@stacksjs/ts-cloud 0.7.121 → 0.7.123

package/dist/bin/cli.js

@@ -9188,7 +9188,7 @@ ${N}`:""}`}var TY=268435456,Io=8000,FA;var RY=NE(async()=>{oU();TD();eJ();XU();_
 `))}async findExistingServer(E,_,T){let R=await this.client.listServers(),N=R.find((A)=>gR(A.labels,E,_,"app")||A.name===T);if(N)return N;let L=R.filter((A)=>A.status!=="off"&&A.labels?.[`${oT}/managed-by`]==="ts-cloud"&&A.labels?.[`${oT}/environment`]===_&&A.labels?.[`${oT}/role`]==="app");if(L.length===1){let A=L[0],S=A.labels?.[`${oT}/project`]??"unknown";return console.warn(`[ts-cloud] No server named '${T}' found; adopting existing ts-cloud app server '${A.name}' (project label '${S}') for project '${E}' — `+"updating it in place instead of provisioning a new server."),A}return}async ensureFirewall(E,_,T){let N=(await this.client.listFirewalls()).find((A)=>A.name===E);if(N)return await this.client.setFirewallRules(N.id,T),{firewall:N};let{firewall:L}=await this.client.createFirewall({name:E,labels:_,rules:T});return{firewall:L}}collectUpstreamPorts(E){let _=new Set;for(let T of Object.values(E))if(typeof T.port==="number")_.add(T.port);return[..._].filter((T)=>![80,443].includes(T))}async sleep(E){await new Promise((_)=>setTimeout(_,E))}async waitForSshReady(E){let{sshIntervalMs:_,sshTimeoutMs:T}=this.bootWait,R=Date.now(),N;while(Date.now()-R<T)try{aZ(`ssh ${this.sshBaseArgs(E,["-o","ConnectTimeout=5"]).map(rN).join(" ")} true`,{stdio:"pipe",maxBuffer:TY});return}catch(L){N=L,await this.sleep(_)}throw Error(`Timed out waiting for SSH on ${E} after ${T}ms: ${N?.message??"unknown error"}`)}async waitForCloudInit(E){let{cloudInitIntervalMs:_,cloudInitTimeoutMs:T}=this.bootWait,R=Date.now();while(Date.now()-R<T){try{let N=this.sshExec(E,"if command -v cloud-init >/dev/null 2>&1; then cloud-init status --long 2>/dev/null || true; else echo 'status: done'; fi");if(/status:\s*error/.test(N))throw Error(`cloud-init reported an error on ${E}:
 ${N}`);if(/status:\s*(?:done|degraded)/.test(N))return}catch(N){if(N instanceof Error&&/cloud-init reported an error/.test(N.message))throw N}await this.sleep(_)}throw Error(`Timed out waiting for cloud-init to finish on ${E} after ${T}ms`)}outputsFromState(E,_){return{deployStoragePath:E.deployStoragePath||"/var/ts-cloud/staging",appInstanceId:E.serverId?String(E.serverId):void 0,appPublicIp:_?.public_net.ipv4?.ip||E.publicIp,appPublicIpv6:CA(_?.public_net.ipv6?.ip)||E.publicIpv6,sshUser:E.sshUser||this.sshUser,servicesPrivateIp:E.servicesPrivateIp}}static SSH_HOST_KEY_OPTS=["-o","StrictHostKeyChecking=no","-o","UserKnownHostsFile=/dev/null","-o","LogLevel=ERROR"];static SSH_KEEPALIVE_OPTS=["-o","ConnectTimeout=30","-o","ServerAliveInterval=15","-o","ServerAliveCountMax=4"];sshBaseArgs(E,_=[]){return["-i",this.sshPrivateKeyPath,...FA.SSH_HOST_KEY_OPTS,...FA.SSH_KEEPALIVE_OPTS,"-o","BatchMode=yes",..._,`${this.sshUser}@${E}`]}scpToHost(E,_,T){let R=["scp","-i",this.sshPrivateKeyPath,...FA.SSH_HOST_KEY_OPTS,...FA.SSH_KEEPALIVE_OPTS,"-o","BatchMode=yes",_,`${this.sshUser}@${E}:${T}`].map((L)=>`"${L.replace(/"/g,"\\\"")}"`).join(" "),N=3;for(let L=1;L<=3;L++)try{aZ(R,{stdio:"pipe",maxBuffer:TY});return}catch(A){if(L===3)throw Error(pZ(A))}}sshExec(E,_){try{return $o("ssh",[...this.sshBaseArgs(E),"bash -s"],{encoding:"utf8",input:_,stdio:["pipe","pipe","pipe"],maxBuffer:TY})}catch(T){throw Error(pZ(T))}}}});class sJ{name="hetzner";usesCloudFormation=!1;async getComputeOutputs(){return{appPublicIp:"127.0.0.1",sshUser:"root"}}async uploadRelease(E){return{artifactRef:E.localPath}}async findComputeTargets(E){if((E.role||"app")!=="app")return[];return[{id:"localhost",name:"localhost",publicIp:"127.0.0.1",status:"running"}]}async runRemoteDeploy(E){let _=E.commands.join(`
 `);try{let T=Bun.spawn(["bash","-c",_],{stdout:"pipe",stderr:"pipe",env:process.env}),[R,N,L]=await Promise.all([new Response(T.stdout).text(),new Response(T.stderr).text(),T.exited]);return{success:L===0,instanceCount:1,perInstance:[{instanceId:"localhost",status:L===0?"Success":"Failed",output:R,error:N}]}}catch(T){return{success:!1,instanceCount:1,perInstance:[{instanceId:"localhost",status:"Failed",error:T?.message??String(T)}],error:T?.message??String(T)}}}}function NY(){let E=process.env.TS_CLOUD_DASHBOARD_BOX;return E!=null&&E!==""&&E!=="0"&&E.toLowerCase()!=="false"}function l_(E){if(NY())return new sJ;switch(E.provider??hT(E.config)){case"aws":return new Y1({region:E.config.project.region});case"hetzner":return new FA({apiToken:E.config.hetzner?.apiToken,allowStateOnly:Boolean(E.config.cloud?.attachTo),sshPrivateKeyPath:E.config.hetzner?.sshPrivateKeyPath,sshPublicKeyPath:E.config.hetzner?.sshPublicKeyPath,sshUser:E.config.hetzner?.sshUser,location:E.config.hetzner?.location});default:throw Error(`Unknown cloud provider: ${E.provider??hT(E.config)}`)}}class LY{drivers=new Map;getDriver(E,_){let T=_??hT(E),R=`${T}:${E.project.slug}:${E.project.region||"default"}`,N=this.drivers.get(R);if(N)return N;let L=l_({config:E,provider:T});return this.drivers.set(R,L),L}}var Wo;var oZ=NE(async()=>{await n_([sE(),p5(),RY()]);Wo=new LY});var AY=NE(()=>{XU()});var Nd=NE(()=>{AY()});function pJ(E){return Object.entries(E).map(([_,T])=>`${_}=${zo(String(T))}`).join(`
-`)}function zo(E){return`"${E.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/\n/g,"\\n").replace(/\r/g,"\\r").replace(/\t/g,"\\t")}"`}function l0(E){return`${E.replace(/\/+$/,"")}/.ts-cloud`}function SY(E){return`${l0(E)}/deploy-history.log`}function Bo(E,_){return`${l0(E)}/deploys/${_}.log`}function Ad(E){return`${l0(E)}/shared-paths`}function m0(E,_){let T=E.replace(/\/+$/,"");return{base:T,releases:`${T}/releases`,shared:`${T}/shared`,current:`${T}/current`,release:`${T}/releases/${_}`}}function Ho(E){let _=E.split("/").pop()||E;if(_===".env"||_.startsWith(".env."))return!0;return/\.[a-z0-9]+$/i.test(_)}function jo(E){return typeof E==="string"?E:E.path}function Sd(E){let _=new Map;for(let T of E)_.set(jo(T),T);return[..._.values()]}function Od(E,_){if(typeof _==="string")return{path:_,target:`${E.shared}/${_}`,seed:!0};return{path:_.path,target:_.target??`${E.shared}/${_.path}`,seed:_.seed!==!1}}function Yo(E){return["ts_cloud_adopt_shared() {",'  TS_CLOUD_SP="$1"','  TS_CLOUD_DST="$2"',`  TS_CLOUD_SRC="${E.current}/$TS_CLOUD_SP"`,'  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi','  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi','  mkdir -p "$(dirname "$TS_CLOUD_DST")"','  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',"  for TS_CLOUD_SIDECAR in -wal -shm; do",'    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',"  done",'  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',"  return 0","}"]}function Q1(E,_=oJ){let T=[`mkdir -p ${E.releases} ${E.shared}`,...Yo(E)],R=_.map((L)=>Od(E,L));for(let{path:L,target:A,seed:S}of R){if(!S)continue;if(T.push(`ts_cloud_adopt_shared '${L}' '${A}'`),Ho(L))T.push(`mkdir -p "$(dirname ${A})"`,`touch ${A}`);else if(L==="storage")T.push(`mkdir -p ${A}/app/public`,`mkdir -p ${A}/framework/cache/data`,`mkdir -p ${A}/framework/sessions`,`mkdir -p ${A}/framework/testing`,`mkdir -p ${A}/framework/views`,`mkdir -p ${A}/logs`);else T.push(`mkdir -p ${A}`)}let N=Ad(E.base);return T.push(`mkdir -p ${l0(E.base)}`,`cat > ${N} <<'TS_CLOUD_SHARED_PATHS_EOF'`,...R.map((L)=>`${L.path}	${L.target}`),"TS_CLOUD_SHARED_PATHS_EOF"),T}function OY(E,_=900){let T=`${l0(E.base)}/deploy.lock`;return[`mkdir -p "$(dirname ${T})"`,`exec 9>${T}`,`flock -w ${_} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${_}s — refusing to race it" >&2; exit 1; }`]}function UY(E){let _=`${E.release}.incoming`;return[`rm -rf ${_}`,`mkdir -p ${_}`,...wo(E),'if [ "$TS_CLOUD_IS_LIVE" = "yes" ]; then',`  TS_CLOUD_STAGED=${_}`,"else",`  rm -rf ${E.release}`,`  mkdir -p ${E.release}`,`  rmdir ${_}`,`  TS_CLOUD_STAGED=${E.release}`,"fi"]}function hY(E){let _=`TS_CLOUD_TRAP_LIVE="$(readlink -f ${E.current} 2>/dev/null || true)"`,T=`TS_CLOUD_TRAP_TARGET="$(readlink -f ${E.release} 2>/dev/null || echo ${E.release})"`;return`trap '${`if [ $? -ne 0 ]; then ${_}; ${T}; [ "$TS_CLOUD_TRAP_LIVE" = "$TS_CLOUD_TRAP_TARGET" ] || rm -rf ${E.release}; fi`}' EXIT`}function wo(E){return[`TS_CLOUD_LIVE_PATH="$(readlink -f ${E.current} 2>/dev/null || true)"`,`TS_CLOUD_RELEASE_PATH="$(readlink -f ${E.release} 2>/dev/null || echo ${E.release})"`,'if [ -n "$TS_CLOUD_LIVE_PATH" ] && [ "$TS_CLOUD_LIVE_PATH" = "$TS_CLOUD_RELEASE_PATH" ]; then TS_CLOUD_IS_LIVE=yes; else TS_CLOUD_IS_LIVE=no; fi']}function $Y(E){let _=`${E.release}.incoming`;return[`if [ "$TS_CLOUD_STAGED" = "${_}" ]; then`,`  rm -rf ${E.release}.previous`,`  mv ${E.release} ${E.release}.previous`,`  mv ${_} ${E.release}`,`  rm -rf ${E.release}.previous`,"fi"]}function EI(E,_=oJ){let T=[];for(let R of _){let{path:N,target:L,seed:A}=Od(E,R),S=`${E.release}/${N}`,O=[`rm -rf ${S}`,`mkdir -p "$(dirname ${S})"`,`ln -sfn ${L} ${S}`];if(A){T.push(...O);continue}T.push(`if [ -e ${L} ]; then`,...O.map((U)=>`  ${U}`),"fi")}return T}function Ld(E,_){let T=Ad(E.base);return[`if [ -f ${T} ]; then`,'  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do','    [ -n "$TS_CLOUD_SP" ] || continue',`    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${E.shared}/$TS_CLOUD_SP"`,'    [ -e "$TS_CLOUD_TGT" ] || continue',`    rm -rf ${_}/"$TS_CLOUD_SP"`,`    mkdir -p "$(dirname ${_}/"$TS_CLOUD_SP")"`,`    ln -sfn "$TS_CLOUD_TGT" ${_}/"$TS_CLOUD_SP"`,`  done < ${T}`,"fi"]}function hh(E){return[`ln -sfn ${E.release} ${E.current}.tmp`,`mv -Tf ${E.current}.tmp ${E.current}`]}function Ud(E,_={}){let T=_.to?[`[ -d ${E.releases}/${_.to} ] || { echo "rollback target ${E.releases}/${_.to} not found" >&2; exit 1; }`,...Ld(E,`${E.releases}/${_.to}`),`ln -sfn ${E.releases}/${_.to} ${E.current}.tmp`,`mv -Tf ${E.current}.tmp ${E.current}`]:[`TS_CLOUD_CURRENT=$(readlink -f ${E.current} 2>/dev/null || true)`,`TS_CLOUD_PREV=$(ls -1dt ${E.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do [ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)`,'[ -n "$TS_CLOUD_PREV" ] || { echo "no previous release to roll back to" >&2; exit 1; }',...Ld(E,'"$TS_CLOUD_PREV"'),`ln -sfn "$TS_CLOUD_PREV" ${E.current}.tmp`,`mv -Tf ${E.current}.tmp ${E.current}`,'echo "rolled back to $TS_CLOUD_PREV"'];if(!_.unitBase)return T;let R=_.unitBase;return[...T,`TS_CLOUD_RB_ID=$(basename "$(readlink -f ${E.current})")`,`if [ -f /etc/systemd/system/${R}@.service ]; then systemctl start "${R}@\${TS_CLOUD_RB_ID}.service"; sleep 2; systemctl is-active --quiet "${R}@\${TS_CLOUD_RB_ID}.service" || { echo "rolled-back release failed to start" >&2; exit 1; }; systemctl enable "${R}@\${TS_CLOUD_RB_ID}.service" 2>/dev/null || true; systemctl list-units --plain --no-legend --type=service "${R}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${R}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done; elif [ -f /etc/systemd/system/${R}.service ]; then systemctl restart ${R}.service; fi`]}function $h(E,_=4){let T=Math.max(1,_);return[`TS_CLOUD_CURRENT=$(readlink -f ${E.current} 2>/dev/null || true)`,`ls -1dt ${E.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${T+1} | while read -r TS_CLOUD_OLD; do`,'  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',"done"]}function Qo(E){return`${l0(E)}/owner`}function DY(E,_){let T=Qo(E);return[`if [ -f "${T}" ]; then`,`  TS_CLOUD_OWNER=$(cat "${T}")`,`  if [ "$TS_CLOUD_OWNER" != "${_}" ]; then`,`    echo "[ts-cloud] REFUSING deploy: ${E} belongs to project '$TS_CLOUD_OWNER', not '${_}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${T} to transfer ownership." >&2`,"    exit 1","  fi","else",`  mkdir -p "$(dirname "${T}")"`,`  printf '%s\\n' "${_}" > "${T}"`,"fi"]}function _I(E,_){let T=l0(E),R=Bo(E,_.releaseId),N=SY(E),L=Math.max(1,_.keepLogs??20),A=_.commit||"",S=_.branch||"";return[`mkdir -p ${T}/deploys`,`exec > >(tee -a ${R}) 2>&1`,`echo "[ts-cloud] deploy ${_.releaseId} commit=${A} branch=${S} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,"ts_cloud_record_deploy() {","  TS_CLOUD_RC=$?",'  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',`  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${_.releaseId}" "${A}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${N}`,"}","trap ts_cloud_record_deploy EXIT",`ls -1t ${T}/deploys/*.log 2>/dev/null | tail -n +${L+1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`]}var oJ,w1=4;var G1=NE(()=>{oJ=["storage",".env"]});function TI(E,_){let T=_==="bun"?"/usr/local/bin/bun":_==="deno"?"/usr/local/bin/deno":"/usr/local/bin/node",R=E.replace(/^(bun|node|deno)\s+/,"");return`${T} ${R}`}function RI(E){let{siteName:_,slug:T,artifactFetch:R,releaseId:N,execStart:L,envEntries:A,port:S,keepReleases:O=w1,preStartCommands:U=[],healthCheckPath:h,healthGateSeconds:$=5,memoryHigh:D="2G",memoryMax:C}=E,J=E.zeroDowntime??S!=null,I=E.appDir??`/var/www/${_}`,W=m0(I,N),H=`${T}-${_}`,j=`${H}.service`,B=P1(T,_,N),Q=Sd([".env",...E.sharedPaths??[]]),K=pJ(A),q=U.length>0?[`cd ${W.release}`,...U]:[],x=["set -euo pipefail",...OY(W),hY(W),...R,...Q1(W,Q),...UY(W),`tar xzf ${B} -C "$TS_CLOUD_STAGED"`,`rm -f ${B}`,`cat > ${W.shared}/.env <<'TS_CLOUD_ENV_EOF'`,K,"TS_CLOUD_ENV_EOF",`chmod 600 ${W.shared}/.env`,...$Y(W),`find ${W.release} -maxdepth 1 \\( -type f -o -type l \\) -name '.env*' ! -name '.env.example' ! -name '*.example' -delete`,`sed -i -E '/^[[:space:]]*(PORT|PORT_BACKEND|PORT_ADMIN|PORT_FRONTEND)[[:space:]]*=/d' ${W.shared}/.env 2>/dev/null || true`,...EI(W,Q),...q];if(J&&S!=null){let b=`${H}@${N}.service`,f=h?h.startsWith("/")?h:`/${h}`:null,v=`{ echo "[ts-cloud] release ${N} failed its health gate — previous release keeps serving" >&2; journalctl -u ${b} -n 50 --no-pager >&2 || true; systemctl stop ${b} 2>/dev/null || true; exit 1; }`;return[...x,`cat > /etc/systemd/system/${H}@.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${_} release %i (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${W.releases}/%i`,`ExecStart=${L}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...D?[`MemoryHigh=${D}`]:[],...C?[`MemoryMax=${C}`]:[],`EnvironmentFile=${W.releases}/%i/.env`,`Environment=PORT=${S}`,"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",`TS_CLOUD_OLD_UNITS=$(systemctl list-units --plain --no-legend --type=service "${H}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${b}$" || true)`,`if [ -f /etc/systemd/system/${j} ] && systemctl is-active --quiet ${j}; then echo "[ts-cloud] retiring pre-zero-downtime unit ${j} (one-time restart cutover)"; systemctl stop ${j}; fi`,`systemctl restart ${b}`,`TS_CLOUD_GATE_OK=1; for TS_CLOUD_I in $(seq 1 ${Math.max(1,$)}); do sleep 1; systemctl is-active --quiet ${b} || { TS_CLOUD_GATE_OK=0; break; }; done`,`if [ "$TS_CLOUD_GATE_OK" -ne 1 ]; then echo "[ts-cloud] release ${N} could not overlap the previous release (no SO_REUSEPORT?) — retiring old instances and retrying" >&2; for TS_CLOUD_RU in \${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_RU" 2>/dev/null || true; done; systemctl restart ${b}; for TS_CLOUD_I in $(seq 1 ${Math.max(1,$)}); do sleep 1; systemctl is-active --quiet ${b} || ${v}; done; fi`,...f?[`curl -sf -o /dev/null --max-time 10 "http://127.0.0.1:${S}${f}" || ${v}`]:[],...hh(W),`systemctl enable ${b} 2>/dev/null || true`,'for TS_CLOUD_U in ${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done',`systemctl list-unit-files --plain --no-legend "${H}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v -e "^${b}$" -e "^${H}@\\.service$" || true; } | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`if [ -f /etc/systemd/system/${j} ]; then systemctl disable ${j} 2>/dev/null || true; rm -f /etc/systemd/system/${j}; systemctl daemon-reload; fi`,...$h(W,O)]}return[...x,`cat > /etc/systemd/system/${j} <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${_} (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${W.current}`,`ExecStart=${L}`,"Restart=always","RestartSec=5",`EnvironmentFile=${W.current}/.env`,...S?[`Environment=PORT=${S}`]:[],"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",`systemctl enable ${j}`,...hh(W),`systemctl restart ${j}`,`systemctl is-active ${j}`,...$h(W,O)]}function NI(E){let{siteName:_,artifactFetch:T,releaseId:R,keepReleases:N=w1,preStartCommands:L=[]}=E,A=E.appDir??`/var/www/${_}`,S=m0(A,R),O=P1(E.slug,_,R),U=L.length>0?[`cd ${S.release}`,...L]:[];return["set -euo pipefail",...OY(S),hY(S),...T,...Q1(S,[]),...UY(S),`tar xzf ${O} -C "$TS_CLOUD_STAGED"`,...$Y(S),`rm -f ${O}`,...U,...hh(S),...$h(S,N)]}function P1(E,_,T){return`/tmp/${[E,_,T].filter(Boolean).join("-")}-release.tar.gz`}function CY(E,_,T,R){return[`aws s3 cp "s3://${E}/${_}" ${R} --region ${T}`]}function XY(E,_){return[`mv "${E}" ${_}`]}function LI(){return['echo "[ts-cloud] host cleanup (disk before): $(df -h / | tail -1)"',"find /var/ts-cloud/staging -xdev -maxdepth 1 -type f -mmin +60 -delete 2>/dev/null || true",'find /tmp -xdev -maxdepth 1 -type f -name "*-release.tar.gz" -mmin +60 -delete 2>/dev/null || true',"find /root/.bun/install/cache -xdev -type f -mtime +7 -delete 2>/dev/null || true","find /root/.bun/install/cache -xdev -depth -type d -empty -delete 2>/dev/null || true","journalctl --vacuum-time=14d --vacuum-size=512M >/dev/null 2>&1 || true",'if command -v docker >/dev/null 2>&1; then docker image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi','if command -v podman >/dev/null 2>&1; then podman image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi',"if command -v apt-get >/dev/null 2>&1; then apt-get clean >/dev/null 2>&1 || true; fi",'echo "[ts-cloud] host cleanup (disk after): $(df -h / | tail -1)"']}var JY=NE(()=>{G1()});function IY(E){if(!E||typeof E!=="object")return E;return Object.fromEntries(Object.keys(E).map((_)=>[_,""]))}function Go(E){let _=JSON.parse(JSON.stringify(E??{}));if(_.hetzner)delete _.hetzner.apiToken;delete _.aws,delete _.stateDir;for(let T of Object.values(_.sites??{})){if(T?.env)T.env=IY(T.env);if(T?.environment)T.environment=IY(T.environment)}for(let T of Object.values(_.environments??{}))if(T?.variables)T.variables=IY(T.variables);for(let T of Object.values(_.infrastructure?.databases??{}))if(T?.password)T.password="";if(_.infrastructure?.appDatabase?.password)_.infrastructure.appDatabase.password="";if(_.infrastructure?.compute?.database?.password)_.infrastructure.compute.database.password="";if(_.infrastructure?.compute?.managedServices?.vitess?.password)_.infrastructure.compute.managedServices.vitess.password="";return _}function hd(E){let _=Go(E);return["// Generated by ts-cloud for the management dashboard — do not edit.","//","// This is the project's resolved cloud config, inlined so it needs no","// imports on the box. Credentials are deliberately absent.",`export default ${JSON.stringify(_,null,2)}`,""].join(`
+`)}function zo(E){return`"${E.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/\n/g,"\\n").replace(/\r/g,"\\r").replace(/\t/g,"\\t")}"`}function l0(E){return`${E.replace(/\/+$/,"")}/.ts-cloud`}function SY(E){return`${l0(E)}/deploy-history.log`}function Bo(E,_){return`${l0(E)}/deploys/${_}.log`}function Ad(E){return`${l0(E)}/shared-paths`}function m0(E,_){let T=E.replace(/\/+$/,"");return{base:T,releases:`${T}/releases`,shared:`${T}/shared`,current:`${T}/current`,release:`${T}/releases/${_}`}}function Ho(E){let _=E.split("/").pop()||E;if(_===".env"||_.startsWith(".env."))return!0;return/\.[a-z0-9]+$/i.test(_)}function jo(E){return typeof E==="string"?E:E.path}function Sd(E){let _=new Map;for(let T of E)_.set(jo(T),T);return[..._.values()]}function Od(E,_){if(typeof _==="string")return{path:_,target:`${E.shared}/${_}`,seed:!0};return{path:_.path,target:_.target??`${E.shared}/${_.path}`,seed:_.seed!==!1}}function Yo(E){return["ts_cloud_adopt_shared() {",'  TS_CLOUD_SP="$1"','  TS_CLOUD_DST="$2"',`  TS_CLOUD_SRC="${E.current}/$TS_CLOUD_SP"`,'  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi','  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi','  mkdir -p "$(dirname "$TS_CLOUD_DST")"','  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',"  for TS_CLOUD_SIDECAR in -wal -shm; do",'    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',"  done",'  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',"  return 0","}"]}function Q1(E,_=oJ){let T=[`mkdir -p ${E.releases} ${E.shared}`,...Yo(E)],R=_.map((L)=>Od(E,L));for(let{path:L,target:A,seed:S}of R){if(!S)continue;if(T.push(`ts_cloud_adopt_shared '${L}' '${A}'`),Ho(L))T.push(`mkdir -p "$(dirname ${A})"`,`touch ${A}`);else if(L==="storage")T.push(`mkdir -p ${A}/app/public`,`mkdir -p ${A}/framework/cache/data`,`mkdir -p ${A}/framework/sessions`,`mkdir -p ${A}/framework/testing`,`mkdir -p ${A}/framework/views`,`mkdir -p ${A}/logs`);else T.push(`mkdir -p ${A}`)}let N=Ad(E.base);return T.push(`mkdir -p ${l0(E.base)}`,`cat > ${N} <<'TS_CLOUD_SHARED_PATHS_EOF'`,...R.map((L)=>`${L.path}	${L.target}`),"TS_CLOUD_SHARED_PATHS_EOF"),T}function OY(E,_=900){let T=`${l0(E.base)}/deploy.lock`;return[`mkdir -p "$(dirname ${T})"`,`exec 9>${T}`,`flock -w ${_} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${_}s — refusing to race it" >&2; exit 1; }`]}function UY(E){let _=`${E.release}.incoming`;return[`rm -rf ${_}`,`mkdir -p ${_}`,...wo(E),'if [ "$TS_CLOUD_IS_LIVE" = "yes" ]; then',`  TS_CLOUD_STAGED=${_}`,"else",`  rm -rf ${E.release}`,`  mkdir -p ${E.release}`,`  rmdir ${_}`,`  TS_CLOUD_STAGED=${E.release}`,"fi"]}function hY(E){let _=`TS_CLOUD_TRAP_LIVE="$(readlink -f ${E.current} 2>/dev/null || true)"`,T=`TS_CLOUD_TRAP_TARGET="$(readlink -f ${E.release} 2>/dev/null || echo ${E.release})"`;return`trap '${`if [ $? -ne 0 ]; then ${_}; ${T}; [ "$TS_CLOUD_TRAP_LIVE" = "$TS_CLOUD_TRAP_TARGET" ] || rm -rf ${E.release}; fi`}' EXIT`}function wo(E){return[`TS_CLOUD_LIVE_PATH="$(readlink -f ${E.current} 2>/dev/null || true)"`,`TS_CLOUD_RELEASE_PATH="$(readlink -f ${E.release} 2>/dev/null || echo ${E.release})"`,'if [ -n "$TS_CLOUD_LIVE_PATH" ] && [ "$TS_CLOUD_LIVE_PATH" = "$TS_CLOUD_RELEASE_PATH" ]; then TS_CLOUD_IS_LIVE=yes; else TS_CLOUD_IS_LIVE=no; fi']}function $Y(E){let _=`${E.release}.incoming`;return[`if [ "$TS_CLOUD_STAGED" = "${_}" ]; then`,`  rm -rf ${E.release}.previous`,`  mv ${E.release} ${E.release}.previous`,`  mv ${_} ${E.release}`,`  rm -rf ${E.release}.previous`,"fi"]}function EI(E,_=oJ){let T=[];for(let R of _){let{path:N,target:L,seed:A}=Od(E,R),S=`${E.release}/${N}`,O=[`rm -rf ${S}`,`mkdir -p "$(dirname ${S})"`,`ln -sfn ${L} ${S}`];if(A){T.push(...O);continue}T.push(`if [ -e ${L} ]; then`,...O.map((U)=>`  ${U}`),"fi")}return T}function Ld(E,_){let T=Ad(E.base);return[`if [ -f ${T} ]; then`,'  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do','    [ -n "$TS_CLOUD_SP" ] || continue',`    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${E.shared}/$TS_CLOUD_SP"`,'    [ -e "$TS_CLOUD_TGT" ] || continue',`    rm -rf ${_}/"$TS_CLOUD_SP"`,`    mkdir -p "$(dirname ${_}/"$TS_CLOUD_SP")"`,`    ln -sfn "$TS_CLOUD_TGT" ${_}/"$TS_CLOUD_SP"`,`  done < ${T}`,"fi"]}function hh(E){return[`ln -sfn ${E.release} ${E.current}.tmp`,`mv -Tf ${E.current}.tmp ${E.current}`]}function Ud(E,_={}){let T=_.to?[`[ -d ${E.releases}/${_.to} ] || { echo "rollback target ${E.releases}/${_.to} not found" >&2; exit 1; }`,...Ld(E,`${E.releases}/${_.to}`),`ln -sfn ${E.releases}/${_.to} ${E.current}.tmp`,`mv -Tf ${E.current}.tmp ${E.current}`]:[`TS_CLOUD_CURRENT=$(readlink -f ${E.current} 2>/dev/null || true)`,`TS_CLOUD_PREV=$(ls -1dt ${E.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do [ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)`,'[ -n "$TS_CLOUD_PREV" ] || { echo "no previous release to roll back to" >&2; exit 1; }',...Ld(E,'"$TS_CLOUD_PREV"'),`ln -sfn "$TS_CLOUD_PREV" ${E.current}.tmp`,`mv -Tf ${E.current}.tmp ${E.current}`,'echo "rolled back to $TS_CLOUD_PREV"'];if(!_.unitBase)return T;let R=_.unitBase;return[...T,`TS_CLOUD_RB_ID=$(basename "$(readlink -f ${E.current})")`,`if [ -f /etc/systemd/system/${R}@.service ]; then systemctl start "${R}@\${TS_CLOUD_RB_ID}.service"; sleep 2; systemctl is-active --quiet "${R}@\${TS_CLOUD_RB_ID}.service" || { echo "rolled-back release failed to start" >&2; exit 1; }; systemctl enable "${R}@\${TS_CLOUD_RB_ID}.service" 2>/dev/null || true; systemctl list-units --plain --no-legend --type=service "${R}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${R}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done; elif [ -f /etc/systemd/system/${R}.service ]; then systemctl restart ${R}.service; fi`]}function $h(E,_=4){let T=Math.max(1,_);return[`TS_CLOUD_CURRENT=$(readlink -f ${E.current} 2>/dev/null || true)`,`ls -1dt ${E.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${T+1} | while read -r TS_CLOUD_OLD; do`,'  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',"done"]}function Qo(E){return`${l0(E)}/owner`}function DY(E,_){let T=Qo(E);return[`if [ -f "${T}" ]; then`,`  TS_CLOUD_OWNER=$(cat "${T}")`,`  if [ "$TS_CLOUD_OWNER" != "${_}" ]; then`,`    echo "[ts-cloud] REFUSING deploy: ${E} belongs to project '$TS_CLOUD_OWNER', not '${_}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${T} to transfer ownership." >&2`,"    exit 1","  fi","else",`  mkdir -p "$(dirname "${T}")"`,`  printf '%s\\n' "${_}" > "${T}"`,"fi"]}function _I(E,_){let T=l0(E),R=Bo(E,_.releaseId),N=SY(E),L=Math.max(1,_.keepLogs??20),A=_.commit||"",S=_.branch||"";return[`mkdir -p ${T}/deploys`,`exec > >(tee -a ${R}) 2>&1`,`echo "[ts-cloud] deploy ${_.releaseId} commit=${A} branch=${S} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,"ts_cloud_record_deploy() {","  TS_CLOUD_RC=$?",'  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',`  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${_.releaseId}" "${A}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${N}`,"}","trap ts_cloud_record_deploy EXIT",`ls -1t ${T}/deploys/*.log 2>/dev/null | tail -n +${L+1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`]}var oJ,w1=4;var G1=NE(()=>{oJ=["storage",".env"]});function TI(E,_){let T=_==="bun"?"/usr/local/bin/bun":_==="deno"?"/usr/local/bin/deno":"/usr/local/bin/node",R=E.replace(/^(bun|node|deno)\s+/,"");return`${T} ${R}`}function RI(E){let{siteName:_,slug:T,artifactFetch:R,releaseId:N,execStart:L,envEntries:A,port:S,keepReleases:O=w1,preStartCommands:U=[],healthCheckPath:h,healthGateSeconds:$=5,memoryHigh:D="2G",memoryMax:C}=E,J=E.zeroDowntime??S!=null,I=E.appDir??`/var/www/${_}`,W=m0(I,N),H=`${T}-${_}`,j=`${H}.service`,B=P1(T,_,N),Q=Sd([".env",...E.sharedPaths??[]]),K=pJ(A),q=U.length>0?[`cd ${W.release}`,...U]:[],x=["set -euo pipefail",...OY(W),hY(W),...R,...Q1(W,Q),...UY(W),`tar xzf ${B} -C "$TS_CLOUD_STAGED"`,`rm -f ${B}`,`cat > ${W.shared}/.env <<'TS_CLOUD_ENV_EOF'`,K,"TS_CLOUD_ENV_EOF",`chmod 600 ${W.shared}/.env`,...$Y(W),`find ${W.release} -maxdepth 1 \\( -type f -o -type l \\) -name '.env*' ! -name '.env.example' ! -name '*.example' -delete`,`sed -i -E '/^[[:space:]]*(PORT|PORT_BACKEND|PORT_ADMIN|PORT_FRONTEND)[[:space:]]*=/d' ${W.shared}/.env 2>/dev/null || true`,...EI(W,Q),...q];if(J&&S!=null){let b=`${H}@${N}.service`,f=h?h.startsWith("/")?h:`/${h}`:null,v=`{ echo "[ts-cloud] release ${N} failed its health gate — previous release keeps serving" >&2; journalctl -u ${b} -n 50 --no-pager >&2 || true; systemctl stop ${b} 2>/dev/null || true; exit 1; }`;return[...x,`cat > /etc/systemd/system/${H}@.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${_} release %i (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${W.releases}/%i`,`ExecStart=${L}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...D?[`MemoryHigh=${D}`]:[],...C?[`MemoryMax=${C}`]:[],`EnvironmentFile=${W.releases}/%i/.env`,`Environment=PORT=${S}`,"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",`TS_CLOUD_OLD_UNITS=$(systemctl list-units --plain --no-legend --type=service "${H}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${b}$" || true)`,`if [ -f /etc/systemd/system/${j} ] && systemctl is-active --quiet ${j}; then echo "[ts-cloud] retiring pre-zero-downtime unit ${j} (one-time restart cutover)"; systemctl stop ${j}; fi`,`systemctl restart ${b}`,`TS_CLOUD_GATE_OK=1; for TS_CLOUD_I in $(seq 1 ${Math.max(1,$)}); do sleep 1; systemctl is-active --quiet ${b} || { TS_CLOUD_GATE_OK=0; break; }; done`,`if [ "$TS_CLOUD_GATE_OK" -ne 1 ]; then echo "[ts-cloud] release ${N} could not overlap the previous release (no SO_REUSEPORT?) — retiring old instances and retrying" >&2; for TS_CLOUD_RU in \${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_RU" 2>/dev/null || true; done; systemctl restart ${b}; for TS_CLOUD_I in $(seq 1 ${Math.max(1,$)}); do sleep 1; systemctl is-active --quiet ${b} || ${v}; done; fi`,...f?[`curl -sf -o /dev/null --max-time 10 "http://127.0.0.1:${S}${f}" || ${v}`]:[],...hh(W),`systemctl enable ${b} 2>/dev/null || true`,'for TS_CLOUD_U in ${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done',`TS_CLOUD_LISTENING=0; for TS_CLOUD_I in $(seq 1 ${Math.max(1,$)}); do if ss -ltnH "sport = :${S}" 2>/dev/null | grep -q .; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] nothing is listening on ${S} after retiring the previous release — restarting ${b} on the now-free port" >&2; systemctl restart ${b}; for TS_CLOUD_I in $(seq 1 ${Math.max(1,$)}); do if ss -ltnH "sport = :${S}" 2>/dev/null | grep -q .; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done; fi`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] ${b} is active but never bound ${S}" >&2; journalctl -u ${b} -n 50 --no-pager >&2 || true; exit 1; fi`,`systemctl list-unit-files --plain --no-legend "${H}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v -e "^${b}$" -e "^${H}@\\.service$" || true; } | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`if [ -f /etc/systemd/system/${j} ]; then systemctl disable ${j} 2>/dev/null || true; rm -f /etc/systemd/system/${j}; systemctl daemon-reload; fi`,...$h(W,O)]}return[...x,`cat > /etc/systemd/system/${j} <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${_} (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${W.current}`,`ExecStart=${L}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...D?[`MemoryHigh=${D}`]:[],...C?[`MemoryMax=${C}`]:[],`EnvironmentFile=${W.current}/.env`,...S?[`Environment=PORT=${S}`]:[],"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",`systemctl enable ${j}`,...hh(W),`systemctl restart ${j}`,`systemctl is-active ${j}`,...$h(W,O)]}function NI(E){let{siteName:_,artifactFetch:T,releaseId:R,keepReleases:N=w1,preStartCommands:L=[]}=E,A=E.appDir??`/var/www/${_}`,S=m0(A,R),O=P1(E.slug,_,R),U=L.length>0?[`cd ${S.release}`,...L]:[];return["set -euo pipefail",...OY(S),hY(S),...T,...Q1(S,[]),...UY(S),`tar xzf ${O} -C "$TS_CLOUD_STAGED"`,...$Y(S),`rm -f ${O}`,...U,...hh(S),...$h(S,N)]}function P1(E,_,T){return`/tmp/${[E,_,T].filter(Boolean).join("-")}-release.tar.gz`}function CY(E,_,T,R){return[`aws s3 cp "s3://${E}/${_}" ${R} --region ${T}`]}function XY(E,_){return[`mv "${E}" ${_}`]}function LI(){return['echo "[ts-cloud] host cleanup (disk before): $(df -h / | tail -1)"',"find /var/ts-cloud/staging -xdev -maxdepth 1 -type f -mmin +60 -delete 2>/dev/null || true",'find /tmp -xdev -maxdepth 1 -type f -name "*-release.tar.gz" -mmin +60 -delete 2>/dev/null || true',"find /root/.bun/install/cache -xdev -type f -mtime +7 -delete 2>/dev/null || true","find /root/.bun/install/cache -xdev -depth -type d -empty -delete 2>/dev/null || true","journalctl --vacuum-time=14d --vacuum-size=512M >/dev/null 2>&1 || true",'if command -v docker >/dev/null 2>&1; then docker image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi','if command -v podman >/dev/null 2>&1; then podman image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi',"if command -v apt-get >/dev/null 2>&1; then apt-get clean >/dev/null 2>&1 || true; fi",'echo "[ts-cloud] host cleanup (disk after): $(df -h / | tail -1)"']}var JY=NE(()=>{G1()});function IY(E){if(!E||typeof E!=="object")return E;return Object.fromEntries(Object.keys(E).map((_)=>[_,""]))}function Go(E){let _=JSON.parse(JSON.stringify(E??{}));if(_.hetzner)delete _.hetzner.apiToken;delete _.aws,delete _.stateDir;for(let T of Object.values(_.sites??{})){if(T?.env)T.env=IY(T.env);if(T?.environment)T.environment=IY(T.environment)}for(let T of Object.values(_.environments??{}))if(T?.variables)T.variables=IY(T.variables);for(let T of Object.values(_.infrastructure?.databases??{}))if(T?.password)T.password="";if(_.infrastructure?.appDatabase?.password)_.infrastructure.appDatabase.password="";if(_.infrastructure?.compute?.database?.password)_.infrastructure.compute.database.password="";if(_.infrastructure?.compute?.managedServices?.vitess?.password)_.infrastructure.compute.managedServices.vitess.password="";return _}function hd(E){let _=Go(E);return["// Generated by ts-cloud for the management dashboard — do not edit.","//","// This is the project's resolved cloud config, inlined so it needs no","// imports on the box. Credentials are deliberately absent.",`export default ${JSON.stringify(_,null,2)}`,""].join(`
 `)}var Hd={};Q_(Hd,{stageLiveDashboardRoot:()=>Bd,resolveUiSource:()=>Dh,resolveDashboardVersion:()=>zd,resolveDashboardAuth:()=>SI,managementDashboardSiteNames:()=>OI,liveStageDir:()=>Fd,ensureManagementDashboard:()=>Ch,dashboardCredentialsFile:()=>M1,buildManagementDashboardArtifact:()=>K1,MANAGEMENT_DASHBOARD_SITE:()=>AI});import{execSync as $d}from"node:child_process";import{randomBytes as Po}from"node:crypto";import{chmodSync as Mo,copyFileSync as Ko,existsSync as n0,mkdirSync as Dd,readFileSync as Cd,statSync as Vo,writeFileSync as FY}from"node:fs";import{tmpdir as Zo}from"node:os";import{basename as qo,dirname as zY,isAbsolute as Xd,join as RR,resolve as xo}from"node:path";import{fileURLToPath as Jd}from"node:url";function M1(){return NL("dashboard-credentials.json")}function yo(){return Po(24).toString("base64url")}function SI(E,_,T){let R=process.env.TS_CLOUD_UI_PASSWORD?.trim();if(R)return{password:R,source:"env"};if(WY(process.env.TS_CLOUD_UI_PUBLIC))return{password:void 0,source:"public"};let N=M1(),L=b_(E,"dashboard-credentials.json");try{if(n0(L)){let S=JSON.parse(Cd(L,"utf8"));if(S?.password)return{password:S.password,source:"generated"}}}catch{}let A=yo();try{Dd(zY(L),{recursive:!0}),FY(L,`${JSON.stringify({username:_,password:A,generatedAt:new Date().toISOString()},null,2)}
 `),Mo(L,384),T.info(`Management dashboard: generated a password for '${_}' and saved it to ${N} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`)}catch(S){T.warn(`Management dashboard: could not persist the generated password (${S?.message??S}). Using it for this deploy only — pass: ${A}
 This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${N} is writable.`)}return{password:A,source:"generated"}}function WY(E){return E!=null&&E!==""&&E!=="0"&&E.toLowerCase()!=="false"}function Fd(){return NL("dashboard-release")}function Wd(){let E=zY(Jd(import.meta.url));for(let _ of[RR(E,"..","..","package.json"),RR(E,"..","package.json")])try{let T=JSON.parse(Cd(_,"utf8"));if(T.name==="@stacksjs/ts-cloud"&&T.version)return`^${T.version}`}catch{}return"latest"}function zd(){return process.env.TS_CLOUD_UI_VERSION?.trim()||Wd()}function Bd(E,_,T){if(!E?.project?.slug)return T.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard."),null;let R=b_(_,"dashboard-release");try{Dd(R,{recursive:!0}),FY(RR(R,"cloud.config.ts"),hd(E));let N=zd();if(N.startsWith("file:")){let A=N.slice(5),S=Xd(A)?A:xo(_,A);if(!n0(S)||!Vo(S).isFile())N=Wd(),T.warn(`Management dashboard: TS_CLOUD_UI_VERSION points to a missing package file (${S}); using the deploying ts-cloud version ${N} instead.`);else{let O=qo(S),U=RR(R,O);if(S!==U)Ko(S,U);N=`file:./${O}`}}let L={name:"ts-cloud-dashboard",private:!0,type:"module",dependencies:{"@stacksjs/ts-cloud":N}};return FY(RR(R,"package.json"),`${JSON.stringify(L,null,2)}
@@ -9697,7 +9697,7 @@ Run \`${this.name??"cli"} --help\` for usage.`;xA.stderr.write(`${L}${N}${A}
 `).length-1;this.output.write(VL.move(-999,E*-1))}render(){let E=Y9(this._render(this)??"",j9.stdout.columns,{hard:!0,trim:!1});if(E===this._prevFrame)return;if(this.state==="initial")this.output.write(VL.hide);else{let _=mf(this._prevFrame,E);if(this.restoreCursor(),_&&_?.length===1){let T=_[0];this.output.write(VL.move(0,T)),this.output.write(PF.lines(1));let R=E.split(`
 `);this.output.write(R[T]),this._prevFrame=E,this.output.write(VL.move(0,R.length-T-1));return}if(_&&_?.length>1){let T=_[0];this.output.write(VL.move(0,T)),this.output.write(PF.down());let N=E.split(`
 `).slice(T);this.output.write(N.join(`
-`)),this._prevFrame=E;return}this.output.write(PF.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function of(E,_){if(E===void 0)return 0;if(_.length===0)return 0;let R=_.findIndex((N)=>N.value===E);return R!==-1?R:0}function Ek(E,_){return(_.label??String(_.value)).toLowerCase().includes(E.toLowerCase())}function _k(E,_){if(!_)return;if(E)return _;return _[0]}class Tk extends qF{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#T="";#R;#_;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return zC.inverse(zC.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[_,...T]=this.userInput.slice(this._cursor);return`${E}${zC.inverse(_)}${T.join("")}`}get options(){if(typeof this.#_==="function")return this.#_();return this.#_}constructor(E){super(E);this.#_=E.options;let _=this.options;this.filteredOptions=[..._],this.multiple=E.multiple===!0,this.#R=E.filter??Ek;let T;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)T=E.initialValue;else T=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)T=[this.options[0].value];if(T)for(let R of T){let N=_.findIndex((L)=>L.value===R);if(N!==-1)this.toggleSelected(R),this.#E=N}this.focusedValue=this.options[this.#E]?.value,this.on("key",(R,N)=>this.#N(R,N)),this.on("userInput",(R)=>this.#L(R))}_isActionKey(E,_){return E==="\t"||this.multiple&&this.isNavigating&&_.name==="space"&&E!==void 0&&E!==""}#N(E,_){let T=_.name==="up",R=_.name==="down",N=_.name==="return";if(T||R){if(this.#E=Math.max(0,Math.min(this.#E+(T?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(N)this.value=_k(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(_.name==="tab"||this.isNavigating&&_.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((_)=>_!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#L(E){if(E!==this.#T){this.#T=E;let _=this.options;if(E)this.filteredOptions=_.filter((T)=>this.#R(E,T));else this.filteredOptions=[..._];if(this.#E=of(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class Rk extends qF{options;cursor=0;#E;getGroupItems(E){return this.options.filter((_)=>_.group===E)}isGroupSelected(E){let _=this.getGroupItems(E),T=this.value;if(T===void 0)return!1;return _.every((R)=>T.includes(R.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let _=String(E.value),T=this.getGroupItems(_);if(this.isGroupSelected(_))this.value=this.value.filter((R)=>T.findIndex((N)=>N.value===R)===-1);else this.value=[...this.value,...T.map((R)=>R.value)];this.value=Array.from(new Set(this.value))}else{let _=this.value.includes(E.value);this.value=_?this.value.filter((T)=>T!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:_}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(_).flatMap(([T,R])=>[{value:T,group:!0,label:T},...R.map((N)=>({...N,group:T}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:T})=>T===E.cursorAt),this.#E?0:1),this.on("cursor",(T)=>{switch(T){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let R=this.options[this.cursor]?.group===!0;if(!this.#E&&R)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let R=this.options[this.cursor]?.group===!0;if(!this.#E&&R)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var Nk=$f();var Z_=(E,_)=>Nk?E:_,xAE=Z_("◆","*"),yAE=Z_("■","x"),fAE=Z_("▲","x"),kAE=Z_("◇","o"),bAE=Z_("┌","T"),Lk=Z_("│","|"),gAE=Z_("└","—"),cAE=Z_("●",">"),vAE=Z_("○"," "),rAE=Z_("◻","[•]"),uAE=Z_("◼","[+]"),tAE=Z_("◻","[ ]"),lAE=Z_("▪","•"),mAE=Z_("─","-"),nAE=Z_("╮","+"),eAE=Z_("├","+"),aAE=Z_("╯","+"),iAE=Z_("●","•"),sAE=Z_("◆","*"),pAE=Z_("▲","!"),oAE=Z_("■","x");var ESE={light:Z_("─","-"),heavy:Z_("━","="),block:Z_("█","#")};function Ak(){return`${zC.gray(Lk)}  `}var _SE=Ak();var xF="0.7.121";kE();import{existsSync as uF}from"node:fs";import{mkdir as Fk,writeFile as v9}from"node:fs/promises";function tF(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(_)=>{if(r("Initializing ts-cloud Project"),uF("cloud.config.ts")){if(!await WE("cloud.config.ts already exists. Overwrite?",!1)){X("Initialization cancelled");return}}let T=_?.name||await X_("Project name","my-app"),R=_?.mode||await jC("Select deployment mode",["serverless","server"]),N=_?.region||await jC("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),L=new l("Creating configuration file...");L.start();let A=`import { defineConfig } from '@ts-cloud/core'
+`)),this._prevFrame=E;return}this.output.write(PF.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function of(E,_){if(E===void 0)return 0;if(_.length===0)return 0;let R=_.findIndex((N)=>N.value===E);return R!==-1?R:0}function Ek(E,_){return(_.label??String(_.value)).toLowerCase().includes(E.toLowerCase())}function _k(E,_){if(!_)return;if(E)return _;return _[0]}class Tk extends qF{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#T="";#R;#_;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return zC.inverse(zC.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[_,...T]=this.userInput.slice(this._cursor);return`${E}${zC.inverse(_)}${T.join("")}`}get options(){if(typeof this.#_==="function")return this.#_();return this.#_}constructor(E){super(E);this.#_=E.options;let _=this.options;this.filteredOptions=[..._],this.multiple=E.multiple===!0,this.#R=E.filter??Ek;let T;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)T=E.initialValue;else T=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)T=[this.options[0].value];if(T)for(let R of T){let N=_.findIndex((L)=>L.value===R);if(N!==-1)this.toggleSelected(R),this.#E=N}this.focusedValue=this.options[this.#E]?.value,this.on("key",(R,N)=>this.#N(R,N)),this.on("userInput",(R)=>this.#L(R))}_isActionKey(E,_){return E==="\t"||this.multiple&&this.isNavigating&&_.name==="space"&&E!==void 0&&E!==""}#N(E,_){let T=_.name==="up",R=_.name==="down",N=_.name==="return";if(T||R){if(this.#E=Math.max(0,Math.min(this.#E+(T?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(N)this.value=_k(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(_.name==="tab"||this.isNavigating&&_.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((_)=>_!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#L(E){if(E!==this.#T){this.#T=E;let _=this.options;if(E)this.filteredOptions=_.filter((T)=>this.#R(E,T));else this.filteredOptions=[..._];if(this.#E=of(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class Rk extends qF{options;cursor=0;#E;getGroupItems(E){return this.options.filter((_)=>_.group===E)}isGroupSelected(E){let _=this.getGroupItems(E),T=this.value;if(T===void 0)return!1;return _.every((R)=>T.includes(R.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let _=String(E.value),T=this.getGroupItems(_);if(this.isGroupSelected(_))this.value=this.value.filter((R)=>T.findIndex((N)=>N.value===R)===-1);else this.value=[...this.value,...T.map((R)=>R.value)];this.value=Array.from(new Set(this.value))}else{let _=this.value.includes(E.value);this.value=_?this.value.filter((T)=>T!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:_}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(_).flatMap(([T,R])=>[{value:T,group:!0,label:T},...R.map((N)=>({...N,group:T}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:T})=>T===E.cursorAt),this.#E?0:1),this.on("cursor",(T)=>{switch(T){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let R=this.options[this.cursor]?.group===!0;if(!this.#E&&R)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let R=this.options[this.cursor]?.group===!0;if(!this.#E&&R)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var Nk=$f();var Z_=(E,_)=>Nk?E:_,xAE=Z_("◆","*"),yAE=Z_("■","x"),fAE=Z_("▲","x"),kAE=Z_("◇","o"),bAE=Z_("┌","T"),Lk=Z_("│","|"),gAE=Z_("└","—"),cAE=Z_("●",">"),vAE=Z_("○"," "),rAE=Z_("◻","[•]"),uAE=Z_("◼","[+]"),tAE=Z_("◻","[ ]"),lAE=Z_("▪","•"),mAE=Z_("─","-"),nAE=Z_("╮","+"),eAE=Z_("├","+"),aAE=Z_("╯","+"),iAE=Z_("●","•"),sAE=Z_("◆","*"),pAE=Z_("▲","!"),oAE=Z_("■","x");var ESE={light:Z_("─","-"),heavy:Z_("━","="),block:Z_("█","#")};function Ak(){return`${zC.gray(Lk)}  `}var _SE=Ak();var xF="0.7.123";kE();import{existsSync as uF}from"node:fs";import{mkdir as Fk,writeFile as v9}from"node:fs/promises";function tF(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(_)=>{if(r("Initializing ts-cloud Project"),uF("cloud.config.ts")){if(!await WE("cloud.config.ts already exists. Overwrite?",!1)){X("Initialization cancelled");return}}let T=_?.name||await X_("Project name","my-app"),R=_?.mode||await jC("Select deployment mode",["serverless","server"]),N=_?.region||await jC("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),L=new l("Creating configuration file...");L.start();let A=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -10051,7 +10051,7 @@ Resources to create: ${Q}`);let K={};for(let q of Object.values(U.Resources||{})
 No changes detected - infrastructure is up to date`);return}if(X(`
 Changes detected:
 `),W.length>0){g(`Resources to add (${W.length}):`);for(let B of W){let Q=C[B].Type;X(`  + ${B} (${Q})`)}console.log()}if(H.length>0){d(`Resources to remove (${H.length}):`);for(let B of H){let Q=D[B].Type;X(`  - ${B} (${Q})`)}console.log()}if(j.length>0){_E(`Resources to modify (${j.length}):`);for(let B of j){let Q=C[B].Type;X(`  ~ ${B} (${Q})`)}console.log()}X("Summary:"),X(`  - Add: ${W.length}`),X(`  - Remove: ${H.length}`),X(`  - Modify: ${j.length}`),X("\nRun `cloud deploy` to apply these changes")}catch(T){d(`Diff failed: ${T.message}`)}})}kE();await sE();XU();_D();function NS(E,_=0){let T=Number(E);return Number.isFinite(T)?T:_}function NH(E){return NS(E)*1024}function Re(E){let _=E?.date?.trim(),T=E?.time?.trim();if(!_||!T)return null;let R=new Date(`${_}T${T}Z`);return Number.isFinite(R.getTime())?R.toISOString():null}function Ne(E,_,T){let R;try{R=JSON.parse(E)}catch{return[]}let N=(R?.sysstat?.hosts??[]).flatMap((A)=>A.statistics??[]),L=[];for(let A of N){let S=Re(A.timestamp);if(!S)continue;let O=new Date(S).getTime();if(O<_.getTime()||O>T.getTime())continue;let U=A["cpu-load"]?.find(($)=>$.cpu==="all")??A["cpu-load"]?.[0],h=NS(U?.idle,100);L.push({timestamp:S,cpuUsedPercent:Math.max(0,Math.min(100,100-h)),cpuUserPercent:NS(U?.user),cpuSystemPercent:NS(U?.system),cpuIowaitPercent:NS(U?.iowait),memoryUsedPercent:NS(A.memory?.["memused-percent"]),memoryUsedBytes:NH(A.memory?.memused),memoryAvailableBytes:NH(A.memory?.avail),swapUsedPercent:NS(A.memory?.["swpused-percent"]),swapUsedBytes:NH(A.memory?.swpused)})}return L.sort((A,S)=>A.timestamp.localeCompare(S.timestamp))}function Le(E){return Object.fromEntries(Object.entries(E.time_series??{}).map(([_,T])=>[_,(T.values??[]).map(([R,N])=>({timestamp:new Date(Number(R)*1000).toISOString(),value:NS(N,Number.NaN)})).filter((R)=>Number.isFinite(R.value))]))}function vM(E){return E.length?E.reduce((_,T)=>_+T,0)/E.length:null}function LH(E){return E.length?Math.max(...E):null}function Ae(E){return E.length?Math.min(...E):null}async function rM(E){let[_,T]=await Promise.all([E.client.getServerMetrics(E.serverId,{types:["cpu","disk","network"],start:E.from,end:E.to,step:E.step}),UN(E.remote.host,"LC_ALL=C sadf -j -- -u -r -S",E.remote).catch(()=>"")]),R=Ne(T,E.from,E.to),N=Le(_),A=(N.cpu??[]).map(($)=>Math.max(0,Math.min(100,$.value/Math.max(1,E.cores)))),S=R.map(($)=>$.cpuUsedPercent),O=A.length?A:S,U=R.map(($)=>$.memoryUsedPercent),h=R.map(($)=>$.swapUsedPercent);return{from:E.from.toISOString(),to:E.to.toISOString(),cores:E.cores,host:R,provider:N,summary:{cpuAveragePercent:vM(O),cpuPeakPercent:LH(O),memoryAveragePercent:vM(U),memoryPeakPercent:LH(U),memoryMinimumAvailableBytes:Ae(R.map(($)=>$.memoryAvailableBytes)),swapPeakPercent:LH(h)}}}HH();wH();PH();ZH();P2();await n_([WH(),$S()]);await g_();import{createHash as ge}from"node:crypto";var A4=async(E)=>{let _=Bun.spawn(E,{stdout:"pipe",stderr:"pipe"}),[T,R,N]=await Promise.all([_.exited,new Response(_.stdout).text(),new Response(_.stderr).text()]);return{code:T,stdout:R,stderr:N}};class S4{async scan(E,_){let T=await A4(["ssh-keyscan","-T","10","-p",String(_),"-t","ed25519",E]),R=T.stdout.split(`
-`).find((N)=>N&&!N.startsWith("#"))?.trim().split(/\s+/);if(T.code!==0||!R?.[1]||!R[2])throw Error(`SSH host-key scan failed: ${T.stderr.trim()||"no key returned"}`);return{algorithm:R[1],key:R[2]}}async exec(E,_){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return A4(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,_])}}var ce=(E)=>`SHA256:${ge("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,ve=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class oL{provider;transport;discoverer;constructor(E,_=new S4,T){this.provider=E;this.transport=_;this.discoverer=T}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let _=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:_.algorithm,hostKeyFingerprint:ce(_.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let _=await this.transport.exec(E,ve);if(_.code!==0)throw Error(`Fleet validation failed: ${_.stderr.trim()||_.code}`);try{return JSON.parse(_.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,_){let T=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${_.length}`);if(T.code!==0)throw Error(`Fleet bootstrap failed: ${T.stderr.trim()||T.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function O4(E,_){return{"fleet.bootstrap":async(T)=>{let R=T.operation.input&&typeof T.operation.input==="object"&&!Array.isArray(T.operation.input)?T.operation.input:{},N=E.get(String(R.serverId??""));if(!N)throw Error("Queued fleet server was not found.");let L=_.find((O)=>O.provider===N.provider);if(!L)throw Error(`No ${N.provider} fleet driver is configured.`);let A=Array.isArray(R.steps)?R.steps.map(String):[];if(T.checkpoint("preflight","Rechecking pinned trust and healthy validation."),N.trustState!=="pinned"||!N.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");T.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let S=await L.bootstrap(N,A);return E.update(N.id,{bootstrapVersion:S.version,status:"ready"}),T.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:N.id,bootstrapVersion:S.version,steps:A.length}}}}var CL=(E)=>E==null?void 0:String(E),B0=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},dH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:CL(E.provider_id),region:CL(E.region),zone:CL(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:CL(E.host_key_algorithm),hostKeyFingerprint:CL(E.host_key_fingerprint),pendingHostKey:CL(E.pending_host_key),roles:B0(E.roles,[]),labels:B0(E.labels,{}),taints:B0(E.taints,[]),capacity:B0(E.capacity,{}),usage:B0(E.usage,{}),capabilities:B0(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:B0(E.validation,void 0),bootstrapVersion:CL(E.bootstrap_version),heartbeatAt:CL(E.heartbeat_at),lastSeenAt:CL(E.last_seen_at),archivedAt:CL(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class XL{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}get(E){let _=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return _?dH(_):void 0}list(E,_=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(dH).filter((T)=>_||T.status!=="archived")}findProvider(E,_,T){let R=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,_,T);return R?dH(R):void 0}create(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,T,T]),this.get(_)}update(E,_){let T=this.get(E);if(!T)throw Error("Server was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[R.name,R.providerId??null,R.region??null,R.zone??null,R.endpoint,R.sshUser,R.sshPort,R.credentialRef,R.hostKeyAlgorithm??null,R.hostKeyFingerprint??null,R.pendingHostKey??null,JSON.stringify(R.roles),JSON.stringify(R.labels),JSON.stringify(R.taints),JSON.stringify(R.capacity),JSON.stringify(R.usage),JSON.stringify(R.capabilities),R.status,R.trustState,JSON.stringify(R.validation??{}),R.bootstrapVersion??null,R.heartbeatAt??null,R.lastSeenAt??null,R.archivedAt??null,N,E]),this.get(E)}}var re=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class OD{store;drivers;now;queue;constructor(E,_,T,R=()=>new Date){this.store=E;this.drivers=_;this.now=R;this.queue=T??new pE(E.control)}driver(E){let _=this.drivers.find((T)=>T.provider===E);if(!_)throw Error(`No ${E} fleet driver is configured.`);return _}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!re.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let _=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(_)return this.store.update(_.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let T=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),R=this.driver(E.provider);return this.store.create({...E,resourceId:T.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:R.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let T=await this.driver(_.provider).test(_);if(!T.reachable)return this.store.update(E,{status:"unreachable"});if(_.hostKeyFingerprint&&_.hostKeyFingerprint!==T.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:T.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:T.hostKeyAlgorithm,hostKeyFingerprint:T.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,_){let T=this.store.get(E);if(!T||T.pendingHostKey!==_)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:_,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let _=this.store.get(E);if(!_||_.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let T=await this.driver(_.provider).validate(_),R=[];if(!["x64","arm64","x86_64","aarch64"].includes(T.arch??""))R.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let A of["curl","tar"])if(!T.tools?.[A])R.push({code:`tool.${A}`,severity:"error",message:`${A} is missing.`,remediation:`Install ${A} before bootstrap.`});if(Math.abs(T.timeSkewSeconds??0)>60)R.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!T.dnsOk)R.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let N={valid:!R.some((A)=>A.severity==="error"),facts:T,findings:R,validatedAt:this.now().toISOString(),validatorVersion:"1"},L={cpu:T.cpuCores??0,memoryBytes:T.memoryBytes??0,diskBytes:T.diskBytes??0};return this.store.update(E,{validation:N,capacity:L,status:N.valid?"ready":"degraded"})}bootstrap(E,_=!1){let T=this.store.get(E);if(!T?.validation?.valid)throw Error("A healthy validation report is required.");let R=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!_)return{preview:!0,steps:R};let N=this.queue.enqueue({projectId:T.projectId,resourceId:T.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:R},lockKey:`server:${E}`,providerKey:T.provider}).operation;return{preview:!1,steps:R,operation:N}}heartbeat(E,_){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let R=this.now().toISOString();return this.store.update(E,{usage:_.usage,capabilities:_.capabilities??T.capabilities,heartbeatAt:R,lastSeenAt:R,status:T.status==="draining"||T.status==="drained"?T.status:"ready"})}drain(E,_=!1){return this.store.update(E,{status:_?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,_){let T=this.store.get(E);if(!T||_!==T.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function ue(){let E=await o(),_=mE(process.cwd(),E),T=new XL(_.store),R=new OD(T,[new oL("aws"),new oL("hetzner"),new oL("ssh")]);return{controlPlane:_,store:T,service:R}}async function EA(E){let _=await ue();try{return await E(_)}finally{_.controlPlane.store.close()}}var H0=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!T)throw Error(`Server ${_} was not found.`);return T},$N=(E)=>{d(E instanceof Error?E.message:String(E)),process.exitCode=1};function qH(E,_){let T=Number.parseInt(E??"",10);return Number.isFinite(T)&&T>=0?T:_}function te(E="3h"){let _=E.match(/^(\d+)(m|h)$/);if(!_)throw Error("--range must use minutes or hours, for example 30m or 3h.");let T=Number(_[1])*(_[2]==="h"?3600000:60000);if(T<300000||T>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return T}function UD(E,_="%"){return E==null?"unavailable":`${E.toFixed(1)}${_}`}async function le(E,_){let T=await o();if(T.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",N=B_(T,R),L=await fN(N);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${L.serverName}.`);let A=$U(T),S=new aL({apiToken:DU(A.apiToken,T)}),O=await S.getServer(L.serverId),U=L.publicIp??O.public_net.ipv4?.ip;if(!U)throw Error(`Server ${O.name} has no public IPv4 address.`);let h=new Date,$=new Date(h.getTime()-te(_.range)),D=Math.min(3600,Math.max(60,qH(_.step,60))),C=await rM({client:S,serverId:O.id,cores:Math.max(1,Number(O.server_type.cores)||1),from:$,to:h,step:D,remote:{host:U,user:L.sshUser??A.sshUser,identityFile:A.sshPrivateKeyPath,connectTimeoutSec:15}});if(_.json){console.log(JSON.stringify({schemaVersion:1,server:O.name,result:C},null,2));return}p(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[O.name,`${C.from} to ${C.to}`,`${UD(C.summary.cpuAveragePercent)} / ${UD(C.summary.cpuPeakPercent)}`,`${UD(C.summary.memoryAveragePercent)} / ${UD(C.summary.memoryPeakPercent)}`,C.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(C.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,UD(C.summary.swapPeakPercent)]])}function U4(E){let _=E.targetType.prices?.find((T)=>T.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:_?{hourlyNet:_.price_hourly.net,hourlyGross:_.price_hourly.gross,monthlyNet:_.price_monthly.net,monthlyGross:_.price_monthly.gross}:void 0}}function me(E){let _=U4(E);p(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${_.serverName} (${_.serverId})`,_.location,`${_.from} -> ${_.to}`,_.capacityAvailable?"available":"waiting",`${_.target.cores??0} / ${_.target.memoryGb??0} GB / ${_.target.diskGb??0} GB`,_.price?.monthlyGross??_.price?.monthlyNet??"not reported"]])}async function ne(E,_,T){let R=await o();if(R.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let N=T.env??process.env.CLOUD_ENV??"production",L=B_(R,N),A=await fN(L),S=$U(R),O=new aL({apiToken:DU(S.apiToken,R)}),h=A&&(E===A.serverName||E===String(A.serverId)||E===A.stackName)?await O.getServer(A.serverId):(await O.listServers()).find((q)=>q.name===E||String(q.id)===E);if(!h)throw Error(`Hetzner server ${E} was not found.`);if(A?.serverId&&A.serverId!==h.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${A.serverId}.`);let $=iL(_),D=T.upgradeDisk!==!1,C=await SD(O,h.id,$,D);if(T.json)console.log(JSON.stringify({schemaVersion:1,plan:U4(C)},null,2));else me(C);if(!T.apply){if(!T.json)X(`Preview only. Re-run with --apply --confirm ${h.name} to execute.`);return}if(T.confirm!==h.name)throw Error(`Resize requires --confirm ${h.name}.`);let J=A?.publicIp??h.public_net.ipv4?.ip;if(!J)throw Error(`Server ${h.name} has no public IPv4 address for verification.`);let I={host:J,user:A?.sshUser??S.sshUser,identityFile:S.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},W=await KH(L),H=new Date().toISOString(),j={schemaVersion:1,operationId:W?.targetType===$&&W.serverId===h.id?W.operationId:crypto.randomUUID(),stackName:L,serverId:h.id,serverName:h.name,sourceType:C.currentType.name,targetType:$,upgradeDisk:D,phase:"planning",status:"running",attempts:W?.targetType===$?W.attempts:0,startedAt:W?.targetType===$?W.startedAt:H,updatedAt:H,manifest:W?.targetType===$?W.manifest:void 0};await pL(j);let B=qH(T.pollSeconds,900)*1000,Q=qH(T.maxWaitMinutes,0)*60000,K=Date.now();for(;;){let q=await SD(O,h.id,$,D);if(!q.capacityAvailable&&!q.alreadyComplete){if(j={...j,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await pL(j),!T.wait){if(!T.json)X(`${$} has no capacity in ${q.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(Q>0&&Date.now()-K>=Q)throw Error(`Timed out waiting for ${$} capacity in ${q.location}.`);if(!T.json)X(`Waiting ${Math.round(B/1000)} seconds for ${$} capacity...`);await Bun.sleep(B);continue}let x=await VH(L);try{let b=await(async()=>{try{return j={...j,status:"running",attempts:j.attempts+1,updatedAt:new Date().toISOString()},await pL(j),await YH({client:O,serverId:h.id,targetType:$,upgradeDisk:D,resumeFromOff:j.phase==="shutting-down"||j.phase==="resizing"||j.phase==="powering-on"||j.phase==="verifying",manifest:j.manifest,hooks:{preflight:async()=>{let f=await QH(I);return j={...j,manifest:f,updatedAt:new Date().toISOString()},await pL(j),f},afterBoot:async(f,v,t,EE)=>GH(I,v,t,EE),onPhase:async(f,v)=>{if(j={...j,phase:f,status:f==="waiting-capacity"?"waiting-capacity":f==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await pL(j),!T.json)X(`${f}${v?` ${JSON.stringify(v)}`:""}`)}}})}finally{await x()}})();if(j={...j,status:b.status==="completed"||b.status==="already-complete"?"completed":b.status==="recovered"?"recovered":"waiting-capacity",lastError:b.status==="recovered"?b.error:void 0,updatedAt:new Date().toISOString()},await pL(j),T.json)console.log(JSON.stringify({schemaVersion:1,result:b},null,2));else if(b.status==="completed"||b.status==="already-complete")g(`${h.name} is on ${$} and passed full post-boot verification.`);else if(b.status==="recovered"&&b.retryable&&T.wait){X(`Capacity race recovered safely. Waiting ${Math.round(B/1000)} seconds before retry.`),await Bun.sleep(B);continue}else if(b.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${b.error}`);return}catch(b){throw j={...j,status:"failed",lastError:b instanceof Error?b.message:String(b),updatedAt:new Date().toISOString()},await pL(j),b}}}async function ee(E,_){let T=await o();if(T.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",N=B_(T,R),L=await fN(N);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${L.serverName}.`);let A=$U(T),S=new aL({apiToken:DU(A.apiToken,T)}),O=await S.getServer(L.serverId),U=L.publicIp??O.public_net.ipv4?.ip;if(!U)throw Error(`Server ${O.name} has no public IPv4 address.`);let h=Q2(T);if(_.json)console.log(JSON.stringify({schemaVersion:1,server:O.name,plan:h},null,2));else p(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[O.name,h.firewallPorts.join(","),h.monitoring?"on":"off",h.autoUpdates?"on":"off",`${h.swapGb} GB`,"disabled"]]);if(!_.apply){if(!_.json)X(`Preview only. Re-run with --apply --confirm ${O.name} to execute.`);return}if(_.confirm!==O.name)throw Error(`Optimization requires --confirm ${O.name}.`);let $={host:U,user:L.sshUser??A.sshUser,identityFile:A.sshPrivateKeyPath,connectTimeoutSec:15},D=await BU($),C=D.routeProbes.filter((t)=>!t.ok),J=T.infrastructure?.compute,I=jR(J)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,W=D.failedUnits.filter((t)=>!I.has(t));if(W.length>0)throw Error(`Preflight found failed services: ${W.join(", ")}`);if(C.length>0)throw Error(`Preflight found unhealthy routes: ${C.map((t)=>t.domain).join(", ")}`);let H=jR(J)?[]:Object.values(T.sites??{}).flatMap((t)=>typeof t?.port==="number"&&![80,443].includes(t.port)?[t.port]:[]),j=JU({allowSsh:J?.allowSsh!==!1,sitePorts:H,allowedPorts:J?.firewall?.allowedPorts}),B=(L.firewallId?(await S.listFirewalls()).find((t)=>t.id===L.firewallId):void 0)??(await S.listFirewalls()).find((t)=>t.name===`${T.project.slug}-${R}-app-fw`);if(!B)throw Error(`Managed firewall for ${O.name} was not found.`);let Q=await S.setFirewallRules(B.id,j);await Promise.all(Q.map((t)=>S.waitForAction(t.id))),await JH(T,$);let[K,q]=await Promise.all([BU($),IH($)]),x=FH(h,q),b=sM(D,K),f=K.routeProbes.filter((t)=>!t.ok);if(b.stoppedServices.length>0)x.push(`services stopped: ${b.stoppedServices.join(", ")}`);if(b.changedRouteFragments.length>0)x.push(`route fragments changed: ${b.changedRouteFragments.join(", ")}`);if(b.missingRouteIds.length>0)x.push(`routes disappeared: ${b.missingRouteIds.join(", ")}`);if(b.changedReleaseLinks.length>0)x.push(`release links changed: ${b.changedReleaseLinks.join(", ")}`);if(b.missingData.length>0)x.push(`databases or volumes disappeared: ${b.missingData.join(", ")}`);if(f.length>0)x.push(`unhealthy routes: ${f.map((t)=>t.domain).join(", ")}`);if(x.length>0)throw Error(`Host optimization verification failed: ${x.join("; ")}`);let v={serverId:O.id,serverName:O.name,services:K.runningServices.length,routes:K.routeIds.length,healthyDomains:K.routeProbes.length,releaseLinks:K.releaseLinks.length,databasesAndVolumes:K.dataCatalog.length,report:q};if(_.json)console.log(JSON.stringify({schemaVersion:1,result:v},null,2));else g(`${O.name} passed full host, rpx route, service, release, and data verification.`)}function xH(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(_,T)=>{try{await EA(async(R)=>{let N=_?[H0(R,_)]:R.store.list(R.controlPlane.project.id),L=N.flatMap((A)=>Object.entries(A.capabilities).map(([S,O])=>({server:A.name,provider:A.provider,action:S,...O})));if(T.json)console.log(JSON.stringify({schemaVersion:1,targets:L},null,2));else p(["Server","Provider","Action","Support","Explanation"],L.map((A)=>[A.server,A.provider,A.action,A.supported?"supported":"unsupported",A.reason??"—"]))})}catch(R){$N(R)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(_,T,R)=>{try{await ne(_,T,R)}catch(N){$N(N)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(_,T)=>{try{await ee(_,T)}catch(R){$N(R)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(_,T)=>{try{await le(_,T)}catch(R){$N(R)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(_)=>{try{await EA(async(T)=>{let R=T.store.list(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],R.map((N)=>[N.name,N.providerId??"—",`${N.provider} / ${N.region??"external"}`,`${N.status} / ${N.trustState}`,N.roles.join(","),`${N.capacity.cpu??0} / ${N.capacity.memoryBytes??0}`,N.heartbeatAt??"never"]))})}catch(T){$N(T)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(_,T)=>{try{await EA(async(R)=>{let N=T.provider;if(!["aws","hetzner","ssh"].includes(N)||!T.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let L=R.service.enroll({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,provider:N,providerId:T.providerId,endpoint:T.endpoint,sshUser:T.user??"deploy",credentialRef:T.credentialRef??"secret://fleet/agent",region:T.region,roles:String(T.roles??"application").split(","),labels:Object.fromEntries(String(T.labels??"").split(",").map((A)=>A.split("=")).filter((A)=>A[0]&&A[1]))});g(`Enrolled ${L.name} as ${L.id}; no remote mutation was performed.`)})}catch(R){$N(R)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(_,T)=>{try{await EA(async(R)=>{let N=H0(R,_);if(N=await R.service.test(N.id),N.trustState==="rotation_pending"){if(!T.acceptHostKey)throw Error(`Host key changed to ${N.pendingHostKey}; review it first.`);N=R.service.reviewHostKey(N.id,T.acceptHostKey)}let L=await R.service.validate(N.id);if(T.json)console.log(JSON.stringify(L.validation,null,2));else p(["Severity","Code","Finding","Remediation"],(L.validation?.findings??[]).map((A)=>[A.severity,A.code,A.message,A.remediation??"—"]));if(!L.validation?.valid)process.exitCode=1})}catch(R){$N(R)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(_,T)=>{try{await EA(async(R)=>{let N=R.service.bootstrap(H0(R,_).id,!!T.apply);if(N.preview)p(["Step"],N.steps.map((L)=>[L]));else g(`Bootstrap queued: ${N.operation?.id}`)})}catch(R){$N(R)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(_,T)=>{try{await EA(async(R)=>g(R.service.drain(H0(R,_).id,!!T.complete).status))}catch(R){$N(R)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(_)=>{try{await EA(async(T)=>{T.service.uncordon(H0(T,_).id),g(`Uncordoned ${_}.`)})}catch(T){$N(T)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(_,T)=>{try{await EA(async(R)=>{R.service.archive(H0(R,_).id,T.confirm??""),g(`Archived ${_}; provider infrastructure was not terminated.`)})}catch(R){$N(R)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(_)=>{try{await EA(async(T)=>{let R=H0(T,_);if(R.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let N=Bun.spawn(["ssh","-p",String(R.sshPort),"-o","StrictHostKeyChecking=yes",`${R.sshUser}@${R.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),L=await N.exited;if(L)process.exitCode=L})}catch(T){$N(T)}});for(let[_,T]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(_,T).action(async(...R)=>ON(_.split(" ")[0],{target:String(R[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}kE();var kN=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},YR=(E)=>E==null?void 0:String(E),D4=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),jU=(E={})=>({...D4(),...E});function h4(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:YR(E.region),architecture:YR(E.architecture),labels:kN(E.labels,{}),requiredServerLabels:kN(E.required_server_labels,{}),toleratedTaints:kN(E.tolerated_taints,[]),capacity:jU(kN(E.capacity,{})),reserved:kN(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:YR(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function $4(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:YR(E.environment_id),resourceId:String(E.resource_id),releaseId:YR(E.release_id),poolId:String(E.pool_id),serverId:YR(E.server_id),purpose:String(E.purpose),requirements:kN(E.requirements,{}),decision:kN(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function ae(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:YR(E.resource_id),poolId:String(E.pool_id),placementId:YR(E.placement_id),operationId:YR(E.operation_id),sourceSha:String(E.source_sha),buildSpec:kN(E.build_spec,{}),credentialPolicy:kN(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:YR(E.workspace),cacheKey:YR(E.cache_key),artifactUri:YR(E.artifact_uri),artifactDigest:YR(E.artifact_digest),status:String(E.status),cleanupAt:YR(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class hD{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}createPool(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(jU(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,T,T]),this.getPool(_)}getPool(E){let _=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return _?h4(_):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(h4)}updatePool(E,_){let T=this.getPool(E);if(!T)throw Error("Capacity pool was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[R.status,JSON.stringify(R.reserved),JSON.stringify(R.capacity),R.concurrency,N,E]),this.getPool(E)}addMember(E,_,T={}){let R=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,_,JSON.stringify(T),R,R])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((_)=>({serverId:String(_.server_id),status:String(_.status),capacityOverride:kN(_.capacity_override,{})}))}memberStatus(E,_,T){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[T,this.now().toISOString(),E,_])}listPlacements(E,_){let T=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map($4);return _?.length?T.filter((R)=>_.includes(R.status)):T}getPlacement(E){let _=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return _?$4(_):void 0}activeUsage(E,_){let T=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),R=_?T.filter((N)=>String(N.server_id)===_):T;return{resources:R.reduce((N,L)=>{let A=jU(kN(L.resources,{}));for(let S of Object.keys(N))N[S]+=A[S];return N},D4()),count:R.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let _=this.id(),T=this.id(),R=this.now().toISOString(),N=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[_,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,R,R]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[T,_,E.decision.poolId,E.decision.serverId??null,JSON.stringify(jU(E.requirements.resources)),N,R,R]),this.getPlacement(_)})}transitionPlacement(E,_){if(!this.getPlacement(E))throw Error("Placement was not found.");let R=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[_,R,E]),["released","failed","blocked"].includes(_))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[R,E]);return this.getPlacement(E)}createBuild(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[_,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),T,T]),this.getBuild(_)}getBuild(E){let _=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return _?ae(_):void 0}updateBuild(E,_){let T=this.getBuild(E);if(!T)throw Error("Remote build was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[R.operationId??null,R.workspace??null,R.cacheKey??null,R.artifactUri??null,R.artifactDigest??null,R.status,R.cleanupAt??null,N,E]),this.getBuild(E)}}var K2=["cpu","memoryBytes","diskBytes","gpu"],C4=(E,_={})=>Object.entries(_).every(([T,R])=>E[T]===R),ie=(E,_,T)=>Object.fromEntries(K2.map((R)=>[R,Math.max(0,E[R]-_[R]-(T[R]??0))])),se=(E,_)=>K2.every((T)=>E[T]>=(_[T]??0)),pe=(E,_)=>K2.reduce((T,R)=>T+(_[R]??0)/(E[R]||1),0);class $D{store;fleet;constructor(E,_){this.store=E;this.fleet=_}poolCandidates(E,_,T){let R=[];for(let N of this.store.listPools(E)){if(N.id===T)continue;let L=[];if(N.status!=="active")L.push(`pool is ${N.status}`);if(N.purpose!==_.purpose)L.push(`purpose is ${N.purpose}`);if(_.region&&N.region!==_.region)L.push(`region is ${N.region??"unset"}`);if(_.architecture&&N.architecture!==_.architecture)L.push(`architecture is ${N.architecture??"unset"}`);if(!C4(N.labels,_.labels))L.push("pool labels do not match");if(N.backend==="server"){let A=this.store.members(N.id);if(!A.length)R.push(this.decision(N,void 0,_,[...L,"pool has no servers"]));for(let S of A){let O=this.fleet.get(S.serverId),U=[...L];if(!O)U.push("server is missing");else this.serverReasons(N,O,S.status,_,U);R.push(this.decision(N,O,_,U,S.capacityOverride))}}else R.push(this.decision(N,void 0,_,L))}return R.sort((N,L)=>Number(L.eligible)-Number(N.eligible)||N.score.cost-L.score.cost||N.score.spread-L.score.spread||N.score.fit-L.score.fit||N.poolName.localeCompare(L.poolName)||(N.serverId??"").localeCompare(L.serverId??""))}serverReasons(E,_,T,R,N){if(T!=="active")N.push(`member is ${T}`);if(_.status!=="ready")N.push(`server is ${_.status}`);if(!_.roles.includes(R.purpose==="build"?"build":R.purpose))N.push(`server lacks ${R.purpose} role`);if(!C4(_.labels,E.requiredServerLabels))N.push("server labels do not match pool selector");for(let L of _.taints)if(!E.toleratedTaints.includes(L))N.push(`taint ${L} is not tolerated`)}decision(E,_,T,R,N={}){let L=jU({..._?.capacity,...N}),A=_?Object.fromEntries(K2.map((U)=>[U,Math.min(E.capacity[U],L[U])])):E.capacity,S=this.store.activeUsage(E.id,_?.id),O=ie(A,S.resources,E.reserved);if(S.count>=E.maxWorkloads)R.push("workload limit reached");if(T.purpose==="build"&&S.count>=E.concurrency)R.push("build concurrency reached");if(!se(O,T.resources))R.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:_?.id,eligible:R.length===0,reasons:R,available:O,score:{fit:pe(O,T.resources),spread:S.count,cost:E.costWeight}}}explain(E,_){return this.poolCandidates(E,_)}place(E){return this.store.control.transaction(()=>{let _=this.poolCandidates(E.projectId,E.requirements).find((T)=>T.eligible);if(!_)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((T)=>T.reasons).join("; ")}`);return this.store.reserve({...E,decision:_})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let _=this.store.updatePool(E,{status:"draining"}),T=[],R=[];for(let N of this.store.listPlacements(_.projectId,["reserved","active"]).filter((L)=>L.poolId===E)){if(N.stateful){R.push(this.store.transitionPlacement(N.id,"blocked"));continue}this.store.transitionPlacement(N.id,"moving");let L=this.place({projectId:N.projectId,environmentId:N.environmentId,resourceId:N.resourceId,releaseId:N.releaseId,requirements:N.requirements});T.push(this.activate(L.id)),this.store.transitionPlacement(N.id,"released")}return{pool:_,moved:T,blocked:R}}drainServer(E,_){this.store.memberStatus(E,_,"draining");let T=this.store.getPool(E);if(!T)throw Error("Capacity pool was not found.");let R=[],N=[];for(let L of this.store.listPlacements(T.projectId,["reserved","active"]).filter((A)=>A.poolId===E&&A.serverId===_)){if(L.stateful){N.push(this.store.transitionPlacement(L.id,"blocked"));continue}this.store.transitionPlacement(L.id,"moving");let A=this.poolCandidates(L.projectId,L.requirements).find((O)=>O.eligible);if(!A){N.push(this.store.transitionPlacement(L.id,"blocked"));continue}let S=this.store.reserve({projectId:L.projectId,environmentId:L.environmentId,resourceId:L.resourceId,releaseId:L.releaseId,requirements:L.requirements,decision:A});R.push(this.activate(S.id)),this.store.transitionPlacement(L.id,"released")}return{moved:R,blocked:N}}reconcileFailure(E){let _=this.fleet.get(E);if(!_)throw Error("Server was not found.");let T=[],R=[];for(let N of this.store.listPlacements(_.projectId,["active"]).filter((L)=>L.serverId===E)){if(N.stateful||!N.autoReschedule){R.push(this.store.transitionPlacement(N.id,"blocked"));continue}this.store.transitionPlacement(N.id,"failed");let L=this.place({projectId:N.projectId,environmentId:N.environmentId,resourceId:N.resourceId,releaseId:N.releaseId,requirements:N.requirements});T.push(this.activate(L.id))}return{rescheduled:T,blocked:R}}}await g_();async function oe(){let E=await o(),_=mE(process.cwd(),E),T=new hD(_.store),R=new $D(T,new XL(_.store));return{controlPlane:_,store:T,service:R}}async function DD(E){let _=await oe();try{await E(_)}catch(T){d(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var V2=(E)=>Object.fromEntries(String(E??"").split(",").map((_)=>_.split("=")).filter((_)=>_[0]&&_[1])),X4=(E)=>Object.fromEntries(Object.entries(V2(E)).map(([_,T])=>[_,Number(T)]));function yH(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(_)=>DD((T)=>{let R=T.store.listPools(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],R.map((N)=>[N.name,N.purpose,N.backend,`${N.region??"any"} / ${N.architecture??"any"}`,N.status,JSON.stringify(N.capacity),String(N.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(_,T)=>DD((R)=>{let{purpose:N,backend:L}=T;if(!["application","build","worker","monitoring","backup"].includes(N)||!["server","ecs","asg"].includes(L))throw Error("Unsupported pool purpose or backend.");let A=R.store.createPool({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,purpose:N,backend:L,region:T.region,architecture:T.arch,labels:V2(T.labels),requiredServerLabels:V2(T.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...X4(T.capacity)},maxWorkloads:Number(T.max),costWeight:1,concurrency:Number(T.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});g(`Created ${A.name} (${A.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(_,T)=>DD((R)=>{let N=R.store.listPools(R.controlPlane.project.id).find((A)=>A.id===_||A.name===_),L=new XL(R.controlPlane.store).list(R.controlPlane.project.id).find((A)=>A.id===T||A.name===T);if(!N||!L)throw Error("Pool or server was not found.");R.store.addMember(N.id,L.id),g(`Attached ${L.name} to ${N.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(_)=>DD((T)=>{let R=T.service.explain(T.controlPlane.project.id,{purpose:_.purpose,resources:X4(_.resources),region:_.region,architecture:_.arch,labels:V2(_.labels)});if(_.json)console.log(JSON.stringify(R,null,2));else p(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],R.map((N)=>[N.poolName,N.serverId??"provider-managed",N.eligible?"yes":"no",JSON.stringify(N.available),`${N.score.fit.toFixed(2)} / ${N.score.spread} / ${N.score.cost}`,N.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(_)=>DD((T)=>{let R=T.store.listPools(T.controlPlane.project.id).find((L)=>L.id===_||L.name===_);if(!R)throw Error("Pool was not found.");let N=T.service.drainPool(R.id);g(`Draining ${R.name}: moved ${N.moved.length}, blocked ${N.blocked.length} stateful placement(s).`)}))}kE();var _A=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},DN=(E)=>E==null?void 0:String(E),J4=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:DN(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:_A(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:_A(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:DN(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),fH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:DN(E.stack_id),stackRevision:DN(E.stack_revision),status:String(E.status),health:_A(E.health,{}),lastHealthyAt:DN(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),kH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:_A(E.config,{}),status:String(E.status),checkpoint:DN(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:DN(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),bH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:_A(E.weights,{}),desiredWeights:_A(E.desired_weights,{}),status:String(E.status),providerState:_A(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),I4=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:DN(E.operation_id),kind:String(E.kind),requestedRegion:DN(E.requested_region),revision:DN(E.revision),plan:_A(E.plan,[]),currentStep:DN(E.current_step),completedSteps:_A(E.completed_steps,[]),status:String(E.status),error:DN(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class CD{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((L)=>L.region)).size!==E.regions.length||E.regions.filter((L)=>L.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let _=E.regions.find((L)=>L.role==="primary"),T=this.id(),R=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[T,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,_.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),_.region,R,R]);for(let L of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),T,L.region,L.role,L.provider,R,R]);for(let L of E.dataPolicy.replicate)for(let A of E.regions)for(let S of E.regions.filter((O)=>O.region!==A.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,L,A.region,S.region,"{}",R,R]);let N=Object.fromEntries(E.regions.map((L)=>[L.region,L.region===_.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),T,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(N),JSON.stringify(N),R,R]),this.get(T)})}get(E){let _=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return _?J4(_):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(J4)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(fH)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(kH)}route(E){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return _?bH(_):void 0}updateTopology(E,_){let T=this.get(E);if(!T)throw Error("Regional topology was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[R.status,R.activeRegion,R.revision??null,JSON.stringify(R.regions),N,E]),this.get(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!T)throw Error("Regional target was not found.");let R=fH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[N.role,N.stackId??null,N.stackRevision??null,N.status,JSON.stringify(N.health),N.lastHealthyAt??null,L,E]),fH(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,_){let T=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!T)throw Error("Replication channel was not found.");let R=kH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[N.status,N.checkpoint??null,N.lagSeconds??null,N.lastVerifiedAt??null,L,E]),kH(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,_){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!T)throw Error("Traffic route was not found.");let R=bH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(N.weights),JSON.stringify(N.desiredWeights),N.status,JSON.stringify(N.providerState),L,E]),bH(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[_,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),T,T]),this.execution(_)}execution(E){let _=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return _?I4(_):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(I4)}updateExecution(E,_){let T=this.execution(E);if(!T)throw Error("Regional execution was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[R.operationId??null,R.currentStep??null,JSON.stringify(R.completedSteps),R.status,R.error??null,N,E]),this.execution(E)}}await g_();class XD{store;queue;constructor(E,_){this.store=E;this.queue=_??new pE(E.control)}create(E){return this.store.create(E)}plan(E,_,T){if(!this.store.get(E))throw Error("Regional topology was not found.");let N=this.store.targets(E),L=this.store.channels(E);if(_==="rollout")return[...N.filter((A)=>A.role==="secondary").map((A)=>`apply:${A.region}`),...N.filter((A)=>A.role==="primary").map((A)=>`apply:${A.region}`),...L.map((A)=>`replicate:${A.kind}:${A.targetRegion}`),"traffic:activate"];if(_==="failover"||_==="failback")return[`health:${T}`,`replication:${T}`,`traffic:${T}`,`roles:${T}`];if(_==="destroy")return["traffic:drain",...N.filter((A)=>A.role==="secondary").map((A)=>`delete:${A.region}`),...N.filter((A)=>A.role==="primary").map((A)=>`delete:${A.region}`),"complete"];return["observe","repair"]}enqueue(E){let _=this.store.get(E.topologyId);if(!_)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!_.regions.some((L)=>L.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===_.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==_.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&_.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let T=this.plan(_.id,E.kind,E.targetRegion),R=this.store.createExecution({topologyId:_.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:T}),N=this.queue.enqueue({projectId:_.projectId,environmentId:_.environmentId,kind:`region.${E.kind}`,input:{executionId:R.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${_.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(R.id,{operationId:N.id}),{execution:this.store.execution(R.id),operation:N}}}var Ea=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function F4(E,_){let T=(U)=>{let h=_.find(($)=>$.provider===U.provider);if(!h)throw Error(`No ${U.provider} regional driver is configured.`);return h},R=(U,h,$)=>{U.throwIfCancellationRequested(),U.checkpoint($,$),E.updateExecution(h.id,{status:"running",currentStep:$,completedSteps:[...E.execution(h.id).completedSteps,$]})},N=async(U,h)=>{let $=E.route(U.id);if(!$)throw Error("Regional traffic route was not found.");let D=E.targets(U.id).find((J)=>J.region===U.activeRegion)??E.targets(U.id)[0];if(!D)throw Error("Regional traffic target was not found.");E.updateRoute($.id,{status:"applying",desiredWeights:h});let C=await T(D).applyTraffic({route:E.route(U.id),topology:U,weights:h});E.updateRoute($.id,{status:Object.values(h).every((J)=>J===0)?"drained":"in_sync",weights:h,providerState:C.providerState})},L=async(U,h,$,D)=>{E.updateTopology($.id,{status:"provisioning"});let C=h.revision,J=D.manifest??{},I=E.targets($.id).sort((H,j)=>Number(H.role==="primary")-Number(j.role==="primary"));for(let H of I){R(U,h,`apply:${H.region}`),E.updateTarget(H.id,{status:"provisioning"});let j=await T(H).applyStack({target:H,revision:C,manifest:J,signal:U.signal}),B=await T(H).health({target:E.updateTarget(H.id,{stackId:j.stackId,stackRevision:C})});if(!B.healthy)throw Error(`Regional health gate failed in ${H.region}.`);E.updateTarget(H.id,{status:"ready",health:B.evidence,lastHealthyAt:new Date().toISOString()})}for(let H of E.channels($.id)){R(U,h,`replicate:${H.kind}:${H.targetRegion}`),E.updateChannel(H.id,{status:"configuring"});let j=I.find((K)=>K.region===H.sourceRegion),B=await T(j).configureReplication({channel:H,topology:$}),Q=await T(j).verifyReplication({channel:E.updateChannel(H.id,{checkpoint:B.checkpoint,lagSeconds:B.lagSeconds}),topology:$});if(!Q.healthy||Q.lagSeconds>$.dataPolicy.maxLagSeconds)throw Error(`${H.kind} replication to ${H.targetRegion} exceeds the RPO.`);E.updateChannel(H.id,{status:"in_sync",checkpoint:Q.checkpoint,lagSeconds:Q.lagSeconds,lastVerifiedAt:new Date().toISOString()})}R(U,h,"traffic:activate");let W=Object.fromEntries($.regions.map((H)=>[H.region,H.region===$.activeRegion?100:0]));return await N($,W),E.updateTopology($.id,{status:"ready",revision:C}),{revision:C,activeRegion:$.activeRegion}},A=async(U,h,$)=>{let D=h.requestedRegion,C=E.targets($.id).find((W)=>W.region===D);if(!C)throw Error("Requested regional target was not found.");E.updateTopology($.id,{status:h.kind==="failover"?"failing_over":"failing_back"}),R(U,h,`health:${D}`);let J=await T(C).health({target:C});if(!J.healthy)throw Error(`Target region ${D} is unhealthy.`);E.updateTarget(C.id,{status:"ready",health:J.evidence,lastHealthyAt:new Date().toISOString()}),R(U,h,`replication:${D}`);for(let W of E.channels($.id).filter((H)=>H.targetRegion===D)){let H=await T(C).verifyReplication({channel:W,topology:$});if(!H.healthy||H.lagSeconds>$.dataPolicy.maxLagSeconds)throw Error(`${W.kind} replication is outside the failover RPO.`);E.updateChannel(W.id,{status:"in_sync",checkpoint:H.checkpoint,lagSeconds:H.lagSeconds,lastVerifiedAt:new Date().toISOString()})}R(U,h,`traffic:${D}`),await N($,Object.fromEntries($.regions.map((W)=>[W.region,W.region===D?100:0]))),R(U,h,`roles:${D}`);let I=$.regions.map((W)=>({...W,role:W.region===D?"primary":"secondary"}));for(let W of E.targets($.id))E.updateTarget(W.id,{role:W.region===D?"primary":"secondary"});return E.updateTopology($.id,{status:h.kind==="failover"?"failed_over":"ready",activeRegion:D,regions:I}),{activeRegion:D}},S=async(U,h,$,D)=>{E.updateTopology($.id,{status:"destroying"}),R(U,h,"traffic:drain"),await N($,Object.fromEntries($.regions.map((J)=>[J.region,0])));let C=D.deleteData!==!0;for(let J of E.targets($.id).sort((I,W)=>Number(I.role==="primary")-Number(W.role==="primary")))R(U,h,`delete:${J.region}`),E.updateTarget(J.id,{status:"deleting"}),await T(J).deleteStack({target:J,retainData:C,signal:U.signal}),E.updateTarget(J.id,{status:"deleted"});return R(U,h,"complete"),E.updateTopology($.id,{status:"destroyed"}),{destroyed:!0,dataRetained:C}},O=async(U)=>{let h=Ea(U.operation.input),$=E.execution(String(h.executionId??""));if(!$)throw Error("Regional execution was not found.");let D=E.get($.topologyId);if(!D)throw Error("Regional topology was not found.");try{let C;if($.kind==="rollout")C=await L(U,$,D,h);else if($.kind==="failover"||$.kind==="failback")C=await A(U,$,D);else if($.kind==="destroy")C=await S(U,$,D,h);else throw Error("Regional reconciliation is not configured.");return E.updateExecution($.id,{status:"succeeded",currentStep:void 0}),{executionId:$.id,...C}}catch(C){if(E.updateExecution($.id,{status:U.cancellationRequested()?"cancelled":"failed",error:C instanceof Error?C.message:String(C)}),E.get(D.id)?.status!=="destroyed")E.updateTopology(D.id,{status:"failed"});throw C}};return{"region.rollout":O,"region.failover":O,"region.failback":O,"region.destroy":O,"region.reconcile":O}}class gH{provider;reason;constructor(E,_="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=_}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function _a(){let E=await o(),_=mE(process.cwd(),E),T=new CD(_.store),R=new XD(T);return{controlPlane:_,store:T,service:R}}async function j0(E){let _=await _a();try{await E(_)}catch(T){d(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var JD=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!T)throw Error("Regional topology was not found.");return T},Ta=(E)=>E.split(",").map((_,T)=>{let[R,N="aws"]=_.split(":");return{region:String(R),provider:N,role:T===0?"primary":"secondary"}}),Ra=(E)=>{let _=new Set(["s3","dynamodb","secrets"]),T=E.split(",").map((N)=>N.trim()),R=T.find((N)=>!_.has(N));if(R)throw Error(`Unsupported replication kind: ${R}`);return T};function cH(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(_)=>j0((T)=>{let R=T.store.list(T.controlPlane.project.id).map((N)=>({topology:N,targets:T.store.targets(N.id),channels:T.store.channels(N.id),route:T.store.route(N.id),executions:T.store.executions(N.id)}));if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Hostname","Active","Status","Revision","Replication"],R.map((N)=>[N.topology.name,N.topology.hostname,N.topology.activeRegion,N.topology.status,N.topology.revision??"—",`${N.channels.filter((L)=>L.status==="in_sync").length}/${N.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(_,T)=>j0((R)=>{if(!T.hostname||!T.regions)throw Error("--hostname and --regions are required.");let N=R.service.create({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,hostname:T.hostname,regions:Ta(T.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Ra(String(T.replicate)),maxLagSeconds:Number(T.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!T.cdn,wafEnabled:!!T.waf});g(`Created ${N.name} (${N.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(_,T,R)=>j0((N)=>p(["Step"],N.service.plan(JD(N,_).id,T,R.target).map((L)=>[L])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(_,T,R)=>j0(async(N)=>{let L=R.manifest?await Bun.file(R.manifest).json():{},A=N.service.enqueue({topologyId:JD(N,_).id,kind:"rollout",revision:T,manifest:L});g(`Regional rollout queued: ${A.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(_,T)=>j0((R)=>{let N=R.service.enqueue({topologyId:JD(R,_).id,kind:"failover",targetRegion:T});g(`Failover queued: ${N.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(_,T)=>j0((R)=>{let N=R.service.enqueue({topologyId:JD(R,_).id,kind:"failback",targetRegion:T});g(`Failback queued: ${N.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(_,T)=>j0((R)=>{let N=R.service.enqueue({topologyId:JD(R,_).id,kind:"destroy",confirmation:T.confirm});g(`Regional teardown queued: ${N.operation.id}; replicated data remains retained.`)}))}kE();var ID="0.7.121";import{createHash as vH,createPublicKey as B4,verify as La}from"node:crypto";function FD(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(FD).join(",")}]`;return`{${Object.keys(E).sort().map((_)=>`${JSON.stringify(_)}:${FD(E[_])}`).join(",")}}`}var H4=(E)=>vH("sha256").update(FD(E)).digest("hex"),Z2=(E)=>vH("sha256").update(FD(E)).digest("hex"),j4=(E)=>vH("sha256").update(B4(E).export({type:"spki",format:"der"})).digest("hex");function Y4(E,_,T){try{return La(null,Buffer.from(FD(E)),B4(T),Buffer.from(_,"base64"))}catch{return!1}}var W4=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((_)=>Number(_)||0),z4=(E,_)=>{let T=W4(E),R=W4(_);for(let N=0;N<3;N++){let L=(T[N]??0)-(R[N]??0);if(L)return L}return 0};function w4(E,_){let T=[];if(_.schemaVersion<E.minimumSchema)T.push(`schema ${_.schemaVersion} is below ${E.minimumSchema}`);if(_.schemaVersion>E.maximumSchema)T.push(`schema ${_.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&z4(_.currentVersion,E.minimumVersion)<0)T.push(`platform ${_.currentVersion} is below ${E.minimumVersion}`);if(z4(E.version,_.currentVersion)<=0)T.push(`version ${E.version} is not newer than ${_.currentVersion}`);if(!E.artifacts.some((R)=>R.platform===_.platform&&R.architecture===_.architecture))T.push(`no artifact for ${_.platform}/${_.architecture}`);return{compatible:T.length===0,reasons:T}}var TA=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},VT=(E)=>E==null?void 0:String(E),Aa=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:VT(E.revoked_at),createdAt:String(E.created_at)}),Q4=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:TA(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:TA(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),G4=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:TA(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),P4=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:VT(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:TA(E.health_gate,{}),status:String(E.status),currentStage:VT(E.current_stage),backupId:VT(E.backup_id),approvedBy:VT(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),rH=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:VT(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:TA(E.evidence,{}),error:VT(E.error),startedAt:VT(E.started_at),finishedAt:VT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),M4=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:TA(E.criteria,{}),candidates:TA(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:VT(E.confirmation),expiresAt:String(E.expires_at),result:TA(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),K4=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:VT(E.backup_policy_id),recoveryPointId:VT(E.recovery_point_id),topologyId:VT(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:VT(E.operation_id),evidence:TA(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:VT(E.error),startedAt:VT(E.started_at),finishedAt:VT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class WD{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}addTrustedKey(E){let _=this.id(),T=this.now().toISOString(),R=j4(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[_,E.organizationId,E.name,E.publicKeyPem,R,T]),this.key(_)}key(E){let _=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return _?Aa(_):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let _=this.key(E.keyId);if(!_||_.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(_.revokedAt)throw Error("Update signing key is revoked.");if(!Y4(E.document,E.signature,_.publicKeyPem))throw Error("Update manifest signature is invalid.");let T=w4(E.document,E.current),R=H4(E.document),N=this.id(),L=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[N,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,R,JSON.stringify(E.document),E.signature,JSON.stringify(T),L]),this.manifest(N)}manifest(E){let _=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return _?Q4(_):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(Q4)}createWindow(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[_,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,T,T]),this.window(_)}window(E){let _=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return _?G4(_):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(G4)}createCampaign(E){return this.control.transaction(()=>{let _=this.manifest(E.manifestId);if(!_?.compatibility.compatible||_.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let T=this.id(),R=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[T,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,R,R]),E.targets.forEach((N,L)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,N.serverId??null,N.target,E.strategy==="canary"?L===0?0:1+Math.floor((L-1)/E.batchSize):Math.floor(L/E.batchSize),N.previousVersion,R,R])),this.campaign(T)})}campaign(E){let _=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return _?P4(_):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(P4)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(rH)}updateCampaign(E,_){let T=this.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let R={...T,..._};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[R.status,R.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!T)throw Error("Upgrade target was not found.");let R={...rH(T),..._};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[R.status,JSON.stringify(R.evidence),R.error??null,R.startedAt??null,R.finishedAt??null,this.now().toISOString(),E]),rH(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let _=[...E.candidates].sort((A,S)=>A.id.localeCompare(S.id)),T=Z2(_),R=this.id(),N=this.now().toISOString(),L=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[R,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(_),T,_.reduce((A,S)=>A+S.bytes,0),L,N,N]),this.cleanup(R)}cleanup(E){let _=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return _?M4(_):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(M4)}updateCleanup(E,_){let T=this.cleanup(E);if(!T)throw Error("Cleanup plan was not found.");let R={...T,..._};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[R.status,R.confirmation??null,JSON.stringify(R.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[_,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,T,T]),this.drill(_)}drill(E){let _=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return _?K4(_):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(K4)}updateDrill(E,_){let T=this.drill(E);if(!T)throw Error("DR drill was not found.");let R={...T,..._};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[R.status,R.operationId??null,JSON.stringify(R.evidence),R.measuredRpoMinutes??null,R.measuredRtoMinutes??null,R.cleanupVerified?1:0,R.error??null,R.startedAt??null,R.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}await g_();function Sa(E,_=new Date){if(!E.enabled)return!1;let T=new Date(E.schedule);if(!Number.isNaN(T.getTime()))return _>=T&&_.getTime()<=T.getTime()+E.durationMinutes*60000;let R=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!R)return!1;let N=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(_),L=Number(N.find((S)=>S.type==="hour")?.value)*60+Number(N.find((S)=>S.type==="minute")?.value),A=Number(R[1])*60+Number(R[2]);return L>=A&&L<A+E.durationMinutes}class zD{store;now;queue;constructor(E,_,T=()=>new Date){this.store=E;this.now=T;this.queue=_??new pE(E.control)}enqueueCampaign(E,_={}){let T=this.store.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let R=T.windowId?this.store.window(T.windowId):void 0;if(R&&!R.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(R&&!_.overrideWindow&&!Sa(R,this.now()))throw Error("Upgrade is outside its maintenance window.");if(R?.requireApproval&&!_.approvedBy&&!T.approvedBy)throw Error("Maintenance approval is required.");let N=this.queue.enqueue({projectId:T.projectId,actorId:_.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:N}}async previewCleanup(E,_){let T=_.find((R)=>R.kind===E.kind);if(!T)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await T.discover(E.criteria)})}enqueueCleanup(E,_){let T=this.store.cleanup(E);if(!T||T.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(T.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let R=`DELETE ${T.candidates.length} ${T.kind}`;if(_!==R)throw Error(`Exact confirmation ${R} is required.`);let N=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${T.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:_}),operation:N}}enqueueDrill(E){let _=this.store.drill(E);if(!_||_.status!=="planned")throw Error("A planned DR drill is required.");let T=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${_.scenario}:${_.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:T.id}),operation:T}}}var uH=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function V4(E){return{"maintenance.upgrade":async(N)=>{let L=E.store.campaign(String(uH(N.operation.input).campaignId??""));if(!L||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let A=E.store.manifest(L.manifestId);if(!A?.compatibility.compatible||A.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let S=A.document.artifacts.find((U)=>U.platform===process.platform&&U.architecture===process.arch)??A.document.artifacts[0];if(!S)throw Error("No update artifact matches this platform.");E.store.updateCampaign(L.id,{status:"running",currentStage:"preflight"});let O=[];try{for(let U of[...new Set(E.store.targets(L.id).map((h)=>h.cohort))].sort((h,$)=>h-$)){E.store.updateCampaign(L.id,{currentStage:`cohort:${U}`});for(let h of E.store.targets(L.id).filter(($)=>$.cohort===U)){N.throwIfCancellationRequested(),N.checkpoint(`download:${h.target}`,"Downloading signed platform artifact."),E.store.updateTarget(h.id,{status:"downloading",startedAt:new Date().toISOString()});let $=await E.platform.download({target:h,artifact:S,signal:N.signal});if($.sha256!==S.sha256)throw Error(`Artifact checksum mismatch for ${h.target}.`);N.checkpoint(`install:${h.target}`,"Installing verified artifact."),E.store.updateTarget(h.id,{status:"installing"}),await E.platform.install({target:h,path:$.path,version:A.version,signal:N.signal}),O.push(h);let D=await E.platform.health({target:h,gate:L.healthGate});if(!D.healthy)throw Error(`Upgrade health gate failed for ${h.target}.`);E.store.updateTarget(h.id,{status:"healthy",evidence:D.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(L.id,{status:"succeeded",currentStage:void 0}),{campaignId:L.id,version:A.version,targets:O.length}}catch(U){E.store.updateCampaign(L.id,{status:"rolling_back",currentStage:"rollback"});for(let h of O.reverse())E.store.updateTarget(h.id,{status:"rolling_back"}),await E.platform.rollback({target:h,version:h.previousVersion,signal:N.signal}),E.store.updateTarget(h.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(L.id,{status:"rolled_back",currentStage:void 0}),U}},"maintenance.cleanup":async(N)=>{let L=E.store.cleanup(String(uH(N.operation.input).planId??""));if(!L||L.status!=="approved")throw Error("Approved cleanup plan was not found.");if(Z2([...L.candidates].sort((h,$)=>h.id.localeCompare($.id)))!==L.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let A=E.cleanup?.find((h)=>h.kind===L.kind);if(!A)throw Error(`No ${L.kind} cleanup driver is configured.`);E.store.updateCleanup(L.id,{status:"running"});let S=[],O=[];for(let h of L.candidates){N.throwIfCancellationRequested();try{await A.remove(h),S.push(h.id)}catch($){O.push({id:h.id,error:$ instanceof Error?$.message:String($)})}}let U=O.length?S.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(L.id,{status:U,result:{removed:S,failed:O,reclaimedBytes:L.candidates.filter((h)=>S.includes(h.id)).reduce((h,$)=>h+$.bytes,0)}}),O.length)throw Error(`Cleanup failed for ${O.length} candidate(s).`);return{planId:L.id,removed:S.length,reclaimedBytes:L.estimatedBytes}},"maintenance.drill":async(N)=>{let L=E.store.drill(String(uH(N.operation.input).drillId??""));if(!L)throw Error("DR drill was not found.");let A=E.recovery?.find(($)=>$.scenario===L.scenario);if(!A)throw Error(`No ${L.scenario} recovery driver is configured.`);let S=new Date;E.store.updateDrill(L.id,{status:"restoring",startedAt:S.toISOString()});let O=L.isolatedTarget,U={},h={};try{N.checkpoint("restore","Restoring into isolated drill target.");let $=await A.restore({drill:L,signal:N.signal});if(!$.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");O=$.target,U=$.evidence;let D=(S.getTime()-new Date($.recoveryPointAt).getTime())/60000;E.store.updateDrill(L.id,{status:"verifying",measuredRpoMinutes:D,evidence:{restore:U}}),N.checkpoint("verify","Running recovery health checks without production traffic.");let C=await A.verify({drill:L,target:O});h=C.evidence;let J=(Date.now()-S.getTime())/60000;if(!C.healthy||D>L.expectedRpoMinutes||J>L.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(L.id,{measuredRpoMinutes:D,measuredRtoMinutes:J,evidence:{restore:U,verify:h}})}catch($){throw E.store.updateDrill(L.id,{status:"failed",error:$ instanceof Error?$.message:String($),evidence:{restore:U,verify:h}}),$}finally{E.store.updateDrill(L.id,{status:"cleaning"});try{await A.cleanup({drill:L,target:O});let $=E.store.drill(L.id);E.store.updateDrill(L.id,{status:$.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch($){E.store.updateDrill(L.id,{status:"cleanup_required",cleanupVerified:!1,error:$ instanceof Error?$.message:String($),finishedAt:new Date().toISOString()})}}return{drillId:L.id,status:E.store.drill(L.id).status}}}}var Z4={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class BD{kind;control;projectId;organizationId;constructor(E,_,T,R){this.kind=E;this.control=_;this.projectId=T;this.organizationId=R}async discover(E){let _=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),T=new Date(Date.now()-_*86400000).toISOString(),R=Z4[this.kind],N=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(R.select).all(N,T).map((A)=>({id:String(A.id),kind:this.kind,label:`${this.kind}:${String(A.id)}`,bytes:Number(A.bytes??0),metadata:{createdAt:String(A.created_at)}}))}async remove(E){if(this.control.database.run(Z4[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function Oa(){let E=await o(),_=mE(process.cwd(),E),T=new WD(_.store),R=new zD(T),N=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new BD(L,_.store,_.project.id,_.organization.id));return{controlPlane:_,store:T,service:R,cleanup:N}}async function RA(E){let _=await Oa();try{await E(_)}catch(T){d(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}function tH(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(_)=>RA((T)=>{let R={manifests:T.store.manifests(T.controlPlane.organization.id),windows:T.store.windows(T.controlPlane.project.id),campaigns:T.store.campaigns(T.controlPlane.project.id),cleanups:T.store.cleanups(T.controlPlane.project.id),drills:T.store.drills(T.controlPlane.project.id)},N=[...R.manifests.map((L)=>["update",L.version,L.compatibility.compatible?"compatible":"blocked",L.compatibility.reasons.join("; ")||L.channel]),...R.campaigns.map((L)=>["upgrade",L.id,L.status,L.currentStage??L.fromVersion]),...R.cleanups.map((L)=>["cleanup",L.kind,L.status,`${L.candidates.length} items / ${L.estimatedBytes} bytes`]),...R.drills.map((L)=>["DR drill",L.scenario,L.status,L.isolatedTarget])];if(_.json)console.log(JSON.stringify(R,null,2));else p(["Area","Name / version","Status","Detail"],N)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(_,T)=>RA(async(R)=>{let N=R.store.addTrustedKey({organizationId:R.controlPlane.organization.id,name:_,publicKeyPem:await Bun.file(T).text()});g(`Trusted ${N.name}: ${N.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(_,T,R)=>RA(async(N)=>{let L=await Bun.file(_).json(),A=(await Bun.file(T).text()).trim(),S=N.store.importManifest({organizationId:N.controlPlane.organization.id,keyId:R,document:L,signature:A,current:{schemaVersion:N.controlPlane.store.health().schemaVersion,currentVersion:ID,platform:process.platform,architecture:process.arch}});g(`Verified ${S.version}; ${S.compatibility.compatible?"compatible":"blocked: "+S.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(_,T,R)=>RA((N)=>{let L=N.store.createWindow({projectId:N.controlPlane.project.id,name:_,schedule:T,timezone:R.timezone,durationMinutes:Number(R.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});g(`Created ${L.name} (${L.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(_,T,R)=>RA((N)=>{let L=new XL(N.controlPlane.store).list(N.controlPlane.project.id).filter((O)=>O.status==="ready").map((O)=>({serverId:O.id,target:O.name,previousVersion:O.bootstrapVersion??ID}));if(!L.length)L.push({target:"control-plane",previousVersion:ID});let A=N.store.createCampaign({projectId:N.controlPlane.project.id,manifestId:_,fromVersion:ID,strategy:R.strategy==="rolling"?"rolling":"canary",batchSize:Number(R.batch),healthGate:{kind:"platform"},backupId:T,targets:L}),S=N.service.enqueueCampaign(A.id);g(`Staged upgrade queued: ${S.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(_,T)=>RA(async(R)=>{let N=await R.service.previewCleanup({projectId:R.controlPlane.project.id,kind:_,criteria:{olderThanDays:Number(T.olderThan)}},R.cleanup);p(["ID","Candidate","Bytes"],N.candidates.map((L)=>[L.id,L.label,String(L.bytes)])),X(`Apply with: cloud cleanup:apply ${N.id} --confirm "DELETE ${N.candidates.length} ${N.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(_,T)=>RA((R)=>{let N=R.service.enqueueCleanup(_,String(T.confirm??""));g(`Cleanup queued: ${N.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(_,T,R)=>RA((N)=>{let L=N.store.createDrill({projectId:N.controlPlane.project.id,scenario:_,isolatedTarget:T,expectedRpoMinutes:Number(R.rpo),expectedRtoMinutes:Number(R.rto),recoveryPointId:R.recoveryPoint,topologyId:R.topology});g(`Planned isolated drill ${L.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(_)=>RA((T)=>{let R=T.service.enqueueDrill(_);g(`DR drill queued: ${R.operation.id}`)}))}kE();DS();cR();async function lH(){try{return(await o()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function mH(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(_)=>{r("Lambda Functions");let T=_?.region||await lH(),R=new K_(T);try{let{Functions:N=[]}=await R.listFunctions({MaxItems:50});if(!N.length){X("No functions found");return}p(["Name","Runtime","Memory","Timeout","Last Modified"],N.map((L)=>[L.FunctionName??"-",L.Runtime??"-",L.MemorySize?`${L.MemorySize} MB`:"-",L.Timeout?`${L.Timeout}s`:"-",L.LastModified??"-"]))}catch(N){d(`Failed to list functions: ${N.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(_,T)=>{r(`Invoking ${_}`);let R=T?.region||await lH(),N=new K_(R),L=new l("Invoking function...");L.start();try{let A=await N.invoke({FunctionName:_,InvocationType:T?.async?"Event":"RequestResponse",Payload:T?.payload||"{}",LogType:T?.async?"None":"Tail"});if(A.FunctionError){if(L.fail(`Function returned an error (${A.FunctionError})`),A.Payload)X(A.Payload);process.exitCode=1;return}if(L.succeed(`Invoked (status ${A.StatusCode})`),A.Payload)X(`
+`).find((N)=>N&&!N.startsWith("#"))?.trim().split(/\s+/);if(T.code!==0||!R?.[1]||!R[2])throw Error(`SSH host-key scan failed: ${T.stderr.trim()||"no key returned"}`);return{algorithm:R[1],key:R[2]}}async exec(E,_){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return A4(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,_])}}var ce=(E)=>`SHA256:${ge("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,ve=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class oL{provider;transport;discoverer;constructor(E,_=new S4,T){this.provider=E;this.transport=_;this.discoverer=T}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let _=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:_.algorithm,hostKeyFingerprint:ce(_.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let _=await this.transport.exec(E,ve);if(_.code!==0)throw Error(`Fleet validation failed: ${_.stderr.trim()||_.code}`);try{return JSON.parse(_.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,_){let T=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${_.length}`);if(T.code!==0)throw Error(`Fleet bootstrap failed: ${T.stderr.trim()||T.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function O4(E,_){return{"fleet.bootstrap":async(T)=>{let R=T.operation.input&&typeof T.operation.input==="object"&&!Array.isArray(T.operation.input)?T.operation.input:{},N=E.get(String(R.serverId??""));if(!N)throw Error("Queued fleet server was not found.");let L=_.find((O)=>O.provider===N.provider);if(!L)throw Error(`No ${N.provider} fleet driver is configured.`);let A=Array.isArray(R.steps)?R.steps.map(String):[];if(T.checkpoint("preflight","Rechecking pinned trust and healthy validation."),N.trustState!=="pinned"||!N.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");T.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let S=await L.bootstrap(N,A);return E.update(N.id,{bootstrapVersion:S.version,status:"ready"}),T.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:N.id,bootstrapVersion:S.version,steps:A.length}}}}var CL=(E)=>E==null?void 0:String(E),B0=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},dH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:CL(E.provider_id),region:CL(E.region),zone:CL(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:CL(E.host_key_algorithm),hostKeyFingerprint:CL(E.host_key_fingerprint),pendingHostKey:CL(E.pending_host_key),roles:B0(E.roles,[]),labels:B0(E.labels,{}),taints:B0(E.taints,[]),capacity:B0(E.capacity,{}),usage:B0(E.usage,{}),capabilities:B0(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:B0(E.validation,void 0),bootstrapVersion:CL(E.bootstrap_version),heartbeatAt:CL(E.heartbeat_at),lastSeenAt:CL(E.last_seen_at),archivedAt:CL(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class XL{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}get(E){let _=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return _?dH(_):void 0}list(E,_=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(dH).filter((T)=>_||T.status!=="archived")}findProvider(E,_,T){let R=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,_,T);return R?dH(R):void 0}create(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,T,T]),this.get(_)}update(E,_){let T=this.get(E);if(!T)throw Error("Server was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[R.name,R.providerId??null,R.region??null,R.zone??null,R.endpoint,R.sshUser,R.sshPort,R.credentialRef,R.hostKeyAlgorithm??null,R.hostKeyFingerprint??null,R.pendingHostKey??null,JSON.stringify(R.roles),JSON.stringify(R.labels),JSON.stringify(R.taints),JSON.stringify(R.capacity),JSON.stringify(R.usage),JSON.stringify(R.capabilities),R.status,R.trustState,JSON.stringify(R.validation??{}),R.bootstrapVersion??null,R.heartbeatAt??null,R.lastSeenAt??null,R.archivedAt??null,N,E]),this.get(E)}}var re=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class OD{store;drivers;now;queue;constructor(E,_,T,R=()=>new Date){this.store=E;this.drivers=_;this.now=R;this.queue=T??new pE(E.control)}driver(E){let _=this.drivers.find((T)=>T.provider===E);if(!_)throw Error(`No ${E} fleet driver is configured.`);return _}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!re.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let _=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(_)return this.store.update(_.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let T=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),R=this.driver(E.provider);return this.store.create({...E,resourceId:T.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:R.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let T=await this.driver(_.provider).test(_);if(!T.reachable)return this.store.update(E,{status:"unreachable"});if(_.hostKeyFingerprint&&_.hostKeyFingerprint!==T.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:T.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:T.hostKeyAlgorithm,hostKeyFingerprint:T.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,_){let T=this.store.get(E);if(!T||T.pendingHostKey!==_)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:_,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let _=this.store.get(E);if(!_||_.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let T=await this.driver(_.provider).validate(_),R=[];if(!["x64","arm64","x86_64","aarch64"].includes(T.arch??""))R.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let A of["curl","tar"])if(!T.tools?.[A])R.push({code:`tool.${A}`,severity:"error",message:`${A} is missing.`,remediation:`Install ${A} before bootstrap.`});if(Math.abs(T.timeSkewSeconds??0)>60)R.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!T.dnsOk)R.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let N={valid:!R.some((A)=>A.severity==="error"),facts:T,findings:R,validatedAt:this.now().toISOString(),validatorVersion:"1"},L={cpu:T.cpuCores??0,memoryBytes:T.memoryBytes??0,diskBytes:T.diskBytes??0};return this.store.update(E,{validation:N,capacity:L,status:N.valid?"ready":"degraded"})}bootstrap(E,_=!1){let T=this.store.get(E);if(!T?.validation?.valid)throw Error("A healthy validation report is required.");let R=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!_)return{preview:!0,steps:R};let N=this.queue.enqueue({projectId:T.projectId,resourceId:T.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:R},lockKey:`server:${E}`,providerKey:T.provider}).operation;return{preview:!1,steps:R,operation:N}}heartbeat(E,_){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let R=this.now().toISOString();return this.store.update(E,{usage:_.usage,capabilities:_.capabilities??T.capabilities,heartbeatAt:R,lastSeenAt:R,status:T.status==="draining"||T.status==="drained"?T.status:"ready"})}drain(E,_=!1){return this.store.update(E,{status:_?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,_){let T=this.store.get(E);if(!T||_!==T.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function ue(){let E=await o(),_=mE(process.cwd(),E),T=new XL(_.store),R=new OD(T,[new oL("aws"),new oL("hetzner"),new oL("ssh")]);return{controlPlane:_,store:T,service:R}}async function EA(E){let _=await ue();try{return await E(_)}finally{_.controlPlane.store.close()}}var H0=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!T)throw Error(`Server ${_} was not found.`);return T},$N=(E)=>{d(E instanceof Error?E.message:String(E)),process.exitCode=1};function qH(E,_){let T=Number.parseInt(E??"",10);return Number.isFinite(T)&&T>=0?T:_}function te(E="3h"){let _=E.match(/^(\d+)(m|h)$/);if(!_)throw Error("--range must use minutes or hours, for example 30m or 3h.");let T=Number(_[1])*(_[2]==="h"?3600000:60000);if(T<300000||T>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return T}function UD(E,_="%"){return E==null?"unavailable":`${E.toFixed(1)}${_}`}async function le(E,_){let T=await o();if(T.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",N=B_(T,R),L=await fN(N);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${L.serverName}.`);let A=$U(T),S=new aL({apiToken:DU(A.apiToken,T)}),O=await S.getServer(L.serverId),U=L.publicIp??O.public_net.ipv4?.ip;if(!U)throw Error(`Server ${O.name} has no public IPv4 address.`);let h=new Date,$=new Date(h.getTime()-te(_.range)),D=Math.min(3600,Math.max(60,qH(_.step,60))),C=await rM({client:S,serverId:O.id,cores:Math.max(1,Number(O.server_type.cores)||1),from:$,to:h,step:D,remote:{host:U,user:L.sshUser??A.sshUser,identityFile:A.sshPrivateKeyPath,connectTimeoutSec:15}});if(_.json){console.log(JSON.stringify({schemaVersion:1,server:O.name,result:C},null,2));return}p(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[O.name,`${C.from} to ${C.to}`,`${UD(C.summary.cpuAveragePercent)} / ${UD(C.summary.cpuPeakPercent)}`,`${UD(C.summary.memoryAveragePercent)} / ${UD(C.summary.memoryPeakPercent)}`,C.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(C.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,UD(C.summary.swapPeakPercent)]])}function U4(E){let _=E.targetType.prices?.find((T)=>T.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:_?{hourlyNet:_.price_hourly.net,hourlyGross:_.price_hourly.gross,monthlyNet:_.price_monthly.net,monthlyGross:_.price_monthly.gross}:void 0}}function me(E){let _=U4(E);p(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${_.serverName} (${_.serverId})`,_.location,`${_.from} -> ${_.to}`,_.capacityAvailable?"available":"waiting",`${_.target.cores??0} / ${_.target.memoryGb??0} GB / ${_.target.diskGb??0} GB`,_.price?.monthlyGross??_.price?.monthlyNet??"not reported"]])}async function ne(E,_,T){let R=await o();if(R.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let N=T.env??process.env.CLOUD_ENV??"production",L=B_(R,N),A=await fN(L),S=$U(R),O=new aL({apiToken:DU(S.apiToken,R)}),h=A&&(E===A.serverName||E===String(A.serverId)||E===A.stackName)?await O.getServer(A.serverId):(await O.listServers()).find((q)=>q.name===E||String(q.id)===E);if(!h)throw Error(`Hetzner server ${E} was not found.`);if(A?.serverId&&A.serverId!==h.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${A.serverId}.`);let $=iL(_),D=T.upgradeDisk!==!1,C=await SD(O,h.id,$,D);if(T.json)console.log(JSON.stringify({schemaVersion:1,plan:U4(C)},null,2));else me(C);if(!T.apply){if(!T.json)X(`Preview only. Re-run with --apply --confirm ${h.name} to execute.`);return}if(T.confirm!==h.name)throw Error(`Resize requires --confirm ${h.name}.`);let J=A?.publicIp??h.public_net.ipv4?.ip;if(!J)throw Error(`Server ${h.name} has no public IPv4 address for verification.`);let I={host:J,user:A?.sshUser??S.sshUser,identityFile:S.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},W=await KH(L),H=new Date().toISOString(),j={schemaVersion:1,operationId:W?.targetType===$&&W.serverId===h.id?W.operationId:crypto.randomUUID(),stackName:L,serverId:h.id,serverName:h.name,sourceType:C.currentType.name,targetType:$,upgradeDisk:D,phase:"planning",status:"running",attempts:W?.targetType===$?W.attempts:0,startedAt:W?.targetType===$?W.startedAt:H,updatedAt:H,manifest:W?.targetType===$?W.manifest:void 0};await pL(j);let B=qH(T.pollSeconds,900)*1000,Q=qH(T.maxWaitMinutes,0)*60000,K=Date.now();for(;;){let q=await SD(O,h.id,$,D);if(!q.capacityAvailable&&!q.alreadyComplete){if(j={...j,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await pL(j),!T.wait){if(!T.json)X(`${$} has no capacity in ${q.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(Q>0&&Date.now()-K>=Q)throw Error(`Timed out waiting for ${$} capacity in ${q.location}.`);if(!T.json)X(`Waiting ${Math.round(B/1000)} seconds for ${$} capacity...`);await Bun.sleep(B);continue}let x=await VH(L);try{let b=await(async()=>{try{return j={...j,status:"running",attempts:j.attempts+1,updatedAt:new Date().toISOString()},await pL(j),await YH({client:O,serverId:h.id,targetType:$,upgradeDisk:D,resumeFromOff:j.phase==="shutting-down"||j.phase==="resizing"||j.phase==="powering-on"||j.phase==="verifying",manifest:j.manifest,hooks:{preflight:async()=>{let f=await QH(I);return j={...j,manifest:f,updatedAt:new Date().toISOString()},await pL(j),f},afterBoot:async(f,v,t,EE)=>GH(I,v,t,EE),onPhase:async(f,v)=>{if(j={...j,phase:f,status:f==="waiting-capacity"?"waiting-capacity":f==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await pL(j),!T.json)X(`${f}${v?` ${JSON.stringify(v)}`:""}`)}}})}finally{await x()}})();if(j={...j,status:b.status==="completed"||b.status==="already-complete"?"completed":b.status==="recovered"?"recovered":"waiting-capacity",lastError:b.status==="recovered"?b.error:void 0,updatedAt:new Date().toISOString()},await pL(j),T.json)console.log(JSON.stringify({schemaVersion:1,result:b},null,2));else if(b.status==="completed"||b.status==="already-complete")g(`${h.name} is on ${$} and passed full post-boot verification.`);else if(b.status==="recovered"&&b.retryable&&T.wait){X(`Capacity race recovered safely. Waiting ${Math.round(B/1000)} seconds before retry.`),await Bun.sleep(B);continue}else if(b.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${b.error}`);return}catch(b){throw j={...j,status:"failed",lastError:b instanceof Error?b.message:String(b),updatedAt:new Date().toISOString()},await pL(j),b}}}async function ee(E,_){let T=await o();if(T.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",N=B_(T,R),L=await fN(N);if(!L?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![L.serverName,String(L.serverId),L.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${L.serverName}.`);let A=$U(T),S=new aL({apiToken:DU(A.apiToken,T)}),O=await S.getServer(L.serverId),U=L.publicIp??O.public_net.ipv4?.ip;if(!U)throw Error(`Server ${O.name} has no public IPv4 address.`);let h=Q2(T);if(_.json)console.log(JSON.stringify({schemaVersion:1,server:O.name,plan:h},null,2));else p(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[O.name,h.firewallPorts.join(","),h.monitoring?"on":"off",h.autoUpdates?"on":"off",`${h.swapGb} GB`,"disabled"]]);if(!_.apply){if(!_.json)X(`Preview only. Re-run with --apply --confirm ${O.name} to execute.`);return}if(_.confirm!==O.name)throw Error(`Optimization requires --confirm ${O.name}.`);let $={host:U,user:L.sshUser??A.sshUser,identityFile:A.sshPrivateKeyPath,connectTimeoutSec:15},D=await BU($),C=D.routeProbes.filter((t)=>!t.ok),J=T.infrastructure?.compute,I=jR(J)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,W=D.failedUnits.filter((t)=>!I.has(t));if(W.length>0)throw Error(`Preflight found failed services: ${W.join(", ")}`);if(C.length>0)throw Error(`Preflight found unhealthy routes: ${C.map((t)=>t.domain).join(", ")}`);let H=jR(J)?[]:Object.values(T.sites??{}).flatMap((t)=>typeof t?.port==="number"&&![80,443].includes(t.port)?[t.port]:[]),j=JU({allowSsh:J?.allowSsh!==!1,sitePorts:H,allowedPorts:J?.firewall?.allowedPorts}),B=(L.firewallId?(await S.listFirewalls()).find((t)=>t.id===L.firewallId):void 0)??(await S.listFirewalls()).find((t)=>t.name===`${T.project.slug}-${R}-app-fw`);if(!B)throw Error(`Managed firewall for ${O.name} was not found.`);let Q=await S.setFirewallRules(B.id,j);await Promise.all(Q.map((t)=>S.waitForAction(t.id))),await JH(T,$);let[K,q]=await Promise.all([BU($),IH($)]),x=FH(h,q),b=sM(D,K),f=K.routeProbes.filter((t)=>!t.ok);if(b.stoppedServices.length>0)x.push(`services stopped: ${b.stoppedServices.join(", ")}`);if(b.changedRouteFragments.length>0)x.push(`route fragments changed: ${b.changedRouteFragments.join(", ")}`);if(b.missingRouteIds.length>0)x.push(`routes disappeared: ${b.missingRouteIds.join(", ")}`);if(b.changedReleaseLinks.length>0)x.push(`release links changed: ${b.changedReleaseLinks.join(", ")}`);if(b.missingData.length>0)x.push(`databases or volumes disappeared: ${b.missingData.join(", ")}`);if(f.length>0)x.push(`unhealthy routes: ${f.map((t)=>t.domain).join(", ")}`);if(x.length>0)throw Error(`Host optimization verification failed: ${x.join("; ")}`);let v={serverId:O.id,serverName:O.name,services:K.runningServices.length,routes:K.routeIds.length,healthyDomains:K.routeProbes.length,releaseLinks:K.releaseLinks.length,databasesAndVolumes:K.dataCatalog.length,report:q};if(_.json)console.log(JSON.stringify({schemaVersion:1,result:v},null,2));else g(`${O.name} passed full host, rpx route, service, release, and data verification.`)}function xH(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(_,T)=>{try{await EA(async(R)=>{let N=_?[H0(R,_)]:R.store.list(R.controlPlane.project.id),L=N.flatMap((A)=>Object.entries(A.capabilities).map(([S,O])=>({server:A.name,provider:A.provider,action:S,...O})));if(T.json)console.log(JSON.stringify({schemaVersion:1,targets:L},null,2));else p(["Server","Provider","Action","Support","Explanation"],L.map((A)=>[A.server,A.provider,A.action,A.supported?"supported":"unsupported",A.reason??"—"]))})}catch(R){$N(R)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(_,T,R)=>{try{await ne(_,T,R)}catch(N){$N(N)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(_,T)=>{try{await ee(_,T)}catch(R){$N(R)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(_,T)=>{try{await le(_,T)}catch(R){$N(R)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(_)=>{try{await EA(async(T)=>{let R=T.store.list(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],R.map((N)=>[N.name,N.providerId??"—",`${N.provider} / ${N.region??"external"}`,`${N.status} / ${N.trustState}`,N.roles.join(","),`${N.capacity.cpu??0} / ${N.capacity.memoryBytes??0}`,N.heartbeatAt??"never"]))})}catch(T){$N(T)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(_,T)=>{try{await EA(async(R)=>{let N=T.provider;if(!["aws","hetzner","ssh"].includes(N)||!T.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let L=R.service.enroll({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,provider:N,providerId:T.providerId,endpoint:T.endpoint,sshUser:T.user??"deploy",credentialRef:T.credentialRef??"secret://fleet/agent",region:T.region,roles:String(T.roles??"application").split(","),labels:Object.fromEntries(String(T.labels??"").split(",").map((A)=>A.split("=")).filter((A)=>A[0]&&A[1]))});g(`Enrolled ${L.name} as ${L.id}; no remote mutation was performed.`)})}catch(R){$N(R)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(_,T)=>{try{await EA(async(R)=>{let N=H0(R,_);if(N=await R.service.test(N.id),N.trustState==="rotation_pending"){if(!T.acceptHostKey)throw Error(`Host key changed to ${N.pendingHostKey}; review it first.`);N=R.service.reviewHostKey(N.id,T.acceptHostKey)}let L=await R.service.validate(N.id);if(T.json)console.log(JSON.stringify(L.validation,null,2));else p(["Severity","Code","Finding","Remediation"],(L.validation?.findings??[]).map((A)=>[A.severity,A.code,A.message,A.remediation??"—"]));if(!L.validation?.valid)process.exitCode=1})}catch(R){$N(R)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(_,T)=>{try{await EA(async(R)=>{let N=R.service.bootstrap(H0(R,_).id,!!T.apply);if(N.preview)p(["Step"],N.steps.map((L)=>[L]));else g(`Bootstrap queued: ${N.operation?.id}`)})}catch(R){$N(R)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(_,T)=>{try{await EA(async(R)=>g(R.service.drain(H0(R,_).id,!!T.complete).status))}catch(R){$N(R)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(_)=>{try{await EA(async(T)=>{T.service.uncordon(H0(T,_).id),g(`Uncordoned ${_}.`)})}catch(T){$N(T)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(_,T)=>{try{await EA(async(R)=>{R.service.archive(H0(R,_).id,T.confirm??""),g(`Archived ${_}; provider infrastructure was not terminated.`)})}catch(R){$N(R)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(_)=>{try{await EA(async(T)=>{let R=H0(T,_);if(R.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let N=Bun.spawn(["ssh","-p",String(R.sshPort),"-o","StrictHostKeyChecking=yes",`${R.sshUser}@${R.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),L=await N.exited;if(L)process.exitCode=L})}catch(T){$N(T)}});for(let[_,T]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(_,T).action(async(...R)=>ON(_.split(" ")[0],{target:String(R[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}kE();var kN=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},YR=(E)=>E==null?void 0:String(E),D4=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),jU=(E={})=>({...D4(),...E});function h4(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:YR(E.region),architecture:YR(E.architecture),labels:kN(E.labels,{}),requiredServerLabels:kN(E.required_server_labels,{}),toleratedTaints:kN(E.tolerated_taints,[]),capacity:jU(kN(E.capacity,{})),reserved:kN(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:YR(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function $4(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:YR(E.environment_id),resourceId:String(E.resource_id),releaseId:YR(E.release_id),poolId:String(E.pool_id),serverId:YR(E.server_id),purpose:String(E.purpose),requirements:kN(E.requirements,{}),decision:kN(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function ae(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:YR(E.resource_id),poolId:String(E.pool_id),placementId:YR(E.placement_id),operationId:YR(E.operation_id),sourceSha:String(E.source_sha),buildSpec:kN(E.build_spec,{}),credentialPolicy:kN(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:YR(E.workspace),cacheKey:YR(E.cache_key),artifactUri:YR(E.artifact_uri),artifactDigest:YR(E.artifact_digest),status:String(E.status),cleanupAt:YR(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class hD{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}createPool(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(jU(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,T,T]),this.getPool(_)}getPool(E){let _=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return _?h4(_):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(h4)}updatePool(E,_){let T=this.getPool(E);if(!T)throw Error("Capacity pool was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[R.status,JSON.stringify(R.reserved),JSON.stringify(R.capacity),R.concurrency,N,E]),this.getPool(E)}addMember(E,_,T={}){let R=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,_,JSON.stringify(T),R,R])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((_)=>({serverId:String(_.server_id),status:String(_.status),capacityOverride:kN(_.capacity_override,{})}))}memberStatus(E,_,T){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[T,this.now().toISOString(),E,_])}listPlacements(E,_){let T=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map($4);return _?.length?T.filter((R)=>_.includes(R.status)):T}getPlacement(E){let _=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return _?$4(_):void 0}activeUsage(E,_){let T=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),R=_?T.filter((N)=>String(N.server_id)===_):T;return{resources:R.reduce((N,L)=>{let A=jU(kN(L.resources,{}));for(let S of Object.keys(N))N[S]+=A[S];return N},D4()),count:R.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let _=this.id(),T=this.id(),R=this.now().toISOString(),N=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[_,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,R,R]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[T,_,E.decision.poolId,E.decision.serverId??null,JSON.stringify(jU(E.requirements.resources)),N,R,R]),this.getPlacement(_)})}transitionPlacement(E,_){if(!this.getPlacement(E))throw Error("Placement was not found.");let R=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[_,R,E]),["released","failed","blocked"].includes(_))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[R,E]);return this.getPlacement(E)}createBuild(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[_,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),T,T]),this.getBuild(_)}getBuild(E){let _=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return _?ae(_):void 0}updateBuild(E,_){let T=this.getBuild(E);if(!T)throw Error("Remote build was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[R.operationId??null,R.workspace??null,R.cacheKey??null,R.artifactUri??null,R.artifactDigest??null,R.status,R.cleanupAt??null,N,E]),this.getBuild(E)}}var K2=["cpu","memoryBytes","diskBytes","gpu"],C4=(E,_={})=>Object.entries(_).every(([T,R])=>E[T]===R),ie=(E,_,T)=>Object.fromEntries(K2.map((R)=>[R,Math.max(0,E[R]-_[R]-(T[R]??0))])),se=(E,_)=>K2.every((T)=>E[T]>=(_[T]??0)),pe=(E,_)=>K2.reduce((T,R)=>T+(_[R]??0)/(E[R]||1),0);class $D{store;fleet;constructor(E,_){this.store=E;this.fleet=_}poolCandidates(E,_,T){let R=[];for(let N of this.store.listPools(E)){if(N.id===T)continue;let L=[];if(N.status!=="active")L.push(`pool is ${N.status}`);if(N.purpose!==_.purpose)L.push(`purpose is ${N.purpose}`);if(_.region&&N.region!==_.region)L.push(`region is ${N.region??"unset"}`);if(_.architecture&&N.architecture!==_.architecture)L.push(`architecture is ${N.architecture??"unset"}`);if(!C4(N.labels,_.labels))L.push("pool labels do not match");if(N.backend==="server"){let A=this.store.members(N.id);if(!A.length)R.push(this.decision(N,void 0,_,[...L,"pool has no servers"]));for(let S of A){let O=this.fleet.get(S.serverId),U=[...L];if(!O)U.push("server is missing");else this.serverReasons(N,O,S.status,_,U);R.push(this.decision(N,O,_,U,S.capacityOverride))}}else R.push(this.decision(N,void 0,_,L))}return R.sort((N,L)=>Number(L.eligible)-Number(N.eligible)||N.score.cost-L.score.cost||N.score.spread-L.score.spread||N.score.fit-L.score.fit||N.poolName.localeCompare(L.poolName)||(N.serverId??"").localeCompare(L.serverId??""))}serverReasons(E,_,T,R,N){if(T!=="active")N.push(`member is ${T}`);if(_.status!=="ready")N.push(`server is ${_.status}`);if(!_.roles.includes(R.purpose==="build"?"build":R.purpose))N.push(`server lacks ${R.purpose} role`);if(!C4(_.labels,E.requiredServerLabels))N.push("server labels do not match pool selector");for(let L of _.taints)if(!E.toleratedTaints.includes(L))N.push(`taint ${L} is not tolerated`)}decision(E,_,T,R,N={}){let L=jU({..._?.capacity,...N}),A=_?Object.fromEntries(K2.map((U)=>[U,Math.min(E.capacity[U],L[U])])):E.capacity,S=this.store.activeUsage(E.id,_?.id),O=ie(A,S.resources,E.reserved);if(S.count>=E.maxWorkloads)R.push("workload limit reached");if(T.purpose==="build"&&S.count>=E.concurrency)R.push("build concurrency reached");if(!se(O,T.resources))R.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:_?.id,eligible:R.length===0,reasons:R,available:O,score:{fit:pe(O,T.resources),spread:S.count,cost:E.costWeight}}}explain(E,_){return this.poolCandidates(E,_)}place(E){return this.store.control.transaction(()=>{let _=this.poolCandidates(E.projectId,E.requirements).find((T)=>T.eligible);if(!_)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((T)=>T.reasons).join("; ")}`);return this.store.reserve({...E,decision:_})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let _=this.store.updatePool(E,{status:"draining"}),T=[],R=[];for(let N of this.store.listPlacements(_.projectId,["reserved","active"]).filter((L)=>L.poolId===E)){if(N.stateful){R.push(this.store.transitionPlacement(N.id,"blocked"));continue}this.store.transitionPlacement(N.id,"moving");let L=this.place({projectId:N.projectId,environmentId:N.environmentId,resourceId:N.resourceId,releaseId:N.releaseId,requirements:N.requirements});T.push(this.activate(L.id)),this.store.transitionPlacement(N.id,"released")}return{pool:_,moved:T,blocked:R}}drainServer(E,_){this.store.memberStatus(E,_,"draining");let T=this.store.getPool(E);if(!T)throw Error("Capacity pool was not found.");let R=[],N=[];for(let L of this.store.listPlacements(T.projectId,["reserved","active"]).filter((A)=>A.poolId===E&&A.serverId===_)){if(L.stateful){N.push(this.store.transitionPlacement(L.id,"blocked"));continue}this.store.transitionPlacement(L.id,"moving");let A=this.poolCandidates(L.projectId,L.requirements).find((O)=>O.eligible);if(!A){N.push(this.store.transitionPlacement(L.id,"blocked"));continue}let S=this.store.reserve({projectId:L.projectId,environmentId:L.environmentId,resourceId:L.resourceId,releaseId:L.releaseId,requirements:L.requirements,decision:A});R.push(this.activate(S.id)),this.store.transitionPlacement(L.id,"released")}return{moved:R,blocked:N}}reconcileFailure(E){let _=this.fleet.get(E);if(!_)throw Error("Server was not found.");let T=[],R=[];for(let N of this.store.listPlacements(_.projectId,["active"]).filter((L)=>L.serverId===E)){if(N.stateful||!N.autoReschedule){R.push(this.store.transitionPlacement(N.id,"blocked"));continue}this.store.transitionPlacement(N.id,"failed");let L=this.place({projectId:N.projectId,environmentId:N.environmentId,resourceId:N.resourceId,releaseId:N.releaseId,requirements:N.requirements});T.push(this.activate(L.id))}return{rescheduled:T,blocked:R}}}await g_();async function oe(){let E=await o(),_=mE(process.cwd(),E),T=new hD(_.store),R=new $D(T,new XL(_.store));return{controlPlane:_,store:T,service:R}}async function DD(E){let _=await oe();try{await E(_)}catch(T){d(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var V2=(E)=>Object.fromEntries(String(E??"").split(",").map((_)=>_.split("=")).filter((_)=>_[0]&&_[1])),X4=(E)=>Object.fromEntries(Object.entries(V2(E)).map(([_,T])=>[_,Number(T)]));function yH(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(_)=>DD((T)=>{let R=T.store.listPools(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],R.map((N)=>[N.name,N.purpose,N.backend,`${N.region??"any"} / ${N.architecture??"any"}`,N.status,JSON.stringify(N.capacity),String(N.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(_,T)=>DD((R)=>{let{purpose:N,backend:L}=T;if(!["application","build","worker","monitoring","backup"].includes(N)||!["server","ecs","asg"].includes(L))throw Error("Unsupported pool purpose or backend.");let A=R.store.createPool({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,purpose:N,backend:L,region:T.region,architecture:T.arch,labels:V2(T.labels),requiredServerLabels:V2(T.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...X4(T.capacity)},maxWorkloads:Number(T.max),costWeight:1,concurrency:Number(T.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});g(`Created ${A.name} (${A.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(_,T)=>DD((R)=>{let N=R.store.listPools(R.controlPlane.project.id).find((A)=>A.id===_||A.name===_),L=new XL(R.controlPlane.store).list(R.controlPlane.project.id).find((A)=>A.id===T||A.name===T);if(!N||!L)throw Error("Pool or server was not found.");R.store.addMember(N.id,L.id),g(`Attached ${L.name} to ${N.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(_)=>DD((T)=>{let R=T.service.explain(T.controlPlane.project.id,{purpose:_.purpose,resources:X4(_.resources),region:_.region,architecture:_.arch,labels:V2(_.labels)});if(_.json)console.log(JSON.stringify(R,null,2));else p(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],R.map((N)=>[N.poolName,N.serverId??"provider-managed",N.eligible?"yes":"no",JSON.stringify(N.available),`${N.score.fit.toFixed(2)} / ${N.score.spread} / ${N.score.cost}`,N.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(_)=>DD((T)=>{let R=T.store.listPools(T.controlPlane.project.id).find((L)=>L.id===_||L.name===_);if(!R)throw Error("Pool was not found.");let N=T.service.drainPool(R.id);g(`Draining ${R.name}: moved ${N.moved.length}, blocked ${N.blocked.length} stateful placement(s).`)}))}kE();var _A=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},DN=(E)=>E==null?void 0:String(E),J4=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:DN(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:_A(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:_A(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:DN(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),fH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:DN(E.stack_id),stackRevision:DN(E.stack_revision),status:String(E.status),health:_A(E.health,{}),lastHealthyAt:DN(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),kH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:_A(E.config,{}),status:String(E.status),checkpoint:DN(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:DN(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),bH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:_A(E.weights,{}),desiredWeights:_A(E.desired_weights,{}),status:String(E.status),providerState:_A(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),I4=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:DN(E.operation_id),kind:String(E.kind),requestedRegion:DN(E.requested_region),revision:DN(E.revision),plan:_A(E.plan,[]),currentStep:DN(E.current_step),completedSteps:_A(E.completed_steps,[]),status:String(E.status),error:DN(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class CD{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((L)=>L.region)).size!==E.regions.length||E.regions.filter((L)=>L.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let _=E.regions.find((L)=>L.role==="primary"),T=this.id(),R=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[T,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,_.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),_.region,R,R]);for(let L of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),T,L.region,L.role,L.provider,R,R]);for(let L of E.dataPolicy.replicate)for(let A of E.regions)for(let S of E.regions.filter((O)=>O.region!==A.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,L,A.region,S.region,"{}",R,R]);let N=Object.fromEntries(E.regions.map((L)=>[L.region,L.region===_.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),T,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(N),JSON.stringify(N),R,R]),this.get(T)})}get(E){let _=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return _?J4(_):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(J4)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(fH)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(kH)}route(E){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return _?bH(_):void 0}updateTopology(E,_){let T=this.get(E);if(!T)throw Error("Regional topology was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[R.status,R.activeRegion,R.revision??null,JSON.stringify(R.regions),N,E]),this.get(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!T)throw Error("Regional target was not found.");let R=fH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[N.role,N.stackId??null,N.stackRevision??null,N.status,JSON.stringify(N.health),N.lastHealthyAt??null,L,E]),fH(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,_){let T=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!T)throw Error("Replication channel was not found.");let R=kH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[N.status,N.checkpoint??null,N.lagSeconds??null,N.lastVerifiedAt??null,L,E]),kH(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,_){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!T)throw Error("Traffic route was not found.");let R=bH(T),N={...R,..._},L=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(N.weights),JSON.stringify(N.desiredWeights),N.status,JSON.stringify(N.providerState),L,E]),bH(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[_,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),T,T]),this.execution(_)}execution(E){let _=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return _?I4(_):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(I4)}updateExecution(E,_){let T=this.execution(E);if(!T)throw Error("Regional execution was not found.");let R={...T,..._},N=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[R.operationId??null,R.currentStep??null,JSON.stringify(R.completedSteps),R.status,R.error??null,N,E]),this.execution(E)}}await g_();class XD{store;queue;constructor(E,_){this.store=E;this.queue=_??new pE(E.control)}create(E){return this.store.create(E)}plan(E,_,T){if(!this.store.get(E))throw Error("Regional topology was not found.");let N=this.store.targets(E),L=this.store.channels(E);if(_==="rollout")return[...N.filter((A)=>A.role==="secondary").map((A)=>`apply:${A.region}`),...N.filter((A)=>A.role==="primary").map((A)=>`apply:${A.region}`),...L.map((A)=>`replicate:${A.kind}:${A.targetRegion}`),"traffic:activate"];if(_==="failover"||_==="failback")return[`health:${T}`,`replication:${T}`,`traffic:${T}`,`roles:${T}`];if(_==="destroy")return["traffic:drain",...N.filter((A)=>A.role==="secondary").map((A)=>`delete:${A.region}`),...N.filter((A)=>A.role==="primary").map((A)=>`delete:${A.region}`),"complete"];return["observe","repair"]}enqueue(E){let _=this.store.get(E.topologyId);if(!_)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!_.regions.some((L)=>L.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===_.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==_.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&_.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let T=this.plan(_.id,E.kind,E.targetRegion),R=this.store.createExecution({topologyId:_.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:T}),N=this.queue.enqueue({projectId:_.projectId,environmentId:_.environmentId,kind:`region.${E.kind}`,input:{executionId:R.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${_.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(R.id,{operationId:N.id}),{execution:this.store.execution(R.id),operation:N}}}var Ea=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function F4(E,_){let T=(U)=>{let h=_.find(($)=>$.provider===U.provider);if(!h)throw Error(`No ${U.provider} regional driver is configured.`);return h},R=(U,h,$)=>{U.throwIfCancellationRequested(),U.checkpoint($,$),E.updateExecution(h.id,{status:"running",currentStep:$,completedSteps:[...E.execution(h.id).completedSteps,$]})},N=async(U,h)=>{let $=E.route(U.id);if(!$)throw Error("Regional traffic route was not found.");let D=E.targets(U.id).find((J)=>J.region===U.activeRegion)??E.targets(U.id)[0];if(!D)throw Error("Regional traffic target was not found.");E.updateRoute($.id,{status:"applying",desiredWeights:h});let C=await T(D).applyTraffic({route:E.route(U.id),topology:U,weights:h});E.updateRoute($.id,{status:Object.values(h).every((J)=>J===0)?"drained":"in_sync",weights:h,providerState:C.providerState})},L=async(U,h,$,D)=>{E.updateTopology($.id,{status:"provisioning"});let C=h.revision,J=D.manifest??{},I=E.targets($.id).sort((H,j)=>Number(H.role==="primary")-Number(j.role==="primary"));for(let H of I){R(U,h,`apply:${H.region}`),E.updateTarget(H.id,{status:"provisioning"});let j=await T(H).applyStack({target:H,revision:C,manifest:J,signal:U.signal}),B=await T(H).health({target:E.updateTarget(H.id,{stackId:j.stackId,stackRevision:C})});if(!B.healthy)throw Error(`Regional health gate failed in ${H.region}.`);E.updateTarget(H.id,{status:"ready",health:B.evidence,lastHealthyAt:new Date().toISOString()})}for(let H of E.channels($.id)){R(U,h,`replicate:${H.kind}:${H.targetRegion}`),E.updateChannel(H.id,{status:"configuring"});let j=I.find((K)=>K.region===H.sourceRegion),B=await T(j).configureReplication({channel:H,topology:$}),Q=await T(j).verifyReplication({channel:E.updateChannel(H.id,{checkpoint:B.checkpoint,lagSeconds:B.lagSeconds}),topology:$});if(!Q.healthy||Q.lagSeconds>$.dataPolicy.maxLagSeconds)throw Error(`${H.kind} replication to ${H.targetRegion} exceeds the RPO.`);E.updateChannel(H.id,{status:"in_sync",checkpoint:Q.checkpoint,lagSeconds:Q.lagSeconds,lastVerifiedAt:new Date().toISOString()})}R(U,h,"traffic:activate");let W=Object.fromEntries($.regions.map((H)=>[H.region,H.region===$.activeRegion?100:0]));return await N($,W),E.updateTopology($.id,{status:"ready",revision:C}),{revision:C,activeRegion:$.activeRegion}},A=async(U,h,$)=>{let D=h.requestedRegion,C=E.targets($.id).find((W)=>W.region===D);if(!C)throw Error("Requested regional target was not found.");E.updateTopology($.id,{status:h.kind==="failover"?"failing_over":"failing_back"}),R(U,h,`health:${D}`);let J=await T(C).health({target:C});if(!J.healthy)throw Error(`Target region ${D} is unhealthy.`);E.updateTarget(C.id,{status:"ready",health:J.evidence,lastHealthyAt:new Date().toISOString()}),R(U,h,`replication:${D}`);for(let W of E.channels($.id).filter((H)=>H.targetRegion===D)){let H=await T(C).verifyReplication({channel:W,topology:$});if(!H.healthy||H.lagSeconds>$.dataPolicy.maxLagSeconds)throw Error(`${W.kind} replication is outside the failover RPO.`);E.updateChannel(W.id,{status:"in_sync",checkpoint:H.checkpoint,lagSeconds:H.lagSeconds,lastVerifiedAt:new Date().toISOString()})}R(U,h,`traffic:${D}`),await N($,Object.fromEntries($.regions.map((W)=>[W.region,W.region===D?100:0]))),R(U,h,`roles:${D}`);let I=$.regions.map((W)=>({...W,role:W.region===D?"primary":"secondary"}));for(let W of E.targets($.id))E.updateTarget(W.id,{role:W.region===D?"primary":"secondary"});return E.updateTopology($.id,{status:h.kind==="failover"?"failed_over":"ready",activeRegion:D,regions:I}),{activeRegion:D}},S=async(U,h,$,D)=>{E.updateTopology($.id,{status:"destroying"}),R(U,h,"traffic:drain"),await N($,Object.fromEntries($.regions.map((J)=>[J.region,0])));let C=D.deleteData!==!0;for(let J of E.targets($.id).sort((I,W)=>Number(I.role==="primary")-Number(W.role==="primary")))R(U,h,`delete:${J.region}`),E.updateTarget(J.id,{status:"deleting"}),await T(J).deleteStack({target:J,retainData:C,signal:U.signal}),E.updateTarget(J.id,{status:"deleted"});return R(U,h,"complete"),E.updateTopology($.id,{status:"destroyed"}),{destroyed:!0,dataRetained:C}},O=async(U)=>{let h=Ea(U.operation.input),$=E.execution(String(h.executionId??""));if(!$)throw Error("Regional execution was not found.");let D=E.get($.topologyId);if(!D)throw Error("Regional topology was not found.");try{let C;if($.kind==="rollout")C=await L(U,$,D,h);else if($.kind==="failover"||$.kind==="failback")C=await A(U,$,D);else if($.kind==="destroy")C=await S(U,$,D,h);else throw Error("Regional reconciliation is not configured.");return E.updateExecution($.id,{status:"succeeded",currentStep:void 0}),{executionId:$.id,...C}}catch(C){if(E.updateExecution($.id,{status:U.cancellationRequested()?"cancelled":"failed",error:C instanceof Error?C.message:String(C)}),E.get(D.id)?.status!=="destroyed")E.updateTopology(D.id,{status:"failed"});throw C}};return{"region.rollout":O,"region.failover":O,"region.failback":O,"region.destroy":O,"region.reconcile":O}}class gH{provider;reason;constructor(E,_="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=_}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function _a(){let E=await o(),_=mE(process.cwd(),E),T=new CD(_.store),R=new XD(T);return{controlPlane:_,store:T,service:R}}async function j0(E){let _=await _a();try{await E(_)}catch(T){d(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var JD=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!T)throw Error("Regional topology was not found.");return T},Ta=(E)=>E.split(",").map((_,T)=>{let[R,N="aws"]=_.split(":");return{region:String(R),provider:N,role:T===0?"primary":"secondary"}}),Ra=(E)=>{let _=new Set(["s3","dynamodb","secrets"]),T=E.split(",").map((N)=>N.trim()),R=T.find((N)=>!_.has(N));if(R)throw Error(`Unsupported replication kind: ${R}`);return T};function cH(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(_)=>j0((T)=>{let R=T.store.list(T.controlPlane.project.id).map((N)=>({topology:N,targets:T.store.targets(N.id),channels:T.store.channels(N.id),route:T.store.route(N.id),executions:T.store.executions(N.id)}));if(_.json)console.log(JSON.stringify(R,null,2));else p(["Name","Hostname","Active","Status","Revision","Replication"],R.map((N)=>[N.topology.name,N.topology.hostname,N.topology.activeRegion,N.topology.status,N.topology.revision??"—",`${N.channels.filter((L)=>L.status==="in_sync").length}/${N.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(_,T)=>j0((R)=>{if(!T.hostname||!T.regions)throw Error("--hostname and --regions are required.");let N=R.service.create({organizationId:R.controlPlane.organization.id,projectId:R.controlPlane.project.id,name:_,hostname:T.hostname,regions:Ta(T.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Ra(String(T.replicate)),maxLagSeconds:Number(T.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!T.cdn,wafEnabled:!!T.waf});g(`Created ${N.name} (${N.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(_,T,R)=>j0((N)=>p(["Step"],N.service.plan(JD(N,_).id,T,R.target).map((L)=>[L])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(_,T,R)=>j0(async(N)=>{let L=R.manifest?await Bun.file(R.manifest).json():{},A=N.service.enqueue({topologyId:JD(N,_).id,kind:"rollout",revision:T,manifest:L});g(`Regional rollout queued: ${A.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(_,T)=>j0((R)=>{let N=R.service.enqueue({topologyId:JD(R,_).id,kind:"failover",targetRegion:T});g(`Failover queued: ${N.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(_,T)=>j0((R)=>{let N=R.service.enqueue({topologyId:JD(R,_).id,kind:"failback",targetRegion:T});g(`Failback queued: ${N.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(_,T)=>j0((R)=>{let N=R.service.enqueue({topologyId:JD(R,_).id,kind:"destroy",confirmation:T.confirm});g(`Regional teardown queued: ${N.operation.id}; replicated data remains retained.`)}))}kE();var ID="0.7.123";import{createHash as vH,createPublicKey as B4,verify as La}from"node:crypto";function FD(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(FD).join(",")}]`;return`{${Object.keys(E).sort().map((_)=>`${JSON.stringify(_)}:${FD(E[_])}`).join(",")}}`}var H4=(E)=>vH("sha256").update(FD(E)).digest("hex"),Z2=(E)=>vH("sha256").update(FD(E)).digest("hex"),j4=(E)=>vH("sha256").update(B4(E).export({type:"spki",format:"der"})).digest("hex");function Y4(E,_,T){try{return La(null,Buffer.from(FD(E)),B4(T),Buffer.from(_,"base64"))}catch{return!1}}var W4=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((_)=>Number(_)||0),z4=(E,_)=>{let T=W4(E),R=W4(_);for(let N=0;N<3;N++){let L=(T[N]??0)-(R[N]??0);if(L)return L}return 0};function w4(E,_){let T=[];if(_.schemaVersion<E.minimumSchema)T.push(`schema ${_.schemaVersion} is below ${E.minimumSchema}`);if(_.schemaVersion>E.maximumSchema)T.push(`schema ${_.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&z4(_.currentVersion,E.minimumVersion)<0)T.push(`platform ${_.currentVersion} is below ${E.minimumVersion}`);if(z4(E.version,_.currentVersion)<=0)T.push(`version ${E.version} is not newer than ${_.currentVersion}`);if(!E.artifacts.some((R)=>R.platform===_.platform&&R.architecture===_.architecture))T.push(`no artifact for ${_.platform}/${_.architecture}`);return{compatible:T.length===0,reasons:T}}var TA=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},VT=(E)=>E==null?void 0:String(E),Aa=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:VT(E.revoked_at),createdAt:String(E.created_at)}),Q4=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:TA(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:TA(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),G4=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:TA(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),P4=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:VT(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:TA(E.health_gate,{}),status:String(E.status),currentStage:VT(E.current_stage),backupId:VT(E.backup_id),approvedBy:VT(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),rH=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:VT(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:TA(E.evidence,{}),error:VT(E.error),startedAt:VT(E.started_at),finishedAt:VT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),M4=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:TA(E.criteria,{}),candidates:TA(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:VT(E.confirmation),expiresAt:String(E.expires_at),result:TA(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),K4=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:VT(E.backup_policy_id),recoveryPointId:VT(E.recovery_point_id),topologyId:VT(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:VT(E.operation_id),evidence:TA(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:VT(E.error),startedAt:VT(E.started_at),finishedAt:VT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class WD{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}addTrustedKey(E){let _=this.id(),T=this.now().toISOString(),R=j4(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[_,E.organizationId,E.name,E.publicKeyPem,R,T]),this.key(_)}key(E){let _=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return _?Aa(_):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let _=this.key(E.keyId);if(!_||_.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(_.revokedAt)throw Error("Update signing key is revoked.");if(!Y4(E.document,E.signature,_.publicKeyPem))throw Error("Update manifest signature is invalid.");let T=w4(E.document,E.current),R=H4(E.document),N=this.id(),L=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[N,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,R,JSON.stringify(E.document),E.signature,JSON.stringify(T),L]),this.manifest(N)}manifest(E){let _=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return _?Q4(_):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(Q4)}createWindow(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[_,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,T,T]),this.window(_)}window(E){let _=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return _?G4(_):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(G4)}createCampaign(E){return this.control.transaction(()=>{let _=this.manifest(E.manifestId);if(!_?.compatibility.compatible||_.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let T=this.id(),R=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[T,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,R,R]),E.targets.forEach((N,L)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,N.serverId??null,N.target,E.strategy==="canary"?L===0?0:1+Math.floor((L-1)/E.batchSize):Math.floor(L/E.batchSize),N.previousVersion,R,R])),this.campaign(T)})}campaign(E){let _=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return _?P4(_):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(P4)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(rH)}updateCampaign(E,_){let T=this.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let R={...T,..._};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[R.status,R.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!T)throw Error("Upgrade target was not found.");let R={...rH(T),..._};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[R.status,JSON.stringify(R.evidence),R.error??null,R.startedAt??null,R.finishedAt??null,this.now().toISOString(),E]),rH(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let _=[...E.candidates].sort((A,S)=>A.id.localeCompare(S.id)),T=Z2(_),R=this.id(),N=this.now().toISOString(),L=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[R,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(_),T,_.reduce((A,S)=>A+S.bytes,0),L,N,N]),this.cleanup(R)}cleanup(E){let _=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return _?M4(_):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(M4)}updateCleanup(E,_){let T=this.cleanup(E);if(!T)throw Error("Cleanup plan was not found.");let R={...T,..._};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[R.status,R.confirmation??null,JSON.stringify(R.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[_,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,T,T]),this.drill(_)}drill(E){let _=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return _?K4(_):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(K4)}updateDrill(E,_){let T=this.drill(E);if(!T)throw Error("DR drill was not found.");let R={...T,..._};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[R.status,R.operationId??null,JSON.stringify(R.evidence),R.measuredRpoMinutes??null,R.measuredRtoMinutes??null,R.cleanupVerified?1:0,R.error??null,R.startedAt??null,R.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}await g_();function Sa(E,_=new Date){if(!E.enabled)return!1;let T=new Date(E.schedule);if(!Number.isNaN(T.getTime()))return _>=T&&_.getTime()<=T.getTime()+E.durationMinutes*60000;let R=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!R)return!1;let N=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(_),L=Number(N.find((S)=>S.type==="hour")?.value)*60+Number(N.find((S)=>S.type==="minute")?.value),A=Number(R[1])*60+Number(R[2]);return L>=A&&L<A+E.durationMinutes}class zD{store;now;queue;constructor(E,_,T=()=>new Date){this.store=E;this.now=T;this.queue=_??new pE(E.control)}enqueueCampaign(E,_={}){let T=this.store.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let R=T.windowId?this.store.window(T.windowId):void 0;if(R&&!R.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(R&&!_.overrideWindow&&!Sa(R,this.now()))throw Error("Upgrade is outside its maintenance window.");if(R?.requireApproval&&!_.approvedBy&&!T.approvedBy)throw Error("Maintenance approval is required.");let N=this.queue.enqueue({projectId:T.projectId,actorId:_.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:N}}async previewCleanup(E,_){let T=_.find((R)=>R.kind===E.kind);if(!T)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await T.discover(E.criteria)})}enqueueCleanup(E,_){let T=this.store.cleanup(E);if(!T||T.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(T.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let R=`DELETE ${T.candidates.length} ${T.kind}`;if(_!==R)throw Error(`Exact confirmation ${R} is required.`);let N=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${T.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:_}),operation:N}}enqueueDrill(E){let _=this.store.drill(E);if(!_||_.status!=="planned")throw Error("A planned DR drill is required.");let T=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${_.scenario}:${_.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:T.id}),operation:T}}}var uH=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function V4(E){return{"maintenance.upgrade":async(N)=>{let L=E.store.campaign(String(uH(N.operation.input).campaignId??""));if(!L||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let A=E.store.manifest(L.manifestId);if(!A?.compatibility.compatible||A.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let S=A.document.artifacts.find((U)=>U.platform===process.platform&&U.architecture===process.arch)??A.document.artifacts[0];if(!S)throw Error("No update artifact matches this platform.");E.store.updateCampaign(L.id,{status:"running",currentStage:"preflight"});let O=[];try{for(let U of[...new Set(E.store.targets(L.id).map((h)=>h.cohort))].sort((h,$)=>h-$)){E.store.updateCampaign(L.id,{currentStage:`cohort:${U}`});for(let h of E.store.targets(L.id).filter(($)=>$.cohort===U)){N.throwIfCancellationRequested(),N.checkpoint(`download:${h.target}`,"Downloading signed platform artifact."),E.store.updateTarget(h.id,{status:"downloading",startedAt:new Date().toISOString()});let $=await E.platform.download({target:h,artifact:S,signal:N.signal});if($.sha256!==S.sha256)throw Error(`Artifact checksum mismatch for ${h.target}.`);N.checkpoint(`install:${h.target}`,"Installing verified artifact."),E.store.updateTarget(h.id,{status:"installing"}),await E.platform.install({target:h,path:$.path,version:A.version,signal:N.signal}),O.push(h);let D=await E.platform.health({target:h,gate:L.healthGate});if(!D.healthy)throw Error(`Upgrade health gate failed for ${h.target}.`);E.store.updateTarget(h.id,{status:"healthy",evidence:D.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(L.id,{status:"succeeded",currentStage:void 0}),{campaignId:L.id,version:A.version,targets:O.length}}catch(U){E.store.updateCampaign(L.id,{status:"rolling_back",currentStage:"rollback"});for(let h of O.reverse())E.store.updateTarget(h.id,{status:"rolling_back"}),await E.platform.rollback({target:h,version:h.previousVersion,signal:N.signal}),E.store.updateTarget(h.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(L.id,{status:"rolled_back",currentStage:void 0}),U}},"maintenance.cleanup":async(N)=>{let L=E.store.cleanup(String(uH(N.operation.input).planId??""));if(!L||L.status!=="approved")throw Error("Approved cleanup plan was not found.");if(Z2([...L.candidates].sort((h,$)=>h.id.localeCompare($.id)))!==L.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let A=E.cleanup?.find((h)=>h.kind===L.kind);if(!A)throw Error(`No ${L.kind} cleanup driver is configured.`);E.store.updateCleanup(L.id,{status:"running"});let S=[],O=[];for(let h of L.candidates){N.throwIfCancellationRequested();try{await A.remove(h),S.push(h.id)}catch($){O.push({id:h.id,error:$ instanceof Error?$.message:String($)})}}let U=O.length?S.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(L.id,{status:U,result:{removed:S,failed:O,reclaimedBytes:L.candidates.filter((h)=>S.includes(h.id)).reduce((h,$)=>h+$.bytes,0)}}),O.length)throw Error(`Cleanup failed for ${O.length} candidate(s).`);return{planId:L.id,removed:S.length,reclaimedBytes:L.estimatedBytes}},"maintenance.drill":async(N)=>{let L=E.store.drill(String(uH(N.operation.input).drillId??""));if(!L)throw Error("DR drill was not found.");let A=E.recovery?.find(($)=>$.scenario===L.scenario);if(!A)throw Error(`No ${L.scenario} recovery driver is configured.`);let S=new Date;E.store.updateDrill(L.id,{status:"restoring",startedAt:S.toISOString()});let O=L.isolatedTarget,U={},h={};try{N.checkpoint("restore","Restoring into isolated drill target.");let $=await A.restore({drill:L,signal:N.signal});if(!$.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");O=$.target,U=$.evidence;let D=(S.getTime()-new Date($.recoveryPointAt).getTime())/60000;E.store.updateDrill(L.id,{status:"verifying",measuredRpoMinutes:D,evidence:{restore:U}}),N.checkpoint("verify","Running recovery health checks without production traffic.");let C=await A.verify({drill:L,target:O});h=C.evidence;let J=(Date.now()-S.getTime())/60000;if(!C.healthy||D>L.expectedRpoMinutes||J>L.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(L.id,{measuredRpoMinutes:D,measuredRtoMinutes:J,evidence:{restore:U,verify:h}})}catch($){throw E.store.updateDrill(L.id,{status:"failed",error:$ instanceof Error?$.message:String($),evidence:{restore:U,verify:h}}),$}finally{E.store.updateDrill(L.id,{status:"cleaning"});try{await A.cleanup({drill:L,target:O});let $=E.store.drill(L.id);E.store.updateDrill(L.id,{status:$.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch($){E.store.updateDrill(L.id,{status:"cleanup_required",cleanupVerified:!1,error:$ instanceof Error?$.message:String($),finishedAt:new Date().toISOString()})}}return{drillId:L.id,status:E.store.drill(L.id).status}}}}var Z4={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class BD{kind;control;projectId;organizationId;constructor(E,_,T,R){this.kind=E;this.control=_;this.projectId=T;this.organizationId=R}async discover(E){let _=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),T=new Date(Date.now()-_*86400000).toISOString(),R=Z4[this.kind],N=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(R.select).all(N,T).map((A)=>({id:String(A.id),kind:this.kind,label:`${this.kind}:${String(A.id)}`,bytes:Number(A.bytes??0),metadata:{createdAt:String(A.created_at)}}))}async remove(E){if(this.control.database.run(Z4[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function Oa(){let E=await o(),_=mE(process.cwd(),E),T=new WD(_.store),R=new zD(T),N=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new BD(L,_.store,_.project.id,_.organization.id));return{controlPlane:_,store:T,service:R,cleanup:N}}async function RA(E){let _=await Oa();try{await E(_)}catch(T){d(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}function tH(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(_)=>RA((T)=>{let R={manifests:T.store.manifests(T.controlPlane.organization.id),windows:T.store.windows(T.controlPlane.project.id),campaigns:T.store.campaigns(T.controlPlane.project.id),cleanups:T.store.cleanups(T.controlPlane.project.id),drills:T.store.drills(T.controlPlane.project.id)},N=[...R.manifests.map((L)=>["update",L.version,L.compatibility.compatible?"compatible":"blocked",L.compatibility.reasons.join("; ")||L.channel]),...R.campaigns.map((L)=>["upgrade",L.id,L.status,L.currentStage??L.fromVersion]),...R.cleanups.map((L)=>["cleanup",L.kind,L.status,`${L.candidates.length} items / ${L.estimatedBytes} bytes`]),...R.drills.map((L)=>["DR drill",L.scenario,L.status,L.isolatedTarget])];if(_.json)console.log(JSON.stringify(R,null,2));else p(["Area","Name / version","Status","Detail"],N)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(_,T)=>RA(async(R)=>{let N=R.store.addTrustedKey({organizationId:R.controlPlane.organization.id,name:_,publicKeyPem:await Bun.file(T).text()});g(`Trusted ${N.name}: ${N.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(_,T,R)=>RA(async(N)=>{let L=await Bun.file(_).json(),A=(await Bun.file(T).text()).trim(),S=N.store.importManifest({organizationId:N.controlPlane.organization.id,keyId:R,document:L,signature:A,current:{schemaVersion:N.controlPlane.store.health().schemaVersion,currentVersion:ID,platform:process.platform,architecture:process.arch}});g(`Verified ${S.version}; ${S.compatibility.compatible?"compatible":"blocked: "+S.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(_,T,R)=>RA((N)=>{let L=N.store.createWindow({projectId:N.controlPlane.project.id,name:_,schedule:T,timezone:R.timezone,durationMinutes:Number(R.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});g(`Created ${L.name} (${L.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(_,T,R)=>RA((N)=>{let L=new XL(N.controlPlane.store).list(N.controlPlane.project.id).filter((O)=>O.status==="ready").map((O)=>({serverId:O.id,target:O.name,previousVersion:O.bootstrapVersion??ID}));if(!L.length)L.push({target:"control-plane",previousVersion:ID});let A=N.store.createCampaign({projectId:N.controlPlane.project.id,manifestId:_,fromVersion:ID,strategy:R.strategy==="rolling"?"rolling":"canary",batchSize:Number(R.batch),healthGate:{kind:"platform"},backupId:T,targets:L}),S=N.service.enqueueCampaign(A.id);g(`Staged upgrade queued: ${S.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(_,T)=>RA(async(R)=>{let N=await R.service.previewCleanup({projectId:R.controlPlane.project.id,kind:_,criteria:{olderThanDays:Number(T.olderThan)}},R.cleanup);p(["ID","Candidate","Bytes"],N.candidates.map((L)=>[L.id,L.label,String(L.bytes)])),X(`Apply with: cloud cleanup:apply ${N.id} --confirm "DELETE ${N.candidates.length} ${N.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(_,T)=>RA((R)=>{let N=R.service.enqueueCleanup(_,String(T.confirm??""));g(`Cleanup queued: ${N.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(_,T,R)=>RA((N)=>{let L=N.store.createDrill({projectId:N.controlPlane.project.id,scenario:_,isolatedTarget:T,expectedRpoMinutes:Number(R.rpo),expectedRtoMinutes:Number(R.rto),recoveryPointId:R.recoveryPoint,topologyId:R.topology});g(`Planned isolated drill ${L.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(_)=>RA((T)=>{let R=T.service.enqueueDrill(_);g(`DR drill queued: ${R.operation.id}`)}))}kE();DS();cR();async function lH(){try{return(await o()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function mH(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(_)=>{r("Lambda Functions");let T=_?.region||await lH(),R=new K_(T);try{let{Functions:N=[]}=await R.listFunctions({MaxItems:50});if(!N.length){X("No functions found");return}p(["Name","Runtime","Memory","Timeout","Last Modified"],N.map((L)=>[L.FunctionName??"-",L.Runtime??"-",L.MemorySize?`${L.MemorySize} MB`:"-",L.Timeout?`${L.Timeout}s`:"-",L.LastModified??"-"]))}catch(N){d(`Failed to list functions: ${N.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(_,T)=>{r(`Invoking ${_}`);let R=T?.region||await lH(),N=new K_(R),L=new l("Invoking function...");L.start();try{let A=await N.invoke({FunctionName:_,InvocationType:T?.async?"Event":"RequestResponse",Payload:T?.payload||"{}",LogType:T?.async?"None":"Tail"});if(A.FunctionError){if(L.fail(`Function returned an error (${A.FunctionError})`),A.Payload)X(A.Payload);process.exitCode=1;return}if(L.succeed(`Invoked (status ${A.StatusCode})`),A.Payload)X(`
 Response:`),X(A.Payload);if(A.LogResult)X(`
 Logs:`),X(Buffer.from(A.LogResult,"base64").toString("utf-8"))}catch(A){L.fail(`Invocation failed: ${A.message}`),process.exitCode=1}}),E.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(_,T)=>{r(`Logs for ${_}`);let R=T?.region||await lH(),N=new wR(R),L=_.startsWith("/aws/lambda/")?_:`/aws/lambda/${_}`,A=Number(T?.since??15),S=(O)=>{for(let U of O){let h=U.timestamp?new Date(U.timestamp).toISOString():"";X(`${h}  ${(U.message??"").trimEnd()}`)}};try{let O=Date.now()-A*60000,{events:U=[]}=await N.filterLogEvents({logGroupName:L,startTime:O,filterPattern:T?.filter,limit:200});if(S(U),U.length)O=(U[U.length-1].timestamp??O)+1;if(T?.tail){X(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise(($)=>setTimeout($,3000));let{events:h=[]}=await N.filterLogEvents({logGroupName:L,startTime:O,filterPattern:T?.filter,limit:200});if(h.length)S(h),O=(h[h.length-1].timestamp??O)+1}}}catch(O){d(`Failed to read logs: ${O.message}`),process.exitCode=1}})}kE();async function q4(E){let _=Bun.spawn(["docker",...E],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[T,R]=await Promise.all([_.exited,new Response(_.stderr).text()]);return{ok:T===0,exitCode:T,command:["docker",...E].join(" "),stderr:R.trim()}}function nH(E){E.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(_)=>{let T=["build","--file",_.file??"Dockerfile","--tag",_.tag??"latest","."];if(_.dryRun){console.log(`docker ${T.join(" ")}`);return}let R=await q4(T);if(_.json)console.log(JSON.stringify(R));if(!R.ok)d(R.stderr||`docker exited ${R.exitCode}`),process.exitCode=R.exitCode;else g(`Built ${_.tag??"latest"}.`)}),E.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(_)=>{if(!_.image){d("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(_.dryRun){console.log(`docker push ${_.image}`);return}let T=await q4(["push",_.image]);if(_.json)console.log(JSON.stringify(T));if(!T.ok)d(T.stderr),process.exitCode=T.exitCode;else g(`Pushed ${_.image}.`)}),E.command("container:deploy","Deploy a container image").action(async()=>ON("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}kE();eL();UL();function eH(E){E.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(_)=>{r("Domains");try{let T=hL(_?.provider),R=bR(_?.provider)?.provider||"unknown",N=new l(`Fetching domains from ${R}...`);N.start();let L=await T.listDomains();if(N.succeed(`Found ${L.length} domain(s)`),L.length===0){X("No domains found in this provider");return}let A=L.map((S)=>[S,"Active","-",R.charAt(0).toUpperCase()+R.slice(1)]);p(["Domain","Status","SSL","Provider"],A)}catch(T){d(`Failed to list domains: ${T instanceof Error?T.message:String(T)}`)}}),E.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(_,T)=>{r(`Adding Domain: ${_}`);try{let R=hL(T?.provider),N=bR(T?.provider)?.provider||"unknown",L=new l(`Checking if ${N} can manage ${_}...`);if(L.start(),await R.canManageDomain(_))L.succeed(`Domain ${_} is already available in ${N}`),X(`