@stacksjs/ts-cloud 0.7.105 → 0.7.108

package/dist/{chunk-vkd2y0fs.js → chunk-eg8ck25v.js}

@@ -47,7 +47,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-dmzez5f8.js";
+} from "./chunk-33sy72r8.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,
@@ -7209,6 +7209,15 @@ var dashboardPageRoutes = [
     modes: ["server"],
     adminOnly: true
   },
+  {
+    id: "infrastructure.topology",
+    path: "/infrastructure/topology",
+    label: "Infrastructure map",
+    group: "infrastructure",
+    modes: ["server", "serverless"],
+    adminOnly: true,
+    legacyPaths: ["/topology"]
+  },
   {
     id: "data.services",
     path: "/data/services",
@@ -8876,6 +8885,554 @@ class WAFv2Client {
   }
 }
 
+// src/deploy/dashboard-topology.ts
+var SERVER_LAYERS = [
+  { index: 0, id: "clients", label: "Clients" },
+  { index: 1, id: "dns", label: "DNS & TLS" },
+  { index: 2, id: "edge", label: "Edge" },
+  { index: 3, id: "routing", label: "Routing" },
+  { index: 4, id: "apps", label: "Applications" },
+  { index: 5, id: "runtime", label: "Background runtime" },
+  { index: 6, id: "data", label: "Data services" },
+  { index: 7, id: "durability", label: "Durability" }
+];
+var SERVERLESS_LAYERS = [
+  { index: 0, id: "clients", label: "Clients" },
+  { index: 1, id: "dns", label: "DNS & TLS" },
+  { index: 2, id: "edge", label: "Edge" },
+  { index: 3, id: "entry", label: "Entry points" },
+  { index: 4, id: "compute", label: "Compute" },
+  { index: 5, id: "messaging", label: "Messaging & pooling" },
+  { index: 6, id: "data", label: "Data services" },
+  { index: 7, id: "durability", label: "Durability" }
+];
+var DATA_SERVICE_KINDS = [
+  { match: /^redis/, kind: "cache", label: "Redis" },
+  { match: /^(?:mysql|mariadb)/, kind: "database", label: "MySQL" },
+  { match: /^postgres/, kind: "database", label: "PostgreSQL" },
+  { match: /^meilisearch/, kind: "database", label: "Meilisearch" },
+  { match: /^vitess|^vtgate/, kind: "database", label: "Vitess" },
+  { match: /^memcached/, kind: "cache", label: "Memcached" }
+];
+var PROXY_SERVICES = /^(?:rpx-gateway|nginx|caddy|traefik|haproxy)$/;
+function text(value, fallback = "") {
+  const out = value == null ? "" : String(value).trim();
+  return out && out !== "-" && out !== "—" ? out : fallback;
+}
+function count(value) {
+  return Array.isArray(value) ? value.length : 0;
+}
+function toneOf(status) {
+  const value = text(status).toLowerCase();
+  if (!value)
+    return "unknown";
+  if (["running", "live", "active", "available", "success", "ok", "healthy", "enabled"].includes(value))
+    return "ok";
+  if (["failed", "stopped", "unreachable", "error", "critical", "disabled"].includes(value))
+    return "bad";
+  if (["configured", "creating", "pending", "degraded", "shadowed", "warn", "unknown"].includes(value))
+    return "warn";
+  return "warn";
+}
+function pushLink(links, link, ids) {
+  if (ids.has(link.source) && ids.has(link.target))
+    links.push(link);
+}
+function buildServerTopology(data, context = {}) {
+  const nodes = [];
+  const links = [];
+  const notes = [];
+  const server = data.server ?? {};
+  const sites = Array.isArray(data.sites) ? data.sites : [];
+  const services = Array.isArray(data.services) ? data.services : [];
+  const workers = Array.isArray(data.workers) ? data.workers : [];
+  const security = data.security ?? {};
+  const reachable = !!data._serverReachable && !data.metricsUnavailable;
+  const box2 = "box";
+  if (!reachable)
+    notes.push("The compute box could not be probed, so live service state is missing; the shape comes from your cloud config.");
+  nodes.push({
+    id: "internet",
+    label: "Internet",
+    kind: "internet",
+    layer: 0,
+    status: "ok",
+    sub: "Public traffic",
+    facts: [],
+    external: true
+  });
+  const domains2 = [
+    ...new Set(sites.map((site) => text(site.domain) || text(site.route).split("/")[0]).filter((domain) => domain && domain !== "internal" && domain !== "loopback"))
+  ];
+  const certificates = Array.isArray(security.tlsCertificates) ? security.tlsCertificates : [];
+  const expiringSoon = certificates.filter((cert) => Number(cert?.daysRemaining ?? 999) < 21).length;
+  nodes.push({
+    id: "dns",
+    label: domains2.length === 1 ? domains2[0] : "Public domains",
+    kind: "dns",
+    layer: 1,
+    status: expiringSoon ? "warn" : domains2.length ? "ok" : "unknown",
+    sub: domains2.length > 1 ? `${domains2.length} domains` : "DNS & certificates",
+    facts: [
+      { label: "Domains", value: domains2.length ? domains2.slice(0, 6).join(", ") : "none resolved" },
+      { label: "Certificates", value: certificates.length ? `${certificates.length} issued` : "none reported" },
+      ...expiringSoon ? [{ label: "Expiring", value: `${expiringSoon} within 21 days` }] : []
+    ],
+    href: "/server/security",
+    external: true
+  });
+  const firewall = security.firewall ?? {};
+  const ports2 = Array.isArray(security.ports) ? security.ports : [];
+  nodes.push({
+    id: "firewall",
+    label: "Host firewall",
+    kind: "firewall",
+    layer: 2,
+    status: toneOf(firewall.status),
+    sub: text(firewall.summary, "Inbound filtering"),
+    facts: [
+      { label: "State", value: text(firewall.status, "unknown") },
+      { label: "Open ports", value: ports2.length ? ports2.map((port) => text(port.listen)).join(", ") : "not reported" }
+    ],
+    href: "/server/firewall",
+    group: box2
+  });
+  const proxyService = services.find((service3) => PROXY_SERVICES.test(text(service3.name)));
+  nodes.push({
+    id: "proxy",
+    label: text(proxyService?.name, "Reverse proxy"),
+    kind: "proxy",
+    layer: 3,
+    status: proxyService ? toneOf(proxyService.status) : "unknown",
+    sub: "TLS termination & routing",
+    facts: [
+      { label: "Service", value: text(proxyService?.name, "not detected") },
+      { label: "State", value: text(proxyService?.status, reachable ? "not running" : "not probed") },
+      { label: "Routes", value: `${sites.length} site${sites.length === 1 ? "" : "s"}` }
+    ],
+    href: "/server/services",
+    group: box2
+  });
+  for (const site of sites) {
+    const id = `site:${text(site.name)}`;
+    if (!text(site.name))
+      continue;
+    nodes.push({
+      id,
+      label: text(site.name),
+      kind: "site",
+      layer: 4,
+      status: toneOf(site.status),
+      sub: text(site.runtime, "runtime"),
+      facts: [
+        { label: "Route", value: text(site.route, "internal") },
+        { label: "Runtime", value: text(site.runtime, "unknown") },
+        { label: "Delivery", value: text(site.deploy, "unknown") },
+        { label: "TLS", value: text(site.tls, "unknown") },
+        ...site.responseMs != null ? [{ label: "Response", value: `${Math.round(Number(site.responseMs))} ms` }] : [],
+        ...site.httpStatus != null ? [{ label: "HTTP", value: String(site.httpStatus) }] : []
+      ],
+      href: "/server/sites",
+      group: box2
+    });
+  }
+  for (const worker2 of workers) {
+    const id = `worker:${text(worker2.name)}`;
+    if (!text(worker2.name))
+      continue;
+    nodes.push({
+      id,
+      label: text(worker2.name),
+      kind: "worker",
+      layer: 5,
+      status: toneOf(worker2.status),
+      sub: `${Number(worker2.processes ?? 1)} process${Number(worker2.processes ?? 1) === 1 ? "" : "es"}`,
+      facts: [
+        { label: "Processes", value: String(worker2.processes ?? 1) },
+        { label: "State", value: text(worker2.status, "unknown") },
+        ...text(worker2.site) ? [{ label: "Site", value: text(worker2.site) }] : []
+      ],
+      href: "/operations/jobs",
+      group: box2
+    });
+  }
+  const scheduler = data.serverScheduler ?? {};
+  if (scheduler.enabled) {
+    nodes.push({
+      id: "scheduler",
+      label: "Scheduler",
+      kind: "scheduler",
+      layer: 5,
+      status: "ok",
+      sub: "Cron dispatch",
+      facts: [{ label: "Last run", value: text(scheduler.lastRun, "unknown") }],
+      href: "/operations/jobs",
+      group: box2
+    });
+  }
+  const dataServices = services.map((service3) => {
+    const name = text(service3.name);
+    const match = DATA_SERVICE_KINDS.find((candidate) => candidate.match.test(name));
+    return match ? { service: service3, name, ...match } : null;
+  }).filter((entry) => !!entry);
+  for (const entry of dataServices) {
+    nodes.push({
+      id: `data:${entry.name}`,
+      label: entry.label,
+      kind: entry.kind,
+      layer: 6,
+      status: toneOf(entry.service.status),
+      sub: entry.name,
+      facts: [
+        { label: "Unit", value: entry.name },
+        { label: "State", value: text(entry.service.status, "unknown") }
+      ],
+      href: "/data/services",
+      group: box2
+    });
+  }
+  const backup = data.backup ?? {};
+  if (backup.enabled) {
+    nodes.push({
+      id: "backup",
+      label: "Backups",
+      kind: "backup",
+      layer: 7,
+      status: "ok",
+      sub: text(backup.destination, "destination"),
+      facts: [
+        { label: "Destination", value: text(backup.destination, "unknown") },
+        { label: "Schedule", value: text(backup.schedule, "unknown") },
+        { label: "Retention", value: `${backup.retention ?? 0} copies` },
+        { label: "Last run", value: text(backup.last, "unknown") }
+      ],
+      href: "/data/backups"
+    });
+  }
+  const ids = new Set(nodes.map((node) => node.id));
+  pushLink(links, { source: "internet", target: "dns", flow: "request", label: "https" }, ids);
+  pushLink(links, { source: "dns", target: "firewall", flow: "request", label: "443/80" }, ids);
+  pushLink(links, { source: "firewall", target: "proxy", flow: "request" }, ids);
+  for (const site of sites) {
+    const id = `site:${text(site.name)}`;
+    pushLink(links, { source: "proxy", target: id, flow: "request", label: text(site.path) || undefined, status: toneOf(site.status) }, ids);
+  }
+  for (const worker2 of workers) {
+    const id = `worker:${text(worker2.name)}`;
+    const site = `site:${text(worker2.site)}`;
+    if (ids.has(site))
+      pushLink(links, { source: site, target: id, flow: "async", label: "queue" }, ids);
+    else
+      pushLink(links, { source: "proxy", target: id, flow: "async", label: "queue" }, ids);
+  }
+  for (const worker2 of workers) {
+    pushLink(links, { source: "scheduler", target: `worker:${text(worker2.name)}`, flow: "async", label: "dispatch" }, ids);
+  }
+  const consumers = [...sites.map((site) => `site:${text(site.name)}`), ...workers.map((worker2) => `worker:${text(worker2.name)}`)];
+  for (const entry of dataServices) {
+    for (const consumer of consumers)
+      pushLink(links, { source: consumer, target: `data:${entry.name}`, flow: "data", label: "localhost" }, ids);
+  }
+  if (dataServices.length && consumers.length)
+    notes.push("Data-service edges show co-location on the box: every process on it can reach localhost. They are not a declared per-site binding.");
+  for (const entry of dataServices) {
+    pushLink(links, { source: `data:${entry.name}`, target: "backup", flow: "backup", label: "snapshot" }, ids);
+  }
+  for (const site of sites) {
+    pushLink(links, { source: `site:${text(site.name)}`, target: "backup", flow: "backup" }, ids);
+  }
+  return {
+    mode: "server",
+    project: text(context.project) || text(data.project?.name) || text(server.name, "project"),
+    environment: text(context.environment) || text(data.environment, "production"),
+    provider: text(server.provider, "unknown"),
+    region: text(server.region, "unknown"),
+    generatedAt: new Date().toISOString(),
+    layers: SERVER_LAYERS,
+    groups: [
+      {
+        id: box2,
+        label: text(server.name, "App server"),
+        sub: [text(server.provider), text(server.region), text(server.ip)].filter(Boolean).join(" · ")
+      }
+    ],
+    nodes,
+    links,
+    notes
+  };
+}
+function buildServerlessTopology(data, context = {}) {
+  const nodes = [];
+  const links = [];
+  const notes = [];
+  const app = data.app ?? {};
+  const functions = Array.isArray(data.functions) ? data.functions : [];
+  const queues = Array.isArray(data.queues) ? data.queues : [];
+  const metrics = data.metrics ?? {};
+  if (!functions.length)
+    notes.push("No Lambda functions were read for this environment, so the compute layer is empty rather than assumed.");
+  nodes.push({
+    id: "internet",
+    label: "Internet",
+    kind: "internet",
+    layer: 0,
+    status: "ok",
+    sub: "Public traffic",
+    facts: [],
+    external: true
+  });
+  const url = text(app.url);
+  const host = url.replace(/^https?:\/\//, "").split("/")[0];
+  nodes.push({
+    id: "dns",
+    label: host || "Application domain",
+    kind: "dns",
+    layer: 1,
+    status: host ? "ok" : "unknown",
+    sub: "DNS & certificates",
+    facts: [{ label: "Endpoint", value: url || "not resolved" }],
+    external: true
+  });
+  const waf = data.waf;
+  if (waf) {
+    nodes.push({
+      id: "waf",
+      label: "WAF",
+      kind: "waf",
+      layer: 2,
+      status: toneOf(waf.status ?? "active"),
+      sub: text(waf.scope, "Managed rules"),
+      facts: [
+        { label: "Web ACL", value: text(waf.name, "unnamed") },
+        ...waf.blocked != null ? [{ label: "Blocked (24h)", value: String(waf.blocked) }] : [],
+        { label: "Rules", value: String(count(data.wafRules)) }
+      ],
+      href: "/serverless/firewall"
+    });
+  }
+  const assets = data.assetsInfo;
+  if (assets) {
+    nodes.push({
+      id: "cdn",
+      label: "Asset CDN",
+      kind: "cdn",
+      layer: 2,
+      status: "ok",
+      sub: text(assets.cdn, "CloudFront"),
+      facts: [
+        { label: "Distribution", value: text(assets.cdn, "unknown") },
+        { label: "Custom domain", value: text(assets.customDomain, "none") }
+      ],
+      href: "/serverless/assets"
+    });
+    nodes.push({
+      id: "assets",
+      label: "Asset bucket",
+      kind: "storage",
+      layer: 6,
+      status: "ok",
+      sub: text(assets.bucket, "S3"),
+      facts: [
+        { label: "Bucket", value: text(assets.bucket, "unknown") },
+        ...assets.files ? [{ label: "Objects", value: String(assets.files) }] : [],
+        ...assets.sizeMb ? [{ label: "Size", value: `${assets.sizeMb} MB` }] : []
+      ],
+      href: "/serverless/assets"
+    });
+  }
+  const httpFunction = functions.find((fn) => text(fn.key).startsWith("http"));
+  nodes.push({
+    id: "gateway",
+    label: "HTTP entry point",
+    kind: "gateway",
+    layer: 3,
+    status: httpFunction ? "ok" : "unknown",
+    sub: "Function URL / API Gateway",
+    facts: [
+      { label: "Endpoint", value: url || "not resolved" },
+      { label: "Invocations (24h)", value: String(metrics.invocations ?? 0) },
+      ...metrics.errorRatePct != null ? [{ label: "Error rate", value: `${metrics.errorRatePct}%` }] : []
+    ],
+    href: "/serverless/metrics"
+  });
+  for (const fn of functions) {
+    const id = `fn:${text(fn.name)}`;
+    if (!text(fn.name))
+      continue;
+    const errors = Number(fn.errors ?? 0);
+    const invocations = Number(fn.invocations ?? 0);
+    nodes.push({
+      id,
+      label: text(fn.key, text(fn.name)),
+      kind: "function",
+      layer: 4,
+      status: errors > 0 ? invocations && errors / invocations > 0.02 ? "bad" : "warn" : invocations ? "ok" : "idle",
+      sub: text(fn.runtime, "lambda"),
+      facts: [
+        { label: "Function", value: text(fn.name) },
+        { label: "Memory", value: `${fn.memory ?? 0} MB` },
+        { label: "Timeout", value: `${fn.timeout ?? 0}s` },
+        { label: "Invocations (24h)", value: String(invocations) },
+        { label: "Errors (24h)", value: String(errors) },
+        { label: "p95", value: `${fn.p95 ?? 0} ms` },
+        ...fn.provisioned ? [{ label: "Provisioned", value: text(fn.provisioned) }] : []
+      ],
+      href: "/serverless/functions"
+    });
+  }
+  for (const queue2 of queues) {
+    const id = `queue:${text(queue2.name)}`;
+    if (!text(queue2.name))
+      continue;
+    const dlq = Number(queue2.dlq ?? 0);
+    nodes.push({
+      id,
+      label: text(queue2.name),
+      kind: "queue",
+      layer: 5,
+      status: dlq > 0 ? "bad" : Number(queue2.visible ?? 0) > 0 ? "warn" : "ok",
+      sub: "SQS",
+      facts: [
+        { label: "Visible", value: String(queue2.visible ?? 0) },
+        { label: "In flight", value: String(queue2.inFlight ?? 0) },
+        { label: "Processed (24h)", value: String(queue2.processed ?? 0) },
+        { label: "Dead letter", value: String(dlq) }
+      ],
+      href: "/serverless/queues"
+    });
+  }
+  const aurora = data.aurora;
+  if (aurora) {
+    nodes.push({
+      id: "database",
+      label: "Aurora Serverless",
+      kind: "database",
+      layer: 6,
+      status: toneOf(aurora.status),
+      sub: text(aurora.engine, "aurora"),
+      facts: [
+        { label: "Cluster", value: text(aurora.id, "unknown") },
+        { label: "Capacity", value: `${aurora.currentAcu ?? 0} ACU (${aurora.minAcu ?? 0}–${aurora.maxAcu ?? 0})` },
+        { label: "Connections", value: String(aurora.connections ?? 0) }
+      ],
+      href: "/serverless/data"
+    });
+  }
+  const proxy = data.proxy;
+  if (proxy) {
+    nodes.push({
+      id: "rds-proxy",
+      label: "RDS Proxy",
+      kind: "database",
+      layer: 5,
+      status: toneOf(proxy.status),
+      sub: "Connection pooling",
+      facts: [
+        { label: "Proxy", value: text(proxy.name, "unknown") },
+        { label: "Endpoint", value: text(proxy.endpoint, "unknown") },
+        { label: "Pooled", value: String(proxy.pooledConns ?? 0) }
+      ],
+      href: "/serverless/data"
+    });
+  }
+  const redis = data.redis;
+  if (redis) {
+    nodes.push({
+      id: "cache",
+      label: "ElastiCache",
+      kind: "cache",
+      layer: 6,
+      status: toneOf(redis.status),
+      sub: text(redis.node, "redis"),
+      facts: [
+        { label: "Group", value: text(redis.id, "unknown") },
+        { label: "Hit rate", value: `${redis.hitRate ?? 0}%` }
+      ],
+      href: "/serverless/data"
+    });
+  }
+  const efs = data.efs;
+  if (efs) {
+    nodes.push({
+      id: "efs",
+      label: "EFS",
+      kind: "filesystem",
+      layer: 6,
+      status: toneOf(efs.status),
+      sub: text(efs.mount, "/mnt/local"),
+      facts: [
+        { label: "File system", value: text(efs.id, "unknown") },
+        { label: "Mount", value: text(efs.mount, "unknown") },
+        { label: "Size", value: `${efs.sizeMb ?? 0} MB` }
+      ],
+      href: "/data/volumes"
+    });
+  }
+  const scheduler = data.scheduler ?? {};
+  if (scheduler.enabled) {
+    nodes.push({
+      id: "scheduler",
+      label: "Scheduler",
+      kind: "scheduler",
+      layer: 3,
+      status: "ok",
+      sub: text(scheduler.expression, "rate(1 minute)"),
+      facts: [
+        { label: "Expression", value: text(scheduler.expression, "unknown") },
+        { label: "Last run", value: text(scheduler.lastRun, "unknown") }
+      ],
+      href: "/operations/jobs"
+    });
+  }
+  const ids = new Set(nodes.map((node) => node.id));
+  const entry = ids.has("waf") ? "waf" : "gateway";
+  pushLink(links, { source: "internet", target: "dns", flow: "request", label: "https" }, ids);
+  pushLink(links, { source: "dns", target: entry, flow: "request" }, ids);
+  pushLink(links, { source: "dns", target: "cdn", flow: "request", label: "assets" }, ids);
+  pushLink(links, { source: "waf", target: "gateway", flow: "request", label: "allowed" }, ids);
+  pushLink(links, { source: "cdn", target: "assets", flow: "data", label: "origin" }, ids);
+  const httpFunctions = functions.filter((fn) => text(fn.key).startsWith("http"));
+  const queueFunctions = functions.filter((fn) => text(fn.key).startsWith("queue"));
+  const cliFunctions = functions.filter((fn) => text(fn.key).startsWith("cli"));
+  for (const fn of httpFunctions)
+    pushLink(links, { source: "gateway", target: `fn:${text(fn.name)}`, flow: "request", label: "invoke" }, ids);
+  for (const fn of cliFunctions)
+    pushLink(links, { source: "scheduler", target: `fn:${text(fn.name)}`, flow: "async", label: "schedule" }, ids);
+  for (const queue2 of queues) {
+    for (const fn of httpFunctions)
+      pushLink(links, { source: `fn:${text(fn.name)}`, target: `queue:${text(queue2.name)}`, flow: "async", label: "publish" }, ids);
+    for (const fn of queueFunctions)
+      pushLink(links, { source: `queue:${text(queue2.name)}`, target: `fn:${text(fn.name)}`, flow: "async", label: "consume" }, ids);
+  }
+  const stateful = ["rds-proxy", "database", "cache", "efs", "assets"];
+  for (const fn of functions) {
+    const id = `fn:${text(fn.name)}`;
+    if (ids.has("rds-proxy"))
+      pushLink(links, { source: id, target: "rds-proxy", flow: "data", label: "pooled" }, ids);
+    else
+      pushLink(links, { source: id, target: "database", flow: "data", label: "sql" }, ids);
+    for (const target of stateful.filter((candidate) => candidate !== "rds-proxy" && candidate !== "database"))
+      pushLink(links, { source: id, target, flow: "data" }, ids);
+  }
+  pushLink(links, { source: "rds-proxy", target: "database", flow: "data", label: "sql" }, ids);
+  return {
+    mode: "serverless",
+    project: text(context.project) || text(app.name, "application"),
+    environment: text(context.environment) || text(app.env, "production"),
+    provider: "aws",
+    region: text(app.region, "unknown"),
+    generatedAt: new Date().toISOString(),
+    layers: SERVERLESS_LAYERS,
+    groups: [],
+    nodes,
+    links,
+    notes
+  };
+}
+function buildTopology(mode, data, context = {}) {
+  return mode === "serverless" ? buildServerlessTopology(data, context) : buildServerTopology(data, context);
+}
+
 // src/deploy/dashboard-data.ts
 function pad(n) {
   return String(n).padStart(2, "0");
@@ -9373,8 +9930,91 @@ async function resolveDashboardData(config, environment2) {
         out.schedulerTasks = tasks;
     } catch {}
   }
+  out.topology = buildServerlessTopology(out, { project: config.project.name, environment: environment2 });
   return out;
 }
+// src/deploy/egress-collection.ts
+var MAX_REPLAY_DAYS = 45;
+var FETCH_TIMEOUT_MS = 1e4;
+function finite(value) {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : null;
+}
+function dayTimestamp(date) {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(date))
+    return null;
+  const parsed = Date.parse(`${date}T12:00:00.000Z`);
+  return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+function egressReportMetrics(report, options) {
+  if (!report || typeof report !== "object")
+    return [];
+  const attributes = { source: options.name };
+  const metrics = [];
+  const at = options.now;
+  const push = (name, value, unit, timestamp = at) => {
+    if (value !== null)
+      metrics.push({ name, value, unit, timestamp, attributes });
+  };
+  push("storage.egress.month", finite(report.monthBytes), "bytes");
+  push("storage.egress.today", finite(report.todayBytes), "bytes");
+  push("storage.egress.projected_month", finite(report.projectedMonthBytes), "bytes");
+  const budget = finite(report.budgetBytes);
+  if (budget !== null && budget > 0) {
+    push("storage.egress.budget", budget, "bytes");
+    const reported = report.budgetUsedPercent;
+    const percent = typeof reported === "number" && Number.isFinite(reported) ? reported : finite(report.monthBytes) !== null ? Math.round(finite(report.monthBytes) / budget * 1000) / 10 : null;
+    push("storage.egress.budget_used_percent", percent, "percent");
+  }
+  const limit = options.maxReplayDays ?? MAX_REPLAY_DAYS;
+  const days = Array.isArray(report.days) ? report.days.slice(-limit) : [];
+  for (const day of days) {
+    const timestamp = dayTimestamp(String(day?.date ?? ""));
+    const bytes = finite(day?.bytes);
+    if (!timestamp || bytes === null)
+      continue;
+    metrics.push({ name: "storage.egress.day", value: bytes, unit: "bytes", timestamp, attributes });
+    const downloads = finite(day?.downloads);
+    if (downloads !== null)
+      metrics.push({ name: "storage.egress.day_downloads", value: downloads, unit: "count", timestamp, attributes });
+  }
+  return metrics;
+}
+async function fetchEgressReport(endpoint, env = process.env, fetchImpl = fetch) {
+  const token = endpoint.tokenEnv ? env[endpoint.tokenEnv] : undefined;
+  const response = await fetchImpl(endpoint.url, {
+    headers: token ? { Authorization: `Bearer ${token}` } : {},
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  });
+  if (!response.ok)
+    throw new Error(`HTTP ${response.status}`);
+  return await response.json();
+}
+async function collectEgressMetrics(endpoints, options) {
+  const metrics = [];
+  const errors = [];
+  if (!Array.isArray(endpoints) || endpoints.length === 0)
+    return { metrics, errors };
+  const results = await Promise.all(endpoints.map(async (endpoint) => {
+    if (!endpoint?.name || !endpoint?.url)
+      return { endpoint, error: "egress endpoint needs both a name and a url" };
+    try {
+      const report = await fetchEgressReport(endpoint, options.env, options.fetchImpl);
+      return { endpoint, report };
+    } catch (error2) {
+      return { endpoint, error: error2 instanceof Error ? error2.message : String(error2) };
+    }
+  }));
+  for (const result of results) {
+    const source = `egress:${result.endpoint?.name ?? "unnamed"}`;
+    if ("error" in result && result.error) {
+      errors.push({ source, message: result.error });
+      continue;
+    }
+    metrics.push(...egressReportMetrics(result.report, { name: result.endpoint.name, now: options.now }));
+  }
+  return { metrics, errors };
+}
 // src/deploy/local-dashboard-server.ts
 import { createHash as createHash33 } from "node:crypto";
 import { existsSync as existsSync20, mkdtempSync as mkdtempSync3, readdirSync as readdirSync8, rmSync as rmSync3, statSync as statSync6 } from "node:fs";
@@ -10238,7 +10878,7 @@ class NotificationRouter {
   }
   async send(channel2, body) {
     const secret = credential(this.store.channelCredential(channel2.id));
-    const text = typeof body.notificationText === "string" ? body.notificationText : `[${String(body.alert?.severity ?? "info").toUpperCase()}] ${String(body.alert?.title ?? "ts-cloud alert")} · ${String(body.alert?.state ?? body.event)}`;
+    const text2 = typeof body.notificationText === "string" ? body.notificationText : `[${String(body.alert?.severity ?? "info").toUpperCase()}] ${String(body.alert?.title ?? "ts-cloud alert")} · ${String(body.alert?.state ?? body.event)}`;
     try {
       if (channel2.kind === "email") {
         if (!this.options.emailImpl)
@@ -10247,7 +10887,7 @@ class NotificationRouter {
           to: channel2.config.to,
           from: channel2.config.from,
           subject: `[ts-cloud] ${String(body.alert?.title ?? body.event)}`,
-          text: `${text}
+          text: `${text2}
 
 ${JSON.stringify(body, null, 2)}`
         });
@@ -10257,15 +10897,15 @@ ${JSON.stringify(body, null, 2)}`
       let posted = body;
       const headers = { "content-type": "application/json" };
       if (channel2.kind === "slack")
-        posted = { text };
+        posted = { text: text2 };
       if (channel2.kind === "discord")
-        posted = { content: text };
+        posted = { content: text2 };
       if (channel2.kind === "teams")
-        posted = { text };
+        posted = { text: text2 };
       if (channel2.kind === "telegram") {
         const token = secret.botToken ?? secret.value;
         url = `https://api.telegram.org/bot${token}/sendMessage`;
-        posted = { chat_id: channel2.config.chatId, text };
+        posted = { chat_id: channel2.config.chatId, text: text2 };
       }
       if (!url || !/^https:\/\//.test(url))
         return { ok: false, error: "Channel endpoint is unavailable or not HTTPS." };
@@ -10392,9 +11032,9 @@ class HealthCheckRunner {
             redirect: "manual"
           });
           const ttfbMs = performance.now() - requestStart;
-          const text = check.config.expectedBody ? await response.text() : "";
+          const text2 = check.config.expectedBody ? await response.text() : "";
           const expected = check.config.expectedStatuses ?? [200, 201, 202, 204];
-          const ok = expected.includes(response.status) && (!check.config.expectedBody || text.includes(check.config.expectedBody));
+          const ok = expected.includes(response.status) && (!check.config.expectedBody || text2.includes(check.config.expectedBody));
           return {
             checkId: check.id,
             status: ok ? "healthy" : "unhealthy",
@@ -11758,9 +12398,9 @@ function inspectApplicationArchive(bytes, filename, options = {}) {
     const header2 = bytes.subarray(offset, offset + 512);
     if (header2.every((value) => value === 0))
       break;
-    const text = (start, length) => new TextDecoder().decode(header2.subarray(start, start + length)).replace(/\0.*$/, "");
-    const name = `${text(345, 155)}${text(345, 155) ? "/" : ""}${text(0, 100)}`;
-    const size = Number.parseInt(text(124, 12).trim() || "0", 8);
+    const text2 = (start, length) => new TextDecoder().decode(header2.subarray(start, start + length)).replace(/\0.*$/, "");
+    const name = `${text2(345, 155)}${text2(345, 155) ? "/" : ""}${text2(0, 100)}`;
+    const size = Number.parseInt(text2(124, 12).trim() || "0", 8);
     const kind = String.fromCharCode(header2[156] ?? 0);
     if (!safePath(name))
       throw new Error(`Unsafe archive path: ${name}`);
@@ -16572,11 +17212,11 @@ function createApiV1Handler(options) {
     try {
       let body;
       const readBody = async () => {
-        const text = await request.text();
-        if (text.length > 1024 * 1024)
+        const text2 = await request.text();
+        if (text2.length > 1024 * 1024)
           throw new ApiServiceError("payload_too_large", "Request body exceeds 1 MB.", 413);
         try {
-          return JSON.parse(text);
+          return JSON.parse(text2);
         } catch {
           throw new ApiServiceError("invalid_json", "Request body must be valid JSON.", 400);
         }
@@ -17487,12 +18127,12 @@ data: ${JSON.stringify(event)}
         const idempotencyKey = request.headers.get("idempotency-key") ?? "";
         if (!idempotencyKey)
           throw new ApiServiceError("idempotency_required", "Idempotency-Key is required for deployment requests.", 428);
-        const text = await request.text();
-        if (text.length > 1024 * 1024)
+        const text2 = await request.text();
+        if (text2.length > 1024 * 1024)
           throw new ApiServiceError("payload_too_large", "Request body exceeds 1 MB.", 413);
         let deployment;
         try {
-          deployment = JSON.parse(text);
+          deployment = JSON.parse(text2);
         } catch {
           throw new ApiServiceError("invalid_json", "Request body must be valid JSON.", 400);
         }
@@ -19112,10 +19752,10 @@ function normalizeScheduleExpression(value) {
     description: `Cron ${expression.replace(/^cron\(|\)$/g, "")}`
   };
 }
-function nextScheduleRuns(expression, zone, from = new Date, count = 5) {
+function nextScheduleRuns(expression, zone, from = new Date, count2 = 5) {
   const parsed = normalizeScheduleExpression(expression);
   const validatedZone = validateTimezone(zone);
-  const amount = Math.min(20, Math.max(1, count));
+  const amount = Math.min(20, Math.max(1, count2));
   const duration2 = rateMilliseconds(parsed.normalized);
   if (duration2)
     return Array.from({ length: amount }, (_, index) => new Date(from.getTime() + duration2 * (index + 1)).toISOString());
@@ -19137,9 +19777,9 @@ function nextScheduleRuns(expression, zone, from = new Date, count = 5) {
     throw new Error("Schedule produced no runs within the bounded preview horizon.");
   return runs;
 }
-function previewSchedule(expression, zone = "UTC", from = new Date, count = 5) {
+function previewSchedule(expression, zone = "UTC", from = new Date, count2 = 5) {
   const parsed = normalizeScheduleExpression(expression);
-  const nextRuns = nextScheduleRuns(parsed.normalized, zone, from, count);
+  const nextRuns = nextScheduleRuns(parsed.normalized, zone, from, count2);
   const notes = parsed.kind === "cron" ? [
     "Server cron and EventBridge use the same wall-clock preview; provider-specific extensions are retained only when supported."
   ] : ["Rate schedules use elapsed-time intervals and are not shifted by DST."];
@@ -19621,14 +20261,14 @@ class JobService {
     for (const job2 of this.store.due(at.toISOString())) {
       const due = job2.nextRunAt, next = nextScheduleRuns(job2.normalizedExpression, job2.timezone, at, 1)[0];
       if (job2.missedRunPolicy === "catch_up") {
-        let cursor3 = due, count = 0;
-        while (cursor3 <= at.toISOString() && count < 10) {
+        let cursor3 = due, count2 = 0;
+        while (cursor3 <= at.toISOString() && count2 < 10) {
           queued.push(this.enqueue(job2, {
             trigger: cursor3 === due ? "scheduled" : "catch_up",
             scheduledFor: cursor3
           }));
           cursor3 = nextScheduleRuns(job2.normalizedExpression, job2.timezone, new Date(cursor3), 1)[0];
-          count++;
+          count2++;
         }
       } else
         queued.push(this.enqueue(job2, { trigger: "scheduled", scheduledFor: due }));
@@ -20441,14 +21081,14 @@ class BackupStore {
           ],
           [policy3.retention.monthly, (date) => date.toISOString().slice(0, 7)]
         ];
-        for (const [count, bucket] of buckets) {
+        for (const [count2, bucket] of buckets) {
           const seen = new Set;
           for (const item of points) {
             const key = bucket(new Date(item.pointInTime));
             if (seen.has(key))
               continue;
             seen.add(key);
-            if (seen.size <= Math.max(0, count ?? 0))
+            if (seen.size <= Math.max(0, count2 ?? 0))
               protectedIds.add(item.id);
           }
         }
@@ -21730,7 +22370,7 @@ var value = (input, key) => {
   const desired = input.desiredState;
   return input[key] ?? (desired && typeof desired === "object" && !Array.isArray(desired) ? desired[key] : undefined);
 };
-var text = (input, key, fallback) => {
+var text2 = (input, key, fallback) => {
   const result2 = value(input, key);
   return result2 == null ? fallback : String(result2);
 };
@@ -21746,7 +22386,7 @@ var strings2 = (input, key) => {
   const result2 = value(input, key);
   return Array.isArray(result2) ? result2.map(String) : [];
 };
-var snapshotName = (id, input) => text(input, "snapshotId") ?? `${id}-final-${new Date().toISOString().replace(/[^0-9]/g, "").slice(0, 14)}`;
+var snapshotName = (id, input) => text2(input, "snapshotId") ?? `${id}-final-${new Date().toISOString().replace(/[^0-9]/g, "").slice(0, 14)}`;
 function rdsObservation(instance2) {
   if (!instance2)
     throw new Error("RDS instance was not found.");
@@ -21780,19 +22420,19 @@ class AwsRdsTransport {
       DBInstanceIdentifier: id,
       DBInstanceClass: String(input.plan),
       Engine: String(input.engine),
-      MasterUsername: text(input, "username", "app"),
+      MasterUsername: text2(input, "username", "app"),
       MasterUserPassword: credential2,
-      DBName: text(input, "database"),
+      DBName: text2(input, "database"),
       AllocatedStorage: number2(input, "storageGb"),
       VpcSecurityGroupIds: strings2(input, "securityGroupIds"),
-      DBSubnetGroupName: text(input, "subnetGroup"),
+      DBSubnetGroupName: text2(input, "subnetGroup"),
       BackupRetentionPeriod: number2(input, "backupRetentionDays") ?? 7,
       MultiAZ: boolean2(input, "highAvailability"),
-      EngineVersion: text(input, "engineVersion"),
+      EngineVersion: text2(input, "engineVersion"),
       PubliclyAccessible: boolean2(input, "publicExposure") ?? false,
-      StorageType: text(input, "storageType", "gp3"),
+      StorageType: text2(input, "storageType", "gp3"),
       StorageEncrypted: true,
-      KmsKeyId: text(input, "kmsKeyId"),
+      KmsKeyId: text2(input, "kmsKeyId"),
       DeletionProtection: true,
       Tags: [{ Key: "managed-by", Value: "ts-cloud" }]
     });
@@ -21817,11 +22457,11 @@ class AwsRdsTransport {
       const targetId = String(input.targetId), result2 = await this.client.restoreDBInstanceFromDBSnapshot({
         DBInstanceIdentifier: targetId,
         DBSnapshotIdentifier: String(input.backupId),
-        DBInstanceClass: text(input, "plan"),
-        DBSubnetGroupName: text(input, "subnetGroup"),
+        DBInstanceClass: text2(input, "plan"),
+        DBSubnetGroupName: text2(input, "subnetGroup"),
         MultiAZ: boolean2(input, "highAvailability"),
         PubliclyAccessible: false,
-        StorageType: text(input, "storageType"),
+        StorageType: text2(input, "storageType"),
         VpcSecurityGroupIds: strings2(input, "securityGroupIds"),
         DeletionProtection: true,
         Tags: [{ Key: "managed-by", Value: "ts-cloud" }]
@@ -21852,10 +22492,10 @@ class AwsRdsTransport {
     if (["resize", "version", "rotate", "expose"].includes(action)) {
       const result2 = await this.client.modifyDBInstance({
         DBInstanceIdentifier: id,
-        DBInstanceClass: text(input, "plan"),
+        DBInstanceClass: text2(input, "plan"),
         AllocatedStorage: number2(input, "storageGb"),
         MasterUserPassword: action === "rotate" ? credential2 : undefined,
-        EngineVersion: text(input, "engineVersion"),
+        EngineVersion: text2(input, "engineVersion"),
         MultiAZ: boolean2(input, "highAvailability"),
         PubliclyAccessible: boolean2(input, "publicExposure"),
         VpcSecurityGroupIds: strings2(input, "securityGroupIds"),
@@ -21900,15 +22540,15 @@ class AwsAuroraTransport {
     await this.client.createDBCluster({
       DBClusterIdentifier: id,
       Engine: engine,
-      EngineVersion: text(input, "engineVersion"),
-      MasterUsername: text(input, "username", "app"),
+      EngineVersion: text2(input, "engineVersion"),
+      MasterUsername: text2(input, "username", "app"),
       MasterUserPassword: credential2,
-      DatabaseName: text(input, "database"),
-      DBSubnetGroupName: text(input, "subnetGroup"),
+      DatabaseName: text2(input, "database"),
+      DBSubnetGroupName: text2(input, "subnetGroup"),
       VpcSecurityGroupIds: strings2(input, "securityGroupIds"),
       BackupRetentionPeriod: number2(input, "backupRetentionDays") ?? 7,
       StorageEncrypted: true,
-      KmsKeyId: text(input, "kmsKeyId"),
+      KmsKeyId: text2(input, "kmsKeyId"),
       DeletionProtection: true,
       ServerlessV2ScalingConfiguration: {
         MinCapacity: number2(input, "minCapacity") ?? 0.5,
@@ -21941,8 +22581,8 @@ class AwsAuroraTransport {
         DBClusterIdentifier: targetId,
         SnapshotIdentifier: String(input.backupId),
         Engine: engine,
-        EngineVersion: text(input, "engineVersion"),
-        DBSubnetGroupName: text(input, "subnetGroup"),
+        EngineVersion: text2(input, "engineVersion"),
+        DBSubnetGroupName: text2(input, "subnetGroup"),
         VpcSecurityGroupIds: strings2(input, "securityGroupIds"),
         DeletionProtection: true,
         ServerlessV2ScalingConfiguration: {
@@ -21953,7 +22593,7 @@ class AwsAuroraTransport {
       await this.client.createDBInstance({
         DBInstanceIdentifier: `${targetId}-writer-1`,
         DBClusterIdentifier: targetId,
-        DBInstanceClass: text(input, "plan", "db.serverless"),
+        DBInstanceClass: text2(input, "plan", "db.serverless"),
         Engine: engine,
         PubliclyAccessible: false
       });
@@ -21982,7 +22622,7 @@ class AwsAuroraTransport {
           MinCapacity: number2(input, "minCapacity") ?? 0.5,
           MaxCapacity: number2(input, "maxCapacity") ?? 4
         },
-        EngineVersion: text(input, "engineVersion"),
+        EngineVersion: text2(input, "engineVersion"),
         MasterUserPassword: action === "rotate" ? credential2 : undefined,
         ApplyImmediately: boolean2(input, "applyImmediately") ?? true
       });
@@ -22019,10 +22659,10 @@ class AwsElastiCacheTransport {
       engine: "redis",
       cacheNodeType: String(input.plan),
       numCacheNodes: number2(input, "nodes") ?? 1,
-      engineVersion: text(input, "engineVersion"),
+      engineVersion: text2(input, "engineVersion"),
       port: number2(input, "port"),
       securityGroupIds: strings2(input, "securityGroupIds"),
-      subnetGroupName: text(input, "subnetGroup"),
+      subnetGroupName: text2(input, "subnetGroup"),
       tags: [{ Key: "managed-by", Value: "ts-cloud" }]
     });
     return {
@@ -26144,8 +26784,8 @@ class Logger2 {
     if (!input)
       return input;
     let out = input;
-    out = out.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, text2, url) => {
-      const label = styles2.underline(styles2.blue(text2));
+    out = out.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, text3, url) => {
+      const label = styles2.underline(styles2.blue(text3));
       const absFile = this.toAbsoluteFilePath(url);
       if (absFile && this.shouldStyleConsole() && this.supportsHyperlinks()) {
         const href = `file://${encodeURI(absFile)}`;
@@ -28453,20 +29093,20 @@ var init_dist = __esm(async () => {
   };
   config = await loadConfig2();
   terminalStyles = {
-    red: (text2) => `\x1B[31m${text2}\x1B[0m`,
-    green: (text2) => `\x1B[32m${text2}\x1B[0m`,
-    yellow: (text2) => `\x1B[33m${text2}\x1B[0m`,
-    blue: (text2) => `\x1B[34m${text2}\x1B[0m`,
-    magenta: (text2) => `\x1B[35m${text2}\x1B[0m`,
-    cyan: (text2) => `\x1B[36m${text2}\x1B[0m`,
-    white: (text2) => `\x1B[37m${text2}\x1B[0m`,
-    gray: (text2) => `\x1B[90m${text2}\x1B[0m`,
-    bgRed: (text2) => `\x1B[41m${text2}\x1B[0m`,
-    bgYellow: (text2) => `\x1B[43m${text2}\x1B[0m`,
-    bold: (text2) => `\x1B[1m${text2}\x1B[0m`,
-    dim: (text2) => `\x1B[2m${text2}\x1B[0m`,
-    italic: (text2) => `\x1B[3m${text2}\x1B[0m`,
-    underline: (text2) => `\x1B[4m${text2}\x1B[0m`,
+    red: (text3) => `\x1B[31m${text3}\x1B[0m`,
+    green: (text3) => `\x1B[32m${text3}\x1B[0m`,
+    yellow: (text3) => `\x1B[33m${text3}\x1B[0m`,
+    blue: (text3) => `\x1B[34m${text3}\x1B[0m`,
+    magenta: (text3) => `\x1B[35m${text3}\x1B[0m`,
+    cyan: (text3) => `\x1B[36m${text3}\x1B[0m`,
+    white: (text3) => `\x1B[37m${text3}\x1B[0m`,
+    gray: (text3) => `\x1B[90m${text3}\x1B[0m`,
+    bgRed: (text3) => `\x1B[41m${text3}\x1B[0m`,
+    bgYellow: (text3) => `\x1B[43m${text3}\x1B[0m`,
+    bold: (text3) => `\x1B[1m${text3}\x1B[0m`,
+    dim: (text3) => `\x1B[2m${text3}\x1B[0m`,
+    italic: (text3) => `\x1B[3m${text3}\x1B[0m`,
+    underline: (text3) => `\x1B[4m${text3}\x1B[0m`,
     reset: "\x1B[0m"
   };
   styles = terminalStyles;
@@ -28530,22 +29170,22 @@ var init_dist = __esm(async () => {
   };
   config2 = await loadConfig4();
   terminalStyles2 = {
-    red: (text2) => `\x1B[31m${text2}\x1B[0m`,
-    green: (text2) => `\x1B[32m${text2}\x1B[0m`,
-    yellow: (text2) => `\x1B[33m${text2}\x1B[0m`,
-    blue: (text2) => `\x1B[34m${text2}\x1B[0m`,
-    magenta: (text2) => `\x1B[35m${text2}\x1B[0m`,
-    cyan: (text2) => `\x1B[36m${text2}\x1B[0m`,
-    white: (text2) => `\x1B[37m${text2}\x1B[0m`,
-    gray: (text2) => `\x1B[90m${text2}\x1B[0m`,
-    bgRed: (text2) => `\x1B[41m${text2}\x1B[0m`,
-    bgYellow: (text2) => `\x1B[43m${text2}\x1B[0m`,
-    bgGray: (text2) => `\x1B[100m${text2}\x1B[0m`,
-    bold: (text2) => `\x1B[1m${text2}\x1B[0m`,
-    dim: (text2) => `\x1B[2m${text2}\x1B[0m`,
-    italic: (text2) => `\x1B[3m${text2}\x1B[0m`,
-    underline: (text2) => `\x1B[4m${text2}\x1B[0m`,
-    strikethrough: (text2) => `\x1B[9m${text2}\x1B[0m`,
+    red: (text3) => `\x1B[31m${text3}\x1B[0m`,
+    green: (text3) => `\x1B[32m${text3}\x1B[0m`,
+    yellow: (text3) => `\x1B[33m${text3}\x1B[0m`,
+    blue: (text3) => `\x1B[34m${text3}\x1B[0m`,
+    magenta: (text3) => `\x1B[35m${text3}\x1B[0m`,
+    cyan: (text3) => `\x1B[36m${text3}\x1B[0m`,
+    white: (text3) => `\x1B[37m${text3}\x1B[0m`,
+    gray: (text3) => `\x1B[90m${text3}\x1B[0m`,
+    bgRed: (text3) => `\x1B[41m${text3}\x1B[0m`,
+    bgYellow: (text3) => `\x1B[43m${text3}\x1B[0m`,
+    bgGray: (text3) => `\x1B[100m${text3}\x1B[0m`,
+    bold: (text3) => `\x1B[1m${text3}\x1B[0m`,
+    dim: (text3) => `\x1B[2m${text3}\x1B[0m`,
+    italic: (text3) => `\x1B[3m${text3}\x1B[0m`,
+    underline: (text3) => `\x1B[4m${text3}\x1B[0m`,
+    strikethrough: (text3) => `\x1B[9m${text3}\x1B[0m`,
     reset: "\x1B[0m"
   };
   styles2 = terminalStyles2;
@@ -28876,22 +29516,22 @@ class JsonFormatter3 {
   }
 }
 var terminalStyles3 = {
-  red: (text2) => `\x1B[31m${text2}\x1B[0m`,
-  green: (text2) => `\x1B[32m${text2}\x1B[0m`,
-  yellow: (text2) => `\x1B[33m${text2}\x1B[0m`,
-  blue: (text2) => `\x1B[34m${text2}\x1B[0m`,
-  magenta: (text2) => `\x1B[35m${text2}\x1B[0m`,
-  cyan: (text2) => `\x1B[36m${text2}\x1B[0m`,
-  white: (text2) => `\x1B[37m${text2}\x1B[0m`,
-  gray: (text2) => `\x1B[90m${text2}\x1B[0m`,
-  bgRed: (text2) => `\x1B[41m${text2}\x1B[0m`,
-  bgYellow: (text2) => `\x1B[43m${text2}\x1B[0m`,
-  bgGray: (text2) => `\x1B[100m${text2}\x1B[0m`,
-  bold: (text2) => `\x1B[1m${text2}\x1B[0m`,
-  dim: (text2) => `\x1B[2m${text2}\x1B[0m`,
-  italic: (text2) => `\x1B[3m${text2}\x1B[0m`,
-  underline: (text2) => `\x1B[4m${text2}\x1B[0m`,
-  strikethrough: (text2) => `\x1B[9m${text2}\x1B[0m`,
+  red: (text3) => `\x1B[31m${text3}\x1B[0m`,
+  green: (text3) => `\x1B[32m${text3}\x1B[0m`,
+  yellow: (text3) => `\x1B[33m${text3}\x1B[0m`,
+  blue: (text3) => `\x1B[34m${text3}\x1B[0m`,
+  magenta: (text3) => `\x1B[35m${text3}\x1B[0m`,
+  cyan: (text3) => `\x1B[36m${text3}\x1B[0m`,
+  white: (text3) => `\x1B[37m${text3}\x1B[0m`,
+  gray: (text3) => `\x1B[90m${text3}\x1B[0m`,
+  bgRed: (text3) => `\x1B[41m${text3}\x1B[0m`,
+  bgYellow: (text3) => `\x1B[43m${text3}\x1B[0m`,
+  bgGray: (text3) => `\x1B[100m${text3}\x1B[0m`,
+  bold: (text3) => `\x1B[1m${text3}\x1B[0m`,
+  dim: (text3) => `\x1B[2m${text3}\x1B[0m`,
+  italic: (text3) => `\x1B[3m${text3}\x1B[0m`,
+  underline: (text3) => `\x1B[4m${text3}\x1B[0m`,
+  strikethrough: (text3) => `\x1B[9m${text3}\x1B[0m`,
   reset: "\x1B[0m"
 };
 var styles3 = terminalStyles3;
@@ -29543,8 +30183,8 @@ class Logger3 {
     if (!input)
       return input;
     let out = input;
-    out = out.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, text2, url) => {
-      const label = styles3.underline(styles3.blue(text2));
+    out = out.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, text3, url) => {
+      const label = styles3.underline(styles3.blue(text3));
       const absFile = this.toAbsoluteFilePath(url);
       if (absFile && this.shouldStyleConsole() && this.supportsHyperlinks()) {
         const href = `file://${encodeURI(absFile)}`;
@@ -38389,15 +39029,15 @@ function findPropertyArray(configText, start, end, property) {
   const arrayStart = configText.indexOf("[", propertyStart);
   return { propertyStart, start: arrayStart, end: findMatching(configText, arrayStart, "[", "]") };
 }
-function findMatching(text2, start, open, close) {
+function findMatching(text3, start, open, close) {
   let depth = 0;
   let quote2;
   let escaped = false;
   let lineComment = false;
   let blockComment = false;
-  for (let index = start;index < text2.length; index++) {
-    const char = text2[index];
-    const next = text2[index + 1];
+  for (let index = start;index < text3.length; index++) {
+    const char = text3[index];
+    const next = text3[index + 1];
     if (lineComment) {
       if (char === `
 `)
@@ -38646,6 +39286,14 @@ EOF`,
     `echo "INODEPCT=$(df -Pi / 2>/dev/null | awk 'NR==2{gsub("%","",$5);print $5}')"`,
     `echo "NETRX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$3} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,
     `echo "NETTX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$11} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,
+    ". /var/lib/ts-cloud/bandwidth-state 2>/dev/null || true",
+    'echo "NETRXRATE=${RX_RATE:-0}"',
+    'echo "NETTXRATE=${TX_RATE:-0}"',
+    'echo "NETRXTODAY=${DAY_RX:-0}"',
+    'echo "NETTXTODAY=${DAY_TX:-0}"',
+    'echo "NETRXMONTH=${MONTH_RX:-0}"',
+    'echo "NETTXMONTH=${MONTH_TX:-0}"',
+    'echo "NETMONTHKEY=${MONTH_KEY:-}"',
     `echo "PROCESSES=$(ps -e --no-headers 2>/dev/null | awk 'END{print NR+0}')"`,
     `echo "UPTIME=$(uptime -p 2>/dev/null | sed 's/^up //' || echo unknown)"`,
     `echo "UPTIME_SECONDS=$(cut -d' ' -f1 /proc/uptime 2>/dev/null || echo 0)"`,
@@ -38734,6 +39382,11 @@ function configuredRegion(config6) {
     return resolveHetznerLocation(config6);
   return config6.project.region ?? "us-east-1";
 }
+function configuredBandwidthBudgetBytes(config6) {
+  const monitoring = config6.infrastructure?.compute?.monitoring;
+  const tb = Number(typeof monitoring === "object" ? monitoring?.alerts?.bandwidthTb ?? 0 : 0);
+  return Number.isFinite(tb) && tb > 0 ? Math.round(tb * 1000 ** 4) : 0;
+}
 function loadLocalState(config6, environment2) {
   const statePath2 = join12(process.cwd(), "storage", "cloud", "state", `${config6.project.slug}-${environment2}.json`);
   if (!existsSync17(statePath2))
@@ -39265,10 +39918,18 @@ function resolveConfigOnlyServerDashboardData(config6, environment2) {
       inodeUsedPct: 0,
       networkRxBytes: 0,
       networkTxBytes: 0,
+      networkRxBytesPerSec: 0,
+      networkTxBytesPerSec: 0,
+      networkRxBytesToday: 0,
+      networkTxBytesToday: 0,
+      networkRxBytesMonth: 0,
+      networkTxBytesMonth: 0,
+      networkMonthKey: "",
       processes: 0,
       uptimeSeconds: 0
     },
     metricsUnavailable: true,
+    bandwidthBudgetBytes: configuredBandwidthBudgetBytes(config6),
     services,
     servicesDetail: services.map((s) => ({ ...s, since: UNKNOWN, memMb: 0, auto: true })),
     backup: configuredBackup(config6),
@@ -39304,6 +39965,7 @@ function resolveConfigOnlyServerDashboardData(config6, environment2) {
   };
   out.diagnostics = diagnosticChecks(config6, out);
   out.activity = activityFeed(out);
+  out.topology = buildServerTopology(out, { project: config6.project.name, environment: environment2 });
   return out;
 }
 async function resolveServerDashboardData(config6, environment2, options = {}) {
@@ -39367,6 +40029,13 @@ async function resolveServerDashboardData(config6, environment2, options = {}) {
       inodeUsedPct: num(parsed.INODEPCT),
       networkRxBytes: num(parsed.NETRX),
       networkTxBytes: num(parsed.NETTX),
+      networkRxBytesPerSec: num(parsed.NETRXRATE),
+      networkTxBytesPerSec: num(parsed.NETTXRATE),
+      networkRxBytesToday: num(parsed.NETRXTODAY),
+      networkTxBytesToday: num(parsed.NETTXTODAY),
+      networkRxBytesMonth: num(parsed.NETRXMONTH),
+      networkTxBytesMonth: num(parsed.NETTXMONTH),
+      networkMonthKey: parsed.NETMONTHKEY || "",
       processes: num(parsed.PROCESSES),
       uptimeSeconds: num(parsed.UPTIME_SECONDS)
     };
@@ -39485,6 +40154,7 @@ async function resolveServerDashboardData(config6, environment2, options = {}) {
   out._serverReachable = instanceCount > 0 && !!parsed;
   out.diagnostics = diagnosticChecks(config6, out);
   out.activity = activityFeed(out);
+  out.topology = buildServerTopology(out, { project: config6.project.name, environment: environment2 });
   return out;
 }
 
@@ -40619,9 +41289,9 @@ function normalizeUser(raw) {
     createdAt: typeof raw.createdAt === "string" ? raw.createdAt : undefined
   };
 }
-function parseUsersFile(text2) {
+function parseUsersFile(text3) {
   try {
-    const parsed = JSON.parse(text2);
+    const parsed = JSON.parse(text3);
     if (!Array.isArray(parsed?.users))
       return [];
     return parsed.users.map(normalizeUser).filter((u) => u !== null);
@@ -41512,6 +42182,12 @@ function scopeCloudConfig(config6, user) {
   };
 }
 
+// src/deploy/dashboard-payload.ts
+function encodeDashboardPayload(data) {
+  const nonAscii = new RegExp("[\\u007F-\\uFFFF]", "g");
+  return JSON.stringify(data).replace(nonAscii, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+
 // src/deploy/dashboard-site-settings.ts
 var MEMBER_EDITABLE_SITE_FIELDS = new Set([
   "name",
@@ -41620,9 +42296,9 @@ class LoginThrottle {
     const key2 = this.key(username, address);
     const entry2 = this.attempts.get(key2);
     const stale = !entry2 || now - entry2.last > this.windowMs;
-    const count = stale ? 1 : entry2.count + 1;
-    const next = { count, last: now };
-    if (count >= this.maxAttempts)
+    const count2 = stale ? 1 : entry2.count + 1;
+    const next = { count: count2, last: now };
+    if (count2 >= this.maxAttempts)
       next.until = now + this.lockoutMs;
     this.attempts.set(key2, next);
   }
@@ -41659,14 +42335,14 @@ function addFirewallPort(configText, port, existing = []) {
 function removeFirewallPort(configText, port, existing = []) {
   return setFirewallPorts({ configText, ports: normalizePorts(existing.filter((p) => p !== port)) });
 }
-function findBlock(text2, start, end, keyword, open) {
-  const body = text2.slice(start, end);
+function findBlock(text3, start, end, keyword, open) {
+  const body = text3.slice(start, end);
   const match = new RegExp(`\\b${keyword}\\s*:\\s*\\${open}`).exec(body);
   if (!match)
     return null;
   const propStart = start + match.index;
-  const openIdx = text2.indexOf(open, propStart);
-  return { propStart, open: openIdx, close: findMatching(text2, openIdx, open, open === "{" ? "}" : "]") };
+  const openIdx = text3.indexOf(open, propStart);
+  return { propStart, open: openIdx, close: findMatching(text3, openIdx, open, open === "{" ? "}" : "]") };
 }
 function renderPortsArray(ports2) {
   return `allowedPorts: [${ports2.join(", ")}]`;
@@ -42310,21 +42986,21 @@ function removeSiteFromCloudConfig(input) {
   const span = findSiteSpan(input.configText, sites.start, sites.end, name);
   if (!span)
     throw new Error(`Site '${name}' does not exist in cloud.config.ts`);
-  const text2 = input.configText;
+  const text3 = input.configText;
   let start = span.nameStart;
-  while (start > 0 && text2[start - 1] !== `
-` && /\s/.test(text2[start - 1]))
+  while (start > 0 && text3[start - 1] !== `
+` && /\s/.test(text3[start - 1]))
     start--;
   let end = span.end + 1;
-  if (text2[end] === ",")
+  if (text3[end] === ",")
     end++;
-  while (end < text2.length && text2[end] !== `
-` && /\s/.test(text2[end]))
+  while (end < text3.length && text3[end] !== `
+` && /\s/.test(text3[end]))
     end++;
-  if (text2[end] === `
+  if (text3[end] === `
 `)
     end++;
-  return text2.slice(0, start) + text2.slice(end);
+  return text3.slice(0, start) + text3.slice(end);
 }
 function setSitePropertyInCloudConfig(input) {
   const name = normalizeSiteName(input.siteName);
@@ -42334,22 +43010,22 @@ function setSitePropertyInCloudConfig(input) {
   const span = findSiteSpan(input.configText, sites.start, sites.end, name);
   if (!span)
     throw new Error(`Site '${name}' does not exist in cloud.config.ts`);
-  const text2 = input.configText;
-  const braceStart = text2.indexOf("{", span.nameStart);
+  const text3 = input.configText;
+  const braceStart = text3.indexOf("{", span.nameStart);
   const braceEnd = span.end;
-  const body = text2.slice(braceStart + 1, braceEnd);
+  const body = text3.slice(braceStart + 1, braceEnd);
   const propMatch = new RegExp(`(^|[\\s,{])(${escapeRegExp(input.key)})\\s*:`, "m").exec(body);
   if (propMatch) {
     const keyStart = braceStart + 1 + propMatch.index + propMatch[1].length;
-    const colon = text2.indexOf(":", keyStart);
-    const valueEnd = scanValueEnd(text2, colon + 1, braceEnd);
-    return `${text2.slice(0, keyStart)}${input.key}: ${input.valueText}${text2.slice(valueEnd)}`;
+    const colon = text3.indexOf(":", keyStart);
+    const valueEnd = scanValueEnd(text3, colon + 1, braceEnd);
+    return `${text3.slice(0, keyStart)}${input.key}: ${input.valueText}${text3.slice(valueEnd)}`;
   }
-  const before = text2.slice(0, braceEnd).trimEnd();
+  const before = text3.slice(0, braceEnd).trimEnd();
   const sep5 = before.endsWith("{") || before.endsWith(",") ? "" : ",";
   return `${before}${sep5}
       ${input.key}: ${input.valueText},
-    ${text2.slice(braceEnd)}`;
+    ${text3.slice(braceEnd)}`;
 }
 function renderSslValue(ssl) {
   if (ssl === false)
@@ -42392,15 +43068,15 @@ ${entries.map(([from, to]) => `        '${escapeSingle(from)}': '${escapeSingle(
 `)}
       }`;
 }
-function scanValueEnd(text2, start, limit2) {
+function scanValueEnd(text3, start, limit2) {
   let i = start;
-  while (i < limit2 && /\s/.test(text2[i]))
+  while (i < limit2 && /\s/.test(text3[i]))
     i++;
   let depth = 0;
   let quote2;
   let escaped = false;
   for (;i < limit2; i++) {
-    const c = text2[i];
+    const c = text3[i];
     if (quote2) {
       if (escaped) {
         escaped = false;
@@ -42508,15 +43184,15 @@ function hasSite(configText, start, end, siteName) {
 function escapeRegExp(value2) {
   return value2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function findMatchingBrace(text2, start) {
+function findMatchingBrace(text3, start) {
   let depth = 0;
   let quote2;
   let escaped = false;
   let lineComment = false;
   let blockComment = false;
-  for (let index = start;index < text2.length; index++) {
-    const char = text2[index];
-    const next = text2[index + 1];
+  for (let index = start;index < text3.length; index++) {
+    const char = text3[index];
+    const next = text3[index + 1];
     if (lineComment) {
       if (char === `
 `)
@@ -42949,6 +43625,12 @@ async function collectNow(context) {
           ["host.disk.inode_used_percent", Number(metrics.inodeUsedPct), "percent"],
           ["host.network.rx", Number(metrics.networkRxBytes), "bytes"],
           ["host.network.tx", Number(metrics.networkTxBytes), "bytes"],
+          ["host.network.rx_rate", Number(metrics.networkRxBytesPerSec), "bytes_per_second"],
+          ["host.network.tx_rate", Number(metrics.networkTxBytesPerSec), "bytes_per_second"],
+          ["host.network.rx_today", Number(metrics.networkRxBytesToday), "bytes"],
+          ["host.network.tx_today", Number(metrics.networkTxBytesToday), "bytes"],
+          ["host.network.rx_month", Number(metrics.networkRxBytesMonth), "bytes"],
+          ["host.network.tx_month", Number(metrics.networkTxBytesMonth), "bytes"],
           ["host.processes", Number(metrics.processes), "count"],
           ["host.uptime", Number(metrics.uptimeSeconds), "seconds"]
         ];
@@ -43009,6 +43691,24 @@ async function collectNow(context) {
       message: error2 instanceof Error ? error2.message : String(error2)
     });
   }
+  {
+    const monitoring = context.config.infrastructure?.compute?.monitoring;
+    const endpoints = typeof monitoring === "object" ? monitoring?.egressEndpoints : undefined;
+    const egress = await collectEgressMetrics(endpoints, { now: now.toISOString() });
+    errors.push(...egress.errors);
+    for (const metric of egress.metrics)
+      records.push({
+        ...scope2,
+        id: id(metric.attributes.source, metric.name, metric.timestamp),
+        kind: "metric",
+        source: `egress:${metric.attributes.source}`,
+        name: metric.name,
+        timestamp: metric.timestamp,
+        value: metric.value,
+        unit: metric.unit,
+        attributes: metric.attributes
+      });
+  }
   if (!context.lightweight)
     try {
       const inventory2 = await resolveRuntimeInventory(context.config, context.environment);
@@ -43343,7 +44043,7 @@ function dashboardMutationAuditPayload(method, path, input, status, durationMs)
   };
 }
 var DUMMY_HASH = hashPassword("ts-cloud-dummy-password");
-function text2(data, status = 200) {
+function text3(data, status = 200) {
   return new Response(data, {
     status,
     headers: { "content-type": "text/plain; charset=utf-8" }
@@ -43387,8 +44087,8 @@ async function loadLocalEnv(cwd) {
   for (const file of candidates) {
     if (!existsSync20(file))
       continue;
-    const text3 = await readFile2(file, "utf8").catch(() => "");
-    for (const line of text3.split(`
+    const text4 = await readFile2(file, "utf8").catch(() => "");
+    for (const line of text4.split(`
 `)) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#") || !trimmed.includes("="))
@@ -43614,12 +44314,19 @@ async function resolveLiveDashboardData(config6, environment2, options = {}) {
 function preserveDashboardSiteSnapshot(previous, next) {
   if (!previous)
     return next;
-  return {
+  const merged = {
     ...next,
     ...Array.isArray(previous.sites) ? { sites: previous.sites } : {},
     ...Array.isArray(previous.sitesDetail) ? { sitesDetail: previous.sitesDetail } : {},
     ...Array.isArray(previous.siteHealth) ? { siteHealth: previous.siteHealth } : {}
   };
+  if (merged.mode !== "serverless" && Array.isArray(merged.sites)) {
+    merged.topology = buildServerTopology(merged, {
+      project: merged.project?.name,
+      environment: merged.environment
+    });
+  }
+  return merged;
 }
 function resolveUiSourceDir(cwd) {
   const candidates = [
@@ -43651,7 +44358,7 @@ async function buildLiveUi(cwd, data) {
       stderr: "pipe",
       env: {
         ...process.env,
-        TSCLOUD_DASHBOARD_DATA: JSON.stringify(data)
+        TSCLOUD_DASHBOARD_DATA: encodeDashboardPayload(data)
       }
     });
     const [stdout, stderr, exitCode] = await Promise.all([
@@ -43862,6 +44569,7 @@ var PAGE_CAPABILITIES = {
   "/server/actions": "runtime:restart",
   "/server/database": "data:read",
   "/server/firewall": "fleet:read",
+  "/infrastructure/topology": "fleet:read",
   "/server/security": "security:read",
   "/security": "security:read",
   "/integrations": "sources:read",
@@ -43934,10 +44642,10 @@ async function serveStatic(uiRoot, pathname) {
         status: 404,
         headers: { "content-type": "text/html; charset=utf-8" }
       });
-    return text2("Not found", 404);
+    return text3("Not found", 404);
   }
   if (statSync6(file).isDirectory())
-    return text2("Not found", 404);
+    return text3("Not found", 404);
   const body = await readFile2(file);
   const type = contentTypes[extname3(file)] ?? "application/octet-stream";
   return new Response(body, { headers: { "content-type": type } });
@@ -46101,7 +46809,7 @@ This link expires in one hour and can be used once.`
               return json15({ ok: false, error: "The web terminal is disabled." }, 403);
             if (activeServer.upgrade(req))
               return;
-            return text2("WebSocket upgrade failed", 400);
+            return text3("WebSocket upgrade failed", 400);
           }
           if (url.pathname === "/api/health") {
             const storage = controlPlane.store.health();
@@ -47055,9 +47763,9 @@ This replacement link expires ${created.invitation.expiresAt} and can be used on
               return json15({ ok: false, error: "Port must be a number between 1 and 65535." }, 422);
             if (typeof body.domain === "string" && body.domain.trim() && !isValidHostname(body.domain.trim()))
               return json15({ ok: false, error: `Domain '${body.domain.trim()}' is not a valid hostname.` }, 422);
-            let text3 = await readFile2(configPath, "utf8");
+            let text4 = await readFile2(configPath, "utf8");
             const set = (key2, valueText) => {
-              text3 = setSitePropertyInCloudConfig({ configText: text3, siteName: name, key: key2, valueText });
+              text4 = setSitePropertyInCloudConfig({ configText: text4, siteName: name, key: key2, valueText });
             };
             if (body.ssl !== undefined) {
               set("ssl", renderSslValue(body.ssl));
@@ -47086,7 +47794,7 @@ This replacement link expires ${created.invitation.expiresAt} and can be used on
               set("port", String(Number(body.port)));
               existing.port = Number(body.port);
             }
-            await writeFile4(configPath, text3);
+            await writeFile4(configPath, text4);
             latestData = await resolveLiveDashboardData(config6, environment2);
             latestDataByEnvironment.set(environment2, latestData);
             return json15({ ok: true, configPath, site: name, data: latestData });
@@ -49599,7 +50307,7 @@ data: ${JSON.stringify({ cursor: position, at: new Date().toISOString() })}
             });
           const uiRoot = await uiRootFor(user, environment2);
           if (!uiRoot)
-            return text2("ts-cloud dashboard UI is unavailable.", 503);
+            return text3("ts-cloud dashboard UI is unavailable.", 503);
           return serveStatic(uiRoot, url.pathname);
         } catch (error2) {
           if (options.verbose)
@@ -49657,4 +50365,4 @@ data: ${JSON.stringify({ cursor: position, at: new Date().toISOString() })}
   };
   return { server, url: `http://${host2}:${server.port}/` };
 }
-export { defaultConfig4 as defaultConfig, getConfig, loadCloudConfig, config5 as config, encodeBase32, decodeBase32, hotp, totp, verifyTotp, matchTotpCounter, totpUri, AUTH_SESSION_IDLE_TTL_MS, AUTH_SESSION_ABSOLUTE_TTL_MS, AUTH_ACTION_TOKEN_TTL_MS, AUTH_MFA_CHALLENGE_TTL_MS, AUTH_OIDC_TRANSACTION_TTL_MS, AuthenticationStore, sendAuthenticationEmail, authEncryptionKeyFile, resolveAuthEncryptionKey, sanitizeOidcReturnPath, discoverOidcProvider, beginOidcAuthorization, completeOidcAuthorization, CONTROL_PLANE_SCHEMA_VERSION, controlPlaneMigrations, AUTHORIZATION_CAPABILITIES, roleCapabilities, scopeContains, authorizeOrganization, effectiveCapabilities, OptimisticConcurrencyError, InvalidOperationTransitionError, UnsupportedSchemaVersionError, controlPlaneDatabaseFile, MAX_CONTROL_PLANE_JSON_BYTES, MAX_CONTROL_PLANE_ERROR_BYTES, sanitizeControlPlaneValue, ControlPlaneStore, searchControlPlane, API_TOKEN_DEFAULT_TTL_MS, API_TOKEN_MAX_TTL_MS, API_IDEMPOTENCY_TTL_MS, AutomationIdentityStore, TsCloudApiError, TsCloudClient, parseCompose, exportCompose, diffCompose, listComposeTemplates, getComposeTemplate, renderComposeTemplate, parseComposeCatalog, planComposeTemplateUpgrade, composeProjectName, buildComposeRuntimeCommand, buildComposeScaleCommand, buildComposeLogsCommand, buildComposeShellCommand, QueueCancellationError, QueueTimeoutError, RetryableOperationError, DurableOperationQueue, DurableQueueWorker, PreviewEnvironmentStore, PreviewEnvironmentService, DEPLOYMENT_QUEUE_KINDS, resolveQueuedDeploymentCommand, createDeploymentQueueHandlers, unsupportedVolumeCapabilities, volumeCapabilities, validateMountPath, validateAttachment, VolumeService, createVolumeQueueHandlers, DockerNamedVolumeDriver, ServerPathVolumeDriver, CloudBlockVolumeDriver, VolumeStore, synchronizeComposeVolumes, completeComposeVolumeDeletion, ComposeApplicationStore, ComposeApplicationService, releaseStrategyCapabilities, assertReleaseStrategy, ReleaseStore, ReleaseService, releaseTrafficPlan, activateImmutableRelease, rollbackImmutableRelease, RELEASE_QUEUE_KINDS, createReleaseQueueHandlers, SourceConnectionStore, SourceProviderError, GithubSourceAdapter, GitlabSourceAdapter, BitbucketSourceAdapter, GiteaSourceAdapter, createSourceAdapter, normalizeSourceEvent, processSourceWebhook, webhookEndpoint, discoverGitRefs, cloneSourceBinding, testSourceConnection, syncSourceRepositories, listSourceReferences, reconcileSourceWebhook, removeSourceWebhook, API_VERSION, openApiDocument, ApiServiceError, requestHash, AutomationApiService, createApiV1Handler, SecurityPostureStore, SECRET_PATTERNS, PreDeployScanner, scanForSecrets, formatScanResults, SecurityScannerRunner, SecretFindingScanner, TrivyImageScanner, AwsIamCapabilityScanner, generateCycloneDxSbom, generateImageSbom, attachSbomToRelease, attachVulnerabilitySummary, createReleaseProvenance, attachProvenanceToRelease, verifyArtifactSignature, securityScope, ensureDefaultSecurityPolicies, recordPreDeploySecretScan, recordSkippedSecretScan, recordDashboardHostPosture, productionChangeReview, secureContainerRelease, runtimeId2 as runtimeId, unsupportedCapabilities, capabilities2 as capabilities, normalizeRuntimeStatus, redactRuntimeConfig, ageSeconds, bytes, discoverRuntimeInventory, ecsWorkloads, lambdaWorkloads, parseDockerInspect, dockerWorkloads, DockerDiscoveryAdapter, parseSystemdRecords, systemdWorkloads, SystemdDiscoveryAdapter, EcsRuntimeAdapter, LambdaRuntimeAdapter, createRuntimeAdapters, resolveRuntimeInventory, authorizeRuntimePath, DIAGNOSTIC_PRESETS, RuntimeOperationService, RuntimeStreamRegistry, DEFAULT_TELEMETRY_POLICY, normalizeTelemetryPolicy, telemetryPolicyKey, loadTelemetryPolicy, saveTelemetryPolicy, telemetryEstimatedMonthlyCost, redactTelemetryText, redactTelemetryValue, pathTemplate, telemetryCursor, telemetryPercentile, telemetryBucketLabel, TelemetryStore, AlertStore, AlertEvaluator, isQuietHours, NotificationRouter, HealthCheckRunner, evaluateTelemetryAlertRules, normalizeScheduleExpression, nextScheduleRuns, previewSchedule, jobProviderCapability, renderServerCron, eventBridgeScheduleInput, reconcileJobObservation, desiredState, ServerCronJobAdapter, EventBridgeJobAdapter, JobProviderReconciler, synchronizeConfiguredJobs, JobService, createJobQueueHandlers, JobStore, dataServiceCapabilities, DataServiceStore, connectionGuidance, DataServiceLifecycle, createDataServiceQueueHandlers, AwsRdsDataAdapter, AwsAuroraDataAdapter, AwsElastiCacheDataAdapter, ServerDataAdapter, ContainerDataAdapter, AwsRdsTransport, AwsAuroraTransport, AwsElastiCacheTransport, BunDockerRuntime, DockerDataTransport, EncryptedDataSecretStore, SystemFleetSshTransport, SshFleetDriver, createFleetQueueHandlers, FleetStore, FleetService, zeroCapacity, capacity, PlacementStore, PlacementService, RemoteBuildService, createRemoteBuildQueueHandlers, TransportRemoteBuildDriver, createServerBuildDriver, createEcsBuildDriver, createAsgBuildDriver, RegionStore, RegionService, createRegionQueueHandlers, AwsRegionalDriver, UnavailableRegionalDriver, canonicalJson, manifestDigest, documentDigest, publicKeyFingerprint, verifyUpdateSignature, updateCompatibility, MaintenanceStore, maintenanceWindowOpen, MaintenanceService, createMaintenanceQueueHandlers, TransportPlatformMaintenanceDriver, ControlPlaneCleanupDriver, TransportDisasterRecoveryDriver, ensureDashboardActor, initializeDashboardControlPlane, synchronizeDashboardUsers, trackDashboardOperation, dashboardPageRoutes, resolveLegacyDashboardRoute, routesForDashboard, deploySite, createStaticApiOriginDependencies, deployStaticApiOrigin, verifyStaticApiOrigin, estimateStaticApiOriginMonthlyCost, createExistingStaticFullStackDependencies, generateExistingStaticFullStackTemplate, deployExistingStaticFullStack, estimateExistingStaticFullStackMonthlyCost, hashContainerContext, createContainerImageDependencies, buildAndPushContainerImage, infraEnvFromOutputs, buildFunctionEnv, deployServerlessApp, redeployServerlessApp, rollbackServerlessApp, setMaintenance, runRemoteCommand, resolveDashboardData, validateBackupDestination, BackupStore, encryptBackup, decryptBackup, backupCredentialStatus, S3BackupDestinationAdapter, BackupCoordinator, createBackupQueueHandlers, AwsDatabaseBackupSource, compressBackup, decompressBackup, BunFilesystemArchiveRuntime, FilesystemBackupSource, LogicalDatabaseBackupSource, BunDockerVolumeRuntime, DockerVolumeBackupSource, ControlPlaneBackupSource, AwsInfrastructureBackupSource, ConfigurationStore, parseDotenv, serializeDotenv, LocalEncryptedConfigurationBackend, AwsSecretsManagerConfigurationBackend, AwsSsmConfigurationBackend, ExternalConfigurationBackend, ConfigurationService, synchronizeConfiguredConfiguration, sanitizeCloudConfig, dashboardActions, resolveDashboardAction, startLocalDashboardServer };
+export { defaultConfig4 as defaultConfig, getConfig, loadCloudConfig, config5 as config, encodeBase32, decodeBase32, hotp, totp, verifyTotp, matchTotpCounter, totpUri, AUTH_SESSION_IDLE_TTL_MS, AUTH_SESSION_ABSOLUTE_TTL_MS, AUTH_ACTION_TOKEN_TTL_MS, AUTH_MFA_CHALLENGE_TTL_MS, AUTH_OIDC_TRANSACTION_TTL_MS, AuthenticationStore, sendAuthenticationEmail, authEncryptionKeyFile, resolveAuthEncryptionKey, sanitizeOidcReturnPath, discoverOidcProvider, beginOidcAuthorization, completeOidcAuthorization, CONTROL_PLANE_SCHEMA_VERSION, controlPlaneMigrations, AUTHORIZATION_CAPABILITIES, roleCapabilities, scopeContains, authorizeOrganization, effectiveCapabilities, OptimisticConcurrencyError, InvalidOperationTransitionError, UnsupportedSchemaVersionError, controlPlaneDatabaseFile, MAX_CONTROL_PLANE_JSON_BYTES, MAX_CONTROL_PLANE_ERROR_BYTES, sanitizeControlPlaneValue, ControlPlaneStore, searchControlPlane, API_TOKEN_DEFAULT_TTL_MS, API_TOKEN_MAX_TTL_MS, API_IDEMPOTENCY_TTL_MS, AutomationIdentityStore, TsCloudApiError, TsCloudClient, parseCompose, exportCompose, diffCompose, listComposeTemplates, getComposeTemplate, renderComposeTemplate, parseComposeCatalog, planComposeTemplateUpgrade, composeProjectName, buildComposeRuntimeCommand, buildComposeScaleCommand, buildComposeLogsCommand, buildComposeShellCommand, QueueCancellationError, QueueTimeoutError, RetryableOperationError, DurableOperationQueue, DurableQueueWorker, PreviewEnvironmentStore, PreviewEnvironmentService, DEPLOYMENT_QUEUE_KINDS, resolveQueuedDeploymentCommand, createDeploymentQueueHandlers, unsupportedVolumeCapabilities, volumeCapabilities, validateMountPath, validateAttachment, VolumeService, createVolumeQueueHandlers, DockerNamedVolumeDriver, ServerPathVolumeDriver, CloudBlockVolumeDriver, VolumeStore, synchronizeComposeVolumes, completeComposeVolumeDeletion, ComposeApplicationStore, ComposeApplicationService, releaseStrategyCapabilities, assertReleaseStrategy, ReleaseStore, ReleaseService, releaseTrafficPlan, activateImmutableRelease, rollbackImmutableRelease, RELEASE_QUEUE_KINDS, createReleaseQueueHandlers, SourceConnectionStore, SourceProviderError, GithubSourceAdapter, GitlabSourceAdapter, BitbucketSourceAdapter, GiteaSourceAdapter, createSourceAdapter, normalizeSourceEvent, processSourceWebhook, webhookEndpoint, discoverGitRefs, cloneSourceBinding, testSourceConnection, syncSourceRepositories, listSourceReferences, reconcileSourceWebhook, removeSourceWebhook, API_VERSION, openApiDocument, ApiServiceError, requestHash, AutomationApiService, createApiV1Handler, SecurityPostureStore, SECRET_PATTERNS, PreDeployScanner, scanForSecrets, formatScanResults, SecurityScannerRunner, SecretFindingScanner, TrivyImageScanner, AwsIamCapabilityScanner, generateCycloneDxSbom, generateImageSbom, attachSbomToRelease, attachVulnerabilitySummary, createReleaseProvenance, attachProvenanceToRelease, verifyArtifactSignature, securityScope, ensureDefaultSecurityPolicies, recordPreDeploySecretScan, recordSkippedSecretScan, recordDashboardHostPosture, productionChangeReview, secureContainerRelease, runtimeId2 as runtimeId, unsupportedCapabilities, capabilities2 as capabilities, normalizeRuntimeStatus, redactRuntimeConfig, ageSeconds, bytes, discoverRuntimeInventory, ecsWorkloads, lambdaWorkloads, parseDockerInspect, dockerWorkloads, DockerDiscoveryAdapter, parseSystemdRecords, systemdWorkloads, SystemdDiscoveryAdapter, EcsRuntimeAdapter, LambdaRuntimeAdapter, createRuntimeAdapters, resolveRuntimeInventory, authorizeRuntimePath, DIAGNOSTIC_PRESETS, RuntimeOperationService, RuntimeStreamRegistry, DEFAULT_TELEMETRY_POLICY, normalizeTelemetryPolicy, telemetryPolicyKey, loadTelemetryPolicy, saveTelemetryPolicy, telemetryEstimatedMonthlyCost, redactTelemetryText, redactTelemetryValue, pathTemplate, telemetryCursor, telemetryPercentile, telemetryBucketLabel, TelemetryStore, AlertStore, AlertEvaluator, isQuietHours, NotificationRouter, HealthCheckRunner, evaluateTelemetryAlertRules, normalizeScheduleExpression, nextScheduleRuns, previewSchedule, jobProviderCapability, renderServerCron, eventBridgeScheduleInput, reconcileJobObservation, desiredState, ServerCronJobAdapter, EventBridgeJobAdapter, JobProviderReconciler, synchronizeConfiguredJobs, JobService, createJobQueueHandlers, JobStore, dataServiceCapabilities, DataServiceStore, connectionGuidance, DataServiceLifecycle, createDataServiceQueueHandlers, AwsRdsDataAdapter, AwsAuroraDataAdapter, AwsElastiCacheDataAdapter, ServerDataAdapter, ContainerDataAdapter, AwsRdsTransport, AwsAuroraTransport, AwsElastiCacheTransport, BunDockerRuntime, DockerDataTransport, EncryptedDataSecretStore, SystemFleetSshTransport, SshFleetDriver, createFleetQueueHandlers, FleetStore, FleetService, zeroCapacity, capacity, PlacementStore, PlacementService, RemoteBuildService, createRemoteBuildQueueHandlers, TransportRemoteBuildDriver, createServerBuildDriver, createEcsBuildDriver, createAsgBuildDriver, RegionStore, RegionService, createRegionQueueHandlers, AwsRegionalDriver, UnavailableRegionalDriver, canonicalJson, manifestDigest, documentDigest, publicKeyFingerprint, verifyUpdateSignature, updateCompatibility, MaintenanceStore, maintenanceWindowOpen, MaintenanceService, createMaintenanceQueueHandlers, TransportPlatformMaintenanceDriver, ControlPlaneCleanupDriver, TransportDisasterRecoveryDriver, ensureDashboardActor, initializeDashboardControlPlane, synchronizeDashboardUsers, trackDashboardOperation, dashboardPageRoutes, resolveLegacyDashboardRoute, routesForDashboard, deploySite, createStaticApiOriginDependencies, deployStaticApiOrigin, verifyStaticApiOrigin, estimateStaticApiOriginMonthlyCost, createExistingStaticFullStackDependencies, generateExistingStaticFullStackTemplate, deployExistingStaticFullStack, estimateExistingStaticFullStackMonthlyCost, hashContainerContext, createContainerImageDependencies, buildAndPushContainerImage, infraEnvFromOutputs, buildFunctionEnv, deployServerlessApp, redeployServerlessApp, rollbackServerlessApp, setMaintenance, runRemoteCommand, buildServerTopology, buildServerlessTopology, buildTopology, resolveDashboardData, egressReportMetrics, fetchEgressReport, collectEgressMetrics, validateBackupDestination, BackupStore, encryptBackup, decryptBackup, backupCredentialStatus, S3BackupDestinationAdapter, BackupCoordinator, createBackupQueueHandlers, AwsDatabaseBackupSource, compressBackup, decompressBackup, BunFilesystemArchiveRuntime, FilesystemBackupSource, LogicalDatabaseBackupSource, BunDockerVolumeRuntime, DockerVolumeBackupSource, ControlPlaneBackupSource, AwsInfrastructureBackupSource, ConfigurationStore, parseDotenv, serializeDotenv, LocalEncryptedConfigurationBackend, AwsSecretsManagerConfigurationBackend, AwsSsmConfigurationBackend, ExternalConfigurationBackend, ConfigurationService, synchronizeConfiguredConfiguration, sanitizeCloudConfig, dashboardActions, resolveDashboardAction, startLocalDashboardServer };