@stacksjs/ts-cloud 0.7.103 → 0.7.105

package/dist/bin/cli.js

@@ -9309,7 +9309,7 @@ Run \`${this.name??"cli"} --help\` for usage.`;eR.stderr.write(`${t}${d}${R}
 `).length-1;this.output.write(Ct.move(-999,E*-1))}render(){let E=rj(this._render(this)??"",Tj.stdout.columns,{hard:!0,trim:!1});if(E===this._prevFrame)return;if(this.state==="initial")this.output.write(Ct.hide);else{let _=kM(this._prevFrame,E);if(this.restoreCursor(),_&&_?.length===1){let T=_[0];this.output.write(Ct.move(0,T)),this.output.write(I1.lines(1));let r=E.split(`
 `);this.output.write(r[T]),this._prevFrame=E,this.output.write(Ct.move(0,r.length-T-1));return}if(_&&_?.length>1){let T=_[0];this.output.write(Ct.move(0,T)),this.output.write(I1.down());let d=E.split(`
 `).slice(T);this.output.write(d.join(`
-`)),this._prevFrame=E;return}this.output.write(I1.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function aM(E,_){if(E===void 0)return 0;if(_.length===0)return 0;let r=_.findIndex((d)=>d.value===E);return r!==-1?r:0}function mM(E,_){return(_.label??String(_.value)).toLowerCase().includes(E.toLowerCase())}function sM(E,_){if(!_)return;if(E)return _;return _[0]}class pM extends F1{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#T="";#r;#_;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return pO.inverse(pO.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[_,...T]=this.userInput.slice(this._cursor);return`${E}${pO.inverse(_)}${T.join("")}`}get options(){if(typeof this.#_==="function")return this.#_();return this.#_}constructor(E){super(E);this.#_=E.options;let _=this.options;this.filteredOptions=[..._],this.multiple=E.multiple===!0,this.#r=E.filter??mM;let T;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)T=E.initialValue;else T=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)T=[this.options[0].value];if(T)for(let r of T){let d=_.findIndex((t)=>t.value===r);if(d!==-1)this.toggleSelected(r),this.#E=d}this.focusedValue=this.options[this.#E]?.value,this.on("key",(r,d)=>this.#d(r,d)),this.on("userInput",(r)=>this.#t(r))}_isActionKey(E,_){return E==="\t"||this.multiple&&this.isNavigating&&_.name==="space"&&E!==void 0&&E!==""}#d(E,_){let T=_.name==="up",r=_.name==="down",d=_.name==="return";if(T||r){if(this.#E=Math.max(0,Math.min(this.#E+(T?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(d)this.value=sM(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(_.name==="tab"||this.isNavigating&&_.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((_)=>_!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#t(E){if(E!==this.#T){this.#T=E;let _=this.options;if(E)this.filteredOptions=_.filter((T)=>this.#r(E,T));else this.filteredOptions=[..._];if(this.#E=aM(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class oM extends F1{options;cursor=0;#E;getGroupItems(E){return this.options.filter((_)=>_.group===E)}isGroupSelected(E){let _=this.getGroupItems(E),T=this.value;if(T===void 0)return!1;return _.every((r)=>T.includes(r.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let _=String(E.value),T=this.getGroupItems(_);if(this.isGroupSelected(_))this.value=this.value.filter((r)=>T.findIndex((d)=>d.value===r)===-1);else this.value=[...this.value,...T.map((r)=>r.value)];this.value=Array.from(new Set(this.value))}else{let _=this.value.includes(E.value);this.value=_?this.value.filter((T)=>T!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:_}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(_).flatMap(([T,r])=>[{value:T,group:!0,label:T},...r.map((d)=>({...d,group:T}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:T})=>T===E.cursorAt),this.#E?0:1),this.on("cursor",(T)=>{switch(T){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var E4=NM();var P_=(E,_)=>E4?E:_,AEE=P_("◆","*"),LEE=P_("■","x"),OEE=P_("▲","x"),cEE=P_("◇","o"),UEE=P_("┌","T"),_4=P_("│","|"),$EE=P_("└","—"),DEE=P_("●",">"),CEE=P_("○"," "),IEE=P_("◻","[•]"),wEE=P_("◼","[+]"),eEE=P_("◻","[ ]"),XEE=P_("▪","•"),JEE=P_("─","-"),zEE=P_("╮","+"),FEE=P_("├","+"),jEE=P_("╯","+"),BEE=P_("●","•"),WEE=P_("◆","*"),HEE=P_("▲","!"),PEE=P_("■","x");var yEE={light:P_("─","-"),heavy:P_("━","="),block:P_("█","#")};function T4(){return`${pO.gray(_4)}  `}var YEE=T4();var j1="0.7.103";fE();import{existsSync as M1}from"node:fs";import{mkdir as c4,writeFile as Xj}from"node:fs/promises";function f1(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(_)=>{if(b("Initializing ts-cloud Project"),M1("cloud.config.ts")){if(!await DE("cloud.config.ts already exists. Overwrite?",!1)){U("Initialization cancelled");return}}let T=_?.name||await O_("Project name","my-app"),r=_?.mode||await _c("Select deployment mode",["serverless","server"]),d=_?.region||await _c("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),t=new n("Creating configuration file...");t.start();let R=`import { defineConfig } from '@ts-cloud/core'
+`)),this._prevFrame=E;return}this.output.write(I1.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function aM(E,_){if(E===void 0)return 0;if(_.length===0)return 0;let r=_.findIndex((d)=>d.value===E);return r!==-1?r:0}function mM(E,_){return(_.label??String(_.value)).toLowerCase().includes(E.toLowerCase())}function sM(E,_){if(!_)return;if(E)return _;return _[0]}class pM extends F1{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#T="";#r;#_;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return pO.inverse(pO.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[_,...T]=this.userInput.slice(this._cursor);return`${E}${pO.inverse(_)}${T.join("")}`}get options(){if(typeof this.#_==="function")return this.#_();return this.#_}constructor(E){super(E);this.#_=E.options;let _=this.options;this.filteredOptions=[..._],this.multiple=E.multiple===!0,this.#r=E.filter??mM;let T;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)T=E.initialValue;else T=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)T=[this.options[0].value];if(T)for(let r of T){let d=_.findIndex((t)=>t.value===r);if(d!==-1)this.toggleSelected(r),this.#E=d}this.focusedValue=this.options[this.#E]?.value,this.on("key",(r,d)=>this.#d(r,d)),this.on("userInput",(r)=>this.#t(r))}_isActionKey(E,_){return E==="\t"||this.multiple&&this.isNavigating&&_.name==="space"&&E!==void 0&&E!==""}#d(E,_){let T=_.name==="up",r=_.name==="down",d=_.name==="return";if(T||r){if(this.#E=Math.max(0,Math.min(this.#E+(T?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(d)this.value=sM(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(_.name==="tab"||this.isNavigating&&_.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((_)=>_!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#t(E){if(E!==this.#T){this.#T=E;let _=this.options;if(E)this.filteredOptions=_.filter((T)=>this.#r(E,T));else this.filteredOptions=[..._];if(this.#E=aM(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class oM extends F1{options;cursor=0;#E;getGroupItems(E){return this.options.filter((_)=>_.group===E)}isGroupSelected(E){let _=this.getGroupItems(E),T=this.value;if(T===void 0)return!1;return _.every((r)=>T.includes(r.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let _=String(E.value),T=this.getGroupItems(_);if(this.isGroupSelected(_))this.value=this.value.filter((r)=>T.findIndex((d)=>d.value===r)===-1);else this.value=[...this.value,...T.map((r)=>r.value)];this.value=Array.from(new Set(this.value))}else{let _=this.value.includes(E.value);this.value=_?this.value.filter((T)=>T!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:_}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(_).flatMap(([T,r])=>[{value:T,group:!0,label:T},...r.map((d)=>({...d,group:T}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:T})=>T===E.cursorAt),this.#E?0:1),this.on("cursor",(T)=>{switch(T){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var E4=NM();var P_=(E,_)=>E4?E:_,AEE=P_("◆","*"),LEE=P_("■","x"),OEE=P_("▲","x"),cEE=P_("◇","o"),UEE=P_("┌","T"),_4=P_("│","|"),$EE=P_("└","—"),DEE=P_("●",">"),CEE=P_("○"," "),IEE=P_("◻","[•]"),wEE=P_("◼","[+]"),eEE=P_("◻","[ ]"),XEE=P_("▪","•"),JEE=P_("─","-"),zEE=P_("╮","+"),FEE=P_("├","+"),jEE=P_("╯","+"),BEE=P_("●","•"),WEE=P_("◆","*"),HEE=P_("▲","!"),PEE=P_("■","x");var yEE={light:P_("─","-"),heavy:P_("━","="),block:P_("█","#")};function T4(){return`${pO.gray(_4)}  `}var YEE=T4();var j1="0.7.105";fE();import{existsSync as M1}from"node:fs";import{mkdir as c4,writeFile as Xj}from"node:fs/promises";function f1(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(_)=>{if(b("Initializing ts-cloud Project"),M1("cloud.config.ts")){if(!await DE("cloud.config.ts already exists. Overwrite?",!1)){U("Initialization cancelled");return}}let T=_?.name||await O_("Project name","my-app"),r=_?.mode||await _c("Select deployment mode",["serverless","server"]),d=_?.region||await _c("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),t=new n("Creating configuration file...");t.start();let R=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -9723,7 +9723,7 @@ Resources to create: ${B}`);let y={};for(let Y of Object.values(S.Resources||{})
 No changes detected - infrastructure is up to date`);return}if(U(`
 Changes detected:
 `),I.length>0){Z(`Resources to add (${I.length}):`);for(let F of I){let B=c[F].Type;U(`  + ${F} (${B})`)}console.log()}if(e.length>0){Q(`Resources to remove (${e.length}):`);for(let F of e){let B=O[F].Type;U(`  - ${F} (${B})`)}console.log()}if(z.length>0){_E(`Resources to modify (${z.length}):`);for(let F of z){let B=c[F].Type;U(`  ~ ${F} (${B})`)}console.log()}U("Summary:"),U(`  - Add: ${I.length}`),U(`  - Remove: ${e.length}`),U(`  - Modify: ${z.length}`),U("\nRun `cloud deploy` to apply these changes")}catch(T){Q(`Diff failed: ${T.message}`)}})}fE();await aE();YS();_0();function kR(E,_=0){let T=Number(E);return Number.isFinite(T)?T:_}function ge(E){return kR(E)*1024}function ub(E){let _=E?.date?.trim(),T=E?.time?.trim();if(!_||!T)return null;let r=new Date(`${_}T${T}Z`);return Number.isFinite(r.getTime())?r.toISOString():null}function vb(E,_,T){let r;try{r=JSON.parse(E)}catch{return[]}let d=(r?.sysstat?.hosts??[]).flatMap((R)=>R.statistics??[]),t=[];for(let R of d){let h=ub(R.timestamp);if(!h)continue;let N=new Date(h).getTime();if(N<_.getTime()||N>T.getTime())continue;let S=R["cpu-load"]?.find((L)=>L.cpu==="all")??R["cpu-load"]?.[0],A=kR(S?.idle,100);t.push({timestamp:h,cpuUsedPercent:Math.max(0,Math.min(100,100-A)),cpuUserPercent:kR(S?.user),cpuSystemPercent:kR(S?.system),cpuIowaitPercent:kR(S?.iowait),memoryUsedPercent:kR(R.memory?.["memused-percent"]),memoryUsedBytes:ge(R.memory?.memused),memoryAvailableBytes:ge(R.memory?.avail),swapUsedPercent:kR(R.memory?.["swpused-percent"]),swapUsedBytes:ge(R.memory?.swpused)})}return t.sort((R,h)=>R.timestamp.localeCompare(h.timestamp))}function nb(E){return Object.fromEntries(Object.entries(E.time_series??{}).map(([_,T])=>[_,(T.values??[]).map(([r,d])=>({timestamp:new Date(Number(r)*1000).toISOString(),value:kR(d,Number.NaN)})).filter((r)=>Number.isFinite(r.value))]))}function AP(E){return E.length?E.reduce((_,T)=>_+T,0)/E.length:null}function xe(E){return E.length?Math.max(...E):null}function lb(E){return E.length?Math.min(...E):null}async function LP(E){let[_,T]=await Promise.all([E.client.getServerMetrics(E.serverId,{types:["cpu","disk","network"],start:E.from,end:E.to,step:E.step}),Td(E.remote.host,"LC_ALL=C sadf -j -- -u -r -S",E.remote).catch(()=>"")]),r=vb(T,E.from,E.to),d=nb(_),R=(d.cpu??[]).map((L)=>Math.max(0,Math.min(100,L.value/Math.max(1,E.cores)))),h=r.map((L)=>L.cpuUsedPercent),N=R.length?R:h,S=r.map((L)=>L.memoryUsedPercent),A=r.map((L)=>L.swapUsedPercent);return{from:E.from.toISOString(),to:E.to.toISOString(),cores:E.cores,host:r,provider:d,summary:{cpuAveragePercent:AP(N),cpuPeakPercent:xe(N),memoryAveragePercent:AP(S),memoryPeakPercent:xe(S),memoryMinimumAvailableBytes:lb(r.map((L)=>L.memoryAvailableBytes)),swapPeakPercent:xe(A)}}}EX();rX();RX();AX();_$();await bd([pe(),mR()]);import{createHash as Hk}from"node:crypto";var WP=async(E)=>{let _=Bun.spawn(E,{stdout:"pipe",stderr:"pipe"}),[T,r,d]=await Promise.all([_.exited,new Response(_.stdout).text(),new Response(_.stderr).text()]);return{code:T,stdout:r,stderr:d}};class HP{async scan(E,_){let T=await WP(["ssh-keyscan","-T","10","-p",String(_),"-t","ed25519",E]),r=T.stdout.split(`
-`).find((d)=>d&&!d.startsWith("#"))?.trim().split(/\s+/);if(T.code!==0||!r?.[1]||!r[2])throw Error(`SSH host-key scan failed: ${T.stderr.trim()||"no key returned"}`);return{algorithm:r[1],key:r[2]}}async exec(E,_){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return WP(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,_])}}var Pk=(E)=>`SHA256:${Hk("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,yk=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class qt{provider;transport;discoverer;constructor(E,_=new HP,T){this.provider=E;this.transport=_;this.discoverer=T}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let _=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:_.algorithm,hostKeyFingerprint:Pk(_.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let _=await this.transport.exec(E,yk);if(_.code!==0)throw Error(`Fleet validation failed: ${_.stderr.trim()||_.code}`);try{return JSON.parse(_.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,_){let T=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${_.length}`);if(T.code!==0)throw Error(`Fleet bootstrap failed: ${T.stderr.trim()||T.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function PP(E,_){return{"fleet.bootstrap":async(T)=>{let r=T.operation.input&&typeof T.operation.input==="object"&&!Array.isArray(T.operation.input)?T.operation.input:{},d=E.get(String(r.serverId??""));if(!d)throw Error("Queued fleet server was not found.");let t=_.find((N)=>N.provider===d.provider);if(!t)throw Error(`No ${d.provider} fleet driver is configured.`);let R=Array.isArray(r.steps)?r.steps.map(String):[];if(T.checkpoint("preflight","Rechecking pinned trust and healthy validation."),d.trustState!=="pinned"||!d.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");T.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let h=await t.bootstrap(d,R);return E.update(d.id,{bootstrapVersion:h.version,status:"ready"}),T.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:d.id,bootstrapVersion:h.version,steps:R.length}}}}var _t=(E)=>E==null?void 0:String(E),ah=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},LX=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:_t(E.provider_id),region:_t(E.region),zone:_t(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:_t(E.host_key_algorithm),hostKeyFingerprint:_t(E.host_key_fingerprint),pendingHostKey:_t(E.pending_host_key),roles:ah(E.roles,[]),labels:ah(E.labels,{}),taints:ah(E.taints,[]),capacity:ah(E.capacity,{}),usage:ah(E.usage,{}),capabilities:ah(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:ah(E.validation,void 0),bootstrapVersion:_t(E.bootstrap_version),heartbeatAt:_t(E.heartbeat_at),lastSeenAt:_t(E.last_seen_at),archivedAt:_t(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class Tt{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}get(E){let _=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return _?LX(_):void 0}list(E,_=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(LX).filter((T)=>_||T.status!=="archived")}findProvider(E,_,T){let r=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,_,T);return r?LX(r):void 0}create(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,T,T]),this.get(_)}update(E,_){let T=this.get(E);if(!T)throw Error("Server was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[r.name,r.providerId??null,r.region??null,r.zone??null,r.endpoint,r.sshUser,r.sshPort,r.credentialRef,r.hostKeyAlgorithm??null,r.hostKeyFingerprint??null,r.pendingHostKey??null,JSON.stringify(r.roles),JSON.stringify(r.labels),JSON.stringify(r.taints),JSON.stringify(r.capacity),JSON.stringify(r.usage),JSON.stringify(r.capabilities),r.status,r.trustState,JSON.stringify(r.validation??{}),r.bootstrapVersion??null,r.heartbeatAt??null,r.lastSeenAt??null,r.archivedAt??null,d,E]),this.get(E)}}var Yk=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class N0{store;drivers;now;queue;constructor(E,_,T,r=()=>new Date){this.store=E;this.drivers=_;this.now=r;this.queue=T??new lE(E.control)}driver(E){let _=this.drivers.find((T)=>T.provider===E);if(!_)throw Error(`No ${E} fleet driver is configured.`);return _}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!Yk.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let _=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(_)return this.store.update(_.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let T=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),r=this.driver(E.provider);return this.store.create({...E,resourceId:T.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:r.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let T=await this.driver(_.provider).test(_);if(!T.reachable)return this.store.update(E,{status:"unreachable"});if(_.hostKeyFingerprint&&_.hostKeyFingerprint!==T.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:T.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:T.hostKeyAlgorithm,hostKeyFingerprint:T.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,_){let T=this.store.get(E);if(!T||T.pendingHostKey!==_)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:_,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let _=this.store.get(E);if(!_||_.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let T=await this.driver(_.provider).validate(_),r=[];if(!["x64","arm64","x86_64","aarch64"].includes(T.arch??""))r.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let R of["curl","tar"])if(!T.tools?.[R])r.push({code:`tool.${R}`,severity:"error",message:`${R} is missing.`,remediation:`Install ${R} before bootstrap.`});if(Math.abs(T.timeSkewSeconds??0)>60)r.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!T.dnsOk)r.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let d={valid:!r.some((R)=>R.severity==="error"),facts:T,findings:r,validatedAt:this.now().toISOString(),validatorVersion:"1"},t={cpu:T.cpuCores??0,memoryBytes:T.memoryBytes??0,diskBytes:T.diskBytes??0};return this.store.update(E,{validation:d,capacity:t,status:d.valid?"ready":"degraded"})}bootstrap(E,_=!1){let T=this.store.get(E);if(!T?.validation?.valid)throw Error("A healthy validation report is required.");let r=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!_)return{preview:!0,steps:r};let d=this.queue.enqueue({projectId:T.projectId,resourceId:T.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:r},lockKey:`server:${E}`,providerKey:T.provider}).operation;return{preview:!1,steps:r,operation:d}}heartbeat(E,_){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let r=this.now().toISOString();return this.store.update(E,{usage:_.usage,capabilities:_.capabilities??T.capabilities,heartbeatAt:r,lastSeenAt:r,status:T.status==="draining"||T.status==="drained"?T.status:"ready"})}drain(E,_=!1){return this.store.update(E,{status:_?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,_){let T=this.store.get(E);if(!T||_!==T.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function Qk(){let E=await p(),_=iE(process.cwd(),E),T=new Tt(_.store),r=new N0(T,[new qt("aws"),new qt("hetzner"),new qt("ssh")]);return{controlPlane:_,store:T,service:r}}async function gt(E){let _=await Qk();try{return await E(_)}finally{_.controlPlane.store.close()}}var mh=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((r)=>r.id===_||r.name===_);if(!T)throw Error(`Server ${_} was not found.`);return T},dd=(E)=>{Q(E instanceof Error?E.message:String(E)),process.exitCode=1};function OX(E,_){let T=Number.parseInt(E??"",10);return Number.isFinite(T)&&T>=0?T:_}function Gk(E="3h"){let _=E.match(/^(\d+)(m|h)$/);if(!_)throw Error("--range must use minutes or hours, for example 30m or 3h.");let T=Number(_[1])*(_[2]==="h"?3600000:60000);if(T<300000||T>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return T}function S0(E,_="%"){return E==null?"unavailable":`${E.toFixed(1)}${_}`}async function Mk(E,_){let T=await p();if(T.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let r=_.env??process.env.CLOUD_ENV??"production",d=I_(T,r),t=await Bd(d);if(!t?.serverId)throw Error(`No pinned Hetzner server was found for ${d}.`);if(![t.serverName,String(t.serverId),t.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${t.serverName}.`);let R=HS(T),h=new ft({apiToken:PS(R.apiToken,T)}),N=await h.getServer(t.serverId),S=t.publicIp??N.public_net.ipv4?.ip;if(!S)throw Error(`Server ${N.name} has no public IPv4 address.`);let A=new Date,L=new Date(A.getTime()-Gk(_.range)),O=Math.min(3600,Math.max(60,OX(_.step,60))),c=await LP({client:h,serverId:N.id,cores:Math.max(1,Number(N.server_type.cores)||1),from:L,to:A,step:O,remote:{host:S,user:t.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15}});if(_.json){console.log(JSON.stringify({schemaVersion:1,server:N.name,result:c},null,2));return}o(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[N.name,`${c.from} to ${c.to}`,`${S0(c.summary.cpuAveragePercent)} / ${S0(c.summary.cpuPeakPercent)}`,`${S0(c.summary.memoryAveragePercent)} / ${S0(c.summary.memoryPeakPercent)}`,c.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(c.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,S0(c.summary.swapPeakPercent)]])}function yP(E){let _=E.targetType.prices?.find((T)=>T.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:_?{hourlyNet:_.price_hourly.net,hourlyGross:_.price_hourly.gross,monthlyNet:_.price_monthly.net,monthlyGross:_.price_monthly.gross}:void 0}}function fk(E){let _=yP(E);o(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${_.serverName} (${_.serverId})`,_.location,`${_.from} -> ${_.to}`,_.capacityAvailable?"available":"waiting",`${_.target.cores??0} / ${_.target.memoryGb??0} GB / ${_.target.diskGb??0} GB`,_.price?.monthlyGross??_.price?.monthlyNet??"not reported"]])}async function Kk(E,_,T){let r=await p();if(r.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let d=T.env??process.env.CLOUD_ENV??"production",t=I_(r,d),R=await Bd(t),h=HS(r),N=new ft({apiToken:PS(h.apiToken,r)}),A=R&&(E===R.serverName||E===String(R.serverId)||E===R.stackName)?await N.getServer(R.serverId):(await N.listServers()).find((Y)=>Y.name===E||String(Y.id)===E);if(!A)throw Error(`Hetzner server ${E} was not found.`);if(R?.serverId&&R.serverId!==A.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${R.serverId}.`);let L=Kt(_),O=T.upgradeDisk!==!1,c=await h0(N,A.id,L,O);if(T.json)console.log(JSON.stringify({schemaVersion:1,plan:yP(c)},null,2));else fk(c);if(!T.apply){if(!T.json)U(`Preview only. Re-run with --apply --confirm ${A.name} to execute.`);return}if(T.confirm!==A.name)throw Error(`Resize requires --confirm ${A.name}.`);let $=R?.publicIp??A.public_net.ipv4?.ip;if(!$)throw Error(`Server ${A.name} has no public IPv4 address for verification.`);let C={host:$,user:R?.sshUser??h.sshUser,identityFile:h.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},I=await NX(t),e=new Date().toISOString(),z={schemaVersion:1,operationId:I?.targetType===L&&I.serverId===A.id?I.operationId:crypto.randomUUID(),stackName:t,serverId:A.id,serverName:A.name,sourceType:c.currentType.name,targetType:L,upgradeDisk:O,phase:"planning",status:"running",attempts:I?.targetType===L?I.attempts:0,startedAt:I?.targetType===L?I.startedAt:e,updatedAt:e,manifest:I?.targetType===L?I.manifest:void 0};await Zt(z);let F=OX(T.pollSeconds,900)*1000,B=OX(T.maxWaitMinutes,0)*60000,y=Date.now();for(;;){let Y=await h0(N,A.id,L,O);if(!Y.capacityAvailable&&!Y.alreadyComplete){if(z={...z,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await Zt(z),!T.wait){if(!T.json)U(`${L} has no capacity in ${Y.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(B>0&&Date.now()-y>=B)throw Error(`Timed out waiting for ${L} capacity in ${Y.location}.`);if(!T.json)U(`Waiting ${Math.round(F/1000)} seconds for ${L} capacity...`);await Bun.sleep(F);continue}let M=await SX(t);try{let V=await(async()=>{try{return z={...z,status:"running",attempts:z.attempts+1,updatedAt:new Date().toISOString()},await Zt(z),await TX({client:N,serverId:A.id,targetType:L,upgradeDisk:O,resumeFromOff:z.phase==="shutting-down"||z.phase==="resizing"||z.phase==="powering-on"||z.phase==="verifying",manifest:z.manifest,hooks:{preflight:async()=>{let g=await dX(C);return z={...z,manifest:g,updatedAt:new Date().toISOString()},await Zt(z),g},afterBoot:async(g,k,v,EE)=>tX(C,k,v,EE),onPhase:async(g,k)=>{if(z={...z,phase:g,status:g==="waiting-capacity"?"waiting-capacity":g==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await Zt(z),!T.json)U(`${g}${k?` ${JSON.stringify(k)}`:""}`)}}})}finally{await M()}})();if(z={...z,status:V.status==="completed"||V.status==="already-complete"?"completed":V.status==="recovered"?"recovered":"waiting-capacity",lastError:V.status==="recovered"?V.error:void 0,updatedAt:new Date().toISOString()},await Zt(z),T.json)console.log(JSON.stringify({schemaVersion:1,result:V},null,2));else if(V.status==="completed"||V.status==="already-complete")Z(`${A.name} is on ${L} and passed full post-boot verification.`);else if(V.status==="recovered"&&V.retryable&&T.wait){U(`Capacity race recovered safely. Waiting ${Math.round(F/1000)} seconds before retry.`),await Bun.sleep(F);continue}else if(V.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${V.error}`);return}catch(V){throw z={...z,status:"failed",lastError:V instanceof Error?V.message:String(V),updatedAt:new Date().toISOString()},await Zt(z),V}}}async function Vk(E,_){let T=await p();if(T.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let r=_.env??process.env.CLOUD_ENV??"production",d=I_(T,r),t=await Bd(d);if(!t?.serverId)throw Error(`No pinned Hetzner server was found for ${d}.`);if(![t.serverName,String(t.serverId),t.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${t.serverName}.`);let R=HS(T),h=new ft({apiToken:PS(R.apiToken,T)}),N=await h.getServer(t.serverId),S=t.publicIp??N.public_net.ipv4?.ip;if(!S)throw Error(`Server ${N.name} has no public IPv4 address.`);let A=oU(T);if(_.json)console.log(JSON.stringify({schemaVersion:1,server:N.name,plan:A},null,2));else o(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[N.name,A.firewallPorts.join(","),A.monitoring?"on":"off",A.autoUpdates?"on":"off",`${A.swapGb} GB`,"disabled"]]);if(!_.apply){if(!_.json)U(`Preview only. Re-run with --apply --confirm ${N.name} to execute.`);return}if(_.confirm!==N.name)throw Error(`Optimization requires --confirm ${N.name}.`);let L={host:S,user:t.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15},O=await VS(L),c=O.routeProbes.filter((v)=>!v.ok),$=T.infrastructure?.compute,C=$r($)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,I=O.failedUnits.filter((v)=>!C.has(v));if(I.length>0)throw Error(`Preflight found failed services: ${I.join(", ")}`);if(c.length>0)throw Error(`Preflight found unhealthy routes: ${c.map((v)=>v.domain).join(", ")}`);let e=$r($)?[]:Object.values(T.sites??{}).flatMap((v)=>typeof v?.port==="number"&&![80,443].includes(v.port)?[v.port]:[]),z=QS({allowSsh:$?.allowSsh!==!1,sitePorts:e,allowedPorts:$?.firewall?.allowedPorts}),F=(t.firewallId?(await h.listFirewalls()).find((v)=>v.id===t.firewallId):void 0)??(await h.listFirewalls()).find((v)=>v.name===`${T.project.slug}-${r}-app-fw`);if(!F)throw Error(`Managed firewall for ${N.name} was not found.`);let B=await h.setFirewallRules(F.id,z);await Promise.all(B.map((v)=>h.waitForAction(v.id))),await ae(T,L);let[y,Y]=await Promise.all([VS(L),me(L)]),M=se(A,Y),V=IP(O,y),g=y.routeProbes.filter((v)=>!v.ok);if(V.stoppedServices.length>0)M.push(`services stopped: ${V.stoppedServices.join(", ")}`);if(V.changedRouteFragments.length>0)M.push(`route fragments changed: ${V.changedRouteFragments.join(", ")}`);if(V.missingRouteIds.length>0)M.push(`routes disappeared: ${V.missingRouteIds.join(", ")}`);if(V.changedReleaseLinks.length>0)M.push(`release links changed: ${V.changedReleaseLinks.join(", ")}`);if(V.missingData.length>0)M.push(`databases or volumes disappeared: ${V.missingData.join(", ")}`);if(g.length>0)M.push(`unhealthy routes: ${g.map((v)=>v.domain).join(", ")}`);if(M.length>0)throw Error(`Host optimization verification failed: ${M.join("; ")}`);let k={serverId:N.id,serverName:N.name,services:y.runningServices.length,routes:y.routeIds.length,healthyDomains:y.routeProbes.length,releaseLinks:y.releaseLinks.length,databasesAndVolumes:y.dataCatalog.length,report:Y};if(_.json)console.log(JSON.stringify({schemaVersion:1,result:k},null,2));else Z(`${N.name} passed full host, rpx route, service, release, and data verification.`)}function cX(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(_,T)=>{try{await gt(async(r)=>{let d=_?[mh(r,_)]:r.store.list(r.controlPlane.project.id),t=d.flatMap((R)=>Object.entries(R.capabilities).map(([h,N])=>({server:R.name,provider:R.provider,action:h,...N})));if(T.json)console.log(JSON.stringify({schemaVersion:1,targets:t},null,2));else o(["Server","Provider","Action","Support","Explanation"],t.map((R)=>[R.server,R.provider,R.action,R.supported?"supported":"unsupported",R.reason??"—"]))})}catch(r){dd(r)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(_,T,r)=>{try{await Kk(_,T,r)}catch(d){dd(d)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(_,T)=>{try{await Vk(_,T)}catch(r){dd(r)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(_,T)=>{try{await Mk(_,T)}catch(r){dd(r)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(_)=>{try{await gt(async(T)=>{let r=T.store.list(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(r,null,2));else o(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],r.map((d)=>[d.name,d.providerId??"—",`${d.provider} / ${d.region??"external"}`,`${d.status} / ${d.trustState}`,d.roles.join(","),`${d.capacity.cpu??0} / ${d.capacity.memoryBytes??0}`,d.heartbeatAt??"never"]))})}catch(T){dd(T)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(_,T)=>{try{await gt(async(r)=>{let d=T.provider;if(!["aws","hetzner","ssh"].includes(d)||!T.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let t=r.service.enroll({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:_,provider:d,providerId:T.providerId,endpoint:T.endpoint,sshUser:T.user??"deploy",credentialRef:T.credentialRef??"secret://fleet/agent",region:T.region,roles:String(T.roles??"application").split(","),labels:Object.fromEntries(String(T.labels??"").split(",").map((R)=>R.split("=")).filter((R)=>R[0]&&R[1]))});Z(`Enrolled ${t.name} as ${t.id}; no remote mutation was performed.`)})}catch(r){dd(r)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(_,T)=>{try{await gt(async(r)=>{let d=mh(r,_);if(d=await r.service.test(d.id),d.trustState==="rotation_pending"){if(!T.acceptHostKey)throw Error(`Host key changed to ${d.pendingHostKey}; review it first.`);d=r.service.reviewHostKey(d.id,T.acceptHostKey)}let t=await r.service.validate(d.id);if(T.json)console.log(JSON.stringify(t.validation,null,2));else o(["Severity","Code","Finding","Remediation"],(t.validation?.findings??[]).map((R)=>[R.severity,R.code,R.message,R.remediation??"—"]));if(!t.validation?.valid)process.exitCode=1})}catch(r){dd(r)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(_,T)=>{try{await gt(async(r)=>{let d=r.service.bootstrap(mh(r,_).id,!!T.apply);if(d.preview)o(["Step"],d.steps.map((t)=>[t]));else Z(`Bootstrap queued: ${d.operation?.id}`)})}catch(r){dd(r)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(_,T)=>{try{await gt(async(r)=>Z(r.service.drain(mh(r,_).id,!!T.complete).status))}catch(r){dd(r)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(_)=>{try{await gt(async(T)=>{T.service.uncordon(mh(T,_).id),Z(`Uncordoned ${_}.`)})}catch(T){dd(T)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(_,T)=>{try{await gt(async(r)=>{r.service.archive(mh(r,_).id,T.confirm??""),Z(`Archived ${_}; provider infrastructure was not terminated.`)})}catch(r){dd(r)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(_)=>{try{await gt(async(T)=>{let r=mh(T,_);if(r.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let d=Bun.spawn(["ssh","-p",String(r.sshPort),"-o","StrictHostKeyChecking=yes",`${r.sshUser}@${r.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),t=await d.exited;if(t)process.exitCode=t})}catch(T){dd(T)}});for(let[_,T]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(_,T).action(async(...r)=>_d(_.split(" ")[0],{target:String(r[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}fE();var Wd=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},Dr=(E)=>E==null?void 0:String(E),GP=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),qS=(E={})=>({...GP(),...E});function YP(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:Dr(E.region),architecture:Dr(E.architecture),labels:Wd(E.labels,{}),requiredServerLabels:Wd(E.required_server_labels,{}),toleratedTaints:Wd(E.tolerated_taints,[]),capacity:qS(Wd(E.capacity,{})),reserved:Wd(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:Dr(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function QP(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Dr(E.environment_id),resourceId:String(E.resource_id),releaseId:Dr(E.release_id),poolId:String(E.pool_id),serverId:Dr(E.server_id),purpose:String(E.purpose),requirements:Wd(E.requirements,{}),decision:Wd(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Zk(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:Dr(E.resource_id),poolId:String(E.pool_id),placementId:Dr(E.placement_id),operationId:Dr(E.operation_id),sourceSha:String(E.source_sha),buildSpec:Wd(E.build_spec,{}),credentialPolicy:Wd(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:Dr(E.workspace),cacheKey:Dr(E.cache_key),artifactUri:Dr(E.artifact_uri),artifactDigest:Dr(E.artifact_digest),status:String(E.status),cleanupAt:Dr(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class A0{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}createPool(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(qS(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,T,T]),this.getPool(_)}getPool(E){let _=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return _?YP(_):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(YP)}updatePool(E,_){let T=this.getPool(E);if(!T)throw Error("Capacity pool was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.reserved),JSON.stringify(r.capacity),r.concurrency,d,E]),this.getPool(E)}addMember(E,_,T={}){let r=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,_,JSON.stringify(T),r,r])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((_)=>({serverId:String(_.server_id),status:String(_.status),capacityOverride:Wd(_.capacity_override,{})}))}memberStatus(E,_,T){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[T,this.now().toISOString(),E,_])}listPlacements(E,_){let T=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(QP);return _?.length?T.filter((r)=>_.includes(r.status)):T}getPlacement(E){let _=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return _?QP(_):void 0}activeUsage(E,_){let T=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),r=_?T.filter((d)=>String(d.server_id)===_):T;return{resources:r.reduce((d,t)=>{let R=qS(Wd(t.resources,{}));for(let h of Object.keys(d))d[h]+=R[h];return d},GP()),count:r.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let _=this.id(),T=this.id(),r=this.now().toISOString(),d=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[_,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,r,r]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[T,_,E.decision.poolId,E.decision.serverId??null,JSON.stringify(qS(E.requirements.resources)),d,r,r]),this.getPlacement(_)})}transitionPlacement(E,_){if(!this.getPlacement(E))throw Error("Placement was not found.");let r=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[_,r,E]),["released","failed","blocked"].includes(_))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[r,E]);return this.getPlacement(E)}createBuild(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[_,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),T,T]),this.getBuild(_)}getBuild(E){let _=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return _?Zk(_):void 0}updateBuild(E,_){let T=this.getBuild(E);if(!T)throw Error("Remote build was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[r.operationId??null,r.workspace??null,r.cacheKey??null,r.artifactUri??null,r.artifactDigest??null,r.status,r.cleanupAt??null,d,E]),this.getBuild(E)}}var r$=["cpu","memoryBytes","diskBytes","gpu"],MP=(E,_={})=>Object.entries(_).every(([T,r])=>E[T]===r),qk=(E,_,T)=>Object.fromEntries(r$.map((r)=>[r,Math.max(0,E[r]-_[r]-(T[r]??0))])),gk=(E,_)=>r$.every((T)=>E[T]>=(_[T]??0)),xk=(E,_)=>r$.reduce((T,r)=>T+(_[r]??0)/(E[r]||1),0);class L0{store;fleet;constructor(E,_){this.store=E;this.fleet=_}poolCandidates(E,_,T){let r=[];for(let d of this.store.listPools(E)){if(d.id===T)continue;let t=[];if(d.status!=="active")t.push(`pool is ${d.status}`);if(d.purpose!==_.purpose)t.push(`purpose is ${d.purpose}`);if(_.region&&d.region!==_.region)t.push(`region is ${d.region??"unset"}`);if(_.architecture&&d.architecture!==_.architecture)t.push(`architecture is ${d.architecture??"unset"}`);if(!MP(d.labels,_.labels))t.push("pool labels do not match");if(d.backend==="server"){let R=this.store.members(d.id);if(!R.length)r.push(this.decision(d,void 0,_,[...t,"pool has no servers"]));for(let h of R){let N=this.fleet.get(h.serverId),S=[...t];if(!N)S.push("server is missing");else this.serverReasons(d,N,h.status,_,S);r.push(this.decision(d,N,_,S,h.capacityOverride))}}else r.push(this.decision(d,void 0,_,t))}return r.sort((d,t)=>Number(t.eligible)-Number(d.eligible)||d.score.cost-t.score.cost||d.score.spread-t.score.spread||d.score.fit-t.score.fit||d.poolName.localeCompare(t.poolName)||(d.serverId??"").localeCompare(t.serverId??""))}serverReasons(E,_,T,r,d){if(T!=="active")d.push(`member is ${T}`);if(_.status!=="ready")d.push(`server is ${_.status}`);if(!_.roles.includes(r.purpose==="build"?"build":r.purpose))d.push(`server lacks ${r.purpose} role`);if(!MP(_.labels,E.requiredServerLabels))d.push("server labels do not match pool selector");for(let t of _.taints)if(!E.toleratedTaints.includes(t))d.push(`taint ${t} is not tolerated`)}decision(E,_,T,r,d={}){let t=qS({..._?.capacity,...d}),R=_?Object.fromEntries(r$.map((S)=>[S,Math.min(E.capacity[S],t[S])])):E.capacity,h=this.store.activeUsage(E.id,_?.id),N=qk(R,h.resources,E.reserved);if(h.count>=E.maxWorkloads)r.push("workload limit reached");if(T.purpose==="build"&&h.count>=E.concurrency)r.push("build concurrency reached");if(!gk(N,T.resources))r.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:_?.id,eligible:r.length===0,reasons:r,available:N,score:{fit:xk(N,T.resources),spread:h.count,cost:E.costWeight}}}explain(E,_){return this.poolCandidates(E,_)}place(E){return this.store.control.transaction(()=>{let _=this.poolCandidates(E.projectId,E.requirements).find((T)=>T.eligible);if(!_)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((T)=>T.reasons).join("; ")}`);return this.store.reserve({...E,decision:_})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let _=this.store.updatePool(E,{status:"draining"}),T=[],r=[];for(let d of this.store.listPlacements(_.projectId,["reserved","active"]).filter((t)=>t.poolId===E)){if(d.stateful){r.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"moving");let t=this.place({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements});T.push(this.activate(t.id)),this.store.transitionPlacement(d.id,"released")}return{pool:_,moved:T,blocked:r}}drainServer(E,_){this.store.memberStatus(E,_,"draining");let T=this.store.getPool(E);if(!T)throw Error("Capacity pool was not found.");let r=[],d=[];for(let t of this.store.listPlacements(T.projectId,["reserved","active"]).filter((R)=>R.poolId===E&&R.serverId===_)){if(t.stateful){d.push(this.store.transitionPlacement(t.id,"blocked"));continue}this.store.transitionPlacement(t.id,"moving");let R=this.poolCandidates(t.projectId,t.requirements).find((N)=>N.eligible);if(!R){d.push(this.store.transitionPlacement(t.id,"blocked"));continue}let h=this.store.reserve({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,releaseId:t.releaseId,requirements:t.requirements,decision:R});r.push(this.activate(h.id)),this.store.transitionPlacement(t.id,"released")}return{moved:r,blocked:d}}reconcileFailure(E){let _=this.fleet.get(E);if(!_)throw Error("Server was not found.");let T=[],r=[];for(let d of this.store.listPlacements(_.projectId,["active"]).filter((t)=>t.serverId===E)){if(d.stateful||!d.autoReschedule){r.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"failed");let t=this.place({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements});T.push(this.activate(t.id))}return{rescheduled:T,blocked:r}}}async function bk(){let E=await p(),_=iE(process.cwd(),E),T=new A0(_.store),r=new L0(T,new Tt(_.store));return{controlPlane:_,store:T,service:r}}async function O0(E){let _=await bk();try{await E(_)}catch(T){Q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var d$=(E)=>Object.fromEntries(String(E??"").split(",").map((_)=>_.split("=")).filter((_)=>_[0]&&_[1])),fP=(E)=>Object.fromEntries(Object.entries(d$(E)).map(([_,T])=>[_,Number(T)]));function UX(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(_)=>O0((T)=>{let r=T.store.listPools(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(r,null,2));else o(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],r.map((d)=>[d.name,d.purpose,d.backend,`${d.region??"any"} / ${d.architecture??"any"}`,d.status,JSON.stringify(d.capacity),String(d.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(_,T)=>O0((r)=>{let{purpose:d,backend:t}=T;if(!["application","build","worker","monitoring","backup"].includes(d)||!["server","ecs","asg"].includes(t))throw Error("Unsupported pool purpose or backend.");let R=r.store.createPool({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:_,purpose:d,backend:t,region:T.region,architecture:T.arch,labels:d$(T.labels),requiredServerLabels:d$(T.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...fP(T.capacity)},maxWorkloads:Number(T.max),costWeight:1,concurrency:Number(T.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});Z(`Created ${R.name} (${R.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(_,T)=>O0((r)=>{let d=r.store.listPools(r.controlPlane.project.id).find((R)=>R.id===_||R.name===_),t=new Tt(r.controlPlane.store).list(r.controlPlane.project.id).find((R)=>R.id===T||R.name===T);if(!d||!t)throw Error("Pool or server was not found.");r.store.addMember(d.id,t.id),Z(`Attached ${t.name} to ${d.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(_)=>O0((T)=>{let r=T.service.explain(T.controlPlane.project.id,{purpose:_.purpose,resources:fP(_.resources),region:_.region,architecture:_.arch,labels:d$(_.labels)});if(_.json)console.log(JSON.stringify(r,null,2));else o(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],r.map((d)=>[d.poolName,d.serverId??"provider-managed",d.eligible?"yes":"no",JSON.stringify(d.available),`${d.score.fit.toFixed(2)} / ${d.score.spread} / ${d.score.cost}`,d.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(_)=>O0((T)=>{let r=T.store.listPools(T.controlPlane.project.id).find((t)=>t.id===_||t.name===_);if(!r)throw Error("Pool was not found.");let d=T.service.drainPool(r.id);Z(`Draining ${r.name}: moved ${d.moved.length}, blocked ${d.blocked.length} stateful placement(s).`)}))}fE();var xt=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},td=(E)=>E==null?void 0:String(E),KP=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:td(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:xt(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:xt(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:td(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),$X=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:td(E.stack_id),stackRevision:td(E.stack_revision),status:String(E.status),health:xt(E.health,{}),lastHealthyAt:td(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),DX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:xt(E.config,{}),status:String(E.status),checkpoint:td(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:td(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),CX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:xt(E.weights,{}),desiredWeights:xt(E.desired_weights,{}),status:String(E.status),providerState:xt(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),VP=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:td(E.operation_id),kind:String(E.kind),requestedRegion:td(E.requested_region),revision:td(E.revision),plan:xt(E.plan,[]),currentStep:td(E.current_step),completedSteps:xt(E.completed_steps,[]),status:String(E.status),error:td(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class c0{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((t)=>t.region)).size!==E.regions.length||E.regions.filter((t)=>t.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let _=E.regions.find((t)=>t.role==="primary"),T=this.id(),r=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[T,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,_.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),_.region,r,r]);for(let t of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),T,t.region,t.role,t.provider,r,r]);for(let t of E.dataPolicy.replicate)for(let R of E.regions)for(let h of E.regions.filter((N)=>N.region!==R.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,t,R.region,h.region,"{}",r,r]);let d=Object.fromEntries(E.regions.map((t)=>[t.region,t.region===_.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),T,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(d),JSON.stringify(d),r,r]),this.get(T)})}get(E){let _=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return _?KP(_):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(KP)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map($X)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(DX)}route(E){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return _?CX(_):void 0}updateTopology(E,_){let T=this.get(E);if(!T)throw Error("Regional topology was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[r.status,r.activeRegion,r.revision??null,JSON.stringify(r.regions),d,E]),this.get(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!T)throw Error("Regional target was not found.");let r=$X(T),d={...r,..._},t=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[d.role,d.stackId??null,d.stackRevision??null,d.status,JSON.stringify(d.health),d.lastHealthyAt??null,t,E]),$X(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,_){let T=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!T)throw Error("Replication channel was not found.");let r=DX(T),d={...r,..._},t=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[d.status,d.checkpoint??null,d.lagSeconds??null,d.lastVerifiedAt??null,t,E]),DX(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,_){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!T)throw Error("Traffic route was not found.");let r=CX(T),d={...r,..._},t=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(d.weights),JSON.stringify(d.desiredWeights),d.status,JSON.stringify(d.providerState),t,E]),CX(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[_,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),T,T]),this.execution(_)}execution(E){let _=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return _?VP(_):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(VP)}updateExecution(E,_){let T=this.execution(E);if(!T)throw Error("Regional execution was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[r.operationId??null,r.currentStep??null,JSON.stringify(r.completedSteps),r.status,r.error??null,d,E]),this.execution(E)}}class U0{store;queue;constructor(E,_){this.store=E;this.queue=_??new lE(E.control)}create(E){return this.store.create(E)}plan(E,_,T){if(!this.store.get(E))throw Error("Regional topology was not found.");let d=this.store.targets(E),t=this.store.channels(E);if(_==="rollout")return[...d.filter((R)=>R.role==="secondary").map((R)=>`apply:${R.region}`),...d.filter((R)=>R.role==="primary").map((R)=>`apply:${R.region}`),...t.map((R)=>`replicate:${R.kind}:${R.targetRegion}`),"traffic:activate"];if(_==="failover"||_==="failback")return[`health:${T}`,`replication:${T}`,`traffic:${T}`,`roles:${T}`];if(_==="destroy")return["traffic:drain",...d.filter((R)=>R.role==="secondary").map((R)=>`delete:${R.region}`),...d.filter((R)=>R.role==="primary").map((R)=>`delete:${R.region}`),"complete"];return["observe","repair"]}enqueue(E){let _=this.store.get(E.topologyId);if(!_)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!_.regions.some((t)=>t.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===_.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==_.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&_.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let T=this.plan(_.id,E.kind,E.targetRegion),r=this.store.createExecution({topologyId:_.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:T}),d=this.queue.enqueue({projectId:_.projectId,environmentId:_.environmentId,kind:`region.${E.kind}`,input:{executionId:r.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${_.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(r.id,{operationId:d.id}),{execution:this.store.execution(r.id),operation:d}}}var kk=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function ZP(E,_){let T=(S)=>{let A=_.find((L)=>L.provider===S.provider);if(!A)throw Error(`No ${S.provider} regional driver is configured.`);return A},r=(S,A,L)=>{S.throwIfCancellationRequested(),S.checkpoint(L,L),E.updateExecution(A.id,{status:"running",currentStep:L,completedSteps:[...E.execution(A.id).completedSteps,L]})},d=async(S,A)=>{let L=E.route(S.id);if(!L)throw Error("Regional traffic route was not found.");let O=E.targets(S.id).find(($)=>$.region===S.activeRegion)??E.targets(S.id)[0];if(!O)throw Error("Regional traffic target was not found.");E.updateRoute(L.id,{status:"applying",desiredWeights:A});let c=await T(O).applyTraffic({route:E.route(S.id),topology:S,weights:A});E.updateRoute(L.id,{status:Object.values(A).every(($)=>$===0)?"drained":"in_sync",weights:A,providerState:c.providerState})},t=async(S,A,L,O)=>{E.updateTopology(L.id,{status:"provisioning"});let c=A.revision,$=O.manifest??{},C=E.targets(L.id).sort((e,z)=>Number(e.role==="primary")-Number(z.role==="primary"));for(let e of C){r(S,A,`apply:${e.region}`),E.updateTarget(e.id,{status:"provisioning"});let z=await T(e).applyStack({target:e,revision:c,manifest:$,signal:S.signal}),F=await T(e).health({target:E.updateTarget(e.id,{stackId:z.stackId,stackRevision:c})});if(!F.healthy)throw Error(`Regional health gate failed in ${e.region}.`);E.updateTarget(e.id,{status:"ready",health:F.evidence,lastHealthyAt:new Date().toISOString()})}for(let e of E.channels(L.id)){r(S,A,`replicate:${e.kind}:${e.targetRegion}`),E.updateChannel(e.id,{status:"configuring"});let z=C.find((y)=>y.region===e.sourceRegion),F=await T(z).configureReplication({channel:e,topology:L}),B=await T(z).verifyReplication({channel:E.updateChannel(e.id,{checkpoint:F.checkpoint,lagSeconds:F.lagSeconds}),topology:L});if(!B.healthy||B.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${e.kind} replication to ${e.targetRegion} exceeds the RPO.`);E.updateChannel(e.id,{status:"in_sync",checkpoint:B.checkpoint,lagSeconds:B.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(S,A,"traffic:activate");let I=Object.fromEntries(L.regions.map((e)=>[e.region,e.region===L.activeRegion?100:0]));return await d(L,I),E.updateTopology(L.id,{status:"ready",revision:c}),{revision:c,activeRegion:L.activeRegion}},R=async(S,A,L)=>{let O=A.requestedRegion,c=E.targets(L.id).find((I)=>I.region===O);if(!c)throw Error("Requested regional target was not found.");E.updateTopology(L.id,{status:A.kind==="failover"?"failing_over":"failing_back"}),r(S,A,`health:${O}`);let $=await T(c).health({target:c});if(!$.healthy)throw Error(`Target region ${O} is unhealthy.`);E.updateTarget(c.id,{status:"ready",health:$.evidence,lastHealthyAt:new Date().toISOString()}),r(S,A,`replication:${O}`);for(let I of E.channels(L.id).filter((e)=>e.targetRegion===O)){let e=await T(c).verifyReplication({channel:I,topology:L});if(!e.healthy||e.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${I.kind} replication is outside the failover RPO.`);E.updateChannel(I.id,{status:"in_sync",checkpoint:e.checkpoint,lagSeconds:e.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(S,A,`traffic:${O}`),await d(L,Object.fromEntries(L.regions.map((I)=>[I.region,I.region===O?100:0]))),r(S,A,`roles:${O}`);let C=L.regions.map((I)=>({...I,role:I.region===O?"primary":"secondary"}));for(let I of E.targets(L.id))E.updateTarget(I.id,{role:I.region===O?"primary":"secondary"});return E.updateTopology(L.id,{status:A.kind==="failover"?"failed_over":"ready",activeRegion:O,regions:C}),{activeRegion:O}},h=async(S,A,L,O)=>{E.updateTopology(L.id,{status:"destroying"}),r(S,A,"traffic:drain"),await d(L,Object.fromEntries(L.regions.map(($)=>[$.region,0])));let c=O.deleteData!==!0;for(let $ of E.targets(L.id).sort((C,I)=>Number(C.role==="primary")-Number(I.role==="primary")))r(S,A,`delete:${$.region}`),E.updateTarget($.id,{status:"deleting"}),await T($).deleteStack({target:$,retainData:c,signal:S.signal}),E.updateTarget($.id,{status:"deleted"});return r(S,A,"complete"),E.updateTopology(L.id,{status:"destroyed"}),{destroyed:!0,dataRetained:c}},N=async(S)=>{let A=kk(S.operation.input),L=E.execution(String(A.executionId??""));if(!L)throw Error("Regional execution was not found.");let O=E.get(L.topologyId);if(!O)throw Error("Regional topology was not found.");try{let c;if(L.kind==="rollout")c=await t(S,L,O,A);else if(L.kind==="failover"||L.kind==="failback")c=await R(S,L,O);else if(L.kind==="destroy")c=await h(S,L,O,A);else throw Error("Regional reconciliation is not configured.");return E.updateExecution(L.id,{status:"succeeded",currentStep:void 0}),{executionId:L.id,...c}}catch(c){if(E.updateExecution(L.id,{status:S.cancellationRequested()?"cancelled":"failed",error:c instanceof Error?c.message:String(c)}),E.get(O.id)?.status!=="destroyed")E.updateTopology(O.id,{status:"failed"});throw c}};return{"region.rollout":N,"region.failover":N,"region.failback":N,"region.destroy":N,"region.reconcile":N}}class IX{provider;reason;constructor(E,_="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=_}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function uk(){let E=await p(),_=iE(process.cwd(),E),T=new c0(_.store),r=new U0(T);return{controlPlane:_,store:T,service:r}}async function sh(E){let _=await uk();try{await E(_)}catch(T){Q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var $0=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((r)=>r.id===_||r.name===_);if(!T)throw Error("Regional topology was not found.");return T},vk=(E)=>E.split(",").map((_,T)=>{let[r,d="aws"]=_.split(":");return{region:String(r),provider:d,role:T===0?"primary":"secondary"}}),nk=(E)=>{let _=new Set(["s3","dynamodb","secrets"]),T=E.split(",").map((d)=>d.trim()),r=T.find((d)=>!_.has(d));if(r)throw Error(`Unsupported replication kind: ${r}`);return T};function wX(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(_)=>sh((T)=>{let r=T.store.list(T.controlPlane.project.id).map((d)=>({topology:d,targets:T.store.targets(d.id),channels:T.store.channels(d.id),route:T.store.route(d.id),executions:T.store.executions(d.id)}));if(_.json)console.log(JSON.stringify(r,null,2));else o(["Name","Hostname","Active","Status","Revision","Replication"],r.map((d)=>[d.topology.name,d.topology.hostname,d.topology.activeRegion,d.topology.status,d.topology.revision??"—",`${d.channels.filter((t)=>t.status==="in_sync").length}/${d.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(_,T)=>sh((r)=>{if(!T.hostname||!T.regions)throw Error("--hostname and --regions are required.");let d=r.service.create({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:_,hostname:T.hostname,regions:vk(T.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:nk(String(T.replicate)),maxLagSeconds:Number(T.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!T.cdn,wafEnabled:!!T.waf});Z(`Created ${d.name} (${d.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(_,T,r)=>sh((d)=>o(["Step"],d.service.plan($0(d,_).id,T,r.target).map((t)=>[t])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(_,T,r)=>sh(async(d)=>{let t=r.manifest?await Bun.file(r.manifest).json():{},R=d.service.enqueue({topologyId:$0(d,_).id,kind:"rollout",revision:T,manifest:t});Z(`Regional rollout queued: ${R.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(_,T)=>sh((r)=>{let d=r.service.enqueue({topologyId:$0(r,_).id,kind:"failover",targetRegion:T});Z(`Failover queued: ${d.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(_,T)=>sh((r)=>{let d=r.service.enqueue({topologyId:$0(r,_).id,kind:"failback",targetRegion:T});Z(`Failback queued: ${d.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(_,T)=>sh((r)=>{let d=r.service.enqueue({topologyId:$0(r,_).id,kind:"destroy",confirmation:T.confirm});Z(`Regional teardown queued: ${d.operation.id}; replicated data remains retained.`)}))}fE();var D0="0.7.103";import{createHash as eX,createPublicKey as xP,verify as ik}from"node:crypto";function C0(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(C0).join(",")}]`;return`{${Object.keys(E).sort().map((_)=>`${JSON.stringify(_)}:${C0(E[_])}`).join(",")}}`}var bP=(E)=>eX("sha256").update(C0(E)).digest("hex"),t$=(E)=>eX("sha256").update(C0(E)).digest("hex"),kP=(E)=>eX("sha256").update(xP(E).export({type:"spki",format:"der"})).digest("hex");function uP(E,_,T){try{return ik(null,Buffer.from(C0(E)),xP(T),Buffer.from(_,"base64"))}catch{return!1}}var qP=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((_)=>Number(_)||0),gP=(E,_)=>{let T=qP(E),r=qP(_);for(let d=0;d<3;d++){let t=(T[d]??0)-(r[d]??0);if(t)return t}return 0};function vP(E,_){let T=[];if(_.schemaVersion<E.minimumSchema)T.push(`schema ${_.schemaVersion} is below ${E.minimumSchema}`);if(_.schemaVersion>E.maximumSchema)T.push(`schema ${_.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&gP(_.currentVersion,E.minimumVersion)<0)T.push(`platform ${_.currentVersion} is below ${E.minimumVersion}`);if(gP(E.version,_.currentVersion)<=0)T.push(`version ${E.version} is not newer than ${_.currentVersion}`);if(!E.artifacts.some((r)=>r.platform===_.platform&&r.architecture===_.architecture))T.push(`no artifact for ${_.platform}/${_.architecture}`);return{compatible:T.length===0,reasons:T}}var bt=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},jT=(E)=>E==null?void 0:String(E),ak=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:jT(E.revoked_at),createdAt:String(E.created_at)}),nP=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:bt(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:bt(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),lP=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:bt(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),iP=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:jT(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:bt(E.health_gate,{}),status:String(E.status),currentStage:jT(E.current_stage),backupId:jT(E.backup_id),approvedBy:jT(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),XX=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:jT(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:bt(E.evidence,{}),error:jT(E.error),startedAt:jT(E.started_at),finishedAt:jT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),aP=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:bt(E.criteria,{}),candidates:bt(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:jT(E.confirmation),expiresAt:String(E.expires_at),result:bt(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),mP=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:jT(E.backup_policy_id),recoveryPointId:jT(E.recovery_point_id),topologyId:jT(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:jT(E.operation_id),evidence:bt(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:jT(E.error),startedAt:jT(E.started_at),finishedAt:jT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class I0{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}addTrustedKey(E){let _=this.id(),T=this.now().toISOString(),r=kP(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[_,E.organizationId,E.name,E.publicKeyPem,r,T]),this.key(_)}key(E){let _=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return _?ak(_):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let _=this.key(E.keyId);if(!_||_.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(_.revokedAt)throw Error("Update signing key is revoked.");if(!uP(E.document,E.signature,_.publicKeyPem))throw Error("Update manifest signature is invalid.");let T=vP(E.document,E.current),r=bP(E.document),d=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[d,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,r,JSON.stringify(E.document),E.signature,JSON.stringify(T),t]),this.manifest(d)}manifest(E){let _=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return _?nP(_):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(nP)}createWindow(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[_,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,T,T]),this.window(_)}window(E){let _=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return _?lP(_):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(lP)}createCampaign(E){return this.control.transaction(()=>{let _=this.manifest(E.manifestId);if(!_?.compatibility.compatible||_.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let T=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[T,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,r,r]),E.targets.forEach((d,t)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,d.serverId??null,d.target,E.strategy==="canary"?t===0?0:1+Math.floor((t-1)/E.batchSize):Math.floor(t/E.batchSize),d.previousVersion,r,r])),this.campaign(T)})}campaign(E){let _=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return _?iP(_):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(iP)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(XX)}updateCampaign(E,_){let T=this.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let r={...T,..._};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[r.status,r.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!T)throw Error("Upgrade target was not found.");let r={...XX(T),..._};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.evidence),r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),XX(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let _=[...E.candidates].sort((R,h)=>R.id.localeCompare(h.id)),T=t$(_),r=this.id(),d=this.now().toISOString(),t=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[r,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(_),T,_.reduce((R,h)=>R+h.bytes,0),t,d,d]),this.cleanup(r)}cleanup(E){let _=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return _?aP(_):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(aP)}updateCleanup(E,_){let T=this.cleanup(E);if(!T)throw Error("Cleanup plan was not found.");let r={...T,..._};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[r.status,r.confirmation??null,JSON.stringify(r.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[_,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,T,T]),this.drill(_)}drill(E){let _=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return _?mP(_):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(mP)}updateDrill(E,_){let T=this.drill(E);if(!T)throw Error("DR drill was not found.");let r={...T,..._};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,r.operationId??null,JSON.stringify(r.evidence),r.measuredRpoMinutes??null,r.measuredRtoMinutes??null,r.cleanupVerified?1:0,r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}function mk(E,_=new Date){if(!E.enabled)return!1;let T=new Date(E.schedule);if(!Number.isNaN(T.getTime()))return _>=T&&_.getTime()<=T.getTime()+E.durationMinutes*60000;let r=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!r)return!1;let d=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(_),t=Number(d.find((h)=>h.type==="hour")?.value)*60+Number(d.find((h)=>h.type==="minute")?.value),R=Number(r[1])*60+Number(r[2]);return t>=R&&t<R+E.durationMinutes}class w0{store;now;queue;constructor(E,_,T=()=>new Date){this.store=E;this.now=T;this.queue=_??new lE(E.control)}enqueueCampaign(E,_={}){let T=this.store.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let r=T.windowId?this.store.window(T.windowId):void 0;if(r&&!r.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(r&&!_.overrideWindow&&!mk(r,this.now()))throw Error("Upgrade is outside its maintenance window.");if(r?.requireApproval&&!_.approvedBy&&!T.approvedBy)throw Error("Maintenance approval is required.");let d=this.queue.enqueue({projectId:T.projectId,actorId:_.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:d}}async previewCleanup(E,_){let T=_.find((r)=>r.kind===E.kind);if(!T)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await T.discover(E.criteria)})}enqueueCleanup(E,_){let T=this.store.cleanup(E);if(!T||T.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(T.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let r=`DELETE ${T.candidates.length} ${T.kind}`;if(_!==r)throw Error(`Exact confirmation ${r} is required.`);let d=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${T.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:_}),operation:d}}enqueueDrill(E){let _=this.store.drill(E);if(!_||_.status!=="planned")throw Error("A planned DR drill is required.");let T=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${_.scenario}:${_.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:T.id}),operation:T}}}var JX=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function sP(E){return{"maintenance.upgrade":async(d)=>{let t=E.store.campaign(String(JX(d.operation.input).campaignId??""));if(!t||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let R=E.store.manifest(t.manifestId);if(!R?.compatibility.compatible||R.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let h=R.document.artifacts.find((S)=>S.platform===process.platform&&S.architecture===process.arch)??R.document.artifacts[0];if(!h)throw Error("No update artifact matches this platform.");E.store.updateCampaign(t.id,{status:"running",currentStage:"preflight"});let N=[];try{for(let S of[...new Set(E.store.targets(t.id).map((A)=>A.cohort))].sort((A,L)=>A-L)){E.store.updateCampaign(t.id,{currentStage:`cohort:${S}`});for(let A of E.store.targets(t.id).filter((L)=>L.cohort===S)){d.throwIfCancellationRequested(),d.checkpoint(`download:${A.target}`,"Downloading signed platform artifact."),E.store.updateTarget(A.id,{status:"downloading",startedAt:new Date().toISOString()});let L=await E.platform.download({target:A,artifact:h,signal:d.signal});if(L.sha256!==h.sha256)throw Error(`Artifact checksum mismatch for ${A.target}.`);d.checkpoint(`install:${A.target}`,"Installing verified artifact."),E.store.updateTarget(A.id,{status:"installing"}),await E.platform.install({target:A,path:L.path,version:R.version,signal:d.signal}),N.push(A);let O=await E.platform.health({target:A,gate:t.healthGate});if(!O.healthy)throw Error(`Upgrade health gate failed for ${A.target}.`);E.store.updateTarget(A.id,{status:"healthy",evidence:O.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(t.id,{status:"succeeded",currentStage:void 0}),{campaignId:t.id,version:R.version,targets:N.length}}catch(S){E.store.updateCampaign(t.id,{status:"rolling_back",currentStage:"rollback"});for(let A of N.reverse())E.store.updateTarget(A.id,{status:"rolling_back"}),await E.platform.rollback({target:A,version:A.previousVersion,signal:d.signal}),E.store.updateTarget(A.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(t.id,{status:"rolled_back",currentStage:void 0}),S}},"maintenance.cleanup":async(d)=>{let t=E.store.cleanup(String(JX(d.operation.input).planId??""));if(!t||t.status!=="approved")throw Error("Approved cleanup plan was not found.");if(t$([...t.candidates].sort((A,L)=>A.id.localeCompare(L.id)))!==t.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let R=E.cleanup?.find((A)=>A.kind===t.kind);if(!R)throw Error(`No ${t.kind} cleanup driver is configured.`);E.store.updateCleanup(t.id,{status:"running"});let h=[],N=[];for(let A of t.candidates){d.throwIfCancellationRequested();try{await R.remove(A),h.push(A.id)}catch(L){N.push({id:A.id,error:L instanceof Error?L.message:String(L)})}}let S=N.length?h.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(t.id,{status:S,result:{removed:h,failed:N,reclaimedBytes:t.candidates.filter((A)=>h.includes(A.id)).reduce((A,L)=>A+L.bytes,0)}}),N.length)throw Error(`Cleanup failed for ${N.length} candidate(s).`);return{planId:t.id,removed:h.length,reclaimedBytes:t.estimatedBytes}},"maintenance.drill":async(d)=>{let t=E.store.drill(String(JX(d.operation.input).drillId??""));if(!t)throw Error("DR drill was not found.");let R=E.recovery?.find((L)=>L.scenario===t.scenario);if(!R)throw Error(`No ${t.scenario} recovery driver is configured.`);let h=new Date;E.store.updateDrill(t.id,{status:"restoring",startedAt:h.toISOString()});let N=t.isolatedTarget,S={},A={};try{d.checkpoint("restore","Restoring into isolated drill target.");let L=await R.restore({drill:t,signal:d.signal});if(!L.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");N=L.target,S=L.evidence;let O=(h.getTime()-new Date(L.recoveryPointAt).getTime())/60000;E.store.updateDrill(t.id,{status:"verifying",measuredRpoMinutes:O,evidence:{restore:S}}),d.checkpoint("verify","Running recovery health checks without production traffic.");let c=await R.verify({drill:t,target:N});A=c.evidence;let $=(Date.now()-h.getTime())/60000;if(!c.healthy||O>t.expectedRpoMinutes||$>t.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(t.id,{measuredRpoMinutes:O,measuredRtoMinutes:$,evidence:{restore:S,verify:A}})}catch(L){throw E.store.updateDrill(t.id,{status:"failed",error:L instanceof Error?L.message:String(L),evidence:{restore:S,verify:A}}),L}finally{E.store.updateDrill(t.id,{status:"cleaning"});try{await R.cleanup({drill:t,target:N});let L=E.store.drill(t.id);E.store.updateDrill(t.id,{status:L.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(L){E.store.updateDrill(t.id,{status:"cleanup_required",cleanupVerified:!1,error:L instanceof Error?L.message:String(L),finishedAt:new Date().toISOString()})}}return{drillId:t.id,status:E.store.drill(t.id).status}}}}var pP={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class e0{kind;control;projectId;organizationId;constructor(E,_,T,r){this.kind=E;this.control=_;this.projectId=T;this.organizationId=r}async discover(E){let _=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),T=new Date(Date.now()-_*86400000).toISOString(),r=pP[this.kind],d=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(r.select).all(d,T).map((R)=>({id:String(R.id),kind:this.kind,label:`${this.kind}:${String(R.id)}`,bytes:Number(R.bytes??0),metadata:{createdAt:String(R.created_at)}}))}async remove(E){if(this.control.database.run(pP[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function sk(){let E=await p(),_=iE(process.cwd(),E),T=new I0(_.store),r=new w0(T),d=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((t)=>new e0(t,_.store,_.project.id,_.organization.id));return{controlPlane:_,store:T,service:r,cleanup:d}}async function kt(E){let _=await sk();try{await E(_)}catch(T){Q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}function zX(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(_)=>kt((T)=>{let r={manifests:T.store.manifests(T.controlPlane.organization.id),windows:T.store.windows(T.controlPlane.project.id),campaigns:T.store.campaigns(T.controlPlane.project.id),cleanups:T.store.cleanups(T.controlPlane.project.id),drills:T.store.drills(T.controlPlane.project.id)},d=[...r.manifests.map((t)=>["update",t.version,t.compatibility.compatible?"compatible":"blocked",t.compatibility.reasons.join("; ")||t.channel]),...r.campaigns.map((t)=>["upgrade",t.id,t.status,t.currentStage??t.fromVersion]),...r.cleanups.map((t)=>["cleanup",t.kind,t.status,`${t.candidates.length} items / ${t.estimatedBytes} bytes`]),...r.drills.map((t)=>["DR drill",t.scenario,t.status,t.isolatedTarget])];if(_.json)console.log(JSON.stringify(r,null,2));else o(["Area","Name / version","Status","Detail"],d)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(_,T)=>kt(async(r)=>{let d=r.store.addTrustedKey({organizationId:r.controlPlane.organization.id,name:_,publicKeyPem:await Bun.file(T).text()});Z(`Trusted ${d.name}: ${d.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(_,T,r)=>kt(async(d)=>{let t=await Bun.file(_).json(),R=(await Bun.file(T).text()).trim(),h=d.store.importManifest({organizationId:d.controlPlane.organization.id,keyId:r,document:t,signature:R,current:{schemaVersion:d.controlPlane.store.health().schemaVersion,currentVersion:D0,platform:process.platform,architecture:process.arch}});Z(`Verified ${h.version}; ${h.compatibility.compatible?"compatible":"blocked: "+h.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(_,T,r)=>kt((d)=>{let t=d.store.createWindow({projectId:d.controlPlane.project.id,name:_,schedule:T,timezone:r.timezone,durationMinutes:Number(r.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});Z(`Created ${t.name} (${t.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(_,T,r)=>kt((d)=>{let t=new Tt(d.controlPlane.store).list(d.controlPlane.project.id).filter((N)=>N.status==="ready").map((N)=>({serverId:N.id,target:N.name,previousVersion:N.bootstrapVersion??D0}));if(!t.length)t.push({target:"control-plane",previousVersion:D0});let R=d.store.createCampaign({projectId:d.controlPlane.project.id,manifestId:_,fromVersion:D0,strategy:r.strategy==="rolling"?"rolling":"canary",batchSize:Number(r.batch),healthGate:{kind:"platform"},backupId:T,targets:t}),h=d.service.enqueueCampaign(R.id);Z(`Staged upgrade queued: ${h.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(_,T)=>kt(async(r)=>{let d=await r.service.previewCleanup({projectId:r.controlPlane.project.id,kind:_,criteria:{olderThanDays:Number(T.olderThan)}},r.cleanup);o(["ID","Candidate","Bytes"],d.candidates.map((t)=>[t.id,t.label,String(t.bytes)])),U(`Apply with: cloud cleanup:apply ${d.id} --confirm "DELETE ${d.candidates.length} ${d.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(_,T)=>kt((r)=>{let d=r.service.enqueueCleanup(_,String(T.confirm??""));Z(`Cleanup queued: ${d.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(_,T,r)=>kt((d)=>{let t=d.store.createDrill({projectId:d.controlPlane.project.id,scenario:_,isolatedTarget:T,expectedRpoMinutes:Number(r.rpo),expectedRtoMinutes:Number(r.rto),recoveryPointId:r.recoveryPoint,topologyId:r.topology});Z(`Planned isolated drill ${t.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(_)=>kt((T)=>{let r=T.service.enqueueDrill(_);Z(`DR drill queued: ${r.operation.id}`)}))}fE();sR();Mr();async function FX(){try{return(await p()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function jX(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(_)=>{b("Lambda Functions");let T=_?.region||await FX(),r=new B_(T);try{let{Functions:d=[]}=await r.listFunctions({MaxItems:50});if(!d.length){U("No functions found");return}o(["Name","Runtime","Memory","Timeout","Last Modified"],d.map((t)=>[t.FunctionName??"-",t.Runtime??"-",t.MemorySize?`${t.MemorySize} MB`:"-",t.Timeout?`${t.Timeout}s`:"-",t.LastModified??"-"]))}catch(d){Q(`Failed to list functions: ${d.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(_,T)=>{b(`Invoking ${_}`);let r=T?.region||await FX(),d=new B_(r),t=new n("Invoking function...");t.start();try{let R=await d.invoke({FunctionName:_,InvocationType:T?.async?"Event":"RequestResponse",Payload:T?.payload||"{}",LogType:T?.async?"None":"Tail"});if(R.FunctionError){if(t.fail(`Function returned an error (${R.FunctionError})`),R.Payload)U(R.Payload);process.exitCode=1;return}if(t.succeed(`Invoked (status ${R.StatusCode})`),R.Payload)U(`
+`).find((d)=>d&&!d.startsWith("#"))?.trim().split(/\s+/);if(T.code!==0||!r?.[1]||!r[2])throw Error(`SSH host-key scan failed: ${T.stderr.trim()||"no key returned"}`);return{algorithm:r[1],key:r[2]}}async exec(E,_){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return WP(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,_])}}var Pk=(E)=>`SHA256:${Hk("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,yk=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class qt{provider;transport;discoverer;constructor(E,_=new HP,T){this.provider=E;this.transport=_;this.discoverer=T}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let _=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:_.algorithm,hostKeyFingerprint:Pk(_.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let _=await this.transport.exec(E,yk);if(_.code!==0)throw Error(`Fleet validation failed: ${_.stderr.trim()||_.code}`);try{return JSON.parse(_.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,_){let T=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${_.length}`);if(T.code!==0)throw Error(`Fleet bootstrap failed: ${T.stderr.trim()||T.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function PP(E,_){return{"fleet.bootstrap":async(T)=>{let r=T.operation.input&&typeof T.operation.input==="object"&&!Array.isArray(T.operation.input)?T.operation.input:{},d=E.get(String(r.serverId??""));if(!d)throw Error("Queued fleet server was not found.");let t=_.find((N)=>N.provider===d.provider);if(!t)throw Error(`No ${d.provider} fleet driver is configured.`);let R=Array.isArray(r.steps)?r.steps.map(String):[];if(T.checkpoint("preflight","Rechecking pinned trust and healthy validation."),d.trustState!=="pinned"||!d.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");T.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let h=await t.bootstrap(d,R);return E.update(d.id,{bootstrapVersion:h.version,status:"ready"}),T.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:d.id,bootstrapVersion:h.version,steps:R.length}}}}var _t=(E)=>E==null?void 0:String(E),ah=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},LX=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:_t(E.provider_id),region:_t(E.region),zone:_t(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:_t(E.host_key_algorithm),hostKeyFingerprint:_t(E.host_key_fingerprint),pendingHostKey:_t(E.pending_host_key),roles:ah(E.roles,[]),labels:ah(E.labels,{}),taints:ah(E.taints,[]),capacity:ah(E.capacity,{}),usage:ah(E.usage,{}),capabilities:ah(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:ah(E.validation,void 0),bootstrapVersion:_t(E.bootstrap_version),heartbeatAt:_t(E.heartbeat_at),lastSeenAt:_t(E.last_seen_at),archivedAt:_t(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class Tt{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}get(E){let _=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return _?LX(_):void 0}list(E,_=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(LX).filter((T)=>_||T.status!=="archived")}findProvider(E,_,T){let r=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,_,T);return r?LX(r):void 0}create(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,T,T]),this.get(_)}update(E,_){let T=this.get(E);if(!T)throw Error("Server was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[r.name,r.providerId??null,r.region??null,r.zone??null,r.endpoint,r.sshUser,r.sshPort,r.credentialRef,r.hostKeyAlgorithm??null,r.hostKeyFingerprint??null,r.pendingHostKey??null,JSON.stringify(r.roles),JSON.stringify(r.labels),JSON.stringify(r.taints),JSON.stringify(r.capacity),JSON.stringify(r.usage),JSON.stringify(r.capabilities),r.status,r.trustState,JSON.stringify(r.validation??{}),r.bootstrapVersion??null,r.heartbeatAt??null,r.lastSeenAt??null,r.archivedAt??null,d,E]),this.get(E)}}var Yk=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class N0{store;drivers;now;queue;constructor(E,_,T,r=()=>new Date){this.store=E;this.drivers=_;this.now=r;this.queue=T??new lE(E.control)}driver(E){let _=this.drivers.find((T)=>T.provider===E);if(!_)throw Error(`No ${E} fleet driver is configured.`);return _}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!Yk.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let _=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(_)return this.store.update(_.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let T=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),r=this.driver(E.provider);return this.store.create({...E,resourceId:T.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:r.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let T=await this.driver(_.provider).test(_);if(!T.reachable)return this.store.update(E,{status:"unreachable"});if(_.hostKeyFingerprint&&_.hostKeyFingerprint!==T.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:T.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:T.hostKeyAlgorithm,hostKeyFingerprint:T.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,_){let T=this.store.get(E);if(!T||T.pendingHostKey!==_)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:_,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let _=this.store.get(E);if(!_||_.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let T=await this.driver(_.provider).validate(_),r=[];if(!["x64","arm64","x86_64","aarch64"].includes(T.arch??""))r.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let R of["curl","tar"])if(!T.tools?.[R])r.push({code:`tool.${R}`,severity:"error",message:`${R} is missing.`,remediation:`Install ${R} before bootstrap.`});if(Math.abs(T.timeSkewSeconds??0)>60)r.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!T.dnsOk)r.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let d={valid:!r.some((R)=>R.severity==="error"),facts:T,findings:r,validatedAt:this.now().toISOString(),validatorVersion:"1"},t={cpu:T.cpuCores??0,memoryBytes:T.memoryBytes??0,diskBytes:T.diskBytes??0};return this.store.update(E,{validation:d,capacity:t,status:d.valid?"ready":"degraded"})}bootstrap(E,_=!1){let T=this.store.get(E);if(!T?.validation?.valid)throw Error("A healthy validation report is required.");let r=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!_)return{preview:!0,steps:r};let d=this.queue.enqueue({projectId:T.projectId,resourceId:T.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:r},lockKey:`server:${E}`,providerKey:T.provider}).operation;return{preview:!1,steps:r,operation:d}}heartbeat(E,_){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let r=this.now().toISOString();return this.store.update(E,{usage:_.usage,capabilities:_.capabilities??T.capabilities,heartbeatAt:r,lastSeenAt:r,status:T.status==="draining"||T.status==="drained"?T.status:"ready"})}drain(E,_=!1){return this.store.update(E,{status:_?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,_){let T=this.store.get(E);if(!T||_!==T.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function Qk(){let E=await p(),_=iE(process.cwd(),E),T=new Tt(_.store),r=new N0(T,[new qt("aws"),new qt("hetzner"),new qt("ssh")]);return{controlPlane:_,store:T,service:r}}async function gt(E){let _=await Qk();try{return await E(_)}finally{_.controlPlane.store.close()}}var mh=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((r)=>r.id===_||r.name===_);if(!T)throw Error(`Server ${_} was not found.`);return T},dd=(E)=>{Q(E instanceof Error?E.message:String(E)),process.exitCode=1};function OX(E,_){let T=Number.parseInt(E??"",10);return Number.isFinite(T)&&T>=0?T:_}function Gk(E="3h"){let _=E.match(/^(\d+)(m|h)$/);if(!_)throw Error("--range must use minutes or hours, for example 30m or 3h.");let T=Number(_[1])*(_[2]==="h"?3600000:60000);if(T<300000||T>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return T}function S0(E,_="%"){return E==null?"unavailable":`${E.toFixed(1)}${_}`}async function Mk(E,_){let T=await p();if(T.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let r=_.env??process.env.CLOUD_ENV??"production",d=I_(T,r),t=await Bd(d);if(!t?.serverId)throw Error(`No pinned Hetzner server was found for ${d}.`);if(![t.serverName,String(t.serverId),t.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${t.serverName}.`);let R=HS(T),h=new ft({apiToken:PS(R.apiToken,T)}),N=await h.getServer(t.serverId),S=t.publicIp??N.public_net.ipv4?.ip;if(!S)throw Error(`Server ${N.name} has no public IPv4 address.`);let A=new Date,L=new Date(A.getTime()-Gk(_.range)),O=Math.min(3600,Math.max(60,OX(_.step,60))),c=await LP({client:h,serverId:N.id,cores:Math.max(1,Number(N.server_type.cores)||1),from:L,to:A,step:O,remote:{host:S,user:t.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15}});if(_.json){console.log(JSON.stringify({schemaVersion:1,server:N.name,result:c},null,2));return}o(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[N.name,`${c.from} to ${c.to}`,`${S0(c.summary.cpuAveragePercent)} / ${S0(c.summary.cpuPeakPercent)}`,`${S0(c.summary.memoryAveragePercent)} / ${S0(c.summary.memoryPeakPercent)}`,c.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(c.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,S0(c.summary.swapPeakPercent)]])}function yP(E){let _=E.targetType.prices?.find((T)=>T.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:_?{hourlyNet:_.price_hourly.net,hourlyGross:_.price_hourly.gross,monthlyNet:_.price_monthly.net,monthlyGross:_.price_monthly.gross}:void 0}}function fk(E){let _=yP(E);o(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${_.serverName} (${_.serverId})`,_.location,`${_.from} -> ${_.to}`,_.capacityAvailable?"available":"waiting",`${_.target.cores??0} / ${_.target.memoryGb??0} GB / ${_.target.diskGb??0} GB`,_.price?.monthlyGross??_.price?.monthlyNet??"not reported"]])}async function Kk(E,_,T){let r=await p();if(r.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let d=T.env??process.env.CLOUD_ENV??"production",t=I_(r,d),R=await Bd(t),h=HS(r),N=new ft({apiToken:PS(h.apiToken,r)}),A=R&&(E===R.serverName||E===String(R.serverId)||E===R.stackName)?await N.getServer(R.serverId):(await N.listServers()).find((Y)=>Y.name===E||String(Y.id)===E);if(!A)throw Error(`Hetzner server ${E} was not found.`);if(R?.serverId&&R.serverId!==A.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${R.serverId}.`);let L=Kt(_),O=T.upgradeDisk!==!1,c=await h0(N,A.id,L,O);if(T.json)console.log(JSON.stringify({schemaVersion:1,plan:yP(c)},null,2));else fk(c);if(!T.apply){if(!T.json)U(`Preview only. Re-run with --apply --confirm ${A.name} to execute.`);return}if(T.confirm!==A.name)throw Error(`Resize requires --confirm ${A.name}.`);let $=R?.publicIp??A.public_net.ipv4?.ip;if(!$)throw Error(`Server ${A.name} has no public IPv4 address for verification.`);let C={host:$,user:R?.sshUser??h.sshUser,identityFile:h.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},I=await NX(t),e=new Date().toISOString(),z={schemaVersion:1,operationId:I?.targetType===L&&I.serverId===A.id?I.operationId:crypto.randomUUID(),stackName:t,serverId:A.id,serverName:A.name,sourceType:c.currentType.name,targetType:L,upgradeDisk:O,phase:"planning",status:"running",attempts:I?.targetType===L?I.attempts:0,startedAt:I?.targetType===L?I.startedAt:e,updatedAt:e,manifest:I?.targetType===L?I.manifest:void 0};await Zt(z);let F=OX(T.pollSeconds,900)*1000,B=OX(T.maxWaitMinutes,0)*60000,y=Date.now();for(;;){let Y=await h0(N,A.id,L,O);if(!Y.capacityAvailable&&!Y.alreadyComplete){if(z={...z,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await Zt(z),!T.wait){if(!T.json)U(`${L} has no capacity in ${Y.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(B>0&&Date.now()-y>=B)throw Error(`Timed out waiting for ${L} capacity in ${Y.location}.`);if(!T.json)U(`Waiting ${Math.round(F/1000)} seconds for ${L} capacity...`);await Bun.sleep(F);continue}let M=await SX(t);try{let V=await(async()=>{try{return z={...z,status:"running",attempts:z.attempts+1,updatedAt:new Date().toISOString()},await Zt(z),await TX({client:N,serverId:A.id,targetType:L,upgradeDisk:O,resumeFromOff:z.phase==="shutting-down"||z.phase==="resizing"||z.phase==="powering-on"||z.phase==="verifying",manifest:z.manifest,hooks:{preflight:async()=>{let g=await dX(C);return z={...z,manifest:g,updatedAt:new Date().toISOString()},await Zt(z),g},afterBoot:async(g,k,v,EE)=>tX(C,k,v,EE),onPhase:async(g,k)=>{if(z={...z,phase:g,status:g==="waiting-capacity"?"waiting-capacity":g==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await Zt(z),!T.json)U(`${g}${k?` ${JSON.stringify(k)}`:""}`)}}})}finally{await M()}})();if(z={...z,status:V.status==="completed"||V.status==="already-complete"?"completed":V.status==="recovered"?"recovered":"waiting-capacity",lastError:V.status==="recovered"?V.error:void 0,updatedAt:new Date().toISOString()},await Zt(z),T.json)console.log(JSON.stringify({schemaVersion:1,result:V},null,2));else if(V.status==="completed"||V.status==="already-complete")Z(`${A.name} is on ${L} and passed full post-boot verification.`);else if(V.status==="recovered"&&V.retryable&&T.wait){U(`Capacity race recovered safely. Waiting ${Math.round(F/1000)} seconds before retry.`),await Bun.sleep(F);continue}else if(V.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${V.error}`);return}catch(V){throw z={...z,status:"failed",lastError:V instanceof Error?V.message:String(V),updatedAt:new Date().toISOString()},await Zt(z),V}}}async function Vk(E,_){let T=await p();if(T.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let r=_.env??process.env.CLOUD_ENV??"production",d=I_(T,r),t=await Bd(d);if(!t?.serverId)throw Error(`No pinned Hetzner server was found for ${d}.`);if(![t.serverName,String(t.serverId),t.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${t.serverName}.`);let R=HS(T),h=new ft({apiToken:PS(R.apiToken,T)}),N=await h.getServer(t.serverId),S=t.publicIp??N.public_net.ipv4?.ip;if(!S)throw Error(`Server ${N.name} has no public IPv4 address.`);let A=oU(T);if(_.json)console.log(JSON.stringify({schemaVersion:1,server:N.name,plan:A},null,2));else o(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[N.name,A.firewallPorts.join(","),A.monitoring?"on":"off",A.autoUpdates?"on":"off",`${A.swapGb} GB`,"disabled"]]);if(!_.apply){if(!_.json)U(`Preview only. Re-run with --apply --confirm ${N.name} to execute.`);return}if(_.confirm!==N.name)throw Error(`Optimization requires --confirm ${N.name}.`);let L={host:S,user:t.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15},O=await VS(L),c=O.routeProbes.filter((v)=>!v.ok),$=T.infrastructure?.compute,C=$r($)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,I=O.failedUnits.filter((v)=>!C.has(v));if(I.length>0)throw Error(`Preflight found failed services: ${I.join(", ")}`);if(c.length>0)throw Error(`Preflight found unhealthy routes: ${c.map((v)=>v.domain).join(", ")}`);let e=$r($)?[]:Object.values(T.sites??{}).flatMap((v)=>typeof v?.port==="number"&&![80,443].includes(v.port)?[v.port]:[]),z=QS({allowSsh:$?.allowSsh!==!1,sitePorts:e,allowedPorts:$?.firewall?.allowedPorts}),F=(t.firewallId?(await h.listFirewalls()).find((v)=>v.id===t.firewallId):void 0)??(await h.listFirewalls()).find((v)=>v.name===`${T.project.slug}-${r}-app-fw`);if(!F)throw Error(`Managed firewall for ${N.name} was not found.`);let B=await h.setFirewallRules(F.id,z);await Promise.all(B.map((v)=>h.waitForAction(v.id))),await ae(T,L);let[y,Y]=await Promise.all([VS(L),me(L)]),M=se(A,Y),V=IP(O,y),g=y.routeProbes.filter((v)=>!v.ok);if(V.stoppedServices.length>0)M.push(`services stopped: ${V.stoppedServices.join(", ")}`);if(V.changedRouteFragments.length>0)M.push(`route fragments changed: ${V.changedRouteFragments.join(", ")}`);if(V.missingRouteIds.length>0)M.push(`routes disappeared: ${V.missingRouteIds.join(", ")}`);if(V.changedReleaseLinks.length>0)M.push(`release links changed: ${V.changedReleaseLinks.join(", ")}`);if(V.missingData.length>0)M.push(`databases or volumes disappeared: ${V.missingData.join(", ")}`);if(g.length>0)M.push(`unhealthy routes: ${g.map((v)=>v.domain).join(", ")}`);if(M.length>0)throw Error(`Host optimization verification failed: ${M.join("; ")}`);let k={serverId:N.id,serverName:N.name,services:y.runningServices.length,routes:y.routeIds.length,healthyDomains:y.routeProbes.length,releaseLinks:y.releaseLinks.length,databasesAndVolumes:y.dataCatalog.length,report:Y};if(_.json)console.log(JSON.stringify({schemaVersion:1,result:k},null,2));else Z(`${N.name} passed full host, rpx route, service, release, and data verification.`)}function cX(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(_,T)=>{try{await gt(async(r)=>{let d=_?[mh(r,_)]:r.store.list(r.controlPlane.project.id),t=d.flatMap((R)=>Object.entries(R.capabilities).map(([h,N])=>({server:R.name,provider:R.provider,action:h,...N})));if(T.json)console.log(JSON.stringify({schemaVersion:1,targets:t},null,2));else o(["Server","Provider","Action","Support","Explanation"],t.map((R)=>[R.server,R.provider,R.action,R.supported?"supported":"unsupported",R.reason??"—"]))})}catch(r){dd(r)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(_,T,r)=>{try{await Kk(_,T,r)}catch(d){dd(d)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(_,T)=>{try{await Vk(_,T)}catch(r){dd(r)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(_,T)=>{try{await Mk(_,T)}catch(r){dd(r)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(_)=>{try{await gt(async(T)=>{let r=T.store.list(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(r,null,2));else o(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],r.map((d)=>[d.name,d.providerId??"—",`${d.provider} / ${d.region??"external"}`,`${d.status} / ${d.trustState}`,d.roles.join(","),`${d.capacity.cpu??0} / ${d.capacity.memoryBytes??0}`,d.heartbeatAt??"never"]))})}catch(T){dd(T)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(_,T)=>{try{await gt(async(r)=>{let d=T.provider;if(!["aws","hetzner","ssh"].includes(d)||!T.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let t=r.service.enroll({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:_,provider:d,providerId:T.providerId,endpoint:T.endpoint,sshUser:T.user??"deploy",credentialRef:T.credentialRef??"secret://fleet/agent",region:T.region,roles:String(T.roles??"application").split(","),labels:Object.fromEntries(String(T.labels??"").split(",").map((R)=>R.split("=")).filter((R)=>R[0]&&R[1]))});Z(`Enrolled ${t.name} as ${t.id}; no remote mutation was performed.`)})}catch(r){dd(r)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(_,T)=>{try{await gt(async(r)=>{let d=mh(r,_);if(d=await r.service.test(d.id),d.trustState==="rotation_pending"){if(!T.acceptHostKey)throw Error(`Host key changed to ${d.pendingHostKey}; review it first.`);d=r.service.reviewHostKey(d.id,T.acceptHostKey)}let t=await r.service.validate(d.id);if(T.json)console.log(JSON.stringify(t.validation,null,2));else o(["Severity","Code","Finding","Remediation"],(t.validation?.findings??[]).map((R)=>[R.severity,R.code,R.message,R.remediation??"—"]));if(!t.validation?.valid)process.exitCode=1})}catch(r){dd(r)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(_,T)=>{try{await gt(async(r)=>{let d=r.service.bootstrap(mh(r,_).id,!!T.apply);if(d.preview)o(["Step"],d.steps.map((t)=>[t]));else Z(`Bootstrap queued: ${d.operation?.id}`)})}catch(r){dd(r)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(_,T)=>{try{await gt(async(r)=>Z(r.service.drain(mh(r,_).id,!!T.complete).status))}catch(r){dd(r)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(_)=>{try{await gt(async(T)=>{T.service.uncordon(mh(T,_).id),Z(`Uncordoned ${_}.`)})}catch(T){dd(T)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(_,T)=>{try{await gt(async(r)=>{r.service.archive(mh(r,_).id,T.confirm??""),Z(`Archived ${_}; provider infrastructure was not terminated.`)})}catch(r){dd(r)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(_)=>{try{await gt(async(T)=>{let r=mh(T,_);if(r.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let d=Bun.spawn(["ssh","-p",String(r.sshPort),"-o","StrictHostKeyChecking=yes",`${r.sshUser}@${r.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),t=await d.exited;if(t)process.exitCode=t})}catch(T){dd(T)}});for(let[_,T]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(_,T).action(async(...r)=>_d(_.split(" ")[0],{target:String(r[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}fE();var Wd=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},Dr=(E)=>E==null?void 0:String(E),GP=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),qS=(E={})=>({...GP(),...E});function YP(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:Dr(E.region),architecture:Dr(E.architecture),labels:Wd(E.labels,{}),requiredServerLabels:Wd(E.required_server_labels,{}),toleratedTaints:Wd(E.tolerated_taints,[]),capacity:qS(Wd(E.capacity,{})),reserved:Wd(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:Dr(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function QP(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Dr(E.environment_id),resourceId:String(E.resource_id),releaseId:Dr(E.release_id),poolId:String(E.pool_id),serverId:Dr(E.server_id),purpose:String(E.purpose),requirements:Wd(E.requirements,{}),decision:Wd(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Zk(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:Dr(E.resource_id),poolId:String(E.pool_id),placementId:Dr(E.placement_id),operationId:Dr(E.operation_id),sourceSha:String(E.source_sha),buildSpec:Wd(E.build_spec,{}),credentialPolicy:Wd(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:Dr(E.workspace),cacheKey:Dr(E.cache_key),artifactUri:Dr(E.artifact_uri),artifactDigest:Dr(E.artifact_digest),status:String(E.status),cleanupAt:Dr(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class A0{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}createPool(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(qS(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,T,T]),this.getPool(_)}getPool(E){let _=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return _?YP(_):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(YP)}updatePool(E,_){let T=this.getPool(E);if(!T)throw Error("Capacity pool was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.reserved),JSON.stringify(r.capacity),r.concurrency,d,E]),this.getPool(E)}addMember(E,_,T={}){let r=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,_,JSON.stringify(T),r,r])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((_)=>({serverId:String(_.server_id),status:String(_.status),capacityOverride:Wd(_.capacity_override,{})}))}memberStatus(E,_,T){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[T,this.now().toISOString(),E,_])}listPlacements(E,_){let T=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(QP);return _?.length?T.filter((r)=>_.includes(r.status)):T}getPlacement(E){let _=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return _?QP(_):void 0}activeUsage(E,_){let T=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),r=_?T.filter((d)=>String(d.server_id)===_):T;return{resources:r.reduce((d,t)=>{let R=qS(Wd(t.resources,{}));for(let h of Object.keys(d))d[h]+=R[h];return d},GP()),count:r.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let _=this.id(),T=this.id(),r=this.now().toISOString(),d=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[_,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,r,r]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[T,_,E.decision.poolId,E.decision.serverId??null,JSON.stringify(qS(E.requirements.resources)),d,r,r]),this.getPlacement(_)})}transitionPlacement(E,_){if(!this.getPlacement(E))throw Error("Placement was not found.");let r=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[_,r,E]),["released","failed","blocked"].includes(_))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[r,E]);return this.getPlacement(E)}createBuild(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[_,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),T,T]),this.getBuild(_)}getBuild(E){let _=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return _?Zk(_):void 0}updateBuild(E,_){let T=this.getBuild(E);if(!T)throw Error("Remote build was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[r.operationId??null,r.workspace??null,r.cacheKey??null,r.artifactUri??null,r.artifactDigest??null,r.status,r.cleanupAt??null,d,E]),this.getBuild(E)}}var r$=["cpu","memoryBytes","diskBytes","gpu"],MP=(E,_={})=>Object.entries(_).every(([T,r])=>E[T]===r),qk=(E,_,T)=>Object.fromEntries(r$.map((r)=>[r,Math.max(0,E[r]-_[r]-(T[r]??0))])),gk=(E,_)=>r$.every((T)=>E[T]>=(_[T]??0)),xk=(E,_)=>r$.reduce((T,r)=>T+(_[r]??0)/(E[r]||1),0);class L0{store;fleet;constructor(E,_){this.store=E;this.fleet=_}poolCandidates(E,_,T){let r=[];for(let d of this.store.listPools(E)){if(d.id===T)continue;let t=[];if(d.status!=="active")t.push(`pool is ${d.status}`);if(d.purpose!==_.purpose)t.push(`purpose is ${d.purpose}`);if(_.region&&d.region!==_.region)t.push(`region is ${d.region??"unset"}`);if(_.architecture&&d.architecture!==_.architecture)t.push(`architecture is ${d.architecture??"unset"}`);if(!MP(d.labels,_.labels))t.push("pool labels do not match");if(d.backend==="server"){let R=this.store.members(d.id);if(!R.length)r.push(this.decision(d,void 0,_,[...t,"pool has no servers"]));for(let h of R){let N=this.fleet.get(h.serverId),S=[...t];if(!N)S.push("server is missing");else this.serverReasons(d,N,h.status,_,S);r.push(this.decision(d,N,_,S,h.capacityOverride))}}else r.push(this.decision(d,void 0,_,t))}return r.sort((d,t)=>Number(t.eligible)-Number(d.eligible)||d.score.cost-t.score.cost||d.score.spread-t.score.spread||d.score.fit-t.score.fit||d.poolName.localeCompare(t.poolName)||(d.serverId??"").localeCompare(t.serverId??""))}serverReasons(E,_,T,r,d){if(T!=="active")d.push(`member is ${T}`);if(_.status!=="ready")d.push(`server is ${_.status}`);if(!_.roles.includes(r.purpose==="build"?"build":r.purpose))d.push(`server lacks ${r.purpose} role`);if(!MP(_.labels,E.requiredServerLabels))d.push("server labels do not match pool selector");for(let t of _.taints)if(!E.toleratedTaints.includes(t))d.push(`taint ${t} is not tolerated`)}decision(E,_,T,r,d={}){let t=qS({..._?.capacity,...d}),R=_?Object.fromEntries(r$.map((S)=>[S,Math.min(E.capacity[S],t[S])])):E.capacity,h=this.store.activeUsage(E.id,_?.id),N=qk(R,h.resources,E.reserved);if(h.count>=E.maxWorkloads)r.push("workload limit reached");if(T.purpose==="build"&&h.count>=E.concurrency)r.push("build concurrency reached");if(!gk(N,T.resources))r.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:_?.id,eligible:r.length===0,reasons:r,available:N,score:{fit:xk(N,T.resources),spread:h.count,cost:E.costWeight}}}explain(E,_){return this.poolCandidates(E,_)}place(E){return this.store.control.transaction(()=>{let _=this.poolCandidates(E.projectId,E.requirements).find((T)=>T.eligible);if(!_)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((T)=>T.reasons).join("; ")}`);return this.store.reserve({...E,decision:_})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let _=this.store.updatePool(E,{status:"draining"}),T=[],r=[];for(let d of this.store.listPlacements(_.projectId,["reserved","active"]).filter((t)=>t.poolId===E)){if(d.stateful){r.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"moving");let t=this.place({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements});T.push(this.activate(t.id)),this.store.transitionPlacement(d.id,"released")}return{pool:_,moved:T,blocked:r}}drainServer(E,_){this.store.memberStatus(E,_,"draining");let T=this.store.getPool(E);if(!T)throw Error("Capacity pool was not found.");let r=[],d=[];for(let t of this.store.listPlacements(T.projectId,["reserved","active"]).filter((R)=>R.poolId===E&&R.serverId===_)){if(t.stateful){d.push(this.store.transitionPlacement(t.id,"blocked"));continue}this.store.transitionPlacement(t.id,"moving");let R=this.poolCandidates(t.projectId,t.requirements).find((N)=>N.eligible);if(!R){d.push(this.store.transitionPlacement(t.id,"blocked"));continue}let h=this.store.reserve({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,releaseId:t.releaseId,requirements:t.requirements,decision:R});r.push(this.activate(h.id)),this.store.transitionPlacement(t.id,"released")}return{moved:r,blocked:d}}reconcileFailure(E){let _=this.fleet.get(E);if(!_)throw Error("Server was not found.");let T=[],r=[];for(let d of this.store.listPlacements(_.projectId,["active"]).filter((t)=>t.serverId===E)){if(d.stateful||!d.autoReschedule){r.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"failed");let t=this.place({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements});T.push(this.activate(t.id))}return{rescheduled:T,blocked:r}}}async function bk(){let E=await p(),_=iE(process.cwd(),E),T=new A0(_.store),r=new L0(T,new Tt(_.store));return{controlPlane:_,store:T,service:r}}async function O0(E){let _=await bk();try{await E(_)}catch(T){Q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var d$=(E)=>Object.fromEntries(String(E??"").split(",").map((_)=>_.split("=")).filter((_)=>_[0]&&_[1])),fP=(E)=>Object.fromEntries(Object.entries(d$(E)).map(([_,T])=>[_,Number(T)]));function UX(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(_)=>O0((T)=>{let r=T.store.listPools(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(r,null,2));else o(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],r.map((d)=>[d.name,d.purpose,d.backend,`${d.region??"any"} / ${d.architecture??"any"}`,d.status,JSON.stringify(d.capacity),String(d.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(_,T)=>O0((r)=>{let{purpose:d,backend:t}=T;if(!["application","build","worker","monitoring","backup"].includes(d)||!["server","ecs","asg"].includes(t))throw Error("Unsupported pool purpose or backend.");let R=r.store.createPool({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:_,purpose:d,backend:t,region:T.region,architecture:T.arch,labels:d$(T.labels),requiredServerLabels:d$(T.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...fP(T.capacity)},maxWorkloads:Number(T.max),costWeight:1,concurrency:Number(T.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});Z(`Created ${R.name} (${R.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(_,T)=>O0((r)=>{let d=r.store.listPools(r.controlPlane.project.id).find((R)=>R.id===_||R.name===_),t=new Tt(r.controlPlane.store).list(r.controlPlane.project.id).find((R)=>R.id===T||R.name===T);if(!d||!t)throw Error("Pool or server was not found.");r.store.addMember(d.id,t.id),Z(`Attached ${t.name} to ${d.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(_)=>O0((T)=>{let r=T.service.explain(T.controlPlane.project.id,{purpose:_.purpose,resources:fP(_.resources),region:_.region,architecture:_.arch,labels:d$(_.labels)});if(_.json)console.log(JSON.stringify(r,null,2));else o(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],r.map((d)=>[d.poolName,d.serverId??"provider-managed",d.eligible?"yes":"no",JSON.stringify(d.available),`${d.score.fit.toFixed(2)} / ${d.score.spread} / ${d.score.cost}`,d.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(_)=>O0((T)=>{let r=T.store.listPools(T.controlPlane.project.id).find((t)=>t.id===_||t.name===_);if(!r)throw Error("Pool was not found.");let d=T.service.drainPool(r.id);Z(`Draining ${r.name}: moved ${d.moved.length}, blocked ${d.blocked.length} stateful placement(s).`)}))}fE();var xt=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},td=(E)=>E==null?void 0:String(E),KP=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:td(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:xt(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:xt(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:td(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),$X=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:td(E.stack_id),stackRevision:td(E.stack_revision),status:String(E.status),health:xt(E.health,{}),lastHealthyAt:td(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),DX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:xt(E.config,{}),status:String(E.status),checkpoint:td(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:td(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),CX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:xt(E.weights,{}),desiredWeights:xt(E.desired_weights,{}),status:String(E.status),providerState:xt(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),VP=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:td(E.operation_id),kind:String(E.kind),requestedRegion:td(E.requested_region),revision:td(E.revision),plan:xt(E.plan,[]),currentStep:td(E.current_step),completedSteps:xt(E.completed_steps,[]),status:String(E.status),error:td(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class c0{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((t)=>t.region)).size!==E.regions.length||E.regions.filter((t)=>t.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let _=E.regions.find((t)=>t.role==="primary"),T=this.id(),r=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[T,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,_.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),_.region,r,r]);for(let t of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),T,t.region,t.role,t.provider,r,r]);for(let t of E.dataPolicy.replicate)for(let R of E.regions)for(let h of E.regions.filter((N)=>N.region!==R.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,t,R.region,h.region,"{}",r,r]);let d=Object.fromEntries(E.regions.map((t)=>[t.region,t.region===_.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),T,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(d),JSON.stringify(d),r,r]),this.get(T)})}get(E){let _=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return _?KP(_):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(KP)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map($X)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(DX)}route(E){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return _?CX(_):void 0}updateTopology(E,_){let T=this.get(E);if(!T)throw Error("Regional topology was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[r.status,r.activeRegion,r.revision??null,JSON.stringify(r.regions),d,E]),this.get(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!T)throw Error("Regional target was not found.");let r=$X(T),d={...r,..._},t=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[d.role,d.stackId??null,d.stackRevision??null,d.status,JSON.stringify(d.health),d.lastHealthyAt??null,t,E]),$X(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,_){let T=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!T)throw Error("Replication channel was not found.");let r=DX(T),d={...r,..._},t=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[d.status,d.checkpoint??null,d.lagSeconds??null,d.lastVerifiedAt??null,t,E]),DX(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,_){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!T)throw Error("Traffic route was not found.");let r=CX(T),d={...r,..._},t=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(d.weights),JSON.stringify(d.desiredWeights),d.status,JSON.stringify(d.providerState),t,E]),CX(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[_,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),T,T]),this.execution(_)}execution(E){let _=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return _?VP(_):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(VP)}updateExecution(E,_){let T=this.execution(E);if(!T)throw Error("Regional execution was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[r.operationId??null,r.currentStep??null,JSON.stringify(r.completedSteps),r.status,r.error??null,d,E]),this.execution(E)}}class U0{store;queue;constructor(E,_){this.store=E;this.queue=_??new lE(E.control)}create(E){return this.store.create(E)}plan(E,_,T){if(!this.store.get(E))throw Error("Regional topology was not found.");let d=this.store.targets(E),t=this.store.channels(E);if(_==="rollout")return[...d.filter((R)=>R.role==="secondary").map((R)=>`apply:${R.region}`),...d.filter((R)=>R.role==="primary").map((R)=>`apply:${R.region}`),...t.map((R)=>`replicate:${R.kind}:${R.targetRegion}`),"traffic:activate"];if(_==="failover"||_==="failback")return[`health:${T}`,`replication:${T}`,`traffic:${T}`,`roles:${T}`];if(_==="destroy")return["traffic:drain",...d.filter((R)=>R.role==="secondary").map((R)=>`delete:${R.region}`),...d.filter((R)=>R.role==="primary").map((R)=>`delete:${R.region}`),"complete"];return["observe","repair"]}enqueue(E){let _=this.store.get(E.topologyId);if(!_)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!_.regions.some((t)=>t.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===_.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==_.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&_.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let T=this.plan(_.id,E.kind,E.targetRegion),r=this.store.createExecution({topologyId:_.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:T}),d=this.queue.enqueue({projectId:_.projectId,environmentId:_.environmentId,kind:`region.${E.kind}`,input:{executionId:r.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${_.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(r.id,{operationId:d.id}),{execution:this.store.execution(r.id),operation:d}}}var kk=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function ZP(E,_){let T=(S)=>{let A=_.find((L)=>L.provider===S.provider);if(!A)throw Error(`No ${S.provider} regional driver is configured.`);return A},r=(S,A,L)=>{S.throwIfCancellationRequested(),S.checkpoint(L,L),E.updateExecution(A.id,{status:"running",currentStep:L,completedSteps:[...E.execution(A.id).completedSteps,L]})},d=async(S,A)=>{let L=E.route(S.id);if(!L)throw Error("Regional traffic route was not found.");let O=E.targets(S.id).find(($)=>$.region===S.activeRegion)??E.targets(S.id)[0];if(!O)throw Error("Regional traffic target was not found.");E.updateRoute(L.id,{status:"applying",desiredWeights:A});let c=await T(O).applyTraffic({route:E.route(S.id),topology:S,weights:A});E.updateRoute(L.id,{status:Object.values(A).every(($)=>$===0)?"drained":"in_sync",weights:A,providerState:c.providerState})},t=async(S,A,L,O)=>{E.updateTopology(L.id,{status:"provisioning"});let c=A.revision,$=O.manifest??{},C=E.targets(L.id).sort((e,z)=>Number(e.role==="primary")-Number(z.role==="primary"));for(let e of C){r(S,A,`apply:${e.region}`),E.updateTarget(e.id,{status:"provisioning"});let z=await T(e).applyStack({target:e,revision:c,manifest:$,signal:S.signal}),F=await T(e).health({target:E.updateTarget(e.id,{stackId:z.stackId,stackRevision:c})});if(!F.healthy)throw Error(`Regional health gate failed in ${e.region}.`);E.updateTarget(e.id,{status:"ready",health:F.evidence,lastHealthyAt:new Date().toISOString()})}for(let e of E.channels(L.id)){r(S,A,`replicate:${e.kind}:${e.targetRegion}`),E.updateChannel(e.id,{status:"configuring"});let z=C.find((y)=>y.region===e.sourceRegion),F=await T(z).configureReplication({channel:e,topology:L}),B=await T(z).verifyReplication({channel:E.updateChannel(e.id,{checkpoint:F.checkpoint,lagSeconds:F.lagSeconds}),topology:L});if(!B.healthy||B.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${e.kind} replication to ${e.targetRegion} exceeds the RPO.`);E.updateChannel(e.id,{status:"in_sync",checkpoint:B.checkpoint,lagSeconds:B.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(S,A,"traffic:activate");let I=Object.fromEntries(L.regions.map((e)=>[e.region,e.region===L.activeRegion?100:0]));return await d(L,I),E.updateTopology(L.id,{status:"ready",revision:c}),{revision:c,activeRegion:L.activeRegion}},R=async(S,A,L)=>{let O=A.requestedRegion,c=E.targets(L.id).find((I)=>I.region===O);if(!c)throw Error("Requested regional target was not found.");E.updateTopology(L.id,{status:A.kind==="failover"?"failing_over":"failing_back"}),r(S,A,`health:${O}`);let $=await T(c).health({target:c});if(!$.healthy)throw Error(`Target region ${O} is unhealthy.`);E.updateTarget(c.id,{status:"ready",health:$.evidence,lastHealthyAt:new Date().toISOString()}),r(S,A,`replication:${O}`);for(let I of E.channels(L.id).filter((e)=>e.targetRegion===O)){let e=await T(c).verifyReplication({channel:I,topology:L});if(!e.healthy||e.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${I.kind} replication is outside the failover RPO.`);E.updateChannel(I.id,{status:"in_sync",checkpoint:e.checkpoint,lagSeconds:e.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(S,A,`traffic:${O}`),await d(L,Object.fromEntries(L.regions.map((I)=>[I.region,I.region===O?100:0]))),r(S,A,`roles:${O}`);let C=L.regions.map((I)=>({...I,role:I.region===O?"primary":"secondary"}));for(let I of E.targets(L.id))E.updateTarget(I.id,{role:I.region===O?"primary":"secondary"});return E.updateTopology(L.id,{status:A.kind==="failover"?"failed_over":"ready",activeRegion:O,regions:C}),{activeRegion:O}},h=async(S,A,L,O)=>{E.updateTopology(L.id,{status:"destroying"}),r(S,A,"traffic:drain"),await d(L,Object.fromEntries(L.regions.map(($)=>[$.region,0])));let c=O.deleteData!==!0;for(let $ of E.targets(L.id).sort((C,I)=>Number(C.role==="primary")-Number(I.role==="primary")))r(S,A,`delete:${$.region}`),E.updateTarget($.id,{status:"deleting"}),await T($).deleteStack({target:$,retainData:c,signal:S.signal}),E.updateTarget($.id,{status:"deleted"});return r(S,A,"complete"),E.updateTopology(L.id,{status:"destroyed"}),{destroyed:!0,dataRetained:c}},N=async(S)=>{let A=kk(S.operation.input),L=E.execution(String(A.executionId??""));if(!L)throw Error("Regional execution was not found.");let O=E.get(L.topologyId);if(!O)throw Error("Regional topology was not found.");try{let c;if(L.kind==="rollout")c=await t(S,L,O,A);else if(L.kind==="failover"||L.kind==="failback")c=await R(S,L,O);else if(L.kind==="destroy")c=await h(S,L,O,A);else throw Error("Regional reconciliation is not configured.");return E.updateExecution(L.id,{status:"succeeded",currentStep:void 0}),{executionId:L.id,...c}}catch(c){if(E.updateExecution(L.id,{status:S.cancellationRequested()?"cancelled":"failed",error:c instanceof Error?c.message:String(c)}),E.get(O.id)?.status!=="destroyed")E.updateTopology(O.id,{status:"failed"});throw c}};return{"region.rollout":N,"region.failover":N,"region.failback":N,"region.destroy":N,"region.reconcile":N}}class IX{provider;reason;constructor(E,_="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=_}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function uk(){let E=await p(),_=iE(process.cwd(),E),T=new c0(_.store),r=new U0(T);return{controlPlane:_,store:T,service:r}}async function sh(E){let _=await uk();try{await E(_)}catch(T){Q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var $0=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((r)=>r.id===_||r.name===_);if(!T)throw Error("Regional topology was not found.");return T},vk=(E)=>E.split(",").map((_,T)=>{let[r,d="aws"]=_.split(":");return{region:String(r),provider:d,role:T===0?"primary":"secondary"}}),nk=(E)=>{let _=new Set(["s3","dynamodb","secrets"]),T=E.split(",").map((d)=>d.trim()),r=T.find((d)=>!_.has(d));if(r)throw Error(`Unsupported replication kind: ${r}`);return T};function wX(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(_)=>sh((T)=>{let r=T.store.list(T.controlPlane.project.id).map((d)=>({topology:d,targets:T.store.targets(d.id),channels:T.store.channels(d.id),route:T.store.route(d.id),executions:T.store.executions(d.id)}));if(_.json)console.log(JSON.stringify(r,null,2));else o(["Name","Hostname","Active","Status","Revision","Replication"],r.map((d)=>[d.topology.name,d.topology.hostname,d.topology.activeRegion,d.topology.status,d.topology.revision??"—",`${d.channels.filter((t)=>t.status==="in_sync").length}/${d.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(_,T)=>sh((r)=>{if(!T.hostname||!T.regions)throw Error("--hostname and --regions are required.");let d=r.service.create({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:_,hostname:T.hostname,regions:vk(T.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:nk(String(T.replicate)),maxLagSeconds:Number(T.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!T.cdn,wafEnabled:!!T.waf});Z(`Created ${d.name} (${d.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(_,T,r)=>sh((d)=>o(["Step"],d.service.plan($0(d,_).id,T,r.target).map((t)=>[t])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(_,T,r)=>sh(async(d)=>{let t=r.manifest?await Bun.file(r.manifest).json():{},R=d.service.enqueue({topologyId:$0(d,_).id,kind:"rollout",revision:T,manifest:t});Z(`Regional rollout queued: ${R.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(_,T)=>sh((r)=>{let d=r.service.enqueue({topologyId:$0(r,_).id,kind:"failover",targetRegion:T});Z(`Failover queued: ${d.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(_,T)=>sh((r)=>{let d=r.service.enqueue({topologyId:$0(r,_).id,kind:"failback",targetRegion:T});Z(`Failback queued: ${d.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(_,T)=>sh((r)=>{let d=r.service.enqueue({topologyId:$0(r,_).id,kind:"destroy",confirmation:T.confirm});Z(`Regional teardown queued: ${d.operation.id}; replicated data remains retained.`)}))}fE();var D0="0.7.105";import{createHash as eX,createPublicKey as xP,verify as ik}from"node:crypto";function C0(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(C0).join(",")}]`;return`{${Object.keys(E).sort().map((_)=>`${JSON.stringify(_)}:${C0(E[_])}`).join(",")}}`}var bP=(E)=>eX("sha256").update(C0(E)).digest("hex"),t$=(E)=>eX("sha256").update(C0(E)).digest("hex"),kP=(E)=>eX("sha256").update(xP(E).export({type:"spki",format:"der"})).digest("hex");function uP(E,_,T){try{return ik(null,Buffer.from(C0(E)),xP(T),Buffer.from(_,"base64"))}catch{return!1}}var qP=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((_)=>Number(_)||0),gP=(E,_)=>{let T=qP(E),r=qP(_);for(let d=0;d<3;d++){let t=(T[d]??0)-(r[d]??0);if(t)return t}return 0};function vP(E,_){let T=[];if(_.schemaVersion<E.minimumSchema)T.push(`schema ${_.schemaVersion} is below ${E.minimumSchema}`);if(_.schemaVersion>E.maximumSchema)T.push(`schema ${_.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&gP(_.currentVersion,E.minimumVersion)<0)T.push(`platform ${_.currentVersion} is below ${E.minimumVersion}`);if(gP(E.version,_.currentVersion)<=0)T.push(`version ${E.version} is not newer than ${_.currentVersion}`);if(!E.artifacts.some((r)=>r.platform===_.platform&&r.architecture===_.architecture))T.push(`no artifact for ${_.platform}/${_.architecture}`);return{compatible:T.length===0,reasons:T}}var bt=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},jT=(E)=>E==null?void 0:String(E),ak=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:jT(E.revoked_at),createdAt:String(E.created_at)}),nP=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:bt(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:bt(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),lP=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:bt(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),iP=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:jT(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:bt(E.health_gate,{}),status:String(E.status),currentStage:jT(E.current_stage),backupId:jT(E.backup_id),approvedBy:jT(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),XX=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:jT(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:bt(E.evidence,{}),error:jT(E.error),startedAt:jT(E.started_at),finishedAt:jT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),aP=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:bt(E.criteria,{}),candidates:bt(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:jT(E.confirmation),expiresAt:String(E.expires_at),result:bt(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),mP=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:jT(E.backup_policy_id),recoveryPointId:jT(E.recovery_point_id),topologyId:jT(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:jT(E.operation_id),evidence:bt(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:jT(E.error),startedAt:jT(E.started_at),finishedAt:jT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class I0{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}addTrustedKey(E){let _=this.id(),T=this.now().toISOString(),r=kP(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[_,E.organizationId,E.name,E.publicKeyPem,r,T]),this.key(_)}key(E){let _=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return _?ak(_):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let _=this.key(E.keyId);if(!_||_.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(_.revokedAt)throw Error("Update signing key is revoked.");if(!uP(E.document,E.signature,_.publicKeyPem))throw Error("Update manifest signature is invalid.");let T=vP(E.document,E.current),r=bP(E.document),d=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[d,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,r,JSON.stringify(E.document),E.signature,JSON.stringify(T),t]),this.manifest(d)}manifest(E){let _=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return _?nP(_):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(nP)}createWindow(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[_,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,T,T]),this.window(_)}window(E){let _=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return _?lP(_):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(lP)}createCampaign(E){return this.control.transaction(()=>{let _=this.manifest(E.manifestId);if(!_?.compatibility.compatible||_.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let T=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[T,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,r,r]),E.targets.forEach((d,t)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,d.serverId??null,d.target,E.strategy==="canary"?t===0?0:1+Math.floor((t-1)/E.batchSize):Math.floor(t/E.batchSize),d.previousVersion,r,r])),this.campaign(T)})}campaign(E){let _=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return _?iP(_):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(iP)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(XX)}updateCampaign(E,_){let T=this.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let r={...T,..._};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[r.status,r.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!T)throw Error("Upgrade target was not found.");let r={...XX(T),..._};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.evidence),r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),XX(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let _=[...E.candidates].sort((R,h)=>R.id.localeCompare(h.id)),T=t$(_),r=this.id(),d=this.now().toISOString(),t=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[r,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(_),T,_.reduce((R,h)=>R+h.bytes,0),t,d,d]),this.cleanup(r)}cleanup(E){let _=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return _?aP(_):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(aP)}updateCleanup(E,_){let T=this.cleanup(E);if(!T)throw Error("Cleanup plan was not found.");let r={...T,..._};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[r.status,r.confirmation??null,JSON.stringify(r.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[_,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,T,T]),this.drill(_)}drill(E){let _=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return _?mP(_):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(mP)}updateDrill(E,_){let T=this.drill(E);if(!T)throw Error("DR drill was not found.");let r={...T,..._};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,r.operationId??null,JSON.stringify(r.evidence),r.measuredRpoMinutes??null,r.measuredRtoMinutes??null,r.cleanupVerified?1:0,r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}function mk(E,_=new Date){if(!E.enabled)return!1;let T=new Date(E.schedule);if(!Number.isNaN(T.getTime()))return _>=T&&_.getTime()<=T.getTime()+E.durationMinutes*60000;let r=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!r)return!1;let d=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(_),t=Number(d.find((h)=>h.type==="hour")?.value)*60+Number(d.find((h)=>h.type==="minute")?.value),R=Number(r[1])*60+Number(r[2]);return t>=R&&t<R+E.durationMinutes}class w0{store;now;queue;constructor(E,_,T=()=>new Date){this.store=E;this.now=T;this.queue=_??new lE(E.control)}enqueueCampaign(E,_={}){let T=this.store.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let r=T.windowId?this.store.window(T.windowId):void 0;if(r&&!r.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(r&&!_.overrideWindow&&!mk(r,this.now()))throw Error("Upgrade is outside its maintenance window.");if(r?.requireApproval&&!_.approvedBy&&!T.approvedBy)throw Error("Maintenance approval is required.");let d=this.queue.enqueue({projectId:T.projectId,actorId:_.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:d}}async previewCleanup(E,_){let T=_.find((r)=>r.kind===E.kind);if(!T)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await T.discover(E.criteria)})}enqueueCleanup(E,_){let T=this.store.cleanup(E);if(!T||T.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(T.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let r=`DELETE ${T.candidates.length} ${T.kind}`;if(_!==r)throw Error(`Exact confirmation ${r} is required.`);let d=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${T.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:_}),operation:d}}enqueueDrill(E){let _=this.store.drill(E);if(!_||_.status!=="planned")throw Error("A planned DR drill is required.");let T=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${_.scenario}:${_.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:T.id}),operation:T}}}var JX=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function sP(E){return{"maintenance.upgrade":async(d)=>{let t=E.store.campaign(String(JX(d.operation.input).campaignId??""));if(!t||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let R=E.store.manifest(t.manifestId);if(!R?.compatibility.compatible||R.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let h=R.document.artifacts.find((S)=>S.platform===process.platform&&S.architecture===process.arch)??R.document.artifacts[0];if(!h)throw Error("No update artifact matches this platform.");E.store.updateCampaign(t.id,{status:"running",currentStage:"preflight"});let N=[];try{for(let S of[...new Set(E.store.targets(t.id).map((A)=>A.cohort))].sort((A,L)=>A-L)){E.store.updateCampaign(t.id,{currentStage:`cohort:${S}`});for(let A of E.store.targets(t.id).filter((L)=>L.cohort===S)){d.throwIfCancellationRequested(),d.checkpoint(`download:${A.target}`,"Downloading signed platform artifact."),E.store.updateTarget(A.id,{status:"downloading",startedAt:new Date().toISOString()});let L=await E.platform.download({target:A,artifact:h,signal:d.signal});if(L.sha256!==h.sha256)throw Error(`Artifact checksum mismatch for ${A.target}.`);d.checkpoint(`install:${A.target}`,"Installing verified artifact."),E.store.updateTarget(A.id,{status:"installing"}),await E.platform.install({target:A,path:L.path,version:R.version,signal:d.signal}),N.push(A);let O=await E.platform.health({target:A,gate:t.healthGate});if(!O.healthy)throw Error(`Upgrade health gate failed for ${A.target}.`);E.store.updateTarget(A.id,{status:"healthy",evidence:O.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(t.id,{status:"succeeded",currentStage:void 0}),{campaignId:t.id,version:R.version,targets:N.length}}catch(S){E.store.updateCampaign(t.id,{status:"rolling_back",currentStage:"rollback"});for(let A of N.reverse())E.store.updateTarget(A.id,{status:"rolling_back"}),await E.platform.rollback({target:A,version:A.previousVersion,signal:d.signal}),E.store.updateTarget(A.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(t.id,{status:"rolled_back",currentStage:void 0}),S}},"maintenance.cleanup":async(d)=>{let t=E.store.cleanup(String(JX(d.operation.input).planId??""));if(!t||t.status!=="approved")throw Error("Approved cleanup plan was not found.");if(t$([...t.candidates].sort((A,L)=>A.id.localeCompare(L.id)))!==t.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let R=E.cleanup?.find((A)=>A.kind===t.kind);if(!R)throw Error(`No ${t.kind} cleanup driver is configured.`);E.store.updateCleanup(t.id,{status:"running"});let h=[],N=[];for(let A of t.candidates){d.throwIfCancellationRequested();try{await R.remove(A),h.push(A.id)}catch(L){N.push({id:A.id,error:L instanceof Error?L.message:String(L)})}}let S=N.length?h.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(t.id,{status:S,result:{removed:h,failed:N,reclaimedBytes:t.candidates.filter((A)=>h.includes(A.id)).reduce((A,L)=>A+L.bytes,0)}}),N.length)throw Error(`Cleanup failed for ${N.length} candidate(s).`);return{planId:t.id,removed:h.length,reclaimedBytes:t.estimatedBytes}},"maintenance.drill":async(d)=>{let t=E.store.drill(String(JX(d.operation.input).drillId??""));if(!t)throw Error("DR drill was not found.");let R=E.recovery?.find((L)=>L.scenario===t.scenario);if(!R)throw Error(`No ${t.scenario} recovery driver is configured.`);let h=new Date;E.store.updateDrill(t.id,{status:"restoring",startedAt:h.toISOString()});let N=t.isolatedTarget,S={},A={};try{d.checkpoint("restore","Restoring into isolated drill target.");let L=await R.restore({drill:t,signal:d.signal});if(!L.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");N=L.target,S=L.evidence;let O=(h.getTime()-new Date(L.recoveryPointAt).getTime())/60000;E.store.updateDrill(t.id,{status:"verifying",measuredRpoMinutes:O,evidence:{restore:S}}),d.checkpoint("verify","Running recovery health checks without production traffic.");let c=await R.verify({drill:t,target:N});A=c.evidence;let $=(Date.now()-h.getTime())/60000;if(!c.healthy||O>t.expectedRpoMinutes||$>t.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(t.id,{measuredRpoMinutes:O,measuredRtoMinutes:$,evidence:{restore:S,verify:A}})}catch(L){throw E.store.updateDrill(t.id,{status:"failed",error:L instanceof Error?L.message:String(L),evidence:{restore:S,verify:A}}),L}finally{E.store.updateDrill(t.id,{status:"cleaning"});try{await R.cleanup({drill:t,target:N});let L=E.store.drill(t.id);E.store.updateDrill(t.id,{status:L.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(L){E.store.updateDrill(t.id,{status:"cleanup_required",cleanupVerified:!1,error:L instanceof Error?L.message:String(L),finishedAt:new Date().toISOString()})}}return{drillId:t.id,status:E.store.drill(t.id).status}}}}var pP={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class e0{kind;control;projectId;organizationId;constructor(E,_,T,r){this.kind=E;this.control=_;this.projectId=T;this.organizationId=r}async discover(E){let _=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),T=new Date(Date.now()-_*86400000).toISOString(),r=pP[this.kind],d=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(r.select).all(d,T).map((R)=>({id:String(R.id),kind:this.kind,label:`${this.kind}:${String(R.id)}`,bytes:Number(R.bytes??0),metadata:{createdAt:String(R.created_at)}}))}async remove(E){if(this.control.database.run(pP[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function sk(){let E=await p(),_=iE(process.cwd(),E),T=new I0(_.store),r=new w0(T),d=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((t)=>new e0(t,_.store,_.project.id,_.organization.id));return{controlPlane:_,store:T,service:r,cleanup:d}}async function kt(E){let _=await sk();try{await E(_)}catch(T){Q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}function zX(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(_)=>kt((T)=>{let r={manifests:T.store.manifests(T.controlPlane.organization.id),windows:T.store.windows(T.controlPlane.project.id),campaigns:T.store.campaigns(T.controlPlane.project.id),cleanups:T.store.cleanups(T.controlPlane.project.id),drills:T.store.drills(T.controlPlane.project.id)},d=[...r.manifests.map((t)=>["update",t.version,t.compatibility.compatible?"compatible":"blocked",t.compatibility.reasons.join("; ")||t.channel]),...r.campaigns.map((t)=>["upgrade",t.id,t.status,t.currentStage??t.fromVersion]),...r.cleanups.map((t)=>["cleanup",t.kind,t.status,`${t.candidates.length} items / ${t.estimatedBytes} bytes`]),...r.drills.map((t)=>["DR drill",t.scenario,t.status,t.isolatedTarget])];if(_.json)console.log(JSON.stringify(r,null,2));else o(["Area","Name / version","Status","Detail"],d)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(_,T)=>kt(async(r)=>{let d=r.store.addTrustedKey({organizationId:r.controlPlane.organization.id,name:_,publicKeyPem:await Bun.file(T).text()});Z(`Trusted ${d.name}: ${d.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(_,T,r)=>kt(async(d)=>{let t=await Bun.file(_).json(),R=(await Bun.file(T).text()).trim(),h=d.store.importManifest({organizationId:d.controlPlane.organization.id,keyId:r,document:t,signature:R,current:{schemaVersion:d.controlPlane.store.health().schemaVersion,currentVersion:D0,platform:process.platform,architecture:process.arch}});Z(`Verified ${h.version}; ${h.compatibility.compatible?"compatible":"blocked: "+h.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(_,T,r)=>kt((d)=>{let t=d.store.createWindow({projectId:d.controlPlane.project.id,name:_,schedule:T,timezone:r.timezone,durationMinutes:Number(r.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});Z(`Created ${t.name} (${t.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(_,T,r)=>kt((d)=>{let t=new Tt(d.controlPlane.store).list(d.controlPlane.project.id).filter((N)=>N.status==="ready").map((N)=>({serverId:N.id,target:N.name,previousVersion:N.bootstrapVersion??D0}));if(!t.length)t.push({target:"control-plane",previousVersion:D0});let R=d.store.createCampaign({projectId:d.controlPlane.project.id,manifestId:_,fromVersion:D0,strategy:r.strategy==="rolling"?"rolling":"canary",batchSize:Number(r.batch),healthGate:{kind:"platform"},backupId:T,targets:t}),h=d.service.enqueueCampaign(R.id);Z(`Staged upgrade queued: ${h.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(_,T)=>kt(async(r)=>{let d=await r.service.previewCleanup({projectId:r.controlPlane.project.id,kind:_,criteria:{olderThanDays:Number(T.olderThan)}},r.cleanup);o(["ID","Candidate","Bytes"],d.candidates.map((t)=>[t.id,t.label,String(t.bytes)])),U(`Apply with: cloud cleanup:apply ${d.id} --confirm "DELETE ${d.candidates.length} ${d.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(_,T)=>kt((r)=>{let d=r.service.enqueueCleanup(_,String(T.confirm??""));Z(`Cleanup queued: ${d.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(_,T,r)=>kt((d)=>{let t=d.store.createDrill({projectId:d.controlPlane.project.id,scenario:_,isolatedTarget:T,expectedRpoMinutes:Number(r.rpo),expectedRtoMinutes:Number(r.rto),recoveryPointId:r.recoveryPoint,topologyId:r.topology});Z(`Planned isolated drill ${t.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(_)=>kt((T)=>{let r=T.service.enqueueDrill(_);Z(`DR drill queued: ${r.operation.id}`)}))}fE();sR();Mr();async function FX(){try{return(await p()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function jX(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(_)=>{b("Lambda Functions");let T=_?.region||await FX(),r=new B_(T);try{let{Functions:d=[]}=await r.listFunctions({MaxItems:50});if(!d.length){U("No functions found");return}o(["Name","Runtime","Memory","Timeout","Last Modified"],d.map((t)=>[t.FunctionName??"-",t.Runtime??"-",t.MemorySize?`${t.MemorySize} MB`:"-",t.Timeout?`${t.Timeout}s`:"-",t.LastModified??"-"]))}catch(d){Q(`Failed to list functions: ${d.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(_,T)=>{b(`Invoking ${_}`);let r=T?.region||await FX(),d=new B_(r),t=new n("Invoking function...");t.start();try{let R=await d.invoke({FunctionName:_,InvocationType:T?.async?"Event":"RequestResponse",Payload:T?.payload||"{}",LogType:T?.async?"None":"Tail"});if(R.FunctionError){if(t.fail(`Function returned an error (${R.FunctionError})`),R.Payload)U(R.Payload);process.exitCode=1;return}if(t.succeed(`Invoked (status ${R.StatusCode})`),R.Payload)U(`
 Response:`),U(R.Payload);if(R.LogResult)U(`
 Logs:`),U(Buffer.from(R.LogResult,"base64").toString("utf-8"))}catch(R){t.fail(`Invocation failed: ${R.message}`),process.exitCode=1}}),E.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(_,T)=>{b(`Logs for ${_}`);let r=T?.region||await FX(),d=new Cr(r),t=_.startsWith("/aws/lambda/")?_:`/aws/lambda/${_}`,R=Number(T?.since??15),h=(N)=>{for(let S of N){let A=S.timestamp?new Date(S.timestamp).toISOString():"";U(`${A}  ${(S.message??"").trimEnd()}`)}};try{let N=Date.now()-R*60000,{events:S=[]}=await d.filterLogEvents({logGroupName:t,startTime:N,filterPattern:T?.filter,limit:200});if(h(S),S.length)N=(S[S.length-1].timestamp??N)+1;if(T?.tail){U(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise((L)=>setTimeout(L,3000));let{events:A=[]}=await d.filterLogEvents({logGroupName:t,startTime:N,filterPattern:T?.filter,limit:200});if(A.length)h(A),N=(A[A.length-1].timestamp??N)+1}}}catch(N){Q(`Failed to read logs: ${N.message}`),process.exitCode=1}})}fE();async function Ey(E){let _=Bun.spawn(["docker",...E],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[T,r]=await Promise.all([_.exited,new Response(_.stderr).text()]);return{ok:T===0,exitCode:T,command:["docker",...E].join(" "),stderr:r.trim()}}function BX(E){E.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(_)=>{let T=["build","--file",_.file??"Dockerfile","--tag",_.tag??"latest","."];if(_.dryRun){console.log(`docker ${T.join(" ")}`);return}let r=await Ey(T);if(_.json)console.log(JSON.stringify(r));if(!r.ok)Q(r.stderr||`docker exited ${r.exitCode}`),process.exitCode=r.exitCode;else Z(`Built ${_.tag??"latest"}.`)}),E.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(_)=>{if(!_.image){Q("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(_.dryRun){console.log(`docker push ${_.image}`);return}let T=await Ey(["push",_.image]);if(_.json)console.log(JSON.stringify(T));if(!T.ok)Q(T.stderr),process.exitCode=T.exitCode;else Z(`Pushed ${_.image}.`)}),E.command("container:deploy","Deploy a container image").action(async()=>_d("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}fE();Mt();sd();function WX(E){E.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(_)=>{b("Domains");try{let T=pd(_?.provider),r=Qr(_?.provider)?.provider||"unknown",d=new n(`Fetching domains from ${r}...`);d.start();let t=await T.listDomains();if(d.succeed(`Found ${t.length} domain(s)`),t.length===0){U("No domains found in this provider");return}let R=t.map((h)=>[h,"Active","-",r.charAt(0).toUpperCase()+r.slice(1)]);o(["Domain","Status","SSL","Provider"],R)}catch(T){Q(`Failed to list domains: ${T instanceof Error?T.message:String(T)}`)}}),E.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(_,T)=>{b(`Adding Domain: ${_}`);try{let r=pd(T?.provider),d=Qr(T?.provider)?.provider||"unknown",t=new n(`Checking if ${d} can manage ${_}...`);if(t.start(),await r.canManageDomain(_))t.succeed(`Domain ${_} is already available in ${d}`),U(`