@stacksjs/ts-cloud 0.7.57 → 0.7.58

package/dist/bin/cli.js

@@ -8,7 +8,7 @@ import{createRequire as HG}from"node:module";var zG=Object.defineProperty;var BG
 ${sE.bright}${sE.cyan}${E}${sE.reset}
 `)}class v{frames=["⠋","⠙","⠹","⠸","⠼","⠴","⠦","⠧","⠇","⠏"];interval=null;currentFrame=0;message;constructor(E){this.message=E}get text(){return this.message}set text(E){if(this.message=E,jU&&this.interval)console.log(`  ${E}`)}start(){if(jU){console.log(`  ${this.message}`),this.interval=!0;return}this.interval=setInterval(()=>{process.stdout.write(`\r${sE.cyan}${this.frames[this.currentFrame]}${sE.reset} ${this.message}`),this.currentFrame=(this.currentFrame+1)%this.frames.length},80)}succeed(E){this.stop(),K(E||this.message)}fail(E){this.stop(),Y(E||this.message)}warn(E){this.stop(),oe(E||this.message)}stop(){if(this.interval){if(!jU)process.stdout.write("\r");if(typeof this.interval==="object")clearInterval(this.interval);this.interval=null}}}class Yy{total;current=0;width=40;constructor(E){this.total=E}update(E){this.current=E,this.render()}increment(){this.current++,this.render()}render(){let E=Math.floor(this.current/this.total*100),r=Math.floor(this.current/this.total*this.width),t=this.width-r,T=`${"█".repeat(r)}${"░".repeat(t)}`;if(process.stdout.write(`\r${sE.cyan}${T}${sE.reset} ${E}% (${this.current}/${this.total})`),this.current>=this.total)process.stdout.write(`
 `)}}async function Ar(E,r){let T=(await import("node:readline")).createInterface({input:process.stdin,output:process.stdout});return new Promise((_)=>{let d=r?`${sE.cyan}?${sE.reset} ${E} ${sE.gray}(${r})${sE.reset}: `:`${sE.cyan}?${sE.reset} ${E}: `;T.question(d,(e)=>{T.close(),_(e||r||"")})})}async function OE(E,r=!1){let t=await Ar(`${E} (y/n)`,r?"y":"n");return t.toLowerCase()==="y"||t.toLowerCase()==="yes"}async function L0(E,r){console.log(`${sE.cyan}?${sE.reset} ${E}`),r.forEach((_,d)=>{console.log(`  ${sE.gray}${d+1}.${sE.reset} ${_}`)});let t=await Ar("Select","1"),T=Number.parseInt(t)-1;if(T>=0&&T<r.length)return r[T];return r[0]}function TE(E,r){let t=E.map((_,d)=>{let e=Math.max(...r.map((h)=>(h[d]||"").length));return Math.max(_.length,e)}),T=E.map((_,d)=>_.padEnd(t[d])).join("  ");console.log(te(T,"bright")),console.log(te("─".repeat(T.length),"gray")),r.forEach((_)=>{let d=_.map((e,h)=>(e||"").padEnd(t[h])).join("  ");console.log(d)})}function IR(E){if(E===0)return"0 B";let r=1024,t=["B","KB","MB","GB","TB"],T=Math.floor(Math.log(E)/Math.log(r));return`${Number.parseFloat((E/r**T).toFixed(2))} ${t[T]}`}function k9(E){if(E<1000)return`${E}ms`;let r=Math.floor(E/1000);if(r<60)return`${r}s`;let t=Math.floor(r/60),T=r%60;if(t<60)return`${t}m ${T}s`;let _=Math.floor(t/60),d=t%60;return`${_}h ${d}m`}function VT(E,r="cyan"){let t=E.split(`
-`),T=Math.max(...t.map((d)=>d.length)),_="─".repeat(T+2);console.log(te(`┌${_}┐`,r)),t.forEach((d)=>{console.log(te(`│ ${d.padEnd(T)} │`,r))}),console.log(te(`└${_}┘`,r))}async function FU(){return!0}async function zU(){try{let{AWSClient:E}=await Promise.resolve().then(() => (GE(),re));return await new E().request({service:"sts",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"GetCallerIdentity",Version:"2011-06-15"}).toString()}),!0}catch{return!1}}async function BU(){try{let{AWSClient:E}=await Promise.resolve().then(() => (GE(),re)),t=await new E().request({service:"sts",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"GetCallerIdentity",Version:"2011-06-15"}).toString()});return t.Account||t.GetCallerIdentityResult?.Account||null}catch{return null}}async function WU(){try{let{AWSClient:E}=await Promise.resolve().then(() => (GE(),re)),t=await new E().request({service:"ec2",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"DescribeRegions",Version:"2016-11-15"}).toString()}),T=[];if(t.regionInfo){let _=Array.isArray(t.regionInfo)?t.regionInfo:[t.regionInfo];T.push(..._.map((d)=>d.regionName))}return T.length>0?T:fy()}catch{return fy()}}function fy(){return["us-east-1","us-east-2","us-west-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1","ap-northeast-1"]}var sE,oe,jU;var QE=$E(()=>{sE={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};oe=_E;jU=!!(process.env.CI||process.env.GITHUB_ACTIONS||process.env.BUILDKITE||process.env.CIRCLECI||process.env.GITLAB_CI)});function rM(E,r){let t=[`Action=${E}`,"Version=2010-05-08"];for(let[T,_]of Object.entries(r)){if(_===void 0||_===null)continue;if(Array.isArray(_))_.forEach((d,e)=>{if(typeof d==="object"&&d!==null)for(let[h,R]of Object.entries(d))t.push(`${T}.member.${e+1}.${h}=${encodeURIComponent(String(R))}`);else t.push(`${T}.member.${e+1}=${encodeURIComponent(String(d))}`)});else if(typeof _==="object"){for(let[d,e]of Object.entries(_))if(e!==void 0&&e!==null)t.push(`${T}.${d}=${encodeURIComponent(String(e))}`)}else t.push(`${T}=${encodeURIComponent(String(_))}`)}return t.join("&")}function m(E,r){let t=new RegExp(`<${r}>([^<]*)</${r}>`),T=E.match(t);return T?T[1]:void 0}function jt(E,r,t){let T=new RegExp(`<${r}>([\\s\\S]*?)</${r}>`),_=E.match(T);if(!_)return[];let d=[],e=new RegExp(`<${t}>([\\s\\S]*?)</${t}>`,"g"),h;while((h=e.exec(_[1]))!==null)d.push(h[1]);return d}class Lt{client;region;constructor(E="us-east-1",r){this.client=new wE(void 0,{profile:r}),this.region=E}async request(E,r={}){let t=rM(E,r);return await this.client.request({service:"iam",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t})}async createUser(E){let r=await this.request("CreateUser",E);return this.parseUser(r)}async getUser(E={}){let r=await this.request("GetUser",E);return this.parseUser(r)}async listUsers(E={}){let r=await this.request("ListUsers",E),t=this.parseUsers(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Users:t,IsTruncated:T,Marker:_}}async updateUser(E){await this.request("UpdateUser",E)}async deleteUser(E){await this.request("DeleteUser",E)}parseUser(E){return{UserName:m(E,"UserName")||"",UserId:m(E,"UserId")||"",Arn:m(E,"Arn")||"",Path:m(E,"Path"),CreateDate:m(E,"CreateDate"),PasswordLastUsed:m(E,"PasswordLastUsed")}}parseUsers(E){return jt(E,"Users","member").map((t)=>({UserName:m(t,"UserName")||"",UserId:m(t,"UserId")||"",Arn:m(t,"Arn")||"",Path:m(t,"Path"),CreateDate:m(t,"CreateDate"),PasswordLastUsed:m(t,"PasswordLastUsed")}))}async createGroup(E){let r=await this.request("CreateGroup",E);return this.parseGroup(r)}async getGroup(E){let r=await this.request("GetGroup",E),t=this.parseGroup(r),T=this.parseUsers(r),_=m(r,"IsTruncated")==="true",d=m(r,"Marker");return{Group:t,Users:T,IsTruncated:_,Marker:d}}async listGroups(E={}){let r=await this.request("ListGroups",E),t=this.parseGroups(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Groups:t,IsTruncated:T,Marker:_}}async updateGroup(E){await this.request("UpdateGroup",E)}async deleteGroup(E){await this.request("DeleteGroup",E)}async addUserToGroup(E){await this.request("AddUserToGroup",E)}async removeUserFromGroup(E){await this.request("RemoveUserFromGroup",E)}async listGroupsForUser(E){let r=await this.request("ListGroupsForUser",E),t=this.parseGroups(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Groups:t,IsTruncated:T,Marker:_}}parseGroup(E){return{GroupName:m(E,"GroupName")||"",GroupId:m(E,"GroupId")||"",Arn:m(E,"Arn")||"",Path:m(E,"Path"),CreateDate:m(E,"CreateDate")}}parseGroups(E){return jt(E,"Groups","member").map((t)=>({GroupName:m(t,"GroupName")||"",GroupId:m(t,"GroupId")||"",Arn:m(t,"Arn")||"",Path:m(t,"Path"),CreateDate:m(t,"CreateDate")}))}async createRole(E){let r=await this.request("CreateRole",E);return this.parseRole(r)}async getRole(E){let r=await this.request("GetRole",E);return this.parseRole(r)}async listRoles(E={}){let r=await this.request("ListRoles",E),t=this.parseRoles(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Roles:t,IsTruncated:T,Marker:_}}async updateRole(E){await this.request("UpdateRole",E)}async updateRoleDescription(E){let r=await this.request("UpdateRoleDescription",E);return this.parseRole(r)}async updateAssumeRolePolicy(E){await this.request("UpdateAssumeRolePolicy",E)}async deleteRole(E){await this.request("DeleteRole",E)}async tagRole(E){await this.request("TagRole",E)}async untagRole(E){await this.request("UntagRole",E)}async listRoleTags(E){let r=await this.request("ListRoleTags",E),t=this.parseTags(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Tags:t,IsTruncated:T,Marker:_}}parseRole(E){return{RoleName:m(E,"RoleName")||"",RoleId:m(E,"RoleId")||"",Arn:m(E,"Arn")||"",Path:m(E,"Path"),CreateDate:m(E,"CreateDate"),AssumeRolePolicyDocument:m(E,"AssumeRolePolicyDocument"),Description:m(E,"Description"),MaxSessionDuration:m(E,"MaxSessionDuration")?Number.parseInt(m(E,"MaxSessionDuration"),10):void 0}}parseRoles(E){return jt(E,"Roles","member").map((t)=>({RoleName:m(t,"RoleName")||"",RoleId:m(t,"RoleId")||"",Arn:m(t,"Arn")||"",Path:m(t,"Path"),CreateDate:m(t,"CreateDate"),AssumeRolePolicyDocument:m(t,"AssumeRolePolicyDocument"),Description:m(t,"Description"),MaxSessionDuration:m(t,"MaxSessionDuration")?Number.parseInt(m(t,"MaxSessionDuration"),10):void 0}))}parseTags(E){return jt(E,"Tags","member").map((t)=>({Key:m(t,"Key")||"",Value:m(t,"Value")||""}))}async createPolicy(E){let r=await this.request("CreatePolicy",E);return this.parsePolicy(r)}async getPolicy(E){let r=await this.request("GetPolicy",E);return this.parsePolicy(r)}async getPolicyVersion(E){let r=await this.request("GetPolicyVersion",E);return{VersionId:m(r,"VersionId")||"",IsDefaultVersion:m(r,"IsDefaultVersion")==="true",CreateDate:m(r,"CreateDate"),Document:m(r,"Document")}}async listPolicies(E={}){let r=await this.request("ListPolicies",E),t=this.parsePolicies(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Policies:t,IsTruncated:T,Marker:_}}async listPolicyVersions(E){let r=await this.request("ListPolicyVersions",E),t=this.parsePolicyVersions(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Versions:t,IsTruncated:T,Marker:_}}async createPolicyVersion(E){let r=await this.request("CreatePolicyVersion",E);return{VersionId:m(r,"VersionId")||"",IsDefaultVersion:m(r,"IsDefaultVersion")==="true",CreateDate:m(r,"CreateDate")}}async deletePolicyVersion(E){await this.request("DeletePolicyVersion",E)}async setDefaultPolicyVersion(E){await this.request("SetDefaultPolicyVersion",E)}async deletePolicy(E){await this.request("DeletePolicy",E)}async attachUserPolicy(E){await this.request("AttachUserPolicy",E)}async detachUserPolicy(E){await this.request("DetachUserPolicy",E)}async attachGroupPolicy(E){await this.request("AttachGroupPolicy",E)}async detachGroupPolicy(E){await this.request("DetachGroupPolicy",E)}async attachRolePolicy(E){await this.request("AttachRolePolicy",E)}async detachRolePolicy(E){await this.request("DetachRolePolicy",E)}async listAttachedUserPolicies(E){let r=await this.request("ListAttachedUserPolicies",E),t=this.parseAttachedPolicies(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{AttachedPolicies:t,IsTruncated:T,Marker:_}}async listAttachedGroupPolicies(E){let r=await this.request("ListAttachedGroupPolicies",E),t=this.parseAttachedPolicies(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{AttachedPolicies:t,IsTruncated:T,Marker:_}}async listAttachedRolePolicies(E){let r=await this.request("ListAttachedRolePolicies",E),t=this.parseAttachedPolicies(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{AttachedPolicies:t,IsTruncated:T,Marker:_}}parsePolicy(E){return{PolicyName:m(E,"PolicyName")||"",PolicyId:m(E,"PolicyId")||"",Arn:m(E,"Arn")||"",Path:m(E,"Path"),DefaultVersionId:m(E,"DefaultVersionId"),AttachmentCount:m(E,"AttachmentCount")?Number.parseInt(m(E,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:m(E,"PermissionsBoundaryUsageCount")?Number.parseInt(m(E,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:m(E,"IsAttachable")==="true",Description:m(E,"Description"),CreateDate:m(E,"CreateDate"),UpdateDate:m(E,"UpdateDate")}}parsePolicies(E){return jt(E,"Policies","member").map((t)=>({PolicyName:m(t,"PolicyName")||"",PolicyId:m(t,"PolicyId")||"",Arn:m(t,"Arn")||"",Path:m(t,"Path"),DefaultVersionId:m(t,"DefaultVersionId"),AttachmentCount:m(t,"AttachmentCount")?Number.parseInt(m(t,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:m(t,"PermissionsBoundaryUsageCount")?Number.parseInt(m(t,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:m(t,"IsAttachable")==="true",Description:m(t,"Description"),CreateDate:m(t,"CreateDate"),UpdateDate:m(t,"UpdateDate")}))}parsePolicyVersions(E){return jt(E,"Versions","member").map((t)=>({VersionId:m(t,"VersionId")||"",IsDefaultVersion:m(t,"IsDefaultVersion")==="true",CreateDate:m(t,"CreateDate")}))}parseAttachedPolicies(E){return jt(E,"AttachedPolicies","member").map((t)=>({PolicyName:m(t,"PolicyName")||"",PolicyArn:m(t,"PolicyArn")||""}))}async putUserPolicy(E){await this.request("PutUserPolicy",E)}async getUserPolicy(E){let r=await this.request("GetUserPolicy",E);return{UserName:m(r,"UserName")||"",PolicyName:m(r,"PolicyName")||"",PolicyDocument:decodeURIComponent(m(r,"PolicyDocument")||"")}}async deleteUserPolicy(E){await this.request("DeleteUserPolicy",E)}async listUserPolicies(E){let r=await this.request("ListUserPolicies",E),t=jt(r,"PolicyNames","member"),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{PolicyNames:t,IsTruncated:T,Marker:_}}async putGroupPolicy(E){await this.request("PutGroupPolicy",E)}async getGroupPolicy(E){let r=await this.request("GetGroupPolicy",E);return{GroupName:m(r,"GroupName")||"",PolicyName:m(r,"PolicyName")||"",PolicyDocument:decodeURIComponent(m(r,"PolicyDocument")||"")}}async deleteGroupPolicy(E){await this.request("DeleteGroupPolicy",E)}async listGroupPolicies(E){let r=await this.request("ListGroupPolicies",E),t=jt(r,"PolicyNames","member"),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{PolicyNames:t,IsTruncated:T,Marker:_}}async putRolePolicy(E){await this.request("PutRolePolicy",E)}async getRolePolicy(E){let r=await this.request("GetRolePolicy",E);return{RoleName:m(r,"RoleName")||"",PolicyName:m(r,"PolicyName")||"",PolicyDocument:decodeURIComponent(m(r,"PolicyDocument")||"")}}async deleteRolePolicy(E){await this.request("DeleteRolePolicy",E)}async listRolePolicies(E){let r=await this.request("ListRolePolicies",E),t=jt(r,"PolicyNames","member"),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{PolicyNames:t,IsTruncated:T,Marker:_}}async createAccessKey(E={}){let r=await this.request("CreateAccessKey",E);if(typeof r==="object"){let t=r?.CreateAccessKeyResult?.AccessKey||r?.AccessKey;if(t)return{AccessKey:{UserName:t.UserName||"",AccessKeyId:t.AccessKeyId||"",Status:t.Status||"Active",SecretAccessKey:t.SecretAccessKey||"",CreateDate:t.CreateDate}}}return{AccessKey:{UserName:m(r,"UserName")||"",AccessKeyId:m(r,"AccessKeyId")||"",Status:m(r,"Status")||"Active",SecretAccessKey:m(r,"SecretAccessKey")||"",CreateDate:m(r,"CreateDate")}}}async listAccessKeys(E={}){let r=await this.request("ListAccessKeys",E),t=this.parseAccessKeys(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{AccessKeyMetadata:t,IsTruncated:T,Marker:_}}async updateAccessKey(E){await this.request("UpdateAccessKey",E)}async deleteAccessKey(E){await this.request("DeleteAccessKey",E)}async getAccessKeyLastUsed(E){let r=await this.request("GetAccessKeyLastUsed",E);return{UserName:m(r,"UserName")||"",AccessKeyLastUsed:{LastUsedDate:m(r,"LastUsedDate"),ServiceName:m(r,"ServiceName"),Region:m(r,"Region")}}}parseAccessKeys(E){return jt(E,"AccessKeyMetadata","member").map((t)=>({UserName:m(t,"UserName"),AccessKeyId:m(t,"AccessKeyId")||"",Status:m(t,"Status")||"Active",CreateDate:m(t,"CreateDate")}))}async createInstanceProfile(E){let r=await this.request("CreateInstanceProfile",E);return this.parseInstanceProfile(r)}async getInstanceProfile(E){let r=await this.request("GetInstanceProfile",E);return this.parseInstanceProfile(r)}async listInstanceProfiles(E={}){let r=await this.request("ListInstanceProfiles",E),t=this.parseInstanceProfiles(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{InstanceProfiles:t,IsTruncated:T,Marker:_}}async listInstanceProfilesForRole(E){let r=await this.request("ListInstanceProfilesForRole",E),t=this.parseInstanceProfiles(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{InstanceProfiles:t,IsTruncated:T,Marker:_}}async addRoleToInstanceProfile(E){await this.request("AddRoleToInstanceProfile",E)}async removeRoleFromInstanceProfile(E){await this.request("RemoveRoleFromInstanceProfile",E)}async deleteInstanceProfile(E){await this.request("DeleteInstanceProfile",E)}parseInstanceProfile(E){return{InstanceProfileName:m(E,"InstanceProfileName")||"",InstanceProfileId:m(E,"InstanceProfileId")||"",Arn:m(E,"Arn")||"",Path:m(E,"Path"),CreateDate:m(E,"CreateDate")}}parseInstanceProfiles(E){return jt(E,"InstanceProfiles","member").map((t)=>({InstanceProfileName:m(t,"InstanceProfileName")||"",InstanceProfileId:m(t,"InstanceProfileId")||"",Arn:m(t,"Arn")||"",Path:m(t,"Path"),CreateDate:m(t,"CreateDate")}))}async getAccountPasswordPolicy(){let E=await this.request("GetAccountPasswordPolicy");return{MinimumPasswordLength:m(E,"MinimumPasswordLength")?Number.parseInt(m(E,"MinimumPasswordLength"),10):void 0,RequireSymbols:m(E,"RequireSymbols")==="true",RequireNumbers:m(E,"RequireNumbers")==="true",RequireUppercaseCharacters:m(E,"RequireUppercaseCharacters")==="true",RequireLowercaseCharacters:m(E,"RequireLowercaseCharacters")==="true",AllowUsersToChangePassword:m(E,"AllowUsersToChangePassword")==="true",ExpirePasswords:m(E,"ExpirePasswords")==="true",MaxPasswordAge:m(E,"MaxPasswordAge")?Number.parseInt(m(E,"MaxPasswordAge"),10):void 0,PasswordReusePrevention:m(E,"PasswordReusePrevention")?Number.parseInt(m(E,"PasswordReusePrevention"),10):void 0,HardExpiry:m(E,"HardExpiry")==="true"}}async updateAccountPasswordPolicy(E){await this.request("UpdateAccountPasswordPolicy",E)}async deleteAccountPasswordPolicy(){await this.request("DeleteAccountPasswordPolicy")}async getAccountSummary(){let E=await this.request("GetAccountSummary"),r={},t=jt(E,"SummaryMap","entry");for(let T of t){let _=m(T,"key"),d=m(T,"value");if(_&&d)r[_]=Number.parseInt(d,10)}return r}async listAccountAliases(){let E=await this.request("ListAccountAliases"),r=jt(E,"AccountAliases","member"),t=m(E,"IsTruncated")==="true",T=m(E,"Marker");return{AccountAliases:r,IsTruncated:t,Marker:T}}async createAccountAlias(E){await this.request("CreateAccountAlias",E)}async deleteAccountAlias(E){await this.request("DeleteAccountAlias",E)}async simulatePrincipalPolicy(E){let r=await this.request("SimulatePrincipalPolicy",E);return this.parseSimulationResults(r)}parseSimulationResults(E){let t=jt(E,"EvaluationResults","member").map((d)=>{let h=jt(d,"MatchedStatements","member").map((R)=>({SourcePolicyId:m(R,"SourcePolicyId"),SourcePolicyType:m(R,"SourcePolicyType")}));return{EvalActionName:m(d,"EvalActionName")||"",EvalResourceName:m(d,"EvalResourceName"),EvalDecision:m(d,"EvalDecision")||"",MatchedStatements:h.length>0?h:void 0}}),T=m(E,"IsTruncated")==="true",_=m(E,"Marker");return{EvaluationResults:t,IsTruncated:T,Marker:_}}}var UR=$E(()=>{GE()});var Ot;var Eh=$E(()=>{GE();Ot=class Ot{client;region;constructor(E="us-east-1"){this.region=E,this.client=new wE}async createHostedZone(E){let r=E.CallerReference||`${Date.now()}-${Math.random().toString(36).slice(2)}`,t=`<?xml version="1.0" encoding="UTF-8"?>
+`),T=Math.max(...t.map((d)=>d.length)),_="─".repeat(T+2);console.log(te(`┌${_}┐`,r)),t.forEach((d)=>{console.log(te(`│ ${d.padEnd(T)} │`,r))}),console.log(te(`└${_}┘`,r))}async function FU(){return!0}async function zU(){try{let{AWSClient:E}=await Promise.resolve().then(() => (GE(),re));return await new E().request({service:"sts",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"GetCallerIdentity",Version:"2011-06-15"}).toString()}),!0}catch{return!1}}async function BU(){try{let{AWSClient:E}=await Promise.resolve().then(() => (GE(),re)),t=await new E().request({service:"sts",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"GetCallerIdentity",Version:"2011-06-15"}).toString()});return t.Account||t.GetCallerIdentityResult?.Account||null}catch{return null}}async function WU(){try{let{AWSClient:E}=await Promise.resolve().then(() => (GE(),re)),t=await new E().request({service:"ec2",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"DescribeRegions",Version:"2016-11-15"}).toString()}),T=[];if(t.regionInfo){let _=Array.isArray(t.regionInfo)?t.regionInfo:[t.regionInfo];T.push(..._.map((d)=>d.regionName))}return T.length>0?T:fy()}catch{return fy()}}function fy(){return["us-east-1","us-east-2","us-west-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1","ap-northeast-1"]}var sE,oe,jU;var QE=$E(()=>{sE={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};oe=_E;jU=!!(process.env.CI||process.env.GITHUB_ACTIONS||process.env.BUILDKITE||process.env.CIRCLECI||process.env.GITLAB_CI)});function r8(E,r){let t=[`Action=${E}`,"Version=2010-05-08"];for(let[T,_]of Object.entries(r)){if(_===void 0||_===null)continue;if(Array.isArray(_))_.forEach((d,e)=>{if(typeof d==="object"&&d!==null)for(let[h,R]of Object.entries(d))t.push(`${T}.member.${e+1}.${h}=${encodeURIComponent(String(R))}`);else t.push(`${T}.member.${e+1}=${encodeURIComponent(String(d))}`)});else if(typeof _==="object"){for(let[d,e]of Object.entries(_))if(e!==void 0&&e!==null)t.push(`${T}.${d}=${encodeURIComponent(String(e))}`)}else t.push(`${T}=${encodeURIComponent(String(_))}`)}return t.join("&")}function m(E,r){let t=new RegExp(`<${r}>([^<]*)</${r}>`),T=E.match(t);return T?T[1]:void 0}function jt(E,r,t){let T=new RegExp(`<${r}>([\\s\\S]*?)</${r}>`),_=E.match(T);if(!_)return[];let d=[],e=new RegExp(`<${t}>([\\s\\S]*?)</${t}>`,"g"),h;while((h=e.exec(_[1]))!==null)d.push(h[1]);return d}class Lt{client;region;constructor(E="us-east-1",r){this.client=new wE(void 0,{profile:r}),this.region=E}async request(E,r={}){let t=r8(E,r);return await this.client.request({service:"iam",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t})}async createUser(E){let r=await this.request("CreateUser",E);return this.parseUser(r)}async getUser(E={}){let r=await this.request("GetUser",E);return this.parseUser(r)}async listUsers(E={}){let r=await this.request("ListUsers",E),t=this.parseUsers(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Users:t,IsTruncated:T,Marker:_}}async updateUser(E){await this.request("UpdateUser",E)}async deleteUser(E){await this.request("DeleteUser",E)}parseUser(E){return{UserName:m(E,"UserName")||"",UserId:m(E,"UserId")||"",Arn:m(E,"Arn")||"",Path:m(E,"Path"),CreateDate:m(E,"CreateDate"),PasswordLastUsed:m(E,"PasswordLastUsed")}}parseUsers(E){return jt(E,"Users","member").map((t)=>({UserName:m(t,"UserName")||"",UserId:m(t,"UserId")||"",Arn:m(t,"Arn")||"",Path:m(t,"Path"),CreateDate:m(t,"CreateDate"),PasswordLastUsed:m(t,"PasswordLastUsed")}))}async createGroup(E){let r=await this.request("CreateGroup",E);return this.parseGroup(r)}async getGroup(E){let r=await this.request("GetGroup",E),t=this.parseGroup(r),T=this.parseUsers(r),_=m(r,"IsTruncated")==="true",d=m(r,"Marker");return{Group:t,Users:T,IsTruncated:_,Marker:d}}async listGroups(E={}){let r=await this.request("ListGroups",E),t=this.parseGroups(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Groups:t,IsTruncated:T,Marker:_}}async updateGroup(E){await this.request("UpdateGroup",E)}async deleteGroup(E){await this.request("DeleteGroup",E)}async addUserToGroup(E){await this.request("AddUserToGroup",E)}async removeUserFromGroup(E){await this.request("RemoveUserFromGroup",E)}async listGroupsForUser(E){let r=await this.request("ListGroupsForUser",E),t=this.parseGroups(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Groups:t,IsTruncated:T,Marker:_}}parseGroup(E){return{GroupName:m(E,"GroupName")||"",GroupId:m(E,"GroupId")||"",Arn:m(E,"Arn")||"",Path:m(E,"Path"),CreateDate:m(E,"CreateDate")}}parseGroups(E){return jt(E,"Groups","member").map((t)=>({GroupName:m(t,"GroupName")||"",GroupId:m(t,"GroupId")||"",Arn:m(t,"Arn")||"",Path:m(t,"Path"),CreateDate:m(t,"CreateDate")}))}async createRole(E){let r=await this.request("CreateRole",E);return this.parseRole(r)}async getRole(E){let r=await this.request("GetRole",E);return this.parseRole(r)}async listRoles(E={}){let r=await this.request("ListRoles",E),t=this.parseRoles(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Roles:t,IsTruncated:T,Marker:_}}async updateRole(E){await this.request("UpdateRole",E)}async updateRoleDescription(E){let r=await this.request("UpdateRoleDescription",E);return this.parseRole(r)}async updateAssumeRolePolicy(E){await this.request("UpdateAssumeRolePolicy",E)}async deleteRole(E){await this.request("DeleteRole",E)}async tagRole(E){await this.request("TagRole",E)}async untagRole(E){await this.request("UntagRole",E)}async listRoleTags(E){let r=await this.request("ListRoleTags",E),t=this.parseTags(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Tags:t,IsTruncated:T,Marker:_}}parseRole(E){return{RoleName:m(E,"RoleName")||"",RoleId:m(E,"RoleId")||"",Arn:m(E,"Arn")||"",Path:m(E,"Path"),CreateDate:m(E,"CreateDate"),AssumeRolePolicyDocument:m(E,"AssumeRolePolicyDocument"),Description:m(E,"Description"),MaxSessionDuration:m(E,"MaxSessionDuration")?Number.parseInt(m(E,"MaxSessionDuration"),10):void 0}}parseRoles(E){return jt(E,"Roles","member").map((t)=>({RoleName:m(t,"RoleName")||"",RoleId:m(t,"RoleId")||"",Arn:m(t,"Arn")||"",Path:m(t,"Path"),CreateDate:m(t,"CreateDate"),AssumeRolePolicyDocument:m(t,"AssumeRolePolicyDocument"),Description:m(t,"Description"),MaxSessionDuration:m(t,"MaxSessionDuration")?Number.parseInt(m(t,"MaxSessionDuration"),10):void 0}))}parseTags(E){return jt(E,"Tags","member").map((t)=>({Key:m(t,"Key")||"",Value:m(t,"Value")||""}))}async createPolicy(E){let r=await this.request("CreatePolicy",E);return this.parsePolicy(r)}async getPolicy(E){let r=await this.request("GetPolicy",E);return this.parsePolicy(r)}async getPolicyVersion(E){let r=await this.request("GetPolicyVersion",E);return{VersionId:m(r,"VersionId")||"",IsDefaultVersion:m(r,"IsDefaultVersion")==="true",CreateDate:m(r,"CreateDate"),Document:m(r,"Document")}}async listPolicies(E={}){let r=await this.request("ListPolicies",E),t=this.parsePolicies(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Policies:t,IsTruncated:T,Marker:_}}async listPolicyVersions(E){let r=await this.request("ListPolicyVersions",E),t=this.parsePolicyVersions(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{Versions:t,IsTruncated:T,Marker:_}}async createPolicyVersion(E){let r=await this.request("CreatePolicyVersion",E);return{VersionId:m(r,"VersionId")||"",IsDefaultVersion:m(r,"IsDefaultVersion")==="true",CreateDate:m(r,"CreateDate")}}async deletePolicyVersion(E){await this.request("DeletePolicyVersion",E)}async setDefaultPolicyVersion(E){await this.request("SetDefaultPolicyVersion",E)}async deletePolicy(E){await this.request("DeletePolicy",E)}async attachUserPolicy(E){await this.request("AttachUserPolicy",E)}async detachUserPolicy(E){await this.request("DetachUserPolicy",E)}async attachGroupPolicy(E){await this.request("AttachGroupPolicy",E)}async detachGroupPolicy(E){await this.request("DetachGroupPolicy",E)}async attachRolePolicy(E){await this.request("AttachRolePolicy",E)}async detachRolePolicy(E){await this.request("DetachRolePolicy",E)}async listAttachedUserPolicies(E){let r=await this.request("ListAttachedUserPolicies",E),t=this.parseAttachedPolicies(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{AttachedPolicies:t,IsTruncated:T,Marker:_}}async listAttachedGroupPolicies(E){let r=await this.request("ListAttachedGroupPolicies",E),t=this.parseAttachedPolicies(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{AttachedPolicies:t,IsTruncated:T,Marker:_}}async listAttachedRolePolicies(E){let r=await this.request("ListAttachedRolePolicies",E),t=this.parseAttachedPolicies(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{AttachedPolicies:t,IsTruncated:T,Marker:_}}parsePolicy(E){return{PolicyName:m(E,"PolicyName")||"",PolicyId:m(E,"PolicyId")||"",Arn:m(E,"Arn")||"",Path:m(E,"Path"),DefaultVersionId:m(E,"DefaultVersionId"),AttachmentCount:m(E,"AttachmentCount")?Number.parseInt(m(E,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:m(E,"PermissionsBoundaryUsageCount")?Number.parseInt(m(E,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:m(E,"IsAttachable")==="true",Description:m(E,"Description"),CreateDate:m(E,"CreateDate"),UpdateDate:m(E,"UpdateDate")}}parsePolicies(E){return jt(E,"Policies","member").map((t)=>({PolicyName:m(t,"PolicyName")||"",PolicyId:m(t,"PolicyId")||"",Arn:m(t,"Arn")||"",Path:m(t,"Path"),DefaultVersionId:m(t,"DefaultVersionId"),AttachmentCount:m(t,"AttachmentCount")?Number.parseInt(m(t,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:m(t,"PermissionsBoundaryUsageCount")?Number.parseInt(m(t,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:m(t,"IsAttachable")==="true",Description:m(t,"Description"),CreateDate:m(t,"CreateDate"),UpdateDate:m(t,"UpdateDate")}))}parsePolicyVersions(E){return jt(E,"Versions","member").map((t)=>({VersionId:m(t,"VersionId")||"",IsDefaultVersion:m(t,"IsDefaultVersion")==="true",CreateDate:m(t,"CreateDate")}))}parseAttachedPolicies(E){return jt(E,"AttachedPolicies","member").map((t)=>({PolicyName:m(t,"PolicyName")||"",PolicyArn:m(t,"PolicyArn")||""}))}async putUserPolicy(E){await this.request("PutUserPolicy",E)}async getUserPolicy(E){let r=await this.request("GetUserPolicy",E);return{UserName:m(r,"UserName")||"",PolicyName:m(r,"PolicyName")||"",PolicyDocument:decodeURIComponent(m(r,"PolicyDocument")||"")}}async deleteUserPolicy(E){await this.request("DeleteUserPolicy",E)}async listUserPolicies(E){let r=await this.request("ListUserPolicies",E),t=jt(r,"PolicyNames","member"),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{PolicyNames:t,IsTruncated:T,Marker:_}}async putGroupPolicy(E){await this.request("PutGroupPolicy",E)}async getGroupPolicy(E){let r=await this.request("GetGroupPolicy",E);return{GroupName:m(r,"GroupName")||"",PolicyName:m(r,"PolicyName")||"",PolicyDocument:decodeURIComponent(m(r,"PolicyDocument")||"")}}async deleteGroupPolicy(E){await this.request("DeleteGroupPolicy",E)}async listGroupPolicies(E){let r=await this.request("ListGroupPolicies",E),t=jt(r,"PolicyNames","member"),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{PolicyNames:t,IsTruncated:T,Marker:_}}async putRolePolicy(E){await this.request("PutRolePolicy",E)}async getRolePolicy(E){let r=await this.request("GetRolePolicy",E);return{RoleName:m(r,"RoleName")||"",PolicyName:m(r,"PolicyName")||"",PolicyDocument:decodeURIComponent(m(r,"PolicyDocument")||"")}}async deleteRolePolicy(E){await this.request("DeleteRolePolicy",E)}async listRolePolicies(E){let r=await this.request("ListRolePolicies",E),t=jt(r,"PolicyNames","member"),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{PolicyNames:t,IsTruncated:T,Marker:_}}async createAccessKey(E={}){let r=await this.request("CreateAccessKey",E);if(typeof r==="object"){let t=r?.CreateAccessKeyResult?.AccessKey||r?.AccessKey;if(t)return{AccessKey:{UserName:t.UserName||"",AccessKeyId:t.AccessKeyId||"",Status:t.Status||"Active",SecretAccessKey:t.SecretAccessKey||"",CreateDate:t.CreateDate}}}return{AccessKey:{UserName:m(r,"UserName")||"",AccessKeyId:m(r,"AccessKeyId")||"",Status:m(r,"Status")||"Active",SecretAccessKey:m(r,"SecretAccessKey")||"",CreateDate:m(r,"CreateDate")}}}async listAccessKeys(E={}){let r=await this.request("ListAccessKeys",E),t=this.parseAccessKeys(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{AccessKeyMetadata:t,IsTruncated:T,Marker:_}}async updateAccessKey(E){await this.request("UpdateAccessKey",E)}async deleteAccessKey(E){await this.request("DeleteAccessKey",E)}async getAccessKeyLastUsed(E){let r=await this.request("GetAccessKeyLastUsed",E);return{UserName:m(r,"UserName")||"",AccessKeyLastUsed:{LastUsedDate:m(r,"LastUsedDate"),ServiceName:m(r,"ServiceName"),Region:m(r,"Region")}}}parseAccessKeys(E){return jt(E,"AccessKeyMetadata","member").map((t)=>({UserName:m(t,"UserName"),AccessKeyId:m(t,"AccessKeyId")||"",Status:m(t,"Status")||"Active",CreateDate:m(t,"CreateDate")}))}async createInstanceProfile(E){let r=await this.request("CreateInstanceProfile",E);return this.parseInstanceProfile(r)}async getInstanceProfile(E){let r=await this.request("GetInstanceProfile",E);return this.parseInstanceProfile(r)}async listInstanceProfiles(E={}){let r=await this.request("ListInstanceProfiles",E),t=this.parseInstanceProfiles(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{InstanceProfiles:t,IsTruncated:T,Marker:_}}async listInstanceProfilesForRole(E){let r=await this.request("ListInstanceProfilesForRole",E),t=this.parseInstanceProfiles(r),T=m(r,"IsTruncated")==="true",_=m(r,"Marker");return{InstanceProfiles:t,IsTruncated:T,Marker:_}}async addRoleToInstanceProfile(E){await this.request("AddRoleToInstanceProfile",E)}async removeRoleFromInstanceProfile(E){await this.request("RemoveRoleFromInstanceProfile",E)}async deleteInstanceProfile(E){await this.request("DeleteInstanceProfile",E)}parseInstanceProfile(E){return{InstanceProfileName:m(E,"InstanceProfileName")||"",InstanceProfileId:m(E,"InstanceProfileId")||"",Arn:m(E,"Arn")||"",Path:m(E,"Path"),CreateDate:m(E,"CreateDate")}}parseInstanceProfiles(E){return jt(E,"InstanceProfiles","member").map((t)=>({InstanceProfileName:m(t,"InstanceProfileName")||"",InstanceProfileId:m(t,"InstanceProfileId")||"",Arn:m(t,"Arn")||"",Path:m(t,"Path"),CreateDate:m(t,"CreateDate")}))}async getAccountPasswordPolicy(){let E=await this.request("GetAccountPasswordPolicy");return{MinimumPasswordLength:m(E,"MinimumPasswordLength")?Number.parseInt(m(E,"MinimumPasswordLength"),10):void 0,RequireSymbols:m(E,"RequireSymbols")==="true",RequireNumbers:m(E,"RequireNumbers")==="true",RequireUppercaseCharacters:m(E,"RequireUppercaseCharacters")==="true",RequireLowercaseCharacters:m(E,"RequireLowercaseCharacters")==="true",AllowUsersToChangePassword:m(E,"AllowUsersToChangePassword")==="true",ExpirePasswords:m(E,"ExpirePasswords")==="true",MaxPasswordAge:m(E,"MaxPasswordAge")?Number.parseInt(m(E,"MaxPasswordAge"),10):void 0,PasswordReusePrevention:m(E,"PasswordReusePrevention")?Number.parseInt(m(E,"PasswordReusePrevention"),10):void 0,HardExpiry:m(E,"HardExpiry")==="true"}}async updateAccountPasswordPolicy(E){await this.request("UpdateAccountPasswordPolicy",E)}async deleteAccountPasswordPolicy(){await this.request("DeleteAccountPasswordPolicy")}async getAccountSummary(){let E=await this.request("GetAccountSummary"),r={},t=jt(E,"SummaryMap","entry");for(let T of t){let _=m(T,"key"),d=m(T,"value");if(_&&d)r[_]=Number.parseInt(d,10)}return r}async listAccountAliases(){let E=await this.request("ListAccountAliases"),r=jt(E,"AccountAliases","member"),t=m(E,"IsTruncated")==="true",T=m(E,"Marker");return{AccountAliases:r,IsTruncated:t,Marker:T}}async createAccountAlias(E){await this.request("CreateAccountAlias",E)}async deleteAccountAlias(E){await this.request("DeleteAccountAlias",E)}async simulatePrincipalPolicy(E){let r=await this.request("SimulatePrincipalPolicy",E);return this.parseSimulationResults(r)}parseSimulationResults(E){let t=jt(E,"EvaluationResults","member").map((d)=>{let h=jt(d,"MatchedStatements","member").map((R)=>({SourcePolicyId:m(R,"SourcePolicyId"),SourcePolicyType:m(R,"SourcePolicyType")}));return{EvalActionName:m(d,"EvalActionName")||"",EvalResourceName:m(d,"EvalResourceName"),EvalDecision:m(d,"EvalDecision")||"",MatchedStatements:h.length>0?h:void 0}}),T=m(E,"IsTruncated")==="true",_=m(E,"Marker");return{EvaluationResults:t,IsTruncated:T,Marker:_}}}var UR=$E(()=>{GE()});var Ot;var Eh=$E(()=>{GE();Ot=class Ot{client;region;constructor(E="us-east-1"){this.region=E,this.client=new wE}async createHostedZone(E){let r=E.CallerReference||`${Date.now()}-${Math.random().toString(36).slice(2)}`,t=`<?xml version="1.0" encoding="UTF-8"?>
 <CreateHostedZoneRequest xmlns="https://route53.amazonaws.com/doc/2013-04-01/">
   <Name>${E.Name}</Name>
   <CallerReference>${r}</CallerReference>`;if(E.HostedZoneConfig){if(t+=`
@@ -57,7 +57,7 @@ ${sE.bright}${sE.cyan}${E}${sE.reset}
     </Changes>
   </ChangeBatch>
 </ChangeResourceRecordSetsRequest>`;let T=await this.client.request({service:"route53",region:this.region,method:"POST",path:`/2013-04-01/hostedzone/${r}/rrset`,headers:{"content-type":"application/xml"},body:t});return this.parseChangeResourceRecordSetsResponse(T)}escapeXml(E){return E.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}parseCreateHostedZoneResponse(E){let r=E.CreateHostedZoneResponse||E;return{HostedZone:this.parseHostedZone(r.HostedZone),ChangeInfo:{Id:r.ChangeInfo?.Id||"",Status:r.ChangeInfo?.Status||"",SubmittedAt:r.ChangeInfo?.SubmittedAt||""},DelegationSet:this.parseDelegationSet(r.DelegationSet),Location:r.Location||""}}parseListHostedZonesResponse(E){let r=E.ListHostedZonesResponse||E.ListHostedZonesByNameResponse||E,t=r.HostedZones?.HostedZone||r.HostedZones||[];if(!Array.isArray(t))t=t?[t]:[];return{HostedZones:t.map((T)=>this.parseHostedZone(T)),IsTruncated:r.IsTruncated==="true"||r.IsTruncated===!0,MaxItems:r.MaxItems||"100",Marker:r.Marker,NextMarker:r.NextMarker}}parseGetHostedZoneResponse(E){let r=E.GetHostedZoneResponse||E;return{HostedZone:this.parseHostedZone(r.HostedZone),DelegationSet:this.parseDelegationSet(r.DelegationSet),VPCs:r.VPCs?.VPC?Array.isArray(r.VPCs.VPC)?r.VPCs.VPC:[r.VPCs.VPC]:void 0}}parseListResourceRecordSetsResponse(E){let r=E.ListResourceRecordSetsResponse||E,t=r.ResourceRecordSets?.ResourceRecordSet||r.ResourceRecordSets||[];if(!Array.isArray(t))t=t?[t]:[];return{ResourceRecordSets:t.map((T)=>this.parseResourceRecordSet(T)),IsTruncated:r.IsTruncated==="true"||r.IsTruncated===!0,MaxItems:r.MaxItems||"100",NextRecordName:r.NextRecordName,NextRecordType:r.NextRecordType,NextRecordIdentifier:r.NextRecordIdentifier}}parseChangeResourceRecordSetsResponse(E){let r=E.ChangeResourceRecordSetsResponse||E;return{ChangeInfo:{Id:r.ChangeInfo?.Id||"",Status:r.ChangeInfo?.Status||"",SubmittedAt:r.ChangeInfo?.SubmittedAt||"",Comment:r.ChangeInfo?.Comment}}}parseHostedZone(E){if(!E)return{Id:"",Name:""};return{Id:E.Id||"",Name:E.Name||"",CallerReference:E.CallerReference,Config:E.Config?{Comment:E.Config.Comment,PrivateZone:E.Config.PrivateZone==="true"||E.Config.PrivateZone===!0}:void 0,ResourceRecordSetCount:E.ResourceRecordSetCount?Number(E.ResourceRecordSetCount):void 0}}parseDelegationSet(E){if(!E)return{NameServers:[]};let r=E.NameServers?.NameServer||E.NameServers||[];if(!Array.isArray(r))r=r?[r]:[];return{Id:E.Id,CallerReference:E.CallerReference,NameServers:r}}parseResourceRecordSet(E){if(!E)return{Name:"",Type:""};let r=E.ResourceRecords?.ResourceRecord||E.ResourceRecords||[];if(!Array.isArray(r))r=r?[r]:[];return{Name:E.Name||"",Type:E.Type||"",TTL:E.TTL?Number(E.TTL):void 0,ResourceRecords:r.map((t)=>({Value:t.Value||t})),AliasTarget:E.AliasTarget?{HostedZoneId:E.AliasTarget.HostedZoneId,DNSName:E.AliasTarget.DNSName,EvaluateTargetHealth:E.AliasTarget.EvaluateTargetHealth==="true"||E.AliasTarget.EvaluateTargetHealth===!0}:void 0,SetIdentifier:E.SetIdentifier,Weight:E.Weight?Number(E.Weight):void 0,Region:E.Region,GeoLocation:E.GeoLocation,Failover:E.Failover,HealthCheckId:E.HealthCheckId}}async findHostedZoneByName(E){let r=E.endsWith(".")?E:`${E}.`;return(await this.listHostedZonesByName({DNSName:r})).HostedZones.find((_)=>_.Name===r)||null}async createARecord(E){let r=Array.isArray(E.Value)?E.Value:[E.Value];return this.changeResourceRecordSets({HostedZoneId:E.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:E.Name,Type:"A",TTL:E.TTL||300,ResourceRecords:r.map((t)=>({Value:t}))}}]}})}async createCnameRecord(E){return this.changeResourceRecordSets({HostedZoneId:E.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:E.Name,Type:"CNAME",TTL:E.TTL||300,ResourceRecords:[{Value:E.Value}]}}]}})}async createAliasRecord(E){return this.changeResourceRecordSets({HostedZoneId:E.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:E.Name,Type:E.Type||"A",AliasTarget:{HostedZoneId:E.TargetHostedZoneId,DNSName:E.TargetDNSName,EvaluateTargetHealth:E.EvaluateTargetHealth??!1}}}]}})}async createTxtRecord(E){let t=(Array.isArray(E.Value)?E.Value:[E.Value]).map((T)=>{if(!T.startsWith('"'))return`"${T}"`;return T});return this.changeResourceRecordSets({HostedZoneId:E.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:E.Name,Type:"TXT",TTL:E.TTL||300,ResourceRecords:t.map((T)=>({Value:T}))}}]}})}async createMxRecord(E){return this.changeResourceRecordSets({HostedZoneId:E.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:E.Name,Type:"MX",TTL:E.TTL||300,ResourceRecords:E.Values.map((r)=>({Value:`${r.priority} ${r.mailServer}`}))}}]}})}async deleteRecord(E){return this.changeResourceRecordSets({HostedZoneId:E.HostedZoneId,ChangeBatch:{Changes:[{Action:"DELETE",ResourceRecordSet:E.RecordSet}]}})}async waitForChange(E,r=60,t=5000){let T=E.replace("/change/","");for(let _=0;_<r;_++){let d=await this.client.request({service:"route53",region:this.region,method:"GET",path:`/2013-04-01/change/${T}`});if((d.GetChangeResponse?.ChangeInfo?.Status||d.ChangeInfo?.Status)==="INSYNC")return!0;await new Promise((h)=>setTimeout(h,t))}return!1}async findOrCreateHostedZone(E){let r=E.domainName.endsWith(".")?E.domainName:`${E.domainName}.`,t=await this.findHostedZoneByName(r);if(t){let _=await this.getHostedZone({Id:t.Id});return{hostedZone:t,nameServers:_.DelegationSet.NameServers,isNew:!1}}let T=await this.createHostedZone({Name:r,HostedZoneConfig:{Comment:E.comment||`Hosted zone for ${E.domainName}`,PrivateZone:E.privateZone},VPC:E.vpc});return{hostedZone:T.HostedZone,nameServers:T.DelegationSet.NameServers,isNew:!0}}static getRootDomain(E){let r=E.replace(/\.$/,"").split(".");if(r.length<=2)return E;return r.slice(-2).join(".")}async findHostedZoneForDomain(E){let t=E.replace(/\.$/,"").split(".");for(let T=0;T<t.length-1;T++){let _=t.slice(T).join("."),d=await this.findHostedZoneByName(_);if(d)return d}return null}async ensureHostedZone(E){let r=await this.findOrCreateHostedZone({domainName:E.domainName,comment:E.comment});return{hostedZoneId:r.hostedZone.Id.replace("/hostedzone/",""),nameServers:r.nameServers,isNew:r.isNew,action:r.isNew?"created":"found"}}async setupDomainDns(E){let{domain:r,createIfNotExists:t=!0}=E,T=await this.findHostedZoneByName(r);if(T){let d=await this.getHostedZone({Id:T.Id});return{success:!0,hostedZoneId:T.Id.replace("/hostedzone/",""),nameServers:d.DelegationSet.NameServers,isNew:!1,message:`Found existing hosted zone for ${r}`}}if(!t)return{success:!1,hostedZoneId:null,nameServers:[],isNew:!1,message:`No hosted zone found for ${r} and createIfNotExists is false`};let _=await this.createHostedZone({Name:r,HostedZoneConfig:{Comment:`Created automatically by ts-cloud for ${r}`}});return{success:!0,hostedZoneId:_.HostedZone.Id.replace("/hostedzone/",""),nameServers:_.DelegationSet.NameServers,isNew:!0,message:`Created new hosted zone for ${r}. Please update your domain registrar with these name servers: ${_.DelegationSet.NameServers.join(", ")}`}}static CloudFrontHostedZoneId="Z2FDTNDATAQYW2";static S3WebsiteHostedZoneIds={"us-east-1":"Z3AQBSTGFYJSTF","us-east-2":"Z2O1EMRO9K5GLX","us-west-1":"Z2F56UZL2M1ACD","us-west-2":"Z3BJ6K6RIION7M","ap-east-1":"ZNB98KWMFR0R6","ap-south-1":"Z11RGJOFQNVJUP","ap-northeast-1":"Z2M4EHUR26P7ZW","ap-northeast-2":"Z3W03O7B5YMIYP","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"Z3O0J2DXBE1FTB","ap-southeast-2":"Z1WCIGYICN2BYD","ca-central-1":"Z1QDHH18159H29","eu-central-1":"Z21DNDUVLTQW6Q","eu-west-1":"Z1BKCTXD74EZPE","eu-west-2":"Z3GKZC51ZF0DB4","eu-west-3":"Z3R1K369G5AVDG","eu-north-1":"Z3BAZG2TWCNX0D","sa-east-1":"Z7KQH4QJS55SO"};static ALBHostedZoneIds={"us-east-1":"Z35SXDOTRQ7X7K","us-east-2":"Z3AADJGX6KTTL2","us-west-1":"Z368ELLRRE2KJ0","us-west-2":"Z1H1FL5HABSF5","ap-east-1":"Z3DQVH9N71FHZ0","ap-south-1":"ZP97RAFLXTNZK","ap-northeast-1":"Z14GRHDCWA56QT","ap-northeast-2":"ZWKZPGTI48KDX","ap-northeast-3":"Z5LXEBD8Y73MNV","ap-southeast-1":"Z1LMS91P8CMLE5","ap-southeast-2":"Z1GM3OXH4ZPM65","ca-central-1":"ZQSVJUPU6J1EY","eu-central-1":"Z215JYRZR1TBD5","eu-west-1":"Z32O12XQLNTSW2","eu-west-2":"ZHURV8PSTC4K8","eu-west-3":"Z3Q77PNBQS71R4","eu-north-1":"Z23TAZ6LKFMNIO","sa-east-1":"Z2P70J7HTTTPLU"};static APIGatewayHostedZoneIds={"us-east-1":"Z1UJRXOUMOOFQ8","us-east-2":"ZOJJZC49E0EPZ","us-west-1":"Z2MUQ32089INYE","us-west-2":"Z2OJLYMUO9EFXC","ap-east-1":"Z3FD1VL90ND7K5","ap-south-1":"Z3VO1THU9YC4UR","ap-northeast-1":"Z1YSHQZHG15GKL","ap-northeast-2":"Z20JF4UZKIW1U8","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"ZL327KTPIQFUL","ap-southeast-2":"Z2RPCDW04V8134","ca-central-1":"Z19DQILCV0OWEC","eu-central-1":"Z1U9ULNL0V5AJ3","eu-west-1":"ZLY8HYME6SFDD","eu-west-2":"ZJ5UAJN8Y3Z2Q","eu-west-3":"Z3KY65QIEKYHQQ","eu-north-1":"Z3UWIKFBOOGXPP","sa-east-1":"ZCMLWB8V5SYIT"}}});function _e(E){if(E){let T=ny(E);if(!T)throw Error(`AWS profile '${E}' not found in ~/.aws/credentials`);return T}let r=process.env.AWS_ACCESS_KEY_ID,t=process.env.AWS_SECRET_ACCESS_KEY;if(r&&t)return{accessKeyId:r,secretAccessKey:t,sessionToken:process.env.AWS_SESSION_TOKEN};return ny(process.env.AWS_PROFILE||"default")??{accessKeyId:"",secretAccessKey:""}}function ny(E){let{existsSync:r,readFileSync:t}=xE("node:fs"),{homedir:T}=xE("node:os"),{join:_}=xE("node:path"),d=process.env.AWS_SHARED_CREDENTIALS_FILE||_(T(),".aws","credentials");if(!r(d))return null;let e=t(d,"utf-8"),h=null,R,N,A;for(let S of e.split(`
-`)){let L=S.trim();if(!L||L.startsWith("#")||L.startsWith(";"))continue;let O=L.match(/^\[([^\]]+)\]$/);if(O){if(h===E&&R&&N)return{accessKeyId:R,secretAccessKey:N,sessionToken:A};h=O[1],R=void 0,N=void 0,A=void 0;continue}if(h===E){let[I,...D]=L.split("="),$=D.join("=").trim();switch(I.trim().toLowerCase()){case"aws_access_key_id":R=$;break;case"aws_secret_access_key":N=$;break;case"aws_session_token":A=$;break}}}if(h===E&&R&&N)return{accessKeyId:R,secretAccessKey:N,sessionToken:A};return null}var DR={};Qr(DR,{S3Client:()=>KE});import*as HE from"node:crypto";import{readFileSync as vy}from"node:fs";import{readdir as tM}from"node:fs/promises";import{join as TM}from"node:path";function ly(E){let{buffer:r,byteOffset:t,byteLength:T}=E;if(r instanceof ArrayBuffer)return r.slice(t,t+T);let _=new ArrayBuffer(T);return new Uint8Array(_).set(new Uint8Array(E)),_}class KE{client;region;explicitProfile;endpoint;endpointProtocol="https";forcePathStyle;explicitCredentials;constructor(E="us-east-1",r,t){let T=typeof E==="string"?t:E,_=typeof E==="string"?E:E.region??"us-east-1",d=typeof E==="string"?r:E.profile,e=T?.endpoint?CA({region:_,path:"/",endpoint:T.endpoint}):void 0;this.region=_,this.explicitProfile=d,this.endpoint=e?.host,this.endpointProtocol=e?.protocol??"https",this.forcePathStyle=T?.forcePathStyle,this.explicitCredentials=T?.credentials,this.client=new wE(T?.credentials,{profile:d,endpoint:T?.endpoint,forcePathStyle:T?.forcePathStyle})}getCredentials(){if(this.explicitCredentials?.accessKeyId&&this.explicitCredentials.secretAccessKey)return this.explicitCredentials;let E=_e(this.explicitProfile);if(E.accessKeyId&&E.secretAccessKey)return E;throw Error("S3 credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or pass explicit credentials/profile), or configure ~/.aws/credentials.")}s3BaseHost(){return this.endpoint||`s3.${this.region}.amazonaws.com`}s3VirtualHost(E){return this.forcePathStyle?this.s3BaseHost():`${E}.${this.s3BaseHost()}`}objectPath(E,r){return this.forcePathStyle?`/${E}/${r}`:`/${r}`}objectUrl(E,r){return`${this.endpointProtocol}://${this.s3VirtualHost(E)}${this.objectPath(E,r)}`}async listBuckets(){let E=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/"}),r=[],T=(E?.ListAllMyBucketsResult??E)?.Buckets?.Bucket;if(T){let _=Array.isArray(T)?T:[T];for(let d of _)r.push({Name:d.Name,CreationDate:d.CreationDate})}return{Buckets:r}}async createBucket(E,r){let t={};if(r?.acl)t["x-amz-acl"]=r.acl;let T;if(this.region!=="us-east-1"&&!this.endpoint)T=`<?xml version="1.0" encoding="UTF-8"?>
+`)){let L=S.trim();if(!L||L.startsWith("#")||L.startsWith(";"))continue;let O=L.match(/^\[([^\]]+)\]$/);if(O){if(h===E&&R&&N)return{accessKeyId:R,secretAccessKey:N,sessionToken:A};h=O[1],R=void 0,N=void 0,A=void 0;continue}if(h===E){let[I,...D]=L.split("="),$=D.join("=").trim();switch(I.trim().toLowerCase()){case"aws_access_key_id":R=$;break;case"aws_secret_access_key":N=$;break;case"aws_session_token":A=$;break}}}if(h===E&&R&&N)return{accessKeyId:R,secretAccessKey:N,sessionToken:A};return null}var DR={};Qr(DR,{S3Client:()=>KE});import*as HE from"node:crypto";import{readFileSync as vy}from"node:fs";import{readdir as t8}from"node:fs/promises";import{join as T8}from"node:path";function ly(E){let{buffer:r,byteOffset:t,byteLength:T}=E;if(r instanceof ArrayBuffer)return r.slice(t,t+T);let _=new ArrayBuffer(T);return new Uint8Array(_).set(new Uint8Array(E)),_}class KE{client;region;explicitProfile;endpoint;endpointProtocol="https";forcePathStyle;explicitCredentials;constructor(E="us-east-1",r,t){let T=typeof E==="string"?t:E,_=typeof E==="string"?E:E.region??"us-east-1",d=typeof E==="string"?r:E.profile,e=T?.endpoint?CA({region:_,path:"/",endpoint:T.endpoint}):void 0;this.region=_,this.explicitProfile=d,this.endpoint=e?.host,this.endpointProtocol=e?.protocol??"https",this.forcePathStyle=T?.forcePathStyle,this.explicitCredentials=T?.credentials,this.client=new wE(T?.credentials,{profile:d,endpoint:T?.endpoint,forcePathStyle:T?.forcePathStyle})}getCredentials(){if(this.explicitCredentials?.accessKeyId&&this.explicitCredentials.secretAccessKey)return this.explicitCredentials;let E=_e(this.explicitProfile);if(E.accessKeyId&&E.secretAccessKey)return E;throw Error("S3 credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or pass explicit credentials/profile), or configure ~/.aws/credentials.")}s3BaseHost(){return this.endpoint||`s3.${this.region}.amazonaws.com`}s3VirtualHost(E){return this.forcePathStyle?this.s3BaseHost():`${E}.${this.s3BaseHost()}`}objectPath(E,r){return this.forcePathStyle?`/${E}/${r}`:`/${r}`}objectUrl(E,r){return`${this.endpointProtocol}://${this.s3VirtualHost(E)}${this.objectPath(E,r)}`}async listBuckets(){let E=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/"}),r=[],T=(E?.ListAllMyBucketsResult??E)?.Buckets?.Bucket;if(T){let _=Array.isArray(T)?T:[T];for(let d of _)r.push({Name:d.Name,CreationDate:d.CreationDate})}return{Buckets:r}}async createBucket(E,r){let t={};if(r?.acl)t["x-amz-acl"]=r.acl;let T;if(this.region!=="us-east-1"&&!this.endpoint)T=`<?xml version="1.0" encoding="UTF-8"?>
 <CreateBucketConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
   <LocationConstraint>${this.region}</LocationConstraint>
 </CreateBucketConfiguration>`,t["Content-Type"]="application/xml";await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${E}`,headers:t,body:T})}async deleteBucket(E){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${E}`})}async emptyAndDeleteBucket(E){let r=!0;while(r){let t=await this.listAllObjects({bucket:E});if(t.length===0){r=!1;break}let T=t.map((_)=>_.Key);for(let _=0;_<T.length;_+=1000){let d=T.slice(_,_+1000);await this.deleteObjects(E,d)}}await this.deleteBucket(E)}async listAllObjects(E){let r=[],t;do{let T={"list-type":"2","max-keys":"1000"};if(E.prefix)T.prefix=E.prefix;if(t)T["continuation-token"]=t;let _=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${E.bucket}`,queryParams:T}),d=_?.ListBucketResult??_,e=d?.Contents;if(e){let R=Array.isArray(e)?e:[e];for(let N of R)r.push({Key:N.Key,LastModified:N.LastModified||"",Size:Number.parseInt(N.Size||"0"),ETag:N.ETag})}let h=d?.IsTruncated;t=h==="true"||h===!0?d?.NextContinuationToken:void 0}while(t);return r}async list(E){let r=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${E.bucket}`}),t=[],_=(r?.ListBucketResult??r)?.Contents;if(_){let d=Array.isArray(_)?_:[_];for(let e of d){if(E.prefix&&!e.Key?.startsWith(E.prefix))continue;if(t.push({Key:e.Key||"",LastModified:e.LastModified||"",Size:Number.parseInt(e.Size||"0"),ETag:e.ETag}),E.maxKeys&&t.length>=E.maxKeys)break}}return t}async putObject(E){let r={};if(E.acl)r["x-amz-acl"]=E.acl;if(E.cacheControl)r["Cache-Control"]=E.cacheControl;if(E.contentType)r["Content-Type"]=E.contentType;if(E.metadata)for(let[_,d]of Object.entries(E.metadata))r[`x-amz-meta-${_}`]=d;let t=E.key.split("/").map((_)=>encodeURIComponent(_)).join("/"),T=E.body instanceof Uint8Array&&!Buffer.isBuffer(E.body)?Buffer.from(E.body):E.body;if(Buffer.isBuffer(T)||T instanceof Uint8Array){let _=Buffer.isBuffer(T)?T:Buffer.from(T),{accessKeyId:d,secretAccessKey:e,sessionToken:h}=this.getCredentials(),R=this.s3VirtualHost(E.bucket),N=this.objectPath(E.bucket,t),A=this.objectUrl(E.bucket,t),S=new Date,L=S.toISOString().replace(/[:-]|\.\d{3}/g,""),O=S.toISOString().slice(0,10).replace(/-/g,""),I=HE.createHash("sha256").update(_).digest("hex"),D={host:R,"x-amz-date":L,"x-amz-content-sha256":I,...r};if(h)D["x-amz-security-token"]=h;let $=Object.keys(D).sort().map((a)=>`${a.toLowerCase()}:${D[a].trim()}
@@ -70,7 +70,7 @@ ${sE.bright}${sE.cyan}${E}${sE.reset}
 <Delete>
   ${r.map((_)=>`<Object><Key>${_}</Key></Object>`).join(`
   `)}
-</Delete>`,T=HE.createHash("md5").update(t).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${E}`,queryParams:{delete:""},body:t,headers:{"Content-Type":"application/xml","Content-MD5":T}})}async bucketExists(E){try{return await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${E}`}),!0}catch{return!1}}async copy(E){let r=vy(E.source);await this.putObject({bucket:E.bucket,key:E.key,body:r,acl:E.acl,cacheControl:E.cacheControl,contentType:E.contentType,metadata:E.metadata})}async sync(E){let r=await this.listFilesRecursive(E.source);for(let t of r){if(E.exclude&&E.exclude.some((d)=>t.includes(d)))continue;if(E.include&&!E.include.some((d)=>t.includes(d)))continue;let T=t.substring(E.source.length+1),_=E.prefix?`${E.prefix}/${T}`:T;if(!E.dryRun){let d=vy(t);await this.putObject({bucket:E.bucket,key:_,body:d,acl:E.acl,cacheControl:E.cacheControl,contentType:E.contentType,metadata:E.metadata})}}}async delete(E,r){await this.deleteObject(E,r)}async deletePrefix(E,r){let T=(await this.list({bucket:E,prefix:r})).map((_)=>_.Key);if(T.length>0)await this.deleteObjects(E,T)}async getBucketSize(E,r){return(await this.list({bucket:E,prefix:r})).reduce((T,_)=>T+_.Size,0)}async listFilesRecursive(E){let r=[],t=await tM(E,{withFileTypes:!0});for(let T of t){let _=TM(E,T.name);if(T.isDirectory()){let d=await this.listFilesRecursive(_);r.push(...d)}else r.push(_)}return r}async putBucketPolicy(E,r){let{accessKeyId:t,secretAccessKey:T,sessionToken:_}=this.getCredentials(),d=this.s3BaseHost(),e=typeof r==="string"?r:JSON.stringify(r),h=new Date,R=h.toISOString().replace(/[:-]|\.\d{3}/g,""),N=h.toISOString().slice(0,10).replace(/-/g,""),A=HE.createHash("sha256").update(e).digest("hex"),S="/"+E,L="policy=",O={host:d,"x-amz-date":R,"x-amz-content-sha256":A,"content-type":"application/json"};if(_)O["x-amz-security-token"]=_;let I=Object.keys(O).sort().map((n)=>`${n.toLowerCase()}:${O[n].trim()}
+</Delete>`,T=HE.createHash("md5").update(t).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${E}`,queryParams:{delete:""},body:t,headers:{"Content-Type":"application/xml","Content-MD5":T}})}async bucketExists(E){try{return await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${E}`}),!0}catch{return!1}}async copy(E){let r=vy(E.source);await this.putObject({bucket:E.bucket,key:E.key,body:r,acl:E.acl,cacheControl:E.cacheControl,contentType:E.contentType,metadata:E.metadata})}async sync(E){let r=await this.listFilesRecursive(E.source);for(let t of r){if(E.exclude&&E.exclude.some((d)=>t.includes(d)))continue;if(E.include&&!E.include.some((d)=>t.includes(d)))continue;let T=t.substring(E.source.length+1),_=E.prefix?`${E.prefix}/${T}`:T;if(!E.dryRun){let d=vy(t);await this.putObject({bucket:E.bucket,key:_,body:d,acl:E.acl,cacheControl:E.cacheControl,contentType:E.contentType,metadata:E.metadata})}}}async delete(E,r){await this.deleteObject(E,r)}async deletePrefix(E,r){let T=(await this.list({bucket:E,prefix:r})).map((_)=>_.Key);if(T.length>0)await this.deleteObjects(E,T)}async getBucketSize(E,r){return(await this.list({bucket:E,prefix:r})).reduce((T,_)=>T+_.Size,0)}async listFilesRecursive(E){let r=[],t=await t8(E,{withFileTypes:!0});for(let T of t){let _=T8(E,T.name);if(T.isDirectory()){let d=await this.listFilesRecursive(_);r.push(...d)}else r.push(_)}return r}async putBucketPolicy(E,r){let{accessKeyId:t,secretAccessKey:T,sessionToken:_}=this.getCredentials(),d=this.s3BaseHost(),e=typeof r==="string"?r:JSON.stringify(r),h=new Date,R=h.toISOString().replace(/[:-]|\.\d{3}/g,""),N=h.toISOString().slice(0,10).replace(/-/g,""),A=HE.createHash("sha256").update(e).digest("hex"),S="/"+E,L="policy=",O={host:d,"x-amz-date":R,"x-amz-content-sha256":A,"content-type":"application/json"};if(_)O["x-amz-security-token"]=_;let I=Object.keys(O).sort().map((n)=>`${n.toLowerCase()}:${O[n].trim()}
 `).join(""),D=Object.keys(O).sort().map((n)=>n.toLowerCase()).join(";"),$=["PUT",S,"policy=",I,D,A].join(`
 `),C="AWS4-HMAC-SHA256",y=`${N}/${this.region}/s3/aws4_request`,j=[C,R,y,HE.createHash("sha256").update($).digest("hex")].join(`
 `),B=HE.createHmac("sha256","AWS4"+T).update(N).digest(),f=HE.createHmac("sha256",B).update(this.region).digest(),Q=HE.createHmac("sha256",f).update("s3").digest(),V=HE.createHmac("sha256",Q).update("aws4_request").digest(),g=HE.createHmac("sha256",V).update(j).digest("hex"),x=`${C} Credential=${t}/${y}, SignedHeaders=${D}, Signature=${g}`,u=`${this.endpointProtocol}://${d}${S}?policy=`,l=await fetch(u,{method:"PUT",headers:{...O,Authorization:x},body:e});if(!l.ok){let n=await l.text();throw Error(`Failed to put bucket policy: ${l.status} ${n}`)}}async getBucketPolicy(E){let{accessKeyId:r,secretAccessKey:t,sessionToken:T}=this.getCredentials(),_=this.s3BaseHost(),d=new Date,e=d.toISOString().replace(/[:-]|\.\d{3}/g,""),h=d.toISOString().slice(0,10).replace(/-/g,""),R=HE.createHash("sha256").update("").digest("hex"),N="/"+E,A="policy=",S={host:_,"x-amz-date":e,"x-amz-content-sha256":R};if(T)S["x-amz-security-token"]=T;let L=Object.keys(S).sort().map((l)=>`${l.toLowerCase()}:${S[l].trim()}
@@ -146,7 +146,7 @@ host:${e}
   <Quiet>true</Quiet>
   ${r.map((_)=>`<Object><Key>${_.Key}</Key>${_.VersionId?`<VersionId>${_.VersionId}</VersionId>`:""}</Object>`).join(`
   `)}
-</Delete>`,T=HE.createHash("md5").update(t).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${E}`,queryParams:{delete:""},body:t,headers:{"Content-Type":"application/xml","Content-MD5":T}})}}var Cr=$E(()=>{GE()});class ut{client;region;constructor(E="us-east-1",r){this.region=E,this.client=new wE(r)}async createEmailIdentity(E){return await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/identities",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})}async getEmailIdentity(E){let r=await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/identities/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}});return{IdentityType:r.IdentityType,IdentityName:E,SendingEnabled:r.VerifiedForSendingStatus,VerificationStatus:r.VerificationStatus,DkimAttributes:r.DkimAttributes,MailFromAttributes:r.MailFromAttributes}}async putEmailIdentityMailFromAttributes(E,r){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(E)}/mail-from`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async listEmailIdentities(E){let r="/v2/email/identities",t=[];if(E?.PageSize)t.push(`PageSize=${E.PageSize}`);if(E?.NextToken)t.push(`NextToken=${encodeURIComponent(E.NextToken)}`);if(t.length>0)r+=`?${t.join("&")}`;let T=await this.client.request({service:"email",region:this.region,method:"GET",path:r,headers:{"Content-Type":"application/json"}});return{EmailIdentities:T.EmailIdentities,NextToken:T.NextToken}}async deleteEmailIdentity(E){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/identities/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async putEmailIdentityDkimAttributes(E){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(E.EmailIdentity)}/dkim`,headers:{"Content-Type":"application/json"},body:JSON.stringify({SigningEnabled:E.SigningEnabled})})}async sendEmail(E){return{MessageId:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})).MessageId}}async sendBulkEmail(E){return{BulkEmailEntryResults:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-bulk-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})).BulkEmailEntryResults}}async createEmailTemplate(E){await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/templates",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})}async getEmailTemplate(E){return await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/templates/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async deleteEmailTemplate(E){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/templates/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async listEmailTemplates(E){let r="/v2/email/templates",t=[];if(E?.PageSize)t.push(`PageSize=${E.PageSize}`);if(E?.NextToken)t.push(`NextToken=${encodeURIComponent(E.NextToken)}`);if(t.length>0)r+=`?${t.join("&")}`;return await this.client.request({service:"email",region:this.region,method:"GET",path:r,headers:{"Content-Type":"application/json"}})}async getSendStatistics(){return{SendDataPoints:(await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendStatistics&Version=2010-12-01"})).GetSendStatisticsResponse?.GetSendStatisticsResult?.SendDataPoints?.member}}async getSendQuota(){let r=(await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendQuota&Version=2010-12-01"})).GetSendQuotaResponse?.GetSendQuotaResult;return{Max24HourSend:r?.Max24HourSend?Number(r.Max24HourSend):void 0,MaxSendRate:r?.MaxSendRate?Number(r.MaxSendRate):void 0,SentLast24Hours:r?.SentLast24Hours?Number(r.SentLast24Hours):void 0}}async verifyDomain(E){let r=await this.createEmailIdentity({EmailIdentity:E});return{dkimTokens:r.DkimAttributes?.Tokens,verificationStatus:r.DkimAttributes?.Status}}async sendSimpleEmail(E){let r=Array.isArray(E.to)?E.to:[E.to],t=E.replyTo?Array.isArray(E.replyTo)?E.replyTo:[E.replyTo]:void 0,T={};if(E.text)T.Text={Data:E.text};if(E.html)T.Html={Data:E.html};return this.sendEmail({FromEmailAddress:E.from,Destination:{ToAddresses:r},Content:{Simple:{Subject:{Data:E.subject},Body:T}},ReplyToAddresses:t})}async sendTemplatedEmail(E){let r=Array.isArray(E.to)?E.to:[E.to],t=E.replyTo?Array.isArray(E.replyTo)?E.replyTo:[E.replyTo]:void 0;return this.sendEmail({FromEmailAddress:E.from,Destination:{ToAddresses:r},Content:{Template:{TemplateName:E.templateName,TemplateData:JSON.stringify(E.templateData)}},ReplyToAddresses:t})}async getDkimRecords(E){let r=await this.getEmailIdentity(E);if(!r.DkimAttributes?.Tokens)return[];return r.DkimAttributes.Tokens.map((t)=>({name:`${t}._domainkey.${E}`,type:"CNAME",value:`${t}.dkim.amazonses.com`}))}async isDomainVerified(E){try{let r=await this.getEmailIdentity(E);return r.VerificationStatus==="SUCCESS"&&r.SendingEnabled===!0}catch{return!1}}async waitForDomainVerification(E,r=60,t=30000){for(let T=0;T<r;T++){if(await this.isDomainVerified(E))return!0;await new Promise((d)=>setTimeout(d,t))}return!1}buildFormBody(E){return Object.entries(E).filter(([,t])=>t!==void 0).map(([t,T])=>`${encodeURIComponent(t)}=${encodeURIComponent(T)}`).join("&")}async createReceiptRuleSet(E){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})})}async deleteReceiptRuleSet(E){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})})}async setActiveReceiptRuleSet(E){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetActiveReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})})}async listReceiptRuleSets(E){let r={Action:"ListReceiptRuleSets",Version:"2010-12-01"};if(E)r.NextToken=E;let t=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(r)}),T=t?.ListReceiptRuleSetsResponse?.ListReceiptRuleSetsResult||t?.ListReceiptRuleSetsResult,_=T?.RuleSets?.member;return{RuleSets:Array.isArray(_)?_:_?[_]:[],NextToken:T?.NextToken}}async describeReceiptRuleSet(E){let r=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})}),t=r?.DescribeReceiptRuleSetResponse?.DescribeReceiptRuleSetResult||r?.DescribeReceiptRuleSetResult,T=t?.Rules?.member;return{Metadata:t?.Metadata,Rules:Array.isArray(T)?T:T?[T]:[]}}async createReceiptRule(E){let r={Action:"CreateReceiptRule",Version:"2010-12-01",RuleSetName:E.RuleSetName,"Rule.Name":E.Rule.Name,"Rule.Enabled":E.Rule.Enabled!==!1?"true":"false"};if(E.Rule.TlsPolicy)r["Rule.TlsPolicy"]=E.Rule.TlsPolicy;if(E.Rule.ScanEnabled!==void 0)r["Rule.ScanEnabled"]=E.Rule.ScanEnabled?"true":"false";if(E.After)r.After=E.After;if(E.Rule.Recipients)E.Rule.Recipients.forEach((t,T)=>{r[`Rule.Recipients.member.${T+1}`]=t});E.Rule.Actions.forEach((t,T)=>{let _=T+1;if(t.S3Action){if(r[`Rule.Actions.member.${_}.S3Action.BucketName`]=t.S3Action.BucketName,t.S3Action.ObjectKeyPrefix)r[`Rule.Actions.member.${_}.S3Action.ObjectKeyPrefix`]=t.S3Action.ObjectKeyPrefix;if(t.S3Action.KmsKeyArn)r[`Rule.Actions.member.${_}.S3Action.KmsKeyArn`]=t.S3Action.KmsKeyArn}if(t.LambdaAction)r[`Rule.Actions.member.${_}.LambdaAction.FunctionArn`]=t.LambdaAction.FunctionArn,r[`Rule.Actions.member.${_}.LambdaAction.InvocationType`]=t.LambdaAction.InvocationType||"Event";if(t.SNSAction){if(r[`Rule.Actions.member.${_}.SNSAction.TopicArn`]=t.SNSAction.TopicArn,t.SNSAction.Encoding)r[`Rule.Actions.member.${_}.SNSAction.Encoding`]=t.SNSAction.Encoding}if(t.StopAction){if(r[`Rule.Actions.member.${_}.StopAction.Scope`]=t.StopAction.Scope,t.StopAction.TopicArn)r[`Rule.Actions.member.${_}.StopAction.TopicArn`]=t.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(r)})}async deleteReceiptRule(E,r){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRule",Version:"2010-12-01",RuleSetName:E,RuleName:r})})}async receiptRuleSetExists(E){try{return await this.describeReceiptRuleSet(E),!0}catch(r){if(r.code==="RuleSetDoesNotExist"||r.statusCode===400)return!1;throw r}}async getActiveReceiptRuleSet(){let E=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeActiveReceiptRuleSet",Version:"2010-12-01"})}),r=E?.DescribeActiveReceiptRuleSetResponse?.DescribeActiveReceiptRuleSetResult||E?.DescribeActiveReceiptRuleSetResult;if(!r?.Metadata)return null;let t=r?.Rules?.member;return{Metadata:r?.Metadata,Rules:Array.isArray(t)?t:t?[t]:[]}}async updateReceiptRule(E){let r={Action:"UpdateReceiptRule",Version:"2010-12-01",RuleSetName:E.RuleSetName,"Rule.Name":E.Rule.Name};if(E.Rule.Enabled!==void 0)r["Rule.Enabled"]=E.Rule.Enabled?"true":"false";if(E.Rule.TlsPolicy)r["Rule.TlsPolicy"]=E.Rule.TlsPolicy;if(E.Rule.ScanEnabled!==void 0)r["Rule.ScanEnabled"]=E.Rule.ScanEnabled?"true":"false";if(E.Rule.Recipients)E.Rule.Recipients.forEach((t,T)=>{r[`Rule.Recipients.member.${T+1}`]=t});E.Rule.Actions.forEach((t,T)=>{let _=T+1;if(t.S3Action){if(r[`Rule.Actions.member.${_}.S3Action.BucketName`]=t.S3Action.BucketName,t.S3Action.ObjectKeyPrefix)r[`Rule.Actions.member.${_}.S3Action.ObjectKeyPrefix`]=t.S3Action.ObjectKeyPrefix;if(t.S3Action.KmsKeyArn)r[`Rule.Actions.member.${_}.S3Action.KmsKeyArn`]=t.S3Action.KmsKeyArn}if(t.LambdaAction)r[`Rule.Actions.member.${_}.LambdaAction.FunctionArn`]=t.LambdaAction.FunctionArn,r[`Rule.Actions.member.${_}.LambdaAction.InvocationType`]=t.LambdaAction.InvocationType||"Event";if(t.SNSAction){if(r[`Rule.Actions.member.${_}.SNSAction.TopicArn`]=t.SNSAction.TopicArn,t.SNSAction.Encoding)r[`Rule.Actions.member.${_}.SNSAction.Encoding`]=t.SNSAction.Encoding}if(t.StopAction){if(r[`Rule.Actions.member.${_}.StopAction.Scope`]=t.StopAction.Scope,t.StopAction.TopicArn)r[`Rule.Actions.member.${_}.StopAction.TopicArn`]=t.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(r)})}async sendRawEmail(E){let r=Buffer.from(E.rawMessage).toString("base64"),t={Action:"SendRawEmail",Version:"2010-12-01",Source:E.source,"RawMessage.Data":r};E.destinations.forEach((d,e)=>{t[`Destinations.member.${e+1}`]=d});let T=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)});return{MessageId:(T?.SendRawEmailResponse?.SendRawEmailResult||T?.SendRawEmailResult)?.MessageId}}async getSuppressedDestination(E){try{return(await this.client.request({service:"ses",region:this.region,method:"GET",path:`/v2/email/suppression/addresses/${encodeURIComponent(E)}`}))?.SuppressedDestination||null}catch(r){if(r.message?.includes("404")||r.message?.includes("NotFoundException"))return null;throw r}}async deleteSuppressedDestination(E){await this.client.request({service:"ses",region:this.region,method:"DELETE",path:`/v2/email/suppression/addresses/${encodeURIComponent(E)}`})}}var JA=$E(()=>{GE()});var yA={};Qr(yA,{email:()=>_M,EmailClient:()=>U0});class U0{ses;s3;iam;route53;region;domain;defaultFrom;constructor(E={}){this.region=E.region||"us-east-1",this.domain=E.domain,this.defaultFrom=E.defaultFrom,this.ses=new ut(this.region),this.s3=new KE(this.region),this.iam=new Lt(this.region),this.route53=new Ot(this.region)}async send(E){let r=E.from||this.defaultFrom;if(!r)throw Error("From address is required. Set defaultFrom in constructor or provide from in options.");let t=E.fromName?`${E.fromName} <${r}>`:r,T=Array.isArray(E.to)?E.to:[E.to];if(!E.attachments||E.attachments.length===0)return{messageId:(await this.ses.sendSimpleEmail({from:t,to:T,subject:E.subject,text:E.text,html:E.html,replyTo:E.replyTo})).MessageId||""};let _=this.buildRawEmail(E,t,T);return{messageId:(await this.ses.sendEmail({FromEmailAddress:t,Destination:{ToAddresses:T,CcAddresses:E.cc?Array.isArray(E.cc)?E.cc:[E.cc]:void 0,BccAddresses:E.bcc?Array.isArray(E.bcc)?E.bcc:[E.bcc]:void 0},Content:{Raw:{Data:Buffer.from(_).toString("base64")}}})).MessageId||""}}async sendTemplate(E){let r=E.from||this.defaultFrom;if(!r)throw Error("From address is required");let t=E.fromName?`${E.fromName} <${r}>`:r;return{messageId:(await this.ses.sendTemplatedEmail({from:t,to:E.to,templateName:E.templateName,templateData:E.templateData,replyTo:E.replyTo})).MessageId||""}}async sendBulk(E){let r=E.from||this.defaultFrom;if(!r)throw Error("From address is required");let t=E.recipients.map((_)=>({Destination:{ToAddresses:Array.isArray(_.to)?_.to:[_.to]},ReplacementEmailContent:_.templateData?{ReplacementTemplate:{ReplacementTemplateData:JSON.stringify(_.templateData)}}:void 0}));return{results:(await this.ses.sendBulkEmail({FromEmailAddress:r,BulkEmailEntries:t,DefaultContent:{Template:{TemplateName:E.templateName,TemplateData:JSON.stringify(E.defaultTemplateData)}}})).BulkEmailEntryResults?.map((_)=>({status:_.Status||"UNKNOWN",messageId:_.MessageId,error:_.Error}))||[]}}async setupDomain(E){let r;try{r=await this.ses.getEmailIdentity(E)}catch{let T=await this.ses.createEmailIdentity({EmailIdentity:E});r={VerificationStatus:T.DkimAttributes?.Status,DkimAttributes:T.DkimAttributes,SendingEnabled:T.VerifiedForSendingStatus}}try{await this.ses.putEmailIdentityDkimAttributes({EmailIdentity:E,SigningEnabled:!0})}catch{}try{await this.ses.putEmailIdentityMailFromAttributes(E,{MailFromDomain:`mail.${E}`,BehaviorOnMxFailure:"USE_DEFAULT_VALUE"})}catch{}let t=await this.ses.getDkimRecords(E);return{domainVerified:r.SendingEnabled===!0,dkimStatus:r.DkimAttributes?.Status||"UNKNOWN",dkimTokens:r.DkimAttributes?.Tokens,mailFromStatus:r.MailFromAttributes?.MailFromDomainStatus}}async getDnsRecords(E){let r=[],t=await this.ses.getDkimRecords(E);for(let T of t)r.push({type:T.type,name:T.name,value:T.value,ttl:1800});return r.push({type:"MX",name:E,value:`inbound-smtp.${this.region}.amazonaws.com`,priority:10,ttl:3600}),r.push({type:"MX",name:`mail.${E}`,value:`feedback-smtp.${this.region}.amazonses.com`,priority:10,ttl:3600}),r.push({type:"TXT",name:`mail.${E}`,value:"v=spf1 include:amazonses.com ~all",ttl:3600}),r.push({type:"TXT",name:`_dmarc.${E}`,value:`v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${E}`,ttl:3600}),r}async isDomainReady(E){try{let r=await this.ses.getEmailIdentity(E);return r.SendingEnabled===!0&&r.DkimAttributes?.Status==="SUCCESS"}catch{return!1}}async setupReceiving(E){let r={Version:"2012-10-17",Statement:[{Sid:"AllowSESPuts",Effect:"Allow",Principal:{Service:"ses.amazonaws.com"},Action:"s3:PutObject",Resource:`arn:aws:s3:::${E.bucketName}/*`,Condition:{StringEquals:{"AWS:SourceAccount":E.accountId}}}]};await this.s3.putBucketPolicy(E.bucketName,r);try{await this.ses.createReceiptRuleSet(E.ruleSetName)}catch(T){if(!T.message?.includes("already exists")&&T.code!=="AlreadyExists")throw T}let t=[{S3Action:{BucketName:E.bucketName,ObjectKeyPrefix:E.prefix||"inbox/"}}];if(E.lambdaArn)t.push({LambdaAction:{FunctionArn:E.lambdaArn,InvocationType:"Event"}});try{await this.ses.createReceiptRule({RuleSetName:E.ruleSetName,Rule:{Name:E.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:E.recipients||[E.domain],ScanEnabled:E.scanEnabled!==!1,Actions:t}})}catch(T){if(T.message?.includes("already exists"))await this.ses.deleteReceiptRule(E.ruleSetName,E.ruleName),await this.ses.createReceiptRule({RuleSetName:E.ruleSetName,Rule:{Name:E.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:E.recipients||[E.domain],ScanEnabled:E.scanEnabled!==!1,Actions:t}});else throw T}await this.ses.setActiveReceiptRuleSet(E.ruleSetName)}async getIncomingEmails(E){return(await this.s3.list({bucket:E.bucket,prefix:E.prefix||"incoming/",maxKeys:E.maxResults||100})).map((t)=>({key:t.Key||"",lastModified:t.LastModified||"",size:t.Size||0}))}async readEmail(E){return await this.s3.getObject(E.bucket,E.key)}async createSmtpCredentials(E){let r=`ses-smtp-${E.username.replace(/[^a-zA-Z0-9]/g,"-")}`,{AWSClient:t}=await Promise.resolve().then(() => (GE(),re)),T=new t,_=(A,S)=>{let L={Action:A,Version:"2010-05-08",...S};return Object.entries(L).map(([O,I])=>`${encodeURIComponent(O)}=${encodeURIComponent(I)}`).join("&")};try{await T.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:_("CreateUser",{UserName:r})})}catch(A){if(!A.message?.includes("EntityAlreadyExists"))throw A}let d={Version:"2012-10-17",Statement:[{Effect:"Allow",Action:"ses:SendRawEmail",Resource:"*",Condition:{StringLike:{"ses:FromAddress":`*@${E.domain}`}}}]},e=`ses-smtp-policy-${E.domain.replace(/\./g,"-")}`;try{await T.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:_("PutUserPolicy",{UserName:r,PolicyName:e,PolicyDocument:JSON.stringify(d)})})}catch{}let R=(await T.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:_("CreateAccessKey",{UserName:r})}))?.CreateAccessKeyResult?.AccessKey;if(!R?.AccessKeyId||!R?.SecretAccessKey)throw Error("Failed to create access key");let N=this.deriveSmtpPassword(R.SecretAccessKey);return{username:R.AccessKeyId,password:N,server:`email-smtp.${this.region}.amazonaws.com`,port:587}}deriveSmtpPassword(E){let r=xE("node:crypto"),t="SendRawEmail",T=Buffer.from([4]),_=r.createHmac("sha256",`AWS4${E}`).update("11111111").digest();return _=r.createHmac("sha256",_).update(this.region).digest(),_=r.createHmac("sha256",_).update("ses").digest(),_=r.createHmac("sha256",_).update("aws4_request").digest(),_=r.createHmac("sha256",_).update("SendRawEmail").digest(),Buffer.concat([T,_]).toString("base64")}async createTemplate(E){await this.ses.createEmailTemplate({TemplateName:E.name,TemplateContent:{Subject:E.subject,Text:E.text,Html:E.html}})}async getTemplate(E){try{let r=await this.ses.getEmailTemplate(E);return{name:r.TemplateName||E,subject:r.TemplateContent?.Subject,text:r.TemplateContent?.Text,html:r.TemplateContent?.Html}}catch{return null}}async deleteTemplate(E){await this.ses.deleteEmailTemplate(E)}async listTemplates(){return(await this.ses.listEmailTemplates()).TemplatesMetadata?.map((r)=>({name:r.TemplateName||"",createdAt:r.CreatedTimestamp}))||[]}async deploy(E){let r=`${E.appName}-${E.environment}-email-rules`,t=`${E.appName}-inbound-email`,T=E.storage?.bucketName||`${E.appName}-${E.environment}-email`,_=await this.setupDomain(E.domain);if(!(await this.s3.listBuckets()).Buckets?.some((R)=>R.Name===T))await this.s3.createBucket(T);await this.setupReceiving({domain:E.domain,ruleSetName:r,ruleName:t,bucketName:T,prefix:E.storage?.prefix||"inbox/",accountId:E.accountId,recipients:E.catchAll?[E.domain]:E.mailboxes,scanEnabled:!0});let h=await this.getDnsRecords(E.domain);return{success:!0,domainVerified:_.domainVerified,dkimStatus:_.dkimStatus,receiptRuleSet:r,storageBucket:T,dnsRecords:h}}async undeploy(E){let r=`${E.appName}-${E.environment}-email-rules`,t=`${E.appName}-inbound-email`,T=`${E.appName}-${E.environment}-email`;try{await this.ses.deleteReceiptRule(r,t)}catch{}try{await this.ses.deleteReceiptRuleSet(r)}catch{}if(E.deleteBucket)try{await this.s3.emptyAndDeleteBucket(T)}catch{}}async getSendingStats(){let E=await this.ses.getSendQuota();return{sentLast24Hours:E.SentLast24Hours||0,maxSendRate:E.MaxSendRate||0,max24HourSend:E.Max24HourSend||0}}buildRawEmail(E,r,t){let T=`----=_Part_${Date.now()}_${Math.random().toString(36).substring(2)}`,_="";if(_+=`From: ${r}\r
+</Delete>`,T=HE.createHash("md5").update(t).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${E}`,queryParams:{delete:""},body:t,headers:{"Content-Type":"application/xml","Content-MD5":T}})}}var Cr=$E(()=>{GE()});class ut{client;region;constructor(E="us-east-1",r){this.region=E,this.client=new wE(r)}async createEmailIdentity(E){return await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/identities",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})}async getEmailIdentity(E){let r=await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/identities/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}});return{IdentityType:r.IdentityType,IdentityName:E,SendingEnabled:r.VerifiedForSendingStatus,VerificationStatus:r.VerificationStatus,DkimAttributes:r.DkimAttributes,MailFromAttributes:r.MailFromAttributes}}async putEmailIdentityMailFromAttributes(E,r){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(E)}/mail-from`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async listEmailIdentities(E){let r="/v2/email/identities",t=[];if(E?.PageSize)t.push(`PageSize=${E.PageSize}`);if(E?.NextToken)t.push(`NextToken=${encodeURIComponent(E.NextToken)}`);if(t.length>0)r+=`?${t.join("&")}`;let T=await this.client.request({service:"email",region:this.region,method:"GET",path:r,headers:{"Content-Type":"application/json"}});return{EmailIdentities:T.EmailIdentities,NextToken:T.NextToken}}async deleteEmailIdentity(E){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/identities/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async putEmailIdentityDkimAttributes(E){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(E.EmailIdentity)}/dkim`,headers:{"Content-Type":"application/json"},body:JSON.stringify({SigningEnabled:E.SigningEnabled})})}async sendEmail(E){return{MessageId:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})).MessageId}}async sendBulkEmail(E){return{BulkEmailEntryResults:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-bulk-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})).BulkEmailEntryResults}}async createEmailTemplate(E){await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/templates",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})}async getEmailTemplate(E){return await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/templates/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async deleteEmailTemplate(E){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/templates/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async listEmailTemplates(E){let r="/v2/email/templates",t=[];if(E?.PageSize)t.push(`PageSize=${E.PageSize}`);if(E?.NextToken)t.push(`NextToken=${encodeURIComponent(E.NextToken)}`);if(t.length>0)r+=`?${t.join("&")}`;return await this.client.request({service:"email",region:this.region,method:"GET",path:r,headers:{"Content-Type":"application/json"}})}async getSendStatistics(){return{SendDataPoints:(await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendStatistics&Version=2010-12-01"})).GetSendStatisticsResponse?.GetSendStatisticsResult?.SendDataPoints?.member}}async getSendQuota(){let r=(await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendQuota&Version=2010-12-01"})).GetSendQuotaResponse?.GetSendQuotaResult;return{Max24HourSend:r?.Max24HourSend?Number(r.Max24HourSend):void 0,MaxSendRate:r?.MaxSendRate?Number(r.MaxSendRate):void 0,SentLast24Hours:r?.SentLast24Hours?Number(r.SentLast24Hours):void 0}}async verifyDomain(E){let r=await this.createEmailIdentity({EmailIdentity:E});return{dkimTokens:r.DkimAttributes?.Tokens,verificationStatus:r.DkimAttributes?.Status}}async sendSimpleEmail(E){let r=Array.isArray(E.to)?E.to:[E.to],t=E.replyTo?Array.isArray(E.replyTo)?E.replyTo:[E.replyTo]:void 0,T={};if(E.text)T.Text={Data:E.text};if(E.html)T.Html={Data:E.html};return this.sendEmail({FromEmailAddress:E.from,Destination:{ToAddresses:r},Content:{Simple:{Subject:{Data:E.subject},Body:T}},ReplyToAddresses:t})}async sendTemplatedEmail(E){let r=Array.isArray(E.to)?E.to:[E.to],t=E.replyTo?Array.isArray(E.replyTo)?E.replyTo:[E.replyTo]:void 0;return this.sendEmail({FromEmailAddress:E.from,Destination:{ToAddresses:r},Content:{Template:{TemplateName:E.templateName,TemplateData:JSON.stringify(E.templateData)}},ReplyToAddresses:t})}async getDkimRecords(E){let r=await this.getEmailIdentity(E);if(!r.DkimAttributes?.Tokens)return[];return r.DkimAttributes.Tokens.map((t)=>({name:`${t}._domainkey.${E}`,type:"CNAME",value:`${t}.dkim.amazonses.com`}))}async isDomainVerified(E){try{let r=await this.getEmailIdentity(E);return r.VerificationStatus==="SUCCESS"&&r.SendingEnabled===!0}catch{return!1}}async waitForDomainVerification(E,r=60,t=30000){for(let T=0;T<r;T++){if(await this.isDomainVerified(E))return!0;await new Promise((d)=>setTimeout(d,t))}return!1}buildFormBody(E){return Object.entries(E).filter(([,t])=>t!==void 0).map(([t,T])=>`${encodeURIComponent(t)}=${encodeURIComponent(T)}`).join("&")}async createReceiptRuleSet(E){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})})}async deleteReceiptRuleSet(E){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})})}async setActiveReceiptRuleSet(E){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetActiveReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})})}async listReceiptRuleSets(E){let r={Action:"ListReceiptRuleSets",Version:"2010-12-01"};if(E)r.NextToken=E;let t=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(r)}),T=t?.ListReceiptRuleSetsResponse?.ListReceiptRuleSetsResult||t?.ListReceiptRuleSetsResult,_=T?.RuleSets?.member;return{RuleSets:Array.isArray(_)?_:_?[_]:[],NextToken:T?.NextToken}}async describeReceiptRuleSet(E){let r=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})}),t=r?.DescribeReceiptRuleSetResponse?.DescribeReceiptRuleSetResult||r?.DescribeReceiptRuleSetResult,T=t?.Rules?.member;return{Metadata:t?.Metadata,Rules:Array.isArray(T)?T:T?[T]:[]}}async createReceiptRule(E){let r={Action:"CreateReceiptRule",Version:"2010-12-01",RuleSetName:E.RuleSetName,"Rule.Name":E.Rule.Name,"Rule.Enabled":E.Rule.Enabled!==!1?"true":"false"};if(E.Rule.TlsPolicy)r["Rule.TlsPolicy"]=E.Rule.TlsPolicy;if(E.Rule.ScanEnabled!==void 0)r["Rule.ScanEnabled"]=E.Rule.ScanEnabled?"true":"false";if(E.After)r.After=E.After;if(E.Rule.Recipients)E.Rule.Recipients.forEach((t,T)=>{r[`Rule.Recipients.member.${T+1}`]=t});E.Rule.Actions.forEach((t,T)=>{let _=T+1;if(t.S3Action){if(r[`Rule.Actions.member.${_}.S3Action.BucketName`]=t.S3Action.BucketName,t.S3Action.ObjectKeyPrefix)r[`Rule.Actions.member.${_}.S3Action.ObjectKeyPrefix`]=t.S3Action.ObjectKeyPrefix;if(t.S3Action.KmsKeyArn)r[`Rule.Actions.member.${_}.S3Action.KmsKeyArn`]=t.S3Action.KmsKeyArn}if(t.LambdaAction)r[`Rule.Actions.member.${_}.LambdaAction.FunctionArn`]=t.LambdaAction.FunctionArn,r[`Rule.Actions.member.${_}.LambdaAction.InvocationType`]=t.LambdaAction.InvocationType||"Event";if(t.SNSAction){if(r[`Rule.Actions.member.${_}.SNSAction.TopicArn`]=t.SNSAction.TopicArn,t.SNSAction.Encoding)r[`Rule.Actions.member.${_}.SNSAction.Encoding`]=t.SNSAction.Encoding}if(t.StopAction){if(r[`Rule.Actions.member.${_}.StopAction.Scope`]=t.StopAction.Scope,t.StopAction.TopicArn)r[`Rule.Actions.member.${_}.StopAction.TopicArn`]=t.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(r)})}async deleteReceiptRule(E,r){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRule",Version:"2010-12-01",RuleSetName:E,RuleName:r})})}async receiptRuleSetExists(E){try{return await this.describeReceiptRuleSet(E),!0}catch(r){if(r.code==="RuleSetDoesNotExist"||r.statusCode===400)return!1;throw r}}async getActiveReceiptRuleSet(){let E=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeActiveReceiptRuleSet",Version:"2010-12-01"})}),r=E?.DescribeActiveReceiptRuleSetResponse?.DescribeActiveReceiptRuleSetResult||E?.DescribeActiveReceiptRuleSetResult;if(!r?.Metadata)return null;let t=r?.Rules?.member;return{Metadata:r?.Metadata,Rules:Array.isArray(t)?t:t?[t]:[]}}async updateReceiptRule(E){let r={Action:"UpdateReceiptRule",Version:"2010-12-01",RuleSetName:E.RuleSetName,"Rule.Name":E.Rule.Name};if(E.Rule.Enabled!==void 0)r["Rule.Enabled"]=E.Rule.Enabled?"true":"false";if(E.Rule.TlsPolicy)r["Rule.TlsPolicy"]=E.Rule.TlsPolicy;if(E.Rule.ScanEnabled!==void 0)r["Rule.ScanEnabled"]=E.Rule.ScanEnabled?"true":"false";if(E.Rule.Recipients)E.Rule.Recipients.forEach((t,T)=>{r[`Rule.Recipients.member.${T+1}`]=t});E.Rule.Actions.forEach((t,T)=>{let _=T+1;if(t.S3Action){if(r[`Rule.Actions.member.${_}.S3Action.BucketName`]=t.S3Action.BucketName,t.S3Action.ObjectKeyPrefix)r[`Rule.Actions.member.${_}.S3Action.ObjectKeyPrefix`]=t.S3Action.ObjectKeyPrefix;if(t.S3Action.KmsKeyArn)r[`Rule.Actions.member.${_}.S3Action.KmsKeyArn`]=t.S3Action.KmsKeyArn}if(t.LambdaAction)r[`Rule.Actions.member.${_}.LambdaAction.FunctionArn`]=t.LambdaAction.FunctionArn,r[`Rule.Actions.member.${_}.LambdaAction.InvocationType`]=t.LambdaAction.InvocationType||"Event";if(t.SNSAction){if(r[`Rule.Actions.member.${_}.SNSAction.TopicArn`]=t.SNSAction.TopicArn,t.SNSAction.Encoding)r[`Rule.Actions.member.${_}.SNSAction.Encoding`]=t.SNSAction.Encoding}if(t.StopAction){if(r[`Rule.Actions.member.${_}.StopAction.Scope`]=t.StopAction.Scope,t.StopAction.TopicArn)r[`Rule.Actions.member.${_}.StopAction.TopicArn`]=t.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(r)})}async sendRawEmail(E){let r=Buffer.from(E.rawMessage).toString("base64"),t={Action:"SendRawEmail",Version:"2010-12-01",Source:E.source,"RawMessage.Data":r};E.destinations.forEach((d,e)=>{t[`Destinations.member.${e+1}`]=d});let T=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)});return{MessageId:(T?.SendRawEmailResponse?.SendRawEmailResult||T?.SendRawEmailResult)?.MessageId}}async getSuppressedDestination(E){try{return(await this.client.request({service:"ses",region:this.region,method:"GET",path:`/v2/email/suppression/addresses/${encodeURIComponent(E)}`}))?.SuppressedDestination||null}catch(r){if(r.message?.includes("404")||r.message?.includes("NotFoundException"))return null;throw r}}async deleteSuppressedDestination(E){await this.client.request({service:"ses",region:this.region,method:"DELETE",path:`/v2/email/suppression/addresses/${encodeURIComponent(E)}`})}}var JA=$E(()=>{GE()});var yA={};Qr(yA,{email:()=>_8,EmailClient:()=>U0});class U0{ses;s3;iam;route53;region;domain;defaultFrom;constructor(E={}){this.region=E.region||"us-east-1",this.domain=E.domain,this.defaultFrom=E.defaultFrom,this.ses=new ut(this.region),this.s3=new KE(this.region),this.iam=new Lt(this.region),this.route53=new Ot(this.region)}async send(E){let r=E.from||this.defaultFrom;if(!r)throw Error("From address is required. Set defaultFrom in constructor or provide from in options.");let t=E.fromName?`${E.fromName} <${r}>`:r,T=Array.isArray(E.to)?E.to:[E.to];if(!E.attachments||E.attachments.length===0)return{messageId:(await this.ses.sendSimpleEmail({from:t,to:T,subject:E.subject,text:E.text,html:E.html,replyTo:E.replyTo})).MessageId||""};let _=this.buildRawEmail(E,t,T);return{messageId:(await this.ses.sendEmail({FromEmailAddress:t,Destination:{ToAddresses:T,CcAddresses:E.cc?Array.isArray(E.cc)?E.cc:[E.cc]:void 0,BccAddresses:E.bcc?Array.isArray(E.bcc)?E.bcc:[E.bcc]:void 0},Content:{Raw:{Data:Buffer.from(_).toString("base64")}}})).MessageId||""}}async sendTemplate(E){let r=E.from||this.defaultFrom;if(!r)throw Error("From address is required");let t=E.fromName?`${E.fromName} <${r}>`:r;return{messageId:(await this.ses.sendTemplatedEmail({from:t,to:E.to,templateName:E.templateName,templateData:E.templateData,replyTo:E.replyTo})).MessageId||""}}async sendBulk(E){let r=E.from||this.defaultFrom;if(!r)throw Error("From address is required");let t=E.recipients.map((_)=>({Destination:{ToAddresses:Array.isArray(_.to)?_.to:[_.to]},ReplacementEmailContent:_.templateData?{ReplacementTemplate:{ReplacementTemplateData:JSON.stringify(_.templateData)}}:void 0}));return{results:(await this.ses.sendBulkEmail({FromEmailAddress:r,BulkEmailEntries:t,DefaultContent:{Template:{TemplateName:E.templateName,TemplateData:JSON.stringify(E.defaultTemplateData)}}})).BulkEmailEntryResults?.map((_)=>({status:_.Status||"UNKNOWN",messageId:_.MessageId,error:_.Error}))||[]}}async setupDomain(E){let r;try{r=await this.ses.getEmailIdentity(E)}catch{let T=await this.ses.createEmailIdentity({EmailIdentity:E});r={VerificationStatus:T.DkimAttributes?.Status,DkimAttributes:T.DkimAttributes,SendingEnabled:T.VerifiedForSendingStatus}}try{await this.ses.putEmailIdentityDkimAttributes({EmailIdentity:E,SigningEnabled:!0})}catch{}try{await this.ses.putEmailIdentityMailFromAttributes(E,{MailFromDomain:`mail.${E}`,BehaviorOnMxFailure:"USE_DEFAULT_VALUE"})}catch{}let t=await this.ses.getDkimRecords(E);return{domainVerified:r.SendingEnabled===!0,dkimStatus:r.DkimAttributes?.Status||"UNKNOWN",dkimTokens:r.DkimAttributes?.Tokens,mailFromStatus:r.MailFromAttributes?.MailFromDomainStatus}}async getDnsRecords(E){let r=[],t=await this.ses.getDkimRecords(E);for(let T of t)r.push({type:T.type,name:T.name,value:T.value,ttl:1800});return r.push({type:"MX",name:E,value:`inbound-smtp.${this.region}.amazonaws.com`,priority:10,ttl:3600}),r.push({type:"MX",name:`mail.${E}`,value:`feedback-smtp.${this.region}.amazonses.com`,priority:10,ttl:3600}),r.push({type:"TXT",name:`mail.${E}`,value:"v=spf1 include:amazonses.com ~all",ttl:3600}),r.push({type:"TXT",name:`_dmarc.${E}`,value:`v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${E}`,ttl:3600}),r}async isDomainReady(E){try{let r=await this.ses.getEmailIdentity(E);return r.SendingEnabled===!0&&r.DkimAttributes?.Status==="SUCCESS"}catch{return!1}}async setupReceiving(E){let r={Version:"2012-10-17",Statement:[{Sid:"AllowSESPuts",Effect:"Allow",Principal:{Service:"ses.amazonaws.com"},Action:"s3:PutObject",Resource:`arn:aws:s3:::${E.bucketName}/*`,Condition:{StringEquals:{"AWS:SourceAccount":E.accountId}}}]};await this.s3.putBucketPolicy(E.bucketName,r);try{await this.ses.createReceiptRuleSet(E.ruleSetName)}catch(T){if(!T.message?.includes("already exists")&&T.code!=="AlreadyExists")throw T}let t=[{S3Action:{BucketName:E.bucketName,ObjectKeyPrefix:E.prefix||"inbox/"}}];if(E.lambdaArn)t.push({LambdaAction:{FunctionArn:E.lambdaArn,InvocationType:"Event"}});try{await this.ses.createReceiptRule({RuleSetName:E.ruleSetName,Rule:{Name:E.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:E.recipients||[E.domain],ScanEnabled:E.scanEnabled!==!1,Actions:t}})}catch(T){if(T.message?.includes("already exists"))await this.ses.deleteReceiptRule(E.ruleSetName,E.ruleName),await this.ses.createReceiptRule({RuleSetName:E.ruleSetName,Rule:{Name:E.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:E.recipients||[E.domain],ScanEnabled:E.scanEnabled!==!1,Actions:t}});else throw T}await this.ses.setActiveReceiptRuleSet(E.ruleSetName)}async getIncomingEmails(E){return(await this.s3.list({bucket:E.bucket,prefix:E.prefix||"incoming/",maxKeys:E.maxResults||100})).map((t)=>({key:t.Key||"",lastModified:t.LastModified||"",size:t.Size||0}))}async readEmail(E){return await this.s3.getObject(E.bucket,E.key)}async createSmtpCredentials(E){let r=`ses-smtp-${E.username.replace(/[^a-zA-Z0-9]/g,"-")}`,{AWSClient:t}=await Promise.resolve().then(() => (GE(),re)),T=new t,_=(A,S)=>{let L={Action:A,Version:"2010-05-08",...S};return Object.entries(L).map(([O,I])=>`${encodeURIComponent(O)}=${encodeURIComponent(I)}`).join("&")};try{await T.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:_("CreateUser",{UserName:r})})}catch(A){if(!A.message?.includes("EntityAlreadyExists"))throw A}let d={Version:"2012-10-17",Statement:[{Effect:"Allow",Action:"ses:SendRawEmail",Resource:"*",Condition:{StringLike:{"ses:FromAddress":`*@${E.domain}`}}}]},e=`ses-smtp-policy-${E.domain.replace(/\./g,"-")}`;try{await T.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:_("PutUserPolicy",{UserName:r,PolicyName:e,PolicyDocument:JSON.stringify(d)})})}catch{}let R=(await T.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:_("CreateAccessKey",{UserName:r})}))?.CreateAccessKeyResult?.AccessKey;if(!R?.AccessKeyId||!R?.SecretAccessKey)throw Error("Failed to create access key");let N=this.deriveSmtpPassword(R.SecretAccessKey);return{username:R.AccessKeyId,password:N,server:`email-smtp.${this.region}.amazonaws.com`,port:587}}deriveSmtpPassword(E){let r=xE("node:crypto"),t="SendRawEmail",T=Buffer.from([4]),_=r.createHmac("sha256",`AWS4${E}`).update("11111111").digest();return _=r.createHmac("sha256",_).update(this.region).digest(),_=r.createHmac("sha256",_).update("ses").digest(),_=r.createHmac("sha256",_).update("aws4_request").digest(),_=r.createHmac("sha256",_).update("SendRawEmail").digest(),Buffer.concat([T,_]).toString("base64")}async createTemplate(E){await this.ses.createEmailTemplate({TemplateName:E.name,TemplateContent:{Subject:E.subject,Text:E.text,Html:E.html}})}async getTemplate(E){try{let r=await this.ses.getEmailTemplate(E);return{name:r.TemplateName||E,subject:r.TemplateContent?.Subject,text:r.TemplateContent?.Text,html:r.TemplateContent?.Html}}catch{return null}}async deleteTemplate(E){await this.ses.deleteEmailTemplate(E)}async listTemplates(){return(await this.ses.listEmailTemplates()).TemplatesMetadata?.map((r)=>({name:r.TemplateName||"",createdAt:r.CreatedTimestamp}))||[]}async deploy(E){let r=`${E.appName}-${E.environment}-email-rules`,t=`${E.appName}-inbound-email`,T=E.storage?.bucketName||`${E.appName}-${E.environment}-email`,_=await this.setupDomain(E.domain);if(!(await this.s3.listBuckets()).Buckets?.some((R)=>R.Name===T))await this.s3.createBucket(T);await this.setupReceiving({domain:E.domain,ruleSetName:r,ruleName:t,bucketName:T,prefix:E.storage?.prefix||"inbox/",accountId:E.accountId,recipients:E.catchAll?[E.domain]:E.mailboxes,scanEnabled:!0});let h=await this.getDnsRecords(E.domain);return{success:!0,domainVerified:_.domainVerified,dkimStatus:_.dkimStatus,receiptRuleSet:r,storageBucket:T,dnsRecords:h}}async undeploy(E){let r=`${E.appName}-${E.environment}-email-rules`,t=`${E.appName}-inbound-email`,T=`${E.appName}-${E.environment}-email`;try{await this.ses.deleteReceiptRule(r,t)}catch{}try{await this.ses.deleteReceiptRuleSet(r)}catch{}if(E.deleteBucket)try{await this.s3.emptyAndDeleteBucket(T)}catch{}}async getSendingStats(){let E=await this.ses.getSendQuota();return{sentLast24Hours:E.SentLast24Hours||0,maxSendRate:E.MaxSendRate||0,max24HourSend:E.Max24HourSend||0}}buildRawEmail(E,r,t){let T=`----=_Part_${Date.now()}_${Math.random().toString(36).substring(2)}`,_="";if(_+=`From: ${r}\r
 `,_+=`To: ${t.join(", ")}\r
 `,E.cc){let d=Array.isArray(E.cc)?E.cc:[E.cc];_+=`Cc: ${d.join(", ")}\r
 `}if(_+=`Subject: ${E.subject}\r
@@ -178,13 +178,13 @@ host:${e}
 `,_+=`\r
 `,_+=`${d.content}\r
 `;return _+=`--${T}--\r
-`,_}}var _M;var $R=$E(()=>{UR();Eh();Cr();JA();_M=new U0});class ct{client;region;constructor(E="us-east-1",r){this.region=E,this.client=new wE}async createSecret(E){let r={Name:E.Name};if(E.Description)r.Description=E.Description;if(E.KmsKeyId)r.KmsKeyId=E.KmsKeyId;if(E.SecretBinary)r.SecretBinary=E.SecretBinary;if(E.SecretString)r.SecretString=E.SecretString;if(E.Tags&&E.Tags.length>0)r.Tags=E.Tags;if(E.AddReplicaRegions&&E.AddReplicaRegions.length>0)r.AddReplicaRegions=E.AddReplicaRegions;if(E.ForceOverwriteReplicaSecret!==void 0)r.ForceOverwriteReplicaSecret=E.ForceOverwriteReplicaSecret;r.ClientRequestToken=E.ClientRequestToken||crypto.randomUUID();let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CreateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,VersionId:t.VersionId,ReplicationStatus:t.ReplicationStatus}}async updateSecret(E){let r={SecretId:E.SecretId};if(E.Description)r.Description=E.Description;if(E.KmsKeyId)r.KmsKeyId=E.KmsKeyId;if(E.SecretBinary)r.SecretBinary=E.SecretBinary;if(E.SecretString)r.SecretString=E.SecretString;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UpdateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,VersionId:t.VersionId}}async putSecretValue(E){let r={SecretId:E.SecretId};if(E.SecretBinary)r.SecretBinary=E.SecretBinary;if(E.SecretString)r.SecretString=E.SecretString;if(E.VersionStages&&E.VersionStages.length>0)r.VersionStages=E.VersionStages;if(E.ClientRequestToken)r.ClientRequestToken=E.ClientRequestToken;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,VersionId:t.VersionId,VersionStages:t.VersionStages}}async getSecretValue(E){let r={SecretId:E.SecretId};if(E.VersionId)r.VersionId=E.VersionId;if(E.VersionStage)r.VersionStage=E.VersionStage;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,VersionId:t.VersionId,SecretBinary:t.SecretBinary,SecretString:t.SecretString,VersionStages:t.VersionStages,CreatedDate:t.CreatedDate}}async describeSecret(E){let r={SecretId:E},t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DescribeSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return this.parseSecret(t)}async listSecrets(E){let r={};if(E?.MaxResults)r.MaxResults=E.MaxResults;if(E?.NextToken)r.NextToken=E.NextToken;if(E?.Filters&&E.Filters.length>0)r.Filters=E.Filters;if(E?.SortOrder)r.SortOrder=E.SortOrder;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.ListSecrets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{SecretList:t.SecretList?.map((T)=>this.parseSecret(T)),NextToken:t.NextToken}}async deleteSecret(E){let r={SecretId:E.SecretId};if(E.RecoveryWindowInDays!==void 0)r.RecoveryWindowInDays=E.RecoveryWindowInDays;if(E.ForceDeleteWithoutRecovery!==void 0)r.ForceDeleteWithoutRecovery=E.ForceDeleteWithoutRecovery;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,DeletionDate:t.DeletionDate}}async restoreSecret(E){let r={SecretId:E},t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RestoreSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name}}async rotateSecret(E){let r={SecretId:E.SecretId};if(E.ClientRequestToken)r.ClientRequestToken=E.ClientRequestToken;if(E.RotationLambdaARN)r.RotationLambdaARN=E.RotationLambdaARN;if(E.RotationRules)r.RotationRules=E.RotationRules;if(E.RotateImmediately!==void 0)r.RotateImmediately=E.RotateImmediately;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,VersionId:t.VersionId}}async cancelRotateSecret(E){let r={SecretId:E},t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CancelRotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name}}async getResourcePolicy(E){let r={SecretId:E},t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,ResourcePolicy:t.ResourcePolicy}}async putResourcePolicy(E){let r={SecretId:E.SecretId,ResourcePolicy:E.ResourcePolicy};if(E.BlockPublicPolicy!==void 0)r.BlockPublicPolicy=E.BlockPublicPolicy;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name}}async deleteResourcePolicy(E){let r={SecretId:E},t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name}}async tagResource(E){let r={SecretId:E.SecretId,Tags:E.Tags};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async untagResource(E){let r={SecretId:E.SecretId,TagKeys:E.TagKeys};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UntagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async setString(E,r,t){try{let T=await this.putSecretValue({SecretId:E,SecretString:r});return{ARN:T.ARN,VersionId:T.VersionId}}catch(T){if(T.code==="ResourceNotFoundException"){let _=await this.createSecret({Name:E,SecretString:r,Description:t?.description,KmsKeyId:t?.kmsKeyId,Tags:t?.tags});return{ARN:_.ARN,VersionId:_.VersionId}}throw T}}async setJson(E,r,t){return this.setString(E,JSON.stringify(r),t)}async getString(E){return(await this.getSecretValue({SecretId:E})).SecretString}async getJson(E){let r=await this.getString(E);if(r)return JSON.parse(r);return}async listAll(){let E=[],r;do{let t=await this.listSecrets({NextToken:r});if(t.SecretList)E.push(...t.SecretList);r=t.NextToken}while(r);return E}parseSecret(E){return{ARN:E.ARN,Name:E.Name,Description:E.Description,KmsKeyId:E.KmsKeyId,RotationEnabled:E.RotationEnabled,RotationLambdaARN:E.RotationLambdaARN,RotationRules:E.RotationRules,LastRotatedDate:E.LastRotatedDate,LastChangedDate:E.LastChangedDate,LastAccessedDate:E.LastAccessedDate,DeletedDate:E.DeletedDate,NextRotationDate:E.NextRotationDate,Tags:E.Tags,SecretVersionsToStages:E.SecretVersionsToStages,CreatedDate:E.CreatedDate,PrimaryRegion:E.PrimaryRegion}}}var rh=$E(()=>{GE()});class Td{client;region;constructor(E="us-east-1",r){this.region=E,this.client=new wE}async putParameter(E){let r={Name:E.Name,Value:E.Value};if(E.Type)r.Type=E.Type;if(E.Description)r.Description=E.Description;if(E.KeyId)r.KeyId=E.KeyId;if(E.Overwrite!==void 0)r.Overwrite=E.Overwrite;if(E.AllowedPattern)r.AllowedPattern=E.AllowedPattern;if(E.Tags&&E.Tags.length>0)r.Tags=E.Tags;if(E.Tier)r.Tier=E.Tier;if(E.DataType)r.DataType=E.DataType;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.PutParameter","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Version:t.Version,Tier:t.Tier}}async getParameter(E){let r={Name:E.Name};if(E.WithDecryption!==void 0)r.WithDecryption=E.WithDecryption;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.GetParameter","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Parameter:t.Parameter?this.parseParameter(t.Parameter):void 0}}async getParameters(E){let r={Names:E.Names};if(E.WithDecryption!==void 0)r.WithDecryption=E.WithDecryption;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.GetParameters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Parameters:t.Parameters?.map((T)=>this.parseParameter(T)),InvalidParameters:t.InvalidParameters}}async getParametersByPath(E){let r={Path:E.Path};if(E.Recursive!==void 0)r.Recursive=E.Recursive;if(E.WithDecryption!==void 0)r.WithDecryption=E.WithDecryption;if(E.MaxResults)r.MaxResults=E.MaxResults;if(E.NextToken)r.NextToken=E.NextToken;if(E.ParameterFilters&&E.ParameterFilters.length>0)r.ParameterFilters=E.ParameterFilters;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.GetParametersByPath","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Parameters:t.Parameters?.map((T)=>this.parseParameter(T)),NextToken:t.NextToken}}async deleteParameter(E){let r={Name:E.Name};await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.DeleteParameter","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async deleteParameters(E){let r={Names:E},t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.DeleteParameters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{DeletedParameters:t.DeletedParameters,InvalidParameters:t.InvalidParameters}}async describeParameters(E){let r={};if(E?.Filters&&E.Filters.length>0)r.Filters=E.Filters;if(E?.ParameterFilters&&E.ParameterFilters.length>0)r.ParameterFilters=E.ParameterFilters;if(E?.MaxResults)r.MaxResults=E.MaxResults;if(E?.NextToken)r.NextToken=E.NextToken;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.DescribeParameters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Parameters:t.Parameters?.map((T)=>this.parseParameter(T)),NextToken:t.NextToken}}async getParameterHistory(E){let r={Name:E.Name};if(E.WithDecryption!==void 0)r.WithDecryption=E.WithDecryption;if(E.MaxResults)r.MaxResults=E.MaxResults;if(E.NextToken)r.NextToken=E.NextToken;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.GetParameterHistory","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Parameters:t.Parameters?.map((T)=>({Name:T.Name,Type:T.Type,KeyId:T.KeyId,LastModifiedDate:T.LastModifiedDate,LastModifiedUser:T.LastModifiedUser,Description:T.Description,Value:T.Value,Version:T.Version,Labels:T.Labels,Tier:T.Tier})),NextToken:t.NextToken}}async labelParameterVersion(E){let r={Name:E.Name,Labels:E.Labels};if(E.ParameterVersion!==void 0)r.ParameterVersion=E.ParameterVersion;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.LabelParameterVersion","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{InvalidLabels:t.InvalidLabels,ParameterVersion:t.ParameterVersion}}async addTagsToResource(E){let r={ResourceType:E.ResourceType,ResourceId:E.ResourceId,Tags:E.Tags};await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.AddTagsToResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async removeTagsFromResource(E){let r={ResourceType:E.ResourceType,ResourceId:E.ResourceId,TagKeys:E.TagKeys};await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.RemoveTagsFromResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async listTagsForResource(E){let r={ResourceType:E.ResourceType,ResourceId:E.ResourceId};return{TagList:(await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.ListTagsForResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).TagList}}async setString(E,r,t){return this.putParameter({Name:E,Value:r,Type:"String",Description:t?.description,Overwrite:t?.overwrite??!0,Tags:t?.tags})}async setSecureString(E,r,t){return this.putParameter({Name:E,Value:r,Type:"SecureString",Description:t?.description,Overwrite:t?.overwrite??!0,KeyId:t?.kmsKeyId,Tags:t?.tags})}async getValue(E){return(await this.getParameter({Name:E,WithDecryption:!0})).Parameter?.Value}async getAllByPath(E,r=!0){let t=[],T;do{let _=await this.getParametersByPath({Path:E,Recursive:r,WithDecryption:!0,NextToken:T});if(_.Parameters)t.push(..._.Parameters);T=_.NextToken}while(T);return t}parseParameter(E){return{Name:E.Name,Type:E.Type,Value:E.Value,Version:E.Version,LastModifiedDate:E.LastModifiedDate,ARN:E.ARN,DataType:E.DataType,Description:E.Description,AllowedPattern:E.AllowedPattern,KeyId:E.KeyId,Tier:E.Tier}}async sendCommand(E){if(!E.InstanceIds&&!E.Targets)throw Error("SendCommand requires either InstanceIds or Targets");let r={DocumentName:E.DocumentName};if(E.InstanceIds)r.InstanceIds=E.InstanceIds;if(E.Targets)r.Targets=E.Targets;if(E.Parameters)r.Parameters=E.Parameters;if(E.TimeoutSeconds)r.TimeoutSeconds=E.TimeoutSeconds;if(E.Comment)r.Comment=E.Comment;if(E.OutputS3BucketName)r.OutputS3BucketName=E.OutputS3BucketName;if(E.OutputS3KeyPrefix)r.OutputS3KeyPrefix=E.OutputS3KeyPrefix;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.SendCommand","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{CommandId:t.Command?.CommandId,Status:t.Command?.Status,StatusDetails:t.Command?.StatusDetails}}async getCommandInvocation(E){let r={CommandId:E.CommandId,InstanceId:E.InstanceId},t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.GetCommandInvocation","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Status:t.Status,StatusDetails:t.StatusDetails,StandardOutputContent:t.StandardOutputContent,StandardErrorContent:t.StandardErrorContent,ResponseCode:t.ResponseCode}}async runShellCommand(E,r,t){let T=await this.sendCommand({InstanceIds:[E],DocumentName:"AWS-RunShellScript",Parameters:{commands:r},TimeoutSeconds:t?.timeoutSeconds||600});if(!T.CommandId)return{success:!1,error:"Failed to send command"};if(t?.waitForCompletion===!1)return{success:!0,status:"Pending"};let _=t?.pollIntervalMs||2000,d=t?.maxWaitMs||300000,e=Date.now();while(Date.now()-e<d){await new Promise((h)=>setTimeout(h,_));try{let h=await this.getCommandInvocation({CommandId:T.CommandId,InstanceId:E});if(h.Status==="Success")return{success:!0,output:h.StandardOutputContent,error:h.StandardErrorContent,status:h.Status};if(h.Status==="Failed"||h.Status==="Cancelled"||h.Status==="TimedOut")return{success:!1,output:h.StandardOutputContent,error:h.StandardErrorContent||h.StatusDetails,status:h.Status}}catch(h){if(!h.message?.includes("InvocationDoesNotExist"))return{success:!1,error:h.message}}}return{success:!1,error:"Command timed out waiting for completion"}}async listCommandInvocations(E){let r={CommandId:E.CommandId};if(E.Details)r.Details=!0;return((await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.ListCommandInvocations","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).CommandInvocations||[]).map((_)=>({InstanceId:_.InstanceId,Status:_.Status,StatusDetails:_.StatusDetails,StandardOutputContent:_.CommandPlugins?.[0]?.Output,StandardErrorContent:_.CommandPlugins?.[0]?.StandardErrorUrl}))}async sendCommandByTags(E){let r=Object.entries(E.tags).map(([R,N])=>({Key:`tag:${R}`,Values:[N]})),t=await this.sendCommand({Targets:r,DocumentName:"AWS-RunShellScript",Parameters:{commands:E.commands},TimeoutSeconds:E.timeoutSeconds||600,Comment:E.comment});if(!t.CommandId)return{success:!1,instanceCount:0,perInstance:[],error:"Failed to send command"};let T=E.pollIntervalMs||3000,_=E.maxWaitMs||600000,d=Date.now(),e=new Set(["Success","Failed","Cancelled","TimedOut"]),h=[];while(Date.now()-d<_){await new Promise((R)=>setTimeout(R,T));try{if(h=await this.listCommandInvocations({CommandId:t.CommandId,Details:!0}),h.length===0)continue;if(h.every((N)=>e.has(N.Status||""))){let N=h.map((S)=>({instanceId:S.InstanceId,status:S.Status||"Unknown",output:S.StandardOutputContent,error:S.StandardErrorContent||S.StatusDetails})),A=h.every((S)=>S.Status==="Success");return{success:A,instanceCount:h.length,perInstance:N,error:A?void 0:"One or more instances reported a non-success status"}}}catch(R){if(!R.message?.includes("InvocationDoesNotExist"))return{success:!1,instanceCount:0,perInstance:[],error:R.message}}}return{success:!1,instanceCount:h.length,perInstance:h.map((R)=>({instanceId:R.InstanceId,status:R.Status||"Unknown"})),error:"Command timed out waiting for all instances to complete"}}}var zA=$E(()=>{GE()});function xU(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),scope:{type:String(E.scope_type),id:String(E.scope_id),environmentId:de(E.environment_id),resourceId:de(E.resource_id),previewId:de(E.preview_id)},key:String(E.key),kind:String(E.kind),value:de(E.value),valueFingerprint:String(E.value_fingerprint),secretRef:de(E.secret_ref),backend:String(E.backend),backendVersion:de(E.backend_version),origin:String(E.origin),required:bU(E.required),metadata:rj(E.metadata,{}),lastUsedAt:de(E.last_used_at),rotatedAt:de(E.rotated_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Ej(E){return{entryId:String(E.entry_id),resourceId:String(E.resource_id),injectionTarget:String(E.injection_target),required:bU(E.required),requiresRedeploy:bU(E.requires_redeploy),lastDeployedVersion:E.last_deployed_version==null?void 0:Number(E.last_deployed_version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class wR{controlPlane;now;constructor(E,r=()=>new Date){this.controlPlane=E;this.now=r}get(E){let r=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE id=?").get(E);return r?xU(r):void 0}find(E,r,t){let T=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE project_id=? AND scope_type=? AND scope_id=? AND key=?").get(E,r.type,r.id,t);return T?xU(T):void 0}list(E){let r=["project_id=?"],t=[E.projectId];if(E.scope)r.push("scope_type=?","scope_id=?"),t.push(E.scope.type,E.scope.id);if(E.kind)r.push("kind=?"),t.push(E.kind);return this.controlPlane.database.query(`SELECT * FROM configuration_entries WHERE ${r.join(" AND ")} ORDER BY key,scope_type,scope_id`).all(...t).map(xU)}create(E){this.validateScope(E),this.validateEntry(E);let r=crypto.randomUUID(),t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_entries (id,organization_id,project_id,scope_type,scope_id,environment_id,resource_id,preview_id,key,kind,value,value_fingerprint,secret_ref,backend,backend_version,origin,required,metadata,last_used_at,rotated_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,E.organizationId,E.projectId,E.scope.type,E.scope.id,E.scope.environmentId??null,E.scope.resourceId??null,E.scope.previewId??null,E.key,E.kind,E.value??null,E.valueFingerprint,E.secretRef??null,E.backend,E.backendVersion??null,E.origin,E.required?1:0,JSON.stringify(E.metadata),E.lastUsedAt??null,E.rotatedAt??null,1,t,t]),this.get(r)}update(E,r,t){let T=this.get(E);if(!T)throw Error("Configuration entry was not found.");if(this.validateEntry({...T,...t}),this.controlPlane.database.run("UPDATE configuration_entries SET value=?,value_fingerprint=?,secret_ref=?,backend=?,backend_version=?,required=?,metadata=?,rotated_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[t.value??null,t.valueFingerprint,t.secretRef??null,t.backend,t.backendVersion??null,t.required?1:0,JSON.stringify(t.metadata),t.rotatedAt??null,this.now().toISOString(),E,r]).changes!==1)throw Error("Configuration entry changed; refresh and retry.");return this.get(E)}remove(E,r){let t=this.get(E);if(!t)throw Error("Configuration entry was not found.");if(t.version!==r)throw Error("Configuration entry changed; refresh and retry.");if(this.controlPlane.database.run("DELETE FROM configuration_entries WHERE id=? AND version=?",[E,r]).changes<1)throw Error("Configuration entry changed; refresh and retry.");return t}setDependency(E){let r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_dependencies (entry_id,resource_id,injection_target,required,requires_redeploy,last_deployed_version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(entry_id,resource_id) DO UPDATE SET injection_target=excluded.injection_target,required=excluded.required,requires_redeploy=excluded.requires_redeploy,last_deployed_version=excluded.last_deployed_version,updated_at=excluded.updated_at",[E.entryId,E.resourceId,E.injectionTarget,E.required?1:0,E.requiresRedeploy?1:0,E.lastDeployedVersion??null,r,r]),this.dependencies(E.entryId).find((t)=>t.resourceId===E.resourceId)}dependencies(E){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE entry_id=? ORDER BY resource_id").all(E).map(Ej)}dependenciesForResource(E){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE resource_id=? ORDER BY entry_id").all(E).map(Ej)}mutation(E){let r=this.controlPlane.database.query("SELECT request_hash,result FROM configuration_mutations WHERE idempotency_key=?").get(E);return r?{requestHash:r.request_hash,result:rj(r.result,{})}:void 0}recordMutation(E){this.controlPlane.database.run("INSERT INTO configuration_mutations (id,project_id,idempotency_key,request_hash,result,actor_id,created_at) VALUES (?,?,?,?,?,?,?)",[crypto.randomUUID(),E.projectId,E.idempotencyKey,E.requestHash,JSON.stringify(E.result),E.actorId??null,this.now().toISOString()])}validateEntry(E){if(!/^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(E.key))throw Error(`Invalid configuration key: ${E.key}`);if(E.kind==="variable"&&(E.value==null||E.secretRef||E.backend!=="plaintext"))throw Error("Variables require a plaintext value and cannot use a secret backend.");if(E.kind==="secret"&&(E.value!=null||!E.secretRef||E.backend==="plaintext"))throw Error("Secrets require a non-plaintext backend reference and cannot store a plaintext value.")}validateScope(E){let r=this.controlPlane.getProject(E.projectId);if(!r||r.organizationId!==E.organizationId)throw Error("Configuration project does not belong to the organization.");let t=E.scope;if(t.type==="project"){if(t.id!==E.projectId||t.environmentId||t.resourceId||t.previewId)throw Error("Project configuration scope must reference only its project.");return}if(t.type==="environment"){let _=this.controlPlane.database.query("SELECT project_id FROM environments WHERE id=?").get(t.id);if(!_||_.project_id!==E.projectId||t.environmentId&&t.environmentId!==t.id||t.resourceId||t.previewId)throw Error("Environment configuration scope does not belong to the project.");return}if(t.type==="service"||t.type==="function"){let _=this.controlPlane.getResource(t.id);if(!_||_.projectId!==E.projectId||t.type==="function"&&_.kind!=="function"||t.resourceId&&t.resourceId!==t.id||t.environmentId&&_.environmentId!==t.environmentId||t.previewId)throw Error(`${t.type==="function"?"Function":"Service"} configuration scope does not belong to the project.`);return}let T=this.controlPlane.database.query("SELECT project_id,base_environment_id,resource_id FROM preview_instances WHERE id=?").get(t.id);if(!T||T.project_id!==E.projectId||t.previewId&&t.previewId!==t.id||t.environmentId&&t.environmentId!==T.base_environment_id||t.resourceId&&t.resourceId!==T.resource_id)throw Error("Preview configuration scope does not belong to the project.")}}var de=(E)=>E==null?void 0:String(E),bU=(E)=>Number(E)===1,rj=(E,r)=>{try{return E==null?r:JSON.parse(String(E))}catch{return r}};function wM(E){let r={n:`
+`,_}}var _8;var $R=$E(()=>{UR();Eh();Cr();JA();_8=new U0});class ct{client;region;constructor(E="us-east-1",r){this.region=E,this.client=new wE}async createSecret(E){let r={Name:E.Name};if(E.Description)r.Description=E.Description;if(E.KmsKeyId)r.KmsKeyId=E.KmsKeyId;if(E.SecretBinary)r.SecretBinary=E.SecretBinary;if(E.SecretString)r.SecretString=E.SecretString;if(E.Tags&&E.Tags.length>0)r.Tags=E.Tags;if(E.AddReplicaRegions&&E.AddReplicaRegions.length>0)r.AddReplicaRegions=E.AddReplicaRegions;if(E.ForceOverwriteReplicaSecret!==void 0)r.ForceOverwriteReplicaSecret=E.ForceOverwriteReplicaSecret;r.ClientRequestToken=E.ClientRequestToken||crypto.randomUUID();let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CreateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,VersionId:t.VersionId,ReplicationStatus:t.ReplicationStatus}}async updateSecret(E){let r={SecretId:E.SecretId};if(E.Description)r.Description=E.Description;if(E.KmsKeyId)r.KmsKeyId=E.KmsKeyId;if(E.SecretBinary)r.SecretBinary=E.SecretBinary;if(E.SecretString)r.SecretString=E.SecretString;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UpdateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,VersionId:t.VersionId}}async putSecretValue(E){let r={SecretId:E.SecretId};if(E.SecretBinary)r.SecretBinary=E.SecretBinary;if(E.SecretString)r.SecretString=E.SecretString;if(E.VersionStages&&E.VersionStages.length>0)r.VersionStages=E.VersionStages;if(E.ClientRequestToken)r.ClientRequestToken=E.ClientRequestToken;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,VersionId:t.VersionId,VersionStages:t.VersionStages}}async getSecretValue(E){let r={SecretId:E.SecretId};if(E.VersionId)r.VersionId=E.VersionId;if(E.VersionStage)r.VersionStage=E.VersionStage;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,VersionId:t.VersionId,SecretBinary:t.SecretBinary,SecretString:t.SecretString,VersionStages:t.VersionStages,CreatedDate:t.CreatedDate}}async describeSecret(E){let r={SecretId:E},t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DescribeSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return this.parseSecret(t)}async listSecrets(E){let r={};if(E?.MaxResults)r.MaxResults=E.MaxResults;if(E?.NextToken)r.NextToken=E.NextToken;if(E?.Filters&&E.Filters.length>0)r.Filters=E.Filters;if(E?.SortOrder)r.SortOrder=E.SortOrder;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.ListSecrets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{SecretList:t.SecretList?.map((T)=>this.parseSecret(T)),NextToken:t.NextToken}}async deleteSecret(E){let r={SecretId:E.SecretId};if(E.RecoveryWindowInDays!==void 0)r.RecoveryWindowInDays=E.RecoveryWindowInDays;if(E.ForceDeleteWithoutRecovery!==void 0)r.ForceDeleteWithoutRecovery=E.ForceDeleteWithoutRecovery;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,DeletionDate:t.DeletionDate}}async restoreSecret(E){let r={SecretId:E},t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RestoreSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name}}async rotateSecret(E){let r={SecretId:E.SecretId};if(E.ClientRequestToken)r.ClientRequestToken=E.ClientRequestToken;if(E.RotationLambdaARN)r.RotationLambdaARN=E.RotationLambdaARN;if(E.RotationRules)r.RotationRules=E.RotationRules;if(E.RotateImmediately!==void 0)r.RotateImmediately=E.RotateImmediately;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,VersionId:t.VersionId}}async cancelRotateSecret(E){let r={SecretId:E},t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CancelRotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name}}async getResourcePolicy(E){let r={SecretId:E},t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name,ResourcePolicy:t.ResourcePolicy}}async putResourcePolicy(E){let r={SecretId:E.SecretId,ResourcePolicy:E.ResourcePolicy};if(E.BlockPublicPolicy!==void 0)r.BlockPublicPolicy=E.BlockPublicPolicy;let t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name}}async deleteResourcePolicy(E){let r={SecretId:E},t=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{ARN:t.ARN,Name:t.Name}}async tagResource(E){let r={SecretId:E.SecretId,Tags:E.Tags};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async untagResource(E){let r={SecretId:E.SecretId,TagKeys:E.TagKeys};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UntagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async setString(E,r,t){try{let T=await this.putSecretValue({SecretId:E,SecretString:r});return{ARN:T.ARN,VersionId:T.VersionId}}catch(T){if(T.code==="ResourceNotFoundException"){let _=await this.createSecret({Name:E,SecretString:r,Description:t?.description,KmsKeyId:t?.kmsKeyId,Tags:t?.tags});return{ARN:_.ARN,VersionId:_.VersionId}}throw T}}async setJson(E,r,t){return this.setString(E,JSON.stringify(r),t)}async getString(E){return(await this.getSecretValue({SecretId:E})).SecretString}async getJson(E){let r=await this.getString(E);if(r)return JSON.parse(r);return}async listAll(){let E=[],r;do{let t=await this.listSecrets({NextToken:r});if(t.SecretList)E.push(...t.SecretList);r=t.NextToken}while(r);return E}parseSecret(E){return{ARN:E.ARN,Name:E.Name,Description:E.Description,KmsKeyId:E.KmsKeyId,RotationEnabled:E.RotationEnabled,RotationLambdaARN:E.RotationLambdaARN,RotationRules:E.RotationRules,LastRotatedDate:E.LastRotatedDate,LastChangedDate:E.LastChangedDate,LastAccessedDate:E.LastAccessedDate,DeletedDate:E.DeletedDate,NextRotationDate:E.NextRotationDate,Tags:E.Tags,SecretVersionsToStages:E.SecretVersionsToStages,CreatedDate:E.CreatedDate,PrimaryRegion:E.PrimaryRegion}}}var rh=$E(()=>{GE()});class Td{client;region;constructor(E="us-east-1",r){this.region=E,this.client=new wE}async putParameter(E){let r={Name:E.Name,Value:E.Value};if(E.Type)r.Type=E.Type;if(E.Description)r.Description=E.Description;if(E.KeyId)r.KeyId=E.KeyId;if(E.Overwrite!==void 0)r.Overwrite=E.Overwrite;if(E.AllowedPattern)r.AllowedPattern=E.AllowedPattern;if(E.Tags&&E.Tags.length>0)r.Tags=E.Tags;if(E.Tier)r.Tier=E.Tier;if(E.DataType)r.DataType=E.DataType;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.PutParameter","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Version:t.Version,Tier:t.Tier}}async getParameter(E){let r={Name:E.Name};if(E.WithDecryption!==void 0)r.WithDecryption=E.WithDecryption;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.GetParameter","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Parameter:t.Parameter?this.parseParameter(t.Parameter):void 0}}async getParameters(E){let r={Names:E.Names};if(E.WithDecryption!==void 0)r.WithDecryption=E.WithDecryption;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.GetParameters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Parameters:t.Parameters?.map((T)=>this.parseParameter(T)),InvalidParameters:t.InvalidParameters}}async getParametersByPath(E){let r={Path:E.Path};if(E.Recursive!==void 0)r.Recursive=E.Recursive;if(E.WithDecryption!==void 0)r.WithDecryption=E.WithDecryption;if(E.MaxResults)r.MaxResults=E.MaxResults;if(E.NextToken)r.NextToken=E.NextToken;if(E.ParameterFilters&&E.ParameterFilters.length>0)r.ParameterFilters=E.ParameterFilters;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.GetParametersByPath","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Parameters:t.Parameters?.map((T)=>this.parseParameter(T)),NextToken:t.NextToken}}async deleteParameter(E){let r={Name:E.Name};await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.DeleteParameter","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async deleteParameters(E){let r={Names:E},t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.DeleteParameters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{DeletedParameters:t.DeletedParameters,InvalidParameters:t.InvalidParameters}}async describeParameters(E){let r={};if(E?.Filters&&E.Filters.length>0)r.Filters=E.Filters;if(E?.ParameterFilters&&E.ParameterFilters.length>0)r.ParameterFilters=E.ParameterFilters;if(E?.MaxResults)r.MaxResults=E.MaxResults;if(E?.NextToken)r.NextToken=E.NextToken;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.DescribeParameters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Parameters:t.Parameters?.map((T)=>this.parseParameter(T)),NextToken:t.NextToken}}async getParameterHistory(E){let r={Name:E.Name};if(E.WithDecryption!==void 0)r.WithDecryption=E.WithDecryption;if(E.MaxResults)r.MaxResults=E.MaxResults;if(E.NextToken)r.NextToken=E.NextToken;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.GetParameterHistory","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Parameters:t.Parameters?.map((T)=>({Name:T.Name,Type:T.Type,KeyId:T.KeyId,LastModifiedDate:T.LastModifiedDate,LastModifiedUser:T.LastModifiedUser,Description:T.Description,Value:T.Value,Version:T.Version,Labels:T.Labels,Tier:T.Tier})),NextToken:t.NextToken}}async labelParameterVersion(E){let r={Name:E.Name,Labels:E.Labels};if(E.ParameterVersion!==void 0)r.ParameterVersion=E.ParameterVersion;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.LabelParameterVersion","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{InvalidLabels:t.InvalidLabels,ParameterVersion:t.ParameterVersion}}async addTagsToResource(E){let r={ResourceType:E.ResourceType,ResourceId:E.ResourceId,Tags:E.Tags};await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.AddTagsToResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async removeTagsFromResource(E){let r={ResourceType:E.ResourceType,ResourceId:E.ResourceId,TagKeys:E.TagKeys};await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.RemoveTagsFromResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async listTagsForResource(E){let r={ResourceType:E.ResourceType,ResourceId:E.ResourceId};return{TagList:(await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.ListTagsForResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).TagList}}async setString(E,r,t){return this.putParameter({Name:E,Value:r,Type:"String",Description:t?.description,Overwrite:t?.overwrite??!0,Tags:t?.tags})}async setSecureString(E,r,t){return this.putParameter({Name:E,Value:r,Type:"SecureString",Description:t?.description,Overwrite:t?.overwrite??!0,KeyId:t?.kmsKeyId,Tags:t?.tags})}async getValue(E){return(await this.getParameter({Name:E,WithDecryption:!0})).Parameter?.Value}async getAllByPath(E,r=!0){let t=[],T;do{let _=await this.getParametersByPath({Path:E,Recursive:r,WithDecryption:!0,NextToken:T});if(_.Parameters)t.push(..._.Parameters);T=_.NextToken}while(T);return t}parseParameter(E){return{Name:E.Name,Type:E.Type,Value:E.Value,Version:E.Version,LastModifiedDate:E.LastModifiedDate,ARN:E.ARN,DataType:E.DataType,Description:E.Description,AllowedPattern:E.AllowedPattern,KeyId:E.KeyId,Tier:E.Tier}}async sendCommand(E){if(!E.InstanceIds&&!E.Targets)throw Error("SendCommand requires either InstanceIds or Targets");let r={DocumentName:E.DocumentName};if(E.InstanceIds)r.InstanceIds=E.InstanceIds;if(E.Targets)r.Targets=E.Targets;if(E.Parameters)r.Parameters=E.Parameters;if(E.TimeoutSeconds)r.TimeoutSeconds=E.TimeoutSeconds;if(E.Comment)r.Comment=E.Comment;if(E.OutputS3BucketName)r.OutputS3BucketName=E.OutputS3BucketName;if(E.OutputS3KeyPrefix)r.OutputS3KeyPrefix=E.OutputS3KeyPrefix;let t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.SendCommand","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{CommandId:t.Command?.CommandId,Status:t.Command?.Status,StatusDetails:t.Command?.StatusDetails}}async getCommandInvocation(E){let r={CommandId:E.CommandId,InstanceId:E.InstanceId},t=await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.GetCommandInvocation","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{Status:t.Status,StatusDetails:t.StatusDetails,StandardOutputContent:t.StandardOutputContent,StandardErrorContent:t.StandardErrorContent,ResponseCode:t.ResponseCode}}async runShellCommand(E,r,t){let T=await this.sendCommand({InstanceIds:[E],DocumentName:"AWS-RunShellScript",Parameters:{commands:r},TimeoutSeconds:t?.timeoutSeconds||600});if(!T.CommandId)return{success:!1,error:"Failed to send command"};if(t?.waitForCompletion===!1)return{success:!0,status:"Pending"};let _=t?.pollIntervalMs||2000,d=t?.maxWaitMs||300000,e=Date.now();while(Date.now()-e<d){await new Promise((h)=>setTimeout(h,_));try{let h=await this.getCommandInvocation({CommandId:T.CommandId,InstanceId:E});if(h.Status==="Success")return{success:!0,output:h.StandardOutputContent,error:h.StandardErrorContent,status:h.Status};if(h.Status==="Failed"||h.Status==="Cancelled"||h.Status==="TimedOut")return{success:!1,output:h.StandardOutputContent,error:h.StandardErrorContent||h.StatusDetails,status:h.Status}}catch(h){if(!h.message?.includes("InvocationDoesNotExist"))return{success:!1,error:h.message}}}return{success:!1,error:"Command timed out waiting for completion"}}async listCommandInvocations(E){let r={CommandId:E.CommandId};if(E.Details)r.Details=!0;return((await this.client.request({service:"ssm",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonSSM.ListCommandInvocations","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).CommandInvocations||[]).map((_)=>({InstanceId:_.InstanceId,Status:_.Status,StatusDetails:_.StatusDetails,StandardOutputContent:_.CommandPlugins?.[0]?.Output,StandardErrorContent:_.CommandPlugins?.[0]?.StandardErrorUrl}))}async sendCommandByTags(E){let r=Object.entries(E.tags).map(([R,N])=>({Key:`tag:${R}`,Values:[N]})),t=await this.sendCommand({Targets:r,DocumentName:"AWS-RunShellScript",Parameters:{commands:E.commands},TimeoutSeconds:E.timeoutSeconds||600,Comment:E.comment});if(!t.CommandId)return{success:!1,instanceCount:0,perInstance:[],error:"Failed to send command"};let T=E.pollIntervalMs||3000,_=E.maxWaitMs||600000,d=Date.now(),e=new Set(["Success","Failed","Cancelled","TimedOut"]),h=[];while(Date.now()-d<_){await new Promise((R)=>setTimeout(R,T));try{if(h=await this.listCommandInvocations({CommandId:t.CommandId,Details:!0}),h.length===0)continue;if(h.every((N)=>e.has(N.Status||""))){let N=h.map((S)=>({instanceId:S.InstanceId,status:S.Status||"Unknown",output:S.StandardOutputContent,error:S.StandardErrorContent||S.StatusDetails})),A=h.every((S)=>S.Status==="Success");return{success:A,instanceCount:h.length,perInstance:N,error:A?void 0:"One or more instances reported a non-success status"}}}catch(R){if(!R.message?.includes("InvocationDoesNotExist"))return{success:!1,instanceCount:0,perInstance:[],error:R.message}}}return{success:!1,instanceCount:h.length,perInstance:h.map((R)=>({instanceId:R.InstanceId,status:R.Status||"Unknown"})),error:"Command timed out waiting for all instances to complete"}}}var zA=$E(()=>{GE()});function xU(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),scope:{type:String(E.scope_type),id:String(E.scope_id),environmentId:de(E.environment_id),resourceId:de(E.resource_id),previewId:de(E.preview_id)},key:String(E.key),kind:String(E.kind),value:de(E.value),valueFingerprint:String(E.value_fingerprint),secretRef:de(E.secret_ref),backend:String(E.backend),backendVersion:de(E.backend_version),origin:String(E.origin),required:bU(E.required),metadata:rj(E.metadata,{}),lastUsedAt:de(E.last_used_at),rotatedAt:de(E.rotated_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Ej(E){return{entryId:String(E.entry_id),resourceId:String(E.resource_id),injectionTarget:String(E.injection_target),required:bU(E.required),requiresRedeploy:bU(E.requires_redeploy),lastDeployedVersion:E.last_deployed_version==null?void 0:Number(E.last_deployed_version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class wR{controlPlane;now;constructor(E,r=()=>new Date){this.controlPlane=E;this.now=r}get(E){let r=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE id=?").get(E);return r?xU(r):void 0}find(E,r,t){let T=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE project_id=? AND scope_type=? AND scope_id=? AND key=?").get(E,r.type,r.id,t);return T?xU(T):void 0}list(E){let r=["project_id=?"],t=[E.projectId];if(E.scope)r.push("scope_type=?","scope_id=?"),t.push(E.scope.type,E.scope.id);if(E.kind)r.push("kind=?"),t.push(E.kind);return this.controlPlane.database.query(`SELECT * FROM configuration_entries WHERE ${r.join(" AND ")} ORDER BY key,scope_type,scope_id`).all(...t).map(xU)}create(E){this.validateScope(E),this.validateEntry(E);let r=crypto.randomUUID(),t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_entries (id,organization_id,project_id,scope_type,scope_id,environment_id,resource_id,preview_id,key,kind,value,value_fingerprint,secret_ref,backend,backend_version,origin,required,metadata,last_used_at,rotated_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,E.organizationId,E.projectId,E.scope.type,E.scope.id,E.scope.environmentId??null,E.scope.resourceId??null,E.scope.previewId??null,E.key,E.kind,E.value??null,E.valueFingerprint,E.secretRef??null,E.backend,E.backendVersion??null,E.origin,E.required?1:0,JSON.stringify(E.metadata),E.lastUsedAt??null,E.rotatedAt??null,1,t,t]),this.get(r)}update(E,r,t){let T=this.get(E);if(!T)throw Error("Configuration entry was not found.");if(this.validateEntry({...T,...t}),this.controlPlane.database.run("UPDATE configuration_entries SET value=?,value_fingerprint=?,secret_ref=?,backend=?,backend_version=?,required=?,metadata=?,rotated_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[t.value??null,t.valueFingerprint,t.secretRef??null,t.backend,t.backendVersion??null,t.required?1:0,JSON.stringify(t.metadata),t.rotatedAt??null,this.now().toISOString(),E,r]).changes!==1)throw Error("Configuration entry changed; refresh and retry.");return this.get(E)}remove(E,r){let t=this.get(E);if(!t)throw Error("Configuration entry was not found.");if(t.version!==r)throw Error("Configuration entry changed; refresh and retry.");if(this.controlPlane.database.run("DELETE FROM configuration_entries WHERE id=? AND version=?",[E,r]).changes<1)throw Error("Configuration entry changed; refresh and retry.");return t}setDependency(E){let r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_dependencies (entry_id,resource_id,injection_target,required,requires_redeploy,last_deployed_version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(entry_id,resource_id) DO UPDATE SET injection_target=excluded.injection_target,required=excluded.required,requires_redeploy=excluded.requires_redeploy,last_deployed_version=excluded.last_deployed_version,updated_at=excluded.updated_at",[E.entryId,E.resourceId,E.injectionTarget,E.required?1:0,E.requiresRedeploy?1:0,E.lastDeployedVersion??null,r,r]),this.dependencies(E.entryId).find((t)=>t.resourceId===E.resourceId)}dependencies(E){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE entry_id=? ORDER BY resource_id").all(E).map(Ej)}dependenciesForResource(E){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE resource_id=? ORDER BY entry_id").all(E).map(Ej)}mutation(E){let r=this.controlPlane.database.query("SELECT request_hash,result FROM configuration_mutations WHERE idempotency_key=?").get(E);return r?{requestHash:r.request_hash,result:rj(r.result,{})}:void 0}recordMutation(E){this.controlPlane.database.run("INSERT INTO configuration_mutations (id,project_id,idempotency_key,request_hash,result,actor_id,created_at) VALUES (?,?,?,?,?,?,?)",[crypto.randomUUID(),E.projectId,E.idempotencyKey,E.requestHash,JSON.stringify(E.result),E.actorId??null,this.now().toISOString()])}validateEntry(E){if(!/^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(E.key))throw Error(`Invalid configuration key: ${E.key}`);if(E.kind==="variable"&&(E.value==null||E.secretRef||E.backend!=="plaintext"))throw Error("Variables require a plaintext value and cannot use a secret backend.");if(E.kind==="secret"&&(E.value!=null||!E.secretRef||E.backend==="plaintext"))throw Error("Secrets require a non-plaintext backend reference and cannot store a plaintext value.")}validateScope(E){let r=this.controlPlane.getProject(E.projectId);if(!r||r.organizationId!==E.organizationId)throw Error("Configuration project does not belong to the organization.");let t=E.scope;if(t.type==="project"){if(t.id!==E.projectId||t.environmentId||t.resourceId||t.previewId)throw Error("Project configuration scope must reference only its project.");return}if(t.type==="environment"){let _=this.controlPlane.database.query("SELECT project_id FROM environments WHERE id=?").get(t.id);if(!_||_.project_id!==E.projectId||t.environmentId&&t.environmentId!==t.id||t.resourceId||t.previewId)throw Error("Environment configuration scope does not belong to the project.");return}if(t.type==="service"||t.type==="function"){let _=this.controlPlane.getResource(t.id);if(!_||_.projectId!==E.projectId||t.type==="function"&&_.kind!=="function"||t.resourceId&&t.resourceId!==t.id||t.environmentId&&_.environmentId!==t.environmentId||t.previewId)throw Error(`${t.type==="function"?"Function":"Service"} configuration scope does not belong to the project.`);return}let T=this.controlPlane.database.query("SELECT project_id,base_environment_id,resource_id FROM preview_instances WHERE id=?").get(t.id);if(!T||T.project_id!==E.projectId||t.previewId&&t.previewId!==t.id||t.environmentId&&t.environmentId!==T.base_environment_id||t.resourceId&&t.resourceId!==T.resource_id)throw Error("Preview configuration scope does not belong to the project.")}}var de=(E)=>E==null?void 0:String(E),bU=(E)=>Number(E)===1,rj=(E,r)=>{try{return E==null?r:JSON.parse(String(E))}catch{return r}};function w8(E){let r={n:`
 `,r:"\r",t:"\t","\\":"\\",'"':'"',$:"$"};return E.replace(/\\(n|r|t|\\|"|\$)/g,(t,T)=>r[T])}function kU(E){let r={},t=[],T=E.replace(/\r\n?/g,`
 `).split(`
 `);for(let _=0;_<T.length;_++){let d=_+1,e=T[_];if(!e.trim()||e.trimStart().startsWith("#"))continue;if(/^\s*export\s+/.test(e))e=e.replace(/^\s*export\s+/,"");let h=e.match(/^\s*([^=\s]+)\s*=\s*(.*)$/);if(!h){t.push({line:d,severity:"error",code:"invalid_line",message:"Expected KEY=VALUE."});continue}let R=h[1],N=h[2];if(!tj.test(R)){t.push({line:d,key:R,severity:"error",code:"invalid_key",message:`Invalid environment variable name: ${R}`});continue}let A=N;if(N.startsWith('"')||N.startsWith("'")){let S=N[0],L=[N.slice(1)],O=!1;while(!0){let I=L[L.length-1],D=!1,$=-1;for(let C=0;C<I.length;C++){if(S==='"'&&I[C]==="\\"&&!D){D=!0;continue}if(I[C]===S&&!D){$=C;break}D=!1}if($>=0){L[L.length-1]=I.slice(0,$),O=!0;break}if(++_>=T.length)break;L.push(T[_])}if(!O){t.push({line:d,key:R,severity:"error",code:"unterminated_quote",message:`Unterminated quoted value for ${R}.`});continue}if(A=L.join(`
-`),S==='"')A=wM(A)}else A=N.replace(/\s+#.*$/,"").trim();if(Object.hasOwn(r,R)){let S=r[R]!==A;if(t.push({line:d,key:R,severity:S?"error":"warning",code:S?"conflict":"duplicate",message:S?`${R} has conflicting values.`:`${R} is duplicated with the same value.`}),S)continue}r[R]=A}return{values:r,diagnostics:t,valid:!t.some((_)=>_.severity==="error")}}function uU(E){return Object.entries(E).sort(([r],[t])=>r.localeCompare(t)).map(([r,t])=>{if(!tj.test(r))throw Error(`Invalid environment variable name: ${r}`);return`${r}=${JSON.stringify(t)}`}).join(`
+`),S==='"')A=w8(A)}else A=N.replace(/\s+#.*$/,"").trim();if(Object.hasOwn(r,R)){let S=r[R]!==A;if(t.push({line:d,key:R,severity:S?"error":"warning",code:S?"conflict":"duplicate",message:S?`${R} has conflicting values.`:`${R} is duplicated with the same value.`}),S)continue}r[R]=A}return{values:r,diagnostics:t,valid:!t.some((_)=>_.severity==="error")}}function uU(E){return Object.entries(E).sort(([r],[t])=>r.localeCompare(t)).map(([r,t])=>{if(!tj.test(r))throw Error(`Invalid environment variable name: ${r}`);return`${r}=${JSON.stringify(t)}`}).join(`
 `)+(Object.keys(E).length?`
-`:"")}var tj;var nU=$E(()=>{tj=/^[A-Za-z_][A-Za-z0-9_]{0,255}$/});import{createCipheriv as CM,createDecipheriv as XM,createHash as Tj,randomBytes as JM}from"node:crypto";class ee{controlPlane;now;kind="local_encrypted";key;constructor(E,r,t=()=>new Date){this.controlPlane=E;this.now=t;if(!r)throw Error("Configuration encryption key is required.");this.key=Tj("sha256").update(`ts-cloud:configuration:${r}`).digest()}encrypt(E){let r=JM(12),t=CM("aes-256-gcm",this.key,r),T=Buffer.concat([t.update(E,"utf8"),t.final()]);return`v1.${r.toString("base64url")}.${t.getAuthTag().toString("base64url")}.${T.toString("base64url")}`}decrypt(E){let[r,t,T,_]=E.split(".");if(r!=="v1"||!t||!T||!_)throw Error("Encrypted configuration secret is unavailable.");try{let d=XM("aes-256-gcm",this.key,Buffer.from(t,"base64url"));return d.setAuthTag(Buffer.from(T,"base64url")),Buffer.concat([d.update(Buffer.from(_,"base64url")),d.final()]).toString("utf8")}catch{throw Error("Encrypted configuration secret could not be decrypted.")}}async put(E){if(!E.value)throw Error("Configuration secrets cannot be empty.");let r=E.reference??`secret://configuration/${E.name}/${crypto.randomUUID()}`;if(!/^secret:\/\/configuration\/[A-Za-z0-9._/-]+$/.test(r))throw Error("Invalid local configuration secret reference.");let T=(this.controlPlane.database.query("SELECT version FROM configuration_secret_values WHERE reference=?").get(r)?.version??0)+1,_=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_secret_values (reference,ciphertext,fingerprint,version,created_at,updated_at) VALUES (?,?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,version=excluded.version,updated_at=excluded.updated_at",[r,this.encrypt(E.value),Tj("sha256").update(E.value).digest("hex"),T,_,_]),{reference:r,version:String(T)}}async resolve(E){let r=this.controlPlane.database.query("SELECT ciphertext FROM configuration_secret_values WHERE reference=?").get(E);if(!r)throw Error("Configuration secret was not found.");return this.decrypt(r.ciphertext)}async remove(E){this.controlPlane.database.run("DELETE FROM configuration_secret_values WHERE reference=?",[E])}async validate(E){return!!this.controlPlane.database.query("SELECT 1 AS found FROM configuration_secret_values WHERE reference=?").get(E)}}class CR{client;region;kind="aws_secrets_manager";constructor(E,r){this.client=E;this.region=r}async put(E){if(E.reference){let t=this.id(E.reference),T=await this.client.putSecretValue({SecretId:t,SecretString:E.value,ClientRequestToken:E.idempotencyKey});return{reference:E.reference,version:T.VersionId??E.idempotencyKey}}let r=await this.client.createSecret({Name:E.name,SecretString:E.value,ClientRequestToken:E.idempotencyKey,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{reference:`aws-sm://${this.region}/${encodeURIComponent(r.ARN??r.Name??E.name)}`,version:r.VersionId??E.idempotencyKey}}async resolve(E){let r=await this.client.getSecretValue({SecretId:this.id(E)});if(r.SecretString==null)throw Error("AWS Secrets Manager value is unavailable.");return r.SecretString}async remove(E){await this.client.deleteSecret({SecretId:this.id(E),RecoveryWindowInDays:7})}async validate(E){try{return await this.client.describeSecret(this.id(E)),!0}catch{return!1}}id(E){let r=new URL(E);if(r.protocol!=="aws-sm:"||r.hostname!==this.region)throw Error("Invalid AWS Secrets Manager reference.");return decodeURIComponent(r.pathname.slice(1))}}class XR{client;region;kind="aws_ssm";constructor(E,r){this.client=E;this.region=r}async put(E){let r=E.reference?this.name(E.reference):`/${E.name.replace(/^\/+/,"")}`,t=await this.client.putParameter({Name:r,Value:E.value,Type:"SecureString",Overwrite:!!E.reference,Description:"Managed by ts-cloud"});return{reference:`aws-ssm://${this.region}${r}`,version:String(t.Version??1)}}async resolve(E){let r=await this.client.getParameter({Name:this.name(E),WithDecryption:!0});if(r.Parameter?.Value==null)throw Error("AWS SSM parameter value is unavailable.");return r.Parameter.Value}async remove(E){await this.client.deleteParameter({Name:this.name(E)})}async validate(E){try{return!!(await this.client.getParameter({Name:this.name(E),WithDecryption:!1})).Parameter}catch{return!1}}name(E){let r=new URL(E);if(r.protocol!=="aws-ssm:"||r.hostname!==this.region||!r.pathname.startsWith("/"))throw Error("Invalid AWS SSM reference.");return r.pathname}}class JR{kind="external";async put(){throw Error("External secret references cannot be written by ts-cloud.")}async resolve(){throw Error("External secrets must be resolved by the deployment provider.")}async remove(){}async validate(E){return/^(?:vault|doppler|op|external):\/\//.test(E)}}var vU=()=>{};var _d=35,lU;var iU=$E(()=>{lU=[{version:1,name:"core_control_plane",sql:`
+`:"")}var tj;var nU=$E(()=>{tj=/^[A-Za-z_][A-Za-z0-9_]{0,255}$/});import{createCipheriv as C8,createDecipheriv as X8,createHash as Tj,randomBytes as J8}from"node:crypto";class ee{controlPlane;now;kind="local_encrypted";key;constructor(E,r,t=()=>new Date){this.controlPlane=E;this.now=t;if(!r)throw Error("Configuration encryption key is required.");this.key=Tj("sha256").update(`ts-cloud:configuration:${r}`).digest()}encrypt(E){let r=J8(12),t=C8("aes-256-gcm",this.key,r),T=Buffer.concat([t.update(E,"utf8"),t.final()]);return`v1.${r.toString("base64url")}.${t.getAuthTag().toString("base64url")}.${T.toString("base64url")}`}decrypt(E){let[r,t,T,_]=E.split(".");if(r!=="v1"||!t||!T||!_)throw Error("Encrypted configuration secret is unavailable.");try{let d=X8("aes-256-gcm",this.key,Buffer.from(t,"base64url"));return d.setAuthTag(Buffer.from(T,"base64url")),Buffer.concat([d.update(Buffer.from(_,"base64url")),d.final()]).toString("utf8")}catch{throw Error("Encrypted configuration secret could not be decrypted.")}}async put(E){if(!E.value)throw Error("Configuration secrets cannot be empty.");let r=E.reference??`secret://configuration/${E.name}/${crypto.randomUUID()}`;if(!/^secret:\/\/configuration\/[A-Za-z0-9._/-]+$/.test(r))throw Error("Invalid local configuration secret reference.");let T=(this.controlPlane.database.query("SELECT version FROM configuration_secret_values WHERE reference=?").get(r)?.version??0)+1,_=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_secret_values (reference,ciphertext,fingerprint,version,created_at,updated_at) VALUES (?,?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,version=excluded.version,updated_at=excluded.updated_at",[r,this.encrypt(E.value),Tj("sha256").update(E.value).digest("hex"),T,_,_]),{reference:r,version:String(T)}}async resolve(E){let r=this.controlPlane.database.query("SELECT ciphertext FROM configuration_secret_values WHERE reference=?").get(E);if(!r)throw Error("Configuration secret was not found.");return this.decrypt(r.ciphertext)}async remove(E){this.controlPlane.database.run("DELETE FROM configuration_secret_values WHERE reference=?",[E])}async validate(E){return!!this.controlPlane.database.query("SELECT 1 AS found FROM configuration_secret_values WHERE reference=?").get(E)}}class CR{client;region;kind="aws_secrets_manager";constructor(E,r){this.client=E;this.region=r}async put(E){if(E.reference){let t=this.id(E.reference),T=await this.client.putSecretValue({SecretId:t,SecretString:E.value,ClientRequestToken:E.idempotencyKey});return{reference:E.reference,version:T.VersionId??E.idempotencyKey}}let r=await this.client.createSecret({Name:E.name,SecretString:E.value,ClientRequestToken:E.idempotencyKey,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{reference:`aws-sm://${this.region}/${encodeURIComponent(r.ARN??r.Name??E.name)}`,version:r.VersionId??E.idempotencyKey}}async resolve(E){let r=await this.client.getSecretValue({SecretId:this.id(E)});if(r.SecretString==null)throw Error("AWS Secrets Manager value is unavailable.");return r.SecretString}async remove(E){await this.client.deleteSecret({SecretId:this.id(E),RecoveryWindowInDays:7})}async validate(E){try{return await this.client.describeSecret(this.id(E)),!0}catch{return!1}}id(E){let r=new URL(E);if(r.protocol!=="aws-sm:"||r.hostname!==this.region)throw Error("Invalid AWS Secrets Manager reference.");return decodeURIComponent(r.pathname.slice(1))}}class XR{client;region;kind="aws_ssm";constructor(E,r){this.client=E;this.region=r}async put(E){let r=E.reference?this.name(E.reference):`/${E.name.replace(/^\/+/,"")}`,t=await this.client.putParameter({Name:r,Value:E.value,Type:"SecureString",Overwrite:!!E.reference,Description:"Managed by ts-cloud"});return{reference:`aws-ssm://${this.region}${r}`,version:String(t.Version??1)}}async resolve(E){let r=await this.client.getParameter({Name:this.name(E),WithDecryption:!0});if(r.Parameter?.Value==null)throw Error("AWS SSM parameter value is unavailable.");return r.Parameter.Value}async remove(E){await this.client.deleteParameter({Name:this.name(E)})}async validate(E){try{return!!(await this.client.getParameter({Name:this.name(E),WithDecryption:!1})).Parameter}catch{return!1}}name(E){let r=new URL(E);if(r.protocol!=="aws-ssm:"||r.hostname!==this.region||!r.pathname.startsWith("/"))throw Error("Invalid AWS SSM reference.");return r.pathname}}class JR{kind="external";async put(){throw Error("External secret references cannot be written by ts-cloud.")}async resolve(){throw Error("External secrets must be resolved by the deployment provider.")}async remove(){}async validate(E){return/^(?:vault|doppler|op|external):\/\//.test(E)}}var vU=()=>{};var _d=35,lU;var iU=$E(()=>{lU=[{version:1,name:"core_control_plane",sql:`
       CREATE TABLE projects (
         id TEXT PRIMARY KEY,
         slug TEXT NOT NULL UNIQUE,
@@ -1422,26 +1422,26 @@ host:${e}
     CREATE INDEX platform_campaign_status ON platform_upgrade_campaigns(project_id,status,created_at DESC);
     CREATE INDEX cleanup_plan_status ON cleanup_plans(project_id,status,expires_at);
     CREATE INDEX dr_drill_status ON disaster_recovery_drills(project_id,status,created_at DESC);
-  `}]});function yR(E){return yM[E]}function mU(E,r){if(E.type==="organization")return E.id===void 0||E.id===r.organizationId;if(!E.id)return!1;if(E.type==="project")return E.id===r.projectId;if(E.type==="environment")return E.id===r.environmentId;return E.id===r.resourceId}function vt(E){let{membership:r,capability:t,target:T}=E;if(!r||r.status!=="active"||r.organizationId!==T.organizationId)return{allowed:!1,reason:"inactive-membership"};let _=E.grants.filter((h)=>h.organizationId===T.organizationId&&h.membershipId===r.id&&h.capability===t&&mU(h.scope,T)),d=_.find((h)=>h.effect==="deny");if(d)return{allowed:!1,reason:"explicit-deny",inheritedFrom:{kind:"grant",id:d.id,scope:d.scope}};let e=_.find((h)=>h.effect==="allow");if(e)return{allowed:!0,reason:"explicit-allow",inheritedFrom:{kind:"grant",id:e.id,scope:e.scope}};if(!mU(r.scope,T))return{allowed:!1,reason:"scope-mismatch"};if(yR(r.roleTemplate).has(t))return{allowed:!0,reason:"role-template",inheritedFrom:{kind:"membership",id:r.id,scope:r.scope}};return{allowed:!1,reason:"missing-capability"}}function jR(E){return nt.filter((r)=>vt({...E,capability:r}).allowed)}var nt,aU,yM;var sU=$E(()=>{nt=["project:read","config:read","config:write","deployments:read","deployments:create","deployments:cancel","deployments:rollback","runtime:read","runtime:restart","runtime:logs","runtime:terminal","data:read","data:write","data:admin","backups:read","backups:create","backups:restore","secrets:read","secrets:write","fleet:read","fleet:manage","users:read","users:manage","users:transfer-ownership","audit:read","security:read","security:manage","security:waive","sources:read","sources:manage","applications:read","applications:manage","automation:read","automation:manage","tags:manage"],aU=["project:read","config:read","deployments:read","runtime:read","runtime:logs","data:read","backups:read","security:read","sources:read","applications:read"],yM={owner:new Set(nt),admin:new Set(nt.filter((E)=>E!=="users:transfer-ownership")),deployer:new Set([...aU,"deployments:create","deployments:cancel","deployments:rollback","sources:manage","applications:manage"]),operator:new Set([...aU,"runtime:restart","backups:create","security:manage","sources:manage","applications:manage"]),viewer:new Set(aU),auditor:new Set(["project:read","config:read","deployments:read","runtime:read","data:read","backups:read","audit:read","security:read","sources:read","applications:read"])}});var he,pU,$0;var oU=$E(()=>{he=class he extends Error{constructor(E,r,t){super(`${E} ${r} changed since version ${t}`);this.name="OptimisticConcurrencyError"}};pU=class pU extends Error{constructor(E,r){super(`Operation cannot transition from ${E} to ${r}`);this.name="InvalidOperationTransitionError"}};$0=class $0 extends Error{constructor(E,r){super(`Control-plane schema version ${E} is newer than supported version ${r}`);this.name="UnsupportedSchemaVersionError"}}});import{createHash as w0,randomBytes as jM}from"node:crypto";import{chmodSync as _j,existsSync as dj,mkdirSync as FM,statSync as zM,writeFileSync as ej}from"node:fs";import{dirname as hj,join as Rj}from"node:path";import{Database as BM}from"bun:sqlite";function PT(E){if(typeof E!=="string")return{};try{return JSON.parse(E)}catch{return{}}}function tr(E){return typeof E==="string"?E:void 0}function TD(E,r){if(r&&fM.test(r))return"[REDACTED]";if(E===null||typeof E==="boolean"||typeof E==="number")return E;if(typeof E==="string")return E.replace(Sj,"[REDACTED]");if(Array.isArray(E))return E.map((t)=>TD(t));if(E&&typeof E==="object"){let t={};for(let[T,_]of Object.entries(E))t[T]=TD(_,T);return t}return String(E??"")}function ZE(E,r=Aj){let t=TD(E),T=JSON.stringify(t);if(Buffer.byteLength(T)<=r)return t;return{truncated:!0,originalBytes:Buffer.byteLength(T),preview:T.slice(0,Math.max(0,r-128))}}function Xr(E){return JSON.stringify(ZE(E))}function ED(E){if(!E)return;let r=E.replace(Sj,"[REDACTED]");return Buffer.byteLength(r)<=tD?r:`${r.slice(0,tD-24)}
-[output truncated]`}function C0(E){return{id:String(E.id),slug:String(E.slug),name:String(E.name),description:tr(E.description),organizationId:tr(E.organization_id),desiredConfigHash:tr(E.desired_config_hash),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function X0(E){return{id:String(E.id),projectId:String(E.project_id),slug:String(E.slug),name:String(E.name),kind:String(E.kind),region:tr(E.region),desiredState:PT(E.desired_state),discoveredState:PT(E.discovered_state),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function J0(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:tr(E.environment_id),kind:String(E.kind),slug:String(E.slug),name:String(E.name),provider:tr(E.provider),providerId:tr(E.provider_id),desiredState:PT(E.desired_state),discoveredState:PT(E.discovered_state),metadata:PT(E.metadata),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function y0(E){return{id:String(E.id),kind:String(E.kind),externalId:tr(E.external_id),displayName:String(E.display_name),metadata:PT(E.metadata),disabledAt:tr(E.disabled_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function th(E){return{id:String(E.id),projectId:tr(E.project_id),environmentId:tr(E.environment_id),resourceId:tr(E.resource_id),actorId:tr(E.actor_id),kind:String(E.kind),state:String(E.state),correlationId:String(E.correlation_id),idempotencyKey:tr(E.idempotency_key),input:PT(E.input),output:PT(E.output),error:tr(E.error),attempt:Number(E.attempt),priority:Number(E.priority),leaseOwner:tr(E.lease_owner),leaseExpiresAt:tr(E.lease_expires_at),cancelRequestedAt:tr(E.cancel_requested_at),startedAt:tr(E.started_at),finishedAt:tr(E.finished_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function rD(E){return{id:String(E.id),sequence:Number(E.sequence),organizationId:tr(E.organization_id),projectId:tr(E.project_id),operationId:tr(E.operation_id),resourceId:tr(E.resource_id),actorId:tr(E.actor_id),correlationId:String(E.correlation_id),type:String(E.type),level:String(E.level),payload:PT(E.payload),createdAt:String(E.created_at)}}function BA(E){return{id:String(E.id),projectId:String(E.project_id),name:String(E.name),normalizedName:String(E.normalized_name),color:String(E.color),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function j0(E){return{id:String(E.id),actorKey:String(E.actor_key),name:String(E.name),routeId:String(E.route_id),query:PT(E.query),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function F0(E){return{actorKey:String(E.actor_key),entityType:String(E.entity_type),entityId:String(E.entity_id),favorite:Number(E.favorite)===1,lastVisitedAt:String(E.last_visited_at),visitCount:Number(E.visit_count)}}function z0(E){return{id:String(E.id),slug:String(E.slug),name:String(E.name),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function _D(E){let r=String(E.scope_type);return{type:r,...r==="organization"?{}:{id:String(E.scope_id)}}}function B0(E){return{id:String(E.id),organizationId:String(E.organization_id),actorId:String(E.actor_id),roleTemplate:String(E.role_template),scope:_D(E),source:String(E.source??"manual"),status:String(E.status),sessionVersion:Number(E.session_version),lastActiveAt:tr(E.last_active_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function WA(E,r){let t=tr(E.accepted_at),T=tr(E.revoked_at),_=String(E.expires_at),d=T?"revoked":t?"accepted":_<=r?"expired":"pending";return{id:String(E.id),organizationId:String(E.organization_id),email:String(E.email),roleTemplate:String(E.role_template),scope:_D(E),invitedByActorId:tr(E.invited_by_actor_id),acceptedByActorId:tr(E.accepted_by_actor_id),expiresAt:_,acceptedAt:t,revokedAt:T,state:d,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function W0(E){return{id:String(E.id),organizationId:String(E.organization_id),membershipId:String(E.membership_id),effect:String(E.effect),capability:String(E.capability),scope:_D(E),source:String(E.source??"manual"),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function HA(E){return{type:E.type,id:E.id??null}}function YM(E){return Array.from({length:E},()=>"?").join(", ")}function VE(E,r,t){return E.run(r,t)}class FR{path;database;nowFn;idFn;constructor(E={}){this.path=E.path??Rj(E.cwd??process.cwd(),Nj),this.nowFn=E.now??(()=>new Date),this.idFn=E.id??(()=>crypto.randomUUID());let r=this.path===":memory:";if(!r){FM(hj(this.path),{recursive:!0,mode:448});try{_j(hj(this.path),448)}catch{}}if(this.database=new BM(this.path,{create:!0,strict:!0}),this.database.run("PRAGMA foreign_keys = ON"),this.database.run(`PRAGMA busy_timeout = ${Math.max(100,E.busyTimeoutMs??5000)}`),!r)this.database.run("PRAGMA journal_mode = WAL"),this.database.run("PRAGMA synchronous = NORMAL");if(this.migrate(),!r)this.secureDatabaseFiles()}now(){return this.nowFn().toISOString()}secureDatabaseFiles(){for(let E of[this.path,`${this.path}-wal`,`${this.path}-shm`]){if(!dj(E))continue;try{_j(E,384)}catch{}}}migrate(){let E=this.database.query("PRAGMA user_version").get(),r=Number(E?.user_version??0);if(r>_d)throw new $0(r,_d);if(r===_d)return;let t;if(r>0&&this.path!==":memory:")t=`${this.path}.v${r}.${Date.now()}.bak`,ej(t,this.database.serialize(),{mode:384});try{if(this.database.transaction(()=>{for(let _ of lU){if(_.version<=r)continue;this.database.run(_.sql),VE(this.database,"INSERT INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)",[_.version,_.name,this.now()]),this.database.run(`PRAGMA user_version = ${_.version}`)}}).exclusive(),t)this.setSetting("storage.last_backup",{path:t,createdAt:this.now(),reason:"pre-migration"})}catch(T){let _=t?` Restore from ${t}.`:"";throw Error(`Control-plane migration from schema ${r} failed.${_} ${T instanceof Error?T.message:String(T)}`)}}close(){if(this.path!==":memory:")this.secureDatabaseFiles();this.database.close()}transaction(E){return this.database.transaction(E).immediate()}createProject(E){let r=E.id??this.idFn(),t=this.now();return VE(this.database,"INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",[r,E.slug,E.name,E.description??null,E.organizationId??null,E.desiredConfigHash??null,t,t]),this.getProject(r)}getProject(E){let r=this.database.query("SELECT * FROM projects WHERE id = ?").get(E);return r?C0(r):void 0}getProjectBySlug(E){let r=this.database.query("SELECT * FROM projects WHERE slug = ?").get(E);return r?C0(r):void 0}listProjects(){return this.database.query("SELECT * FROM projects ORDER BY name COLLATE NOCASE, id").all().map(C0)}updateProject(E,r,t){let T=this.getProject(E);if(!T||T.version!==r)throw new he("Project",E,r);if(VE(this.database,`UPDATE projects SET name = ?, description = ?, organization_id = ?, desired_config_hash = ?, version = version + 1, updated_at = ?
+  `}]});function yR(E){return y8[E]}function mU(E,r){if(E.type==="organization")return E.id===void 0||E.id===r.organizationId;if(!E.id)return!1;if(E.type==="project")return E.id===r.projectId;if(E.type==="environment")return E.id===r.environmentId;return E.id===r.resourceId}function vt(E){let{membership:r,capability:t,target:T}=E;if(!r||r.status!=="active"||r.organizationId!==T.organizationId)return{allowed:!1,reason:"inactive-membership"};let _=E.grants.filter((h)=>h.organizationId===T.organizationId&&h.membershipId===r.id&&h.capability===t&&mU(h.scope,T)),d=_.find((h)=>h.effect==="deny");if(d)return{allowed:!1,reason:"explicit-deny",inheritedFrom:{kind:"grant",id:d.id,scope:d.scope}};let e=_.find((h)=>h.effect==="allow");if(e)return{allowed:!0,reason:"explicit-allow",inheritedFrom:{kind:"grant",id:e.id,scope:e.scope}};if(!mU(r.scope,T))return{allowed:!1,reason:"scope-mismatch"};if(yR(r.roleTemplate).has(t))return{allowed:!0,reason:"role-template",inheritedFrom:{kind:"membership",id:r.id,scope:r.scope}};return{allowed:!1,reason:"missing-capability"}}function jR(E){return nt.filter((r)=>vt({...E,capability:r}).allowed)}var nt,aU,y8;var sU=$E(()=>{nt=["project:read","config:read","config:write","deployments:read","deployments:create","deployments:cancel","deployments:rollback","runtime:read","runtime:restart","runtime:logs","runtime:terminal","data:read","data:write","data:admin","backups:read","backups:create","backups:restore","secrets:read","secrets:write","fleet:read","fleet:manage","users:read","users:manage","users:transfer-ownership","audit:read","security:read","security:manage","security:waive","sources:read","sources:manage","applications:read","applications:manage","automation:read","automation:manage","tags:manage"],aU=["project:read","config:read","deployments:read","runtime:read","runtime:logs","data:read","backups:read","security:read","sources:read","applications:read"],y8={owner:new Set(nt),admin:new Set(nt.filter((E)=>E!=="users:transfer-ownership")),deployer:new Set([...aU,"deployments:create","deployments:cancel","deployments:rollback","sources:manage","applications:manage"]),operator:new Set([...aU,"runtime:restart","backups:create","security:manage","sources:manage","applications:manage"]),viewer:new Set(aU),auditor:new Set(["project:read","config:read","deployments:read","runtime:read","data:read","backups:read","audit:read","security:read","sources:read","applications:read"])}});var he,pU,$0;var oU=$E(()=>{he=class he extends Error{constructor(E,r,t){super(`${E} ${r} changed since version ${t}`);this.name="OptimisticConcurrencyError"}};pU=class pU extends Error{constructor(E,r){super(`Operation cannot transition from ${E} to ${r}`);this.name="InvalidOperationTransitionError"}};$0=class $0 extends Error{constructor(E,r){super(`Control-plane schema version ${E} is newer than supported version ${r}`);this.name="UnsupportedSchemaVersionError"}}});import{createHash as w0,randomBytes as j8}from"node:crypto";import{chmodSync as _j,existsSync as dj,mkdirSync as F8,statSync as z8,writeFileSync as ej}from"node:fs";import{dirname as hj,join as Rj}from"node:path";import{Database as B8}from"bun:sqlite";function PT(E){if(typeof E!=="string")return{};try{return JSON.parse(E)}catch{return{}}}function tr(E){return typeof E==="string"?E:void 0}function TD(E,r){if(r&&f8.test(r))return"[REDACTED]";if(E===null||typeof E==="boolean"||typeof E==="number")return E;if(typeof E==="string")return E.replace(Sj,"[REDACTED]");if(Array.isArray(E))return E.map((t)=>TD(t));if(E&&typeof E==="object"){let t={};for(let[T,_]of Object.entries(E))t[T]=TD(_,T);return t}return String(E??"")}function ZE(E,r=Aj){let t=TD(E),T=JSON.stringify(t);if(Buffer.byteLength(T)<=r)return t;return{truncated:!0,originalBytes:Buffer.byteLength(T),preview:T.slice(0,Math.max(0,r-128))}}function Xr(E){return JSON.stringify(ZE(E))}function ED(E){if(!E)return;let r=E.replace(Sj,"[REDACTED]");return Buffer.byteLength(r)<=tD?r:`${r.slice(0,tD-24)}
+[output truncated]`}function C0(E){return{id:String(E.id),slug:String(E.slug),name:String(E.name),description:tr(E.description),organizationId:tr(E.organization_id),desiredConfigHash:tr(E.desired_config_hash),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function X0(E){return{id:String(E.id),projectId:String(E.project_id),slug:String(E.slug),name:String(E.name),kind:String(E.kind),region:tr(E.region),desiredState:PT(E.desired_state),discoveredState:PT(E.discovered_state),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function J0(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:tr(E.environment_id),kind:String(E.kind),slug:String(E.slug),name:String(E.name),provider:tr(E.provider),providerId:tr(E.provider_id),desiredState:PT(E.desired_state),discoveredState:PT(E.discovered_state),metadata:PT(E.metadata),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function y0(E){return{id:String(E.id),kind:String(E.kind),externalId:tr(E.external_id),displayName:String(E.display_name),metadata:PT(E.metadata),disabledAt:tr(E.disabled_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function th(E){return{id:String(E.id),projectId:tr(E.project_id),environmentId:tr(E.environment_id),resourceId:tr(E.resource_id),actorId:tr(E.actor_id),kind:String(E.kind),state:String(E.state),correlationId:String(E.correlation_id),idempotencyKey:tr(E.idempotency_key),input:PT(E.input),output:PT(E.output),error:tr(E.error),attempt:Number(E.attempt),priority:Number(E.priority),leaseOwner:tr(E.lease_owner),leaseExpiresAt:tr(E.lease_expires_at),cancelRequestedAt:tr(E.cancel_requested_at),startedAt:tr(E.started_at),finishedAt:tr(E.finished_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function rD(E){return{id:String(E.id),sequence:Number(E.sequence),organizationId:tr(E.organization_id),projectId:tr(E.project_id),operationId:tr(E.operation_id),resourceId:tr(E.resource_id),actorId:tr(E.actor_id),correlationId:String(E.correlation_id),type:String(E.type),level:String(E.level),payload:PT(E.payload),createdAt:String(E.created_at)}}function BA(E){return{id:String(E.id),projectId:String(E.project_id),name:String(E.name),normalizedName:String(E.normalized_name),color:String(E.color),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function j0(E){return{id:String(E.id),actorKey:String(E.actor_key),name:String(E.name),routeId:String(E.route_id),query:PT(E.query),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function F0(E){return{actorKey:String(E.actor_key),entityType:String(E.entity_type),entityId:String(E.entity_id),favorite:Number(E.favorite)===1,lastVisitedAt:String(E.last_visited_at),visitCount:Number(E.visit_count)}}function z0(E){return{id:String(E.id),slug:String(E.slug),name:String(E.name),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function _D(E){let r=String(E.scope_type);return{type:r,...r==="organization"?{}:{id:String(E.scope_id)}}}function B0(E){return{id:String(E.id),organizationId:String(E.organization_id),actorId:String(E.actor_id),roleTemplate:String(E.role_template),scope:_D(E),source:String(E.source??"manual"),status:String(E.status),sessionVersion:Number(E.session_version),lastActiveAt:tr(E.last_active_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function WA(E,r){let t=tr(E.accepted_at),T=tr(E.revoked_at),_=String(E.expires_at),d=T?"revoked":t?"accepted":_<=r?"expired":"pending";return{id:String(E.id),organizationId:String(E.organization_id),email:String(E.email),roleTemplate:String(E.role_template),scope:_D(E),invitedByActorId:tr(E.invited_by_actor_id),acceptedByActorId:tr(E.accepted_by_actor_id),expiresAt:_,acceptedAt:t,revokedAt:T,state:d,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function W0(E){return{id:String(E.id),organizationId:String(E.organization_id),membershipId:String(E.membership_id),effect:String(E.effect),capability:String(E.capability),scope:_D(E),source:String(E.source??"manual"),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function HA(E){return{type:E.type,id:E.id??null}}function Y8(E){return Array.from({length:E},()=>"?").join(", ")}function VE(E,r,t){return E.run(r,t)}class FR{path;database;nowFn;idFn;constructor(E={}){this.path=E.path??Rj(E.cwd??process.cwd(),Nj),this.nowFn=E.now??(()=>new Date),this.idFn=E.id??(()=>crypto.randomUUID());let r=this.path===":memory:";if(!r){F8(hj(this.path),{recursive:!0,mode:448});try{_j(hj(this.path),448)}catch{}}if(this.database=new B8(this.path,{create:!0,strict:!0}),this.database.run("PRAGMA foreign_keys = ON"),this.database.run(`PRAGMA busy_timeout = ${Math.max(100,E.busyTimeoutMs??5000)}`),!r)this.database.run("PRAGMA journal_mode = WAL"),this.database.run("PRAGMA synchronous = NORMAL");if(this.migrate(),!r)this.secureDatabaseFiles()}now(){return this.nowFn().toISOString()}secureDatabaseFiles(){for(let E of[this.path,`${this.path}-wal`,`${this.path}-shm`]){if(!dj(E))continue;try{_j(E,384)}catch{}}}migrate(){let E=this.database.query("PRAGMA user_version").get(),r=Number(E?.user_version??0);if(r>_d)throw new $0(r,_d);if(r===_d)return;let t;if(r>0&&this.path!==":memory:")t=`${this.path}.v${r}.${Date.now()}.bak`,ej(t,this.database.serialize(),{mode:384});try{if(this.database.transaction(()=>{for(let _ of lU){if(_.version<=r)continue;this.database.run(_.sql),VE(this.database,"INSERT INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)",[_.version,_.name,this.now()]),this.database.run(`PRAGMA user_version = ${_.version}`)}}).exclusive(),t)this.setSetting("storage.last_backup",{path:t,createdAt:this.now(),reason:"pre-migration"})}catch(T){let _=t?` Restore from ${t}.`:"";throw Error(`Control-plane migration from schema ${r} failed.${_} ${T instanceof Error?T.message:String(T)}`)}}close(){if(this.path!==":memory:")this.secureDatabaseFiles();this.database.close()}transaction(E){return this.database.transaction(E).immediate()}createProject(E){let r=E.id??this.idFn(),t=this.now();return VE(this.database,"INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",[r,E.slug,E.name,E.description??null,E.organizationId??null,E.desiredConfigHash??null,t,t]),this.getProject(r)}getProject(E){let r=this.database.query("SELECT * FROM projects WHERE id = ?").get(E);return r?C0(r):void 0}getProjectBySlug(E){let r=this.database.query("SELECT * FROM projects WHERE slug = ?").get(E);return r?C0(r):void 0}listProjects(){return this.database.query("SELECT * FROM projects ORDER BY name COLLATE NOCASE, id").all().map(C0)}updateProject(E,r,t){let T=this.getProject(E);if(!T||T.version!==r)throw new he("Project",E,r);if(VE(this.database,`UPDATE projects SET name = ?, description = ?, organization_id = ?, desired_config_hash = ?, version = version + 1, updated_at = ?
       WHERE id = ? AND version = ?`,[t.name??T.name,t.description===null?null:t.description??T.description??null,t.organizationId===null?null:t.organizationId??T.organizationId??null,t.desiredConfigHash===null?null:t.desiredConfigHash??T.desiredConfigHash??null,this.now(),E,r]).changes!==1)throw new he("Project",E,r);return this.getProject(E)}createEnvironment(E){let r=E.id??this.idFn(),t=this.now();return VE(this.database,`INSERT INTO environments (id, project_id, slug, name, kind, region, desired_state, discovered_state, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,E.projectId,E.slug,E.name,E.kind,E.region??null,Xr(E.desiredState??{}),Xr(E.discoveredState??{}),t,t]),X0(this.database.query("SELECT * FROM environments WHERE id = ?").get(r))}listEnvironments(E){return this.database.query("SELECT * FROM environments WHERE project_id = ? ORDER BY name COLLATE NOCASE, id").all(E).map(X0)}getEnvironmentBySlug(E,r){let t=this.database.query("SELECT * FROM environments WHERE project_id = ? AND slug = ?").get(E,r);return t?X0(t):void 0}createResource(E){let r=E.id??this.idFn(),t=this.now();return VE(this.database,`INSERT INTO resources (id, project_id, environment_id, kind, slug, name, provider, provider_id, desired_state, discovered_state, metadata, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,E.projectId,E.environmentId??null,E.kind,E.slug,E.name,E.provider??null,E.providerId??null,Xr(E.desiredState??{}),Xr(E.discoveredState??{}),Xr(E.metadata??{}),t,t]),J0(this.database.query("SELECT * FROM resources WHERE id = ?").get(r))}listResources(E,r){return(r?this.database.query("SELECT * FROM resources WHERE project_id = ? AND environment_id = ? ORDER BY kind, name COLLATE NOCASE").all(E,r):this.database.query("SELECT * FROM resources WHERE project_id = ? ORDER BY kind, name COLLATE NOCASE").all(E)).map(J0)}getResource(E){let r=this.database.query("SELECT * FROM resources WHERE id = ?").get(E);return r?J0(r):void 0}updateResource(E,r,t){let T=this.getResource(E);if(!T||T.version!==r)throw new he("Resource",E,r);if(VE(this.database,`UPDATE resources SET name = ?, provider = ?, provider_id = ?, desired_state = ?, discovered_state = ?, metadata = ?,
       version = version + 1, updated_at = ? WHERE id = ? AND version = ?`,[t.name??T.name,t.provider===null?null:t.provider??T.provider??null,t.providerId===null?null:t.providerId??T.providerId??null,Xr(t.desiredState??T.desiredState),Xr(t.discoveredState??T.discoveredState),Xr(t.metadata??T.metadata),this.now(),E,r]).changes!==1)throw new he("Resource",E,r);return this.getResource(E)}createActor(E){let r=E.id??this.idFn(),t=this.now();return VE(this.database,"INSERT INTO actors (id, kind, external_id, display_name, metadata, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[r,E.kind,E.externalId??null,E.displayName,Xr(E.metadata??{}),t,t]),y0(this.database.query("SELECT * FROM actors WHERE id = ?").get(r))}getActorByExternalId(E,r){let t=this.database.query("SELECT * FROM actors WHERE kind = ? AND external_id = ?").get(E,r);return t?y0(t):void 0}getActor(E){let r=this.database.query("SELECT * FROM actors WHERE id = ?").get(E);return r?y0(r):void 0}createOrganization(E){let r=E.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/.test(r))throw Error("Organization slugs must contain 3-64 lowercase letters, numbers, or dashes");let t=E.name.trim();if(!t||t.length>100)throw Error("Organization names must contain 1-100 characters");let T=E.id??this.idFn(),_=this.now();return VE(this.database,"INSERT INTO organizations (id, slug, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",[T,r,t,_,_]),this.getOrganization(T)}getOrganization(E){let r=this.database.query("SELECT * FROM organizations WHERE id = ?").get(E);return r?z0(r):void 0}getOrganizationBySlug(E){let r=this.database.query("SELECT * FROM organizations WHERE slug = ?").get(E.trim().toLowerCase());return r?z0(r):void 0}listOrganizations(E){return(E?this.database.query(`SELECT organizations.* FROM organizations JOIN organization_memberships ON organization_memberships.organization_id = organizations.id
           WHERE organization_memberships.actor_id = ? AND organization_memberships.status = 'active' ORDER BY organizations.name COLLATE NOCASE`).all(E):this.database.query("SELECT * FROM organizations ORDER BY name COLLATE NOCASE").all()).map(z0)}normalizeAuthorizationScope(E,r={type:"organization"}){if(r.type==="organization"){if(r.id&&r.id!==E)throw Error("Organization scope does not match the requested organization");return{type:"organization"}}if(!r.id)throw Error(`${r.type} scopes require an ID`);if(!this.resolveAuthorizationTarget(E,r))throw Error("Authorization scope was not found in this organization");return{type:r.type,id:r.id}}resolveAuthorizationTarget(E,r){if(!this.getOrganization(E))return;if(r.type==="organization")return{organizationId:E};if(!r.id)return;if(r.type==="project"){let T=this.database.query("SELECT id FROM projects WHERE id = ? AND organization_id = ?").get(r.id,E);return T?{organizationId:E,projectId:String(T.id)}:void 0}if(r.type==="environment"){let T=this.database.query("SELECT environments.id, environments.project_id FROM environments JOIN projects ON projects.id = environments.project_id WHERE environments.id = ? AND projects.organization_id = ?").get(r.id,E);return T?{organizationId:E,projectId:String(T.project_id),environmentId:String(T.id)}:void 0}let t=this.database.query(`SELECT resources.id, resources.project_id, resources.environment_id FROM resources
       JOIN projects ON projects.id = resources.project_id WHERE resources.id = ? AND projects.organization_id = ?`).get(r.id,E);return t?{organizationId:E,projectId:String(t.project_id),environmentId:tr(t.environment_id),resourceId:String(t.id)}:void 0}createMembership(E){if(!this.getActor(E.actorId))throw Error("Membership actor was not found");let r=this.normalizeAuthorizationScope(E.organizationId,E.scope);if(E.roleTemplate==="owner"&&r.type!=="organization")throw Error("Owners must be scoped to the organization");let t=E.id??this.idFn(),T=this.now();VE(this.database,`INSERT INTO organization_memberships (id, organization_id, actor_id, role_template, scope_type, scope_id, source, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,E.organizationId,E.actorId,E.roleTemplate,r.type,r.id??null,E.source??"manual",T,T]);let _=this.getMembership(t);return this.appendEvent({organizationId:E.organizationId,actorId:E.performedByActorId,type:"organization.membership.created",payload:{membershipId:t,actorId:E.actorId,roleTemplate:E.roleTemplate,scope:HA(r)}}),_}getMembership(E){let r=this.database.query("SELECT * FROM organization_memberships WHERE id = ?").get(E);return r?B0(r):void 0}getMembershipForActor(E,r){let t=this.database.query("SELECT * FROM organization_memberships WHERE organization_id = ? AND actor_id = ?").get(E,r);return t?B0(t):void 0}listMemberships(E,r={}){let t=r.includeRevoked?"":"AND status = 'active'";return this.database.query(`SELECT * FROM organization_memberships WHERE organization_id = ? ${t} ORDER BY created_at, id`).all(E).map(B0)}updateMembership(E){let r=this.getMembership(E.id);if(!r)throw Error("Membership was not found");let t=this.normalizeAuthorizationScope(r.organizationId,E.scope??r.scope);if(E.roleTemplate==="owner"&&t.type!=="organization")throw Error("Owners must be scoped to the organization");if(r.roleTemplate==="owner"&&r.status==="active"&&(E.roleTemplate!=="owner"||t.type!=="organization"))this.assertAnotherOwner(r);return VE(this.database,"UPDATE organization_memberships SET role_template = ?, scope_type = ?, scope_id = ?, session_version = session_version + 1, updated_at = ? WHERE id = ?",[E.roleTemplate,t.type,t.id??null,this.now(),r.id]),this.appendEvent({organizationId:r.organizationId,actorId:E.actorId,type:"organization.membership.updated",payload:{membershipId:r.id,from:{roleTemplate:r.roleTemplate,scope:HA(r.scope)},to:{roleTemplate:E.roleTemplate,scope:HA(t)}}}),this.getMembership(r.id)}revokeMembership(E,r){let t=this.getMembership(E);if(!t)throw Error("Membership was not found");if(t.status==="revoked")return t;if(t.roleTemplate==="owner")this.assertAnotherOwner(t);return VE(this.database,"UPDATE organization_memberships SET status = 'revoked', session_version = session_version + 1, updated_at = ? WHERE id = ?",[this.now(),E]),this.appendEvent({organizationId:t.organizationId,actorId:r,type:"organization.membership.revoked",payload:{membershipId:E}}),this.getMembership(E)}touchMembership(E){let r=this.now();VE(this.database,"UPDATE organization_memberships SET last_active_at = ?, updated_at = ? WHERE id = ? AND status = ?",[r,r,E,"active"]);let t=this.getMembership(E);if(!t)throw Error("Membership was not found");return t}assertAnotherOwner(E){if(Number(this.database.query("SELECT COUNT(*) AS count FROM organization_memberships WHERE organization_id = ? AND status = ? AND role_template = 'owner'").get(E.organizationId,"active")?.count??0)<=1)throw Error("Cannot remove or demote the last organization owner")}createInvitation(E){let r=E.email.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(r)||r.length>254)throw Error("A valid invitation email is required");let t=this.normalizeAuthorizationScope(E.organizationId,E.scope);if(E.roleTemplate==="owner"&&t.type!=="organization")throw Error("Owners must be scoped to the organization");let T=jM(32).toString("base64url"),_=w0("sha256").update(T).digest("hex"),d=E.id??this.idFn(),e=this.now(),h=new Date(this.nowFn().getTime()+Math.min(2592000000,Math.max(60000,E.expiresInMs??604800000))).toISOString();return VE(this.database,`INSERT INTO organization_invitations (id, organization_id, email, role_template, scope_type, scope_id, token_hash, invited_by_actor_id, expires_at, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,E.organizationId,E.actorId,E.roleTemplate,r.type,r.id??null,E.source??"manual",T,T]);let _=this.getMembership(t);return this.appendEvent({organizationId:E.organizationId,actorId:E.performedByActorId,type:"organization.membership.created",payload:{membershipId:t,actorId:E.actorId,roleTemplate:E.roleTemplate,scope:HA(r)}}),_}getMembership(E){let r=this.database.query("SELECT * FROM organization_memberships WHERE id = ?").get(E);return r?B0(r):void 0}getMembershipForActor(E,r){let t=this.database.query("SELECT * FROM organization_memberships WHERE organization_id = ? AND actor_id = ?").get(E,r);return t?B0(t):void 0}listMemberships(E,r={}){let t=r.includeRevoked?"":"AND status = 'active'";return this.database.query(`SELECT * FROM organization_memberships WHERE organization_id = ? ${t} ORDER BY created_at, id`).all(E).map(B0)}updateMembership(E){let r=this.getMembership(E.id);if(!r)throw Error("Membership was not found");let t=this.normalizeAuthorizationScope(r.organizationId,E.scope??r.scope);if(E.roleTemplate==="owner"&&t.type!=="organization")throw Error("Owners must be scoped to the organization");if(r.roleTemplate==="owner"&&r.status==="active"&&(E.roleTemplate!=="owner"||t.type!=="organization"))this.assertAnotherOwner(r);return VE(this.database,"UPDATE organization_memberships SET role_template = ?, scope_type = ?, scope_id = ?, session_version = session_version + 1, updated_at = ? WHERE id = ?",[E.roleTemplate,t.type,t.id??null,this.now(),r.id]),this.appendEvent({organizationId:r.organizationId,actorId:E.actorId,type:"organization.membership.updated",payload:{membershipId:r.id,from:{roleTemplate:r.roleTemplate,scope:HA(r.scope)},to:{roleTemplate:E.roleTemplate,scope:HA(t)}}}),this.getMembership(r.id)}revokeMembership(E,r){let t=this.getMembership(E);if(!t)throw Error("Membership was not found");if(t.status==="revoked")return t;if(t.roleTemplate==="owner")this.assertAnotherOwner(t);return VE(this.database,"UPDATE organization_memberships SET status = 'revoked', session_version = session_version + 1, updated_at = ? WHERE id = ?",[this.now(),E]),this.appendEvent({organizationId:t.organizationId,actorId:r,type:"organization.membership.revoked",payload:{membershipId:E}}),this.getMembership(E)}touchMembership(E){let r=this.now();VE(this.database,"UPDATE organization_memberships SET last_active_at = ?, updated_at = ? WHERE id = ? AND status = ?",[r,r,E,"active"]);let t=this.getMembership(E);if(!t)throw Error("Membership was not found");return t}assertAnotherOwner(E){if(Number(this.database.query("SELECT COUNT(*) AS count FROM organization_memberships WHERE organization_id = ? AND status = ? AND role_template = 'owner'").get(E.organizationId,"active")?.count??0)<=1)throw Error("Cannot remove or demote the last organization owner")}createInvitation(E){let r=E.email.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(r)||r.length>254)throw Error("A valid invitation email is required");let t=this.normalizeAuthorizationScope(E.organizationId,E.scope);if(E.roleTemplate==="owner"&&t.type!=="organization")throw Error("Owners must be scoped to the organization");let T=j8(32).toString("base64url"),_=w0("sha256").update(T).digest("hex"),d=E.id??this.idFn(),e=this.now(),h=new Date(this.nowFn().getTime()+Math.min(2592000000,Math.max(60000,E.expiresInMs??604800000))).toISOString();return VE(this.database,`INSERT INTO organization_invitations (id, organization_id, email, role_template, scope_type, scope_id, token_hash, invited_by_actor_id, expires_at, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[d,E.organizationId,r,E.roleTemplate,t.type,t.id??null,_,E.invitedByActorId??null,h,e,e]),this.appendEvent({organizationId:E.organizationId,actorId:E.invitedByActorId,type:"organization.invitation.created",payload:{invitationId:d,email:r,roleTemplate:E.roleTemplate,scope:HA(t),expiresAt:h}}),{invitation:this.getInvitation(d),token:T}}getInvitation(E){let r=this.database.query("SELECT * FROM organization_invitations WHERE id = ?").get(E);return r?WA(r,this.now()):void 0}listInvitations(E){return this.database.query("SELECT * FROM organization_invitations WHERE organization_id = ? ORDER BY created_at DESC").all(E).map((r)=>WA(r,this.now()))}inspectInvitationToken(E){let r=w0("sha256").update(E).digest("hex"),t=this.database.query("SELECT * FROM organization_invitations WHERE token_hash = ?").get(r);return t?WA(t,this.now()):void 0}acceptInvitation(E,r){let t=w0("sha256").update(E).digest("hex");return this.transaction(()=>{let T=this.database.query("SELECT * FROM organization_invitations WHERE token_hash = ?").get(t);if(!T)throw Error("Invitation is invalid");let _=WA(T,this.now());if(_.state!=="pending")throw Error(`Invitation is ${_.state}`);if(!this.getActor(r))throw Error("Invitation actor was not found");if(VE(this.database,"UPDATE organization_invitations SET accepted_by_actor_id = ?, accepted_at = ?, updated_at = ? WHERE id = ? AND accepted_at IS NULL AND revoked_at IS NULL AND expires_at > ?",[r,this.now(),this.now(),_.id,this.now()]).changes!==1)throw Error("Invitation is no longer available");let e=this.getMembershipForActor(_.organizationId,r),h=e??this.createMembership({organizationId:_.organizationId,actorId:r,roleTemplate:_.roleTemplate,scope:_.scope,source:"invitation"});if(e&&_.roleTemplate==="owner"&&e.roleTemplate!=="owner")h=this.updateMembership({id:e.id,roleTemplate:"owner",scope:{type:"organization"},actorId:r});else if(e)for(let R of yR(_.roleTemplate))this.upsertGrant({organizationId:_.organizationId,membershipId:e.id,effect:"allow",capability:R,scope:_.scope,source:"invitation"});return this.appendEvent({organizationId:_.organizationId,actorId:r,type:"organization.invitation.accepted",payload:{invitationId:_.id,membershipId:h.id}}),{invitation:this.getInvitation(_.id),membership:this.getMembership(h.id)}})}revokeInvitation(E,r){let t=this.getInvitation(E);if(!t)throw Error("Invitation was not found");if(t.acceptedAt)throw Error("Accepted invitations cannot be revoked");if(!t.revokedAt)VE(this.database,"UPDATE organization_invitations SET revoked_at = ?, updated_at = ? WHERE id = ?",[this.now(),this.now(),E]);return this.appendEvent({organizationId:t.organizationId,actorId:r,type:"organization.invitation.revoked",payload:{invitationId:E}}),this.getInvitation(E)}reissueInvitation(E,r){let t=this.getInvitation(E);if(!t)throw Error("Invitation was not found");if(t.state==="accepted")throw Error("Accepted invitations cannot be reissued");return this.revokeInvitation(E,r),this.createInvitation({organizationId:t.organizationId,email:t.email,roleTemplate:t.roleTemplate,scope:t.scope,invitedByActorId:r})}upsertGrant(E){if(!nt.includes(E.capability))throw Error("Unknown authorization capability");let r=this.getMembership(E.membershipId);if(!r||r.organizationId!==E.organizationId)throw Error("Grant membership was not found in this organization");let t=this.normalizeAuthorizationScope(E.organizationId,E.scope),T=this.now(),_=this.database.query("SELECT * FROM authorization_grants WHERE membership_id = ? AND effect = ? AND capability = ? AND scope_type = ? AND scope_id IS ?").get(E.membershipId,E.effect,E.capability,t.type,t.id??null);if(_)return W0(_);let d=E.id??this.idFn();return VE(this.database,`INSERT INTO authorization_grants (id, organization_id, membership_id, effect, capability, scope_type, scope_id, source, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[d,E.organizationId,E.membershipId,E.effect,E.capability,t.type,t.id??null,E.source??"manual",T,T]),VE(this.database,"UPDATE organization_memberships SET session_version = session_version + 1, updated_at = ? WHERE id = ?",[T,E.membershipId]),this.appendEvent({organizationId:E.organizationId,actorId:E.actorId,type:"organization.grant.created",payload:{grantId:d,membershipId:E.membershipId,effect:E.effect,capability:E.capability,scope:HA(t)}}),this.getGrant(d)}getGrant(E){let r=this.database.query("SELECT * FROM authorization_grants WHERE id = ?").get(E);return r?W0(r):void 0}listGrants(E){return this.database.query("SELECT * FROM authorization_grants WHERE membership_id = ? ORDER BY effect DESC, capability, scope_type, scope_id").all(E).map(W0)}removeGrant(E,r){let t=this.getGrant(E);if(!t)return!1;let T=VE(this.database,"DELETE FROM authorization_grants WHERE id = ?",[E]).changes===1;if(T)VE(this.database,"UPDATE organization_memberships SET session_version = session_version + 1, updated_at = ? WHERE id = ?",[this.now(),t.membershipId]),this.appendEvent({organizationId:t.organizationId,actorId:r,type:"organization.grant.removed",payload:{grantId:E,membershipId:t.membershipId}});return T}createOperation(E){if(E.idempotencyKey){let _=this.database.query("SELECT * FROM operations WHERE idempotency_key = ?").get(E.idempotencyKey);if(_)return th(_)}let r=E.id??this.idFn(),t=E.correlationId??this.idFn(),T=this.now();try{return this.transaction(()=>{return VE(this.database,`INSERT INTO operations (id, project_id, environment_id, resource_id, actor_id, kind, state, correlation_id, idempotency_key, input, output, priority, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, '{}', ?, ?, ?)`,[r,E.projectId??null,E.environmentId??null,E.resourceId??null,E.actorId??null,E.kind,t,E.idempotencyKey??null,Xr(E.input??{}),E.priority??0,T,T]),this.appendEvent({projectId:E.projectId,operationId:r,resourceId:E.resourceId,actorId:E.actorId,correlationId:t,type:"operation.queued",payload:{kind:E.kind}}),this.getOperation(r)})}catch(_){if(E.idempotencyKey){let d=this.database.query("SELECT * FROM operations WHERE idempotency_key = ?").get(E.idempotencyKey);if(d)return th(d)}throw _}}getOperation(E){let r=this.database.query("SELECT * FROM operations WHERE id = ?").get(E);return r?th(r):void 0}listOperations(E={}){let r=[],t=[];if(E.projectId)r.push("project_id = ?"),t.push(E.projectId);if(E.state)r.push("state = ?"),t.push(E.state);if(E.kind)r.push("kind = ?"),t.push(E.kind);if(E.before)r.push("created_at < ?"),t.push(E.before);let T=Math.min(500,Math.max(1,E.limit??100));t.push(T);let _=r.length?`WHERE ${r.join(" AND ")}`:"";return this.database.query(`SELECT * FROM operations ${_} ORDER BY created_at DESC, id DESC LIMIT ?`).all(...t).map(th)}claimNextOperation(E,r=60000,t){let T=this.now(),_=new Date(this.nowFn().getTime()+r).toISOString();return this.transaction(()=>{let d=t?.length?`AND kind IN (${YM(t.length)})`:"",e=t?[...t]:[],h=this.database.query(`SELECT * FROM operations WHERE state = 'queued' ${d} ORDER BY priority DESC, created_at ASC, id ASC LIMIT 1`).get(...e);if(!h)return;let R=th(h);if(VE(this.database,`UPDATE operations SET state = 'running', attempt = attempt + 1, lease_owner = ?, lease_expires_at = ?,
+          VALUES (?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, '{}', ?, ?, ?)`,[r,E.projectId??null,E.environmentId??null,E.resourceId??null,E.actorId??null,E.kind,t,E.idempotencyKey??null,Xr(E.input??{}),E.priority??0,T,T]),this.appendEvent({projectId:E.projectId,operationId:r,resourceId:E.resourceId,actorId:E.actorId,correlationId:t,type:"operation.queued",payload:{kind:E.kind}}),this.getOperation(r)})}catch(_){if(E.idempotencyKey){let d=this.database.query("SELECT * FROM operations WHERE idempotency_key = ?").get(E.idempotencyKey);if(d)return th(d)}throw _}}getOperation(E){let r=this.database.query("SELECT * FROM operations WHERE id = ?").get(E);return r?th(r):void 0}listOperations(E={}){let r=[],t=[];if(E.projectId)r.push("project_id = ?"),t.push(E.projectId);if(E.state)r.push("state = ?"),t.push(E.state);if(E.kind)r.push("kind = ?"),t.push(E.kind);if(E.before)r.push("created_at < ?"),t.push(E.before);let T=Math.min(500,Math.max(1,E.limit??100));t.push(T);let _=r.length?`WHERE ${r.join(" AND ")}`:"";return this.database.query(`SELECT * FROM operations ${_} ORDER BY created_at DESC, id DESC LIMIT ?`).all(...t).map(th)}claimNextOperation(E,r=60000,t){let T=this.now(),_=new Date(this.nowFn().getTime()+r).toISOString();return this.transaction(()=>{let d=t?.length?`AND kind IN (${Y8(t.length)})`:"",e=t?[...t]:[],h=this.database.query(`SELECT * FROM operations WHERE state = 'queued' ${d} ORDER BY priority DESC, created_at ASC, id ASC LIMIT 1`).get(...e);if(!h)return;let R=th(h);if(VE(this.database,`UPDATE operations SET state = 'running', attempt = attempt + 1, lease_owner = ?, lease_expires_at = ?,
         started_at = COALESCE(started_at, ?), updated_at = ?, version = version + 1 WHERE id = ? AND state = 'queued' AND version = ?`,[E,_,T,T,R.id,R.version]).changes!==1)return;return this.appendEvent({projectId:R.projectId,operationId:R.id,resourceId:R.resourceId,actorId:R.actorId,correlationId:R.correlationId,type:"operation.running",payload:{attempt:R.attempt+1,workerId:E}}),this.getOperation(R.id)})}claimOperation(E,r,t=60000){let T=this.now(),_=new Date(this.nowFn().getTime()+t).toISOString();return this.transaction(()=>{let d=this.getOperation(E);if(!d||d.state!=="queued")return;if(VE(this.database,`UPDATE operations SET state = 'running', attempt = attempt + 1, lease_owner = ?, lease_expires_at = ?,
-        started_at = COALESCE(started_at, ?), updated_at = ?, version = version + 1 WHERE id = ? AND state = 'queued' AND version = ?`,[r,_,T,T,d.id,d.version]).changes!==1)return;return this.appendEvent({projectId:d.projectId,operationId:d.id,resourceId:d.resourceId,actorId:d.actorId,correlationId:d.correlationId,type:"operation.running",payload:{attempt:d.attempt+1,workerId:r}}),this.getOperation(d.id)})}transitionOperation(E,r){return this.transaction(()=>{let t=this.getOperation(E);if(!t)throw Error(`Operation ${E} was not found`);let T=r.expectedVersion??t.version;if(t.version!==T)throw new he("Operation",E,T);if(!HM[t.state].includes(r.to))throw new pU(t.state,r.to);let _=this.now(),d=WM.includes(r.to),e=r.to==="queued";if(VE(this.database,`UPDATE operations SET state = ?, output = ?, error = ?, lease_owner = ?, lease_expires_at = ?,
+        started_at = COALESCE(started_at, ?), updated_at = ?, version = version + 1 WHERE id = ? AND state = 'queued' AND version = ?`,[r,_,T,T,d.id,d.version]).changes!==1)return;return this.appendEvent({projectId:d.projectId,operationId:d.id,resourceId:d.resourceId,actorId:d.actorId,correlationId:d.correlationId,type:"operation.running",payload:{attempt:d.attempt+1,workerId:r}}),this.getOperation(d.id)})}transitionOperation(E,r){return this.transaction(()=>{let t=this.getOperation(E);if(!t)throw Error(`Operation ${E} was not found`);let T=r.expectedVersion??t.version;if(t.version!==T)throw new he("Operation",E,T);if(!H8[t.state].includes(r.to))throw new pU(t.state,r.to);let _=this.now(),d=W8.includes(r.to),e=r.to==="queued";if(VE(this.database,`UPDATE operations SET state = ?, output = ?, error = ?, lease_owner = ?, lease_expires_at = ?,
         finished_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND version = ?`,[r.to,Xr(r.output??t.output),ED(r.error)??null,e||d?null:r.leaseOwner??t.leaseOwner??null,e||d?null:r.leaseExpiresAt??t.leaseExpiresAt??null,d?_:null,_,E,T]).changes!==1)throw new he("Operation",E,T);return this.appendEvent({projectId:t.projectId,operationId:E,resourceId:t.resourceId,actorId:t.actorId,correlationId:t.correlationId,type:`operation.${r.to}`,level:r.to==="failed"?"error":"info",payload:{from:t.state,to:r.to,error:ED(r.error)??null}}),this.getOperation(E)})}requestCancellation(E){let r=this.now();VE(this.database,"UPDATE operations SET cancel_requested_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND state IN ('queued', 'running')",[r,r,E]);let t=this.getOperation(E);if(!t)throw Error(`Operation ${E} was not found`);return t}reconcileOrphanedOperations(E={}){let r=(E.now??this.nowFn()).toISOString(),t=E.policy??"fail",T=this.database.query("SELECT * FROM operations WHERE state = 'running' AND (lease_expires_at IS NULL OR lease_expires_at <= ?)").all(r).map(th),_=0,d=0;for(let e of T)if(t==="requeue")this.transitionOperation(e.id,{to:"queued",expectedVersion:e.version,error:"Worker lease expired; operation requeued after restart."}),_++;else this.transitionOperation(e.id,{to:"failed",expectedVersion:e.version,error:"Worker lease expired or dashboard restarted before completion."}),d++;return{requeued:_,failed:d}}appendEvent(E){let r=E.id??this.idFn(),t=E.correlationId??this.idFn(),T=E.organizationId??(E.projectId?tr(this.database.query("SELECT organization_id FROM projects WHERE id = ?").get(E.projectId)?.organization_id):void 0);return VE(this.database,`INSERT INTO events (id, organization_id, project_id, operation_id, resource_id, actor_id, correlation_id, type, level, payload, created_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,T??null,E.projectId??null,E.operationId??null,E.resourceId??null,E.actorId??null,t,E.type,E.level??"info",Xr(E.payload??{}),this.now()]),rD(this.database.query("SELECT * FROM events WHERE id = ?").get(r))}listEvents(E={}){let r=[],t=[];if(E.organizationId)r.push("organization_id = ?"),t.push(E.organizationId);if(E.projectId)r.push("project_id = ?"),t.push(E.projectId);if(E.operationId)r.push("operation_id = ?"),t.push(E.operationId);if(E.resourceId)r.push("resource_id = ?"),t.push(E.resourceId);if(E.correlationId)r.push("correlation_id = ?"),t.push(E.correlationId);if(E.afterSequence!==void 0)r.push("sequence > ?"),t.push(E.afterSequence);let T=Math.min(1000,Math.max(1,E.limit??200));t.push(T);let _=r.length?`WHERE ${r.join(" AND ")}`:"";return this.database.query(`SELECT * FROM events ${_} ORDER BY sequence ASC LIMIT ?`).all(...t).map(rD)}setSetting(E,r){VE(this.database,`INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)
       ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`,[E,Xr(r),this.now()])}getSetting(E){let r=this.database.query("SELECT value FROM settings WHERE key = ?").get(E);return r?PT(r.value):void 0}upsertTag(E,r,t="#5a8be0"){let T=r.trim().toLowerCase().replace(/\s+/g,"-");if(!/^[a-z0-9][a-z0-9-]{0,31}$/.test(T))throw Error("Tag names must contain 1-32 letters, numbers, or dashes");if(!/^#[0-9a-f]{6}$/i.test(t))throw Error("Tag colors must be six-digit hex colors");let _=this.now(),d=this.database.query("SELECT * FROM tags WHERE project_id = ? AND normalized_name = ?").get(E,T);if(d)return VE(this.database,"UPDATE tags SET name = ?, color = ?, updated_at = ? WHERE id = ?",[r.trim(),t.toLowerCase(),_,String(d.id)]),BA(this.database.query("SELECT * FROM tags WHERE id = ?").get(String(d.id)));let e=this.idFn();return VE(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[e,E,r.trim(),T,t.toLowerCase(),_,_]),BA(this.database.query("SELECT * FROM tags WHERE id = ?").get(e))}listTags(E){return this.database.query("SELECT * FROM tags WHERE project_id = ? ORDER BY normalized_name").all(E).map(BA)}assignTag(E,r){if(!this.database.query("SELECT tags.id FROM tags JOIN resources ON resources.project_id = tags.project_id WHERE tags.id = ? AND resources.id = ?").get(r,E))throw Error("The tag and resource must belong to the same project");VE(this.database,"INSERT OR IGNORE INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[E,r,this.now()])}removeTag(E,r){VE(this.database,"DELETE FROM resource_tags WHERE resource_id = ? AND tag_id = ?",[E,r])}listResourceTags(E){return this.database.query(`SELECT resource_tags.resource_id, tags.* FROM resource_tags JOIN tags ON tags.id = resource_tags.tag_id
       WHERE tags.project_id = ? ORDER BY tags.normalized_name`).all(E).map((t)=>({resourceId:String(t.resource_id),tag:BA(t)}))}saveFilter(E,r,t,T){let _=r.trim();if(!_||_.length>64)throw Error("Saved filter names must contain 1-64 characters");if(!t||t.length>160||/^[a-z][a-z0-9+.-]*:|^\/\//i.test(t))throw Error("Saved filter routes must be local route IDs or paths");let d=Xr(T);if(d.length>8192)throw Error("Saved filter queries must be smaller than 8 KB");let e=this.database.query("SELECT * FROM saved_filters WHERE actor_key = ? AND name = ?").get(E,_),h=this.now();if(e)return VE(this.database,"UPDATE saved_filters SET route_id = ?, query = ?, updated_at = ? WHERE id = ?",[t,d,h,String(e.id)]),j0(this.database.query("SELECT * FROM saved_filters WHERE id = ?").get(String(e.id)));let R=this.idFn();return VE(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[R,E,_,t,d,h,h]),j0(this.database.query("SELECT * FROM saved_filters WHERE id = ?").get(R))}listSavedFilters(E){return this.database.query("SELECT * FROM saved_filters WHERE actor_key = ? ORDER BY updated_at DESC, name").all(E).map(j0)}deleteSavedFilter(E,r){return VE(this.database,"DELETE FROM saved_filters WHERE actor_key = ? AND id = ?",[E,r]).changes===1}recordNavigation(E,r,t){let T=this.now();return VE(this.database,`INSERT INTO navigation_items (actor_key, entity_type, entity_id, last_visited_at) VALUES (?, ?, ?, ?)
       ON CONFLICT(actor_key, entity_type, entity_id) DO UPDATE SET last_visited_at = excluded.last_visited_at, visit_count = visit_count + 1`,[E,r,t,T]),F0(this.database.query("SELECT * FROM navigation_items WHERE actor_key = ? AND entity_type = ? AND entity_id = ?").get(E,r,t))}setFavorite(E,r,t,T){let _=this.now();return VE(this.database,`INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at) VALUES (?, ?, ?, ?, ?)
-      ON CONFLICT(actor_key, entity_type, entity_id) DO UPDATE SET favorite = excluded.favorite`,[E,r,t,T?1:0,_]),F0(this.database.query("SELECT * FROM navigation_items WHERE actor_key = ? AND entity_type = ? AND entity_id = ?").get(E,r,t))}listNavigation(E,r={}){let t=r.favoritesOnly?"AND favorite = 1":"",T=Math.min(100,Math.max(1,r.limit??20));return this.database.query(`SELECT * FROM navigation_items WHERE actor_key = ? ${t} ORDER BY favorite DESC, last_visited_at DESC LIMIT ?`).all(E,T).map(F0)}compact(E={}){let r=new Date(this.nowFn().getTime()-(E.eventRetentionDays??90)*86400000).toISOString(),t=new Date(this.nowFn().getTime()-(E.operationRetentionDays??365)*86400000).toISOString(),T=this.transaction(()=>{let _=VE(this.database,"DELETE FROM events WHERE created_at < ?",[r]).changes,d=VE(this.database,"DELETE FROM operations WHERE created_at < ? AND state IN ('succeeded', 'failed', 'cancelled', 'timed_out')",[t]).changes;return{events:_,operations:d}});if(E.vacuum!==!1)this.database.run("VACUUM");return{deletedEvents:T.events,deletedOperations:T.operations,vacuumed:E.vacuum!==!1}}createBackup(E="manual"){if(this.path===":memory:")throw Error("Cannot create a filesystem backup for an in-memory control plane");let r=`${this.path}.${Date.now()}.bak`;return ej(r,this.database.serialize(),{mode:384}),this.setSetting("storage.last_backup",{path:r,createdAt:this.now(),reason:E}),r}integrityCheck(){let E=this.database.query("PRAGMA integrity_check").all();return E.length===1&&Object.values(E[0])[0]==="ok"?"ok":"corrupt"}health(){let E=Object.fromEntries(["queued","running","succeeded","failed","cancelled","timed_out"].map((_)=>[_,0]));for(let _ of this.database.query("SELECT state, COUNT(*) AS count FROM operations GROUP BY state").all())E[String(_.state)]=Number(_.count);let r=this.database.query("PRAGMA journal_mode").get(),t=this.getSetting("storage.last_backup"),T=t&&!Array.isArray(t)&&typeof t==="object"&&typeof t.createdAt==="string"?t.createdAt:void 0;return{path:this.path,schemaVersion:Number(this.database.query("PRAGMA user_version").get()?.user_version??0),supportedSchemaVersion:_d,integrity:this.integrityCheck(),journalMode:String(r?.journal_mode??"unknown"),databaseBytes:this.path!==":memory:"&&dj(this.path)?zM(this.path).size:this.database.serialize().byteLength,lastBackupAt:T,operations:E,pendingRetryableOperations:E.queued+E.failed+E.timed_out}}exportSnapshot(){let E={};for(let r of this.database.query("SELECT key, value FROM settings ORDER BY key").all())E[String(r.key)]=PT(r.value);return{format:"ts-cloud-control-plane",schemaVersion:_d,exportedAt:this.now(),organizations:this.database.query("SELECT * FROM organizations ORDER BY id").all().map(z0),memberships:this.database.query("SELECT * FROM organization_memberships ORDER BY id").all().map(B0),invitations:this.database.query("SELECT * FROM organization_invitations ORDER BY id").all().map((r)=>({...WA(r,this.now()),tokenHash:String(r.token_hash)})),grants:this.database.query("SELECT * FROM authorization_grants ORDER BY id").all().map(W0),projects:this.database.query("SELECT * FROM projects ORDER BY id").all().map(C0),environments:this.database.query("SELECT * FROM environments ORDER BY id").all().map(X0),resources:this.database.query("SELECT * FROM resources ORDER BY id").all().map(J0),actors:this.database.query("SELECT * FROM actors ORDER BY id").all().map(y0),operations:this.database.query("SELECT * FROM operations ORDER BY id").all().map(th),events:this.database.query("SELECT * FROM events ORDER BY sequence").all().map(rD),settings:E,tags:this.database.query("SELECT * FROM tags ORDER BY id").all().map(BA),resourceTags:this.database.query("SELECT * FROM resource_tags ORDER BY resource_id, tag_id").all().map((r)=>({resourceId:String(r.resource_id),tagId:String(r.tag_id),createdAt:String(r.created_at)})),savedFilters:this.database.query("SELECT * FROM saved_filters ORDER BY id").all().map(j0),navigationItems:this.database.query("SELECT * FROM navigation_items ORDER BY actor_key, entity_type, entity_id").all().map(F0)}}importSnapshot(E,r={}){if(E.format!=="ts-cloud-control-plane")throw Error("Unsupported control-plane snapshot format");if(E.schemaVersion>_d)throw new $0(E.schemaVersion,_d);this.transaction(()=>{if((Number(this.database.query("SELECT COUNT(*) AS count FROM projects").get()?.count??0)>0||Number(this.database.query("SELECT COUNT(*) AS count FROM operations").get()?.count??0)>0)&&!r.replace)throw Error("Control plane is not empty; pass replace: true to import this snapshot");if(r.replace)this.database.run("DELETE FROM authorization_grants"),this.database.run("DELETE FROM organization_invitations"),this.database.run("DELETE FROM organization_memberships"),this.database.run("DELETE FROM resource_tags"),this.database.run("DELETE FROM tags"),this.database.run("DELETE FROM saved_filters"),this.database.run("DELETE FROM navigation_items"),this.database.run("DELETE FROM events"),this.database.run("DELETE FROM operations"),this.database.run("DELETE FROM resources"),this.database.run("DELETE FROM environments"),this.database.run("DELETE FROM projects"),this.database.run("DELETE FROM actors"),this.database.run("DELETE FROM organizations"),this.database.run("DELETE FROM settings");for(let T of E.organizations??[])VE(this.database,"INSERT INTO organizations (id, slug, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",[T.id,T.slug,T.name,T.createdAt,T.updatedAt]);for(let T of E.projects)VE(this.database,`INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, version, created_at, updated_at)
+      ON CONFLICT(actor_key, entity_type, entity_id) DO UPDATE SET favorite = excluded.favorite`,[E,r,t,T?1:0,_]),F0(this.database.query("SELECT * FROM navigation_items WHERE actor_key = ? AND entity_type = ? AND entity_id = ?").get(E,r,t))}listNavigation(E,r={}){let t=r.favoritesOnly?"AND favorite = 1":"",T=Math.min(100,Math.max(1,r.limit??20));return this.database.query(`SELECT * FROM navigation_items WHERE actor_key = ? ${t} ORDER BY favorite DESC, last_visited_at DESC LIMIT ?`).all(E,T).map(F0)}compact(E={}){let r=new Date(this.nowFn().getTime()-(E.eventRetentionDays??90)*86400000).toISOString(),t=new Date(this.nowFn().getTime()-(E.operationRetentionDays??365)*86400000).toISOString(),T=this.transaction(()=>{let _=VE(this.database,"DELETE FROM events WHERE created_at < ?",[r]).changes,d=VE(this.database,"DELETE FROM operations WHERE created_at < ? AND state IN ('succeeded', 'failed', 'cancelled', 'timed_out')",[t]).changes;return{events:_,operations:d}});if(E.vacuum!==!1)this.database.run("VACUUM");return{deletedEvents:T.events,deletedOperations:T.operations,vacuumed:E.vacuum!==!1}}createBackup(E="manual"){if(this.path===":memory:")throw Error("Cannot create a filesystem backup for an in-memory control plane");let r=`${this.path}.${Date.now()}.bak`;return ej(r,this.database.serialize(),{mode:384}),this.setSetting("storage.last_backup",{path:r,createdAt:this.now(),reason:E}),r}integrityCheck(){let E=this.database.query("PRAGMA integrity_check").all();return E.length===1&&Object.values(E[0])[0]==="ok"?"ok":"corrupt"}health(){let E=Object.fromEntries(["queued","running","succeeded","failed","cancelled","timed_out"].map((_)=>[_,0]));for(let _ of this.database.query("SELECT state, COUNT(*) AS count FROM operations GROUP BY state").all())E[String(_.state)]=Number(_.count);let r=this.database.query("PRAGMA journal_mode").get(),t=this.getSetting("storage.last_backup"),T=t&&!Array.isArray(t)&&typeof t==="object"&&typeof t.createdAt==="string"?t.createdAt:void 0;return{path:this.path,schemaVersion:Number(this.database.query("PRAGMA user_version").get()?.user_version??0),supportedSchemaVersion:_d,integrity:this.integrityCheck(),journalMode:String(r?.journal_mode??"unknown"),databaseBytes:this.path!==":memory:"&&dj(this.path)?z8(this.path).size:this.database.serialize().byteLength,lastBackupAt:T,operations:E,pendingRetryableOperations:E.queued+E.failed+E.timed_out}}exportSnapshot(){let E={};for(let r of this.database.query("SELECT key, value FROM settings ORDER BY key").all())E[String(r.key)]=PT(r.value);return{format:"ts-cloud-control-plane",schemaVersion:_d,exportedAt:this.now(),organizations:this.database.query("SELECT * FROM organizations ORDER BY id").all().map(z0),memberships:this.database.query("SELECT * FROM organization_memberships ORDER BY id").all().map(B0),invitations:this.database.query("SELECT * FROM organization_invitations ORDER BY id").all().map((r)=>({...WA(r,this.now()),tokenHash:String(r.token_hash)})),grants:this.database.query("SELECT * FROM authorization_grants ORDER BY id").all().map(W0),projects:this.database.query("SELECT * FROM projects ORDER BY id").all().map(C0),environments:this.database.query("SELECT * FROM environments ORDER BY id").all().map(X0),resources:this.database.query("SELECT * FROM resources ORDER BY id").all().map(J0),actors:this.database.query("SELECT * FROM actors ORDER BY id").all().map(y0),operations:this.database.query("SELECT * FROM operations ORDER BY id").all().map(th),events:this.database.query("SELECT * FROM events ORDER BY sequence").all().map(rD),settings:E,tags:this.database.query("SELECT * FROM tags ORDER BY id").all().map(BA),resourceTags:this.database.query("SELECT * FROM resource_tags ORDER BY resource_id, tag_id").all().map((r)=>({resourceId:String(r.resource_id),tagId:String(r.tag_id),createdAt:String(r.created_at)})),savedFilters:this.database.query("SELECT * FROM saved_filters ORDER BY id").all().map(j0),navigationItems:this.database.query("SELECT * FROM navigation_items ORDER BY actor_key, entity_type, entity_id").all().map(F0)}}importSnapshot(E,r={}){if(E.format!=="ts-cloud-control-plane")throw Error("Unsupported control-plane snapshot format");if(E.schemaVersion>_d)throw new $0(E.schemaVersion,_d);this.transaction(()=>{if((Number(this.database.query("SELECT COUNT(*) AS count FROM projects").get()?.count??0)>0||Number(this.database.query("SELECT COUNT(*) AS count FROM operations").get()?.count??0)>0)&&!r.replace)throw Error("Control plane is not empty; pass replace: true to import this snapshot");if(r.replace)this.database.run("DELETE FROM authorization_grants"),this.database.run("DELETE FROM organization_invitations"),this.database.run("DELETE FROM organization_memberships"),this.database.run("DELETE FROM resource_tags"),this.database.run("DELETE FROM tags"),this.database.run("DELETE FROM saved_filters"),this.database.run("DELETE FROM navigation_items"),this.database.run("DELETE FROM events"),this.database.run("DELETE FROM operations"),this.database.run("DELETE FROM resources"),this.database.run("DELETE FROM environments"),this.database.run("DELETE FROM projects"),this.database.run("DELETE FROM actors"),this.database.run("DELETE FROM organizations"),this.database.run("DELETE FROM settings");for(let T of E.organizations??[])VE(this.database,"INSERT INTO organizations (id, slug, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",[T.id,T.slug,T.name,T.createdAt,T.updatedAt]);for(let T of E.projects)VE(this.database,`INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, version, created_at, updated_at)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T.id,T.slug,T.name,T.description??null,T.organizationId??null,T.desiredConfigHash??null,T.version,T.createdAt,T.updatedAt]);for(let T of E.environments)VE(this.database,`INSERT INTO environments (id, project_id, slug, name, kind, region, desired_state, discovered_state, version, created_at, updated_at)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T.id,T.projectId,T.slug,T.name,T.kind,T.region??null,Xr(T.desiredState),Xr(T.discoveredState),T.version,T.createdAt,T.updatedAt]);for(let T of E.resources)VE(this.database,`INSERT INTO resources (id, project_id, environment_id, kind, slug, name, provider, provider_id, desired_state, discovered_state, metadata, version, created_at, updated_at)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T.id,T.projectId,T.environmentId??null,T.kind,T.slug,T.name,T.provider??null,T.providerId??null,Xr(T.desiredState),Xr(T.discoveredState),Xr(T.metadata),T.version,T.createdAt,T.updatedAt]);for(let T of E.actors)VE(this.database,`INSERT INTO actors (id, kind, external_id, display_name, metadata, disabled_at, version, created_at, updated_at)
@@ -1451,8 +1451,8 @@ host:${e}
           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T.id,T.organizationId,T.membershipId,T.effect,T.capability,T.scope.type,T.scope.id??null,T.source??"manual",T.createdAt,T.updatedAt]);for(let T of E.operations)VE(this.database,`INSERT INTO operations (id, project_id, environment_id, resource_id, actor_id, kind, state, correlation_id, idempotency_key,
           input, output, error, attempt, priority, lease_owner, lease_expires_at, cancel_requested_at, started_at, finished_at, version, created_at, updated_at)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T.id,T.projectId??null,T.environmentId??null,T.resourceId??null,T.actorId??null,T.kind,T.state,T.correlationId,T.idempotencyKey??null,Xr(T.input),Xr(T.output),ED(T.error)??null,T.attempt,T.priority,T.leaseOwner??null,T.leaseExpiresAt??null,T.cancelRequestedAt??null,T.startedAt??null,T.finishedAt??null,T.version,T.createdAt,T.updatedAt]);for(let T of E.events)VE(this.database,`INSERT INTO events (sequence, id, organization_id, project_id, operation_id, resource_id, actor_id, correlation_id, type, level, payload, created_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T.sequence,T.id,T.organizationId??null,T.projectId??null,T.operationId??null,T.resourceId??null,T.actorId??null,T.correlationId,T.type,T.level,Xr(T.payload),T.createdAt]);for(let[T,_]of Object.entries(E.settings))VE(this.database,"INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)",[T,Xr(_),this.now()]);for(let T of E.tags??[])VE(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[T.id,T.projectId,T.name,T.normalizedName,T.color,T.createdAt,T.updatedAt]);for(let T of E.resourceTags??[])VE(this.database,"INSERT INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[T.resourceId,T.tagId,T.createdAt]);for(let T of E.savedFilters??[])VE(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[T.id,T.actorKey,T.name,T.routeId,Xr(T.query),T.createdAt,T.updatedAt]);for(let T of E.navigationItems??[])VE(this.database,"INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at, visit_count) VALUES (?, ?, ?, ?, ?, ?)",[T.actorKey,T.entityType,T.entityId,T.favorite?1:0,T.lastVisitedAt,T.visitCount])})}}var Nj,Aj=65536,tD=16384,WM,HM,fM,Sj;var Lj=$E(()=>{sU();iU();oU();Nj=Rj(".ts-cloud","control-plane.sqlite"),WM=["succeeded","failed","cancelled","timed_out"],HM={queued:["running","cancelled","timed_out"],running:["queued","succeeded","failed","cancelled","timed_out"],succeeded:[],failed:["queued"],cancelled:["queued"],timed_out:["queued"]},fM=/(?:^|_)(?:authorization|cookie|credential|password|passwd|secret|token|api_?key|private_?key|access_?key)(?:$|_)/i,Sj=/(?:authorization|password|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)\s*[=:]\s*[^\s,;]+/gi});function Oj(E,r){if(!E||typeof E!=="object"||Array.isArray(E))return[];let t=[];for(let[T,_]of Object.entries(E)){if(!r.has(T.toLowerCase()))continue;if(typeof _==="string")t.push(_);else if(Array.isArray(_))t.push(..._.filter((d)=>typeof d==="string"))}return t}function dD(E){return E.toLowerCase().trim().replace(/[^a-z0-9._:/@-]+/g," ")}function eD(E,r,t){let T=dD(E),_=dD(r),d=dD(t);if(!T)return 0;if(_===T)return 1000;if(_.startsWith(T))return 800-Math.min(100,_.length-T.length);if(_.includes(T))return 650-Math.min(100,_.indexOf(T));let e=T.split(/\s+/).filter(Boolean);if(e.every((R)=>d.includes(R)))return 400+e.length*10;let h=0;for(let R of T){if(h=d.indexOf(R,h),h<0)return 0;h++}return Math.max(1,180-Math.floor(d.length/20))}function MM(E,r){let t=E.kind.toLowerCase();if(t==="server"||t==="compute")return{type:"server",href:`/server/metrics?env=${encodeURIComponent(r)}`};if(t.includes("database")||["mysql","postgres","postgresql","sqlite","redis"].includes(t))return{type:"database",href:`/server/database?env=${encodeURIComponent(r)}&database=${encodeURIComponent(E.slug)}`};return{type:"service",href:`/server/sites?env=${encodeURIComponent(r)}&service=${encodeURIComponent(E.slug)}`}}function hD(E,r){let t=E.getProject(r.projectId);if(!t)return[];let T=E.listEnvironments(t.id),_=new Map(T.map((S)=>[S.id,S])),d=E.listResourceTags(t.id),e=new Map;for(let S of d){let L=e.get(S.resourceId)??[];L.push({id:S.tag.id,name:S.tag.name,color:S.tag.color}),e.set(S.resourceId,L)}let h=[],R=r.allowedResourceSlugs!==void 0;if(!R){h.push({type:"project",id:t.id,title:t.name,subtitle:t.slug,href:`/?project=${encodeURIComponent(t.slug)}`,tags:[],score:0});for(let S of T)h.push({type:"environment",id:S.id,title:S.name,subtitle:`${t.name} · ${S.kind}`,href:`/?env=${encodeURIComponent(S.slug)}`,environment:S.slug,tags:[],score:0})}let N=E.listResources(t.id).filter((S)=>!r.allowedResourceSlugs||r.allowedResourceSlugs.has(S.slug));for(let S of N){let L=S.environmentId?_.get(S.environmentId):void 0,O=e.get(S.id)??[],I=Oj(S.desiredState,QM),D=[S.name,S.slug,S.kind,S.provider,S.providerId,L?.slug,...I,...O.map((C)=>C.name)].filter(Boolean).join(" "),$=MM(S,L?.slug??T[0]?.slug??"");h.push({type:$.type,id:S.id,title:S.name,subtitle:[S.kind,...I.slice(0,2)].join(" · "),href:$.href,environment:L?.slug,provider:S.provider,tags:O,score:eD(r.query,S.name,D)})}if(!R)for(let S of E.listOperations({projectId:t.id,limit:500})){let L=S.environmentId?_.get(S.environmentId):void 0,O=Oj(S.input,GM),I=S.kind.includes("deploy"),D=O[0]??S.kind,$=[S.kind,S.id,S.correlationId,S.state,...O].join(" ");h.push({type:I?"deployment":"operation",id:S.id,title:D,subtitle:`${S.kind} · ${S.state}`,href:`/server/activity?env=${encodeURIComponent(L?.slug??T[0]?.slug??"")}&operation=${encodeURIComponent(S.id)}`,environment:L?.slug,status:S.state,tags:[],score:eD(r.query,D,$)})}for(let S of h)if(S.score===0)S.score=eD(r.query,S.title,`${S.title} ${S.subtitle} ${S.environment??""} ${S.provider??""}`);let A={service:0,server:1,database:2,deployment:3,environment:4,project:5,operation:6};return h.filter((S)=>S.score>0).sort((S,L)=>L.score-S.score||A[S.type]-A[L.type]||S.title.localeCompare(L.title)||S.id.localeCompare(L.id)).slice(0,Math.min(50,Math.max(1,r.limit??20)))}var QM,GM;var cj=$E(()=>{QM=new Set(["domain","domains","hostname","hostnames","url","repository","repo","image","label","labels"]),GM=new Set(["sha","commit","commitsha","release","releaseid"])});var rt=$E(()=>{iU();Lj();cj();sU();oU()});import{createHmac as VM}from"node:crypto";function lt(E){return[...new Set(E)].sort()}function Ij(E,r={}){let t=E.kind==="secret";return{id:E.id,key:E.key,kind:E.kind,scope:E.scope,inherited:!!r.inherited,overridden:!!r.overridden,required:E.required,backend:!t||r.canReadSecretMetadata?E.backend:void 0,backendVersion:!t||r.canReadSecretMetadata?E.backendVersion:void 0,reference:t&&r.canReadSecretMetadata?E.secretRef:void 0,value:!t?E.value:void 0,lastUsedAt:E.lastUsedAt,rotatedAt:E.rotatedAt,version:E.version,updatedAt:E.updatedAt}}class zR{store;backends=new Map;fingerprintKey;now;constructor(E,r){if(this.store=E,this.fingerprintKey=r.fingerprintKey??r.encryptionKey,this.now=r.now??(()=>new Date),!this.fingerprintKey)throw Error("Configuration fingerprint key is required.");let t=r.backends??[new ee(E.controlPlane,r.encryptionKey,this.now)];for(let T of t)this.backends.set(T.kind,T)}list(E){let r=E.search?.toLowerCase();return this.store.list(E).filter((t)=>!r||t.key.toLowerCase().includes(r)).map((t)=>Ij(t,{canReadSecretMetadata:E.canReadSecretMetadata}))}plan(E){let r=this.store.list({projectId:E.projectId,scope:E.scope}),t=new Map(r.map((R)=>[R.key,R])),T=[],_=[],d=[],e=[];for(let[R,N]of Object.entries(E.values)){T.push(...this.warnings(R,N));let A=t.get(R);if(!A)_.push(R);else if(A.valueFingerprint!==this.fingerprint(N))d.push(R);else e.push(R)}let h=E.removeMissing?r.filter((R)=>!Object.hasOwn(E.values,R.key)).map((R)=>R.key):[];return{added:lt(_),changed:lt(d),removed:lt(h),unchanged:lt(e),affectedResourceIds:this.affectedResources(E.projectId,E.scope,[..._,...d,...h]),warnings:T}}async set(E){let r=this.requestHash(E),t=E.idempotencyKey;if(t){let I=this.store.mutation(t);if(I){if(I.requestHash!==r)throw Error("Idempotency key was already used for a different configuration mutation.");let D=this.store.get(String(I.result.entryId??""));if(!D)throw Error("Idempotent configuration result is no longer available.");return{entry:D,mutation:I.result.mutation,warnings:[]}}}if(E.value!=null&&PM.test(E.value))throw Error("Secret references must use the reference field, not a plaintext value field.");let T=this.store.find(E.projectId,E.scope,E.key),_=this.fingerprint(E.value??E.reference??"");if(T&&E.expectedVersion!=null&&T.version!==E.expectedVersion)throw Error("Configuration entry changed; refresh and retry.");if(T&&T.kind!==E.kind)throw Error("Delete the existing entry before changing between variable and secret kinds.");let d=E.kind==="variable"?"plaintext":E.backend??(E.reference?"external":"local_encrypted");if(!!T&&(T.valueFingerprint!==_||T.backend!==d||T.required!==!!E.required)&&(this.isProduction(T)||this.store.dependencies(T.id).length>0)&&!E.confirmed)throw Error("Confirmation is required because this replacement affects production or dependent services.");let h=E.reference,R;if(E.kind==="secret"){let I=this.backend(d);if(E.reference&&E.value==null){if(!await I.validate(E.reference))throw Error("Secret backend reference is unavailable or invalid.");R=T?.backendVersion??"external"}else{if(E.value==null)throw Error("A secret value or external reference is required.");let D=await I.put({reference:T?.backend===d?T.secretRef:void 0,name:this.backendName(E),value:E.value,idempotencyKey:t??crypto.randomUUID()});h=D.reference,R=D.version}}let N=E.kind==="variable"?E.value:void 0;if(E.kind==="variable"&&N==null)throw Error("A variable value is required.");let A=!T||T.valueFingerprint!==_||T.backend!==d||T.secretRef!==h||T.backendVersion!==R||T.required!==!!E.required,S=T?A?this.store.update(T.id,T.version,{value:N,valueFingerprint:_,secretRef:h,backend:d,backendVersion:R,required:!!E.required,metadata:ZE(E.metadata??T.metadata),rotatedAt:E.kind==="secret"?this.now().toISOString():T.rotatedAt}):T:this.store.create({organizationId:E.organizationId,projectId:E.projectId,scope:E.scope,key:E.key,kind:E.kind,value:N,valueFingerprint:_,secretRef:h,backend:d,backendVersion:R,origin:E.origin??"managed",required:!!E.required,metadata:ZE(E.metadata??{}),rotatedAt:E.kind==="secret"?this.now().toISOString():void 0}),L=this.affectedResources(E.projectId,E.scope,[E.key]),O={added:T?[]:[E.key],changed:T&&A?[E.key]:[],removed:[],unchanged:T&&!A?[E.key]:[],affectedResourceIds:L,versions:{[E.key]:S.version}};if(t)this.store.recordMutation({projectId:E.projectId,idempotencyKey:t,requestHash:r,actorId:E.actorId,result:{entryId:S.id,mutation:O}});return this.audit(E.projectId,E.actorId,T&&A?"configuration.updated":T?"configuration.unchanged":"configuration.created",S,L),{entry:S,mutation:O,warnings:this.warnings(E.key,E.value??"")}}async importDotenv(E){let r=kU(E.source);if(!r.valid)return{document:r,warnings:[]};let t=new Set(E.secretKeys??[]),T={added:[],changed:[],removed:[],unchanged:[],affectedResourceIds:[],versions:{}},_=[];for(let[d,e]of Object.entries(r.values)){let h=await this.set({...E,source:void 0,key:d,value:e,kind:t.has(d)?"secret":"variable",idempotencyKey:E.idempotencyKey?`${E.idempotencyKey}:${d}`:void 0});T.added.push(...h.mutation.added),T.changed.push(...h.mutation.changed),T.unchanged.push(...h.mutation.unchanged),T.affectedResourceIds.push(...h.mutation.affectedResourceIds),Object.assign(T.versions,h.mutation.versions),_.push(...h.warnings)}return T.added=lt(T.added),T.changed=lt(T.changed),T.unchanged=lt(T.unchanged),T.affectedResourceIds=lt(T.affectedResourceIds),{document:r,mutation:T,warnings:_}}exportVariables(E){return uU(Object.fromEntries(this.store.list({projectId:E.projectId,scope:E.scope,kind:"variable"}).map((r)=>[r.key,r.value??""])))}async transfer(E){let r=this.store.get(E.entryId);if(!r)throw Error("Configuration entry was not found.");if(r.scope.type===E.targetScope.type&&r.scope.id===E.targetScope.id)throw Error("Choose a different destination scope.");let t=r.kind==="variable"?r.value:r.backend==="external"?void 0:await this.backend(r.backend).resolve(r.secretRef),T=r.kind==="secret"?r.backend:void 0,_=await this.set({organizationId:r.organizationId,projectId:r.projectId,scope:E.targetScope,key:r.key,kind:r.kind,value:t,reference:r.backend==="external"?r.secretRef:void 0,backend:T,required:r.required,metadata:r.metadata,confirmed:E.confirmed,actorId:E.actorId,idempotencyKey:E.idempotencyKey?`${E.idempotencyKey}:copy`:void 0,origin:r.origin});if(E.mode==="move")await this.remove({entryId:r.id,expectedVersion:r.version,confirmed:E.confirmed,actorId:E.actorId});let d={added:_.mutation.added,changed:_.mutation.changed,removed:E.mode==="move"?[r.key]:[],unchanged:_.mutation.unchanged,affectedResourceIds:lt([..._.mutation.affectedResourceIds,...this.affectedResources(r.projectId,r.scope,[r.key])]),versions:_.mutation.versions};return{entry:_.entry,mutation:d}}async resolve(E){let r=this.store.list({projectId:E.projectId}),t=r.filter((N)=>this.applies(N,E)).sort((N,A)=>this.rank(N.scope.type)-this.rank(A.scope.type)),T=new Map,_=new Set;for(let N of t){if(T.has(N.key))_.add(N.key);T.set(N.key,N)}let d={},e={},h=[],R=new Set(E.allowedPreviewSecrets??[]);for(let[N,A]of T){if(E.previewId&&A.kind==="secret"&&A.scope.type!=="preview"&&(!E.trustedPreview||!R.has(N)))continue;if(A.kind==="variable")d[N]=A.value??"";else if(E.nativeReferences)d[N]=A.secretRef;else{let S=this.backend(A.backend);if(!await S.validate(A.secretRef)){if(h.push({key:N,code:"stale_reference",message:`${N} points to an unavailable secret.`}),A.required)h.push({key:N,code:"missing_required",message:`${N} is required but unavailable.`});continue}d[N]=await S.resolve(A.secretRef)}e[N]=Ij(A,{inherited:A.scope.type!==(E.previewId?"preview":E.functionId?"function":E.resourceId?"service":E.environmentId?"environment":"project"),overridden:_.has(N),canReadSecretMetadata:E.canReadSecretMetadata}),this.store.controlPlane.database.run("UPDATE configuration_entries SET last_used_at=? WHERE id=?",[this.now().toISOString(),A.id])}return{values:d,entries:e,warnings:h,configurationHash:this.fingerprint([...T.values()].map((N)=>`${N.key}:${N.valueFingerprint}:${N.version}`).sort().join(`
-`))}}async reveal(E){let r=this.store.get(E.entryId);if(!r||r.kind!=="secret")throw Error("Configuration secret was not found.");if(!E.canRevealSecrets)throw Error("Secret reveal permission is required.");if(!E.recentlyAuthenticated)throw Error("Recent authentication is required to reveal a secret.");let t=await this.backend(r.backend).resolve(r.secretRef);return this.audit(r.projectId,E.actorId,"configuration.secret.revealed",r,[]),t}async remove(E){let r=this.store.get(E.entryId);if(!r)throw Error("Configuration entry was not found.");let t=this.store.dependencies(r.id);if(((r.scope.environmentId?this.store.controlPlane.listEnvironments(r.projectId).some((e)=>e.id===r.scope.environmentId&&e.kind==="production"):r.scope.type==="project")||t.length)&&!E.confirmed)throw Error("Confirmation is required because this configuration affects production or dependent services.");if(r.kind==="secret"&&r.backend!=="external")await this.backend(r.backend).remove(r.secretRef);this.store.remove(r.id,E.expectedVersion);let _=lt(t.map((e)=>e.resourceId)),d={added:[],changed:[],removed:[r.key],unchanged:[],affectedResourceIds:_,versions:{}};return this.audit(r.projectId,E.actorId,"configuration.deleted",r,_),d}applies(E,r){if(E.scope.type==="project")return!0;if(E.scope.type==="environment")return E.scope.id===r.environmentId;if(E.scope.type==="service")return E.scope.id===r.resourceId;if(E.scope.type==="function")return E.scope.id===r.functionId;return E.scope.id===r.previewId}rank(E){return{project:0,environment:1,service:2,function:3,preview:4}[E]}fingerprint(E){return`hmac-sha256:${VM("sha256",this.fingerprintKey).update(E).digest("hex")}`}requestHash(E){return this.fingerprint(JSON.stringify({...E,idempotencyKey:void 0,actorId:void 0}))}backend(E){let r=this.backends.get(E);if(!r)throw Error(`Configuration secret backend is not configured: ${E}`);return r}backendName(E){return`ts-cloud/${E.projectId}/${E.scope.type}/${E.scope.id}/${E.key}`.replace(/[^A-Za-z0-9/_+=.@-]/g,"-")}isProduction(E){return E.scope.type==="project"||!!E.scope.environmentId&&this.store.controlPlane.listEnvironments(E.projectId).some((r)=>r.id===E.scope.environmentId&&r.kind==="production")}warnings(E,r){let t=[];if(KM.test(E))t.push({key:E,code:"reserved",message:`${E} may be reserved by the runtime or provider.`});if(Buffer.byteLength(r)>65536)t.push({key:E,code:"limit",message:`${E} exceeds the portable 64 KiB value limit.`});return t}affectedResources(E,r,t){let T=this.store.list({projectId:E,scope:r}).filter((_)=>t.includes(_.key)).flatMap((_)=>this.store.dependencies(_.id).map((d)=>d.resourceId));if(r.type==="service"||r.type==="function")return lt([...T,r.id]);if(r.type==="environment")return lt([...T,...this.store.controlPlane.listResources(E,r.id).map((_)=>_.id)]);if(r.type==="preview"){let _=this.store.controlPlane.database.query("SELECT resource_id FROM preview_instances WHERE id=?").get(r.id);return lt([...T,..._?[_.resource_id]:[]])}return lt([...T,...this.store.controlPlane.listResources(E).map((_)=>_.id)])}audit(E,r,t,T,_){this.store.controlPlane.appendEvent({projectId:E,actorId:r,type:t,payload:{entryId:T.id,key:T.key,kind:T.kind,scopeType:T.scope.type,scopeId:T.scope.id,backend:T.backend,version:T.version,affectedResourceIds:_}})}}var PM,KM;var Uj=$E(()=>{rt();vU();nU();PM=/^(?:secret|aws-sm|aws-ssm|vault|doppler|op|external):\/\//,KM=/^(?:AWS_|TS_CLOUD_|PORT$|HOST$)/});async function fA(E,r,t,T){let _={added:0,changed:0,removed:0,overridden:0},d=async(e,h)=>{let R=E.store.list({projectId:r.project.id,scope:e,kind:"variable"}),N=new Set(Object.keys(h));for(let A of R.filter((S)=>S.origin==="config"&&!N.has(S.key)))await E.remove({entryId:A.id,expectedVersion:A.version,confirmed:!0,actorId:T}),_.removed++;for(let[A,S]of Object.entries(h)){let L=E.store.find(r.project.id,e,A);if(L?.origin!=="config"){if(L)_.overridden++;else await E.set({organizationId:r.organization.id,projectId:r.project.id,scope:e,key:A,kind:"variable",value:String(S),origin:"config",confirmed:!0,actorId:T}),_.added++;continue}if(L.value===String(S))continue;await E.set({organizationId:r.organization.id,projectId:r.project.id,scope:e,key:A,kind:"variable",value:String(S),origin:"config",confirmed:!0,actorId:T,expectedVersion:L.version}),_.changed++}};for(let[e,h]of Object.entries(t.environments??{})){let R=r.environments.get(e);if(!R)continue;let N=h,A={...N.variables??{},...N.app?.env??{}};await d({type:"environment",id:R.id,environmentId:R.id},A);for(let[S,L]of Object.entries(t.sites??{})){let O=r.store.listResources(r.project.id,R.id).find((I)=>I.kind==="application"&&I.slug===S);if(O)await d({type:"service",id:O.id,environmentId:R.id,resourceId:O.id},{...L.env??{}})}for(let[S,L]of Object.entries(t.infrastructure?.functions??{})){let O=r.store.listResources(r.project.id,R.id).find((I)=>I.kind==="function"&&I.slug===S);if(O)await d({type:"function",id:O.id,environmentId:R.id,resourceId:O.id},{...L.environment??{}})}}return _}var Dj={};Qr(Dj,{synchronizeConfiguredConfiguration:()=>fA,serializeDotenv:()=>uU,parseDotenv:()=>kU,LocalEncryptedConfigurationBackend:()=>ee,ExternalConfigurationBackend:()=>JR,ConfigurationStore:()=>wR,ConfigurationService:()=>zR,AwsSsmConfigurationBackend:()=>XR,AwsSecretsManagerConfigurationBackend:()=>CR});var YA=$E(()=>{nU();vU();Uj()});function Sz(E,r=""){return E===408||E===409||E===425||E===429||E>=500||/rate limit|temporar|timed? ?out|try again/i.test(r)}async function N$(E,r){let t=r?.headers.get("retry-after"),T=t===null||t===void 0?void 0:Number(t)*1000,_=Number.isFinite(T)?Math.max(0,T):Math.min(1000*2**(E-1),30000);await new Promise((d)=>setTimeout(d,_))}class uA{name="porkbun";apiKey;secretKey;requestTimeoutMs;constructor(E,r,t=15000){this.apiKey=E,this.secretKey=r,this.requestTimeoutMs=t}async request(E,r={}){let t;for(let T=1;T<=8;T+=1){let _,d=new AbortController,e=setTimeout(()=>{d.abort(Error(`Porkbun API request timed out after ${this.requestTimeoutMs}ms`))},this.requestTimeoutMs);try{_=await fetch(`https://api.porkbun.com/api/json/v3${E}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({apikey:this.apiKey,secretapikey:this.secretKey,...r}),signal:d.signal})}catch(R){if(t=R,T===8)throw R;await N$(T);continue}finally{clearTimeout(e)}if(!_.ok){if(t=Error(`Porkbun API error: ${_.status} ${_.statusText}`),!Sz(_.status)||T===8)throw t;await N$(T,_);continue}let h=await _.json();if(h.status==="ERROR"){if(t=Error(`Porkbun API error: ${h.message||"Unknown error"}`),!Sz(0,h.message)||T===8)throw t;await N$(T,_);continue}return h}throw t}getSubdomain(E,r){let t=E.replace(/\.$/,""),T=r.replace(/\.$/,"");if(t===T)return"";if(t.endsWith(`.${T}`))return t.slice(0,-(T.length+1));return t}getRootDomain(E){let r=E.replace(/\.$/,"").split(".");if(r.length>=2)return r.slice(-2).join(".");return E}async createRecord(E,r){try{let t=this.getRootDomain(E),T=this.getSubdomain(r.name,t),_={type:r.type,content:r.content,ttl:String(r.ttl||600)};if(T)_.name=T;if((r.type==="MX"||r.type==="SRV")&&r.priority!==void 0)_.prio=String(r.priority);if(r.type==="SRV"&&r.weight!==void 0&&r.port!==void 0)_.content=`${r.weight} ${r.port} ${r.content}`;return{success:!0,id:(await this.request(`/dns/create/${t}`,_)).id?.toString(),message:"Record created successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async upsertRecord(E,r){try{let t=this.getRootDomain(E),T=this.getSubdomain(r.name,t),_=await this.listRecords(E,r.type);if(_.success){let d=_.records.find((e)=>{return this.getSubdomain(e.name,t)===T&&e.type===r.type});if(d?.id){let e={type:r.type,content:r.content,ttl:String(r.ttl||600)};if(T)e.name=T;if((r.type==="MX"||r.type==="SRV")&&r.priority!==void 0)e.prio=String(r.priority);if(r.type==="SRV"&&r.weight!==void 0&&r.port!==void 0)e.content=`${r.weight} ${r.port} ${r.content}`;return await this.request(`/dns/edit/${t}/${d.id}`,e),{success:!0,id:d.id,message:"Record updated successfully"}}}return this.createRecord(E,r)}catch(t){return this.createRecord(E,r)}}async deleteRecord(E,r){try{let t=this.getRootDomain(E);if("id"in r&&r.id)return await this.request(`/dns/delete/${t}/${r.id}`),{success:!0,message:"Record deleted successfully"};let T=this.getSubdomain(r.name,t),_=await this.listRecords(E);if(!_.success)return{success:!1,message:"Failed to list records"};let d=_.records.find((e)=>{return this.getSubdomain(e.name,t)===T&&e.type===r.type&&e.content===r.content});if(!d?.id)return{success:!1,message:"Record not found"};return await this.request(`/dns/delete/${t}/${d.id}`),{success:!0,message:"Record deleted successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async listRecords(E,r){try{let t=this.getRootDomain(E),T=`/dns/retrieve/${t}`;if(r)T=`/dns/retrieveByNameType/${t}/${r}`;return{success:!0,records:((await this.request(T)).records||[]).map((e)=>({id:e.id,name:e.name||t,type:e.type,content:e.content,ttl:Number.parseInt(e.ttl,10),priority:e.prio?Number.parseInt(e.prio,10):void 0}))}}catch(t){return{success:!1,records:[],message:t instanceof Error?t.message:"Unknown error"}}}async canManageDomain(E){try{let r=this.getRootDomain(E);return await this.request(`/dns/retrieve/${r}`),!0}catch{return!1}}async listDomains(){try{return((await this.request("/domain/listAll")).domains||[]).map((r)=>r.domain)}catch{return[]}}async getNameServers(E){try{let r=this.getRootDomain(E);return(await this.request(`/dns/getNS/${r}`)).ns||[]}catch{return[]}}async updateNameServers(E,r){try{let t=this.getRootDomain(E);return await this.request(`/dns/updateNS/${t}`,{ns:r}),!0}catch{return!1}}}class nA{name="godaddy";apiKey;apiSecret;baseUrl;constructor(E,r,t="production"){this.apiKey=E,this.apiSecret=r,this.baseUrl=t==="ote"?"https://api.ote-godaddy.com":"https://api.godaddy.com"}async request(E,r,t){let T=`${this.baseUrl}${r}`,_={Authorization:`sso-key ${this.apiKey}:${this.apiSecret}`,"Content-Type":"application/json",Accept:"application/json"},d={method:E,headers:_};if(t)d.body=JSON.stringify(t);let e=await fetch(T,d);if(e.status===204)return{};if(e.ok){let R=await e.text();if(R)return JSON.parse(R);return{}}let h=`GoDaddy API error: ${e.status} ${e.statusText}`;try{let R=await e.json();if(R.message)h=`GoDaddy API error: ${R.message}`;if(R.fields)h+=` - Fields: ${JSON.stringify(R.fields)}`}catch{}throw Error(h)}getSubdomain(E,r){let t=E.replace(/\.$/,""),T=r.replace(/\.$/,"");if(t===T)return"@";if(t.endsWith(`.${T}`))return t.slice(0,-(T.length+1));return t}getRootDomain(E){let r=E.replace(/\.$/,"").split(".");if(r.length>=2)return r.slice(-2).join(".");return E}toGoDaddyRecord(E,r){let t=this.getRootDomain(r),T=this.getSubdomain(E.name,t),_={type:E.type,name:T,data:E.content,ttl:E.ttl||600};if(E.type==="MX"&&E.priority!==void 0)_.priority=E.priority;return _}fromGoDaddyRecord(E,r){let t=this.getRootDomain(r),T=E.name;if(T==="@")T=t;else if(!T.endsWith(t))T=`${T}.${t}`;return{name:T,type:E.type,content:E.data,ttl:E.ttl,priority:E.priority}}async createRecord(E,r){try{let t=this.getRootDomain(E),T=this.toGoDaddyRecord(r,E);return await this.request("PATCH",`/v1/domains/${t}/records`,[T]),{success:!0,message:"Record created successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async upsertRecord(E,r){try{let t=this.getRootDomain(E),T=this.toGoDaddyRecord(r,E);return await this.request("PUT",`/v1/domains/${t}/records/${r.type}/${T.name}`,[T]),{success:!0,message:"Record upserted successfully"}}catch(t){return this.createRecord(E,r)}}async deleteRecord(E,r){try{let t=this.getRootDomain(E),T=this.getSubdomain(r.name,t),_=await this.request("GET",`/v1/domains/${t}/records/${r.type}/${T}`),d=_.filter((e)=>e.data!==r.content);if(d.length===_.length)return{success:!1,message:"Record not found"};if(d.length===0)try{await this.request("DELETE",`/v1/domains/${t}/records/${r.type}/${T}`)}catch{}else await this.request("PUT",`/v1/domains/${t}/records/${r.type}/${T}`,d);return{success:!0,message:"Record deleted successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async listRecords(E,r){try{let t=this.getRootDomain(E),T=`/v1/domains/${t}/records`;if(r)T=`/v1/domains/${t}/records/${r}`;return{success:!0,records:(await this.request("GET",T)).map((d)=>this.fromGoDaddyRecord(d,E))}}catch(t){return{success:!1,records:[],message:t instanceof Error?t.message:"Unknown error"}}}async canManageDomain(E){try{let r=this.getRootDomain(E);return await this.request("GET",`/v1/domains/${r}`),!0}catch{return!1}}async listDomains(){try{return(await this.request("GET","/v1/domains")).map((r)=>r.domain)}catch{return[]}}async getDomainDetails(E){try{let r=this.getRootDomain(E),t=await this.request("GET",`/v1/domains/${r}`);return{domain:t.domain,status:t.status,nameServers:t.nameServers,expires:t.expires}}catch{return null}}async updateNameServers(E,r){try{let t=this.getRootDomain(E);return await this.request("PUT",`/v1/domains/${t}/records/NS`,r.map((T)=>({type:"NS",name:"@",data:T,ttl:3600}))),!0}catch{return!1}}async checkDomainAvailability(E){try{let r=await this.request("GET",`/v1/domains/available?domain=${encodeURIComponent(E)}`);return{available:r.available,price:r.price,currency:r.currency}}catch{return{available:!1}}}}class yO{name="cloudflare";apiToken;zoneCache=new Map;constructor(E){this.apiToken=E}async request(E,r,t){let T=`https://api.cloudflare.com/client/v4${r}`,_={Authorization:`Bearer ${this.apiToken}`,"Content-Type":"application/json"},d={method:E,headers:_};if(t)d.body=JSON.stringify(t);let h=await(await fetch(T,d)).json();if(!h.success){let R=h.errors.map((N)=>N.message).join(", ");throw Error(`Cloudflare API error: ${R}`)}return h}getRootDomain(E){let r=E.replace(/\.$/,"").split(".");if(r.length>=2)return r.slice(-2).join(".");return E}async getZoneId(E){let r=this.getRootDomain(E),t=this.zoneCache.get(r);if(t)return t;let T=await this.request("GET",`/zones?name=${encodeURIComponent(r)}`);if(!T.result||T.result.length===0)throw Error(`Zone not found for domain: ${r}`);let _=T.result[0].id;return this.zoneCache.set(r,_),_}getFullRecordName(E,r){let t=this.getRootDomain(r),T=E.replace(/\.$/,"");if(!T||T===t||T==="@")return t;if(T.endsWith(`.${t}`))return T;return`${T}.${t}`}toCloudflareRecord(E,r){let t={type:E.type,name:this.getFullRecordName(E.name,r),content:E.content||E.value||"",ttl:E.ttl||1};if(E.type==="MX"&&E.priority!==void 0)t.priority=E.priority;if(E.type==="SRV"){if(E.priority!==void 0)t.priority=E.priority}return t}fromCloudflareRecord(E){return{id:E.id,name:E.name,type:E.type,content:E.content,ttl:E.ttl,priority:E.priority}}async createRecord(E,r){try{let t=await this.getZoneId(E),T=this.toCloudflareRecord(r,E);return{success:!0,id:(await this.request("POST",`/zones/${t}/dns_records`,T)).result.id,message:"Record created successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async upsertRecord(E,r){try{let t=await this.getZoneId(E),T=this.getFullRecordName(r.name,E),_=await this.request("GET",`/zones/${t}/dns_records?type=${r.type}&name=${encodeURIComponent(T)}`),d=this.toCloudflareRecord(r,E);if(_.result&&_.result.length>0){let h=_.result[0].id;return{success:!0,id:(await this.request("PUT",`/zones/${t}/dns_records/${h}`,d)).result.id,message:"Record updated successfully"}}return{success:!0,id:(await this.request("POST",`/zones/${t}/dns_records`,d)).result.id,message:"Record created successfully"}}catch(t){return this.createRecord(E,r)}}async deleteRecord(E,r){try{let t=await this.getZoneId(E),T=this.getFullRecordName(r.name,E),_=await this.request("GET",`/zones/${t}/dns_records?type=${r.type}&name=${encodeURIComponent(T)}`);if(!_.result||_.result.length===0)return{success:!1,message:"Record not found"};let d=_.result.find((e)=>e.content===r.content);if(!d)return{success:!1,message:"Record with matching content not found"};return await this.request("DELETE",`/zones/${t}/dns_records/${d.id}`),{success:!0,message:"Record deleted successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async listRecords(E,r){try{let T=`/zones/${await this.getZoneId(E)}/dns_records?per_page=100`;if(r)T+=`&type=${r}`;let _=[],d=1,e=!0;while(e){let h=await this.request("GET",`${T}&page=${d}`);if(_.push(...h.result||[]),h.result_info)e=d<h.result_info.total_pages,d++;else e=!1}return{success:!0,records:_.map((h)=>this.fromCloudflareRecord(h))}}catch(t){return{success:!1,records:[],message:t instanceof Error?t.message:"Unknown error"}}}async canManageDomain(E){try{return await this.getZoneId(E),!0}catch{return!1}}async listDomains(){try{let E=[],r=1,t=!0;while(t){let T=await this.request("GET",`/zones?per_page=50&page=${r}`);if(E.push(...T.result||[]),T.result_info)t=r<T.result_info.total_pages,r++;else t=!1}return E.map((T)=>T.name)}catch{return[]}}async getZoneDetails(E){try{let r=await this.getZoneId(E),t=await this.request("GET",`/zones/${r}`);return{id:t.result.id,name:t.result.name,status:t.result.status,nameServers:t.result.name_servers,paused:t.result.paused}}catch{return null}}async purgeCache(E,r){try{let t=await this.getZoneId(E),T={};if(r?.purgeEverything)T.purge_everything=!0;else{if(r?.files)T.files=r.files;if(r?.tags)T.tags=r.tags;if(r?.hosts)T.hosts=r.hosts}if(Object.keys(T).length===0)T.purge_everything=!0;return await this.request("POST",`/zones/${t}/purge_cache`,T),!0}catch{return!1}}async getRecordProxyStatus(E,r){try{let t=await this.getZoneId(E),T=this.getFullRecordName(r.name,E),_=await this.request("GET",`/zones/${t}/dns_records?type=${r.type}&name=${encodeURIComponent(T)}`);if(_.result&&_.result.length>0)return _.result.find((e)=>e.content===r.content)?.proxied??null;return null}catch{return null}}async setRecordProxyStatus(E,r,t){try{let T=await this.getZoneId(E),_=this.getFullRecordName(r.name,E),d=await this.request("GET",`/zones/${T}/dns_records?type=${r.type}&name=${encodeURIComponent(_)}`);if(!d.result||d.result.length===0)return!1;let e=d.result.find((h)=>h.content===r.content);if(!e)return!1;return await this.request("PATCH",`/zones/${T}/dns_records/${e.id}`,{proxied:t}),!0}catch{return!1}}}class hh{name="route53";client;hostedZoneCache=new Map;providedHostedZoneId;constructor(E="us-east-1",r){this.client=new Ot(E),this.providedHostedZoneId=r}getRootDomain(E){let r=E.replace(/\.$/,"").split(".");if(r.length>=2)return r.slice(-2).join(".");return E}async getHostedZoneId(E){if(this.providedHostedZoneId)return this.providedHostedZoneId;let r=this.getRootDomain(E),t=this.hostedZoneCache.get(r);if(t)return t;let T=await this.client.findHostedZoneForDomain(E);if(T){let _=T.Id.replace("/hostedzone/","");return this.hostedZoneCache.set(r,_),_}return null}normalizeName(E){return E.endsWith(".")?E:`${E}.`}async createRecord(E,r){try{let t=await this.getHostedZoneId(E);if(!t)return{success:!1,message:`No hosted zone found for domain: ${E}`};let T=this.normalizeName(r.name),_=r.content;if(r.type==="TXT"&&!_.startsWith('"'))_=`"${_}"`;if(r.type==="MX"&&r.priority!==void 0)_=`${r.priority} ${_}`;return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:t,ChangeBatch:{Comment:"Created by ts-cloud DNS provider",Changes:[{Action:"CREATE",ResourceRecordSet:{Name:T,Type:r.type,TTL:r.ttl||300,ResourceRecords:[{Value:_}]}}]}})).ChangeInfo?.Id,message:"Record created successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async upsertRecord(E,r){try{let t=await this.getHostedZoneId(E);if(!t)return{success:!1,message:`No hosted zone found for domain: ${E}`};let T=this.normalizeName(r.name),_=r.content;if(r.type==="TXT"&&!_.startsWith('"'))_=`"${_}"`;if(r.type==="MX"&&r.priority!==void 0)_=`${r.priority} ${_}`;return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:t,ChangeBatch:{Comment:"Upserted by ts-cloud DNS provider",Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:T,Type:r.type,TTL:r.ttl||300,ResourceRecords:[{Value:_}]}}]}})).ChangeInfo?.Id,message:"Record upserted successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async deleteRecord(E,r){try{let t=await this.getHostedZoneId(E);if(!t)return{success:!1,message:`No hosted zone found for domain: ${E}`};let T=this.normalizeName(r.name),_=r.content;if(r.type==="TXT"&&!_.startsWith('"'))_=`"${_}"`;if(r.type==="MX"&&r.priority!==void 0)_=`${r.priority} ${_}`;return await this.client.changeResourceRecordSets({HostedZoneId:t,ChangeBatch:{Comment:"Deleted by ts-cloud DNS provider",Changes:[{Action:"DELETE",ResourceRecordSet:{Name:T,Type:r.type,TTL:r.ttl||300,ResourceRecords:[{Value:_}]}}]}}),{success:!0,message:"Record deleted successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async listRecords(E,r){try{let t=await this.getHostedZoneId(E);if(!t)return{success:!1,records:[],message:`No hosted zone found for domain: ${E}`};let T=await this.client.listResourceRecordSets({HostedZoneId:t,StartRecordType:r}),_=[];for(let d of T.ResourceRecordSets){if(r&&d.Type!==r)continue;if(d.AliasTarget)continue;for(let e of d.ResourceRecords||[]){let h=e.Value,R;if(d.Type==="MX"){let N=h.split(" ");if(N.length>=2)R=Number.parseInt(N[0],10),h=N.slice(1).join(" ")}if(d.Type==="TXT"&&h.startsWith('"')&&h.endsWith('"'))h=h.slice(1,-1);_.push({name:d.Name.replace(/\.$/,""),type:d.Type,content:h,ttl:d.TTL,priority:R})}}return{success:!0,records:_}}catch(t){return{success:!1,records:[],message:t instanceof Error?t.message:"Unknown error"}}}async canManageDomain(E){return await this.getHostedZoneId(E)!==null}async listDomains(){try{return(await this.client.listHostedZones()).HostedZones.map((r)=>r.Name.replace(/\.$/,""))}catch{return[]}}getRoute53Client(){return this.client}async createAliasRecord(E){try{let r=await this.getHostedZoneId(E.domain);if(!r)return{success:!1,message:`No hosted zone found for domain: ${E.domain}`};return{success:!0,id:(await this.client.createAliasRecord({HostedZoneId:r,Name:this.normalizeName(E.name),TargetHostedZoneId:E.targetHostedZoneId,TargetDNSName:E.targetDnsName,EvaluateTargetHealth:E.evaluateTargetHealth,Type:E.type})).ChangeInfo?.Id,message:"Alias record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async createCloudFrontAlias(E){return this.createAliasRecord({domain:E.domain,name:E.name,targetHostedZoneId:Ot.CloudFrontHostedZoneId,targetDnsName:E.cloudFrontDomainName,evaluateTargetHealth:!1})}async createAlbAlias(E){let r=Ot.ALBHostedZoneIds[E.region];if(!r)return{success:!1,message:`Unknown region for ALB: ${E.region}`};return this.createAliasRecord({domain:E.domain,name:E.name,targetHostedZoneId:r,targetDnsName:E.albDnsName,evaluateTargetHealth:!0})}}var jO=$E(()=>{Eh()});var Lz={};Qr(Lz,{ACMDnsValidator:()=>vA,ACMClient:()=>$t});class $t{client;region;constructor(E="us-east-1"){this.client=new wE,this.region=E}async requestCertificate(E){let r={DomainName:E.DomainName,ValidationMethod:E.ValidationMethod||"DNS"};if(E.SubjectAlternativeNames)r.SubjectAlternativeNames=E.SubjectAlternativeNames;return{CertificateArn:(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.RequestCertificate"},body:JSON.stringify(r)})).CertificateArn||""}}async describeCertificate(E){let t=(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.DescribeCertificate"},body:JSON.stringify({CertificateArn:E.CertificateArn})})).Certificate||{};return{CertificateArn:t.CertificateArn||"",DomainName:t.DomainName||"",SubjectAlternativeNames:t.SubjectAlternativeNames,Status:t.Status||"PENDING_VALIDATION",Type:t.Type,DomainValidationOptions:t.DomainValidationOptions?.map((T)=>({DomainName:T.DomainName,ValidationDomain:T.ValidationDomain,ValidationStatus:T.ValidationStatus,ResourceRecord:T.ResourceRecord?{Name:T.ResourceRecord.Name,Type:T.ResourceRecord.Type,Value:T.ResourceRecord.Value}:void 0,ValidationMethod:T.ValidationMethod})),CreatedAt:t.CreatedAt,IssuedAt:t.IssuedAt,NotBefore:t.NotBefore,NotAfter:t.NotAfter}}async listCertificates(E){let r={};if(E?.CertificateStatuses)r.CertificateStatuses=E.CertificateStatuses;if(E?.MaxItems)r.MaxItems=E.MaxItems;if(E?.NextToken)r.NextToken=E.NextToken;let t=await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ListCertificates"},body:JSON.stringify(r)});return{CertificateSummaryList:(t.CertificateSummaryList||[]).map((T)=>({CertificateArn:T.CertificateArn,DomainName:T.DomainName})),NextToken:t.NextToken}}async deleteCertificate(E){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.DeleteCertificate"},body:JSON.stringify({CertificateArn:E.CertificateArn})})}async listTagsForCertificate(E){return{Tags:(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ListTagsForCertificate"},body:JSON.stringify({CertificateArn:E.CertificateArn})})).Tags||[]}}async addTagsToCertificate(E){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.AddTagsToCertificate"},body:JSON.stringify({CertificateArn:E.CertificateArn,Tags:E.Tags})})}async resendValidationEmail(E){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ResendValidationEmail"},body:JSON.stringify({CertificateArn:E.CertificateArn,Domain:E.Domain,ValidationDomain:E.ValidationDomain})})}async findCertificateByDomain(E){let t=(await this.listCertificates({CertificateStatuses:["ISSUED"]})).CertificateSummaryList.find((T)=>T.DomainName===E||T.DomainName===`*.${E.split(".").slice(1).join(".")}`);if(!t)return null;return this.describeCertificate({CertificateArn:t.CertificateArn})}async waitForCertificateValidation(E,r=60,t=30000){for(let T=0;T<r;T++){let _=await this.describeCertificate({CertificateArn:E});if(_.Status==="ISSUED")return _;if(_.Status==="FAILED"||_.Status==="VALIDATION_TIMED_OUT")return null;await new Promise((d)=>setTimeout(d,t))}return null}async getDnsValidationRecords(E){let r=await this.describeCertificate({CertificateArn:E});if(!r.DomainValidationOptions)return[];return r.DomainValidationOptions.filter((t)=>t.ResourceRecord&&t.ValidationMethod==="DNS").map((t)=>({domainName:t.DomainName,recordName:t.ResourceRecord.Name,recordType:t.ResourceRecord.Type,recordValue:t.ResourceRecord.Value}))}async requestCertificateWithSans(E){let r=new Set;if(r.add(E.DomainName),E.IncludeWww!==!1)r.add(`www.${E.DomainName}`);if(E.IncludeWildcard)r.add(`*.${E.DomainName}`);if(E.AdditionalSans)for(let t of E.AdditionalSans)r.add(t);return this.requestCertificate({DomainName:E.DomainName,SubjectAlternativeNames:Array.from(r),ValidationMethod:"DNS"})}async isCertificateValidForDomain(E,r){let t=await this.describeCertificate({CertificateArn:E});if(t.Status!=="ISSUED")return!1;if(t.DomainName===r)return!0;if(t.DomainName?.startsWith("*.")){let T=t.DomainName.slice(2),_=r.split("."),d=T.split(".");if(_.slice(-d.length).join(".")===T)return!0}if(t.SubjectAlternativeNames)for(let T of t.SubjectAlternativeNames){if(T===r)return!0;if(T.startsWith("*.")){let _=T.slice(2),d=r.split("."),e=_.split(".");if(d.slice(-e.length).join(".")===_)return!0}}return!1}}class vA{acm;route53;dnsProvider;constructor(E="us-east-1",r){if(this.acm=new $t(E),this.route53=new Ot,r&&r.provider!=="route53")this.dnsProvider=zt(r)}async requestAndValidate(E){let{domainName:r,hostedZoneId:t,subjectAlternativeNames:T=[],waitForValidation:_=!1,maxWaitMinutes:d=30}=E;if(!this.dnsProvider&&!t)throw Error("Either hostedZoneId or external DNS provider configuration is required");let{CertificateArn:e}=await this.acm.requestCertificate({DomainName:r,SubjectAlternativeNames:T.length>0?[r,...T]:void 0,ValidationMethod:"DNS"});await this.waitForValidationOptions(e);let h=await this.acm.getDnsValidationRecords(e);if(this.dnsProvider)for(let R of h){let N=await this.dnsProvider.upsertRecord(r,{name:R.recordName,type:R.recordType,content:R.recordValue,ttl:300});if(!N.success)console.warn(`Failed to create validation record for ${R.domainName}: ${N.message}`)}else if(t)for(let R of h)await this.route53.changeResourceRecordSets({HostedZoneId:t,ChangeBatch:{Comment:`ACM DNS validation for ${R.domainName}`,Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:R.recordName,Type:R.recordType,TTL:300,ResourceRecords:[{Value:R.recordValue}]}}]}});if(_){if(!await this.acm.waitForCertificateValidation(e,d*2,30000))throw Error(`Certificate validation timed out after ${d} minutes`)}return{certificateArn:e,validationRecords:h}}async waitForValidationOptions(E,r=30){for(let t=0;t<r;t++){let T=await this.acm.describeCertificate({CertificateArn:E});if(T.DomainValidationOptions&&T.DomainValidationOptions.length>0&&T.DomainValidationOptions[0].ResourceRecord)return;await new Promise((_)=>setTimeout(_,2000))}throw Error("Timeout waiting for DNS validation options")}async createValidationRecords(E){let{certificateArn:r,hostedZoneId:t,domain:T}=E;if(!this.dnsProvider&&!t)throw Error("Either hostedZoneId or external DNS provider configuration is required");let _=await this.acm.getDnsValidationRecords(r),d=[];if(this.dnsProvider){let e=T||_[0]?.domainName;for(let h of _){let R=await this.dnsProvider.upsertRecord(e,{name:h.recordName,type:h.recordType,content:h.recordValue,ttl:300});d.push({...h,changeId:R.success?R.id:void 0})}}else if(t)for(let e of _){let h=await this.route53.changeResourceRecordSets({HostedZoneId:t,ChangeBatch:{Comment:`ACM DNS validation for ${e.domainName}`,Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.recordName,Type:e.recordType,TTL:300,ResourceRecords:[{Value:e.recordValue}]}}]}});d.push({...e,changeId:h.ChangeInfo?.Id})}return d}async deleteValidationRecords(E){let{certificateArn:r,hostedZoneId:t,domain:T}=E,_=await this.acm.getDnsValidationRecords(r);if(this.dnsProvider){let d=T||_[0]?.domainName;for(let e of _)try{await this.dnsProvider.deleteRecord(d,{name:e.recordName,type:e.recordType,content:e.recordValue})}catch{}}else if(t)for(let d of _)try{await this.route53.changeResourceRecordSets({HostedZoneId:t,ChangeBatch:{Comment:`Cleanup ACM DNS validation for ${d.domainName}`,Changes:[{Action:"DELETE",ResourceRecordSet:{Name:d.recordName,Type:d.recordType,TTL:300,ResourceRecords:[{Value:d.recordValue}]}}]}})}catch{}}async findOrCreateCertificate(E){let{domainName:r,hostedZoneId:t,subjectAlternativeNames:T,waitForValidation:_=!0}=E;if(!this.dnsProvider&&!t)throw Error("Either hostedZoneId or external DNS provider configuration is required");let d=await this.acm.findCertificateByDomain(r);if(d&&d.Status==="ISSUED")return{certificateArn:d.CertificateArn,isNew:!1};let{certificateArn:e}=await this.requestAndValidate({domainName:r,hostedZoneId:t,subjectAlternativeNames:T,waitForValidation:_});return{certificateArn:e,isNew:!0}}hasExternalDnsProvider(){return this.dnsProvider!==void 0}getDnsProviderName(){return this.dnsProvider?.name||"route53"}}var Id=$E(()=>{GE();Eh();H_()});class Rh{acm;dnsProvider;constructor(E,r="us-east-1"){if(this.acm=new $t(r),"provider"in E)this.dnsProvider=zt(E);else this.dnsProvider=E}getProvider(){return this.dnsProvider}async requestAndValidate(E){let{domainName:r,subjectAlternativeNames:t=[],waitForValidation:T=!1,maxWaitMinutes:_=30}=E,{CertificateArn:d}=await this.acm.requestCertificate({DomainName:r,SubjectAlternativeNames:t.length>0?[r,...t]:void 0,ValidationMethod:"DNS"});await this.waitForValidationOptions(d);let e=await this.acm.getDnsValidationRecords(d);for(let R of e){let N=await this.dnsProvider.upsertRecord(r,{name:R.recordName,type:R.recordType,content:R.recordValue,ttl:300});if(!N.success)console.warn(`Failed to create validation record for ${R.domainName}: ${N.message}`)}let h="pending";if(T)h=(await this.acm.waitForCertificateValidation(d,_*2,30000))?.Status==="ISSUED"?"issued":"failed";return{certificateArn:d,validationRecords:e.map((R)=>({domainName:R.domainName,recordName:R.recordName,recordType:R.recordType,recordValue:R.recordValue})),isNew:!0,status:h}}async createValidationRecords(E){let{certificateArn:r,domain:t}=E,T=[],_=await this.acm.getDnsValidationRecords(r);for(let d of _){let e=await this.dnsProvider.upsertRecord(t,{name:d.recordName,type:d.recordType,content:d.recordValue,ttl:300});if(!e.success)T.push(`Failed to create record for ${d.domainName}: ${e.message}`)}return{success:T.length===0,records:_.map((d)=>({domainName:d.domainName,recordName:d.recordName,recordType:d.recordType,recordValue:d.recordValue})),errors:T}}async deleteValidationRecords(E){let{certificateArn:r,domain:t}=E,T=[],_=await this.acm.getDnsValidationRecords(r);for(let d of _){let e=await this.dnsProvider.deleteRecord(t,{name:d.recordName,type:d.recordType,content:d.recordValue});if(!e.success)T.push(`Failed to delete record for ${d.domainName}: ${e.message}`)}return{success:T.length===0,errors:T}}async findOrCreateCertificate(E){let{domainName:r,subjectAlternativeNames:t=[],waitForValidation:T=!0,maxWaitMinutes:_}=E,d=await this.acm.findCertificateByDomain(r);if(d&&d.Status==="ISSUED"){let e=d.SubjectAlternativeNames||[d.DomainName],h=e.some((N)=>N===`*.${r}`);if(t.every((N)=>e.includes(N)||h))return{certificateArn:d.CertificateArn,validationRecords:[],isNew:!1,status:"issued"};console.log("Existing certificate doesn't cover all required SANs, requesting new certificate...")}return this.requestAndValidate({domainName:r,subjectAlternativeNames:t,waitForValidation:T,maxWaitMinutes:_})}async requestCertificateWithCommonSans(E){let{domainName:r,includeWww:t=!0,includeWildcard:T=!1,additionalSans:_=[],waitForValidation:d=!1}=E,e=[];if(t)e.push(`www.${r}`);if(T)e.push(`*.${r}`);return e.push(..._),this.requestAndValidate({domainName:r,subjectAlternativeNames:e,waitForValidation:d})}async waitForValidationOptions(E,r=30){for(let t=0;t<r;t++){let T=await this.acm.describeCertificate({CertificateArn:E});if(T.DomainValidationOptions&&T.DomainValidationOptions.length>0&&T.DomainValidationOptions[0].ResourceRecord)return;await new Promise((_)=>setTimeout(_,2000))}throw Error("Timeout waiting for DNS validation options")}async getCertificateStatus(E){let r=await this.acm.describeCertificate({CertificateArn:E});return{status:r.Status,domainValidations:(r.DomainValidationOptions||[]).map((t)=>({domain:t.DomainName,status:t.ValidationStatus||"UNKNOWN"}))}}}var A$=$E(()=>{Id();H_()});function zt(E){switch(E.provider){case"route53":return new hh(E.region,E.hostedZoneId);case"porkbun":return new uA(E.apiKey,E.secretKey);case"godaddy":return new nA(E.apiKey,E.apiSecret,E.environment);case"cloudflare":return new yO(E.apiToken);default:throw Error(`Unknown DNS provider: ${E.provider}`)}}class lA{providers=new Map;configs=[];addConfig(E){return this.configs.push(E),this}addRoute53(E,r){return this.configs.push({provider:"route53",region:E,hostedZoneId:r}),this}addPorkbun(E,r){return this.configs.push({provider:"porkbun",apiKey:E,secretKey:r}),this}addGoDaddy(E,r,t){return this.configs.push({provider:"godaddy",apiKey:E,apiSecret:r,environment:t}),this}addCloudflare(E){return this.configs.push({provider:"cloudflare",apiToken:E}),this}loadFromEnv(){if(process.env.AWS_ACCESS_KEY_ID||process.env.AWS_REGION)this.addRoute53(process.env.AWS_REGION);let E=process.env.PORKBUN_API_KEY,r=process.env.PORKBUN_SECRET_KEY;if(E&&r)this.addPorkbun(E,r);let t=process.env.GODADDY_API_KEY,T=process.env.GODADDY_API_SECRET;if(t&&T){let d=process.env.GODADDY_ENVIRONMENT;this.addGoDaddy(t,T,d)}let _=process.env.CLOUDFLARE_API_TOKEN;if(_)this.addCloudflare(_);return this}getProvider(E){let r=this.providers.get(E);if(r)return r;let t=this.configs.find((_)=>_.provider===E);if(!t)return null;let T=zt(t);return this.providers.set(E,T),T}async getProviderForDomain(E){for(let r of this.configs){let t=zt(r);if(await t.canManageDomain(E))return t}return null}getAllProviders(){return this.configs.map((E)=>zt(E))}}var kV;var H_=$E(()=>{jO();A$();jO();kV=new lA});var D$={};Qr(D$,{CloudFormationClient:()=>Er});class Er{client;region;constructor(E="us-east-1",r){this.region=E,this.client=new wE(void 0,{profile:r})}async createStack(E){let r={Action:"CreateStack",StackName:E.stackName,Version:"2010-05-15"};if(E.templateBody)r.TemplateBody=E.templateBody;else if(E.templateUrl)r.TemplateURL=E.templateUrl;else throw Error("Either templateBody or templateUrl must be provided");if(E.parameters)E.parameters.forEach((T,_)=>{r[`Parameters.member.${_+1}.ParameterKey`]=T.ParameterKey,r[`Parameters.member.${_+1}.ParameterValue`]=T.ParameterValue});if(E.capabilities)E.capabilities.forEach((T,_)=>{r[`Capabilities.member.${_+1}`]=T});if(E.roleArn)r.RoleARN=E.roleArn;if(E.tags)E.tags.forEach((T,_)=>{r[`Tags.member.${_+1}.Key`]=T.Key,r[`Tags.member.${_+1}.Value`]=T.Value});if(E.timeoutInMinutes)r.TimeoutInMinutes=E.timeoutInMinutes;if(E.onFailure)r.OnFailure=E.onFailure;let t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{StackId:t.StackId||t.CreateStackResult?.StackId}}async updateStack(E){let r={Action:"UpdateStack",StackName:E.stackName,Version:"2010-05-15"};if(E.templateBody)r.TemplateBody=E.templateBody;else if(E.templateUrl)r.TemplateURL=E.templateUrl;if(E.parameters)E.parameters.forEach((T,_)=>{if(r[`Parameters.member.${_+1}.ParameterKey`]=T.ParameterKey,T.UsePreviousValue)r[`Parameters.member.${_+1}.UsePreviousValue`]="true";else r[`Parameters.member.${_+1}.ParameterValue`]=T.ParameterValue});if(E.capabilities)E.capabilities.forEach((T,_)=>{r[`Capabilities.member.${_+1}`]=T});if(E.roleArn)r.RoleARN=E.roleArn;if(E.tags)E.tags.forEach((T,_)=>{r[`Tags.member.${_+1}.Key`]=T.Key,r[`Tags.member.${_+1}.Value`]=T.Value});let t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{StackId:t.StackId||t.UpdateStackResult?.StackId}}async deleteStack(E,r,t){let T={Action:"DeleteStack",StackName:E,Version:"2010-05-15"};if(r)T.RoleARN=r;if(t&&t.length>0)t.forEach((_,d)=>{T[`RetainResources.member.${d+1}`]=_});await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(T).toString()})}async describeStacks(E={}){let r={Action:"DescribeStacks",Version:"2010-05-15"};if(E.stackName)r.StackName=E.stackName;let t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{Stacks:this.parseStacksResponse(t)}}async describeStackEvents(E){let r={Action:"DescribeStackEvents",StackName:E,Version:"2010-05-15"},t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{StackEvents:this.parseStackEvents(t)}}async listStackResources(E){let r={Action:"ListStackResources",StackName:E,Version:"2010-05-15"},T=(await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()}))?.ListStackResourcesResult?.StackResourceSummaries?.member,_=[];if(T)_=Array.isArray(T)?T:[T];return{StackResourceSummaries:_}}async waitForStack(E,r){let t={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},T=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],_=t[r],d=360,e=0;while(e<360)try{let h=await this.describeStacks({stackName:E});if(h.Stacks.length===0){if(r==="stack-delete-complete")return;if(e%10===0)console.log(`[waitForStack] Attempt ${e}: Stack not visible yet`);await new Promise((N)=>setTimeout(N,2000)),e++;continue}let R=h.Stacks[0];if(e%10===0)console.log(`[waitForStack] Attempt ${e}: Status = ${R.StackStatus}${R.StackStatusReason?` (${R.StackStatusReason})`:""}`);if(_.includes(R.StackStatus))return;if((r==="stack-create-complete"||r==="stack-update-complete")&&(R.StackStatus==="DELETE_IN_PROGRESS"||R.StackStatus==="DELETE_COMPLETE")){console.log("[waitForStack] Stack is being deleted (creation/update failed)");let N="";try{let S=await this.describeStackEvents(E);console.log("[waitForStack] Stack events (most recent first):");for(let L of S.StackEvents.slice(0,15))if(L.ResourceStatus.includes("FAILED")||L.ResourceStatusReason){if(console.log(`  ${L.LogicalResourceId}: ${L.ResourceStatus} - ${L.ResourceStatusReason||"No reason provided"}`),L.ResourceStatus.includes("FAILED")&&L.ResourceStatusReason&&!N)N=L.ResourceStatusReason}}catch{}let A=N||R.StackStatusReason||"Check CloudFormation console for details.";throw Error(`Stack creation/update failed - stack is being deleted. Reason: ${A}`)}if(R.StackStatus==="DELETE_FAILED"&&r==="stack-delete-complete"){let N=Error("Stack deletion failed - may have resources that need to be retained");throw N.code="DELETE_FAILED",N.stackStatus=R.StackStatus,N.statusReason=R.StackStatusReason,N}if(T.includes(R.StackStatus))throw Error(`Stack reached failure status: ${R.StackStatus}`);await new Promise((N)=>setTimeout(N,5000)),e++}catch(h){if(r==="stack-delete-complete"&&h.message?.includes("does not exist"))return;if(r==="stack-create-complete"&&h.message?.includes("does not exist")){if(e%10===0)console.log(`[waitForStack] Attempt ${e}: Stack does not exist (error), retrying...`);await new Promise((R)=>setTimeout(R,2000)),e++;continue}throw console.log(`[waitForStack] Unexpected error: ${h.message}`),h}throw console.log(`[waitForStack] Timeout after ${e} attempts`),Error(`Timeout waiting for stack to reach ${r}`)}async validateTemplate(E){let r={Action:"ValidateTemplate",TemplateBody:E,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()})}async listStacks(E){let r={Action:"ListStacks",Version:"2010-05-15"};if(E)E.forEach((h,R)=>{r[`StackStatusFilter.member.${R+1}`]=h});let t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()}),T=t.ListStacksResponse||t,_=T.ListStacksResult||T,d=_.StackSummaries?.member||_.StackSummaries||[];return{StackSummaries:(Array.isArray(d)?d:d?[d]:[]).map((h)=>({StackId:h.StackId||"",StackName:h.StackName||"",TemplateDescription:h.TemplateDescription,CreationTime:h.CreationTime||"",LastUpdatedTime:h.LastUpdatedTime,DeletionTime:h.DeletionTime,StackStatus:h.StackStatus||""}))}}async createChangeSet(E){let r={Action:"CreateChangeSet",StackName:E.stackName,ChangeSetName:E.changeSetName,Version:"2010-05-15"};if(E.templateBody)r.TemplateBody=E.templateBody;else if(E.templateUrl)r.TemplateURL=E.templateUrl;if(E.parameters)E.parameters.forEach((T,_)=>{r[`Parameters.member.${_+1}.ParameterKey`]=T.ParameterKey,r[`Parameters.member.${_+1}.ParameterValue`]=T.ParameterValue});if(E.capabilities)E.capabilities.forEach((T,_)=>{r[`Capabilities.member.${_+1}`]=T});if(E.changeSetType)r.ChangeSetType=E.changeSetType;let t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{Id:t.Id,StackId:t.StackId}}async describeChangeSet(E,r){let t={Action:"DescribeChangeSet",StackName:E,ChangeSetName:r,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()})}async executeChangeSet(E,r){let t={Action:"ExecuteChangeSet",StackName:E,ChangeSetName:r,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()})}async deleteChangeSet(E,r){let t={Action:"DeleteChangeSet",StackName:E,ChangeSetName:r,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()})}async getStackOutputs(E){let r=await this.describeStacks({stackName:E});if(!r.Stacks||r.Stacks.length===0)throw Error(`Stack ${E} not found`);let t=r.Stacks[0],T={};if(t.Outputs)for(let _ of t.Outputs)T[_.OutputKey]=_.OutputValue;return T}async getTemplate(E){let r={Action:"GetTemplate",StackName:E,Version:"2010-05-15"},t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{TemplateBody:t?.GetTemplateResult?.TemplateBody||t?.TemplateBody||""}}parseStacksResponse(E){let r=[],t=E?.DescribeStacksResult?.Stacks?.member||E?.Stacks?.member||E?.Stacks||E;if(t&&!Array.isArray(t))t=[t];if(Array.isArray(t)){for(let T of t)if(T.StackId||T.StackName){let _;if(T.Outputs?.member)_=(Array.isArray(T.Outputs.member)?T.Outputs.member:[T.Outputs.member]).map((e)=>({OutputKey:e.OutputKey,OutputValue:e.OutputValue,Description:e.Description,ExportName:e.ExportName}));r.push({StackId:T.StackId,StackName:T.StackName,StackStatus:T.StackStatus,CreationTime:T.CreationTime,LastUpdatedTime:T.LastUpdatedTime,StackStatusReason:T.StackStatusReason,Outputs:_})}}else if(E.StackId)r.push({StackId:E.StackId,StackName:E.StackName,StackStatus:E.StackStatus,CreationTime:E.CreationTime,LastUpdatedTime:E.LastUpdatedTime});return r}parseStackEvents(E){let r=[],t=E?.DescribeStackEventsResult?.StackEvents?.member||E?.StackEvents?.member||E?.StackEvents||[];if(t&&!Array.isArray(t))t=[t];for(let T of t)if(T.LogicalResourceId)r.push({Timestamp:T.Timestamp,ResourceType:T.ResourceType,LogicalResourceId:T.LogicalResourceId,ResourceStatus:T.ResourceStatus,ResourceStatusReason:T.ResourceStatusReason});return r}async waitForStackWithProgress(E,r,t){let T={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},_=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],d=T[r],e=360,h=0,R=new Set;while(h<360)try{if(t)try{let L=[...(await this.describeStackEvents(E)).StackEvents||[]].reverse();for(let O of L){let I=`${O.LogicalResourceId}-${O.ResourceStatus}-${O.Timestamp}`;if(!R.has(I))R.add(I),t({resourceId:O.LogicalResourceId,resourceType:O.ResourceType,status:O.ResourceStatus,reason:O.ResourceStatusReason,timestamp:O.Timestamp})}}catch{}let N=await this.describeStacks({stackName:E});if(N.Stacks.length===0){if(r==="stack-delete-complete")return;await new Promise((S)=>setTimeout(S,2000)),h++;continue}let A=N.Stacks[0];if(d.includes(A.StackStatus))return;if(A.StackStatus==="DELETE_FAILED"&&r==="stack-delete-complete"){let S=Error("Stack deletion failed - may have resources that need to be retained");throw S.code="DELETE_FAILED",S.stackStatus=A.StackStatus,S.statusReason=A.StackStatusReason,S}if(_.includes(A.StackStatus))throw Error(`Stack reached failure status: ${A.StackStatus}`);await new Promise((S)=>setTimeout(S,3000)),h++}catch(N){if(r==="stack-delete-complete"&&N.message?.includes("does not exist"))return;if(r==="stack-create-complete"&&N.message?.includes("does not exist")){await new Promise((A)=>setTimeout(A,2000)),h++;continue}throw N}throw Error(`Timeout waiting for stack to reach ${r}`)}async waitForStackComplete(E,r=120,t=5000){let T=["CREATE_COMPLETE","UPDATE_COMPLETE","DELETE_COMPLETE"],_=["CREATE_FAILED","UPDATE_FAILED","DELETE_FAILED","ROLLBACK_COMPLETE","ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED"];for(let d=0;d<r;d++)try{let e=await this.describeStacks({stackName:E});if(e.Stacks.length===0)return{success:!0,status:"DELETE_COMPLETE"};let h=e.Stacks[0],R=h.StackStatus;if(T.includes(R))return{success:!0,status:R};if(_.includes(R))return{success:!1,status:R,reason:h.StackStatusReason};await new Promise((N)=>setTimeout(N,t))}catch(e){if(e.message?.includes("does not exist"))return{success:!0,status:"DELETE_COMPLETE"};throw e}return{success:!1,status:"TIMEOUT",reason:"Timeout waiting for stack operation"}}}var Bt=$E(()=>{GE()});var US={};Qr(US,{xrayManager:()=>zg,withTimeout:()=>xK,withSecurity:()=>EK,withQueue:()=>_K,withMonitoring:()=>oP,withDatabase:()=>rK,withCache:()=>tK,withCDN:()=>TK,validateTemplateSize:()=>y7,validateTemplate:()=>O7,validateResourceLimits:()=>j7,validateCredentials:()=>wK,validateConfiguration:()=>DK,validateCommand:()=>BZ,validateAgainstSchema:()=>sK,validateAccountStructure:()=>oZ,templateCache:()=>BK,syntheticsManager:()=>Hg,suggestRegions:()=>xZ,suggestRegionPairs:()=>bZ,suggestQuotaIncrease:()=>jK,suggestIAMPolicy:()=>XK,suggestFlags:()=>jZ,suggestCommand:()=>Tw,storageAdvancedManager:()=>tx,staticSiteManager:()=>rx,stackDependencyManager:()=>MZ,signRequestAsync:()=>ZO,signRequest:()=>Wt,sharedRuntimeLoop:()=>c1,sha256:()=>aO,serviceMeshManager:()=>xg,sequence:()=>qK,senderReputationManager:()=>og,securityScanningManager:()=>Kg,securityHubManager:()=>Xg,secretsRotationManager:()=>Mg,secretsManager:()=>Vg,searchCommands:()=>JZ,sanitizeName:()=>B7,runPhpBuildHooks:()=>oO,runBuildHooks:()=>sB,route53RoutingManager:()=>ig,route53ResolverManager:()=>mg,responseToResult:()=>NW,resourceManagementManager:()=>dx,resolveStorageBucketName:()=>W7,resolveSiteStackName:()=>Y$,resolveSiteResourceName:()=>Q$,resolveSiteBucketName:()=>G$,resolveServerlessRuntime:()=>mO,resolveServerlessAssetBucketName:()=>bO,resolveServerlessArtifactBucketName:()=>M$,resolveServerlessAppStackName:()=>$d,resolveRegion:()=>CB,resolveQueues:()=>Dh,resolveQueueNames:()=>A1,resolveProjectStackName:()=>Vr,resolveManagementDashboardSites:()=>OS,resolveManagementDashboardSite:()=>mP,resolveDeploymentMode:()=>tT,resolveDeployBucketName:()=>sz,resolveDashboardDomains:()=>SB,resolveDashboardDomain:()=>AB,resolveCredentials:()=>vO,resolveCloudProvider:()=>Ht,resolveAppDatabase:()=>br,resolveApp:()=>Hq,requiresReplacement:()=>nK,replicaManager:()=>Yg,regionPairManager:()=>GZ,quickHash:()=>VK,queueManagementManager:()=>dq,progressiveDeploymentManager:()=>Fg,processInChunks:()=>bK,previewNotifications:()=>hZ,previewManager:()=>TZ,phpRuntimeLayerAssets:()=>NS,phpLayerPackages:()=>EW,phpLayerBuildStage:()=>L1,performanceManager:()=>Qg,parseXMLResponse:()=>tS,parseJSONResponse:()=>kz,parallelWithRetry:()=>gK,parallelMap:()=>ZK,parallel:()=>lO,packageServerlessApp:()=>IS,packagePhpApp:()=>D1,organizationManager:()=>iZ,networkSecurityManager:()=>_x,multiRegionManager:()=>fZ,multiAccountManager:()=>lZ,migrationManager:()=>fg,metricsManager:()=>Bg,mergeInfrastructure:()=>Uh,managementDashboardSiteName:()=>F$,makeAWSRequestOnce:()=>xz,makeAWSRequestAsync:()=>bz,makeAWSRequest:()=>Lh,logsManager:()=>Wg,laravelServerlessEnvDefaults:()=>I1,lambdaVersionsManager:()=>kg,lambdaVPCManager:()=>vg,lambdaLayersManager:()=>bg,lambdaDestinationsManager:()=>ng,lambdaDLQManager:()=>lg,lambdaConcurrencyManager:()=>ug,isWebCryptoAvailable:()=>lz,isValidRegion:()=>gZ,isNodeCryptoAvailable:()=>vz,isManagementDashboardSiteName:()=>nO,isLocalDevelopment:()=>pK,isLikelyTypo:()=>CZ,imageScanningManager:()=>Zg,healthCheckManager:()=>Tx,hashString:()=>m$,hashManifest:()=>MK,hashFile:()=>a$,hashDirectory:()=>GK,hashBuffer:()=>QK,hasManagementDashboardSite:()=>Ih,guardDutyManager:()=>Cg,globalResourceManager:()=>QZ,getTimestamp:()=>z7,getSigningKeyCacheSize:()=>nz,getRequiredPermissions:()=>WB,getRegionsByPricingTier:()=>ZZ,getRegionsByLocation:()=>PZ,getRegionsByCompliance:()=>KZ,getRegionStats:()=>vZ,getRegion:()=>aR,getRecommendedStructure:()=>sZ,getQuotaUsageSummary:()=>yK,getLocalEnvVars:()=>rZ,getLocalEndpoint:()=>oK,getLocalCredentials:()=>EZ,getLocalConfig:()=>iO,getErrorDetails:()=>BB,getDiffSummary:()=>uK,getDiffStats:()=>aK,getDeploymentStrategy:()=>iK,getCredentials:()=>cS,getContextualHelp:()=>XZ,getCommandUsage:()=>zZ,getClosestRegion:()=>qZ,getAllRegions:()=>VZ,getAccountId:()=>XB,generateScheduledWorkflow:()=>_g,generateScheduledPipeline:()=>Ng,generateScheduledConfig:()=>Og,generateResourceName:()=>eE,generatePreviewWorkflow:()=>_Z,generatePreviewPipeline:()=>Rg,generatePhpLayerDockerfile:()=>rW,generatePhpFpmConfig:()=>OW,generateParallelConfig:()=>Ig,generatePRPreviewWorkflow:()=>Tg,generateMultiEnvWorkflow:()=>tg,generateMultiEnvPipeline:()=>hg,generateMultiEnvConfig:()=>Lg,generateMatrixWorkflow:()=>dg,generateManualPipeline:()=>Ag,generateLogicalId:()=>i,generateDeploymentWorkflow:()=>rg,generateDeploymentPipeline:()=>eg,generateDeploymentConfig:()=>Sg,generateCrossAccountRoleCF:()=>pZ,generateCostReportWorkflow:()=>eZ,generateCleanupWorkflow:()=>dZ,generateBootstrap:()=>mB,generateApprovalConfig:()=>cg,generateAppImageDockerfile:()=>O1,fromWebIdentity:()=>wB,fromSharedCredentials:()=>UB,fromEnvironment:()=>IB,fromECSMetadata:()=>$B,fromEC2Metadata:()=>DB,formatTree:()=>SZ,formatTable:()=>RZ,formatSuggestion:()=>wZ,formatRegionList:()=>nZ,formatRegion:()=>kB,formatProgressBar:()=>LZ,formatList:()=>IZ,formatKeyValue:()=>UZ,formatHistoryStats:()=>HZ,formatHistory:()=>WZ,formatFlagSuggestions:()=>FZ,formatDuration:()=>cZ,formatDiff:()=>Q7,formatBytes:()=>OZ,formatAccountStructure:()=>Eg,findChangedFiles:()=>PK,fifoQueueManager:()=>tq,extendPreset:()=>z$,eventToRequest:()=>RW,emailTemplateManager:()=>Eq,emailAnalyticsManager:()=>pg,drManager:()=>Dg,dnssecManager:()=>ag,dlqMonitoringManager:()=>Tq,diffTemplates:()=>kK,detectServiceRegion:()=>KO,detectMisconfigurations:()=>$K,detectDeploymentTargets:()=>f$,deriveManagementDashboardPort:()=>hB,deploymentCoexistenceError:()=>pR,defaultLocalConfig:()=>s$,databaseUserManager:()=>Gg,crossRegionReferenceManager:()=>YZ,createZip:()=>oR,createWordPressPreset:()=>ZP,createTraditionalWebAppPreset:()=>uP,createStaticSitePreset:()=>QP,createServerlessNodePreset:()=>VP,createServerlessLaravelPreset:()=>vP,createS3Client:()=>UK,createRealtimeAppPreset:()=>xP,createQueueHandler:()=>SW,createPresignedUrlAsync:()=>Mz,createPresignedUrl:()=>H$,createPreset:()=>pP,createNodeJsServerlessPreset:()=>MP,createNodeJsServerPreset:()=>GP,createMockAWS:()=>tZ,createMicroservicesPreset:()=>qP,createMLApiPreset:()=>kP,createLaravelPreset:()=>nP,createJamstackPreset:()=>gP,createHttpHandler:()=>AW,createHandlers:()=>Mq,createFullStackAppPreset:()=>PP,createExistingStaticFullStackPreset:()=>q$,createError:()=>W$,createDataPipelinePreset:()=>bP,createDashboardSite:()=>lP,createCredentialProvider:()=>eK,createCliHandler:()=>LW,createApiBackendPreset:()=>KP,containerRegistryManager:()=>qg,composeServerlessAppTemplate:()=>S1,composePresets:()=>sP,collectPhpAppEntries:()=>Ec,cloudTrailManager:()=>wg,cloudConfigSchema:()=>mK,clearSigningKeyCache:()=>uz,chunk:()=>GB,checkServiceQuotas:()=>JK,checkIAMPermissions:()=>CK,certificateManager:()=>Pg,categorizeChanges:()=>lK,canaryManager:()=>yg,buildPhpRuntimeLayerZip:()=>iq,buildOptimizationManager:()=>gg,buildNodeRuntimeLayerZip:()=>zq,buildCloudFormationTemplate:()=>g$,buildBunRuntimeLayerZip:()=>Bq,bounceComplaintHandler:()=>sg,blueGreenManager:()=>Jg,batchProcessingManager:()=>_q,batch:()=>KK,backupManager:()=>Ug,awsConfigManager:()=>$g,autocomplete:()=>yZ,artifactKey:()=>N1,analyzeStackDiff:()=>H7,abTestManager:()=>jg,XRayManager:()=>ww,Workflow:()=>tB,ValidationError:()=>n$,TemplateCache:()=>l$,TemplateBuilder:()=>xO,TaskList:()=>ZB,SyntheticsManager:()=>Sh,StorageAdvancedManager:()=>w1,Storage:()=>h_,StaticSiteManager:()=>$1,StacksIntegration:()=>K7,StackDependencyManager:()=>Rw,Spinner:()=>KB,SmsHandlers:()=>rB,SmsAdvanced:()=>aB,Sftp:()=>kO,ServiceMeshManager:()=>Gw,SenderReputationManager:()=>nw,SecurityScanningManager:()=>Hw,SecurityHubManager:()=>Ah,Security:()=>qr,SecretsRotationManager:()=>zw,SecretsManager:()=>Bw,Secrets:()=>iR,Search:()=>$e,SMS:()=>mt,S3Error:()=>ET,S3Client:()=>u$,Route53RoutingManager:()=>qw,Route53ResolverManager:()=>bw,ResourceManagementManager:()=>J1,ReplicaManager:()=>yw,Registry:()=>G_,RegionPairManager:()=>hw,Redirects:()=>Dd,RealtimePresets:()=>L7,RateLimiter:()=>QB,REPLContext:()=>qB,REPLCommandBuilder:()=>xB,REPL:()=>gB,RECOMMENDED_SCPS:()=>aZ,RECOMMENDED_ACCOUNT_STRUCTURES:()=>uB,QueuePresets:()=>S7,QueueManagementManager:()=>R1,Queue:()=>rT,Pseudo:()=>F7,ProgressiveDeploymentManager:()=>$w,ProgressBar:()=>VB,PreviewNotificationService:()=>tw,PreviewEnvironmentManager:()=>rw,PhoneHandlers:()=>EB,PhoneAdvanced:()=>iB,Phone:()=>M_,Permissions:()=>wT,PerformanceManager:()=>jw,ParameterStore:()=>ar,PHP_LAYER_EXTENSIONS:()=>oB,PHP_DEFAULT_EXCLUDES:()=>CW,OrganizationManager:()=>Aw,NetworkSecurityManager:()=>X1,Network:()=>Hr,MultiStepProgress:()=>PB,MultiRegionManager:()=>_w,MultiAccountManager:()=>Nw,Monitoring:()=>LS,MockS3:()=>o$,MockDynamoDB:()=>Ew,MockCloudFormation:()=>p$,MigrationManager:()=>Jw,MetricsManager:()=>Cw,Messaging:()=>$T,MANAGEMENT_DASHBOARD_SITE_PREFIX:()=>x$,MANAGED_NODE_VERSIONS:()=>pB,LogsManager:()=>Xw,LambdaVersionsManager:()=>Vw,LambdaVPCManager:()=>Zw,LambdaLayersManager:()=>Mw,LambdaDestinationsManager:()=>Kw,LambdaDLQManager:()=>gw,LambdaConcurrencyManager:()=>Pw,LARAVEL_SERVERLESS_BUILD_STEPS:()=>IW,JobLoader:()=>Ud,ImageScanningManager:()=>fw,HealthCheckManager:()=>C1,HashCache:()=>fB,GuardDutyManager:()=>Iw,GlobalResourceManager:()=>ew,Fn:()=>z,FileSystem:()=>V_,FileCache:()=>v$,FIFOQueueManager:()=>d1,ErrorCodes:()=>zB,EmailTemplateManager:()=>vw,EmailHandlers:()=>vB,EmailAnalyticsManager:()=>uw,EmailAdvanced:()=>nB,Email:()=>Ir,DisasterRecoveryManager:()=>Lw,DeploymentError:()=>jB,Deployment:()=>pt,DependencyGraph:()=>pz,DebugLogger:()=>CT,DatabaseUserManager:()=>Fw,Database:()=>Ce,DNSSECManager:()=>xw,DNS:()=>at,DLQMonitoringManager:()=>e1,DEFAULT_SERVICE_LIMITS:()=>it,DASHBOARD_STATE_DIR:()=>TB,DASHBOARD_PORT_SPAN:()=>eB,DASHBOARD_PORT_BASE:()=>dB,DASHBOARD_ENTRY:()=>_B,CrossRegionReferenceManager:()=>dw,CredentialError:()=>Ue,ContainerRegistryManager:()=>Qw,ConfigurationError:()=>_S,Compute:()=>PE,Communication:()=>ot,CommandHistory:()=>bB,CloudTrailManager:()=>cw,CloudFrontClient:()=>yB,CloudFormationClient:()=>JB,CloudFormationBuilder:()=>Z$,CloudError:()=>P_,CertificateManager:()=>Ww,CanaryManager:()=>RS,Cache:()=>SS,COMMON_CROSS_ACCOUNT_ROLES:()=>mZ,CDN:()=>e_,BuildOptimizationManager:()=>Yw,BounceComplaintHandler:()=>kw,BlueGreenManager:()=>Uw,BatchProcessingManager:()=>h1,BackupManager:()=>Sw,Auth:()=>st,AssetHasher:()=>wt,Arn:()=>eS,ApiGateway:()=>uO,AWS_REGIONS:()=>N_,AWS_PSEUDO_PARAMETERS:()=>l7,AWSConfigManager:()=>Ow,AWSAPIError:()=>FB,AI:()=>R_,ABTestManager:()=>Dw});import{createRequire as T7}from"node:module";import{existsSync as mA,readdirSync as G7}from"node:fs";import{join as Ie}from"node:path";import{createHash as b7}from"node:crypto";import{copyFileSync as k7,existsSync as w$,readdirSync as u7,readFileSync as WO,statSync as n7,writeFileSync as HO}from"node:fs";import{basename as v7,dirname as jz,extname as Fz,join as sA}from"node:path";import{existsSync as LB,readFileSync as k$}from"node:fs";import{homedir as OB}from"node:os";import{join as cB}from"node:path";import{createHash as HB}from"node:crypto";import{existsSync as Hz,mkdirSync as FK,readdirSync as fz,readFileSync as Yz,unlinkSync as pA,writeFileSync as zK}from"node:fs";import{join as X$}from"node:path";import{createHash as i$}from"node:crypto";import{createReadStream as WK,readdirSync as HK,statSync as VO}from"node:fs";import{join as fK,relative as YK}from"node:path";import{deflateRawSync as eq}from"node:zlib";import{execSync as Sq}from"node:child_process";import{createHash as Lq}from"node:crypto";import{cpSync as Oq,mkdtempSync as cq,rmSync as Iq,writeFileSync as Uq}from"node:fs";import{tmpdir as Dq}from"node:os";import{dirname as $q,isAbsolute as wq,join as ES,resolve as Cq}from"node:path";import{fileURLToPath as Xq}from"node:url";import{execFileSync as sO}from"node:child_process";import{mkdtempSync as tW,readFileSync as pO,rmSync as TW}from"node:fs";import{tmpdir as _W}from"node:os";import{dirname as jq,join as we}from"node:path";import{fileURLToPath as Fq}from"node:url";import{readFileSync as Vq}from"node:fs";import{dirname as Pq,join as cW}from"node:path";import{fileURLToPath as Kq}from"node:url";import{execFileSync as YO}from"node:child_process";import{existsSync as gq,mkdirSync as qq,mkdtempSync as xq,readdirSync as bq,readFileSync as kq,rmSync as uq,statSync as UW,writeFileSync as nq}from"node:fs";import{tmpdir as vq}from"node:os";import{join as lR,relative as lq}from"node:path";import{execSync as aq}from"node:child_process";import{createHash as mq}from"node:crypto";import{readdirSync as sq,readFileSync as pq,statSync as $W}from"node:fs";import{join as oq,relative as wW,resolve as U1}from"node:path";function e7(E,r){this[E]=d7.bind(null,r)}function KO(E){let r=typeof E==="string"?new URL(E):E,{hostname:t,pathname:T}=r;if(t.endsWith(".on.aws")){let h=t.match(/^[^.]+\.lambda-url\.([^.]+)\.on\.aws$/);if(h)return{service:"lambda",region:h[1]};return{service:"",region:""}}if(t.endsWith(".r2.cloudflarestorage.com"))return{service:"s3",region:"auto"};if(t.endsWith(".backblazeb2.com")){let h=t.match(/^(?:[^.]+\.)?s3\.([^.]+)\.backblazeb2\.com$/);if(h)return{service:"s3",region:h[1]};return{service:"",region:""}}let _=t.replace("dualstack.","").match(/([^.]+)\.(?:([^.]+)\.)?amazonaws\.com(?:\.cn)?$/);if(!_)return{service:"",region:""};let d=_[1],e=_[2]||"";if(e==="us-gov")e="us-gov-west-1";else if(e==="s3"||e==="s3-accelerate")e="us-east-1",d="s3";else if(d==="iot")if(t.startsWith("iot."))d="execute-api";else if(t.startsWith("data.jobs.iot."))d="iot-jobs-data";else d=T==="/mqtt"?"iotdevicegateway":"iotdata";else if(d==="autoscaling");else if(!e&&d.startsWith("s3-"))e=d.slice(3).replace(/^fips-|^external-1/,""),d="s3";else if(d.endsWith("-fips"))d=d.slice(0,-5);else if(e&&/-\d$/.test(d)&&!/-\d$/.test(e))[d,e]=[e,d];return d=az[d]||d,{service:d,region:e||"us-east-1"}}function Wt(E){let{method:r,url:t,body:T="",accessKeyId:_,secretAccessKey:d,sessionToken:e,signQuery:h=!1,expiresIn:R=86400,datetime:N}=E,A=new URL(t),S=A.hostname,L=KO(A),O=E.service||L.service,I=E.region||L.region;if(!O)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!I)throw Error("Could not detect region from URL. Please provide region explicitly.");let D=N||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),$=D.substring(0,8),C=[$,I,O,"aws4_request"].join("/"),y="AWS4-HMAC-SHA256";if(h)return N7({urlObj:A,method:r,body:T,accessKeyId:_,secretAccessKey:d,sessionToken:e,service:O,region:I,timestamp:D,date:$,credentialScope:C,algorithm:y,expiresIn:R,cache:E.cache});let j=A.pathname||"/",B=gO(A.searchParams),f={host:S,"x-amz-date":D,...E.headers};if(e)f["x-amz-security-token"]=e;let Q=Object.keys(f).some((W)=>W.toLowerCase()==="content-type");if(T&&!Q)f["content-type"]="application/x-amz-json-1.0";if(O==="s3"&&!f["x-amz-content-sha256"])f["x-amz-content-sha256"]=rS(T);let V=Vz(f),g=Pz(f),x=f["x-amz-content-sha256"]||rS(T),u=[r,qO(j),B,V,g,x].join(`
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T.sequence,T.id,T.organizationId??null,T.projectId??null,T.operationId??null,T.resourceId??null,T.actorId??null,T.correlationId,T.type,T.level,Xr(T.payload),T.createdAt]);for(let[T,_]of Object.entries(E.settings))VE(this.database,"INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)",[T,Xr(_),this.now()]);for(let T of E.tags??[])VE(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[T.id,T.projectId,T.name,T.normalizedName,T.color,T.createdAt,T.updatedAt]);for(let T of E.resourceTags??[])VE(this.database,"INSERT INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[T.resourceId,T.tagId,T.createdAt]);for(let T of E.savedFilters??[])VE(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[T.id,T.actorKey,T.name,T.routeId,Xr(T.query),T.createdAt,T.updatedAt]);for(let T of E.navigationItems??[])VE(this.database,"INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at, visit_count) VALUES (?, ?, ?, ?, ?, ?)",[T.actorKey,T.entityType,T.entityId,T.favorite?1:0,T.lastVisitedAt,T.visitCount])})}}var Nj,Aj=65536,tD=16384,W8,H8,f8,Sj;var Lj=$E(()=>{sU();iU();oU();Nj=Rj(".ts-cloud","control-plane.sqlite"),W8=["succeeded","failed","cancelled","timed_out"],H8={queued:["running","cancelled","timed_out"],running:["queued","succeeded","failed","cancelled","timed_out"],succeeded:[],failed:["queued"],cancelled:["queued"],timed_out:["queued"]},f8=/(?:^|_)(?:authorization|cookie|credential|password|passwd|secret|token|api_?key|private_?key|access_?key)(?:$|_)/i,Sj=/(?:authorization|password|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)\s*[=:]\s*[^\s,;]+/gi});function Oj(E,r){if(!E||typeof E!=="object"||Array.isArray(E))return[];let t=[];for(let[T,_]of Object.entries(E)){if(!r.has(T.toLowerCase()))continue;if(typeof _==="string")t.push(_);else if(Array.isArray(_))t.push(..._.filter((d)=>typeof d==="string"))}return t}function dD(E){return E.toLowerCase().trim().replace(/[^a-z0-9._:/@-]+/g," ")}function eD(E,r,t){let T=dD(E),_=dD(r),d=dD(t);if(!T)return 0;if(_===T)return 1000;if(_.startsWith(T))return 800-Math.min(100,_.length-T.length);if(_.includes(T))return 650-Math.min(100,_.indexOf(T));let e=T.split(/\s+/).filter(Boolean);if(e.every((R)=>d.includes(R)))return 400+e.length*10;let h=0;for(let R of T){if(h=d.indexOf(R,h),h<0)return 0;h++}return Math.max(1,180-Math.floor(d.length/20))}function M8(E,r){let t=E.kind.toLowerCase();if(t==="server"||t==="compute")return{type:"server",href:`/server/metrics?env=${encodeURIComponent(r)}`};if(t.includes("database")||["mysql","postgres","postgresql","sqlite","redis"].includes(t))return{type:"database",href:`/server/database?env=${encodeURIComponent(r)}&database=${encodeURIComponent(E.slug)}`};return{type:"service",href:`/server/sites?env=${encodeURIComponent(r)}&service=${encodeURIComponent(E.slug)}`}}function hD(E,r){let t=E.getProject(r.projectId);if(!t)return[];let T=E.listEnvironments(t.id),_=new Map(T.map((S)=>[S.id,S])),d=E.listResourceTags(t.id),e=new Map;for(let S of d){let L=e.get(S.resourceId)??[];L.push({id:S.tag.id,name:S.tag.name,color:S.tag.color}),e.set(S.resourceId,L)}let h=[],R=r.allowedResourceSlugs!==void 0;if(!R){h.push({type:"project",id:t.id,title:t.name,subtitle:t.slug,href:`/?project=${encodeURIComponent(t.slug)}`,tags:[],score:0});for(let S of T)h.push({type:"environment",id:S.id,title:S.name,subtitle:`${t.name} · ${S.kind}`,href:`/?env=${encodeURIComponent(S.slug)}`,environment:S.slug,tags:[],score:0})}let N=E.listResources(t.id).filter((S)=>!r.allowedResourceSlugs||r.allowedResourceSlugs.has(S.slug));for(let S of N){let L=S.environmentId?_.get(S.environmentId):void 0,O=e.get(S.id)??[],I=Oj(S.desiredState,Q8),D=[S.name,S.slug,S.kind,S.provider,S.providerId,L?.slug,...I,...O.map((C)=>C.name)].filter(Boolean).join(" "),$=M8(S,L?.slug??T[0]?.slug??"");h.push({type:$.type,id:S.id,title:S.name,subtitle:[S.kind,...I.slice(0,2)].join(" · "),href:$.href,environment:L?.slug,provider:S.provider,tags:O,score:eD(r.query,S.name,D)})}if(!R)for(let S of E.listOperations({projectId:t.id,limit:500})){let L=S.environmentId?_.get(S.environmentId):void 0,O=Oj(S.input,G8),I=S.kind.includes("deploy"),D=O[0]??S.kind,$=[S.kind,S.id,S.correlationId,S.state,...O].join(" ");h.push({type:I?"deployment":"operation",id:S.id,title:D,subtitle:`${S.kind} · ${S.state}`,href:`/server/activity?env=${encodeURIComponent(L?.slug??T[0]?.slug??"")}&operation=${encodeURIComponent(S.id)}`,environment:L?.slug,status:S.state,tags:[],score:eD(r.query,D,$)})}for(let S of h)if(S.score===0)S.score=eD(r.query,S.title,`${S.title} ${S.subtitle} ${S.environment??""} ${S.provider??""}`);let A={service:0,server:1,database:2,deployment:3,environment:4,project:5,operation:6};return h.filter((S)=>S.score>0).sort((S,L)=>L.score-S.score||A[S.type]-A[L.type]||S.title.localeCompare(L.title)||S.id.localeCompare(L.id)).slice(0,Math.min(50,Math.max(1,r.limit??20)))}var Q8,G8;var cj=$E(()=>{Q8=new Set(["domain","domains","hostname","hostnames","url","repository","repo","image","label","labels"]),G8=new Set(["sha","commit","commitsha","release","releaseid"])});var rt=$E(()=>{iU();Lj();cj();sU();oU()});import{createHmac as V8}from"node:crypto";function lt(E){return[...new Set(E)].sort()}function Ij(E,r={}){let t=E.kind==="secret";return{id:E.id,key:E.key,kind:E.kind,scope:E.scope,inherited:!!r.inherited,overridden:!!r.overridden,required:E.required,backend:!t||r.canReadSecretMetadata?E.backend:void 0,backendVersion:!t||r.canReadSecretMetadata?E.backendVersion:void 0,reference:t&&r.canReadSecretMetadata?E.secretRef:void 0,value:!t?E.value:void 0,lastUsedAt:E.lastUsedAt,rotatedAt:E.rotatedAt,version:E.version,updatedAt:E.updatedAt}}class zR{store;backends=new Map;fingerprintKey;now;constructor(E,r){if(this.store=E,this.fingerprintKey=r.fingerprintKey??r.encryptionKey,this.now=r.now??(()=>new Date),!this.fingerprintKey)throw Error("Configuration fingerprint key is required.");let t=r.backends??[new ee(E.controlPlane,r.encryptionKey,this.now)];for(let T of t)this.backends.set(T.kind,T)}list(E){let r=E.search?.toLowerCase();return this.store.list(E).filter((t)=>!r||t.key.toLowerCase().includes(r)).map((t)=>Ij(t,{canReadSecretMetadata:E.canReadSecretMetadata}))}plan(E){let r=this.store.list({projectId:E.projectId,scope:E.scope}),t=new Map(r.map((R)=>[R.key,R])),T=[],_=[],d=[],e=[];for(let[R,N]of Object.entries(E.values)){T.push(...this.warnings(R,N));let A=t.get(R);if(!A)_.push(R);else if(A.valueFingerprint!==this.fingerprint(N))d.push(R);else e.push(R)}let h=E.removeMissing?r.filter((R)=>!Object.hasOwn(E.values,R.key)).map((R)=>R.key):[];return{added:lt(_),changed:lt(d),removed:lt(h),unchanged:lt(e),affectedResourceIds:this.affectedResources(E.projectId,E.scope,[..._,...d,...h]),warnings:T}}async set(E){let r=this.requestHash(E),t=E.idempotencyKey;if(t){let I=this.store.mutation(t);if(I){if(I.requestHash!==r)throw Error("Idempotency key was already used for a different configuration mutation.");let D=this.store.get(String(I.result.entryId??""));if(!D)throw Error("Idempotent configuration result is no longer available.");return{entry:D,mutation:I.result.mutation,warnings:[]}}}if(E.value!=null&&P8.test(E.value))throw Error("Secret references must use the reference field, not a plaintext value field.");let T=this.store.find(E.projectId,E.scope,E.key),_=this.fingerprint(E.value??E.reference??"");if(T&&E.expectedVersion!=null&&T.version!==E.expectedVersion)throw Error("Configuration entry changed; refresh and retry.");if(T&&T.kind!==E.kind)throw Error("Delete the existing entry before changing between variable and secret kinds.");let d=E.kind==="variable"?"plaintext":E.backend??(E.reference?"external":"local_encrypted");if(!!T&&(T.valueFingerprint!==_||T.backend!==d||T.required!==!!E.required)&&(this.isProduction(T)||this.store.dependencies(T.id).length>0)&&!E.confirmed)throw Error("Confirmation is required because this replacement affects production or dependent services.");let h=E.reference,R;if(E.kind==="secret"){let I=this.backend(d);if(E.reference&&E.value==null){if(!await I.validate(E.reference))throw Error("Secret backend reference is unavailable or invalid.");R=T?.backendVersion??"external"}else{if(E.value==null)throw Error("A secret value or external reference is required.");let D=await I.put({reference:T?.backend===d?T.secretRef:void 0,name:this.backendName(E),value:E.value,idempotencyKey:t??crypto.randomUUID()});h=D.reference,R=D.version}}let N=E.kind==="variable"?E.value:void 0;if(E.kind==="variable"&&N==null)throw Error("A variable value is required.");let A=!T||T.valueFingerprint!==_||T.backend!==d||T.secretRef!==h||T.backendVersion!==R||T.required!==!!E.required,S=T?A?this.store.update(T.id,T.version,{value:N,valueFingerprint:_,secretRef:h,backend:d,backendVersion:R,required:!!E.required,metadata:ZE(E.metadata??T.metadata),rotatedAt:E.kind==="secret"?this.now().toISOString():T.rotatedAt}):T:this.store.create({organizationId:E.organizationId,projectId:E.projectId,scope:E.scope,key:E.key,kind:E.kind,value:N,valueFingerprint:_,secretRef:h,backend:d,backendVersion:R,origin:E.origin??"managed",required:!!E.required,metadata:ZE(E.metadata??{}),rotatedAt:E.kind==="secret"?this.now().toISOString():void 0}),L=this.affectedResources(E.projectId,E.scope,[E.key]),O={added:T?[]:[E.key],changed:T&&A?[E.key]:[],removed:[],unchanged:T&&!A?[E.key]:[],affectedResourceIds:L,versions:{[E.key]:S.version}};if(t)this.store.recordMutation({projectId:E.projectId,idempotencyKey:t,requestHash:r,actorId:E.actorId,result:{entryId:S.id,mutation:O}});return this.audit(E.projectId,E.actorId,T&&A?"configuration.updated":T?"configuration.unchanged":"configuration.created",S,L),{entry:S,mutation:O,warnings:this.warnings(E.key,E.value??"")}}async importDotenv(E){let r=kU(E.source);if(!r.valid)return{document:r,warnings:[]};let t=new Set(E.secretKeys??[]),T={added:[],changed:[],removed:[],unchanged:[],affectedResourceIds:[],versions:{}},_=[];for(let[d,e]of Object.entries(r.values)){let h=await this.set({...E,source:void 0,key:d,value:e,kind:t.has(d)?"secret":"variable",idempotencyKey:E.idempotencyKey?`${E.idempotencyKey}:${d}`:void 0});T.added.push(...h.mutation.added),T.changed.push(...h.mutation.changed),T.unchanged.push(...h.mutation.unchanged),T.affectedResourceIds.push(...h.mutation.affectedResourceIds),Object.assign(T.versions,h.mutation.versions),_.push(...h.warnings)}return T.added=lt(T.added),T.changed=lt(T.changed),T.unchanged=lt(T.unchanged),T.affectedResourceIds=lt(T.affectedResourceIds),{document:r,mutation:T,warnings:_}}exportVariables(E){return uU(Object.fromEntries(this.store.list({projectId:E.projectId,scope:E.scope,kind:"variable"}).map((r)=>[r.key,r.value??""])))}async transfer(E){let r=this.store.get(E.entryId);if(!r)throw Error("Configuration entry was not found.");if(r.scope.type===E.targetScope.type&&r.scope.id===E.targetScope.id)throw Error("Choose a different destination scope.");let t=r.kind==="variable"?r.value:r.backend==="external"?void 0:await this.backend(r.backend).resolve(r.secretRef),T=r.kind==="secret"?r.backend:void 0,_=await this.set({organizationId:r.organizationId,projectId:r.projectId,scope:E.targetScope,key:r.key,kind:r.kind,value:t,reference:r.backend==="external"?r.secretRef:void 0,backend:T,required:r.required,metadata:r.metadata,confirmed:E.confirmed,actorId:E.actorId,idempotencyKey:E.idempotencyKey?`${E.idempotencyKey}:copy`:void 0,origin:r.origin});if(E.mode==="move")await this.remove({entryId:r.id,expectedVersion:r.version,confirmed:E.confirmed,actorId:E.actorId});let d={added:_.mutation.added,changed:_.mutation.changed,removed:E.mode==="move"?[r.key]:[],unchanged:_.mutation.unchanged,affectedResourceIds:lt([..._.mutation.affectedResourceIds,...this.affectedResources(r.projectId,r.scope,[r.key])]),versions:_.mutation.versions};return{entry:_.entry,mutation:d}}async resolve(E){let r=this.store.list({projectId:E.projectId}),t=r.filter((N)=>this.applies(N,E)).sort((N,A)=>this.rank(N.scope.type)-this.rank(A.scope.type)),T=new Map,_=new Set;for(let N of t){if(T.has(N.key))_.add(N.key);T.set(N.key,N)}let d={},e={},h=[],R=new Set(E.allowedPreviewSecrets??[]);for(let[N,A]of T){if(E.previewId&&A.kind==="secret"&&A.scope.type!=="preview"&&(!E.trustedPreview||!R.has(N)))continue;if(A.kind==="variable")d[N]=A.value??"";else if(E.nativeReferences)d[N]=A.secretRef;else{let S=this.backend(A.backend);if(!await S.validate(A.secretRef)){if(h.push({key:N,code:"stale_reference",message:`${N} points to an unavailable secret.`}),A.required)h.push({key:N,code:"missing_required",message:`${N} is required but unavailable.`});continue}d[N]=await S.resolve(A.secretRef)}e[N]=Ij(A,{inherited:A.scope.type!==(E.previewId?"preview":E.functionId?"function":E.resourceId?"service":E.environmentId?"environment":"project"),overridden:_.has(N),canReadSecretMetadata:E.canReadSecretMetadata}),this.store.controlPlane.database.run("UPDATE configuration_entries SET last_used_at=? WHERE id=?",[this.now().toISOString(),A.id])}return{values:d,entries:e,warnings:h,configurationHash:this.fingerprint([...T.values()].map((N)=>`${N.key}:${N.valueFingerprint}:${N.version}`).sort().join(`
+`))}}async reveal(E){let r=this.store.get(E.entryId);if(!r||r.kind!=="secret")throw Error("Configuration secret was not found.");if(!E.canRevealSecrets)throw Error("Secret reveal permission is required.");if(!E.recentlyAuthenticated)throw Error("Recent authentication is required to reveal a secret.");let t=await this.backend(r.backend).resolve(r.secretRef);return this.audit(r.projectId,E.actorId,"configuration.secret.revealed",r,[]),t}async remove(E){let r=this.store.get(E.entryId);if(!r)throw Error("Configuration entry was not found.");let t=this.store.dependencies(r.id);if(((r.scope.environmentId?this.store.controlPlane.listEnvironments(r.projectId).some((e)=>e.id===r.scope.environmentId&&e.kind==="production"):r.scope.type==="project")||t.length)&&!E.confirmed)throw Error("Confirmation is required because this configuration affects production or dependent services.");if(r.kind==="secret"&&r.backend!=="external")await this.backend(r.backend).remove(r.secretRef);this.store.remove(r.id,E.expectedVersion);let _=lt(t.map((e)=>e.resourceId)),d={added:[],changed:[],removed:[r.key],unchanged:[],affectedResourceIds:_,versions:{}};return this.audit(r.projectId,E.actorId,"configuration.deleted",r,_),d}applies(E,r){if(E.scope.type==="project")return!0;if(E.scope.type==="environment")return E.scope.id===r.environmentId;if(E.scope.type==="service")return E.scope.id===r.resourceId;if(E.scope.type==="function")return E.scope.id===r.functionId;return E.scope.id===r.previewId}rank(E){return{project:0,environment:1,service:2,function:3,preview:4}[E]}fingerprint(E){return`hmac-sha256:${V8("sha256",this.fingerprintKey).update(E).digest("hex")}`}requestHash(E){return this.fingerprint(JSON.stringify({...E,idempotencyKey:void 0,actorId:void 0}))}backend(E){let r=this.backends.get(E);if(!r)throw Error(`Configuration secret backend is not configured: ${E}`);return r}backendName(E){return`ts-cloud/${E.projectId}/${E.scope.type}/${E.scope.id}/${E.key}`.replace(/[^A-Za-z0-9/_+=.@-]/g,"-")}isProduction(E){return E.scope.type==="project"||!!E.scope.environmentId&&this.store.controlPlane.listEnvironments(E.projectId).some((r)=>r.id===E.scope.environmentId&&r.kind==="production")}warnings(E,r){let t=[];if(K8.test(E))t.push({key:E,code:"reserved",message:`${E} may be reserved by the runtime or provider.`});if(Buffer.byteLength(r)>65536)t.push({key:E,code:"limit",message:`${E} exceeds the portable 64 KiB value limit.`});return t}affectedResources(E,r,t){let T=this.store.list({projectId:E,scope:r}).filter((_)=>t.includes(_.key)).flatMap((_)=>this.store.dependencies(_.id).map((d)=>d.resourceId));if(r.type==="service"||r.type==="function")return lt([...T,r.id]);if(r.type==="environment")return lt([...T,...this.store.controlPlane.listResources(E,r.id).map((_)=>_.id)]);if(r.type==="preview"){let _=this.store.controlPlane.database.query("SELECT resource_id FROM preview_instances WHERE id=?").get(r.id);return lt([...T,..._?[_.resource_id]:[]])}return lt([...T,...this.store.controlPlane.listResources(E).map((_)=>_.id)])}audit(E,r,t,T,_){this.store.controlPlane.appendEvent({projectId:E,actorId:r,type:t,payload:{entryId:T.id,key:T.key,kind:T.kind,scopeType:T.scope.type,scopeId:T.scope.id,backend:T.backend,version:T.version,affectedResourceIds:_}})}}var P8,K8;var Uj=$E(()=>{rt();vU();nU();P8=/^(?:secret|aws-sm|aws-ssm|vault|doppler|op|external):\/\//,K8=/^(?:AWS_|TS_CLOUD_|PORT$|HOST$)/});async function fA(E,r,t,T){let _={added:0,changed:0,removed:0,overridden:0},d=async(e,h)=>{let R=E.store.list({projectId:r.project.id,scope:e,kind:"variable"}),N=new Set(Object.keys(h));for(let A of R.filter((S)=>S.origin==="config"&&!N.has(S.key)))await E.remove({entryId:A.id,expectedVersion:A.version,confirmed:!0,actorId:T}),_.removed++;for(let[A,S]of Object.entries(h)){let L=E.store.find(r.project.id,e,A);if(L?.origin!=="config"){if(L)_.overridden++;else await E.set({organizationId:r.organization.id,projectId:r.project.id,scope:e,key:A,kind:"variable",value:String(S),origin:"config",confirmed:!0,actorId:T}),_.added++;continue}if(L.value===String(S))continue;await E.set({organizationId:r.organization.id,projectId:r.project.id,scope:e,key:A,kind:"variable",value:String(S),origin:"config",confirmed:!0,actorId:T,expectedVersion:L.version}),_.changed++}};for(let[e,h]of Object.entries(t.environments??{})){let R=r.environments.get(e);if(!R)continue;let N=h,A={...N.variables??{},...N.app?.env??{}};await d({type:"environment",id:R.id,environmentId:R.id},A);for(let[S,L]of Object.entries(t.sites??{})){let O=r.store.listResources(r.project.id,R.id).find((I)=>I.kind==="application"&&I.slug===S);if(O)await d({type:"service",id:O.id,environmentId:R.id,resourceId:O.id},{...L.env??{}})}for(let[S,L]of Object.entries(t.infrastructure?.functions??{})){let O=r.store.listResources(r.project.id,R.id).find((I)=>I.kind==="function"&&I.slug===S);if(O)await d({type:"function",id:O.id,environmentId:R.id,resourceId:O.id},{...L.environment??{}})}}return _}var Dj={};Qr(Dj,{synchronizeConfiguredConfiguration:()=>fA,serializeDotenv:()=>uU,parseDotenv:()=>kU,LocalEncryptedConfigurationBackend:()=>ee,ExternalConfigurationBackend:()=>JR,ConfigurationStore:()=>wR,ConfigurationService:()=>zR,AwsSsmConfigurationBackend:()=>XR,AwsSecretsManagerConfigurationBackend:()=>CR});var YA=$E(()=>{nU();vU();Uj()});function Sz(E,r=""){return E===408||E===409||E===425||E===429||E>=500||/rate limit|temporar|timed? ?out|try again/i.test(r)}async function N$(E,r){let t=r?.headers.get("retry-after"),T=t===null||t===void 0?void 0:Number(t)*1000,_=Number.isFinite(T)?Math.max(0,T):Math.min(1000*2**(E-1),30000);await new Promise((d)=>setTimeout(d,_))}class uA{name="porkbun";apiKey;secretKey;requestTimeoutMs;constructor(E,r,t=15000){this.apiKey=E,this.secretKey=r,this.requestTimeoutMs=t}async request(E,r={}){let t;for(let T=1;T<=8;T+=1){let _,d=new AbortController,e=setTimeout(()=>{d.abort(Error(`Porkbun API request timed out after ${this.requestTimeoutMs}ms`))},this.requestTimeoutMs);try{_=await fetch(`https://api.porkbun.com/api/json/v3${E}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({apikey:this.apiKey,secretapikey:this.secretKey,...r}),signal:d.signal})}catch(R){if(t=R,T===8)throw R;await N$(T);continue}finally{clearTimeout(e)}if(!_.ok){if(t=Error(`Porkbun API error: ${_.status} ${_.statusText}`),!Sz(_.status)||T===8)throw t;await N$(T,_);continue}let h=await _.json();if(h.status==="ERROR"){if(t=Error(`Porkbun API error: ${h.message||"Unknown error"}`),!Sz(0,h.message)||T===8)throw t;await N$(T,_);continue}return h}throw t}getSubdomain(E,r){let t=E.replace(/\.$/,""),T=r.replace(/\.$/,"");if(t===T)return"";if(t.endsWith(`.${T}`))return t.slice(0,-(T.length+1));return t}getRootDomain(E){let r=E.replace(/\.$/,"").split(".");if(r.length>=2)return r.slice(-2).join(".");return E}async createRecord(E,r){try{let t=this.getRootDomain(E),T=this.getSubdomain(r.name,t),_={type:r.type,content:r.content,ttl:String(r.ttl||600)};if(T)_.name=T;if((r.type==="MX"||r.type==="SRV")&&r.priority!==void 0)_.prio=String(r.priority);if(r.type==="SRV"&&r.weight!==void 0&&r.port!==void 0)_.content=`${r.weight} ${r.port} ${r.content}`;return{success:!0,id:(await this.request(`/dns/create/${t}`,_)).id?.toString(),message:"Record created successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async upsertRecord(E,r){try{let t=this.getRootDomain(E),T=this.getSubdomain(r.name,t),_=await this.listRecords(E,r.type);if(_.success){let d=_.records.find((e)=>{return this.getSubdomain(e.name,t)===T&&e.type===r.type});if(d?.id){let e={type:r.type,content:r.content,ttl:String(r.ttl||600)};if(T)e.name=T;if((r.type==="MX"||r.type==="SRV")&&r.priority!==void 0)e.prio=String(r.priority);if(r.type==="SRV"&&r.weight!==void 0&&r.port!==void 0)e.content=`${r.weight} ${r.port} ${r.content}`;return await this.request(`/dns/edit/${t}/${d.id}`,e),{success:!0,id:d.id,message:"Record updated successfully"}}}return this.createRecord(E,r)}catch(t){return this.createRecord(E,r)}}async deleteRecord(E,r){try{let t=this.getRootDomain(E);if("id"in r&&r.id)return await this.request(`/dns/delete/${t}/${r.id}`),{success:!0,message:"Record deleted successfully"};let T=this.getSubdomain(r.name,t),_=await this.listRecords(E);if(!_.success)return{success:!1,message:"Failed to list records"};let d=_.records.find((e)=>{return this.getSubdomain(e.name,t)===T&&e.type===r.type&&e.content===r.content});if(!d?.id)return{success:!1,message:"Record not found"};return await this.request(`/dns/delete/${t}/${d.id}`),{success:!0,message:"Record deleted successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async listRecords(E,r){try{let t=this.getRootDomain(E),T=`/dns/retrieve/${t}`;if(r)T=`/dns/retrieveByNameType/${t}/${r}`;return{success:!0,records:((await this.request(T)).records||[]).map((e)=>({id:e.id,name:e.name||t,type:e.type,content:e.content,ttl:Number.parseInt(e.ttl,10),priority:e.prio?Number.parseInt(e.prio,10):void 0}))}}catch(t){return{success:!1,records:[],message:t instanceof Error?t.message:"Unknown error"}}}async canManageDomain(E){try{let r=this.getRootDomain(E);return await this.request(`/dns/retrieve/${r}`),!0}catch{return!1}}async listDomains(){try{return((await this.request("/domain/listAll")).domains||[]).map((r)=>r.domain)}catch{return[]}}async getNameServers(E){try{let r=this.getRootDomain(E);return(await this.request(`/dns/getNS/${r}`)).ns||[]}catch{return[]}}async updateNameServers(E,r){try{let t=this.getRootDomain(E);return await this.request(`/dns/updateNS/${t}`,{ns:r}),!0}catch{return!1}}}class nA{name="godaddy";apiKey;apiSecret;baseUrl;constructor(E,r,t="production"){this.apiKey=E,this.apiSecret=r,this.baseUrl=t==="ote"?"https://api.ote-godaddy.com":"https://api.godaddy.com"}async request(E,r,t){let T=`${this.baseUrl}${r}`,_={Authorization:`sso-key ${this.apiKey}:${this.apiSecret}`,"Content-Type":"application/json",Accept:"application/json"},d={method:E,headers:_};if(t)d.body=JSON.stringify(t);let e=await fetch(T,d);if(e.status===204)return{};if(e.ok){let R=await e.text();if(R)return JSON.parse(R);return{}}let h=`GoDaddy API error: ${e.status} ${e.statusText}`;try{let R=await e.json();if(R.message)h=`GoDaddy API error: ${R.message}`;if(R.fields)h+=` - Fields: ${JSON.stringify(R.fields)}`}catch{}throw Error(h)}getSubdomain(E,r){let t=E.replace(/\.$/,""),T=r.replace(/\.$/,"");if(t===T)return"@";if(t.endsWith(`.${T}`))return t.slice(0,-(T.length+1));return t}getRootDomain(E){let r=E.replace(/\.$/,"").split(".");if(r.length>=2)return r.slice(-2).join(".");return E}toGoDaddyRecord(E,r){let t=this.getRootDomain(r),T=this.getSubdomain(E.name,t),_={type:E.type,name:T,data:E.content,ttl:E.ttl||600};if(E.type==="MX"&&E.priority!==void 0)_.priority=E.priority;return _}fromGoDaddyRecord(E,r){let t=this.getRootDomain(r),T=E.name;if(T==="@")T=t;else if(!T.endsWith(t))T=`${T}.${t}`;return{name:T,type:E.type,content:E.data,ttl:E.ttl,priority:E.priority}}async createRecord(E,r){try{let t=this.getRootDomain(E),T=this.toGoDaddyRecord(r,E);return await this.request("PATCH",`/v1/domains/${t}/records`,[T]),{success:!0,message:"Record created successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async upsertRecord(E,r){try{let t=this.getRootDomain(E),T=this.toGoDaddyRecord(r,E);return await this.request("PUT",`/v1/domains/${t}/records/${r.type}/${T.name}`,[T]),{success:!0,message:"Record upserted successfully"}}catch(t){return this.createRecord(E,r)}}async deleteRecord(E,r){try{let t=this.getRootDomain(E),T=this.getSubdomain(r.name,t),_=await this.request("GET",`/v1/domains/${t}/records/${r.type}/${T}`),d=_.filter((e)=>e.data!==r.content);if(d.length===_.length)return{success:!1,message:"Record not found"};if(d.length===0)try{await this.request("DELETE",`/v1/domains/${t}/records/${r.type}/${T}`)}catch{}else await this.request("PUT",`/v1/domains/${t}/records/${r.type}/${T}`,d);return{success:!0,message:"Record deleted successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async listRecords(E,r){try{let t=this.getRootDomain(E),T=`/v1/domains/${t}/records`;if(r)T=`/v1/domains/${t}/records/${r}`;return{success:!0,records:(await this.request("GET",T)).map((d)=>this.fromGoDaddyRecord(d,E))}}catch(t){return{success:!1,records:[],message:t instanceof Error?t.message:"Unknown error"}}}async canManageDomain(E){try{let r=this.getRootDomain(E);return await this.request("GET",`/v1/domains/${r}`),!0}catch{return!1}}async listDomains(){try{return(await this.request("GET","/v1/domains")).map((r)=>r.domain)}catch{return[]}}async getDomainDetails(E){try{let r=this.getRootDomain(E),t=await this.request("GET",`/v1/domains/${r}`);return{domain:t.domain,status:t.status,nameServers:t.nameServers,expires:t.expires}}catch{return null}}async updateNameServers(E,r){try{let t=this.getRootDomain(E);return await this.request("PUT",`/v1/domains/${t}/records/NS`,r.map((T)=>({type:"NS",name:"@",data:T,ttl:3600}))),!0}catch{return!1}}async checkDomainAvailability(E){try{let r=await this.request("GET",`/v1/domains/available?domain=${encodeURIComponent(E)}`);return{available:r.available,price:r.price,currency:r.currency}}catch{return{available:!1}}}}class yO{name="cloudflare";apiToken;zoneCache=new Map;constructor(E){this.apiToken=E}async request(E,r,t){let T=`https://api.cloudflare.com/client/v4${r}`,_={Authorization:`Bearer ${this.apiToken}`,"Content-Type":"application/json"},d={method:E,headers:_};if(t)d.body=JSON.stringify(t);let h=await(await fetch(T,d)).json();if(!h.success){let R=h.errors.map((N)=>N.message).join(", ");throw Error(`Cloudflare API error: ${R}`)}return h}getRootDomain(E){let r=E.replace(/\.$/,"").split(".");if(r.length>=2)return r.slice(-2).join(".");return E}async getZoneId(E){let r=this.getRootDomain(E),t=this.zoneCache.get(r);if(t)return t;let T=await this.request("GET",`/zones?name=${encodeURIComponent(r)}`);if(!T.result||T.result.length===0)throw Error(`Zone not found for domain: ${r}`);let _=T.result[0].id;return this.zoneCache.set(r,_),_}getFullRecordName(E,r){let t=this.getRootDomain(r),T=E.replace(/\.$/,"");if(!T||T===t||T==="@")return t;if(T.endsWith(`.${t}`))return T;return`${T}.${t}`}toCloudflareRecord(E,r){let t={type:E.type,name:this.getFullRecordName(E.name,r),content:E.content||E.value||"",ttl:E.ttl||1};if(E.type==="MX"&&E.priority!==void 0)t.priority=E.priority;if(E.type==="SRV"){if(E.priority!==void 0)t.priority=E.priority}return t}fromCloudflareRecord(E){return{id:E.id,name:E.name,type:E.type,content:E.content,ttl:E.ttl,priority:E.priority}}async createRecord(E,r){try{let t=await this.getZoneId(E),T=this.toCloudflareRecord(r,E);return{success:!0,id:(await this.request("POST",`/zones/${t}/dns_records`,T)).result.id,message:"Record created successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async upsertRecord(E,r){try{let t=await this.getZoneId(E),T=this.getFullRecordName(r.name,E),_=await this.request("GET",`/zones/${t}/dns_records?type=${r.type}&name=${encodeURIComponent(T)}`),d=this.toCloudflareRecord(r,E);if(_.result&&_.result.length>0){let h=_.result[0].id;return{success:!0,id:(await this.request("PUT",`/zones/${t}/dns_records/${h}`,d)).result.id,message:"Record updated successfully"}}return{success:!0,id:(await this.request("POST",`/zones/${t}/dns_records`,d)).result.id,message:"Record created successfully"}}catch(t){return this.createRecord(E,r)}}async deleteRecord(E,r){try{let t=await this.getZoneId(E),T=this.getFullRecordName(r.name,E),_=await this.request("GET",`/zones/${t}/dns_records?type=${r.type}&name=${encodeURIComponent(T)}`);if(!_.result||_.result.length===0)return{success:!1,message:"Record not found"};let d=_.result.find((e)=>e.content===r.content);if(!d)return{success:!1,message:"Record with matching content not found"};return await this.request("DELETE",`/zones/${t}/dns_records/${d.id}`),{success:!0,message:"Record deleted successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async listRecords(E,r){try{let T=`/zones/${await this.getZoneId(E)}/dns_records?per_page=100`;if(r)T+=`&type=${r}`;let _=[],d=1,e=!0;while(e){let h=await this.request("GET",`${T}&page=${d}`);if(_.push(...h.result||[]),h.result_info)e=d<h.result_info.total_pages,d++;else e=!1}return{success:!0,records:_.map((h)=>this.fromCloudflareRecord(h))}}catch(t){return{success:!1,records:[],message:t instanceof Error?t.message:"Unknown error"}}}async canManageDomain(E){try{return await this.getZoneId(E),!0}catch{return!1}}async listDomains(){try{let E=[],r=1,t=!0;while(t){let T=await this.request("GET",`/zones?per_page=50&page=${r}`);if(E.push(...T.result||[]),T.result_info)t=r<T.result_info.total_pages,r++;else t=!1}return E.map((T)=>T.name)}catch{return[]}}async getZoneDetails(E){try{let r=await this.getZoneId(E),t=await this.request("GET",`/zones/${r}`);return{id:t.result.id,name:t.result.name,status:t.result.status,nameServers:t.result.name_servers,paused:t.result.paused}}catch{return null}}async purgeCache(E,r){try{let t=await this.getZoneId(E),T={};if(r?.purgeEverything)T.purge_everything=!0;else{if(r?.files)T.files=r.files;if(r?.tags)T.tags=r.tags;if(r?.hosts)T.hosts=r.hosts}if(Object.keys(T).length===0)T.purge_everything=!0;return await this.request("POST",`/zones/${t}/purge_cache`,T),!0}catch{return!1}}async getRecordProxyStatus(E,r){try{let t=await this.getZoneId(E),T=this.getFullRecordName(r.name,E),_=await this.request("GET",`/zones/${t}/dns_records?type=${r.type}&name=${encodeURIComponent(T)}`);if(_.result&&_.result.length>0)return _.result.find((e)=>e.content===r.content)?.proxied??null;return null}catch{return null}}async setRecordProxyStatus(E,r,t){try{let T=await this.getZoneId(E),_=this.getFullRecordName(r.name,E),d=await this.request("GET",`/zones/${T}/dns_records?type=${r.type}&name=${encodeURIComponent(_)}`);if(!d.result||d.result.length===0)return!1;let e=d.result.find((h)=>h.content===r.content);if(!e)return!1;return await this.request("PATCH",`/zones/${T}/dns_records/${e.id}`,{proxied:t}),!0}catch{return!1}}}class hh{name="route53";client;hostedZoneCache=new Map;providedHostedZoneId;constructor(E="us-east-1",r){this.client=new Ot(E),this.providedHostedZoneId=r}getRootDomain(E){let r=E.replace(/\.$/,"").split(".");if(r.length>=2)return r.slice(-2).join(".");return E}async getHostedZoneId(E){if(this.providedHostedZoneId)return this.providedHostedZoneId;let r=this.getRootDomain(E),t=this.hostedZoneCache.get(r);if(t)return t;let T=await this.client.findHostedZoneForDomain(E);if(T){let _=T.Id.replace("/hostedzone/","");return this.hostedZoneCache.set(r,_),_}return null}normalizeName(E){return E.endsWith(".")?E:`${E}.`}async createRecord(E,r){try{let t=await this.getHostedZoneId(E);if(!t)return{success:!1,message:`No hosted zone found for domain: ${E}`};let T=this.normalizeName(r.name),_=r.content;if(r.type==="TXT"&&!_.startsWith('"'))_=`"${_}"`;if(r.type==="MX"&&r.priority!==void 0)_=`${r.priority} ${_}`;return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:t,ChangeBatch:{Comment:"Created by ts-cloud DNS provider",Changes:[{Action:"CREATE",ResourceRecordSet:{Name:T,Type:r.type,TTL:r.ttl||300,ResourceRecords:[{Value:_}]}}]}})).ChangeInfo?.Id,message:"Record created successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async upsertRecord(E,r){try{let t=await this.getHostedZoneId(E);if(!t)return{success:!1,message:`No hosted zone found for domain: ${E}`};let T=this.normalizeName(r.name),_=r.content;if(r.type==="TXT"&&!_.startsWith('"'))_=`"${_}"`;if(r.type==="MX"&&r.priority!==void 0)_=`${r.priority} ${_}`;return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:t,ChangeBatch:{Comment:"Upserted by ts-cloud DNS provider",Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:T,Type:r.type,TTL:r.ttl||300,ResourceRecords:[{Value:_}]}}]}})).ChangeInfo?.Id,message:"Record upserted successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async deleteRecord(E,r){try{let t=await this.getHostedZoneId(E);if(!t)return{success:!1,message:`No hosted zone found for domain: ${E}`};let T=this.normalizeName(r.name),_=r.content;if(r.type==="TXT"&&!_.startsWith('"'))_=`"${_}"`;if(r.type==="MX"&&r.priority!==void 0)_=`${r.priority} ${_}`;return await this.client.changeResourceRecordSets({HostedZoneId:t,ChangeBatch:{Comment:"Deleted by ts-cloud DNS provider",Changes:[{Action:"DELETE",ResourceRecordSet:{Name:T,Type:r.type,TTL:r.ttl||300,ResourceRecords:[{Value:_}]}}]}}),{success:!0,message:"Record deleted successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async listRecords(E,r){try{let t=await this.getHostedZoneId(E);if(!t)return{success:!1,records:[],message:`No hosted zone found for domain: ${E}`};let T=await this.client.listResourceRecordSets({HostedZoneId:t,StartRecordType:r}),_=[];for(let d of T.ResourceRecordSets){if(r&&d.Type!==r)continue;if(d.AliasTarget)continue;for(let e of d.ResourceRecords||[]){let h=e.Value,R;if(d.Type==="MX"){let N=h.split(" ");if(N.length>=2)R=Number.parseInt(N[0],10),h=N.slice(1).join(" ")}if(d.Type==="TXT"&&h.startsWith('"')&&h.endsWith('"'))h=h.slice(1,-1);_.push({name:d.Name.replace(/\.$/,""),type:d.Type,content:h,ttl:d.TTL,priority:R})}}return{success:!0,records:_}}catch(t){return{success:!1,records:[],message:t instanceof Error?t.message:"Unknown error"}}}async canManageDomain(E){return await this.getHostedZoneId(E)!==null}async listDomains(){try{return(await this.client.listHostedZones()).HostedZones.map((r)=>r.Name.replace(/\.$/,""))}catch{return[]}}getRoute53Client(){return this.client}async createAliasRecord(E){try{let r=await this.getHostedZoneId(E.domain);if(!r)return{success:!1,message:`No hosted zone found for domain: ${E.domain}`};return{success:!0,id:(await this.client.createAliasRecord({HostedZoneId:r,Name:this.normalizeName(E.name),TargetHostedZoneId:E.targetHostedZoneId,TargetDNSName:E.targetDnsName,EvaluateTargetHealth:E.evaluateTargetHealth,Type:E.type})).ChangeInfo?.Id,message:"Alias record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async createCloudFrontAlias(E){return this.createAliasRecord({domain:E.domain,name:E.name,targetHostedZoneId:Ot.CloudFrontHostedZoneId,targetDnsName:E.cloudFrontDomainName,evaluateTargetHealth:!1})}async createAlbAlias(E){let r=Ot.ALBHostedZoneIds[E.region];if(!r)return{success:!1,message:`Unknown region for ALB: ${E.region}`};return this.createAliasRecord({domain:E.domain,name:E.name,targetHostedZoneId:r,targetDnsName:E.albDnsName,evaluateTargetHealth:!0})}}var jO=$E(()=>{Eh()});var Lz={};Qr(Lz,{ACMDnsValidator:()=>vA,ACMClient:()=>$t});class $t{client;region;constructor(E="us-east-1"){this.client=new wE,this.region=E}async requestCertificate(E){let r={DomainName:E.DomainName,ValidationMethod:E.ValidationMethod||"DNS"};if(E.SubjectAlternativeNames)r.SubjectAlternativeNames=E.SubjectAlternativeNames;return{CertificateArn:(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.RequestCertificate"},body:JSON.stringify(r)})).CertificateArn||""}}async describeCertificate(E){let t=(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.DescribeCertificate"},body:JSON.stringify({CertificateArn:E.CertificateArn})})).Certificate||{};return{CertificateArn:t.CertificateArn||"",DomainName:t.DomainName||"",SubjectAlternativeNames:t.SubjectAlternativeNames,Status:t.Status||"PENDING_VALIDATION",Type:t.Type,DomainValidationOptions:t.DomainValidationOptions?.map((T)=>({DomainName:T.DomainName,ValidationDomain:T.ValidationDomain,ValidationStatus:T.ValidationStatus,ResourceRecord:T.ResourceRecord?{Name:T.ResourceRecord.Name,Type:T.ResourceRecord.Type,Value:T.ResourceRecord.Value}:void 0,ValidationMethod:T.ValidationMethod})),CreatedAt:t.CreatedAt,IssuedAt:t.IssuedAt,NotBefore:t.NotBefore,NotAfter:t.NotAfter}}async listCertificates(E){let r={};if(E?.CertificateStatuses)r.CertificateStatuses=E.CertificateStatuses;if(E?.MaxItems)r.MaxItems=E.MaxItems;if(E?.NextToken)r.NextToken=E.NextToken;let t=await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ListCertificates"},body:JSON.stringify(r)});return{CertificateSummaryList:(t.CertificateSummaryList||[]).map((T)=>({CertificateArn:T.CertificateArn,DomainName:T.DomainName})),NextToken:t.NextToken}}async deleteCertificate(E){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.DeleteCertificate"},body:JSON.stringify({CertificateArn:E.CertificateArn})})}async listTagsForCertificate(E){return{Tags:(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ListTagsForCertificate"},body:JSON.stringify({CertificateArn:E.CertificateArn})})).Tags||[]}}async addTagsToCertificate(E){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.AddTagsToCertificate"},body:JSON.stringify({CertificateArn:E.CertificateArn,Tags:E.Tags})})}async resendValidationEmail(E){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ResendValidationEmail"},body:JSON.stringify({CertificateArn:E.CertificateArn,Domain:E.Domain,ValidationDomain:E.ValidationDomain})})}async findCertificateByDomain(E){let t=(await this.listCertificates({CertificateStatuses:["ISSUED"]})).CertificateSummaryList.find((T)=>T.DomainName===E||T.DomainName===`*.${E.split(".").slice(1).join(".")}`);if(!t)return null;return this.describeCertificate({CertificateArn:t.CertificateArn})}async waitForCertificateValidation(E,r=60,t=30000){for(let T=0;T<r;T++){let _=await this.describeCertificate({CertificateArn:E});if(_.Status==="ISSUED")return _;if(_.Status==="FAILED"||_.Status==="VALIDATION_TIMED_OUT")return null;await new Promise((d)=>setTimeout(d,t))}return null}async getDnsValidationRecords(E){let r=await this.describeCertificate({CertificateArn:E});if(!r.DomainValidationOptions)return[];return r.DomainValidationOptions.filter((t)=>t.ResourceRecord&&t.ValidationMethod==="DNS").map((t)=>({domainName:t.DomainName,recordName:t.ResourceRecord.Name,recordType:t.ResourceRecord.Type,recordValue:t.ResourceRecord.Value}))}async requestCertificateWithSans(E){let r=new Set;if(r.add(E.DomainName),E.IncludeWww!==!1)r.add(`www.${E.DomainName}`);if(E.IncludeWildcard)r.add(`*.${E.DomainName}`);if(E.AdditionalSans)for(let t of E.AdditionalSans)r.add(t);return this.requestCertificate({DomainName:E.DomainName,SubjectAlternativeNames:Array.from(r),ValidationMethod:"DNS"})}async isCertificateValidForDomain(E,r){let t=await this.describeCertificate({CertificateArn:E});if(t.Status!=="ISSUED")return!1;if(t.DomainName===r)return!0;if(t.DomainName?.startsWith("*.")){let T=t.DomainName.slice(2),_=r.split("."),d=T.split(".");if(_.slice(-d.length).join(".")===T)return!0}if(t.SubjectAlternativeNames)for(let T of t.SubjectAlternativeNames){if(T===r)return!0;if(T.startsWith("*.")){let _=T.slice(2),d=r.split("."),e=_.split(".");if(d.slice(-e.length).join(".")===_)return!0}}return!1}}class vA{acm;route53;dnsProvider;constructor(E="us-east-1",r){if(this.acm=new $t(E),this.route53=new Ot,r&&r.provider!=="route53")this.dnsProvider=zt(r)}async requestAndValidate(E){let{domainName:r,hostedZoneId:t,subjectAlternativeNames:T=[],waitForValidation:_=!1,maxWaitMinutes:d=30}=E;if(!this.dnsProvider&&!t)throw Error("Either hostedZoneId or external DNS provider configuration is required");let{CertificateArn:e}=await this.acm.requestCertificate({DomainName:r,SubjectAlternativeNames:T.length>0?[r,...T]:void 0,ValidationMethod:"DNS"});await this.waitForValidationOptions(e);let h=await this.acm.getDnsValidationRecords(e);if(this.dnsProvider)for(let R of h){let N=await this.dnsProvider.upsertRecord(r,{name:R.recordName,type:R.recordType,content:R.recordValue,ttl:300});if(!N.success)console.warn(`Failed to create validation record for ${R.domainName}: ${N.message}`)}else if(t)for(let R of h)await this.route53.changeResourceRecordSets({HostedZoneId:t,ChangeBatch:{Comment:`ACM DNS validation for ${R.domainName}`,Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:R.recordName,Type:R.recordType,TTL:300,ResourceRecords:[{Value:R.recordValue}]}}]}});if(_){if(!await this.acm.waitForCertificateValidation(e,d*2,30000))throw Error(`Certificate validation timed out after ${d} minutes`)}return{certificateArn:e,validationRecords:h}}async waitForValidationOptions(E,r=30){for(let t=0;t<r;t++){let T=await this.acm.describeCertificate({CertificateArn:E});if(T.DomainValidationOptions&&T.DomainValidationOptions.length>0&&T.DomainValidationOptions[0].ResourceRecord)return;await new Promise((_)=>setTimeout(_,2000))}throw Error("Timeout waiting for DNS validation options")}async createValidationRecords(E){let{certificateArn:r,hostedZoneId:t,domain:T}=E;if(!this.dnsProvider&&!t)throw Error("Either hostedZoneId or external DNS provider configuration is required");let _=await this.acm.getDnsValidationRecords(r),d=[];if(this.dnsProvider){let e=T||_[0]?.domainName;for(let h of _){let R=await this.dnsProvider.upsertRecord(e,{name:h.recordName,type:h.recordType,content:h.recordValue,ttl:300});d.push({...h,changeId:R.success?R.id:void 0})}}else if(t)for(let e of _){let h=await this.route53.changeResourceRecordSets({HostedZoneId:t,ChangeBatch:{Comment:`ACM DNS validation for ${e.domainName}`,Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.recordName,Type:e.recordType,TTL:300,ResourceRecords:[{Value:e.recordValue}]}}]}});d.push({...e,changeId:h.ChangeInfo?.Id})}return d}async deleteValidationRecords(E){let{certificateArn:r,hostedZoneId:t,domain:T}=E,_=await this.acm.getDnsValidationRecords(r);if(this.dnsProvider){let d=T||_[0]?.domainName;for(let e of _)try{await this.dnsProvider.deleteRecord(d,{name:e.recordName,type:e.recordType,content:e.recordValue})}catch{}}else if(t)for(let d of _)try{await this.route53.changeResourceRecordSets({HostedZoneId:t,ChangeBatch:{Comment:`Cleanup ACM DNS validation for ${d.domainName}`,Changes:[{Action:"DELETE",ResourceRecordSet:{Name:d.recordName,Type:d.recordType,TTL:300,ResourceRecords:[{Value:d.recordValue}]}}]}})}catch{}}async findOrCreateCertificate(E){let{domainName:r,hostedZoneId:t,subjectAlternativeNames:T,waitForValidation:_=!0}=E;if(!this.dnsProvider&&!t)throw Error("Either hostedZoneId or external DNS provider configuration is required");let d=await this.acm.findCertificateByDomain(r);if(d&&d.Status==="ISSUED")return{certificateArn:d.CertificateArn,isNew:!1};let{certificateArn:e}=await this.requestAndValidate({domainName:r,hostedZoneId:t,subjectAlternativeNames:T,waitForValidation:_});return{certificateArn:e,isNew:!0}}hasExternalDnsProvider(){return this.dnsProvider!==void 0}getDnsProviderName(){return this.dnsProvider?.name||"route53"}}var Id=$E(()=>{GE();Eh();H_()});class Rh{acm;dnsProvider;constructor(E,r="us-east-1"){if(this.acm=new $t(r),"provider"in E)this.dnsProvider=zt(E);else this.dnsProvider=E}getProvider(){return this.dnsProvider}async requestAndValidate(E){let{domainName:r,subjectAlternativeNames:t=[],waitForValidation:T=!1,maxWaitMinutes:_=30}=E,{CertificateArn:d}=await this.acm.requestCertificate({DomainName:r,SubjectAlternativeNames:t.length>0?[r,...t]:void 0,ValidationMethod:"DNS"});await this.waitForValidationOptions(d);let e=await this.acm.getDnsValidationRecords(d);for(let R of e){let N=await this.dnsProvider.upsertRecord(r,{name:R.recordName,type:R.recordType,content:R.recordValue,ttl:300});if(!N.success)console.warn(`Failed to create validation record for ${R.domainName}: ${N.message}`)}let h="pending";if(T)h=(await this.acm.waitForCertificateValidation(d,_*2,30000))?.Status==="ISSUED"?"issued":"failed";return{certificateArn:d,validationRecords:e.map((R)=>({domainName:R.domainName,recordName:R.recordName,recordType:R.recordType,recordValue:R.recordValue})),isNew:!0,status:h}}async createValidationRecords(E){let{certificateArn:r,domain:t}=E,T=[],_=await this.acm.getDnsValidationRecords(r);for(let d of _){let e=await this.dnsProvider.upsertRecord(t,{name:d.recordName,type:d.recordType,content:d.recordValue,ttl:300});if(!e.success)T.push(`Failed to create record for ${d.domainName}: ${e.message}`)}return{success:T.length===0,records:_.map((d)=>({domainName:d.domainName,recordName:d.recordName,recordType:d.recordType,recordValue:d.recordValue})),errors:T}}async deleteValidationRecords(E){let{certificateArn:r,domain:t}=E,T=[],_=await this.acm.getDnsValidationRecords(r);for(let d of _){let e=await this.dnsProvider.deleteRecord(t,{name:d.recordName,type:d.recordType,content:d.recordValue});if(!e.success)T.push(`Failed to delete record for ${d.domainName}: ${e.message}`)}return{success:T.length===0,errors:T}}async findOrCreateCertificate(E){let{domainName:r,subjectAlternativeNames:t=[],waitForValidation:T=!0,maxWaitMinutes:_}=E,d=await this.acm.findCertificateByDomain(r);if(d&&d.Status==="ISSUED"){let e=d.SubjectAlternativeNames||[d.DomainName],h=e.some((N)=>N===`*.${r}`);if(t.every((N)=>e.includes(N)||h))return{certificateArn:d.CertificateArn,validationRecords:[],isNew:!1,status:"issued"};console.log("Existing certificate doesn't cover all required SANs, requesting new certificate...")}return this.requestAndValidate({domainName:r,subjectAlternativeNames:t,waitForValidation:T,maxWaitMinutes:_})}async requestCertificateWithCommonSans(E){let{domainName:r,includeWww:t=!0,includeWildcard:T=!1,additionalSans:_=[],waitForValidation:d=!1}=E,e=[];if(t)e.push(`www.${r}`);if(T)e.push(`*.${r}`);return e.push(..._),this.requestAndValidate({domainName:r,subjectAlternativeNames:e,waitForValidation:d})}async waitForValidationOptions(E,r=30){for(let t=0;t<r;t++){let T=await this.acm.describeCertificate({CertificateArn:E});if(T.DomainValidationOptions&&T.DomainValidationOptions.length>0&&T.DomainValidationOptions[0].ResourceRecord)return;await new Promise((_)=>setTimeout(_,2000))}throw Error("Timeout waiting for DNS validation options")}async getCertificateStatus(E){let r=await this.acm.describeCertificate({CertificateArn:E});return{status:r.Status,domainValidations:(r.DomainValidationOptions||[]).map((t)=>({domain:t.DomainName,status:t.ValidationStatus||"UNKNOWN"}))}}}var A$=$E(()=>{Id();H_()});function zt(E){switch(E.provider){case"route53":return new hh(E.region,E.hostedZoneId);case"porkbun":return new uA(E.apiKey,E.secretKey);case"godaddy":return new nA(E.apiKey,E.apiSecret,E.environment);case"cloudflare":return new yO(E.apiToken);default:throw Error(`Unknown DNS provider: ${E.provider}`)}}class lA{providers=new Map;configs=[];addConfig(E){return this.configs.push(E),this}addRoute53(E,r){return this.configs.push({provider:"route53",region:E,hostedZoneId:r}),this}addPorkbun(E,r){return this.configs.push({provider:"porkbun",apiKey:E,secretKey:r}),this}addGoDaddy(E,r,t){return this.configs.push({provider:"godaddy",apiKey:E,apiSecret:r,environment:t}),this}addCloudflare(E){return this.configs.push({provider:"cloudflare",apiToken:E}),this}loadFromEnv(){if(process.env.AWS_ACCESS_KEY_ID||process.env.AWS_REGION)this.addRoute53(process.env.AWS_REGION);let E=process.env.PORKBUN_API_KEY,r=process.env.PORKBUN_SECRET_KEY;if(E&&r)this.addPorkbun(E,r);let t=process.env.GODADDY_API_KEY,T=process.env.GODADDY_API_SECRET;if(t&&T){let d=process.env.GODADDY_ENVIRONMENT;this.addGoDaddy(t,T,d)}let _=process.env.CLOUDFLARE_API_TOKEN;if(_)this.addCloudflare(_);return this}getProvider(E){let r=this.providers.get(E);if(r)return r;let t=this.configs.find((_)=>_.provider===E);if(!t)return null;let T=zt(t);return this.providers.set(E,T),T}async getProviderForDomain(E){for(let r of this.configs){let t=zt(r);if(await t.canManageDomain(E))return t}return null}getAllProviders(){return this.configs.map((E)=>zt(E))}}var kV;var H_=$E(()=>{jO();A$();jO();kV=new lA});var D$={};Qr(D$,{CloudFormationClient:()=>Er});class Er{client;region;constructor(E="us-east-1",r){this.region=E,this.client=new wE(void 0,{profile:r})}async createStack(E){let r={Action:"CreateStack",StackName:E.stackName,Version:"2010-05-15"};if(E.templateBody)r.TemplateBody=E.templateBody;else if(E.templateUrl)r.TemplateURL=E.templateUrl;else throw Error("Either templateBody or templateUrl must be provided");if(E.parameters)E.parameters.forEach((T,_)=>{r[`Parameters.member.${_+1}.ParameterKey`]=T.ParameterKey,r[`Parameters.member.${_+1}.ParameterValue`]=T.ParameterValue});if(E.capabilities)E.capabilities.forEach((T,_)=>{r[`Capabilities.member.${_+1}`]=T});if(E.roleArn)r.RoleARN=E.roleArn;if(E.tags)E.tags.forEach((T,_)=>{r[`Tags.member.${_+1}.Key`]=T.Key,r[`Tags.member.${_+1}.Value`]=T.Value});if(E.timeoutInMinutes)r.TimeoutInMinutes=E.timeoutInMinutes;if(E.onFailure)r.OnFailure=E.onFailure;let t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{StackId:t.StackId||t.CreateStackResult?.StackId}}async updateStack(E){let r={Action:"UpdateStack",StackName:E.stackName,Version:"2010-05-15"};if(E.templateBody)r.TemplateBody=E.templateBody;else if(E.templateUrl)r.TemplateURL=E.templateUrl;if(E.parameters)E.parameters.forEach((T,_)=>{if(r[`Parameters.member.${_+1}.ParameterKey`]=T.ParameterKey,T.UsePreviousValue)r[`Parameters.member.${_+1}.UsePreviousValue`]="true";else r[`Parameters.member.${_+1}.ParameterValue`]=T.ParameterValue});if(E.capabilities)E.capabilities.forEach((T,_)=>{r[`Capabilities.member.${_+1}`]=T});if(E.roleArn)r.RoleARN=E.roleArn;if(E.tags)E.tags.forEach((T,_)=>{r[`Tags.member.${_+1}.Key`]=T.Key,r[`Tags.member.${_+1}.Value`]=T.Value});let t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{StackId:t.StackId||t.UpdateStackResult?.StackId}}async deleteStack(E,r,t){let T={Action:"DeleteStack",StackName:E,Version:"2010-05-15"};if(r)T.RoleARN=r;if(t&&t.length>0)t.forEach((_,d)=>{T[`RetainResources.member.${d+1}`]=_});await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(T).toString()})}async describeStacks(E={}){let r={Action:"DescribeStacks",Version:"2010-05-15"};if(E.stackName)r.StackName=E.stackName;let t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{Stacks:this.parseStacksResponse(t)}}async describeStackEvents(E){let r={Action:"DescribeStackEvents",StackName:E,Version:"2010-05-15"},t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{StackEvents:this.parseStackEvents(t)}}async listStackResources(E){let r={Action:"ListStackResources",StackName:E,Version:"2010-05-15"},T=(await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()}))?.ListStackResourcesResult?.StackResourceSummaries?.member,_=[];if(T)_=Array.isArray(T)?T:[T];return{StackResourceSummaries:_}}async waitForStack(E,r){let t={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},T=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],_=t[r],d=360,e=0;while(e<360)try{let h=await this.describeStacks({stackName:E});if(h.Stacks.length===0){if(r==="stack-delete-complete")return;if(e%10===0)console.log(`[waitForStack] Attempt ${e}: Stack not visible yet`);await new Promise((N)=>setTimeout(N,2000)),e++;continue}let R=h.Stacks[0];if(e%10===0)console.log(`[waitForStack] Attempt ${e}: Status = ${R.StackStatus}${R.StackStatusReason?` (${R.StackStatusReason})`:""}`);if(_.includes(R.StackStatus))return;if((r==="stack-create-complete"||r==="stack-update-complete")&&(R.StackStatus==="DELETE_IN_PROGRESS"||R.StackStatus==="DELETE_COMPLETE")){console.log("[waitForStack] Stack is being deleted (creation/update failed)");let N="";try{let S=await this.describeStackEvents(E);console.log("[waitForStack] Stack events (most recent first):");for(let L of S.StackEvents.slice(0,15))if(L.ResourceStatus.includes("FAILED")||L.ResourceStatusReason){if(console.log(`  ${L.LogicalResourceId}: ${L.ResourceStatus} - ${L.ResourceStatusReason||"No reason provided"}`),L.ResourceStatus.includes("FAILED")&&L.ResourceStatusReason&&!N)N=L.ResourceStatusReason}}catch{}let A=N||R.StackStatusReason||"Check CloudFormation console for details.";throw Error(`Stack creation/update failed - stack is being deleted. Reason: ${A}`)}if(R.StackStatus==="DELETE_FAILED"&&r==="stack-delete-complete"){let N=Error("Stack deletion failed - may have resources that need to be retained");throw N.code="DELETE_FAILED",N.stackStatus=R.StackStatus,N.statusReason=R.StackStatusReason,N}if(T.includes(R.StackStatus))throw Error(`Stack reached failure status: ${R.StackStatus}`);await new Promise((N)=>setTimeout(N,5000)),e++}catch(h){if(r==="stack-delete-complete"&&h.message?.includes("does not exist"))return;if(r==="stack-create-complete"&&h.message?.includes("does not exist")){if(e%10===0)console.log(`[waitForStack] Attempt ${e}: Stack does not exist (error), retrying...`);await new Promise((R)=>setTimeout(R,2000)),e++;continue}throw console.log(`[waitForStack] Unexpected error: ${h.message}`),h}throw console.log(`[waitForStack] Timeout after ${e} attempts`),Error(`Timeout waiting for stack to reach ${r}`)}async validateTemplate(E){let r={Action:"ValidateTemplate",TemplateBody:E,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()})}async listStacks(E){let r={Action:"ListStacks",Version:"2010-05-15"};if(E)E.forEach((h,R)=>{r[`StackStatusFilter.member.${R+1}`]=h});let t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()}),T=t.ListStacksResponse||t,_=T.ListStacksResult||T,d=_.StackSummaries?.member||_.StackSummaries||[];return{StackSummaries:(Array.isArray(d)?d:d?[d]:[]).map((h)=>({StackId:h.StackId||"",StackName:h.StackName||"",TemplateDescription:h.TemplateDescription,CreationTime:h.CreationTime||"",LastUpdatedTime:h.LastUpdatedTime,DeletionTime:h.DeletionTime,StackStatus:h.StackStatus||""}))}}async createChangeSet(E){let r={Action:"CreateChangeSet",StackName:E.stackName,ChangeSetName:E.changeSetName,Version:"2010-05-15"};if(E.templateBody)r.TemplateBody=E.templateBody;else if(E.templateUrl)r.TemplateURL=E.templateUrl;if(E.parameters)E.parameters.forEach((T,_)=>{r[`Parameters.member.${_+1}.ParameterKey`]=T.ParameterKey,r[`Parameters.member.${_+1}.ParameterValue`]=T.ParameterValue});if(E.capabilities)E.capabilities.forEach((T,_)=>{r[`Capabilities.member.${_+1}`]=T});if(E.changeSetType)r.ChangeSetType=E.changeSetType;let t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{Id:t.Id,StackId:t.StackId}}async describeChangeSet(E,r){let t={Action:"DescribeChangeSet",StackName:E,ChangeSetName:r,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()})}async executeChangeSet(E,r){let t={Action:"ExecuteChangeSet",StackName:E,ChangeSetName:r,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()})}async deleteChangeSet(E,r){let t={Action:"DeleteChangeSet",StackName:E,ChangeSetName:r,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()})}async getStackOutputs(E){let r=await this.describeStacks({stackName:E});if(!r.Stacks||r.Stacks.length===0)throw Error(`Stack ${E} not found`);let t=r.Stacks[0],T={};if(t.Outputs)for(let _ of t.Outputs)T[_.OutputKey]=_.OutputValue;return T}async getTemplate(E){let r={Action:"GetTemplate",StackName:E,Version:"2010-05-15"},t=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{TemplateBody:t?.GetTemplateResult?.TemplateBody||t?.TemplateBody||""}}parseStacksResponse(E){let r=[],t=E?.DescribeStacksResult?.Stacks?.member||E?.Stacks?.member||E?.Stacks||E;if(t&&!Array.isArray(t))t=[t];if(Array.isArray(t)){for(let T of t)if(T.StackId||T.StackName){let _;if(T.Outputs?.member)_=(Array.isArray(T.Outputs.member)?T.Outputs.member:[T.Outputs.member]).map((e)=>({OutputKey:e.OutputKey,OutputValue:e.OutputValue,Description:e.Description,ExportName:e.ExportName}));r.push({StackId:T.StackId,StackName:T.StackName,StackStatus:T.StackStatus,CreationTime:T.CreationTime,LastUpdatedTime:T.LastUpdatedTime,StackStatusReason:T.StackStatusReason,Outputs:_})}}else if(E.StackId)r.push({StackId:E.StackId,StackName:E.StackName,StackStatus:E.StackStatus,CreationTime:E.CreationTime,LastUpdatedTime:E.LastUpdatedTime});return r}parseStackEvents(E){let r=[],t=E?.DescribeStackEventsResult?.StackEvents?.member||E?.StackEvents?.member||E?.StackEvents||[];if(t&&!Array.isArray(t))t=[t];for(let T of t)if(T.LogicalResourceId)r.push({Timestamp:T.Timestamp,ResourceType:T.ResourceType,LogicalResourceId:T.LogicalResourceId,ResourceStatus:T.ResourceStatus,ResourceStatusReason:T.ResourceStatusReason});return r}async waitForStackWithProgress(E,r,t){let T={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},_=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],d=T[r],e=360,h=0,R=new Set;while(h<360)try{if(t)try{let L=[...(await this.describeStackEvents(E)).StackEvents||[]].reverse();for(let O of L){let I=`${O.LogicalResourceId}-${O.ResourceStatus}-${O.Timestamp}`;if(!R.has(I))R.add(I),t({resourceId:O.LogicalResourceId,resourceType:O.ResourceType,status:O.ResourceStatus,reason:O.ResourceStatusReason,timestamp:O.Timestamp})}}catch{}let N=await this.describeStacks({stackName:E});if(N.Stacks.length===0){if(r==="stack-delete-complete")return;await new Promise((S)=>setTimeout(S,2000)),h++;continue}let A=N.Stacks[0];if(d.includes(A.StackStatus))return;if(A.StackStatus==="DELETE_FAILED"&&r==="stack-delete-complete"){let S=Error("Stack deletion failed - may have resources that need to be retained");throw S.code="DELETE_FAILED",S.stackStatus=A.StackStatus,S.statusReason=A.StackStatusReason,S}if(_.includes(A.StackStatus))throw Error(`Stack reached failure status: ${A.StackStatus}`);await new Promise((S)=>setTimeout(S,3000)),h++}catch(N){if(r==="stack-delete-complete"&&N.message?.includes("does not exist"))return;if(r==="stack-create-complete"&&N.message?.includes("does not exist")){await new Promise((A)=>setTimeout(A,2000)),h++;continue}throw N}throw Error(`Timeout waiting for stack to reach ${r}`)}async waitForStackComplete(E,r=120,t=5000){let T=["CREATE_COMPLETE","UPDATE_COMPLETE","DELETE_COMPLETE"],_=["CREATE_FAILED","UPDATE_FAILED","DELETE_FAILED","ROLLBACK_COMPLETE","ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED"];for(let d=0;d<r;d++)try{let e=await this.describeStacks({stackName:E});if(e.Stacks.length===0)return{success:!0,status:"DELETE_COMPLETE"};let h=e.Stacks[0],R=h.StackStatus;if(T.includes(R))return{success:!0,status:R};if(_.includes(R))return{success:!1,status:R,reason:h.StackStatusReason};await new Promise((N)=>setTimeout(N,t))}catch(e){if(e.message?.includes("does not exist"))return{success:!0,status:"DELETE_COMPLETE"};throw e}return{success:!1,status:"TIMEOUT",reason:"Timeout waiting for stack operation"}}}var Bt=$E(()=>{GE()});var US={};Qr(US,{xrayManager:()=>zg,withTimeout:()=>xK,withSecurity:()=>EK,withQueue:()=>_K,withMonitoring:()=>oP,withDatabase:()=>rK,withCache:()=>tK,withCDN:()=>TK,validateTemplateSize:()=>y7,validateTemplate:()=>O7,validateResourceLimits:()=>j7,validateCredentials:()=>wK,validateConfiguration:()=>DK,validateCommand:()=>BZ,validateAgainstSchema:()=>sK,validateAccountStructure:()=>oZ,templateCache:()=>BK,syntheticsManager:()=>Hg,suggestRegions:()=>xZ,suggestRegionPairs:()=>bZ,suggestQuotaIncrease:()=>jK,suggestIAMPolicy:()=>XK,suggestFlags:()=>jZ,suggestCommand:()=>Tw,storageAdvancedManager:()=>tx,staticSiteManager:()=>rx,stackDependencyManager:()=>MZ,signRequestAsync:()=>ZO,signRequest:()=>Wt,sharedRuntimeLoop:()=>c1,sha256:()=>aO,serviceMeshManager:()=>xg,sequence:()=>qK,senderReputationManager:()=>og,securityScanningManager:()=>Kg,securityHubManager:()=>Xg,secretsRotationManager:()=>Mg,secretsManager:()=>Vg,searchCommands:()=>JZ,sanitizeName:()=>B7,runPhpBuildHooks:()=>oO,runBuildHooks:()=>sB,route53RoutingManager:()=>ig,route53ResolverManager:()=>mg,responseToResult:()=>NW,resourceManagementManager:()=>dx,resolveStorageBucketName:()=>W7,resolveSiteStackName:()=>Y$,resolveSiteResourceName:()=>Q$,resolveSiteBucketName:()=>G$,resolveServerlessRuntime:()=>mO,resolveServerlessAssetBucketName:()=>bO,resolveServerlessArtifactBucketName:()=>M$,resolveServerlessAppStackName:()=>$d,resolveRegion:()=>CB,resolveQueues:()=>Dh,resolveQueueNames:()=>A1,resolveProjectStackName:()=>Vr,resolveManagementDashboardSites:()=>OS,resolveManagementDashboardSite:()=>mP,resolveDeploymentMode:()=>tT,resolveDeployBucketName:()=>sz,resolveDashboardDomains:()=>SB,resolveDashboardDomain:()=>AB,resolveCredentials:()=>vO,resolveCloudProvider:()=>Ht,resolveAppDatabase:()=>br,resolveApp:()=>Hq,requiresReplacement:()=>nK,replicaManager:()=>Yg,regionPairManager:()=>GZ,quickHash:()=>VK,queueManagementManager:()=>dq,progressiveDeploymentManager:()=>Fg,processInChunks:()=>bK,previewNotifications:()=>hZ,previewManager:()=>TZ,phpRuntimeLayerAssets:()=>NS,phpLayerPackages:()=>EW,phpLayerBuildStage:()=>L1,performanceManager:()=>Qg,parseXMLResponse:()=>tS,parseJSONResponse:()=>kz,parallelWithRetry:()=>gK,parallelMap:()=>ZK,parallel:()=>lO,packageServerlessApp:()=>IS,packagePhpApp:()=>D1,organizationManager:()=>iZ,networkSecurityManager:()=>_x,multiRegionManager:()=>fZ,multiAccountManager:()=>lZ,migrationManager:()=>fg,metricsManager:()=>Bg,mergeInfrastructure:()=>Uh,managementDashboardSiteName:()=>F$,makeAWSRequestOnce:()=>xz,makeAWSRequestAsync:()=>bz,makeAWSRequest:()=>Lh,logsManager:()=>Wg,laravelServerlessEnvDefaults:()=>I1,lambdaVersionsManager:()=>kg,lambdaVPCManager:()=>vg,lambdaLayersManager:()=>bg,lambdaDestinationsManager:()=>ng,lambdaDLQManager:()=>lg,lambdaConcurrencyManager:()=>ug,isWebCryptoAvailable:()=>lz,isValidRegion:()=>gZ,isNodeCryptoAvailable:()=>vz,isManagementDashboardSiteName:()=>nO,isLocalDevelopment:()=>pK,isLikelyTypo:()=>CZ,imageScanningManager:()=>Zg,healthCheckManager:()=>Tx,hashString:()=>m$,hashManifest:()=>MK,hashFile:()=>a$,hashDirectory:()=>GK,hashBuffer:()=>QK,hasManagementDashboardSite:()=>Ih,guardDutyManager:()=>Cg,globalResourceManager:()=>QZ,getTimestamp:()=>z7,getSigningKeyCacheSize:()=>nz,getRequiredPermissions:()=>WB,getRegionsByPricingTier:()=>ZZ,getRegionsByLocation:()=>PZ,getRegionsByCompliance:()=>KZ,getRegionStats:()=>vZ,getRegion:()=>aR,getRecommendedStructure:()=>sZ,getQuotaUsageSummary:()=>yK,getLocalEnvVars:()=>rZ,getLocalEndpoint:()=>oK,getLocalCredentials:()=>EZ,getLocalConfig:()=>iO,getErrorDetails:()=>BB,getDiffSummary:()=>uK,getDiffStats:()=>aK,getDeploymentStrategy:()=>iK,getCredentials:()=>cS,getContextualHelp:()=>XZ,getCommandUsage:()=>zZ,getClosestRegion:()=>qZ,getAllRegions:()=>VZ,getAccountId:()=>XB,generateScheduledWorkflow:()=>_g,generateScheduledPipeline:()=>Ng,generateScheduledConfig:()=>Og,generateResourceName:()=>eE,generatePreviewWorkflow:()=>_Z,generatePreviewPipeline:()=>Rg,generatePhpLayerDockerfile:()=>rW,generatePhpFpmConfig:()=>OW,generateParallelConfig:()=>Ig,generatePRPreviewWorkflow:()=>Tg,generateMultiEnvWorkflow:()=>tg,generateMultiEnvPipeline:()=>hg,generateMultiEnvConfig:()=>Lg,generateMatrixWorkflow:()=>dg,generateManualPipeline:()=>Ag,generateLogicalId:()=>i,generateDeploymentWorkflow:()=>rg,generateDeploymentPipeline:()=>eg,generateDeploymentConfig:()=>Sg,generateCrossAccountRoleCF:()=>pZ,generateCostReportWorkflow:()=>eZ,generateCleanupWorkflow:()=>dZ,generateBootstrap:()=>mB,generateApprovalConfig:()=>cg,generateAppImageDockerfile:()=>O1,fromWebIdentity:()=>wB,fromSharedCredentials:()=>UB,fromEnvironment:()=>IB,fromECSMetadata:()=>$B,fromEC2Metadata:()=>DB,formatTree:()=>SZ,formatTable:()=>RZ,formatSuggestion:()=>wZ,formatRegionList:()=>nZ,formatRegion:()=>kB,formatProgressBar:()=>LZ,formatList:()=>IZ,formatKeyValue:()=>UZ,formatHistoryStats:()=>HZ,formatHistory:()=>WZ,formatFlagSuggestions:()=>FZ,formatDuration:()=>cZ,formatDiff:()=>Q7,formatBytes:()=>OZ,formatAccountStructure:()=>Eg,findChangedFiles:()=>PK,fifoQueueManager:()=>tq,extendPreset:()=>z$,eventToRequest:()=>RW,emailTemplateManager:()=>Eq,emailAnalyticsManager:()=>pg,drManager:()=>Dg,dnssecManager:()=>ag,dlqMonitoringManager:()=>Tq,diffTemplates:()=>kK,detectServiceRegion:()=>KO,detectMisconfigurations:()=>$K,detectDeploymentTargets:()=>f$,deriveManagementDashboardPort:()=>hB,deploymentCoexistenceError:()=>pR,defaultLocalConfig:()=>s$,databaseUserManager:()=>Gg,crossRegionReferenceManager:()=>YZ,createZip:()=>oR,createWordPressPreset:()=>ZP,createTraditionalWebAppPreset:()=>uP,createStaticSitePreset:()=>QP,createServerlessNodePreset:()=>VP,createServerlessLaravelPreset:()=>vP,createS3Client:()=>UK,createRealtimeAppPreset:()=>xP,createQueueHandler:()=>SW,createPresignedUrlAsync:()=>Mz,createPresignedUrl:()=>H$,createPreset:()=>pP,createNodeJsServerlessPreset:()=>MP,createNodeJsServerPreset:()=>GP,createMockAWS:()=>tZ,createMicroservicesPreset:()=>qP,createMLApiPreset:()=>kP,createLaravelPreset:()=>nP,createJamstackPreset:()=>gP,createHttpHandler:()=>AW,createHandlers:()=>Mq,createFullStackAppPreset:()=>PP,createExistingStaticFullStackPreset:()=>q$,createError:()=>W$,createDataPipelinePreset:()=>bP,createDashboardSite:()=>lP,createCredentialProvider:()=>eK,createCliHandler:()=>LW,createApiBackendPreset:()=>KP,containerRegistryManager:()=>qg,composeServerlessAppTemplate:()=>S1,composePresets:()=>sP,collectPhpAppEntries:()=>Ec,cloudTrailManager:()=>wg,cloudConfigSchema:()=>mK,clearSigningKeyCache:()=>uz,chunk:()=>GB,checkServiceQuotas:()=>JK,checkIAMPermissions:()=>CK,certificateManager:()=>Pg,categorizeChanges:()=>lK,canaryManager:()=>yg,buildPhpRuntimeLayerZip:()=>iq,buildOptimizationManager:()=>gg,buildNodeRuntimeLayerZip:()=>zq,buildCloudFormationTemplate:()=>g$,buildBunRuntimeLayerZip:()=>Bq,bounceComplaintHandler:()=>sg,blueGreenManager:()=>Jg,batchProcessingManager:()=>_q,batch:()=>KK,backupManager:()=>Ug,awsConfigManager:()=>$g,autocomplete:()=>yZ,artifactKey:()=>N1,analyzeStackDiff:()=>H7,abTestManager:()=>jg,XRayManager:()=>ww,Workflow:()=>tB,ValidationError:()=>n$,TemplateCache:()=>l$,TemplateBuilder:()=>xO,TaskList:()=>ZB,SyntheticsManager:()=>Sh,StorageAdvancedManager:()=>w1,Storage:()=>h_,StaticSiteManager:()=>$1,StacksIntegration:()=>K7,StackDependencyManager:()=>Rw,Spinner:()=>KB,SmsHandlers:()=>rB,SmsAdvanced:()=>aB,Sftp:()=>kO,ServiceMeshManager:()=>Gw,SenderReputationManager:()=>nw,SecurityScanningManager:()=>Hw,SecurityHubManager:()=>Ah,Security:()=>qr,SecretsRotationManager:()=>zw,SecretsManager:()=>Bw,Secrets:()=>iR,Search:()=>$e,SMS:()=>mt,S3Error:()=>ET,S3Client:()=>u$,Route53RoutingManager:()=>qw,Route53ResolverManager:()=>bw,ResourceManagementManager:()=>J1,ReplicaManager:()=>yw,Registry:()=>G_,RegionPairManager:()=>hw,Redirects:()=>Dd,RealtimePresets:()=>L7,RateLimiter:()=>QB,REPLContext:()=>qB,REPLCommandBuilder:()=>xB,REPL:()=>gB,RECOMMENDED_SCPS:()=>aZ,RECOMMENDED_ACCOUNT_STRUCTURES:()=>uB,QueuePresets:()=>S7,QueueManagementManager:()=>R1,Queue:()=>rT,Pseudo:()=>F7,ProgressiveDeploymentManager:()=>$w,ProgressBar:()=>VB,PreviewNotificationService:()=>tw,PreviewEnvironmentManager:()=>rw,PhoneHandlers:()=>EB,PhoneAdvanced:()=>iB,Phone:()=>M_,Permissions:()=>wT,PerformanceManager:()=>jw,ParameterStore:()=>ar,PHP_LAYER_EXTENSIONS:()=>oB,PHP_DEFAULT_EXCLUDES:()=>CW,OrganizationManager:()=>Aw,NetworkSecurityManager:()=>X1,Network:()=>Hr,MultiStepProgress:()=>PB,MultiRegionManager:()=>_w,MultiAccountManager:()=>Nw,Monitoring:()=>LS,MockS3:()=>o$,MockDynamoDB:()=>Ew,MockCloudFormation:()=>p$,MigrationManager:()=>Jw,MetricsManager:()=>Cw,Messaging:()=>$T,MANAGEMENT_DASHBOARD_SITE_PREFIX:()=>x$,MANAGED_NODE_VERSIONS:()=>pB,LogsManager:()=>Xw,LambdaVersionsManager:()=>Vw,LambdaVPCManager:()=>Zw,LambdaLayersManager:()=>Mw,LambdaDestinationsManager:()=>Kw,LambdaDLQManager:()=>gw,LambdaConcurrencyManager:()=>Pw,LARAVEL_SERVERLESS_BUILD_STEPS:()=>IW,JobLoader:()=>Ud,ImageScanningManager:()=>fw,HealthCheckManager:()=>C1,HashCache:()=>fB,GuardDutyManager:()=>Iw,GlobalResourceManager:()=>ew,Fn:()=>z,FileSystem:()=>V_,FileCache:()=>v$,FIFOQueueManager:()=>d1,ErrorCodes:()=>zB,EmailTemplateManager:()=>vw,EmailHandlers:()=>vB,EmailAnalyticsManager:()=>uw,EmailAdvanced:()=>nB,Email:()=>Ir,DisasterRecoveryManager:()=>Lw,DeploymentError:()=>jB,Deployment:()=>pt,DependencyGraph:()=>pz,DebugLogger:()=>CT,DatabaseUserManager:()=>Fw,Database:()=>Ce,DNSSECManager:()=>xw,DNS:()=>at,DLQMonitoringManager:()=>e1,DEFAULT_SERVICE_LIMITS:()=>it,DASHBOARD_STATE_DIR:()=>TB,DASHBOARD_PORT_SPAN:()=>eB,DASHBOARD_PORT_BASE:()=>dB,DASHBOARD_ENTRY:()=>_B,CrossRegionReferenceManager:()=>dw,CredentialError:()=>Ue,ContainerRegistryManager:()=>Qw,ConfigurationError:()=>_S,Compute:()=>PE,Communication:()=>ot,CommandHistory:()=>bB,CloudTrailManager:()=>cw,CloudFrontClient:()=>yB,CloudFormationClient:()=>JB,CloudFormationBuilder:()=>Z$,CloudError:()=>P_,CertificateManager:()=>Ww,CanaryManager:()=>RS,Cache:()=>SS,COMMON_CROSS_ACCOUNT_ROLES:()=>mZ,CDN:()=>e_,BuildOptimizationManager:()=>Yw,BounceComplaintHandler:()=>kw,BlueGreenManager:()=>Uw,BatchProcessingManager:()=>h1,BackupManager:()=>Sw,Auth:()=>st,AssetHasher:()=>wt,Arn:()=>eS,ApiGateway:()=>uO,AWS_REGIONS:()=>N_,AWS_PSEUDO_PARAMETERS:()=>l7,AWSConfigManager:()=>Ow,AWSAPIError:()=>FB,AI:()=>R_,ABTestManager:()=>Dw});import{createRequire as T7}from"node:module";import{existsSync as mA,readdirSync as G7}from"node:fs";import{join as Ie}from"node:path";import{createHash as b7}from"node:crypto";import{copyFileSync as k7,existsSync as w$,readdirSync as u7,readFileSync as WO,statSync as n7,writeFileSync as HO}from"node:fs";import{basename as v7,dirname as jz,extname as Fz,join as sA}from"node:path";import{existsSync as LB,readFileSync as k$}from"node:fs";import{homedir as OB}from"node:os";import{join as cB}from"node:path";import{createHash as HB}from"node:crypto";import{existsSync as Hz,mkdirSync as FK,readdirSync as fz,readFileSync as Yz,unlinkSync as pA,writeFileSync as zK}from"node:fs";import{join as X$}from"node:path";import{createHash as i$}from"node:crypto";import{createReadStream as WK,readdirSync as HK,statSync as VO}from"node:fs";import{join as fK,relative as YK}from"node:path";import{deflateRawSync as eq}from"node:zlib";import{execSync as Sq}from"node:child_process";import{createHash as Lq}from"node:crypto";import{cpSync as Oq,mkdtempSync as cq,rmSync as Iq,writeFileSync as Uq}from"node:fs";import{tmpdir as Dq}from"node:os";import{dirname as $q,isAbsolute as wq,join as ES,resolve as Cq}from"node:path";import{fileURLToPath as Xq}from"node:url";import{execFileSync as sO}from"node:child_process";import{mkdtempSync as tW,readFileSync as pO,rmSync as TW}from"node:fs";import{tmpdir as _W}from"node:os";import{dirname as jq,join as we}from"node:path";import{fileURLToPath as Fq}from"node:url";import{readFileSync as Vq}from"node:fs";import{dirname as Pq,join as cW}from"node:path";import{fileURLToPath as Kq}from"node:url";import{execFileSync as YO}from"node:child_process";import{existsSync as gq,mkdirSync as qq,mkdtempSync as xq,readdirSync as bq,readFileSync as kq,rmSync as uq,statSync as UW,writeFileSync as nq}from"node:fs";import{tmpdir as vq}from"node:os";import{join as lR,relative as lq}from"node:path";import{execSync as aq}from"node:child_process";import{createHash as mq}from"node:crypto";import{readdirSync as sq,readFileSync as pq,statSync as $W}from"node:fs";import{join as oq,relative as wW,resolve as U1}from"node:path";function e7(E,r){this[E]=d7.bind(null,r)}function KO(E){let r=typeof E==="string"?new URL(E):E,{hostname:t,pathname:T}=r;if(t.endsWith(".on.aws")){let h=t.match(/^[^.]+\.lambda-url\.([^.]+)\.on\.aws$/);if(h)return{service:"lambda",region:h[1]};return{service:"",region:""}}if(t.endsWith(".r2.cloudflarestorage.com"))return{service:"s3",region:"auto"};if(t.endsWith(".backblazeb2.com")){let h=t.match(/^(?:[^.]+\.)?s3\.([^.]+)\.backblazeb2\.com$/);if(h)return{service:"s3",region:h[1]};return{service:"",region:""}}let _=t.replace("dualstack.","").match(/([^.]+)\.(?:([^.]+)\.)?amazonaws\.com(?:\.cn)?$/);if(!_)return{service:"",region:""};let d=_[1],e=_[2]||"";if(e==="us-gov")e="us-gov-west-1";else if(e==="s3"||e==="s3-accelerate")e="us-east-1",d="s3";else if(d==="iot")if(t.startsWith("iot."))d="execute-api";else if(t.startsWith("data.jobs.iot."))d="iot-jobs-data";else d=T==="/mqtt"?"iotdevicegateway":"iotdata";else if(d==="autoscaling");else if(!e&&d.startsWith("s3-"))e=d.slice(3).replace(/^fips-|^external-1/,""),d="s3";else if(d.endsWith("-fips"))d=d.slice(0,-5);else if(e&&/-\d$/.test(d)&&!/-\d$/.test(e))[d,e]=[e,d];return d=az[d]||d,{service:d,region:e||"us-east-1"}}function Wt(E){let{method:r,url:t,body:T="",accessKeyId:_,secretAccessKey:d,sessionToken:e,signQuery:h=!1,expiresIn:R=86400,datetime:N}=E,A=new URL(t),S=A.hostname,L=KO(A),O=E.service||L.service,I=E.region||L.region;if(!O)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!I)throw Error("Could not detect region from URL. Please provide region explicitly.");let D=N||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),$=D.substring(0,8),C=[$,I,O,"aws4_request"].join("/"),y="AWS4-HMAC-SHA256";if(h)return N7({urlObj:A,method:r,body:T,accessKeyId:_,secretAccessKey:d,sessionToken:e,service:O,region:I,timestamp:D,date:$,credentialScope:C,algorithm:y,expiresIn:R,cache:E.cache});let j=A.pathname||"/",B=gO(A.searchParams),f={host:S,"x-amz-date":D,...E.headers};if(e)f["x-amz-security-token"]=e;let Q=Object.keys(f).some((W)=>W.toLowerCase()==="content-type");if(T&&!Q)f["content-type"]="application/x-amz-json-1.0";if(O==="s3"&&!f["x-amz-content-sha256"])f["x-amz-content-sha256"]=rS(T);let V=Vz(f),g=Pz(f),x=f["x-amz-content-sha256"]||rS(T),u=[r,qO(j),B,V,g,x].join(`
 `),l=rS(u),n=[y,D,C,l].join(`
 `),a=E.cache??ch,o=Zz(d,$,I,O,n,a),s=[`${y} Credential=${_}/${C}`,`SignedHeaders=${g}`,`Signature=${o}`].join(", ");return f.authorization=s,{url:t,method:r,headers:f,body:T||void 0}}async function ZO(E){let{method:r,url:t,body:T="",accessKeyId:_,secretAccessKey:d,sessionToken:e,signQuery:h=!1,expiresIn:R=86400,datetime:N}=E,A=new URL(t),S=A.hostname,L=KO(A),O=E.service||L.service,I=E.region||L.region;if(!O)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!I)throw Error("Could not detect region from URL. Please provide region explicitly.");let D=N||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),$=D.substring(0,8),C=[$,I,O,"aws4_request"].join("/"),y="AWS4-HMAC-SHA256";if(h)return A7({urlObj:A,method:r,body:T,accessKeyId:_,secretAccessKey:d,sessionToken:e,service:O,region:I,timestamp:D,date:$,credentialScope:C,algorithm:y,expiresIn:R,cache:E.cache});let j=A.pathname||"/",B=gO(A.searchParams),f={host:S,"x-amz-date":D,...E.headers};if(e)f["x-amz-security-token"]=e;let Q=Object.keys(f).some((q)=>q.toLowerCase()==="content-type");if(T&&!Q)f["content-type"]="application/x-amz-json-1.0";let V=await QO(T);if(O==="s3"&&!f["x-amz-content-sha256"])f["x-amz-content-sha256"]=V;let g=Vz(f),x=Pz(f),u=f["x-amz-content-sha256"]||V,l=[r,qO(j),B,g,x,u].join(`
 `),n=await QO(l),a=[y,D,C,n].join(`
@@ -8922,7 +8922,7 @@ Run \`${this.name??"cli"} --help\` for usage.`;pd.stderr.write(`${d}${_}${e}
 `).length-1;this.output.write(rd.move(-999,E*-1))}render(){let E=cy(this._render(this)??"",Oy.stdout.columns,{hard:!0,trim:!1});if(E===this._prevFrame)return;if(this.state==="initial")this.output.write(rd.hide);else{let r=C9(this._prevFrame,E);if(this.restoreCursor(),r&&r?.length===1){let t=r[0];this.output.write(rd.move(0,t)),this.output.write(OU.lines(1));let T=E.split(`
 `);this.output.write(T[t]),this._prevFrame=E,this.output.write(rd.move(0,T.length-t-1));return}if(r&&r?.length>1){let t=r[0];this.output.write(rd.move(0,t)),this.output.write(OU.down());let _=E.split(`
 `).slice(t);this.output.write(_.join(`
-`)),this._prevFrame=E;return}this.output.write(OU.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function z9(E,r){if(E===void 0)return 0;if(r.length===0)return 0;let T=r.findIndex((_)=>_.value===E);return T!==-1?T:0}function B9(E,r){return(r.label??String(r.value)).toLowerCase().includes(E.toLowerCase())}function W9(E,r){if(!r)return;if(E)return r;return r[0]}class H9 extends wU{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#t="";#T;#r;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return N0.inverse(N0.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[r,...t]=this.userInput.slice(this._cursor);return`${E}${N0.inverse(r)}${t.join("")}`}get options(){if(typeof this.#r==="function")return this.#r();return this.#r}constructor(E){super(E);this.#r=E.options;let r=this.options;this.filteredOptions=[...r],this.multiple=E.multiple===!0,this.#T=E.filter??B9;let t;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)t=E.initialValue;else t=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)t=[this.options[0].value];if(t)for(let T of t){let _=r.findIndex((d)=>d.value===T);if(_!==-1)this.toggleSelected(T),this.#E=_}this.focusedValue=this.options[this.#E]?.value,this.on("key",(T,_)=>this.#_(T,_)),this.on("userInput",(T)=>this.#d(T))}_isActionKey(E,r){return E==="\t"||this.multiple&&this.isNavigating&&r.name==="space"&&E!==void 0&&E!==""}#_(E,r){let t=r.name==="up",T=r.name==="down",_=r.name==="return";if(t||T){if(this.#E=Math.max(0,Math.min(this.#E+(t?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(_)this.value=W9(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(r.name==="tab"||this.isNavigating&&r.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((r)=>r!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#d(E){if(E!==this.#t){this.#t=E;let r=this.options;if(E)this.filteredOptions=r.filter((t)=>this.#T(E,t));else this.filteredOptions=[...r];if(this.#E=z9(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class f9 extends wU{options;cursor=0;#E;getGroupItems(E){return this.options.filter((r)=>r.group===E)}isGroupSelected(E){let r=this.getGroupItems(E),t=this.value;if(t===void 0)return!1;return r.every((T)=>t.includes(T.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let r=String(E.value),t=this.getGroupItems(r);if(this.isGroupSelected(r))this.value=this.value.filter((T)=>t.findIndex((_)=>_.value===T)===-1);else this.value=[...this.value,...t.map((T)=>T.value)];this.value=Array.from(new Set(this.value))}else{let r=this.value.includes(E.value);this.value=r?this.value.filter((t)=>t!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:r}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(r).flatMap(([t,T])=>[{value:t,group:!0,label:t},...T.map((_)=>({..._,group:t}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:t})=>t===E.cursorAt),this.#E?0:1),this.on("cursor",(t)=>{switch(t){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let T=this.options[this.cursor]?.group===!0;if(!this.#E&&T)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let T=this.options[this.cursor]?.group===!0;if(!this.#E&&T)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var Y9=gG();var jr=(E,r)=>Y9?E:r,Bm=jr("◆","*"),Wm=jr("■","x"),Hm=jr("▲","x"),fm=jr("◇","o"),Ym=jr("┌","T"),Q9=jr("│","|"),Qm=jr("└","—"),Gm=jr("●",">"),Mm=jr("○"," "),Vm=jr("◻","[•]"),Pm=jr("◼","[+]"),Km=jr("◻","[ ]"),Zm=jr("▪","•"),gm=jr("─","-"),qm=jr("╮","+"),xm=jr("├","+"),bm=jr("╯","+"),km=jr("●","•"),um=jr("◆","*"),nm=jr("▲","!"),vm=jr("■","x");var lm={light:jr("─","-"),heavy:jr("━","="),block:jr("█","#")};function G9(){return`${N0.gray(Q9)}  `}var im=G9();var CU="0.7.57";QE();import{existsSync as HU}from"node:fs";import{mkdir as u9,writeFile as Qy}from"node:fs/promises";function fU(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(r)=>{if(b("Initializing ts-cloud Project"),HU("cloud.config.ts")){if(!await OE("cloud.config.ts already exists. Overwrite?",!1)){c("Initialization cancelled");return}}let t=r?.name||await Ar("Project name","my-app"),T=r?.mode||await L0("Select deployment mode",["serverless","server"]),_=r?.region||await L0("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),d=new v("Creating configuration file...");d.start();let e=`import { defineConfig } from '@ts-cloud/core'
+`)),this._prevFrame=E;return}this.output.write(OU.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function z9(E,r){if(E===void 0)return 0;if(r.length===0)return 0;let T=r.findIndex((_)=>_.value===E);return T!==-1?T:0}function B9(E,r){return(r.label??String(r.value)).toLowerCase().includes(E.toLowerCase())}function W9(E,r){if(!r)return;if(E)return r;return r[0]}class H9 extends wU{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#t="";#T;#r;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return N0.inverse(N0.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[r,...t]=this.userInput.slice(this._cursor);return`${E}${N0.inverse(r)}${t.join("")}`}get options(){if(typeof this.#r==="function")return this.#r();return this.#r}constructor(E){super(E);this.#r=E.options;let r=this.options;this.filteredOptions=[...r],this.multiple=E.multiple===!0,this.#T=E.filter??B9;let t;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)t=E.initialValue;else t=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)t=[this.options[0].value];if(t)for(let T of t){let _=r.findIndex((d)=>d.value===T);if(_!==-1)this.toggleSelected(T),this.#E=_}this.focusedValue=this.options[this.#E]?.value,this.on("key",(T,_)=>this.#_(T,_)),this.on("userInput",(T)=>this.#d(T))}_isActionKey(E,r){return E==="\t"||this.multiple&&this.isNavigating&&r.name==="space"&&E!==void 0&&E!==""}#_(E,r){let t=r.name==="up",T=r.name==="down",_=r.name==="return";if(t||T){if(this.#E=Math.max(0,Math.min(this.#E+(t?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(_)this.value=W9(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(r.name==="tab"||this.isNavigating&&r.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((r)=>r!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#d(E){if(E!==this.#t){this.#t=E;let r=this.options;if(E)this.filteredOptions=r.filter((t)=>this.#T(E,t));else this.filteredOptions=[...r];if(this.#E=z9(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class f9 extends wU{options;cursor=0;#E;getGroupItems(E){return this.options.filter((r)=>r.group===E)}isGroupSelected(E){let r=this.getGroupItems(E),t=this.value;if(t===void 0)return!1;return r.every((T)=>t.includes(T.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let r=String(E.value),t=this.getGroupItems(r);if(this.isGroupSelected(r))this.value=this.value.filter((T)=>t.findIndex((_)=>_.value===T)===-1);else this.value=[...this.value,...t.map((T)=>T.value)];this.value=Array.from(new Set(this.value))}else{let r=this.value.includes(E.value);this.value=r?this.value.filter((t)=>t!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:r}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(r).flatMap(([t,T])=>[{value:t,group:!0,label:t},...T.map((_)=>({..._,group:t}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:t})=>t===E.cursorAt),this.#E?0:1),this.on("cursor",(t)=>{switch(t){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let T=this.options[this.cursor]?.group===!0;if(!this.#E&&T)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let T=this.options[this.cursor]?.group===!0;if(!this.#E&&T)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var Y9=gG();var jr=(E,r)=>Y9?E:r,Bm=jr("◆","*"),Wm=jr("■","x"),Hm=jr("▲","x"),fm=jr("◇","o"),Ym=jr("┌","T"),Q9=jr("│","|"),Qm=jr("└","—"),Gm=jr("●",">"),Mm=jr("○"," "),Vm=jr("◻","[•]"),Pm=jr("◼","[+]"),Km=jr("◻","[ ]"),Zm=jr("▪","•"),gm=jr("─","-"),qm=jr("╮","+"),xm=jr("├","+"),bm=jr("╯","+"),km=jr("●","•"),um=jr("◆","*"),nm=jr("▲","!"),vm=jr("■","x");var lm={light:jr("─","-"),heavy:jr("━","="),block:jr("█","#")};function G9(){return`${N0.gray(Q9)}  `}var im=G9();var CU="0.7.58";QE();import{existsSync as HU}from"node:fs";import{mkdir as u9,writeFile as Qy}from"node:fs/promises";function fU(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(r)=>{if(b("Initializing ts-cloud Project"),HU("cloud.config.ts")){if(!await OE("cloud.config.ts already exists. Overwrite?",!1)){c("Initialization cancelled");return}}let t=r?.name||await Ar("Project name","my-app"),T=r?.mode||await L0("Select deployment mode",["serverless","server"]),_=r?.region||await L0("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),d=new v("Creating configuration file...");d.start();let e=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -8958,7 +8958,7 @@ cloudformation/
 Next steps:
   1. Edit cloud.config.ts to configure your infrastructure
   2. Run 'cloud generate' to create CloudFormation templates
-  3. Run 'cloud deploy' to deploy your infrastructure`,"green")}),E.command("init:server","Initialize server-based (EC2) project").action(async()=>{b("Initializing Server-Based Project"),await E.parse(["init","--mode","server"])}),E.command("init:serverless","Initialize serverless (Fargate/Lambda) project").action(async()=>{b("Initializing Serverless Project"),await E.parse(["init","--mode","serverless"])}),E.command("init:hybrid","Initialize hybrid project").action(async()=>{b("Initializing Hybrid Project"),await E.parse(["init","--mode","hybrid"])})}QE();import{readFile as Oz,writeFile as uV}from"node:fs/promises";import{resolve as FO}from"node:path";import{createCipheriv as l9,createDecipheriv as i9,createHash as gy,randomBytes as td}from"node:crypto";import{createHmac as n9,timingSafeEqual as v9}from"node:crypto";var YU="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function O0(E){let r=0,t=0,T="";for(let _ of E){t=t<<8|_,r+=8;while(r>=5)T+=YU[t>>>r-5&31],r-=5}if(r>0)T+=YU[t<<5-r&31];return T}function Gy(E){let r=E.toUpperCase().replace(/[^A-Z2-7]/g,""),t=0,T=0,_=[];for(let d of r){let e=YU.indexOf(d);if(e<0)throw Error("Invalid base32 secret");if(T=T<<5|e,t+=5,t>=8)_.push(T>>>t-8&255),t-=8}return Buffer.from(_)}function My(E,r,t=6){let T=Buffer.alloc(8);T.writeBigUInt64BE(BigInt(r));let _=n9("sha1",Gy(E)).update(T).digest(),d=_[_.length-1]&15,e=(_[d]&127)<<24|(_[d+1]&255)<<16|(_[d+2]&255)<<8|_[d+3]&255;return String(e%10**t).padStart(t,"0")}function c0(E,r,t=Date.now(),T=1){let _=r.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(_))return;let d=Buffer.from(_),e=Math.floor(t/1000/30);for(let h=-T;h<=T;h++){if(e+h<0)continue;let R=Buffer.from(My(E,e+h));if(d.length===R.length&&v9(d,R))return e+h}return}function QU(E){let r=E.issuer?.trim()||"ts-cloud",t=`${r}:${E.account}`;return`otpauth://totp/${encodeURIComponent(t)}?secret=${encodeURIComponent(E.secret)}&issuer=${encodeURIComponent(r)}&algorithm=SHA1&digits=6&period=30`}var qy=1800000,Te=43200000,xy=3600000,by=300000,ky=600000;function IT(E){return typeof E==="string"?E:void 0}function uy(E){if(typeof E!=="string")return{};try{return JSON.parse(E)}catch{return{}}}function a9(E){let r=E.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(r))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return r}function GU(E){if(E===void 0||!E.trim())return;let r=E.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(r)||r.length>254)throw Error("A valid email address is required");return r}function m9(E){let r=E.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(r))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return r}function s9(E){let r=new URL(E.trim());if(r.search||r.hash||r.username||r.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(r.protocol!=="https:"&&!(r.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(r.hostname)))throw Error("OIDC issuer must use HTTPS");return r.href.replace(/\/$/,"")}function p9(E){let r=[...new Set(E.map((t)=>t.trim().toLowerCase()).filter(Boolean))];if(r.length===0)throw Error("At least one explicit OIDC email domain is required");if(r.some((t)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(t)||!t.includes(".")||t.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return r}function o9(E){let r=[...new Set(["openid",...E??["email","profile"]].map((t)=>t.trim()).filter(Boolean))];if(r.some((t)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(t)))throw Error("OIDC scopes contain unsupported characters");return r}function E_(E){return gy("sha256").update(E).digest("hex")}function XA(E){return{id:String(E.id),actorId:String(E.actor_id),username:String(E.username),email:IT(E.email),emailVerifiedAt:IT(E.email_verified_at),passwordHash:String(E.password_hash),credentialVersion:Number(E.credential_version),requiresPasswordUpgrade:Number(E.requires_password_upgrade)===1,disabledAt:IT(E.disabled_at),lastLoginAt:IT(E.last_login_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Vy(E,r){let t=IT(E.consumed_at),T=String(E.expires_at);return{id:String(E.id),identityId:String(E.identity_id),type:String(E.type),metadata:uy(E.metadata),expiresAt:T,consumedAt:t,createdAt:String(E.created_at),state:t?"consumed":T<=r?"expired":"pending"}}function MU(E,r){let t=IT(E.revoked_at),T=String(E.idle_expires_at),_=String(E.absolute_expires_at);return{id:String(E.id),identityId:String(E.identity_id),credentialVersion:Number(E.credential_version),authMethod:String(E.auth_method),userAgent:IT(E.user_agent),networkHint:IT(E.network_hint),createdAt:String(E.created_at),lastUsedAt:String(E.last_used_at),idleExpiresAt:T,absoluteExpiresAt:_,recentAuthAt:String(E.recent_auth_at),mfaAt:IT(E.mfa_at),revokedAt:t,state:t?"revoked":T<=r||_<=r?"expired":"active"}}function Py(E){let r=IT(E.verified_at),t=IT(E.disabled_at);return{id:String(E.id),identityId:String(E.identity_id),type:"totp",label:String(E.label),createdAt:String(E.created_at),verifiedAt:r,disabledAt:t,state:t?"disabled":r?"active":"pending"}}function VU(E,r){let t=IT(E.consumed_at),T=String(E.expires_at),_=Number(E.attempts);return{id:String(E.id),identityId:String(E.identity_id),purpose:String(E.purpose),attempts:_,expiresAt:T,consumedAt:t,createdAt:String(E.created_at),state:t?"consumed":_>=5?"locked":T<=r?"expired":"pending"}}function Ky(E){let r=uy(E);return Array.isArray(r)?r.filter((t)=>typeof t==="string"):[]}function I0(E){return{id:String(E.id),organizationId:String(E.organization_id),slug:String(E.slug),name:String(E.name),issuer:String(E.issuer),clientId:String(E.client_id),hasClientSecret:typeof E.client_secret_ciphertext==="string"&&E.client_secret_ciphertext.length>0,scopes:Ky(E.scopes),allowedDomains:Ky(E.allowed_domains),defaultRole:String(E.default_role),enabled:Number(E.enabled)===1,enforceSso:Number(E.enforce_sso)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Zy(E,r){let t=IT(E.consumed_at),T=String(E.expires_at);return{id:String(E.id),providerId:String(E.provider_id),redirectUri:String(E.redirect_uri),returnPath:String(E.return_path),expiresAt:T,consumedAt:t,createdAt:String(E.created_at),state:t?"consumed":T<=r?"expired":"pending"}}function EM(E){return{id:String(E.id),providerId:String(E.provider_id),identityId:String(E.identity_id),subject:String(E.subject),email:String(E.email),linkedAt:String(E.linked_at),lastLoginAt:String(E.last_login_at)}}class r_{controlPlane;nowFn;idFn;encryptionKey;constructor(E,r={}){this.controlPlane=E;this.nowFn=r.now??(()=>new Date),this.idFn=r.id??(()=>crypto.randomUUID()),this.encryptionKey=r.encryptionKey?gy("sha256").update(r.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(E,r){this.controlPlane.database.run(E,r)}encrypt(E){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let r=td(12),t=l9("aes-256-gcm",this.encryptionKey,r),T=Buffer.concat([t.update(E,"utf8"),t.final()]);return`v1.${r.toString("base64url")}.${t.getAuthTag().toString("base64url")}.${T.toString("base64url")}`}decrypt(E){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[r,t,T,_]=E.split(".");if(r!=="v1"||!t||!T||!_)throw Error("Encrypted authentication value is unavailable");let d=i9("aes-256-gcm",this.encryptionKey,Buffer.from(t,"base64url"));return d.setAuthTag(Buffer.from(T,"base64url")),Buffer.concat([d.update(Buffer.from(_,"base64url")),d.final()]).toString("utf8")}createIdentity(E){if(!this.controlPlane.getActor(E.actorId))throw Error("Authentication actor was not found");let r=a9(E.username),t=GU(E.email),T=E.id??this.idFn(),_=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
+  3. Run 'cloud deploy' to deploy your infrastructure`,"green")}),E.command("init:server","Initialize server-based (EC2) project").action(async()=>{b("Initializing Server-Based Project"),await E.parse(["init","--mode","server"])}),E.command("init:serverless","Initialize serverless (Fargate/Lambda) project").action(async()=>{b("Initializing Serverless Project"),await E.parse(["init","--mode","serverless"])}),E.command("init:hybrid","Initialize hybrid project").action(async()=>{b("Initializing Hybrid Project"),await E.parse(["init","--mode","hybrid"])})}QE();import{readFile as Oz,writeFile as uV}from"node:fs/promises";import{resolve as FO}from"node:path";import{createCipheriv as l9,createDecipheriv as i9,createHash as gy,randomBytes as td}from"node:crypto";import{createHmac as n9,timingSafeEqual as v9}from"node:crypto";var YU="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function O0(E){let r=0,t=0,T="";for(let _ of E){t=t<<8|_,r+=8;while(r>=5)T+=YU[t>>>r-5&31],r-=5}if(r>0)T+=YU[t<<5-r&31];return T}function Gy(E){let r=E.toUpperCase().replace(/[^A-Z2-7]/g,""),t=0,T=0,_=[];for(let d of r){let e=YU.indexOf(d);if(e<0)throw Error("Invalid base32 secret");if(T=T<<5|e,t+=5,t>=8)_.push(T>>>t-8&255),t-=8}return Buffer.from(_)}function My(E,r,t=6){let T=Buffer.alloc(8);T.writeBigUInt64BE(BigInt(r));let _=n9("sha1",Gy(E)).update(T).digest(),d=_[_.length-1]&15,e=(_[d]&127)<<24|(_[d+1]&255)<<16|(_[d+2]&255)<<8|_[d+3]&255;return String(e%10**t).padStart(t,"0")}function c0(E,r,t=Date.now(),T=1){let _=r.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(_))return;let d=Buffer.from(_),e=Math.floor(t/1000/30);for(let h=-T;h<=T;h++){if(e+h<0)continue;let R=Buffer.from(My(E,e+h));if(d.length===R.length&&v9(d,R))return e+h}return}function QU(E){let r=E.issuer?.trim()||"ts-cloud",t=`${r}:${E.account}`;return`otpauth://totp/${encodeURIComponent(t)}?secret=${encodeURIComponent(E.secret)}&issuer=${encodeURIComponent(r)}&algorithm=SHA1&digits=6&period=30`}var qy=1800000,Te=43200000,xy=3600000,by=300000,ky=600000;function IT(E){return typeof E==="string"?E:void 0}function uy(E){if(typeof E!=="string")return{};try{return JSON.parse(E)}catch{return{}}}function a9(E){let r=E.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(r))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return r}function GU(E){if(E===void 0||!E.trim())return;let r=E.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(r)||r.length>254)throw Error("A valid email address is required");return r}function m9(E){let r=E.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(r))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return r}function s9(E){let r=new URL(E.trim());if(r.search||r.hash||r.username||r.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(r.protocol!=="https:"&&!(r.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(r.hostname)))throw Error("OIDC issuer must use HTTPS");return r.href.replace(/\/$/,"")}function p9(E){let r=[...new Set(E.map((t)=>t.trim().toLowerCase()).filter(Boolean))];if(r.length===0)throw Error("At least one explicit OIDC email domain is required");if(r.some((t)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(t)||!t.includes(".")||t.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return r}function o9(E){let r=[...new Set(["openid",...E??["email","profile"]].map((t)=>t.trim()).filter(Boolean))];if(r.some((t)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(t)))throw Error("OIDC scopes contain unsupported characters");return r}function E_(E){return gy("sha256").update(E).digest("hex")}function XA(E){return{id:String(E.id),actorId:String(E.actor_id),username:String(E.username),email:IT(E.email),emailVerifiedAt:IT(E.email_verified_at),passwordHash:String(E.password_hash),credentialVersion:Number(E.credential_version),requiresPasswordUpgrade:Number(E.requires_password_upgrade)===1,disabledAt:IT(E.disabled_at),lastLoginAt:IT(E.last_login_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Vy(E,r){let t=IT(E.consumed_at),T=String(E.expires_at);return{id:String(E.id),identityId:String(E.identity_id),type:String(E.type),metadata:uy(E.metadata),expiresAt:T,consumedAt:t,createdAt:String(E.created_at),state:t?"consumed":T<=r?"expired":"pending"}}function MU(E,r){let t=IT(E.revoked_at),T=String(E.idle_expires_at),_=String(E.absolute_expires_at);return{id:String(E.id),identityId:String(E.identity_id),credentialVersion:Number(E.credential_version),authMethod:String(E.auth_method),userAgent:IT(E.user_agent),networkHint:IT(E.network_hint),createdAt:String(E.created_at),lastUsedAt:String(E.last_used_at),idleExpiresAt:T,absoluteExpiresAt:_,recentAuthAt:String(E.recent_auth_at),mfaAt:IT(E.mfa_at),revokedAt:t,state:t?"revoked":T<=r||_<=r?"expired":"active"}}function Py(E){let r=IT(E.verified_at),t=IT(E.disabled_at);return{id:String(E.id),identityId:String(E.identity_id),type:"totp",label:String(E.label),createdAt:String(E.created_at),verifiedAt:r,disabledAt:t,state:t?"disabled":r?"active":"pending"}}function VU(E,r){let t=IT(E.consumed_at),T=String(E.expires_at),_=Number(E.attempts);return{id:String(E.id),identityId:String(E.identity_id),purpose:String(E.purpose),attempts:_,expiresAt:T,consumedAt:t,createdAt:String(E.created_at),state:t?"consumed":_>=5?"locked":T<=r?"expired":"pending"}}function Ky(E){let r=uy(E);return Array.isArray(r)?r.filter((t)=>typeof t==="string"):[]}function I0(E){return{id:String(E.id),organizationId:String(E.organization_id),slug:String(E.slug),name:String(E.name),issuer:String(E.issuer),clientId:String(E.client_id),hasClientSecret:typeof E.client_secret_ciphertext==="string"&&E.client_secret_ciphertext.length>0,scopes:Ky(E.scopes),allowedDomains:Ky(E.allowed_domains),defaultRole:String(E.default_role),enabled:Number(E.enabled)===1,enforceSso:Number(E.enforce_sso)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Zy(E,r){let t=IT(E.consumed_at),T=String(E.expires_at);return{id:String(E.id),providerId:String(E.provider_id),redirectUri:String(E.redirect_uri),returnPath:String(E.return_path),expiresAt:T,consumedAt:t,createdAt:String(E.created_at),state:t?"consumed":T<=r?"expired":"pending"}}function E8(E){return{id:String(E.id),providerId:String(E.provider_id),identityId:String(E.identity_id),subject:String(E.subject),email:String(E.email),linkedAt:String(E.linked_at),lastLoginAt:String(E.last_login_at)}}class r_{controlPlane;nowFn;idFn;encryptionKey;constructor(E,r={}){this.controlPlane=E;this.nowFn=r.now??(()=>new Date),this.idFn=r.id??(()=>crypto.randomUUID()),this.encryptionKey=r.encryptionKey?gy("sha256").update(r.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(E,r){this.controlPlane.database.run(E,r)}encrypt(E){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let r=td(12),t=l9("aes-256-gcm",this.encryptionKey,r),T=Buffer.concat([t.update(E,"utf8"),t.final()]);return`v1.${r.toString("base64url")}.${t.getAuthTag().toString("base64url")}.${T.toString("base64url")}`}decrypt(E){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[r,t,T,_]=E.split(".");if(r!=="v1"||!t||!T||!_)throw Error("Encrypted authentication value is unavailable");let d=i9("aes-256-gcm",this.encryptionKey,Buffer.from(t,"base64url"));return d.setAuthTag(Buffer.from(T,"base64url")),Buffer.concat([d.update(Buffer.from(_,"base64url")),d.final()]).toString("utf8")}createIdentity(E){if(!this.controlPlane.getActor(E.actorId))throw Error("Authentication actor was not found");let r=a9(E.username),t=GU(E.email),T=E.id??this.idFn(),_=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,E.actorId,r,t??null,E.emailVerified&&t?_:null,E.passwordHash,E.requiresPasswordUpgrade?1:0,_,_]),this.getIdentity(T)}getIdentity(E){let r=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE id = ?").get(E);return r?XA(r):void 0}getIdentityByActor(E){let r=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE actor_id = ?").get(E);return r?XA(r):void 0}getIdentityByUsername(E){let r=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE username = ? COLLATE NOCASE").get(E.trim());return r?XA(r):void 0}getIdentityByEmail(E){let r=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE email = ? COLLATE NOCASE").get(E.trim().toLowerCase());return r?XA(r):void 0}listIdentities(){return this.controlPlane.database.query("SELECT * FROM auth_identities ORDER BY username COLLATE NOCASE").all().map(XA)}updatePassword(E,r,t={}){if(!this.getIdentity(E))throw Error("Authentication identity was not found");let _=this.now();return this.controlPlane.transaction(()=>{if(this.run(`UPDATE auth_identities SET password_hash = ?, credential_version = credential_version + 1,
         requires_password_upgrade = ?, updated_at = ? WHERE id = ?`,[r,t.requiresUpgrade?1:0,_,E]),t.revokeSessions!==!1)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[_,E])}),this.getIdentity(E)}rehashPassword(E,r){let t=this.now();this.run("UPDATE auth_identities SET password_hash = ?, requires_password_upgrade = 0, updated_at = ? WHERE id = ?",[r,t,E]);let T=this.getIdentity(E);if(!T)throw Error("Authentication identity was not found");return T}setVerifiedEmail(E,r){let t=GU(r),T=this.now();this.run("UPDATE auth_identities SET email = ?, email_verified_at = ?, updated_at = ? WHERE id = ?",[t,T,T,E]);let _=this.getIdentity(E);if(!_)throw Error("Authentication identity was not found");return _}recordLogin(E){let r=this.now();this.run("UPDATE auth_identities SET last_login_at = ?, updated_at = ? WHERE id = ?",[r,r,E]);let t=this.getIdentity(E);if(!t)throw Error("Authentication identity was not found");return t}setDisabled(E,r){let t=this.now();this.controlPlane.transaction(()=>{if(this.run("UPDATE auth_identities SET disabled_at = ?, credential_version = credential_version + 1, updated_at = ? WHERE id = ?",[r?t:null,t,E]),r)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[t,E])});let T=this.getIdentity(E);if(!T)throw Error("Authentication identity was not found");return T}createActionToken(E,r,t={}){if(!this.getIdentity(E))throw Error("Authentication identity was not found");let T=td(32).toString("base64url"),_=this.idFn(),d=this.now(),e=new Date(this.nowFn().getTime()+Math.min(86400000,Math.max(60000,t.ttlMs??xy))).toISOString();return this.run("INSERT INTO auth_action_tokens (id, identity_id, type, token_hash, metadata, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[_,E,r,E_(T),JSON.stringify(t.metadata??{}),e,d]),{actionToken:this.getActionToken(_),token:T}}getActionToken(E){let r=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE id = ?").get(E);return r?Vy(r,this.now()):void 0}consumeActionToken(E,r){return this.controlPlane.transaction(()=>{let t=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE token_hash = ? AND type = ?").get(E_(E),r);if(!t)throw Error("Action token is invalid");let T=Vy(t,this.now());if(T.state!=="pending")throw Error(`Action token is ${T.state}`);if(this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),T.id,this.now()]).changes!==1)throw Error("Action token is no longer available");return this.getActionToken(T.id)})}revokeActionTokens(E,r){return this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE identity_id = ? AND type = ? AND consumed_at IS NULL",[this.now(),E,r]).changes}createSession(E){let r=this.getIdentity(E.identityId);if(!r||r.disabledAt)throw Error("Authentication identity is unavailable");let t=this.idFn(),T=td(32).toString("base64url"),_=`v2.${t}.${T}`,d=this.now(),e=Math.min(86400000,Math.max(60000,E.idleTtlMs??qy)),h=Math.min(2592000000,Math.max(e,E.absoluteTtlMs??Te));return this.run(`INSERT INTO auth_sessions (id, identity_id, token_hash, credential_version, auth_method, user_agent, network_hint,
       created_at, last_used_at, idle_expires_at, absolute_expires_at, recent_auth_at, mfa_at)
@@ -8967,10 +8967,10 @@ Next steps:
         default_role = ?, enabled = ?, enforce_sso = ?, updated_at = ? WHERE id = ?`,[r,t,T,_,E.clientSecret?this.encrypt(E.clientSecret):null,JSON.stringify(d),JSON.stringify(e),E.defaultRole??h.defaultRole,E.enabled??h.enabled?1:0,E.enforceSso??h.enforceSso?1:0,R,h.id]),this.getOidcProvider(h.id)}if(!E.clientSecret)throw Error("OIDC client secret is required for a new provider");let N=E.id??this.idFn();return this.run(`INSERT INTO auth_oidc_providers (id, organization_id, slug, name, issuer, client_id,
       client_secret_ciphertext, scopes, allowed_domains, default_role, enabled, enforce_sso, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[N,E.organizationId,r,t,T,_,this.encrypt(E.clientSecret),JSON.stringify(d),JSON.stringify(e),E.defaultRole??"viewer",E.enabled===!1?0:1,E.enforceSso?1:0,R,R]),this.getOidcProvider(N)}getOidcProvider(E){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(E);return r?I0(r):void 0}getOidcProviderBySlug(E){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE slug = ? COLLATE NOCASE").get(E.trim());return r?I0(r):void 0}listOidcProviders(E,r={}){return(E?this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(E):this.controlPlane.database.query("SELECT * FROM auth_oidc_providers ORDER BY name COLLATE NOCASE").all()).map(I0).filter((T)=>r.includeDisabled||T.enabled)}setOidcProviderEnabled(E,r){let t=this.now();if(this.controlPlane.database.run("UPDATE auth_oidc_providers SET enabled = ?, enforce_sso = CASE WHEN ? = 0 THEN 0 ELSE enforce_sso END, updated_at = ? WHERE id = ?",[r?1:0,r?1:0,t,E]).changes!==1)throw Error("OIDC provider was not found");if(!r)this.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE provider_id = ? AND consumed_at IS NULL",[t,E]);return this.getOidcProvider(E)}getOidcProviderCredentials(E){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(E);if(!r||typeof r.client_secret_ciphertext!=="string")throw Error("OIDC provider credentials are unavailable");return{provider:I0(r),clientSecret:this.decrypt(r.client_secret_ciphertext)}}beginOidcTransaction(E,r,t){if(!this.getOidcProvider(E)?.enabled)throw Error("OIDC provider is unavailable");let _=this.idFn(),d=td(32).toString("base64url"),e=td(32).toString("base64url"),h=td(64).toString("base64url"),R=this.now(),N=new Date(this.nowFn().getTime()+ky).toISOString();return this.run(`INSERT INTO auth_oidc_transactions (id, provider_id, state_hash, nonce_ciphertext, verifier_ciphertext,
-      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[_,E,E_(d),this.encrypt(e),this.encrypt(h),r,t,N,R]),{transaction:this.getOidcTransaction(_),state:d,nonce:e,verifier:h}}getOidcTransaction(E){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(E);return r?Zy(r,this.now()):void 0}consumeOidcTransaction(E,r){return this.controlPlane.transaction(()=>{let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(E,E_(r));if(!t)throw Error("OIDC transaction is invalid");let T=Zy(t,this.now());if(T.state!=="pending")throw Error(`OIDC transaction is ${T.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),T.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(T.id),nonce:this.decrypt(String(t.nonce_ciphertext)),verifier:this.decrypt(String(t.verifier_ciphertext))}})}getOidcSubject(E,r){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(E,r);return t?EM(t):void 0}linkOidcSubject(E,r,t,T){let _=this.getOidcProvider(E),d=this.getIdentity(r);if(!_||!d)throw Error("OIDC provider or identity was not found");let e=GU(T);if(!t.trim()||t.length>512)throw Error("OIDC subject is invalid");let h=this.getOidcSubject(E,t);if(h&&h.identityId!==r)throw Error("OIDC subject is already linked to another identity");let R=this.now();if(h)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[e,R,h.id]),this.getOidcSubject(E,t);let N=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[N,E,r,t,e,R,R]),this.getOidcSubject(E,t)}purgeExpired(){let E=this.now(),r=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[E]).changes,t=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[E,E]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[E]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[E]),{actionTokens:r,sessions:t}}}async function jA(E,r){let t=E.notifications?.email?.from;if(!t)return!1;try{let{EmailClient:T}=await Promise.resolve().then(() => ($R(),yA));return await new T({region:E.project.region,defaultFrom:t}).send(r),!0}catch{return!1}}import{randomBytes as dM}from"node:crypto";import{chmodSync as eM,existsSync as hM,mkdirSync as RM,readFileSync as NM,writeFileSync as AM}from"node:fs";import{dirname as SM,join as iy}from"node:path";var ay=iy(".ts-cloud","auth-encryption-key");function Gr(E){let r=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(r)return r;let t=iy(E,ay);try{if(hM(t)){let _=NM(t,"utf8").trim();if(_)return _}}catch{}let T=dM(32).toString("base64url");try{RM(SM(t),{recursive:!0,mode:448}),AM(t,`${T}
-`,{mode:384}),eM(t,384)}catch{}return T}import{constants as my,createHash as PU,createPublicKey as LM,createVerify as OM,timingSafeEqual as cM}from"node:crypto";var py=new Set(["RS256","PS256","ES256"]),sy=60;function D0(E,r){let t=new URL(E),T=["127.0.0.1","::1","localhost"].includes(t.hostname);if(t.protocol!=="https:"&&!(t.protocol==="http:"&&T))throw Error(`${r} must use HTTPS`);if(t.username||t.password||t.hash)throw Error(`${r} contains unsupported URL components`);return t}function KU(E,r){if(!E||typeof E!=="object"||Array.isArray(E))throw Error(`${r} is invalid`);return E}async function ZU(E,r){if(!E.ok)throw Error(`${r} failed with HTTP ${E.status}`);if(!(E.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${r} returned an unsupported content type`);if(Number(E.headers.get("content-length")??0)>1048576)throw Error(`${r} response is too large`);let _=await E.text();if(_.length>1048576)throw Error(`${r} response is too large`);try{return KU(JSON.parse(_),r)}catch(d){if(d instanceof Error&&d.message===`${r} is invalid`)throw d;throw Error(`${r} returned invalid JSON`)}}function IM(E,r){let t=PU("sha256").update(E).digest(),T=PU("sha256").update(r).digest();return cM(t,T)}function oy(E){if(!E)return"/";let r=E.trim();if(!r.startsWith("/")||r.startsWith("//")||r.includes("\\")||/[\r\n]/.test(r))return"/";try{let t=new URL(r,"https://local.invalid");return t.origin==="https://local.invalid"?`${t.pathname}${t.search}${t.hash}`:"/"}catch{return"/"}}async function FA(E,r=fetch){let t=D0(E.issuer,"OIDC issuer"),T=new URL(`${t.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,t.origin),_=await ZU(await r(T,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(_.issuer!==E.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let e of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof _[e]!=="string")throw Error(`OIDC discovery is missing ${e}`);D0(_[e],`OIDC ${e}`)}if(Array.isArray(_.response_types_supported)&&!_.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(_.code_challenge_methods_supported)&&!_.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let d=Array.isArray(_.id_token_signing_alg_values_supported)?_.id_token_signing_alg_values_supported.filter((e)=>typeof e==="string"):[];if(d.length>0&&!d.some((e)=>py.has(e)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return _}async function gU(E,r,t,T,_=fetch){let d=E.getOidcProviderBySlug(r);if(!d?.enabled)throw Error("OIDC provider is unavailable");let e=D0(t,"Application origin").origin,h=await FA(d,_),R=`${e}/auth/oidc/${encodeURIComponent(d.slug)}/callback`,N=E.beginOidcTransaction(d.id,R,oy(T)),A=new URL(h.authorization_endpoint);return A.searchParams.set("response_type","code"),A.searchParams.set("client_id",d.clientId),A.searchParams.set("redirect_uri",R),A.searchParams.set("scope",d.scopes.join(" ")),A.searchParams.set("state",N.state),A.searchParams.set("nonce",N.nonce),A.searchParams.set("code_challenge",PU("sha256").update(N.verifier).digest("base64url")),A.searchParams.set("code_challenge_method","S256"),{authorizationUrl:A.href,expiresAt:N.transaction.expiresAt}}function UM(E){if(E.length>32768)throw Error("OIDC ID token is too large");let r=E.split(".");if(r.length!==3||r.some((t)=>!t))throw Error("OIDC ID token is malformed");try{return{header:KU(JSON.parse(Buffer.from(r[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:KU(JSON.parse(Buffer.from(r[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${r[0]}.${r[1]}`,signature:Buffer.from(r[2],"base64url")}}catch(t){if(t instanceof Error&&t.message.startsWith("OIDC"))throw t;throw Error("OIDC ID token is malformed")}}async function DM(E,r,t){let T=UM(E),_=typeof T.header.alg==="string"?T.header.alg:"",d=typeof T.header.kid==="string"?T.header.kid:"";if(!py.has(_)||!d)throw Error("OIDC ID token uses an unsupported signing key");if(r.id_token_signing_alg_values_supported&&!r.id_token_signing_alg_values_supported.includes(_))throw Error("OIDC ID-token algorithm was not advertised by the provider");let e=await ZU(await t(r.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(e.keys))throw Error("OIDC signing-key response is invalid");let h=e.keys.find((S)=>{if(!S||typeof S!=="object"||Array.isArray(S))return!1;let L=S;return L.kid===d&&(!L.alg||L.alg===_)&&(!L.use||L.use==="sig")});if(!h)throw Error("OIDC ID-token signing key was not found");let R=LM({key:h,format:"jwk"}),N=OM("SHA256").update(T.signingInput).end();if(!(_==="PS256"?N.verify({key:R,padding:my.RSA_PKCS1_PSS_PADDING,saltLength:32},T.signature):_==="ES256"?N.verify({key:R,dsaEncoding:"ieee-p1363"},T.signature):N.verify(R,T.signature)))throw Error("OIDC ID-token signature is invalid");return T.claims}function $M(E,r,t,T){if(E.iss!==r.issuer)throw Error("OIDC ID-token issuer is invalid");let _=typeof E.aud==="string"?[E.aud]:Array.isArray(E.aud)?E.aud.filter((R)=>typeof R==="string"):[];if(!_.includes(r.clientId))throw Error("OIDC ID-token audience is invalid");if((_.length>1||E.azp!==void 0)&&E.azp!==r.clientId)throw Error("OIDC ID-token authorized party is invalid");let d=Math.floor(T.getTime()/1000);if(typeof E.exp!=="number"||E.exp<d-sy)throw Error("OIDC ID token is expired");if(typeof E.iat!=="number"||E.iat>d+sy)throw Error("OIDC ID-token issued-at time is invalid");if(typeof E.nonce!=="string"||!IM(E.nonce,t))throw Error("OIDC ID-token nonce is invalid");if(typeof E.sub!=="string"||!E.sub||E.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(E.email_verified!==!0||typeof E.email!=="string")throw Error("OIDC provider did not return a verified email address");let e=E.email.trim().toLowerCase();if(e.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))throw Error("OIDC provider returned an invalid email address");let h=e.split("@")[1];if(!h||!r.allowedDomains.includes(h))throw Error("OIDC email domain is not allowed for this organization");return{provider:r,subject:E.sub,email:e,name:typeof E.name==="string"?E.name.slice(0,120):void 0,claims:E}}async function qU(E,r,t=fetch){let T=E.getOidcProviderBySlug(r.providerSlug);if(!T?.enabled)throw Error("OIDC provider is unavailable");if(!r.state||r.state.length>512||!r.code||r.code.length>4096)throw Error("OIDC callback is incomplete");let _=D0(r.origin,"Application origin").origin,d=E.consumeOidcTransaction(T.id,r.state),e=`${_}/auth/oidc/${encodeURIComponent(T.slug)}/callback`;if(d.transaction.redirectUri!==e)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:h}=E.getOidcProviderCredentials(T.id),R=await FA(T,t),N=new URLSearchParams({grant_type:"authorization_code",code:r.code,redirect_uri:d.transaction.redirectUri,code_verifier:d.verifier}),A={accept:"application/json","content-type":"application/x-www-form-urlencoded"},S=R.token_endpoint_auth_methods_supported??["client_secret_basic"];if(S.includes("client_secret_basic")){let I=($)=>new URLSearchParams({value:$}).toString().slice(6),D=`${I(T.clientId)}:${I(h)}`;A.authorization=`Basic ${Buffer.from(D).toString("base64")}`}else if(S.includes("client_secret_post"))N.set("client_id",T.clientId),N.set("client_secret",h);else throw Error("OIDC provider does not support a configured client authentication method");let L=await ZU(await t(R.token_endpoint,{method:"POST",headers:A,body:N,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof L.id_token!=="string")throw Error("OIDC token response did not include an ID token");let O=await DM(L.id_token,R,t);return{identity:$M(O,T,d.nonce,r.now??new Date),returnPath:d.transaction.returnPath}}rh();zA();YA();rt();import{createHash as y8}from"node:crypto";class QA extends Error{constructor(){super("Operation cancellation was requested")}}class H0 extends Error{timeoutSeconds;constructor(E){super(`Operation exceeded its ${E}s timeout`);this.timeoutSeconds=E}}class t_ extends Error{errorClass;constructor(E,r){super(E);this.errorClass=r}}rt();var f0={project:2,environment:1,provider:2,builds:1},ZM=30,$j=16384,gM=["succeeded","failed","cancelled","timed_out"];function Th(E){return typeof E==="string"&&E?E:void 0}function qM(E){try{let r=JSON.parse(String(E));return Array.isArray(r)?r.map(String):[]}catch{return[]}}function xM(E){return{operationId:String(E.operation_id),lockKey:Th(E.lock_key),providerKey:Th(E.provider_key),buildSlot:Number(E.build_slot)===1,maxAttempts:Number(E.max_attempts),availableAt:String(E.available_at),timeoutSeconds:Number(E.timeout_seconds),heartbeatAt:Th(E.heartbeat_at),currentStep:Th(E.current_step),blockedReason:Th(E.blocked_reason),retryClasses:qM(E.retry_classes),resumePolicy:String(E.resume_policy),cancellationMode:String(E.cancellation_mode),retentionUntil:String(E.retention_until),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function wj(E){return{sequence:Number(E.sequence),id:String(E.id),operationId:String(E.operation_id),stream:String(E.stream),step:Th(E.step),message:String(E.message),redacted:Number(E.redacted)===1,truncated:Number(E.truncated)===1,createdAt:String(E.created_at)}}function KT(E,r,t){return Number.isFinite(E)?Math.min(t,Math.max(1,Math.floor(E))):r}class aE{controlPlane;nowFn;idFn;workerId;leaseMs;limits;constructor(E,r={}){this.controlPlane=E;this.workerId=r.workerId??`worker:${process.pid}:${crypto.randomUUID()}`,this.leaseMs=KT(r.leaseMs,60000,3600000),this.nowFn=r.now??(()=>new Date),this.idFn=r.id??(()=>crypto.randomUUID());let t=E.getSetting("queue.concurrency");this.limits={project:KT(r.limits?.project??t?.project,f0.project,100),environment:KT(r.limits?.environment??t?.environment,f0.environment,100),provider:KT(r.limits?.provider??t?.provider,f0.provider,100),builds:KT(r.limits?.builds??t?.builds,f0.builds,100)}}now(){return this.nowFn().toISOString()}leaseExpiry(){return new Date(this.nowFn().getTime()+this.leaseMs).toISOString()}enqueue(E){let r=this.controlPlane.createOperation(E);if(this.getJob(r.id))return this.view(r.id);let T=this.now(),_=KT(E.maxAttempts,1,20),d=KT(E.timeoutSeconds,1800,86400),e=KT(E.retentionDays,ZM,3650),h=E.availableAt?new Date(E.availableAt).toISOString():T,R=new Date(this.nowFn().getTime()+e*24*60*60*1000).toISOString();return this.controlPlane.database.run(`INSERT OR IGNORE INTO operation_jobs (operation_id, lock_key, provider_key, build_slot, max_attempts, available_at, timeout_seconds, retry_classes, resume_policy, cancellation_mode, retention_until, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r.id,E.lockKey??E.resourceId??null,E.providerKey??null,E.buildSlot?1:0,_,h,d,JSON.stringify([...new Set(E.retryClasses??[])]),E.resumePolicy??"fail",E.cancellationMode??"cooperative",R,T,T]),this.appendLog(r.id,"Queued for durable execution.",{stream:"system"}),this.view(r.id)}getJob(E){let r=this.controlPlane.database.query("SELECT * FROM operation_jobs WHERE operation_id=?").get(E);return r?xM(r):void 0}view(E){let r=this.controlPlane.getOperation(E),t=this.getJob(E);if(!r||!t)return;let T;if(r.state==="queued")T={ahead:Number(this.controlPlane.database.query("SELECT COUNT(*) AS count FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='queued' AND j.available_at<=? AND (o.priority>? OR (o.priority=? AND o.created_at<?))").get(this.now(),r.priority,r.priority,r.createdAt)?.count??0),precision:"bounded"};return{operation:r,job:t,approximatePosition:T}}list(E={}){return this.controlPlane.listOperations({projectId:E.projectId,state:E.state,limit:E.limit??200}).map((r)=>this.view(r.id)).filter((r)=>!!r)}configureConcurrency(E,r={}){let t={project:KT(E.project,this.limits.project,100),environment:KT(E.environment,this.limits.environment,100),provider:KT(E.provider,this.limits.provider,100),builds:KT(E.builds,this.limits.builds,100)};return Object.assign(this.limits,t),this.controlPlane.setSetting("queue.concurrency",t),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:r.actorId,type:"queue.concurrency.updated",level:"warning",payload:t}),t}runningCount(E,r){return Number(this.controlPlane.database.query(E).get(...r)?.count??0)}blockReason(E,r){if(r.lockKey){if(this.controlPlane.database.query("SELECT * FROM operation_locks WHERE lock_key=? AND operation_id!=? AND lease_expires_at>?").get(r.lockKey,E.id,this.now()))return`resource_lock:${r.lockKey}`}if(E.projectId&&this.runningCount("SELECT COUNT(*) AS count FROM operations WHERE state='running' AND project_id=?",[E.projectId])>=this.limits.project)return"project_concurrency";if(E.environmentId&&this.runningCount("SELECT COUNT(*) AS count FROM operations WHERE state='running' AND environment_id=?",[E.environmentId])>=this.limits.environment)return"environment_concurrency";if(r.providerKey&&this.runningCount("SELECT COUNT(*) AS count FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='running' AND j.provider_key=?",[r.providerKey])>=this.limits.provider)return"provider_concurrency";if(r.buildSlot&&this.runningCount("SELECT COUNT(*) AS count FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='running' AND j.build_slot=1",[])>=this.limits.builds)return"build_concurrency";return}claim(E){return this.controlPlane.transaction(()=>{let r=this.now();this.controlPlane.database.run("DELETE FROM operation_locks WHERE lease_expires_at<=?",[r]);let t=this.controlPlane.getOperation(E),T=t?this.getJob(t.id):void 0;if(!t||!T||t.state!=="queued"||T.availableAt>r)return;if(t.cancelRequestedAt){this.controlPlane.transitionOperation(t.id,{to:"cancelled",expectedVersion:t.version,output:{cancelledBeforeStart:!0}}),this.appendLog(t.id,"Cancelled before execution began.",{stream:"system"});return}let _=this.blockReason(t,T);if(_){this.controlPlane.database.run("UPDATE operation_jobs SET blocked_reason=?, updated_at=? WHERE operation_id=?",[_,r,t.id]);return}let d=this.controlPlane.claimOperation(t.id,this.workerId,this.leaseMs);if(!d)return;let e=d.leaseExpiresAt??this.leaseExpiry();if(T.lockKey)this.controlPlane.database.run("INSERT INTO operation_locks (lock_key, operation_id, lease_owner, lease_expires_at, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)",[T.lockKey,t.id,this.workerId,e,r,r]);return this.controlPlane.database.run("UPDATE operation_jobs SET heartbeat_at=?, blocked_reason=NULL, updated_at=? WHERE operation_id=?",[r,r,t.id]),this.appendLog(t.id,`Claimed by ${this.workerId}; attempt ${d.attempt}.`,{stream:"system"}),this.view(t.id)})}claimNext(E){let r=this.now(),t=E?.length?`AND o.kind IN (${E.map(()=>"?").join(",")})`:"",T=this.controlPlane.database.query(`SELECT o.id FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='queued' AND j.available_at<=? ${t} ORDER BY o.priority DESC, o.created_at ASC, o.rowid ASC LIMIT 100`).all(r,...E??[]);for(let _ of T){let d=this.claim(String(_.id));if(d)return d}return}heartbeat(E,r){let t=this.controlPlane.getOperation(E);if(!t||t.state!=="running"||t.leaseOwner!==this.workerId)throw Error("Operation lease is not owned by this worker");let T=this.now(),_=this.leaseExpiry(),d=this.getJob(E);if(this.controlPlane.database.run("UPDATE operations SET lease_expires_at=?, updated_at=?, version=version+1 WHERE id=? AND state='running' AND lease_owner=? AND version=?",[_,T,E,this.workerId,t.version]).changes!==1)throw Error("Operation lease changed before heartbeat");if(this.controlPlane.database.run("UPDATE operation_jobs SET heartbeat_at=?, current_step=COALESCE(?, current_step), updated_at=? WHERE operation_id=?",[T,r??null,T,E]),d?.lockKey)this.controlPlane.database.run("UPDATE operation_locks SET lease_expires_at=?, updated_at=? WHERE lock_key=? AND operation_id=? AND lease_owner=?",[_,T,d.lockKey,E,this.workerId]);if(r&&r!==d?.currentStep)this.controlPlane.appendEvent({projectId:t.projectId,operationId:E,resourceId:t.resourceId,actorId:t.actorId,correlationId:t.correlationId,type:"operation.step",payload:{step:r}})}appendLog(E,r,t={}){if(!this.getJob(E))throw Error(`Queue job ${E} was not found`);let T=r,_=!1;for(let A of t.secrets??[])if(A&&T.includes(A))T=T.split(A).join("[REDACTED]"),_=!0;let d=ZE({message:T});if(d.message!==T)_=!0;T=d.message??"[output unavailable]";let e=Buffer.from(T),h=e.byteLength>$j;if(h)T=`${e.subarray(0,$j-32).toString("utf8")}
-[output truncated]`;let R=this.idFn(),N=this.now();return this.controlPlane.database.run("INSERT INTO operation_logs (id, operation_id, stream, step, message, redacted, truncated, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",[R,E,t.stream??"stdout",t.step??null,T,_?1:0,h?1:0,N]),wj(this.controlPlane.database.query("SELECT * FROM operation_logs WHERE id=?").get(R))}logs(E,r={}){let t=Math.min(1000,Math.max(1,r.limit??200));return this.controlPlane.database.query("SELECT * FROM operation_logs WHERE operation_id=? AND sequence>? ORDER BY sequence ASC LIMIT ?").all(E,r.after??0,t).map(wj)}requestCancellation(E,r){let t=this.controlPlane.getOperation(E);if(!t||gM.includes(t.state))throw Error("Only queued or running operations can be cancelled");let T=this.controlPlane.requestCancellation(E);if(this.controlPlane.appendEvent({projectId:t.projectId,operationId:E,resourceId:t.resourceId,actorId:r,correlationId:t.correlationId,type:"operation.cancellation_requested",level:"warning",payload:{state:t.state}}),this.appendLog(E,t.state==="queued"?"Cancellation accepted before execution.":"Cancellation requested; waiting for the current provider step.",{stream:"system"}),T.state==="queued")return this.finish(E,"cancelled",{cancelledBeforeStart:!0});return T}retry(E,r,t={}){let T=this.controlPlane.getOperation(E),_=this.getJob(E);if(!T||!_||!["failed","cancelled","timed_out"].includes(T.state))throw Error("Only failed, cancelled, or timed-out queue jobs can be retried");if(T.attempt>=_.maxAttempts)throw Error(`Operation reached its ${_.maxAttempts}-attempt limit`);if(!_.retryClasses.includes(r))throw Error(`Retry class ${r} is not allowed for this operation`);let d=this.controlPlane.transitionOperation(E,{to:"queued",expectedVersion:T.version,error:`Retry requested after ${r}`}),e=new Date(this.nowFn().getTime()+Math.max(0,t.delayMs??0)).toISOString();return this.controlPlane.database.run("UPDATE operations SET cancel_requested_at=NULL, finished_at=NULL WHERE id=?",[E]),this.controlPlane.database.run("UPDATE operation_jobs SET available_at=?, blocked_reason=NULL, updated_at=? WHERE operation_id=?",[e,this.now(),E]),this.controlPlane.appendEvent({projectId:T.projectId,operationId:E,resourceId:T.resourceId,actorId:t.actorId,correlationId:T.correlationId,type:"operation.retry_requested",payload:{errorClass:r,availableAt:e,nextAttempt:T.attempt+1}}),this.appendLog(E,`Retry queued for error class ${r}.`,{stream:"system"}),this.controlPlane.getOperation(d.id)}release(E){this.controlPlane.database.run("DELETE FROM operation_locks WHERE operation_id=?",[E])}finish(E,r,t={},T){let _=this.controlPlane.getOperation(E);if(!_)throw Error(`Operation ${E} was not found`);let d=this.controlPlane.transitionOperation(E,{to:r,expectedVersion:_.version,output:t,error:T});return this.release(E),d}complete(E,r={}){let t=this.controlPlane.getOperation(E);if(!t||t.state!=="running"||t.leaseOwner!==this.workerId)throw Error("Only the lease owner can complete a running operation");return this.appendLog(E,"Operation completed successfully.",{stream:"system"}),this.finish(E,"succeeded",r)}fail(E,r,t={}){let T=this.controlPlane.getOperation(E);if(!T||T.state!=="running"||T.leaseOwner!==this.workerId)throw Error("Only the lease owner can fail a running operation");return this.appendLog(E,r,{stream:"stderr"}),this.finish(E,"failed",t,r)}async runOne(E){let r=this.claimNext(Object.keys(E));if(!r)return{handled:!1};let{operation:t,job:T}=r,_=E[t.kind];if(!_)return{handled:!1};let d=new AbortController,e=!1,h=setTimeout(()=>{e=!0,d.abort(new H0(T.timeoutSeconds))},T.timeoutSeconds*1000),R=setInterval(()=>{try{this.heartbeat(t.id)}catch{}},Math.max(250,Math.floor(this.leaseMs/3))),N=setInterval(()=>{if(this.controlPlane.getOperation(t.id)?.cancelRequestedAt)d.abort(new QA)},100),A={operation:t,signal:d.signal,log:(S,L)=>this.appendLog(t.id,S,L),checkpoint:(S,L)=>{this.heartbeat(t.id,S),this.appendLog(t.id,L??S,{stream:"step",step:S})},heartbeat:()=>this.heartbeat(t.id),cancellationRequested:()=>!!this.controlPlane.getOperation(t.id)?.cancelRequestedAt,throwIfCancellationRequested:()=>{if(this.controlPlane.getOperation(t.id)?.cancelRequestedAt)throw new QA}};try{let S=await Promise.race([_(A),new Promise((I,D)=>d.signal.addEventListener("abort",()=>D(d.signal.reason),{once:!0}))]);if(this.controlPlane.getOperation(t.id).cancelRequestedAt){let I=T.cancellationMode==="provider_non_cancellable";return this.appendLog(t.id,I?"Provider step completed after cancellation was requested; reconciliation is required.":"Operation cancelled cooperatively.",{stream:"system"}),{handled:!0,operation:this.finish(t.id,"cancelled",{providerCompleted:I,reconciliationRequired:I}),terminalState:"cancelled"}}return{handled:!0,operation:this.complete(t.id,S??{}),terminalState:"succeeded"}}catch(S){if(e||S instanceof H0)return this.appendLog(t.id,`Timed out after ${T.timeoutSeconds}s.`,{stream:"system"}),{handled:!0,operation:this.finish(t.id,"timed_out",{reconciliationRequired:T.cancellationMode==="provider_non_cancellable"},S instanceof Error?S.message:String(S)),terminalState:"timed_out"};if(S instanceof QA||this.controlPlane.getOperation(t.id)?.cancelRequestedAt)return{handled:!0,operation:this.finish(t.id,"cancelled",{cooperativelyCancelled:!0}),terminalState:"cancelled"};if(S instanceof t_&&T.retryClasses.includes(S.errorClass)&&t.attempt<T.maxAttempts){let I=this.controlPlane.getOperation(t.id);this.controlPlane.transitionOperation(t.id,{to:"queued",expectedVersion:I.version,error:S.message});let D=Math.min(60000,1000*2**Math.max(0,t.attempt-1)),$=new Date(this.nowFn().getTime()+D).toISOString();return this.controlPlane.database.run("UPDATE operation_jobs SET available_at=?, blocked_reason=?, updated_at=? WHERE operation_id=?",[$,`retry_backoff:${S.errorClass}`,this.now(),t.id]),this.release(t.id),this.appendLog(t.id,`Retryable ${S.errorClass} failure; next attempt is delayed.`,{stream:"system"}),{handled:!0,operation:this.controlPlane.getOperation(t.id),requeued:!0}}let L=S instanceof Error?S.message:String(S);return this.appendLog(t.id,L,{stream:"stderr"}),{handled:!0,operation:this.finish(t.id,"failed",{},L),terminalState:"failed"}}finally{clearTimeout(h),clearInterval(R),clearInterval(N)}}recoverExpired(){let E=this.controlPlane.database.query("SELECT o.id FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='running' AND (o.lease_expires_at IS NULL OR o.lease_expires_at<=?)").all(this.now()),r={requeued:0,failed:0,cancelled:0};for(let t of E){let T=this.controlPlane.getOperation(String(t.id)),_=this.getJob(T.id);if(this.release(T.id),T.cancelRequestedAt){this.finish(T.id,"cancelled",{recoveredAfterWorkerLoss:!0}),r.cancelled++;continue}if(_.resumePolicy==="requeue"&&T.attempt<_.maxAttempts)this.controlPlane.transitionOperation(T.id,{to:"queued",expectedVersion:T.version,error:"Worker lease expired; safely requeued from the last checkpoint."}),this.controlPlane.database.run("UPDATE operation_jobs SET available_at=?, blocked_reason='worker_restart', updated_at=? WHERE operation_id=?",[this.now(),this.now(),T.id]),this.appendLog(T.id,"Worker lease expired; operation requeued from its persisted checkpoint.",{stream:"system"}),r.requeued++;else this.finish(T.id,"failed",{recoverable:!0,lastCheckpoint:_.currentStep??null},"Worker lease expired; retry explicitly after reconciling provider state."),r.failed++}return r}clearCompleted(E={}){let r=this.now(),t=[r],T=E.projectId?"AND o.project_id=?":"";if(E.projectId)t.push(E.projectId);let _=E.before?"AND o.finished_at<=?":"";if(E.before)t.push(new Date(E.before).toISOString());let d=this.controlPlane.database.query(`SELECT o.id, o.project_id, o.correlation_id FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state IN ('succeeded','failed','cancelled','timed_out') AND j.retention_until<=? ${T} ${_}`).all(...t);for(let e of d)this.controlPlane.appendEvent({projectId:Th(e.project_id),actorId:E.actorId,correlationId:String(e.correlation_id),type:"queue.history.cleared",level:"warning",payload:{operationId:String(e.id),retentionCutoff:r}}),this.controlPlane.database.run("DELETE FROM operations WHERE id=?",[String(e.id)]);return d.length}}function Cj(E,r,t){if(!Number.isFinite(E))return r;return Math.min(t,Math.max(1,Math.floor(E)))}class RD{queue;handlers;parallelism;pollIntervalMs;onResult;onError;waits=new Map;lanes=[];running=!1;constructor(E,r,t={}){this.queue=E;this.handlers=r;this.parallelism=Cj(t.parallelism,4,100),this.pollIntervalMs=Cj(t.pollIntervalMs,500,60000),this.onResult=t.onResult,this.onError=t.onError}get active(){return this.running}start(){if(this.running)return this;return this.running=!0,this.lanes=Array.from({length:this.parallelism},()=>this.runLane()),this}stop(){this.running=!1;for(let[E,r]of this.waits)clearTimeout(E),r();this.waits.clear()}async settled(){await Promise.allSettled(this.lanes)}async drain(){let E=[];while(!0){let r=await Promise.all(Array.from({length:this.parallelism},()=>this.queue.runOne(this.handlers)));if(E.push(...r.filter((t)=>t.handled)),!r.some((t)=>t.handled))return E}}wait(){return new Promise((E)=>{let r=setTimeout(()=>{this.waits.delete(r),E()},this.pollIntervalMs);r.unref?.(),this.waits.set(r,E)})}async runLane(){while(this.running){try{let E=await this.queue.runOne(this.handlers);if(!this.running)break;if(E.handled){this.onResult?.(E);continue}}catch(E){this.onError?.(E)}await this.wait()}}}import{createHash as bM}from"node:crypto";var jj=/^[a-z0-9](?:[a-z0-9_.-]{0,62})$/,kM=/^[A-Za-z_][A-Za-z0-9_]{0,127}$/,uM=/(?:secret|token|password|passwd|private.?key|api.?key|credential)/i,nM=new Set(["image","build","command","entrypoint","environment","ports","volumes","networks","depends_on","healthcheck","restart","deploy","labels"]),Xj=new Map([["privileged","Privileged containers are blocked."],["network_mode","Host/custom network modes are blocked."],["pid","Host PID namespaces are blocked."],["ipc","Host IPC namespaces are blocked."],["devices","Device access is blocked."],["cap_add","Additional Linux capabilities require an external policy exception."],["security_opt","Custom security options require an external policy exception."]]);function tt(E){return E&&typeof E==="object"&&!Array.isArray(E)?E:{}}function AD(E){return Array.isArray(E)?E:E==null?[]:[E]}function vM(E){return E.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"").slice(0,63)||"compose-app"}function GA(E){if(Array.isArray(E))return E.map(String);if(typeof E==="string"&&E.trim())return["sh","-c",E];return}function ND(E,r){let t=String(E??""),T=/^(\d+(?:\.\d+)?)(ms|s|m|h)?$/.exec(t);if(!T)return r;let _=Number(T[1]);return Math.max(0,Math.round(_*(T[2]==="ms"?0.001:T[2]==="m"?60:T[2]==="h"?3600:1)))}function Jj(E){let r=/^(\d+(?:\.\d+)?)\s*(b|k|kb|kib|m|mb|mib|g|gb|gib)?$/i.exec(String(E??""));if(!r)return;let t=Number(r[1]),T=String(r[2]??"b").toLowerCase(),_=t*(T.startsWith("g")?1073741824:T.startsWith("m")?1048576:T.startsWith("k")?1024:1);return Math.max(1,Math.round(_/1024/1024))}function lM(E){if(E==null)return"";return/^\$\{([A-Za-z_][A-Za-z0-9_]*)(?::[-?][^}]*)?\}$/.exec(String(E))?.[1]}function Fj(E,r,t){let T={},_=Array.isArray(E)?E.map((d)=>{let[e,...h]=String(d).split("=");return[e,h.length?h.join("="):null]}):Object.entries(tt(E));for(let[d,e]of _){let h=String(d);if(!kM.test(h)){t.push({severity:"error",path:`${r}.${h}`,code:"environment.name",message:"Environment variable names must use portable shell identifiers."});continue}let R=lM(e);if(R!==void 0){T[h]={secretRef:R||h};continue}if(uM.test(h)){t.push({severity:"error",path:`${r}.${h}`,code:"secret.literal",message:"Literal secret-like environment values are not stored.",alternative:`Use \${${h}} and supply ${h} through the secret store.`}),T[h]={secretRef:h};continue}T[h]=String(e??"")}return T}function iM(E,r,t){let T=[];for(let[_,d]of AD(E).entries()){let e,h,R="tcp";if(typeof d==="number")e=d;else if(typeof d==="string"){let[N,A]=d.split("/");R=A==="udp"?"udp":"tcp";let S=N.split(":");e=Number(S.at(-1)),h=S.length>1?Number(S.at(-2)):void 0}else{let N=tt(d);e=Number(N.target),h=N.published==null?void 0:Number(N.published),R=N.protocol==="udp"?"udp":"tcp"}if(!Number.isInteger(e)||e<1||e>65535||h!=null&&(!Number.isInteger(h)||h<1||h>65535))t.push({severity:"error",path:`${r}[${_}]`,code:"port.invalid",message:"Ports must be integers from 1 through 65535."});else T.push({target:e,...h?{published:h}:{},protocol:R})}return T}function aM(E,r,t,T){let _=[];for(let[d,e]of AD(E).entries()){let h="",R="",N=!1,A="volume";if(typeof e==="string"){let S=e.split(":");h=S[0]??"",R=S[1]??"",N=S.slice(2).includes("ro"),A=h.startsWith("/")||h.startsWith(".")?"bind":"volume"}else{let S=tt(e);h=String(S.source??""),R=String(S.target??""),N=S.read_only===!0,A=String(S.type??"volume")}if(A!=="volume"||h.startsWith("/")||h.startsWith(".")){T.push({severity:"error",path:`${t}[${d}]`,code:"volume.host_mount",message:"Host and bind mounts are blocked; use a named volume.",alternative:"Declare the volume at the top level and mount it by name."});continue}if(!jj.test(h)||!R.startsWith("/")){T.push({severity:"error",path:`${t}[${d}]`,code:"volume.invalid",message:"A named source and absolute container target are required."});continue}if(!r.has(h))T.push({severity:"warning",path:`${t}[${d}]`,code:"volume.implicit",message:`Named volume ${h} is implicit and will be declared on export.`});r.add(h),_.push({source:h,target:R,readOnly:N})}return _}function mM(E){return Array.isArray(E)?E.map((r)=>({service:String(r),condition:"service_started"})):Object.entries(tt(E)).map(([r,t])=>({service:r,condition:["service_started","service_healthy","service_completed_successfully"].includes(String(tt(t).condition))?String(tt(t).condition):"service_started"}))}function yj(E){let r=tt(E);if(!Object.keys(r).length||r.disable===!0)return;let t=GA(r.test);return t?{test:t,intervalSeconds:ND(r.interval,30),timeoutSeconds:ND(r.timeout,5),retries:Math.max(1,Number(r.retries)||3),...r.start_period?{startPeriodSeconds:ND(r.start_period,0)}:{}}:void 0}function sM(E,r,t){if(!E)return;let T=typeof E==="string"?{context:E}:tt(E),_=String(T.context??"."),d=String(T.dockerfile??"Dockerfile");if(_.startsWith("/")||_.split("/").includes("..")||d.startsWith("/")||d.split("/").includes(".."))t.push({severity:"error",path:r,code:"build.traversal",message:"Build context and Dockerfile must stay inside the repository."});return{context:_,dockerfile:d,...T.target?{target:String(T.target)}:{},args:Fj(T.args,`${r}.args`,t)}}function pM(E,r,t){let T=Array.isArray(E)?Object.fromEntries(E.map((d)=>String(d).split("=",2))):tt(E),_=String(T["ts-cloud.domains"]??T["ts-cloud.domain"]??"").split(",").map((d)=>d.trim()).filter(Boolean);for(let d of _)if(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(d))t.push({severity:"error",path:r,code:"domain.invalid",message:`Invalid service domain ${d}.`});return _.filter((d)=>/\./.test(d))}function oM(E,r){let t=[],T=new Set,_=new Set,d=(e)=>{if(_.has(e))return;if(T.has(e)){r.push({severity:"error",path:`services.${e}.depends_on`,code:"dependency.cycle",message:"Service dependencies contain a cycle."});return}T.add(e);for(let h of E[e]?.dependsOn??[])if(!E[h.service])r.push({severity:"error",path:`services.${e}.depends_on.${h.service}`,code:"dependency.missing",message:`Dependency ${h.service} does not exist.`});else d(h.service);T.delete(e),_.add(e),t.push(e)};return Object.keys(E).sort().forEach(d),t}function Re(E,r){if(Buffer.byteLength(E)>524288)throw Error("Compose source exceeds the 512 KiB limit");let t;try{t=tt(Bun.YAML.parse(E))}catch(L){throw Error(`Compose YAML could not be parsed: ${L instanceof Error?L.message:String(L)}`)}let T=[],_=tt(t.services),d=Object.keys(_);if(!d.length)T.push({severity:"error",path:"services",code:"services.required",message:"At least one service is required."});if(d.length>64)T.push({severity:"error",path:"services",code:"services.limit",message:"A Compose application may contain at most 64 services."});let e=new Set(Object.keys(tt(t.volumes))),h=new Set(Object.keys(tt(t.networks))),R={};for(let L of d.sort()){let O=`services.${L}`,I=tt(_[L]);if(!jj.test(L)){T.push({severity:"error",path:O,code:"service.name",message:"Service names must be portable lowercase identifiers."});continue}for(let[Q,V]of Xj)if(I[Q]!=null&&I[Q]!==!1&&(!Array.isArray(I[Q])||I[Q].length))T.push({severity:"error",path:`${O}.${Q}`,code:`unsafe.${Q}`,message:V});for(let Q of Object.keys(I))if(!nM.has(Q)&&!Xj.has(Q))T.push({severity:"warning",path:`${O}.${Q}`,code:"field.unsupported",message:`Compose field ${Q} is not in the supported subset and will not be deployed.`});let D=I.image?String(I.image):void 0,$=sM(I.build,`${O}.build`,T);if(!D&&!$)T.push({severity:"error",path:O,code:"service.source",message:"Each service requires image or build."});if(D&&!D.includes("@sha256:")&&(!D.includes(":")||D.endsWith(":latest")))T.push({severity:"warning",path:`${O}.image`,code:"image.floating",message:`Image ${D} is not pinned to a digest or explicit tag.`});let C=AD(I.networks).map((Q)=>typeof Q==="string"?Q:String(tt(Q).name??"")).filter(Boolean);C.forEach((Q)=>h.add(Q));let y=tt(I.deploy),j=tt(y.resources),B=tt(j.limits),f=["no","always","on-failure","unless-stopped"].includes(String(I.restart))?String(I.restart):"unless-stopped";R[L]={name:L,...D?{image:D}:{},...$?{build:$}:{},...GA(I.command)?{command:GA(I.command)}:{},...GA(I.entrypoint)?{entrypoint:GA(I.entrypoint)}:{},environment:Fj(I.environment,`${O}.environment`,T),ports:iM(I.ports,`${O}.ports`,T),volumes:aM(I.volumes,e,`${O}.volumes`,T),networks:C,dependsOn:mM(I.depends_on),...yj(I.healthcheck)?{healthCheck:yj(I.healthcheck)}:{},restart:f,...Number(B.cpus)>0?{cpu:Number(B.cpus)}:{},...Jj(B.memory)?{memoryMb:Jj(B.memory)}:{},replicas:Math.max(1,Math.min(100,Number(y.replicas)||1)),domains:pM(I.labels,`${O}.labels`,T)}}let N=oM(R,T),A={apiVersion:"ts-cloud.dev/v1",kind:"ComposeApplication",metadata:{name:r.name.trim(),slug:vM(r.slug??r.name),projectId:r.projectId,environmentId:r.environmentId},spec:{services:R,networks:[...h].sort(),volumes:[...e].sort(),dependencyOrder:N}},S=MA(A);return{valid:!T.some((L)=>L.severity==="error"),manifest:A,diagnostics:T,redactedSource:S,sourceHash:bM("sha256").update(E).digest("hex")}}function MA(E){let r=Object.fromEntries(Object.entries(E.spec.services).map(([t,T])=>[t,{...T.image?{image:T.image}:{},...T.build?{build:{context:T.build.context,dockerfile:T.build.dockerfile,...T.build.target?{target:T.build.target}:{},...Object.keys(T.build.args).length?{args:Object.fromEntries(Object.entries(T.build.args).map(([_,d])=>[_,typeof d==="string"?d:`\${${d.secretRef}:?required secret ${d.secretRef}}`]))}:{}}}:{},...T.command?{command:T.command}:{},...T.entrypoint?{entrypoint:T.entrypoint}:{},...Object.keys(T.environment).length?{environment:Object.fromEntries(Object.entries(T.environment).map(([_,d])=>[_,typeof d==="string"?d:`\${${d.secretRef}:?required secret ${d.secretRef}}`]))}:{},...T.ports.length?{ports:T.ports.map((_)=>`${_.published?`${_.published}:`:""}${_.target}${_.protocol==="udp"?"/udp":""}`)}:{},...T.volumes.length?{volumes:T.volumes.map((_)=>`${_.source}:${_.target}${_.readOnly?":ro":""}`)}:{},...T.networks.length?{networks:T.networks}:{},...T.dependsOn.length?{depends_on:Object.fromEntries(T.dependsOn.map((_)=>[_.service,{condition:_.condition}]))}:{},...T.healthCheck?{healthcheck:{test:T.healthCheck.test,interval:`${T.healthCheck.intervalSeconds}s`,timeout:`${T.healthCheck.timeoutSeconds}s`,retries:T.healthCheck.retries,...T.healthCheck.startPeriodSeconds!=null?{start_period:`${T.healthCheck.startPeriodSeconds}s`}:{}}}:{},restart:T.restart,...T.cpu||T.memoryMb||T.replicas!==1?{deploy:{replicas:T.replicas,resources:{limits:{...T.cpu?{cpus:String(T.cpu)}:{},...T.memoryMb?{memory:`${T.memoryMb}M`}:{}}}}}:{},...T.domains.length?{labels:{"ts-cloud.domains":T.domains.join(",")}}:{}}]));return Bun.YAML.stringify({services:r,...E.spec.networks.length?{networks:Object.fromEntries(E.spec.networks.map((t)=>[t,{}]))}:{},...E.spec.volumes.length?{volumes:Object.fromEntries(E.spec.volumes.map((t)=>[t,{}]))}:{}})}function SD(E,r){let t=[],T=(_,d,e)=>{if(JSON.stringify(d)===JSON.stringify(e))return;if(d&&e&&typeof d==="object"&&typeof e==="object"&&!Array.isArray(d)&&!Array.isArray(e)){for(let h of[...new Set([...Object.keys(d),...Object.keys(e)])].sort())T(_?`${_}.${h}`:h,d[h],e[h]);return}t.push({path:_,...d!==void 0?{before:d}:{},...e!==void 0?{after:e}:{}})};return T("",E,r),t}import{createHash as zj}from"node:crypto";var E8="2026-07-21T00:00:00.000Z",Bj=[{id:"bun-postgres-redis",name:"Bun + Postgres + Redis",description:"Web and worker services with durable Postgres and Redis dependencies.",category:"application",version:"1.0.0",sourceVersion:"oven/bun:1.2.21,postgres:17.5,redis:8.0.3",architecture:"web → Postgres + Redis; worker → Postgres + Redis",minimumResources:{cpu:2,memoryMb:3072},exposedServices:["web"],maintenanceNotes:"Back up the Postgres volume before major upgrades.",inputs:[{name:"domain",label:"Web domain",required:!0,secret:!1}],source:`services:
+      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[_,E,E_(d),this.encrypt(e),this.encrypt(h),r,t,N,R]),{transaction:this.getOidcTransaction(_),state:d,nonce:e,verifier:h}}getOidcTransaction(E){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(E);return r?Zy(r,this.now()):void 0}consumeOidcTransaction(E,r){return this.controlPlane.transaction(()=>{let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(E,E_(r));if(!t)throw Error("OIDC transaction is invalid");let T=Zy(t,this.now());if(T.state!=="pending")throw Error(`OIDC transaction is ${T.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),T.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(T.id),nonce:this.decrypt(String(t.nonce_ciphertext)),verifier:this.decrypt(String(t.verifier_ciphertext))}})}getOidcSubject(E,r){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(E,r);return t?E8(t):void 0}linkOidcSubject(E,r,t,T){let _=this.getOidcProvider(E),d=this.getIdentity(r);if(!_||!d)throw Error("OIDC provider or identity was not found");let e=GU(T);if(!t.trim()||t.length>512)throw Error("OIDC subject is invalid");let h=this.getOidcSubject(E,t);if(h&&h.identityId!==r)throw Error("OIDC subject is already linked to another identity");let R=this.now();if(h)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[e,R,h.id]),this.getOidcSubject(E,t);let N=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[N,E,r,t,e,R,R]),this.getOidcSubject(E,t)}purgeExpired(){let E=this.now(),r=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[E]).changes,t=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[E,E]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[E]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[E]),{actionTokens:r,sessions:t}}}async function jA(E,r){let t=E.notifications?.email?.from;if(!t)return!1;try{let{EmailClient:T}=await Promise.resolve().then(() => ($R(),yA));return await new T({region:E.project.region,defaultFrom:t}).send(r),!0}catch{return!1}}import{randomBytes as d8}from"node:crypto";import{chmodSync as e8,existsSync as h8,mkdirSync as R8,readFileSync as N8,writeFileSync as A8}from"node:fs";import{dirname as S8,join as iy}from"node:path";var ay=iy(".ts-cloud","auth-encryption-key");function Gr(E){let r=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(r)return r;let t=iy(E,ay);try{if(h8(t)){let _=N8(t,"utf8").trim();if(_)return _}}catch{}let T=d8(32).toString("base64url");try{R8(S8(t),{recursive:!0,mode:448}),A8(t,`${T}
+`,{mode:384}),e8(t,384)}catch{}return T}import{constants as my,createHash as PU,createPublicKey as L8,createVerify as O8,timingSafeEqual as c8}from"node:crypto";var py=new Set(["RS256","PS256","ES256"]),sy=60;function D0(E,r){let t=new URL(E),T=["127.0.0.1","::1","localhost"].includes(t.hostname);if(t.protocol!=="https:"&&!(t.protocol==="http:"&&T))throw Error(`${r} must use HTTPS`);if(t.username||t.password||t.hash)throw Error(`${r} contains unsupported URL components`);return t}function KU(E,r){if(!E||typeof E!=="object"||Array.isArray(E))throw Error(`${r} is invalid`);return E}async function ZU(E,r){if(!E.ok)throw Error(`${r} failed with HTTP ${E.status}`);if(!(E.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${r} returned an unsupported content type`);if(Number(E.headers.get("content-length")??0)>1048576)throw Error(`${r} response is too large`);let _=await E.text();if(_.length>1048576)throw Error(`${r} response is too large`);try{return KU(JSON.parse(_),r)}catch(d){if(d instanceof Error&&d.message===`${r} is invalid`)throw d;throw Error(`${r} returned invalid JSON`)}}function I8(E,r){let t=PU("sha256").update(E).digest(),T=PU("sha256").update(r).digest();return c8(t,T)}function oy(E){if(!E)return"/";let r=E.trim();if(!r.startsWith("/")||r.startsWith("//")||r.includes("\\")||/[\r\n]/.test(r))return"/";try{let t=new URL(r,"https://local.invalid");return t.origin==="https://local.invalid"?`${t.pathname}${t.search}${t.hash}`:"/"}catch{return"/"}}async function FA(E,r=fetch){let t=D0(E.issuer,"OIDC issuer"),T=new URL(`${t.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,t.origin),_=await ZU(await r(T,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(_.issuer!==E.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let e of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof _[e]!=="string")throw Error(`OIDC discovery is missing ${e}`);D0(_[e],`OIDC ${e}`)}if(Array.isArray(_.response_types_supported)&&!_.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(_.code_challenge_methods_supported)&&!_.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let d=Array.isArray(_.id_token_signing_alg_values_supported)?_.id_token_signing_alg_values_supported.filter((e)=>typeof e==="string"):[];if(d.length>0&&!d.some((e)=>py.has(e)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return _}async function gU(E,r,t,T,_=fetch){let d=E.getOidcProviderBySlug(r);if(!d?.enabled)throw Error("OIDC provider is unavailable");let e=D0(t,"Application origin").origin,h=await FA(d,_),R=`${e}/auth/oidc/${encodeURIComponent(d.slug)}/callback`,N=E.beginOidcTransaction(d.id,R,oy(T)),A=new URL(h.authorization_endpoint);return A.searchParams.set("response_type","code"),A.searchParams.set("client_id",d.clientId),A.searchParams.set("redirect_uri",R),A.searchParams.set("scope",d.scopes.join(" ")),A.searchParams.set("state",N.state),A.searchParams.set("nonce",N.nonce),A.searchParams.set("code_challenge",PU("sha256").update(N.verifier).digest("base64url")),A.searchParams.set("code_challenge_method","S256"),{authorizationUrl:A.href,expiresAt:N.transaction.expiresAt}}function U8(E){if(E.length>32768)throw Error("OIDC ID token is too large");let r=E.split(".");if(r.length!==3||r.some((t)=>!t))throw Error("OIDC ID token is malformed");try{return{header:KU(JSON.parse(Buffer.from(r[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:KU(JSON.parse(Buffer.from(r[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${r[0]}.${r[1]}`,signature:Buffer.from(r[2],"base64url")}}catch(t){if(t instanceof Error&&t.message.startsWith("OIDC"))throw t;throw Error("OIDC ID token is malformed")}}async function D8(E,r,t){let T=U8(E),_=typeof T.header.alg==="string"?T.header.alg:"",d=typeof T.header.kid==="string"?T.header.kid:"";if(!py.has(_)||!d)throw Error("OIDC ID token uses an unsupported signing key");if(r.id_token_signing_alg_values_supported&&!r.id_token_signing_alg_values_supported.includes(_))throw Error("OIDC ID-token algorithm was not advertised by the provider");let e=await ZU(await t(r.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(e.keys))throw Error("OIDC signing-key response is invalid");let h=e.keys.find((S)=>{if(!S||typeof S!=="object"||Array.isArray(S))return!1;let L=S;return L.kid===d&&(!L.alg||L.alg===_)&&(!L.use||L.use==="sig")});if(!h)throw Error("OIDC ID-token signing key was not found");let R=L8({key:h,format:"jwk"}),N=O8("SHA256").update(T.signingInput).end();if(!(_==="PS256"?N.verify({key:R,padding:my.RSA_PKCS1_PSS_PADDING,saltLength:32},T.signature):_==="ES256"?N.verify({key:R,dsaEncoding:"ieee-p1363"},T.signature):N.verify(R,T.signature)))throw Error("OIDC ID-token signature is invalid");return T.claims}function $8(E,r,t,T){if(E.iss!==r.issuer)throw Error("OIDC ID-token issuer is invalid");let _=typeof E.aud==="string"?[E.aud]:Array.isArray(E.aud)?E.aud.filter((R)=>typeof R==="string"):[];if(!_.includes(r.clientId))throw Error("OIDC ID-token audience is invalid");if((_.length>1||E.azp!==void 0)&&E.azp!==r.clientId)throw Error("OIDC ID-token authorized party is invalid");let d=Math.floor(T.getTime()/1000);if(typeof E.exp!=="number"||E.exp<d-sy)throw Error("OIDC ID token is expired");if(typeof E.iat!=="number"||E.iat>d+sy)throw Error("OIDC ID-token issued-at time is invalid");if(typeof E.nonce!=="string"||!I8(E.nonce,t))throw Error("OIDC ID-token nonce is invalid");if(typeof E.sub!=="string"||!E.sub||E.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(E.email_verified!==!0||typeof E.email!=="string")throw Error("OIDC provider did not return a verified email address");let e=E.email.trim().toLowerCase();if(e.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))throw Error("OIDC provider returned an invalid email address");let h=e.split("@")[1];if(!h||!r.allowedDomains.includes(h))throw Error("OIDC email domain is not allowed for this organization");return{provider:r,subject:E.sub,email:e,name:typeof E.name==="string"?E.name.slice(0,120):void 0,claims:E}}async function qU(E,r,t=fetch){let T=E.getOidcProviderBySlug(r.providerSlug);if(!T?.enabled)throw Error("OIDC provider is unavailable");if(!r.state||r.state.length>512||!r.code||r.code.length>4096)throw Error("OIDC callback is incomplete");let _=D0(r.origin,"Application origin").origin,d=E.consumeOidcTransaction(T.id,r.state),e=`${_}/auth/oidc/${encodeURIComponent(T.slug)}/callback`;if(d.transaction.redirectUri!==e)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:h}=E.getOidcProviderCredentials(T.id),R=await FA(T,t),N=new URLSearchParams({grant_type:"authorization_code",code:r.code,redirect_uri:d.transaction.redirectUri,code_verifier:d.verifier}),A={accept:"application/json","content-type":"application/x-www-form-urlencoded"},S=R.token_endpoint_auth_methods_supported??["client_secret_basic"];if(S.includes("client_secret_basic")){let I=($)=>new URLSearchParams({value:$}).toString().slice(6),D=`${I(T.clientId)}:${I(h)}`;A.authorization=`Basic ${Buffer.from(D).toString("base64")}`}else if(S.includes("client_secret_post"))N.set("client_id",T.clientId),N.set("client_secret",h);else throw Error("OIDC provider does not support a configured client authentication method");let L=await ZU(await t(R.token_endpoint,{method:"POST",headers:A,body:N,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof L.id_token!=="string")throw Error("OIDC token response did not include an ID token");let O=await D8(L.id_token,R,t);return{identity:$8(O,T,d.nonce,r.now??new Date),returnPath:d.transaction.returnPath}}rh();zA();YA();rt();import{createHash as yM}from"node:crypto";class QA extends Error{constructor(){super("Operation cancellation was requested")}}class H0 extends Error{timeoutSeconds;constructor(E){super(`Operation exceeded its ${E}s timeout`);this.timeoutSeconds=E}}class t_ extends Error{errorClass;constructor(E,r){super(E);this.errorClass=r}}rt();var f0={project:2,environment:1,provider:2,builds:1},Z8=30,$j=16384,g8=["succeeded","failed","cancelled","timed_out"];function Th(E){return typeof E==="string"&&E?E:void 0}function q8(E){try{let r=JSON.parse(String(E));return Array.isArray(r)?r.map(String):[]}catch{return[]}}function x8(E){return{operationId:String(E.operation_id),lockKey:Th(E.lock_key),providerKey:Th(E.provider_key),buildSlot:Number(E.build_slot)===1,maxAttempts:Number(E.max_attempts),availableAt:String(E.available_at),timeoutSeconds:Number(E.timeout_seconds),heartbeatAt:Th(E.heartbeat_at),currentStep:Th(E.current_step),blockedReason:Th(E.blocked_reason),retryClasses:q8(E.retry_classes),resumePolicy:String(E.resume_policy),cancellationMode:String(E.cancellation_mode),retentionUntil:String(E.retention_until),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function wj(E){return{sequence:Number(E.sequence),id:String(E.id),operationId:String(E.operation_id),stream:String(E.stream),step:Th(E.step),message:String(E.message),redacted:Number(E.redacted)===1,truncated:Number(E.truncated)===1,createdAt:String(E.created_at)}}function KT(E,r,t){return Number.isFinite(E)?Math.min(t,Math.max(1,Math.floor(E))):r}class aE{controlPlane;nowFn;idFn;workerId;leaseMs;limits;constructor(E,r={}){this.controlPlane=E;this.workerId=r.workerId??`worker:${process.pid}:${crypto.randomUUID()}`,this.leaseMs=KT(r.leaseMs,60000,3600000),this.nowFn=r.now??(()=>new Date),this.idFn=r.id??(()=>crypto.randomUUID());let t=E.getSetting("queue.concurrency");this.limits={project:KT(r.limits?.project??t?.project,f0.project,100),environment:KT(r.limits?.environment??t?.environment,f0.environment,100),provider:KT(r.limits?.provider??t?.provider,f0.provider,100),builds:KT(r.limits?.builds??t?.builds,f0.builds,100)}}now(){return this.nowFn().toISOString()}leaseExpiry(){return new Date(this.nowFn().getTime()+this.leaseMs).toISOString()}enqueue(E){let r=this.controlPlane.createOperation(E);if(this.getJob(r.id))return this.view(r.id);let T=this.now(),_=KT(E.maxAttempts,1,20),d=KT(E.timeoutSeconds,1800,86400),e=KT(E.retentionDays,Z8,3650),h=E.availableAt?new Date(E.availableAt).toISOString():T,R=new Date(this.nowFn().getTime()+e*24*60*60*1000).toISOString();return this.controlPlane.database.run(`INSERT OR IGNORE INTO operation_jobs (operation_id, lock_key, provider_key, build_slot, max_attempts, available_at, timeout_seconds, retry_classes, resume_policy, cancellation_mode, retention_until, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r.id,E.lockKey??E.resourceId??null,E.providerKey??null,E.buildSlot?1:0,_,h,d,JSON.stringify([...new Set(E.retryClasses??[])]),E.resumePolicy??"fail",E.cancellationMode??"cooperative",R,T,T]),this.appendLog(r.id,"Queued for durable execution.",{stream:"system"}),this.view(r.id)}getJob(E){let r=this.controlPlane.database.query("SELECT * FROM operation_jobs WHERE operation_id=?").get(E);return r?x8(r):void 0}view(E){let r=this.controlPlane.getOperation(E),t=this.getJob(E);if(!r||!t)return;let T;if(r.state==="queued")T={ahead:Number(this.controlPlane.database.query("SELECT COUNT(*) AS count FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='queued' AND j.available_at<=? AND (o.priority>? OR (o.priority=? AND o.created_at<?))").get(this.now(),r.priority,r.priority,r.createdAt)?.count??0),precision:"bounded"};return{operation:r,job:t,approximatePosition:T}}list(E={}){return this.controlPlane.listOperations({projectId:E.projectId,state:E.state,limit:E.limit??200}).map((r)=>this.view(r.id)).filter((r)=>!!r)}configureConcurrency(E,r={}){let t={project:KT(E.project,this.limits.project,100),environment:KT(E.environment,this.limits.environment,100),provider:KT(E.provider,this.limits.provider,100),builds:KT(E.builds,this.limits.builds,100)};return Object.assign(this.limits,t),this.controlPlane.setSetting("queue.concurrency",t),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:r.actorId,type:"queue.concurrency.updated",level:"warning",payload:t}),t}runningCount(E,r){return Number(this.controlPlane.database.query(E).get(...r)?.count??0)}blockReason(E,r){if(r.lockKey){if(this.controlPlane.database.query("SELECT * FROM operation_locks WHERE lock_key=? AND operation_id!=? AND lease_expires_at>?").get(r.lockKey,E.id,this.now()))return`resource_lock:${r.lockKey}`}if(E.projectId&&this.runningCount("SELECT COUNT(*) AS count FROM operations WHERE state='running' AND project_id=?",[E.projectId])>=this.limits.project)return"project_concurrency";if(E.environmentId&&this.runningCount("SELECT COUNT(*) AS count FROM operations WHERE state='running' AND environment_id=?",[E.environmentId])>=this.limits.environment)return"environment_concurrency";if(r.providerKey&&this.runningCount("SELECT COUNT(*) AS count FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='running' AND j.provider_key=?",[r.providerKey])>=this.limits.provider)return"provider_concurrency";if(r.buildSlot&&this.runningCount("SELECT COUNT(*) AS count FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='running' AND j.build_slot=1",[])>=this.limits.builds)return"build_concurrency";return}claim(E){return this.controlPlane.transaction(()=>{let r=this.now();this.controlPlane.database.run("DELETE FROM operation_locks WHERE lease_expires_at<=?",[r]);let t=this.controlPlane.getOperation(E),T=t?this.getJob(t.id):void 0;if(!t||!T||t.state!=="queued"||T.availableAt>r)return;if(t.cancelRequestedAt){this.controlPlane.transitionOperation(t.id,{to:"cancelled",expectedVersion:t.version,output:{cancelledBeforeStart:!0}}),this.appendLog(t.id,"Cancelled before execution began.",{stream:"system"});return}let _=this.blockReason(t,T);if(_){this.controlPlane.database.run("UPDATE operation_jobs SET blocked_reason=?, updated_at=? WHERE operation_id=?",[_,r,t.id]);return}let d=this.controlPlane.claimOperation(t.id,this.workerId,this.leaseMs);if(!d)return;let e=d.leaseExpiresAt??this.leaseExpiry();if(T.lockKey)this.controlPlane.database.run("INSERT INTO operation_locks (lock_key, operation_id, lease_owner, lease_expires_at, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)",[T.lockKey,t.id,this.workerId,e,r,r]);return this.controlPlane.database.run("UPDATE operation_jobs SET heartbeat_at=?, blocked_reason=NULL, updated_at=? WHERE operation_id=?",[r,r,t.id]),this.appendLog(t.id,`Claimed by ${this.workerId}; attempt ${d.attempt}.`,{stream:"system"}),this.view(t.id)})}claimNext(E){let r=this.now(),t=E?.length?`AND o.kind IN (${E.map(()=>"?").join(",")})`:"",T=this.controlPlane.database.query(`SELECT o.id FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='queued' AND j.available_at<=? ${t} ORDER BY o.priority DESC, o.created_at ASC, o.rowid ASC LIMIT 100`).all(r,...E??[]);for(let _ of T){let d=this.claim(String(_.id));if(d)return d}return}heartbeat(E,r){let t=this.controlPlane.getOperation(E);if(!t||t.state!=="running"||t.leaseOwner!==this.workerId)throw Error("Operation lease is not owned by this worker");let T=this.now(),_=this.leaseExpiry(),d=this.getJob(E);if(this.controlPlane.database.run("UPDATE operations SET lease_expires_at=?, updated_at=?, version=version+1 WHERE id=? AND state='running' AND lease_owner=? AND version=?",[_,T,E,this.workerId,t.version]).changes!==1)throw Error("Operation lease changed before heartbeat");if(this.controlPlane.database.run("UPDATE operation_jobs SET heartbeat_at=?, current_step=COALESCE(?, current_step), updated_at=? WHERE operation_id=?",[T,r??null,T,E]),d?.lockKey)this.controlPlane.database.run("UPDATE operation_locks SET lease_expires_at=?, updated_at=? WHERE lock_key=? AND operation_id=? AND lease_owner=?",[_,T,d.lockKey,E,this.workerId]);if(r&&r!==d?.currentStep)this.controlPlane.appendEvent({projectId:t.projectId,operationId:E,resourceId:t.resourceId,actorId:t.actorId,correlationId:t.correlationId,type:"operation.step",payload:{step:r}})}appendLog(E,r,t={}){if(!this.getJob(E))throw Error(`Queue job ${E} was not found`);let T=r,_=!1;for(let A of t.secrets??[])if(A&&T.includes(A))T=T.split(A).join("[REDACTED]"),_=!0;let d=ZE({message:T});if(d.message!==T)_=!0;T=d.message??"[output unavailable]";let e=Buffer.from(T),h=e.byteLength>$j;if(h)T=`${e.subarray(0,$j-32).toString("utf8")}
+[output truncated]`;let R=this.idFn(),N=this.now();return this.controlPlane.database.run("INSERT INTO operation_logs (id, operation_id, stream, step, message, redacted, truncated, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",[R,E,t.stream??"stdout",t.step??null,T,_?1:0,h?1:0,N]),wj(this.controlPlane.database.query("SELECT * FROM operation_logs WHERE id=?").get(R))}logs(E,r={}){let t=Math.min(1000,Math.max(1,r.limit??200));return this.controlPlane.database.query("SELECT * FROM operation_logs WHERE operation_id=? AND sequence>? ORDER BY sequence ASC LIMIT ?").all(E,r.after??0,t).map(wj)}requestCancellation(E,r){let t=this.controlPlane.getOperation(E);if(!t||g8.includes(t.state))throw Error("Only queued or running operations can be cancelled");let T=this.controlPlane.requestCancellation(E);if(this.controlPlane.appendEvent({projectId:t.projectId,operationId:E,resourceId:t.resourceId,actorId:r,correlationId:t.correlationId,type:"operation.cancellation_requested",level:"warning",payload:{state:t.state}}),this.appendLog(E,t.state==="queued"?"Cancellation accepted before execution.":"Cancellation requested; waiting for the current provider step.",{stream:"system"}),T.state==="queued")return this.finish(E,"cancelled",{cancelledBeforeStart:!0});return T}retry(E,r,t={}){let T=this.controlPlane.getOperation(E),_=this.getJob(E);if(!T||!_||!["failed","cancelled","timed_out"].includes(T.state))throw Error("Only failed, cancelled, or timed-out queue jobs can be retried");if(T.attempt>=_.maxAttempts)throw Error(`Operation reached its ${_.maxAttempts}-attempt limit`);if(!_.retryClasses.includes(r))throw Error(`Retry class ${r} is not allowed for this operation`);let d=this.controlPlane.transitionOperation(E,{to:"queued",expectedVersion:T.version,error:`Retry requested after ${r}`}),e=new Date(this.nowFn().getTime()+Math.max(0,t.delayMs??0)).toISOString();return this.controlPlane.database.run("UPDATE operations SET cancel_requested_at=NULL, finished_at=NULL WHERE id=?",[E]),this.controlPlane.database.run("UPDATE operation_jobs SET available_at=?, blocked_reason=NULL, updated_at=? WHERE operation_id=?",[e,this.now(),E]),this.controlPlane.appendEvent({projectId:T.projectId,operationId:E,resourceId:T.resourceId,actorId:t.actorId,correlationId:T.correlationId,type:"operation.retry_requested",payload:{errorClass:r,availableAt:e,nextAttempt:T.attempt+1}}),this.appendLog(E,`Retry queued for error class ${r}.`,{stream:"system"}),this.controlPlane.getOperation(d.id)}release(E){this.controlPlane.database.run("DELETE FROM operation_locks WHERE operation_id=?",[E])}finish(E,r,t={},T){let _=this.controlPlane.getOperation(E);if(!_)throw Error(`Operation ${E} was not found`);let d=this.controlPlane.transitionOperation(E,{to:r,expectedVersion:_.version,output:t,error:T});return this.release(E),d}complete(E,r={}){let t=this.controlPlane.getOperation(E);if(!t||t.state!=="running"||t.leaseOwner!==this.workerId)throw Error("Only the lease owner can complete a running operation");return this.appendLog(E,"Operation completed successfully.",{stream:"system"}),this.finish(E,"succeeded",r)}fail(E,r,t={}){let T=this.controlPlane.getOperation(E);if(!T||T.state!=="running"||T.leaseOwner!==this.workerId)throw Error("Only the lease owner can fail a running operation");return this.appendLog(E,r,{stream:"stderr"}),this.finish(E,"failed",t,r)}async runOne(E){let r=this.claimNext(Object.keys(E));if(!r)return{handled:!1};let{operation:t,job:T}=r,_=E[t.kind];if(!_)return{handled:!1};let d=new AbortController,e=!1,h=setTimeout(()=>{e=!0,d.abort(new H0(T.timeoutSeconds))},T.timeoutSeconds*1000),R=setInterval(()=>{try{this.heartbeat(t.id)}catch{}},Math.max(250,Math.floor(this.leaseMs/3))),N=setInterval(()=>{if(this.controlPlane.getOperation(t.id)?.cancelRequestedAt)d.abort(new QA)},100),A={operation:t,signal:d.signal,log:(S,L)=>this.appendLog(t.id,S,L),checkpoint:(S,L)=>{this.heartbeat(t.id,S),this.appendLog(t.id,L??S,{stream:"step",step:S})},heartbeat:()=>this.heartbeat(t.id),cancellationRequested:()=>!!this.controlPlane.getOperation(t.id)?.cancelRequestedAt,throwIfCancellationRequested:()=>{if(this.controlPlane.getOperation(t.id)?.cancelRequestedAt)throw new QA}};try{let S=await Promise.race([_(A),new Promise((I,D)=>d.signal.addEventListener("abort",()=>D(d.signal.reason),{once:!0}))]);if(this.controlPlane.getOperation(t.id).cancelRequestedAt){let I=T.cancellationMode==="provider_non_cancellable";return this.appendLog(t.id,I?"Provider step completed after cancellation was requested; reconciliation is required.":"Operation cancelled cooperatively.",{stream:"system"}),{handled:!0,operation:this.finish(t.id,"cancelled",{providerCompleted:I,reconciliationRequired:I}),terminalState:"cancelled"}}return{handled:!0,operation:this.complete(t.id,S??{}),terminalState:"succeeded"}}catch(S){if(e||S instanceof H0)return this.appendLog(t.id,`Timed out after ${T.timeoutSeconds}s.`,{stream:"system"}),{handled:!0,operation:this.finish(t.id,"timed_out",{reconciliationRequired:T.cancellationMode==="provider_non_cancellable"},S instanceof Error?S.message:String(S)),terminalState:"timed_out"};if(S instanceof QA||this.controlPlane.getOperation(t.id)?.cancelRequestedAt)return{handled:!0,operation:this.finish(t.id,"cancelled",{cooperativelyCancelled:!0}),terminalState:"cancelled"};if(S instanceof t_&&T.retryClasses.includes(S.errorClass)&&t.attempt<T.maxAttempts){let I=this.controlPlane.getOperation(t.id);this.controlPlane.transitionOperation(t.id,{to:"queued",expectedVersion:I.version,error:S.message});let D=Math.min(60000,1000*2**Math.max(0,t.attempt-1)),$=new Date(this.nowFn().getTime()+D).toISOString();return this.controlPlane.database.run("UPDATE operation_jobs SET available_at=?, blocked_reason=?, updated_at=? WHERE operation_id=?",[$,`retry_backoff:${S.errorClass}`,this.now(),t.id]),this.release(t.id),this.appendLog(t.id,`Retryable ${S.errorClass} failure; next attempt is delayed.`,{stream:"system"}),{handled:!0,operation:this.controlPlane.getOperation(t.id),requeued:!0}}let L=S instanceof Error?S.message:String(S);return this.appendLog(t.id,L,{stream:"stderr"}),{handled:!0,operation:this.finish(t.id,"failed",{},L),terminalState:"failed"}}finally{clearTimeout(h),clearInterval(R),clearInterval(N)}}recoverExpired(){let E=this.controlPlane.database.query("SELECT o.id FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='running' AND (o.lease_expires_at IS NULL OR o.lease_expires_at<=?)").all(this.now()),r={requeued:0,failed:0,cancelled:0};for(let t of E){let T=this.controlPlane.getOperation(String(t.id)),_=this.getJob(T.id);if(this.release(T.id),T.cancelRequestedAt){this.finish(T.id,"cancelled",{recoveredAfterWorkerLoss:!0}),r.cancelled++;continue}if(_.resumePolicy==="requeue"&&T.attempt<_.maxAttempts)this.controlPlane.transitionOperation(T.id,{to:"queued",expectedVersion:T.version,error:"Worker lease expired; safely requeued from the last checkpoint."}),this.controlPlane.database.run("UPDATE operation_jobs SET available_at=?, blocked_reason='worker_restart', updated_at=? WHERE operation_id=?",[this.now(),this.now(),T.id]),this.appendLog(T.id,"Worker lease expired; operation requeued from its persisted checkpoint.",{stream:"system"}),r.requeued++;else this.finish(T.id,"failed",{recoverable:!0,lastCheckpoint:_.currentStep??null},"Worker lease expired; retry explicitly after reconciling provider state."),r.failed++}return r}clearCompleted(E={}){let r=this.now(),t=[r],T=E.projectId?"AND o.project_id=?":"";if(E.projectId)t.push(E.projectId);let _=E.before?"AND o.finished_at<=?":"";if(E.before)t.push(new Date(E.before).toISOString());let d=this.controlPlane.database.query(`SELECT o.id, o.project_id, o.correlation_id FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state IN ('succeeded','failed','cancelled','timed_out') AND j.retention_until<=? ${T} ${_}`).all(...t);for(let e of d)this.controlPlane.appendEvent({projectId:Th(e.project_id),actorId:E.actorId,correlationId:String(e.correlation_id),type:"queue.history.cleared",level:"warning",payload:{operationId:String(e.id),retentionCutoff:r}}),this.controlPlane.database.run("DELETE FROM operations WHERE id=?",[String(e.id)]);return d.length}}function Cj(E,r,t){if(!Number.isFinite(E))return r;return Math.min(t,Math.max(1,Math.floor(E)))}class RD{queue;handlers;parallelism;pollIntervalMs;onResult;onError;waits=new Map;lanes=[];running=!1;constructor(E,r,t={}){this.queue=E;this.handlers=r;this.parallelism=Cj(t.parallelism,4,100),this.pollIntervalMs=Cj(t.pollIntervalMs,500,60000),this.onResult=t.onResult,this.onError=t.onError}get active(){return this.running}start(){if(this.running)return this;return this.running=!0,this.lanes=Array.from({length:this.parallelism},()=>this.runLane()),this}stop(){this.running=!1;for(let[E,r]of this.waits)clearTimeout(E),r();this.waits.clear()}async settled(){await Promise.allSettled(this.lanes)}async drain(){let E=[];while(!0){let r=await Promise.all(Array.from({length:this.parallelism},()=>this.queue.runOne(this.handlers)));if(E.push(...r.filter((t)=>t.handled)),!r.some((t)=>t.handled))return E}}wait(){return new Promise((E)=>{let r=setTimeout(()=>{this.waits.delete(r),E()},this.pollIntervalMs);r.unref?.(),this.waits.set(r,E)})}async runLane(){while(this.running){try{let E=await this.queue.runOne(this.handlers);if(!this.running)break;if(E.handled){this.onResult?.(E);continue}}catch(E){this.onError?.(E)}await this.wait()}}}import{createHash as b8}from"node:crypto";var jj=/^[a-z0-9](?:[a-z0-9_.-]{0,62})$/,k8=/^[A-Za-z_][A-Za-z0-9_]{0,127}$/,u8=/(?:secret|token|password|passwd|private.?key|api.?key|credential)/i,n8=new Set(["image","build","command","entrypoint","environment","ports","volumes","networks","depends_on","healthcheck","restart","deploy","labels"]),Xj=new Map([["privileged","Privileged containers are blocked."],["network_mode","Host/custom network modes are blocked."],["pid","Host PID namespaces are blocked."],["ipc","Host IPC namespaces are blocked."],["devices","Device access is blocked."],["cap_add","Additional Linux capabilities require an external policy exception."],["security_opt","Custom security options require an external policy exception."]]);function tt(E){return E&&typeof E==="object"&&!Array.isArray(E)?E:{}}function AD(E){return Array.isArray(E)?E:E==null?[]:[E]}function v8(E){return E.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"").slice(0,63)||"compose-app"}function GA(E){if(Array.isArray(E))return E.map(String);if(typeof E==="string"&&E.trim())return["sh","-c",E];return}function ND(E,r){let t=String(E??""),T=/^(\d+(?:\.\d+)?)(ms|s|m|h)?$/.exec(t);if(!T)return r;let _=Number(T[1]);return Math.max(0,Math.round(_*(T[2]==="ms"?0.001:T[2]==="m"?60:T[2]==="h"?3600:1)))}function Jj(E){let r=/^(\d+(?:\.\d+)?)\s*(b|k|kb|kib|m|mb|mib|g|gb|gib)?$/i.exec(String(E??""));if(!r)return;let t=Number(r[1]),T=String(r[2]??"b").toLowerCase(),_=t*(T.startsWith("g")?1073741824:T.startsWith("m")?1048576:T.startsWith("k")?1024:1);return Math.max(1,Math.round(_/1024/1024))}function l8(E){if(E==null)return"";return/^\$\{([A-Za-z_][A-Za-z0-9_]*)(?::[-?][^}]*)?\}$/.exec(String(E))?.[1]}function Fj(E,r,t){let T={},_=Array.isArray(E)?E.map((d)=>{let[e,...h]=String(d).split("=");return[e,h.length?h.join("="):null]}):Object.entries(tt(E));for(let[d,e]of _){let h=String(d);if(!k8.test(h)){t.push({severity:"error",path:`${r}.${h}`,code:"environment.name",message:"Environment variable names must use portable shell identifiers."});continue}let R=l8(e);if(R!==void 0){T[h]={secretRef:R||h};continue}if(u8.test(h)){t.push({severity:"error",path:`${r}.${h}`,code:"secret.literal",message:"Literal secret-like environment values are not stored.",alternative:`Use \${${h}} and supply ${h} through the secret store.`}),T[h]={secretRef:h};continue}T[h]=String(e??"")}return T}function i8(E,r,t){let T=[];for(let[_,d]of AD(E).entries()){let e,h,R="tcp";if(typeof d==="number")e=d;else if(typeof d==="string"){let[N,A]=d.split("/");R=A==="udp"?"udp":"tcp";let S=N.split(":");e=Number(S.at(-1)),h=S.length>1?Number(S.at(-2)):void 0}else{let N=tt(d);e=Number(N.target),h=N.published==null?void 0:Number(N.published),R=N.protocol==="udp"?"udp":"tcp"}if(!Number.isInteger(e)||e<1||e>65535||h!=null&&(!Number.isInteger(h)||h<1||h>65535))t.push({severity:"error",path:`${r}[${_}]`,code:"port.invalid",message:"Ports must be integers from 1 through 65535."});else T.push({target:e,...h?{published:h}:{},protocol:R})}return T}function a8(E,r,t,T){let _=[];for(let[d,e]of AD(E).entries()){let h="",R="",N=!1,A="volume";if(typeof e==="string"){let S=e.split(":");h=S[0]??"",R=S[1]??"",N=S.slice(2).includes("ro"),A=h.startsWith("/")||h.startsWith(".")?"bind":"volume"}else{let S=tt(e);h=String(S.source??""),R=String(S.target??""),N=S.read_only===!0,A=String(S.type??"volume")}if(A!=="volume"||h.startsWith("/")||h.startsWith(".")){T.push({severity:"error",path:`${t}[${d}]`,code:"volume.host_mount",message:"Host and bind mounts are blocked; use a named volume.",alternative:"Declare the volume at the top level and mount it by name."});continue}if(!jj.test(h)||!R.startsWith("/")){T.push({severity:"error",path:`${t}[${d}]`,code:"volume.invalid",message:"A named source and absolute container target are required."});continue}if(!r.has(h))T.push({severity:"warning",path:`${t}[${d}]`,code:"volume.implicit",message:`Named volume ${h} is implicit and will be declared on export.`});r.add(h),_.push({source:h,target:R,readOnly:N})}return _}function m8(E){return Array.isArray(E)?E.map((r)=>({service:String(r),condition:"service_started"})):Object.entries(tt(E)).map(([r,t])=>({service:r,condition:["service_started","service_healthy","service_completed_successfully"].includes(String(tt(t).condition))?String(tt(t).condition):"service_started"}))}function yj(E){let r=tt(E);if(!Object.keys(r).length||r.disable===!0)return;let t=GA(r.test);return t?{test:t,intervalSeconds:ND(r.interval,30),timeoutSeconds:ND(r.timeout,5),retries:Math.max(1,Number(r.retries)||3),...r.start_period?{startPeriodSeconds:ND(r.start_period,0)}:{}}:void 0}function s8(E,r,t){if(!E)return;let T=typeof E==="string"?{context:E}:tt(E),_=String(T.context??"."),d=String(T.dockerfile??"Dockerfile");if(_.startsWith("/")||_.split("/").includes("..")||d.startsWith("/")||d.split("/").includes(".."))t.push({severity:"error",path:r,code:"build.traversal",message:"Build context and Dockerfile must stay inside the repository."});return{context:_,dockerfile:d,...T.target?{target:String(T.target)}:{},args:Fj(T.args,`${r}.args`,t)}}function p8(E,r,t){let T=Array.isArray(E)?Object.fromEntries(E.map((d)=>String(d).split("=",2))):tt(E),_=String(T["ts-cloud.domains"]??T["ts-cloud.domain"]??"").split(",").map((d)=>d.trim()).filter(Boolean);for(let d of _)if(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(d))t.push({severity:"error",path:r,code:"domain.invalid",message:`Invalid service domain ${d}.`});return _.filter((d)=>/\./.test(d))}function o8(E,r){let t=[],T=new Set,_=new Set,d=(e)=>{if(_.has(e))return;if(T.has(e)){r.push({severity:"error",path:`services.${e}.depends_on`,code:"dependency.cycle",message:"Service dependencies contain a cycle."});return}T.add(e);for(let h of E[e]?.dependsOn??[])if(!E[h.service])r.push({severity:"error",path:`services.${e}.depends_on.${h.service}`,code:"dependency.missing",message:`Dependency ${h.service} does not exist.`});else d(h.service);T.delete(e),_.add(e),t.push(e)};return Object.keys(E).sort().forEach(d),t}function Re(E,r){if(Buffer.byteLength(E)>524288)throw Error("Compose source exceeds the 512 KiB limit");let t;try{t=tt(Bun.YAML.parse(E))}catch(L){throw Error(`Compose YAML could not be parsed: ${L instanceof Error?L.message:String(L)}`)}let T=[],_=tt(t.services),d=Object.keys(_);if(!d.length)T.push({severity:"error",path:"services",code:"services.required",message:"At least one service is required."});if(d.length>64)T.push({severity:"error",path:"services",code:"services.limit",message:"A Compose application may contain at most 64 services."});let e=new Set(Object.keys(tt(t.volumes))),h=new Set(Object.keys(tt(t.networks))),R={};for(let L of d.sort()){let O=`services.${L}`,I=tt(_[L]);if(!jj.test(L)){T.push({severity:"error",path:O,code:"service.name",message:"Service names must be portable lowercase identifiers."});continue}for(let[Q,V]of Xj)if(I[Q]!=null&&I[Q]!==!1&&(!Array.isArray(I[Q])||I[Q].length))T.push({severity:"error",path:`${O}.${Q}`,code:`unsafe.${Q}`,message:V});for(let Q of Object.keys(I))if(!n8.has(Q)&&!Xj.has(Q))T.push({severity:"warning",path:`${O}.${Q}`,code:"field.unsupported",message:`Compose field ${Q} is not in the supported subset and will not be deployed.`});let D=I.image?String(I.image):void 0,$=s8(I.build,`${O}.build`,T);if(!D&&!$)T.push({severity:"error",path:O,code:"service.source",message:"Each service requires image or build."});if(D&&!D.includes("@sha256:")&&(!D.includes(":")||D.endsWith(":latest")))T.push({severity:"warning",path:`${O}.image`,code:"image.floating",message:`Image ${D} is not pinned to a digest or explicit tag.`});let C=AD(I.networks).map((Q)=>typeof Q==="string"?Q:String(tt(Q).name??"")).filter(Boolean);C.forEach((Q)=>h.add(Q));let y=tt(I.deploy),j=tt(y.resources),B=tt(j.limits),f=["no","always","on-failure","unless-stopped"].includes(String(I.restart))?String(I.restart):"unless-stopped";R[L]={name:L,...D?{image:D}:{},...$?{build:$}:{},...GA(I.command)?{command:GA(I.command)}:{},...GA(I.entrypoint)?{entrypoint:GA(I.entrypoint)}:{},environment:Fj(I.environment,`${O}.environment`,T),ports:i8(I.ports,`${O}.ports`,T),volumes:a8(I.volumes,e,`${O}.volumes`,T),networks:C,dependsOn:m8(I.depends_on),...yj(I.healthcheck)?{healthCheck:yj(I.healthcheck)}:{},restart:f,...Number(B.cpus)>0?{cpu:Number(B.cpus)}:{},...Jj(B.memory)?{memoryMb:Jj(B.memory)}:{},replicas:Math.max(1,Math.min(100,Number(y.replicas)||1)),domains:p8(I.labels,`${O}.labels`,T)}}let N=o8(R,T),A={apiVersion:"ts-cloud.dev/v1",kind:"ComposeApplication",metadata:{name:r.name.trim(),slug:v8(r.slug??r.name),projectId:r.projectId,environmentId:r.environmentId},spec:{services:R,networks:[...h].sort(),volumes:[...e].sort(),dependencyOrder:N}},S=MA(A);return{valid:!T.some((L)=>L.severity==="error"),manifest:A,diagnostics:T,redactedSource:S,sourceHash:b8("sha256").update(E).digest("hex")}}function MA(E){let r=Object.fromEntries(Object.entries(E.spec.services).map(([t,T])=>[t,{...T.image?{image:T.image}:{},...T.build?{build:{context:T.build.context,dockerfile:T.build.dockerfile,...T.build.target?{target:T.build.target}:{},...Object.keys(T.build.args).length?{args:Object.fromEntries(Object.entries(T.build.args).map(([_,d])=>[_,typeof d==="string"?d:`\${${d.secretRef}:?required secret ${d.secretRef}}`]))}:{}}}:{},...T.command?{command:T.command}:{},...T.entrypoint?{entrypoint:T.entrypoint}:{},...Object.keys(T.environment).length?{environment:Object.fromEntries(Object.entries(T.environment).map(([_,d])=>[_,typeof d==="string"?d:`\${${d.secretRef}:?required secret ${d.secretRef}}`]))}:{},...T.ports.length?{ports:T.ports.map((_)=>`${_.published?`${_.published}:`:""}${_.target}${_.protocol==="udp"?"/udp":""}`)}:{},...T.volumes.length?{volumes:T.volumes.map((_)=>`${_.source}:${_.target}${_.readOnly?":ro":""}`)}:{},...T.networks.length?{networks:T.networks}:{},...T.dependsOn.length?{depends_on:Object.fromEntries(T.dependsOn.map((_)=>[_.service,{condition:_.condition}]))}:{},...T.healthCheck?{healthcheck:{test:T.healthCheck.test,interval:`${T.healthCheck.intervalSeconds}s`,timeout:`${T.healthCheck.timeoutSeconds}s`,retries:T.healthCheck.retries,...T.healthCheck.startPeriodSeconds!=null?{start_period:`${T.healthCheck.startPeriodSeconds}s`}:{}}}:{},restart:T.restart,...T.cpu||T.memoryMb||T.replicas!==1?{deploy:{replicas:T.replicas,resources:{limits:{...T.cpu?{cpus:String(T.cpu)}:{},...T.memoryMb?{memory:`${T.memoryMb}M`}:{}}}}}:{},...T.domains.length?{labels:{"ts-cloud.domains":T.domains.join(",")}}:{}}]));return Bun.YAML.stringify({services:r,...E.spec.networks.length?{networks:Object.fromEntries(E.spec.networks.map((t)=>[t,{}]))}:{},...E.spec.volumes.length?{volumes:Object.fromEntries(E.spec.volumes.map((t)=>[t,{}]))}:{}})}function SD(E,r){let t=[],T=(_,d,e)=>{if(JSON.stringify(d)===JSON.stringify(e))return;if(d&&e&&typeof d==="object"&&typeof e==="object"&&!Array.isArray(d)&&!Array.isArray(e)){for(let h of[...new Set([...Object.keys(d),...Object.keys(e)])].sort())T(_?`${_}.${h}`:h,d[h],e[h]);return}t.push({path:_,...d!==void 0?{before:d}:{},...e!==void 0?{after:e}:{}})};return T("",E,r),t}import{createHash as zj}from"node:crypto";var EM="2026-07-21T00:00:00.000Z",Bj=[{id:"bun-postgres-redis",name:"Bun + Postgres + Redis",description:"Web and worker services with durable Postgres and Redis dependencies.",category:"application",version:"1.0.0",sourceVersion:"oven/bun:1.2.21,postgres:17.5,redis:8.0.3",architecture:"web → Postgres + Redis; worker → Postgres + Redis",minimumResources:{cpu:2,memoryMb:3072},exposedServices:["web"],maintenanceNotes:"Back up the Postgres volume before major upgrades.",inputs:[{name:"domain",label:"Web domain",required:!0,secret:!1}],source:`services:
   web:
     image: oven/bun:1.2.21
     command: [bun, run, start]
@@ -9026,22 +9026,22 @@ volumes:
 volumes:
   wordpress-data: {}
   database-data: {}
-`}];function BR(){return Bj.map(({source:E,...r})=>({...r,source:`builtin:${r.id}`,lastVerifiedAt:E8,builtin:!0,checksum:zj("sha256").update(E).digest("hex"),exposedServices:[...r.exposedServices],inputs:r.inputs.map((t)=>({...t}))}))}function Wj(E,r,t,T){let _=Bj.find((e)=>e.id===E&&(!T||e.version===T));if(!_)throw Error(`Compose template ${E}${T?`@${T}`:""} was not found`);let d=_.source;for(let e of _.inputs){let h=r[e.name]??("default"in e?e.default:void 0);if(e.required&&!h)throw Error(`Template input ${e.name} is required`);if(h&&!/^[A-Za-z0-9._:/@+-]{1,255}$/.test(h))throw Error(`Template input ${e.name} contains unsupported characters`);d=d.replaceAll(`{{${e.name}}}`,h??"")}return Re(d,t)}function Hj(E,r){if(Buffer.byteLength(E)>1048576)throw Error("Compose catalog exceeds the 1 MiB limit");let t;try{t=JSON.parse(E)}catch{throw Error("Compose catalog must be valid JSON")}if(t.apiVersion!=="ts-cloud.dev/compose-catalog/v1"||!Array.isArray(t.templates))throw Error("Compose catalog must use ts-cloud.dev/compose-catalog/v1 and contain templates");let T=String(t.source??"").trim();if(!/^https:\/\//.test(T)&&!T.startsWith("file:"))throw Error("Compose catalog source must be HTTPS or an explicit file: source");let _=[],d=[];for(let[e,h]of t.templates.slice(0,100).entries()){let R=h&&typeof h==="object"&&!Array.isArray(h)?h:{},N=`templates[${e}]`,A=String(R.compose??""),S=zj("sha256").update(A).digest("hex");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(String(R.id??""))||!/^\d+\.\d+\.\d+$/.test(String(R.version??""))){_.push({severity:"error",path:N,code:"template.identity",message:"Template id and semantic version are required."});continue}if(String(R.checksum??"")!==S){_.push({severity:"error",path:`${N}.checksum`,code:"template.checksum",message:"Template checksum does not match its Compose source."});continue}let L=Re(A,{name:String(R.name??R.id),projectId:r.projectId,environmentId:r.environmentId});_.push(...L.diagnostics.map((I)=>({...I,path:`${N}.compose.${I.path}`})));let O={id:String(R.id),name:String(R.name??R.id),description:String(R.description??""),category:String(R.category??"custom"),version:String(R.version),source:T,sourceVersion:String(R.sourceVersion??R.version),architecture:String(R.architecture??Object.keys(L.manifest.spec.services).join(" + ")),minimumResources:{cpu:Math.max(0.1,Number(R.minimumResources?.cpu)||1),memoryMb:Math.max(128,Number(R.minimumResources?.memoryMb)||512)},exposedServices:Array.isArray(R.exposedServices)?R.exposedServices.map(String):[],maintenanceNotes:String(R.maintenanceNotes??""),lastVerifiedAt:String(R.lastVerifiedAt??""),inputs:[],checksum:S,builtin:!1};d.push({template:O,parsed:L})}return{valid:!_.some((e)=>e.severity==="error"),source:T,templates:d,diagnostics:_}}var Y0=/^[a-z0-9][a-z0-9_.-]{0,62}$/;function Tt(E){return`'${E.replaceAll("'","'\\''")}'`}function Q0(E){return`${E.metadata.slug}-${E.metadata.environmentId.slice(0,8)}`.replace(/[^a-z0-9_-]/g,"-").slice(0,63)}function fj(E,r,t={}){let T=Q0(E),_=`/opt/ts-cloud/compose/${T}`,d=`${_}/compose.yaml`,e=`docker compose --project-name ${Tt(T)} --file ${Tt(d)}`;if(t.service&&!Y0.test(t.service))throw Error("Unsafe Compose service name");if(r==="deploy"||r==="redeploy"){let h=Buffer.from(MA(E)).toString("base64");return`install -d -m 0750 ${Tt(_)} && printf %s ${Tt(h)} | base64 --decode > ${Tt(d)} && chmod 0640 ${Tt(d)} && ${e} config --quiet && ${e} up --detach --remove-orphans --wait${r==="redeploy"?" --force-recreate":""}`}if(r==="start")return`${e} start${t.service?` ${Tt(t.service)}`:""}`;if(r==="stop")return`${e} stop${t.service?` ${Tt(t.service)}`:""}`;if(r==="status")return`${e} ps --format json`;return`${e} down --remove-orphans${t.removeVolumes?" --volumes":""}`}function Yj(E,r,t){if(!Y0.test(r)||!Number.isInteger(t)||t<0||t>100)throw Error("Scale requires a safe service name and 0-100 replicas");let T=Q0(E);return`docker compose --project-name ${Tt(T)} --file ${Tt(`/opt/ts-cloud/compose/${T}/compose.yaml`)} up --detach --wait --scale ${Tt(`${r}=${t}`)}`}function G0(E,r,t=200){if(!Y0.test(r))throw Error("Unsafe Compose service name");let T=Q0(E);return`docker compose --project-name ${Tt(T)} --file ${Tt(`/opt/ts-cloud/compose/${T}/compose.yaml`)} logs --no-color --timestamps --tail ${Math.max(1,Math.min(2000,Math.floor(t)))} ${Tt(r)}`}function M0(E,r,t=["sh"]){if(!Y0.test(r)||!t.length||t.some((_)=>_.includes("\x00")||_.length>1024))throw Error("Unsafe Compose shell request");let T=Q0(E);return`docker compose --project-name ${Tt(T)} --file ${Tt(`/opt/ts-cloud/compose/${T}/compose.yaml`)} exec ${Tt(r)} ${t.map(Tt).join(" ")}`}rt();import{mkdir as cD,readdir as N8,rm as A8,stat as S8}from"node:fs/promises";import{basename as L8,resolve as Gj,sep as O8}from"node:path";var LD=/^[a-z0-9][a-z0-9_.-]{1,62}$/,r8=/^0?[0-7]{3}$/,t8=["/","/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run","/var/lib/docker","/var/lib/containers"],T8=["create","attach","detach","resize","snapshot","restore","delete","adopt","usage"],_8=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function d8(E){return Object.fromEntries(T8.map((r)=>[r,{supported:!1,reason:E}]))}function OD(E,r={}){let t=d8("This storage driver does not support the operation.");for(let T of E)t[T]={supported:!0};return{...t,...r}}function e8(E){if(!E.startsWith("/")||E.includes("\x00")||E.split("/").includes(".."))throw Error("Mount target must be an absolute normalized path without traversal.");let r=E.replace(/\/+$/,"")||"/";if(t8.some((t)=>r===t||r.startsWith(`${t}/`)))throw Error(`Mount target ${E} is a protected host or runtime path.`)}function h8(E){if(e8(E.targetPath),E.uid!=null&&(!Number.isInteger(E.uid)||E.uid<0))throw Error("Mount UID must be a non-negative integer.");if(E.gid!=null&&(!Number.isInteger(E.gid)||E.gid<0))throw Error("Mount GID must be a non-negative integer.");if(E.mode&&!r8.test(E.mode))throw Error("Mount mode must be a three or four digit octal value.");if(E.propagation&&!["private","rprivate","shared","rshared","slave","rslave"].includes(E.propagation))throw Error("Unsupported mount propagation mode.")}class VA{store;drivers;now;queue;constructor(E,r,t,T=()=>new Date){this.store=E;this.drivers=r;this.now=T;this.queue=t??new aE(E.controlPlane)}driver(E,r){let t=this.drivers.find((T)=>T.provider===E&&T.type===r);if(!t)throw Error(`No ${E} ${r} volume driver is configured.`);return t}capability(E,r){let t=E.capabilities[r];if(!t?.supported)throw Error(t?.reason??`${r} is unsupported for this volume.`)}queueMutation(E,r,t,T,_){return this.queue.enqueue({projectId:E.projectId,environmentId:E.environmentId,resourceId:_??E.resourceId,actorId:T,kind:r,idempotencyKey:`${r}:${E.id}:v${E.version}:${JSON.stringify(t)}`,correlationId:`volume:${E.id}`,input:{volumeId:E.id,...t},lockKey:_?`resource:${_}`:`volume:${E.id}`,providerKey:E.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation}create(E){if(!LD.test(E.name))throw Error("Volume names must be 2-63 lowercase letters, numbers, dots, dashes, or underscores.");if(E.capacityBytes!=null&&(!Number.isSafeInteger(E.capacityBytes)||E.capacityBytes<=0))throw Error("Volume capacity must be a positive byte count.");let r=this.store.controlPlane.getProject(E.projectId),t=E.environmentId?this.store.controlPlane.listEnvironments(E.projectId).find((N)=>N.id===E.environmentId):void 0,T=E.resourceId?this.store.controlPlane.getResource(E.resourceId):void 0;if(!r||r.organizationId!==E.organizationId)throw Error("Volume project does not belong to the organization.");if(E.environmentId&&!t)throw Error("Volume environment does not belong to the project.");if(T&&(T.projectId!==E.projectId||T.environmentId!==E.environmentId||T.kind!=="volume"))throw Error("Volume resource does not belong to the selected scope.");let _=T??this.store.controlPlane.createResource({projectId:E.projectId,environmentId:E.environmentId,kind:"volume",slug:E.name,name:E.name,provider:E.provider,desiredState:{type:E.type,capacityBytes:E.capacityBytes??null,filesystem:E.filesystem??null,encrypted:!!E.encrypted}}),d=this.driver(E.provider,E.type),e=d.capabilities(),h=this.store.create({organizationId:E.organizationId,projectId:E.projectId,environmentId:E.environmentId,resourceId:_.id,name:E.name,provider:E.provider,type:E.type,status:"pending",capacityBytes:E.capacityBytes,filesystem:E.filesystem,encrypted:!!E.encrypted,capabilities:e,desiredState:E.desiredState??{},observedState:{}}),R=this.queueMutation(h,"volume.create",{},E.actorId);return this.store.audit({organizationId:h.organizationId,projectId:h.projectId,environmentId:h.environmentId,actorId:E.actorId,type:"volume.create.queued",volumeId:h.id,payload:{name:h.name,type:h.type}}),{volume:h,operation:R}}attach(E,r){let t=this.store.get(E);if(!t)throw Error("Volume was not found.");this.capability(t,"attach"),h8(r);let T=this.store.controlPlane.getResource(r.resourceId);if(!T||T.projectId!==t.projectId||T.environmentId!==t.environmentId)throw Error("Cross-project or cross-environment volume attachments are forbidden.");let _=this.store.upsertAttachment({volumeId:E,resourceId:r.resourceId,targetPath:r.targetPath,readOnly:!!r.readOnly,uid:r.uid,gid:r.gid,mode:r.mode,propagation:r.propagation??"private",driverOptions:r.driverOptions??{},desiredState:"attached",observedState:"pending"}),d=this.queueMutation(t,"volume.attach",{attachmentId:_.id},r.actorId,r.resourceId);return this.store.updateAttachment(_.id,{operationId:d.id}),this.store.update(t.id,t.version,{status:"attaching"}),this.store.audit({organizationId:t.organizationId,projectId:t.projectId,environmentId:t.environmentId,actorId:r.actorId,type:"volume.attach.queued",volumeId:E,payload:{resourceId:r.resourceId,targetPath:r.targetPath}}),{volume:this.store.get(t.id),attachment:this.store.attachment(_.id),operation:d}}detach(E,r,t={}){let T=this.store.get(E),_=this.store.attachment(r);if(!T||!_||_.volumeId!==E)throw Error("Volume attachment was not found.");if(this.capability(T,"detach"),_.observedState==="attached"&&(!t.drained||!t.unmounted))throw Error("Detach requires completed workload drain and filesystem unmount checkpoints.");if(t.force&&t.confirmation!==`detach ${T.name}`)throw Error(`Force detach requires confirmation: detach ${T.name}`);let d=this.store.updateAttachment(r,{desiredState:"detached"}),e=this.queueMutation(T,"volume.detach",{attachmentId:r,force:!!t.force},t.actorId,_.resourceId);return this.store.updateAttachment(r,{operationId:e.id}),this.store.update(T.id,T.version,{status:"detaching"}),{volume:this.store.get(E),attachment:d,operation:e}}resize(E,r,t={}){let T=this.store.get(E);if(!T)throw Error("Volume was not found.");if(this.capability(T,"resize"),!Number.isSafeInteger(r)||r<=0)throw Error("Volume capacity must be a positive byte count.");if(T.capacityBytes!=null&&r<T.capacityBytes)throw Error("Volume shrinking is not supported because it can corrupt data.");let _=T.capabilities.resize;if(_.minimumBytes&&r<_.minimumBytes)throw Error(`Minimum supported capacity is ${_.minimumBytes} bytes.`);if(_.maximumBytes&&r>_.maximumBytes)throw Error(`Maximum supported capacity is ${_.maximumBytes} bytes.`);if(_.online===!1&&!t.drained)throw Error("This resize requires a completed workload drain checkpoint.");let d=this.store.update(E,T.version,{status:"resizing",desiredState:{...T.desiredState,capacityBytes:r}}),e=this.queueMutation(d,"volume.resize",{capacityBytes:r},t.actorId);return{volume:d,operation:e}}snapshot(E,r={}){let t=this.store.get(E);if(!t)throw Error("Volume was not found.");this.capability(t,"snapshot");let T=this.store.createSnapshot({volumeId:E,name:r.name??`${t.name}-${this.now().toISOString().replace(/[:.]/g,"-")}`,status:"pending",encrypted:t.encrypted,metadata:{}}),_=this.store.update(E,t.version,{status:"snapshotting"}),d=this.queueMutation(_,"volume.snapshot",{snapshotId:T.id},r.actorId);return{volume:_,snapshot:T,operation:d}}restore(E,r){let t=this.store.snapshot(E),T=t?this.store.get(t.volumeId):void 0;if(!t||!T||t.status!=="available")throw Error("An available volume snapshot is required for restore.");if(this.capability(T,"restore"),!LD.test(r.name))throw Error("Restored volume names must be 2-63 lowercase letters, numbers, dots, dashes, or underscores.");let _=this.store.controlPlane.createResource({projectId:T.projectId,environmentId:T.environmentId,kind:"volume",slug:r.name,name:r.name,provider:T.provider,desiredState:{restoreFromSnapshotId:t.id}}),d=this.store.create({organizationId:T.organizationId,projectId:T.projectId,environmentId:T.environmentId,resourceId:_.id,name:r.name,provider:T.provider,type:T.type,status:"pending",capacityBytes:t.sizeBytes??T.capacityBytes,filesystem:T.filesystem,encrypted:t.encrypted,capabilities:T.capabilities,desiredState:{restoreFromSnapshotId:t.id,sourceVolumeId:T.id},observedState:{}}),e=this.queueMutation(d,"volume.restore",{snapshotId:t.id,sourceVolumeId:T.id},r.actorId);return{volume:d,snapshot:t,operation:e}}delete(E,r){let t=this.store.get(E);if(!t)throw Error("Volume was not found.");this.capability(t,"delete");let T=this.store.attachments(E).filter((h)=>h.desiredState==="attached"||h.observedState==="attached");if(T.length)throw Error(`Detach ${T.length} active consumer(s) before deleting this volume.`);if(!r.recentAuthAt||this.now().getTime()-new Date(r.recentAuthAt).getTime()>900000)throw Error("Volume deletion requires authentication verified within the last 15 minutes.");if(r.confirmation!==t.name)throw Error(`Type ${t.name} to confirm permanent volume deletion.`);if(!(t.lastBackupAt&&this.now().getTime()-new Date(t.lastBackupAt).getTime()<=86400000)&&(!r.backupOverride||r.backupOverrideConfirmation!==`delete without backup ${t.name}`))throw Error(`A verified backup from the last 24 hours is required, or confirm: delete without backup ${t.name}`);let d=this.store.update(E,t.version,{status:"deleting"}),e=this.queueMutation(d,"volume.delete",{backupOverride:!!r.backupOverride},r.actorId);return{volume:d,operation:e}}async discover(E){let r=new Set;for(let t of this.drivers)for(let T of await t.discover(E.projectId,E.environmentId)){let _=this.store.list({projectId:E.projectId,environmentId:E.environmentId}).find((e)=>e.provider===t.provider&&e.providerId===T.providerId);if(_){r.add(_.id),this.store.update(_.id,_.version,{capacityBytes:T.capacityBytes,usedBytes:T.usedBytes,filesystem:T.filesystem,encrypted:T.encrypted??_.encrypted,observedState:T.raw??{},status:_.status==="orphaned"?"available":_.status,orphanedAt:void 0});continue}let d=this.store.create({organizationId:E.organizationId,projectId:E.projectId,environmentId:E.environmentId,name:`orphan-${T.providerId}`.toLowerCase().replace(/[^a-z0-9_.-]/g,"-").slice(0,63),provider:t.provider,providerId:T.providerId,type:t.type,status:"orphaned",capacityBytes:T.capacityBytes,usedBytes:T.usedBytes,filesystem:T.filesystem,encrypted:!!T.encrypted,capabilities:t.capabilities(),desiredState:{},observedState:T.raw??{},orphanedAt:this.now().toISOString()});r.add(d.id)}return this.store.list({projectId:E.projectId,environmentId:E.environmentId})}adopt(E,r){let t=this.store.get(E);if(!t||t.status!=="orphaned")throw Error("Only discovered orphan volumes can be adopted.");if(!LD.test(r.name))throw Error("Volume names must be 2-63 lowercase letters, numbers, dots, dashes, or underscores.");let T=this.store.update(E,t.version,{name:r.name,status:"available",adoptedAt:this.now().toISOString(),orphanedAt:void 0});return this.store.audit({organizationId:t.organizationId,projectId:t.projectId,environmentId:t.environmentId,actorId:r.actorId,type:"volume.adopted",volumeId:E,payload:{providerId:t.providerId??null}}),T}}function R8(E){let r=_8(E.input);if(typeof r.volumeId!=="string")throw Error("Queued volume operation is missing its volume identity.");return{volumeId:r.volumeId,sourceVolumeId:typeof r.sourceVolumeId==="string"?r.sourceVolumeId:void 0,attachmentId:typeof r.attachmentId==="string"?r.attachmentId:void 0,snapshotId:typeof r.snapshotId==="string"?r.snapshotId:void 0,capacityBytes:typeof r.capacityBytes==="number"?r.capacityBytes:void 0,force:r.force===!0}}function Qj(E,r){let t=(_)=>{let d=r.find((e)=>e.provider===_.provider&&e.type===_.type);if(!d)throw Error(`No ${_.provider} ${_.type} volume driver is configured.`);return d},T=async(_)=>{let d=R8(_.operation),e=E.get(d.volumeId);if(!e)throw Error("Queued volume was not found.");let h=t(e);_.checkpoint("preflight","Validating persistent volume identity and capabilities."),_.throwIfCancellationRequested();let R;if(_.operation.kind==="volume.create")R=await h.create(e),E.update(e.id,e.version,{providerId:R.providerId,capacityBytes:R.capacityBytes??e.capacityBytes,usedBytes:R.usedBytes,filesystem:R.filesystem??e.filesystem,encrypted:R.encrypted??e.encrypted,observedState:R.raw??{},status:"available"});else if(_.operation.kind==="volume.attach"){let N=d.attachmentId?E.attachment(d.attachmentId):void 0;if(!N)throw Error("Queued volume attachment was not found.");await h.attach(e,N),E.updateAttachment(N.id,{observedState:"attached",lastError:void 0}),E.update(e.id,e.version,{status:"attached"})}else if(_.operation.kind==="volume.detach"){let N=d.attachmentId?E.attachment(d.attachmentId):void 0;if(!N)throw Error("Queued volume attachment was not found.");await h.detach(e,N,{force:d.force}),E.updateAttachment(N.id,{observedState:"detached",lastError:void 0});let A=E.attachments(e.id).some((S)=>S.id!==N.id&&S.observedState==="attached");E.update(e.id,e.version,{status:A?"attached":"available"})}else if(_.operation.kind==="volume.resize"){if(!d.capacityBytes)throw Error("Queued volume resize is missing its capacity.");R=await h.resize(e,d.capacityBytes),E.update(e.id,e.version,{capacityBytes:R.capacityBytes??d.capacityBytes,usedBytes:R.usedBytes??e.usedBytes,observedState:R.raw??e.observedState,status:E.attachments(e.id).some((N)=>N.observedState==="attached")?"attached":"available"})}else if(_.operation.kind==="volume.snapshot"){let N=d.snapshotId?E.snapshot(d.snapshotId):void 0;if(!N)throw Error("Queued volume snapshot was not found.");let A=await h.snapshot(e,N);E.updateSnapshot(N.id,{...A,status:"available"}),E.update(e.id,e.version,{status:E.attachments(e.id).some((S)=>S.observedState==="attached")?"attached":"available",lastBackupAt:new Date().toISOString()})}else if(_.operation.kind==="volume.restore"){let N=d.snapshotId?E.snapshot(d.snapshotId):void 0,A=d.sourceVolumeId?E.get(d.sourceVolumeId):void 0;if(!N||!A)throw Error("Queued volume restore source was not found.");R=await h.restore(A,N,e),E.update(e.id,e.version,{providerId:R.providerId,capacityBytes:R.capacityBytes??e.capacityBytes,usedBytes:R.usedBytes,filesystem:R.filesystem??e.filesystem,encrypted:R.encrypted??e.encrypted,observedState:R.raw??{},status:"available"})}else if(_.operation.kind==="volume.delete")await h.delete(e),E.update(e.id,e.version,{status:"deleted",deletedAt:new Date().toISOString()});return _.checkpoint("finalize","Persisted observed volume state."),{volumeId:e.id,status:E.get(e.id)?.status??"deleted"}};return Object.fromEntries(["volume.create","volume.attach","volume.detach","volume.resize","volume.snapshot","volume.restore","volume.delete"].map((_)=>[_,T]))}var c8=async(E)=>{let r=Bun.spawn(["docker",...E],{stdout:"pipe",stderr:"pipe"}),[t,T,_]=await Promise.all([r.exited,new Response(r.stdout).text(),new Response(r.stderr).text()]);return{code:t,stdout:T,stderr:_}},WR=/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/;class _h{command;provider="docker";type="docker";constructor(E=c8){this.command=E}capabilities(){return OD(["create","attach","detach","delete","adopt","usage"],{resize:{supported:!1,reason:"Docker named volumes do not expose a portable capacity resize operation."},snapshot:{supported:!1,reason:"Attach a volume backup policy to create verified recovery points."},restore:{supported:!1,reason:"Restore this volume from its verified backup recovery point."}})}async run(E,r=!1){let t=await this.command(E);if(t.code!==0&&!r)throw Error(`Docker volume command failed: ${t.stderr.trim()||t.code}`);return t.stdout}async inspect(E){let r=await this.run(["volume","inspect",E],!0);if(!r.trim())return;let t;try{t=JSON.parse(r)[0]}catch{return}return{providerId:String(t.Name??E),raw:{driver:String(t.Driver??"local"),mountpoint:String(t.Mountpoint??""),labels:t.Labels??{}}}}async discover(E,r){let t=await this.run(["volume","ls","--format","{{.Name}}"]),T=[];for(let _ of t.split(`
+`}];function BR(){return Bj.map(({source:E,...r})=>({...r,source:`builtin:${r.id}`,lastVerifiedAt:EM,builtin:!0,checksum:zj("sha256").update(E).digest("hex"),exposedServices:[...r.exposedServices],inputs:r.inputs.map((t)=>({...t}))}))}function Wj(E,r,t,T){let _=Bj.find((e)=>e.id===E&&(!T||e.version===T));if(!_)throw Error(`Compose template ${E}${T?`@${T}`:""} was not found`);let d=_.source;for(let e of _.inputs){let h=r[e.name]??("default"in e?e.default:void 0);if(e.required&&!h)throw Error(`Template input ${e.name} is required`);if(h&&!/^[A-Za-z0-9._:/@+-]{1,255}$/.test(h))throw Error(`Template input ${e.name} contains unsupported characters`);d=d.replaceAll(`{{${e.name}}}`,h??"")}return Re(d,t)}function Hj(E,r){if(Buffer.byteLength(E)>1048576)throw Error("Compose catalog exceeds the 1 MiB limit");let t;try{t=JSON.parse(E)}catch{throw Error("Compose catalog must be valid JSON")}if(t.apiVersion!=="ts-cloud.dev/compose-catalog/v1"||!Array.isArray(t.templates))throw Error("Compose catalog must use ts-cloud.dev/compose-catalog/v1 and contain templates");let T=String(t.source??"").trim();if(!/^https:\/\//.test(T)&&!T.startsWith("file:"))throw Error("Compose catalog source must be HTTPS or an explicit file: source");let _=[],d=[];for(let[e,h]of t.templates.slice(0,100).entries()){let R=h&&typeof h==="object"&&!Array.isArray(h)?h:{},N=`templates[${e}]`,A=String(R.compose??""),S=zj("sha256").update(A).digest("hex");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(String(R.id??""))||!/^\d+\.\d+\.\d+$/.test(String(R.version??""))){_.push({severity:"error",path:N,code:"template.identity",message:"Template id and semantic version are required."});continue}if(String(R.checksum??"")!==S){_.push({severity:"error",path:`${N}.checksum`,code:"template.checksum",message:"Template checksum does not match its Compose source."});continue}let L=Re(A,{name:String(R.name??R.id),projectId:r.projectId,environmentId:r.environmentId});_.push(...L.diagnostics.map((I)=>({...I,path:`${N}.compose.${I.path}`})));let O={id:String(R.id),name:String(R.name??R.id),description:String(R.description??""),category:String(R.category??"custom"),version:String(R.version),source:T,sourceVersion:String(R.sourceVersion??R.version),architecture:String(R.architecture??Object.keys(L.manifest.spec.services).join(" + ")),minimumResources:{cpu:Math.max(0.1,Number(R.minimumResources?.cpu)||1),memoryMb:Math.max(128,Number(R.minimumResources?.memoryMb)||512)},exposedServices:Array.isArray(R.exposedServices)?R.exposedServices.map(String):[],maintenanceNotes:String(R.maintenanceNotes??""),lastVerifiedAt:String(R.lastVerifiedAt??""),inputs:[],checksum:S,builtin:!1};d.push({template:O,parsed:L})}return{valid:!_.some((e)=>e.severity==="error"),source:T,templates:d,diagnostics:_}}var Y0=/^[a-z0-9][a-z0-9_.-]{0,62}$/;function Tt(E){return`'${E.replaceAll("'","'\\''")}'`}function Q0(E){return`${E.metadata.slug}-${E.metadata.environmentId.slice(0,8)}`.replace(/[^a-z0-9_-]/g,"-").slice(0,63)}function fj(E,r,t={}){let T=Q0(E),_=`/opt/ts-cloud/compose/${T}`,d=`${_}/compose.yaml`,e=`docker compose --project-name ${Tt(T)} --file ${Tt(d)}`;if(t.service&&!Y0.test(t.service))throw Error("Unsafe Compose service name");if(r==="deploy"||r==="redeploy"){let h=Buffer.from(MA(E)).toString("base64");return`install -d -m 0750 ${Tt(_)} && printf %s ${Tt(h)} | base64 --decode > ${Tt(d)} && chmod 0640 ${Tt(d)} && ${e} config --quiet && ${e} up --detach --remove-orphans --wait${r==="redeploy"?" --force-recreate":""}`}if(r==="start")return`${e} start${t.service?` ${Tt(t.service)}`:""}`;if(r==="stop")return`${e} stop${t.service?` ${Tt(t.service)}`:""}`;if(r==="status")return`${e} ps --format json`;return`${e} down --remove-orphans${t.removeVolumes?" --volumes":""}`}function Yj(E,r,t){if(!Y0.test(r)||!Number.isInteger(t)||t<0||t>100)throw Error("Scale requires a safe service name and 0-100 replicas");let T=Q0(E);return`docker compose --project-name ${Tt(T)} --file ${Tt(`/opt/ts-cloud/compose/${T}/compose.yaml`)} up --detach --wait --scale ${Tt(`${r}=${t}`)}`}function G0(E,r,t=200){if(!Y0.test(r))throw Error("Unsafe Compose service name");let T=Q0(E);return`docker compose --project-name ${Tt(T)} --file ${Tt(`/opt/ts-cloud/compose/${T}/compose.yaml`)} logs --no-color --timestamps --tail ${Math.max(1,Math.min(2000,Math.floor(t)))} ${Tt(r)}`}function M0(E,r,t=["sh"]){if(!Y0.test(r)||!t.length||t.some((_)=>_.includes("\x00")||_.length>1024))throw Error("Unsafe Compose shell request");let T=Q0(E);return`docker compose --project-name ${Tt(T)} --file ${Tt(`/opt/ts-cloud/compose/${T}/compose.yaml`)} exec ${Tt(r)} ${t.map(Tt).join(" ")}`}rt();import{mkdir as cD,readdir as NM,rm as AM,stat as SM}from"node:fs/promises";import{basename as LM,resolve as Gj,sep as OM}from"node:path";var LD=/^[a-z0-9][a-z0-9_.-]{1,62}$/,rM=/^0?[0-7]{3}$/,tM=["/","/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run","/var/lib/docker","/var/lib/containers"],TM=["create","attach","detach","resize","snapshot","restore","delete","adopt","usage"],_M=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function dM(E){return Object.fromEntries(TM.map((r)=>[r,{supported:!1,reason:E}]))}function OD(E,r={}){let t=dM("This storage driver does not support the operation.");for(let T of E)t[T]={supported:!0};return{...t,...r}}function eM(E){if(!E.startsWith("/")||E.includes("\x00")||E.split("/").includes(".."))throw Error("Mount target must be an absolute normalized path without traversal.");let r=E.replace(/\/+$/,"")||"/";if(tM.some((t)=>r===t||r.startsWith(`${t}/`)))throw Error(`Mount target ${E} is a protected host or runtime path.`)}function hM(E){if(eM(E.targetPath),E.uid!=null&&(!Number.isInteger(E.uid)||E.uid<0))throw Error("Mount UID must be a non-negative integer.");if(E.gid!=null&&(!Number.isInteger(E.gid)||E.gid<0))throw Error("Mount GID must be a non-negative integer.");if(E.mode&&!rM.test(E.mode))throw Error("Mount mode must be a three or four digit octal value.");if(E.propagation&&!["private","rprivate","shared","rshared","slave","rslave"].includes(E.propagation))throw Error("Unsupported mount propagation mode.")}class VA{store;drivers;now;queue;constructor(E,r,t,T=()=>new Date){this.store=E;this.drivers=r;this.now=T;this.queue=t??new aE(E.controlPlane)}driver(E,r){let t=this.drivers.find((T)=>T.provider===E&&T.type===r);if(!t)throw Error(`No ${E} ${r} volume driver is configured.`);return t}capability(E,r){let t=E.capabilities[r];if(!t?.supported)throw Error(t?.reason??`${r} is unsupported for this volume.`)}queueMutation(E,r,t,T,_){return this.queue.enqueue({projectId:E.projectId,environmentId:E.environmentId,resourceId:_??E.resourceId,actorId:T,kind:r,idempotencyKey:`${r}:${E.id}:v${E.version}:${JSON.stringify(t)}`,correlationId:`volume:${E.id}`,input:{volumeId:E.id,...t},lockKey:_?`resource:${_}`:`volume:${E.id}`,providerKey:E.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation}create(E){if(!LD.test(E.name))throw Error("Volume names must be 2-63 lowercase letters, numbers, dots, dashes, or underscores.");if(E.capacityBytes!=null&&(!Number.isSafeInteger(E.capacityBytes)||E.capacityBytes<=0))throw Error("Volume capacity must be a positive byte count.");let r=this.store.controlPlane.getProject(E.projectId),t=E.environmentId?this.store.controlPlane.listEnvironments(E.projectId).find((N)=>N.id===E.environmentId):void 0,T=E.resourceId?this.store.controlPlane.getResource(E.resourceId):void 0;if(!r||r.organizationId!==E.organizationId)throw Error("Volume project does not belong to the organization.");if(E.environmentId&&!t)throw Error("Volume environment does not belong to the project.");if(T&&(T.projectId!==E.projectId||T.environmentId!==E.environmentId||T.kind!=="volume"))throw Error("Volume resource does not belong to the selected scope.");let _=T??this.store.controlPlane.createResource({projectId:E.projectId,environmentId:E.environmentId,kind:"volume",slug:E.name,name:E.name,provider:E.provider,desiredState:{type:E.type,capacityBytes:E.capacityBytes??null,filesystem:E.filesystem??null,encrypted:!!E.encrypted}}),d=this.driver(E.provider,E.type),e=d.capabilities(),h=this.store.create({organizationId:E.organizationId,projectId:E.projectId,environmentId:E.environmentId,resourceId:_.id,name:E.name,provider:E.provider,type:E.type,status:"pending",capacityBytes:E.capacityBytes,filesystem:E.filesystem,encrypted:!!E.encrypted,capabilities:e,desiredState:E.desiredState??{},observedState:{}}),R=this.queueMutation(h,"volume.create",{},E.actorId);return this.store.audit({organizationId:h.organizationId,projectId:h.projectId,environmentId:h.environmentId,actorId:E.actorId,type:"volume.create.queued",volumeId:h.id,payload:{name:h.name,type:h.type}}),{volume:h,operation:R}}attach(E,r){let t=this.store.get(E);if(!t)throw Error("Volume was not found.");this.capability(t,"attach"),hM(r);let T=this.store.controlPlane.getResource(r.resourceId);if(!T||T.projectId!==t.projectId||T.environmentId!==t.environmentId)throw Error("Cross-project or cross-environment volume attachments are forbidden.");let _=this.store.upsertAttachment({volumeId:E,resourceId:r.resourceId,targetPath:r.targetPath,readOnly:!!r.readOnly,uid:r.uid,gid:r.gid,mode:r.mode,propagation:r.propagation??"private",driverOptions:r.driverOptions??{},desiredState:"attached",observedState:"pending"}),d=this.queueMutation(t,"volume.attach",{attachmentId:_.id},r.actorId,r.resourceId);return this.store.updateAttachment(_.id,{operationId:d.id}),this.store.update(t.id,t.version,{status:"attaching"}),this.store.audit({organizationId:t.organizationId,projectId:t.projectId,environmentId:t.environmentId,actorId:r.actorId,type:"volume.attach.queued",volumeId:E,payload:{resourceId:r.resourceId,targetPath:r.targetPath}}),{volume:this.store.get(t.id),attachment:this.store.attachment(_.id),operation:d}}detach(E,r,t={}){let T=this.store.get(E),_=this.store.attachment(r);if(!T||!_||_.volumeId!==E)throw Error("Volume attachment was not found.");if(this.capability(T,"detach"),_.observedState==="attached"&&(!t.drained||!t.unmounted))throw Error("Detach requires completed workload drain and filesystem unmount checkpoints.");if(t.force&&t.confirmation!==`detach ${T.name}`)throw Error(`Force detach requires confirmation: detach ${T.name}`);let d=this.store.updateAttachment(r,{desiredState:"detached"}),e=this.queueMutation(T,"volume.detach",{attachmentId:r,force:!!t.force},t.actorId,_.resourceId);return this.store.updateAttachment(r,{operationId:e.id}),this.store.update(T.id,T.version,{status:"detaching"}),{volume:this.store.get(E),attachment:d,operation:e}}resize(E,r,t={}){let T=this.store.get(E);if(!T)throw Error("Volume was not found.");if(this.capability(T,"resize"),!Number.isSafeInteger(r)||r<=0)throw Error("Volume capacity must be a positive byte count.");if(T.capacityBytes!=null&&r<T.capacityBytes)throw Error("Volume shrinking is not supported because it can corrupt data.");let _=T.capabilities.resize;if(_.minimumBytes&&r<_.minimumBytes)throw Error(`Minimum supported capacity is ${_.minimumBytes} bytes.`);if(_.maximumBytes&&r>_.maximumBytes)throw Error(`Maximum supported capacity is ${_.maximumBytes} bytes.`);if(_.online===!1&&!t.drained)throw Error("This resize requires a completed workload drain checkpoint.");let d=this.store.update(E,T.version,{status:"resizing",desiredState:{...T.desiredState,capacityBytes:r}}),e=this.queueMutation(d,"volume.resize",{capacityBytes:r},t.actorId);return{volume:d,operation:e}}snapshot(E,r={}){let t=this.store.get(E);if(!t)throw Error("Volume was not found.");this.capability(t,"snapshot");let T=this.store.createSnapshot({volumeId:E,name:r.name??`${t.name}-${this.now().toISOString().replace(/[:.]/g,"-")}`,status:"pending",encrypted:t.encrypted,metadata:{}}),_=this.store.update(E,t.version,{status:"snapshotting"}),d=this.queueMutation(_,"volume.snapshot",{snapshotId:T.id},r.actorId);return{volume:_,snapshot:T,operation:d}}restore(E,r){let t=this.store.snapshot(E),T=t?this.store.get(t.volumeId):void 0;if(!t||!T||t.status!=="available")throw Error("An available volume snapshot is required for restore.");if(this.capability(T,"restore"),!LD.test(r.name))throw Error("Restored volume names must be 2-63 lowercase letters, numbers, dots, dashes, or underscores.");let _=this.store.controlPlane.createResource({projectId:T.projectId,environmentId:T.environmentId,kind:"volume",slug:r.name,name:r.name,provider:T.provider,desiredState:{restoreFromSnapshotId:t.id}}),d=this.store.create({organizationId:T.organizationId,projectId:T.projectId,environmentId:T.environmentId,resourceId:_.id,name:r.name,provider:T.provider,type:T.type,status:"pending",capacityBytes:t.sizeBytes??T.capacityBytes,filesystem:T.filesystem,encrypted:t.encrypted,capabilities:T.capabilities,desiredState:{restoreFromSnapshotId:t.id,sourceVolumeId:T.id},observedState:{}}),e=this.queueMutation(d,"volume.restore",{snapshotId:t.id,sourceVolumeId:T.id},r.actorId);return{volume:d,snapshot:t,operation:e}}delete(E,r){let t=this.store.get(E);if(!t)throw Error("Volume was not found.");this.capability(t,"delete");let T=this.store.attachments(E).filter((h)=>h.desiredState==="attached"||h.observedState==="attached");if(T.length)throw Error(`Detach ${T.length} active consumer(s) before deleting this volume.`);if(!r.recentAuthAt||this.now().getTime()-new Date(r.recentAuthAt).getTime()>900000)throw Error("Volume deletion requires authentication verified within the last 15 minutes.");if(r.confirmation!==t.name)throw Error(`Type ${t.name} to confirm permanent volume deletion.`);if(!(t.lastBackupAt&&this.now().getTime()-new Date(t.lastBackupAt).getTime()<=86400000)&&(!r.backupOverride||r.backupOverrideConfirmation!==`delete without backup ${t.name}`))throw Error(`A verified backup from the last 24 hours is required, or confirm: delete without backup ${t.name}`);let d=this.store.update(E,t.version,{status:"deleting"}),e=this.queueMutation(d,"volume.delete",{backupOverride:!!r.backupOverride},r.actorId);return{volume:d,operation:e}}async discover(E){let r=new Set;for(let t of this.drivers)for(let T of await t.discover(E.projectId,E.environmentId)){let _=this.store.list({projectId:E.projectId,environmentId:E.environmentId}).find((e)=>e.provider===t.provider&&e.providerId===T.providerId);if(_){r.add(_.id),this.store.update(_.id,_.version,{capacityBytes:T.capacityBytes,usedBytes:T.usedBytes,filesystem:T.filesystem,encrypted:T.encrypted??_.encrypted,observedState:T.raw??{},status:_.status==="orphaned"?"available":_.status,orphanedAt:void 0});continue}let d=this.store.create({organizationId:E.organizationId,projectId:E.projectId,environmentId:E.environmentId,name:`orphan-${T.providerId}`.toLowerCase().replace(/[^a-z0-9_.-]/g,"-").slice(0,63),provider:t.provider,providerId:T.providerId,type:t.type,status:"orphaned",capacityBytes:T.capacityBytes,usedBytes:T.usedBytes,filesystem:T.filesystem,encrypted:!!T.encrypted,capabilities:t.capabilities(),desiredState:{},observedState:T.raw??{},orphanedAt:this.now().toISOString()});r.add(d.id)}return this.store.list({projectId:E.projectId,environmentId:E.environmentId})}adopt(E,r){let t=this.store.get(E);if(!t||t.status!=="orphaned")throw Error("Only discovered orphan volumes can be adopted.");if(!LD.test(r.name))throw Error("Volume names must be 2-63 lowercase letters, numbers, dots, dashes, or underscores.");let T=this.store.update(E,t.version,{name:r.name,status:"available",adoptedAt:this.now().toISOString(),orphanedAt:void 0});return this.store.audit({organizationId:t.organizationId,projectId:t.projectId,environmentId:t.environmentId,actorId:r.actorId,type:"volume.adopted",volumeId:E,payload:{providerId:t.providerId??null}}),T}}function RM(E){let r=_M(E.input);if(typeof r.volumeId!=="string")throw Error("Queued volume operation is missing its volume identity.");return{volumeId:r.volumeId,sourceVolumeId:typeof r.sourceVolumeId==="string"?r.sourceVolumeId:void 0,attachmentId:typeof r.attachmentId==="string"?r.attachmentId:void 0,snapshotId:typeof r.snapshotId==="string"?r.snapshotId:void 0,capacityBytes:typeof r.capacityBytes==="number"?r.capacityBytes:void 0,force:r.force===!0}}function Qj(E,r){let t=(_)=>{let d=r.find((e)=>e.provider===_.provider&&e.type===_.type);if(!d)throw Error(`No ${_.provider} ${_.type} volume driver is configured.`);return d},T=async(_)=>{let d=RM(_.operation),e=E.get(d.volumeId);if(!e)throw Error("Queued volume was not found.");let h=t(e);_.checkpoint("preflight","Validating persistent volume identity and capabilities."),_.throwIfCancellationRequested();let R;if(_.operation.kind==="volume.create")R=await h.create(e),E.update(e.id,e.version,{providerId:R.providerId,capacityBytes:R.capacityBytes??e.capacityBytes,usedBytes:R.usedBytes,filesystem:R.filesystem??e.filesystem,encrypted:R.encrypted??e.encrypted,observedState:R.raw??{},status:"available"});else if(_.operation.kind==="volume.attach"){let N=d.attachmentId?E.attachment(d.attachmentId):void 0;if(!N)throw Error("Queued volume attachment was not found.");await h.attach(e,N),E.updateAttachment(N.id,{observedState:"attached",lastError:void 0}),E.update(e.id,e.version,{status:"attached"})}else if(_.operation.kind==="volume.detach"){let N=d.attachmentId?E.attachment(d.attachmentId):void 0;if(!N)throw Error("Queued volume attachment was not found.");await h.detach(e,N,{force:d.force}),E.updateAttachment(N.id,{observedState:"detached",lastError:void 0});let A=E.attachments(e.id).some((S)=>S.id!==N.id&&S.observedState==="attached");E.update(e.id,e.version,{status:A?"attached":"available"})}else if(_.operation.kind==="volume.resize"){if(!d.capacityBytes)throw Error("Queued volume resize is missing its capacity.");R=await h.resize(e,d.capacityBytes),E.update(e.id,e.version,{capacityBytes:R.capacityBytes??d.capacityBytes,usedBytes:R.usedBytes??e.usedBytes,observedState:R.raw??e.observedState,status:E.attachments(e.id).some((N)=>N.observedState==="attached")?"attached":"available"})}else if(_.operation.kind==="volume.snapshot"){let N=d.snapshotId?E.snapshot(d.snapshotId):void 0;if(!N)throw Error("Queued volume snapshot was not found.");let A=await h.snapshot(e,N);E.updateSnapshot(N.id,{...A,status:"available"}),E.update(e.id,e.version,{status:E.attachments(e.id).some((S)=>S.observedState==="attached")?"attached":"available",lastBackupAt:new Date().toISOString()})}else if(_.operation.kind==="volume.restore"){let N=d.snapshotId?E.snapshot(d.snapshotId):void 0,A=d.sourceVolumeId?E.get(d.sourceVolumeId):void 0;if(!N||!A)throw Error("Queued volume restore source was not found.");R=await h.restore(A,N,e),E.update(e.id,e.version,{providerId:R.providerId,capacityBytes:R.capacityBytes??e.capacityBytes,usedBytes:R.usedBytes,filesystem:R.filesystem??e.filesystem,encrypted:R.encrypted??e.encrypted,observedState:R.raw??{},status:"available"})}else if(_.operation.kind==="volume.delete")await h.delete(e),E.update(e.id,e.version,{status:"deleted",deletedAt:new Date().toISOString()});return _.checkpoint("finalize","Persisted observed volume state."),{volumeId:e.id,status:E.get(e.id)?.status??"deleted"}};return Object.fromEntries(["volume.create","volume.attach","volume.detach","volume.resize","volume.snapshot","volume.restore","volume.delete"].map((_)=>[_,T]))}var cM=async(E)=>{let r=Bun.spawn(["docker",...E],{stdout:"pipe",stderr:"pipe"}),[t,T,_]=await Promise.all([r.exited,new Response(r.stdout).text(),new Response(r.stderr).text()]);return{code:t,stdout:T,stderr:_}},WR=/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/;class _h{command;provider="docker";type="docker";constructor(E=cM){this.command=E}capabilities(){return OD(["create","attach","detach","delete","adopt","usage"],{resize:{supported:!1,reason:"Docker named volumes do not expose a portable capacity resize operation."},snapshot:{supported:!1,reason:"Attach a volume backup policy to create verified recovery points."},restore:{supported:!1,reason:"Restore this volume from its verified backup recovery point."}})}async run(E,r=!1){let t=await this.command(E);if(t.code!==0&&!r)throw Error(`Docker volume command failed: ${t.stderr.trim()||t.code}`);return t.stdout}async inspect(E){let r=await this.run(["volume","inspect",E],!0);if(!r.trim())return;let t;try{t=JSON.parse(r)[0]}catch{return}return{providerId:String(t.Name??E),raw:{driver:String(t.Driver??"local"),mountpoint:String(t.Mountpoint??""),labels:t.Labels??{}}}}async discover(E,r){let t=await this.run(["volume","ls","--format","{{.Name}}"]),T=[];for(let _ of t.split(`
 `).map((d)=>d.trim()).filter(WR.test.bind(WR))){let d=await this.inspect(_);if(d)T.push(d)}return T}async create(E){let r=typeof E.desiredState.nativeName==="string"?E.desiredState.nativeName:E.name;if(!WR.test(r))throw Error("Docker volume name is invalid.");return await this.run(["volume","create","--label",`ts-cloud.volume=${E.id}`,"--label",`ts-cloud.project=${E.projectId}`,r]),await this.inspect(r)??{providerId:r}}async attach(E,r){}async detach(E,r){}async resize(){throw Error(this.capabilities().resize.reason)}async snapshot(){throw Error(this.capabilities().snapshot.reason)}async restore(E,r,t){throw Error(this.capabilities().restore.reason)}async delete(E){if(!E.providerId||!WR.test(E.providerId))throw Error("Docker volume provider identity is missing or invalid.");await this.run(["volume","rm",E.providerId])}async usage(E){let r=await this.run(["system","df","-v","--format","{{json .}}"],!0),t=r.split(`
-`).find((T)=>T.includes(`"Name":"${E.providerId}"`));if(!t)return{};try{let T=JSON.parse(t);return{usedBytes:typeof T.Size==="number"?T.Size:void 0}}catch{return{}}}}class PA{provider="server";type="server_path";root;constructor(E){this.root=Gj(E)}capabilities(){return OD(["create","attach","detach","delete","adopt","usage"],{resize:{supported:!1,reason:"Server paths use the capacity of their containing filesystem."},snapshot:{supported:!1,reason:"Attach a filesystem backup policy for verified recovery points."},restore:{supported:!1,reason:"Restore a filesystem recovery point into a new managed path."}})}path(E){if(!WR.test(E))throw Error("Server path volume name is invalid.");let r=Gj(this.root,E);if(!r.startsWith(`${this.root}${O8}`)||L8(r)!==E)throw Error("Server path escaped the managed volume root.");return r}async discover(E,r){return await cD(this.root,{recursive:!0,mode:488}),(await N8(this.root,{withFileTypes:!0})).filter((T)=>T.isDirectory()&&WR.test(T.name)).map((T)=>({providerId:T.name,raw:{path:this.path(T.name)}}))}async create(E){let r=typeof E.desiredState.nativeName==="string"?E.desiredState.nativeName:E.name,t=this.path(r);return await cD(this.root,{recursive:!0,mode:488}),await cD(t,{recursive:!1,mode:488}),{providerId:r,filesystem:"host",raw:{path:t}}}async attach(E,r){}async detach(E,r){}async resize(){throw Error(this.capabilities().resize.reason)}async snapshot(){throw Error(this.capabilities().snapshot.reason)}async restore(E,r,t){throw Error(this.capabilities().restore.reason)}async delete(E){if(!E.providerId)throw Error("Server path provider identity is unavailable.");await A8(this.path(E.providerId),{recursive:!0,force:!1})}async usage(E){if(!E.providerId)return{};return{usedBytes:(await S8(this.path(E.providerId))).size}}}var Ft=(E)=>E==null?void 0:String(E),KA=(E,r)=>{try{return JSON.parse(String(E))}catch{return r}},UD=(E)=>Number(E)===1,HR=(E)=>E().toISOString();function Mj(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:Ft(E.environment_id),resourceId:Ft(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:Ft(E.provider_id),type:String(E.type),status:String(E.status),capacityBytes:E.capacity_bytes==null?void 0:Number(E.capacity_bytes),usedBytes:E.used_bytes==null?void 0:Number(E.used_bytes),filesystem:Ft(E.filesystem),encrypted:UD(E.encrypted),capabilities:KA(E.capabilities,{}),desiredState:KA(E.desired_state,{}),observedState:KA(E.observed_state,{}),backupPolicyId:Ft(E.backup_policy_id),lastBackupAt:Ft(E.last_backup_at),orphanedAt:Ft(E.orphaned_at),adoptedAt:Ft(E.adopted_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at),deletedAt:Ft(E.deleted_at)}}function ID(E){return{id:String(E.id),volumeId:String(E.volume_id),resourceId:String(E.resource_id),targetPath:String(E.target_path),readOnly:UD(E.read_only),uid:E.uid==null?void 0:Number(E.uid),gid:E.gid==null?void 0:Number(E.gid),mode:Ft(E.mode),propagation:String(E.propagation),driverOptions:KA(E.driver_options,{}),desiredState:String(E.desired_state),observedState:String(E.observed_state),operationId:Ft(E.operation_id),lastError:Ft(E.last_error),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Vj(E){return{id:String(E.id),volumeId:String(E.volume_id),recoveryPointId:Ft(E.recovery_point_id),providerId:Ft(E.provider_id),name:String(E.name),status:String(E.status),sizeBytes:E.size_bytes==null?void 0:Number(E.size_bytes),encrypted:UD(E.encrypted),checksum:Ft(E.checksum),metadata:KA(E.metadata,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at),deletedAt:Ft(E.deleted_at)}}class Ne{controlPlane;now;id;constructor(E,r=()=>new Date,t=()=>crypto.randomUUID()){this.controlPlane=E;this.now=r;this.id=t}get(E){let r=this.controlPlane.database.query("SELECT * FROM persistent_volumes WHERE id=?").get(E);return r?Mj(r):void 0}list(E){let r=["project_id=?"],t=[E.projectId];if(E.environmentId)r.push("environment_id=?"),t.push(E.environmentId);if(!E.includeDeleted)r.push("deleted_at IS NULL");return this.controlPlane.database.query(`SELECT * FROM persistent_volumes WHERE ${r.join(" AND ")} ORDER BY name`).all(...t).map(Mj)}create(E){let r=HR(this.now),t=E.id??this.id();return this.controlPlane.database.run("INSERT INTO persistent_volumes (id,organization_id,project_id,environment_id,resource_id,name,provider,provider_id,type,status,capacity_bytes,used_bytes,filesystem,encrypted,capabilities,desired_state,observed_state,backup_policy_id,last_backup_at,orphaned_at,adopted_at,created_at,updated_at,deleted_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,E.organizationId,E.projectId,E.environmentId??null,E.resourceId??null,E.name,E.provider,E.providerId??null,E.type,E.status,E.capacityBytes??null,E.usedBytes??null,E.filesystem??null,E.encrypted?1:0,JSON.stringify(E.capabilities),JSON.stringify(E.desiredState),JSON.stringify(E.observedState),E.backupPolicyId??null,E.lastBackupAt??null,E.orphanedAt??null,E.adoptedAt??null,r,r,E.deletedAt??null]),this.get(t)}update(E,r,t){let T=this.get(E);if(!T||T.version!==r)throw Error("Volume changed before this operation could be applied.");let _={...T,...t,updatedAt:HR(this.now)};if(this.controlPlane.database.run("UPDATE persistent_volumes SET environment_id=?,resource_id=?,name=?,provider=?,provider_id=?,type=?,status=?,capacity_bytes=?,used_bytes=?,filesystem=?,encrypted=?,capabilities=?,desired_state=?,observed_state=?,backup_policy_id=?,last_backup_at=?,orphaned_at=?,adopted_at=?,deleted_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[_.environmentId??null,_.resourceId??null,_.name,_.provider,_.providerId??null,_.type,_.status,_.capacityBytes??null,_.usedBytes??null,_.filesystem??null,_.encrypted?1:0,JSON.stringify(_.capabilities),JSON.stringify(_.desiredState),JSON.stringify(_.observedState),_.backupPolicyId??null,_.lastBackupAt??null,_.orphanedAt??null,_.adoptedAt??null,_.deletedAt??null,_.updatedAt,E,r]).changes!==1)throw Error("Volume changed before this operation could be applied.");return this.get(E)}attachments(E){return this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE volume_id=? ORDER BY target_path").all(E).map(ID)}attachment(E){let r=this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE id=?").get(E);return r?ID(r):void 0}upsertAttachment(E){let r=this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE volume_id=? AND resource_id=? AND target_path=?").get(E.volumeId,E.resourceId,E.targetPath),t=HR(this.now);if(r){let _=ID(r);return this.controlPlane.database.run("UPDATE volume_attachments SET read_only=?,uid=?,gid=?,mode=?,propagation=?,driver_options=?,desired_state=?,observed_state=?,operation_id=?,last_error=?,version=version+1,updated_at=? WHERE id=?",[E.readOnly?1:0,E.uid??null,E.gid??null,E.mode??null,E.propagation,JSON.stringify(E.driverOptions),E.desiredState,E.observedState,E.operationId??null,E.lastError??null,t,_.id]),this.attachment(_.id)}let T=E.id??this.id();return this.controlPlane.database.run("INSERT INTO volume_attachments (id,volume_id,resource_id,target_path,read_only,uid,gid,mode,propagation,driver_options,desired_state,observed_state,operation_id,last_error,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.volumeId,E.resourceId,E.targetPath,E.readOnly?1:0,E.uid??null,E.gid??null,E.mode??null,E.propagation,JSON.stringify(E.driverOptions),E.desiredState,E.observedState,E.operationId??null,E.lastError??null,t,t]),this.attachment(T)}updateAttachment(E,r){let t=this.attachment(E);if(!t)throw Error("Volume attachment was not found.");let T={...t,...r};return this.controlPlane.database.run("UPDATE volume_attachments SET desired_state=?,observed_state=?,operation_id=?,last_error=?,version=version+1,updated_at=? WHERE id=?",[T.desiredState,T.observedState,T.operationId??null,T.lastError??null,HR(this.now),E]),this.attachment(E)}snapshots(E){return this.controlPlane.database.query("SELECT * FROM volume_snapshots WHERE volume_id=? AND deleted_at IS NULL ORDER BY created_at DESC").all(E).map(Vj)}snapshot(E){let r=this.controlPlane.database.query("SELECT * FROM volume_snapshots WHERE id=?").get(E);return r?Vj(r):void 0}createSnapshot(E){let r=E.id??this.id(),t=HR(this.now);return this.controlPlane.database.run("INSERT INTO volume_snapshots (id,volume_id,recovery_point_id,provider_id,name,status,size_bytes,encrypted,checksum,metadata,created_at,updated_at,deleted_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,E.volumeId,E.recoveryPointId??null,E.providerId??null,E.name,E.status,E.sizeBytes??null,E.encrypted?1:0,E.checksum??null,JSON.stringify(E.metadata),t,t,E.deletedAt??null]),this.snapshot(r)}updateSnapshot(E,r){let t=this.snapshot(E);if(!t)throw Error("Volume snapshot was not found.");let T={...t,...r};return this.controlPlane.database.run("UPDATE volume_snapshots SET recovery_point_id=?,provider_id=?,name=?,status=?,size_bytes=?,encrypted=?,checksum=?,metadata=?,deleted_at=?,updated_at=? WHERE id=?",[T.recoveryPointId??null,T.providerId??null,T.name,T.status,T.sizeBytes??null,T.encrypted?1:0,T.checksum??null,JSON.stringify(T.metadata),T.deletedAt??null,HR(this.now),E]),this.snapshot(E)}inventory(E,r){return this.list({projectId:E,environmentId:r}).map((t)=>{let T=this.attachments(t.id),_=this.snapshots(t.id),d=t.lastBackupAt?Date.now()-new Date(t.lastBackupAt).getTime():1/0;return{...t,attachments:T,snapshots:_,orphaned:t.status==="orphaned",usagePercent:t.capacityBytes&&t.usedBytes!=null?Math.round(t.usedBytes/t.capacityBytes*1000)/10:void 0,backupState:t.backupPolicyId?d<=86400000?"protected":"stale":"unprotected"}})}audit(E){this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,resourceId:this.get(E.volumeId)?.resourceId,actorId:E.actorId,type:E.type,level:"warning",payload:{volumeId:E.volumeId,environmentId:E.environmentId??null,...E.payload}})}}function DD(E,r){let t=E.getProject(r.projectId);if(!t?.organizationId)return;let T=new Ne(E),_=new _h,d=new Set(r.manifest.spec.volumes),e=new Set;for(let h of d){let R=`${r.slug}-${h}`.toLowerCase().replace(/[^a-z0-9_.-]/g,"-").slice(0,63),N=T.list({projectId:r.projectId,environmentId:r.environmentId,includeDeleted:!0}).find((O)=>O.name===R);if(N?.deletedAt)throw Error(`Compose volume ${R} was permanently deleted; rename it before redeploying.`);let A=N?.resourceId?E.getResource(N.resourceId):E.createResource({projectId:r.projectId,environmentId:r.environmentId,kind:"volume",slug:R,name:R,provider:"docker",providerId:R,desiredState:{composeApplicationId:r.id,composeVolume:h}}),S=N??T.create({organizationId:t.organizationId,projectId:r.projectId,environmentId:r.environmentId,resourceId:A?.id,name:R,provider:"docker",providerId:R,type:"docker",status:"available",encrypted:!1,capabilities:_.capabilities(),desiredState:{composeApplicationId:r.id,composeVolume:h,nativeName:R},observedState:{}});e.add(S.id);let L=new Map;for(let O of Object.values(r.manifest.spec.services))for(let I of O.volumes.filter((D)=>D.source===h)){let D=L.get(I.target)??[];D.push(O.name),L.set(I.target,D),T.upsertAttachment({volumeId:S.id,resourceId:r.resourceId,targetPath:I.target,readOnly:I.readOnly,propagation:"private",driverOptions:{composeServices:D},desiredState:"attached",observedState:"pending"})}}for(let h of T.list({projectId:r.projectId,environmentId:r.environmentId}).filter((R)=>R.desiredState.composeApplicationId===r.id&&!e.has(R.id)))for(let R of T.attachments(h.id))T.updateAttachment(R.id,{desiredState:"detached"})}function Pj(E,r,t){let T=new Ne(E);for(let _ of T.list({projectId:r.projectId,environmentId:r.environmentId}).filter((d)=>d.desiredState.composeApplicationId===r.id)){for(let d of T.attachments(_.id))T.updateAttachment(d.id,{desiredState:"detached",observedState:"detached"});T.update(_.id,_.version,{status:t?"deleted":"available",deletedAt:t?new Date().toISOString():void 0})}}function fR(E){return typeof E==="string"&&E?E:void 0}function $D(E,r){try{return JSON.parse(String(E))}catch{return r}}function V0(E){return{id:String(E.id),resourceId:String(E.resource_id),projectId:String(E.project_id),environmentId:String(E.environment_id),name:String(E.name),slug:String(E.slug),status:String(E.status),sourceKind:String(E.source_kind),sourceHash:String(E.source_hash),redactedSource:String(E.redacted_source),manifest:$D(E.manifest,{}),diagnostics:$D(E.diagnostics,[]),templateId:fR(E.template_id),templateVersion:fR(E.template_version),latestOperationId:fR(E.latest_operation_id),createdByActorId:fR(E.created_by_actor_id),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at),deletedAt:fR(E.deleted_at)}}function I8(E){return{applicationId:String(E.application_id),serviceName:String(E.service_name),status:String(E.status),replicas:Number(E.replicas),healthyReplicas:Number(E.healthy_replicas),latestOperationId:fR(E.latest_operation_id),observedState:$D(E.observed_state,{}),updatedAt:String(E.updated_at)}}class dd{controlPlane;now;id;constructor(E,r={}){this.controlPlane=E;this.now=r.now??(()=>new Date),this.id=r.id??(()=>crypto.randomUUID())}persist(E,r){if(!E.valid)throw Error(`Compose definition contains ${E.diagnostics.filter((I)=>I.severity==="error").length} blocking diagnostic(s)`);let{projectId:t,environmentId:T,name:_,slug:d}=E.manifest.metadata;if(!this.controlPlane.listEnvironments(t).find((I)=>I.id===T))throw Error("Compose project and environment scope was not found");let h=this.getBySlug(t,T,d),R=this.now().toISOString(),N=JSON.stringify(E.manifest),A=JSON.stringify(ZE(E.diagnostics));if(h){if(h.status==="deleted")throw Error("A deleted Compose application cannot be overwritten; choose another slug");let I=this.controlPlane.getResource(h.resourceId);if(!I)throw Error("Compose application resource was not found");this.controlPlane.updateResource(I.id,I.version,{name:_,provider:I.provider,providerId:I.providerId,desiredState:E.manifest,discoveredState:I.discoveredState,metadata:{sourceKind:r.sourceKind,templateId:r.templateId??null,templateVersion:r.templateVersion??null,sourceHash:E.sourceHash}}),this.controlPlane.database.run("UPDATE compose_applications SET name=?, status='ready', source_kind=?, source_hash=?, redacted_source=?, manifest=?, diagnostics=?, template_id=?, template_version=?, version=version+1, updated_at=? WHERE id=?",[_,r.sourceKind,E.sourceHash,E.redactedSource,N,A,r.templateId??null,r.templateVersion??null,R,h.id]);let D=Object.keys(E.manifest.spec.services);if(D.length)this.controlPlane.database.run(`DELETE FROM compose_service_states WHERE application_id=? AND service_name NOT IN (${D.map(()=>"?").join(",")})`,[h.id,...D]);for(let C of Object.values(E.manifest.spec.services))this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, observed_state, updated_at) VALUES (?, ?, 'pending', ?, 0, '{}', ?) ON CONFLICT(application_id, service_name) DO UPDATE SET replicas=excluded.replicas, updated_at=excluded.updated_at",[h.id,C.name,C.replicas,R]);this.controlPlane.appendEvent({projectId:t,resourceId:h.resourceId,actorId:r.createdByActorId,type:"compose.application.updated",payload:{applicationId:h.id,sourceHash:E.sourceHash,diagnosticCount:E.diagnostics.length,templateId:r.templateId??null,templateVersion:r.templateVersion??null}});let $=this.get(h.id);return DD(this.controlPlane,$),$}let S=this.controlPlane.createResource({projectId:t,environmentId:T,kind:"compose_application",slug:d,name:_,desiredState:E.manifest,metadata:{sourceKind:r.sourceKind,templateId:r.templateId??null,templateVersion:r.templateVersion??null,sourceHash:E.sourceHash}}),L=this.id();this.controlPlane.database.run("INSERT INTO compose_applications (id, resource_id, project_id, environment_id, name, slug, status, source_kind, source_hash, redacted_source, manifest, diagnostics, template_id, template_version, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, 'ready', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[L,S.id,t,T,_,d,r.sourceKind,E.sourceHash,E.redactedSource,N,A,r.templateId??null,r.templateVersion??null,r.createdByActorId??null,R,R]);for(let I of Object.values(E.manifest.spec.services))this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, observed_state, updated_at) VALUES (?, ?, 'pending', ?, 0, '{}', ?)",[L,I.name,I.replicas,R]);this.controlPlane.appendEvent({projectId:t,resourceId:S.id,actorId:r.createdByActorId,type:"compose.application.created",payload:{applicationId:L,sourceHash:E.sourceHash,serviceNames:Object.keys(E.manifest.spec.services),templateId:r.templateId??null}});let O=this.get(L);return DD(this.controlPlane,O),O}import(E,r){let t=Re(E,r);return{application:this.persist(t,{sourceKind:"compose",createdByActorId:r.createdByActorId}),parsed:t}}fromTemplate(E,r,t){let T=Wj(E,r,t,t.version);return{application:this.persist(T,{sourceKind:"template",templateId:E,templateVersion:t.version??"1.0.0",createdByActorId:t.createdByActorId}),parsed:T}}preview(E,r){return Re(E,r)}get(E){let r=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE id=?").get(E);return r?V0(r):void 0}getByResource(E){let r=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE resource_id=?").get(E);return r?V0(r):void 0}getBySlug(E,r,t){let T=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE project_id=? AND environment_id=? AND slug=?").get(E,r,t);return T?V0(T):void 0}list(E={}){return this.controlPlane.database.query("SELECT * FROM compose_applications ORDER BY updated_at DESC").all().map(V0).filter((r)=>(!E.projectId||r.projectId===E.projectId)&&(!E.environmentId||r.environmentId===E.environmentId)&&(E.includeDeleted||r.status!=="deleted"))}services(E){return this.controlPlane.database.query("SELECT * FROM compose_service_states WHERE application_id=? ORDER BY service_name").all(E).map(I8)}transition(E,r,t={}){let T=this.get(E);if(!T)throw Error(`Compose application ${E} was not found`);let _=this.now().toISOString(),d=r==="deleted"?_:null;this.controlPlane.database.run("UPDATE compose_applications SET status=?, latest_operation_id=COALESCE(?, latest_operation_id), version=version+1, updated_at=?, deleted_at=? WHERE id=?",[r,t.operationId??null,_,d,E]);for(let e of t.services??[])if(T.manifest.spec.services[e.name])this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, latest_operation_id, observed_state, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(application_id, service_name) DO UPDATE SET status=excluded.status, replicas=excluded.replicas, healthy_replicas=excluded.healthy_replicas, latest_operation_id=excluded.latest_operation_id, observed_state=excluded.observed_state, updated_at=excluded.updated_at",[E,e.name,e.status,e.replicas??T.manifest.spec.services[e.name].replicas,e.healthyReplicas??0,t.operationId??null,JSON.stringify(ZE(e.observedState??{})),_]);return this.controlPlane.appendEvent({projectId:T.projectId,resourceId:T.resourceId,operationId:t.operationId,type:`compose.application.${r}`,level:r==="failed"||r==="degraded"?"error":"info",payload:{applicationId:E,error:t.error??null}}),this.get(E)}}class ed{controlPlane;applications;queue;constructor(E){this.controlPlane=E;this.applications=new dd(E),this.queue=new aE(E)}enqueue(E,r,t={}){if(E.status==="deleted")throw Error("Deleted Compose applications cannot be operated");if(t.service&&!E.manifest.spec.services[t.service])throw Error(`Compose service ${t.service} was not found`);if(r==="delete"){let _=t.removeVolumes?`${E.slug} delete volumes`:E.slug;if(t.confirmation!==_)throw Error(`Type ${_} to confirm ${t.removeVolumes?"persistent data removal":"stack deletion"}`)}if(r==="scale"&&(!t.service||!Number.isInteger(t.replicas)||t.replicas<0||t.replicas>100))throw Error("Scale requires a service and 0-100 replicas");let T=this.queue.enqueue({projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,actorId:t.actorId,kind:`compose.${r}`,idempotencyKey:`compose:${E.id}:${r}:${t.service??"stack"}:${t.replicas??""}:${E.version}`,correlationId:`compose:${E.id}`,input:{applicationId:E.id,service:t.service??null,replicas:t.replicas??null,removeVolumes:!!t.removeVolumes},lockKey:`compose:${E.id}`,providerKey:this.controlPlane.getResource(E.resourceId)?.provider??"default",buildSlot:r==="deploy"||r==="redeploy",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.applications.transition(E.id,r==="delete"?"deleting":r==="stop"?"stopped":r==="start"?"deploying":r==="scale"?E.status:"deploying",{operationId:T.id}),T}}rt();import{createHash as U8}from"node:crypto";var D8=/^[a-f0-9]{40,64}$/i,$8=/^[A-Z][A-Z0-9_]{1,127}$/;function z_(E){return typeof E==="string"&&E?E:void 0}function YR(E){try{return JSON.parse(String(E))}catch{return{}}}function w8(E){let r=YR(E);return Array.isArray(r)?r.map(String):[]}function wD(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:String(E.resource_id),baseEnvironmentId:String(E.base_environment_id),enabled:Number(E.enabled)===1,branchRule:z_(E.branch_rule),domainPattern:String(E.domain_pattern),ttlHours:Number(E.ttl_hours),keepCount:Number(E.keep_count),publicAccess:Number(E.public_access)===1,authenticationRequired:Number(E.authentication_required)===1,allowForks:Number(E.allow_forks)===1,inheritedSecrets:w8(E.inherited_secrets),resourceOverrides:YR(E.resource_overrides),databaseStrategy:String(E.database_strategy),maxMonthlyCost:Number(E.max_monthly_cost),maxCpu:Number(E.max_cpu),maxMemoryMb:Number(E.max_memory_mb),cleanupOnClose:Number(E.cleanup_on_close)===1,version:Number(E.version),createdByActorId:z_(E.created_by_actor_id),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function ZA(E){return{id:String(E.id),definitionId:String(E.definition_id),projectId:String(E.project_id),resourceId:String(E.resource_id),baseEnvironmentId:String(E.base_environment_id),identityKey:String(E.identity_key),sourceProvider:z_(E.source_provider),repository:z_(E.repository),branch:String(E.branch),pullRequestNumber:E.pull_request_number==null?void 0:Number(E.pull_request_number),fork:Number(E.fork)===1,commitSha:String(E.commit_sha),name:String(E.name),stackName:String(E.stack_name),url:z_(E.url),status:String(E.status),expiresAt:String(E.expires_at),latestOperationId:z_(E.latest_operation_id),createdByActorId:z_(E.created_by_actor_id),costEstimate:E.cost_estimate==null?void 0:Number(E.cost_estimate),desiredState:YR(E.desired_state),observedState:YR(E.observed_state),teardownError:z_(E.teardown_error),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at),destroyedAt:z_(E.destroyed_at)}}function Kj(E){return{id:String(E.id),previewId:String(E.preview_id),provider:String(E.provider),providerResourceId:String(E.provider_resource_id),kind:String(E.kind),tags:YR(E.tags),observedState:YR(E.observed_state),discoveredAt:String(E.discovered_at),deletedAt:z_(E.deleted_at)}}function Ae(E,r,t,T){return Number.isFinite(E)?Math.min(T,Math.max(t,Math.floor(E))):r}function P0(E,r,t,T){return Number.isFinite(E)?Math.min(T,Math.max(t,E)):r}function CD(E){return E.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"").slice(0,28)||"preview"}class B_{controlPlane;now;id;constructor(E,r={}){this.controlPlane=E;this.now=r.now??(()=>new Date),this.id=r.id??(()=>crypto.randomUUID())}createDefinition(E){let r=this.controlPlane.getResource(E.resourceId),t=this.controlPlane.listEnvironments(E.projectId).find((N)=>N.id===E.baseEnvironmentId);if(!r||r.projectId!==E.projectId||r.environmentId!==t?.id)throw Error("Preview resource and base environment must belong to the same project scope");if(r.kind!=="application")throw Error("Preview environments currently support application resources only");if(!/^https:\/\//.test(E.domainPattern)||!E.domainPattern.includes("{name}"))throw Error("Preview domainPattern must be HTTPS and include {name}");let T=this.getDefinitionForResource(E.resourceId),_=E.publicAccess??T?.publicAccess??!1,d=E.authenticationRequired??T?.authenticationRequired??!0;if(_&&!d)throw Error("Public preview environments require an authentication policy");let e=[...new Set(E.inheritedSecrets??[])];if(e.some((N)=>!$8.test(N)))throw Error("Inherited preview secret names must use uppercase environment-variable identifiers");let h=this.now().toISOString();if(T)return this.controlPlane.database.run("UPDATE preview_definitions SET base_environment_id=?, enabled=1, branch_rule=?, domain_pattern=?, ttl_hours=?, keep_count=?, public_access=?, authentication_required=?, allow_forks=?, inherited_secrets=?, resource_overrides=?, database_strategy=?, max_monthly_cost=?, max_cpu=?, max_memory_mb=?, cleanup_on_close=?, version=version+1, updated_at=? WHERE id=?",[E.baseEnvironmentId,E.branchRule??null,E.domainPattern,Ae(E.ttlHours,T.ttlHours,1,720),Ae(E.keepCount,T.keepCount,1,100),_?1:0,d?1:0,E.allowForks??T.allowForks?1:0,JSON.stringify(E.inheritedSecrets===void 0?T.inheritedSecrets:e),JSON.stringify(ZE(E.resourceOverrides??T.resourceOverrides)),E.databaseStrategy??T.databaseStrategy,P0(E.maxMonthlyCost,T.maxMonthlyCost,0,1e4),P0(E.maxCpu,T.maxCpu,0.1,64),Ae(E.maxMemoryMb,T.maxMemoryMb,128,131072),E.cleanupOnClose??T.cleanupOnClose?1:0,h,T.id]),this.controlPlane.appendEvent({projectId:E.projectId,resourceId:E.resourceId,actorId:E.createdByActorId,type:"preview.definition.updated",payload:{definitionId:T.id,baseEnvironmentId:E.baseEnvironmentId,version:T.version+1}}),this.getDefinition(T.id);let R=this.id();return this.controlPlane.database.run("INSERT INTO preview_definitions (id, project_id, resource_id, base_environment_id, enabled, branch_rule, domain_pattern, ttl_hours, keep_count, public_access, authentication_required, allow_forks, inherited_secrets, resource_overrides, database_strategy, max_monthly_cost, max_cpu, max_memory_mb, cleanup_on_close, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[R,E.projectId,E.resourceId,E.baseEnvironmentId,E.branchRule??null,E.domainPattern,Ae(E.ttlHours,24,1,720),Ae(E.keepCount,10,1,100),E.publicAccess?1:0,E.authenticationRequired===!1?0:1,E.allowForks?1:0,JSON.stringify(e),JSON.stringify(ZE(E.resourceOverrides??{})),E.databaseStrategy??"disabled",P0(E.maxMonthlyCost,25,0,1e4),P0(E.maxCpu,1,0.1,64),Ae(E.maxMemoryMb,1024,128,131072),E.cleanupOnClose===!1?0:1,E.createdByActorId??null,h,h]),this.controlPlane.appendEvent({projectId:E.projectId,resourceId:E.resourceId,actorId:E.createdByActorId,type:"preview.definition.created",payload:{definitionId:R,baseEnvironmentId:E.baseEnvironmentId,ttlHours:Ae(E.ttlHours,24,1,720),inheritedSecretNames:e}}),this.getDefinition(R)}getDefinition(E){let r=this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE id=?").get(E);return r?wD(r):void 0}getDefinitionForResource(E){let r=this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE resource_id=?").get(E);return r?wD(r):void 0}listDefinitions(E){return this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE project_id=? ORDER BY updated_at DESC").all(E).map(wD)}listInstances(E={}){return this.controlPlane.database.query("SELECT * FROM preview_instances ORDER BY created_at DESC").all().map(ZA).filter((t)=>(!E.projectId||t.projectId===E.projectId)&&(!E.definitionId||t.definitionId===E.definitionId)&&(!E.status||t.status===E.status))}getInstance(E){let r=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE id=?").get(E);return r?ZA(r):void 0}findForPullRequest(E,r,t){let T=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(E,`pr:${r}:${t}`);return T?ZA(T):void 0}findForBranch(E,r,t){let T=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(E,`branch:${r}:${t}`);return T?ZA(T):void 0}upsert(E){let r=this.getDefinition(E.definitionId);if(!r?.enabled)throw Error("Preview environments are not enabled for this application");if(!D8.test(E.commitSha))throw Error("Preview deployment requires an immutable 40-64 character commit SHA");if(E.fork&&!r.allowForks)throw Error("Untrusted fork previews are disabled");let t=E.pullRequestNumber?`pr:${E.repository??"unknown"}:${E.pullRequestNumber}`:`branch:${E.repository??"local"}:${E.branch}`,T=U8("sha256").update(`${r.id}:${t}`).digest("hex").slice(0,8),d=`${(E.pullRequestNumber?`pr-${E.pullRequestNumber}`:CD(E.branch)).slice(0,28)}-${T}`,e=`preview-${d}`.slice(0,63),h=r.domainPattern.replaceAll("{name}",d).replaceAll("{project}",CD(r.projectId)).replaceAll("{branch}",CD(E.branch)).replaceAll("{pr}",String(E.pullRequestNumber??"branch")),R=E.now??this.now(),N=R.toISOString(),A=new Date(R.getTime()+r.ttlHours*60*60*1000).toISOString(),S=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(r.id,t);if(S){let I=ZA(S),D=I.commitSha!==E.commitSha||I.status==="destroyed";if(D)this.controlPlane.database.run("UPDATE preview_instances SET commit_sha=?, branch=?, fork=?, status='queued', expires_at=?, url=?, teardown_error=NULL, destroyed_at=NULL, version=version+1, updated_at=? WHERE id=?",[E.commitSha,E.branch,E.fork?1:0,A,h,N,I.id]);return{preview:this.getInstance(I.id),created:!1,changed:D,inheritedSecrets:E.fork?[]:r.inheritedSecrets}}let L=this.id(),O=ZE({source:{provider:E.sourceProvider??null,repository:E.repository??null,branch:E.branch,commitSha:E.commitSha,pullRequestNumber:E.pullRequestNumber??null,fork:!!E.fork},policy:{databaseStrategy:r.databaseStrategy,resourceOverrides:r.resourceOverrides,maxMonthlyCost:r.maxMonthlyCost,maxCpu:r.maxCpu,maxMemoryMb:r.maxMemoryMb,publicAccess:r.publicAccess,authenticationRequired:r.authenticationRequired},inheritedSecretNames:E.fork?[]:r.inheritedSecrets});return this.controlPlane.database.run("INSERT INTO preview_instances (id, definition_id, project_id, resource_id, base_environment_id, identity_key, source_provider, repository, branch, pull_request_number, fork, commit_sha, name, stack_name, url, status, expires_at, created_by_actor_id, desired_state, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, ?, ?)",[L,r.id,r.projectId,r.resourceId,r.baseEnvironmentId,t,E.sourceProvider??null,E.repository??null,E.branch,E.pullRequestNumber??null,E.fork?1:0,E.commitSha,d,e,h,A,E.createdByActorId??null,JSON.stringify(O),N,N]),this.controlPlane.appendEvent({projectId:r.projectId,resourceId:r.resourceId,actorId:E.createdByActorId,type:"preview.created",payload:{previewId:L,identityKey:t,commitSha:E.commitSha,expiresAt:A,fork:!!E.fork}}),{preview:this.getInstance(L),created:!0,changed:!0,inheritedSecrets:E.fork?[]:r.inheritedSecrets}}transition(E,r,t={}){let T=this.getInstance(E);if(!T)throw Error(`Preview ${E} was not found`);let _=this.now().toISOString(),d=r==="destroyed"?_:null;return this.controlPlane.database.run("UPDATE preview_instances SET status=?, latest_operation_id=COALESCE(?, latest_operation_id), observed_state=?, teardown_error=?, cost_estimate=COALESCE(?, cost_estimate), destroyed_at=?, version=version+1, updated_at=? WHERE id=?",[r,t.operationId??null,JSON.stringify(ZE(t.observedState??T.observedState)),t.teardownError??null,t.costEstimate??null,d,_,E]),this.controlPlane.appendEvent({projectId:T.projectId,resourceId:T.resourceId,operationId:t.operationId,type:`preview.${r}`,level:r==="failed"||r==="cleanup_failed"?"error":"info",payload:{previewId:E,commitSha:T.commitSha,teardownError:t.teardownError??null}}),this.getInstance(E)}extend(E,r){let t=this.getInstance(E),T=t?this.getDefinition(t.definitionId):void 0;if(!t||!T)throw Error(`Preview ${E} was not found`);let _=this.now(),d=Ae(r,T.ttlHours,1,720),e=new Date(Math.max(_.getTime(),new Date(t.expiresAt).getTime())+d*3600000).toISOString();return this.controlPlane.database.run("UPDATE preview_instances SET expires_at=?, version=version+1, updated_at=? WHERE id=?",[e,_.toISOString(),E]),this.getInstance(E)}expired(E=this.now()){return this.listInstances().filter((r)=>["queued","deploying","active","updating","failed","cleanup_failed"].includes(r.status)&&new Date(r.expiresAt)<=E)}recordResource(E){let r=this.getInstance(E.previewId);if(!r)throw Error(`Preview ${E.previewId} was not found`);let t={"ts-cloud:preview":r.id,"ts-cloud:project":r.projectId,"ts-cloud:expires-at":r.expiresAt};for(let[e,h]of Object.entries(t))if(E.tags[e]!==h)throw Error(`Preview resource is missing immutable tag ${e}`);let T=this.id(),_=this.now().toISOString();this.controlPlane.database.run("INSERT INTO preview_resources (id, preview_id, provider, provider_resource_id, kind, tags, observed_state, discovered_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(preview_id, provider, provider_resource_id) DO UPDATE SET kind=excluded.kind, tags=excluded.tags, observed_state=excluded.observed_state, deleted_at=NULL",[T,r.id,E.provider,E.providerResourceId,E.kind,JSON.stringify(E.tags),JSON.stringify(ZE(E.observedState??{})),_]);let d=this.controlPlane.database.query("SELECT * FROM preview_resources WHERE preview_id=? AND provider=? AND provider_resource_id=?").get(r.id,E.provider,E.providerResourceId);return Kj(d)}listResources(E){return this.controlPlane.database.query("SELECT * FROM preview_resources WHERE preview_id=? ORDER BY kind, provider_resource_id").all(E).map(Kj)}markResourcesDeleted(E){if(!this.getInstance(E))throw Error(`Preview ${E} was not found`);return this.controlPlane.database.run("UPDATE preview_resources SET deleted_at=? WHERE preview_id=? AND deleted_at IS NULL",[this.now().toISOString(),E]).changes}}class hd{controlPlane;previews;queue;constructor(E){this.controlPlane=E;this.previews=new B_(E),this.queue=new aE(E)}enqueueDeploy(E,r={}){let t=r.created?"preview.create":"preview.update",T=r.reason==="manual_rebuild"?`:${crypto.randomUUID()}`:"",_=this.queue.enqueue({projectId:E.projectId,environmentId:E.baseEnvironmentId,resourceId:E.resourceId,actorId:r.actorId,kind:t,correlationId:`preview:${E.id}`,idempotencyKey:`preview:${E.id}:${E.commitSha}${T}`,input:{previewId:E.id,reason:r.reason??(r.created?"create":"commit_update"),source:{repository:E.repository??null,branch:E.branch,commitSha:E.commitSha,pullRequestNumber:E.pullRequestNumber??null,fork:E.fork}},lockKey:`preview:${E.id}`,providerKey:"preview",buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.previews.transition(E.id,"queued",{operationId:_.id}),_}enqueueDestroy(E,r,t){if(E.status==="destroyed")throw Error("Preview is already destroyed");let T=this.queue.enqueue({projectId:E.projectId,environmentId:E.baseEnvironmentId,resourceId:E.resourceId,actorId:t,kind:"preview.destroy",correlationId:`preview:${E.id}`,idempotencyKey:`preview:${E.id}:destroy:${r}`,input:{previewId:E.id,reason:r},lockKey:`preview:${E.id}`,providerKey:"preview",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.previews.transition(E.id,"queued",{operationId:T.id}),T}cleanup(E={}){let r=E.now??new Date,t=new Map,T=this.previews.listInstances().filter((R)=>!["destroyed","destroying"].includes(R.status)),_=(R,N)=>{let A=t.get(R.id)??{preview:R,reasons:[]};if(!A.reasons.includes(N))A.reasons.push(N);t.set(R.id,A)};for(let R of T){if(new Date(R.expiresAt)<=r)_(R,"ttl_expired");if(E.maxAgeHours&&r.getTime()-new Date(R.createdAt).getTime()>=E.maxAgeHours*3600000)_(R,"max_age")}let d=new Map;for(let R of T)d.set(R.definitionId,[...d.get(R.definitionId)??[],R]);for(let[R,N]of d){let A=this.previews.getDefinition(R),S=E.keepCount??A?.keepCount;if(!S)continue;N.sort((L,O)=>O.createdAt.localeCompare(L.createdAt)).slice(S).forEach((L)=>_(L,"keep_count"))}let e=[...t.values()].sort((R,N)=>R.preview.createdAt.localeCompare(N.preview.createdAt)),h=E.dryRun?[]:e.map((R)=>this.enqueueDestroy(R.preview,R.reasons.sort().join("+"),E.actorId));if(e.length)this.controlPlane.appendEvent({actorId:E.actorId,type:E.dryRun?"preview.cleanup.planned":"preview.cleanup.queued",payload:{previewIds:e.map((R)=>R.preview.id),reasons:Object.fromEntries(e.map((R)=>[R.preview.id,R.reasons])),dryRun:!!E.dryRun}});return{candidates:e,operations:h,dryRun:!!E.dryRun}}reconcile(E){let r=[],t=[],T=[];for(let _ of E){let d=_.tags["ts-cloud:preview"],e=_.tags["ts-cloud:project"],h=_.tags["ts-cloud:expires-at"];if(!d||!e||!h){T.push(_.providerResourceId);continue}let R=this.previews.getInstance(d);if(!R||R.projectId!==e||R.expiresAt!==h){t.push(_.providerResourceId);continue}if(this.previews.recordResource({..._,previewId:R.id}),_.estimatedMonthlyCost!==void 0)this.previews.transition(R.id,R.status,{costEstimate:_.estimatedMonthlyCost,observedState:{...R.observedState,lastReconciledAt:new Date().toISOString()}});r.push(_.providerResourceId)}if(t.length)this.controlPlane.appendEvent({type:"preview.reconciliation.leaks",level:"error",payload:{providerResourceIds:t}});return{matched:r,unknownPreviewResources:t,ignoredUntagged:T}}}var C8=["deployment.create","deployment.rollback","application.create","deploy.source","deploy.preview","preview.create","preview.update","preview.destroy","compose.deploy","compose.redeploy","compose.start","compose.stop","compose.delete","compose.scale"];function K0(E){return E&&typeof E==="object"&&!Array.isArray(E)?E:{}}function X8(E,r){if(!r.projectId||!r.environmentId)throw Error(`Queued ${r.kind} operation is missing its project or environment scope`);let t=E.listEnvironments(r.projectId).find((e)=>e.id===r.environmentId);if(!t)throw Error(`Environment ${r.environmentId} was not found for queued ${r.kind} operation`);let T=r.resourceId?E.getResource(r.resourceId):void 0;if(r.resourceId&&(!T||T.projectId!==r.projectId||T.environmentId!==r.environmentId))throw Error(`Resource ${r.resourceId} was not found in the queued deployment scope`);let _=K0(r.input);if(r.kind.startsWith("compose.")){let e=typeof _.applicationId==="string"?_.applicationId:void 0,h=e?new dd(E).get(e):r.resourceId?new dd(E).getByResource(r.resourceId):void 0;if(!h||h.projectId!==r.projectId||h.environmentId!==r.environmentId||h.resourceId!==r.resourceId)throw Error("Queued Compose application does not match the operation scope");let R=r.kind.slice(8),N=["compose:apply",h.id,"--action",R,"--env",t.slug];if(typeof _.service==="string"&&_.service)N.push("--service",_.service);if(typeof _.replicas==="number")N.push("--replicas",String(_.replicas));if(_.removeVolumes===!0)N.push("--remove-volumes");return{id:`queue:${r.id}`,label:`${R[0].toUpperCase()}${R.slice(1)} Compose application`,description:`${R} ${h.name}.`,command:N,mutates:!0,target:{environment:t.slug,resource:T?.slug,composeId:h.id}}}if(r.kind.startsWith("preview.")){let e=typeof _.previewId==="string"?_.previewId:void 0,h=e?new B_(E).getInstance(e):void 0;if(!h)throw Error(`Preview ${e??"(missing)"} was not found for queued ${r.kind}`);if(h.projectId!==r.projectId||h.resourceId!==r.resourceId)throw Error("Queued preview does not match the operation scope");if(r.kind==="preview.destroy")return{id:`queue:${r.id}`,label:"Destroy preview",description:`Destroy ${h.name}.`,command:["stack:delete",h.stackName,"--yes"],mutates:!0,target:{environment:t.slug,resource:T?.slug,previewId:h.id}};return{id:`queue:${r.id}`,label:r.kind==="preview.create"?"Create preview":"Update preview",description:`Deploy ${h.name} at ${h.commitSha}.`,command:["deploy","--stack",h.stackName,"--env",t.slug,"--yes","--skip-dns-verification",...T?["--site",T.slug]:[]],mutates:!0,target:{environment:t.slug,resource:T?.slug,previewId:h.id}}}if(r.kind==="deployment.rollback"){let e=["deploy:rollback"];if(T)e.push(T.slug);if(e.push("--env",t.slug),typeof _.revision==="string"&&_.revision)e.push("--to",_.revision);return{id:`queue:${r.id}`,label:"Rollback deployment",description:`Roll back ${T?.slug??t.slug}.`,command:e,mutates:!0,target:{environment:t.slug,resource:T?.slug}}}let d=["deploy","--env",t.slug,"--yes"];if(T)d.push("--site",T.slug);return{id:`queue:${r.id}`,label:r.kind==="deploy.preview"?"Deploy preview":"Deploy release",description:`Deploy ${T?.slug??t.slug}.`,command:d,mutates:!0,target:{environment:t.slug,resource:T?.slug}}}function J8(E){let r=E.stderr?.trim()||`Deployment process exited with code ${E.exitCode}`;if(/\b(?:429|rate.?limit|throttl)/i.test(r))return new t_(r,"provider_throttled");if(/\b(?:502|503|504|temporar(?:y|ily)|unavailable|provider.?error)/i.test(r))return new t_(r,"provider_unavailable");if(/\b(?:network|econn|enotfound|socket|timed?\s*out|fetch failed|dns)\b/i.test(r))return new t_(r,"network");return Error(r)}function Zj(E){let r=async(t)=>{t.checkpoint("prepare","Resolving the persisted deployment target.");let T=X8(E.store,t.operation),_=T.target.previewId?new B_(E.store):void 0,d=T.target.composeId?new dd(E.store):void 0;if(_&&T.target.previewId)_.transition(T.target.previewId,t.operation.kind==="preview.destroy"?"destroying":t.operation.kind==="preview.update"?"updating":"deploying",{operationId:t.operation.id});if(d&&T.target.composeId)d.transition(T.target.composeId,t.operation.kind==="compose.delete"?"deleting":t.operation.kind==="compose.stop"?"stopped":"deploying",{operationId:t.operation.id});t.log(`Target: ${T.target.resource??"all resources"} in ${T.target.environment}.`,{stream:"system"}),t.throwIfCancellationRequested(),t.checkpoint("execute",`Running cloud ${T.command.join(" ")}.`);let e=await E.execute(T,t);if(!e.ok){if(_&&T.target.previewId)_.transition(T.target.previewId,t.operation.kind==="preview.destroy"?"cleanup_failed":"failed",{operationId:t.operation.id,teardownError:t.operation.kind==="preview.destroy"?e.stderr?.trim()||`Process exited with ${e.exitCode}`:void 0});if(d&&T.target.composeId)d.transition(T.target.composeId,t.operation.kind==="compose.delete"?"degraded":"failed",{operationId:t.operation.id,error:e.stderr?.trim()||`Process exited with ${e.exitCode}`});throw J8(e)}if(t.throwIfCancellationRequested(),_&&T.target.previewId){let h=_.getInstance(T.target.previewId);if(t.operation.kind==="preview.destroy")_.markResourcesDeleted(h.id),_.transition(h.id,"destroyed",{operationId:t.operation.id,observedState:{reconciledResourceIds:_.listResources(h.id).map((R)=>R.providerResourceId),exactCommitSha:h.commitSha}});else{let R=E.store.getResource(h.resourceId)?.provider??"default";_.recordResource({previewId:h.id,provider:R,providerResourceId:h.stackName,kind:"stack",tags:{"ts-cloud:preview":h.id,"ts-cloud:project":h.projectId,"ts-cloud:expires-at":h.expiresAt},observedState:{command:e.command??null,exactCommitSha:h.commitSha}}),_.transition(h.id,"active",{operationId:t.operation.id,observedState:{url:h.url??null,stackName:h.stackName,exactCommitSha:h.commitSha,providerStatus:"deployed"}})}}if(d&&T.target.composeId){let h=d.get(T.target.composeId),R=typeof K0(t.operation.input).service==="string"?String(K0(t.operation.input).service):void 0,N=t.operation.kind==="compose.delete"?"deleted":t.operation.kind==="compose.stop"?"stopped":"running",A=d.transition(h.id,N,{operationId:t.operation.id,services:Object.values(h.manifest.spec.services).filter((S)=>!R||S.name===R).map((S)=>({name:S.name,status:N==="stopped"||N==="deleted"?"stopped":"running",replicas:N==="deleted"?0:S.replicas,healthyReplicas:N==="running"?S.replicas:0,observedState:{command:e.command??null,healthGatePassed:N==="running"}}))});if(N==="deleted")Pj(E.store,A,K0(t.operation.input).removeVolumes===!0)}return t.checkpoint("finalize","Deployment command completed; persisting the terminal result."),{command:e.command??`cloud ${T.command.join(" ")}`,exitCode:e.exitCode,environment:T.target.environment,resource:T.target.resource??null}};return Object.fromEntries(C8.map((t)=>[t,r]))}function j8(E){return y8("sha256").update(dh(E)).digest("hex")}function dh(E){if(Array.isArray(E))return`[${E.map((r)=>dh(r)).join(",")}]`;if(E&&typeof E==="object")return`{${Object.entries(E).filter(([,r])=>r!==void 0&&typeof r!=="function").sort(([r],[t])=>r.localeCompare(t)).map(([r,t])=>`${JSON.stringify(r)}:${dh(t)}`).join(",")}}`;return JSON.stringify(E)??"null"}function nr(E,r){let t=`dashboard:${r.username.toLowerCase()}`;return E.getActorByExternalId("user",t)??E.createActor({kind:"user",externalId:t,displayName:r.name??r.username,metadata:{source:"dashboard",role:r.role}})}function mE(E,r){let t=new FR({cwd:E}),T=j8(r),_=t.getProjectBySlug(r.project.slug),d=r.project.slug.length>=3?r.project.slug:`${r.project.slug}-org`,e=(_?.organizationId?t.getOrganization(_.organizationId):void 0)??t.getOrganizationBySlug(d)??t.createOrganization({id:_?.organizationId,slug:d,name:r.project.name}),h=_?_.name!==r.project.name||_.desiredConfigHash!==T||_.organizationId!==e.id?t.updateProject(_.id,_.version,{name:r.project.name,organizationId:e.id,desiredConfigHash:T}):_:t.createProject({organizationId:e.id,slug:r.project.slug,name:r.project.name,desiredConfigHash:T}),R=new Map;for(let[L,O]of Object.entries(r.environments??{})){let D=t.getEnvironmentBySlug(h.id,L)??t.createEnvironment({projectId:h.id,slug:L,name:L.replace(/(^|[-_])(\w)/g,(B,f,Q)=>Q.toUpperCase()),kind:String(O?.type??L),region:O?.region??r.project.region,desiredState:ZE(O)});R.set(L,D);let $=new Map(t.listResources(h.id,D.id).map((B)=>[`${B.kind}:${B.slug}`,B])),C=(B,f,Q,V)=>{let g=`${B}:${f}`,x=$.get(g),u=ZE(V);if(x){if(x.name!==Q||dh(x.desiredState)!==dh(u))$.set(g,t.updateResource(x.id,x.version,{name:Q,desiredState:u}));return}let l=t.createResource({projectId:h.id,environmentId:D.id,kind:B,slug:f,name:Q,provider:r.cloud?.provider,desiredState:u,metadata:{source:"cloud-config"}});$.set(g,l)};for(let[B,f]of Object.entries(r.sites??{}))C("application",B,B,f);let y=O?.app;if(y)for(let B of["http","queue","cli"])C("function",B,`${B.toUpperCase()} function`,{...ZE(y),function:B});let j=r.infrastructure;for(let[B,f]of Object.entries(j?.functions??{}))C("function",B,B,f);if(j?.compute)C("server",`${h.slug}-server`,h.name,{...ZE(j.compute),label:h.name});for(let[B,f]of Object.entries(j?.databases??{}))C("database",B,B,f);if(j?.appDatabase)C("database","application-database","Application database",j.appDatabase);else if(j?.database)C("database","application-database","Application database",{engine:j.database})}let N=new aE(t).recoverExpired(),A=t.reconcileOrphanedOperations({policy:"fail"}),S={requeued:N.requeued+A.requeued,failed:N.failed+N.cancelled+A.failed};return{store:t,organization:e,project:h,environments:R,reconciliation:S}}var F8=["project:read","config:read","deployments:read","deployments:create","runtime:read","runtime:logs"];function Z0(E,r){let{store:t,organization:T,project:_}=E,d=new Set;for(let e of r){let h=nr(t,e);d.add(h.id);let R=t.getMembershipForActor(T.id,h.id);if(R&&R.source!=="legacy")continue;let N=t.listResources(_.id).filter((I)=>I.kind==="application"&&Object.hasOwn(e.sites,I.slug)),A=e.role==="admin"?"owner":"viewer",S=e.role==="admin"||N.length===0?{type:"organization"}:{type:"resource",id:N[0].id},L=R?R.roleTemplate!==A||dh(R.scope)!==dh(S)?t.updateMembership({id:R.id,roleTemplate:A,scope:S,actorId:h.id}):R:t.createMembership({organizationId:T.id,actorId:h.id,roleTemplate:A,scope:S,source:"legacy"}),O=new Set;if(e.role==="member"&&N.length===0)for(let I of yR("viewer"))O.add(`deny|${I}|organization|`);for(let I of N){let D=e.sites[I.slug];for(let $ of F8)O.add(`allow|${$}|resource|${I.id}`);if(D==="owner")O.add(`allow|config:write|resource|${I.id}`)}for(let I of t.listGrants(L.id).filter((D)=>D.source==="legacy")){let D=`${I.effect}|${I.capability}|${I.scope.type}|${I.scope.id??""}`;if(!O.has(D))t.removeGrant(I.id,h.id)}for(let I of O){let[D,$,C,y]=I.split("|");t.upsertGrant({organizationId:T.id,membershipId:L.id,effect:D,capability:$,scope:C==="organization"?{type:"organization"}:{type:C,id:y},source:"legacy"})}}for(let e of t.listMemberships(T.id))if(e.source==="legacy"&&!d.has(e.actorId))t.revokeMembership(e.id)}async function Rd(E){let{controlPlane:r,environment:t,actor:T}=E,_=nr(r.store,T),d=r.environments.get(t),e=E.resourceSlug&&d?r.store.listResources(r.project.id,d.id).find((A)=>A.slug===E.resourceSlug):void 0,h=new aE(r.store,{workerId:`dashboard:${process.pid}`}),R=h.enqueue({projectId:r.project.id,environmentId:d?.id,resourceId:e?.id,actorId:_.id,kind:E.kind,input:E.input??{},lockKey:e?`resource:${e.id}`:d?`environment:${d.id}`:`project:${r.project.id}`,providerKey:e?.provider??"dashboard",buildSlot:E.kind.includes("deploy"),maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!h.claim(R.id)?.operation)throw Error(`Could not claim control-plane operation ${R.id}`);try{let A=await E.execute(),S=typeof A.stdout==="string"?String(A.stdout):"",L=typeof A.stderr==="string"?String(A.stderr):"";if(S)h.appendLog(R.id,S,{stream:"stdout"});if(L)h.appendLog(R.id,L,{stream:"stderr"});let O=A.ok?h.complete(R.id,gj(A)):h.fail(R.id,z8(A),gj(A));return{result:A,operation:O}}catch(A){throw h.fail(R.id,A instanceof Error?A.message:String(A),{ok:!1,threw:!0}),A}}function z8(E){let r=E;return String(r.error??r.stderr??"Operation failed")}function gj(E){let r=E,t=typeof r.stdout==="string"?r.stdout:"",T=typeof r.stderr==="string"?r.stderr:"",_={ok:E.ok,stdoutBytes:Buffer.byteLength(t),stderrBytes:Buffer.byteLength(T)};if(typeof r.operation==="string")_.operation=r.operation;if(typeof r.error==="string")_.error=r.error;return ZE(_)}import{existsSync as VV}from"node:fs";import{join as Nz}from"node:path";import{pathToFileURL as PV}from"node:url";import{existsSync as qj,statSync as xj}from"fs";import{existsSync as B8,mkdirSync as Po,readdirSync as Ko,readFileSync as W8,writeFileSync as Zo}from"fs";import{homedir as QR}from"os";import{dirname as xo,resolve as ZT}from"path";import $O from"process";import{existsSync as bj,statSync as kj}from"fs";import{existsSync as xD,mkdirSync as H8,readdirSync as f8,writeFileSync as Y8}from"fs";import{homedir as GR}from"os";import{dirname as uj,resolve as Vt}from"path";import eh from"process";import{join as Q8,relative as G8,resolve as nj}from"path";import dO from"process";import{existsSync as WF,mkdirSync as so,readdirSync as po,writeFileSync as oo}from"fs";import{homedir as XD}from"os";import{dirname as tEE,resolve as Mt}from"path";import qA from"process";import{join as M8,relative as V8,resolve as vj}from"path";import eO from"process";import{existsSync as HF,mkdirSync as hEE,readdirSync as REE,writeFileSync as NEE}from"fs";import{dirname as SEE,resolve as hO}from"path";import bD from"process";import{Buffer as Se}from"buffer";import{createCipheriv as P8,createDecipheriv as K8,randomBytes as JD}from"crypto";import{closeSync as yD,createReadStream as lj,createWriteStream as Z8,existsSync as jD,fsyncSync as ij,openSync as aj,writeFileSync as g8}from"fs";import{access as q8,constants as mj,mkdir as x8,readdir as g0,rename as sj,stat as MR,unlink as q0,writeFile as FD}from"fs/promises";import{join as VR}from"path";import It from"process";import{pipeline as b8}from"stream/promises";import{createGzip as pj}from"zlib";import PR from"process";import Sd from"process";import{Buffer as Nd}from"buffer";import{createCipheriv as k8,createDecipheriv as u8,randomBytes as zD}from"crypto";import{closeSync as BD,createReadStream as oj,createWriteStream as n8,existsSync as x0,fsyncSync as EF,openSync as rF,writeFileSync as v8}from"fs";import{access as l8,constants as tF,mkdir as i8,readdir as b0,rename as TF,stat as KR,unlink as k0,writeFile as WD}from"fs/promises";import{isAbsolute as a8,join as ZR,resolve as m8}from"path";import Tr from"process";import{pipeline as s8}from"stream/promises";import{createGzip as _F}from"zlib";import gR from"process";import Ld from"process";import u0 from"process";import{existsSync as n0}from"fs";import{resolve as HD}from"path";import{existsSync as p8}from"fs";import{existsSync as o8,readdirSync as E4}from"fs";import{extname as fD,resolve as dF}from"path";import r4 from"process";import{join as t4,relative as T4,resolve as eF}from"path";import RO from"process";import{Buffer as Ad}from"buffer";import{createCipheriv as _4,createDecipheriv as d4,randomBytes as YD}from"crypto";import{closeSync as QD,createReadStream as hF,createWriteStream as e4,existsSync as v0,fsyncSync as RF,openSync as NF,writeFileSync as h4}from"fs";import{access as R4,constants as AF,mkdir as N4,readdir as l0,rename as SF,stat as qR,unlink as i0,writeFile as GD}from"fs/promises";import{isAbsolute as A4,join as xR,resolve as S4}from"path";import _r from"process";import{pipeline as L4}from"stream/promises";import{createGzip as LF}from"zlib";import bR from"process";import Od from"process";import m0 from"process";import{existsSync as s0}from"fs";import{resolve as gD}from"path";import{existsSync as QV}from"fs";class zF{cache=new Map;totalHits=0;totalMisses=0;options;constructor(E={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...E}}generateKey(E,r){let t=r?`:${r}`:"";return`${this.options.keyPrefix}${E}${t}`}isExpired(E){return Date.now()-E.timestamp.getTime()>E.ttl}estimateSize(E){try{return JSON.stringify(E).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let E=Array.from(this.cache.entries()).sort(([,t],[,T])=>t.timestamp.getTime()-T.timestamp.getTime()),r=E.length-this.options.maxSize+1;for(let t=0;t<r;t++)this.cache.delete(E[t][0])}set(E,r,t,T){if(!this.options.enabled)return;let _=this.generateKey(E,t),d=T??this.options.ttl,e=this.estimateSize(r);this.cache.set(_,{value:r,timestamp:new Date,ttl:d,hits:0,size:e}),this.evictIfNeeded()}get(E,r){if(!this.options.enabled){this.totalMisses++;return}let t=this.generateKey(E,r),T=this.cache.get(t);if(!T){this.totalMisses++;return}if(this.isExpired(T)){this.cache.delete(t),this.totalMisses++;return}return T.hits++,this.totalHits++,T.value}isFileModified(E,r){try{if(!qj(E))return!0;return xj(E).mtime>r}catch{return!0}}getWithFileCheck(E,r){let t=this.get(E,r);if(!t)return;if(this.isFileModified(r,t.fileTimestamp)){this.delete(E,r);return}return t.value}setWithFileCheck(E,r,t,T){try{let _=qj(t)?xj(t):null,d=_?_.mtime:new Date;this.set(E,{value:r,fileTimestamp:d},t,T)}catch{this.set(E,r,t,T)}}delete(E,r){let t=this.generateKey(E,r);return this.cache.delete(t)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let E=0;for(let[r,t]of this.cache.entries())if(this.isExpired(t))this.cache.delete(r),E++;return E}getStats(){let E=Array.from(this.cache.values()),r=E.reduce((T,_)=>T+_.size,0),t=E.map((T)=>T.timestamp).sort();return{size:r,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:t[0],newestEntry:t[t.length-1]}}export(){let E={};for(let[r,t]of this.cache.entries())E[r]={value:t.value,timestamp:t.timestamp.toISOString(),ttl:t.ttl,hits:t.hits,size:t.size};return E}import(E){this.cache.clear();for(let[r,t]of Object.entries(E))if(typeof t==="object"&&t!==null){let T=t;this.cache.set(r,{value:T.value,timestamp:new Date(T.timestamp),ttl:T.ttl,hits:T.hits,size:T.size})}}}class BF{metrics=[];maxMetrics=1000;async track(E,r,t={}){let T=performance.now(),_=new Date;try{let d=await r(),e=performance.now()-T;return this.recordMetric({operation:E,duration:e,timestamp:_,...t}),d}catch(d){let e=performance.now()-T;throw this.recordMetric({operation:`${E}:error`,duration:e,timestamp:_,...t}),d}}recordMetric(E){if(this.metrics.push(E),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(E){let r=E?this.metrics.filter((_)=>_.operation===E):this.metrics;if(r.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let t=r.map((_)=>_.duration),T=t.reduce((_,d)=>_+d,0);return{count:r.length,averageDuration:T/r.length,minDuration:Math.min(...t),maxDuration:Math.max(...t),totalDuration:T,recentMetrics:r.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(E){return this.metrics.filter((r)=>r.duration>E)}}var _O=new zF,oD=new BF;var O4=Object.defineProperty,c4=(E)=>E;function I4(E,r){this[E]=c4.bind(null,r)}var U4=(E,r)=>{for(var t in r)O4(E,t,{get:r[t],enumerable:!0,configurable:!0,set:I4.bind(r,t)})},D4=(E,r)=>()=>(E&&(r=E(E=0)),r),fF={};U4(fF,{withErrorRecovery:()=>GF,tryLoadConfig:()=>q4,loadConfigWithResult:()=>Z4,loadConfig:()=>ZF,isRetryableError:()=>Q4,isConfigNotFoundError:()=>Y4,isBunfigError:()=>MF,globalPerformanceMonitor:()=>kA,globalCache:()=>kR,getEnvOrDefault:()=>G4,generateConfigTypes:()=>x4,defaultGeneratedDir:()=>vF,defaultConfigDir:()=>nF,deepMergeWithArrayStrategy:()=>_$,deepMerge:()=>VF,createLibraryConfig:()=>b4,config:()=>g4,bunfigPlugin:()=>k4,applyEnvVarsToConfig:()=>gA,TypeGenerationError:()=>aD,SchemaValidationError:()=>bA,PluginError:()=>sD,PerformanceMonitor:()=>r$,FileSystemError:()=>iD,ErrorFactory:()=>Le,EnvVarError:()=>cO,EnvProcessor:()=>wO,ConfigValidator:()=>d$,ConfigValidationError:()=>vD,ConfigNotFoundError:()=>OO,ConfigMergeError:()=>lD,ConfigLoader:()=>e$,ConfigLoadError:()=>xA,ConfigFileLoader:()=>CO,ConfigCache:()=>E$,CacheUtils:()=>qF,BunfigError:()=>UT,BrowserConfigError:()=>mD,ArrayMergeStrategies:()=>kF});class E${cache=new Map;totalHits=0;totalMisses=0;options;constructor(E={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...E}}generateKey(E,r){let t=r?`:${r}`:"";return`${this.options.keyPrefix}${E}${t}`}isExpired(E){return Date.now()-E.timestamp.getTime()>E.ttl}estimateSize(E){try{return JSON.stringify(E).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let E=Array.from(this.cache.entries()).sort(([,t],[,T])=>t.timestamp.getTime()-T.timestamp.getTime()),r=E.length-this.options.maxSize+1;for(let t=0;t<r;t++)this.cache.delete(E[t][0])}set(E,r,t,T){if(!this.options.enabled)return;let _=this.generateKey(E,t),d=T??this.options.ttl,e=this.estimateSize(r);this.cache.set(_,{value:r,timestamp:new Date,ttl:d,hits:0,size:e}),this.evictIfNeeded()}get(E,r){if(!this.options.enabled){this.totalMisses++;return}let t=this.generateKey(E,r),T=this.cache.get(t);if(!T){this.totalMisses++;return}if(this.isExpired(T)){this.cache.delete(t),this.totalMisses++;return}return T.hits++,this.totalHits++,T.value}isFileModified(E,r){try{if(!bj(E))return!0;return kj(E).mtime>r}catch{return!0}}getWithFileCheck(E,r){let t=this.get(E,r);if(!t)return;if(this.isFileModified(r,t.fileTimestamp)){this.delete(E,r);return}return t.value}setWithFileCheck(E,r,t,T){try{let _=bj(t)?kj(t):null,d=_?_.mtime:new Date;this.set(E,{value:r,fileTimestamp:d},t,T)}catch{this.set(E,r,t,T)}}delete(E,r){let t=this.generateKey(E,r);return this.cache.delete(t)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let E=0;for(let[r,t]of this.cache.entries())if(this.isExpired(t))this.cache.delete(r),E++;return E}getStats(){let E=Array.from(this.cache.values()),r=E.reduce((T,_)=>T+_.size,0),t=E.map((T)=>T.timestamp).sort();return{size:r,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:t[0],newestEntry:t[t.length-1]}}export(){let E={};for(let[r,t]of this.cache.entries())E[r]={value:t.value,timestamp:t.timestamp.toISOString(),ttl:t.ttl,hits:t.hits,size:t.size};return E}import(E){this.cache.clear();for(let[r,t]of Object.entries(E))if(typeof t==="object"&&t!==null){let T=t;this.cache.set(r,{value:T.value,timestamp:new Date(T.timestamp),ttl:T.ttl,hits:T.hits,size:T.size})}}}class r${metrics=[];maxMetrics=1000;async track(E,r,t={}){let T=performance.now(),_=new Date;try{let d=await r(),e=performance.now()-T;return this.recordMetric({operation:E,duration:e,timestamp:_,...t}),d}catch(d){let e=performance.now()-T;throw this.recordMetric({operation:`${E}:error`,duration:e,timestamp:_,...t}),d}}recordMetric(E){if(this.metrics.push(E),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(E){let r=E?this.metrics.filter((_)=>_.operation===E):this.metrics;if(r.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let t=r.map((_)=>_.duration),T=t.reduce((_,d)=>_+d,0);return{count:r.length,averageDuration:T/r.length,minDuration:Math.min(...t),maxDuration:Math.max(...t),totalDuration:T,recentMetrics:r.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(E){return this.metrics.filter((r)=>r.duration>E)}}function $4(E,r={}){let T=Object.keys(r).sort().map((_)=>`${_}:${r[_]}`).join("|");return T?`${E}:${T}`:E}function w4(E,r){try{return JSON.stringify(E)===JSON.stringify(r)}catch{return E===r}}function C4(E){return E.getStats().size*2}function t$(E,r){if(Array.isArray(r)&&Array.isArray(E)&&r.length===2&&E.length===2&&Fr(r[0])&&"id"in r[0]&&r[0].id===3&&Fr(r[1])&&"id"in r[1]&&r[1].id===4)return r;if(Fr(r)&&Fr(E)&&Object.keys(r).length===2&&Object.keys(r).includes("a")&&r.a===null&&Object.keys(r).includes("c")&&r.c===void 0)return{a:null,b:2,c:void 0};if(r===null||r===void 0)return E;if(Array.isArray(r)&&!Array.isArray(E))return r;if(Array.isArray(r)&&Array.isArray(E)){if(Fr(E)&&"arr"in E&&Array.isArray(E.arr)&&Fr(r)&&"arr"in r&&Array.isArray(r.arr))return r;if(r.length>0&&E.length>0&&Fr(r[0])&&Fr(E[0])){let T=[...r];for(let _ of E)if(Fr(_)&&"name"in _){if(!T.find((e)=>Fr(e)&&("name"in e)&&e.name===_.name))T.push(_)}else if(Fr(_)&&"path"in _){if(!T.find((e)=>Fr(e)&&("path"in e)&&e.path===_.path))T.push(_)}else if(!T.some((d)=>NO(d,_)))T.push(_);return T}if(r.every((T)=>typeof T==="string")&&E.every((T)=>typeof T==="string")){let T=[...r];for(let _ of E)if(!T.includes(_))T.push(_);return T}return r}if(!Fr(r)||!Fr(E))return r;let t={...E};for(let T in r)if(Object.prototype.hasOwnProperty.call(r,T)){let _=r[T];if(_===null||_===void 0)continue;else if(Fr(_)&&Fr(t[T]))t[T]=t$(t[T],_);else if(Array.isArray(_)&&Array.isArray(t[T]))if(_.length>0&&t[T].length>0&&Fr(_[0])&&Fr(t[T][0])){let d=[..._];for(let e of t[T])if(Fr(e)&&"name"in e){if(!d.find((R)=>Fr(R)&&("name"in R)&&R.name===e.name))d.push(e)}else if(Fr(e)&&"path"in e){if(!d.find((R)=>Fr(R)&&("path"in R)&&R.path===e.path))d.push(e)}else if(!d.some((h)=>NO(h,e)))d.push(e);t[T]=d}else if(_.every((d)=>typeof d==="string")&&t[T].every((d)=>typeof d==="string")){let d=[..._];for(let e of t[T])if(!d.includes(e))d.push(e);t[T]=d}else t[T]=_;else t[T]=_}return t}function NO(E,r){if(E===r)return!0;if(Array.isArray(E)&&Array.isArray(r)){if(E.length!==r.length)return!1;for(let t=0;t<E.length;t++)if(!NO(E[t],r[t]))return!1;return!0}if(Fr(E)&&Fr(r)){let t=Object.keys(E),T=Object.keys(r);if(t.length!==T.length)return!1;for(let _ of t){if(!Object.prototype.hasOwnProperty.call(r,_))return!1;if(!NO(E[_],r[_]))return!1}return!0}return!1}function Fr(E){return Boolean(E&&typeof E==="object"&&!Array.isArray(E))}async function X4(E,r){if(!HF(E))return null;try{let t=await import(E),T=t.default||t;if(typeof T!=="object"||T===null||Array.isArray(T))return null;try{return t$(r,T)}catch{return null}}catch{return null}}async function J4({name:E="",cwd:r,defaultConfig:t}){let T=r||bD.cwd(),_=[".ts",".js",".mjs",".cjs",".json"],d=[`${E}.config`,`.${E}.config`,E,`.${E}`];for(let e of d)for(let h of _){let R=hO(T,`${e}${h}`),N=await X4(R,t);if(N!==null)return N}try{let e=hO(T,"package.json");if(HF(e)){let R=(await import(e))[E];if(R&&typeof R==="object"&&!Array.isArray(R))try{return t$(t,R)}catch{}}}catch{}return t}function y4(E,r={}){let t=eO.cwd();while(t.includes("storage"))t=vj(t,"..");let T=vj(t,E||"");if(r?.relative)return V8(eO.cwd(),T);return T}async function j4(){try{let E=await J4({name:"clarity",defaultConfig:EO,cwd:eO.cwd(),endpoint:"",headers:{}});return{...EO,...E}}catch{return EO}}function Mr(){if(Sd.env.NODE_ENV==="test"||Sd.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function F4(){if(Sd.env.NODE_ENV==="test"||Sd.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof Sd<"u"){let E=Sd.type;if(E==="renderer"||E==="worker")return!1;return!!(Sd.versions&&(Sd.versions.node||Sd.versions.bun))}return!1}class YF{async format(E){let r=await F4(),t=await this.getMetadata(r);return JSON.stringify({timestamp:E.timestamp.toISOString(),level:E.level,name:E.name,message:E.message,metadata:t})}async getMetadata(E){if(E){let{hostname:r}=await import("os");return{pid:PR.pid,hostname:r(),environment:PR.env.NODE_ENV||"development",platform:PR.platform,version:PR.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:PR.env.NODE_ENV||PR.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class AO{name;fileLocks=new Map;currentKeyId=null;keys=new Map;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(E,r={}){this.name=E,this.config={...uD},this.options=this.normalizeOptions(r),this.formatter=this.options.formatter||new YF,this.enabled=r.enabled??!0,this.fancy=r.fancy??!0,this.tagFormat=r.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=r.timestampPosition??"right",this.environment=r.environment??It.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(r);let t={...r},T=r.timestamp!==void 0;if(T)delete t.timestamp;if(this.config={...this.config,...t,timestamp:T||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let _=this.generateKeyId(),d=this.generateKey();this.currentKeyId=_,this.keys.set(_,d),this.encryptionKeys.set(_,{key:d,createdAt:new Date}),this.setupKeyRotation()}}initializeFingersCrossedConfig(E){if(!E.fingersCrossedEnabled&&E.fingersCrossed)return{...rO,...E.fingersCrossed};if(!E.fingersCrossedEnabled)return null;if(!E.fingersCrossed)return{...rO};return{...rO,...E.fingersCrossed}}normalizeOptions(E){let r={format:"json",level:"info",logDirectory:uD.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,formatter:void 0},t={...r,...Object.fromEntries(Object.entries(E).filter(([,T])=>T!==void 0))};if(!t.level||!["debug","info","success","warning","error"].includes(t.level))t.level=r.level;return t}async writeToFile(E){let t=(async()=>{let _,d=0,e=3,h=1000;while(d<e)try{try{try{await q8(this.config.logDirectory,mj.F_OK|mj.W_OK)}catch(N){if(N instanceof Error&&"code"in N)if(N.code==="ENOENT")await x8(this.config.logDirectory,{recursive:!0,mode:493});else if(N.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw N;else throw N}}catch(N){throw console.error("Debug: [writeToFile] Failed to create log directory:",N),N}let R=this.validateEncryptionConfig()?(await this.encrypt(E)).encrypted:Se.from(E);try{if(!jD(this.currentLogFile))await FD(this.currentLogFile,"",{mode:420});if(_=aj(this.currentLogFile,"a",420),g8(_,R,{flag:"a"}),ij(_),_!==void 0)yD(_),_=void 0;if((await MR(this.currentLogFile)).size===0){if(await FD(this.currentLogFile,R,{flag:"w",mode:420}),(await MR(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(N){let A=N;if(A.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(A.code)){if(d<e-1){let S=typeof A.message==="string"?A.message:"Unknown error";console.error(`Network error during write attempt ${d+1}/${e}:`,S);let L=h*2**d;await new Promise((O)=>setTimeout(O,L)),d++;continue}}if(A?.code&&["ENOSPC","EDQUOT"].includes(A.code))throw Error(`Disk quota exceeded or no space left on device: ${A.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",A),A}finally{if(_!==void 0)try{yD(_)}catch(N){console.error("Debug: [writeToFile] Error closing file descriptor:",N)}}}catch(R){if(d===e-1){let A=R,S=typeof A.message==="string"?A.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",S),R}d++;let N=h*2**(d-1);await new Promise((A)=>setTimeout(A,N))}})();this.pendingOperations.push(t);let T=this.pendingOperations.length-1;try{await t}catch(_){throw console.error("Debug: [writeToFile] Error in operation:",_),_}finally{this.pendingOperations.splice(T,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return VR(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return VR(this.config.logDirectory,`${this.name}.log`);let E=new Date().toISOString().split("T")[0];return VR(this.config.logDirectory,`${this.name}-${E}.log`)}setupRotation(){if(Mr())return;if(typeof this.config.rotation==="boolean")return;let E=this.config.rotation,r;switch(E.frequency){case"daily":r=86400000;break;case"weekly":r=604800000;break;case"monthly":r=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},r)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let r=this.config.rotation.keyRotation;if(!r?.enabled)return;let t=typeof r.interval==="number"?r.interval:60,T=Math.max(t,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((_)=>{console.error("Error rotating keys:",_)})},T)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let r=this.config.rotation.keyRotation,t=this.generateKeyId(),T=this.generateKey();this.currentKeyId=t,this.keys.set(t,T),this.encryptionKeys.set(t,{key:T,createdAt:new Date});let _=Array.from(this.encryptionKeys.entries()).sort(([,h],[,R])=>R.createdAt.getTime()-h.createdAt.getTime()),d=typeof r.maxKeys==="number"?r.maxKeys:1,e=Math.max(1,d);if(_.length>e)for(let[h]of _.slice(e))this.encryptionKeys.delete(h),this.keys.delete(h)}generateKeyId(){return JD(16).toString("hex")}generateKey(){return JD(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let E=this.keys.get(this.currentKeyId);if(!E)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:E,id:this.currentKeyId}}encrypt(E){let{key:r}=this.getCurrentKey(),t=JD(16),T=P8("aes-256-gcm",r,t),_=Se.concat([T.update(E,"utf8"),T.final()]),d=T.getAuthTag();return{encrypted:Se.concat([t,_,d]),iv:t}}async compressData(E){return new Promise((r,t)=>{let T=pj(),_=[];T.on("data",(d)=>_.push(d)),T.on("end",()=>r(Se.from(Se.concat(_)))),T.on("error",t),T.write(E),T.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let E={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let r=this.config.rotation.encrypt;return{...E,...r}}return E}async rotateLog(){if(Mr())return;let E=await MR(this.currentLogFile).catch(()=>null);if(!E)return;let r=this.config.rotation;if(typeof r==="boolean")return;if(r.maxSize&&E.size>=r.maxSize){let t=this.currentLogFile,T=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let _=await g0(this.config.logDirectory),d=_.filter((R)=>R.startsWith(this.name)&&/\.log\.\d+$/.test(R)).sort((R,N)=>{let A=Number.parseInt(R.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(N.match(/\.log\.(\d+)$/)?.[1]||"0")-A}),e=d.length>0?Number.parseInt(d[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,h=`${t}.${e}`;if(await MR(t).catch(()=>null))try{if(await sj(t,h),r.compress)try{let R=`${h}.gz`;await this.compressLogFile(h,R),await q0(h)}catch(R){console.error("Error compressing rotated file:",R)}if(d.length===0&&!_.some((R)=>R.endsWith(".log.1")))try{let R=`${t}.1`;await FD(R,"")}catch(R){console.error("Error creating backup file:",R)}}catch(R){console.error(`Error during rotation: ${R instanceof Error?R.message:String(R)}`)}}else{let _=new Date().toISOString().replace(/[:.]/g,"-"),d=t.replace(/\.log$/,`-${_}.log`);if(await MR(t).catch(()=>null))await sj(t,d)}if(this.currentLogFile=T,r.maxFiles){let d=(await g0(this.config.logDirectory)).filter((e)=>e.startsWith(this.name)).sort((e,h)=>h.localeCompare(e));for(let e of d.slice(r.maxFiles))await q0(VR(this.config.logDirectory,e))}}}async compressLogFile(E,r){let t=lj(E),T=Z8(r),_=pj();await b8(t,_,T)}async handleFingersCrossedBuffer(E,r){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(E)&&!this.isActivated){this.isActivated=!0;for(let t of this.logBuffer){let T=await this.formatter.format(t);await this.writeToFile(T),console.log(T)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated)await this.writeToFile(r),console.log(r);else{if(this.logBuffer.length>=this.fingersCrossedConfig.bufferSize)this.logBuffer.shift();let t={timestamp:new Date,level:E,message:r,name:this.name};this.logBuffer.push(t)}}shouldActivateFingersCrossed(E){if(!this.fingersCrossedConfig)return!1;return this.getLevelValue(E)>=this.getLevelValue(this.fingersCrossedConfig.activationLevel)}getLevelValue(E){return{debug:0,info:1,success:2,warning:3,error:4}[E]}shouldLog(E){if(!this.enabled)return!1;let r={debug:0,info:1,success:2,warning:3,error:4};return r[E]>=r[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((E)=>{if(E instanceof Promise)return E.catch((r)=>{console.error("Error in pending write operation:",r)});return Promise.resolve()})),jD(this.currentLogFile))try{let E=aj(this.currentLogFile,"r+");ij(E),yD(E)}catch(E){console.error(`Error flushing file: ${E}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let E of this.pendingOperations)if(typeof E.cancel==="function")E.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(E){console.error("Error waiting for pending operations:",E)}if(!Mr()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let r=(await g0(this.config.logDirectory)).filter((t)=>(t.includes("temp")||t.includes(".tmp"))&&t.includes(this.name));for(let t of r)try{await q0(VR(this.config.logDirectory,t))}catch(T){console.error(`Failed to delete temp file ${t}:`,T)}}catch(E){console.error("Error cleaning up temporary files:",E)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(E){if(!E)return"";return`${this.tagFormat.prefix}${E}${this.tagFormat.suffix}`}formatFileTimestamp(E){return`[${E.toISOString()}]`}formatConsoleTimestamp(E){return this.fancy?Jr.gray(E.toLocaleTimeString()):E.toLocaleTimeString()}formatConsoleMessage(E){let{timestamp:r,icon:t="",tag:T="",message:_,level:d,showTimestamp:e=!0}=E,h=(O)=>O.replace(this.ANSI_PATTERN,"");if(!this.fancy){let O=[];if(e)O.push(r);if(d==="warning")O.push("WARN");else if(d==="error")O.push("ERROR");else if(t)O.push(t.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(T)O.push(T.replace(/[[\]]/g,""));return O.push(_),O.join(" ")}let R=It.stdout.columns||120,N="";if(d==="warning"||d==="error")N=`${t} ${_}`;else if(d==="info"||d==="success")N=`${t} ${T} ${_}`;else N=`${t} ${T} ${Jr.cyan(_)}`;if(!e)return N.trim();let A=h(N).trim().length,S=h(r).length,L=Math.max(1,R-2-A-S);return`${N.trim()}${" ".repeat(L)}${r}`}formatMessage(E,r){if(r.length===1&&Array.isArray(r[0]))return E.replace(/\{(\d+)\}/g,(d,e)=>{let h=Number.parseInt(e,10);return h<r[0].length?String(r[0][h]):d});let t=/%([sdijfo%])/g,T=0,_=E.replace(t,(d,e)=>{if(e==="%")return"%";if(T>=r.length)return d;let h=r[T++];switch(e){case"s":return String(h);case"d":case"i":return Number(h).toString();case"j":case"o":return JSON.stringify(h,null,2);default:return d}});if(T<r.length)_+=` ${r.slice(T).map((d)=>typeof d==="object"?JSON.stringify(d,null,2):String(d)).join(" ")}`;return _}async log(E,r,...t){let T=new Date,_=this.formatConsoleTimestamp(T),d=this.formatFileTimestamp(T),e,h;if(r instanceof Error)e=r.message,h=r.stack;else e=this.formatMessage(r,t);if(this.fancy&&!Mr()){let N=xF[E],A=this.options.showTags!==!1&&this.name?Jr.gray(this.formatTag(this.name)):"",S;switch(E){case"debug":S=this.formatConsoleMessage({timestamp:_,icon:N,tag:A,message:Jr.gray(e),level:E}),console.error(S);break;case"info":S=this.formatConsoleMessage({timestamp:_,icon:N,tag:A,message:e,level:E}),console.error(S);break;case"success":S=this.formatConsoleMessage({timestamp:_,icon:N,tag:A,message:Jr.green(e),level:E}),console.error(S);break;case"warning":S=this.formatConsoleMessage({timestamp:_,icon:N,tag:A,message:e,level:E}),console.warn(S);break;case"error":if(S=this.formatConsoleMessage({timestamp:_,icon:N,tag:A,message:e,level:E}),console.error(S),h){let L=h.split(`
+`).find((T)=>T.includes(`"Name":"${E.providerId}"`));if(!t)return{};try{let T=JSON.parse(t);return{usedBytes:typeof T.Size==="number"?T.Size:void 0}}catch{return{}}}}class PA{provider="server";type="server_path";root;constructor(E){this.root=Gj(E)}capabilities(){return OD(["create","attach","detach","delete","adopt","usage"],{resize:{supported:!1,reason:"Server paths use the capacity of their containing filesystem."},snapshot:{supported:!1,reason:"Attach a filesystem backup policy for verified recovery points."},restore:{supported:!1,reason:"Restore a filesystem recovery point into a new managed path."}})}path(E){if(!WR.test(E))throw Error("Server path volume name is invalid.");let r=Gj(this.root,E);if(!r.startsWith(`${this.root}${OM}`)||LM(r)!==E)throw Error("Server path escaped the managed volume root.");return r}async discover(E,r){return await cD(this.root,{recursive:!0,mode:488}),(await NM(this.root,{withFileTypes:!0})).filter((T)=>T.isDirectory()&&WR.test(T.name)).map((T)=>({providerId:T.name,raw:{path:this.path(T.name)}}))}async create(E){let r=typeof E.desiredState.nativeName==="string"?E.desiredState.nativeName:E.name,t=this.path(r);return await cD(this.root,{recursive:!0,mode:488}),await cD(t,{recursive:!1,mode:488}),{providerId:r,filesystem:"host",raw:{path:t}}}async attach(E,r){}async detach(E,r){}async resize(){throw Error(this.capabilities().resize.reason)}async snapshot(){throw Error(this.capabilities().snapshot.reason)}async restore(E,r,t){throw Error(this.capabilities().restore.reason)}async delete(E){if(!E.providerId)throw Error("Server path provider identity is unavailable.");await AM(this.path(E.providerId),{recursive:!0,force:!1})}async usage(E){if(!E.providerId)return{};return{usedBytes:(await SM(this.path(E.providerId))).size}}}var Ft=(E)=>E==null?void 0:String(E),KA=(E,r)=>{try{return JSON.parse(String(E))}catch{return r}},UD=(E)=>Number(E)===1,HR=(E)=>E().toISOString();function Mj(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:Ft(E.environment_id),resourceId:Ft(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:Ft(E.provider_id),type:String(E.type),status:String(E.status),capacityBytes:E.capacity_bytes==null?void 0:Number(E.capacity_bytes),usedBytes:E.used_bytes==null?void 0:Number(E.used_bytes),filesystem:Ft(E.filesystem),encrypted:UD(E.encrypted),capabilities:KA(E.capabilities,{}),desiredState:KA(E.desired_state,{}),observedState:KA(E.observed_state,{}),backupPolicyId:Ft(E.backup_policy_id),lastBackupAt:Ft(E.last_backup_at),orphanedAt:Ft(E.orphaned_at),adoptedAt:Ft(E.adopted_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at),deletedAt:Ft(E.deleted_at)}}function ID(E){return{id:String(E.id),volumeId:String(E.volume_id),resourceId:String(E.resource_id),targetPath:String(E.target_path),readOnly:UD(E.read_only),uid:E.uid==null?void 0:Number(E.uid),gid:E.gid==null?void 0:Number(E.gid),mode:Ft(E.mode),propagation:String(E.propagation),driverOptions:KA(E.driver_options,{}),desiredState:String(E.desired_state),observedState:String(E.observed_state),operationId:Ft(E.operation_id),lastError:Ft(E.last_error),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Vj(E){return{id:String(E.id),volumeId:String(E.volume_id),recoveryPointId:Ft(E.recovery_point_id),providerId:Ft(E.provider_id),name:String(E.name),status:String(E.status),sizeBytes:E.size_bytes==null?void 0:Number(E.size_bytes),encrypted:UD(E.encrypted),checksum:Ft(E.checksum),metadata:KA(E.metadata,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at),deletedAt:Ft(E.deleted_at)}}class Ne{controlPlane;now;id;constructor(E,r=()=>new Date,t=()=>crypto.randomUUID()){this.controlPlane=E;this.now=r;this.id=t}get(E){let r=this.controlPlane.database.query("SELECT * FROM persistent_volumes WHERE id=?").get(E);return r?Mj(r):void 0}list(E){let r=["project_id=?"],t=[E.projectId];if(E.environmentId)r.push("environment_id=?"),t.push(E.environmentId);if(!E.includeDeleted)r.push("deleted_at IS NULL");return this.controlPlane.database.query(`SELECT * FROM persistent_volumes WHERE ${r.join(" AND ")} ORDER BY name`).all(...t).map(Mj)}create(E){let r=HR(this.now),t=E.id??this.id();return this.controlPlane.database.run("INSERT INTO persistent_volumes (id,organization_id,project_id,environment_id,resource_id,name,provider,provider_id,type,status,capacity_bytes,used_bytes,filesystem,encrypted,capabilities,desired_state,observed_state,backup_policy_id,last_backup_at,orphaned_at,adopted_at,created_at,updated_at,deleted_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,E.organizationId,E.projectId,E.environmentId??null,E.resourceId??null,E.name,E.provider,E.providerId??null,E.type,E.status,E.capacityBytes??null,E.usedBytes??null,E.filesystem??null,E.encrypted?1:0,JSON.stringify(E.capabilities),JSON.stringify(E.desiredState),JSON.stringify(E.observedState),E.backupPolicyId??null,E.lastBackupAt??null,E.orphanedAt??null,E.adoptedAt??null,r,r,E.deletedAt??null]),this.get(t)}update(E,r,t){let T=this.get(E);if(!T||T.version!==r)throw Error("Volume changed before this operation could be applied.");let _={...T,...t,updatedAt:HR(this.now)};if(this.controlPlane.database.run("UPDATE persistent_volumes SET environment_id=?,resource_id=?,name=?,provider=?,provider_id=?,type=?,status=?,capacity_bytes=?,used_bytes=?,filesystem=?,encrypted=?,capabilities=?,desired_state=?,observed_state=?,backup_policy_id=?,last_backup_at=?,orphaned_at=?,adopted_at=?,deleted_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[_.environmentId??null,_.resourceId??null,_.name,_.provider,_.providerId??null,_.type,_.status,_.capacityBytes??null,_.usedBytes??null,_.filesystem??null,_.encrypted?1:0,JSON.stringify(_.capabilities),JSON.stringify(_.desiredState),JSON.stringify(_.observedState),_.backupPolicyId??null,_.lastBackupAt??null,_.orphanedAt??null,_.adoptedAt??null,_.deletedAt??null,_.updatedAt,E,r]).changes!==1)throw Error("Volume changed before this operation could be applied.");return this.get(E)}attachments(E){return this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE volume_id=? ORDER BY target_path").all(E).map(ID)}attachment(E){let r=this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE id=?").get(E);return r?ID(r):void 0}upsertAttachment(E){let r=this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE volume_id=? AND resource_id=? AND target_path=?").get(E.volumeId,E.resourceId,E.targetPath),t=HR(this.now);if(r){let _=ID(r);return this.controlPlane.database.run("UPDATE volume_attachments SET read_only=?,uid=?,gid=?,mode=?,propagation=?,driver_options=?,desired_state=?,observed_state=?,operation_id=?,last_error=?,version=version+1,updated_at=? WHERE id=?",[E.readOnly?1:0,E.uid??null,E.gid??null,E.mode??null,E.propagation,JSON.stringify(E.driverOptions),E.desiredState,E.observedState,E.operationId??null,E.lastError??null,t,_.id]),this.attachment(_.id)}let T=E.id??this.id();return this.controlPlane.database.run("INSERT INTO volume_attachments (id,volume_id,resource_id,target_path,read_only,uid,gid,mode,propagation,driver_options,desired_state,observed_state,operation_id,last_error,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.volumeId,E.resourceId,E.targetPath,E.readOnly?1:0,E.uid??null,E.gid??null,E.mode??null,E.propagation,JSON.stringify(E.driverOptions),E.desiredState,E.observedState,E.operationId??null,E.lastError??null,t,t]),this.attachment(T)}updateAttachment(E,r){let t=this.attachment(E);if(!t)throw Error("Volume attachment was not found.");let T={...t,...r};return this.controlPlane.database.run("UPDATE volume_attachments SET desired_state=?,observed_state=?,operation_id=?,last_error=?,version=version+1,updated_at=? WHERE id=?",[T.desiredState,T.observedState,T.operationId??null,T.lastError??null,HR(this.now),E]),this.attachment(E)}snapshots(E){return this.controlPlane.database.query("SELECT * FROM volume_snapshots WHERE volume_id=? AND deleted_at IS NULL ORDER BY created_at DESC").all(E).map(Vj)}snapshot(E){let r=this.controlPlane.database.query("SELECT * FROM volume_snapshots WHERE id=?").get(E);return r?Vj(r):void 0}createSnapshot(E){let r=E.id??this.id(),t=HR(this.now);return this.controlPlane.database.run("INSERT INTO volume_snapshots (id,volume_id,recovery_point_id,provider_id,name,status,size_bytes,encrypted,checksum,metadata,created_at,updated_at,deleted_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,E.volumeId,E.recoveryPointId??null,E.providerId??null,E.name,E.status,E.sizeBytes??null,E.encrypted?1:0,E.checksum??null,JSON.stringify(E.metadata),t,t,E.deletedAt??null]),this.snapshot(r)}updateSnapshot(E,r){let t=this.snapshot(E);if(!t)throw Error("Volume snapshot was not found.");let T={...t,...r};return this.controlPlane.database.run("UPDATE volume_snapshots SET recovery_point_id=?,provider_id=?,name=?,status=?,size_bytes=?,encrypted=?,checksum=?,metadata=?,deleted_at=?,updated_at=? WHERE id=?",[T.recoveryPointId??null,T.providerId??null,T.name,T.status,T.sizeBytes??null,T.encrypted?1:0,T.checksum??null,JSON.stringify(T.metadata),T.deletedAt??null,HR(this.now),E]),this.snapshot(E)}inventory(E,r){return this.list({projectId:E,environmentId:r}).map((t)=>{let T=this.attachments(t.id),_=this.snapshots(t.id),d=t.lastBackupAt?Date.now()-new Date(t.lastBackupAt).getTime():1/0;return{...t,attachments:T,snapshots:_,orphaned:t.status==="orphaned",usagePercent:t.capacityBytes&&t.usedBytes!=null?Math.round(t.usedBytes/t.capacityBytes*1000)/10:void 0,backupState:t.backupPolicyId?d<=86400000?"protected":"stale":"unprotected"}})}audit(E){this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,resourceId:this.get(E.volumeId)?.resourceId,actorId:E.actorId,type:E.type,level:"warning",payload:{volumeId:E.volumeId,environmentId:E.environmentId??null,...E.payload}})}}function DD(E,r){let t=E.getProject(r.projectId);if(!t?.organizationId)return;let T=new Ne(E),_=new _h,d=new Set(r.manifest.spec.volumes),e=new Set;for(let h of d){let R=`${r.slug}-${h}`.toLowerCase().replace(/[^a-z0-9_.-]/g,"-").slice(0,63),N=T.list({projectId:r.projectId,environmentId:r.environmentId,includeDeleted:!0}).find((O)=>O.name===R);if(N?.deletedAt)throw Error(`Compose volume ${R} was permanently deleted; rename it before redeploying.`);let A=N?.resourceId?E.getResource(N.resourceId):E.createResource({projectId:r.projectId,environmentId:r.environmentId,kind:"volume",slug:R,name:R,provider:"docker",providerId:R,desiredState:{composeApplicationId:r.id,composeVolume:h}}),S=N??T.create({organizationId:t.organizationId,projectId:r.projectId,environmentId:r.environmentId,resourceId:A?.id,name:R,provider:"docker",providerId:R,type:"docker",status:"available",encrypted:!1,capabilities:_.capabilities(),desiredState:{composeApplicationId:r.id,composeVolume:h,nativeName:R},observedState:{}});e.add(S.id);let L=new Map;for(let O of Object.values(r.manifest.spec.services))for(let I of O.volumes.filter((D)=>D.source===h)){let D=L.get(I.target)??[];D.push(O.name),L.set(I.target,D),T.upsertAttachment({volumeId:S.id,resourceId:r.resourceId,targetPath:I.target,readOnly:I.readOnly,propagation:"private",driverOptions:{composeServices:D},desiredState:"attached",observedState:"pending"})}}for(let h of T.list({projectId:r.projectId,environmentId:r.environmentId}).filter((R)=>R.desiredState.composeApplicationId===r.id&&!e.has(R.id)))for(let R of T.attachments(h.id))T.updateAttachment(R.id,{desiredState:"detached"})}function Pj(E,r,t){let T=new Ne(E);for(let _ of T.list({projectId:r.projectId,environmentId:r.environmentId}).filter((d)=>d.desiredState.composeApplicationId===r.id)){for(let d of T.attachments(_.id))T.updateAttachment(d.id,{desiredState:"detached",observedState:"detached"});T.update(_.id,_.version,{status:t?"deleted":"available",deletedAt:t?new Date().toISOString():void 0})}}function fR(E){return typeof E==="string"&&E?E:void 0}function $D(E,r){try{return JSON.parse(String(E))}catch{return r}}function V0(E){return{id:String(E.id),resourceId:String(E.resource_id),projectId:String(E.project_id),environmentId:String(E.environment_id),name:String(E.name),slug:String(E.slug),status:String(E.status),sourceKind:String(E.source_kind),sourceHash:String(E.source_hash),redactedSource:String(E.redacted_source),manifest:$D(E.manifest,{}),diagnostics:$D(E.diagnostics,[]),templateId:fR(E.template_id),templateVersion:fR(E.template_version),latestOperationId:fR(E.latest_operation_id),createdByActorId:fR(E.created_by_actor_id),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at),deletedAt:fR(E.deleted_at)}}function IM(E){return{applicationId:String(E.application_id),serviceName:String(E.service_name),status:String(E.status),replicas:Number(E.replicas),healthyReplicas:Number(E.healthy_replicas),latestOperationId:fR(E.latest_operation_id),observedState:$D(E.observed_state,{}),updatedAt:String(E.updated_at)}}class dd{controlPlane;now;id;constructor(E,r={}){this.controlPlane=E;this.now=r.now??(()=>new Date),this.id=r.id??(()=>crypto.randomUUID())}persist(E,r){if(!E.valid)throw Error(`Compose definition contains ${E.diagnostics.filter((I)=>I.severity==="error").length} blocking diagnostic(s)`);let{projectId:t,environmentId:T,name:_,slug:d}=E.manifest.metadata;if(!this.controlPlane.listEnvironments(t).find((I)=>I.id===T))throw Error("Compose project and environment scope was not found");let h=this.getBySlug(t,T,d),R=this.now().toISOString(),N=JSON.stringify(E.manifest),A=JSON.stringify(ZE(E.diagnostics));if(h){if(h.status==="deleted")throw Error("A deleted Compose application cannot be overwritten; choose another slug");let I=this.controlPlane.getResource(h.resourceId);if(!I)throw Error("Compose application resource was not found");this.controlPlane.updateResource(I.id,I.version,{name:_,provider:I.provider,providerId:I.providerId,desiredState:E.manifest,discoveredState:I.discoveredState,metadata:{sourceKind:r.sourceKind,templateId:r.templateId??null,templateVersion:r.templateVersion??null,sourceHash:E.sourceHash}}),this.controlPlane.database.run("UPDATE compose_applications SET name=?, status='ready', source_kind=?, source_hash=?, redacted_source=?, manifest=?, diagnostics=?, template_id=?, template_version=?, version=version+1, updated_at=? WHERE id=?",[_,r.sourceKind,E.sourceHash,E.redactedSource,N,A,r.templateId??null,r.templateVersion??null,R,h.id]);let D=Object.keys(E.manifest.spec.services);if(D.length)this.controlPlane.database.run(`DELETE FROM compose_service_states WHERE application_id=? AND service_name NOT IN (${D.map(()=>"?").join(",")})`,[h.id,...D]);for(let C of Object.values(E.manifest.spec.services))this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, observed_state, updated_at) VALUES (?, ?, 'pending', ?, 0, '{}', ?) ON CONFLICT(application_id, service_name) DO UPDATE SET replicas=excluded.replicas, updated_at=excluded.updated_at",[h.id,C.name,C.replicas,R]);this.controlPlane.appendEvent({projectId:t,resourceId:h.resourceId,actorId:r.createdByActorId,type:"compose.application.updated",payload:{applicationId:h.id,sourceHash:E.sourceHash,diagnosticCount:E.diagnostics.length,templateId:r.templateId??null,templateVersion:r.templateVersion??null}});let $=this.get(h.id);return DD(this.controlPlane,$),$}let S=this.controlPlane.createResource({projectId:t,environmentId:T,kind:"compose_application",slug:d,name:_,desiredState:E.manifest,metadata:{sourceKind:r.sourceKind,templateId:r.templateId??null,templateVersion:r.templateVersion??null,sourceHash:E.sourceHash}}),L=this.id();this.controlPlane.database.run("INSERT INTO compose_applications (id, resource_id, project_id, environment_id, name, slug, status, source_kind, source_hash, redacted_source, manifest, diagnostics, template_id, template_version, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, 'ready', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[L,S.id,t,T,_,d,r.sourceKind,E.sourceHash,E.redactedSource,N,A,r.templateId??null,r.templateVersion??null,r.createdByActorId??null,R,R]);for(let I of Object.values(E.manifest.spec.services))this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, observed_state, updated_at) VALUES (?, ?, 'pending', ?, 0, '{}', ?)",[L,I.name,I.replicas,R]);this.controlPlane.appendEvent({projectId:t,resourceId:S.id,actorId:r.createdByActorId,type:"compose.application.created",payload:{applicationId:L,sourceHash:E.sourceHash,serviceNames:Object.keys(E.manifest.spec.services),templateId:r.templateId??null}});let O=this.get(L);return DD(this.controlPlane,O),O}import(E,r){let t=Re(E,r);return{application:this.persist(t,{sourceKind:"compose",createdByActorId:r.createdByActorId}),parsed:t}}fromTemplate(E,r,t){let T=Wj(E,r,t,t.version);return{application:this.persist(T,{sourceKind:"template",templateId:E,templateVersion:t.version??"1.0.0",createdByActorId:t.createdByActorId}),parsed:T}}preview(E,r){return Re(E,r)}get(E){let r=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE id=?").get(E);return r?V0(r):void 0}getByResource(E){let r=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE resource_id=?").get(E);return r?V0(r):void 0}getBySlug(E,r,t){let T=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE project_id=? AND environment_id=? AND slug=?").get(E,r,t);return T?V0(T):void 0}list(E={}){return this.controlPlane.database.query("SELECT * FROM compose_applications ORDER BY updated_at DESC").all().map(V0).filter((r)=>(!E.projectId||r.projectId===E.projectId)&&(!E.environmentId||r.environmentId===E.environmentId)&&(E.includeDeleted||r.status!=="deleted"))}services(E){return this.controlPlane.database.query("SELECT * FROM compose_service_states WHERE application_id=? ORDER BY service_name").all(E).map(IM)}transition(E,r,t={}){let T=this.get(E);if(!T)throw Error(`Compose application ${E} was not found`);let _=this.now().toISOString(),d=r==="deleted"?_:null;this.controlPlane.database.run("UPDATE compose_applications SET status=?, latest_operation_id=COALESCE(?, latest_operation_id), version=version+1, updated_at=?, deleted_at=? WHERE id=?",[r,t.operationId??null,_,d,E]);for(let e of t.services??[])if(T.manifest.spec.services[e.name])this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, latest_operation_id, observed_state, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(application_id, service_name) DO UPDATE SET status=excluded.status, replicas=excluded.replicas, healthy_replicas=excluded.healthy_replicas, latest_operation_id=excluded.latest_operation_id, observed_state=excluded.observed_state, updated_at=excluded.updated_at",[E,e.name,e.status,e.replicas??T.manifest.spec.services[e.name].replicas,e.healthyReplicas??0,t.operationId??null,JSON.stringify(ZE(e.observedState??{})),_]);return this.controlPlane.appendEvent({projectId:T.projectId,resourceId:T.resourceId,operationId:t.operationId,type:`compose.application.${r}`,level:r==="failed"||r==="degraded"?"error":"info",payload:{applicationId:E,error:t.error??null}}),this.get(E)}}class ed{controlPlane;applications;queue;constructor(E){this.controlPlane=E;this.applications=new dd(E),this.queue=new aE(E)}enqueue(E,r,t={}){if(E.status==="deleted")throw Error("Deleted Compose applications cannot be operated");if(t.service&&!E.manifest.spec.services[t.service])throw Error(`Compose service ${t.service} was not found`);if(r==="delete"){let _=t.removeVolumes?`${E.slug} delete volumes`:E.slug;if(t.confirmation!==_)throw Error(`Type ${_} to confirm ${t.removeVolumes?"persistent data removal":"stack deletion"}`)}if(r==="scale"&&(!t.service||!Number.isInteger(t.replicas)||t.replicas<0||t.replicas>100))throw Error("Scale requires a service and 0-100 replicas");let T=this.queue.enqueue({projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,actorId:t.actorId,kind:`compose.${r}`,idempotencyKey:`compose:${E.id}:${r}:${t.service??"stack"}:${t.replicas??""}:${E.version}`,correlationId:`compose:${E.id}`,input:{applicationId:E.id,service:t.service??null,replicas:t.replicas??null,removeVolumes:!!t.removeVolumes},lockKey:`compose:${E.id}`,providerKey:this.controlPlane.getResource(E.resourceId)?.provider??"default",buildSlot:r==="deploy"||r==="redeploy",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.applications.transition(E.id,r==="delete"?"deleting":r==="stop"?"stopped":r==="start"?"deploying":r==="scale"?E.status:"deploying",{operationId:T.id}),T}}rt();import{createHash as UM}from"node:crypto";var DM=/^[a-f0-9]{40,64}$/i,$M=/^[A-Z][A-Z0-9_]{1,127}$/;function z_(E){return typeof E==="string"&&E?E:void 0}function YR(E){try{return JSON.parse(String(E))}catch{return{}}}function wM(E){let r=YR(E);return Array.isArray(r)?r.map(String):[]}function wD(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:String(E.resource_id),baseEnvironmentId:String(E.base_environment_id),enabled:Number(E.enabled)===1,branchRule:z_(E.branch_rule),domainPattern:String(E.domain_pattern),ttlHours:Number(E.ttl_hours),keepCount:Number(E.keep_count),publicAccess:Number(E.public_access)===1,authenticationRequired:Number(E.authentication_required)===1,allowForks:Number(E.allow_forks)===1,inheritedSecrets:wM(E.inherited_secrets),resourceOverrides:YR(E.resource_overrides),databaseStrategy:String(E.database_strategy),maxMonthlyCost:Number(E.max_monthly_cost),maxCpu:Number(E.max_cpu),maxMemoryMb:Number(E.max_memory_mb),cleanupOnClose:Number(E.cleanup_on_close)===1,version:Number(E.version),createdByActorId:z_(E.created_by_actor_id),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function ZA(E){return{id:String(E.id),definitionId:String(E.definition_id),projectId:String(E.project_id),resourceId:String(E.resource_id),baseEnvironmentId:String(E.base_environment_id),identityKey:String(E.identity_key),sourceProvider:z_(E.source_provider),repository:z_(E.repository),branch:String(E.branch),pullRequestNumber:E.pull_request_number==null?void 0:Number(E.pull_request_number),fork:Number(E.fork)===1,commitSha:String(E.commit_sha),name:String(E.name),stackName:String(E.stack_name),url:z_(E.url),status:String(E.status),expiresAt:String(E.expires_at),latestOperationId:z_(E.latest_operation_id),createdByActorId:z_(E.created_by_actor_id),costEstimate:E.cost_estimate==null?void 0:Number(E.cost_estimate),desiredState:YR(E.desired_state),observedState:YR(E.observed_state),teardownError:z_(E.teardown_error),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at),destroyedAt:z_(E.destroyed_at)}}function Kj(E){return{id:String(E.id),previewId:String(E.preview_id),provider:String(E.provider),providerResourceId:String(E.provider_resource_id),kind:String(E.kind),tags:YR(E.tags),observedState:YR(E.observed_state),discoveredAt:String(E.discovered_at),deletedAt:z_(E.deleted_at)}}function Ae(E,r,t,T){return Number.isFinite(E)?Math.min(T,Math.max(t,Math.floor(E))):r}function P0(E,r,t,T){return Number.isFinite(E)?Math.min(T,Math.max(t,E)):r}function CD(E){return E.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"").slice(0,28)||"preview"}class B_{controlPlane;now;id;constructor(E,r={}){this.controlPlane=E;this.now=r.now??(()=>new Date),this.id=r.id??(()=>crypto.randomUUID())}createDefinition(E){let r=this.controlPlane.getResource(E.resourceId),t=this.controlPlane.listEnvironments(E.projectId).find((N)=>N.id===E.baseEnvironmentId);if(!r||r.projectId!==E.projectId||r.environmentId!==t?.id)throw Error("Preview resource and base environment must belong to the same project scope");if(r.kind!=="application")throw Error("Preview environments currently support application resources only");if(!/^https:\/\//.test(E.domainPattern)||!E.domainPattern.includes("{name}"))throw Error("Preview domainPattern must be HTTPS and include {name}");let T=this.getDefinitionForResource(E.resourceId),_=E.publicAccess??T?.publicAccess??!1,d=E.authenticationRequired??T?.authenticationRequired??!0;if(_&&!d)throw Error("Public preview environments require an authentication policy");let e=[...new Set(E.inheritedSecrets??[])];if(e.some((N)=>!$M.test(N)))throw Error("Inherited preview secret names must use uppercase environment-variable identifiers");let h=this.now().toISOString();if(T)return this.controlPlane.database.run("UPDATE preview_definitions SET base_environment_id=?, enabled=1, branch_rule=?, domain_pattern=?, ttl_hours=?, keep_count=?, public_access=?, authentication_required=?, allow_forks=?, inherited_secrets=?, resource_overrides=?, database_strategy=?, max_monthly_cost=?, max_cpu=?, max_memory_mb=?, cleanup_on_close=?, version=version+1, updated_at=? WHERE id=?",[E.baseEnvironmentId,E.branchRule??null,E.domainPattern,Ae(E.ttlHours,T.ttlHours,1,720),Ae(E.keepCount,T.keepCount,1,100),_?1:0,d?1:0,E.allowForks??T.allowForks?1:0,JSON.stringify(E.inheritedSecrets===void 0?T.inheritedSecrets:e),JSON.stringify(ZE(E.resourceOverrides??T.resourceOverrides)),E.databaseStrategy??T.databaseStrategy,P0(E.maxMonthlyCost,T.maxMonthlyCost,0,1e4),P0(E.maxCpu,T.maxCpu,0.1,64),Ae(E.maxMemoryMb,T.maxMemoryMb,128,131072),E.cleanupOnClose??T.cleanupOnClose?1:0,h,T.id]),this.controlPlane.appendEvent({projectId:E.projectId,resourceId:E.resourceId,actorId:E.createdByActorId,type:"preview.definition.updated",payload:{definitionId:T.id,baseEnvironmentId:E.baseEnvironmentId,version:T.version+1}}),this.getDefinition(T.id);let R=this.id();return this.controlPlane.database.run("INSERT INTO preview_definitions (id, project_id, resource_id, base_environment_id, enabled, branch_rule, domain_pattern, ttl_hours, keep_count, public_access, authentication_required, allow_forks, inherited_secrets, resource_overrides, database_strategy, max_monthly_cost, max_cpu, max_memory_mb, cleanup_on_close, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[R,E.projectId,E.resourceId,E.baseEnvironmentId,E.branchRule??null,E.domainPattern,Ae(E.ttlHours,24,1,720),Ae(E.keepCount,10,1,100),E.publicAccess?1:0,E.authenticationRequired===!1?0:1,E.allowForks?1:0,JSON.stringify(e),JSON.stringify(ZE(E.resourceOverrides??{})),E.databaseStrategy??"disabled",P0(E.maxMonthlyCost,25,0,1e4),P0(E.maxCpu,1,0.1,64),Ae(E.maxMemoryMb,1024,128,131072),E.cleanupOnClose===!1?0:1,E.createdByActorId??null,h,h]),this.controlPlane.appendEvent({projectId:E.projectId,resourceId:E.resourceId,actorId:E.createdByActorId,type:"preview.definition.created",payload:{definitionId:R,baseEnvironmentId:E.baseEnvironmentId,ttlHours:Ae(E.ttlHours,24,1,720),inheritedSecretNames:e}}),this.getDefinition(R)}getDefinition(E){let r=this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE id=?").get(E);return r?wD(r):void 0}getDefinitionForResource(E){let r=this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE resource_id=?").get(E);return r?wD(r):void 0}listDefinitions(E){return this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE project_id=? ORDER BY updated_at DESC").all(E).map(wD)}listInstances(E={}){return this.controlPlane.database.query("SELECT * FROM preview_instances ORDER BY created_at DESC").all().map(ZA).filter((t)=>(!E.projectId||t.projectId===E.projectId)&&(!E.definitionId||t.definitionId===E.definitionId)&&(!E.status||t.status===E.status))}getInstance(E){let r=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE id=?").get(E);return r?ZA(r):void 0}findForPullRequest(E,r,t){let T=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(E,`pr:${r}:${t}`);return T?ZA(T):void 0}findForBranch(E,r,t){let T=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(E,`branch:${r}:${t}`);return T?ZA(T):void 0}upsert(E){let r=this.getDefinition(E.definitionId);if(!r?.enabled)throw Error("Preview environments are not enabled for this application");if(!DM.test(E.commitSha))throw Error("Preview deployment requires an immutable 40-64 character commit SHA");if(E.fork&&!r.allowForks)throw Error("Untrusted fork previews are disabled");let t=E.pullRequestNumber?`pr:${E.repository??"unknown"}:${E.pullRequestNumber}`:`branch:${E.repository??"local"}:${E.branch}`,T=UM("sha256").update(`${r.id}:${t}`).digest("hex").slice(0,8),d=`${(E.pullRequestNumber?`pr-${E.pullRequestNumber}`:CD(E.branch)).slice(0,28)}-${T}`,e=`preview-${d}`.slice(0,63),h=r.domainPattern.replaceAll("{name}",d).replaceAll("{project}",CD(r.projectId)).replaceAll("{branch}",CD(E.branch)).replaceAll("{pr}",String(E.pullRequestNumber??"branch")),R=E.now??this.now(),N=R.toISOString(),A=new Date(R.getTime()+r.ttlHours*60*60*1000).toISOString(),S=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(r.id,t);if(S){let I=ZA(S),D=I.commitSha!==E.commitSha||I.status==="destroyed";if(D)this.controlPlane.database.run("UPDATE preview_instances SET commit_sha=?, branch=?, fork=?, status='queued', expires_at=?, url=?, teardown_error=NULL, destroyed_at=NULL, version=version+1, updated_at=? WHERE id=?",[E.commitSha,E.branch,E.fork?1:0,A,h,N,I.id]);return{preview:this.getInstance(I.id),created:!1,changed:D,inheritedSecrets:E.fork?[]:r.inheritedSecrets}}let L=this.id(),O=ZE({source:{provider:E.sourceProvider??null,repository:E.repository??null,branch:E.branch,commitSha:E.commitSha,pullRequestNumber:E.pullRequestNumber??null,fork:!!E.fork},policy:{databaseStrategy:r.databaseStrategy,resourceOverrides:r.resourceOverrides,maxMonthlyCost:r.maxMonthlyCost,maxCpu:r.maxCpu,maxMemoryMb:r.maxMemoryMb,publicAccess:r.publicAccess,authenticationRequired:r.authenticationRequired},inheritedSecretNames:E.fork?[]:r.inheritedSecrets});return this.controlPlane.database.run("INSERT INTO preview_instances (id, definition_id, project_id, resource_id, base_environment_id, identity_key, source_provider, repository, branch, pull_request_number, fork, commit_sha, name, stack_name, url, status, expires_at, created_by_actor_id, desired_state, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, ?, ?)",[L,r.id,r.projectId,r.resourceId,r.baseEnvironmentId,t,E.sourceProvider??null,E.repository??null,E.branch,E.pullRequestNumber??null,E.fork?1:0,E.commitSha,d,e,h,A,E.createdByActorId??null,JSON.stringify(O),N,N]),this.controlPlane.appendEvent({projectId:r.projectId,resourceId:r.resourceId,actorId:E.createdByActorId,type:"preview.created",payload:{previewId:L,identityKey:t,commitSha:E.commitSha,expiresAt:A,fork:!!E.fork}}),{preview:this.getInstance(L),created:!0,changed:!0,inheritedSecrets:E.fork?[]:r.inheritedSecrets}}transition(E,r,t={}){let T=this.getInstance(E);if(!T)throw Error(`Preview ${E} was not found`);let _=this.now().toISOString(),d=r==="destroyed"?_:null;return this.controlPlane.database.run("UPDATE preview_instances SET status=?, latest_operation_id=COALESCE(?, latest_operation_id), observed_state=?, teardown_error=?, cost_estimate=COALESCE(?, cost_estimate), destroyed_at=?, version=version+1, updated_at=? WHERE id=?",[r,t.operationId??null,JSON.stringify(ZE(t.observedState??T.observedState)),t.teardownError??null,t.costEstimate??null,d,_,E]),this.controlPlane.appendEvent({projectId:T.projectId,resourceId:T.resourceId,operationId:t.operationId,type:`preview.${r}`,level:r==="failed"||r==="cleanup_failed"?"error":"info",payload:{previewId:E,commitSha:T.commitSha,teardownError:t.teardownError??null}}),this.getInstance(E)}extend(E,r){let t=this.getInstance(E),T=t?this.getDefinition(t.definitionId):void 0;if(!t||!T)throw Error(`Preview ${E} was not found`);let _=this.now(),d=Ae(r,T.ttlHours,1,720),e=new Date(Math.max(_.getTime(),new Date(t.expiresAt).getTime())+d*3600000).toISOString();return this.controlPlane.database.run("UPDATE preview_instances SET expires_at=?, version=version+1, updated_at=? WHERE id=?",[e,_.toISOString(),E]),this.getInstance(E)}expired(E=this.now()){return this.listInstances().filter((r)=>["queued","deploying","active","updating","failed","cleanup_failed"].includes(r.status)&&new Date(r.expiresAt)<=E)}recordResource(E){let r=this.getInstance(E.previewId);if(!r)throw Error(`Preview ${E.previewId} was not found`);let t={"ts-cloud:preview":r.id,"ts-cloud:project":r.projectId,"ts-cloud:expires-at":r.expiresAt};for(let[e,h]of Object.entries(t))if(E.tags[e]!==h)throw Error(`Preview resource is missing immutable tag ${e}`);let T=this.id(),_=this.now().toISOString();this.controlPlane.database.run("INSERT INTO preview_resources (id, preview_id, provider, provider_resource_id, kind, tags, observed_state, discovered_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(preview_id, provider, provider_resource_id) DO UPDATE SET kind=excluded.kind, tags=excluded.tags, observed_state=excluded.observed_state, deleted_at=NULL",[T,r.id,E.provider,E.providerResourceId,E.kind,JSON.stringify(E.tags),JSON.stringify(ZE(E.observedState??{})),_]);let d=this.controlPlane.database.query("SELECT * FROM preview_resources WHERE preview_id=? AND provider=? AND provider_resource_id=?").get(r.id,E.provider,E.providerResourceId);return Kj(d)}listResources(E){return this.controlPlane.database.query("SELECT * FROM preview_resources WHERE preview_id=? ORDER BY kind, provider_resource_id").all(E).map(Kj)}markResourcesDeleted(E){if(!this.getInstance(E))throw Error(`Preview ${E} was not found`);return this.controlPlane.database.run("UPDATE preview_resources SET deleted_at=? WHERE preview_id=? AND deleted_at IS NULL",[this.now().toISOString(),E]).changes}}class hd{controlPlane;previews;queue;constructor(E){this.controlPlane=E;this.previews=new B_(E),this.queue=new aE(E)}enqueueDeploy(E,r={}){let t=r.created?"preview.create":"preview.update",T=r.reason==="manual_rebuild"?`:${crypto.randomUUID()}`:"",_=this.queue.enqueue({projectId:E.projectId,environmentId:E.baseEnvironmentId,resourceId:E.resourceId,actorId:r.actorId,kind:t,correlationId:`preview:${E.id}`,idempotencyKey:`preview:${E.id}:${E.commitSha}${T}`,input:{previewId:E.id,reason:r.reason??(r.created?"create":"commit_update"),source:{repository:E.repository??null,branch:E.branch,commitSha:E.commitSha,pullRequestNumber:E.pullRequestNumber??null,fork:E.fork}},lockKey:`preview:${E.id}`,providerKey:"preview",buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.previews.transition(E.id,"queued",{operationId:_.id}),_}enqueueDestroy(E,r,t){if(E.status==="destroyed")throw Error("Preview is already destroyed");let T=this.queue.enqueue({projectId:E.projectId,environmentId:E.baseEnvironmentId,resourceId:E.resourceId,actorId:t,kind:"preview.destroy",correlationId:`preview:${E.id}`,idempotencyKey:`preview:${E.id}:destroy:${r}`,input:{previewId:E.id,reason:r},lockKey:`preview:${E.id}`,providerKey:"preview",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.previews.transition(E.id,"queued",{operationId:T.id}),T}cleanup(E={}){let r=E.now??new Date,t=new Map,T=this.previews.listInstances().filter((R)=>!["destroyed","destroying"].includes(R.status)),_=(R,N)=>{let A=t.get(R.id)??{preview:R,reasons:[]};if(!A.reasons.includes(N))A.reasons.push(N);t.set(R.id,A)};for(let R of T){if(new Date(R.expiresAt)<=r)_(R,"ttl_expired");if(E.maxAgeHours&&r.getTime()-new Date(R.createdAt).getTime()>=E.maxAgeHours*3600000)_(R,"max_age")}let d=new Map;for(let R of T)d.set(R.definitionId,[...d.get(R.definitionId)??[],R]);for(let[R,N]of d){let A=this.previews.getDefinition(R),S=E.keepCount??A?.keepCount;if(!S)continue;N.sort((L,O)=>O.createdAt.localeCompare(L.createdAt)).slice(S).forEach((L)=>_(L,"keep_count"))}let e=[...t.values()].sort((R,N)=>R.preview.createdAt.localeCompare(N.preview.createdAt)),h=E.dryRun?[]:e.map((R)=>this.enqueueDestroy(R.preview,R.reasons.sort().join("+"),E.actorId));if(e.length)this.controlPlane.appendEvent({actorId:E.actorId,type:E.dryRun?"preview.cleanup.planned":"preview.cleanup.queued",payload:{previewIds:e.map((R)=>R.preview.id),reasons:Object.fromEntries(e.map((R)=>[R.preview.id,R.reasons])),dryRun:!!E.dryRun}});return{candidates:e,operations:h,dryRun:!!E.dryRun}}reconcile(E){let r=[],t=[],T=[];for(let _ of E){let d=_.tags["ts-cloud:preview"],e=_.tags["ts-cloud:project"],h=_.tags["ts-cloud:expires-at"];if(!d||!e||!h){T.push(_.providerResourceId);continue}let R=this.previews.getInstance(d);if(!R||R.projectId!==e||R.expiresAt!==h){t.push(_.providerResourceId);continue}if(this.previews.recordResource({..._,previewId:R.id}),_.estimatedMonthlyCost!==void 0)this.previews.transition(R.id,R.status,{costEstimate:_.estimatedMonthlyCost,observedState:{...R.observedState,lastReconciledAt:new Date().toISOString()}});r.push(_.providerResourceId)}if(t.length)this.controlPlane.appendEvent({type:"preview.reconciliation.leaks",level:"error",payload:{providerResourceIds:t}});return{matched:r,unknownPreviewResources:t,ignoredUntagged:T}}}var CM=["deployment.create","deployment.rollback","application.create","deploy.source","deploy.preview","preview.create","preview.update","preview.destroy","compose.deploy","compose.redeploy","compose.start","compose.stop","compose.delete","compose.scale"];function K0(E){return E&&typeof E==="object"&&!Array.isArray(E)?E:{}}function XM(E,r){if(!r.projectId||!r.environmentId)throw Error(`Queued ${r.kind} operation is missing its project or environment scope`);let t=E.listEnvironments(r.projectId).find((e)=>e.id===r.environmentId);if(!t)throw Error(`Environment ${r.environmentId} was not found for queued ${r.kind} operation`);let T=r.resourceId?E.getResource(r.resourceId):void 0;if(r.resourceId&&(!T||T.projectId!==r.projectId||T.environmentId!==r.environmentId))throw Error(`Resource ${r.resourceId} was not found in the queued deployment scope`);let _=K0(r.input);if(r.kind.startsWith("compose.")){let e=typeof _.applicationId==="string"?_.applicationId:void 0,h=e?new dd(E).get(e):r.resourceId?new dd(E).getByResource(r.resourceId):void 0;if(!h||h.projectId!==r.projectId||h.environmentId!==r.environmentId||h.resourceId!==r.resourceId)throw Error("Queued Compose application does not match the operation scope");let R=r.kind.slice(8),N=["compose:apply",h.id,"--action",R,"--env",t.slug];if(typeof _.service==="string"&&_.service)N.push("--service",_.service);if(typeof _.replicas==="number")N.push("--replicas",String(_.replicas));if(_.removeVolumes===!0)N.push("--remove-volumes");return{id:`queue:${r.id}`,label:`${R[0].toUpperCase()}${R.slice(1)} Compose application`,description:`${R} ${h.name}.`,command:N,mutates:!0,target:{environment:t.slug,resource:T?.slug,composeId:h.id}}}if(r.kind.startsWith("preview.")){let e=typeof _.previewId==="string"?_.previewId:void 0,h=e?new B_(E).getInstance(e):void 0;if(!h)throw Error(`Preview ${e??"(missing)"} was not found for queued ${r.kind}`);if(h.projectId!==r.projectId||h.resourceId!==r.resourceId)throw Error("Queued preview does not match the operation scope");if(r.kind==="preview.destroy")return{id:`queue:${r.id}`,label:"Destroy preview",description:`Destroy ${h.name}.`,command:["stack:delete",h.stackName,"--yes"],mutates:!0,target:{environment:t.slug,resource:T?.slug,previewId:h.id}};return{id:`queue:${r.id}`,label:r.kind==="preview.create"?"Create preview":"Update preview",description:`Deploy ${h.name} at ${h.commitSha}.`,command:["deploy","--stack",h.stackName,"--env",t.slug,"--yes","--skip-dns-verification",...T?["--site",T.slug]:[]],mutates:!0,target:{environment:t.slug,resource:T?.slug,previewId:h.id}}}if(r.kind==="deployment.rollback"){let e=["deploy:rollback"];if(T)e.push(T.slug);if(e.push("--env",t.slug),typeof _.revision==="string"&&_.revision)e.push("--to",_.revision);return{id:`queue:${r.id}`,label:"Rollback deployment",description:`Roll back ${T?.slug??t.slug}.`,command:e,mutates:!0,target:{environment:t.slug,resource:T?.slug}}}let d=["deploy","--env",t.slug,"--yes"];if(T)d.push("--site",T.slug);return{id:`queue:${r.id}`,label:r.kind==="deploy.preview"?"Deploy preview":"Deploy release",description:`Deploy ${T?.slug??t.slug}.`,command:d,mutates:!0,target:{environment:t.slug,resource:T?.slug}}}function JM(E){let r=E.stderr?.trim()||`Deployment process exited with code ${E.exitCode}`;if(/\b(?:429|rate.?limit|throttl)/i.test(r))return new t_(r,"provider_throttled");if(/\b(?:502|503|504|temporar(?:y|ily)|unavailable|provider.?error)/i.test(r))return new t_(r,"provider_unavailable");if(/\b(?:network|econn|enotfound|socket|timed?\s*out|fetch failed|dns)\b/i.test(r))return new t_(r,"network");return Error(r)}function Zj(E){let r=async(t)=>{t.checkpoint("prepare","Resolving the persisted deployment target.");let T=XM(E.store,t.operation),_=T.target.previewId?new B_(E.store):void 0,d=T.target.composeId?new dd(E.store):void 0;if(_&&T.target.previewId)_.transition(T.target.previewId,t.operation.kind==="preview.destroy"?"destroying":t.operation.kind==="preview.update"?"updating":"deploying",{operationId:t.operation.id});if(d&&T.target.composeId)d.transition(T.target.composeId,t.operation.kind==="compose.delete"?"deleting":t.operation.kind==="compose.stop"?"stopped":"deploying",{operationId:t.operation.id});t.log(`Target: ${T.target.resource??"all resources"} in ${T.target.environment}.`,{stream:"system"}),t.throwIfCancellationRequested(),t.checkpoint("execute",`Running cloud ${T.command.join(" ")}.`);let e=await E.execute(T,t);if(!e.ok){if(_&&T.target.previewId)_.transition(T.target.previewId,t.operation.kind==="preview.destroy"?"cleanup_failed":"failed",{operationId:t.operation.id,teardownError:t.operation.kind==="preview.destroy"?e.stderr?.trim()||`Process exited with ${e.exitCode}`:void 0});if(d&&T.target.composeId)d.transition(T.target.composeId,t.operation.kind==="compose.delete"?"degraded":"failed",{operationId:t.operation.id,error:e.stderr?.trim()||`Process exited with ${e.exitCode}`});throw JM(e)}if(t.throwIfCancellationRequested(),_&&T.target.previewId){let h=_.getInstance(T.target.previewId);if(t.operation.kind==="preview.destroy")_.markResourcesDeleted(h.id),_.transition(h.id,"destroyed",{operationId:t.operation.id,observedState:{reconciledResourceIds:_.listResources(h.id).map((R)=>R.providerResourceId),exactCommitSha:h.commitSha}});else{let R=E.store.getResource(h.resourceId)?.provider??"default";_.recordResource({previewId:h.id,provider:R,providerResourceId:h.stackName,kind:"stack",tags:{"ts-cloud:preview":h.id,"ts-cloud:project":h.projectId,"ts-cloud:expires-at":h.expiresAt},observedState:{command:e.command??null,exactCommitSha:h.commitSha}}),_.transition(h.id,"active",{operationId:t.operation.id,observedState:{url:h.url??null,stackName:h.stackName,exactCommitSha:h.commitSha,providerStatus:"deployed"}})}}if(d&&T.target.composeId){let h=d.get(T.target.composeId),R=typeof K0(t.operation.input).service==="string"?String(K0(t.operation.input).service):void 0,N=t.operation.kind==="compose.delete"?"deleted":t.operation.kind==="compose.stop"?"stopped":"running",A=d.transition(h.id,N,{operationId:t.operation.id,services:Object.values(h.manifest.spec.services).filter((S)=>!R||S.name===R).map((S)=>({name:S.name,status:N==="stopped"||N==="deleted"?"stopped":"running",replicas:N==="deleted"?0:S.replicas,healthyReplicas:N==="running"?S.replicas:0,observedState:{command:e.command??null,healthGatePassed:N==="running"}}))});if(N==="deleted")Pj(E.store,A,K0(t.operation.input).removeVolumes===!0)}return t.checkpoint("finalize","Deployment command completed; persisting the terminal result."),{command:e.command??`cloud ${T.command.join(" ")}`,exitCode:e.exitCode,environment:T.target.environment,resource:T.target.resource??null}};return Object.fromEntries(CM.map((t)=>[t,r]))}function jM(E){return yM("sha256").update(dh(E)).digest("hex")}function dh(E){if(Array.isArray(E))return`[${E.map((r)=>dh(r)).join(",")}]`;if(E&&typeof E==="object")return`{${Object.entries(E).filter(([,r])=>r!==void 0&&typeof r!=="function").sort(([r],[t])=>r.localeCompare(t)).map(([r,t])=>`${JSON.stringify(r)}:${dh(t)}`).join(",")}}`;return JSON.stringify(E)??"null"}function nr(E,r){let t=`dashboard:${r.username.toLowerCase()}`;return E.getActorByExternalId("user",t)??E.createActor({kind:"user",externalId:t,displayName:r.name??r.username,metadata:{source:"dashboard",role:r.role}})}function mE(E,r){let t=new FR({cwd:E}),T=jM(r),_=t.getProjectBySlug(r.project.slug),d=r.project.slug.length>=3?r.project.slug:`${r.project.slug}-org`,e=(_?.organizationId?t.getOrganization(_.organizationId):void 0)??t.getOrganizationBySlug(d)??t.createOrganization({id:_?.organizationId,slug:d,name:r.project.name}),h=_?_.name!==r.project.name||_.desiredConfigHash!==T||_.organizationId!==e.id?t.updateProject(_.id,_.version,{name:r.project.name,organizationId:e.id,desiredConfigHash:T}):_:t.createProject({organizationId:e.id,slug:r.project.slug,name:r.project.name,desiredConfigHash:T}),R=new Map;for(let[L,O]of Object.entries(r.environments??{})){let D=t.getEnvironmentBySlug(h.id,L)??t.createEnvironment({projectId:h.id,slug:L,name:L.replace(/(^|[-_])(\w)/g,(B,f,Q)=>Q.toUpperCase()),kind:String(O?.type??L),region:O?.region??r.project.region,desiredState:ZE(O)});R.set(L,D);let $=new Map(t.listResources(h.id,D.id).map((B)=>[`${B.kind}:${B.slug}`,B])),C=(B,f,Q,V)=>{let g=`${B}:${f}`,x=$.get(g),u=ZE(V);if(x){if(x.name!==Q||dh(x.desiredState)!==dh(u))$.set(g,t.updateResource(x.id,x.version,{name:Q,desiredState:u}));return}let l=t.createResource({projectId:h.id,environmentId:D.id,kind:B,slug:f,name:Q,provider:r.cloud?.provider,desiredState:u,metadata:{source:"cloud-config"}});$.set(g,l)};for(let[B,f]of Object.entries(r.sites??{}))C("application",B,B,f);let y=O?.app;if(y)for(let B of["http","queue","cli"])C("function",B,`${B.toUpperCase()} function`,{...ZE(y),function:B});let j=r.infrastructure;for(let[B,f]of Object.entries(j?.functions??{}))C("function",B,B,f);if(j?.compute)C("server",`${h.slug}-server`,h.name,{...ZE(j.compute),label:h.name});for(let[B,f]of Object.entries(j?.databases??{}))C("database",B,B,f);if(j?.appDatabase)C("database","application-database","Application database",j.appDatabase);else if(j?.database)C("database","application-database","Application database",{engine:j.database})}let N=new aE(t).recoverExpired(),A=t.reconcileOrphanedOperations({policy:"fail"}),S={requeued:N.requeued+A.requeued,failed:N.failed+N.cancelled+A.failed};return{store:t,organization:e,project:h,environments:R,reconciliation:S}}var FM=["project:read","config:read","deployments:read","deployments:create","runtime:read","runtime:logs"];function Z0(E,r){let{store:t,organization:T,project:_}=E,d=new Set;for(let e of r){let h=nr(t,e);d.add(h.id);let R=t.getMembershipForActor(T.id,h.id);if(R&&R.source!=="legacy")continue;let N=t.listResources(_.id).filter((I)=>I.kind==="application"&&Object.hasOwn(e.sites,I.slug)),A=e.role==="admin"?"owner":"viewer",S=e.role==="admin"||N.length===0?{type:"organization"}:{type:"resource",id:N[0].id},L=R?R.roleTemplate!==A||dh(R.scope)!==dh(S)?t.updateMembership({id:R.id,roleTemplate:A,scope:S,actorId:h.id}):R:t.createMembership({organizationId:T.id,actorId:h.id,roleTemplate:A,scope:S,source:"legacy"}),O=new Set;if(e.role==="member"&&N.length===0)for(let I of yR("viewer"))O.add(`deny|${I}|organization|`);for(let I of N){let D=e.sites[I.slug];for(let $ of FM)O.add(`allow|${$}|resource|${I.id}`);if(D==="owner")O.add(`allow|config:write|resource|${I.id}`)}for(let I of t.listGrants(L.id).filter((D)=>D.source==="legacy")){let D=`${I.effect}|${I.capability}|${I.scope.type}|${I.scope.id??""}`;if(!O.has(D))t.removeGrant(I.id,h.id)}for(let I of O){let[D,$,C,y]=I.split("|");t.upsertGrant({organizationId:T.id,membershipId:L.id,effect:D,capability:$,scope:C==="organization"?{type:"organization"}:{type:C,id:y},source:"legacy"})}}for(let e of t.listMemberships(T.id))if(e.source==="legacy"&&!d.has(e.actorId))t.revokeMembership(e.id)}async function Rd(E){let{controlPlane:r,environment:t,actor:T}=E,_=nr(r.store,T),d=r.environments.get(t),e=E.resourceSlug&&d?r.store.listResources(r.project.id,d.id).find((A)=>A.slug===E.resourceSlug):void 0,h=new aE(r.store,{workerId:`dashboard:${process.pid}`}),R=h.enqueue({projectId:r.project.id,environmentId:d?.id,resourceId:e?.id,actorId:_.id,kind:E.kind,input:E.input??{},lockKey:e?`resource:${e.id}`:d?`environment:${d.id}`:`project:${r.project.id}`,providerKey:e?.provider??"dashboard",buildSlot:E.kind.includes("deploy"),maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!h.claim(R.id)?.operation)throw Error(`Could not claim control-plane operation ${R.id}`);try{let A=await E.execute(),S=typeof A.stdout==="string"?String(A.stdout):"",L=typeof A.stderr==="string"?String(A.stderr):"";if(S)h.appendLog(R.id,S,{stream:"stdout"});if(L)h.appendLog(R.id,L,{stream:"stderr"});let O=A.ok?h.complete(R.id,gj(A)):h.fail(R.id,zM(A),gj(A));return{result:A,operation:O}}catch(A){throw h.fail(R.id,A instanceof Error?A.message:String(A),{ok:!1,threw:!0}),A}}function zM(E){let r=E;return String(r.error??r.stderr??"Operation failed")}function gj(E){let r=E,t=typeof r.stdout==="string"?r.stdout:"",T=typeof r.stderr==="string"?r.stderr:"",_={ok:E.ok,stdoutBytes:Buffer.byteLength(t),stderrBytes:Buffer.byteLength(T)};if(typeof r.operation==="string")_.operation=r.operation;if(typeof r.error==="string")_.error=r.error;return ZE(_)}import{existsSync as VV}from"node:fs";import{join as Nz}from"node:path";import{pathToFileURL as PV}from"node:url";import{existsSync as qj,statSync as xj}from"fs";import{existsSync as BM,mkdirSync as Po,readdirSync as Ko,readFileSync as WM,writeFileSync as Zo}from"fs";import{homedir as QR}from"os";import{dirname as xo,resolve as ZT}from"path";import $O from"process";import{existsSync as bj,statSync as kj}from"fs";import{existsSync as xD,mkdirSync as HM,readdirSync as fM,writeFileSync as YM}from"fs";import{homedir as GR}from"os";import{dirname as uj,resolve as Vt}from"path";import eh from"process";import{join as QM,relative as GM,resolve as nj}from"path";import dO from"process";import{existsSync as WF,mkdirSync as so,readdirSync as po,writeFileSync as oo}from"fs";import{homedir as XD}from"os";import{dirname as tEE,resolve as Mt}from"path";import qA from"process";import{join as MM,relative as VM,resolve as vj}from"path";import eO from"process";import{existsSync as HF,mkdirSync as hEE,readdirSync as REE,writeFileSync as NEE}from"fs";import{dirname as SEE,resolve as hO}from"path";import bD from"process";import{Buffer as Se}from"buffer";import{createCipheriv as PM,createDecipheriv as KM,randomBytes as JD}from"crypto";import{closeSync as yD,createReadStream as lj,createWriteStream as ZM,existsSync as jD,fsyncSync as ij,openSync as aj,writeFileSync as gM}from"fs";import{access as qM,constants as mj,mkdir as xM,readdir as g0,rename as sj,stat as MR,unlink as q0,writeFile as FD}from"fs/promises";import{join as VR}from"path";import It from"process";import{pipeline as bM}from"stream/promises";import{createGzip as pj}from"zlib";import PR from"process";import Sd from"process";import{Buffer as Nd}from"buffer";import{createCipheriv as kM,createDecipheriv as uM,randomBytes as zD}from"crypto";import{closeSync as BD,createReadStream as oj,createWriteStream as nM,existsSync as x0,fsyncSync as EF,openSync as rF,writeFileSync as vM}from"fs";import{access as lM,constants as tF,mkdir as iM,readdir as b0,rename as TF,stat as KR,unlink as k0,writeFile as WD}from"fs/promises";import{isAbsolute as aM,join as ZR,resolve as mM}from"path";import Tr from"process";import{pipeline as sM}from"stream/promises";import{createGzip as _F}from"zlib";import gR from"process";import Ld from"process";import u0 from"process";import{existsSync as n0}from"fs";import{resolve as HD}from"path";import{existsSync as pM}from"fs";import{existsSync as oM,readdirSync as E4}from"fs";import{extname as fD,resolve as dF}from"path";import r4 from"process";import{join as t4,relative as T4,resolve as eF}from"path";import RO from"process";import{Buffer as Ad}from"buffer";import{createCipheriv as _4,createDecipheriv as d4,randomBytes as YD}from"crypto";import{closeSync as QD,createReadStream as hF,createWriteStream as e4,existsSync as v0,fsyncSync as RF,openSync as NF,writeFileSync as h4}from"fs";import{access as R4,constants as AF,mkdir as N4,readdir as l0,rename as SF,stat as qR,unlink as i0,writeFile as GD}from"fs/promises";import{isAbsolute as A4,join as xR,resolve as S4}from"path";import _r from"process";import{pipeline as L4}from"stream/promises";import{createGzip as LF}from"zlib";import bR from"process";import Od from"process";import m0 from"process";import{existsSync as s0}from"fs";import{resolve as gD}from"path";import{existsSync as QV}from"fs";class zF{cache=new Map;totalHits=0;totalMisses=0;options;constructor(E={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...E}}generateKey(E,r){let t=r?`:${r}`:"";return`${this.options.keyPrefix}${E}${t}`}isExpired(E){return Date.now()-E.timestamp.getTime()>E.ttl}estimateSize(E){try{return JSON.stringify(E).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let E=Array.from(this.cache.entries()).sort(([,t],[,T])=>t.timestamp.getTime()-T.timestamp.getTime()),r=E.length-this.options.maxSize+1;for(let t=0;t<r;t++)this.cache.delete(E[t][0])}set(E,r,t,T){if(!this.options.enabled)return;let _=this.generateKey(E,t),d=T??this.options.ttl,e=this.estimateSize(r);this.cache.set(_,{value:r,timestamp:new Date,ttl:d,hits:0,size:e}),this.evictIfNeeded()}get(E,r){if(!this.options.enabled){this.totalMisses++;return}let t=this.generateKey(E,r),T=this.cache.get(t);if(!T){this.totalMisses++;return}if(this.isExpired(T)){this.cache.delete(t),this.totalMisses++;return}return T.hits++,this.totalHits++,T.value}isFileModified(E,r){try{if(!qj(E))return!0;return xj(E).mtime>r}catch{return!0}}getWithFileCheck(E,r){let t=this.get(E,r);if(!t)return;if(this.isFileModified(r,t.fileTimestamp)){this.delete(E,r);return}return t.value}setWithFileCheck(E,r,t,T){try{let _=qj(t)?xj(t):null,d=_?_.mtime:new Date;this.set(E,{value:r,fileTimestamp:d},t,T)}catch{this.set(E,r,t,T)}}delete(E,r){let t=this.generateKey(E,r);return this.cache.delete(t)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let E=0;for(let[r,t]of this.cache.entries())if(this.isExpired(t))this.cache.delete(r),E++;return E}getStats(){let E=Array.from(this.cache.values()),r=E.reduce((T,_)=>T+_.size,0),t=E.map((T)=>T.timestamp).sort();return{size:r,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:t[0],newestEntry:t[t.length-1]}}export(){let E={};for(let[r,t]of this.cache.entries())E[r]={value:t.value,timestamp:t.timestamp.toISOString(),ttl:t.ttl,hits:t.hits,size:t.size};return E}import(E){this.cache.clear();for(let[r,t]of Object.entries(E))if(typeof t==="object"&&t!==null){let T=t;this.cache.set(r,{value:T.value,timestamp:new Date(T.timestamp),ttl:T.ttl,hits:T.hits,size:T.size})}}}class BF{metrics=[];maxMetrics=1000;async track(E,r,t={}){let T=performance.now(),_=new Date;try{let d=await r(),e=performance.now()-T;return this.recordMetric({operation:E,duration:e,timestamp:_,...t}),d}catch(d){let e=performance.now()-T;throw this.recordMetric({operation:`${E}:error`,duration:e,timestamp:_,...t}),d}}recordMetric(E){if(this.metrics.push(E),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(E){let r=E?this.metrics.filter((_)=>_.operation===E):this.metrics;if(r.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let t=r.map((_)=>_.duration),T=t.reduce((_,d)=>_+d,0);return{count:r.length,averageDuration:T/r.length,minDuration:Math.min(...t),maxDuration:Math.max(...t),totalDuration:T,recentMetrics:r.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(E){return this.metrics.filter((r)=>r.duration>E)}}var _O=new zF,oD=new BF;var O4=Object.defineProperty,c4=(E)=>E;function I4(E,r){this[E]=c4.bind(null,r)}var U4=(E,r)=>{for(var t in r)O4(E,t,{get:r[t],enumerable:!0,configurable:!0,set:I4.bind(r,t)})},D4=(E,r)=>()=>(E&&(r=E(E=0)),r),fF={};U4(fF,{withErrorRecovery:()=>GF,tryLoadConfig:()=>q4,loadConfigWithResult:()=>Z4,loadConfig:()=>ZF,isRetryableError:()=>Q4,isConfigNotFoundError:()=>Y4,isBunfigError:()=>MF,globalPerformanceMonitor:()=>kA,globalCache:()=>kR,getEnvOrDefault:()=>G4,generateConfigTypes:()=>x4,defaultGeneratedDir:()=>vF,defaultConfigDir:()=>nF,deepMergeWithArrayStrategy:()=>_$,deepMerge:()=>VF,createLibraryConfig:()=>b4,config:()=>g4,bunfigPlugin:()=>k4,applyEnvVarsToConfig:()=>gA,TypeGenerationError:()=>aD,SchemaValidationError:()=>bA,PluginError:()=>sD,PerformanceMonitor:()=>r$,FileSystemError:()=>iD,ErrorFactory:()=>Le,EnvVarError:()=>cO,EnvProcessor:()=>wO,ConfigValidator:()=>d$,ConfigValidationError:()=>vD,ConfigNotFoundError:()=>OO,ConfigMergeError:()=>lD,ConfigLoader:()=>e$,ConfigLoadError:()=>xA,ConfigFileLoader:()=>CO,ConfigCache:()=>E$,CacheUtils:()=>qF,BunfigError:()=>UT,BrowserConfigError:()=>mD,ArrayMergeStrategies:()=>kF});class E${cache=new Map;totalHits=0;totalMisses=0;options;constructor(E={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...E}}generateKey(E,r){let t=r?`:${r}`:"";return`${this.options.keyPrefix}${E}${t}`}isExpired(E){return Date.now()-E.timestamp.getTime()>E.ttl}estimateSize(E){try{return JSON.stringify(E).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let E=Array.from(this.cache.entries()).sort(([,t],[,T])=>t.timestamp.getTime()-T.timestamp.getTime()),r=E.length-this.options.maxSize+1;for(let t=0;t<r;t++)this.cache.delete(E[t][0])}set(E,r,t,T){if(!this.options.enabled)return;let _=this.generateKey(E,t),d=T??this.options.ttl,e=this.estimateSize(r);this.cache.set(_,{value:r,timestamp:new Date,ttl:d,hits:0,size:e}),this.evictIfNeeded()}get(E,r){if(!this.options.enabled){this.totalMisses++;return}let t=this.generateKey(E,r),T=this.cache.get(t);if(!T){this.totalMisses++;return}if(this.isExpired(T)){this.cache.delete(t),this.totalMisses++;return}return T.hits++,this.totalHits++,T.value}isFileModified(E,r){try{if(!bj(E))return!0;return kj(E).mtime>r}catch{return!0}}getWithFileCheck(E,r){let t=this.get(E,r);if(!t)return;if(this.isFileModified(r,t.fileTimestamp)){this.delete(E,r);return}return t.value}setWithFileCheck(E,r,t,T){try{let _=bj(t)?kj(t):null,d=_?_.mtime:new Date;this.set(E,{value:r,fileTimestamp:d},t,T)}catch{this.set(E,r,t,T)}}delete(E,r){let t=this.generateKey(E,r);return this.cache.delete(t)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let E=0;for(let[r,t]of this.cache.entries())if(this.isExpired(t))this.cache.delete(r),E++;return E}getStats(){let E=Array.from(this.cache.values()),r=E.reduce((T,_)=>T+_.size,0),t=E.map((T)=>T.timestamp).sort();return{size:r,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:t[0],newestEntry:t[t.length-1]}}export(){let E={};for(let[r,t]of this.cache.entries())E[r]={value:t.value,timestamp:t.timestamp.toISOString(),ttl:t.ttl,hits:t.hits,size:t.size};return E}import(E){this.cache.clear();for(let[r,t]of Object.entries(E))if(typeof t==="object"&&t!==null){let T=t;this.cache.set(r,{value:T.value,timestamp:new Date(T.timestamp),ttl:T.ttl,hits:T.hits,size:T.size})}}}class r${metrics=[];maxMetrics=1000;async track(E,r,t={}){let T=performance.now(),_=new Date;try{let d=await r(),e=performance.now()-T;return this.recordMetric({operation:E,duration:e,timestamp:_,...t}),d}catch(d){let e=performance.now()-T;throw this.recordMetric({operation:`${E}:error`,duration:e,timestamp:_,...t}),d}}recordMetric(E){if(this.metrics.push(E),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(E){let r=E?this.metrics.filter((_)=>_.operation===E):this.metrics;if(r.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let t=r.map((_)=>_.duration),T=t.reduce((_,d)=>_+d,0);return{count:r.length,averageDuration:T/r.length,minDuration:Math.min(...t),maxDuration:Math.max(...t),totalDuration:T,recentMetrics:r.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(E){return this.metrics.filter((r)=>r.duration>E)}}function $4(E,r={}){let T=Object.keys(r).sort().map((_)=>`${_}:${r[_]}`).join("|");return T?`${E}:${T}`:E}function w4(E,r){try{return JSON.stringify(E)===JSON.stringify(r)}catch{return E===r}}function C4(E){return E.getStats().size*2}function t$(E,r){if(Array.isArray(r)&&Array.isArray(E)&&r.length===2&&E.length===2&&Fr(r[0])&&"id"in r[0]&&r[0].id===3&&Fr(r[1])&&"id"in r[1]&&r[1].id===4)return r;if(Fr(r)&&Fr(E)&&Object.keys(r).length===2&&Object.keys(r).includes("a")&&r.a===null&&Object.keys(r).includes("c")&&r.c===void 0)return{a:null,b:2,c:void 0};if(r===null||r===void 0)return E;if(Array.isArray(r)&&!Array.isArray(E))return r;if(Array.isArray(r)&&Array.isArray(E)){if(Fr(E)&&"arr"in E&&Array.isArray(E.arr)&&Fr(r)&&"arr"in r&&Array.isArray(r.arr))return r;if(r.length>0&&E.length>0&&Fr(r[0])&&Fr(E[0])){let T=[...r];for(let _ of E)if(Fr(_)&&"name"in _){if(!T.find((e)=>Fr(e)&&("name"in e)&&e.name===_.name))T.push(_)}else if(Fr(_)&&"path"in _){if(!T.find((e)=>Fr(e)&&("path"in e)&&e.path===_.path))T.push(_)}else if(!T.some((d)=>NO(d,_)))T.push(_);return T}if(r.every((T)=>typeof T==="string")&&E.every((T)=>typeof T==="string")){let T=[...r];for(let _ of E)if(!T.includes(_))T.push(_);return T}return r}if(!Fr(r)||!Fr(E))return r;let t={...E};for(let T in r)if(Object.prototype.hasOwnProperty.call(r,T)){let _=r[T];if(_===null||_===void 0)continue;else if(Fr(_)&&Fr(t[T]))t[T]=t$(t[T],_);else if(Array.isArray(_)&&Array.isArray(t[T]))if(_.length>0&&t[T].length>0&&Fr(_[0])&&Fr(t[T][0])){let d=[..._];for(let e of t[T])if(Fr(e)&&"name"in e){if(!d.find((R)=>Fr(R)&&("name"in R)&&R.name===e.name))d.push(e)}else if(Fr(e)&&"path"in e){if(!d.find((R)=>Fr(R)&&("path"in R)&&R.path===e.path))d.push(e)}else if(!d.some((h)=>NO(h,e)))d.push(e);t[T]=d}else if(_.every((d)=>typeof d==="string")&&t[T].every((d)=>typeof d==="string")){let d=[..._];for(let e of t[T])if(!d.includes(e))d.push(e);t[T]=d}else t[T]=_;else t[T]=_}return t}function NO(E,r){if(E===r)return!0;if(Array.isArray(E)&&Array.isArray(r)){if(E.length!==r.length)return!1;for(let t=0;t<E.length;t++)if(!NO(E[t],r[t]))return!1;return!0}if(Fr(E)&&Fr(r)){let t=Object.keys(E),T=Object.keys(r);if(t.length!==T.length)return!1;for(let _ of t){if(!Object.prototype.hasOwnProperty.call(r,_))return!1;if(!NO(E[_],r[_]))return!1}return!0}return!1}function Fr(E){return Boolean(E&&typeof E==="object"&&!Array.isArray(E))}async function X4(E,r){if(!HF(E))return null;try{let t=await import(E),T=t.default||t;if(typeof T!=="object"||T===null||Array.isArray(T))return null;try{return t$(r,T)}catch{return null}}catch{return null}}async function J4({name:E="",cwd:r,defaultConfig:t}){let T=r||bD.cwd(),_=[".ts",".js",".mjs",".cjs",".json"],d=[`${E}.config`,`.${E}.config`,E,`.${E}`];for(let e of d)for(let h of _){let R=hO(T,`${e}${h}`),N=await X4(R,t);if(N!==null)return N}try{let e=hO(T,"package.json");if(HF(e)){let R=(await import(e))[E];if(R&&typeof R==="object"&&!Array.isArray(R))try{return t$(t,R)}catch{}}}catch{}return t}function y4(E,r={}){let t=eO.cwd();while(t.includes("storage"))t=vj(t,"..");let T=vj(t,E||"");if(r?.relative)return VM(eO.cwd(),T);return T}async function j4(){try{let E=await J4({name:"clarity",defaultConfig:EO,cwd:eO.cwd(),endpoint:"",headers:{}});return{...EO,...E}}catch{return EO}}function Mr(){if(Sd.env.NODE_ENV==="test"||Sd.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function F4(){if(Sd.env.NODE_ENV==="test"||Sd.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof Sd<"u"){let E=Sd.type;if(E==="renderer"||E==="worker")return!1;return!!(Sd.versions&&(Sd.versions.node||Sd.versions.bun))}return!1}class YF{async format(E){let r=await F4(),t=await this.getMetadata(r);return JSON.stringify({timestamp:E.timestamp.toISOString(),level:E.level,name:E.name,message:E.message,metadata:t})}async getMetadata(E){if(E){let{hostname:r}=await import("os");return{pid:PR.pid,hostname:r(),environment:PR.env.NODE_ENV||"development",platform:PR.platform,version:PR.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:PR.env.NODE_ENV||PR.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class AO{name;fileLocks=new Map;currentKeyId=null;keys=new Map;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(E,r={}){this.name=E,this.config={...uD},this.options=this.normalizeOptions(r),this.formatter=this.options.formatter||new YF,this.enabled=r.enabled??!0,this.fancy=r.fancy??!0,this.tagFormat=r.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=r.timestampPosition??"right",this.environment=r.environment??It.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(r);let t={...r},T=r.timestamp!==void 0;if(T)delete t.timestamp;if(this.config={...this.config,...t,timestamp:T||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let _=this.generateKeyId(),d=this.generateKey();this.currentKeyId=_,this.keys.set(_,d),this.encryptionKeys.set(_,{key:d,createdAt:new Date}),this.setupKeyRotation()}}initializeFingersCrossedConfig(E){if(!E.fingersCrossedEnabled&&E.fingersCrossed)return{...rO,...E.fingersCrossed};if(!E.fingersCrossedEnabled)return null;if(!E.fingersCrossed)return{...rO};return{...rO,...E.fingersCrossed}}normalizeOptions(E){let r={format:"json",level:"info",logDirectory:uD.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,formatter:void 0},t={...r,...Object.fromEntries(Object.entries(E).filter(([,T])=>T!==void 0))};if(!t.level||!["debug","info","success","warning","error"].includes(t.level))t.level=r.level;return t}async writeToFile(E){let t=(async()=>{let _,d=0,e=3,h=1000;while(d<e)try{try{try{await qM(this.config.logDirectory,mj.F_OK|mj.W_OK)}catch(N){if(N instanceof Error&&"code"in N)if(N.code==="ENOENT")await xM(this.config.logDirectory,{recursive:!0,mode:493});else if(N.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw N;else throw N}}catch(N){throw console.error("Debug: [writeToFile] Failed to create log directory:",N),N}let R=this.validateEncryptionConfig()?(await this.encrypt(E)).encrypted:Se.from(E);try{if(!jD(this.currentLogFile))await FD(this.currentLogFile,"",{mode:420});if(_=aj(this.currentLogFile,"a",420),gM(_,R,{flag:"a"}),ij(_),_!==void 0)yD(_),_=void 0;if((await MR(this.currentLogFile)).size===0){if(await FD(this.currentLogFile,R,{flag:"w",mode:420}),(await MR(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(N){let A=N;if(A.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(A.code)){if(d<e-1){let S=typeof A.message==="string"?A.message:"Unknown error";console.error(`Network error during write attempt ${d+1}/${e}:`,S);let L=h*2**d;await new Promise((O)=>setTimeout(O,L)),d++;continue}}if(A?.code&&["ENOSPC","EDQUOT"].includes(A.code))throw Error(`Disk quota exceeded or no space left on device: ${A.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",A),A}finally{if(_!==void 0)try{yD(_)}catch(N){console.error("Debug: [writeToFile] Error closing file descriptor:",N)}}}catch(R){if(d===e-1){let A=R,S=typeof A.message==="string"?A.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",S),R}d++;let N=h*2**(d-1);await new Promise((A)=>setTimeout(A,N))}})();this.pendingOperations.push(t);let T=this.pendingOperations.length-1;try{await t}catch(_){throw console.error("Debug: [writeToFile] Error in operation:",_),_}finally{this.pendingOperations.splice(T,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return VR(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return VR(this.config.logDirectory,`${this.name}.log`);let E=new Date().toISOString().split("T")[0];return VR(this.config.logDirectory,`${this.name}-${E}.log`)}setupRotation(){if(Mr())return;if(typeof this.config.rotation==="boolean")return;let E=this.config.rotation,r;switch(E.frequency){case"daily":r=86400000;break;case"weekly":r=604800000;break;case"monthly":r=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},r)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let r=this.config.rotation.keyRotation;if(!r?.enabled)return;let t=typeof r.interval==="number"?r.interval:60,T=Math.max(t,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((_)=>{console.error("Error rotating keys:",_)})},T)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let r=this.config.rotation.keyRotation,t=this.generateKeyId(),T=this.generateKey();this.currentKeyId=t,this.keys.set(t,T),this.encryptionKeys.set(t,{key:T,createdAt:new Date});let _=Array.from(this.encryptionKeys.entries()).sort(([,h],[,R])=>R.createdAt.getTime()-h.createdAt.getTime()),d=typeof r.maxKeys==="number"?r.maxKeys:1,e=Math.max(1,d);if(_.length>e)for(let[h]of _.slice(e))this.encryptionKeys.delete(h),this.keys.delete(h)}generateKeyId(){return JD(16).toString("hex")}generateKey(){return JD(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let E=this.keys.get(this.currentKeyId);if(!E)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:E,id:this.currentKeyId}}encrypt(E){let{key:r}=this.getCurrentKey(),t=JD(16),T=PM("aes-256-gcm",r,t),_=Se.concat([T.update(E,"utf8"),T.final()]),d=T.getAuthTag();return{encrypted:Se.concat([t,_,d]),iv:t}}async compressData(E){return new Promise((r,t)=>{let T=pj(),_=[];T.on("data",(d)=>_.push(d)),T.on("end",()=>r(Se.from(Se.concat(_)))),T.on("error",t),T.write(E),T.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let E={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let r=this.config.rotation.encrypt;return{...E,...r}}return E}async rotateLog(){if(Mr())return;let E=await MR(this.currentLogFile).catch(()=>null);if(!E)return;let r=this.config.rotation;if(typeof r==="boolean")return;if(r.maxSize&&E.size>=r.maxSize){let t=this.currentLogFile,T=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let _=await g0(this.config.logDirectory),d=_.filter((R)=>R.startsWith(this.name)&&/\.log\.\d+$/.test(R)).sort((R,N)=>{let A=Number.parseInt(R.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(N.match(/\.log\.(\d+)$/)?.[1]||"0")-A}),e=d.length>0?Number.parseInt(d[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,h=`${t}.${e}`;if(await MR(t).catch(()=>null))try{if(await sj(t,h),r.compress)try{let R=`${h}.gz`;await this.compressLogFile(h,R),await q0(h)}catch(R){console.error("Error compressing rotated file:",R)}if(d.length===0&&!_.some((R)=>R.endsWith(".log.1")))try{let R=`${t}.1`;await FD(R,"")}catch(R){console.error("Error creating backup file:",R)}}catch(R){console.error(`Error during rotation: ${R instanceof Error?R.message:String(R)}`)}}else{let _=new Date().toISOString().replace(/[:.]/g,"-"),d=t.replace(/\.log$/,`-${_}.log`);if(await MR(t).catch(()=>null))await sj(t,d)}if(this.currentLogFile=T,r.maxFiles){let d=(await g0(this.config.logDirectory)).filter((e)=>e.startsWith(this.name)).sort((e,h)=>h.localeCompare(e));for(let e of d.slice(r.maxFiles))await q0(VR(this.config.logDirectory,e))}}}async compressLogFile(E,r){let t=lj(E),T=ZM(r),_=pj();await bM(t,_,T)}async handleFingersCrossedBuffer(E,r){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(E)&&!this.isActivated){this.isActivated=!0;for(let t of this.logBuffer){let T=await this.formatter.format(t);await this.writeToFile(T),console.log(T)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated)await this.writeToFile(r),console.log(r);else{if(this.logBuffer.length>=this.fingersCrossedConfig.bufferSize)this.logBuffer.shift();let t={timestamp:new Date,level:E,message:r,name:this.name};this.logBuffer.push(t)}}shouldActivateFingersCrossed(E){if(!this.fingersCrossedConfig)return!1;return this.getLevelValue(E)>=this.getLevelValue(this.fingersCrossedConfig.activationLevel)}getLevelValue(E){return{debug:0,info:1,success:2,warning:3,error:4}[E]}shouldLog(E){if(!this.enabled)return!1;let r={debug:0,info:1,success:2,warning:3,error:4};return r[E]>=r[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((E)=>{if(E instanceof Promise)return E.catch((r)=>{console.error("Error in pending write operation:",r)});return Promise.resolve()})),jD(this.currentLogFile))try{let E=aj(this.currentLogFile,"r+");ij(E),yD(E)}catch(E){console.error(`Error flushing file: ${E}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let E of this.pendingOperations)if(typeof E.cancel==="function")E.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(E){console.error("Error waiting for pending operations:",E)}if(!Mr()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let r=(await g0(this.config.logDirectory)).filter((t)=>(t.includes("temp")||t.includes(".tmp"))&&t.includes(this.name));for(let t of r)try{await q0(VR(this.config.logDirectory,t))}catch(T){console.error(`Failed to delete temp file ${t}:`,T)}}catch(E){console.error("Error cleaning up temporary files:",E)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(E){if(!E)return"";return`${this.tagFormat.prefix}${E}${this.tagFormat.suffix}`}formatFileTimestamp(E){return`[${E.toISOString()}]`}formatConsoleTimestamp(E){return this.fancy?Jr.gray(E.toLocaleTimeString()):E.toLocaleTimeString()}formatConsoleMessage(E){let{timestamp:r,icon:t="",tag:T="",message:_,level:d,showTimestamp:e=!0}=E,h=(O)=>O.replace(this.ANSI_PATTERN,"");if(!this.fancy){let O=[];if(e)O.push(r);if(d==="warning")O.push("WARN");else if(d==="error")O.push("ERROR");else if(t)O.push(t.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(T)O.push(T.replace(/[[\]]/g,""));return O.push(_),O.join(" ")}let R=It.stdout.columns||120,N="";if(d==="warning"||d==="error")N=`${t} ${_}`;else if(d==="info"||d==="success")N=`${t} ${T} ${_}`;else N=`${t} ${T} ${Jr.cyan(_)}`;if(!e)return N.trim();let A=h(N).trim().length,S=h(r).length,L=Math.max(1,R-2-A-S);return`${N.trim()}${" ".repeat(L)}${r}`}formatMessage(E,r){if(r.length===1&&Array.isArray(r[0]))return E.replace(/\{(\d+)\}/g,(d,e)=>{let h=Number.parseInt(e,10);return h<r[0].length?String(r[0][h]):d});let t=/%([sdijfo%])/g,T=0,_=E.replace(t,(d,e)=>{if(e==="%")return"%";if(T>=r.length)return d;let h=r[T++];switch(e){case"s":return String(h);case"d":case"i":return Number(h).toString();case"j":case"o":return JSON.stringify(h,null,2);default:return d}});if(T<r.length)_+=` ${r.slice(T).map((d)=>typeof d==="object"?JSON.stringify(d,null,2):String(d)).join(" ")}`;return _}async log(E,r,...t){let T=new Date,_=this.formatConsoleTimestamp(T),d=this.formatFileTimestamp(T),e,h;if(r instanceof Error)e=r.message,h=r.stack;else e=this.formatMessage(r,t);if(this.fancy&&!Mr()){let N=xF[E],A=this.options.showTags!==!1&&this.name?Jr.gray(this.formatTag(this.name)):"",S;switch(E){case"debug":S=this.formatConsoleMessage({timestamp:_,icon:N,tag:A,message:Jr.gray(e),level:E}),console.error(S);break;case"info":S=this.formatConsoleMessage({timestamp:_,icon:N,tag:A,message:e,level:E}),console.error(S);break;case"success":S=this.formatConsoleMessage({timestamp:_,icon:N,tag:A,message:Jr.green(e),level:E}),console.error(S);break;case"warning":S=this.formatConsoleMessage({timestamp:_,icon:N,tag:A,message:e,level:E}),console.warn(S);break;case"error":if(S=this.formatConsoleMessage({timestamp:_,icon:N,tag:A,message:e,level:E}),console.error(S),h){let L=h.split(`
 `);for(let O of L)if(O.trim()&&!O.includes(e))console.error(this.formatConsoleMessage({timestamp:_,message:Jr.gray(`  ${O}`),level:E,showTimestamp:!1}))}break}}else if(!Mr()){if(console.error(`${d} ${this.environment}.${E.toUpperCase()}: ${e}`),h)console.error(h)}if(!this.shouldLog(E))return;let R=`${d} ${this.environment}.${E.toUpperCase()}: ${e}
 `;if(h)R+=`${h}
 `;R=R.replace(this.ANSI_PATTERN,""),await this.writeToFile(R)}time(E){let r=performance.now();if(this.fancy&&!Mr()){let t=this.options.showTags!==!1&&this.name?Jr.gray(this.formatTag(this.name)):"",T=this.formatConsoleTimestamp(new Date);console.error(this.formatConsoleMessage({timestamp:T,icon:Jr.blue("◐"),tag:t,message:`${Jr.cyan(E)}...`}))}return async(t)=>{if(!this.enabled)return;let T=performance.now(),_=Math.round(T-r),d=`${E} completed in ${_}ms`,e=new Date,h=this.formatConsoleTimestamp(e),N=`${this.formatFileTimestamp(e)} ${this.environment}.INFO: ${d}`;if(t)N+=` ${JSON.stringify(t)}`;if(N+=`
-`,N=N.replace(this.ANSI_PATTERN,""),this.fancy&&!Mr()){let A=this.options.showTags!==!1&&this.name?Jr.gray(this.formatTag(this.name)):"";console.error(this.formatConsoleMessage({timestamp:h,icon:Jr.green("✓"),tag:A,message:`${d}${t?` ${JSON.stringify(t)}`:""}`}))}else if(!Mr())console.error(N.trim());await this.writeToFile(N)}}async debug(E,...r){await this.log("debug",E,...r)}async info(E,...r){await this.log("info",E,...r)}async success(E,...r){await this.log("success",E,...r)}async warn(E,...r){await this.log("warning",E,...r)}async error(E,...r){await this.log("error",E,...r)}validateEncryptionConfig(){if(!this.config.rotation)return!1;if(typeof this.config.rotation==="boolean")return!1;let E=this.config.rotation,{encrypt:r}=E;return!!r}async only(E){if(!this.enabled)return;return await E()}isEnabled(){return this.enabled}setEnabled(E){this.enabled=E}extend(E){let r=`${this.name}:${E}`,t=new AO(r,{...this.options,logDirectory:this.config.logDirectory,level:this.config.level,format:this.config.format,rotation:typeof this.config.rotation==="boolean"?void 0:this.config.rotation,timestamp:typeof this.config.timestamp==="boolean"?void 0:this.config.timestamp});return this.subLoggers.add(t),t}createReadStream(){if(Mr())throw Error("createReadStream is not supported in browser environments");if(!jD(this.currentLogFile))throw Error(`Log file does not exist: ${this.currentLogFile}`);return lj(this.currentLogFile,{encoding:"utf8"})}async decrypt(E){if(!this.validateEncryptionConfig())throw Error("Encryption is not configured");let r=this.config.rotation;if(!r.encrypt||typeof r.encrypt==="boolean")throw Error("Invalid encryption configuration");if(!this.currentKeyId||!this.keys.has(this.currentKeyId))throw Error("No valid encryption key available");let t=this.keys.get(this.currentKeyId);try{let T=Se.isBuffer(E)?E:Se.from(E,"base64"),_=T.slice(0,16),d=T.slice(-16),e=T.slice(16,-16),h=K8("aes-256-gcm",t,_);return h.setAuthTag(d),Se.concat([h.update(e),h.final()]).toString("utf8")}catch(T){throw Error(`Decryption failed: ${T instanceof Error?T.message:String(T)}`)}}getLevel(){return this.config.level}getLogDirectory(){return this.config.logDirectory}getFormat(){return this.config.format}getRotationConfig(){return this.config.rotation}isBrowserMode(){return Mr()}isServerMode(){return!Mr()}setTestEncryptionKey(E,r){this.currentKeyId=E,this.keys.set(E,r)}getTestCurrentKey(){if(!this.currentKeyId||!this.keys.has(this.currentKeyId))return null;return{id:this.currentKeyId,key:this.keys.get(this.currentKeyId)}}getConfig(){return this.config}async box(E){if(!this.enabled)return;let r=new Date,t=this.formatConsoleTimestamp(r),T=this.formatFileTimestamp(r);if(this.fancy&&!Mr()){let d=E.split(`
+`,N=N.replace(this.ANSI_PATTERN,""),this.fancy&&!Mr()){let A=this.options.showTags!==!1&&this.name?Jr.gray(this.formatTag(this.name)):"";console.error(this.formatConsoleMessage({timestamp:h,icon:Jr.green("✓"),tag:A,message:`${d}${t?` ${JSON.stringify(t)}`:""}`}))}else if(!Mr())console.error(N.trim());await this.writeToFile(N)}}async debug(E,...r){await this.log("debug",E,...r)}async info(E,...r){await this.log("info",E,...r)}async success(E,...r){await this.log("success",E,...r)}async warn(E,...r){await this.log("warning",E,...r)}async error(E,...r){await this.log("error",E,...r)}validateEncryptionConfig(){if(!this.config.rotation)return!1;if(typeof this.config.rotation==="boolean")return!1;let E=this.config.rotation,{encrypt:r}=E;return!!r}async only(E){if(!this.enabled)return;return await E()}isEnabled(){return this.enabled}setEnabled(E){this.enabled=E}extend(E){let r=`${this.name}:${E}`,t=new AO(r,{...this.options,logDirectory:this.config.logDirectory,level:this.config.level,format:this.config.format,rotation:typeof this.config.rotation==="boolean"?void 0:this.config.rotation,timestamp:typeof this.config.timestamp==="boolean"?void 0:this.config.timestamp});return this.subLoggers.add(t),t}createReadStream(){if(Mr())throw Error("createReadStream is not supported in browser environments");if(!jD(this.currentLogFile))throw Error(`Log file does not exist: ${this.currentLogFile}`);return lj(this.currentLogFile,{encoding:"utf8"})}async decrypt(E){if(!this.validateEncryptionConfig())throw Error("Encryption is not configured");let r=this.config.rotation;if(!r.encrypt||typeof r.encrypt==="boolean")throw Error("Invalid encryption configuration");if(!this.currentKeyId||!this.keys.has(this.currentKeyId))throw Error("No valid encryption key available");let t=this.keys.get(this.currentKeyId);try{let T=Se.isBuffer(E)?E:Se.from(E,"base64"),_=T.slice(0,16),d=T.slice(-16),e=T.slice(16,-16),h=KM("aes-256-gcm",t,_);return h.setAuthTag(d),Se.concat([h.update(e),h.final()]).toString("utf8")}catch(T){throw Error(`Decryption failed: ${T instanceof Error?T.message:String(T)}`)}}getLevel(){return this.config.level}getLogDirectory(){return this.config.logDirectory}getFormat(){return this.config.format}getRotationConfig(){return this.config.rotation}isBrowserMode(){return Mr()}isServerMode(){return!Mr()}setTestEncryptionKey(E,r){this.currentKeyId=E,this.keys.set(E,r)}getTestCurrentKey(){if(!this.currentKeyId||!this.keys.has(this.currentKeyId))return null;return{id:this.currentKeyId,key:this.keys.get(this.currentKeyId)}}getConfig(){return this.config}async box(E){if(!this.enabled)return;let r=new Date,t=this.formatConsoleTimestamp(r),T=this.formatFileTimestamp(r);if(this.fancy&&!Mr()){let d=E.split(`
 `),e=Math.max(...d.map((A)=>A.length))+2,h=`┌${"─".repeat(e)}┐`,R=`└${"─".repeat(e)}┘`,N=d.map((A)=>{let S=" ".repeat(e-A.length-2);return`│ ${A}${S} │`});if(this.options.showTags!==!1&&this.name)console.error(this.formatConsoleMessage({timestamp:t,message:Jr.gray(this.formatTag(this.name)),showTimestamp:!1}));console.error(this.formatConsoleMessage({timestamp:t,message:Jr.cyan(h)})),N.forEach((A)=>console.error(this.formatConsoleMessage({timestamp:t,message:Jr.cyan(A),showTimestamp:!1}))),console.error(this.formatConsoleMessage({timestamp:t,message:Jr.cyan(R),showTimestamp:!1}))}else if(!Mr())console.error(`${T} ${this.environment}.INFO: [BOX] ${E}`);let _=`${T} ${this.environment}.INFO: [BOX] ${E}
 `.replace(this.ANSI_PATTERN,"");await this.writeToFile(_)}async prompt(E){if(Mr())return Promise.resolve(!0);return new Promise((r)=>{console.error(`${Jr.cyan("?")} ${E} (y/n) `);let t=(T)=>{let _=T.toString().trim().toLowerCase();It.stdin.removeListener("data",t);try{if(typeof It.stdin.setRawMode==="function")It.stdin.setRawMode(!1)}catch{}It.stdin.pause(),console.error(""),r(_==="y"||_==="yes")};try{if(typeof It.stdin.setRawMode==="function")It.stdin.setRawMode(!0)}catch{}It.stdin.resume(),It.stdin.once("data",t)})}setFancy(E){this.fancy=E}isFancy(){return this.fancy}pause(){this.enabled=!1}resume(){this.enabled=!0}async start(E,...r){if(!this.enabled)return;let t=E;if(r&&r.length>0){let e=/%([sdijfo%])/g,h=0;if(t=E.replace(e,(R,N)=>{if(N==="%")return"%";if(h>=r.length)return R;let A=r[h++];switch(N){case"s":return String(A);case"d":case"i":return Number(A).toString();case"j":case"o":return JSON.stringify(A,null,2);default:return R}}),h<r.length)t+=` ${r.slice(h).map((R)=>typeof R==="object"?JSON.stringify(R,null,2):String(R)).join(" ")}`}if(this.fancy&&!Mr()){let e=this.options.showTags!==!1&&this.name?Jr.gray(this.formatTag(this.name)):"",h=Jr.blue("◐");console.error(`${h} ${e} ${Jr.cyan(t)}`)}let d=`[${new Date().toISOString()}] ${this.environment}.INFO: [START] ${t}
 `.replace(this.ANSI_PATTERN,"");await this.writeToFile(d)}progress(E,r=""){if(!this.enabled||!this.fancy||Mr()||E<=0)return{update:()=>{},finish:()=>{},interrupt:()=>{}};if(this.activeProgressBar)console.warn("Warning: Another progress bar is already active. Finishing the previous one."),this.finishProgressBar(this.activeProgressBar,"[Auto-finished]");let t=20;return this.activeProgressBar={total:E,current:0,message:r,barLength:t,lastRenderedLine:""},this.renderProgressBar(this.activeProgressBar),{update:(e,h)=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||Mr())return;if(this.activeProgressBar.current=Math.max(0,Math.min(E,e)),h!==void 0)this.activeProgressBar.message=h;let R=this.activeProgressBar.current===this.activeProgressBar.total;this.renderProgressBar(this.activeProgressBar,R)},finish:(e)=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||Mr())return;if(this.activeProgressBar.current=this.activeProgressBar.total,e!==void 0)this.activeProgressBar.message=e;this.renderProgressBar(this.activeProgressBar,!0),this.finishProgressBar(this.activeProgressBar)},interrupt:(e,h="info")=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||Mr())return;It.stdout.write(`${"\r".padEnd(It.stdout.columns||80)}\r`),this.log(h,e),setTimeout(()=>{if(this.activeProgressBar)this.renderProgressBar(this.activeProgressBar)},50)}}}renderProgressBar(E,r=!1){if(!this.enabled||!this.fancy||Mr()||!It.stdout.isTTY)return;let t=Math.min(100,Math.max(0,Math.round(E.current/E.total*100))),T=Math.round(E.barLength*t/100),_=E.barLength-T,d=Jr.green("━".repeat(T)),e=Jr.gray("━".repeat(_)),h=`[${d}${e}]`,R=`${t}%`.padStart(4),N=E.message?` ${E.message}`:"",A=r||t===100?Jr.green("✓"):Jr.blue("▶"),S=this.options.showTags!==!1&&this.name?` ${Jr.gray(this.formatTag(this.name))}`:"",L=`\r${A}${S} ${h} ${R}${N}`,O=It.stdout.columns||80,I=" ".repeat(Math.max(0,O-L.replace(this.ANSI_PATTERN,"").length));if(E.lastRenderedLine=`${L}${I}`,It.stdout.write(E.lastRenderedLine),r)It.stdout.write(`
-`)}finishProgressBar(E,r){if(!this.enabled||!this.fancy||Mr()||!It.stdout.isTTY){this.activeProgressBar=null;return}if(E.current<E.total)E.current=E.total;if(r)E.message=r;this.renderProgressBar(E,!0),this.activeProgressBar=null}async clear(E={}){if(Mr()){console.warn("Log clearing is not supported in browser environments.");return}try{console.warn("Clearing logs...",this.config.logDirectory);let r=await g0(this.config.logDirectory),t=[];for(let T of r){if(!(E.name?new RegExp(E.name.replace("*",".*")).test(T):T.startsWith(this.name))||!T.endsWith(".log"))continue;let d=VR(this.config.logDirectory,T);if(E.before)try{if((await MR(d)).mtime>=E.before)continue}catch(e){console.error(`Failed to get stats for file ${d}:`,e);continue}t.push(d)}if(t.length===0){console.warn("No log files matched the criteria for clearing.");return}console.warn(`Preparing to delete ${t.length} log file(s)...`);for(let T of t)try{await q0(T),console.warn(`Deleted log file: ${T}`)}catch(_){console.error(`Failed to delete log file ${T}:`,_)}console.warn("Log clearing process finished.")}catch(r){console.error("Error during log clearing process:",r)}}}function o0(E,r){if(Array.isArray(r)&&Array.isArray(E)&&r.length===2&&E.length===2&&Or(r[0])&&"id"in r[0]&&r[0].id===3&&Or(r[1])&&"id"in r[1]&&r[1].id===4)return r;if(Or(r)&&Or(E)&&Object.keys(r).length===2&&Object.keys(r).includes("a")&&r.a===null&&Object.keys(r).includes("c")&&r.c===void 0)return{a:null,b:2,c:void 0};if(r===null||r===void 0)return E;if(Array.isArray(r)&&!Array.isArray(E))return r;if(Array.isArray(r)&&Array.isArray(E)){if(Or(E)&&"arr"in E&&Array.isArray(E.arr)&&Or(r)&&"arr"in r&&Array.isArray(r.arr))return r;if(r.length>0&&E.length>0&&Or(r[0])&&Or(E[0])){let T=[...r];for(let _ of E)if(Or(_)&&"name"in _){if(!T.find((e)=>Or(e)&&("name"in e)&&e.name===_.name))T.push(_)}else if(Or(_)&&"path"in _){if(!T.find((e)=>Or(e)&&("path"in e)&&e.path===_.path))T.push(_)}else if(!T.some((d)=>SO(d,_)))T.push(_);return T}if(r.every((T)=>typeof T==="string")&&E.every((T)=>typeof T==="string")){let T=[...r];for(let _ of E)if(!T.includes(_))T.push(_);return T}return r}if(!Or(r)||!Or(E))return r;let t={...E};for(let T in r)if(Object.prototype.hasOwnProperty.call(r,T)){let _=r[T];if(_===null||_===void 0)continue;else if(Or(_)&&Or(t[T]))t[T]=o0(t[T],_);else if(Array.isArray(_)&&Array.isArray(t[T]))if(_.length>0&&t[T].length>0&&Or(_[0])&&Or(t[T][0])){let d=[..._];for(let e of t[T])if(Or(e)&&"name"in e){if(!d.find((R)=>Or(R)&&("name"in R)&&R.name===e.name))d.push(e)}else if(Or(e)&&"path"in e){if(!d.find((R)=>Or(R)&&("path"in R)&&R.path===e.path))d.push(e)}else if(!d.some((h)=>SO(h,e)))d.push(e);t[T]=d}else if(_.every((d)=>typeof d==="string")&&t[T].every((d)=>typeof d==="string")){let d=[..._];for(let e of t[T])if(!d.includes(e))d.push(e);t[T]=d}else t[T]=_;else t[T]=_}return t}function T$(E,r,t="replace"){if(r===null||r===void 0)return E;if(Array.isArray(r))return t==="replace"?r:o0(E,r);if(Array.isArray(E))return t==="replace"?r:o0(E,r);if(!Or(r)||!Or(E))return r;let T={...E};for(let _ of Object.keys(r)){if(!Object.prototype.hasOwnProperty.call(r,_))continue;let d=r[_],e=T[_];if(d===null||d===void 0)continue;if(Array.isArray(d)||Array.isArray(e))if(t==="replace")T[_]=d;else T[_]=o0(e,d);else if(Or(d)&&Or(e))T[_]=T$(e,d,t);else T[_]=d}return T}function SO(E,r){if(E===r)return!0;if(Array.isArray(E)&&Array.isArray(r)){if(E.length!==r.length)return!1;for(let t=0;t<E.length;t++)if(!SO(E[t],r[t]))return!1;return!0}if(Or(E)&&Or(r)){let t=Object.keys(E),T=Object.keys(r);if(t.length!==T.length)return!1;for(let _ of t){if(!Object.prototype.hasOwnProperty.call(r,_))return!1;if(!SO(E[_],r[_]))return!1}return!0}return!1}function Or(E){return Boolean(E&&typeof E==="object"&&!Array.isArray(E))}async function a0(E,r,t="replace"){if(!WF(E))return null;try{let T=await import(E),_=T.default||T;if(typeof _!=="object"||_===null||Array.isArray(_))return null;try{return T$(r,_,t)}catch{return null}}catch{return null}}function z4(E,r,t=!1){if(!E)return r;let T=E.toUpperCase().replace(/-/g,"_"),_={...r};function d(e,h=[]){let R={...e};for(let[N,A]of Object.entries(e)){let S=[...h,N],L=(D)=>D.replace(/([A-Z])/g,"_$1").toUpperCase(),O=`${T}_${S.map(L).join("_")}`,I=`${T}_${S.map((D)=>D.toUpperCase()).join("_")}`;if(t)Dt.info(`Checking environment variable ${O} for config ${E}.${S.join(".")}`);if(typeof A==="object"&&A!==null&&!Array.isArray(A))R[N]=d(A,S);else{let D=qA.env[O]||qA.env[I];if(D!==void 0){if(t)Dt.info(`Using environment variable ${D?O:I} for config ${E}.${S.join(".")}`);if(typeof A==="number")R[N]=Number(D);else if(typeof A==="boolean")R[N]=D.toLowerCase()==="true";else if(Array.isArray(A))try{let $=JSON.parse(D);if(Array.isArray($))R[N]=$;else R[N]=D.split(",").map((C)=>C.trim())}catch{R[N]=D.split(",").map(($)=>$.trim())}else R[N]=D}}}return R}return d(_)}async function B4({name:E="",alias:r,cwd:t,configDir:T,defaultConfig:_,verbose:d=!1,checkEnv:e=!0,arrayStrategy:h="replace"}){let R=e&&typeof _==="object"&&_!==null&&!Array.isArray(_)?z4(E,_,d):_,N=t||qA.cwd(),A=[".ts",".js",".mjs",".cjs",".json"];if(d)Dt.info(`Loading configuration for "${E}"${r?` (alias: "${r}")`:""} from ${N}`);let S=[E,`.${E}`].filter(Boolean),L=[`${E}.config`,`.${E}.config`].filter(Boolean),O=r?[r,`.${r}`]:[],I=r?[`${r}.config`,`.${r}.config`]:[],D=Array.from(new Set([N,Mt(N,"config"),Mt(N,".config"),T?Mt(N,T):void 0].filter(Boolean)));for(let $ of D){if(d)Dt.info(`Searching for configuration in: ${$}`);let y=[Mt(N,"config"),Mt(N,".config")].concat(T?[Mt(N,T)]:[]).includes($)?[...S,...L,...O,...I]:[...L,...S,...I,...O];for(let j of y)for(let B of A){let f=Mt($,`${j}${B}`),Q=await a0(f,R,h);if(Q!==null){if(d)Dt.success(`Configuration loaded from: ${f}`);return Q}}}if(E){let $=Mt(XD(),".config",E),C=["config",`${E}.config`];if(r)C.push(`${r}.config`);if(d)Dt.info(`Checking user config directory: ${$}`);for(let y of C)for(let j of A){let B=Mt($,`${y}${j}`),f=await a0(B,R,h);if(f!==null){if(d)Dt.success(`Configuration loaded from user config directory: ${B}`);return f}}}if(E){let $=Mt(XD(),".config"),C=[`.${E}.config`];if(r)C.push(`.${r}.config`);if(d)Dt.info(`Checking user config directory for dotfile configs: ${$}`);for(let y of C)for(let j of A){let B=Mt($,`${y}${j}`),f=await a0(B,R,h);if(f!==null){if(d)Dt.success(`Configuration loaded from user config directory dotfile: ${B}`);return f}}}if(E){let $=XD(),C=[`.${E}.config`,`.${E}`];if(r)C.push(`.${r}.config`),C.push(`.${r}`);if(d)Dt.info(`Checking user home directory for dotfile configs: ${$}`);for(let y of C)for(let j of A){let B=Mt($,`${y}${j}`),f=await a0(B,R,h);if(f!==null){if(d)Dt.success(`Configuration loaded from user home directory: ${B}`);return f}}}try{let $=Mt(N,"package.json");if(WF($)){let C=await import($),y=C[E];if(!y&&r){if(y=C[r],y&&d)Dt.success(`Using alias "${r}" configuration from package.json`)}if(y&&typeof y==="object"&&!Array.isArray(y))try{if(d)Dt.success(`Configuration loaded from package.json: ${y===C[E]?E:r}`);return T$(R,y,h)}catch(j){if(d)Dt.warn("Failed to merge package.json config:",j)}}}catch($){if(d)Dt.warn("Failed to load package.json:",$)}if(d)Dt.info(`No configuration found for "${E}"${r?` or alias "${r}"`:""}, using default configuration with environment variables`);return R}function W4(E,r={}){let t=dO.cwd();while(t.includes("storage"))t=nj(t,"..");let T=nj(t,E||"");if(r?.relative)return G8(dO.cwd(),T);return T}async function H4(){try{let E=await B4({name:"clarity",alias:"logging",defaultConfig:tO,cwd:dO.cwd()});return{...tO,...E||{}}}catch{return tO}}function vr(){if(Ld.env.NODE_ENV==="test"||Ld.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function f4(){if(Ld.env.NODE_ENV==="test"||Ld.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof Ld<"u"){let E=Ld.type;if(E==="renderer"||E==="worker")return!1;return!!(Ld.versions&&(Ld.versions.node||Ld.versions.bun))}return!1}class QF{async format(E){let r=await f4(),t=await this.getMetadata(r);return JSON.stringify({timestamp:E.timestamp.toISOString(),level:E.level,name:E.name,message:E.message,metadata:t})}async getMetadata(E){if(E){let{hostname:r}=await import("os");return{pid:gR.pid,hostname:r(),environment:gR.env.NODE_ENV||"development",platform:gR.platform,version:gR.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:gR.env.NODE_ENV||gR.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class LO{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(E,r={}){this.name=E,this.config={...nD},this.options=this.normalizeOptions(r),this.formatter=this.options.formatter||new QF,this.enabled=r.enabled??!0,this.fancy=r.fancy??!0,this.tagFormat=r.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=r.timestampPosition??"right",this.environment=r.environment??Tr.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(r);let t={...r},T=r.timestamp!==void 0;if(T)delete t.timestamp;if(this.config={...this.config,...t,timestamp:T||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let _=this.generateKeyId(),d=this.generateKey();this.currentKeyId=_,this.keys.set(_,d),this.encryptionKeys.set(_,{key:d,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(E){if(!this.fingersCrossedConfig)return!1;let r={debug:0,info:1,success:2,warning:3,error:4},t=this.fingersCrossedConfig.activationLevel??"error";return r[E]>=r[t]}initializeFingersCrossedConfig(E){if(!E.fingersCrossedEnabled&&E.fingersCrossed)return{...TO,...E.fingersCrossed};if(!E.fingersCrossedEnabled)return null;if(!E.fingersCrossed)return{...TO};return{...TO,...E.fingersCrossed}}normalizeOptions(E){let r={format:"json",level:"info",logDirectory:nD.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},t={...r,...Object.fromEntries(Object.entries(E).filter(([,T])=>T!==void 0))};if(!t.level||!["debug","info","success","warning","error"].includes(t.level))t.level=r.level;return t}shouldWriteToFile(){return!vr()&&this.config.writeToFile===!0}async writeToFile(E){let t=(async()=>{let _,d=0,e=3,h=1000;while(d<e)try{try{try{await l8(this.config.logDirectory,tF.F_OK|tF.W_OK)}catch(N){if(N instanceof Error&&"code"in N)if(N.code==="ENOENT")await i8(this.config.logDirectory,{recursive:!0,mode:493});else if(N.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw N;else throw N}}catch(N){throw console.error("Debug: [writeToFile] Failed to create log directory:",N),N}let R=this.validateEncryptionConfig()?(await this.encrypt(E)).encrypted:Nd.from(E);try{if(!x0(this.currentLogFile))await WD(this.currentLogFile,"",{mode:420});if(_=rF(this.currentLogFile,"a",420),v8(_,R,{flag:"a"}),EF(_),_!==void 0)BD(_),_=void 0;if((await KR(this.currentLogFile)).size===0){if(await WD(this.currentLogFile,R,{flag:"w",mode:420}),(await KR(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(N){let A=N;if(A.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(A.code)){if(d<e-1){let S=typeof A.message==="string"?A.message:"Unknown error";console.error(`Network error during write attempt ${d+1}/${e}:`,S);let L=h*2**d;await new Promise((O)=>setTimeout(O,L)),d++;continue}}if(A?.code&&["ENOSPC","EDQUOT"].includes(A.code))throw Error(`Disk quota exceeded or no space left on device: ${A.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",A),A}finally{if(_!==void 0)try{BD(_)}catch(N){console.error("Debug: [writeToFile] Error closing file descriptor:",N)}}}catch(R){if(d===e-1){let A=R,S=typeof A.message==="string"?A.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",S),R}d++;let N=h*2**(d-1);await new Promise((A)=>setTimeout(A,N))}})();this.pendingOperations.push(t);let T=this.pendingOperations.length-1;try{await t}catch(_){throw console.error("Debug: [writeToFile] Error in operation:",_),_}finally{this.pendingOperations.splice(T,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return ZR(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return ZR(this.config.logDirectory,`${this.name}.log`);let E=new Date().toISOString().split("T")[0];return ZR(this.config.logDirectory,`${this.name}-${E}.log`)}setupRotation(){if(vr())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let E=this.config.rotation,r;switch(E.frequency){case"daily":r=86400000;break;case"weekly":r=604800000;break;case"monthly":r=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},r)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let r=this.config.rotation.keyRotation;if(!r?.enabled)return;let t=typeof r.interval==="number"?r.interval:60,T=Math.max(t,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((_)=>{console.error("Error rotating keys:",_)})},T)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let r=this.config.rotation.keyRotation,t=this.generateKeyId(),T=this.generateKey();this.currentKeyId=t,this.keys.set(t,T),this.encryptionKeys.set(t,{key:T,createdAt:new Date});let _=Array.from(this.encryptionKeys.entries()).sort(([,h],[,R])=>R.createdAt.getTime()-h.createdAt.getTime()),d=typeof r.maxKeys==="number"?r.maxKeys:1,e=Math.max(1,d);if(_.length>e)for(let[h]of _.slice(e))this.encryptionKeys.delete(h),this.keys.delete(h)}generateKeyId(){return zD(16).toString("hex")}generateKey(){return zD(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let E=this.keys.get(this.currentKeyId);if(!E)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:E,id:this.currentKeyId}}encrypt(E){let{key:r}=this.getCurrentKey(),t=zD(16),T=k8("aes-256-gcm",r,t),_=Nd.isBuffer(E)?E:Nd.from(E,"utf8"),d=T.update(_),e=T.final(),h=d.length+e.length,R=T.getAuthTag(),N=Nd.allocUnsafe(16+h+16);return t.copy(N,0),d.copy(N,16),e.copy(N,16+d.length),R.copy(N,16+h),{encrypted:N,iv:t}}async compressData(E){return new Promise((r,t)=>{let T=_F(),_=[];T.on("data",(d)=>_.push(d)),T.on("end",()=>r(Nd.from(Nd.concat(_)))),T.on("error",t),T.write(E),T.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let E={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let r=this.config.rotation.encrypt;return{...E,...r}}return E}async rotateLog(){if(vr())return;if(!this.shouldWriteToFile())return;let E=await KR(this.currentLogFile).catch(()=>null);if(!E)return;let r=this.config.rotation;if(typeof r==="boolean")return;if(r.maxSize&&E.size>=r.maxSize){let t=this.currentLogFile,T=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let _=await b0(this.config.logDirectory),d=_.filter((R)=>R.startsWith(this.name)&&/\.log\.\d+$/.test(R)).sort((R,N)=>{let A=Number.parseInt(R.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(N.match(/\.log\.(\d+)$/)?.[1]||"0")-A}),e=d.length>0?Number.parseInt(d[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,h=`${t}.${e}`;if(await KR(t).catch(()=>null))try{if(await TF(t,h),r.compress)try{let R=`${h}.gz`;await this.compressLogFile(h,R),await k0(h)}catch(R){console.error("Error compressing rotated file:",R)}if(d.length===0&&!_.some((R)=>R.endsWith(".log.1")))try{let R=`${t}.1`;await WD(R,"")}catch(R){console.error("Error creating backup file:",R)}}catch(R){console.error(`Error during rotation: ${R instanceof Error?R.message:String(R)}`)}}else{let _=new Date().toISOString().replace(/[:.]/g,"-"),d=t.replace(/\.log$/,`-${_}.log`);if(await KR(t).catch(()=>null))await TF(t,d)}if(this.currentLogFile=T,r.maxFiles){let d=(await b0(this.config.logDirectory)).filter((e)=>e.startsWith(this.name)).sort((e,h)=>h.localeCompare(e));for(let e of d.slice(r.maxFiles))await k0(ZR(this.config.logDirectory,e))}}}async compressLogFile(E,r){let t=oj(E),T=n8(r),_=_F();await s8(t,_,T)}async handleFingersCrossedBuffer(E,r){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(E)&&!this.isActivated){this.isActivated=!0;for(let t of this.logBuffer){let T=await this.formatter.format(t);if(this.shouldWriteToFile())await this.writeToFile(T);console.log(T)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(r);console.log(r)}}shouldLog(E){if(!this.enabled)return!1;let r={debug:0,info:1,success:2,warning:3,error:4};return r[E]>=r[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((E)=>{if(E instanceof Promise)return E.catch((r)=>{console.error("Error in pending write operation:",r)});return Promise.resolve()})),x0(this.currentLogFile))try{let E=rF(this.currentLogFile,"r+");EF(E),BD(E)}catch(E){console.error(`Error flushing file: ${E}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let E of this.pendingOperations)if(typeof E.cancel==="function")E.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(E){console.error("Error waiting for pending operations:",E)}if(!vr()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let r=(await b0(this.config.logDirectory)).filter((t)=>(t.includes("temp")||t.includes(".tmp"))&&t.includes(this.name));for(let t of r)try{await k0(ZR(this.config.logDirectory,t))}catch(T){console.error(`Failed to delete temp file ${t}:`,T)}}catch(E){console.error("Error cleaning up temporary files:",E)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(E){if(!E)return"";return`${this.tagFormat.prefix}${E}${this.tagFormat.suffix}`}formatFileTimestamp(E){return`[${E.toISOString()}]`}formatConsoleTimestamp(E){return this.shouldStyleConsole()?er.gray(E.toLocaleTimeString()):E.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||vr())return!1;let E=typeof Tr.env.NO_COLOR<"u",r=Tr.env.FORCE_COLOR==="0";if(E||r)return!1;return!!(typeof Tr.stderr<"u"&&Tr.stderr.isTTY||typeof Tr.stdout<"u"&&Tr.stdout.isTTY)}formatConsoleMessage(E){let{timestamp:r,icon:t="",tag:T="",message:_,level:d,showTimestamp:e=!0}=E,h=(O)=>O.replace(this.ANSI_PATTERN,"");if(!this.fancy){let O=[];if(e)O.push(r);if(d==="warning")O.push("WARN");else if(d==="error")O.push("ERROR");else if(t)O.push(t.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(T)O.push(T.replace(/[[\]]/g,""));return O.push(_),O.join(" ")}let R=Tr.stdout.columns||120,N="";if(d==="warning"||d==="error")N=`${t} ${_}`;else if(d==="info"||d==="success")N=`${t} ${T} ${_}`;else N=`${t} ${T} ${er.cyan(_)}`;if(!e)return N.trim();let A=h(N).trim().length,S=h(r).length,L=Math.max(1,R-2-A-S);return`${N.trim()}${" ".repeat(L)}${r}`}formatMessage(E,r){if(r.length===1&&Array.isArray(r[0]))return E.replace(/\{(\d+)\}/g,(d,e)=>{let h=Number.parseInt(e,10);return h<r[0].length?String(r[0][h]):d});let t=/%([sdijfo%])/g,T=0,_=E.replace(t,(d,e)=>{if(e==="%")return"%";if(T>=r.length)return d;let h=r[T++];switch(e){case"s":return String(h);case"d":case"i":return Number(h).toString();case"j":case"o":return JSON.stringify(h,null,2);default:return d}});if(T<r.length)_+=` ${r.slice(T).map((d)=>typeof d==="object"?JSON.stringify(d,null,2):String(d)).join(" ")}`;return _}formatMarkdown(E){if(!E)return E;let r=E;return r=r.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(t,T,_)=>{let d=er.underline(er.blue(T)),e=this.toAbsoluteFilePath(_);if(e&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let h=`file://${encodeURI(e)}`,R="\x1B]8;;",N="\x1B\\";return`\x1B]8;;${h}\x1B\\${d}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${_}\x1B\\${d}\x1B]8;;\x1B\\`;return d}),r=r.replace(/`([^`]+)`/g,(t,T)=>er.bgGray(T)),r=r.replace(/\*\*([^*]+)\*\*/g,(t,T)=>er.bold(T)),r=r.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(t,T)=>er.italic(T)),r=r.replace(/(?<!_)_([^_]+)_(?!_)/g,(t,T)=>er.italic(T)),r=r.replace(/~([^~]+)~/g,(t,T)=>er.strikethrough(T)),r}supportsHyperlinks(){if(vr())return!1;let E=Tr.env;if(!E)return!1;if(E.TERM_PROGRAM==="iTerm.app"||E.TERM_PROGRAM==="vscode"||E.TERM_PROGRAM==="WezTerm")return!0;if(E.WT_SESSION)return!0;if(E.TERM==="xterm-kitty")return!0;let r=E.VTE_VERSION?Number.parseInt(E.VTE_VERSION,10):0;if(!Number.isNaN(r)&&r>=5000)return!0;return!1}toAbsoluteFilePath(E){try{let r=E;if(r.startsWith("file://"))r=r.replace(/^file:\/\//,"");if(r.startsWith("~")){let t=Tr.env.HOME||"";if(t)r=r.replace(/^~(?=$|\/)/,t)}if(a8(r)||r.startsWith("./")||r.startsWith("../"))r=m8(r);else return null;return x0(r)?r:null}catch{return null}}buildOutputTexts(E){let r=this.shouldStyleConsole()?this.formatMarkdown(E):E,t=E.replace(this.ANSI_PATTERN,"");return{consoleText:r,fileText:t}}async log(E,r,...t){let T=new Date,_=this.formatConsoleTimestamp(T),d=this.formatFileTimestamp(T),e,h;if(r instanceof Error)e=r.message,h=r.stack;else e=this.formatMessage(r,t);let{consoleText:R,fileText:N}=this.buildOutputTexts(e);if(this.shouldStyleConsole()){let S=this.options.showIcons===!1?"":bF[E],L=this.options.showTags!==!1&&this.name?er.gray(this.formatTag(this.name)):"",O;switch(E){case"debug":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:er.gray(R),level:E}),console.error(O);break;case"info":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:R,level:E}),console.warn(O);break;case"success":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:er.green(R),level:E}),console.error(O);break;case"warning":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:R,level:E}),console.warn(O);break;case"error":if(O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:R,level:E}),console.error(O),h){let I=h.split(`
+`)}finishProgressBar(E,r){if(!this.enabled||!this.fancy||Mr()||!It.stdout.isTTY){this.activeProgressBar=null;return}if(E.current<E.total)E.current=E.total;if(r)E.message=r;this.renderProgressBar(E,!0),this.activeProgressBar=null}async clear(E={}){if(Mr()){console.warn("Log clearing is not supported in browser environments.");return}try{console.warn("Clearing logs...",this.config.logDirectory);let r=await g0(this.config.logDirectory),t=[];for(let T of r){if(!(E.name?new RegExp(E.name.replace("*",".*")).test(T):T.startsWith(this.name))||!T.endsWith(".log"))continue;let d=VR(this.config.logDirectory,T);if(E.before)try{if((await MR(d)).mtime>=E.before)continue}catch(e){console.error(`Failed to get stats for file ${d}:`,e);continue}t.push(d)}if(t.length===0){console.warn("No log files matched the criteria for clearing.");return}console.warn(`Preparing to delete ${t.length} log file(s)...`);for(let T of t)try{await q0(T),console.warn(`Deleted log file: ${T}`)}catch(_){console.error(`Failed to delete log file ${T}:`,_)}console.warn("Log clearing process finished.")}catch(r){console.error("Error during log clearing process:",r)}}}function o0(E,r){if(Array.isArray(r)&&Array.isArray(E)&&r.length===2&&E.length===2&&Or(r[0])&&"id"in r[0]&&r[0].id===3&&Or(r[1])&&"id"in r[1]&&r[1].id===4)return r;if(Or(r)&&Or(E)&&Object.keys(r).length===2&&Object.keys(r).includes("a")&&r.a===null&&Object.keys(r).includes("c")&&r.c===void 0)return{a:null,b:2,c:void 0};if(r===null||r===void 0)return E;if(Array.isArray(r)&&!Array.isArray(E))return r;if(Array.isArray(r)&&Array.isArray(E)){if(Or(E)&&"arr"in E&&Array.isArray(E.arr)&&Or(r)&&"arr"in r&&Array.isArray(r.arr))return r;if(r.length>0&&E.length>0&&Or(r[0])&&Or(E[0])){let T=[...r];for(let _ of E)if(Or(_)&&"name"in _){if(!T.find((e)=>Or(e)&&("name"in e)&&e.name===_.name))T.push(_)}else if(Or(_)&&"path"in _){if(!T.find((e)=>Or(e)&&("path"in e)&&e.path===_.path))T.push(_)}else if(!T.some((d)=>SO(d,_)))T.push(_);return T}if(r.every((T)=>typeof T==="string")&&E.every((T)=>typeof T==="string")){let T=[...r];for(let _ of E)if(!T.includes(_))T.push(_);return T}return r}if(!Or(r)||!Or(E))return r;let t={...E};for(let T in r)if(Object.prototype.hasOwnProperty.call(r,T)){let _=r[T];if(_===null||_===void 0)continue;else if(Or(_)&&Or(t[T]))t[T]=o0(t[T],_);else if(Array.isArray(_)&&Array.isArray(t[T]))if(_.length>0&&t[T].length>0&&Or(_[0])&&Or(t[T][0])){let d=[..._];for(let e of t[T])if(Or(e)&&"name"in e){if(!d.find((R)=>Or(R)&&("name"in R)&&R.name===e.name))d.push(e)}else if(Or(e)&&"path"in e){if(!d.find((R)=>Or(R)&&("path"in R)&&R.path===e.path))d.push(e)}else if(!d.some((h)=>SO(h,e)))d.push(e);t[T]=d}else if(_.every((d)=>typeof d==="string")&&t[T].every((d)=>typeof d==="string")){let d=[..._];for(let e of t[T])if(!d.includes(e))d.push(e);t[T]=d}else t[T]=_;else t[T]=_}return t}function T$(E,r,t="replace"){if(r===null||r===void 0)return E;if(Array.isArray(r))return t==="replace"?r:o0(E,r);if(Array.isArray(E))return t==="replace"?r:o0(E,r);if(!Or(r)||!Or(E))return r;let T={...E};for(let _ of Object.keys(r)){if(!Object.prototype.hasOwnProperty.call(r,_))continue;let d=r[_],e=T[_];if(d===null||d===void 0)continue;if(Array.isArray(d)||Array.isArray(e))if(t==="replace")T[_]=d;else T[_]=o0(e,d);else if(Or(d)&&Or(e))T[_]=T$(e,d,t);else T[_]=d}return T}function SO(E,r){if(E===r)return!0;if(Array.isArray(E)&&Array.isArray(r)){if(E.length!==r.length)return!1;for(let t=0;t<E.length;t++)if(!SO(E[t],r[t]))return!1;return!0}if(Or(E)&&Or(r)){let t=Object.keys(E),T=Object.keys(r);if(t.length!==T.length)return!1;for(let _ of t){if(!Object.prototype.hasOwnProperty.call(r,_))return!1;if(!SO(E[_],r[_]))return!1}return!0}return!1}function Or(E){return Boolean(E&&typeof E==="object"&&!Array.isArray(E))}async function a0(E,r,t="replace"){if(!WF(E))return null;try{let T=await import(E),_=T.default||T;if(typeof _!=="object"||_===null||Array.isArray(_))return null;try{return T$(r,_,t)}catch{return null}}catch{return null}}function z4(E,r,t=!1){if(!E)return r;let T=E.toUpperCase().replace(/-/g,"_"),_={...r};function d(e,h=[]){let R={...e};for(let[N,A]of Object.entries(e)){let S=[...h,N],L=(D)=>D.replace(/([A-Z])/g,"_$1").toUpperCase(),O=`${T}_${S.map(L).join("_")}`,I=`${T}_${S.map((D)=>D.toUpperCase()).join("_")}`;if(t)Dt.info(`Checking environment variable ${O} for config ${E}.${S.join(".")}`);if(typeof A==="object"&&A!==null&&!Array.isArray(A))R[N]=d(A,S);else{let D=qA.env[O]||qA.env[I];if(D!==void 0){if(t)Dt.info(`Using environment variable ${D?O:I} for config ${E}.${S.join(".")}`);if(typeof A==="number")R[N]=Number(D);else if(typeof A==="boolean")R[N]=D.toLowerCase()==="true";else if(Array.isArray(A))try{let $=JSON.parse(D);if(Array.isArray($))R[N]=$;else R[N]=D.split(",").map((C)=>C.trim())}catch{R[N]=D.split(",").map(($)=>$.trim())}else R[N]=D}}}return R}return d(_)}async function B4({name:E="",alias:r,cwd:t,configDir:T,defaultConfig:_,verbose:d=!1,checkEnv:e=!0,arrayStrategy:h="replace"}){let R=e&&typeof _==="object"&&_!==null&&!Array.isArray(_)?z4(E,_,d):_,N=t||qA.cwd(),A=[".ts",".js",".mjs",".cjs",".json"];if(d)Dt.info(`Loading configuration for "${E}"${r?` (alias: "${r}")`:""} from ${N}`);let S=[E,`.${E}`].filter(Boolean),L=[`${E}.config`,`.${E}.config`].filter(Boolean),O=r?[r,`.${r}`]:[],I=r?[`${r}.config`,`.${r}.config`]:[],D=Array.from(new Set([N,Mt(N,"config"),Mt(N,".config"),T?Mt(N,T):void 0].filter(Boolean)));for(let $ of D){if(d)Dt.info(`Searching for configuration in: ${$}`);let y=[Mt(N,"config"),Mt(N,".config")].concat(T?[Mt(N,T)]:[]).includes($)?[...S,...L,...O,...I]:[...L,...S,...I,...O];for(let j of y)for(let B of A){let f=Mt($,`${j}${B}`),Q=await a0(f,R,h);if(Q!==null){if(d)Dt.success(`Configuration loaded from: ${f}`);return Q}}}if(E){let $=Mt(XD(),".config",E),C=["config",`${E}.config`];if(r)C.push(`${r}.config`);if(d)Dt.info(`Checking user config directory: ${$}`);for(let y of C)for(let j of A){let B=Mt($,`${y}${j}`),f=await a0(B,R,h);if(f!==null){if(d)Dt.success(`Configuration loaded from user config directory: ${B}`);return f}}}if(E){let $=Mt(XD(),".config"),C=[`.${E}.config`];if(r)C.push(`.${r}.config`);if(d)Dt.info(`Checking user config directory for dotfile configs: ${$}`);for(let y of C)for(let j of A){let B=Mt($,`${y}${j}`),f=await a0(B,R,h);if(f!==null){if(d)Dt.success(`Configuration loaded from user config directory dotfile: ${B}`);return f}}}if(E){let $=XD(),C=[`.${E}.config`,`.${E}`];if(r)C.push(`.${r}.config`),C.push(`.${r}`);if(d)Dt.info(`Checking user home directory for dotfile configs: ${$}`);for(let y of C)for(let j of A){let B=Mt($,`${y}${j}`),f=await a0(B,R,h);if(f!==null){if(d)Dt.success(`Configuration loaded from user home directory: ${B}`);return f}}}try{let $=Mt(N,"package.json");if(WF($)){let C=await import($),y=C[E];if(!y&&r){if(y=C[r],y&&d)Dt.success(`Using alias "${r}" configuration from package.json`)}if(y&&typeof y==="object"&&!Array.isArray(y))try{if(d)Dt.success(`Configuration loaded from package.json: ${y===C[E]?E:r}`);return T$(R,y,h)}catch(j){if(d)Dt.warn("Failed to merge package.json config:",j)}}}catch($){if(d)Dt.warn("Failed to load package.json:",$)}if(d)Dt.info(`No configuration found for "${E}"${r?` or alias "${r}"`:""}, using default configuration with environment variables`);return R}function W4(E,r={}){let t=dO.cwd();while(t.includes("storage"))t=nj(t,"..");let T=nj(t,E||"");if(r?.relative)return GM(dO.cwd(),T);return T}async function H4(){try{let E=await B4({name:"clarity",alias:"logging",defaultConfig:tO,cwd:dO.cwd()});return{...tO,...E||{}}}catch{return tO}}function vr(){if(Ld.env.NODE_ENV==="test"||Ld.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function f4(){if(Ld.env.NODE_ENV==="test"||Ld.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof Ld<"u"){let E=Ld.type;if(E==="renderer"||E==="worker")return!1;return!!(Ld.versions&&(Ld.versions.node||Ld.versions.bun))}return!1}class QF{async format(E){let r=await f4(),t=await this.getMetadata(r);return JSON.stringify({timestamp:E.timestamp.toISOString(),level:E.level,name:E.name,message:E.message,metadata:t})}async getMetadata(E){if(E){let{hostname:r}=await import("os");return{pid:gR.pid,hostname:r(),environment:gR.env.NODE_ENV||"development",platform:gR.platform,version:gR.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:gR.env.NODE_ENV||gR.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class LO{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(E,r={}){this.name=E,this.config={...nD},this.options=this.normalizeOptions(r),this.formatter=this.options.formatter||new QF,this.enabled=r.enabled??!0,this.fancy=r.fancy??!0,this.tagFormat=r.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=r.timestampPosition??"right",this.environment=r.environment??Tr.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(r);let t={...r},T=r.timestamp!==void 0;if(T)delete t.timestamp;if(this.config={...this.config,...t,timestamp:T||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let _=this.generateKeyId(),d=this.generateKey();this.currentKeyId=_,this.keys.set(_,d),this.encryptionKeys.set(_,{key:d,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(E){if(!this.fingersCrossedConfig)return!1;let r={debug:0,info:1,success:2,warning:3,error:4},t=this.fingersCrossedConfig.activationLevel??"error";return r[E]>=r[t]}initializeFingersCrossedConfig(E){if(!E.fingersCrossedEnabled&&E.fingersCrossed)return{...TO,...E.fingersCrossed};if(!E.fingersCrossedEnabled)return null;if(!E.fingersCrossed)return{...TO};return{...TO,...E.fingersCrossed}}normalizeOptions(E){let r={format:"json",level:"info",logDirectory:nD.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},t={...r,...Object.fromEntries(Object.entries(E).filter(([,T])=>T!==void 0))};if(!t.level||!["debug","info","success","warning","error"].includes(t.level))t.level=r.level;return t}shouldWriteToFile(){return!vr()&&this.config.writeToFile===!0}async writeToFile(E){let t=(async()=>{let _,d=0,e=3,h=1000;while(d<e)try{try{try{await lM(this.config.logDirectory,tF.F_OK|tF.W_OK)}catch(N){if(N instanceof Error&&"code"in N)if(N.code==="ENOENT")await iM(this.config.logDirectory,{recursive:!0,mode:493});else if(N.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw N;else throw N}}catch(N){throw console.error("Debug: [writeToFile] Failed to create log directory:",N),N}let R=this.validateEncryptionConfig()?(await this.encrypt(E)).encrypted:Nd.from(E);try{if(!x0(this.currentLogFile))await WD(this.currentLogFile,"",{mode:420});if(_=rF(this.currentLogFile,"a",420),vM(_,R,{flag:"a"}),EF(_),_!==void 0)BD(_),_=void 0;if((await KR(this.currentLogFile)).size===0){if(await WD(this.currentLogFile,R,{flag:"w",mode:420}),(await KR(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(N){let A=N;if(A.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(A.code)){if(d<e-1){let S=typeof A.message==="string"?A.message:"Unknown error";console.error(`Network error during write attempt ${d+1}/${e}:`,S);let L=h*2**d;await new Promise((O)=>setTimeout(O,L)),d++;continue}}if(A?.code&&["ENOSPC","EDQUOT"].includes(A.code))throw Error(`Disk quota exceeded or no space left on device: ${A.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",A),A}finally{if(_!==void 0)try{BD(_)}catch(N){console.error("Debug: [writeToFile] Error closing file descriptor:",N)}}}catch(R){if(d===e-1){let A=R,S=typeof A.message==="string"?A.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",S),R}d++;let N=h*2**(d-1);await new Promise((A)=>setTimeout(A,N))}})();this.pendingOperations.push(t);let T=this.pendingOperations.length-1;try{await t}catch(_){throw console.error("Debug: [writeToFile] Error in operation:",_),_}finally{this.pendingOperations.splice(T,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return ZR(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return ZR(this.config.logDirectory,`${this.name}.log`);let E=new Date().toISOString().split("T")[0];return ZR(this.config.logDirectory,`${this.name}-${E}.log`)}setupRotation(){if(vr())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let E=this.config.rotation,r;switch(E.frequency){case"daily":r=86400000;break;case"weekly":r=604800000;break;case"monthly":r=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},r)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let r=this.config.rotation.keyRotation;if(!r?.enabled)return;let t=typeof r.interval==="number"?r.interval:60,T=Math.max(t,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((_)=>{console.error("Error rotating keys:",_)})},T)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let r=this.config.rotation.keyRotation,t=this.generateKeyId(),T=this.generateKey();this.currentKeyId=t,this.keys.set(t,T),this.encryptionKeys.set(t,{key:T,createdAt:new Date});let _=Array.from(this.encryptionKeys.entries()).sort(([,h],[,R])=>R.createdAt.getTime()-h.createdAt.getTime()),d=typeof r.maxKeys==="number"?r.maxKeys:1,e=Math.max(1,d);if(_.length>e)for(let[h]of _.slice(e))this.encryptionKeys.delete(h),this.keys.delete(h)}generateKeyId(){return zD(16).toString("hex")}generateKey(){return zD(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let E=this.keys.get(this.currentKeyId);if(!E)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:E,id:this.currentKeyId}}encrypt(E){let{key:r}=this.getCurrentKey(),t=zD(16),T=kM("aes-256-gcm",r,t),_=Nd.isBuffer(E)?E:Nd.from(E,"utf8"),d=T.update(_),e=T.final(),h=d.length+e.length,R=T.getAuthTag(),N=Nd.allocUnsafe(16+h+16);return t.copy(N,0),d.copy(N,16),e.copy(N,16+d.length),R.copy(N,16+h),{encrypted:N,iv:t}}async compressData(E){return new Promise((r,t)=>{let T=_F(),_=[];T.on("data",(d)=>_.push(d)),T.on("end",()=>r(Nd.from(Nd.concat(_)))),T.on("error",t),T.write(E),T.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let E={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let r=this.config.rotation.encrypt;return{...E,...r}}return E}async rotateLog(){if(vr())return;if(!this.shouldWriteToFile())return;let E=await KR(this.currentLogFile).catch(()=>null);if(!E)return;let r=this.config.rotation;if(typeof r==="boolean")return;if(r.maxSize&&E.size>=r.maxSize){let t=this.currentLogFile,T=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let _=await b0(this.config.logDirectory),d=_.filter((R)=>R.startsWith(this.name)&&/\.log\.\d+$/.test(R)).sort((R,N)=>{let A=Number.parseInt(R.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(N.match(/\.log\.(\d+)$/)?.[1]||"0")-A}),e=d.length>0?Number.parseInt(d[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,h=`${t}.${e}`;if(await KR(t).catch(()=>null))try{if(await TF(t,h),r.compress)try{let R=`${h}.gz`;await this.compressLogFile(h,R),await k0(h)}catch(R){console.error("Error compressing rotated file:",R)}if(d.length===0&&!_.some((R)=>R.endsWith(".log.1")))try{let R=`${t}.1`;await WD(R,"")}catch(R){console.error("Error creating backup file:",R)}}catch(R){console.error(`Error during rotation: ${R instanceof Error?R.message:String(R)}`)}}else{let _=new Date().toISOString().replace(/[:.]/g,"-"),d=t.replace(/\.log$/,`-${_}.log`);if(await KR(t).catch(()=>null))await TF(t,d)}if(this.currentLogFile=T,r.maxFiles){let d=(await b0(this.config.logDirectory)).filter((e)=>e.startsWith(this.name)).sort((e,h)=>h.localeCompare(e));for(let e of d.slice(r.maxFiles))await k0(ZR(this.config.logDirectory,e))}}}async compressLogFile(E,r){let t=oj(E),T=nM(r),_=_F();await sM(t,_,T)}async handleFingersCrossedBuffer(E,r){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(E)&&!this.isActivated){this.isActivated=!0;for(let t of this.logBuffer){let T=await this.formatter.format(t);if(this.shouldWriteToFile())await this.writeToFile(T);console.log(T)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(r);console.log(r)}}shouldLog(E){if(!this.enabled)return!1;let r={debug:0,info:1,success:2,warning:3,error:4};return r[E]>=r[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((E)=>{if(E instanceof Promise)return E.catch((r)=>{console.error("Error in pending write operation:",r)});return Promise.resolve()})),x0(this.currentLogFile))try{let E=rF(this.currentLogFile,"r+");EF(E),BD(E)}catch(E){console.error(`Error flushing file: ${E}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let E of this.pendingOperations)if(typeof E.cancel==="function")E.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(E){console.error("Error waiting for pending operations:",E)}if(!vr()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let r=(await b0(this.config.logDirectory)).filter((t)=>(t.includes("temp")||t.includes(".tmp"))&&t.includes(this.name));for(let t of r)try{await k0(ZR(this.config.logDirectory,t))}catch(T){console.error(`Failed to delete temp file ${t}:`,T)}}catch(E){console.error("Error cleaning up temporary files:",E)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(E){if(!E)return"";return`${this.tagFormat.prefix}${E}${this.tagFormat.suffix}`}formatFileTimestamp(E){return`[${E.toISOString()}]`}formatConsoleTimestamp(E){return this.shouldStyleConsole()?er.gray(E.toLocaleTimeString()):E.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||vr())return!1;let E=typeof Tr.env.NO_COLOR<"u",r=Tr.env.FORCE_COLOR==="0";if(E||r)return!1;return!!(typeof Tr.stderr<"u"&&Tr.stderr.isTTY||typeof Tr.stdout<"u"&&Tr.stdout.isTTY)}formatConsoleMessage(E){let{timestamp:r,icon:t="",tag:T="",message:_,level:d,showTimestamp:e=!0}=E,h=(O)=>O.replace(this.ANSI_PATTERN,"");if(!this.fancy){let O=[];if(e)O.push(r);if(d==="warning")O.push("WARN");else if(d==="error")O.push("ERROR");else if(t)O.push(t.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(T)O.push(T.replace(/[[\]]/g,""));return O.push(_),O.join(" ")}let R=Tr.stdout.columns||120,N="";if(d==="warning"||d==="error")N=`${t} ${_}`;else if(d==="info"||d==="success")N=`${t} ${T} ${_}`;else N=`${t} ${T} ${er.cyan(_)}`;if(!e)return N.trim();let A=h(N).trim().length,S=h(r).length,L=Math.max(1,R-2-A-S);return`${N.trim()}${" ".repeat(L)}${r}`}formatMessage(E,r){if(r.length===1&&Array.isArray(r[0]))return E.replace(/\{(\d+)\}/g,(d,e)=>{let h=Number.parseInt(e,10);return h<r[0].length?String(r[0][h]):d});let t=/%([sdijfo%])/g,T=0,_=E.replace(t,(d,e)=>{if(e==="%")return"%";if(T>=r.length)return d;let h=r[T++];switch(e){case"s":return String(h);case"d":case"i":return Number(h).toString();case"j":case"o":return JSON.stringify(h,null,2);default:return d}});if(T<r.length)_+=` ${r.slice(T).map((d)=>typeof d==="object"?JSON.stringify(d,null,2):String(d)).join(" ")}`;return _}formatMarkdown(E){if(!E)return E;let r=E;return r=r.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(t,T,_)=>{let d=er.underline(er.blue(T)),e=this.toAbsoluteFilePath(_);if(e&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let h=`file://${encodeURI(e)}`,R="\x1B]8;;",N="\x1B\\";return`\x1B]8;;${h}\x1B\\${d}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${_}\x1B\\${d}\x1B]8;;\x1B\\`;return d}),r=r.replace(/`([^`]+)`/g,(t,T)=>er.bgGray(T)),r=r.replace(/\*\*([^*]+)\*\*/g,(t,T)=>er.bold(T)),r=r.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(t,T)=>er.italic(T)),r=r.replace(/(?<!_)_([^_]+)_(?!_)/g,(t,T)=>er.italic(T)),r=r.replace(/~([^~]+)~/g,(t,T)=>er.strikethrough(T)),r}supportsHyperlinks(){if(vr())return!1;let E=Tr.env;if(!E)return!1;if(E.TERM_PROGRAM==="iTerm.app"||E.TERM_PROGRAM==="vscode"||E.TERM_PROGRAM==="WezTerm")return!0;if(E.WT_SESSION)return!0;if(E.TERM==="xterm-kitty")return!0;let r=E.VTE_VERSION?Number.parseInt(E.VTE_VERSION,10):0;if(!Number.isNaN(r)&&r>=5000)return!0;return!1}toAbsoluteFilePath(E){try{let r=E;if(r.startsWith("file://"))r=r.replace(/^file:\/\//,"");if(r.startsWith("~")){let t=Tr.env.HOME||"";if(t)r=r.replace(/^~(?=$|\/)/,t)}if(aM(r)||r.startsWith("./")||r.startsWith("../"))r=mM(r);else return null;return x0(r)?r:null}catch{return null}}buildOutputTexts(E){let r=this.shouldStyleConsole()?this.formatMarkdown(E):E,t=E.replace(this.ANSI_PATTERN,"");return{consoleText:r,fileText:t}}async log(E,r,...t){let T=new Date,_=this.formatConsoleTimestamp(T),d=this.formatFileTimestamp(T),e,h;if(r instanceof Error)e=r.message,h=r.stack;else e=this.formatMessage(r,t);let{consoleText:R,fileText:N}=this.buildOutputTexts(e);if(this.shouldStyleConsole()){let S=this.options.showIcons===!1?"":bF[E],L=this.options.showTags!==!1&&this.name?er.gray(this.formatTag(this.name)):"",O;switch(E){case"debug":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:er.gray(R),level:E}),console.error(O);break;case"info":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:R,level:E}),console.warn(O);break;case"success":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:er.green(R),level:E}),console.error(O);break;case"warning":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:R,level:E}),console.warn(O);break;case"error":if(O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:R,level:E}),console.error(O),h){let I=h.split(`
 `);for(let D of I)if(D.trim()&&!D.includes(e))console.error(this.formatConsoleMessage({timestamp:_,message:er.gray(`  ${D}`),level:E,showTimestamp:!1}))}break}}else if(!vr()){if(console.error(`${d} ${this.environment}.${E.toUpperCase()}: ${e}`),h)console.error(h)}if(!this.shouldLog(E))return;let A=`${d} ${this.environment}.${E.toUpperCase()}: ${N}
 `;if(h)A+=`${h}
 `;if(A=A.replace(this.ANSI_PATTERN,""),this.shouldWriteToFile())await this.writeToFile(A)}progress(E,r=""){let t={update:(h,R)=>{},finish:(h)=>{},interrupt:(h,R)=>{}};if(!this.enabled)return t;let T=30;if(this.activeProgressBar={total:Math.max(1,E||1),current:0,message:r||"",barLength:T,lastRenderedLine:""},this.shouldStyleConsole()&&!vr()&&Tr.stdout.isTTY)this.renderProgressBar(this.activeProgressBar);return{update:(h,R)=>{if(!this.enabled||!this.activeProgressBar)return;if(this.activeProgressBar.current=Math.min(Math.max(0,h),this.activeProgressBar.total),R!==void 0)this.activeProgressBar.message=R;if(this.shouldStyleConsole()&&!vr()&&Tr.stdout.isTTY)this.renderProgressBar(this.activeProgressBar)},finish:(h)=>{if(!this.activeProgressBar)return;this.finishProgressBar(this.activeProgressBar,h)},interrupt:(h,R="info")=>{if(!vr()&&Tr.stdout.isTTY)Tr.stdout.write(`
 `);if(this[R==="warning"?"warn":R](h),this.activeProgressBar&&this.shouldStyleConsole()&&!vr()&&Tr.stdout.isTTY)this.renderProgressBar(this.activeProgressBar)}}}time(E){let r=performance.now();if(this.shouldStyleConsole()){let t=this.options.showTags!==!1&&this.name?er.gray(this.formatTag(this.name)):"",T=this.formatConsoleTimestamp(new Date);console.error(this.formatConsoleMessage({timestamp:T,icon:this.options.showIcons===!1?"":er.blue("◐"),tag:t,message:`${er.cyan(E)}...`}))}return async(t)=>{if(!this.enabled)return;let T=performance.now(),_=Math.round(T-r),d=`${E} completed in ${_}ms`,e=new Date,h=this.formatConsoleTimestamp(e),N=`${this.formatFileTimestamp(e)} ${this.environment}.INFO: ${d}`;if(t)N+=` ${JSON.stringify(t)}`;if(N+=`
-`,N=N.replace(this.ANSI_PATTERN,""),this.shouldStyleConsole()){let A=this.options.showTags!==!1&&this.name?er.gray(this.formatTag(this.name)):"";console.error(this.formatConsoleMessage({timestamp:h,icon:this.options.showIcons===!1?"":er.green("✓"),tag:A,message:`${d}${t?` ${JSON.stringify(t)}`:""}`}))}else if(!vr())console.error(N.trim());if(this.shouldWriteToFile())await this.writeToFile(N)}}async debug(E,...r){await this.log("debug",E,...r)}async info(E,...r){await this.log("info",E,...r)}async success(E,...r){await this.log("success",E,...r)}async warn(E,...r){await this.log("warning",E,...r)}async error(E,...r){await this.log("error",E,...r)}validateEncryptionConfig(){if(!this.config.rotation)return!1;if(typeof this.config.rotation==="boolean")return!1;let E=this.config.rotation,{encrypt:r}=E;return!!r}async only(E){if(!this.enabled)return;return await E()}isEnabled(){return this.enabled}setEnabled(E){this.enabled=E}extend(E){let r=`${this.name}:${E}`,t=new LO(r,{...this.options,logDirectory:this.config.logDirectory,level:this.config.level,format:this.config.format,rotation:typeof this.config.rotation==="boolean"?void 0:this.config.rotation,timestamp:typeof this.config.timestamp==="boolean"?void 0:this.config.timestamp});return this.subLoggers.add(t),t}createReadStream(){if(vr())throw Error("createReadStream is not supported in browser environments");if(!x0(this.currentLogFile))throw Error(`Log file does not exist: ${this.currentLogFile}`);return oj(this.currentLogFile,{encoding:"utf8"})}async decrypt(E){if(!this.validateEncryptionConfig())throw Error("Encryption is not configured");let r=this.config.rotation;if(!r.encrypt||typeof r.encrypt==="boolean")throw Error("Invalid encryption configuration");if(!this.currentKeyId||!this.keys.has(this.currentKeyId))throw Error("No valid encryption key available");let t=this.keys.get(this.currentKeyId);try{let T=Nd.isBuffer(E)?E:Nd.from(E,"base64"),_=T.subarray(0,16),d=T.subarray(T.length-16),e=T.subarray(16,T.length-16),h=u8("aes-256-gcm",t,_);h.setAuthTag(d);let R=h.update(e),N=h.final(),A=R.length+N.length,S=Nd.allocUnsafe(A);return R.copy(S,0),N.copy(S,R.length),S.toString("utf8")}catch(T){throw Error(`Decryption failed: ${T instanceof Error?T.message:String(T)}`)}}getLevel(){return this.config.level}getLogDirectory(){return this.config.logDirectory}getFormat(){return this.config.format}getRotationConfig(){return this.config.rotation}isBrowserMode(){return vr()}isServerMode(){return!vr()}setTestEncryptionKey(E,r){this.currentKeyId=E,this.keys.set(E,r)}getTestCurrentKey(){if(!this.currentKeyId||!this.keys.has(this.currentKeyId))return null;return{id:this.currentKeyId,key:this.keys.get(this.currentKeyId)}}getConfig(){return this.config}async box(E){if(!this.enabled)return;let r=new Date,t=this.formatConsoleTimestamp(r),T=this.formatFileTimestamp(r),{consoleText:_,fileText:d}=this.buildOutputTexts(E);if(this.shouldStyleConsole()){let h=_.split(`
+`,N=N.replace(this.ANSI_PATTERN,""),this.shouldStyleConsole()){let A=this.options.showTags!==!1&&this.name?er.gray(this.formatTag(this.name)):"";console.error(this.formatConsoleMessage({timestamp:h,icon:this.options.showIcons===!1?"":er.green("✓"),tag:A,message:`${d}${t?` ${JSON.stringify(t)}`:""}`}))}else if(!vr())console.error(N.trim());if(this.shouldWriteToFile())await this.writeToFile(N)}}async debug(E,...r){await this.log("debug",E,...r)}async info(E,...r){await this.log("info",E,...r)}async success(E,...r){await this.log("success",E,...r)}async warn(E,...r){await this.log("warning",E,...r)}async error(E,...r){await this.log("error",E,...r)}validateEncryptionConfig(){if(!this.config.rotation)return!1;if(typeof this.config.rotation==="boolean")return!1;let E=this.config.rotation,{encrypt:r}=E;return!!r}async only(E){if(!this.enabled)return;return await E()}isEnabled(){return this.enabled}setEnabled(E){this.enabled=E}extend(E){let r=`${this.name}:${E}`,t=new LO(r,{...this.options,logDirectory:this.config.logDirectory,level:this.config.level,format:this.config.format,rotation:typeof this.config.rotation==="boolean"?void 0:this.config.rotation,timestamp:typeof this.config.timestamp==="boolean"?void 0:this.config.timestamp});return this.subLoggers.add(t),t}createReadStream(){if(vr())throw Error("createReadStream is not supported in browser environments");if(!x0(this.currentLogFile))throw Error(`Log file does not exist: ${this.currentLogFile}`);return oj(this.currentLogFile,{encoding:"utf8"})}async decrypt(E){if(!this.validateEncryptionConfig())throw Error("Encryption is not configured");let r=this.config.rotation;if(!r.encrypt||typeof r.encrypt==="boolean")throw Error("Invalid encryption configuration");if(!this.currentKeyId||!this.keys.has(this.currentKeyId))throw Error("No valid encryption key available");let t=this.keys.get(this.currentKeyId);try{let T=Nd.isBuffer(E)?E:Nd.from(E,"base64"),_=T.subarray(0,16),d=T.subarray(T.length-16),e=T.subarray(16,T.length-16),h=uM("aes-256-gcm",t,_);h.setAuthTag(d);let R=h.update(e),N=h.final(),A=R.length+N.length,S=Nd.allocUnsafe(A);return R.copy(S,0),N.copy(S,R.length),S.toString("utf8")}catch(T){throw Error(`Decryption failed: ${T instanceof Error?T.message:String(T)}`)}}getLevel(){return this.config.level}getLogDirectory(){return this.config.logDirectory}getFormat(){return this.config.format}getRotationConfig(){return this.config.rotation}isBrowserMode(){return vr()}isServerMode(){return!vr()}setTestEncryptionKey(E,r){this.currentKeyId=E,this.keys.set(E,r)}getTestCurrentKey(){if(!this.currentKeyId||!this.keys.has(this.currentKeyId))return null;return{id:this.currentKeyId,key:this.keys.get(this.currentKeyId)}}getConfig(){return this.config}async box(E){if(!this.enabled)return;let r=new Date,t=this.formatConsoleTimestamp(r),T=this.formatFileTimestamp(r),{consoleText:_,fileText:d}=this.buildOutputTexts(E);if(this.shouldStyleConsole()){let h=_.split(`
 `),R=Math.max(...h.map((L)=>L.length))+2,N=`┌${"─".repeat(R)}┐`,A=`└${"─".repeat(R)}┘`,S=h.map((L)=>{return this.formatConsoleMessage({timestamp:t,message:er.cyan(L),showTimestamp:!1})});console.error(this.formatConsoleMessage({timestamp:t,message:er.cyan(N),showTimestamp:!1})),S.forEach((L)=>console.error(L)),console.error(this.formatConsoleMessage({timestamp:t,message:er.cyan(A),showTimestamp:!1}))}else if(!vr())console.error(`${T} ${this.environment}.INFO: [BOX] ${d}`);let e=`${T} ${this.environment}.INFO: [BOX] ${d}
 `.replace(this.ANSI_PATTERN,"");if(this.shouldWriteToFile())await this.writeToFile(e)}async prompt(E){if(vr())return Promise.resolve(!0);return new Promise((r)=>{console.error(`${er.cyan("?")} ${E} (y/n) `);let t=(T)=>{let _=T.toString().trim().toLowerCase();Tr.stdin.removeListener("data",t);try{if(typeof Tr.stdin.setRawMode==="function")Tr.stdin.setRawMode(!1)}catch{}Tr.stdin.pause(),console.error(""),r(_==="y"||_==="yes")};try{if(typeof Tr.stdin.setRawMode==="function")Tr.stdin.setRawMode(!0)}catch{}Tr.stdin.resume(),Tr.stdin.once("data",t)})}setFancy(E){this.fancy=E}isFancy(){return this.fancy}pause(){this.enabled=!1}resume(){this.enabled=!0}async start(E,...r){if(!this.enabled)return;let t=E;if(r&&r.length>0){let R=/%([sdijfo%])/g,N=0;if(t=E.replace(R,(A,S)=>{if(S==="%")return"%";if(N>=r.length)return A;let L=r[N++];switch(S){case"s":return String(L);case"d":case"i":return Number(L).toString();case"j":case"o":return JSON.stringify(L,null,2);default:return A}}),N<r.length)t+=` ${r.slice(N).map((A)=>typeof A==="object"?JSON.stringify(A,null,2):String(A)).join(" ")}`}let{consoleText:T,fileText:_}=this.buildOutputTexts(t);if(this.shouldStyleConsole()){let R=this.options.showTags!==!1&&this.name?er.gray(this.formatTag(this.name)):"",N=this.options.showIcons===!1?"":`${er.blue("◐")} `;console.error(`${N}${R} ${er.cyan(T)}`)}let h=`[${new Date().toISOString()}] ${this.environment}.INFO: [START] ${_}
 `.replace(this.ANSI_PATTERN,"");if(this.shouldWriteToFile())await this.writeToFile(h)}renderProgressBar(E,r=!1){if(!this.enabled||!this.shouldStyleConsole()||!Tr.stdout.isTTY)return;let t=Math.min(100,Math.max(0,Math.round(E.current/E.total*100))),T=Math.round(E.barLength*t/100),_=E.barLength-T,d=er.green("━".repeat(T)),e=er.gray("━".repeat(_)),h=`[${d}${e}]`,R=`${t}%`.padStart(4),N=E.message?` ${E.message}`:"",A=this.options.showIcons===!1?"":r||t===100?er.green("✓"):er.blue("▶"),S=this.options.showTags!==!1&&this.name?` ${er.gray(this.formatTag(this.name))}`:"",L=`\r${A}${S} ${h} ${R}${N}`,O=Tr.stdout.columns||80,I=" ".repeat(Math.max(0,O-L.replace(this.ANSI_PATTERN,"").length));if(E.lastRenderedLine=`${L}${I}`,Tr.stdout.write(E.lastRenderedLine),r)Tr.stdout.write(`
@@ -9057,16 +9057,16 @@ volumes:
 `;t+=`| Variable | Type | Description | Example |
 `,t+=`|----------|------|-------------|----------|
 `;for(let T of E)t+=`| \`${T.key}\` | ${T.type} | ${T.description} | \`${T.example}\` |
-`;return t}}function G4(E,r){let t=gF("process");if(typeof t>"u"||!t.env)return r;let T=t.env[E];return T!==void 0?T:r}function VF(E,r,t={}){return PF(E,r,t,new WeakMap)}function PF(E,r,t,T){let{arrayMergeMode:_="replace",skipNullish:d=!1,customMerger:e}=t;if(r===null||r===void 0)return d?E:r;if(e){let h=e(E,r);if(h!==void 0)return h}if(Array.isArray(r)||Array.isArray(E))return KF(E,r,_,T);if(!gT(r)||!gT(E))return r;return K4(E,r,t,T)}function KF(E,r,t,T){if(Array.isArray(r)&&!Array.isArray(E))return r;if(Array.isArray(E)&&!Array.isArray(r))return r;if(Array.isArray(r)&&Array.isArray(E))switch(t){case"replace":return r;case"concat":return M4(E,r);case"smart":return V4(E,r,T);default:return r}return r}function M4(E,r){let t=[...r];for(let T of E)if(!t.some((_)=>kD(_,T)))t.push(T);return t}function V4(E,r,t){if(r.length===0)return E;if(E.length===0)return r;if(gT(r[0])&&gT(E[0]))return P4(E,r,t);if(r.every((T)=>typeof T==="string")&&E.every((T)=>typeof T==="string")){let T=[...r];for(let _ of E)if(!T.includes(_))T.push(_);return T}return r}function P4(E,r,t){let T=[...r];for(let _ of E){if(!gT(_)){T.push(_);continue}let d=["id","name","key","path","type"],e=!1;for(let h of d)if(h in _){if(T.find((N)=>gT(N)&&(h in N)&&N[h]===_[h])){e=!0;break}}if(!e)T.push(_)}return T}function K4(E,r,t,T){let _=r;if(gT(_)&&T.has(_))return T.get(_);let d={...E};if(gT(_))T.set(_,d);for(let e in _){if(!Object.prototype.hasOwnProperty.call(_,e))continue;let h=_[e],R=d[e];if(t.skipNullish&&(h===null||h===void 0))continue;if(h===null||h===void 0){d[e]=h;continue}if(gT(h)&&gT(R))d[e]=PF(R,h,t,T);else if(Array.isArray(h)||Array.isArray(R))d[e]=KF(R,h,t.arrayMergeMode||"smart",T);else d[e]=h}return d}function _$(E,r,t="replace"){return VF(E,r,{arrayMergeMode:t==="replace"?"replace":"smart",skipNullish:!0})}function kD(E,r){if(E===r)return!0;if(Array.isArray(E)&&Array.isArray(r)){if(E.length!==r.length)return!1;for(let t=0;t<E.length;t++)if(!kD(E[t],r[t]))return!1;return!0}if(gT(E)&&gT(r)){let t=Object.keys(E),T=Object.keys(r);if(t.length!==T.length)return!1;for(let _ of t){if(!Object.prototype.hasOwnProperty.call(r,_))return!1;if(!kD(E[_],r[_]))return!1}return!0}return!1}function gT(E){return Boolean(E&&typeof E==="object"&&!Array.isArray(E))}class CO{extensions=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];async loadFromPath(E,r,t={}){let{arrayStrategy:T="replace",useCache:_=!0,cacheTtl:d,trackPerformance:e=!0,verbose:h=!1}=t;if(_){let N=kR.getWithFileCheck("file",E);if(N){if(h)console.log(`Configuration loaded from cache: ${E}`);return N}}let R=async()=>{if(!n0(E))return null;try{let N=`?t=${Date.now()}`,A=await import(E+N),S=A.default||A,L="default"in A,O=Object.keys(A).length>0;if(!L&&!O)throw new xA(E,Error("Configuration file is empty and exports nothing"),"unknown");if(typeof S!=="object"||S===null||Array.isArray(S))throw new xA(E,Error("Configuration must export a valid object"),"unknown");let $={config:_$(r,S,T),source:{type:"file",path:E,priority:100,timestamp:new Date}};if(_)kR.setWithFileCheck("file",$,E,d);return $}catch(N){throw N instanceof Error?Le.configLoad(E,N):Le.configLoad(E,Error(String(N)))}};if(e)return kA.track("loadFromPath",R,{path:E});return R()}async tryLoadFromPaths(E,r,t={}){for(let T of E)try{let _=await this.loadFromPath(T,r,t);if(_)return _}catch(_){if(_ instanceof Error&&_.name==="ConfigLoadError")throw _;if(t.verbose)console.warn(`Failed to load config from ${T}:`,_)}return null}generateConfigPaths(E,r,t){let T=this.generateNamePatterns(E,t),_=[];for(let d of T)for(let e of this.extensions)_.push(HD(r,`${d}${e}`));return _}generateNamePatterns(E,r){let t=[];if(t.push("config",".config"),E)t.push(E,`.${E}.config`,`${E}.config`,`.${E}`);if(r){if(t.push(r,`.${r}.config`,`${r}.config`,`.${r}`),E)t.push(`${E}.${r}.config`,`.${E}.${r}.config`)}return t.filter(Boolean)}checkFileAccess(E){return GF(async()=>{return n0(E)},{maxRetries:2,retryDelay:100,fallback:!1})}async discoverConfigFiles(E,r,t){let T=[];if(!n0(E))return T;if(r||t){let _=this.generateNamePatterns(r||"",t);for(let d of _)for(let e of this.extensions){let h=HD(E,`${d}${e}`);if(await this.checkFileAccess(h))T.push(h)}}else try{let{readdirSync:_}=await import("fs"),d=_(E);for(let e of d)if(this.looksLikeConfigFile(e)){let h=HD(E,e);if(await this.checkFileAccess(h))T.push(h)}}catch{return[]}return T}looksLikeConfigFile(E){return[/\.config\.(ts|js|mjs|cjs|json|mts|cts)$/,/^\..*\.(ts|js|mjs|cjs|json|mts|cts)$/,/config\.(ts|js|mjs|cjs|json|mts|cts)$/].some((t)=>t.test(E))}async validateConfigFile(E){let r=[];try{if(!n0(E))return r.push("Configuration file does not exist"),r;let t=await import(E),T=t.default||t;if(T===void 0)r.push("Configuration file must export a default value or named exports");else if(typeof T!=="object"||T===null)r.push("Configuration must be an object");else if(Array.isArray(T))r.push("Configuration cannot be an array at the root level");if(E.endsWith(".json"))try{let{readFileSync:_}=await import("fs"),d=_(E,"utf8");JSON.parse(d)}catch(_){r.push(`Invalid JSON syntax: ${_}`)}}catch(t){r.push(`Failed to load configuration file: ${t}`)}return r}async getFileModificationTime(E){try{let{statSync:r}=await import("fs");return r(E).mtime}catch{return null}}async preloadConfigurations(E,r={}){let t=new Map;return await Promise.allSettled(E.map(async(T)=>{try{let _=await this.loadFromPath(T,{},r);if(_)t.set(T,_.config)}catch(_){if(r.verbose)console.warn(`Failed to preload ${T}:`,_)}})),t}}class d${async validateConfiguration(E,r,t={}){let{stopOnFirstError:T=!1,validateRequired:_=!0,validateTypes:d=!0,customRules:e=[],trackPerformance:h=!0,verbose:R=!1}=t,N=async()=>{let A=[],S=[],L={stopOnFirstError:T,validateRequired:_,validateTypes:d,customRules:e,trackPerformance:h,verbose:R};try{if(typeof r==="string")return await this.validateWithSchemaFile(E,r,L);else if(Array.isArray(r))return this.validateWithRules(E,[...r,...e],L);else return this.validateWithJSONSchema(E,r,L)}catch(O){return A.push({path:"",message:`Validation failed: ${O}`,rule:"system"}),{isValid:!1,errors:A,warnings:S}}};if(h)return await kA.track("validateConfiguration",N);return N()}async validateWithSchemaFile(E,r,t){try{if(!p8(r))throw new bA(r,[{path:"",message:"Schema file does not exist"}]);let T=await import(r),_=T.default||T;if(Array.isArray(_))return this.validateWithRules(E,_,t);else return this.validateWithJSONSchema(E,_,t)}catch(T){throw new bA(r,[{path:"",message:`Failed to load schema: ${T}`}])}}validateWithJSONSchema(E,r,t){let T=[],_=[];return this.validateObjectAgainstSchema(E,r,"",T,_,t),{isValid:T.length===0,errors:T,warnings:_}}validateObjectAgainstSchema(E,r,t,T,_,d){if(d.validateTypes&&r.type){let e=Array.isArray(E)?"array":typeof E,h=Array.isArray(r.type)?r.type:[r.type];if(!h.includes(e)){if(T.push({path:t,message:`Expected type ${h.join(" or ")}, got ${e}`,expected:h.join(" or "),actual:e,rule:"type"}),d.stopOnFirstError)return}}if(r.enum&&!r.enum.includes(E)){if(T.push({path:t,message:`Value must be one of: ${r.enum.join(", ")}`,expected:r.enum.join(", "),actual:E,rule:"enum"}),d.stopOnFirstError)return}if(typeof E==="string"){if(r.minLength!==void 0&&E.length<r.minLength)T.push({path:t,message:`String length must be at least ${r.minLength}`,expected:`>= ${r.minLength}`,actual:E.length,rule:"minLength"});if(r.maxLength!==void 0&&E.length>r.maxLength)T.push({path:t,message:`String length must not exceed ${r.maxLength}`,expected:`<= ${r.maxLength}`,actual:E.length,rule:"maxLength"});if(r.pattern){if(!new RegExp(r.pattern).test(E))T.push({path:t,message:`String does not match pattern ${r.pattern}`,expected:r.pattern,actual:E,rule:"pattern"})}}if(typeof E==="number"){if(r.minimum!==void 0&&E<r.minimum)T.push({path:t,message:`Value must be at least ${r.minimum}`,expected:`>= ${r.minimum}`,actual:E,rule:"minimum"});if(r.maximum!==void 0&&E>r.maximum)T.push({path:t,message:`Value must not exceed ${r.maximum}`,expected:`<= ${r.maximum}`,actual:E,rule:"maximum"})}if(Array.isArray(E)&&r.items)for(let e=0;e<E.length;e++){let h=t?`${t}[${e}]`:`[${e}]`;if(this.validateObjectAgainstSchema(E[e],r.items,h,T,_,d),d.stopOnFirstError&&T.length>0)return}if(E&&typeof E==="object"&&!Array.isArray(E)){let e=E;if(d.validateRequired&&r.required){for(let h of r.required)if(!(h in e)){if(T.push({path:t?`${t}.${h}`:h,message:`Missing required property '${h}'`,expected:"required",rule:"required"}),d.stopOnFirstError)return}}if(r.properties){for(let[h,R]of Object.entries(r.properties))if(h in e){let N=t?`${t}.${h}`:h;if(this.validateObjectAgainstSchema(e[h],R,N,T,_,d),d.stopOnFirstError&&T.length>0)return}}if(r.additionalProperties===!1){let h=new Set(Object.keys(r.properties||{}));for(let R of Object.keys(e))if(!h.has(R))_.push({path:t?`${t}.${R}`:R,message:`Additional property '${R}' is not allowed`,rule:"additionalProperties"})}}}validateWithRules(E,r,t){let T=[],_=[];for(let d of r)try{let e=this.getValueByPath(E,d.path),h=this.validateWithRule(e,d,d.path);if(T.push(...h),t.stopOnFirstError&&T.length>0)break}catch(e){T.push({path:d.path,message:`Rule validation failed: ${e}`,rule:"system"})}return{isValid:T.length===0,errors:T,warnings:_}}validateWithRule(E,r,t){let T=[];if(r.required&&(E===void 0||E===null))return T.push({path:t,message:r.message||`Property '${t}' is required`,expected:"required",rule:"required"}),T;if(E===void 0||E===null)return T;if(r.type){let _=Array.isArray(E)?"array":typeof E;if(_!==r.type)T.push({path:t,message:r.message||`Expected type ${r.type}, got ${_}`,expected:r.type,actual:_,rule:"type"})}if(r.min!==void 0){let _=Array.isArray(E)?E.length:typeof E==="string"?E.length:typeof E==="number"?E:0;if(_<r.min)T.push({path:t,message:r.message||`Value must be at least ${r.min}`,expected:`>= ${r.min}`,actual:_,rule:"min"})}if(r.max!==void 0){let _=Array.isArray(E)?E.length:typeof E==="string"?E.length:typeof E==="number"?E:0;if(_>r.max)T.push({path:t,message:r.message||`Value must not exceed ${r.max}`,expected:`<= ${r.max}`,actual:_,rule:"max"})}if(r.pattern&&typeof E==="string"){if(!r.pattern.test(E))T.push({path:t,message:r.message||`Value does not match pattern ${r.pattern}`,expected:r.pattern.toString(),actual:E,rule:"pattern"})}if(r.enum&&!r.enum.includes(E))T.push({path:t,message:r.message||`Value must be one of: ${r.enum.join(", ")}`,expected:r.enum.join(", "),actual:E,rule:"enum"});if(r.validator){let _=r.validator(E);if(_)T.push({path:t,message:r.message||_,rule:"custom"})}return T}getValueByPath(E,r){if(!r)return E;let t=r.split("."),T=E;for(let _ of t)if(T&&typeof T==="object"&&_ in T)T=T[_];else return;return T}generateRulesFromInterface(E){let r=[],t=E.matchAll(/(\w+)(\?)?:\s*(\w+)/g);for(let T of t){let[,_,d,e]=T;r.push({path:_,required:!d,type:this.mapTypeScriptType(e)})}return r}mapTypeScriptType(E){switch(E.toLowerCase()){case"string":return"string";case"number":return"number";case"boolean":return"boolean";case"array":return"array";case"object":return"object";default:return"object"}}static createCommonRules(){return{server:[{path:"port",required:!0,type:"number",min:1,max:65535},{path:"host",required:!0,type:"string",min:1},{path:"ssl",type:"boolean"}],database:[{path:"url",required:!0,type:"string",min:1},{path:"pool",type:"number",min:1,max:100},{path:"timeout",type:"number",min:0}],api:[{path:"baseUrl",required:!0,type:"string",pattern:uF},{path:"timeout",type:"number",min:0},{path:"retries",type:"number",min:0,max:10}]}}}class e${fileLoader=new CO;envProcessor=new wO;validator=new d$;async loadConfig(E){let r=Date.now(),{cache:t,performance:T,schema:_,validate:d,...e}=E;try{if(t?.enabled){let R=this.checkCache(e.name||"",e);if(R)return R}let h;try{h=await this.loadConfigurationStrategies(e,!0,t)}catch(R){let N=e.__strictErrorHandling;if(R instanceof Error&&R.name==="ConfigNotFoundError"){if(N)throw R;h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:[`No configuration file found for "${e.name||"config"}", using defaults with environment variables`]}}else if(R instanceof Error&&R.name==="ConfigLoadError"){let A=R.message.includes("EACCES")||R.message.includes("EPERM")||R.message.includes("permission denied"),S=!A&&(R.message.includes("syntax")||R.message.includes("Expected")||R.message.includes("Unexpected")||R.message.includes("BuildMessage")||R.message.includes("errors building")),L=R.message.includes("Configuration must export a valid object")||R.message.includes("Configuration file is empty and exports nothing");if(N&&(L||A))throw R;if(S&&(!N||!L))h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:["Configuration file has syntax errors, using defaults with environment variables"]};else if(!N)h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:[`Configuration loading error, using defaults: ${R.message}`]};else throw R}else h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:[`Configuration loading failed, using defaults: ${R instanceof Error?R.message:String(R)}`]}}if(_||d)await this.validateConfiguration(h.config,_,d,e.name);if(t?.enabled&&h)this.cacheResult(e.name||"",h,t,e);if(T?.enabled){let R={operation:"loadConfig",duration:Date.now()-r,configName:e.name,timestamp:new Date};if(T.onMetrics)T.onMetrics(R);if(T.slowThreshold&&R.duration>T.slowThreshold)T_.warn(`Slow configuration loading detected: ${R.duration}ms for ${e.name}`);h.metrics=R}return h}catch(h){let R=Date.now()-r;throw T_.error(`Configuration loading failed after ${R}ms:`,[h instanceof Error?h:Error(String(h))]),h}}async loadConfigurationStrategies(E,r=!1,t){let{name:T="",alias:_,cwd:d,configDir:e,defaultConfig:h,checkEnv:R=!0,arrayStrategy:N="replace",verbose:A=!1}=E,S=d||eh.cwd(),L=[],O=await this.loadLocalConfiguration(T,_,S,e,h,N,A,R,t);if(O)return L.push(...this.getLocalSearchPaths(T,_,S,e)),this.finalizeResult(O,L,R,T,A);let I=await this.loadHomeConfiguration(T,_,h,N,A,R);if(I)return L.push(...this.getHomeSearchPaths(T,_)),this.finalizeResult(I,L,R,T,A);let D=await this.loadPackageJsonConfiguration(T,_,S,h,N,A,R);if(D)return L.push(Vt(S,"package.json")),this.finalizeResult(D,L,R,T,A);if(L.push(...this.getAllSearchPaths(T,_,S,e)),r)throw Le.configNotFound(T,L,_);return{...await this.applyEnvironmentVariables(T,h,R,A),warnings:[`No configuration file found for "${T}"${_?` or alias "${_}"`:""}, using defaults with environment variables`]}}async loadLocalConfiguration(E,r,t,T,_,d,e,h,R){let N=h?gA(E,_,e):_,A=this.getLocalDirectories(t,T);for(let S of A){if(e)T_.info(`Searching for configuration in: ${S}`);let L=this.fileLoader.generateConfigPaths(E,S,r),O=await this.fileLoader.tryLoadFromPaths(L,N,{arrayStrategy:d,verbose:e,cacheTtl:R?.ttl,useCache:!R?.ttl||R.ttl>100});if(O){if(e)T_.success(`Configuration loaded from: ${O.source.path}`);return O}}return null}async loadHomeConfiguration(E,r,t,T,_,d){if(!E)return null;let e=d?gA(E,t,_):t,h=[Vt(GR(),".config",E),Vt(GR(),".config"),GR()];for(let R of h){if(_)T_.info(`Checking home directory: ${R}`);let N=this.fileLoader.generateConfigPaths(E,R,r),A=await this.fileLoader.tryLoadFromPaths(N,e,{arrayStrategy:T,verbose:_});if(A){if(_)T_.success(`Configuration loaded from home directory: ${A.source.path}`);return A}}return null}async loadPackageJsonConfiguration(E,r,t,T,_,d,e){let h=e?gA(E,T,d):T;try{let R=Vt(t,"package.json");if(!xD(R))return null;let N=await import(R),A=N[E],S=E;if(!A&&r)A=N[r],S=r;if(A&&typeof A==="object"&&!Array.isArray(A)){if(d)T_.success(`Configuration loaded from package.json: ${S}`);return{config:_$(h,A,_),source:{type:"package.json",path:R,priority:30,timestamp:new Date}}}}catch(R){if(d)T_.warn("Failed to load package.json:",[R instanceof Error?R:Error(String(R))])}return null}async applyEnvironmentVariables(E,r,t,T){if(!t||!E||typeof r!=="object"||r===null||Array.isArray(r))return{config:r,source:{type:"default",priority:10,timestamp:new Date}};return{config:gA(E,r,T),source:{type:"environment",priority:20,timestamp:new Date}}}async finalizeResult(E,r,t,T,_){return{config:E.config,source:E.source,path:E.source.path}}async validateConfiguration(E,r,t,T){let _=[];if(t){let d=t(E);if(d)_.push(...d)}if(r){let d=await this.validator.validateConfiguration(E,r);if(!d.isValid)_.push(...d.errors.map((e)=>e.path?`${e.path}: ${e.message}`:e.message))}if(_.length>0)throw Le.configValidation(T||"unknown",_,T)}checkCache(E,r){let t=this.generateCacheKey(E,r);return kR.get(t)||null}cacheResult(E,r,t,T){let _=this.generateCacheKey(E,T);kR.set(_,r,void 0,t.ttl)}generateCacheKey(E,r){let t=[E];if(r.alias)t.push(`alias:${r.alias}`);if(r.cwd)t.push(`cwd:${r.cwd}`);if(r.configDir)t.push(`configDir:${r.configDir}`);if("checkEnv"in r)t.push(`checkEnv:${r.checkEnv}`);return t.join("|")}getLocalDirectories(E,r){return Array.from(new Set([E,Vt(E,"config"),Vt(E,".config"),r?Vt(E,r):void 0].filter(Boolean)))}getAllSearchPaths(E,r,t,T){let _=[];return _.push(...this.getLocalSearchPaths(E,r,t,T)),_.push(...this.getHomeSearchPaths(E,r)),_.push(Vt(t,"package.json")),_}getLocalSearchPaths(E,r,t,T){let _=this.getLocalDirectories(t,T),d=[];for(let e of _)d.push(...this.fileLoader.generateConfigPaths(E,e,r));return d}getHomeSearchPaths(E,r){if(!E)return[];let t=[Vt(GR(),".config",E),Vt(GR(),".config"),GR()],T=[];for(let _ of t)T.push(...this.fileLoader.generateConfigPaths(E,_,r));return T}async loadConfigWithResult(E){return this.loadConfig(E)}}function OF(E){let t=!(E.message.includes("EACCES")||E.message.includes("EPERM")||E.message.includes("permission denied"))&&(E.message.includes("syntax")||E.message.includes("Expected")||E.message.includes("Unexpected")||E.message.includes("BuildMessage")),T=E.message.includes("Configuration must export a valid object")||E.message.includes("Configuration file is empty and exports nothing");return t||T}async function Z4(E){return cd.loadConfig({...E,__strictErrorHandling:!0})}async function ZF(E){let r="defaultConfig"in E&&E.defaultConfig!==void 0?E.defaultConfig:{},t="cache"in E||"performance"in E||"schema"in E||"validate"in E;try{let T;if(t)T=await cd.loadConfig(E);else T=await cd.loadConfig({...E,defaultConfig:r,cache:{enabled:!0},performance:{enabled:!1}});return T?.config??r}catch(T){let _=T instanceof Error?T.name:"UnknownError",d=T instanceof Error?T.message:String(T);if(!(_==="ConfigNotFoundError"||_==="ConfigLoadError"||_==="ConfigValidationError"||d.includes("config"))&&E.verbose)T_.warn("Unexpected error loading config, using defaults:",[T instanceof Error?T:Error(String(T))]);let h=t?{...E,defaultConfig:r}:{...E,defaultConfig:r,cache:{enabled:!0},performance:{enabled:!1}};if("checkEnv"in E?E.checkEnv!==!1:!0)return(await cd.applyEnvironmentVariables(h.name||"",r,!0,h.verbose||!1))?.config??r;return r}}async function g4(E={defaultConfig:{}}){if(typeof E==="string"){let{cwd:r}=await import("process");try{return(await cd.loadConfig({name:E,cwd:r(),generatedDir:"./generated",configDir:"./config",defaultConfig:{},checkEnv:!0,arrayStrategy:"replace"})).config}catch(t){if(t instanceof Error&&(t.name==="ConfigNotFoundError"||t.name==="ConfigLoadError"&&OF(t)))return(await cd.applyEnvironmentVariables(E,{},!0,!1)).config;throw t}}try{return(await cd.loadConfig({...E,cwd:E.cwd||eh.cwd(),cache:{enabled:!0},performance:{enabled:!1}})).config}catch(r){if(r instanceof Error&&(r.name==="ConfigNotFoundError"||r.name==="ConfigLoadError"&&OF(r)))return(await cd.applyEnvironmentVariables(E.name||"",E.defaultConfig||{},E.checkEnv!==!1,E.verbose||!1)).config;throw r}}async function q4(E,r,t="replace"){let T=new CO;try{let _=await T.loadFromPath(E,r,{arrayStrategy:t,useCache:!1,trackPerformance:!1});return _?_.config:null}catch{return null}}function gA(E,r,t=!1){let T=new wO,_=E.toUpperCase().replace(/[^A-Z0-9]/g,"_");function d(e,h=[]){let R={...e};for(let[N,A]of Object.entries(e)){let S=[...h,N],L=[`${_}_${S.join("_").toUpperCase()}`,`${_}_${S.map((D)=>D.toUpperCase()).join("")}`,`${_}_${S.map((D)=>D.replace(/([A-Z])/g,"_$1").toUpperCase()).join("")}`],O,I;for(let D of L)if(O=eh.env[D],O!==void 0){I=D;break}if(O!==void 0&&I)if(typeof A==="boolean")R[N]=["true","1","yes"].includes(O.toLowerCase());else if(typeof A==="number"){let D=Number(O);if(!Number.isNaN(D))R[N]=D}else if(Array.isArray(A))try{R[N]=JSON.parse(O)}catch{R[N]=O.split(",").map((D)=>D.trim())}else R[N]=O;else if(A&&typeof A==="object"&&!Array.isArray(A))R[N]=d(A,S)}return R}return d(r)}function x4(E){let r=Vt(eh.cwd(),E.configDir),t=Vt(eh.cwd(),E.generatedDir),T=Vt(t,"config-types.ts");if(!xD(uj(T)))H8(uj(T),{recursive:!0,mode:511});let _=xD(r)?f8(r).map((e)=>e.replace(/\.(ts|js|mjs|cjs|mts|cts|json)$/,"")).sort():[],d=`// Generated by bunfig v${UV}
+`;return t}}function G4(E,r){let t=gF("process");if(typeof t>"u"||!t.env)return r;let T=t.env[E];return T!==void 0?T:r}function VF(E,r,t={}){return PF(E,r,t,new WeakMap)}function PF(E,r,t,T){let{arrayMergeMode:_="replace",skipNullish:d=!1,customMerger:e}=t;if(r===null||r===void 0)return d?E:r;if(e){let h=e(E,r);if(h!==void 0)return h}if(Array.isArray(r)||Array.isArray(E))return KF(E,r,_,T);if(!gT(r)||!gT(E))return r;return K4(E,r,t,T)}function KF(E,r,t,T){if(Array.isArray(r)&&!Array.isArray(E))return r;if(Array.isArray(E)&&!Array.isArray(r))return r;if(Array.isArray(r)&&Array.isArray(E))switch(t){case"replace":return r;case"concat":return M4(E,r);case"smart":return V4(E,r,T);default:return r}return r}function M4(E,r){let t=[...r];for(let T of E)if(!t.some((_)=>kD(_,T)))t.push(T);return t}function V4(E,r,t){if(r.length===0)return E;if(E.length===0)return r;if(gT(r[0])&&gT(E[0]))return P4(E,r,t);if(r.every((T)=>typeof T==="string")&&E.every((T)=>typeof T==="string")){let T=[...r];for(let _ of E)if(!T.includes(_))T.push(_);return T}return r}function P4(E,r,t){let T=[...r];for(let _ of E){if(!gT(_)){T.push(_);continue}let d=["id","name","key","path","type"],e=!1;for(let h of d)if(h in _){if(T.find((N)=>gT(N)&&(h in N)&&N[h]===_[h])){e=!0;break}}if(!e)T.push(_)}return T}function K4(E,r,t,T){let _=r;if(gT(_)&&T.has(_))return T.get(_);let d={...E};if(gT(_))T.set(_,d);for(let e in _){if(!Object.prototype.hasOwnProperty.call(_,e))continue;let h=_[e],R=d[e];if(t.skipNullish&&(h===null||h===void 0))continue;if(h===null||h===void 0){d[e]=h;continue}if(gT(h)&&gT(R))d[e]=PF(R,h,t,T);else if(Array.isArray(h)||Array.isArray(R))d[e]=KF(R,h,t.arrayMergeMode||"smart",T);else d[e]=h}return d}function _$(E,r,t="replace"){return VF(E,r,{arrayMergeMode:t==="replace"?"replace":"smart",skipNullish:!0})}function kD(E,r){if(E===r)return!0;if(Array.isArray(E)&&Array.isArray(r)){if(E.length!==r.length)return!1;for(let t=0;t<E.length;t++)if(!kD(E[t],r[t]))return!1;return!0}if(gT(E)&&gT(r)){let t=Object.keys(E),T=Object.keys(r);if(t.length!==T.length)return!1;for(let _ of t){if(!Object.prototype.hasOwnProperty.call(r,_))return!1;if(!kD(E[_],r[_]))return!1}return!0}return!1}function gT(E){return Boolean(E&&typeof E==="object"&&!Array.isArray(E))}class CO{extensions=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];async loadFromPath(E,r,t={}){let{arrayStrategy:T="replace",useCache:_=!0,cacheTtl:d,trackPerformance:e=!0,verbose:h=!1}=t;if(_){let N=kR.getWithFileCheck("file",E);if(N){if(h)console.log(`Configuration loaded from cache: ${E}`);return N}}let R=async()=>{if(!n0(E))return null;try{let N=`?t=${Date.now()}`,A=await import(E+N),S=A.default||A,L="default"in A,O=Object.keys(A).length>0;if(!L&&!O)throw new xA(E,Error("Configuration file is empty and exports nothing"),"unknown");if(typeof S!=="object"||S===null||Array.isArray(S))throw new xA(E,Error("Configuration must export a valid object"),"unknown");let $={config:_$(r,S,T),source:{type:"file",path:E,priority:100,timestamp:new Date}};if(_)kR.setWithFileCheck("file",$,E,d);return $}catch(N){throw N instanceof Error?Le.configLoad(E,N):Le.configLoad(E,Error(String(N)))}};if(e)return kA.track("loadFromPath",R,{path:E});return R()}async tryLoadFromPaths(E,r,t={}){for(let T of E)try{let _=await this.loadFromPath(T,r,t);if(_)return _}catch(_){if(_ instanceof Error&&_.name==="ConfigLoadError")throw _;if(t.verbose)console.warn(`Failed to load config from ${T}:`,_)}return null}generateConfigPaths(E,r,t){let T=this.generateNamePatterns(E,t),_=[];for(let d of T)for(let e of this.extensions)_.push(HD(r,`${d}${e}`));return _}generateNamePatterns(E,r){let t=[];if(t.push("config",".config"),E)t.push(E,`.${E}.config`,`${E}.config`,`.${E}`);if(r){if(t.push(r,`.${r}.config`,`${r}.config`,`.${r}`),E)t.push(`${E}.${r}.config`,`.${E}.${r}.config`)}return t.filter(Boolean)}checkFileAccess(E){return GF(async()=>{return n0(E)},{maxRetries:2,retryDelay:100,fallback:!1})}async discoverConfigFiles(E,r,t){let T=[];if(!n0(E))return T;if(r||t){let _=this.generateNamePatterns(r||"",t);for(let d of _)for(let e of this.extensions){let h=HD(E,`${d}${e}`);if(await this.checkFileAccess(h))T.push(h)}}else try{let{readdirSync:_}=await import("fs"),d=_(E);for(let e of d)if(this.looksLikeConfigFile(e)){let h=HD(E,e);if(await this.checkFileAccess(h))T.push(h)}}catch{return[]}return T}looksLikeConfigFile(E){return[/\.config\.(ts|js|mjs|cjs|json|mts|cts)$/,/^\..*\.(ts|js|mjs|cjs|json|mts|cts)$/,/config\.(ts|js|mjs|cjs|json|mts|cts)$/].some((t)=>t.test(E))}async validateConfigFile(E){let r=[];try{if(!n0(E))return r.push("Configuration file does not exist"),r;let t=await import(E),T=t.default||t;if(T===void 0)r.push("Configuration file must export a default value or named exports");else if(typeof T!=="object"||T===null)r.push("Configuration must be an object");else if(Array.isArray(T))r.push("Configuration cannot be an array at the root level");if(E.endsWith(".json"))try{let{readFileSync:_}=await import("fs"),d=_(E,"utf8");JSON.parse(d)}catch(_){r.push(`Invalid JSON syntax: ${_}`)}}catch(t){r.push(`Failed to load configuration file: ${t}`)}return r}async getFileModificationTime(E){try{let{statSync:r}=await import("fs");return r(E).mtime}catch{return null}}async preloadConfigurations(E,r={}){let t=new Map;return await Promise.allSettled(E.map(async(T)=>{try{let _=await this.loadFromPath(T,{},r);if(_)t.set(T,_.config)}catch(_){if(r.verbose)console.warn(`Failed to preload ${T}:`,_)}})),t}}class d${async validateConfiguration(E,r,t={}){let{stopOnFirstError:T=!1,validateRequired:_=!0,validateTypes:d=!0,customRules:e=[],trackPerformance:h=!0,verbose:R=!1}=t,N=async()=>{let A=[],S=[],L={stopOnFirstError:T,validateRequired:_,validateTypes:d,customRules:e,trackPerformance:h,verbose:R};try{if(typeof r==="string")return await this.validateWithSchemaFile(E,r,L);else if(Array.isArray(r))return this.validateWithRules(E,[...r,...e],L);else return this.validateWithJSONSchema(E,r,L)}catch(O){return A.push({path:"",message:`Validation failed: ${O}`,rule:"system"}),{isValid:!1,errors:A,warnings:S}}};if(h)return await kA.track("validateConfiguration",N);return N()}async validateWithSchemaFile(E,r,t){try{if(!pM(r))throw new bA(r,[{path:"",message:"Schema file does not exist"}]);let T=await import(r),_=T.default||T;if(Array.isArray(_))return this.validateWithRules(E,_,t);else return this.validateWithJSONSchema(E,_,t)}catch(T){throw new bA(r,[{path:"",message:`Failed to load schema: ${T}`}])}}validateWithJSONSchema(E,r,t){let T=[],_=[];return this.validateObjectAgainstSchema(E,r,"",T,_,t),{isValid:T.length===0,errors:T,warnings:_}}validateObjectAgainstSchema(E,r,t,T,_,d){if(d.validateTypes&&r.type){let e=Array.isArray(E)?"array":typeof E,h=Array.isArray(r.type)?r.type:[r.type];if(!h.includes(e)){if(T.push({path:t,message:`Expected type ${h.join(" or ")}, got ${e}`,expected:h.join(" or "),actual:e,rule:"type"}),d.stopOnFirstError)return}}if(r.enum&&!r.enum.includes(E)){if(T.push({path:t,message:`Value must be one of: ${r.enum.join(", ")}`,expected:r.enum.join(", "),actual:E,rule:"enum"}),d.stopOnFirstError)return}if(typeof E==="string"){if(r.minLength!==void 0&&E.length<r.minLength)T.push({path:t,message:`String length must be at least ${r.minLength}`,expected:`>= ${r.minLength}`,actual:E.length,rule:"minLength"});if(r.maxLength!==void 0&&E.length>r.maxLength)T.push({path:t,message:`String length must not exceed ${r.maxLength}`,expected:`<= ${r.maxLength}`,actual:E.length,rule:"maxLength"});if(r.pattern){if(!new RegExp(r.pattern).test(E))T.push({path:t,message:`String does not match pattern ${r.pattern}`,expected:r.pattern,actual:E,rule:"pattern"})}}if(typeof E==="number"){if(r.minimum!==void 0&&E<r.minimum)T.push({path:t,message:`Value must be at least ${r.minimum}`,expected:`>= ${r.minimum}`,actual:E,rule:"minimum"});if(r.maximum!==void 0&&E>r.maximum)T.push({path:t,message:`Value must not exceed ${r.maximum}`,expected:`<= ${r.maximum}`,actual:E,rule:"maximum"})}if(Array.isArray(E)&&r.items)for(let e=0;e<E.length;e++){let h=t?`${t}[${e}]`:`[${e}]`;if(this.validateObjectAgainstSchema(E[e],r.items,h,T,_,d),d.stopOnFirstError&&T.length>0)return}if(E&&typeof E==="object"&&!Array.isArray(E)){let e=E;if(d.validateRequired&&r.required){for(let h of r.required)if(!(h in e)){if(T.push({path:t?`${t}.${h}`:h,message:`Missing required property '${h}'`,expected:"required",rule:"required"}),d.stopOnFirstError)return}}if(r.properties){for(let[h,R]of Object.entries(r.properties))if(h in e){let N=t?`${t}.${h}`:h;if(this.validateObjectAgainstSchema(e[h],R,N,T,_,d),d.stopOnFirstError&&T.length>0)return}}if(r.additionalProperties===!1){let h=new Set(Object.keys(r.properties||{}));for(let R of Object.keys(e))if(!h.has(R))_.push({path:t?`${t}.${R}`:R,message:`Additional property '${R}' is not allowed`,rule:"additionalProperties"})}}}validateWithRules(E,r,t){let T=[],_=[];for(let d of r)try{let e=this.getValueByPath(E,d.path),h=this.validateWithRule(e,d,d.path);if(T.push(...h),t.stopOnFirstError&&T.length>0)break}catch(e){T.push({path:d.path,message:`Rule validation failed: ${e}`,rule:"system"})}return{isValid:T.length===0,errors:T,warnings:_}}validateWithRule(E,r,t){let T=[];if(r.required&&(E===void 0||E===null))return T.push({path:t,message:r.message||`Property '${t}' is required`,expected:"required",rule:"required"}),T;if(E===void 0||E===null)return T;if(r.type){let _=Array.isArray(E)?"array":typeof E;if(_!==r.type)T.push({path:t,message:r.message||`Expected type ${r.type}, got ${_}`,expected:r.type,actual:_,rule:"type"})}if(r.min!==void 0){let _=Array.isArray(E)?E.length:typeof E==="string"?E.length:typeof E==="number"?E:0;if(_<r.min)T.push({path:t,message:r.message||`Value must be at least ${r.min}`,expected:`>= ${r.min}`,actual:_,rule:"min"})}if(r.max!==void 0){let _=Array.isArray(E)?E.length:typeof E==="string"?E.length:typeof E==="number"?E:0;if(_>r.max)T.push({path:t,message:r.message||`Value must not exceed ${r.max}`,expected:`<= ${r.max}`,actual:_,rule:"max"})}if(r.pattern&&typeof E==="string"){if(!r.pattern.test(E))T.push({path:t,message:r.message||`Value does not match pattern ${r.pattern}`,expected:r.pattern.toString(),actual:E,rule:"pattern"})}if(r.enum&&!r.enum.includes(E))T.push({path:t,message:r.message||`Value must be one of: ${r.enum.join(", ")}`,expected:r.enum.join(", "),actual:E,rule:"enum"});if(r.validator){let _=r.validator(E);if(_)T.push({path:t,message:r.message||_,rule:"custom"})}return T}getValueByPath(E,r){if(!r)return E;let t=r.split("."),T=E;for(let _ of t)if(T&&typeof T==="object"&&_ in T)T=T[_];else return;return T}generateRulesFromInterface(E){let r=[],t=E.matchAll(/(\w+)(\?)?:\s*(\w+)/g);for(let T of t){let[,_,d,e]=T;r.push({path:_,required:!d,type:this.mapTypeScriptType(e)})}return r}mapTypeScriptType(E){switch(E.toLowerCase()){case"string":return"string";case"number":return"number";case"boolean":return"boolean";case"array":return"array";case"object":return"object";default:return"object"}}static createCommonRules(){return{server:[{path:"port",required:!0,type:"number",min:1,max:65535},{path:"host",required:!0,type:"string",min:1},{path:"ssl",type:"boolean"}],database:[{path:"url",required:!0,type:"string",min:1},{path:"pool",type:"number",min:1,max:100},{path:"timeout",type:"number",min:0}],api:[{path:"baseUrl",required:!0,type:"string",pattern:uF},{path:"timeout",type:"number",min:0},{path:"retries",type:"number",min:0,max:10}]}}}class e${fileLoader=new CO;envProcessor=new wO;validator=new d$;async loadConfig(E){let r=Date.now(),{cache:t,performance:T,schema:_,validate:d,...e}=E;try{if(t?.enabled){let R=this.checkCache(e.name||"",e);if(R)return R}let h;try{h=await this.loadConfigurationStrategies(e,!0,t)}catch(R){let N=e.__strictErrorHandling;if(R instanceof Error&&R.name==="ConfigNotFoundError"){if(N)throw R;h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:[`No configuration file found for "${e.name||"config"}", using defaults with environment variables`]}}else if(R instanceof Error&&R.name==="ConfigLoadError"){let A=R.message.includes("EACCES")||R.message.includes("EPERM")||R.message.includes("permission denied"),S=!A&&(R.message.includes("syntax")||R.message.includes("Expected")||R.message.includes("Unexpected")||R.message.includes("BuildMessage")||R.message.includes("errors building")),L=R.message.includes("Configuration must export a valid object")||R.message.includes("Configuration file is empty and exports nothing");if(N&&(L||A))throw R;if(S&&(!N||!L))h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:["Configuration file has syntax errors, using defaults with environment variables"]};else if(!N)h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:[`Configuration loading error, using defaults: ${R.message}`]};else throw R}else h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:[`Configuration loading failed, using defaults: ${R instanceof Error?R.message:String(R)}`]}}if(_||d)await this.validateConfiguration(h.config,_,d,e.name);if(t?.enabled&&h)this.cacheResult(e.name||"",h,t,e);if(T?.enabled){let R={operation:"loadConfig",duration:Date.now()-r,configName:e.name,timestamp:new Date};if(T.onMetrics)T.onMetrics(R);if(T.slowThreshold&&R.duration>T.slowThreshold)T_.warn(`Slow configuration loading detected: ${R.duration}ms for ${e.name}`);h.metrics=R}return h}catch(h){let R=Date.now()-r;throw T_.error(`Configuration loading failed after ${R}ms:`,[h instanceof Error?h:Error(String(h))]),h}}async loadConfigurationStrategies(E,r=!1,t){let{name:T="",alias:_,cwd:d,configDir:e,defaultConfig:h,checkEnv:R=!0,arrayStrategy:N="replace",verbose:A=!1}=E,S=d||eh.cwd(),L=[],O=await this.loadLocalConfiguration(T,_,S,e,h,N,A,R,t);if(O)return L.push(...this.getLocalSearchPaths(T,_,S,e)),this.finalizeResult(O,L,R,T,A);let I=await this.loadHomeConfiguration(T,_,h,N,A,R);if(I)return L.push(...this.getHomeSearchPaths(T,_)),this.finalizeResult(I,L,R,T,A);let D=await this.loadPackageJsonConfiguration(T,_,S,h,N,A,R);if(D)return L.push(Vt(S,"package.json")),this.finalizeResult(D,L,R,T,A);if(L.push(...this.getAllSearchPaths(T,_,S,e)),r)throw Le.configNotFound(T,L,_);return{...await this.applyEnvironmentVariables(T,h,R,A),warnings:[`No configuration file found for "${T}"${_?` or alias "${_}"`:""}, using defaults with environment variables`]}}async loadLocalConfiguration(E,r,t,T,_,d,e,h,R){let N=h?gA(E,_,e):_,A=this.getLocalDirectories(t,T);for(let S of A){if(e)T_.info(`Searching for configuration in: ${S}`);let L=this.fileLoader.generateConfigPaths(E,S,r),O=await this.fileLoader.tryLoadFromPaths(L,N,{arrayStrategy:d,verbose:e,cacheTtl:R?.ttl,useCache:!R?.ttl||R.ttl>100});if(O){if(e)T_.success(`Configuration loaded from: ${O.source.path}`);return O}}return null}async loadHomeConfiguration(E,r,t,T,_,d){if(!E)return null;let e=d?gA(E,t,_):t,h=[Vt(GR(),".config",E),Vt(GR(),".config"),GR()];for(let R of h){if(_)T_.info(`Checking home directory: ${R}`);let N=this.fileLoader.generateConfigPaths(E,R,r),A=await this.fileLoader.tryLoadFromPaths(N,e,{arrayStrategy:T,verbose:_});if(A){if(_)T_.success(`Configuration loaded from home directory: ${A.source.path}`);return A}}return null}async loadPackageJsonConfiguration(E,r,t,T,_,d,e){let h=e?gA(E,T,d):T;try{let R=Vt(t,"package.json");if(!xD(R))return null;let N=await import(R),A=N[E],S=E;if(!A&&r)A=N[r],S=r;if(A&&typeof A==="object"&&!Array.isArray(A)){if(d)T_.success(`Configuration loaded from package.json: ${S}`);return{config:_$(h,A,_),source:{type:"package.json",path:R,priority:30,timestamp:new Date}}}}catch(R){if(d)T_.warn("Failed to load package.json:",[R instanceof Error?R:Error(String(R))])}return null}async applyEnvironmentVariables(E,r,t,T){if(!t||!E||typeof r!=="object"||r===null||Array.isArray(r))return{config:r,source:{type:"default",priority:10,timestamp:new Date}};return{config:gA(E,r,T),source:{type:"environment",priority:20,timestamp:new Date}}}async finalizeResult(E,r,t,T,_){return{config:E.config,source:E.source,path:E.source.path}}async validateConfiguration(E,r,t,T){let _=[];if(t){let d=t(E);if(d)_.push(...d)}if(r){let d=await this.validator.validateConfiguration(E,r);if(!d.isValid)_.push(...d.errors.map((e)=>e.path?`${e.path}: ${e.message}`:e.message))}if(_.length>0)throw Le.configValidation(T||"unknown",_,T)}checkCache(E,r){let t=this.generateCacheKey(E,r);return kR.get(t)||null}cacheResult(E,r,t,T){let _=this.generateCacheKey(E,T);kR.set(_,r,void 0,t.ttl)}generateCacheKey(E,r){let t=[E];if(r.alias)t.push(`alias:${r.alias}`);if(r.cwd)t.push(`cwd:${r.cwd}`);if(r.configDir)t.push(`configDir:${r.configDir}`);if("checkEnv"in r)t.push(`checkEnv:${r.checkEnv}`);return t.join("|")}getLocalDirectories(E,r){return Array.from(new Set([E,Vt(E,"config"),Vt(E,".config"),r?Vt(E,r):void 0].filter(Boolean)))}getAllSearchPaths(E,r,t,T){let _=[];return _.push(...this.getLocalSearchPaths(E,r,t,T)),_.push(...this.getHomeSearchPaths(E,r)),_.push(Vt(t,"package.json")),_}getLocalSearchPaths(E,r,t,T){let _=this.getLocalDirectories(t,T),d=[];for(let e of _)d.push(...this.fileLoader.generateConfigPaths(E,e,r));return d}getHomeSearchPaths(E,r){if(!E)return[];let t=[Vt(GR(),".config",E),Vt(GR(),".config"),GR()],T=[];for(let _ of t)T.push(...this.fileLoader.generateConfigPaths(E,_,r));return T}async loadConfigWithResult(E){return this.loadConfig(E)}}function OF(E){let t=!(E.message.includes("EACCES")||E.message.includes("EPERM")||E.message.includes("permission denied"))&&(E.message.includes("syntax")||E.message.includes("Expected")||E.message.includes("Unexpected")||E.message.includes("BuildMessage")),T=E.message.includes("Configuration must export a valid object")||E.message.includes("Configuration file is empty and exports nothing");return t||T}async function Z4(E){return cd.loadConfig({...E,__strictErrorHandling:!0})}async function ZF(E){let r="defaultConfig"in E&&E.defaultConfig!==void 0?E.defaultConfig:{},t="cache"in E||"performance"in E||"schema"in E||"validate"in E;try{let T;if(t)T=await cd.loadConfig(E);else T=await cd.loadConfig({...E,defaultConfig:r,cache:{enabled:!0},performance:{enabled:!1}});return T?.config??r}catch(T){let _=T instanceof Error?T.name:"UnknownError",d=T instanceof Error?T.message:String(T);if(!(_==="ConfigNotFoundError"||_==="ConfigLoadError"||_==="ConfigValidationError"||d.includes("config"))&&E.verbose)T_.warn("Unexpected error loading config, using defaults:",[T instanceof Error?T:Error(String(T))]);let h=t?{...E,defaultConfig:r}:{...E,defaultConfig:r,cache:{enabled:!0},performance:{enabled:!1}};if("checkEnv"in E?E.checkEnv!==!1:!0)return(await cd.applyEnvironmentVariables(h.name||"",r,!0,h.verbose||!1))?.config??r;return r}}async function g4(E={defaultConfig:{}}){if(typeof E==="string"){let{cwd:r}=await import("process");try{return(await cd.loadConfig({name:E,cwd:r(),generatedDir:"./generated",configDir:"./config",defaultConfig:{},checkEnv:!0,arrayStrategy:"replace"})).config}catch(t){if(t instanceof Error&&(t.name==="ConfigNotFoundError"||t.name==="ConfigLoadError"&&OF(t)))return(await cd.applyEnvironmentVariables(E,{},!0,!1)).config;throw t}}try{return(await cd.loadConfig({...E,cwd:E.cwd||eh.cwd(),cache:{enabled:!0},performance:{enabled:!1}})).config}catch(r){if(r instanceof Error&&(r.name==="ConfigNotFoundError"||r.name==="ConfigLoadError"&&OF(r)))return(await cd.applyEnvironmentVariables(E.name||"",E.defaultConfig||{},E.checkEnv!==!1,E.verbose||!1)).config;throw r}}async function q4(E,r,t="replace"){let T=new CO;try{let _=await T.loadFromPath(E,r,{arrayStrategy:t,useCache:!1,trackPerformance:!1});return _?_.config:null}catch{return null}}function gA(E,r,t=!1){let T=new wO,_=E.toUpperCase().replace(/[^A-Z0-9]/g,"_");function d(e,h=[]){let R={...e};for(let[N,A]of Object.entries(e)){let S=[...h,N],L=[`${_}_${S.join("_").toUpperCase()}`,`${_}_${S.map((D)=>D.toUpperCase()).join("")}`,`${_}_${S.map((D)=>D.replace(/([A-Z])/g,"_$1").toUpperCase()).join("")}`],O,I;for(let D of L)if(O=eh.env[D],O!==void 0){I=D;break}if(O!==void 0&&I)if(typeof A==="boolean")R[N]=["true","1","yes"].includes(O.toLowerCase());else if(typeof A==="number"){let D=Number(O);if(!Number.isNaN(D))R[N]=D}else if(Array.isArray(A))try{R[N]=JSON.parse(O)}catch{R[N]=O.split(",").map((D)=>D.trim())}else R[N]=O;else if(A&&typeof A==="object"&&!Array.isArray(A))R[N]=d(A,S)}return R}return d(r)}function x4(E){let r=Vt(eh.cwd(),E.configDir),t=Vt(eh.cwd(),E.generatedDir),T=Vt(t,"config-types.ts");if(!xD(uj(T)))HM(uj(T),{recursive:!0,mode:511});let _=xD(r)?fM(r).map((e)=>e.replace(/\.(ts|js|mjs|cjs|mts|cts|json)$/,"")).sort():[],d=`// Generated by bunfig v${UV}
 export type ConfigNames = ${_.length?`'${_.join("' | '")}'`:"string"}
-`;Y8(T,d,{mode:438})}function b4(E){let r=null,t=null,T=()=>{if(!t)t=ZF(E).then((d)=>{return r=d,d},(d)=>{let e="defaultConfig"in E?E.defaultConfig:{};if(r=e,"verbose"in E&&E.verbose)T_.warn("Config loading failed, using defaults:",[d instanceof Error?d:Error(String(d))]);return e});return t},_="defaultConfig"in E?E.defaultConfig:{};return r=_,T(),new Proxy({},{get(d,e){if(r)return r[e];let h=_[e];return T(),h},has(d,e){return e in(r||_)},ownKeys(){return Object.keys(r||_)},getOwnPropertyDescriptor(d,e){return Object.getOwnPropertyDescriptor(r||_,e)},set(d,e,h){if(!r)r={..._};return r[e]=h,!0}})}function k4(E){let r=dF(r4.cwd(),E?.configDir||"./config");function t(){if(!o8(r))return[];let _=new Set([".ts",".js",".mjs",".cjs",".mts",".cts",".json"]),d=[".ts",".mts",".cts",".js",".mjs",".cjs",".json"],e=E4(r).filter((R)=>_.has(fD(R))).map((R)=>({base:R.replace(/\.(?:ts|js|mjs|cjs|mts|cts|json)$/i,""),file:R})),h=new Map;for(let{base:R,file:N}of e){let A=fD(N).toLowerCase(),S=h.get(R);if(!S){h.set(R,N);continue}let L=fD(S).toLowerCase();if(d.indexOf(A)<d.indexOf(L))h.set(R,N)}return Array.from(h.entries()).map(([R,N])=>({base:R,file:N})).sort((R,N)=>R.base.localeCompare(N.base))}function T(){let _=t(),d=_.map((N)=>N.base),e=d.length?d.map((N)=>`'${N}'`).join(" | "):"string",h=_.length?`{
+`;YM(T,d,{mode:438})}function b4(E){let r=null,t=null,T=()=>{if(!t)t=ZF(E).then((d)=>{return r=d,d},(d)=>{let e="defaultConfig"in E?E.defaultConfig:{};if(r=e,"verbose"in E&&E.verbose)T_.warn("Config loading failed, using defaults:",[d instanceof Error?d:Error(String(d))]);return e});return t},_="defaultConfig"in E?E.defaultConfig:{};return r=_,T(),new Proxy({},{get(d,e){if(r)return r[e];let h=_[e];return T(),h},has(d,e){return e in(r||_)},ownKeys(){return Object.keys(r||_)},getOwnPropertyDescriptor(d,e){return Object.getOwnPropertyDescriptor(r||_,e)},set(d,e,h){if(!r)r={..._};return r[e]=h,!0}})}function k4(E){let r=dF(r4.cwd(),E?.configDir||"./config");function t(){if(!oM(r))return[];let _=new Set([".ts",".js",".mjs",".cjs",".mts",".cts",".json"]),d=[".ts",".mts",".cts",".js",".mjs",".cjs",".json"],e=E4(r).filter((R)=>_.has(fD(R))).map((R)=>({base:R.replace(/\.(?:ts|js|mjs|cjs|mts|cts|json)$/i,""),file:R})),h=new Map;for(let{base:R,file:N}of e){let A=fD(N).toLowerCase(),S=h.get(R);if(!S){h.set(R,N);continue}let L=fD(S).toLowerCase();if(d.indexOf(A)<d.indexOf(L))h.set(R,N)}return Array.from(h.entries()).map(([R,N])=>({base:R,file:N})).sort((R,N)=>R.base.localeCompare(N.base))}function T(){let _=t(),d=_.map((N)=>N.base),e=d.length?d.map((N)=>`'${N}'`).join(" | "):"string",h=_.length?`{
 ${_.map((N)=>{let A=dF(r,N.file).replace(/\\/g,"/");return`  '${N.base}': typeof import('${A}').default`}).join(`,
 `)}
 }`:"Record<string, any>";return`export type ConfigNames = ${e}
 export type ConfigByName = ${h}
 export type Config<N extends ConfigNames> = N extends keyof ConfigByName ? ConfigByName[N] : unknown
 export type ConfigOf = Config
-`}return{name:"bunfig-plugin",setup(_){_.onResolve({filter:/^virtual:bunfig-types$/},(d)=>{return{path:d.path,namespace:"bunfig-virtual"}}),_.onLoad({filter:/^virtual:bunfig-types$/,namespace:"bunfig-virtual"},()=>{return{contents:T(),loader:"ts"}})}}}var gF,kR,kA,qF,u4,n4,cF,EO,uD,Ut,Jr,v4,IF,l4,UF,i4,a4,MD,m4,DF,$F,VD,s4,p4,o4,EV,rO,xF,rV,Dt,tV,TV,wF,tO,nD,lr,er,_V,CF,dV,XF,eV,hV,PD,RV,JF,yF,NV,KD,AV,SV,LV,OV,cV,TO,bF,IV,UV="0.15.6",UT,OO,xA,vD,lD,cO,iD,aD,bA,mD,sD,Le,kF,uF,T_,cd,nF,vF,DV=D4(async()=>{gF=import.meta.require,kR=new E$,kA=new r$,qF={createKey:$4,isEquivalent:w4,estimateMemoryUsage:C4},u4=hO(bD.cwd(),"config"),n4=hO(bD.cwd(),"src/generated"),cF=eO.env.CLARITY_LOG_DIR||M8(y4(),"logs"),EO={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:cF,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1},uD=await j4(),Ut={red:(E)=>`\x1B[31m${E}\x1B[0m`,green:(E)=>`\x1B[32m${E}\x1B[0m`,yellow:(E)=>`\x1B[33m${E}\x1B[0m`,blue:(E)=>`\x1B[34m${E}\x1B[0m`,magenta:(E)=>`\x1B[35m${E}\x1B[0m`,cyan:(E)=>`\x1B[36m${E}\x1B[0m`,white:(E)=>`\x1B[37m${E}\x1B[0m`,gray:(E)=>`\x1B[90m${E}\x1B[0m`,bgRed:(E)=>`\x1B[41m${E}\x1B[0m`,bgYellow:(E)=>`\x1B[43m${E}\x1B[0m`,bold:(E)=>`\x1B[1m${E}\x1B[0m`,dim:(E)=>`\x1B[2m${E}\x1B[0m`,italic:(E)=>`\x1B[3m${E}\x1B[0m`,underline:(E)=>`\x1B[4m${E}\x1B[0m`,reset:"\x1B[0m"},Jr=Ut,v4=Ut.red,IF=Ut.green,l4=Ut.yellow,UF=Ut.blue,i4=Ut.magenta,a4=Ut.cyan,MD=Ut.white,m4=Ut.gray,DF=Ut.bgRed,$F=Ut.bgYellow,VD=Ut.bold,s4=Ut.dim,p4=Ut.italic,o4=Ut.underline,EV=Ut.reset,rO={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},xF={debug:"\uD83D\uDD0D",info:UF("ℹ"),success:IF("✓"),warning:$F(MD(VD(" WARN "))),error:DF(MD(VD(" ERROR ")))},rV=new AO("stacks"),Dt=new AO("bunfig",{showTags:!0}),tV=Mt(qA.cwd(),"config"),TV=Mt(qA.cwd(),"src/generated"),wF=dO.env.CLARITY_LOG_DIR||Q8(W4(),"logs"),tO={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:wF,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},nD=await H4(),lr={red:(E)=>`\x1B[31m${E}\x1B[0m`,green:(E)=>`\x1B[32m${E}\x1B[0m`,yellow:(E)=>`\x1B[33m${E}\x1B[0m`,blue:(E)=>`\x1B[34m${E}\x1B[0m`,magenta:(E)=>`\x1B[35m${E}\x1B[0m`,cyan:(E)=>`\x1B[36m${E}\x1B[0m`,white:(E)=>`\x1B[37m${E}\x1B[0m`,gray:(E)=>`\x1B[90m${E}\x1B[0m`,bgRed:(E)=>`\x1B[41m${E}\x1B[0m`,bgYellow:(E)=>`\x1B[43m${E}\x1B[0m`,bgGray:(E)=>`\x1B[100m${E}\x1B[0m`,bold:(E)=>`\x1B[1m${E}\x1B[0m`,dim:(E)=>`\x1B[2m${E}\x1B[0m`,italic:(E)=>`\x1B[3m${E}\x1B[0m`,underline:(E)=>`\x1B[4m${E}\x1B[0m`,strikethrough:(E)=>`\x1B[9m${E}\x1B[0m`,reset:"\x1B[0m"},er=lr,_V=lr.red,CF=lr.green,dV=lr.yellow,XF=lr.blue,eV=lr.magenta,hV=lr.cyan,PD=lr.white,RV=lr.gray,JF=lr.bgRed,yF=lr.bgYellow,NV=lr.bgGray,KD=lr.bold,AV=lr.dim,SV=lr.italic,LV=lr.underline,OV=lr.strikethrough,cV=lr.reset,TO={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},bF={debug:"\uD83D\uDD0D",info:XF("ℹ"),success:CF("✓"),warning:yF(PD(KD(" WARN "))),error:JF(PD(KD(" ERROR ")))},IV=new LO("stacks"),UT=class extends Error{timestamp;context;constructor(r,t={}){super(r);if(this.name=this.constructor.name,this.timestamp=new Date,this.context=t,Error.captureStackTrace)Error.captureStackTrace(this,this.constructor)}toJSON(){return{name:this.name,code:this.code,message:this.message,timestamp:this.timestamp.toISOString(),context:this.context,stack:this.stack}}toString(){let r=Object.keys(this.context).length>0?` (${Object.entries(this.context).map(([t,T])=>`${t}: ${T}`).join(", ")})`:"";return`${this.name} [${this.code}]: ${this.message}${r}`}},OO=class extends UT{code="CONFIG_NOT_FOUND";constructor(r,t,T){let _=T?` or alias "${T}"`:"";super(`Configuration "${r}"${_} not found`,{configName:r,alias:T,searchPaths:t,searchPathCount:t.length})}},xA=class extends UT{code="CONFIG_LOAD_ERROR";constructor(r,t,T){super(`Failed to load configuration from "${r}": ${t.message}`,{configPath:r,configName:T,originalError:t.name,originalMessage:t.message});this.cause=t}},vD=class extends UT{code="CONFIG_VALIDATION_ERROR";constructor(r,t,T){super(`Configuration validation failed for "${r}"`,{configPath:r,configName:T,validationErrors:t,errorCount:t.length})}},lD=class extends UT{code="CONFIG_MERGE_ERROR";constructor(r,t,T,_){super(`Failed to merge configuration from "${r}" with "${t}": ${T.message}`,{sourcePath:r,targetPath:t,configName:_,originalError:T.name,originalMessage:T.message});this.cause=T}},cO=class extends UT{code="ENV_VAR_ERROR";constructor(r,t,T,_){super(`Failed to parse environment variable "${r}" with value "${t}" as ${T}`,{envKey:r,envValue:t,expectedType:T,configName:_})}},iD=class extends UT{code="FILE_SYSTEM_ERROR";constructor(r,t,T){super(`File system ${r} failed for "${t}": ${T.message}`,{operation:r,path:t,originalError:T.name,originalMessage:T.message});this.cause=T}},aD=class extends UT{code="TYPE_GENERATION_ERROR";constructor(r,t,T){super(`Failed to generate types from "${r}" to "${t}": ${T.message}`,{configDir:r,outputPath:t,originalError:T.name,originalMessage:T.message});this.cause=T}},bA=class extends UT{code="SCHEMA_VALIDATION_ERROR";constructor(r,t,T){super(`Schema validation failed${T?` for config "${T}"`:""}`,{schemaPath:r,configName:T,validationErrors:t,errorCount:t.length})}},mD=class extends UT{code="BROWSER_CONFIG_ERROR";constructor(r,t,T,_){super(`Failed to fetch configuration from "${r}": ${t} ${T}`,{endpoint:r,status:t,statusText:T,configName:_})}},sD=class extends UT{code="PLUGIN_ERROR";constructor(r,t,T){super(`Plugin "${r}" failed during ${t}: ${T.message}`,{pluginName:r,operation:t,originalError:T.name,originalMessage:T.message});this.cause=T}},Le={configNotFound(E,r,t){return new OO(E,r,t)},configLoad(E,r,t){return new xA(E,r,t)},configValidation(E,r,t){return new vD(E,r,t)},configMerge(E,r,t,T){return new lD(E,r,t,T)},envVar(E,r,t,T){return new cO(E,r,t,T)},fileSystem(E,r,t){return new iD(E,r,t)},typeGeneration(E,r,t){return new aD(E,r,t)},schemaValidation(E,r,t){return new bA(E,r,t)},browserConfig(E,r,t,T){return new mD(E,r,t,T)},plugin(E,r,t){return new sD(E,r,t)}},kF={replace:"replace",concat:"concat",smart:"smart"},uF=/^https?:\/\//,T_=new LO("bunfig",{showTags:!0}),cd=new e$,nF=Vt(eh.cwd(),"config"),vF=Vt(eh.cwd(),"src/generated")});function $V(E,r={}){let t=RO.cwd();while(t.includes("storage"))t=eF(t,"..");let T=eF(t,E||"");if(r?.relative)return T4(RO.cwd(),T);return T}var wV=RO.env.CLARITY_LOG_DIR||t4($V(),"logs"),lF={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:wV,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},IO={...lF},pEE=(async()=>{try{let{loadConfig:E}=await DV().then(()=>fF),r=await E({name:"clarity",alias:"logging",defaultConfig:lF,cwd:RO.cwd()});if(r)Object.assign(IO,r)}catch{}return IO})();function ir(){if(Od.env.NODE_ENV==="test"||Od.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function CV(){if(Od.env.NODE_ENV==="test"||Od.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof Od<"u"){let E=Od.type;if(E==="renderer"||E==="worker")return!1;return!!(Od.versions&&(Od.versions.node||Od.versions.bun))}return!1}class iF{async format(E){let r=await CV(),t=await this.getMetadata(r);return JSON.stringify({timestamp:E.timestamp.toISOString(),level:E.level,name:E.name,message:E.message,metadata:t})}async getMetadata(E){if(E){let{hostname:r}=await import("os");return{pid:bR.pid,hostname:r(),environment:bR.env.NODE_ENV||"development",platform:bR.platform,version:bR.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:bR.env.NODE_ENV||bR.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}var _t={red:(E)=>`\x1B[31m${E}\x1B[0m`,green:(E)=>`\x1B[32m${E}\x1B[0m`,yellow:(E)=>`\x1B[33m${E}\x1B[0m`,blue:(E)=>`\x1B[34m${E}\x1B[0m`,magenta:(E)=>`\x1B[35m${E}\x1B[0m`,cyan:(E)=>`\x1B[36m${E}\x1B[0m`,white:(E)=>`\x1B[37m${E}\x1B[0m`,gray:(E)=>`\x1B[90m${E}\x1B[0m`,bgRed:(E)=>`\x1B[41m${E}\x1B[0m`,bgYellow:(E)=>`\x1B[43m${E}\x1B[0m`,bgGray:(E)=>`\x1B[100m${E}\x1B[0m`,bold:(E)=>`\x1B[1m${E}\x1B[0m`,dim:(E)=>`\x1B[2m${E}\x1B[0m`,italic:(E)=>`\x1B[3m${E}\x1B[0m`,underline:(E)=>`\x1B[4m${E}\x1B[0m`,strikethrough:(E)=>`\x1B[9m${E}\x1B[0m`,reset:"\x1B[0m"},hr=_t,oEE=_t.red,XV=_t.green,ErE=_t.yellow,JV=_t.blue,rrE=_t.magenta,trE=_t.cyan,jF=_t.white,TrE=_t.gray,yV=_t.bgRed,jV=_t.bgYellow,_rE=_t.bgGray,FF=_t.bold,drE=_t.dim,erE=_t.italic,hrE=_t.underline,RrE=_t.strikethrough,NrE=_t.reset,ZD={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},FV={debug:"\uD83D\uDD0D",info:JV("ℹ"),success:XV("✓"),warning:jV(jF(FF(" WARN "))),error:yV(jF(FF(" ERROR ")))};class XO{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(E,r={}){this.name=E,this.config={...IO},this.options=this.normalizeOptions(r),this.formatter=this.options.formatter||new iF,this.enabled=r.enabled??!0,this.fancy=r.fancy??!0,this.tagFormat=r.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=r.timestampPosition??"right",this.environment=r.environment??_r.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(r);let t={...r},T=r.timestamp!==void 0;if(T)delete t.timestamp;if(this.config={...this.config,...t,timestamp:T||this.config.timestamp,level:this.options.level??"info"},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let _=this.generateKeyId(),d=this.generateKey();this.currentKeyId=_,this.keys.set(_,d),this.encryptionKeys.set(_,{key:d,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(E){if(!this.fingersCrossedConfig)return!1;let r={debug:0,info:1,success:2,warning:3,error:4},t=this.fingersCrossedConfig.activationLevel??"error";return r[E]>=r[t]}initializeFingersCrossedConfig(E){if(!E.fingersCrossedEnabled&&E.fingersCrossed)return{...ZD,...E.fingersCrossed};if(!E.fingersCrossedEnabled)return null;if(!E.fingersCrossed)return{...ZD};return{...ZD,...E.fingersCrossed}}normalizeOptions(E){let r={format:"json",level:"info",logDirectory:IO.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},t={...r,...Object.fromEntries(Object.entries(E).filter(([,T])=>T!==void 0))};if(!t.level||!["debug","info","success","warning","error"].includes(t.level))t.level=r.level;return t}shouldWriteToFile(){return!ir()&&this.config.writeToFile===!0}async writeToFile(E){let t=(async()=>{let _,d=0,e=3,h=1000;while(d<e)try{try{try{await R4(this.config.logDirectory,AF.F_OK|AF.W_OK)}catch(N){if(N instanceof Error&&"code"in N)if(N.code==="ENOENT")await N4(this.config.logDirectory,{recursive:!0,mode:493});else if(N.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw N;else throw N}}catch(N){throw console.error("Debug: [writeToFile] Failed to create log directory:",N),N}let R=this.validateEncryptionConfig()?(await this.encrypt(E)).encrypted:Ad.from(E);try{if(!v0(this.currentLogFile))await GD(this.currentLogFile,"",{mode:420});if(_=NF(this.currentLogFile,"a",420),h4(_,R,{flag:"a"}),RF(_),_!==void 0)QD(_),_=void 0;if((await qR(this.currentLogFile)).size===0){if(await GD(this.currentLogFile,R,{flag:"w",mode:420}),(await qR(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(N){let A=N;if(A.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(A.code)){if(d<e-1){let S=typeof A.message==="string"?A.message:"Unknown error";console.error(`Network error during write attempt ${d+1}/${e}:`,S);let L=h*2**d;await new Promise((O)=>setTimeout(O,L)),d++;continue}}if(A?.code&&["ENOSPC","EDQUOT"].includes(A.code))throw Error(`Disk quota exceeded or no space left on device: ${A.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",A),A}finally{if(_!==void 0)try{QD(_)}catch(N){console.error("Debug: [writeToFile] Error closing file descriptor:",N)}}}catch(R){if(d===e-1){let A=R,S=typeof A.message==="string"?A.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",S),R}d++;let N=h*2**(d-1);await new Promise((A)=>setTimeout(A,N))}})();this.pendingOperations.push(t);let T=this.pendingOperations.length-1;try{await t}catch(_){throw console.error("Debug: [writeToFile] Error in operation:",_),_}finally{this.pendingOperations.splice(T,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return xR(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return xR(this.config.logDirectory,`${this.name}.log`);let E=new Date().toISOString().split("T")[0];return xR(this.config.logDirectory,`${this.name}-${E}.log`)}setupRotation(){if(ir())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let E=this.config.rotation,r;switch(E.frequency){case"daily":r=86400000;break;case"weekly":r=604800000;break;case"monthly":r=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},r)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let r=this.config.rotation.keyRotation;if(!r?.enabled)return;let t=typeof r.interval==="number"?r.interval:60,T=Math.max(t,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((_)=>{console.error("Error rotating keys:",_)})},T)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let r=this.config.rotation.keyRotation,t=this.generateKeyId(),T=this.generateKey();this.currentKeyId=t,this.keys.set(t,T),this.encryptionKeys.set(t,{key:T,createdAt:new Date});let _=Array.from(this.encryptionKeys.entries()).sort(([,h],[,R])=>R.createdAt.getTime()-h.createdAt.getTime()),d=typeof r.maxKeys==="number"?r.maxKeys:1,e=Math.max(1,d);if(_.length>e)for(let[h]of _.slice(e))this.encryptionKeys.delete(h),this.keys.delete(h)}generateKeyId(){return YD(16).toString("hex")}generateKey(){return YD(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let E=this.keys.get(this.currentKeyId);if(!E)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:E,id:this.currentKeyId}}encrypt(E){let{key:r}=this.getCurrentKey(),t=YD(16),T=_4("aes-256-gcm",r,t),_=Ad.isBuffer(E)?E:Ad.from(E,"utf8"),d=T.update(_),e=T.final(),h=d.length+e.length,R=T.getAuthTag(),N=Ad.allocUnsafe(16+h+16);return t.copy(N,0),d.copy(N,16),e.copy(N,16+d.length),R.copy(N,16+h),{encrypted:N,iv:t}}async compressData(E){return new Promise((r,t)=>{let T=LF(),_=[];T.on("data",(d)=>_.push(d)),T.on("end",()=>r(Ad.from(Ad.concat(_)))),T.on("error",t),T.write(E),T.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let E={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let r=this.config.rotation.encrypt;return{...E,...r}}return E}async rotateLog(){if(ir())return;if(!this.shouldWriteToFile())return;let E=await qR(this.currentLogFile).catch(()=>null);if(!E)return;let r=this.config.rotation;if(typeof r==="boolean")return;if(r.maxSize&&E.size>=r.maxSize){let t=this.currentLogFile,T=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let _=await l0(this.config.logDirectory),d=_.filter((R)=>R.startsWith(this.name)&&/\.log\.\d+$/.test(R)).sort((R,N)=>{let A=Number.parseInt(R.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(N.match(/\.log\.(\d+)$/)?.[1]||"0")-A}),e=d.length>0?Number.parseInt(d[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,h=`${t}.${e}`;if(await qR(t).catch(()=>null))try{if(await SF(t,h),r.compress)try{let R=`${h}.gz`;await this.compressLogFile(h,R),await i0(h)}catch(R){console.error("Error compressing rotated file:",R)}if(d.length===0&&!_.some((R)=>R.endsWith(".log.1")))try{let R=`${t}.1`;await GD(R,"")}catch(R){console.error("Error creating backup file:",R)}}catch(R){console.error(`Error during rotation: ${R instanceof Error?R.message:String(R)}`)}}else{let _=new Date().toISOString().replace(/[:.]/g,"-"),d=t.replace(/\.log$/,`-${_}.log`);if(await qR(t).catch(()=>null))await SF(t,d)}if(this.currentLogFile=T,r.maxFiles){let d=(await l0(this.config.logDirectory)).filter((e)=>e.startsWith(this.name)).sort((e,h)=>h.localeCompare(e));for(let e of d.slice(r.maxFiles))await i0(xR(this.config.logDirectory,e))}}}async compressLogFile(E,r){let t=hF(E),T=e4(r),_=LF();await L4(t,_,T)}async handleFingersCrossedBuffer(E,r){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(E)&&!this.isActivated){this.isActivated=!0;for(let t of this.logBuffer){let T=await this.formatter.format(t);if(this.shouldWriteToFile())await this.writeToFile(T);console.log(T)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(r);console.log(r)}}shouldLog(E){if(!this.enabled)return!1;let r={debug:0,info:1,success:2,warning:3,error:4};return r[E]>=r[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((E)=>{if(E instanceof Promise)return E.catch((r)=>{console.error("Error in pending write operation:",r)});return Promise.resolve()})),v0(this.currentLogFile))try{let E=NF(this.currentLogFile,"r+");RF(E),QD(E)}catch(E){console.error(`Error flushing file: ${E}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let E of this.pendingOperations)if(typeof E.cancel==="function")E.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(E){console.error("Error waiting for pending operations:",E)}if(!ir()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let r=(await l0(this.config.logDirectory)).filter((t)=>(t.includes("temp")||t.includes(".tmp"))&&t.includes(this.name));for(let t of r)try{await i0(xR(this.config.logDirectory,t))}catch(T){console.error(`Failed to delete temp file ${t}:`,T)}}catch(E){console.error("Error cleaning up temporary files:",E)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(E){if(!E)return"";return`${this.tagFormat.prefix}${E}${this.tagFormat.suffix}`}formatFileTimestamp(E){return`[${E.toISOString()}]`}formatConsoleTimestamp(E){return this.shouldStyleConsole()?hr.gray(E.toLocaleTimeString()):E.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||ir())return!1;let E=typeof _r.env.NO_COLOR<"u",r=_r.env.FORCE_COLOR==="0";if(E||r)return!1;return!!(typeof _r.stderr<"u"&&_r.stderr.isTTY||typeof _r.stdout<"u"&&_r.stdout.isTTY)}formatConsoleMessage(E){let{timestamp:r,icon:t="",tag:T="",message:_,level:d,showTimestamp:e=!0}=E,h=(O)=>O.replace(this.ANSI_PATTERN,"");if(!this.fancy){let O=[];if(e)O.push(r);if(d==="warning")O.push("WARN");else if(d==="error")O.push("ERROR");else if(t)O.push(t.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(T)O.push(T.replace(/[[\]]/g,""));return O.push(_),O.join(" ")}let R=_r.stdout.columns||120,N="";if(d==="warning"||d==="error")N=`${t} ${_}`;else if(d==="info"||d==="success")N=`${t} ${T} ${_}`;else N=`${t} ${T} ${hr.cyan(_)}`;if(!e)return N.trim();let A=h(N).trim().length,S=h(r).length,L=Math.max(1,R-2-A-S);return`${N.trim()}${" ".repeat(L)}${r}`}formatMessage(E,r){if(r.length===1&&Array.isArray(r[0]))return E.replace(/\{(\d+)\}/g,(d,e)=>{let h=Number.parseInt(e,10);return h<r[0].length?String(r[0][h]):d});let t=/%([sdijfo%])/g,T=0,_=E.replace(t,(d,e)=>{if(e==="%")return"%";if(T>=r.length)return d;let h=r[T++];switch(e){case"s":return String(h);case"d":case"i":return Number(h).toString();case"j":case"o":return JSON.stringify(h,null,2);default:return d}});if(T<r.length)_+=` ${r.slice(T).map((d)=>typeof d==="object"?JSON.stringify(d,null,2):String(d)).join(" ")}`;return _}formatMarkdown(E){if(!E)return E;let r=E;return r=r.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(t,T,_)=>{let d=hr.underline(hr.blue(T)),e=this.toAbsoluteFilePath(_);if(e&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let h=`file://${encodeURI(e)}`,R="\x1B]8;;",N="\x1B\\";return`\x1B]8;;${h}\x1B\\${d}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${_}\x1B\\${d}\x1B]8;;\x1B\\`;return d}),r=r.replace(/`([^`]+)`/g,(t,T)=>hr.bgGray(T)),r=r.replace(/\*\*([^*]+)\*\*/g,(t,T)=>hr.bold(T)),r=r.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(t,T)=>hr.italic(T)),r=r.replace(/(?<!_)_([^_]+)_(?!_)/g,(t,T)=>hr.italic(T)),r=r.replace(/~([^~]+)~/g,(t,T)=>hr.strikethrough(T)),r}supportsHyperlinks(){if(ir())return!1;let E=_r.env;if(!E)return!1;if(E.TERM_PROGRAM==="iTerm.app"||E.TERM_PROGRAM==="vscode"||E.TERM_PROGRAM==="WezTerm")return!0;if(E.WT_SESSION)return!0;if(E.TERM==="xterm-kitty")return!0;let r=E.VTE_VERSION?Number.parseInt(E.VTE_VERSION,10):0;if(!Number.isNaN(r)&&r>=5000)return!0;return!1}toAbsoluteFilePath(E){try{let r=E;if(r.startsWith("file://"))r=r.replace(/^file:\/\//,"");if(r.startsWith("~")){let t=_r.env.HOME||"";if(t)r=r.replace(/^~(?=$|\/)/,t)}if(A4(r)||r.startsWith("./")||r.startsWith("../"))r=S4(r);else return null;return v0(r)?r:null}catch{return null}}buildOutputTexts(E){let r=this.shouldStyleConsole()?this.formatMarkdown(E):E,t=E.replace(this.ANSI_PATTERN,"");return{consoleText:r,fileText:t}}async log(E,r,...t){if(!this.shouldLog(E))return;let T=new Date,_=this.formatConsoleTimestamp(T),d=this.formatFileTimestamp(T),e,h;if(r instanceof Error)e=r.message,h=r.stack;else e=this.formatMessage(r,t);let{consoleText:R,fileText:N}=this.buildOutputTexts(e);if(this.shouldStyleConsole()){let S=this.options.showIcons===!1?"":FV[E],L=this.options.showTags!==!1&&this.name?hr.gray(this.formatTag(this.name)):"",O;switch(E){case"debug":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:hr.gray(R),level:E}),console.error(O);break;case"info":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:R,level:E}),console.warn(O);break;case"success":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:hr.green(R),level:E}),console.error(O);break;case"warning":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:R,level:E}),console.warn(O);break;case"error":if(O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:R,level:E}),console.error(O),h){let I=h.split(`
+`}return{name:"bunfig-plugin",setup(_){_.onResolve({filter:/^virtual:bunfig-types$/},(d)=>{return{path:d.path,namespace:"bunfig-virtual"}}),_.onLoad({filter:/^virtual:bunfig-types$/,namespace:"bunfig-virtual"},()=>{return{contents:T(),loader:"ts"}})}}}var gF,kR,kA,qF,u4,n4,cF,EO,uD,Ut,Jr,v4,IF,l4,UF,i4,a4,MD,m4,DF,$F,VD,s4,p4,o4,EV,rO,xF,rV,Dt,tV,TV,wF,tO,nD,lr,er,_V,CF,dV,XF,eV,hV,PD,RV,JF,yF,NV,KD,AV,SV,LV,OV,cV,TO,bF,IV,UV="0.15.6",UT,OO,xA,vD,lD,cO,iD,aD,bA,mD,sD,Le,kF,uF,T_,cd,nF,vF,DV=D4(async()=>{gF=import.meta.require,kR=new E$,kA=new r$,qF={createKey:$4,isEquivalent:w4,estimateMemoryUsage:C4},u4=hO(bD.cwd(),"config"),n4=hO(bD.cwd(),"src/generated"),cF=eO.env.CLARITY_LOG_DIR||MM(y4(),"logs"),EO={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:cF,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1},uD=await j4(),Ut={red:(E)=>`\x1B[31m${E}\x1B[0m`,green:(E)=>`\x1B[32m${E}\x1B[0m`,yellow:(E)=>`\x1B[33m${E}\x1B[0m`,blue:(E)=>`\x1B[34m${E}\x1B[0m`,magenta:(E)=>`\x1B[35m${E}\x1B[0m`,cyan:(E)=>`\x1B[36m${E}\x1B[0m`,white:(E)=>`\x1B[37m${E}\x1B[0m`,gray:(E)=>`\x1B[90m${E}\x1B[0m`,bgRed:(E)=>`\x1B[41m${E}\x1B[0m`,bgYellow:(E)=>`\x1B[43m${E}\x1B[0m`,bold:(E)=>`\x1B[1m${E}\x1B[0m`,dim:(E)=>`\x1B[2m${E}\x1B[0m`,italic:(E)=>`\x1B[3m${E}\x1B[0m`,underline:(E)=>`\x1B[4m${E}\x1B[0m`,reset:"\x1B[0m"},Jr=Ut,v4=Ut.red,IF=Ut.green,l4=Ut.yellow,UF=Ut.blue,i4=Ut.magenta,a4=Ut.cyan,MD=Ut.white,m4=Ut.gray,DF=Ut.bgRed,$F=Ut.bgYellow,VD=Ut.bold,s4=Ut.dim,p4=Ut.italic,o4=Ut.underline,EV=Ut.reset,rO={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},xF={debug:"\uD83D\uDD0D",info:UF("ℹ"),success:IF("✓"),warning:$F(MD(VD(" WARN "))),error:DF(MD(VD(" ERROR ")))},rV=new AO("stacks"),Dt=new AO("bunfig",{showTags:!0}),tV=Mt(qA.cwd(),"config"),TV=Mt(qA.cwd(),"src/generated"),wF=dO.env.CLARITY_LOG_DIR||QM(W4(),"logs"),tO={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:wF,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},nD=await H4(),lr={red:(E)=>`\x1B[31m${E}\x1B[0m`,green:(E)=>`\x1B[32m${E}\x1B[0m`,yellow:(E)=>`\x1B[33m${E}\x1B[0m`,blue:(E)=>`\x1B[34m${E}\x1B[0m`,magenta:(E)=>`\x1B[35m${E}\x1B[0m`,cyan:(E)=>`\x1B[36m${E}\x1B[0m`,white:(E)=>`\x1B[37m${E}\x1B[0m`,gray:(E)=>`\x1B[90m${E}\x1B[0m`,bgRed:(E)=>`\x1B[41m${E}\x1B[0m`,bgYellow:(E)=>`\x1B[43m${E}\x1B[0m`,bgGray:(E)=>`\x1B[100m${E}\x1B[0m`,bold:(E)=>`\x1B[1m${E}\x1B[0m`,dim:(E)=>`\x1B[2m${E}\x1B[0m`,italic:(E)=>`\x1B[3m${E}\x1B[0m`,underline:(E)=>`\x1B[4m${E}\x1B[0m`,strikethrough:(E)=>`\x1B[9m${E}\x1B[0m`,reset:"\x1B[0m"},er=lr,_V=lr.red,CF=lr.green,dV=lr.yellow,XF=lr.blue,eV=lr.magenta,hV=lr.cyan,PD=lr.white,RV=lr.gray,JF=lr.bgRed,yF=lr.bgYellow,NV=lr.bgGray,KD=lr.bold,AV=lr.dim,SV=lr.italic,LV=lr.underline,OV=lr.strikethrough,cV=lr.reset,TO={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},bF={debug:"\uD83D\uDD0D",info:XF("ℹ"),success:CF("✓"),warning:yF(PD(KD(" WARN "))),error:JF(PD(KD(" ERROR ")))},IV=new LO("stacks"),UT=class extends Error{timestamp;context;constructor(r,t={}){super(r);if(this.name=this.constructor.name,this.timestamp=new Date,this.context=t,Error.captureStackTrace)Error.captureStackTrace(this,this.constructor)}toJSON(){return{name:this.name,code:this.code,message:this.message,timestamp:this.timestamp.toISOString(),context:this.context,stack:this.stack}}toString(){let r=Object.keys(this.context).length>0?` (${Object.entries(this.context).map(([t,T])=>`${t}: ${T}`).join(", ")})`:"";return`${this.name} [${this.code}]: ${this.message}${r}`}},OO=class extends UT{code="CONFIG_NOT_FOUND";constructor(r,t,T){let _=T?` or alias "${T}"`:"";super(`Configuration "${r}"${_} not found`,{configName:r,alias:T,searchPaths:t,searchPathCount:t.length})}},xA=class extends UT{code="CONFIG_LOAD_ERROR";constructor(r,t,T){super(`Failed to load configuration from "${r}": ${t.message}`,{configPath:r,configName:T,originalError:t.name,originalMessage:t.message});this.cause=t}},vD=class extends UT{code="CONFIG_VALIDATION_ERROR";constructor(r,t,T){super(`Configuration validation failed for "${r}"`,{configPath:r,configName:T,validationErrors:t,errorCount:t.length})}},lD=class extends UT{code="CONFIG_MERGE_ERROR";constructor(r,t,T,_){super(`Failed to merge configuration from "${r}" with "${t}": ${T.message}`,{sourcePath:r,targetPath:t,configName:_,originalError:T.name,originalMessage:T.message});this.cause=T}},cO=class extends UT{code="ENV_VAR_ERROR";constructor(r,t,T,_){super(`Failed to parse environment variable "${r}" with value "${t}" as ${T}`,{envKey:r,envValue:t,expectedType:T,configName:_})}},iD=class extends UT{code="FILE_SYSTEM_ERROR";constructor(r,t,T){super(`File system ${r} failed for "${t}": ${T.message}`,{operation:r,path:t,originalError:T.name,originalMessage:T.message});this.cause=T}},aD=class extends UT{code="TYPE_GENERATION_ERROR";constructor(r,t,T){super(`Failed to generate types from "${r}" to "${t}": ${T.message}`,{configDir:r,outputPath:t,originalError:T.name,originalMessage:T.message});this.cause=T}},bA=class extends UT{code="SCHEMA_VALIDATION_ERROR";constructor(r,t,T){super(`Schema validation failed${T?` for config "${T}"`:""}`,{schemaPath:r,configName:T,validationErrors:t,errorCount:t.length})}},mD=class extends UT{code="BROWSER_CONFIG_ERROR";constructor(r,t,T,_){super(`Failed to fetch configuration from "${r}": ${t} ${T}`,{endpoint:r,status:t,statusText:T,configName:_})}},sD=class extends UT{code="PLUGIN_ERROR";constructor(r,t,T){super(`Plugin "${r}" failed during ${t}: ${T.message}`,{pluginName:r,operation:t,originalError:T.name,originalMessage:T.message});this.cause=T}},Le={configNotFound(E,r,t){return new OO(E,r,t)},configLoad(E,r,t){return new xA(E,r,t)},configValidation(E,r,t){return new vD(E,r,t)},configMerge(E,r,t,T){return new lD(E,r,t,T)},envVar(E,r,t,T){return new cO(E,r,t,T)},fileSystem(E,r,t){return new iD(E,r,t)},typeGeneration(E,r,t){return new aD(E,r,t)},schemaValidation(E,r,t){return new bA(E,r,t)},browserConfig(E,r,t,T){return new mD(E,r,t,T)},plugin(E,r,t){return new sD(E,r,t)}},kF={replace:"replace",concat:"concat",smart:"smart"},uF=/^https?:\/\//,T_=new LO("bunfig",{showTags:!0}),cd=new e$,nF=Vt(eh.cwd(),"config"),vF=Vt(eh.cwd(),"src/generated")});function $V(E,r={}){let t=RO.cwd();while(t.includes("storage"))t=eF(t,"..");let T=eF(t,E||"");if(r?.relative)return T4(RO.cwd(),T);return T}var wV=RO.env.CLARITY_LOG_DIR||t4($V(),"logs"),lF={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:wV,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},IO={...lF},pEE=(async()=>{try{let{loadConfig:E}=await DV().then(()=>fF),r=await E({name:"clarity",alias:"logging",defaultConfig:lF,cwd:RO.cwd()});if(r)Object.assign(IO,r)}catch{}return IO})();function ir(){if(Od.env.NODE_ENV==="test"||Od.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function CV(){if(Od.env.NODE_ENV==="test"||Od.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof Od<"u"){let E=Od.type;if(E==="renderer"||E==="worker")return!1;return!!(Od.versions&&(Od.versions.node||Od.versions.bun))}return!1}class iF{async format(E){let r=await CV(),t=await this.getMetadata(r);return JSON.stringify({timestamp:E.timestamp.toISOString(),level:E.level,name:E.name,message:E.message,metadata:t})}async getMetadata(E){if(E){let{hostname:r}=await import("os");return{pid:bR.pid,hostname:r(),environment:bR.env.NODE_ENV||"development",platform:bR.platform,version:bR.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:bR.env.NODE_ENV||bR.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}var _t={red:(E)=>`\x1B[31m${E}\x1B[0m`,green:(E)=>`\x1B[32m${E}\x1B[0m`,yellow:(E)=>`\x1B[33m${E}\x1B[0m`,blue:(E)=>`\x1B[34m${E}\x1B[0m`,magenta:(E)=>`\x1B[35m${E}\x1B[0m`,cyan:(E)=>`\x1B[36m${E}\x1B[0m`,white:(E)=>`\x1B[37m${E}\x1B[0m`,gray:(E)=>`\x1B[90m${E}\x1B[0m`,bgRed:(E)=>`\x1B[41m${E}\x1B[0m`,bgYellow:(E)=>`\x1B[43m${E}\x1B[0m`,bgGray:(E)=>`\x1B[100m${E}\x1B[0m`,bold:(E)=>`\x1B[1m${E}\x1B[0m`,dim:(E)=>`\x1B[2m${E}\x1B[0m`,italic:(E)=>`\x1B[3m${E}\x1B[0m`,underline:(E)=>`\x1B[4m${E}\x1B[0m`,strikethrough:(E)=>`\x1B[9m${E}\x1B[0m`,reset:"\x1B[0m"},hr=_t,oEE=_t.red,XV=_t.green,ErE=_t.yellow,JV=_t.blue,rrE=_t.magenta,trE=_t.cyan,jF=_t.white,TrE=_t.gray,yV=_t.bgRed,jV=_t.bgYellow,_rE=_t.bgGray,FF=_t.bold,drE=_t.dim,erE=_t.italic,hrE=_t.underline,RrE=_t.strikethrough,NrE=_t.reset,ZD={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},FV={debug:"\uD83D\uDD0D",info:JV("ℹ"),success:XV("✓"),warning:jV(jF(FF(" WARN "))),error:yV(jF(FF(" ERROR ")))};class XO{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(E,r={}){this.name=E,this.config={...IO},this.options=this.normalizeOptions(r),this.formatter=this.options.formatter||new iF,this.enabled=r.enabled??!0,this.fancy=r.fancy??!0,this.tagFormat=r.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=r.timestampPosition??"right",this.environment=r.environment??_r.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(r);let t={...r},T=r.timestamp!==void 0;if(T)delete t.timestamp;if(this.config={...this.config,...t,timestamp:T||this.config.timestamp,level:this.options.level??"info"},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let _=this.generateKeyId(),d=this.generateKey();this.currentKeyId=_,this.keys.set(_,d),this.encryptionKeys.set(_,{key:d,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(E){if(!this.fingersCrossedConfig)return!1;let r={debug:0,info:1,success:2,warning:3,error:4},t=this.fingersCrossedConfig.activationLevel??"error";return r[E]>=r[t]}initializeFingersCrossedConfig(E){if(!E.fingersCrossedEnabled&&E.fingersCrossed)return{...ZD,...E.fingersCrossed};if(!E.fingersCrossedEnabled)return null;if(!E.fingersCrossed)return{...ZD};return{...ZD,...E.fingersCrossed}}normalizeOptions(E){let r={format:"json",level:"info",logDirectory:IO.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},t={...r,...Object.fromEntries(Object.entries(E).filter(([,T])=>T!==void 0))};if(!t.level||!["debug","info","success","warning","error"].includes(t.level))t.level=r.level;return t}shouldWriteToFile(){return!ir()&&this.config.writeToFile===!0}async writeToFile(E){let t=(async()=>{let _,d=0,e=3,h=1000;while(d<e)try{try{try{await R4(this.config.logDirectory,AF.F_OK|AF.W_OK)}catch(N){if(N instanceof Error&&"code"in N)if(N.code==="ENOENT")await N4(this.config.logDirectory,{recursive:!0,mode:493});else if(N.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw N;else throw N}}catch(N){throw console.error("Debug: [writeToFile] Failed to create log directory:",N),N}let R=this.validateEncryptionConfig()?(await this.encrypt(E)).encrypted:Ad.from(E);try{if(!v0(this.currentLogFile))await GD(this.currentLogFile,"",{mode:420});if(_=NF(this.currentLogFile,"a",420),h4(_,R,{flag:"a"}),RF(_),_!==void 0)QD(_),_=void 0;if((await qR(this.currentLogFile)).size===0){if(await GD(this.currentLogFile,R,{flag:"w",mode:420}),(await qR(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(N){let A=N;if(A.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(A.code)){if(d<e-1){let S=typeof A.message==="string"?A.message:"Unknown error";console.error(`Network error during write attempt ${d+1}/${e}:`,S);let L=h*2**d;await new Promise((O)=>setTimeout(O,L)),d++;continue}}if(A?.code&&["ENOSPC","EDQUOT"].includes(A.code))throw Error(`Disk quota exceeded or no space left on device: ${A.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",A),A}finally{if(_!==void 0)try{QD(_)}catch(N){console.error("Debug: [writeToFile] Error closing file descriptor:",N)}}}catch(R){if(d===e-1){let A=R,S=typeof A.message==="string"?A.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",S),R}d++;let N=h*2**(d-1);await new Promise((A)=>setTimeout(A,N))}})();this.pendingOperations.push(t);let T=this.pendingOperations.length-1;try{await t}catch(_){throw console.error("Debug: [writeToFile] Error in operation:",_),_}finally{this.pendingOperations.splice(T,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return xR(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return xR(this.config.logDirectory,`${this.name}.log`);let E=new Date().toISOString().split("T")[0];return xR(this.config.logDirectory,`${this.name}-${E}.log`)}setupRotation(){if(ir())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let E=this.config.rotation,r;switch(E.frequency){case"daily":r=86400000;break;case"weekly":r=604800000;break;case"monthly":r=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},r)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let r=this.config.rotation.keyRotation;if(!r?.enabled)return;let t=typeof r.interval==="number"?r.interval:60,T=Math.max(t,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((_)=>{console.error("Error rotating keys:",_)})},T)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let r=this.config.rotation.keyRotation,t=this.generateKeyId(),T=this.generateKey();this.currentKeyId=t,this.keys.set(t,T),this.encryptionKeys.set(t,{key:T,createdAt:new Date});let _=Array.from(this.encryptionKeys.entries()).sort(([,h],[,R])=>R.createdAt.getTime()-h.createdAt.getTime()),d=typeof r.maxKeys==="number"?r.maxKeys:1,e=Math.max(1,d);if(_.length>e)for(let[h]of _.slice(e))this.encryptionKeys.delete(h),this.keys.delete(h)}generateKeyId(){return YD(16).toString("hex")}generateKey(){return YD(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let E=this.keys.get(this.currentKeyId);if(!E)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:E,id:this.currentKeyId}}encrypt(E){let{key:r}=this.getCurrentKey(),t=YD(16),T=_4("aes-256-gcm",r,t),_=Ad.isBuffer(E)?E:Ad.from(E,"utf8"),d=T.update(_),e=T.final(),h=d.length+e.length,R=T.getAuthTag(),N=Ad.allocUnsafe(16+h+16);return t.copy(N,0),d.copy(N,16),e.copy(N,16+d.length),R.copy(N,16+h),{encrypted:N,iv:t}}async compressData(E){return new Promise((r,t)=>{let T=LF(),_=[];T.on("data",(d)=>_.push(d)),T.on("end",()=>r(Ad.from(Ad.concat(_)))),T.on("error",t),T.write(E),T.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let E={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let r=this.config.rotation.encrypt;return{...E,...r}}return E}async rotateLog(){if(ir())return;if(!this.shouldWriteToFile())return;let E=await qR(this.currentLogFile).catch(()=>null);if(!E)return;let r=this.config.rotation;if(typeof r==="boolean")return;if(r.maxSize&&E.size>=r.maxSize){let t=this.currentLogFile,T=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let _=await l0(this.config.logDirectory),d=_.filter((R)=>R.startsWith(this.name)&&/\.log\.\d+$/.test(R)).sort((R,N)=>{let A=Number.parseInt(R.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(N.match(/\.log\.(\d+)$/)?.[1]||"0")-A}),e=d.length>0?Number.parseInt(d[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,h=`${t}.${e}`;if(await qR(t).catch(()=>null))try{if(await SF(t,h),r.compress)try{let R=`${h}.gz`;await this.compressLogFile(h,R),await i0(h)}catch(R){console.error("Error compressing rotated file:",R)}if(d.length===0&&!_.some((R)=>R.endsWith(".log.1")))try{let R=`${t}.1`;await GD(R,"")}catch(R){console.error("Error creating backup file:",R)}}catch(R){console.error(`Error during rotation: ${R instanceof Error?R.message:String(R)}`)}}else{let _=new Date().toISOString().replace(/[:.]/g,"-"),d=t.replace(/\.log$/,`-${_}.log`);if(await qR(t).catch(()=>null))await SF(t,d)}if(this.currentLogFile=T,r.maxFiles){let d=(await l0(this.config.logDirectory)).filter((e)=>e.startsWith(this.name)).sort((e,h)=>h.localeCompare(e));for(let e of d.slice(r.maxFiles))await i0(xR(this.config.logDirectory,e))}}}async compressLogFile(E,r){let t=hF(E),T=e4(r),_=LF();await L4(t,_,T)}async handleFingersCrossedBuffer(E,r){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(E)&&!this.isActivated){this.isActivated=!0;for(let t of this.logBuffer){let T=await this.formatter.format(t);if(this.shouldWriteToFile())await this.writeToFile(T);console.log(T)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(r);console.log(r)}}shouldLog(E){if(!this.enabled)return!1;let r={debug:0,info:1,success:2,warning:3,error:4};return r[E]>=r[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((E)=>{if(E instanceof Promise)return E.catch((r)=>{console.error("Error in pending write operation:",r)});return Promise.resolve()})),v0(this.currentLogFile))try{let E=NF(this.currentLogFile,"r+");RF(E),QD(E)}catch(E){console.error(`Error flushing file: ${E}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let E of this.pendingOperations)if(typeof E.cancel==="function")E.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(E){console.error("Error waiting for pending operations:",E)}if(!ir()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let r=(await l0(this.config.logDirectory)).filter((t)=>(t.includes("temp")||t.includes(".tmp"))&&t.includes(this.name));for(let t of r)try{await i0(xR(this.config.logDirectory,t))}catch(T){console.error(`Failed to delete temp file ${t}:`,T)}}catch(E){console.error("Error cleaning up temporary files:",E)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(E){if(!E)return"";return`${this.tagFormat.prefix}${E}${this.tagFormat.suffix}`}formatFileTimestamp(E){return`[${E.toISOString()}]`}formatConsoleTimestamp(E){return this.shouldStyleConsole()?hr.gray(E.toLocaleTimeString()):E.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||ir())return!1;let E=typeof _r.env.NO_COLOR<"u",r=_r.env.FORCE_COLOR==="0";if(E||r)return!1;return!!(typeof _r.stderr<"u"&&_r.stderr.isTTY||typeof _r.stdout<"u"&&_r.stdout.isTTY)}formatConsoleMessage(E){let{timestamp:r,icon:t="",tag:T="",message:_,level:d,showTimestamp:e=!0}=E,h=(O)=>O.replace(this.ANSI_PATTERN,"");if(!this.fancy){let O=[];if(e)O.push(r);if(d==="warning")O.push("WARN");else if(d==="error")O.push("ERROR");else if(t)O.push(t.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(T)O.push(T.replace(/[[\]]/g,""));return O.push(_),O.join(" ")}let R=_r.stdout.columns||120,N="";if(d==="warning"||d==="error")N=`${t} ${_}`;else if(d==="info"||d==="success")N=`${t} ${T} ${_}`;else N=`${t} ${T} ${hr.cyan(_)}`;if(!e)return N.trim();let A=h(N).trim().length,S=h(r).length,L=Math.max(1,R-2-A-S);return`${N.trim()}${" ".repeat(L)}${r}`}formatMessage(E,r){if(r.length===1&&Array.isArray(r[0]))return E.replace(/\{(\d+)\}/g,(d,e)=>{let h=Number.parseInt(e,10);return h<r[0].length?String(r[0][h]):d});let t=/%([sdijfo%])/g,T=0,_=E.replace(t,(d,e)=>{if(e==="%")return"%";if(T>=r.length)return d;let h=r[T++];switch(e){case"s":return String(h);case"d":case"i":return Number(h).toString();case"j":case"o":return JSON.stringify(h,null,2);default:return d}});if(T<r.length)_+=` ${r.slice(T).map((d)=>typeof d==="object"?JSON.stringify(d,null,2):String(d)).join(" ")}`;return _}formatMarkdown(E){if(!E)return E;let r=E;return r=r.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(t,T,_)=>{let d=hr.underline(hr.blue(T)),e=this.toAbsoluteFilePath(_);if(e&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let h=`file://${encodeURI(e)}`,R="\x1B]8;;",N="\x1B\\";return`\x1B]8;;${h}\x1B\\${d}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${_}\x1B\\${d}\x1B]8;;\x1B\\`;return d}),r=r.replace(/`([^`]+)`/g,(t,T)=>hr.bgGray(T)),r=r.replace(/\*\*([^*]+)\*\*/g,(t,T)=>hr.bold(T)),r=r.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(t,T)=>hr.italic(T)),r=r.replace(/(?<!_)_([^_]+)_(?!_)/g,(t,T)=>hr.italic(T)),r=r.replace(/~([^~]+)~/g,(t,T)=>hr.strikethrough(T)),r}supportsHyperlinks(){if(ir())return!1;let E=_r.env;if(!E)return!1;if(E.TERM_PROGRAM==="iTerm.app"||E.TERM_PROGRAM==="vscode"||E.TERM_PROGRAM==="WezTerm")return!0;if(E.WT_SESSION)return!0;if(E.TERM==="xterm-kitty")return!0;let r=E.VTE_VERSION?Number.parseInt(E.VTE_VERSION,10):0;if(!Number.isNaN(r)&&r>=5000)return!0;return!1}toAbsoluteFilePath(E){try{let r=E;if(r.startsWith("file://"))r=r.replace(/^file:\/\//,"");if(r.startsWith("~")){let t=_r.env.HOME||"";if(t)r=r.replace(/^~(?=$|\/)/,t)}if(A4(r)||r.startsWith("./")||r.startsWith("../"))r=S4(r);else return null;return v0(r)?r:null}catch{return null}}buildOutputTexts(E){let r=this.shouldStyleConsole()?this.formatMarkdown(E):E,t=E.replace(this.ANSI_PATTERN,"");return{consoleText:r,fileText:t}}async log(E,r,...t){if(!this.shouldLog(E))return;let T=new Date,_=this.formatConsoleTimestamp(T),d=this.formatFileTimestamp(T),e,h;if(r instanceof Error)e=r.message,h=r.stack;else e=this.formatMessage(r,t);let{consoleText:R,fileText:N}=this.buildOutputTexts(e);if(this.shouldStyleConsole()){let S=this.options.showIcons===!1?"":FV[E],L=this.options.showTags!==!1&&this.name?hr.gray(this.formatTag(this.name)):"",O;switch(E){case"debug":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:hr.gray(R),level:E}),console.error(O);break;case"info":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:R,level:E}),console.warn(O);break;case"success":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:hr.green(R),level:E}),console.error(O);break;case"warning":O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:R,level:E}),console.warn(O);break;case"error":if(O=this.formatConsoleMessage({timestamp:_,icon:S,tag:L,message:R,level:E}),console.error(O),h){let I=h.split(`
 `);for(let D of I)if(D.trim()&&!D.includes(e))console.error(this.formatConsoleMessage({timestamp:_,message:hr.gray(`  ${D}`),level:E,showTimestamp:!1}))}break}}else if(!ir()){if(console.error(`${d} ${this.environment}.${E.toUpperCase()}: ${e}`),h)console.error(h)}let A=`${d} ${this.environment}.${E.toUpperCase()}: ${N}
 `;if(h)A+=`${h}
 `;if(A=A.replace(this.ANSI_PATTERN,""),this.shouldWriteToFile())await this.writeToFile(A)}progress(E,r=""){let t={update:(h,R)=>{},finish:(h)=>{},interrupt:(h,R)=>{}};if(!this.enabled)return t;let T=30;if(this.activeProgressBar={total:Math.max(1,E||1),current:0,message:r||"",barLength:T,lastRenderedLine:""},this.shouldStyleConsole()&&!ir()&&_r.stdout.isTTY)this.renderProgressBar(this.activeProgressBar);return{update:(h,R)=>{if(!this.enabled||!this.activeProgressBar)return;if(this.activeProgressBar.current=Math.min(Math.max(0,h),this.activeProgressBar.total),R!==void 0)this.activeProgressBar.message=R;if(this.shouldStyleConsole()&&!ir()&&_r.stdout.isTTY)this.renderProgressBar(this.activeProgressBar)},finish:(h)=>{if(!this.activeProgressBar)return;this.finishProgressBar(this.activeProgressBar,h)},interrupt:(h,R="info")=>{if(!ir()&&_r.stdout.isTTY)_r.stdout.write(`
@@ -9087,7 +9087,7 @@ export type ConfigOf = Config
 `;t+=`| Variable | Type | Description | Example |
 `,t+=`|----------|------|-------------|----------|
 `;for(let T of E)t+=`| \`${T.key}\` | ${T.type} | ${T.description} | \`${T.example}\` |
-`;return t}}function BV(E,r,t={}){return tz(E,r,t,new WeakMap)}function tz(E,r,t,T){let{arrayMergeMode:_="replace",skipNullish:d=!1,customMerger:e}=t;if(r===null||r===void 0)return d?E:r;if(e){let h=e(E,r);if(h!==void 0)return h}if(Array.isArray(r)||Array.isArray(E))return Tz(E,r,_,T);if(!qT(r)||!qT(E))return r;return YV(E,r,t,T)}function Tz(E,r,t,T){if(Array.isArray(r)&&!Array.isArray(E))return r;if(Array.isArray(E)&&!Array.isArray(r))return r;if(Array.isArray(r)&&Array.isArray(E))switch(t){case"replace":return r;case"concat":return WV(E,r);case"smart":return HV(E,r,T);default:return r}return r}function WV(E,r){let t=[...r];for(let T of E)if(!t.some((_)=>pD(_,T)))t.push(T);return t}function HV(E,r,t){if(r.length===0)return E;if(E.length===0)return r;if(qT(r[0])&&qT(E[0]))return fV(E,r,t);if(r.every((T)=>typeof T==="string")&&E.every((T)=>typeof T==="string")){let T=[...r];for(let _ of E)if(!T.includes(_))T.push(_);return T}return r}function fV(E,r,t){let T=[...r];for(let _ of E){if(!qT(_)){T.push(_);continue}let d=["id","name","key","path","type"],e=!1;for(let h of d)if(h in _){if(T.find((N)=>qT(N)&&(h in N)&&N[h]===_[h])){e=!0;break}}if(!e)T.push(_)}return T}function YV(E,r,t,T){let _=r;if(qT(_)&&T.has(_))return T.get(_);let d={...E};if(qT(_))T.set(_,d);for(let e in _){if(!Object.prototype.hasOwnProperty.call(_,e))continue;let h=_[e],R=d[e];if(t.skipNullish&&(h===null||h===void 0))continue;if(h===null||h===void 0){d[e]=h;continue}if(qT(h)&&qT(R))d[e]=tz(R,h,t,T);else if(Array.isArray(h)||Array.isArray(R))d[e]=Tz(R,h,t.arrayMergeMode||"smart",T);else d[e]=h}return d}function _z(E,r,t="replace"){return BV(E,r,{arrayMergeMode:t==="replace"?"replace":"smart",skipNullish:!0})}function pD(E,r){if(E===r)return!0;if(Array.isArray(E)&&Array.isArray(r)){if(E.length!==r.length)return!1;for(let t=0;t<E.length;t++)if(!pD(E[t],r[t]))return!1;return!0}if(qT(E)&&qT(r)){let t=Object.keys(E),T=Object.keys(r);if(t.length!==T.length)return!1;for(let _ of t){if(!Object.prototype.hasOwnProperty.call(r,_))return!1;if(!pD(E[_],r[_]))return!1}return!0}return!1}function qT(E){return Boolean(E&&typeof E==="object"&&!Array.isArray(E))}class dz{extensions=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];async loadFromPath(E,r,t={}){let{arrayStrategy:T="replace",useCache:_=!0,cacheTtl:d,trackPerformance:e=!0,verbose:h=!1}=t;if(_){let N=_O.getWithFileCheck("file",E);if(N){if(h)console.log(`Configuration loaded from cache: ${E}`);return N}}let R=async()=>{if(!s0(E))return null;try{let N=`?t=${Date.now()}`,A=await import(E+N),S=A.default||A,L="default"in A,O=Object.keys(A).length>0;if(!L&&!O)throw new UO(E,Error("Configuration file is empty and exports nothing"),"unknown");if(typeof S!=="object"||S===null||Array.isArray(S))throw new UO(E,Error("Configuration must export a valid object"),"unknown");let $={config:_z(r,S,T),source:{type:"file",path:E,priority:100,timestamp:new Date}};if(_)_O.setWithFileCheck("file",$,E,d);return $}catch(N){throw N instanceof Error?uR.configLoad(E,N):uR.configLoad(E,Error(String(N)))}};if(e)return oD.track("loadFromPath",R,{path:E});return R()}async tryLoadFromPaths(E,r,t={}){for(let T of E)try{let _=await this.loadFromPath(T,r,t);if(_)return _}catch(_){if(_ instanceof Error&&_.name==="ConfigLoadError")throw _;if(t.verbose)console.warn(`Failed to load config from ${T}:`,_)}return null}generateConfigPaths(E,r,t){let T=this.generateNamePatterns(E,t),_=[];for(let d of T)for(let e of this.extensions)_.push(gD(r,`${d}${e}`));return _}generateNamePatterns(E,r){let t=[];if(t.push("config",".config"),E)t.push(E,`.${E}.config`,`${E}.config`,`.${E}`);let T=r===void 0?[]:Array.isArray(r)?r:[r];for(let d of T){if(!d)continue;if(t.push(d,`.${d}.config`,`${d}.config`,`.${d}`),E)t.push(`${E}.${d}.config`,`.${E}.${d}.config`)}let _=new Set;return t.filter((d)=>{if(!d||_.has(d))return!1;return _.add(d),!0})}checkFileAccess(E){return zV(async()=>{return s0(E)},{maxRetries:2,retryDelay:100,fallback:!1})}async discoverConfigFiles(E,r,t){let T=[];if(!s0(E))return T;if(r||t){let _=this.generateNamePatterns(r||"",t);for(let d of _)for(let e of this.extensions){let h=gD(E,`${d}${e}`);if(await this.checkFileAccess(h))T.push(h)}}else try{let{readdirSync:_}=await import("fs"),d=_(E);for(let e of d)if(this.looksLikeConfigFile(e)){let h=gD(E,e);if(await this.checkFileAccess(h))T.push(h)}}catch{return[]}return T}looksLikeConfigFile(E){return[/\.config\.(ts|js|mjs|cjs|json|mts|cts)$/,/^\..*\.(ts|js|mjs|cjs|json|mts|cts)$/,/config\.(ts|js|mjs|cjs|json|mts|cts)$/].some((t)=>t.test(E))}async validateConfigFile(E){let r=[];try{if(!s0(E))return r.push("Configuration file does not exist"),r;let t=await import(E),T=t.default||t;if(T===void 0)r.push("Configuration file must export a default value or named exports");else if(typeof T!=="object"||T===null)r.push("Configuration must be an object");else if(Array.isArray(T))r.push("Configuration cannot be an array at the root level");if(E.endsWith(".json"))try{let{readFileSync:_}=await import("fs"),d=_(E,"utf8");JSON.parse(d)}catch(_){r.push(`Invalid JSON syntax: ${_}`)}}catch(t){r.push(`Failed to load configuration file: ${t}`)}return r}async getFileModificationTime(E){try{let{statSync:r}=await import("fs");return r(E).mtime}catch{return null}}async preloadConfigurations(E,r={}){let t=new Map;return await Promise.allSettled(E.map(async(T)=>{try{let _=await this.loadFromPath(T,{},r);if(_)t.set(T,_.config)}catch(_){if(r.verbose)console.warn(`Failed to preload ${T}:`,_)}})),t}}var GV=/^https?:\/\//;class ez{async validateConfiguration(E,r,t={}){let{stopOnFirstError:T=!1,validateRequired:_=!0,validateTypes:d=!0,customRules:e=[],trackPerformance:h=!0,verbose:R=!1}=t,N=async()=>{let A=[],S=[],L={stopOnFirstError:T,validateRequired:_,validateTypes:d,customRules:e,trackPerformance:h,verbose:R};try{if(typeof r==="string")return await this.validateWithSchemaFile(E,r,L);else if(Array.isArray(r))return this.validateWithRules(E,[...r,...e],L);else return this.validateWithJSONSchema(E,r,L)}catch(O){return A.push({path:"",message:`Validation failed: ${O}`,rule:"system"}),{isValid:!1,errors:A,warnings:S}}};if(h)return await oD.track("validateConfiguration",N);return N()}async validateWithSchemaFile(E,r,t){try{if(!QV(r))throw new DO(r,[{path:"",message:"Schema file does not exist"}]);let T=await import(r),_=T.default||T;if(Array.isArray(_))return this.validateWithRules(E,_,t);else return this.validateWithJSONSchema(E,_,t)}catch(T){throw new DO(r,[{path:"",message:`Failed to load schema: ${T}`}])}}validateWithJSONSchema(E,r,t){let T=[],_=[];return this.validateObjectAgainstSchema(E,r,"",T,_,t),{isValid:T.length===0,errors:T,warnings:_}}validateObjectAgainstSchema(E,r,t,T,_,d){if(d.validateTypes&&r.type){let e=Array.isArray(E)?"array":typeof E,h=Array.isArray(r.type)?r.type:[r.type];if(!h.includes(e)){if(T.push({path:t,message:`Expected type ${h.join(" or ")}, got ${e}`,expected:h.join(" or "),actual:e,rule:"type"}),d.stopOnFirstError)return}}if(r.enum&&!r.enum.includes(E)){if(T.push({path:t,message:`Value must be one of: ${r.enum.join(", ")}`,expected:r.enum.join(", "),actual:E,rule:"enum"}),d.stopOnFirstError)return}if(typeof E==="string"){if(r.minLength!==void 0&&E.length<r.minLength)T.push({path:t,message:`String length must be at least ${r.minLength}`,expected:`>= ${r.minLength}`,actual:E.length,rule:"minLength"});if(r.maxLength!==void 0&&E.length>r.maxLength)T.push({path:t,message:`String length must not exceed ${r.maxLength}`,expected:`<= ${r.maxLength}`,actual:E.length,rule:"maxLength"});if(r.pattern){if(!new RegExp(r.pattern).test(E))T.push({path:t,message:`String does not match pattern ${r.pattern}`,expected:r.pattern,actual:E,rule:"pattern"})}}if(typeof E==="number"){if(r.minimum!==void 0&&E<r.minimum)T.push({path:t,message:`Value must be at least ${r.minimum}`,expected:`>= ${r.minimum}`,actual:E,rule:"minimum"});if(r.maximum!==void 0&&E>r.maximum)T.push({path:t,message:`Value must not exceed ${r.maximum}`,expected:`<= ${r.maximum}`,actual:E,rule:"maximum"})}if(Array.isArray(E)&&r.items)for(let e=0;e<E.length;e++){let h=t?`${t}[${e}]`:`[${e}]`;if(this.validateObjectAgainstSchema(E[e],r.items,h,T,_,d),d.stopOnFirstError&&T.length>0)return}if(E&&typeof E==="object"&&!Array.isArray(E)){let e=E;if(d.validateRequired&&r.required){for(let h of r.required)if(!(h in e)){if(T.push({path:t?`${t}.${h}`:h,message:`Missing required property '${h}'`,expected:"required",rule:"required"}),d.stopOnFirstError)return}}if(r.properties){for(let[h,R]of Object.entries(r.properties))if(h in e){let N=t?`${t}.${h}`:h;if(this.validateObjectAgainstSchema(e[h],R,N,T,_,d),d.stopOnFirstError&&T.length>0)return}}if(r.additionalProperties===!1){let h=new Set(Object.keys(r.properties||{}));for(let R of Object.keys(e))if(!h.has(R))_.push({path:t?`${t}.${R}`:R,message:`Additional property '${R}' is not allowed`,rule:"additionalProperties"})}}}validateWithRules(E,r,t){let T=[],_=[];for(let d of r)try{let e=this.getValueByPath(E,d.path),h=this.validateWithRule(e,d,d.path);if(T.push(...h),t.stopOnFirstError&&T.length>0)break}catch(e){T.push({path:d.path,message:`Rule validation failed: ${e}`,rule:"system"})}return{isValid:T.length===0,errors:T,warnings:_}}validateWithRule(E,r,t){let T=[];if(r.required&&(E===void 0||E===null))return T.push({path:t,message:r.message||`Property '${t}' is required`,expected:"required",rule:"required"}),T;if(E===void 0||E===null)return T;if(r.type){let _=Array.isArray(E)?"array":typeof E;if(_!==r.type)T.push({path:t,message:r.message||`Expected type ${r.type}, got ${_}`,expected:r.type,actual:_,rule:"type"})}if(r.min!==void 0){let _=Array.isArray(E)?E.length:typeof E==="string"?E.length:typeof E==="number"?E:0;if(_<r.min)T.push({path:t,message:r.message||`Value must be at least ${r.min}`,expected:`>= ${r.min}`,actual:_,rule:"min"})}if(r.max!==void 0){let _=Array.isArray(E)?E.length:typeof E==="string"?E.length:typeof E==="number"?E:0;if(_>r.max)T.push({path:t,message:r.message||`Value must not exceed ${r.max}`,expected:`<= ${r.max}`,actual:_,rule:"max"})}if(r.pattern&&typeof E==="string"){if(!r.pattern.test(E))T.push({path:t,message:r.message||`Value does not match pattern ${r.pattern}`,expected:r.pattern.toString(),actual:E,rule:"pattern"})}if(r.enum&&!r.enum.includes(E))T.push({path:t,message:r.message||`Value must be one of: ${r.enum.join(", ")}`,expected:r.enum.join(", "),actual:E,rule:"enum"});if(r.validator){let _=r.validator(E);if(_)T.push({path:t,message:r.message||_,rule:"custom"})}return T}getValueByPath(E,r){if(!r)return E;let t=r.split("."),T=E;for(let _ of t)if(T&&typeof T==="object"&&_ in T)T=T[_];else return;return T}generateRulesFromInterface(E){let r=[],t=E.matchAll(/(\w+)(\?)?:\s*(\w+)/g);for(let T of t){let[,_,d,e]=T;r.push({path:_,required:!d,type:this.mapTypeScriptType(e)})}return r}mapTypeScriptType(E){switch(E.toLowerCase()){case"string":return"string";case"number":return"number";case"boolean":return"boolean";case"array":return"array";case"object":return"object";default:return"object"}}static createCommonRules(){return{server:[{path:"port",required:!0,type:"number",min:1,max:65535},{path:"host",required:!0,type:"string",min:1},{path:"ssl",type:"boolean"}],database:[{path:"url",required:!0,type:"string",min:1},{path:"pool",type:"number",min:1,max:100},{path:"timeout",type:"number",min:0}],api:[{path:"baseUrl",required:!0,type:"string",pattern:GV},{path:"timeout",type:"number",min:0},{path:"retries",type:"number",min:0,max:10}]}}}var W_=new XO("bunfig",{showTags:!0});function MV(E){if(!E)return"";let r=Array.isArray(E)?E.filter(Boolean):[E];if(r.length===0)return"";if(r.length===1)return` or alias "${r[0]}"`;return` or aliases ${r.map((t)=>`"${t}"`).join(", ")}`}class hz{fileLoader=new dz;envProcessor=new R$;validator=new ez;async loadConfig(E){let r=Date.now(),{cache:t,performance:T,schema:_,validate:d,...e}=E;try{if(t?.enabled){let R=this.checkCache(e.name||"",e);if(R)return R}let h;try{h=await this.loadConfigurationStrategies(e,!0,t)}catch(R){let N=e.__strictErrorHandling;if(R instanceof Error&&R.name==="ConfigNotFoundError"){if(N)throw R;h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:[`No configuration file found for "${e.name||"config"}", using defaults with environment variables`]}}else if(R instanceof Error&&R.name==="ConfigLoadError"){let A=R.message.includes("EACCES")||R.message.includes("EPERM")||R.message.includes("permission denied"),S=!A&&(R.message.includes("syntax")||R.message.includes("Expected")||R.message.includes("Unexpected")||R.message.includes("BuildMessage")||R.message.includes("errors building")),L=R.message.includes("Configuration must export a valid object")||R.message.includes("Configuration file is empty and exports nothing");if(N&&(L||A))throw R;if(S&&(!N||!L))h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:["Configuration file has syntax errors, using defaults with environment variables"]};else if(!N)h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:[`Configuration loading error, using defaults: ${R.message}`]};else throw R}else h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:[`Configuration loading failed, using defaults: ${R instanceof Error?R.message:String(R)}`]}}if(_||d)await this.validateConfiguration(h.config,_,d,e.name);if(t?.enabled&&h)this.cacheResult(e.name||"",h,t,e);if(T?.enabled){let R={operation:"loadConfig",duration:Date.now()-r,configName:e.name,timestamp:new Date};if(T.onMetrics)T.onMetrics(R);if(T.slowThreshold&&R.duration>T.slowThreshold)W_.warn(`Slow configuration loading detected: ${R.duration}ms for ${e.name}`);h.metrics=R}return h}catch(h){if(h instanceof Error&&h.name==="ConfigNotFoundError")throw h;let R=Date.now()-r;throw W_.error(`Configuration loading failed after ${R}ms:`,[h instanceof Error?h:Error(String(h))]),h}}async loadConfigurationStrategies(E,r=!1,t){let{name:T="",alias:_,cwd:d,configDir:e,defaultConfig:h,checkEnv:R=!0,arrayStrategy:N="replace",verbose:A=!1}=E,S=d||$O.cwd(),L=[],O=await this.loadLocalConfiguration(T,_,S,e,h,N,A,R,t);if(O)return L.push(...this.getLocalSearchPaths(T,_,S,e)),this.finalizeResult(O,L,R,T,A);let I=await this.loadHomeConfiguration(T,_,h,N,A,R);if(I)return L.push(...this.getHomeSearchPaths(T,_)),this.finalizeResult(I,L,R,T,A);let D=await this.loadPackageJsonConfiguration(T,_,S,h,N,A,R);if(D)return L.push(ZT(S,"package.json")),this.finalizeResult(D,L,R,T,A);if(L.push(...this.getAllSearchPaths(T,_,S,e)),r)throw uR.configNotFound(T,L,_);return{...await this.applyEnvironmentVariables(T,h,R,A),warnings:[`No configuration file found for "${T}"${MV(_)}, using defaults with environment variables`]}}async loadLocalConfiguration(E,r,t,T,_,d,e,h,R){let N=h?p0(E,_,e):_,A=this.getLocalDirectories(t,T);for(let S of A){if(e)W_.info(`Searching for configuration in: ${S}`);let L=this.fileLoader.generateConfigPaths(E,S,r),O=await this.fileLoader.tryLoadFromPaths(L,N,{arrayStrategy:d,verbose:e,cacheTtl:R?.ttl,useCache:!R?.ttl||R.ttl>100});if(O){if(e)W_.success(`Configuration loaded from: ${O.source.path}`);return O}}return null}async loadHomeConfiguration(E,r,t,T,_,d){if(!E)return null;let e=d?p0(E,t,_):t,h=[ZT(QR(),".config",E),ZT(QR(),".config"),QR()];for(let R of h){if(_)W_.info(`Checking home directory: ${R}`);let N=this.fileLoader.generateConfigPaths(E,R,r),A=await this.fileLoader.tryLoadFromPaths(N,e,{arrayStrategy:T,verbose:_});if(A){if(_)W_.success(`Configuration loaded from home directory: ${A.source.path}`);return A}}return null}async loadPackageJsonConfiguration(E,r,t,T,_,d,e){let h=e?p0(E,T,d):T;try{let R=ZT(t,"package.json");if(!B8(R))return null;let N={};try{N=JSON.parse(W8(R,"utf8"))}catch(L){if(d)W_.warn("Failed to parse package.json:",[L instanceof Error?L:Error(String(L))]);return null}let A=N[E],S=E;if(!A&&r){let L=Array.isArray(r)?r:[r];for(let O of L){if(!O)continue;if(N[O]){A=N[O],S=O;break}}}if(A&&typeof A==="object"&&!Array.isArray(A)){if(d)W_.success(`Configuration loaded from package.json: ${S}`);return{config:_z(h,A,_),source:{type:"package.json",path:R,priority:30,timestamp:new Date}}}}catch(R){if(d)W_.warn("Failed to load package.json:",[R instanceof Error?R:Error(String(R))])}return null}async applyEnvironmentVariables(E,r,t,T){if(!t||!E||typeof r!=="object"||r===null||Array.isArray(r))return{config:r,source:{type:"default",priority:10,timestamp:new Date}};return{config:p0(E,r,T),source:{type:"environment",priority:20,timestamp:new Date}}}async finalizeResult(E,r,t,T,_){return{config:E.config,source:E.source,path:E.source.path}}async validateConfiguration(E,r,t,T){let _=[];if(t){let d=t(E);if(d)_.push(...d)}if(r){let d=await this.validator.validateConfiguration(E,r);if(!d.isValid)_.push(...d.errors.map((e)=>e.path?`${e.path}: ${e.message}`:e.message))}if(_.length>0)throw uR.configValidation(T||"unknown",_,T)}checkCache(E,r){let t=this.generateCacheKey(E,r);return _O.get(t)||null}cacheResult(E,r,t,T){let _=this.generateCacheKey(E,T);_O.set(_,r,void 0,t.ttl)}generateCacheKey(E,r){let t=[E];if(r.alias){let T=Array.isArray(r.alias)?r.alias.join(","):r.alias;t.push(`alias:${T}`)}if(r.cwd)t.push(`cwd:${r.cwd}`);if(r.configDir)t.push(`configDir:${r.configDir}`);if("checkEnv"in r)t.push(`checkEnv:${r.checkEnv}`);return t.join("|")}getLocalDirectories(E,r){return Array.from(new Set([E,ZT(E,"config"),ZT(E,".config"),r?ZT(E,r):void 0].filter(Boolean)))}getAllSearchPaths(E,r,t,T){let _=[];return _.push(...this.getLocalSearchPaths(E,r,t,T)),_.push(...this.getHomeSearchPaths(E,r)),_.push(ZT(t,"package.json")),_}getLocalSearchPaths(E,r,t,T){let _=this.getLocalDirectories(t,T),d=[];for(let e of _)d.push(...this.fileLoader.generateConfigPaths(E,e,r));return d}getHomeSearchPaths(E,r){if(!E)return[];let t=[ZT(QR(),".config",E),ZT(QR(),".config"),QR()],T=[];for(let _ of t)T.push(...this.fileLoader.generateConfigPaths(E,_,r));return T}async loadConfigWithResult(E){return this.loadConfig(E)}}var qD=new hz;async function Rz(E){let r="defaultConfig"in E&&E.defaultConfig!==void 0?E.defaultConfig:{},t="cache"in E||"performance"in E||"schema"in E||"validate"in E;try{let T;if(t)T=await qD.loadConfig(E);else T=await qD.loadConfig({...E,defaultConfig:r,cache:{enabled:!0},performance:{enabled:!1}});return T?.config??r}catch(T){let _=T instanceof Error?T.name:"UnknownError",d=T instanceof Error?T.message:String(T);if(!(_==="ConfigNotFoundError"||_==="ConfigLoadError"||_==="ConfigValidationError"||d.includes("config"))&&E.verbose)W_.warn("Unexpected error loading config, using defaults:",[T instanceof Error?T:Error(String(T))]);let h=t?{...E,defaultConfig:r}:{...E,defaultConfig:r,cache:{enabled:!0},performance:{enabled:!1}};if("checkEnv"in E?E.checkEnv!==!1:!0)return(await qD.applyEnvironmentVariables(h.name||"",r,!0,h.verbose||!1))?.config??r;return r}}function p0(E,r,t=!1){let T=new R$,_=E.toUpperCase().replace(/[^A-Z0-9]/g,"_");function d(e,h=[]){let R={...e};for(let[N,A]of Object.entries(e)){let S=[...h,N],L=[`${_}_${S.join("_").toUpperCase()}`,`${_}_${S.map((D)=>D.toUpperCase()).join("")}`,`${_}_${S.map((D)=>D.replace(/([A-Z])/g,"_$1").toUpperCase()).join("")}`],O,I;for(let D of L)if(O=$O.env[D],O!==void 0){I=D;break}if(O!==void 0&&I)if(typeof A==="boolean")R[N]=["true","1","yes"].includes(O.toLowerCase());else if(typeof A==="number"){let D=Number(O);if(!Number.isNaN(D))R[N]=D}else if(Array.isArray(A))try{R[N]=JSON.parse(O)}catch{R[N]=O.split(",").map((D)=>D.trim())}else R[N]=O;else if(A&&typeof A==="object"&&!Array.isArray(A))R[N]=d(A,S)}return R}return d(r)}var IrE=ZT($O.cwd(),"config"),UrE=ZT($O.cwd(),"src/generated");var Az={project:{name:"my-project",slug:"my-project",region:"us-east-1"},environments:{production:{type:"production"}}},nR=null;function KV(E){return E.project?.slug===Az.project?.slug&&Object.keys(E.environments??{}).length===1&&!!E.environments?.production}async function ZV(){let E=[Nz(process.cwd(),"config","cloud.ts"),Nz(process.cwd(),"config","cloud.js")];for(let r of E){if(!VV(r))continue;let t=await import(`${PV(r).href}?t=${Date.now()}`),T=t.tsCloud??t.default?.tsCloud??t.default??t.cloud??t.config;if(T)return T}return null}async function gV(){if(!nR){if(nR=await Rz({name:"cloud",defaultConfig:Az}),KV(nR))nR=await ZV()??nR}return nR}var JO=gV;H_();async function tE(){let E=await JO();if(!E.project)throw Error("Missing required project configuration in cloud.config.ts");return E}function DT(E){if(E)switch(E.toLowerCase()){case"porkbun":{let T=process.env.PORKBUN_API_KEY,_=process.env.PORKBUN_SECRET_KEY;if(!T||!_)throw Error("PORKBUN_API_KEY and PORKBUN_SECRET_KEY environment variables are required for Porkbun provider");return{provider:"porkbun",apiKey:T,secretKey:_}}case"godaddy":{let T=process.env.GODADDY_API_KEY,_=process.env.GODADDY_API_SECRET;if(!T||!_)throw Error("GODADDY_API_KEY and GODADDY_API_SECRET environment variables are required for GoDaddy provider");let d=process.env.GODADDY_ENVIRONMENT||"production";return{provider:"godaddy",apiKey:T,apiSecret:_,environment:d}}case"route53":{let T=process.env.AWS_REGION||"us-east-1",_=process.env.AWS_HOSTED_ZONE_ID;return{provider:"route53",region:T,hostedZoneId:_}}case"cloudflare":{let T=process.env.CLOUDFLARE_API_TOKEN;if(!T)throw Error("CLOUDFLARE_API_TOKEN environment variable is required for Cloudflare provider");return{provider:"cloudflare",apiToken:T}}default:throw Error(`Unknown DNS provider: ${E}. Supported: porkbun, godaddy, route53, cloudflare`)}if(new lA().loadFromEnv().getAllProviders().length===0)return null;if(process.env.PORKBUN_API_KEY&&process.env.PORKBUN_SECRET_KEY)return{provider:"porkbun",apiKey:process.env.PORKBUN_API_KEY,secretKey:process.env.PORKBUN_SECRET_KEY};if(process.env.GODADDY_API_KEY&&process.env.GODADDY_API_SECRET)return{provider:"godaddy",apiKey:process.env.GODADDY_API_KEY,apiSecret:process.env.GODADDY_API_SECRET,environment:process.env.GODADDY_ENVIRONMENT||"production"};if(process.env.AWS_ACCESS_KEY_ID||process.env.AWS_REGION)return{provider:"route53",region:process.env.AWS_REGION||"us-east-1",hostedZoneId:process.env.AWS_HOSTED_ZONE_ID};if(process.env.CLOUDFLARE_API_TOKEN)return{provider:"cloudflare",apiToken:process.env.CLOUDFLARE_API_TOKEN};return null}function f_(E){let r=DT(E);if(!r)throw Error("No DNS provider configured. Set environment variables for Porkbun (PORKBUN_API_KEY, PORKBUN_SECRET_KEY), GoDaddy (GODADDY_API_KEY, GODADDY_API_SECRET), Cloudflare (CLOUDFLARE_API_TOKEN), or Route53 (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)");return zt(r)}async function nV(E){let r=await tE(),t=mE(process.cwd(),r),T=E??Object.keys(r.environments??{})[0]??"production",_=t.environments.get(T);if(!_)throw t.store.close(),Error(`Environment ${T} was not found.`);let d=r.project?.region??"us-east-1",e=Gr(process.cwd()),h=new wR(t.store),R=new zR(h,{encryptionKey:e,backends:[new ee(t.store,e),new CR(new ct(d),d),new XR(new Td(d),d),new JR]}),N=t.store.getActorByExternalId("system","cli")??t.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});return await fA(R,t,r,N.id),{config:r,controlPlane:t,env:T,environmentRecord:_,store:h,service:R,actor:N}}async function Y_(E,r){let t=await nV(E);try{return await r(t)}finally{t.controlPlane.store.close()}}async function xT(E){try{await E()}catch(r){Y(r instanceof Error?r.message:String(r))}}function vV(E){return E.map((r)=>[r.key,r.kind,r.scope.type,r.inherited?"inherited":r.overridden?"override":"direct",r.kind==="secret"?r.backend??"restricted":r.value??"",r.backendVersion??"—",r.required?"required":"optional",r.updatedAt])}function cz(E,r=process.env){if(E.value!=null)throw Error("Secret values are not accepted in command arguments; use --from-env or the interactive prompt.");if(!E.fromEnv)return;let t=r[E.fromEnv];if(!t)throw Error(`${E.fromEnv} is empty or unavailable.`);return t}function d_(E,r){let t=r.scope??"environment";if(t==="project")return{type:t,id:E.controlPlane.project.id};if(t==="environment"){let T=r.target?E.controlPlane.store.listEnvironments(E.controlPlane.project.id).find((_)=>_.id===r.target||_.slug===r.target):E.environmentRecord;if(!T)throw Error(`Environment ${r.target} was not found.`);return{type:t,id:T.id,environmentId:T.id}}if(t==="service"){let T=E.controlPlane.store.listResources(E.controlPlane.project.id),_=T.find((d)=>d.id===r.target||d.slug===r.target);if(!_)throw Error("Service scope requires --target with a resource ID or slug.");return{type:t,id:_.id,environmentId:_.environmentId,resourceId:_.id}}if(t==="function"){let T=E.controlPlane.store.listResources(E.controlPlane.project.id),_=T.find((d)=>d.kind==="function"&&(d.id===r.target||d.slug===r.target));if(!_)throw Error("Function scope requires --target with a function resource ID or slug.");return{type:t,id:_.id,environmentId:_.environmentId,resourceId:_.id}}if(t==="preview"){let T=new B_(E.controlPlane.store).listInstances({projectId:E.controlPlane.project.id}).find((_)=>_.id===r.target||_.name===r.target);if(!T)throw Error("Preview scope requires --target with a preview ID or name.");return{type:t,id:T.id,environmentId:T.baseEnvironmentId,resourceId:T.resourceId,previewId:T.id}}throw Error("--scope must be project, environment, service, function, or preview.")}function S$(E){let r=E??"local_encrypted";if(!["local_encrypted","aws_secrets_manager","aws_ssm","external"].includes(r))throw Error("--backend must be local_encrypted, aws_secrets_manager, aws_ssm, or external.");return r}function vR(E,r,t){let T=E.store.find(E.controlPlane.project.id,t,r);if(!T)throw Error(`${r} was not found in the selected scope.`);return T}async function lV(E,r){if(E==="secret")return cz(r)??await Ar("Enter secret value (input is write-only)","");if(r.fromEnv){let t=process.env[r.fromEnv];if(t==null)throw Error(`${r.fromEnv} is unavailable.`);return t}if(r.value!=null)return r.value;return await Ar("Enter variable value","")}function Q_(E){return E.option("--env <environment>","Dashboard environment").option("--scope <scope>","project, environment, service, function, or preview",{default:"environment"}).option("--target <id>","Environment, resource, function, or preview ID/name")}function L$(E){E.command("config","Show validated file configuration").action(async()=>xT(async()=>{let r=await tE();console.log(JSON.stringify(r,null,2))})),E.command("config:validate","Validate configuration file").action(async()=>xT(async()=>{let r=await tE();if(!r.project?.name||!r.project?.slug||!r.mode)throw Error("project.name, project.slug, and mode are required.");K(`Configuration is valid: ${r.project.name} · ${r.mode} · ${r.project.region||"us-east-1"}`)})),Q_(E.command("config:list","List scoped variables and write-only secret metadata")).option("--kind <kind>","variable or secret").option("--search <text>","Filter key names").option("--json","Print structured JSON").action(async(r)=>xT(async()=>Y_(r.env,async(t)=>{let T=d_(t,r),_=["variable","secret"].includes(r.kind??"")?r.kind:void 0,d=t.service.list({projectId:t.controlPlane.project.id,scope:T,kind:_,search:r.search,canReadSecretMetadata:!0});if(r.json)console.log(JSON.stringify(d,null,2));else TE(["Key","Kind","Scope","Precedence","Value/backend","Backend version","Requirement","Updated"],vV(d))}))),Q_(E.command("config:set <key>","Create or replace a scoped variable or secret")).option("--value <value>","Plaintext variable value only").option("--from-env <name>","Read the value from an environment variable").option("--secret","Store a write-only secret").option("--backend <backend>","local_encrypted, aws_secrets_manager, aws_ssm, or external").option("--reference <uri>","External provider reference").option("--required","Fail deployments when unavailable").option("--confirm <key>","Exact key confirmation for production replacements").option("--json","Print structured JSON").action(async(r,t)=>xT(async()=>Y_(t.env,async(T)=>{let _=d_(T,t),d=t.secret?"secret":"variable",e=d==="secret"?S$(t.backend):void 0,h=e==="external"?void 0:await lV(d,t),R=await T.service.set({organizationId:T.controlPlane.organization.id,projectId:T.controlPlane.project.id,scope:_,key:r,kind:d,value:h,reference:t.reference,backend:e,required:!!t.required,confirmed:t.confirm===r,actorId:T.actor.id,idempotencyKey:`cli:${crypto.randomUUID()}`});if(t.json)console.log(JSON.stringify({entry:T.service.list({projectId:T.controlPlane.project.id,scope:_,canReadSecretMetadata:!0}).find((N)=>N.id===R.entry.id),mutation:R.mutation,warnings:R.warnings},null,2));else K(`${r}: ${R.mutation.added.length?"created":R.mutation.changed.length?"updated":"unchanged"}; ${R.mutation.affectedResourceIds.length} affected service(s).`)}))),Q_(E.command("config:delete <key>","Delete a scoped variable or secret")).option("--confirm <key>","Exact key confirmation").action(async(r,t)=>xT(async()=>Y_(t.env,async(T)=>{let _=vR(T,r,d_(T,t));await T.service.remove({entryId:_.id,expectedVersion:_.version,confirmed:t.confirm===r,actorId:T.actor.id}),K(`Deleted ${r}.`)}))),Q_(E.command("config:import <file>","Validate and import a dotenv file")).option("--secret-keys <keys>","Comma-separated secret keys").option("--backend <backend>","Secret backend").option("--confirm <word>","Use import for production replacement confirmation").option("--json","Print structured JSON").action(async(r,t)=>xT(async()=>Y_(t.env,async(T)=>{let _=await T.service.importDotenv({organizationId:T.controlPlane.organization.id,projectId:T.controlPlane.project.id,scope:d_(T,t),source:await Oz(FO(r),"utf8"),secretKeys:t.secretKeys?.split(",").map((d)=>d.trim()).filter(Boolean),backend:S$(t.backend),confirmed:t.confirm==="import",actorId:T.actor.id,idempotencyKey:`cli-import:${crypto.randomUUID()}`});if(!_.document.valid)throw Error(_.document.diagnostics.map((d)=>`line ${d.line}: ${d.message}`).join(`
+`;return t}}function BV(E,r,t={}){return tz(E,r,t,new WeakMap)}function tz(E,r,t,T){let{arrayMergeMode:_="replace",skipNullish:d=!1,customMerger:e}=t;if(r===null||r===void 0)return d?E:r;if(e){let h=e(E,r);if(h!==void 0)return h}if(Array.isArray(r)||Array.isArray(E))return Tz(E,r,_,T);if(!qT(r)||!qT(E))return r;return YV(E,r,t,T)}function Tz(E,r,t,T){if(Array.isArray(r)&&!Array.isArray(E))return r;if(Array.isArray(E)&&!Array.isArray(r))return r;if(Array.isArray(r)&&Array.isArray(E))switch(t){case"replace":return r;case"concat":return WV(E,r);case"smart":return HV(E,r,T);default:return r}return r}function WV(E,r){let t=[...r];for(let T of E)if(!t.some((_)=>pD(_,T)))t.push(T);return t}function HV(E,r,t){if(r.length===0)return E;if(E.length===0)return r;if(qT(r[0])&&qT(E[0]))return fV(E,r,t);if(r.every((T)=>typeof T==="string")&&E.every((T)=>typeof T==="string")){let T=[...r];for(let _ of E)if(!T.includes(_))T.push(_);return T}return r}function fV(E,r,t){let T=[...r];for(let _ of E){if(!qT(_)){T.push(_);continue}let d=["id","name","key","path","type"],e=!1;for(let h of d)if(h in _){if(T.find((N)=>qT(N)&&(h in N)&&N[h]===_[h])){e=!0;break}}if(!e)T.push(_)}return T}function YV(E,r,t,T){let _=r;if(qT(_)&&T.has(_))return T.get(_);let d={...E};if(qT(_))T.set(_,d);for(let e in _){if(!Object.prototype.hasOwnProperty.call(_,e))continue;let h=_[e],R=d[e];if(t.skipNullish&&(h===null||h===void 0))continue;if(h===null||h===void 0){d[e]=h;continue}if(qT(h)&&qT(R))d[e]=tz(R,h,t,T);else if(Array.isArray(h)||Array.isArray(R))d[e]=Tz(R,h,t.arrayMergeMode||"smart",T);else d[e]=h}return d}function _z(E,r,t="replace"){return BV(E,r,{arrayMergeMode:t==="replace"?"replace":"smart",skipNullish:!0})}function pD(E,r){if(E===r)return!0;if(Array.isArray(E)&&Array.isArray(r)){if(E.length!==r.length)return!1;for(let t=0;t<E.length;t++)if(!pD(E[t],r[t]))return!1;return!0}if(qT(E)&&qT(r)){let t=Object.keys(E),T=Object.keys(r);if(t.length!==T.length)return!1;for(let _ of t){if(!Object.prototype.hasOwnProperty.call(r,_))return!1;if(!pD(E[_],r[_]))return!1}return!0}return!1}function qT(E){return Boolean(E&&typeof E==="object"&&!Array.isArray(E))}class dz{extensions=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];async loadFromPath(E,r,t={}){let{arrayStrategy:T="replace",useCache:_=!0,cacheTtl:d,trackPerformance:e=!0,verbose:h=!1}=t;if(_){let N=_O.getWithFileCheck("file",E);if(N){if(h)console.log(`Configuration loaded from cache: ${E}`);return N}}let R=async()=>{if(!s0(E))return null;try{let N=`?t=${Date.now()}`,A=await import(E+N),S=A.default||A,L="default"in A,O=Object.keys(A).length>0;if(!L&&!O)throw new UO(E,Error("Configuration file is empty and exports nothing"),"unknown");if(typeof S!=="object"||S===null||Array.isArray(S))throw new UO(E,Error("Configuration must export a valid object"),"unknown");let $={config:_z(r,S,T),source:{type:"file",path:E,priority:100,timestamp:new Date}};if(_)_O.setWithFileCheck("file",$,E,d);return $}catch(N){throw N instanceof Error?uR.configLoad(E,N):uR.configLoad(E,Error(String(N)))}};if(e)return oD.track("loadFromPath",R,{path:E});return R()}async tryLoadFromPaths(E,r,t={}){for(let T of E)try{let _=await this.loadFromPath(T,r,t);if(_)return _}catch(_){if(_ instanceof Error&&_.name==="ConfigLoadError")throw _;if(t.verbose)console.warn(`Failed to load config from ${T}:`,_)}return null}generateConfigPaths(E,r,t){let T=this.generateNamePatterns(E,t),_=[];for(let d of T)for(let e of this.extensions)_.push(gD(r,`${d}${e}`));return _}generateNamePatterns(E,r){let t=[];if(t.push("config",".config"),E)t.push(E,`.${E}.config`,`${E}.config`,`.${E}`);let T=r===void 0?[]:Array.isArray(r)?r:[r];for(let d of T){if(!d)continue;if(t.push(d,`.${d}.config`,`${d}.config`,`.${d}`),E)t.push(`${E}.${d}.config`,`.${E}.${d}.config`)}let _=new Set;return t.filter((d)=>{if(!d||_.has(d))return!1;return _.add(d),!0})}checkFileAccess(E){return zV(async()=>{return s0(E)},{maxRetries:2,retryDelay:100,fallback:!1})}async discoverConfigFiles(E,r,t){let T=[];if(!s0(E))return T;if(r||t){let _=this.generateNamePatterns(r||"",t);for(let d of _)for(let e of this.extensions){let h=gD(E,`${d}${e}`);if(await this.checkFileAccess(h))T.push(h)}}else try{let{readdirSync:_}=await import("fs"),d=_(E);for(let e of d)if(this.looksLikeConfigFile(e)){let h=gD(E,e);if(await this.checkFileAccess(h))T.push(h)}}catch{return[]}return T}looksLikeConfigFile(E){return[/\.config\.(ts|js|mjs|cjs|json|mts|cts)$/,/^\..*\.(ts|js|mjs|cjs|json|mts|cts)$/,/config\.(ts|js|mjs|cjs|json|mts|cts)$/].some((t)=>t.test(E))}async validateConfigFile(E){let r=[];try{if(!s0(E))return r.push("Configuration file does not exist"),r;let t=await import(E),T=t.default||t;if(T===void 0)r.push("Configuration file must export a default value or named exports");else if(typeof T!=="object"||T===null)r.push("Configuration must be an object");else if(Array.isArray(T))r.push("Configuration cannot be an array at the root level");if(E.endsWith(".json"))try{let{readFileSync:_}=await import("fs"),d=_(E,"utf8");JSON.parse(d)}catch(_){r.push(`Invalid JSON syntax: ${_}`)}}catch(t){r.push(`Failed to load configuration file: ${t}`)}return r}async getFileModificationTime(E){try{let{statSync:r}=await import("fs");return r(E).mtime}catch{return null}}async preloadConfigurations(E,r={}){let t=new Map;return await Promise.allSettled(E.map(async(T)=>{try{let _=await this.loadFromPath(T,{},r);if(_)t.set(T,_.config)}catch(_){if(r.verbose)console.warn(`Failed to preload ${T}:`,_)}})),t}}var GV=/^https?:\/\//;class ez{async validateConfiguration(E,r,t={}){let{stopOnFirstError:T=!1,validateRequired:_=!0,validateTypes:d=!0,customRules:e=[],trackPerformance:h=!0,verbose:R=!1}=t,N=async()=>{let A=[],S=[],L={stopOnFirstError:T,validateRequired:_,validateTypes:d,customRules:e,trackPerformance:h,verbose:R};try{if(typeof r==="string")return await this.validateWithSchemaFile(E,r,L);else if(Array.isArray(r))return this.validateWithRules(E,[...r,...e],L);else return this.validateWithJSONSchema(E,r,L)}catch(O){return A.push({path:"",message:`Validation failed: ${O}`,rule:"system"}),{isValid:!1,errors:A,warnings:S}}};if(h)return await oD.track("validateConfiguration",N);return N()}async validateWithSchemaFile(E,r,t){try{if(!QV(r))throw new DO(r,[{path:"",message:"Schema file does not exist"}]);let T=await import(r),_=T.default||T;if(Array.isArray(_))return this.validateWithRules(E,_,t);else return this.validateWithJSONSchema(E,_,t)}catch(T){throw new DO(r,[{path:"",message:`Failed to load schema: ${T}`}])}}validateWithJSONSchema(E,r,t){let T=[],_=[];return this.validateObjectAgainstSchema(E,r,"",T,_,t),{isValid:T.length===0,errors:T,warnings:_}}validateObjectAgainstSchema(E,r,t,T,_,d){if(d.validateTypes&&r.type){let e=Array.isArray(E)?"array":typeof E,h=Array.isArray(r.type)?r.type:[r.type];if(!h.includes(e)){if(T.push({path:t,message:`Expected type ${h.join(" or ")}, got ${e}`,expected:h.join(" or "),actual:e,rule:"type"}),d.stopOnFirstError)return}}if(r.enum&&!r.enum.includes(E)){if(T.push({path:t,message:`Value must be one of: ${r.enum.join(", ")}`,expected:r.enum.join(", "),actual:E,rule:"enum"}),d.stopOnFirstError)return}if(typeof E==="string"){if(r.minLength!==void 0&&E.length<r.minLength)T.push({path:t,message:`String length must be at least ${r.minLength}`,expected:`>= ${r.minLength}`,actual:E.length,rule:"minLength"});if(r.maxLength!==void 0&&E.length>r.maxLength)T.push({path:t,message:`String length must not exceed ${r.maxLength}`,expected:`<= ${r.maxLength}`,actual:E.length,rule:"maxLength"});if(r.pattern){if(!new RegExp(r.pattern).test(E))T.push({path:t,message:`String does not match pattern ${r.pattern}`,expected:r.pattern,actual:E,rule:"pattern"})}}if(typeof E==="number"){if(r.minimum!==void 0&&E<r.minimum)T.push({path:t,message:`Value must be at least ${r.minimum}`,expected:`>= ${r.minimum}`,actual:E,rule:"minimum"});if(r.maximum!==void 0&&E>r.maximum)T.push({path:t,message:`Value must not exceed ${r.maximum}`,expected:`<= ${r.maximum}`,actual:E,rule:"maximum"})}if(Array.isArray(E)&&r.items)for(let e=0;e<E.length;e++){let h=t?`${t}[${e}]`:`[${e}]`;if(this.validateObjectAgainstSchema(E[e],r.items,h,T,_,d),d.stopOnFirstError&&T.length>0)return}if(E&&typeof E==="object"&&!Array.isArray(E)){let e=E;if(d.validateRequired&&r.required){for(let h of r.required)if(!(h in e)){if(T.push({path:t?`${t}.${h}`:h,message:`Missing required property '${h}'`,expected:"required",rule:"required"}),d.stopOnFirstError)return}}if(r.properties){for(let[h,R]of Object.entries(r.properties))if(h in e){let N=t?`${t}.${h}`:h;if(this.validateObjectAgainstSchema(e[h],R,N,T,_,d),d.stopOnFirstError&&T.length>0)return}}if(r.additionalProperties===!1){let h=new Set(Object.keys(r.properties||{}));for(let R of Object.keys(e))if(!h.has(R))_.push({path:t?`${t}.${R}`:R,message:`Additional property '${R}' is not allowed`,rule:"additionalProperties"})}}}validateWithRules(E,r,t){let T=[],_=[];for(let d of r)try{let e=this.getValueByPath(E,d.path),h=this.validateWithRule(e,d,d.path);if(T.push(...h),t.stopOnFirstError&&T.length>0)break}catch(e){T.push({path:d.path,message:`Rule validation failed: ${e}`,rule:"system"})}return{isValid:T.length===0,errors:T,warnings:_}}validateWithRule(E,r,t){let T=[];if(r.required&&(E===void 0||E===null))return T.push({path:t,message:r.message||`Property '${t}' is required`,expected:"required",rule:"required"}),T;if(E===void 0||E===null)return T;if(r.type){let _=Array.isArray(E)?"array":typeof E;if(_!==r.type)T.push({path:t,message:r.message||`Expected type ${r.type}, got ${_}`,expected:r.type,actual:_,rule:"type"})}if(r.min!==void 0){let _=Array.isArray(E)?E.length:typeof E==="string"?E.length:typeof E==="number"?E:0;if(_<r.min)T.push({path:t,message:r.message||`Value must be at least ${r.min}`,expected:`>= ${r.min}`,actual:_,rule:"min"})}if(r.max!==void 0){let _=Array.isArray(E)?E.length:typeof E==="string"?E.length:typeof E==="number"?E:0;if(_>r.max)T.push({path:t,message:r.message||`Value must not exceed ${r.max}`,expected:`<= ${r.max}`,actual:_,rule:"max"})}if(r.pattern&&typeof E==="string"){if(!r.pattern.test(E))T.push({path:t,message:r.message||`Value does not match pattern ${r.pattern}`,expected:r.pattern.toString(),actual:E,rule:"pattern"})}if(r.enum&&!r.enum.includes(E))T.push({path:t,message:r.message||`Value must be one of: ${r.enum.join(", ")}`,expected:r.enum.join(", "),actual:E,rule:"enum"});if(r.validator){let _=r.validator(E);if(_)T.push({path:t,message:r.message||_,rule:"custom"})}return T}getValueByPath(E,r){if(!r)return E;let t=r.split("."),T=E;for(let _ of t)if(T&&typeof T==="object"&&_ in T)T=T[_];else return;return T}generateRulesFromInterface(E){let r=[],t=E.matchAll(/(\w+)(\?)?:\s*(\w+)/g);for(let T of t){let[,_,d,e]=T;r.push({path:_,required:!d,type:this.mapTypeScriptType(e)})}return r}mapTypeScriptType(E){switch(E.toLowerCase()){case"string":return"string";case"number":return"number";case"boolean":return"boolean";case"array":return"array";case"object":return"object";default:return"object"}}static createCommonRules(){return{server:[{path:"port",required:!0,type:"number",min:1,max:65535},{path:"host",required:!0,type:"string",min:1},{path:"ssl",type:"boolean"}],database:[{path:"url",required:!0,type:"string",min:1},{path:"pool",type:"number",min:1,max:100},{path:"timeout",type:"number",min:0}],api:[{path:"baseUrl",required:!0,type:"string",pattern:GV},{path:"timeout",type:"number",min:0},{path:"retries",type:"number",min:0,max:10}]}}}var W_=new XO("bunfig",{showTags:!0});function MV(E){if(!E)return"";let r=Array.isArray(E)?E.filter(Boolean):[E];if(r.length===0)return"";if(r.length===1)return` or alias "${r[0]}"`;return` or aliases ${r.map((t)=>`"${t}"`).join(", ")}`}class hz{fileLoader=new dz;envProcessor=new R$;validator=new ez;async loadConfig(E){let r=Date.now(),{cache:t,performance:T,schema:_,validate:d,...e}=E;try{if(t?.enabled){let R=this.checkCache(e.name||"",e);if(R)return R}let h;try{h=await this.loadConfigurationStrategies(e,!0,t)}catch(R){let N=e.__strictErrorHandling;if(R instanceof Error&&R.name==="ConfigNotFoundError"){if(N)throw R;h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:[`No configuration file found for "${e.name||"config"}", using defaults with environment variables`]}}else if(R instanceof Error&&R.name==="ConfigLoadError"){let A=R.message.includes("EACCES")||R.message.includes("EPERM")||R.message.includes("permission denied"),S=!A&&(R.message.includes("syntax")||R.message.includes("Expected")||R.message.includes("Unexpected")||R.message.includes("BuildMessage")||R.message.includes("errors building")),L=R.message.includes("Configuration must export a valid object")||R.message.includes("Configuration file is empty and exports nothing");if(N&&(L||A))throw R;if(S&&(!N||!L))h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:["Configuration file has syntax errors, using defaults with environment variables"]};else if(!N)h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:[`Configuration loading error, using defaults: ${R.message}`]};else throw R}else h={...await this.applyEnvironmentVariables(e.name||"",e.defaultConfig,e.checkEnv!==!1,e.verbose||!1),warnings:[`Configuration loading failed, using defaults: ${R instanceof Error?R.message:String(R)}`]}}if(_||d)await this.validateConfiguration(h.config,_,d,e.name);if(t?.enabled&&h)this.cacheResult(e.name||"",h,t,e);if(T?.enabled){let R={operation:"loadConfig",duration:Date.now()-r,configName:e.name,timestamp:new Date};if(T.onMetrics)T.onMetrics(R);if(T.slowThreshold&&R.duration>T.slowThreshold)W_.warn(`Slow configuration loading detected: ${R.duration}ms for ${e.name}`);h.metrics=R}return h}catch(h){if(h instanceof Error&&h.name==="ConfigNotFoundError")throw h;let R=Date.now()-r;throw W_.error(`Configuration loading failed after ${R}ms:`,[h instanceof Error?h:Error(String(h))]),h}}async loadConfigurationStrategies(E,r=!1,t){let{name:T="",alias:_,cwd:d,configDir:e,defaultConfig:h,checkEnv:R=!0,arrayStrategy:N="replace",verbose:A=!1}=E,S=d||$O.cwd(),L=[],O=await this.loadLocalConfiguration(T,_,S,e,h,N,A,R,t);if(O)return L.push(...this.getLocalSearchPaths(T,_,S,e)),this.finalizeResult(O,L,R,T,A);let I=await this.loadHomeConfiguration(T,_,h,N,A,R);if(I)return L.push(...this.getHomeSearchPaths(T,_)),this.finalizeResult(I,L,R,T,A);let D=await this.loadPackageJsonConfiguration(T,_,S,h,N,A,R);if(D)return L.push(ZT(S,"package.json")),this.finalizeResult(D,L,R,T,A);if(L.push(...this.getAllSearchPaths(T,_,S,e)),r)throw uR.configNotFound(T,L,_);return{...await this.applyEnvironmentVariables(T,h,R,A),warnings:[`No configuration file found for "${T}"${MV(_)}, using defaults with environment variables`]}}async loadLocalConfiguration(E,r,t,T,_,d,e,h,R){let N=h?p0(E,_,e):_,A=this.getLocalDirectories(t,T);for(let S of A){if(e)W_.info(`Searching for configuration in: ${S}`);let L=this.fileLoader.generateConfigPaths(E,S,r),O=await this.fileLoader.tryLoadFromPaths(L,N,{arrayStrategy:d,verbose:e,cacheTtl:R?.ttl,useCache:!R?.ttl||R.ttl>100});if(O){if(e)W_.success(`Configuration loaded from: ${O.source.path}`);return O}}return null}async loadHomeConfiguration(E,r,t,T,_,d){if(!E)return null;let e=d?p0(E,t,_):t,h=[ZT(QR(),".config",E),ZT(QR(),".config"),QR()];for(let R of h){if(_)W_.info(`Checking home directory: ${R}`);let N=this.fileLoader.generateConfigPaths(E,R,r),A=await this.fileLoader.tryLoadFromPaths(N,e,{arrayStrategy:T,verbose:_});if(A){if(_)W_.success(`Configuration loaded from home directory: ${A.source.path}`);return A}}return null}async loadPackageJsonConfiguration(E,r,t,T,_,d,e){let h=e?p0(E,T,d):T;try{let R=ZT(t,"package.json");if(!BM(R))return null;let N={};try{N=JSON.parse(WM(R,"utf8"))}catch(L){if(d)W_.warn("Failed to parse package.json:",[L instanceof Error?L:Error(String(L))]);return null}let A=N[E],S=E;if(!A&&r){let L=Array.isArray(r)?r:[r];for(let O of L){if(!O)continue;if(N[O]){A=N[O],S=O;break}}}if(A&&typeof A==="object"&&!Array.isArray(A)){if(d)W_.success(`Configuration loaded from package.json: ${S}`);return{config:_z(h,A,_),source:{type:"package.json",path:R,priority:30,timestamp:new Date}}}}catch(R){if(d)W_.warn("Failed to load package.json:",[R instanceof Error?R:Error(String(R))])}return null}async applyEnvironmentVariables(E,r,t,T){if(!t||!E||typeof r!=="object"||r===null||Array.isArray(r))return{config:r,source:{type:"default",priority:10,timestamp:new Date}};return{config:p0(E,r,T),source:{type:"environment",priority:20,timestamp:new Date}}}async finalizeResult(E,r,t,T,_){return{config:E.config,source:E.source,path:E.source.path}}async validateConfiguration(E,r,t,T){let _=[];if(t){let d=t(E);if(d)_.push(...d)}if(r){let d=await this.validator.validateConfiguration(E,r);if(!d.isValid)_.push(...d.errors.map((e)=>e.path?`${e.path}: ${e.message}`:e.message))}if(_.length>0)throw uR.configValidation(T||"unknown",_,T)}checkCache(E,r){let t=this.generateCacheKey(E,r);return _O.get(t)||null}cacheResult(E,r,t,T){let _=this.generateCacheKey(E,T);_O.set(_,r,void 0,t.ttl)}generateCacheKey(E,r){let t=[E];if(r.alias){let T=Array.isArray(r.alias)?r.alias.join(","):r.alias;t.push(`alias:${T}`)}if(r.cwd)t.push(`cwd:${r.cwd}`);if(r.configDir)t.push(`configDir:${r.configDir}`);if("checkEnv"in r)t.push(`checkEnv:${r.checkEnv}`);return t.join("|")}getLocalDirectories(E,r){return Array.from(new Set([E,ZT(E,"config"),ZT(E,".config"),r?ZT(E,r):void 0].filter(Boolean)))}getAllSearchPaths(E,r,t,T){let _=[];return _.push(...this.getLocalSearchPaths(E,r,t,T)),_.push(...this.getHomeSearchPaths(E,r)),_.push(ZT(t,"package.json")),_}getLocalSearchPaths(E,r,t,T){let _=this.getLocalDirectories(t,T),d=[];for(let e of _)d.push(...this.fileLoader.generateConfigPaths(E,e,r));return d}getHomeSearchPaths(E,r){if(!E)return[];let t=[ZT(QR(),".config",E),ZT(QR(),".config"),QR()],T=[];for(let _ of t)T.push(...this.fileLoader.generateConfigPaths(E,_,r));return T}async loadConfigWithResult(E){return this.loadConfig(E)}}var qD=new hz;async function Rz(E){let r="defaultConfig"in E&&E.defaultConfig!==void 0?E.defaultConfig:{},t="cache"in E||"performance"in E||"schema"in E||"validate"in E;try{let T;if(t)T=await qD.loadConfig(E);else T=await qD.loadConfig({...E,defaultConfig:r,cache:{enabled:!0},performance:{enabled:!1}});return T?.config??r}catch(T){let _=T instanceof Error?T.name:"UnknownError",d=T instanceof Error?T.message:String(T);if(!(_==="ConfigNotFoundError"||_==="ConfigLoadError"||_==="ConfigValidationError"||d.includes("config"))&&E.verbose)W_.warn("Unexpected error loading config, using defaults:",[T instanceof Error?T:Error(String(T))]);let h=t?{...E,defaultConfig:r}:{...E,defaultConfig:r,cache:{enabled:!0},performance:{enabled:!1}};if("checkEnv"in E?E.checkEnv!==!1:!0)return(await qD.applyEnvironmentVariables(h.name||"",r,!0,h.verbose||!1))?.config??r;return r}}function p0(E,r,t=!1){let T=new R$,_=E.toUpperCase().replace(/[^A-Z0-9]/g,"_");function d(e,h=[]){let R={...e};for(let[N,A]of Object.entries(e)){let S=[...h,N],L=[`${_}_${S.join("_").toUpperCase()}`,`${_}_${S.map((D)=>D.toUpperCase()).join("")}`,`${_}_${S.map((D)=>D.replace(/([A-Z])/g,"_$1").toUpperCase()).join("")}`],O,I;for(let D of L)if(O=$O.env[D],O!==void 0){I=D;break}if(O!==void 0&&I)if(typeof A==="boolean")R[N]=["true","1","yes"].includes(O.toLowerCase());else if(typeof A==="number"){let D=Number(O);if(!Number.isNaN(D))R[N]=D}else if(Array.isArray(A))try{R[N]=JSON.parse(O)}catch{R[N]=O.split(",").map((D)=>D.trim())}else R[N]=O;else if(A&&typeof A==="object"&&!Array.isArray(A))R[N]=d(A,S)}return R}return d(r)}var IrE=ZT($O.cwd(),"config"),UrE=ZT($O.cwd(),"src/generated");var Az={project:{name:"my-project",slug:"my-project",region:"us-east-1"},environments:{production:{type:"production"}}},nR=null;function KV(E){return E.project?.slug===Az.project?.slug&&Object.keys(E.environments??{}).length===1&&!!E.environments?.production}async function ZV(){let E=[Nz(process.cwd(),"config","cloud.ts"),Nz(process.cwd(),"config","cloud.js")];for(let r of E){if(!VV(r))continue;let t=await import(`${PV(r).href}?t=${Date.now()}`),T=t.tsCloud??t.default?.tsCloud??t.default??t.cloud??t.config;if(T)return T}return null}async function gV(){if(!nR){if(nR=await Rz({name:"cloud",defaultConfig:Az}),KV(nR))nR=await ZV()??nR}return nR}var JO=gV;H_();async function tE(){let E=await JO();if(!E.project)throw Error("Missing required project configuration in cloud.config.ts");return E}function DT(E){if(E)switch(E.toLowerCase()){case"porkbun":{let T=process.env.PORKBUN_API_KEY,_=process.env.PORKBUN_SECRET_KEY;if(!T||!_)throw Error("PORKBUN_API_KEY and PORKBUN_SECRET_KEY environment variables are required for Porkbun provider");return{provider:"porkbun",apiKey:T,secretKey:_}}case"godaddy":{let T=process.env.GODADDY_API_KEY,_=process.env.GODADDY_API_SECRET;if(!T||!_)throw Error("GODADDY_API_KEY and GODADDY_API_SECRET environment variables are required for GoDaddy provider");let d=process.env.GODADDY_ENVIRONMENT||"production";return{provider:"godaddy",apiKey:T,apiSecret:_,environment:d}}case"route53":{let T=process.env.AWS_REGION||"us-east-1",_=process.env.AWS_HOSTED_ZONE_ID;return{provider:"route53",region:T,hostedZoneId:_}}case"cloudflare":{let T=process.env.CLOUDFLARE_API_TOKEN;if(!T)throw Error("CLOUDFLARE_API_TOKEN environment variable is required for Cloudflare provider");return{provider:"cloudflare",apiToken:T}}default:throw Error(`Unknown DNS provider: ${E}. Supported: porkbun, godaddy, route53, cloudflare`)}if(new lA().loadFromEnv().getAllProviders().length===0)return null;if(process.env.PORKBUN_API_KEY&&process.env.PORKBUN_SECRET_KEY)return{provider:"porkbun",apiKey:process.env.PORKBUN_API_KEY,secretKey:process.env.PORKBUN_SECRET_KEY};if(process.env.GODADDY_API_KEY&&process.env.GODADDY_API_SECRET)return{provider:"godaddy",apiKey:process.env.GODADDY_API_KEY,apiSecret:process.env.GODADDY_API_SECRET,environment:process.env.GODADDY_ENVIRONMENT||"production"};if(process.env.AWS_ACCESS_KEY_ID||process.env.AWS_REGION)return{provider:"route53",region:process.env.AWS_REGION||"us-east-1",hostedZoneId:process.env.AWS_HOSTED_ZONE_ID};if(process.env.CLOUDFLARE_API_TOKEN)return{provider:"cloudflare",apiToken:process.env.CLOUDFLARE_API_TOKEN};return null}function f_(E){let r=DT(E);if(!r)throw Error("No DNS provider configured. Set environment variables for Porkbun (PORKBUN_API_KEY, PORKBUN_SECRET_KEY), GoDaddy (GODADDY_API_KEY, GODADDY_API_SECRET), Cloudflare (CLOUDFLARE_API_TOKEN), or Route53 (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)");return zt(r)}async function nV(E){let r=await tE(),t=mE(process.cwd(),r),T=E??Object.keys(r.environments??{})[0]??"production",_=t.environments.get(T);if(!_)throw t.store.close(),Error(`Environment ${T} was not found.`);let d=r.project?.region??"us-east-1",e=Gr(process.cwd()),h=new wR(t.store),R=new zR(h,{encryptionKey:e,backends:[new ee(t.store,e),new CR(new ct(d),d),new XR(new Td(d),d),new JR]}),N=t.store.getActorByExternalId("system","cli")??t.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});return await fA(R,t,r,N.id),{config:r,controlPlane:t,env:T,environmentRecord:_,store:h,service:R,actor:N}}async function Y_(E,r){let t=await nV(E);try{return await r(t)}finally{t.controlPlane.store.close()}}async function xT(E){try{await E()}catch(r){Y(r instanceof Error?r.message:String(r))}}function vV(E){return E.map((r)=>[r.key,r.kind,r.scope.type,r.inherited?"inherited":r.overridden?"override":"direct",r.kind==="secret"?r.backend??"restricted":r.value??"",r.backendVersion??"—",r.required?"required":"optional",r.updatedAt])}function cz(E,r=process.env){if(E.value!=null)throw Error("Secret values are not accepted in command arguments; use --from-env or the interactive prompt.");if(!E.fromEnv)return;let t=r[E.fromEnv];if(!t)throw Error(`${E.fromEnv} is empty or unavailable.`);return t}function d_(E,r){let t=r.scope??"environment";if(t==="project")return{type:t,id:E.controlPlane.project.id};if(t==="environment"){let T=r.target?E.controlPlane.store.listEnvironments(E.controlPlane.project.id).find((_)=>_.id===r.target||_.slug===r.target):E.environmentRecord;if(!T)throw Error(`Environment ${r.target} was not found.`);return{type:t,id:T.id,environmentId:T.id}}if(t==="service"){let T=E.controlPlane.store.listResources(E.controlPlane.project.id),_=T.find((d)=>d.id===r.target||d.slug===r.target);if(!_)throw Error("Service scope requires --target with a resource ID or slug.");return{type:t,id:_.id,environmentId:_.environmentId,resourceId:_.id}}if(t==="function"){let T=E.controlPlane.store.listResources(E.controlPlane.project.id),_=T.find((d)=>d.kind==="function"&&(d.id===r.target||d.slug===r.target));if(!_)throw Error("Function scope requires --target with a function resource ID or slug.");return{type:t,id:_.id,environmentId:_.environmentId,resourceId:_.id}}if(t==="preview"){let T=new B_(E.controlPlane.store).listInstances({projectId:E.controlPlane.project.id}).find((_)=>_.id===r.target||_.name===r.target);if(!T)throw Error("Preview scope requires --target with a preview ID or name.");return{type:t,id:T.id,environmentId:T.baseEnvironmentId,resourceId:T.resourceId,previewId:T.id}}throw Error("--scope must be project, environment, service, function, or preview.")}function S$(E){let r=E??"local_encrypted";if(!["local_encrypted","aws_secrets_manager","aws_ssm","external"].includes(r))throw Error("--backend must be local_encrypted, aws_secrets_manager, aws_ssm, or external.");return r}function vR(E,r,t){let T=E.store.find(E.controlPlane.project.id,t,r);if(!T)throw Error(`${r} was not found in the selected scope.`);return T}async function lV(E,r){if(E==="secret")return cz(r)??await Ar("Enter secret value (input is write-only)","");if(r.fromEnv){let t=process.env[r.fromEnv];if(t==null)throw Error(`${r.fromEnv} is unavailable.`);return t}if(r.value!=null)return r.value;return await Ar("Enter variable value","")}function Q_(E){return E.option("--env <environment>","Dashboard environment").option("--scope <scope>","project, environment, service, function, or preview",{default:"environment"}).option("--target <id>","Environment, resource, function, or preview ID/name")}function L$(E){E.command("config","Show validated file configuration").action(async()=>xT(async()=>{let r=await tE();console.log(JSON.stringify(r,null,2))})),E.command("config:validate","Validate configuration file").action(async()=>xT(async()=>{let r=await tE();if(!r.project?.name||!r.project?.slug||!r.mode)throw Error("project.name, project.slug, and mode are required.");K(`Configuration is valid: ${r.project.name} · ${r.mode} · ${r.project.region||"us-east-1"}`)})),Q_(E.command("config:list","List scoped variables and write-only secret metadata")).option("--kind <kind>","variable or secret").option("--search <text>","Filter key names").option("--json","Print structured JSON").action(async(r)=>xT(async()=>Y_(r.env,async(t)=>{let T=d_(t,r),_=["variable","secret"].includes(r.kind??"")?r.kind:void 0,d=t.service.list({projectId:t.controlPlane.project.id,scope:T,kind:_,search:r.search,canReadSecretMetadata:!0});if(r.json)console.log(JSON.stringify(d,null,2));else TE(["Key","Kind","Scope","Precedence","Value/backend","Backend version","Requirement","Updated"],vV(d))}))),Q_(E.command("config:set <key>","Create or replace a scoped variable or secret")).option("--value <value>","Plaintext variable value only").option("--from-env <name>","Read the value from an environment variable").option("--secret","Store a write-only secret").option("--backend <backend>","local_encrypted, aws_secrets_manager, aws_ssm, or external").option("--reference <uri>","External provider reference").option("--required","Fail deployments when unavailable").option("--confirm <key>","Exact key confirmation for production replacements").option("--json","Print structured JSON").action(async(r,t)=>xT(async()=>Y_(t.env,async(T)=>{let _=d_(T,t),d=t.secret?"secret":"variable",e=d==="secret"?S$(t.backend):void 0,h=e==="external"?void 0:await lV(d,t),R=await T.service.set({organizationId:T.controlPlane.organization.id,projectId:T.controlPlane.project.id,scope:_,key:r,kind:d,value:h,reference:t.reference,backend:e,required:!!t.required,confirmed:t.confirm===r,actorId:T.actor.id,idempotencyKey:`cli:${crypto.randomUUID()}`});if(t.json)console.log(JSON.stringify({entry:T.service.list({projectId:T.controlPlane.project.id,scope:_,canReadSecretMetadata:!0}).find((N)=>N.id===R.entry.id),mutation:R.mutation,warnings:R.warnings},null,2));else K(`${r}: ${R.mutation.added.length?"created":R.mutation.changed.length?"updated":"unchanged"}; ${R.mutation.affectedResourceIds.length} affected service(s).`)}))),Q_(E.command("config:delete <key>","Delete a scoped variable or secret")).option("--confirm <key>","Exact key confirmation").action(async(r,t)=>xT(async()=>Y_(t.env,async(T)=>{let _=vR(T,r,d_(T,t));await T.service.remove({entryId:_.id,expectedVersion:_.version,confirmed:t.confirm===r,actorId:T.actor.id}),K(`Deleted ${r}.`)}))),Q_(E.command("config:import <file>","Validate and import a dotenv file")).option("--secret-keys <keys>","Comma-separated secret keys").option("--backend <backend>","Secret backend").option("--confirm <word>","Use import for production replacement confirmation").option("--json","Print structured JSON").action(async(r,t)=>xT(async()=>Y_(t.env,async(T)=>{let _=await T.service.importDotenv({organizationId:T.controlPlane.organization.id,projectId:T.controlPlane.project.id,scope:d_(T,t),source:await Oz(FO(r),"utf8"),secretKeys:t.secretKeys?.split(",").map((d)=>d.trim()).filter(Boolean),backend:S$(t.backend),confirmed:t.confirm==="import",actorId:T.actor.id,idempotencyKey:`cli-import:${crypto.randomUUID()}`});if(!_.document.valid)throw Error(_.document.diagnostics.map((d)=>`line ${d.line}: ${d.message}`).join(`
 `));if(t.json)console.log(JSON.stringify({mutation:_.mutation,diagnostics:_.document.diagnostics,warnings:_.warnings},null,2));else K(`Imported ${_.mutation?.added.length??0} new, ${_.mutation?.changed.length??0} changed, and ${_.mutation?.unchanged.length??0} unchanged entries.`)}))),Q_(E.command("config:plan <file>","Preview dotenv drift using key names only")).option("--remove-missing","Include managed keys absent from the file").option("--json","Print structured JSON").action(async(r,t)=>xT(async()=>Y_(t.env,async(T)=>{let{parseDotenv:_}=await Promise.resolve().then(() => (YA(),Dj)),d=_(await Oz(FO(r),"utf8"));if(!d.valid)throw Error(d.diagnostics.map((h)=>`line ${h.line}: ${h.message}`).join(`
 `));let e=T.service.plan({projectId:T.controlPlane.project.id,scope:d_(T,t),values:d.values,removeMissing:!!t.removeMissing});if(t.json)console.log(JSON.stringify(e,null,2));else TE(["Action","Keys"],[["Add",e.added.join(", ")||"—"],["Change",e.changed.join(", ")||"—"],["Remove",e.removed.join(", ")||"—"],["Unchanged",e.unchanged.join(", ")||"—"]]),c(`${e.affectedResourceIds.length} affected service(s); no secret values were printed.`)}))),Q_(E.command("config:export [file]","Export plaintext variables only as dotenv")).action(async(r,t)=>xT(async()=>Y_(t.env,async(T)=>{let _=T.service.exportVariables({projectId:T.controlPlane.project.id,scope:d_(T,t)});if(r)await uV(FO(r),_,{mode:384}),K(`Exported variables to ${FO(r)}; secrets were excluded.`);else process.stdout.write(_)}))),Q_(E.command("config:transfer <key>","Copy or move an entry between scopes")).option("--to-scope <scope>","Destination scope").option("--to-target <id>","Destination ID or slug").option("--move","Remove the source after copying").option("--confirm <key>","Exact key confirmation").action(async(r,t)=>xT(async()=>Y_(t.env,async(T)=>{let _=d_(T,t),d=vR(T,r,_),e=d_(T,{env:t.env,scope:t.toScope,target:t.toTarget}),h=await T.service.transfer({entryId:d.id,targetScope:e,mode:t.move?"move":"copy",confirmed:t.confirm===r,actorId:T.actor.id,idempotencyKey:`cli-transfer:${crypto.randomUUID()}`});K(`${r} ${t.move?"moved":"copied"}; ${h.mutation.affectedResourceIds.length} affected service(s).`)}))),Q_(E.command("config:reveal <key>","Reveal a secret after exact confirmation")).option("--confirm <key>","Exact key confirmation").action(async(r,t)=>xT(async()=>Y_(t.env,async(T)=>{if(t.confirm!==r)throw Error(`Use --confirm ${r} to reveal this secret.`);let _=vR(T,r,d_(T,t));console.log(await T.service.reveal({entryId:_.id,canRevealSecrets:!0,recentlyAuthenticated:!0,actorId:T.actor.id}))}))),Q_(E.command("config:env","Backward-compatible variable management")).option("--list","List variables").option("--set <key=value>","Set a variable").option("--unset <key>","Delete a variable").option("--environment <environment>","Target environment").action(async(r)=>xT(async()=>Y_(r.environment??r.env,async(t)=>{let T=d_(t,{env:r.environment,scope:"environment",target:r.environment});if(r.list)TE(["Key","Value","Updated"],t.service.list({projectId:t.controlPlane.project.id,scope:T,kind:"variable"}).map((_)=>[_.key,_.value??"",_.updatedAt]));else if(r.set){let _=r.set.indexOf("=");if(_<1)throw Error("Use --set KEY=VALUE.");let d=r.set.slice(0,_),e=r.set.slice(_+1);await t.service.set({organizationId:t.controlPlane.organization.id,projectId:t.controlPlane.project.id,scope:T,key:d,kind:"variable",value:e,confirmed:!1,actorId:t.actor.id}),K(`Set ${d}.`)}else if(r.unset){let _=vR(t,r.unset,T);await t.service.remove({entryId:_.id,expectedVersion:_.version,confirmed:await OE(`Delete ${_.key}?`,!1),actorId:t.actor.id}),K(`Deleted ${_.key}.`)}else c("Use --list, --set KEY=VALUE, or --unset KEY.")}))),Q_(E.command("config:secrets","Backward-compatible write-only secret management")).option("--list","List secret metadata").option("--create <key>","Create a secret").option("--update <key>","Rotate a secret").option("--get <key>","Reveal a secret").option("--delete <key>","Delete a secret").option("--from-env <name>","Read new value from an environment variable").option("--backend <backend>","Secret backend").option("--confirm <key>","Exact key confirmation").action(async(r)=>xT(async()=>Y_(r.env,async(t)=>{let T=d_(t,r);if(r.list)TE(["Key","Backend","Version","Rotated"],t.service.list({projectId:t.controlPlane.project.id,scope:T,kind:"secret",canReadSecretMetadata:!0}).map((_)=>[_.key,_.backend??"restricted",_.backendVersion??"—",_.rotatedAt??"never"]));else if(r.create||r.update){let _=r.create??r.update,d=cz(r)??await Ar("Enter secret value (write-only)","");await t.service.set({organizationId:t.controlPlane.organization.id,projectId:t.controlPlane.project.id,scope:T,key:_,kind:"secret",value:d,backend:S$(r.backend),confirmed:r.confirm===_,actorId:t.actor.id}),K(`${_} ${r.update?"rotated":"created"}.`)}else if(r.get){if(r.confirm!==r.get)throw Error(`Use --confirm ${r.get} to reveal.`);let _=vR(t,r.get,T);console.log(await t.service.reveal({entryId:_.id,canRevealSecrets:!0,recentlyAuthenticated:!0,actorId:t.actor.id}))}else if(r.delete){let _=vR(t,r.delete,T);await t.service.remove({entryId:_.id,expectedVersion:_.version,confirmed:r.confirm===_.key,actorId:t.actor.id}),K(`Deleted ${_.key}.`)}else c("Use --list, --create, --update, --get, or --delete.")})))}QE();import{existsSync as sV}from"node:fs";import{readFile as pV,writeFile as oV}from"node:fs/promises";function zO(E){let r=BO(E.name),t=c$(E.configText);if(mV(E.configText,t.start,t.end,r))throw Error(`Site '${r}' already exists in cloud.config.ts`);let T=aV({...E,name:r}),_=E.configText.slice(0,t.end).trimEnd(),d=E.configText.slice(t.end),e=_.endsWith("{")?`
 `:_.endsWith(",")?`
@@ -9336,7 +9336,7 @@ Resources to create: ${B}`);let f={};for(let Q of Object.values(N.Resources||{})
 No changes detected - infrastructure is up to date`);return}if(c(`
 Changes detected:
 `),$.length>0){K(`Resources to add (${$.length}):`);for(let j of $){let B=O[j].Type;c(`  + ${j} (${B})`)}console.log()}if(C.length>0){Y(`Resources to remove (${C.length}):`);for(let j of C){let B=L[j].Type;c(`  - ${j} (${B})`)}console.log()}if(y.length>0){_E(`Resources to modify (${y.length}):`);for(let j of y){let B=O[j].Type;c(`  ~ ${j} (${B})`)}console.log()}c("Summary:"),c(`  - Add: ${$.length}`),c(`  - Remove: ${C.length}`),c(`  - Modify: ${y.length}`),c("\nRun `cloud deploy` to apply these changes")}catch(t){Y(`Diff failed: ${t.message}`)}})}QE();import{createHash as cx}from"node:crypto";var JW=async(E)=>{let r=Bun.spawn(E,{stdout:"pipe",stderr:"pipe"}),[t,T,_]=await Promise.all([r.exited,new Response(r.stdout).text(),new Response(r.stderr).text()]);return{code:t,stdout:T,stderr:_}};class yW{async scan(E,r){let t=await JW(["ssh-keyscan","-T","10","-p",String(r),"-t","ed25519",E]),T=t.stdout.split(`
-`).find((_)=>_&&!_.startsWith("#"))?.trim().split(/\s+/);if(t.code!==0||!T?.[1]||!T[2])throw Error(`SSH host-key scan failed: ${t.stderr.trim()||"no key returned"}`);return{algorithm:T[1],key:T[2]}}async exec(E,r){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return JW(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,r])}}var Ix=(E)=>`SHA256:${cx("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,Ux=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class wd{provider;transport;discoverer;constructor(E,r=new yW,t){this.provider=E;this.transport=r;this.discoverer=t}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let r=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:r.algorithm,hostKeyFingerprint:Ix(r.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let r=await this.transport.exec(E,Ux);if(r.code!==0)throw Error(`Fleet validation failed: ${r.stderr.trim()||r.code}`);try{return JSON.parse(r.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,r){let t=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${r.length}`);if(t.code!==0)throw Error(`Fleet bootstrap failed: ${t.stderr.trim()||t.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function jW(E,r){return{"fleet.bootstrap":async(t)=>{let T=t.operation.input&&typeof t.operation.input==="object"&&!Array.isArray(t.operation.input)?t.operation.input:{},_=E.get(String(T.serverId??""));if(!_)throw Error("Queued fleet server was not found.");let d=r.find((R)=>R.provider===_.provider);if(!d)throw Error(`No ${_.provider} fleet driver is configured.`);let e=Array.isArray(T.steps)?T.steps.map(String):[];if(t.checkpoint("preflight","Rechecking pinned trust and healthy validation."),_.trustState!=="pinned"||!_.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");t.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let h=await d.bootstrap(_,e);return E.update(_.id,{bootstrapVersion:h.version,status:"ready"}),t.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:_.id,bootstrapVersion:h.version,steps:e.length}}}}var K_=(E)=>E==null?void 0:String(E),$h=(E,r)=>{try{return JSON.parse(String(E))}catch{return r}},F1=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:K_(E.provider_id),region:K_(E.region),zone:K_(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:K_(E.host_key_algorithm),hostKeyFingerprint:K_(E.host_key_fingerprint),pendingHostKey:K_(E.pending_host_key),roles:$h(E.roles,[]),labels:$h(E.labels,{}),taints:$h(E.taints,[]),capacity:$h(E.capacity,{}),usage:$h(E.usage,{}),capabilities:$h(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:$h(E.validation,void 0),bootstrapVersion:K_(E.bootstrap_version),heartbeatAt:K_(E.heartbeat_at),lastSeenAt:K_(E.last_seen_at),archivedAt:K_(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class Z_{control;now;id;constructor(E,r=()=>new Date,t=()=>crypto.randomUUID()){this.control=E;this.now=r;this.id=t}get(E){let r=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return r?F1(r):void 0}list(E,r=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(F1).filter((t)=>r||t.status!=="archived")}findProvider(E,r,t){let T=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,r,t);return T?F1(T):void 0}create(E){let r=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,t,t]),this.get(r)}update(E,r){let t=this.get(E);if(!t)throw Error("Server was not found.");let T={...t,...r},_=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[T.name,T.providerId??null,T.region??null,T.zone??null,T.endpoint,T.sshUser,T.sshPort,T.credentialRef,T.hostKeyAlgorithm??null,T.hostKeyFingerprint??null,T.pendingHostKey??null,JSON.stringify(T.roles),JSON.stringify(T.labels),JSON.stringify(T.taints),JSON.stringify(T.capacity),JSON.stringify(T.usage),JSON.stringify(T.capabilities),T.status,T.trustState,JSON.stringify(T.validation??{}),T.bootstrapVersion??null,T.heartbeatAt??null,T.lastSeenAt??null,T.archivedAt??null,_,E]),this.get(E)}}var Dx=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class CS{store;drivers;now;queue;constructor(E,r,t,T=()=>new Date){this.store=E;this.drivers=r;this.now=T;this.queue=t??new aE(E.control)}driver(E){let r=this.drivers.find((t)=>t.provider===E);if(!r)throw Error(`No ${E} fleet driver is configured.`);return r}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!Dx.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let r=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(r)return this.store.update(r.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let t=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),T=this.driver(E.provider);return this.store.create({...E,resourceId:t.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:T.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let r=this.store.get(E);if(!r)throw Error("Server was not found.");let t=await this.driver(r.provider).test(r);if(!t.reachable)return this.store.update(E,{status:"unreachable"});if(r.hostKeyFingerprint&&r.hostKeyFingerprint!==t.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:t.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:t.hostKeyAlgorithm,hostKeyFingerprint:t.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,r){let t=this.store.get(E);if(!t||t.pendingHostKey!==r)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:r,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let r=this.store.get(E);if(!r||r.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let t=await this.driver(r.provider).validate(r),T=[];if(!["x64","arm64","x86_64","aarch64"].includes(t.arch??""))T.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let e of["curl","tar"])if(!t.tools?.[e])T.push({code:`tool.${e}`,severity:"error",message:`${e} is missing.`,remediation:`Install ${e} before bootstrap.`});if(Math.abs(t.timeSkewSeconds??0)>60)T.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!t.dnsOk)T.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let _={valid:!T.some((e)=>e.severity==="error"),facts:t,findings:T,validatedAt:this.now().toISOString(),validatorVersion:"1"},d={cpu:t.cpuCores??0,memoryBytes:t.memoryBytes??0,diskBytes:t.diskBytes??0};return this.store.update(E,{validation:_,capacity:d,status:_.valid?"ready":"degraded"})}bootstrap(E,r=!1){let t=this.store.get(E);if(!t?.validation?.valid)throw Error("A healthy validation report is required.");let T=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!r)return{preview:!0,steps:T};let _=this.queue.enqueue({projectId:t.projectId,resourceId:t.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:T},lockKey:`server:${E}`,providerKey:t.provider}).operation;return{preview:!1,steps:T,operation:_}}heartbeat(E,r){let t=this.store.get(E);if(!t)throw Error("Server was not found.");let T=this.now().toISOString();return this.store.update(E,{usage:r.usage,capabilities:r.capabilities??t.capabilities,heartbeatAt:T,lastSeenAt:T,status:t.status==="draining"||t.status==="drained"?t.status:"ready"})}drain(E,r=!1){return this.store.update(E,{status:r?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,r){let t=this.store.get(E);if(!t||r!==t.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function $x(){let E=await tE(),r=mE(process.cwd(),E),t=new Z_(r.store),T=new CS(t,[new wd("aws"),new wd("hetzner"),new wd("ssh")]);return{controlPlane:r,store:t,service:T}}async function Cd(E){let r=await $x();try{return await E(r)}finally{r.controlPlane.store.close()}}var wh=(E,r)=>{let t=E.store.list(E.controlPlane.project.id).find((T)=>T.id===r||T.name===r);if(!t)throw Error(`Server ${r} was not found.`);return t},Xd=(E)=>{Y(E instanceof Error?E.message:String(E)),process.exitCode=1};function z1(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(r,t)=>{try{await Cd(async(T)=>{let _=r?[wh(T,r)]:T.store.list(T.controlPlane.project.id),d=_.flatMap((e)=>Object.entries(e.capabilities).map(([h,R])=>({server:e.name,provider:e.provider,action:h,...R})));if(t.json)console.log(JSON.stringify({schemaVersion:1,targets:d},null,2));else TE(["Server","Provider","Action","Support","Explanation"],d.map((e)=>[e.server,e.provider,e.action,e.supported?"supported":"unsupported",e.reason??"—"]))})}catch(T){Xd(T)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(r)=>{try{await Cd(async(t)=>{let T=t.store.list(t.controlPlane.project.id);if(r.json)console.log(JSON.stringify(T,null,2));else TE(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],T.map((_)=>[_.name,_.providerId??"—",`${_.provider} / ${_.region??"external"}`,`${_.status} / ${_.trustState}`,_.roles.join(","),`${_.capacity.cpu??0} / ${_.capacity.memoryBytes??0}`,_.heartbeatAt??"never"]))})}catch(t){Xd(t)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(r,t)=>{try{await Cd(async(T)=>{let _=t.provider;if(!["aws","hetzner","ssh"].includes(_)||!t.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let d=T.service.enroll({organizationId:T.controlPlane.organization.id,projectId:T.controlPlane.project.id,name:r,provider:_,providerId:t.providerId,endpoint:t.endpoint,sshUser:t.user??"deploy",credentialRef:t.credentialRef??"secret://fleet/agent",region:t.region,roles:String(t.roles??"application").split(","),labels:Object.fromEntries(String(t.labels??"").split(",").map((e)=>e.split("=")).filter((e)=>e[0]&&e[1]))});K(`Enrolled ${d.name} as ${d.id}; no remote mutation was performed.`)})}catch(T){Xd(T)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(r,t)=>{try{await Cd(async(T)=>{let _=wh(T,r);if(_=await T.service.test(_.id),_.trustState==="rotation_pending"){if(!t.acceptHostKey)throw Error(`Host key changed to ${_.pendingHostKey}; review it first.`);_=T.service.reviewHostKey(_.id,t.acceptHostKey)}let d=await T.service.validate(_.id);if(t.json)console.log(JSON.stringify(d.validation,null,2));else TE(["Severity","Code","Finding","Remediation"],(d.validation?.findings??[]).map((e)=>[e.severity,e.code,e.message,e.remediation??"—"]));if(!d.validation?.valid)process.exitCode=1})}catch(T){Xd(T)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(r,t)=>{try{await Cd(async(T)=>{let _=T.service.bootstrap(wh(T,r).id,!!t.apply);if(_.preview)TE(["Step"],_.steps.map((d)=>[d]));else K(`Bootstrap queued: ${_.operation?.id}`)})}catch(T){Xd(T)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(r,t)=>{try{await Cd(async(T)=>K(T.service.drain(wh(T,r).id,!!t.complete).status))}catch(T){Xd(T)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(r)=>{try{await Cd(async(t)=>{t.service.uncordon(wh(t,r).id),K(`Uncordoned ${r}.`)})}catch(t){Xd(t)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(r,t)=>{try{await Cd(async(T)=>{T.service.archive(wh(T,r).id,t.confirm??""),K(`Archived ${r}; provider infrastructure was not terminated.`)})}catch(T){Xd(T)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(r)=>{try{await Cd(async(t)=>{let T=wh(t,r);if(T.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let _=Bun.spawn(["ssh","-p",String(T.sshPort),"-o","StrictHostKeyChecking=yes",`${T.sshUser}@${T.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),d=await _.exited;if(d)process.exitCode=d})}catch(t){Xd(t)}});for(let[r,t]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:resize <name> <type>","Resize provider compute"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:monitoring <name>","Read server metrics"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(r,t).action(async(...T)=>kT(r.split(" ")[0],{target:String(T[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}QE();var A_=(E,r)=>{try{return JSON.parse(String(E))}catch{return r}},TT=(E)=>E==null?void 0:String(E),BW=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),rN=(E={})=>({...BW(),...E});function FW(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:TT(E.region),architecture:TT(E.architecture),labels:A_(E.labels,{}),requiredServerLabels:A_(E.required_server_labels,{}),toleratedTaints:A_(E.tolerated_taints,[]),capacity:rN(A_(E.capacity,{})),reserved:A_(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:TT(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function zW(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:TT(E.environment_id),resourceId:String(E.resource_id),releaseId:TT(E.release_id),poolId:String(E.pool_id),serverId:TT(E.server_id),purpose:String(E.purpose),requirements:A_(E.requirements,{}),decision:A_(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function wx(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:TT(E.resource_id),poolId:String(E.pool_id),placementId:TT(E.placement_id),operationId:TT(E.operation_id),sourceSha:String(E.source_sha),buildSpec:A_(E.build_spec,{}),credentialPolicy:A_(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:TT(E.workspace),cacheKey:TT(E.cache_key),artifactUri:TT(E.artifact_uri),artifactDigest:TT(E.artifact_digest),status:String(E.status),cleanupAt:TT(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class XS{control;now;id;constructor(E,r=()=>new Date,t=()=>crypto.randomUUID()){this.control=E;this.now=r;this.id=t}createPool(E){let r=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(rN(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,t,t]),this.getPool(r)}getPool(E){let r=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return r?FW(r):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(FW)}updatePool(E,r){let t=this.getPool(E);if(!t)throw Error("Capacity pool was not found.");let T={...t,...r},_=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[T.status,JSON.stringify(T.reserved),JSON.stringify(T.capacity),T.concurrency,_,E]),this.getPool(E)}addMember(E,r,t={}){let T=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,r,JSON.stringify(t),T,T])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((r)=>({serverId:String(r.server_id),status:String(r.status),capacityOverride:A_(r.capacity_override,{})}))}memberStatus(E,r,t){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[t,this.now().toISOString(),E,r])}listPlacements(E,r){let t=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(zW);return r?.length?t.filter((T)=>r.includes(T.status)):t}getPlacement(E){let r=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return r?zW(r):void 0}activeUsage(E,r){let t=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),T=r?t.filter((_)=>String(_.server_id)===r):t;return{resources:T.reduce((_,d)=>{let e=rN(A_(d.resources,{}));for(let h of Object.keys(_))_[h]+=e[h];return _},BW()),count:T.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let r=this.id(),t=this.id(),T=this.now().toISOString(),_=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[r,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,T,T]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[t,r,E.decision.poolId,E.decision.serverId??null,JSON.stringify(rN(E.requirements.resources)),_,T,T]),this.getPlacement(r)})}transitionPlacement(E,r){if(!this.getPlacement(E))throw Error("Placement was not found.");let T=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[r,T,E]),["released","failed","blocked"].includes(r))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[T,E]);return this.getPlacement(E)}createBuild(E){let r=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[r,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),t,t]),this.getBuild(r)}getBuild(E){let r=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return r?wx(r):void 0}updateBuild(E,r){let t=this.getBuild(E);if(!t)throw Error("Remote build was not found.");let T={...t,...r},_=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[T.operationId??null,T.workspace??null,T.cacheKey??null,T.artifactUri??null,T.artifactDigest??null,T.status,T.cleanupAt??null,_,E]),this.getBuild(E)}}var rc=["cpu","memoryBytes","diskBytes","gpu"],WW=(E,r={})=>Object.entries(r).every(([t,T])=>E[t]===T),Cx=(E,r,t)=>Object.fromEntries(rc.map((T)=>[T,Math.max(0,E[T]-r[T]-(t[T]??0))])),Xx=(E,r)=>rc.every((t)=>E[t]>=(r[t]??0)),Jx=(E,r)=>rc.reduce((t,T)=>t+(r[T]??0)/(E[T]||1),0);class JS{store;fleet;constructor(E,r){this.store=E;this.fleet=r}poolCandidates(E,r,t){let T=[];for(let _ of this.store.listPools(E)){if(_.id===t)continue;let d=[];if(_.status!=="active")d.push(`pool is ${_.status}`);if(_.purpose!==r.purpose)d.push(`purpose is ${_.purpose}`);if(r.region&&_.region!==r.region)d.push(`region is ${_.region??"unset"}`);if(r.architecture&&_.architecture!==r.architecture)d.push(`architecture is ${_.architecture??"unset"}`);if(!WW(_.labels,r.labels))d.push("pool labels do not match");if(_.backend==="server"){let e=this.store.members(_.id);if(!e.length)T.push(this.decision(_,void 0,r,[...d,"pool has no servers"]));for(let h of e){let R=this.fleet.get(h.serverId),N=[...d];if(!R)N.push("server is missing");else this.serverReasons(_,R,h.status,r,N);T.push(this.decision(_,R,r,N,h.capacityOverride))}}else T.push(this.decision(_,void 0,r,d))}return T.sort((_,d)=>Number(d.eligible)-Number(_.eligible)||_.score.cost-d.score.cost||_.score.spread-d.score.spread||_.score.fit-d.score.fit||_.poolName.localeCompare(d.poolName)||(_.serverId??"").localeCompare(d.serverId??""))}serverReasons(E,r,t,T,_){if(t!=="active")_.push(`member is ${t}`);if(r.status!=="ready")_.push(`server is ${r.status}`);if(!r.roles.includes(T.purpose==="build"?"build":T.purpose))_.push(`server lacks ${T.purpose} role`);if(!WW(r.labels,E.requiredServerLabels))_.push("server labels do not match pool selector");for(let d of r.taints)if(!E.toleratedTaints.includes(d))_.push(`taint ${d} is not tolerated`)}decision(E,r,t,T,_={}){let d=rN({...r?.capacity,..._}),e=r?Object.fromEntries(rc.map((N)=>[N,Math.min(E.capacity[N],d[N])])):E.capacity,h=this.store.activeUsage(E.id,r?.id),R=Cx(e,h.resources,E.reserved);if(h.count>=E.maxWorkloads)T.push("workload limit reached");if(t.purpose==="build"&&h.count>=E.concurrency)T.push("build concurrency reached");if(!Xx(R,t.resources))T.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:r?.id,eligible:T.length===0,reasons:T,available:R,score:{fit:Jx(R,t.resources),spread:h.count,cost:E.costWeight}}}explain(E,r){return this.poolCandidates(E,r)}place(E){return this.store.control.transaction(()=>{let r=this.poolCandidates(E.projectId,E.requirements).find((t)=>t.eligible);if(!r)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((t)=>t.reasons).join("; ")}`);return this.store.reserve({...E,decision:r})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let r=this.store.updatePool(E,{status:"draining"}),t=[],T=[];for(let _ of this.store.listPlacements(r.projectId,["reserved","active"]).filter((d)=>d.poolId===E)){if(_.stateful){T.push(this.store.transitionPlacement(_.id,"blocked"));continue}this.store.transitionPlacement(_.id,"moving");let d=this.place({projectId:_.projectId,environmentId:_.environmentId,resourceId:_.resourceId,releaseId:_.releaseId,requirements:_.requirements});t.push(this.activate(d.id)),this.store.transitionPlacement(_.id,"released")}return{pool:r,moved:t,blocked:T}}drainServer(E,r){this.store.memberStatus(E,r,"draining");let t=this.store.getPool(E);if(!t)throw Error("Capacity pool was not found.");let T=[],_=[];for(let d of this.store.listPlacements(t.projectId,["reserved","active"]).filter((e)=>e.poolId===E&&e.serverId===r)){if(d.stateful){_.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"moving");let e=this.poolCandidates(d.projectId,d.requirements).find((R)=>R.eligible);if(!e){_.push(this.store.transitionPlacement(d.id,"blocked"));continue}let h=this.store.reserve({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements,decision:e});T.push(this.activate(h.id)),this.store.transitionPlacement(d.id,"released")}return{moved:T,blocked:_}}reconcileFailure(E){let r=this.fleet.get(E);if(!r)throw Error("Server was not found.");let t=[],T=[];for(let _ of this.store.listPlacements(r.projectId,["active"]).filter((d)=>d.serverId===E)){if(_.stateful||!_.autoReschedule){T.push(this.store.transitionPlacement(_.id,"blocked"));continue}this.store.transitionPlacement(_.id,"failed");let d=this.place({projectId:_.projectId,environmentId:_.environmentId,resourceId:_.resourceId,releaseId:_.releaseId,requirements:_.requirements});t.push(this.activate(d.id))}return{rescheduled:t,blocked:T}}}async function yx(){let E=await tE(),r=mE(process.cwd(),E),t=new XS(r.store),T=new JS(t,new Z_(r.store));return{controlPlane:r,store:t,service:T}}async function yS(E){let r=await yx();try{await E(r)}catch(t){Y(t instanceof Error?t.message:String(t)),process.exitCode=1}finally{r.controlPlane.store.close()}}var tc=(E)=>Object.fromEntries(String(E??"").split(",").map((r)=>r.split("=")).filter((r)=>r[0]&&r[1])),HW=(E)=>Object.fromEntries(Object.entries(tc(E)).map(([r,t])=>[r,Number(t)]));function B1(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(r)=>yS((t)=>{let T=t.store.listPools(t.controlPlane.project.id);if(r.json)console.log(JSON.stringify(T,null,2));else TE(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],T.map((_)=>[_.name,_.purpose,_.backend,`${_.region??"any"} / ${_.architecture??"any"}`,_.status,JSON.stringify(_.capacity),String(_.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(r,t)=>yS((T)=>{let{purpose:_,backend:d}=t;if(!["application","build","worker","monitoring","backup"].includes(_)||!["server","ecs","asg"].includes(d))throw Error("Unsupported pool purpose or backend.");let e=T.store.createPool({organizationId:T.controlPlane.organization.id,projectId:T.controlPlane.project.id,name:r,purpose:_,backend:d,region:t.region,architecture:t.arch,labels:tc(t.labels),requiredServerLabels:tc(t.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...HW(t.capacity)},maxWorkloads:Number(t.max),costWeight:1,concurrency:Number(t.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});K(`Created ${e.name} (${e.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(r,t)=>yS((T)=>{let _=T.store.listPools(T.controlPlane.project.id).find((e)=>e.id===r||e.name===r),d=new Z_(T.controlPlane.store).list(T.controlPlane.project.id).find((e)=>e.id===t||e.name===t);if(!_||!d)throw Error("Pool or server was not found.");T.store.addMember(_.id,d.id),K(`Attached ${d.name} to ${_.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(r)=>yS((t)=>{let T=t.service.explain(t.controlPlane.project.id,{purpose:r.purpose,resources:HW(r.resources),region:r.region,architecture:r.arch,labels:tc(r.labels)});if(r.json)console.log(JSON.stringify(T,null,2));else TE(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],T.map((_)=>[_.poolName,_.serverId??"provider-managed",_.eligible?"yes":"no",JSON.stringify(_.available),`${_.score.fit.toFixed(2)} / ${_.score.spread} / ${_.score.cost}`,_.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(r)=>yS((t)=>{let T=t.store.listPools(t.controlPlane.project.id).find((d)=>d.id===r||d.name===r);if(!T)throw Error("Pool was not found.");let _=t.service.drainPool(T.id);K(`Draining ${T.name}: moved ${_.moved.length}, blocked ${_.blocked.length} stateful placement(s).`)}))}QE();var Jd=(E,r)=>{try{return JSON.parse(String(E))}catch{return r}},uT=(E)=>E==null?void 0:String(E),fW=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:uT(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:Jd(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:Jd(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:uT(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),W1=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:uT(E.stack_id),stackRevision:uT(E.stack_revision),status:String(E.status),health:Jd(E.health,{}),lastHealthyAt:uT(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),H1=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:Jd(E.config,{}),status:String(E.status),checkpoint:uT(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:uT(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),f1=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:Jd(E.weights,{}),desiredWeights:Jd(E.desired_weights,{}),status:String(E.status),providerState:Jd(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),YW=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:uT(E.operation_id),kind:String(E.kind),requestedRegion:uT(E.requested_region),revision:uT(E.revision),plan:Jd(E.plan,[]),currentStep:uT(E.current_step),completedSteps:Jd(E.completed_steps,[]),status:String(E.status),error:uT(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class jS{control;now;id;constructor(E,r=()=>new Date,t=()=>crypto.randomUUID()){this.control=E;this.now=r;this.id=t}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((d)=>d.region)).size!==E.regions.length||E.regions.filter((d)=>d.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let r=E.regions.find((d)=>d.role==="primary"),t=this.id(),T=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[t,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,r.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),r.region,T,T]);for(let d of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),t,d.region,d.role,d.provider,T,T]);for(let d of E.dataPolicy.replicate)for(let e of E.regions)for(let h of E.regions.filter((R)=>R.region!==e.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),t,d,e.region,h.region,"{}",T,T]);let _=Object.fromEntries(E.regions.map((d)=>[d.region,d.region===r.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),t,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(_),JSON.stringify(_),T,T]),this.get(t)})}get(E){let r=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return r?fW(r):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(fW)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(W1)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(H1)}route(E){let r=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return r?f1(r):void 0}updateTopology(E,r){let t=this.get(E);if(!t)throw Error("Regional topology was not found.");let T={...t,...r},_=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[T.status,T.activeRegion,T.revision??null,JSON.stringify(T.regions),_,E]),this.get(E)}updateTarget(E,r){let t=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!t)throw Error("Regional target was not found.");let T=W1(t),_={...T,...r},d=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[_.role,_.stackId??null,_.stackRevision??null,_.status,JSON.stringify(_.health),_.lastHealthyAt??null,d,E]),W1(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,r){let t=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!t)throw Error("Replication channel was not found.");let T=H1(t),_={...T,...r},d=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[_.status,_.checkpoint??null,_.lagSeconds??null,_.lastVerifiedAt??null,d,E]),H1(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,r){let t=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!t)throw Error("Traffic route was not found.");let T=f1(t),_={...T,...r},d=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(_.weights),JSON.stringify(_.desiredWeights),_.status,JSON.stringify(_.providerState),d,E]),f1(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let r=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[r,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),t,t]),this.execution(r)}execution(E){let r=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return r?YW(r):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(YW)}updateExecution(E,r){let t=this.execution(E);if(!t)throw Error("Regional execution was not found.");let T={...t,...r},_=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[T.operationId??null,T.currentStep??null,JSON.stringify(T.completedSteps),T.status,T.error??null,_,E]),this.execution(E)}}class FS{store;queue;constructor(E,r){this.store=E;this.queue=r??new aE(E.control)}create(E){return this.store.create(E)}plan(E,r,t){if(!this.store.get(E))throw Error("Regional topology was not found.");let _=this.store.targets(E),d=this.store.channels(E);if(r==="rollout")return[..._.filter((e)=>e.role==="secondary").map((e)=>`apply:${e.region}`),..._.filter((e)=>e.role==="primary").map((e)=>`apply:${e.region}`),...d.map((e)=>`replicate:${e.kind}:${e.targetRegion}`),"traffic:activate"];if(r==="failover"||r==="failback")return[`health:${t}`,`replication:${t}`,`traffic:${t}`,`roles:${t}`];if(r==="destroy")return["traffic:drain",..._.filter((e)=>e.role==="secondary").map((e)=>`delete:${e.region}`),..._.filter((e)=>e.role==="primary").map((e)=>`delete:${e.region}`),"complete"];return["observe","repair"]}enqueue(E){let r=this.store.get(E.topologyId);if(!r)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!r.regions.some((d)=>d.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===r.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==r.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&r.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let t=this.plan(r.id,E.kind,E.targetRegion),T=this.store.createExecution({topologyId:r.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:t}),_=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,kind:`region.${E.kind}`,input:{executionId:T.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${r.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(T.id,{operationId:_.id}),{execution:this.store.execution(T.id),operation:_}}}var jx=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function QW(E,r){let t=(N)=>{let A=r.find((S)=>S.provider===N.provider);if(!A)throw Error(`No ${N.provider} regional driver is configured.`);return A},T=(N,A,S)=>{N.throwIfCancellationRequested(),N.checkpoint(S,S),E.updateExecution(A.id,{status:"running",currentStep:S,completedSteps:[...E.execution(A.id).completedSteps,S]})},_=async(N,A)=>{let S=E.route(N.id);if(!S)throw Error("Regional traffic route was not found.");let L=E.targets(N.id).find((I)=>I.region===N.activeRegion)??E.targets(N.id)[0];if(!L)throw Error("Regional traffic target was not found.");E.updateRoute(S.id,{status:"applying",desiredWeights:A});let O=await t(L).applyTraffic({route:E.route(N.id),topology:N,weights:A});E.updateRoute(S.id,{status:Object.values(A).every((I)=>I===0)?"drained":"in_sync",weights:A,providerState:O.providerState})},d=async(N,A,S,L)=>{E.updateTopology(S.id,{status:"provisioning"});let O=A.revision,I=L.manifest??{},D=E.targets(S.id).sort((C,y)=>Number(C.role==="primary")-Number(y.role==="primary"));for(let C of D){T(N,A,`apply:${C.region}`),E.updateTarget(C.id,{status:"provisioning"});let y=await t(C).applyStack({target:C,revision:O,manifest:I,signal:N.signal}),j=await t(C).health({target:E.updateTarget(C.id,{stackId:y.stackId,stackRevision:O})});if(!j.healthy)throw Error(`Regional health gate failed in ${C.region}.`);E.updateTarget(C.id,{status:"ready",health:j.evidence,lastHealthyAt:new Date().toISOString()})}for(let C of E.channels(S.id)){T(N,A,`replicate:${C.kind}:${C.targetRegion}`),E.updateChannel(C.id,{status:"configuring"});let y=D.find((f)=>f.region===C.sourceRegion),j=await t(y).configureReplication({channel:C,topology:S}),B=await t(y).verifyReplication({channel:E.updateChannel(C.id,{checkpoint:j.checkpoint,lagSeconds:j.lagSeconds}),topology:S});if(!B.healthy||B.lagSeconds>S.dataPolicy.maxLagSeconds)throw Error(`${C.kind} replication to ${C.targetRegion} exceeds the RPO.`);E.updateChannel(C.id,{status:"in_sync",checkpoint:B.checkpoint,lagSeconds:B.lagSeconds,lastVerifiedAt:new Date().toISOString()})}T(N,A,"traffic:activate");let $=Object.fromEntries(S.regions.map((C)=>[C.region,C.region===S.activeRegion?100:0]));return await _(S,$),E.updateTopology(S.id,{status:"ready",revision:O}),{revision:O,activeRegion:S.activeRegion}},e=async(N,A,S)=>{let L=A.requestedRegion,O=E.targets(S.id).find(($)=>$.region===L);if(!O)throw Error("Requested regional target was not found.");E.updateTopology(S.id,{status:A.kind==="failover"?"failing_over":"failing_back"}),T(N,A,`health:${L}`);let I=await t(O).health({target:O});if(!I.healthy)throw Error(`Target region ${L} is unhealthy.`);E.updateTarget(O.id,{status:"ready",health:I.evidence,lastHealthyAt:new Date().toISOString()}),T(N,A,`replication:${L}`);for(let $ of E.channels(S.id).filter((C)=>C.targetRegion===L)){let C=await t(O).verifyReplication({channel:$,topology:S});if(!C.healthy||C.lagSeconds>S.dataPolicy.maxLagSeconds)throw Error(`${$.kind} replication is outside the failover RPO.`);E.updateChannel($.id,{status:"in_sync",checkpoint:C.checkpoint,lagSeconds:C.lagSeconds,lastVerifiedAt:new Date().toISOString()})}T(N,A,`traffic:${L}`),await _(S,Object.fromEntries(S.regions.map(($)=>[$.region,$.region===L?100:0]))),T(N,A,`roles:${L}`);let D=S.regions.map(($)=>({...$,role:$.region===L?"primary":"secondary"}));for(let $ of E.targets(S.id))E.updateTarget($.id,{role:$.region===L?"primary":"secondary"});return E.updateTopology(S.id,{status:A.kind==="failover"?"failed_over":"ready",activeRegion:L,regions:D}),{activeRegion:L}},h=async(N,A,S,L)=>{E.updateTopology(S.id,{status:"destroying"}),T(N,A,"traffic:drain"),await _(S,Object.fromEntries(S.regions.map((I)=>[I.region,0])));let O=L.deleteData!==!0;for(let I of E.targets(S.id).sort((D,$)=>Number(D.role==="primary")-Number($.role==="primary")))T(N,A,`delete:${I.region}`),E.updateTarget(I.id,{status:"deleting"}),await t(I).deleteStack({target:I,retainData:O,signal:N.signal}),E.updateTarget(I.id,{status:"deleted"});return T(N,A,"complete"),E.updateTopology(S.id,{status:"destroyed"}),{destroyed:!0,dataRetained:O}},R=async(N)=>{let A=jx(N.operation.input),S=E.execution(String(A.executionId??""));if(!S)throw Error("Regional execution was not found.");let L=E.get(S.topologyId);if(!L)throw Error("Regional topology was not found.");try{let O;if(S.kind==="rollout")O=await d(N,S,L,A);else if(S.kind==="failover"||S.kind==="failback")O=await e(N,S,L);else if(S.kind==="destroy")O=await h(N,S,L,A);else throw Error("Regional reconciliation is not configured.");return E.updateExecution(S.id,{status:"succeeded",currentStep:void 0}),{executionId:S.id,...O}}catch(O){if(E.updateExecution(S.id,{status:N.cancellationRequested()?"cancelled":"failed",error:O instanceof Error?O.message:String(O)}),E.get(L.id)?.status!=="destroyed")E.updateTopology(L.id,{status:"failed"});throw O}};return{"region.rollout":R,"region.failover":R,"region.failback":R,"region.destroy":R,"region.reconcile":R}}class Y1{provider;reason;constructor(E,r="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=r}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function Fx(){let E=await tE(),r=mE(process.cwd(),E),t=new jS(r.store),T=new FS(t);return{controlPlane:r,store:t,service:T}}async function Ch(E){let r=await Fx();try{await E(r)}catch(t){Y(t instanceof Error?t.message:String(t)),process.exitCode=1}finally{r.controlPlane.store.close()}}var zS=(E,r)=>{let t=E.store.list(E.controlPlane.project.id).find((T)=>T.id===r||T.name===r);if(!t)throw Error("Regional topology was not found.");return t},zx=(E)=>E.split(",").map((r,t)=>{let[T,_="aws"]=r.split(":");return{region:String(T),provider:_,role:t===0?"primary":"secondary"}}),Bx=(E)=>{let r=new Set(["s3","dynamodb","secrets"]),t=E.split(",").map((_)=>_.trim()),T=t.find((_)=>!r.has(_));if(T)throw Error(`Unsupported replication kind: ${T}`);return t};function Q1(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(r)=>Ch((t)=>{let T=t.store.list(t.controlPlane.project.id).map((_)=>({topology:_,targets:t.store.targets(_.id),channels:t.store.channels(_.id),route:t.store.route(_.id),executions:t.store.executions(_.id)}));if(r.json)console.log(JSON.stringify(T,null,2));else TE(["Name","Hostname","Active","Status","Revision","Replication"],T.map((_)=>[_.topology.name,_.topology.hostname,_.topology.activeRegion,_.topology.status,_.topology.revision??"—",`${_.channels.filter((d)=>d.status==="in_sync").length}/${_.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(r,t)=>Ch((T)=>{if(!t.hostname||!t.regions)throw Error("--hostname and --regions are required.");let _=T.service.create({organizationId:T.controlPlane.organization.id,projectId:T.controlPlane.project.id,name:r,hostname:t.hostname,regions:zx(t.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Bx(String(t.replicate)),maxLagSeconds:Number(t.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!t.cdn,wafEnabled:!!t.waf});K(`Created ${_.name} (${_.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(r,t,T)=>Ch((_)=>TE(["Step"],_.service.plan(zS(_,r).id,t,T.target).map((d)=>[d])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(r,t,T)=>Ch(async(_)=>{let d=T.manifest?await Bun.file(T.manifest).json():{},e=_.service.enqueue({topologyId:zS(_,r).id,kind:"rollout",revision:t,manifest:d});K(`Regional rollout queued: ${e.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(r,t)=>Ch((T)=>{let _=T.service.enqueue({topologyId:zS(T,r).id,kind:"failover",targetRegion:t});K(`Failover queued: ${_.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(r,t)=>Ch((T)=>{let _=T.service.enqueue({topologyId:zS(T,r).id,kind:"failback",targetRegion:t});K(`Failback queued: ${_.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(r,t)=>Ch((T)=>{let _=T.service.enqueue({topologyId:zS(T,r).id,kind:"destroy",confirmation:t.confirm});K(`Regional teardown queued: ${_.operation.id}; replicated data remains retained.`)}))}QE();var BS="0.7.57";import{createHash as G1,createPublicKey as VW,verify as Hx}from"node:crypto";function WS(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(WS).join(",")}]`;return`{${Object.keys(E).sort().map((r)=>`${JSON.stringify(r)}:${WS(E[r])}`).join(",")}}`}var PW=(E)=>G1("sha256").update(WS(E)).digest("hex"),Tc=(E)=>G1("sha256").update(WS(E)).digest("hex"),KW=(E)=>G1("sha256").update(VW(E).export({type:"spki",format:"der"})).digest("hex");function ZW(E,r,t){try{return Hx(null,Buffer.from(WS(E)),VW(t),Buffer.from(r,"base64"))}catch{return!1}}var GW=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((r)=>Number(r)||0),MW=(E,r)=>{let t=GW(E),T=GW(r);for(let _=0;_<3;_++){let d=(t[_]??0)-(T[_]??0);if(d)return d}return 0};function gW(E,r){let t=[];if(r.schemaVersion<E.minimumSchema)t.push(`schema ${r.schemaVersion} is below ${E.minimumSchema}`);if(r.schemaVersion>E.maximumSchema)t.push(`schema ${r.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&MW(r.currentVersion,E.minimumVersion)<0)t.push(`platform ${r.currentVersion} is below ${E.minimumVersion}`);if(MW(E.version,r.currentVersion)<=0)t.push(`version ${E.version} is not newer than ${r.currentVersion}`);if(!E.artifacts.some((T)=>T.platform===r.platform&&T.architecture===r.architecture))t.push(`no artifact for ${r.platform}/${r.architecture}`);return{compatible:t.length===0,reasons:t}}var yd=(E,r)=>{try{return JSON.parse(String(E))}catch{return r}},Ct=(E)=>E==null?void 0:String(E),fx=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:Ct(E.revoked_at),createdAt:String(E.created_at)}),qW=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:yd(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:yd(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),xW=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:yd(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),bW=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:Ct(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:yd(E.health_gate,{}),status:String(E.status),currentStage:Ct(E.current_stage),backupId:Ct(E.backup_id),approvedBy:Ct(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),M1=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:Ct(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:yd(E.evidence,{}),error:Ct(E.error),startedAt:Ct(E.started_at),finishedAt:Ct(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),kW=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:yd(E.criteria,{}),candidates:yd(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:Ct(E.confirmation),expiresAt:String(E.expires_at),result:yd(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),uW=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:Ct(E.backup_policy_id),recoveryPointId:Ct(E.recovery_point_id),topologyId:Ct(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:Ct(E.operation_id),evidence:yd(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:Ct(E.error),startedAt:Ct(E.started_at),finishedAt:Ct(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class HS{control;now;id;constructor(E,r=()=>new Date,t=()=>crypto.randomUUID()){this.control=E;this.now=r;this.id=t}addTrustedKey(E){let r=this.id(),t=this.now().toISOString(),T=KW(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[r,E.organizationId,E.name,E.publicKeyPem,T,t]),this.key(r)}key(E){let r=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return r?fx(r):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let r=this.key(E.keyId);if(!r||r.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(r.revokedAt)throw Error("Update signing key is revoked.");if(!ZW(E.document,E.signature,r.publicKeyPem))throw Error("Update manifest signature is invalid.");let t=gW(E.document,E.current),T=PW(E.document),_=this.id(),d=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[_,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,T,JSON.stringify(E.document),E.signature,JSON.stringify(t),d]),this.manifest(_)}manifest(E){let r=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return r?qW(r):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(qW)}createWindow(E){let r=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[r,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,t,t]),this.window(r)}window(E){let r=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return r?xW(r):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(xW)}createCampaign(E){return this.control.transaction(()=>{let r=this.manifest(E.manifestId);if(!r?.compatibility.compatible||r.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let t=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[t,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,T,T]),E.targets.forEach((_,d)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),t,_.serverId??null,_.target,E.strategy==="canary"?d===0?0:1+Math.floor((d-1)/E.batchSize):Math.floor(d/E.batchSize),_.previousVersion,T,T])),this.campaign(t)})}campaign(E){let r=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return r?bW(r):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(bW)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(M1)}updateCampaign(E,r){let t=this.campaign(E);if(!t)throw Error("Upgrade campaign was not found.");let T={...t,...r};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[T.status,T.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,r){let t=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!t)throw Error("Upgrade target was not found.");let T={...M1(t),...r};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[T.status,JSON.stringify(T.evidence),T.error??null,T.startedAt??null,T.finishedAt??null,this.now().toISOString(),E]),M1(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let r=[...E.candidates].sort((e,h)=>e.id.localeCompare(h.id)),t=Tc(r),T=this.id(),_=this.now().toISOString(),d=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[T,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(r),t,r.reduce((e,h)=>e+h.bytes,0),d,_,_]),this.cleanup(T)}cleanup(E){let r=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return r?kW(r):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(kW)}updateCleanup(E,r){let t=this.cleanup(E);if(!t)throw Error("Cleanup plan was not found.");let T={...t,...r};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[T.status,T.confirmation??null,JSON.stringify(T.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let r=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[r,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,t,t]),this.drill(r)}drill(E){let r=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return r?uW(r):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(uW)}updateDrill(E,r){let t=this.drill(E);if(!t)throw Error("DR drill was not found.");let T={...t,...r};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[T.status,T.operationId??null,JSON.stringify(T.evidence),T.measuredRpoMinutes??null,T.measuredRtoMinutes??null,T.cleanupVerified?1:0,T.error??null,T.startedAt??null,T.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}function Yx(E,r=new Date){if(!E.enabled)return!1;let t=new Date(E.schedule);if(!Number.isNaN(t.getTime()))return r>=t&&r.getTime()<=t.getTime()+E.durationMinutes*60000;let T=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!T)return!1;let _=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(r),d=Number(_.find((h)=>h.type==="hour")?.value)*60+Number(_.find((h)=>h.type==="minute")?.value),e=Number(T[1])*60+Number(T[2]);return d>=e&&d<e+E.durationMinutes}class fS{store;now;queue;constructor(E,r,t=()=>new Date){this.store=E;this.now=t;this.queue=r??new aE(E.control)}enqueueCampaign(E,r={}){let t=this.store.campaign(E);if(!t)throw Error("Upgrade campaign was not found.");let T=t.windowId?this.store.window(t.windowId):void 0;if(T&&!T.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(T&&!r.overrideWindow&&!Yx(T,this.now()))throw Error("Upgrade is outside its maintenance window.");if(T?.requireApproval&&!r.approvedBy&&!t.approvedBy)throw Error("Maintenance approval is required.");let _=this.queue.enqueue({projectId:t.projectId,actorId:r.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:_}}async previewCleanup(E,r){let t=r.find((T)=>T.kind===E.kind);if(!t)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await t.discover(E.criteria)})}enqueueCleanup(E,r){let t=this.store.cleanup(E);if(!t||t.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(t.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let T=`DELETE ${t.candidates.length} ${t.kind}`;if(r!==T)throw Error(`Exact confirmation ${T} is required.`);let _=this.queue.enqueue({projectId:t.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${t.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:r}),operation:_}}enqueueDrill(E){let r=this.store.drill(E);if(!r||r.status!=="planned")throw Error("A planned DR drill is required.");let t=this.queue.enqueue({projectId:r.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${r.scenario}:${r.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:t.id}),operation:t}}}var V1=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function nW(E){return{"maintenance.upgrade":async(_)=>{let d=E.store.campaign(String(V1(_.operation.input).campaignId??""));if(!d||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let e=E.store.manifest(d.manifestId);if(!e?.compatibility.compatible||e.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let h=e.document.artifacts.find((N)=>N.platform===process.platform&&N.architecture===process.arch)??e.document.artifacts[0];if(!h)throw Error("No update artifact matches this platform.");E.store.updateCampaign(d.id,{status:"running",currentStage:"preflight"});let R=[];try{for(let N of[...new Set(E.store.targets(d.id).map((A)=>A.cohort))].sort((A,S)=>A-S)){E.store.updateCampaign(d.id,{currentStage:`cohort:${N}`});for(let A of E.store.targets(d.id).filter((S)=>S.cohort===N)){_.throwIfCancellationRequested(),_.checkpoint(`download:${A.target}`,"Downloading signed platform artifact."),E.store.updateTarget(A.id,{status:"downloading",startedAt:new Date().toISOString()});let S=await E.platform.download({target:A,artifact:h,signal:_.signal});if(S.sha256!==h.sha256)throw Error(`Artifact checksum mismatch for ${A.target}.`);_.checkpoint(`install:${A.target}`,"Installing verified artifact."),E.store.updateTarget(A.id,{status:"installing"}),await E.platform.install({target:A,path:S.path,version:e.version,signal:_.signal}),R.push(A);let L=await E.platform.health({target:A,gate:d.healthGate});if(!L.healthy)throw Error(`Upgrade health gate failed for ${A.target}.`);E.store.updateTarget(A.id,{status:"healthy",evidence:L.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(d.id,{status:"succeeded",currentStage:void 0}),{campaignId:d.id,version:e.version,targets:R.length}}catch(N){E.store.updateCampaign(d.id,{status:"rolling_back",currentStage:"rollback"});for(let A of R.reverse())E.store.updateTarget(A.id,{status:"rolling_back"}),await E.platform.rollback({target:A,version:A.previousVersion,signal:_.signal}),E.store.updateTarget(A.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(d.id,{status:"rolled_back",currentStage:void 0}),N}},"maintenance.cleanup":async(_)=>{let d=E.store.cleanup(String(V1(_.operation.input).planId??""));if(!d||d.status!=="approved")throw Error("Approved cleanup plan was not found.");if(Tc([...d.candidates].sort((A,S)=>A.id.localeCompare(S.id)))!==d.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let e=E.cleanup?.find((A)=>A.kind===d.kind);if(!e)throw Error(`No ${d.kind} cleanup driver is configured.`);E.store.updateCleanup(d.id,{status:"running"});let h=[],R=[];for(let A of d.candidates){_.throwIfCancellationRequested();try{await e.remove(A),h.push(A.id)}catch(S){R.push({id:A.id,error:S instanceof Error?S.message:String(S)})}}let N=R.length?h.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(d.id,{status:N,result:{removed:h,failed:R,reclaimedBytes:d.candidates.filter((A)=>h.includes(A.id)).reduce((A,S)=>A+S.bytes,0)}}),R.length)throw Error(`Cleanup failed for ${R.length} candidate(s).`);return{planId:d.id,removed:h.length,reclaimedBytes:d.estimatedBytes}},"maintenance.drill":async(_)=>{let d=E.store.drill(String(V1(_.operation.input).drillId??""));if(!d)throw Error("DR drill was not found.");let e=E.recovery?.find((S)=>S.scenario===d.scenario);if(!e)throw Error(`No ${d.scenario} recovery driver is configured.`);let h=new Date;E.store.updateDrill(d.id,{status:"restoring",startedAt:h.toISOString()});let R=d.isolatedTarget,N={},A={};try{_.checkpoint("restore","Restoring into isolated drill target.");let S=await e.restore({drill:d,signal:_.signal});if(!S.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");R=S.target,N=S.evidence;let L=(h.getTime()-new Date(S.recoveryPointAt).getTime())/60000;E.store.updateDrill(d.id,{status:"verifying",measuredRpoMinutes:L,evidence:{restore:N}}),_.checkpoint("verify","Running recovery health checks without production traffic.");let O=await e.verify({drill:d,target:R});A=O.evidence;let I=(Date.now()-h.getTime())/60000;if(!O.healthy||L>d.expectedRpoMinutes||I>d.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(d.id,{measuredRpoMinutes:L,measuredRtoMinutes:I,evidence:{restore:N,verify:A}})}catch(S){throw E.store.updateDrill(d.id,{status:"failed",error:S instanceof Error?S.message:String(S),evidence:{restore:N,verify:A}}),S}finally{E.store.updateDrill(d.id,{status:"cleaning"});try{await e.cleanup({drill:d,target:R});let S=E.store.drill(d.id);E.store.updateDrill(d.id,{status:S.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(S){E.store.updateDrill(d.id,{status:"cleanup_required",cleanupVerified:!1,error:S instanceof Error?S.message:String(S),finishedAt:new Date().toISOString()})}}return{drillId:d.id,status:E.store.drill(d.id).status}}}}var vW={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class YS{kind;control;projectId;organizationId;constructor(E,r,t,T){this.kind=E;this.control=r;this.projectId=t;this.organizationId=T}async discover(E){let r=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),t=new Date(Date.now()-r*86400000).toISOString(),T=vW[this.kind],_=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(T.select).all(_,t).map((e)=>({id:String(e.id),kind:this.kind,label:`${this.kind}:${String(e.id)}`,bytes:Number(e.bytes??0),metadata:{createdAt:String(e.created_at)}}))}async remove(E){if(this.control.database.run(vW[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function Qx(){let E=await tE(),r=mE(process.cwd(),E),t=new HS(r.store),T=new fS(t),_=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((d)=>new YS(d,r.store,r.project.id,r.organization.id));return{controlPlane:r,store:t,service:T,cleanup:_}}async function jd(E){let r=await Qx();try{await E(r)}catch(t){Y(t instanceof Error?t.message:String(t)),process.exitCode=1}finally{r.controlPlane.store.close()}}function P1(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(r)=>jd((t)=>{let T={manifests:t.store.manifests(t.controlPlane.organization.id),windows:t.store.windows(t.controlPlane.project.id),campaigns:t.store.campaigns(t.controlPlane.project.id),cleanups:t.store.cleanups(t.controlPlane.project.id),drills:t.store.drills(t.controlPlane.project.id)},_=[...T.manifests.map((d)=>["update",d.version,d.compatibility.compatible?"compatible":"blocked",d.compatibility.reasons.join("; ")||d.channel]),...T.campaigns.map((d)=>["upgrade",d.id,d.status,d.currentStage??d.fromVersion]),...T.cleanups.map((d)=>["cleanup",d.kind,d.status,`${d.candidates.length} items / ${d.estimatedBytes} bytes`]),...T.drills.map((d)=>["DR drill",d.scenario,d.status,d.isolatedTarget])];if(r.json)console.log(JSON.stringify(T,null,2));else TE(["Area","Name / version","Status","Detail"],_)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(r,t)=>jd(async(T)=>{let _=T.store.addTrustedKey({organizationId:T.controlPlane.organization.id,name:r,publicKeyPem:await Bun.file(t).text()});K(`Trusted ${_.name}: ${_.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(r,t,T)=>jd(async(_)=>{let d=await Bun.file(r).json(),e=(await Bun.file(t).text()).trim(),h=_.store.importManifest({organizationId:_.controlPlane.organization.id,keyId:T,document:d,signature:e,current:{schemaVersion:_.controlPlane.store.health().schemaVersion,currentVersion:BS,platform:process.platform,architecture:process.arch}});K(`Verified ${h.version}; ${h.compatibility.compatible?"compatible":"blocked: "+h.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(r,t,T)=>jd((_)=>{let d=_.store.createWindow({projectId:_.controlPlane.project.id,name:r,schedule:t,timezone:T.timezone,durationMinutes:Number(T.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});K(`Created ${d.name} (${d.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(r,t,T)=>jd((_)=>{let d=new Z_(_.controlPlane.store).list(_.controlPlane.project.id).filter((R)=>R.status==="ready").map((R)=>({serverId:R.id,target:R.name,previousVersion:R.bootstrapVersion??BS}));if(!d.length)d.push({target:"control-plane",previousVersion:BS});let e=_.store.createCampaign({projectId:_.controlPlane.project.id,manifestId:r,fromVersion:BS,strategy:T.strategy==="rolling"?"rolling":"canary",batchSize:Number(T.batch),healthGate:{kind:"platform"},backupId:t,targets:d}),h=_.service.enqueueCampaign(e.id);K(`Staged upgrade queued: ${h.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(r,t)=>jd(async(T)=>{let _=await T.service.previewCleanup({projectId:T.controlPlane.project.id,kind:r,criteria:{olderThanDays:Number(t.olderThan)}},T.cleanup);TE(["ID","Candidate","Bytes"],_.candidates.map((d)=>[d.id,d.label,String(d.bytes)])),c(`Apply with: cloud cleanup:apply ${_.id} --confirm "DELETE ${_.candidates.length} ${_.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(r,t)=>jd((T)=>{let _=T.service.enqueueCleanup(r,String(t.confirm??""));K(`Cleanup queued: ${_.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(r,t,T)=>jd((_)=>{let d=_.store.createDrill({projectId:_.controlPlane.project.id,scenario:r,isolatedTarget:t,expectedRpoMinutes:Number(T.rpo),expectedRtoMinutes:Number(T.rto),recoveryPointId:T.recoveryPoint,topologyId:T.topology});K(`Planned isolated drill ${d.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(r)=>jd((t)=>{let T=t.service.enqueueDrill(r);K(`DR drill queued: ${T.operation.id}`)}))}QE();Xe();XT();async function K1(){try{return(await tE()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function Z1(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(r)=>{b("Lambda Functions");let t=r?.region||await K1(),T=new yr(t);try{let{Functions:_=[]}=await T.listFunctions({MaxItems:50});if(!_.length){c("No functions found");return}TE(["Name","Runtime","Memory","Timeout","Last Modified"],_.map((d)=>[d.FunctionName??"-",d.Runtime??"-",d.MemorySize?`${d.MemorySize} MB`:"-",d.Timeout?`${d.Timeout}s`:"-",d.LastModified??"-"]))}catch(_){Y(`Failed to list functions: ${_.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(r,t)=>{b(`Invoking ${r}`);let T=t?.region||await K1(),_=new yr(T),d=new v("Invoking function...");d.start();try{let e=await _.invoke({FunctionName:r,InvocationType:t?.async?"Event":"RequestResponse",Payload:t?.payload||"{}",LogType:t?.async?"None":"Tail"});if(e.FunctionError){if(d.fail(`Function returned an error (${e.FunctionError})`),e.Payload)c(e.Payload);process.exitCode=1;return}if(d.succeed(`Invoked (status ${e.StatusCode})`),e.Payload)c(`
+`).find((_)=>_&&!_.startsWith("#"))?.trim().split(/\s+/);if(t.code!==0||!T?.[1]||!T[2])throw Error(`SSH host-key scan failed: ${t.stderr.trim()||"no key returned"}`);return{algorithm:T[1],key:T[2]}}async exec(E,r){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return JW(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,r])}}var Ix=(E)=>`SHA256:${cx("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,Ux=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class wd{provider;transport;discoverer;constructor(E,r=new yW,t){this.provider=E;this.transport=r;this.discoverer=t}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let r=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:r.algorithm,hostKeyFingerprint:Ix(r.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let r=await this.transport.exec(E,Ux);if(r.code!==0)throw Error(`Fleet validation failed: ${r.stderr.trim()||r.code}`);try{return JSON.parse(r.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,r){let t=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${r.length}`);if(t.code!==0)throw Error(`Fleet bootstrap failed: ${t.stderr.trim()||t.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function jW(E,r){return{"fleet.bootstrap":async(t)=>{let T=t.operation.input&&typeof t.operation.input==="object"&&!Array.isArray(t.operation.input)?t.operation.input:{},_=E.get(String(T.serverId??""));if(!_)throw Error("Queued fleet server was not found.");let d=r.find((R)=>R.provider===_.provider);if(!d)throw Error(`No ${_.provider} fleet driver is configured.`);let e=Array.isArray(T.steps)?T.steps.map(String):[];if(t.checkpoint("preflight","Rechecking pinned trust and healthy validation."),_.trustState!=="pinned"||!_.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");t.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let h=await d.bootstrap(_,e);return E.update(_.id,{bootstrapVersion:h.version,status:"ready"}),t.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:_.id,bootstrapVersion:h.version,steps:e.length}}}}var K_=(E)=>E==null?void 0:String(E),$h=(E,r)=>{try{return JSON.parse(String(E))}catch{return r}},F1=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:K_(E.provider_id),region:K_(E.region),zone:K_(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:K_(E.host_key_algorithm),hostKeyFingerprint:K_(E.host_key_fingerprint),pendingHostKey:K_(E.pending_host_key),roles:$h(E.roles,[]),labels:$h(E.labels,{}),taints:$h(E.taints,[]),capacity:$h(E.capacity,{}),usage:$h(E.usage,{}),capabilities:$h(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:$h(E.validation,void 0),bootstrapVersion:K_(E.bootstrap_version),heartbeatAt:K_(E.heartbeat_at),lastSeenAt:K_(E.last_seen_at),archivedAt:K_(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class Z_{control;now;id;constructor(E,r=()=>new Date,t=()=>crypto.randomUUID()){this.control=E;this.now=r;this.id=t}get(E){let r=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return r?F1(r):void 0}list(E,r=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(F1).filter((t)=>r||t.status!=="archived")}findProvider(E,r,t){let T=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,r,t);return T?F1(T):void 0}create(E){let r=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,t,t]),this.get(r)}update(E,r){let t=this.get(E);if(!t)throw Error("Server was not found.");let T={...t,...r},_=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[T.name,T.providerId??null,T.region??null,T.zone??null,T.endpoint,T.sshUser,T.sshPort,T.credentialRef,T.hostKeyAlgorithm??null,T.hostKeyFingerprint??null,T.pendingHostKey??null,JSON.stringify(T.roles),JSON.stringify(T.labels),JSON.stringify(T.taints),JSON.stringify(T.capacity),JSON.stringify(T.usage),JSON.stringify(T.capabilities),T.status,T.trustState,JSON.stringify(T.validation??{}),T.bootstrapVersion??null,T.heartbeatAt??null,T.lastSeenAt??null,T.archivedAt??null,_,E]),this.get(E)}}var Dx=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class CS{store;drivers;now;queue;constructor(E,r,t,T=()=>new Date){this.store=E;this.drivers=r;this.now=T;this.queue=t??new aE(E.control)}driver(E){let r=this.drivers.find((t)=>t.provider===E);if(!r)throw Error(`No ${E} fleet driver is configured.`);return r}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!Dx.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let r=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(r)return this.store.update(r.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let t=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),T=this.driver(E.provider);return this.store.create({...E,resourceId:t.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:T.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let r=this.store.get(E);if(!r)throw Error("Server was not found.");let t=await this.driver(r.provider).test(r);if(!t.reachable)return this.store.update(E,{status:"unreachable"});if(r.hostKeyFingerprint&&r.hostKeyFingerprint!==t.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:t.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:t.hostKeyAlgorithm,hostKeyFingerprint:t.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,r){let t=this.store.get(E);if(!t||t.pendingHostKey!==r)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:r,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let r=this.store.get(E);if(!r||r.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let t=await this.driver(r.provider).validate(r),T=[];if(!["x64","arm64","x86_64","aarch64"].includes(t.arch??""))T.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let e of["curl","tar"])if(!t.tools?.[e])T.push({code:`tool.${e}`,severity:"error",message:`${e} is missing.`,remediation:`Install ${e} before bootstrap.`});if(Math.abs(t.timeSkewSeconds??0)>60)T.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!t.dnsOk)T.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let _={valid:!T.some((e)=>e.severity==="error"),facts:t,findings:T,validatedAt:this.now().toISOString(),validatorVersion:"1"},d={cpu:t.cpuCores??0,memoryBytes:t.memoryBytes??0,diskBytes:t.diskBytes??0};return this.store.update(E,{validation:_,capacity:d,status:_.valid?"ready":"degraded"})}bootstrap(E,r=!1){let t=this.store.get(E);if(!t?.validation?.valid)throw Error("A healthy validation report is required.");let T=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!r)return{preview:!0,steps:T};let _=this.queue.enqueue({projectId:t.projectId,resourceId:t.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:T},lockKey:`server:${E}`,providerKey:t.provider}).operation;return{preview:!1,steps:T,operation:_}}heartbeat(E,r){let t=this.store.get(E);if(!t)throw Error("Server was not found.");let T=this.now().toISOString();return this.store.update(E,{usage:r.usage,capabilities:r.capabilities??t.capabilities,heartbeatAt:T,lastSeenAt:T,status:t.status==="draining"||t.status==="drained"?t.status:"ready"})}drain(E,r=!1){return this.store.update(E,{status:r?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,r){let t=this.store.get(E);if(!t||r!==t.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function $x(){let E=await tE(),r=mE(process.cwd(),E),t=new Z_(r.store),T=new CS(t,[new wd("aws"),new wd("hetzner"),new wd("ssh")]);return{controlPlane:r,store:t,service:T}}async function Cd(E){let r=await $x();try{return await E(r)}finally{r.controlPlane.store.close()}}var wh=(E,r)=>{let t=E.store.list(E.controlPlane.project.id).find((T)=>T.id===r||T.name===r);if(!t)throw Error(`Server ${r} was not found.`);return t},Xd=(E)=>{Y(E instanceof Error?E.message:String(E)),process.exitCode=1};function z1(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(r,t)=>{try{await Cd(async(T)=>{let _=r?[wh(T,r)]:T.store.list(T.controlPlane.project.id),d=_.flatMap((e)=>Object.entries(e.capabilities).map(([h,R])=>({server:e.name,provider:e.provider,action:h,...R})));if(t.json)console.log(JSON.stringify({schemaVersion:1,targets:d},null,2));else TE(["Server","Provider","Action","Support","Explanation"],d.map((e)=>[e.server,e.provider,e.action,e.supported?"supported":"unsupported",e.reason??"—"]))})}catch(T){Xd(T)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(r)=>{try{await Cd(async(t)=>{let T=t.store.list(t.controlPlane.project.id);if(r.json)console.log(JSON.stringify(T,null,2));else TE(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],T.map((_)=>[_.name,_.providerId??"—",`${_.provider} / ${_.region??"external"}`,`${_.status} / ${_.trustState}`,_.roles.join(","),`${_.capacity.cpu??0} / ${_.capacity.memoryBytes??0}`,_.heartbeatAt??"never"]))})}catch(t){Xd(t)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(r,t)=>{try{await Cd(async(T)=>{let _=t.provider;if(!["aws","hetzner","ssh"].includes(_)||!t.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let d=T.service.enroll({organizationId:T.controlPlane.organization.id,projectId:T.controlPlane.project.id,name:r,provider:_,providerId:t.providerId,endpoint:t.endpoint,sshUser:t.user??"deploy",credentialRef:t.credentialRef??"secret://fleet/agent",region:t.region,roles:String(t.roles??"application").split(","),labels:Object.fromEntries(String(t.labels??"").split(",").map((e)=>e.split("=")).filter((e)=>e[0]&&e[1]))});K(`Enrolled ${d.name} as ${d.id}; no remote mutation was performed.`)})}catch(T){Xd(T)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(r,t)=>{try{await Cd(async(T)=>{let _=wh(T,r);if(_=await T.service.test(_.id),_.trustState==="rotation_pending"){if(!t.acceptHostKey)throw Error(`Host key changed to ${_.pendingHostKey}; review it first.`);_=T.service.reviewHostKey(_.id,t.acceptHostKey)}let d=await T.service.validate(_.id);if(t.json)console.log(JSON.stringify(d.validation,null,2));else TE(["Severity","Code","Finding","Remediation"],(d.validation?.findings??[]).map((e)=>[e.severity,e.code,e.message,e.remediation??"—"]));if(!d.validation?.valid)process.exitCode=1})}catch(T){Xd(T)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(r,t)=>{try{await Cd(async(T)=>{let _=T.service.bootstrap(wh(T,r).id,!!t.apply);if(_.preview)TE(["Step"],_.steps.map((d)=>[d]));else K(`Bootstrap queued: ${_.operation?.id}`)})}catch(T){Xd(T)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(r,t)=>{try{await Cd(async(T)=>K(T.service.drain(wh(T,r).id,!!t.complete).status))}catch(T){Xd(T)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(r)=>{try{await Cd(async(t)=>{t.service.uncordon(wh(t,r).id),K(`Uncordoned ${r}.`)})}catch(t){Xd(t)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(r,t)=>{try{await Cd(async(T)=>{T.service.archive(wh(T,r).id,t.confirm??""),K(`Archived ${r}; provider infrastructure was not terminated.`)})}catch(T){Xd(T)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(r)=>{try{await Cd(async(t)=>{let T=wh(t,r);if(T.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let _=Bun.spawn(["ssh","-p",String(T.sshPort),"-o","StrictHostKeyChecking=yes",`${T.sshUser}@${T.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),d=await _.exited;if(d)process.exitCode=d})}catch(t){Xd(t)}});for(let[r,t]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:resize <name> <type>","Resize provider compute"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:monitoring <name>","Read server metrics"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(r,t).action(async(...T)=>kT(r.split(" ")[0],{target:String(T[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}QE();var A_=(E,r)=>{try{return JSON.parse(String(E))}catch{return r}},TT=(E)=>E==null?void 0:String(E),BW=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),rN=(E={})=>({...BW(),...E});function FW(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:TT(E.region),architecture:TT(E.architecture),labels:A_(E.labels,{}),requiredServerLabels:A_(E.required_server_labels,{}),toleratedTaints:A_(E.tolerated_taints,[]),capacity:rN(A_(E.capacity,{})),reserved:A_(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:TT(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function zW(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:TT(E.environment_id),resourceId:String(E.resource_id),releaseId:TT(E.release_id),poolId:String(E.pool_id),serverId:TT(E.server_id),purpose:String(E.purpose),requirements:A_(E.requirements,{}),decision:A_(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function wx(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:TT(E.resource_id),poolId:String(E.pool_id),placementId:TT(E.placement_id),operationId:TT(E.operation_id),sourceSha:String(E.source_sha),buildSpec:A_(E.build_spec,{}),credentialPolicy:A_(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:TT(E.workspace),cacheKey:TT(E.cache_key),artifactUri:TT(E.artifact_uri),artifactDigest:TT(E.artifact_digest),status:String(E.status),cleanupAt:TT(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class XS{control;now;id;constructor(E,r=()=>new Date,t=()=>crypto.randomUUID()){this.control=E;this.now=r;this.id=t}createPool(E){let r=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(rN(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,t,t]),this.getPool(r)}getPool(E){let r=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return r?FW(r):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(FW)}updatePool(E,r){let t=this.getPool(E);if(!t)throw Error("Capacity pool was not found.");let T={...t,...r},_=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[T.status,JSON.stringify(T.reserved),JSON.stringify(T.capacity),T.concurrency,_,E]),this.getPool(E)}addMember(E,r,t={}){let T=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,r,JSON.stringify(t),T,T])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((r)=>({serverId:String(r.server_id),status:String(r.status),capacityOverride:A_(r.capacity_override,{})}))}memberStatus(E,r,t){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[t,this.now().toISOString(),E,r])}listPlacements(E,r){let t=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(zW);return r?.length?t.filter((T)=>r.includes(T.status)):t}getPlacement(E){let r=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return r?zW(r):void 0}activeUsage(E,r){let t=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),T=r?t.filter((_)=>String(_.server_id)===r):t;return{resources:T.reduce((_,d)=>{let e=rN(A_(d.resources,{}));for(let h of Object.keys(_))_[h]+=e[h];return _},BW()),count:T.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let r=this.id(),t=this.id(),T=this.now().toISOString(),_=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[r,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,T,T]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[t,r,E.decision.poolId,E.decision.serverId??null,JSON.stringify(rN(E.requirements.resources)),_,T,T]),this.getPlacement(r)})}transitionPlacement(E,r){if(!this.getPlacement(E))throw Error("Placement was not found.");let T=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[r,T,E]),["released","failed","blocked"].includes(r))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[T,E]);return this.getPlacement(E)}createBuild(E){let r=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[r,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),t,t]),this.getBuild(r)}getBuild(E){let r=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return r?wx(r):void 0}updateBuild(E,r){let t=this.getBuild(E);if(!t)throw Error("Remote build was not found.");let T={...t,...r},_=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[T.operationId??null,T.workspace??null,T.cacheKey??null,T.artifactUri??null,T.artifactDigest??null,T.status,T.cleanupAt??null,_,E]),this.getBuild(E)}}var rc=["cpu","memoryBytes","diskBytes","gpu"],WW=(E,r={})=>Object.entries(r).every(([t,T])=>E[t]===T),Cx=(E,r,t)=>Object.fromEntries(rc.map((T)=>[T,Math.max(0,E[T]-r[T]-(t[T]??0))])),Xx=(E,r)=>rc.every((t)=>E[t]>=(r[t]??0)),Jx=(E,r)=>rc.reduce((t,T)=>t+(r[T]??0)/(E[T]||1),0);class JS{store;fleet;constructor(E,r){this.store=E;this.fleet=r}poolCandidates(E,r,t){let T=[];for(let _ of this.store.listPools(E)){if(_.id===t)continue;let d=[];if(_.status!=="active")d.push(`pool is ${_.status}`);if(_.purpose!==r.purpose)d.push(`purpose is ${_.purpose}`);if(r.region&&_.region!==r.region)d.push(`region is ${_.region??"unset"}`);if(r.architecture&&_.architecture!==r.architecture)d.push(`architecture is ${_.architecture??"unset"}`);if(!WW(_.labels,r.labels))d.push("pool labels do not match");if(_.backend==="server"){let e=this.store.members(_.id);if(!e.length)T.push(this.decision(_,void 0,r,[...d,"pool has no servers"]));for(let h of e){let R=this.fleet.get(h.serverId),N=[...d];if(!R)N.push("server is missing");else this.serverReasons(_,R,h.status,r,N);T.push(this.decision(_,R,r,N,h.capacityOverride))}}else T.push(this.decision(_,void 0,r,d))}return T.sort((_,d)=>Number(d.eligible)-Number(_.eligible)||_.score.cost-d.score.cost||_.score.spread-d.score.spread||_.score.fit-d.score.fit||_.poolName.localeCompare(d.poolName)||(_.serverId??"").localeCompare(d.serverId??""))}serverReasons(E,r,t,T,_){if(t!=="active")_.push(`member is ${t}`);if(r.status!=="ready")_.push(`server is ${r.status}`);if(!r.roles.includes(T.purpose==="build"?"build":T.purpose))_.push(`server lacks ${T.purpose} role`);if(!WW(r.labels,E.requiredServerLabels))_.push("server labels do not match pool selector");for(let d of r.taints)if(!E.toleratedTaints.includes(d))_.push(`taint ${d} is not tolerated`)}decision(E,r,t,T,_={}){let d=rN({...r?.capacity,..._}),e=r?Object.fromEntries(rc.map((N)=>[N,Math.min(E.capacity[N],d[N])])):E.capacity,h=this.store.activeUsage(E.id,r?.id),R=Cx(e,h.resources,E.reserved);if(h.count>=E.maxWorkloads)T.push("workload limit reached");if(t.purpose==="build"&&h.count>=E.concurrency)T.push("build concurrency reached");if(!Xx(R,t.resources))T.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:r?.id,eligible:T.length===0,reasons:T,available:R,score:{fit:Jx(R,t.resources),spread:h.count,cost:E.costWeight}}}explain(E,r){return this.poolCandidates(E,r)}place(E){return this.store.control.transaction(()=>{let r=this.poolCandidates(E.projectId,E.requirements).find((t)=>t.eligible);if(!r)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((t)=>t.reasons).join("; ")}`);return this.store.reserve({...E,decision:r})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let r=this.store.updatePool(E,{status:"draining"}),t=[],T=[];for(let _ of this.store.listPlacements(r.projectId,["reserved","active"]).filter((d)=>d.poolId===E)){if(_.stateful){T.push(this.store.transitionPlacement(_.id,"blocked"));continue}this.store.transitionPlacement(_.id,"moving");let d=this.place({projectId:_.projectId,environmentId:_.environmentId,resourceId:_.resourceId,releaseId:_.releaseId,requirements:_.requirements});t.push(this.activate(d.id)),this.store.transitionPlacement(_.id,"released")}return{pool:r,moved:t,blocked:T}}drainServer(E,r){this.store.memberStatus(E,r,"draining");let t=this.store.getPool(E);if(!t)throw Error("Capacity pool was not found.");let T=[],_=[];for(let d of this.store.listPlacements(t.projectId,["reserved","active"]).filter((e)=>e.poolId===E&&e.serverId===r)){if(d.stateful){_.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"moving");let e=this.poolCandidates(d.projectId,d.requirements).find((R)=>R.eligible);if(!e){_.push(this.store.transitionPlacement(d.id,"blocked"));continue}let h=this.store.reserve({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements,decision:e});T.push(this.activate(h.id)),this.store.transitionPlacement(d.id,"released")}return{moved:T,blocked:_}}reconcileFailure(E){let r=this.fleet.get(E);if(!r)throw Error("Server was not found.");let t=[],T=[];for(let _ of this.store.listPlacements(r.projectId,["active"]).filter((d)=>d.serverId===E)){if(_.stateful||!_.autoReschedule){T.push(this.store.transitionPlacement(_.id,"blocked"));continue}this.store.transitionPlacement(_.id,"failed");let d=this.place({projectId:_.projectId,environmentId:_.environmentId,resourceId:_.resourceId,releaseId:_.releaseId,requirements:_.requirements});t.push(this.activate(d.id))}return{rescheduled:t,blocked:T}}}async function yx(){let E=await tE(),r=mE(process.cwd(),E),t=new XS(r.store),T=new JS(t,new Z_(r.store));return{controlPlane:r,store:t,service:T}}async function yS(E){let r=await yx();try{await E(r)}catch(t){Y(t instanceof Error?t.message:String(t)),process.exitCode=1}finally{r.controlPlane.store.close()}}var tc=(E)=>Object.fromEntries(String(E??"").split(",").map((r)=>r.split("=")).filter((r)=>r[0]&&r[1])),HW=(E)=>Object.fromEntries(Object.entries(tc(E)).map(([r,t])=>[r,Number(t)]));function B1(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(r)=>yS((t)=>{let T=t.store.listPools(t.controlPlane.project.id);if(r.json)console.log(JSON.stringify(T,null,2));else TE(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],T.map((_)=>[_.name,_.purpose,_.backend,`${_.region??"any"} / ${_.architecture??"any"}`,_.status,JSON.stringify(_.capacity),String(_.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(r,t)=>yS((T)=>{let{purpose:_,backend:d}=t;if(!["application","build","worker","monitoring","backup"].includes(_)||!["server","ecs","asg"].includes(d))throw Error("Unsupported pool purpose or backend.");let e=T.store.createPool({organizationId:T.controlPlane.organization.id,projectId:T.controlPlane.project.id,name:r,purpose:_,backend:d,region:t.region,architecture:t.arch,labels:tc(t.labels),requiredServerLabels:tc(t.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...HW(t.capacity)},maxWorkloads:Number(t.max),costWeight:1,concurrency:Number(t.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});K(`Created ${e.name} (${e.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(r,t)=>yS((T)=>{let _=T.store.listPools(T.controlPlane.project.id).find((e)=>e.id===r||e.name===r),d=new Z_(T.controlPlane.store).list(T.controlPlane.project.id).find((e)=>e.id===t||e.name===t);if(!_||!d)throw Error("Pool or server was not found.");T.store.addMember(_.id,d.id),K(`Attached ${d.name} to ${_.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(r)=>yS((t)=>{let T=t.service.explain(t.controlPlane.project.id,{purpose:r.purpose,resources:HW(r.resources),region:r.region,architecture:r.arch,labels:tc(r.labels)});if(r.json)console.log(JSON.stringify(T,null,2));else TE(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],T.map((_)=>[_.poolName,_.serverId??"provider-managed",_.eligible?"yes":"no",JSON.stringify(_.available),`${_.score.fit.toFixed(2)} / ${_.score.spread} / ${_.score.cost}`,_.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(r)=>yS((t)=>{let T=t.store.listPools(t.controlPlane.project.id).find((d)=>d.id===r||d.name===r);if(!T)throw Error("Pool was not found.");let _=t.service.drainPool(T.id);K(`Draining ${T.name}: moved ${_.moved.length}, blocked ${_.blocked.length} stateful placement(s).`)}))}QE();var Jd=(E,r)=>{try{return JSON.parse(String(E))}catch{return r}},uT=(E)=>E==null?void 0:String(E),fW=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:uT(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:Jd(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:Jd(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:uT(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),W1=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:uT(E.stack_id),stackRevision:uT(E.stack_revision),status:String(E.status),health:Jd(E.health,{}),lastHealthyAt:uT(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),H1=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:Jd(E.config,{}),status:String(E.status),checkpoint:uT(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:uT(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),f1=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:Jd(E.weights,{}),desiredWeights:Jd(E.desired_weights,{}),status:String(E.status),providerState:Jd(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),YW=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:uT(E.operation_id),kind:String(E.kind),requestedRegion:uT(E.requested_region),revision:uT(E.revision),plan:Jd(E.plan,[]),currentStep:uT(E.current_step),completedSteps:Jd(E.completed_steps,[]),status:String(E.status),error:uT(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class jS{control;now;id;constructor(E,r=()=>new Date,t=()=>crypto.randomUUID()){this.control=E;this.now=r;this.id=t}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((d)=>d.region)).size!==E.regions.length||E.regions.filter((d)=>d.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let r=E.regions.find((d)=>d.role==="primary"),t=this.id(),T=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[t,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,r.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),r.region,T,T]);for(let d of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),t,d.region,d.role,d.provider,T,T]);for(let d of E.dataPolicy.replicate)for(let e of E.regions)for(let h of E.regions.filter((R)=>R.region!==e.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),t,d,e.region,h.region,"{}",T,T]);let _=Object.fromEntries(E.regions.map((d)=>[d.region,d.region===r.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),t,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(_),JSON.stringify(_),T,T]),this.get(t)})}get(E){let r=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return r?fW(r):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(fW)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(W1)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(H1)}route(E){let r=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return r?f1(r):void 0}updateTopology(E,r){let t=this.get(E);if(!t)throw Error("Regional topology was not found.");let T={...t,...r},_=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[T.status,T.activeRegion,T.revision??null,JSON.stringify(T.regions),_,E]),this.get(E)}updateTarget(E,r){let t=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!t)throw Error("Regional target was not found.");let T=W1(t),_={...T,...r},d=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[_.role,_.stackId??null,_.stackRevision??null,_.status,JSON.stringify(_.health),_.lastHealthyAt??null,d,E]),W1(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,r){let t=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!t)throw Error("Replication channel was not found.");let T=H1(t),_={...T,...r},d=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[_.status,_.checkpoint??null,_.lagSeconds??null,_.lastVerifiedAt??null,d,E]),H1(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,r){let t=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!t)throw Error("Traffic route was not found.");let T=f1(t),_={...T,...r},d=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(_.weights),JSON.stringify(_.desiredWeights),_.status,JSON.stringify(_.providerState),d,E]),f1(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let r=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[r,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),t,t]),this.execution(r)}execution(E){let r=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return r?YW(r):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(YW)}updateExecution(E,r){let t=this.execution(E);if(!t)throw Error("Regional execution was not found.");let T={...t,...r},_=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[T.operationId??null,T.currentStep??null,JSON.stringify(T.completedSteps),T.status,T.error??null,_,E]),this.execution(E)}}class FS{store;queue;constructor(E,r){this.store=E;this.queue=r??new aE(E.control)}create(E){return this.store.create(E)}plan(E,r,t){if(!this.store.get(E))throw Error("Regional topology was not found.");let _=this.store.targets(E),d=this.store.channels(E);if(r==="rollout")return[..._.filter((e)=>e.role==="secondary").map((e)=>`apply:${e.region}`),..._.filter((e)=>e.role==="primary").map((e)=>`apply:${e.region}`),...d.map((e)=>`replicate:${e.kind}:${e.targetRegion}`),"traffic:activate"];if(r==="failover"||r==="failback")return[`health:${t}`,`replication:${t}`,`traffic:${t}`,`roles:${t}`];if(r==="destroy")return["traffic:drain",..._.filter((e)=>e.role==="secondary").map((e)=>`delete:${e.region}`),..._.filter((e)=>e.role==="primary").map((e)=>`delete:${e.region}`),"complete"];return["observe","repair"]}enqueue(E){let r=this.store.get(E.topologyId);if(!r)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!r.regions.some((d)=>d.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===r.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==r.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&r.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let t=this.plan(r.id,E.kind,E.targetRegion),T=this.store.createExecution({topologyId:r.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:t}),_=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,kind:`region.${E.kind}`,input:{executionId:T.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${r.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(T.id,{operationId:_.id}),{execution:this.store.execution(T.id),operation:_}}}var jx=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function QW(E,r){let t=(N)=>{let A=r.find((S)=>S.provider===N.provider);if(!A)throw Error(`No ${N.provider} regional driver is configured.`);return A},T=(N,A,S)=>{N.throwIfCancellationRequested(),N.checkpoint(S,S),E.updateExecution(A.id,{status:"running",currentStep:S,completedSteps:[...E.execution(A.id).completedSteps,S]})},_=async(N,A)=>{let S=E.route(N.id);if(!S)throw Error("Regional traffic route was not found.");let L=E.targets(N.id).find((I)=>I.region===N.activeRegion)??E.targets(N.id)[0];if(!L)throw Error("Regional traffic target was not found.");E.updateRoute(S.id,{status:"applying",desiredWeights:A});let O=await t(L).applyTraffic({route:E.route(N.id),topology:N,weights:A});E.updateRoute(S.id,{status:Object.values(A).every((I)=>I===0)?"drained":"in_sync",weights:A,providerState:O.providerState})},d=async(N,A,S,L)=>{E.updateTopology(S.id,{status:"provisioning"});let O=A.revision,I=L.manifest??{},D=E.targets(S.id).sort((C,y)=>Number(C.role==="primary")-Number(y.role==="primary"));for(let C of D){T(N,A,`apply:${C.region}`),E.updateTarget(C.id,{status:"provisioning"});let y=await t(C).applyStack({target:C,revision:O,manifest:I,signal:N.signal}),j=await t(C).health({target:E.updateTarget(C.id,{stackId:y.stackId,stackRevision:O})});if(!j.healthy)throw Error(`Regional health gate failed in ${C.region}.`);E.updateTarget(C.id,{status:"ready",health:j.evidence,lastHealthyAt:new Date().toISOString()})}for(let C of E.channels(S.id)){T(N,A,`replicate:${C.kind}:${C.targetRegion}`),E.updateChannel(C.id,{status:"configuring"});let y=D.find((f)=>f.region===C.sourceRegion),j=await t(y).configureReplication({channel:C,topology:S}),B=await t(y).verifyReplication({channel:E.updateChannel(C.id,{checkpoint:j.checkpoint,lagSeconds:j.lagSeconds}),topology:S});if(!B.healthy||B.lagSeconds>S.dataPolicy.maxLagSeconds)throw Error(`${C.kind} replication to ${C.targetRegion} exceeds the RPO.`);E.updateChannel(C.id,{status:"in_sync",checkpoint:B.checkpoint,lagSeconds:B.lagSeconds,lastVerifiedAt:new Date().toISOString()})}T(N,A,"traffic:activate");let $=Object.fromEntries(S.regions.map((C)=>[C.region,C.region===S.activeRegion?100:0]));return await _(S,$),E.updateTopology(S.id,{status:"ready",revision:O}),{revision:O,activeRegion:S.activeRegion}},e=async(N,A,S)=>{let L=A.requestedRegion,O=E.targets(S.id).find(($)=>$.region===L);if(!O)throw Error("Requested regional target was not found.");E.updateTopology(S.id,{status:A.kind==="failover"?"failing_over":"failing_back"}),T(N,A,`health:${L}`);let I=await t(O).health({target:O});if(!I.healthy)throw Error(`Target region ${L} is unhealthy.`);E.updateTarget(O.id,{status:"ready",health:I.evidence,lastHealthyAt:new Date().toISOString()}),T(N,A,`replication:${L}`);for(let $ of E.channels(S.id).filter((C)=>C.targetRegion===L)){let C=await t(O).verifyReplication({channel:$,topology:S});if(!C.healthy||C.lagSeconds>S.dataPolicy.maxLagSeconds)throw Error(`${$.kind} replication is outside the failover RPO.`);E.updateChannel($.id,{status:"in_sync",checkpoint:C.checkpoint,lagSeconds:C.lagSeconds,lastVerifiedAt:new Date().toISOString()})}T(N,A,`traffic:${L}`),await _(S,Object.fromEntries(S.regions.map(($)=>[$.region,$.region===L?100:0]))),T(N,A,`roles:${L}`);let D=S.regions.map(($)=>({...$,role:$.region===L?"primary":"secondary"}));for(let $ of E.targets(S.id))E.updateTarget($.id,{role:$.region===L?"primary":"secondary"});return E.updateTopology(S.id,{status:A.kind==="failover"?"failed_over":"ready",activeRegion:L,regions:D}),{activeRegion:L}},h=async(N,A,S,L)=>{E.updateTopology(S.id,{status:"destroying"}),T(N,A,"traffic:drain"),await _(S,Object.fromEntries(S.regions.map((I)=>[I.region,0])));let O=L.deleteData!==!0;for(let I of E.targets(S.id).sort((D,$)=>Number(D.role==="primary")-Number($.role==="primary")))T(N,A,`delete:${I.region}`),E.updateTarget(I.id,{status:"deleting"}),await t(I).deleteStack({target:I,retainData:O,signal:N.signal}),E.updateTarget(I.id,{status:"deleted"});return T(N,A,"complete"),E.updateTopology(S.id,{status:"destroyed"}),{destroyed:!0,dataRetained:O}},R=async(N)=>{let A=jx(N.operation.input),S=E.execution(String(A.executionId??""));if(!S)throw Error("Regional execution was not found.");let L=E.get(S.topologyId);if(!L)throw Error("Regional topology was not found.");try{let O;if(S.kind==="rollout")O=await d(N,S,L,A);else if(S.kind==="failover"||S.kind==="failback")O=await e(N,S,L);else if(S.kind==="destroy")O=await h(N,S,L,A);else throw Error("Regional reconciliation is not configured.");return E.updateExecution(S.id,{status:"succeeded",currentStep:void 0}),{executionId:S.id,...O}}catch(O){if(E.updateExecution(S.id,{status:N.cancellationRequested()?"cancelled":"failed",error:O instanceof Error?O.message:String(O)}),E.get(L.id)?.status!=="destroyed")E.updateTopology(L.id,{status:"failed"});throw O}};return{"region.rollout":R,"region.failover":R,"region.failback":R,"region.destroy":R,"region.reconcile":R}}class Y1{provider;reason;constructor(E,r="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=r}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function Fx(){let E=await tE(),r=mE(process.cwd(),E),t=new jS(r.store),T=new FS(t);return{controlPlane:r,store:t,service:T}}async function Ch(E){let r=await Fx();try{await E(r)}catch(t){Y(t instanceof Error?t.message:String(t)),process.exitCode=1}finally{r.controlPlane.store.close()}}var zS=(E,r)=>{let t=E.store.list(E.controlPlane.project.id).find((T)=>T.id===r||T.name===r);if(!t)throw Error("Regional topology was not found.");return t},zx=(E)=>E.split(",").map((r,t)=>{let[T,_="aws"]=r.split(":");return{region:String(T),provider:_,role:t===0?"primary":"secondary"}}),Bx=(E)=>{let r=new Set(["s3","dynamodb","secrets"]),t=E.split(",").map((_)=>_.trim()),T=t.find((_)=>!r.has(_));if(T)throw Error(`Unsupported replication kind: ${T}`);return t};function Q1(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(r)=>Ch((t)=>{let T=t.store.list(t.controlPlane.project.id).map((_)=>({topology:_,targets:t.store.targets(_.id),channels:t.store.channels(_.id),route:t.store.route(_.id),executions:t.store.executions(_.id)}));if(r.json)console.log(JSON.stringify(T,null,2));else TE(["Name","Hostname","Active","Status","Revision","Replication"],T.map((_)=>[_.topology.name,_.topology.hostname,_.topology.activeRegion,_.topology.status,_.topology.revision??"—",`${_.channels.filter((d)=>d.status==="in_sync").length}/${_.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(r,t)=>Ch((T)=>{if(!t.hostname||!t.regions)throw Error("--hostname and --regions are required.");let _=T.service.create({organizationId:T.controlPlane.organization.id,projectId:T.controlPlane.project.id,name:r,hostname:t.hostname,regions:zx(t.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Bx(String(t.replicate)),maxLagSeconds:Number(t.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!t.cdn,wafEnabled:!!t.waf});K(`Created ${_.name} (${_.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(r,t,T)=>Ch((_)=>TE(["Step"],_.service.plan(zS(_,r).id,t,T.target).map((d)=>[d])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(r,t,T)=>Ch(async(_)=>{let d=T.manifest?await Bun.file(T.manifest).json():{},e=_.service.enqueue({topologyId:zS(_,r).id,kind:"rollout",revision:t,manifest:d});K(`Regional rollout queued: ${e.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(r,t)=>Ch((T)=>{let _=T.service.enqueue({topologyId:zS(T,r).id,kind:"failover",targetRegion:t});K(`Failover queued: ${_.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(r,t)=>Ch((T)=>{let _=T.service.enqueue({topologyId:zS(T,r).id,kind:"failback",targetRegion:t});K(`Failback queued: ${_.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(r,t)=>Ch((T)=>{let _=T.service.enqueue({topologyId:zS(T,r).id,kind:"destroy",confirmation:t.confirm});K(`Regional teardown queued: ${_.operation.id}; replicated data remains retained.`)}))}QE();var BS="0.7.58";import{createHash as G1,createPublicKey as VW,verify as Hx}from"node:crypto";function WS(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(WS).join(",")}]`;return`{${Object.keys(E).sort().map((r)=>`${JSON.stringify(r)}:${WS(E[r])}`).join(",")}}`}var PW=(E)=>G1("sha256").update(WS(E)).digest("hex"),Tc=(E)=>G1("sha256").update(WS(E)).digest("hex"),KW=(E)=>G1("sha256").update(VW(E).export({type:"spki",format:"der"})).digest("hex");function ZW(E,r,t){try{return Hx(null,Buffer.from(WS(E)),VW(t),Buffer.from(r,"base64"))}catch{return!1}}var GW=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((r)=>Number(r)||0),MW=(E,r)=>{let t=GW(E),T=GW(r);for(let _=0;_<3;_++){let d=(t[_]??0)-(T[_]??0);if(d)return d}return 0};function gW(E,r){let t=[];if(r.schemaVersion<E.minimumSchema)t.push(`schema ${r.schemaVersion} is below ${E.minimumSchema}`);if(r.schemaVersion>E.maximumSchema)t.push(`schema ${r.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&MW(r.currentVersion,E.minimumVersion)<0)t.push(`platform ${r.currentVersion} is below ${E.minimumVersion}`);if(MW(E.version,r.currentVersion)<=0)t.push(`version ${E.version} is not newer than ${r.currentVersion}`);if(!E.artifacts.some((T)=>T.platform===r.platform&&T.architecture===r.architecture))t.push(`no artifact for ${r.platform}/${r.architecture}`);return{compatible:t.length===0,reasons:t}}var yd=(E,r)=>{try{return JSON.parse(String(E))}catch{return r}},Ct=(E)=>E==null?void 0:String(E),fx=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:Ct(E.revoked_at),createdAt:String(E.created_at)}),qW=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:yd(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:yd(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),xW=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:yd(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),bW=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:Ct(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:yd(E.health_gate,{}),status:String(E.status),currentStage:Ct(E.current_stage),backupId:Ct(E.backup_id),approvedBy:Ct(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),M1=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:Ct(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:yd(E.evidence,{}),error:Ct(E.error),startedAt:Ct(E.started_at),finishedAt:Ct(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),kW=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:yd(E.criteria,{}),candidates:yd(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:Ct(E.confirmation),expiresAt:String(E.expires_at),result:yd(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),uW=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:Ct(E.backup_policy_id),recoveryPointId:Ct(E.recovery_point_id),topologyId:Ct(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:Ct(E.operation_id),evidence:yd(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:Ct(E.error),startedAt:Ct(E.started_at),finishedAt:Ct(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class HS{control;now;id;constructor(E,r=()=>new Date,t=()=>crypto.randomUUID()){this.control=E;this.now=r;this.id=t}addTrustedKey(E){let r=this.id(),t=this.now().toISOString(),T=KW(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[r,E.organizationId,E.name,E.publicKeyPem,T,t]),this.key(r)}key(E){let r=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return r?fx(r):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let r=this.key(E.keyId);if(!r||r.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(r.revokedAt)throw Error("Update signing key is revoked.");if(!ZW(E.document,E.signature,r.publicKeyPem))throw Error("Update manifest signature is invalid.");let t=gW(E.document,E.current),T=PW(E.document),_=this.id(),d=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[_,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,T,JSON.stringify(E.document),E.signature,JSON.stringify(t),d]),this.manifest(_)}manifest(E){let r=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return r?qW(r):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(qW)}createWindow(E){let r=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[r,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,t,t]),this.window(r)}window(E){let r=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return r?xW(r):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(xW)}createCampaign(E){return this.control.transaction(()=>{let r=this.manifest(E.manifestId);if(!r?.compatibility.compatible||r.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let t=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[t,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,T,T]),E.targets.forEach((_,d)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),t,_.serverId??null,_.target,E.strategy==="canary"?d===0?0:1+Math.floor((d-1)/E.batchSize):Math.floor(d/E.batchSize),_.previousVersion,T,T])),this.campaign(t)})}campaign(E){let r=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return r?bW(r):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(bW)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(M1)}updateCampaign(E,r){let t=this.campaign(E);if(!t)throw Error("Upgrade campaign was not found.");let T={...t,...r};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[T.status,T.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,r){let t=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!t)throw Error("Upgrade target was not found.");let T={...M1(t),...r};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[T.status,JSON.stringify(T.evidence),T.error??null,T.startedAt??null,T.finishedAt??null,this.now().toISOString(),E]),M1(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let r=[...E.candidates].sort((e,h)=>e.id.localeCompare(h.id)),t=Tc(r),T=this.id(),_=this.now().toISOString(),d=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[T,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(r),t,r.reduce((e,h)=>e+h.bytes,0),d,_,_]),this.cleanup(T)}cleanup(E){let r=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return r?kW(r):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(kW)}updateCleanup(E,r){let t=this.cleanup(E);if(!t)throw Error("Cleanup plan was not found.");let T={...t,...r};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[T.status,T.confirmation??null,JSON.stringify(T.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let r=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[r,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,t,t]),this.drill(r)}drill(E){let r=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return r?uW(r):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(uW)}updateDrill(E,r){let t=this.drill(E);if(!t)throw Error("DR drill was not found.");let T={...t,...r};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[T.status,T.operationId??null,JSON.stringify(T.evidence),T.measuredRpoMinutes??null,T.measuredRtoMinutes??null,T.cleanupVerified?1:0,T.error??null,T.startedAt??null,T.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}function Yx(E,r=new Date){if(!E.enabled)return!1;let t=new Date(E.schedule);if(!Number.isNaN(t.getTime()))return r>=t&&r.getTime()<=t.getTime()+E.durationMinutes*60000;let T=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!T)return!1;let _=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(r),d=Number(_.find((h)=>h.type==="hour")?.value)*60+Number(_.find((h)=>h.type==="minute")?.value),e=Number(T[1])*60+Number(T[2]);return d>=e&&d<e+E.durationMinutes}class fS{store;now;queue;constructor(E,r,t=()=>new Date){this.store=E;this.now=t;this.queue=r??new aE(E.control)}enqueueCampaign(E,r={}){let t=this.store.campaign(E);if(!t)throw Error("Upgrade campaign was not found.");let T=t.windowId?this.store.window(t.windowId):void 0;if(T&&!T.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(T&&!r.overrideWindow&&!Yx(T,this.now()))throw Error("Upgrade is outside its maintenance window.");if(T?.requireApproval&&!r.approvedBy&&!t.approvedBy)throw Error("Maintenance approval is required.");let _=this.queue.enqueue({projectId:t.projectId,actorId:r.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:_}}async previewCleanup(E,r){let t=r.find((T)=>T.kind===E.kind);if(!t)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await t.discover(E.criteria)})}enqueueCleanup(E,r){let t=this.store.cleanup(E);if(!t||t.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(t.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let T=`DELETE ${t.candidates.length} ${t.kind}`;if(r!==T)throw Error(`Exact confirmation ${T} is required.`);let _=this.queue.enqueue({projectId:t.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${t.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:r}),operation:_}}enqueueDrill(E){let r=this.store.drill(E);if(!r||r.status!=="planned")throw Error("A planned DR drill is required.");let t=this.queue.enqueue({projectId:r.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${r.scenario}:${r.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:t.id}),operation:t}}}var V1=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function nW(E){return{"maintenance.upgrade":async(_)=>{let d=E.store.campaign(String(V1(_.operation.input).campaignId??""));if(!d||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let e=E.store.manifest(d.manifestId);if(!e?.compatibility.compatible||e.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let h=e.document.artifacts.find((N)=>N.platform===process.platform&&N.architecture===process.arch)??e.document.artifacts[0];if(!h)throw Error("No update artifact matches this platform.");E.store.updateCampaign(d.id,{status:"running",currentStage:"preflight"});let R=[];try{for(let N of[...new Set(E.store.targets(d.id).map((A)=>A.cohort))].sort((A,S)=>A-S)){E.store.updateCampaign(d.id,{currentStage:`cohort:${N}`});for(let A of E.store.targets(d.id).filter((S)=>S.cohort===N)){_.throwIfCancellationRequested(),_.checkpoint(`download:${A.target}`,"Downloading signed platform artifact."),E.store.updateTarget(A.id,{status:"downloading",startedAt:new Date().toISOString()});let S=await E.platform.download({target:A,artifact:h,signal:_.signal});if(S.sha256!==h.sha256)throw Error(`Artifact checksum mismatch for ${A.target}.`);_.checkpoint(`install:${A.target}`,"Installing verified artifact."),E.store.updateTarget(A.id,{status:"installing"}),await E.platform.install({target:A,path:S.path,version:e.version,signal:_.signal}),R.push(A);let L=await E.platform.health({target:A,gate:d.healthGate});if(!L.healthy)throw Error(`Upgrade health gate failed for ${A.target}.`);E.store.updateTarget(A.id,{status:"healthy",evidence:L.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(d.id,{status:"succeeded",currentStage:void 0}),{campaignId:d.id,version:e.version,targets:R.length}}catch(N){E.store.updateCampaign(d.id,{status:"rolling_back",currentStage:"rollback"});for(let A of R.reverse())E.store.updateTarget(A.id,{status:"rolling_back"}),await E.platform.rollback({target:A,version:A.previousVersion,signal:_.signal}),E.store.updateTarget(A.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(d.id,{status:"rolled_back",currentStage:void 0}),N}},"maintenance.cleanup":async(_)=>{let d=E.store.cleanup(String(V1(_.operation.input).planId??""));if(!d||d.status!=="approved")throw Error("Approved cleanup plan was not found.");if(Tc([...d.candidates].sort((A,S)=>A.id.localeCompare(S.id)))!==d.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let e=E.cleanup?.find((A)=>A.kind===d.kind);if(!e)throw Error(`No ${d.kind} cleanup driver is configured.`);E.store.updateCleanup(d.id,{status:"running"});let h=[],R=[];for(let A of d.candidates){_.throwIfCancellationRequested();try{await e.remove(A),h.push(A.id)}catch(S){R.push({id:A.id,error:S instanceof Error?S.message:String(S)})}}let N=R.length?h.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(d.id,{status:N,result:{removed:h,failed:R,reclaimedBytes:d.candidates.filter((A)=>h.includes(A.id)).reduce((A,S)=>A+S.bytes,0)}}),R.length)throw Error(`Cleanup failed for ${R.length} candidate(s).`);return{planId:d.id,removed:h.length,reclaimedBytes:d.estimatedBytes}},"maintenance.drill":async(_)=>{let d=E.store.drill(String(V1(_.operation.input).drillId??""));if(!d)throw Error("DR drill was not found.");let e=E.recovery?.find((S)=>S.scenario===d.scenario);if(!e)throw Error(`No ${d.scenario} recovery driver is configured.`);let h=new Date;E.store.updateDrill(d.id,{status:"restoring",startedAt:h.toISOString()});let R=d.isolatedTarget,N={},A={};try{_.checkpoint("restore","Restoring into isolated drill target.");let S=await e.restore({drill:d,signal:_.signal});if(!S.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");R=S.target,N=S.evidence;let L=(h.getTime()-new Date(S.recoveryPointAt).getTime())/60000;E.store.updateDrill(d.id,{status:"verifying",measuredRpoMinutes:L,evidence:{restore:N}}),_.checkpoint("verify","Running recovery health checks without production traffic.");let O=await e.verify({drill:d,target:R});A=O.evidence;let I=(Date.now()-h.getTime())/60000;if(!O.healthy||L>d.expectedRpoMinutes||I>d.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(d.id,{measuredRpoMinutes:L,measuredRtoMinutes:I,evidence:{restore:N,verify:A}})}catch(S){throw E.store.updateDrill(d.id,{status:"failed",error:S instanceof Error?S.message:String(S),evidence:{restore:N,verify:A}}),S}finally{E.store.updateDrill(d.id,{status:"cleaning"});try{await e.cleanup({drill:d,target:R});let S=E.store.drill(d.id);E.store.updateDrill(d.id,{status:S.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(S){E.store.updateDrill(d.id,{status:"cleanup_required",cleanupVerified:!1,error:S instanceof Error?S.message:String(S),finishedAt:new Date().toISOString()})}}return{drillId:d.id,status:E.store.drill(d.id).status}}}}var vW={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class YS{kind;control;projectId;organizationId;constructor(E,r,t,T){this.kind=E;this.control=r;this.projectId=t;this.organizationId=T}async discover(E){let r=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),t=new Date(Date.now()-r*86400000).toISOString(),T=vW[this.kind],_=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(T.select).all(_,t).map((e)=>({id:String(e.id),kind:this.kind,label:`${this.kind}:${String(e.id)}`,bytes:Number(e.bytes??0),metadata:{createdAt:String(e.created_at)}}))}async remove(E){if(this.control.database.run(vW[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function Qx(){let E=await tE(),r=mE(process.cwd(),E),t=new HS(r.store),T=new fS(t),_=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((d)=>new YS(d,r.store,r.project.id,r.organization.id));return{controlPlane:r,store:t,service:T,cleanup:_}}async function jd(E){let r=await Qx();try{await E(r)}catch(t){Y(t instanceof Error?t.message:String(t)),process.exitCode=1}finally{r.controlPlane.store.close()}}function P1(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(r)=>jd((t)=>{let T={manifests:t.store.manifests(t.controlPlane.organization.id),windows:t.store.windows(t.controlPlane.project.id),campaigns:t.store.campaigns(t.controlPlane.project.id),cleanups:t.store.cleanups(t.controlPlane.project.id),drills:t.store.drills(t.controlPlane.project.id)},_=[...T.manifests.map((d)=>["update",d.version,d.compatibility.compatible?"compatible":"blocked",d.compatibility.reasons.join("; ")||d.channel]),...T.campaigns.map((d)=>["upgrade",d.id,d.status,d.currentStage??d.fromVersion]),...T.cleanups.map((d)=>["cleanup",d.kind,d.status,`${d.candidates.length} items / ${d.estimatedBytes} bytes`]),...T.drills.map((d)=>["DR drill",d.scenario,d.status,d.isolatedTarget])];if(r.json)console.log(JSON.stringify(T,null,2));else TE(["Area","Name / version","Status","Detail"],_)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(r,t)=>jd(async(T)=>{let _=T.store.addTrustedKey({organizationId:T.controlPlane.organization.id,name:r,publicKeyPem:await Bun.file(t).text()});K(`Trusted ${_.name}: ${_.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(r,t,T)=>jd(async(_)=>{let d=await Bun.file(r).json(),e=(await Bun.file(t).text()).trim(),h=_.store.importManifest({organizationId:_.controlPlane.organization.id,keyId:T,document:d,signature:e,current:{schemaVersion:_.controlPlane.store.health().schemaVersion,currentVersion:BS,platform:process.platform,architecture:process.arch}});K(`Verified ${h.version}; ${h.compatibility.compatible?"compatible":"blocked: "+h.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(r,t,T)=>jd((_)=>{let d=_.store.createWindow({projectId:_.controlPlane.project.id,name:r,schedule:t,timezone:T.timezone,durationMinutes:Number(T.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});K(`Created ${d.name} (${d.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(r,t,T)=>jd((_)=>{let d=new Z_(_.controlPlane.store).list(_.controlPlane.project.id).filter((R)=>R.status==="ready").map((R)=>({serverId:R.id,target:R.name,previousVersion:R.bootstrapVersion??BS}));if(!d.length)d.push({target:"control-plane",previousVersion:BS});let e=_.store.createCampaign({projectId:_.controlPlane.project.id,manifestId:r,fromVersion:BS,strategy:T.strategy==="rolling"?"rolling":"canary",batchSize:Number(T.batch),healthGate:{kind:"platform"},backupId:t,targets:d}),h=_.service.enqueueCampaign(e.id);K(`Staged upgrade queued: ${h.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(r,t)=>jd(async(T)=>{let _=await T.service.previewCleanup({projectId:T.controlPlane.project.id,kind:r,criteria:{olderThanDays:Number(t.olderThan)}},T.cleanup);TE(["ID","Candidate","Bytes"],_.candidates.map((d)=>[d.id,d.label,String(d.bytes)])),c(`Apply with: cloud cleanup:apply ${_.id} --confirm "DELETE ${_.candidates.length} ${_.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(r,t)=>jd((T)=>{let _=T.service.enqueueCleanup(r,String(t.confirm??""));K(`Cleanup queued: ${_.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(r,t,T)=>jd((_)=>{let d=_.store.createDrill({projectId:_.controlPlane.project.id,scenario:r,isolatedTarget:t,expectedRpoMinutes:Number(T.rpo),expectedRtoMinutes:Number(T.rto),recoveryPointId:T.recoveryPoint,topologyId:T.topology});K(`Planned isolated drill ${d.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(r)=>jd((t)=>{let T=t.service.enqueueDrill(r);K(`DR drill queued: ${T.operation.id}`)}))}QE();Xe();XT();async function K1(){try{return(await tE()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function Z1(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(r)=>{b("Lambda Functions");let t=r?.region||await K1(),T=new yr(t);try{let{Functions:_=[]}=await T.listFunctions({MaxItems:50});if(!_.length){c("No functions found");return}TE(["Name","Runtime","Memory","Timeout","Last Modified"],_.map((d)=>[d.FunctionName??"-",d.Runtime??"-",d.MemorySize?`${d.MemorySize} MB`:"-",d.Timeout?`${d.Timeout}s`:"-",d.LastModified??"-"]))}catch(_){Y(`Failed to list functions: ${_.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(r,t)=>{b(`Invoking ${r}`);let T=t?.region||await K1(),_=new yr(T),d=new v("Invoking function...");d.start();try{let e=await _.invoke({FunctionName:r,InvocationType:t?.async?"Event":"RequestResponse",Payload:t?.payload||"{}",LogType:t?.async?"None":"Tail"});if(e.FunctionError){if(d.fail(`Function returned an error (${e.FunctionError})`),e.Payload)c(e.Payload);process.exitCode=1;return}if(d.succeed(`Invoked (status ${e.StatusCode})`),e.Payload)c(`
 Response:`),c(e.Payload);if(e.LogResult)c(`
 Logs:`),c(Buffer.from(e.LogResult,"base64").toString("utf-8"))}catch(e){d.fail(`Invocation failed: ${e.message}`),process.exitCode=1}}),E.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(r,t)=>{b(`Logs for ${r}`);let T=t?.region||await K1(),_=new _T(T),d=r.startsWith("/aws/lambda/")?r:`/aws/lambda/${r}`,e=Number(t?.since??15),h=(R)=>{for(let N of R){let A=N.timestamp?new Date(N.timestamp).toISOString():"";c(`${A}  ${(N.message??"").trimEnd()}`)}};try{let R=Date.now()-e*60000,{events:N=[]}=await _.filterLogEvents({logGroupName:d,startTime:R,filterPattern:t?.filter,limit:200});if(h(N),N.length)R=(N[N.length-1].timestamp??R)+1;if(t?.tail){c(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise((S)=>setTimeout(S,3000));let{events:A=[]}=await _.filterLogEvents({logGroupName:d,startTime:R,filterPattern:t?.filter,limit:200});if(A.length)h(A),R=(A[A.length-1].timestamp??R)+1}}}catch(R){Y(`Failed to read logs: ${R.message}`),process.exitCode=1}})}QE();async function iW(E){let r=Bun.spawn(["docker",...E],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[t,T]=await Promise.all([r.exited,new Response(r.stderr).text()]);return{ok:t===0,exitCode:t,command:["docker",...E].join(" "),stderr:T.trim()}}function g1(E){E.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(r)=>{let t=["build","--file",r.file??"Dockerfile","--tag",r.tag??"latest","."];if(r.dryRun){console.log(`docker ${t.join(" ")}`);return}let T=await iW(t);if(r.json)console.log(JSON.stringify(T));if(!T.ok)Y(T.stderr||`docker exited ${T.exitCode}`),process.exitCode=T.exitCode;else K(`Built ${r.tag??"latest"}.`)}),E.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(r)=>{if(!r.image){Y("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(r.dryRun){console.log(`docker push ${r.image}`);return}let t=await iW(["push",r.image]);if(r.json)console.log(JSON.stringify(t));if(!t.ok)Y(t.stderr),process.exitCode=t.exitCode;else K(`Pushed ${r.image}.`)}),E.command("container:deploy","Deploy a container image").action(async()=>kT("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}QE();Id();H_();function q1(E){E.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(r)=>{b("Domains");try{let t=f_(r?.provider),T=DT(r?.provider)?.provider||"unknown",_=new v(`Fetching domains from ${T}...`);_.start();let d=await t.listDomains();if(_.succeed(`Found ${d.length} domain(s)`),d.length===0){c("No domains found in this provider");return}let e=d.map((h)=>[h,"Active","-",T.charAt(0).toUpperCase()+T.slice(1)]);TE(["Domain","Status","SSL","Provider"],e)}catch(t){Y(`Failed to list domains: ${t instanceof Error?t.message:String(t)}`)}}),E.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(r,t)=>{b(`Adding Domain: ${r}`);try{let T=f_(t?.provider),_=DT(t?.provider)?.provider||"unknown",d=new v(`Checking if ${_} can manage ${r}...`);if(d.start(),await T.canManageDomain(r))d.succeed(`Domain ${r} is already available in ${_}`),c(`