@stacksjs/ts-cloud 0.7.115 → 0.7.116

package/dist/bin/cli.js

@@ -9694,7 +9694,7 @@ Run \`${this.name??"cli"} --help\` for usage.`;qA.stderr.write(`${L}${N}${A}
 `).length-1;this.output.write(KL.move(-999,E*-1))}render(){let E=X9(this._render(this)??"",C9.stdout.columns,{hard:!0,trim:!1});if(E===this._prevFrame)return;if(this.state==="initial")this.output.write(KL.hide);else{let _=Gf(this._prevFrame,E);if(this.restoreCursor(),_&&_?.length===1){let T=_[0];this.output.write(KL.move(0,T)),this.output.write(YF.lines(1));let R=E.split(`
 `);this.output.write(R[T]),this._prevFrame=E,this.output.write(KL.move(0,R.length-T-1));return}if(_&&_?.length>1){let T=_[0];this.output.write(KL.move(0,T)),this.output.write(YF.down());let N=E.split(`
 `).slice(T);this.output.write(N.join(`
-`)),this._prevFrame=E;return}this.output.write(YF.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function df(E,_){if(E===void 0)return 0;if(_.length===0)return 0;let R=_.findIndex((N)=>N.value===E);return R!==-1?R:0}function qf(E,_){return(_.label??String(_.value)).toLowerCase().includes(E.toLowerCase())}function xf(E,_){if(!_)return;if(E)return _;return _[0]}class yf extends KF{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#T="";#R;#_;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return FC.inverse(FC.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[_,...T]=this.userInput.slice(this._cursor);return`${E}${FC.inverse(_)}${T.join("")}`}get options(){if(typeof this.#_==="function")return this.#_();return this.#_}constructor(E){super(E);this.#_=E.options;let _=this.options;this.filteredOptions=[..._],this.multiple=E.multiple===!0,this.#R=E.filter??qf;let T;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)T=E.initialValue;else T=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)T=[this.options[0].value];if(T)for(let R of T){let N=_.findIndex((L)=>L.value===R);if(N!==-1)this.toggleSelected(R),this.#E=N}this.focusedValue=this.options[this.#E]?.value,this.on("key",(R,N)=>this.#N(R,N)),this.on("userInput",(R)=>this.#L(R))}_isActionKey(E,_){return E==="\t"||this.multiple&&this.isNavigating&&_.name==="space"&&E!==void 0&&E!==""}#N(E,_){let T=_.name==="up",R=_.name==="down",N=_.name==="return";if(T||R){if(this.#E=Math.max(0,Math.min(this.#E+(T?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(N)this.value=xf(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(_.name==="tab"||this.isNavigating&&_.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((_)=>_!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#L(E){if(E!==this.#T){this.#T=E;let _=this.options;if(E)this.filteredOptions=_.filter((T)=>this.#R(E,T));else this.filteredOptions=[..._];if(this.#E=df(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class ff extends KF{options;cursor=0;#E;getGroupItems(E){return this.options.filter((_)=>_.group===E)}isGroupSelected(E){let _=this.getGroupItems(E),T=this.value;if(T===void 0)return!1;return _.every((R)=>T.includes(R.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let _=String(E.value),T=this.getGroupItems(_);if(this.isGroupSelected(_))this.value=this.value.filter((R)=>T.findIndex((N)=>N.value===R)===-1);else this.value=[...this.value,...T.map((R)=>R.value)];this.value=Array.from(new Set(this.value))}else{let _=this.value.includes(E.value);this.value=_?this.value.filter((T)=>T!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:_}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(_).flatMap(([T,R])=>[{value:T,group:!0,label:T},...R.map((N)=>({...N,group:T}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:T})=>T===E.cursorAt),this.#E?0:1),this.on("cursor",(T)=>{switch(T){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let R=this.options[this.cursor]?.group===!0;if(!this.#E&&R)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let R=this.options[this.cursor]?.group===!0;if(!this.#E&&R)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var kf=ly();var Z_=(E,_)=>kf?E:_,TAE=Z_("◆","*"),RAE=Z_("■","x"),NAE=Z_("▲","x"),LAE=Z_("◇","o"),AAE=Z_("┌","T"),bf=Z_("│","|"),SAE=Z_("└","—"),OAE=Z_("●",">"),UAE=Z_("○"," "),hAE=Z_("◻","[•]"),$AE=Z_("◼","[+]"),DAE=Z_("◻","[ ]"),CAE=Z_("▪","•"),XAE=Z_("─","-"),JAE=Z_("╮","+"),IAE=Z_("├","+"),FAE=Z_("╯","+"),WAE=Z_("●","•"),zAE=Z_("◆","*"),BAE=Z_("▲","!"),HAE=Z_("■","x");var jAE={light:Z_("─","-"),heavy:Z_("━","="),block:Z_("█","#")};function gf(){return`${FC.gray(bf)}  `}var YAE=gf();var VF="0.7.115";kE();import{existsSync as gF}from"node:fs";import{mkdir as sf,writeFile as d9}from"node:fs/promises";function cF(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(_)=>{if(r("Initializing ts-cloud Project"),gF("cloud.config.ts")){if(!await WE("cloud.config.ts already exists. Overwrite?",!1)){X("Initialization cancelled");return}}let T=_?.name||await X_("Project name","my-app"),R=_?.mode||await BC("Select deployment mode",["serverless","server"]),N=_?.region||await BC("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),L=new l("Creating configuration file...");L.start();let A=`import { defineConfig } from '@ts-cloud/core'
+`)),this._prevFrame=E;return}this.output.write(YF.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function df(E,_){if(E===void 0)return 0;if(_.length===0)return 0;let R=_.findIndex((N)=>N.value===E);return R!==-1?R:0}function qf(E,_){return(_.label??String(_.value)).toLowerCase().includes(E.toLowerCase())}function xf(E,_){if(!_)return;if(E)return _;return _[0]}class yf extends KF{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#T="";#R;#_;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return FC.inverse(FC.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[_,...T]=this.userInput.slice(this._cursor);return`${E}${FC.inverse(_)}${T.join("")}`}get options(){if(typeof this.#_==="function")return this.#_();return this.#_}constructor(E){super(E);this.#_=E.options;let _=this.options;this.filteredOptions=[..._],this.multiple=E.multiple===!0,this.#R=E.filter??qf;let T;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)T=E.initialValue;else T=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)T=[this.options[0].value];if(T)for(let R of T){let N=_.findIndex((L)=>L.value===R);if(N!==-1)this.toggleSelected(R),this.#E=N}this.focusedValue=this.options[this.#E]?.value,this.on("key",(R,N)=>this.#N(R,N)),this.on("userInput",(R)=>this.#L(R))}_isActionKey(E,_){return E==="\t"||this.multiple&&this.isNavigating&&_.name==="space"&&E!==void 0&&E!==""}#N(E,_){let T=_.name==="up",R=_.name==="down",N=_.name==="return";if(T||R){if(this.#E=Math.max(0,Math.min(this.#E+(T?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(N)this.value=xf(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(_.name==="tab"||this.isNavigating&&_.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((_)=>_!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#L(E){if(E!==this.#T){this.#T=E;let _=this.options;if(E)this.filteredOptions=_.filter((T)=>this.#R(E,T));else this.filteredOptions=[..._];if(this.#E=df(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class ff extends KF{options;cursor=0;#E;getGroupItems(E){return this.options.filter((_)=>_.group===E)}isGroupSelected(E){let _=this.getGroupItems(E),T=this.value;if(T===void 0)return!1;return _.every((R)=>T.includes(R.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let _=String(E.value),T=this.getGroupItems(_);if(this.isGroupSelected(_))this.value=this.value.filter((R)=>T.findIndex((N)=>N.value===R)===-1);else this.value=[...this.value,...T.map((R)=>R.value)];this.value=Array.from(new Set(this.value))}else{let _=this.value.includes(E.value);this.value=_?this.value.filter((T)=>T!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:_}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(_).flatMap(([T,R])=>[{value:T,group:!0,label:T},...R.map((N)=>({...N,group:T}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:T})=>T===E.cursorAt),this.#E?0:1),this.on("cursor",(T)=>{switch(T){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let R=this.options[this.cursor]?.group===!0;if(!this.#E&&R)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let R=this.options[this.cursor]?.group===!0;if(!this.#E&&R)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var kf=ly();var Z_=(E,_)=>kf?E:_,TAE=Z_("◆","*"),RAE=Z_("■","x"),NAE=Z_("▲","x"),LAE=Z_("◇","o"),AAE=Z_("┌","T"),bf=Z_("│","|"),SAE=Z_("└","—"),OAE=Z_("●",">"),UAE=Z_("○"," "),hAE=Z_("◻","[•]"),$AE=Z_("◼","[+]"),DAE=Z_("◻","[ ]"),CAE=Z_("▪","•"),XAE=Z_("─","-"),JAE=Z_("╮","+"),IAE=Z_("├","+"),FAE=Z_("╯","+"),WAE=Z_("●","•"),zAE=Z_("◆","*"),BAE=Z_("▲","!"),HAE=Z_("■","x");var jAE={light:Z_("─","-"),heavy:Z_("━","="),block:Z_("█","#")};function gf(){return`${FC.gray(bf)}  `}var YAE=gf();var VF="0.7.116";kE();import{existsSync as gF}from"node:fs";import{mkdir as sf,writeFile as d9}from"node:fs/promises";function cF(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(_)=>{if(r("Initializing ts-cloud Project"),gF("cloud.config.ts")){if(!await WE("cloud.config.ts already exists. Overwrite?",!1)){X("Initialization cancelled");return}}let T=_?.name||await X_("Project name","my-app"),R=_?.mode||await BC("Select deployment mode",["serverless","server"]),N=_?.region||await BC("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),L=new l("Creating configuration file...");L.start();let A=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -10048,7 +10048,7 @@ Resources to create: ${G}`);let K={};for(let d of Object.values(U.Resources||{})
 No changes detected - infrastructure is up to date`);return}if(X(`
 Changes detected:
 `),W.length>0){b(`Resources to add (${W.length}):`);for(let B of W){let G=C[B].Type;X(`  + ${B} (${G})`)}console.log()}if(H.length>0){q(`Resources to remove (${H.length}):`);for(let B of H){let G=D[B].Type;X(`  - ${B} (${G})`)}console.log()}if(w.length>0){_E(`Resources to modify (${w.length}):`);for(let B of w){let G=C[B].Type;X(`  ~ ${B} (${G})`)}console.log()}X("Summary:"),X(`  - Add: ${W.length}`),X(`  - Remove: ${H.length}`),X(`  - Modify: ${w.length}`),X("\nRun `cloud deploy` to apply these changes")}catch(T){q(`Diff failed: ${T.message}`)}})}kE();await sE();CU();o$();function RS(E,_=0){let T=Number(E);return Number.isFinite(T)?T:_}function EH(E){return RS(E)*1024}function dn(E){let _=E?.date?.trim(),T=E?.time?.trim();if(!_||!T)return null;let R=new Date(`${_}T${T}Z`);return Number.isFinite(R.getTime())?R.toISOString():null}function qn(E,_,T){let R;try{R=JSON.parse(E)}catch{return[]}let N=(R?.sysstat?.hosts??[]).flatMap((A)=>A.statistics??[]),L=[];for(let A of N){let S=dn(A.timestamp);if(!S)continue;let O=new Date(S).getTime();if(O<_.getTime()||O>T.getTime())continue;let U=A["cpu-load"]?.find(($)=>$.cpu==="all")??A["cpu-load"]?.[0],h=RS(U?.idle,100);L.push({timestamp:S,cpuUsedPercent:Math.max(0,Math.min(100,100-h)),cpuUserPercent:RS(U?.user),cpuSystemPercent:RS(U?.system),cpuIowaitPercent:RS(U?.iowait),memoryUsedPercent:RS(A.memory?.["memused-percent"]),memoryUsedBytes:EH(A.memory?.memused),memoryAvailableBytes:EH(A.memory?.avail),swapUsedPercent:RS(A.memory?.["swpused-percent"]),swapUsedBytes:EH(A.memory?.swpused)})}return L.sort((A,S)=>A.timestamp.localeCompare(S.timestamp))}function xn(E){return Object.fromEntries(Object.entries(E.time_series??{}).map(([_,T])=>[_,(T.values??[]).map(([R,N])=>({timestamp:new Date(Number(R)*1000).toISOString(),value:RS(N,Number.NaN)})).filter((R)=>Number.isFinite(R.value))]))}function dM(E){return E.length?E.reduce((_,T)=>_+T,0)/E.length:null}function _H(E){return E.length?Math.max(...E):null}function yn(E){return E.length?Math.min(...E):null}async function qM(E){let[_,T]=await Promise.all([E.client.getServerMetrics(E.serverId,{types:["cpu","disk","network"],start:E.from,end:E.to,step:E.step}),UN(E.remote.host,"LC_ALL=C sadf -j -- -u -r -S",E.remote).catch(()=>"")]),R=qn(T,E.from,E.to),N=xn(_),A=(N.cpu??[]).map(($)=>Math.max(0,Math.min(100,$.value/Math.max(1,E.cores)))),S=R.map(($)=>$.cpuUsedPercent),O=A.length?A:S,U=R.map(($)=>$.memoryUsedPercent),h=R.map(($)=>$.swapUsedPercent);return{from:E.from.toISOString(),to:E.to.toISOString(),cores:E.cores,host:R,provider:N,summary:{cpuAveragePercent:dM(O),cpuPeakPercent:_H(O),memoryAveragePercent:dM(U),memoryPeakPercent:_H(U),memoryMinimumAvailableBytes:yn(R.map(($)=>$.memoryAvailableBytes)),swapPeakPercent:_H(h)}}}IH();zH();jH();GH();w2();await n_([XH(),hS()]);await g_();import{createHash as Ie}from"node:crypto";var iM=async(E)=>{let _=Bun.spawn(E,{stdout:"pipe",stderr:"pipe"}),[T,R,N]=await Promise.all([_.exited,new Response(_.stdout).text(),new Response(_.stderr).text()]);return{code:T,stdout:R,stderr:N}};class sM{async scan(E,_){let T=await iM(["ssh-keyscan","-T","10","-p",String(_),"-t","ed25519",E]),R=T.stdout.split(`
-`).find((N)=>N&&!N.startsWith("#"))?.trim().split(/\s+/);if(T.code!==0||!R?.[1]||!R[2])throw Error(`SSH host-key scan failed: ${T.stderr.trim()||"no key returned"}`);return{algorithm:R[1],key:R[2]}}async exec(E,_){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return iM(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,_])}}var Fe=(E)=>`SHA256:${Ie("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,We=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class pL{provider;transport;discoverer;constructor(E,_=new sM,T){this.provider=E;this.transport=_;this.discoverer=T}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let _=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:_.algorithm,hostKeyFingerprint:Fe(_.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let _=await this.transport.exec(E,We);if(_.code!==0)throw Error(`Fleet validation failed: ${_.stderr.trim()||_.code}`);try{return JSON.parse(_.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,_){let T=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${_.length}`);if(T.code!==0)throw Error(`Fleet bootstrap failed: ${T.stderr.trim()||T.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function pM(E,_){return{"fleet.bootstrap":async(T)=>{let R=T.operation.input&&typeof T.operation.input==="object"&&!Array.isArray(T.operation.input)?T.operation.input:{},N=E.get(String(R.serverId??""));if(!N)throw Error("Queued fleet server was not found.");let L=_.find((O)=>O.provider===N.provider);if(!L)throw Error(`No ${N.provider} fleet driver is configured.`);let A=Array.isArray(R.steps)?R.steps.map(String):[];if(T.checkpoint("preflight","Rechecking pinned trust and healthy validation."),N.trustState!=="pinned"||!N.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");T.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let S=await L.bootstrap(N,A);return E.update(N.id,{bootstrapVersion:S.version,status:"ready"}),T.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:N.id,bootstrapVersion:S.version,steps:A.length}}}}var DL=(E)=>E==null?void 0:String(E),z0=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},PH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:DL(E.provider_id),region:DL(E.region),zone:DL(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:DL(E.host_key_algorithm),hostKeyFingerprint:DL(E.host_key_fingerprint),pendingHostKey:DL(E.pending_host_key),roles:z0(E.roles,[]),labels:z0(E.labels,{}),taints:z0(E.taints,[]),capacity:z0(E.capacity,{}),usage:z0(E.usage,{}),capabilities:z0(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:z0(E.validation,void 0),bootstrapVersion:DL(E.bootstrap_version),heartbeatAt:DL(E.heartbeat_at),lastSeenAt:DL(E.last_seen_at),archivedAt:DL(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class CL{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}get(E){let _=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return _?PH(_):void 0}list(E,_=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(PH).filter((T)=>_||T.status!=="archived")}findProvider(E,_,T){let R=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,_,T);return R?PH(R):void 0}create(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,T,T]),this.get(_)}update(E,_){let T=this.get(E);if(!T)throw Error("Server was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[R.name,R.providerId??null,R.region??null,R.zone??null,R.endpoint,R.sshUser,R.sshPort,R.credentialRef,R.hostKeyAlgorithm??null,R.hostKeyFingerprint??null,R.pendingHostKey??null,JSON.stringify(R.roles),JSON.stringify(R.labels),JSON.stringify(R.taints),JSON.stringify(R.capacity),JSON.stringify(R.usage),JSON.stringify(R.capabilities),R.status,R.trustState,JSON.stringify(R.validation??{}),R.bootstrapVersion??null,R.heartbeatAt??null,R.lastSeenAt??null,R.archivedAt??null,N,E]),this.get(E)}}var ze=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class AD{store;drivers;now;queue;constructor(E,_,T,R=()=>new Date){this.store=E;this.drivers=_;this.now=R;this.queue=T??new pE(E.control)}driver(E){let _=this.drivers.find((T)=>T.provider===E);if(!_)throw Error(`No ${E} fleet driver is configured.`);return _}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!ze.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let _=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(_)return this.store.update(_.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let T=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),R=this.driver(E.provider);return this.store.create({...E,resourceId:T.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:R.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let T=await this.driver(_.provider).test(_);if(!T.reachable)return this.store.update(E,{status:"unreachable"});if(_.hostKeyFingerprint&&_.hostKeyFingerprint!==T.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:T.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:T.hostKeyAlgorithm,hostKeyFingerprint:T.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,_){let T=this.store.get(E);if(!T||T.pendingHostKey!==_)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:_,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let _=this.store.get(E);if(!_||_.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let T=await this.driver(_.provider).validate(_),R=[];if(!["x64","arm64","x86_64","aarch64"].includes(T.arch??""))R.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let A of["curl","tar"])if(!T.tools?.[A])R.push({code:`tool.${A}`,severity:"error",message:`${A} is missing.`,remediation:`Install ${A} before bootstrap.`});if(Math.abs(T.timeSkewSeconds??0)>60)R.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!T.dnsOk)R.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let N={valid:!R.some((A)=>A.severity==="error"),facts:T,findings:R,validatedAt:this.now().toISOString(),validatorVersion:"1"},L={cpu:T.cpuCores??0,memoryBytes:T.memoryBytes??0,diskBytes:T.diskBytes??0};return this.store.update(E,{validation:N,capacity:L,status:N.valid?"ready":"degraded"})}bootstrap(E,_=!1){let T=this.store.get(E);if(!T?.validation?.valid)throw Error("A healthy validation report is required.");let R=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!_)return{preview:!0,steps:R};let N=this.queue.enqueue({projectId:T.projectId,resourceId:T.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:R},lockKey:`server:${E}`,providerKey:T.provider}).operation;return{preview:!1,steps:R,operation:N}}heartbeat(E,_){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let R=this.now().toISOString();return this.store.update(E,{usage:_.usage,capabilities:_.capabilities??T.capabilities,heartbeatAt:R,lastSeenAt:R,status:T.status==="draining"||T.status==="drained"?T.status:"ready"})}drain(E,_=!1){return this.store.update(E,{status:_?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,_){let T=this.store.get(E);if(!T||_!==T.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function Be(){let E=await o(),_=mE(process.cwd(),E),T=new CL(_.store),R=new AD(T,[new pL("aws"),new pL("hetzner"),new pL("ssh")]);return{controlPlane:_,store:T,service:R}}async function oL(E){let _=await Be();try{return await E(_)}finally{_.controlPlane.store.close()}}var B0=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!T)throw Error(`Server ${_} was not found.`);return T},$N=(E)=>{q(E instanceof Error?E.message:String(E)),process.exitCode=1};function MH(E,_){let T=Number.parseInt(E??"",10);return Number.isFinite(T)&&T>=0?T:_}function He(E="3h"){let _=E.match(/^(\d+)(m|h)$/);if(!_)throw Error("--range must use minutes or hours, for example 30m or 3h.");let T=Number(_[1])*(_[2]==="h"?3600000:60000);if(T<300000||T>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return T}function SD(E,_="%"){return E==null?"unavailable":`${E.toFixed(1)}${_}`}async function je(E,_){let T=await o();if(T.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",N=B_(T,R),L=await fN(N);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${L.serverName}.`);let A=hU(T),S=new eL({apiToken:$U(A.apiToken,T)}),O=await S.getServer(L.serverId),U=L.publicIp??O.public_net.ipv4?.ip;if(!U)throw Error(`Server ${O.name} has no public IPv4 address.`);let h=new Date,$=new Date(h.getTime()-He(_.range)),D=Math.min(3600,Math.max(60,MH(_.step,60))),C=await qM({client:S,serverId:O.id,cores:Math.max(1,Number(O.server_type.cores)||1),from:$,to:h,step:D,remote:{host:U,user:L.sshUser??A.sshUser,identityFile:A.sshPrivateKeyPath,connectTimeoutSec:15}});if(_.json){console.log(JSON.stringify({schemaVersion:1,server:O.name,result:C},null,2));return}p(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[O.name,`${C.from} to ${C.to}`,`${SD(C.summary.cpuAveragePercent)} / ${SD(C.summary.cpuPeakPercent)}`,`${SD(C.summary.memoryAveragePercent)} / ${SD(C.summary.memoryPeakPercent)}`,C.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(C.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,SD(C.summary.swapPeakPercent)]])}function oM(E){let _=E.targetType.prices?.find((T)=>T.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:_?{hourlyNet:_.price_hourly.net,hourlyGross:_.price_hourly.gross,monthlyNet:_.price_monthly.net,monthlyGross:_.price_monthly.gross}:void 0}}function Ye(E){let _=oM(E);p(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${_.serverName} (${_.serverId})`,_.location,`${_.from} -> ${_.to}`,_.capacityAvailable?"available":"waiting",`${_.target.cores??0} / ${_.target.memoryGb??0} GB / ${_.target.diskGb??0} GB`,_.price?.monthlyGross??_.price?.monthlyNet??"not reported"]])}async function we(E,_,T){let R=await o();if(R.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let N=T.env??process.env.CLOUD_ENV??"production",L=B_(R,N),A=await fN(L),S=hU(R),O=new eL({apiToken:$U(S.apiToken,R)}),h=A&&(E===A.serverName||E===String(A.serverId)||E===A.stackName)?await O.getServer(A.serverId):(await O.listServers()).find((d)=>d.name===E||String(d.id)===E);if(!h)throw Error(`Hetzner server ${E} was not found.`);if(A?.serverId&&A.serverId!==h.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${A.serverId}.`);let $=aL(_),D=T.upgradeDisk!==!1,C=await LD(O,h.id,$,D);if(T.json)console.log(JSON.stringify({schemaVersion:1,plan:oM(C)},null,2));else Ye(C);if(!T.apply){if(!T.json)X(`Preview only. Re-run with --apply --confirm ${h.name} to execute.`);return}if(T.confirm!==h.name)throw Error(`Resize requires --confirm ${h.name}.`);let J=A?.publicIp??h.public_net.ipv4?.ip;if(!J)throw Error(`Server ${h.name} has no public IPv4 address for verification.`);let I={host:J,user:A?.sshUser??S.sshUser,identityFile:S.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},W=await wH(L),H=new Date().toISOString(),w={schemaVersion:1,operationId:W?.targetType===$&&W.serverId===h.id?W.operationId:crypto.randomUUID(),stackName:L,serverId:h.id,serverName:h.name,sourceType:C.currentType.name,targetType:$,upgradeDisk:D,phase:"planning",status:"running",attempts:W?.targetType===$?W.attempts:0,startedAt:W?.targetType===$?W.startedAt:H,updatedAt:H,manifest:W?.targetType===$?W.manifest:void 0};await sL(w);let B=MH(T.pollSeconds,900)*1000,G=MH(T.maxWaitMinutes,0)*60000,K=Date.now();for(;;){let d=await LD(O,h.id,$,D);if(!d.capacityAvailable&&!d.alreadyComplete){if(w={...w,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await sL(w),!T.wait){if(!T.json)X(`${$} has no capacity in ${d.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(G>0&&Date.now()-K>=G)throw Error(`Timed out waiting for ${$} capacity in ${d.location}.`);if(!T.json)X(`Waiting ${Math.round(B/1000)} seconds for ${$} capacity...`);await Bun.sleep(B);continue}let x=await QH(L);try{let g=await(async()=>{try{return w={...w,status:"running",attempts:w.attempts+1,updatedAt:new Date().toISOString()},await sL(w),await WH({client:O,serverId:h.id,targetType:$,upgradeDisk:D,resumeFromOff:w.phase==="shutting-down"||w.phase==="resizing"||w.phase==="powering-on"||w.phase==="verifying",manifest:w.manifest,hooks:{preflight:async()=>{let f=await BH(I);return w={...w,manifest:f,updatedAt:new Date().toISOString()},await sL(w),f},afterBoot:async(f,v,t,TE)=>HH(I,v,t,TE),onPhase:async(f,v)=>{if(w={...w,phase:f,status:f==="waiting-capacity"?"waiting-capacity":f==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await sL(w),!T.json)X(`${f}${v?` ${JSON.stringify(v)}`:""}`)}}})}finally{await x()}})();if(w={...w,status:g.status==="completed"||g.status==="already-complete"?"completed":g.status==="recovered"?"recovered":"waiting-capacity",lastError:g.status==="recovered"?g.error:void 0,updatedAt:new Date().toISOString()},await sL(w),T.json)console.log(JSON.stringify({schemaVersion:1,result:g},null,2));else if(g.status==="completed"||g.status==="already-complete")b(`${h.name} is on ${$} and passed full post-boot verification.`);else if(g.status==="recovered"&&g.retryable&&T.wait){X(`Capacity race recovered safely. Waiting ${Math.round(B/1000)} seconds before retry.`),await Bun.sleep(B);continue}else if(g.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${g.error}`);return}catch(g){throw w={...w,status:"failed",lastError:g instanceof Error?g.message:String(g),updatedAt:new Date().toISOString()},await sL(w),g}}}async function Qe(E,_){let T=await o();if(T.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",N=B_(T,R),L=await fN(N);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${L.serverName}.`);let A=hU(T),S=new eL({apiToken:$U(A.apiToken,T)}),O=await S.getServer(L.serverId),U=L.publicIp??O.public_net.ipv4?.ip;if(!U)throw Error(`Server ${O.name} has no public IPv4 address.`);let h=j2(T);if(_.json)console.log(JSON.stringify({schemaVersion:1,server:O.name,plan:h},null,2));else p(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[O.name,h.firewallPorts.join(","),h.monitoring?"on":"off",h.autoUpdates?"on":"off",`${h.swapGb} GB`,"disabled"]]);if(!_.apply){if(!_.json)X(`Preview only. Re-run with --apply --confirm ${O.name} to execute.`);return}if(_.confirm!==O.name)throw Error(`Optimization requires --confirm ${O.name}.`);let $={host:U,user:L.sshUser??A.sshUser,identityFile:A.sshPrivateKeyPath,connectTimeoutSec:15},D=await zU($),C=D.routeProbes.filter((t)=>!t.ok),J=T.infrastructure?.compute,I=jR(J)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,W=D.failedUnits.filter((t)=>!I.has(t));if(W.length>0)throw Error(`Preflight found failed services: ${W.join(", ")}`);if(C.length>0)throw Error(`Preflight found unhealthy routes: ${C.map((t)=>t.domain).join(", ")}`);let H=jR(J)?[]:Object.values(T.sites??{}).flatMap((t)=>typeof t?.port==="number"&&![80,443].includes(t.port)?[t.port]:[]),w=XU({allowSsh:J?.allowSsh!==!1,sitePorts:H,allowedPorts:J?.firewall?.allowedPorts}),B=(L.firewallId?(await S.listFirewalls()).find((t)=>t.id===L.firewallId):void 0)??(await S.listFirewalls()).find((t)=>t.name===`${T.project.slug}-${R}-app-fw`);if(!B)throw Error(`Managed firewall for ${O.name} was not found.`);let G=await S.setFirewallRules(B.id,w);await Promise.all(G.map((t)=>S.waitForAction(t.id))),await $H(T,$);let[K,d]=await Promise.all([zU($),DH($)]),x=CH(h,d),g=vM(D,K),f=K.routeProbes.filter((t)=>!t.ok);if(g.stoppedServices.length>0)x.push(`services stopped: ${g.stoppedServices.join(", ")}`);if(g.changedRouteFragments.length>0)x.push(`route fragments changed: ${g.changedRouteFragments.join(", ")}`);if(g.missingRouteIds.length>0)x.push(`routes disappeared: ${g.missingRouteIds.join(", ")}`);if(g.changedReleaseLinks.length>0)x.push(`release links changed: ${g.changedReleaseLinks.join(", ")}`);if(g.missingData.length>0)x.push(`databases or volumes disappeared: ${g.missingData.join(", ")}`);if(f.length>0)x.push(`unhealthy routes: ${f.map((t)=>t.domain).join(", ")}`);if(x.length>0)throw Error(`Host optimization verification failed: ${x.join("; ")}`);let v={serverId:O.id,serverName:O.name,services:K.runningServices.length,routes:K.routeIds.length,healthyDomains:K.routeProbes.length,releaseLinks:K.releaseLinks.length,databasesAndVolumes:K.dataCatalog.length,report:d};if(_.json)console.log(JSON.stringify({schemaVersion:1,result:v},null,2));else b(`${O.name} passed full host, rpx route, service, release, and data verification.`)}function KH(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(_,T)=>{try{await oL(async(R)=>{let N=_?[B0(R,_)]:R.store.list(R.controlPlane.project.id),L=N.flatMap((A)=>Object.entries(A.capabilities).map(([S,O])=>({server:A.name,provider:A.provider,action:S,...O})));if(T.json)console.log(JSON.stringify({schemaVersion:1,targets:L},null,2));else p(["Server","Provider","Action","Support","Explanation"],L.map((A)=>[A.server,A.provider,A.action,A.supported?"supported":"unsupported",A.reason??"—"]))})}catch(R){$N(R)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(_,T,R)=>{try{await we(_,T,R)}catch(N){$N(N)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(_,T)=>{try{await Qe(_,T)}catch(R){$N(R)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(_,T)=>{try{await je(_,T)}catch(R){$N(R)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(_)=>{try{await oL(async(T)=>{let R=T.store.list(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],R.map((N)=>[N.name,N.providerId??"—",`${N.provider} / ${N.region??"external"}`,`${N.status} / ${N.trustState}`,N.roles.join(","),`${N.capacity.cpu??0} / ${N.capacity.memoryBytes??0}`,N.heartbeatAt??"never"]))})}catch(T){$N(T)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(_,T)=>{try{await oL(async(R)=>{let N=T.provider;if(!["aws","hetzner","ssh"].includes(N)||!T.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let L=R.service.enroll({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,provider:N,providerId:T.providerId,endpoint:T.endpoint,sshUser:T.user??"deploy",credentialRef:T.credentialRef??"secret://fleet/agent",region:T.region,roles:String(T.roles??"application").split(","),labels:Object.fromEntries(String(T.labels??"").split(",").map((A)=>A.split("=")).filter((A)=>A[0]&&A[1]))});b(`Enrolled ${L.name} as ${L.id}; no remote mutation was performed.`)})}catch(R){$N(R)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(_,T)=>{try{await oL(async(R)=>{let N=B0(R,_);if(N=await R.service.test(N.id),N.trustState==="rotation_pending"){if(!T.acceptHostKey)throw Error(`Host key changed to ${N.pendingHostKey}; review it first.`);N=R.service.reviewHostKey(N.id,T.acceptHostKey)}let L=await R.service.validate(N.id);if(T.json)console.log(JSON.stringify(L.validation,null,2));else p(["Severity","Code","Finding","Remediation"],(L.validation?.findings??[]).map((A)=>[A.severity,A.code,A.message,A.remediation??"—"]));if(!L.validation?.valid)process.exitCode=1})}catch(R){$N(R)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(_,T)=>{try{await oL(async(R)=>{let N=R.service.bootstrap(B0(R,_).id,!!T.apply);if(N.preview)p(["Step"],N.steps.map((L)=>[L]));else b(`Bootstrap queued: ${N.operation?.id}`)})}catch(R){$N(R)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(_,T)=>{try{await oL(async(R)=>b(R.service.drain(B0(R,_).id,!!T.complete).status))}catch(R){$N(R)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(_)=>{try{await oL(async(T)=>{T.service.uncordon(B0(T,_).id),b(`Uncordoned ${_}.`)})}catch(T){$N(T)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(_,T)=>{try{await oL(async(R)=>{R.service.archive(B0(R,_).id,T.confirm??""),b(`Archived ${_}; provider infrastructure was not terminated.`)})}catch(R){$N(R)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(_)=>{try{await oL(async(T)=>{let R=B0(T,_);if(R.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let N=Bun.spawn(["ssh","-p",String(R.sshPort),"-o","StrictHostKeyChecking=yes",`${R.sshUser}@${R.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),L=await N.exited;if(L)process.exitCode=L})}catch(T){$N(T)}});for(let[_,T]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(_,T).action(async(...R)=>ON(_.split(" ")[0],{target:String(R[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}kE();var kN=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},YR=(E)=>E==null?void 0:String(E),T4=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),HU=(E={})=>({...T4(),...E});function E4(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:YR(E.region),architecture:YR(E.architecture),labels:kN(E.labels,{}),requiredServerLabels:kN(E.required_server_labels,{}),toleratedTaints:kN(E.tolerated_taints,[]),capacity:HU(kN(E.capacity,{})),reserved:kN(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:YR(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function _4(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:YR(E.environment_id),resourceId:String(E.resource_id),releaseId:YR(E.release_id),poolId:String(E.pool_id),serverId:YR(E.server_id),purpose:String(E.purpose),requirements:kN(E.requirements,{}),decision:kN(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Ge(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:YR(E.resource_id),poolId:String(E.pool_id),placementId:YR(E.placement_id),operationId:YR(E.operation_id),sourceSha:String(E.source_sha),buildSpec:kN(E.build_spec,{}),credentialPolicy:kN(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:YR(E.workspace),cacheKey:YR(E.cache_key),artifactUri:YR(E.artifact_uri),artifactDigest:YR(E.artifact_digest),status:String(E.status),cleanupAt:YR(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class OD{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}createPool(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(HU(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,T,T]),this.getPool(_)}getPool(E){let _=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return _?E4(_):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(E4)}updatePool(E,_){let T=this.getPool(E);if(!T)throw Error("Capacity pool was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[R.status,JSON.stringify(R.reserved),JSON.stringify(R.capacity),R.concurrency,N,E]),this.getPool(E)}addMember(E,_,T={}){let R=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,_,JSON.stringify(T),R,R])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((_)=>({serverId:String(_.server_id),status:String(_.status),capacityOverride:kN(_.capacity_override,{})}))}memberStatus(E,_,T){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[T,this.now().toISOString(),E,_])}listPlacements(E,_){let T=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(_4);return _?.length?T.filter((R)=>_.includes(R.status)):T}getPlacement(E){let _=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return _?_4(_):void 0}activeUsage(E,_){let T=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),R=_?T.filter((N)=>String(N.server_id)===_):T;return{resources:R.reduce((N,L)=>{let A=HU(kN(L.resources,{}));for(let S of Object.keys(N))N[S]+=A[S];return N},T4()),count:R.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let _=this.id(),T=this.id(),R=this.now().toISOString(),N=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[_,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,R,R]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[T,_,E.decision.poolId,E.decision.serverId??null,JSON.stringify(HU(E.requirements.resources)),N,R,R]),this.getPlacement(_)})}transitionPlacement(E,_){if(!this.getPlacement(E))throw Error("Placement was not found.");let R=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[_,R,E]),["released","failed","blocked"].includes(_))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[R,E]);return this.getPlacement(E)}createBuild(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[_,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),T,T]),this.getBuild(_)}getBuild(E){let _=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return _?Ge(_):void 0}updateBuild(E,_){let T=this.getBuild(E);if(!T)throw Error("Remote build was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[R.operationId??null,R.workspace??null,R.cacheKey??null,R.artifactUri??null,R.artifactDigest??null,R.status,R.cleanupAt??null,N,E]),this.getBuild(E)}}var G2=["cpu","memoryBytes","diskBytes","gpu"],R4=(E,_={})=>Object.entries(_).every(([T,R])=>E[T]===R),Pe=(E,_,T)=>Object.fromEntries(G2.map((R)=>[R,Math.max(0,E[R]-_[R]-(T[R]??0))])),Me=(E,_)=>G2.every((T)=>E[T]>=(_[T]??0)),Ke=(E,_)=>G2.reduce((T,R)=>T+(_[R]??0)/(E[R]||1),0);class UD{store;fleet;constructor(E,_){this.store=E;this.fleet=_}poolCandidates(E,_,T){let R=[];for(let N of this.store.listPools(E)){if(N.id===T)continue;let L=[];if(N.status!=="active")L.push(`pool is ${N.status}`);if(N.purpose!==_.purpose)L.push(`purpose is ${N.purpose}`);if(_.region&&N.region!==_.region)L.push(`region is ${N.region??"unset"}`);if(_.architecture&&N.architecture!==_.architecture)L.push(`architecture is ${N.architecture??"unset"}`);if(!R4(N.labels,_.labels))L.push("pool labels do not match");if(N.backend==="server"){let A=this.store.members(N.id);if(!A.length)R.push(this.decision(N,void 0,_,[...L,"pool has no servers"]));for(let S of A){let O=this.fleet.get(S.serverId),U=[...L];if(!O)U.push("server is missing");else this.serverReasons(N,O,S.status,_,U);R.push(this.decision(N,O,_,U,S.capacityOverride))}}else R.push(this.decision(N,void 0,_,L))}return R.sort((N,L)=>Number(L.eligible)-Number(N.eligible)||N.score.cost-L.score.cost||N.score.spread-L.score.spread||N.score.fit-L.score.fit||N.poolName.localeCompare(L.poolName)||(N.serverId??"").localeCompare(L.serverId??""))}serverReasons(E,_,T,R,N){if(T!=="active")N.push(`member is ${T}`);if(_.status!=="ready")N.push(`server is ${_.status}`);if(!_.roles.includes(R.purpose==="build"?"build":R.purpose))N.push(`server lacks ${R.purpose} role`);if(!R4(_.labels,E.requiredServerLabels))N.push("server labels do not match pool selector");for(let L of _.taints)if(!E.toleratedTaints.includes(L))N.push(`taint ${L} is not tolerated`)}decision(E,_,T,R,N={}){let L=HU({..._?.capacity,...N}),A=_?Object.fromEntries(G2.map((U)=>[U,Math.min(E.capacity[U],L[U])])):E.capacity,S=this.store.activeUsage(E.id,_?.id),O=Pe(A,S.resources,E.reserved);if(S.count>=E.maxWorkloads)R.push("workload limit reached");if(T.purpose==="build"&&S.count>=E.concurrency)R.push("build concurrency reached");if(!Me(O,T.resources))R.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:_?.id,eligible:R.length===0,reasons:R,available:O,score:{fit:Ke(O,T.resources),spread:S.count,cost:E.costWeight}}}explain(E,_){return this.poolCandidates(E,_)}place(E){return this.store.control.transaction(()=>{let _=this.poolCandidates(E.projectId,E.requirements).find((T)=>T.eligible);if(!_)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((T)=>T.reasons).join("; ")}`);return this.store.reserve({...E,decision:_})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let _=this.store.updatePool(E,{status:"draining"}),T=[],R=[];for(let N of this.store.listPlacements(_.projectId,["reserved","active"]).filter((L)=>L.poolId===E)){if(N.stateful){R.push(this.store.transitionPlacement(N.id,"blocked"));continue}this.store.transitionPlacement(N.id,"moving");let L=this.place({projectId:N.projectId,environmentId:N.environmentId,resourceId:N.resourceId,releaseId:N.releaseId,requirements:N.requirements});T.push(this.activate(L.id)),this.store.transitionPlacement(N.id,"released")}return{pool:_,moved:T,blocked:R}}drainServer(E,_){this.store.memberStatus(E,_,"draining");let T=this.store.getPool(E);if(!T)throw Error("Capacity pool was not found.");let R=[],N=[];for(let L of this.store.listPlacements(T.projectId,["reserved","active"]).filter((A)=>A.poolId===E&&A.serverId===_)){if(L.stateful){N.push(this.store.transitionPlacement(L.id,"blocked"));continue}this.store.transitionPlacement(L.id,"moving");let A=this.poolCandidates(L.projectId,L.requirements).find((O)=>O.eligible);if(!A){N.push(this.store.transitionPlacement(L.id,"blocked"));continue}let S=this.store.reserve({projectId:L.projectId,environmentId:L.environmentId,resourceId:L.resourceId,releaseId:L.releaseId,requirements:L.requirements,decision:A});R.push(this.activate(S.id)),this.store.transitionPlacement(L.id,"released")}return{moved:R,blocked:N}}reconcileFailure(E){let _=this.fleet.get(E);if(!_)throw Error("Server was not found.");let T=[],R=[];for(let N of this.store.listPlacements(_.projectId,["active"]).filter((L)=>L.serverId===E)){if(N.stateful||!N.autoReschedule){R.push(this.store.transitionPlacement(N.id,"blocked"));continue}this.store.transitionPlacement(N.id,"failed");let L=this.place({projectId:N.projectId,environmentId:N.environmentId,resourceId:N.resourceId,releaseId:N.releaseId,requirements:N.requirements});T.push(this.activate(L.id))}return{rescheduled:T,blocked:R}}}await g_();async function Ve(){let E=await o(),_=mE(process.cwd(),E),T=new OD(_.store),R=new UD(T,new CL(_.store));return{controlPlane:_,store:T,service:R}}async function hD(E){let _=await Ve();try{await E(_)}catch(T){q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var P2=(E)=>Object.fromEntries(String(E??"").split(",").map((_)=>_.split("=")).filter((_)=>_[0]&&_[1])),N4=(E)=>Object.fromEntries(Object.entries(P2(E)).map(([_,T])=>[_,Number(T)]));function VH(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(_)=>hD((T)=>{let R=T.store.listPools(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],R.map((N)=>[N.name,N.purpose,N.backend,`${N.region??"any"} / ${N.architecture??"any"}`,N.status,JSON.stringify(N.capacity),String(N.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(_,T)=>hD((R)=>{let{purpose:N,backend:L}=T;if(!["application","build","worker","monitoring","backup"].includes(N)||!["server","ecs","asg"].includes(L))throw Error("Unsupported pool purpose or backend.");let A=R.store.createPool({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,purpose:N,backend:L,region:T.region,architecture:T.arch,labels:P2(T.labels),requiredServerLabels:P2(T.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...N4(T.capacity)},maxWorkloads:Number(T.max),costWeight:1,concurrency:Number(T.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});b(`Created ${A.name} (${A.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(_,T)=>hD((R)=>{let N=R.store.listPools(R.controlPlane.project.id).find((A)=>A.id===_||A.name===_),L=new CL(R.controlPlane.store).list(R.controlPlane.project.id).find((A)=>A.id===T||A.name===T);if(!N||!L)throw Error("Pool or server was not found.");R.store.addMember(N.id,L.id),b(`Attached ${L.name} to ${N.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(_)=>hD((T)=>{let R=T.service.explain(T.controlPlane.project.id,{purpose:_.purpose,resources:N4(_.resources),region:_.region,architecture:_.arch,labels:P2(_.labels)});if(_.json)console.log(JSON.stringify(R,null,2));else p(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],R.map((N)=>[N.poolName,N.serverId??"provider-managed",N.eligible?"yes":"no",JSON.stringify(N.available),`${N.score.fit.toFixed(2)} / ${N.score.spread} / ${N.score.cost}`,N.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(_)=>hD((T)=>{let R=T.store.listPools(T.controlPlane.project.id).find((L)=>L.id===_||L.name===_);if(!R)throw Error("Pool was not found.");let N=T.service.drainPool(R.id);b(`Draining ${R.name}: moved ${N.moved.length}, blocked ${N.blocked.length} stateful placement(s).`)}))}kE();var EA=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},DN=(E)=>E==null?void 0:String(E),L4=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:DN(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:EA(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:EA(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:DN(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),ZH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:DN(E.stack_id),stackRevision:DN(E.stack_revision),status:String(E.status),health:EA(E.health,{}),lastHealthyAt:DN(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),dH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:EA(E.config,{}),status:String(E.status),checkpoint:DN(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:DN(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),qH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:EA(E.weights,{}),desiredWeights:EA(E.desired_weights,{}),status:String(E.status),providerState:EA(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),A4=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:DN(E.operation_id),kind:String(E.kind),requestedRegion:DN(E.requested_region),revision:DN(E.revision),plan:EA(E.plan,[]),currentStep:DN(E.current_step),completedSteps:EA(E.completed_steps,[]),status:String(E.status),error:DN(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class $D{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((L)=>L.region)).size!==E.regions.length||E.regions.filter((L)=>L.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let _=E.regions.find((L)=>L.role==="primary"),T=this.id(),R=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[T,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,_.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),_.region,R,R]);for(let L of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),T,L.region,L.role,L.provider,R,R]);for(let L of E.dataPolicy.replicate)for(let A of E.regions)for(let S of E.regions.filter((O)=>O.region!==A.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,L,A.region,S.region,"{}",R,R]);let N=Object.fromEntries(E.regions.map((L)=>[L.region,L.region===_.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),T,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(N),JSON.stringify(N),R,R]),this.get(T)})}get(E){let _=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return _?L4(_):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(L4)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(ZH)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(dH)}route(E){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return _?qH(_):void 0}updateTopology(E,_){let T=this.get(E);if(!T)throw Error("Regional topology was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[R.status,R.activeRegion,R.revision??null,JSON.stringify(R.regions),N,E]),this.get(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!T)throw Error("Regional target was not found.");let R=ZH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[N.role,N.stackId??null,N.stackRevision??null,N.status,JSON.stringify(N.health),N.lastHealthyAt??null,L,E]),ZH(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,_){let T=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!T)throw Error("Replication channel was not found.");let R=dH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[N.status,N.checkpoint??null,N.lagSeconds??null,N.lastVerifiedAt??null,L,E]),dH(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,_){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!T)throw Error("Traffic route was not found.");let R=qH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(N.weights),JSON.stringify(N.desiredWeights),N.status,JSON.stringify(N.providerState),L,E]),qH(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[_,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),T,T]),this.execution(_)}execution(E){let _=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return _?A4(_):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(A4)}updateExecution(E,_){let T=this.execution(E);if(!T)throw Error("Regional execution was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[R.operationId??null,R.currentStep??null,JSON.stringify(R.completedSteps),R.status,R.error??null,N,E]),this.execution(E)}}await g_();class DD{store;queue;constructor(E,_){this.store=E;this.queue=_??new pE(E.control)}create(E){return this.store.create(E)}plan(E,_,T){if(!this.store.get(E))throw Error("Regional topology was not found.");let N=this.store.targets(E),L=this.store.channels(E);if(_==="rollout")return[...N.filter((A)=>A.role==="secondary").map((A)=>`apply:${A.region}`),...N.filter((A)=>A.role==="primary").map((A)=>`apply:${A.region}`),...L.map((A)=>`replicate:${A.kind}:${A.targetRegion}`),"traffic:activate"];if(_==="failover"||_==="failback")return[`health:${T}`,`replication:${T}`,`traffic:${T}`,`roles:${T}`];if(_==="destroy")return["traffic:drain",...N.filter((A)=>A.role==="secondary").map((A)=>`delete:${A.region}`),...N.filter((A)=>A.role==="primary").map((A)=>`delete:${A.region}`),"complete"];return["observe","repair"]}enqueue(E){let _=this.store.get(E.topologyId);if(!_)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!_.regions.some((L)=>L.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===_.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==_.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&_.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let T=this.plan(_.id,E.kind,E.targetRegion),R=this.store.createExecution({topologyId:_.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:T}),N=this.queue.enqueue({projectId:_.projectId,environmentId:_.environmentId,kind:`region.${E.kind}`,input:{executionId:R.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${_.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(R.id,{operationId:N.id}),{execution:this.store.execution(R.id),operation:N}}}var Ze=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function S4(E,_){let T=(U)=>{let h=_.find(($)=>$.provider===U.provider);if(!h)throw Error(`No ${U.provider} regional driver is configured.`);return h},R=(U,h,$)=>{U.throwIfCancellationRequested(),U.checkpoint($,$),E.updateExecution(h.id,{status:"running",currentStep:$,completedSteps:[...E.execution(h.id).completedSteps,$]})},N=async(U,h)=>{let $=E.route(U.id);if(!$)throw Error("Regional traffic route was not found.");let D=E.targets(U.id).find((J)=>J.region===U.activeRegion)??E.targets(U.id)[0];if(!D)throw Error("Regional traffic target was not found.");E.updateRoute($.id,{status:"applying",desiredWeights:h});let C=await T(D).applyTraffic({route:E.route(U.id),topology:U,weights:h});E.updateRoute($.id,{status:Object.values(h).every((J)=>J===0)?"drained":"in_sync",weights:h,providerState:C.providerState})},L=async(U,h,$,D)=>{E.updateTopology($.id,{status:"provisioning"});let C=h.revision,J=D.manifest??{},I=E.targets($.id).sort((H,w)=>Number(H.role==="primary")-Number(w.role==="primary"));for(let H of I){R(U,h,`apply:${H.region}`),E.updateTarget(H.id,{status:"provisioning"});let w=await T(H).applyStack({target:H,revision:C,manifest:J,signal:U.signal}),B=await T(H).health({target:E.updateTarget(H.id,{stackId:w.stackId,stackRevision:C})});if(!B.healthy)throw Error(`Regional health gate failed in ${H.region}.`);E.updateTarget(H.id,{status:"ready",health:B.evidence,lastHealthyAt:new Date().toISOString()})}for(let H of E.channels($.id)){R(U,h,`replicate:${H.kind}:${H.targetRegion}`),E.updateChannel(H.id,{status:"configuring"});let w=I.find((K)=>K.region===H.sourceRegion),B=await T(w).configureReplication({channel:H,topology:$}),G=await T(w).verifyReplication({channel:E.updateChannel(H.id,{checkpoint:B.checkpoint,lagSeconds:B.lagSeconds}),topology:$});if(!G.healthy||G.lagSeconds>$.dataPolicy.maxLagSeconds)throw Error(`${H.kind} replication to ${H.targetRegion} exceeds the RPO.`);E.updateChannel(H.id,{status:"in_sync",checkpoint:G.checkpoint,lagSeconds:G.lagSeconds,lastVerifiedAt:new Date().toISOString()})}R(U,h,"traffic:activate");let W=Object.fromEntries($.regions.map((H)=>[H.region,H.region===$.activeRegion?100:0]));return await N($,W),E.updateTopology($.id,{status:"ready",revision:C}),{revision:C,activeRegion:$.activeRegion}},A=async(U,h,$)=>{let D=h.requestedRegion,C=E.targets($.id).find((W)=>W.region===D);if(!C)throw Error("Requested regional target was not found.");E.updateTopology($.id,{status:h.kind==="failover"?"failing_over":"failing_back"}),R(U,h,`health:${D}`);let J=await T(C).health({target:C});if(!J.healthy)throw Error(`Target region ${D} is unhealthy.`);E.updateTarget(C.id,{status:"ready",health:J.evidence,lastHealthyAt:new Date().toISOString()}),R(U,h,`replication:${D}`);for(let W of E.channels($.id).filter((H)=>H.targetRegion===D)){let H=await T(C).verifyReplication({channel:W,topology:$});if(!H.healthy||H.lagSeconds>$.dataPolicy.maxLagSeconds)throw Error(`${W.kind} replication is outside the failover RPO.`);E.updateChannel(W.id,{status:"in_sync",checkpoint:H.checkpoint,lagSeconds:H.lagSeconds,lastVerifiedAt:new Date().toISOString()})}R(U,h,`traffic:${D}`),await N($,Object.fromEntries($.regions.map((W)=>[W.region,W.region===D?100:0]))),R(U,h,`roles:${D}`);let I=$.regions.map((W)=>({...W,role:W.region===D?"primary":"secondary"}));for(let W of E.targets($.id))E.updateTarget(W.id,{role:W.region===D?"primary":"secondary"});return E.updateTopology($.id,{status:h.kind==="failover"?"failed_over":"ready",activeRegion:D,regions:I}),{activeRegion:D}},S=async(U,h,$,D)=>{E.updateTopology($.id,{status:"destroying"}),R(U,h,"traffic:drain"),await N($,Object.fromEntries($.regions.map((J)=>[J.region,0])));let C=D.deleteData!==!0;for(let J of E.targets($.id).sort((I,W)=>Number(I.role==="primary")-Number(W.role==="primary")))R(U,h,`delete:${J.region}`),E.updateTarget(J.id,{status:"deleting"}),await T(J).deleteStack({target:J,retainData:C,signal:U.signal}),E.updateTarget(J.id,{status:"deleted"});return R(U,h,"complete"),E.updateTopology($.id,{status:"destroyed"}),{destroyed:!0,dataRetained:C}},O=async(U)=>{let h=Ze(U.operation.input),$=E.execution(String(h.executionId??""));if(!$)throw Error("Regional execution was not found.");let D=E.get($.topologyId);if(!D)throw Error("Regional topology was not found.");try{let C;if($.kind==="rollout")C=await L(U,$,D,h);else if($.kind==="failover"||$.kind==="failback")C=await A(U,$,D);else if($.kind==="destroy")C=await S(U,$,D,h);else throw Error("Regional reconciliation is not configured.");return E.updateExecution($.id,{status:"succeeded",currentStep:void 0}),{executionId:$.id,...C}}catch(C){if(E.updateExecution($.id,{status:U.cancellationRequested()?"cancelled":"failed",error:C instanceof Error?C.message:String(C)}),E.get(D.id)?.status!=="destroyed")E.updateTopology(D.id,{status:"failed"});throw C}};return{"region.rollout":O,"region.failover":O,"region.failback":O,"region.destroy":O,"region.reconcile":O}}class xH{provider;reason;constructor(E,_="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=_}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function de(){let E=await o(),_=mE(process.cwd(),E),T=new $D(_.store),R=new DD(T);return{controlPlane:_,store:T,service:R}}async function H0(E){let _=await de();try{await E(_)}catch(T){q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var CD=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!T)throw Error("Regional topology was not found.");return T},qe=(E)=>E.split(",").map((_,T)=>{let[R,N="aws"]=_.split(":");return{region:String(R),provider:N,role:T===0?"primary":"secondary"}}),xe=(E)=>{let _=new Set(["s3","dynamodb","secrets"]),T=E.split(",").map((N)=>N.trim()),R=T.find((N)=>!_.has(N));if(R)throw Error(`Unsupported replication kind: ${R}`);return T};function yH(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(_)=>H0((T)=>{let R=T.store.list(T.controlPlane.project.id).map((N)=>({topology:N,targets:T.store.targets(N.id),channels:T.store.channels(N.id),route:T.store.route(N.id),executions:T.store.executions(N.id)}));if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Hostname","Active","Status","Revision","Replication"],R.map((N)=>[N.topology.name,N.topology.hostname,N.topology.activeRegion,N.topology.status,N.topology.revision??"—",`${N.channels.filter((L)=>L.status==="in_sync").length}/${N.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(_,T)=>H0((R)=>{if(!T.hostname||!T.regions)throw Error("--hostname and --regions are required.");let N=R.service.create({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,hostname:T.hostname,regions:qe(T.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:xe(String(T.replicate)),maxLagSeconds:Number(T.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!T.cdn,wafEnabled:!!T.waf});b(`Created ${N.name} (${N.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(_,T,R)=>H0((N)=>p(["Step"],N.service.plan(CD(N,_).id,T,R.target).map((L)=>[L])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(_,T,R)=>H0(async(N)=>{let L=R.manifest?await Bun.file(R.manifest).json():{},A=N.service.enqueue({topologyId:CD(N,_).id,kind:"rollout",revision:T,manifest:L});b(`Regional rollout queued: ${A.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(_,T)=>H0((R)=>{let N=R.service.enqueue({topologyId:CD(R,_).id,kind:"failover",targetRegion:T});b(`Failover queued: ${N.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(_,T)=>H0((R)=>{let N=R.service.enqueue({topologyId:CD(R,_).id,kind:"failback",targetRegion:T});b(`Failback queued: ${N.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(_,T)=>H0((R)=>{let N=R.service.enqueue({topologyId:CD(R,_).id,kind:"destroy",confirmation:T.confirm});b(`Regional teardown queued: ${N.operation.id}; replicated data remains retained.`)}))}kE();var XD="0.7.115";import{createHash as fH,createPublicKey as h4,verify as fe}from"node:crypto";function JD(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(JD).join(",")}]`;return`{${Object.keys(E).sort().map((_)=>`${JSON.stringify(_)}:${JD(E[_])}`).join(",")}}`}var $4=(E)=>fH("sha256").update(JD(E)).digest("hex"),M2=(E)=>fH("sha256").update(JD(E)).digest("hex"),D4=(E)=>fH("sha256").update(h4(E).export({type:"spki",format:"der"})).digest("hex");function C4(E,_,T){try{return fe(null,Buffer.from(JD(E)),h4(T),Buffer.from(_,"base64"))}catch{return!1}}var O4=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((_)=>Number(_)||0),U4=(E,_)=>{let T=O4(E),R=O4(_);for(let N=0;N<3;N++){let L=(T[N]??0)-(R[N]??0);if(L)return L}return 0};function X4(E,_){let T=[];if(_.schemaVersion<E.minimumSchema)T.push(`schema ${_.schemaVersion} is below ${E.minimumSchema}`);if(_.schemaVersion>E.maximumSchema)T.push(`schema ${_.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&U4(_.currentVersion,E.minimumVersion)<0)T.push(`platform ${_.currentVersion} is below ${E.minimumVersion}`);if(U4(E.version,_.currentVersion)<=0)T.push(`version ${E.version} is not newer than ${_.currentVersion}`);if(!E.artifacts.some((R)=>R.platform===_.platform&&R.architecture===_.architecture))T.push(`no artifact for ${_.platform}/${_.architecture}`);return{compatible:T.length===0,reasons:T}}var _A=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},VT=(E)=>E==null?void 0:String(E),ke=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:VT(E.revoked_at),createdAt:String(E.created_at)}),J4=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:_A(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:_A(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),I4=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:_A(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),F4=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:VT(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:_A(E.health_gate,{}),status:String(E.status),currentStage:VT(E.current_stage),backupId:VT(E.backup_id),approvedBy:VT(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),kH=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:VT(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:_A(E.evidence,{}),error:VT(E.error),startedAt:VT(E.started_at),finishedAt:VT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),W4=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:_A(E.criteria,{}),candidates:_A(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:VT(E.confirmation),expiresAt:String(E.expires_at),result:_A(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),z4=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:VT(E.backup_policy_id),recoveryPointId:VT(E.recovery_point_id),topologyId:VT(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:VT(E.operation_id),evidence:_A(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:VT(E.error),startedAt:VT(E.started_at),finishedAt:VT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class ID{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}addTrustedKey(E){let _=this.id(),T=this.now().toISOString(),R=D4(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[_,E.organizationId,E.name,E.publicKeyPem,R,T]),this.key(_)}key(E){let _=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return _?ke(_):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let _=this.key(E.keyId);if(!_||_.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(_.revokedAt)throw Error("Update signing key is revoked.");if(!C4(E.document,E.signature,_.publicKeyPem))throw Error("Update manifest signature is invalid.");let T=X4(E.document,E.current),R=$4(E.document),N=this.id(),L=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[N,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,R,JSON.stringify(E.document),E.signature,JSON.stringify(T),L]),this.manifest(N)}manifest(E){let _=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return _?J4(_):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(J4)}createWindow(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[_,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,T,T]),this.window(_)}window(E){let _=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return _?I4(_):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(I4)}createCampaign(E){return this.control.transaction(()=>{let _=this.manifest(E.manifestId);if(!_?.compatibility.compatible||_.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let T=this.id(),R=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[T,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,R,R]),E.targets.forEach((N,L)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,N.serverId??null,N.target,E.strategy==="canary"?L===0?0:1+Math.floor((L-1)/E.batchSize):Math.floor(L/E.batchSize),N.previousVersion,R,R])),this.campaign(T)})}campaign(E){let _=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return _?F4(_):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(F4)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(kH)}updateCampaign(E,_){let T=this.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let R={...T,..._};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[R.status,R.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!T)throw Error("Upgrade target was not found.");let R={...kH(T),..._};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[R.status,JSON.stringify(R.evidence),R.error??null,R.startedAt??null,R.finishedAt??null,this.now().toISOString(),E]),kH(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let _=[...E.candidates].sort((A,S)=>A.id.localeCompare(S.id)),T=M2(_),R=this.id(),N=this.now().toISOString(),L=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[R,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(_),T,_.reduce((A,S)=>A+S.bytes,0),L,N,N]),this.cleanup(R)}cleanup(E){let _=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return _?W4(_):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(W4)}updateCleanup(E,_){let T=this.cleanup(E);if(!T)throw Error("Cleanup plan was not found.");let R={...T,..._};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[R.status,R.confirmation??null,JSON.stringify(R.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[_,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,T,T]),this.drill(_)}drill(E){let _=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return _?z4(_):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(z4)}updateDrill(E,_){let T=this.drill(E);if(!T)throw Error("DR drill was not found.");let R={...T,..._};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[R.status,R.operationId??null,JSON.stringify(R.evidence),R.measuredRpoMinutes??null,R.measuredRtoMinutes??null,R.cleanupVerified?1:0,R.error??null,R.startedAt??null,R.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}await g_();function be(E,_=new Date){if(!E.enabled)return!1;let T=new Date(E.schedule);if(!Number.isNaN(T.getTime()))return _>=T&&_.getTime()<=T.getTime()+E.durationMinutes*60000;let R=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!R)return!1;let N=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(_),L=Number(N.find((S)=>S.type==="hour")?.value)*60+Number(N.find((S)=>S.type==="minute")?.value),A=Number(R[1])*60+Number(R[2]);return L>=A&&L<A+E.durationMinutes}class FD{store;now;queue;constructor(E,_,T=()=>new Date){this.store=E;this.now=T;this.queue=_??new pE(E.control)}enqueueCampaign(E,_={}){let T=this.store.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let R=T.windowId?this.store.window(T.windowId):void 0;if(R&&!R.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(R&&!_.overrideWindow&&!be(R,this.now()))throw Error("Upgrade is outside its maintenance window.");if(R?.requireApproval&&!_.approvedBy&&!T.approvedBy)throw Error("Maintenance approval is required.");let N=this.queue.enqueue({projectId:T.projectId,actorId:_.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:N}}async previewCleanup(E,_){let T=_.find((R)=>R.kind===E.kind);if(!T)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await T.discover(E.criteria)})}enqueueCleanup(E,_){let T=this.store.cleanup(E);if(!T||T.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(T.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let R=`DELETE ${T.candidates.length} ${T.kind}`;if(_!==R)throw Error(`Exact confirmation ${R} is required.`);let N=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${T.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:_}),operation:N}}enqueueDrill(E){let _=this.store.drill(E);if(!_||_.status!=="planned")throw Error("A planned DR drill is required.");let T=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${_.scenario}:${_.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:T.id}),operation:T}}}var bH=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function B4(E){return{"maintenance.upgrade":async(N)=>{let L=E.store.campaign(String(bH(N.operation.input).campaignId??""));if(!L||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let A=E.store.manifest(L.manifestId);if(!A?.compatibility.compatible||A.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let S=A.document.artifacts.find((U)=>U.platform===process.platform&&U.architecture===process.arch)??A.document.artifacts[0];if(!S)throw Error("No update artifact matches this platform.");E.store.updateCampaign(L.id,{status:"running",currentStage:"preflight"});let O=[];try{for(let U of[...new Set(E.store.targets(L.id).map((h)=>h.cohort))].sort((h,$)=>h-$)){E.store.updateCampaign(L.id,{currentStage:`cohort:${U}`});for(let h of E.store.targets(L.id).filter(($)=>$.cohort===U)){N.throwIfCancellationRequested(),N.checkpoint(`download:${h.target}`,"Downloading signed platform artifact."),E.store.updateTarget(h.id,{status:"downloading",startedAt:new Date().toISOString()});let $=await E.platform.download({target:h,artifact:S,signal:N.signal});if($.sha256!==S.sha256)throw Error(`Artifact checksum mismatch for ${h.target}.`);N.checkpoint(`install:${h.target}`,"Installing verified artifact."),E.store.updateTarget(h.id,{status:"installing"}),await E.platform.install({target:h,path:$.path,version:A.version,signal:N.signal}),O.push(h);let D=await E.platform.health({target:h,gate:L.healthGate});if(!D.healthy)throw Error(`Upgrade health gate failed for ${h.target}.`);E.store.updateTarget(h.id,{status:"healthy",evidence:D.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(L.id,{status:"succeeded",currentStage:void 0}),{campaignId:L.id,version:A.version,targets:O.length}}catch(U){E.store.updateCampaign(L.id,{status:"rolling_back",currentStage:"rollback"});for(let h of O.reverse())E.store.updateTarget(h.id,{status:"rolling_back"}),await E.platform.rollback({target:h,version:h.previousVersion,signal:N.signal}),E.store.updateTarget(h.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(L.id,{status:"rolled_back",currentStage:void 0}),U}},"maintenance.cleanup":async(N)=>{let L=E.store.cleanup(String(bH(N.operation.input).planId??""));if(!L||L.status!=="approved")throw Error("Approved cleanup plan was not found.");if(M2([...L.candidates].sort((h,$)=>h.id.localeCompare($.id)))!==L.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let A=E.cleanup?.find((h)=>h.kind===L.kind);if(!A)throw Error(`No ${L.kind} cleanup driver is configured.`);E.store.updateCleanup(L.id,{status:"running"});let S=[],O=[];for(let h of L.candidates){N.throwIfCancellationRequested();try{await A.remove(h),S.push(h.id)}catch($){O.push({id:h.id,error:$ instanceof Error?$.message:String($)})}}let U=O.length?S.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(L.id,{status:U,result:{removed:S,failed:O,reclaimedBytes:L.candidates.filter((h)=>S.includes(h.id)).reduce((h,$)=>h+$.bytes,0)}}),O.length)throw Error(`Cleanup failed for ${O.length} candidate(s).`);return{planId:L.id,removed:S.length,reclaimedBytes:L.estimatedBytes}},"maintenance.drill":async(N)=>{let L=E.store.drill(String(bH(N.operation.input).drillId??""));if(!L)throw Error("DR drill was not found.");let A=E.recovery?.find(($)=>$.scenario===L.scenario);if(!A)throw Error(`No ${L.scenario} recovery driver is configured.`);let S=new Date;E.store.updateDrill(L.id,{status:"restoring",startedAt:S.toISOString()});let O=L.isolatedTarget,U={},h={};try{N.checkpoint("restore","Restoring into isolated drill target.");let $=await A.restore({drill:L,signal:N.signal});if(!$.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");O=$.target,U=$.evidence;let D=(S.getTime()-new Date($.recoveryPointAt).getTime())/60000;E.store.updateDrill(L.id,{status:"verifying",measuredRpoMinutes:D,evidence:{restore:U}}),N.checkpoint("verify","Running recovery health checks without production traffic.");let C=await A.verify({drill:L,target:O});h=C.evidence;let J=(Date.now()-S.getTime())/60000;if(!C.healthy||D>L.expectedRpoMinutes||J>L.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(L.id,{measuredRpoMinutes:D,measuredRtoMinutes:J,evidence:{restore:U,verify:h}})}catch($){throw E.store.updateDrill(L.id,{status:"failed",error:$ instanceof Error?$.message:String($),evidence:{restore:U,verify:h}}),$}finally{E.store.updateDrill(L.id,{status:"cleaning"});try{await A.cleanup({drill:L,target:O});let $=E.store.drill(L.id);E.store.updateDrill(L.id,{status:$.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch($){E.store.updateDrill(L.id,{status:"cleanup_required",cleanupVerified:!1,error:$ instanceof Error?$.message:String($),finishedAt:new Date().toISOString()})}}return{drillId:L.id,status:E.store.drill(L.id).status}}}}var H4={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class WD{kind;control;projectId;organizationId;constructor(E,_,T,R){this.kind=E;this.control=_;this.projectId=T;this.organizationId=R}async discover(E){let _=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),T=new Date(Date.now()-_*86400000).toISOString(),R=H4[this.kind],N=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(R.select).all(N,T).map((A)=>({id:String(A.id),kind:this.kind,label:`${this.kind}:${String(A.id)}`,bytes:Number(A.bytes??0),metadata:{createdAt:String(A.created_at)}}))}async remove(E){if(this.control.database.run(H4[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function ge(){let E=await o(),_=mE(process.cwd(),E),T=new ID(_.store),R=new FD(T),N=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new WD(L,_.store,_.project.id,_.organization.id));return{controlPlane:_,store:T,service:R,cleanup:N}}async function TA(E){let _=await ge();try{await E(_)}catch(T){q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}function gH(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(_)=>TA((T)=>{let R={manifests:T.store.manifests(T.controlPlane.organization.id),windows:T.store.windows(T.controlPlane.project.id),campaigns:T.store.campaigns(T.controlPlane.project.id),cleanups:T.store.cleanups(T.controlPlane.project.id),drills:T.store.drills(T.controlPlane.project.id)},N=[...R.manifests.map((L)=>["update",L.version,L.compatibility.compatible?"compatible":"blocked",L.compatibility.reasons.join("; ")||L.channel]),...R.campaigns.map((L)=>["upgrade",L.id,L.status,L.currentStage??L.fromVersion]),...R.cleanups.map((L)=>["cleanup",L.kind,L.status,`${L.candidates.length} items / ${L.estimatedBytes} bytes`]),...R.drills.map((L)=>["DR drill",L.scenario,L.status,L.isolatedTarget])];if(_.json)console.log(JSON.stringify(R,null,2));else p(["Area","Name / version","Status","Detail"],N)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(_,T)=>TA(async(R)=>{let N=R.store.addTrustedKey({organizationId:R.controlPlane.organization.id,name:_,publicKeyPem:await Bun.file(T).text()});b(`Trusted ${N.name}: ${N.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(_,T,R)=>TA(async(N)=>{let L=await Bun.file(_).json(),A=(await Bun.file(T).text()).trim(),S=N.store.importManifest({organizationId:N.controlPlane.organization.id,keyId:R,document:L,signature:A,current:{schemaVersion:N.controlPlane.store.health().schemaVersion,currentVersion:XD,platform:process.platform,architecture:process.arch}});b(`Verified ${S.version}; ${S.compatibility.compatible?"compatible":"blocked: "+S.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(_,T,R)=>TA((N)=>{let L=N.store.createWindow({projectId:N.controlPlane.project.id,name:_,schedule:T,timezone:R.timezone,durationMinutes:Number(R.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});b(`Created ${L.name} (${L.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(_,T,R)=>TA((N)=>{let L=new CL(N.controlPlane.store).list(N.controlPlane.project.id).filter((O)=>O.status==="ready").map((O)=>({serverId:O.id,target:O.name,previousVersion:O.bootstrapVersion??XD}));if(!L.length)L.push({target:"control-plane",previousVersion:XD});let A=N.store.createCampaign({projectId:N.controlPlane.project.id,manifestId:_,fromVersion:XD,strategy:R.strategy==="rolling"?"rolling":"canary",batchSize:Number(R.batch),healthGate:{kind:"platform"},backupId:T,targets:L}),S=N.service.enqueueCampaign(A.id);b(`Staged upgrade queued: ${S.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(_,T)=>TA(async(R)=>{let N=await R.service.previewCleanup({projectId:R.controlPlane.project.id,kind:_,criteria:{olderThanDays:Number(T.olderThan)}},R.cleanup);p(["ID","Candidate","Bytes"],N.candidates.map((L)=>[L.id,L.label,String(L.bytes)])),X(`Apply with: cloud cleanup:apply ${N.id} --confirm "DELETE ${N.candidates.length} ${N.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(_,T)=>TA((R)=>{let N=R.service.enqueueCleanup(_,String(T.confirm??""));b(`Cleanup queued: ${N.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(_,T,R)=>TA((N)=>{let L=N.store.createDrill({projectId:N.controlPlane.project.id,scenario:_,isolatedTarget:T,expectedRpoMinutes:Number(R.rpo),expectedRtoMinutes:Number(R.rto),recoveryPointId:R.recoveryPoint,topologyId:R.topology});b(`Planned isolated drill ${L.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(_)=>TA((T)=>{let R=T.service.enqueueDrill(_);b(`DR drill queued: ${R.operation.id}`)}))}kE();$S();vR();async function cH(){try{return(await o()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function vH(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(_)=>{r("Lambda Functions");let T=_?.region||await cH(),R=new K_(T);try{let{Functions:N=[]}=await R.listFunctions({MaxItems:50});if(!N.length){X("No functions found");return}p(["Name","Runtime","Memory","Timeout","Last Modified"],N.map((L)=>[L.FunctionName??"-",L.Runtime??"-",L.MemorySize?`${L.MemorySize} MB`:"-",L.Timeout?`${L.Timeout}s`:"-",L.LastModified??"-"]))}catch(N){q(`Failed to list functions: ${N.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(_,T)=>{r(`Invoking ${_}`);let R=T?.region||await cH(),N=new K_(R),L=new l("Invoking function...");L.start();try{let A=await N.invoke({FunctionName:_,InvocationType:T?.async?"Event":"RequestResponse",Payload:T?.payload||"{}",LogType:T?.async?"None":"Tail"});if(A.FunctionError){if(L.fail(`Function returned an error (${A.FunctionError})`),A.Payload)X(A.Payload);process.exitCode=1;return}if(L.succeed(`Invoked (status ${A.StatusCode})`),A.Payload)X(`
+`).find((N)=>N&&!N.startsWith("#"))?.trim().split(/\s+/);if(T.code!==0||!R?.[1]||!R[2])throw Error(`SSH host-key scan failed: ${T.stderr.trim()||"no key returned"}`);return{algorithm:R[1],key:R[2]}}async exec(E,_){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return iM(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,_])}}var Fe=(E)=>`SHA256:${Ie("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,We=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class pL{provider;transport;discoverer;constructor(E,_=new sM,T){this.provider=E;this.transport=_;this.discoverer=T}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let _=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:_.algorithm,hostKeyFingerprint:Fe(_.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let _=await this.transport.exec(E,We);if(_.code!==0)throw Error(`Fleet validation failed: ${_.stderr.trim()||_.code}`);try{return JSON.parse(_.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,_){let T=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${_.length}`);if(T.code!==0)throw Error(`Fleet bootstrap failed: ${T.stderr.trim()||T.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function pM(E,_){return{"fleet.bootstrap":async(T)=>{let R=T.operation.input&&typeof T.operation.input==="object"&&!Array.isArray(T.operation.input)?T.operation.input:{},N=E.get(String(R.serverId??""));if(!N)throw Error("Queued fleet server was not found.");let L=_.find((O)=>O.provider===N.provider);if(!L)throw Error(`No ${N.provider} fleet driver is configured.`);let A=Array.isArray(R.steps)?R.steps.map(String):[];if(T.checkpoint("preflight","Rechecking pinned trust and healthy validation."),N.trustState!=="pinned"||!N.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");T.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let S=await L.bootstrap(N,A);return E.update(N.id,{bootstrapVersion:S.version,status:"ready"}),T.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:N.id,bootstrapVersion:S.version,steps:A.length}}}}var DL=(E)=>E==null?void 0:String(E),z0=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},PH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:DL(E.provider_id),region:DL(E.region),zone:DL(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:DL(E.host_key_algorithm),hostKeyFingerprint:DL(E.host_key_fingerprint),pendingHostKey:DL(E.pending_host_key),roles:z0(E.roles,[]),labels:z0(E.labels,{}),taints:z0(E.taints,[]),capacity:z0(E.capacity,{}),usage:z0(E.usage,{}),capabilities:z0(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:z0(E.validation,void 0),bootstrapVersion:DL(E.bootstrap_version),heartbeatAt:DL(E.heartbeat_at),lastSeenAt:DL(E.last_seen_at),archivedAt:DL(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class CL{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}get(E){let _=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return _?PH(_):void 0}list(E,_=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(PH).filter((T)=>_||T.status!=="archived")}findProvider(E,_,T){let R=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,_,T);return R?PH(R):void 0}create(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,T,T]),this.get(_)}update(E,_){let T=this.get(E);if(!T)throw Error("Server was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[R.name,R.providerId??null,R.region??null,R.zone??null,R.endpoint,R.sshUser,R.sshPort,R.credentialRef,R.hostKeyAlgorithm??null,R.hostKeyFingerprint??null,R.pendingHostKey??null,JSON.stringify(R.roles),JSON.stringify(R.labels),JSON.stringify(R.taints),JSON.stringify(R.capacity),JSON.stringify(R.usage),JSON.stringify(R.capabilities),R.status,R.trustState,JSON.stringify(R.validation??{}),R.bootstrapVersion??null,R.heartbeatAt??null,R.lastSeenAt??null,R.archivedAt??null,N,E]),this.get(E)}}var ze=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class AD{store;drivers;now;queue;constructor(E,_,T,R=()=>new Date){this.store=E;this.drivers=_;this.now=R;this.queue=T??new pE(E.control)}driver(E){let _=this.drivers.find((T)=>T.provider===E);if(!_)throw Error(`No ${E} fleet driver is configured.`);return _}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!ze.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let _=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(_)return this.store.update(_.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let T=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),R=this.driver(E.provider);return this.store.create({...E,resourceId:T.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:R.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let T=await this.driver(_.provider).test(_);if(!T.reachable)return this.store.update(E,{status:"unreachable"});if(_.hostKeyFingerprint&&_.hostKeyFingerprint!==T.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:T.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:T.hostKeyAlgorithm,hostKeyFingerprint:T.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,_){let T=this.store.get(E);if(!T||T.pendingHostKey!==_)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:_,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let _=this.store.get(E);if(!_||_.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let T=await this.driver(_.provider).validate(_),R=[];if(!["x64","arm64","x86_64","aarch64"].includes(T.arch??""))R.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let A of["curl","tar"])if(!T.tools?.[A])R.push({code:`tool.${A}`,severity:"error",message:`${A} is missing.`,remediation:`Install ${A} before bootstrap.`});if(Math.abs(T.timeSkewSeconds??0)>60)R.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!T.dnsOk)R.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let N={valid:!R.some((A)=>A.severity==="error"),facts:T,findings:R,validatedAt:this.now().toISOString(),validatorVersion:"1"},L={cpu:T.cpuCores??0,memoryBytes:T.memoryBytes??0,diskBytes:T.diskBytes??0};return this.store.update(E,{validation:N,capacity:L,status:N.valid?"ready":"degraded"})}bootstrap(E,_=!1){let T=this.store.get(E);if(!T?.validation?.valid)throw Error("A healthy validation report is required.");let R=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!_)return{preview:!0,steps:R};let N=this.queue.enqueue({projectId:T.projectId,resourceId:T.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:R},lockKey:`server:${E}`,providerKey:T.provider}).operation;return{preview:!1,steps:R,operation:N}}heartbeat(E,_){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let R=this.now().toISOString();return this.store.update(E,{usage:_.usage,capabilities:_.capabilities??T.capabilities,heartbeatAt:R,lastSeenAt:R,status:T.status==="draining"||T.status==="drained"?T.status:"ready"})}drain(E,_=!1){return this.store.update(E,{status:_?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,_){let T=this.store.get(E);if(!T||_!==T.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function Be(){let E=await o(),_=mE(process.cwd(),E),T=new CL(_.store),R=new AD(T,[new pL("aws"),new pL("hetzner"),new pL("ssh")]);return{controlPlane:_,store:T,service:R}}async function oL(E){let _=await Be();try{return await E(_)}finally{_.controlPlane.store.close()}}var B0=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!T)throw Error(`Server ${_} was not found.`);return T},$N=(E)=>{q(E instanceof Error?E.message:String(E)),process.exitCode=1};function MH(E,_){let T=Number.parseInt(E??"",10);return Number.isFinite(T)&&T>=0?T:_}function He(E="3h"){let _=E.match(/^(\d+)(m|h)$/);if(!_)throw Error("--range must use minutes or hours, for example 30m or 3h.");let T=Number(_[1])*(_[2]==="h"?3600000:60000);if(T<300000||T>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return T}function SD(E,_="%"){return E==null?"unavailable":`${E.toFixed(1)}${_}`}async function je(E,_){let T=await o();if(T.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",N=B_(T,R),L=await fN(N);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${L.serverName}.`);let A=hU(T),S=new eL({apiToken:$U(A.apiToken,T)}),O=await S.getServer(L.serverId),U=L.publicIp??O.public_net.ipv4?.ip;if(!U)throw Error(`Server ${O.name} has no public IPv4 address.`);let h=new Date,$=new Date(h.getTime()-He(_.range)),D=Math.min(3600,Math.max(60,MH(_.step,60))),C=await qM({client:S,serverId:O.id,cores:Math.max(1,Number(O.server_type.cores)||1),from:$,to:h,step:D,remote:{host:U,user:L.sshUser??A.sshUser,identityFile:A.sshPrivateKeyPath,connectTimeoutSec:15}});if(_.json){console.log(JSON.stringify({schemaVersion:1,server:O.name,result:C},null,2));return}p(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[O.name,`${C.from} to ${C.to}`,`${SD(C.summary.cpuAveragePercent)} / ${SD(C.summary.cpuPeakPercent)}`,`${SD(C.summary.memoryAveragePercent)} / ${SD(C.summary.memoryPeakPercent)}`,C.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(C.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,SD(C.summary.swapPeakPercent)]])}function oM(E){let _=E.targetType.prices?.find((T)=>T.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:_?{hourlyNet:_.price_hourly.net,hourlyGross:_.price_hourly.gross,monthlyNet:_.price_monthly.net,monthlyGross:_.price_monthly.gross}:void 0}}function Ye(E){let _=oM(E);p(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${_.serverName} (${_.serverId})`,_.location,`${_.from} -> ${_.to}`,_.capacityAvailable?"available":"waiting",`${_.target.cores??0} / ${_.target.memoryGb??0} GB / ${_.target.diskGb??0} GB`,_.price?.monthlyGross??_.price?.monthlyNet??"not reported"]])}async function we(E,_,T){let R=await o();if(R.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let N=T.env??process.env.CLOUD_ENV??"production",L=B_(R,N),A=await fN(L),S=hU(R),O=new eL({apiToken:$U(S.apiToken,R)}),h=A&&(E===A.serverName||E===String(A.serverId)||E===A.stackName)?await O.getServer(A.serverId):(await O.listServers()).find((d)=>d.name===E||String(d.id)===E);if(!h)throw Error(`Hetzner server ${E} was not found.`);if(A?.serverId&&A.serverId!==h.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${A.serverId}.`);let $=aL(_),D=T.upgradeDisk!==!1,C=await LD(O,h.id,$,D);if(T.json)console.log(JSON.stringify({schemaVersion:1,plan:oM(C)},null,2));else Ye(C);if(!T.apply){if(!T.json)X(`Preview only. Re-run with --apply --confirm ${h.name} to execute.`);return}if(T.confirm!==h.name)throw Error(`Resize requires --confirm ${h.name}.`);let J=A?.publicIp??h.public_net.ipv4?.ip;if(!J)throw Error(`Server ${h.name} has no public IPv4 address for verification.`);let I={host:J,user:A?.sshUser??S.sshUser,identityFile:S.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},W=await wH(L),H=new Date().toISOString(),w={schemaVersion:1,operationId:W?.targetType===$&&W.serverId===h.id?W.operationId:crypto.randomUUID(),stackName:L,serverId:h.id,serverName:h.name,sourceType:C.currentType.name,targetType:$,upgradeDisk:D,phase:"planning",status:"running",attempts:W?.targetType===$?W.attempts:0,startedAt:W?.targetType===$?W.startedAt:H,updatedAt:H,manifest:W?.targetType===$?W.manifest:void 0};await sL(w);let B=MH(T.pollSeconds,900)*1000,G=MH(T.maxWaitMinutes,0)*60000,K=Date.now();for(;;){let d=await LD(O,h.id,$,D);if(!d.capacityAvailable&&!d.alreadyComplete){if(w={...w,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await sL(w),!T.wait){if(!T.json)X(`${$} has no capacity in ${d.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(G>0&&Date.now()-K>=G)throw Error(`Timed out waiting for ${$} capacity in ${d.location}.`);if(!T.json)X(`Waiting ${Math.round(B/1000)} seconds for ${$} capacity...`);await Bun.sleep(B);continue}let x=await QH(L);try{let g=await(async()=>{try{return w={...w,status:"running",attempts:w.attempts+1,updatedAt:new Date().toISOString()},await sL(w),await WH({client:O,serverId:h.id,targetType:$,upgradeDisk:D,resumeFromOff:w.phase==="shutting-down"||w.phase==="resizing"||w.phase==="powering-on"||w.phase==="verifying",manifest:w.manifest,hooks:{preflight:async()=>{let f=await BH(I);return w={...w,manifest:f,updatedAt:new Date().toISOString()},await sL(w),f},afterBoot:async(f,v,t,TE)=>HH(I,v,t,TE),onPhase:async(f,v)=>{if(w={...w,phase:f,status:f==="waiting-capacity"?"waiting-capacity":f==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await sL(w),!T.json)X(`${f}${v?` ${JSON.stringify(v)}`:""}`)}}})}finally{await x()}})();if(w={...w,status:g.status==="completed"||g.status==="already-complete"?"completed":g.status==="recovered"?"recovered":"waiting-capacity",lastError:g.status==="recovered"?g.error:void 0,updatedAt:new Date().toISOString()},await sL(w),T.json)console.log(JSON.stringify({schemaVersion:1,result:g},null,2));else if(g.status==="completed"||g.status==="already-complete")b(`${h.name} is on ${$} and passed full post-boot verification.`);else if(g.status==="recovered"&&g.retryable&&T.wait){X(`Capacity race recovered safely. Waiting ${Math.round(B/1000)} seconds before retry.`),await Bun.sleep(B);continue}else if(g.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${g.error}`);return}catch(g){throw w={...w,status:"failed",lastError:g instanceof Error?g.message:String(g),updatedAt:new Date().toISOString()},await sL(w),g}}}async function Qe(E,_){let T=await o();if(T.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",N=B_(T,R),L=await fN(N);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${L.serverName}.`);let A=hU(T),S=new eL({apiToken:$U(A.apiToken,T)}),O=await S.getServer(L.serverId),U=L.publicIp??O.public_net.ipv4?.ip;if(!U)throw Error(`Server ${O.name} has no public IPv4 address.`);let h=j2(T);if(_.json)console.log(JSON.stringify({schemaVersion:1,server:O.name,plan:h},null,2));else p(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[O.name,h.firewallPorts.join(","),h.monitoring?"on":"off",h.autoUpdates?"on":"off",`${h.swapGb} GB`,"disabled"]]);if(!_.apply){if(!_.json)X(`Preview only. Re-run with --apply --confirm ${O.name} to execute.`);return}if(_.confirm!==O.name)throw Error(`Optimization requires --confirm ${O.name}.`);let $={host:U,user:L.sshUser??A.sshUser,identityFile:A.sshPrivateKeyPath,connectTimeoutSec:15},D=await zU($),C=D.routeProbes.filter((t)=>!t.ok),J=T.infrastructure?.compute,I=jR(J)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,W=D.failedUnits.filter((t)=>!I.has(t));if(W.length>0)throw Error(`Preflight found failed services: ${W.join(", ")}`);if(C.length>0)throw Error(`Preflight found unhealthy routes: ${C.map((t)=>t.domain).join(", ")}`);let H=jR(J)?[]:Object.values(T.sites??{}).flatMap((t)=>typeof t?.port==="number"&&![80,443].includes(t.port)?[t.port]:[]),w=XU({allowSsh:J?.allowSsh!==!1,sitePorts:H,allowedPorts:J?.firewall?.allowedPorts}),B=(L.firewallId?(await S.listFirewalls()).find((t)=>t.id===L.firewallId):void 0)??(await S.listFirewalls()).find((t)=>t.name===`${T.project.slug}-${R}-app-fw`);if(!B)throw Error(`Managed firewall for ${O.name} was not found.`);let G=await S.setFirewallRules(B.id,w);await Promise.all(G.map((t)=>S.waitForAction(t.id))),await $H(T,$);let[K,d]=await Promise.all([zU($),DH($)]),x=CH(h,d),g=vM(D,K),f=K.routeProbes.filter((t)=>!t.ok);if(g.stoppedServices.length>0)x.push(`services stopped: ${g.stoppedServices.join(", ")}`);if(g.changedRouteFragments.length>0)x.push(`route fragments changed: ${g.changedRouteFragments.join(", ")}`);if(g.missingRouteIds.length>0)x.push(`routes disappeared: ${g.missingRouteIds.join(", ")}`);if(g.changedReleaseLinks.length>0)x.push(`release links changed: ${g.changedReleaseLinks.join(", ")}`);if(g.missingData.length>0)x.push(`databases or volumes disappeared: ${g.missingData.join(", ")}`);if(f.length>0)x.push(`unhealthy routes: ${f.map((t)=>t.domain).join(", ")}`);if(x.length>0)throw Error(`Host optimization verification failed: ${x.join("; ")}`);let v={serverId:O.id,serverName:O.name,services:K.runningServices.length,routes:K.routeIds.length,healthyDomains:K.routeProbes.length,releaseLinks:K.releaseLinks.length,databasesAndVolumes:K.dataCatalog.length,report:d};if(_.json)console.log(JSON.stringify({schemaVersion:1,result:v},null,2));else b(`${O.name} passed full host, rpx route, service, release, and data verification.`)}function KH(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(_,T)=>{try{await oL(async(R)=>{let N=_?[B0(R,_)]:R.store.list(R.controlPlane.project.id),L=N.flatMap((A)=>Object.entries(A.capabilities).map(([S,O])=>({server:A.name,provider:A.provider,action:S,...O})));if(T.json)console.log(JSON.stringify({schemaVersion:1,targets:L},null,2));else p(["Server","Provider","Action","Support","Explanation"],L.map((A)=>[A.server,A.provider,A.action,A.supported?"supported":"unsupported",A.reason??"—"]))})}catch(R){$N(R)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(_,T,R)=>{try{await we(_,T,R)}catch(N){$N(N)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(_,T)=>{try{await Qe(_,T)}catch(R){$N(R)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(_,T)=>{try{await je(_,T)}catch(R){$N(R)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(_)=>{try{await oL(async(T)=>{let R=T.store.list(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],R.map((N)=>[N.name,N.providerId??"—",`${N.provider} / ${N.region??"external"}`,`${N.status} / ${N.trustState}`,N.roles.join(","),`${N.capacity.cpu??0} / ${N.capacity.memoryBytes??0}`,N.heartbeatAt??"never"]))})}catch(T){$N(T)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(_,T)=>{try{await oL(async(R)=>{let N=T.provider;if(!["aws","hetzner","ssh"].includes(N)||!T.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let L=R.service.enroll({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,provider:N,providerId:T.providerId,endpoint:T.endpoint,sshUser:T.user??"deploy",credentialRef:T.credentialRef??"secret://fleet/agent",region:T.region,roles:String(T.roles??"application").split(","),labels:Object.fromEntries(String(T.labels??"").split(",").map((A)=>A.split("=")).filter((A)=>A[0]&&A[1]))});b(`Enrolled ${L.name} as ${L.id}; no remote mutation was performed.`)})}catch(R){$N(R)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(_,T)=>{try{await oL(async(R)=>{let N=B0(R,_);if(N=await R.service.test(N.id),N.trustState==="rotation_pending"){if(!T.acceptHostKey)throw Error(`Host key changed to ${N.pendingHostKey}; review it first.`);N=R.service.reviewHostKey(N.id,T.acceptHostKey)}let L=await R.service.validate(N.id);if(T.json)console.log(JSON.stringify(L.validation,null,2));else p(["Severity","Code","Finding","Remediation"],(L.validation?.findings??[]).map((A)=>[A.severity,A.code,A.message,A.remediation??"—"]));if(!L.validation?.valid)process.exitCode=1})}catch(R){$N(R)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(_,T)=>{try{await oL(async(R)=>{let N=R.service.bootstrap(B0(R,_).id,!!T.apply);if(N.preview)p(["Step"],N.steps.map((L)=>[L]));else b(`Bootstrap queued: ${N.operation?.id}`)})}catch(R){$N(R)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(_,T)=>{try{await oL(async(R)=>b(R.service.drain(B0(R,_).id,!!T.complete).status))}catch(R){$N(R)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(_)=>{try{await oL(async(T)=>{T.service.uncordon(B0(T,_).id),b(`Uncordoned ${_}.`)})}catch(T){$N(T)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(_,T)=>{try{await oL(async(R)=>{R.service.archive(B0(R,_).id,T.confirm??""),b(`Archived ${_}; provider infrastructure was not terminated.`)})}catch(R){$N(R)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(_)=>{try{await oL(async(T)=>{let R=B0(T,_);if(R.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let N=Bun.spawn(["ssh","-p",String(R.sshPort),"-o","StrictHostKeyChecking=yes",`${R.sshUser}@${R.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),L=await N.exited;if(L)process.exitCode=L})}catch(T){$N(T)}});for(let[_,T]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(_,T).action(async(...R)=>ON(_.split(" ")[0],{target:String(R[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}kE();var kN=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},YR=(E)=>E==null?void 0:String(E),T4=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),HU=(E={})=>({...T4(),...E});function E4(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:YR(E.region),architecture:YR(E.architecture),labels:kN(E.labels,{}),requiredServerLabels:kN(E.required_server_labels,{}),toleratedTaints:kN(E.tolerated_taints,[]),capacity:HU(kN(E.capacity,{})),reserved:kN(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:YR(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function _4(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:YR(E.environment_id),resourceId:String(E.resource_id),releaseId:YR(E.release_id),poolId:String(E.pool_id),serverId:YR(E.server_id),purpose:String(E.purpose),requirements:kN(E.requirements,{}),decision:kN(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Ge(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:YR(E.resource_id),poolId:String(E.pool_id),placementId:YR(E.placement_id),operationId:YR(E.operation_id),sourceSha:String(E.source_sha),buildSpec:kN(E.build_spec,{}),credentialPolicy:kN(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:YR(E.workspace),cacheKey:YR(E.cache_key),artifactUri:YR(E.artifact_uri),artifactDigest:YR(E.artifact_digest),status:String(E.status),cleanupAt:YR(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class OD{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}createPool(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(HU(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,T,T]),this.getPool(_)}getPool(E){let _=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return _?E4(_):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(E4)}updatePool(E,_){let T=this.getPool(E);if(!T)throw Error("Capacity pool was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[R.status,JSON.stringify(R.reserved),JSON.stringify(R.capacity),R.concurrency,N,E]),this.getPool(E)}addMember(E,_,T={}){let R=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,_,JSON.stringify(T),R,R])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((_)=>({serverId:String(_.server_id),status:String(_.status),capacityOverride:kN(_.capacity_override,{})}))}memberStatus(E,_,T){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[T,this.now().toISOString(),E,_])}listPlacements(E,_){let T=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(_4);return _?.length?T.filter((R)=>_.includes(R.status)):T}getPlacement(E){let _=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return _?_4(_):void 0}activeUsage(E,_){let T=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),R=_?T.filter((N)=>String(N.server_id)===_):T;return{resources:R.reduce((N,L)=>{let A=HU(kN(L.resources,{}));for(let S of Object.keys(N))N[S]+=A[S];return N},T4()),count:R.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let _=this.id(),T=this.id(),R=this.now().toISOString(),N=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[_,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,R,R]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[T,_,E.decision.poolId,E.decision.serverId??null,JSON.stringify(HU(E.requirements.resources)),N,R,R]),this.getPlacement(_)})}transitionPlacement(E,_){if(!this.getPlacement(E))throw Error("Placement was not found.");let R=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[_,R,E]),["released","failed","blocked"].includes(_))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[R,E]);return this.getPlacement(E)}createBuild(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[_,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),T,T]),this.getBuild(_)}getBuild(E){let _=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return _?Ge(_):void 0}updateBuild(E,_){let T=this.getBuild(E);if(!T)throw Error("Remote build was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[R.operationId??null,R.workspace??null,R.cacheKey??null,R.artifactUri??null,R.artifactDigest??null,R.status,R.cleanupAt??null,N,E]),this.getBuild(E)}}var G2=["cpu","memoryBytes","diskBytes","gpu"],R4=(E,_={})=>Object.entries(_).every(([T,R])=>E[T]===R),Pe=(E,_,T)=>Object.fromEntries(G2.map((R)=>[R,Math.max(0,E[R]-_[R]-(T[R]??0))])),Me=(E,_)=>G2.every((T)=>E[T]>=(_[T]??0)),Ke=(E,_)=>G2.reduce((T,R)=>T+(_[R]??0)/(E[R]||1),0);class UD{store;fleet;constructor(E,_){this.store=E;this.fleet=_}poolCandidates(E,_,T){let R=[];for(let N of this.store.listPools(E)){if(N.id===T)continue;let L=[];if(N.status!=="active")L.push(`pool is ${N.status}`);if(N.purpose!==_.purpose)L.push(`purpose is ${N.purpose}`);if(_.region&&N.region!==_.region)L.push(`region is ${N.region??"unset"}`);if(_.architecture&&N.architecture!==_.architecture)L.push(`architecture is ${N.architecture??"unset"}`);if(!R4(N.labels,_.labels))L.push("pool labels do not match");if(N.backend==="server"){let A=this.store.members(N.id);if(!A.length)R.push(this.decision(N,void 0,_,[...L,"pool has no servers"]));for(let S of A){let O=this.fleet.get(S.serverId),U=[...L];if(!O)U.push("server is missing");else this.serverReasons(N,O,S.status,_,U);R.push(this.decision(N,O,_,U,S.capacityOverride))}}else R.push(this.decision(N,void 0,_,L))}return R.sort((N,L)=>Number(L.eligible)-Number(N.eligible)||N.score.cost-L.score.cost||N.score.spread-L.score.spread||N.score.fit-L.score.fit||N.poolName.localeCompare(L.poolName)||(N.serverId??"").localeCompare(L.serverId??""))}serverReasons(E,_,T,R,N){if(T!=="active")N.push(`member is ${T}`);if(_.status!=="ready")N.push(`server is ${_.status}`);if(!_.roles.includes(R.purpose==="build"?"build":R.purpose))N.push(`server lacks ${R.purpose} role`);if(!R4(_.labels,E.requiredServerLabels))N.push("server labels do not match pool selector");for(let L of _.taints)if(!E.toleratedTaints.includes(L))N.push(`taint ${L} is not tolerated`)}decision(E,_,T,R,N={}){let L=HU({..._?.capacity,...N}),A=_?Object.fromEntries(G2.map((U)=>[U,Math.min(E.capacity[U],L[U])])):E.capacity,S=this.store.activeUsage(E.id,_?.id),O=Pe(A,S.resources,E.reserved);if(S.count>=E.maxWorkloads)R.push("workload limit reached");if(T.purpose==="build"&&S.count>=E.concurrency)R.push("build concurrency reached");if(!Me(O,T.resources))R.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:_?.id,eligible:R.length===0,reasons:R,available:O,score:{fit:Ke(O,T.resources),spread:S.count,cost:E.costWeight}}}explain(E,_){return this.poolCandidates(E,_)}place(E){return this.store.control.transaction(()=>{let _=this.poolCandidates(E.projectId,E.requirements).find((T)=>T.eligible);if(!_)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((T)=>T.reasons).join("; ")}`);return this.store.reserve({...E,decision:_})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let _=this.store.updatePool(E,{status:"draining"}),T=[],R=[];for(let N of this.store.listPlacements(_.projectId,["reserved","active"]).filter((L)=>L.poolId===E)){if(N.stateful){R.push(this.store.transitionPlacement(N.id,"blocked"));continue}this.store.transitionPlacement(N.id,"moving");let L=this.place({projectId:N.projectId,environmentId:N.environmentId,resourceId:N.resourceId,releaseId:N.releaseId,requirements:N.requirements});T.push(this.activate(L.id)),this.store.transitionPlacement(N.id,"released")}return{pool:_,moved:T,blocked:R}}drainServer(E,_){this.store.memberStatus(E,_,"draining");let T=this.store.getPool(E);if(!T)throw Error("Capacity pool was not found.");let R=[],N=[];for(let L of this.store.listPlacements(T.projectId,["reserved","active"]).filter((A)=>A.poolId===E&&A.serverId===_)){if(L.stateful){N.push(this.store.transitionPlacement(L.id,"blocked"));continue}this.store.transitionPlacement(L.id,"moving");let A=this.poolCandidates(L.projectId,L.requirements).find((O)=>O.eligible);if(!A){N.push(this.store.transitionPlacement(L.id,"blocked"));continue}let S=this.store.reserve({projectId:L.projectId,environmentId:L.environmentId,resourceId:L.resourceId,releaseId:L.releaseId,requirements:L.requirements,decision:A});R.push(this.activate(S.id)),this.store.transitionPlacement(L.id,"released")}return{moved:R,blocked:N}}reconcileFailure(E){let _=this.fleet.get(E);if(!_)throw Error("Server was not found.");let T=[],R=[];for(let N of this.store.listPlacements(_.projectId,["active"]).filter((L)=>L.serverId===E)){if(N.stateful||!N.autoReschedule){R.push(this.store.transitionPlacement(N.id,"blocked"));continue}this.store.transitionPlacement(N.id,"failed");let L=this.place({projectId:N.projectId,environmentId:N.environmentId,resourceId:N.resourceId,releaseId:N.releaseId,requirements:N.requirements});T.push(this.activate(L.id))}return{rescheduled:T,blocked:R}}}await g_();async function Ve(){let E=await o(),_=mE(process.cwd(),E),T=new OD(_.store),R=new UD(T,new CL(_.store));return{controlPlane:_,store:T,service:R}}async function hD(E){let _=await Ve();try{await E(_)}catch(T){q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var P2=(E)=>Object.fromEntries(String(E??"").split(",").map((_)=>_.split("=")).filter((_)=>_[0]&&_[1])),N4=(E)=>Object.fromEntries(Object.entries(P2(E)).map(([_,T])=>[_,Number(T)]));function VH(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(_)=>hD((T)=>{let R=T.store.listPools(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],R.map((N)=>[N.name,N.purpose,N.backend,`${N.region??"any"} / ${N.architecture??"any"}`,N.status,JSON.stringify(N.capacity),String(N.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(_,T)=>hD((R)=>{let{purpose:N,backend:L}=T;if(!["application","build","worker","monitoring","backup"].includes(N)||!["server","ecs","asg"].includes(L))throw Error("Unsupported pool purpose or backend.");let A=R.store.createPool({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,purpose:N,backend:L,region:T.region,architecture:T.arch,labels:P2(T.labels),requiredServerLabels:P2(T.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...N4(T.capacity)},maxWorkloads:Number(T.max),costWeight:1,concurrency:Number(T.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});b(`Created ${A.name} (${A.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(_,T)=>hD((R)=>{let N=R.store.listPools(R.controlPlane.project.id).find((A)=>A.id===_||A.name===_),L=new CL(R.controlPlane.store).list(R.controlPlane.project.id).find((A)=>A.id===T||A.name===T);if(!N||!L)throw Error("Pool or server was not found.");R.store.addMember(N.id,L.id),b(`Attached ${L.name} to ${N.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(_)=>hD((T)=>{let R=T.service.explain(T.controlPlane.project.id,{purpose:_.purpose,resources:N4(_.resources),region:_.region,architecture:_.arch,labels:P2(_.labels)});if(_.json)console.log(JSON.stringify(R,null,2));else p(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],R.map((N)=>[N.poolName,N.serverId??"provider-managed",N.eligible?"yes":"no",JSON.stringify(N.available),`${N.score.fit.toFixed(2)} / ${N.score.spread} / ${N.score.cost}`,N.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(_)=>hD((T)=>{let R=T.store.listPools(T.controlPlane.project.id).find((L)=>L.id===_||L.name===_);if(!R)throw Error("Pool was not found.");let N=T.service.drainPool(R.id);b(`Draining ${R.name}: moved ${N.moved.length}, blocked ${N.blocked.length} stateful placement(s).`)}))}kE();var EA=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},DN=(E)=>E==null?void 0:String(E),L4=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:DN(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:EA(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:EA(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:DN(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),ZH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:DN(E.stack_id),stackRevision:DN(E.stack_revision),status:String(E.status),health:EA(E.health,{}),lastHealthyAt:DN(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),dH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:EA(E.config,{}),status:String(E.status),checkpoint:DN(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:DN(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),qH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:EA(E.weights,{}),desiredWeights:EA(E.desired_weights,{}),status:String(E.status),providerState:EA(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),A4=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:DN(E.operation_id),kind:String(E.kind),requestedRegion:DN(E.requested_region),revision:DN(E.revision),plan:EA(E.plan,[]),currentStep:DN(E.current_step),completedSteps:EA(E.completed_steps,[]),status:String(E.status),error:DN(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class $D{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((L)=>L.region)).size!==E.regions.length||E.regions.filter((L)=>L.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let _=E.regions.find((L)=>L.role==="primary"),T=this.id(),R=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[T,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,_.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),_.region,R,R]);for(let L of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),T,L.region,L.role,L.provider,R,R]);for(let L of E.dataPolicy.replicate)for(let A of E.regions)for(let S of E.regions.filter((O)=>O.region!==A.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,L,A.region,S.region,"{}",R,R]);let N=Object.fromEntries(E.regions.map((L)=>[L.region,L.region===_.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),T,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(N),JSON.stringify(N),R,R]),this.get(T)})}get(E){let _=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return _?L4(_):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(L4)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(ZH)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(dH)}route(E){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return _?qH(_):void 0}updateTopology(E,_){let T=this.get(E);if(!T)throw Error("Regional topology was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[R.status,R.activeRegion,R.revision??null,JSON.stringify(R.regions),N,E]),this.get(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!T)throw Error("Regional target was not found.");let R=ZH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[N.role,N.stackId??null,N.stackRevision??null,N.status,JSON.stringify(N.health),N.lastHealthyAt??null,L,E]),ZH(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,_){let T=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!T)throw Error("Replication channel was not found.");let R=dH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[N.status,N.checkpoint??null,N.lagSeconds??null,N.lastVerifiedAt??null,L,E]),dH(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,_){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!T)throw Error("Traffic route was not found.");let R=qH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(N.weights),JSON.stringify(N.desiredWeights),N.status,JSON.stringify(N.providerState),L,E]),qH(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[_,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),T,T]),this.execution(_)}execution(E){let _=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return _?A4(_):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(A4)}updateExecution(E,_){let T=this.execution(E);if(!T)throw Error("Regional execution was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[R.operationId??null,R.currentStep??null,JSON.stringify(R.completedSteps),R.status,R.error??null,N,E]),this.execution(E)}}await g_();class DD{store;queue;constructor(E,_){this.store=E;this.queue=_??new pE(E.control)}create(E){return this.store.create(E)}plan(E,_,T){if(!this.store.get(E))throw Error("Regional topology was not found.");let N=this.store.targets(E),L=this.store.channels(E);if(_==="rollout")return[...N.filter((A)=>A.role==="secondary").map((A)=>`apply:${A.region}`),...N.filter((A)=>A.role==="primary").map((A)=>`apply:${A.region}`),...L.map((A)=>`replicate:${A.kind}:${A.targetRegion}`),"traffic:activate"];if(_==="failover"||_==="failback")return[`health:${T}`,`replication:${T}`,`traffic:${T}`,`roles:${T}`];if(_==="destroy")return["traffic:drain",...N.filter((A)=>A.role==="secondary").map((A)=>`delete:${A.region}`),...N.filter((A)=>A.role==="primary").map((A)=>`delete:${A.region}`),"complete"];return["observe","repair"]}enqueue(E){let _=this.store.get(E.topologyId);if(!_)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!_.regions.some((L)=>L.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===_.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==_.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&_.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let T=this.plan(_.id,E.kind,E.targetRegion),R=this.store.createExecution({topologyId:_.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:T}),N=this.queue.enqueue({projectId:_.projectId,environmentId:_.environmentId,kind:`region.${E.kind}`,input:{executionId:R.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${_.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(R.id,{operationId:N.id}),{execution:this.store.execution(R.id),operation:N}}}var Ze=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function S4(E,_){let T=(U)=>{let h=_.find(($)=>$.provider===U.provider);if(!h)throw Error(`No ${U.provider} regional driver is configured.`);return h},R=(U,h,$)=>{U.throwIfCancellationRequested(),U.checkpoint($,$),E.updateExecution(h.id,{status:"running",currentStep:$,completedSteps:[...E.execution(h.id).completedSteps,$]})},N=async(U,h)=>{let $=E.route(U.id);if(!$)throw Error("Regional traffic route was not found.");let D=E.targets(U.id).find((J)=>J.region===U.activeRegion)??E.targets(U.id)[0];if(!D)throw Error("Regional traffic target was not found.");E.updateRoute($.id,{status:"applying",desiredWeights:h});let C=await T(D).applyTraffic({route:E.route(U.id),topology:U,weights:h});E.updateRoute($.id,{status:Object.values(h).every((J)=>J===0)?"drained":"in_sync",weights:h,providerState:C.providerState})},L=async(U,h,$,D)=>{E.updateTopology($.id,{status:"provisioning"});let C=h.revision,J=D.manifest??{},I=E.targets($.id).sort((H,w)=>Number(H.role==="primary")-Number(w.role==="primary"));for(let H of I){R(U,h,`apply:${H.region}`),E.updateTarget(H.id,{status:"provisioning"});let w=await T(H).applyStack({target:H,revision:C,manifest:J,signal:U.signal}),B=await T(H).health({target:E.updateTarget(H.id,{stackId:w.stackId,stackRevision:C})});if(!B.healthy)throw Error(`Regional health gate failed in ${H.region}.`);E.updateTarget(H.id,{status:"ready",health:B.evidence,lastHealthyAt:new Date().toISOString()})}for(let H of E.channels($.id)){R(U,h,`replicate:${H.kind}:${H.targetRegion}`),E.updateChannel(H.id,{status:"configuring"});let w=I.find((K)=>K.region===H.sourceRegion),B=await T(w).configureReplication({channel:H,topology:$}),G=await T(w).verifyReplication({channel:E.updateChannel(H.id,{checkpoint:B.checkpoint,lagSeconds:B.lagSeconds}),topology:$});if(!G.healthy||G.lagSeconds>$.dataPolicy.maxLagSeconds)throw Error(`${H.kind} replication to ${H.targetRegion} exceeds the RPO.`);E.updateChannel(H.id,{status:"in_sync",checkpoint:G.checkpoint,lagSeconds:G.lagSeconds,lastVerifiedAt:new Date().toISOString()})}R(U,h,"traffic:activate");let W=Object.fromEntries($.regions.map((H)=>[H.region,H.region===$.activeRegion?100:0]));return await N($,W),E.updateTopology($.id,{status:"ready",revision:C}),{revision:C,activeRegion:$.activeRegion}},A=async(U,h,$)=>{let D=h.requestedRegion,C=E.targets($.id).find((W)=>W.region===D);if(!C)throw Error("Requested regional target was not found.");E.updateTopology($.id,{status:h.kind==="failover"?"failing_over":"failing_back"}),R(U,h,`health:${D}`);let J=await T(C).health({target:C});if(!J.healthy)throw Error(`Target region ${D} is unhealthy.`);E.updateTarget(C.id,{status:"ready",health:J.evidence,lastHealthyAt:new Date().toISOString()}),R(U,h,`replication:${D}`);for(let W of E.channels($.id).filter((H)=>H.targetRegion===D)){let H=await T(C).verifyReplication({channel:W,topology:$});if(!H.healthy||H.lagSeconds>$.dataPolicy.maxLagSeconds)throw Error(`${W.kind} replication is outside the failover RPO.`);E.updateChannel(W.id,{status:"in_sync",checkpoint:H.checkpoint,lagSeconds:H.lagSeconds,lastVerifiedAt:new Date().toISOString()})}R(U,h,`traffic:${D}`),await N($,Object.fromEntries($.regions.map((W)=>[W.region,W.region===D?100:0]))),R(U,h,`roles:${D}`);let I=$.regions.map((W)=>({...W,role:W.region===D?"primary":"secondary"}));for(let W of E.targets($.id))E.updateTarget(W.id,{role:W.region===D?"primary":"secondary"});return E.updateTopology($.id,{status:h.kind==="failover"?"failed_over":"ready",activeRegion:D,regions:I}),{activeRegion:D}},S=async(U,h,$,D)=>{E.updateTopology($.id,{status:"destroying"}),R(U,h,"traffic:drain"),await N($,Object.fromEntries($.regions.map((J)=>[J.region,0])));let C=D.deleteData!==!0;for(let J of E.targets($.id).sort((I,W)=>Number(I.role==="primary")-Number(W.role==="primary")))R(U,h,`delete:${J.region}`),E.updateTarget(J.id,{status:"deleting"}),await T(J).deleteStack({target:J,retainData:C,signal:U.signal}),E.updateTarget(J.id,{status:"deleted"});return R(U,h,"complete"),E.updateTopology($.id,{status:"destroyed"}),{destroyed:!0,dataRetained:C}},O=async(U)=>{let h=Ze(U.operation.input),$=E.execution(String(h.executionId??""));if(!$)throw Error("Regional execution was not found.");let D=E.get($.topologyId);if(!D)throw Error("Regional topology was not found.");try{let C;if($.kind==="rollout")C=await L(U,$,D,h);else if($.kind==="failover"||$.kind==="failback")C=await A(U,$,D);else if($.kind==="destroy")C=await S(U,$,D,h);else throw Error("Regional reconciliation is not configured.");return E.updateExecution($.id,{status:"succeeded",currentStep:void 0}),{executionId:$.id,...C}}catch(C){if(E.updateExecution($.id,{status:U.cancellationRequested()?"cancelled":"failed",error:C instanceof Error?C.message:String(C)}),E.get(D.id)?.status!=="destroyed")E.updateTopology(D.id,{status:"failed"});throw C}};return{"region.rollout":O,"region.failover":O,"region.failback":O,"region.destroy":O,"region.reconcile":O}}class xH{provider;reason;constructor(E,_="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=_}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function de(){let E=await o(),_=mE(process.cwd(),E),T=new $D(_.store),R=new DD(T);return{controlPlane:_,store:T,service:R}}async function H0(E){let _=await de();try{await E(_)}catch(T){q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var CD=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!T)throw Error("Regional topology was not found.");return T},qe=(E)=>E.split(",").map((_,T)=>{let[R,N="aws"]=_.split(":");return{region:String(R),provider:N,role:T===0?"primary":"secondary"}}),xe=(E)=>{let _=new Set(["s3","dynamodb","secrets"]),T=E.split(",").map((N)=>N.trim()),R=T.find((N)=>!_.has(N));if(R)throw Error(`Unsupported replication kind: ${R}`);return T};function yH(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(_)=>H0((T)=>{let R=T.store.list(T.controlPlane.project.id).map((N)=>({topology:N,targets:T.store.targets(N.id),channels:T.store.channels(N.id),route:T.store.route(N.id),executions:T.store.executions(N.id)}));if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Hostname","Active","Status","Revision","Replication"],R.map((N)=>[N.topology.name,N.topology.hostname,N.topology.activeRegion,N.topology.status,N.topology.revision??"—",`${N.channels.filter((L)=>L.status==="in_sync").length}/${N.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(_,T)=>H0((R)=>{if(!T.hostname||!T.regions)throw Error("--hostname and --regions are required.");let N=R.service.create({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,hostname:T.hostname,regions:qe(T.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:xe(String(T.replicate)),maxLagSeconds:Number(T.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!T.cdn,wafEnabled:!!T.waf});b(`Created ${N.name} (${N.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(_,T,R)=>H0((N)=>p(["Step"],N.service.plan(CD(N,_).id,T,R.target).map((L)=>[L])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(_,T,R)=>H0(async(N)=>{let L=R.manifest?await Bun.file(R.manifest).json():{},A=N.service.enqueue({topologyId:CD(N,_).id,kind:"rollout",revision:T,manifest:L});b(`Regional rollout queued: ${A.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(_,T)=>H0((R)=>{let N=R.service.enqueue({topologyId:CD(R,_).id,kind:"failover",targetRegion:T});b(`Failover queued: ${N.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(_,T)=>H0((R)=>{let N=R.service.enqueue({topologyId:CD(R,_).id,kind:"failback",targetRegion:T});b(`Failback queued: ${N.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(_,T)=>H0((R)=>{let N=R.service.enqueue({topologyId:CD(R,_).id,kind:"destroy",confirmation:T.confirm});b(`Regional teardown queued: ${N.operation.id}; replicated data remains retained.`)}))}kE();var XD="0.7.116";import{createHash as fH,createPublicKey as h4,verify as fe}from"node:crypto";function JD(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(JD).join(",")}]`;return`{${Object.keys(E).sort().map((_)=>`${JSON.stringify(_)}:${JD(E[_])}`).join(",")}}`}var $4=(E)=>fH("sha256").update(JD(E)).digest("hex"),M2=(E)=>fH("sha256").update(JD(E)).digest("hex"),D4=(E)=>fH("sha256").update(h4(E).export({type:"spki",format:"der"})).digest("hex");function C4(E,_,T){try{return fe(null,Buffer.from(JD(E)),h4(T),Buffer.from(_,"base64"))}catch{return!1}}var O4=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((_)=>Number(_)||0),U4=(E,_)=>{let T=O4(E),R=O4(_);for(let N=0;N<3;N++){let L=(T[N]??0)-(R[N]??0);if(L)return L}return 0};function X4(E,_){let T=[];if(_.schemaVersion<E.minimumSchema)T.push(`schema ${_.schemaVersion} is below ${E.minimumSchema}`);if(_.schemaVersion>E.maximumSchema)T.push(`schema ${_.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&U4(_.currentVersion,E.minimumVersion)<0)T.push(`platform ${_.currentVersion} is below ${E.minimumVersion}`);if(U4(E.version,_.currentVersion)<=0)T.push(`version ${E.version} is not newer than ${_.currentVersion}`);if(!E.artifacts.some((R)=>R.platform===_.platform&&R.architecture===_.architecture))T.push(`no artifact for ${_.platform}/${_.architecture}`);return{compatible:T.length===0,reasons:T}}var _A=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},VT=(E)=>E==null?void 0:String(E),ke=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:VT(E.revoked_at),createdAt:String(E.created_at)}),J4=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:_A(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:_A(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),I4=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:_A(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),F4=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:VT(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:_A(E.health_gate,{}),status:String(E.status),currentStage:VT(E.current_stage),backupId:VT(E.backup_id),approvedBy:VT(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),kH=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:VT(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:_A(E.evidence,{}),error:VT(E.error),startedAt:VT(E.started_at),finishedAt:VT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),W4=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:_A(E.criteria,{}),candidates:_A(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:VT(E.confirmation),expiresAt:String(E.expires_at),result:_A(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),z4=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:VT(E.backup_policy_id),recoveryPointId:VT(E.recovery_point_id),topologyId:VT(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:VT(E.operation_id),evidence:_A(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:VT(E.error),startedAt:VT(E.started_at),finishedAt:VT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class ID{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}addTrustedKey(E){let _=this.id(),T=this.now().toISOString(),R=D4(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[_,E.organizationId,E.name,E.publicKeyPem,R,T]),this.key(_)}key(E){let _=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return _?ke(_):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let _=this.key(E.keyId);if(!_||_.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(_.revokedAt)throw Error("Update signing key is revoked.");if(!C4(E.document,E.signature,_.publicKeyPem))throw Error("Update manifest signature is invalid.");let T=X4(E.document,E.current),R=$4(E.document),N=this.id(),L=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[N,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,R,JSON.stringify(E.document),E.signature,JSON.stringify(T),L]),this.manifest(N)}manifest(E){let _=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return _?J4(_):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(J4)}createWindow(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[_,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,T,T]),this.window(_)}window(E){let _=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return _?I4(_):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(I4)}createCampaign(E){return this.control.transaction(()=>{let _=this.manifest(E.manifestId);if(!_?.compatibility.compatible||_.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let T=this.id(),R=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[T,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,R,R]),E.targets.forEach((N,L)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,N.serverId??null,N.target,E.strategy==="canary"?L===0?0:1+Math.floor((L-1)/E.batchSize):Math.floor(L/E.batchSize),N.previousVersion,R,R])),this.campaign(T)})}campaign(E){let _=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return _?F4(_):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(F4)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(kH)}updateCampaign(E,_){let T=this.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let R={...T,..._};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[R.status,R.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!T)throw Error("Upgrade target was not found.");let R={...kH(T),..._};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[R.status,JSON.stringify(R.evidence),R.error??null,R.startedAt??null,R.finishedAt??null,this.now().toISOString(),E]),kH(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let _=[...E.candidates].sort((A,S)=>A.id.localeCompare(S.id)),T=M2(_),R=this.id(),N=this.now().toISOString(),L=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[R,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(_),T,_.reduce((A,S)=>A+S.bytes,0),L,N,N]),this.cleanup(R)}cleanup(E){let _=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return _?W4(_):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(W4)}updateCleanup(E,_){let T=this.cleanup(E);if(!T)throw Error("Cleanup plan was not found.");let R={...T,..._};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[R.status,R.confirmation??null,JSON.stringify(R.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[_,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,T,T]),this.drill(_)}drill(E){let _=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return _?z4(_):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(z4)}updateDrill(E,_){let T=this.drill(E);if(!T)throw Error("DR drill was not found.");let R={...T,..._};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[R.status,R.operationId??null,JSON.stringify(R.evidence),R.measuredRpoMinutes??null,R.measuredRtoMinutes??null,R.cleanupVerified?1:0,R.error??null,R.startedAt??null,R.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}await g_();function be(E,_=new Date){if(!E.enabled)return!1;let T=new Date(E.schedule);if(!Number.isNaN(T.getTime()))return _>=T&&_.getTime()<=T.getTime()+E.durationMinutes*60000;let R=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!R)return!1;let N=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(_),L=Number(N.find((S)=>S.type==="hour")?.value)*60+Number(N.find((S)=>S.type==="minute")?.value),A=Number(R[1])*60+Number(R[2]);return L>=A&&L<A+E.durationMinutes}class FD{store;now;queue;constructor(E,_,T=()=>new Date){this.store=E;this.now=T;this.queue=_??new pE(E.control)}enqueueCampaign(E,_={}){let T=this.store.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let R=T.windowId?this.store.window(T.windowId):void 0;if(R&&!R.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(R&&!_.overrideWindow&&!be(R,this.now()))throw Error("Upgrade is outside its maintenance window.");if(R?.requireApproval&&!_.approvedBy&&!T.approvedBy)throw Error("Maintenance approval is required.");let N=this.queue.enqueue({projectId:T.projectId,actorId:_.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:N}}async previewCleanup(E,_){let T=_.find((R)=>R.kind===E.kind);if(!T)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await T.discover(E.criteria)})}enqueueCleanup(E,_){let T=this.store.cleanup(E);if(!T||T.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(T.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let R=`DELETE ${T.candidates.length} ${T.kind}`;if(_!==R)throw Error(`Exact confirmation ${R} is required.`);let N=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${T.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:_}),operation:N}}enqueueDrill(E){let _=this.store.drill(E);if(!_||_.status!=="planned")throw Error("A planned DR drill is required.");let T=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${_.scenario}:${_.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:T.id}),operation:T}}}var bH=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function B4(E){return{"maintenance.upgrade":async(N)=>{let L=E.store.campaign(String(bH(N.operation.input).campaignId??""));if(!L||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let A=E.store.manifest(L.manifestId);if(!A?.compatibility.compatible||A.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let S=A.document.artifacts.find((U)=>U.platform===process.platform&&U.architecture===process.arch)??A.document.artifacts[0];if(!S)throw Error("No update artifact matches this platform.");E.store.updateCampaign(L.id,{status:"running",currentStage:"preflight"});let O=[];try{for(let U of[...new Set(E.store.targets(L.id).map((h)=>h.cohort))].sort((h,$)=>h-$)){E.store.updateCampaign(L.id,{currentStage:`cohort:${U}`});for(let h of E.store.targets(L.id).filter(($)=>$.cohort===U)){N.throwIfCancellationRequested(),N.checkpoint(`download:${h.target}`,"Downloading signed platform artifact."),E.store.updateTarget(h.id,{status:"downloading",startedAt:new Date().toISOString()});let $=await E.platform.download({target:h,artifact:S,signal:N.signal});if($.sha256!==S.sha256)throw Error(`Artifact checksum mismatch for ${h.target}.`);N.checkpoint(`install:${h.target}`,"Installing verified artifact."),E.store.updateTarget(h.id,{status:"installing"}),await E.platform.install({target:h,path:$.path,version:A.version,signal:N.signal}),O.push(h);let D=await E.platform.health({target:h,gate:L.healthGate});if(!D.healthy)throw Error(`Upgrade health gate failed for ${h.target}.`);E.store.updateTarget(h.id,{status:"healthy",evidence:D.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(L.id,{status:"succeeded",currentStage:void 0}),{campaignId:L.id,version:A.version,targets:O.length}}catch(U){E.store.updateCampaign(L.id,{status:"rolling_back",currentStage:"rollback"});for(let h of O.reverse())E.store.updateTarget(h.id,{status:"rolling_back"}),await E.platform.rollback({target:h,version:h.previousVersion,signal:N.signal}),E.store.updateTarget(h.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(L.id,{status:"rolled_back",currentStage:void 0}),U}},"maintenance.cleanup":async(N)=>{let L=E.store.cleanup(String(bH(N.operation.input).planId??""));if(!L||L.status!=="approved")throw Error("Approved cleanup plan was not found.");if(M2([...L.candidates].sort((h,$)=>h.id.localeCompare($.id)))!==L.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let A=E.cleanup?.find((h)=>h.kind===L.kind);if(!A)throw Error(`No ${L.kind} cleanup driver is configured.`);E.store.updateCleanup(L.id,{status:"running"});let S=[],O=[];for(let h of L.candidates){N.throwIfCancellationRequested();try{await A.remove(h),S.push(h.id)}catch($){O.push({id:h.id,error:$ instanceof Error?$.message:String($)})}}let U=O.length?S.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(L.id,{status:U,result:{removed:S,failed:O,reclaimedBytes:L.candidates.filter((h)=>S.includes(h.id)).reduce((h,$)=>h+$.bytes,0)}}),O.length)throw Error(`Cleanup failed for ${O.length} candidate(s).`);return{planId:L.id,removed:S.length,reclaimedBytes:L.estimatedBytes}},"maintenance.drill":async(N)=>{let L=E.store.drill(String(bH(N.operation.input).drillId??""));if(!L)throw Error("DR drill was not found.");let A=E.recovery?.find(($)=>$.scenario===L.scenario);if(!A)throw Error(`No ${L.scenario} recovery driver is configured.`);let S=new Date;E.store.updateDrill(L.id,{status:"restoring",startedAt:S.toISOString()});let O=L.isolatedTarget,U={},h={};try{N.checkpoint("restore","Restoring into isolated drill target.");let $=await A.restore({drill:L,signal:N.signal});if(!$.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");O=$.target,U=$.evidence;let D=(S.getTime()-new Date($.recoveryPointAt).getTime())/60000;E.store.updateDrill(L.id,{status:"verifying",measuredRpoMinutes:D,evidence:{restore:U}}),N.checkpoint("verify","Running recovery health checks without production traffic.");let C=await A.verify({drill:L,target:O});h=C.evidence;let J=(Date.now()-S.getTime())/60000;if(!C.healthy||D>L.expectedRpoMinutes||J>L.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(L.id,{measuredRpoMinutes:D,measuredRtoMinutes:J,evidence:{restore:U,verify:h}})}catch($){throw E.store.updateDrill(L.id,{status:"failed",error:$ instanceof Error?$.message:String($),evidence:{restore:U,verify:h}}),$}finally{E.store.updateDrill(L.id,{status:"cleaning"});try{await A.cleanup({drill:L,target:O});let $=E.store.drill(L.id);E.store.updateDrill(L.id,{status:$.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch($){E.store.updateDrill(L.id,{status:"cleanup_required",cleanupVerified:!1,error:$ instanceof Error?$.message:String($),finishedAt:new Date().toISOString()})}}return{drillId:L.id,status:E.store.drill(L.id).status}}}}var H4={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class WD{kind;control;projectId;organizationId;constructor(E,_,T,R){this.kind=E;this.control=_;this.projectId=T;this.organizationId=R}async discover(E){let _=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),T=new Date(Date.now()-_*86400000).toISOString(),R=H4[this.kind],N=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(R.select).all(N,T).map((A)=>({id:String(A.id),kind:this.kind,label:`${this.kind}:${String(A.id)}`,bytes:Number(A.bytes??0),metadata:{createdAt:String(A.created_at)}}))}async remove(E){if(this.control.database.run(H4[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function ge(){let E=await o(),_=mE(process.cwd(),E),T=new ID(_.store),R=new FD(T),N=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new WD(L,_.store,_.project.id,_.organization.id));return{controlPlane:_,store:T,service:R,cleanup:N}}async function TA(E){let _=await ge();try{await E(_)}catch(T){q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}function gH(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(_)=>TA((T)=>{let R={manifests:T.store.manifests(T.controlPlane.organization.id),windows:T.store.windows(T.controlPlane.project.id),campaigns:T.store.campaigns(T.controlPlane.project.id),cleanups:T.store.cleanups(T.controlPlane.project.id),drills:T.store.drills(T.controlPlane.project.id)},N=[...R.manifests.map((L)=>["update",L.version,L.compatibility.compatible?"compatible":"blocked",L.compatibility.reasons.join("; ")||L.channel]),...R.campaigns.map((L)=>["upgrade",L.id,L.status,L.currentStage??L.fromVersion]),...R.cleanups.map((L)=>["cleanup",L.kind,L.status,`${L.candidates.length} items / ${L.estimatedBytes} bytes`]),...R.drills.map((L)=>["DR drill",L.scenario,L.status,L.isolatedTarget])];if(_.json)console.log(JSON.stringify(R,null,2));else p(["Area","Name / version","Status","Detail"],N)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(_,T)=>TA(async(R)=>{let N=R.store.addTrustedKey({organizationId:R.controlPlane.organization.id,name:_,publicKeyPem:await Bun.file(T).text()});b(`Trusted ${N.name}: ${N.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(_,T,R)=>TA(async(N)=>{let L=await Bun.file(_).json(),A=(await Bun.file(T).text()).trim(),S=N.store.importManifest({organizationId:N.controlPlane.organization.id,keyId:R,document:L,signature:A,current:{schemaVersion:N.controlPlane.store.health().schemaVersion,currentVersion:XD,platform:process.platform,architecture:process.arch}});b(`Verified ${S.version}; ${S.compatibility.compatible?"compatible":"blocked: "+S.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(_,T,R)=>TA((N)=>{let L=N.store.createWindow({projectId:N.controlPlane.project.id,name:_,schedule:T,timezone:R.timezone,durationMinutes:Number(R.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});b(`Created ${L.name} (${L.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(_,T,R)=>TA((N)=>{let L=new CL(N.controlPlane.store).list(N.controlPlane.project.id).filter((O)=>O.status==="ready").map((O)=>({serverId:O.id,target:O.name,previousVersion:O.bootstrapVersion??XD}));if(!L.length)L.push({target:"control-plane",previousVersion:XD});let A=N.store.createCampaign({projectId:N.controlPlane.project.id,manifestId:_,fromVersion:XD,strategy:R.strategy==="rolling"?"rolling":"canary",batchSize:Number(R.batch),healthGate:{kind:"platform"},backupId:T,targets:L}),S=N.service.enqueueCampaign(A.id);b(`Staged upgrade queued: ${S.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(_,T)=>TA(async(R)=>{let N=await R.service.previewCleanup({projectId:R.controlPlane.project.id,kind:_,criteria:{olderThanDays:Number(T.olderThan)}},R.cleanup);p(["ID","Candidate","Bytes"],N.candidates.map((L)=>[L.id,L.label,String(L.bytes)])),X(`Apply with: cloud cleanup:apply ${N.id} --confirm "DELETE ${N.candidates.length} ${N.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(_,T)=>TA((R)=>{let N=R.service.enqueueCleanup(_,String(T.confirm??""));b(`Cleanup queued: ${N.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(_,T,R)=>TA((N)=>{let L=N.store.createDrill({projectId:N.controlPlane.project.id,scenario:_,isolatedTarget:T,expectedRpoMinutes:Number(R.rpo),expectedRtoMinutes:Number(R.rto),recoveryPointId:R.recoveryPoint,topologyId:R.topology});b(`Planned isolated drill ${L.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(_)=>TA((T)=>{let R=T.service.enqueueDrill(_);b(`DR drill queued: ${R.operation.id}`)}))}kE();$S();vR();async function cH(){try{return(await o()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function vH(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(_)=>{r("Lambda Functions");let T=_?.region||await cH(),R=new K_(T);try{let{Functions:N=[]}=await R.listFunctions({MaxItems:50});if(!N.length){X("No functions found");return}p(["Name","Runtime","Memory","Timeout","Last Modified"],N.map((L)=>[L.FunctionName??"-",L.Runtime??"-",L.MemorySize?`${L.MemorySize} MB`:"-",L.Timeout?`${L.Timeout}s`:"-",L.LastModified??"-"]))}catch(N){q(`Failed to list functions: ${N.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(_,T)=>{r(`Invoking ${_}`);let R=T?.region||await cH(),N=new K_(R),L=new l("Invoking function...");L.start();try{let A=await N.invoke({FunctionName:_,InvocationType:T?.async?"Event":"RequestResponse",Payload:T?.payload||"{}",LogType:T?.async?"None":"Tail"});if(A.FunctionError){if(L.fail(`Function returned an error (${A.FunctionError})`),A.Payload)X(A.Payload);process.exitCode=1;return}if(L.succeed(`Invoked (status ${A.StatusCode})`),A.Payload)X(`
 Response:`),X(A.Payload);if(A.LogResult)X(`
 Logs:`),X(Buffer.from(A.LogResult,"base64").toString("utf-8"))}catch(A){L.fail(`Invocation failed: ${A.message}`),process.exitCode=1}}),E.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(_,T)=>{r(`Logs for ${_}`);let R=T?.region||await cH(),N=new wR(R),L=_.startsWith("/aws/lambda/")?_:`/aws/lambda/${_}`,A=Number(T?.since??15),S=(O)=>{for(let U of O){let h=U.timestamp?new Date(U.timestamp).toISOString():"";X(`${h}  ${(U.message??"").trimEnd()}`)}};try{let O=Date.now()-A*60000,{events:U=[]}=await N.filterLogEvents({logGroupName:L,startTime:O,filterPattern:T?.filter,limit:200});if(S(U),U.length)O=(U[U.length-1].timestamp??O)+1;if(T?.tail){X(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise(($)=>setTimeout($,3000));let{events:h=[]}=await N.filterLogEvents({logGroupName:L,startTime:O,filterPattern:T?.filter,limit:200});if(h.length)S(h),O=(h[h.length-1].timestamp??O)+1}}}catch(O){q(`Failed to read logs: ${O.message}`),process.exitCode=1}})}kE();async function Y4(E){let _=Bun.spawn(["docker",...E],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[T,R]=await Promise.all([_.exited,new Response(_.stderr).text()]);return{ok:T===0,exitCode:T,command:["docker",...E].join(" "),stderr:R.trim()}}function rH(E){E.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(_)=>{let T=["build","--file",_.file??"Dockerfile","--tag",_.tag??"latest","."];if(_.dryRun){console.log(`docker ${T.join(" ")}`);return}let R=await Y4(T);if(_.json)console.log(JSON.stringify(R));if(!R.ok)q(R.stderr||`docker exited ${R.exitCode}`),process.exitCode=R.exitCode;else b(`Built ${_.tag??"latest"}.`)}),E.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(_)=>{if(!_.image){q("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(_.dryRun){console.log(`docker push ${_.image}`);return}let T=await Y4(["push",_.image]);if(_.json)console.log(JSON.stringify(T));if(!T.ok)q(T.stderr),process.exitCode=T.exitCode;else b(`Pushed ${_.image}.`)}),E.command("container:deploy","Deploy a container image").action(async()=>ON("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}kE();nL();OL();function uH(E){E.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(_)=>{r("Domains");try{let T=UL(_?.provider),R=gR(_?.provider)?.provider||"unknown",N=new l(`Fetching domains from ${R}...`);N.start();let L=await T.listDomains();if(N.succeed(`Found ${L.length} domain(s)`),L.length===0){X("No domains found in this provider");return}let A=L.map((S)=>[S,"Active","-",R.charAt(0).toUpperCase()+R.slice(1)]);p(["Domain","Status","SSL","Provider"],A)}catch(T){q(`Failed to list domains: ${T instanceof Error?T.message:String(T)}`)}}),E.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(_,T)=>{r(`Adding Domain: ${_}`);try{let R=UL(T?.provider),N=gR(T?.provider)?.provider||"unknown",L=new l(`Checking if ${N} can manage ${_}...`);if(L.start(),await R.canManageDomain(_))L.succeed(`Domain ${_} is already available in ${N}`),X(`
@@ -10150,14 +10150,14 @@ Invalidation is in progress. Use --wait to wait for completion.`)}catch(T){q(`In
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,E.organizationId,E.projectId,E.environmentId??null,E.releaseId,E.kind,E.format,E.digest,tN(E.summary),E.content??null,E.sensitive?1:0,R]),this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,type:"security.release_artifact.created",payload:{artifactId:T,releaseId:E.releaseId,kind:E.kind,format:E.format,digest:E.digest,sensitive:E.sensitive}}),uY(this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE id = ?").get(T))}listReleaseArtifacts(E,_=!1){return this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? ORDER BY created_at, kind").all(E).map(uY).map((T)=>T.sensitive&&!_?{...T,content:void 0}:T)}summary(E,_,T){let R=this.listFindings({organizationId:E,projectId:_,environmentId:T,limit:1000}),N=this.listScanRuns({organizationId:E,projectId:_,environmentId:T,limit:1000}),L={info:0,low:0,medium:0,high:0,critical:0};for(let S of R)if(S.status==="open"||S.status==="acknowledged")L[S.severity]++;let A={passed:0,failed:0,skipped:0,unavailable:0,unsupported:0,stale:0};for(let S of N)A[S.status]++;return{open:L,waived:R.filter((S)=>S.status==="waived").length,resolved:R.filter((S)=>S.status==="resolved").length,checks:A,lastScannedAt:N[0]?.completedAt}}exportPosture(E){let _=this.controlPlane.listProjects().filter((T)=>T.organizationId===E);return rE({format:"ts-cloud-security-posture",version:1,exportedAt:this.now(),organizationId:E,policies:this.listPolicies(E),findings:this.listFindings({organizationId:E,limit:1000}),waivers:this.listWaivers().filter((T)=>this.getFinding(T.findingId)?.organizationId===E),scans:_.flatMap((T)=>this.listScanRuns({organizationId:E,projectId:T.id,limit:1000})),decisions:_.flatMap((T)=>this.controlPlane.listEnvironments(T.id).flatMap((R)=>this.listDecisions(R.id,1000)))})}}WO();i0();import{existsSync as $EE,readdirSync as DEE,readFileSync as CEE,statSync as XEE}from"node:fs";import{extname as JEE,join as IEE,relative as FEE}from"node:path";var md=[{name:"AWS Access Key ID",pattern:/(?:^|[^A-Z0-9])((AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16})(?:[^A-Z0-9]|$)/g,severity:"critical",description:"AWS Access Key ID detected"},{name:"AWS Secret Access Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key|secretAccessKey)['"]?\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,severity:"critical",description:"AWS Secret Access Key detected"},{name:"AWS Secret Key (Generic)",pattern:/(?:^|['"`:=\s])([A-Za-z0-9/+=]{40})(?:['"`\s]|$)/g,severity:"high",description:"Potential AWS Secret Key (40-char base64)"},{name:"Generic API Key",pattern:/(?:api[_-]?key|apikey|api[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9_\-]{20,})['"]?/gi,severity:"high",description:"Generic API key detected"},{name:"RSA Private Key",pattern:/-----BEGIN RSA PRIVATE KEY-----/g,severity:"critical",description:"RSA private key detected"},{name:"OpenSSH Private Key",pattern:/-----BEGIN OPENSSH PRIVATE KEY-----/g,severity:"critical",description:"OpenSSH private key detected"},{name:"EC Private Key",pattern:/-----BEGIN EC PRIVATE KEY-----/g,severity:"critical",description:"EC private key detected"},{name:"PGP Private Key",pattern:/-----BEGIN PGP PRIVATE KEY BLOCK-----/g,severity:"critical",description:"PGP private key detected"},{name:"GitHub Token",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"critical",description:"GitHub personal access token detected"},{name:"GitHub OAuth",pattern:/github[_-]?oauth[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9_]{40})['"]?/gi,severity:"critical",description:"GitHub OAuth token detected"},{name:"Slack Token",pattern:/xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*/g,severity:"critical",description:"Slack token detected"},{name:"Slack Webhook",pattern:/https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g,severity:"high",description:"Slack webhook URL detected"},{name:"Discord Webhook",pattern:/https:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]+/g,severity:"high",description:"Discord webhook URL detected"},{name:"JWT Token",pattern:/eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,severity:"high",description:"JWT token detected"},{name:"Google API Key",pattern:/AIza[0-9A-Za-z_-]{35}/g,severity:"critical",description:"Google API key detected"},{name:"Google OAuth ID",pattern:/[0-9]+-[A-Za-z0-9_]{32}\.apps\.googleusercontent\.com/g,severity:"high",description:"Google OAuth client ID detected"},{name:"Firebase API Key",pattern:/(?:firebase[_-]?api[_-]?key)\s*[=:]\s*['"]?([A-Za-z0-9_-]{39})['"]?/gi,severity:"critical",description:"Firebase API key detected"},{name:"Cloudflare API Token",pattern:/(?:cloudflare[_-]?api[_-]?token|cf[_-]?api[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{40})['"]?/gi,severity:"critical",description:"Cloudflare API token detected"},{name:"Azure Client Secret",pattern:/(?:azure[_-]?client[_-]?secret|client[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9~._-]{34,})['"]?/gi,severity:"critical",description:"Azure client secret detected"},{name:"Heroku API Key",pattern:/(?:heroku[_-]?api[_-]?key)\s*[=:]\s*['"]?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]?/gi,severity:"critical",description:"Heroku API key detected"},{name:"Database Connection String",pattern:/(?:mysql|postgres|postgresql|mongodb|redis|mongodb\+srv):\/\/[^:]+:[^@]+@[^/\s]+/gi,severity:"critical",description:"Database connection string with credentials detected"},{name:"Database Password",pattern:/(?:db[_-]?password|database[_-]?password|mysql[_-]?password|postgres[_-]?password)\s*[=:]\s*['"]?([^'"\s]{8,})['"]?/gi,severity:"critical",description:"Database password detected"},{name:"Stripe API Key",pattern:/(?:sk|pk)_(?:test|live)_[0-9a-zA-Z]{24,}/g,severity:"critical",description:"Stripe API key detected"},{name:"PayPal Client ID",pattern:/(?:paypal[_-]?client[_-]?id)\s*[=:]\s*['"]?([A-Za-z0-9_-]{80})['"]?/gi,severity:"high",description:"PayPal client ID detected"},{name:"Square Access Token",pattern:/sq0[a-z]{3}-[0-9A-Za-z_-]{22,}/g,severity:"critical",description:"Square access token detected"},{name:"Twilio API Key",pattern:/SK[a-f0-9]{32}/g,severity:"critical",description:"Twilio API key detected"},{name:"SendGrid API Key",pattern:/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,severity:"critical",description:"SendGrid API key detected"},{name:"Mailgun API Key",pattern:/key-[0-9a-zA-Z]{32}/g,severity:"critical",description:"Mailgun API key detected"},{name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"]([^'"]{8,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded password detected"},{name:"Secret/Token Assignment",pattern:/(?:secret|token|auth[_-]?token|access[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9_\-/+=]{16,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded secret or token detected"},{name:"NPM Token",pattern:/(?:npm[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{36})['"]?/gi,severity:"critical",description:"NPM token detected"},{name:"SSH Private Key Path Exposed",pattern:/~\/\.ssh\/id_[a-z]+|\/home\/[^/]+\/\.ssh\/id_[a-z]+/g,severity:"medium",description:"SSH private key path exposed"},{name:"Env Variable with Secret",pattern:/(?:process\.env\.)((?=[A-Z_]*(?:SECRET|KEY|TOKEN|PASSWORD|CREDENTIAL|AUTH))[A-Z_]+)\s*(?:===?\s*['"]([^'"]+)['"])?/g,severity:"medium",description:"Environment variable containing secret may be exposed"}],WEE=[".js",".jsx",".ts",".tsx",".mjs",".cjs",".vue",".svelte",".html",".htm",".css",".scss",".less",".json",".yaml",".yml",".toml",".xml",".env",".config",".conf"],zEE=["node_modules",".git",".svn",".hg","dist","build","coverage",".nyc_output","__pycache__",".pytest_cache","vendor",".idea",".vscode",".turbo",".next",".nuxt","framework.bak","pantry",".pantry","tests","test","__tests__","spec","__mocks__",".github",".gitlab",".circleci"],BEE=["package-lock.json","yarn.lock","pnpm-lock.yaml","bun.lockb","bun.lock","*.min.js","*.min.css","*.map","*.d.ts","*.test.ts","*.test.js","*.spec.ts","*.spec.js",".env",".env.*"];class Fh{patterns;excludeDirs;excludeFiles;maxFileSize;constructor(E){this.patterns=[...md,...E?.customPatterns||[]],this.excludeDirs=[...zEE,...E?.excludeDirs||[]],this.excludeFiles=[...BEE,...E?.excludeFiles||[]],this.maxFileSize=E?.maxFileSize||1048576}async scan(E){let _=Date.now(),T=[],R=0,{directory:N,exclude:L=[],include:A,skipPatterns:S=[]}=E,O=E.failOnSeverity||"critical";if(!$EE(N))throw Error(`Directory not found: ${N}`);let U=this.getFilesToScan(N,[...this.excludeDirs,...L],A);for(let J of U){let I=FEE(N,J);if(this.shouldExcludeFile(I))continue;try{if(XEE(J).size>this.maxFileSize)continue;let H=CEE(J,"utf-8"),w=this.scanContent(H,I,S);T.push(...w),R++}catch{continue}}let h={critical:T.filter((J)=>J.pattern.severity==="critical").length,high:T.filter((J)=>J.pattern.severity==="high").length,medium:T.filter((J)=>J.pattern.severity==="medium").length,low:T.filter((J)=>J.pattern.severity==="low").length},$=["low","medium","high","critical"],D=$.indexOf(O),C=!0;for(let J=D;J<$.length;J++)if(h[$[J]]>0){C=!1;break}return{passed:C,findings:T,scannedFiles:R,duration:Date.now()-_,summary:h}}scanContent(E,_,T){let R=[],N=E.split(`
 `);for(let L of this.patterns){if(T.includes(L.name))continue;L.pattern.lastIndex=0;let A;while((A=L.pattern.exec(E))!==null){let S=E.substring(0,A.index),O=S.split(`
 `).length,U=S.lastIndexOf(`
-`),h=A.index-U,$=N[O-1]||"";if(this.isLikelyPlaceholder(A[0],$))continue;let D=A[1]||A[0];if(L.name==="AWS Secret Key (Generic)"&&/^[a-f0-9]{40}$/i.test(D))continue;if(L.name==="AWS Secret Key (Generic)"&&!this.hasSecretCharacterDiversity(D))continue;if(L.name==="AWS Secret Key (Generic)"&&/^(?:Actions|Commands|Controllers|Handlers|Jobs|Listeners|Middleware|Models|Resources|Services)\//.test(D))continue;if(this.isLowEntropy(D))continue;R.push({file:_,line:O,column:h,match:this.maskSecret(A[0]),pattern:L,context:this.maskSecret($.trim())})}}return R}isLikelyPlaceholder(E,_){let T=["example","placeholder","your_","YOUR_","xxx","XXX","***","test","TEST","dummy","DUMMY","fake","FAKE","sample","SAMPLE","<your","${","{{","process.env","import.meta.env","CHANGEME","TODO","FIXME"],R=E.toLowerCase(),N=_.toLowerCase();for(let A of T)if(R.includes(A.toLowerCase())||N.includes(A.toLowerCase()))return!0;let L=_.trim();if(L.startsWith("//")||L.startsWith("#")||L.startsWith("*")||L.startsWith("/*")){if(N.includes("example")||N.includes("format:")||N.includes("e.g."))return!0}return!1}isLowEntropy(E){if(E.length<8)return!1;if(new Set(E).size<8)return!0;if(/(.)\1{3,}/.test(E))return!0;return!1}hasSecretCharacterDiversity(E){let _=/[\d+=]/.test(E),T=[/[a-z]/.test(E),/[A-Z]/.test(E),/\d/.test(E),/[/+=]/.test(E)];return _&&T.filter(Boolean).length>=3}maskSecret(E){if(E.length<=8)return"*".repeat(E.length);let _=Math.min(4,Math.floor(E.length*0.2));return E.substring(0,_)+"*".repeat(E.length-_*2)+E.substring(E.length-_)}getFilesToScan(E,_,T){let R=[],N=T||WEE,L=(A)=>{let S=DEE(A,{withFileTypes:!0});for(let O of S){let U=IEE(A,O.name);if(O.isDirectory()){if(!_.includes(O.name))L(U)}else if(O.isFile()){let h=JEE(O.name).toLowerCase();if(N.includes(h)||O.name.startsWith(".env")||O.name.endsWith(".config"))R.push(U)}}};return L(E),R}shouldExcludeFile(E){let _=E.split("/").pop()||"";for(let T of this.excludeFiles)if(T.startsWith("*")){let R=T.substring(1);if(_.endsWith(R))return!0}else if(T.endsWith("*")){let R=T.substring(0,T.length-1);if(_.startsWith(R))return!0}else if(_===T)return!0;return!1}addPattern(E){this.patterns.push(E)}getPatterns(){return[...this.patterns]}}function HEE(E,_){return{status:"unavailable",findings:[],error:`${E.id} exceeded its ${_}ms timeout`,metadata:{timeoutMs:_}}}class s0{posture;defaultTimeoutMs;nowFn;constructor(E,_={}){this.posture=E;this.defaultTimeoutMs=_.defaultTimeoutMs??60000,this.nowFn=_.now??(()=>new Date)}async run(E,_){let T=this.nowFn(),R=Math.max(100,E.timeoutMs??this.defaultTimeoutMs),N=new AbortController,L,A=new Promise((h)=>{L=setTimeout(()=>{N.abort(),h(HEE(E,R))},R)}),S;try{S=await Promise.race([E.scan({..._,signal:N.signal}),A])}catch(h){S={status:"unavailable",findings:[],error:h instanceof Error?h.message:String(h)}}finally{if(L)clearTimeout(L)}let O=this.nowFn(),U={..._,scannerId:E.id,scannerVersion:E.version,status:S.status,findings:S.findings,metadata:S.metadata,error:S.error,startedAt:T.toISOString(),completedAt:O.toISOString(),durationMs:Math.max(0,O.getTime()-T.getTime())};return this.posture.recordScan(U)}async runAll(E,_){return Promise.all(E.map((T)=>this.run(T,_)))}}class x1{scanner;id="source-secrets";version="1.0.0";timeoutMs=30000;constructor(E=new Fh){this.scanner=E}async scan(E){if(!E.artifactRoot)return{status:"skipped",findings:[],error:"No artifact root was supplied"};let _=await this.scanner.scan({directory:E.artifactRoot,failOnSeverity:"critical"});return{status:_.passed?"passed":"failed",findings:_.findings.map((T)=>({...E,ruleId:T.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:T.pattern.severity,title:T.pattern.name,description:T.pattern.description,subject:`${T.file}:${T.line}`,evidence:{file:T.file,line:T.line,column:T.column,match:T.match,context:T.context},remediation:"Remove the credential, rotate it at its issuer, and use a managed secret or environment reference."})),metadata:{scannedFiles:_.scannedFiles,summary:_.summary}}}}function jEE(E){let _=E?.toLowerCase();return _==="critical"||_==="high"||_==="medium"||_==="low"?_:"info"}class mY{id="trivy-image";version;timeoutMs;constructor(E={}){this.version=E.version??"local",this.timeoutMs=E.timeoutMs??120000,this.executable=E.executable??"trivy"}executable;async scan(E){if(!E.imageRef)return{status:"skipped",findings:[],error:"No image reference was supplied"};let _;try{_=Bun.spawn([this.executable,"image","--format","json","--quiet","--scanners","vuln",E.imageRef],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",TRIVY_NO_PROGRESS:"true"}})}catch(O){return{status:"unsupported",findings:[],error:O instanceof Error?O.message:String(O)}}let T=()=>_.kill();E.signal.addEventListener("abort",T,{once:!0});let[R,N,L]=await Promise.all([_.exited,new Response(_.stdout).text(),new Response(_.stderr).text()]);if(E.signal.removeEventListener("abort",T),R!==0)return{status:/not found|enoent/i.test(L)?"unsupported":"unavailable",findings:[],error:L.slice(0,2000)||`Trivy exited with ${R}`};let A=JSON.parse(N),S=[];for(let O of A.Results??[])for(let U of O.Vulnerabilities??[]){let h=U.VulnerabilityID??"unknown-vulnerability";S.push({...E,ruleId:h,severity:jEE(U.Severity),title:U.Title||h,description:U.Description||`${h} affects ${U.PkgName??"an image package"}.`,subject:`${E.imageRef}:${U.PkgName??"unknown"}:${U.InstalledVersion??"unknown"}`,evidence:{image:E.imageRef,target:O.Target??"",cve:h,package:U.PkgName??"",installedVersion:U.InstalledVersion??"",fixedVersion:U.FixedVersion??"",reference:U.PrimaryURL??""},remediation:U.FixedVersion?`Upgrade ${U.PkgName} to ${U.FixedVersion} or later.`:"Remove or replace the affected package and rescan the image."})}return{status:S.length?"failed":"passed",findings:S,metadata:{imageRef:E.imageRef,vulnerabilityCount:S.length,localOnly:!0}}}}import{createHash as YEE,createVerify as jHE}from"node:crypto";import{existsSync as wEE,readFileSync as QEE}from"node:fs";import{basename as GEE,join as PEE,resolve as nd}from"node:path";function y1(E){return YEE("sha256").update(E).digest("hex")}function MEE(E){let _=[["dependencies","required"],["optionalDependencies","optional"],["devDependencies","excluded"],["peerDependencies","required"]],T=new Map;for(let[R,N]of _){let L=E[R];if(!L||typeof L!=="object"||Array.isArray(L))continue;for(let[A,S]of Object.entries(L)){let O=String(S).replace(/^[~^]/,""),U=`${A}@${O}`;if(!T.has(U))T.set(U,{type:"library",name:A,version:O,purl:`pkg:npm/${encodeURIComponent(A)}@${encodeURIComponent(O)}`,scope:N})}}return[...T.values()].sort((R,N)=>`${R.name}@${R.version}`.localeCompare(`${N.name}@${N.version}`))}function ed(E,_={}){let T=PEE(nd(E),"package.json");if(!wEE(T))throw Error(`Cannot generate an SBOM: ${T} was not found`);let R=QEE(T,"utf8"),N=JSON.parse(R),L=String(N.name??GEE(nd(E))),A=String(N.version??"0.0.0"),S=y1(R);return{bomFormat:"CycloneDX",specVersion:"1.5",serialNumber:_.serial??`urn:uuid:${crypto.randomUUID()}`,version:1,metadata:{timestamp:(_.now??new Date).toISOString(),component:{type:"application",name:L,version:A,purl:`pkg:npm/${encodeURIComponent(L)}@${encodeURIComponent(A)}`,hashes:[{alg:"SHA-256",content:S}]},tools:[{vendor:"ts-cloud",name:"security-posture",version:"1.0.0"}]},components:MEE(N)}}async function ad(E,_={}){let T=Bun.spawn([_.executable??"syft",E,"-o","cyclonedx-json"],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",SYFT_CHECK_FOR_APP_UPDATE:"false"}}),R=()=>T.kill();_.signal?.addEventListener("abort",R,{once:!0});let[N,L,A]=await Promise.all([T.exited,new Response(T.stdout).text(),new Response(T.stderr).text()]);if(_.signal?.removeEventListener("abort",R),N!==0)throw Error(A.slice(0,2000)||`Syft exited with ${N}`);return JSON.parse(L)}function nY(E,_,T){let R=JSON.stringify(T);return E.addReleaseArtifact({..._,kind:"sbom",format:`cyclonedx-${T.specVersion}+json`,digest:`sha256:${y1(R)}`,summary:{component:T.metadata.component.name,version:T.metadata.component.version,components:T.components.length},content:R,sensitive:!0})}function id(E,_,T){let R={total:T.length,critical:0,high:0,medium:0,low:0,info:0,fixable:0};for(let L of T){R[L.severity]++;let A=L.evidence;if(typeof A.fixedVersion==="string"&&A.fixedVersion)R.fixable++}let N=JSON.stringify({releaseId:_.releaseId,generatedAt:new Date().toISOString(),findings:T.map((L)=>({id:L.id,ruleId:L.ruleId,severity:L.severity,subject:L.subject,remediation:L.remediation}))});return E.addReleaseArtifact({..._,kind:"vulnerability_summary",format:"ts-cloud-vulnerability-summary+json",digest:`sha256:${y1(N)}`,summary:R,content:N,sensitive:!0})}function sd(E){if(!E.artifact&&!E.artifactSha256)throw Error("Release provenance requires artifact content or a SHA-256 digest");return{_type:"https://in-toto.io/Statement/v1",subject:[{name:E.artifactName,digest:{sha256:E.artifactSha256?.replace(/^sha256:/,"")??y1(E.artifact)}}],predicateType:"https://slsa.dev/provenance/v1",predicate:{buildDefinition:{buildType:"https://ts-cloud.dev/build/v1",externalParameters:E.externalParameters??{},internalParameters:{},resolvedDependencies:E.resolvedDependencies??[]},runDetails:{builder:{id:"https://ts-cloud.dev/builders/local/v1"},metadata:{invocationId:E.invocationId,startedOn:E.startedAt,finishedOn:E.completedAt}}}}}function pd(E,_,T){let R=JSON.stringify(T);return E.addReleaseArtifact({..._,kind:"provenance",format:"in-toto+slsa-v1+json",digest:`sha256:${y1(R)}`,summary:{subjects:T.subject.length,builder:T.predicate.runDetails.builder.id,buildType:T.predicate.buildDefinition.buildType},content:R,sensitive:!0})}function VR(E,_){let T=E.environments.get(_);if(!T)throw Error(`Security scope for environment '${_}' was not found`);return{organizationId:E.organization.id,projectId:E.project.id,environmentId:T.id}}function f1(E,_){let T=new qS(E.store),R=T.listPolicies(E.organization.id);for(let[N,L]of E.environments){if(R.some((S)=>S.environmentId===L.id))continue;let A=N==="production"||L.kind==="production";R.push(T.createPolicy({organizationId:E.organization.id,environmentId:L.id,name:A?"Production baseline":"Environment baseline",scannerFailMode:A?"closed":"open",requiredScanners:["source-secrets"],rules:A?[{minimumSeverity:"critical",action:"block"},{minimumSeverity:"high",action:"block"},{minimumSeverity:"medium",action:"warn"},{minimumSeverity:"low",action:"record"}]:[{minimumSeverity:"critical",action:"warn"},{minimumSeverity:"high",action:"warn"},{minimumSeverity:"low",action:"record"}],actorId:_}))}return R}function od(E,_,T,R={}){let N=T.findings.map((L)=>({..._,ruleId:L.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:L.pattern.severity,title:L.pattern.name,description:L.pattern.description,subject:`${L.file}:${L.line}`,evidence:{file:L.file,line:L.line,column:L.column,match:L.match,context:L.context},remediation:"Remove and rotate the credential, then reference it through a managed secret or environment variable."}));return E.recordScan({..._,scannerId:"source-secrets",scannerVersion:R.scannerVersion??"1.0.0",status:R.skipped?"skipped":T.passed?"passed":"failed",findings:R.skipped?[]:N,metadata:{scannedFiles:T.scannedFiles,durationMs:T.duration,summary:T.summary},durationMs:T.duration,error:R.skipped?"The operator explicitly skipped source-secret scanning.":void 0})}function E3(E,_,T="The operator explicitly skipped source-secret scanning."){return E.recordScan({..._,scannerId:"source-secrets",scannerVersion:"1.0.0",status:"skipped",findings:[],error:T})}function KEE(E,_){let T=[],R=_.security;if(R?.firewall&&!["active","configured","ok"].includes(String(R.firewall.status)))T.push({...E,ruleId:"host-firewall-disabled",severity:"high",title:"Host firewall is not active",description:String(R.firewall.summary??"The host firewall did not report an active configuration."),subject:"host:firewall",evidence:{status:String(R.firewall.status??"unknown"),rules:Array.isArray(R.firewall.rules)?R.firewall.rules.length:0},remediation:"Apply the declarative firewall policy and confirm only required listeners are public."});for(let N of R?.ports??[]){let L=String(N.listen??""),A=Number(L.match(/:(\d+)$/)?.[1]);if(N.exposure==="public"&&Number.isFinite(A)&&![22,80,443].includes(A))T.push({...E,ruleId:"unexpected-public-listener",severity:"medium",title:`Unexpected public listener on port ${A}`,description:`${String(N.processName??"A process")} is listening publicly outside the standard SSH/HTTP/HTTPS ports.`,subject:`host:port:${A}`,evidence:{protocol:String(N.proto??""),listen:L,process:String(N.processName??"")},remediation:"Bind the service to loopback/private networking or explicitly document and firewall the required public port."})}for(let N of R?.tlsCertificates??[]){let L=Number(N.daysRemaining);if(Number.isFinite(L)&&L<30)T.push({...E,ruleId:"tls-certificate-expiry",severity:L<14?"high":"medium",title:`TLS certificate expires in ${L} days`,description:`${String(N.domain??"A configured domain")} needs renewal.`,subject:`tls:${String(N.domain??"unknown")}`,evidence:{domain:String(N.domain??""),daysRemaining:L,expires:String(N.expires??"")},remediation:"Renew the certificate and verify automatic renewal can complete before expiry."})}for(let N of _.diagnostics??[]){if(N.status==="pass"||N.status==="ok")continue;T.push({...E,ruleId:`diagnostic-${String(N.name??"unknown").toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:N.status==="fail"?"high":"medium",title:String(N.name??"Host security check"),description:String(N.detail??"The host security diagnostic did not pass."),subject:`diagnostic:${String(N.name??"unknown")}`,evidence:{status:String(N.status??"unknown")},remediation:"Follow the diagnostic guidance, rerun the check, and confirm the finding resolves."})}return T}function BI(E,_,T){let R=!!T.security||Array.isArray(T.diagnostics),N=R?KEE(_,T):[];return E.recordScan({..._,scannerId:"host-posture",scannerVersion:"1.0.0",status:!R?"unavailable":N.length?"failed":"passed",findings:N,metadata:{source:"dashboard-live-probe",checks:Array.isArray(T.diagnostics)?T.diagnostics.length:0},error:R?void 0:"Live host posture data was unavailable; source and provider checks remain usable."})}function p0(E,_){let T=E.evaluateGate({..._.scope,operationId:_.operationId}),R=E.listFindings({..._.scope,limit:1000}).filter((N)=>N.status!=="resolved");return{decision:T,summary:{desiredConfigHash:_.desiredConfigHash??null,securityImpact:{critical:R.filter((N)=>N.severity==="critical").length,high:R.filter((N)=>N.severity==="high").length,waived:R.filter((N)=>N.status==="waived").length,assigned:R.filter((N)=>!!N.ownerActorId).length},blockingFindingIds:T.findingIds,policy:{id:T.policyId,version:T.policyVersion},scannerVersions:T.scannerVersions}}}async function _3(E,_){let T=_.scanner??new mY({timeoutMs:_.scannerTimeoutMs}),N=await new s0(E,{defaultTimeoutMs:_.scannerTimeoutMs??120000}).run(T,{..._.scope,releaseId:_.releaseId,imageRef:_.imageRef}),L={..._.scope,releaseId:_.releaseId};id(E,L,N.findings);let A=_.generateImageSbom??ad,S=new AbortController,O=Math.max(100,_.sbomTimeoutMs??120000),U,h=new Promise((C,J)=>{U=setTimeout(()=>{S.abort(),J(Error(`syft-sbom exceeded its ${O}ms timeout`))},O)}),$="unavailable";try{let C=await Promise.race([A(_.imageRef,{signal:S.signal}),h]);nY(E,L,C),E.recordScan({..._.scope,releaseId:_.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"passed",metadata:{imageRef:_.imageRef,format:`cyclonedx-${C.specVersion}+json`,components:C.components.length,localOnly:!0}}),$="image"}catch(C){let J=C instanceof Error?C.message:String(C);try{let I=ed(_.artifactRoot);nY(E,L,I),E.recordScan({..._.scope,releaseId:_.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unsupported",error:`Image inventory was unavailable; attached a package-manifest SBOM instead. ${J}`,metadata:{imageRef:_.imageRef,fallback:"package-manifest",components:I.components.length,localOnly:!0}}),$="manifest"}catch(I){E.recordScan({..._.scope,releaseId:_.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unavailable",error:`Image and manifest SBOM generation were unavailable. ${J}; ${I instanceof Error?I.message:String(I)}`,metadata:{imageRef:_.imageRef,localOnly:!0}})}}finally{if(U)clearTimeout(U)}let D=sd({artifactName:_.imageRef,artifact:_.imageSha256?void 0:_.imageRef,artifactSha256:_.imageSha256,invocationId:_.invocationId,startedAt:_.startedAt,completedAt:_.completedAt??new Date().toISOString(),externalParameters:_.externalParameters??{imageRef:_.imageRef}});return pd(E,L,D),{scan:N,sbomSource:$}}async function X_E(E){let _=qF();if(_.emptyEnvKey||_.emptyEnvSecret)_E("Empty AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY env var detected — likely a misconfigured .env file. Remove the empty lines or fill them in.");X(`AWS credentials: ${_.description}`);try{let R=await new BL(E).getCallerIdentity();if(R.Arn)X(`AWS identity: ${R.Arn}`)}catch(T){_E(`Could not verify AWS identity: ${T.message}`)}}function J_E(){try{return GI("git rev-parse --short HEAD",{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{return Date.now().toString(36)}}async function Nw(E,_,T,R){let{ensureManagementDashboard:N}=await M1().then(() => Ld);N(E,{logger:{info:X,warn:_E}});let L=E.sites||{},A=Object.entries(L);if(A.length===0)return _E("infrastructure.compute is set but no sites are configured — nothing to deploy. Add sites to `cloud.config.ts`."),!0;if(R&&!L[R])return q(`Site '${R}' was not found. Configured sites: ${A.map(([W])=>W).join(", ")}`),!1;let S=A.filter(([W,H])=>{if(!H)return!1;if(R&&W!==R)return!1;if(t_(H)==="bucket")return _E(`Site '${W}' targets a bucket — skipping compute deploy (handled by the static-site path).`),!1;return NH(H)});if(R)X(`Deploying only '${R}'. Other sites keep their current release; proxy routes are still regenerated in full.`);let O=E.project.slug,h=(E.infrastructure?.compute||{}).runtime||"bun",$=l_({config:E}),D=J_E(),C=new Map,J={step:(W)=>jE(W),error:(W)=>q(W)};if(!await Z1(E,"beforeDeploy",J))return!1;if(!await Z1(E,"beforeBuild",J))return!1;for(let[W,H]of S){let w=t_(H);if(r(`Preparing site: ${W}`),X(`Domain: ${H.domain||"(none)"}`),X(`Source: ${H.root}`),X(`Kind: ${w==="server-static"?"static (shipped to /var/www)":"app (systemd service)"}`),w==="server-app")X(`Start: ${H.start}`),X(`Port: ${H.port??"(unset)"}`);if(H.build){jE(`Running build: ${H.build}`);try{GI(H.build,{stdio:"inherit",cwd:process.cwd()})}catch(G){return q(`Build failed for site '${W}': ${G.message}`),!1}}if(!ZR(H.root))return q(`Build output not found at ${H.root} for site '${W}'`),!1;let B=f3(y3(),`${O}-${W}-${D}.tar.gz`);jE(`Packaging ${H.root} → ${B}`);try{let G=(H.exclude||[]).map((K)=>`--exclude='${K}'`).join(" ");GI(`tar czf "${B}" -C "${H.root}" ${G} .`,{stdio:"inherit"})}catch(G){return q(`Failed to package '${W}': ${G.message}`),!1}C.set(W,B)}if(!await Z1(E,"afterBuild",J))return!1;let I=await $I({config:R?{...E,sites:Object.fromEntries(S)}:E,rpxConfig:R?E:void 0,environment:_,driver:$,sha:D,runtime:h,tarballForSite:(W)=>{let H=C.get(W);if(!H)throw Error(`Missing tarball for site '${W}'`);return H},logger:{info:(W)=>X(W),warn:(W)=>_E(W),error:(W)=>q(W),step:(W)=>jE(W),success:(W)=>b(W)}});if(I&&!await Z1(E,"afterDeploy",J))return!1;return I}async function wI(E){let _=new Fh;jE("Running pre-deployment security scan...");let T=await _.scan({directory:E.sourceDir,failOnSeverity:E.failOnSeverity||"critical",skipPatterns:E.skipPatterns});return{passed:T.passed,result:T}}function I_E(){let E=f3(y3(),`ts-cloud-empty-scan-${process.pid}`);return x3(E,{recursive:!0}),E}function QI(E){let{summary:_,findings:T,scannedFiles:R,duration:N}=E;if(X(`
+`),h=A.index-U,$=N[O-1]||"";if(this.isLikelyPlaceholder(A[0],$))continue;let D=A[1]||A[0];if(L.name==="AWS Secret Key (Generic)"&&/^[a-f0-9]{40}$/i.test(D))continue;if(L.name==="AWS Secret Key (Generic)"&&!this.hasSecretCharacterDiversity(D))continue;if(L.name==="AWS Secret Key (Generic)"&&/^(?:Actions|Commands|Controllers|Handlers|Jobs|Listeners|Middleware|Models|Resources|Services)\//.test(D))continue;if(this.isLowEntropy(D))continue;R.push({file:_,line:O,column:h,match:this.maskSecret(A[0]),pattern:L,context:this.maskSecret($.trim())})}}return R}isLikelyPlaceholder(E,_){let T=["example","placeholder","your_","YOUR_","xxx","XXX","***","test","TEST","dummy","DUMMY","fake","FAKE","sample","SAMPLE","<your","${","{{","process.env","import.meta.env","CHANGEME","TODO","FIXME"],R=E.toLowerCase(),N=_.toLowerCase();for(let A of T)if(R.includes(A.toLowerCase())||N.includes(A.toLowerCase()))return!0;let L=_.trim();if(L.startsWith("//")||L.startsWith("#")||L.startsWith("*")||L.startsWith("/*")){if(N.includes("example")||N.includes("format:")||N.includes("e.g."))return!0}return!1}isLowEntropy(E){if(E.length<8)return!1;if(new Set(E).size<8)return!0;if(/(.)\1{3,}/.test(E))return!0;return!1}hasSecretCharacterDiversity(E){let _=/[\d+=]/.test(E),T=[/[a-z]/.test(E),/[A-Z]/.test(E),/\d/.test(E),/[/+=]/.test(E)];return _&&T.filter(Boolean).length>=3}maskSecret(E){if(E.length<=8)return"*".repeat(E.length);let _=Math.min(4,Math.floor(E.length*0.2));return E.substring(0,_)+"*".repeat(E.length-_*2)+E.substring(E.length-_)}getFilesToScan(E,_,T){let R=[],N=T||WEE,L=(A)=>{let S=DEE(A,{withFileTypes:!0});for(let O of S){let U=IEE(A,O.name);if(O.isDirectory()){if(!_.includes(O.name))L(U)}else if(O.isFile()){let h=JEE(O.name).toLowerCase();if(N.includes(h)||O.name.startsWith(".env")||O.name.endsWith(".config"))R.push(U)}}};return L(E),R}shouldExcludeFile(E){let _=E.split("/").pop()||"";for(let T of this.excludeFiles)if(T.startsWith("*")){let R=T.substring(1);if(_.endsWith(R))return!0}else if(T.endsWith("*")){let R=T.substring(0,T.length-1);if(_.startsWith(R))return!0}else if(_===T)return!0;return!1}addPattern(E){this.patterns.push(E)}getPatterns(){return[...this.patterns]}}function HEE(E,_){return{status:"unavailable",findings:[],error:`${E.id} exceeded its ${_}ms timeout`,metadata:{timeoutMs:_}}}class s0{posture;defaultTimeoutMs;nowFn;constructor(E,_={}){this.posture=E;this.defaultTimeoutMs=_.defaultTimeoutMs??60000,this.nowFn=_.now??(()=>new Date)}async run(E,_){let T=this.nowFn(),R=Math.max(100,E.timeoutMs??this.defaultTimeoutMs),N=new AbortController,L,A=new Promise((h)=>{L=setTimeout(()=>{N.abort(),h(HEE(E,R))},R)}),S;try{S=await Promise.race([E.scan({..._,signal:N.signal}),A])}catch(h){S={status:"unavailable",findings:[],error:h instanceof Error?h.message:String(h)}}finally{if(L)clearTimeout(L)}let O=this.nowFn(),U={..._,scannerId:E.id,scannerVersion:E.version,status:S.status,findings:S.findings,metadata:S.metadata,error:S.error,startedAt:T.toISOString(),completedAt:O.toISOString(),durationMs:Math.max(0,O.getTime()-T.getTime())};return this.posture.recordScan(U)}async runAll(E,_){return Promise.all(E.map((T)=>this.run(T,_)))}}class x1{scanner;id="source-secrets";version="1.0.0";timeoutMs=30000;constructor(E=new Fh){this.scanner=E}async scan(E){if(!E.artifactRoot)return{status:"skipped",findings:[],error:"No artifact root was supplied"};let _=await this.scanner.scan({directory:E.artifactRoot,failOnSeverity:"critical"});return{status:_.passed?"passed":"failed",findings:_.findings.map((T)=>({...E,ruleId:T.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:T.pattern.severity,title:T.pattern.name,description:T.pattern.description,subject:`${T.file}:${T.line}`,evidence:{file:T.file,line:T.line,column:T.column,match:T.match,context:T.context},remediation:"Remove the credential, rotate it at its issuer, and use a managed secret or environment reference."})),metadata:{scannedFiles:_.scannedFiles,summary:_.summary}}}}function jEE(E){let _=E?.toLowerCase();return _==="critical"||_==="high"||_==="medium"||_==="low"?_:"info"}class mY{id="trivy-image";version;timeoutMs;constructor(E={}){this.version=E.version??"local",this.timeoutMs=E.timeoutMs??120000,this.executable=E.executable??"trivy"}executable;async scan(E){if(!E.imageRef)return{status:"skipped",findings:[],error:"No image reference was supplied"};let _;try{_=Bun.spawn([this.executable,"image","--format","json","--quiet","--scanners","vuln",E.imageRef],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",TRIVY_NO_PROGRESS:"true"}})}catch(O){return{status:"unsupported",findings:[],error:O instanceof Error?O.message:String(O)}}let T=()=>_.kill();E.signal.addEventListener("abort",T,{once:!0});let[R,N,L]=await Promise.all([_.exited,new Response(_.stdout).text(),new Response(_.stderr).text()]);if(E.signal.removeEventListener("abort",T),R!==0)return{status:/not found|enoent/i.test(L)?"unsupported":"unavailable",findings:[],error:L.slice(0,2000)||`Trivy exited with ${R}`};let A=JSON.parse(N),S=[];for(let O of A.Results??[])for(let U of O.Vulnerabilities??[]){let h=U.VulnerabilityID??"unknown-vulnerability";S.push({...E,ruleId:h,severity:jEE(U.Severity),title:U.Title||h,description:U.Description||`${h} affects ${U.PkgName??"an image package"}.`,subject:`${E.imageRef}:${U.PkgName??"unknown"}:${U.InstalledVersion??"unknown"}`,evidence:{image:E.imageRef,target:O.Target??"",cve:h,package:U.PkgName??"",installedVersion:U.InstalledVersion??"",fixedVersion:U.FixedVersion??"",reference:U.PrimaryURL??""},remediation:U.FixedVersion?`Upgrade ${U.PkgName} to ${U.FixedVersion} or later.`:"Remove or replace the affected package and rescan the image."})}return{status:S.length?"failed":"passed",findings:S,metadata:{imageRef:E.imageRef,vulnerabilityCount:S.length,localOnly:!0}}}}import{createHash as YEE,createVerify as jHE}from"node:crypto";import{existsSync as wEE,readFileSync as QEE}from"node:fs";import{basename as GEE,join as PEE,resolve as nd}from"node:path";function y1(E){return YEE("sha256").update(E).digest("hex")}function MEE(E){let _=[["dependencies","required"],["optionalDependencies","optional"],["devDependencies","excluded"],["peerDependencies","required"]],T=new Map;for(let[R,N]of _){let L=E[R];if(!L||typeof L!=="object"||Array.isArray(L))continue;for(let[A,S]of Object.entries(L)){let O=String(S).replace(/^[~^]/,""),U=`${A}@${O}`;if(!T.has(U))T.set(U,{type:"library",name:A,version:O,purl:`pkg:npm/${encodeURIComponent(A)}@${encodeURIComponent(O)}`,scope:N})}}return[...T.values()].sort((R,N)=>`${R.name}@${R.version}`.localeCompare(`${N.name}@${N.version}`))}function ed(E,_={}){let T=PEE(nd(E),"package.json");if(!wEE(T))throw Error(`Cannot generate an SBOM: ${T} was not found`);let R=QEE(T,"utf8"),N=JSON.parse(R),L=String(N.name??GEE(nd(E))),A=String(N.version??"0.0.0"),S=y1(R);return{bomFormat:"CycloneDX",specVersion:"1.5",serialNumber:_.serial??`urn:uuid:${crypto.randomUUID()}`,version:1,metadata:{timestamp:(_.now??new Date).toISOString(),component:{type:"application",name:L,version:A,purl:`pkg:npm/${encodeURIComponent(L)}@${encodeURIComponent(A)}`,hashes:[{alg:"SHA-256",content:S}]},tools:[{vendor:"ts-cloud",name:"security-posture",version:"1.0.0"}]},components:MEE(N)}}async function ad(E,_={}){let T=Bun.spawn([_.executable??"syft",E,"-o","cyclonedx-json"],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",SYFT_CHECK_FOR_APP_UPDATE:"false"}}),R=()=>T.kill();_.signal?.addEventListener("abort",R,{once:!0});let[N,L,A]=await Promise.all([T.exited,new Response(T.stdout).text(),new Response(T.stderr).text()]);if(_.signal?.removeEventListener("abort",R),N!==0)throw Error(A.slice(0,2000)||`Syft exited with ${N}`);return JSON.parse(L)}function nY(E,_,T){let R=JSON.stringify(T);return E.addReleaseArtifact({..._,kind:"sbom",format:`cyclonedx-${T.specVersion}+json`,digest:`sha256:${y1(R)}`,summary:{component:T.metadata.component.name,version:T.metadata.component.version,components:T.components.length},content:R,sensitive:!0})}function id(E,_,T){let R={total:T.length,critical:0,high:0,medium:0,low:0,info:0,fixable:0};for(let L of T){R[L.severity]++;let A=L.evidence;if(typeof A.fixedVersion==="string"&&A.fixedVersion)R.fixable++}let N=JSON.stringify({releaseId:_.releaseId,generatedAt:new Date().toISOString(),findings:T.map((L)=>({id:L.id,ruleId:L.ruleId,severity:L.severity,subject:L.subject,remediation:L.remediation}))});return E.addReleaseArtifact({..._,kind:"vulnerability_summary",format:"ts-cloud-vulnerability-summary+json",digest:`sha256:${y1(N)}`,summary:R,content:N,sensitive:!0})}function sd(E){if(!E.artifact&&!E.artifactSha256)throw Error("Release provenance requires artifact content or a SHA-256 digest");return{_type:"https://in-toto.io/Statement/v1",subject:[{name:E.artifactName,digest:{sha256:E.artifactSha256?.replace(/^sha256:/,"")??y1(E.artifact)}}],predicateType:"https://slsa.dev/provenance/v1",predicate:{buildDefinition:{buildType:"https://ts-cloud.dev/build/v1",externalParameters:E.externalParameters??{},internalParameters:{},resolvedDependencies:E.resolvedDependencies??[]},runDetails:{builder:{id:"https://ts-cloud.dev/builders/local/v1"},metadata:{invocationId:E.invocationId,startedOn:E.startedAt,finishedOn:E.completedAt}}}}}function pd(E,_,T){let R=JSON.stringify(T);return E.addReleaseArtifact({..._,kind:"provenance",format:"in-toto+slsa-v1+json",digest:`sha256:${y1(R)}`,summary:{subjects:T.subject.length,builder:T.predicate.runDetails.builder.id,buildType:T.predicate.buildDefinition.buildType},content:R,sensitive:!0})}function VR(E,_){let T=E.environments.get(_);if(!T)throw Error(`Security scope for environment '${_}' was not found`);return{organizationId:E.organization.id,projectId:E.project.id,environmentId:T.id}}function f1(E,_){let T=new qS(E.store),R=T.listPolicies(E.organization.id);for(let[N,L]of E.environments){if(R.some((S)=>S.environmentId===L.id))continue;let A=N==="production"||L.kind==="production";R.push(T.createPolicy({organizationId:E.organization.id,environmentId:L.id,name:A?"Production baseline":"Environment baseline",scannerFailMode:A?"closed":"open",requiredScanners:["source-secrets"],rules:A?[{minimumSeverity:"critical",action:"block"},{minimumSeverity:"high",action:"block"},{minimumSeverity:"medium",action:"warn"},{minimumSeverity:"low",action:"record"}]:[{minimumSeverity:"critical",action:"warn"},{minimumSeverity:"high",action:"warn"},{minimumSeverity:"low",action:"record"}],actorId:_}))}return R}function od(E,_,T,R={}){let N=T.findings.map((L)=>({..._,ruleId:L.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:L.pattern.severity,title:L.pattern.name,description:L.pattern.description,subject:`${L.file}:${L.line}`,evidence:{file:L.file,line:L.line,column:L.column,match:L.match,context:L.context},remediation:"Remove and rotate the credential, then reference it through a managed secret or environment variable."}));return E.recordScan({..._,scannerId:"source-secrets",scannerVersion:R.scannerVersion??"1.0.0",status:R.skipped?"skipped":T.passed?"passed":"failed",findings:R.skipped?[]:N,metadata:{scannedFiles:T.scannedFiles,durationMs:T.duration,summary:T.summary},durationMs:T.duration,error:R.skipped?"The operator explicitly skipped source-secret scanning.":void 0})}function E3(E,_,T="The operator explicitly skipped source-secret scanning."){return E.recordScan({..._,scannerId:"source-secrets",scannerVersion:"1.0.0",status:"skipped",findings:[],error:T})}function KEE(E,_){let T=[],R=_.security;if(R?.firewall&&!["active","configured","ok"].includes(String(R.firewall.status)))T.push({...E,ruleId:"host-firewall-disabled",severity:"high",title:"Host firewall is not active",description:String(R.firewall.summary??"The host firewall did not report an active configuration."),subject:"host:firewall",evidence:{status:String(R.firewall.status??"unknown"),rules:Array.isArray(R.firewall.rules)?R.firewall.rules.length:0},remediation:"Apply the declarative firewall policy and confirm only required listeners are public."});for(let N of R?.ports??[]){let L=String(N.listen??""),A=Number(L.match(/:(\d+)$/)?.[1]);if(N.exposure==="public"&&Number.isFinite(A)&&![22,80,443].includes(A))T.push({...E,ruleId:"unexpected-public-listener",severity:"medium",title:`Unexpected public listener on port ${A}`,description:`${String(N.processName??"A process")} is listening publicly outside the standard SSH/HTTP/HTTPS ports.`,subject:`host:port:${A}`,evidence:{protocol:String(N.proto??""),listen:L,process:String(N.processName??"")},remediation:"Bind the service to loopback/private networking or explicitly document and firewall the required public port."})}for(let N of R?.tlsCertificates??[]){let L=Number(N.daysRemaining);if(Number.isFinite(L)&&L<30)T.push({...E,ruleId:"tls-certificate-expiry",severity:L<14?"high":"medium",title:`TLS certificate expires in ${L} days`,description:`${String(N.domain??"A configured domain")} needs renewal.`,subject:`tls:${String(N.domain??"unknown")}`,evidence:{domain:String(N.domain??""),daysRemaining:L,expires:String(N.expires??"")},remediation:"Renew the certificate and verify automatic renewal can complete before expiry."})}for(let N of _.diagnostics??[]){if(N.status==="pass"||N.status==="ok")continue;T.push({...E,ruleId:`diagnostic-${String(N.name??"unknown").toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:N.status==="fail"?"high":"medium",title:String(N.name??"Host security check"),description:String(N.detail??"The host security diagnostic did not pass."),subject:`diagnostic:${String(N.name??"unknown")}`,evidence:{status:String(N.status??"unknown")},remediation:"Follow the diagnostic guidance, rerun the check, and confirm the finding resolves."})}return T}function BI(E,_,T){let R=!!T.security||Array.isArray(T.diagnostics),N=R?KEE(_,T):[];return E.recordScan({..._,scannerId:"host-posture",scannerVersion:"1.0.0",status:!R?"unavailable":N.length?"failed":"passed",findings:N,metadata:{source:"dashboard-live-probe",checks:Array.isArray(T.diagnostics)?T.diagnostics.length:0},error:R?void 0:"Live host posture data was unavailable; source and provider checks remain usable."})}function p0(E,_){let T=E.evaluateGate({..._.scope,operationId:_.operationId}),R=E.listFindings({..._.scope,limit:1000}).filter((N)=>N.status!=="resolved");return{decision:T,summary:{desiredConfigHash:_.desiredConfigHash??null,securityImpact:{critical:R.filter((N)=>N.severity==="critical").length,high:R.filter((N)=>N.severity==="high").length,waived:R.filter((N)=>N.status==="waived").length,assigned:R.filter((N)=>!!N.ownerActorId).length},blockingFindingIds:T.findingIds,policy:{id:T.policyId,version:T.policyVersion},scannerVersions:T.scannerVersions}}}async function _3(E,_){let T=_.scanner??new mY({timeoutMs:_.scannerTimeoutMs}),N=await new s0(E,{defaultTimeoutMs:_.scannerTimeoutMs??120000}).run(T,{..._.scope,releaseId:_.releaseId,imageRef:_.imageRef}),L={..._.scope,releaseId:_.releaseId};id(E,L,N.findings);let A=_.generateImageSbom??ad,S=new AbortController,O=Math.max(100,_.sbomTimeoutMs??120000),U,h=new Promise((C,J)=>{U=setTimeout(()=>{S.abort(),J(Error(`syft-sbom exceeded its ${O}ms timeout`))},O)}),$="unavailable";try{let C=await Promise.race([A(_.imageRef,{signal:S.signal}),h]);nY(E,L,C),E.recordScan({..._.scope,releaseId:_.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"passed",metadata:{imageRef:_.imageRef,format:`cyclonedx-${C.specVersion}+json`,components:C.components.length,localOnly:!0}}),$="image"}catch(C){let J=C instanceof Error?C.message:String(C);try{let I=ed(_.artifactRoot);nY(E,L,I),E.recordScan({..._.scope,releaseId:_.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unsupported",error:`Image inventory was unavailable; attached a package-manifest SBOM instead. ${J}`,metadata:{imageRef:_.imageRef,fallback:"package-manifest",components:I.components.length,localOnly:!0}}),$="manifest"}catch(I){E.recordScan({..._.scope,releaseId:_.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unavailable",error:`Image and manifest SBOM generation were unavailable. ${J}; ${I instanceof Error?I.message:String(I)}`,metadata:{imageRef:_.imageRef,localOnly:!0}})}}finally{if(U)clearTimeout(U)}let D=sd({artifactName:_.imageRef,artifact:_.imageSha256?void 0:_.imageRef,artifactSha256:_.imageSha256,invocationId:_.invocationId,startedAt:_.startedAt,completedAt:_.completedAt??new Date().toISOString(),externalParameters:_.externalParameters??{imageRef:_.imageRef}});return pd(E,L,D),{scan:N,sbomSource:$}}async function X_E(E){let _=qF();if(_.emptyEnvKey||_.emptyEnvSecret)_E("Empty AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY env var detected — likely a misconfigured .env file. Remove the empty lines or fill them in.");X(`AWS credentials: ${_.description}`);try{let R=await new BL(E).getCallerIdentity();if(R.Arn)X(`AWS identity: ${R.Arn}`)}catch(T){_E(`Could not verify AWS identity: ${T.message}`)}}function J_E(){try{return GI("git rev-parse --short HEAD",{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{return Date.now().toString(36)}}async function Nw(E,_,T,R){let{ensureManagementDashboard:N}=await M1().then(() => Ld);N(E,{logger:{info:X,warn:_E}});let L=E.sites||{},A=Object.entries(L);if(A.length===0)return _E("infrastructure.compute is set but no sites are configured — nothing to deploy. Add sites to `cloud.config.ts`."),!0;if(R&&!L[R])return q(`Site '${R}' was not found. Configured sites: ${A.map(([W])=>W).join(", ")}`),!1;let S=A.filter(([W,H])=>{if(!H)return!1;if(R&&W!==R)return!1;if(t_(H)==="bucket")return _E(`Site '${W}' targets a bucket — skipping compute deploy (handled by the static-site path).`),!1;return NH(H)});if(R)X(`Deploying only '${R}'. Other sites keep their current release; proxy routes are still regenerated in full.`);let O=E.project.slug,h=(E.infrastructure?.compute||{}).runtime||"bun",$=l_({config:E}),D=J_E(),C=new Map,J={step:(W)=>jE(W),error:(W)=>q(W)};if(!await Z1(E,"beforeDeploy",J))return!1;if(!await Z1(E,"beforeBuild",J))return!1;for(let[W,H]of S){let w=t_(H);if(r(`Preparing site: ${W}`),X(`Domain: ${H.domain||"(none)"}`),X(`Source: ${H.root}`),X(`Kind: ${w==="server-static"?"static (shipped to /var/www)":"app (systemd service)"}`),w==="server-app")X(`Start: ${H.start}`),X(`Port: ${H.port??"(unset)"}`);if(H.build){jE(`Running build: ${H.build}`);try{GI(H.build,{stdio:"inherit",cwd:process.cwd()})}catch(G){return q(`Build failed for site '${W}': ${G.message}`),!1}}if(!ZR(H.root))return q(`Build output not found at ${H.root} for site '${W}'`),!1;let B=f3(y3(),`${O}-${W}-${D}.tar.gz`);jE(`Packaging ${H.root} → ${B}`);try{let G=(H.exclude||[]).map((K)=>`--exclude='${K}'`).join(" ");GI(`tar czf "${B}" -C "${H.root}" ${G} .`,{stdio:"inherit"})}catch(G){return q(`Failed to package '${W}': ${G.message}`),!1}C.set(W,B)}if(!await Z1(E,"afterBuild",J))return!1;let I=await $I({config:R?{...E,sites:Object.fromEntries(S)}:E,rpxConfig:R?E:void 0,environment:_,driver:$,sha:D,runtime:h,tarballForSite:(W)=>{let H=C.get(W);if(!H)throw Error(`Missing tarball for site '${W}'`);return H},logger:{info:(W)=>X(W),warn:(W)=>_E(W),error:(W)=>q(W),step:(W)=>jE(W),success:(W)=>b(W)}});if(I&&!await Z1(E,"afterDeploy",J))return!1;return I}async function wI(E){let _=new Fh;if(jE("Running pre-deployment security scan..."),E.exclude?.length)X(`Excluding from the scan: ${E.exclude.join(", ")}`);let T=await _.scan({directory:E.sourceDir,failOnSeverity:E.failOnSeverity||"critical",skipPatterns:E.skipPatterns,exclude:E.exclude});return{passed:T.passed,result:T}}function I_E(){let E=f3(y3(),`ts-cloud-empty-scan-${process.pid}`);return x3(E,{recursive:!0}),E}function QI(E){let{summary:_,findings:T,scannedFiles:R,duration:N}=E;if(X(`
 Scanned ${R} files in ${N}ms`),_.critical>0)q(`  Critical: ${_.critical}`);else X(`  Critical: ${_.critical}`);if(_.high>0)_E(`  High: ${_.high}`);else X(`  High: ${_.high}`);if(X(`  Medium: ${_.medium}`),X(`  Low: ${_.low}`),T.length>0){X(`
 Findings:`);let L=T.filter((h)=>h.pattern.severity==="critical"),A=T.filter((h)=>h.pattern.severity==="high"),S=T.filter((h)=>h.pattern.severity==="medium"),O=T.filter((h)=>h.pattern.severity==="low"),U=(h,$,D)=>{if(h.length>0){console.log(`
 ${kA(`[${$}]`,D)}`);for(let C of h.slice(0,10))X(`  ${C.pattern.name}`),X(`    File: ${C.file}:${C.line}`),X(`    Match: ${C.match}`);if(h.length>10)X(`  ... and ${h.length-10} more ${$.toLowerCase()} findings`)}};U(L,"CRITICAL","red"),U(A,"HIGH","yellow"),U(S,"MEDIUM","blue"),U(O,"LOW","gray")}}function k3(E,_){let T=Object.keys(E.environments??{});if(_&&T.includes(_))return _;if(T.includes("production"))return"production";if(T[0])return T[0];throw Error("A configured environment is required for security policy evaluation")}function Lw(E,_,T){let R=k3(E,_),N=mE(process.cwd(),E);try{let L=new qS(N.store);f1(N);let A=VR(N,R);if(T)od(L,A,T);else E3(L,A);let S=p0(L,{scope:A,desiredConfigHash:N.project.desiredConfigHash});return X(`Security policy: ${S.decision.policyId} v${S.decision.policyVersion} — ${S.decision.outcome.toUpperCase()}`),X(`Security decision: ${S.decision.explanation}`),{allowed:S.decision.outcome!=="block",explanation:S.decision.explanation}}finally{N.store.close()}}async function F_E(E,_){let T=k3(E),R=mE(process.cwd(),E);try{let N=new qS(R.store);f1(R);let L=VR(R,T),A=_.imageSha256?`${_.imageRef}@sha256:${_.imageSha256.replace(/^sha256:/,"")}`:_.imageRef;jE("Scanning the built image and producing release security artifacts...");let S=await _3(N,{scope:L,releaseId:A,imageRef:_.imageRef,imageSha256:_.imageSha256,artifactRoot:_.artifactRoot,invocationId:_.invocationId,startedAt:_.startedAt,externalParameters:{imageRef:_.imageRef,artifactRoot:_.artifactRoot}});X(`Image scanner: ${S.scan.run.status} (${S.scan.findings.length} findings)`),X(`Release SBOM: ${S.sbomSource==="image"?"full image inventory":S.sbomSource==="manifest"?"package-manifest fallback":"unavailable"}`);let O=p0(N,{scope:L,operationId:_.invocationId,desiredConfigHash:R.project.desiredConfigHash});return X(`Release policy: ${O.decision.policyId} v${O.decision.policyVersion} — ${O.decision.outcome.toUpperCase()}`),X(`Release decision: ${O.decision.explanation}`),{allowed:O.decision.outcome!=="block",explanation:O.decision.explanation}}finally{R.store.close()}}function W_E(E){try{let _=mE(process.cwd(),E),T=new V0(_.store).current();if(!T.attackMode&&!T.mitigationPause&&T.ipRules.allow.length===0&&T.ipRules.block.length===0)return E;let R=Wj(E,T);return X(`Applying protection controls: ${T.ipRules.allow.length} allow, ${T.ipRules.block.length} block${T.attackMode?", attack mode ON":""}${T.mitigationPause?", mitigation PAUSED":""}`),R}catch{return E}}function Sw(E){E.command("deploy:security-scan","Run pre-deployment security scan").option("--source <path>","Source directory to scan",{default:"."}).option("--fail-on <severity>","Fail on severity level (critical, high, medium, low)",{default:"critical"}).option("--skip-patterns <patterns>","Comma-separated list of pattern names to skip").action(async(_)=>{r("Pre-Deployment Security Scan");try{let T=_?.source||".",R=_?.failOn||"critical",N=_?.skipPatterns?.split(",").map((S)=>S.trim())||[];if(!ZR(T)){q(`Source directory not found: ${T}`);return}X(`Source: ${T}`),X(`Fail on: ${R} or higher severity`);let{passed:L,result:A}=await wI({sourceDir:T,failOnSeverity:R,skipPatterns:N});if(QI(A),L)b(`
 ✓ Security scan passed - no blocking issues found`);else q(`
 ✗ Security scan failed - blocking issues detected`),X(`
 Recommendations:`),X("  1. Remove any hardcoded credentials from your code"),X("  2. Use environment variables or AWS Secrets Manager"),X("  3. Add sensitive files to .gitignore"),X("  4. Use --skip-patterns to ignore false positives"),process.exit(1)}catch(T){q(`Security scan failed: ${T.message}`),process.exit(1)}}),E.command("deploy","Deploy infrastructure").option("--stack <name>","Stack name").option("--env <environment>","Environment to deploy to").option("--site <name>","Deploy specific site only (routes are still regenerated in full)").option("--skip-security-scan","Skip pre-deployment security scan").option("--skip-dns-verification","Skip DNS provider verification and record creation (use when DNS is already configured)").option("--security-fail-on <severity>","Security scan fail threshold (critical, high, medium, low)",{default:"critical"}).option("--dry-run","Show the deployment plan without making changes").option("--yes","Skip confirmation prompts (non-interactive / CI)").action(async(_)=>{r("Deploying Infrastructure");let T=_?.yes===!0||process.env.CI==="true",R=_?.env||"staging",N=null;N=await z_E(R);try{let L=await o(),A=W_E(L),{errors:S,warnings:O}=RH(A);for(let RE of O)_E(RE);if(S.length>0){q(`
-✗ Deployment configuration is invalid:`);for(let RE of S)q(`  • ${RE}`);process.exitCode=1;return}if(_?.dryRun){if(_.site&&!A.sites?.[_.site]){q(`Site '${_.site}' was not found. Configured sites: ${Object.keys(A.sites||{}).join(", ")||"none"}`),process.exitCode=1;return}let RE=YT(A),V=_.stack||B_(A,R),m=gT(A),e=A.project.region||"us-east-1",a=_.site?[_.site]:Object.keys(A.sites||{});r("Deployment Plan"),X(`Cloud provider: ${m}`),X(`Mode: ${RE}`),X(`Stack: ${V}`),X(`Region: ${e}`),X(`Environment: ${R}`),X(`Sites: ${a.length>0?a.join(", "):"none"}`),b("Dry run complete. No infrastructure, DNS, certificates, or application files were changed.");return}if(gT(A)==="aws"){let RE=A.project?.region||"us-east-1";await X_E(RE)}let U;if(!_?.skipSecurityScan){let RE=fM(A,_?.site);if(!RE)X("This deploy ships no files — every site in scope is a redirect or proxy route, so only gateway routes and certificates change. Scanning an empty artifact.");let{result:V}=await wI({sourceDir:RE?process.cwd():I_E(),failOnSeverity:_?.securityFailOn||"critical"});QI(V),U=V}else _E(`Security scan skipped (--skip-security-scan)
+✗ Deployment configuration is invalid:`);for(let RE of S)q(`  • ${RE}`);process.exitCode=1;return}if(_?.dryRun){if(_.site&&!A.sites?.[_.site]){q(`Site '${_.site}' was not found. Configured sites: ${Object.keys(A.sites||{}).join(", ")||"none"}`),process.exitCode=1;return}let RE=YT(A),V=_.stack||B_(A,R),m=gT(A),e=A.project.region||"us-east-1",a=_.site?[_.site]:Object.keys(A.sites||{});r("Deployment Plan"),X(`Cloud provider: ${m}`),X(`Mode: ${RE}`),X(`Stack: ${V}`),X(`Region: ${e}`),X(`Environment: ${R}`),X(`Sites: ${a.length>0?a.join(", "):"none"}`),b("Dry run complete. No infrastructure, DNS, certificates, or application files were changed.");return}if(gT(A)==="aws"){let RE=A.project?.region||"us-east-1";await X_E(RE)}let U;if(!_?.skipSecurityScan){let RE=fM(A,_?.site);if(!RE)X("This deploy ships no files — every site in scope is a redirect or proxy route, so only gateway routes and certificates change. Scanning an empty artifact.");let{result:V}=await wI({sourceDir:RE?process.cwd():I_E(),failOnSeverity:_?.securityFailOn||"critical",exclude:A.infrastructure?.security?.scan?.exclude});QI(V),U=V}else _E(`Security scan skipped (--skip-security-scan)
 `);let h=Lw(A,R,U);if(!h.allowed){q(`
 ✗ Deployment blocked by security policy: ${h.explanation}`),X("Remediate the findings or create an authorized, time-limited waiver in the Security posture center."),process.exitCode=1;return}if(b(`✓ Security policy allows this deployment
 `),YT(A)==="serverless"){jE("Serverless project detected: deploying the Lambda application");let{deployServerlessApp:RE}=await ST().then(() => tR);await RE(A,R,{}),b("Serverless deployment complete");return}let $=_?.stack||B_(A,R),D=A.project.region||"us-east-1",C=A.infrastructure?.deployStack!==!1,J=A.sites&&Object.keys(A.sites).length>0,I=A.infrastructure?.dns?.provider;if(J&&I){if(await H_E(A,_?.site,I,D,_?.skipDnsVerification,R,T),!C){if(A.infrastructure?.compute){let RE=Object.values(A.sites).map((V)=>V.domain).filter((V)=>!!V);if(RE.length>0)jE("Syncing CloudFront dynamic HTTP methods for app domains..."),await II(RE)}return}}if(!C){X("Infrastructure stack deployment disabled (infrastructure.deployStack: false)");return}let W=gT(A);if(X(`Cloud provider: ${W}`),X(`Stack: ${$}`),X(`Region: ${D}`),X(`Environment: ${R}`),(W==="hetzner"||A.infrastructure?.compute?.mode==="server")&&A.infrastructure?.compute){jE(`Provisioning ${W} compute infrastructure...`);let RE=l_({config:A,provider:W});if(!RE.provisionComputeInfrastructure){q(`${W} driver does not support compute provisioning`),process.exitCode=1;return}let V=await RE.provisionComputeInfrastructure({config:A,environment:R});if(b(`${W} compute infrastructure ready`),V.appPublicIp)X(`App server: ${V.appPublicIp}`);if(V.appInstanceId)X(`Server ID: ${V.appInstanceId}`);if(!await Nw(A,R,D,_?.site))q(`App deploy to ${W} compute reported a failure`),process.exitCode=1;else{if(b(`App deployed to ${W} compute`),_?.skipDnsVerification)X("DNS verification and record reconciliation skipped (--skip-dns-verification)");else await B_E(A,V.appPublicIp,I);let e=await DI({config:A,environment:R,driver:RE,logger:{info:X,warn:_E,error:q,step:jE,success:b}});if(!e)q("App deployed, but rpx TLS certificate reconciliation failed");if(!e)process.exitCode=1}return}jE("Generating CloudFormation template...");let w=new SU({config:A,environment:R});w.generate();let B=w.toJSON(),G=JSON.parse(B);if(Object.keys(G.Resources||{}).length===0){X(`No infrastructure resources to deploy for environment '${R}' — skipping stack ${$}.`);return}jE("Validating template...");let d=e$(G),x=a$(B),g=i$(G),f=[...d.errors,...x.errors,...g.errors];if(f.length>0){q("Template validation failed:");for(let RE of f)q(`  - ${RE.path}: ${RE.message}`);return}let v=[...d.warnings,...x.warnings,...g.warnings];if(v.length>0)for(let RE of v)_E(`  - ${RE.path}: ${RE.message}`);b("Template validated successfully");let t=Object.keys(G.Resources).length;X(`