@stacksjs/ts-cloud 0.7.110 → 0.7.111

package/dist/bin/cli.js

@@ -121,11 +121,11 @@ ${oE.bright}${oE.cyan}${E}${oE.reset}
 host:${A}
 `,"content-type;host","UNSIGNED-PAYLOAD"].join(`
 `),I=["AWS4-HMAC-SHA256",O,h,bE.createHash("sha256").update(J).digest("hex")].join(`
-`),W=bE.createHmac("sha256",`AWS4${L}`).update(U).digest(),H=bE.createHmac("sha256",W).update(this.region).digest(),w=bE.createHmac("sha256",H).update("s3").digest(),B=bE.createHmac("sha256",w).update("aws4_request").digest(),Q=bE.createHmac("sha256",B).update(I).digest("hex");return C.append("X-Amz-Signature",Q),`${this.endpointProtocol}://${A}${this.objectPath(E,D)}?${C.toString()}`}async createMultipartUpload(E,_,T){let R={};if(T?.contentType)R["Content-Type"]=T.contentType;if(T?.metadata)for(let[A,S]of Object.entries(T.metadata))R[`x-amz-meta-${A}`]=S;let N=_.split("/").map((A)=>encodeURIComponent(A)).join("/");return{UploadId:(await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${N}`,bucket:E,queryParams:{uploads:""},headers:R}))?.InitiateMultipartUploadResult?.UploadId}}async uploadPart(E,_,T,R,N){let{accessKeyId:L,secretAccessKey:A,sessionToken:S}=this.getCredentials(),O=this.s3VirtualHost(E),U=_.split("/").map((SE)=>encodeURIComponent(SE)).join("/"),h=this.objectPath(E,U),$=`${this.objectUrl(E,U)}?partNumber=${R}&uploadId=${encodeURIComponent(T)}`,D=new Date,C=D.toISOString().replace(/[:-]|\.\d{3}/g,""),J=D.toISOString().slice(0,10).replace(/-/g,""),I=bE.createHash("sha256").update(N).digest("hex"),W={host:O,"x-amz-date":C,"x-amz-content-sha256":I};if(S)W["x-amz-security-token"]=S;let H=Object.keys(W).sort().map((SE)=>`${SE.toLowerCase()}:${W[SE].trim()}
+`),W=bE.createHmac("sha256",`AWS4${L}`).update(U).digest(),H=bE.createHmac("sha256",W).update(this.region).digest(),w=bE.createHmac("sha256",H).update("s3").digest(),B=bE.createHmac("sha256",w).update("aws4_request").digest(),Q=bE.createHmac("sha256",B).update(I).digest("hex");return C.append("X-Amz-Signature",Q),`${this.endpointProtocol}://${A}${this.objectPath(E,D)}?${C.toString()}`}async createMultipartUpload(E,_,T){let R={};if(T?.contentType)R["Content-Type"]=T.contentType;if(T?.metadata)for(let[S,O]of Object.entries(T.metadata))R[`x-amz-meta-${S}`]=O;let N=_.split("/").map((S)=>encodeURIComponent(S)).join("/"),L=await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${N}`,bucket:E,queryParams:{uploads:""},headers:R});return{UploadId:(L?.InitiateMultipartUploadResult??L)?.UploadId}}async uploadPart(E,_,T,R,N){let{accessKeyId:L,secretAccessKey:A,sessionToken:S}=this.getCredentials(),O=this.s3VirtualHost(E),U=_.split("/").map((SE)=>encodeURIComponent(SE)).join("/"),h=this.objectPath(E,U),$=`${this.objectUrl(E,U)}?partNumber=${R}&uploadId=${encodeURIComponent(T)}`,D=new Date,C=D.toISOString().replace(/[:-]|\.\d{3}/g,""),J=D.toISOString().slice(0,10).replace(/-/g,""),I=bE.createHash("sha256").update(N).digest("hex"),W={host:O,"x-amz-date":C,"x-amz-content-sha256":I};if(S)W["x-amz-security-token"]=S;let H=Object.keys(W).sort().map((SE)=>`${SE.toLowerCase()}:${W[SE].trim()}
 `).join(""),w=Object.keys(W).sort().map((SE)=>SE.toLowerCase()).join(";"),B=["PUT",h,`partNumber=${R}&uploadId=${encodeURIComponent(T)}`,H,w,I].join(`
 `),Q="AWS4-HMAC-SHA256",K=`${J}/${this.region}/s3/aws4_request`,q=[Q,C,K,bE.createHash("sha256").update(B).digest("hex")].join(`
 `),x=bE.createHmac("sha256",`AWS4${A}`).update(J).digest(),g=bE.createHmac("sha256",x).update(this.region).digest(),k=bE.createHmac("sha256",g).update("s3").digest(),v=bE.createHmac("sha256",k).update("aws4_request").digest(),t=bE.createHmac("sha256",v).update(q).digest("hex"),EE=`${Q} Credential=${L}/${K}, SignedHeaders=${w}, Signature=${t}`,TE=await fetch($,{method:"PUT",headers:{...W,Authorization:EE},body:t9(N)});if(!TE.ok){let SE=await TE.text();throw Error(`Upload part failed: ${TE.status} ${SE}`)}return{ETag:TE.headers.get("etag")||""}}async completeMultipartUpload(E,_,T,R){let N=_.split("/").map((S)=>encodeURIComponent(S)).join("/"),A=`<?xml version="1.0" encoding="UTF-8"?>
-<CompleteMultipartUpload>${R.sort((S,O)=>S.PartNumber-O.PartNumber).map((S)=>`<Part><PartNumber>${S.PartNumber}</PartNumber><ETag>${S.ETag}</ETag></Part>`).join("")}</CompleteMultipartUpload>`;await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${N}`,bucket:E,queryParams:{uploadId:T},headers:{"Content-Type":"application/xml"},body:A})}async abortMultipartUpload(E,_,T){let R=_.split("/").map((N)=>encodeURIComponent(N)).join("/");await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${R}`,bucket:E,queryParams:{uploadId:T}})}async listMultipartUploads(E){let T=(await this.client.request({service:"s3",region:this.region,method:"GET",path:"/",bucket:E,queryParams:{uploads:""}}))?.ListMultipartUploadsResult?.Upload;if(!T)return[];return(Array.isArray(T)?T:[T]).map((N)=>({Key:N.Key,UploadId:N.UploadId,Initiated:N.Initiated}))}async restoreObject(E,_,T,R="Standard"){let N=`<?xml version="1.0" encoding="UTF-8"?>
+<CompleteMultipartUpload>${R.sort((S,O)=>S.PartNumber-O.PartNumber).map((S)=>`<Part><PartNumber>${S.PartNumber}</PartNumber><ETag>${S.ETag}</ETag></Part>`).join("")}</CompleteMultipartUpload>`;await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${N}`,bucket:E,queryParams:{uploadId:T},headers:{"Content-Type":"application/xml"},body:A})}async abortMultipartUpload(E,_,T){let R=_.split("/").map((N)=>encodeURIComponent(N)).join("/");await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${R}`,bucket:E,queryParams:{uploadId:T}})}async listMultipartUploads(E){let _=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/",bucket:E,queryParams:{uploads:""}}),T=(_?.ListMultipartUploadsResult??_)?.Upload;if(!T)return[];return(Array.isArray(T)?T:[T]).map((N)=>({Key:N.Key,UploadId:N.UploadId,Initiated:N.Initiated}))}async restoreObject(E,_,T,R="Standard"){let N=`<?xml version="1.0" encoding="UTF-8"?>
 <RestoreRequest>
   <Days>${T}</Days>
   <GlacierJobParameters>
@@ -8776,7 +8776,7 @@ writeFileSync(candidatePath, JSON.stringify(candidate, null, 2) + '\\n', { mode:
 `.trim();return[`__tsc_fragment_candidate="$(mktemp "${E}.candidate.XXXXXX")"`,`cat > "$__tsc_fragment_candidate" <<'${T}'`,_,T,'chmod 0600 "$__tsc_fragment_candidate"',`if [ -f ${E} ]; then TS_CLOUD_RPX_CURRENT_FRAGMENT=${E} TS_CLOUD_RPX_CANDIDATE_FRAGMENT="$__tsc_fragment_candidate" ${R.bunBin} -e ${kn(N)}; fi`,`mv -f "$__tsc_fragment_candidate" ${E}`,`chmod 0600 ${E}`]}function LH(E){return`rpx-cert-renew-${(E||"app").replace(/[^a-z0-9._-]+/gi,"-")}.service`}function bn(E){let _=new Set;for(let T of E.proxies){let R=T.to;if(!R||R.startsWith("*")||R.includes(":")||!R.includes("."))continue;_.add(R)}return[..._]}function gn(E){let{config:_,proxy:T}=E,R=_.acmeChallengeWebroot,N=bn(_);if(!T.onDemandTls||!R||N.length===0)return[];let L=E.bunBin??"/usr/local/bin/bun",A=T.version??"latest",S=_.productionCerts.certsDir,O=T.onDemandTlsEmail??`webmaster@${N[0]}`,U=`${L} ${HR}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`,h=N.join(","),$=N.join(" "),D=(E.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),C=`${RD}/renew-certs-${D}.sh`,J=LH(D),I=`rpx-cert-renew-${D}.timer`,W=["#!/bin/sh","# Generated by ts-cloud — issue/renew rpx gateway TLS certs via tlsx http-01.","# The running gateway serves the challenge from $WEBROOT on :80, so this needs","# no downtime and no DNS credentials. Reloads the gateway only if a cert changed.","set -u",`CERTS='${S}'`,`WEBROOT='${R}'`,`EMAIL='${O}'`,`TLSX="${U}"`,`DOMAINS='${h}'`,'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',`for d in ${$}; do`,'  if [ ! -s "$CERTS/$d.crt" ]; then','    $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',"    # rpx reloads its SNI set when a PEM appears. Complete that reload","    # before the next hostname starts http-01, or :80 can disappear in","    # the middle of the following challenge on a multi-domain deploy.",`    [ -s "$CERTS/$d.crt" ] && systemctl restart ${SS}`,"  fi","done",'$TLSX acme:renew --domains "$DOMAINS" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew: some domains failed (non-fatal)"','rm -f "$CERTS"/*.chain.crt','after=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',`[ "$before" = "$after" ] || systemctl restart ${SS}`].join(`
 `),H=["[Unit]",`Description=Issue/renew rpx gateway TLS certs for ${D} (tlsx http-01)`,`After=network-online.target ${SS}`,"Wants=network-online.target","","[Service]","Type=oneshot",`ExecStart=${C}`].join(`
 `),w=["[Unit]",`Description=Daily rpx gateway TLS cert issuance/renewal for ${D}`,"","[Timer]","OnCalendar=*-*-* 03:30:00","RandomizedDelaySec=1h","Persistent=true","","[Install]","WantedBy=timers.target"].join(`
-`);return[`mkdir -p ${R}`,`(cd ${HR} && ${L} add @stacksjs/tlsx@${A}) || true`,...JU(C,W,"TS_CLOUD_RENEW_EOF"),`chmod +x ${C}`,...JU(`/etc/systemd/system/${J}`,H,"TS_CLOUD_RENEW_SVC_EOF"),...JU(`/etc/systemd/system/${I}`,w,"TS_CLOUD_RENEW_TIMER_EOF"),"systemctl daemon-reload",`systemctl enable --now ${I} || true`,`${C} || true`]}function US(E){let{config:_,proxy:T}=E,R=E.bunBin??"/usr/local/bin/bun",N=T.version??"latest",L=_.productionCerts.certsDir,A=(E.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),S=JSON.stringify({slug:A,..._},null,2),O=fn(I0,L),h=[`Environment=RPX_UPSTREAM_TIMEOUT=${T.upstreamTimeout??60}`];if(typeof T.maxUpstreamConns==="number")h.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${T.maxUpstreamConns}`);let $=T.memoryHigh??"512M",D=T.memoryMax??"768M";return["set -euo pipefail",`mkdir -p ${RD} ${I0} ${L} ${HR}`,`rm -rf ${HR}.next ${HR}.prev`,`mkdir -p ${HR}.next`,`(cd ${HR}.next && ${R} add @stacksjs/rpx@${N})`,`mv ${HR} ${HR}.prev`,`mv ${HR}.next ${HR}`,`rm -rf ${HR}.prev`,`ln -sfn ${HR}/node_modules ${RD}/node_modules`,...yM(`${I0}/${A}.json`,S,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:R,preserveManagementDashboardRoutes:E.preserveManagementDashboardRoutes}),...JU(RH,O,"TS_CLOUD_RPX_EOF"),`${R} build --production --compile --outfile ${TD}.next ${RH}`,`chmod 0755 ${TD}.next`,`mv -f ${TD}.next ${TD}`,...JU(`/etc/systemd/system/${SS}`,["[Unit]","Description=rpx reverse-proxy gateway (managed by ts-cloud)","After=network.target network-online.target","Wants=network-online.target","","[Service]","Type=simple",`ExecStart=${TD}`,`WorkingDirectory=${HR}`,"Environment=BUN_INSTALL=/root/.bun","Environment=APP_ENV=production","Environment=NODE_ENV=production",...h,"MemoryAccounting=true",`MemoryHigh=${$}`,`MemoryMax=${D}`,"OOMPolicy=stop","Restart=always","RestartSec=5","LimitNOFILE=1048576","AmbientCapabilities=CAP_NET_BIND_SERVICE","","[Install]","WantedBy=multi-user.target"].join(`
+`);return[`mkdir -p ${R}`,`(cd ${HR} && ${L} add @stacksjs/tlsx@${A}) || true`,...JU(C,W,"TS_CLOUD_RENEW_EOF"),`chmod +x ${C}`,...JU(`/etc/systemd/system/${J}`,H,"TS_CLOUD_RENEW_SVC_EOF"),...JU(`/etc/systemd/system/${I}`,w,"TS_CLOUD_RENEW_TIMER_EOF"),"systemctl daemon-reload",`systemctl enable --now ${I} || true`,`${C} || true`]}function US(E){let{config:_,proxy:T}=E,R=E.bunBin??"/usr/local/bin/bun",N=T.version??"latest",L=_.productionCerts.certsDir,A=(E.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),S=JSON.stringify({slug:A,..._},null,2),O=fn(I0,L),h=[`Environment=RPX_UPSTREAM_TIMEOUT=${T.upstreamTimeout??60}`];if(typeof T.maxUpstreamConns==="number")h.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${T.maxUpstreamConns}`);let $=T.memoryHigh??"512M",D=T.memoryMax??"768M";return["set -euo pipefail",`mkdir -p ${RD} ${I0} ${L} ${HR}`,`rm -rf ${HR}.next ${HR}.prev`,`mkdir -p ${HR}.next`,`(cd ${HR}.next && ${R} add @stacksjs/rpx@${N})`,`mv ${HR} ${HR}.prev`,`mv ${HR}.next ${HR}`,`rm -rf ${HR}.prev`,`ln -sfn ${HR}/node_modules ${RD}/node_modules`,...yM(`${I0}/${A}.json`,S,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:R,preserveManagementDashboardRoutes:E.preserveManagementDashboardRoutes}),...JU(RH,O,"TS_CLOUD_RPX_EOF"),`${R} build --production --compile --outfile ${TD}.next ${RH}`,`chmod 0755 ${TD}.next`,`mv -f ${TD}.next ${TD}`,...JU(`/etc/systemd/system/${SS}`,["[Unit]","Description=rpx reverse-proxy gateway (managed by ts-cloud)","After=network.target network-online.target","Wants=network-online.target","","[Service]","Type=simple",`ExecStart=${TD}`,`WorkingDirectory=${HR}`,"Environment=BUN_INSTALL=/root/.bun","Environment=APP_ENV=production","Environment=NODE_ENV=production",...h,"MemoryAccounting=true",`MemoryHigh=${$}`,`MemoryMax=${D}`,"OOMPolicy=stop","Restart=always","RestartSec=5","StartLimitIntervalSec=120","StartLimitBurst=5",`ExecStartPre=/bin/sh -c 'for p in 80 443; do fuser -k -n tcp "$p" 2>/dev/null || true; done; sleep 1'`,"LimitNOFILE=1048576","AmbientCapabilities=CAP_NET_BIND_SERVICE","","[Install]","WantedBy=multi-user.target"].join(`
 `),"TS_CLOUD_RPX_UNIT_EOF"),"systemctl daemon-reload","systemctl disable --now bun-gateway.service 2>/dev/null || true","systemctl disable --now bun-gateway-renew.timer bun-gateway-renew.service 2>/dev/null || true","rm -f /etc/systemd/system/bun-gateway-renew.timer /etc/systemd/system/bun-gateway-renew.service","systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",`for timer in /etc/systemd/system/rpx-cert-renew-*.timer; do [ -e "$timer" ] || continue; unit="$(basename "$timer")"; tenant="\${unit#rpx-cert-renew-}"; tenant="\${tenant%.timer}"; [ -f "${I0}/$tenant.json" ] && continue; systemctl disable --now "$unit" 2>/dev/null || true; rm -f "$timer" "/etc/systemd/system/rpx-cert-renew-$tenant.service" "${RD}/renew-certs-$tenant.sh"; done`,`systemctl enable ${SS}`,`systemctl restart ${SS}`,...gn(E)]}function ND(E){let _=(E.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),T=JSON.stringify({slug:_,...E.config},null,2);return["set -euo pipefail",`mkdir -p ${I0}`,...yM(`${I0}/${_}.json`,T,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:"/usr/local/bin/bun",preserveManagementDashboardRoutes:E.preserveManagementDashboardRoutes}),`systemctl restart ${SS}`]}var NH="/etc/rpx/certs",dn="/var/www/acme-challenge",RD="/etc/rpx",HR="/opt/rpx-gateway",RH="/etc/rpx/gateway.ts",TD="/etc/rpx/gateway",SS="rpx-gateway.service",I0="/etc/rpx/sites.d";var hS=NE(async()=>{await AS()});function z2(E={}){if(E.enabled===!1)return[];let _=[...new Set([...cn,...E.allowedPorts||[]])].filter((R)=>Number.isInteger(R)&&R>=1&&R<=65535).sort((R,N)=>R-N),T=["export DEBIAN_FRONTEND=noninteractive","command -v ufw >/dev/null 2>&1 || apt-get install -y ufw","ufw --force reset","ufw default deny incoming","ufw default allow outgoing","ufw allow OpenSSH"];for(let R of _)T.push(`ufw allow ${R}/tcp`);return T.push("ufw --force enable"),T}var cn;var AH=NE(()=>{cn=[80,443]});function B2(E){return E.split("=",1)[0]??E}function fM(E){return E.replace(/@[^.]+(?=\.service$)/,"")}function kM(E,_){let T=new Set(_.runningServices.map(fM)),R=new Set(_.routeFragments.map(B2)),N=new Set(_.releaseLinks.map(B2)),L=new Set(_.routeIds),A=new Set(_.dataCatalog);return{stoppedServices:E.runningServices.filter((S)=>!T.has(fM(S))),changedRouteFragments:E.routeFragments.filter((S)=>!R.has(B2(S))),missingRouteIds:E.routeIds.filter((S)=>!L.has(S)),changedReleaseLinks:E.releaseLinks.filter((S)=>!N.has(B2(S))),missingData:E.dataCatalog.filter((S)=>!A.has(S))}}function bM(E){return E.infrastructure?.compute??{}}function H2(E){let _=bM(E),T=_.monitoring;return{firewallPorts:[...new Set([22,80,443,..._.firewall?.allowedPorts??[]])].filter((N)=>Number.isInteger(N)&&N>=1&&N<=65535).sort((N,L)=>N-L),monitoring:T!==!1&&(typeof T!=="object"||T.enabled!==!1),autoUpdates:_.autoUpdates!==!1,swapGb:Math.max(0,Math.floor(_.swapGb??2)),sshPasswordAuthentication:!1,journalMaxUse:"256M",journalRetention:"14day"}}function vn(E){return["install -d -m 0755 /etc/ssh/sshd_config.d /etc/systemd/journald.conf.d /etc/sysctl.d /etc/fail2ban/jail.d","cat > /etc/ssh/sshd_config.d/99-ts-cloud-hardening.conf <<'TS_CLOUD_SSH_EOF'","# Managed by ts-cloud host optimization.","PasswordAuthentication no","KbdInteractiveAuthentication no","PermitRootLogin prohibit-password","MaxAuthTries 4","LoginGraceTime 30","TS_CLOUD_SSH_EOF","sshd -t","systemctl reload ssh","cat > /etc/systemd/journald.conf.d/99-ts-cloud-retention.conf <<'TS_CLOUD_JOURNAL_EOF'","[Journal]",`SystemMaxUse=${E.journalMaxUse}`,`MaxRetentionSec=${E.journalRetention}`,"Compress=yes","TS_CLOUD_JOURNAL_EOF","systemctl restart systemd-journald","journalctl --vacuum-size=256M --vacuum-time=14d >/dev/null","cat > /etc/sysctl.d/99-ts-cloud-production.conf <<'TS_CLOUD_SYSCTL_EOF'","# Managed by ts-cloud host optimization.","vm.swappiness=10","vm.dirty_background_ratio=5","vm.dirty_ratio=15","net.core.somaxconn=4096","net.ipv4.tcp_max_syn_backlog=4096","net.ipv4.tcp_fin_timeout=30","net.ipv4.tcp_keepalive_time=300","net.ipv4.tcp_keepalive_intvl=30","net.ipv4.tcp_keepalive_probes=5","fs.inotify.max_user_watches=524288","TS_CLOUD_SYSCTL_EOF","sysctl --system >/dev/null","export DEBIAN_FRONTEND=noninteractive","command -v fail2ban-client >/dev/null 2>&1 || apt-get install -y fail2ban","cat > /etc/fail2ban/jail.d/99-ts-cloud-sshd.conf <<'TS_CLOUD_FAIL2BAN_EOF'","[sshd]","enabled = true","backend = systemd","bantime = 1h","findtime = 10m","maxretry = 5","TS_CLOUD_FAIL2BAN_EOF","systemctl enable --now fail2ban","systemctl restart fail2ban"]}function rn(E){if(E===0)return[];return["if ! swapon --show=NAME --noheadings 2>/dev/null | grep -qx '/swapfile'; then",`  if [ ! -f /swapfile ]; then fallocate -l ${E}G /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=${E*1024} status=none; fi`,"  chmod 600 /swapfile","  mkswap /swapfile >/dev/null","  swapon /swapfile","fi","grep -qE '^/swapfile\\s' /etc/fstab || echo '/swapfile none swap sw 0 0' >> /etc/fstab"]}function gM(E){let _=bM(E),T=H2(E),R=_.monitoring??!0,N=_.firewall??{enabled:!0};return["set -euo pipefail",...jR(_)?["systemctl disable --now nginx.service bun-gateway.service ts-cloud-nginx.service 2>/dev/null || true","systemctl reset-failed nginx.service bun-gateway.service ts-cloud-nginx.service 2>/dev/null || true"]:[],...rn(T.swapGb),...NS(T.autoUpdates),...LS(R),...vn(T),...z2(N),"systemctl daemon-reload","systemctl reset-failed"]}function tn(E){return`printf %s ${Buffer.from(E).toString("base64")} | base64 -d | bun -`}async function SH(E,_){let T=gM(E).join(`
 `),R=`printf %s ${Buffer.from(T).toString("base64")} | base64 -d | bash`;await UN(_.host,R,_)}async function OH(E){let _=await UN(E.host,tn(un),E);return JSON.parse(_)}function UH(E,_){let T=[],R=new Set(_.firewallPorts),N=E.firewallPorts.filter((A)=>!R.has(A)),L=_.firewallPorts.filter((A)=>!E.firewallPorts.includes(A));if(!_.firewallActive)T.push("UFW is not active");if(N.length>0)T.push(`UFW is missing ports: ${N.join(", ")}`);if(L.length>0)T.push(`UFW has unexpected ports: ${L.join(", ")}`);if(_.passwordAuthentication)T.push("SSH password authentication remains enabled");if(_.rootPasswordLogin)T.push("SSH root password login remains enabled");if(!_.fail2banActive)T.push("fail2ban is not active");if(E.autoUpdates&&!_.unattendedUpgradesActive)T.push("unattended upgrades are not active");if(E.monitoring&&!_.metricsTimerActive)T.push("metrics timer is not active");if(E.monitoring&&!_.metricsSnapshotFresh)T.push("metrics snapshot is stale");if(E.swapGb>0&&_.swapBytes<E.swapGb*1073741824*0.9)T.push("configured swap is missing");if(_.failedUnits.length>0)T.push(`failed services: ${_.failedUnits.join(", ")}`);return T}var un;var hH=NE(async()=>{ED();AH();await hS();un=String.raw`
 const text = (command) => {
@@ -9694,7 +9694,7 @@ Run \`${this.name??"cli"} --help\` for usage.`;qA.stderr.write(`${L}${N}${A}
 `).length-1;this.output.write(KL.move(-999,E*-1))}render(){let E=$9(this._render(this)??"",h9.stdout.columns,{hard:!0,trim:!1});if(E===this._prevFrame)return;if(this.state==="initial")this.output.write(KL.hide);else{let _=zf(this._prevFrame,E);if(this.restoreCursor(),_&&_?.length===1){let T=_[0];this.output.write(KL.move(0,T)),this.output.write(HF.lines(1));let R=E.split(`
 `);this.output.write(R[T]),this._prevFrame=E,this.output.write(KL.move(0,R.length-T-1));return}if(_&&_?.length>1){let T=_[0];this.output.write(KL.move(0,T)),this.output.write(HF.down());let N=E.split(`
 `).slice(T);this.output.write(N.join(`
-`)),this._prevFrame=E;return}this.output.write(HF.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function Qf(E,_){if(E===void 0)return 0;if(_.length===0)return 0;let R=_.findIndex((N)=>N.value===E);return R!==-1?R:0}function Gf(E,_){return(_.label??String(_.value)).toLowerCase().includes(E.toLowerCase())}function Pf(E,_){if(!_)return;if(E)return _;return _[0]}class Mf extends PF{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#T="";#R;#_;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return FC.inverse(FC.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[_,...T]=this.userInput.slice(this._cursor);return`${E}${FC.inverse(_)}${T.join("")}`}get options(){if(typeof this.#_==="function")return this.#_();return this.#_}constructor(E){super(E);this.#_=E.options;let _=this.options;this.filteredOptions=[..._],this.multiple=E.multiple===!0,this.#R=E.filter??Gf;let T;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)T=E.initialValue;else T=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)T=[this.options[0].value];if(T)for(let R of T){let N=_.findIndex((L)=>L.value===R);if(N!==-1)this.toggleSelected(R),this.#E=N}this.focusedValue=this.options[this.#E]?.value,this.on("key",(R,N)=>this.#N(R,N)),this.on("userInput",(R)=>this.#L(R))}_isActionKey(E,_){return E==="\t"||this.multiple&&this.isNavigating&&_.name==="space"&&E!==void 0&&E!==""}#N(E,_){let T=_.name==="up",R=_.name==="down",N=_.name==="return";if(T||R){if(this.#E=Math.max(0,Math.min(this.#E+(T?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(N)this.value=Pf(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(_.name==="tab"||this.isNavigating&&_.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((_)=>_!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#L(E){if(E!==this.#T){this.#T=E;let _=this.options;if(E)this.filteredOptions=_.filter((T)=>this.#R(E,T));else this.filteredOptions=[..._];if(this.#E=Qf(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class Kf extends PF{options;cursor=0;#E;getGroupItems(E){return this.options.filter((_)=>_.group===E)}isGroupSelected(E){let _=this.getGroupItems(E),T=this.value;if(T===void 0)return!1;return _.every((R)=>T.includes(R.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let _=String(E.value),T=this.getGroupItems(_);if(this.isGroupSelected(_))this.value=this.value.filter((R)=>T.findIndex((N)=>N.value===R)===-1);else this.value=[...this.value,...T.map((R)=>R.value)];this.value=Array.from(new Set(this.value))}else{let _=this.value.includes(E.value);this.value=_?this.value.filter((T)=>T!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:_}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(_).flatMap(([T,R])=>[{value:T,group:!0,label:T},...R.map((N)=>({...N,group:T}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:T})=>T===E.cursorAt),this.#E?0:1),this.on("cursor",(T)=>{switch(T){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let R=this.options[this.cursor]?.group===!0;if(!this.#E&&R)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let R=this.options[this.cursor]?.group===!0;if(!this.#E&&R)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var Vf=by();var Z_=(E,_)=>Vf?E:_,sLE=Z_("◆","*"),pLE=Z_("■","x"),oLE=Z_("▲","x"),EAE=Z_("◇","o"),_AE=Z_("┌","T"),Zf=Z_("│","|"),TAE=Z_("└","—"),RAE=Z_("●",">"),NAE=Z_("○"," "),LAE=Z_("◻","[•]"),AAE=Z_("◼","[+]"),SAE=Z_("◻","[ ]"),OAE=Z_("▪","•"),UAE=Z_("─","-"),hAE=Z_("╮","+"),$AE=Z_("├","+"),DAE=Z_("╯","+"),CAE=Z_("●","•"),XAE=Z_("◆","*"),JAE=Z_("▲","!"),IAE=Z_("■","x");var FAE={light:Z_("─","-"),heavy:Z_("━","="),block:Z_("█","#")};function df(){return`${FC.gray(Zf)}  `}var WAE=df();var MF="0.7.110";kE();import{existsSync as kF}from"node:fs";import{mkdir as uf,writeFile as K9}from"node:fs/promises";function bF(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(_)=>{if(r("Initializing ts-cloud Project"),kF("cloud.config.ts")){if(!await WE("cloud.config.ts already exists. Overwrite?",!1)){X("Initialization cancelled");return}}let T=_?.name||await X_("Project name","my-app"),R=_?.mode||await BC("Select deployment mode",["serverless","server"]),N=_?.region||await BC("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),L=new l("Creating configuration file...");L.start();let A=`import { defineConfig } from '@ts-cloud/core'
+`)),this._prevFrame=E;return}this.output.write(HF.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function Qf(E,_){if(E===void 0)return 0;if(_.length===0)return 0;let R=_.findIndex((N)=>N.value===E);return R!==-1?R:0}function Gf(E,_){return(_.label??String(_.value)).toLowerCase().includes(E.toLowerCase())}function Pf(E,_){if(!_)return;if(E)return _;return _[0]}class Mf extends PF{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#T="";#R;#_;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return FC.inverse(FC.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[_,...T]=this.userInput.slice(this._cursor);return`${E}${FC.inverse(_)}${T.join("")}`}get options(){if(typeof this.#_==="function")return this.#_();return this.#_}constructor(E){super(E);this.#_=E.options;let _=this.options;this.filteredOptions=[..._],this.multiple=E.multiple===!0,this.#R=E.filter??Gf;let T;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)T=E.initialValue;else T=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)T=[this.options[0].value];if(T)for(let R of T){let N=_.findIndex((L)=>L.value===R);if(N!==-1)this.toggleSelected(R),this.#E=N}this.focusedValue=this.options[this.#E]?.value,this.on("key",(R,N)=>this.#N(R,N)),this.on("userInput",(R)=>this.#L(R))}_isActionKey(E,_){return E==="\t"||this.multiple&&this.isNavigating&&_.name==="space"&&E!==void 0&&E!==""}#N(E,_){let T=_.name==="up",R=_.name==="down",N=_.name==="return";if(T||R){if(this.#E=Math.max(0,Math.min(this.#E+(T?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(N)this.value=Pf(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(_.name==="tab"||this.isNavigating&&_.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((_)=>_!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#L(E){if(E!==this.#T){this.#T=E;let _=this.options;if(E)this.filteredOptions=_.filter((T)=>this.#R(E,T));else this.filteredOptions=[..._];if(this.#E=Qf(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class Kf extends PF{options;cursor=0;#E;getGroupItems(E){return this.options.filter((_)=>_.group===E)}isGroupSelected(E){let _=this.getGroupItems(E),T=this.value;if(T===void 0)return!1;return _.every((R)=>T.includes(R.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let _=String(E.value),T=this.getGroupItems(_);if(this.isGroupSelected(_))this.value=this.value.filter((R)=>T.findIndex((N)=>N.value===R)===-1);else this.value=[...this.value,...T.map((R)=>R.value)];this.value=Array.from(new Set(this.value))}else{let _=this.value.includes(E.value);this.value=_?this.value.filter((T)=>T!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:_}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(_).flatMap(([T,R])=>[{value:T,group:!0,label:T},...R.map((N)=>({...N,group:T}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:T})=>T===E.cursorAt),this.#E?0:1),this.on("cursor",(T)=>{switch(T){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let R=this.options[this.cursor]?.group===!0;if(!this.#E&&R)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let R=this.options[this.cursor]?.group===!0;if(!this.#E&&R)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var Vf=by();var Z_=(E,_)=>Vf?E:_,sLE=Z_("◆","*"),pLE=Z_("■","x"),oLE=Z_("▲","x"),EAE=Z_("◇","o"),_AE=Z_("┌","T"),Zf=Z_("│","|"),TAE=Z_("└","—"),RAE=Z_("●",">"),NAE=Z_("○"," "),LAE=Z_("◻","[•]"),AAE=Z_("◼","[+]"),SAE=Z_("◻","[ ]"),OAE=Z_("▪","•"),UAE=Z_("─","-"),hAE=Z_("╮","+"),$AE=Z_("├","+"),DAE=Z_("╯","+"),CAE=Z_("●","•"),XAE=Z_("◆","*"),JAE=Z_("▲","!"),IAE=Z_("■","x");var FAE={light:Z_("─","-"),heavy:Z_("━","="),block:Z_("█","#")};function df(){return`${FC.gray(Zf)}  `}var WAE=df();var MF="0.7.111";kE();import{existsSync as kF}from"node:fs";import{mkdir as uf,writeFile as K9}from"node:fs/promises";function bF(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(_)=>{if(r("Initializing ts-cloud Project"),kF("cloud.config.ts")){if(!await WE("cloud.config.ts already exists. Overwrite?",!1)){X("Initialization cancelled");return}}let T=_?.name||await X_("Project name","my-app"),R=_?.mode||await BC("Select deployment mode",["serverless","server"]),N=_?.region||await BC("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),L=new l("Creating configuration file...");L.start();let A=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -10048,7 +10048,7 @@ Resources to create: ${Q}`);let K={};for(let q of Object.values(U.Resources||{})
 No changes detected - infrastructure is up to date`);return}if(X(`
 Changes detected:
 `),W.length>0){b(`Resources to add (${W.length}):`);for(let B of W){let Q=C[B].Type;X(`  + ${B} (${Q})`)}console.log()}if(H.length>0){d(`Resources to remove (${H.length}):`);for(let B of H){let Q=D[B].Type;X(`  - ${B} (${Q})`)}console.log()}if(w.length>0){_E(`Resources to modify (${w.length}):`);for(let B of w){let Q=C[B].Type;X(`  ~ ${B} (${Q})`)}console.log()}X("Summary:"),X(`  - Add: ${W.length}`),X(`  - Remove: ${H.length}`),X(`  - Modify: ${w.length}`),X("\nRun `cloud deploy` to apply these changes")}catch(T){d(`Diff failed: ${T.message}`)}})}kE();await sE();CU();o$();function RS(E,_=0){let T=Number(E);return Number.isFinite(T)?T:_}function pB(E){return RS(E)*1024}function Qn(E){let _=E?.date?.trim(),T=E?.time?.trim();if(!_||!T)return null;let R=new Date(`${_}T${T}Z`);return Number.isFinite(R.getTime())?R.toISOString():null}function Gn(E,_,T){let R;try{R=JSON.parse(E)}catch{return[]}let N=(R?.sysstat?.hosts??[]).flatMap((A)=>A.statistics??[]),L=[];for(let A of N){let S=Qn(A.timestamp);if(!S)continue;let O=new Date(S).getTime();if(O<_.getTime()||O>T.getTime())continue;let U=A["cpu-load"]?.find(($)=>$.cpu==="all")??A["cpu-load"]?.[0],h=RS(U?.idle,100);L.push({timestamp:S,cpuUsedPercent:Math.max(0,Math.min(100,100-h)),cpuUserPercent:RS(U?.user),cpuSystemPercent:RS(U?.system),cpuIowaitPercent:RS(U?.iowait),memoryUsedPercent:RS(A.memory?.["memused-percent"]),memoryUsedBytes:pB(A.memory?.memused),memoryAvailableBytes:pB(A.memory?.avail),swapUsedPercent:RS(A.memory?.["swpused-percent"]),swapUsedBytes:pB(A.memory?.swpused)})}return L.sort((A,S)=>A.timestamp.localeCompare(S.timestamp))}function Pn(E){return Object.fromEntries(Object.entries(E.time_series??{}).map(([_,T])=>[_,(T.values??[]).map(([R,N])=>({timestamp:new Date(Number(R)*1000).toISOString(),value:RS(N,Number.NaN)})).filter((R)=>Number.isFinite(R.value))]))}function KM(E){return E.length?E.reduce((_,T)=>_+T,0)/E.length:null}function oB(E){return E.length?Math.max(...E):null}function Mn(E){return E.length?Math.min(...E):null}async function VM(E){let[_,T]=await Promise.all([E.client.getServerMetrics(E.serverId,{types:["cpu","disk","network"],start:E.from,end:E.to,step:E.step}),UN(E.remote.host,"LC_ALL=C sadf -j -- -u -r -S",E.remote).catch(()=>"")]),R=Gn(T,E.from,E.to),N=Pn(_),A=(N.cpu??[]).map(($)=>Math.max(0,Math.min(100,$.value/Math.max(1,E.cores)))),S=R.map(($)=>$.cpuUsedPercent),O=A.length?A:S,U=R.map(($)=>$.memoryUsedPercent),h=R.map(($)=>$.swapUsedPercent);return{from:E.from.toISOString(),to:E.to.toISOString(),cores:E.cores,host:R,provider:N,summary:{cpuAveragePercent:KM(O),cpuPeakPercent:oB(O),memoryAveragePercent:KM(U),memoryPeakPercent:oB(U),memoryMinimumAvailableBytes:Mn(R.map(($)=>$.memoryAvailableBytes)),swapPeakPercent:oB(h)}}}DH();JH();WH();jH();Y2();await m_([hH(),hS()]);await g_();import{createHash as he}from"node:crypto";var mM=async(E)=>{let _=Bun.spawn(E,{stdout:"pipe",stderr:"pipe"}),[T,R,N]=await Promise.all([_.exited,new Response(_.stdout).text(),new Response(_.stderr).text()]);return{code:T,stdout:R,stderr:N}};class nM{async scan(E,_){let T=await mM(["ssh-keyscan","-T","10","-p",String(_),"-t","ed25519",E]),R=T.stdout.split(`
-`).find((N)=>N&&!N.startsWith("#"))?.trim().split(/\s+/);if(T.code!==0||!R?.[1]||!R[2])throw Error(`SSH host-key scan failed: ${T.stderr.trim()||"no key returned"}`);return{algorithm:R[1],key:R[2]}}async exec(E,_){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return mM(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,_])}}var $e=(E)=>`SHA256:${he("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,De=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class pL{provider;transport;discoverer;constructor(E,_=new nM,T){this.provider=E;this.transport=_;this.discoverer=T}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let _=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:_.algorithm,hostKeyFingerprint:$e(_.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let _=await this.transport.exec(E,De);if(_.code!==0)throw Error(`Fleet validation failed: ${_.stderr.trim()||_.code}`);try{return JSON.parse(_.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,_){let T=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${_.length}`);if(T.code!==0)throw Error(`Fleet bootstrap failed: ${T.stderr.trim()||T.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function eM(E,_){return{"fleet.bootstrap":async(T)=>{let R=T.operation.input&&typeof T.operation.input==="object"&&!Array.isArray(T.operation.input)?T.operation.input:{},N=E.get(String(R.serverId??""));if(!N)throw Error("Queued fleet server was not found.");let L=_.find((O)=>O.provider===N.provider);if(!L)throw Error(`No ${N.provider} fleet driver is configured.`);let A=Array.isArray(R.steps)?R.steps.map(String):[];if(T.checkpoint("preflight","Rechecking pinned trust and healthy validation."),N.trustState!=="pinned"||!N.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");T.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let S=await L.bootstrap(N,A);return E.update(N.id,{bootstrapVersion:S.version,status:"ready"}),T.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:N.id,bootstrapVersion:S.version,steps:A.length}}}}var DL=(E)=>E==null?void 0:String(E),z0=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},YH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:DL(E.provider_id),region:DL(E.region),zone:DL(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:DL(E.host_key_algorithm),hostKeyFingerprint:DL(E.host_key_fingerprint),pendingHostKey:DL(E.pending_host_key),roles:z0(E.roles,[]),labels:z0(E.labels,{}),taints:z0(E.taints,[]),capacity:z0(E.capacity,{}),usage:z0(E.usage,{}),capabilities:z0(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:z0(E.validation,void 0),bootstrapVersion:DL(E.bootstrap_version),heartbeatAt:DL(E.heartbeat_at),lastSeenAt:DL(E.last_seen_at),archivedAt:DL(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class CL{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}get(E){let _=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return _?YH(_):void 0}list(E,_=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(YH).filter((T)=>_||T.status!=="archived")}findProvider(E,_,T){let R=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,_,T);return R?YH(R):void 0}create(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,T,T]),this.get(_)}update(E,_){let T=this.get(E);if(!T)throw Error("Server was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[R.name,R.providerId??null,R.region??null,R.zone??null,R.endpoint,R.sshUser,R.sshPort,R.credentialRef,R.hostKeyAlgorithm??null,R.hostKeyFingerprint??null,R.pendingHostKey??null,JSON.stringify(R.roles),JSON.stringify(R.labels),JSON.stringify(R.taints),JSON.stringify(R.capacity),JSON.stringify(R.usage),JSON.stringify(R.capabilities),R.status,R.trustState,JSON.stringify(R.validation??{}),R.bootstrapVersion??null,R.heartbeatAt??null,R.lastSeenAt??null,R.archivedAt??null,N,E]),this.get(E)}}var Ce=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class AD{store;drivers;now;queue;constructor(E,_,T,R=()=>new Date){this.store=E;this.drivers=_;this.now=R;this.queue=T??new pE(E.control)}driver(E){let _=this.drivers.find((T)=>T.provider===E);if(!_)throw Error(`No ${E} fleet driver is configured.`);return _}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!Ce.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let _=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(_)return this.store.update(_.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let T=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),R=this.driver(E.provider);return this.store.create({...E,resourceId:T.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:R.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let T=await this.driver(_.provider).test(_);if(!T.reachable)return this.store.update(E,{status:"unreachable"});if(_.hostKeyFingerprint&&_.hostKeyFingerprint!==T.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:T.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:T.hostKeyAlgorithm,hostKeyFingerprint:T.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,_){let T=this.store.get(E);if(!T||T.pendingHostKey!==_)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:_,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let _=this.store.get(E);if(!_||_.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let T=await this.driver(_.provider).validate(_),R=[];if(!["x64","arm64","x86_64","aarch64"].includes(T.arch??""))R.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let A of["curl","tar"])if(!T.tools?.[A])R.push({code:`tool.${A}`,severity:"error",message:`${A} is missing.`,remediation:`Install ${A} before bootstrap.`});if(Math.abs(T.timeSkewSeconds??0)>60)R.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!T.dnsOk)R.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let N={valid:!R.some((A)=>A.severity==="error"),facts:T,findings:R,validatedAt:this.now().toISOString(),validatorVersion:"1"},L={cpu:T.cpuCores??0,memoryBytes:T.memoryBytes??0,diskBytes:T.diskBytes??0};return this.store.update(E,{validation:N,capacity:L,status:N.valid?"ready":"degraded"})}bootstrap(E,_=!1){let T=this.store.get(E);if(!T?.validation?.valid)throw Error("A healthy validation report is required.");let R=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!_)return{preview:!0,steps:R};let N=this.queue.enqueue({projectId:T.projectId,resourceId:T.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:R},lockKey:`server:${E}`,providerKey:T.provider}).operation;return{preview:!1,steps:R,operation:N}}heartbeat(E,_){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let R=this.now().toISOString();return this.store.update(E,{usage:_.usage,capabilities:_.capabilities??T.capabilities,heartbeatAt:R,lastSeenAt:R,status:T.status==="draining"||T.status==="drained"?T.status:"ready"})}drain(E,_=!1){return this.store.update(E,{status:_?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,_){let T=this.store.get(E);if(!T||_!==T.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function Xe(){let E=await o(),_=mE(process.cwd(),E),T=new CL(_.store),R=new AD(T,[new pL("aws"),new pL("hetzner"),new pL("ssh")]);return{controlPlane:_,store:T,service:R}}async function oL(E){let _=await Xe();try{return await E(_)}finally{_.controlPlane.store.close()}}var B0=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!T)throw Error(`Server ${_} was not found.`);return T},$N=(E)=>{d(E instanceof Error?E.message:String(E)),process.exitCode=1};function wH(E,_){let T=Number.parseInt(E??"",10);return Number.isFinite(T)&&T>=0?T:_}function Je(E="3h"){let _=E.match(/^(\d+)(m|h)$/);if(!_)throw Error("--range must use minutes or hours, for example 30m or 3h.");let T=Number(_[1])*(_[2]==="h"?3600000:60000);if(T<300000||T>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return T}function SD(E,_="%"){return E==null?"unavailable":`${E.toFixed(1)}${_}`}async function Ie(E,_){let T=await o();if(T.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",N=B_(T,R),L=await fN(N);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${L.serverName}.`);let A=hU(T),S=new eL({apiToken:$U(A.apiToken,T)}),O=await S.getServer(L.serverId),U=L.publicIp??O.public_net.ipv4?.ip;if(!U)throw Error(`Server ${O.name} has no public IPv4 address.`);let h=new Date,$=new Date(h.getTime()-Je(_.range)),D=Math.min(3600,Math.max(60,wH(_.step,60))),C=await VM({client:S,serverId:O.id,cores:Math.max(1,Number(O.server_type.cores)||1),from:$,to:h,step:D,remote:{host:U,user:L.sshUser??A.sshUser,identityFile:A.sshPrivateKeyPath,connectTimeoutSec:15}});if(_.json){console.log(JSON.stringify({schemaVersion:1,server:O.name,result:C},null,2));return}p(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[O.name,`${C.from} to ${C.to}`,`${SD(C.summary.cpuAveragePercent)} / ${SD(C.summary.cpuPeakPercent)}`,`${SD(C.summary.memoryAveragePercent)} / ${SD(C.summary.memoryPeakPercent)}`,C.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(C.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,SD(C.summary.swapPeakPercent)]])}function aM(E){let _=E.targetType.prices?.find((T)=>T.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:_?{hourlyNet:_.price_hourly.net,hourlyGross:_.price_hourly.gross,monthlyNet:_.price_monthly.net,monthlyGross:_.price_monthly.gross}:void 0}}function Fe(E){let _=aM(E);p(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${_.serverName} (${_.serverId})`,_.location,`${_.from} -> ${_.to}`,_.capacityAvailable?"available":"waiting",`${_.target.cores??0} / ${_.target.memoryGb??0} GB / ${_.target.diskGb??0} GB`,_.price?.monthlyGross??_.price?.monthlyNet??"not reported"]])}async function We(E,_,T){let R=await o();if(R.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let N=T.env??process.env.CLOUD_ENV??"production",L=B_(R,N),A=await fN(L),S=hU(R),O=new eL({apiToken:$U(S.apiToken,R)}),h=A&&(E===A.serverName||E===String(A.serverId)||E===A.stackName)?await O.getServer(A.serverId):(await O.listServers()).find((q)=>q.name===E||String(q.id)===E);if(!h)throw Error(`Hetzner server ${E} was not found.`);if(A?.serverId&&A.serverId!==h.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${A.serverId}.`);let $=aL(_),D=T.upgradeDisk!==!1,C=await LD(O,h.id,$,D);if(T.json)console.log(JSON.stringify({schemaVersion:1,plan:aM(C)},null,2));else Fe(C);if(!T.apply){if(!T.json)X(`Preview only. Re-run with --apply --confirm ${h.name} to execute.`);return}if(T.confirm!==h.name)throw Error(`Resize requires --confirm ${h.name}.`);let J=A?.publicIp??h.public_net.ipv4?.ip;if(!J)throw Error(`Server ${h.name} has no public IPv4 address for verification.`);let I={host:J,user:A?.sshUser??S.sshUser,identityFile:S.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},W=await BH(L),H=new Date().toISOString(),w={schemaVersion:1,operationId:W?.targetType===$&&W.serverId===h.id?W.operationId:crypto.randomUUID(),stackName:L,serverId:h.id,serverName:h.name,sourceType:C.currentType.name,targetType:$,upgradeDisk:D,phase:"planning",status:"running",attempts:W?.targetType===$?W.attempts:0,startedAt:W?.targetType===$?W.startedAt:H,updatedAt:H,manifest:W?.targetType===$?W.manifest:void 0};await sL(w);let B=wH(T.pollSeconds,900)*1000,Q=wH(T.maxWaitMinutes,0)*60000,K=Date.now();for(;;){let q=await LD(O,h.id,$,D);if(!q.capacityAvailable&&!q.alreadyComplete){if(w={...w,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await sL(w),!T.wait){if(!T.json)X(`${$} has no capacity in ${q.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(Q>0&&Date.now()-K>=Q)throw Error(`Timed out waiting for ${$} capacity in ${q.location}.`);if(!T.json)X(`Waiting ${Math.round(B/1000)} seconds for ${$} capacity...`);await Bun.sleep(B);continue}let x=await HH(L);try{let g=await(async()=>{try{return w={...w,status:"running",attempts:w.attempts+1,updatedAt:new Date().toISOString()},await sL(w),await XH({client:O,serverId:h.id,targetType:$,upgradeDisk:D,resumeFromOff:w.phase==="shutting-down"||w.phase==="resizing"||w.phase==="powering-on"||w.phase==="verifying",manifest:w.manifest,hooks:{preflight:async()=>{let k=await IH(I);return w={...w,manifest:k,updatedAt:new Date().toISOString()},await sL(w),k},afterBoot:async(k,v,t,EE)=>FH(I,v,t,EE),onPhase:async(k,v)=>{if(w={...w,phase:k,status:k==="waiting-capacity"?"waiting-capacity":k==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await sL(w),!T.json)X(`${k}${v?` ${JSON.stringify(v)}`:""}`)}}})}finally{await x()}})();if(w={...w,status:g.status==="completed"||g.status==="already-complete"?"completed":g.status==="recovered"?"recovered":"waiting-capacity",lastError:g.status==="recovered"?g.error:void 0,updatedAt:new Date().toISOString()},await sL(w),T.json)console.log(JSON.stringify({schemaVersion:1,result:g},null,2));else if(g.status==="completed"||g.status==="already-complete")b(`${h.name} is on ${$} and passed full post-boot verification.`);else if(g.status==="recovered"&&g.retryable&&T.wait){X(`Capacity race recovered safely. Waiting ${Math.round(B/1000)} seconds before retry.`),await Bun.sleep(B);continue}else if(g.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${g.error}`);return}catch(g){throw w={...w,status:"failed",lastError:g instanceof Error?g.message:String(g),updatedAt:new Date().toISOString()},await sL(w),g}}}async function ze(E,_){let T=await o();if(T.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",N=B_(T,R),L=await fN(N);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${L.serverName}.`);let A=hU(T),S=new eL({apiToken:$U(A.apiToken,T)}),O=await S.getServer(L.serverId),U=L.publicIp??O.public_net.ipv4?.ip;if(!U)throw Error(`Server ${O.name} has no public IPv4 address.`);let h=H2(T);if(_.json)console.log(JSON.stringify({schemaVersion:1,server:O.name,plan:h},null,2));else p(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[O.name,h.firewallPorts.join(","),h.monitoring?"on":"off",h.autoUpdates?"on":"off",`${h.swapGb} GB`,"disabled"]]);if(!_.apply){if(!_.json)X(`Preview only. Re-run with --apply --confirm ${O.name} to execute.`);return}if(_.confirm!==O.name)throw Error(`Optimization requires --confirm ${O.name}.`);let $={host:U,user:L.sshUser??A.sshUser,identityFile:A.sshPrivateKeyPath,connectTimeoutSec:15},D=await zU($),C=D.routeProbes.filter((t)=>!t.ok),J=T.infrastructure?.compute,I=jR(J)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,W=D.failedUnits.filter((t)=>!I.has(t));if(W.length>0)throw Error(`Preflight found failed services: ${W.join(", ")}`);if(C.length>0)throw Error(`Preflight found unhealthy routes: ${C.map((t)=>t.domain).join(", ")}`);let H=jR(J)?[]:Object.values(T.sites??{}).flatMap((t)=>typeof t?.port==="number"&&![80,443].includes(t.port)?[t.port]:[]),w=XU({allowSsh:J?.allowSsh!==!1,sitePorts:H,allowedPorts:J?.firewall?.allowedPorts}),B=(L.firewallId?(await S.listFirewalls()).find((t)=>t.id===L.firewallId):void 0)??(await S.listFirewalls()).find((t)=>t.name===`${T.project.slug}-${R}-app-fw`);if(!B)throw Error(`Managed firewall for ${O.name} was not found.`);let Q=await S.setFirewallRules(B.id,w);await Promise.all(Q.map((t)=>S.waitForAction(t.id))),await SH(T,$);let[K,q]=await Promise.all([zU($),OH($)]),x=UH(h,q),g=kM(D,K),k=K.routeProbes.filter((t)=>!t.ok);if(g.stoppedServices.length>0)x.push(`services stopped: ${g.stoppedServices.join(", ")}`);if(g.changedRouteFragments.length>0)x.push(`route fragments changed: ${g.changedRouteFragments.join(", ")}`);if(g.missingRouteIds.length>0)x.push(`routes disappeared: ${g.missingRouteIds.join(", ")}`);if(g.changedReleaseLinks.length>0)x.push(`release links changed: ${g.changedReleaseLinks.join(", ")}`);if(g.missingData.length>0)x.push(`databases or volumes disappeared: ${g.missingData.join(", ")}`);if(k.length>0)x.push(`unhealthy routes: ${k.map((t)=>t.domain).join(", ")}`);if(x.length>0)throw Error(`Host optimization verification failed: ${x.join("; ")}`);let v={serverId:O.id,serverName:O.name,services:K.runningServices.length,routes:K.routeIds.length,healthyDomains:K.routeProbes.length,releaseLinks:K.releaseLinks.length,databasesAndVolumes:K.dataCatalog.length,report:q};if(_.json)console.log(JSON.stringify({schemaVersion:1,result:v},null,2));else b(`${O.name} passed full host, rpx route, service, release, and data verification.`)}function QH(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(_,T)=>{try{await oL(async(R)=>{let N=_?[B0(R,_)]:R.store.list(R.controlPlane.project.id),L=N.flatMap((A)=>Object.entries(A.capabilities).map(([S,O])=>({server:A.name,provider:A.provider,action:S,...O})));if(T.json)console.log(JSON.stringify({schemaVersion:1,targets:L},null,2));else p(["Server","Provider","Action","Support","Explanation"],L.map((A)=>[A.server,A.provider,A.action,A.supported?"supported":"unsupported",A.reason??"—"]))})}catch(R){$N(R)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(_,T,R)=>{try{await We(_,T,R)}catch(N){$N(N)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(_,T)=>{try{await ze(_,T)}catch(R){$N(R)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(_,T)=>{try{await Ie(_,T)}catch(R){$N(R)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(_)=>{try{await oL(async(T)=>{let R=T.store.list(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],R.map((N)=>[N.name,N.providerId??"—",`${N.provider} / ${N.region??"external"}`,`${N.status} / ${N.trustState}`,N.roles.join(","),`${N.capacity.cpu??0} / ${N.capacity.memoryBytes??0}`,N.heartbeatAt??"never"]))})}catch(T){$N(T)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(_,T)=>{try{await oL(async(R)=>{let N=T.provider;if(!["aws","hetzner","ssh"].includes(N)||!T.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let L=R.service.enroll({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,provider:N,providerId:T.providerId,endpoint:T.endpoint,sshUser:T.user??"deploy",credentialRef:T.credentialRef??"secret://fleet/agent",region:T.region,roles:String(T.roles??"application").split(","),labels:Object.fromEntries(String(T.labels??"").split(",").map((A)=>A.split("=")).filter((A)=>A[0]&&A[1]))});b(`Enrolled ${L.name} as ${L.id}; no remote mutation was performed.`)})}catch(R){$N(R)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(_,T)=>{try{await oL(async(R)=>{let N=B0(R,_);if(N=await R.service.test(N.id),N.trustState==="rotation_pending"){if(!T.acceptHostKey)throw Error(`Host key changed to ${N.pendingHostKey}; review it first.`);N=R.service.reviewHostKey(N.id,T.acceptHostKey)}let L=await R.service.validate(N.id);if(T.json)console.log(JSON.stringify(L.validation,null,2));else p(["Severity","Code","Finding","Remediation"],(L.validation?.findings??[]).map((A)=>[A.severity,A.code,A.message,A.remediation??"—"]));if(!L.validation?.valid)process.exitCode=1})}catch(R){$N(R)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(_,T)=>{try{await oL(async(R)=>{let N=R.service.bootstrap(B0(R,_).id,!!T.apply);if(N.preview)p(["Step"],N.steps.map((L)=>[L]));else b(`Bootstrap queued: ${N.operation?.id}`)})}catch(R){$N(R)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(_,T)=>{try{await oL(async(R)=>b(R.service.drain(B0(R,_).id,!!T.complete).status))}catch(R){$N(R)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(_)=>{try{await oL(async(T)=>{T.service.uncordon(B0(T,_).id),b(`Uncordoned ${_}.`)})}catch(T){$N(T)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(_,T)=>{try{await oL(async(R)=>{R.service.archive(B0(R,_).id,T.confirm??""),b(`Archived ${_}; provider infrastructure was not terminated.`)})}catch(R){$N(R)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(_)=>{try{await oL(async(T)=>{let R=B0(T,_);if(R.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let N=Bun.spawn(["ssh","-p",String(R.sshPort),"-o","StrictHostKeyChecking=yes",`${R.sshUser}@${R.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),L=await N.exited;if(L)process.exitCode=L})}catch(T){$N(T)}});for(let[_,T]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(_,T).action(async(...R)=>ON(_.split(" ")[0],{target:String(R[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}kE();var kN=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},YR=(E)=>E==null?void 0:String(E),pM=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),HU=(E={})=>({...pM(),...E});function iM(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:YR(E.region),architecture:YR(E.architecture),labels:kN(E.labels,{}),requiredServerLabels:kN(E.required_server_labels,{}),toleratedTaints:kN(E.tolerated_taints,[]),capacity:HU(kN(E.capacity,{})),reserved:kN(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:YR(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function sM(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:YR(E.environment_id),resourceId:String(E.resource_id),releaseId:YR(E.release_id),poolId:String(E.pool_id),serverId:YR(E.server_id),purpose:String(E.purpose),requirements:kN(E.requirements,{}),decision:kN(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Be(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:YR(E.resource_id),poolId:String(E.pool_id),placementId:YR(E.placement_id),operationId:YR(E.operation_id),sourceSha:String(E.source_sha),buildSpec:kN(E.build_spec,{}),credentialPolicy:kN(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:YR(E.workspace),cacheKey:YR(E.cache_key),artifactUri:YR(E.artifact_uri),artifactDigest:YR(E.artifact_digest),status:String(E.status),cleanupAt:YR(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class OD{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}createPool(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(HU(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,T,T]),this.getPool(_)}getPool(E){let _=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return _?iM(_):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(iM)}updatePool(E,_){let T=this.getPool(E);if(!T)throw Error("Capacity pool was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[R.status,JSON.stringify(R.reserved),JSON.stringify(R.capacity),R.concurrency,N,E]),this.getPool(E)}addMember(E,_,T={}){let R=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,_,JSON.stringify(T),R,R])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((_)=>({serverId:String(_.server_id),status:String(_.status),capacityOverride:kN(_.capacity_override,{})}))}memberStatus(E,_,T){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[T,this.now().toISOString(),E,_])}listPlacements(E,_){let T=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(sM);return _?.length?T.filter((R)=>_.includes(R.status)):T}getPlacement(E){let _=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return _?sM(_):void 0}activeUsage(E,_){let T=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),R=_?T.filter((N)=>String(N.server_id)===_):T;return{resources:R.reduce((N,L)=>{let A=HU(kN(L.resources,{}));for(let S of Object.keys(N))N[S]+=A[S];return N},pM()),count:R.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let _=this.id(),T=this.id(),R=this.now().toISOString(),N=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[_,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,R,R]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[T,_,E.decision.poolId,E.decision.serverId??null,JSON.stringify(HU(E.requirements.resources)),N,R,R]),this.getPlacement(_)})}transitionPlacement(E,_){if(!this.getPlacement(E))throw Error("Placement was not found.");let R=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[_,R,E]),["released","failed","blocked"].includes(_))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[R,E]);return this.getPlacement(E)}createBuild(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[_,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),T,T]),this.getBuild(_)}getBuild(E){let _=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return _?Be(_):void 0}updateBuild(E,_){let T=this.getBuild(E);if(!T)throw Error("Remote build was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[R.operationId??null,R.workspace??null,R.cacheKey??null,R.artifactUri??null,R.artifactDigest??null,R.status,R.cleanupAt??null,N,E]),this.getBuild(E)}}var Q2=["cpu","memoryBytes","diskBytes","gpu"],oM=(E,_={})=>Object.entries(_).every(([T,R])=>E[T]===R),He=(E,_,T)=>Object.fromEntries(Q2.map((R)=>[R,Math.max(0,E[R]-_[R]-(T[R]??0))])),je=(E,_)=>Q2.every((T)=>E[T]>=(_[T]??0)),Ye=(E,_)=>Q2.reduce((T,R)=>T+(_[R]??0)/(E[R]||1),0);class UD{store;fleet;constructor(E,_){this.store=E;this.fleet=_}poolCandidates(E,_,T){let R=[];for(let N of this.store.listPools(E)){if(N.id===T)continue;let L=[];if(N.status!=="active")L.push(`pool is ${N.status}`);if(N.purpose!==_.purpose)L.push(`purpose is ${N.purpose}`);if(_.region&&N.region!==_.region)L.push(`region is ${N.region??"unset"}`);if(_.architecture&&N.architecture!==_.architecture)L.push(`architecture is ${N.architecture??"unset"}`);if(!oM(N.labels,_.labels))L.push("pool labels do not match");if(N.backend==="server"){let A=this.store.members(N.id);if(!A.length)R.push(this.decision(N,void 0,_,[...L,"pool has no servers"]));for(let S of A){let O=this.fleet.get(S.serverId),U=[...L];if(!O)U.push("server is missing");else this.serverReasons(N,O,S.status,_,U);R.push(this.decision(N,O,_,U,S.capacityOverride))}}else R.push(this.decision(N,void 0,_,L))}return R.sort((N,L)=>Number(L.eligible)-Number(N.eligible)||N.score.cost-L.score.cost||N.score.spread-L.score.spread||N.score.fit-L.score.fit||N.poolName.localeCompare(L.poolName)||(N.serverId??"").localeCompare(L.serverId??""))}serverReasons(E,_,T,R,N){if(T!=="active")N.push(`member is ${T}`);if(_.status!=="ready")N.push(`server is ${_.status}`);if(!_.roles.includes(R.purpose==="build"?"build":R.purpose))N.push(`server lacks ${R.purpose} role`);if(!oM(_.labels,E.requiredServerLabels))N.push("server labels do not match pool selector");for(let L of _.taints)if(!E.toleratedTaints.includes(L))N.push(`taint ${L} is not tolerated`)}decision(E,_,T,R,N={}){let L=HU({..._?.capacity,...N}),A=_?Object.fromEntries(Q2.map((U)=>[U,Math.min(E.capacity[U],L[U])])):E.capacity,S=this.store.activeUsage(E.id,_?.id),O=He(A,S.resources,E.reserved);if(S.count>=E.maxWorkloads)R.push("workload limit reached");if(T.purpose==="build"&&S.count>=E.concurrency)R.push("build concurrency reached");if(!je(O,T.resources))R.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:_?.id,eligible:R.length===0,reasons:R,available:O,score:{fit:Ye(O,T.resources),spread:S.count,cost:E.costWeight}}}explain(E,_){return this.poolCandidates(E,_)}place(E){return this.store.control.transaction(()=>{let _=this.poolCandidates(E.projectId,E.requirements).find((T)=>T.eligible);if(!_)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((T)=>T.reasons).join("; ")}`);return this.store.reserve({...E,decision:_})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let _=this.store.updatePool(E,{status:"draining"}),T=[],R=[];for(let N of this.store.listPlacements(_.projectId,["reserved","active"]).filter((L)=>L.poolId===E)){if(N.stateful){R.push(this.store.transitionPlacement(N.id,"blocked"));continue}this.store.transitionPlacement(N.id,"moving");let L=this.place({projectId:N.projectId,environmentId:N.environmentId,resourceId:N.resourceId,releaseId:N.releaseId,requirements:N.requirements});T.push(this.activate(L.id)),this.store.transitionPlacement(N.id,"released")}return{pool:_,moved:T,blocked:R}}drainServer(E,_){this.store.memberStatus(E,_,"draining");let T=this.store.getPool(E);if(!T)throw Error("Capacity pool was not found.");let R=[],N=[];for(let L of this.store.listPlacements(T.projectId,["reserved","active"]).filter((A)=>A.poolId===E&&A.serverId===_)){if(L.stateful){N.push(this.store.transitionPlacement(L.id,"blocked"));continue}this.store.transitionPlacement(L.id,"moving");let A=this.poolCandidates(L.projectId,L.requirements).find((O)=>O.eligible);if(!A){N.push(this.store.transitionPlacement(L.id,"blocked"));continue}let S=this.store.reserve({projectId:L.projectId,environmentId:L.environmentId,resourceId:L.resourceId,releaseId:L.releaseId,requirements:L.requirements,decision:A});R.push(this.activate(S.id)),this.store.transitionPlacement(L.id,"released")}return{moved:R,blocked:N}}reconcileFailure(E){let _=this.fleet.get(E);if(!_)throw Error("Server was not found.");let T=[],R=[];for(let N of this.store.listPlacements(_.projectId,["active"]).filter((L)=>L.serverId===E)){if(N.stateful||!N.autoReschedule){R.push(this.store.transitionPlacement(N.id,"blocked"));continue}this.store.transitionPlacement(N.id,"failed");let L=this.place({projectId:N.projectId,environmentId:N.environmentId,resourceId:N.resourceId,releaseId:N.releaseId,requirements:N.requirements});T.push(this.activate(L.id))}return{rescheduled:T,blocked:R}}}await g_();async function we(){let E=await o(),_=mE(process.cwd(),E),T=new OD(_.store),R=new UD(T,new CL(_.store));return{controlPlane:_,store:T,service:R}}async function hD(E){let _=await we();try{await E(_)}catch(T){d(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var G2=(E)=>Object.fromEntries(String(E??"").split(",").map((_)=>_.split("=")).filter((_)=>_[0]&&_[1])),EK=(E)=>Object.fromEntries(Object.entries(G2(E)).map(([_,T])=>[_,Number(T)]));function GH(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(_)=>hD((T)=>{let R=T.store.listPools(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],R.map((N)=>[N.name,N.purpose,N.backend,`${N.region??"any"} / ${N.architecture??"any"}`,N.status,JSON.stringify(N.capacity),String(N.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(_,T)=>hD((R)=>{let{purpose:N,backend:L}=T;if(!["application","build","worker","monitoring","backup"].includes(N)||!["server","ecs","asg"].includes(L))throw Error("Unsupported pool purpose or backend.");let A=R.store.createPool({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,purpose:N,backend:L,region:T.region,architecture:T.arch,labels:G2(T.labels),requiredServerLabels:G2(T.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...EK(T.capacity)},maxWorkloads:Number(T.max),costWeight:1,concurrency:Number(T.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});b(`Created ${A.name} (${A.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(_,T)=>hD((R)=>{let N=R.store.listPools(R.controlPlane.project.id).find((A)=>A.id===_||A.name===_),L=new CL(R.controlPlane.store).list(R.controlPlane.project.id).find((A)=>A.id===T||A.name===T);if(!N||!L)throw Error("Pool or server was not found.");R.store.addMember(N.id,L.id),b(`Attached ${L.name} to ${N.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(_)=>hD((T)=>{let R=T.service.explain(T.controlPlane.project.id,{purpose:_.purpose,resources:EK(_.resources),region:_.region,architecture:_.arch,labels:G2(_.labels)});if(_.json)console.log(JSON.stringify(R,null,2));else p(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],R.map((N)=>[N.poolName,N.serverId??"provider-managed",N.eligible?"yes":"no",JSON.stringify(N.available),`${N.score.fit.toFixed(2)} / ${N.score.spread} / ${N.score.cost}`,N.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(_)=>hD((T)=>{let R=T.store.listPools(T.controlPlane.project.id).find((L)=>L.id===_||L.name===_);if(!R)throw Error("Pool was not found.");let N=T.service.drainPool(R.id);b(`Draining ${R.name}: moved ${N.moved.length}, blocked ${N.blocked.length} stateful placement(s).`)}))}kE();var EA=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},DN=(E)=>E==null?void 0:String(E),_K=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:DN(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:EA(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:EA(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:DN(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),PH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:DN(E.stack_id),stackRevision:DN(E.stack_revision),status:String(E.status),health:EA(E.health,{}),lastHealthyAt:DN(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),MH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:EA(E.config,{}),status:String(E.status),checkpoint:DN(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:DN(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),KH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:EA(E.weights,{}),desiredWeights:EA(E.desired_weights,{}),status:String(E.status),providerState:EA(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),TK=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:DN(E.operation_id),kind:String(E.kind),requestedRegion:DN(E.requested_region),revision:DN(E.revision),plan:EA(E.plan,[]),currentStep:DN(E.current_step),completedSteps:EA(E.completed_steps,[]),status:String(E.status),error:DN(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class $D{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((L)=>L.region)).size!==E.regions.length||E.regions.filter((L)=>L.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let _=E.regions.find((L)=>L.role==="primary"),T=this.id(),R=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[T,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,_.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),_.region,R,R]);for(let L of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),T,L.region,L.role,L.provider,R,R]);for(let L of E.dataPolicy.replicate)for(let A of E.regions)for(let S of E.regions.filter((O)=>O.region!==A.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,L,A.region,S.region,"{}",R,R]);let N=Object.fromEntries(E.regions.map((L)=>[L.region,L.region===_.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),T,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(N),JSON.stringify(N),R,R]),this.get(T)})}get(E){let _=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return _?_K(_):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(_K)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(PH)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(MH)}route(E){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return _?KH(_):void 0}updateTopology(E,_){let T=this.get(E);if(!T)throw Error("Regional topology was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[R.status,R.activeRegion,R.revision??null,JSON.stringify(R.regions),N,E]),this.get(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!T)throw Error("Regional target was not found.");let R=PH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[N.role,N.stackId??null,N.stackRevision??null,N.status,JSON.stringify(N.health),N.lastHealthyAt??null,L,E]),PH(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,_){let T=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!T)throw Error("Replication channel was not found.");let R=MH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[N.status,N.checkpoint??null,N.lagSeconds??null,N.lastVerifiedAt??null,L,E]),MH(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,_){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!T)throw Error("Traffic route was not found.");let R=KH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(N.weights),JSON.stringify(N.desiredWeights),N.status,JSON.stringify(N.providerState),L,E]),KH(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[_,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),T,T]),this.execution(_)}execution(E){let _=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return _?TK(_):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(TK)}updateExecution(E,_){let T=this.execution(E);if(!T)throw Error("Regional execution was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[R.operationId??null,R.currentStep??null,JSON.stringify(R.completedSteps),R.status,R.error??null,N,E]),this.execution(E)}}await g_();class DD{store;queue;constructor(E,_){this.store=E;this.queue=_??new pE(E.control)}create(E){return this.store.create(E)}plan(E,_,T){if(!this.store.get(E))throw Error("Regional topology was not found.");let N=this.store.targets(E),L=this.store.channels(E);if(_==="rollout")return[...N.filter((A)=>A.role==="secondary").map((A)=>`apply:${A.region}`),...N.filter((A)=>A.role==="primary").map((A)=>`apply:${A.region}`),...L.map((A)=>`replicate:${A.kind}:${A.targetRegion}`),"traffic:activate"];if(_==="failover"||_==="failback")return[`health:${T}`,`replication:${T}`,`traffic:${T}`,`roles:${T}`];if(_==="destroy")return["traffic:drain",...N.filter((A)=>A.role==="secondary").map((A)=>`delete:${A.region}`),...N.filter((A)=>A.role==="primary").map((A)=>`delete:${A.region}`),"complete"];return["observe","repair"]}enqueue(E){let _=this.store.get(E.topologyId);if(!_)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!_.regions.some((L)=>L.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===_.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==_.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&_.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let T=this.plan(_.id,E.kind,E.targetRegion),R=this.store.createExecution({topologyId:_.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:T}),N=this.queue.enqueue({projectId:_.projectId,environmentId:_.environmentId,kind:`region.${E.kind}`,input:{executionId:R.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${_.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(R.id,{operationId:N.id}),{execution:this.store.execution(R.id),operation:N}}}var Qe=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function RK(E,_){let T=(U)=>{let h=_.find(($)=>$.provider===U.provider);if(!h)throw Error(`No ${U.provider} regional driver is configured.`);return h},R=(U,h,$)=>{U.throwIfCancellationRequested(),U.checkpoint($,$),E.updateExecution(h.id,{status:"running",currentStep:$,completedSteps:[...E.execution(h.id).completedSteps,$]})},N=async(U,h)=>{let $=E.route(U.id);if(!$)throw Error("Regional traffic route was not found.");let D=E.targets(U.id).find((J)=>J.region===U.activeRegion)??E.targets(U.id)[0];if(!D)throw Error("Regional traffic target was not found.");E.updateRoute($.id,{status:"applying",desiredWeights:h});let C=await T(D).applyTraffic({route:E.route(U.id),topology:U,weights:h});E.updateRoute($.id,{status:Object.values(h).every((J)=>J===0)?"drained":"in_sync",weights:h,providerState:C.providerState})},L=async(U,h,$,D)=>{E.updateTopology($.id,{status:"provisioning"});let C=h.revision,J=D.manifest??{},I=E.targets($.id).sort((H,w)=>Number(H.role==="primary")-Number(w.role==="primary"));for(let H of I){R(U,h,`apply:${H.region}`),E.updateTarget(H.id,{status:"provisioning"});let w=await T(H).applyStack({target:H,revision:C,manifest:J,signal:U.signal}),B=await T(H).health({target:E.updateTarget(H.id,{stackId:w.stackId,stackRevision:C})});if(!B.healthy)throw Error(`Regional health gate failed in ${H.region}.`);E.updateTarget(H.id,{status:"ready",health:B.evidence,lastHealthyAt:new Date().toISOString()})}for(let H of E.channels($.id)){R(U,h,`replicate:${H.kind}:${H.targetRegion}`),E.updateChannel(H.id,{status:"configuring"});let w=I.find((K)=>K.region===H.sourceRegion),B=await T(w).configureReplication({channel:H,topology:$}),Q=await T(w).verifyReplication({channel:E.updateChannel(H.id,{checkpoint:B.checkpoint,lagSeconds:B.lagSeconds}),topology:$});if(!Q.healthy||Q.lagSeconds>$.dataPolicy.maxLagSeconds)throw Error(`${H.kind} replication to ${H.targetRegion} exceeds the RPO.`);E.updateChannel(H.id,{status:"in_sync",checkpoint:Q.checkpoint,lagSeconds:Q.lagSeconds,lastVerifiedAt:new Date().toISOString()})}R(U,h,"traffic:activate");let W=Object.fromEntries($.regions.map((H)=>[H.region,H.region===$.activeRegion?100:0]));return await N($,W),E.updateTopology($.id,{status:"ready",revision:C}),{revision:C,activeRegion:$.activeRegion}},A=async(U,h,$)=>{let D=h.requestedRegion,C=E.targets($.id).find((W)=>W.region===D);if(!C)throw Error("Requested regional target was not found.");E.updateTopology($.id,{status:h.kind==="failover"?"failing_over":"failing_back"}),R(U,h,`health:${D}`);let J=await T(C).health({target:C});if(!J.healthy)throw Error(`Target region ${D} is unhealthy.`);E.updateTarget(C.id,{status:"ready",health:J.evidence,lastHealthyAt:new Date().toISOString()}),R(U,h,`replication:${D}`);for(let W of E.channels($.id).filter((H)=>H.targetRegion===D)){let H=await T(C).verifyReplication({channel:W,topology:$});if(!H.healthy||H.lagSeconds>$.dataPolicy.maxLagSeconds)throw Error(`${W.kind} replication is outside the failover RPO.`);E.updateChannel(W.id,{status:"in_sync",checkpoint:H.checkpoint,lagSeconds:H.lagSeconds,lastVerifiedAt:new Date().toISOString()})}R(U,h,`traffic:${D}`),await N($,Object.fromEntries($.regions.map((W)=>[W.region,W.region===D?100:0]))),R(U,h,`roles:${D}`);let I=$.regions.map((W)=>({...W,role:W.region===D?"primary":"secondary"}));for(let W of E.targets($.id))E.updateTarget(W.id,{role:W.region===D?"primary":"secondary"});return E.updateTopology($.id,{status:h.kind==="failover"?"failed_over":"ready",activeRegion:D,regions:I}),{activeRegion:D}},S=async(U,h,$,D)=>{E.updateTopology($.id,{status:"destroying"}),R(U,h,"traffic:drain"),await N($,Object.fromEntries($.regions.map((J)=>[J.region,0])));let C=D.deleteData!==!0;for(let J of E.targets($.id).sort((I,W)=>Number(I.role==="primary")-Number(W.role==="primary")))R(U,h,`delete:${J.region}`),E.updateTarget(J.id,{status:"deleting"}),await T(J).deleteStack({target:J,retainData:C,signal:U.signal}),E.updateTarget(J.id,{status:"deleted"});return R(U,h,"complete"),E.updateTopology($.id,{status:"destroyed"}),{destroyed:!0,dataRetained:C}},O=async(U)=>{let h=Qe(U.operation.input),$=E.execution(String(h.executionId??""));if(!$)throw Error("Regional execution was not found.");let D=E.get($.topologyId);if(!D)throw Error("Regional topology was not found.");try{let C;if($.kind==="rollout")C=await L(U,$,D,h);else if($.kind==="failover"||$.kind==="failback")C=await A(U,$,D);else if($.kind==="destroy")C=await S(U,$,D,h);else throw Error("Regional reconciliation is not configured.");return E.updateExecution($.id,{status:"succeeded",currentStep:void 0}),{executionId:$.id,...C}}catch(C){if(E.updateExecution($.id,{status:U.cancellationRequested()?"cancelled":"failed",error:C instanceof Error?C.message:String(C)}),E.get(D.id)?.status!=="destroyed")E.updateTopology(D.id,{status:"failed"});throw C}};return{"region.rollout":O,"region.failover":O,"region.failback":O,"region.destroy":O,"region.reconcile":O}}class VH{provider;reason;constructor(E,_="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=_}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function Ge(){let E=await o(),_=mE(process.cwd(),E),T=new $D(_.store),R=new DD(T);return{controlPlane:_,store:T,service:R}}async function H0(E){let _=await Ge();try{await E(_)}catch(T){d(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var CD=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!T)throw Error("Regional topology was not found.");return T},Pe=(E)=>E.split(",").map((_,T)=>{let[R,N="aws"]=_.split(":");return{region:String(R),provider:N,role:T===0?"primary":"secondary"}}),Me=(E)=>{let _=new Set(["s3","dynamodb","secrets"]),T=E.split(",").map((N)=>N.trim()),R=T.find((N)=>!_.has(N));if(R)throw Error(`Unsupported replication kind: ${R}`);return T};function ZH(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(_)=>H0((T)=>{let R=T.store.list(T.controlPlane.project.id).map((N)=>({topology:N,targets:T.store.targets(N.id),channels:T.store.channels(N.id),route:T.store.route(N.id),executions:T.store.executions(N.id)}));if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Hostname","Active","Status","Revision","Replication"],R.map((N)=>[N.topology.name,N.topology.hostname,N.topology.activeRegion,N.topology.status,N.topology.revision??"—",`${N.channels.filter((L)=>L.status==="in_sync").length}/${N.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(_,T)=>H0((R)=>{if(!T.hostname||!T.regions)throw Error("--hostname and --regions are required.");let N=R.service.create({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,hostname:T.hostname,regions:Pe(T.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Me(String(T.replicate)),maxLagSeconds:Number(T.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!T.cdn,wafEnabled:!!T.waf});b(`Created ${N.name} (${N.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(_,T,R)=>H0((N)=>p(["Step"],N.service.plan(CD(N,_).id,T,R.target).map((L)=>[L])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(_,T,R)=>H0(async(N)=>{let L=R.manifest?await Bun.file(R.manifest).json():{},A=N.service.enqueue({topologyId:CD(N,_).id,kind:"rollout",revision:T,manifest:L});b(`Regional rollout queued: ${A.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(_,T)=>H0((R)=>{let N=R.service.enqueue({topologyId:CD(R,_).id,kind:"failover",targetRegion:T});b(`Failover queued: ${N.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(_,T)=>H0((R)=>{let N=R.service.enqueue({topologyId:CD(R,_).id,kind:"failback",targetRegion:T});b(`Failback queued: ${N.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(_,T)=>H0((R)=>{let N=R.service.enqueue({topologyId:CD(R,_).id,kind:"destroy",confirmation:T.confirm});b(`Regional teardown queued: ${N.operation.id}; replicated data remains retained.`)}))}kE();var XD="0.7.110";import{createHash as dH,createPublicKey as AK,verify as Ve}from"node:crypto";function JD(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(JD).join(",")}]`;return`{${Object.keys(E).sort().map((_)=>`${JSON.stringify(_)}:${JD(E[_])}`).join(",")}}`}var SK=(E)=>dH("sha256").update(JD(E)).digest("hex"),P2=(E)=>dH("sha256").update(JD(E)).digest("hex"),OK=(E)=>dH("sha256").update(AK(E).export({type:"spki",format:"der"})).digest("hex");function UK(E,_,T){try{return Ve(null,Buffer.from(JD(E)),AK(T),Buffer.from(_,"base64"))}catch{return!1}}var NK=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((_)=>Number(_)||0),LK=(E,_)=>{let T=NK(E),R=NK(_);for(let N=0;N<3;N++){let L=(T[N]??0)-(R[N]??0);if(L)return L}return 0};function hK(E,_){let T=[];if(_.schemaVersion<E.minimumSchema)T.push(`schema ${_.schemaVersion} is below ${E.minimumSchema}`);if(_.schemaVersion>E.maximumSchema)T.push(`schema ${_.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&LK(_.currentVersion,E.minimumVersion)<0)T.push(`platform ${_.currentVersion} is below ${E.minimumVersion}`);if(LK(E.version,_.currentVersion)<=0)T.push(`version ${E.version} is not newer than ${_.currentVersion}`);if(!E.artifacts.some((R)=>R.platform===_.platform&&R.architecture===_.architecture))T.push(`no artifact for ${_.platform}/${_.architecture}`);return{compatible:T.length===0,reasons:T}}var _A=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},KT=(E)=>E==null?void 0:String(E),Ze=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:KT(E.revoked_at),createdAt:String(E.created_at)}),$K=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:_A(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:_A(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),DK=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:_A(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),CK=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:KT(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:_A(E.health_gate,{}),status:String(E.status),currentStage:KT(E.current_stage),backupId:KT(E.backup_id),approvedBy:KT(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),qH=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:KT(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:_A(E.evidence,{}),error:KT(E.error),startedAt:KT(E.started_at),finishedAt:KT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),XK=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:_A(E.criteria,{}),candidates:_A(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:KT(E.confirmation),expiresAt:String(E.expires_at),result:_A(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),JK=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:KT(E.backup_policy_id),recoveryPointId:KT(E.recovery_point_id),topologyId:KT(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:KT(E.operation_id),evidence:_A(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:KT(E.error),startedAt:KT(E.started_at),finishedAt:KT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class ID{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}addTrustedKey(E){let _=this.id(),T=this.now().toISOString(),R=OK(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[_,E.organizationId,E.name,E.publicKeyPem,R,T]),this.key(_)}key(E){let _=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return _?Ze(_):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let _=this.key(E.keyId);if(!_||_.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(_.revokedAt)throw Error("Update signing key is revoked.");if(!UK(E.document,E.signature,_.publicKeyPem))throw Error("Update manifest signature is invalid.");let T=hK(E.document,E.current),R=SK(E.document),N=this.id(),L=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[N,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,R,JSON.stringify(E.document),E.signature,JSON.stringify(T),L]),this.manifest(N)}manifest(E){let _=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return _?$K(_):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map($K)}createWindow(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[_,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,T,T]),this.window(_)}window(E){let _=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return _?DK(_):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(DK)}createCampaign(E){return this.control.transaction(()=>{let _=this.manifest(E.manifestId);if(!_?.compatibility.compatible||_.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let T=this.id(),R=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[T,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,R,R]),E.targets.forEach((N,L)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,N.serverId??null,N.target,E.strategy==="canary"?L===0?0:1+Math.floor((L-1)/E.batchSize):Math.floor(L/E.batchSize),N.previousVersion,R,R])),this.campaign(T)})}campaign(E){let _=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return _?CK(_):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(CK)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(qH)}updateCampaign(E,_){let T=this.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let R={...T,..._};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[R.status,R.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!T)throw Error("Upgrade target was not found.");let R={...qH(T),..._};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[R.status,JSON.stringify(R.evidence),R.error??null,R.startedAt??null,R.finishedAt??null,this.now().toISOString(),E]),qH(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let _=[...E.candidates].sort((A,S)=>A.id.localeCompare(S.id)),T=P2(_),R=this.id(),N=this.now().toISOString(),L=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[R,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(_),T,_.reduce((A,S)=>A+S.bytes,0),L,N,N]),this.cleanup(R)}cleanup(E){let _=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return _?XK(_):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(XK)}updateCleanup(E,_){let T=this.cleanup(E);if(!T)throw Error("Cleanup plan was not found.");let R={...T,..._};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[R.status,R.confirmation??null,JSON.stringify(R.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[_,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,T,T]),this.drill(_)}drill(E){let _=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return _?JK(_):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(JK)}updateDrill(E,_){let T=this.drill(E);if(!T)throw Error("DR drill was not found.");let R={...T,..._};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[R.status,R.operationId??null,JSON.stringify(R.evidence),R.measuredRpoMinutes??null,R.measuredRtoMinutes??null,R.cleanupVerified?1:0,R.error??null,R.startedAt??null,R.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}await g_();function de(E,_=new Date){if(!E.enabled)return!1;let T=new Date(E.schedule);if(!Number.isNaN(T.getTime()))return _>=T&&_.getTime()<=T.getTime()+E.durationMinutes*60000;let R=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!R)return!1;let N=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(_),L=Number(N.find((S)=>S.type==="hour")?.value)*60+Number(N.find((S)=>S.type==="minute")?.value),A=Number(R[1])*60+Number(R[2]);return L>=A&&L<A+E.durationMinutes}class FD{store;now;queue;constructor(E,_,T=()=>new Date){this.store=E;this.now=T;this.queue=_??new pE(E.control)}enqueueCampaign(E,_={}){let T=this.store.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let R=T.windowId?this.store.window(T.windowId):void 0;if(R&&!R.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(R&&!_.overrideWindow&&!de(R,this.now()))throw Error("Upgrade is outside its maintenance window.");if(R?.requireApproval&&!_.approvedBy&&!T.approvedBy)throw Error("Maintenance approval is required.");let N=this.queue.enqueue({projectId:T.projectId,actorId:_.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:N}}async previewCleanup(E,_){let T=_.find((R)=>R.kind===E.kind);if(!T)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await T.discover(E.criteria)})}enqueueCleanup(E,_){let T=this.store.cleanup(E);if(!T||T.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(T.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let R=`DELETE ${T.candidates.length} ${T.kind}`;if(_!==R)throw Error(`Exact confirmation ${R} is required.`);let N=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${T.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:_}),operation:N}}enqueueDrill(E){let _=this.store.drill(E);if(!_||_.status!=="planned")throw Error("A planned DR drill is required.");let T=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${_.scenario}:${_.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:T.id}),operation:T}}}var xH=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function IK(E){return{"maintenance.upgrade":async(N)=>{let L=E.store.campaign(String(xH(N.operation.input).campaignId??""));if(!L||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let A=E.store.manifest(L.manifestId);if(!A?.compatibility.compatible||A.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let S=A.document.artifacts.find((U)=>U.platform===process.platform&&U.architecture===process.arch)??A.document.artifacts[0];if(!S)throw Error("No update artifact matches this platform.");E.store.updateCampaign(L.id,{status:"running",currentStage:"preflight"});let O=[];try{for(let U of[...new Set(E.store.targets(L.id).map((h)=>h.cohort))].sort((h,$)=>h-$)){E.store.updateCampaign(L.id,{currentStage:`cohort:${U}`});for(let h of E.store.targets(L.id).filter(($)=>$.cohort===U)){N.throwIfCancellationRequested(),N.checkpoint(`download:${h.target}`,"Downloading signed platform artifact."),E.store.updateTarget(h.id,{status:"downloading",startedAt:new Date().toISOString()});let $=await E.platform.download({target:h,artifact:S,signal:N.signal});if($.sha256!==S.sha256)throw Error(`Artifact checksum mismatch for ${h.target}.`);N.checkpoint(`install:${h.target}`,"Installing verified artifact."),E.store.updateTarget(h.id,{status:"installing"}),await E.platform.install({target:h,path:$.path,version:A.version,signal:N.signal}),O.push(h);let D=await E.platform.health({target:h,gate:L.healthGate});if(!D.healthy)throw Error(`Upgrade health gate failed for ${h.target}.`);E.store.updateTarget(h.id,{status:"healthy",evidence:D.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(L.id,{status:"succeeded",currentStage:void 0}),{campaignId:L.id,version:A.version,targets:O.length}}catch(U){E.store.updateCampaign(L.id,{status:"rolling_back",currentStage:"rollback"});for(let h of O.reverse())E.store.updateTarget(h.id,{status:"rolling_back"}),await E.platform.rollback({target:h,version:h.previousVersion,signal:N.signal}),E.store.updateTarget(h.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(L.id,{status:"rolled_back",currentStage:void 0}),U}},"maintenance.cleanup":async(N)=>{let L=E.store.cleanup(String(xH(N.operation.input).planId??""));if(!L||L.status!=="approved")throw Error("Approved cleanup plan was not found.");if(P2([...L.candidates].sort((h,$)=>h.id.localeCompare($.id)))!==L.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let A=E.cleanup?.find((h)=>h.kind===L.kind);if(!A)throw Error(`No ${L.kind} cleanup driver is configured.`);E.store.updateCleanup(L.id,{status:"running"});let S=[],O=[];for(let h of L.candidates){N.throwIfCancellationRequested();try{await A.remove(h),S.push(h.id)}catch($){O.push({id:h.id,error:$ instanceof Error?$.message:String($)})}}let U=O.length?S.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(L.id,{status:U,result:{removed:S,failed:O,reclaimedBytes:L.candidates.filter((h)=>S.includes(h.id)).reduce((h,$)=>h+$.bytes,0)}}),O.length)throw Error(`Cleanup failed for ${O.length} candidate(s).`);return{planId:L.id,removed:S.length,reclaimedBytes:L.estimatedBytes}},"maintenance.drill":async(N)=>{let L=E.store.drill(String(xH(N.operation.input).drillId??""));if(!L)throw Error("DR drill was not found.");let A=E.recovery?.find(($)=>$.scenario===L.scenario);if(!A)throw Error(`No ${L.scenario} recovery driver is configured.`);let S=new Date;E.store.updateDrill(L.id,{status:"restoring",startedAt:S.toISOString()});let O=L.isolatedTarget,U={},h={};try{N.checkpoint("restore","Restoring into isolated drill target.");let $=await A.restore({drill:L,signal:N.signal});if(!$.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");O=$.target,U=$.evidence;let D=(S.getTime()-new Date($.recoveryPointAt).getTime())/60000;E.store.updateDrill(L.id,{status:"verifying",measuredRpoMinutes:D,evidence:{restore:U}}),N.checkpoint("verify","Running recovery health checks without production traffic.");let C=await A.verify({drill:L,target:O});h=C.evidence;let J=(Date.now()-S.getTime())/60000;if(!C.healthy||D>L.expectedRpoMinutes||J>L.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(L.id,{measuredRpoMinutes:D,measuredRtoMinutes:J,evidence:{restore:U,verify:h}})}catch($){throw E.store.updateDrill(L.id,{status:"failed",error:$ instanceof Error?$.message:String($),evidence:{restore:U,verify:h}}),$}finally{E.store.updateDrill(L.id,{status:"cleaning"});try{await A.cleanup({drill:L,target:O});let $=E.store.drill(L.id);E.store.updateDrill(L.id,{status:$.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch($){E.store.updateDrill(L.id,{status:"cleanup_required",cleanupVerified:!1,error:$ instanceof Error?$.message:String($),finishedAt:new Date().toISOString()})}}return{drillId:L.id,status:E.store.drill(L.id).status}}}}var FK={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class WD{kind;control;projectId;organizationId;constructor(E,_,T,R){this.kind=E;this.control=_;this.projectId=T;this.organizationId=R}async discover(E){let _=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),T=new Date(Date.now()-_*86400000).toISOString(),R=FK[this.kind],N=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(R.select).all(N,T).map((A)=>({id:String(A.id),kind:this.kind,label:`${this.kind}:${String(A.id)}`,bytes:Number(A.bytes??0),metadata:{createdAt:String(A.created_at)}}))}async remove(E){if(this.control.database.run(FK[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function qe(){let E=await o(),_=mE(process.cwd(),E),T=new ID(_.store),R=new FD(T),N=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new WD(L,_.store,_.project.id,_.organization.id));return{controlPlane:_,store:T,service:R,cleanup:N}}async function TA(E){let _=await qe();try{await E(_)}catch(T){d(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}function yH(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(_)=>TA((T)=>{let R={manifests:T.store.manifests(T.controlPlane.organization.id),windows:T.store.windows(T.controlPlane.project.id),campaigns:T.store.campaigns(T.controlPlane.project.id),cleanups:T.store.cleanups(T.controlPlane.project.id),drills:T.store.drills(T.controlPlane.project.id)},N=[...R.manifests.map((L)=>["update",L.version,L.compatibility.compatible?"compatible":"blocked",L.compatibility.reasons.join("; ")||L.channel]),...R.campaigns.map((L)=>["upgrade",L.id,L.status,L.currentStage??L.fromVersion]),...R.cleanups.map((L)=>["cleanup",L.kind,L.status,`${L.candidates.length} items / ${L.estimatedBytes} bytes`]),...R.drills.map((L)=>["DR drill",L.scenario,L.status,L.isolatedTarget])];if(_.json)console.log(JSON.stringify(R,null,2));else p(["Area","Name / version","Status","Detail"],N)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(_,T)=>TA(async(R)=>{let N=R.store.addTrustedKey({organizationId:R.controlPlane.organization.id,name:_,publicKeyPem:await Bun.file(T).text()});b(`Trusted ${N.name}: ${N.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(_,T,R)=>TA(async(N)=>{let L=await Bun.file(_).json(),A=(await Bun.file(T).text()).trim(),S=N.store.importManifest({organizationId:N.controlPlane.organization.id,keyId:R,document:L,signature:A,current:{schemaVersion:N.controlPlane.store.health().schemaVersion,currentVersion:XD,platform:process.platform,architecture:process.arch}});b(`Verified ${S.version}; ${S.compatibility.compatible?"compatible":"blocked: "+S.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(_,T,R)=>TA((N)=>{let L=N.store.createWindow({projectId:N.controlPlane.project.id,name:_,schedule:T,timezone:R.timezone,durationMinutes:Number(R.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});b(`Created ${L.name} (${L.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(_,T,R)=>TA((N)=>{let L=new CL(N.controlPlane.store).list(N.controlPlane.project.id).filter((O)=>O.status==="ready").map((O)=>({serverId:O.id,target:O.name,previousVersion:O.bootstrapVersion??XD}));if(!L.length)L.push({target:"control-plane",previousVersion:XD});let A=N.store.createCampaign({projectId:N.controlPlane.project.id,manifestId:_,fromVersion:XD,strategy:R.strategy==="rolling"?"rolling":"canary",batchSize:Number(R.batch),healthGate:{kind:"platform"},backupId:T,targets:L}),S=N.service.enqueueCampaign(A.id);b(`Staged upgrade queued: ${S.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(_,T)=>TA(async(R)=>{let N=await R.service.previewCleanup({projectId:R.controlPlane.project.id,kind:_,criteria:{olderThanDays:Number(T.olderThan)}},R.cleanup);p(["ID","Candidate","Bytes"],N.candidates.map((L)=>[L.id,L.label,String(L.bytes)])),X(`Apply with: cloud cleanup:apply ${N.id} --confirm "DELETE ${N.candidates.length} ${N.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(_,T)=>TA((R)=>{let N=R.service.enqueueCleanup(_,String(T.confirm??""));b(`Cleanup queued: ${N.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(_,T,R)=>TA((N)=>{let L=N.store.createDrill({projectId:N.controlPlane.project.id,scenario:_,isolatedTarget:T,expectedRpoMinutes:Number(R.rpo),expectedRtoMinutes:Number(R.rto),recoveryPointId:R.recoveryPoint,topologyId:R.topology});b(`Planned isolated drill ${L.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(_)=>TA((T)=>{let R=T.service.enqueueDrill(_);b(`DR drill queued: ${R.operation.id}`)}))}kE();$S();vR();async function fH(){try{return(await o()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function kH(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(_)=>{r("Lambda Functions");let T=_?.region||await fH(),R=new K_(T);try{let{Functions:N=[]}=await R.listFunctions({MaxItems:50});if(!N.length){X("No functions found");return}p(["Name","Runtime","Memory","Timeout","Last Modified"],N.map((L)=>[L.FunctionName??"-",L.Runtime??"-",L.MemorySize?`${L.MemorySize} MB`:"-",L.Timeout?`${L.Timeout}s`:"-",L.LastModified??"-"]))}catch(N){d(`Failed to list functions: ${N.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(_,T)=>{r(`Invoking ${_}`);let R=T?.region||await fH(),N=new K_(R),L=new l("Invoking function...");L.start();try{let A=await N.invoke({FunctionName:_,InvocationType:T?.async?"Event":"RequestResponse",Payload:T?.payload||"{}",LogType:T?.async?"None":"Tail"});if(A.FunctionError){if(L.fail(`Function returned an error (${A.FunctionError})`),A.Payload)X(A.Payload);process.exitCode=1;return}if(L.succeed(`Invoked (status ${A.StatusCode})`),A.Payload)X(`
+`).find((N)=>N&&!N.startsWith("#"))?.trim().split(/\s+/);if(T.code!==0||!R?.[1]||!R[2])throw Error(`SSH host-key scan failed: ${T.stderr.trim()||"no key returned"}`);return{algorithm:R[1],key:R[2]}}async exec(E,_){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return mM(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,_])}}var $e=(E)=>`SHA256:${he("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,De=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class pL{provider;transport;discoverer;constructor(E,_=new nM,T){this.provider=E;this.transport=_;this.discoverer=T}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let _=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:_.algorithm,hostKeyFingerprint:$e(_.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let _=await this.transport.exec(E,De);if(_.code!==0)throw Error(`Fleet validation failed: ${_.stderr.trim()||_.code}`);try{return JSON.parse(_.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,_){let T=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${_.length}`);if(T.code!==0)throw Error(`Fleet bootstrap failed: ${T.stderr.trim()||T.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function eM(E,_){return{"fleet.bootstrap":async(T)=>{let R=T.operation.input&&typeof T.operation.input==="object"&&!Array.isArray(T.operation.input)?T.operation.input:{},N=E.get(String(R.serverId??""));if(!N)throw Error("Queued fleet server was not found.");let L=_.find((O)=>O.provider===N.provider);if(!L)throw Error(`No ${N.provider} fleet driver is configured.`);let A=Array.isArray(R.steps)?R.steps.map(String):[];if(T.checkpoint("preflight","Rechecking pinned trust and healthy validation."),N.trustState!=="pinned"||!N.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");T.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let S=await L.bootstrap(N,A);return E.update(N.id,{bootstrapVersion:S.version,status:"ready"}),T.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:N.id,bootstrapVersion:S.version,steps:A.length}}}}var DL=(E)=>E==null?void 0:String(E),z0=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},YH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:DL(E.provider_id),region:DL(E.region),zone:DL(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:DL(E.host_key_algorithm),hostKeyFingerprint:DL(E.host_key_fingerprint),pendingHostKey:DL(E.pending_host_key),roles:z0(E.roles,[]),labels:z0(E.labels,{}),taints:z0(E.taints,[]),capacity:z0(E.capacity,{}),usage:z0(E.usage,{}),capabilities:z0(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:z0(E.validation,void 0),bootstrapVersion:DL(E.bootstrap_version),heartbeatAt:DL(E.heartbeat_at),lastSeenAt:DL(E.last_seen_at),archivedAt:DL(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class CL{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}get(E){let _=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return _?YH(_):void 0}list(E,_=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(YH).filter((T)=>_||T.status!=="archived")}findProvider(E,_,T){let R=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,_,T);return R?YH(R):void 0}create(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,T,T]),this.get(_)}update(E,_){let T=this.get(E);if(!T)throw Error("Server was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[R.name,R.providerId??null,R.region??null,R.zone??null,R.endpoint,R.sshUser,R.sshPort,R.credentialRef,R.hostKeyAlgorithm??null,R.hostKeyFingerprint??null,R.pendingHostKey??null,JSON.stringify(R.roles),JSON.stringify(R.labels),JSON.stringify(R.taints),JSON.stringify(R.capacity),JSON.stringify(R.usage),JSON.stringify(R.capabilities),R.status,R.trustState,JSON.stringify(R.validation??{}),R.bootstrapVersion??null,R.heartbeatAt??null,R.lastSeenAt??null,R.archivedAt??null,N,E]),this.get(E)}}var Ce=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class AD{store;drivers;now;queue;constructor(E,_,T,R=()=>new Date){this.store=E;this.drivers=_;this.now=R;this.queue=T??new pE(E.control)}driver(E){let _=this.drivers.find((T)=>T.provider===E);if(!_)throw Error(`No ${E} fleet driver is configured.`);return _}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!Ce.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let _=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(_)return this.store.update(_.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let T=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),R=this.driver(E.provider);return this.store.create({...E,resourceId:T.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:R.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let T=await this.driver(_.provider).test(_);if(!T.reachable)return this.store.update(E,{status:"unreachable"});if(_.hostKeyFingerprint&&_.hostKeyFingerprint!==T.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:T.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:T.hostKeyAlgorithm,hostKeyFingerprint:T.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,_){let T=this.store.get(E);if(!T||T.pendingHostKey!==_)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:_,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let _=this.store.get(E);if(!_||_.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let T=await this.driver(_.provider).validate(_),R=[];if(!["x64","arm64","x86_64","aarch64"].includes(T.arch??""))R.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let A of["curl","tar"])if(!T.tools?.[A])R.push({code:`tool.${A}`,severity:"error",message:`${A} is missing.`,remediation:`Install ${A} before bootstrap.`});if(Math.abs(T.timeSkewSeconds??0)>60)R.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!T.dnsOk)R.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let N={valid:!R.some((A)=>A.severity==="error"),facts:T,findings:R,validatedAt:this.now().toISOString(),validatorVersion:"1"},L={cpu:T.cpuCores??0,memoryBytes:T.memoryBytes??0,diskBytes:T.diskBytes??0};return this.store.update(E,{validation:N,capacity:L,status:N.valid?"ready":"degraded"})}bootstrap(E,_=!1){let T=this.store.get(E);if(!T?.validation?.valid)throw Error("A healthy validation report is required.");let R=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!_)return{preview:!0,steps:R};let N=this.queue.enqueue({projectId:T.projectId,resourceId:T.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:R},lockKey:`server:${E}`,providerKey:T.provider}).operation;return{preview:!1,steps:R,operation:N}}heartbeat(E,_){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let R=this.now().toISOString();return this.store.update(E,{usage:_.usage,capabilities:_.capabilities??T.capabilities,heartbeatAt:R,lastSeenAt:R,status:T.status==="draining"||T.status==="drained"?T.status:"ready"})}drain(E,_=!1){return this.store.update(E,{status:_?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,_){let T=this.store.get(E);if(!T||_!==T.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function Xe(){let E=await o(),_=mE(process.cwd(),E),T=new CL(_.store),R=new AD(T,[new pL("aws"),new pL("hetzner"),new pL("ssh")]);return{controlPlane:_,store:T,service:R}}async function oL(E){let _=await Xe();try{return await E(_)}finally{_.controlPlane.store.close()}}var B0=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!T)throw Error(`Server ${_} was not found.`);return T},$N=(E)=>{d(E instanceof Error?E.message:String(E)),process.exitCode=1};function wH(E,_){let T=Number.parseInt(E??"",10);return Number.isFinite(T)&&T>=0?T:_}function Je(E="3h"){let _=E.match(/^(\d+)(m|h)$/);if(!_)throw Error("--range must use minutes or hours, for example 30m or 3h.");let T=Number(_[1])*(_[2]==="h"?3600000:60000);if(T<300000||T>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return T}function SD(E,_="%"){return E==null?"unavailable":`${E.toFixed(1)}${_}`}async function Ie(E,_){let T=await o();if(T.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",N=B_(T,R),L=await fN(N);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${L.serverName}.`);let A=hU(T),S=new eL({apiToken:$U(A.apiToken,T)}),O=await S.getServer(L.serverId),U=L.publicIp??O.public_net.ipv4?.ip;if(!U)throw Error(`Server ${O.name} has no public IPv4 address.`);let h=new Date,$=new Date(h.getTime()-Je(_.range)),D=Math.min(3600,Math.max(60,wH(_.step,60))),C=await VM({client:S,serverId:O.id,cores:Math.max(1,Number(O.server_type.cores)||1),from:$,to:h,step:D,remote:{host:U,user:L.sshUser??A.sshUser,identityFile:A.sshPrivateKeyPath,connectTimeoutSec:15}});if(_.json){console.log(JSON.stringify({schemaVersion:1,server:O.name,result:C},null,2));return}p(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[O.name,`${C.from} to ${C.to}`,`${SD(C.summary.cpuAveragePercent)} / ${SD(C.summary.cpuPeakPercent)}`,`${SD(C.summary.memoryAveragePercent)} / ${SD(C.summary.memoryPeakPercent)}`,C.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(C.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,SD(C.summary.swapPeakPercent)]])}function aM(E){let _=E.targetType.prices?.find((T)=>T.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:_?{hourlyNet:_.price_hourly.net,hourlyGross:_.price_hourly.gross,monthlyNet:_.price_monthly.net,monthlyGross:_.price_monthly.gross}:void 0}}function Fe(E){let _=aM(E);p(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${_.serverName} (${_.serverId})`,_.location,`${_.from} -> ${_.to}`,_.capacityAvailable?"available":"waiting",`${_.target.cores??0} / ${_.target.memoryGb??0} GB / ${_.target.diskGb??0} GB`,_.price?.monthlyGross??_.price?.monthlyNet??"not reported"]])}async function We(E,_,T){let R=await o();if(R.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let N=T.env??process.env.CLOUD_ENV??"production",L=B_(R,N),A=await fN(L),S=hU(R),O=new eL({apiToken:$U(S.apiToken,R)}),h=A&&(E===A.serverName||E===String(A.serverId)||E===A.stackName)?await O.getServer(A.serverId):(await O.listServers()).find((q)=>q.name===E||String(q.id)===E);if(!h)throw Error(`Hetzner server ${E} was not found.`);if(A?.serverId&&A.serverId!==h.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${A.serverId}.`);let $=aL(_),D=T.upgradeDisk!==!1,C=await LD(O,h.id,$,D);if(T.json)console.log(JSON.stringify({schemaVersion:1,plan:aM(C)},null,2));else Fe(C);if(!T.apply){if(!T.json)X(`Preview only. Re-run with --apply --confirm ${h.name} to execute.`);return}if(T.confirm!==h.name)throw Error(`Resize requires --confirm ${h.name}.`);let J=A?.publicIp??h.public_net.ipv4?.ip;if(!J)throw Error(`Server ${h.name} has no public IPv4 address for verification.`);let I={host:J,user:A?.sshUser??S.sshUser,identityFile:S.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},W=await BH(L),H=new Date().toISOString(),w={schemaVersion:1,operationId:W?.targetType===$&&W.serverId===h.id?W.operationId:crypto.randomUUID(),stackName:L,serverId:h.id,serverName:h.name,sourceType:C.currentType.name,targetType:$,upgradeDisk:D,phase:"planning",status:"running",attempts:W?.targetType===$?W.attempts:0,startedAt:W?.targetType===$?W.startedAt:H,updatedAt:H,manifest:W?.targetType===$?W.manifest:void 0};await sL(w);let B=wH(T.pollSeconds,900)*1000,Q=wH(T.maxWaitMinutes,0)*60000,K=Date.now();for(;;){let q=await LD(O,h.id,$,D);if(!q.capacityAvailable&&!q.alreadyComplete){if(w={...w,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await sL(w),!T.wait){if(!T.json)X(`${$} has no capacity in ${q.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(Q>0&&Date.now()-K>=Q)throw Error(`Timed out waiting for ${$} capacity in ${q.location}.`);if(!T.json)X(`Waiting ${Math.round(B/1000)} seconds for ${$} capacity...`);await Bun.sleep(B);continue}let x=await HH(L);try{let g=await(async()=>{try{return w={...w,status:"running",attempts:w.attempts+1,updatedAt:new Date().toISOString()},await sL(w),await XH({client:O,serverId:h.id,targetType:$,upgradeDisk:D,resumeFromOff:w.phase==="shutting-down"||w.phase==="resizing"||w.phase==="powering-on"||w.phase==="verifying",manifest:w.manifest,hooks:{preflight:async()=>{let k=await IH(I);return w={...w,manifest:k,updatedAt:new Date().toISOString()},await sL(w),k},afterBoot:async(k,v,t,EE)=>FH(I,v,t,EE),onPhase:async(k,v)=>{if(w={...w,phase:k,status:k==="waiting-capacity"?"waiting-capacity":k==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await sL(w),!T.json)X(`${k}${v?` ${JSON.stringify(v)}`:""}`)}}})}finally{await x()}})();if(w={...w,status:g.status==="completed"||g.status==="already-complete"?"completed":g.status==="recovered"?"recovered":"waiting-capacity",lastError:g.status==="recovered"?g.error:void 0,updatedAt:new Date().toISOString()},await sL(w),T.json)console.log(JSON.stringify({schemaVersion:1,result:g},null,2));else if(g.status==="completed"||g.status==="already-complete")b(`${h.name} is on ${$} and passed full post-boot verification.`);else if(g.status==="recovered"&&g.retryable&&T.wait){X(`Capacity race recovered safely. Waiting ${Math.round(B/1000)} seconds before retry.`),await Bun.sleep(B);continue}else if(g.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${g.error}`);return}catch(g){throw w={...w,status:"failed",lastError:g instanceof Error?g.message:String(g),updatedAt:new Date().toISOString()},await sL(w),g}}}async function ze(E,_){let T=await o();if(T.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",N=B_(T,R),L=await fN(N);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${L.serverName}.`);let A=hU(T),S=new eL({apiToken:$U(A.apiToken,T)}),O=await S.getServer(L.serverId),U=L.publicIp??O.public_net.ipv4?.ip;if(!U)throw Error(`Server ${O.name} has no public IPv4 address.`);let h=H2(T);if(_.json)console.log(JSON.stringify({schemaVersion:1,server:O.name,plan:h},null,2));else p(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[O.name,h.firewallPorts.join(","),h.monitoring?"on":"off",h.autoUpdates?"on":"off",`${h.swapGb} GB`,"disabled"]]);if(!_.apply){if(!_.json)X(`Preview only. Re-run with --apply --confirm ${O.name} to execute.`);return}if(_.confirm!==O.name)throw Error(`Optimization requires --confirm ${O.name}.`);let $={host:U,user:L.sshUser??A.sshUser,identityFile:A.sshPrivateKeyPath,connectTimeoutSec:15},D=await zU($),C=D.routeProbes.filter((t)=>!t.ok),J=T.infrastructure?.compute,I=jR(J)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,W=D.failedUnits.filter((t)=>!I.has(t));if(W.length>0)throw Error(`Preflight found failed services: ${W.join(", ")}`);if(C.length>0)throw Error(`Preflight found unhealthy routes: ${C.map((t)=>t.domain).join(", ")}`);let H=jR(J)?[]:Object.values(T.sites??{}).flatMap((t)=>typeof t?.port==="number"&&![80,443].includes(t.port)?[t.port]:[]),w=XU({allowSsh:J?.allowSsh!==!1,sitePorts:H,allowedPorts:J?.firewall?.allowedPorts}),B=(L.firewallId?(await S.listFirewalls()).find((t)=>t.id===L.firewallId):void 0)??(await S.listFirewalls()).find((t)=>t.name===`${T.project.slug}-${R}-app-fw`);if(!B)throw Error(`Managed firewall for ${O.name} was not found.`);let Q=await S.setFirewallRules(B.id,w);await Promise.all(Q.map((t)=>S.waitForAction(t.id))),await SH(T,$);let[K,q]=await Promise.all([zU($),OH($)]),x=UH(h,q),g=kM(D,K),k=K.routeProbes.filter((t)=>!t.ok);if(g.stoppedServices.length>0)x.push(`services stopped: ${g.stoppedServices.join(", ")}`);if(g.changedRouteFragments.length>0)x.push(`route fragments changed: ${g.changedRouteFragments.join(", ")}`);if(g.missingRouteIds.length>0)x.push(`routes disappeared: ${g.missingRouteIds.join(", ")}`);if(g.changedReleaseLinks.length>0)x.push(`release links changed: ${g.changedReleaseLinks.join(", ")}`);if(g.missingData.length>0)x.push(`databases or volumes disappeared: ${g.missingData.join(", ")}`);if(k.length>0)x.push(`unhealthy routes: ${k.map((t)=>t.domain).join(", ")}`);if(x.length>0)throw Error(`Host optimization verification failed: ${x.join("; ")}`);let v={serverId:O.id,serverName:O.name,services:K.runningServices.length,routes:K.routeIds.length,healthyDomains:K.routeProbes.length,releaseLinks:K.releaseLinks.length,databasesAndVolumes:K.dataCatalog.length,report:q};if(_.json)console.log(JSON.stringify({schemaVersion:1,result:v},null,2));else b(`${O.name} passed full host, rpx route, service, release, and data verification.`)}function QH(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(_,T)=>{try{await oL(async(R)=>{let N=_?[B0(R,_)]:R.store.list(R.controlPlane.project.id),L=N.flatMap((A)=>Object.entries(A.capabilities).map(([S,O])=>({server:A.name,provider:A.provider,action:S,...O})));if(T.json)console.log(JSON.stringify({schemaVersion:1,targets:L},null,2));else p(["Server","Provider","Action","Support","Explanation"],L.map((A)=>[A.server,A.provider,A.action,A.supported?"supported":"unsupported",A.reason??"—"]))})}catch(R){$N(R)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(_,T,R)=>{try{await We(_,T,R)}catch(N){$N(N)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(_,T)=>{try{await ze(_,T)}catch(R){$N(R)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(_,T)=>{try{await Ie(_,T)}catch(R){$N(R)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(_)=>{try{await oL(async(T)=>{let R=T.store.list(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],R.map((N)=>[N.name,N.providerId??"—",`${N.provider} / ${N.region??"external"}`,`${N.status} / ${N.trustState}`,N.roles.join(","),`${N.capacity.cpu??0} / ${N.capacity.memoryBytes??0}`,N.heartbeatAt??"never"]))})}catch(T){$N(T)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(_,T)=>{try{await oL(async(R)=>{let N=T.provider;if(!["aws","hetzner","ssh"].includes(N)||!T.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let L=R.service.enroll({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,provider:N,providerId:T.providerId,endpoint:T.endpoint,sshUser:T.user??"deploy",credentialRef:T.credentialRef??"secret://fleet/agent",region:T.region,roles:String(T.roles??"application").split(","),labels:Object.fromEntries(String(T.labels??"").split(",").map((A)=>A.split("=")).filter((A)=>A[0]&&A[1]))});b(`Enrolled ${L.name} as ${L.id}; no remote mutation was performed.`)})}catch(R){$N(R)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(_,T)=>{try{await oL(async(R)=>{let N=B0(R,_);if(N=await R.service.test(N.id),N.trustState==="rotation_pending"){if(!T.acceptHostKey)throw Error(`Host key changed to ${N.pendingHostKey}; review it first.`);N=R.service.reviewHostKey(N.id,T.acceptHostKey)}let L=await R.service.validate(N.id);if(T.json)console.log(JSON.stringify(L.validation,null,2));else p(["Severity","Code","Finding","Remediation"],(L.validation?.findings??[]).map((A)=>[A.severity,A.code,A.message,A.remediation??"—"]));if(!L.validation?.valid)process.exitCode=1})}catch(R){$N(R)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(_,T)=>{try{await oL(async(R)=>{let N=R.service.bootstrap(B0(R,_).id,!!T.apply);if(N.preview)p(["Step"],N.steps.map((L)=>[L]));else b(`Bootstrap queued: ${N.operation?.id}`)})}catch(R){$N(R)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(_,T)=>{try{await oL(async(R)=>b(R.service.drain(B0(R,_).id,!!T.complete).status))}catch(R){$N(R)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(_)=>{try{await oL(async(T)=>{T.service.uncordon(B0(T,_).id),b(`Uncordoned ${_}.`)})}catch(T){$N(T)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(_,T)=>{try{await oL(async(R)=>{R.service.archive(B0(R,_).id,T.confirm??""),b(`Archived ${_}; provider infrastructure was not terminated.`)})}catch(R){$N(R)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(_)=>{try{await oL(async(T)=>{let R=B0(T,_);if(R.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let N=Bun.spawn(["ssh","-p",String(R.sshPort),"-o","StrictHostKeyChecking=yes",`${R.sshUser}@${R.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),L=await N.exited;if(L)process.exitCode=L})}catch(T){$N(T)}});for(let[_,T]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(_,T).action(async(...R)=>ON(_.split(" ")[0],{target:String(R[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}kE();var kN=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},YR=(E)=>E==null?void 0:String(E),pM=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),HU=(E={})=>({...pM(),...E});function iM(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:YR(E.region),architecture:YR(E.architecture),labels:kN(E.labels,{}),requiredServerLabels:kN(E.required_server_labels,{}),toleratedTaints:kN(E.tolerated_taints,[]),capacity:HU(kN(E.capacity,{})),reserved:kN(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:YR(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function sM(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:YR(E.environment_id),resourceId:String(E.resource_id),releaseId:YR(E.release_id),poolId:String(E.pool_id),serverId:YR(E.server_id),purpose:String(E.purpose),requirements:kN(E.requirements,{}),decision:kN(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Be(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:YR(E.resource_id),poolId:String(E.pool_id),placementId:YR(E.placement_id),operationId:YR(E.operation_id),sourceSha:String(E.source_sha),buildSpec:kN(E.build_spec,{}),credentialPolicy:kN(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:YR(E.workspace),cacheKey:YR(E.cache_key),artifactUri:YR(E.artifact_uri),artifactDigest:YR(E.artifact_digest),status:String(E.status),cleanupAt:YR(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class OD{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}createPool(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(HU(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,T,T]),this.getPool(_)}getPool(E){let _=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return _?iM(_):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(iM)}updatePool(E,_){let T=this.getPool(E);if(!T)throw Error("Capacity pool was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[R.status,JSON.stringify(R.reserved),JSON.stringify(R.capacity),R.concurrency,N,E]),this.getPool(E)}addMember(E,_,T={}){let R=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,_,JSON.stringify(T),R,R])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((_)=>({serverId:String(_.server_id),status:String(_.status),capacityOverride:kN(_.capacity_override,{})}))}memberStatus(E,_,T){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[T,this.now().toISOString(),E,_])}listPlacements(E,_){let T=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(sM);return _?.length?T.filter((R)=>_.includes(R.status)):T}getPlacement(E){let _=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return _?sM(_):void 0}activeUsage(E,_){let T=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),R=_?T.filter((N)=>String(N.server_id)===_):T;return{resources:R.reduce((N,L)=>{let A=HU(kN(L.resources,{}));for(let S of Object.keys(N))N[S]+=A[S];return N},pM()),count:R.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let _=this.id(),T=this.id(),R=this.now().toISOString(),N=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[_,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,R,R]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[T,_,E.decision.poolId,E.decision.serverId??null,JSON.stringify(HU(E.requirements.resources)),N,R,R]),this.getPlacement(_)})}transitionPlacement(E,_){if(!this.getPlacement(E))throw Error("Placement was not found.");let R=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[_,R,E]),["released","failed","blocked"].includes(_))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[R,E]);return this.getPlacement(E)}createBuild(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[_,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),T,T]),this.getBuild(_)}getBuild(E){let _=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return _?Be(_):void 0}updateBuild(E,_){let T=this.getBuild(E);if(!T)throw Error("Remote build was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[R.operationId??null,R.workspace??null,R.cacheKey??null,R.artifactUri??null,R.artifactDigest??null,R.status,R.cleanupAt??null,N,E]),this.getBuild(E)}}var Q2=["cpu","memoryBytes","diskBytes","gpu"],oM=(E,_={})=>Object.entries(_).every(([T,R])=>E[T]===R),He=(E,_,T)=>Object.fromEntries(Q2.map((R)=>[R,Math.max(0,E[R]-_[R]-(T[R]??0))])),je=(E,_)=>Q2.every((T)=>E[T]>=(_[T]??0)),Ye=(E,_)=>Q2.reduce((T,R)=>T+(_[R]??0)/(E[R]||1),0);class UD{store;fleet;constructor(E,_){this.store=E;this.fleet=_}poolCandidates(E,_,T){let R=[];for(let N of this.store.listPools(E)){if(N.id===T)continue;let L=[];if(N.status!=="active")L.push(`pool is ${N.status}`);if(N.purpose!==_.purpose)L.push(`purpose is ${N.purpose}`);if(_.region&&N.region!==_.region)L.push(`region is ${N.region??"unset"}`);if(_.architecture&&N.architecture!==_.architecture)L.push(`architecture is ${N.architecture??"unset"}`);if(!oM(N.labels,_.labels))L.push("pool labels do not match");if(N.backend==="server"){let A=this.store.members(N.id);if(!A.length)R.push(this.decision(N,void 0,_,[...L,"pool has no servers"]));for(let S of A){let O=this.fleet.get(S.serverId),U=[...L];if(!O)U.push("server is missing");else this.serverReasons(N,O,S.status,_,U);R.push(this.decision(N,O,_,U,S.capacityOverride))}}else R.push(this.decision(N,void 0,_,L))}return R.sort((N,L)=>Number(L.eligible)-Number(N.eligible)||N.score.cost-L.score.cost||N.score.spread-L.score.spread||N.score.fit-L.score.fit||N.poolName.localeCompare(L.poolName)||(N.serverId??"").localeCompare(L.serverId??""))}serverReasons(E,_,T,R,N){if(T!=="active")N.push(`member is ${T}`);if(_.status!=="ready")N.push(`server is ${_.status}`);if(!_.roles.includes(R.purpose==="build"?"build":R.purpose))N.push(`server lacks ${R.purpose} role`);if(!oM(_.labels,E.requiredServerLabels))N.push("server labels do not match pool selector");for(let L of _.taints)if(!E.toleratedTaints.includes(L))N.push(`taint ${L} is not tolerated`)}decision(E,_,T,R,N={}){let L=HU({..._?.capacity,...N}),A=_?Object.fromEntries(Q2.map((U)=>[U,Math.min(E.capacity[U],L[U])])):E.capacity,S=this.store.activeUsage(E.id,_?.id),O=He(A,S.resources,E.reserved);if(S.count>=E.maxWorkloads)R.push("workload limit reached");if(T.purpose==="build"&&S.count>=E.concurrency)R.push("build concurrency reached");if(!je(O,T.resources))R.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:_?.id,eligible:R.length===0,reasons:R,available:O,score:{fit:Ye(O,T.resources),spread:S.count,cost:E.costWeight}}}explain(E,_){return this.poolCandidates(E,_)}place(E){return this.store.control.transaction(()=>{let _=this.poolCandidates(E.projectId,E.requirements).find((T)=>T.eligible);if(!_)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((T)=>T.reasons).join("; ")}`);return this.store.reserve({...E,decision:_})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let _=this.store.updatePool(E,{status:"draining"}),T=[],R=[];for(let N of this.store.listPlacements(_.projectId,["reserved","active"]).filter((L)=>L.poolId===E)){if(N.stateful){R.push(this.store.transitionPlacement(N.id,"blocked"));continue}this.store.transitionPlacement(N.id,"moving");let L=this.place({projectId:N.projectId,environmentId:N.environmentId,resourceId:N.resourceId,releaseId:N.releaseId,requirements:N.requirements});T.push(this.activate(L.id)),this.store.transitionPlacement(N.id,"released")}return{pool:_,moved:T,blocked:R}}drainServer(E,_){this.store.memberStatus(E,_,"draining");let T=this.store.getPool(E);if(!T)throw Error("Capacity pool was not found.");let R=[],N=[];for(let L of this.store.listPlacements(T.projectId,["reserved","active"]).filter((A)=>A.poolId===E&&A.serverId===_)){if(L.stateful){N.push(this.store.transitionPlacement(L.id,"blocked"));continue}this.store.transitionPlacement(L.id,"moving");let A=this.poolCandidates(L.projectId,L.requirements).find((O)=>O.eligible);if(!A){N.push(this.store.transitionPlacement(L.id,"blocked"));continue}let S=this.store.reserve({projectId:L.projectId,environmentId:L.environmentId,resourceId:L.resourceId,releaseId:L.releaseId,requirements:L.requirements,decision:A});R.push(this.activate(S.id)),this.store.transitionPlacement(L.id,"released")}return{moved:R,blocked:N}}reconcileFailure(E){let _=this.fleet.get(E);if(!_)throw Error("Server was not found.");let T=[],R=[];for(let N of this.store.listPlacements(_.projectId,["active"]).filter((L)=>L.serverId===E)){if(N.stateful||!N.autoReschedule){R.push(this.store.transitionPlacement(N.id,"blocked"));continue}this.store.transitionPlacement(N.id,"failed");let L=this.place({projectId:N.projectId,environmentId:N.environmentId,resourceId:N.resourceId,releaseId:N.releaseId,requirements:N.requirements});T.push(this.activate(L.id))}return{rescheduled:T,blocked:R}}}await g_();async function we(){let E=await o(),_=mE(process.cwd(),E),T=new OD(_.store),R=new UD(T,new CL(_.store));return{controlPlane:_,store:T,service:R}}async function hD(E){let _=await we();try{await E(_)}catch(T){d(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var G2=(E)=>Object.fromEntries(String(E??"").split(",").map((_)=>_.split("=")).filter((_)=>_[0]&&_[1])),EK=(E)=>Object.fromEntries(Object.entries(G2(E)).map(([_,T])=>[_,Number(T)]));function GH(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(_)=>hD((T)=>{let R=T.store.listPools(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],R.map((N)=>[N.name,N.purpose,N.backend,`${N.region??"any"} / ${N.architecture??"any"}`,N.status,JSON.stringify(N.capacity),String(N.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(_,T)=>hD((R)=>{let{purpose:N,backend:L}=T;if(!["application","build","worker","monitoring","backup"].includes(N)||!["server","ecs","asg"].includes(L))throw Error("Unsupported pool purpose or backend.");let A=R.store.createPool({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,purpose:N,backend:L,region:T.region,architecture:T.arch,labels:G2(T.labels),requiredServerLabels:G2(T.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...EK(T.capacity)},maxWorkloads:Number(T.max),costWeight:1,concurrency:Number(T.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});b(`Created ${A.name} (${A.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(_,T)=>hD((R)=>{let N=R.store.listPools(R.controlPlane.project.id).find((A)=>A.id===_||A.name===_),L=new CL(R.controlPlane.store).list(R.controlPlane.project.id).find((A)=>A.id===T||A.name===T);if(!N||!L)throw Error("Pool or server was not found.");R.store.addMember(N.id,L.id),b(`Attached ${L.name} to ${N.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(_)=>hD((T)=>{let R=T.service.explain(T.controlPlane.project.id,{purpose:_.purpose,resources:EK(_.resources),region:_.region,architecture:_.arch,labels:G2(_.labels)});if(_.json)console.log(JSON.stringify(R,null,2));else p(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],R.map((N)=>[N.poolName,N.serverId??"provider-managed",N.eligible?"yes":"no",JSON.stringify(N.available),`${N.score.fit.toFixed(2)} / ${N.score.spread} / ${N.score.cost}`,N.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(_)=>hD((T)=>{let R=T.store.listPools(T.controlPlane.project.id).find((L)=>L.id===_||L.name===_);if(!R)throw Error("Pool was not found.");let N=T.service.drainPool(R.id);b(`Draining ${R.name}: moved ${N.moved.length}, blocked ${N.blocked.length} stateful placement(s).`)}))}kE();var EA=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},DN=(E)=>E==null?void 0:String(E),_K=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:DN(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:EA(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:EA(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:DN(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),PH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:DN(E.stack_id),stackRevision:DN(E.stack_revision),status:String(E.status),health:EA(E.health,{}),lastHealthyAt:DN(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),MH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:EA(E.config,{}),status:String(E.status),checkpoint:DN(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:DN(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),KH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:EA(E.weights,{}),desiredWeights:EA(E.desired_weights,{}),status:String(E.status),providerState:EA(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),TK=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:DN(E.operation_id),kind:String(E.kind),requestedRegion:DN(E.requested_region),revision:DN(E.revision),plan:EA(E.plan,[]),currentStep:DN(E.current_step),completedSteps:EA(E.completed_steps,[]),status:String(E.status),error:DN(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class $D{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((L)=>L.region)).size!==E.regions.length||E.regions.filter((L)=>L.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let _=E.regions.find((L)=>L.role==="primary"),T=this.id(),R=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[T,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,_.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),_.region,R,R]);for(let L of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),T,L.region,L.role,L.provider,R,R]);for(let L of E.dataPolicy.replicate)for(let A of E.regions)for(let S of E.regions.filter((O)=>O.region!==A.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,L,A.region,S.region,"{}",R,R]);let N=Object.fromEntries(E.regions.map((L)=>[L.region,L.region===_.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),T,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(N),JSON.stringify(N),R,R]),this.get(T)})}get(E){let _=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return _?_K(_):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(_K)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(PH)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(MH)}route(E){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return _?KH(_):void 0}updateTopology(E,_){let T=this.get(E);if(!T)throw Error("Regional topology was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[R.status,R.activeRegion,R.revision??null,JSON.stringify(R.regions),N,E]),this.get(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!T)throw Error("Regional target was not found.");let R=PH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[N.role,N.stackId??null,N.stackRevision??null,N.status,JSON.stringify(N.health),N.lastHealthyAt??null,L,E]),PH(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,_){let T=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!T)throw Error("Replication channel was not found.");let R=MH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[N.status,N.checkpoint??null,N.lagSeconds??null,N.lastVerifiedAt??null,L,E]),MH(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,_){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!T)throw Error("Traffic route was not found.");let R=KH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(N.weights),JSON.stringify(N.desiredWeights),N.status,JSON.stringify(N.providerState),L,E]),KH(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[_,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),T,T]),this.execution(_)}execution(E){let _=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return _?TK(_):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(TK)}updateExecution(E,_){let T=this.execution(E);if(!T)throw Error("Regional execution was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[R.operationId??null,R.currentStep??null,JSON.stringify(R.completedSteps),R.status,R.error??null,N,E]),this.execution(E)}}await g_();class DD{store;queue;constructor(E,_){this.store=E;this.queue=_??new pE(E.control)}create(E){return this.store.create(E)}plan(E,_,T){if(!this.store.get(E))throw Error("Regional topology was not found.");let N=this.store.targets(E),L=this.store.channels(E);if(_==="rollout")return[...N.filter((A)=>A.role==="secondary").map((A)=>`apply:${A.region}`),...N.filter((A)=>A.role==="primary").map((A)=>`apply:${A.region}`),...L.map((A)=>`replicate:${A.kind}:${A.targetRegion}`),"traffic:activate"];if(_==="failover"||_==="failback")return[`health:${T}`,`replication:${T}`,`traffic:${T}`,`roles:${T}`];if(_==="destroy")return["traffic:drain",...N.filter((A)=>A.role==="secondary").map((A)=>`delete:${A.region}`),...N.filter((A)=>A.role==="primary").map((A)=>`delete:${A.region}`),"complete"];return["observe","repair"]}enqueue(E){let _=this.store.get(E.topologyId);if(!_)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!_.regions.some((L)=>L.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===_.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==_.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&_.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let T=this.plan(_.id,E.kind,E.targetRegion),R=this.store.createExecution({topologyId:_.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:T}),N=this.queue.enqueue({projectId:_.projectId,environmentId:_.environmentId,kind:`region.${E.kind}`,input:{executionId:R.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${_.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(R.id,{operationId:N.id}),{execution:this.store.execution(R.id),operation:N}}}var Qe=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function RK(E,_){let T=(U)=>{let h=_.find(($)=>$.provider===U.provider);if(!h)throw Error(`No ${U.provider} regional driver is configured.`);return h},R=(U,h,$)=>{U.throwIfCancellationRequested(),U.checkpoint($,$),E.updateExecution(h.id,{status:"running",currentStep:$,completedSteps:[...E.execution(h.id).completedSteps,$]})},N=async(U,h)=>{let $=E.route(U.id);if(!$)throw Error("Regional traffic route was not found.");let D=E.targets(U.id).find((J)=>J.region===U.activeRegion)??E.targets(U.id)[0];if(!D)throw Error("Regional traffic target was not found.");E.updateRoute($.id,{status:"applying",desiredWeights:h});let C=await T(D).applyTraffic({route:E.route(U.id),topology:U,weights:h});E.updateRoute($.id,{status:Object.values(h).every((J)=>J===0)?"drained":"in_sync",weights:h,providerState:C.providerState})},L=async(U,h,$,D)=>{E.updateTopology($.id,{status:"provisioning"});let C=h.revision,J=D.manifest??{},I=E.targets($.id).sort((H,w)=>Number(H.role==="primary")-Number(w.role==="primary"));for(let H of I){R(U,h,`apply:${H.region}`),E.updateTarget(H.id,{status:"provisioning"});let w=await T(H).applyStack({target:H,revision:C,manifest:J,signal:U.signal}),B=await T(H).health({target:E.updateTarget(H.id,{stackId:w.stackId,stackRevision:C})});if(!B.healthy)throw Error(`Regional health gate failed in ${H.region}.`);E.updateTarget(H.id,{status:"ready",health:B.evidence,lastHealthyAt:new Date().toISOString()})}for(let H of E.channels($.id)){R(U,h,`replicate:${H.kind}:${H.targetRegion}`),E.updateChannel(H.id,{status:"configuring"});let w=I.find((K)=>K.region===H.sourceRegion),B=await T(w).configureReplication({channel:H,topology:$}),Q=await T(w).verifyReplication({channel:E.updateChannel(H.id,{checkpoint:B.checkpoint,lagSeconds:B.lagSeconds}),topology:$});if(!Q.healthy||Q.lagSeconds>$.dataPolicy.maxLagSeconds)throw Error(`${H.kind} replication to ${H.targetRegion} exceeds the RPO.`);E.updateChannel(H.id,{status:"in_sync",checkpoint:Q.checkpoint,lagSeconds:Q.lagSeconds,lastVerifiedAt:new Date().toISOString()})}R(U,h,"traffic:activate");let W=Object.fromEntries($.regions.map((H)=>[H.region,H.region===$.activeRegion?100:0]));return await N($,W),E.updateTopology($.id,{status:"ready",revision:C}),{revision:C,activeRegion:$.activeRegion}},A=async(U,h,$)=>{let D=h.requestedRegion,C=E.targets($.id).find((W)=>W.region===D);if(!C)throw Error("Requested regional target was not found.");E.updateTopology($.id,{status:h.kind==="failover"?"failing_over":"failing_back"}),R(U,h,`health:${D}`);let J=await T(C).health({target:C});if(!J.healthy)throw Error(`Target region ${D} is unhealthy.`);E.updateTarget(C.id,{status:"ready",health:J.evidence,lastHealthyAt:new Date().toISOString()}),R(U,h,`replication:${D}`);for(let W of E.channels($.id).filter((H)=>H.targetRegion===D)){let H=await T(C).verifyReplication({channel:W,topology:$});if(!H.healthy||H.lagSeconds>$.dataPolicy.maxLagSeconds)throw Error(`${W.kind} replication is outside the failover RPO.`);E.updateChannel(W.id,{status:"in_sync",checkpoint:H.checkpoint,lagSeconds:H.lagSeconds,lastVerifiedAt:new Date().toISOString()})}R(U,h,`traffic:${D}`),await N($,Object.fromEntries($.regions.map((W)=>[W.region,W.region===D?100:0]))),R(U,h,`roles:${D}`);let I=$.regions.map((W)=>({...W,role:W.region===D?"primary":"secondary"}));for(let W of E.targets($.id))E.updateTarget(W.id,{role:W.region===D?"primary":"secondary"});return E.updateTopology($.id,{status:h.kind==="failover"?"failed_over":"ready",activeRegion:D,regions:I}),{activeRegion:D}},S=async(U,h,$,D)=>{E.updateTopology($.id,{status:"destroying"}),R(U,h,"traffic:drain"),await N($,Object.fromEntries($.regions.map((J)=>[J.region,0])));let C=D.deleteData!==!0;for(let J of E.targets($.id).sort((I,W)=>Number(I.role==="primary")-Number(W.role==="primary")))R(U,h,`delete:${J.region}`),E.updateTarget(J.id,{status:"deleting"}),await T(J).deleteStack({target:J,retainData:C,signal:U.signal}),E.updateTarget(J.id,{status:"deleted"});return R(U,h,"complete"),E.updateTopology($.id,{status:"destroyed"}),{destroyed:!0,dataRetained:C}},O=async(U)=>{let h=Qe(U.operation.input),$=E.execution(String(h.executionId??""));if(!$)throw Error("Regional execution was not found.");let D=E.get($.topologyId);if(!D)throw Error("Regional topology was not found.");try{let C;if($.kind==="rollout")C=await L(U,$,D,h);else if($.kind==="failover"||$.kind==="failback")C=await A(U,$,D);else if($.kind==="destroy")C=await S(U,$,D,h);else throw Error("Regional reconciliation is not configured.");return E.updateExecution($.id,{status:"succeeded",currentStep:void 0}),{executionId:$.id,...C}}catch(C){if(E.updateExecution($.id,{status:U.cancellationRequested()?"cancelled":"failed",error:C instanceof Error?C.message:String(C)}),E.get(D.id)?.status!=="destroyed")E.updateTopology(D.id,{status:"failed"});throw C}};return{"region.rollout":O,"region.failover":O,"region.failback":O,"region.destroy":O,"region.reconcile":O}}class VH{provider;reason;constructor(E,_="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=_}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function Ge(){let E=await o(),_=mE(process.cwd(),E),T=new $D(_.store),R=new DD(T);return{controlPlane:_,store:T,service:R}}async function H0(E){let _=await Ge();try{await E(_)}catch(T){d(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var CD=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!T)throw Error("Regional topology was not found.");return T},Pe=(E)=>E.split(",").map((_,T)=>{let[R,N="aws"]=_.split(":");return{region:String(R),provider:N,role:T===0?"primary":"secondary"}}),Me=(E)=>{let _=new Set(["s3","dynamodb","secrets"]),T=E.split(",").map((N)=>N.trim()),R=T.find((N)=>!_.has(N));if(R)throw Error(`Unsupported replication kind: ${R}`);return T};function ZH(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(_)=>H0((T)=>{let R=T.store.list(T.controlPlane.project.id).map((N)=>({topology:N,targets:T.store.targets(N.id),channels:T.store.channels(N.id),route:T.store.route(N.id),executions:T.store.executions(N.id)}));if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Hostname","Active","Status","Revision","Replication"],R.map((N)=>[N.topology.name,N.topology.hostname,N.topology.activeRegion,N.topology.status,N.topology.revision??"—",`${N.channels.filter((L)=>L.status==="in_sync").length}/${N.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(_,T)=>H0((R)=>{if(!T.hostname||!T.regions)throw Error("--hostname and --regions are required.");let N=R.service.create({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,hostname:T.hostname,regions:Pe(T.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Me(String(T.replicate)),maxLagSeconds:Number(T.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!T.cdn,wafEnabled:!!T.waf});b(`Created ${N.name} (${N.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(_,T,R)=>H0((N)=>p(["Step"],N.service.plan(CD(N,_).id,T,R.target).map((L)=>[L])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(_,T,R)=>H0(async(N)=>{let L=R.manifest?await Bun.file(R.manifest).json():{},A=N.service.enqueue({topologyId:CD(N,_).id,kind:"rollout",revision:T,manifest:L});b(`Regional rollout queued: ${A.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(_,T)=>H0((R)=>{let N=R.service.enqueue({topologyId:CD(R,_).id,kind:"failover",targetRegion:T});b(`Failover queued: ${N.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(_,T)=>H0((R)=>{let N=R.service.enqueue({topologyId:CD(R,_).id,kind:"failback",targetRegion:T});b(`Failback queued: ${N.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(_,T)=>H0((R)=>{let N=R.service.enqueue({topologyId:CD(R,_).id,kind:"destroy",confirmation:T.confirm});b(`Regional teardown queued: ${N.operation.id}; replicated data remains retained.`)}))}kE();var XD="0.7.111";import{createHash as dH,createPublicKey as AK,verify as Ve}from"node:crypto";function JD(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(JD).join(",")}]`;return`{${Object.keys(E).sort().map((_)=>`${JSON.stringify(_)}:${JD(E[_])}`).join(",")}}`}var SK=(E)=>dH("sha256").update(JD(E)).digest("hex"),P2=(E)=>dH("sha256").update(JD(E)).digest("hex"),OK=(E)=>dH("sha256").update(AK(E).export({type:"spki",format:"der"})).digest("hex");function UK(E,_,T){try{return Ve(null,Buffer.from(JD(E)),AK(T),Buffer.from(_,"base64"))}catch{return!1}}var NK=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((_)=>Number(_)||0),LK=(E,_)=>{let T=NK(E),R=NK(_);for(let N=0;N<3;N++){let L=(T[N]??0)-(R[N]??0);if(L)return L}return 0};function hK(E,_){let T=[];if(_.schemaVersion<E.minimumSchema)T.push(`schema ${_.schemaVersion} is below ${E.minimumSchema}`);if(_.schemaVersion>E.maximumSchema)T.push(`schema ${_.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&LK(_.currentVersion,E.minimumVersion)<0)T.push(`platform ${_.currentVersion} is below ${E.minimumVersion}`);if(LK(E.version,_.currentVersion)<=0)T.push(`version ${E.version} is not newer than ${_.currentVersion}`);if(!E.artifacts.some((R)=>R.platform===_.platform&&R.architecture===_.architecture))T.push(`no artifact for ${_.platform}/${_.architecture}`);return{compatible:T.length===0,reasons:T}}var _A=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},KT=(E)=>E==null?void 0:String(E),Ze=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:KT(E.revoked_at),createdAt:String(E.created_at)}),$K=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:_A(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:_A(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),DK=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:_A(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),CK=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:KT(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:_A(E.health_gate,{}),status:String(E.status),currentStage:KT(E.current_stage),backupId:KT(E.backup_id),approvedBy:KT(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),qH=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:KT(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:_A(E.evidence,{}),error:KT(E.error),startedAt:KT(E.started_at),finishedAt:KT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),XK=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:_A(E.criteria,{}),candidates:_A(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:KT(E.confirmation),expiresAt:String(E.expires_at),result:_A(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),JK=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:KT(E.backup_policy_id),recoveryPointId:KT(E.recovery_point_id),topologyId:KT(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:KT(E.operation_id),evidence:_A(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:KT(E.error),startedAt:KT(E.started_at),finishedAt:KT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class ID{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}addTrustedKey(E){let _=this.id(),T=this.now().toISOString(),R=OK(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[_,E.organizationId,E.name,E.publicKeyPem,R,T]),this.key(_)}key(E){let _=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return _?Ze(_):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let _=this.key(E.keyId);if(!_||_.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(_.revokedAt)throw Error("Update signing key is revoked.");if(!UK(E.document,E.signature,_.publicKeyPem))throw Error("Update manifest signature is invalid.");let T=hK(E.document,E.current),R=SK(E.document),N=this.id(),L=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[N,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,R,JSON.stringify(E.document),E.signature,JSON.stringify(T),L]),this.manifest(N)}manifest(E){let _=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return _?$K(_):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map($K)}createWindow(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[_,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,T,T]),this.window(_)}window(E){let _=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return _?DK(_):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(DK)}createCampaign(E){return this.control.transaction(()=>{let _=this.manifest(E.manifestId);if(!_?.compatibility.compatible||_.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let T=this.id(),R=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[T,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,R,R]),E.targets.forEach((N,L)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,N.serverId??null,N.target,E.strategy==="canary"?L===0?0:1+Math.floor((L-1)/E.batchSize):Math.floor(L/E.batchSize),N.previousVersion,R,R])),this.campaign(T)})}campaign(E){let _=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return _?CK(_):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(CK)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(qH)}updateCampaign(E,_){let T=this.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let R={...T,..._};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[R.status,R.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!T)throw Error("Upgrade target was not found.");let R={...qH(T),..._};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[R.status,JSON.stringify(R.evidence),R.error??null,R.startedAt??null,R.finishedAt??null,this.now().toISOString(),E]),qH(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let _=[...E.candidates].sort((A,S)=>A.id.localeCompare(S.id)),T=P2(_),R=this.id(),N=this.now().toISOString(),L=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[R,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(_),T,_.reduce((A,S)=>A+S.bytes,0),L,N,N]),this.cleanup(R)}cleanup(E){let _=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return _?XK(_):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(XK)}updateCleanup(E,_){let T=this.cleanup(E);if(!T)throw Error("Cleanup plan was not found.");let R={...T,..._};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[R.status,R.confirmation??null,JSON.stringify(R.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[_,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,T,T]),this.drill(_)}drill(E){let _=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return _?JK(_):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(JK)}updateDrill(E,_){let T=this.drill(E);if(!T)throw Error("DR drill was not found.");let R={...T,..._};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[R.status,R.operationId??null,JSON.stringify(R.evidence),R.measuredRpoMinutes??null,R.measuredRtoMinutes??null,R.cleanupVerified?1:0,R.error??null,R.startedAt??null,R.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}await g_();function de(E,_=new Date){if(!E.enabled)return!1;let T=new Date(E.schedule);if(!Number.isNaN(T.getTime()))return _>=T&&_.getTime()<=T.getTime()+E.durationMinutes*60000;let R=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!R)return!1;let N=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(_),L=Number(N.find((S)=>S.type==="hour")?.value)*60+Number(N.find((S)=>S.type==="minute")?.value),A=Number(R[1])*60+Number(R[2]);return L>=A&&L<A+E.durationMinutes}class FD{store;now;queue;constructor(E,_,T=()=>new Date){this.store=E;this.now=T;this.queue=_??new pE(E.control)}enqueueCampaign(E,_={}){let T=this.store.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let R=T.windowId?this.store.window(T.windowId):void 0;if(R&&!R.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(R&&!_.overrideWindow&&!de(R,this.now()))throw Error("Upgrade is outside its maintenance window.");if(R?.requireApproval&&!_.approvedBy&&!T.approvedBy)throw Error("Maintenance approval is required.");let N=this.queue.enqueue({projectId:T.projectId,actorId:_.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:N}}async previewCleanup(E,_){let T=_.find((R)=>R.kind===E.kind);if(!T)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await T.discover(E.criteria)})}enqueueCleanup(E,_){let T=this.store.cleanup(E);if(!T||T.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(T.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let R=`DELETE ${T.candidates.length} ${T.kind}`;if(_!==R)throw Error(`Exact confirmation ${R} is required.`);let N=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${T.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:_}),operation:N}}enqueueDrill(E){let _=this.store.drill(E);if(!_||_.status!=="planned")throw Error("A planned DR drill is required.");let T=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${_.scenario}:${_.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:T.id}),operation:T}}}var xH=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function IK(E){return{"maintenance.upgrade":async(N)=>{let L=E.store.campaign(String(xH(N.operation.input).campaignId??""));if(!L||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let A=E.store.manifest(L.manifestId);if(!A?.compatibility.compatible||A.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let S=A.document.artifacts.find((U)=>U.platform===process.platform&&U.architecture===process.arch)??A.document.artifacts[0];if(!S)throw Error("No update artifact matches this platform.");E.store.updateCampaign(L.id,{status:"running",currentStage:"preflight"});let O=[];try{for(let U of[...new Set(E.store.targets(L.id).map((h)=>h.cohort))].sort((h,$)=>h-$)){E.store.updateCampaign(L.id,{currentStage:`cohort:${U}`});for(let h of E.store.targets(L.id).filter(($)=>$.cohort===U)){N.throwIfCancellationRequested(),N.checkpoint(`download:${h.target}`,"Downloading signed platform artifact."),E.store.updateTarget(h.id,{status:"downloading",startedAt:new Date().toISOString()});let $=await E.platform.download({target:h,artifact:S,signal:N.signal});if($.sha256!==S.sha256)throw Error(`Artifact checksum mismatch for ${h.target}.`);N.checkpoint(`install:${h.target}`,"Installing verified artifact."),E.store.updateTarget(h.id,{status:"installing"}),await E.platform.install({target:h,path:$.path,version:A.version,signal:N.signal}),O.push(h);let D=await E.platform.health({target:h,gate:L.healthGate});if(!D.healthy)throw Error(`Upgrade health gate failed for ${h.target}.`);E.store.updateTarget(h.id,{status:"healthy",evidence:D.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(L.id,{status:"succeeded",currentStage:void 0}),{campaignId:L.id,version:A.version,targets:O.length}}catch(U){E.store.updateCampaign(L.id,{status:"rolling_back",currentStage:"rollback"});for(let h of O.reverse())E.store.updateTarget(h.id,{status:"rolling_back"}),await E.platform.rollback({target:h,version:h.previousVersion,signal:N.signal}),E.store.updateTarget(h.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(L.id,{status:"rolled_back",currentStage:void 0}),U}},"maintenance.cleanup":async(N)=>{let L=E.store.cleanup(String(xH(N.operation.input).planId??""));if(!L||L.status!=="approved")throw Error("Approved cleanup plan was not found.");if(P2([...L.candidates].sort((h,$)=>h.id.localeCompare($.id)))!==L.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let A=E.cleanup?.find((h)=>h.kind===L.kind);if(!A)throw Error(`No ${L.kind} cleanup driver is configured.`);E.store.updateCleanup(L.id,{status:"running"});let S=[],O=[];for(let h of L.candidates){N.throwIfCancellationRequested();try{await A.remove(h),S.push(h.id)}catch($){O.push({id:h.id,error:$ instanceof Error?$.message:String($)})}}let U=O.length?S.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(L.id,{status:U,result:{removed:S,failed:O,reclaimedBytes:L.candidates.filter((h)=>S.includes(h.id)).reduce((h,$)=>h+$.bytes,0)}}),O.length)throw Error(`Cleanup failed for ${O.length} candidate(s).`);return{planId:L.id,removed:S.length,reclaimedBytes:L.estimatedBytes}},"maintenance.drill":async(N)=>{let L=E.store.drill(String(xH(N.operation.input).drillId??""));if(!L)throw Error("DR drill was not found.");let A=E.recovery?.find(($)=>$.scenario===L.scenario);if(!A)throw Error(`No ${L.scenario} recovery driver is configured.`);let S=new Date;E.store.updateDrill(L.id,{status:"restoring",startedAt:S.toISOString()});let O=L.isolatedTarget,U={},h={};try{N.checkpoint("restore","Restoring into isolated drill target.");let $=await A.restore({drill:L,signal:N.signal});if(!$.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");O=$.target,U=$.evidence;let D=(S.getTime()-new Date($.recoveryPointAt).getTime())/60000;E.store.updateDrill(L.id,{status:"verifying",measuredRpoMinutes:D,evidence:{restore:U}}),N.checkpoint("verify","Running recovery health checks without production traffic.");let C=await A.verify({drill:L,target:O});h=C.evidence;let J=(Date.now()-S.getTime())/60000;if(!C.healthy||D>L.expectedRpoMinutes||J>L.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(L.id,{measuredRpoMinutes:D,measuredRtoMinutes:J,evidence:{restore:U,verify:h}})}catch($){throw E.store.updateDrill(L.id,{status:"failed",error:$ instanceof Error?$.message:String($),evidence:{restore:U,verify:h}}),$}finally{E.store.updateDrill(L.id,{status:"cleaning"});try{await A.cleanup({drill:L,target:O});let $=E.store.drill(L.id);E.store.updateDrill(L.id,{status:$.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch($){E.store.updateDrill(L.id,{status:"cleanup_required",cleanupVerified:!1,error:$ instanceof Error?$.message:String($),finishedAt:new Date().toISOString()})}}return{drillId:L.id,status:E.store.drill(L.id).status}}}}var FK={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class WD{kind;control;projectId;organizationId;constructor(E,_,T,R){this.kind=E;this.control=_;this.projectId=T;this.organizationId=R}async discover(E){let _=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),T=new Date(Date.now()-_*86400000).toISOString(),R=FK[this.kind],N=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(R.select).all(N,T).map((A)=>({id:String(A.id),kind:this.kind,label:`${this.kind}:${String(A.id)}`,bytes:Number(A.bytes??0),metadata:{createdAt:String(A.created_at)}}))}async remove(E){if(this.control.database.run(FK[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function qe(){let E=await o(),_=mE(process.cwd(),E),T=new ID(_.store),R=new FD(T),N=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new WD(L,_.store,_.project.id,_.organization.id));return{controlPlane:_,store:T,service:R,cleanup:N}}async function TA(E){let _=await qe();try{await E(_)}catch(T){d(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}function yH(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(_)=>TA((T)=>{let R={manifests:T.store.manifests(T.controlPlane.organization.id),windows:T.store.windows(T.controlPlane.project.id),campaigns:T.store.campaigns(T.controlPlane.project.id),cleanups:T.store.cleanups(T.controlPlane.project.id),drills:T.store.drills(T.controlPlane.project.id)},N=[...R.manifests.map((L)=>["update",L.version,L.compatibility.compatible?"compatible":"blocked",L.compatibility.reasons.join("; ")||L.channel]),...R.campaigns.map((L)=>["upgrade",L.id,L.status,L.currentStage??L.fromVersion]),...R.cleanups.map((L)=>["cleanup",L.kind,L.status,`${L.candidates.length} items / ${L.estimatedBytes} bytes`]),...R.drills.map((L)=>["DR drill",L.scenario,L.status,L.isolatedTarget])];if(_.json)console.log(JSON.stringify(R,null,2));else p(["Area","Name / version","Status","Detail"],N)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(_,T)=>TA(async(R)=>{let N=R.store.addTrustedKey({organizationId:R.controlPlane.organization.id,name:_,publicKeyPem:await Bun.file(T).text()});b(`Trusted ${N.name}: ${N.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(_,T,R)=>TA(async(N)=>{let L=await Bun.file(_).json(),A=(await Bun.file(T).text()).trim(),S=N.store.importManifest({organizationId:N.controlPlane.organization.id,keyId:R,document:L,signature:A,current:{schemaVersion:N.controlPlane.store.health().schemaVersion,currentVersion:XD,platform:process.platform,architecture:process.arch}});b(`Verified ${S.version}; ${S.compatibility.compatible?"compatible":"blocked: "+S.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(_,T,R)=>TA((N)=>{let L=N.store.createWindow({projectId:N.controlPlane.project.id,name:_,schedule:T,timezone:R.timezone,durationMinutes:Number(R.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});b(`Created ${L.name} (${L.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(_,T,R)=>TA((N)=>{let L=new CL(N.controlPlane.store).list(N.controlPlane.project.id).filter((O)=>O.status==="ready").map((O)=>({serverId:O.id,target:O.name,previousVersion:O.bootstrapVersion??XD}));if(!L.length)L.push({target:"control-plane",previousVersion:XD});let A=N.store.createCampaign({projectId:N.controlPlane.project.id,manifestId:_,fromVersion:XD,strategy:R.strategy==="rolling"?"rolling":"canary",batchSize:Number(R.batch),healthGate:{kind:"platform"},backupId:T,targets:L}),S=N.service.enqueueCampaign(A.id);b(`Staged upgrade queued: ${S.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(_,T)=>TA(async(R)=>{let N=await R.service.previewCleanup({projectId:R.controlPlane.project.id,kind:_,criteria:{olderThanDays:Number(T.olderThan)}},R.cleanup);p(["ID","Candidate","Bytes"],N.candidates.map((L)=>[L.id,L.label,String(L.bytes)])),X(`Apply with: cloud cleanup:apply ${N.id} --confirm "DELETE ${N.candidates.length} ${N.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(_,T)=>TA((R)=>{let N=R.service.enqueueCleanup(_,String(T.confirm??""));b(`Cleanup queued: ${N.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(_,T,R)=>TA((N)=>{let L=N.store.createDrill({projectId:N.controlPlane.project.id,scenario:_,isolatedTarget:T,expectedRpoMinutes:Number(R.rpo),expectedRtoMinutes:Number(R.rto),recoveryPointId:R.recoveryPoint,topologyId:R.topology});b(`Planned isolated drill ${L.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(_)=>TA((T)=>{let R=T.service.enqueueDrill(_);b(`DR drill queued: ${R.operation.id}`)}))}kE();$S();vR();async function fH(){try{return(await o()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function kH(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(_)=>{r("Lambda Functions");let T=_?.region||await fH(),R=new K_(T);try{let{Functions:N=[]}=await R.listFunctions({MaxItems:50});if(!N.length){X("No functions found");return}p(["Name","Runtime","Memory","Timeout","Last Modified"],N.map((L)=>[L.FunctionName??"-",L.Runtime??"-",L.MemorySize?`${L.MemorySize} MB`:"-",L.Timeout?`${L.Timeout}s`:"-",L.LastModified??"-"]))}catch(N){d(`Failed to list functions: ${N.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(_,T)=>{r(`Invoking ${_}`);let R=T?.region||await fH(),N=new K_(R),L=new l("Invoking function...");L.start();try{let A=await N.invoke({FunctionName:_,InvocationType:T?.async?"Event":"RequestResponse",Payload:T?.payload||"{}",LogType:T?.async?"None":"Tail"});if(A.FunctionError){if(L.fail(`Function returned an error (${A.FunctionError})`),A.Payload)X(A.Payload);process.exitCode=1;return}if(L.succeed(`Invoked (status ${A.StatusCode})`),A.Payload)X(`
 Response:`),X(A.Payload);if(A.LogResult)X(`
 Logs:`),X(Buffer.from(A.LogResult,"base64").toString("utf-8"))}catch(A){L.fail(`Invocation failed: ${A.message}`),process.exitCode=1}}),E.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(_,T)=>{r(`Logs for ${_}`);let R=T?.region||await fH(),N=new wR(R),L=_.startsWith("/aws/lambda/")?_:`/aws/lambda/${_}`,A=Number(T?.since??15),S=(O)=>{for(let U of O){let h=U.timestamp?new Date(U.timestamp).toISOString():"";X(`${h}  ${(U.message??"").trimEnd()}`)}};try{let O=Date.now()-A*60000,{events:U=[]}=await N.filterLogEvents({logGroupName:L,startTime:O,filterPattern:T?.filter,limit:200});if(S(U),U.length)O=(U[U.length-1].timestamp??O)+1;if(T?.tail){X(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise(($)=>setTimeout($,3000));let{events:h=[]}=await N.filterLogEvents({logGroupName:L,startTime:O,filterPattern:T?.filter,limit:200});if(h.length)S(h),O=(h[h.length-1].timestamp??O)+1}}}catch(O){d(`Failed to read logs: ${O.message}`),process.exitCode=1}})}kE();async function zK(E){let _=Bun.spawn(["docker",...E],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[T,R]=await Promise.all([_.exited,new Response(_.stderr).text()]);return{ok:T===0,exitCode:T,command:["docker",...E].join(" "),stderr:R.trim()}}function bH(E){E.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(_)=>{let T=["build","--file",_.file??"Dockerfile","--tag",_.tag??"latest","."];if(_.dryRun){console.log(`docker ${T.join(" ")}`);return}let R=await zK(T);if(_.json)console.log(JSON.stringify(R));if(!R.ok)d(R.stderr||`docker exited ${R.exitCode}`),process.exitCode=R.exitCode;else b(`Built ${_.tag??"latest"}.`)}),E.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(_)=>{if(!_.image){d("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(_.dryRun){console.log(`docker push ${_.image}`);return}let T=await zK(["push",_.image]);if(_.json)console.log(JSON.stringify(T));if(!T.ok)d(T.stderr),process.exitCode=T.exitCode;else b(`Pushed ${_.image}.`)}),E.command("container:deploy","Deploy a container image").action(async()=>ON("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}kE();nL();OL();function gH(E){E.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(_)=>{r("Domains");try{let T=UL(_?.provider),R=gR(_?.provider)?.provider||"unknown",N=new l(`Fetching domains from ${R}...`);N.start();let L=await T.listDomains();if(N.succeed(`Found ${L.length} domain(s)`),L.length===0){X("No domains found in this provider");return}let A=L.map((S)=>[S,"Active","-",R.charAt(0).toUpperCase()+R.slice(1)]);p(["Domain","Status","SSL","Provider"],A)}catch(T){d(`Failed to list domains: ${T instanceof Error?T.message:String(T)}`)}}),E.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(_,T)=>{r(`Adding Domain: ${_}`);try{let R=UL(T?.provider),N=gR(T?.provider)?.provider||"unknown",L=new l(`Checking if ${N} can manage ${_}...`);if(L.start(),await R.canManageDomain(_))L.succeed(`Domain ${_} is already available in ${N}`),X(`