@stacksjs/ts-cloud 0.7.72 → 0.7.74

package/dist/bin/cli.js

@@ -9195,7 +9195,7 @@ Run \`${this.name??"cli"} --help\` for usage.`;Sr.stderr.write(`${h}${R}${r}
 `).length-1;this.output.write(Ah.move(-999,E*-1))}render(){let E=Xj(this._render(this)??"",cj.stdout.columns,{hard:!0,trim:!1});if(E===this._prevFrame)return;if(this.state==="initial")this.output.write(Ah.hide);else{let T=fM(this._prevFrame,E);if(this.restoreCursor(),T&&T?.length===1){let _=T[0];this.output.write(Ah.move(0,_)),this.output.write(k1.lines(1));let d=E.split(`
 `);this.output.write(d[_]),this._prevFrame=E,this.output.write(Ah.move(0,d.length-_-1));return}if(T&&T?.length>1){let _=T[0];this.output.write(Ah.move(0,_)),this.output.write(k1.down());let R=E.split(`
 `).slice(_);this.output.write(R.join(`
-`)),this._prevFrame=E;return}this.output.write(k1.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function bM(E,T){if(E===void 0)return 0;if(T.length===0)return 0;let d=T.findIndex((R)=>R.value===E);return d!==-1?d:0}function kM(E,T){return(T.label??String(T.value)).toLowerCase().includes(E.toLowerCase())}function uM(E,T){if(!T)return;if(E)return T;return T[0]}class vM extends m1{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#_="";#d;#T;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return GO.inverse(GO.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[T,..._]=this.userInput.slice(this._cursor);return`${E}${GO.inverse(T)}${_.join("")}`}get options(){if(typeof this.#T==="function")return this.#T();return this.#T}constructor(E){super(E);this.#T=E.options;let T=this.options;this.filteredOptions=[...T],this.multiple=E.multiple===!0,this.#d=E.filter??kM;let _;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)_=E.initialValue;else _=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)_=[this.options[0].value];if(_)for(let d of _){let R=T.findIndex((h)=>h.value===d);if(R!==-1)this.toggleSelected(d),this.#E=R}this.focusedValue=this.options[this.#E]?.value,this.on("key",(d,R)=>this.#R(d,R)),this.on("userInput",(d)=>this.#h(d))}_isActionKey(E,T){return E==="\t"||this.multiple&&this.isNavigating&&T.name==="space"&&E!==void 0&&E!==""}#R(E,T){let _=T.name==="up",d=T.name==="down",R=T.name==="return";if(_||d){if(this.#E=Math.max(0,Math.min(this.#E+(_?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(R)this.value=uM(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(T.name==="tab"||this.isNavigating&&T.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((T)=>T!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#h(E){if(E!==this.#_){this.#_=E;let T=this.options;if(E)this.filteredOptions=T.filter((_)=>this.#d(E,_));else this.filteredOptions=[...T];if(this.#E=bM(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class nM extends m1{options;cursor=0;#E;getGroupItems(E){return this.options.filter((T)=>T.group===E)}isGroupSelected(E){let T=this.getGroupItems(E),_=this.value;if(_===void 0)return!1;return T.every((d)=>_.includes(d.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let T=String(E.value),_=this.getGroupItems(T);if(this.isGroupSelected(T))this.value=this.value.filter((d)=>_.findIndex((R)=>R.value===d)===-1);else this.value=[...this.value,..._.map((d)=>d.value)];this.value=Array.from(new Set(this.value))}else{let T=this.value.includes(E.value);this.value=T?this.value.filter((_)=>_!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:T}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(T).flatMap(([_,d])=>[{value:_,group:!0,label:_},...d.map((R)=>({...R,group:_}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:_})=>_===E.cursorAt),this.#E?0:1),this.on("cursor",(_)=>{switch(_){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let d=this.options[this.cursor]?.group===!0;if(!this.#E&&d)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let d=this.options[this.cursor]?.group===!0;if(!this.#E&&d)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var lM=TM();var WT=(E,T)=>lM?E:T,Ip=WT("◆","*"),Cp=WT("■","x"),wp=WT("▲","x"),cp=WT("◇","o"),Xp=WT("┌","T"),iM=WT("│","|"),Jp=WT("└","—"),Fp=WT("●",">"),zp=WT("○"," "),jp=WT("◻","[•]"),Bp=WT("◼","[+]"),Wp=WT("◻","[ ]"),Hp=WT("▪","•"),yp=WT("─","-"),Yp=WT("╮","+"),ep=WT("├","+"),Gp=WT("╯","+"),Qp=WT("●","•"),Mp=WT("◆","*"),Vp=WT("▲","!"),Kp=WT("■","x");var fp={light:WT("─","-"),heavy:WT("━","="),block:WT("█","#")};function mM(){return`${GO.gray(iM)}  `}var Pp=mM();var a1="0.7.72";ME();import{existsSync as hI}from"node:fs";import{mkdir as r4,writeFile as Zj}from"node:fs/promises";function rI(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(T)=>{if(b("Initializing ts-cloud Project"),hI("cloud.config.ts")){if(!await $E("cloud.config.ts already exists. Overwrite?",!1)){$("Initialization cancelled");return}}let _=T?.name||await LT("Project name","my-app"),d=T?.mode||await VO("Select deployment mode",["serverless","server"]),R=T?.region||await VO("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),h=new n("Creating configuration file...");h.start();let r=`import { defineConfig } from '@ts-cloud/core'
+`)),this._prevFrame=E;return}this.output.write(k1.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function bM(E,T){if(E===void 0)return 0;if(T.length===0)return 0;let d=T.findIndex((R)=>R.value===E);return d!==-1?d:0}function kM(E,T){return(T.label??String(T.value)).toLowerCase().includes(E.toLowerCase())}function uM(E,T){if(!T)return;if(E)return T;return T[0]}class vM extends m1{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#_="";#d;#T;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return GO.inverse(GO.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[T,..._]=this.userInput.slice(this._cursor);return`${E}${GO.inverse(T)}${_.join("")}`}get options(){if(typeof this.#T==="function")return this.#T();return this.#T}constructor(E){super(E);this.#T=E.options;let T=this.options;this.filteredOptions=[...T],this.multiple=E.multiple===!0,this.#d=E.filter??kM;let _;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)_=E.initialValue;else _=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)_=[this.options[0].value];if(_)for(let d of _){let R=T.findIndex((h)=>h.value===d);if(R!==-1)this.toggleSelected(d),this.#E=R}this.focusedValue=this.options[this.#E]?.value,this.on("key",(d,R)=>this.#R(d,R)),this.on("userInput",(d)=>this.#h(d))}_isActionKey(E,T){return E==="\t"||this.multiple&&this.isNavigating&&T.name==="space"&&E!==void 0&&E!==""}#R(E,T){let _=T.name==="up",d=T.name==="down",R=T.name==="return";if(_||d){if(this.#E=Math.max(0,Math.min(this.#E+(_?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(R)this.value=uM(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(T.name==="tab"||this.isNavigating&&T.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((T)=>T!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#h(E){if(E!==this.#_){this.#_=E;let T=this.options;if(E)this.filteredOptions=T.filter((_)=>this.#d(E,_));else this.filteredOptions=[...T];if(this.#E=bM(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class nM extends m1{options;cursor=0;#E;getGroupItems(E){return this.options.filter((T)=>T.group===E)}isGroupSelected(E){let T=this.getGroupItems(E),_=this.value;if(_===void 0)return!1;return T.every((d)=>_.includes(d.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let T=String(E.value),_=this.getGroupItems(T);if(this.isGroupSelected(T))this.value=this.value.filter((d)=>_.findIndex((R)=>R.value===d)===-1);else this.value=[...this.value,..._.map((d)=>d.value)];this.value=Array.from(new Set(this.value))}else{let T=this.value.includes(E.value);this.value=T?this.value.filter((_)=>_!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:T}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(T).flatMap(([_,d])=>[{value:_,group:!0,label:_},...d.map((R)=>({...R,group:_}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:_})=>_===E.cursorAt),this.#E?0:1),this.on("cursor",(_)=>{switch(_){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let d=this.options[this.cursor]?.group===!0;if(!this.#E&&d)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let d=this.options[this.cursor]?.group===!0;if(!this.#E&&d)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var lM=TM();var WT=(E,T)=>lM?E:T,Ip=WT("◆","*"),Cp=WT("■","x"),wp=WT("▲","x"),cp=WT("◇","o"),Xp=WT("┌","T"),iM=WT("│","|"),Jp=WT("└","—"),Fp=WT("●",">"),zp=WT("○"," "),jp=WT("◻","[•]"),Bp=WT("◼","[+]"),Wp=WT("◻","[ ]"),Hp=WT("▪","•"),yp=WT("─","-"),Yp=WT("╮","+"),ep=WT("├","+"),Gp=WT("╯","+"),Qp=WT("●","•"),Mp=WT("◆","*"),Vp=WT("▲","!"),Kp=WT("■","x");var fp={light:WT("─","-"),heavy:WT("━","="),block:WT("█","#")};function mM(){return`${GO.gray(iM)}  `}var Pp=mM();var a1="0.7.74";ME();import{existsSync as hI}from"node:fs";import{mkdir as r4,writeFile as Zj}from"node:fs/promises";function rI(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(T)=>{if(b("Initializing ts-cloud Project"),hI("cloud.config.ts")){if(!await $E("cloud.config.ts already exists. Overwrite?",!1)){$("Initialization cancelled");return}}let _=T?.name||await LT("Project name","my-app"),d=T?.mode||await VO("Select deployment mode",["serverless","server"]),R=T?.region||await VO("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),h=new n("Creating configuration file...");h.start();let r=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -9609,7 +9609,7 @@ Resources to create: ${W}`);let G={};for(let e of Object.values(S.Resources||{})
 No changes detected - infrastructure is up to date`);return}if($(`
 Changes detected:
 `),w.length>0){Z(`Resources to add (${w.length}):`);for(let j of w){let W=U[j].Type;$(`  + ${j} (${W})`)}console.log()}if(c.length>0){Q(`Resources to remove (${c.length}):`);for(let j of c){let W=O[j].Type;$(`  - ${j} (${W})`)}console.log()}if(z.length>0){dE(`Resources to modify (${z.length}):`);for(let j of z){let W=U[j].Type;$(`  ~ ${j} (${W})`)}console.log()}$("Summary:"),$(`  - Add: ${w.length}`),$(`  - Remove: ${c.length}`),$(`  - Modify: ${z.length}`),$("\nRun `cloud deploy` to apply these changes")}catch(_){Q(`Diff failed: ${_.message}`)}})}ME();await mE();IS();ft();function Mr(E,T=0){let _=Number(E);return Number.isFinite(_)?_:T}function tX(E){return Mr(E)*1024}function P3(E){let T=E?.date?.trim(),_=E?.time?.trim();if(!T||!_)return null;let d=new Date(`${T}T${_}Z`);return Number.isFinite(d.getTime())?d.toISOString():null}function Z3(E,T,_){let d;try{d=JSON.parse(E)}catch{return[]}let R=(d?.sysstat?.hosts??[]).flatMap((r)=>r.statistics??[]),h=[];for(let r of R){let N=P3(r.timestamp);if(!N)continue;let A=new Date(N).getTime();if(A<T.getTime()||A>_.getTime())continue;let S=r["cpu-load"]?.find((t)=>t.cpu==="all")??r["cpu-load"]?.[0],L=Mr(S?.idle,100);h.push({timestamp:N,cpuUsedPercent:Math.max(0,Math.min(100,100-L)),cpuUserPercent:Mr(S?.user),cpuSystemPercent:Mr(S?.system),cpuIowaitPercent:Mr(S?.iowait),memoryUsedPercent:Mr(r.memory?.["memused-percent"]),memoryUsedBytes:tX(r.memory?.memused),memoryAvailableBytes:tX(r.memory?.avail),swapUsedPercent:Mr(r.memory?.["swpused-percent"]),swapUsedBytes:tX(r.memory?.swpused)})}return h.sort((r,N)=>r.timestamp.localeCompare(N.timestamp))}function q3(E){return Object.fromEntries(Object.entries(E.time_series??{}).map(([T,_])=>[T,(_.values??[]).map(([d,R])=>({timestamp:new Date(Number(d)*1000).toISOString(),value:Mr(R,Number.NaN)})).filter((d)=>Number.isFinite(d.value))]))}function Yy(E){return E.length?E.reduce((T,_)=>T+_,0)/E.length:null}function OX(E){return E.length?Math.max(...E):null}function x3(E){return E.length?Math.min(...E):null}async function ey(E){let[T,_]=await Promise.all([E.client.getServerMetrics(E.serverId,{types:["cpu","disk","network"],start:E.from,end:E.to,step:E.step}),id(E.remote.host,"LC_ALL=C sadf -j -- -u -r -S",E.remote).catch(()=>"")]),d=Z3(_,E.from,E.to),R=q3(T),r=(R.cpu??[]).map((t)=>Math.max(0,Math.min(100,t.value/Math.max(1,E.cores)))),N=d.map((t)=>t.cpuUsedPercent),A=r.length?r:N,S=d.map((t)=>t.memoryUsedPercent),L=d.map((t)=>t.swapUsedPercent);return{from:E.from.toISOString(),to:E.to.toISOString(),cores:E.cores,host:d,provider:R,summary:{cpuAveragePercent:Yy(A),cpuPeakPercent:OX(A),memoryAveragePercent:Yy(S),memoryPeakPercent:OX(S),memoryMinimumAvailableBytes:x3(d.map((t)=>t.memoryAvailableBytes)),swapPeakPercent:OX(L)}}}BX();yX();GX();KX();K$();await QR([zX(),qr()]);import{createHash as Xb}from"node:crypto";var vy=async(E)=>{let T=Bun.spawn(E,{stdout:"pipe",stderr:"pipe"}),[_,d,R]=await Promise.all([T.exited,new Response(T.stdout).text(),new Response(T.stderr).text()]);return{code:_,stdout:d,stderr:R}};class ny{async scan(E,T){let _=await vy(["ssh-keyscan","-T","10","-p",String(T),"-t","ed25519",E]),d=_.stdout.split(`
-`).find((R)=>R&&!R.startsWith("#"))?.trim().split(/\s+/);if(_.code!==0||!d?.[1]||!d[2])throw Error(`SSH host-key scan failed: ${_.stderr.trim()||"no key returned"}`);return{algorithm:d[1],key:d[2]}}async exec(E,T){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return vy(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,T])}}var Jb=(E)=>`SHA256:${Xb("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,Fb=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class eh{provider;transport;discoverer;constructor(E,T=new ny,_){this.provider=E;this.transport=T;this.discoverer=_}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let T=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:T.algorithm,hostKeyFingerprint:Jb(T.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let T=await this.transport.exec(E,Fb);if(T.code!==0)throw Error(`Fleet validation failed: ${T.stderr.trim()||T.code}`);try{return JSON.parse(T.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,T){let _=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${T.length}`);if(_.code!==0)throw Error(`Fleet bootstrap failed: ${_.stderr.trim()||_.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function ly(E,T){return{"fleet.bootstrap":async(_)=>{let d=_.operation.input&&typeof _.operation.input==="object"&&!Array.isArray(_.operation.input)?_.operation.input:{},R=E.get(String(d.serverId??""));if(!R)throw Error("Queued fleet server was not found.");let h=T.find((A)=>A.provider===R.provider);if(!h)throw Error(`No ${R.provider} fleet driver is configured.`);let r=Array.isArray(d.steps)?d.steps.map(String):[];if(_.checkpoint("preflight","Rechecking pinned trust and healthy validation."),R.trustState!=="pinned"||!R.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");_.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let N=await h.bootstrap(R,r);return E.update(R.id,{bootstrapVersion:N.version,status:"ready"}),_.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:R.id,bootstrapVersion:N.version,steps:r.length}}}}var vR=(E)=>E==null?void 0:String(E),PN=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},fX=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:vR(E.provider_id),region:vR(E.region),zone:vR(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:vR(E.host_key_algorithm),hostKeyFingerprint:vR(E.host_key_fingerprint),pendingHostKey:vR(E.pending_host_key),roles:PN(E.roles,[]),labels:PN(E.labels,{}),taints:PN(E.taints,[]),capacity:PN(E.capacity,{}),usage:PN(E.usage,{}),capabilities:PN(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:PN(E.validation,void 0),bootstrapVersion:vR(E.bootstrap_version),heartbeatAt:vR(E.heartbeat_at),lastSeenAt:vR(E.last_seen_at),archivedAt:vR(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class nR{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}get(E){let T=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return T?fX(T):void 0}list(E,T=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(fX).filter((_)=>T||_.status!=="archived")}findProvider(E,T,_){let d=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,T,_);return d?fX(d):void 0}create(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,_,_]),this.get(T)}update(E,T){let _=this.get(E);if(!_)throw Error("Server was not found.");let d={..._,...T},R=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[d.name,d.providerId??null,d.region??null,d.zone??null,d.endpoint,d.sshUser,d.sshPort,d.credentialRef,d.hostKeyAlgorithm??null,d.hostKeyFingerprint??null,d.pendingHostKey??null,JSON.stringify(d.roles),JSON.stringify(d.labels),JSON.stringify(d.taints),JSON.stringify(d.capacity),JSON.stringify(d.usage),JSON.stringify(d.capabilities),d.status,d.trustState,JSON.stringify(d.validation??{}),d.bootstrapVersion??null,d.heartbeatAt??null,d.lastSeenAt??null,d.archivedAt??null,R,E]),this.get(E)}}var zb=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class gt{store;drivers;now;queue;constructor(E,T,_,d=()=>new Date){this.store=E;this.drivers=T;this.now=d;this.queue=_??new nE(E.control)}driver(E){let T=this.drivers.find((_)=>_.provider===E);if(!T)throw Error(`No ${E} fleet driver is configured.`);return T}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!zb.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let T=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(T)return this.store.update(T.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let _=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),d=this.driver(E.provider);return this.store.create({...E,resourceId:_.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:d.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let _=await this.driver(T.provider).test(T);if(!_.reachable)return this.store.update(E,{status:"unreachable"});if(T.hostKeyFingerprint&&T.hostKeyFingerprint!==_.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:_.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:_.hostKeyAlgorithm,hostKeyFingerprint:_.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,T){let _=this.store.get(E);if(!_||_.pendingHostKey!==T)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:T,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let T=this.store.get(E);if(!T||T.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let _=await this.driver(T.provider).validate(T),d=[];if(!["x64","arm64","x86_64","aarch64"].includes(_.arch??""))d.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let r of["curl","tar"])if(!_.tools?.[r])d.push({code:`tool.${r}`,severity:"error",message:`${r} is missing.`,remediation:`Install ${r} before bootstrap.`});if(Math.abs(_.timeSkewSeconds??0)>60)d.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!_.dnsOk)d.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let R={valid:!d.some((r)=>r.severity==="error"),facts:_,findings:d,validatedAt:this.now().toISOString(),validatorVersion:"1"},h={cpu:_.cpuCores??0,memoryBytes:_.memoryBytes??0,diskBytes:_.diskBytes??0};return this.store.update(E,{validation:R,capacity:h,status:R.valid?"ready":"degraded"})}bootstrap(E,T=!1){let _=this.store.get(E);if(!_?.validation?.valid)throw Error("A healthy validation report is required.");let d=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!T)return{preview:!0,steps:d};let R=this.queue.enqueue({projectId:_.projectId,resourceId:_.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:d},lockKey:`server:${E}`,providerKey:_.provider}).operation;return{preview:!1,steps:d,operation:R}}heartbeat(E,T){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let d=this.now().toISOString();return this.store.update(E,{usage:T.usage,capabilities:T.capabilities??_.capabilities,heartbeatAt:d,lastSeenAt:d,status:_.status==="draining"||_.status==="drained"?_.status:"ready"})}drain(E,T=!1){return this.store.update(E,{status:T?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,T){let _=this.store.get(E);if(!_||T!==_.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function jb(){let E=await o(),T=lE(process.cwd(),E),_=new nR(T.store),d=new gt(_,[new eh("aws"),new eh("hetzner"),new eh("ssh")]);return{controlPlane:T,store:_,service:d}}async function Gh(E){let T=await jb();try{return await E(T)}finally{T.controlPlane.store.close()}}var ZN=(E,T)=>{let _=E.store.list(E.controlPlane.project.id).find((d)=>d.id===T||d.name===T);if(!_)throw Error(`Server ${T} was not found.`);return _},sd=(E)=>{Q(E instanceof Error?E.message:String(E)),process.exitCode=1};function PX(E,T){let _=Number.parseInt(E??"",10);return Number.isFinite(_)&&_>=0?_:T}function Bb(E="3h"){let T=E.match(/^(\d+)(m|h)$/);if(!T)throw Error("--range must use minutes or hours, for example 30m or 3h.");let _=Number(T[1])*(T[2]==="h"?3600000:60000);if(_<300000||_>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return _}function bt(E,T="%"){return E==null?"unavailable":`${E.toFixed(1)}${T}`}async function Wb(E,T){let _=await o();if(_.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let d=T.env??process.env.CLOUD_ENV??"production",R=IT(_,d),h=await IR(R);if(!h?.serverId)throw Error(`No pinned Hetzner server was found for ${R}.`);if(![h.serverName,String(h.serverId),h.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${h.serverName}.`);let r=$S(_),N=new Wh({apiToken:Qr(r.apiToken,_)}),A=await N.getServer(h.serverId),S=h.publicIp??A.public_net.ipv4?.ip;if(!S)throw Error(`Server ${A.name} has no public IPv4 address.`);let L=new Date,t=new Date(L.getTime()-Bb(T.range)),O=Math.min(3600,Math.max(60,PX(T.step,60))),U=await ey({client:N,serverId:A.id,cores:Math.max(1,Number(A.server_type.cores)||1),from:t,to:L,step:O,remote:{host:S,user:h.sshUser??r.sshUser,identityFile:r.sshPrivateKeyPath,connectTimeoutSec:15}});if(T.json){console.log(JSON.stringify({schemaVersion:1,server:A.name,result:U},null,2));return}EE(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[A.name,`${U.from} to ${U.to}`,`${bt(U.summary.cpuAveragePercent)} / ${bt(U.summary.cpuPeakPercent)}`,`${bt(U.summary.memoryAveragePercent)} / ${bt(U.summary.memoryPeakPercent)}`,U.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(U.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,bt(U.summary.swapPeakPercent)]])}function iy(E){let T=E.targetType.prices?.find((_)=>_.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:T?{hourlyNet:T.price_hourly.net,hourlyGross:T.price_hourly.gross,monthlyNet:T.price_monthly.net,monthlyGross:T.price_monthly.gross}:void 0}}function Hb(E){let T=iy(E);EE(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${T.serverName} (${T.serverId})`,T.location,`${T.from} -> ${T.to}`,T.capacityAvailable?"available":"waiting",`${T.target.cores??0} / ${T.target.memoryGb??0} GB / ${T.target.diskGb??0} GB`,T.price?.monthlyGross??T.price?.monthlyNet??"not reported"]])}async function yb(E,T,_){let d=await o();if(d.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",h=IT(d,R),r=await IR(h),N=$S(d),A=new Wh({apiToken:Qr(N.apiToken,d)}),L=r&&(E===r.serverName||E===String(r.serverId)||E===r.stackName)?await A.getServer(r.serverId):(await A.listServers()).find((e)=>e.name===E||String(e.id)===E);if(!L)throw Error(`Hetzner server ${E} was not found.`);if(r?.serverId&&r.serverId!==L.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${r.serverId}.`);let t=Hh(T),O=_.upgradeDisk!==!1,U=await xt(A,L.id,t,O);if(_.json)console.log(JSON.stringify({schemaVersion:1,plan:iy(U)},null,2));else Hb(U);if(!_.apply){if(!_.json)$(`Preview only. Re-run with --apply --confirm ${L.name} to execute.`);return}if(_.confirm!==L.name)throw Error(`Resize requires --confirm ${L.name}.`);let D=r?.publicIp??L.public_net.ipv4?.ip;if(!D)throw Error(`Server ${L.name} has no public IPv4 address for verification.`);let C={host:D,user:r?.sshUser??N.sshUser,identityFile:N.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},w=await MX(h),c=new Date().toISOString(),z={schemaVersion:1,operationId:w?.targetType===t&&w.serverId===L.id?w.operationId:crypto.randomUUID(),stackName:h,serverId:L.id,serverName:L.name,sourceType:U.currentType.name,targetType:t,upgradeDisk:O,phase:"planning",status:"running",attempts:w?.targetType===t?w.attempts:0,startedAt:w?.targetType===t?w.startedAt:c,updatedAt:c,manifest:w?.targetType===t?w.manifest:void 0};await Yh(z);let j=PX(_.pollSeconds,900)*1000,W=PX(_.maxWaitMinutes,0)*60000,G=Date.now();for(;;){let e=await xt(A,L.id,t,O);if(!e.capacityAvailable&&!e.alreadyComplete){if(z={...z,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await Yh(z),!_.wait){if(!_.json)$(`${t} has no capacity in ${e.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(W>0&&Date.now()-G>=W)throw Error(`Timed out waiting for ${t} capacity in ${e.location}.`);if(!_.json)$(`Waiting ${Math.round(j/1000)} seconds for ${t} capacity...`);await Bun.sleep(j);continue}let V=await VX(h);try{let P=await(async()=>{try{return z={...z,status:"running",attempts:z.attempts+1,updatedAt:new Date().toISOString()},await Yh(z),await HX({client:A,serverId:L.id,targetType:t,upgradeDisk:O,resumeFromOff:z.phase==="shutting-down"||z.phase==="resizing"||z.phase==="powering-on"||z.phase==="verifying",manifest:z.manifest,hooks:{preflight:async()=>{let g=await YX(C);return z={...z,manifest:g,updatedAt:new Date().toISOString()},await Yh(z),g},afterBoot:async(g,k,v,TE)=>eX(C,k,v,TE),onPhase:async(g,k)=>{if(z={...z,phase:g,status:g==="waiting-capacity"?"waiting-capacity":g==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await Yh(z),!_.json)$(`${g}${k?` ${JSON.stringify(k)}`:""}`)}}})}finally{await V()}})();if(z={...z,status:P.status==="completed"||P.status==="already-complete"?"completed":P.status==="recovered"?"recovered":"waiting-capacity",lastError:P.status==="recovered"?P.error:void 0,updatedAt:new Date().toISOString()},await Yh(z),_.json)console.log(JSON.stringify({schemaVersion:1,result:P},null,2));else if(P.status==="completed"||P.status==="already-complete")Z(`${L.name} is on ${t} and passed full post-boot verification.`);else if(P.status==="recovered"&&P.retryable&&_.wait){$(`Capacity race recovered safely. Waiting ${Math.round(j/1000)} seconds before retry.`),await Bun.sleep(j);continue}else if(P.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${P.error}`);return}catch(P){throw z={...z,status:"failed",lastError:P instanceof Error?P.message:String(P),updatedAt:new Date().toISOString()},await Yh(z),P}}}async function Yb(E,T){let _=await o();if(_.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let d=T.env??process.env.CLOUD_ENV??"production",R=IT(_,d),h=await IR(R);if(!h?.serverId)throw Error(`No pinned Hetzner server was found for ${R}.`);if(![h.serverName,String(h.serverId),h.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${h.serverName}.`);let r=$S(_),N=new Wh({apiToken:Qr(r.apiToken,_)}),A=await N.getServer(h.serverId),S=h.publicIp??A.public_net.ipv4?.ip;if(!S)throw Error(`Server ${A.name} has no public IPv4 address.`);let L=M$(_);if(T.json)console.log(JSON.stringify({schemaVersion:1,server:A.name,plan:L},null,2));else EE(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[A.name,L.firewallPorts.join(","),L.monitoring?"on":"off",L.autoUpdates?"on":"off",`${L.swapGb} GB`,"disabled"]]);if(!T.apply){if(!T.json)$(`Preview only. Re-run with --apply --confirm ${A.name} to execute.`);return}if(T.confirm!==A.name)throw Error(`Optimization requires --confirm ${A.name}.`);let t={host:S,user:h.sshUser??r.sshUser,identityFile:r.sshPrivateKeyPath,connectTimeoutSec:15},O=await FS(t),U=O.routeProbes.filter((v)=>!v.ok),D=_.infrastructure?.compute,C=Nd(D)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,w=O.failedUnits.filter((v)=>!C.has(v));if(w.length>0)throw Error(`Preflight found failed services: ${w.join(", ")}`);if(U.length>0)throw Error(`Preflight found unhealthy routes: ${U.map((v)=>v.domain).join(", ")}`);let c=Nd(D)?[]:Object.values(_.sites??{}).flatMap((v)=>typeof v?.port==="number"&&![80,443].includes(v.port)?[v.port]:[]),z=CS({allowSsh:D?.allowSsh!==!1,sitePorts:c,allowedPorts:D?.firewall?.allowedPorts}),j=(h.firewallId?(await N.listFirewalls()).find((v)=>v.id===h.firewallId):void 0)??(await N.listFirewalls()).find((v)=>v.name===`${_.project.slug}-${d}-app-fw`);if(!j)throw Error(`Managed firewall for ${A.name} was not found.`);let W=await N.setFirewallRules(j.id,z);await Promise.all(W.map((v)=>N.waitForAction(v.id))),await XX(_,t);let[G,e]=await Promise.all([FS(t),JX(t)]),V=FX(L,e),P=fy(O,G),g=G.routeProbes.filter((v)=>!v.ok);if(P.stoppedServices.length>0)V.push(`services stopped: ${P.stoppedServices.join(", ")}`);if(P.changedRouteFragments.length>0)V.push(`route fragments changed: ${P.changedRouteFragments.join(", ")}`);if(P.missingRouteIds.length>0)V.push(`routes disappeared: ${P.missingRouteIds.join(", ")}`);if(P.changedReleaseLinks.length>0)V.push(`release links changed: ${P.changedReleaseLinks.join(", ")}`);if(P.missingData.length>0)V.push(`databases or volumes disappeared: ${P.missingData.join(", ")}`);if(g.length>0)V.push(`unhealthy routes: ${g.map((v)=>v.domain).join(", ")}`);if(V.length>0)throw Error(`Host optimization verification failed: ${V.join("; ")}`);let k={serverId:A.id,serverName:A.name,services:G.runningServices.length,routes:G.routeIds.length,healthyDomains:G.routeProbes.length,releaseLinks:G.releaseLinks.length,databasesAndVolumes:G.dataCatalog.length,report:e};if(T.json)console.log(JSON.stringify({schemaVersion:1,result:k},null,2));else Z(`${A.name} passed full host, rpx route, service, release, and data verification.`)}function ZX(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(T,_)=>{try{await Gh(async(d)=>{let R=T?[ZN(d,T)]:d.store.list(d.controlPlane.project.id),h=R.flatMap((r)=>Object.entries(r.capabilities).map(([N,A])=>({server:r.name,provider:r.provider,action:N,...A})));if(_.json)console.log(JSON.stringify({schemaVersion:1,targets:h},null,2));else EE(["Server","Provider","Action","Support","Explanation"],h.map((r)=>[r.server,r.provider,r.action,r.supported?"supported":"unsupported",r.reason??"—"]))})}catch(d){sd(d)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(T,_,d)=>{try{await yb(T,_,d)}catch(R){sd(R)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(T,_)=>{try{await Yb(T,_)}catch(d){sd(d)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(T,_)=>{try{await Wb(T,_)}catch(d){sd(d)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(T)=>{try{await Gh(async(_)=>{let d=_.store.list(_.controlPlane.project.id);if(T.json)console.log(JSON.stringify(d,null,2));else EE(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],d.map((R)=>[R.name,R.providerId??"—",`${R.provider} / ${R.region??"external"}`,`${R.status} / ${R.trustState}`,R.roles.join(","),`${R.capacity.cpu??0} / ${R.capacity.memoryBytes??0}`,R.heartbeatAt??"never"]))})}catch(_){sd(_)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(T,_)=>{try{await Gh(async(d)=>{let R=_.provider;if(!["aws","hetzner","ssh"].includes(R)||!_.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let h=d.service.enroll({organizationId:d.controlPlane.organization.id,projectId:d.controlPlane.project.id,name:T,provider:R,providerId:_.providerId,endpoint:_.endpoint,sshUser:_.user??"deploy",credentialRef:_.credentialRef??"secret://fleet/agent",region:_.region,roles:String(_.roles??"application").split(","),labels:Object.fromEntries(String(_.labels??"").split(",").map((r)=>r.split("=")).filter((r)=>r[0]&&r[1]))});Z(`Enrolled ${h.name} as ${h.id}; no remote mutation was performed.`)})}catch(d){sd(d)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(T,_)=>{try{await Gh(async(d)=>{let R=ZN(d,T);if(R=await d.service.test(R.id),R.trustState==="rotation_pending"){if(!_.acceptHostKey)throw Error(`Host key changed to ${R.pendingHostKey}; review it first.`);R=d.service.reviewHostKey(R.id,_.acceptHostKey)}let h=await d.service.validate(R.id);if(_.json)console.log(JSON.stringify(h.validation,null,2));else EE(["Severity","Code","Finding","Remediation"],(h.validation?.findings??[]).map((r)=>[r.severity,r.code,r.message,r.remediation??"—"]));if(!h.validation?.valid)process.exitCode=1})}catch(d){sd(d)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(T,_)=>{try{await Gh(async(d)=>{let R=d.service.bootstrap(ZN(d,T).id,!!_.apply);if(R.preview)EE(["Step"],R.steps.map((h)=>[h]));else Z(`Bootstrap queued: ${R.operation?.id}`)})}catch(d){sd(d)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(T,_)=>{try{await Gh(async(d)=>Z(d.service.drain(ZN(d,T).id,!!_.complete).status))}catch(d){sd(d)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(T)=>{try{await Gh(async(_)=>{_.service.uncordon(ZN(_,T).id),Z(`Uncordoned ${T}.`)})}catch(_){sd(_)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(T,_)=>{try{await Gh(async(d)=>{d.service.archive(ZN(d,T).id,_.confirm??""),Z(`Archived ${T}; provider infrastructure was not terminated.`)})}catch(d){sd(d)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(T)=>{try{await Gh(async(_)=>{let d=ZN(_,T);if(d.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let R=Bun.spawn(["ssh","-p",String(d.sshPort),"-o","StrictHostKeyChecking=yes",`${d.sshUser}@${d.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),h=await R.exited;if(h)process.exitCode=h})}catch(_){sd(_)}});for(let[T,_]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(T,_).action(async(...d)=>ld(T.split(" ")[0],{target:String(d[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}ME();var CR=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},Ad=(E)=>E==null?void 0:String(E),sy=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),jS=(E={})=>({...sy(),...E});function my(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:Ad(E.region),architecture:Ad(E.architecture),labels:CR(E.labels,{}),requiredServerLabels:CR(E.required_server_labels,{}),toleratedTaints:CR(E.tolerated_taints,[]),capacity:jS(CR(E.capacity,{})),reserved:CR(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:Ad(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function ay(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Ad(E.environment_id),resourceId:String(E.resource_id),releaseId:Ad(E.release_id),poolId:String(E.pool_id),serverId:Ad(E.server_id),purpose:String(E.purpose),requirements:CR(E.requirements,{}),decision:CR(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function eb(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:Ad(E.resource_id),poolId:String(E.pool_id),placementId:Ad(E.placement_id),operationId:Ad(E.operation_id),sourceSha:String(E.source_sha),buildSpec:CR(E.build_spec,{}),credentialPolicy:CR(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:Ad(E.workspace),cacheKey:Ad(E.cache_key),artifactUri:Ad(E.artifact_uri),artifactDigest:Ad(E.artifact_digest),status:String(E.status),cleanupAt:Ad(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class kt{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}createPool(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(jS(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,_,_]),this.getPool(T)}getPool(E){let T=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return T?my(T):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(my)}updatePool(E,T){let _=this.getPool(E);if(!_)throw Error("Capacity pool was not found.");let d={..._,...T},R=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[d.status,JSON.stringify(d.reserved),JSON.stringify(d.capacity),d.concurrency,R,E]),this.getPool(E)}addMember(E,T,_={}){let d=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,T,JSON.stringify(_),d,d])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((T)=>({serverId:String(T.server_id),status:String(T.status),capacityOverride:CR(T.capacity_override,{})}))}memberStatus(E,T,_){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[_,this.now().toISOString(),E,T])}listPlacements(E,T){let _=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(ay);return T?.length?_.filter((d)=>T.includes(d.status)):_}getPlacement(E){let T=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return T?ay(T):void 0}activeUsage(E,T){let _=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),d=T?_.filter((R)=>String(R.server_id)===T):_;return{resources:d.reduce((R,h)=>{let r=jS(CR(h.resources,{}));for(let N of Object.keys(R))R[N]+=r[N];return R},sy()),count:d.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let T=this.id(),_=this.id(),d=this.now().toISOString(),R=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[T,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,d,d]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[_,T,E.decision.poolId,E.decision.serverId??null,JSON.stringify(jS(E.requirements.resources)),R,d,d]),this.getPlacement(T)})}transitionPlacement(E,T){if(!this.getPlacement(E))throw Error("Placement was not found.");let d=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[T,d,E]),["released","failed","blocked"].includes(T))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[d,E]);return this.getPlacement(E)}createBuild(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[T,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),_,_]),this.getBuild(T)}getBuild(E){let T=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return T?eb(T):void 0}updateBuild(E,T){let _=this.getBuild(E);if(!_)throw Error("Remote build was not found.");let d={..._,...T},R=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[d.operationId??null,d.workspace??null,d.cacheKey??null,d.artifactUri??null,d.artifactDigest??null,d.status,d.cleanupAt??null,R,E]),this.getBuild(E)}}var P$=["cpu","memoryBytes","diskBytes","gpu"],py=(E,T={})=>Object.entries(T).every(([_,d])=>E[_]===d),Gb=(E,T,_)=>Object.fromEntries(P$.map((d)=>[d,Math.max(0,E[d]-T[d]-(_[d]??0))])),Qb=(E,T)=>P$.every((_)=>E[_]>=(T[_]??0)),Mb=(E,T)=>P$.reduce((_,d)=>_+(T[d]??0)/(E[d]||1),0);class ut{store;fleet;constructor(E,T){this.store=E;this.fleet=T}poolCandidates(E,T,_){let d=[];for(let R of this.store.listPools(E)){if(R.id===_)continue;let h=[];if(R.status!=="active")h.push(`pool is ${R.status}`);if(R.purpose!==T.purpose)h.push(`purpose is ${R.purpose}`);if(T.region&&R.region!==T.region)h.push(`region is ${R.region??"unset"}`);if(T.architecture&&R.architecture!==T.architecture)h.push(`architecture is ${R.architecture??"unset"}`);if(!py(R.labels,T.labels))h.push("pool labels do not match");if(R.backend==="server"){let r=this.store.members(R.id);if(!r.length)d.push(this.decision(R,void 0,T,[...h,"pool has no servers"]));for(let N of r){let A=this.fleet.get(N.serverId),S=[...h];if(!A)S.push("server is missing");else this.serverReasons(R,A,N.status,T,S);d.push(this.decision(R,A,T,S,N.capacityOverride))}}else d.push(this.decision(R,void 0,T,h))}return d.sort((R,h)=>Number(h.eligible)-Number(R.eligible)||R.score.cost-h.score.cost||R.score.spread-h.score.spread||R.score.fit-h.score.fit||R.poolName.localeCompare(h.poolName)||(R.serverId??"").localeCompare(h.serverId??""))}serverReasons(E,T,_,d,R){if(_!=="active")R.push(`member is ${_}`);if(T.status!=="ready")R.push(`server is ${T.status}`);if(!T.roles.includes(d.purpose==="build"?"build":d.purpose))R.push(`server lacks ${d.purpose} role`);if(!py(T.labels,E.requiredServerLabels))R.push("server labels do not match pool selector");for(let h of T.taints)if(!E.toleratedTaints.includes(h))R.push(`taint ${h} is not tolerated`)}decision(E,T,_,d,R={}){let h=jS({...T?.capacity,...R}),r=T?Object.fromEntries(P$.map((S)=>[S,Math.min(E.capacity[S],h[S])])):E.capacity,N=this.store.activeUsage(E.id,T?.id),A=Gb(r,N.resources,E.reserved);if(N.count>=E.maxWorkloads)d.push("workload limit reached");if(_.purpose==="build"&&N.count>=E.concurrency)d.push("build concurrency reached");if(!Qb(A,_.resources))d.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:T?.id,eligible:d.length===0,reasons:d,available:A,score:{fit:Mb(A,_.resources),spread:N.count,cost:E.costWeight}}}explain(E,T){return this.poolCandidates(E,T)}place(E){return this.store.control.transaction(()=>{let T=this.poolCandidates(E.projectId,E.requirements).find((_)=>_.eligible);if(!T)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((_)=>_.reasons).join("; ")}`);return this.store.reserve({...E,decision:T})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let T=this.store.updatePool(E,{status:"draining"}),_=[],d=[];for(let R of this.store.listPlacements(T.projectId,["reserved","active"]).filter((h)=>h.poolId===E)){if(R.stateful){d.push(this.store.transitionPlacement(R.id,"blocked"));continue}this.store.transitionPlacement(R.id,"moving");let h=this.place({projectId:R.projectId,environmentId:R.environmentId,resourceId:R.resourceId,releaseId:R.releaseId,requirements:R.requirements});_.push(this.activate(h.id)),this.store.transitionPlacement(R.id,"released")}return{pool:T,moved:_,blocked:d}}drainServer(E,T){this.store.memberStatus(E,T,"draining");let _=this.store.getPool(E);if(!_)throw Error("Capacity pool was not found.");let d=[],R=[];for(let h of this.store.listPlacements(_.projectId,["reserved","active"]).filter((r)=>r.poolId===E&&r.serverId===T)){if(h.stateful){R.push(this.store.transitionPlacement(h.id,"blocked"));continue}this.store.transitionPlacement(h.id,"moving");let r=this.poolCandidates(h.projectId,h.requirements).find((A)=>A.eligible);if(!r){R.push(this.store.transitionPlacement(h.id,"blocked"));continue}let N=this.store.reserve({projectId:h.projectId,environmentId:h.environmentId,resourceId:h.resourceId,releaseId:h.releaseId,requirements:h.requirements,decision:r});d.push(this.activate(N.id)),this.store.transitionPlacement(h.id,"released")}return{moved:d,blocked:R}}reconcileFailure(E){let T=this.fleet.get(E);if(!T)throw Error("Server was not found.");let _=[],d=[];for(let R of this.store.listPlacements(T.projectId,["active"]).filter((h)=>h.serverId===E)){if(R.stateful||!R.autoReschedule){d.push(this.store.transitionPlacement(R.id,"blocked"));continue}this.store.transitionPlacement(R.id,"failed");let h=this.place({projectId:R.projectId,environmentId:R.environmentId,resourceId:R.resourceId,releaseId:R.releaseId,requirements:R.requirements});_.push(this.activate(h.id))}return{rescheduled:_,blocked:d}}}async function Vb(){let E=await o(),T=lE(process.cwd(),E),_=new kt(T.store),d=new ut(_,new nR(T.store));return{controlPlane:T,store:_,service:d}}async function vt(E){let T=await Vb();try{await E(T)}catch(_){Q(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}var Z$=(E)=>Object.fromEntries(String(E??"").split(",").map((T)=>T.split("=")).filter((T)=>T[0]&&T[1])),oy=(E)=>Object.fromEntries(Object.entries(Z$(E)).map(([T,_])=>[T,Number(_)]));function qX(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(T)=>vt((_)=>{let d=_.store.listPools(_.controlPlane.project.id);if(T.json)console.log(JSON.stringify(d,null,2));else EE(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],d.map((R)=>[R.name,R.purpose,R.backend,`${R.region??"any"} / ${R.architecture??"any"}`,R.status,JSON.stringify(R.capacity),String(R.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(T,_)=>vt((d)=>{let{purpose:R,backend:h}=_;if(!["application","build","worker","monitoring","backup"].includes(R)||!["server","ecs","asg"].includes(h))throw Error("Unsupported pool purpose or backend.");let r=d.store.createPool({organizationId:d.controlPlane.organization.id,projectId:d.controlPlane.project.id,name:T,purpose:R,backend:h,region:_.region,architecture:_.arch,labels:Z$(_.labels),requiredServerLabels:Z$(_.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...oy(_.capacity)},maxWorkloads:Number(_.max),costWeight:1,concurrency:Number(_.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});Z(`Created ${r.name} (${r.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(T,_)=>vt((d)=>{let R=d.store.listPools(d.controlPlane.project.id).find((r)=>r.id===T||r.name===T),h=new nR(d.controlPlane.store).list(d.controlPlane.project.id).find((r)=>r.id===_||r.name===_);if(!R||!h)throw Error("Pool or server was not found.");d.store.addMember(R.id,h.id),Z(`Attached ${h.name} to ${R.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(T)=>vt((_)=>{let d=_.service.explain(_.controlPlane.project.id,{purpose:T.purpose,resources:oy(T.resources),region:T.region,architecture:T.arch,labels:Z$(T.labels)});if(T.json)console.log(JSON.stringify(d,null,2));else EE(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],d.map((R)=>[R.poolName,R.serverId??"provider-managed",R.eligible?"yes":"no",JSON.stringify(R.available),`${R.score.fit.toFixed(2)} / ${R.score.spread} / ${R.score.cost}`,R.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(T)=>vt((_)=>{let d=_.store.listPools(_.controlPlane.project.id).find((h)=>h.id===T||h.name===T);if(!d)throw Error("Pool was not found.");let R=_.service.drainPool(d.id);Z(`Draining ${d.name}: moved ${R.moved.length}, blocked ${R.blocked.length} stateful placement(s).`)}))}ME();var Qh=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},pd=(E)=>E==null?void 0:String(E),E5=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:pd(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:Qh(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:Qh(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:pd(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),xX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:pd(E.stack_id),stackRevision:pd(E.stack_revision),status:String(E.status),health:Qh(E.health,{}),lastHealthyAt:pd(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),gX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:Qh(E.config,{}),status:String(E.status),checkpoint:pd(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:pd(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),bX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:Qh(E.weights,{}),desiredWeights:Qh(E.desired_weights,{}),status:String(E.status),providerState:Qh(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),T5=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:pd(E.operation_id),kind:String(E.kind),requestedRegion:pd(E.requested_region),revision:pd(E.revision),plan:Qh(E.plan,[]),currentStep:pd(E.current_step),completedSteps:Qh(E.completed_steps,[]),status:String(E.status),error:pd(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class nt{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((h)=>h.region)).size!==E.regions.length||E.regions.filter((h)=>h.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let T=E.regions.find((h)=>h.role==="primary"),_=this.id(),d=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[_,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,T.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),T.region,d,d]);for(let h of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),_,h.region,h.role,h.provider,d,d]);for(let h of E.dataPolicy.replicate)for(let r of E.regions)for(let N of E.regions.filter((A)=>A.region!==r.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),_,h,r.region,N.region,"{}",d,d]);let R=Object.fromEntries(E.regions.map((h)=>[h.region,h.region===T.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),_,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(R),JSON.stringify(R),d,d]),this.get(_)})}get(E){let T=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return T?E5(T):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(E5)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(xX)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(gX)}route(E){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return T?bX(T):void 0}updateTopology(E,T){let _=this.get(E);if(!_)throw Error("Regional topology was not found.");let d={..._,...T},R=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[d.status,d.activeRegion,d.revision??null,JSON.stringify(d.regions),R,E]),this.get(E)}updateTarget(E,T){let _=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!_)throw Error("Regional target was not found.");let d=xX(_),R={...d,...T},h=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[R.role,R.stackId??null,R.stackRevision??null,R.status,JSON.stringify(R.health),R.lastHealthyAt??null,h,E]),xX(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,T){let _=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!_)throw Error("Replication channel was not found.");let d=gX(_),R={...d,...T},h=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[R.status,R.checkpoint??null,R.lagSeconds??null,R.lastVerifiedAt??null,h,E]),gX(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,T){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!_)throw Error("Traffic route was not found.");let d=bX(_),R={...d,...T},h=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(R.weights),JSON.stringify(R.desiredWeights),R.status,JSON.stringify(R.providerState),h,E]),bX(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[T,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),_,_]),this.execution(T)}execution(E){let T=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return T?T5(T):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(T5)}updateExecution(E,T){let _=this.execution(E);if(!_)throw Error("Regional execution was not found.");let d={..._,...T},R=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[d.operationId??null,d.currentStep??null,JSON.stringify(d.completedSteps),d.status,d.error??null,R,E]),this.execution(E)}}class lt{store;queue;constructor(E,T){this.store=E;this.queue=T??new nE(E.control)}create(E){return this.store.create(E)}plan(E,T,_){if(!this.store.get(E))throw Error("Regional topology was not found.");let R=this.store.targets(E),h=this.store.channels(E);if(T==="rollout")return[...R.filter((r)=>r.role==="secondary").map((r)=>`apply:${r.region}`),...R.filter((r)=>r.role==="primary").map((r)=>`apply:${r.region}`),...h.map((r)=>`replicate:${r.kind}:${r.targetRegion}`),"traffic:activate"];if(T==="failover"||T==="failback")return[`health:${_}`,`replication:${_}`,`traffic:${_}`,`roles:${_}`];if(T==="destroy")return["traffic:drain",...R.filter((r)=>r.role==="secondary").map((r)=>`delete:${r.region}`),...R.filter((r)=>r.role==="primary").map((r)=>`delete:${r.region}`),"complete"];return["observe","repair"]}enqueue(E){let T=this.store.get(E.topologyId);if(!T)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!T.regions.some((h)=>h.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===T.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==T.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&T.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let _=this.plan(T.id,E.kind,E.targetRegion),d=this.store.createExecution({topologyId:T.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:_}),R=this.queue.enqueue({projectId:T.projectId,environmentId:T.environmentId,kind:`region.${E.kind}`,input:{executionId:d.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${T.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(d.id,{operationId:R.id}),{execution:this.store.execution(d.id),operation:R}}}var Kb=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function _5(E,T){let _=(S)=>{let L=T.find((t)=>t.provider===S.provider);if(!L)throw Error(`No ${S.provider} regional driver is configured.`);return L},d=(S,L,t)=>{S.throwIfCancellationRequested(),S.checkpoint(t,t),E.updateExecution(L.id,{status:"running",currentStep:t,completedSteps:[...E.execution(L.id).completedSteps,t]})},R=async(S,L)=>{let t=E.route(S.id);if(!t)throw Error("Regional traffic route was not found.");let O=E.targets(S.id).find((D)=>D.region===S.activeRegion)??E.targets(S.id)[0];if(!O)throw Error("Regional traffic target was not found.");E.updateRoute(t.id,{status:"applying",desiredWeights:L});let U=await _(O).applyTraffic({route:E.route(S.id),topology:S,weights:L});E.updateRoute(t.id,{status:Object.values(L).every((D)=>D===0)?"drained":"in_sync",weights:L,providerState:U.providerState})},h=async(S,L,t,O)=>{E.updateTopology(t.id,{status:"provisioning"});let U=L.revision,D=O.manifest??{},C=E.targets(t.id).sort((c,z)=>Number(c.role==="primary")-Number(z.role==="primary"));for(let c of C){d(S,L,`apply:${c.region}`),E.updateTarget(c.id,{status:"provisioning"});let z=await _(c).applyStack({target:c,revision:U,manifest:D,signal:S.signal}),j=await _(c).health({target:E.updateTarget(c.id,{stackId:z.stackId,stackRevision:U})});if(!j.healthy)throw Error(`Regional health gate failed in ${c.region}.`);E.updateTarget(c.id,{status:"ready",health:j.evidence,lastHealthyAt:new Date().toISOString()})}for(let c of E.channels(t.id)){d(S,L,`replicate:${c.kind}:${c.targetRegion}`),E.updateChannel(c.id,{status:"configuring"});let z=C.find((G)=>G.region===c.sourceRegion),j=await _(z).configureReplication({channel:c,topology:t}),W=await _(z).verifyReplication({channel:E.updateChannel(c.id,{checkpoint:j.checkpoint,lagSeconds:j.lagSeconds}),topology:t});if(!W.healthy||W.lagSeconds>t.dataPolicy.maxLagSeconds)throw Error(`${c.kind} replication to ${c.targetRegion} exceeds the RPO.`);E.updateChannel(c.id,{status:"in_sync",checkpoint:W.checkpoint,lagSeconds:W.lagSeconds,lastVerifiedAt:new Date().toISOString()})}d(S,L,"traffic:activate");let w=Object.fromEntries(t.regions.map((c)=>[c.region,c.region===t.activeRegion?100:0]));return await R(t,w),E.updateTopology(t.id,{status:"ready",revision:U}),{revision:U,activeRegion:t.activeRegion}},r=async(S,L,t)=>{let O=L.requestedRegion,U=E.targets(t.id).find((w)=>w.region===O);if(!U)throw Error("Requested regional target was not found.");E.updateTopology(t.id,{status:L.kind==="failover"?"failing_over":"failing_back"}),d(S,L,`health:${O}`);let D=await _(U).health({target:U});if(!D.healthy)throw Error(`Target region ${O} is unhealthy.`);E.updateTarget(U.id,{status:"ready",health:D.evidence,lastHealthyAt:new Date().toISOString()}),d(S,L,`replication:${O}`);for(let w of E.channels(t.id).filter((c)=>c.targetRegion===O)){let c=await _(U).verifyReplication({channel:w,topology:t});if(!c.healthy||c.lagSeconds>t.dataPolicy.maxLagSeconds)throw Error(`${w.kind} replication is outside the failover RPO.`);E.updateChannel(w.id,{status:"in_sync",checkpoint:c.checkpoint,lagSeconds:c.lagSeconds,lastVerifiedAt:new Date().toISOString()})}d(S,L,`traffic:${O}`),await R(t,Object.fromEntries(t.regions.map((w)=>[w.region,w.region===O?100:0]))),d(S,L,`roles:${O}`);let C=t.regions.map((w)=>({...w,role:w.region===O?"primary":"secondary"}));for(let w of E.targets(t.id))E.updateTarget(w.id,{role:w.region===O?"primary":"secondary"});return E.updateTopology(t.id,{status:L.kind==="failover"?"failed_over":"ready",activeRegion:O,regions:C}),{activeRegion:O}},N=async(S,L,t,O)=>{E.updateTopology(t.id,{status:"destroying"}),d(S,L,"traffic:drain"),await R(t,Object.fromEntries(t.regions.map((D)=>[D.region,0])));let U=O.deleteData!==!0;for(let D of E.targets(t.id).sort((C,w)=>Number(C.role==="primary")-Number(w.role==="primary")))d(S,L,`delete:${D.region}`),E.updateTarget(D.id,{status:"deleting"}),await _(D).deleteStack({target:D,retainData:U,signal:S.signal}),E.updateTarget(D.id,{status:"deleted"});return d(S,L,"complete"),E.updateTopology(t.id,{status:"destroyed"}),{destroyed:!0,dataRetained:U}},A=async(S)=>{let L=Kb(S.operation.input),t=E.execution(String(L.executionId??""));if(!t)throw Error("Regional execution was not found.");let O=E.get(t.topologyId);if(!O)throw Error("Regional topology was not found.");try{let U;if(t.kind==="rollout")U=await h(S,t,O,L);else if(t.kind==="failover"||t.kind==="failback")U=await r(S,t,O);else if(t.kind==="destroy")U=await N(S,t,O,L);else throw Error("Regional reconciliation is not configured.");return E.updateExecution(t.id,{status:"succeeded",currentStep:void 0}),{executionId:t.id,...U}}catch(U){if(E.updateExecution(t.id,{status:S.cancellationRequested()?"cancelled":"failed",error:U instanceof Error?U.message:String(U)}),E.get(O.id)?.status!=="destroyed")E.updateTopology(O.id,{status:"failed"});throw U}};return{"region.rollout":A,"region.failover":A,"region.failback":A,"region.destroy":A,"region.reconcile":A}}class kX{provider;reason;constructor(E,T="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=T}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function fb(){let E=await o(),T=lE(process.cwd(),E),_=new nt(T.store),d=new lt(_);return{controlPlane:T,store:_,service:d}}async function qN(E){let T=await fb();try{await E(T)}catch(_){Q(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}var it=(E,T)=>{let _=E.store.list(E.controlPlane.project.id).find((d)=>d.id===T||d.name===T);if(!_)throw Error("Regional topology was not found.");return _},Pb=(E)=>E.split(",").map((T,_)=>{let[d,R="aws"]=T.split(":");return{region:String(d),provider:R,role:_===0?"primary":"secondary"}}),Zb=(E)=>{let T=new Set(["s3","dynamodb","secrets"]),_=E.split(",").map((R)=>R.trim()),d=_.find((R)=>!T.has(R));if(d)throw Error(`Unsupported replication kind: ${d}`);return _};function uX(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(T)=>qN((_)=>{let d=_.store.list(_.controlPlane.project.id).map((R)=>({topology:R,targets:_.store.targets(R.id),channels:_.store.channels(R.id),route:_.store.route(R.id),executions:_.store.executions(R.id)}));if(T.json)console.log(JSON.stringify(d,null,2));else EE(["Name","Hostname","Active","Status","Revision","Replication"],d.map((R)=>[R.topology.name,R.topology.hostname,R.topology.activeRegion,R.topology.status,R.topology.revision??"—",`${R.channels.filter((h)=>h.status==="in_sync").length}/${R.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(T,_)=>qN((d)=>{if(!_.hostname||!_.regions)throw Error("--hostname and --regions are required.");let R=d.service.create({organizationId:d.controlPlane.organization.id,projectId:d.controlPlane.project.id,name:T,hostname:_.hostname,regions:Pb(_.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Zb(String(_.replicate)),maxLagSeconds:Number(_.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!_.cdn,wafEnabled:!!_.waf});Z(`Created ${R.name} (${R.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(T,_,d)=>qN((R)=>EE(["Step"],R.service.plan(it(R,T).id,_,d.target).map((h)=>[h])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(T,_,d)=>qN(async(R)=>{let h=d.manifest?await Bun.file(d.manifest).json():{},r=R.service.enqueue({topologyId:it(R,T).id,kind:"rollout",revision:_,manifest:h});Z(`Regional rollout queued: ${r.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(T,_)=>qN((d)=>{let R=d.service.enqueue({topologyId:it(d,T).id,kind:"failover",targetRegion:_});Z(`Failover queued: ${R.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(T,_)=>qN((d)=>{let R=d.service.enqueue({topologyId:it(d,T).id,kind:"failback",targetRegion:_});Z(`Failback queued: ${R.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(T,_)=>qN((d)=>{let R=d.service.enqueue({topologyId:it(d,T).id,kind:"destroy",confirmation:_.confirm});Z(`Regional teardown queued: ${R.operation.id}; replicated data remains retained.`)}))}ME();var mt="0.7.72";import{createHash as vX,createPublicKey as h5,verify as xb}from"node:crypto";function at(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(at).join(",")}]`;return`{${Object.keys(E).sort().map((T)=>`${JSON.stringify(T)}:${at(E[T])}`).join(",")}}`}var r5=(E)=>vX("sha256").update(at(E)).digest("hex"),q$=(E)=>vX("sha256").update(at(E)).digest("hex"),N5=(E)=>vX("sha256").update(h5(E).export({type:"spki",format:"der"})).digest("hex");function A5(E,T,_){try{return xb(null,Buffer.from(at(E)),h5(_),Buffer.from(T,"base64"))}catch{return!1}}var d5=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((T)=>Number(T)||0),R5=(E,T)=>{let _=d5(E),d=d5(T);for(let R=0;R<3;R++){let h=(_[R]??0)-(d[R]??0);if(h)return h}return 0};function S5(E,T){let _=[];if(T.schemaVersion<E.minimumSchema)_.push(`schema ${T.schemaVersion} is below ${E.minimumSchema}`);if(T.schemaVersion>E.maximumSchema)_.push(`schema ${T.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&R5(T.currentVersion,E.minimumVersion)<0)_.push(`platform ${T.currentVersion} is below ${E.minimumVersion}`);if(R5(E.version,T.currentVersion)<=0)_.push(`version ${E.version} is not newer than ${T.currentVersion}`);if(!E.artifacts.some((d)=>d.platform===T.platform&&d.architecture===T.architecture))_.push(`no artifact for ${T.platform}/${T.architecture}`);return{compatible:_.length===0,reasons:_}}var Mh=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},F_=(E)=>E==null?void 0:String(E),gb=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:F_(E.revoked_at),createdAt:String(E.created_at)}),L5=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:Mh(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:Mh(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),t5=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:Mh(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),O5=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:F_(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:Mh(E.health_gate,{}),status:String(E.status),currentStage:F_(E.current_stage),backupId:F_(E.backup_id),approvedBy:F_(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),nX=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:F_(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:Mh(E.evidence,{}),error:F_(E.error),startedAt:F_(E.started_at),finishedAt:F_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),U5=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:Mh(E.criteria,{}),candidates:Mh(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:F_(E.confirmation),expiresAt:String(E.expires_at),result:Mh(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),$5=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:F_(E.backup_policy_id),recoveryPointId:F_(E.recovery_point_id),topologyId:F_(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:F_(E.operation_id),evidence:Mh(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:F_(E.error),startedAt:F_(E.started_at),finishedAt:F_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class st{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}addTrustedKey(E){let T=this.id(),_=this.now().toISOString(),d=N5(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[T,E.organizationId,E.name,E.publicKeyPem,d,_]),this.key(T)}key(E){let T=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return T?gb(T):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let T=this.key(E.keyId);if(!T||T.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(T.revokedAt)throw Error("Update signing key is revoked.");if(!A5(E.document,E.signature,T.publicKeyPem))throw Error("Update manifest signature is invalid.");let _=S5(E.document,E.current),d=r5(E.document),R=this.id(),h=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[R,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,d,JSON.stringify(E.document),E.signature,JSON.stringify(_),h]),this.manifest(R)}manifest(E){let T=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return T?L5(T):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(L5)}createWindow(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[T,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,_,_]),this.window(T)}window(E){let T=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return T?t5(T):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(t5)}createCampaign(E){return this.control.transaction(()=>{let T=this.manifest(E.manifestId);if(!T?.compatibility.compatible||T.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let _=this.id(),d=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[_,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,d,d]),E.targets.forEach((R,h)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),_,R.serverId??null,R.target,E.strategy==="canary"?h===0?0:1+Math.floor((h-1)/E.batchSize):Math.floor(h/E.batchSize),R.previousVersion,d,d])),this.campaign(_)})}campaign(E){let T=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return T?O5(T):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(O5)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(nX)}updateCampaign(E,T){let _=this.campaign(E);if(!_)throw Error("Upgrade campaign was not found.");let d={..._,...T};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[d.status,d.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,T){let _=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!_)throw Error("Upgrade target was not found.");let d={...nX(_),...T};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[d.status,JSON.stringify(d.evidence),d.error??null,d.startedAt??null,d.finishedAt??null,this.now().toISOString(),E]),nX(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let T=[...E.candidates].sort((r,N)=>r.id.localeCompare(N.id)),_=q$(T),d=this.id(),R=this.now().toISOString(),h=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[d,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(T),_,T.reduce((r,N)=>r+N.bytes,0),h,R,R]),this.cleanup(d)}cleanup(E){let T=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return T?U5(T):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(U5)}updateCleanup(E,T){let _=this.cleanup(E);if(!_)throw Error("Cleanup plan was not found.");let d={..._,...T};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[d.status,d.confirmation??null,JSON.stringify(d.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[T,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,_,_]),this.drill(T)}drill(E){let T=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return T?$5(T):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map($5)}updateDrill(E,T){let _=this.drill(E);if(!_)throw Error("DR drill was not found.");let d={..._,...T};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[d.status,d.operationId??null,JSON.stringify(d.evidence),d.measuredRpoMinutes??null,d.measuredRtoMinutes??null,d.cleanupVerified?1:0,d.error??null,d.startedAt??null,d.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}function bb(E,T=new Date){if(!E.enabled)return!1;let _=new Date(E.schedule);if(!Number.isNaN(_.getTime()))return T>=_&&T.getTime()<=_.getTime()+E.durationMinutes*60000;let d=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!d)return!1;let R=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(T),h=Number(R.find((N)=>N.type==="hour")?.value)*60+Number(R.find((N)=>N.type==="minute")?.value),r=Number(d[1])*60+Number(d[2]);return h>=r&&h<r+E.durationMinutes}class pt{store;now;queue;constructor(E,T,_=()=>new Date){this.store=E;this.now=_;this.queue=T??new nE(E.control)}enqueueCampaign(E,T={}){let _=this.store.campaign(E);if(!_)throw Error("Upgrade campaign was not found.");let d=_.windowId?this.store.window(_.windowId):void 0;if(d&&!d.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(d&&!T.overrideWindow&&!bb(d,this.now()))throw Error("Upgrade is outside its maintenance window.");if(d?.requireApproval&&!T.approvedBy&&!_.approvedBy)throw Error("Maintenance approval is required.");let R=this.queue.enqueue({projectId:_.projectId,actorId:T.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:R}}async previewCleanup(E,T){let _=T.find((d)=>d.kind===E.kind);if(!_)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await _.discover(E.criteria)})}enqueueCleanup(E,T){let _=this.store.cleanup(E);if(!_||_.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(_.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let d=`DELETE ${_.candidates.length} ${_.kind}`;if(T!==d)throw Error(`Exact confirmation ${d} is required.`);let R=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${_.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:T}),operation:R}}enqueueDrill(E){let T=this.store.drill(E);if(!T||T.status!=="planned")throw Error("A planned DR drill is required.");let _=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${T.scenario}:${T.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:_.id}),operation:_}}}var lX=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function D5(E){return{"maintenance.upgrade":async(R)=>{let h=E.store.campaign(String(lX(R.operation.input).campaignId??""));if(!h||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let r=E.store.manifest(h.manifestId);if(!r?.compatibility.compatible||r.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let N=r.document.artifacts.find((S)=>S.platform===process.platform&&S.architecture===process.arch)??r.document.artifacts[0];if(!N)throw Error("No update artifact matches this platform.");E.store.updateCampaign(h.id,{status:"running",currentStage:"preflight"});let A=[];try{for(let S of[...new Set(E.store.targets(h.id).map((L)=>L.cohort))].sort((L,t)=>L-t)){E.store.updateCampaign(h.id,{currentStage:`cohort:${S}`});for(let L of E.store.targets(h.id).filter((t)=>t.cohort===S)){R.throwIfCancellationRequested(),R.checkpoint(`download:${L.target}`,"Downloading signed platform artifact."),E.store.updateTarget(L.id,{status:"downloading",startedAt:new Date().toISOString()});let t=await E.platform.download({target:L,artifact:N,signal:R.signal});if(t.sha256!==N.sha256)throw Error(`Artifact checksum mismatch for ${L.target}.`);R.checkpoint(`install:${L.target}`,"Installing verified artifact."),E.store.updateTarget(L.id,{status:"installing"}),await E.platform.install({target:L,path:t.path,version:r.version,signal:R.signal}),A.push(L);let O=await E.platform.health({target:L,gate:h.healthGate});if(!O.healthy)throw Error(`Upgrade health gate failed for ${L.target}.`);E.store.updateTarget(L.id,{status:"healthy",evidence:O.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(h.id,{status:"succeeded",currentStage:void 0}),{campaignId:h.id,version:r.version,targets:A.length}}catch(S){E.store.updateCampaign(h.id,{status:"rolling_back",currentStage:"rollback"});for(let L of A.reverse())E.store.updateTarget(L.id,{status:"rolling_back"}),await E.platform.rollback({target:L,version:L.previousVersion,signal:R.signal}),E.store.updateTarget(L.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(h.id,{status:"rolled_back",currentStage:void 0}),S}},"maintenance.cleanup":async(R)=>{let h=E.store.cleanup(String(lX(R.operation.input).planId??""));if(!h||h.status!=="approved")throw Error("Approved cleanup plan was not found.");if(q$([...h.candidates].sort((L,t)=>L.id.localeCompare(t.id)))!==h.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let r=E.cleanup?.find((L)=>L.kind===h.kind);if(!r)throw Error(`No ${h.kind} cleanup driver is configured.`);E.store.updateCleanup(h.id,{status:"running"});let N=[],A=[];for(let L of h.candidates){R.throwIfCancellationRequested();try{await r.remove(L),N.push(L.id)}catch(t){A.push({id:L.id,error:t instanceof Error?t.message:String(t)})}}let S=A.length?N.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(h.id,{status:S,result:{removed:N,failed:A,reclaimedBytes:h.candidates.filter((L)=>N.includes(L.id)).reduce((L,t)=>L+t.bytes,0)}}),A.length)throw Error(`Cleanup failed for ${A.length} candidate(s).`);return{planId:h.id,removed:N.length,reclaimedBytes:h.estimatedBytes}},"maintenance.drill":async(R)=>{let h=E.store.drill(String(lX(R.operation.input).drillId??""));if(!h)throw Error("DR drill was not found.");let r=E.recovery?.find((t)=>t.scenario===h.scenario);if(!r)throw Error(`No ${h.scenario} recovery driver is configured.`);let N=new Date;E.store.updateDrill(h.id,{status:"restoring",startedAt:N.toISOString()});let A=h.isolatedTarget,S={},L={};try{R.checkpoint("restore","Restoring into isolated drill target.");let t=await r.restore({drill:h,signal:R.signal});if(!t.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");A=t.target,S=t.evidence;let O=(N.getTime()-new Date(t.recoveryPointAt).getTime())/60000;E.store.updateDrill(h.id,{status:"verifying",measuredRpoMinutes:O,evidence:{restore:S}}),R.checkpoint("verify","Running recovery health checks without production traffic.");let U=await r.verify({drill:h,target:A});L=U.evidence;let D=(Date.now()-N.getTime())/60000;if(!U.healthy||O>h.expectedRpoMinutes||D>h.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(h.id,{measuredRpoMinutes:O,measuredRtoMinutes:D,evidence:{restore:S,verify:L}})}catch(t){throw E.store.updateDrill(h.id,{status:"failed",error:t instanceof Error?t.message:String(t),evidence:{restore:S,verify:L}}),t}finally{E.store.updateDrill(h.id,{status:"cleaning"});try{await r.cleanup({drill:h,target:A});let t=E.store.drill(h.id);E.store.updateDrill(h.id,{status:t.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(t){E.store.updateDrill(h.id,{status:"cleanup_required",cleanupVerified:!1,error:t instanceof Error?t.message:String(t),finishedAt:new Date().toISOString()})}}return{drillId:h.id,status:E.store.drill(h.id).status}}}}var I5={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class ot{kind;control;projectId;organizationId;constructor(E,T,_,d){this.kind=E;this.control=T;this.projectId=_;this.organizationId=d}async discover(E){let T=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),_=new Date(Date.now()-T*86400000).toISOString(),d=I5[this.kind],R=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(d.select).all(R,_).map((r)=>({id:String(r.id),kind:this.kind,label:`${this.kind}:${String(r.id)}`,bytes:Number(r.bytes??0),metadata:{createdAt:String(r.created_at)}}))}async remove(E){if(this.control.database.run(I5[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function kb(){let E=await o(),T=lE(process.cwd(),E),_=new st(T.store),d=new pt(_),R=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((h)=>new ot(h,T.store,T.project.id,T.organization.id));return{controlPlane:T,store:_,service:d,cleanup:R}}async function Vh(E){let T=await kb();try{await E(T)}catch(_){Q(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}function iX(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(T)=>Vh((_)=>{let d={manifests:_.store.manifests(_.controlPlane.organization.id),windows:_.store.windows(_.controlPlane.project.id),campaigns:_.store.campaigns(_.controlPlane.project.id),cleanups:_.store.cleanups(_.controlPlane.project.id),drills:_.store.drills(_.controlPlane.project.id)},R=[...d.manifests.map((h)=>["update",h.version,h.compatibility.compatible?"compatible":"blocked",h.compatibility.reasons.join("; ")||h.channel]),...d.campaigns.map((h)=>["upgrade",h.id,h.status,h.currentStage??h.fromVersion]),...d.cleanups.map((h)=>["cleanup",h.kind,h.status,`${h.candidates.length} items / ${h.estimatedBytes} bytes`]),...d.drills.map((h)=>["DR drill",h.scenario,h.status,h.isolatedTarget])];if(T.json)console.log(JSON.stringify(d,null,2));else EE(["Area","Name / version","Status","Detail"],R)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(T,_)=>Vh(async(d)=>{let R=d.store.addTrustedKey({organizationId:d.controlPlane.organization.id,name:T,publicKeyPem:await Bun.file(_).text()});Z(`Trusted ${R.name}: ${R.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(T,_,d)=>Vh(async(R)=>{let h=await Bun.file(T).json(),r=(await Bun.file(_).text()).trim(),N=R.store.importManifest({organizationId:R.controlPlane.organization.id,keyId:d,document:h,signature:r,current:{schemaVersion:R.controlPlane.store.health().schemaVersion,currentVersion:mt,platform:process.platform,architecture:process.arch}});Z(`Verified ${N.version}; ${N.compatibility.compatible?"compatible":"blocked: "+N.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(T,_,d)=>Vh((R)=>{let h=R.store.createWindow({projectId:R.controlPlane.project.id,name:T,schedule:_,timezone:d.timezone,durationMinutes:Number(d.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});Z(`Created ${h.name} (${h.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(T,_,d)=>Vh((R)=>{let h=new nR(R.controlPlane.store).list(R.controlPlane.project.id).filter((A)=>A.status==="ready").map((A)=>({serverId:A.id,target:A.name,previousVersion:A.bootstrapVersion??mt}));if(!h.length)h.push({target:"control-plane",previousVersion:mt});let r=R.store.createCampaign({projectId:R.controlPlane.project.id,manifestId:T,fromVersion:mt,strategy:d.strategy==="rolling"?"rolling":"canary",batchSize:Number(d.batch),healthGate:{kind:"platform"},backupId:_,targets:h}),N=R.service.enqueueCampaign(r.id);Z(`Staged upgrade queued: ${N.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(T,_)=>Vh(async(d)=>{let R=await d.service.previewCleanup({projectId:d.controlPlane.project.id,kind:T,criteria:{olderThanDays:Number(_.olderThan)}},d.cleanup);EE(["ID","Candidate","Bytes"],R.candidates.map((h)=>[h.id,h.label,String(h.bytes)])),$(`Apply with: cloud cleanup:apply ${R.id} --confirm "DELETE ${R.candidates.length} ${R.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(T,_)=>Vh((d)=>{let R=d.service.enqueueCleanup(T,String(_.confirm??""));Z(`Cleanup queued: ${R.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(T,_,d)=>Vh((R)=>{let h=R.store.createDrill({projectId:R.controlPlane.project.id,scenario:T,isolatedTarget:_,expectedRpoMinutes:Number(d.rpo),expectedRtoMinutes:Number(d.rto),recoveryPointId:d.recoveryPoint,topologyId:d.topology});Z(`Planned isolated drill ${h.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(T)=>Vh((_)=>{let d=_.service.enqueueDrill(T);Z(`DR drill queued: ${d.operation.id}`)}))}ME();xr();Bd();async function mX(){try{return(await o()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function aX(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(T)=>{b("Lambda Functions");let _=T?.region||await mX(),d=new jT(_);try{let{Functions:R=[]}=await d.listFunctions({MaxItems:50});if(!R.length){$("No functions found");return}EE(["Name","Runtime","Memory","Timeout","Last Modified"],R.map((h)=>[h.FunctionName??"-",h.Runtime??"-",h.MemorySize?`${h.MemorySize} MB`:"-",h.Timeout?`${h.Timeout}s`:"-",h.LastModified??"-"]))}catch(R){Q(`Failed to list functions: ${R.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(T,_)=>{b(`Invoking ${T}`);let d=_?.region||await mX(),R=new jT(d),h=new n("Invoking function...");h.start();try{let r=await R.invoke({FunctionName:T,InvocationType:_?.async?"Event":"RequestResponse",Payload:_?.payload||"{}",LogType:_?.async?"None":"Tail"});if(r.FunctionError){if(h.fail(`Function returned an error (${r.FunctionError})`),r.Payload)$(r.Payload);process.exitCode=1;return}if(h.succeed(`Invoked (status ${r.StatusCode})`),r.Payload)$(`
+`).find((R)=>R&&!R.startsWith("#"))?.trim().split(/\s+/);if(_.code!==0||!d?.[1]||!d[2])throw Error(`SSH host-key scan failed: ${_.stderr.trim()||"no key returned"}`);return{algorithm:d[1],key:d[2]}}async exec(E,T){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return vy(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,T])}}var Jb=(E)=>`SHA256:${Xb("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,Fb=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class eh{provider;transport;discoverer;constructor(E,T=new ny,_){this.provider=E;this.transport=T;this.discoverer=_}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let T=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:T.algorithm,hostKeyFingerprint:Jb(T.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let T=await this.transport.exec(E,Fb);if(T.code!==0)throw Error(`Fleet validation failed: ${T.stderr.trim()||T.code}`);try{return JSON.parse(T.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,T){let _=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${T.length}`);if(_.code!==0)throw Error(`Fleet bootstrap failed: ${_.stderr.trim()||_.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function ly(E,T){return{"fleet.bootstrap":async(_)=>{let d=_.operation.input&&typeof _.operation.input==="object"&&!Array.isArray(_.operation.input)?_.operation.input:{},R=E.get(String(d.serverId??""));if(!R)throw Error("Queued fleet server was not found.");let h=T.find((A)=>A.provider===R.provider);if(!h)throw Error(`No ${R.provider} fleet driver is configured.`);let r=Array.isArray(d.steps)?d.steps.map(String):[];if(_.checkpoint("preflight","Rechecking pinned trust and healthy validation."),R.trustState!=="pinned"||!R.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");_.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let N=await h.bootstrap(R,r);return E.update(R.id,{bootstrapVersion:N.version,status:"ready"}),_.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:R.id,bootstrapVersion:N.version,steps:r.length}}}}var vR=(E)=>E==null?void 0:String(E),PN=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},fX=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:vR(E.provider_id),region:vR(E.region),zone:vR(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:vR(E.host_key_algorithm),hostKeyFingerprint:vR(E.host_key_fingerprint),pendingHostKey:vR(E.pending_host_key),roles:PN(E.roles,[]),labels:PN(E.labels,{}),taints:PN(E.taints,[]),capacity:PN(E.capacity,{}),usage:PN(E.usage,{}),capabilities:PN(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:PN(E.validation,void 0),bootstrapVersion:vR(E.bootstrap_version),heartbeatAt:vR(E.heartbeat_at),lastSeenAt:vR(E.last_seen_at),archivedAt:vR(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class nR{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}get(E){let T=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return T?fX(T):void 0}list(E,T=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(fX).filter((_)=>T||_.status!=="archived")}findProvider(E,T,_){let d=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,T,_);return d?fX(d):void 0}create(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,_,_]),this.get(T)}update(E,T){let _=this.get(E);if(!_)throw Error("Server was not found.");let d={..._,...T},R=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[d.name,d.providerId??null,d.region??null,d.zone??null,d.endpoint,d.sshUser,d.sshPort,d.credentialRef,d.hostKeyAlgorithm??null,d.hostKeyFingerprint??null,d.pendingHostKey??null,JSON.stringify(d.roles),JSON.stringify(d.labels),JSON.stringify(d.taints),JSON.stringify(d.capacity),JSON.stringify(d.usage),JSON.stringify(d.capabilities),d.status,d.trustState,JSON.stringify(d.validation??{}),d.bootstrapVersion??null,d.heartbeatAt??null,d.lastSeenAt??null,d.archivedAt??null,R,E]),this.get(E)}}var zb=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class gt{store;drivers;now;queue;constructor(E,T,_,d=()=>new Date){this.store=E;this.drivers=T;this.now=d;this.queue=_??new nE(E.control)}driver(E){let T=this.drivers.find((_)=>_.provider===E);if(!T)throw Error(`No ${E} fleet driver is configured.`);return T}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!zb.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let T=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(T)return this.store.update(T.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let _=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),d=this.driver(E.provider);return this.store.create({...E,resourceId:_.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:d.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let _=await this.driver(T.provider).test(T);if(!_.reachable)return this.store.update(E,{status:"unreachable"});if(T.hostKeyFingerprint&&T.hostKeyFingerprint!==_.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:_.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:_.hostKeyAlgorithm,hostKeyFingerprint:_.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,T){let _=this.store.get(E);if(!_||_.pendingHostKey!==T)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:T,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let T=this.store.get(E);if(!T||T.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let _=await this.driver(T.provider).validate(T),d=[];if(!["x64","arm64","x86_64","aarch64"].includes(_.arch??""))d.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let r of["curl","tar"])if(!_.tools?.[r])d.push({code:`tool.${r}`,severity:"error",message:`${r} is missing.`,remediation:`Install ${r} before bootstrap.`});if(Math.abs(_.timeSkewSeconds??0)>60)d.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!_.dnsOk)d.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let R={valid:!d.some((r)=>r.severity==="error"),facts:_,findings:d,validatedAt:this.now().toISOString(),validatorVersion:"1"},h={cpu:_.cpuCores??0,memoryBytes:_.memoryBytes??0,diskBytes:_.diskBytes??0};return this.store.update(E,{validation:R,capacity:h,status:R.valid?"ready":"degraded"})}bootstrap(E,T=!1){let _=this.store.get(E);if(!_?.validation?.valid)throw Error("A healthy validation report is required.");let d=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!T)return{preview:!0,steps:d};let R=this.queue.enqueue({projectId:_.projectId,resourceId:_.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:d},lockKey:`server:${E}`,providerKey:_.provider}).operation;return{preview:!1,steps:d,operation:R}}heartbeat(E,T){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let d=this.now().toISOString();return this.store.update(E,{usage:T.usage,capabilities:T.capabilities??_.capabilities,heartbeatAt:d,lastSeenAt:d,status:_.status==="draining"||_.status==="drained"?_.status:"ready"})}drain(E,T=!1){return this.store.update(E,{status:T?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,T){let _=this.store.get(E);if(!_||T!==_.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function jb(){let E=await o(),T=lE(process.cwd(),E),_=new nR(T.store),d=new gt(_,[new eh("aws"),new eh("hetzner"),new eh("ssh")]);return{controlPlane:T,store:_,service:d}}async function Gh(E){let T=await jb();try{return await E(T)}finally{T.controlPlane.store.close()}}var ZN=(E,T)=>{let _=E.store.list(E.controlPlane.project.id).find((d)=>d.id===T||d.name===T);if(!_)throw Error(`Server ${T} was not found.`);return _},sd=(E)=>{Q(E instanceof Error?E.message:String(E)),process.exitCode=1};function PX(E,T){let _=Number.parseInt(E??"",10);return Number.isFinite(_)&&_>=0?_:T}function Bb(E="3h"){let T=E.match(/^(\d+)(m|h)$/);if(!T)throw Error("--range must use minutes or hours, for example 30m or 3h.");let _=Number(T[1])*(T[2]==="h"?3600000:60000);if(_<300000||_>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return _}function bt(E,T="%"){return E==null?"unavailable":`${E.toFixed(1)}${T}`}async function Wb(E,T){let _=await o();if(_.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let d=T.env??process.env.CLOUD_ENV??"production",R=IT(_,d),h=await IR(R);if(!h?.serverId)throw Error(`No pinned Hetzner server was found for ${R}.`);if(![h.serverName,String(h.serverId),h.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${h.serverName}.`);let r=$S(_),N=new Wh({apiToken:Qr(r.apiToken,_)}),A=await N.getServer(h.serverId),S=h.publicIp??A.public_net.ipv4?.ip;if(!S)throw Error(`Server ${A.name} has no public IPv4 address.`);let L=new Date,t=new Date(L.getTime()-Bb(T.range)),O=Math.min(3600,Math.max(60,PX(T.step,60))),U=await ey({client:N,serverId:A.id,cores:Math.max(1,Number(A.server_type.cores)||1),from:t,to:L,step:O,remote:{host:S,user:h.sshUser??r.sshUser,identityFile:r.sshPrivateKeyPath,connectTimeoutSec:15}});if(T.json){console.log(JSON.stringify({schemaVersion:1,server:A.name,result:U},null,2));return}EE(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[A.name,`${U.from} to ${U.to}`,`${bt(U.summary.cpuAveragePercent)} / ${bt(U.summary.cpuPeakPercent)}`,`${bt(U.summary.memoryAveragePercent)} / ${bt(U.summary.memoryPeakPercent)}`,U.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(U.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,bt(U.summary.swapPeakPercent)]])}function iy(E){let T=E.targetType.prices?.find((_)=>_.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:T?{hourlyNet:T.price_hourly.net,hourlyGross:T.price_hourly.gross,monthlyNet:T.price_monthly.net,monthlyGross:T.price_monthly.gross}:void 0}}function Hb(E){let T=iy(E);EE(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${T.serverName} (${T.serverId})`,T.location,`${T.from} -> ${T.to}`,T.capacityAvailable?"available":"waiting",`${T.target.cores??0} / ${T.target.memoryGb??0} GB / ${T.target.diskGb??0} GB`,T.price?.monthlyGross??T.price?.monthlyNet??"not reported"]])}async function yb(E,T,_){let d=await o();if(d.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let R=_.env??process.env.CLOUD_ENV??"production",h=IT(d,R),r=await IR(h),N=$S(d),A=new Wh({apiToken:Qr(N.apiToken,d)}),L=r&&(E===r.serverName||E===String(r.serverId)||E===r.stackName)?await A.getServer(r.serverId):(await A.listServers()).find((e)=>e.name===E||String(e.id)===E);if(!L)throw Error(`Hetzner server ${E} was not found.`);if(r?.serverId&&r.serverId!==L.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${r.serverId}.`);let t=Hh(T),O=_.upgradeDisk!==!1,U=await xt(A,L.id,t,O);if(_.json)console.log(JSON.stringify({schemaVersion:1,plan:iy(U)},null,2));else Hb(U);if(!_.apply){if(!_.json)$(`Preview only. Re-run with --apply --confirm ${L.name} to execute.`);return}if(_.confirm!==L.name)throw Error(`Resize requires --confirm ${L.name}.`);let D=r?.publicIp??L.public_net.ipv4?.ip;if(!D)throw Error(`Server ${L.name} has no public IPv4 address for verification.`);let C={host:D,user:r?.sshUser??N.sshUser,identityFile:N.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},w=await MX(h),c=new Date().toISOString(),z={schemaVersion:1,operationId:w?.targetType===t&&w.serverId===L.id?w.operationId:crypto.randomUUID(),stackName:h,serverId:L.id,serverName:L.name,sourceType:U.currentType.name,targetType:t,upgradeDisk:O,phase:"planning",status:"running",attempts:w?.targetType===t?w.attempts:0,startedAt:w?.targetType===t?w.startedAt:c,updatedAt:c,manifest:w?.targetType===t?w.manifest:void 0};await Yh(z);let j=PX(_.pollSeconds,900)*1000,W=PX(_.maxWaitMinutes,0)*60000,G=Date.now();for(;;){let e=await xt(A,L.id,t,O);if(!e.capacityAvailable&&!e.alreadyComplete){if(z={...z,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await Yh(z),!_.wait){if(!_.json)$(`${t} has no capacity in ${e.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(W>0&&Date.now()-G>=W)throw Error(`Timed out waiting for ${t} capacity in ${e.location}.`);if(!_.json)$(`Waiting ${Math.round(j/1000)} seconds for ${t} capacity...`);await Bun.sleep(j);continue}let V=await VX(h);try{let P=await(async()=>{try{return z={...z,status:"running",attempts:z.attempts+1,updatedAt:new Date().toISOString()},await Yh(z),await HX({client:A,serverId:L.id,targetType:t,upgradeDisk:O,resumeFromOff:z.phase==="shutting-down"||z.phase==="resizing"||z.phase==="powering-on"||z.phase==="verifying",manifest:z.manifest,hooks:{preflight:async()=>{let g=await YX(C);return z={...z,manifest:g,updatedAt:new Date().toISOString()},await Yh(z),g},afterBoot:async(g,k,v,TE)=>eX(C,k,v,TE),onPhase:async(g,k)=>{if(z={...z,phase:g,status:g==="waiting-capacity"?"waiting-capacity":g==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await Yh(z),!_.json)$(`${g}${k?` ${JSON.stringify(k)}`:""}`)}}})}finally{await V()}})();if(z={...z,status:P.status==="completed"||P.status==="already-complete"?"completed":P.status==="recovered"?"recovered":"waiting-capacity",lastError:P.status==="recovered"?P.error:void 0,updatedAt:new Date().toISOString()},await Yh(z),_.json)console.log(JSON.stringify({schemaVersion:1,result:P},null,2));else if(P.status==="completed"||P.status==="already-complete")Z(`${L.name} is on ${t} and passed full post-boot verification.`);else if(P.status==="recovered"&&P.retryable&&_.wait){$(`Capacity race recovered safely. Waiting ${Math.round(j/1000)} seconds before retry.`),await Bun.sleep(j);continue}else if(P.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${P.error}`);return}catch(P){throw z={...z,status:"failed",lastError:P instanceof Error?P.message:String(P),updatedAt:new Date().toISOString()},await Yh(z),P}}}async function Yb(E,T){let _=await o();if(_.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let d=T.env??process.env.CLOUD_ENV??"production",R=IT(_,d),h=await IR(R);if(!h?.serverId)throw Error(`No pinned Hetzner server was found for ${R}.`);if(![h.serverName,String(h.serverId),h.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${h.serverName}.`);let r=$S(_),N=new Wh({apiToken:Qr(r.apiToken,_)}),A=await N.getServer(h.serverId),S=h.publicIp??A.public_net.ipv4?.ip;if(!S)throw Error(`Server ${A.name} has no public IPv4 address.`);let L=M$(_);if(T.json)console.log(JSON.stringify({schemaVersion:1,server:A.name,plan:L},null,2));else EE(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[A.name,L.firewallPorts.join(","),L.monitoring?"on":"off",L.autoUpdates?"on":"off",`${L.swapGb} GB`,"disabled"]]);if(!T.apply){if(!T.json)$(`Preview only. Re-run with --apply --confirm ${A.name} to execute.`);return}if(T.confirm!==A.name)throw Error(`Optimization requires --confirm ${A.name}.`);let t={host:S,user:h.sshUser??r.sshUser,identityFile:r.sshPrivateKeyPath,connectTimeoutSec:15},O=await FS(t),U=O.routeProbes.filter((v)=>!v.ok),D=_.infrastructure?.compute,C=Nd(D)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,w=O.failedUnits.filter((v)=>!C.has(v));if(w.length>0)throw Error(`Preflight found failed services: ${w.join(", ")}`);if(U.length>0)throw Error(`Preflight found unhealthy routes: ${U.map((v)=>v.domain).join(", ")}`);let c=Nd(D)?[]:Object.values(_.sites??{}).flatMap((v)=>typeof v?.port==="number"&&![80,443].includes(v.port)?[v.port]:[]),z=CS({allowSsh:D?.allowSsh!==!1,sitePorts:c,allowedPorts:D?.firewall?.allowedPorts}),j=(h.firewallId?(await N.listFirewalls()).find((v)=>v.id===h.firewallId):void 0)??(await N.listFirewalls()).find((v)=>v.name===`${_.project.slug}-${d}-app-fw`);if(!j)throw Error(`Managed firewall for ${A.name} was not found.`);let W=await N.setFirewallRules(j.id,z);await Promise.all(W.map((v)=>N.waitForAction(v.id))),await XX(_,t);let[G,e]=await Promise.all([FS(t),JX(t)]),V=FX(L,e),P=fy(O,G),g=G.routeProbes.filter((v)=>!v.ok);if(P.stoppedServices.length>0)V.push(`services stopped: ${P.stoppedServices.join(", ")}`);if(P.changedRouteFragments.length>0)V.push(`route fragments changed: ${P.changedRouteFragments.join(", ")}`);if(P.missingRouteIds.length>0)V.push(`routes disappeared: ${P.missingRouteIds.join(", ")}`);if(P.changedReleaseLinks.length>0)V.push(`release links changed: ${P.changedReleaseLinks.join(", ")}`);if(P.missingData.length>0)V.push(`databases or volumes disappeared: ${P.missingData.join(", ")}`);if(g.length>0)V.push(`unhealthy routes: ${g.map((v)=>v.domain).join(", ")}`);if(V.length>0)throw Error(`Host optimization verification failed: ${V.join("; ")}`);let k={serverId:A.id,serverName:A.name,services:G.runningServices.length,routes:G.routeIds.length,healthyDomains:G.routeProbes.length,releaseLinks:G.releaseLinks.length,databasesAndVolumes:G.dataCatalog.length,report:e};if(T.json)console.log(JSON.stringify({schemaVersion:1,result:k},null,2));else Z(`${A.name} passed full host, rpx route, service, release, and data verification.`)}function ZX(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(T,_)=>{try{await Gh(async(d)=>{let R=T?[ZN(d,T)]:d.store.list(d.controlPlane.project.id),h=R.flatMap((r)=>Object.entries(r.capabilities).map(([N,A])=>({server:r.name,provider:r.provider,action:N,...A})));if(_.json)console.log(JSON.stringify({schemaVersion:1,targets:h},null,2));else EE(["Server","Provider","Action","Support","Explanation"],h.map((r)=>[r.server,r.provider,r.action,r.supported?"supported":"unsupported",r.reason??"—"]))})}catch(d){sd(d)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(T,_,d)=>{try{await yb(T,_,d)}catch(R){sd(R)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(T,_)=>{try{await Yb(T,_)}catch(d){sd(d)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(T,_)=>{try{await Wb(T,_)}catch(d){sd(d)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(T)=>{try{await Gh(async(_)=>{let d=_.store.list(_.controlPlane.project.id);if(T.json)console.log(JSON.stringify(d,null,2));else EE(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],d.map((R)=>[R.name,R.providerId??"—",`${R.provider} / ${R.region??"external"}`,`${R.status} / ${R.trustState}`,R.roles.join(","),`${R.capacity.cpu??0} / ${R.capacity.memoryBytes??0}`,R.heartbeatAt??"never"]))})}catch(_){sd(_)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(T,_)=>{try{await Gh(async(d)=>{let R=_.provider;if(!["aws","hetzner","ssh"].includes(R)||!_.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let h=d.service.enroll({organizationId:d.controlPlane.organization.id,projectId:d.controlPlane.project.id,name:T,provider:R,providerId:_.providerId,endpoint:_.endpoint,sshUser:_.user??"deploy",credentialRef:_.credentialRef??"secret://fleet/agent",region:_.region,roles:String(_.roles??"application").split(","),labels:Object.fromEntries(String(_.labels??"").split(",").map((r)=>r.split("=")).filter((r)=>r[0]&&r[1]))});Z(`Enrolled ${h.name} as ${h.id}; no remote mutation was performed.`)})}catch(d){sd(d)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(T,_)=>{try{await Gh(async(d)=>{let R=ZN(d,T);if(R=await d.service.test(R.id),R.trustState==="rotation_pending"){if(!_.acceptHostKey)throw Error(`Host key changed to ${R.pendingHostKey}; review it first.`);R=d.service.reviewHostKey(R.id,_.acceptHostKey)}let h=await d.service.validate(R.id);if(_.json)console.log(JSON.stringify(h.validation,null,2));else EE(["Severity","Code","Finding","Remediation"],(h.validation?.findings??[]).map((r)=>[r.severity,r.code,r.message,r.remediation??"—"]));if(!h.validation?.valid)process.exitCode=1})}catch(d){sd(d)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(T,_)=>{try{await Gh(async(d)=>{let R=d.service.bootstrap(ZN(d,T).id,!!_.apply);if(R.preview)EE(["Step"],R.steps.map((h)=>[h]));else Z(`Bootstrap queued: ${R.operation?.id}`)})}catch(d){sd(d)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(T,_)=>{try{await Gh(async(d)=>Z(d.service.drain(ZN(d,T).id,!!_.complete).status))}catch(d){sd(d)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(T)=>{try{await Gh(async(_)=>{_.service.uncordon(ZN(_,T).id),Z(`Uncordoned ${T}.`)})}catch(_){sd(_)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(T,_)=>{try{await Gh(async(d)=>{d.service.archive(ZN(d,T).id,_.confirm??""),Z(`Archived ${T}; provider infrastructure was not terminated.`)})}catch(d){sd(d)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(T)=>{try{await Gh(async(_)=>{let d=ZN(_,T);if(d.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let R=Bun.spawn(["ssh","-p",String(d.sshPort),"-o","StrictHostKeyChecking=yes",`${d.sshUser}@${d.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),h=await R.exited;if(h)process.exitCode=h})}catch(_){sd(_)}});for(let[T,_]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(T,_).action(async(...d)=>ld(T.split(" ")[0],{target:String(d[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}ME();var CR=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},Ad=(E)=>E==null?void 0:String(E),sy=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),jS=(E={})=>({...sy(),...E});function my(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:Ad(E.region),architecture:Ad(E.architecture),labels:CR(E.labels,{}),requiredServerLabels:CR(E.required_server_labels,{}),toleratedTaints:CR(E.tolerated_taints,[]),capacity:jS(CR(E.capacity,{})),reserved:CR(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:Ad(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function ay(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Ad(E.environment_id),resourceId:String(E.resource_id),releaseId:Ad(E.release_id),poolId:String(E.pool_id),serverId:Ad(E.server_id),purpose:String(E.purpose),requirements:CR(E.requirements,{}),decision:CR(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function eb(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:Ad(E.resource_id),poolId:String(E.pool_id),placementId:Ad(E.placement_id),operationId:Ad(E.operation_id),sourceSha:String(E.source_sha),buildSpec:CR(E.build_spec,{}),credentialPolicy:CR(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:Ad(E.workspace),cacheKey:Ad(E.cache_key),artifactUri:Ad(E.artifact_uri),artifactDigest:Ad(E.artifact_digest),status:String(E.status),cleanupAt:Ad(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class kt{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}createPool(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(jS(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,_,_]),this.getPool(T)}getPool(E){let T=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return T?my(T):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(my)}updatePool(E,T){let _=this.getPool(E);if(!_)throw Error("Capacity pool was not found.");let d={..._,...T},R=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[d.status,JSON.stringify(d.reserved),JSON.stringify(d.capacity),d.concurrency,R,E]),this.getPool(E)}addMember(E,T,_={}){let d=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,T,JSON.stringify(_),d,d])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((T)=>({serverId:String(T.server_id),status:String(T.status),capacityOverride:CR(T.capacity_override,{})}))}memberStatus(E,T,_){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[_,this.now().toISOString(),E,T])}listPlacements(E,T){let _=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(ay);return T?.length?_.filter((d)=>T.includes(d.status)):_}getPlacement(E){let T=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return T?ay(T):void 0}activeUsage(E,T){let _=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),d=T?_.filter((R)=>String(R.server_id)===T):_;return{resources:d.reduce((R,h)=>{let r=jS(CR(h.resources,{}));for(let N of Object.keys(R))R[N]+=r[N];return R},sy()),count:d.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let T=this.id(),_=this.id(),d=this.now().toISOString(),R=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[T,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,d,d]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[_,T,E.decision.poolId,E.decision.serverId??null,JSON.stringify(jS(E.requirements.resources)),R,d,d]),this.getPlacement(T)})}transitionPlacement(E,T){if(!this.getPlacement(E))throw Error("Placement was not found.");let d=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[T,d,E]),["released","failed","blocked"].includes(T))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[d,E]);return this.getPlacement(E)}createBuild(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[T,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),_,_]),this.getBuild(T)}getBuild(E){let T=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return T?eb(T):void 0}updateBuild(E,T){let _=this.getBuild(E);if(!_)throw Error("Remote build was not found.");let d={..._,...T},R=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[d.operationId??null,d.workspace??null,d.cacheKey??null,d.artifactUri??null,d.artifactDigest??null,d.status,d.cleanupAt??null,R,E]),this.getBuild(E)}}var P$=["cpu","memoryBytes","diskBytes","gpu"],py=(E,T={})=>Object.entries(T).every(([_,d])=>E[_]===d),Gb=(E,T,_)=>Object.fromEntries(P$.map((d)=>[d,Math.max(0,E[d]-T[d]-(_[d]??0))])),Qb=(E,T)=>P$.every((_)=>E[_]>=(T[_]??0)),Mb=(E,T)=>P$.reduce((_,d)=>_+(T[d]??0)/(E[d]||1),0);class ut{store;fleet;constructor(E,T){this.store=E;this.fleet=T}poolCandidates(E,T,_){let d=[];for(let R of this.store.listPools(E)){if(R.id===_)continue;let h=[];if(R.status!=="active")h.push(`pool is ${R.status}`);if(R.purpose!==T.purpose)h.push(`purpose is ${R.purpose}`);if(T.region&&R.region!==T.region)h.push(`region is ${R.region??"unset"}`);if(T.architecture&&R.architecture!==T.architecture)h.push(`architecture is ${R.architecture??"unset"}`);if(!py(R.labels,T.labels))h.push("pool labels do not match");if(R.backend==="server"){let r=this.store.members(R.id);if(!r.length)d.push(this.decision(R,void 0,T,[...h,"pool has no servers"]));for(let N of r){let A=this.fleet.get(N.serverId),S=[...h];if(!A)S.push("server is missing");else this.serverReasons(R,A,N.status,T,S);d.push(this.decision(R,A,T,S,N.capacityOverride))}}else d.push(this.decision(R,void 0,T,h))}return d.sort((R,h)=>Number(h.eligible)-Number(R.eligible)||R.score.cost-h.score.cost||R.score.spread-h.score.spread||R.score.fit-h.score.fit||R.poolName.localeCompare(h.poolName)||(R.serverId??"").localeCompare(h.serverId??""))}serverReasons(E,T,_,d,R){if(_!=="active")R.push(`member is ${_}`);if(T.status!=="ready")R.push(`server is ${T.status}`);if(!T.roles.includes(d.purpose==="build"?"build":d.purpose))R.push(`server lacks ${d.purpose} role`);if(!py(T.labels,E.requiredServerLabels))R.push("server labels do not match pool selector");for(let h of T.taints)if(!E.toleratedTaints.includes(h))R.push(`taint ${h} is not tolerated`)}decision(E,T,_,d,R={}){let h=jS({...T?.capacity,...R}),r=T?Object.fromEntries(P$.map((S)=>[S,Math.min(E.capacity[S],h[S])])):E.capacity,N=this.store.activeUsage(E.id,T?.id),A=Gb(r,N.resources,E.reserved);if(N.count>=E.maxWorkloads)d.push("workload limit reached");if(_.purpose==="build"&&N.count>=E.concurrency)d.push("build concurrency reached");if(!Qb(A,_.resources))d.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:T?.id,eligible:d.length===0,reasons:d,available:A,score:{fit:Mb(A,_.resources),spread:N.count,cost:E.costWeight}}}explain(E,T){return this.poolCandidates(E,T)}place(E){return this.store.control.transaction(()=>{let T=this.poolCandidates(E.projectId,E.requirements).find((_)=>_.eligible);if(!T)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((_)=>_.reasons).join("; ")}`);return this.store.reserve({...E,decision:T})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let T=this.store.updatePool(E,{status:"draining"}),_=[],d=[];for(let R of this.store.listPlacements(T.projectId,["reserved","active"]).filter((h)=>h.poolId===E)){if(R.stateful){d.push(this.store.transitionPlacement(R.id,"blocked"));continue}this.store.transitionPlacement(R.id,"moving");let h=this.place({projectId:R.projectId,environmentId:R.environmentId,resourceId:R.resourceId,releaseId:R.releaseId,requirements:R.requirements});_.push(this.activate(h.id)),this.store.transitionPlacement(R.id,"released")}return{pool:T,moved:_,blocked:d}}drainServer(E,T){this.store.memberStatus(E,T,"draining");let _=this.store.getPool(E);if(!_)throw Error("Capacity pool was not found.");let d=[],R=[];for(let h of this.store.listPlacements(_.projectId,["reserved","active"]).filter((r)=>r.poolId===E&&r.serverId===T)){if(h.stateful){R.push(this.store.transitionPlacement(h.id,"blocked"));continue}this.store.transitionPlacement(h.id,"moving");let r=this.poolCandidates(h.projectId,h.requirements).find((A)=>A.eligible);if(!r){R.push(this.store.transitionPlacement(h.id,"blocked"));continue}let N=this.store.reserve({projectId:h.projectId,environmentId:h.environmentId,resourceId:h.resourceId,releaseId:h.releaseId,requirements:h.requirements,decision:r});d.push(this.activate(N.id)),this.store.transitionPlacement(h.id,"released")}return{moved:d,blocked:R}}reconcileFailure(E){let T=this.fleet.get(E);if(!T)throw Error("Server was not found.");let _=[],d=[];for(let R of this.store.listPlacements(T.projectId,["active"]).filter((h)=>h.serverId===E)){if(R.stateful||!R.autoReschedule){d.push(this.store.transitionPlacement(R.id,"blocked"));continue}this.store.transitionPlacement(R.id,"failed");let h=this.place({projectId:R.projectId,environmentId:R.environmentId,resourceId:R.resourceId,releaseId:R.releaseId,requirements:R.requirements});_.push(this.activate(h.id))}return{rescheduled:_,blocked:d}}}async function Vb(){let E=await o(),T=lE(process.cwd(),E),_=new kt(T.store),d=new ut(_,new nR(T.store));return{controlPlane:T,store:_,service:d}}async function vt(E){let T=await Vb();try{await E(T)}catch(_){Q(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}var Z$=(E)=>Object.fromEntries(String(E??"").split(",").map((T)=>T.split("=")).filter((T)=>T[0]&&T[1])),oy=(E)=>Object.fromEntries(Object.entries(Z$(E)).map(([T,_])=>[T,Number(_)]));function qX(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(T)=>vt((_)=>{let d=_.store.listPools(_.controlPlane.project.id);if(T.json)console.log(JSON.stringify(d,null,2));else EE(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],d.map((R)=>[R.name,R.purpose,R.backend,`${R.region??"any"} / ${R.architecture??"any"}`,R.status,JSON.stringify(R.capacity),String(R.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(T,_)=>vt((d)=>{let{purpose:R,backend:h}=_;if(!["application","build","worker","monitoring","backup"].includes(R)||!["server","ecs","asg"].includes(h))throw Error("Unsupported pool purpose or backend.");let r=d.store.createPool({organizationId:d.controlPlane.organization.id,projectId:d.controlPlane.project.id,name:T,purpose:R,backend:h,region:_.region,architecture:_.arch,labels:Z$(_.labels),requiredServerLabels:Z$(_.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...oy(_.capacity)},maxWorkloads:Number(_.max),costWeight:1,concurrency:Number(_.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});Z(`Created ${r.name} (${r.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(T,_)=>vt((d)=>{let R=d.store.listPools(d.controlPlane.project.id).find((r)=>r.id===T||r.name===T),h=new nR(d.controlPlane.store).list(d.controlPlane.project.id).find((r)=>r.id===_||r.name===_);if(!R||!h)throw Error("Pool or server was not found.");d.store.addMember(R.id,h.id),Z(`Attached ${h.name} to ${R.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(T)=>vt((_)=>{let d=_.service.explain(_.controlPlane.project.id,{purpose:T.purpose,resources:oy(T.resources),region:T.region,architecture:T.arch,labels:Z$(T.labels)});if(T.json)console.log(JSON.stringify(d,null,2));else EE(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],d.map((R)=>[R.poolName,R.serverId??"provider-managed",R.eligible?"yes":"no",JSON.stringify(R.available),`${R.score.fit.toFixed(2)} / ${R.score.spread} / ${R.score.cost}`,R.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(T)=>vt((_)=>{let d=_.store.listPools(_.controlPlane.project.id).find((h)=>h.id===T||h.name===T);if(!d)throw Error("Pool was not found.");let R=_.service.drainPool(d.id);Z(`Draining ${d.name}: moved ${R.moved.length}, blocked ${R.blocked.length} stateful placement(s).`)}))}ME();var Qh=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},pd=(E)=>E==null?void 0:String(E),E5=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:pd(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:Qh(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:Qh(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:pd(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),xX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:pd(E.stack_id),stackRevision:pd(E.stack_revision),status:String(E.status),health:Qh(E.health,{}),lastHealthyAt:pd(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),gX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:Qh(E.config,{}),status:String(E.status),checkpoint:pd(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:pd(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),bX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:Qh(E.weights,{}),desiredWeights:Qh(E.desired_weights,{}),status:String(E.status),providerState:Qh(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),T5=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:pd(E.operation_id),kind:String(E.kind),requestedRegion:pd(E.requested_region),revision:pd(E.revision),plan:Qh(E.plan,[]),currentStep:pd(E.current_step),completedSteps:Qh(E.completed_steps,[]),status:String(E.status),error:pd(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class nt{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((h)=>h.region)).size!==E.regions.length||E.regions.filter((h)=>h.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let T=E.regions.find((h)=>h.role==="primary"),_=this.id(),d=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[_,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,T.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),T.region,d,d]);for(let h of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),_,h.region,h.role,h.provider,d,d]);for(let h of E.dataPolicy.replicate)for(let r of E.regions)for(let N of E.regions.filter((A)=>A.region!==r.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),_,h,r.region,N.region,"{}",d,d]);let R=Object.fromEntries(E.regions.map((h)=>[h.region,h.region===T.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),_,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(R),JSON.stringify(R),d,d]),this.get(_)})}get(E){let T=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return T?E5(T):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(E5)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(xX)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(gX)}route(E){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return T?bX(T):void 0}updateTopology(E,T){let _=this.get(E);if(!_)throw Error("Regional topology was not found.");let d={..._,...T},R=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[d.status,d.activeRegion,d.revision??null,JSON.stringify(d.regions),R,E]),this.get(E)}updateTarget(E,T){let _=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!_)throw Error("Regional target was not found.");let d=xX(_),R={...d,...T},h=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[R.role,R.stackId??null,R.stackRevision??null,R.status,JSON.stringify(R.health),R.lastHealthyAt??null,h,E]),xX(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,T){let _=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!_)throw Error("Replication channel was not found.");let d=gX(_),R={...d,...T},h=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[R.status,R.checkpoint??null,R.lagSeconds??null,R.lastVerifiedAt??null,h,E]),gX(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,T){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!_)throw Error("Traffic route was not found.");let d=bX(_),R={...d,...T},h=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(R.weights),JSON.stringify(R.desiredWeights),R.status,JSON.stringify(R.providerState),h,E]),bX(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[T,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),_,_]),this.execution(T)}execution(E){let T=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return T?T5(T):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(T5)}updateExecution(E,T){let _=this.execution(E);if(!_)throw Error("Regional execution was not found.");let d={..._,...T},R=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[d.operationId??null,d.currentStep??null,JSON.stringify(d.completedSteps),d.status,d.error??null,R,E]),this.execution(E)}}class lt{store;queue;constructor(E,T){this.store=E;this.queue=T??new nE(E.control)}create(E){return this.store.create(E)}plan(E,T,_){if(!this.store.get(E))throw Error("Regional topology was not found.");let R=this.store.targets(E),h=this.store.channels(E);if(T==="rollout")return[...R.filter((r)=>r.role==="secondary").map((r)=>`apply:${r.region}`),...R.filter((r)=>r.role==="primary").map((r)=>`apply:${r.region}`),...h.map((r)=>`replicate:${r.kind}:${r.targetRegion}`),"traffic:activate"];if(T==="failover"||T==="failback")return[`health:${_}`,`replication:${_}`,`traffic:${_}`,`roles:${_}`];if(T==="destroy")return["traffic:drain",...R.filter((r)=>r.role==="secondary").map((r)=>`delete:${r.region}`),...R.filter((r)=>r.role==="primary").map((r)=>`delete:${r.region}`),"complete"];return["observe","repair"]}enqueue(E){let T=this.store.get(E.topologyId);if(!T)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!T.regions.some((h)=>h.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===T.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==T.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&T.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let _=this.plan(T.id,E.kind,E.targetRegion),d=this.store.createExecution({topologyId:T.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:_}),R=this.queue.enqueue({projectId:T.projectId,environmentId:T.environmentId,kind:`region.${E.kind}`,input:{executionId:d.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${T.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(d.id,{operationId:R.id}),{execution:this.store.execution(d.id),operation:R}}}var Kb=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function _5(E,T){let _=(S)=>{let L=T.find((t)=>t.provider===S.provider);if(!L)throw Error(`No ${S.provider} regional driver is configured.`);return L},d=(S,L,t)=>{S.throwIfCancellationRequested(),S.checkpoint(t,t),E.updateExecution(L.id,{status:"running",currentStep:t,completedSteps:[...E.execution(L.id).completedSteps,t]})},R=async(S,L)=>{let t=E.route(S.id);if(!t)throw Error("Regional traffic route was not found.");let O=E.targets(S.id).find((D)=>D.region===S.activeRegion)??E.targets(S.id)[0];if(!O)throw Error("Regional traffic target was not found.");E.updateRoute(t.id,{status:"applying",desiredWeights:L});let U=await _(O).applyTraffic({route:E.route(S.id),topology:S,weights:L});E.updateRoute(t.id,{status:Object.values(L).every((D)=>D===0)?"drained":"in_sync",weights:L,providerState:U.providerState})},h=async(S,L,t,O)=>{E.updateTopology(t.id,{status:"provisioning"});let U=L.revision,D=O.manifest??{},C=E.targets(t.id).sort((c,z)=>Number(c.role==="primary")-Number(z.role==="primary"));for(let c of C){d(S,L,`apply:${c.region}`),E.updateTarget(c.id,{status:"provisioning"});let z=await _(c).applyStack({target:c,revision:U,manifest:D,signal:S.signal}),j=await _(c).health({target:E.updateTarget(c.id,{stackId:z.stackId,stackRevision:U})});if(!j.healthy)throw Error(`Regional health gate failed in ${c.region}.`);E.updateTarget(c.id,{status:"ready",health:j.evidence,lastHealthyAt:new Date().toISOString()})}for(let c of E.channels(t.id)){d(S,L,`replicate:${c.kind}:${c.targetRegion}`),E.updateChannel(c.id,{status:"configuring"});let z=C.find((G)=>G.region===c.sourceRegion),j=await _(z).configureReplication({channel:c,topology:t}),W=await _(z).verifyReplication({channel:E.updateChannel(c.id,{checkpoint:j.checkpoint,lagSeconds:j.lagSeconds}),topology:t});if(!W.healthy||W.lagSeconds>t.dataPolicy.maxLagSeconds)throw Error(`${c.kind} replication to ${c.targetRegion} exceeds the RPO.`);E.updateChannel(c.id,{status:"in_sync",checkpoint:W.checkpoint,lagSeconds:W.lagSeconds,lastVerifiedAt:new Date().toISOString()})}d(S,L,"traffic:activate");let w=Object.fromEntries(t.regions.map((c)=>[c.region,c.region===t.activeRegion?100:0]));return await R(t,w),E.updateTopology(t.id,{status:"ready",revision:U}),{revision:U,activeRegion:t.activeRegion}},r=async(S,L,t)=>{let O=L.requestedRegion,U=E.targets(t.id).find((w)=>w.region===O);if(!U)throw Error("Requested regional target was not found.");E.updateTopology(t.id,{status:L.kind==="failover"?"failing_over":"failing_back"}),d(S,L,`health:${O}`);let D=await _(U).health({target:U});if(!D.healthy)throw Error(`Target region ${O} is unhealthy.`);E.updateTarget(U.id,{status:"ready",health:D.evidence,lastHealthyAt:new Date().toISOString()}),d(S,L,`replication:${O}`);for(let w of E.channels(t.id).filter((c)=>c.targetRegion===O)){let c=await _(U).verifyReplication({channel:w,topology:t});if(!c.healthy||c.lagSeconds>t.dataPolicy.maxLagSeconds)throw Error(`${w.kind} replication is outside the failover RPO.`);E.updateChannel(w.id,{status:"in_sync",checkpoint:c.checkpoint,lagSeconds:c.lagSeconds,lastVerifiedAt:new Date().toISOString()})}d(S,L,`traffic:${O}`),await R(t,Object.fromEntries(t.regions.map((w)=>[w.region,w.region===O?100:0]))),d(S,L,`roles:${O}`);let C=t.regions.map((w)=>({...w,role:w.region===O?"primary":"secondary"}));for(let w of E.targets(t.id))E.updateTarget(w.id,{role:w.region===O?"primary":"secondary"});return E.updateTopology(t.id,{status:L.kind==="failover"?"failed_over":"ready",activeRegion:O,regions:C}),{activeRegion:O}},N=async(S,L,t,O)=>{E.updateTopology(t.id,{status:"destroying"}),d(S,L,"traffic:drain"),await R(t,Object.fromEntries(t.regions.map((D)=>[D.region,0])));let U=O.deleteData!==!0;for(let D of E.targets(t.id).sort((C,w)=>Number(C.role==="primary")-Number(w.role==="primary")))d(S,L,`delete:${D.region}`),E.updateTarget(D.id,{status:"deleting"}),await _(D).deleteStack({target:D,retainData:U,signal:S.signal}),E.updateTarget(D.id,{status:"deleted"});return d(S,L,"complete"),E.updateTopology(t.id,{status:"destroyed"}),{destroyed:!0,dataRetained:U}},A=async(S)=>{let L=Kb(S.operation.input),t=E.execution(String(L.executionId??""));if(!t)throw Error("Regional execution was not found.");let O=E.get(t.topologyId);if(!O)throw Error("Regional topology was not found.");try{let U;if(t.kind==="rollout")U=await h(S,t,O,L);else if(t.kind==="failover"||t.kind==="failback")U=await r(S,t,O);else if(t.kind==="destroy")U=await N(S,t,O,L);else throw Error("Regional reconciliation is not configured.");return E.updateExecution(t.id,{status:"succeeded",currentStep:void 0}),{executionId:t.id,...U}}catch(U){if(E.updateExecution(t.id,{status:S.cancellationRequested()?"cancelled":"failed",error:U instanceof Error?U.message:String(U)}),E.get(O.id)?.status!=="destroyed")E.updateTopology(O.id,{status:"failed"});throw U}};return{"region.rollout":A,"region.failover":A,"region.failback":A,"region.destroy":A,"region.reconcile":A}}class kX{provider;reason;constructor(E,T="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=T}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function fb(){let E=await o(),T=lE(process.cwd(),E),_=new nt(T.store),d=new lt(_);return{controlPlane:T,store:_,service:d}}async function qN(E){let T=await fb();try{await E(T)}catch(_){Q(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}var it=(E,T)=>{let _=E.store.list(E.controlPlane.project.id).find((d)=>d.id===T||d.name===T);if(!_)throw Error("Regional topology was not found.");return _},Pb=(E)=>E.split(",").map((T,_)=>{let[d,R="aws"]=T.split(":");return{region:String(d),provider:R,role:_===0?"primary":"secondary"}}),Zb=(E)=>{let T=new Set(["s3","dynamodb","secrets"]),_=E.split(",").map((R)=>R.trim()),d=_.find((R)=>!T.has(R));if(d)throw Error(`Unsupported replication kind: ${d}`);return _};function uX(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(T)=>qN((_)=>{let d=_.store.list(_.controlPlane.project.id).map((R)=>({topology:R,targets:_.store.targets(R.id),channels:_.store.channels(R.id),route:_.store.route(R.id),executions:_.store.executions(R.id)}));if(T.json)console.log(JSON.stringify(d,null,2));else EE(["Name","Hostname","Active","Status","Revision","Replication"],d.map((R)=>[R.topology.name,R.topology.hostname,R.topology.activeRegion,R.topology.status,R.topology.revision??"—",`${R.channels.filter((h)=>h.status==="in_sync").length}/${R.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(T,_)=>qN((d)=>{if(!_.hostname||!_.regions)throw Error("--hostname and --regions are required.");let R=d.service.create({organizationId:d.controlPlane.organization.id,projectId:d.controlPlane.project.id,name:T,hostname:_.hostname,regions:Pb(_.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Zb(String(_.replicate)),maxLagSeconds:Number(_.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!_.cdn,wafEnabled:!!_.waf});Z(`Created ${R.name} (${R.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(T,_,d)=>qN((R)=>EE(["Step"],R.service.plan(it(R,T).id,_,d.target).map((h)=>[h])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(T,_,d)=>qN(async(R)=>{let h=d.manifest?await Bun.file(d.manifest).json():{},r=R.service.enqueue({topologyId:it(R,T).id,kind:"rollout",revision:_,manifest:h});Z(`Regional rollout queued: ${r.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(T,_)=>qN((d)=>{let R=d.service.enqueue({topologyId:it(d,T).id,kind:"failover",targetRegion:_});Z(`Failover queued: ${R.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(T,_)=>qN((d)=>{let R=d.service.enqueue({topologyId:it(d,T).id,kind:"failback",targetRegion:_});Z(`Failback queued: ${R.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(T,_)=>qN((d)=>{let R=d.service.enqueue({topologyId:it(d,T).id,kind:"destroy",confirmation:_.confirm});Z(`Regional teardown queued: ${R.operation.id}; replicated data remains retained.`)}))}ME();var mt="0.7.74";import{createHash as vX,createPublicKey as h5,verify as xb}from"node:crypto";function at(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(at).join(",")}]`;return`{${Object.keys(E).sort().map((T)=>`${JSON.stringify(T)}:${at(E[T])}`).join(",")}}`}var r5=(E)=>vX("sha256").update(at(E)).digest("hex"),q$=(E)=>vX("sha256").update(at(E)).digest("hex"),N5=(E)=>vX("sha256").update(h5(E).export({type:"spki",format:"der"})).digest("hex");function A5(E,T,_){try{return xb(null,Buffer.from(at(E)),h5(_),Buffer.from(T,"base64"))}catch{return!1}}var d5=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((T)=>Number(T)||0),R5=(E,T)=>{let _=d5(E),d=d5(T);for(let R=0;R<3;R++){let h=(_[R]??0)-(d[R]??0);if(h)return h}return 0};function S5(E,T){let _=[];if(T.schemaVersion<E.minimumSchema)_.push(`schema ${T.schemaVersion} is below ${E.minimumSchema}`);if(T.schemaVersion>E.maximumSchema)_.push(`schema ${T.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&R5(T.currentVersion,E.minimumVersion)<0)_.push(`platform ${T.currentVersion} is below ${E.minimumVersion}`);if(R5(E.version,T.currentVersion)<=0)_.push(`version ${E.version} is not newer than ${T.currentVersion}`);if(!E.artifacts.some((d)=>d.platform===T.platform&&d.architecture===T.architecture))_.push(`no artifact for ${T.platform}/${T.architecture}`);return{compatible:_.length===0,reasons:_}}var Mh=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},F_=(E)=>E==null?void 0:String(E),gb=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:F_(E.revoked_at),createdAt:String(E.created_at)}),L5=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:Mh(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:Mh(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),t5=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:Mh(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),O5=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:F_(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:Mh(E.health_gate,{}),status:String(E.status),currentStage:F_(E.current_stage),backupId:F_(E.backup_id),approvedBy:F_(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),nX=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:F_(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:Mh(E.evidence,{}),error:F_(E.error),startedAt:F_(E.started_at),finishedAt:F_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),U5=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:Mh(E.criteria,{}),candidates:Mh(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:F_(E.confirmation),expiresAt:String(E.expires_at),result:Mh(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),$5=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:F_(E.backup_policy_id),recoveryPointId:F_(E.recovery_point_id),topologyId:F_(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:F_(E.operation_id),evidence:Mh(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:F_(E.error),startedAt:F_(E.started_at),finishedAt:F_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class st{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}addTrustedKey(E){let T=this.id(),_=this.now().toISOString(),d=N5(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[T,E.organizationId,E.name,E.publicKeyPem,d,_]),this.key(T)}key(E){let T=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return T?gb(T):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let T=this.key(E.keyId);if(!T||T.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(T.revokedAt)throw Error("Update signing key is revoked.");if(!A5(E.document,E.signature,T.publicKeyPem))throw Error("Update manifest signature is invalid.");let _=S5(E.document,E.current),d=r5(E.document),R=this.id(),h=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[R,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,d,JSON.stringify(E.document),E.signature,JSON.stringify(_),h]),this.manifest(R)}manifest(E){let T=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return T?L5(T):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(L5)}createWindow(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[T,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,_,_]),this.window(T)}window(E){let T=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return T?t5(T):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(t5)}createCampaign(E){return this.control.transaction(()=>{let T=this.manifest(E.manifestId);if(!T?.compatibility.compatible||T.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let _=this.id(),d=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[_,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,d,d]),E.targets.forEach((R,h)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),_,R.serverId??null,R.target,E.strategy==="canary"?h===0?0:1+Math.floor((h-1)/E.batchSize):Math.floor(h/E.batchSize),R.previousVersion,d,d])),this.campaign(_)})}campaign(E){let T=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return T?O5(T):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(O5)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(nX)}updateCampaign(E,T){let _=this.campaign(E);if(!_)throw Error("Upgrade campaign was not found.");let d={..._,...T};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[d.status,d.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,T){let _=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!_)throw Error("Upgrade target was not found.");let d={...nX(_),...T};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[d.status,JSON.stringify(d.evidence),d.error??null,d.startedAt??null,d.finishedAt??null,this.now().toISOString(),E]),nX(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let T=[...E.candidates].sort((r,N)=>r.id.localeCompare(N.id)),_=q$(T),d=this.id(),R=this.now().toISOString(),h=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[d,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(T),_,T.reduce((r,N)=>r+N.bytes,0),h,R,R]),this.cleanup(d)}cleanup(E){let T=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return T?U5(T):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(U5)}updateCleanup(E,T){let _=this.cleanup(E);if(!_)throw Error("Cleanup plan was not found.");let d={..._,...T};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[d.status,d.confirmation??null,JSON.stringify(d.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[T,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,_,_]),this.drill(T)}drill(E){let T=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return T?$5(T):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map($5)}updateDrill(E,T){let _=this.drill(E);if(!_)throw Error("DR drill was not found.");let d={..._,...T};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[d.status,d.operationId??null,JSON.stringify(d.evidence),d.measuredRpoMinutes??null,d.measuredRtoMinutes??null,d.cleanupVerified?1:0,d.error??null,d.startedAt??null,d.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}function bb(E,T=new Date){if(!E.enabled)return!1;let _=new Date(E.schedule);if(!Number.isNaN(_.getTime()))return T>=_&&T.getTime()<=_.getTime()+E.durationMinutes*60000;let d=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!d)return!1;let R=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(T),h=Number(R.find((N)=>N.type==="hour")?.value)*60+Number(R.find((N)=>N.type==="minute")?.value),r=Number(d[1])*60+Number(d[2]);return h>=r&&h<r+E.durationMinutes}class pt{store;now;queue;constructor(E,T,_=()=>new Date){this.store=E;this.now=_;this.queue=T??new nE(E.control)}enqueueCampaign(E,T={}){let _=this.store.campaign(E);if(!_)throw Error("Upgrade campaign was not found.");let d=_.windowId?this.store.window(_.windowId):void 0;if(d&&!d.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(d&&!T.overrideWindow&&!bb(d,this.now()))throw Error("Upgrade is outside its maintenance window.");if(d?.requireApproval&&!T.approvedBy&&!_.approvedBy)throw Error("Maintenance approval is required.");let R=this.queue.enqueue({projectId:_.projectId,actorId:T.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:R}}async previewCleanup(E,T){let _=T.find((d)=>d.kind===E.kind);if(!_)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await _.discover(E.criteria)})}enqueueCleanup(E,T){let _=this.store.cleanup(E);if(!_||_.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(_.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let d=`DELETE ${_.candidates.length} ${_.kind}`;if(T!==d)throw Error(`Exact confirmation ${d} is required.`);let R=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${_.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:T}),operation:R}}enqueueDrill(E){let T=this.store.drill(E);if(!T||T.status!=="planned")throw Error("A planned DR drill is required.");let _=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${T.scenario}:${T.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:_.id}),operation:_}}}var lX=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function D5(E){return{"maintenance.upgrade":async(R)=>{let h=E.store.campaign(String(lX(R.operation.input).campaignId??""));if(!h||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let r=E.store.manifest(h.manifestId);if(!r?.compatibility.compatible||r.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let N=r.document.artifacts.find((S)=>S.platform===process.platform&&S.architecture===process.arch)??r.document.artifacts[0];if(!N)throw Error("No update artifact matches this platform.");E.store.updateCampaign(h.id,{status:"running",currentStage:"preflight"});let A=[];try{for(let S of[...new Set(E.store.targets(h.id).map((L)=>L.cohort))].sort((L,t)=>L-t)){E.store.updateCampaign(h.id,{currentStage:`cohort:${S}`});for(let L of E.store.targets(h.id).filter((t)=>t.cohort===S)){R.throwIfCancellationRequested(),R.checkpoint(`download:${L.target}`,"Downloading signed platform artifact."),E.store.updateTarget(L.id,{status:"downloading",startedAt:new Date().toISOString()});let t=await E.platform.download({target:L,artifact:N,signal:R.signal});if(t.sha256!==N.sha256)throw Error(`Artifact checksum mismatch for ${L.target}.`);R.checkpoint(`install:${L.target}`,"Installing verified artifact."),E.store.updateTarget(L.id,{status:"installing"}),await E.platform.install({target:L,path:t.path,version:r.version,signal:R.signal}),A.push(L);let O=await E.platform.health({target:L,gate:h.healthGate});if(!O.healthy)throw Error(`Upgrade health gate failed for ${L.target}.`);E.store.updateTarget(L.id,{status:"healthy",evidence:O.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(h.id,{status:"succeeded",currentStage:void 0}),{campaignId:h.id,version:r.version,targets:A.length}}catch(S){E.store.updateCampaign(h.id,{status:"rolling_back",currentStage:"rollback"});for(let L of A.reverse())E.store.updateTarget(L.id,{status:"rolling_back"}),await E.platform.rollback({target:L,version:L.previousVersion,signal:R.signal}),E.store.updateTarget(L.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(h.id,{status:"rolled_back",currentStage:void 0}),S}},"maintenance.cleanup":async(R)=>{let h=E.store.cleanup(String(lX(R.operation.input).planId??""));if(!h||h.status!=="approved")throw Error("Approved cleanup plan was not found.");if(q$([...h.candidates].sort((L,t)=>L.id.localeCompare(t.id)))!==h.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let r=E.cleanup?.find((L)=>L.kind===h.kind);if(!r)throw Error(`No ${h.kind} cleanup driver is configured.`);E.store.updateCleanup(h.id,{status:"running"});let N=[],A=[];for(let L of h.candidates){R.throwIfCancellationRequested();try{await r.remove(L),N.push(L.id)}catch(t){A.push({id:L.id,error:t instanceof Error?t.message:String(t)})}}let S=A.length?N.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(h.id,{status:S,result:{removed:N,failed:A,reclaimedBytes:h.candidates.filter((L)=>N.includes(L.id)).reduce((L,t)=>L+t.bytes,0)}}),A.length)throw Error(`Cleanup failed for ${A.length} candidate(s).`);return{planId:h.id,removed:N.length,reclaimedBytes:h.estimatedBytes}},"maintenance.drill":async(R)=>{let h=E.store.drill(String(lX(R.operation.input).drillId??""));if(!h)throw Error("DR drill was not found.");let r=E.recovery?.find((t)=>t.scenario===h.scenario);if(!r)throw Error(`No ${h.scenario} recovery driver is configured.`);let N=new Date;E.store.updateDrill(h.id,{status:"restoring",startedAt:N.toISOString()});let A=h.isolatedTarget,S={},L={};try{R.checkpoint("restore","Restoring into isolated drill target.");let t=await r.restore({drill:h,signal:R.signal});if(!t.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");A=t.target,S=t.evidence;let O=(N.getTime()-new Date(t.recoveryPointAt).getTime())/60000;E.store.updateDrill(h.id,{status:"verifying",measuredRpoMinutes:O,evidence:{restore:S}}),R.checkpoint("verify","Running recovery health checks without production traffic.");let U=await r.verify({drill:h,target:A});L=U.evidence;let D=(Date.now()-N.getTime())/60000;if(!U.healthy||O>h.expectedRpoMinutes||D>h.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(h.id,{measuredRpoMinutes:O,measuredRtoMinutes:D,evidence:{restore:S,verify:L}})}catch(t){throw E.store.updateDrill(h.id,{status:"failed",error:t instanceof Error?t.message:String(t),evidence:{restore:S,verify:L}}),t}finally{E.store.updateDrill(h.id,{status:"cleaning"});try{await r.cleanup({drill:h,target:A});let t=E.store.drill(h.id);E.store.updateDrill(h.id,{status:t.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(t){E.store.updateDrill(h.id,{status:"cleanup_required",cleanupVerified:!1,error:t instanceof Error?t.message:String(t),finishedAt:new Date().toISOString()})}}return{drillId:h.id,status:E.store.drill(h.id).status}}}}var I5={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class ot{kind;control;projectId;organizationId;constructor(E,T,_,d){this.kind=E;this.control=T;this.projectId=_;this.organizationId=d}async discover(E){let T=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),_=new Date(Date.now()-T*86400000).toISOString(),d=I5[this.kind],R=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(d.select).all(R,_).map((r)=>({id:String(r.id),kind:this.kind,label:`${this.kind}:${String(r.id)}`,bytes:Number(r.bytes??0),metadata:{createdAt:String(r.created_at)}}))}async remove(E){if(this.control.database.run(I5[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function kb(){let E=await o(),T=lE(process.cwd(),E),_=new st(T.store),d=new pt(_),R=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((h)=>new ot(h,T.store,T.project.id,T.organization.id));return{controlPlane:T,store:_,service:d,cleanup:R}}async function Vh(E){let T=await kb();try{await E(T)}catch(_){Q(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}function iX(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(T)=>Vh((_)=>{let d={manifests:_.store.manifests(_.controlPlane.organization.id),windows:_.store.windows(_.controlPlane.project.id),campaigns:_.store.campaigns(_.controlPlane.project.id),cleanups:_.store.cleanups(_.controlPlane.project.id),drills:_.store.drills(_.controlPlane.project.id)},R=[...d.manifests.map((h)=>["update",h.version,h.compatibility.compatible?"compatible":"blocked",h.compatibility.reasons.join("; ")||h.channel]),...d.campaigns.map((h)=>["upgrade",h.id,h.status,h.currentStage??h.fromVersion]),...d.cleanups.map((h)=>["cleanup",h.kind,h.status,`${h.candidates.length} items / ${h.estimatedBytes} bytes`]),...d.drills.map((h)=>["DR drill",h.scenario,h.status,h.isolatedTarget])];if(T.json)console.log(JSON.stringify(d,null,2));else EE(["Area","Name / version","Status","Detail"],R)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(T,_)=>Vh(async(d)=>{let R=d.store.addTrustedKey({organizationId:d.controlPlane.organization.id,name:T,publicKeyPem:await Bun.file(_).text()});Z(`Trusted ${R.name}: ${R.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(T,_,d)=>Vh(async(R)=>{let h=await Bun.file(T).json(),r=(await Bun.file(_).text()).trim(),N=R.store.importManifest({organizationId:R.controlPlane.organization.id,keyId:d,document:h,signature:r,current:{schemaVersion:R.controlPlane.store.health().schemaVersion,currentVersion:mt,platform:process.platform,architecture:process.arch}});Z(`Verified ${N.version}; ${N.compatibility.compatible?"compatible":"blocked: "+N.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(T,_,d)=>Vh((R)=>{let h=R.store.createWindow({projectId:R.controlPlane.project.id,name:T,schedule:_,timezone:d.timezone,durationMinutes:Number(d.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});Z(`Created ${h.name} (${h.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(T,_,d)=>Vh((R)=>{let h=new nR(R.controlPlane.store).list(R.controlPlane.project.id).filter((A)=>A.status==="ready").map((A)=>({serverId:A.id,target:A.name,previousVersion:A.bootstrapVersion??mt}));if(!h.length)h.push({target:"control-plane",previousVersion:mt});let r=R.store.createCampaign({projectId:R.controlPlane.project.id,manifestId:T,fromVersion:mt,strategy:d.strategy==="rolling"?"rolling":"canary",batchSize:Number(d.batch),healthGate:{kind:"platform"},backupId:_,targets:h}),N=R.service.enqueueCampaign(r.id);Z(`Staged upgrade queued: ${N.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(T,_)=>Vh(async(d)=>{let R=await d.service.previewCleanup({projectId:d.controlPlane.project.id,kind:T,criteria:{olderThanDays:Number(_.olderThan)}},d.cleanup);EE(["ID","Candidate","Bytes"],R.candidates.map((h)=>[h.id,h.label,String(h.bytes)])),$(`Apply with: cloud cleanup:apply ${R.id} --confirm "DELETE ${R.candidates.length} ${R.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(T,_)=>Vh((d)=>{let R=d.service.enqueueCleanup(T,String(_.confirm??""));Z(`Cleanup queued: ${R.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(T,_,d)=>Vh((R)=>{let h=R.store.createDrill({projectId:R.controlPlane.project.id,scenario:T,isolatedTarget:_,expectedRpoMinutes:Number(d.rpo),expectedRtoMinutes:Number(d.rto),recoveryPointId:d.recoveryPoint,topologyId:d.topology});Z(`Planned isolated drill ${h.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(T)=>Vh((_)=>{let d=_.service.enqueueDrill(T);Z(`DR drill queued: ${d.operation.id}`)}))}ME();xr();Bd();async function mX(){try{return(await o()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function aX(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(T)=>{b("Lambda Functions");let _=T?.region||await mX(),d=new jT(_);try{let{Functions:R=[]}=await d.listFunctions({MaxItems:50});if(!R.length){$("No functions found");return}EE(["Name","Runtime","Memory","Timeout","Last Modified"],R.map((h)=>[h.FunctionName??"-",h.Runtime??"-",h.MemorySize?`${h.MemorySize} MB`:"-",h.Timeout?`${h.Timeout}s`:"-",h.LastModified??"-"]))}catch(R){Q(`Failed to list functions: ${R.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(T,_)=>{b(`Invoking ${T}`);let d=_?.region||await mX(),R=new jT(d),h=new n("Invoking function...");h.start();try{let r=await R.invoke({FunctionName:T,InvocationType:_?.async?"Event":"RequestResponse",Payload:_?.payload||"{}",LogType:_?.async?"None":"Tail"});if(r.FunctionError){if(h.fail(`Function returned an error (${r.FunctionError})`),r.Payload)$(r.Payload);process.exitCode=1;return}if(h.succeed(`Invoked (status ${r.StatusCode})`),r.Payload)$(`
 Response:`),$(r.Payload);if(r.LogResult)$(`
 Logs:`),$(Buffer.from(r.LogResult,"base64").toString("utf-8"))}catch(r){h.fail(`Invocation failed: ${r.message}`),process.exitCode=1}}),E.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(T,_)=>{b(`Logs for ${T}`);let d=_?.region||await mX(),R=new Sd(d),h=T.startsWith("/aws/lambda/")?T:`/aws/lambda/${T}`,r=Number(_?.since??15),N=(A)=>{for(let S of A){let L=S.timestamp?new Date(S.timestamp).toISOString():"";$(`${L}  ${(S.message??"").trimEnd()}`)}};try{let A=Date.now()-r*60000,{events:S=[]}=await R.filterLogEvents({logGroupName:h,startTime:A,filterPattern:_?.filter,limit:200});if(N(S),S.length)A=(S[S.length-1].timestamp??A)+1;if(_?.tail){$(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise((t)=>setTimeout(t,3000));let{events:L=[]}=await R.filterLogEvents({logGroupName:h,startTime:A,filterPattern:_?.filter,limit:200});if(L.length)N(L),A=(L[L.length-1].timestamp??A)+1}}}catch(A){Q(`Failed to read logs: ${A.message}`),process.exitCode=1}})}ME();async function w5(E){let T=Bun.spawn(["docker",...E],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[_,d]=await Promise.all([T.exited,new Response(T.stderr).text()]);return{ok:_===0,exitCode:_,command:["docker",...E].join(" "),stderr:d.trim()}}function sX(E){E.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(T)=>{let _=["build","--file",T.file??"Dockerfile","--tag",T.tag??"latest","."];if(T.dryRun){console.log(`docker ${_.join(" ")}`);return}let d=await w5(_);if(T.json)console.log(JSON.stringify(d));if(!d.ok)Q(d.stderr||`docker exited ${d.exitCode}`),process.exitCode=d.exitCode;else Z(`Built ${T.tag??"latest"}.`)}),E.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(T)=>{if(!T.image){Q("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(T.dryRun){console.log(`docker push ${T.image}`);return}let _=await w5(["push",T.image]);if(T.json)console.log(JSON.stringify(_));if(!_.ok)Q(_.stderr),process.exitCode=_.exitCode;else Z(`Pushed ${T.image}.`)}),E.command("container:deploy","Deploy a container image").action(async()=>ld("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}ME();Bh();gR();function pX(E){E.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(T)=>{b("Domains");try{let _=bR(T?.provider),d=jd(T?.provider)?.provider||"unknown",R=new n(`Fetching domains from ${d}...`);R.start();let h=await _.listDomains();if(R.succeed(`Found ${h.length} domain(s)`),h.length===0){$("No domains found in this provider");return}let r=h.map((N)=>[N,"Active","-",d.charAt(0).toUpperCase()+d.slice(1)]);EE(["Domain","Status","SSL","Provider"],r)}catch(_){Q(`Failed to list domains: ${_ instanceof Error?_.message:String(_)}`)}}),E.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(T,_)=>{b(`Adding Domain: ${T}`);try{let d=bR(_?.provider),R=jd(_?.provider)?.provider||"unknown",h=new n(`Checking if ${R} can manage ${T}...`);if(h.start(),await d.canManageDomain(T))h.succeed(`Domain ${T} is already available in ${R}`),$(`
@@ -9706,10 +9706,10 @@ Invalidation is in progress. Use --wait to wait for completion.`)}catch(_){Q(`In
       (id, organization_id, project_id, environment_id, operation_id, policy_id, policy_version, outcome, scanner_versions, finding_ids, waiver_ids, explanation, created_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[W,E.organizationId,E.projectId,E.environmentId,E.operationId??null,_.id,_.version,z,zR(w),zR([...r,...N].map((e)=>e.id)),zR([...R.values()].map((e)=>e.id)),j.join("; "),G]),this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,operationId:E.operationId,type:"security.deploy.decision",level:z==="block"?"error":z==="warn"?"warning":"info",payload:{decisionId:W,outcome:z,policyId:_.id,policyVersion:_.version,scannerVersions:w,blockerIds:r.map((e)=>e.id),waiverIds:[...R.values()].map((e)=>e.id),explanation:j.join("; ")}}),this.getDecision(W)}getDecision(E){let T=this.controlPlane.database.query("SELECT * FROM security_deploy_decisions WHERE id = ?").get(E);return T?tG(T):void 0}listDecisions(E,T=100){return this.controlPlane.database.query("SELECT * FROM security_deploy_decisions WHERE environment_id = ? ORDER BY created_at DESC LIMIT ?").all(E,Math.min(500,Math.max(1,T))).map(tG)}addReleaseArtifact(E){let T=this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? AND kind = ? AND digest = ?").get(E.releaseId,E.kind,E.digest);if(T)return lJ(T);let _=this.idFn(),d=this.now();return this.run(`INSERT INTO release_security_artifacts
       (id, organization_id, project_id, environment_id, release_id, kind, format, digest, summary, content, sensitive, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[_,E.organizationId,E.projectId,E.environmentId??null,E.releaseId,E.kind,E.format,E.digest,zR(E.summary),E.content??null,E.sensitive?1:0,d]),this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,type:"security.release_artifact.created",payload:{artifactId:_,releaseId:E.releaseId,kind:E.kind,format:E.format,digest:E.digest,sensitive:E.sensitive}}),lJ(this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE id = ?").get(_))}listReleaseArtifacts(E,T=!1){return this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? ORDER BY created_at, kind").all(E).map(lJ).map((_)=>_.sensitive&&!T?{..._,content:void 0}:_)}summary(E,T,_){let d=this.listFindings({organizationId:E,projectId:T,environmentId:_,limit:1000}),R=this.listScanRuns({organizationId:E,projectId:T,environmentId:_,limit:1000}),h={info:0,low:0,medium:0,high:0,critical:0};for(let N of d)if(N.status==="open"||N.status==="acknowledged")h[N.severity]++;let r={passed:0,failed:0,skipped:0,unavailable:0,unsupported:0,stale:0};for(let N of R)r[N.status]++;return{open:h,waived:d.filter((N)=>N.status==="waived").length,resolved:d.filter((N)=>N.status==="resolved").length,checks:r,lastScannedAt:R[0]?.completedAt}}exportPosture(E){let T=this.controlPlane.listProjects().filter((_)=>_.organizationId===E);return xE({format:"ts-cloud-security-posture",version:1,exportedAt:this.now(),organizationId:E,policies:this.listPolicies(E),findings:this.listFindings({organizationId:E,limit:1000}),waivers:this.listWaivers().filter((_)=>this.getFinding(_.findingId)?.organizationId===E),scans:T.flatMap((_)=>this.listScanRuns({organizationId:E,projectId:_.id,limit:1000})),decisions:T.flatMap((_)=>this.controlPlane.listEnvironments(_.id).flatMap((d)=>this.listDecisions(d.id,1000)))})}}yA();NA();import{existsSync as Fn,readdirSync as zn,readFileSync as jn,statSync as Bn}from"node:fs";import{extname as Wn,join as Hn,relative as yn}from"node:path";var $G=[{name:"AWS Access Key ID",pattern:/(?:^|[^A-Z0-9])((AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16})(?:[^A-Z0-9]|$)/g,severity:"critical",description:"AWS Access Key ID detected"},{name:"AWS Secret Access Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key|secretAccessKey)['"]?\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,severity:"critical",description:"AWS Secret Access Key detected"},{name:"AWS Secret Key (Generic)",pattern:/(?:^|['"`:=\s])([A-Za-z0-9/+=]{40})(?:['"`\s]|$)/g,severity:"high",description:"Potential AWS Secret Key (40-char base64)"},{name:"Generic API Key",pattern:/(?:api[_-]?key|apikey|api[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9_\-]{20,})['"]?/gi,severity:"high",description:"Generic API key detected"},{name:"RSA Private Key",pattern:/-----BEGIN RSA PRIVATE KEY-----/g,severity:"critical",description:"RSA private key detected"},{name:"OpenSSH Private Key",pattern:/-----BEGIN OPENSSH PRIVATE KEY-----/g,severity:"critical",description:"OpenSSH private key detected"},{name:"EC Private Key",pattern:/-----BEGIN EC PRIVATE KEY-----/g,severity:"critical",description:"EC private key detected"},{name:"PGP Private Key",pattern:/-----BEGIN PGP PRIVATE KEY BLOCK-----/g,severity:"critical",description:"PGP private key detected"},{name:"GitHub Token",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"critical",description:"GitHub personal access token detected"},{name:"GitHub OAuth",pattern:/github[_-]?oauth[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9_]{40})['"]?/gi,severity:"critical",description:"GitHub OAuth token detected"},{name:"Slack Token",pattern:/xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*/g,severity:"critical",description:"Slack token detected"},{name:"Slack Webhook",pattern:/https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g,severity:"high",description:"Slack webhook URL detected"},{name:"Discord Webhook",pattern:/https:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]+/g,severity:"high",description:"Discord webhook URL detected"},{name:"JWT Token",pattern:/eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,severity:"high",description:"JWT token detected"},{name:"Google API Key",pattern:/AIza[0-9A-Za-z_-]{35}/g,severity:"critical",description:"Google API key detected"},{name:"Google OAuth ID",pattern:/[0-9]+-[A-Za-z0-9_]{32}\.apps\.googleusercontent\.com/g,severity:"high",description:"Google OAuth client ID detected"},{name:"Firebase API Key",pattern:/(?:firebase[_-]?api[_-]?key)\s*[=:]\s*['"]?([A-Za-z0-9_-]{39})['"]?/gi,severity:"critical",description:"Firebase API key detected"},{name:"Cloudflare API Token",pattern:/(?:cloudflare[_-]?api[_-]?token|cf[_-]?api[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{40})['"]?/gi,severity:"critical",description:"Cloudflare API token detected"},{name:"Azure Client Secret",pattern:/(?:azure[_-]?client[_-]?secret|client[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9~._-]{34,})['"]?/gi,severity:"critical",description:"Azure client secret detected"},{name:"Heroku API Key",pattern:/(?:heroku[_-]?api[_-]?key)\s*[=:]\s*['"]?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]?/gi,severity:"critical",description:"Heroku API key detected"},{name:"Database Connection String",pattern:/(?:mysql|postgres|postgresql|mongodb|redis|mongodb\+srv):\/\/[^:]+:[^@]+@[^/\s]+/gi,severity:"critical",description:"Database connection string with credentials detected"},{name:"Database Password",pattern:/(?:db[_-]?password|database[_-]?password|mysql[_-]?password|postgres[_-]?password)\s*[=:]\s*['"]?([^'"\s]{8,})['"]?/gi,severity:"critical",description:"Database password detected"},{name:"Stripe API Key",pattern:/(?:sk|pk)_(?:test|live)_[0-9a-zA-Z]{24,}/g,severity:"critical",description:"Stripe API key detected"},{name:"PayPal Client ID",pattern:/(?:paypal[_-]?client[_-]?id)\s*[=:]\s*['"]?([A-Za-z0-9_-]{80})['"]?/gi,severity:"high",description:"PayPal client ID detected"},{name:"Square Access Token",pattern:/sq0[a-z]{3}-[0-9A-Za-z_-]{22,}/g,severity:"critical",description:"Square access token detected"},{name:"Twilio API Key",pattern:/SK[a-f0-9]{32}/g,severity:"critical",description:"Twilio API key detected"},{name:"SendGrid API Key",pattern:/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,severity:"critical",description:"SendGrid API key detected"},{name:"Mailgun API Key",pattern:/key-[0-9a-zA-Z]{32}/g,severity:"critical",description:"Mailgun API key detected"},{name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"]([^'"]{8,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded password detected"},{name:"Secret/Token Assignment",pattern:/(?:secret|token|auth[_-]?token|access[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9_\-/+=]{16,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded secret or token detected"},{name:"NPM Token",pattern:/(?:npm[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{36})['"]?/gi,severity:"critical",description:"NPM token detected"},{name:"SSH Private Key Path Exposed",pattern:/~\/\.ssh\/id_[a-z]+|\/home\/[^/]+\/\.ssh\/id_[a-z]+/g,severity:"medium",description:"SSH private key path exposed"},{name:"Env Variable with Secret",pattern:/(?:process\.env\.)((?=[A-Z_]*(?:SECRET|KEY|TOKEN|PASSWORD|CREDENTIAL|AUTH))[A-Z_]+)\s*(?:===?\s*['"]([^'"]+)['"])?/g,severity:"medium",description:"Environment variable containing secret may be exposed"}],Yn=[".js",".jsx",".ts",".tsx",".mjs",".cjs",".vue",".svelte",".html",".htm",".css",".scss",".less",".json",".yaml",".yml",".toml",".xml",".env",".config",".conf"],en=["node_modules",".git",".svn",".hg","dist","build","coverage",".nyc_output","__pycache__",".pytest_cache","vendor",".idea",".vscode",".turbo",".next",".nuxt","pantry",".pantry","tests","test","__tests__","spec","__mocks__",".github",".gitlab",".circleci"],Gn=["package-lock.json","yarn.lock","pnpm-lock.yaml","bun.lockb","bun.lock","*.min.js","*.min.css","*.map","*.d.ts","*.test.ts","*.test.js","*.spec.ts","*.spec.js",".env",".env.*"];class dL{patterns;excludeDirs;excludeFiles;maxFileSize;constructor(E){this.patterns=[...$G,...E?.customPatterns||[]],this.excludeDirs=[...en,...E?.excludeDirs||[]],this.excludeFiles=[...Gn,...E?.excludeFiles||[]],this.maxFileSize=E?.maxFileSize||1048576}async scan(E){let T=Date.now(),_=[],d=0,{directory:R,exclude:h=[],include:r,skipPatterns:N=[]}=E,A=E.failOnSeverity||"critical";if(!Fn(R))throw Error(`Directory not found: ${R}`);let S=this.getFilesToScan(R,[...this.excludeDirs,...h],r);for(let D of S){let C=yn(R,D);if(this.shouldExcludeFile(C))continue;try{if(Bn(D).size>this.maxFileSize)continue;let c=jn(D,"utf-8"),z=this.scanContent(c,C,N);_.push(...z),d++}catch{continue}}let L={critical:_.filter((D)=>D.pattern.severity==="critical").length,high:_.filter((D)=>D.pattern.severity==="high").length,medium:_.filter((D)=>D.pattern.severity==="medium").length,low:_.filter((D)=>D.pattern.severity==="low").length},t=["low","medium","high","critical"],O=t.indexOf(A),U=!0;for(let D=O;D<t.length;D++)if(L[t[D]]>0){U=!1;break}return{passed:U,findings:_,scannedFiles:d,duration:Date.now()-T,summary:L}}scanContent(E,T,_){let d=[],R=E.split(`
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[_,E.organizationId,E.projectId,E.environmentId??null,E.releaseId,E.kind,E.format,E.digest,zR(E.summary),E.content??null,E.sensitive?1:0,d]),this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,type:"security.release_artifact.created",payload:{artifactId:_,releaseId:E.releaseId,kind:E.kind,format:E.format,digest:E.digest,sensitive:E.sensitive}}),lJ(this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE id = ?").get(_))}listReleaseArtifacts(E,T=!1){return this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? ORDER BY created_at, kind").all(E).map(lJ).map((_)=>_.sensitive&&!T?{..._,content:void 0}:_)}summary(E,T,_){let d=this.listFindings({organizationId:E,projectId:T,environmentId:_,limit:1000}),R=this.listScanRuns({organizationId:E,projectId:T,environmentId:_,limit:1000}),h={info:0,low:0,medium:0,high:0,critical:0};for(let N of d)if(N.status==="open"||N.status==="acknowledged")h[N.severity]++;let r={passed:0,failed:0,skipped:0,unavailable:0,unsupported:0,stale:0};for(let N of R)r[N.status]++;return{open:h,waived:d.filter((N)=>N.status==="waived").length,resolved:d.filter((N)=>N.status==="resolved").length,checks:r,lastScannedAt:R[0]?.completedAt}}exportPosture(E){let T=this.controlPlane.listProjects().filter((_)=>_.organizationId===E);return xE({format:"ts-cloud-security-posture",version:1,exportedAt:this.now(),organizationId:E,policies:this.listPolicies(E),findings:this.listFindings({organizationId:E,limit:1000}),waivers:this.listWaivers().filter((_)=>this.getFinding(_.findingId)?.organizationId===E),scans:T.flatMap((_)=>this.listScanRuns({organizationId:E,projectId:_.id,limit:1000})),decisions:T.flatMap((_)=>this.controlPlane.listEnvironments(_.id).flatMap((d)=>this.listDecisions(d.id,1000)))})}}yA();NA();import{existsSync as Fn,readdirSync as zn,readFileSync as jn,statSync as Bn}from"node:fs";import{extname as Wn,join as Hn,relative as yn}from"node:path";var $G=[{name:"AWS Access Key ID",pattern:/(?:^|[^A-Z0-9])((AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16})(?:[^A-Z0-9]|$)/g,severity:"critical",description:"AWS Access Key ID detected"},{name:"AWS Secret Access Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key|secretAccessKey)['"]?\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,severity:"critical",description:"AWS Secret Access Key detected"},{name:"AWS Secret Key (Generic)",pattern:/(?:^|['"`:=\s])([A-Za-z0-9/+=]{40})(?:['"`\s]|$)/g,severity:"high",description:"Potential AWS Secret Key (40-char base64)"},{name:"Generic API Key",pattern:/(?:api[_-]?key|apikey|api[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9_\-]{20,})['"]?/gi,severity:"high",description:"Generic API key detected"},{name:"RSA Private Key",pattern:/-----BEGIN RSA PRIVATE KEY-----/g,severity:"critical",description:"RSA private key detected"},{name:"OpenSSH Private Key",pattern:/-----BEGIN OPENSSH PRIVATE KEY-----/g,severity:"critical",description:"OpenSSH private key detected"},{name:"EC Private Key",pattern:/-----BEGIN EC PRIVATE KEY-----/g,severity:"critical",description:"EC private key detected"},{name:"PGP Private Key",pattern:/-----BEGIN PGP PRIVATE KEY BLOCK-----/g,severity:"critical",description:"PGP private key detected"},{name:"GitHub Token",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"critical",description:"GitHub personal access token detected"},{name:"GitHub OAuth",pattern:/github[_-]?oauth[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9_]{40})['"]?/gi,severity:"critical",description:"GitHub OAuth token detected"},{name:"Slack Token",pattern:/xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*/g,severity:"critical",description:"Slack token detected"},{name:"Slack Webhook",pattern:/https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g,severity:"high",description:"Slack webhook URL detected"},{name:"Discord Webhook",pattern:/https:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]+/g,severity:"high",description:"Discord webhook URL detected"},{name:"JWT Token",pattern:/eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,severity:"high",description:"JWT token detected"},{name:"Google API Key",pattern:/AIza[0-9A-Za-z_-]{35}/g,severity:"critical",description:"Google API key detected"},{name:"Google OAuth ID",pattern:/[0-9]+-[A-Za-z0-9_]{32}\.apps\.googleusercontent\.com/g,severity:"high",description:"Google OAuth client ID detected"},{name:"Firebase API Key",pattern:/(?:firebase[_-]?api[_-]?key)\s*[=:]\s*['"]?([A-Za-z0-9_-]{39})['"]?/gi,severity:"critical",description:"Firebase API key detected"},{name:"Cloudflare API Token",pattern:/(?:cloudflare[_-]?api[_-]?token|cf[_-]?api[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{40})['"]?/gi,severity:"critical",description:"Cloudflare API token detected"},{name:"Azure Client Secret",pattern:/(?:azure[_-]?client[_-]?secret|client[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9~._-]{34,})['"]?/gi,severity:"critical",description:"Azure client secret detected"},{name:"Heroku API Key",pattern:/(?:heroku[_-]?api[_-]?key)\s*[=:]\s*['"]?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]?/gi,severity:"critical",description:"Heroku API key detected"},{name:"Database Connection String",pattern:/(?:mysql|postgres|postgresql|mongodb|redis|mongodb\+srv):\/\/[^:]+:[^@]+@[^/\s]+/gi,severity:"critical",description:"Database connection string with credentials detected"},{name:"Database Password",pattern:/(?:db[_-]?password|database[_-]?password|mysql[_-]?password|postgres[_-]?password)\s*[=:]\s*['"]?([^'"\s]{8,})['"]?/gi,severity:"critical",description:"Database password detected"},{name:"Stripe API Key",pattern:/(?:sk|pk)_(?:test|live)_[0-9a-zA-Z]{24,}/g,severity:"critical",description:"Stripe API key detected"},{name:"PayPal Client ID",pattern:/(?:paypal[_-]?client[_-]?id)\s*[=:]\s*['"]?([A-Za-z0-9_-]{80})['"]?/gi,severity:"high",description:"PayPal client ID detected"},{name:"Square Access Token",pattern:/sq0[a-z]{3}-[0-9A-Za-z_-]{22,}/g,severity:"critical",description:"Square access token detected"},{name:"Twilio API Key",pattern:/SK[a-f0-9]{32}/g,severity:"critical",description:"Twilio API key detected"},{name:"SendGrid API Key",pattern:/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,severity:"critical",description:"SendGrid API key detected"},{name:"Mailgun API Key",pattern:/key-[0-9a-zA-Z]{32}/g,severity:"critical",description:"Mailgun API key detected"},{name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"]([^'"]{8,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded password detected"},{name:"Secret/Token Assignment",pattern:/(?:secret|token|auth[_-]?token|access[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9_\-/+=]{16,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded secret or token detected"},{name:"NPM Token",pattern:/(?:npm[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{36})['"]?/gi,severity:"critical",description:"NPM token detected"},{name:"SSH Private Key Path Exposed",pattern:/~\/\.ssh\/id_[a-z]+|\/home\/[^/]+\/\.ssh\/id_[a-z]+/g,severity:"medium",description:"SSH private key path exposed"},{name:"Env Variable with Secret",pattern:/(?:process\.env\.)((?=[A-Z_]*(?:SECRET|KEY|TOKEN|PASSWORD|CREDENTIAL|AUTH))[A-Z_]+)\s*(?:===?\s*['"]([^'"]+)['"])?/g,severity:"medium",description:"Environment variable containing secret may be exposed"}],Yn=[".js",".jsx",".ts",".tsx",".mjs",".cjs",".vue",".svelte",".html",".htm",".css",".scss",".less",".json",".yaml",".yml",".toml",".xml",".env",".config",".conf"],en=["node_modules",".git",".svn",".hg","dist","build","coverage",".nyc_output","__pycache__",".pytest_cache","vendor",".idea",".vscode",".turbo",".next",".nuxt","framework.bak","pantry",".pantry","tests","test","__tests__","spec","__mocks__",".github",".gitlab",".circleci"],Gn=["package-lock.json","yarn.lock","pnpm-lock.yaml","bun.lockb","bun.lock","*.min.js","*.min.css","*.map","*.d.ts","*.test.ts","*.test.js","*.spec.ts","*.spec.js",".env",".env.*"];class dL{patterns;excludeDirs;excludeFiles;maxFileSize;constructor(E){this.patterns=[...$G,...E?.customPatterns||[]],this.excludeDirs=[...en,...E?.excludeDirs||[]],this.excludeFiles=[...Gn,...E?.excludeFiles||[]],this.maxFileSize=E?.maxFileSize||1048576}async scan(E){let T=Date.now(),_=[],d=0,{directory:R,exclude:h=[],include:r,skipPatterns:N=[]}=E,A=E.failOnSeverity||"critical";if(!Fn(R))throw Error(`Directory not found: ${R}`);let S=this.getFilesToScan(R,[...this.excludeDirs,...h],r);for(let D of S){let C=yn(R,D);if(this.shouldExcludeFile(C))continue;try{if(Bn(D).size>this.maxFileSize)continue;let c=jn(D,"utf-8"),z=this.scanContent(c,C,N);_.push(...z),d++}catch{continue}}let L={critical:_.filter((D)=>D.pattern.severity==="critical").length,high:_.filter((D)=>D.pattern.severity==="high").length,medium:_.filter((D)=>D.pattern.severity==="medium").length,low:_.filter((D)=>D.pattern.severity==="low").length},t=["low","medium","high","critical"],O=t.indexOf(A),U=!0;for(let D=O;D<t.length;D++)if(L[t[D]]>0){U=!1;break}return{passed:U,findings:_,scannedFiles:d,duration:Date.now()-T,summary:L}}scanContent(E,T,_){let d=[],R=E.split(`
 `);for(let h of this.patterns){if(_.includes(h.name))continue;h.pattern.lastIndex=0;let r;while((r=h.pattern.exec(E))!==null){let N=E.substring(0,r.index),A=N.split(`
 `).length,S=N.lastIndexOf(`
-`),L=r.index-S,t=R[A-1]||"";if(this.isLikelyPlaceholder(r[0],t))continue;let O=r[1]||r[0];if(h.name==="AWS Secret Key (Generic)"&&/^[a-f0-9]{40}$/i.test(O))continue;if(h.name==="AWS Secret Key (Generic)"&&!this.hasSecretCharacterDiversity(O))continue;if(h.name==="AWS Secret Key (Generic)"&&/^(?:Actions|Commands|Controllers|Handlers|Jobs|Listeners|Middleware|Models|Resources|Services)\//.test(O))continue;if(this.isLowEntropy(O))continue;d.push({file:T,line:A,column:L,match:this.maskSecret(r[0]),pattern:h,context:this.maskSecret(t.trim())})}}return d}isLikelyPlaceholder(E,T){let _=["example","placeholder","your_","YOUR_","xxx","XXX","***","test","TEST","dummy","DUMMY","fake","FAKE","sample","SAMPLE","<your","${","{{","process.env","import.meta.env","CHANGEME","TODO","FIXME"],d=E.toLowerCase(),R=T.toLowerCase();for(let r of _)if(d.includes(r.toLowerCase())||R.includes(r.toLowerCase()))return!0;let h=T.trim();if(h.startsWith("//")||h.startsWith("#")||h.startsWith("*")||h.startsWith("/*")){if(R.includes("example")||R.includes("format:")||R.includes("e.g."))return!0}return!1}isLowEntropy(E){if(E.length<8)return!1;if(new Set(E).size<8)return!0;if(/(.)\1{3,}/.test(E))return!0;return!1}hasSecretCharacterDiversity(E){return[/[a-z]/.test(E),/[A-Z]/.test(E),/\d/.test(E),/[/+=]/.test(E)].filter(Boolean).length>=3}maskSecret(E){if(E.length<=8)return"*".repeat(E.length);let T=Math.min(4,Math.floor(E.length*0.2));return E.substring(0,T)+"*".repeat(E.length-T*2)+E.substring(E.length-T)}getFilesToScan(E,T,_){let d=[],R=_||Yn,h=(r)=>{let N=zn(r,{withFileTypes:!0});for(let A of N){let S=Hn(r,A.name);if(A.isDirectory()){if(!T.includes(A.name))h(S)}else if(A.isFile()){let L=Wn(A.name).toLowerCase();if(R.includes(L)||A.name.startsWith(".env")||A.name.endsWith(".config"))d.push(S)}}};return h(E),d}shouldExcludeFile(E){let T=E.split("/").pop()||"";for(let _ of this.excludeFiles)if(_.startsWith("*")){let d=_.substring(1);if(T.endsWith(d))return!0}else if(_.endsWith("*")){let d=_.substring(0,_.length-1);if(T.startsWith(d))return!0}else if(T===_)return!0;return!1}addPattern(E){this.patterns.push(E)}getPatterns(){return[...this.patterns]}}function Qn(E,T){return{status:"unavailable",findings:[],error:`${E.id} exceeded its ${T}ms timeout`,metadata:{timeoutMs:T}}}class AA{posture;defaultTimeoutMs;nowFn;constructor(E,T={}){this.posture=E;this.defaultTimeoutMs=T.defaultTimeoutMs??60000,this.nowFn=T.now??(()=>new Date)}async run(E,T){let _=this.nowFn(),d=Math.max(100,E.timeoutMs??this.defaultTimeoutMs),R=new AbortController,h,r=new Promise((L)=>{h=setTimeout(()=>{R.abort(),L(Qn(E,d))},d)}),N;try{N=await Promise.race([E.scan({...T,signal:R.signal}),r])}catch(L){N={status:"unavailable",findings:[],error:L instanceof Error?L.message:String(L)}}finally{if(h)clearTimeout(h)}let A=this.nowFn(),S={...T,scannerId:E.id,scannerVersion:E.version,status:N.status,findings:N.findings,metadata:N.metadata,error:N.error,startedAt:_.toISOString(),completedAt:A.toISOString(),durationMs:Math.max(0,A.getTime()-_.getTime())};return this.posture.recordScan(S)}async runAll(E,T){return Promise.all(E.map((_)=>this.run(_,T)))}}class n0{scanner;id="source-secrets";version="1.0.0";timeoutMs=30000;constructor(E=new dL){this.scanner=E}async scan(E){if(!E.artifactRoot)return{status:"skipped",findings:[],error:"No artifact root was supplied"};let T=await this.scanner.scan({directory:E.artifactRoot,failOnSeverity:"critical"});return{status:T.passed?"passed":"failed",findings:T.findings.map((_)=>({...E,ruleId:_.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:_.pattern.severity,title:_.pattern.name,description:_.pattern.description,subject:`${_.file}:${_.line}`,evidence:{file:_.file,line:_.line,column:_.column,match:_.match,context:_.context},remediation:"Remove the credential, rotate it at its issuer, and use a managed secret or environment reference."})),metadata:{scannedFiles:T.scannedFiles,summary:T.summary}}}}function Mn(E){let T=E?.toLowerCase();return T==="critical"||T==="high"||T==="medium"||T==="low"?T:"info"}class aJ{id="trivy-image";version;timeoutMs;constructor(E={}){this.version=E.version??"local",this.timeoutMs=E.timeoutMs??120000,this.executable=E.executable??"trivy"}executable;async scan(E){if(!E.imageRef)return{status:"skipped",findings:[],error:"No image reference was supplied"};let T;try{T=Bun.spawn([this.executable,"image","--format","json","--quiet","--scanners","vuln",E.imageRef],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",TRIVY_NO_PROGRESS:"true"}})}catch(A){return{status:"unsupported",findings:[],error:A instanceof Error?A.message:String(A)}}let _=()=>T.kill();E.signal.addEventListener("abort",_,{once:!0});let[d,R,h]=await Promise.all([T.exited,new Response(T.stdout).text(),new Response(T.stderr).text()]);if(E.signal.removeEventListener("abort",_),d!==0)return{status:/not found|enoent/i.test(h)?"unsupported":"unavailable",findings:[],error:h.slice(0,2000)||`Trivy exited with ${d}`};let r=JSON.parse(R),N=[];for(let A of r.Results??[])for(let S of A.Vulnerabilities??[]){let L=S.VulnerabilityID??"unknown-vulnerability";N.push({...E,ruleId:L,severity:Mn(S.Severity),title:S.Title||L,description:S.Description||`${L} affects ${S.PkgName??"an image package"}.`,subject:`${E.imageRef}:${S.PkgName??"unknown"}:${S.InstalledVersion??"unknown"}`,evidence:{image:E.imageRef,target:A.Target??"",cve:L,package:S.PkgName??"",installedVersion:S.InstalledVersion??"",fixedVersion:S.FixedVersion??"",reference:S.PrimaryURL??""},remediation:S.FixedVersion?`Upgrade ${S.PkgName} to ${S.FixedVersion} or later.`:"Remove or replace the affected package and rescan the image."})}return{status:N.length?"failed":"passed",findings:N,metadata:{imageRef:E.imageRef,vulnerabilityCount:N.length,localOnly:!0}}}}import{createHash as Vn,createVerify as h$E}from"node:crypto";import{existsSync as Kn,readFileSync as fn}from"node:fs";import{basename as Pn,join as Zn,resolve as DG}from"node:path";function l0(E){return Vn("sha256").update(E).digest("hex")}function qn(E){let T=[["dependencies","required"],["optionalDependencies","optional"],["devDependencies","excluded"],["peerDependencies","required"]],_=new Map;for(let[d,R]of T){let h=E[d];if(!h||typeof h!=="object"||Array.isArray(h))continue;for(let[r,N]of Object.entries(h)){let A=String(N).replace(/^[~^]/,""),S=`${r}@${A}`;if(!_.has(S))_.set(S,{type:"library",name:r,version:A,purl:`pkg:npm/${encodeURIComponent(r)}@${encodeURIComponent(A)}`,scope:R})}}return[..._.values()].sort((d,R)=>`${d.name}@${d.version}`.localeCompare(`${R.name}@${R.version}`))}function IG(E,T={}){let _=Zn(DG(E),"package.json");if(!Kn(_))throw Error(`Cannot generate an SBOM: ${_} was not found`);let d=fn(_,"utf8"),R=JSON.parse(d),h=String(R.name??Pn(DG(E))),r=String(R.version??"0.0.0"),N=l0(d);return{bomFormat:"CycloneDX",specVersion:"1.5",serialNumber:T.serial??`urn:uuid:${crypto.randomUUID()}`,version:1,metadata:{timestamp:(T.now??new Date).toISOString(),component:{type:"application",name:h,version:r,purl:`pkg:npm/${encodeURIComponent(h)}@${encodeURIComponent(r)}`,hashes:[{alg:"SHA-256",content:N}]},tools:[{vendor:"ts-cloud",name:"security-posture",version:"1.0.0"}]},components:qn(R)}}async function CG(E,T={}){let _=Bun.spawn([T.executable??"syft",E,"-o","cyclonedx-json"],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",SYFT_CHECK_FOR_APP_UPDATE:"false"}}),d=()=>_.kill();T.signal?.addEventListener("abort",d,{once:!0});let[R,h,r]=await Promise.all([_.exited,new Response(_.stdout).text(),new Response(_.stderr).text()]);if(T.signal?.removeEventListener("abort",d),R!==0)throw Error(r.slice(0,2000)||`Syft exited with ${R}`);return JSON.parse(h)}function sJ(E,T,_){let d=JSON.stringify(_);return E.addReleaseArtifact({...T,kind:"sbom",format:`cyclonedx-${_.specVersion}+json`,digest:`sha256:${l0(d)}`,summary:{component:_.metadata.component.name,version:_.metadata.component.version,components:_.components.length},content:d,sensitive:!0})}function wG(E,T,_){let d={total:_.length,critical:0,high:0,medium:0,low:0,info:0,fixable:0};for(let h of _){d[h.severity]++;let r=h.evidence;if(typeof r.fixedVersion==="string"&&r.fixedVersion)d.fixable++}let R=JSON.stringify({releaseId:T.releaseId,generatedAt:new Date().toISOString(),findings:_.map((h)=>({id:h.id,ruleId:h.ruleId,severity:h.severity,subject:h.subject,remediation:h.remediation}))});return E.addReleaseArtifact({...T,kind:"vulnerability_summary",format:"ts-cloud-vulnerability-summary+json",digest:`sha256:${l0(R)}`,summary:d,content:R,sensitive:!0})}function cG(E){if(!E.artifact&&!E.artifactSha256)throw Error("Release provenance requires artifact content or a SHA-256 digest");return{_type:"https://in-toto.io/Statement/v1",subject:[{name:E.artifactName,digest:{sha256:E.artifactSha256?.replace(/^sha256:/,"")??l0(E.artifact)}}],predicateType:"https://slsa.dev/provenance/v1",predicate:{buildDefinition:{buildType:"https://ts-cloud.dev/build/v1",externalParameters:E.externalParameters??{},internalParameters:{},resolvedDependencies:E.resolvedDependencies??[]},runDetails:{builder:{id:"https://ts-cloud.dev/builders/local/v1"},metadata:{invocationId:E.invocationId,startedOn:E.startedAt,finishedOn:E.completedAt}}}}}function XG(E,T,_){let d=JSON.stringify(_);return E.addReleaseArtifact({...T,kind:"provenance",format:"in-toto+slsa-v1+json",digest:`sha256:${l0(d)}`,summary:{subjects:_.subject.length,builder:_.predicate.runDetails.builder.id,buildType:_.predicate.buildDefinition.buildType},content:d,sensitive:!0})}function $d(E,T){let _=E.environments.get(T);if(!_)throw Error(`Security scope for environment '${T}' was not found`);return{organizationId:E.organization.id,projectId:E.project.id,environmentId:_.id}}function i0(E,T){let _=new EN(E.store),d=_.listPolicies(E.organization.id);for(let[R,h]of E.environments){if(d.some((N)=>N.environmentId===h.id))continue;let r=R==="production"||h.kind==="production";d.push(_.createPolicy({organizationId:E.organization.id,environmentId:h.id,name:r?"Production baseline":"Environment baseline",scannerFailMode:r?"closed":"open",requiredScanners:["source-secrets"],rules:r?[{minimumSeverity:"critical",action:"block"},{minimumSeverity:"high",action:"block"},{minimumSeverity:"medium",action:"warn"},{minimumSeverity:"low",action:"record"}]:[{minimumSeverity:"critical",action:"warn"},{minimumSeverity:"high",action:"warn"},{minimumSeverity:"low",action:"record"}],actorId:T}))}return d}function JG(E,T,_,d={}){let R=_.findings.map((h)=>({...T,ruleId:h.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:h.pattern.severity,title:h.pattern.name,description:h.pattern.description,subject:`${h.file}:${h.line}`,evidence:{file:h.file,line:h.line,column:h.column,match:h.match,context:h.context},remediation:"Remove and rotate the credential, then reference it through a managed secret or environment variable."}));return E.recordScan({...T,scannerId:"source-secrets",scannerVersion:d.scannerVersion??"1.0.0",status:d.skipped?"skipped":_.passed?"passed":"failed",findings:d.skipped?[]:R,metadata:{scannedFiles:_.scannedFiles,durationMs:_.duration,summary:_.summary},durationMs:_.duration,error:d.skipped?"The operator explicitly skipped source-secret scanning.":void 0})}function FG(E,T,_="The operator explicitly skipped source-secret scanning."){return E.recordScan({...T,scannerId:"source-secrets",scannerVersion:"1.0.0",status:"skipped",findings:[],error:_})}function xn(E,T){let _=[],d=T.security;if(d?.firewall&&!["active","configured","ok"].includes(String(d.firewall.status)))_.push({...E,ruleId:"host-firewall-disabled",severity:"high",title:"Host firewall is not active",description:String(d.firewall.summary??"The host firewall did not report an active configuration."),subject:"host:firewall",evidence:{status:String(d.firewall.status??"unknown"),rules:Array.isArray(d.firewall.rules)?d.firewall.rules.length:0},remediation:"Apply the declarative firewall policy and confirm only required listeners are public."});for(let R of d?.ports??[]){let h=String(R.listen??""),r=Number(h.match(/:(\d+)$/)?.[1]);if(R.exposure==="public"&&Number.isFinite(r)&&![22,80,443].includes(r))_.push({...E,ruleId:"unexpected-public-listener",severity:"medium",title:`Unexpected public listener on port ${r}`,description:`${String(R.processName??"A process")} is listening publicly outside the standard SSH/HTTP/HTTPS ports.`,subject:`host:port:${r}`,evidence:{protocol:String(R.proto??""),listen:h,process:String(R.processName??"")},remediation:"Bind the service to loopback/private networking or explicitly document and firewall the required public port."})}for(let R of d?.tlsCertificates??[]){let h=Number(R.daysRemaining);if(Number.isFinite(h)&&h<30)_.push({...E,ruleId:"tls-certificate-expiry",severity:h<14?"high":"medium",title:`TLS certificate expires in ${h} days`,description:`${String(R.domain??"A configured domain")} needs renewal.`,subject:`tls:${String(R.domain??"unknown")}`,evidence:{domain:String(R.domain??""),daysRemaining:h,expires:String(R.expires??"")},remediation:"Renew the certificate and verify automatic renewal can complete before expiry."})}for(let R of T.diagnostics??[]){if(R.status==="pass"||R.status==="ok")continue;_.push({...E,ruleId:`diagnostic-${String(R.name??"unknown").toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:R.status==="fail"?"high":"medium",title:String(R.name??"Host security check"),description:String(R.detail??"The host security diagnostic did not pass."),subject:`diagnostic:${String(R.name??"unknown")}`,evidence:{status:String(R.status??"unknown")},remediation:"Follow the diagnostic guidance, rerun the check, and confirm the finding resolves."})}return _}function ZD(E,T,_){let d=!!_.security||Array.isArray(_.diagnostics),R=d?xn(T,_):[];return E.recordScan({...T,scannerId:"host-posture",scannerVersion:"1.0.0",status:!d?"unavailable":R.length?"failed":"passed",findings:R,metadata:{source:"dashboard-live-probe",checks:Array.isArray(_.diagnostics)?_.diagnostics.length:0},error:d?void 0:"Live host posture data was unavailable; source and provider checks remain usable."})}function SA(E,T){let _=E.evaluateGate({...T.scope,operationId:T.operationId}),d=E.listFindings({...T.scope,limit:1000}).filter((R)=>R.status!=="resolved");return{decision:_,summary:{desiredConfigHash:T.desiredConfigHash??null,securityImpact:{critical:d.filter((R)=>R.severity==="critical").length,high:d.filter((R)=>R.severity==="high").length,waived:d.filter((R)=>R.status==="waived").length,assigned:d.filter((R)=>!!R.ownerActorId).length},blockingFindingIds:_.findingIds,policy:{id:_.policyId,version:_.policyVersion},scannerVersions:_.scannerVersions}}}async function zG(E,T){let _=T.scanner??new aJ({timeoutMs:T.scannerTimeoutMs}),R=await new AA(E,{defaultTimeoutMs:T.scannerTimeoutMs??120000}).run(_,{...T.scope,releaseId:T.releaseId,imageRef:T.imageRef}),h={...T.scope,releaseId:T.releaseId};wG(E,h,R.findings);let r=T.generateImageSbom??CG,N=new AbortController,A=Math.max(100,T.sbomTimeoutMs??120000),S,L=new Promise((U,D)=>{S=setTimeout(()=>{N.abort(),D(Error(`syft-sbom exceeded its ${A}ms timeout`))},A)}),t="unavailable";try{let U=await Promise.race([r(T.imageRef,{signal:N.signal}),L]);sJ(E,h,U),E.recordScan({...T.scope,releaseId:T.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"passed",metadata:{imageRef:T.imageRef,format:`cyclonedx-${U.specVersion}+json`,components:U.components.length,localOnly:!0}}),t="image"}catch(U){let D=U instanceof Error?U.message:String(U);try{let C=IG(T.artifactRoot);sJ(E,h,C),E.recordScan({...T.scope,releaseId:T.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unsupported",error:`Image inventory was unavailable; attached a package-manifest SBOM instead. ${D}`,metadata:{imageRef:T.imageRef,fallback:"package-manifest",components:C.components.length,localOnly:!0}}),t="manifest"}catch(C){E.recordScan({...T.scope,releaseId:T.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unavailable",error:`Image and manifest SBOM generation were unavailable. ${D}; ${C instanceof Error?C.message:String(C)}`,metadata:{imageRef:T.imageRef,localOnly:!0}})}}finally{if(S)clearTimeout(S)}let O=cG({artifactName:T.imageRef,artifact:T.imageSha256?void 0:T.imageRef,artifactSha256:T.imageSha256,invocationId:T.invocationId,startedAt:T.startedAt,completedAt:T.completedAt??new Date().toISOString(),externalParameters:T.externalParameters??{imageRef:T.imageRef}});return XG(E,h,O),{scan:R,sbomSource:t}}async function jl(E){let T=o1();if(T.emptyEnvKey||T.emptyEnvSecret)dE("Empty AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY env var detected — likely a misconfigured .env file. Remove the empty lines or fill them in.");$(`AWS credentials: ${T.description}`);try{let d=await new sR(E).getCallerIdentity();if(d.Arn)$(`AWS identity: ${d.Arn}`)}catch(_){dE(`Could not verify AWS identity: ${_.message}`)}}function Bl(){try{return uD("git rev-parse --short HEAD",{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{return Date.now().toString(36)}}async function rF(E,T,_,d){let{ensureManagementDashboard:R}=await x0().then(() => je);R(E,{logger:{info:$,warn:dE}});let h=E.sites||{},r=Object.entries(h);if(r.length===0)return dE("infrastructure.compute is set but no sites are configured — nothing to deploy. Add sites to `cloud.config.ts`."),!0;if(d&&!h[d])return Q(`Site '${d}' was not found. Configured sites: ${r.map(([w])=>w).join(", ")}`),!1;let N=r.filter(([w,c])=>{if(!c)return!1;if(d&&w!==d)return!1;if(vT(c)==="bucket")return dE(`Site '${w}' targets a bucket — skipping compute deploy (handled by the static-site path).`),!1;return Qy(c)});if(N.length===0)return!0;if(d)$(`Deploying only '${d}'. Other sites keep their current release; proxy routes are still regenerated in full.`);let A=E.project.slug,L=(E.infrastructure?.compute||{}).runtime||"bun",t=ZT({config:E}),O=Bl(),U=new Map,D={step:(w)=>wE(w),error:(w)=>Q(w)};if(!await k0(E,"beforeDeploy",D))return!1;if(!await k0(E,"beforeBuild",D))return!1;for(let[w,c]of N){let z=vT(c);if(b(`Preparing site: ${w}`),$(`Domain: ${c.domain||"(none)"}`),$(`Source: ${c.root}`),$(`Kind: ${z==="server-static"?"static (shipped to /var/www)":"app (systemd service)"}`),z==="server-app")$(`Start: ${c.start}`),$(`Port: ${c.port??"(unset)"}`);if(c.build){wE(`Running build: ${c.build}`);try{uD(c.build,{stdio:"inherit",cwd:process.cwd()})}catch(W){return Q(`Build failed for site '${w}': ${W.message}`),!1}}if(!Dd(c.root))return Q(`Build output not found at ${c.root} for site '${w}'`),!1;let j=zl(Jl(),`${A}-${w}-${O}.tar.gz`);wE(`Packaging ${c.root} → ${j}`);try{let W=(c.exclude||[]).map((G)=>`--exclude='${G}'`).join(" ");uD(`tar czf "${j}" -C "${c.root}" ${W} .`,{stdio:"inherit"})}catch(W){return Q(`Failed to package '${w}': ${W.message}`),!1}U.set(w,j)}if(!await k0(E,"afterBuild",D))return!1;let C=await eD({config:d?{...E,sites:Object.fromEntries(N)}:E,rpxConfig:d?E:void 0,environment:T,driver:t,sha:O,runtime:L,tarballForSite:(w)=>{let c=U.get(w);if(!c)throw Error(`Missing tarball for site '${w}'`);return c},logger:{info:(w)=>$(w),warn:(w)=>dE(w),error:(w)=>Q(w),step:(w)=>wE(w),success:(w)=>Z(w)}});if(C&&!await k0(E,"afterDeploy",D))return!1;return C}async function bD(E){let T=new dL;wE("Running pre-deployment security scan...");let _=await T.scan({directory:E.sourceDir,failOnSeverity:E.failOnSeverity||"critical",skipPatterns:E.skipPatterns});return{passed:_.passed,result:_}}function kD(E){let{summary:T,findings:_,scannedFiles:d,duration:R}=E;if($(`
+`),L=r.index-S,t=R[A-1]||"";if(this.isLikelyPlaceholder(r[0],t))continue;let O=r[1]||r[0];if(h.name==="AWS Secret Key (Generic)"&&/^[a-f0-9]{40}$/i.test(O))continue;if(h.name==="AWS Secret Key (Generic)"&&!this.hasSecretCharacterDiversity(O))continue;if(h.name==="AWS Secret Key (Generic)"&&/^(?:Actions|Commands|Controllers|Handlers|Jobs|Listeners|Middleware|Models|Resources|Services)\//.test(O))continue;if(this.isLowEntropy(O))continue;d.push({file:T,line:A,column:L,match:this.maskSecret(r[0]),pattern:h,context:this.maskSecret(t.trim())})}}return d}isLikelyPlaceholder(E,T){let _=["example","placeholder","your_","YOUR_","xxx","XXX","***","test","TEST","dummy","DUMMY","fake","FAKE","sample","SAMPLE","<your","${","{{","process.env","import.meta.env","CHANGEME","TODO","FIXME"],d=E.toLowerCase(),R=T.toLowerCase();for(let r of _)if(d.includes(r.toLowerCase())||R.includes(r.toLowerCase()))return!0;let h=T.trim();if(h.startsWith("//")||h.startsWith("#")||h.startsWith("*")||h.startsWith("/*")){if(R.includes("example")||R.includes("format:")||R.includes("e.g."))return!0}return!1}isLowEntropy(E){if(E.length<8)return!1;if(new Set(E).size<8)return!0;if(/(.)\1{3,}/.test(E))return!0;return!1}hasSecretCharacterDiversity(E){let T=/[\d+=]/.test(E),_=[/[a-z]/.test(E),/[A-Z]/.test(E),/\d/.test(E),/[/+=]/.test(E)];return T&&_.filter(Boolean).length>=3}maskSecret(E){if(E.length<=8)return"*".repeat(E.length);let T=Math.min(4,Math.floor(E.length*0.2));return E.substring(0,T)+"*".repeat(E.length-T*2)+E.substring(E.length-T)}getFilesToScan(E,T,_){let d=[],R=_||Yn,h=(r)=>{let N=zn(r,{withFileTypes:!0});for(let A of N){let S=Hn(r,A.name);if(A.isDirectory()){if(!T.includes(A.name))h(S)}else if(A.isFile()){let L=Wn(A.name).toLowerCase();if(R.includes(L)||A.name.startsWith(".env")||A.name.endsWith(".config"))d.push(S)}}};return h(E),d}shouldExcludeFile(E){let T=E.split("/").pop()||"";for(let _ of this.excludeFiles)if(_.startsWith("*")){let d=_.substring(1);if(T.endsWith(d))return!0}else if(_.endsWith("*")){let d=_.substring(0,_.length-1);if(T.startsWith(d))return!0}else if(T===_)return!0;return!1}addPattern(E){this.patterns.push(E)}getPatterns(){return[...this.patterns]}}function Qn(E,T){return{status:"unavailable",findings:[],error:`${E.id} exceeded its ${T}ms timeout`,metadata:{timeoutMs:T}}}class AA{posture;defaultTimeoutMs;nowFn;constructor(E,T={}){this.posture=E;this.defaultTimeoutMs=T.defaultTimeoutMs??60000,this.nowFn=T.now??(()=>new Date)}async run(E,T){let _=this.nowFn(),d=Math.max(100,E.timeoutMs??this.defaultTimeoutMs),R=new AbortController,h,r=new Promise((L)=>{h=setTimeout(()=>{R.abort(),L(Qn(E,d))},d)}),N;try{N=await Promise.race([E.scan({...T,signal:R.signal}),r])}catch(L){N={status:"unavailable",findings:[],error:L instanceof Error?L.message:String(L)}}finally{if(h)clearTimeout(h)}let A=this.nowFn(),S={...T,scannerId:E.id,scannerVersion:E.version,status:N.status,findings:N.findings,metadata:N.metadata,error:N.error,startedAt:_.toISOString(),completedAt:A.toISOString(),durationMs:Math.max(0,A.getTime()-_.getTime())};return this.posture.recordScan(S)}async runAll(E,T){return Promise.all(E.map((_)=>this.run(_,T)))}}class n0{scanner;id="source-secrets";version="1.0.0";timeoutMs=30000;constructor(E=new dL){this.scanner=E}async scan(E){if(!E.artifactRoot)return{status:"skipped",findings:[],error:"No artifact root was supplied"};let T=await this.scanner.scan({directory:E.artifactRoot,failOnSeverity:"critical"});return{status:T.passed?"passed":"failed",findings:T.findings.map((_)=>({...E,ruleId:_.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:_.pattern.severity,title:_.pattern.name,description:_.pattern.description,subject:`${_.file}:${_.line}`,evidence:{file:_.file,line:_.line,column:_.column,match:_.match,context:_.context},remediation:"Remove the credential, rotate it at its issuer, and use a managed secret or environment reference."})),metadata:{scannedFiles:T.scannedFiles,summary:T.summary}}}}function Mn(E){let T=E?.toLowerCase();return T==="critical"||T==="high"||T==="medium"||T==="low"?T:"info"}class aJ{id="trivy-image";version;timeoutMs;constructor(E={}){this.version=E.version??"local",this.timeoutMs=E.timeoutMs??120000,this.executable=E.executable??"trivy"}executable;async scan(E){if(!E.imageRef)return{status:"skipped",findings:[],error:"No image reference was supplied"};let T;try{T=Bun.spawn([this.executable,"image","--format","json","--quiet","--scanners","vuln",E.imageRef],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",TRIVY_NO_PROGRESS:"true"}})}catch(A){return{status:"unsupported",findings:[],error:A instanceof Error?A.message:String(A)}}let _=()=>T.kill();E.signal.addEventListener("abort",_,{once:!0});let[d,R,h]=await Promise.all([T.exited,new Response(T.stdout).text(),new Response(T.stderr).text()]);if(E.signal.removeEventListener("abort",_),d!==0)return{status:/not found|enoent/i.test(h)?"unsupported":"unavailable",findings:[],error:h.slice(0,2000)||`Trivy exited with ${d}`};let r=JSON.parse(R),N=[];for(let A of r.Results??[])for(let S of A.Vulnerabilities??[]){let L=S.VulnerabilityID??"unknown-vulnerability";N.push({...E,ruleId:L,severity:Mn(S.Severity),title:S.Title||L,description:S.Description||`${L} affects ${S.PkgName??"an image package"}.`,subject:`${E.imageRef}:${S.PkgName??"unknown"}:${S.InstalledVersion??"unknown"}`,evidence:{image:E.imageRef,target:A.Target??"",cve:L,package:S.PkgName??"",installedVersion:S.InstalledVersion??"",fixedVersion:S.FixedVersion??"",reference:S.PrimaryURL??""},remediation:S.FixedVersion?`Upgrade ${S.PkgName} to ${S.FixedVersion} or later.`:"Remove or replace the affected package and rescan the image."})}return{status:N.length?"failed":"passed",findings:N,metadata:{imageRef:E.imageRef,vulnerabilityCount:N.length,localOnly:!0}}}}import{createHash as Vn,createVerify as h$E}from"node:crypto";import{existsSync as Kn,readFileSync as fn}from"node:fs";import{basename as Pn,join as Zn,resolve as DG}from"node:path";function l0(E){return Vn("sha256").update(E).digest("hex")}function qn(E){let T=[["dependencies","required"],["optionalDependencies","optional"],["devDependencies","excluded"],["peerDependencies","required"]],_=new Map;for(let[d,R]of T){let h=E[d];if(!h||typeof h!=="object"||Array.isArray(h))continue;for(let[r,N]of Object.entries(h)){let A=String(N).replace(/^[~^]/,""),S=`${r}@${A}`;if(!_.has(S))_.set(S,{type:"library",name:r,version:A,purl:`pkg:npm/${encodeURIComponent(r)}@${encodeURIComponent(A)}`,scope:R})}}return[..._.values()].sort((d,R)=>`${d.name}@${d.version}`.localeCompare(`${R.name}@${R.version}`))}function IG(E,T={}){let _=Zn(DG(E),"package.json");if(!Kn(_))throw Error(`Cannot generate an SBOM: ${_} was not found`);let d=fn(_,"utf8"),R=JSON.parse(d),h=String(R.name??Pn(DG(E))),r=String(R.version??"0.0.0"),N=l0(d);return{bomFormat:"CycloneDX",specVersion:"1.5",serialNumber:T.serial??`urn:uuid:${crypto.randomUUID()}`,version:1,metadata:{timestamp:(T.now??new Date).toISOString(),component:{type:"application",name:h,version:r,purl:`pkg:npm/${encodeURIComponent(h)}@${encodeURIComponent(r)}`,hashes:[{alg:"SHA-256",content:N}]},tools:[{vendor:"ts-cloud",name:"security-posture",version:"1.0.0"}]},components:qn(R)}}async function CG(E,T={}){let _=Bun.spawn([T.executable??"syft",E,"-o","cyclonedx-json"],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",SYFT_CHECK_FOR_APP_UPDATE:"false"}}),d=()=>_.kill();T.signal?.addEventListener("abort",d,{once:!0});let[R,h,r]=await Promise.all([_.exited,new Response(_.stdout).text(),new Response(_.stderr).text()]);if(T.signal?.removeEventListener("abort",d),R!==0)throw Error(r.slice(0,2000)||`Syft exited with ${R}`);return JSON.parse(h)}function sJ(E,T,_){let d=JSON.stringify(_);return E.addReleaseArtifact({...T,kind:"sbom",format:`cyclonedx-${_.specVersion}+json`,digest:`sha256:${l0(d)}`,summary:{component:_.metadata.component.name,version:_.metadata.component.version,components:_.components.length},content:d,sensitive:!0})}function wG(E,T,_){let d={total:_.length,critical:0,high:0,medium:0,low:0,info:0,fixable:0};for(let h of _){d[h.severity]++;let r=h.evidence;if(typeof r.fixedVersion==="string"&&r.fixedVersion)d.fixable++}let R=JSON.stringify({releaseId:T.releaseId,generatedAt:new Date().toISOString(),findings:_.map((h)=>({id:h.id,ruleId:h.ruleId,severity:h.severity,subject:h.subject,remediation:h.remediation}))});return E.addReleaseArtifact({...T,kind:"vulnerability_summary",format:"ts-cloud-vulnerability-summary+json",digest:`sha256:${l0(R)}`,summary:d,content:R,sensitive:!0})}function cG(E){if(!E.artifact&&!E.artifactSha256)throw Error("Release provenance requires artifact content or a SHA-256 digest");return{_type:"https://in-toto.io/Statement/v1",subject:[{name:E.artifactName,digest:{sha256:E.artifactSha256?.replace(/^sha256:/,"")??l0(E.artifact)}}],predicateType:"https://slsa.dev/provenance/v1",predicate:{buildDefinition:{buildType:"https://ts-cloud.dev/build/v1",externalParameters:E.externalParameters??{},internalParameters:{},resolvedDependencies:E.resolvedDependencies??[]},runDetails:{builder:{id:"https://ts-cloud.dev/builders/local/v1"},metadata:{invocationId:E.invocationId,startedOn:E.startedAt,finishedOn:E.completedAt}}}}}function XG(E,T,_){let d=JSON.stringify(_);return E.addReleaseArtifact({...T,kind:"provenance",format:"in-toto+slsa-v1+json",digest:`sha256:${l0(d)}`,summary:{subjects:_.subject.length,builder:_.predicate.runDetails.builder.id,buildType:_.predicate.buildDefinition.buildType},content:d,sensitive:!0})}function $d(E,T){let _=E.environments.get(T);if(!_)throw Error(`Security scope for environment '${T}' was not found`);return{organizationId:E.organization.id,projectId:E.project.id,environmentId:_.id}}function i0(E,T){let _=new EN(E.store),d=_.listPolicies(E.organization.id);for(let[R,h]of E.environments){if(d.some((N)=>N.environmentId===h.id))continue;let r=R==="production"||h.kind==="production";d.push(_.createPolicy({organizationId:E.organization.id,environmentId:h.id,name:r?"Production baseline":"Environment baseline",scannerFailMode:r?"closed":"open",requiredScanners:["source-secrets"],rules:r?[{minimumSeverity:"critical",action:"block"},{minimumSeverity:"high",action:"block"},{minimumSeverity:"medium",action:"warn"},{minimumSeverity:"low",action:"record"}]:[{minimumSeverity:"critical",action:"warn"},{minimumSeverity:"high",action:"warn"},{minimumSeverity:"low",action:"record"}],actorId:T}))}return d}function JG(E,T,_,d={}){let R=_.findings.map((h)=>({...T,ruleId:h.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:h.pattern.severity,title:h.pattern.name,description:h.pattern.description,subject:`${h.file}:${h.line}`,evidence:{file:h.file,line:h.line,column:h.column,match:h.match,context:h.context},remediation:"Remove and rotate the credential, then reference it through a managed secret or environment variable."}));return E.recordScan({...T,scannerId:"source-secrets",scannerVersion:d.scannerVersion??"1.0.0",status:d.skipped?"skipped":_.passed?"passed":"failed",findings:d.skipped?[]:R,metadata:{scannedFiles:_.scannedFiles,durationMs:_.duration,summary:_.summary},durationMs:_.duration,error:d.skipped?"The operator explicitly skipped source-secret scanning.":void 0})}function FG(E,T,_="The operator explicitly skipped source-secret scanning."){return E.recordScan({...T,scannerId:"source-secrets",scannerVersion:"1.0.0",status:"skipped",findings:[],error:_})}function xn(E,T){let _=[],d=T.security;if(d?.firewall&&!["active","configured","ok"].includes(String(d.firewall.status)))_.push({...E,ruleId:"host-firewall-disabled",severity:"high",title:"Host firewall is not active",description:String(d.firewall.summary??"The host firewall did not report an active configuration."),subject:"host:firewall",evidence:{status:String(d.firewall.status??"unknown"),rules:Array.isArray(d.firewall.rules)?d.firewall.rules.length:0},remediation:"Apply the declarative firewall policy and confirm only required listeners are public."});for(let R of d?.ports??[]){let h=String(R.listen??""),r=Number(h.match(/:(\d+)$/)?.[1]);if(R.exposure==="public"&&Number.isFinite(r)&&![22,80,443].includes(r))_.push({...E,ruleId:"unexpected-public-listener",severity:"medium",title:`Unexpected public listener on port ${r}`,description:`${String(R.processName??"A process")} is listening publicly outside the standard SSH/HTTP/HTTPS ports.`,subject:`host:port:${r}`,evidence:{protocol:String(R.proto??""),listen:h,process:String(R.processName??"")},remediation:"Bind the service to loopback/private networking or explicitly document and firewall the required public port."})}for(let R of d?.tlsCertificates??[]){let h=Number(R.daysRemaining);if(Number.isFinite(h)&&h<30)_.push({...E,ruleId:"tls-certificate-expiry",severity:h<14?"high":"medium",title:`TLS certificate expires in ${h} days`,description:`${String(R.domain??"A configured domain")} needs renewal.`,subject:`tls:${String(R.domain??"unknown")}`,evidence:{domain:String(R.domain??""),daysRemaining:h,expires:String(R.expires??"")},remediation:"Renew the certificate and verify automatic renewal can complete before expiry."})}for(let R of T.diagnostics??[]){if(R.status==="pass"||R.status==="ok")continue;_.push({...E,ruleId:`diagnostic-${String(R.name??"unknown").toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:R.status==="fail"?"high":"medium",title:String(R.name??"Host security check"),description:String(R.detail??"The host security diagnostic did not pass."),subject:`diagnostic:${String(R.name??"unknown")}`,evidence:{status:String(R.status??"unknown")},remediation:"Follow the diagnostic guidance, rerun the check, and confirm the finding resolves."})}return _}function ZD(E,T,_){let d=!!_.security||Array.isArray(_.diagnostics),R=d?xn(T,_):[];return E.recordScan({...T,scannerId:"host-posture",scannerVersion:"1.0.0",status:!d?"unavailable":R.length?"failed":"passed",findings:R,metadata:{source:"dashboard-live-probe",checks:Array.isArray(_.diagnostics)?_.diagnostics.length:0},error:d?void 0:"Live host posture data was unavailable; source and provider checks remain usable."})}function SA(E,T){let _=E.evaluateGate({...T.scope,operationId:T.operationId}),d=E.listFindings({...T.scope,limit:1000}).filter((R)=>R.status!=="resolved");return{decision:_,summary:{desiredConfigHash:T.desiredConfigHash??null,securityImpact:{critical:d.filter((R)=>R.severity==="critical").length,high:d.filter((R)=>R.severity==="high").length,waived:d.filter((R)=>R.status==="waived").length,assigned:d.filter((R)=>!!R.ownerActorId).length},blockingFindingIds:_.findingIds,policy:{id:_.policyId,version:_.policyVersion},scannerVersions:_.scannerVersions}}}async function zG(E,T){let _=T.scanner??new aJ({timeoutMs:T.scannerTimeoutMs}),R=await new AA(E,{defaultTimeoutMs:T.scannerTimeoutMs??120000}).run(_,{...T.scope,releaseId:T.releaseId,imageRef:T.imageRef}),h={...T.scope,releaseId:T.releaseId};wG(E,h,R.findings);let r=T.generateImageSbom??CG,N=new AbortController,A=Math.max(100,T.sbomTimeoutMs??120000),S,L=new Promise((U,D)=>{S=setTimeout(()=>{N.abort(),D(Error(`syft-sbom exceeded its ${A}ms timeout`))},A)}),t="unavailable";try{let U=await Promise.race([r(T.imageRef,{signal:N.signal}),L]);sJ(E,h,U),E.recordScan({...T.scope,releaseId:T.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"passed",metadata:{imageRef:T.imageRef,format:`cyclonedx-${U.specVersion}+json`,components:U.components.length,localOnly:!0}}),t="image"}catch(U){let D=U instanceof Error?U.message:String(U);try{let C=IG(T.artifactRoot);sJ(E,h,C),E.recordScan({...T.scope,releaseId:T.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unsupported",error:`Image inventory was unavailable; attached a package-manifest SBOM instead. ${D}`,metadata:{imageRef:T.imageRef,fallback:"package-manifest",components:C.components.length,localOnly:!0}}),t="manifest"}catch(C){E.recordScan({...T.scope,releaseId:T.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unavailable",error:`Image and manifest SBOM generation were unavailable. ${D}; ${C instanceof Error?C.message:String(C)}`,metadata:{imageRef:T.imageRef,localOnly:!0}})}}finally{if(S)clearTimeout(S)}let O=cG({artifactName:T.imageRef,artifact:T.imageSha256?void 0:T.imageRef,artifactSha256:T.imageSha256,invocationId:T.invocationId,startedAt:T.startedAt,completedAt:T.completedAt??new Date().toISOString(),externalParameters:T.externalParameters??{imageRef:T.imageRef}});return XG(E,h,O),{scan:R,sbomSource:t}}async function jl(E){let T=o1();if(T.emptyEnvKey||T.emptyEnvSecret)dE("Empty AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY env var detected — likely a misconfigured .env file. Remove the empty lines or fill them in.");$(`AWS credentials: ${T.description}`);try{let d=await new sR(E).getCallerIdentity();if(d.Arn)$(`AWS identity: ${d.Arn}`)}catch(_){dE(`Could not verify AWS identity: ${_.message}`)}}function Bl(){try{return uD("git rev-parse --short HEAD",{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{return Date.now().toString(36)}}async function rF(E,T,_,d){let{ensureManagementDashboard:R}=await x0().then(() => je);R(E,{logger:{info:$,warn:dE}});let h=E.sites||{},r=Object.entries(h);if(r.length===0)return dE("infrastructure.compute is set but no sites are configured — nothing to deploy. Add sites to `cloud.config.ts`."),!0;if(d&&!h[d])return Q(`Site '${d}' was not found. Configured sites: ${r.map(([w])=>w).join(", ")}`),!1;let N=r.filter(([w,c])=>{if(!c)return!1;if(d&&w!==d)return!1;if(vT(c)==="bucket")return dE(`Site '${w}' targets a bucket — skipping compute deploy (handled by the static-site path).`),!1;return Qy(c)});if(N.length===0)return!0;if(d)$(`Deploying only '${d}'. Other sites keep their current release; proxy routes are still regenerated in full.`);let A=E.project.slug,L=(E.infrastructure?.compute||{}).runtime||"bun",t=ZT({config:E}),O=Bl(),U=new Map,D={step:(w)=>wE(w),error:(w)=>Q(w)};if(!await k0(E,"beforeDeploy",D))return!1;if(!await k0(E,"beforeBuild",D))return!1;for(let[w,c]of N){let z=vT(c);if(b(`Preparing site: ${w}`),$(`Domain: ${c.domain||"(none)"}`),$(`Source: ${c.root}`),$(`Kind: ${z==="server-static"?"static (shipped to /var/www)":"app (systemd service)"}`),z==="server-app")$(`Start: ${c.start}`),$(`Port: ${c.port??"(unset)"}`);if(c.build){wE(`Running build: ${c.build}`);try{uD(c.build,{stdio:"inherit",cwd:process.cwd()})}catch(W){return Q(`Build failed for site '${w}': ${W.message}`),!1}}if(!Dd(c.root))return Q(`Build output not found at ${c.root} for site '${w}'`),!1;let j=zl(Jl(),`${A}-${w}-${O}.tar.gz`);wE(`Packaging ${c.root} → ${j}`);try{let W=(c.exclude||[]).map((G)=>`--exclude='${G}'`).join(" ");uD(`tar czf "${j}" -C "${c.root}" ${W} .`,{stdio:"inherit"})}catch(W){return Q(`Failed to package '${w}': ${W.message}`),!1}U.set(w,j)}if(!await k0(E,"afterBuild",D))return!1;let C=await eD({config:d?{...E,sites:Object.fromEntries(N)}:E,rpxConfig:d?E:void 0,environment:T,driver:t,sha:O,runtime:L,tarballForSite:(w)=>{let c=U.get(w);if(!c)throw Error(`Missing tarball for site '${w}'`);return c},logger:{info:(w)=>$(w),warn:(w)=>dE(w),error:(w)=>Q(w),step:(w)=>wE(w),success:(w)=>Z(w)}});if(C&&!await k0(E,"afterDeploy",D))return!1;return C}async function bD(E){let T=new dL;wE("Running pre-deployment security scan...");let _=await T.scan({directory:E.sourceDir,failOnSeverity:E.failOnSeverity||"critical",skipPatterns:E.skipPatterns});return{passed:_.passed,result:_}}function kD(E){let{summary:T,findings:_,scannedFiles:d,duration:R}=E;if($(`
 Scanned ${d} files in ${R}ms`),T.critical>0)Q(`  Critical: ${T.critical}`);else $(`  Critical: ${T.critical}`);if(T.high>0)dE(`  High: ${T.high}`);else $(`  High: ${T.high}`);if($(`  Medium: ${T.medium}`),$(`  Low: ${T.low}`),_.length>0){$(`
 Findings:`);let h=_.filter((L)=>L.pattern.severity==="critical"),r=_.filter((L)=>L.pattern.severity==="high"),N=_.filter((L)=>L.pattern.severity==="medium"),A=_.filter((L)=>L.pattern.severity==="low"),S=(L,t,O)=>{if(L.length>0){console.log(`
 ${Ur(`[${t}]`,O)}`);for(let U of L.slice(0,10))$(`  ${U.pattern.name}`),$(`    File: ${U.file}:${U.line}`),$(`    Match: ${U.match}`);if(L.length>10)$(`  ... and ${L.length-10} more ${t.toLowerCase()} findings`)}};S(h,"CRITICAL","red"),S(r,"HIGH","yellow"),S(N,"MEDIUM","blue"),S(A,"LOW","gray")}}function E9(E,T){let _=Object.keys(E.environments??{});if(T&&_.includes(T))return T;if(_.includes("production"))return"production";if(_[0])return _[0];throw Error("A configured environment is required for security policy evaluation")}function NF(E,T,_){let d=E9(E,T),R=lE(process.cwd(),E);try{let h=new EN(R.store);i0(R);let r=$d(R,d);if(_)JG(h,r,_);else FG(h,r);let N=SA(h,{scope:r,desiredConfigHash:R.project.desiredConfigHash});return $(`Security policy: ${N.decision.policyId} v${N.decision.policyVersion} — ${N.decision.outcome.toUpperCase()}`),$(`Security decision: ${N.decision.explanation}`),{allowed:N.decision.outcome!=="block",explanation:N.decision.explanation}}finally{R.store.close()}}async function Wl(E,T){let _=E9(E),d=lE(process.cwd(),E);try{let R=new EN(d.store);i0(d);let h=$d(d,_),r=T.imageSha256?`${T.imageRef}@sha256:${T.imageSha256.replace(/^sha256:/,"")}`:T.imageRef;wE("Scanning the built image and producing release security artifacts...");let N=await zG(R,{scope:h,releaseId:r,imageRef:T.imageRef,imageSha256:T.imageSha256,artifactRoot:T.artifactRoot,invocationId:T.invocationId,startedAt:T.startedAt,externalParameters:{imageRef:T.imageRef,artifactRoot:T.artifactRoot}});$(`Image scanner: ${N.scan.run.status} (${N.scan.findings.length} findings)`),$(`Release SBOM: ${N.sbomSource==="image"?"full image inventory":N.sbomSource==="manifest"?"package-manifest fallback":"unavailable"}`);let A=SA(R,{scope:h,operationId:T.invocationId,desiredConfigHash:d.project.desiredConfigHash});return $(`Release policy: ${A.decision.policyId} v${A.decision.policyVersion} — ${A.decision.outcome.toUpperCase()}`),$(`Release decision: ${A.decision.explanation}`),{allowed:A.decision.outcome!=="block",explanation:A.decision.explanation}}finally{d.store.close()}}function SF(E){E.command("deploy:security-scan","Run pre-deployment security scan").option("--source <path>","Source directory to scan",{default:"."}).option("--fail-on <severity>","Fail on severity level (critical, high, medium, low)",{default:"critical"}).option("--skip-patterns <patterns>","Comma-separated list of pattern names to skip").action(async(T)=>{b("Pre-Deployment Security Scan");try{let _=T?.source||".",d=T?.failOn||"critical",R=T?.skipPatterns?.split(",").map((N)=>N.trim())||[];if(!Dd(_)){Q(`Source directory not found: ${_}`);return}$(`Source: ${_}`),$(`Fail on: ${d} or higher severity`);let{passed:h,result:r}=await bD({sourceDir:_,failOnSeverity:d,skipPatterns:R});if(kD(r),h)Z(`