},{Key:"Environment",Value:k},{Key:"ManagedBy",Value:"ts-cloud"}]}),it.succeed("Update initiated"),u("Waiting for stack update to complete..."),await Tt.waitForStack(oe,"stack-update-complete"),n("Stack updated successfully!")}catch(Et){if(Et.message.includes("No updates are to be performed"))it.succeed("No changes detected"),e("Stack is already up to date — continuing to app deploy");else throw Et}}else{e("Creating new stack...");let it=new s("Creating CloudFormation stack...");it.start(),await Tt.createStack({stackName:oe,templateBody:Re,capabilities:["CAPABILITY_IAM","CAPABILITY_NAMED_IAM"],tags:[{Key:"Project",Value:z.project.name},{Key:"Environment",Value:k},{Key:"ManagedBy",Value:"ts-cloud"}]}),it.succeed("Stack creation initiated"),u("Waiting for stack creation to complete..."),await Tt.waitForStack(oe,"stack-create-complete"),n("Stack created successfully!")}let zt=await Tt.getStackOutputs(oe);if(Ee(`Deployment Complete!
+Recommendations:`),e("  1. Remove any hardcoded credentials from your code"),e("  2. Use environment variables or AWS Secrets Manager"),e("  3. Add sensitive files to .gitignore"),e("  4. Use --skip-patterns to ignore false positives"),process.exit(1)}catch(m){r(`Security scan failed: ${m.message}`),process.exit(1)}}),R.command("deploy","Deploy infrastructure").option("--stack <name>","Stack name").option("--env <environment>","Environment to deploy to").option("--site <name>","Deploy specific site only (routes are still regenerated in full)").option("--skip-security-scan","Skip pre-deployment security scan").option("--skip-dns-verification","Skip DNS provider verification and record creation (use when DNS is already configured)").option("--security-fail-on <severity>","Security scan fail threshold (critical, high, medium, low)",{default:"critical"}).option("--dry-run","Show the deployment plan without making changes").option("--yes","Skip confirmation prompts (non-interactive / CI)").action(async(t)=>{i("Deploying Infrastructure");let m=t?.yes===!0||process.env.CI==="true",k=t?.env||"staging",I=null;I=await og(k);try{let L=await De(),z=ig(L),{errors:Y,warnings:Z}=Ks(z);for(let Ke of Z)a(Ke);if(Y.length>0){r(`
+✗ Deployment configuration is invalid:`);for(let Ke of Y)r(`  • ${Ke}`);process.exitCode=1;return}if(t?.dryRun){if(t.site&&!z.sites?.[t.site]){r(`Site '${t.site}' was not found. Configured sites: ${Object.keys(z.sites||{}).join(", ")||"none"}`),process.exitCode=1;return}let Ke=H(z),$t=t.stack||T(z,k),gn=U(z),hn=z.project.region||"us-east-1",Fn=t.site?[t.site]:Object.keys(z.sites||{});i("Deployment Plan"),e(`Cloud provider: ${gn}`),e(`Mode: ${Ke}`),e(`Stack: ${$t}`),e(`Region: ${hn}`),e(`Environment: ${k}`),e(`Sites: ${Fn.length>0?Fn.join(", "):"none"}`),await ou(z,{dryRun:!0}),await su(z,{dryRun:!0}),n("Dry run complete. No infrastructure, DNS, certificates, or application files were changed.");return}if(U(z)==="aws"){let Ke=z.project?.region||"us-east-1";await eg(Ke)}let X;if(!t?.skipSecurityScan){let Ke=rl(z,t?.site);if(!Ke)e("This deploy ships no files — every site in scope is a redirect or proxy route, so only gateway routes and certificates change. Scanning an empty artifact.");let{result:$t}=await ca({sourceDir:Ke?process.cwd():ng(),failOnSeverity:t?.securityFailOn||"critical",exclude:z.infrastructure?.security?.scan?.exclude});la($t),X=$t}else a(`Security scan skipped (--skip-security-scan)
+`);let ee=cl(z,k,X);if(!ee.allowed){r(`
+✗ Deployment blocked by security policy: ${ee.explanation}`),e("Remediate the findings or create an authorized, time-limited waiver in the Security posture center."),process.exitCode=1;return}if(n(`✓ Security policy allows this deployment
+`),!await ou(z)){process.exitCode=1;return}if(!await su(z)){process.exitCode=1;return}if(H(z)==="serverless"){u("Serverless project detected: deploying the Lambda application");let{deployServerlessApp:Ke}=await import("./chunk-j1dbkpha.js");await Ke(z,k,{}),n("Serverless deployment complete");return}let oe=t?.stack||T(z,k),se=z.project.region||"us-east-1",ue=z.infrastructure?.deployStack!==!1,ke=z.sites&&Object.keys(z.sites).length>0,ce=z.infrastructure?.dns?.provider;if(ke&&ce){if(await lg(z,t?.site,ce,se,t?.skipDnsVerification,k,m),!ue){if(z.infrastructure?.compute){let Ke=Object.values(z.sites).map(($t)=>$t.domain).filter(($t)=>!!$t);if(Ke.length>0)u("Syncing CloudFront dynamic HTTP methods for app domains..."),await Xs(Ke)}return}}if(!ue){e("Infrastructure stack deployment disabled (infrastructure.deployStack: false)");return}let Se=U(z);if(e(`Cloud provider: ${Se}`),e(`Stack: ${oe}`),e(`Region: ${se}`),e(`Environment: ${k}`),(Se==="hetzner"||z.infrastructure?.compute?.mode==="server")&&xo(z)){u(`Provisioning ${Se} compute infrastructure...`);let Ke=O({config:z,provider:Se});if(!Ke.provisionComputeInfrastructure){r(`${Se} driver does not support compute provisioning`),process.exitCode=1;return}let $t=await Ke.provisionComputeInfrastructure({config:z,environment:k});if(n(`${Se} compute infrastructure ready`),$t.appPublicIp)e(`App server: ${$t.appPublicIp}`);if($t.appInstanceId)e(`Server ID: ${$t.appInstanceId}`);if(!await al(z,k,se,t?.site))r(`App deploy to ${Se} compute reported a failure`),process.exitCode=1;else{if(n(`App deployed to ${Se} compute`),t?.skipDnsVerification)e("DNS verification and record reconciliation skipped (--skip-dns-verification)");else await sg(z,$t.appPublicIp,ce,$t.appPublicIpv6),await ag(z,ce);let hn=await Do({config:z,environment:k,driver:Ke,logger:{info:e,warn:a,error:r,step:u,success:n}});if(!hn)r("App deployed, but rpx TLS certificate reconciliation failed");if(!hn)process.exitCode=1;if(!t?.skipDnsVerification)await cg(z,$t.appPublicIp,$t.appPublicIpv6)}return}u("Generating CloudFormation template...");let ve=new yo({config:z,environment:k});ve.generate();let Re=ve.toJSON(),Ie=JSON.parse(Re);if(Object.keys(Ie.Resources||{}).length===0){e(`No infrastructure resources to deploy for environment '${k}' — skipping stack ${oe}.`);return}u("Validating template...");let Ne=Yo(Ie),Fe=Xo(Re),ze=es(Ie),ot=[...Ne.errors,...Fe.errors,...ze.errors];if(ot.length>0){r("Template validation failed:");for(let Ke of ot)r(`  - ${Ke.path}: ${Ke.message}`);return}let wt=[...Ne.warnings,...Fe.warnings,...ze.warnings];if(wt.length>0)for(let Ke of wt)a(`  - ${Ke.path}: ${Ke.message}`);n("Template validated successfully");let He=Object.keys(Ie.Resources).length;e(`
+Resources to deploy: ${He}`);let dt={};for(let Ke of Object.values(Ie.Resources)){let $t=Ke.Type;dt[$t]=(dt[$t]||0)+1}for(let[Ke,$t]of Object.entries(dt).sort((gn,hn)=>hn[1]-gn[1]).slice(0,5))e(`  - ${Ke}: ${$t}`);if(!(m||await d(`
+Deploy now?`,!0))){e("Deployment cancelled");return}let At=new v(se),qe=$a(Ie);if(qe.length>0){let{ensureFailoverReplicaBuckets:Ke}=await import("./chunk-11hc309t.js");u("Ensuring failover replica buckets..."),await Ke(qe,($t)=>e(`  ${$t}`))}u("Checking stack status...");let xt=!1;try{let Ke=await At.describeStacks({stackName:oe});xt=Ke.Stacks&&Ke.Stacks.length>0}catch(Ke){xt=!1}if(xt){e("Stack exists, updating...");let Ke=new s("Updating CloudFormation stack...");Ke.start();try{await At.updateStack({stackName:oe,templateBody:Re,capabilities:["CAPABILITY_IAM","CAPABILITY_NAMED_IAM"],tags:[{Key:"Project",Value:z.project.name},{Key:"Environment",Value:k},{Key:"ManagedBy",Value:"ts-cloud"}]}),Ke.succeed("Update initiated"),u("Waiting for stack update to complete..."),await At.waitForStack(oe,"stack-update-complete"),n("Stack updated successfully!")}catch($t){if($t.message.includes("No updates are to be performed"))Ke.succeed("No changes detected"),e("Stack is already up to date — continuing to app deploy");else throw $t}}else{e("Creating new stack...");let Ke=new s("Creating CloudFormation stack...");Ke.start(),await At.createStack({stackName:oe,templateBody:Re,capabilities:["CAPABILITY_IAM","CAPABILITY_NAMED_IAM"],tags:[{Key:"Project",Value:z.project.name},{Key:"Environment",Value:k},{Key:"ManagedBy",Value:"ts-cloud"}]}),Ke.succeed("Stack creation initiated"),u("Waiting for stack creation to complete..."),await At.waitForStack(oe,"stack-create-complete"),n("Stack created successfully!")}let Ot=await At.getStackOutputs(oe);if(we(`Deployment Complete!
 
 Stack: ${oe}
-Region: ${ae}
+Region: ${se}
 Environment: ${k}
-Resources: ${nt}
+Resources: ${He}
 
 View in console:
-https://console.aws.amazon.com/cloudformation/home?region=${ae}#/stacks/stackinfo?stackId=${encodeURIComponent(oe)}`,"green"),Object.keys(zt).length>0){e(`
-Stack Outputs:`);for(let[it,Et]of Object.entries(zt))e(`  - ${it}: ${Et}`)}if(Ge.length>0){let{grantFailoverReplicaAccess:it}=await import("./chunk-71fa7yed.js");u("Granting the distribution read access to its failover replicas..."),await it(Ge,zt,(Et)=>e(`  ${Et}`))}if(z.infrastructure?.storage)for(let[it,Et]of Object.entries(z.infrastructure.storage)){if(!Et.website||!Et.root)continue;let hn=zt[`${it}BucketName`]||zt.FrontendBucketName,yn=zt[`${it}CloudFrontDistributionId`];if(!hn){a(`Could not find bucket name for storage '${it}' — skipping file upload`);continue}if(!In(Et.root)){a(`Source directory not found: ${Et.root} — skipping file upload for '${it}'`);continue}u(`Uploading files from ${Et.root} to s3://${hn}...`);let{uploadStaticFiles:tr,invalidateCache:Oi}=await import("./chunk-hp1cqk45.js"),wn=await tr({sourceDir:Et.root,bucket:hn,region:ae,onProgress:(Wt,Pn,xn)=>{if(Wt%10===0||Wt===Pn)e(`  ${Wt}/${Pn}: ${xn}`)}});if(wn.errors.length>0)a(`Upload completed with errors: ${wn.errors.join(", ")}`);else{let Wt=wn.skipped>0?`Uploaded ${wn.uploaded} files (${wn.skipped} unchanged)`:`Uploaded ${wn.uploaded} files`;n(Wt)}if(yn&&wn.uploaded>0){u("Invalidating CloudFront cache...");let{invalidationId:Wt}=await Oi(yn);n(`Cache invalidation created: ${Wt}`)}}if(Ge.length>0){let{seedFailoverReplicas:it}=await import("./chunk-71fa7yed.js");u("Syncing failover replicas..."),await it(Ge,(Et)=>e(`  ${Et}`))}if(z.infrastructure?.compute)await al(z,k,ae,t?.site);if(z.infrastructure?.compute&&z.sites){let it=Object.values(z.sites).map((Et)=>Et.domain).filter((Et)=>!!Et);if(it.length>0)u("Syncing CloudFront dynamic HTTP methods for app domains..."),await ta(it)}}catch(L){if(r(`Deployment failed: ${L.message}`),process.exitCode=1,L.stack)e(`
-Stack trace:`),console.error(L.stack)}finally{if(I)await I()}}),R.command("deploy:server","Deploy EC2 infrastructure").option("--env <environment>","Environment (production, staging, development)").option("--site <name>","Deploy specific site only (routes are still regenerated in full)").action(async(t)=>{i("Deploying Server Infrastructure");try{let m=await Ne(),k=t?.env||"production",I=m.project.region||"us-east-1",L=Fr(m);if(L){r(L),process.exitCode=1;return}if(!Io(m)){r("No `infrastructure.compute` configured — nothing to deploy as a server."),e("Add an EC2 compute block to cloud.config, or use `cloud deploy:serverless` for Lambda apps."),process.exitCode=1;return}if(e(`Region: ${I}`),e(`Environment: ${k}`),!await al(m,k,I,t?.site)){process.exitCode=1;return}if(m.sites){let Y=Object.values(m.sites).map((Z)=>Z.domain).filter((Z)=>!!Z);if(Y.length>0)u("Syncing CloudFront dynamic HTTP methods for app domains..."),await ta(Y)}n(`
-Server deployment complete!`)}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}}),R.command("deploy:serverless","Deploy a serverless application (http/queue/cli Lambda functions)").option("--env <environment>","Environment (production, staging, development)").option("--skip-build","Skip local build hooks").option("--skip-hooks","Skip remote deploy hooks (e.g. migrations)").option("--redeploy","Re-activate the last build without rebuilding").action(async(t)=>{try{let m=await Ne(),k=t?.env||"production",I=Fr(m);if(I){r(I),process.exitCode=1;return}let{deployServerlessApp:L,redeployServerlessApp:z}=await import("./chunk-mwprtzxp.js");if(t?.redeploy){await z(m,k);return}await L(m,k,{skipBuild:t?.skipBuild,skipDeployHooks:t?.skipHooks})}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}}),R.command("serverless:rollback","Roll back a serverless app to the previous build").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let m=await Ne(),k=t?.env||"production",{rollbackServerlessApp:I}=await import("./chunk-mwprtzxp.js");await I(m,k)}catch(m){r(`Rollback failed: ${m.message}`),process.exitCode=1}}),R.command("deploy:rollback [site]","Roll a compute site back to a previous release").option("--env <environment>","Environment (production, staging, development)").option("--to <release>","Release id to roll back to (default: the previous release)").option("--dry-run","Say which release it would roll back to, and change nothing").option("--all","Every configured site, instead of one").option("--only-if-live <release>","Only roll back a site whose live release is this commit (what a failed deploy switched)").action(async(t,m)=>{i("Rolling Back Release");try{let k=await Ne(),I=m?.env||"production",L=m?.all?Object.keys(k.sites||{}):[t||Object.keys(k.sites||{})[0]].filter(Boolean);if(L.length===0){r("No site configured to roll back."),process.exitCode=1;return}let{rollbackComputeSite:z}=await import("./chunk-wrcdcg7m.js"),Y=O({config:k});for(let Z of L){let X=await z({driver:Y,slug:k.project.slug,environment:I,logger:f},{siteName:Z,to:m?.to,dryRun:m?.dryRun,onlyIfLive:m?.onlyIfLive,site:k.sites?.[Z]});for(let ie of X.perInstance||[])e(`  ${Z} ${ie.instanceId}: ${ie.output?.trim()||ie.status}`);if(!X.success)r(`Rollback of ${Z} failed: ${X.error||"unknown error"}`),process.exitCode=1}}catch(k){r(`Rollback failed: ${k.message}`),process.exitCode=1}}),R.command("deploy:history [site]","Show a compute site's deployment history").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Number of entries to show",{default:"20"}).action(async(t,m)=>{i("Deployment History");try{let k=await Ne(),I=m?.env||"production",L=t||Object.keys(k.sites||{})[0];if(!L){r("No site configured."),process.exitCode=1;return}let{getComputeDeployHistory:z}=await import("./chunk-wrcdcg7m.js"),Y=await z({driver:O({config:k}),slug:k.project.slug,environment:I,logger:f},{siteName:L,limit:Number.parseInt(m?.limit||"20",10)||20});if(!Y.success){r(`Could not read history: ${Y.error||"unknown error"}`),process.exitCode=1;return}for(let Z of Y.perInstance||[])e(`
-${Z.instanceId}:`),e(Z.output?.trimEnd()||"(no output)")}catch(k){r(`History lookup failed: ${k.message}`),process.exitCode=1}}),R.command("deploy:recipe <name> <script>","Run a reusable server recipe (a local bash file) across servers").option("--env <environment>","Environment (production, staging, development)").option("--user <user>","User to run the recipe as",{default:"root"}).action(async(t,m,k)=>{i(`Running Recipe: ${t}`);try{if(!In(m)){r(`Recipe script not found: ${m}`),process.exitCode=1;return}let I=await Ne(),L=k?.env||"production",z=ll(m,"utf8").split(`
-`),{runComputeRecipe:Y}=await import("./chunk-wrcdcg7m.js"),Z=await Y({driver:O({config:I}),slug:I.project.slug,environment:L,logger:f},{name:t,script:z,user:k?.user});for(let X of Z.perInstance||[])e(`
-${X.instanceId}:`),e(X.output?.trimEnd()||"(no output)");if(!Z.success)process.exitCode=1}catch(I){r(`Recipe failed: ${I.message}`),process.exitCode=1}}),R.command("db:restore-backup [from]","Restore the app database from an on-box ts-backups dump (latest, or a given file)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{i("Database Restore");try{let k=await Ne(),I=m?.env||"production",{restoreDatabaseBackup:L}=await import("./chunk-wrcdcg7m.js"),z=await L({driver:O({config:k}),slug:k.project.slug,environment:I,logger:f},{database:w(k),from:t});for(let Y of z.perInstance||[])e(`  ${Y.instanceId}: ${Y.output?.trim()||Y.status}`);if(!z.success)r(`Restore failed: ${z.error||"unknown error"}`),process.exitCode=1}catch(k){r(`Restore failed: ${k.message}`),process.exitCode=1}}),R.command("quick-deploy","Generate a push-to-deploy CI pipeline for your git provider (Forge Quick Deploy)").option("--env <environment>","Environment to deploy on push",{default:"production"}).option("--provider <provider>","CI provider (github, gitlab, bitbucket); defaults to the origin remote").option("--site <site>","Deploy only this configured site").option("--skip-dns-verification","Generate a deploy that skips DNS verification and record creation").option("--ssh-key-secret <name>","CI secret/variable containing the Hetzner deployment SSH private key",{default:"SSH_PRIVATE_KEY"}).option("--force","Overwrite an existing pipeline file").action(async(t)=>{i("Quick Deploy (push-to-deploy)");try{let m=await Ne(),{buildQuickDeployCi:k,inferQuickDeployProvider:I}=await import("./chunk-em9swj0k.js"),L=t?.provider?.toLowerCase();if(L&&!["github","gitlab","bitbucket"].includes(L))throw Error(`Unsupported CI provider '${t?.provider}'. Use github, gitlab, or bitbucket.`);let z=L;if(!z)try{let Z=dl("git remote get-url origin",{stdio:["ignore","pipe","ignore"]}).toString().trim();z=I(Z)}catch{}let Y=k(m,t?.env||"production",{provider:z,site:t?.site,skipDnsVerification:t?.skipDnsVerification,setup:In("pantry.lock")?"pantry":"bun",sshPrivateKeySecret:t?.sshKeySecret});if(!Y){a("Could not resolve a GitHub, GitLab, or Bitbucket provider from --provider, the origin remote, or a configured site repository."),process.exitCode=1;return}if(In(Y.path)&&!t?.force){a(`${Y.path} already exists — re-run with --force to overwrite.`);return}au(Qf(Y.path),{recursive:!0}),Zf(Y.path,Y.content),n(`Wrote ${Y.path} (${Y.provider}, deploys on push to '${Y.branch}').`),e("Next: commit it and add your provider credentials as CI secrets/variables.")}catch(m){r(`Quick deploy setup failed: ${m.message}`),process.exitCode=1}}),R.command("down","Put the serverless app into maintenance mode (503)").option("--env <environment>","Environment (production, staging, development)").option("--secret <secret>","Bypass secret (send as x-maintenance-bypass header)").action(async(t)=>{try{let m=await Ne(),k=t?.env||"production",{setMaintenance:I}=await import("./chunk-mwprtzxp.js");await I(m,k,!0,t?.secret)}catch(m){r(`Failed to enable maintenance mode: ${m.message}`),process.exitCode=1}}),R.command("up","Bring the serverless app out of maintenance mode").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let m=await Ne(),k=t?.env||"production",{setMaintenance:I}=await import("./chunk-mwprtzxp.js");await I(m,k,!1)}catch(m){r(`Failed to disable maintenance mode: ${m.message}`),process.exitCode=1}}),R.command("command <cmd>","Run a command on the serverless CLI function (e.g. migrations)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let k=await Ne(),I=m?.env||"production",{runAndRecordCommand:L}=await import("./chunk-mwprtzxp.js"),{id:z,output:Y}=await L(k,I,t);if(e(Y),z>0)e(`
-(recorded as #${z} — re-run with \`cloud command:again ${z}\`)`)}catch(k){r(`Command failed: ${k.message}`),process.exitCode=1}}),R.command("command:history","List recorded CLI-function command invocations").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Show at most this many (most recent)",{default:"20"}).action(async(t)=>{try{let m=await Ne(),k=t?.env||"production",{listCommandHistory:I}=await import("./chunk-mwprtzxp.js"),L=await I(m,k);if(!L.length){e("No command history yet.");return}let z=Number(t?.limit??20);i(`Command history — ${m.project.slug} (${k})`),c(["#","When","Status","Command"],L.slice(-z).reverse().map((Y)=>[String(Y.id),Y.timestamp,Y.status,Y.command]))}catch(m){r(`Failed to read history: ${m.message}`),process.exitCode=1}}),R.command("command:again [id]","Re-run a recorded command (defaults to the most recent)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let k=await Ne(),I=m?.env||"production",{getCommandRecord:L,runAndRecordCommand:z}=await import("./chunk-mwprtzxp.js"),Y=await L(k,I,t?Number(t):void 0);if(!Y){r(t?`No command #${t} in history.`:"No command history to re-run."),process.exitCode=1;return}e(`Re-running #${Y.id}: ${Y.command}`);let Z=await z(k,I,Y.command);if(e(Z.output),Z.id>0)e(`
-(recorded as #${Z.id})`)}catch(k){r(`Command failed: ${k.message}`),process.exitCode=1}}),R.command("serverless:db-shell <sql>","Run a SQL statement against a private serverless database (via the CLI function)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let k=await Ne(),I=m?.env||"production",{runDbQuery:L}=await import("./chunk-mwprtzxp.js"),z=await L(k,I,t);e(z)}catch(k){r(`Query failed: ${k.message}`),process.exitCode=1}}),R.command("serverless:db-scale <min> <max>","Rescale the serverless Aurora cluster (min/max ACUs)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m,k)=>{i("Scaling serverless database");try{let I=await Ne(),L=k?.env||"production",z=Number(t),Y=Number(m);if(!(z>0)||!(Y>=z)){r("Provide valid capacities: min > 0 and max >= min (e.g. `serverless:db-scale 0.5 8`)."),process.exitCode=1;return}let{scaleServerlessDatabase:Z}=await import("./chunk-mwprtzxp.js");await Z(I,L,z,Y)}catch(I){r(`Scale failed: ${I.message}`),process.exitCode=1}}),R.command("serverless:db-restore","Restore the serverless Aurora cluster to a point in time (as a new cluster)").option("--env <environment>","Environment (production, staging, development)").option("--to <timestamp>","Restore to this ISO-8601 time (UTC)").option("--latest","Restore to the latest restorable time").option("--target <id>","New cluster identifier (defaults to <cluster>-restore-<stamp>)").action(async(t)=>{i("Restoring serverless database");try{let m=await Ne(),k=t?.env||"production",I;if(t?.to){if(I=new Date(t.to),Number.isNaN(I.getTime())){r(`Invalid --to timestamp: ${t.to} (use ISO-8601, e.g. 2026-06-18T10:00:00Z).`),process.exitCode=1;return}}let{restoreServerlessDatabase:L}=await import("./chunk-mwprtzxp.js");await L(m,k,{toTime:I,latest:t?.latest,target:t?.target})}catch(m){r(`Restore failed: ${m.message}`),process.exitCode=1}}),R.command("serverless:info","Show an operational summary of a deployed serverless app").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let m=await Ne(),k=t?.env||"production",{serverlessInfo:I}=await import("./chunk-mwprtzxp.js"),L=await I(m,k);if(i(`${L.slug} (${L.environment})`),e(`Stack:    ${L.stackStatus}`),e(`Region:   ${L.region}`),L.endpoint)e(`URL:      ${L.endpoint}`);if(L.assetUrl)e(`Assets:   ${L.assetUrl}`);if(e(`Scheduler:${L.scheduler==="off"?" off":` ${L.scheduler}`}`),e(`Queues:   ${L.queues.length?L.queues.join(", "):"none"}`),e(`Warming:  ${L.provisionedConcurrency>0?`provisioned concurrency ×${L.provisionedConcurrency}`:"none / ping-warm"}`),L.lastRelease)e(`Release:  ${L.lastRelease.sha.slice(0,12)} @ ${L.lastRelease.timestamp}`);c(["Function","Version","Provisioned"],L.functions.map((z)=>[z.name,z.version,z.provisioned?`${z.provisioned.status} ${z.provisioned.allocated}/${z.provisioned.requested}`:"—"]))}catch(m){r(`Failed to read info: ${m.message}`),process.exitCode=1}}),R.command("dashboard:build","Build the management dashboard with live data baked in").option("--env <environment>","Environment (production, staging, development)").option("--ui <dir>","UI directory (default ./ui)",{default:"ui"}).action(async(t)=>{i("Building management dashboard (live data)");try{let{existsSync:m}=await import("node:fs"),k=t?.ui||"ui";if(!m(`${k}/package.json`)){r(`No UI project at ${k}/ (expected ${k}/package.json). Pass --ui <dir>.`),process.exitCode=1;return}let I=await Ne(),L=t?.env||"production";u("Gathering live data from AWS");let z=null;if(I.environments?.[L]?.app){let{resolveDashboardData:ie}=await import("./chunk-9tt7ahdf.js"),oe=await ie(I,L).catch((ae)=>(a(`Serverless data unavailable (${ae.message}) — that view uses sample data.`),null));if(oe)z={...z??{},...oe}}if(I.infrastructure?.compute){let{resolveServerDashboardData:ie}=await import("./chunk-zrw80j07.js"),oe=await ie(I,L).catch(()=>null);if(oe){if(oe._serverReachable===!1)a("Server box not reachable over SSM — server view uses config + sample data.");z={...z??{},...oe}}}u("Building dashboard");let{encodeDashboardPayload:Y}=await import("./chunk-haezjam0.js"),{execSync:Z}=await import("node:child_process"),{rmSync:X}=await import("node:fs");for(let ie of[".stx/ssg-cache",".stx/cache"])X(`${k}/${ie}`,{recursive:!0,force:!0});Z("bun run build",{cwd:k,stdio:"inherit",env:{...process.env,...z?{TSCLOUD_DASHBOARD_DATA:Y(z)}:{}}}),n(`Dashboard built → ${k}/dist${z?" (live data)":" (sample data)"}`)}catch(m){r(`Dashboard build failed: ${m.message}`),process.exitCode=1}}),R.command("serverless:build-php-layer","Build + publish the ts-cloud PHP runtime layer (requires Docker)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--php <version>","PHP version",{default:"8.3"}).option("--name <name>","Layer name",{default:"tscloud-php"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(t)=>{i("Building PHP runtime layer");try{let m=await Ne().catch(()=>null),k=t?.region||m?.project.region||"us-east-1",I=t?.arch||"x86_64",L=t?.php||"8.3",z=`${t?.name||"tscloud-php"}-${L.replace(".","")}-${I}`,Y=t?.bucket||`${m?.project.slug||"tscloud"}-layers`,{buildPhpRuntimeLayerZip:Z}=await import("./chunk-1vw6khps.js"),{S3Client:X}=await import("./chunk-1rrmswhq.js"),{LambdaClient:ie}=await import("./chunk-9zwvysdn.js"),oe=Z({architecture:I,phpVersion:L,onStep:(ke)=>u(ke)});e(`Layer: ${oe.fileCount} files, ${(oe.zip.length/1024/1024).toFixed(1)} MB`);let ae=new X(k);if(!await ae.bucketExists(Y))u(`Creating layer bucket ${Y}`),await ae.createBucket(Y);let be=`layers/${z}.zip`;u("Uploading layer zip"),await ae.putObject({bucket:Y,key:be,body:oe.zip,contentType:"application/zip"}),u("Publishing layer version");let de=await new ie(k).publishLayerVersion({LayerName:z,Description:`ts-cloud PHP ${L} runtime (${I})`,Content:{S3Bucket:Y,S3Key:be},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[I]});Ee(["PHP runtime layer published","",`ARN: ${de.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'php', layers: ['${de.LayerVersionArn}'] }`,"or set TSCLOUD_PHP_LAYER_ARN before deploying."].join(`
-`),"green")}catch(m){r(`Layer build failed: ${m.message}`),process.exitCode=1}}),R.command("serverless:build-node-layer","Build + publish a ts-cloud Node custom runtime layer (any version, incl. 24)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--node <version>","Node version (e.g. 24)",{default:"24"}).option("--name <name>","Layer name",{default:"tscloud-node"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(t)=>{i("Building Node runtime layer");try{let m=await Ne().catch(()=>null),k=t?.region||m?.project.region||"us-east-1",I=t?.arch||"x86_64",L=t?.node||"24",{buildNodeRuntimeLayerZip:z}=await import("./chunk-1vw6khps.js"),{S3Client:Y}=await import("./chunk-1rrmswhq.js"),{LambdaClient:Z}=await import("./chunk-9zwvysdn.js"),X=z({architecture:I,version:L,onStep:(ke)=>u(ke)}),ie=`${t?.name||"tscloud-node"}-${X.version.split(".")[0]}-${I}`,oe=t?.bucket||`${m?.project.slug||"tscloud"}-layers`;e(`Layer: Node ${X.version}, ${(X.zip.length/1024/1024).toFixed(1)} MB`);let ae=new Y(k);if(!await ae.bucketExists(oe))u(`Creating layer bucket ${oe}`),await ae.createBucket(oe);let be=`layers/${ie}.zip`;u("Uploading layer zip"),await ae.putObject({bucket:oe,key:be,body:X.zip,contentType:"application/zip"}),u("Publishing layer version");let de=await new Z(k).publishLayerVersion({LayerName:ie,Description:`ts-cloud Node ${X.version} runtime (${I})`,Content:{S3Bucket:oe,S3Key:be},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[I]});Ee(["Node runtime layer published","",`ARN: ${de.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'node', runtimeVersion: '${X.version.split(".")[0]}', layers: ['${de.LayerVersionArn}'] }`,"or set TSCLOUD_NODE_LAYER_ARN before deploying."].join(`
-`),"green")}catch(m){r(`Layer build failed: ${m.message}`),process.exitCode=1}}),R.command("serverless:build-bun-layer","Build + publish a ts-cloud Bun custom runtime layer").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--bun <version>",'Bun version (e.g. 1.3.13, or "latest")',{default:"latest"}).option("--name <name>","Layer name",{default:"tscloud-bun"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(t)=>{i("Building Bun runtime layer");try{let m=await Ne().catch(()=>null),k=t?.region||m?.project.region||"us-east-1",I=t?.arch||"x86_64",L=t?.bun||"latest",{buildBunRuntimeLayerZip:z}=await import("./chunk-1vw6khps.js"),{S3Client:Y}=await import("./chunk-1rrmswhq.js"),{LambdaClient:Z}=await import("./chunk-9zwvysdn.js"),X=z({architecture:I,version:L,onStep:(ke)=>u(ke)}),ie=`${t?.name||"tscloud-bun"}-${X.version.replace(/\./g,"")}-${I}`,oe=t?.bucket||`${m?.project.slug||"tscloud"}-layers`;e(`Layer: Bun ${X.version}, ${(X.zip.length/1024/1024).toFixed(1)} MB`);let ae=new Y(k);if(!await ae.bucketExists(oe))u(`Creating layer bucket ${oe}`),await ae.createBucket(oe);let be=`layers/${ie}.zip`;u("Uploading layer zip"),await ae.putObject({bucket:oe,key:be,body:X.zip,contentType:"application/zip"}),u("Publishing layer version");let de=await new Z(k).publishLayerVersion({LayerName:ie,Description:`ts-cloud Bun ${X.version} runtime (${I})`,Content:{S3Bucket:oe,S3Key:be},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[I]});Ee(["Bun runtime layer published","",`ARN: ${de.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'bun', layers: ['${de.LayerVersionArn}'] }`,"or set TSCLOUD_BUN_LAYER_ARN before deploying."].join(`
-`),"green")}catch(m){r(`Layer build failed: ${m.message}`),process.exitCode=1}}),R.command("deploy:status","Check deployment status").option("--stack <name>","Stack name").option("--env <environment>","Environment").action(async(t)=>{i("Deployment Status");try{let m=await Ne(),k=t?.env||"production",I=t?.stack||T(m,k),L=m.project.region||"us-east-1";e(`Stack: ${I}`),e(`Region: ${L}`);let z=new s("Checking deployment status...");z.start();let Z=await new v(L).describeStacks({stackName:I});if(Z.Stacks.length===0){z.fail("Stack not found"),_r("No deployment found for this environment");return}let X=Z.Stacks[0];if(z.succeed("Status retrieved"),e(`
+https://console.aws.amazon.com/cloudformation/home?region=${se}#/stacks/stackinfo?stackId=${encodeURIComponent(oe)}`,"green"),Object.keys(Ot).length>0){e(`
+Stack Outputs:`);for(let[Ke,$t]of Object.entries(Ot))e(`  - ${Ke}: ${$t}`)}if(qe.length>0){let{grantFailoverReplicaAccess:Ke}=await import("./chunk-11hc309t.js");u("Granting the distribution read access to its failover replicas..."),await Ke(qe,Ot,($t)=>e(`  ${$t}`))}if(z.infrastructure?.storage)for(let[Ke,$t]of Object.entries(z.infrastructure.storage)){if(!$t.website||!$t.root)continue;let gn=Ot[`${Ke}BucketName`]||Ot.FrontendBucketName,hn=Ot[`${Ke}CloudFrontDistributionId`];if(!gn){a(`Could not find bucket name for storage '${Ke}' — skipping file upload`);continue}if(!Sn($t.root)){a(`Source directory not found: ${$t.root} — skipping file upload for '${Ke}'`);continue}u(`Uploading files from ${$t.root} to s3://${gn}...`);let{uploadStaticFiles:Fn,invalidateCache:Li}=await import("./chunk-afvk9mbs.js"),vn=await Fn({sourceDir:$t.root,bucket:gn,region:se,onProgress:(Lt,kn,An)=>{if(Lt%10===0||Lt===kn)e(`  ${Lt}/${kn}: ${An}`)}});if(vn.errors.length>0)a(`Upload completed with errors: ${vn.errors.join(", ")}`);else{let Lt=vn.skipped>0?`Uploaded ${vn.uploaded} files (${vn.skipped} unchanged)`:`Uploaded ${vn.uploaded} files`;n(Lt)}if(hn&&vn.uploaded>0){u("Invalidating CloudFront cache...");let{invalidationId:Lt}=await Li(hn);n(`Cache invalidation created: ${Lt}`)}}if(qe.length>0){let{seedFailoverReplicas:Ke}=await import("./chunk-11hc309t.js");u("Syncing failover replicas..."),await Ke(qe,($t)=>e(`  ${$t}`))}if(z.infrastructure?.compute)await al(z,k,se,t?.site);if(z.infrastructure?.compute&&z.sites){let Ke=Object.values(z.sites).map(($t)=>$t.domain).filter(($t)=>!!$t);if(Ke.length>0)u("Syncing CloudFront dynamic HTTP methods for app domains..."),await Xs(Ke)}}catch(L){if(r(`Deployment failed: ${L.message}`),process.exitCode=1,L.stack)e(`
+Stack trace:`),console.error(L.stack)}finally{if(I)await I()}}),R.command("deploy:server","Deploy EC2 infrastructure").option("--env <environment>","Environment (production, staging, development)").option("--site <name>","Deploy specific site only (routes are still regenerated in full)").action(async(t)=>{i("Deploying Server Infrastructure");try{let m=await De(),k=t?.env||"production",I=m.project.region||"us-east-1",L=Vr(m);if(L){r(L),process.exitCode=1;return}if(!xo(m)){r("No `infrastructure.compute` configured — nothing to deploy as a server."),e("Add an EC2 compute block to cloud.config, or use `cloud deploy:serverless` for Lambda apps."),process.exitCode=1;return}if(e(`Region: ${I}`),e(`Environment: ${k}`),!await al(m,k,I,t?.site)){process.exitCode=1;return}if(m.sites){let Y=Object.values(m.sites).map((Z)=>Z.domain).filter((Z)=>!!Z);if(Y.length>0)u("Syncing CloudFront dynamic HTTP methods for app domains..."),await Xs(Y)}n(`
+Server deployment complete!`)}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}}),R.command("deploy:serverless","Deploy a serverless application (http/queue/cli Lambda functions)").option("--env <environment>","Environment (production, staging, development)").option("--skip-build","Skip local build hooks").option("--skip-hooks","Skip remote deploy hooks (e.g. migrations)").option("--redeploy","Re-activate the last build without rebuilding").action(async(t)=>{try{let m=await De(),k=t?.env||"production",I=Vr(m);if(I){r(I),process.exitCode=1;return}let{deployServerlessApp:L,redeployServerlessApp:z}=await import("./chunk-j1dbkpha.js");if(t?.redeploy){await z(m,k);return}await L(m,k,{skipBuild:t?.skipBuild,skipDeployHooks:t?.skipHooks})}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}}),R.command("serverless:rollback","Roll back a serverless app to the previous build").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let m=await De(),k=t?.env||"production",{rollbackServerlessApp:I}=await import("./chunk-j1dbkpha.js");await I(m,k)}catch(m){r(`Rollback failed: ${m.message}`),process.exitCode=1}}),R.command("deploy:rollback [site]","Roll a compute site back to a previous release").option("--env <environment>","Environment (production, staging, development)").option("--to <release>","Release id to roll back to (default: the previous release)").option("--dry-run","Say which release it would roll back to, and change nothing").option("--all","Every configured site, instead of one").option("--only-if-live <release>","Only roll back a site whose live release is this commit (what a failed deploy switched)").action(async(t,m)=>{i("Rolling Back Release");try{let k=await De(),I=m?.env||"production",L=m?.all?Object.keys(k.sites||{}):[t||Object.keys(k.sites||{})[0]].filter(Boolean);if(L.length===0){r("No site configured to roll back."),process.exitCode=1;return}let{rollbackComputeSite:z}=await import("./chunk-r50x03ws.js"),Y=O({config:k});for(let Z of L){let X=await z({driver:Y,slug:k.project.slug,environment:I,logger:f},{siteName:Z,to:m?.to,dryRun:m?.dryRun,onlyIfLive:m?.onlyIfLive,site:k.sites?.[Z]});for(let ee of X.perInstance||[])e(`  ${Z} ${ee.instanceId}: ${ee.output?.trim()||ee.status}`);if(!X.success)r(`Rollback of ${Z} failed: ${X.error||"unknown error"}`),process.exitCode=1}}catch(k){r(`Rollback failed: ${k.message}`),process.exitCode=1}}),R.command("deploy:history [site]","Show a compute site's deployment history").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Number of entries to show",{default:"20"}).action(async(t,m)=>{i("Deployment History");try{let k=await De(),I=m?.env||"production",L=t||Object.keys(k.sites||{})[0];if(!L){r("No site configured."),process.exitCode=1;return}let{getComputeDeployHistory:z}=await import("./chunk-r50x03ws.js"),Y=await z({driver:O({config:k}),slug:k.project.slug,environment:I,logger:f},{siteName:L,limit:Number.parseInt(m?.limit||"20",10)||20});if(!Y.success){r(`Could not read history: ${Y.error||"unknown error"}`),process.exitCode=1;return}for(let Z of Y.perInstance||[])e(`
+${Z.instanceId}:`),e(Z.output?.trimEnd()||"(no output)")}catch(k){r(`History lookup failed: ${k.message}`),process.exitCode=1}}),R.command("deploy:recipe <name> <script>","Run a reusable server recipe (a local bash file) across servers").option("--env <environment>","Environment (production, staging, development)").option("--user <user>","User to run the recipe as",{default:"root"}).action(async(t,m,k)=>{i(`Running Recipe: ${t}`);try{if(!Sn(m)){r(`Recipe script not found: ${m}`),process.exitCode=1;return}let I=await De(),L=k?.env||"production",z=ll(m,"utf8").split(`
+`),{runComputeRecipe:Y}=await import("./chunk-r50x03ws.js"),Z=await Y({driver:O({config:I}),slug:I.project.slug,environment:L,logger:f},{name:t,script:z,user:k?.user});for(let X of Z.perInstance||[])e(`
+${X.instanceId}:`),e(X.output?.trimEnd()||"(no output)");if(!Z.success)process.exitCode=1}catch(I){r(`Recipe failed: ${I.message}`),process.exitCode=1}}),R.command("db:restore-backup [from]","Restore the app database from an on-box ts-backups dump (latest, or a given file)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{i("Database Restore");try{let k=await De(),I=m?.env||"production",{restoreDatabaseBackup:L}=await import("./chunk-r50x03ws.js"),z=await L({driver:O({config:k}),slug:k.project.slug,environment:I,logger:f},{database:w(k),from:t});for(let Y of z.perInstance||[])e(`  ${Y.instanceId}: ${Y.output?.trim()||Y.status}`);if(!z.success)r(`Restore failed: ${z.error||"unknown error"}`),process.exitCode=1}catch(k){r(`Restore failed: ${k.message}`),process.exitCode=1}}),R.command("quick-deploy","Generate a push-to-deploy CI pipeline for your git provider (Forge Quick Deploy)").option("--env <environment>","Environment to deploy on push",{default:"production"}).option("--provider <provider>","CI provider (github, gitlab, bitbucket); defaults to the origin remote").option("--site <site>","Deploy only this configured site").option("--skip-dns-verification","Generate a deploy that skips DNS verification and record creation").option("--ssh-key-secret <name>","CI secret/variable containing the Hetzner deployment SSH private key",{default:"SSH_PRIVATE_KEY"}).option("--force","Overwrite an existing pipeline file").action(async(t)=>{i("Quick Deploy (push-to-deploy)");try{let m=await De(),{buildQuickDeployCi:k,inferQuickDeployProvider:I}=await import("./chunk-h99kxww0.js"),L=t?.provider?.toLowerCase();if(L&&!["github","gitlab","bitbucket"].includes(L))throw Error(`Unsupported CI provider '${t?.provider}'. Use github, gitlab, or bitbucket.`);let z=L;if(!z)try{let Z=dl("git remote get-url origin",{stdio:["ignore","pipe","ignore"]}).toString().trim();z=I(Z)}catch{}let Y=k(m,t?.env||"production",{provider:z,site:t?.site,skipDnsVerification:t?.skipDnsVerification,setup:Sn("pantry.lock")?"pantry":"bun",sshPrivateKeySecret:t?.sshKeySecret});if(!Y){a("Could not resolve a GitHub, GitLab, or Bitbucket provider from --provider, the origin remote, or a configured site repository."),process.exitCode=1;return}if(Sn(Y.path)&&!t?.force){a(`${Y.path} already exists — re-run with --force to overwrite.`);return}au(Qf(Y.path),{recursive:!0}),Zf(Y.path,Y.content),n(`Wrote ${Y.path} (${Y.provider}, deploys on push to '${Y.branch}').`),e("Next: commit it and add your provider credentials as CI secrets/variables.")}catch(m){r(`Quick deploy setup failed: ${m.message}`),process.exitCode=1}}),R.command("down","Put the serverless app into maintenance mode (503)").option("--env <environment>","Environment (production, staging, development)").option("--secret <secret>","Bypass secret (send as x-maintenance-bypass header)").action(async(t)=>{try{let m=await De(),k=t?.env||"production",{setMaintenance:I}=await import("./chunk-j1dbkpha.js");await I(m,k,!0,t?.secret)}catch(m){r(`Failed to enable maintenance mode: ${m.message}`),process.exitCode=1}}),R.command("up","Bring the serverless app out of maintenance mode").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let m=await De(),k=t?.env||"production",{setMaintenance:I}=await import("./chunk-j1dbkpha.js");await I(m,k,!1)}catch(m){r(`Failed to disable maintenance mode: ${m.message}`),process.exitCode=1}}),R.command("command <cmd>","Run a command on the serverless CLI function (e.g. migrations)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let k=await De(),I=m?.env||"production",{runAndRecordCommand:L}=await import("./chunk-j1dbkpha.js"),{id:z,output:Y}=await L(k,I,t);if(e(Y),z>0)e(`
+(recorded as #${z} — re-run with \`cloud command:again ${z}\`)`)}catch(k){r(`Command failed: ${k.message}`),process.exitCode=1}}),R.command("command:history","List recorded CLI-function command invocations").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Show at most this many (most recent)",{default:"20"}).action(async(t)=>{try{let m=await De(),k=t?.env||"production",{listCommandHistory:I}=await import("./chunk-j1dbkpha.js"),L=await I(m,k);if(!L.length){e("No command history yet.");return}let z=Number(t?.limit??20);i(`Command history — ${m.project.slug} (${k})`),c(["#","When","Status","Command"],L.slice(-z).reverse().map((Y)=>[String(Y.id),Y.timestamp,Y.status,Y.command]))}catch(m){r(`Failed to read history: ${m.message}`),process.exitCode=1}}),R.command("command:again [id]","Re-run a recorded command (defaults to the most recent)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let k=await De(),I=m?.env||"production",{getCommandRecord:L,runAndRecordCommand:z}=await import("./chunk-j1dbkpha.js"),Y=await L(k,I,t?Number(t):void 0);if(!Y){r(t?`No command #${t} in history.`:"No command history to re-run."),process.exitCode=1;return}e(`Re-running #${Y.id}: ${Y.command}`);let Z=await z(k,I,Y.command);if(e(Z.output),Z.id>0)e(`
+(recorded as #${Z.id})`)}catch(k){r(`Command failed: ${k.message}`),process.exitCode=1}}),R.command("serverless:db-shell <sql>","Run a SQL statement against a private serverless database (via the CLI function)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let k=await De(),I=m?.env||"production",{runDbQuery:L}=await import("./chunk-j1dbkpha.js"),z=await L(k,I,t);e(z)}catch(k){r(`Query failed: ${k.message}`),process.exitCode=1}}),R.command("serverless:db-scale <min> <max>","Rescale the serverless Aurora cluster (min/max ACUs)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m,k)=>{i("Scaling serverless database");try{let I=await De(),L=k?.env||"production",z=Number(t),Y=Number(m);if(!(z>0)||!(Y>=z)){r("Provide valid capacities: min > 0 and max >= min (e.g. `serverless:db-scale 0.5 8`)."),process.exitCode=1;return}let{scaleServerlessDatabase:Z}=await import("./chunk-j1dbkpha.js");await Z(I,L,z,Y)}catch(I){r(`Scale failed: ${I.message}`),process.exitCode=1}}),R.command("serverless:db-restore","Restore the serverless Aurora cluster to a point in time (as a new cluster)").option("--env <environment>","Environment (production, staging, development)").option("--to <timestamp>","Restore to this ISO-8601 time (UTC)").option("--latest","Restore to the latest restorable time").option("--target <id>","New cluster identifier (defaults to <cluster>-restore-<stamp>)").action(async(t)=>{i("Restoring serverless database");try{let m=await De(),k=t?.env||"production",I;if(t?.to){if(I=new Date(t.to),Number.isNaN(I.getTime())){r(`Invalid --to timestamp: ${t.to} (use ISO-8601, e.g. 2026-06-18T10:00:00Z).`),process.exitCode=1;return}}let{restoreServerlessDatabase:L}=await import("./chunk-j1dbkpha.js");await L(m,k,{toTime:I,latest:t?.latest,target:t?.target})}catch(m){r(`Restore failed: ${m.message}`),process.exitCode=1}}),R.command("serverless:info","Show an operational summary of a deployed serverless app").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let m=await De(),k=t?.env||"production",{serverlessInfo:I}=await import("./chunk-j1dbkpha.js"),L=await I(m,k);if(i(`${L.slug} (${L.environment})`),e(`Stack:    ${L.stackStatus}`),e(`Region:   ${L.region}`),L.endpoint)e(`URL:      ${L.endpoint}`);if(L.assetUrl)e(`Assets:   ${L.assetUrl}`);if(e(`Scheduler:${L.scheduler==="off"?" off":` ${L.scheduler}`}`),e(`Queues:   ${L.queues.length?L.queues.join(", "):"none"}`),e(`Warming:  ${L.provisionedConcurrency>0?`provisioned concurrency ×${L.provisionedConcurrency}`:"none / ping-warm"}`),L.lastRelease)e(`Release:  ${L.lastRelease.sha.slice(0,12)} @ ${L.lastRelease.timestamp}`);c(["Function","Version","Provisioned"],L.functions.map((z)=>[z.name,z.version,z.provisioned?`${z.provisioned.status} ${z.provisioned.allocated}/${z.provisioned.requested}`:"—"]))}catch(m){r(`Failed to read info: ${m.message}`),process.exitCode=1}}),R.command("dashboard:build","Build the management dashboard with live data baked in").option("--env <environment>","Environment (production, staging, development)").option("--ui <dir>","UI directory (default ./ui)",{default:"ui"}).action(async(t)=>{i("Building management dashboard (live data)");try{let{existsSync:m}=await import("node:fs"),k=t?.ui||"ui";if(!m(`${k}/package.json`)){r(`No UI project at ${k}/ (expected ${k}/package.json). Pass --ui <dir>.`),process.exitCode=1;return}let I=await De(),L=t?.env||"production";u("Gathering live data from AWS");let z=null;if(I.environments?.[L]?.app){let{resolveDashboardData:ee}=await import("./chunk-m5tpfe3s.js"),oe=await ee(I,L).catch((se)=>(a(`Serverless data unavailable (${se.message}) — that view uses sample data.`),null));if(oe)z={...z??{},...oe}}if(I.infrastructure?.compute){let{resolveServerDashboardData:ee}=await import("./chunk-eb591jvz.js"),oe=await ee(I,L).catch(()=>null);if(oe){if(oe._serverReachable===!1)a("Server box not reachable over SSM — server view uses config + sample data.");z={...z??{},...oe}}}u("Building dashboard");let{encodeDashboardPayload:Y}=await import("./chunk-jjw5d8b9.js"),{execSync:Z}=await import("node:child_process"),{rmSync:X}=await import("node:fs");for(let ee of[".stx/ssg-cache",".stx/cache"])X(`${k}/${ee}`,{recursive:!0,force:!0});Z("bun run build",{cwd:k,stdio:"inherit",env:{...process.env,...z?{TSCLOUD_DASHBOARD_DATA:Y(z)}:{}}}),n(`Dashboard built → ${k}/dist${z?" (live data)":" (sample data)"}`)}catch(m){r(`Dashboard build failed: ${m.message}`),process.exitCode=1}}),R.command("serverless:build-php-layer","Build + publish the ts-cloud PHP runtime layer (requires Docker)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--php <version>","PHP version",{default:"8.3"}).option("--name <name>","Layer name",{default:"tscloud-php"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(t)=>{i("Building PHP runtime layer");try{let m=await De().catch(()=>null),k=t?.region||m?.project.region||"us-east-1",I=t?.arch||"x86_64",L=t?.php||"8.3",z=`${t?.name||"tscloud-php"}-${L.replace(".","")}-${I}`,Y=t?.bucket||`${m?.project.slug||"tscloud"}-layers`,{buildPhpRuntimeLayerZip:Z}=await import("./chunk-seh19g93.js"),{S3Client:X}=await import("./chunk-sxfdxk39.js"),{LambdaClient:ee}=await import("./chunk-tyeessz3.js"),oe=Z({architecture:I,phpVersion:L,onStep:(Se)=>u(Se)});e(`Layer: ${oe.fileCount} files, ${(oe.zip.length/1024/1024).toFixed(1)} MB`);let se=new X(k);if(!await se.bucketExists(Y))u(`Creating layer bucket ${Y}`),await se.createBucket(Y);let ue=`layers/${z}.zip`;u("Uploading layer zip"),await se.putObject({bucket:Y,key:ue,body:oe.zip,contentType:"application/zip"}),u("Publishing layer version");let ce=await new ee(k).publishLayerVersion({LayerName:z,Description:`ts-cloud PHP ${L} runtime (${I})`,Content:{S3Bucket:Y,S3Key:ue},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[I]});we(["PHP runtime layer published","",`ARN: ${ce.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'php', layers: ['${ce.LayerVersionArn}'] }`,"or set TSCLOUD_PHP_LAYER_ARN before deploying."].join(`
+`),"green")}catch(m){r(`Layer build failed: ${m.message}`),process.exitCode=1}}),R.command("serverless:build-node-layer","Build + publish a ts-cloud Node custom runtime layer (any version, incl. 24)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--node <version>","Node version (e.g. 24)",{default:"24"}).option("--name <name>","Layer name",{default:"tscloud-node"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(t)=>{i("Building Node runtime layer");try{let m=await De().catch(()=>null),k=t?.region||m?.project.region||"us-east-1",I=t?.arch||"x86_64",L=t?.node||"24",{buildNodeRuntimeLayerZip:z}=await import("./chunk-seh19g93.js"),{S3Client:Y}=await import("./chunk-sxfdxk39.js"),{LambdaClient:Z}=await import("./chunk-tyeessz3.js"),X=z({architecture:I,version:L,onStep:(Se)=>u(Se)}),ee=`${t?.name||"tscloud-node"}-${X.version.split(".")[0]}-${I}`,oe=t?.bucket||`${m?.project.slug||"tscloud"}-layers`;e(`Layer: Node ${X.version}, ${(X.zip.length/1024/1024).toFixed(1)} MB`);let se=new Y(k);if(!await se.bucketExists(oe))u(`Creating layer bucket ${oe}`),await se.createBucket(oe);let ue=`layers/${ee}.zip`;u("Uploading layer zip"),await se.putObject({bucket:oe,key:ue,body:X.zip,contentType:"application/zip"}),u("Publishing layer version");let ce=await new Z(k).publishLayerVersion({LayerName:ee,Description:`ts-cloud Node ${X.version} runtime (${I})`,Content:{S3Bucket:oe,S3Key:ue},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[I]});we(["Node runtime layer published","",`ARN: ${ce.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'node', runtimeVersion: '${X.version.split(".")[0]}', layers: ['${ce.LayerVersionArn}'] }`,"or set TSCLOUD_NODE_LAYER_ARN before deploying."].join(`
+`),"green")}catch(m){r(`Layer build failed: ${m.message}`),process.exitCode=1}}),R.command("serverless:build-bun-layer","Build + publish a ts-cloud Bun custom runtime layer").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--bun <version>",'Bun version (e.g. 1.3.13, or "latest")',{default:"latest"}).option("--name <name>","Layer name",{default:"tscloud-bun"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(t)=>{i("Building Bun runtime layer");try{let m=await De().catch(()=>null),k=t?.region||m?.project.region||"us-east-1",I=t?.arch||"x86_64",L=t?.bun||"latest",{buildBunRuntimeLayerZip:z}=await import("./chunk-seh19g93.js"),{S3Client:Y}=await import("./chunk-sxfdxk39.js"),{LambdaClient:Z}=await import("./chunk-tyeessz3.js"),X=z({architecture:I,version:L,onStep:(Se)=>u(Se)}),ee=`${t?.name||"tscloud-bun"}-${X.version.replace(/\./g,"")}-${I}`,oe=t?.bucket||`${m?.project.slug||"tscloud"}-layers`;e(`Layer: Bun ${X.version}, ${(X.zip.length/1024/1024).toFixed(1)} MB`);let se=new Y(k);if(!await se.bucketExists(oe))u(`Creating layer bucket ${oe}`),await se.createBucket(oe);let ue=`layers/${ee}.zip`;u("Uploading layer zip"),await se.putObject({bucket:oe,key:ue,body:X.zip,contentType:"application/zip"}),u("Publishing layer version");let ce=await new Z(k).publishLayerVersion({LayerName:ee,Description:`ts-cloud Bun ${X.version} runtime (${I})`,Content:{S3Bucket:oe,S3Key:ue},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[I]});we(["Bun runtime layer published","",`ARN: ${ce.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'bun', layers: ['${ce.LayerVersionArn}'] }`,"or set TSCLOUD_BUN_LAYER_ARN before deploying."].join(`
+`),"green")}catch(m){r(`Layer build failed: ${m.message}`),process.exitCode=1}}),R.command("deploy:status","Check deployment status").option("--stack <name>","Stack name").option("--env <environment>","Environment").action(async(t)=>{i("Deployment Status");try{let m=await De(),k=t?.env||"production",I=t?.stack||T(m,k),L=m.project.region||"us-east-1";e(`Stack: ${I}`),e(`Region: ${L}`);let z=new s("Checking deployment status...");z.start();let Z=await new v(L).describeStacks({stackName:I});if(Z.Stacks.length===0){z.fail("Stack not found"),Or("No deployment found for this environment");return}let X=Z.Stacks[0];if(z.succeed("Status retrieved"),e(`
 Status: ${X.StackStatus}`),e(`Created: ${X.CreationTime}`),X.LastUpdatedTime)e(`Last Updated: ${X.LastUpdatedTime}`);if(X.Outputs&&X.Outputs.length>0){e(`
-Outputs:`);for(let ie of X.Outputs)e(`  ${ie.OutputKey}: ${ie.OutputValue}`)}}catch(m){r(`Failed to get status: ${m.message}`)}}),R.command("deploy:rollback","Rollback to previous version").option("--stack <name>","Stack name").option("--env <environment>","Environment").action(async(t)=>{i("Rolling Back Deployment");try{let m=await Ne(),k=t?.env||"production",I=t?.stack||T(m,k),L=m.project.region||"us-east-1";if(e(`Stack: ${I}`),e(`Region: ${L}`),!await d(`
-Are you sure you want to rollback?`,!1)){e("Rollback cancelled");return}let Y=new s("Rolling back stack...");Y.start();let Z=new v(L);await Z.deleteStack(I),Y.succeed("Stack deletion initiated"),u("Waiting for stack deletion..."),await Z.waitForStack(I,"stack-delete-complete"),n("Stack rolled back successfully!")}catch(m){r(`Rollback failed: ${m.message}`)}}),R.command("deploy:static","Deploy static site (S3 + CloudFront invalidation)").option("--source <path>","Source directory",{default:"dist"}).option("--bucket <name>","S3 bucket name").option("--distribution <id>","CloudFront distribution ID").option("--prefix <prefix>","S3 prefix/folder").option("--delete","Delete files not in source").option("--cache-control <value>","Cache-Control header",{default:"public, max-age=31536000"}).option("--no-invalidate","Skip CloudFront invalidation").option("--wait","Wait for invalidation to complete").option("--skip-security-scan","Skip pre-deployment security scan").option("--security-fail-on <severity>","Security scan fail threshold (critical, high, medium, low)",{default:"critical"}).action(async(t)=>{i("Deploying Static Site");try{let m=await Ne(),k=m.project.region||"us-east-1",I=t?.source||"dist",L;if(!t?.skipSecurityScan){u("Scanning source directory for leaked secrets...");let{result:Re}=await pa({sourceDir:I,failOnSeverity:t?.securityFailOn||"critical"});fa(Re),L=Re}else a(`Security scan skipped (--skip-security-scan)
+Outputs:`);for(let ee of X.Outputs)e(`  ${ee.OutputKey}: ${ee.OutputValue}`)}}catch(m){r(`Failed to get status: ${m.message}`)}}),R.command("deploy:rollback","Rollback to previous version").option("--stack <name>","Stack name").option("--env <environment>","Environment").action(async(t)=>{i("Rolling Back Deployment");try{let m=await De(),k=t?.env||"production",I=t?.stack||T(m,k),L=m.project.region||"us-east-1";if(e(`Stack: ${I}`),e(`Region: ${L}`),!await d(`
+Are you sure you want to rollback?`,!1)){e("Rollback cancelled");return}let Y=new s("Rolling back stack...");Y.start();let Z=new v(L);await Z.deleteStack(I),Y.succeed("Stack deletion initiated"),u("Waiting for stack deletion..."),await Z.waitForStack(I,"stack-delete-complete"),n("Stack rolled back successfully!")}catch(m){r(`Rollback failed: ${m.message}`)}}),R.command("deploy:static","Deploy static site (S3 + CloudFront invalidation)").option("--source <path>","Source directory",{default:"dist"}).option("--bucket <name>","S3 bucket name").option("--distribution <id>","CloudFront distribution ID").option("--prefix <prefix>","S3 prefix/folder").option("--delete","Delete files not in source").option("--cache-control <value>","Cache-Control header",{default:"public, max-age=31536000"}).option("--no-invalidate","Skip CloudFront invalidation").option("--wait","Wait for invalidation to complete").option("--skip-security-scan","Skip pre-deployment security scan").option("--security-fail-on <severity>","Security scan fail threshold (critical, high, medium, low)",{default:"critical"}).action(async(t)=>{i("Deploying Static Site");try{let m=await De(),k=m.project.region||"us-east-1",I=t?.source||"dist",L;if(!t?.skipSecurityScan){u("Scanning source directory for leaked secrets...");let{result:Re}=await ca({sourceDir:I,failOnSeverity:t?.securityFailOn||"critical"});la(Re),L=Re}else a(`Security scan skipped (--skip-security-scan)
 `);let z=cl(m,void 0,L);if(!z.allowed){r(`
 ✗ Static deployment blocked by security policy: ${z.explanation}`),e("Remediate the findings or create an authorized, time-limited waiver in the Security posture center."),process.exitCode=1;return}n(`✓ Security policy allows this deployment
-`);let Y=t?.bucket,Z=t?.distribution,X=t?.prefix,ie=t?.delete||!1,oe=t?.cacheControl||"public, max-age=31536000",ae=t?.invalidate!==!1,be=t?.wait||!1;if(!Y){r("--bucket is required");return}if(!In(I)){r(`Source directory not found: ${I}`);return}if(e(`Source: ${I}`),e(`Bucket: s3://${Y}${X?`/${X}`:""}`),e(`Cache-Control: ${oe}`),Z)e(`CloudFront Distribution: ${Z}`);if(ie)a("Delete mode enabled - files not in source will be removed");if(!await d(`
-Deploy static site now?`,!0)){e("Deployment cancelled");return}let de=new g(k),ke=new s("Uploading files to S3...");ke.start(),await de.sync({source:I,bucket:Y,prefix:X,delete:ie,cacheControl:oe,acl:"public-read"}),ke.succeed("Files uploaded successfully!");let Se=(await de.getBucketSize(Y,X)/1024/1024).toFixed(2);if(e(`Total size: ${Se} MB`),ae&&Z){let Re=new E,Pe=new s("Invalidating CloudFront cache...");Pe.start();let ze=await Re.invalidateAll(Z);if(Pe.succeed("Invalidation created"),e(`Invalidation ID: ${ze.Id}`),be){let Le=new s("Waiting for invalidation to complete...");Le.start(),await Re.waitForInvalidation(Z,ze.Id),Le.succeed("Invalidation completed!")}}Ee(`Static Site Deployed!
+`);let Y=t?.bucket,Z=t?.distribution,X=t?.prefix,ee=t?.delete||!1,oe=t?.cacheControl||"public, max-age=31536000",se=t?.invalidate!==!1,ue=t?.wait||!1;if(!Y){r("--bucket is required");return}if(!Sn(I)){r(`Source directory not found: ${I}`);return}if(e(`Source: ${I}`),e(`Bucket: s3://${Y}${X?`/${X}`:""}`),e(`Cache-Control: ${oe}`),Z)e(`CloudFront Distribution: ${Z}`);if(ee)a("Delete mode enabled - files not in source will be removed");if(!await d(`
+Deploy static site now?`,!0)){e("Deployment cancelled");return}let ce=new g(k),Se=new s("Uploading files to S3...");Se.start(),await ce.sync({source:I,bucket:Y,prefix:X,delete:ee,cacheControl:oe,acl:"public-read"}),Se.succeed("Files uploaded successfully!");let ve=(await ce.getBucketSize(Y,X)/1024/1024).toFixed(2);if(e(`Total size: ${ve} MB`),se&&Z){let Re=new E,Ie=new s("Invalidating CloudFront cache...");Ie.start();let Me=await Re.invalidateAll(Z);if(Ie.succeed("Invalidation created"),e(`Invalidation ID: ${Me.Id}`),ue){let Ne=new s("Waiting for invalidation to complete...");Ne.start(),await Re.waitForInvalidation(Z,Me.Id),Ne.succeed("Invalidation completed!")}}we(`Static Site Deployed!
 
 Source: ${I}
 Bucket: s3://${Y}${X?`/${X}`:""}
-Size: ${Se} MB
+Size: ${ve} MB
 ${Z?`Distribution: ${Z}`:""}
 
 View your site:
-https://${Y}.s3.${k}.amazonaws.com${X?`/${X}`:""}/index.html`,"green")}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}}),R.command("deploy:container","Deploy container (ECR push + ECS service update)").option("--cluster <name>","ECS cluster name").option("--service <name>","ECS service name").option("--repository <name>","ECR repository name").option("--image <tag>","Docker image tag",{default:"latest"}).option("--dockerfile <path>","Dockerfile path",{default:"Dockerfile"}).option("--context <path>","Docker build context",{default:"."}).option("--task-definition <name>","Task definition family name").option("--force","Force new deployment even if no changes").option("--wait","Wait for deployment to stabilize").option("--skip-security-scan","Skip pre-deployment security scan").option("--security-fail-on <severity>","Security scan fail threshold (critical, high, medium, low)",{default:"critical"}).action(async(t)=>{i("Deploying Container");try{let m=await Ne(),k=m.project.region||"us-east-1",I=t?.cluster,L=t?.service,z=t?.repository,Y=t?.image||"latest",Z=t?.dockerfile||"Dockerfile",X=t?.context||".",ie=t?.force||!1,oe=t?.wait||!1,ae=new Date().toISOString(),be=crypto.randomUUID();if(!I||!L){r("--cluster and --service are required");return}if(!z){r("--repository is required");return}if(!In(Z)){r(`Dockerfile not found: ${Z}`);return}let Ae;if(!t?.skipSecurityScan){u("Scanning build context for leaked secrets...");let{result:Wt}=await pa({sourceDir:X,failOnSeverity:t?.securityFailOn||"critical"});fa(Wt),Ae=Wt}else a(`Security scan skipped (--skip-security-scan)
-`);let de=cl(m,void 0,Ae);if(!de.allowed){r(`
-✗ Container deployment blocked by security policy: ${de.explanation}`),e("Remediate the findings or create an authorized, time-limited waiver in the Security posture center."),process.exitCode=1;return}if(n(`✓ Security policy allows this deployment
+https://${Y}.s3.${k}.amazonaws.com${X?`/${X}`:""}/index.html`,"green")}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}}),R.command("deploy:container","Deploy container (ECR push + ECS service update)").option("--cluster <name>","ECS cluster name").option("--service <name>","ECS service name").option("--repository <name>","ECR repository name").option("--image <tag>","Docker image tag",{default:"latest"}).option("--dockerfile <path>","Dockerfile path",{default:"Dockerfile"}).option("--context <path>","Docker build context",{default:"."}).option("--task-definition <name>","Task definition family name").option("--force","Force new deployment even if no changes").option("--wait","Wait for deployment to stabilize").option("--skip-security-scan","Skip pre-deployment security scan").option("--security-fail-on <severity>","Security scan fail threshold (critical, high, medium, low)",{default:"critical"}).action(async(t)=>{i("Deploying Container");try{let m=await De(),k=m.project.region||"us-east-1",I=t?.cluster,L=t?.service,z=t?.repository,Y=t?.image||"latest",Z=t?.dockerfile||"Dockerfile",X=t?.context||".",ee=t?.force||!1,oe=t?.wait||!1,se=new Date().toISOString(),ue=crypto.randomUUID();if(!I||!L){r("--cluster and --service are required");return}if(!z){r("--repository is required");return}if(!Sn(Z)){r(`Dockerfile not found: ${Z}`);return}let ke;if(!t?.skipSecurityScan){u("Scanning build context for leaked secrets...");let{result:Lt}=await ca({sourceDir:X,failOnSeverity:t?.securityFailOn||"critical"});la(Lt),ke=Lt}else a(`Security scan skipped (--skip-security-scan)
+`);let ce=cl(m,void 0,ke);if(!ce.allowed){r(`
+✗ Container deployment blocked by security policy: ${ce.explanation}`),e("Remediate the findings or create an authorized, time-limited waiver in the Security posture center."),process.exitCode=1;return}if(n(`✓ Security policy allows this deployment
 `),e(`Cluster: ${I}`),e(`Service: ${L}`),e(`Repository: ${z}`),e(`Image Tag: ${Y}`),e(`Dockerfile: ${Z}`),!await d(`
-Deploy container now?`,!0)){e("Deployment cancelled");return}let De=new At(k),Se=new Mt(k),Re=new s("Getting ECR credentials...");Re.start();let Pe=await De.getAuthorizationToken();if(!Pe.authorizationData?.[0]){Re.fail("Failed to get ECR credentials");return}let ze=Pe.authorizationData[0],Be=(ze.proxyEndpoint||"").replace("https://","");Re.succeed("ECR credentials obtained");let Ve=new s("Logging into ECR...");Ve.start();let ct=ze.authorizationToken||"",nt=Buffer.from(ct,"base64").toString("utf8").split(":")[1],{spawn:xt}=await import("child_process"),Qt=xt("docker",["login","--username","AWS","--password-stdin",Be],{stdio:["pipe","pipe","pipe"]});Qt.stdin.write(nt),Qt.stdin.end(),await new Promise((Wt,Pn)=>{Qt.on("close",(xn)=>{if(xn===0)Wt();else Pn(Error(`Docker login failed with code ${xn}`))})}),Ve.succeed("Logged into ECR");let Tt=new s("Building Docker image...");Tt.start();let Ge=`${Be}/${z}:${Y}`,Ot=xt("docker",["build","-t",Ge,"-f",Z,X],{stdio:["pipe","pipe","pipe"]});await new Promise((Wt,Pn)=>{let xn="";Ot.stderr.on("data",(Ht)=>{xn+=Ht.toString()}),Ot.on("close",(Ht)=>{if(Ht===0)Wt();else Pn(Error(`Docker build failed: ${xn}`))})}),Tt.succeed("Docker image built");let zt=new s("Pushing image to ECR...");zt.start();let it=xt("docker",["push",Ge],{stdio:["pipe","pipe","pipe"]});await new Promise((Wt,Pn)=>{let xn="";it.stderr.on("data",(Ht)=>{xn+=Ht.toString()}),it.on("close",(Ht)=>{if(Ht===0)Wt();else Pn(Error(`Docker push failed: ${xn}`))})}),zt.succeed("Image pushed to ECR");let Et,hn=xt("docker",["image","inspect","--format={{.Id}}",Ge],{stdio:["ignore","pipe","pipe"]}),[yn,tr]=await Promise.all([new Promise((Wt)=>hn.on("close",Wt)),new Response(hn.stdout).text()]);if(yn===0){let Wt=tr.trim();if(/^sha256:[a-f0-9]{64}$/i.test(Wt))Et=Wt}let Oi=await rg(m,{imageRef:Ge,imageSha256:Et,artifactRoot:X,invocationId:be,startedAt:ae});if(!Oi.allowed){r(`
-✗ ECS service update blocked by release security policy: ${Oi.explanation}`),e("The image remains in ECR for investigation. Remediate and rebuild it, or create an authorized, time-limited waiver."),process.exitCode=1;return}n(`✓ Release security policy allows the ECS service update
-`);let wn=new s("Updating ECS service...");if(wn.start(),await Se.updateService({cluster:I,service:L,forceNewDeployment:ie}),wn.succeed("ECS service updated"),oe){let Wt=new s("Waiting for deployment to stabilize...");Wt.start(),await Se.waitForServiceStable(I,L),Wt.succeed("Deployment stabilized")}n(`
+Deploy container now?`,!0)){e("Deployment cancelled");return}let xe=new It(k),ve=new Bt(k),Re=new s("Getting ECR credentials...");Re.start();let Ie=await xe.getAuthorizationToken();if(!Ie.authorizationData?.[0]){Re.fail("Failed to get ECR credentials");return}let Me=Ie.authorizationData[0],Fe=(Me.proxyEndpoint||"").replace("https://","");Re.succeed("ECR credentials obtained");let ze=new s("Logging into ECR...");ze.start();let ot=Me.authorizationToken||"",He=Buffer.from(ot,"base64").toString("utf8").split(":")[1],{spawn:dt}=await import("child_process"),Jt=dt("docker",["login","--username","AWS","--password-stdin",Fe],{stdio:["pipe","pipe","pipe"]});Jt.stdin.write(He),Jt.stdin.end(),await new Promise((Lt,kn)=>{Jt.on("close",(An)=>{if(An===0)Lt();else kn(Error(`Docker login failed with code ${An}`))})}),ze.succeed("Logged into ECR");let At=new s("Building Docker image...");At.start();let qe=`${Fe}/${z}:${Y}`,xt=dt("docker",["build","-t",qe,"-f",Z,X],{stdio:["pipe","pipe","pipe"]});await new Promise((Lt,kn)=>{let An="";xt.stderr.on("data",(qt)=>{An+=qt.toString()}),xt.on("close",(qt)=>{if(qt===0)Lt();else kn(Error(`Docker build failed: ${An}`))})}),At.succeed("Docker image built");let Ot=new s("Pushing image to ECR...");Ot.start();let Ke=dt("docker",["push",qe],{stdio:["pipe","pipe","pipe"]});await new Promise((Lt,kn)=>{let An="";Ke.stderr.on("data",(qt)=>{An+=qt.toString()}),Ke.on("close",(qt)=>{if(qt===0)Lt();else kn(Error(`Docker push failed: ${An}`))})}),Ot.succeed("Image pushed to ECR");let $t,gn=dt("docker",["image","inspect","--format={{.Id}}",qe],{stdio:["ignore","pipe","pipe"]}),[hn,Fn]=await Promise.all([new Promise((Lt)=>gn.on("close",Lt)),new Response(gn.stdout).text()]);if(hn===0){let Lt=Fn.trim();if(/^sha256:[a-f0-9]{64}$/i.test(Lt))$t=Lt}let Li=await rg(m,{imageRef:qe,imageSha256:$t,artifactRoot:X,invocationId:ue,startedAt:se});if(!Li.allowed){r(`
+✗ ECS service update blocked by release security policy: ${Li.explanation}`),e("The image remains in ECR for investigation. Remediate and rebuild it, or create an authorized, time-limited waiver."),process.exitCode=1;return}n(`✓ Release security policy allows the ECS service update
+`);let vn=new s("Updating ECS service...");if(vn.start(),await ve.updateService({cluster:I,service:L,forceNewDeployment:ee}),vn.succeed("ECS service updated"),oe){let Lt=new s("Waiting for deployment to stabilize...");Lt.start(),await ve.waitForServiceStable(I,L),Lt.succeed("Deployment stabilized")}n(`
 Container deployment complete!`),e(`
-Image: ${Ge}`),e(`Cluster: ${I}`),e(`Service: ${L}`)}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}})}async function og(R){let t=process.cwd(),m=`${t}/.env`,k=`${t}/.env.local`,z=({stage:["stage","staging"],staging:["staging","stage"]}[R]||[R]).map((oe)=>`${t}/.env.${oe}`).find((oe)=>In(oe));if(!z){if(In(m))a(`No .env.${R} found, falling back to .env`);else e(`No .env.${R} or .env file found; using the existing process environment`);return null}let Y=z.split("/").pop();u(`Loading environment file: ${Y}`);let Z=null,X=null;if(In(k)){Z=`${k}.bak`,As(k,Z);let oe=ll(k,"utf-8");for(let be of oe.split(`
-`)){let Ae=be.trim();if(!Ae||Ae.startsWith("#"))continue;let de=Ae.indexOf("=");if(de===-1)continue;let ke=Ae.slice(0,de).trim();delete process.env[ke]}let{unlinkSync:ae}=await import("node:fs");ae(k),e("Temporarily moved .env.local out of the way and purged its values from process.env")}if(In(m))X=`${m}.bak`,As(m,X);As(z,m);let ie=ll(z,"utf-8");for(let oe of ie.split(`
-`)){let ae=oe.trim();if(!ae||ae.startsWith("#"))continue;let be=ae.indexOf("=");if(be===-1)continue;let Ae=ae.slice(0,be).trim(),de=ae.slice(be+1).trim();process.env[Ae]=de}return n(`Loaded ${Y}`),async()=>{let{unlinkSync:oe}=await import("node:fs");if(X)As(X,`${t}/.env`),oe(X),e("Restored .env");if(Z)As(Z,`${t}/.env.local`),oe(Z),e("Restored .env.local")}}async function sg(R,t,m,k){if(!m)return;let I=Ns(R.sites||{});if(I.size===0)return;if(!t){a("DNS: no app server IP resolved — skipping A-record reconciliation.");return}let L;try{L=bn(m)}catch(ie){a(`DNS: ${ie instanceof Error?ie.message:String(ie)}`),e(`Point each site domain at ${t} manually.`);return}if(!L){a(`DNS provider '${m}' is not configured — skipping A-record reconciliation.`),e(`Point each site domain at ${t} manually.`);return}if(L.provider==="route53"){let ie=R.infrastructure?.dns?.hostedZoneId;if(ie&&!L.hostedZoneId)L.hostedZoneId=ie}let z=B(L),Y=R.infrastructure?.dns?.domain,Z=te(k),X=Z?"A/AAAA":"A";u(`Reconciling DNS: ${I.size} ${X} record(s) → ${t} via ${m}...`);for(let ie of I){let oe=Y&&ie.endsWith(Y)?Y:ie.split(".").slice(-2).join(".");try{let ae=await Ei({provider:z,zone:oe,fqdn:ie,ipv4:t,ipv6:Z});for(let be of ae.published)n(`  ✓ ${be.fqdn} ${be.type} → ${be.content}`);for(let be of ae.warnings)a(`  ⚠ ${ie}: ${be}`)}catch(ae){a(`  ⚠ ${ie}: ${ae instanceof Error?ae.message:String(ae)} — set the address record manually.`)}}}async function ag(R,t){let m=R.infrastructure?.dns?.records;if(!t||!m?.length)return;let k=R.infrastructure?.dns?.domain;if(!k){a("DNS records: infrastructure.dns.domain is not set — skipping declared records.");return}let I;try{I=bn(t)}catch(Y){a(`DNS records: ${Y instanceof Error?Y.message:String(Y)}`);return}if(!I){a(`DNS records: provider '${t}' is not configured — skipping.`);return}let L=B(I),z=Lo(m,k);u(`Reconciling ${z.length} declared DNS record(s) on ${k}...`);try{let Y=await Mo({provider:L,zone:k,records:z});for(let Z of Y.outcomes){let{record:X,action:ie}=Z,oe=`${X.type} ${X.name} -> ${X.content.slice(0,60)}`;if(ie==="failed")a(`  ⚠ ${oe}: ${Z.message||"failed"}`);else if(ie==="unchanged")e(`  = ${oe}`);else n(`  ✓ ${oe} (${ie})`)}for(let Z of Y.warnings)a(`  ⚠ ${Z}`)}catch(Y){a(`DNS records: ${Y instanceof Error?Y.message:String(Y)}`)}}async function cg(R,t,m){let{plan:k,errors:I}=Qc(R);for(let z of I)a(`Cloudflare CDN: ${z}`);if(!k)return;if(!t){a("Cloudflare CDN: no app server IP resolved — skipping.");return}u(`Cloudflare CDN: reconciling ${k.hosts.length} host(s) on ${k.zone}...`);let L=new he(k.apiToken,{zoneId:k.zoneId,accountId:k.accountId});try{let z=await Zc({provider:L,zone:k.zone,hosts:k.hosts,ipv4:t,ipv6:te(m),proxied:k.proxied,settings:k.settings,cache:k.cache,originGuard:k.originGuard,purge:k.purge,skipOriginProbe:k.skipOriginProbe});for(let Y of z.records)n(`  ✓ ${Y.host} ${Y.type} → ${Y.content}${Y.proxied?" (proxied)":" (DNS-only)"}`);for(let Y of z.settingsChanged)e(`  ✓ ${Y.id}: ${JSON.stringify(Y.from)} → ${JSON.stringify(Y.to)}`);if(z.cacheRules>0)n(`  ✓ ${z.cacheRules} cache rule(s) applied`);if(z.originGuard)n("  ✓ origin guard header applied");if(z.purged)n("  ✓ edge cache purged");for(let Y of z.warnings)a(`  ⚠ ${Y}`)}catch(z){a(`Cloudflare CDN: ${z instanceof Error?z.message:String(z)}`)}}async function ou(R,t={}){let m=Object.keys(R.infrastructure?.r2?.buckets??{}).length;if(m===0)return!0;u(`Cloudflare R2: ${t.dryRun?"planning":"reconciling"} ${m} bucket(s)...`);try{let k=await tl(R,{apiToken:process.env.CLOUDFLARE_API_TOKEN,accountId:process.env.CLOUDFLARE_ACCOUNT_ID,zoneId:process.env.CLOUDFLARE_ZONE_ID,dryRun:t.dryRun});for(let I of k.buckets){if(I.changes.length===0)e(`  = ${I.name} (in sync)`);for(let L of I.changes)n(`  ✓ ${I.name}: ${L}`);for(let L of I.domains)e(`    ${L.domain}: ${L.status??"unknown"}`)}for(let I of k.warnings)a(`  ⚠ ${I}`);return!0}catch(k){return r(`Cloudflare R2: ${k instanceof Error?k.message:String(k)}`),!1}}async function su(R,t={}){let m=Object.keys(R.infrastructure?.workers??{}).length;if(m===0)return!0;u(`Cloudflare Workers: ${t.dryRun?"planning":"reconciling"} ${m} Worker(s)...`);try{let k=await sl(R,{apiToken:process.env.CLOUDFLARE_API_TOKEN,accountId:process.env.CLOUDFLARE_ACCOUNT_ID,zoneId:process.env.CLOUDFLARE_ZONE_ID,projectRoot:process.cwd(),dryRun:t.dryRun});for(let I of k.workers){for(let L of I.changes)n(`  ✓ ${I.name}: ${L}`);for(let L of I.domains)e(`    ${L.domain}: ${L.status??"unknown"}`)}for(let I of k.warnings)a(`  ⚠ ${I}`);return!0}catch(k){return r(`Cloudflare Workers: ${k instanceof Error?k.message:String(k)}`),!1}}async function lg(R,t,m,k,I,L,z=!1){let Y=R.sites||{},Z=t?[t]:Object.keys(Y);if(Z.length===0){a("No sites configured in cloud.config.ts");return}let X=null,ie=!1,oe=()=>{if(X||ie)return X;let ae=null;try{ae=bn(m)}catch(be){r(be.message)}if(!ae)return r(`DNS provider '${m}' is not configured. Please set the required environment variables.`),e(`
-For Cloudflare: CLOUDFLARE_API_TOKEN`),e("For Porkbun: PORKBUN_API_KEY, PORKBUN_SECRET_KEY"),e("For GoDaddy: GODADDY_API_KEY, GODADDY_API_SECRET"),ie=!0,null;if(ae.provider==="route53"){let be=R.infrastructure?.dns?.hostedZoneId;if(be&&!ae.hostedZoneId)ae.hostedZoneId=be}return X={config:ae,provider:B(ae)},X};for(let ae of Z){let be=Y[ae];if(!be){r(`Site '${ae}' not found in configuration`);continue}if(!Wc(be)){let Be=A(be);e(`Site '${ae}' is ${Be} — handled outside the static bucket pipeline.`);continue}let Ae=oe();if(!Ae)return;let de=be.domain;if(!de){r(`Site '${ae}' has no domain configured`);continue}if(i(`Deploying Site: ${ae}`),e(`Domain: ${de}`),e(`Source: ${be.root}`),e(`DNS Provider: ${m}`),be.build){u(`Running build command: ${be.build}`);try{let{execSync:Be}=await import("node:child_process");Be(be.build,{stdio:"inherit",cwd:process.cwd()}),n("Build completed successfully")}catch(Be){r(`Build failed: ${Be.message}`);continue}}if(!In(be.root)){if(r(`Source directory not found: ${be.root}`),!be.build)e('Run your build command first (e.g., bun run generate) or add a "build" option to your site config');continue}u("Checking existing DNS records...");let ke=await Ae.provider.listRecords(de);if(ke.success&&ke.records.length>0){let Be=de.split("."),Ve=Be.length>2?Be[0]:"@",ct=Be.slice(-2).join("."),Dt=ke.records.find((nt)=>nt.type==="CNAME"&&(nt.name===de||nt.name===Ve||nt.name===`${Ve}.${ct}`));if(Dt){let nt=Dt.content.includes("netlify"),xt=Dt.content.includes("vercel");if(Dt.content.includes("cloudfront.net"))e(`Domain already points to CloudFront: ${Dt.content}`),e("Proceeding with file upload...");else{let Tt=nt?"Netlify":xt?"Vercel":"another provider";if(a(`
-Existing CNAME record detected:`),e(`  ${Dt.name} -> ${Dt.content}`),nt||xt)e(`
-This domain is currently pointing to ${Tt}.`),e("Deploying will update this record to point to AWS CloudFront.");if(!(z||await d(`
-Update DNS record to point to AWS CloudFront?`,!0))){e("Deployment cancelled");continue}u(`Removing old ${Tt} CNAME record...`);let Ot=await Ae.provider.deleteRecord(de,{name:Dt.name,type:"CNAME",content:Dt.content});if(Ot.success)n(`Removed CNAME: ${Dt.name} -> ${Dt.content}`);else a(`Could not remove old record: ${Ot.message}`),e("The deployment will attempt to update it instead.")}}}let De=be.root,Se,Re=!!be.installScript;if(Re){let{mkdtempSync:Be,copyFileSync:Ve,readdirSync:ct,statSync:Dt}=await import("node:fs"),{tmpdir:nt}=await import("node:os"),{join:xt,resolve:Qt}=await import("node:path");Se=Be(xt(nt(),"cloud-install-"));let Tt=Qt(be.installScript);Ve(Tt,xt(Se,"index.html"));let Ge=Tt.split("/").pop();if(Ge!=="index.html")Ve(Tt,xt(Se,Ge));if(In(be.root)){let Ot=ct(be.root);for(let zt of Ot){let it=xt(be.root,zt);if(Dt(it).isFile()&&zt!=="index.html")Ve(it,xt(Se,zt))}}De=Se,e(`Install script: ${be.installScript}`),e(`Serving at: curl -fsSL https://${de} | bash`)}u("Deploying to AWS (S3 + CloudFront)...");let Pe=ha(R,ae,be,L),ze=ya(R,ae);e(`Stack: ${Pe}`);let Le=await Yi({siteName:ze,stackName:Pe,domain:de,region:k,bucket:ba(R.project.slug,L,ae,be.bucket),sourceDir:De,certificateArn:be.certificateArn,dnsProvider:Ae.config,skipDnsVerification:I,passthroughUrls:Re,dynamicApp:!!R.infrastructure?.compute?.cloudFrontOriginDomain,computeOriginDomain:R.infrastructure?.compute?.cloudFrontOriginDomain,computeOriginPort:R.infrastructure?.compute?.cloudFrontOriginPort??R.infrastructure?.api?.port??3008,computeOriginId:R.infrastructure?.compute?.cloudFrontOriginId??`${R.project.slug}-site-ec2`,onProgress:(Be,Ve)=>{if(Be==="infrastructure")u(Ve||"Setting up infrastructure...");else if(Be==="upload"){if(Ve?.includes("/")&&!Ve.includes("1/")){let ct=Ve.match(/(\d+)\/(\d+)/);if(ct){let[,Dt,nt]=ct;if(Number(Dt)%10===0||Dt===nt)e(`  Uploaded ${Dt}/${nt} files`)}}}else if(Be==="invalidate")u("Invalidating CDN cache...")}});if(Se){let{rmSync:Be}=await import("node:fs");Be(Se,{recursive:!0,force:!0})}if(Le.success){n(`
-Deployment successful!`);let Be=Le.filesSkipped>0?`${Le.filesUploaded} uploaded, ${Le.filesSkipped} unchanged`:`${Le.filesUploaded}`,Ve=Re?`
-Install: curl -fsSL https://${Le.domain} | bash`:"";Ee(`Site Deployed!
-
-Domain: https://${Le.domain}
-CloudFront: ${Le.distributionDomain}
-Bucket: ${Le.bucket}
-Files: ${Be}${Ve}
-
-Your site is now live at https://${Le.domain}`,"green")}else throw Error(Le.message||`Site '${ae}' deployment failed`)}}import{execFileSync as dg}from"node:child_process";import{createHash as ug}from"node:crypto";import{existsSync as uu,mkdirSync as mg,mkdtempSync as pg,readdirSync as fg,readFileSync as gg,rmSync as hg,statSync as mu,writeFileSync as yg}from"node:fs";import{tmpdir as vg}from"node:os";import{basename as bg,join as Wo,relative as wg,resolve as ml}from"node:path";var Sg=new Set([".git","node_modules","dist","coverage"]);function pu(R,t=R){let m=[];for(let k of fg(R).sort()){if(Sg.has(k))continue;let I=Wo(R,k);if(ga(I,t))continue;let L=mu(I);if(L.isDirectory())m.push(...pu(I,t));else if(L.isFile())m.push(wg(t,I))}return m}function Cg(R){let t=ml(R);if(!uu(t)||!mu(t).isDirectory())throw Error(`Container context does not exist: ${t}`);let m=ug("sha256");for(let k of pu(t))m.update(k),m.update("\x00"),m.update(gg(Wo(t,k))),m.update("\x00");return m.digest("hex")}function $g(R){return{ecr:new At(R.region||"us-east-1",R.profile),run:(t,m,k)=>{dg(t,m,{cwd:k?.cwd,env:k?.env,stdio:k?.stdio||"inherit"})}}}async function fu(R,t){let m=ml(R.context),k=ml(R.dockerfile||Wo(m,"Dockerfile"));if(!uu(k))throw Error(`Dockerfile does not exist: ${k}`);if(!R.repository.split("/").every((Ae)=>/^[a-z0-9][a-z0-9._-]*$/.test(Ae)&&!/[._-]$/.test(Ae)&&!/[._-]{2}/.test(Ae)))throw Error("ECR repository name is invalid");let z=t||$g(R),Y=Cg(m),Z=`sha-${Y.slice(0,20)}`,X="";try{X=(await z.ecr.describeRepositories({repositoryNames:[R.repository]})).repositories?.[0]?.repositoryUri||""}catch{}if(!X)X=(await z.ecr.createRepository({repositoryName:R.repository,imageTagMutability:"IMMUTABLE",imageScanningConfiguration:{scanOnPush:!0},tags:[{Key:"ManagedBy",Value:"ts-cloud"}]})).repository?.repositoryUri||"";if(!X)throw Error(`Could not resolve ECR repository URI for ${R.repository}`);await z.ecr.putLifecyclePolicy({repositoryName:R.repository,lifecyclePolicyText:JSON.stringify({rules:[{rulePriority:1,description:"Retain the newest 25 release images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:25},action:{type:"expire"}}]})});let ie=`${X}:${Z}`,oe=pg(Wo(vg(),"ts-cloud-container-"));try{z.run("docker",["version"],{stdio:"ignore"}),z.run("docker",["build","--platform",R.platform||"linux/amd64","--provenance=false","--sbom=false","--file",k,"--tag",ie,m],{cwd:m});let Ae=(await z.ecr.getAuthorizationToken()).authorizationData?.[0];if(!Ae?.authorizationToken||!Ae.proxyEndpoint)throw Error("ECR did not return Docker authorization data");let de=Ae.proxyEndpoint.replace(/^https?:\/\//,""),ke=Wo(oe,"docker");mg(ke,{recursive:!0}),yg(Wo(ke,"config.json"),JSON.stringify({auths:{[de]:{auth:Ae.authorizationToken}}}),{mode:384}),z.run("docker",["push",ie],{env:{...process.env,DOCKER_CONFIG:ke}})}finally{hg(oe,{recursive:!0,force:!0})}let be=(await z.ecr.describeImages({repositoryName:R.repository,imageIds:[{imageTag:Z}]})).imageDetails?.[0]?.imageDigest;if(!be||!/^sha256:[a-f0-9]{64}$/i.test(be))throw Error(`ECR did not return an immutable digest for ${bg(ie)}`);return{repository:R.repository,tag:Z,imageUri:ie,digest:be,digestUri:`${X}@${be}`,contextSha256:Y}}import{createHash as kg}from"node:crypto";function Ag(R){let t=R;return String(t?.code||t?.name||t?.statusCode||"")}function Rg(R){return Ag(R)==="ValidationError"&&String(R.message).includes("does not exist")}function Ig(R){return Object.fromEntries((R||[]).map((t)=>[t.OutputKey,t.OutputValue]))}function Pg(R){let t=R?.Aliases?.Items??R?.Aliases,m=t?.CNAME??t;if(Array.isArray(m))return m.map(String);if(typeof m==="string")return[m];return[]}function gu(R){if(!/^[a-z][a-z0-9-]{1,62}$/.test(R.slug))throw Error("Slug must be a lowercase DNS-safe identifier");if(!/^[A-Z0-9]{8,32}$/.test(R.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(R.expectedAlias))throw Error("Expected distribution alias is invalid");let t=R.imageUri.match(/@((?:sha256:)[a-f0-9]{64})$/i)?.[1];if(!t)throw Error("Container image must use an immutable ECR digest URI ending in @sha256:<64 hex>");let m=R.stackName||`${R.slug}-backend`;if(!/^[A-Za-z][A-Za-z0-9-]{0,127}$/.test(m))throw Error("CloudFormation stack name is invalid");let k=R.pathPattern||"/api/*";if(!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]+\*$/.test(k)||k==="/*")throw Error("Backend path must be a non-default wildcard pattern");let I=R.originId||`${R.slug}-backend`;if(!/^[A-Za-z0-9_.-]{1,128}$/.test(I))throw Error("CloudFront origin ID is invalid");if(R.originVerifySecret&&R.originVerifySecret.length<24)throw Error("Origin verification secret must contain at least 24 characters");if(!!R.originDomain!==!!R.certificateArn)throw Error("A custom origin domain and matching ACM certificate ARN must be provided together");return{stackName:m,region:R.region||"us-east-1",pathPattern:k,originId:I,digest:t}}function pl(R){let t=R.region||"us-east-1";return{cloudformation:new v(t,R.profile),cloudfront:new E(R.profile),sts:new bt(t,R.profile),fetch,sleep:(m)=>new Promise((k)=>setTimeout(k,m))}}function xg(R){let t=gu(R),m=Da({name:R.name,slug:R.slug,domain:R.originDomain||R.expectedAlias,imageUri:R.imageUri,certificateArn:R.certificateArn,originVerifySecret:R.originVerifySecret,desiredCount:R.desiredCount,database:R.database,cache:R.cache,queue:R.queue}),k=Pa(m);return k.Description=`Managed backend for existing static frontend ${R.expectedAlias}`,k.Metadata={ManagedBy:"ts-cloud",ExistingDistributionId:R.distributionId,ExistingDistributionAlias:R.expectedAlias,BackendPathPattern:t.pathPattern,ContainerDigest:t.digest},k}async function Dg(R,t,m){let k;for(let I=0;I<30;I++){let L=Date.now();try{let z=await R.fetch(t,{redirect:"manual",headers:m?{"x-origin-verify":m}:void 0}),Y=Date.now()-L,Z=await z.text(),X=Z;try{X=JSON.parse(Z)}catch{}if(z.ok)return{url:t,status:z.status,latencyMs:Y,body:X};k=Error(`origin returned ${z.status}`)}catch(z){k=z}if(I<29)await R.sleep(1e4)}throw Error(`Backend origin did not become healthy: ${k instanceof Error?k.message:String(k)}`)}async function hu(R,t){let m=gu(R),k=t||pl({region:m.region,profile:R.profile}),[I,L]=await Promise.all([k.sts.getCallerIdentity(),k.cloudfront.getDistribution(R.distributionId)]);if(!I.Account)throw Error("AWS identity did not return an account ID");if(!L.Enabled)throw Error(`CloudFront distribution ${R.distributionId} is disabled`);if(!Pg(L).includes(R.expectedAlias))throw Error(`Distribution ${R.distributionId} does not contain expected alias ${R.expectedAlias}`);let z;try{z=(await k.cloudformation.describeStacks({stackName:m.stackName})).Stacks[0]}catch(Pe){if(!Rg(Pe))throw Pe}let Y=xg(R),Z=JSON.stringify(Y);if(Buffer.byteLength(Z)>51200)throw Error("Generated template exceeds the direct CloudFormation template body limit");let X=Object.values(Y.Resources||{}).reduce((Pe,ze)=>(Pe[ze.Type]=(Pe[ze.Type]||0)+1,Pe),{}),ie=[`cloud cdn:origin:remove ${R.distributionId} ${R.originDomain||"ALB_HOST"} --id ${m.originId} --path '${m.pathPattern}' --profile ${R.profile||"default"} --apply --confirm 'remove:${R.distributionId}:${m.pathPattern}'`,`After CloudFront is deployed, restore external DNS if changed and delete stack ${m.stackName} only with an approved data-retention decision.`],oe={mode:R.apply?"apply":"plan",accountId:I.Account,stack:{name:m.stackName,existed:!!z,status:z?.StackStatus,templateSha256:kg("sha256").update(Z).digest("hex"),resourceCount:Object.keys(Y.Resources||{}).length,resourceTypes:X},distribution:{id:L.Id,alias:R.expectedAlias,domainName:L.DomainName,status:L.Status,pathPattern:m.pathPattern,originId:m.originId},artifact:{imageUri:R.imageUri,digest:m.digest},services:{database:R.database!==!1,cache:R.cache!==!1,queue:R.queue!==!1,mail:"ses",desiredCount:R.desiredCount||1},cloudFrontApplied:!1,dnsApplied:!1,applied:!1,rollback:ie};if(!R.apply)return oe;let ae=`${R.distributionId}:${m.pathPattern}:${m.stackName}`;if(R.confirm!==ae)throw Error(`Pass exact confirmation token ${ae} to provision the backend and change live routing`);if(z)try{await k.cloudformation.updateStack({stackName:m.stackName,templateBody:Z,capabilities:["CAPABILITY_NAMED_IAM"],tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:R.slug}]}),await k.cloudformation.waitForStack(m.stackName,"stack-update-complete")}catch(Pe){if(!String(Pe.message).includes("No updates are to be performed"))throw Pe}else await k.cloudformation.createStack({stackName:m.stackName,templateBody:Z,capabilities:["CAPABILITY_NAMED_IAM"],onFailure:"ROLLBACK",tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:R.slug}]}),await k.cloudformation.waitForStack(m.stackName,"stack-create-complete");let be=(await k.cloudformation.describeStacks({stackName:m.stackName})).Stacks[0],Ae=Ig(be?.Outputs),de=Ae.AppLoadBalancerDnsName;if(!de)throw Error("Backend stack did not return AppLoadBalancerDnsName");let ke=!1;if(R.originDomain&&R.originDomain!==de){if(!k.dns)throw Error(`External DNS provider is required to map ${R.originDomain} to ${de}`);let Pe=await k.dns.upsertRecord(R.originDomain,{name:R.originDomain,type:"CNAME",content:de,ttl:300});if(!Pe.success)throw Error(Pe.message||"External DNS update failed");ke=!0}let De=R.originDomain||de,Se=R.certificateArn?"https-only":"http-only",Re=R.skipHealthCheck?void 0:await Dg(k,`${Se==="https-only"?"https":"http"}://${De}/api/health`,R.originVerifySecret);return await k.cloudfront.upsertExistingDistributionOrigin(R.distributionId,{id:m.originId,domainName:De,pathPattern:m.pathPattern,protocolPolicy:Se,customHeaders:R.originVerifySecret?{"X-Origin-Verify":R.originVerifySecret}:void 0}),{...oe,outputs:Ae,health:Re,cloudFrontApplied:!0,dnsApplied:ke,applied:!0}}function yu(R={}){let m={fargate:730*(R.desiredCount||1)*0.012342500000000001,applicationLoadBalancer:16.425,natGateway:32.85,postgres:730*(R.multiAzDatabase?0.032:0.016),redis:23.36};return{monthlyUsd:Number(Object.values(m).reduce((k,I)=>k+I,0).toFixed(2)),components:Object.fromEntries(Object.entries(m).map(([k,I])=>[k,Number(I.toFixed(2))])),assumptions:["us-east-1 public on-demand rate snapshot, July 2026","one 0.25 vCPU/0.5 GB Linux Fargate task unless desiredCount is changed","one ALB before LCU charges and one NAT gateway before data processing","single-AZ db.t4g.micro PostgreSQL by default and two cache.t4g.micro Redis nodes","excludes storage, backups, CloudFront, data transfer, public IPv4, logs, email, queue requests, taxes, and free-tier credits"]}}function fl(R){R.command("container:artifact <repository>","Build, scan, push, and resolve an immutable ECR container artifact").option("--context <path>","Docker build context",{default:"."}).option("--dockerfile <path>","Dockerfile path").option("--platform <platform>","Target platform",{default:"linux/amd64"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--profile <name>","AWS credential profile").action(async(t,m)=>{try{let k=await fu({repository:t,context:m.context||".",dockerfile:m.dockerfile,platform:m.platform,region:m.region,profile:m.profile});n("Immutable container artifact published."),e(JSON.stringify(k,null,2))}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}}),R.command("deploy:fullstack <distributionId> <alias>","Plan or deploy an ECS/RDS/Redis/SQS/SES backend behind an existing static site").option("--name <name>","Application display name").option("--slug <slug>","Application slug").option("--image <digest-uri>","Immutable ECR image URI with @sha256 digest").option("--stack <name>","Backend CloudFormation stack name").option("--path <pattern>","CloudFront backend path",{default:"/api/*"}).option("--origin-id <id>","CloudFront origin ID").option("--origin-domain <domain>","DNS name for the ALB origin").option("--certificate-arn <arn>","ACM certificate matching the origin domain").option("--dns-provider <provider>","External DNS provider (porkbun, godaddy, cloudflare, route53)").option("--origin-secret-env <name>","Environment variable holding the CloudFront-to-ALB secret",{default:"TS_CLOUD_ORIGIN_SECRET"}).option("--desired-count <count>","Baseline Fargate task count",{default:"1"}).option("--no-database","Do not provision PostgreSQL").option("--no-cache","Do not provision Redis").option("--no-queue","Do not provision SQS").option("--region <region>","AWS region",{default:"us-east-1"}).option("--profile <name>","AWS credential profile").option("--skip-health-check","Skip the ALB health gate before CloudFront").option("--apply","Provision and change live routing").option("--confirm <text>","Exact distribution:path:stack confirmation").action(async(t,m,k)=>{try{if(!k.slug)throw Error("--slug is required");if(!k.image)throw Error("--image must be an immutable digest URI from container:artifact");let I=k.originSecretEnv||"TS_CLOUD_ORIGIN_SECRET",L=process.env[I];if(k.apply&&!L)throw Error(`${I} must contain a stable random CloudFront-to-ALB secret before apply`);let z=pl({region:k.region,profile:k.profile}),Y=k.originDomain&&k.apply?{...z,dns:Vr(k.dnsProvider)}:z,Z=await hu({name:k.name||k.slug,slug:k.slug,imageUri:k.image,distributionId:t,expectedAlias:m,stackName:k.stack,pathPattern:k.path,originId:k.originId,originDomain:k.originDomain,certificateArn:k.certificateArn,originVerifySecret:L,desiredCount:Number(k.desiredCount)||1,database:k.database!==!1,cache:k.cache!==!1,queue:k.queue!==!1,region:k.region,profile:k.profile,skipHealthCheck:!!k.skipHealthCheck,apply:!!k.apply,confirm:k.confirm},Y);if(e(JSON.stringify(Z,null,2)),Z.applied)n("Full-stack backend is healthy and the CloudFront path patch was submitted.");else e(`Plan only. Apply with --confirm '${t}:${Z.distribution.pathPattern}:${Z.stack.name}'.`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}}),R.command("deploy:fullstack:cost","Estimate the always-on full-stack backend baseline").option("--desired-count <count>","Fargate task count",{default:"1"}).option("--multi-az-database","Estimate a two-instance database baseline").action((t)=>e(JSON.stringify(yu({desiredCount:Number(t.desiredCount)||1,multiAzDatabase:!!t.multiAzDatabase}),null,2)))}function Eg(R){return R.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function vu(R,t="/var/www"){let m=`${t}/${R}-`;return["set -u",`for TS_CLOUD_DIR in ${m}*; do`,'  [ -d "$TS_CLOUD_DIR" ] || continue','  [ -d "$TS_CLOUD_DIR/releases" ] || continue',`  TS_CLOUD_SITE="\${TS_CLOUD_DIR#${m}}"`,"  TS_CLOUD_ACTIVE=no",`  for TS_CLOUD_UNIT in $(ls /etc/systemd/system/ 2>/dev/null | grep -E "^${Eg(R)}-$TS_CLOUD_SITE[-@.]" || true); do`,'    systemctl is-active "$TS_CLOUD_UNIT" >/dev/null 2>&1 && TS_CLOUD_ACTIVE=yes',"  done",'  TS_CLOUD_SIZE="$(du -sh "$TS_CLOUD_DIR" 2>/dev/null | cut -f1)"','  echo "site:$TS_CLOUD_SITE:$TS_CLOUD_ACTIVE:${TS_CLOUD_SIZE:-?}"',"done","exit 0"]}function bu(R){if(!R)return[];let t=[];for(let m of R.split(`
+Image: ${qe}`),e(`Cluster: ${I}`),e(`Service: ${L}`)}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}})}async function og(R){let t=process.cwd(),m=`${t}/.env`,k=`${t}/.env.local`,z=({stage:["stage","staging"],staging:["staging","stage"]}[R]||[R]).map((oe)=>`${t}/.env.${oe}`).find((oe)=>Sn(oe));if(!z){if(Sn(m))a(`No .env.${R} found, falling back to .env`);else e(`No .env.${R} or .env file found; using the existing process environment`);return null}let Y=z.split("/").pop();u(`Loading environment file: ${Y}`);let Z=null,X=null;if(Sn(k)){Z=`${k}.bak`,$s(k,Z);let oe=ll(k,"utf-8");for(let ue of oe.split(`
+`)){let ke=ue.trim();if(!ke||ke.startsWith("#"))continue;let ce=ke.indexOf("=");if(ce===-1)continue;let Se=ke.slice(0,ce).trim();delete process.env[Se]}let{unlinkSync:se}=await import("node:fs");se(k),e("Temporarily moved .env.local out of the way and purged its values from process.env")}if(Sn(m))X=`${m}.bak`,$s(m,X);$s(z,m);let ee=ll(z,"utf-8");for(let oe of ee.split(`
+`)){let se=oe.trim();if(!se||se.startsWith("#"))continue;let ue=se.indexOf("=");if(ue===-1)continue;let ke=se.slice(0,ue).trim(),ce=se.slice(ue+1).trim();process.env[ke]=ce}return n(`Loaded ${Y}`),async()=>{let{unlinkSync:oe}=await import("node:fs");if(X)$s(X,`${t}/.env`),oe(X),e("Restored .env");if(Z)$s(Z,`${t}/.env.local`),oe(Z),e("Restored .env.local")}}async function sg(R,t,m,k){if(!m)return;let I=Bs(R.sites||{});if(I.size===0)return;if(!t){a("DNS: no app server IP resolved — skipping A-record reconciliation.");return}let L;try{L=yn(m)}catch(ee){a(`DNS: ${ee instanceof Error?ee.message:String(ee)}`),e(`Point each site domain at ${t} manually.`);return}if(!L){a(`DNS provider '${m}' is not configured — skipping A-record reconciliation.`),e(`Point each site domain at ${t} manually.`);return}if(L.provider==="route53"){let ee=R.infrastructure?.dns?.hostedZoneId;if(ee&&!L.hostedZoneId)L.hostedZoneId=ee}let z=B(L),Y=R.infrastructure?.dns?.domain,Z=re(k),X=Z?"A/AAAA":"A";u(`Reconciling DNS: ${I.size} ${X} record(s) → ${t} via ${m}...`);for(let ee of I){let oe=Y&&ee.endsWith(Y)?Y:ee.split(".").slice(-2).join(".");try{let se=await Ai({provider:z,zone:oe,fqdn:ee,ipv4:t,ipv6:Z});for(let ue of se.published)n(`  ✓ ${ue.fqdn} ${ue.type} → ${ue.content}`);for(let ue of se.warnings)a(`  ⚠ ${ee}: ${ue}`)}catch(se){a(`  ⚠ ${ee}: ${se instanceof Error?se.message:String(se)} — set the address record manually.`)}}}async function ag(R,t){let m=R.infrastructure?.dns?.records;if(!t||!m?.length)return;let k=R.infrastructure?.dns?.domain;if(!k){a("DNS records: infrastructure.dns.domain is not set — skipping declared records.");return}let I;try{I=yn(t)}catch(Y){a(`DNS records: ${Y instanceof Error?Y.message:String(Y)}`);return}if(!I){a(`DNS records: provider '${t}' is not configured — skipping.`);return}let L=B(I),z=jo(m,k);u(`Reconciling ${z.length} declared DNS record(s) on ${k}...`);try{let Y=await Vo({provider:L,zone:k,records:z});for(let Z of Y.outcomes){let{record:X,action:ee}=Z,oe=`${X.type} ${X.name} -> ${X.content.slice(0,60)}`;if(ee==="failed")a(`  ⚠ ${oe}: ${Z.message||"failed"}`);else if(ee==="unchanged")e(`  = ${oe}`);else n(`  ✓ ${oe} (${ee})`)}for(let Z of Y.warnings)a(`  ⚠ ${Z}`)}catch(Y){a(`DNS records: ${Y instanceof Error?Y.message:String(Y)}`)}}async function cg(R,t,m){let{plan:k,errors:I}=Gc(R);for(let z of I)a(`Cloudflare CDN: ${z}`);if(!k)return;if(!t){a("Cloudflare CDN: no app server IP resolved — skipping.");return}u(`Cloudflare CDN: reconciling ${k.hosts.length} host(s) on ${k.zone}...`);let L=new ye(k.apiToken,{zoneId:k.zoneId,accountId:k.accountId});try{let z=await Hc({provider:L,zone:k.zone,hosts:k.hosts,ipv4:t,ipv6:re(m),proxied:k.proxied,settings:k.settings,cache:k.cache,originGuard:k.originGuard,purge:k.purge,skipOriginProbe:k.skipOriginProbe});for(let Y of z.records)n(`  ✓ ${Y.host} ${Y.type} → ${Y.content}${Y.proxied?" (proxied)":" (DNS-only)"}`);for(let Y of z.settingsChanged)e(`  ✓ ${Y.id}: ${JSON.stringify(Y.from)} → ${JSON.stringify(Y.to)}`);if(z.cacheRules>0)n(`  ✓ ${z.cacheRules} cache rule(s) applied`);if(z.originGuard)n("  ✓ origin guard header applied");if(z.purged)n("  ✓ edge cache purged");for(let Y of z.warnings)a(`  ⚠ ${Y}`)}catch(z){a(`Cloudflare CDN: ${z instanceof Error?z.message:String(z)}`)}}async function ou(R,t={}){let m=Object.keys(R.infrastructure?.r2?.buckets??{}).length;if(m===0)return!0;u(`Cloudflare R2: ${t.dryRun?"planning":"reconciling"} ${m} bucket(s)...`);try{let k=await Zc(R,{apiToken:process.env.CLOUDFLARE_API_TOKEN,accountId:process.env.CLOUDFLARE_ACCOUNT_ID,zoneId:process.env.CLOUDFLARE_ZONE_ID,dryRun:t.dryRun});for(let I of k.buckets){if(I.changes.length===0)e(`  = ${I.name} (in sync)`);for(let L of I.changes)n(`  ✓ ${I.name}: ${L}`);for(let L of I.domains)e(`    ${L.domain}: ${L.status??"unknown"}`)}for(let I of k.warnings)a(`  ⚠ ${I}`);return!0}catch(k){return r(`Cloudflare R2: ${k instanceof Error?k.message:String(k)}`),!1}}async function su(R,t={}){let m=Object.keys(R.infrastructure?.workers??{}).length;if(m===0)return!0;u(`Cloudflare Workers: ${t.dryRun?"planning":"reconciling"} ${m} Worker(s)...`);try{let k=await sl(R,{apiToken:process.env.CLOUDFLARE_API_TOKEN,accountId:process.env.CLOUDFLARE_ACCOUNT_ID,zoneId:process.env.CLOUDFLARE_ZONE_ID,projectRoot:process.cwd(),dryRun:t.dryRun});for(let I of k.workers){for(let L of I.changes)n(`  ✓ ${I.name}: ${L}`);for(let L of I.domains)e(`    ${L.domain}: ${L.status??"unknown"}`)}for(let I of k.warnings)a(`  ⚠ ${I}`);return!0}catch(k){return r(`Cloudflare Workers: ${k instanceof Error?k.message:String(k)}`),!1}}async function lg(R,t,m,k,I,L,z=!1){let Y=R.sites||{},Z=t?[t]:Object.keys(Y);if(Z.length===0){a("No sites configured in cloud.config.ts");return}let X=null,ee=!1,oe=()=>{if(X||ee)return X;let se=null;try{se=yn(m)}catch(ue){r(ue.message)}if(!se)return r(`DNS provider '${m}' is not configured. Please set the required environment variables.`),e(`
+For Cloudflare: CLOUDFLARE_API_TOKEN`),e("For Porkbun: PORKBUN_API_KEY, PORKBUN_SECRET_KEY"),e("For GoDaddy: GODADDY_API_KEY, GODADDY_API_SECRET"),ee=!0,null;if(se.provider==="route53"){let ue=R.infrastructure?.dns?.hostedZoneId;if(ue&&!se.hostedZoneId)se.hostedZoneId=ue}return X={config:se,provider:B(se)},X};for(let se of Z){let ue=Y[se];if(!ue){r(`Site '${se}' not found in configuration`);continue}if(!tl(ue)){let Fe=A(ue);e(`Site '${se}' is ${Fe} — handled outside the static bucket pipeline.`);continue}let ke=oe();if(!ke)return;let ce=ue.domain;if(!ce){r(`Site '${se}' has no domain configured`);continue}if(i(`Deploying Site: ${se}`),e(`Domain: ${ce}`),e(`Source: ${ue.root}`),e(`DNS Provider: ${m}`),ue.build){u(`Running build command: ${ue.build}`);try{let{execSync:Fe}=await import("node:child_process");Fe(ue.build,{stdio:"inherit",cwd:process.cwd()}),n("Build completed successfully")}catch(Fe){r(`Build failed: ${Fe.message}`);continue}}if(!Sn(ue.root)){if(r(`Source directory not found: ${ue.root}`),!ue.build)e('Run your build command first (e.g., bun run generate) or add a "build" option to your site config');continue}u("Checking existing DNS records...");let Se=await ke.provider.listRecords(ce);if(Se.success&&Se.records.length>0){let Fe=ce.split("."),ze=Fe.length>2?Fe[0]:"@",ot=Fe.slice(-2).join("."),wt=Se.records.find((He)=>He.type==="CNAME"&&(He.name===ce||He.name===ze||He.name===`${ze}.${ot}`));if(wt){let He=wt.content.includes("netlify"),dt=wt.content.includes("vercel");if(wt.content.includes("cloudfront.net"))e(`Domain already points to CloudFront: ${wt.content}`),e("Proceeding with file upload...");else{let At=He?"Netlify":dt?"Vercel":"another provider";if(a(`
+Existing CNAME record detected:`),e(`  ${wt.name} -> ${wt.content}`),He||dt)e(`
+This domain is currently pointing to ${At}.`),e("Deploying will update this record to point to AWS CloudFront.");if(!(z||await d(`
+Update DNS record to point to AWS CloudFront?`,!0))){e("Deployment cancelled");continue}u(`Removing old ${At} CNAME record...`);let xt=await ke.provider.deleteRecord(ce,{name:wt.name,type:"CNAME",content:wt.content});if(xt.success)n(`Removed CNAME: ${wt.name} -> ${wt.content}`);else a(`Could not remove old record: ${xt.message}`),e("The deployment will attempt to update it instead.")}}}let xe=ue.root,ve,Re=!!ue.installScript;if(Re){let{mkdtempSync:Fe,copyFileSync:ze,readdirSync:ot,statSync:wt}=await import("node:fs"),{tmpdir:He}=await import("node:os"),{join:dt,resolve:Jt}=await import("node:path");ve=Fe(dt(He(),"cloud-install-"));let At=Jt(ue.installScript);ze(At,dt(ve,"index.html"));let qe=At.split("/").pop();if(qe!=="index.html")ze(At,dt(ve,qe));if(Sn(ue.root)){let xt=ot(ue.root);for(let Ot of xt){let Ke=dt(ue.root,Ot);if(wt(Ke).isFile()&&Ot!=="index.html")ze(Ke,dt(ve,Ot))}}xe=ve,e(`Install script: ${ue.installScript}`),e(`Serving at: curl -fsSL https://${ce} | bash`)}u("Deploying to AWS (S3 + CloudFront)...");let Ie=wa(R,se,ue,L),Me=Aa(R,se);e(`Stack: ${Ie}`);let Ne=await no({siteName:Me,stackName:Ie,domain:ce,region:k,bucket:Ra(R.project.slug,L,se,ue.bucket),sourceDir:xe,certificateArn:ue.certificateArn,dnsProvider:ke.config,skipDnsVerification:I,passthroughUrls:Re,dynamicApp:!!R.infrastructure?.compute?.cloudFrontOriginDomain,computeOriginDomain:R.infrastructure?.compute?.cloudFrontOriginDomain,computeOriginPort:R.infrastructure?.compute?.cloudFrontOriginPort??R.infrastructure?.api?.port??3008,computeOriginId:R.infrastructure?.compute?.cloudFrontOriginId??`${R.project.slug}-site-ec2`,onProgress:(Fe,ze)=>{if(Fe==="infrastructure")u(ze||"Setting up infrastructure...");else if(Fe==="upload"){if(ze?.includes("/")&&!ze.includes("1/")){let ot=ze.match(/(\d+)\/(\d+)/);if(ot){let[,wt,He]=ot;if(Number(wt)%10===0||wt===He)e(`  Uploaded ${wt}/${He} files`)}}}else if(Fe==="invalidate")u("Invalidating CDN cache...")}});if(ve){let{rmSync:Fe}=await import("node:fs");Fe(ve,{recursive:!0,force:!0})}if(Ne.success){n(`
+Deployment successful!`);let Fe=Ne.filesSkipped>0?`${Ne.filesUploaded} uploaded, ${Ne.filesSkipped} unchanged`:`${Ne.filesUploaded}`,ze=Re?`
+Install: curl -fsSL https://${Ne.domain} | bash`:"";we(`Site Deployed!
+
+Domain: https://${Ne.domain}
+CloudFront: ${Ne.distributionDomain}
+Bucket: ${Ne.bucket}
+Files: ${Fe}${ze}
+
+Your site is now live at https://${Ne.domain}`,"green")}else throw Error(Ne.message||`Site '${se}' deployment failed`)}}import{execFileSync as dg}from"node:child_process";import{createHash as ug}from"node:crypto";import{existsSync as uu,mkdirSync as mg,mkdtempSync as pg,readdirSync as fg,readFileSync as gg,rmSync as hg,statSync as mu,writeFileSync as yg}from"node:fs";import{tmpdir as vg}from"node:os";import{basename as bg,join as Bo,relative as wg,resolve as ml}from"node:path";var Sg=new Set([".git","node_modules","dist","coverage"]);function pu(R,t=R){let m=[];for(let k of fg(R).sort()){if(Sg.has(k))continue;let I=Bo(R,k);if(Ta(I,t))continue;let L=mu(I);if(L.isDirectory())m.push(...pu(I,t));else if(L.isFile())m.push(wg(t,I))}return m}function Cg(R){let t=ml(R);if(!uu(t)||!mu(t).isDirectory())throw Error(`Container context does not exist: ${t}`);let m=ug("sha256");for(let k of pu(t))m.update(k),m.update("\x00"),m.update(gg(Bo(t,k))),m.update("\x00");return m.digest("hex")}function $g(R){return{ecr:new It(R.region||"us-east-1",R.profile),run:(t,m,k)=>{dg(t,m,{cwd:k?.cwd,env:k?.env,stdio:k?.stdio||"inherit"})}}}async function fu(R,t){let m=ml(R.context),k=ml(R.dockerfile||Bo(m,"Dockerfile"));if(!uu(k))throw Error(`Dockerfile does not exist: ${k}`);if(!R.repository.split("/").every((ke)=>/^[a-z0-9][a-z0-9._-]*$/.test(ke)&&!/[._-]$/.test(ke)&&!/[._-]{2}/.test(ke)))throw Error("ECR repository name is invalid");let z=t||$g(R),Y=Cg(m),Z=`sha-${Y.slice(0,20)}`,X="";try{X=(await z.ecr.describeRepositories({repositoryNames:[R.repository]})).repositories?.[0]?.repositoryUri||""}catch{}if(!X)X=(await z.ecr.createRepository({repositoryName:R.repository,imageTagMutability:"IMMUTABLE",imageScanningConfiguration:{scanOnPush:!0},tags:[{Key:"ManagedBy",Value:"ts-cloud"}]})).repository?.repositoryUri||"";if(!X)throw Error(`Could not resolve ECR repository URI for ${R.repository}`);await z.ecr.putLifecyclePolicy({repositoryName:R.repository,lifecyclePolicyText:JSON.stringify({rules:[{rulePriority:1,description:"Retain the newest 25 release images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:25},action:{type:"expire"}}]})});let ee=`${X}:${Z}`,oe=pg(Bo(vg(),"ts-cloud-container-"));try{z.run("docker",["version"],{stdio:"ignore"}),z.run("docker",["build","--platform",R.platform||"linux/amd64","--provenance=false","--sbom=false","--file",k,"--tag",ee,m],{cwd:m});let ke=(await z.ecr.getAuthorizationToken()).authorizationData?.[0];if(!ke?.authorizationToken||!ke.proxyEndpoint)throw Error("ECR did not return Docker authorization data");let ce=ke.proxyEndpoint.replace(/^https?:\/\//,""),Se=Bo(oe,"docker");mg(Se,{recursive:!0}),yg(Bo(Se,"config.json"),JSON.stringify({auths:{[ce]:{auth:ke.authorizationToken}}}),{mode:384}),z.run("docker",["push",ee],{env:{...process.env,DOCKER_CONFIG:Se}})}finally{hg(oe,{recursive:!0,force:!0})}let ue=(await z.ecr.describeImages({repositoryName:R.repository,imageIds:[{imageTag:Z}]})).imageDetails?.[0]?.imageDigest;if(!ue||!/^sha256:[a-f0-9]{64}$/i.test(ue))throw Error(`ECR did not return an immutable digest for ${bg(ee)}`);return{repository:R.repository,tag:Z,imageUri:ee,digest:ue,digestUri:`${X}@${ue}`,contextSha256:Y}}import{createHash as kg}from"node:crypto";function Ag(R){let t=R;return String(t?.code||t?.name||t?.statusCode||"")}function Rg(R){return Ag(R)==="ValidationError"&&String(R.message).includes("does not exist")}function Ig(R){return Object.fromEntries((R||[]).map((t)=>[t.OutputKey,t.OutputValue]))}function Pg(R){let t=R?.Aliases?.Items??R?.Aliases,m=t?.CNAME??t;if(Array.isArray(m))return m.map(String);if(typeof m==="string")return[m];return[]}function gu(R){if(!/^[a-z][a-z0-9-]{1,62}$/.test(R.slug))throw Error("Slug must be a lowercase DNS-safe identifier");if(!/^[A-Z0-9]{8,32}$/.test(R.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(R.expectedAlias))throw Error("Expected distribution alias is invalid");let t=R.imageUri.match(/@((?:sha256:)[a-f0-9]{64})$/i)?.[1];if(!t)throw Error("Container image must use an immutable ECR digest URI ending in @sha256:<64 hex>");let m=R.stackName||`${R.slug}-backend`;if(!/^[A-Za-z][A-Za-z0-9-]{0,127}$/.test(m))throw Error("CloudFormation stack name is invalid");let k=R.pathPattern||"/api/*";if(!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]+\*$/.test(k)||k==="/*")throw Error("Backend path must be a non-default wildcard pattern");let I=R.originId||`${R.slug}-backend`;if(!/^[A-Za-z0-9_.-]{1,128}$/.test(I))throw Error("CloudFront origin ID is invalid");if(R.originVerifySecret&&R.originVerifySecret.length<24)throw Error("Origin verification secret must contain at least 24 characters");if(!!R.originDomain!==!!R.certificateArn)throw Error("A custom origin domain and matching ACM certificate ARN must be provided together");return{stackName:m,region:R.region||"us-east-1",pathPattern:k,originId:I,digest:t}}function pl(R){let t=R.region||"us-east-1";return{cloudformation:new v(t,R.profile),cloudfront:new E(R.profile),sts:new vt(t,R.profile),fetch,sleep:(m)=>new Promise((k)=>setTimeout(k,m))}}function xg(R){let t=gu(R),m=Ma({name:R.name,slug:R.slug,domain:R.originDomain||R.expectedAlias,imageUri:R.imageUri,certificateArn:R.certificateArn,originVerifySecret:R.originVerifySecret,desiredCount:R.desiredCount,database:R.database,cache:R.cache,queue:R.queue}),k=La(m);return k.Description=`Managed backend for existing static frontend ${R.expectedAlias}`,k.Metadata={ManagedBy:"ts-cloud",ExistingDistributionId:R.distributionId,ExistingDistributionAlias:R.expectedAlias,BackendPathPattern:t.pathPattern,ContainerDigest:t.digest},k}async function Dg(R,t,m){let k;for(let I=0;I<30;I++){let L=Date.now();try{let z=await R.fetch(t,{redirect:"manual",headers:m?{"x-origin-verify":m}:void 0}),Y=Date.now()-L,Z=await z.text(),X=Z;try{X=JSON.parse(Z)}catch{}if(z.ok)return{url:t,status:z.status,latencyMs:Y,body:X};k=Error(`origin returned ${z.status}`)}catch(z){k=z}if(I<29)await R.sleep(1e4)}throw Error(`Backend origin did not become healthy: ${k instanceof Error?k.message:String(k)}`)}async function hu(R,t){let m=gu(R),k=t||pl({region:m.region,profile:R.profile}),[I,L]=await Promise.all([k.sts.getCallerIdentity(),k.cloudfront.getDistribution(R.distributionId)]);if(!I.Account)throw Error("AWS identity did not return an account ID");if(!L.Enabled)throw Error(`CloudFront distribution ${R.distributionId} is disabled`);if(!Pg(L).includes(R.expectedAlias))throw Error(`Distribution ${R.distributionId} does not contain expected alias ${R.expectedAlias}`);let z;try{z=(await k.cloudformation.describeStacks({stackName:m.stackName})).Stacks[0]}catch(Ie){if(!Rg(Ie))throw Ie}let Y=xg(R),Z=JSON.stringify(Y);if(Buffer.byteLength(Z)>51200)throw Error("Generated template exceeds the direct CloudFormation template body limit");let X=Object.values(Y.Resources||{}).reduce((Ie,Me)=>(Ie[Me.Type]=(Ie[Me.Type]||0)+1,Ie),{}),ee=[`cloud cdn:origin:remove ${R.distributionId} ${R.originDomain||"ALB_HOST"} --id ${m.originId} --path '${m.pathPattern}' --profile ${R.profile||"default"} --apply --confirm 'remove:${R.distributionId}:${m.pathPattern}'`,`After CloudFront is deployed, restore external DNS if changed and delete stack ${m.stackName} only with an approved data-retention decision.`],oe={mode:R.apply?"apply":"plan",accountId:I.Account,stack:{name:m.stackName,existed:!!z,status:z?.StackStatus,templateSha256:kg("sha256").update(Z).digest("hex"),resourceCount:Object.keys(Y.Resources||{}).length,resourceTypes:X},distribution:{id:L.Id,alias:R.expectedAlias,domainName:L.DomainName,status:L.Status,pathPattern:m.pathPattern,originId:m.originId},artifact:{imageUri:R.imageUri,digest:m.digest},services:{database:R.database!==!1,cache:R.cache!==!1,queue:R.queue!==!1,mail:"ses",desiredCount:R.desiredCount||1},cloudFrontApplied:!1,dnsApplied:!1,applied:!1,rollback:ee};if(!R.apply)return oe;let se=`${R.distributionId}:${m.pathPattern}:${m.stackName}`;if(R.confirm!==se)throw Error(`Pass exact confirmation token ${se} to provision the backend and change live routing`);if(z)try{await k.cloudformation.updateStack({stackName:m.stackName,templateBody:Z,capabilities:["CAPABILITY_NAMED_IAM"],tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:R.slug}]}),await k.cloudformation.waitForStack(m.stackName,"stack-update-complete")}catch(Ie){if(!String(Ie.message).includes("No updates are to be performed"))throw Ie}else await k.cloudformation.createStack({stackName:m.stackName,templateBody:Z,capabilities:["CAPABILITY_NAMED_IAM"],onFailure:"ROLLBACK",tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:R.slug}]}),await k.cloudformation.waitForStack(m.stackName,"stack-create-complete");let ue=(await k.cloudformation.describeStacks({stackName:m.stackName})).Stacks[0],ke=Ig(ue?.Outputs),ce=ke.AppLoadBalancerDnsName;if(!ce)throw Error("Backend stack did not return AppLoadBalancerDnsName");let Se=!1;if(R.originDomain&&R.originDomain!==ce){if(!k.dns)throw Error(`External DNS provider is required to map ${R.originDomain} to ${ce}`);let Ie=await k.dns.upsertRecord(R.originDomain,{name:R.originDomain,type:"CNAME",content:ce,ttl:300});if(!Ie.success)throw Error(Ie.message||"External DNS update failed");Se=!0}let xe=R.originDomain||ce,ve=R.certificateArn?"https-only":"http-only",Re=R.skipHealthCheck?void 0:await Dg(k,`${ve==="https-only"?"https":"http"}://${xe}/api/health`,R.originVerifySecret);return await k.cloudfront.upsertExistingDistributionOrigin(R.distributionId,{id:m.originId,domainName:xe,pathPattern:m.pathPattern,protocolPolicy:ve,customHeaders:R.originVerifySecret?{"X-Origin-Verify":R.originVerifySecret}:void 0}),{...oe,outputs:ke,health:Re,cloudFrontApplied:!0,dnsApplied:Se,applied:!0}}function yu(R={}){let m={fargate:730*(R.desiredCount||1)*0.012342500000000001,applicationLoadBalancer:16.425,natGateway:32.85,postgres:730*(R.multiAzDatabase?0.032:0.016),redis:23.36};return{monthlyUsd:Number(Object.values(m).reduce((k,I)=>k+I,0).toFixed(2)),components:Object.fromEntries(Object.entries(m).map(([k,I])=>[k,Number(I.toFixed(2))])),assumptions:["us-east-1 public on-demand rate snapshot, July 2026","one 0.25 vCPU/0.5 GB Linux Fargate task unless desiredCount is changed","one ALB before LCU charges and one NAT gateway before data processing","single-AZ db.t4g.micro PostgreSQL by default and two cache.t4g.micro Redis nodes","excludes storage, backups, CloudFront, data transfer, public IPv4, logs, email, queue requests, taxes, and free-tier credits"]}}function fl(R){R.command("container:artifact <repository>","Build, scan, push, and resolve an immutable ECR container artifact").option("--context <path>","Docker build context",{default:"."}).option("--dockerfile <path>","Dockerfile path").option("--platform <platform>","Target platform",{default:"linux/amd64"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--profile <name>","AWS credential profile").action(async(t,m)=>{try{let k=await fu({repository:t,context:m.context||".",dockerfile:m.dockerfile,platform:m.platform,region:m.region,profile:m.profile});n("Immutable container artifact published."),e(JSON.stringify(k,null,2))}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}}),R.command("deploy:fullstack <distributionId> <alias>","Plan or deploy an ECS/RDS/Redis/SQS/SES backend behind an existing static site").option("--name <name>","Application display name").option("--slug <slug>","Application slug").option("--image <digest-uri>","Immutable ECR image URI with @sha256 digest").option("--stack <name>","Backend CloudFormation stack name").option("--path <pattern>","CloudFront backend path",{default:"/api/*"}).option("--origin-id <id>","CloudFront origin ID").option("--origin-domain <domain>","DNS name for the ALB origin").option("--certificate-arn <arn>","ACM certificate matching the origin domain").option("--dns-provider <provider>","External DNS provider (porkbun, godaddy, cloudflare, route53)").option("--origin-secret-env <name>","Environment variable holding the CloudFront-to-ALB secret",{default:"TS_CLOUD_ORIGIN_SECRET"}).option("--desired-count <count>","Baseline Fargate task count",{default:"1"}).option("--no-database","Do not provision PostgreSQL").option("--no-cache","Do not provision Redis").option("--no-queue","Do not provision SQS").option("--region <region>","AWS region",{default:"us-east-1"}).option("--profile <name>","AWS credential profile").option("--skip-health-check","Skip the ALB health gate before CloudFront").option("--apply","Provision and change live routing").option("--confirm <text>","Exact distribution:path:stack confirmation").action(async(t,m,k)=>{try{if(!k.slug)throw Error("--slug is required");if(!k.image)throw Error("--image must be an immutable digest URI from container:artifact");let I=k.originSecretEnv||"TS_CLOUD_ORIGIN_SECRET",L=process.env[I];if(k.apply&&!L)throw Error(`${I} must contain a stable random CloudFront-to-ALB secret before apply`);let z=pl({region:k.region,profile:k.profile}),Y=k.originDomain&&k.apply?{...z,dns:_r(k.dnsProvider)}:z,Z=await hu({name:k.name||k.slug,slug:k.slug,imageUri:k.image,distributionId:t,expectedAlias:m,stackName:k.stack,pathPattern:k.path,originId:k.originId,originDomain:k.originDomain,certificateArn:k.certificateArn,originVerifySecret:L,desiredCount:Number(k.desiredCount)||1,database:k.database!==!1,cache:k.cache!==!1,queue:k.queue!==!1,region:k.region,profile:k.profile,skipHealthCheck:!!k.skipHealthCheck,apply:!!k.apply,confirm:k.confirm},Y);if(e(JSON.stringify(Z,null,2)),Z.applied)n("Full-stack backend is healthy and the CloudFront path patch was submitted.");else e(`Plan only. Apply with --confirm '${t}:${Z.distribution.pathPattern}:${Z.stack.name}'.`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}}),R.command("deploy:fullstack:cost","Estimate the always-on full-stack backend baseline").option("--desired-count <count>","Fargate task count",{default:"1"}).option("--multi-az-database","Estimate a two-instance database baseline").action((t)=>e(JSON.stringify(yu({desiredCount:Number(t.desiredCount)||1,multiAzDatabase:!!t.multiAzDatabase}),null,2)))}function Eg(R){return R.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function vu(R,t="/var/www"){let m=`${t}/${R}-`;return["set -u",`for TS_CLOUD_DIR in ${m}*; do`,'  [ -d "$TS_CLOUD_DIR" ] || continue','  [ -d "$TS_CLOUD_DIR/releases" ] || continue',`  TS_CLOUD_SITE="\${TS_CLOUD_DIR#${m}}"`,"  TS_CLOUD_ACTIVE=no",`  for TS_CLOUD_UNIT in $(ls /etc/systemd/system/ 2>/dev/null | grep -E "^${Eg(R)}-$TS_CLOUD_SITE[-@.]" || true); do`,'    systemctl is-active "$TS_CLOUD_UNIT" >/dev/null 2>&1 && TS_CLOUD_ACTIVE=yes',"  done",'  TS_CLOUD_SIZE="$(du -sh "$TS_CLOUD_DIR" 2>/dev/null | cut -f1)"','  echo "site:$TS_CLOUD_SITE:$TS_CLOUD_ACTIVE:${TS_CLOUD_SIZE:-?}"',"done","exit 0"]}function bu(R){if(!R)return[];let t=[];for(let m of R.split(`
 `)){let k=m.trim();if(!k.startsWith("site:"))continue;let[,I,L,z]=k.split(":");if(!I||L!=="no")continue;t.push({name:I,size:z||"?"})}return t}function wu(R,t,m){let k=R.map((L)=>`  ${t}-${L.name} (${L.size})`).join(`
 `),I=R.length===1?"it":"them";return`This server still holds ${R.length} site tree${R.length===1?"":"s"} with nothing running for ${I}:
 ${k}
 `+"A site moved off this box keeps its files here on purpose — they are the rollback, and they are what makes "+`the move reversible until this server is destroyed. Destroying it now discards that.
 Verify the site is serving from its new home first, then re-run with ${m} to destroy it anyway.`}var Tg="--discard-drained-sites";async function Ng(R,t,m,k){if(k)return!0;let I=t.project.slug,L;try{let Y=await R.findComputeTargets({slug:I,environment:m,role:"app",stackName:T(t,m)});if(Y.length===0)return!0;let Z=await R.runRemoteDeploy({targets:Y,commands:vu(I),comment:`ts-cloud scan drained sites ${I}`,tags:{Project:I,Environment:m,Role:"app"}});if(!Z.success)return a(`Could not check the server for moved-off site files: ${Z.error||"unknown error"}`),!0;L=Z.perInstance.map((X)=>X.output??"").join(`
-`)}catch(Y){return a(`Could not check the server for moved-off site files: ${Y instanceof Error?Y.message:String(Y)}`),!0}let z=bu(L);if(z.length===0)return!0;return r(wu(z,I,Tg)),!1}function gl(R){R.command("apply","Apply configured server resize, persistent volumes and deployment storage").option("--env <env>","Environment",{default:"production"}).option("--dry-run","Show the provider plan without changing anything").option("--yes","Apply the displayed compute plan without prompting").action(async(t)=>{try{let m=await Ne(),k=t?.env||"production",I=O({config:m});if(!I.applyComputeChanges)throw Error("This provider does not support configured compute changes");let L=await I.applyComputeChanges({config:m,environment:k,dryRun:!0});if(console.log(JSON.stringify(L,null,2)),t?.dryRun)return;if(!t?.yes&&!await d("Apply these compute changes?",!1))return;let z=await I.applyComputeChanges({config:m,environment:k});if(z.waitingForCapacity)a(z.waitingForCapacity);n("Configured compute changes applied")}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}}),R.command("destroy","Destroy the single-server compute (instance + firewall)").option("--env <env>","Environment",{default:"production"}).option("--force","Skip the confirmation prompt").option("--discard-drained-sites","Destroy even though a moved site left its rollback files here").action(async(t)=>{i("Destroy Compute");let m=await Ne(),k=t?.env||"production",I=U(m),L=O({config:m,provider:I});if(!L.destroyCompute){r(`The ${I} driver does not support compute teardown`);return}if(a(`This terminates the ${I} server for ${m.project.slug}/${k} and deletes its firewall.`),!await Ng(L,m,k,!!t?.discardDrainedSites)){process.exitCode=1;return}if(!t?.force){if(!await d("This is irreversible. Continue?",!1)){e("Cancelled");return}}let z=new s("Destroying compute...");z.start();try{let{destroyed:Y}=await L.destroyCompute({config:m,environment:k});if(z.succeed("Compute destroyed"),Y.length>0)Y.forEach((Z)=>e(`  removed ${Z}`));else e("Nothing to destroy (no matching resources found)")}catch(Y){z.fail("Teardown failed"),r(Y instanceof Error?Y.message:String(Y))}})}import{readFileSync as Og}from"node:fs";import{homedir as Lg}from"node:os";import Fg from"node:process";var Su=(R)=>R.replace(/^~(?=$|\/)/,Lg());function hl(R){R.command("boxes:apply [name]","Converge declared boxes: create, resize when asked, install packages and start services").option("--dry-run","Show what would change without touching any box").option("--yes","Apply without prompting").action(async(t,m)=>{try{let k=await Ne(),I=Object.entries(k.infrastructure?.boxes??{}),L=t?I.filter(([X,ie])=>X===t||ie.name===t):I;if(L.length===0)throw Error(t?`No box named ${t} in infrastructure.boxes`:"No boxes declared in infrastructure.boxes");let z=St(k);if(!z.apiToken)throw Error("Hetzner API token required: hetzner.apiToken, HCLOUD_TOKEN or HETZNER_API_TOKEN");let Y=new Oe({apiToken:z.apiToken}),Z={sshPublicKey:Og(Su(z.sshPublicKeyPath),"utf8").trim(),identityFile:Su(z.sshPrivateKeyPath),knownHostsFile:Ri()};for(let[X,ie]of L){let oe=await To({box:ie,client:Y,...Z,dryRun:!0});e(`${X} (${ie.name}):`);for(let ae of oe.report)e(`  ${ae}`)}if(m?.dryRun)return;if(!m?.yes&&!await d("Apply these box changes?",!1))return;for(let[X,ie]of L){let oe=await To({box:ie,client:Y,...Z,onPhase:(ae)=>e(`  ${X}: ${ae}`)});for(let ae of oe.report)e(`  ${X}: ${ae}`);n(`${X} converged (${oe.box.publicIp})`)}}catch(k){r(k instanceof Error?k.message:String(k)),Fg.exitCode=1}})}import{statSync as jg,writeFileSync as Bg}from"node:fs";function yl(R){R.command("stack:list","List all CloudFormation stacks").action(async()=>{i("CloudFormation Stacks");try{let m=(await Ne()).project.region||"us-east-1",k=new v(m),I=new s("Loading stacks...");I.start();let L=await k.listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS"]);if(I.succeed(`Found ${L.StackSummaries.length} stacks`),L.StackSummaries.length===0){e("No stacks found");return}let z=["Stack Name","Status","Created","Updated"],Y=L.StackSummaries.map((Z)=>[Z.StackName,Z.StackStatus,new Date(Z.CreationTime).toLocaleString(),Z.LastUpdatedTime?new Date(Z.LastUpdatedTime).toLocaleString():"Never"]);c(z,Y)}catch(t){r(`Failed to list stacks: ${t.message}`)}}),R.command("stack:describe STACK_NAME","Describe a CloudFormation stack").action(async(t)=>{i(`Stack: ${t}`);try{let k=(await Ne()).project.region||"us-east-1",I=new v(k),L=new s("Loading stack details...");L.start();let z=await I.describeStacks({stackName:t});if(!z.Stacks||z.Stacks.length===0){L.fail("Stack not found");return}let Y=z.Stacks[0];if(L.succeed("Stack details loaded"),e(`
+`)}catch(Y){return a(`Could not check the server for moved-off site files: ${Y instanceof Error?Y.message:String(Y)}`),!0}let z=bu(L);if(z.length===0)return!0;return r(wu(z,I,Tg)),!1}function gl(R){R.command("apply","Apply configured server resize, persistent volumes and deployment storage").option("--env <env>","Environment",{default:"production"}).option("--dry-run","Show the provider plan without changing anything").option("--yes","Apply the displayed compute plan without prompting").action(async(t)=>{try{let m=await De(),k=t?.env||"production",I=O({config:m});if(!I.applyComputeChanges)throw Error("This provider does not support configured compute changes");let L=await I.applyComputeChanges({config:m,environment:k,dryRun:!0});if(console.log(JSON.stringify(L,null,2)),t?.dryRun)return;if(!t?.yes&&!await d("Apply these compute changes?",!1))return;let z=await I.applyComputeChanges({config:m,environment:k});if(z.waitingForCapacity)a(z.waitingForCapacity);n("Configured compute changes applied")}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}}),R.command("destroy","Destroy the single-server compute (instance + firewall)").option("--env <env>","Environment",{default:"production"}).option("--force","Skip the confirmation prompt").option("--discard-drained-sites","Destroy even though a moved site left its rollback files here").action(async(t)=>{i("Destroy Compute");let m=await De(),k=t?.env||"production",I=U(m),L=O({config:m,provider:I});if(!L.destroyCompute){r(`The ${I} driver does not support compute teardown`);return}if(a(`This terminates the ${I} server for ${m.project.slug}/${k} and deletes its firewall.`),!await Ng(L,m,k,!!t?.discardDrainedSites)){process.exitCode=1;return}if(!t?.force){if(!await d("This is irreversible. Continue?",!1)){e("Cancelled");return}}let z=new s("Destroying compute...");z.start();try{let{destroyed:Y}=await L.destroyCompute({config:m,environment:k});if(z.succeed("Compute destroyed"),Y.length>0)Y.forEach((Z)=>e(`  removed ${Z}`));else e("Nothing to destroy (no matching resources found)")}catch(Y){z.fail("Teardown failed"),r(Y instanceof Error?Y.message:String(Y))}})}import{readFileSync as Og}from"node:fs";import{homedir as Lg}from"node:os";import Fg from"node:process";var Su=(R)=>R.replace(/^~(?=$|\/)/,Lg());function hl(R){R.command("boxes:apply [name]","Converge declared boxes: create, resize when asked, install packages and start services").option("--dry-run","Show what would change without touching any box").option("--yes","Apply without prompting").action(async(t,m)=>{try{let k=await De(),I=Object.entries(k.infrastructure?.boxes??{}),L=t?I.filter(([X,ee])=>X===t||ee.name===t):I;if(L.length===0)throw Error(t?`No box named ${t} in infrastructure.boxes`:"No boxes declared in infrastructure.boxes");let z=Ct(k);if(!z.apiToken)throw Error("Hetzner API token required: hetzner.apiToken, HCLOUD_TOKEN or HETZNER_API_TOKEN");let Y=new $e({apiToken:z.apiToken}),Z={sshPublicKey:Og(Su(z.sshPublicKeyPath),"utf8").trim(),identityFile:Su(z.sshPrivateKeyPath),knownHostsFile:Pi()};for(let[X,ee]of L){let oe=await Io({box:ee,client:Y,...Z,dryRun:!0});e(`${X} (${ee.name}):`);for(let se of oe.report)e(`  ${se}`)}if(m?.dryRun)return;if(!m?.yes&&!await d("Apply these box changes?",!1))return;for(let[X,ee]of L){let oe=await Io({box:ee,client:Y,...Z,onPhase:(se)=>e(`  ${X}: ${se}`)});for(let se of oe.report)e(`  ${X}: ${se}`);n(`${X} converged (${oe.box.publicIp})`)}}catch(k){r(k instanceof Error?k.message:String(k)),Fg.exitCode=1}})}import{statSync as jg,writeFileSync as Bg}from"node:fs";function yl(R){R.command("stack:list","List all CloudFormation stacks").action(async()=>{i("CloudFormation Stacks");try{let m=(await De()).project.region||"us-east-1",k=new v(m),I=new s("Loading stacks...");I.start();let L=await k.listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS"]);if(I.succeed(`Found ${L.StackSummaries.length} stacks`),L.StackSummaries.length===0){e("No stacks found");return}let z=["Stack Name","Status","Created","Updated"],Y=L.StackSummaries.map((Z)=>[Z.StackName,Z.StackStatus,new Date(Z.CreationTime).toLocaleString(),Z.LastUpdatedTime?new Date(Z.LastUpdatedTime).toLocaleString():"Never"]);c(z,Y)}catch(t){r(`Failed to list stacks: ${t.message}`)}}),R.command("stack:describe STACK_NAME","Describe a CloudFormation stack").action(async(t)=>{i(`Stack: ${t}`);try{let k=(await De()).project.region||"us-east-1",I=new v(k),L=new s("Loading stack details...");L.start();let z=await I.describeStacks({stackName:t});if(!z.Stacks||z.Stacks.length===0){L.fail("Stack not found");return}let Y=z.Stacks[0];if(L.succeed("Stack details loaded"),e(`
 Stack Information:`),e(`  - Name: ${Y.StackName}`),e(`  - Status: ${Y.StackStatus}`),e(`  - Created: ${new Date(Y.CreationTime).toLocaleString()}`),Y.LastUpdatedTime)e(`  - Updated: ${new Date(Y.LastUpdatedTime).toLocaleString()}`);if(Y.Parameters&&Y.Parameters.length>0){e(`
 Parameters:`);for(let X of Y.Parameters)e(`  - ${X.ParameterKey}: ${X.ParameterValue}`)}if(Y.Outputs&&Y.Outputs.length>0){e(`
 Outputs:`);for(let X of Y.Outputs)if(e(`  - ${X.OutputKey}: ${X.OutputValue}`),X.Description)e(`    ${X.Description}`)}if(Y.Tags&&Y.Tags.length>0){e(`
 Tags:`);for(let X of Y.Tags)e(`  - ${X.Key}: ${X.Value}`)}u(`
 Loading stack resources...`);let Z=await I.listStackResources(t);if(Z.StackResourceSummaries.length>0){e(`
-Resources (${Z.StackResourceSummaries.length}):`);let X=["Logical ID","Type","Status"],ie=Z.StackResourceSummaries.slice(0,10).map((oe)=>[oe.LogicalResourceId,oe.ResourceType,oe.ResourceStatus]);if(c(X,ie),Z.StackResourceSummaries.length>10)e(`
-... and ${Z.StackResourceSummaries.length-10} more resources`)}}catch(m){r(`Failed to describe stack: ${m.message}`)}}),R.command("stack:delete STACK_NAME","Delete a CloudFormation stack").option("--yes","Skip the confirmation prompt").action(async(t,m)=>{i(`Delete Stack: ${t}`);try{let I=(await Ne()).project.region||"us-east-1";if(a("This will permanently delete the stack and all its resources!"),!(m?.yes||await d(`
-Are you sure you want to delete this stack?`,!1))){e("Deletion cancelled");return}let z=new v(I),Y=new s("Deleting stack...");Y.start(),await z.deleteStack(t),Y.succeed("Stack deletion initiated"),u("Waiting for stack deletion..."),await z.waitForStack(t,"stack-delete-complete"),n("Stack deleted successfully!")}catch(k){r(`Failed to delete stack: ${k.message}`)}}),R.command("stack:events STACK_NAME","Show stack events").option("--limit <number>","Limit number of events",{default:"20"}).action(async(t,m)=>{i(`Stack Events: ${t}`);try{let I=(await Ne()).project.region||"us-east-1",L=new v(I),z=new s("Loading events...");z.start();let Y=await L.describeStackEvents(t);z.succeed(`Found ${Y.StackEvents.length} events`);let Z=m?.limit?Number.parseInt(m.limit):20,X=Y.StackEvents.slice(0,Z);if(X.length===0){e("No events found");return}let ie=["Time","Resource","Status","Reason"],oe=X.map((ae)=>[new Date(ae.Timestamp).toLocaleString(),ae.LogicalResourceId,ae.ResourceStatus,ae.ResourceStatusReason||""]);c(ie,oe)}catch(k){r(`Failed to load events: ${k.message}`)}}),R.command("stack:outputs STACK_NAME","Show stack outputs").action(async(t)=>{i(`Stack Outputs: ${t}`);try{let k=(await Ne()).project.region||"us-east-1",I=new v(k),L=new s("Loading stack outputs...");L.start();let z=await I.describeStacks({stackName:t});if(!z.Stacks||z.Stacks.length===0){L.fail("Stack not found");return}let Y=z.Stacks[0];if(L.succeed("Stack outputs loaded"),!Y.Outputs||Y.Outputs.length===0){e("No outputs found for this stack");return}let Z=["Key","Value","Description","Export Name"],X=Y.Outputs.map((ie)=>[ie.OutputKey||"",ie.OutputValue||"",ie.Description||"",ie.ExportName||""]);c(Z,X),e(`
-Copy-friendly format:`);for(let ie of Y.Outputs)e(`${ie.OutputKey}=${ie.OutputValue}`)}catch(m){r(`Failed to load outputs: ${m.message}`)}}),R.command("stack:export STACK_NAME","Export stack template").option("--output <file>","Output file path").option("--format <format>","Output format (json or yaml)",{default:"json"}).action(async(t,m)=>{i(`Export Stack: ${t}`);try{let I=(await Ne()).project.region||"us-east-1",L=new v(I),z=new s("Fetching stack template...");z.start();let Y=await L.getTemplate(t);if(!Y.TemplateBody){z.fail("Template not found");return}z.succeed("Template fetched");let Z=m?.format||"json",X=Y.TemplateBody;if(Z==="json"){let ie=JSON.parse(X);X=JSON.stringify(ie,null,2)}if(m?.output){let ie=m.output;Bg(ie,X,"utf-8"),n(`Template exported to: ${ie}`);let ae=(jg(ie).size/1024).toFixed(2);e(`File size: ${ae} KB`)}else e(`
-Template:`),console.log(X)}catch(k){r(`Failed to export template: ${k.message}`)}})}import{existsSync as _g}from"node:fs";function vl(R,t){R.command("upgrade","Upgrade CLI to latest version").action(async()=>{En("upgrade",{message:`Self-update is disabled for this ${t} build because no signed update-manifest source is configured.`,nextAction:"Install a verified release with your package manager or configure platform maintenance updates."})}),R.command("doctor","Check system requirements and AWS credentials").action(async()=>{if(i("System Diagnostics"),u("Checking Bun..."),n(`Bun ${process.versions.bun}`),u("Checking AWS CLI..."),await ia())n("AWS CLI is installed");else r("AWS CLI is not installed"),e("Install: https://aws.amazon.com/cli/");if(u("Checking AWS credentials..."),await oa()){n("AWS credentials are configured");let L=await sa();if(L)e(`Account ID: ${L}`)}else r("AWS credentials are not configured"),e("Run: aws configure");u("Checking CloudFront list access...");let I=!1;try{let{CloudFrontClient:L}=await import("./chunk-s9k81gq6.js");await new L().listDistributions(),n("CloudFront list access is enabled"),I=!0}catch(L){a(`CloudFront list check failed: ${L.message}`)}if(I){u("Checking CloudFront create access...");try{let L=new v("us-east-1"),z=JSON.stringify({AWSTemplateFormatVersion:"2010-09-09",Description:"Test CloudFront access",Resources:{TestOAC:{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:"test-oac-validation",OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}}}});await L.validateTemplate(z),n("CloudFront create access appears enabled")}catch(L){if(L.message?.includes("403")||L.message?.includes("AccessDenied")||L.message?.includes("must be verified"))r("CloudFront create access denied - account verification required"),e(""),e("Your AWS account needs to be verified for CloudFront."),e("This is required before you can create CloudFront distributions."),e(""),e("To verify your account:"),e("  1. Go to: https://console.aws.amazon.com/support/home#/"),e("  2. Create a support case"),e("  3. Select: Service limit increase > CloudFront"),e('  4. Request: "Please verify my account for CloudFront access"'),e(""),e("Verification usually takes 1-2 business days.");else n("CloudFront create access appears enabled (validation passed)")}}u("Checking S3 access...");try{let{S3Client:L}=await import("./chunk-1rrmswhq.js");await new L("us-east-1").listBuckets(),n("S3 access is enabled")}catch(L){a(`S3 check failed: ${L.message}`)}u("Checking ACM (SSL certificates) access...");try{await new K("us-east-1").listCertificates(),n("ACM access is enabled")}catch(L){a(`ACM check failed: ${L.message}`)}if(u("Checking configuration..."),_g("cloud.config.ts"))n("cloud.config.ts found");else a("cloud.config.ts not found"),e("Run: cloud init")}),R.command("regions","List available AWS regions").action(async()=>{i("AWS Regions");let m=new s("Fetching regions...");m.start();let k=await aa();m.stop(),k.forEach((I)=>{console.log(`  ${I}`)})}),R.command("version","Show the version of the CLI").alias("v").action(()=>{console.log(`ts-cloud v${t}`)})}function bl(R){R.command("analytics:sites:list","List all analytics sites").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t)=>{i("Analytics Sites");try{let m=new G(t.region),k=new s("Fetching sites...");k.start();let I=await m.scan({TableName:t.table,FilterExpression:"begins_with(pk, :pk)",ExpressionAttributeValues:{":pk":{S:"SITE#"}}});if(k.succeed(`Found ${I.Items?.length||0} site(s)`),!I.Items||I.Items.length===0){e("No analytics sites found"),e("Use `cloud analytics:sites:create` to create a new site");return}let L=I.Items.map((z)=>G.unmarshal(z));c(["ID","Name","Domains","Active","Created"],L.map((z)=>[z.siteId||"N/A",z.name||"Unnamed",(z.domains||[]).join(", ")||"-",z.isActive?"Yes":"No",z.createdAt?new Date(z.createdAt).toLocaleDateString():"N/A"]))}catch(m){r(`Failed to list sites: ${m.message}`),process.exit(1)}}),R.command("analytics:sites:create","Create a new analytics site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--name <name>","Site name").option("--domain <domain>","Site domain(s) (can be specified multiple times)").action(async(t)=>{i("Create Analytics Site");try{let m=new G(t.region),k=t.name||await P("Site name","My Site"),I=[];if(t.domain)I=Array.isArray(t.domain)?t.domain:[t.domain];else I=(await P("Site domains (comma-separated)","example.com")).split(",").map((ie)=>ie.trim()).filter(Boolean);if(e(`
+Resources (${Z.StackResourceSummaries.length}):`);let X=["Logical ID","Type","Status"],ee=Z.StackResourceSummaries.slice(0,10).map((oe)=>[oe.LogicalResourceId,oe.ResourceType,oe.ResourceStatus]);if(c(X,ee),Z.StackResourceSummaries.length>10)e(`
+... and ${Z.StackResourceSummaries.length-10} more resources`)}}catch(m){r(`Failed to describe stack: ${m.message}`)}}),R.command("stack:delete STACK_NAME","Delete a CloudFormation stack").option("--yes","Skip the confirmation prompt").action(async(t,m)=>{i(`Delete Stack: ${t}`);try{let I=(await De()).project.region||"us-east-1";if(a("This will permanently delete the stack and all its resources!"),!(m?.yes||await d(`
+Are you sure you want to delete this stack?`,!1))){e("Deletion cancelled");return}let z=new v(I),Y=new s("Deleting stack...");Y.start(),await z.deleteStack(t),Y.succeed("Stack deletion initiated"),u("Waiting for stack deletion..."),await z.waitForStack(t,"stack-delete-complete"),n("Stack deleted successfully!")}catch(k){r(`Failed to delete stack: ${k.message}`)}}),R.command("stack:events STACK_NAME","Show stack events").option("--limit <number>","Limit number of events",{default:"20"}).action(async(t,m)=>{i(`Stack Events: ${t}`);try{let I=(await De()).project.region||"us-east-1",L=new v(I),z=new s("Loading events...");z.start();let Y=await L.describeStackEvents(t);z.succeed(`Found ${Y.StackEvents.length} events`);let Z=m?.limit?Number.parseInt(m.limit):20,X=Y.StackEvents.slice(0,Z);if(X.length===0){e("No events found");return}let ee=["Time","Resource","Status","Reason"],oe=X.map((se)=>[new Date(se.Timestamp).toLocaleString(),se.LogicalResourceId,se.ResourceStatus,se.ResourceStatusReason||""]);c(ee,oe)}catch(k){r(`Failed to load events: ${k.message}`)}}),R.command("stack:outputs STACK_NAME","Show stack outputs").action(async(t)=>{i(`Stack Outputs: ${t}`);try{let k=(await De()).project.region||"us-east-1",I=new v(k),L=new s("Loading stack outputs...");L.start();let z=await I.describeStacks({stackName:t});if(!z.Stacks||z.Stacks.length===0){L.fail("Stack not found");return}let Y=z.Stacks[0];if(L.succeed("Stack outputs loaded"),!Y.Outputs||Y.Outputs.length===0){e("No outputs found for this stack");return}let Z=["Key","Value","Description","Export Name"],X=Y.Outputs.map((ee)=>[ee.OutputKey||"",ee.OutputValue||"",ee.Description||"",ee.ExportName||""]);c(Z,X),e(`
+Copy-friendly format:`);for(let ee of Y.Outputs)e(`${ee.OutputKey}=${ee.OutputValue}`)}catch(m){r(`Failed to load outputs: ${m.message}`)}}),R.command("stack:export STACK_NAME","Export stack template").option("--output <file>","Output file path").option("--format <format>","Output format (json or yaml)",{default:"json"}).action(async(t,m)=>{i(`Export Stack: ${t}`);try{let I=(await De()).project.region||"us-east-1",L=new v(I),z=new s("Fetching stack template...");z.start();let Y=await L.getTemplate(t);if(!Y.TemplateBody){z.fail("Template not found");return}z.succeed("Template fetched");let Z=m?.format||"json",X=Y.TemplateBody;if(Z==="json"){let ee=JSON.parse(X);X=JSON.stringify(ee,null,2)}if(m?.output){let ee=m.output;Bg(ee,X,"utf-8"),n(`Template exported to: ${ee}`);let se=(jg(ee).size/1024).toFixed(2);e(`File size: ${se} KB`)}else e(`
+Template:`),console.log(X)}catch(k){r(`Failed to export template: ${k.message}`)}})}import{existsSync as _g}from"node:fs";function vl(R,t){R.command("upgrade","Upgrade CLI to latest version").action(async()=>{xn("upgrade",{message:`Self-update is disabled for this ${t} build because no signed update-manifest source is configured.`,nextAction:"Install a verified release with your package manager or configure platform maintenance updates."})}),R.command("doctor","Check system requirements and AWS credentials").action(async()=>{if(i("System Diagnostics"),u("Checking Bun..."),n(`Bun ${process.versions.bun}`),u("Checking AWS CLI..."),await pa())n("AWS CLI is installed");else r("AWS CLI is not installed"),e("Install: https://aws.amazon.com/cli/");if(u("Checking AWS credentials..."),await ma()){n("AWS credentials are configured");let L=await ga();if(L)e(`Account ID: ${L}`)}else r("AWS credentials are not configured"),e("Run: aws configure");u("Checking CloudFront list access...");let I=!1;try{let{CloudFrontClient:L}=await import("./chunk-rhncmffy.js");await new L().listDistributions(),n("CloudFront list access is enabled"),I=!0}catch(L){a(`CloudFront list check failed: ${L.message}`)}if(I){u("Checking CloudFront create access...");try{let L=new v("us-east-1"),z=JSON.stringify({AWSTemplateFormatVersion:"2010-09-09",Description:"Test CloudFront access",Resources:{TestOAC:{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:"test-oac-validation",OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}}}});await L.validateTemplate(z),n("CloudFront create access appears enabled")}catch(L){if(L.message?.includes("403")||L.message?.includes("AccessDenied")||L.message?.includes("must be verified"))r("CloudFront create access denied - account verification required"),e(""),e("Your AWS account needs to be verified for CloudFront."),e("This is required before you can create CloudFront distributions."),e(""),e("To verify your account:"),e("  1. Go to: https://console.aws.amazon.com/support/home#/"),e("  2. Create a support case"),e("  3. Select: Service limit increase > CloudFront"),e('  4. Request: "Please verify my account for CloudFront access"'),e(""),e("Verification usually takes 1-2 business days.");else n("CloudFront create access appears enabled (validation passed)")}}u("Checking S3 access...");try{let{S3Client:L}=await import("./chunk-sxfdxk39.js");await new L("us-east-1").listBuckets(),n("S3 access is enabled")}catch(L){a(`S3 check failed: ${L.message}`)}u("Checking ACM (SSL certificates) access...");try{await new K("us-east-1").listCertificates(),n("ACM access is enabled")}catch(L){a(`ACM check failed: ${L.message}`)}if(u("Checking configuration..."),_g("cloud.config.ts"))n("cloud.config.ts found");else a("cloud.config.ts not found"),e("Run: cloud init")}),R.command("regions","List available AWS regions").action(async()=>{i("AWS Regions");let m=new s("Fetching regions...");m.start();let k=await fa();m.stop(),k.forEach((I)=>{console.log(`  ${I}`)})}),R.command("version","Show the version of the CLI").alias("v").action(()=>{console.log(`ts-cloud v${t}`)})}function bl(R){R.command("analytics:sites:list","List all analytics sites").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t)=>{i("Analytics Sites");try{let m=new G(t.region),k=new s("Fetching sites...");k.start();let I=await m.scan({TableName:t.table,FilterExpression:"begins_with(pk, :pk)",ExpressionAttributeValues:{":pk":{S:"SITE#"}}});if(k.succeed(`Found ${I.Items?.length||0} site(s)`),!I.Items||I.Items.length===0){e("No analytics sites found"),e("Use `cloud analytics:sites:create` to create a new site");return}let L=I.Items.map((z)=>G.unmarshal(z));c(["ID","Name","Domains","Active","Created"],L.map((z)=>[z.siteId||"N/A",z.name||"Unnamed",(z.domains||[]).join(", ")||"-",z.isActive?"Yes":"No",z.createdAt?new Date(z.createdAt).toLocaleDateString():"N/A"]))}catch(m){r(`Failed to list sites: ${m.message}`),process.exit(1)}}),R.command("analytics:sites:create","Create a new analytics site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--name <name>","Site name").option("--domain <domain>","Site domain(s) (can be specified multiple times)").action(async(t)=>{i("Create Analytics Site");try{let m=new G(t.region),k=t.name||await P("Site name","My Site"),I=[];if(t.domain)I=Array.isArray(t.domain)?t.domain:[t.domain];else I=(await P("Site domains (comma-separated)","example.com")).split(",").map((ee)=>ee.trim()).filter(Boolean);if(e(`
 Creating site: ${k}`),e(`Domains: ${I.join(", ")}`),!await d(`
 Create this site?`,!0)){e("Operation cancelled");return}let z=new s("Creating site...");z.start();let Y=`site_${Date.now()}_${Math.random().toString(36).substring(2,9)}`,Z=new Date().toISOString();await m.putItem({TableName:t.table,Item:{pk:{S:`SITE#${Y}`},sk:{S:`SITE#${Y}`},siteId:{S:Y},name:{S:k},domains:{L:I.map((X)=>({S:X}))},isActive:{BOOL:!0},createdAt:{S:Z},updatedAt:{S:Z}}}),z.succeed("Site created successfully"),n(`
 Site ID: ${Y}`),e(`
-Add the tracking script to your website:`),e(`  <script src="https://analytics.stacksjs.com/track.js" data-site-id="${Y}"></script>`)}catch(m){r(`Failed to create site: ${m.message}`),process.exit(1)}}),R.command("analytics:sites:update <siteId>","Update an analytics site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--name <name>","New site name").option("--domain <domain>","Set domains (replaces existing)").option("--active <boolean>","Set site active/inactive status").action(async(t,m)=>{i("Update Analytics Site");try{let k=new G(m.region),I=await k.getItem({TableName:m.table,Key:{pk:{S:`SITE#${t}`},sk:{S:`SITE#${t}`}}});if(!I.Item)r(`Site not found: ${t}`),process.exit(1);let L=G.unmarshal(I.Item);e(`Updating site: ${L.name||"Unnamed"} (${t})`),e("");let z=[],Y={},Z={};if(m.name)z.push("#n = :name"),Y["#n"]="name",Z[":name"]={S:m.name},e(`  Name: ${L.name} -> ${m.name}`);if(m.domain!==void 0){let X=Array.isArray(m.domain)?m.domain:[m.domain];z.push("domains = :domains"),Z[":domains"]={L:X.map((ie)=>({S:ie}))},e(`  Domains: ${JSON.stringify(L.domains||[])} -> ${JSON.stringify(X)}`)}if(m.active!==void 0){let X=m.active==="true"||m.active==="1";z.push("isActive = :active"),Z[":active"]={BOOL:X},e(`  Active: ${L.isActive} -> ${X}`)}if(z.length===0){a("No updates specified. Use --name, --domain, or --active options.");return}z.push("updatedAt = :updatedAt"),Z[":updatedAt"]={S:new Date().toISOString()},await k.updateItem({TableName:m.table,Key:{pk:{S:`SITE#${t}`},sk:{S:`SITE#${t}`}},UpdateExpression:`SET ${z.join(", ")}`,ExpressionAttributeNames:Object.keys(Y).length>0?Y:void 0,ExpressionAttributeValues:Z}),e(""),n("Site updated successfully")}catch(k){r(`Failed to update site: ${k.message}`),process.exit(1)}}),R.command("analytics:query <siteId>","Query analytics data for a site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--limit <n>","Max items to return",{default:"10"}).option("--type <type>","Filter by type (pageview, event, etc.)").action(async(t,m)=>{i(`Analytics Data: ${t}`);try{let k=new G(m.region),I=new s("Querying data...");I.start();let L=await k.query({TableName:m.table,KeyConditionExpression:"pk = :pk",ExpressionAttributeValues:{":pk":{S:`SITE#${t}`}},ScanIndexForward:!1,Limit:parseInt(m.limit,10)});if(I.succeed(`Found ${L.Items?.length||0} items`),!L.Items||L.Items.length===0){e("No data found for this site");return}let z=L.Items.map((Y)=>G.unmarshal(Y));for(let Y of z){if(e(""),e(`SK: ${Y.sk}`),Y.path)e(`  Path: ${Y.path}`);if(Y.timestamp)e(`  Time: ${Y.timestamp}`);if(Y.visitorId)e(`  Visitor: ${Y.visitorId}`);if(Y.browser)e(`  Browser: ${Y.browser}`);if(Y.country)e(`  Country: ${Y.country}`)}}catch(k){r(`Failed to query data: ${k.message}`),process.exit(1)}}),R.command("analytics:realtime <siteId>","Check realtime visitors for a site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--minutes <n>","Minutes to look back",{default:"5"}).action(async(t,m)=>{i(`Realtime: ${t}`);try{let k=new G(m.region),I=new s("Checking realtime...");I.start();let L=parseInt(m.minutes,10),z=new Date(Date.now()-L*60*1000),Y=await k.query({TableName:m.table,KeyConditionExpression:"pk = :pk AND sk BETWEEN :start AND :end",ExpressionAttributeValues:{":pk":{S:`SITE#${t}`},":start":{S:`PAGEVIEW#${z.toISOString()}`},":end":{S:"PAGEVIEW#Z"}},ScanIndexForward:!1});if(I.succeed(`Found ${Y.Items?.length||0} pageviews in last ${L} minutes`),!Y.Items||Y.Items.length===0){a("No recent pageviews found"),e(""),e("Possible issues:"),e("  1. Tracking script not installed correctly"),e("  2. Site ID mismatch"),e("  3. CORS or network issues");return}let Z=Y.Items.map((oe)=>G.unmarshal(oe)),X=new Set(Z.map((oe)=>oe.visitorId)).size;e(""),n(`${X} unique visitor(s) online`),e("");let ie={};for(let oe of Z){let ae=oe.path||"/";ie[ae]=(ie[ae]||0)+1}e("Active pages:");for(let[oe,ae]of Object.entries(ie).sort((be,Ae)=>Ae[1]-be[1]).slice(0,5))e(`  ${oe}: ${ae} view(s)`);e(""),e("Recent pageviews:");for(let oe of Z.slice(0,5))e(`  ${oe.timestamp} - ${oe.path} (${oe.browser||"Unknown"})`)}catch(k){r(`Failed to check realtime: ${k.message}`),process.exit(1)}})}import{chmodSync as Mg,mkdirSync as zg,readFileSync as Ug,writeFileSync as Wg}from"node:fs";import{dirname as Vg,resolve as $a}from"node:path";function Jt(R){return new Br(R?{path:$a(R)}:{})}function qg(R){let t=R.health();i("Control-plane diagnostics"),e(`Database: ${t.path}`),e(`Schema: ${t.schemaVersion}/${t.supportedSchemaVersion}`),e(`Integrity: ${t.integrity}`),e(`Journal: ${t.journalMode}`),e(`Size: ${t.databaseBytes.toLocaleString()} bytes`),e(`Last backup: ${t.lastBackupAt??"never"}`),e(`Operations: ${Object.entries(t.operations).map(([m,k])=>`${m}=${k}`).join(", ")}`),e(`Pending/retryable: ${t.pendingRetryableOperations}`)}function Ti(R,t){let m=R.getOrganization(t)??R.getOrganizationBySlug(t);if(!m)throw Error(`Organization '${t}' was not found.`);return m}function va(R,t){let m=R??"organization";if(m==="organization")return{type:"organization"};if(!["project","environment","resource"].includes(m)||!t)throw Error("Scoped access requires --scope project|environment|resource and --scope-id <id>.");return{type:m,id:t}}function Sa(R,t){let m=t.includes("@")?R.getIdentityByEmail(t):R.getIdentityByUsername(t);if(!m)throw Error(`Authentication identity '${t}' was not found.`);return m}function Ca(R,t){return new Me(R,{encryptionKey:_($a(t??process.cwd()))})}function Cu(R,t="TS_CLOUD_API_TOKEN"){let m=process.env[t]?.trim();if(!m)throw Error(`Set ${t} to a one-time-issued API token.`);return new to({baseUrl:R??process.env.TS_CLOUD_API_URL??"http://127.0.0.1:7676",token:m})}function wl(R){R.command("dashboard:serve","Run the local Forge-style cloud management UI").option("--host <host>","Host to bind",{default:"127.0.0.1"}).option("--port <port>","Port to bind",{default:"7676"}).option("--env <environment>","Environment to manage").option("--box","Box mode: run on the provisioned server (operate on localhost)").option("--open","Print the URL for opening in a browser").option("--verbose","Print server errors").action(async(t)=>{let m=await fr({host:t?.host,port:Number(t?.port??7676),environment:t?.env,box:t?.box,verbose:t?.verbose});i("ts-cloud Local Dashboard"),n(`Serving ${m.url}`),e("Use Ctrl+C to stop."),await new Promise((k)=>{let I=()=>{m.server.stop(!0),k()};process.once("SIGINT",I),process.once("SIGTERM",I)})}),R.command("control-plane:status","Inspect local control-plane storage health").option("--path <path>","Use a non-default control-plane database").action((t)=>{let m=Jt(t?.path);try{qg(m)}finally{m.close()}}),R.command("control-plane:backup","Create a consistent local control-plane backup").option("--path <path>","Use a non-default control-plane database").action((t)=>{let m=Jt(t?.path);try{let k=m.createBackup("cli");n(`Backup written to ${k}`)}finally{m.close()}}),R.command("control-plane:export <file>","Export portable control-plane metadata and history").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=$a(t),I=Jt(m?.path);try{zg(Vg(k),{recursive:!0}),Wg(k,`${JSON.stringify(I.exportSnapshot(),null,2)}
-`,{mode:384}),Mg(k,384),n(`Control-plane snapshot exported to ${k}`)}finally{I.close()}}),R.command("control-plane:import <file>","Import a portable control-plane snapshot").option("--path <path>","Use a non-default control-plane database").option("--replace","Replace existing control-plane records").action((t,m)=>{let k=$a(t),I=JSON.parse(Ug(k,"utf8")),L=Jt(m?.path);try{let z=m?.replace?L.createBackup("pre-import"):void 0;if(L.importSnapshot(I,{replace:m?.replace}),n(`Imported control-plane snapshot from ${k}`),z)e(`Previous state backed up to ${z}`)}finally{L.close()}}),R.command("control-plane:compact","Apply history retention and compact control-plane storage").option("--path <path>","Use a non-default control-plane database").option("--event-days <days>","Retain event history for this many days",{default:"90"}).option("--operation-days <days>","Retain terminal operations for this many days",{default:"365"}).option("--no-vacuum","Delete expired records without reclaiming file space").action((t)=>{let m=Jt(t?.path);try{let k=m.compact({eventRetentionDays:Number(t?.eventDays??90),operationRetentionDays:Number(t?.operationDays??365),vacuum:t?.vacuum!==!1});if(n(`Removed ${k.deletedEvents} event(s) and ${k.deletedOperations} terminal operation(s).`),k.vacuumed)e("Database file compacted.")}finally{m.close()}}),R.command("organization:list","List organizations in the local control plane").option("--path <path>","Use a non-default control-plane database").action((t)=>{let m=Jt(t?.path);try{i("Organizations");for(let k of m.listOrganizations())e(`${k.slug}  ${k.name}  ${k.id}`)}finally{m.close()}}),R.command("organization:members <organization>","List memberships and scoped grants").option("--path <path>","Use a non-default control-plane database").option("--all","Include revoked memberships").action((t,m)=>{let k=Jt(m?.path);try{let I=Ti(k,t);i(`${I.name} members`);for(let L of k.listMemberships(I.id,{includeRevoked:m?.all})){let z=k.getActor(L.actorId);e(`${z?.displayName??L.actorId}  ${L.roleTemplate}  ${L.scope.type}:${L.scope.id??I.slug}  ${L.status}  ${L.id}`);for(let Y of k.listGrants(L.id))e(`  ${Y.effect} ${Y.capability} @ ${Y.scope.type}:${Y.scope.id??I.slug}`)}}finally{k.close()}}),R.command("organization:invite <organization> <email>","Create a hashed, expiring organization invitation").option("--path <path>","Use a non-default control-plane database").option("--role <role>","owner|admin|deployer|operator|viewer|auditor",{default:"viewer"}).option("--scope <scope>","organization|project|environment|resource",{default:"organization"}).option("--scope-id <id>","Project, environment, or resource ID").option("--days <days>","Invitation lifetime in days",{default:"7"}).option("--base-url <url>","Dashboard URL used to print the acceptance link",{default:"http://127.0.0.1:7676"}).action((t,m,k)=>{let I=Jt(k?.path);try{let L=Ti(I,t);if(!["owner","admin","deployer","operator","viewer","auditor"].includes(k?.role??"viewer"))throw Error("Unknown role template.");let z=I.createInvitation({organizationId:L.id,email:m,roleTemplate:k?.role??"viewer",scope:va(k?.scope,k?.scopeId),expiresInMs:Number(k?.days??7)*86400000});n(`Invitation created for ${z.invitation.email}; expires ${z.invitation.expiresAt}`),e(`${String(k?.baseUrl??"http://127.0.0.1:7676").replace(/\/$/,"")}/accept-invitation?token=${encodeURIComponent(z.token)}`),e("This token is shown once. Resending revokes it and creates a new token.")}finally{I.close()}}),R.command("organization:invitations <organization>","List invitation states without exposing tokens").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=Jt(m?.path);try{let I=Ti(k,t);i(`${I.name} invitations`);for(let L of k.listInvitations(I.id))e(`${L.email}  ${L.roleTemplate}  ${L.scope.type}:${L.scope.id??I.slug}  ${L.state}  ${L.id}`)}finally{k.close()}}),R.command("organization:revoke-invitation <id>","Revoke a pending organization invitation").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=Jt(m?.path);try{let I=k.revokeInvitation(t);n(`Invitation ${I.id} is ${I.state}.`)}finally{k.close()}}),R.command("organization:grant <organization> <membership> <capability>","Add an explicit scoped allow or deny").option("--path <path>","Use a non-default control-plane database").option("--effect <effect>","allow|deny",{default:"allow"}).option("--scope <scope>","organization|project|environment|resource",{default:"organization"}).option("--scope-id <id>","Project, environment, or resource ID").action((t,m,k,I)=>{let L=Jt(I?.path);try{let z=Ti(L,t);if(!le.includes(k))throw Error(`Unknown capability '${k}'.`);if(I?.effect!==void 0&&!["allow","deny"].includes(I.effect))throw Error("Effect must be allow or deny.");let Y=L.upsertGrant({organizationId:z.id,membershipId:m,effect:I?.effect??"allow",capability:k,scope:va(I?.scope,I?.scopeId)});n(`${Y.effect} ${Y.capability} added at ${Y.scope.type}:${Y.scope.id??z.slug}.`)}finally{L.close()}}),R.command("organization:revoke-member <membership>","Revoke a membership and invalidate its sessions").option("--path <path>","Use a non-default control-plane database").option("--confirm <id>","Type the membership ID to confirm").action((t,m)=>{if(m?.confirm!==t)throw Error(`Pass --confirm ${t} to revoke this membership.`);let k=Jt(m?.path);try{let I=k.revokeMembership(t);n(`Membership ${I.id} revoked; session version is now ${I.sessionVersion}.`)}finally{k.close()}}),R.command("auth:identities","List local authentication identities without credential material").option("--path <path>","Use a non-default control-plane database").action((t)=>{let m=Jt(t?.path);try{let k=new Me(m);i("Authentication identities");for(let I of k.listIdentities())e(`${I.username}  ${I.email??"no-email"}  ${I.disabledAt?"disabled":"active"}  ${I.id}`)}finally{m.close()}}),R.command("auth:reset-link <identity>","Create a one-time password reset link for offline recovery").option("--path <path>","Use a non-default control-plane database").option("--base-url <url>","Dashboard URL used to print the reset link",{default:"http://127.0.0.1:7676"}).action((t,m)=>{let k=Jt(m?.path);try{let I=new Me(k),L=Sa(I,t);I.revokeActionTokens(L.id,"password_reset");let z=I.createActionToken(L.id,"password_reset");n(`Created a one-time reset link for ${L.username}; it expires ${z.actionToken.expiresAt}.`),e(`${String(m?.baseUrl??"http://127.0.0.1:7676").replace(/\/$/,"")}/reset-password?token=${encodeURIComponent(z.token)}`)}finally{k.close()}}),R.command("auth:sessions <identity>","List active and expired sessions for an identity").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=Jt(m?.path);try{let I=new Me(k),L=Sa(I,t);i(`${L.username} sessions`);for(let z of I.listSessions(L.id,{includeInactive:!0}))e(`${z.state}  ${z.authMethod}  ${z.userAgent??"unknown-device"}  ${z.lastUsedAt}  ${z.id}`)}finally{k.close()}}),R.command("auth:revoke-sessions <identity>","Revoke every dashboard session for an identity").option("--path <path>","Use a non-default control-plane database").option("--confirm <identity>","Type the username or email to confirm").action((t,m)=>{if(m?.confirm!==t)throw Error(`Pass --confirm ${t} to revoke these sessions.`);let k=Jt(m?.path);try{let I=new Me(k),L=Sa(I,t),z=I.listSessions(L.id);for(let Y of z)I.revokeSession(L.id,Y.id);n(`Revoked ${z.length} session(s) for ${L.username}.`)}finally{k.close()}}),R.command("auth:disable-mfa <identity>","Disable MFA through the offline administrative recovery path").option("--path <path>","Use a non-default control-plane database").option("--confirm <identity>","Type the username or email to confirm").action((t,m)=>{if(m?.confirm!==t)throw Error(`Pass --confirm ${t} to disable MFA.`);let k=Jt(m?.path);try{let I=new Me(k),L=Sa(I,t);I.disableMfa(L.id);for(let z of I.listSessions(L.id))I.revokeSession(L.id,z.id);n(`Disabled MFA and revoked active sessions for ${L.username}.`)}finally{k.close()}}),R.command("auth:oidc:list <organization>","List OIDC providers without credential material").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=Jt(m?.path);try{let I=Ti(k,t),L=Ca(k);i(`${I.name} OIDC providers`);let z=L.listOidcProviders(I.id,{includeDisabled:!0});if(z.length===0)e("No providers configured.");for(let Y of z)e(`${Y.enabled?"enabled":"disabled"}  ${Y.slug}  ${Y.issuer}  role=${Y.defaultRole}  enforce=${Y.enforceSso}`)}finally{k.close()}}),R.command("auth:oidc:configure <organization> <slug>","Create or update an encrypted OIDC provider configuration").option("--path <path>","Use a non-default control-plane database").option("--auth-root <path>","Directory containing .ts-cloud/auth-encryption-key").option("--name <name>","Provider label shown on the sign-in page").option("--issuer <url>","Exact OIDC issuer URL").option("--client-id <id>","OIDC client ID").option("--secret-env <name>","Environment variable containing the client secret",{default:"TS_CLOUD_OIDC_CLIENT_SECRET"}).option("--domains <domains>","Comma-separated verified email domains").option("--scopes <scopes>","Comma-separated scopes (openid is always included)",{default:"email,profile"}).option("--default-role <role>","Role for provisioned users: admin, deployer, operator, viewer, or auditor",{default:"viewer"}).option("--enforce-sso","Require SSO for matching non-owner local accounts").option("--disabled","Save the provider disabled").action((t,m,k)=>{let I=Jt(k?.path);try{let L=Ti(I,t),z=Ca(I,k?.authRoot),Y=z.getOidcProviderBySlug(m),Z=k?.secretEnv??"TS_CLOUD_OIDC_CLIENT_SECRET",X=process.env[Z]?.trim();if(!Y&&!X)throw Error(`Set ${Z} to the client secret before creating this provider.`);let ie=(k?.domains??Y?.allowedDomains.join(",")??"").split(",").map((be)=>be.trim()).filter(Boolean),oe=k?.defaultRole??Y?.defaultRole??"viewer";if(!["admin","deployer","operator","viewer","auditor"].includes(oe))throw Error("Default role must be admin, deployer, operator, viewer, or auditor.");let ae=z.upsertOidcProvider({id:Y?.id,organizationId:L.id,slug:m,name:k?.name??Y?.name??m,issuer:k?.issuer??Y?.issuer??"",clientId:k?.clientId??Y?.clientId??"",clientSecret:X,allowedDomains:ie,scopes:(k?.scopes??Y?.scopes.join(",")??"email,profile").split(",").map((be)=>be.trim()).filter(Boolean),defaultRole:oe,enforceSso:k?.enforceSso??Y?.enforceSso??!1,enabled:k?.disabled?!1:Y?.enabled??!0});if(n(`${ae.name} saved as ${ae.enabled?"enabled":"disabled"} with encrypted credentials.`),e(`Callback path: /auth/oidc/${ae.slug}/callback`),ae.enforceSso)e(`Offline recovery: cloud auth:oidc:disable ${ae.slug} --confirm ${ae.slug}`)}finally{I.close()}}),R.command("auth:oidc:test <slug>","Validate OIDC discovery for a configured provider").option("--path <path>","Use a non-default control-plane database").option("--auth-root <path>","Directory containing .ts-cloud/auth-encryption-key").action(async(t,m)=>{let k=Jt(m?.path);try{let L=Ca(k,m?.authRoot).getOidcProviderBySlug(t);if(!L)throw Error(`OIDC provider '${t}' was not found.`);let z=await $n(L);n(`${L.name} discovery is valid and issuer-bound.`),e(`Authorization: ${z.authorization_endpoint}`),e(`Token: ${z.token_endpoint}`),e(`JWKS: ${z.jwks_uri}`)}finally{k.close()}}),R.command("auth:oidc:disable <slug>","Disable an OIDC provider through the offline recovery path").option("--path <path>","Use a non-default control-plane database").option("--auth-root <path>","Directory containing .ts-cloud/auth-encryption-key").option("--confirm <slug>","Type the provider slug to confirm").action((t,m)=>{if(m?.confirm!==t)throw Error(`Pass --confirm ${t} to disable this provider.`);let k=Jt(m?.path);try{let I=Ca(k,m?.authRoot),L=I.getOidcProviderBySlug(t);if(!L)throw Error(`OIDC provider '${t}' was not found.`);I.setOidcProviderEnabled(L.id,!1),n(`Disabled ${L.name}, cancelled pending sign-ins, and removed SSO enforcement.`)}finally{k.close()}}),R.command("api:service-accounts <organization>","List service accounts and safe token metadata").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=Jt(m?.path);try{let I=Ti(k,t),L=new We(k);i(`${I.name} service accounts`);for(let z of L.listServiceAccounts(I.id,{includeDisabled:!0})){e(`${z.state}  ${z.slug}  ${z.name}  ${z.id}`);for(let Y of L.listTokens(z.id,{includeInactive:!0}))e(`  ${Y.state}  ${Y.prefix}  ${Y.name}  expires=${Y.expiresAt}  last-used=${Y.lastUsedAt??"never"}`)}}finally{k.close()}}),R.command("api:service-account:create <organization> <slug>","Create a scoped service account").option("--path <path>","Use a non-default control-plane database").option("--name <name>","Display name").option("--role <role>","admin, deployer, operator, viewer, or auditor",{default:"deployer"}).option("--scope <scope>","organization, project, environment, or resource",{default:"organization"}).option("--scope-id <id>","Required for non-organization scope").action((t,m,k)=>{let I=Jt(k?.path);try{let L=Ti(I,t),z=k?.role??"deployer";if(!["admin","deployer","operator","viewer","auditor"].includes(z))throw Error("Service-account role cannot be owner and must be a supported role.");let Z=new We(I).createServiceAccount({organizationId:L.id,slug:m,name:k?.name??m,roleTemplate:z,scope:va(k?.scope,k?.scopeId)});n(`Created ${Z.serviceAccount.name} (${Z.serviceAccount.id}) with ${Z.membership.roleTemplate} access.`)}finally{I.close()}}),R.command("api:token:create <organization> <account>","Create and reveal a scoped API token exactly once").option("--path <path>","Use a non-default control-plane database").option("--name <name>","Token label",{default:"CLI token"}).option("--capabilities <list>","Comma-separated capabilities").option("--scope <scope>","organization, project, environment, or resource",{default:"organization"}).option("--scope-id <id>","Required for non-organization scope").option("--expires-days <days>","Expiry in days, maximum 365",{default:"90"}).action((t,m,k)=>{let I=Jt(k?.path);try{let L=Ti(I,t),z=new We(I),Y=z.getServiceAccount(m)??z.getServiceAccountBySlug(L.id,m);if(!Y||Y.organizationId!==L.id)throw Error(`Service account '${m}' was not found.`);let Z=(k?.capabilities??"").split(",").map((oe)=>oe.trim()).filter((oe)=>le.includes(oe));if(!Z.length)throw Error(`Pass --capabilities with one or more of: ${le.join(", ")}`);let X=Math.min(365,Math.max(1,Number(k?.expiresDays??90))),ie=z.createToken({serviceAccountId:Y.id,name:k?.name??"CLI token",capabilities:Z,scope:va(k?.scope,k?.scopeId),expiresAt:new Date(Date.now()+X*24*60*60*1000).toISOString()});n(`Created ${ie.token.prefix}; copy this secret now. It will not be shown again.`),e(ie.secret)}finally{I.close()}}),R.command("api:token:rotate <token>","Create an overlapping replacement for an API token").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=Jt(m?.path);try{let I=new We(k).rotateToken(t);n(`Created overlapping replacement ${I.token.prefix}; revoke the old token after rollout.`),e(I.secret)}finally{k.close()}}),R.command("api:token:revoke <token>","Immediately revoke an API token").option("--path <path>","Use a non-default control-plane database").option("--confirm <token>","Type the token ID to confirm").action((t,m)=>{if(m?.confirm!==t)throw Error(`Pass --confirm ${t} to revoke this token.`);let k=Jt(m?.path);try{let I=new We(k).revokeToken(t);n(`Revoked ${I.prefix}; bearer requests stop immediately.`)}finally{k.close()}}),R.command("api:projects","List projects through the public v1 API").option("--base-url <url>","Dashboard base URL").option("--token-env <name>","Environment variable containing the API token",{default:"TS_CLOUD_API_TOKEN"}).action(async(t)=>{let m=await Cu(t?.baseUrl,t?.tokenEnv).listProjects();for(let k of m.data)e(`${k.slug}  ${k.name}  ${k.id}`)}),R.command("api:deploy <project> <environment>","Queue a deployment through the public v1 API").option("--base-url <url>","Dashboard base URL").option("--token-env <name>","Environment variable containing the API token",{default:"TS_CLOUD_API_TOKEN"}).option("--service <id>","Optional service resource ID").option("--revision <revision>","Revision or release identifier").option("--idempotency-key <key>","Stable retry key").action(async(t,m,k)=>{let I=k?.idempotencyKey??`cli-${Date.now()}-${crypto.randomUUID().slice(0,8)}`,L=await Cu(k?.baseUrl,k?.tokenEnv).createDeployment({projectId:t,environmentId:m,serviceId:k?.service,revision:k?.revision},I);n(`${L.idempotentReplay?"Replayed":"Queued"} operation ${L.operation.id} (${L.operation.state}).`)})}import{createHash as Hg}from"node:crypto";var Gg=`let coldStart = true
+Add the tracking script to your website:`),e(`  <script src="https://analytics.stacksjs.com/track.js" data-site-id="${Y}"></script>`)}catch(m){r(`Failed to create site: ${m.message}`),process.exit(1)}}),R.command("analytics:sites:update <siteId>","Update an analytics site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--name <name>","New site name").option("--domain <domain>","Set domains (replaces existing)").option("--active <boolean>","Set site active/inactive status").action(async(t,m)=>{i("Update Analytics Site");try{let k=new G(m.region),I=await k.getItem({TableName:m.table,Key:{pk:{S:`SITE#${t}`},sk:{S:`SITE#${t}`}}});if(!I.Item)r(`Site not found: ${t}`),process.exit(1);let L=G.unmarshal(I.Item);e(`Updating site: ${L.name||"Unnamed"} (${t})`),e("");let z=[],Y={},Z={};if(m.name)z.push("#n = :name"),Y["#n"]="name",Z[":name"]={S:m.name},e(`  Name: ${L.name} -> ${m.name}`);if(m.domain!==void 0){let X=Array.isArray(m.domain)?m.domain:[m.domain];z.push("domains = :domains"),Z[":domains"]={L:X.map((ee)=>({S:ee}))},e(`  Domains: ${JSON.stringify(L.domains||[])} -> ${JSON.stringify(X)}`)}if(m.active!==void 0){let X=m.active==="true"||m.active==="1";z.push("isActive = :active"),Z[":active"]={BOOL:X},e(`  Active: ${L.isActive} -> ${X}`)}if(z.length===0){a("No updates specified. Use --name, --domain, or --active options.");return}z.push("updatedAt = :updatedAt"),Z[":updatedAt"]={S:new Date().toISOString()},await k.updateItem({TableName:m.table,Key:{pk:{S:`SITE#${t}`},sk:{S:`SITE#${t}`}},UpdateExpression:`SET ${z.join(", ")}`,ExpressionAttributeNames:Object.keys(Y).length>0?Y:void 0,ExpressionAttributeValues:Z}),e(""),n("Site updated successfully")}catch(k){r(`Failed to update site: ${k.message}`),process.exit(1)}}),R.command("analytics:query <siteId>","Query analytics data for a site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--limit <n>","Max items to return",{default:"10"}).option("--type <type>","Filter by type (pageview, event, etc.)").action(async(t,m)=>{i(`Analytics Data: ${t}`);try{let k=new G(m.region),I=new s("Querying data...");I.start();let L=await k.query({TableName:m.table,KeyConditionExpression:"pk = :pk",ExpressionAttributeValues:{":pk":{S:`SITE#${t}`}},ScanIndexForward:!1,Limit:parseInt(m.limit,10)});if(I.succeed(`Found ${L.Items?.length||0} items`),!L.Items||L.Items.length===0){e("No data found for this site");return}let z=L.Items.map((Y)=>G.unmarshal(Y));for(let Y of z){if(e(""),e(`SK: ${Y.sk}`),Y.path)e(`  Path: ${Y.path}`);if(Y.timestamp)e(`  Time: ${Y.timestamp}`);if(Y.visitorId)e(`  Visitor: ${Y.visitorId}`);if(Y.browser)e(`  Browser: ${Y.browser}`);if(Y.country)e(`  Country: ${Y.country}`)}}catch(k){r(`Failed to query data: ${k.message}`),process.exit(1)}}),R.command("analytics:realtime <siteId>","Check realtime visitors for a site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--minutes <n>","Minutes to look back",{default:"5"}).action(async(t,m)=>{i(`Realtime: ${t}`);try{let k=new G(m.region),I=new s("Checking realtime...");I.start();let L=parseInt(m.minutes,10),z=new Date(Date.now()-L*60*1000),Y=await k.query({TableName:m.table,KeyConditionExpression:"pk = :pk AND sk BETWEEN :start AND :end",ExpressionAttributeValues:{":pk":{S:`SITE#${t}`},":start":{S:`PAGEVIEW#${z.toISOString()}`},":end":{S:"PAGEVIEW#Z"}},ScanIndexForward:!1});if(I.succeed(`Found ${Y.Items?.length||0} pageviews in last ${L} minutes`),!Y.Items||Y.Items.length===0){a("No recent pageviews found"),e(""),e("Possible issues:"),e("  1. Tracking script not installed correctly"),e("  2. Site ID mismatch"),e("  3. CORS or network issues");return}let Z=Y.Items.map((oe)=>G.unmarshal(oe)),X=new Set(Z.map((oe)=>oe.visitorId)).size;e(""),n(`${X} unique visitor(s) online`),e("");let ee={};for(let oe of Z){let se=oe.path||"/";ee[se]=(ee[se]||0)+1}e("Active pages:");for(let[oe,se]of Object.entries(ee).sort((ue,ke)=>ke[1]-ue[1]).slice(0,5))e(`  ${oe}: ${se} view(s)`);e(""),e("Recent pageviews:");for(let oe of Z.slice(0,5))e(`  ${oe.timestamp} - ${oe.path} (${oe.browser||"Unknown"})`)}catch(k){r(`Failed to check realtime: ${k.message}`),process.exit(1)}})}import{chmodSync as Mg,mkdirSync as zg,readFileSync as Ug,writeFileSync as Wg}from"node:fs";import{dirname as Vg,resolve as va}from"node:path";function Gt(R){return new Fr(R?{path:va(R)}:{})}function qg(R){let t=R.health();i("Control-plane diagnostics"),e(`Database: ${t.path}`),e(`Schema: ${t.schemaVersion}/${t.supportedSchemaVersion}`),e(`Integrity: ${t.integrity}`),e(`Journal: ${t.journalMode}`),e(`Size: ${t.databaseBytes.toLocaleString()} bytes`),e(`Last backup: ${t.lastBackupAt??"never"}`),e(`Operations: ${Object.entries(t.operations).map(([m,k])=>`${m}=${k}`).join(", ")}`),e(`Pending/retryable: ${t.pendingRetryableOperations}`)}function Di(R,t){let m=R.getOrganization(t)??R.getOrganizationBySlug(t);if(!m)throw Error(`Organization '${t}' was not found.`);return m}function da(R,t){let m=R??"organization";if(m==="organization")return{type:"organization"};if(!["project","environment","resource"].includes(m)||!t)throw Error("Scoped access requires --scope project|environment|resource and --scope-id <id>.");return{type:m,id:t}}function ua(R,t){let m=t.includes("@")?R.getIdentityByEmail(t):R.getIdentityByUsername(t);if(!m)throw Error(`Authentication identity '${t}' was not found.`);return m}function ha(R,t){return new Ue(R,{encryptionKey:_(va(t??process.cwd()))})}function Cu(R,t="TS_CLOUD_API_TOKEN"){let m=process.env[t]?.trim();if(!m)throw Error(`Set ${t} to a one-time-issued API token.`);return new so({baseUrl:R??process.env.TS_CLOUD_API_URL??"http://127.0.0.1:7676",token:m})}function wl(R){R.command("dashboard:serve","Run the local Forge-style cloud management UI").option("--host <host>","Host to bind",{default:"127.0.0.1"}).option("--port <port>","Port to bind",{default:"7676"}).option("--env <environment>","Environment to manage").option("--box","Box mode: run on the provisioned server (operate on localhost)").option("--open","Print the URL for opening in a browser").option("--verbose","Print server errors").action(async(t)=>{let m=await hr({host:t?.host,port:Number(t?.port??7676),environment:t?.env,box:t?.box,verbose:t?.verbose});i("ts-cloud Local Dashboard"),n(`Serving ${m.url}`),e("Use Ctrl+C to stop."),await new Promise((k)=>{let I=()=>{m.server.stop(!0),k()};process.once("SIGINT",I),process.once("SIGTERM",I)})}),R.command("control-plane:status","Inspect local control-plane storage health").option("--path <path>","Use a non-default control-plane database").action((t)=>{let m=Gt(t?.path);try{qg(m)}finally{m.close()}}),R.command("control-plane:backup","Create a consistent local control-plane backup").option("--path <path>","Use a non-default control-plane database").action((t)=>{let m=Gt(t?.path);try{let k=m.createBackup("cli");n(`Backup written to ${k}`)}finally{m.close()}}),R.command("control-plane:export <file>","Export portable control-plane metadata and history").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=va(t),I=Gt(m?.path);try{zg(Vg(k),{recursive:!0}),Wg(k,`${JSON.stringify(I.exportSnapshot(),null,2)}
+`,{mode:384}),Mg(k,384),n(`Control-plane snapshot exported to ${k}`)}finally{I.close()}}),R.command("control-plane:import <file>","Import a portable control-plane snapshot").option("--path <path>","Use a non-default control-plane database").option("--replace","Replace existing control-plane records").action((t,m)=>{let k=va(t),I=JSON.parse(Ug(k,"utf8")),L=Gt(m?.path);try{let z=m?.replace?L.createBackup("pre-import"):void 0;if(L.importSnapshot(I,{replace:m?.replace}),n(`Imported control-plane snapshot from ${k}`),z)e(`Previous state backed up to ${z}`)}finally{L.close()}}),R.command("control-plane:compact","Apply history retention and compact control-plane storage").option("--path <path>","Use a non-default control-plane database").option("--event-days <days>","Retain event history for this many days",{default:"90"}).option("--operation-days <days>","Retain terminal operations for this many days",{default:"365"}).option("--no-vacuum","Delete expired records without reclaiming file space").action((t)=>{let m=Gt(t?.path);try{let k=m.compact({eventRetentionDays:Number(t?.eventDays??90),operationRetentionDays:Number(t?.operationDays??365),vacuum:t?.vacuum!==!1});if(n(`Removed ${k.deletedEvents} event(s) and ${k.deletedOperations} terminal operation(s).`),k.vacuumed)e("Database file compacted.")}finally{m.close()}}),R.command("organization:list","List organizations in the local control plane").option("--path <path>","Use a non-default control-plane database").action((t)=>{let m=Gt(t?.path);try{i("Organizations");for(let k of m.listOrganizations())e(`${k.slug}  ${k.name}  ${k.id}`)}finally{m.close()}}),R.command("organization:members <organization>","List memberships and scoped grants").option("--path <path>","Use a non-default control-plane database").option("--all","Include revoked memberships").action((t,m)=>{let k=Gt(m?.path);try{let I=Di(k,t);i(`${I.name} members`);for(let L of k.listMemberships(I.id,{includeRevoked:m?.all})){let z=k.getActor(L.actorId);e(`${z?.displayName??L.actorId}  ${L.roleTemplate}  ${L.scope.type}:${L.scope.id??I.slug}  ${L.status}  ${L.id}`);for(let Y of k.listGrants(L.id))e(`  ${Y.effect} ${Y.capability} @ ${Y.scope.type}:${Y.scope.id??I.slug}`)}}finally{k.close()}}),R.command("organization:invite <organization> <email>","Create a hashed, expiring organization invitation").option("--path <path>","Use a non-default control-plane database").option("--role <role>","owner|admin|deployer|operator|viewer|auditor",{default:"viewer"}).option("--scope <scope>","organization|project|environment|resource",{default:"organization"}).option("--scope-id <id>","Project, environment, or resource ID").option("--days <days>","Invitation lifetime in days",{default:"7"}).option("--base-url <url>","Dashboard URL used to print the acceptance link",{default:"http://127.0.0.1:7676"}).action((t,m,k)=>{let I=Gt(k?.path);try{let L=Di(I,t);if(!["owner","admin","deployer","operator","viewer","auditor"].includes(k?.role??"viewer"))throw Error("Unknown role template.");let z=I.createInvitation({organizationId:L.id,email:m,roleTemplate:k?.role??"viewer",scope:da(k?.scope,k?.scopeId),expiresInMs:Number(k?.days??7)*86400000});n(`Invitation created for ${z.invitation.email}; expires ${z.invitation.expiresAt}`),e(`${String(k?.baseUrl??"http://127.0.0.1:7676").replace(/\/$/,"")}/accept-invitation?token=${encodeURIComponent(z.token)}`),e("This token is shown once. Resending revokes it and creates a new token.")}finally{I.close()}}),R.command("organization:invitations <organization>","List invitation states without exposing tokens").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=Gt(m?.path);try{let I=Di(k,t);i(`${I.name} invitations`);for(let L of k.listInvitations(I.id))e(`${L.email}  ${L.roleTemplate}  ${L.scope.type}:${L.scope.id??I.slug}  ${L.state}  ${L.id}`)}finally{k.close()}}),R.command("organization:revoke-invitation <id>","Revoke a pending organization invitation").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=Gt(m?.path);try{let I=k.revokeInvitation(t);n(`Invitation ${I.id} is ${I.state}.`)}finally{k.close()}}),R.command("organization:grant <organization> <membership> <capability>","Add an explicit scoped allow or deny").option("--path <path>","Use a non-default control-plane database").option("--effect <effect>","allow|deny",{default:"allow"}).option("--scope <scope>","organization|project|environment|resource",{default:"organization"}).option("--scope-id <id>","Project, environment, or resource ID").action((t,m,k,I)=>{let L=Gt(I?.path);try{let z=Di(L,t);if(!de.includes(k))throw Error(`Unknown capability '${k}'.`);if(I?.effect!==void 0&&!["allow","deny"].includes(I.effect))throw Error("Effect must be allow or deny.");let Y=L.upsertGrant({organizationId:z.id,membershipId:m,effect:I?.effect??"allow",capability:k,scope:da(I?.scope,I?.scopeId)});n(`${Y.effect} ${Y.capability} added at ${Y.scope.type}:${Y.scope.id??z.slug}.`)}finally{L.close()}}),R.command("organization:revoke-member <membership>","Revoke a membership and invalidate its sessions").option("--path <path>","Use a non-default control-plane database").option("--confirm <id>","Type the membership ID to confirm").action((t,m)=>{if(m?.confirm!==t)throw Error(`Pass --confirm ${t} to revoke this membership.`);let k=Gt(m?.path);try{let I=k.revokeMembership(t);n(`Membership ${I.id} revoked; session version is now ${I.sessionVersion}.`)}finally{k.close()}}),R.command("auth:identities","List local authentication identities without credential material").option("--path <path>","Use a non-default control-plane database").action((t)=>{let m=Gt(t?.path);try{let k=new Ue(m);i("Authentication identities");for(let I of k.listIdentities())e(`${I.username}  ${I.email??"no-email"}  ${I.disabledAt?"disabled":"active"}  ${I.id}`)}finally{m.close()}}),R.command("auth:reset-link <identity>","Create a one-time password reset link for offline recovery").option("--path <path>","Use a non-default control-plane database").option("--base-url <url>","Dashboard URL used to print the reset link",{default:"http://127.0.0.1:7676"}).action((t,m)=>{let k=Gt(m?.path);try{let I=new Ue(k),L=ua(I,t);I.revokeActionTokens(L.id,"password_reset");let z=I.createActionToken(L.id,"password_reset");n(`Created a one-time reset link for ${L.username}; it expires ${z.actionToken.expiresAt}.`),e(`${String(m?.baseUrl??"http://127.0.0.1:7676").replace(/\/$/,"")}/reset-password?token=${encodeURIComponent(z.token)}`)}finally{k.close()}}),R.command("auth:sessions <identity>","List active and expired sessions for an identity").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=Gt(m?.path);try{let I=new Ue(k),L=ua(I,t);i(`${L.username} sessions`);for(let z of I.listSessions(L.id,{includeInactive:!0}))e(`${z.state}  ${z.authMethod}  ${z.userAgent??"unknown-device"}  ${z.lastUsedAt}  ${z.id}`)}finally{k.close()}}),R.command("auth:revoke-sessions <identity>","Revoke every dashboard session for an identity").option("--path <path>","Use a non-default control-plane database").option("--confirm <identity>","Type the username or email to confirm").action((t,m)=>{if(m?.confirm!==t)throw Error(`Pass --confirm ${t} to revoke these sessions.`);let k=Gt(m?.path);try{let I=new Ue(k),L=ua(I,t),z=I.listSessions(L.id);for(let Y of z)I.revokeSession(L.id,Y.id);n(`Revoked ${z.length} session(s) for ${L.username}.`)}finally{k.close()}}),R.command("auth:disable-mfa <identity>","Disable MFA through the offline administrative recovery path").option("--path <path>","Use a non-default control-plane database").option("--confirm <identity>","Type the username or email to confirm").action((t,m)=>{if(m?.confirm!==t)throw Error(`Pass --confirm ${t} to disable MFA.`);let k=Gt(m?.path);try{let I=new Ue(k),L=ua(I,t);I.disableMfa(L.id);for(let z of I.listSessions(L.id))I.revokeSession(L.id,z.id);n(`Disabled MFA and revoked active sessions for ${L.username}.`)}finally{k.close()}}),R.command("auth:oidc:list <organization>","List OIDC providers without credential material").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=Gt(m?.path);try{let I=Di(k,t),L=ha(k);i(`${I.name} OIDC providers`);let z=L.listOidcProviders(I.id,{includeDisabled:!0});if(z.length===0)e("No providers configured.");for(let Y of z)e(`${Y.enabled?"enabled":"disabled"}  ${Y.slug}  ${Y.issuer}  role=${Y.defaultRole}  enforce=${Y.enforceSso}`)}finally{k.close()}}),R.command("auth:oidc:configure <organization> <slug>","Create or update an encrypted OIDC provider configuration").option("--path <path>","Use a non-default control-plane database").option("--auth-root <path>","Directory containing .ts-cloud/auth-encryption-key").option("--name <name>","Provider label shown on the sign-in page").option("--issuer <url>","Exact OIDC issuer URL").option("--client-id <id>","OIDC client ID").option("--secret-env <name>","Environment variable containing the client secret",{default:"TS_CLOUD_OIDC_CLIENT_SECRET"}).option("--domains <domains>","Comma-separated verified email domains").option("--scopes <scopes>","Comma-separated scopes (openid is always included)",{default:"email,profile"}).option("--default-role <role>","Role for provisioned users: admin, deployer, operator, viewer, or auditor",{default:"viewer"}).option("--enforce-sso","Require SSO for matching non-owner local accounts").option("--disabled","Save the provider disabled").action((t,m,k)=>{let I=Gt(k?.path);try{let L=Di(I,t),z=ha(I,k?.authRoot),Y=z.getOidcProviderBySlug(m),Z=k?.secretEnv??"TS_CLOUD_OIDC_CLIENT_SECRET",X=process.env[Z]?.trim();if(!Y&&!X)throw Error(`Set ${Z} to the client secret before creating this provider.`);let ee=(k?.domains??Y?.allowedDomains.join(",")??"").split(",").map((ue)=>ue.trim()).filter(Boolean),oe=k?.defaultRole??Y?.defaultRole??"viewer";if(!["admin","deployer","operator","viewer","auditor"].includes(oe))throw Error("Default role must be admin, deployer, operator, viewer, or auditor.");let se=z.upsertOidcProvider({id:Y?.id,organizationId:L.id,slug:m,name:k?.name??Y?.name??m,issuer:k?.issuer??Y?.issuer??"",clientId:k?.clientId??Y?.clientId??"",clientSecret:X,allowedDomains:ee,scopes:(k?.scopes??Y?.scopes.join(",")??"email,profile").split(",").map((ue)=>ue.trim()).filter(Boolean),defaultRole:oe,enforceSso:k?.enforceSso??Y?.enforceSso??!1,enabled:k?.disabled?!1:Y?.enabled??!0});if(n(`${se.name} saved as ${se.enabled?"enabled":"disabled"} with encrypted credentials.`),e(`Callback path: /auth/oidc/${se.slug}/callback`),se.enforceSso)e(`Offline recovery: cloud auth:oidc:disable ${se.slug} --confirm ${se.slug}`)}finally{I.close()}}),R.command("auth:oidc:test <slug>","Validate OIDC discovery for a configured provider").option("--path <path>","Use a non-default control-plane database").option("--auth-root <path>","Directory containing .ts-cloud/auth-encryption-key").action(async(t,m)=>{let k=Gt(m?.path);try{let L=ha(k,m?.authRoot).getOidcProviderBySlug(t);if(!L)throw Error(`OIDC provider '${t}' was not found.`);let z=await Mn(L);n(`${L.name} discovery is valid and issuer-bound.`),e(`Authorization: ${z.authorization_endpoint}`),e(`Token: ${z.token_endpoint}`),e(`JWKS: ${z.jwks_uri}`)}finally{k.close()}}),R.command("auth:oidc:disable <slug>","Disable an OIDC provider through the offline recovery path").option("--path <path>","Use a non-default control-plane database").option("--auth-root <path>","Directory containing .ts-cloud/auth-encryption-key").option("--confirm <slug>","Type the provider slug to confirm").action((t,m)=>{if(m?.confirm!==t)throw Error(`Pass --confirm ${t} to disable this provider.`);let k=Gt(m?.path);try{let I=ha(k,m?.authRoot),L=I.getOidcProviderBySlug(t);if(!L)throw Error(`OIDC provider '${t}' was not found.`);I.setOidcProviderEnabled(L.id,!1),n(`Disabled ${L.name}, cancelled pending sign-ins, and removed SSO enforcement.`)}finally{k.close()}}),R.command("api:service-accounts <organization>","List service accounts and safe token metadata").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=Gt(m?.path);try{let I=Di(k,t),L=new Je(k);i(`${I.name} service accounts`);for(let z of L.listServiceAccounts(I.id,{includeDisabled:!0})){e(`${z.state}  ${z.slug}  ${z.name}  ${z.id}`);for(let Y of L.listTokens(z.id,{includeInactive:!0}))e(`  ${Y.state}  ${Y.prefix}  ${Y.name}  expires=${Y.expiresAt}  last-used=${Y.lastUsedAt??"never"}`)}}finally{k.close()}}),R.command("api:service-account:create <organization> <slug>","Create a scoped service account").option("--path <path>","Use a non-default control-plane database").option("--name <name>","Display name").option("--role <role>","admin, deployer, operator, viewer, or auditor",{default:"deployer"}).option("--scope <scope>","organization, project, environment, or resource",{default:"organization"}).option("--scope-id <id>","Required for non-organization scope").action((t,m,k)=>{let I=Gt(k?.path);try{let L=Di(I,t),z=k?.role??"deployer";if(!["admin","deployer","operator","viewer","auditor"].includes(z))throw Error("Service-account role cannot be owner and must be a supported role.");let Z=new Je(I).createServiceAccount({organizationId:L.id,slug:m,name:k?.name??m,roleTemplate:z,scope:da(k?.scope,k?.scopeId)});n(`Created ${Z.serviceAccount.name} (${Z.serviceAccount.id}) with ${Z.membership.roleTemplate} access.`)}finally{I.close()}}),R.command("api:token:create <organization> <account>","Create and reveal a scoped API token exactly once").option("--path <path>","Use a non-default control-plane database").option("--name <name>","Token label",{default:"CLI token"}).option("--capabilities <list>","Comma-separated capabilities").option("--scope <scope>","organization, project, environment, or resource",{default:"organization"}).option("--scope-id <id>","Required for non-organization scope").option("--expires-days <days>","Expiry in days, maximum 365",{default:"90"}).action((t,m,k)=>{let I=Gt(k?.path);try{let L=Di(I,t),z=new Je(I),Y=z.getServiceAccount(m)??z.getServiceAccountBySlug(L.id,m);if(!Y||Y.organizationId!==L.id)throw Error(`Service account '${m}' was not found.`);let Z=(k?.capabilities??"").split(",").map((oe)=>oe.trim()).filter((oe)=>de.includes(oe));if(!Z.length)throw Error(`Pass --capabilities with one or more of: ${de.join(", ")}`);let X=Math.min(365,Math.max(1,Number(k?.expiresDays??90))),ee=z.createToken({serviceAccountId:Y.id,name:k?.name??"CLI token",capabilities:Z,scope:da(k?.scope,k?.scopeId),expiresAt:new Date(Date.now()+X*24*60*60*1000).toISOString()});n(`Created ${ee.token.prefix}; copy this secret now. It will not be shown again.`),e(ee.secret)}finally{I.close()}}),R.command("api:token:rotate <token>","Create an overlapping replacement for an API token").option("--path <path>","Use a non-default control-plane database").action((t,m)=>{let k=Gt(m?.path);try{let I=new Je(k).rotateToken(t);n(`Created overlapping replacement ${I.token.prefix}; revoke the old token after rollout.`),e(I.secret)}finally{k.close()}}),R.command("api:token:revoke <token>","Immediately revoke an API token").option("--path <path>","Use a non-default control-plane database").option("--confirm <token>","Type the token ID to confirm").action((t,m)=>{if(m?.confirm!==t)throw Error(`Pass --confirm ${t} to revoke this token.`);let k=Gt(m?.path);try{let I=new Je(k).revokeToken(t);n(`Revoked ${I.prefix}; bearer requests stop immediately.`)}finally{k.close()}}),R.command("api:projects","List projects through the public v1 API").option("--base-url <url>","Dashboard base URL").option("--token-env <name>","Environment variable containing the API token",{default:"TS_CLOUD_API_TOKEN"}).action(async(t)=>{let m=await Cu(t?.baseUrl,t?.tokenEnv).listProjects();for(let k of m.data)e(`${k.slug}  ${k.name}  ${k.id}`)}),R.command("api:deploy <project> <environment>","Queue a deployment through the public v1 API").option("--base-url <url>","Dashboard base URL").option("--token-env <name>","Environment variable containing the API token",{default:"TS_CLOUD_API_TOKEN"}).option("--service <id>","Optional service resource ID").option("--revision <revision>","Revision or release identifier").option("--idempotency-key <key>","Stable retry key").action(async(t,m,k)=>{let I=k?.idempotencyKey??`cli-${Date.now()}-${crypto.randomUUID().slice(0,8)}`,L=await Cu(k?.baseUrl,k?.tokenEnv).createDeployment({projectId:t,environmentId:m,serviceId:k?.service,revision:k?.revision},I);n(`${L.idempotentReplay?"Replayed":"Queued"} operation ${L.operation.id} (${L.operation.state}).`)})}import{createHash as Hg}from"node:crypto";var Gg=`let coldStart = true
 const initializedAt = new Date().toISOString()
 export const handler = async (event) => {
   const currentColdStart = coldStart
@@ -475,7 +475,7 @@ export const handler = async (event) => {
     body: JSON.stringify({ ok: statusCode === 200, service: 'ts-cloud-static-api', path, coldStart: currentColdStart, initializedAt })
   }
 }
-`;function Au(R){let t=R;return String(t?.code||t?.name||t?.statusCode||"")}function Kg(R){return["NoSuchEntity","ResourceNotFoundException","404"].includes(Au(R))}function $u(R){return["EntityAlreadyExists","ResourceAlreadyExistsException","ResourceConflictException","409"].includes(Au(R))}function ku(R,t){let m=R?.Items;if(!m)return[];if(Array.isArray(m))return m;let k=m[t];if(k===void 0)return[];return Array.isArray(k)?k:[k]}function Sl(R){let t=R?.Aliases?.Items,m=t?.CNAME??t;if(Array.isArray(m))return m.map(String);if(typeof m==="string")return[m];return[]}function Jg(R){if(!/^[A-Z0-9]{8,32}$/.test(R.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(R.expectedAlias))throw Error("Expected CloudFront alias is invalid");if(!/^[A-Za-z0-9-_]{1,64}$/.test(R.functionName))throw Error("Lambda function name is invalid");let t=R.pathPattern?.startsWith("/")?R.pathPattern:`/${R.pathPattern||"api/*"}`;if(t==="/"||t==="/*"||!t.endsWith("*"))throw Error("API path must be a non-default wildcard pattern such as /api/*");let m=R.originId||`${R.functionName}-url`,k=R.roleName||`${R.functionName}-execution`;if(!/^[A-Za-z0-9_.-]{1,64}$/.test(k))throw Error("IAM role name is invalid");let I=R.memorySize??256,L=R.timeout??10,z=R.logRetentionDays??14;if(I<128||I>10240)throw Error("Lambda memory must be between 128 and 10240 MB");if(L<1||L>900)throw Error("Lambda timeout must be between 1 and 900 seconds");return{region:R.region||"us-east-1",pathPattern:t,originId:m,roleName:k,memorySize:I,timeout:L,logRetentionDays:z}}function Yg(R){let t=R.region||"us-east-1";return{cloudfront:new E(R.profile),iam:new ne(t,R.profile),lambda:new D(t,R.profile),logs:new ce(t,R.profile),sts:new bt(t,R.profile),sleep:(m)=>new Promise((k)=>setTimeout(k,m))}}async function Ru(R,t){let m=Jg(R),k=t||Yg({profile:R.profile,region:m.region}),[I,L,z]=await Promise.all([k.sts.getCallerIdentity(),k.cloudfront.getDistribution(R.distributionId),k.cloudfront.getDistributionConfig(R.distributionId)]);if(!I.Account)throw Error("AWS identity did not return an account ID");if(!L.Enabled)throw Error(`CloudFront distribution ${R.distributionId} is disabled`);if(!(Sl(L).length?Sl(L):Sl(z.DistributionConfig)).includes(R.expectedAlias))throw Error(`Distribution ${R.distributionId} does not contain expected alias ${R.expectedAlias}`);let Z,X=!0;try{Z=await k.iam.getRole({RoleName:m.roleName})}catch(Tt){if(!Kg(Tt))throw Tt;X=!1}let ie=Z?.Arn||`arn:aws:iam::${I.Account}:role/${m.roleName}`,oe=await k.lambda.functionExists(R.functionName),ae=oe?await k.lambda.getFunctionUrl(R.functionName):null,be=await k.cloudfront.listOriginAccessControls(),Ae=`${R.functionName}-lambda-url`,de=be.some((Tt)=>Tt.Name===Ae&&Tt.OriginAccessControlOriginType==="lambda"),ke=ku(z.DistributionConfig.Origins,"Origin"),De=ku(z.DistributionConfig.CacheBehaviors,"CacheBehavior"),Se=ke.some((Tt)=>String(Tt.Id)===m.originId),Re=De.some((Tt)=>String(Tt.PathPattern)===m.pathPattern),Pe=[...!X?[`create IAM execution role ${m.roleName}`]:[`reconcile IAM execution policy ${m.roleName}`],...oe?[`update Lambda ${R.functionName} code and configuration`]:[`create Lambda ${R.functionName}`],...!ae?["create private AWS_IAM function URL"]:[],...!de?[`create Lambda origin access control ${Ae}`]:[],"grant CloudFront function-URL and invocation permissions",`${Re?"reconcile":"add"} ${m.pathPattern} behavior without changing the default behavior`],ze={command:`cloud cdn:origin:remove ${R.distributionId} FUNCTION_URL_HOST --id ${m.originId} --path '${m.pathPattern}' --apply --confirm 'remove:${R.distributionId}:${m.pathPattern}'`,removeFunction:!oe,removeRole:!X},Le={mode:R.apply?"apply":"plan",accountId:I.Account,identityArn:I.Arn,distribution:{id:L.Id,arn:L.ARN,alias:R.expectedAlias,domainName:L.DomainName,status:L.Status},function:{name:R.functionName,existed:oe,runtime:"nodejs22.x",urlExisted:!!ae,url:ae?.FunctionUrl},role:{name:m.roleName,existed:X,arn:ie},origin:{id:m.originId,pathPattern:m.pathPattern,existed:Se,behaviorExisted:Re,accessControlExisted:de},changes:Pe,rollback:ze,applied:!1};if(!R.apply)return Le;let Be=`${R.distributionId}:${m.pathPattern}`;if(R.confirm!==Be)throw Error(`Pass exact confirmation token ${Be} to mutate the live distribution`);if(!Z)Z=await k.iam.createRole({RoleName:m.roleName,Description:`Execution role for ${R.functionName}`,AssumeRolePolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]}),Tags:[{Key:"ManagedBy",Value:"ts-cloud"}]});await k.iam.putRolePolicy({RoleName:m.roleName,PolicyName:"lambda-logs",PolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:${m.region}:${I.Account}:log-group:/aws/lambda/${R.functionName}:*`}]})});try{await k.logs.createLogGroup(`/aws/lambda/${R.functionName}`,{ManagedBy:"ts-cloud"})}catch(Tt){if(!$u(Tt))throw Tt}await k.logs.putRetentionPolicy(`/aws/lambda/${R.functionName}`,m.logRetentionDays);let Ve=R.code||Gg;if(oe)await k.lambda.updateFunctionCodeInline(R.functionName,Ve,"index.mjs"),await k.lambda.waitForFunctionActive(R.functionName),await k.lambda.updateFunctionConfiguration({FunctionName:R.functionName,Runtime:"nodejs22.x",Role:Z.Arn,Handler:"index.handler",Description:`Private API origin for ${R.expectedAlias}`,Timeout:m.timeout,MemorySize:m.memorySize});else{let Tt;for(let Ge=0;Ge<8;Ge++)try{await k.lambda.createFunctionWithCode({FunctionName:R.functionName,Runtime:"nodejs22.x",Role:Z.Arn,Handler:"index.handler",Code:Ve,Filename:"index.mjs",Description:`Private API origin for ${R.expectedAlias}`,Timeout:m.timeout,MemorySize:m.memorySize}),Tt=void 0;break}catch(Ot){if(Tt=Ot,!String(Ot.message).toLowerCase().includes("role"))throw Ot;await k.sleep(1000)}if(Tt)throw Tt}await k.lambda.waitForFunctionActive(R.functionName);let ct=ae||await k.lambda.createFunctionUrl({FunctionName:R.functionName,AuthType:"AWS_IAM",InvokeMode:"BUFFERED"});if(!ct.FunctionUrl)throw Error("Lambda did not return a function URL");let Dt=new URL(ct.FunctionUrl).hostname,nt=await k.cloudfront.findOrCreateOriginAccessControl(Ae,"lambda"),xt=L.ARN||`arn:aws:cloudfront::${I.Account}:distribution/${R.distributionId}`,Qt=[{FunctionName:R.functionName,StatementId:"AllowCloudFrontFunctionUrl",Action:"lambda:InvokeFunctionUrl",Principal:"cloudfront.amazonaws.com",SourceArn:xt,FunctionUrlAuthType:"AWS_IAM"},{FunctionName:R.functionName,StatementId:"AllowCloudFrontInvoke",Action:"lambda:InvokeFunction",Principal:"cloudfront.amazonaws.com",SourceArn:xt,InvokedViaFunctionUrl:!0}];for(let Tt of Qt)try{await k.lambda.addPermission(Tt)}catch(Ge){if(!$u(Ge))throw Ge}return await k.cloudfront.upsertExistingDistributionOrigin(R.distributionId,{id:m.originId,domainName:Dt,pathPattern:m.pathPattern,originAccessControlId:nt.Id}),{...Le,function:{...Le.function,url:ct.FunctionUrl},applied:!0}}async function Iu(R){let t=`https://${R.alias}/`,m=`https://${R.alias}/api/health`,k=await fetch(t,{redirect:"follow",headers:{"cache-control":"no-cache"}}),I=new Uint8Array(await k.arrayBuffer()),L=Hg("sha256").update(I).digest("hex"),z=Date.now(),Y=await fetch(m,{redirect:"follow",headers:{"cache-control":"no-cache"}}),Z=Date.now()-z,X=await Y.text(),ie=X;try{ie=JSON.parse(X)}catch{}let oe;if(R.logs&&R.functionName){let ae=await R.logs.filterLogEvents({logGroupName:`/aws/lambda/${R.functionName}`,startTime:z-60000,filterPattern:'"Init Duration"',limit:25});for(let be of ae.events||[]){let Ae=be.message?.match(/Init Duration:\s*([0-9.]+)\s*ms/i);if(Ae)oe=Number(Ae[1])}}return{frontend:{url:t,status:k.status,sha256:L,unchanged:R.expectedFrontendSha256?L===R.expectedFrontendSha256:void 0,bytes:I.byteLength},api:{url:m,status:Y.status,latencyMs:Z,healthy:Y.ok&&!!ie?.ok,body:ie},coldStart:{observed:oe!==void 0,initDurationMs:oe},verifiedAt:(R.now?.()||new Date).toISOString()}}function Pu(R){let t=(R.memoryMb||256)/1024,m=Math.max(0,R.requests-(R.includeFreeTier===!1?0:1e6)),k=Math.max(0,R.requests*(R.averageDurationMs/1000)*t-(R.includeFreeTier===!1?0:400000)),I=m/1e6*0.2+k*0.0000166667,L=9.010025,z=16.425;return{lambdaUsd:Number(I.toFixed(2)),alwaysOnFargateAndAlbUsd:Number(25.435025000000003 .toFixed(2)),assumptions:["us-east-1 public list rates snapshot, July 2026","Lambda x86 request and duration pricing with optional monthly free tier","Fargate comparison uses one always-on 0.25 vCPU/0.5 GB task plus one ALB before LCU charges","excludes CloudFront, data transfer, logs, taxes, and application data services"]}}function Cl(R){R.command("cdn:api:deploy <distributionId> <alias>","Plan or deploy a private Lambda API behind an existing static distribution").option("--function <name>","Lambda function name",{default:"ts-cloud-static-api"}).option("--path <pattern>","CloudFront API path",{default:"/api/*"}).option("--origin-id <id>","Stable CloudFront origin ID").option("--role <name>","Lambda execution role name").option("--region <region>","Lambda region",{default:"us-east-1"}).option("--profile <name>","AWS credential profile").option("--memory <mb>","Lambda memory in MB",{default:"256"}).option("--timeout <seconds>","Lambda timeout",{default:"10"}).option("--retention <days>","CloudWatch log retention",{default:"14"}).option("--apply","Create resources and patch the live distribution").option("--confirm <text>","Exact distribution:path confirmation").action(async(t,m,k)=>{try{let I=await Ru({distributionId:t,expectedAlias:m,functionName:k.function||"ts-cloud-static-api",pathPattern:k.path,originId:k.originId,roleName:k.role,region:k.region,profile:k.profile,memorySize:Number(k.memory),timeout:Number(k.timeout),logRetentionDays:Number(k.retention),apply:!!k.apply,confirm:k.confirm});if(e(JSON.stringify(I,null,2)),I.applied)n("Private API origin submitted to CloudFront. Run cdn:api:verify after propagation.");else e(`Plan only. Re-run with --apply --confirm '${t}:${I.origin.pathPattern}'.`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}}),R.command("cdn:api:verify <alias>","Verify static frontend integrity, API health, latency, and Lambda initialization").option("--function <name>","Lambda function name",{default:"ts-cloud-static-api"}).option("--frontend-sha256 <digest>","Expected SHA-256 of the frontend response").option("--region <region>","Lambda region",{default:"us-east-1"}).option("--profile <name>","AWS credential profile").action(async(t,m)=>{try{let k=new ce(m.region||"us-east-1",m.profile),I=await Iu({alias:t,expectedFrontendSha256:m.frontendSha256,logs:k,functionName:m.function||"ts-cloud-static-api"});if(e(JSON.stringify(I,null,2)),!I.api.healthy||I.frontend.unchanged===!1)throw Error("Static API verification failed");n("Static frontend and Lambda API verification passed.")}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}}),R.command("cdn:api:cost <requests>","Compare a low-volume Lambda API with one always-on Fargate task and ALB").option("--duration <milliseconds>","Average Lambda duration",{default:"100"}).option("--memory <mb>","Lambda memory in MB",{default:"256"}).option("--no-free-tier","Exclude the Lambda free tier").action((t,m)=>{let k=Pu({requests:Number(t),averageDurationMs:Number(m.duration),memoryMb:Number(m.memory),includeFreeTier:m.freeTier!==!1});e(JSON.stringify(k,null,2))}),R.command("cdn:origin:add <distributionId> <domain>","Safely add a backend origin and path to an existing distribution").option("--id <origin>","Stable origin ID",{default:"api-backend"}).option("--path <pattern>","Path behavior",{default:"/api/*"}).option("--profile <name>","AWS credential profile").option("--replace","Replace a reviewed path/origin collision").option("--apply","Apply the ETag-protected patch").option("--confirm <text>","Exact distribution:path confirmation").action(async(t,m,k)=>{try{let I=new E(k.profile),L={id:k.id??"api-backend",domainName:m,pathPattern:k.path??"/api/*",replaceExisting:!!k.replace},z=await I.upsertExistingDistributionOrigin(t,{...L,dryRun:!0});if(e(JSON.stringify(z,null,2)),!k.apply){e("Dry run only. Re-run with --apply and the exact --confirm token.");return}let Y=`${t}:${z.pathPattern}`;if(k.confirm!==Y)throw Error(`Pass --confirm "${Y}" to apply this live distribution change`);let Z=await I.upsertExistingDistributionOrigin(t,L);n(Z.changed?"Backend origin patch submitted.":"Backend origin already matches."),e(JSON.stringify(Z,null,2))}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}}),R.command("cdn:origin:remove <distributionId> <domain>","Remove one exact backend behavior and its unreferenced origin").option("--id <origin>","Origin ID",{default:"api-backend"}).option("--path <pattern>","Path behavior",{default:"/api/*"}).option("--profile <name>","AWS credential profile").option("--apply","Apply the ETag-protected rollback").option("--confirm <text>","Exact remove:distribution:path confirmation").action(async(t,m,k)=>{try{let I=new E(k.profile),L={id:k.id??"api-backend",domainName:m,pathPattern:k.path??"/api/*"},z=await I.removeExistingDistributionOrigin(t,{...L,dryRun:!0});if(e(JSON.stringify(z,null,2)),!k.apply){e("Dry run only. Re-run with --apply and the exact --confirm token.");return}let Y=`remove:${t}:${z.pathPattern}`;if(k.confirm!==Y)throw Error(`Pass --confirm "${Y}" to apply this live distribution rollback`);let Z=await I.removeExistingDistributionOrigin(t,L);n(Z.changed?"Backend behavior rollback submitted.":"Backend behavior was already absent."),e(JSON.stringify(Z,null,2))}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}}),R.command("cdn:list","List all CloudFront distributions").action(async()=>{i("CloudFront Distributions");try{let t=await Ne(),m=new E,k=new s("Fetching distributions...");k.start();let I=await m.listDistributions();if(k.succeed(`Found ${I.length} distribution(s)`),I.length===0){e("No CloudFront distributions found"),e("Use `cloud cdn:create` to create a new distribution");return}c(["ID","Domain","Status","Enabled","Aliases"],I.map((L)=>[L.Id||"N/A",L.DomainName||"N/A",L.Status||"N/A",L.Enabled?"Yes":"No",(L.Aliases?.Items?.length||0).toString()]))}catch(t){r(`Failed to list distributions: ${t.message}`),process.exit(1)}}),R.command("cdn:status <distributionId>","Get CloudFront distribution status").action(async(t)=>{i(`CloudFront Distribution: ${t}`);try{let m=new E,k=new s("Fetching distribution details...");k.start();let I=await m.getDistribution(t);if(k.succeed("Distribution details loaded"),e(`
+`;function Au(R){let t=R;return String(t?.code||t?.name||t?.statusCode||"")}function Kg(R){return["NoSuchEntity","ResourceNotFoundException","404"].includes(Au(R))}function $u(R){return["EntityAlreadyExists","ResourceAlreadyExistsException","ResourceConflictException","409"].includes(Au(R))}function ku(R,t){let m=R?.Items;if(!m)return[];if(Array.isArray(m))return m;let k=m[t];if(k===void 0)return[];return Array.isArray(k)?k:[k]}function Sl(R){let t=R?.Aliases?.Items,m=t?.CNAME??t;if(Array.isArray(m))return m.map(String);if(typeof m==="string")return[m];return[]}function Jg(R){if(!/^[A-Z0-9]{8,32}$/.test(R.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(R.expectedAlias))throw Error("Expected CloudFront alias is invalid");if(!/^[A-Za-z0-9-_]{1,64}$/.test(R.functionName))throw Error("Lambda function name is invalid");let t=R.pathPattern?.startsWith("/")?R.pathPattern:`/${R.pathPattern||"api/*"}`;if(t==="/"||t==="/*"||!t.endsWith("*"))throw Error("API path must be a non-default wildcard pattern such as /api/*");let m=R.originId||`${R.functionName}-url`,k=R.roleName||`${R.functionName}-execution`;if(!/^[A-Za-z0-9_.-]{1,64}$/.test(k))throw Error("IAM role name is invalid");let I=R.memorySize??256,L=R.timeout??10,z=R.logRetentionDays??14;if(I<128||I>10240)throw Error("Lambda memory must be between 128 and 10240 MB");if(L<1||L>900)throw Error("Lambda timeout must be between 1 and 900 seconds");return{region:R.region||"us-east-1",pathPattern:t,originId:m,roleName:k,memorySize:I,timeout:L,logRetentionDays:z}}function Yg(R){let t=R.region||"us-east-1";return{cloudfront:new E(R.profile),iam:new ie(t,R.profile),lambda:new D(t,R.profile),logs:new le(t,R.profile),sts:new vt(t,R.profile),sleep:(m)=>new Promise((k)=>setTimeout(k,m))}}async function Ru(R,t){let m=Jg(R),k=t||Yg({profile:R.profile,region:m.region}),[I,L,z]=await Promise.all([k.sts.getCallerIdentity(),k.cloudfront.getDistribution(R.distributionId),k.cloudfront.getDistributionConfig(R.distributionId)]);if(!I.Account)throw Error("AWS identity did not return an account ID");if(!L.Enabled)throw Error(`CloudFront distribution ${R.distributionId} is disabled`);if(!(Sl(L).length?Sl(L):Sl(z.DistributionConfig)).includes(R.expectedAlias))throw Error(`Distribution ${R.distributionId} does not contain expected alias ${R.expectedAlias}`);let Z,X=!0;try{Z=await k.iam.getRole({RoleName:m.roleName})}catch(At){if(!Kg(At))throw At;X=!1}let ee=Z?.Arn||`arn:aws:iam::${I.Account}:role/${m.roleName}`,oe=await k.lambda.functionExists(R.functionName),se=oe?await k.lambda.getFunctionUrl(R.functionName):null,ue=await k.cloudfront.listOriginAccessControls(),ke=`${R.functionName}-lambda-url`,ce=ue.some((At)=>At.Name===ke&&At.OriginAccessControlOriginType==="lambda"),Se=ku(z.DistributionConfig.Origins,"Origin"),xe=ku(z.DistributionConfig.CacheBehaviors,"CacheBehavior"),ve=Se.some((At)=>String(At.Id)===m.originId),Re=xe.some((At)=>String(At.PathPattern)===m.pathPattern),Ie=[...!X?[`create IAM execution role ${m.roleName}`]:[`reconcile IAM execution policy ${m.roleName}`],...oe?[`update Lambda ${R.functionName} code and configuration`]:[`create Lambda ${R.functionName}`],...!se?["create private AWS_IAM function URL"]:[],...!ce?[`create Lambda origin access control ${ke}`]:[],"grant CloudFront function-URL and invocation permissions",`${Re?"reconcile":"add"} ${m.pathPattern} behavior without changing the default behavior`],Me={command:`cloud cdn:origin:remove ${R.distributionId} FUNCTION_URL_HOST --id ${m.originId} --path '${m.pathPattern}' --apply --confirm 'remove:${R.distributionId}:${m.pathPattern}'`,removeFunction:!oe,removeRole:!X},Ne={mode:R.apply?"apply":"plan",accountId:I.Account,identityArn:I.Arn,distribution:{id:L.Id,arn:L.ARN,alias:R.expectedAlias,domainName:L.DomainName,status:L.Status},function:{name:R.functionName,existed:oe,runtime:"nodejs22.x",urlExisted:!!se,url:se?.FunctionUrl},role:{name:m.roleName,existed:X,arn:ee},origin:{id:m.originId,pathPattern:m.pathPattern,existed:ve,behaviorExisted:Re,accessControlExisted:ce},changes:Ie,rollback:Me,applied:!1};if(!R.apply)return Ne;let Fe=`${R.distributionId}:${m.pathPattern}`;if(R.confirm!==Fe)throw Error(`Pass exact confirmation token ${Fe} to mutate the live distribution`);if(!Z)Z=await k.iam.createRole({RoleName:m.roleName,Description:`Execution role for ${R.functionName}`,AssumeRolePolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]}),Tags:[{Key:"ManagedBy",Value:"ts-cloud"}]});await k.iam.putRolePolicy({RoleName:m.roleName,PolicyName:"lambda-logs",PolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:${m.region}:${I.Account}:log-group:/aws/lambda/${R.functionName}:*`}]})});try{await k.logs.createLogGroup(`/aws/lambda/${R.functionName}`,{ManagedBy:"ts-cloud"})}catch(At){if(!$u(At))throw At}await k.logs.putRetentionPolicy(`/aws/lambda/${R.functionName}`,m.logRetentionDays);let ze=R.code||Gg;if(oe)await k.lambda.updateFunctionCodeInline(R.functionName,ze,"index.mjs"),await k.lambda.waitForFunctionActive(R.functionName),await k.lambda.updateFunctionConfiguration({FunctionName:R.functionName,Runtime:"nodejs22.x",Role:Z.Arn,Handler:"index.handler",Description:`Private API origin for ${R.expectedAlias}`,Timeout:m.timeout,MemorySize:m.memorySize});else{let At;for(let qe=0;qe<8;qe++)try{await k.lambda.createFunctionWithCode({FunctionName:R.functionName,Runtime:"nodejs22.x",Role:Z.Arn,Handler:"index.handler",Code:ze,Filename:"index.mjs",Description:`Private API origin for ${R.expectedAlias}`,Timeout:m.timeout,MemorySize:m.memorySize}),At=void 0;break}catch(xt){if(At=xt,!String(xt.message).toLowerCase().includes("role"))throw xt;await k.sleep(1000)}if(At)throw At}await k.lambda.waitForFunctionActive(R.functionName);let ot=se||await k.lambda.createFunctionUrl({FunctionName:R.functionName,AuthType:"AWS_IAM",InvokeMode:"BUFFERED"});if(!ot.FunctionUrl)throw Error("Lambda did not return a function URL");let wt=new URL(ot.FunctionUrl).hostname,He=await k.cloudfront.findOrCreateOriginAccessControl(ke,"lambda"),dt=L.ARN||`arn:aws:cloudfront::${I.Account}:distribution/${R.distributionId}`,Jt=[{FunctionName:R.functionName,StatementId:"AllowCloudFrontFunctionUrl",Action:"lambda:InvokeFunctionUrl",Principal:"cloudfront.amazonaws.com",SourceArn:dt,FunctionUrlAuthType:"AWS_IAM"},{FunctionName:R.functionName,StatementId:"AllowCloudFrontInvoke",Action:"lambda:InvokeFunction",Principal:"cloudfront.amazonaws.com",SourceArn:dt,InvokedViaFunctionUrl:!0}];for(let At of Jt)try{await k.lambda.addPermission(At)}catch(qe){if(!$u(qe))throw qe}return await k.cloudfront.upsertExistingDistributionOrigin(R.distributionId,{id:m.originId,domainName:wt,pathPattern:m.pathPattern,originAccessControlId:He.Id}),{...Ne,function:{...Ne.function,url:ot.FunctionUrl},applied:!0}}async function Iu(R){let t=`https://${R.alias}/`,m=`https://${R.alias}/api/health`,k=await fetch(t,{redirect:"follow",headers:{"cache-control":"no-cache"}}),I=new Uint8Array(await k.arrayBuffer()),L=Hg("sha256").update(I).digest("hex"),z=Date.now(),Y=await fetch(m,{redirect:"follow",headers:{"cache-control":"no-cache"}}),Z=Date.now()-z,X=await Y.text(),ee=X;try{ee=JSON.parse(X)}catch{}let oe;if(R.logs&&R.functionName){let se=await R.logs.filterLogEvents({logGroupName:`/aws/lambda/${R.functionName}`,startTime:z-60000,filterPattern:'"Init Duration"',limit:25});for(let ue of se.events||[]){let ke=ue.message?.match(/Init Duration:\s*([0-9.]+)\s*ms/i);if(ke)oe=Number(ke[1])}}return{frontend:{url:t,status:k.status,sha256:L,unchanged:R.expectedFrontendSha256?L===R.expectedFrontendSha256:void 0,bytes:I.byteLength},api:{url:m,status:Y.status,latencyMs:Z,healthy:Y.ok&&!!ee?.ok,body:ee},coldStart:{observed:oe!==void 0,initDurationMs:oe},verifiedAt:(R.now?.()||new Date).toISOString()}}function Pu(R){let t=(R.memoryMb||256)/1024,m=Math.max(0,R.requests-(R.includeFreeTier===!1?0:1e6)),k=Math.max(0,R.requests*(R.averageDurationMs/1000)*t-(R.includeFreeTier===!1?0:400000)),I=m/1e6*0.2+k*0.0000166667,L=9.010025,z=16.425;return{lambdaUsd:Number(I.toFixed(2)),alwaysOnFargateAndAlbUsd:Number(25.435025000000003 .toFixed(2)),assumptions:["us-east-1 public list rates snapshot, July 2026","Lambda x86 request and duration pricing with optional monthly free tier","Fargate comparison uses one always-on 0.25 vCPU/0.5 GB task plus one ALB before LCU charges","excludes CloudFront, data transfer, logs, taxes, and application data services"]}}function Cl(R){R.command("cdn:api:deploy <distributionId> <alias>","Plan or deploy a private Lambda API behind an existing static distribution").option("--function <name>","Lambda function name",{default:"ts-cloud-static-api"}).option("--path <pattern>","CloudFront API path",{default:"/api/*"}).option("--origin-id <id>","Stable CloudFront origin ID").option("--role <name>","Lambda execution role name").option("--region <region>","Lambda region",{default:"us-east-1"}).option("--profile <name>","AWS credential profile").option("--memory <mb>","Lambda memory in MB",{default:"256"}).option("--timeout <seconds>","Lambda timeout",{default:"10"}).option("--retention <days>","CloudWatch log retention",{default:"14"}).option("--apply","Create resources and patch the live distribution").option("--confirm <text>","Exact distribution:path confirmation").action(async(t,m,k)=>{try{let I=await Ru({distributionId:t,expectedAlias:m,functionName:k.function||"ts-cloud-static-api",pathPattern:k.path,originId:k.originId,roleName:k.role,region:k.region,profile:k.profile,memorySize:Number(k.memory),timeout:Number(k.timeout),logRetentionDays:Number(k.retention),apply:!!k.apply,confirm:k.confirm});if(e(JSON.stringify(I,null,2)),I.applied)n("Private API origin submitted to CloudFront. Run cdn:api:verify after propagation.");else e(`Plan only. Re-run with --apply --confirm '${t}:${I.origin.pathPattern}'.`)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}}),R.command("cdn:api:verify <alias>","Verify static frontend integrity, API health, latency, and Lambda initialization").option("--function <name>","Lambda function name",{default:"ts-cloud-static-api"}).option("--frontend-sha256 <digest>","Expected SHA-256 of the frontend response").option("--region <region>","Lambda region",{default:"us-east-1"}).option("--profile <name>","AWS credential profile").action(async(t,m)=>{try{let k=new le(m.region||"us-east-1",m.profile),I=await Iu({alias:t,expectedFrontendSha256:m.frontendSha256,logs:k,functionName:m.function||"ts-cloud-static-api"});if(e(JSON.stringify(I,null,2)),!I.api.healthy||I.frontend.unchanged===!1)throw Error("Static API verification failed");n("Static frontend and Lambda API verification passed.")}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}}),R.command("cdn:api:cost <requests>","Compare a low-volume Lambda API with one always-on Fargate task and ALB").option("--duration <milliseconds>","Average Lambda duration",{default:"100"}).option("--memory <mb>","Lambda memory in MB",{default:"256"}).option("--no-free-tier","Exclude the Lambda free tier").action((t,m)=>{let k=Pu({requests:Number(t),averageDurationMs:Number(m.duration),memoryMb:Number(m.memory),includeFreeTier:m.freeTier!==!1});e(JSON.stringify(k,null,2))}),R.command("cdn:origin:add <distributionId> <domain>","Safely add a backend origin and path to an existing distribution").option("--id <origin>","Stable origin ID",{default:"api-backend"}).option("--path <pattern>","Path behavior",{default:"/api/*"}).option("--profile <name>","AWS credential profile").option("--replace","Replace a reviewed path/origin collision").option("--apply","Apply the ETag-protected patch").option("--confirm <text>","Exact distribution:path confirmation").action(async(t,m,k)=>{try{let I=new E(k.profile),L={id:k.id??"api-backend",domainName:m,pathPattern:k.path??"/api/*",replaceExisting:!!k.replace},z=await I.upsertExistingDistributionOrigin(t,{...L,dryRun:!0});if(e(JSON.stringify(z,null,2)),!k.apply){e("Dry run only. Re-run with --apply and the exact --confirm token.");return}let Y=`${t}:${z.pathPattern}`;if(k.confirm!==Y)throw Error(`Pass --confirm "${Y}" to apply this live distribution change`);let Z=await I.upsertExistingDistributionOrigin(t,L);n(Z.changed?"Backend origin patch submitted.":"Backend origin already matches."),e(JSON.stringify(Z,null,2))}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}}),R.command("cdn:origin:remove <distributionId> <domain>","Remove one exact backend behavior and its unreferenced origin").option("--id <origin>","Origin ID",{default:"api-backend"}).option("--path <pattern>","Path behavior",{default:"/api/*"}).option("--profile <name>","AWS credential profile").option("--apply","Apply the ETag-protected rollback").option("--confirm <text>","Exact remove:distribution:path confirmation").action(async(t,m,k)=>{try{let I=new E(k.profile),L={id:k.id??"api-backend",domainName:m,pathPattern:k.path??"/api/*"},z=await I.removeExistingDistributionOrigin(t,{...L,dryRun:!0});if(e(JSON.stringify(z,null,2)),!k.apply){e("Dry run only. Re-run with --apply and the exact --confirm token.");return}let Y=`remove:${t}:${z.pathPattern}`;if(k.confirm!==Y)throw Error(`Pass --confirm "${Y}" to apply this live distribution rollback`);let Z=await I.removeExistingDistributionOrigin(t,L);n(Z.changed?"Backend behavior rollback submitted.":"Backend behavior was already absent."),e(JSON.stringify(Z,null,2))}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}}),R.command("cdn:list","List all CloudFront distributions").action(async()=>{i("CloudFront Distributions");try{let t=await De(),m=new E,k=new s("Fetching distributions...");k.start();let I=await m.listDistributions();if(k.succeed(`Found ${I.length} distribution(s)`),I.length===0){e("No CloudFront distributions found"),e("Use `cloud cdn:create` to create a new distribution");return}c(["ID","Domain","Status","Enabled","Aliases"],I.map((L)=>[L.Id||"N/A",L.DomainName||"N/A",L.Status||"N/A",L.Enabled?"Yes":"No",(L.Aliases?.Items?.length||0).toString()]))}catch(t){r(`Failed to list distributions: ${t.message}`),process.exit(1)}}),R.command("cdn:status <distributionId>","Get CloudFront distribution status").action(async(t)=>{i(`CloudFront Distribution: ${t}`);try{let m=new E,k=new s("Fetching distribution details...");k.start();let I=await m.getDistribution(t);if(k.succeed("Distribution details loaded"),e(`
 Distribution Information:`),e(`  ID: ${I.Id}`),e(`  Domain: ${I.DomainName}`),e(`  Status: ${I.Status}`),e(`  ARN: ${I.ARN}`),e(`  Enabled: ${I.Enabled?"Yes":"No"}`),I.Aliases?.Items?.length)e(`  Aliases: ${I.Aliases.Items.join(", ")}`);let L=await m.getDistributionConfig(t);e(`
 Origins:`);for(let z of x(L.DistributionConfig?.Origins?.Items?.Origin))e(`  - ${z.Id}: ${z.DomainName}`);if(L.DistributionConfig?.DefaultCacheBehavior){let z=L.DistributionConfig.DefaultCacheBehavior;e(`
 Default Cache Behavior:`),e(`  Target Origin: ${z.TargetOriginId}`),e(`  Viewer Protocol: ${z.ViewerProtocolPolicy}`)}}catch(m){r(`Failed to get distribution: ${m.message}`),process.exit(1)}}),R.command("cdn:create","Create a new CloudFront distribution for an S3 bucket").option("--bucket <name>","S3 bucket name").option("--region <region>","S3 bucket region",{default:"us-east-1"}).option("--alias <domain>","Custom domain alias (CNAME)").option("--certificate <arn>","ACM certificate ARN for custom domain").option("--comment <text>","Distribution comment/description").action(async(t)=>{i("Create CloudFront Distribution");try{if(!t.bucket)r("--bucket is required"),e("Example: cloud cdn:create --bucket my-bucket --region us-east-1"),process.exit(1);let m=new E;if(e(`Bucket: ${t.bucket}`),e(`Region: ${t.region}`),t.alias)e(`Alias: ${t.alias}`);if(!await d(`
@@ -488,36 +488,36 @@ Invalidation ID: ${Y.Id}`),e(`Status: ${Y.Status}`),e(`
 Note: Invalidation typically completes in 5-10 minutes.`)}catch(k){r(`Failed to create invalidation: ${k.message}`),process.exit(1)}}),R.command("cdn:disable <distributionId>","Disable a CloudFront distribution").action(async(t)=>{i("Disable CloudFront Distribution");try{let m=new E;if(a(`This will disable distribution: ${t}`),e("The distribution will stop serving content."),!await d(`
 Disable this distribution?`,!1)){e("Operation cancelled");return}let I=new s("Disabling distribution...");I.start(),await m.disableDistribution(t),I.succeed("Distribution disabled"),e(`
 Note: Changes may take 15-30 minutes to propagate.`),e("To delete the distribution, wait for it to be fully disabled first.")}catch(m){r(`Failed to disable distribution: ${m.message}`),process.exit(1)}}),R.command("cdn:delete <distributionId>","Delete a CloudFront distribution").action(async(t)=>{i("Delete CloudFront Distribution");try{let m=new E;if(a(`This will permanently delete distribution: ${t}`),a("The distribution must be disabled first."),!await d(`
-Delete this distribution?`,!1)){e("Operation cancelled");return}let I=new s("Checking distribution status...");I.start();let L=await m.getDistribution(t);if(L.Status!=="Deployed"||L.Enabled){I.fail("Distribution must be disabled and deployed before deletion"),e('\nRun `cloud cdn:disable` first and wait for status to be "Deployed"');return}I.text="Deleting distribution...",await m.deleteDistribution(t),I.succeed("Distribution deleted")}catch(m){r(`Failed to delete distribution: ${m.message}`),process.exit(1)}})}import{readdirSync as Zg,statSync as Qg}from"node:fs";import{join as xu,relative as Xg}from"node:path";async function Er(R){let t=await Ne(),m=y(process.cwd(),t),k=R??Object.keys(t.environments??{})[0]??"production",I=m.environments.get(k);if(!I)throw m.store.close(),Error(`Environment ${k} was not found.`);let L=m.store.getActorByExternalId("system","cli")??m.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"}),z=new gt(m.store),Y=new rn(z,[new Ft,new nn(xu(process.cwd(),".ts-cloud","volumes"))]);return{controlPlane:m,environmentRecord:I,actor:L,store:z,service:Y}}function eh(R){return R.map((t)=>[t.name,`${t.provider}/${t.type}`,t.status,t.capacityBytes==null?"—":Is(t.capacityBytes),t.usedBytes==null?"—":Is(t.usedBytes),String(t.attachments.filter((m)=>m.observedState==="attached").length),t.backupState,t.orphaned?"orphan":"managed"])}function $l(R){R.command("storage:list","List all S3 buckets").option("--region <region>","AWS region").action(async(m)=>{i("S3 Buckets");try{let k=await Ne(),I=m.region||k.project.region||"us-east-1",L=new g(I),z=new s("Fetching buckets...");z.start();let Z=(await L.listBuckets()).Buckets||[];if(z.succeed(`Found ${Z.length} bucket(s)`),Z.length===0){e("No S3 buckets found"),e("Use `cloud storage:create` to create a new bucket");return}c(["Name","Created"],Z.map((X)=>[X.Name||"N/A",X.CreationDate?new Date(X.CreationDate).toLocaleDateString():"N/A"]))}catch(k){r(`Failed to list buckets: ${k.message}`),process.exit(1)}}),R.command("storage:create <name>","Create a new S3 bucket").option("--region <region>","AWS region",{default:"us-east-1"}).option("--public","Enable public access").option("--versioning","Enable versioning").action(async(m,k)=>{i("Create S3 Bucket");try{let I=new g(k.region);if(e(`Bucket name: ${m}`),e(`Region: ${k.region}`),e(`Public access: ${k.public?"Yes":"No"}`),e(`Versioning: ${k.versioning?"Yes":"No"}`),!await d(`
+Delete this distribution?`,!1)){e("Operation cancelled");return}let I=new s("Checking distribution status...");I.start();let L=await m.getDistribution(t);if(L.Status!=="Deployed"||L.Enabled){I.fail("Distribution must be disabled and deployed before deletion"),e('\nRun `cloud cdn:disable` first and wait for status to be "Deployed"');return}I.text="Deleting distribution...",await m.deleteDistribution(t),I.succeed("Distribution deleted")}catch(m){r(`Failed to delete distribution: ${m.message}`),process.exit(1)}})}import{readdirSync as Zg,statSync as Qg}from"node:fs";import{join as xu,relative as Xg}from"node:path";async function wr(R){let t=await De(),m=y(process.cwd(),t),k=R??Object.keys(t.environments??{})[0]??"production",I=m.environments.get(k);if(!I)throw m.store.close(),Error(`Environment ${k} was not found.`);let L=m.store.getActorByExternalId("system","cli")??m.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"}),z=new ht(m.store),Y=new nn(z,[new Vt,new on(xu(process.cwd(),".ts-cloud","volumes"))]);return{controlPlane:m,environmentRecord:I,actor:L,store:z,service:Y}}function eh(R){return R.map((t)=>[t.name,`${t.provider}/${t.type}`,t.status,t.capacityBytes==null?"—":ks(t.capacityBytes),t.usedBytes==null?"—":ks(t.usedBytes),String(t.attachments.filter((m)=>m.observedState==="attached").length),t.backupState,t.orphaned?"orphan":"managed"])}function $l(R){R.command("storage:list","List all S3 buckets").option("--region <region>","AWS region").action(async(m)=>{i("S3 Buckets");try{let k=await De(),I=m.region||k.project.region||"us-east-1",L=new g(I),z=new s("Fetching buckets...");z.start();let Z=(await L.listBuckets()).Buckets||[];if(z.succeed(`Found ${Z.length} bucket(s)`),Z.length===0){e("No S3 buckets found"),e("Use `cloud storage:create` to create a new bucket");return}c(["Name","Created"],Z.map((X)=>[X.Name||"N/A",X.CreationDate?new Date(X.CreationDate).toLocaleDateString():"N/A"]))}catch(k){r(`Failed to list buckets: ${k.message}`),process.exit(1)}}),R.command("storage:create <name>","Create a new S3 bucket").option("--region <region>","AWS region",{default:"us-east-1"}).option("--public","Enable public access").option("--versioning","Enable versioning").action(async(m,k)=>{i("Create S3 Bucket");try{let I=new g(k.region);if(e(`Bucket name: ${m}`),e(`Region: ${k.region}`),e(`Public access: ${k.public?"Yes":"No"}`),e(`Versioning: ${k.versioning?"Yes":"No"}`),!await d(`
 Create this bucket?`,!0)){e("Operation cancelled");return}let z=new s("Creating bucket...");if(z.start(),await I.createBucket(m),!k.public)z.text="Configuring public access block...",await I.putPublicAccessBlock(m,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!0,RestrictPublicBuckets:!0});if(k.versioning)z.text="Enabling versioning...",await I.putBucketVersioning(m,"Enabled");z.succeed("Bucket created"),n(`
 Bucket: ${m}`),e(`Region: ${k.region}`),e(`URL: s3://${m}`)}catch(I){r(`Failed to create bucket: ${I.message}`),process.exit(1)}}),R.command("storage:delete <name>","Delete an S3 bucket").option("--force","Delete all objects first").action(async(m,k)=>{i("Delete S3 Bucket");try{let I=new g("us-east-1");if(a(`This will permanently delete bucket: ${m}`),k.force)a("All objects in the bucket will be deleted!");if(!await d(`
-Delete this bucket?`,!1)){e("Operation cancelled");return}let z=new s("Deleting bucket...");if(z.start(),k.force)z.text="Emptying bucket...",await I.emptyBucket(m);await I.deleteBucket(m),z.succeed("Bucket deleted")}catch(I){r(`Failed to delete bucket: ${I.message}`),process.exit(1)}}),R.command("storage:sync <source> <bucket>","Sync local directory to S3 bucket").option("--prefix <prefix>","S3 key prefix").option("--delete","Delete files in S3 that are not in source").option("--dry-run","Show what would be synced without making changes").action(async(m,k,I)=>{i("Sync to S3");try{let Z=function(ae,be){let Ae=Zg(ae,{withFileTypes:!0});for(let de of Ae){let ke=xu(ae,de.name);if(de.isDirectory())Z(ke,be);else{let De=Xg(be,ke),Se=I.prefix?`${I.prefix}/${De}`:De,Re=Qg(ke);Y.push({path:ke,key:Se,size:Re.size})}}},L=new g("us-east-1");if(e(`Source: ${m}`),e(`Destination: s3://${k}/${I.prefix||""}`),I.dryRun)e("Dry run mode - no changes will be made");let z=new s("Scanning files...");z.start();let Y=[];if(Z(m,m),z.succeed(`Found ${Y.length} local file(s)`),Y.length===0){e("No files to sync");return}e(`
-Files to sync:`);for(let ae of Y.slice(0,10))e(`  ${ae.key} (${(ae.size/1024).toFixed(2)} KB)`);if(Y.length>10)e(`  ... and ${Y.length-10} more`);if(I.dryRun){e(`
+Delete this bucket?`,!1)){e("Operation cancelled");return}let z=new s("Deleting bucket...");if(z.start(),k.force)z.text="Emptying bucket...",await I.emptyBucket(m);await I.deleteBucket(m),z.succeed("Bucket deleted")}catch(I){r(`Failed to delete bucket: ${I.message}`),process.exit(1)}}),R.command("storage:sync <source> <bucket>","Sync local directory to S3 bucket").option("--prefix <prefix>","S3 key prefix").option("--delete","Delete files in S3 that are not in source").option("--dry-run","Show what would be synced without making changes").action(async(m,k,I)=>{i("Sync to S3");try{let Z=function(se,ue){let ke=Zg(se,{withFileTypes:!0});for(let ce of ke){let Se=xu(se,ce.name);if(ce.isDirectory())Z(Se,ue);else{let xe=Xg(ue,Se),ve=I.prefix?`${I.prefix}/${xe}`:xe,Re=Qg(Se);Y.push({path:Se,key:ve,size:Re.size})}}},L=new g("us-east-1");if(e(`Source: ${m}`),e(`Destination: s3://${k}/${I.prefix||""}`),I.dryRun)e("Dry run mode - no changes will be made");let z=new s("Scanning files...");z.start();let Y=[];if(Z(m,m),z.succeed(`Found ${Y.length} local file(s)`),Y.length===0){e("No files to sync");return}e(`
+Files to sync:`);for(let se of Y.slice(0,10))e(`  ${se.key} (${(se.size/1024).toFixed(2)} KB)`);if(Y.length>10)e(`  ... and ${Y.length-10} more`);if(I.dryRun){e(`
 Dry run complete - no changes made`);return}if(!await d(`
-Sync these files?`,!0)){e("Operation cancelled");return}let ie=new s("Uploading files...");ie.start();let oe=0;for(let ae of Y){ie.text=`Uploading ${ae.key}... (${oe+1}/${Y.length})`;let Ae=await Bun.file(ae.path).arrayBuffer();await L.putObject({bucket:k,key:ae.key,body:Buffer.from(Ae),contentType:th(ae.key)}),oe++}if(ie.succeed(`Uploaded ${oe} file(s)`),I.delete){let ae=new s("Checking for files to delete...");ae.start();let be=await L.listObjects({bucket:k,prefix:I.prefix}),Ae=new Set(Y.map((ke)=>ke.key)),de=be.objects.filter((ke)=>ke.Key&&!Ae.has(ke.Key)).map((ke)=>ke.Key);if(de.length>0){ae.text=`Deleting ${de.length} remote file(s)...`;for(let ke of de)await L.deleteObject(k,ke);ae.succeed(`Deleted ${de.length} remote file(s)`)}else ae.succeed("No files to delete")}n(`
+Sync these files?`,!0)){e("Operation cancelled");return}let ee=new s("Uploading files...");ee.start();let oe=0;for(let se of Y){ee.text=`Uploading ${se.key}... (${oe+1}/${Y.length})`;let ke=await Bun.file(se.path).arrayBuffer();await L.putObject({bucket:k,key:se.key,body:Buffer.from(ke),contentType:th(se.key)}),oe++}if(ee.succeed(`Uploaded ${oe} file(s)`),I.delete){let se=new s("Checking for files to delete...");se.start();let ue=await L.listObjects({bucket:k,prefix:I.prefix}),ke=new Set(Y.map((Se)=>Se.key)),ce=ue.objects.filter((Se)=>Se.Key&&!ke.has(Se.Key)).map((Se)=>Se.Key);if(ce.length>0){se.text=`Deleting ${ce.length} remote file(s)...`;for(let Se of ce)await L.deleteObject(k,Se);se.succeed(`Deleted ${ce.length} remote file(s)`)}else se.succeed("No files to delete")}n(`
 Sync complete!`)}catch(L){r(`Failed to sync: ${L.message}`),process.exit(1)}}),R.command("storage:policy <bucket>","Show or set bucket policy").option("--set <file>","Set policy from JSON file").option("--public-read","Set a public read policy").option("--delete","Delete the bucket policy").action(async(m,k)=>{i("S3 Bucket Policy");try{let I=new g("us-east-1");if(k.delete){if(a(`This will delete the policy for bucket: ${m}`),!await d(`
 Delete bucket policy?`,!1)){e("Operation cancelled");return}let Y=new s("Deleting policy...");Y.start(),await I.deleteBucketPolicy(m),Y.succeed("Policy deleted");return}if(k.publicRead){if(a(`This will make bucket ${m} publicly readable!`),!await d(`
 Set public read policy?`,!1)){e("Operation cancelled");return}let Y=new s("Setting policy...");Y.start();let Z={Version:"2012-10-17",Statement:[{Sid:"PublicReadGetObject",Effect:"Allow",Principal:"*",Action:"s3:GetObject",Resource:`arn:aws:s3:::${m}/*`}]};await I.putBucketPolicy(m,Z),Y.succeed("Public read policy set");return}if(k.set){let z=new s("Setting policy...");z.start();let Z=await Bun.file(k.set).text();await I.putBucketPolicy(m,Z),z.succeed("Policy set");return}let L=new s("Fetching policy...");L.start();try{let z=await I.getBucketPolicy(m);L.succeed("Policy loaded"),e(`
-Bucket Policy:`),console.log(JSON.stringify(z||{},null,2))}catch(z){if(z.message?.includes("NoSuchBucketPolicy"))L.succeed("No policy set"),e("This bucket has no policy configured.");else throw z}}catch(I){r(`Failed to manage policy: ${I.message}`),process.exit(1)}}),R.command("storage:ls <bucket>","List objects in a bucket").option("--prefix <prefix>","Filter by prefix").option("--limit <number>","Limit number of results",{default:"100"}).action(async(m,k)=>{i(`Objects in ${m}`);try{let I=new g("us-east-1"),L=new s("Listing objects...");L.start();let z=await I.listObjects({bucket:m,prefix:k.prefix,maxKeys:Number.parseInt(k.limit||"100")}),Y=z.objects;if(L.succeed(`Found ${Y.length} object(s)${z.nextContinuationToken?" (truncated)":""}`),Y.length===0){e("No objects found");return}if(c(["Key","Size","Last Modified"],Y.map((Z)=>[Z.Key||"N/A",Is(Z.Size||0),Z.LastModified?new Date(Z.LastModified).toLocaleString():"N/A"])),z.nextContinuationToken)e(`
-More objects available. Use --limit to see more.`)}catch(I){r(`Failed to list objects: ${I.message}`),process.exit(1)}});let t=(m,k)=>R.command(m,k).option("--env <environment>","Dashboard environment");t("volume:list","List persistent volumes, consumers, usage, and protection").option("--json","Print structured JSON").action(async(m)=>{let k=await Er(m.env);try{let I=k.store.inventory(k.controlPlane.project.id,k.environmentRecord.id);if(m.json)console.log(JSON.stringify(I,null,2));else c(["Name","Driver","Status","Capacity","Used","Consumers","Backup","Ownership"],eh(I))}catch(I){r(I instanceof Error?I.message:String(I))}finally{k.controlPlane.store.close()}}),t("volume:show <name>","Inspect a persistent volume and its dependency graph").option("--json","Print structured JSON").action(async(m,k)=>{let I=await Er(k.env);try{let L=I.store.inventory(I.controlPlane.project.id,I.environmentRecord.id).find((z)=>z.id===m||z.name===m);if(!L)throw Error(`Volume ${m} was not found.`);if(k.json)console.log(JSON.stringify(L,null,2));else c(["Property","Value"],[["ID",L.id],["Driver",`${L.provider}/${L.type}`],["Provider ID",L.providerId??"—"],["Status",L.status],["Capacity",L.capacityBytes==null?"—":Is(L.capacityBytes)],["Used",L.usedBytes==null?"—":Is(L.usedBytes)],["Backup",L.backupState]]),c(["Resource","Target","Mode","State"],L.attachments.map((z)=>[z.resourceId,z.targetPath,z.readOnly?"read only":"read/write",z.observedState]))}catch(L){r(L instanceof Error?L.message:String(L))}finally{I.controlPlane.store.close()}}),t("volume:create <name>","Create a stable named or managed-path volume").option("--driver <driver>","docker or server",{default:"docker"}).option("--capacity-bytes <bytes>","Advisory capacity in bytes").option("--encrypted","Request provider encryption").action(async(m,k)=>{let I=await Er(k.env);try{let L=k.driver==="server";if(!L&&k.driver!=="docker")throw Error("--driver must be docker or server.");let z=I.service.create({organizationId:I.controlPlane.organization.id,projectId:I.controlPlane.project.id,environmentId:I.environmentRecord.id,name:m,provider:L?"server":"docker",type:L?"server_path":"docker",capacityBytes:k.capacityBytes?Number(k.capacityBytes):void 0,encrypted:!!k.encrypted,actorId:I.actor.id});n(`Volume create queued: ${z.operation.id}`)}catch(L){r(L instanceof Error?L.message:String(L))}finally{I.controlPlane.store.close()}}),t("volume:attach <volume> <resource> <target>","Validate and attach a volume to a workload").option("--read-only","Mount read only").option("--uid <uid>","Filesystem UID").option("--gid <gid>","Filesystem GID").option("--mode <mode>","Octal mode").action(async(m,k,I,L)=>{let z=await Er(L.env);try{let Y=z.store.list({projectId:z.controlPlane.project.id,environmentId:z.environmentRecord.id}).find((ie)=>ie.id===m||ie.name===m),Z=z.controlPlane.store.listResources(z.controlPlane.project.id,z.environmentRecord.id).find((ie)=>ie.id===k||ie.slug===k);if(!Y||!Z)throw Error("Volume or resource was not found in the selected environment.");let X=z.service.attach(Y.id,{resourceId:Z.id,targetPath:I,readOnly:!!L.readOnly,uid:L.uid?Number(L.uid):void 0,gid:L.gid?Number(L.gid):void 0,mode:L.mode,actorId:z.actor.id});n(`Volume attachment queued: ${X.operation.id}`)}catch(Y){r(Y instanceof Error?Y.message:String(Y))}finally{z.controlPlane.store.close()}}),t("volume:detach <volume> <attachment>","Drain, unmount, and detach a volume consumer").option("--force","Force after exact confirmation").option("--confirm <text>","Exact force-detach confirmation").action(async(m,k,I)=>{let L=await Er(I.env);try{let z=L.store.list({projectId:L.controlPlane.project.id,environmentId:L.environmentRecord.id}).find((Z)=>Z.id===m||Z.name===m);if(!z)throw Error("Volume was not found.");let Y=L.service.detach(z.id,k,{drained:!0,unmounted:!0,force:!!I.force,confirmation:I.confirm,actorId:L.actor.id});n(`Volume detach queued: ${Y.operation.id}`)}catch(z){r(z instanceof Error?z.message:String(z))}finally{L.controlPlane.store.close()}}),t("volume:resize <volume> <bytes>","Grow a capable persistent volume").option("--drained","Confirm offline workload drain").action(async(m,k,I)=>{let L=await Er(I.env);try{let z=L.store.list({projectId:L.controlPlane.project.id,environmentId:L.environmentRecord.id}).find((Z)=>Z.id===m||Z.name===m);if(!z)throw Error("Volume was not found.");let Y=L.service.resize(z.id,Number(k),{drained:!!I.drained,actorId:L.actor.id});n(`Volume resize queued: ${Y.operation.id}`)}catch(z){r(z instanceof Error?z.message:String(z))}finally{L.controlPlane.store.close()}}),t("volume:snapshot <volume>","Create a provider snapshot when supported").action(async(m,k)=>{let I=await Er(k.env);try{let L=I.store.list({projectId:I.controlPlane.project.id,environmentId:I.environmentRecord.id}).find((Y)=>Y.id===m||Y.name===m);if(!L)throw Error("Volume was not found.");let z=I.service.snapshot(L.id,{actorId:I.actor.id});n(`Volume snapshot queued: ${z.operation.id}`)}catch(L){r(L instanceof Error?L.message:String(L))}finally{I.controlPlane.store.close()}}),t("volume:restore <snapshot> <name>","Restore a snapshot into a replacement volume").action(async(m,k,I)=>{let L=await Er(I.env);try{let z=L.service.restore(m,{name:k,actorId:L.actor.id});n(`Volume restore queued: ${z.operation.id}`)}catch(z){r(z instanceof Error?z.message:String(z))}finally{L.controlPlane.store.close()}}),t("volume:discover","Discover provider volumes without adopting or deleting them").action(async(m)=>{let k=await Er(m.env);try{let I=await k.service.discover({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,environmentId:k.environmentRecord.id,actorId:k.actor.id});n(`Discovered ${I.filter((L)=>L.status==="orphaned").length} orphan volume(s).`)}catch(I){r(I instanceof Error?I.message:String(I))}finally{k.controlPlane.store.close()}}),t("volume:adopt <volume> <name>","Adopt a discovered orphan under a managed name").action(async(m,k,I)=>{let L=await Er(I.env);try{L.service.adopt(m,{name:k,actorId:L.actor.id}),n(`Adopted ${k}.`)}catch(z){r(z instanceof Error?z.message:String(z))}finally{L.controlPlane.store.close()}}),t("volume:delete <volume>","Permanently delete a detached volume").option("--confirm <name>","Exact volume name").option("--without-backup","Explicitly override the recent-backup gate").option("--backup-confirm <text>","Exact backup override confirmation").action(async(m,k)=>{let I=await Er(k.env);try{let L=I.store.list({projectId:I.controlPlane.project.id,environmentId:I.environmentRecord.id}).find((Y)=>Y.id===m||Y.name===m);if(!L)throw Error("Volume was not found.");let z=I.service.delete(L.id,{recentAuthAt:new Date().toISOString(),confirmation:k.confirm,backupOverride:!!k.withoutBackup,backupOverrideConfirmation:k.backupConfirm,actorId:I.actor.id});n(`Volume deletion queued: ${z.operation.id}`)}catch(L){r(L instanceof Error?L.message:String(L))}finally{I.controlPlane.store.close()}})}function th(R){let t=R.split(".").pop()?.toLowerCase();return{html:"text/html",css:"text/css",js:"application/javascript",json:"application/json",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",svg:"image/svg+xml",ico:"image/x-icon",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",eot:"application/vnd.ms-fontobject",pdf:"application/pdf",zip:"application/zip",xml:"application/xml",txt:"text/plain",md:"text/markdown"}[t||""]||"application/octet-stream"}function Is(R){if(R===0)return"0 B";let t=1024,m=["B","KB","MB","GB","TB"],k=Math.floor(Math.log(R)/Math.log(t));return`${Number.parseFloat((R/t**k).toFixed(2))} ${m[k]}`}var Du=["aws","backblaze","hetzner"];function Eu(R,t){let m=R.indexOf(":");if(m===-1)throw Error(`--${t} must be in the form <provider:bucket> (e.g. aws:my-bucket), got "${R}"`);let k=R.slice(0,m),I=R.slice(m+1);if(!Du.includes(k))throw Error(`Unknown provider "${k}" for --${t}. Supported: ${Du.join(", ")}`);if(!I)throw Error(`--${t} is missing a bucket name (expected <provider:bucket>)`);return{provider:k,bucket:I}}function Tu(R){if(!R)return;let t=R.split(",").map((m)=>m.trim()).filter(Boolean);return t.length>0?t:void 0}function kl(R){R.command("migrate:storage","Migrate object-storage data between providers (AWS S3 ↔ Hetzner ↔ Backblaze)").option("--from <provider:bucket>","Source endpoint, e.g. aws:stacks-production-email").option("--to <provider:bucket>","Destination endpoint, e.g. hetzner:stacks-mail").option("--from-region <region>","Source region/location (default: provider default)").option("--to-region <region>","Destination region/location (default: provider default)").option("--from-endpoint <host>","Source endpoint host override (no scheme)").option("--to-endpoint <host>","Destination endpoint host override (no scheme)").option("--from-prefix <prefix>","Only read source keys under this prefix (stripped from dest key)").option("--to-prefix <prefix>","Prepend this prefix to every destination key").option("--include <csv>","Only copy keys under these comma-separated prefixes").option("--exclude <csv>","Skip keys under these comma-separated prefixes").option("--dry-run","Print the plan (what would copy / what is excluded) without writing").option("--force","Re-copy even if the destination already has an object of the same size").option("--delete-extraneous","Delete destination keys not present in the source (default OFF)").option("--concurrency <n>","Max concurrent copies",{default:"8"}).option("--verify","After copying, re-list the destination and assert object count + sizes match").action(async(t)=>{i("Migrate Object Storage");try{if(!t.from||!t.to)throw Error("Both --from <provider:bucket> and --to <provider:bucket> are required");let m=Eu(t.from,"from"),k=Eu(t.to,"to"),I=Tu(t.include),L=Tu(t.exclude),z=Number.parseInt(t.concurrency||"8",10),Y={provider:m.provider,bucket:m.bucket,region:t.fromRegion,endpoint:t.fromEndpoint,prefix:t.fromPrefix},Z={provider:k.provider,bucket:k.bucket,region:t.toRegion,endpoint:t.toEndpoint,prefix:t.toPrefix};if(e(`Source:      ${m.provider}:${m.bucket}${t.fromPrefix?`/${t.fromPrefix}`:""}`),e(`Destination: ${k.provider}:${k.bucket}${t.toPrefix?`/${t.toPrefix}`:""}`),I)e(`Include:     ${I.join(", ")}`);if(L)e(`Exclude:     ${L.join(", ")}`);if(e(`Concurrency: ${z}`),t.dryRun)a("Dry run — no objects will be written");if(t.deleteExtraneous&&!t.dryRun)a("Delete-extraneous ON — destination keys not in the source will be removed");let X=new s("Listing source objects...");X.start();let ie=0,oe=await ps({from:Y,to:Z,include:I,exclude:L,dryRun:t.dryRun,force:t.force,deleteExtraneous:t.deleteExtraneous,concurrency:z,verify:t.verify,onProgress:(ae)=>{if(ae.index-ie>=1||ae.index===ae.total){ie=ae.index;let be=ae.action==="planned"?"plan":ae.action;X.text=`[${ae.index}/${ae.total}] ${be}: ${ae.key}`}}});if(X.succeed(t.dryRun?"Plan ready":"Migration complete"),t.dryRun&&oe.plan){e(`
-Would copy ${oe.plan.length} object(s):`);for(let ae of oe.plan.slice(0,50))e(`  ${ae.key}  ->  ${ae.destKey}  (${vn(ae.size)})`);if(oe.plan.length>50)e(`  ... and ${oe.plan.length-50} more`)}if(oe.excludedKeys.length>0){e(`
-EXCLUDED ${oe.excludedKeys.length} key(s) (deliberately not migrated):`);for(let ae of oe.excludedKeys.slice(0,50))e(`  ${ae}`);if(oe.excludedKeys.length>50)e(`  ... and ${oe.excludedKeys.length-50} more`)}if(oe.deleted.length>0){a(`
-Deleted ${oe.deleted.length} extraneous destination key(s):`);for(let ae of oe.deleted.slice(0,50))a(`  ${ae}`)}if(e(`
-Summary:`),t.dryRun)e(`  would copy:  ${oe.plan?.length??0}`);else n(`  copied:      ${oe.copied} (${vn(oe.bytesCopied)})`),e(`  skipped:     ${oe.skipped} (already present)`);if(e(`  excluded:    ${oe.excluded}`),oe.deleted.length>0)e(`  deleted:     ${oe.deleted.length}`);if(oe.errors.length>0){r(`  errors:      ${oe.errors.length}`);for(let ae of oe.errors.slice(0,20))r(`    ${ae.key}: ${ae.message}`)}if(oe.verification){let ae=oe.verification;if(ae.ok)n(`
-Verification PASSED — ${ae.matched} object(s) present at destination with matching sizes`);else{r(`
-Verification FAILED — ${ae.missing.length} missing, ${ae.sizeMismatches.length} size mismatch(es)`);for(let be of ae.missing.slice(0,20))r(`  missing: ${be}`);for(let be of ae.sizeMismatches.slice(0,20))r(`  size:    ${be.key} expected ${be.expected} got ${be.actual}`)}}if(oe.errors.length>0||oe.verification?.ok===!1)process.exit(1)}catch(m){r(`Migration failed: ${m.message}`),process.exit(1)}})}function Al(R){R.command("cache:list","List all ElastiCache clusters").option("--region <region>","AWS region").action(async(t)=>{i("ElastiCache Clusters");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new se(k),L=new s("Fetching clusters...");L.start();let Y=(await I.describeCacheClusters()).CacheClusters||[];if(L.succeed(`Found ${Y.length} cluster(s)`),Y.length===0){e("No ElastiCache clusters found"),e("Use `cloud cache:create` to create a new cluster");return}c(["Cluster ID","Engine","Node Type","Nodes","Status"],Y.map((Z)=>[Z.CacheClusterId||"N/A",`${Z.Engine||"N/A"} ${Z.EngineVersion||""}`,Z.CacheNodeType||"N/A",(Z.NumCacheNodes||0).toString(),Z.CacheClusterStatus||"N/A"]))}catch(m){r(`Failed to list clusters: ${m.message}`),process.exit(1)}}),R.command("cache:create <name>","Create a new ElastiCache cluster").option("--engine <engine>","Cache engine (redis or memcached)",{default:"redis"}).option("--node-type <type>","Node instance type",{default:"cache.t3.micro"}).option("--nodes <number>","Number of cache nodes",{default:"1"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--version <version>","Engine version").action(async(t,m)=>{i("Create ElastiCache Cluster");try{let k=new se(m.region);if(e(`Cluster ID: ${t}`),e(`Engine: ${m.engine}`),e(`Node Type: ${m.nodeType}`),e(`Number of Nodes: ${m.nodes}`),e(`Region: ${m.region}`),!await d(`
+Bucket Policy:`),console.log(JSON.stringify(z||{},null,2))}catch(z){if(z.message?.includes("NoSuchBucketPolicy"))L.succeed("No policy set"),e("This bucket has no policy configured.");else throw z}}catch(I){r(`Failed to manage policy: ${I.message}`),process.exit(1)}}),R.command("storage:ls <bucket>","List objects in a bucket").option("--prefix <prefix>","Filter by prefix").option("--limit <number>","Limit number of results",{default:"100"}).action(async(m,k)=>{i(`Objects in ${m}`);try{let I=new g("us-east-1"),L=new s("Listing objects...");L.start();let z=await I.listObjects({bucket:m,prefix:k.prefix,maxKeys:Number.parseInt(k.limit||"100")}),Y=z.objects;if(L.succeed(`Found ${Y.length} object(s)${z.nextContinuationToken?" (truncated)":""}`),Y.length===0){e("No objects found");return}if(c(["Key","Size","Last Modified"],Y.map((Z)=>[Z.Key||"N/A",ks(Z.Size||0),Z.LastModified?new Date(Z.LastModified).toLocaleString():"N/A"])),z.nextContinuationToken)e(`
+More objects available. Use --limit to see more.`)}catch(I){r(`Failed to list objects: ${I.message}`),process.exit(1)}});let t=(m,k)=>R.command(m,k).option("--env <environment>","Dashboard environment");t("volume:list","List persistent volumes, consumers, usage, and protection").option("--json","Print structured JSON").action(async(m)=>{let k=await wr(m.env);try{let I=k.store.inventory(k.controlPlane.project.id,k.environmentRecord.id);if(m.json)console.log(JSON.stringify(I,null,2));else c(["Name","Driver","Status","Capacity","Used","Consumers","Backup","Ownership"],eh(I))}catch(I){r(I instanceof Error?I.message:String(I))}finally{k.controlPlane.store.close()}}),t("volume:show <name>","Inspect a persistent volume and its dependency graph").option("--json","Print structured JSON").action(async(m,k)=>{let I=await wr(k.env);try{let L=I.store.inventory(I.controlPlane.project.id,I.environmentRecord.id).find((z)=>z.id===m||z.name===m);if(!L)throw Error(`Volume ${m} was not found.`);if(k.json)console.log(JSON.stringify(L,null,2));else c(["Property","Value"],[["ID",L.id],["Driver",`${L.provider}/${L.type}`],["Provider ID",L.providerId??"—"],["Status",L.status],["Capacity",L.capacityBytes==null?"—":ks(L.capacityBytes)],["Used",L.usedBytes==null?"—":ks(L.usedBytes)],["Backup",L.backupState]]),c(["Resource","Target","Mode","State"],L.attachments.map((z)=>[z.resourceId,z.targetPath,z.readOnly?"read only":"read/write",z.observedState]))}catch(L){r(L instanceof Error?L.message:String(L))}finally{I.controlPlane.store.close()}}),t("volume:create <name>","Create a stable named or managed-path volume").option("--driver <driver>","docker or server",{default:"docker"}).option("--capacity-bytes <bytes>","Advisory capacity in bytes").option("--encrypted","Request provider encryption").action(async(m,k)=>{let I=await wr(k.env);try{let L=k.driver==="server";if(!L&&k.driver!=="docker")throw Error("--driver must be docker or server.");let z=I.service.create({organizationId:I.controlPlane.organization.id,projectId:I.controlPlane.project.id,environmentId:I.environmentRecord.id,name:m,provider:L?"server":"docker",type:L?"server_path":"docker",capacityBytes:k.capacityBytes?Number(k.capacityBytes):void 0,encrypted:!!k.encrypted,actorId:I.actor.id});n(`Volume create queued: ${z.operation.id}`)}catch(L){r(L instanceof Error?L.message:String(L))}finally{I.controlPlane.store.close()}}),t("volume:attach <volume> <resource> <target>","Validate and attach a volume to a workload").option("--read-only","Mount read only").option("--uid <uid>","Filesystem UID").option("--gid <gid>","Filesystem GID").option("--mode <mode>","Octal mode").action(async(m,k,I,L)=>{let z=await wr(L.env);try{let Y=z.store.list({projectId:z.controlPlane.project.id,environmentId:z.environmentRecord.id}).find((ee)=>ee.id===m||ee.name===m),Z=z.controlPlane.store.listResources(z.controlPlane.project.id,z.environmentRecord.id).find((ee)=>ee.id===k||ee.slug===k);if(!Y||!Z)throw Error("Volume or resource was not found in the selected environment.");let X=z.service.attach(Y.id,{resourceId:Z.id,targetPath:I,readOnly:!!L.readOnly,uid:L.uid?Number(L.uid):void 0,gid:L.gid?Number(L.gid):void 0,mode:L.mode,actorId:z.actor.id});n(`Volume attachment queued: ${X.operation.id}`)}catch(Y){r(Y instanceof Error?Y.message:String(Y))}finally{z.controlPlane.store.close()}}),t("volume:detach <volume> <attachment>","Drain, unmount, and detach a volume consumer").option("--force","Force after exact confirmation").option("--confirm <text>","Exact force-detach confirmation").action(async(m,k,I)=>{let L=await wr(I.env);try{let z=L.store.list({projectId:L.controlPlane.project.id,environmentId:L.environmentRecord.id}).find((Z)=>Z.id===m||Z.name===m);if(!z)throw Error("Volume was not found.");let Y=L.service.detach(z.id,k,{drained:!0,unmounted:!0,force:!!I.force,confirmation:I.confirm,actorId:L.actor.id});n(`Volume detach queued: ${Y.operation.id}`)}catch(z){r(z instanceof Error?z.message:String(z))}finally{L.controlPlane.store.close()}}),t("volume:resize <volume> <bytes>","Grow a capable persistent volume").option("--drained","Confirm offline workload drain").action(async(m,k,I)=>{let L=await wr(I.env);try{let z=L.store.list({projectId:L.controlPlane.project.id,environmentId:L.environmentRecord.id}).find((Z)=>Z.id===m||Z.name===m);if(!z)throw Error("Volume was not found.");let Y=L.service.resize(z.id,Number(k),{drained:!!I.drained,actorId:L.actor.id});n(`Volume resize queued: ${Y.operation.id}`)}catch(z){r(z instanceof Error?z.message:String(z))}finally{L.controlPlane.store.close()}}),t("volume:snapshot <volume>","Create a provider snapshot when supported").action(async(m,k)=>{let I=await wr(k.env);try{let L=I.store.list({projectId:I.controlPlane.project.id,environmentId:I.environmentRecord.id}).find((Y)=>Y.id===m||Y.name===m);if(!L)throw Error("Volume was not found.");let z=I.service.snapshot(L.id,{actorId:I.actor.id});n(`Volume snapshot queued: ${z.operation.id}`)}catch(L){r(L instanceof Error?L.message:String(L))}finally{I.controlPlane.store.close()}}),t("volume:restore <snapshot> <name>","Restore a snapshot into a replacement volume").action(async(m,k,I)=>{let L=await wr(I.env);try{let z=L.service.restore(m,{name:k,actorId:L.actor.id});n(`Volume restore queued: ${z.operation.id}`)}catch(z){r(z instanceof Error?z.message:String(z))}finally{L.controlPlane.store.close()}}),t("volume:discover","Discover provider volumes without adopting or deleting them").action(async(m)=>{let k=await wr(m.env);try{let I=await k.service.discover({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,environmentId:k.environmentRecord.id,actorId:k.actor.id});n(`Discovered ${I.filter((L)=>L.status==="orphaned").length} orphan volume(s).`)}catch(I){r(I instanceof Error?I.message:String(I))}finally{k.controlPlane.store.close()}}),t("volume:adopt <volume> <name>","Adopt a discovered orphan under a managed name").action(async(m,k,I)=>{let L=await wr(I.env);try{L.service.adopt(m,{name:k,actorId:L.actor.id}),n(`Adopted ${k}.`)}catch(z){r(z instanceof Error?z.message:String(z))}finally{L.controlPlane.store.close()}}),t("volume:delete <volume>","Permanently delete a detached volume").option("--confirm <name>","Exact volume name").option("--without-backup","Explicitly override the recent-backup gate").option("--backup-confirm <text>","Exact backup override confirmation").action(async(m,k)=>{let I=await wr(k.env);try{let L=I.store.list({projectId:I.controlPlane.project.id,environmentId:I.environmentRecord.id}).find((Y)=>Y.id===m||Y.name===m);if(!L)throw Error("Volume was not found.");let z=I.service.delete(L.id,{recentAuthAt:new Date().toISOString(),confirmation:k.confirm,backupOverride:!!k.withoutBackup,backupOverrideConfirmation:k.backupConfirm,actorId:I.actor.id});n(`Volume deletion queued: ${z.operation.id}`)}catch(L){r(L instanceof Error?L.message:String(L))}finally{I.controlPlane.store.close()}})}function th(R){let t=R.split(".").pop()?.toLowerCase();return{html:"text/html",css:"text/css",js:"application/javascript",json:"application/json",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",svg:"image/svg+xml",ico:"image/x-icon",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",eot:"application/vnd.ms-fontobject",pdf:"application/pdf",zip:"application/zip",xml:"application/xml",txt:"text/plain",md:"text/markdown"}[t||""]||"application/octet-stream"}function ks(R){if(R===0)return"0 B";let t=1024,m=["B","KB","MB","GB","TB"],k=Math.floor(Math.log(R)/Math.log(t));return`${Number.parseFloat((R/t**k).toFixed(2))} ${m[k]}`}var Du=["aws","backblaze","hetzner"];function Eu(R,t){let m=R.indexOf(":");if(m===-1)throw Error(`--${t} must be in the form <provider:bucket> (e.g. aws:my-bucket), got "${R}"`);let k=R.slice(0,m),I=R.slice(m+1);if(!Du.includes(k))throw Error(`Unknown provider "${k}" for --${t}. Supported: ${Du.join(", ")}`);if(!I)throw Error(`--${t} is missing a bucket name (expected <provider:bucket>)`);return{provider:k,bucket:I}}function Tu(R){if(!R)return;let t=R.split(",").map((m)=>m.trim()).filter(Boolean);return t.length>0?t:void 0}function kl(R){R.command("migrate:storage","Migrate object-storage data between providers (AWS S3 ↔ Hetzner ↔ Backblaze)").option("--from <provider:bucket>","Source endpoint, e.g. aws:stacks-production-email").option("--to <provider:bucket>","Destination endpoint, e.g. hetzner:stacks-mail").option("--from-region <region>","Source region/location (default: provider default)").option("--to-region <region>","Destination region/location (default: provider default)").option("--from-endpoint <host>","Source endpoint host override (no scheme)").option("--to-endpoint <host>","Destination endpoint host override (no scheme)").option("--from-prefix <prefix>","Only read source keys under this prefix (stripped from dest key)").option("--to-prefix <prefix>","Prepend this prefix to every destination key").option("--include <csv>","Only copy keys under these comma-separated prefixes").option("--exclude <csv>","Skip keys under these comma-separated prefixes").option("--dry-run","Print the plan (what would copy / what is excluded) without writing").option("--force","Re-copy even if the destination already has an object of the same size").option("--delete-extraneous","Delete destination keys not present in the source (default OFF)").option("--concurrency <n>","Max concurrent copies",{default:"8"}).option("--verify","After copying, re-list the destination and assert object count + sizes match").action(async(t)=>{i("Migrate Object Storage");try{if(!t.from||!t.to)throw Error("Both --from <provider:bucket> and --to <provider:bucket> are required");let m=Eu(t.from,"from"),k=Eu(t.to,"to"),I=Tu(t.include),L=Tu(t.exclude),z=Number.parseInt(t.concurrency||"8",10),Y={provider:m.provider,bucket:m.bucket,region:t.fromRegion,endpoint:t.fromEndpoint,prefix:t.fromPrefix},Z={provider:k.provider,bucket:k.bucket,region:t.toRegion,endpoint:t.toEndpoint,prefix:t.toPrefix};if(e(`Source:      ${m.provider}:${m.bucket}${t.fromPrefix?`/${t.fromPrefix}`:""}`),e(`Destination: ${k.provider}:${k.bucket}${t.toPrefix?`/${t.toPrefix}`:""}`),I)e(`Include:     ${I.join(", ")}`);if(L)e(`Exclude:     ${L.join(", ")}`);if(e(`Concurrency: ${z}`),t.dryRun)a("Dry run — no objects will be written");if(t.deleteExtraneous&&!t.dryRun)a("Delete-extraneous ON — destination keys not in the source will be removed");let X=new s("Listing source objects...");X.start();let ee=0,oe=await vs({from:Y,to:Z,include:I,exclude:L,dryRun:t.dryRun,force:t.force,deleteExtraneous:t.deleteExtraneous,concurrency:z,verify:t.verify,onProgress:(se)=>{if(se.index-ee>=1||se.index===se.total){ee=se.index;let ue=se.action==="planned"?"plan":se.action;X.text=`[${se.index}/${se.total}] ${ue}: ${se.key}`}}});if(X.succeed(t.dryRun?"Plan ready":"Migration complete"),t.dryRun&&oe.plan){e(`
+Would copy ${oe.plan.length} object(s):`);for(let se of oe.plan.slice(0,50))e(`  ${se.key}  ->  ${se.destKey}  (${Cn(se.size)})`);if(oe.plan.length>50)e(`  ... and ${oe.plan.length-50} more`)}if(oe.excludedKeys.length>0){e(`
+EXCLUDED ${oe.excludedKeys.length} key(s) (deliberately not migrated):`);for(let se of oe.excludedKeys.slice(0,50))e(`  ${se}`);if(oe.excludedKeys.length>50)e(`  ... and ${oe.excludedKeys.length-50} more`)}if(oe.deleted.length>0){a(`
+Deleted ${oe.deleted.length} extraneous destination key(s):`);for(let se of oe.deleted.slice(0,50))a(`  ${se}`)}if(e(`
+Summary:`),t.dryRun)e(`  would copy:  ${oe.plan?.length??0}`);else n(`  copied:      ${oe.copied} (${Cn(oe.bytesCopied)})`),e(`  skipped:     ${oe.skipped} (already present)`);if(e(`  excluded:    ${oe.excluded}`),oe.deleted.length>0)e(`  deleted:     ${oe.deleted.length}`);if(oe.errors.length>0){r(`  errors:      ${oe.errors.length}`);for(let se of oe.errors.slice(0,20))r(`    ${se.key}: ${se.message}`)}if(oe.verification){let se=oe.verification;if(se.ok)n(`
+Verification PASSED — ${se.matched} object(s) present at destination with matching sizes`);else{r(`
+Verification FAILED — ${se.missing.length} missing, ${se.sizeMismatches.length} size mismatch(es)`);for(let ue of se.missing.slice(0,20))r(`  missing: ${ue}`);for(let ue of se.sizeMismatches.slice(0,20))r(`  size:    ${ue.key} expected ${ue.expected} got ${ue.actual}`)}}if(oe.errors.length>0||oe.verification?.ok===!1)process.exit(1)}catch(m){r(`Migration failed: ${m.message}`),process.exit(1)}})}function Al(R){R.command("cache:list","List all ElastiCache clusters").option("--region <region>","AWS region").action(async(t)=>{i("ElastiCache Clusters");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new ae(k),L=new s("Fetching clusters...");L.start();let Y=(await I.describeCacheClusters()).CacheClusters||[];if(L.succeed(`Found ${Y.length} cluster(s)`),Y.length===0){e("No ElastiCache clusters found"),e("Use `cloud cache:create` to create a new cluster");return}c(["Cluster ID","Engine","Node Type","Nodes","Status"],Y.map((Z)=>[Z.CacheClusterId||"N/A",`${Z.Engine||"N/A"} ${Z.EngineVersion||""}`,Z.CacheNodeType||"N/A",(Z.NumCacheNodes||0).toString(),Z.CacheClusterStatus||"N/A"]))}catch(m){r(`Failed to list clusters: ${m.message}`),process.exit(1)}}),R.command("cache:create <name>","Create a new ElastiCache cluster").option("--engine <engine>","Cache engine (redis or memcached)",{default:"redis"}).option("--node-type <type>","Node instance type",{default:"cache.t3.micro"}).option("--nodes <number>","Number of cache nodes",{default:"1"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--version <version>","Engine version").action(async(t,m)=>{i("Create ElastiCache Cluster");try{let k=new ae(m.region);if(e(`Cluster ID: ${t}`),e(`Engine: ${m.engine}`),e(`Node Type: ${m.nodeType}`),e(`Number of Nodes: ${m.nodes}`),e(`Region: ${m.region}`),!await d(`
 Create this cluster?`,!0)){e("Operation cancelled");return}let L=new s("Creating cluster...");L.start(),await k.createCacheCluster({cacheClusterId:t,engine:m.engine,cacheNodeType:m.nodeType,numCacheNodes:Number.parseInt(m.nodes),engineVersion:m.version}),L.succeed("Cluster creation initiated"),n(`
 Cluster: ${t}`),e("Status: creating"),e(`
-Note: Cluster creation may take several minutes.`),e("Use `cloud cache:list` to check status.")}catch(k){r(`Failed to create cluster: ${k.message}`),process.exit(1)}}),R.command("cache:delete <clusterId>","Delete an ElastiCache cluster").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Delete ElastiCache Cluster");try{let k=new se(m.region);if(a(`This will permanently delete cluster: ${t}`),a("All data in the cluster will be lost!"),!await d(`
+Note: Cluster creation may take several minutes.`),e("Use `cloud cache:list` to check status.")}catch(k){r(`Failed to create cluster: ${k.message}`),process.exit(1)}}),R.command("cache:delete <clusterId>","Delete an ElastiCache cluster").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Delete ElastiCache Cluster");try{let k=new ae(m.region);if(a(`This will permanently delete cluster: ${t}`),a("All data in the cluster will be lost!"),!await d(`
 Delete this cluster?`,!1)){e("Operation cancelled");return}let L=new s("Deleting cluster...");L.start(),await k.deleteCacheCluster(t),L.succeed("Cluster deletion initiated"),e(`
-Note: Cluster deletion may take several minutes.`)}catch(k){r(`Failed to delete cluster: ${k.message}`),process.exit(1)}}),R.command("cache:stats <clusterId>","Show ElastiCache cluster statistics").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i(`ElastiCache Stats: ${t}`);try{let k=new se(m.region),I=new s("Fetching cluster details...");I.start();let z=(await k.describeCacheClusters(t)).CacheClusters?.[0];if(!z){I.fail("Cluster not found");return}if(I.succeed("Cluster details loaded"),e(`
+Note: Cluster deletion may take several minutes.`)}catch(k){r(`Failed to delete cluster: ${k.message}`),process.exit(1)}}),R.command("cache:stats <clusterId>","Show ElastiCache cluster statistics").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i(`ElastiCache Stats: ${t}`);try{let k=new ae(m.region),I=new s("Fetching cluster details...");I.start();let z=(await k.describeCacheClusters(t)).CacheClusters?.[0];if(!z){I.fail("Cluster not found");return}if(I.succeed("Cluster details loaded"),e(`
 Cluster Information:`),e(`  Cluster ID: ${z.CacheClusterId}`),e(`  Engine: ${z.Engine} ${z.EngineVersion}`),e(`  Node Type: ${z.CacheNodeType}`),e(`  Status: ${z.CacheClusterStatus}`),e(`  Nodes: ${z.NumCacheNodes}`),e(`  Availability Zone: ${z.PreferredAvailabilityZone||"Not set"}`),z.CacheNodes&&z.CacheNodes.length>0){e(`
-Cache Nodes:`);for(let Y of z.CacheNodes)if(e(`  - ${Y.CacheNodeId}: ${Y.CacheNodeStatus}`),Y.Endpoint)e(`    Endpoint: ${Y.Endpoint.Address}:${Y.Endpoint.Port}`)}}catch(k){r(`Failed to get cluster stats: ${k.message}`),process.exit(1)}}),R.command("cache:flush <clusterId>","Flush all data from a Redis cluster").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Flush ElastiCache Cluster");try{let k=new se(m.region),I=new s("Getting cluster endpoint...");I.start();let z=(await k.describeCacheClusters(t)).CacheClusters?.[0];if(!z){I.fail("Cluster not found");return}if(z.Engine!=="redis"){I.fail("Flush is only supported for Redis clusters"),e("For Memcached, items expire automatically based on TTL.");return}I.stop();let Y=z.CacheNodes?.[0]?.Endpoint;if(!Y){r("Could not determine cluster endpoint");return}if(a(`This will delete ALL data in cluster: ${t}`),a(`Endpoint: ${Y.Address}:${Y.Port}`),a("This action cannot be undone!"),!await d(`
+Cache Nodes:`);for(let Y of z.CacheNodes)if(e(`  - ${Y.CacheNodeId}: ${Y.CacheNodeStatus}`),Y.Endpoint)e(`    Endpoint: ${Y.Endpoint.Address}:${Y.Endpoint.Port}`)}}catch(k){r(`Failed to get cluster stats: ${k.message}`),process.exit(1)}}),R.command("cache:flush <clusterId>","Flush all data from a Redis cluster").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Flush ElastiCache Cluster");try{let k=new ae(m.region),I=new s("Getting cluster endpoint...");I.start();let z=(await k.describeCacheClusters(t)).CacheClusters?.[0];if(!z){I.fail("Cluster not found");return}if(z.Engine!=="redis"){I.fail("Flush is only supported for Redis clusters"),e("For Memcached, items expire automatically based on TTL.");return}I.stop();let Y=z.CacheNodes?.[0]?.Endpoint;if(!Y){r("Could not determine cluster endpoint");return}if(a(`This will delete ALL data in cluster: ${t}`),a(`Endpoint: ${Y.Address}:${Y.Port}`),a("This action cannot be undone!"),!await d(`
 Flush all data?`,!1)){e("Operation cancelled");return}e(`
 To flush the Redis cluster, connect and run FLUSHALL:`),e(`  redis-cli -h ${Y.Address} -p ${Y.Port} FLUSHALL`),e(`
-Note: Direct FLUSHALL via AWS API is not supported.`),e("You must connect to the cluster directly to execute this command.")}catch(k){r(`Failed to get cluster info: ${k.message}`),process.exit(1)}}),R.command("cache:reboot <clusterId>","Reboot cache cluster nodes").option("--region <region>","AWS region",{default:"us-east-1"}).option("--node <nodeId>","Specific node ID to reboot").action(async(t,m)=>{i("Reboot ElastiCache Cluster");try{let k=new se(m.region),I=new s("Getting cluster info...");I.start();let z=(await k.describeCacheClusters(t)).CacheClusters?.[0];if(!z){I.fail("Cluster not found");return}I.stop();let Y=m.node?[m.node]:z.CacheNodes?.map((ie)=>ie.CacheNodeId).filter(Boolean)||[];if(Y.length===0){r("No nodes found to reboot");return}if(a(`This will reboot the following nodes: ${Y.join(", ")}`),a("The cluster may be temporarily unavailable during reboot."),!await d(`
+Note: Direct FLUSHALL via AWS API is not supported.`),e("You must connect to the cluster directly to execute this command.")}catch(k){r(`Failed to get cluster info: ${k.message}`),process.exit(1)}}),R.command("cache:reboot <clusterId>","Reboot cache cluster nodes").option("--region <region>","AWS region",{default:"us-east-1"}).option("--node <nodeId>","Specific node ID to reboot").action(async(t,m)=>{i("Reboot ElastiCache Cluster");try{let k=new ae(m.region),I=new s("Getting cluster info...");I.start();let z=(await k.describeCacheClusters(t)).CacheClusters?.[0];if(!z){I.fail("Cluster not found");return}I.stop();let Y=m.node?[m.node]:z.CacheNodes?.map((ee)=>ee.CacheNodeId).filter(Boolean)||[];if(Y.length===0){r("No nodes found to reboot");return}if(a(`This will reboot the following nodes: ${Y.join(", ")}`),a("The cluster may be temporarily unavailable during reboot."),!await d(`
 Reboot these nodes?`,!1)){e("Operation cancelled");return}let X=new s("Rebooting nodes...");X.start(),await k.rebootCacheCluster(t,Y),X.succeed("Reboot initiated"),e(`
-Note: Reboot may take several minutes to complete.`),e("Use `cloud cache:stats` to check status.")}catch(k){r(`Failed to reboot cluster: ${k.message}`),process.exit(1)}})}function Rl(R){R.command("queue:list","List all SQS queues").option("--region <region>","AWS region").action(async(t)=>{i("SQS Queues");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new V(k),L=new s("Fetching queues...");L.start();let Y=(await I.listQueues()).QueueUrls||[];if(L.succeed(`Found ${Y.length} queue(s)`),Y.length===0){e("No SQS queues found"),e("Use `cloud queue:create` to create a new queue");return}let Z=[];for(let X of Y)try{let ie=await I.getQueueAttributes(X),oe=X.split("/").pop()||X;Z.push({url:X,name:oe,messages:ie.Attributes?.ApproximateNumberOfMessages||"0",type:ie.Attributes?.FifoQueue==="true"?"FIFO":"Standard"})}catch{let ie=X.split("/").pop()||X;Z.push({url:X,name:ie,messages:"N/A",type:"Unknown"})}c(["Queue Name","Messages","Type"],Z.map((X)=>[X.name,X.messages,X.type]))}catch(m){r(`Failed to list queues: ${m.message}`),process.exit(1)}}),R.command("queue:create <name>","Create a new SQS queue").option("--region <region>","AWS region",{default:"us-east-1"}).option("--fifo","Create a FIFO queue").option("--dlq <queueArn>","Dead letter queue ARN").option("--max-retries <number>","Max receive count before DLQ",{default:"3"}).option("--visibility <seconds>","Visibility timeout in seconds",{default:"30"}).option("--retention <days>","Message retention in days",{default:"4"}).action(async(t,m)=>{i("Create SQS Queue");try{let k=new V(m.region),I=m.fifo&&!t.endsWith(".fifo")?`${t}.fifo`:t;if(e(`Queue name: ${I}`),e(`Type: ${m.fifo?"FIFO":"Standard"}`),e(`Visibility timeout: ${m.visibility} seconds`),e(`Message retention: ${m.retention} days`),m.dlq)e(`Dead letter queue: ${m.dlq}`),e(`Max retries: ${m.maxRetries}`);if(!await d(`
+Note: Reboot may take several minutes to complete.`),e("Use `cloud cache:stats` to check status.")}catch(k){r(`Failed to reboot cluster: ${k.message}`),process.exit(1)}})}function Rl(R){R.command("queue:list","List all SQS queues").option("--region <region>","AWS region").action(async(t)=>{i("SQS Queues");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new V(k),L=new s("Fetching queues...");L.start();let Y=(await I.listQueues()).QueueUrls||[];if(L.succeed(`Found ${Y.length} queue(s)`),Y.length===0){e("No SQS queues found"),e("Use `cloud queue:create` to create a new queue");return}let Z=[];for(let X of Y)try{let ee=await I.getQueueAttributes(X),oe=X.split("/").pop()||X;Z.push({url:X,name:oe,messages:ee.Attributes?.ApproximateNumberOfMessages||"0",type:ee.Attributes?.FifoQueue==="true"?"FIFO":"Standard"})}catch{let ee=X.split("/").pop()||X;Z.push({url:X,name:ee,messages:"N/A",type:"Unknown"})}c(["Queue Name","Messages","Type"],Z.map((X)=>[X.name,X.messages,X.type]))}catch(m){r(`Failed to list queues: ${m.message}`),process.exit(1)}}),R.command("queue:create <name>","Create a new SQS queue").option("--region <region>","AWS region",{default:"us-east-1"}).option("--fifo","Create a FIFO queue").option("--dlq <queueArn>","Dead letter queue ARN").option("--max-retries <number>","Max receive count before DLQ",{default:"3"}).option("--visibility <seconds>","Visibility timeout in seconds",{default:"30"}).option("--retention <days>","Message retention in days",{default:"4"}).action(async(t,m)=>{i("Create SQS Queue");try{let k=new V(m.region),I=m.fifo&&!t.endsWith(".fifo")?`${t}.fifo`:t;if(e(`Queue name: ${I}`),e(`Type: ${m.fifo?"FIFO":"Standard"}`),e(`Visibility timeout: ${m.visibility} seconds`),e(`Message retention: ${m.retention} days`),m.dlq)e(`Dead letter queue: ${m.dlq}`),e(`Max retries: ${m.maxRetries}`);if(!await d(`
 Create this queue?`,!0)){e("Operation cancelled");return}let z=new s("Creating queue...");z.start();let Y=await k.createQueue({queueName:I,fifo:m.fifo,visibilityTimeout:Number.parseInt(m.visibility),messageRetentionPeriod:Number.parseInt(m.retention)*24*60*60,contentBasedDeduplication:m.fifo?!0:void 0,deadLetterTargetArn:m.dlq,maxReceiveCount:m.dlq?Number.parseInt(m.maxRetries):void 0});z.succeed("Queue created"),n(`
 Queue URL: ${Y.QueueUrl}`),e(`
 To send a message:`),e(`  cloud queue:send ${I} --message "Hello World"`)}catch(k){r(`Failed to create queue: ${k.message}`),process.exit(1)}}),R.command("queue:delete <name>","Delete an SQS queue").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Delete SQS Queue");try{let k=new V(m.region);if(a(`This will permanently delete queue: ${t}`),a("All messages in the queue will be lost!"),!await d(`
@@ -530,11 +530,11 @@ Queue Information:`),e(`  URL: ${L.QueueUrl}`),e(`  ARN: ${Y.QueueArn||"N/A"}`),
 Messages:`),e(`  Available: ${Y.ApproximateNumberOfMessages||"0"}`),e(`  In Flight: ${Y.ApproximateNumberOfMessagesNotVisible||"0"}`),e(`  Delayed: ${Y.ApproximateNumberOfMessagesDelayed||"0"}`),e(`
 Configuration:`),e(`  Visibility Timeout: ${Y.VisibilityTimeout||"30"} seconds`),e(`  Message Retention: ${Number.parseInt(Y.MessageRetentionPeriod||"345600")/86400} days`),e(`  Max Message Size: ${Number.parseInt(Y.MaximumMessageSize||"262144")/1024} KB`),e(`  Receive Wait Time: ${Y.ReceiveMessageWaitTimeSeconds||"0"} seconds`),Y.RedrivePolicy){let Z=JSON.parse(Y.RedrivePolicy);e(`
 Dead Letter Queue:`),e(`  Target ARN: ${Z.deadLetterTargetArn}`),e(`  Max Receives: ${Z.maxReceiveCount}`)}e(`
-Timestamps:`),e(`  Created: ${Y.CreatedTimestamp?new Date(Number.parseInt(Y.CreatedTimestamp)*1000).toISOString():"N/A"}`),e(`  Last Modified: ${Y.LastModifiedTimestamp?new Date(Number.parseInt(Y.LastModifiedTimestamp)*1000).toISOString():"N/A"}`)}catch(k){r(`Failed to get queue stats: ${k.message}`),process.exit(1)}})}function Il(R){R.command("network:list","List all VPCs").option("--region <region>","AWS region").action(async(t)=>{i("VPCs");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new Q(k),L=new s("Fetching VPCs...");L.start();let Y=(await I.describeVpcs()).Vpcs||[];if(L.succeed(`Found ${Y.length} VPC(s)`),Y.length===0){e("No VPCs found");return}c(["VPC ID","Name","CIDR","State","Default"],Y.map((Z)=>[Z.VpcId||"N/A",Z.Tags?.find((X)=>X.Key==="Name")?.Value||"-",Z.CidrBlock||"N/A",Z.State||"N/A",Z.IsDefault?"Yes":"No"]))}catch(m){r(`Failed to list VPCs: ${m.message}`),process.exit(1)}}),R.command("network:subnets","List all subnets").option("--region <region>","AWS region").option("--vpc <vpcId>","Filter by VPC ID").action(async(t)=>{i("Subnets");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new Q(k),L=new s("Fetching subnets...");L.start();let z=t.vpc?[{Name:"vpc-id",Values:[t.vpc]}]:void 0,Z=(await I.describeSubnets({Filters:z})).Subnets||[];if(L.succeed(`Found ${Z.length} subnet(s)`),Z.length===0){e("No subnets found");return}c(["Subnet ID","Name","VPC","CIDR","AZ","IPs Available","Public"],Z.map((X)=>[X.SubnetId||"N/A",X.Tags?.find((ie)=>ie.Key==="Name")?.Value||"-",X.VpcId||"N/A",X.CidrBlock||"N/A",X.AvailabilityZone||"N/A",(X.AvailableIpAddressCount||0).toString(),X.MapPublicIpOnLaunch?"Yes":"No"]))}catch(m){r(`Failed to list subnets: ${m.message}`),process.exit(1)}}),R.command("network:security-groups","List all security groups").option("--region <region>","AWS region").option("--vpc <vpcId>","Filter by VPC ID").action(async(t)=>{i("Security Groups");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new Q(k),L=new s("Fetching security groups...");L.start();let z=t.vpc?[{Name:"vpc-id",Values:[t.vpc]}]:void 0,Z=(await I.describeSecurityGroups({Filters:z})).SecurityGroups||[];if(L.succeed(`Found ${Z.length} security group(s)`),Z.length===0){e("No security groups found");return}c(["Group ID","Name","VPC","Description","Inbound Rules","Outbound Rules"],Z.map((X)=>[X.GroupId||"N/A",X.GroupName||"N/A",X.VpcId||"N/A",(X.Description||"").substring(0,30),(X.IpPermissions?.length||0).toString(),(X.IpPermissionsEgress?.length||0).toString()]))}catch(m){r(`Failed to list security groups: ${m.message}`),process.exit(1)}}),R.command("network:security-group <groupId>","Show security group details").option("--region <region>","AWS region").action(async(t,m)=>{i(`Security Group: ${t}`);try{let k=await Ne(),I=m.region||k.project.region||"us-east-1",L=new Q(I),z=new s("Fetching security group...");z.start();let Z=(await L.describeSecurityGroups({GroupIds:[t]})).SecurityGroups?.[0];if(!Z){z.fail("Security group not found");return}if(z.succeed("Security group loaded"),e(`
+Timestamps:`),e(`  Created: ${Y.CreatedTimestamp?new Date(Number.parseInt(Y.CreatedTimestamp)*1000).toISOString():"N/A"}`),e(`  Last Modified: ${Y.LastModifiedTimestamp?new Date(Number.parseInt(Y.LastModifiedTimestamp)*1000).toISOString():"N/A"}`)}catch(k){r(`Failed to get queue stats: ${k.message}`),process.exit(1)}})}function Il(R){R.command("network:list","List all VPCs").option("--region <region>","AWS region").action(async(t)=>{i("VPCs");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new Q(k),L=new s("Fetching VPCs...");L.start();let Y=(await I.describeVpcs()).Vpcs||[];if(L.succeed(`Found ${Y.length} VPC(s)`),Y.length===0){e("No VPCs found");return}c(["VPC ID","Name","CIDR","State","Default"],Y.map((Z)=>[Z.VpcId||"N/A",Z.Tags?.find((X)=>X.Key==="Name")?.Value||"-",Z.CidrBlock||"N/A",Z.State||"N/A",Z.IsDefault?"Yes":"No"]))}catch(m){r(`Failed to list VPCs: ${m.message}`),process.exit(1)}}),R.command("network:subnets","List all subnets").option("--region <region>","AWS region").option("--vpc <vpcId>","Filter by VPC ID").action(async(t)=>{i("Subnets");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new Q(k),L=new s("Fetching subnets...");L.start();let z=t.vpc?[{Name:"vpc-id",Values:[t.vpc]}]:void 0,Z=(await I.describeSubnets({Filters:z})).Subnets||[];if(L.succeed(`Found ${Z.length} subnet(s)`),Z.length===0){e("No subnets found");return}c(["Subnet ID","Name","VPC","CIDR","AZ","IPs Available","Public"],Z.map((X)=>[X.SubnetId||"N/A",X.Tags?.find((ee)=>ee.Key==="Name")?.Value||"-",X.VpcId||"N/A",X.CidrBlock||"N/A",X.AvailabilityZone||"N/A",(X.AvailableIpAddressCount||0).toString(),X.MapPublicIpOnLaunch?"Yes":"No"]))}catch(m){r(`Failed to list subnets: ${m.message}`),process.exit(1)}}),R.command("network:security-groups","List all security groups").option("--region <region>","AWS region").option("--vpc <vpcId>","Filter by VPC ID").action(async(t)=>{i("Security Groups");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new Q(k),L=new s("Fetching security groups...");L.start();let z=t.vpc?[{Name:"vpc-id",Values:[t.vpc]}]:void 0,Z=(await I.describeSecurityGroups({Filters:z})).SecurityGroups||[];if(L.succeed(`Found ${Z.length} security group(s)`),Z.length===0){e("No security groups found");return}c(["Group ID","Name","VPC","Description","Inbound Rules","Outbound Rules"],Z.map((X)=>[X.GroupId||"N/A",X.GroupName||"N/A",X.VpcId||"N/A",(X.Description||"").substring(0,30),(X.IpPermissions?.length||0).toString(),(X.IpPermissionsEgress?.length||0).toString()]))}catch(m){r(`Failed to list security groups: ${m.message}`),process.exit(1)}}),R.command("network:security-group <groupId>","Show security group details").option("--region <region>","AWS region").action(async(t,m)=>{i(`Security Group: ${t}`);try{let k=await De(),I=m.region||k.project.region||"us-east-1",L=new Q(I),z=new s("Fetching security group...");z.start();let Z=(await L.describeSecurityGroups({GroupIds:[t]})).SecurityGroups?.[0];if(!Z){z.fail("Security group not found");return}if(z.succeed("Security group loaded"),e(`
 General Information:`),e(`  Group ID: ${Z.GroupId}`),e(`  Name: ${Z.GroupName}`),e(`  VPC: ${Z.VpcId}`),e(`  Description: ${Z.Description}`),Z.IpPermissions&&Z.IpPermissions.length>0){e(`
-Inbound Rules:`);for(let X of Z.IpPermissions){let ie=X.IpProtocol==="-1"?"All":X.IpProtocol?.toUpperCase(),oe=X.FromPort===X.ToPort?X.FromPort?.toString()||"All":`${X.FromPort}-${X.ToPort}`;for(let ae of X.IpRanges||[])e(`  - ${ie} ${oe} from ${ae.CidrIp}${ae.Description?` (${ae.Description})`:""}`);for(let ae of X.UserIdGroupPairs||[])e(`  - ${ie} ${oe} from ${ae.GroupId}${ae.Description?` (${ae.Description})`:""}`)}}else e(`
+Inbound Rules:`);for(let X of Z.IpPermissions){let ee=X.IpProtocol==="-1"?"All":X.IpProtocol?.toUpperCase(),oe=X.FromPort===X.ToPort?X.FromPort?.toString()||"All":`${X.FromPort}-${X.ToPort}`;for(let se of X.IpRanges||[])e(`  - ${ee} ${oe} from ${se.CidrIp}${se.Description?` (${se.Description})`:""}`);for(let se of X.UserIdGroupPairs||[])e(`  - ${ee} ${oe} from ${se.GroupId}${se.Description?` (${se.Description})`:""}`)}}else e(`
 No inbound rules configured.`);if(Z.IpPermissionsEgress&&Z.IpPermissionsEgress.length>0){e(`
-Outbound Rules:`);for(let X of Z.IpPermissionsEgress){let ie=X.IpProtocol==="-1"?"All":X.IpProtocol?.toUpperCase(),oe=X.FromPort===X.ToPort?X.FromPort?.toString()||"All":`${X.FromPort}-${X.ToPort}`;for(let ae of X.IpRanges||[])e(`  - ${ie} ${oe} to ${ae.CidrIp}${ae.Description?` (${ae.Description})`:""}`);for(let ae of X.UserIdGroupPairs||[])e(`  - ${ie} ${oe} to ${ae.GroupId}${ae.Description?` (${ae.Description})`:""}`)}}else e(`
+Outbound Rules:`);for(let X of Z.IpPermissionsEgress){let ee=X.IpProtocol==="-1"?"All":X.IpProtocol?.toUpperCase(),oe=X.FromPort===X.ToPort?X.FromPort?.toString()||"All":`${X.FromPort}-${X.ToPort}`;for(let se of X.IpRanges||[])e(`  - ${ee} ${oe} to ${se.CidrIp}${se.Description?` (${se.Description})`:""}`);for(let se of X.UserIdGroupPairs||[])e(`  - ${ee} ${oe} to ${se.GroupId}${se.Description?` (${se.Description})`:""}`)}}else e(`
 No outbound rules configured.`);if(Z.Tags&&Z.Tags.length>0){e(`
 Tags:`);for(let X of Z.Tags)e(`  ${X.Key}: ${X.Value}`)}}catch(k){r(`Failed to get security group: ${k.message}`),process.exit(1)}}),R.command("network:create-vpc <cidr>","Create a new VPC").option("--region <region>","AWS region",{default:"us-east-1"}).option("--name <name>","VPC name tag").option("--tenancy <tenancy>","Instance tenancy (default or dedicated)",{default:"default"}).action(async(t,m)=>{i("Create VPC");try{let k=new Q(m.region);if(e(`CIDR Block: ${t}`),e(`Region: ${m.region}`),e(`Tenancy: ${m.tenancy}`),m.name)e(`Name: ${m.name}`);if(!await d(`
 Create this VPC?`,!0)){e("Operation cancelled");return}let L=new s("Creating VPC...");L.start();let z=await k.createVpc({CidrBlock:t,InstanceTenancy:m.tenancy,TagSpecifications:m.name?[{ResourceType:"vpc",Tags:[{Key:"Name",Value:m.name}]}]:void 0});L.succeed("VPC created"),n(`
@@ -543,116 +543,116 @@ Create this subnet?`,!0)){e("Operation cancelled");return}let z=new s("Creating
 Subnet ID: ${Y.Subnet?.SubnetId}`),e(`CIDR: ${Y.Subnet?.CidrBlock}`),e(`Availability Zone: ${Y.Subnet?.AvailabilityZone}`)}catch(I){r(`Failed to create subnet: ${I.message}`),process.exit(1)}}),R.command("network:create-sg <vpcId> <name>","Create a new security group").option("--region <region>","AWS region",{default:"us-east-1"}).option("--description <desc>","Security group description").action(async(t,m,k)=>{i("Create Security Group");try{let I=new Q(k.region),L=k.description||`Security group for ${m}`;if(e(`VPC: ${t}`),e(`Name: ${m}`),e(`Description: ${L}`),!await d(`
 Create this security group?`,!0)){e("Operation cancelled");return}let Y=new s("Creating security group...");Y.start();let Z=await I.createSecurityGroup({GroupName:m,Description:L,VpcId:t,TagSpecifications:[{ResourceType:"security-group",Tags:[{Key:"Name",Value:m}]}]});Y.succeed("Security group created"),n(`
 Group ID: ${Z.GroupId}`),e(`
-To add rules:`),e(`  cloud network:sg-rule ${Z.GroupId} --inbound --port 443 --cidr 0.0.0.0/0`)}catch(I){r(`Failed to create security group: ${I.message}`),process.exit(1)}}),R.command("network:sg-rule <groupId>","Add a rule to a security group").option("--region <region>","AWS region",{default:"us-east-1"}).option("--inbound","Add inbound rule").option("--outbound","Add outbound rule").option("--protocol <protocol>","Protocol (tcp, udp, icmp, or -1 for all)",{default:"tcp"}).option("--port <port>","Port number or range (e.g., 80 or 80-443)").option("--cidr <cidr>","CIDR block (e.g., 0.0.0.0/0)").option("--source-group <groupId>","Source security group").option("--description <desc>","Rule description").action(async(t,m)=>{i("Add Security Group Rule");try{let k=new Q(m.region);if(!m.inbound&&!m.outbound){r("Specify --inbound or --outbound");return}if(!m.cidr&&!m.sourceGroup){r("Specify --cidr or --source-group");return}let I,L;if(m.port)if(m.port.includes("-")){let[oe,ae]=m.port.split("-");I=Number.parseInt(oe),L=Number.parseInt(ae)}else I=Number.parseInt(m.port),L=I;else if(m.protocol!=="-1"){r("Port is required for TCP/UDP protocols");return}let z=m.inbound?"Inbound":"Outbound",Y=m.protocol==="-1"?"All":I===L?I:`${I}-${L}`;if(e(`Security Group: ${t}`),e(`Direction: ${z}`),e(`Protocol: ${m.protocol}`),e(`Port(s): ${Y}`),e(`Source: ${m.cidr||m.sourceGroup}`),!await d(`
-Add this rule?`,!0)){e("Operation cancelled");return}let X=new s("Adding rule...");X.start();let ie={IpProtocol:m.protocol,FromPort:I,ToPort:L};if(m.cidr)ie.IpRanges=[{CidrIp:m.cidr,Description:m.description}];if(m.sourceGroup)ie.UserIdGroupPairs=[{GroupId:m.sourceGroup,Description:m.description}];if(m.inbound)await k.authorizeSecurityGroupIngress({GroupId:t,IpPermissions:[ie]});else await k.authorizeSecurityGroupEgress({GroupId:t,IpPermissions:[ie]});X.succeed("Rule added")}catch(k){r(`Failed to add rule: ${k.message}`),process.exit(1)}}),R.command("network:elastic-ips","List Elastic IP addresses").option("--region <region>","AWS region").action(async(t)=>{i("Elastic IP Addresses");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new Q(k),L=new s("Fetching Elastic IPs...");L.start();let Y=(await I.describeAddresses()).Addresses||[];if(L.succeed(`Found ${Y.length} Elastic IP(s)`),Y.length===0){e("No Elastic IPs found");return}c(["Public IP","Allocation ID","Association ID","Instance","Name"],Y.map((Z)=>[Z.PublicIp||"N/A",Z.AllocationId||"N/A",Z.AssociationId||"-",Z.InstanceId||"-",Z.Tags?.find((X)=>X.Key==="Name")?.Value||"-"]))}catch(m){r(`Failed to list Elastic IPs: ${m.message}`),process.exit(1)}}),R.command("network:route-tables","List route tables").option("--region <region>","AWS region").option("--vpc <vpcId>","Filter by VPC ID").action(async(t)=>{i("Route Tables");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new Q(k),L=new s("Fetching route tables...");L.start();let z=t.vpc?[{Name:"vpc-id",Values:[t.vpc]}]:void 0,Z=(await I.describeRouteTables({Filters:z})).RouteTables||[];if(L.succeed(`Found ${Z.length} route table(s)`),Z.length===0){e("No route tables found");return}c(["Route Table ID","VPC","Name","Main","Associations","Routes"],Z.map((X)=>[X.RouteTableId||"N/A",X.VpcId||"N/A",X.Tags?.find((ie)=>ie.Key==="Name")?.Value||"-",X.Associations?.some((ie)=>ie.Main)?"Yes":"No",(X.Associations?.length||0).toString(),(X.Routes?.length||0).toString()]))}catch(m){r(`Failed to list route tables: ${m.message}`),process.exit(1)}})}function Pl(R){R.command("scheduler:list","List all EventBridge schedules").option("--region <region>","AWS region").option("--group <name>","Schedule group name",{default:"default"}).action(async(t)=>{i("EventBridge Schedules");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new Ue(k),L=new s("Fetching schedules...");L.start();let Y=(await I.listSchedules({GroupName:t.group})).Schedules||[];if(L.succeed(`Found ${Y.length} schedule(s)`),Y.length===0){e("No schedules found"),e("Use `cloud scheduler:create` to create a new schedule");return}c(["Name","State","Schedule Expression","Group"],Y.map((Z)=>[Z.Name||"N/A",Z.State||"N/A",Z.ScheduleExpression||"N/A",Z.GroupName||"default"]))}catch(m){r(`Failed to list schedules: ${m.message}`),process.exit(1)}}),R.command("scheduler:create <name>","Create a new EventBridge schedule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--schedule <expression>","Schedule expression (rate or cron)").option("--target-arn <arn>","Target ARN (Lambda, SQS, SNS, etc.)").option("--role-arn <arn>","IAM role ARN for scheduler").option("--input <json>","JSON input to pass to target").option("--group <name>","Schedule group name",{default:"default"}).option("--timezone <tz>","Timezone for cron expressions",{default:"UTC"}).option("--description <text>","Schedule description").option("--start <datetime>","Start date/time (ISO 8601)").option("--end <datetime>","End date/time (ISO 8601)").action(async(t,m)=>{i("Create EventBridge Schedule");try{if(!m.schedule){r("--schedule is required"),e("Examples:"),e("  Rate: rate(5 minutes), rate(1 hour), rate(1 day)"),e("  Cron: cron(0 12 * * ? *) - every day at 12:00 UTC");return}if(!m.targetArn){r("--target-arn is required");return}if(!m.roleArn){r("--role-arn is required"),e("The role must have permissions to invoke the target.");return}let k=new Ue(m.region);if(e(`Name: ${t}`),e(`Schedule: ${m.schedule}`),e(`Target: ${m.targetArn}`),e(`Group: ${m.group}`),e(`Timezone: ${m.timezone}`),!await d(`
+To add rules:`),e(`  cloud network:sg-rule ${Z.GroupId} --inbound --port 443 --cidr 0.0.0.0/0`)}catch(I){r(`Failed to create security group: ${I.message}`),process.exit(1)}}),R.command("network:sg-rule <groupId>","Add a rule to a security group").option("--region <region>","AWS region",{default:"us-east-1"}).option("--inbound","Add inbound rule").option("--outbound","Add outbound rule").option("--protocol <protocol>","Protocol (tcp, udp, icmp, or -1 for all)",{default:"tcp"}).option("--port <port>","Port number or range (e.g., 80 or 80-443)").option("--cidr <cidr>","CIDR block (e.g., 0.0.0.0/0)").option("--source-group <groupId>","Source security group").option("--description <desc>","Rule description").action(async(t,m)=>{i("Add Security Group Rule");try{let k=new Q(m.region);if(!m.inbound&&!m.outbound){r("Specify --inbound or --outbound");return}if(!m.cidr&&!m.sourceGroup){r("Specify --cidr or --source-group");return}let I,L;if(m.port)if(m.port.includes("-")){let[oe,se]=m.port.split("-");I=Number.parseInt(oe),L=Number.parseInt(se)}else I=Number.parseInt(m.port),L=I;else if(m.protocol!=="-1"){r("Port is required for TCP/UDP protocols");return}let z=m.inbound?"Inbound":"Outbound",Y=m.protocol==="-1"?"All":I===L?I:`${I}-${L}`;if(e(`Security Group: ${t}`),e(`Direction: ${z}`),e(`Protocol: ${m.protocol}`),e(`Port(s): ${Y}`),e(`Source: ${m.cidr||m.sourceGroup}`),!await d(`
+Add this rule?`,!0)){e("Operation cancelled");return}let X=new s("Adding rule...");X.start();let ee={IpProtocol:m.protocol,FromPort:I,ToPort:L};if(m.cidr)ee.IpRanges=[{CidrIp:m.cidr,Description:m.description}];if(m.sourceGroup)ee.UserIdGroupPairs=[{GroupId:m.sourceGroup,Description:m.description}];if(m.inbound)await k.authorizeSecurityGroupIngress({GroupId:t,IpPermissions:[ee]});else await k.authorizeSecurityGroupEgress({GroupId:t,IpPermissions:[ee]});X.succeed("Rule added")}catch(k){r(`Failed to add rule: ${k.message}`),process.exit(1)}}),R.command("network:elastic-ips","List Elastic IP addresses").option("--region <region>","AWS region").action(async(t)=>{i("Elastic IP Addresses");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new Q(k),L=new s("Fetching Elastic IPs...");L.start();let Y=(await I.describeAddresses()).Addresses||[];if(L.succeed(`Found ${Y.length} Elastic IP(s)`),Y.length===0){e("No Elastic IPs found");return}c(["Public IP","Allocation ID","Association ID","Instance","Name"],Y.map((Z)=>[Z.PublicIp||"N/A",Z.AllocationId||"N/A",Z.AssociationId||"-",Z.InstanceId||"-",Z.Tags?.find((X)=>X.Key==="Name")?.Value||"-"]))}catch(m){r(`Failed to list Elastic IPs: ${m.message}`),process.exit(1)}}),R.command("network:route-tables","List route tables").option("--region <region>","AWS region").option("--vpc <vpcId>","Filter by VPC ID").action(async(t)=>{i("Route Tables");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new Q(k),L=new s("Fetching route tables...");L.start();let z=t.vpc?[{Name:"vpc-id",Values:[t.vpc]}]:void 0,Z=(await I.describeRouteTables({Filters:z})).RouteTables||[];if(L.succeed(`Found ${Z.length} route table(s)`),Z.length===0){e("No route tables found");return}c(["Route Table ID","VPC","Name","Main","Associations","Routes"],Z.map((X)=>[X.RouteTableId||"N/A",X.VpcId||"N/A",X.Tags?.find((ee)=>ee.Key==="Name")?.Value||"-",X.Associations?.some((ee)=>ee.Main)?"Yes":"No",(X.Associations?.length||0).toString(),(X.Routes?.length||0).toString()]))}catch(m){r(`Failed to list route tables: ${m.message}`),process.exit(1)}})}function Pl(R){R.command("scheduler:list","List all EventBridge schedules").option("--region <region>","AWS region").option("--group <name>","Schedule group name",{default:"default"}).action(async(t)=>{i("EventBridge Schedules");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new Be(k),L=new s("Fetching schedules...");L.start();let Y=(await I.listSchedules({GroupName:t.group})).Schedules||[];if(L.succeed(`Found ${Y.length} schedule(s)`),Y.length===0){e("No schedules found"),e("Use `cloud scheduler:create` to create a new schedule");return}c(["Name","State","Schedule Expression","Group"],Y.map((Z)=>[Z.Name||"N/A",Z.State||"N/A",Z.ScheduleExpression||"N/A",Z.GroupName||"default"]))}catch(m){r(`Failed to list schedules: ${m.message}`),process.exit(1)}}),R.command("scheduler:create <name>","Create a new EventBridge schedule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--schedule <expression>","Schedule expression (rate or cron)").option("--target-arn <arn>","Target ARN (Lambda, SQS, SNS, etc.)").option("--role-arn <arn>","IAM role ARN for scheduler").option("--input <json>","JSON input to pass to target").option("--group <name>","Schedule group name",{default:"default"}).option("--timezone <tz>","Timezone for cron expressions",{default:"UTC"}).option("--description <text>","Schedule description").option("--start <datetime>","Start date/time (ISO 8601)").option("--end <datetime>","End date/time (ISO 8601)").action(async(t,m)=>{i("Create EventBridge Schedule");try{if(!m.schedule){r("--schedule is required"),e("Examples:"),e("  Rate: rate(5 minutes), rate(1 hour), rate(1 day)"),e("  Cron: cron(0 12 * * ? *) - every day at 12:00 UTC");return}if(!m.targetArn){r("--target-arn is required");return}if(!m.roleArn){r("--role-arn is required"),e("The role must have permissions to invoke the target.");return}let k=new Be(m.region);if(e(`Name: ${t}`),e(`Schedule: ${m.schedule}`),e(`Target: ${m.targetArn}`),e(`Group: ${m.group}`),e(`Timezone: ${m.timezone}`),!await d(`
 Create this schedule?`,!0)){e("Operation cancelled");return}let L=new s("Creating schedule...");L.start(),await k.createSchedule({Name:t,GroupName:m.group,ScheduleExpression:m.schedule,ScheduleExpressionTimezone:m.timezone,Description:m.description,State:"ENABLED",FlexibleTimeWindow:{Mode:"OFF"},Target:{Arn:m.targetArn,RoleArn:m.roleArn,Input:m.input},StartDate:m.start?new Date(m.start):void 0,EndDate:m.end?new Date(m.end):void 0}),L.succeed("Schedule created"),n(`
-Schedule: ${t}`),e(`Expression: ${m.schedule}`)}catch(k){r(`Failed to create schedule: ${k.message}`),process.exit(1)}}),R.command("scheduler:delete <name>","Delete an EventBridge schedule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--group <name>","Schedule group name",{default:"default"}).action(async(t,m)=>{i("Delete EventBridge Schedule");try{let k=new Ue(m.region);if(a(`This will delete schedule: ${t}`),!await d(`
-Delete this schedule?`,!1)){e("Operation cancelled");return}let L=new s("Deleting schedule...");L.start(),await k.deleteSchedule({Name:t,GroupName:m.group}),L.succeed("Schedule deleted")}catch(k){r(`Failed to delete schedule: ${k.message}`),process.exit(1)}}),R.command("scheduler:enable <name>","Enable an EventBridge schedule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--group <name>","Schedule group name",{default:"default"}).action(async(t,m)=>{i("Enable EventBridge Schedule");try{let k=new Ue(m.region),I=new s("Getting schedule...");I.start();let L=await k.getSchedule({Name:t,GroupName:m.group});if(!L){I.fail("Schedule not found");return}I.text="Enabling schedule...",await k.updateSchedule({Name:t,GroupName:m.group,ScheduleExpression:L.ScheduleExpression,ScheduleExpressionTimezone:L.ScheduleExpressionTimezone,FlexibleTimeWindow:L.FlexibleTimeWindow,Target:L.Target,State:"ENABLED"}),I.succeed("Schedule enabled")}catch(k){r(`Failed to enable schedule: ${k.message}`),process.exit(1)}}),R.command("scheduler:disable <name>","Disable an EventBridge schedule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--group <name>","Schedule group name",{default:"default"}).action(async(t,m)=>{i("Disable EventBridge Schedule");try{let k=new Ue(m.region),I=new s("Getting schedule...");I.start();let L=await k.getSchedule({Name:t,GroupName:m.group});if(!L){I.fail("Schedule not found");return}I.text="Disabling schedule...",await k.updateSchedule({Name:t,GroupName:m.group,ScheduleExpression:L.ScheduleExpression,ScheduleExpressionTimezone:L.ScheduleExpressionTimezone,FlexibleTimeWindow:L.FlexibleTimeWindow,Target:L.Target,State:"DISABLED"}),I.succeed("Schedule disabled")}catch(k){r(`Failed to disable schedule: ${k.message}`),process.exit(1)}}),R.command("scheduler:describe <name>","Show EventBridge schedule details").option("--region <region>","AWS region",{default:"us-east-1"}).option("--group <name>","Schedule group name",{default:"default"}).action(async(t,m)=>{i(`Schedule: ${t}`);try{let k=new Ue(m.region),I=new s("Fetching schedule...");I.start();let L=await k.getSchedule({Name:t,GroupName:m.group});if(!L){I.fail("Schedule not found");return}if(I.succeed("Schedule loaded"),e(`
+Schedule: ${t}`),e(`Expression: ${m.schedule}`)}catch(k){r(`Failed to create schedule: ${k.message}`),process.exit(1)}}),R.command("scheduler:delete <name>","Delete an EventBridge schedule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--group <name>","Schedule group name",{default:"default"}).action(async(t,m)=>{i("Delete EventBridge Schedule");try{let k=new Be(m.region);if(a(`This will delete schedule: ${t}`),!await d(`
+Delete this schedule?`,!1)){e("Operation cancelled");return}let L=new s("Deleting schedule...");L.start(),await k.deleteSchedule({Name:t,GroupName:m.group}),L.succeed("Schedule deleted")}catch(k){r(`Failed to delete schedule: ${k.message}`),process.exit(1)}}),R.command("scheduler:enable <name>","Enable an EventBridge schedule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--group <name>","Schedule group name",{default:"default"}).action(async(t,m)=>{i("Enable EventBridge Schedule");try{let k=new Be(m.region),I=new s("Getting schedule...");I.start();let L=await k.getSchedule({Name:t,GroupName:m.group});if(!L){I.fail("Schedule not found");return}I.text="Enabling schedule...",await k.updateSchedule({Name:t,GroupName:m.group,ScheduleExpression:L.ScheduleExpression,ScheduleExpressionTimezone:L.ScheduleExpressionTimezone,FlexibleTimeWindow:L.FlexibleTimeWindow,Target:L.Target,State:"ENABLED"}),I.succeed("Schedule enabled")}catch(k){r(`Failed to enable schedule: ${k.message}`),process.exit(1)}}),R.command("scheduler:disable <name>","Disable an EventBridge schedule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--group <name>","Schedule group name",{default:"default"}).action(async(t,m)=>{i("Disable EventBridge Schedule");try{let k=new Be(m.region),I=new s("Getting schedule...");I.start();let L=await k.getSchedule({Name:t,GroupName:m.group});if(!L){I.fail("Schedule not found");return}I.text="Disabling schedule...",await k.updateSchedule({Name:t,GroupName:m.group,ScheduleExpression:L.ScheduleExpression,ScheduleExpressionTimezone:L.ScheduleExpressionTimezone,FlexibleTimeWindow:L.FlexibleTimeWindow,Target:L.Target,State:"DISABLED"}),I.succeed("Schedule disabled")}catch(k){r(`Failed to disable schedule: ${k.message}`),process.exit(1)}}),R.command("scheduler:describe <name>","Show EventBridge schedule details").option("--region <region>","AWS region",{default:"us-east-1"}).option("--group <name>","Schedule group name",{default:"default"}).action(async(t,m)=>{i(`Schedule: ${t}`);try{let k=new Be(m.region),I=new s("Fetching schedule...");I.start();let L=await k.getSchedule({Name:t,GroupName:m.group});if(!L){I.fail("Schedule not found");return}if(I.succeed("Schedule loaded"),e(`
 Schedule Information:`),e(`  Name: ${L.Name}`),e(`  ARN: ${L.Arn}`),e(`  Group: ${L.GroupName}`),e(`  State: ${L.State}`),e(`  Expression: ${L.ScheduleExpression}`),e(`  Timezone: ${L.ScheduleExpressionTimezone}`),L.Description)e(`  Description: ${L.Description}`);if(L.Target){if(e(`
 Target:`),e(`  ARN: ${L.Target.Arn}`),e(`  Role ARN: ${L.Target.RoleArn}`),L.Target.Input)e(`  Input: ${L.Target.Input}`)}if(e(`
 Flexible Time Window:`),e(`  Mode: ${L.FlexibleTimeWindow?.Mode}`),L.FlexibleTimeWindow?.MaximumWindowInMinutes)e(`  Max Window: ${L.FlexibleTimeWindow.MaximumWindowInMinutes} minutes`);if(L.StartDate)e(`
 Start Date: ${L.StartDate}`);if(L.EndDate)e(`End Date: ${L.EndDate}`);e(`
-Created: ${L.CreationDate||"N/A"}`),e(`Last Modified: ${L.LastModificationDate||"N/A"}`)}catch(k){r(`Failed to get schedule: ${k.message}`),process.exit(1)}}),R.command("scheduler:groups","List schedule groups").option("--region <region>","AWS region").action(async(t)=>{i("Schedule Groups");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new Ue(k),L=new s("Fetching groups...");L.start();let Y=(await I.listScheduleGroups()).ScheduleGroups||[];if(L.succeed(`Found ${Y.length} group(s)`),Y.length===0){e("No schedule groups found");return}c(["Name","State","Created"],Y.map((Z)=>[Z.Name||"N/A",Z.State||"N/A",Z.CreationDate?new Date(Z.CreationDate).toLocaleString():"N/A"]))}catch(m){r(`Failed to list groups: ${m.message}`),process.exit(1)}})}function xl(R){R.command("events:list","List all EventBridge rules").option("--region <region>","AWS region").option("--bus <name>","Event bus name",{default:"default"}).action(async(t)=>{i("EventBridge Rules");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new ve(k),L=new s("Fetching rules...");L.start();let Y=(await I.listRules({EventBusName:t.bus})).Rules||[];if(L.succeed(`Found ${Y.length} rule(s)`),Y.length===0){e("No EventBridge rules found"),e("Use `cloud events:create` to create a new rule");return}c(["Name","State","Schedule/Pattern","Description"],Y.map((Z)=>[Z.Name||"N/A",Z.State||"N/A",Z.ScheduleExpression||(Z.EventPattern?"Event Pattern":"N/A"),(Z.Description||"").substring(0,40)]))}catch(m){r(`Failed to list rules: ${m.message}`),process.exit(1)}}),R.command("events:create <name>","Create a new EventBridge rule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--bus <name>","Event bus name",{default:"default"}).option("--schedule <expression>","Schedule expression (rate or cron)").option("--pattern <json>","Event pattern JSON").option("--pattern-file <path>","Event pattern from JSON file").option("--description <text>","Rule description").option("--disabled","Create in disabled state").action(async(t,m)=>{i("Create EventBridge Rule");try{if(!m.schedule&&!m.pattern&&!m.patternFile){r("Either --schedule or --pattern/--pattern-file is required"),e(`
-Examples:`),e('  Schedule: --schedule "rate(5 minutes)"'),e(`  Pattern:  --pattern '{"source": ["aws.ec2"]}'`);return}let k=new ve(m.region),I;if(m.patternFile)I=await Bun.file(m.patternFile).text();else if(m.pattern)I=m.pattern;if(e(`Name: ${t}`),e(`Event Bus: ${m.bus}`),m.schedule)e(`Schedule: ${m.schedule}`);if(I)e(`Event Pattern: ${I}`);if(e(`State: ${m.disabled?"DISABLED":"ENABLED"}`),!await d(`
+Created: ${L.CreationDate||"N/A"}`),e(`Last Modified: ${L.LastModificationDate||"N/A"}`)}catch(k){r(`Failed to get schedule: ${k.message}`),process.exit(1)}}),R.command("scheduler:groups","List schedule groups").option("--region <region>","AWS region").action(async(t)=>{i("Schedule Groups");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new Be(k),L=new s("Fetching groups...");L.start();let Y=(await I.listScheduleGroups()).ScheduleGroups||[];if(L.succeed(`Found ${Y.length} group(s)`),Y.length===0){e("No schedule groups found");return}c(["Name","State","Created"],Y.map((Z)=>[Z.Name||"N/A",Z.State||"N/A",Z.CreationDate?new Date(Z.CreationDate).toLocaleString():"N/A"]))}catch(m){r(`Failed to list groups: ${m.message}`),process.exit(1)}})}function xl(R){R.command("events:list","List all EventBridge rules").option("--region <region>","AWS region").option("--bus <name>","Event bus name",{default:"default"}).action(async(t)=>{i("EventBridge Rules");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new Ce(k),L=new s("Fetching rules...");L.start();let Y=(await I.listRules({EventBusName:t.bus})).Rules||[];if(L.succeed(`Found ${Y.length} rule(s)`),Y.length===0){e("No EventBridge rules found"),e("Use `cloud events:create` to create a new rule");return}c(["Name","State","Schedule/Pattern","Description"],Y.map((Z)=>[Z.Name||"N/A",Z.State||"N/A",Z.ScheduleExpression||(Z.EventPattern?"Event Pattern":"N/A"),(Z.Description||"").substring(0,40)]))}catch(m){r(`Failed to list rules: ${m.message}`),process.exit(1)}}),R.command("events:create <name>","Create a new EventBridge rule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--bus <name>","Event bus name",{default:"default"}).option("--schedule <expression>","Schedule expression (rate or cron)").option("--pattern <json>","Event pattern JSON").option("--pattern-file <path>","Event pattern from JSON file").option("--description <text>","Rule description").option("--disabled","Create in disabled state").action(async(t,m)=>{i("Create EventBridge Rule");try{if(!m.schedule&&!m.pattern&&!m.patternFile){r("Either --schedule or --pattern/--pattern-file is required"),e(`
+Examples:`),e('  Schedule: --schedule "rate(5 minutes)"'),e(`  Pattern:  --pattern '{"source": ["aws.ec2"]}'`);return}let k=new Ce(m.region),I;if(m.patternFile)I=await Bun.file(m.patternFile).text();else if(m.pattern)I=m.pattern;if(e(`Name: ${t}`),e(`Event Bus: ${m.bus}`),m.schedule)e(`Schedule: ${m.schedule}`);if(I)e(`Event Pattern: ${I}`);if(e(`State: ${m.disabled?"DISABLED":"ENABLED"}`),!await d(`
 Create this rule?`,!0)){e("Operation cancelled");return}let z=new s("Creating rule...");z.start();let Y=await k.putRule({Name:t,EventBusName:m.bus,ScheduleExpression:m.schedule,EventPattern:I,Description:m.description,State:m.disabled?"DISABLED":"ENABLED"});z.succeed("Rule created"),n(`
-Rule ARN: ${Y.RuleArn}`),e("\nNote: Add targets to the rule with `cloud events:target`")}catch(k){r(`Failed to create rule: ${k.message}`),process.exit(1)}}),R.command("events:delete <name>","Delete an EventBridge rule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--bus <name>","Event bus name",{default:"default"}).option("--force","Remove all targets and delete rule").action(async(t,m)=>{i("Delete EventBridge Rule");try{let k=new ve(m.region);if(a(`This will delete rule: ${t}`),!await d(`
+Rule ARN: ${Y.RuleArn}`),e("\nNote: Add targets to the rule with `cloud events:target`")}catch(k){r(`Failed to create rule: ${k.message}`),process.exit(1)}}),R.command("events:delete <name>","Delete an EventBridge rule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--bus <name>","Event bus name",{default:"default"}).option("--force","Remove all targets and delete rule").action(async(t,m)=>{i("Delete EventBridge Rule");try{let k=new Ce(m.region);if(a(`This will delete rule: ${t}`),!await d(`
 Delete this rule?`,!1)){e("Operation cancelled");return}let L=new s("Checking targets...");L.start();let z=await k.listTargetsByRule({Rule:t,EventBusName:m.bus});if(z.Targets&&z.Targets.length>0){if(!m.force){L.fail("Rule has targets"),e(`
-The rule has ${z.Targets.length} target(s).`),e("Use --force to remove targets and delete the rule.");return}L.text="Removing targets...",await k.removeTargets({Rule:t,EventBusName:m.bus,Ids:z.Targets.map((Y)=>Y.Id)})}L.text="Deleting rule...",await k.deleteRule({Name:t,EventBusName:m.bus}),L.succeed("Rule deleted")}catch(k){r(`Failed to delete rule: ${k.message}`),process.exit(1)}}),R.command("events:describe <name>","Show EventBridge rule details").option("--region <region>","AWS region",{default:"us-east-1"}).option("--bus <name>","Event bus name",{default:"default"}).action(async(t,m)=>{i(`Rule: ${t}`);try{let k=new ve(m.region),I=new s("Fetching rule...");I.start();let L=await k.describeRule({Name:t,EventBusName:m.bus});if(!L){I.fail("Rule not found");return}let z=await k.listTargetsByRule({Rule:t,EventBusName:m.bus});if(I.succeed("Rule loaded"),e(`
+The rule has ${z.Targets.length} target(s).`),e("Use --force to remove targets and delete the rule.");return}L.text="Removing targets...",await k.removeTargets({Rule:t,EventBusName:m.bus,Ids:z.Targets.map((Y)=>Y.Id)})}L.text="Deleting rule...",await k.deleteRule({Name:t,EventBusName:m.bus}),L.succeed("Rule deleted")}catch(k){r(`Failed to delete rule: ${k.message}`),process.exit(1)}}),R.command("events:describe <name>","Show EventBridge rule details").option("--region <region>","AWS region",{default:"us-east-1"}).option("--bus <name>","Event bus name",{default:"default"}).action(async(t,m)=>{i(`Rule: ${t}`);try{let k=new Ce(m.region),I=new s("Fetching rule...");I.start();let L=await k.describeRule({Name:t,EventBusName:m.bus});if(!L){I.fail("Rule not found");return}let z=await k.listTargetsByRule({Rule:t,EventBusName:m.bus});if(I.succeed("Rule loaded"),e(`
 Rule Information:`),e(`  Name: ${L.Name}`),e(`  ARN: ${L.Arn}`),e(`  State: ${L.State}`),e(`  Event Bus: ${L.EventBusName}`),L.Description)e(`  Description: ${L.Description}`);if(L.ScheduleExpression)e(`
 Schedule Expression: ${L.ScheduleExpression}`);if(L.EventPattern)e(`
 Event Pattern:`),console.log(JSON.stringify(JSON.parse(L.EventPattern),null,2));if(z.Targets&&z.Targets.length>0){e(`
 Targets (${z.Targets.length}):`);for(let Y of z.Targets)if(e(`  - ${Y.Id}: ${Y.Arn}`),Y.Input)e(`    Input: ${Y.Input}`)}else e(`
-No targets configured.`)}catch(k){r(`Failed to get rule: ${k.message}`),process.exit(1)}}),R.command("events:target <ruleName>","Add a target to an EventBridge rule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--bus <name>","Event bus name",{default:"default"}).option("--id <id>","Target ID").option("--arn <arn>","Target ARN (Lambda, SQS, SNS, etc.)").option("--role <arn>","IAM role ARN (for some targets)").option("--input <json>","Constant JSON input").option("--input-path <path>","JSONPath expression for input").action(async(t,m)=>{i("Add EventBridge Target");try{if(!m.arn){r("--arn is required");return}let k=new ve(m.region),I=m.id||`target-${Date.now()}`;if(e(`Rule: ${t}`),e(`Target ID: ${I}`),e(`Target ARN: ${m.arn}`),!await d(`
+No targets configured.`)}catch(k){r(`Failed to get rule: ${k.message}`),process.exit(1)}}),R.command("events:target <ruleName>","Add a target to an EventBridge rule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--bus <name>","Event bus name",{default:"default"}).option("--id <id>","Target ID").option("--arn <arn>","Target ARN (Lambda, SQS, SNS, etc.)").option("--role <arn>","IAM role ARN (for some targets)").option("--input <json>","Constant JSON input").option("--input-path <path>","JSONPath expression for input").action(async(t,m)=>{i("Add EventBridge Target");try{if(!m.arn){r("--arn is required");return}let k=new Ce(m.region),I=m.id||`target-${Date.now()}`;if(e(`Rule: ${t}`),e(`Target ID: ${I}`),e(`Target ARN: ${m.arn}`),!await d(`
 Add this target?`,!0)){e("Operation cancelled");return}let z=new s("Adding target...");z.start();let Y={Id:I,Arn:m.arn};if(m.role)Y.RoleArn=m.role;if(m.input)Y.Input=m.input;if(m.inputPath)Y.InputPath=m.inputPath;await k.putTargets({Rule:t,EventBusName:m.bus,Targets:[Y]}),z.succeed("Target added"),n(`
-Target ${I} added to rule ${t}`)}catch(k){r(`Failed to add target: ${k.message}`),process.exit(1)}}),R.command("events:buses","List event buses").option("--region <region>","AWS region").action(async(t)=>{i("Event Buses");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new ve(k),L=new s("Fetching event buses...");L.start();let Y=(await I.listEventBuses()).EventBuses||[];if(L.succeed(`Found ${Y.length} event bus(es)`),Y.length===0){e("No event buses found");return}c(["Name","ARN","Policy"],Y.map((Z)=>[Z.Name||"N/A",Z.Arn||"N/A",Z.Policy?"Custom":"Default"]))}catch(m){r(`Failed to list event buses: ${m.message}`),process.exit(1)}}),R.command("events:enable <name>","Enable an EventBridge rule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--bus <name>","Event bus name",{default:"default"}).action(async(t,m)=>{i("Enable EventBridge Rule");try{let k=new ve(m.region),I=new s("Enabling rule...");I.start(),await k.enableRule({Name:t,EventBusName:m.bus}),I.succeed("Rule enabled")}catch(k){r(`Failed to enable rule: ${k.message}`),process.exit(1)}}),R.command("events:disable <name>","Disable an EventBridge rule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--bus <name>","Event bus name",{default:"default"}).action(async(t,m)=>{i("Disable EventBridge Rule");try{let k=new ve(m.region),I=new s("Disabling rule...");I.start(),await k.disableRule({Name:t,EventBusName:m.bus}),I.succeed("Rule disabled")}catch(k){r(`Failed to disable rule: ${k.message}`),process.exit(1)}})}function Dl(R){R.command("email:identities","List verified email identities").option("--region <region>","AWS region").action(async(t)=>{i("Email Identities");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new we(k),L=new s("Fetching identities...");L.start();let Y=(await I.listEmailIdentities()).EmailIdentities||[];if(L.succeed(`Found ${Y.length} identity(s)`),Y.length===0){e("No email identities found"),e("Use `cloud email:verify` to verify an email or domain");return}let Z=[];for(let X of Y){let ie=X.IdentityName||"Unknown",oe="Unknown";try{oe=(await I.getEmailIdentity(ie)).VerificationStatus||"Unknown"}catch{}let ae=X.IdentityType==="EMAIL_ADDRESS"?"Email":X.IdentityType==="DOMAIN"?"Domain":X.IdentityType||"Unknown";Z.push([ie,ae,oe])}c(["Identity","Type","Verification Status"],Z)}catch(m){let k=m instanceof Error?m.message:String(m);r(`Failed to list identities: ${k}`),process.exit(1)}}),R.command("email:verify <identity>","Verify an email address or domain").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Verify Email Identity");try{let k=new we(m.region),I=t.includes("@");if(e(`Identity: ${t}`),e(`Type: ${I?"Email Address":"Domain"}`),!await d(`
+Target ${I} added to rule ${t}`)}catch(k){r(`Failed to add target: ${k.message}`),process.exit(1)}}),R.command("events:buses","List event buses").option("--region <region>","AWS region").action(async(t)=>{i("Event Buses");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new Ce(k),L=new s("Fetching event buses...");L.start();let Y=(await I.listEventBuses()).EventBuses||[];if(L.succeed(`Found ${Y.length} event bus(es)`),Y.length===0){e("No event buses found");return}c(["Name","ARN","Policy"],Y.map((Z)=>[Z.Name||"N/A",Z.Arn||"N/A",Z.Policy?"Custom":"Default"]))}catch(m){r(`Failed to list event buses: ${m.message}`),process.exit(1)}}),R.command("events:enable <name>","Enable an EventBridge rule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--bus <name>","Event bus name",{default:"default"}).action(async(t,m)=>{i("Enable EventBridge Rule");try{let k=new Ce(m.region),I=new s("Enabling rule...");I.start(),await k.enableRule({Name:t,EventBusName:m.bus}),I.succeed("Rule enabled")}catch(k){r(`Failed to enable rule: ${k.message}`),process.exit(1)}}),R.command("events:disable <name>","Disable an EventBridge rule").option("--region <region>","AWS region",{default:"us-east-1"}).option("--bus <name>","Event bus name",{default:"default"}).action(async(t,m)=>{i("Disable EventBridge Rule");try{let k=new Ce(m.region),I=new s("Disabling rule...");I.start(),await k.disableRule({Name:t,EventBusName:m.bus}),I.succeed("Rule disabled")}catch(k){r(`Failed to disable rule: ${k.message}`),process.exit(1)}})}function Dl(R){R.command("email:identities","List verified email identities").option("--region <region>","AWS region").action(async(t)=>{i("Email Identities");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new Ae(k),L=new s("Fetching identities...");L.start();let Y=(await I.listEmailIdentities()).EmailIdentities||[];if(L.succeed(`Found ${Y.length} identity(s)`),Y.length===0){e("No email identities found"),e("Use `cloud email:verify` to verify an email or domain");return}let Z=[];for(let X of Y){let ee=X.IdentityName||"Unknown",oe="Unknown";try{oe=(await I.getEmailIdentity(ee)).VerificationStatus||"Unknown"}catch{}let se=X.IdentityType==="EMAIL_ADDRESS"?"Email":X.IdentityType==="DOMAIN"?"Domain":X.IdentityType||"Unknown";Z.push([ee,se,oe])}c(["Identity","Type","Verification Status"],Z)}catch(m){let k=m instanceof Error?m.message:String(m);r(`Failed to list identities: ${k}`),process.exit(1)}}),R.command("email:verify <identity>","Verify an email address or domain").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Verify Email Identity");try{let k=new Ae(m.region),I=t.includes("@");if(e(`Identity: ${t}`),e(`Type: ${I?"Email Address":"Domain"}`),!await d(`
 Send verification?`,!0)){e("Operation cancelled");return}let z=new s("Initiating verification...");if(z.start(),I)await k.createEmailIdentity({EmailIdentity:t}),z.succeed("Verification email sent"),e(`
 A verification email has been sent to ${t}`),e("Click the link in the email to complete verification.");else{let Y=await k.verifyDomain(t);z.succeed("Domain verification initiated");let Z=Y.dkimTokens||[];if(Z.length>0){e(`
 DKIM Records (for email authentication):`);for(let X of Z)e(`
   Name:  ${X}._domainkey.${t}`),e("  Type:  CNAME"),e(`  Value: ${X}.dkim.amazonses.com`)}e(`
-Verification Status: ${Y.verificationStatus||"PENDING"}`)}}catch(k){let I=k instanceof Error?k.message:String(k);r(`Failed to verify identity: ${I}`),process.exit(1)}}),R.command("email:delete <identity>","Delete a verified email identity").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Delete Email Identity");try{let k=new we(m.region);if(a(`This will remove identity: ${t}`),!await d(`
-Delete this identity?`,!1)){e("Operation cancelled");return}let L=new s("Deleting identity...");L.start(),await k.deleteEmailIdentity(t),L.succeed("Identity deleted")}catch(k){let I=k instanceof Error?k.message:String(k);r(`Failed to delete identity: ${I}`),process.exit(1)}}),R.command("email:send","Send a test email").option("--region <region>","AWS region",{default:"us-east-1"}).option("--from <email>","From email address (must be verified)").option("--to <email>","To email address").option("--subject <text>","Email subject").option("--body <text>","Email body (text)").option("--html <html>","Email body (HTML)").action(async(t)=>{i("Send Email");try{let m=new we(t.region),k=t.from||await P("From (verified email)"),I=t.to||await P("To"),L=t.subject||await P("Subject","Test Email from ts-cloud"),z=t.body||await P("Body","This is a test email sent from ts-cloud CLI.");if(e(`
+Verification Status: ${Y.verificationStatus||"PENDING"}`)}}catch(k){let I=k instanceof Error?k.message:String(k);r(`Failed to verify identity: ${I}`),process.exit(1)}}),R.command("email:delete <identity>","Delete a verified email identity").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Delete Email Identity");try{let k=new Ae(m.region);if(a(`This will remove identity: ${t}`),!await d(`
+Delete this identity?`,!1)){e("Operation cancelled");return}let L=new s("Deleting identity...");L.start(),await k.deleteEmailIdentity(t),L.succeed("Identity deleted")}catch(k){let I=k instanceof Error?k.message:String(k);r(`Failed to delete identity: ${I}`),process.exit(1)}}),R.command("email:send","Send a test email").option("--region <region>","AWS region",{default:"us-east-1"}).option("--from <email>","From email address (must be verified)").option("--to <email>","To email address").option("--subject <text>","Email subject").option("--body <text>","Email body (text)").option("--html <html>","Email body (HTML)").action(async(t)=>{i("Send Email");try{let m=new Ae(t.region),k=t.from||await P("From (verified email)"),I=t.to||await P("To"),L=t.subject||await P("Subject","Test Email from ts-cloud"),z=t.body||await P("Body","This is a test email sent from ts-cloud CLI.");if(e(`
 From: ${k}`),e(`To: ${I}`),e(`Subject: ${L}`),!await d(`
 Send this email?`,!0)){e("Operation cancelled");return}let Z=new s("Sending email...");Z.start();let X=await m.sendEmail({FromEmailAddress:k,Destination:{ToAddresses:[I]},Content:{Simple:{Subject:{Data:L},Body:{Text:{Data:z},...t.html&&{Html:{Data:t.html}}}}}});Z.succeed("Email sent"),n(`
-Message ID: ${X.MessageId}`)}catch(m){let k=m instanceof Error?m.message:String(m);r(`Failed to send email: ${k}`),process.exit(1)}}),R.command("email:templates","List email templates").option("--region <region>","AWS region").action(async(t)=>{i("Email Templates");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new we(k),L=new s("Fetching templates...");L.start();let Y=(await I.listEmailTemplates()).TemplatesMetadata||[];if(L.succeed(`Found ${Y.length} template(s)`),Y.length===0){e("No email templates found"),e("Use `cloud email:template:create` to create a template");return}c(["Name","Created"],Y.map((Z)=>[Z.TemplateName||"N/A",Z.CreatedTimestamp?new Date(Z.CreatedTimestamp).toLocaleString():"N/A"]))}catch(m){let k=m instanceof Error?m.message:String(m);r(`Failed to list templates: ${k}`),process.exit(1)}}),R.command("email:template:create <name>","Create an email template").option("--region <region>","AWS region",{default:"us-east-1"}).option("--subject <text>","Email subject (supports {{variable}} placeholders)").option("--text <text>","Text body").option("--html <html>","HTML body").option("--html-file <path>","HTML body from file").action(async(t,m)=>{i("Create Email Template");try{let k=new we(m.region),I=m.subject||await P("Subject template","Hello {{name}}"),L=m.text||await P("Text body","Hello {{name}}, this is a test."),z=m.html;if(m.htmlFile)z=await Bun.file(m.htmlFile).text();if(e(`
+Message ID: ${X.MessageId}`)}catch(m){let k=m instanceof Error?m.message:String(m);r(`Failed to send email: ${k}`),process.exit(1)}}),R.command("email:templates","List email templates").option("--region <region>","AWS region").action(async(t)=>{i("Email Templates");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new Ae(k),L=new s("Fetching templates...");L.start();let Y=(await I.listEmailTemplates()).TemplatesMetadata||[];if(L.succeed(`Found ${Y.length} template(s)`),Y.length===0){e("No email templates found"),e("Use `cloud email:template:create` to create a template");return}c(["Name","Created"],Y.map((Z)=>[Z.TemplateName||"N/A",Z.CreatedTimestamp?new Date(Z.CreatedTimestamp).toLocaleString():"N/A"]))}catch(m){let k=m instanceof Error?m.message:String(m);r(`Failed to list templates: ${k}`),process.exit(1)}}),R.command("email:template:create <name>","Create an email template").option("--region <region>","AWS region",{default:"us-east-1"}).option("--subject <text>","Email subject (supports {{variable}} placeholders)").option("--text <text>","Text body").option("--html <html>","HTML body").option("--html-file <path>","HTML body from file").action(async(t,m)=>{i("Create Email Template");try{let k=new Ae(m.region),I=m.subject||await P("Subject template","Hello {{name}}"),L=m.text||await P("Text body","Hello {{name}}, this is a test."),z=m.html;if(m.htmlFile)z=await Bun.file(m.htmlFile).text();if(e(`
 Template Name: ${t}`),e(`Subject: ${I}`),!await d(`
 Create this template?`,!0)){e("Operation cancelled");return}let Z=new s("Creating template...");Z.start(),await k.createEmailTemplate({TemplateName:t,TemplateContent:{Subject:I,Text:L,Html:z}}),Z.succeed("Template created"),e(`
-To send using this template:`),e(`  cloud email:send:template --template ${t} --to user@example.com --data '{"name":"John"}'`)}catch(k){let I=k instanceof Error?k.message:String(k);r(`Failed to create template: ${I}`),process.exit(1)}}),R.command("email:template:delete <name>","Delete an email template").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Delete Email Template");try{let k=new we(m.region);if(a(`This will delete template: ${t}`),!await d(`
-Delete this template?`,!1)){e("Operation cancelled");return}let L=new s("Deleting template...");L.start(),await k.deleteEmailTemplate(t),L.succeed("Template deleted")}catch(k){let I=k instanceof Error?k.message:String(k);r(`Failed to delete template: ${I}`),process.exit(1)}}),R.command("email:stats","Show SES sending statistics").option("--region <region>","AWS region").action(async(t)=>{i("Email Statistics");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new we(k),L=new s("Fetching statistics...");L.start();let[z,Y]=await Promise.all([I.getSendQuota(),I.getSendStatistics()]);L.succeed("Statistics loaded"),e(`
+To send using this template:`),e(`  cloud email:send:template --template ${t} --to user@example.com --data '{"name":"John"}'`)}catch(k){let I=k instanceof Error?k.message:String(k);r(`Failed to create template: ${I}`),process.exit(1)}}),R.command("email:template:delete <name>","Delete an email template").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Delete Email Template");try{let k=new Ae(m.region);if(a(`This will delete template: ${t}`),!await d(`
+Delete this template?`,!1)){e("Operation cancelled");return}let L=new s("Deleting template...");L.start(),await k.deleteEmailTemplate(t),L.succeed("Template deleted")}catch(k){let I=k instanceof Error?k.message:String(k);r(`Failed to delete template: ${I}`),process.exit(1)}}),R.command("email:stats","Show SES sending statistics").option("--region <region>","AWS region").action(async(t)=>{i("Email Statistics");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new Ae(k),L=new s("Fetching statistics...");L.start();let[z,Y]=await Promise.all([I.getSendQuota(),I.getSendStatistics()]);L.succeed("Statistics loaded"),e(`
 Sending Quota:`),e(`  Max 24-hour Send: ${z.Max24HourSend||0}`),e(`  Max Send Rate: ${z.MaxSendRate||0} emails/second`),e(`  Sent Last 24h: ${z.SentLast24Hours||0}`);let Z=(z.Max24HourSend||0)-(z.SentLast24Hours||0);if(e(`  Remaining: ${Z}`),Y.SendDataPoints&&Y.SendDataPoints.length>0){e(`
-Recent Statistics:`);let X=0,ie=0,oe=0,ae=0;for(let be of Y.SendDataPoints)X+=be.DeliveryAttempts||0,ie+=be.Bounces||0,oe+=be.Complaints||0,ae+=be.Rejects||0;if(e(`  Total Attempts: ${X}`),e(`  Bounces: ${ie}`),e(`  Complaints: ${oe}`),e(`  Rejects: ${ae}`),X>0){let be=(ie/X*100).toFixed(2),Ae=(oe/X*100).toFixed(2);if(e(`
-  Bounce Rate: ${be}%`),e(`  Complaint Rate: ${Ae}%`),Number.parseFloat(be)>5)a(`
-  Warning: Bounce rate is high (>5%). This may affect your sender reputation.`);if(Number.parseFloat(Ae)>0.1)a(`
-  Warning: Complaint rate is high (>0.1%). This may affect your sender reputation.`)}}}catch(m){let k=m instanceof Error?m.message:String(m);r(`Failed to get statistics: ${k}`),process.exit(1)}})}function El(R){R.command("notify:topics","List all SNS topics").option("--region <region>","AWS region").action(async(t)=>{i("SNS Topics");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=new me(k),L=new s("Fetching topics...");L.start();let Y=(await I.listTopics()).Topics||[];if(L.succeed(`Found ${Y.length} topic(s)`),Y.length===0){e("No SNS topics found"),e("Use `cloud notify:create` to create a new topic");return}c(["Topic ARN","Name"],Y.map((Z)=>{let X=Z.TopicArn?.split(":").pop()||"N/A";return[Z.TopicArn||"N/A",X]}))}catch(m){r(`Failed to list topics: ${m.message}`),process.exit(1)}}),R.command("notify:create <name>","Create a new SNS topic").option("--region <region>","AWS region",{default:"us-east-1"}).option("--fifo","Create a FIFO topic").option("--display-name <name>","Display name for SMS subscriptions").action(async(t,m)=>{i("Create SNS Topic");try{let k=new me(m.region),I=m.fifo&&!t.endsWith(".fifo")?`${t}.fifo`:t;if(e(`Topic name: ${I}`),e(`Type: ${m.fifo?"FIFO":"Standard"}`),!await d(`
+Recent Statistics:`);let X=0,ee=0,oe=0,se=0;for(let ue of Y.SendDataPoints)X+=ue.DeliveryAttempts||0,ee+=ue.Bounces||0,oe+=ue.Complaints||0,se+=ue.Rejects||0;if(e(`  Total Attempts: ${X}`),e(`  Bounces: ${ee}`),e(`  Complaints: ${oe}`),e(`  Rejects: ${se}`),X>0){let ue=(ee/X*100).toFixed(2),ke=(oe/X*100).toFixed(2);if(e(`
+  Bounce Rate: ${ue}%`),e(`  Complaint Rate: ${ke}%`),Number.parseFloat(ue)>5)a(`
+  Warning: Bounce rate is high (>5%). This may affect your sender reputation.`);if(Number.parseFloat(ke)>0.1)a(`
+  Warning: Complaint rate is high (>0.1%). This may affect your sender reputation.`)}}}catch(m){let k=m instanceof Error?m.message:String(m);r(`Failed to get statistics: ${k}`),process.exit(1)}})}function El(R){R.command("notify:topics","List all SNS topics").option("--region <region>","AWS region").action(async(t)=>{i("SNS Topics");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=new ge(k),L=new s("Fetching topics...");L.start();let Y=(await I.listTopics()).Topics||[];if(L.succeed(`Found ${Y.length} topic(s)`),Y.length===0){e("No SNS topics found"),e("Use `cloud notify:create` to create a new topic");return}c(["Topic ARN","Name"],Y.map((Z)=>{let X=Z.TopicArn?.split(":").pop()||"N/A";return[Z.TopicArn||"N/A",X]}))}catch(m){r(`Failed to list topics: ${m.message}`),process.exit(1)}}),R.command("notify:create <name>","Create a new SNS topic").option("--region <region>","AWS region",{default:"us-east-1"}).option("--fifo","Create a FIFO topic").option("--display-name <name>","Display name for SMS subscriptions").action(async(t,m)=>{i("Create SNS Topic");try{let k=new ge(m.region),I=m.fifo&&!t.endsWith(".fifo")?`${t}.fifo`:t;if(e(`Topic name: ${I}`),e(`Type: ${m.fifo?"FIFO":"Standard"}`),!await d(`
 Create this topic?`,!0)){e("Operation cancelled");return}let z=new s("Creating topic...");z.start();let Y={};if(m.fifo)Y.FifoTopic="true",Y.ContentBasedDeduplication="true";if(m.displayName)Y.DisplayName=m.displayName;let Z=await k.createTopic({Name:I,Attributes:Object.keys(Y).length>0?Y:void 0});z.succeed("Topic created"),n(`
 Topic ARN: ${Z.TopicArn}`),e(`
-To subscribe:`),e(`  cloud notify:subscribe ${Z.TopicArn} --email user@example.com`)}catch(k){r(`Failed to create topic: ${k.message}`),process.exit(1)}}),R.command("notify:delete <topicArn>","Delete an SNS topic").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Delete SNS Topic");try{let k=new me(m.region);if(a(`This will delete topic: ${t}`),a("All subscriptions will be removed."),!await d(`
-Delete this topic?`,!1)){e("Operation cancelled");return}let L=new s("Deleting topic...");L.start(),await k.deleteTopic(t),L.succeed("Topic deleted")}catch(k){r(`Failed to delete topic: ${k.message}`),process.exit(1)}}),R.command("notify:subscribe <topicArn>","Subscribe to an SNS topic").option("--region <region>","AWS region",{default:"us-east-1"}).option("--email <address>","Email address").option("--sms <number>","Phone number (E.164 format)").option("--sqs <queueArn>","SQS queue ARN").option("--lambda <functionArn>","Lambda function ARN").option("--https <url>","HTTPS endpoint URL").option("--filter <json>","Filter policy JSON").action(async(t,m)=>{i("Subscribe to SNS Topic");try{let k=new me(m.region),I,L;if(m.email)I="email",L=m.email;else if(m.sms)I="sms",L=m.sms;else if(m.sqs)I="sqs",L=m.sqs;else if(m.lambda)I="lambda",L=m.lambda;else if(m.https)I="https",L=m.https;else{r("Specify a subscription type: --email, --sms, --sqs, --lambda, or --https");return}if(e(`Topic: ${t}`),e(`Protocol: ${I}`),e(`Endpoint: ${L}`),!await d(`
+To subscribe:`),e(`  cloud notify:subscribe ${Z.TopicArn} --email user@example.com`)}catch(k){r(`Failed to create topic: ${k.message}`),process.exit(1)}}),R.command("notify:delete <topicArn>","Delete an SNS topic").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Delete SNS Topic");try{let k=new ge(m.region);if(a(`This will delete topic: ${t}`),a("All subscriptions will be removed."),!await d(`
+Delete this topic?`,!1)){e("Operation cancelled");return}let L=new s("Deleting topic...");L.start(),await k.deleteTopic(t),L.succeed("Topic deleted")}catch(k){r(`Failed to delete topic: ${k.message}`),process.exit(1)}}),R.command("notify:subscribe <topicArn>","Subscribe to an SNS topic").option("--region <region>","AWS region",{default:"us-east-1"}).option("--email <address>","Email address").option("--sms <number>","Phone number (E.164 format)").option("--sqs <queueArn>","SQS queue ARN").option("--lambda <functionArn>","Lambda function ARN").option("--https <url>","HTTPS endpoint URL").option("--filter <json>","Filter policy JSON").action(async(t,m)=>{i("Subscribe to SNS Topic");try{let k=new ge(m.region),I,L;if(m.email)I="email",L=m.email;else if(m.sms)I="sms",L=m.sms;else if(m.sqs)I="sqs",L=m.sqs;else if(m.lambda)I="lambda",L=m.lambda;else if(m.https)I="https",L=m.https;else{r("Specify a subscription type: --email, --sms, --sqs, --lambda, or --https");return}if(e(`Topic: ${t}`),e(`Protocol: ${I}`),e(`Endpoint: ${L}`),!await d(`
 Create this subscription?`,!0)){e("Operation cancelled");return}let Y=new s("Creating subscription...");Y.start();let Z={TopicArn:t,Protocol:I,Endpoint:L};if(m.filter)Z.Attributes={FilterPolicy:m.filter};let X=await k.subscribe(Z);if(Y.succeed("Subscription created"),X.SubscriptionArn==="pending confirmation")e(`
 Subscription is pending confirmation.`),e("The subscriber will receive a confirmation message.");else n(`
-Subscription ARN: ${X.SubscriptionArn}`)}catch(k){r(`Failed to subscribe: ${k.message}`),process.exit(1)}}),R.command("notify:unsubscribe <subscriptionArn>","Unsubscribe from an SNS topic").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Unsubscribe from SNS Topic");try{let k=new me(m.region);if(a(`This will remove subscription: ${t}`),!await d(`
-Unsubscribe?`,!1)){e("Operation cancelled");return}let L=new s("Unsubscribing...");L.start(),await k.unsubscribe(t),L.succeed("Unsubscribed")}catch(k){r(`Failed to unsubscribe: ${k.message}`),process.exit(1)}}),R.command("notify:subscriptions <topicArn>","List subscriptions for a topic").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Topic Subscriptions");try{let k=new me(m.region),I=new s("Fetching subscriptions...");I.start();let z=(await k.listSubscriptionsByTopic(t)).Subscriptions||[];if(I.succeed(`Found ${z.length} subscription(s)`),z.length===0){e("No subscriptions found");return}c(["Protocol","Endpoint","Status","Subscription ARN"],z.map((Y)=>[Y.Protocol||"N/A",Y.Endpoint||"N/A",Y.SubscriptionArn==="PendingConfirmation"?"Pending":"Confirmed",(Y.SubscriptionArn||"N/A").substring(0,50)]))}catch(k){r(`Failed to list subscriptions: ${k.message}`),process.exit(1)}}),R.command("notify:publish <topicArn>","Publish a message to an SNS topic").option("--region <region>","AWS region",{default:"us-east-1"}).option("--message <text>","Message body").option("--subject <text>","Message subject (for email)").option("--file <path>","Read message from file").option("--json","Send as JSON message structure").option("--group <id>","Message group ID (for FIFO topics)").option("--dedup <id>","Deduplication ID (for FIFO topics)").action(async(t,m)=>{i("Publish to SNS Topic");try{let k=new me(m.region),I;if(m.file)I=await Bun.file(m.file).text();else if(m.message)I=m.message;else I=await P("Message");if(!I){r("Message is required");return}if(e(`Topic: ${t}`),e(`Message length: ${I.length} characters`),!await d(`
+Subscription ARN: ${X.SubscriptionArn}`)}catch(k){r(`Failed to subscribe: ${k.message}`),process.exit(1)}}),R.command("notify:unsubscribe <subscriptionArn>","Unsubscribe from an SNS topic").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Unsubscribe from SNS Topic");try{let k=new ge(m.region);if(a(`This will remove subscription: ${t}`),!await d(`
+Unsubscribe?`,!1)){e("Operation cancelled");return}let L=new s("Unsubscribing...");L.start(),await k.unsubscribe(t),L.succeed("Unsubscribed")}catch(k){r(`Failed to unsubscribe: ${k.message}`),process.exit(1)}}),R.command("notify:subscriptions <topicArn>","List subscriptions for a topic").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Topic Subscriptions");try{let k=new ge(m.region),I=new s("Fetching subscriptions...");I.start();let z=(await k.listSubscriptionsByTopic(t)).Subscriptions||[];if(I.succeed(`Found ${z.length} subscription(s)`),z.length===0){e("No subscriptions found");return}c(["Protocol","Endpoint","Status","Subscription ARN"],z.map((Y)=>[Y.Protocol||"N/A",Y.Endpoint||"N/A",Y.SubscriptionArn==="PendingConfirmation"?"Pending":"Confirmed",(Y.SubscriptionArn||"N/A").substring(0,50)]))}catch(k){r(`Failed to list subscriptions: ${k.message}`),process.exit(1)}}),R.command("notify:publish <topicArn>","Publish a message to an SNS topic").option("--region <region>","AWS region",{default:"us-east-1"}).option("--message <text>","Message body").option("--subject <text>","Message subject (for email)").option("--file <path>","Read message from file").option("--json","Send as JSON message structure").option("--group <id>","Message group ID (for FIFO topics)").option("--dedup <id>","Deduplication ID (for FIFO topics)").action(async(t,m)=>{i("Publish to SNS Topic");try{let k=new ge(m.region),I;if(m.file)I=await Bun.file(m.file).text();else if(m.message)I=m.message;else I=await P("Message");if(!I){r("Message is required");return}if(e(`Topic: ${t}`),e(`Message length: ${I.length} characters`),!await d(`
 Publish this message?`,!0)){e("Operation cancelled");return}let z=new s("Publishing message...");z.start();let Y={TopicArn:t,Message:I};if(m.subject)Y.Subject=m.subject;if(m.json)Y.MessageStructure="json";if(m.group)Y.MessageGroupId=m.group;if(m.dedup)Y.MessageDeduplicationId=m.dedup;let Z=await k.publish(Y);z.succeed("Message published"),n(`
-Message ID: ${Z.MessageId}`)}catch(k){r(`Failed to publish message: ${k.message}`),process.exit(1)}}),R.command("notify:sms <phoneNumber>","Send an SMS message directly").option("--region <region>","AWS region",{default:"us-east-1"}).option("--message <text>","Message body").option("--sender <id>","Sender ID or short code").option("--type <type>","Message type (Transactional or Promotional)",{default:"Transactional"}).action(async(t,m)=>{i("Send SMS");try{let k=new me(m.region),I=m.message||await P("Message");if(!I){r("Message is required");return}if(e(`To: ${t}`),e(`Message: ${I}`),e(`Type: ${m.type}`),!await d(`
+Message ID: ${Z.MessageId}`)}catch(k){r(`Failed to publish message: ${k.message}`),process.exit(1)}}),R.command("notify:sms <phoneNumber>","Send an SMS message directly").option("--region <region>","AWS region",{default:"us-east-1"}).option("--message <text>","Message body").option("--sender <id>","Sender ID or short code").option("--type <type>","Message type (Transactional or Promotional)",{default:"Transactional"}).action(async(t,m)=>{i("Send SMS");try{let k=new ge(m.region),I=m.message||await P("Message");if(!I){r("Message is required");return}if(e(`To: ${t}`),e(`Message: ${I}`),e(`Type: ${m.type}`),!await d(`
 Send this SMS?`,!0)){e("Operation cancelled");return}let z=new s("Sending SMS...");z.start();let Y={PhoneNumber:t,Message:I,MessageAttributes:{"AWS.SNS.SMS.SMSType":{DataType:"String",StringValue:m.type}}};if(m.sender)Y.MessageAttributes["AWS.SNS.SMS.SenderID"]={DataType:"String",StringValue:m.sender};let Z=await k.publish(Y);z.succeed("SMS sent"),n(`
-Message ID: ${Z.MessageId}`)}catch(k){r(`Failed to send SMS: ${k.message}`),process.exit(1)}}),R.command("notify:topic:attributes <topicArn>","Show topic attributes").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Topic Attributes");try{let k=new me(m.region),I=new s("Fetching attributes...");I.start();let L=await k.getTopicAttributes(t);if(I.succeed("Attributes loaded"),e(`
+Message ID: ${Z.MessageId}`)}catch(k){r(`Failed to send SMS: ${k.message}`),process.exit(1)}}),R.command("notify:topic:attributes <topicArn>","Show topic attributes").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Topic Attributes");try{let k=new ge(m.region),I=new s("Fetching attributes...");I.start();let L=await k.getTopicAttributes(t);if(I.succeed("Attributes loaded"),e(`
 Topic Information:`),e(`  ARN: ${t}`),e(`  Display Name: ${L.DisplayName||"Not set"}`),e(`  Owner: ${L.Owner||"N/A"}`),e(`
 Subscriptions:`),e(`  Confirmed: ${L.SubscriptionsConfirmed||0}`),e(`  Pending: ${L.SubscriptionsPending||0}`),e(`  Deleted: ${L.SubscriptionsDeleted||0}`),e(`
 Settings:`),e(`  FIFO: ${L.FifoTopic==="true"?"Yes":"No"}`),e(`  Content Deduplication: ${L.ContentBasedDeduplication==="true"?"Yes":"No"}`),L.EffectiveDeliveryPolicy)e(`
 Delivery Policy: Configured`);if(L.Policy)e(`
-Access Policy: Configured`)}catch(k){r(`Failed to get attributes: ${k.message}`),process.exit(1)}})}function Tl(R){R.command("iam:roles","List IAM roles").option("--prefix <prefix>","Filter by role name prefix").option("--path <path>","Filter by path prefix",{default:"/"}).action(async(t)=>{i("IAM Roles");try{let m=new ne,k=new s("Fetching roles...");k.start();let L=(await m.listRoles({PathPrefix:t.path})).Roles||[];if(t.prefix)L=L.filter((z)=>z.RoleName?.startsWith(t.prefix));if(k.succeed(`Found ${L.length} role(s)`),L.length===0){e("No IAM roles found");return}c(["Role Name","Path","Created","Description"],L.map((z)=>[z.RoleName||"N/A",z.Path||"/",z.CreateDate?new Date(z.CreateDate).toLocaleDateString():"N/A",(z.Description||"").substring(0,40)]))}catch(m){r(`Failed to list roles: ${m.message}`),process.exit(1)}}),R.command("iam:role <roleName>","Show IAM role details").action(async(t)=>{i(`IAM Role: ${t}`);try{let m=new ne,k=new s("Fetching role details...");k.start();let I=await m.getRole({RoleName:t}),L=await m.listAttachedRolePolicies({RoleName:t}),z=await m.listRolePolicies({RoleName:t});if(k.succeed("Role details loaded"),e(`
+Access Policy: Configured`)}catch(k){r(`Failed to get attributes: ${k.message}`),process.exit(1)}})}function Tl(R){R.command("iam:roles","List IAM roles").option("--prefix <prefix>","Filter by role name prefix").option("--path <path>","Filter by path prefix",{default:"/"}).action(async(t)=>{i("IAM Roles");try{let m=new ie,k=new s("Fetching roles...");k.start();let L=(await m.listRoles({PathPrefix:t.path})).Roles||[];if(t.prefix)L=L.filter((z)=>z.RoleName?.startsWith(t.prefix));if(k.succeed(`Found ${L.length} role(s)`),L.length===0){e("No IAM roles found");return}c(["Role Name","Path","Created","Description"],L.map((z)=>[z.RoleName||"N/A",z.Path||"/",z.CreateDate?new Date(z.CreateDate).toLocaleDateString():"N/A",(z.Description||"").substring(0,40)]))}catch(m){r(`Failed to list roles: ${m.message}`),process.exit(1)}}),R.command("iam:role <roleName>","Show IAM role details").action(async(t)=>{i(`IAM Role: ${t}`);try{let m=new ie,k=new s("Fetching role details...");k.start();let I=await m.getRole({RoleName:t}),L=await m.listAttachedRolePolicies({RoleName:t}),z=await m.listRolePolicies({RoleName:t});if(k.succeed("Role details loaded"),e(`
 Role Information:`),e(`  Name: ${I.RoleName}`),e(`  ARN: ${I.Arn}`),e(`  Path: ${I.Path}`),e(`  Created: ${I.CreateDate?new Date(I.CreateDate).toLocaleString():"N/A"}`),I.Description)e(`  Description: ${I.Description}`);if(I.MaxSessionDuration)e(`  Max Session: ${I.MaxSessionDuration/3600} hours`);if(I.AssumeRolePolicyDocument){e(`
 Trust Policy:`);let Y=JSON.parse(decodeURIComponent(I.AssumeRolePolicyDocument));console.log(JSON.stringify(Y,null,2))}if(L.AttachedPolicies&&L.AttachedPolicies.length>0){e(`
 Attached Managed Policies:`);for(let Y of L.AttachedPolicies)e(`  - ${Y.PolicyName}`)}if(z.PolicyNames&&z.PolicyNames.length>0){e(`
 Inline Policies:`);for(let Y of z.PolicyNames)e(`  - ${Y}`)}if(I.Tags&&I.Tags.length>0){e(`
-Tags:`);for(let Y of I.Tags)e(`  ${Y.Key}: ${Y.Value}`)}}catch(m){r(`Failed to get role: ${m.message}`),process.exit(1)}}),R.command("iam:policies","List IAM policies").option("--scope <scope>","Filter by scope (All, AWS, Local)",{default:"Local"}).option("--prefix <prefix>","Filter by policy name prefix").option("--path <path>","Filter by path prefix",{default:"/"}).action(async(t)=>{i("IAM Policies");try{let m=new ne,k=new s("Fetching policies...");k.start();let L=(await m.listPolicies({Scope:t.scope,PathPrefix:t.path,OnlyAttached:!1})).Policies||[];if(t.prefix)L=L.filter((z)=>z.PolicyName?.startsWith(t.prefix));if(k.succeed(`Found ${L.length} policy(s)`),L.length===0){e("No IAM policies found");return}if(c(["Policy Name","ARN","Attachments","Created"],L.slice(0,50).map((z)=>[z.PolicyName||"N/A",(z.Arn||"N/A").substring(0,50),(z.AttachmentCount||0).toString(),z.CreateDate?new Date(z.CreateDate).toLocaleDateString():"N/A"])),L.length>50)e(`
-... and ${L.length-50} more policies`)}catch(m){r(`Failed to list policies: ${m.message}`),process.exit(1)}}),R.command("iam:policy <policyArn>","Show IAM policy details").option("--version <version>","Policy version ID").action(async(t,m)=>{i("IAM Policy Details");try{let k=new ne,I=new s("Fetching policy...");I.start();let L=await k.getPolicy({PolicyArn:t}),z=m.version||L.DefaultVersionId||"v1",Y=await k.getPolicyVersion({PolicyArn:t,VersionId:z});if(I.succeed("Policy loaded"),e(`
+Tags:`);for(let Y of I.Tags)e(`  ${Y.Key}: ${Y.Value}`)}}catch(m){r(`Failed to get role: ${m.message}`),process.exit(1)}}),R.command("iam:policies","List IAM policies").option("--scope <scope>","Filter by scope (All, AWS, Local)",{default:"Local"}).option("--prefix <prefix>","Filter by policy name prefix").option("--path <path>","Filter by path prefix",{default:"/"}).action(async(t)=>{i("IAM Policies");try{let m=new ie,k=new s("Fetching policies...");k.start();let L=(await m.listPolicies({Scope:t.scope,PathPrefix:t.path,OnlyAttached:!1})).Policies||[];if(t.prefix)L=L.filter((z)=>z.PolicyName?.startsWith(t.prefix));if(k.succeed(`Found ${L.length} policy(s)`),L.length===0){e("No IAM policies found");return}if(c(["Policy Name","ARN","Attachments","Created"],L.slice(0,50).map((z)=>[z.PolicyName||"N/A",(z.Arn||"N/A").substring(0,50),(z.AttachmentCount||0).toString(),z.CreateDate?new Date(z.CreateDate).toLocaleDateString():"N/A"])),L.length>50)e(`
+... and ${L.length-50} more policies`)}catch(m){r(`Failed to list policies: ${m.message}`),process.exit(1)}}),R.command("iam:policy <policyArn>","Show IAM policy details").option("--version <version>","Policy version ID").action(async(t,m)=>{i("IAM Policy Details");try{let k=new ie,I=new s("Fetching policy...");I.start();let L=await k.getPolicy({PolicyArn:t}),z=m.version||L.DefaultVersionId||"v1",Y=await k.getPolicyVersion({PolicyArn:t,VersionId:z});if(I.succeed("Policy loaded"),e(`
 Policy Information:`),e(`  Name: ${L.PolicyName}`),e(`  ARN: ${L.Arn}`),e(`  Path: ${L.Path}`),e(`  Created: ${L.CreateDate?new Date(L.CreateDate).toLocaleString():"N/A"}`),e(`  Updated: ${L.UpdateDate?new Date(L.UpdateDate).toLocaleString():"N/A"}`),e(`  Attachment Count: ${L.AttachmentCount||0}`),e(`  Version: ${z}`),L.Description)e(`  Description: ${L.Description}`);if(Y.Document){e(`
-Policy Document:`);let Z=JSON.parse(decodeURIComponent(Y.Document));console.log(JSON.stringify(Z,null,2))}}catch(k){r(`Failed to get policy: ${k.message}`),process.exit(1)}}),R.command("iam:users","List IAM users").option("--path <path>","Filter by path prefix",{default:"/"}).action(async(t)=>{i("IAM Users");try{let m=new ne,k=new s("Fetching users...");k.start();let L=(await m.listUsers({PathPrefix:t.path})).Users||[];if(k.succeed(`Found ${L.length} user(s)`),L.length===0){e("No IAM users found");return}c(["User Name","User ID","Path","Created","Password Last Used"],L.map((z)=>[z.UserName||"N/A",z.UserId||"N/A",z.Path||"/",z.CreateDate?new Date(z.CreateDate).toLocaleDateString():"N/A",z.PasswordLastUsed?new Date(z.PasswordLastUsed).toLocaleDateString():"Never"]))}catch(m){r(`Failed to list users: ${m.message}`),process.exit(1)}}),R.command("iam:user <userName>","Show IAM user details").action(async(t)=>{i(`IAM User: ${t}`);try{let m=new ne,k=new s("Fetching user details...");k.start();let I=await m.getUser({UserName:t}),[L,z,Y]=await Promise.all([m.listGroupsForUser({UserName:t}),m.listAttachedUserPolicies({UserName:t}),m.listAccessKeys({UserName:t})]);if(k.succeed("User details loaded"),e(`
+Policy Document:`);let Z=JSON.parse(decodeURIComponent(Y.Document));console.log(JSON.stringify(Z,null,2))}}catch(k){r(`Failed to get policy: ${k.message}`),process.exit(1)}}),R.command("iam:users","List IAM users").option("--path <path>","Filter by path prefix",{default:"/"}).action(async(t)=>{i("IAM Users");try{let m=new ie,k=new s("Fetching users...");k.start();let L=(await m.listUsers({PathPrefix:t.path})).Users||[];if(k.succeed(`Found ${L.length} user(s)`),L.length===0){e("No IAM users found");return}c(["User Name","User ID","Path","Created","Password Last Used"],L.map((z)=>[z.UserName||"N/A",z.UserId||"N/A",z.Path||"/",z.CreateDate?new Date(z.CreateDate).toLocaleDateString():"N/A",z.PasswordLastUsed?new Date(z.PasswordLastUsed).toLocaleDateString():"Never"]))}catch(m){r(`Failed to list users: ${m.message}`),process.exit(1)}}),R.command("iam:user <userName>","Show IAM user details").action(async(t)=>{i(`IAM User: ${t}`);try{let m=new ie,k=new s("Fetching user details...");k.start();let I=await m.getUser({UserName:t}),[L,z,Y]=await Promise.all([m.listGroupsForUser({UserName:t}),m.listAttachedUserPolicies({UserName:t}),m.listAccessKeys({UserName:t})]);if(k.succeed("User details loaded"),e(`
 User Information:`),e(`  Name: ${I.UserName}`),e(`  ARN: ${I.Arn}`),e(`  User ID: ${I.UserId}`),e(`  Path: ${I.Path}`),e(`  Created: ${I.CreateDate?new Date(I.CreateDate).toLocaleString():"N/A"}`),I.PasswordLastUsed)e(`  Password Last Used: ${new Date(I.PasswordLastUsed).toLocaleString()}`);if(L.Groups&&L.Groups.length>0){e(`
 Groups:`);for(let Z of L.Groups)e(`  - ${Z.GroupName}`)}if(z.AttachedPolicies&&z.AttachedPolicies.length>0){e(`
 Attached Policies:`);for(let Z of z.AttachedPolicies)e(`  - ${Z.PolicyName}`)}if(Y.AccessKeyMetadata&&Y.AccessKeyMetadata.length>0){e(`
 Access Keys:`);for(let Z of Y.AccessKeyMetadata)if(e(`  - ${Z.AccessKeyId}: ${Z.Status}`),Z.CreateDate)e(`    Created: ${new Date(Z.CreateDate).toLocaleString()}`)}if(I.Tags&&I.Tags.length>0){e(`
-Tags:`);for(let Z of I.Tags)e(`  ${Z.Key}: ${Z.Value}`)}}catch(m){r(`Failed to get user: ${m.message}`),process.exit(1)}}),R.command("iam:groups","List IAM groups").option("--path <path>","Filter by path prefix",{default:"/"}).action(async(t)=>{i("IAM Groups");try{let m=new ne,k=new s("Fetching groups...");k.start();let L=(await m.listGroups({PathPrefix:t.path})).Groups||[];if(k.succeed(`Found ${L.length} group(s)`),L.length===0){e("No IAM groups found");return}c(["Group Name","Group ID","Path","Created"],L.map((z)=>[z.GroupName||"N/A",z.GroupId||"N/A",z.Path||"/",z.CreateDate?new Date(z.CreateDate).toLocaleDateString():"N/A"]))}catch(m){r(`Failed to list groups: ${m.message}`),process.exit(1)}}),R.command("iam:simulate <policyArn>","Simulate IAM policy").option("--action <action>","Action to simulate (e.g., s3:GetObject)").option("--resource <arn>","Resource ARN to test against").action(async(t,m)=>{i("Simulate IAM Policy");try{let k=new ne,I=m.action||await P("Action to simulate","s3:GetObject"),L=m.resource||await P("Resource ARN","*");e(`
+Tags:`);for(let Z of I.Tags)e(`  ${Z.Key}: ${Z.Value}`)}}catch(m){r(`Failed to get user: ${m.message}`),process.exit(1)}}),R.command("iam:groups","List IAM groups").option("--path <path>","Filter by path prefix",{default:"/"}).action(async(t)=>{i("IAM Groups");try{let m=new ie,k=new s("Fetching groups...");k.start();let L=(await m.listGroups({PathPrefix:t.path})).Groups||[];if(k.succeed(`Found ${L.length} group(s)`),L.length===0){e("No IAM groups found");return}c(["Group Name","Group ID","Path","Created"],L.map((z)=>[z.GroupName||"N/A",z.GroupId||"N/A",z.Path||"/",z.CreateDate?new Date(z.CreateDate).toLocaleDateString():"N/A"]))}catch(m){r(`Failed to list groups: ${m.message}`),process.exit(1)}}),R.command("iam:simulate <policyArn>","Simulate IAM policy").option("--action <action>","Action to simulate (e.g., s3:GetObject)").option("--resource <arn>","Resource ARN to test against").action(async(t,m)=>{i("Simulate IAM Policy");try{let k=new ie,I=m.action||await P("Action to simulate","s3:GetObject"),L=m.resource||await P("Resource ARN","*");e(`
 Policy: ${t}`),e(`Action: ${I}`),e(`Resource: ${L}`);let z=new s("Running simulation...");z.start();let Y=await k.simulatePrincipalPolicy({PolicySourceArn:t,ActionNames:[I],ResourceArns:[L]});if(z.succeed("Simulation complete"),Y.EvaluationResults&&Y.EvaluationResults.length>0)for(let Z of Y.EvaluationResults){let X=Z.EvalDecision;if(e(`
-Result for ${Z.EvalActionName}:`),X==="allowed")n("  Decision: ALLOWED");else if(X==="implicitDeny")a("  Decision: IMPLICIT DENY (no matching allow statement)");else r("  Decision: EXPLICIT DENY");if(Z.MatchedStatements&&Z.MatchedStatements.length>0){e("  Matched Statements:");for(let ie of Z.MatchedStatements)e(`    - ${ie.SourcePolicyId}: ${ie.SourcePolicyType}`)}}}catch(k){r(`Failed to simulate policy: ${k.message}`),process.exit(1)}}),R.command("iam:whoami","Show current IAM identity").action(async()=>{i("Current IAM Identity");try{let t=new ne,m=new s("Fetching identity...");m.start();let{STSClient:k}=await import("./chunk-3rjer1mp.js"),L=await new k("us-east-1").getCallerIdentity();m.succeed("Identity loaded"),e(`
+Result for ${Z.EvalActionName}:`),X==="allowed")n("  Decision: ALLOWED");else if(X==="implicitDeny")a("  Decision: IMPLICIT DENY (no matching allow statement)");else r("  Decision: EXPLICIT DENY");if(Z.MatchedStatements&&Z.MatchedStatements.length>0){e("  Matched Statements:");for(let ee of Z.MatchedStatements)e(`    - ${ee.SourcePolicyId}: ${ee.SourcePolicyType}`)}}}catch(k){r(`Failed to simulate policy: ${k.message}`),process.exit(1)}}),R.command("iam:whoami","Show current IAM identity").action(async()=>{i("Current IAM Identity");try{let t=new ie,m=new s("Fetching identity...");m.start();let{STSClient:k}=await import("./chunk-5njr2s5x.js"),L=await new k("us-east-1").getCallerIdentity();m.succeed("Identity loaded"),e(`
 Caller Identity:`),e(`  Account: ${L.Account}`),e(`  ARN: ${L.Arn}`),e(`  User ID: ${L.UserId}`);let z=L.Arn||"";if(z.includes(":user/"))e("  Type: IAM User");else if(z.includes(":assumed-role/"))e("  Type: Assumed Role");else if(z.includes(":root"))a("  Type: Root Account"),a(`
-  Warning: Using root credentials is not recommended!`)}catch(t){r(`Failed to get identity: ${t.message}`),process.exit(1)}})}async function Ki(R){let{AWSClient:t}=await import("./chunk-5tzygzdy.js");class m{client;region;constructor(k){this.region=k,this.client=new t}async jsonRpcRequest(k,I){return this.client.request({service:"cloudtrail",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.${k}`},body:JSON.stringify(I)})}async describeTrails(){return this.jsonRpcRequest("DescribeTrails",{})}async getTrailStatus(k){return this.jsonRpcRequest("GetTrailStatus",{Name:k})}async lookupEvents(k){return this.jsonRpcRequest("LookupEvents",{...k,StartTime:k.StartTime?.toISOString(),EndTime:k.EndTime?.toISOString()})}async getEventSelectors(k){return this.jsonRpcRequest("GetEventSelectors",{TrailName:k})}async createTrail(k){return this.jsonRpcRequest("CreateTrail",k)}async startLogging(k){return this.jsonRpcRequest("StartLogging",{Name:k})}async stopLogging(k){return this.jsonRpcRequest("StopLogging",{Name:k})}async deleteTrail(k){return this.jsonRpcRequest("DeleteTrail",{Name:k})}}return new m(R)}function Nl(R){R.command("audit:trails","List CloudTrail trails").option("--region <region>","AWS region").action(async(t)=>{i("CloudTrail Trails");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=await Ki(k),L=new s("Fetching trails...");L.start();let Y=(await I.describeTrails()).trailList||[];if(L.succeed(`Found ${Y.length} trail(s)`),Y.length===0){e("No CloudTrail trails found"),e("Use `cloud audit:create` to create a new trail");return}c(["Name","Multi-Region","S3 Bucket","Log Validation","Home Region"],Y.map((Z)=>[Z.Name||"N/A",Z.IsMultiRegionTrail?"Yes":"No",Z.S3BucketName||"N/A",Z.LogFileValidationEnabled?"Yes":"No",Z.HomeRegion||"N/A"]))}catch(m){r(`Failed to list trails: ${m.message}`),process.exit(1)}}),R.command("audit:trail <trailName>","Show CloudTrail trail details").option("--region <region>","AWS region").action(async(t,m)=>{i(`CloudTrail: ${t}`);try{let k=await Ne(),I=m.region||k.project.region||"us-east-1",L=await Ki(I),z=new s("Fetching trail details...");z.start();let[Y,Z]=await Promise.all([L.describeTrails(),L.getTrailStatus(t)]),X=(Y.trailList||[]).find((ie)=>ie.Name===t);if(!X){z.fail("Trail not found");return}if(z.succeed("Trail details loaded"),e(`
+  Warning: Using root credentials is not recommended!`)}catch(t){r(`Failed to get identity: ${t.message}`),process.exit(1)}})}async function Ki(R){let{AWSClient:t}=await import("./chunk-we82q71y.js");class m{client;region;constructor(k){this.region=k,this.client=new t}async jsonRpcRequest(k,I){return this.client.request({service:"cloudtrail",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.${k}`},body:JSON.stringify(I)})}async describeTrails(){return this.jsonRpcRequest("DescribeTrails",{})}async getTrailStatus(k){return this.jsonRpcRequest("GetTrailStatus",{Name:k})}async lookupEvents(k){return this.jsonRpcRequest("LookupEvents",{...k,StartTime:k.StartTime?.toISOString(),EndTime:k.EndTime?.toISOString()})}async getEventSelectors(k){return this.jsonRpcRequest("GetEventSelectors",{TrailName:k})}async createTrail(k){return this.jsonRpcRequest("CreateTrail",k)}async startLogging(k){return this.jsonRpcRequest("StartLogging",{Name:k})}async stopLogging(k){return this.jsonRpcRequest("StopLogging",{Name:k})}async deleteTrail(k){return this.jsonRpcRequest("DeleteTrail",{Name:k})}}return new m(R)}function Nl(R){R.command("audit:trails","List CloudTrail trails").option("--region <region>","AWS region").action(async(t)=>{i("CloudTrail Trails");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=await Ki(k),L=new s("Fetching trails...");L.start();let Y=(await I.describeTrails()).trailList||[];if(L.succeed(`Found ${Y.length} trail(s)`),Y.length===0){e("No CloudTrail trails found"),e("Use `cloud audit:create` to create a new trail");return}c(["Name","Multi-Region","S3 Bucket","Log Validation","Home Region"],Y.map((Z)=>[Z.Name||"N/A",Z.IsMultiRegionTrail?"Yes":"No",Z.S3BucketName||"N/A",Z.LogFileValidationEnabled?"Yes":"No",Z.HomeRegion||"N/A"]))}catch(m){r(`Failed to list trails: ${m.message}`),process.exit(1)}}),R.command("audit:trail <trailName>","Show CloudTrail trail details").option("--region <region>","AWS region").action(async(t,m)=>{i(`CloudTrail: ${t}`);try{let k=await De(),I=m.region||k.project.region||"us-east-1",L=await Ki(I),z=new s("Fetching trail details...");z.start();let[Y,Z]=await Promise.all([L.describeTrails(),L.getTrailStatus(t)]),X=(Y.trailList||[]).find((ee)=>ee.Name===t);if(!X){z.fail("Trail not found");return}if(z.succeed("Trail details loaded"),e(`
 Trail Configuration:`),e(`  Name: ${X.Name}`),e(`  ARN: ${X.TrailARN}`),e(`  Home Region: ${X.HomeRegion}`),e(`  Multi-Region: ${X.IsMultiRegionTrail?"Yes":"No"}`),e(`  Organization Trail: ${X.IsOrganizationTrail?"Yes":"No"}`),e(`
 Storage:`),e(`  S3 Bucket: ${X.S3BucketName}`),X.S3KeyPrefix)e(`  S3 Prefix: ${X.S3KeyPrefix}`);if(e(`  Log Validation: ${X.LogFileValidationEnabled?"Enabled":"Disabled"}`),X.CloudWatchLogsLogGroupArn)e(`
 CloudWatch Logs:`),e(`  Log Group: ${X.CloudWatchLogsLogGroupArn}`);if(X.KMSKeyId)e(`
 Encryption:`),e(`  KMS Key: ${X.KMSKeyId}`);if(e(`
-Status:`),e(`  Logging: ${Z.IsLogging?"Active":"Stopped"}`),Z.LatestDeliveryTime)e(`  Latest Delivery: ${new Date(Z.LatestDeliveryTime).toLocaleString()}`);if(Z.LatestDeliveryError)a(`  Latest Error: ${Z.LatestDeliveryError}`);try{let ie=await L.getEventSelectors(t);if(ie.EventSelectors&&ie.EventSelectors.length>0){e(`
-Event Selectors:`);for(let oe of ie.EventSelectors)if(e(`  - Read/Write: ${oe.ReadWriteType}`),e(`    Management Events: ${oe.IncludeManagementEvents?"Yes":"No"}`),oe.DataResources&&oe.DataResources.length>0)e(`    Data Resources: ${oe.DataResources.length} configured`)}}catch{}}catch(k){r(`Failed to get trail: ${k.message}`),process.exit(1)}}),R.command("audit:events","Look up recent CloudTrail events").option("--region <region>","AWS region").option("--user <username>","Filter by IAM user").option("--event <eventName>","Filter by event name").option("--resource <resourceName>","Filter by resource name").option("--hours <number>","Hours to look back",{default:"24"}).option("--limit <number>","Maximum events to return",{default:"50"}).action(async(t)=>{i("CloudTrail Events");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=await Ki(k),L=new s("Looking up events...");L.start();let z=new Date,Z={StartTime:new Date(z.getTime()-Number.parseInt(t.hours)*60*60*1000),EndTime:z,MaxResults:Number.parseInt(t.limit)};if(t.user)Z.LookupAttributes=[{AttributeKey:"Username",AttributeValue:t.user}];else if(t.event)Z.LookupAttributes=[{AttributeKey:"EventName",AttributeValue:t.event}];else if(t.resource)Z.LookupAttributes=[{AttributeKey:"ResourceName",AttributeValue:t.resource}];let ie=(await I.lookupEvents(Z)).Events||[];if(L.succeed(`Found ${ie.length} event(s)`),ie.length===0){e("No events found matching criteria");return}c(["Time","Event","User","Source IP","Resources"],ie.map((oe)=>[oe.EventTime?new Date(oe.EventTime).toLocaleString():"N/A",oe.EventName||"N/A",oe.Username||"N/A",oe.SourceIPAddress||"N/A",(oe.Resources||[]).map((ae)=>ae.ResourceName).join(", ").substring(0,30)||"-"]))}catch(m){r(`Failed to lookup events: ${m.message}`),process.exit(1)}}),R.command("audit:event <eventId>","Show CloudTrail event details").option("--region <region>","AWS region").action(async(t,m)=>{i(`Event: ${t}`);try{let k=await Ne(),I=m.region||k.project.region||"us-east-1",L=await Ki(I),z=new s("Fetching event...");z.start();let Z=(await L.lookupEvents({LookupAttributes:[{AttributeKey:"EventId",AttributeValue:t}],MaxResults:1})).Events?.[0];if(!Z){z.fail("Event not found");return}if(z.succeed("Event loaded"),e(`
+Status:`),e(`  Logging: ${Z.IsLogging?"Active":"Stopped"}`),Z.LatestDeliveryTime)e(`  Latest Delivery: ${new Date(Z.LatestDeliveryTime).toLocaleString()}`);if(Z.LatestDeliveryError)a(`  Latest Error: ${Z.LatestDeliveryError}`);try{let ee=await L.getEventSelectors(t);if(ee.EventSelectors&&ee.EventSelectors.length>0){e(`
+Event Selectors:`);for(let oe of ee.EventSelectors)if(e(`  - Read/Write: ${oe.ReadWriteType}`),e(`    Management Events: ${oe.IncludeManagementEvents?"Yes":"No"}`),oe.DataResources&&oe.DataResources.length>0)e(`    Data Resources: ${oe.DataResources.length} configured`)}}catch{}}catch(k){r(`Failed to get trail: ${k.message}`),process.exit(1)}}),R.command("audit:events","Look up recent CloudTrail events").option("--region <region>","AWS region").option("--user <username>","Filter by IAM user").option("--event <eventName>","Filter by event name").option("--resource <resourceName>","Filter by resource name").option("--hours <number>","Hours to look back",{default:"24"}).option("--limit <number>","Maximum events to return",{default:"50"}).action(async(t)=>{i("CloudTrail Events");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=await Ki(k),L=new s("Looking up events...");L.start();let z=new Date,Z={StartTime:new Date(z.getTime()-Number.parseInt(t.hours)*60*60*1000),EndTime:z,MaxResults:Number.parseInt(t.limit)};if(t.user)Z.LookupAttributes=[{AttributeKey:"Username",AttributeValue:t.user}];else if(t.event)Z.LookupAttributes=[{AttributeKey:"EventName",AttributeValue:t.event}];else if(t.resource)Z.LookupAttributes=[{AttributeKey:"ResourceName",AttributeValue:t.resource}];let ee=(await I.lookupEvents(Z)).Events||[];if(L.succeed(`Found ${ee.length} event(s)`),ee.length===0){e("No events found matching criteria");return}c(["Time","Event","User","Source IP","Resources"],ee.map((oe)=>[oe.EventTime?new Date(oe.EventTime).toLocaleString():"N/A",oe.EventName||"N/A",oe.Username||"N/A",oe.SourceIPAddress||"N/A",(oe.Resources||[]).map((se)=>se.ResourceName).join(", ").substring(0,30)||"-"]))}catch(m){r(`Failed to lookup events: ${m.message}`),process.exit(1)}}),R.command("audit:event <eventId>","Show CloudTrail event details").option("--region <region>","AWS region").action(async(t,m)=>{i(`Event: ${t}`);try{let k=await De(),I=m.region||k.project.region||"us-east-1",L=await Ki(I),z=new s("Fetching event...");z.start();let Z=(await L.lookupEvents({LookupAttributes:[{AttributeKey:"EventId",AttributeValue:t}],MaxResults:1})).Events?.[0];if(!Z){z.fail("Event not found");return}if(z.succeed("Event loaded"),e(`
 Event Information:`),e(`  Event ID: ${Z.EventId}`),e(`  Event Name: ${Z.EventName}`),e(`  Event Time: ${Z.EventTime?new Date(Z.EventTime).toLocaleString():"N/A"}`),e(`  Event Source: ${Z.EventSource}`),e(`  Username: ${Z.Username}`),e(`  Source IP: ${Z.SourceIPAddress}`),e(`  Access Key: ${Z.AccessKeyId||"N/A"}`),Z.Resources&&Z.Resources.length>0){e(`
 Resources:`);for(let X of Z.Resources)e(`  - ${X.ResourceType}: ${X.ResourceName}`)}if(Z.CloudTrailEvent){e(`
 Full Event Record:`);let X=JSON.parse(Z.CloudTrailEvent);console.log(JSON.stringify(X,null,2))}}catch(k){r(`Failed to get event: ${k.message}`),process.exit(1)}}),R.command("audit:create <trailName>","Create a new CloudTrail trail").option("--region <region>","AWS region",{default:"us-east-1"}).option("--bucket <name>","S3 bucket for logs").option("--prefix <prefix>","S3 key prefix").option("--multi-region","Enable multi-region trail").option("--validation","Enable log file validation").option("--global-events","Include global service events").action(async(t,m)=>{i("Create CloudTrail Trail");try{if(!m.bucket){r("--bucket is required");return}let k=await Ki(m.region);if(e(`Trail Name: ${t}`),e(`S3 Bucket: ${m.bucket}`),e(`Multi-Region: ${m.multiRegion?"Yes":"No"}`),e(`Log Validation: ${m.validation?"Yes":"No"}`),e(`Global Events: ${m.globalEvents?"Yes":"No"}`),!await d(`
 Create this trail?`,!0)){e("Operation cancelled");return}let L=new s("Creating trail...");L.start();let z=await k.createTrail({Name:t,S3BucketName:m.bucket,S3KeyPrefix:m.prefix,IsMultiRegionTrail:m.multiRegion,EnableLogFileValidation:m.validation,IncludeGlobalServiceEvents:m.globalEvents??!0});L.text="Starting logging...",await k.startLogging(t),L.succeed("Trail created and logging started"),n(`
 Trail ARN: ${z.TrailARN}`),e(`S3 Bucket: ${z.S3BucketName}`)}catch(k){r(`Failed to create trail: ${k.message}`),process.exit(1)}}),R.command("audit:start <trailName>","Start CloudTrail logging").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Start CloudTrail Logging");try{let k=await Ki(m.region),I=new s("Starting logging...");I.start(),await k.startLogging(t),I.succeed("Logging started")}catch(k){r(`Failed to start logging: ${k.message}`),process.exit(1)}}),R.command("audit:stop <trailName>","Stop CloudTrail logging").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Stop CloudTrail Logging");try{let k=await Ki(m.region);if(a(`This will stop logging for trail: ${t}`),!await d(`
 Stop logging?`,!1)){e("Operation cancelled");return}let L=new s("Stopping logging...");L.start(),await k.stopLogging(t),L.succeed("Logging stopped")}catch(k){r(`Failed to stop logging: ${k.message}`),process.exit(1)}}),R.command("audit:delete <trailName>","Delete a CloudTrail trail").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Delete CloudTrail Trail");try{let k=await Ki(m.region);if(a(`This will permanently delete trail: ${t}`),!await d(`
-Delete this trail?`,!1)){e("Operation cancelled");return}let L=new s("Deleting trail...");L.start(),await k.deleteTrail(t),L.succeed("Trail deleted")}catch(k){r(`Failed to delete trail: ${k.message}`),process.exit(1)}})}function Ol(R){R.command("status","Show overall infrastructure health dashboard").option("--region <region>","AWS region").action(async(t)=>{i("Infrastructure Status Dashboard");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1";e(`Region: ${k}`),e(`Project: ${m.project.name||"Unknown"}`),e("");let I=[],L=new s("Checking EC2 instances...");L.start();try{let{EC2Client:de}=await import("./chunk-1qez75tb.js"),De=await new de(k).describeInstances({Filters:[{Name:"instance-state-name",Values:["running","pending","stopping","stopped"]}]}),Se=0,Re=0,Pe=0;for(let ze of De.Reservations||[])for(let Le of ze.Instances||[])if(Pe++,Le.State?.Name==="running")Se++;else if(Le.State?.Name==="stopped")Re++;L.succeed("EC2 instances checked"),I.push({name:"EC2 Instances",status:Se>0?"OK":Pe>0?"WARN":"INFO",details:`${Se} running, ${Re} stopped, ${Pe} total`})}catch(de){L.fail("EC2 check failed"),I.push({name:"EC2 Instances",status:"ERROR",details:de.message})}let z=new s("Checking RDS instances...");z.start();try{let{RDSClient:de}=await import("./chunk-b9ersj22.js"),Se=(await new de(k).describeDBInstances()).DBInstances||[],Re=Se.filter((Pe)=>Pe.DBInstanceStatus==="available").length;z.succeed("RDS instances checked"),I.push({name:"RDS Databases",status:Se.length>0&&Re===Se.length?"OK":Se.length>0?"WARN":"INFO",details:`${Re} available, ${Se.length} total`})}catch(de){z.fail("RDS check failed"),I.push({name:"RDS Databases",status:"ERROR",details:de.message})}let Y=new s("Checking Lambda functions...");Y.start();try{let{LambdaClient:de}=await import("./chunk-9zwvysdn.js"),Se=(await new de(k).listFunctions()).Functions||[];Y.succeed("Lambda functions checked"),I.push({name:"Lambda Functions",status:"OK",details:`${Se.length} function(s)`})}catch(de){Y.fail("Lambda check failed"),I.push({name:"Lambda Functions",status:"ERROR",details:de.message})}let Z=new s("Checking S3 buckets...");Z.start();try{let{S3Client:de}=await import("./chunk-1rrmswhq.js"),Se=(await new de(k).listBuckets()).Buckets||[];Z.succeed("S3 buckets checked"),I.push({name:"S3 Buckets",status:"OK",details:`${Se.length} bucket(s)`})}catch(de){Z.fail("S3 check failed"),I.push({name:"S3 Buckets",status:"ERROR",details:de.message})}let X=new s("Checking CloudFront distributions...");X.start();try{let{CloudFrontClient:de}=await import("./chunk-s9k81gq6.js"),De=await new de().listDistributions(),Se=De.filter((Re)=>Re.Status==="Deployed").length;X.succeed("CloudFront checked"),I.push({name:"CloudFront",status:De.length>0&&Se===De.length?"OK":De.length>0?"WARN":"INFO",details:`${Se} deployed, ${De.length} total`})}catch(de){X.fail("CloudFront check failed"),I.push({name:"CloudFront",status:"ERROR",details:de.message})}let ie=new s("Checking SQS queues...");ie.start();try{let{SQSClient:de}=await import("./chunk-q3mtvtem.js"),Se=(await new de(k).listQueues()).QueueUrls||[];ie.succeed("SQS queues checked"),I.push({name:"SQS Queues",status:"OK",details:`${Se.length} queue(s)`})}catch(de){ie.fail("SQS check failed"),I.push({name:"SQS Queues",status:"ERROR",details:de.message})}let oe=new s("Checking CloudFormation stacks...");oe.start();try{let{CloudFormationClient:de}=await import("./chunk-ybekawxv.js"),Se=(await new de(k).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE"])).StackSummaries||[],Re=Se.filter((Le)=>Le.StackStatus==="CREATE_COMPLETE"||Le.StackStatus==="UPDATE_COMPLETE").length,Pe=Se.filter((Le)=>Le.StackStatus?.includes("IN_PROGRESS")).length,ze=Se.filter((Le)=>Le.StackStatus?.includes("ROLLBACK")).length;oe.succeed("CloudFormation checked"),I.push({name:"CloudFormation",status:ze>0?"WARN":Pe>0?"INFO":"OK",details:`${Re} healthy, ${Pe} in progress, ${ze} rolled back`})}catch(de){oe.fail("CloudFormation check failed"),I.push({name:"CloudFormation",status:"ERROR",details:de.message})}let ae=new s("Checking SSL certificates...");ae.start();try{let{ACMClient:de}=await import("./chunk-qpd51n1j.js"),ke=new de("us-east-1"),Se=(await ke.listCertificates()).CertificateSummaryList||[],Re=await Promise.all(Se.map((Be)=>ke.describeCertificate({CertificateArn:Be.CertificateArn}))),Pe=Re.filter((Be)=>Be.Status==="ISSUED").length,ze=Re.filter((Be)=>Be.Status==="PENDING_VALIDATION").length,Le=Re.filter((Be)=>{if(Be.NotAfter)return(new Date(Be.NotAfter).getTime()-Date.now())/86400000<30;return!1}).length;ae.succeed("SSL certificates checked"),I.push({name:"SSL Certificates",status:Le>0?"WARN":ze>0?"INFO":"OK",details:`${Pe} issued, ${ze} pending${Le>0?`, ${Le} expiring soon`:""}`})}catch(de){ae.fail("ACM check failed"),I.push({name:"SSL Certificates",status:"ERROR",details:de.message})}e(`
+Delete this trail?`,!1)){e("Operation cancelled");return}let L=new s("Deleting trail...");L.start(),await k.deleteTrail(t),L.succeed("Trail deleted")}catch(k){r(`Failed to delete trail: ${k.message}`),process.exit(1)}})}function Ol(R){R.command("status","Show overall infrastructure health dashboard").option("--region <region>","AWS region").action(async(t)=>{i("Infrastructure Status Dashboard");try{let m=await De(),k=t.region||m.project.region||"us-east-1";e(`Region: ${k}`),e(`Project: ${m.project.name||"Unknown"}`),e("");let I=[],L=new s("Checking EC2 instances...");L.start();try{let{EC2Client:ce}=await import("./chunk-49zcdbn0.js"),xe=await new ce(k).describeInstances({Filters:[{Name:"instance-state-name",Values:["running","pending","stopping","stopped"]}]}),ve=0,Re=0,Ie=0;for(let Me of xe.Reservations||[])for(let Ne of Me.Instances||[])if(Ie++,Ne.State?.Name==="running")ve++;else if(Ne.State?.Name==="stopped")Re++;L.succeed("EC2 instances checked"),I.push({name:"EC2 Instances",status:ve>0?"OK":Ie>0?"WARN":"INFO",details:`${ve} running, ${Re} stopped, ${Ie} total`})}catch(ce){L.fail("EC2 check failed"),I.push({name:"EC2 Instances",status:"ERROR",details:ce.message})}let z=new s("Checking RDS instances...");z.start();try{let{RDSClient:ce}=await import("./chunk-ckbv6y4c.js"),ve=(await new ce(k).describeDBInstances()).DBInstances||[],Re=ve.filter((Ie)=>Ie.DBInstanceStatus==="available").length;z.succeed("RDS instances checked"),I.push({name:"RDS Databases",status:ve.length>0&&Re===ve.length?"OK":ve.length>0?"WARN":"INFO",details:`${Re} available, ${ve.length} total`})}catch(ce){z.fail("RDS check failed"),I.push({name:"RDS Databases",status:"ERROR",details:ce.message})}let Y=new s("Checking Lambda functions...");Y.start();try{let{LambdaClient:ce}=await import("./chunk-tyeessz3.js"),ve=(await new ce(k).listFunctions()).Functions||[];Y.succeed("Lambda functions checked"),I.push({name:"Lambda Functions",status:"OK",details:`${ve.length} function(s)`})}catch(ce){Y.fail("Lambda check failed"),I.push({name:"Lambda Functions",status:"ERROR",details:ce.message})}let Z=new s("Checking S3 buckets...");Z.start();try{let{S3Client:ce}=await import("./chunk-sxfdxk39.js"),ve=(await new ce(k).listBuckets()).Buckets||[];Z.succeed("S3 buckets checked"),I.push({name:"S3 Buckets",status:"OK",details:`${ve.length} bucket(s)`})}catch(ce){Z.fail("S3 check failed"),I.push({name:"S3 Buckets",status:"ERROR",details:ce.message})}let X=new s("Checking CloudFront distributions...");X.start();try{let{CloudFrontClient:ce}=await import("./chunk-rhncmffy.js"),xe=await new ce().listDistributions(),ve=xe.filter((Re)=>Re.Status==="Deployed").length;X.succeed("CloudFront checked"),I.push({name:"CloudFront",status:xe.length>0&&ve===xe.length?"OK":xe.length>0?"WARN":"INFO",details:`${ve} deployed, ${xe.length} total`})}catch(ce){X.fail("CloudFront check failed"),I.push({name:"CloudFront",status:"ERROR",details:ce.message})}let ee=new s("Checking SQS queues...");ee.start();try{let{SQSClient:ce}=await import("./chunk-ty2pdbz3.js"),ve=(await new ce(k).listQueues()).QueueUrls||[];ee.succeed("SQS queues checked"),I.push({name:"SQS Queues",status:"OK",details:`${ve.length} queue(s)`})}catch(ce){ee.fail("SQS check failed"),I.push({name:"SQS Queues",status:"ERROR",details:ce.message})}let oe=new s("Checking CloudFormation stacks...");oe.start();try{let{CloudFormationClient:ce}=await import("./chunk-6qhgzf9a.js"),ve=(await new ce(k).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE"])).StackSummaries||[],Re=ve.filter((Ne)=>Ne.StackStatus==="CREATE_COMPLETE"||Ne.StackStatus==="UPDATE_COMPLETE").length,Ie=ve.filter((Ne)=>Ne.StackStatus?.includes("IN_PROGRESS")).length,Me=ve.filter((Ne)=>Ne.StackStatus?.includes("ROLLBACK")).length;oe.succeed("CloudFormation checked"),I.push({name:"CloudFormation",status:Me>0?"WARN":Ie>0?"INFO":"OK",details:`${Re} healthy, ${Ie} in progress, ${Me} rolled back`})}catch(ce){oe.fail("CloudFormation check failed"),I.push({name:"CloudFormation",status:"ERROR",details:ce.message})}let se=new s("Checking SSL certificates...");se.start();try{let{ACMClient:ce}=await import("./chunk-9g4qsx30.js"),Se=new ce("us-east-1"),ve=(await Se.listCertificates()).CertificateSummaryList||[],Re=await Promise.all(ve.map((Fe)=>Se.describeCertificate({CertificateArn:Fe.CertificateArn}))),Ie=Re.filter((Fe)=>Fe.Status==="ISSUED").length,Me=Re.filter((Fe)=>Fe.Status==="PENDING_VALIDATION").length,Ne=Re.filter((Fe)=>{if(Fe.NotAfter)return(new Date(Fe.NotAfter).getTime()-Date.now())/86400000<30;return!1}).length;se.succeed("SSL certificates checked"),I.push({name:"SSL Certificates",status:Ne>0?"WARN":Me>0?"INFO":"OK",details:`${Ie} issued, ${Me} pending${Ne>0?`, ${Ne} expiring soon`:""}`})}catch(ce){se.fail("ACM check failed"),I.push({name:"SSL Certificates",status:"ERROR",details:ce.message})}e(`
 `+"=".repeat(60)),e("HEALTH SUMMARY"),e("=".repeat(60)+`
-`);for(let de of I){let ke="";if(de.status==="OK")ke=`${C.green}[OK]${C.reset}`;else if(de.status==="WARN")ke=`${C.yellow}[WARN]${C.reset}`;else if(de.status==="ERROR")ke=`${C.red}[ERROR]${C.reset}`;else ke=`${C.blue}[INFO]${C.reset}`;console.log(`${ke} ${de.name.padEnd(20)} ${de.details}`)}let be=I.some((de)=>de.status==="ERROR"),Ae=I.some((de)=>de.status==="WARN");if(e(""),be)r("Some services have errors. Check the details above.");else if(Ae)a("Some services need attention. Check the warnings above.");else n("All services are healthy!")}catch(m){r(`Failed to get status: ${m.message}`),process.exit(1)}}),R.command("status:costs","Show current month cost summary").option("--region <region>","AWS region").action(async(t)=>{i("Cost Summary");try{e("Fetching cost data from AWS Cost Explorer..."),e("");let m=new Date,k=new Date(m.getFullYear(),m.getMonth(),1),I=new Date(m.getFullYear(),m.getMonth()+1,0);e(`Period: ${k.toISOString().split("T")[0]} to ${I.toISOString().split("T")[0]}`),e(""),e("Note: Cost data requires AWS Cost Explorer API access."),e("Run `cloud cost` for detailed cost analysis.")}catch(m){r(`Failed to get cost summary: ${m.message}`),process.exit(1)}}),R.command("status:alarms","Show CloudWatch alarm status").option("--region <region>","AWS region").action(async(t)=>{i("CloudWatch Alarms");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",{AWSClient:I}=await import("./chunk-5tzygzdy.js");class L{client;region;constructor(be){this.region=be,this.client=new I}async describeAlarms(){return this.client.request({service:"monitoring",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=DescribeAlarms&Version=2010-08-01"})}}let z=new L(k),Y=new s("Fetching alarms...");Y.start();let X=(await z.describeAlarms()).MetricAlarms||[];if(Y.succeed(`Found ${X.length} alarm(s)`),X.length===0){e("No CloudWatch alarms configured");return}let ie=X.filter((be)=>be.StateValue==="ALARM"),oe=X.filter((be)=>be.StateValue==="OK"),ae=X.filter((be)=>be.StateValue==="INSUFFICIENT_DATA");if(e(""),e(`Alarming: ${ie.length}`),e(`OK: ${oe.length}`),e(`Insufficient Data: ${ae.length}`),ie.length>0){e(`
-Alarms in ALARM state:`);for(let be of ie)r(`  - ${be.AlarmName}: ${be.AlarmDescription||"No description"}`)}}catch(m){r(`Failed to get alarms: ${m.message}`),process.exit(1)}})}async function jr(R){let{AWSClient:t}=await import("./chunk-5tzygzdy.js");class m{client;region;constructor(k){this.region=k,this.client=new t}async jsonRpcRequest(k,I){return this.client.request({service:"backup",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`CryoControllerFrontendService.${k}`},body:JSON.stringify(I)})}async listBackupVaults(){return this.jsonRpcRequest("ListBackupVaults",{})}async listBackupPlans(){return this.jsonRpcRequest("ListBackupPlans",{})}async listRecoveryPointsByBackupVault(k,I){return this.jsonRpcRequest("ListRecoveryPointsByBackupVault",{BackupVaultName:k,...I})}async describeBackupVault(k){return this.jsonRpcRequest("DescribeBackupVault",{BackupVaultName:k})}async getBackupPlan(k){return this.jsonRpcRequest("GetBackupPlan",{BackupPlanId:k})}async createBackupVault(k,I){return this.jsonRpcRequest("CreateBackupVault",{BackupVaultName:k,...I})}async deleteBackupVault(k){return this.jsonRpcRequest("DeleteBackupVault",{BackupVaultName:k})}async createBackupPlan(k){return this.jsonRpcRequest("CreateBackupPlan",{BackupPlan:k})}async deleteBackupPlan(k){return this.jsonRpcRequest("DeleteBackupPlan",{BackupPlanId:k})}async startBackupJob(k){return this.jsonRpcRequest("StartBackupJob",k)}async startRestoreJob(k){return this.jsonRpcRequest("StartRestoreJob",k)}async describeBackupJob(k){return this.jsonRpcRequest("DescribeBackupJob",{BackupJobId:k})}async describeRestoreJob(k){return this.jsonRpcRequest("DescribeRestoreJob",{RestoreJobId:k})}async listBackupJobs(k){return this.jsonRpcRequest("ListBackupJobs",k||{})}async listRestoreJobs(k){return this.jsonRpcRequest("ListRestoreJobs",k||{})}async createBackupSelection(k,I){return this.jsonRpcRequest("CreateBackupSelection",{BackupPlanId:k,BackupSelection:I})}async listBackupSelections(k){return this.jsonRpcRequest("ListBackupSelections",{BackupPlanId:k})}}return new m(R)}function Ll(R){R.command("backup:vaults","List backup vaults").option("--region <region>","AWS region").action(async(t)=>{i("Backup Vaults");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=await jr(k),L=new s("Fetching vaults...");L.start();let Y=(await I.listBackupVaults()).BackupVaultList||[];if(L.succeed(`Found ${Y.length} vault(s)`),Y.length===0){e("No backup vaults found"),e("Use `cloud backup:create-vault` to create a new vault");return}c(["Vault Name","Recovery Points","Created","Encrypted"],Y.map((Z)=>[Z.BackupVaultName||"N/A",(Z.NumberOfRecoveryPoints||0).toString(),Z.CreationDate?new Date(Z.CreationDate).toLocaleDateString():"N/A",Z.EncryptionKeyArn?"Yes":"Default"]))}catch(m){r(`Failed to list vaults: ${m.message}`),process.exit(1)}}),R.command("backup:list","List backup plans").option("--region <region>","AWS region").action(async(t)=>{i("Backup Plans");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=await jr(k),L=new s("Fetching backup plans...");L.start();let Y=(await I.listBackupPlans()).BackupPlansList||[];if(L.succeed(`Found ${Y.length} backup plan(s)`),Y.length===0){e("No backup plans found"),e("Use `cloud backup:create` to create a backup plan");return}c(["Plan Name","Plan ID","Version","Created"],Y.map((Z)=>[Z.BackupPlanName||"N/A",Z.BackupPlanId||"N/A",Z.VersionId?.substring(0,8)||"N/A",Z.CreationDate?new Date(Z.CreationDate).toLocaleDateString():"N/A"]))}catch(m){r(`Failed to list backup plans: ${m.message}`),process.exit(1)}}),R.command("backup:recovery-points <vaultName>","List recovery points in a vault").option("--region <region>","AWS region").option("--limit <number>","Maximum results",{default:"50"}).action(async(t,m)=>{i(`Recovery Points: ${t}`);try{let k=await Ne(),I=m.region||k.project.region||"us-east-1",L=await jr(I),z=new s("Fetching recovery points...");z.start();let Z=(await L.listRecoveryPointsByBackupVault(t,{MaxResults:Number.parseInt(m.limit)})).RecoveryPoints||[];if(z.succeed(`Found ${Z.length} recovery point(s)`),Z.length===0){e("No recovery points found");return}c(["Resource","Status","Created","Size","Lifecycle"],Z.map((X)=>[X.ResourceArn?.split(":").pop()||"N/A",X.Status||"N/A",X.CreationDate?new Date(X.CreationDate).toLocaleString():"N/A",X.BackupSizeInBytes?Nu(X.BackupSizeInBytes):"N/A",X.Lifecycle?.DeleteAfterDays?`${X.Lifecycle.DeleteAfterDays} days`:"Indefinite"]))}catch(k){r(`Failed to list recovery points: ${k.message}`),process.exit(1)}}),R.command("backup:create-vault <vaultName>","Create a backup vault").option("--region <region>","AWS region",{default:"us-east-1"}).option("--kms-key <arn>","KMS key ARN for encryption").action(async(t,m)=>{i("Create Backup Vault");try{let k=await jr(m.region);if(e(`Vault Name: ${t}`),e(`Region: ${m.region}`),e(`Encryption: ${m.kmsKey?"Custom KMS":"AWS Managed"}`),!await d(`
+`);for(let ce of I){let Se="";if(ce.status==="OK")Se=`${C.green}[OK]${C.reset}`;else if(ce.status==="WARN")Se=`${C.yellow}[WARN]${C.reset}`;else if(ce.status==="ERROR")Se=`${C.red}[ERROR]${C.reset}`;else Se=`${C.blue}[INFO]${C.reset}`;console.log(`${Se} ${ce.name.padEnd(20)} ${ce.details}`)}let ue=I.some((ce)=>ce.status==="ERROR"),ke=I.some((ce)=>ce.status==="WARN");if(e(""),ue)r("Some services have errors. Check the details above.");else if(ke)a("Some services need attention. Check the warnings above.");else n("All services are healthy!")}catch(m){r(`Failed to get status: ${m.message}`),process.exit(1)}}),R.command("status:costs","Show current month cost summary").option("--region <region>","AWS region").action(async(t)=>{i("Cost Summary");try{e("Fetching cost data from AWS Cost Explorer..."),e("");let m=new Date,k=new Date(m.getFullYear(),m.getMonth(),1),I=new Date(m.getFullYear(),m.getMonth()+1,0);e(`Period: ${k.toISOString().split("T")[0]} to ${I.toISOString().split("T")[0]}`),e(""),e("Note: Cost data requires AWS Cost Explorer API access."),e("Run `cloud cost` for detailed cost analysis.")}catch(m){r(`Failed to get cost summary: ${m.message}`),process.exit(1)}}),R.command("status:alarms","Show CloudWatch alarm status").option("--region <region>","AWS region").action(async(t)=>{i("CloudWatch Alarms");try{let m=await De(),k=t.region||m.project.region||"us-east-1",{AWSClient:I}=await import("./chunk-we82q71y.js");class L{client;region;constructor(ue){this.region=ue,this.client=new I}async describeAlarms(){return this.client.request({service:"monitoring",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=DescribeAlarms&Version=2010-08-01"})}}let z=new L(k),Y=new s("Fetching alarms...");Y.start();let X=(await z.describeAlarms()).MetricAlarms||[];if(Y.succeed(`Found ${X.length} alarm(s)`),X.length===0){e("No CloudWatch alarms configured");return}let ee=X.filter((ue)=>ue.StateValue==="ALARM"),oe=X.filter((ue)=>ue.StateValue==="OK"),se=X.filter((ue)=>ue.StateValue==="INSUFFICIENT_DATA");if(e(""),e(`Alarming: ${ee.length}`),e(`OK: ${oe.length}`),e(`Insufficient Data: ${se.length}`),ee.length>0){e(`
+Alarms in ALARM state:`);for(let ue of ee)r(`  - ${ue.AlarmName}: ${ue.AlarmDescription||"No description"}`)}}catch(m){r(`Failed to get alarms: ${m.message}`),process.exit(1)}})}async function Sr(R){let{AWSClient:t}=await import("./chunk-we82q71y.js");class m{client;region;constructor(k){this.region=k,this.client=new t}async jsonRpcRequest(k,I){return this.client.request({service:"backup",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`CryoControllerFrontendService.${k}`},body:JSON.stringify(I)})}async listBackupVaults(){return this.jsonRpcRequest("ListBackupVaults",{})}async listBackupPlans(){return this.jsonRpcRequest("ListBackupPlans",{})}async listRecoveryPointsByBackupVault(k,I){return this.jsonRpcRequest("ListRecoveryPointsByBackupVault",{BackupVaultName:k,...I})}async describeBackupVault(k){return this.jsonRpcRequest("DescribeBackupVault",{BackupVaultName:k})}async getBackupPlan(k){return this.jsonRpcRequest("GetBackupPlan",{BackupPlanId:k})}async createBackupVault(k,I){return this.jsonRpcRequest("CreateBackupVault",{BackupVaultName:k,...I})}async deleteBackupVault(k){return this.jsonRpcRequest("DeleteBackupVault",{BackupVaultName:k})}async createBackupPlan(k){return this.jsonRpcRequest("CreateBackupPlan",{BackupPlan:k})}async deleteBackupPlan(k){return this.jsonRpcRequest("DeleteBackupPlan",{BackupPlanId:k})}async startBackupJob(k){return this.jsonRpcRequest("StartBackupJob",k)}async startRestoreJob(k){return this.jsonRpcRequest("StartRestoreJob",k)}async describeBackupJob(k){return this.jsonRpcRequest("DescribeBackupJob",{BackupJobId:k})}async describeRestoreJob(k){return this.jsonRpcRequest("DescribeRestoreJob",{RestoreJobId:k})}async listBackupJobs(k){return this.jsonRpcRequest("ListBackupJobs",k||{})}async listRestoreJobs(k){return this.jsonRpcRequest("ListRestoreJobs",k||{})}async createBackupSelection(k,I){return this.jsonRpcRequest("CreateBackupSelection",{BackupPlanId:k,BackupSelection:I})}async listBackupSelections(k){return this.jsonRpcRequest("ListBackupSelections",{BackupPlanId:k})}}return new m(R)}function Ll(R){R.command("backup:vaults","List backup vaults").option("--region <region>","AWS region").action(async(t)=>{i("Backup Vaults");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=await Sr(k),L=new s("Fetching vaults...");L.start();let Y=(await I.listBackupVaults()).BackupVaultList||[];if(L.succeed(`Found ${Y.length} vault(s)`),Y.length===0){e("No backup vaults found"),e("Use `cloud backup:create-vault` to create a new vault");return}c(["Vault Name","Recovery Points","Created","Encrypted"],Y.map((Z)=>[Z.BackupVaultName||"N/A",(Z.NumberOfRecoveryPoints||0).toString(),Z.CreationDate?new Date(Z.CreationDate).toLocaleDateString():"N/A",Z.EncryptionKeyArn?"Yes":"Default"]))}catch(m){r(`Failed to list vaults: ${m.message}`),process.exit(1)}}),R.command("backup:list","List backup plans").option("--region <region>","AWS region").action(async(t)=>{i("Backup Plans");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=await Sr(k),L=new s("Fetching backup plans...");L.start();let Y=(await I.listBackupPlans()).BackupPlansList||[];if(L.succeed(`Found ${Y.length} backup plan(s)`),Y.length===0){e("No backup plans found"),e("Use `cloud backup:create` to create a backup plan");return}c(["Plan Name","Plan ID","Version","Created"],Y.map((Z)=>[Z.BackupPlanName||"N/A",Z.BackupPlanId||"N/A",Z.VersionId?.substring(0,8)||"N/A",Z.CreationDate?new Date(Z.CreationDate).toLocaleDateString():"N/A"]))}catch(m){r(`Failed to list backup plans: ${m.message}`),process.exit(1)}}),R.command("backup:recovery-points <vaultName>","List recovery points in a vault").option("--region <region>","AWS region").option("--limit <number>","Maximum results",{default:"50"}).action(async(t,m)=>{i(`Recovery Points: ${t}`);try{let k=await De(),I=m.region||k.project.region||"us-east-1",L=await Sr(I),z=new s("Fetching recovery points...");z.start();let Z=(await L.listRecoveryPointsByBackupVault(t,{MaxResults:Number.parseInt(m.limit)})).RecoveryPoints||[];if(z.succeed(`Found ${Z.length} recovery point(s)`),Z.length===0){e("No recovery points found");return}c(["Resource","Status","Created","Size","Lifecycle"],Z.map((X)=>[X.ResourceArn?.split(":").pop()||"N/A",X.Status||"N/A",X.CreationDate?new Date(X.CreationDate).toLocaleString():"N/A",X.BackupSizeInBytes?Nu(X.BackupSizeInBytes):"N/A",X.Lifecycle?.DeleteAfterDays?`${X.Lifecycle.DeleteAfterDays} days`:"Indefinite"]))}catch(k){r(`Failed to list recovery points: ${k.message}`),process.exit(1)}}),R.command("backup:create-vault <vaultName>","Create a backup vault").option("--region <region>","AWS region",{default:"us-east-1"}).option("--kms-key <arn>","KMS key ARN for encryption").action(async(t,m)=>{i("Create Backup Vault");try{let k=await Sr(m.region);if(e(`Vault Name: ${t}`),e(`Region: ${m.region}`),e(`Encryption: ${m.kmsKey?"Custom KMS":"AWS Managed"}`),!await d(`
 Create this vault?`,!0)){e("Operation cancelled");return}let L=new s("Creating vault...");L.start(),await k.createBackupVault(t,{EncryptionKeyArn:m.kmsKey}),L.succeed("Vault created"),n(`
-Vault: ${t}`)}catch(k){r(`Failed to create vault: ${k.message}`),process.exit(1)}}),R.command("backup:create <planName>","Create a backup plan").option("--region <region>","AWS region",{default:"us-east-1"}).option("--vault <name>","Target backup vault",{default:"Default"}).option("--schedule <cron>","Backup schedule (cron expression)",{default:"cron(0 5 ? * * *)"}).option("--retention <days>","Retention period in days",{default:"30"}).option("--lifecycle-cold <days>","Move to cold storage after days").action(async(t,m)=>{i("Create Backup Plan");try{let k=await jr(m.region);if(e(`Plan Name: ${t}`),e(`Vault: ${m.vault}`),e(`Schedule: ${m.schedule}`),e(`Retention: ${m.retention} days`),!await d(`
+Vault: ${t}`)}catch(k){r(`Failed to create vault: ${k.message}`),process.exit(1)}}),R.command("backup:create <planName>","Create a backup plan").option("--region <region>","AWS region",{default:"us-east-1"}).option("--vault <name>","Target backup vault",{default:"Default"}).option("--schedule <cron>","Backup schedule (cron expression)",{default:"cron(0 5 ? * * *)"}).option("--retention <days>","Retention period in days",{default:"30"}).option("--lifecycle-cold <days>","Move to cold storage after days").action(async(t,m)=>{i("Create Backup Plan");try{let k=await Sr(m.region);if(e(`Plan Name: ${t}`),e(`Vault: ${m.vault}`),e(`Schedule: ${m.schedule}`),e(`Retention: ${m.retention} days`),!await d(`
 Create this backup plan?`,!0)){e("Operation cancelled");return}let L=new s("Creating backup plan...");L.start();let z={DeleteAfterDays:Number.parseInt(m.retention)};if(m.lifecycleCold)z.MoveToColdStorageAfterDays=Number.parseInt(m.lifecycleCold);let Y=await k.createBackupPlan({BackupPlanName:t,Rules:[{RuleName:`${t}-daily`,TargetBackupVaultName:m.vault,ScheduleExpression:m.schedule,StartWindowMinutes:60,CompletionWindowMinutes:180,Lifecycle:z}]});L.succeed("Backup plan created"),n(`
-Plan ID: ${Y.BackupPlanId}`),e("\nNote: Add resource selections with `cloud backup:add-selection`")}catch(k){r(`Failed to create backup plan: ${k.message}`),process.exit(1)}}),R.command("backup:add-selection <planId>","Add resources to a backup plan").option("--region <region>","AWS region",{default:"us-east-1"}).option("--name <name>","Selection name").option("--role <arn>","IAM role ARN for backup").option("--resource <arn>","Resource ARN to backup").option("--tag-key <key>","Tag key for resource selection").option("--tag-value <value>","Tag value for resource selection").action(async(t,m)=>{i("Add Backup Selection");try{if(!m.role){r("--role is required (IAM role ARN for AWS Backup)");return}if(!m.resource&&!m.tagKey){r("Specify --resource or --tag-key/--tag-value");return}let k=await jr(m.region),L={SelectionName:m.name||`selection-${Date.now()}`,IamRoleArn:m.role};if(m.resource)L.Resources=[m.resource],e(`Resource: ${m.resource}`);if(m.tagKey&&m.tagValue)L.ListOfTags=[{ConditionType:"STRINGEQUALS",ConditionKey:m.tagKey,ConditionValue:m.tagValue}],e(`Tag: ${m.tagKey}=${m.tagValue}`);if(!await d(`
+Plan ID: ${Y.BackupPlanId}`),e("\nNote: Add resource selections with `cloud backup:add-selection`")}catch(k){r(`Failed to create backup plan: ${k.message}`),process.exit(1)}}),R.command("backup:add-selection <planId>","Add resources to a backup plan").option("--region <region>","AWS region",{default:"us-east-1"}).option("--name <name>","Selection name").option("--role <arn>","IAM role ARN for backup").option("--resource <arn>","Resource ARN to backup").option("--tag-key <key>","Tag key for resource selection").option("--tag-value <value>","Tag value for resource selection").action(async(t,m)=>{i("Add Backup Selection");try{if(!m.role){r("--role is required (IAM role ARN for AWS Backup)");return}if(!m.resource&&!m.tagKey){r("Specify --resource or --tag-key/--tag-value");return}let k=await Sr(m.region),L={SelectionName:m.name||`selection-${Date.now()}`,IamRoleArn:m.role};if(m.resource)L.Resources=[m.resource],e(`Resource: ${m.resource}`);if(m.tagKey&&m.tagValue)L.ListOfTags=[{ConditionType:"STRINGEQUALS",ConditionKey:m.tagKey,ConditionValue:m.tagValue}],e(`Tag: ${m.tagKey}=${m.tagValue}`);if(!await d(`
 Add this selection?`,!0)){e("Operation cancelled");return}let Y=new s("Adding selection...");Y.start();let Z=await k.createBackupSelection(t,L);Y.succeed("Selection added"),n(`
-Selection ID: ${Z.SelectionId}`)}catch(k){r(`Failed to add selection: ${k.message}`),process.exit(1)}}),R.command("backup:start <resourceArn>","Start an on-demand backup").option("--region <region>","AWS region",{default:"us-east-1"}).option("--vault <name>","Backup vault name",{default:"Default"}).option("--role <arn>","IAM role ARN for backup").action(async(t,m)=>{i("Start Backup Job");try{if(!m.role){r("--role is required (IAM role ARN for AWS Backup)");return}let k=await jr(m.region);if(e(`Resource: ${t}`),e(`Vault: ${m.vault}`),!await d(`
+Selection ID: ${Z.SelectionId}`)}catch(k){r(`Failed to add selection: ${k.message}`),process.exit(1)}}),R.command("backup:start <resourceArn>","Start an on-demand backup").option("--region <region>","AWS region",{default:"us-east-1"}).option("--vault <name>","Backup vault name",{default:"Default"}).option("--role <arn>","IAM role ARN for backup").action(async(t,m)=>{i("Start Backup Job");try{if(!m.role){r("--role is required (IAM role ARN for AWS Backup)");return}let k=await Sr(m.region);if(e(`Resource: ${t}`),e(`Vault: ${m.vault}`),!await d(`
 Start backup?`,!0)){e("Operation cancelled");return}let L=new s("Starting backup job...");L.start();let z=await k.startBackupJob({BackupVaultName:m.vault,ResourceArn:t,IamRoleArn:m.role,IdempotencyToken:`cli-${Date.now()}`});L.succeed("Backup job started"),n(`
-Job ID: ${z.BackupJobId}`),e("Use `cloud backup:jobs` to check status")}catch(k){r(`Failed to start backup: ${k.message}`),process.exit(1)}}),R.command("backup:restore <recoveryPointArn>","Start a restore job").option("--region <region>","AWS region",{default:"us-east-1"}).option("--role <arn>","IAM role ARN for restore").option("--metadata <json>","Restore metadata JSON").action(async(t,m)=>{i("Start Restore Job");try{if(!m.role){r("--role is required (IAM role ARN for AWS Backup)");return}let k=await jr(m.region);e(`Recovery Point: ${t}`);let I={};if(m.metadata)I=JSON.parse(m.metadata);if(a(`
+Job ID: ${z.BackupJobId}`),e("Use `cloud backup:jobs` to check status")}catch(k){r(`Failed to start backup: ${k.message}`),process.exit(1)}}),R.command("backup:restore <recoveryPointArn>","Start a restore job").option("--region <region>","AWS region",{default:"us-east-1"}).option("--role <arn>","IAM role ARN for restore").option("--metadata <json>","Restore metadata JSON").action(async(t,m)=>{i("Start Restore Job");try{if(!m.role){r("--role is required (IAM role ARN for AWS Backup)");return}let k=await Sr(m.region);e(`Recovery Point: ${t}`);let I={};if(m.metadata)I=JSON.parse(m.metadata);if(a(`
 Restore will create new resources. Review carefully.`),!await d(`
 Start restore?`,!1)){e("Operation cancelled");return}let z=new s("Starting restore job...");z.start();let Y=await k.startRestoreJob({RecoveryPointArn:t,IamRoleArn:m.role,Metadata:I,IdempotencyToken:`cli-${Date.now()}`});z.succeed("Restore job started"),n(`
-Job ID: ${Y.RestoreJobId}`),e("Use `cloud backup:restore-jobs` to check status")}catch(k){r(`Failed to start restore: ${k.message}`),process.exit(1)}}),R.command("backup:jobs","List recent backup jobs").option("--region <region>","AWS region").option("--state <state>","Filter by state (CREATED, PENDING, RUNNING, COMPLETED, FAILED)").action(async(t)=>{i("Backup Jobs");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=await jr(k),L=new s("Fetching backup jobs...");L.start();let Y=(await I.listBackupJobs({ByState:t.state,MaxResults:50})).BackupJobs||[];if(L.succeed(`Found ${Y.length} job(s)`),Y.length===0){e("No backup jobs found");return}c(["Job ID","Resource","State","Started","Size"],Y.map((Z)=>[Z.BackupJobId?.substring(0,16)||"N/A",Z.ResourceArn?.split(":").pop()||"N/A",Z.State||"N/A",Z.CreationDate?new Date(Z.CreationDate).toLocaleString():"N/A",Z.BackupSizeInBytes?Nu(Z.BackupSizeInBytes):"N/A"]))}catch(m){r(`Failed to list backup jobs: ${m.message}`),process.exit(1)}}),R.command("backup:restore-jobs","List recent restore jobs").option("--region <region>","AWS region").option("--status <status>","Filter by status").action(async(t)=>{i("Restore Jobs");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=await jr(k),L=new s("Fetching restore jobs...");L.start();let Y=(await I.listRestoreJobs({ByStatus:t.status,MaxResults:50})).RestoreJobs||[];if(L.succeed(`Found ${Y.length} job(s)`),Y.length===0){e("No restore jobs found");return}c(["Job ID","Resource","Status","Started","Completed"],Y.map((Z)=>[Z.RestoreJobId?.substring(0,16)||"N/A",Z.CreatedResourceArn?.split(":").pop()||"Pending",Z.Status||"N/A",Z.CreationDate?new Date(Z.CreationDate).toLocaleString():"N/A",Z.CompletionDate?new Date(Z.CompletionDate).toLocaleString():"-"]))}catch(m){r(`Failed to list restore jobs: ${m.message}`),process.exit(1)}}),R.command("backup:schedule","Show backup schedule overview").option("--region <region>","AWS region").action(async(t)=>{i("Backup Schedule Overview");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",I=await jr(k),L=new s("Fetching backup plans...");L.start();let Y=(await I.listBackupPlans()).BackupPlansList||[];if(L.succeed(`Found ${Y.length} backup plan(s)`),Y.length===0){e("No backup plans configured");return}for(let Z of Y){e(`
-${Z.BackupPlanName}`),e("=".repeat(40));try{let ie=(await I.getBackupPlan(Z.BackupPlanId)).BackupPlan?.Rules||[];for(let ae of ie)if(e(`  Rule: ${ae.RuleName}`),e(`    Schedule: ${ae.ScheduleExpression}`),e(`    Vault: ${ae.TargetBackupVaultName}`),ae.Lifecycle?.DeleteAfterDays)e(`    Retention: ${ae.Lifecycle.DeleteAfterDays} days`);let oe=await I.listBackupSelections(Z.BackupPlanId);if(oe.BackupSelectionsList&&oe.BackupSelectionsList.length>0)e(`  Selections: ${oe.BackupSelectionsList.length}`)}catch{e("  (Unable to load plan details)")}}}catch(m){r(`Failed to get schedule: ${m.message}`),process.exit(1)}})}function Nu(R){if(R===0)return"0 B";let t=1024,m=["B","KB","MB","GB","TB"],k=Math.floor(Math.log(R)/Math.log(t));return`${Number.parseFloat((R/t**k).toFixed(2))} ${m[k]}`}async function kh(R){let t=await Ne(),m=y(process.cwd(),t),k=R??Object.keys(t.environments??{})[0]??"production",I=m.environments.get(k);if(!I)throw m.store.close(),Error(`Environment ${k} was not found.`);let L=new S(m.store,{workerId:`cli:${process.pid}`}),z=new di(m.store),Y=new tn(z,L),Z=new ar(m.store),X=new cr(m.store,_(process.cwd())),ie=m.store.getActorByExternalId("system","cli")??m.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});return{config:t,controlPlane:m,env:k,environmentRecord:I,queue:L,store:z,coordinator:Y,dataServices:Z,secrets:X,actor:ie}}async function $i(R,t){let m=await kh(R);try{return await t(m)}finally{m.controlPlane.store.close()}}async function ki(R){try{await R()}catch(t){r(t instanceof Error?t.message:String(t))}}function Ni(R,t,m,k){R.controlPlane.store.appendEvent({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,resourceId:k,actorId:R.actor.id,type:`backup.${t}`,payload:m})}function Ah(R,t){let m=R.store.getPolicy(t)??R.store.listPolicies(R.controlPlane.project.id,R.environmentRecord.id).find((k)=>k.name===t);if(!m||m.environmentId!==R.environmentRecord.id)throw Error(`Backup policy ${t} was not found in ${R.env}.`);return m}function ka(R,t){let m=R.store.getRecoveryPoint(t),k=R.store.listRecoveryPoints(R.controlPlane.project.id).filter((L)=>L.id.startsWith(t)),I=m??(k.length===1?k[0]:void 0);if(!I)throw Error(k.length>1?`Recovery point prefix ${t} is ambiguous.`:`Recovery point ${t} was not found.`);return I}function Ou(R,t){let m=R.store.getDestination(t)??R.store.listDestinations(R.controlPlane.project.id).find((k)=>k.name===t);if(!m)throw Error(`Backup destination ${t} was not found.`);return m}function Rh(R,t){return R.kind==="volume"?{volumeName:t}:R.kind==="logical_database"?{targetId:t,dataServiceId:t}:{targetId:t}}function Ih(R,t=[]){let m=new Map(t.map((k)=>[k.id,k.name]));return R.map((k)=>[k.id,k.status,k.verificationState,k.kind,m.get(k.policyId??"")??"manual",k.pointInTime,k.sizeBytes?`${k.sizeBytes} B`:"provider",k.held?"hold":k.pinned?"pinned":"retention"])}function Fl(R){R.command("recovery:list","Show backup coverage, destination health, and recent recovery points").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>ki(async()=>$i(t.env,async(m)=>{let k=m.store.listPolicies(m.controlPlane.project.id,m.environmentRecord.id),I=new Set(k.map((Y)=>Y.id)),L=m.store.listRecoveryPoints(m.controlPlane.project.id).filter((Y)=>!Y.policyId||I.has(Y.policyId)),z={coverage:m.store.coverage(m.controlPlane.project.id).filter((Y)=>I.has(Y.policy.id)),destinations:m.store.listDestinations(m.controlPlane.project.id).map((Y)=>({...Y,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!Y.credentialRef,clientEncryptionConfigured:!!Y.encryptionKeyRef})),policies:k,recoveryPoints:L,jobs:m.store.listJobs(m.controlPlane.project.id).filter((Y)=>!Y.policyId||I.has(Y.policyId))};if(t.json)e(JSON.stringify(z,null,2));else c(["Policy","RPO","Destination","Latest point","Verification"],z.coverage.map((Y)=>[Y.policy.name,Y.missedRpo?"MISSED":"protected",Y.destinationHealthy?"healthy":"attention",Y.lastRecoveryPoint?.pointInTime??"none",Y.lastRecoveryPoint?.verificationState??"none"])),c(["ID","State","Verification","Kind","Policy","Point in time","Size","Protection"],Ih(L,k))}))),R.command("recovery:jobs","List durable backup, verification, restore, drill, and cleanup jobs").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>ki(async()=>$i(t.env,async(m)=>{let k=new Set(m.store.listPolicies(m.controlPlane.project.id,m.environmentRecord.id).map((L)=>L.id)),I=m.store.listJobs(m.controlPlane.project.id).filter((L)=>!L.policyId||k.has(L.policyId));if(t.json)e(JSON.stringify(I,null,2));else c(["ID","Kind","State","Phase","Operation","Started","Finished","Error"],I.map((L)=>[L.id,L.kind,L.status,String(L.progress.phase??"queued"),L.operationId??"—",L.startedAt??"—",L.finishedAt??"—",L.error??"—"]))}))),R.command("recovery:destination:add <name>","Connect an S3, S3-compatible, or AWS Backup destination").option("--env <environment>","Target environment").option("--provider <provider>","aws_s3, s3_compatible, or aws_backup",{default:"aws_s3"}).option("--bucket <bucket>","Object bucket").option("--endpoint <url>","Origin-only HTTPS endpoint").option("--allow-private","Allow a private endpoint").option("--path-style","Force path-style S3 URLs").option("--prefix <prefix>","Object key prefix").option("--region <region>","Destination region").option("--credentials-env <name>","Environment variable containing credential JSON").option("--encryption <mode>","provider, client_side, or both",{default:"provider"}).option("--encryption-key-env <name>","Environment variable containing the client encryption key").option("--lock-days <days>","Default immutable retention days").action(async(t,m)=>ki(async()=>$i(m.env,async(k)=>{if(!["aws_s3","s3_compatible","aws_backup"].includes(m.provider??""))throw Error("--provider must be aws_s3, s3_compatible, or aws_backup.");if(!["provider","client_side","both"].includes(m.encryption??""))throw Error("--encryption must be provider, client_side, or both.");let I=`secret://data-services/backups/${k.controlPlane.project.id}/${t}`,L=[];try{let z,Y;if(m.credentialsEnv){let X=process.env[m.credentialsEnv];if(!X)throw Error(`${m.credentialsEnv} is empty.`);z=`${I}/credentials`,await k.secrets.put(z,X),L.push(z)}if(m.encryption!=="provider"){if(!m.encryptionKeyEnv)throw Error("Client encryption requires --encryption-key-env.");let X=process.env[m.encryptionKeyEnv];if(!X||X.length<32)throw Error(`${m.encryptionKeyEnv} must contain at least 32 characters.`);Y=`${I}/encryption-key`,await k.secrets.put(Y,X),L.push(Y)}let Z=k.store.createDestination({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,name:t,provider:m.provider,endpoint:m.endpoint,endpointPolicy:m.allowPrivate?"allow_private":"public_https",bucket:m.bucket,prefix:m.prefix??"",region:m.region??k.config.project.region,forcePathStyle:!!m.pathStyle,credentialRef:z,encryption:m.encryption,encryptionKeyRef:Y,immutability:{objectLock:!!m.lockDays,defaultRetentionDays:m.lockDays?Number(m.lockDays):void 0},status:"untested"});Ni(k,"destination_created",{destinationId:Z.id,provider:Z.provider}),n(`Created destination ${Z.name} (${Z.id}); test it with cloud recovery:destination:test ${Z.name}`)}catch(z){for(let Y of L)await k.secrets.remove(Y).catch(()=>{});throw z}}))),R.command("recovery:destination:test <destination>","Write, read, verify, and clean a destination health object").option("--env <environment>","Target environment").action(async(t,m)=>ki(async()=>$i(m.env,async(k)=>{let I=Ou(k,t);if(I.provider==="aws_backup")throw Error("AWS Backup is verified by creating a provider recovery point.");try{await new ui(k.secrets).test(I),k.store.recordDestinationTest(I.id,{ok:!0}),Ni(k,"destination_tested",{destinationId:I.id,ok:!0}),n(`${I.name} passed write, read, checksum, and cleanup checks.`)}catch(L){let z=L instanceof Error?L.message:String(L);throw k.store.recordDestinationTest(I.id,{ok:!1,error:z}),Ni(k,"destination_tested",{destinationId:I.id,ok:!1}),L}}))),R.command("recovery:policy:add <name>","Create a scheduled recovery policy").option("--env <environment>","Target environment").option("--destination <id>","Destination ID or name").option("--kind <kind>","managed_database, logical_database, volume, files, control_plane, or infrastructure").option("--data-service <id>","Data service ID or name").option("--resource <id>","Resource ID or slug").option("--volume <name>","Named Docker volume").option("--include <path>","Project-relative include path or provider setting (repeatable)").option("--exclude <pattern>","Archive exclude pattern (repeatable)").option("--schedule <expression>","Cron, rate, or preset",{default:"daily"}).option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--rpo <minutes>","Recovery point objective",{default:"1440"}).option("--rto <minutes>","Recovery time objective",{default:"120"}).option("--keep <count>","Minimum latest points",{default:"7"}).option("--expire <days>","Expiry days",{default:"30"}).option("--compression <kind>","none, gzip, or zstd",{default:"gzip"}).option("--disabled","Create disabled").action(async(t,m)=>ki(async()=>$i(m.env,async(k)=>{if(!m.destination)throw Error("--destination is required.");if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(m.kind??""))throw Error("--kind must be managed_database, logical_database, volume, files, control_plane, or infrastructure.");let I=Ou(k,m.destination),L=k.dataServices.list(k.controlPlane.project.id,k.environmentRecord.id),z=m.dataService?k.dataServices.get(m.dataService)??L.find((ae)=>ae.name===m.dataService):void 0,Y=k.controlPlane.store.listResources(k.controlPlane.project.id,k.environmentRecord.id),Z=m.resource?Y.find((ae)=>ae.id===m.resource||ae.slug===m.resource):void 0,X=m.include?Array.isArray(m.include)?m.include:[m.include]:[],ie=m.exclude?Array.isArray(m.exclude)?m.exclude:[m.exclude]:[];if(["managed_database","logical_database"].includes(m.kind??"")&&!z)throw Error("--data-service must identify a service in this environment.");if(m.kind==="volume"&&(!Z||!m.volume))throw Error("Volume policies require --resource and --volume.");if(m.kind==="files"&&(!Z||!X.length))throw Error("File policies require --resource and at least one --include path.");if(m.kind==="infrastructure"&&(!X.some((ae)=>ae.startsWith("resource:arn:"))||!X.some((ae)=>ae.startsWith("role:arn:"))))throw Error("Infrastructure policies require --include resource:<arn> and --include role:<arn>.");let oe=k.store.createPolicy({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,environmentId:k.environmentRecord.id,resourceId:Z?.id,dataServiceId:z?.id,destinationId:I.id,name:t,resourceKind:m.kind,schedule:m.schedule??"daily",timezone:m.timezone??"UTC",retention:{keepLast:Number(m.keep)||7,expireAfterDays:Number(m.expire)||30},compression:m.compression,encryption:"destination",includePatterns:m.volume?[m.volume,...X]:X,excludePatterns:ie,expectedRpoMinutes:Number(m.rpo)||1440,expectedRtoMinutes:Number(m.rto)||120,enabled:!m.disabled});Ni(k,"policy_created",{policyId:oe.id,resourceKind:oe.resourceKind},oe.resourceId),n(`Created policy ${oe.name} (${oe.id}); next run ${oe.nextRunAt}`)}))),R.command("recovery:run <policy>","Queue an on-demand run of a recovery policy").option("--env <environment>","Target environment").action(async(t,m)=>ki(async()=>$i(m.env,async(k)=>{let I=Ah(k,t),L=k.coordinator.enqueueBackup(I,new Date().toISOString(),k.actor.id);Ni(k,"run_queued",{policyId:I.id,backupJobId:L.id},I.resourceId),n(`Queued backup job ${L.id}; inspect it with cloud recovery:jobs`)}))),R.command("recovery:verify <point>","Queue independent verification of a recovery point").option("--env <environment>","Target environment").action(async(t,m)=>ki(async()=>$i(m.env,async(k)=>{let I=ka(k,t),L=k.coordinator.enqueueVerification(I);Ni(k,"verification_queued",{recoveryPointId:I.id,backupJobId:L.id},I.resourceId),n(`Queued verification job ${L.id}`)}))),R.command("recovery:restore <point> <target>","Validate or queue an isolated, in-place, or drill restore").option("--env <environment>","Target environment").option("--mode <mode>","isolated or in_place",{default:"isolated"}).option("--drill","Validate health and clean the isolated target").option("--execute","Queue the validated restore").option("--confirm <target>","Exact in-place target confirmation").option("--ack-downtime","Acknowledge downtime and data replacement").option("--safety <point>","Distinct verified safety recovery point").option("--metadata <json>","Provider restore metadata JSON").action(async(t,m,k)=>ki(async()=>$i(k.env,async(I)=>{if(!["isolated","in_place"].includes(k.mode??""))throw Error("--mode must be isolated or in_place.");if(k.drill&&k.mode==="in_place")throw Error("Recovery drills require --mode isolated.");let L=ka(I,t),z={mode:k.mode,target:{...Rh(L,m),...k.metadata?{metadata:JSON.parse(k.metadata)}:{},inPlace:k.mode==="in_place"},targetName:m,confirm:k.confirm,recentAuth:!0,downtimeAcknowledged:!!k.ackDowntime,safetyBackupId:k.safety?ka(I,k.safety).id:void 0},Y=I.coordinator.planRestore(L,z);if(!k.execute){e(JSON.stringify({...Y,productionExecutionCreated:!1},null,2));return}let Z=I.coordinator.enqueueRestore(L,{...z,drill:!!k.drill,actorId:I.actor.id});Ni(I,k.drill?"drill_queued":"restore_queued",{recoveryPointId:L.id,backupJobId:Z.id,mode:z.mode,target:m},L.resourceId),n(`Queued ${k.drill?"drill":"restore"} job ${Z.id}`)}))),R.command("recovery:protect <point>","Pin, hold, or release retention protection").option("--env <environment>","Target environment").option("--pin","Pin the point").option("--unpin","Remove its pin").option("--hold","Place a legal hold").option("--release-hold","Release its legal hold").action(async(t,m)=>ki(async()=>$i(m.env,async(k)=>{let I=ka(k,t);if(![m.pin,m.unpin,m.hold,m.releaseHold].filter(Boolean).length)throw Error("Choose --pin, --unpin, --hold, or --release-hold.");let L=k.store.updateRecoveryPoint(I.id,{pinned:m.pin?!0:m.unpin?!1:I.pinned,held:m.hold?!0:m.releaseHold?!1:I.held});Ni(k,"protection_updated",{recoveryPointId:I.id,pinned:L.pinned,held:L.held},I.resourceId),n(`${L.id}: pinned=${L.pinned} held=${L.held}`)}))),R.command("recovery:retention","Queue deletion of expired, unlocked, unheld recovery points").option("--env <environment>","Target environment").action(async(t)=>ki(async()=>$i(t.env,async(m)=>{let k=m.coordinator.enqueueRetention();Ni(m,"retention_queued",{jobs:k.length}),n(`Queued ${k.length} retention cleanup job${k.length===1?"":"s"}.`)})))}function jl(R){R.command("api:list","List all API Gateway APIs").option("--region <region>","AWS region").action(async(t)=>{i("API Gateway APIs");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1",{LambdaClient:I}=await import("./chunk-9zwvysdn.js"),L=new I(k),z=new s("Fetching APIs...");z.start();let{CloudFormationClient:Y}=await import("./chunk-ybekawxv.js"),ie=(await new Y(k).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE"])).StackSummaries.filter((oe)=>oe.StackName?.includes("api")||oe.StackName?.includes("Api")||oe.StackName?.includes("API"));if(z.succeed("APIs listed"),e(`
-API-related CloudFormation stacks:`),ie.length===0)e("No API Gateway stacks found"),e(`
-To create an API, you can:`),e("  1. Use cloud.config.ts to define your API"),e("  2. Deploy with `cloud deploy`");else c(["Stack Name","Status","Created"],ie.map((oe)=>[oe.StackName||"N/A",oe.StackStatus||"N/A",oe.CreationTime?new Date(oe.CreationTime).toLocaleDateString():"N/A"]));e("\nTip: Use AWS Console or `aws apigateway get-rest-apis` for detailed API listing")}catch(m){r(`Failed to list APIs: ${m.message}`),process.exit(1)}}),R.command("api:describe <apiId>","Show API Gateway API details").option("--region <region>","AWS region").action(async(t,m)=>{i(`API: ${t}`);try{let k=await Ne(),I=m.region||k.project.region||"us-east-1";e(`API ID: ${t}`),e(`Region: ${I}`),e(""),e("For detailed API information, use AWS CLI:"),e(`  aws apigateway get-rest-api --rest-api-id ${t} --region ${I}`),e(`  aws apigateway get-resources --rest-api-id ${t} --region ${I}`),e(`  aws apigateway get-stages --rest-api-id ${t} --region ${I}`)}catch(k){r(`Failed to describe API: ${k.message}`),process.exit(1)}}),R.command("api:stages <apiId>","List API stages").option("--region <region>","AWS region").action(async(t,m)=>{i(`API Stages: ${t}`);try{let k=await Ne(),I=m.region||k.project.region||"us-east-1";e(`API ID: ${t}`),e(`Region: ${I}`),e(""),e("Common stages:"),e("  - prod (production)"),e("  - staging"),e("  - dev (development)"),e(""),e("For detailed stage information, use AWS CLI:"),e(`  aws apigateway get-stages --rest-api-id ${t} --region ${I}`)}catch(k){r(`Failed to list stages: ${k.message}`),process.exit(1)}}),R.command("api:deploy <apiId>","Deploy API to a stage").option("--region <region>","AWS region",{default:"us-east-1"}).option("--stage <name>","Stage name",{default:"prod"}).option("--description <text>","Deployment description").action(async(t,m)=>{i("Deploy API");try{if(e(`API ID: ${t}`),e(`Stage: ${m.stage}`),!await d(`
-Deploy to this stage?`,!0)){e("Operation cancelled");return}if(e(""),e("To deploy an API Gateway API:"),e("  aws apigateway create-deployment \\"),e(`    --rest-api-id ${t} \\`),e(`    --stage-name ${m.stage} \\`),e(`    --region ${m.region}`),m.description)e(`    --description "${m.description}"`)}catch(k){r(`Failed to deploy API: ${k.message}`),process.exit(1)}}),R.command("api:domains","List custom domain names").option("--region <region>","AWS region").action(async(t)=>{i("API Gateway Custom Domains");try{let m=await Ne(),k=t.region||m.project.region||"us-east-1";e(`Region: ${k}`),e(""),e("To list custom domains, use AWS CLI:"),e(`  aws apigateway get-domain-names --region ${k}`),e(""),e("To create a custom domain:"),e("  1. Request or import an SSL certificate in ACM"),e("  2. Create a custom domain in API Gateway"),e("  3. Create a base path mapping to your API"),e("  4. Add a DNS record pointing to the distribution")}catch(m){r(`Failed to list domains: ${m.message}`),process.exit(1)}}),R.command("api:usage <apiId>","Show API usage statistics").option("--region <region>","AWS region").option("--stage <name>","Stage name",{default:"prod"}).option("--days <number>","Number of days to show",{default:"7"}).action(async(t,m)=>{i("API Usage Statistics");try{let k=await Ne(),I=m.region||k.project.region||"us-east-1";e(`API ID: ${t}`),e(`Stage: ${m.stage}`),e(`Period: Last ${m.days} days`),e("");let L=new Date,z=new Date;z.setDate(z.getDate()-Number.parseInt(m.days)),e("To view API metrics in CloudWatch:"),e("  aws cloudwatch get-metric-statistics \\"),e("    --namespace AWS/ApiGateway \\"),e("    --metric-name Count \\"),e(`    --dimensions Name=ApiName,Value=${t} Name=Stage,Value=${m.stage} \\`),e(`    --start-time ${z.toISOString()} \\`),e(`    --end-time ${L.toISOString()} \\`),e("    --period 86400 \\"),e("    --statistics Sum \\"),e(`    --region ${I}`),e(""),e("Available metrics:"),e("  - Count: Total API calls"),e("  - Latency: Response latency"),e("  - 4XXError: Client errors"),e("  - 5XXError: Server errors"),e("  - IntegrationLatency: Backend latency")}catch(k){r(`Failed to get usage: ${k.message}`),process.exit(1)}}),R.command("api:export <apiId>","Export API specification").option("--region <region>","AWS region",{default:"us-east-1"}).option("--stage <name>","Stage name",{default:"prod"}).option("--format <format>","Export format (oas30, swagger)",{default:"oas30"}).option("--output <file>","Output file path").action(async(t,m)=>{i("Export API Specification");try{e(`API ID: ${t}`),e(`Stage: ${m.stage}`),e(`Format: ${m.format==="oas30"?"OpenAPI 3.0":"Swagger 2.0"}`),e("");let k=m.format==="oas30"?"oas30":"swagger";e("To export the API specification:"),e("  aws apigateway get-export \\"),e(`    --rest-api-id ${t} \\`),e(`    --stage-name ${m.stage} \\`),e(`    --export-type ${k} \\`),e("    --accepts application/json \\"),e(`    --region ${m.region} \\`),e(`    ${m.output||"api-spec.json"}`)}catch(k){r(`Failed to export API: ${k.message}`),process.exit(1)}}),R.command("api:logs <apiId>","View API Gateway logs").option("--region <region>","AWS region").option("--stage <name>","Stage name",{default:"prod"}).option("--tail","Tail the logs").action(async(t,m)=>{i("API Gateway Logs");try{let k=await Ne(),I=m.region||k.project.region||"us-east-1",L=`API-Gateway-Execution-Logs_${t}/${m.stage}`;if(e(`Log Group: ${L}`),e(""),e("To view logs:"),e("  aws logs filter-log-events \\"),e(`    --log-group-name "${L}" \\`),e(`    --region ${I}`),m.tail)e(""),e("For real-time log tailing, use:"),e(`  aws logs tail "${L}" --follow --region ${I}`);e(""),e("Note: Ensure logging is enabled for the API stage."),e("You can enable it in the stage settings.")}catch(k){r(`Failed to get logs: ${k.message}`),process.exit(1)}}),R.command("api:test <apiId> <path>","Test an API endpoint").option("--region <region>","AWS region").option("--stage <name>","Stage name",{default:"prod"}).option("--method <method>","HTTP method",{default:"GET"}).option("--body <json>","Request body (JSON)").option("--header <header>","Request header (can be specified multiple times)").action(async(t,m,k)=>{i("Test API Endpoint");try{let I=await Ne(),L=k.region||I.project.region||"us-east-1",z=`https://${t}.execute-api.${L}.amazonaws.com/${k.stage}${m.startsWith("/")?m:`/${m}`}`;e(`URL: ${z}`),e(`Method: ${k.method}`);let Y={"Content-Type":"application/json"};if(k.header){let Ae=Array.isArray(k.header)?k.header:[k.header];for(let de of Ae){let[ke,...De]=de.split(":");Y[ke.trim()]=De.join(":").trim()}}e("Headers:");for(let[Ae,de]of Object.entries(Y))e(`  ${Ae}: ${de}`);if(k.body)e(`Body: ${k.body}`);if(!await d(`
-Send request?`,!0)){e("Operation cancelled");return}let X=new s("Sending request...");X.start();let ie=Date.now(),oe=await fetch(z,{method:k.method,headers:Y,body:k.body}),ae=Date.now()-ie,be=await oe.text();X.succeed(`Response received (${ae}ms)`),e(`
+Job ID: ${Y.RestoreJobId}`),e("Use `cloud backup:restore-jobs` to check status")}catch(k){r(`Failed to start restore: ${k.message}`),process.exit(1)}}),R.command("backup:jobs","List recent backup jobs").option("--region <region>","AWS region").option("--state <state>","Filter by state (CREATED, PENDING, RUNNING, COMPLETED, FAILED)").action(async(t)=>{i("Backup Jobs");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=await Sr(k),L=new s("Fetching backup jobs...");L.start();let Y=(await I.listBackupJobs({ByState:t.state,MaxResults:50})).BackupJobs||[];if(L.succeed(`Found ${Y.length} job(s)`),Y.length===0){e("No backup jobs found");return}c(["Job ID","Resource","State","Started","Size"],Y.map((Z)=>[Z.BackupJobId?.substring(0,16)||"N/A",Z.ResourceArn?.split(":").pop()||"N/A",Z.State||"N/A",Z.CreationDate?new Date(Z.CreationDate).toLocaleString():"N/A",Z.BackupSizeInBytes?Nu(Z.BackupSizeInBytes):"N/A"]))}catch(m){r(`Failed to list backup jobs: ${m.message}`),process.exit(1)}}),R.command("backup:restore-jobs","List recent restore jobs").option("--region <region>","AWS region").option("--status <status>","Filter by status").action(async(t)=>{i("Restore Jobs");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=await Sr(k),L=new s("Fetching restore jobs...");L.start();let Y=(await I.listRestoreJobs({ByStatus:t.status,MaxResults:50})).RestoreJobs||[];if(L.succeed(`Found ${Y.length} job(s)`),Y.length===0){e("No restore jobs found");return}c(["Job ID","Resource","Status","Started","Completed"],Y.map((Z)=>[Z.RestoreJobId?.substring(0,16)||"N/A",Z.CreatedResourceArn?.split(":").pop()||"Pending",Z.Status||"N/A",Z.CreationDate?new Date(Z.CreationDate).toLocaleString():"N/A",Z.CompletionDate?new Date(Z.CompletionDate).toLocaleString():"-"]))}catch(m){r(`Failed to list restore jobs: ${m.message}`),process.exit(1)}}),R.command("backup:schedule","Show backup schedule overview").option("--region <region>","AWS region").action(async(t)=>{i("Backup Schedule Overview");try{let m=await De(),k=t.region||m.project.region||"us-east-1",I=await Sr(k),L=new s("Fetching backup plans...");L.start();let Y=(await I.listBackupPlans()).BackupPlansList||[];if(L.succeed(`Found ${Y.length} backup plan(s)`),Y.length===0){e("No backup plans configured");return}for(let Z of Y){e(`
+${Z.BackupPlanName}`),e("=".repeat(40));try{let ee=(await I.getBackupPlan(Z.BackupPlanId)).BackupPlan?.Rules||[];for(let se of ee)if(e(`  Rule: ${se.RuleName}`),e(`    Schedule: ${se.ScheduleExpression}`),e(`    Vault: ${se.TargetBackupVaultName}`),se.Lifecycle?.DeleteAfterDays)e(`    Retention: ${se.Lifecycle.DeleteAfterDays} days`);let oe=await I.listBackupSelections(Z.BackupPlanId);if(oe.BackupSelectionsList&&oe.BackupSelectionsList.length>0)e(`  Selections: ${oe.BackupSelectionsList.length}`)}catch{e("  (Unable to load plan details)")}}}catch(m){r(`Failed to get schedule: ${m.message}`),process.exit(1)}})}function Nu(R){if(R===0)return"0 B";let t=1024,m=["B","KB","MB","GB","TB"],k=Math.floor(Math.log(R)/Math.log(t));return`${Number.parseFloat((R/t**k).toFixed(2))} ${m[k]}`}async function kh(R){let t=await De(),m=y(process.cwd(),t),k=R??Object.keys(t.environments??{})[0]??"production",I=m.environments.get(k);if(!I)throw m.store.close(),Error(`Environment ${k} was not found.`);let L=new S(m.store,{workerId:`cli:${process.pid}`}),z=new pi(m.store),Y=new rn(z,L),Z=new cr(m.store),X=new lr(m.store,_(process.cwd())),ee=m.store.getActorByExternalId("system","cli")??m.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});return{config:t,controlPlane:m,env:k,environmentRecord:I,queue:L,store:z,coordinator:Y,dataServices:Z,secrets:X,actor:ee}}async function vi(R,t){let m=await kh(R);try{return await t(m)}finally{m.controlPlane.store.close()}}async function wi(R){try{await R()}catch(t){r(t instanceof Error?t.message:String(t))}}function Oi(R,t,m,k){R.controlPlane.store.appendEvent({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,resourceId:k,actorId:R.actor.id,type:`backup.${t}`,payload:m})}function Ah(R,t){let m=R.store.getPolicy(t)??R.store.listPolicies(R.controlPlane.project.id,R.environmentRecord.id).find((k)=>k.name===t);if(!m||m.environmentId!==R.environmentRecord.id)throw Error(`Backup policy ${t} was not found in ${R.env}.`);return m}function ba(R,t){let m=R.store.getRecoveryPoint(t),k=R.store.listRecoveryPoints(R.controlPlane.project.id).filter((L)=>L.id.startsWith(t)),I=m??(k.length===1?k[0]:void 0);if(!I)throw Error(k.length>1?`Recovery point prefix ${t} is ambiguous.`:`Recovery point ${t} was not found.`);return I}function Ou(R,t){let m=R.store.getDestination(t)??R.store.listDestinations(R.controlPlane.project.id).find((k)=>k.name===t);if(!m)throw Error(`Backup destination ${t} was not found.`);return m}function Rh(R,t){return R.kind==="volume"?{volumeName:t}:R.kind==="logical_database"?{targetId:t,dataServiceId:t}:{targetId:t}}function Ih(R,t=[]){let m=new Map(t.map((k)=>[k.id,k.name]));return R.map((k)=>[k.id,k.status,k.verificationState,k.kind,m.get(k.policyId??"")??"manual",k.pointInTime,k.sizeBytes?`${k.sizeBytes} B`:"provider",k.held?"hold":k.pinned?"pinned":"retention"])}function Fl(R){R.command("recovery:list","Show backup coverage, destination health, and recent recovery points").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>wi(async()=>vi(t.env,async(m)=>{let k=m.store.listPolicies(m.controlPlane.project.id,m.environmentRecord.id),I=new Set(k.map((Y)=>Y.id)),L=m.store.listRecoveryPoints(m.controlPlane.project.id).filter((Y)=>!Y.policyId||I.has(Y.policyId)),z={coverage:m.store.coverage(m.controlPlane.project.id).filter((Y)=>I.has(Y.policy.id)),destinations:m.store.listDestinations(m.controlPlane.project.id).map((Y)=>({...Y,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!Y.credentialRef,clientEncryptionConfigured:!!Y.encryptionKeyRef})),policies:k,recoveryPoints:L,jobs:m.store.listJobs(m.controlPlane.project.id).filter((Y)=>!Y.policyId||I.has(Y.policyId))};if(t.json)e(JSON.stringify(z,null,2));else c(["Policy","RPO","Destination","Latest point","Verification"],z.coverage.map((Y)=>[Y.policy.name,Y.missedRpo?"MISSED":"protected",Y.destinationHealthy?"healthy":"attention",Y.lastRecoveryPoint?.pointInTime??"none",Y.lastRecoveryPoint?.verificationState??"none"])),c(["ID","State","Verification","Kind","Policy","Point in time","Size","Protection"],Ih(L,k))}))),R.command("recovery:jobs","List durable backup, verification, restore, drill, and cleanup jobs").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>wi(async()=>vi(t.env,async(m)=>{let k=new Set(m.store.listPolicies(m.controlPlane.project.id,m.environmentRecord.id).map((L)=>L.id)),I=m.store.listJobs(m.controlPlane.project.id).filter((L)=>!L.policyId||k.has(L.policyId));if(t.json)e(JSON.stringify(I,null,2));else c(["ID","Kind","State","Phase","Operation","Started","Finished","Error"],I.map((L)=>[L.id,L.kind,L.status,String(L.progress.phase??"queued"),L.operationId??"—",L.startedAt??"—",L.finishedAt??"—",L.error??"—"]))}))),R.command("recovery:destination:add <name>","Connect an S3, S3-compatible, or AWS Backup destination").option("--env <environment>","Target environment").option("--provider <provider>","aws_s3, s3_compatible, or aws_backup",{default:"aws_s3"}).option("--bucket <bucket>","Object bucket").option("--endpoint <url>","Origin-only HTTPS endpoint").option("--allow-private","Allow a private endpoint").option("--path-style","Force path-style S3 URLs").option("--prefix <prefix>","Object key prefix").option("--region <region>","Destination region").option("--credentials-env <name>","Environment variable containing credential JSON").option("--encryption <mode>","provider, client_side, or both",{default:"provider"}).option("--encryption-key-env <name>","Environment variable containing the client encryption key").option("--lock-days <days>","Default immutable retention days").action(async(t,m)=>wi(async()=>vi(m.env,async(k)=>{if(!["aws_s3","s3_compatible","aws_backup"].includes(m.provider??""))throw Error("--provider must be aws_s3, s3_compatible, or aws_backup.");if(!["provider","client_side","both"].includes(m.encryption??""))throw Error("--encryption must be provider, client_side, or both.");let I=`secret://data-services/backups/${k.controlPlane.project.id}/${t}`,L=[];try{let z,Y;if(m.credentialsEnv){let X=process.env[m.credentialsEnv];if(!X)throw Error(`${m.credentialsEnv} is empty.`);z=`${I}/credentials`,await k.secrets.put(z,X),L.push(z)}if(m.encryption!=="provider"){if(!m.encryptionKeyEnv)throw Error("Client encryption requires --encryption-key-env.");let X=process.env[m.encryptionKeyEnv];if(!X||X.length<32)throw Error(`${m.encryptionKeyEnv} must contain at least 32 characters.`);Y=`${I}/encryption-key`,await k.secrets.put(Y,X),L.push(Y)}let Z=k.store.createDestination({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,name:t,provider:m.provider,endpoint:m.endpoint,endpointPolicy:m.allowPrivate?"allow_private":"public_https",bucket:m.bucket,prefix:m.prefix??"",region:m.region??k.config.project.region,forcePathStyle:!!m.pathStyle,credentialRef:z,encryption:m.encryption,encryptionKeyRef:Y,immutability:{objectLock:!!m.lockDays,defaultRetentionDays:m.lockDays?Number(m.lockDays):void 0},status:"untested"});Oi(k,"destination_created",{destinationId:Z.id,provider:Z.provider}),n(`Created destination ${Z.name} (${Z.id}); test it with cloud recovery:destination:test ${Z.name}`)}catch(z){for(let Y of L)await k.secrets.remove(Y).catch(()=>{});throw z}}))),R.command("recovery:destination:test <destination>","Write, read, verify, and clean a destination health object").option("--env <environment>","Target environment").action(async(t,m)=>wi(async()=>vi(m.env,async(k)=>{let I=Ou(k,t);if(I.provider==="aws_backup")throw Error("AWS Backup is verified by creating a provider recovery point.");try{await new mi(k.secrets).test(I),k.store.recordDestinationTest(I.id,{ok:!0}),Oi(k,"destination_tested",{destinationId:I.id,ok:!0}),n(`${I.name} passed write, read, checksum, and cleanup checks.`)}catch(L){let z=L instanceof Error?L.message:String(L);throw k.store.recordDestinationTest(I.id,{ok:!1,error:z}),Oi(k,"destination_tested",{destinationId:I.id,ok:!1}),L}}))),R.command("recovery:policy:add <name>","Create a scheduled recovery policy").option("--env <environment>","Target environment").option("--destination <id>","Destination ID or name").option("--kind <kind>","managed_database, logical_database, volume, files, control_plane, or infrastructure").option("--data-service <id>","Data service ID or name").option("--resource <id>","Resource ID or slug").option("--volume <name>","Named Docker volume").option("--include <path>","Project-relative include path or provider setting (repeatable)").option("--exclude <pattern>","Archive exclude pattern (repeatable)").option("--schedule <expression>","Cron, rate, or preset",{default:"daily"}).option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--rpo <minutes>","Recovery point objective",{default:"1440"}).option("--rto <minutes>","Recovery time objective",{default:"120"}).option("--keep <count>","Minimum latest points",{default:"7"}).option("--expire <days>","Expiry days",{default:"30"}).option("--compression <kind>","none, gzip, or zstd",{default:"gzip"}).option("--disabled","Create disabled").action(async(t,m)=>wi(async()=>vi(m.env,async(k)=>{if(!m.destination)throw Error("--destination is required.");if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(m.kind??""))throw Error("--kind must be managed_database, logical_database, volume, files, control_plane, or infrastructure.");let I=Ou(k,m.destination),L=k.dataServices.list(k.controlPlane.project.id,k.environmentRecord.id),z=m.dataService?k.dataServices.get(m.dataService)??L.find((se)=>se.name===m.dataService):void 0,Y=k.controlPlane.store.listResources(k.controlPlane.project.id,k.environmentRecord.id),Z=m.resource?Y.find((se)=>se.id===m.resource||se.slug===m.resource):void 0,X=m.include?Array.isArray(m.include)?m.include:[m.include]:[],ee=m.exclude?Array.isArray(m.exclude)?m.exclude:[m.exclude]:[];if(["managed_database","logical_database"].includes(m.kind??"")&&!z)throw Error("--data-service must identify a service in this environment.");if(m.kind==="volume"&&(!Z||!m.volume))throw Error("Volume policies require --resource and --volume.");if(m.kind==="files"&&(!Z||!X.length))throw Error("File policies require --resource and at least one --include path.");if(m.kind==="infrastructure"&&(!X.some((se)=>se.startsWith("resource:arn:"))||!X.some((se)=>se.startsWith("role:arn:"))))throw Error("Infrastructure policies require --include resource:<arn> and --include role:<arn>.");let oe=k.store.createPolicy({organizationId:k.controlPlane.organization.id,projectId:k.controlPlane.project.id,environmentId:k.environmentRecord.id,resourceId:Z?.id,dataServiceId:z?.id,destinationId:I.id,name:t,resourceKind:m.kind,schedule:m.schedule??"daily",timezone:m.timezone??"UTC",retention:{keepLast:Number(m.keep)||7,expireAfterDays:Number(m.expire)||30},compression:m.compression,encryption:"destination",includePatterns:m.volume?[m.volume,...X]:X,excludePatterns:ee,expectedRpoMinutes:Number(m.rpo)||1440,expectedRtoMinutes:Number(m.rto)||120,enabled:!m.disabled});Oi(k,"policy_created",{policyId:oe.id,resourceKind:oe.resourceKind},oe.resourceId),n(`Created policy ${oe.name} (${oe.id}); next run ${oe.nextRunAt}`)}))),R.command("recovery:run <policy>","Queue an on-demand run of a recovery policy").option("--env <environment>","Target environment").action(async(t,m)=>wi(async()=>vi(m.env,async(k)=>{let I=Ah(k,t),L=k.coordinator.enqueueBackup(I,new Date().toISOString(),k.actor.id);Oi(k,"run_queued",{policyId:I.id,backupJobId:L.id},I.resourceId),n(`Queued backup job ${L.id}; inspect it with cloud recovery:jobs`)}))),R.command("recovery:verify <point>","Queue independent verification of a recovery point").option("--env <environment>","Target environment").action(async(t,m)=>wi(async()=>vi(m.env,async(k)=>{let I=ba(k,t),L=k.coordinator.enqueueVerification(I);Oi(k,"verification_queued",{recoveryPointId:I.id,backupJobId:L.id},I.resourceId),n(`Queued verification job ${L.id}`)}))),R.command("recovery:restore <point> <target>","Validate or queue an isolated, in-place, or drill restore").option("--env <environment>","Target environment").option("--mode <mode>","isolated or in_place",{default:"isolated"}).option("--drill","Validate health and clean the isolated target").option("--execute","Queue the validated restore").option("--confirm <target>","Exact in-place target confirmation").option("--ack-downtime","Acknowledge downtime and data replacement").option("--safety <point>","Distinct verified safety recovery point").option("--metadata <json>","Provider restore metadata JSON").action(async(t,m,k)=>wi(async()=>vi(k.env,async(I)=>{if(!["isolated","in_place"].includes(k.mode??""))throw Error("--mode must be isolated or in_place.");if(k.drill&&k.mode==="in_place")throw Error("Recovery drills require --mode isolated.");let L=ba(I,t),z={mode:k.mode,target:{...Rh(L,m),...k.metadata?{metadata:JSON.parse(k.metadata)}:{},inPlace:k.mode==="in_place"},targetName:m,confirm:k.confirm,recentAuth:!0,downtimeAcknowledged:!!k.ackDowntime,safetyBackupId:k.safety?ba(I,k.safety).id:void 0},Y=I.coordinator.planRestore(L,z);if(!k.execute){e(JSON.stringify({...Y,productionExecutionCreated:!1},null,2));return}let Z=I.coordinator.enqueueRestore(L,{...z,drill:!!k.drill,actorId:I.actor.id});Oi(I,k.drill?"drill_queued":"restore_queued",{recoveryPointId:L.id,backupJobId:Z.id,mode:z.mode,target:m},L.resourceId),n(`Queued ${k.drill?"drill":"restore"} job ${Z.id}`)}))),R.command("recovery:protect <point>","Pin, hold, or release retention protection").option("--env <environment>","Target environment").option("--pin","Pin the point").option("--unpin","Remove its pin").option("--hold","Place a legal hold").option("--release-hold","Release its legal hold").action(async(t,m)=>wi(async()=>vi(m.env,async(k)=>{let I=ba(k,t);if(![m.pin,m.unpin,m.hold,m.releaseHold].filter(Boolean).length)throw Error("Choose --pin, --unpin, --hold, or --release-hold.");let L=k.store.updateRecoveryPoint(I.id,{pinned:m.pin?!0:m.unpin?!1:I.pinned,held:m.hold?!0:m.releaseHold?!1:I.held});Oi(k,"protection_updated",{recoveryPointId:I.id,pinned:L.pinned,held:L.held},I.resourceId),n(`${L.id}: pinned=${L.pinned} held=${L.held}`)}))),R.command("recovery:retention","Queue deletion of expired, unlocked, unheld recovery points").option("--env <environment>","Target environment").action(async(t)=>wi(async()=>vi(t.env,async(m)=>{let k=m.coordinator.enqueueRetention();Oi(m,"retention_queued",{jobs:k.length}),n(`Queued ${k.length} retention cleanup job${k.length===1?"":"s"}.`)})))}function jl(R){R.command("api:list","List all API Gateway APIs").option("--region <region>","AWS region").action(async(t)=>{i("API Gateway APIs");try{let m=await De(),k=t.region||m.project.region||"us-east-1",{LambdaClient:I}=await import("./chunk-tyeessz3.js"),L=new I(k),z=new s("Fetching APIs...");z.start();let{CloudFormationClient:Y}=await import("./chunk-6qhgzf9a.js"),ee=(await new Y(k).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE"])).StackSummaries.filter((oe)=>oe.StackName?.includes("api")||oe.StackName?.includes("Api")||oe.StackName?.includes("API"));if(z.succeed("APIs listed"),e(`
+API-related CloudFormation stacks:`),ee.length===0)e("No API Gateway stacks found"),e(`
+To create an API, you can:`),e("  1. Use cloud.config.ts to define your API"),e("  2. Deploy with `cloud deploy`");else c(["Stack Name","Status","Created"],ee.map((oe)=>[oe.StackName||"N/A",oe.StackStatus||"N/A",oe.CreationTime?new Date(oe.CreationTime).toLocaleDateString():"N/A"]));e("\nTip: Use AWS Console or `aws apigateway get-rest-apis` for detailed API listing")}catch(m){r(`Failed to list APIs: ${m.message}`),process.exit(1)}}),R.command("api:describe <apiId>","Show API Gateway API details").option("--region <region>","AWS region").action(async(t,m)=>{i(`API: ${t}`);try{let k=await De(),I=m.region||k.project.region||"us-east-1";e(`API ID: ${t}`),e(`Region: ${I}`),e(""),e("For detailed API information, use AWS CLI:"),e(`  aws apigateway get-rest-api --rest-api-id ${t} --region ${I}`),e(`  aws apigateway get-resources --rest-api-id ${t} --region ${I}`),e(`  aws apigateway get-stages --rest-api-id ${t} --region ${I}`)}catch(k){r(`Failed to describe API: ${k.message}`),process.exit(1)}}),R.command("api:stages <apiId>","List API stages").option("--region <region>","AWS region").action(async(t,m)=>{i(`API Stages: ${t}`);try{let k=await De(),I=m.region||k.project.region||"us-east-1";e(`API ID: ${t}`),e(`Region: ${I}`),e(""),e("Common stages:"),e("  - prod (production)"),e("  - staging"),e("  - dev (development)"),e(""),e("For detailed stage information, use AWS CLI:"),e(`  aws apigateway get-stages --rest-api-id ${t} --region ${I}`)}catch(k){r(`Failed to list stages: ${k.message}`),process.exit(1)}}),R.command("api:deploy <apiId>","Deploy API to a stage").option("--region <region>","AWS region",{default:"us-east-1"}).option("--stage <name>","Stage name",{default:"prod"}).option("--description <text>","Deployment description").action(async(t,m)=>{i("Deploy API");try{if(e(`API ID: ${t}`),e(`Stage: ${m.stage}`),!await d(`
+Deploy to this stage?`,!0)){e("Operation cancelled");return}if(e(""),e("To deploy an API Gateway API:"),e("  aws apigateway create-deployment \\"),e(`    --rest-api-id ${t} \\`),e(`    --stage-name ${m.stage} \\`),e(`    --region ${m.region}`),m.description)e(`    --description "${m.description}"`)}catch(k){r(`Failed to deploy API: ${k.message}`),process.exit(1)}}),R.command("api:domains","List custom domain names").option("--region <region>","AWS region").action(async(t)=>{i("API Gateway Custom Domains");try{let m=await De(),k=t.region||m.project.region||"us-east-1";e(`Region: ${k}`),e(""),e("To list custom domains, use AWS CLI:"),e(`  aws apigateway get-domain-names --region ${k}`),e(""),e("To create a custom domain:"),e("  1. Request or import an SSL certificate in ACM"),e("  2. Create a custom domain in API Gateway"),e("  3. Create a base path mapping to your API"),e("  4. Add a DNS record pointing to the distribution")}catch(m){r(`Failed to list domains: ${m.message}`),process.exit(1)}}),R.command("api:usage <apiId>","Show API usage statistics").option("--region <region>","AWS region").option("--stage <name>","Stage name",{default:"prod"}).option("--days <number>","Number of days to show",{default:"7"}).action(async(t,m)=>{i("API Usage Statistics");try{let k=await De(),I=m.region||k.project.region||"us-east-1";e(`API ID: ${t}`),e(`Stage: ${m.stage}`),e(`Period: Last ${m.days} days`),e("");let L=new Date,z=new Date;z.setDate(z.getDate()-Number.parseInt(m.days)),e("To view API metrics in CloudWatch:"),e("  aws cloudwatch get-metric-statistics \\"),e("    --namespace AWS/ApiGateway \\"),e("    --metric-name Count \\"),e(`    --dimensions Name=ApiName,Value=${t} Name=Stage,Value=${m.stage} \\`),e(`    --start-time ${z.toISOString()} \\`),e(`    --end-time ${L.toISOString()} \\`),e("    --period 86400 \\"),e("    --statistics Sum \\"),e(`    --region ${I}`),e(""),e("Available metrics:"),e("  - Count: Total API calls"),e("  - Latency: Response latency"),e("  - 4XXError: Client errors"),e("  - 5XXError: Server errors"),e("  - IntegrationLatency: Backend latency")}catch(k){r(`Failed to get usage: ${k.message}`),process.exit(1)}}),R.command("api:export <apiId>","Export API specification").option("--region <region>","AWS region",{default:"us-east-1"}).option("--stage <name>","Stage name",{default:"prod"}).option("--format <format>","Export format (oas30, swagger)",{default:"oas30"}).option("--output <file>","Output file path").action(async(t,m)=>{i("Export API Specification");try{e(`API ID: ${t}`),e(`Stage: ${m.stage}`),e(`Format: ${m.format==="oas30"?"OpenAPI 3.0":"Swagger 2.0"}`),e("");let k=m.format==="oas30"?"oas30":"swagger";e("To export the API specification:"),e("  aws apigateway get-export \\"),e(`    --rest-api-id ${t} \\`),e(`    --stage-name ${m.stage} \\`),e(`    --export-type ${k} \\`),e("    --accepts application/json \\"),e(`    --region ${m.region} \\`),e(`    ${m.output||"api-spec.json"}`)}catch(k){r(`Failed to export API: ${k.message}`),process.exit(1)}}),R.command("api:logs <apiId>","View API Gateway logs").option("--region <region>","AWS region").option("--stage <name>","Stage name",{default:"prod"}).option("--tail","Tail the logs").action(async(t,m)=>{i("API Gateway Logs");try{let k=await De(),I=m.region||k.project.region||"us-east-1",L=`API-Gateway-Execution-Logs_${t}/${m.stage}`;if(e(`Log Group: ${L}`),e(""),e("To view logs:"),e("  aws logs filter-log-events \\"),e(`    --log-group-name "${L}" \\`),e(`    --region ${I}`),m.tail)e(""),e("For real-time log tailing, use:"),e(`  aws logs tail "${L}" --follow --region ${I}`);e(""),e("Note: Ensure logging is enabled for the API stage."),e("You can enable it in the stage settings.")}catch(k){r(`Failed to get logs: ${k.message}`),process.exit(1)}}),R.command("api:test <apiId> <path>","Test an API endpoint").option("--region <region>","AWS region").option("--stage <name>","Stage name",{default:"prod"}).option("--method <method>","HTTP method",{default:"GET"}).option("--body <json>","Request body (JSON)").option("--header <header>","Request header (can be specified multiple times)").action(async(t,m,k)=>{i("Test API Endpoint");try{let I=await De(),L=k.region||I.project.region||"us-east-1",z=`https://${t}.execute-api.${L}.amazonaws.com/${k.stage}${m.startsWith("/")?m:`/${m}`}`;e(`URL: ${z}`),e(`Method: ${k.method}`);let Y={"Content-Type":"application/json"};if(k.header){let ke=Array.isArray(k.header)?k.header:[k.header];for(let ce of ke){let[Se,...xe]=ce.split(":");Y[Se.trim()]=xe.join(":").trim()}}e("Headers:");for(let[ke,ce]of Object.entries(Y))e(`  ${ke}: ${ce}`);if(k.body)e(`Body: ${k.body}`);if(!await d(`
+Send request?`,!0)){e("Operation cancelled");return}let X=new s("Sending request...");X.start();let ee=Date.now(),oe=await fetch(z,{method:k.method,headers:Y,body:k.body}),se=Date.now()-ee,ue=await oe.text();X.succeed(`Response received (${se}ms)`),e(`
 Status: ${oe.status} ${oe.statusText}`),e(`
-Response Headers:`),oe.headers.forEach((Ae,de)=>{e(`  ${de}: ${Ae}`)}),e(`
-Response Body:`);try{let Ae=JSON.parse(be);console.log(JSON.stringify(Ae,null,2))}catch{console.log(be)}}catch(I){r(`Failed to test API: ${I.message}`),process.exit(1)}})}async function lo(R){let t=await Ne(),m=y(process.cwd(),t),k=new S(m.store,{workerId:`cli:${process.pid}`});try{return await R(k,m.project.id,m.organization.id)}finally{m.store.close()}}function Ph(R){if(!R)return;if(!["queued","running","succeeded","failed","cancelled","timed_out"].includes(R))throw Error("State must be queued, running, succeeded, failed, cancelled, or timed_out");return R}function xh(R,t){if(!R)return"—";let m=Math.max(0,new Date(t??Date.now()).getTime()-new Date(R).getTime());return m<1000?`${m}ms`:m<60000?`${Math.round(m/1000)}s`:`${Math.round(m/60000)}m`}function Bl(R){R.command("ops:list","List durable deployment and mutation jobs").option("--state <state>","Filter queue state").option("--all-projects","Show all locally authorized projects").action(async(t)=>{try{await lo(async(m,k)=>{let I=m.list({projectId:t.allProjects?void 0:k,state:Ph(t.state),limit:500});c(["ID","State","Operation","Target","Attempt","Step / blocked","Queued","Duration"],I.map(({operation:L,job:z,approximatePosition:Y})=>[L.id,L.state,L.kind,L.resourceId??L.environmentId??L.projectId??"global",`${L.attempt}/${z.maxAttempts}`,z.blockedReason??z.currentStep??(Y?`${Y.ahead} ahead`:"—"),L.createdAt,xh(L.startedAt,L.finishedAt)]))})}catch(m){r(m instanceof Error?m.message:String(m))}}),R.command("ops:show <id>","Show a durable operation and its latest sanitized logs").option("--after <cursor>","Show logs after this sequence",{default:"0"}).action(async(t,m)=>{try{await lo(async(k)=>{let I=k.view(t);if(!I)throw Error(`Operation ${t} was not found`);e(JSON.stringify(I,null,2));for(let L of k.logs(t,{after:Number(m.after)||0,limit:500}))e(`${L.sequence} ${L.stream.toUpperCase()}${L.step?` [${L.step}]`:""} ${L.message}`)})}catch(k){r(k instanceof Error?k.message:String(k))}}),R.command("ops:cancel <id>","Cancel queued work or request running cancellation").option("--yes","Skip confirmation").action(async(t,m)=>{try{await lo(async(k)=>{let I=k.view(t);if(!I)throw Error(`Operation ${t} was not found`);if(!m.yes&&!await d(`Cancel ${I.operation.kind} (${t})?`,!1))return;let L=k.requestCancellation(t);n(`${L.state==="cancelled"?"Cancelled":"Cancellation requested for"} ${t}`)})}catch(k){r(k instanceof Error?k.message:String(k))}}),R.command("ops:retry <id>","Retry a terminal job using an allow-listed error class").option("--class <name>","Retryable error class").option("--delay <milliseconds>","Delay before the next attempt",{default:"0"}).action(async(t,m)=>{try{if(!m.class)throw Error("Pass --class with one of the retry classes shown by ops:show");await lo(async(k)=>{let I=k.retry(t,m.class,{delayMs:Number(m.delay)||0});n(`Retry queued: ${I.id} · attempt ${I.attempt+1}`)})}catch(k){r(k instanceof Error?k.message:String(k))}}),R.command("ops:concurrency","Show effective durable queue concurrency limits").action(async()=>{try{await lo(async(t)=>e(JSON.stringify(t.limits,null,2)))}catch(t){r(t instanceof Error?t.message:String(t))}}),R.command("ops:concurrency:set","Confirm and audit durable queue concurrency limits").option("--project <count>","Concurrent jobs per project").option("--environment <count>","Concurrent jobs per environment").option("--provider <count>","Concurrent jobs per provider").option("--builds <count>","Concurrent build slots").option("--confirm <text>",'Must equal "update queue limits"').action(async(t)=>{try{if(t.confirm!=="update queue limits")throw Error('Pass --confirm "update queue limits" to change production concurrency');let m={};for(let k of["project","environment","provider","builds"])if(t[k]!==void 0)m[k]=Number(t[k]);await lo(async(k,I,L)=>n(`Queue concurrency updated: ${JSON.stringify(k.configureConcurrency(m,{organizationId:L}))}`))}catch(m){r(m instanceof Error?m.message:String(m))}}),R.command("ops:history:clear","Clear terminal jobs after their retention policy expires").option("--before <date>","Also require completion before this timestamp").option("--yes","Skip confirmation").action(async(t)=>{try{await lo(async(m,k)=>{if(!t.yes&&!await d("Clear completed queue history whose retention has elapsed?",!1))return;let I=m.clearCompleted({projectId:k,before:t.before});n(`Cleared ${I} retained operation${I===1?"":"s"}.`)})}catch(m){r(m instanceof Error?m.message:String(m))}})}import{readFile as Dh,writeFile as Eh}from"node:fs/promises";function Th(R){if(R==null)return"—";if(R<60)return`${R}s`;if(R<3600)return`${Math.floor(R/60)}m`;if(R<86400)return`${Math.floor(R/3600)}h`;return`${Math.floor(R/86400)}d`}function Nh(R){return R==null?"—":vn(R)}function Oh(R){return R.map((t)=>[t.id,t.name,t.provider,t.kind,t.status,t.desiredReplicas==null?"—":`${t.runningReplicas??0}/${t.desiredReplicas}`,t.image??t.runtime??"—",Nh(t.resources?.memoryBytes??t.resources?.memoryLimitBytes),Th(t.ageSeconds)])}function Lh(R,t){let m=t.search?.toLowerCase();return{...R,workloads:R.workloads.filter((k)=>(!t.provider||k.provider===t.provider)&&(!t.status||k.status===t.status)&&(!m||`${k.name} ${k.id} ${k.links.service??""} ${Object.values(k.tags).join(" ")}`.toLowerCase().includes(m)))}}async function po(R){let t=await Ne(),m=R??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let k=new Ce(t,m);return{config:t,env:m,service:k}}async function Ra(R,t){if(t!==void 0)return t;return P(`Type ${R.name} to confirm`,"")}async function Fh(R,t,m,k,I,L){return xa(R,`runtime.${t}`,{workloadId:R.id,provider:R.provider,action:t,replicas:m??null},I,()=>L.run({workloadId:R.id,action:t,replicas:m,confirm:k,recentAuth:!0}))}async function xa(R,t,m,k,I){let L=await Ne(),z=y(process.cwd(),L),Y=new S(z.store,{workerId:`cli:${process.pid}`});try{let Z=z.environments.get(k),X=z.store.listResources(z.project.id,Z?.id).find((ae)=>ae.slug===R.links.service),ie=z.store.getActorByExternalId("system","cli")??z.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI",metadata:{source:"cli"}}),oe=Y.enqueue({projectId:z.project.id,environmentId:Z?.id,resourceId:X?.id,actorId:ie.id,kind:t,input:h(m),lockKey:X?`resource:${X.id}`:`runtime:${R.id}`,providerKey:R.provider,maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!Y.claim(oe.id))throw Error(`Workload is locked by another operation. Inspect ${oe.id} with cloud ops:show.`);try{let ae=await I();if(ae.stdout)Y.appendLog(oe.id,ae.stdout,{stream:"stdout"});if(ae.stderr)Y.appendLog(oe.id,ae.stderr,{stream:"stderr"});if(ae.ok)Y.complete(oe.id,{ok:!0,command:ae.command??null});else Y.fail(oe.id,ae.error??ae.stderr??"Runtime operation failed",{ok:!1});return{result:ae,operationId:oe.id}}catch(ae){throw Y.fail(oe.id,ae instanceof Error?ae.message:String(ae),{ok:!1,threw:!0}),ae}}finally{z.store.close()}}function _l(R){R.command("runtime:list","List services, containers, ECS tasks, and Lambda functions").option("--env <environment>","Target environment").option("--provider <provider>","Filter systemd, docker, ecs, or lambda").option("--status <status>","Filter normalized runtime status").option("--search <query>","Search names, IDs, services, and tags").option("--json","Print normalized JSON").action(async(t)=>{try{let{service:m}=await po(t.env),k=Lh(await m.inventory(),t);if(t.json)e(JSON.stringify(k,null,2));else{c(["ID","Name","Provider","Kind","Status","Replicas","Image / runtime","Memory","Age"],Oh(k.workloads));for(let I of k.sources.filter((L)=>L.status!=="fresh"))a(`${I.id}: ${I.status}${I.message?` — ${I.message}`:""}`)}}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}}),R.command("runtime:inspect <workload>","Inspect normalized config, replicas, networks, mounts, links, and capabilities").option("--env <environment>","Target environment").action(async(t,m)=>{try{let{service:k}=await po(m.env),I=await k.workload(t);if(!I)throw Error("Workload was not found in this project and environment");e(JSON.stringify(I,null,2))}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}}),R.command("runtime:logs <workload>","Read bounded logs for one authorized runtime target").option("--env <environment>","Target environment").option("--lines <count>","Maximum log lines",{default:"200"}).option("--json","Print structured JSON").action(async(t,m)=>{try{let{service:k}=await po(m.env),I=await k.logs(t,{limit:Number(m.lines)||200});if(m.json)e(JSON.stringify(I,null,2));else for(let L of I.lines)console.log(`${L.timestamp??"—"} ${L.message}`)}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}}),R.command("runtime:action <workload> <action>","Start, stop, restart, redeploy, or scale one workload").option("--env <environment>","Target environment").option("--replicas <count>","Desired replicas for scale").option("--confirm <name>","Exact workload name confirmation").action(async(t,m,k)=>{try{let I=m;if(!["start","stop","restart","redeploy","scale"].includes(I))throw Error("Action must be start, stop, restart, redeploy, or scale");let L=k.replicas==null?void 0:Number(k.replicas);if(I==="scale"&&(!Number.isInteger(L)||L<0))throw Error("Scale requires a non-negative integer --replicas value");let{env:z,service:Y}=await po(k.env),Z=await Y.inventory(),X=Z.workloads.find((ae)=>ae.id===t);if(!X)throw Error("Workload was not found in this project and environment");let ie=new Ce(await Ne(),z,{inventory:async()=>Z}),oe=await Fh(X,I,L,await Ra(X,k.confirm),z,ie);if(!oe.result.ok)throw Error(oe.result.error??oe.result.stderr??"Runtime operation failed");if(n(`${I} completed for ${X.name} · operation ${oe.operationId}`),oe.result.stdout)e(oe.result.stdout)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}}),R.command("runtime:exec <workload>","Run a scoped diagnostic preset or container command").option("--env <environment>","Target environment").option("--preset <preset>","Read-only preset: process, sockets, or filesystem").option("--command <command>","Free-form command (Docker containers only)").option("--confirm <name>","Exact workload name confirmation").action(async(t,m)=>{try{let{env:k,service:I}=await po(m.env),z=(await I.inventory()).workloads.find((ie)=>ie.id===t);if(!z)throw Error("Workload was not found in this project and environment");let Y=["process","sockets","filesystem"].includes(String(m.preset))?m.preset:void 0;if(m.preset&&!Y)throw Error("Preset must be process, sockets, or filesystem");if(!Y&&!m.command)throw Error("Pass --preset or --command");let Z=await Ra(z,m.confirm),X=await xa(z,"runtime.exec",{workloadId:t,provider:z.provider,preset:Y??null,freeForm:!!m.command},k,()=>I.exec({workloadId:t,preset:Y,command:m.command,confirm:Z,recentAuth:!0}));if(!X.result.ok)throw Error(X.result.error??X.result.stderr??"Exec failed");if(X.result.stdout)e(X.result.stdout);if(X.result.stderr)a(X.result.stderr);n(`Exec completed for ${z.name} · operation ${X.operationId}`)}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}}),R.command("runtime:download <workload> <remote> <local>","Download a bounded file from a service-owned path").option("--env <environment>","Target environment").option("--confirm <name>","Exact workload name confirmation").action(async(t,m,k,I)=>{try{let{env:L,service:z}=await po(I.env),Z=(await z.inventory()).workloads.find((oe)=>oe.id===t);if(!Z)throw Error("Workload was not found in this project and environment");let X=await Ra(Z,I.confirm),ie=await xa(Z,"runtime.file.read",{workloadId:t,provider:Z.provider,path:m},L,()=>z.readFile({workloadId:t,path:m,confirm:X,recentAuth:!0}));if(!ie.result.ok||!ie.result.contentBase64)throw Error(ie.result.error??"File download failed");await Eh(k,Buffer.from(ie.result.contentBase64,"base64")),n(`Downloaded ${ie.result.size??0} bytes to ${k} · operation ${ie.operationId}${ie.result.truncated?" (truncated)":""}`)}catch(L){r(L instanceof Error?L.message:String(L)),process.exitCode=1}}),R.command("runtime:upload <workload> <local> <remote>","Upload and atomically replace a file in a service-owned path").option("--env <environment>","Target environment").option("--confirm <name>","Exact workload name confirmation").action(async(t,m,k,I)=>{try{let{env:L,service:z}=await po(I.env),Z=(await z.inventory()).workloads.find((ae)=>ae.id===t);if(!Z)throw Error("Workload was not found in this project and environment");let X=await Ra(Z,I.confirm),ie=(await Dh(m)).toString("base64"),oe=await xa(Z,"runtime.file.write",{workloadId:t,provider:Z.provider,path:k,bytes:Buffer.from(ie,"base64").byteLength},L,()=>z.writeFile({workloadId:t,path:k,contentBase64:ie,confirm:X,recentAuth:!0}));if(!oe.result.ok)throw Error(oe.result.error??"File upload failed");n(`Uploaded ${oe.result.size??0} bytes to ${k} · operation ${oe.operationId}`)}catch(L){r(L instanceof Error?L.message:String(L)),process.exitCode=1}})}function jh(R,t=new Date){let m=R.to?new Date(R.to):t;if(!Number.isFinite(m.getTime()))throw Error("--to must be a valid ISO-8601 instant");if(R.from){let L=new Date(R.from);if(!Number.isFinite(L.getTime()))throw Error("--from must be a valid ISO-8601 instant");return{from:L.toISOString(),to:m.toISOString()}}let k=String(R.range??"1h").match(/^(\d+)(m|h|d)$/);if(!k)throw Error("--range must use minutes, hours, or days (for example 30m, 6h, or 7d)");let I=k[2]==="m"?60000:k[2]==="h"?3600000:86400000;return{from:new Date(m.getTime()-Number(k[1])*I).toISOString(),to:m.toISOString()}}async function Ps(R){let t=await Ne(),m=R??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let k=y(process.cwd(),t),I=k.environments.get(m),L=new Qe(k.store);return{config:t,env:m,controlPlane:k,environmentRecord:I,telemetry:L}}function Lu(R,t,m){let k=(L)=>L?.split(",").map((z)=>z.trim()).filter(Boolean)||void 0,I=k(R.kind)?.filter((L)=>["metric","log","trace","request","event"].includes(L));return{projectId:t,environmentId:m,...jh(R),kinds:I,names:k(R.name),sources:k(R.source),text:R.text,limit:Math.min(5000,Math.max(1,Number(R.limit)||200))}}function Bh(R){let t=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"];return[t.join(","),...R.map((m)=>t.map((k)=>`"${String(m[k]??"").replaceAll('"','""')}"`).join(","))].join(`
-`)}function Ml(R){R.command("telemetry:collect","Collect normalized host/runtime or AWS telemetry into the local control plane").option("--env <environment>","Target environment").option("--force","Bypass the provider-query cache").option("--json","Print structured JSON").action(async(t)=>{let m=await Ps(t.env);try{let k=await pi({controlPlane:m.controlPlane.store,projectId:m.controlPlane.project.id,environmentId:m.environmentRecord?.id,config:m.config,environment:m.env,force:t.force});if(t.json)e(JSON.stringify(k,null,2));else n(`Collected ${k.collected} normalized records${k.cached?" (cached provider result)":""}.`),c(["Source","Freshness","Lag","Sampling","Retention"],k.statuses.map((I)=>[I.source,I.freshness,I.lagSeconds==null?"—":`${I.lagSeconds}s`,`${Math.round(I.samplingRate*100)}%`,`${I.retentionDays}d`]))}finally{m.controlPlane.store.close()}}),R.command("telemetry:query","Query bounded normalized metrics, logs, traces, requests, and events").option("--env <environment>","Target environment").option("--from <instant>","ISO-8601 start").option("--to <instant>","ISO-8601 end").option("--range <duration>","Relative window such as 1h or 7d",{default:"1h"}).option("--kind <kinds>","Comma-separated kinds").option("--name <names>","Comma-separated signal names").option("--source <sources>","Comma-separated sources").option("--text <query>","Search name/message").option("--limit <count>","Maximum records",{default:"200"}).option("--json","Print structured JSON").action(async(t)=>{let m=await Ps(t.env);try{let k=m.telemetry.query(Lu(t,m.controlPlane.project.id,m.environmentRecord?.id));if(t.json)e(JSON.stringify(k,null,2));else c(["Time","Kind","Source","Signal","Value / message","Correlation"],k.records.map((I)=>[I.timestamp,I.kind,I.source,I.name,I.message??(I.value==null?"—":`${I.value} ${I.unit??""}`),I.requestId??I.traceId??I.releaseId??I.deploymentId??"—"]));if(k.truncated)a("More records are available; narrow the window or use the dashboard cursor explorer.")}finally{m.controlPlane.store.close()}}),R.command("telemetry:export <file>","Export a bounded telemetry query as JSON or CSV").option("--env <environment>","Target environment").option("--from <instant>","ISO-8601 start").option("--to <instant>","ISO-8601 end").option("--range <duration>","Relative window",{default:"1h"}).option("--kind <kinds>","Comma-separated kinds").option("--name <names>","Comma-separated signal names").option("--source <sources>","Comma-separated sources").option("--text <query>","Search name/message").option("--limit <count>","Maximum records",{default:"5000"}).action(async(t,m)=>{let k=await Ps(m.env);try{let I=Lu(m,k.controlPlane.project.id,k.environmentRecord?.id),L=k.telemetry.query(I);await Bun.write(t,t.toLowerCase().endsWith(".csv")?Bh(L.records):JSON.stringify({exportedAt:new Date().toISOString(),query:I,...L},null,2)),n(`Exported ${L.records.length} records to ${t}${L.truncated?" (bounded result)":""}.`)}finally{k.controlPlane.store.close()}}),R.command("telemetry:compact","Downsample old metrics and enforce configured retention").option("--env <environment>","Target environment").action(async(t)=>{let m=await Ps(t.env);try{let k=Xe(m.controlPlane.store,m.controlPlane.project.id);e(JSON.stringify(m.telemetry.enforceRetention(k,m.controlPlane.project.id),null,2))}finally{m.controlPlane.store.close()}}),R.command("telemetry:policy","Show or update sampling, retention, and local storage cost assumptions").option("--env <environment>","Target environment").option("--raw-days <days>","Raw retention days").option("--downsample-days <days>","Downsample after days").option("--sampling <rate>","Sampling rate from 0.01 to 1").option("--storage-usd-gb-month <amount>","Local storage cost assumption").option("--json","Print structured JSON").action(async(t)=>{let m=await Ps(t.env);try{let k={};if(t.rawDays!=null)k.rawDays=Number(t.rawDays);if(t.downsampleDays!=null)k.downsampleAfterDays=Number(t.downsampleDays);if(t.sampling!=null)k.samplingRate=Number(t.sampling);if(t.storageUsdGbMonth!=null)k.estimatedStorageUsdPerGbMonth=Number(t.storageUsdGbMonth);let I=Object.keys(k).length?hi(m.controlPlane.store,m.controlPlane.project.id,k):Xe(m.controlPlane.store,m.controlPlane.project.id),z=m.telemetry.status(m.controlPlane.project.id,m.environmentRecord?.id,I.rawDays,I.samplingRate).reduce((Z,X)=>Z+X.estimatedDailyBytes*30,0),Y={policy:I,estimatedMonthlyBytes:z,estimatedMonthlyCostUsd:yi(z,I),costEstimateConfigured:I.estimatedStorageUsdPerGbMonth>0};if(t.json)e(JSON.stringify(Y,null,2));else e(JSON.stringify(I,null,2)),e(Y.costEstimateConfigured?`Estimated local storage: $${Y.estimatedMonthlyCostUsd}/month`:"Storage cost remains unavailable until --storage-usd-gb-month is set.")}finally{m.controlPlane.store.close()}})}async function Ji(R){let t=await Ne(),m=R??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let k=y(process.cwd(),t),I=k.environments.get(m),L=new ht(k.store,{encryptionKey:_(process.cwd())});return{config:t,env:m,controlPlane:k,environmentRecord:I,alerts:L}}function Fu(R){return new yr(R,{emailImpl:async(t)=>{let{email:m}=await import("./chunk-86w3vzx8.js");return m.send(t)}})}function zl(R){R.command("health:list","List configured health checks and latest results").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{let m=await Ji(t.env);try{let k=m.alerts.listHealthChecks(m.controlPlane.project.id,m.environmentRecord?.id).map((I)=>({...I,latest:m.alerts.listHealthResults(I.id,1)[0]}));if(t.json)e(JSON.stringify(k,null,2));else c(["ID","Name","Kind","Target","Status","Interval","Enabled"],k.map((I)=>[I.id,I.name,I.kind,I.target,I.latest?.status??"no data",`${I.intervalSeconds}s`,I.enabled?"yes":"no"]))}finally{m.controlPlane.store.close()}}),R.command("health:run <check>","Run one health check and evaluate linked alert rules").option("--env <environment>","Target environment").option("--test","Preview without persisting results or incidents").action(async(t,m)=>{let k=await Ji(m.env);try{let I=k.alerts.getHealthCheck(t)??k.alerts.listHealthChecks(k.controlPlane.project.id,k.environmentRecord?.id).find((Y)=>Y.name===t);if(!I)throw Error("Health check was not found");let L=new je(k.alerts);if(m.test){let Y=await L.probe(I);e(JSON.stringify({...Y,productionIncidentCreated:!1},null,2));return}let z=await L.runAndEvaluate(I);if(e(JSON.stringify(z,null,2)),z.result.status==="healthy")n(`${I.name} is healthy.`);else a(`${I.name} is ${z.result.status}.`)}finally{k.controlPlane.store.close()}}),R.command("alerts:list","List pending, firing, silenced, and resolved alerts").option("--env <environment>","Target environment").option("--state <states>","Comma-separated states").option("--json","Print structured JSON").action(async(t)=>{let m=await Ji(t.env);try{let k=m.alerts.listAlerts(m.controlPlane.project.id,{environmentId:m.environmentRecord?.id,states:t.state?.split(",").filter(Boolean)});if(t.json)e(JSON.stringify(k,null,2));else c(["ID","State","Severity","Title","Owner","First seen","Last seen"],k.map((I)=>[I.id,I.state,I.severity,I.title,I.ownerActorId??"unassigned",I.firstSeenAt,I.lastSeenAt]))}finally{m.controlPlane.store.close()}}),R.command("alerts:evaluate","Evaluate persisted telemetry rules now").option("--env <environment>","Target environment").action(async(t)=>{let m=await Ji(t.env);try{let k=on(m.alerts,m.controlPlane.project.id,m.environmentRecord?.id);e(JSON.stringify(k,null,2))}finally{m.controlPlane.store.close()}}),R.command("alerts:ack <alert>","Acknowledge an alert as the CLI actor").option("--env <environment>","Target environment").action(async(t,m)=>{let k=await Ji(m.env);try{let I=k.controlPlane.store.getActorByExternalId("system","cli")??k.controlPlane.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});n(`Acknowledged ${k.alerts.acknowledge(t,I.id).title}.`)}finally{k.controlPlane.store.close()}}),R.command("notifications:list","List notification channels, routes, and recent delivery diagnostics").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{let m=await Ji(t.env);try{let k={channels:m.alerts.listChannels(m.controlPlane.organization.id),routes:m.alerts.listRoutes(m.controlPlane.organization.id),deliveries:m.alerts.listDeliveries({limit:100})};if(t.json)e(JSON.stringify(k,null,2));else c(["Channel","Type","Status","Tested","Error"],k.channels.map((I)=>[I.name,I.kind,I.status,I.lastTestedAt??"never",I.lastError??"—"])),c(["Event","State","Attempts","Status","Error"],k.deliveries.map((I)=>[I.eventType,I.state,`${I.attempt}/${I.maxAttempts}`,String(I.responseStatus??"—"),I.error??"—"]))}finally{m.controlPlane.store.close()}}),R.command("notifications:test <channel>","Send a channel test without creating a production incident").option("--env <environment>","Target environment").action(async(t,m)=>{let k=await Ji(m.env);try{let I=k.alerts.getChannel(t)??k.alerts.listChannels(k.controlPlane.organization.id).find((z)=>z.name===t);if(!I)throw Error("Notification channel was not found");let L=await Fu(k.alerts).testChannel(I.id);if(L.ok)n("Test delivered; no production incident was created.");else throw Error(L.error)}finally{k.controlPlane.store.close()}}),R.command("notifications:retry <delivery>","Retry one failed notification delivery").option("--env <environment>","Target environment").action(async(t,m)=>{let k=await Ji(m.env);try{let I=k.alerts.getDelivery(t);if(!I)throw Error("Notification delivery was not found");k.alerts.updateDelivery(t,{state:"retrying",attempt:Math.max(0,I.attempt-1),nextAttemptAt:new Date().toISOString()}),e(JSON.stringify(await Fu(k.alerts).deliver(t),null,2))}finally{k.controlPlane.store.close()}})}async function _h(R,t){let m=await Ne(),k=y(process.cwd(),m),I=!R&&t?new en(k.store).get(t):void 0,L=I?.environmentId?k.store.listEnvironments(k.project.id).find((be)=>be.id===I.environmentId)?.slug:void 0,z=R??L??Object.keys(m.environments??{})[0]??"production";if(!Object.hasOwn(m.environments??{},z))throw k.store.close(),Error(`Environment ${z} was not found`);let Y=k.environments.get(z);if(!Y)throw k.store.close(),Error(`Environment ${z} was not found in the control plane`);let Z=new en(k.store),X=new S(k.store,{workerId:`cli:${process.pid}`}),ie=new li(Z,{queue:X}),oe=k.store.listResources(k.project.id,Y.id);Zr(Z,m,{organization:k.organization,project:k.project,environment:Y,resources:oe});let ae=k.store.getActorByExternalId("system","cli")??k.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});return{config:m,env:z,controlPlane:k,environmentRecord:Y,resources:oe,store:Z,queue:X,service:ie,actor:ae}}async function zr(R,t,m){let k=await _h(R,m);try{return await t(k)}finally{k.controlPlane.store.close()}}async function er(R){try{await R()}catch(t){r(t instanceof Error?t.message:String(t))}}function Vo(R,t){let m=R.store.list(R.controlPlane.project.id,{environmentId:R.environmentRecord.id}),k=R.store.get(t)??m.find((I)=>I.name===t);if(!k||k.environmentId!==R.environmentRecord.id)throw Error(`Scheduled job ${t} was not found in ${R.env}`);return k}function bo(R,t,m,k){R.controlPlane.store.appendEvent({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,resourceId:k,actorId:R.actor.id,type:`job.${t}`,payload:m})}function ju(R,t,m){if(R.environmentRecord.kind==="production"&&m!==t)throw Error(`Production ${t} requires --confirm ${t}`)}function Mh(R){if(!R)return{};if(!/^(?:secret|ssm|arn|env):\/\//.test(R))throw Error("Payloads must use a secret://, ssm://, arn://, or env:// reference");return{input:R}}function zh(R){return R.map((t)=>[t.id,t.enabled?"enabled":"disabled",t.provider,t.name,t.expression,t.timezone,t.nextRunAt??"—",t.reconciliationStatus])}function Ul(R){R.command("jobs:list","List server cron, EventBridge, and recurring control-plane jobs").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>er(async()=>zr(t.env,async(m)=>{let k=m.store.list(m.controlPlane.project.id,{environmentId:m.environmentRecord.id});if(t.json)e(JSON.stringify(k,null,2));else c(["ID","State","Provider","Name","Expression","Timezone","Next run","Reconciliation"],zh(k))}))),R.command("jobs:preview <expression>","Preview the next runs without creating production work").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--from <date>","Preview from an ISO timestamp").option("--count <count>","Number of runs",{default:"5"}).action(async(t,m)=>er(async()=>{let k=mt(t,m.timezone??"UTC",m.from?new Date(m.from):new Date,Number(m.count)||5);e(JSON.stringify({...k,productionExecutionCreated:!1},null,2))})),R.command("jobs:add <name> <expression>","Create a managed recurring job").option("--env <environment>","Target environment").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--operation <id>","Safe server operation target (scheduler, backup, or worker)").option("--resource <id>","Resource ID or slug").option("--starts-at <date>","Schedule window start").option("--ends-at <date>","Schedule window end").option("--flexible-minutes <count>","Provider flexible window",{default:"0"}).option("--missed <policy>","skip or catch_up",{default:"skip"}).option("--overlap <policy>","allow, forbid, or replace",{default:"forbid"}).option("--attempts <count>","Maximum attempts",{default:"3"}).option("--backoff <seconds>","Retry backoff seconds",{default:"30"}).option("--timeout <seconds>","Execution timeout",{default:"900"}).option("--dead-letter <reference>","Dead-letter ARN or secret reference").option("--payload-ref <reference>","Referenced payload; inline values are forbidden").option("--disabled","Create disabled").action(async(t,m,k)=>er(async()=>zr(k.env,async(I)=>{if(!["skip","catch_up"].includes(k.missed??"skip"))throw Error("--missed must be skip or catch_up");if(!["allow","forbid","replace"].includes(k.overlap??"forbid"))throw Error("--overlap must be allow, forbid, or replace");let L=H(I.config),Y={workers:I.store.listWorkers(I.controlPlane.project.id,I.environmentRecord.id).map((be)=>({name:be.name}))},Z;if(L==="server"){let be=Xr(I.config,Y).filter((de)=>!de.danger&&["scheduler","backup","worker"].includes(de.group)),Ae=k.operation?be.find((de)=>de.id===k.operation):be.length===1?be[0]:void 0;if(!Ae)throw Error(`Choose a safe target with --operation. Available: ${be.map((de)=>de.id).join(", ")||"none"}`);Z={kind:"dashboard_operation",operationId:Ae.id}}else Z={kind:"serverless_scheduler",action:"run"};let X=L==="server"?"server":"eventbridge",ie=ci({provider:X,expression:m,flexibleMinutes:Number(k.flexibleMinutes)||0,missedRunPolicy:k.missed??"skip",overlapPolicy:k.overlap??"forbid"});if(!ie.supported)throw Error(ie.notes.join(" "));let oe=k.resource?I.resources.find((be)=>be.id===k.resource||be.slug===k.resource):void 0;if(k.resource&&!oe)throw Error(`Resource ${k.resource} was not found in ${I.env}`);let ae=I.store.create({organizationId:I.controlPlane.organization.id,projectId:I.controlPlane.project.id,environmentId:I.environmentRecord.id,resourceId:oe?.id,name:t,provider:X,expression:m,timezone:k.timezone??"UTC",startsAt:k.startsAt,endsAt:k.endsAt,flexibleMinutes:Number(k.flexibleMinutes)||0,target:Z,payloadRefs:Mh(k.payloadRef),missedRunPolicy:k.missed??"skip",overlapPolicy:k.overlap??"forbid",retryPolicy:{maxAttempts:Number(k.attempts)||3,backoffSeconds:Number(k.backoff)||30,deadLetterRef:k.deadLetter},timeoutSeconds:Number(k.timeout)||900,enabled:!k.disabled,origin:"managed",ownerActorId:I.actor.id,observedState:{},reconciliationStatus:"pending"});bo(I,"created",{jobId:ae.id,provider:ae.provider,expression:ae.normalizedExpression},ae.resourceId),n(`Created ${ae.name} (${ae.id}); next run ${ae.nextRunAt??"outside the active window"}`)}))),R.command("jobs:update <job>","Update a managed job schedule and policies").option("--env <environment>","Target environment").option("--expression <expression>","Cron, preset, or rate expression").option("--timezone <timezone>","IANA timezone").option("--missed <policy>","skip or catch_up").option("--overlap <policy>","allow, forbid, or replace").option("--timeout <seconds>","Execution timeout").action(async(t,m)=>er(async()=>zr(m.env,async(k)=>{let I=Vo(k,t);if(I.origin==="config")throw Error("Config-defined schedules must be edited in cloud.config.ts and reconciled");if(m.missed&&!["skip","catch_up"].includes(m.missed))throw Error("--missed must be skip or catch_up");if(m.overlap&&!["allow","forbid","replace"].includes(m.overlap))throw Error("--overlap must be allow, forbid, or replace");let L=k.store.updateSchedule(I.id,{expression:m.expression,timezone:m.timezone,missedRunPolicy:m.missed,overlapPolicy:m.overlap,timeoutSeconds:m.timeout==null?void 0:Number(m.timeout)});bo(k,"updated",{jobId:L.id,expression:L.normalizedExpression,version:L.version},L.resourceId),n(`Updated ${L.name}; next run ${L.nextRunAt??"outside the active window"}`)}))),R.command("jobs:run <job>","Queue a manual run through the durable operation worker").option("--env <environment>","Target environment").action(async(t,m)=>er(async()=>zr(m.env,async(k)=>{let I=Vo(k,t),L=k.service.enqueue(I,{trigger:"manual",actorId:k.actor.id});bo(k,"run_queued",{jobId:I.id,executionId:L.id},I.resourceId),n(`Queued execution ${L.id}; inspect it with cloud jobs:history "${I.name}"`)}))),R.command("jobs:dispatch <job>","Dispatch an externally triggered schedule into the durable queue").option("--env <environment>","Target environment").option("--scheduled-for <date>","Provider scheduled timestamp").option("--scheduled","Mark this as a provider schedule trigger").action(async(t,m)=>er(async()=>zr(m.env,async(k)=>{let I=Vo(k,t);if(!I.enabled)throw Error(`${I.name} is disabled`);let L=m.scheduledFor?new Date(m.scheduledFor):new Date;if(!m.scheduledFor)L.setUTCSeconds(0,0);let z=L.toISOString(),Y=k.service.enqueue(I,{trigger:m.scheduled?"scheduled":"external",scheduledFor:z,actorId:k.actor.id}),Z=pt(I.normalizedExpression,I.timezone,L,1)[0];k.store.markScheduled(I.id,z,Z),n(`Accepted ${I.name} for ${z} as ${Y.id}`)},t)));for(let t of["enable","disable"])R.command(`jobs:${t} <job>`,`${t==="enable"?"Enable":"Disable"} a scheduled job`).option("--env <environment>","Target environment").option("--confirm <text>",`Production ${t} confirmation`).action(async(m,k)=>er(async()=>zr(k.env,async(I)=>{let L=Vo(I,m);if(t==="disable")ju(I,t,k.confirm);let z=I.store.setEnabled(L.id,t==="enable");bo(I,t==="enable"?"enabled":"disabled",{jobId:z.id},z.resourceId),n(`${z.name} is ${z.enabled?"enabled":"disabled"}`)})));R.command("jobs:delete <job>","Delete a managed schedule").option("--env <environment>","Target environment").option("--confirm <text>","Must be delete in production").action(async(t,m)=>er(async()=>zr(m.env,async(k)=>{let I=Vo(k,t);ju(k,"delete",m.confirm),k.store.remove(I.id),bo(k,"deleted",{jobId:I.id,name:I.name},I.resourceId),n(`Deleted ${I.name}`)}))),R.command("jobs:history <job>","Show execution attempts, output, errors, and redacted logs").option("--env <environment>","Target environment").option("--limit <count>","Maximum executions",{default:"100"}).option("--logs","Print execution logs").option("--json","Print structured JSON").action(async(t,m)=>er(async()=>zr(m.env,async(k)=>{let I=Vo(k,t),L=k.store.listExecutions(I.id,Number(m.limit)||100).map((z)=>({...z,logs:m.logs&&z.operationId?k.queue.logs(z.operationId,{limit:500}):[]}));if(m.json)e(JSON.stringify(L,null,2));else if(c(["ID","Status","Trigger","Scheduled for","Attempt","Started","Finished","Error"],L.map((z)=>[z.id,z.status,z.trigger,z.scheduledFor,String(z.attempt),z.startedAt??"—",z.finishedAt??"—",z.error??"—"])),m.logs)for(let z of L)for(let Y of z.logs)e(`${z.id} ${Y.sequence} ${Y.stream.toUpperCase()} ${Y.message}`)}))),R.command("jobs:reconcile","Import declarative schedules and workers without destructive deletion").option("--env <environment>","Target environment").action(async(t)=>er(async()=>zr(t.env,async(m)=>{let k=Zr(m.store,m.config,{organization:m.controlPlane.organization,project:m.controlPlane.project,environment:m.environmentRecord,resources:m.resources});bo(m,"reconciled",k),n(`Reconciled ${k.jobs} schedules and ${k.workers} workers; retained ${k.drifted} missing definitions as drifted`)}))),R.command("workers:list","List configured systemd, ECS, and Lambda workers").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>er(async()=>zr(t.env,async(m)=>{let k=m.store.listWorkers(m.controlPlane.project.id,m.environmentRecord.id);if(t.json)e(JSON.stringify(k,null,2));else c(["ID","Provider","Name","Queue","Processes","Timeout","Restart","Reconciliation"],k.map((I)=>[I.id,I.provider,I.name,I.queue,String(I.processes),`${I.timeoutSeconds}s`,I.restartPolicy,I.reconciliationStatus]))}))),R.command("workers:restart <worker>","Gracefully restart an allowlisted systemd worker").option("--env <environment>","Target environment").option("--confirm <name>","Exact worker name confirmation").action(async(t,m)=>er(async()=>zr(m.env,async(k)=>{let I=k.store.listWorkers(k.controlPlane.project.id,k.environmentRecord.id),L=k.store.getWorker(t)??I.find((Z)=>Z.name===t);if(!L||L.environmentId!==k.environmentRecord.id)throw Error(`Worker ${t} was not found in ${k.env}`);if(m.confirm!==L.name)throw Error(`Restart requires --confirm "${L.name}"`);if(L.provider!=="systemd")throw Error(`${L.provider} workers are provider/config managed and do not expose a safe restart adapter`);let z=si(String(L.target.operationId??""),k.config,{workers:I.map((Z)=>({name:Z.name}))});if(!z||z.danger||z.group!=="worker")throw Error("The allowlisted worker restart operation is unavailable");let Y=await Qr(k.config,k.env,z);if(k.store.reconcileWorker(L.id,Y.ok?"in_sync":"unavailable",{...L.observedState,lastRestartAt:new Date().toISOString(),command:Y.command??null,error:Y.error??Y.stderr??null}),bo(k,"worker_restarted",{workerId:L.id,ok:Y.ok},L.resourceId),!Y.ok)throw Error(Y.error??Y.stderr??"Worker restart failed");n(`Restarted ${L.name}`)})))}function Wl(R){R.command("tunnel","Start a local tunnel to expose your local server").option("--port <number>","Local port to expose",{default:"3000"}).option("--subdomain <name>","Custom subdomain (if available)").option("--host <hostname>","Local hostname",{default:"localhost"}).option("--server <url>","Tunnel server URL",{default:"localtunnel.dev"}).option("--verbose","Enable verbose logging").action(async(t)=>{i("Local Tunnel");let m=Number.parseInt(t.port);if(e(`Local server: ${t.host}:${m}`),e(`Tunnel server: ${t.server}`),t.subdomain)e(`Requested subdomain: ${t.subdomain}`);let k=new s("Connecting to tunnel server...");k.start();try{let I;try{let X=await import("localtunnels");I=X.TunnelClient}catch{k.fail("localtunnels package not found"),e(`
+Response Headers:`),oe.headers.forEach((ke,ce)=>{e(`  ${ce}: ${ke}`)}),e(`
+Response Body:`);try{let ke=JSON.parse(ue);console.log(JSON.stringify(ke,null,2))}catch{console.log(ue)}}catch(I){r(`Failed to test API: ${I.message}`),process.exit(1)}})}async function ao(R){let t=await De(),m=y(process.cwd(),t),k=new S(m.store,{workerId:`cli:${process.pid}`});try{return await R(k,m.project.id,m.organization.id)}finally{m.store.close()}}function Ph(R){if(!R)return;if(!["queued","running","succeeded","failed","cancelled","timed_out"].includes(R))throw Error("State must be queued, running, succeeded, failed, cancelled, or timed_out");return R}function xh(R,t){if(!R)return"—";let m=Math.max(0,new Date(t??Date.now()).getTime()-new Date(R).getTime());return m<1000?`${m}ms`:m<60000?`${Math.round(m/1000)}s`:`${Math.round(m/60000)}m`}function Bl(R){R.command("ops:list","List durable deployment and mutation jobs").option("--state <state>","Filter queue state").option("--all-projects","Show all locally authorized projects").action(async(t)=>{try{await ao(async(m,k)=>{let I=m.list({projectId:t.allProjects?void 0:k,state:Ph(t.state),limit:500});c(["ID","State","Operation","Target","Attempt","Step / blocked","Queued","Duration"],I.map(({operation:L,job:z,approximatePosition:Y})=>[L.id,L.state,L.kind,L.resourceId??L.environmentId??L.projectId??"global",`${L.attempt}/${z.maxAttempts}`,z.blockedReason??z.currentStep??(Y?`${Y.ahead} ahead`:"—"),L.createdAt,xh(L.startedAt,L.finishedAt)]))})}catch(m){r(m instanceof Error?m.message:String(m))}}),R.command("ops:show <id>","Show a durable operation and its latest sanitized logs").option("--after <cursor>","Show logs after this sequence",{default:"0"}).action(async(t,m)=>{try{await ao(async(k)=>{let I=k.view(t);if(!I)throw Error(`Operation ${t} was not found`);e(JSON.stringify(I,null,2));for(let L of k.logs(t,{after:Number(m.after)||0,limit:500}))e(`${L.sequence} ${L.stream.toUpperCase()}${L.step?` [${L.step}]`:""} ${L.message}`)})}catch(k){r(k instanceof Error?k.message:String(k))}}),R.command("ops:cancel <id>","Cancel queued work or request running cancellation").option("--yes","Skip confirmation").action(async(t,m)=>{try{await ao(async(k)=>{let I=k.view(t);if(!I)throw Error(`Operation ${t} was not found`);if(!m.yes&&!await d(`Cancel ${I.operation.kind} (${t})?`,!1))return;let L=k.requestCancellation(t);n(`${L.state==="cancelled"?"Cancelled":"Cancellation requested for"} ${t}`)})}catch(k){r(k instanceof Error?k.message:String(k))}}),R.command("ops:retry <id>","Retry a terminal job using an allow-listed error class").option("--class <name>","Retryable error class").option("--delay <milliseconds>","Delay before the next attempt",{default:"0"}).action(async(t,m)=>{try{if(!m.class)throw Error("Pass --class with one of the retry classes shown by ops:show");await ao(async(k)=>{let I=k.retry(t,m.class,{delayMs:Number(m.delay)||0});n(`Retry queued: ${I.id} · attempt ${I.attempt+1}`)})}catch(k){r(k instanceof Error?k.message:String(k))}}),R.command("ops:concurrency","Show effective durable queue concurrency limits").action(async()=>{try{await ao(async(t)=>e(JSON.stringify(t.limits,null,2)))}catch(t){r(t instanceof Error?t.message:String(t))}}),R.command("ops:concurrency:set","Confirm and audit durable queue concurrency limits").option("--project <count>","Concurrent jobs per project").option("--environment <count>","Concurrent jobs per environment").option("--provider <count>","Concurrent jobs per provider").option("--builds <count>","Concurrent build slots").option("--confirm <text>",'Must equal "update queue limits"').action(async(t)=>{try{if(t.confirm!=="update queue limits")throw Error('Pass --confirm "update queue limits" to change production concurrency');let m={};for(let k of["project","environment","provider","builds"])if(t[k]!==void 0)m[k]=Number(t[k]);await ao(async(k,I,L)=>n(`Queue concurrency updated: ${JSON.stringify(k.configureConcurrency(m,{organizationId:L}))}`))}catch(m){r(m instanceof Error?m.message:String(m))}}),R.command("ops:history:clear","Clear terminal jobs after their retention policy expires").option("--before <date>","Also require completion before this timestamp").option("--yes","Skip confirmation").action(async(t)=>{try{await ao(async(m,k)=>{if(!t.yes&&!await d("Clear completed queue history whose retention has elapsed?",!1))return;let I=m.clearCompleted({projectId:k,before:t.before});n(`Cleared ${I} retained operation${I===1?"":"s"}.`)})}catch(m){r(m instanceof Error?m.message:String(m))}})}import{readFile as Dh,writeFile as Eh}from"node:fs/promises";function Th(R){if(R==null)return"—";if(R<60)return`${R}s`;if(R<3600)return`${Math.floor(R/60)}m`;if(R<86400)return`${Math.floor(R/3600)}h`;return`${Math.floor(R/86400)}d`}function Nh(R){return R==null?"—":Cn(R)}function Oh(R){return R.map((t)=>[t.id,t.name,t.provider,t.kind,t.status,t.desiredReplicas==null?"—":`${t.runningReplicas??0}/${t.desiredReplicas}`,t.image??t.runtime??"—",Nh(t.resources?.memoryBytes??t.resources?.memoryLimitBytes),Th(t.ageSeconds)])}function Lh(R,t){let m=t.search?.toLowerCase();return{...R,workloads:R.workloads.filter((k)=>(!t.provider||k.provider===t.provider)&&(!t.status||k.status===t.status)&&(!m||`${k.name} ${k.id} ${k.links.service??""} ${Object.values(k.tags).join(" ")}`.toLowerCase().includes(m)))}}async function co(R){let t=await De(),m=R??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let k=new Te(t,m);return{config:t,env:m,service:k}}async function Sa(R,t){if(t!==void 0)return t;return P(`Type ${R.name} to confirm`,"")}async function Fh(R,t,m,k,I,L){return Ca(R,`runtime.${t}`,{workloadId:R.id,provider:R.provider,action:t,replicas:m??null},I,()=>L.run({workloadId:R.id,action:t,replicas:m,confirm:k,recentAuth:!0}))}async function Ca(R,t,m,k,I){let L=await De(),z=y(process.cwd(),L),Y=new S(z.store,{workerId:`cli:${process.pid}`});try{let Z=z.environments.get(k),X=z.store.listResources(z.project.id,Z?.id).find((se)=>se.slug===R.links.service),ee=z.store.getActorByExternalId("system","cli")??z.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI",metadata:{source:"cli"}}),oe=Y.enqueue({projectId:z.project.id,environmentId:Z?.id,resourceId:X?.id,actorId:ee.id,kind:t,input:h(m),lockKey:X?`resource:${X.id}`:`runtime:${R.id}`,providerKey:R.provider,maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!Y.claim(oe.id))throw Error(`Workload is locked by another operation. Inspect ${oe.id} with cloud ops:show.`);try{let se=await I();if(se.stdout)Y.appendLog(oe.id,se.stdout,{stream:"stdout"});if(se.stderr)Y.appendLog(oe.id,se.stderr,{stream:"stderr"});if(se.ok)Y.complete(oe.id,{ok:!0,command:se.command??null});else Y.fail(oe.id,se.error??se.stderr??"Runtime operation failed",{ok:!1});return{result:se,operationId:oe.id}}catch(se){throw Y.fail(oe.id,se instanceof Error?se.message:String(se),{ok:!1,threw:!0}),se}}finally{z.store.close()}}function _l(R){R.command("runtime:list","List services, containers, ECS tasks, and Lambda functions").option("--env <environment>","Target environment").option("--provider <provider>","Filter systemd, docker, ecs, or lambda").option("--status <status>","Filter normalized runtime status").option("--search <query>","Search names, IDs, services, and tags").option("--json","Print normalized JSON").action(async(t)=>{try{let{service:m}=await co(t.env),k=Lh(await m.inventory(),t);if(t.json)e(JSON.stringify(k,null,2));else{c(["ID","Name","Provider","Kind","Status","Replicas","Image / runtime","Memory","Age"],Oh(k.workloads));for(let I of k.sources.filter((L)=>L.status!=="fresh"))a(`${I.id}: ${I.status}${I.message?` — ${I.message}`:""}`)}}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}}),R.command("runtime:inspect <workload>","Inspect normalized config, replicas, networks, mounts, links, and capabilities").option("--env <environment>","Target environment").action(async(t,m)=>{try{let{service:k}=await co(m.env),I=await k.workload(t);if(!I)throw Error("Workload was not found in this project and environment");e(JSON.stringify(I,null,2))}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}}),R.command("runtime:logs <workload>","Read bounded logs for one authorized runtime target").option("--env <environment>","Target environment").option("--lines <count>","Maximum log lines",{default:"200"}).option("--json","Print structured JSON").action(async(t,m)=>{try{let{service:k}=await co(m.env),I=await k.logs(t,{limit:Number(m.lines)||200});if(m.json)e(JSON.stringify(I,null,2));else for(let L of I.lines)console.log(`${L.timestamp??"—"} ${L.message}`)}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}}),R.command("runtime:action <workload> <action>","Start, stop, restart, redeploy, or scale one workload").option("--env <environment>","Target environment").option("--replicas <count>","Desired replicas for scale").option("--confirm <name>","Exact workload name confirmation").action(async(t,m,k)=>{try{let I=m;if(!["start","stop","restart","redeploy","scale"].includes(I))throw Error("Action must be start, stop, restart, redeploy, or scale");let L=k.replicas==null?void 0:Number(k.replicas);if(I==="scale"&&(!Number.isInteger(L)||L<0))throw Error("Scale requires a non-negative integer --replicas value");let{env:z,service:Y}=await co(k.env),Z=await Y.inventory(),X=Z.workloads.find((se)=>se.id===t);if(!X)throw Error("Workload was not found in this project and environment");let ee=new Te(await De(),z,{inventory:async()=>Z}),oe=await Fh(X,I,L,await Sa(X,k.confirm),z,ee);if(!oe.result.ok)throw Error(oe.result.error??oe.result.stderr??"Runtime operation failed");if(n(`${I} completed for ${X.name} · operation ${oe.operationId}`),oe.result.stdout)e(oe.result.stdout)}catch(I){r(I instanceof Error?I.message:String(I)),process.exitCode=1}}),R.command("runtime:exec <workload>","Run a scoped diagnostic preset or container command").option("--env <environment>","Target environment").option("--preset <preset>","Read-only preset: process, sockets, or filesystem").option("--command <command>","Free-form command (Docker containers only)").option("--confirm <name>","Exact workload name confirmation").action(async(t,m)=>{try{let{env:k,service:I}=await co(m.env),z=(await I.inventory()).workloads.find((ee)=>ee.id===t);if(!z)throw Error("Workload was not found in this project and environment");let Y=["process","sockets","filesystem"].includes(String(m.preset))?m.preset:void 0;if(m.preset&&!Y)throw Error("Preset must be process, sockets, or filesystem");if(!Y&&!m.command)throw Error("Pass --preset or --command");let Z=await Sa(z,m.confirm),X=await Ca(z,"runtime.exec",{workloadId:t,provider:z.provider,preset:Y??null,freeForm:!!m.command},k,()=>I.exec({workloadId:t,preset:Y,command:m.command,confirm:Z,recentAuth:!0}));if(!X.result.ok)throw Error(X.result.error??X.result.stderr??"Exec failed");if(X.result.stdout)e(X.result.stdout);if(X.result.stderr)a(X.result.stderr);n(`Exec completed for ${z.name} · operation ${X.operationId}`)}catch(k){r(k instanceof Error?k.message:String(k)),process.exitCode=1}}),R.command("runtime:download <workload> <remote> <local>","Download a bounded file from a service-owned path").option("--env <environment>","Target environment").option("--confirm <name>","Exact workload name confirmation").action(async(t,m,k,I)=>{try{let{env:L,service:z}=await co(I.env),Z=(await z.inventory()).workloads.find((oe)=>oe.id===t);if(!Z)throw Error("Workload was not found in this project and environment");let X=await Sa(Z,I.confirm),ee=await Ca(Z,"runtime.file.read",{workloadId:t,provider:Z.provider,path:m},L,()=>z.readFile({workloadId:t,path:m,confirm:X,recentAuth:!0}));if(!ee.result.ok||!ee.result.contentBase64)throw Error(ee.result.error??"File download failed");await Eh(k,Buffer.from(ee.result.contentBase64,"base64")),n(`Downloaded ${ee.result.size??0} bytes to ${k} · operation ${ee.operationId}${ee.result.truncated?" (truncated)":""}`)}catch(L){r(L instanceof Error?L.message:String(L)),process.exitCode=1}}),R.command("runtime:upload <workload> <local> <remote>","Upload and atomically replace a file in a service-owned path").option("--env <environment>","Target environment").option("--confirm <name>","Exact workload name confirmation").action(async(t,m,k,I)=>{try{let{env:L,service:z}=await co(I.env),Z=(await z.inventory()).workloads.find((se)=>se.id===t);if(!Z)throw Error("Workload was not found in this project and environment");let X=await Sa(Z,I.confirm),ee=(await Dh(m)).toString("base64"),oe=await Ca(Z,"runtime.file.write",{workloadId:t,provider:Z.provider,path:k,bytes:Buffer.from(ee,"base64").byteLength},L,()=>z.writeFile({workloadId:t,path:k,contentBase64:ee,confirm:X,recentAuth:!0}));if(!oe.result.ok)throw Error(oe.result.error??"File upload failed");n(`Uploaded ${oe.result.size??0} bytes to ${k} · operation ${oe.operationId}`)}catch(L){r(L instanceof Error?L.message:String(L)),process.exitCode=1}})}function jh(R,t=new Date){let m=R.to?new Date(R.to):t;if(!Number.isFinite(m.getTime()))throw Error("--to must be a valid ISO-8601 instant");if(R.from){let L=new Date(R.from);if(!Number.isFinite(L.getTime()))throw Error("--from must be a valid ISO-8601 instant");return{from:L.toISOString(),to:m.toISOString()}}let k=String(R.range??"1h").match(/^(\d+)(m|h|d)$/);if(!k)throw Error("--range must use minutes, hours, or days (for example 30m, 6h, or 7d)");let I=k[2]==="m"?60000:k[2]==="h"?3600000:86400000;return{from:new Date(m.getTime()-Number(k[1])*I).toISOString(),to:m.toISOString()}}async function As(R){let t=await De(),m=R??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let k=y(process.cwd(),t),I=k.environments.get(m),L=new Ze(k.store);return{config:t,env:m,controlPlane:k,environmentRecord:I,telemetry:L}}function Lu(R,t,m){let k=(L)=>L?.split(",").map((z)=>z.trim()).filter(Boolean)||void 0,I=k(R.kind)?.filter((L)=>["metric","log","trace","request","event"].includes(L));return{projectId:t,environmentId:m,...jh(R),kinds:I,names:k(R.name),sources:k(R.source),text:R.text,limit:Math.min(5000,Math.max(1,Number(R.limit)||200))}}function Bh(R){let t=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"];return[t.join(","),...R.map((m)=>t.map((k)=>`"${String(m[k]??"").replaceAll('"','""')}"`).join(","))].join(`
+`)}function Ml(R){R.command("telemetry:collect","Collect normalized host/runtime or AWS telemetry into the local control plane").option("--env <environment>","Target environment").option("--force","Bypass the provider-query cache").option("--json","Print structured JSON").action(async(t)=>{let m=await As(t.env);try{let k=await gi({controlPlane:m.controlPlane.store,projectId:m.controlPlane.project.id,environmentId:m.environmentRecord?.id,config:m.config,environment:m.env,force:t.force});if(t.json)e(JSON.stringify(k,null,2));else n(`Collected ${k.collected} normalized records${k.cached?" (cached provider result)":""}.`),c(["Source","Freshness","Lag","Sampling","Retention"],k.statuses.map((I)=>[I.source,I.freshness,I.lagSeconds==null?"—":`${I.lagSeconds}s`,`${Math.round(I.samplingRate*100)}%`,`${I.retentionDays}d`]))}finally{m.controlPlane.store.close()}}),R.command("telemetry:query","Query bounded normalized metrics, logs, traces, requests, and events").option("--env <environment>","Target environment").option("--from <instant>","ISO-8601 start").option("--to <instant>","ISO-8601 end").option("--range <duration>","Relative window such as 1h or 7d",{default:"1h"}).option("--kind <kinds>","Comma-separated kinds").option("--name <names>","Comma-separated signal names").option("--source <sources>","Comma-separated sources").option("--text <query>","Search name/message").option("--limit <count>","Maximum records",{default:"200"}).option("--json","Print structured JSON").action(async(t)=>{let m=await As(t.env);try{let k=m.telemetry.query(Lu(t,m.controlPlane.project.id,m.environmentRecord?.id));if(t.json)e(JSON.stringify(k,null,2));else c(["Time","Kind","Source","Signal","Value / message","Correlation"],k.records.map((I)=>[I.timestamp,I.kind,I.source,I.name,I.message??(I.value==null?"—":`${I.value} ${I.unit??""}`),I.requestId??I.traceId??I.releaseId??I.deploymentId??"—"]));if(k.truncated)a("More records are available; narrow the window or use the dashboard cursor explorer.")}finally{m.controlPlane.store.close()}}),R.command("telemetry:export <file>","Export a bounded telemetry query as JSON or CSV").option("--env <environment>","Target environment").option("--from <instant>","ISO-8601 start").option("--to <instant>","ISO-8601 end").option("--range <duration>","Relative window",{default:"1h"}).option("--kind <kinds>","Comma-separated kinds").option("--name <names>","Comma-separated signal names").option("--source <sources>","Comma-separated sources").option("--text <query>","Search name/message").option("--limit <count>","Maximum records",{default:"5000"}).action(async(t,m)=>{let k=await As(m.env);try{let I=Lu(m,k.controlPlane.project.id,k.environmentRecord?.id),L=k.telemetry.query(I);await Bun.write(t,t.toLowerCase().endsWith(".csv")?Bh(L.records):JSON.stringify({exportedAt:new Date().toISOString(),query:I,...L},null,2)),n(`Exported ${L.records.length} records to ${t}${L.truncated?" (bounded result)":""}.`)}finally{k.controlPlane.store.close()}}),R.command("telemetry:compact","Downsample old metrics and enforce configured retention").option("--env <environment>","Target environment").action(async(t)=>{let m=await As(t.env);try{let k=Ye(m.controlPlane.store,m.controlPlane.project.id);e(JSON.stringify(m.telemetry.enforceRetention(k,m.controlPlane.project.id),null,2))}finally{m.controlPlane.store.close()}}),R.command("telemetry:policy","Show or update sampling, retention, and local storage cost assumptions").option("--env <environment>","Target environment").option("--raw-days <days>","Raw retention days").option("--downsample-days <days>","Downsample after days").option("--sampling <rate>","Sampling rate from 0.01 to 1").option("--storage-usd-gb-month <amount>","Local storage cost assumption").option("--json","Print structured JSON").action(async(t)=>{let m=await As(t.env);try{let k={};if(t.rawDays!=null)k.rawDays=Number(t.rawDays);if(t.downsampleDays!=null)k.downsampleAfterDays=Number(t.downsampleDays);if(t.sampling!=null)k.samplingRate=Number(t.sampling);if(t.storageUsdGbMonth!=null)k.estimatedStorageUsdPerGbMonth=Number(t.storageUsdGbMonth);let I=Object.keys(k).length?bi(m.controlPlane.store,m.controlPlane.project.id,k):Ye(m.controlPlane.store,m.controlPlane.project.id),z=m.telemetry.status(m.controlPlane.project.id,m.environmentRecord?.id,I.rawDays,I.samplingRate).reduce((Z,X)=>Z+X.estimatedDailyBytes*30,0),Y={policy:I,estimatedMonthlyBytes:z,estimatedMonthlyCostUsd:Si(z,I),costEstimateConfigured:I.estimatedStorageUsdPerGbMonth>0};if(t.json)e(JSON.stringify(Y,null,2));else e(JSON.stringify(I,null,2)),e(Y.costEstimateConfigured?`Estimated local storage: $${Y.estimatedMonthlyCostUsd}/month`:"Storage cost remains unavailable until --storage-usd-gb-month is set.")}finally{m.controlPlane.store.close()}})}async function Ji(R){let t=await De(),m=R??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let k=y(process.cwd(),t),I=k.environments.get(m),L=new bt(k.store,{encryptionKey:_(process.cwd())});return{config:t,env:m,controlPlane:k,environmentRecord:I,alerts:L}}function Fu(R){return new br(R,{emailImpl:async(t)=>{let{email:m}=await import("./chunk-0rvzy2z7.js");return m.send(t)}})}function zl(R){R.command("health:list","List configured health checks and latest results").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{let m=await Ji(t.env);try{let k=m.alerts.listHealthChecks(m.controlPlane.project.id,m.environmentRecord?.id).map((I)=>({...I,latest:m.alerts.listHealthResults(I.id,1)[0]}));if(t.json)e(JSON.stringify(k,null,2));else c(["ID","Name","Kind","Target","Status","Interval","Enabled"],k.map((I)=>[I.id,I.name,I.kind,I.target,I.latest?.status??"no data",`${I.intervalSeconds}s`,I.enabled?"yes":"no"]))}finally{m.controlPlane.store.close()}}),R.command("health:run <check>","Run one health check and evaluate linked alert rules").option("--env <environment>","Target environment").option("--test","Preview without persisting results or incidents").action(async(t,m)=>{let k=await Ji(m.env);try{let I=k.alerts.getHealthCheck(t)??k.alerts.listHealthChecks(k.controlPlane.project.id,k.environmentRecord?.id).find((Y)=>Y.name===t);if(!I)throw Error("Health check was not found");let L=new Ve(k.alerts);if(m.test){let Y=await L.probe(I);e(JSON.stringify({...Y,productionIncidentCreated:!1},null,2));return}let z=await L.runAndEvaluate(I);if(e(JSON.stringify(z,null,2)),z.result.status==="healthy")n(`${I.name} is healthy.`);else a(`${I.name} is ${z.result.status}.`)}finally{k.controlPlane.store.close()}}),R.command("alerts:list","List pending, firing, silenced, and resolved alerts").option("--env <environment>","Target environment").option("--state <states>","Comma-separated states").option("--json","Print structured JSON").action(async(t)=>{let m=await Ji(t.env);try{let k=m.alerts.listAlerts(m.controlPlane.project.id,{environmentId:m.environmentRecord?.id,states:t.state?.split(",").filter(Boolean)});if(t.json)e(JSON.stringify(k,null,2));else c(["ID","State","Severity","Title","Owner","First seen","Last seen"],k.map((I)=>[I.id,I.state,I.severity,I.title,I.ownerActorId??"unassigned",I.firstSeenAt,I.lastSeenAt]))}finally{m.controlPlane.store.close()}}),R.command("alerts:evaluate","Evaluate persisted telemetry rules now").option("--env <environment>","Target environment").action(async(t)=>{let m=await Ji(t.env);try{let k=sn(m.alerts,m.controlPlane.project.id,m.environmentRecord?.id);e(JSON.stringify(k,null,2))}finally{m.controlPlane.store.close()}}),R.command("alerts:ack <alert>","Acknowledge an alert as the CLI actor").option("--env <environment>","Target environment").action(async(t,m)=>{let k=await Ji(m.env);try{let I=k.controlPlane.store.getActorByExternalId("system","cli")??k.controlPlane.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});n(`Acknowledged ${k.alerts.acknowledge(t,I.id).title}.`)}finally{k.controlPlane.store.close()}}),R.command("notifications:list","List notification channels, routes, and recent delivery diagnostics").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{let m=await Ji(t.env);try{let k={channels:m.alerts.listChannels(m.controlPlane.organization.id),routes:m.alerts.listRoutes(m.controlPlane.organization.id),deliveries:m.alerts.listDeliveries({limit:100})};if(t.json)e(JSON.stringify(k,null,2));else c(["Channel","Type","Status","Tested","Error"],k.channels.map((I)=>[I.name,I.kind,I.status,I.lastTestedAt??"never",I.lastError??"—"])),c(["Event","State","Attempts","Status","Error"],k.deliveries.map((I)=>[I.eventType,I.state,`${I.attempt}/${I.maxAttempts}`,String(I.responseStatus??"—"),I.error??"—"]))}finally{m.controlPlane.store.close()}}),R.command("notifications:test <channel>","Send a channel test without creating a production incident").option("--env <environment>","Target environment").action(async(t,m)=>{let k=await Ji(m.env);try{let I=k.alerts.getChannel(t)??k.alerts.listChannels(k.controlPlane.organization.id).find((z)=>z.name===t);if(!I)throw Error("Notification channel was not found");let L=await Fu(k.alerts).testChannel(I.id);if(L.ok)n("Test delivered; no production incident was created.");else throw Error(L.error)}finally{k.controlPlane.store.close()}}),R.command("notifications:retry <delivery>","Retry one failed notification delivery").option("--env <environment>","Target environment").action(async(t,m)=>{let k=await Ji(m.env);try{let I=k.alerts.getDelivery(t);if(!I)throw Error("Notification delivery was not found");k.alerts.updateDelivery(t,{state:"retrying",attempt:Math.max(0,I.attempt-1),nextAttemptAt:new Date().toISOString()}),e(JSON.stringify(await Fu(k.alerts).deliver(t),null,2))}finally{k.controlPlane.store.close()}})}async function _h(R,t){let m=await De(),k=y(process.cwd(),m),I=!R&&t?new tn(k.store).get(t):void 0,L=I?.environmentId?k.store.listEnvironments(k.project.id).find((ue)=>ue.id===I.environmentId)?.slug:void 0,z=R??L??Object.keys(m.environments??{})[0]??"production";if(!Object.hasOwn(m.environments??{},z))throw k.store.close(),Error(`Environment ${z} was not found`);let Y=k.environments.get(z);if(!Y)throw k.store.close(),Error(`Environment ${z} was not found in the control plane`);let Z=new tn(k.store),X=new S(k.store,{workerId:`cli:${process.pid}`}),ee=new ui(Z,{queue:X}),oe=k.store.listResources(k.project.id,Y.id);en(Z,m,{organization:k.organization,project:k.project,environment:Y,resources:oe});let se=k.store.getActorByExternalId("system","cli")??k.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});return{config:m,env:z,controlPlane:k,environmentRecord:Y,resources:oe,store:Z,queue:X,service:ee,actor:se}}async function jr(R,t,m){let k=await _h(R,m);try{return await t(k)}finally{k.controlPlane.store.close()}}async function On(R){try{await R()}catch(t){r(t instanceof Error?t.message:String(t))}}function _o(R,t){let m=R.store.list(R.controlPlane.project.id,{environmentId:R.environmentRecord.id}),k=R.store.get(t)??m.find((I)=>I.name===t);if(!k||k.environmentId!==R.environmentRecord.id)throw Error(`Scheduled job ${t} was not found in ${R.env}`);return k}function uo(R,t,m,k){R.controlPlane.store.appendEvent({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,resourceId:k,actorId:R.actor.id,type:`job.${t}`,payload:m})}function ju(R,t,m){if(R.environmentRecord.kind==="production"&&m!==t)throw Error(`Production ${t} requires --confirm ${t}`)}function Mh(R){if(!R)return{};if(!/^(?:secret|ssm|arn|env):\/\//.test(R))throw Error("Payloads must use a secret://, ssm://, arn://, or env:// reference");return{input:R}}function zh(R){return R.map((t)=>[t.id,t.enabled?"enabled":"disabled",t.provider,t.name,t.expression,t.timezone,t.nextRunAt??"—",t.reconciliationStatus])}function Ul(R){R.command("jobs:list","List server cron, EventBridge, and recurring control-plane jobs").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>On(async()=>jr(t.env,async(m)=>{let k=m.store.list(m.controlPlane.project.id,{environmentId:m.environmentRecord.id});if(t.json)e(JSON.stringify(k,null,2));else c(["ID","State","Provider","Name","Expression","Timezone","Next run","Reconciliation"],zh(k))}))),R.command("jobs:preview <expression>","Preview the next runs without creating production work").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--from <date>","Preview from an ISO timestamp").option("--count <count>","Number of runs",{default:"5"}).action(async(t,m)=>On(async()=>{let k=ft(t,m.timezone??"UTC",m.from?new Date(m.from):new Date,Number(m.count)||5);e(JSON.stringify({...k,productionExecutionCreated:!1},null,2))})),R.command("jobs:add <name> <expression>","Create a managed recurring job").option("--env <environment>","Target environment").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--operation <id>","Safe server operation target (scheduler, backup, or worker)").option("--resource <id>","Resource ID or slug").option("--starts-at <date>","Schedule window start").option("--ends-at <date>","Schedule window end").option("--flexible-minutes <count>","Provider flexible window",{default:"0"}).option("--missed <policy>","skip or catch_up",{default:"skip"}).option("--overlap <policy>","allow, forbid, or replace",{default:"forbid"}).option("--attempts <count>","Maximum attempts",{default:"3"}).option("--backoff <seconds>","Retry backoff seconds",{default:"30"}).option("--timeout <seconds>","Execution timeout",{default:"900"}).option("--dead-letter <reference>","Dead-letter ARN or secret reference").option("--payload-ref <reference>","Referenced payload; inline values are forbidden").option("--disabled","Create disabled").action(async(t,m,k)=>On(async()=>jr(k.env,async(I)=>{if(!["skip","catch_up"].includes(k.missed??"skip"))throw Error("--missed must be skip or catch_up");if(!["allow","forbid","replace"].includes(k.overlap??"forbid"))throw Error("--overlap must be allow, forbid, or replace");let L=H(I.config),Y={workers:I.store.listWorkers(I.controlPlane.project.id,I.environmentRecord.id).map((ue)=>({name:ue.name}))},Z;if(L==="server"){let ue=Qr(I.config,Y).filter((ce)=>!ce.danger&&["scheduler","backup","worker"].includes(ce.group)),ke=k.operation?ue.find((ce)=>ce.id===k.operation):ue.length===1?ue[0]:void 0;if(!ke)throw Error(`Choose a safe target with --operation. Available: ${ue.map((ce)=>ce.id).join(", ")||"none"}`);Z={kind:"dashboard_operation",operationId:ke.id}}else Z={kind:"serverless_scheduler",action:"run"};let X=L==="server"?"server":"eventbridge",ee=di({provider:X,expression:m,flexibleMinutes:Number(k.flexibleMinutes)||0,missedRunPolicy:k.missed??"skip",overlapPolicy:k.overlap??"forbid"});if(!ee.supported)throw Error(ee.notes.join(" "));let oe=k.resource?I.resources.find((ue)=>ue.id===k.resource||ue.slug===k.resource):void 0;if(k.resource&&!oe)throw Error(`Resource ${k.resource} was not found in ${I.env}`);let se=I.store.create({organizationId:I.controlPlane.organization.id,projectId:I.controlPlane.project.id,environmentId:I.environmentRecord.id,resourceId:oe?.id,name:t,provider:X,expression:m,timezone:k.timezone??"UTC",startsAt:k.startsAt,endsAt:k.endsAt,flexibleMinutes:Number(k.flexibleMinutes)||0,target:Z,payloadRefs:Mh(k.payloadRef),missedRunPolicy:k.missed??"skip",overlapPolicy:k.overlap??"forbid",retryPolicy:{maxAttempts:Number(k.attempts)||3,backoffSeconds:Number(k.backoff)||30,deadLetterRef:k.deadLetter},timeoutSeconds:Number(k.timeout)||900,enabled:!k.disabled,origin:"managed",ownerActorId:I.actor.id,observedState:{},reconciliationStatus:"pending"});uo(I,"created",{jobId:se.id,provider:se.provider,expression:se.normalizedExpression},se.resourceId),n(`Created ${se.name} (${se.id}); next run ${se.nextRunAt??"outside the active window"}`)}))),R.command("jobs:update <job>","Update a managed job schedule and policies").option("--env <environment>","Target environment").option("--expression <expression>","Cron, preset, or rate expression").option("--timezone <timezone>","IANA timezone").option("--missed <policy>","skip or catch_up").option("--overlap <policy>","allow, forbid, or replace").option("--timeout <seconds>","Execution timeout").action(async(t,m)=>On(async()=>jr(m.env,async(k)=>{let I=_o(k,t);if(I.origin==="config")throw Error("Config-defined schedules must be edited in cloud.config.ts and reconciled");if(m.missed&&!["skip","catch_up"].includes(m.missed))throw Error("--missed must be skip or catch_up");if(m.overlap&&!["allow","forbid","replace"].includes(m.overlap))throw Error("--overlap must be allow, forbid, or replace");let L=k.store.updateSchedule(I.id,{expression:m.expression,timezone:m.timezone,missedRunPolicy:m.missed,overlapPolicy:m.overlap,timeoutSeconds:m.timeout==null?void 0:Number(m.timeout)});uo(k,"updated",{jobId:L.id,expression:L.normalizedExpression,version:L.version},L.resourceId),n(`Updated ${L.name}; next run ${L.nextRunAt??"outside the active window"}`)}))),R.command("jobs:run <job>","Queue a manual run through the durable operation worker").option("--env <environment>","Target environment").action(async(t,m)=>On(async()=>jr(m.env,async(k)=>{let I=_o(k,t),L=k.service.enqueue(I,{trigger:"manual",actorId:k.actor.id});uo(k,"run_queued",{jobId:I.id,executionId:L.id},I.resourceId),n(`Queued execution ${L.id}; inspect it with cloud jobs:history "${I.name}"`)}))),R.command("jobs:dispatch <job>","Dispatch an externally triggered schedule into the durable queue").option("--env <environment>","Target environment").option("--scheduled-for <date>","Provider scheduled timestamp").option("--scheduled","Mark this as a provider schedule trigger").action(async(t,m)=>On(async()=>jr(m.env,async(k)=>{let I=_o(k,t);if(!I.enabled)throw Error(`${I.name} is disabled`);let L=m.scheduledFor?new Date(m.scheduledFor):new Date;if(!m.scheduledFor)L.setUTCSeconds(0,0);let z=L.toISOString(),Y=k.service.enqueue(I,{trigger:m.scheduled?"scheduled":"external",scheduledFor:z,actorId:k.actor.id}),Z=gt(I.normalizedExpression,I.timezone,L,1)[0];k.store.markScheduled(I.id,z,Z),n(`Accepted ${I.name} for ${z} as ${Y.id}`)},t)));for(let t of["enable","disable"])R.command(`jobs:${t} <job>`,`${t==="enable"?"Enable":"Disable"} a scheduled job`).option("--env <environment>","Target environment").option("--confirm <text>",`Production ${t} confirmation`).action(async(m,k)=>On(async()=>jr(k.env,async(I)=>{let L=_o(I,m);if(t==="disable")ju(I,t,k.confirm);let z=I.store.setEnabled(L.id,t==="enable");uo(I,t==="enable"?"enabled":"disabled",{jobId:z.id},z.resourceId),n(`${z.name} is ${z.enabled?"enabled":"disabled"}`)})));R.command("jobs:delete <job>","Delete a managed schedule").option("--env <environment>","Target environment").option("--confirm <text>","Must be delete in production").action(async(t,m)=>On(async()=>jr(m.env,async(k)=>{let I=_o(k,t);ju(k,"delete",m.confirm),k.store.remove(I.id),uo(k,"deleted",{jobId:I.id,name:I.name},I.resourceId),n(`Deleted ${I.name}`)}))),R.command("jobs:history <job>","Show execution attempts, output, errors, and redacted logs").option("--env <environment>","Target environment").option("--limit <count>","Maximum executions",{default:"100"}).option("--logs","Print execution logs").option("--json","Print structured JSON").action(async(t,m)=>On(async()=>jr(m.env,async(k)=>{let I=_o(k,t),L=k.store.listExecutions(I.id,Number(m.limit)||100).map((z)=>({...z,logs:m.logs&&z.operationId?k.queue.logs(z.operationId,{limit:500}):[]}));if(m.json)e(JSON.stringify(L,null,2));else if(c(["ID","Status","Trigger","Scheduled for","Attempt","Started","Finished","Error"],L.map((z)=>[z.id,z.status,z.trigger,z.scheduledFor,String(z.attempt),z.startedAt??"—",z.finishedAt??"—",z.error??"—"])),m.logs)for(let z of L)for(let Y of z.logs)e(`${z.id} ${Y.sequence} ${Y.stream.toUpperCase()} ${Y.message}`)}))),R.command("jobs:reconcile","Import declarative schedules and workers without destructive deletion").option("--env <environment>","Target environment").action(async(t)=>On(async()=>jr(t.env,async(m)=>{let k=en(m.store,m.config,{organization:m.controlPlane.organization,project:m.controlPlane.project,environment:m.environmentRecord,resources:m.resources});uo(m,"reconciled",k),n(`Reconciled ${k.jobs} schedules and ${k.workers} workers; retained ${k.drifted} missing definitions as drifted`)}))),R.command("workers:list","List configured systemd, ECS, and Lambda workers").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>On(async()=>jr(t.env,async(m)=>{let k=m.store.listWorkers(m.controlPlane.project.id,m.environmentRecord.id);if(t.json)e(JSON.stringify(k,null,2));else c(["ID","Provider","Name","Queue","Processes","Timeout","Restart","Reconciliation"],k.map((I)=>[I.id,I.provider,I.name,I.queue,String(I.processes),`${I.timeoutSeconds}s`,I.restartPolicy,I.reconciliationStatus]))}))),R.command("workers:restart <worker>","Gracefully restart an allowlisted systemd worker").option("--env <environment>","Target environment").option("--confirm <name>","Exact worker name confirmation").action(async(t,m)=>On(async()=>jr(m.env,async(k)=>{let I=k.store.listWorkers(k.controlPlane.project.id,k.environmentRecord.id),L=k.store.getWorker(t)??I.find((Z)=>Z.name===t);if(!L||L.environmentId!==k.environmentRecord.id)throw Error(`Worker ${t} was not found in ${k.env}`);if(m.confirm!==L.name)throw Error(`Restart requires --confirm "${L.name}"`);if(L.provider!=="systemd")throw Error(`${L.provider} workers are provider/config managed and do not expose a safe restart adapter`);let z=ci(String(L.target.operationId??""),k.config,{workers:I.map((Z)=>({name:Z.name}))});if(!z||z.danger||z.group!=="worker")throw Error("The allowlisted worker restart operation is unavailable");let Y=await Yr(k.config,k.env,z);if(k.store.reconcileWorker(L.id,Y.ok?"in_sync":"unavailable",{...L.observedState,lastRestartAt:new Date().toISOString(),command:Y.command??null,error:Y.error??Y.stderr??null}),uo(k,"worker_restarted",{workerId:L.id,ok:Y.ok},L.resourceId),!Y.ok)throw Error(Y.error??Y.stderr??"Worker restart failed");n(`Restarted ${L.name}`)})))}function Wl(R){R.command("tunnel","Start a local tunnel to expose your local server").option("--port <number>","Local port to expose",{default:"3000"}).option("--subdomain <name>","Custom subdomain (if available)").option("--host <hostname>","Local hostname",{default:"localhost"}).option("--server <url>","Tunnel server URL",{default:"localtunnel.dev"}).option("--verbose","Enable verbose logging").action(async(t)=>{i("Local Tunnel");let m=Number.parseInt(t.port);if(e(`Local server: ${t.host}:${m}`),e(`Tunnel server: ${t.server}`),t.subdomain)e(`Requested subdomain: ${t.subdomain}`);let k=new s("Connecting to tunnel server...");k.start();try{let I;try{let X=await import("localtunnels");I=X.TunnelClient}catch{k.fail("localtunnels package not found"),e(`
 To use tunnels, install the localtunnels package:`),e("  bun add localtunnels"),e(`
 Or use the standalone CLI:`),e("  bunx localtunnels --port 3000");return}let L=t.server.replace(/^(wss?|https?):\/\//,""),z=t.server.startsWith("wss://")||t.server.startsWith("https://")||L==="localtunnel.dev",Y=new I({localPort:m,localHost:t.host,subdomain:t.subdomain,host:L,port:z?443:80,secure:z,verbose:t.verbose});Y.on("connected",(X)=>{k.succeed("Connected!"),n(`
 Your tunnel URL: ${X.url}`),e(`Subdomain: ${X.subdomain}`),e(`
@@ -671,4 +671,4 @@ Response headers:`),I.headers.forEach((Y,Z)=>{e(`  ${Z}: ${Y}`)});let z=await I.
 Response body (first 500 chars):`),console.log(z.substring(0,500)),z.length>500)e(`... (${z.length-500} more characters)`)}}catch(k){m.fail("Connection failed"),r(`Error: ${k.message}`)}}),R.command("tunnel:server","Start a self-hosted tunnel server").option("--port <number>","Port to listen on",{default:"3000"}).option("--host <hostname>","Host to bind to",{default:"0.0.0.0"}).option("--domain <domain>","Domain for tunnel URLs",{default:"localhost"}).option("--verbose","Enable verbose logging").action(async(t)=>{i("Local Tunnel Server");let m=Number.parseInt(t.port);e(`Listening on: ${t.host}:${m}`),e(`Domain: ${t.domain}`),e("");let k=new s("Starting tunnel server...");k.start();try{let I;try{let Y=await import("localtunnels");I=Y.TunnelServer}catch{k.fail("localtunnels package not found"),e(`
 To run a tunnel server, install localtunnels:`),e("  bun add localtunnels"),e(`
 Or use the standalone CLI:`),e("  bunx localtunnels server --port 3000");return}let L=new I({port:m,host:t.host,verbose:t.verbose});L.on("connection",(Y)=>{e(`+ Client connected: ${Y.subdomain} (total: ${Y.totalConnections})`)}),L.on("disconnection",(Y)=>{e(`- Client disconnected: ${Y.subdomain}`)});let z=()=>{e(`
-Shutting down server...`),L.stop(),process.exit(0)};process.on("SIGINT",z),process.on("SIGTERM",z),await L.start(),k.succeed("Server running!"),e(""),e(`WebSocket URL: ws://${t.host==="0.0.0.0"?"localhost":t.host}:${m}`),e(`HTTP URL: http://${t.host==="0.0.0.0"?"localhost":t.host}:${m}`),e(""),e("Clients can connect with:"),e(`  cloud tunnel --port 3000 --server ${t.host==="0.0.0.0"?"localhost":t.host}:${m}`),e(""),e("Press Ctrl+C to stop the server"),await new Promise(()=>{})}catch(I){k.fail("Failed to start server"),r(`Error: ${I.message}`),process.exit(1)}})}var kt=new za("cloud");kt.option("--env <environment>","Environment (production, staging, development)").option("--region <region>","AWS Region").option("--profile <profile>","AWS CLI Profile").option("--verbose","Enable verbose logging").option("--dry-run","Show what would be done without making changes");pc(kt);Va(kt);Ha(kt);Ka(kt);Ya(kt);ul(kt);fl(kt);gl(kt);hl(kt);yl(kt);ec(kt);nc(kt);rc(kt);ic(kt);oc(kt);ac(kt);cc(kt);Cl(kt);$l(kt);kl(kt);Al(kt);Rl(kt);Il(kt);lc(kt);Cc(kt);mc(kt);Ol(kt);Pl(kt);xl(kt);Dl(kt);El(kt);vc(kt);wc(kt);Tl(kt);Nl(kt);Ll(kt);Fl(kt);jl(kt);Bl(kt);_l(kt);Ml(kt);zl(kt);Ul(kt);Pc(kt);Dc(kt);xc(kt);Tc(kt);Nc(kt);Lc(kt);Bc(kt);Mc(kt);Uc(kt);qc(kt);bl(kt);Wl(kt);wl(kt);vl(kt,Ua);kt.version(Ua);kt.help();kt.parse(void 0,{run:!1}).then(({options:R})=>(td(R,kt.matchedCommand),kt.runMatchedCommand()));
+Shutting down server...`),L.stop(),process.exit(0)};process.on("SIGINT",z),process.on("SIGTERM",z),await L.start(),k.succeed("Server running!"),e(""),e(`WebSocket URL: ws://${t.host==="0.0.0.0"?"localhost":t.host}:${m}`),e(`HTTP URL: http://${t.host==="0.0.0.0"?"localhost":t.host}:${m}`),e(""),e("Clients can connect with:"),e(`  cloud tunnel --port 3000 --server ${t.host==="0.0.0.0"?"localhost":t.host}:${m}`),e(""),e("Press Ctrl+C to stop the server"),await new Promise(()=>{})}catch(I){k.fail("Failed to start server"),r(`Error: ${I.message}`),process.exit(1)}})}var st=new za("cloud");st.option("--env <environment>","Environment (production, staging, development)").option("--region <region>","AWS Region").option("--profile <profile>","AWS CLI Profile").option("--verbose","Enable verbose logging").option("--dry-run","Show what would be done without making changes");pc(st);Va(st);Ha(st);Ka(st);Ya(st);ul(st);fl(st);gl(st);hl(st);yl(st);ec(st);nc(st);rc(st);ic(st);oc(st);ac(st);cc(st);Cl(st);$l(st);kl(st);Al(st);Rl(st);Il(st);lc(st);hc(st);mc(st);Ol(st);Pl(st);xl(st);Dl(st);El(st);fc(st);gc(st);Tl(st);Nl(st);Ll(st);Fl(st);jl(st);Bl(st);_l(st);Ml(st);zl(st);Ul(st);$c(st);Pc(st);kc(st);Dc(st);Nc(st);Lc(st);jc(st);_c(st);Mc(st);zc(st);bl(st);Wl(st);wl(st);vl(st,Ua);st.version(Ua);st.help();st.parse(void 0,{run:!1}).then(({options:R})=>(td(R,st.matchedCommand),st.runMatchedCommand()));