@stacksjs/ts-cloud 0.7.78 → 0.7.79

package/dist/bin/cli.js

@@ -8734,7 +8734,7 @@ runcmd:
   - [ bash, /var/lib/cloud/ts-cloud-bootstrap.sh ]
 `}var iX=()=>{};import{execSync as aX}from"node:child_process";import{existsSync as Rn,readFileSync as hn}from"node:fs";function d5(E){return(Buffer.isBuffer(E)?E.toString("utf8"):typeof E==="string"?E:"").replace(/(^|\n)(\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*=).*$/gm,"$1$2[redacted]").replace(/encrypted:[A-Za-z0-9+/=]+/g,"encrypted:[redacted]").trim().slice(-Sn)}function R5(E){let T=E,_=typeof T?.status==="number"?` (exit ${T.status})`:"",r=T?.signal?` (signal ${T.signal})`:"",t=[d5(T?.stderr),d5(T?.stdout)].filter(Boolean).join(`
 `);return`Remote SSH command failed${_}${r}${t?`
-${t}`:""}`}var mX=268435456,Sn=8000,ld;var sX=$E(async()=>{ZL();cU();wN();iX();KL();jC();Ve();await Yt([aE(),uX(),lX(),bR()]);ld=class ld{name="hetzner";usesCloudFormation=!1;client;sshPrivateKeyPath;sshPublicKeyPath;sshUser;location;waitForBoot;bootWait;constructor(E={}){this.client=E.client??new Wd({apiToken:MR(E.apiToken)});let T=$N(void 0,{sshPrivateKeyPath:E.sshPrivateKeyPath,sshPublicKeyPath:E.sshPublicKeyPath,sshUser:E.sshUser,location:E.location});this.sshPrivateKeyPath=T.sshPrivateKeyPath,this.sshPublicKeyPath=T.sshPublicKeyPath,this.sshUser=T.sshUser,this.location=T.location,this.waitForBoot=E.waitForBoot??!0,this.bootWait={sshIntervalMs:E.bootWait?.sshIntervalMs??5000,sshTimeoutMs:E.bootWait?.sshTimeoutMs??300000,cloudInitIntervalMs:E.bootWait?.cloudInitIntervalMs??5000,cloudInitTimeoutMs:E.bootWait?.cloudInitTimeoutMs??600000}}async provisionComputeInfrastructure(E){let{config:T,environment:_}=E,r=T.project.slug,t=T.infrastructure?.compute;if(!t)throw Error("infrastructure.compute is required to provision Hetzner compute");if(T.cloud?.attachTo)return this.attachToComputeInfrastructure(T.cloud.attachTo,T,_);let d=DT(T,_),R=`${r}-${_}-app`,h=t.runtime==="php"||!!t.php,S=r5(t);if(S.dedicatedServices||S.appServers>1)return h?this.provisionFleet(E,S):this.provisionBunFleet(E,S);let N=J_(r,_,"app"),A=T.sites||{},L=hr(t)?[]:this.collectUpstreamPorts(A),O=`${r}-${_}-app-fw`,{firewall:c}=await this.ensureFirewall(O,N,CN({allowSsh:t.allowSsh!==!1,sitePorts:L,allowedPorts:t.firewall?.allowedPorts})),U=await this.ensureSshKey(r,_,N),$=await Dt(d);if($?.serverId){let s=await this.tryGetServer($.serverId);if(s&&s.status!=="off")return this.outputsFromState($,s)}let I=await this.findExistingServer(r,_,R);if(I&&I.status!=="off"){let s={provider:"hetzner",stackName:d,serverId:I.id,serverName:I.name,publicIp:I.public_net.ipv4?.ip,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await gh(d,s),this.outputsFromState(s,I)}let w=t.proxy?.engine==="rpx"?xR({proxy:t.proxy,config:qR(A,{proxy:t.proxy,slug:T.project.slug}),slug:T.project.slug,bunBin:t.runtime==="node"||t.runtime==="deno"?void 0:"/usr/local/bin/bun"}):void 0,z=Y0(T),F=t.bakedImage===!0,j=Tt({runtime:z.runtime,runtimeVersion:z.runtimeVersion,systemPackages:t.systemPackages,database:T.infrastructure?.database,phpProvision:z.phpProvision,servicesProvision:z.servicesProvision,rpxProvision:w,baked:F,swapGb:t.swapGb}),H=vd(j),f=Hd(t.size),Q=VL(T),{server:K,action:x}=await this.client.createServer({name:R,serverType:f,image:Q,location:T.hetzner?.location||this.location,userData:H,labels:N,sshKeys:U?[U]:void 0,firewalls:[{firewall:c.id}]});await this.client.waitForAction(x.id);let k=await this.client.waitForServerRunning(K.id),v={provider:"hetzner",stackName:d,serverId:k.id,serverName:k.name,firewallId:c.id,publicIp:k.public_net.ipv4?.ip,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};await gh(d,v);let TE=k.public_net.ipv4?.ip;if(TE&&this.waitForBoot)await this.waitForSshReady(TE),await this.waitForCloudInit(TE);return this.outputsFromState(v,k)}async provisionFleet(E,T){let{config:_,environment:r}=E,t=_.project.slug,d=_.infrastructure.compute,R=DT(_,r),h=Hd(d.size),S=VL(_),N=_.hetzner?.location||this.location,A=d.bakedImage===!0,L=await Dt(R);if(L?.loadBalancerId){let dE=(await this.client.listLoadBalancers().catch(()=>[])).find((m)=>m.id===L.loadBalancerId);if(dE)return{appPublicIp:dE.public_net?.ipv4?.ip,loadBalancerIp:dE.public_net?.ipv4?.ip,servicesPrivateIp:L.servicesPrivateIp,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}let O=await this.ensureSshKey(t,r,J_(t,r,"app")),c=`${t}-${r}-net`,$=(await this.client.listNetworks().catch(()=>[])).find((_E)=>_E.name===c)??await this.client.createNetwork({name:c,labels:J_(t,r,"app")}),{firewall:I}=await this.ensureFirewall(`${t}-${r}-app-fw`,J_(t,r,"app"),CN({allowSsh:!0,sitePorts:[],allowedPorts:d.firewall?.allowedPorts})),{firewall:w}=await this.ensureFirewall(`${t}-${r}-services-fw`,J_(t,r,"services"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},{direction:"in",protocol:"tcp",port:"3306",source_ips:[$.ip_range]},{direction:"in",protocol:"tcp",port:"5432",source_ips:[$.ip_range]},{direction:"in",protocol:"tcp",port:"6379",source_ips:[$.ip_range]},{direction:"in",protocol:"tcp",port:"7700",source_ips:[$.ip_range]}]),z=vX(_),F=vd(Tt({runtime:"php",servicesProvision:z,baked:A,swapGb:d.swapGb})),j=await this.client.listServers().catch(()=>[]),H=[],f=j.find((_E)=>mr(_E.labels,t,r,"services"));if(!f){let{server:_E,action:dE}=await this.client.createServer({name:`${t}-${r}-services`,serverType:Hd(typeof d.servicesServer==="object"?d.servicesServer.size:d.size),image:S,location:N,userData:F,labels:J_(t,r,"services"),sshKeys:O?[O]:void 0,firewalls:[{firewall:w.id}],networks:[$.id]});await this.client.waitForAction(dE.id),f=await this.client.waitForServerRunning(_E.id),H.push(_E.id)}let Q=f.id,K=f.private_net?.[0]?.ip??(await this.client.getServer(Q)).private_net?.[0]?.ip,x=[...KR(!0),...ZR(!0),...mN(d.sshKeys),...aN(_.notifications)],k=OU({versions:d.php?.versions,default:d.php?.default,extensions:d.php?.extensions,installNginx:!hr(d),optimizeForProduction:d.php?.optimizeForProduction,ini:d.php?.ini}),v=vd(Tt({runtime:"php",phpProvision:k,servicesProvision:x,baked:A,swapGb:d.swapGb})),TE=j.filter((_E)=>mr(_E.labels,t,r,"app")),s=TE.map((_E)=>_E.id);if(TE.length>T.appServers)for(let _E of TE.slice(T.appServers))await this.client.deleteServer(_E.id).catch(()=>{}),s.splice(s.indexOf(_E.id),1);for(let _E=TE.length;_E<T.appServers;_E++){let{server:dE,action:m}=await this.client.createServer({name:`${t}-${r}-app-${_E+1}`,serverType:h,image:S,location:N,userData:v,labels:J_(t,r,"app"),sshKeys:O?[O]:void 0,firewalls:[{firewall:I.id}],networks:[$.id]});await this.client.waitForAction(m.id),s.push(dE.id),H.push(dE.id)}if(this.waitForBoot&&H.length>0)await Promise.all(H.map(async(_E)=>{let m=(await this.client.waitForServerRunning(_E)).public_net.ipv4?.ip;if(m)await this.waitForSshReady(m),await this.waitForCloudInit(m)}));let rE=`${t}-${r}-lb`,SE,W;if(T.loadBalancer){let dE=(await this.client.listLoadBalancers().catch(()=>[])).find((m)=>m.name===rE)??await this.client.createLoadBalancer({name:rE,location:N,network:$.id,labels:J_(t,r,"lb"),labelSelector:`ts-cloud/project=${t},ts-cloud/environment=${r},ts-cloud/role=app`,services:[{listenPort:80,destinationPort:80},{listenPort:443,destinationPort:443}]});W=dE.id,SE=dE.public_net?.ipv4?.ip}let q=SE??(await this.client.getServer(s[0]).catch(()=>{return}))?.public_net.ipv4?.ip,u={provider:"hetzner",stackName:R,networkId:$.id,loadBalancerId:W,servicesServerId:Q,servicesPrivateIp:K,publicIp:q,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await gh(R,u),{appPublicIp:q,loadBalancerIp:SE,servicesPrivateIp:K,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}async provisionBunFleet(E,T){let{config:_,environment:r}=E,t=_.project.slug,d=_.infrastructure.compute,R=DT(_,r),h=Hd(d.size),S=VL(_),N=_.hetzner?.location||this.location,A=d.bakedImage===!0,L=_.sites||{},O=await Dt(R);if(O?.lbServerId){let m=await this.tryGetServer(O.lbServerId);if(m&&m.status!=="off"){let IE=d.proxy?.engine==="rpx"?d.proxy:{engine:"rpx"},jE=await this.findComputeTargets({slug:t,environment:r,role:"app",stackName:R});return this.refreshLbRoutes(m,L,jE.map((yE)=>({privateIp:yE.privateIp,publicIp:yE.publicIp})),IE,t),{appPublicIp:m.public_net.ipv4?.ip??O.publicIp,loadBalancerIp:m.public_net.ipv4?.ip??O.publicIp,servicesPrivateIp:O.servicesPrivateIp,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}}let c=await this.ensureSshKey(t,r,J_(t,r,"app")),U=`${t}-${r}-net`,I=(await this.client.listNetworks().catch(()=>[])).find((m)=>m.name===U)??await this.client.createNetwork({name:U,labels:J_(t,r,"app")}),w=this.collectUpstreamPorts(L),{firewall:z}=await this.ensureFirewall(`${t}-${r}-app-fw`,J_(t,r,"app"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},...w.map((m)=>({direction:"in",protocol:"tcp",port:String(m),source_ips:[I.ip_range],description:`ts-cloud port ${m} (private, LB-only)`}))]),{firewall:F}=await this.ensureFirewall(`${t}-${r}-lb-fw`,J_(t,r,"lb"),CN({allowSsh:!0,sitePorts:[],allowedPorts:d.firewall?.allowedPorts})),j=await this.client.listServers().catch(()=>[]),H=[],f,Q,K=!!d.servicesServer||!!d.managedServices,x=T.dedicatedServices&&K;if(x){let{firewall:m}=await this.ensureFirewall(`${t}-${r}-services-fw`,J_(t,r,"services"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},{direction:"in",protocol:"tcp",port:"3306",source_ips:[I.ip_range]},{direction:"in",protocol:"tcp",port:"5432",source_ips:[I.ip_range]},{direction:"in",protocol:"tcp",port:"6379",source_ips:[I.ip_range]},{direction:"in",protocol:"tcp",port:"7700",source_ips:[I.ip_range]}]),IE=vX(_),jE=vd(Tt({runtime:"bun",servicesProvision:IE,baked:A,swapGb:d.swapGb})),yE=j.find((PE)=>mr(PE.labels,t,r,"services"));if(!yE){let{server:PE,action:ZE}=await this.client.createServer({name:`${t}-${r}-services`,serverType:Hd(typeof d.servicesServer==="object"?d.servicesServer.size:d.size),image:S,location:N,userData:jE,labels:J_(t,r,"services"),sshKeys:c?[c]:void 0,firewalls:[{firewall:m.id}],networks:[I.id]});await this.client.waitForAction(ZE.id),yE=await this.client.waitForServerRunning(PE.id),H.push(PE.id)}f=yE.id,Q=yE.private_net?.[0]?.ip??(await this.client.getServer(f)).private_net?.[0]?.ip}let k=x?{...d,managedServices:void 0,backups:void 0}:d,v=Y0({..._,infrastructure:{..._.infrastructure,compute:k}}),TE=vd(Tt({runtime:v.runtime,runtimeVersion:v.runtimeVersion,systemPackages:d.systemPackages,database:_.infrastructure?.database,servicesProvision:v.servicesProvision,baked:A,swapGb:d.swapGb})),s=j.filter((m)=>mr(m.labels,t,r,"app")),rE=s.map((m)=>m.id);if(s.length>T.appServers)for(let m of s.slice(T.appServers))await this.client.deleteServer(m.id).catch(()=>{}),rE.splice(rE.indexOf(m.id),1);for(let m=s.length;m<T.appServers;m++){let{server:IE,action:jE}=await this.client.createServer({name:`${t}-${r}-app-${m+1}`,serverType:h,image:S,location:N,userData:TE,labels:J_(t,r,"app"),sshKeys:c?[c]:void 0,firewalls:[{firewall:z.id}],networks:[I.id]});await this.client.waitForAction(jE.id),rE.push(IE.id),H.push(IE.id)}if(this.waitForBoot&&H.length>0)await Promise.all(H.map(async(m)=>{let jE=(await this.client.waitForServerRunning(m)).public_net.ipv4?.ip;if(jE)await this.waitForSshReady(jE),await this.waitForCloudInit(jE)}));let SE=[];for(let m of rE){let IE=j.find((jE)=>jE.id===m);if(!IE||!IE.private_net?.[0]?.ip)IE=await this.client.getServer(m).catch(()=>IE);SE.push({privateIp:IE?.private_net?.[0]?.ip,publicIp:IE?.public_net.ipv4?.ip})}let W=`${t}-${r}-lb`,q,u;if(T.loadBalancer){let m=j.find((jE)=>mr(jE.labels,t,r,"lb")),IE=d.proxy?.engine==="rpx"?d.proxy:{engine:"rpx"};if(!m){let jE=xR({proxy:IE,config:JN(L,SE,{proxy:IE,slug:t}),slug:t,bunBin:v.runtime==="node"||v.runtime==="deno"?void 0:"/usr/local/bin/bun"}),yE=vd(Tt({runtime:"bun",rpxProvision:jE,baked:!1})),PE=typeof d.loadBalancer==="object"?d.loadBalancer.size:void 0,{server:ZE,action:FE}=await this.client.createServer({name:W,serverType:Hd(PE??"micro"),image:S,location:N,userData:yE,labels:J_(t,r,"lb"),sshKeys:c?[c]:void 0,firewalls:[{firewall:F.id}],networks:[I.id]});if(await this.client.waitForAction(FE.id),m=await this.client.waitForServerRunning(ZE.id),this.waitForBoot){let gE=m.public_net.ipv4?.ip;if(gE)await this.waitForSshReady(gE),await this.waitForCloudInit(gE)}}else this.refreshLbRoutes(m,L,SE,IE,t);q=m.id,u=m.public_net.ipv4?.ip}let _E=u??(await this.client.getServer(rE[0]).catch(()=>{return}))?.public_net.ipv4?.ip,dE={provider:"hetzner",stackName:R,networkId:I.id,lbServerId:q,appServerIds:rE,servicesServerId:f,servicesPrivateIp:Q,publicIp:_E,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await gh(R,dE),{appPublicIp:_E,loadBalancerIp:u,servicesPrivateIp:Q,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}async destroyCompute(E){let{config:T,environment:_}=E,r=T.project.slug,t=DT(T,_),d=await Dt(t),R=[],h=`${r}-${_}-lb`,N=(await this.client.listLoadBalancers().catch(()=>[])).find((I)=>I.name===h);if(N)try{await this.client.deleteLoadBalancer(N.id),R.push(`load balancer ${h}`)}catch{}let A=await this.client.listServers().catch(()=>[]),L=new Set;for(let I of A)if(mr(I.labels,r,_,"app")||mr(I.labels,r,_,"services")||mr(I.labels,r,_,"lb"))L.add(I.id);if(d?.serverId)L.add(d.serverId);if(d?.servicesServerId)L.add(d.servicesServerId);if(d?.lbServerId)L.add(d.lbServerId);for(let I of d?.appServerIds??[])L.add(I);for(let I of L)try{await this.client.deleteServer(I),R.push(`server ${I}`)}catch{}let O=await this.client.listFirewalls().catch(()=>[]);for(let I of[`${r}-${_}-app-fw`,`${r}-${_}-services-fw`,`${r}-${_}-lb-fw`]){let w=O.find((z)=>z.name===I);if(!w)continue;for(let z=0;z<12;z++)try{await this.client.deleteFirewall(w.id),R.push(`firewall ${I}`);break}catch{await this.sleep(3000)}}let c=`${r}-${_}-net`,$=(await this.client.listNetworks().catch(()=>[])).find((I)=>I.name===c);if($)for(let I=0;I<12;I++)try{await this.client.deleteNetwork($.id),R.push(`network ${c}`);break}catch{await this.sleep(3000)}return await gh(t,{provider:"hetzner",stackName:t}).catch(()=>{}),{destroyed:R}}async getComputeOutputs(E){let T=DT(E.config,E.environment),_=await Dt(T);if(_?.serverId){let d=await this.tryGetServer(_.serverId);if(d)return this.outputsFromState(_,d)}if(_?.lbServerId){let R=(await this.tryGetServer(_.lbServerId))?.public_net.ipv4?.ip??_.publicIp;return{...this.outputsFromState(_),appPublicIp:R,loadBalancerIp:R}}if(_?.loadBalancerId||_?.servicesPrivateIp)return this.outputsFromState(_);let t=(await this.findComputeTargets({slug:E.config.project.slug,environment:E.environment,role:"app",stackName:DT(E.config,E.environment)}))[0];return{deployStoragePath:"/var/ts-cloud/staging",appInstanceId:t?.id,appPublicIp:t?.publicIp,sshUser:this.sshUser}}async uploadRelease(E){let T=E.targets?.length?E.targets:await this.findComputeTargets({slug:E.config.project.slug,environment:E.environment,role:"app",stackName:DT(E.config,E.environment)});if(T.length===0)throw Error("No Hetzner compute targets found for release upload");let r=`/var/ts-cloud/staging/${E.remoteKey.replace(/^releases\//,"").replace(/\//g,"-")}`;for(let t of T){if(!t.publicIp)throw Error(`Target ${t.id} has no public IP for SCP upload`);this.scpToHost(t.publicIp,E.localPath,r)}return{artifactRef:r}}async findComputeTargets(E){let T=await this.client.listServers(),_=E.role||"app",r=(d)=>({id:String(d.id),name:d.name,publicIp:d.public_net.ipv4?.ip,privateIp:d.private_net?.[0]?.ip,status:d.status}),t=T.filter((d)=>mr(d.labels,E.slug,E.environment,_));if(t.length>0)return t.map(r);if(_==="app"||_==="lb"||_==="services"){let d=await Dt(E.stackName??`${E.slug}-${E.environment}`),R=[...new Set(_==="app"?[d?.serverId,...d?.appServerIds??[]]:_==="lb"?[d?.lbServerId]:[d?.servicesServerId])].filter((h)=>typeof h==="number");if(R.length>0){let h=[];for(let S of R){let N=T.find((A)=>A.id===S)??await this.tryGetServer(S);if(N&&N.status!=="off")h.push(N)}if(h.length>0)return h.map(r)}}if(_==="app"){let d=T.filter((R)=>R.status!=="off"&&R.labels?.[`${K_}/managed-by`]==="ts-cloud"&&R.labels?.[`${K_}/environment`]===E.environment&&R.labels?.[`${K_}/role`]==="app");if(d.length===1)return d.map(r)}return[]}async attachToComputeInfrastructure(E,T,_){let r=await this.client.listServers(),t=(O)=>r.filter((c)=>c.status!=="off"&&mr(c.labels,E,_,O)),d=t("app");if(d.length===0)throw Error(`Cannot attach '${T.project.slug}' to '${E}': no running Hetzner app server is labeled for ${E}/${_}. Deploy the owner project first.`);let R=t("lb")[0],h=t("services")[0],S=d[0],N=R??S,A=DT(T,_),L={provider:"hetzner",stackName:A,serverId:S.id,serverName:S.name,appServerIds:d.map((O)=>O.id),lbServerId:R?.id,servicesServerId:h?.id,servicesPrivateIp:h?.private_net?.[0]?.ip,publicIp:N.public_net.ipv4?.ip,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await gh(A,L),this.outputsFromState(L)}async runRemoteDeploy(E){if(E.targets.length===0)return{success:!1,instanceCount:0,perInstance:[],error:"No targets provided"};let T=E.commands.join(`
+${t}`:""}`}var mX=268435456,Sn=8000,ld;var sX=$E(async()=>{ZL();cU();wN();iX();KL();jC();Ve();await Yt([aE(),uX(),lX(),bR()]);ld=class ld{name="hetzner";usesCloudFormation=!1;client;sshPrivateKeyPath;sshPublicKeyPath;sshUser;location;waitForBoot;bootWait;constructor(E={}){this.client=E.client??new Wd({apiToken:MR(E.apiToken)});let T=$N(void 0,{sshPrivateKeyPath:E.sshPrivateKeyPath,sshPublicKeyPath:E.sshPublicKeyPath,sshUser:E.sshUser,location:E.location});this.sshPrivateKeyPath=T.sshPrivateKeyPath,this.sshPublicKeyPath=T.sshPublicKeyPath,this.sshUser=T.sshUser,this.location=T.location,this.waitForBoot=E.waitForBoot??!0,this.bootWait={sshIntervalMs:E.bootWait?.sshIntervalMs??5000,sshTimeoutMs:E.bootWait?.sshTimeoutMs??300000,cloudInitIntervalMs:E.bootWait?.cloudInitIntervalMs??5000,cloudInitTimeoutMs:E.bootWait?.cloudInitTimeoutMs??600000}}async provisionComputeInfrastructure(E){let{config:T,environment:_}=E,r=T.project.slug,t=T.infrastructure?.compute;if(!t)throw Error("infrastructure.compute is required to provision Hetzner compute");if(T.cloud?.attachTo)return this.attachToComputeInfrastructure(T.cloud.attachTo,T,_);let d=DT(T,_),R=`${r}-${_}-app`,h=t.runtime==="php"||!!t.php,S=r5(t);if(S.dedicatedServices||S.appServers>1)return h?this.provisionFleet(E,S):this.provisionBunFleet(E,S);let N=J_(r,_,"app"),A=T.sites||{},L=hr(t)?[]:this.collectUpstreamPorts(A),O=`${r}-${_}-app-fw`,{firewall:c}=await this.ensureFirewall(O,N,CN({allowSsh:t.allowSsh!==!1,sitePorts:L,allowedPorts:t.firewall?.allowedPorts})),U=await this.ensureSshKey(r,_,N),$=await Dt(d);if($?.serverId){let s=await this.tryGetServer($.serverId);if(s&&s.status!=="off")return this.outputsFromState($,s)}let I=await this.findExistingServer(r,_,R);if(I&&I.status!=="off"){let s={provider:"hetzner",stackName:d,serverId:I.id,serverName:I.name,publicIp:I.public_net.ipv4?.ip,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await gh(d,s),this.outputsFromState(s,I)}let w=t.proxy?.engine==="rpx"?xR({proxy:t.proxy,config:qR(A,{proxy:t.proxy,slug:T.project.slug}),slug:T.project.slug,bunBin:t.runtime==="node"||t.runtime==="deno"?void 0:"/usr/local/bin/bun"}):void 0,z=Y0(T),F=t.bakedImage===!0,j=Tt({runtime:z.runtime,runtimeVersion:z.runtimeVersion,systemPackages:t.systemPackages,database:T.infrastructure?.database,phpProvision:z.phpProvision,servicesProvision:z.servicesProvision,rpxProvision:w,baked:F,swapGb:t.swapGb}),H=vd(j),f=Hd(t.size),Q=VL(T),{server:K,action:x}=await this.client.createServer({name:R,serverType:f,image:Q,location:T.hetzner?.location||this.location,userData:H,labels:N,sshKeys:U?[U]:void 0,firewalls:[{firewall:c.id}]});await this.client.waitForAction(x.id);let k=await this.client.waitForServerRunning(K.id),v={provider:"hetzner",stackName:d,serverId:k.id,serverName:k.name,firewallId:c.id,publicIp:k.public_net.ipv4?.ip,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};await gh(d,v);let TE=k.public_net.ipv4?.ip;if(TE&&this.waitForBoot)await this.waitForSshReady(TE),await this.waitForCloudInit(TE);return this.outputsFromState(v,k)}async provisionFleet(E,T){let{config:_,environment:r}=E,t=_.project.slug,d=_.infrastructure.compute,R=DT(_,r),h=Hd(d.size),S=VL(_),N=_.hetzner?.location||this.location,A=d.bakedImage===!0,L=await Dt(R);if(L?.loadBalancerId){let dE=(await this.client.listLoadBalancers().catch(()=>[])).find((m)=>m.id===L.loadBalancerId);if(dE)return{appPublicIp:dE.public_net?.ipv4?.ip,loadBalancerIp:dE.public_net?.ipv4?.ip,servicesPrivateIp:L.servicesPrivateIp,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}let O=await this.ensureSshKey(t,r,J_(t,r,"app")),c=`${t}-${r}-net`,$=(await this.client.listNetworks().catch(()=>[])).find((_E)=>_E.name===c)??await this.client.createNetwork({name:c,labels:J_(t,r,"app")}),{firewall:I}=await this.ensureFirewall(`${t}-${r}-app-fw`,J_(t,r,"app"),CN({allowSsh:!0,sitePorts:[],allowedPorts:d.firewall?.allowedPorts})),{firewall:w}=await this.ensureFirewall(`${t}-${r}-services-fw`,J_(t,r,"services"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},{direction:"in",protocol:"tcp",port:"3306",source_ips:[$.ip_range]},{direction:"in",protocol:"tcp",port:"5432",source_ips:[$.ip_range]},{direction:"in",protocol:"tcp",port:"6379",source_ips:[$.ip_range]},{direction:"in",protocol:"tcp",port:"7700",source_ips:[$.ip_range]}]),z=vX(_),F=vd(Tt({runtime:"php",servicesProvision:z,baked:A,swapGb:d.swapGb})),j=await this.client.listServers().catch(()=>[]),H=[],f=j.find((_E)=>mr(_E.labels,t,r,"services"));if(!f){let{server:_E,action:dE}=await this.client.createServer({name:`${t}-${r}-services`,serverType:Hd(typeof d.servicesServer==="object"?d.servicesServer.size:d.size),image:S,location:N,userData:F,labels:J_(t,r,"services"),sshKeys:O?[O]:void 0,firewalls:[{firewall:w.id}],networks:[$.id]});await this.client.waitForAction(dE.id),f=await this.client.waitForServerRunning(_E.id),H.push(_E.id)}let Q=f.id,K=f.private_net?.[0]?.ip??(await this.client.getServer(Q)).private_net?.[0]?.ip,x=[...KR(!0),...ZR(!0),...mN(d.sshKeys),...aN(_.notifications)],k=OU({versions:d.php?.versions,default:d.php?.default,extensions:d.php?.extensions,installNginx:!hr(d),optimizeForProduction:d.php?.optimizeForProduction,ini:d.php?.ini}),v=vd(Tt({runtime:"php",phpProvision:k,servicesProvision:x,baked:A,swapGb:d.swapGb})),TE=j.filter((_E)=>mr(_E.labels,t,r,"app")),s=TE.map((_E)=>_E.id);if(TE.length>T.appServers)for(let _E of TE.slice(T.appServers))await this.client.deleteServer(_E.id).catch(()=>{}),s.splice(s.indexOf(_E.id),1);for(let _E=TE.length;_E<T.appServers;_E++){let{server:dE,action:m}=await this.client.createServer({name:`${t}-${r}-app-${_E+1}`,serverType:h,image:S,location:N,userData:v,labels:J_(t,r,"app"),sshKeys:O?[O]:void 0,firewalls:[{firewall:I.id}],networks:[$.id]});await this.client.waitForAction(m.id),s.push(dE.id),H.push(dE.id)}if(this.waitForBoot&&H.length>0)await Promise.all(H.map(async(_E)=>{let m=(await this.client.waitForServerRunning(_E)).public_net.ipv4?.ip;if(m)await this.waitForSshReady(m),await this.waitForCloudInit(m)}));let rE=`${t}-${r}-lb`,SE,W;if(T.loadBalancer){let dE=(await this.client.listLoadBalancers().catch(()=>[])).find((m)=>m.name===rE)??await this.client.createLoadBalancer({name:rE,location:N,network:$.id,labels:J_(t,r,"lb"),labelSelector:`ts-cloud/project=${t},ts-cloud/environment=${r},ts-cloud/role=app`,services:[{listenPort:80,destinationPort:80},{listenPort:443,destinationPort:443}]});W=dE.id,SE=dE.public_net?.ipv4?.ip}let q=SE??(await this.client.getServer(s[0]).catch(()=>{return}))?.public_net.ipv4?.ip,u={provider:"hetzner",stackName:R,networkId:$.id,loadBalancerId:W,servicesServerId:Q,servicesPrivateIp:K,publicIp:q,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await gh(R,u),{appPublicIp:q,loadBalancerIp:SE,servicesPrivateIp:K,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}async provisionBunFleet(E,T){let{config:_,environment:r}=E,t=_.project.slug,d=_.infrastructure.compute,R=DT(_,r),h=Hd(d.size),S=VL(_),N=_.hetzner?.location||this.location,A=d.bakedImage===!0,L=_.sites||{},O=await Dt(R);if(O?.lbServerId){let m=await this.tryGetServer(O.lbServerId);if(m&&m.status!=="off"){let IE=d.proxy?.engine==="rpx"?d.proxy:{engine:"rpx"},jE=await this.findComputeTargets({slug:t,environment:r,role:"app",stackName:R});return this.refreshLbRoutes(m,L,jE.map((yE)=>({privateIp:yE.privateIp,publicIp:yE.publicIp})),IE,t),{appPublicIp:m.public_net.ipv4?.ip??O.publicIp,loadBalancerIp:m.public_net.ipv4?.ip??O.publicIp,servicesPrivateIp:O.servicesPrivateIp,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}}let c=await this.ensureSshKey(t,r,J_(t,r,"app")),U=`${t}-${r}-net`,I=(await this.client.listNetworks().catch(()=>[])).find((m)=>m.name===U)??await this.client.createNetwork({name:U,labels:J_(t,r,"app")}),w=this.collectUpstreamPorts(L),{firewall:z}=await this.ensureFirewall(`${t}-${r}-app-fw`,J_(t,r,"app"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},...w.map((m)=>({direction:"in",protocol:"tcp",port:String(m),source_ips:[I.ip_range],description:`ts-cloud port ${m} (private, LB-only)`}))]),{firewall:F}=await this.ensureFirewall(`${t}-${r}-lb-fw`,J_(t,r,"lb"),CN({allowSsh:!0,sitePorts:[],allowedPorts:d.firewall?.allowedPorts})),j=await this.client.listServers().catch(()=>[]),H=[],f,Q,K=!!d.servicesServer||!!d.managedServices,x=T.dedicatedServices&&K;if(x){let{firewall:m}=await this.ensureFirewall(`${t}-${r}-services-fw`,J_(t,r,"services"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},{direction:"in",protocol:"tcp",port:"3306",source_ips:[I.ip_range]},{direction:"in",protocol:"tcp",port:"5432",source_ips:[I.ip_range]},{direction:"in",protocol:"tcp",port:"6379",source_ips:[I.ip_range]},{direction:"in",protocol:"tcp",port:"7700",source_ips:[I.ip_range]}]),IE=vX(_),jE=vd(Tt({runtime:"bun",servicesProvision:IE,baked:A,swapGb:d.swapGb})),yE=j.find((PE)=>mr(PE.labels,t,r,"services"));if(!yE){let{server:PE,action:ZE}=await this.client.createServer({name:`${t}-${r}-services`,serverType:Hd(typeof d.servicesServer==="object"?d.servicesServer.size:d.size),image:S,location:N,userData:jE,labels:J_(t,r,"services"),sshKeys:c?[c]:void 0,firewalls:[{firewall:m.id}],networks:[I.id]});await this.client.waitForAction(ZE.id),yE=await this.client.waitForServerRunning(PE.id),H.push(PE.id)}f=yE.id,Q=yE.private_net?.[0]?.ip??(await this.client.getServer(f)).private_net?.[0]?.ip}let k=x?{...d,managedServices:void 0,backups:void 0}:d,v=Y0({..._,infrastructure:{..._.infrastructure,compute:k}}),TE=vd(Tt({runtime:v.runtime,runtimeVersion:v.runtimeVersion,systemPackages:d.systemPackages,database:_.infrastructure?.database,servicesProvision:v.servicesProvision,baked:A,swapGb:d.swapGb})),s=j.filter((m)=>mr(m.labels,t,r,"app")),rE=s.map((m)=>m.id);if(s.length>T.appServers)for(let m of s.slice(T.appServers))await this.client.deleteServer(m.id).catch(()=>{}),rE.splice(rE.indexOf(m.id),1);for(let m=s.length;m<T.appServers;m++){let{server:IE,action:jE}=await this.client.createServer({name:`${t}-${r}-app-${m+1}`,serverType:h,image:S,location:N,userData:TE,labels:J_(t,r,"app"),sshKeys:c?[c]:void 0,firewalls:[{firewall:z.id}],networks:[I.id]});await this.client.waitForAction(jE.id),rE.push(IE.id),H.push(IE.id)}if(this.waitForBoot&&H.length>0)await Promise.all(H.map(async(m)=>{let jE=(await this.client.waitForServerRunning(m)).public_net.ipv4?.ip;if(jE)await this.waitForSshReady(jE),await this.waitForCloudInit(jE)}));let SE=[];for(let m of rE){let IE=j.find((jE)=>jE.id===m);if(!IE||!IE.private_net?.[0]?.ip)IE=await this.client.getServer(m).catch(()=>IE);SE.push({privateIp:IE?.private_net?.[0]?.ip,publicIp:IE?.public_net.ipv4?.ip})}let W=`${t}-${r}-lb`,q,u;if(T.loadBalancer){let m=j.find((jE)=>mr(jE.labels,t,r,"lb")),IE=d.proxy?.engine==="rpx"?d.proxy:{engine:"rpx"};if(!m){let jE=xR({proxy:IE,config:JN(L,SE,{proxy:IE,slug:t}),slug:t,bunBin:v.runtime==="node"||v.runtime==="deno"?void 0:"/usr/local/bin/bun"}),yE=vd(Tt({runtime:"bun",rpxProvision:jE,baked:!1})),PE=typeof d.loadBalancer==="object"?d.loadBalancer.size:void 0,{server:ZE,action:FE}=await this.client.createServer({name:W,serverType:Hd(PE??"micro"),image:S,location:N,userData:yE,labels:J_(t,r,"lb"),sshKeys:c?[c]:void 0,firewalls:[{firewall:F.id}],networks:[I.id]});if(await this.client.waitForAction(FE.id),m=await this.client.waitForServerRunning(ZE.id),this.waitForBoot){let gE=m.public_net.ipv4?.ip;if(gE)await this.waitForSshReady(gE),await this.waitForCloudInit(gE)}}else this.refreshLbRoutes(m,L,SE,IE,t);q=m.id,u=m.public_net.ipv4?.ip}let _E=u??(await this.client.getServer(rE[0]).catch(()=>{return}))?.public_net.ipv4?.ip,dE={provider:"hetzner",stackName:R,networkId:I.id,lbServerId:q,appServerIds:rE,servicesServerId:f,servicesPrivateIp:Q,publicIp:_E,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await gh(R,dE),{appPublicIp:_E,loadBalancerIp:u,servicesPrivateIp:Q,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}async destroyCompute(E){let{config:T,environment:_}=E,r=T.project.slug,t=DT(T,_),d=await Dt(t),R=[],h=`${r}-${_}-lb`,N=(await this.client.listLoadBalancers().catch(()=>[])).find((I)=>I.name===h);if(N)try{await this.client.deleteLoadBalancer(N.id),R.push(`load balancer ${h}`)}catch{}let A=await this.client.listServers().catch(()=>[]),L=new Set;for(let I of A)if(mr(I.labels,r,_,"app")||mr(I.labels,r,_,"services")||mr(I.labels,r,_,"lb"))L.add(I.id);if(d?.serverId)L.add(d.serverId);if(d?.servicesServerId)L.add(d.servicesServerId);if(d?.lbServerId)L.add(d.lbServerId);for(let I of d?.appServerIds??[])L.add(I);for(let I of L)try{await this.client.deleteServer(I),R.push(`server ${I}`)}catch{}let O=await this.client.listFirewalls().catch(()=>[]);for(let I of[`${r}-${_}-app-fw`,`${r}-${_}-services-fw`,`${r}-${_}-lb-fw`]){let w=O.find((z)=>z.name===I);if(!w)continue;for(let z=0;z<12;z++)try{await this.client.deleteFirewall(w.id),R.push(`firewall ${I}`);break}catch{await this.sleep(3000)}}let c=`${r}-${_}-net`,$=(await this.client.listNetworks().catch(()=>[])).find((I)=>I.name===c);if($)for(let I=0;I<12;I++)try{await this.client.deleteNetwork($.id),R.push(`network ${c}`);break}catch{await this.sleep(3000)}return await gh(t,{provider:"hetzner",stackName:t}).catch(()=>{}),{destroyed:R}}async getComputeOutputs(E){let T=DT(E.config,E.environment),_=await Dt(T);if(_?.serverId){let d=await this.tryGetServer(_.serverId);if(d)return this.outputsFromState(_,d)}if(_?.lbServerId){let R=(await this.tryGetServer(_.lbServerId))?.public_net.ipv4?.ip??_.publicIp;return{...this.outputsFromState(_),appPublicIp:R,loadBalancerIp:R}}if(_?.loadBalancerId||_?.servicesPrivateIp)return this.outputsFromState(_);let t=(await this.findComputeTargets({slug:E.config.project.slug,environment:E.environment,role:"app",stackName:DT(E.config,E.environment)}))[0];return{deployStoragePath:"/var/ts-cloud/staging",appInstanceId:t?.id,appPublicIp:t?.publicIp,sshUser:this.sshUser}}async uploadRelease(E){let T=E.targets?.length?E.targets:await this.findComputeTargets({slug:E.config.project.slug,environment:E.environment,role:"app",stackName:DT(E.config,E.environment)});if(T.length===0)throw Error("No Hetzner compute targets found for release upload");let r=`/var/ts-cloud/staging/${E.remoteKey.replace(/^releases\//,"").replace(/\//g,"-")}`;for(let t of T){if(!t.publicIp)throw Error(`Target ${t.id} has no public IP for SCP upload`);this.scpToHost(t.publicIp,E.localPath,r)}return{artifactRef:r}}async findComputeTargets(E){let T=await this.client.listServers(),_=E.role||"app",r=(d)=>({id:String(d.id),name:d.name,publicIp:d.public_net.ipv4?.ip,privateIp:d.private_net?.[0]?.ip,status:d.status});if(_==="app"||_==="lb"||_==="services"){let d=await Dt(E.stackName??`${E.slug}-${E.environment}`),R=[...new Set(_==="app"?[d?.serverId,...d?.appServerIds??[]]:_==="lb"?[d?.lbServerId]:[d?.servicesServerId])].filter((h)=>typeof h==="number");if(R.length>0){let h=[];for(let S of R){let N=T.find((A)=>A.id===S)??await this.tryGetServer(S);if(N&&N.status!=="off")h.push(N)}if(h.length>0)return h.map(r)}}let t=T.filter((d)=>mr(d.labels,E.slug,E.environment,_));if(t.length>0)return t.map(r);if(_==="app"){let d=T.filter((R)=>R.status!=="off"&&R.labels?.[`${K_}/managed-by`]==="ts-cloud"&&R.labels?.[`${K_}/environment`]===E.environment&&R.labels?.[`${K_}/role`]==="app");if(d.length===1)return d.map(r)}return[]}async attachToComputeInfrastructure(E,T,_){let r=await this.client.listServers(),t=(O)=>r.filter((c)=>c.status!=="off"&&mr(c.labels,E,_,O)),d=t("app");if(d.length===0)throw Error(`Cannot attach '${T.project.slug}' to '${E}': no running Hetzner app server is labeled for ${E}/${_}. Deploy the owner project first.`);let R=t("lb")[0],h=t("services")[0],S=d[0],N=R??S,A=DT(T,_),L={provider:"hetzner",stackName:A,serverId:S.id,serverName:S.name,appServerIds:d.map((O)=>O.id),lbServerId:R?.id,servicesServerId:h?.id,servicesPrivateIp:h?.private_net?.[0]?.ip,publicIp:N.public_net.ipv4?.ip,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await gh(A,L),this.outputsFromState(L)}async runRemoteDeploy(E){if(E.targets.length===0)return{success:!1,instanceCount:0,perInstance:[],error:"No targets provided"};let T=E.commands.join(`
 `),_=[];for(let t of E.targets){if(!t.publicIp){_.push({instanceId:t.id,status:"Failed",error:"Missing public IP"});continue}try{let d=this.sshExec(t.publicIp,T);_.push({instanceId:t.id,status:"Success",output:d})}catch(d){_.push({instanceId:t.id,status:"Failed",error:d.message})}}let r=_.every((t)=>t.status==="Success");return{success:r,instanceCount:E.targets.length,perInstance:_,error:r?void 0:"One or more SSH deploy commands failed"}}async ensureSshKey(E,T,_){if(!Rn(this.sshPublicKeyPath))throw Error(`SSH public key not found at ${this.sshPublicKeyPath}. ts-cloud deploys to Hetzner over SSH and needs a public key to authorize on the server. Generate one (\`ssh-keygen -t ed25519\`) or set hetzner.sshPrivateKeyPath / HCLOUD_SSH_PUBLIC_KEY.`);let r=hn(this.sshPublicKeyPath,"utf8").trim(),t=IN(r),R=(await this.client.listSshKeys()).find((S)=>IN(S.public_key)===t);if(R)return R.id;return(await this.client.createSshKey({name:`${E}-${T}-deploy`,publicKey:r,labels:_})).id}async tryGetServer(E){try{return await this.client.getServer(E)}catch{return null}}refreshLbRoutes(E,T,_,r,t){let d=E.public_net.ipv4?.ip;if(!d){console.warn(`[ts-cloud] LB server '${E.name}' has no public IP — skipping the rpx route refresh; its routes may be stale.`);return}let R=_.filter((S)=>S.privateIp||S.publicIp);if(R.length===0){console.warn(`[ts-cloud] No routable app boxes found for LB '${E.name}' — leaving its current rpx routes untouched.`);return}let h=JN(T,R,{proxy:r,slug:t});this.sshExec(d,qL({config:h,slug:t}).join(`
 `))}async findExistingServer(E,T,_){let r=await this.client.listServers(),t=r.find((R)=>mr(R.labels,E,T,"app")||R.name===_);if(t)return t;let d=r.filter((R)=>R.status!=="off"&&R.labels?.[`${K_}/managed-by`]==="ts-cloud"&&R.labels?.[`${K_}/environment`]===T&&R.labels?.[`${K_}/role`]==="app");if(d.length===1){let R=d[0],h=R.labels?.[`${K_}/project`]??"unknown";return console.warn(`[ts-cloud] No server named '${_}' found; adopting existing ts-cloud app server '${R.name}' (project label '${h}') for project '${E}' — `+"updating it in place instead of provisioning a new server."),R}return}async ensureFirewall(E,T,_){let t=(await this.client.listFirewalls()).find((R)=>R.name===E);if(t)return await this.client.setFirewallRules(t.id,_),{firewall:t};let{firewall:d}=await this.client.createFirewall({name:E,labels:T,rules:_});return{firewall:d}}collectUpstreamPorts(E){let T=new Set;for(let _ of Object.values(E))if(typeof _.port==="number")T.add(_.port);return[...T].filter((_)=>![80,443].includes(_))}async sleep(E){await new Promise((T)=>setTimeout(T,E))}async waitForSshReady(E){let{sshIntervalMs:T,sshTimeoutMs:_}=this.bootWait,r=Date.now(),t;while(Date.now()-r<_)try{aX(`ssh ${this.sshBaseArgs(E,["-o","ConnectTimeout=5"]).map((d)=>`'${d.replace(/'/g,"\\\"")}"`).join(" ")} true`,{stdio:"pipe",maxBuffer:mX});return}catch(d){t=d,await this.sleep(T)}throw Error(`Timed out waiting for SSH on ${E} after ${_}ms: ${t?.message??"unknown error"}`)}async waitForCloudInit(E){let{cloudInitIntervalMs:T,cloudInitTimeoutMs:_}=this.bootWait,r=Date.now();while(Date.now()-r<_){try{let t=this.sshExec(E,"if command -v cloud-init >/dev/null 2>&1; then cloud-init status --long 2>/dev/null || true; else echo 'status: done'; fi");if(/status:\s*error/.test(t))throw Error(`cloud-init reported an error on ${E}:
 ${t}`);if(/status:\s*(?:done|degraded)/.test(t))return}catch(t){if(t instanceof Error&&/cloud-init reported an error/.test(t.message))throw t}await this.sleep(T)}throw Error(`Timed out waiting for cloud-init to finish on ${E} after ${_}ms`)}outputsFromState(E,T){return{deployStoragePath:E.deployStoragePath||"/var/ts-cloud/staging",appInstanceId:E.serverId?String(E.serverId):void 0,appPublicIp:T?.public_net.ipv4?.ip||E.publicIp,sshUser:E.sshUser||this.sshUser,servicesPrivateIp:E.servicesPrivateIp}}static SSH_HOST_KEY_OPTS=["-o","StrictHostKeyChecking=no","-o","UserKnownHostsFile=/dev/null","-o","LogLevel=ERROR"];static SSH_KEEPALIVE_OPTS=["-o","ConnectTimeout=30","-o","ServerAliveInterval=15","-o","ServerAliveCountMax=4"];sshBaseArgs(E,T=[]){return["-i",this.sshPrivateKeyPath,...ld.SSH_HOST_KEY_OPTS,...ld.SSH_KEEPALIVE_OPTS,"-o","BatchMode=yes",...T,`${this.sshUser}@${E}`]}scpToHost(E,T,_){let r=["scp","-i",this.sshPrivateKeyPath,...ld.SSH_HOST_KEY_OPTS,...ld.SSH_KEEPALIVE_OPTS,"-o","BatchMode=yes",T,`${this.sshUser}@${E}:${_}`].map((d)=>`"${d.replace(/"/g,"\\\"")}"`).join(" "),t=3;for(let d=1;d<=3;d++)try{aX(r,{stdio:"pipe",maxBuffer:mX});return}catch(R){if(d===3)throw Error(R5(R))}}sshExec(E,T){let _=T.replace(/'/g,"'\\''");try{return aX(`ssh ${this.sshBaseArgs(E).map((r)=>`"${r.replace(/"/g,"\\\"")}"`).join(" ")} '${_}'`,{encoding:"utf8",stdio:["pipe","pipe","pipe"],maxBuffer:mX})}catch(r){throw Error(R5(r))}}}});class UU{name="hetzner";usesCloudFormation=!1;async getComputeOutputs(){return{appPublicIp:"127.0.0.1",sshUser:"root"}}async uploadRelease(E){return{artifactRef:E.localPath}}async findComputeTargets(E){if((E.role||"app")!=="app")return[];return[{id:"localhost",name:"localhost",publicIp:"127.0.0.1",status:"running"}]}async runRemoteDeploy(E){let T=E.commands.join(`
@@ -9210,7 +9210,7 @@ Run \`${this.name??"cli"} --help\` for usage.`;OR.stderr.write(`${d}${t}${R}
 `).length-1;this.output.write(Ld.move(-999,E*-1))}render(){let E=XF(this._render(this)??"",CF.stdout.columns,{hard:!0,trim:!1});if(E===this._prevFrame)return;if(this.state==="initial")this.output.write(Ld.hide);else{let T=q8(this._prevFrame,E);if(this.restoreCursor(),T&&T?.length===1){let _=T[0];this.output.write(Ld.move(0,_)),this.output.write(kD.lines(1));let r=E.split(`
 `);this.output.write(r[_]),this._prevFrame=E,this.output.write(Ld.move(0,r.length-_-1));return}if(T&&T?.length>1){let _=T[0];this.output.write(Ld.move(0,_)),this.output.write(kD.down());let t=E.split(`
 `).slice(_);this.output.write(t.join(`
-`)),this._prevFrame=E;return}this.output.write(kD.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function v8(E,T){if(E===void 0)return 0;if(T.length===0)return 0;let r=T.findIndex((t)=>t.value===E);return r!==-1?r:0}function l8(E,T){return(T.label??String(T.value)).toLowerCase().includes(E.toLowerCase())}function i8(E,T){if(!T)return;if(E)return T;return T[0]}class a8 extends aD{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#_="";#r;#T;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return YO.inverse(YO.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[T,..._]=this.userInput.slice(this._cursor);return`${E}${YO.inverse(T)}${_.join("")}`}get options(){if(typeof this.#T==="function")return this.#T();return this.#T}constructor(E){super(E);this.#T=E.options;let T=this.options;this.filteredOptions=[...T],this.multiple=E.multiple===!0,this.#r=E.filter??l8;let _;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)_=E.initialValue;else _=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)_=[this.options[0].value];if(_)for(let r of _){let t=T.findIndex((d)=>d.value===r);if(t!==-1)this.toggleSelected(r),this.#E=t}this.focusedValue=this.options[this.#E]?.value,this.on("key",(r,t)=>this.#t(r,t)),this.on("userInput",(r)=>this.#d(r))}_isActionKey(E,T){return E==="\t"||this.multiple&&this.isNavigating&&T.name==="space"&&E!==void 0&&E!==""}#t(E,T){let _=T.name==="up",r=T.name==="down",t=T.name==="return";if(_||r){if(this.#E=Math.max(0,Math.min(this.#E+(_?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(t)this.value=i8(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(T.name==="tab"||this.isNavigating&&T.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((T)=>T!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#d(E){if(E!==this.#_){this.#_=E;let T=this.options;if(E)this.filteredOptions=T.filter((_)=>this.#r(E,_));else this.filteredOptions=[...T];if(this.#E=v8(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class m8 extends aD{options;cursor=0;#E;getGroupItems(E){return this.options.filter((T)=>T.group===E)}isGroupSelected(E){let T=this.getGroupItems(E),_=this.value;if(_===void 0)return!1;return T.every((r)=>_.includes(r.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let T=String(E.value),_=this.getGroupItems(T);if(this.isGroupSelected(T))this.value=this.value.filter((r)=>_.findIndex((t)=>t.value===r)===-1);else this.value=[...this.value,..._.map((r)=>r.value)];this.value=Array.from(new Set(this.value))}else{let T=this.value.includes(E.value);this.value=T?this.value.filter((_)=>_!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:T}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(T).flatMap(([_,r])=>[{value:_,group:!0,label:_},...r.map((t)=>({...t,group:_}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:_})=>_===E.cursorAt),this.#E?0:1),this.on("cursor",(_)=>{switch(_){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var s8=d8();var yT=(E,T)=>s8?E:T,wp=yT("◆","*"),Cp=yT("■","x"),Xp=yT("▲","x"),Jp=yT("◇","o"),zp=yT("┌","T"),p8=yT("│","|"),Fp=yT("└","—"),jp=yT("●",">"),yp=yT("○"," "),Pp=yT("◻","[•]"),Bp=yT("◼","[+]"),Wp=yT("◻","[ ]"),Hp=yT("▪","•"),fp=yT("─","-"),Yp=yT("╮","+"),Gp=yT("├","+"),Qp=yT("╯","+"),Mp=yT("●","•"),Vp=yT("◆","*"),Kp=yT("▲","!"),Zp=yT("■","x");var gp={light:yT("─","-"),heavy:yT("━","="),block:yT("█","#")};function o8(){return`${YO.gray(p8)}  `}var qp=o8();var mD="0.7.78";ME();import{existsSync as d$}from"node:fs";import{mkdir as AQ,writeFile as gF}from"node:fs/promises";function R$(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(T)=>{if(b("Initializing ts-cloud Project"),d$("cloud.config.ts")){if(!await eE("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let _=T?.name||await LT("Project name","my-app"),r=T?.mode||await MO("Select deployment mode",["serverless","server"]),t=T?.region||await MO("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),d=new l("Creating configuration file...");d.start();let R=`import { defineConfig } from '@ts-cloud/core'
+`)),this._prevFrame=E;return}this.output.write(kD.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function v8(E,T){if(E===void 0)return 0;if(T.length===0)return 0;let r=T.findIndex((t)=>t.value===E);return r!==-1?r:0}function l8(E,T){return(T.label??String(T.value)).toLowerCase().includes(E.toLowerCase())}function i8(E,T){if(!T)return;if(E)return T;return T[0]}class a8 extends aD{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#_="";#r;#T;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return YO.inverse(YO.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[T,..._]=this.userInput.slice(this._cursor);return`${E}${YO.inverse(T)}${_.join("")}`}get options(){if(typeof this.#T==="function")return this.#T();return this.#T}constructor(E){super(E);this.#T=E.options;let T=this.options;this.filteredOptions=[...T],this.multiple=E.multiple===!0,this.#r=E.filter??l8;let _;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)_=E.initialValue;else _=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)_=[this.options[0].value];if(_)for(let r of _){let t=T.findIndex((d)=>d.value===r);if(t!==-1)this.toggleSelected(r),this.#E=t}this.focusedValue=this.options[this.#E]?.value,this.on("key",(r,t)=>this.#t(r,t)),this.on("userInput",(r)=>this.#d(r))}_isActionKey(E,T){return E==="\t"||this.multiple&&this.isNavigating&&T.name==="space"&&E!==void 0&&E!==""}#t(E,T){let _=T.name==="up",r=T.name==="down",t=T.name==="return";if(_||r){if(this.#E=Math.max(0,Math.min(this.#E+(_?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(t)this.value=i8(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(T.name==="tab"||this.isNavigating&&T.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((T)=>T!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#d(E){if(E!==this.#_){this.#_=E;let T=this.options;if(E)this.filteredOptions=T.filter((_)=>this.#r(E,_));else this.filteredOptions=[...T];if(this.#E=v8(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class m8 extends aD{options;cursor=0;#E;getGroupItems(E){return this.options.filter((T)=>T.group===E)}isGroupSelected(E){let T=this.getGroupItems(E),_=this.value;if(_===void 0)return!1;return T.every((r)=>_.includes(r.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let T=String(E.value),_=this.getGroupItems(T);if(this.isGroupSelected(T))this.value=this.value.filter((r)=>_.findIndex((t)=>t.value===r)===-1);else this.value=[...this.value,..._.map((r)=>r.value)];this.value=Array.from(new Set(this.value))}else{let T=this.value.includes(E.value);this.value=T?this.value.filter((_)=>_!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:T}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(T).flatMap(([_,r])=>[{value:_,group:!0,label:_},...r.map((t)=>({...t,group:_}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:_})=>_===E.cursorAt),this.#E?0:1),this.on("cursor",(_)=>{switch(_){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var s8=d8();var yT=(E,T)=>s8?E:T,wp=yT("◆","*"),Cp=yT("■","x"),Xp=yT("▲","x"),Jp=yT("◇","o"),zp=yT("┌","T"),p8=yT("│","|"),Fp=yT("└","—"),jp=yT("●",">"),yp=yT("○"," "),Pp=yT("◻","[•]"),Bp=yT("◼","[+]"),Wp=yT("◻","[ ]"),Hp=yT("▪","•"),fp=yT("─","-"),Yp=yT("╮","+"),Gp=yT("├","+"),Qp=yT("╯","+"),Mp=yT("●","•"),Vp=yT("◆","*"),Kp=yT("▲","!"),Zp=yT("■","x");var gp={light:yT("─","-"),heavy:yT("━","="),block:yT("█","#")};function o8(){return`${YO.gray(p8)}  `}var qp=o8();var mD="0.7.79";ME();import{existsSync as d$}from"node:fs";import{mkdir as AQ,writeFile as gF}from"node:fs/promises";function R$(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(T)=>{if(b("Initializing ts-cloud Project"),d$("cloud.config.ts")){if(!await eE("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let _=T?.name||await LT("Project name","my-app"),r=T?.mode||await MO("Select deployment mode",["serverless","server"]),t=T?.region||await MO("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),d=new l("Creating configuration file...");d.start();let R=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -9624,7 +9624,7 @@ Resources to create: ${j}`);let H={};for(let f of Object.values(N.Resources||{})
 No changes detected - infrastructure is up to date`);return}if(e(`
 Changes detected:
 `),I.length>0){Z(`Resources to add (${I.length}):`);for(let F of I){let j=c[F].Type;e(`  + ${F} (${j})`)}console.log()}if(w.length>0){Y(`Resources to remove (${w.length}):`);for(let F of w){let j=O[F].Type;e(`  - ${F} (${j})`)}console.log()}if(z.length>0){tE(`Resources to modify (${z.length}):`);for(let F of z){let j=c[F].Type;e(`  ~ ${F} (${j})`)}console.log()}e("Summary:"),e(`  - Add: ${I.length}`),e(`  - Remove: ${w.length}`),e(`  - Modify: ${z.length}`),e("\nRun `cloud deploy` to apply these changes")}catch(_){Y(`Diff failed: ${_.message}`)}})}ME();await aE();wN();KL();function VR(E,T=0){let _=Number(E);return Number.isFinite(_)?_:T}function LC(E){return VR(E)*1024}function qb(E){let T=E?.date?.trim(),_=E?.time?.trim();if(!T||!_)return null;let r=new Date(`${T}T${_}Z`);return Number.isFinite(r.getTime())?r.toISOString():null}function xb(E,T,_){let r;try{r=JSON.parse(E)}catch{return[]}let t=(r?.sysstat?.hosts??[]).flatMap((R)=>R.statistics??[]),d=[];for(let R of t){let h=qb(R.timestamp);if(!h)continue;let S=new Date(h).getTime();if(S<T.getTime()||S>_.getTime())continue;let N=R["cpu-load"]?.find((L)=>L.cpu==="all")??R["cpu-load"]?.[0],A=VR(N?.idle,100);d.push({timestamp:h,cpuUsedPercent:Math.max(0,Math.min(100,100-A)),cpuUserPercent:VR(N?.user),cpuSystemPercent:VR(N?.system),cpuIowaitPercent:VR(N?.iowait),memoryUsedPercent:VR(R.memory?.["memused-percent"]),memoryUsedBytes:LC(R.memory?.memused),memoryAvailableBytes:LC(R.memory?.avail),swapUsedPercent:VR(R.memory?.["swpused-percent"]),swapUsedBytes:LC(R.memory?.swpused)})}return d.sort((R,h)=>R.timestamp.localeCompare(h.timestamp))}function bb(E){return Object.fromEntries(Object.entries(E.time_series??{}).map(([T,_])=>[T,(_.values??[]).map(([r,t])=>({timestamp:new Date(Number(r)*1000).toISOString(),value:VR(t,Number.NaN)})).filter((r)=>Number.isFinite(r.value))]))}function HW(E){return E.length?E.reduce((T,_)=>T+_,0)/E.length:null}function OC(E){return E.length?Math.max(...E):null}function kb(E){return E.length?Math.min(...E):null}async function fW(E){let[T,_]=await Promise.all([E.client.getServerMetrics(E.serverId,{types:["cpu","disk","network"],start:E.from,end:E.to,step:E.step}),ir(E.remote.host,"LC_ALL=C sadf -j -- -u -r -S",E.remote).catch(()=>"")]),r=xb(_,E.from,E.to),t=bb(T),R=(t.cpu??[]).map((L)=>Math.max(0,Math.min(100,L.value/Math.max(1,E.cores)))),h=r.map((L)=>L.cpuUsedPercent),S=R.length?R:h,N=r.map((L)=>L.memoryUsedPercent),A=r.map((L)=>L.swapUsedPercent);return{from:E.from.toISOString(),to:E.to.toISOString(),cores:E.cores,host:r,provider:t,summary:{cpuAveragePercent:HW(S),cpuPeakPercent:OC(S),memoryAveragePercent:HW(N),memoryPeakPercent:OC(N),memoryMinimumAvailableBytes:kb(r.map((L)=>L.memoryAvailableBytes)),swapPeakPercent:OC(A)}}}jC();BC();fC();MC();Ve();await Yt([zC(),bR()]);import{createHash as z3}from"node:crypto";var vW=async(E)=>{let T=Bun.spawn(E,{stdout:"pipe",stderr:"pipe"}),[_,r,t]=await Promise.all([T.exited,new Response(T.stdout).text(),new Response(T.stderr).text()]);return{code:_,stdout:r,stderr:t}};class lW{async scan(E,T){let _=await vW(["ssh-keyscan","-T","10","-p",String(T),"-t","ed25519",E]),r=_.stdout.split(`
-`).find((t)=>t&&!t.startsWith("#"))?.trim().split(/\s+/);if(_.code!==0||!r?.[1]||!r[2])throw Error(`SSH host-key scan failed: ${_.stderr.trim()||"no key returned"}`);return{algorithm:r[1],key:r[2]}}async exec(E,T){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return vW(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,T])}}var F3=(E)=>`SHA256:${z3("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,j3=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class Gd{provider;transport;discoverer;constructor(E,T=new lW,_){this.provider=E;this.transport=T;this.discoverer=_}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let T=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:T.algorithm,hostKeyFingerprint:F3(T.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let T=await this.transport.exec(E,j3);if(T.code!==0)throw Error(`Fleet validation failed: ${T.stderr.trim()||T.code}`);try{return JSON.parse(T.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,T){let _=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${T.length}`);if(_.code!==0)throw Error(`Fleet bootstrap failed: ${_.stderr.trim()||_.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function iW(E,T){return{"fleet.bootstrap":async(_)=>{let r=_.operation.input&&typeof _.operation.input==="object"&&!Array.isArray(_.operation.input)?_.operation.input:{},t=E.get(String(r.serverId??""));if(!t)throw Error("Queued fleet server was not found.");let d=T.find((S)=>S.provider===t.provider);if(!d)throw Error(`No ${t.provider} fleet driver is configured.`);let R=Array.isArray(r.steps)?r.steps.map(String):[];if(_.checkpoint("preflight","Rechecking pinned trust and healthy validation."),t.trustState!=="pinned"||!t.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");_.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let h=await d.bootstrap(t,R);return E.update(t.id,{bootstrapVersion:h.version,status:"ready"}),_.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:t.id,bootstrapVersion:h.version,steps:R.length}}}}var nt=(E)=>E==null?void 0:String(E),qh=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},VC=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:nt(E.provider_id),region:nt(E.region),zone:nt(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:nt(E.host_key_algorithm),hostKeyFingerprint:nt(E.host_key_fingerprint),pendingHostKey:nt(E.pending_host_key),roles:qh(E.roles,[]),labels:qh(E.labels,{}),taints:qh(E.taints,[]),capacity:qh(E.capacity,{}),usage:qh(E.usage,{}),capabilities:qh(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:qh(E.validation,void 0),bootstrapVersion:nt(E.bootstrap_version),heartbeatAt:nt(E.heartbeat_at),lastSeenAt:nt(E.last_seen_at),archivedAt:nt(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class vt{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}get(E){let T=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return T?VC(T):void 0}list(E,T=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(VC).filter((_)=>T||_.status!=="archived")}findProvider(E,T,_){let r=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,T,_);return r?VC(r):void 0}create(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,_,_]),this.get(T)}update(E,T){let _=this.get(E);if(!_)throw Error("Server was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[r.name,r.providerId??null,r.region??null,r.zone??null,r.endpoint,r.sshUser,r.sshPort,r.credentialRef,r.hostKeyAlgorithm??null,r.hostKeyFingerprint??null,r.pendingHostKey??null,JSON.stringify(r.roles),JSON.stringify(r.labels),JSON.stringify(r.taints),JSON.stringify(r.capacity),JSON.stringify(r.usage),JSON.stringify(r.capabilities),r.status,r.trustState,JSON.stringify(r.validation??{}),r.bootstrapVersion??null,r.heartbeatAt??null,r.lastSeenAt??null,r.archivedAt??null,t,E]),this.get(E)}}var y3=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class bL{store;drivers;now;queue;constructor(E,T,_,r=()=>new Date){this.store=E;this.drivers=T;this.now=r;this.queue=_??new lE(E.control)}driver(E){let T=this.drivers.find((_)=>_.provider===E);if(!T)throw Error(`No ${E} fleet driver is configured.`);return T}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!y3.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let T=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(T)return this.store.update(T.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let _=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),r=this.driver(E.provider);return this.store.create({...E,resourceId:_.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:r.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let _=await this.driver(T.provider).test(T);if(!_.reachable)return this.store.update(E,{status:"unreachable"});if(T.hostKeyFingerprint&&T.hostKeyFingerprint!==_.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:_.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:_.hostKeyAlgorithm,hostKeyFingerprint:_.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,T){let _=this.store.get(E);if(!_||_.pendingHostKey!==T)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:T,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let T=this.store.get(E);if(!T||T.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let _=await this.driver(T.provider).validate(T),r=[];if(!["x64","arm64","x86_64","aarch64"].includes(_.arch??""))r.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let R of["curl","tar"])if(!_.tools?.[R])r.push({code:`tool.${R}`,severity:"error",message:`${R} is missing.`,remediation:`Install ${R} before bootstrap.`});if(Math.abs(_.timeSkewSeconds??0)>60)r.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!_.dnsOk)r.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let t={valid:!r.some((R)=>R.severity==="error"),facts:_,findings:r,validatedAt:this.now().toISOString(),validatorVersion:"1"},d={cpu:_.cpuCores??0,memoryBytes:_.memoryBytes??0,diskBytes:_.diskBytes??0};return this.store.update(E,{validation:t,capacity:d,status:t.valid?"ready":"degraded"})}bootstrap(E,T=!1){let _=this.store.get(E);if(!_?.validation?.valid)throw Error("A healthy validation report is required.");let r=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!T)return{preview:!0,steps:r};let t=this.queue.enqueue({projectId:_.projectId,resourceId:_.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:r},lockKey:`server:${E}`,providerKey:_.provider}).operation;return{preview:!1,steps:r,operation:t}}heartbeat(E,T){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let r=this.now().toISOString();return this.store.update(E,{usage:T.usage,capabilities:T.capabilities??_.capabilities,heartbeatAt:r,lastSeenAt:r,status:_.status==="draining"||_.status==="drained"?_.status:"ready"})}drain(E,T=!1){return this.store.update(E,{status:T?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,T){let _=this.store.get(E);if(!_||T!==_.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function P3(){let E=await o(),T=iE(process.cwd(),E),_=new vt(T.store),r=new bL(_,[new Gd("aws"),new Gd("hetzner"),new Gd("ssh")]);return{controlPlane:T,store:_,service:r}}async function Qd(E){let T=await P3();try{return await E(T)}finally{T.controlPlane.store.close()}}var xh=(E,T)=>{let _=E.store.list(E.controlPlane.project.id).find((r)=>r.id===T||r.name===T);if(!_)throw Error(`Server ${T} was not found.`);return _},sr=(E)=>{Y(E instanceof Error?E.message:String(E)),process.exitCode=1};function KC(E,T){let _=Number.parseInt(E??"",10);return Number.isFinite(_)&&_>=0?_:T}function B3(E="3h"){let T=E.match(/^(\d+)(m|h)$/);if(!T)throw Error("--range must use minutes or hours, for example 30m or 3h.");let _=Number(T[1])*(T[2]==="h"?3600000:60000);if(_<300000||_>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return _}function kL(E,T="%"){return E==null?"unavailable":`${E.toFixed(1)}${T}`}async function W3(E,T){let _=await o();if(_.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let r=T.env??process.env.CLOUD_ENV??"production",t=DT(_,r),d=await Dt(t);if(!d?.serverId)throw Error(`No pinned Hetzner server was found for ${t}.`);if(![d.serverName,String(d.serverId),d.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${d.serverName}.`);let R=$N(_),h=new Wd({apiToken:MR(R.apiToken,_)}),S=await h.getServer(d.serverId),N=d.publicIp??S.public_net.ipv4?.ip;if(!N)throw Error(`Server ${S.name} has no public IPv4 address.`);let A=new Date,L=new Date(A.getTime()-B3(T.range)),O=Math.min(3600,Math.max(60,KC(T.step,60))),c=await fW({client:h,serverId:S.id,cores:Math.max(1,Number(S.server_type.cores)||1),from:L,to:A,step:O,remote:{host:N,user:d.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15}});if(T.json){console.log(JSON.stringify({schemaVersion:1,server:S.name,result:c},null,2));return}EE(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[S.name,`${c.from} to ${c.to}`,`${kL(c.summary.cpuAveragePercent)} / ${kL(c.summary.cpuPeakPercent)}`,`${kL(c.summary.memoryAveragePercent)} / ${kL(c.summary.memoryPeakPercent)}`,c.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(c.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,kL(c.summary.swapPeakPercent)]])}function aW(E){let T=E.targetType.prices?.find((_)=>_.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:T?{hourlyNet:T.price_hourly.net,hourlyGross:T.price_hourly.gross,monthlyNet:T.price_monthly.net,monthlyGross:T.price_monthly.gross}:void 0}}function H3(E){let T=aW(E);EE(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${T.serverName} (${T.serverId})`,T.location,`${T.from} -> ${T.to}`,T.capacityAvailable?"available":"waiting",`${T.target.cores??0} / ${T.target.memoryGb??0} GB / ${T.target.diskGb??0} GB`,T.price?.monthlyGross??T.price?.monthlyNet??"not reported"]])}async function f3(E,T,_){let r=await o();if(r.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let t=_.env??process.env.CLOUD_ENV??"production",d=DT(r,t),R=await Dt(d),h=$N(r),S=new Wd({apiToken:MR(h.apiToken,r)}),A=R&&(E===R.serverName||E===String(R.serverId)||E===R.stackName)?await S.getServer(R.serverId):(await S.listServers()).find((f)=>f.name===E||String(f.id)===E);if(!A)throw Error(`Hetzner server ${E} was not found.`);if(R?.serverId&&R.serverId!==A.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${R.serverId}.`);let L=Hd(T),O=_.upgradeDisk!==!1,c=await xL(S,A.id,L,O);if(_.json)console.log(JSON.stringify({schemaVersion:1,plan:aW(c)},null,2));else H3(c);if(!_.apply){if(!_.json)e(`Preview only. Re-run with --apply --confirm ${A.name} to execute.`);return}if(_.confirm!==A.name)throw Error(`Resize requires --confirm ${A.name}.`);let U=R?.publicIp??A.public_net.ipv4?.ip;if(!U)throw Error(`Server ${A.name} has no public IPv4 address for verification.`);let $={host:U,user:R?.sshUser??h.sshUser,identityFile:h.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},I=await GC(d),w=new Date().toISOString(),z={schemaVersion:1,operationId:I?.targetType===L&&I.serverId===A.id?I.operationId:crypto.randomUUID(),stackName:d,serverId:A.id,serverName:A.name,sourceType:c.currentType.name,targetType:L,upgradeDisk:O,phase:"planning",status:"running",attempts:I?.targetType===L?I.attempts:0,startedAt:I?.targetType===L?I.startedAt:w,updatedAt:w,manifest:I?.targetType===L?I.manifest:void 0};await Yd(z);let F=KC(_.pollSeconds,900)*1000,j=KC(_.maxWaitMinutes,0)*60000,H=Date.now();for(;;){let f=await xL(S,A.id,L,O);if(!f.capacityAvailable&&!f.alreadyComplete){if(z={...z,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await Yd(z),!_.wait){if(!_.json)e(`${L} has no capacity in ${f.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(j>0&&Date.now()-H>=j)throw Error(`Timed out waiting for ${L} capacity in ${f.location}.`);if(!_.json)e(`Waiting ${Math.round(F/1000)} seconds for ${L} capacity...`);await Bun.sleep(F);continue}let Q=await QC(d);try{let K=await(async()=>{try{return z={...z,status:"running",attempts:z.attempts+1,updatedAt:new Date().toISOString()},await Yd(z),await PC({client:S,serverId:A.id,targetType:L,upgradeDisk:O,resumeFromOff:z.phase==="shutting-down"||z.phase==="resizing"||z.phase==="powering-on"||z.phase==="verifying",manifest:z.manifest,hooks:{preflight:async()=>{let x=await WC($);return z={...z,manifest:x,updatedAt:new Date().toISOString()},await Yd(z),x},afterBoot:async(x,k,v,TE)=>HC($,k,v,TE),onPhase:async(x,k)=>{if(z={...z,phase:x,status:x==="waiting-capacity"?"waiting-capacity":x==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await Yd(z),!_.json)e(`${x}${k?` ${JSON.stringify(k)}`:""}`)}}})}finally{await Q()}})();if(z={...z,status:K.status==="completed"||K.status==="already-complete"?"completed":K.status==="recovered"?"recovered":"waiting-capacity",lastError:K.status==="recovered"?K.error:void 0,updatedAt:new Date().toISOString()},await Yd(z),_.json)console.log(JSON.stringify({schemaVersion:1,result:K},null,2));else if(K.status==="completed"||K.status==="already-complete")Z(`${A.name} is on ${L} and passed full post-boot verification.`);else if(K.status==="recovered"&&K.retryable&&_.wait){e(`Capacity race recovered safely. Waiting ${Math.round(F/1000)} seconds before retry.`),await Bun.sleep(F);continue}else if(K.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${K.error}`);return}catch(K){throw z={...z,status:"failed",lastError:K instanceof Error?K.message:String(K),updatedAt:new Date().toISOString()},await Yd(z),K}}}async function Y3(E,T){let _=await o();if(_.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let r=T.env??process.env.CLOUD_ENV??"production",t=DT(_,r),d=await Dt(t);if(!d?.serverId)throw Error(`No pinned Hetzner server was found for ${t}.`);if(![d.serverName,String(d.serverId),d.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${d.serverName}.`);let R=$N(_),h=new Wd({apiToken:MR(R.apiToken,_)}),S=await h.getServer(d.serverId),N=d.publicIp??S.public_net.ipv4?.ip;if(!N)throw Error(`Server ${S.name} has no public IPv4 address.`);let A=Qe(_);if(T.json)console.log(JSON.stringify({schemaVersion:1,server:S.name,plan:A},null,2));else EE(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[S.name,A.firewallPorts.join(","),A.monitoring?"on":"off",A.autoUpdates?"on":"off",`${A.swapGb} GB`,"disabled"]]);if(!T.apply){if(!T.json)e(`Preview only. Re-run with --apply --confirm ${S.name} to execute.`);return}if(T.confirm!==S.name)throw Error(`Optimization requires --confirm ${S.name}.`);let L={host:N,user:d.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15},O=await jN(L),c=O.routeProbes.filter((v)=>!v.ok),U=_.infrastructure?.compute,$=hr(U)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,I=O.failedUnits.filter((v)=>!$.has(v));if(I.length>0)throw Error(`Preflight found failed services: ${I.join(", ")}`);if(c.length>0)throw Error(`Preflight found unhealthy routes: ${c.map((v)=>v.domain).join(", ")}`);let w=hr(U)?[]:Object.values(_.sites??{}).flatMap((v)=>typeof v?.port==="number"&&![80,443].includes(v.port)?[v.port]:[]),z=CN({allowSsh:U?.allowSsh!==!1,sitePorts:w,allowedPorts:U?.firewall?.allowedPorts}),F=(d.firewallId?(await h.listFirewalls()).find((v)=>v.id===d.firewallId):void 0)??(await h.listFirewalls()).find((v)=>v.name===`${_.project.slug}-${r}-app-fw`);if(!F)throw Error(`Managed firewall for ${S.name} was not found.`);let j=await h.setFirewallRules(F.id,z);await Promise.all(j.map((v)=>h.waitForAction(v.id))),await CC(_,L);let[H,f]=await Promise.all([jN(L),XC(L)]),Q=JC(A,f),K=KW(O,H),x=H.routeProbes.filter((v)=>!v.ok);if(K.stoppedServices.length>0)Q.push(`services stopped: ${K.stoppedServices.join(", ")}`);if(K.changedRouteFragments.length>0)Q.push(`route fragments changed: ${K.changedRouteFragments.join(", ")}`);if(K.missingRouteIds.length>0)Q.push(`routes disappeared: ${K.missingRouteIds.join(", ")}`);if(K.changedReleaseLinks.length>0)Q.push(`release links changed: ${K.changedReleaseLinks.join(", ")}`);if(K.missingData.length>0)Q.push(`databases or volumes disappeared: ${K.missingData.join(", ")}`);if(x.length>0)Q.push(`unhealthy routes: ${x.map((v)=>v.domain).join(", ")}`);if(Q.length>0)throw Error(`Host optimization verification failed: ${Q.join("; ")}`);let k={serverId:S.id,serverName:S.name,services:H.runningServices.length,routes:H.routeIds.length,healthyDomains:H.routeProbes.length,releaseLinks:H.releaseLinks.length,databasesAndVolumes:H.dataCatalog.length,report:f};if(T.json)console.log(JSON.stringify({schemaVersion:1,result:k},null,2));else Z(`${S.name} passed full host, rpx route, service, release, and data verification.`)}function ZC(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(T,_)=>{try{await Qd(async(r)=>{let t=T?[xh(r,T)]:r.store.list(r.controlPlane.project.id),d=t.flatMap((R)=>Object.entries(R.capabilities).map(([h,S])=>({server:R.name,provider:R.provider,action:h,...S})));if(_.json)console.log(JSON.stringify({schemaVersion:1,targets:d},null,2));else EE(["Server","Provider","Action","Support","Explanation"],d.map((R)=>[R.server,R.provider,R.action,R.supported?"supported":"unsupported",R.reason??"—"]))})}catch(r){sr(r)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(T,_,r)=>{try{await f3(T,_,r)}catch(t){sr(t)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(T,_)=>{try{await Y3(T,_)}catch(r){sr(r)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(T,_)=>{try{await W3(T,_)}catch(r){sr(r)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(T)=>{try{await Qd(async(_)=>{let r=_.store.list(_.controlPlane.project.id);if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],r.map((t)=>[t.name,t.providerId??"—",`${t.provider} / ${t.region??"external"}`,`${t.status} / ${t.trustState}`,t.roles.join(","),`${t.capacity.cpu??0} / ${t.capacity.memoryBytes??0}`,t.heartbeatAt??"never"]))})}catch(_){sr(_)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(T,_)=>{try{await Qd(async(r)=>{let t=_.provider;if(!["aws","hetzner","ssh"].includes(t)||!_.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let d=r.service.enroll({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:T,provider:t,providerId:_.providerId,endpoint:_.endpoint,sshUser:_.user??"deploy",credentialRef:_.credentialRef??"secret://fleet/agent",region:_.region,roles:String(_.roles??"application").split(","),labels:Object.fromEntries(String(_.labels??"").split(",").map((R)=>R.split("=")).filter((R)=>R[0]&&R[1]))});Z(`Enrolled ${d.name} as ${d.id}; no remote mutation was performed.`)})}catch(r){sr(r)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(T,_)=>{try{await Qd(async(r)=>{let t=xh(r,T);if(t=await r.service.test(t.id),t.trustState==="rotation_pending"){if(!_.acceptHostKey)throw Error(`Host key changed to ${t.pendingHostKey}; review it first.`);t=r.service.reviewHostKey(t.id,_.acceptHostKey)}let d=await r.service.validate(t.id);if(_.json)console.log(JSON.stringify(d.validation,null,2));else EE(["Severity","Code","Finding","Remediation"],(d.validation?.findings??[]).map((R)=>[R.severity,R.code,R.message,R.remediation??"—"]));if(!d.validation?.valid)process.exitCode=1})}catch(r){sr(r)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(T,_)=>{try{await Qd(async(r)=>{let t=r.service.bootstrap(xh(r,T).id,!!_.apply);if(t.preview)EE(["Step"],t.steps.map((d)=>[d]));else Z(`Bootstrap queued: ${t.operation?.id}`)})}catch(r){sr(r)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(T,_)=>{try{await Qd(async(r)=>Z(r.service.drain(xh(r,T).id,!!_.complete).status))}catch(r){sr(r)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(T)=>{try{await Qd(async(_)=>{_.service.uncordon(xh(_,T).id),Z(`Uncordoned ${T}.`)})}catch(_){sr(_)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(T,_)=>{try{await Qd(async(r)=>{r.service.archive(xh(r,T).id,_.confirm??""),Z(`Archived ${T}; provider infrastructure was not terminated.`)})}catch(r){sr(r)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(T)=>{try{await Qd(async(_)=>{let r=xh(_,T);if(r.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let t=Bun.spawn(["ssh","-p",String(r.sshPort),"-o","StrictHostKeyChecking=yes",`${r.sshUser}@${r.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),d=await t.exited;if(d)process.exitCode=d})}catch(_){sr(_)}});for(let[T,_]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(T,_).action(async(...r)=>lr(T.split(" ")[0],{target:String(r[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}ME();var $t=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},Sr=(E)=>E==null?void 0:String(E),pW=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),PN=(E={})=>({...pW(),...E});function mW(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:Sr(E.region),architecture:Sr(E.architecture),labels:$t(E.labels,{}),requiredServerLabels:$t(E.required_server_labels,{}),toleratedTaints:$t(E.tolerated_taints,[]),capacity:PN($t(E.capacity,{})),reserved:$t(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:Sr(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function sW(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Sr(E.environment_id),resourceId:String(E.resource_id),releaseId:Sr(E.release_id),poolId:String(E.pool_id),serverId:Sr(E.server_id),purpose:String(E.purpose),requirements:$t(E.requirements,{}),decision:$t(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function G3(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:Sr(E.resource_id),poolId:String(E.pool_id),placementId:Sr(E.placement_id),operationId:Sr(E.operation_id),sourceSha:String(E.source_sha),buildSpec:$t(E.build_spec,{}),credentialPolicy:$t(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:Sr(E.workspace),cacheKey:Sr(E.cache_key),artifactUri:Sr(E.artifact_uri),artifactDigest:Sr(E.artifact_digest),status:String(E.status),cleanupAt:Sr(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class uL{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}createPool(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(PN(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,_,_]),this.getPool(T)}getPool(E){let T=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return T?mW(T):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(mW)}updatePool(E,T){let _=this.getPool(E);if(!_)throw Error("Capacity pool was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.reserved),JSON.stringify(r.capacity),r.concurrency,t,E]),this.getPool(E)}addMember(E,T,_={}){let r=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,T,JSON.stringify(_),r,r])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((T)=>({serverId:String(T.server_id),status:String(T.status),capacityOverride:$t(T.capacity_override,{})}))}memberStatus(E,T,_){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[_,this.now().toISOString(),E,T])}listPlacements(E,T){let _=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(sW);return T?.length?_.filter((r)=>T.includes(r.status)):_}getPlacement(E){let T=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return T?sW(T):void 0}activeUsage(E,T){let _=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),r=T?_.filter((t)=>String(t.server_id)===T):_;return{resources:r.reduce((t,d)=>{let R=PN($t(d.resources,{}));for(let h of Object.keys(t))t[h]+=R[h];return t},pW()),count:r.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let T=this.id(),_=this.id(),r=this.now().toISOString(),t=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[T,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,r,r]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[_,T,E.decision.poolId,E.decision.serverId??null,JSON.stringify(PN(E.requirements.resources)),t,r,r]),this.getPlacement(T)})}transitionPlacement(E,T){if(!this.getPlacement(E))throw Error("Placement was not found.");let r=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[T,r,E]),["released","failed","blocked"].includes(T))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[r,E]);return this.getPlacement(E)}createBuild(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[T,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),_,_]),this.getBuild(T)}getBuild(E){let T=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return T?G3(T):void 0}updateBuild(E,T){let _=this.getBuild(E);if(!_)throw Error("Remote build was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[r.operationId??null,r.workspace??null,r.cacheKey??null,r.artifactUri??null,r.artifactDigest??null,r.status,r.cleanupAt??null,t,E]),this.getBuild(E)}}var Ze=["cpu","memoryBytes","diskBytes","gpu"],oW=(E,T={})=>Object.entries(T).every(([_,r])=>E[_]===r),Q3=(E,T,_)=>Object.fromEntries(Ze.map((r)=>[r,Math.max(0,E[r]-T[r]-(_[r]??0))])),M3=(E,T)=>Ze.every((_)=>E[_]>=(T[_]??0)),V3=(E,T)=>Ze.reduce((_,r)=>_+(T[r]??0)/(E[r]||1),0);class nL{store;fleet;constructor(E,T){this.store=E;this.fleet=T}poolCandidates(E,T,_){let r=[];for(let t of this.store.listPools(E)){if(t.id===_)continue;let d=[];if(t.status!=="active")d.push(`pool is ${t.status}`);if(t.purpose!==T.purpose)d.push(`purpose is ${t.purpose}`);if(T.region&&t.region!==T.region)d.push(`region is ${t.region??"unset"}`);if(T.architecture&&t.architecture!==T.architecture)d.push(`architecture is ${t.architecture??"unset"}`);if(!oW(t.labels,T.labels))d.push("pool labels do not match");if(t.backend==="server"){let R=this.store.members(t.id);if(!R.length)r.push(this.decision(t,void 0,T,[...d,"pool has no servers"]));for(let h of R){let S=this.fleet.get(h.serverId),N=[...d];if(!S)N.push("server is missing");else this.serverReasons(t,S,h.status,T,N);r.push(this.decision(t,S,T,N,h.capacityOverride))}}else r.push(this.decision(t,void 0,T,d))}return r.sort((t,d)=>Number(d.eligible)-Number(t.eligible)||t.score.cost-d.score.cost||t.score.spread-d.score.spread||t.score.fit-d.score.fit||t.poolName.localeCompare(d.poolName)||(t.serverId??"").localeCompare(d.serverId??""))}serverReasons(E,T,_,r,t){if(_!=="active")t.push(`member is ${_}`);if(T.status!=="ready")t.push(`server is ${T.status}`);if(!T.roles.includes(r.purpose==="build"?"build":r.purpose))t.push(`server lacks ${r.purpose} role`);if(!oW(T.labels,E.requiredServerLabels))t.push("server labels do not match pool selector");for(let d of T.taints)if(!E.toleratedTaints.includes(d))t.push(`taint ${d} is not tolerated`)}decision(E,T,_,r,t={}){let d=PN({...T?.capacity,...t}),R=T?Object.fromEntries(Ze.map((N)=>[N,Math.min(E.capacity[N],d[N])])):E.capacity,h=this.store.activeUsage(E.id,T?.id),S=Q3(R,h.resources,E.reserved);if(h.count>=E.maxWorkloads)r.push("workload limit reached");if(_.purpose==="build"&&h.count>=E.concurrency)r.push("build concurrency reached");if(!M3(S,_.resources))r.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:T?.id,eligible:r.length===0,reasons:r,available:S,score:{fit:V3(S,_.resources),spread:h.count,cost:E.costWeight}}}explain(E,T){return this.poolCandidates(E,T)}place(E){return this.store.control.transaction(()=>{let T=this.poolCandidates(E.projectId,E.requirements).find((_)=>_.eligible);if(!T)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((_)=>_.reasons).join("; ")}`);return this.store.reserve({...E,decision:T})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let T=this.store.updatePool(E,{status:"draining"}),_=[],r=[];for(let t of this.store.listPlacements(T.projectId,["reserved","active"]).filter((d)=>d.poolId===E)){if(t.stateful){r.push(this.store.transitionPlacement(t.id,"blocked"));continue}this.store.transitionPlacement(t.id,"moving");let d=this.place({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,releaseId:t.releaseId,requirements:t.requirements});_.push(this.activate(d.id)),this.store.transitionPlacement(t.id,"released")}return{pool:T,moved:_,blocked:r}}drainServer(E,T){this.store.memberStatus(E,T,"draining");let _=this.store.getPool(E);if(!_)throw Error("Capacity pool was not found.");let r=[],t=[];for(let d of this.store.listPlacements(_.projectId,["reserved","active"]).filter((R)=>R.poolId===E&&R.serverId===T)){if(d.stateful){t.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"moving");let R=this.poolCandidates(d.projectId,d.requirements).find((S)=>S.eligible);if(!R){t.push(this.store.transitionPlacement(d.id,"blocked"));continue}let h=this.store.reserve({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements,decision:R});r.push(this.activate(h.id)),this.store.transitionPlacement(d.id,"released")}return{moved:r,blocked:t}}reconcileFailure(E){let T=this.fleet.get(E);if(!T)throw Error("Server was not found.");let _=[],r=[];for(let t of this.store.listPlacements(T.projectId,["active"]).filter((d)=>d.serverId===E)){if(t.stateful||!t.autoReschedule){r.push(this.store.transitionPlacement(t.id,"blocked"));continue}this.store.transitionPlacement(t.id,"failed");let d=this.place({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,releaseId:t.releaseId,requirements:t.requirements});_.push(this.activate(d.id))}return{rescheduled:_,blocked:r}}}async function K3(){let E=await o(),T=iE(process.cwd(),E),_=new uL(T.store),r=new nL(_,new vt(T.store));return{controlPlane:T,store:_,service:r}}async function vL(E){let T=await K3();try{await E(T)}catch(_){Y(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}var ge=(E)=>Object.fromEntries(String(E??"").split(",").map((T)=>T.split("=")).filter((T)=>T[0]&&T[1])),EH=(E)=>Object.fromEntries(Object.entries(ge(E)).map(([T,_])=>[T,Number(_)]));function gC(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(T)=>vL((_)=>{let r=_.store.listPools(_.controlPlane.project.id);if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],r.map((t)=>[t.name,t.purpose,t.backend,`${t.region??"any"} / ${t.architecture??"any"}`,t.status,JSON.stringify(t.capacity),String(t.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(T,_)=>vL((r)=>{let{purpose:t,backend:d}=_;if(!["application","build","worker","monitoring","backup"].includes(t)||!["server","ecs","asg"].includes(d))throw Error("Unsupported pool purpose or backend.");let R=r.store.createPool({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:T,purpose:t,backend:d,region:_.region,architecture:_.arch,labels:ge(_.labels),requiredServerLabels:ge(_.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...EH(_.capacity)},maxWorkloads:Number(_.max),costWeight:1,concurrency:Number(_.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});Z(`Created ${R.name} (${R.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(T,_)=>vL((r)=>{let t=r.store.listPools(r.controlPlane.project.id).find((R)=>R.id===T||R.name===T),d=new vt(r.controlPlane.store).list(r.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!t||!d)throw Error("Pool or server was not found.");r.store.addMember(t.id,d.id),Z(`Attached ${d.name} to ${t.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(T)=>vL((_)=>{let r=_.service.explain(_.controlPlane.project.id,{purpose:T.purpose,resources:EH(T.resources),region:T.region,architecture:T.arch,labels:ge(T.labels)});if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],r.map((t)=>[t.poolName,t.serverId??"provider-managed",t.eligible?"yes":"no",JSON.stringify(t.available),`${t.score.fit.toFixed(2)} / ${t.score.spread} / ${t.score.cost}`,t.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(T)=>vL((_)=>{let r=_.store.listPools(_.controlPlane.project.id).find((d)=>d.id===T||d.name===T);if(!r)throw Error("Pool was not found.");let t=_.service.drainPool(r.id);Z(`Draining ${r.name}: moved ${t.moved.length}, blocked ${t.blocked.length} stateful placement(s).`)}))}ME();var Md=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},pr=(E)=>E==null?void 0:String(E),TH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:pr(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:Md(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:Md(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:pr(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),qC=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:pr(E.stack_id),stackRevision:pr(E.stack_revision),status:String(E.status),health:Md(E.health,{}),lastHealthyAt:pr(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),xC=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:Md(E.config,{}),status:String(E.status),checkpoint:pr(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:pr(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),bC=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:Md(E.weights,{}),desiredWeights:Md(E.desired_weights,{}),status:String(E.status),providerState:Md(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),_H=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:pr(E.operation_id),kind:String(E.kind),requestedRegion:pr(E.requested_region),revision:pr(E.revision),plan:Md(E.plan,[]),currentStep:pr(E.current_step),completedSteps:Md(E.completed_steps,[]),status:String(E.status),error:pr(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class lL{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((d)=>d.region)).size!==E.regions.length||E.regions.filter((d)=>d.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let T=E.regions.find((d)=>d.role==="primary"),_=this.id(),r=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[_,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,T.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),T.region,r,r]);for(let d of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),_,d.region,d.role,d.provider,r,r]);for(let d of E.dataPolicy.replicate)for(let R of E.regions)for(let h of E.regions.filter((S)=>S.region!==R.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),_,d,R.region,h.region,"{}",r,r]);let t=Object.fromEntries(E.regions.map((d)=>[d.region,d.region===T.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),_,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(t),JSON.stringify(t),r,r]),this.get(_)})}get(E){let T=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return T?TH(T):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(TH)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(qC)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(xC)}route(E){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return T?bC(T):void 0}updateTopology(E,T){let _=this.get(E);if(!_)throw Error("Regional topology was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[r.status,r.activeRegion,r.revision??null,JSON.stringify(r.regions),t,E]),this.get(E)}updateTarget(E,T){let _=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!_)throw Error("Regional target was not found.");let r=qC(_),t={...r,...T},d=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[t.role,t.stackId??null,t.stackRevision??null,t.status,JSON.stringify(t.health),t.lastHealthyAt??null,d,E]),qC(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,T){let _=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!_)throw Error("Replication channel was not found.");let r=xC(_),t={...r,...T},d=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[t.status,t.checkpoint??null,t.lagSeconds??null,t.lastVerifiedAt??null,d,E]),xC(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,T){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!_)throw Error("Traffic route was not found.");let r=bC(_),t={...r,...T},d=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(t.weights),JSON.stringify(t.desiredWeights),t.status,JSON.stringify(t.providerState),d,E]),bC(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[T,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),_,_]),this.execution(T)}execution(E){let T=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return T?_H(T):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(_H)}updateExecution(E,T){let _=this.execution(E);if(!_)throw Error("Regional execution was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[r.operationId??null,r.currentStep??null,JSON.stringify(r.completedSteps),r.status,r.error??null,t,E]),this.execution(E)}}class iL{store;queue;constructor(E,T){this.store=E;this.queue=T??new lE(E.control)}create(E){return this.store.create(E)}plan(E,T,_){if(!this.store.get(E))throw Error("Regional topology was not found.");let t=this.store.targets(E),d=this.store.channels(E);if(T==="rollout")return[...t.filter((R)=>R.role==="secondary").map((R)=>`apply:${R.region}`),...t.filter((R)=>R.role==="primary").map((R)=>`apply:${R.region}`),...d.map((R)=>`replicate:${R.kind}:${R.targetRegion}`),"traffic:activate"];if(T==="failover"||T==="failback")return[`health:${_}`,`replication:${_}`,`traffic:${_}`,`roles:${_}`];if(T==="destroy")return["traffic:drain",...t.filter((R)=>R.role==="secondary").map((R)=>`delete:${R.region}`),...t.filter((R)=>R.role==="primary").map((R)=>`delete:${R.region}`),"complete"];return["observe","repair"]}enqueue(E){let T=this.store.get(E.topologyId);if(!T)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!T.regions.some((d)=>d.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===T.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==T.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&T.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let _=this.plan(T.id,E.kind,E.targetRegion),r=this.store.createExecution({topologyId:T.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:_}),t=this.queue.enqueue({projectId:T.projectId,environmentId:T.environmentId,kind:`region.${E.kind}`,input:{executionId:r.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${T.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(r.id,{operationId:t.id}),{execution:this.store.execution(r.id),operation:t}}}var Z3=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function rH(E,T){let _=(N)=>{let A=T.find((L)=>L.provider===N.provider);if(!A)throw Error(`No ${N.provider} regional driver is configured.`);return A},r=(N,A,L)=>{N.throwIfCancellationRequested(),N.checkpoint(L,L),E.updateExecution(A.id,{status:"running",currentStep:L,completedSteps:[...E.execution(A.id).completedSteps,L]})},t=async(N,A)=>{let L=E.route(N.id);if(!L)throw Error("Regional traffic route was not found.");let O=E.targets(N.id).find((U)=>U.region===N.activeRegion)??E.targets(N.id)[0];if(!O)throw Error("Regional traffic target was not found.");E.updateRoute(L.id,{status:"applying",desiredWeights:A});let c=await _(O).applyTraffic({route:E.route(N.id),topology:N,weights:A});E.updateRoute(L.id,{status:Object.values(A).every((U)=>U===0)?"drained":"in_sync",weights:A,providerState:c.providerState})},d=async(N,A,L,O)=>{E.updateTopology(L.id,{status:"provisioning"});let c=A.revision,U=O.manifest??{},$=E.targets(L.id).sort((w,z)=>Number(w.role==="primary")-Number(z.role==="primary"));for(let w of $){r(N,A,`apply:${w.region}`),E.updateTarget(w.id,{status:"provisioning"});let z=await _(w).applyStack({target:w,revision:c,manifest:U,signal:N.signal}),F=await _(w).health({target:E.updateTarget(w.id,{stackId:z.stackId,stackRevision:c})});if(!F.healthy)throw Error(`Regional health gate failed in ${w.region}.`);E.updateTarget(w.id,{status:"ready",health:F.evidence,lastHealthyAt:new Date().toISOString()})}for(let w of E.channels(L.id)){r(N,A,`replicate:${w.kind}:${w.targetRegion}`),E.updateChannel(w.id,{status:"configuring"});let z=$.find((H)=>H.region===w.sourceRegion),F=await _(z).configureReplication({channel:w,topology:L}),j=await _(z).verifyReplication({channel:E.updateChannel(w.id,{checkpoint:F.checkpoint,lagSeconds:F.lagSeconds}),topology:L});if(!j.healthy||j.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${w.kind} replication to ${w.targetRegion} exceeds the RPO.`);E.updateChannel(w.id,{status:"in_sync",checkpoint:j.checkpoint,lagSeconds:j.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(N,A,"traffic:activate");let I=Object.fromEntries(L.regions.map((w)=>[w.region,w.region===L.activeRegion?100:0]));return await t(L,I),E.updateTopology(L.id,{status:"ready",revision:c}),{revision:c,activeRegion:L.activeRegion}},R=async(N,A,L)=>{let O=A.requestedRegion,c=E.targets(L.id).find((I)=>I.region===O);if(!c)throw Error("Requested regional target was not found.");E.updateTopology(L.id,{status:A.kind==="failover"?"failing_over":"failing_back"}),r(N,A,`health:${O}`);let U=await _(c).health({target:c});if(!U.healthy)throw Error(`Target region ${O} is unhealthy.`);E.updateTarget(c.id,{status:"ready",health:U.evidence,lastHealthyAt:new Date().toISOString()}),r(N,A,`replication:${O}`);for(let I of E.channels(L.id).filter((w)=>w.targetRegion===O)){let w=await _(c).verifyReplication({channel:I,topology:L});if(!w.healthy||w.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${I.kind} replication is outside the failover RPO.`);E.updateChannel(I.id,{status:"in_sync",checkpoint:w.checkpoint,lagSeconds:w.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(N,A,`traffic:${O}`),await t(L,Object.fromEntries(L.regions.map((I)=>[I.region,I.region===O?100:0]))),r(N,A,`roles:${O}`);let $=L.regions.map((I)=>({...I,role:I.region===O?"primary":"secondary"}));for(let I of E.targets(L.id))E.updateTarget(I.id,{role:I.region===O?"primary":"secondary"});return E.updateTopology(L.id,{status:A.kind==="failover"?"failed_over":"ready",activeRegion:O,regions:$}),{activeRegion:O}},h=async(N,A,L,O)=>{E.updateTopology(L.id,{status:"destroying"}),r(N,A,"traffic:drain"),await t(L,Object.fromEntries(L.regions.map((U)=>[U.region,0])));let c=O.deleteData!==!0;for(let U of E.targets(L.id).sort(($,I)=>Number($.role==="primary")-Number(I.role==="primary")))r(N,A,`delete:${U.region}`),E.updateTarget(U.id,{status:"deleting"}),await _(U).deleteStack({target:U,retainData:c,signal:N.signal}),E.updateTarget(U.id,{status:"deleted"});return r(N,A,"complete"),E.updateTopology(L.id,{status:"destroyed"}),{destroyed:!0,dataRetained:c}},S=async(N)=>{let A=Z3(N.operation.input),L=E.execution(String(A.executionId??""));if(!L)throw Error("Regional execution was not found.");let O=E.get(L.topologyId);if(!O)throw Error("Regional topology was not found.");try{let c;if(L.kind==="rollout")c=await d(N,L,O,A);else if(L.kind==="failover"||L.kind==="failback")c=await R(N,L,O);else if(L.kind==="destroy")c=await h(N,L,O,A);else throw Error("Regional reconciliation is not configured.");return E.updateExecution(L.id,{status:"succeeded",currentStep:void 0}),{executionId:L.id,...c}}catch(c){if(E.updateExecution(L.id,{status:N.cancellationRequested()?"cancelled":"failed",error:c instanceof Error?c.message:String(c)}),E.get(O.id)?.status!=="destroyed")E.updateTopology(O.id,{status:"failed"});throw c}};return{"region.rollout":S,"region.failover":S,"region.failback":S,"region.destroy":S,"region.reconcile":S}}class kC{provider;reason;constructor(E,T="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=T}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function g3(){let E=await o(),T=iE(process.cwd(),E),_=new lL(T.store),r=new iL(_);return{controlPlane:T,store:_,service:r}}async function bh(E){let T=await g3();try{await E(T)}catch(_){Y(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}var aL=(E,T)=>{let _=E.store.list(E.controlPlane.project.id).find((r)=>r.id===T||r.name===T);if(!_)throw Error("Regional topology was not found.");return _},q3=(E)=>E.split(",").map((T,_)=>{let[r,t="aws"]=T.split(":");return{region:String(r),provider:t,role:_===0?"primary":"secondary"}}),x3=(E)=>{let T=new Set(["s3","dynamodb","secrets"]),_=E.split(",").map((t)=>t.trim()),r=_.find((t)=>!T.has(t));if(r)throw Error(`Unsupported replication kind: ${r}`);return _};function uC(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(T)=>bh((_)=>{let r=_.store.list(_.controlPlane.project.id).map((t)=>({topology:t,targets:_.store.targets(t.id),channels:_.store.channels(t.id),route:_.store.route(t.id),executions:_.store.executions(t.id)}));if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Name","Hostname","Active","Status","Revision","Replication"],r.map((t)=>[t.topology.name,t.topology.hostname,t.topology.activeRegion,t.topology.status,t.topology.revision??"—",`${t.channels.filter((d)=>d.status==="in_sync").length}/${t.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(T,_)=>bh((r)=>{if(!_.hostname||!_.regions)throw Error("--hostname and --regions are required.");let t=r.service.create({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:T,hostname:_.hostname,regions:q3(_.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:x3(String(_.replicate)),maxLagSeconds:Number(_.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!_.cdn,wafEnabled:!!_.waf});Z(`Created ${t.name} (${t.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(T,_,r)=>bh((t)=>EE(["Step"],t.service.plan(aL(t,T).id,_,r.target).map((d)=>[d])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(T,_,r)=>bh(async(t)=>{let d=r.manifest?await Bun.file(r.manifest).json():{},R=t.service.enqueue({topologyId:aL(t,T).id,kind:"rollout",revision:_,manifest:d});Z(`Regional rollout queued: ${R.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(T,_)=>bh((r)=>{let t=r.service.enqueue({topologyId:aL(r,T).id,kind:"failover",targetRegion:_});Z(`Failover queued: ${t.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(T,_)=>bh((r)=>{let t=r.service.enqueue({topologyId:aL(r,T).id,kind:"failback",targetRegion:_});Z(`Failback queued: ${t.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(T,_)=>bh((r)=>{let t=r.service.enqueue({topologyId:aL(r,T).id,kind:"destroy",confirmation:_.confirm});Z(`Regional teardown queued: ${t.operation.id}; replicated data remains retained.`)}))}ME();var mL="0.7.78";import{createHash as nC,createPublicKey as RH,verify as k3}from"node:crypto";function sL(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(sL).join(",")}]`;return`{${Object.keys(E).sort().map((T)=>`${JSON.stringify(T)}:${sL(E[T])}`).join(",")}}`}var hH=(E)=>nC("sha256").update(sL(E)).digest("hex"),qe=(E)=>nC("sha256").update(sL(E)).digest("hex"),SH=(E)=>nC("sha256").update(RH(E).export({type:"spki",format:"der"})).digest("hex");function NH(E,T,_){try{return k3(null,Buffer.from(sL(E)),RH(_),Buffer.from(T,"base64"))}catch{return!1}}var tH=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((T)=>Number(T)||0),dH=(E,T)=>{let _=tH(E),r=tH(T);for(let t=0;t<3;t++){let d=(_[t]??0)-(r[t]??0);if(d)return d}return 0};function AH(E,T){let _=[];if(T.schemaVersion<E.minimumSchema)_.push(`schema ${T.schemaVersion} is below ${E.minimumSchema}`);if(T.schemaVersion>E.maximumSchema)_.push(`schema ${T.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&dH(T.currentVersion,E.minimumVersion)<0)_.push(`platform ${T.currentVersion} is below ${E.minimumVersion}`);if(dH(E.version,T.currentVersion)<=0)_.push(`version ${E.version} is not newer than ${T.currentVersion}`);if(!E.artifacts.some((r)=>r.platform===T.platform&&r.architecture===T.architecture))_.push(`no artifact for ${T.platform}/${T.architecture}`);return{compatible:_.length===0,reasons:_}}var Vd=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},z_=(E)=>E==null?void 0:String(E),u3=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:z_(E.revoked_at),createdAt:String(E.created_at)}),LH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:Vd(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:Vd(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),OH=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:Vd(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),cH=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:z_(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:Vd(E.health_gate,{}),status:String(E.status),currentStage:z_(E.current_stage),backupId:z_(E.backup_id),approvedBy:z_(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),vC=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:z_(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:Vd(E.evidence,{}),error:z_(E.error),startedAt:z_(E.started_at),finishedAt:z_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),eH=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:Vd(E.criteria,{}),candidates:Vd(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:z_(E.confirmation),expiresAt:String(E.expires_at),result:Vd(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),UH=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:z_(E.backup_policy_id),recoveryPointId:z_(E.recovery_point_id),topologyId:z_(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:z_(E.operation_id),evidence:Vd(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:z_(E.error),startedAt:z_(E.started_at),finishedAt:z_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class pL{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}addTrustedKey(E){let T=this.id(),_=this.now().toISOString(),r=SH(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[T,E.organizationId,E.name,E.publicKeyPem,r,_]),this.key(T)}key(E){let T=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return T?u3(T):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let T=this.key(E.keyId);if(!T||T.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(T.revokedAt)throw Error("Update signing key is revoked.");if(!NH(E.document,E.signature,T.publicKeyPem))throw Error("Update manifest signature is invalid.");let _=AH(E.document,E.current),r=hH(E.document),t=this.id(),d=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[t,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,r,JSON.stringify(E.document),E.signature,JSON.stringify(_),d]),this.manifest(t)}manifest(E){let T=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return T?LH(T):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(LH)}createWindow(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[T,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,_,_]),this.window(T)}window(E){let T=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return T?OH(T):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(OH)}createCampaign(E){return this.control.transaction(()=>{let T=this.manifest(E.manifestId);if(!T?.compatibility.compatible||T.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let _=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[_,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,r,r]),E.targets.forEach((t,d)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),_,t.serverId??null,t.target,E.strategy==="canary"?d===0?0:1+Math.floor((d-1)/E.batchSize):Math.floor(d/E.batchSize),t.previousVersion,r,r])),this.campaign(_)})}campaign(E){let T=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return T?cH(T):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(cH)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(vC)}updateCampaign(E,T){let _=this.campaign(E);if(!_)throw Error("Upgrade campaign was not found.");let r={..._,...T};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[r.status,r.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,T){let _=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!_)throw Error("Upgrade target was not found.");let r={...vC(_),...T};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.evidence),r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),vC(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let T=[...E.candidates].sort((R,h)=>R.id.localeCompare(h.id)),_=qe(T),r=this.id(),t=this.now().toISOString(),d=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[r,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(T),_,T.reduce((R,h)=>R+h.bytes,0),d,t,t]),this.cleanup(r)}cleanup(E){let T=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return T?eH(T):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(eH)}updateCleanup(E,T){let _=this.cleanup(E);if(!_)throw Error("Cleanup plan was not found.");let r={..._,...T};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[r.status,r.confirmation??null,JSON.stringify(r.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[T,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,_,_]),this.drill(T)}drill(E){let T=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return T?UH(T):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(UH)}updateDrill(E,T){let _=this.drill(E);if(!_)throw Error("DR drill was not found.");let r={..._,...T};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,r.operationId??null,JSON.stringify(r.evidence),r.measuredRpoMinutes??null,r.measuredRtoMinutes??null,r.cleanupVerified?1:0,r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}function n3(E,T=new Date){if(!E.enabled)return!1;let _=new Date(E.schedule);if(!Number.isNaN(_.getTime()))return T>=_&&T.getTime()<=_.getTime()+E.durationMinutes*60000;let r=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!r)return!1;let t=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(T),d=Number(t.find((h)=>h.type==="hour")?.value)*60+Number(t.find((h)=>h.type==="minute")?.value),R=Number(r[1])*60+Number(r[2]);return d>=R&&d<R+E.durationMinutes}class oL{store;now;queue;constructor(E,T,_=()=>new Date){this.store=E;this.now=_;this.queue=T??new lE(E.control)}enqueueCampaign(E,T={}){let _=this.store.campaign(E);if(!_)throw Error("Upgrade campaign was not found.");let r=_.windowId?this.store.window(_.windowId):void 0;if(r&&!r.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(r&&!T.overrideWindow&&!n3(r,this.now()))throw Error("Upgrade is outside its maintenance window.");if(r?.requireApproval&&!T.approvedBy&&!_.approvedBy)throw Error("Maintenance approval is required.");let t=this.queue.enqueue({projectId:_.projectId,actorId:T.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:t}}async previewCleanup(E,T){let _=T.find((r)=>r.kind===E.kind);if(!_)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await _.discover(E.criteria)})}enqueueCleanup(E,T){let _=this.store.cleanup(E);if(!_||_.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(_.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let r=`DELETE ${_.candidates.length} ${_.kind}`;if(T!==r)throw Error(`Exact confirmation ${r} is required.`);let t=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${_.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:T}),operation:t}}enqueueDrill(E){let T=this.store.drill(E);if(!T||T.status!=="planned")throw Error("A planned DR drill is required.");let _=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${T.scenario}:${T.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:_.id}),operation:_}}}var lC=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function DH(E){return{"maintenance.upgrade":async(t)=>{let d=E.store.campaign(String(lC(t.operation.input).campaignId??""));if(!d||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let R=E.store.manifest(d.manifestId);if(!R?.compatibility.compatible||R.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let h=R.document.artifacts.find((N)=>N.platform===process.platform&&N.architecture===process.arch)??R.document.artifacts[0];if(!h)throw Error("No update artifact matches this platform.");E.store.updateCampaign(d.id,{status:"running",currentStage:"preflight"});let S=[];try{for(let N of[...new Set(E.store.targets(d.id).map((A)=>A.cohort))].sort((A,L)=>A-L)){E.store.updateCampaign(d.id,{currentStage:`cohort:${N}`});for(let A of E.store.targets(d.id).filter((L)=>L.cohort===N)){t.throwIfCancellationRequested(),t.checkpoint(`download:${A.target}`,"Downloading signed platform artifact."),E.store.updateTarget(A.id,{status:"downloading",startedAt:new Date().toISOString()});let L=await E.platform.download({target:A,artifact:h,signal:t.signal});if(L.sha256!==h.sha256)throw Error(`Artifact checksum mismatch for ${A.target}.`);t.checkpoint(`install:${A.target}`,"Installing verified artifact."),E.store.updateTarget(A.id,{status:"installing"}),await E.platform.install({target:A,path:L.path,version:R.version,signal:t.signal}),S.push(A);let O=await E.platform.health({target:A,gate:d.healthGate});if(!O.healthy)throw Error(`Upgrade health gate failed for ${A.target}.`);E.store.updateTarget(A.id,{status:"healthy",evidence:O.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(d.id,{status:"succeeded",currentStage:void 0}),{campaignId:d.id,version:R.version,targets:S.length}}catch(N){E.store.updateCampaign(d.id,{status:"rolling_back",currentStage:"rollback"});for(let A of S.reverse())E.store.updateTarget(A.id,{status:"rolling_back"}),await E.platform.rollback({target:A,version:A.previousVersion,signal:t.signal}),E.store.updateTarget(A.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(d.id,{status:"rolled_back",currentStage:void 0}),N}},"maintenance.cleanup":async(t)=>{let d=E.store.cleanup(String(lC(t.operation.input).planId??""));if(!d||d.status!=="approved")throw Error("Approved cleanup plan was not found.");if(qe([...d.candidates].sort((A,L)=>A.id.localeCompare(L.id)))!==d.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let R=E.cleanup?.find((A)=>A.kind===d.kind);if(!R)throw Error(`No ${d.kind} cleanup driver is configured.`);E.store.updateCleanup(d.id,{status:"running"});let h=[],S=[];for(let A of d.candidates){t.throwIfCancellationRequested();try{await R.remove(A),h.push(A.id)}catch(L){S.push({id:A.id,error:L instanceof Error?L.message:String(L)})}}let N=S.length?h.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(d.id,{status:N,result:{removed:h,failed:S,reclaimedBytes:d.candidates.filter((A)=>h.includes(A.id)).reduce((A,L)=>A+L.bytes,0)}}),S.length)throw Error(`Cleanup failed for ${S.length} candidate(s).`);return{planId:d.id,removed:h.length,reclaimedBytes:d.estimatedBytes}},"maintenance.drill":async(t)=>{let d=E.store.drill(String(lC(t.operation.input).drillId??""));if(!d)throw Error("DR drill was not found.");let R=E.recovery?.find((L)=>L.scenario===d.scenario);if(!R)throw Error(`No ${d.scenario} recovery driver is configured.`);let h=new Date;E.store.updateDrill(d.id,{status:"restoring",startedAt:h.toISOString()});let S=d.isolatedTarget,N={},A={};try{t.checkpoint("restore","Restoring into isolated drill target.");let L=await R.restore({drill:d,signal:t.signal});if(!L.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");S=L.target,N=L.evidence;let O=(h.getTime()-new Date(L.recoveryPointAt).getTime())/60000;E.store.updateDrill(d.id,{status:"verifying",measuredRpoMinutes:O,evidence:{restore:N}}),t.checkpoint("verify","Running recovery health checks without production traffic.");let c=await R.verify({drill:d,target:S});A=c.evidence;let U=(Date.now()-h.getTime())/60000;if(!c.healthy||O>d.expectedRpoMinutes||U>d.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(d.id,{measuredRpoMinutes:O,measuredRtoMinutes:U,evidence:{restore:N,verify:A}})}catch(L){throw E.store.updateDrill(d.id,{status:"failed",error:L instanceof Error?L.message:String(L),evidence:{restore:N,verify:A}}),L}finally{E.store.updateDrill(d.id,{status:"cleaning"});try{await R.cleanup({drill:d,target:S});let L=E.store.drill(d.id);E.store.updateDrill(d.id,{status:L.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(L){E.store.updateDrill(d.id,{status:"cleanup_required",cleanupVerified:!1,error:L instanceof Error?L.message:String(L),finishedAt:new Date().toISOString()})}}return{drillId:d.id,status:E.store.drill(d.id).status}}}}var $H={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class E0{kind;control;projectId;organizationId;constructor(E,T,_,r){this.kind=E;this.control=T;this.projectId=_;this.organizationId=r}async discover(E){let T=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),_=new Date(Date.now()-T*86400000).toISOString(),r=$H[this.kind],t=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(r.select).all(t,_).map((R)=>({id:String(R.id),kind:this.kind,label:`${this.kind}:${String(R.id)}`,bytes:Number(R.bytes??0),metadata:{createdAt:String(R.created_at)}}))}async remove(E){if(this.control.database.run($H[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function v3(){let E=await o(),T=iE(process.cwd(),E),_=new pL(T.store),r=new oL(_),t=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((d)=>new E0(d,T.store,T.project.id,T.organization.id));return{controlPlane:T,store:_,service:r,cleanup:t}}async function Kd(E){let T=await v3();try{await E(T)}catch(_){Y(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}function iC(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(T)=>Kd((_)=>{let r={manifests:_.store.manifests(_.controlPlane.organization.id),windows:_.store.windows(_.controlPlane.project.id),campaigns:_.store.campaigns(_.controlPlane.project.id),cleanups:_.store.cleanups(_.controlPlane.project.id),drills:_.store.drills(_.controlPlane.project.id)},t=[...r.manifests.map((d)=>["update",d.version,d.compatibility.compatible?"compatible":"blocked",d.compatibility.reasons.join("; ")||d.channel]),...r.campaigns.map((d)=>["upgrade",d.id,d.status,d.currentStage??d.fromVersion]),...r.cleanups.map((d)=>["cleanup",d.kind,d.status,`${d.candidates.length} items / ${d.estimatedBytes} bytes`]),...r.drills.map((d)=>["DR drill",d.scenario,d.status,d.isolatedTarget])];if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Area","Name / version","Status","Detail"],t)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(T,_)=>Kd(async(r)=>{let t=r.store.addTrustedKey({organizationId:r.controlPlane.organization.id,name:T,publicKeyPem:await Bun.file(_).text()});Z(`Trusted ${t.name}: ${t.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(T,_,r)=>Kd(async(t)=>{let d=await Bun.file(T).json(),R=(await Bun.file(_).text()).trim(),h=t.store.importManifest({organizationId:t.controlPlane.organization.id,keyId:r,document:d,signature:R,current:{schemaVersion:t.controlPlane.store.health().schemaVersion,currentVersion:mL,platform:process.platform,architecture:process.arch}});Z(`Verified ${h.version}; ${h.compatibility.compatible?"compatible":"blocked: "+h.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(T,_,r)=>Kd((t)=>{let d=t.store.createWindow({projectId:t.controlPlane.project.id,name:T,schedule:_,timezone:r.timezone,durationMinutes:Number(r.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});Z(`Created ${d.name} (${d.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(T,_,r)=>Kd((t)=>{let d=new vt(t.controlPlane.store).list(t.controlPlane.project.id).filter((S)=>S.status==="ready").map((S)=>({serverId:S.id,target:S.name,previousVersion:S.bootstrapVersion??mL}));if(!d.length)d.push({target:"control-plane",previousVersion:mL});let R=t.store.createCampaign({projectId:t.controlPlane.project.id,manifestId:T,fromVersion:mL,strategy:r.strategy==="rolling"?"rolling":"canary",batchSize:Number(r.batch),healthGate:{kind:"platform"},backupId:_,targets:d}),h=t.service.enqueueCampaign(R.id);Z(`Staged upgrade queued: ${h.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(T,_)=>Kd(async(r)=>{let t=await r.service.previewCleanup({projectId:r.controlPlane.project.id,kind:T,criteria:{olderThanDays:Number(_.olderThan)}},r.cleanup);EE(["ID","Candidate","Bytes"],t.candidates.map((d)=>[d.id,d.label,String(d.bytes)])),e(`Apply with: cloud cleanup:apply ${t.id} --confirm "DELETE ${t.candidates.length} ${t.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(T,_)=>Kd((r)=>{let t=r.service.enqueueCleanup(T,String(_.confirm??""));Z(`Cleanup queued: ${t.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(T,_,r)=>Kd((t)=>{let d=t.store.createDrill({projectId:t.controlPlane.project.id,scenario:T,isolatedTarget:_,expectedRpoMinutes:Number(r.rpo),expectedRtoMinutes:Number(r.rto),recoveryPointId:r.recoveryPoint,topologyId:r.topology});Z(`Planned isolated drill ${d.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(T)=>Kd((_)=>{let r=_.service.enqueueDrill(T);Z(`DR drill queued: ${r.operation.id}`)}))}ME();kR();jr();async function aC(){try{return(await o()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function mC(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(T)=>{b("Lambda Functions");let _=T?.region||await aC(),r=new FT(_);try{let{Functions:t=[]}=await r.listFunctions({MaxItems:50});if(!t.length){e("No functions found");return}EE(["Name","Runtime","Memory","Timeout","Last Modified"],t.map((d)=>[d.FunctionName??"-",d.Runtime??"-",d.MemorySize?`${d.MemorySize} MB`:"-",d.Timeout?`${d.Timeout}s`:"-",d.LastModified??"-"]))}catch(t){Y(`Failed to list functions: ${t.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(T,_)=>{b(`Invoking ${T}`);let r=_?.region||await aC(),t=new FT(r),d=new l("Invoking function...");d.start();try{let R=await t.invoke({FunctionName:T,InvocationType:_?.async?"Event":"RequestResponse",Payload:_?.payload||"{}",LogType:_?.async?"None":"Tail"});if(R.FunctionError){if(d.fail(`Function returned an error (${R.FunctionError})`),R.Payload)e(R.Payload);process.exitCode=1;return}if(d.succeed(`Invoked (status ${R.StatusCode})`),R.Payload)e(`
+`).find((t)=>t&&!t.startsWith("#"))?.trim().split(/\s+/);if(_.code!==0||!r?.[1]||!r[2])throw Error(`SSH host-key scan failed: ${_.stderr.trim()||"no key returned"}`);return{algorithm:r[1],key:r[2]}}async exec(E,T){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return vW(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,T])}}var F3=(E)=>`SHA256:${z3("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,j3=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class Gd{provider;transport;discoverer;constructor(E,T=new lW,_){this.provider=E;this.transport=T;this.discoverer=_}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let T=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:T.algorithm,hostKeyFingerprint:F3(T.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let T=await this.transport.exec(E,j3);if(T.code!==0)throw Error(`Fleet validation failed: ${T.stderr.trim()||T.code}`);try{return JSON.parse(T.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,T){let _=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${T.length}`);if(_.code!==0)throw Error(`Fleet bootstrap failed: ${_.stderr.trim()||_.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function iW(E,T){return{"fleet.bootstrap":async(_)=>{let r=_.operation.input&&typeof _.operation.input==="object"&&!Array.isArray(_.operation.input)?_.operation.input:{},t=E.get(String(r.serverId??""));if(!t)throw Error("Queued fleet server was not found.");let d=T.find((S)=>S.provider===t.provider);if(!d)throw Error(`No ${t.provider} fleet driver is configured.`);let R=Array.isArray(r.steps)?r.steps.map(String):[];if(_.checkpoint("preflight","Rechecking pinned trust and healthy validation."),t.trustState!=="pinned"||!t.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");_.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let h=await d.bootstrap(t,R);return E.update(t.id,{bootstrapVersion:h.version,status:"ready"}),_.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:t.id,bootstrapVersion:h.version,steps:R.length}}}}var nt=(E)=>E==null?void 0:String(E),qh=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},VC=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:nt(E.provider_id),region:nt(E.region),zone:nt(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:nt(E.host_key_algorithm),hostKeyFingerprint:nt(E.host_key_fingerprint),pendingHostKey:nt(E.pending_host_key),roles:qh(E.roles,[]),labels:qh(E.labels,{}),taints:qh(E.taints,[]),capacity:qh(E.capacity,{}),usage:qh(E.usage,{}),capabilities:qh(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:qh(E.validation,void 0),bootstrapVersion:nt(E.bootstrap_version),heartbeatAt:nt(E.heartbeat_at),lastSeenAt:nt(E.last_seen_at),archivedAt:nt(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class vt{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}get(E){let T=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return T?VC(T):void 0}list(E,T=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(VC).filter((_)=>T||_.status!=="archived")}findProvider(E,T,_){let r=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,T,_);return r?VC(r):void 0}create(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,_,_]),this.get(T)}update(E,T){let _=this.get(E);if(!_)throw Error("Server was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[r.name,r.providerId??null,r.region??null,r.zone??null,r.endpoint,r.sshUser,r.sshPort,r.credentialRef,r.hostKeyAlgorithm??null,r.hostKeyFingerprint??null,r.pendingHostKey??null,JSON.stringify(r.roles),JSON.stringify(r.labels),JSON.stringify(r.taints),JSON.stringify(r.capacity),JSON.stringify(r.usage),JSON.stringify(r.capabilities),r.status,r.trustState,JSON.stringify(r.validation??{}),r.bootstrapVersion??null,r.heartbeatAt??null,r.lastSeenAt??null,r.archivedAt??null,t,E]),this.get(E)}}var y3=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class bL{store;drivers;now;queue;constructor(E,T,_,r=()=>new Date){this.store=E;this.drivers=T;this.now=r;this.queue=_??new lE(E.control)}driver(E){let T=this.drivers.find((_)=>_.provider===E);if(!T)throw Error(`No ${E} fleet driver is configured.`);return T}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!y3.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let T=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(T)return this.store.update(T.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let _=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),r=this.driver(E.provider);return this.store.create({...E,resourceId:_.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:r.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let _=await this.driver(T.provider).test(T);if(!_.reachable)return this.store.update(E,{status:"unreachable"});if(T.hostKeyFingerprint&&T.hostKeyFingerprint!==_.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:_.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:_.hostKeyAlgorithm,hostKeyFingerprint:_.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,T){let _=this.store.get(E);if(!_||_.pendingHostKey!==T)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:T,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let T=this.store.get(E);if(!T||T.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let _=await this.driver(T.provider).validate(T),r=[];if(!["x64","arm64","x86_64","aarch64"].includes(_.arch??""))r.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let R of["curl","tar"])if(!_.tools?.[R])r.push({code:`tool.${R}`,severity:"error",message:`${R} is missing.`,remediation:`Install ${R} before bootstrap.`});if(Math.abs(_.timeSkewSeconds??0)>60)r.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!_.dnsOk)r.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let t={valid:!r.some((R)=>R.severity==="error"),facts:_,findings:r,validatedAt:this.now().toISOString(),validatorVersion:"1"},d={cpu:_.cpuCores??0,memoryBytes:_.memoryBytes??0,diskBytes:_.diskBytes??0};return this.store.update(E,{validation:t,capacity:d,status:t.valid?"ready":"degraded"})}bootstrap(E,T=!1){let _=this.store.get(E);if(!_?.validation?.valid)throw Error("A healthy validation report is required.");let r=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!T)return{preview:!0,steps:r};let t=this.queue.enqueue({projectId:_.projectId,resourceId:_.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:r},lockKey:`server:${E}`,providerKey:_.provider}).operation;return{preview:!1,steps:r,operation:t}}heartbeat(E,T){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let r=this.now().toISOString();return this.store.update(E,{usage:T.usage,capabilities:T.capabilities??_.capabilities,heartbeatAt:r,lastSeenAt:r,status:_.status==="draining"||_.status==="drained"?_.status:"ready"})}drain(E,T=!1){return this.store.update(E,{status:T?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,T){let _=this.store.get(E);if(!_||T!==_.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function P3(){let E=await o(),T=iE(process.cwd(),E),_=new vt(T.store),r=new bL(_,[new Gd("aws"),new Gd("hetzner"),new Gd("ssh")]);return{controlPlane:T,store:_,service:r}}async function Qd(E){let T=await P3();try{return await E(T)}finally{T.controlPlane.store.close()}}var xh=(E,T)=>{let _=E.store.list(E.controlPlane.project.id).find((r)=>r.id===T||r.name===T);if(!_)throw Error(`Server ${T} was not found.`);return _},sr=(E)=>{Y(E instanceof Error?E.message:String(E)),process.exitCode=1};function KC(E,T){let _=Number.parseInt(E??"",10);return Number.isFinite(_)&&_>=0?_:T}function B3(E="3h"){let T=E.match(/^(\d+)(m|h)$/);if(!T)throw Error("--range must use minutes or hours, for example 30m or 3h.");let _=Number(T[1])*(T[2]==="h"?3600000:60000);if(_<300000||_>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return _}function kL(E,T="%"){return E==null?"unavailable":`${E.toFixed(1)}${T}`}async function W3(E,T){let _=await o();if(_.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let r=T.env??process.env.CLOUD_ENV??"production",t=DT(_,r),d=await Dt(t);if(!d?.serverId)throw Error(`No pinned Hetzner server was found for ${t}.`);if(![d.serverName,String(d.serverId),d.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${d.serverName}.`);let R=$N(_),h=new Wd({apiToken:MR(R.apiToken,_)}),S=await h.getServer(d.serverId),N=d.publicIp??S.public_net.ipv4?.ip;if(!N)throw Error(`Server ${S.name} has no public IPv4 address.`);let A=new Date,L=new Date(A.getTime()-B3(T.range)),O=Math.min(3600,Math.max(60,KC(T.step,60))),c=await fW({client:h,serverId:S.id,cores:Math.max(1,Number(S.server_type.cores)||1),from:L,to:A,step:O,remote:{host:N,user:d.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15}});if(T.json){console.log(JSON.stringify({schemaVersion:1,server:S.name,result:c},null,2));return}EE(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[S.name,`${c.from} to ${c.to}`,`${kL(c.summary.cpuAveragePercent)} / ${kL(c.summary.cpuPeakPercent)}`,`${kL(c.summary.memoryAveragePercent)} / ${kL(c.summary.memoryPeakPercent)}`,c.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(c.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,kL(c.summary.swapPeakPercent)]])}function aW(E){let T=E.targetType.prices?.find((_)=>_.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:T?{hourlyNet:T.price_hourly.net,hourlyGross:T.price_hourly.gross,monthlyNet:T.price_monthly.net,monthlyGross:T.price_monthly.gross}:void 0}}function H3(E){let T=aW(E);EE(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${T.serverName} (${T.serverId})`,T.location,`${T.from} -> ${T.to}`,T.capacityAvailable?"available":"waiting",`${T.target.cores??0} / ${T.target.memoryGb??0} GB / ${T.target.diskGb??0} GB`,T.price?.monthlyGross??T.price?.monthlyNet??"not reported"]])}async function f3(E,T,_){let r=await o();if(r.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let t=_.env??process.env.CLOUD_ENV??"production",d=DT(r,t),R=await Dt(d),h=$N(r),S=new Wd({apiToken:MR(h.apiToken,r)}),A=R&&(E===R.serverName||E===String(R.serverId)||E===R.stackName)?await S.getServer(R.serverId):(await S.listServers()).find((f)=>f.name===E||String(f.id)===E);if(!A)throw Error(`Hetzner server ${E} was not found.`);if(R?.serverId&&R.serverId!==A.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${R.serverId}.`);let L=Hd(T),O=_.upgradeDisk!==!1,c=await xL(S,A.id,L,O);if(_.json)console.log(JSON.stringify({schemaVersion:1,plan:aW(c)},null,2));else H3(c);if(!_.apply){if(!_.json)e(`Preview only. Re-run with --apply --confirm ${A.name} to execute.`);return}if(_.confirm!==A.name)throw Error(`Resize requires --confirm ${A.name}.`);let U=R?.publicIp??A.public_net.ipv4?.ip;if(!U)throw Error(`Server ${A.name} has no public IPv4 address for verification.`);let $={host:U,user:R?.sshUser??h.sshUser,identityFile:h.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},I=await GC(d),w=new Date().toISOString(),z={schemaVersion:1,operationId:I?.targetType===L&&I.serverId===A.id?I.operationId:crypto.randomUUID(),stackName:d,serverId:A.id,serverName:A.name,sourceType:c.currentType.name,targetType:L,upgradeDisk:O,phase:"planning",status:"running",attempts:I?.targetType===L?I.attempts:0,startedAt:I?.targetType===L?I.startedAt:w,updatedAt:w,manifest:I?.targetType===L?I.manifest:void 0};await Yd(z);let F=KC(_.pollSeconds,900)*1000,j=KC(_.maxWaitMinutes,0)*60000,H=Date.now();for(;;){let f=await xL(S,A.id,L,O);if(!f.capacityAvailable&&!f.alreadyComplete){if(z={...z,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await Yd(z),!_.wait){if(!_.json)e(`${L} has no capacity in ${f.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(j>0&&Date.now()-H>=j)throw Error(`Timed out waiting for ${L} capacity in ${f.location}.`);if(!_.json)e(`Waiting ${Math.round(F/1000)} seconds for ${L} capacity...`);await Bun.sleep(F);continue}let Q=await QC(d);try{let K=await(async()=>{try{return z={...z,status:"running",attempts:z.attempts+1,updatedAt:new Date().toISOString()},await Yd(z),await PC({client:S,serverId:A.id,targetType:L,upgradeDisk:O,resumeFromOff:z.phase==="shutting-down"||z.phase==="resizing"||z.phase==="powering-on"||z.phase==="verifying",manifest:z.manifest,hooks:{preflight:async()=>{let x=await WC($);return z={...z,manifest:x,updatedAt:new Date().toISOString()},await Yd(z),x},afterBoot:async(x,k,v,TE)=>HC($,k,v,TE),onPhase:async(x,k)=>{if(z={...z,phase:x,status:x==="waiting-capacity"?"waiting-capacity":x==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await Yd(z),!_.json)e(`${x}${k?` ${JSON.stringify(k)}`:""}`)}}})}finally{await Q()}})();if(z={...z,status:K.status==="completed"||K.status==="already-complete"?"completed":K.status==="recovered"?"recovered":"waiting-capacity",lastError:K.status==="recovered"?K.error:void 0,updatedAt:new Date().toISOString()},await Yd(z),_.json)console.log(JSON.stringify({schemaVersion:1,result:K},null,2));else if(K.status==="completed"||K.status==="already-complete")Z(`${A.name} is on ${L} and passed full post-boot verification.`);else if(K.status==="recovered"&&K.retryable&&_.wait){e(`Capacity race recovered safely. Waiting ${Math.round(F/1000)} seconds before retry.`),await Bun.sleep(F);continue}else if(K.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${K.error}`);return}catch(K){throw z={...z,status:"failed",lastError:K instanceof Error?K.message:String(K),updatedAt:new Date().toISOString()},await Yd(z),K}}}async function Y3(E,T){let _=await o();if(_.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let r=T.env??process.env.CLOUD_ENV??"production",t=DT(_,r),d=await Dt(t);if(!d?.serverId)throw Error(`No pinned Hetzner server was found for ${t}.`);if(![d.serverName,String(d.serverId),d.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${d.serverName}.`);let R=$N(_),h=new Wd({apiToken:MR(R.apiToken,_)}),S=await h.getServer(d.serverId),N=d.publicIp??S.public_net.ipv4?.ip;if(!N)throw Error(`Server ${S.name} has no public IPv4 address.`);let A=Qe(_);if(T.json)console.log(JSON.stringify({schemaVersion:1,server:S.name,plan:A},null,2));else EE(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[S.name,A.firewallPorts.join(","),A.monitoring?"on":"off",A.autoUpdates?"on":"off",`${A.swapGb} GB`,"disabled"]]);if(!T.apply){if(!T.json)e(`Preview only. Re-run with --apply --confirm ${S.name} to execute.`);return}if(T.confirm!==S.name)throw Error(`Optimization requires --confirm ${S.name}.`);let L={host:N,user:d.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15},O=await jN(L),c=O.routeProbes.filter((v)=>!v.ok),U=_.infrastructure?.compute,$=hr(U)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,I=O.failedUnits.filter((v)=>!$.has(v));if(I.length>0)throw Error(`Preflight found failed services: ${I.join(", ")}`);if(c.length>0)throw Error(`Preflight found unhealthy routes: ${c.map((v)=>v.domain).join(", ")}`);let w=hr(U)?[]:Object.values(_.sites??{}).flatMap((v)=>typeof v?.port==="number"&&![80,443].includes(v.port)?[v.port]:[]),z=CN({allowSsh:U?.allowSsh!==!1,sitePorts:w,allowedPorts:U?.firewall?.allowedPorts}),F=(d.firewallId?(await h.listFirewalls()).find((v)=>v.id===d.firewallId):void 0)??(await h.listFirewalls()).find((v)=>v.name===`${_.project.slug}-${r}-app-fw`);if(!F)throw Error(`Managed firewall for ${S.name} was not found.`);let j=await h.setFirewallRules(F.id,z);await Promise.all(j.map((v)=>h.waitForAction(v.id))),await CC(_,L);let[H,f]=await Promise.all([jN(L),XC(L)]),Q=JC(A,f),K=KW(O,H),x=H.routeProbes.filter((v)=>!v.ok);if(K.stoppedServices.length>0)Q.push(`services stopped: ${K.stoppedServices.join(", ")}`);if(K.changedRouteFragments.length>0)Q.push(`route fragments changed: ${K.changedRouteFragments.join(", ")}`);if(K.missingRouteIds.length>0)Q.push(`routes disappeared: ${K.missingRouteIds.join(", ")}`);if(K.changedReleaseLinks.length>0)Q.push(`release links changed: ${K.changedReleaseLinks.join(", ")}`);if(K.missingData.length>0)Q.push(`databases or volumes disappeared: ${K.missingData.join(", ")}`);if(x.length>0)Q.push(`unhealthy routes: ${x.map((v)=>v.domain).join(", ")}`);if(Q.length>0)throw Error(`Host optimization verification failed: ${Q.join("; ")}`);let k={serverId:S.id,serverName:S.name,services:H.runningServices.length,routes:H.routeIds.length,healthyDomains:H.routeProbes.length,releaseLinks:H.releaseLinks.length,databasesAndVolumes:H.dataCatalog.length,report:f};if(T.json)console.log(JSON.stringify({schemaVersion:1,result:k},null,2));else Z(`${S.name} passed full host, rpx route, service, release, and data verification.`)}function ZC(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(T,_)=>{try{await Qd(async(r)=>{let t=T?[xh(r,T)]:r.store.list(r.controlPlane.project.id),d=t.flatMap((R)=>Object.entries(R.capabilities).map(([h,S])=>({server:R.name,provider:R.provider,action:h,...S})));if(_.json)console.log(JSON.stringify({schemaVersion:1,targets:d},null,2));else EE(["Server","Provider","Action","Support","Explanation"],d.map((R)=>[R.server,R.provider,R.action,R.supported?"supported":"unsupported",R.reason??"—"]))})}catch(r){sr(r)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(T,_,r)=>{try{await f3(T,_,r)}catch(t){sr(t)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(T,_)=>{try{await Y3(T,_)}catch(r){sr(r)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(T,_)=>{try{await W3(T,_)}catch(r){sr(r)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(T)=>{try{await Qd(async(_)=>{let r=_.store.list(_.controlPlane.project.id);if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],r.map((t)=>[t.name,t.providerId??"—",`${t.provider} / ${t.region??"external"}`,`${t.status} / ${t.trustState}`,t.roles.join(","),`${t.capacity.cpu??0} / ${t.capacity.memoryBytes??0}`,t.heartbeatAt??"never"]))})}catch(_){sr(_)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(T,_)=>{try{await Qd(async(r)=>{let t=_.provider;if(!["aws","hetzner","ssh"].includes(t)||!_.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let d=r.service.enroll({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:T,provider:t,providerId:_.providerId,endpoint:_.endpoint,sshUser:_.user??"deploy",credentialRef:_.credentialRef??"secret://fleet/agent",region:_.region,roles:String(_.roles??"application").split(","),labels:Object.fromEntries(String(_.labels??"").split(",").map((R)=>R.split("=")).filter((R)=>R[0]&&R[1]))});Z(`Enrolled ${d.name} as ${d.id}; no remote mutation was performed.`)})}catch(r){sr(r)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(T,_)=>{try{await Qd(async(r)=>{let t=xh(r,T);if(t=await r.service.test(t.id),t.trustState==="rotation_pending"){if(!_.acceptHostKey)throw Error(`Host key changed to ${t.pendingHostKey}; review it first.`);t=r.service.reviewHostKey(t.id,_.acceptHostKey)}let d=await r.service.validate(t.id);if(_.json)console.log(JSON.stringify(d.validation,null,2));else EE(["Severity","Code","Finding","Remediation"],(d.validation?.findings??[]).map((R)=>[R.severity,R.code,R.message,R.remediation??"—"]));if(!d.validation?.valid)process.exitCode=1})}catch(r){sr(r)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(T,_)=>{try{await Qd(async(r)=>{let t=r.service.bootstrap(xh(r,T).id,!!_.apply);if(t.preview)EE(["Step"],t.steps.map((d)=>[d]));else Z(`Bootstrap queued: ${t.operation?.id}`)})}catch(r){sr(r)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(T,_)=>{try{await Qd(async(r)=>Z(r.service.drain(xh(r,T).id,!!_.complete).status))}catch(r){sr(r)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(T)=>{try{await Qd(async(_)=>{_.service.uncordon(xh(_,T).id),Z(`Uncordoned ${T}.`)})}catch(_){sr(_)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(T,_)=>{try{await Qd(async(r)=>{r.service.archive(xh(r,T).id,_.confirm??""),Z(`Archived ${T}; provider infrastructure was not terminated.`)})}catch(r){sr(r)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(T)=>{try{await Qd(async(_)=>{let r=xh(_,T);if(r.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let t=Bun.spawn(["ssh","-p",String(r.sshPort),"-o","StrictHostKeyChecking=yes",`${r.sshUser}@${r.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),d=await t.exited;if(d)process.exitCode=d})}catch(_){sr(_)}});for(let[T,_]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(T,_).action(async(...r)=>lr(T.split(" ")[0],{target:String(r[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}ME();var $t=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},Sr=(E)=>E==null?void 0:String(E),pW=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),PN=(E={})=>({...pW(),...E});function mW(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:Sr(E.region),architecture:Sr(E.architecture),labels:$t(E.labels,{}),requiredServerLabels:$t(E.required_server_labels,{}),toleratedTaints:$t(E.tolerated_taints,[]),capacity:PN($t(E.capacity,{})),reserved:$t(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:Sr(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function sW(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Sr(E.environment_id),resourceId:String(E.resource_id),releaseId:Sr(E.release_id),poolId:String(E.pool_id),serverId:Sr(E.server_id),purpose:String(E.purpose),requirements:$t(E.requirements,{}),decision:$t(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function G3(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:Sr(E.resource_id),poolId:String(E.pool_id),placementId:Sr(E.placement_id),operationId:Sr(E.operation_id),sourceSha:String(E.source_sha),buildSpec:$t(E.build_spec,{}),credentialPolicy:$t(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:Sr(E.workspace),cacheKey:Sr(E.cache_key),artifactUri:Sr(E.artifact_uri),artifactDigest:Sr(E.artifact_digest),status:String(E.status),cleanupAt:Sr(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class uL{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}createPool(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(PN(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,_,_]),this.getPool(T)}getPool(E){let T=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return T?mW(T):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(mW)}updatePool(E,T){let _=this.getPool(E);if(!_)throw Error("Capacity pool was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.reserved),JSON.stringify(r.capacity),r.concurrency,t,E]),this.getPool(E)}addMember(E,T,_={}){let r=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,T,JSON.stringify(_),r,r])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((T)=>({serverId:String(T.server_id),status:String(T.status),capacityOverride:$t(T.capacity_override,{})}))}memberStatus(E,T,_){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[_,this.now().toISOString(),E,T])}listPlacements(E,T){let _=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(sW);return T?.length?_.filter((r)=>T.includes(r.status)):_}getPlacement(E){let T=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return T?sW(T):void 0}activeUsage(E,T){let _=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),r=T?_.filter((t)=>String(t.server_id)===T):_;return{resources:r.reduce((t,d)=>{let R=PN($t(d.resources,{}));for(let h of Object.keys(t))t[h]+=R[h];return t},pW()),count:r.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let T=this.id(),_=this.id(),r=this.now().toISOString(),t=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[T,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,r,r]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[_,T,E.decision.poolId,E.decision.serverId??null,JSON.stringify(PN(E.requirements.resources)),t,r,r]),this.getPlacement(T)})}transitionPlacement(E,T){if(!this.getPlacement(E))throw Error("Placement was not found.");let r=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[T,r,E]),["released","failed","blocked"].includes(T))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[r,E]);return this.getPlacement(E)}createBuild(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[T,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),_,_]),this.getBuild(T)}getBuild(E){let T=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return T?G3(T):void 0}updateBuild(E,T){let _=this.getBuild(E);if(!_)throw Error("Remote build was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[r.operationId??null,r.workspace??null,r.cacheKey??null,r.artifactUri??null,r.artifactDigest??null,r.status,r.cleanupAt??null,t,E]),this.getBuild(E)}}var Ze=["cpu","memoryBytes","diskBytes","gpu"],oW=(E,T={})=>Object.entries(T).every(([_,r])=>E[_]===r),Q3=(E,T,_)=>Object.fromEntries(Ze.map((r)=>[r,Math.max(0,E[r]-T[r]-(_[r]??0))])),M3=(E,T)=>Ze.every((_)=>E[_]>=(T[_]??0)),V3=(E,T)=>Ze.reduce((_,r)=>_+(T[r]??0)/(E[r]||1),0);class nL{store;fleet;constructor(E,T){this.store=E;this.fleet=T}poolCandidates(E,T,_){let r=[];for(let t of this.store.listPools(E)){if(t.id===_)continue;let d=[];if(t.status!=="active")d.push(`pool is ${t.status}`);if(t.purpose!==T.purpose)d.push(`purpose is ${t.purpose}`);if(T.region&&t.region!==T.region)d.push(`region is ${t.region??"unset"}`);if(T.architecture&&t.architecture!==T.architecture)d.push(`architecture is ${t.architecture??"unset"}`);if(!oW(t.labels,T.labels))d.push("pool labels do not match");if(t.backend==="server"){let R=this.store.members(t.id);if(!R.length)r.push(this.decision(t,void 0,T,[...d,"pool has no servers"]));for(let h of R){let S=this.fleet.get(h.serverId),N=[...d];if(!S)N.push("server is missing");else this.serverReasons(t,S,h.status,T,N);r.push(this.decision(t,S,T,N,h.capacityOverride))}}else r.push(this.decision(t,void 0,T,d))}return r.sort((t,d)=>Number(d.eligible)-Number(t.eligible)||t.score.cost-d.score.cost||t.score.spread-d.score.spread||t.score.fit-d.score.fit||t.poolName.localeCompare(d.poolName)||(t.serverId??"").localeCompare(d.serverId??""))}serverReasons(E,T,_,r,t){if(_!=="active")t.push(`member is ${_}`);if(T.status!=="ready")t.push(`server is ${T.status}`);if(!T.roles.includes(r.purpose==="build"?"build":r.purpose))t.push(`server lacks ${r.purpose} role`);if(!oW(T.labels,E.requiredServerLabels))t.push("server labels do not match pool selector");for(let d of T.taints)if(!E.toleratedTaints.includes(d))t.push(`taint ${d} is not tolerated`)}decision(E,T,_,r,t={}){let d=PN({...T?.capacity,...t}),R=T?Object.fromEntries(Ze.map((N)=>[N,Math.min(E.capacity[N],d[N])])):E.capacity,h=this.store.activeUsage(E.id,T?.id),S=Q3(R,h.resources,E.reserved);if(h.count>=E.maxWorkloads)r.push("workload limit reached");if(_.purpose==="build"&&h.count>=E.concurrency)r.push("build concurrency reached");if(!M3(S,_.resources))r.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:T?.id,eligible:r.length===0,reasons:r,available:S,score:{fit:V3(S,_.resources),spread:h.count,cost:E.costWeight}}}explain(E,T){return this.poolCandidates(E,T)}place(E){return this.store.control.transaction(()=>{let T=this.poolCandidates(E.projectId,E.requirements).find((_)=>_.eligible);if(!T)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((_)=>_.reasons).join("; ")}`);return this.store.reserve({...E,decision:T})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let T=this.store.updatePool(E,{status:"draining"}),_=[],r=[];for(let t of this.store.listPlacements(T.projectId,["reserved","active"]).filter((d)=>d.poolId===E)){if(t.stateful){r.push(this.store.transitionPlacement(t.id,"blocked"));continue}this.store.transitionPlacement(t.id,"moving");let d=this.place({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,releaseId:t.releaseId,requirements:t.requirements});_.push(this.activate(d.id)),this.store.transitionPlacement(t.id,"released")}return{pool:T,moved:_,blocked:r}}drainServer(E,T){this.store.memberStatus(E,T,"draining");let _=this.store.getPool(E);if(!_)throw Error("Capacity pool was not found.");let r=[],t=[];for(let d of this.store.listPlacements(_.projectId,["reserved","active"]).filter((R)=>R.poolId===E&&R.serverId===T)){if(d.stateful){t.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"moving");let R=this.poolCandidates(d.projectId,d.requirements).find((S)=>S.eligible);if(!R){t.push(this.store.transitionPlacement(d.id,"blocked"));continue}let h=this.store.reserve({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements,decision:R});r.push(this.activate(h.id)),this.store.transitionPlacement(d.id,"released")}return{moved:r,blocked:t}}reconcileFailure(E){let T=this.fleet.get(E);if(!T)throw Error("Server was not found.");let _=[],r=[];for(let t of this.store.listPlacements(T.projectId,["active"]).filter((d)=>d.serverId===E)){if(t.stateful||!t.autoReschedule){r.push(this.store.transitionPlacement(t.id,"blocked"));continue}this.store.transitionPlacement(t.id,"failed");let d=this.place({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,releaseId:t.releaseId,requirements:t.requirements});_.push(this.activate(d.id))}return{rescheduled:_,blocked:r}}}async function K3(){let E=await o(),T=iE(process.cwd(),E),_=new uL(T.store),r=new nL(_,new vt(T.store));return{controlPlane:T,store:_,service:r}}async function vL(E){let T=await K3();try{await E(T)}catch(_){Y(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}var ge=(E)=>Object.fromEntries(String(E??"").split(",").map((T)=>T.split("=")).filter((T)=>T[0]&&T[1])),EH=(E)=>Object.fromEntries(Object.entries(ge(E)).map(([T,_])=>[T,Number(_)]));function gC(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(T)=>vL((_)=>{let r=_.store.listPools(_.controlPlane.project.id);if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],r.map((t)=>[t.name,t.purpose,t.backend,`${t.region??"any"} / ${t.architecture??"any"}`,t.status,JSON.stringify(t.capacity),String(t.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(T,_)=>vL((r)=>{let{purpose:t,backend:d}=_;if(!["application","build","worker","monitoring","backup"].includes(t)||!["server","ecs","asg"].includes(d))throw Error("Unsupported pool purpose or backend.");let R=r.store.createPool({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:T,purpose:t,backend:d,region:_.region,architecture:_.arch,labels:ge(_.labels),requiredServerLabels:ge(_.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...EH(_.capacity)},maxWorkloads:Number(_.max),costWeight:1,concurrency:Number(_.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});Z(`Created ${R.name} (${R.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(T,_)=>vL((r)=>{let t=r.store.listPools(r.controlPlane.project.id).find((R)=>R.id===T||R.name===T),d=new vt(r.controlPlane.store).list(r.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!t||!d)throw Error("Pool or server was not found.");r.store.addMember(t.id,d.id),Z(`Attached ${d.name} to ${t.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(T)=>vL((_)=>{let r=_.service.explain(_.controlPlane.project.id,{purpose:T.purpose,resources:EH(T.resources),region:T.region,architecture:T.arch,labels:ge(T.labels)});if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],r.map((t)=>[t.poolName,t.serverId??"provider-managed",t.eligible?"yes":"no",JSON.stringify(t.available),`${t.score.fit.toFixed(2)} / ${t.score.spread} / ${t.score.cost}`,t.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(T)=>vL((_)=>{let r=_.store.listPools(_.controlPlane.project.id).find((d)=>d.id===T||d.name===T);if(!r)throw Error("Pool was not found.");let t=_.service.drainPool(r.id);Z(`Draining ${r.name}: moved ${t.moved.length}, blocked ${t.blocked.length} stateful placement(s).`)}))}ME();var Md=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},pr=(E)=>E==null?void 0:String(E),TH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:pr(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:Md(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:Md(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:pr(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),qC=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:pr(E.stack_id),stackRevision:pr(E.stack_revision),status:String(E.status),health:Md(E.health,{}),lastHealthyAt:pr(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),xC=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:Md(E.config,{}),status:String(E.status),checkpoint:pr(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:pr(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),bC=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:Md(E.weights,{}),desiredWeights:Md(E.desired_weights,{}),status:String(E.status),providerState:Md(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),_H=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:pr(E.operation_id),kind:String(E.kind),requestedRegion:pr(E.requested_region),revision:pr(E.revision),plan:Md(E.plan,[]),currentStep:pr(E.current_step),completedSteps:Md(E.completed_steps,[]),status:String(E.status),error:pr(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class lL{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((d)=>d.region)).size!==E.regions.length||E.regions.filter((d)=>d.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let T=E.regions.find((d)=>d.role==="primary"),_=this.id(),r=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[_,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,T.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),T.region,r,r]);for(let d of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),_,d.region,d.role,d.provider,r,r]);for(let d of E.dataPolicy.replicate)for(let R of E.regions)for(let h of E.regions.filter((S)=>S.region!==R.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),_,d,R.region,h.region,"{}",r,r]);let t=Object.fromEntries(E.regions.map((d)=>[d.region,d.region===T.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),_,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(t),JSON.stringify(t),r,r]),this.get(_)})}get(E){let T=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return T?TH(T):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(TH)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(qC)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(xC)}route(E){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return T?bC(T):void 0}updateTopology(E,T){let _=this.get(E);if(!_)throw Error("Regional topology was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[r.status,r.activeRegion,r.revision??null,JSON.stringify(r.regions),t,E]),this.get(E)}updateTarget(E,T){let _=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!_)throw Error("Regional target was not found.");let r=qC(_),t={...r,...T},d=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[t.role,t.stackId??null,t.stackRevision??null,t.status,JSON.stringify(t.health),t.lastHealthyAt??null,d,E]),qC(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,T){let _=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!_)throw Error("Replication channel was not found.");let r=xC(_),t={...r,...T},d=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[t.status,t.checkpoint??null,t.lagSeconds??null,t.lastVerifiedAt??null,d,E]),xC(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,T){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!_)throw Error("Traffic route was not found.");let r=bC(_),t={...r,...T},d=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(t.weights),JSON.stringify(t.desiredWeights),t.status,JSON.stringify(t.providerState),d,E]),bC(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[T,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),_,_]),this.execution(T)}execution(E){let T=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return T?_H(T):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(_H)}updateExecution(E,T){let _=this.execution(E);if(!_)throw Error("Regional execution was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[r.operationId??null,r.currentStep??null,JSON.stringify(r.completedSteps),r.status,r.error??null,t,E]),this.execution(E)}}class iL{store;queue;constructor(E,T){this.store=E;this.queue=T??new lE(E.control)}create(E){return this.store.create(E)}plan(E,T,_){if(!this.store.get(E))throw Error("Regional topology was not found.");let t=this.store.targets(E),d=this.store.channels(E);if(T==="rollout")return[...t.filter((R)=>R.role==="secondary").map((R)=>`apply:${R.region}`),...t.filter((R)=>R.role==="primary").map((R)=>`apply:${R.region}`),...d.map((R)=>`replicate:${R.kind}:${R.targetRegion}`),"traffic:activate"];if(T==="failover"||T==="failback")return[`health:${_}`,`replication:${_}`,`traffic:${_}`,`roles:${_}`];if(T==="destroy")return["traffic:drain",...t.filter((R)=>R.role==="secondary").map((R)=>`delete:${R.region}`),...t.filter((R)=>R.role==="primary").map((R)=>`delete:${R.region}`),"complete"];return["observe","repair"]}enqueue(E){let T=this.store.get(E.topologyId);if(!T)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!T.regions.some((d)=>d.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===T.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==T.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&T.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let _=this.plan(T.id,E.kind,E.targetRegion),r=this.store.createExecution({topologyId:T.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:_}),t=this.queue.enqueue({projectId:T.projectId,environmentId:T.environmentId,kind:`region.${E.kind}`,input:{executionId:r.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${T.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(r.id,{operationId:t.id}),{execution:this.store.execution(r.id),operation:t}}}var Z3=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function rH(E,T){let _=(N)=>{let A=T.find((L)=>L.provider===N.provider);if(!A)throw Error(`No ${N.provider} regional driver is configured.`);return A},r=(N,A,L)=>{N.throwIfCancellationRequested(),N.checkpoint(L,L),E.updateExecution(A.id,{status:"running",currentStep:L,completedSteps:[...E.execution(A.id).completedSteps,L]})},t=async(N,A)=>{let L=E.route(N.id);if(!L)throw Error("Regional traffic route was not found.");let O=E.targets(N.id).find((U)=>U.region===N.activeRegion)??E.targets(N.id)[0];if(!O)throw Error("Regional traffic target was not found.");E.updateRoute(L.id,{status:"applying",desiredWeights:A});let c=await _(O).applyTraffic({route:E.route(N.id),topology:N,weights:A});E.updateRoute(L.id,{status:Object.values(A).every((U)=>U===0)?"drained":"in_sync",weights:A,providerState:c.providerState})},d=async(N,A,L,O)=>{E.updateTopology(L.id,{status:"provisioning"});let c=A.revision,U=O.manifest??{},$=E.targets(L.id).sort((w,z)=>Number(w.role==="primary")-Number(z.role==="primary"));for(let w of $){r(N,A,`apply:${w.region}`),E.updateTarget(w.id,{status:"provisioning"});let z=await _(w).applyStack({target:w,revision:c,manifest:U,signal:N.signal}),F=await _(w).health({target:E.updateTarget(w.id,{stackId:z.stackId,stackRevision:c})});if(!F.healthy)throw Error(`Regional health gate failed in ${w.region}.`);E.updateTarget(w.id,{status:"ready",health:F.evidence,lastHealthyAt:new Date().toISOString()})}for(let w of E.channels(L.id)){r(N,A,`replicate:${w.kind}:${w.targetRegion}`),E.updateChannel(w.id,{status:"configuring"});let z=$.find((H)=>H.region===w.sourceRegion),F=await _(z).configureReplication({channel:w,topology:L}),j=await _(z).verifyReplication({channel:E.updateChannel(w.id,{checkpoint:F.checkpoint,lagSeconds:F.lagSeconds}),topology:L});if(!j.healthy||j.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${w.kind} replication to ${w.targetRegion} exceeds the RPO.`);E.updateChannel(w.id,{status:"in_sync",checkpoint:j.checkpoint,lagSeconds:j.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(N,A,"traffic:activate");let I=Object.fromEntries(L.regions.map((w)=>[w.region,w.region===L.activeRegion?100:0]));return await t(L,I),E.updateTopology(L.id,{status:"ready",revision:c}),{revision:c,activeRegion:L.activeRegion}},R=async(N,A,L)=>{let O=A.requestedRegion,c=E.targets(L.id).find((I)=>I.region===O);if(!c)throw Error("Requested regional target was not found.");E.updateTopology(L.id,{status:A.kind==="failover"?"failing_over":"failing_back"}),r(N,A,`health:${O}`);let U=await _(c).health({target:c});if(!U.healthy)throw Error(`Target region ${O} is unhealthy.`);E.updateTarget(c.id,{status:"ready",health:U.evidence,lastHealthyAt:new Date().toISOString()}),r(N,A,`replication:${O}`);for(let I of E.channels(L.id).filter((w)=>w.targetRegion===O)){let w=await _(c).verifyReplication({channel:I,topology:L});if(!w.healthy||w.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${I.kind} replication is outside the failover RPO.`);E.updateChannel(I.id,{status:"in_sync",checkpoint:w.checkpoint,lagSeconds:w.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(N,A,`traffic:${O}`),await t(L,Object.fromEntries(L.regions.map((I)=>[I.region,I.region===O?100:0]))),r(N,A,`roles:${O}`);let $=L.regions.map((I)=>({...I,role:I.region===O?"primary":"secondary"}));for(let I of E.targets(L.id))E.updateTarget(I.id,{role:I.region===O?"primary":"secondary"});return E.updateTopology(L.id,{status:A.kind==="failover"?"failed_over":"ready",activeRegion:O,regions:$}),{activeRegion:O}},h=async(N,A,L,O)=>{E.updateTopology(L.id,{status:"destroying"}),r(N,A,"traffic:drain"),await t(L,Object.fromEntries(L.regions.map((U)=>[U.region,0])));let c=O.deleteData!==!0;for(let U of E.targets(L.id).sort(($,I)=>Number($.role==="primary")-Number(I.role==="primary")))r(N,A,`delete:${U.region}`),E.updateTarget(U.id,{status:"deleting"}),await _(U).deleteStack({target:U,retainData:c,signal:N.signal}),E.updateTarget(U.id,{status:"deleted"});return r(N,A,"complete"),E.updateTopology(L.id,{status:"destroyed"}),{destroyed:!0,dataRetained:c}},S=async(N)=>{let A=Z3(N.operation.input),L=E.execution(String(A.executionId??""));if(!L)throw Error("Regional execution was not found.");let O=E.get(L.topologyId);if(!O)throw Error("Regional topology was not found.");try{let c;if(L.kind==="rollout")c=await d(N,L,O,A);else if(L.kind==="failover"||L.kind==="failback")c=await R(N,L,O);else if(L.kind==="destroy")c=await h(N,L,O,A);else throw Error("Regional reconciliation is not configured.");return E.updateExecution(L.id,{status:"succeeded",currentStep:void 0}),{executionId:L.id,...c}}catch(c){if(E.updateExecution(L.id,{status:N.cancellationRequested()?"cancelled":"failed",error:c instanceof Error?c.message:String(c)}),E.get(O.id)?.status!=="destroyed")E.updateTopology(O.id,{status:"failed"});throw c}};return{"region.rollout":S,"region.failover":S,"region.failback":S,"region.destroy":S,"region.reconcile":S}}class kC{provider;reason;constructor(E,T="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=T}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function g3(){let E=await o(),T=iE(process.cwd(),E),_=new lL(T.store),r=new iL(_);return{controlPlane:T,store:_,service:r}}async function bh(E){let T=await g3();try{await E(T)}catch(_){Y(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}var aL=(E,T)=>{let _=E.store.list(E.controlPlane.project.id).find((r)=>r.id===T||r.name===T);if(!_)throw Error("Regional topology was not found.");return _},q3=(E)=>E.split(",").map((T,_)=>{let[r,t="aws"]=T.split(":");return{region:String(r),provider:t,role:_===0?"primary":"secondary"}}),x3=(E)=>{let T=new Set(["s3","dynamodb","secrets"]),_=E.split(",").map((t)=>t.trim()),r=_.find((t)=>!T.has(t));if(r)throw Error(`Unsupported replication kind: ${r}`);return _};function uC(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(T)=>bh((_)=>{let r=_.store.list(_.controlPlane.project.id).map((t)=>({topology:t,targets:_.store.targets(t.id),channels:_.store.channels(t.id),route:_.store.route(t.id),executions:_.store.executions(t.id)}));if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Name","Hostname","Active","Status","Revision","Replication"],r.map((t)=>[t.topology.name,t.topology.hostname,t.topology.activeRegion,t.topology.status,t.topology.revision??"—",`${t.channels.filter((d)=>d.status==="in_sync").length}/${t.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(T,_)=>bh((r)=>{if(!_.hostname||!_.regions)throw Error("--hostname and --regions are required.");let t=r.service.create({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:T,hostname:_.hostname,regions:q3(_.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:x3(String(_.replicate)),maxLagSeconds:Number(_.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!_.cdn,wafEnabled:!!_.waf});Z(`Created ${t.name} (${t.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(T,_,r)=>bh((t)=>EE(["Step"],t.service.plan(aL(t,T).id,_,r.target).map((d)=>[d])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(T,_,r)=>bh(async(t)=>{let d=r.manifest?await Bun.file(r.manifest).json():{},R=t.service.enqueue({topologyId:aL(t,T).id,kind:"rollout",revision:_,manifest:d});Z(`Regional rollout queued: ${R.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(T,_)=>bh((r)=>{let t=r.service.enqueue({topologyId:aL(r,T).id,kind:"failover",targetRegion:_});Z(`Failover queued: ${t.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(T,_)=>bh((r)=>{let t=r.service.enqueue({topologyId:aL(r,T).id,kind:"failback",targetRegion:_});Z(`Failback queued: ${t.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(T,_)=>bh((r)=>{let t=r.service.enqueue({topologyId:aL(r,T).id,kind:"destroy",confirmation:_.confirm});Z(`Regional teardown queued: ${t.operation.id}; replicated data remains retained.`)}))}ME();var mL="0.7.79";import{createHash as nC,createPublicKey as RH,verify as k3}from"node:crypto";function sL(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(sL).join(",")}]`;return`{${Object.keys(E).sort().map((T)=>`${JSON.stringify(T)}:${sL(E[T])}`).join(",")}}`}var hH=(E)=>nC("sha256").update(sL(E)).digest("hex"),qe=(E)=>nC("sha256").update(sL(E)).digest("hex"),SH=(E)=>nC("sha256").update(RH(E).export({type:"spki",format:"der"})).digest("hex");function NH(E,T,_){try{return k3(null,Buffer.from(sL(E)),RH(_),Buffer.from(T,"base64"))}catch{return!1}}var tH=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((T)=>Number(T)||0),dH=(E,T)=>{let _=tH(E),r=tH(T);for(let t=0;t<3;t++){let d=(_[t]??0)-(r[t]??0);if(d)return d}return 0};function AH(E,T){let _=[];if(T.schemaVersion<E.minimumSchema)_.push(`schema ${T.schemaVersion} is below ${E.minimumSchema}`);if(T.schemaVersion>E.maximumSchema)_.push(`schema ${T.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&dH(T.currentVersion,E.minimumVersion)<0)_.push(`platform ${T.currentVersion} is below ${E.minimumVersion}`);if(dH(E.version,T.currentVersion)<=0)_.push(`version ${E.version} is not newer than ${T.currentVersion}`);if(!E.artifacts.some((r)=>r.platform===T.platform&&r.architecture===T.architecture))_.push(`no artifact for ${T.platform}/${T.architecture}`);return{compatible:_.length===0,reasons:_}}var Vd=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},z_=(E)=>E==null?void 0:String(E),u3=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:z_(E.revoked_at),createdAt:String(E.created_at)}),LH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:Vd(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:Vd(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),OH=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:Vd(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),cH=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:z_(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:Vd(E.health_gate,{}),status:String(E.status),currentStage:z_(E.current_stage),backupId:z_(E.backup_id),approvedBy:z_(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),vC=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:z_(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:Vd(E.evidence,{}),error:z_(E.error),startedAt:z_(E.started_at),finishedAt:z_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),eH=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:Vd(E.criteria,{}),candidates:Vd(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:z_(E.confirmation),expiresAt:String(E.expires_at),result:Vd(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),UH=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:z_(E.backup_policy_id),recoveryPointId:z_(E.recovery_point_id),topologyId:z_(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:z_(E.operation_id),evidence:Vd(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:z_(E.error),startedAt:z_(E.started_at),finishedAt:z_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class pL{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}addTrustedKey(E){let T=this.id(),_=this.now().toISOString(),r=SH(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[T,E.organizationId,E.name,E.publicKeyPem,r,_]),this.key(T)}key(E){let T=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return T?u3(T):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let T=this.key(E.keyId);if(!T||T.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(T.revokedAt)throw Error("Update signing key is revoked.");if(!NH(E.document,E.signature,T.publicKeyPem))throw Error("Update manifest signature is invalid.");let _=AH(E.document,E.current),r=hH(E.document),t=this.id(),d=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[t,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,r,JSON.stringify(E.document),E.signature,JSON.stringify(_),d]),this.manifest(t)}manifest(E){let T=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return T?LH(T):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(LH)}createWindow(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[T,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,_,_]),this.window(T)}window(E){let T=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return T?OH(T):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(OH)}createCampaign(E){return this.control.transaction(()=>{let T=this.manifest(E.manifestId);if(!T?.compatibility.compatible||T.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let _=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[_,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,r,r]),E.targets.forEach((t,d)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),_,t.serverId??null,t.target,E.strategy==="canary"?d===0?0:1+Math.floor((d-1)/E.batchSize):Math.floor(d/E.batchSize),t.previousVersion,r,r])),this.campaign(_)})}campaign(E){let T=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return T?cH(T):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(cH)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(vC)}updateCampaign(E,T){let _=this.campaign(E);if(!_)throw Error("Upgrade campaign was not found.");let r={..._,...T};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[r.status,r.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,T){let _=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!_)throw Error("Upgrade target was not found.");let r={...vC(_),...T};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.evidence),r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),vC(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let T=[...E.candidates].sort((R,h)=>R.id.localeCompare(h.id)),_=qe(T),r=this.id(),t=this.now().toISOString(),d=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[r,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(T),_,T.reduce((R,h)=>R+h.bytes,0),d,t,t]),this.cleanup(r)}cleanup(E){let T=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return T?eH(T):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(eH)}updateCleanup(E,T){let _=this.cleanup(E);if(!_)throw Error("Cleanup plan was not found.");let r={..._,...T};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[r.status,r.confirmation??null,JSON.stringify(r.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[T,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,_,_]),this.drill(T)}drill(E){let T=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return T?UH(T):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(UH)}updateDrill(E,T){let _=this.drill(E);if(!_)throw Error("DR drill was not found.");let r={..._,...T};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,r.operationId??null,JSON.stringify(r.evidence),r.measuredRpoMinutes??null,r.measuredRtoMinutes??null,r.cleanupVerified?1:0,r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}function n3(E,T=new Date){if(!E.enabled)return!1;let _=new Date(E.schedule);if(!Number.isNaN(_.getTime()))return T>=_&&T.getTime()<=_.getTime()+E.durationMinutes*60000;let r=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!r)return!1;let t=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(T),d=Number(t.find((h)=>h.type==="hour")?.value)*60+Number(t.find((h)=>h.type==="minute")?.value),R=Number(r[1])*60+Number(r[2]);return d>=R&&d<R+E.durationMinutes}class oL{store;now;queue;constructor(E,T,_=()=>new Date){this.store=E;this.now=_;this.queue=T??new lE(E.control)}enqueueCampaign(E,T={}){let _=this.store.campaign(E);if(!_)throw Error("Upgrade campaign was not found.");let r=_.windowId?this.store.window(_.windowId):void 0;if(r&&!r.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(r&&!T.overrideWindow&&!n3(r,this.now()))throw Error("Upgrade is outside its maintenance window.");if(r?.requireApproval&&!T.approvedBy&&!_.approvedBy)throw Error("Maintenance approval is required.");let t=this.queue.enqueue({projectId:_.projectId,actorId:T.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:t}}async previewCleanup(E,T){let _=T.find((r)=>r.kind===E.kind);if(!_)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await _.discover(E.criteria)})}enqueueCleanup(E,T){let _=this.store.cleanup(E);if(!_||_.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(_.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let r=`DELETE ${_.candidates.length} ${_.kind}`;if(T!==r)throw Error(`Exact confirmation ${r} is required.`);let t=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${_.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:T}),operation:t}}enqueueDrill(E){let T=this.store.drill(E);if(!T||T.status!=="planned")throw Error("A planned DR drill is required.");let _=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${T.scenario}:${T.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:_.id}),operation:_}}}var lC=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function DH(E){return{"maintenance.upgrade":async(t)=>{let d=E.store.campaign(String(lC(t.operation.input).campaignId??""));if(!d||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let R=E.store.manifest(d.manifestId);if(!R?.compatibility.compatible||R.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let h=R.document.artifacts.find((N)=>N.platform===process.platform&&N.architecture===process.arch)??R.document.artifacts[0];if(!h)throw Error("No update artifact matches this platform.");E.store.updateCampaign(d.id,{status:"running",currentStage:"preflight"});let S=[];try{for(let N of[...new Set(E.store.targets(d.id).map((A)=>A.cohort))].sort((A,L)=>A-L)){E.store.updateCampaign(d.id,{currentStage:`cohort:${N}`});for(let A of E.store.targets(d.id).filter((L)=>L.cohort===N)){t.throwIfCancellationRequested(),t.checkpoint(`download:${A.target}`,"Downloading signed platform artifact."),E.store.updateTarget(A.id,{status:"downloading",startedAt:new Date().toISOString()});let L=await E.platform.download({target:A,artifact:h,signal:t.signal});if(L.sha256!==h.sha256)throw Error(`Artifact checksum mismatch for ${A.target}.`);t.checkpoint(`install:${A.target}`,"Installing verified artifact."),E.store.updateTarget(A.id,{status:"installing"}),await E.platform.install({target:A,path:L.path,version:R.version,signal:t.signal}),S.push(A);let O=await E.platform.health({target:A,gate:d.healthGate});if(!O.healthy)throw Error(`Upgrade health gate failed for ${A.target}.`);E.store.updateTarget(A.id,{status:"healthy",evidence:O.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(d.id,{status:"succeeded",currentStage:void 0}),{campaignId:d.id,version:R.version,targets:S.length}}catch(N){E.store.updateCampaign(d.id,{status:"rolling_back",currentStage:"rollback"});for(let A of S.reverse())E.store.updateTarget(A.id,{status:"rolling_back"}),await E.platform.rollback({target:A,version:A.previousVersion,signal:t.signal}),E.store.updateTarget(A.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(d.id,{status:"rolled_back",currentStage:void 0}),N}},"maintenance.cleanup":async(t)=>{let d=E.store.cleanup(String(lC(t.operation.input).planId??""));if(!d||d.status!=="approved")throw Error("Approved cleanup plan was not found.");if(qe([...d.candidates].sort((A,L)=>A.id.localeCompare(L.id)))!==d.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let R=E.cleanup?.find((A)=>A.kind===d.kind);if(!R)throw Error(`No ${d.kind} cleanup driver is configured.`);E.store.updateCleanup(d.id,{status:"running"});let h=[],S=[];for(let A of d.candidates){t.throwIfCancellationRequested();try{await R.remove(A),h.push(A.id)}catch(L){S.push({id:A.id,error:L instanceof Error?L.message:String(L)})}}let N=S.length?h.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(d.id,{status:N,result:{removed:h,failed:S,reclaimedBytes:d.candidates.filter((A)=>h.includes(A.id)).reduce((A,L)=>A+L.bytes,0)}}),S.length)throw Error(`Cleanup failed for ${S.length} candidate(s).`);return{planId:d.id,removed:h.length,reclaimedBytes:d.estimatedBytes}},"maintenance.drill":async(t)=>{let d=E.store.drill(String(lC(t.operation.input).drillId??""));if(!d)throw Error("DR drill was not found.");let R=E.recovery?.find((L)=>L.scenario===d.scenario);if(!R)throw Error(`No ${d.scenario} recovery driver is configured.`);let h=new Date;E.store.updateDrill(d.id,{status:"restoring",startedAt:h.toISOString()});let S=d.isolatedTarget,N={},A={};try{t.checkpoint("restore","Restoring into isolated drill target.");let L=await R.restore({drill:d,signal:t.signal});if(!L.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");S=L.target,N=L.evidence;let O=(h.getTime()-new Date(L.recoveryPointAt).getTime())/60000;E.store.updateDrill(d.id,{status:"verifying",measuredRpoMinutes:O,evidence:{restore:N}}),t.checkpoint("verify","Running recovery health checks without production traffic.");let c=await R.verify({drill:d,target:S});A=c.evidence;let U=(Date.now()-h.getTime())/60000;if(!c.healthy||O>d.expectedRpoMinutes||U>d.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(d.id,{measuredRpoMinutes:O,measuredRtoMinutes:U,evidence:{restore:N,verify:A}})}catch(L){throw E.store.updateDrill(d.id,{status:"failed",error:L instanceof Error?L.message:String(L),evidence:{restore:N,verify:A}}),L}finally{E.store.updateDrill(d.id,{status:"cleaning"});try{await R.cleanup({drill:d,target:S});let L=E.store.drill(d.id);E.store.updateDrill(d.id,{status:L.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(L){E.store.updateDrill(d.id,{status:"cleanup_required",cleanupVerified:!1,error:L instanceof Error?L.message:String(L),finishedAt:new Date().toISOString()})}}return{drillId:d.id,status:E.store.drill(d.id).status}}}}var $H={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class E0{kind;control;projectId;organizationId;constructor(E,T,_,r){this.kind=E;this.control=T;this.projectId=_;this.organizationId=r}async discover(E){let T=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),_=new Date(Date.now()-T*86400000).toISOString(),r=$H[this.kind],t=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(r.select).all(t,_).map((R)=>({id:String(R.id),kind:this.kind,label:`${this.kind}:${String(R.id)}`,bytes:Number(R.bytes??0),metadata:{createdAt:String(R.created_at)}}))}async remove(E){if(this.control.database.run($H[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function v3(){let E=await o(),T=iE(process.cwd(),E),_=new pL(T.store),r=new oL(_),t=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((d)=>new E0(d,T.store,T.project.id,T.organization.id));return{controlPlane:T,store:_,service:r,cleanup:t}}async function Kd(E){let T=await v3();try{await E(T)}catch(_){Y(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}function iC(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(T)=>Kd((_)=>{let r={manifests:_.store.manifests(_.controlPlane.organization.id),windows:_.store.windows(_.controlPlane.project.id),campaigns:_.store.campaigns(_.controlPlane.project.id),cleanups:_.store.cleanups(_.controlPlane.project.id),drills:_.store.drills(_.controlPlane.project.id)},t=[...r.manifests.map((d)=>["update",d.version,d.compatibility.compatible?"compatible":"blocked",d.compatibility.reasons.join("; ")||d.channel]),...r.campaigns.map((d)=>["upgrade",d.id,d.status,d.currentStage??d.fromVersion]),...r.cleanups.map((d)=>["cleanup",d.kind,d.status,`${d.candidates.length} items / ${d.estimatedBytes} bytes`]),...r.drills.map((d)=>["DR drill",d.scenario,d.status,d.isolatedTarget])];if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Area","Name / version","Status","Detail"],t)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(T,_)=>Kd(async(r)=>{let t=r.store.addTrustedKey({organizationId:r.controlPlane.organization.id,name:T,publicKeyPem:await Bun.file(_).text()});Z(`Trusted ${t.name}: ${t.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(T,_,r)=>Kd(async(t)=>{let d=await Bun.file(T).json(),R=(await Bun.file(_).text()).trim(),h=t.store.importManifest({organizationId:t.controlPlane.organization.id,keyId:r,document:d,signature:R,current:{schemaVersion:t.controlPlane.store.health().schemaVersion,currentVersion:mL,platform:process.platform,architecture:process.arch}});Z(`Verified ${h.version}; ${h.compatibility.compatible?"compatible":"blocked: "+h.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(T,_,r)=>Kd((t)=>{let d=t.store.createWindow({projectId:t.controlPlane.project.id,name:T,schedule:_,timezone:r.timezone,durationMinutes:Number(r.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});Z(`Created ${d.name} (${d.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(T,_,r)=>Kd((t)=>{let d=new vt(t.controlPlane.store).list(t.controlPlane.project.id).filter((S)=>S.status==="ready").map((S)=>({serverId:S.id,target:S.name,previousVersion:S.bootstrapVersion??mL}));if(!d.length)d.push({target:"control-plane",previousVersion:mL});let R=t.store.createCampaign({projectId:t.controlPlane.project.id,manifestId:T,fromVersion:mL,strategy:r.strategy==="rolling"?"rolling":"canary",batchSize:Number(r.batch),healthGate:{kind:"platform"},backupId:_,targets:d}),h=t.service.enqueueCampaign(R.id);Z(`Staged upgrade queued: ${h.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(T,_)=>Kd(async(r)=>{let t=await r.service.previewCleanup({projectId:r.controlPlane.project.id,kind:T,criteria:{olderThanDays:Number(_.olderThan)}},r.cleanup);EE(["ID","Candidate","Bytes"],t.candidates.map((d)=>[d.id,d.label,String(d.bytes)])),e(`Apply with: cloud cleanup:apply ${t.id} --confirm "DELETE ${t.candidates.length} ${t.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(T,_)=>Kd((r)=>{let t=r.service.enqueueCleanup(T,String(_.confirm??""));Z(`Cleanup queued: ${t.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(T,_,r)=>Kd((t)=>{let d=t.store.createDrill({projectId:t.controlPlane.project.id,scenario:T,isolatedTarget:_,expectedRpoMinutes:Number(r.rpo),expectedRtoMinutes:Number(r.rto),recoveryPointId:r.recoveryPoint,topologyId:r.topology});Z(`Planned isolated drill ${d.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(T)=>Kd((_)=>{let r=_.service.enqueueDrill(T);Z(`DR drill queued: ${r.operation.id}`)}))}ME();kR();jr();async function aC(){try{return(await o()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function mC(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(T)=>{b("Lambda Functions");let _=T?.region||await aC(),r=new FT(_);try{let{Functions:t=[]}=await r.listFunctions({MaxItems:50});if(!t.length){e("No functions found");return}EE(["Name","Runtime","Memory","Timeout","Last Modified"],t.map((d)=>[d.FunctionName??"-",d.Runtime??"-",d.MemorySize?`${d.MemorySize} MB`:"-",d.Timeout?`${d.Timeout}s`:"-",d.LastModified??"-"]))}catch(t){Y(`Failed to list functions: ${t.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(T,_)=>{b(`Invoking ${T}`);let r=_?.region||await aC(),t=new FT(r),d=new l("Invoking function...");d.start();try{let R=await t.invoke({FunctionName:T,InvocationType:_?.async?"Event":"RequestResponse",Payload:_?.payload||"{}",LogType:_?.async?"None":"Tail"});if(R.FunctionError){if(d.fail(`Function returned an error (${R.FunctionError})`),R.Payload)e(R.Payload);process.exitCode=1;return}if(d.succeed(`Invoked (status ${R.StatusCode})`),R.Payload)e(`
 Response:`),e(R.Payload);if(R.LogResult)e(`
 Logs:`),e(Buffer.from(R.LogResult,"base64").toString("utf-8"))}catch(R){d.fail(`Invocation failed: ${R.message}`),process.exitCode=1}}),E.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(T,_)=>{b(`Logs for ${T}`);let r=_?.region||await aC(),t=new Nr(r),d=T.startsWith("/aws/lambda/")?T:`/aws/lambda/${T}`,R=Number(_?.since??15),h=(S)=>{for(let N of S){let A=N.timestamp?new Date(N.timestamp).toISOString():"";e(`${A}  ${(N.message??"").trimEnd()}`)}};try{let S=Date.now()-R*60000,{events:N=[]}=await t.filterLogEvents({logGroupName:d,startTime:S,filterPattern:_?.filter,limit:200});if(h(N),N.length)S=(N[N.length-1].timestamp??S)+1;if(_?.tail){e(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise((L)=>setTimeout(L,3000));let{events:A=[]}=await t.filterLogEvents({logGroupName:d,startTime:S,filterPattern:_?.filter,limit:200});if(A.length)h(A),S=(A[A.length-1].timestamp??S)+1}}}catch(S){Y(`Failed to read logs: ${S.message}`),process.exitCode=1}})}ME();async function wH(E){let T=Bun.spawn(["docker",...E],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[_,r]=await Promise.all([T.exited,new Response(T.stderr).text()]);return{ok:_===0,exitCode:_,command:["docker",...E].join(" "),stderr:r.trim()}}function sC(E){E.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(T)=>{let _=["build","--file",T.file??"Dockerfile","--tag",T.tag??"latest","."];if(T.dryRun){console.log(`docker ${_.join(" ")}`);return}let r=await wH(_);if(T.json)console.log(JSON.stringify(r));if(!r.ok)Y(r.stderr||`docker exited ${r.exitCode}`),process.exitCode=r.exitCode;else Z(`Built ${T.tag??"latest"}.`)}),E.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(T)=>{if(!T.image){Y("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(T.dryRun){console.log(`docker push ${T.image}`);return}let _=await wH(["push",T.image]);if(T.json)console.log(JSON.stringify(_));if(!_.ok)Y(_.stderr),process.exitCode=_.exitCode;else Z(`Pushed ${T.image}.`)}),E.command("container:deploy","Deploy a container image").action(async()=>lr("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}ME();Bd();xt();function pC(E){E.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(T)=>{b("Domains");try{let _=bt(T?.provider),r=Fr(T?.provider)?.provider||"unknown",t=new l(`Fetching domains from ${r}...`);t.start();let d=await _.listDomains();if(t.succeed(`Found ${d.length} domain(s)`),d.length===0){e("No domains found in this provider");return}let R=d.map((h)=>[h,"Active","-",r.charAt(0).toUpperCase()+r.slice(1)]);EE(["Domain","Status","SSL","Provider"],R)}catch(_){Y(`Failed to list domains: ${_ instanceof Error?_.message:String(_)}`)}}),E.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(T,_)=>{b(`Adding Domain: ${T}`);try{let r=bt(_?.provider),t=Fr(_?.provider)?.provider||"unknown",d=new l(`Checking if ${t} can manage ${T}...`);if(d.start(),await r.canManageDomain(T))d.succeed(`Domain ${T} is already available in ${t}`),e(`