@stacksjs/ts-cloud 0.7.87 → 0.7.88

package/dist/bin/cli.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env bun
 // @bun
-import{createRequire as _9}from"node:module";var oQ=Object.defineProperty;var E9=(E)=>E;function T9(E,T){this[E]=E9.bind(null,T)}var MT=(E,T)=>{for(var _ in T)oQ(E,_,{get:T[_],enumerable:!0,configurable:!0,set:T9.bind(T,_)})};var wE=(E,T)=>()=>(E&&(T=E(E=0)),T);var Qt=(E)=>Promise.all(E),kE=_9(import.meta.url);class ZF{customEntities={};useHtmlEntities;constructor(E=!1){this.useHtmlEntities=E}addEntity(E,T){this.customEntities[E]=T}decodeEntities(E){let T=E.indexOf("&");if(T===-1)return E;let _=E.length,r="",t=0;while(T!==-1&&T<_){if(T>t)r+=E.substring(t,T);let d=E.indexOf(";",T+1);if(d===-1||d-T>32){r+="&",t=T+1,T=E.indexOf("&",t);continue}let R=E.substring(T+1,d);if(R.charCodeAt(0)===35){let h=R.length,S=0,N=!1;if(h>2&&(R.charCodeAt(1)===120||R.charCodeAt(1)===88)){N=!0;for(let A=2;A<h;A++){let L=R.charCodeAt(A);if(L>=48&&L<=57)S=S<<4|L-48;else if(L>=65&&L<=70)S=S<<4|L-55;else if(L>=97&&L<=102)S=S<<4|L-87;else{N=!1;break}}}else if(h>1){N=!0;for(let A=1;A<h;A++){let L=R.charCodeAt(A);if(L>=48&&L<=57)S=S*10+(L-48);else{N=!1;break}}}if(N)r+=String.fromCodePoint(S);else r+=E.substring(T,d+1)}else{let h=this.customEntities[R];if(h===void 0){let S=R.length;if(S>=2&&S<=4){let N=R.charCodeAt(0);if(N===108&&S===2&&R.charCodeAt(1)===116)h="<";else if(N===103&&S===2&&R.charCodeAt(1)===116)h=">";else if(N===97&&S===3&&R.charCodeAt(1)===109&&R.charCodeAt(2)===112)h="&";else if(N===113&&S===4)h=R==="quot"?'"':void 0;else if(N===97&&S===4)h=R==="apos"?"'":void 0}if(h===void 0)h=S8[R]??(this.useHtmlEntities?N8[R]:void 0)}if(h!==void 0)r+=h;else r+=E.substring(T,d+1)}t=d+1,T=E.indexOf("&",t)}if(t<_)r+=E.substring(t);return r}}function qr(E){return E===32||E===9||E===10||E===13}function t$(E){return E>=65&&E<=90||E>=97&&E<=122||E===95||E===58||E>=192&&E<=214||E>=216&&E<=246||E>=248&&E<=767||E>=880&&E<=893||E>=895&&E<=8191||E>=8204&&E<=8205||E>=8304&&E<=8591||E>=11264&&E<=12271||E>=12289&&E<=55295||E>=63744&&E<=64975||E>=65008&&E<=65533}function gF(E){return t$(E)||E===45||E===46||E>=48&&E<=57||E===183||E>=768&&E<=879||E>=8255&&E<=8256}function VF(E,T){return E.charCodeAt(T)===91&&E.charCodeAt(T+1)===67&&E.charCodeAt(T+2)===68&&E.charCodeAt(T+3)===65&&E.charCodeAt(T+4)===84&&E.charCodeAt(T+5)===65&&E.charCodeAt(T+6)===91}function KF(E,T){let _=E.charCodeAt(T),r=E.charCodeAt(T+1),t=E.charCodeAt(T+2),d=E.charCodeAt(T+3),R=E.charCodeAt(T+4),h=E.charCodeAt(T+5),S=E.charCodeAt(T+6);return(_===68||_===100)&&(r===79||r===111)&&(t===67||t===99)&&(d===84||d===116)&&(R===89||R===121)&&(h===80||h===112)&&(S===69||S===101)}function e8(E,T,_){if(T>=_||!t$(E.charCodeAt(T)))return T;T++;while(T<_&&gF(E.charCodeAt(T)))T++;return T}class d${options;entityDecoder;unpairedSet;exactStopNodes;wildcardStopSuffixes;needsJPath;_ignoreAttributes=!0;_textNodeName="#text";_commentPropName=!1;_cdataPropName=!1;_piPropName=!1;_alwaysCreateTextNode=!1;_trimValues=!0;_processEntities=!0;_parseTagValue=!0;_parseAttributeValue=!1;_removeNSPrefix=!1;_attrPrefix="@_";_attrsGroupName=!1;_ignorePiTags=!1;_ignoreDeclaration=!1;constructor(E){this.options={...A8,...E},this.entityDecoder=new ZF(this.options.htmlEntities),this.unpairedSet=new Set(this.options.unpairedTags),this.exactStopNodes=new Set,this.wildcardStopSuffixes=[];for(let T of this.options.stopNodes)if(T.startsWith("*."))this.wildcardStopSuffixes.push(T.substring(2));else this.exactStopNodes.add(T);this._ignoreAttributes=this.options.ignoreAttributes,this._textNodeName=this.options.textNodeName,this._commentPropName=this.options.commentPropName,this._cdataPropName=this.options.cdataPropName,this._piPropName=this.options.piPropName,this._alwaysCreateTextNode=this.options.alwaysCreateTextNode,this._trimValues=this.options.trimValues,this._processEntities=this.options.processEntities,this._parseTagValue=this.options.parseTagValue,this._parseAttributeValue=this.options.parseAttributeValue,this._removeNSPrefix=this.options.removeNSPrefix,this._attrPrefix=this.options.attributeNamePrefix,this._attrsGroupName=this.options.attributesGroupName,this._ignorePiTags=this.options.ignorePiTags,this._ignoreDeclaration=this.options.ignoreDeclaration,this.needsJPath=this.options.stopNodes.length>0||this.options.isArray!==void 0||this.options.updateTag!==void 0||this.options.tagValueProcessor!==void 0||this.options.attributeValueProcessor!==void 0}addEntity(E,T){this.entityDecoder.addEntity(E,T)}parse(E){if(E instanceof Uint8Array)E=new TextDecoder().decode(E);let T=E;if(this.options.preserveOrder)return this.parseOrdered(T);return this.parseUnordered(T)}parseUnordered(E){let T={},_=E.length,r=0;if(_>0&&E.charCodeAt(0)===65279)r=1;return r=this.parseChildren(E,r,_,T,"",[]),T}parseOrdered(E){let T=E.length,_=0;if(T>0&&E.charCodeAt(0)===65279)_=1;let r=[];return this.parseChildrenOrdered(E,_,T,r,""),r}readTagName(E,T,_){return e8(E,T,_)}extractTagName(E,T,_){let r=E.substring(T,_);if(this._removeNSPrefix){let t=r.indexOf(":");if(t!==-1)r=r.substring(t+1)}if(this.options.transformTagName)r=this.options.transformTagName(r);return r}parseAttributes(E,T,_,r,t){let d=0,R=this._removeNSPrefix,h=this.options.transformAttributeName,S=this._trimValues,N=this._processEntities,A=this.options.attributeValueProcessor;while(T<_){let L=E.charCodeAt(T);while(L===32||L===9||L===10||L===13){if(T++,T>=_)break;L=E.charCodeAt(T)}if(T>=_)break;if(L===62||L===47)break;let O=T;if(!t$(L))break;T++;while(T<_&&gF(E.charCodeAt(T)))T++;let c=E.substring(O,T);if(R){let U=c.indexOf(":");if(U!==-1)c=c.substring(U+1)}if(h)c=h(c);while(T<_&&qr(E.charCodeAt(T)))T++;if(T<_&&E.charCodeAt(T)===61){T++;while(T<_&&qr(E.charCodeAt(T)))T++;if(T>=_)break;let U=E.charCodeAt(T);if(U===34||U===39){T++;let $=T;while(T<_&&E.charCodeAt(T)!==U)T++;let I=E.substring($,T);if(S&&I.length>0){let w=I.charCodeAt(0),z=I.charCodeAt(I.length-1);if(w<=32||z<=32)I=I.trim()}if(N)I=this.entityDecoder.decodeEntities(I);if(A)I=A(c,I,r)??I;if(t[c]=I,d++,T<_)T++}}else t[c]="true",d++}return d>0?-T-1:T}processTagValue(E,T,_,r,t){if(this._trimValues){let d=E.length;if(d>0){let R=E.charCodeAt(0),h=E.charCodeAt(d-1);if(R<=32||h<=32)E=E.trim()}}if(this._processEntities)E=this.entityDecoder.decodeEntities(E);if(this.options.tagValueProcessor){let d=this.options.tagValueProcessor(T,E,_,r,t);if(d!==void 0)E=d}if(!E)return E;if(this._parseTagValue)return this.parseValue(E);return E}parseValue(E){if(E==="true")return!0;if(E==="false")return!1;if(!E)return E;let T=E.charCodeAt(0);if(!(T>=48&&T<=57||T===43||T===45||T===46))return E;let r=this.options.numberParseOptions;if(r.skipLike?.test(E))return E;if(r.hex&&T===48&&L8.test(E))return Number.parseInt(E,16);if(E.length>1&&T===48&&E.charCodeAt(1)!==46){if(r.leadingZeros)return E}if(r.scientific&&O8.test(E)){let t=Number(E);if(!Number.isNaN(t))return t}if(c8.test(E)){let t=Number(E);if(!Number.isNaN(t))return t}return E}parseAttributeValue(E){if(!this._parseAttributeValue)return E;return this.parseValue(E)}isStopNode(E){if(this.exactStopNodes.has(E))return!0;for(let T of this.wildcardStopSuffixes)if(E.endsWith(`.${T}`)||E===T)return!0;return!1}readStopNodeContent(E,T,_,r){let t=`</${r}`,d=E.indexOf(t,T);if(d===-1)return{content:E.substring(T),pos:_};let R=E.substring(T,d),h=d+t.length;while(h<_&&E.charCodeAt(h)!==62)h++;if(h<_)h++;return{content:R,pos:h}}addToObj(E,T,_,r,t,d){let R=E[T];if(R!==void 0)if(!Array.isArray(R))E[T]=[R,_];else R.push(_);else if(this.options.isArray?.(T,r,t,d))E[T]=[_];else E[T]=_}flushText(E,T,_,r){if(!E&&!T)return;let t=this._textNodeName;if(T){let d=E;if(d&&this._processEntities)d=this.entityDecoder.decodeEntities(d);let R=T+d;if(this._trimValues&&R.length>0){let h=R.charCodeAt(0),S=R.charCodeAt(R.length-1);if(h<=32||S<=32)R=R.trim()}if(this.options.tagValueProcessor){let h=this.options.tagValueProcessor(t,R,_,!1,!0);if(h!==void 0)R=h}if(R){let h=this._parseTagValue?this.parseValue(R):R;if(h!==void 0&&h!=="")this.addToObj(r,t,h,_,!0,!1)}}else{let d=this.processTagValue(E,t,_,!1,!0);if(d!==void 0&&d!=="")this.addToObj(r,t,d,_,!0,!1)}}parseChildren(E,T,_,r,t,d){let R="",h="",S=this.needsJPath;while(T<_){if(E.charCodeAt(T)!==60){let w=T;T++;while(T<_&&E.charCodeAt(T)!==60)T++;if(!R)R=E.substring(w,T);else R+=E.substring(w,T);continue}if(T+1>=_)break;let A=E.charCodeAt(T+1);if(A===33&&T+3<_&&E.charCodeAt(T+2)===45&&E.charCodeAt(T+3)===45){if(R||h)this.flushText(R,h,t,r),R="",h="";T+=4;let w=E.indexOf("-->",T);if(w===-1){T=_;break}if(this._commentPropName){let z=E.substring(T,w);this.addToObj(r,this._commentPropName,z,t,!0,!1)}T=w+3;continue}if(A===33&&T+8<_&&VF(E,T+2)){T+=9;let w=E.indexOf("]]>",T);if(w===-1){T=_;break}let z=E.substring(T,w);if(this._cdataPropName)this.flushText(R,h,t,r),R="",h="",this.addToObj(r,this._cdataPropName,z,t,!0,!1);else{if(R){let F=R;if(this._processEntities)F=this.entityDecoder.decodeEntities(F);h+=F,R=""}h+=z}T=w+3;continue}if(A===33&&T+9<_&&KF(E,T+2)){T+=9;let w=1;while(T<_&&w>0){let z=E.charCodeAt(T);if(z===60)w++;else if(z===62)w--;T++}continue}if(A===63){T+=2;let w=T;while(T<_&&!qr(E.charCodeAt(T))&&E.charCodeAt(T)!==63)T++;let z=E.substring(w,T),F=E.indexOf("?>",T);if(F===-1){T=_;break}let j=E.substring(T,F).trim();if(z==="xml"){if(!this._ignoreDeclaration&&this._piPropName){let Y=this.parsePiAttributes(j);this.addToObj(r,this._piPropName,{[z]:Y},t,!0,!1)}}else if(!this._ignorePiTags&&this._piPropName)this.addToObj(r,this._piPropName,{[z]:j},t,!0,!1);T=F+2;continue}if(A===47){if(R||h)this.flushText(R,h,t,r),R="",h="";T+=2;let w=T,z=this.readTagName(E,T,_),F=this.extractTagName(E,w,z);T=z;while(T<_&&qr(E.charCodeAt(T)))T++;if(T<_&&E.charCodeAt(T)===62)T++;if(d.length>0&&d[d.length-1]===F){d.pop();continue}return T}if(R||h)this.flushText(R,h,t,r),R="",h="";T++;let L=T,O=this.readTagName(E,T,_),c=this.extractTagName(E,L,O);if(!c){T=O+1;continue}T=O;let U=S?t?`${t}.${c}`:c:"",$={},I=!1;if(!this._ignoreAttributes){let w=this.parseAttributes(E,T,_,U,$);if(w<0)T=-w-1,I=!0;else T=w}else while(T<_){let w=E.charCodeAt(T);if(w===62||w===47)break;if(w===34||w===39){T++;while(T<_&&E.charCodeAt(T)!==w)T++}T++}if(this.options.updateTag){if(this.options.updateTag(c,U,$)===!1){while(T<_&&qr(E.charCodeAt(T)))T++;if(T<_&&E.charCodeAt(T)===47)T+=2;else if(T<_&&E.charCodeAt(T)===62){T++;let z=`</${c}>`,F=E.indexOf(z,T);if(F!==-1)T=F+z.length}continue}}while(T<_&&qr(E.charCodeAt(T)))T++;if(T<_&&E.charCodeAt(T)===47){if(T+=2,I||this._alwaysCreateTextNode){let w={};if(I)this.applyAttributes(w,$,U);if(this._alwaysCreateTextNode)w[this._textNodeName]="";this.addToObj(r,c,w,U,!0,!1)}else this.addToObj(r,c,"",U,!0,!1);continue}if(T<_&&E.charCodeAt(T)===62){if(T++,this.unpairedSet.has(c)){if(I){let j={};this.applyAttributes(j,$,U),this.addToObj(r,c,j,U,!0,!1)}else this.addToObj(r,c,"",U,!0,!1);d.push(c);continue}if(this.exactStopNodes.size>0||this.wildcardStopSuffixes.length>0){if(this.isStopNode(U)){let j=this.readStopNodeContent(E,T,_,c),Y={};if(I)this.applyAttributes(Y,$,U);if(j.content)Y[this._textNodeName]=j.content;this.addToObj(r,c,Y,U,!0,!1),T=j.pos;continue}}let w={};if(I)this.applyAttributes(w,$,U);T=this.parseChildren(E,T,_,w,U,d);let z=this._textNodeName,F=w[z];if(!I&&!this._alwaysCreateTextNode){let j=!0;for(let Y in w)if(Y!==z){j=!1;break}if(j){this.addToObj(r,c,F!==void 0?F:"",U,!0,!1);continue}}this.addToObj(r,c,w,U,!1,!1)}}if(R||h)this.flushText(R,h,t,r);return T}parseChildrenOrdered(E,T,_,r,t){let d="",R=this.needsJPath;while(T<_){if(E.charCodeAt(T)!==60){let I=T;T++;while(T<_&&E.charCodeAt(T)!==60)T++;if(!d)d=E.substring(I,T);else d+=E.substring(I,T);continue}if(T+1>=_)break;let S=E.charCodeAt(T+1);if(S===33&&T+3<_&&E.charCodeAt(T+2)===45&&E.charCodeAt(T+3)===45){if(d){let w=this.processTagValue(d,this._textNodeName,t,!1,!0);if(w!==void 0&&w!=="")r.push({[this._textNodeName]:w});d=""}T+=4;let I=E.indexOf("-->",T);if(I===-1){T=_;break}if(this._commentPropName)r.push({[this._commentPropName]:[{[this._textNodeName]:E.substring(T,I)}]});T=I+3;continue}if(S===33&&T+8<_&&VF(E,T+2)){T+=9;let I=E.indexOf("]]>",T);if(I===-1){T=_;break}let w=E.substring(T,I);if(this._cdataPropName){if(d){let z=this.processTagValue(d,this._textNodeName,t,!1,!0);if(z!==void 0&&z!=="")r.push({[this._textNodeName]:z});d=""}r.push({[this._cdataPropName]:[{[this._textNodeName]:w}]})}else d+=w;T=I+3;continue}if(S===33&&T+9<_&&KF(E,T+2)){T+=9;let I=1;while(T<_&&I>0){let w=E.charCodeAt(T);if(w===60)I++;else if(w===62)I--;T++}continue}if(S===63){T+=2;let I=E.indexOf("?>",T);if(I===-1){T=_;break}T=I+2;continue}if(S===47){if(d){let w=this.processTagValue(d,this._textNodeName,t,!1,!0);if(w!==void 0&&w!=="")r.push({[this._textNodeName]:w});d=""}T+=2,T=this.readTagName(E,T,_);while(T<_&&qr(E.charCodeAt(T)))T++;if(T<_&&E.charCodeAt(T)===62)T++;return T}if(d){let I=this.processTagValue(d,this._textNodeName,t,!1,!0);if(I!==void 0&&I!=="")r.push({[this._textNodeName]:I});d=""}T++;let N=T,A=this.readTagName(E,T,_),L=this.extractTagName(E,N,A);if(!L){T=A+1;continue}T=A;let O=R?t?`${t}.${L}`:L:"",c={},U=!1;if(!this._ignoreAttributes){let I=this.parseAttributes(E,T,_,O,c);if(I<0)T=-I-1,U=!0;else T=I}else while(T<_){let I=E.charCodeAt(T);if(I===62||I===47)break;if(I===34||I===39){T++;while(T<_&&E.charCodeAt(T)!==I)T++}T++}while(T<_&&qr(E.charCodeAt(T)))T++;let $={[L]:[]};if(U){$[":@"]={};for(let w in c)$[":@"][this._attrPrefix+w]=this.parseAttributeValue(c[w])}if(T<_&&E.charCodeAt(T)===47){T+=2,r.push($);continue}if(T<_&&E.charCodeAt(T)===62)T++,T=this.parseChildrenOrdered(E,T,_,$[L],O),r.push($)}if(d){let h=this.processTagValue(d,this._textNodeName,t,!1,!0);if(h!==void 0&&h!=="")r.push({[this._textNodeName]:h})}return T}applyAttributes(E,T,_){let r=this._attrPrefix;if(this._attrsGroupName){let t={};for(let d in T)t[r+d]=this.parseAttributeValue(T[d]);E[this._attrsGroupName]=t}else for(let t in T)E[r+t]=this.parseAttributeValue(T[t])}parsePiAttributes(E){let T={},_=0,r=E.length;while(_<r){while(_<r&&qr(E.charCodeAt(_)))_++;if(_>=r)break;let t=_;while(_<r&&!qr(E.charCodeAt(_))&&E.charCodeAt(_)!==61)_++;let d=E.substring(t,_);if(!d)break;while(_<r&&qr(E.charCodeAt(_)))_++;if(_<r&&E.charCodeAt(_)===61){_++;while(_<r&&qr(E.charCodeAt(_)))_++;if(_<r){let R=E.charCodeAt(_);if(R===34||R===39){_++;let h=_;while(_<r&&E.charCodeAt(_)!==R)_++;if(T[d]=E.substring(h,_),_<r)_++}}}}return T}}var S8,N8,ZA,A8,L8,O8,c8;var qF=wE(()=>{S8={amp:"&",lt:"<",gt:">",quot:'"',apos:"'"},N8={nbsp:" ",copy:"©",reg:"®",trade:"™",euro:"€",pound:"£",yen:"¥",cent:"¢",deg:"°",micro:"µ",middot:"·",bull:"•",hellip:"…",prime:"′",Prime:"″",laquo:"«",raquo:"»",lsquo:"‘",rsquo:"’",ldquo:"“",rdquo:"”",ndash:"–",mdash:"—",iexcl:"¡",iquest:"¿",sect:"§",para:"¶",dagger:"†",Dagger:"‡",lsaquo:"‹",rsaquo:"›",oline:"‾",frasl:"⁄",ensp:" ",emsp:" ",thinsp:" ",zwnj:"‌",zwj:"‍",lrm:"‎",rlm:"‏",times:"×",divide:"÷",plusmn:"±",ne:"≠",le:"≤",ge:"≥",infin:"∞",fnof:"ƒ",Alpha:"Α",Beta:"Β",Gamma:"Γ",Delta:"Δ",Epsilon:"Ε",Zeta:"Ζ",Eta:"Η",Theta:"Θ",Iota:"Ι",Kappa:"Κ",Lambda:"Λ",Mu:"Μ",Nu:"Ν",Xi:"Ξ",Omicron:"Ο",Pi:"Π",Rho:"Ρ",Sigma:"Σ",Tau:"Τ",Upsilon:"Υ",Phi:"Φ",Chi:"Χ",Psi:"Ψ",Omega:"Ω",alpha:"α",beta:"β",gamma:"γ",delta:"δ",epsilon:"ε",zeta:"ζ",eta:"η",theta:"θ",iota:"ι",kappa:"κ",lambda:"λ",mu:"μ",nu:"ν",xi:"ξ",omicron:"ο",pi:"π",rho:"ρ",sigmaf:"ς",sigma:"σ",tau:"τ",upsilon:"υ",phi:"φ",chi:"χ",psi:"ψ",omega:"ω",thetasym:"ϑ",upsih:"ϒ",piv:"ϖ",larr:"←",uarr:"↑",rarr:"→",darr:"↓",harr:"↔",crarr:"↵",lArr:"⇐",uArr:"⇑",rArr:"⇒",dArr:"⇓",hArr:"⇔",forall:"∀",part:"∂",exist:"∃",empty:"∅",nabla:"∇",isin:"∈",notin:"∉",ni:"∋",prod:"∏",sum:"∑",minus:"−",lowast:"∗",radic:"√",prop:"∝",ang:"∠",and:"∧",or:"∨",cap:"∩",cup:"∪",int:"∫",there4:"∴",sim:"∼",cong:"≅",asymp:"≈",equiv:"≡",sub:"⊂",sup:"⊃",nsub:"⊄",sube:"⊆",supe:"⊇",oplus:"⊕",otimes:"⊗",perp:"⊥",sdot:"⋅",lceil:"⌈",rceil:"⌉",lfloor:"⌊",rfloor:"⌋",lang:"〈",rang:"〉",loz:"◊",spades:"♠",clubs:"♣",hearts:"♥",diams:"♦",Agrave:"À",Aacute:"Á",Acirc:"Â",Atilde:"Ã",Auml:"Ä",Aring:"Å",AElig:"Æ",Ccedil:"Ç",Egrave:"È",Eacute:"É",Ecirc:"Ê",Euml:"Ë",Igrave:"Ì",Iacute:"Í",Icirc:"Î",Iuml:"Ï",ETH:"Ð",Ntilde:"Ñ",Ograve:"Ò",Oacute:"Ó",Ocirc:"Ô",Otilde:"Õ",Ouml:"Ö",Oslash:"Ø",Ugrave:"Ù",Uacute:"Ú",Ucirc:"Û",Uuml:"Ü",Yacute:"Ý",THORN:"Þ",szlig:"ß",agrave:"à",aacute:"á",acirc:"â",atilde:"ã",auml:"ä",aring:"å",aelig:"æ",ccedil:"ç",egrave:"è",eacute:"é",ecirc:"ê",euml:"ë",igrave:"ì",iacute:"í",icirc:"î",iuml:"ï",eth:"ð",ntilde:"ñ",ograve:"ò",oacute:"ó",ocirc:"ô",otilde:"õ",ouml:"ö",oslash:"ø",ugrave:"ù",uacute:"ú",ucirc:"û",uuml:"ü",yacute:"ý",thorn:"þ",yuml:"ÿ",OElig:"Œ",oelig:"œ",Scaron:"Š",scaron:"š",Yuml:"Ÿ",circ:"ˆ",tilde:"˜"};ZA=[];ZA[38]="&amp;";ZA[60]="&lt;";ZA[62]="&gt;";ZA[34]="&quot;";ZA[39]="&apos;";A8={attributeNamePrefix:"@_",attributesGroupName:!1,textNodeName:"#text",ignoreAttributes:!0,removeNSPrefix:!1,allowBooleanAttributes:!1,alwaysCreateTextNode:!1,trimValues:!0,parseTagValue:!0,parseAttributeValue:!1,processEntities:!0,htmlEntities:!1,commentPropName:!1,cdataPropName:!1,piPropName:!1,preserveOrder:!1,stopNodes:[],unpairedTags:[],isArray:void 0,tagValueProcessor:void 0,attributeValueProcessor:void 0,updateTag:void 0,numberParseOptions:{hex:!0,leadingZeros:!0,scientific:!0},ignorePiTags:!1,transformAttributeName:void 0,transformTagName:void 0,ignoreDeclaration:!1};L8=/^0x[\da-fA-F]+$/,O8=/^[+-]?\d+(\.\d+)?[eE][+-]?\d+$/,c8=/^[+-]?(\d+\.?\d*|\.\d+)$/});var UR={};MT(UR,{resolveS3Endpoint:()=>gA,detectCredentialSource:()=>R$,buildQueryParams:()=>IT,AWSClient:()=>zE});import*as eR from"node:crypto";import{existsSync as xF,readFileSync as U8}from"node:fs";import{homedir as bF}from"node:os";import{join as kF}from"node:path";function gA(E){let T=E.endpoint||`s3.${E.region}.amazonaws.com`,_=new URL(/^https?:\/\//i.test(T)?T:`https://${T}`);if(_.protocol!=="http:"&&_.protocol!=="https:"||_.pathname!=="/"&&_.pathname!==""||_.search||_.hash||_.username||_.password)throw Error("S3 endpoint must be an HTTP(S) origin without a path");let r=_.protocol.slice(0,-1),t=_.host;if(!E.bucket)return{protocol:r,host:t,path:E.path};if(E.forcePathStyle){let d=E.path==="/"?`/${E.bucket}`:`/${E.bucket}${E.path}`;return{protocol:r,host:t,path:d}}return{protocol:r,host:`${E.bucket}.${t}`,path:E.path}}class zE{credentials;config;cache;xmlParser;constructor(E,T){this.config={maxRetries:3,retryDelay:1000,cacheEnabled:!0,defaultCacheTTL:60000,...T},this.credentials=E||this.loadCredentials(),this.cache=new Map,this.xmlParser=new d$({ignoreAttributes:!1,attributeNamePrefix:"@_",textNodeName:"#text",parseAttributeValue:!0,trimValues:!0})}loadCredentials(){let E=process.env.AWS_ACCESS_KEY_ID,T=process.env.AWS_SECRET_ACCESS_KEY,_=process.env.AWS_SESSION_TOKEN;if(E&&T)return{accessKeyId:E,secretAccessKey:T,sessionToken:_};let r=this.loadCredentialsFromFile();if(r)return r;return{accessKeyId:"",secretAccessKey:""}}loadCredentialsFromFile(){let E=this.config?.profile||process.env.AWS_PROFILE||"default",T=process.env.AWS_SHARED_CREDENTIALS_FILE||kF(bF(),".aws","credentials");if(!xF(T))return null;try{let _=U8(T,"utf-8"),r=this.parseCredentialsFile(_,E);if(r.accessKeyId&&r.secretAccessKey)return r}catch{}return null}parseCredentialsFile(E,T){let _=E.split(`
+import{createRequire as _8}from"node:module";var oQ=Object.defineProperty;var E8=(E)=>E;function T8(E,T){this[E]=E8.bind(null,T)}var MT=(E,T)=>{for(var _ in T)oQ(E,_,{get:T[_],enumerable:!0,configurable:!0,set:T8.bind(T,_)})};var wE=(E,T)=>()=>(E&&(T=E(E=0)),T);var Qt=(E)=>Promise.all(E),kE=_8(import.meta.url);class ZF{customEntities={};useHtmlEntities;constructor(E=!1){this.useHtmlEntities=E}addEntity(E,T){this.customEntities[E]=T}decodeEntities(E){let T=E.indexOf("&");if(T===-1)return E;let _=E.length,r="",t=0;while(T!==-1&&T<_){if(T>t)r+=E.substring(t,T);let d=E.indexOf(";",T+1);if(d===-1||d-T>32){r+="&",t=T+1,T=E.indexOf("&",t);continue}let R=E.substring(T+1,d);if(R.charCodeAt(0)===35){let h=R.length,S=0,N=!1;if(h>2&&(R.charCodeAt(1)===120||R.charCodeAt(1)===88)){N=!0;for(let A=2;A<h;A++){let L=R.charCodeAt(A);if(L>=48&&L<=57)S=S<<4|L-48;else if(L>=65&&L<=70)S=S<<4|L-55;else if(L>=97&&L<=102)S=S<<4|L-87;else{N=!1;break}}}else if(h>1){N=!0;for(let A=1;A<h;A++){let L=R.charCodeAt(A);if(L>=48&&L<=57)S=S*10+(L-48);else{N=!1;break}}}if(N)r+=String.fromCodePoint(S);else r+=E.substring(T,d+1)}else{let h=this.customEntities[R];if(h===void 0){let S=R.length;if(S>=2&&S<=4){let N=R.charCodeAt(0);if(N===108&&S===2&&R.charCodeAt(1)===116)h="<";else if(N===103&&S===2&&R.charCodeAt(1)===116)h=">";else if(N===97&&S===3&&R.charCodeAt(1)===109&&R.charCodeAt(2)===112)h="&";else if(N===113&&S===4)h=R==="quot"?'"':void 0;else if(N===97&&S===4)h=R==="apos"?"'":void 0}if(h===void 0)h=S9[R]??(this.useHtmlEntities?N9[R]:void 0)}if(h!==void 0)r+=h;else r+=E.substring(T,d+1)}t=d+1,T=E.indexOf("&",t)}if(t<_)r+=E.substring(t);return r}}function qr(E){return E===32||E===9||E===10||E===13}function t$(E){return E>=65&&E<=90||E>=97&&E<=122||E===95||E===58||E>=192&&E<=214||E>=216&&E<=246||E>=248&&E<=767||E>=880&&E<=893||E>=895&&E<=8191||E>=8204&&E<=8205||E>=8304&&E<=8591||E>=11264&&E<=12271||E>=12289&&E<=55295||E>=63744&&E<=64975||E>=65008&&E<=65533}function gF(E){return t$(E)||E===45||E===46||E>=48&&E<=57||E===183||E>=768&&E<=879||E>=8255&&E<=8256}function VF(E,T){return E.charCodeAt(T)===91&&E.charCodeAt(T+1)===67&&E.charCodeAt(T+2)===68&&E.charCodeAt(T+3)===65&&E.charCodeAt(T+4)===84&&E.charCodeAt(T+5)===65&&E.charCodeAt(T+6)===91}function KF(E,T){let _=E.charCodeAt(T),r=E.charCodeAt(T+1),t=E.charCodeAt(T+2),d=E.charCodeAt(T+3),R=E.charCodeAt(T+4),h=E.charCodeAt(T+5),S=E.charCodeAt(T+6);return(_===68||_===100)&&(r===79||r===111)&&(t===67||t===99)&&(d===84||d===116)&&(R===89||R===121)&&(h===80||h===112)&&(S===69||S===101)}function e9(E,T,_){if(T>=_||!t$(E.charCodeAt(T)))return T;T++;while(T<_&&gF(E.charCodeAt(T)))T++;return T}class d${options;entityDecoder;unpairedSet;exactStopNodes;wildcardStopSuffixes;needsJPath;_ignoreAttributes=!0;_textNodeName="#text";_commentPropName=!1;_cdataPropName=!1;_piPropName=!1;_alwaysCreateTextNode=!1;_trimValues=!0;_processEntities=!0;_parseTagValue=!0;_parseAttributeValue=!1;_removeNSPrefix=!1;_attrPrefix="@_";_attrsGroupName=!1;_ignorePiTags=!1;_ignoreDeclaration=!1;constructor(E){this.options={...A9,...E},this.entityDecoder=new ZF(this.options.htmlEntities),this.unpairedSet=new Set(this.options.unpairedTags),this.exactStopNodes=new Set,this.wildcardStopSuffixes=[];for(let T of this.options.stopNodes)if(T.startsWith("*."))this.wildcardStopSuffixes.push(T.substring(2));else this.exactStopNodes.add(T);this._ignoreAttributes=this.options.ignoreAttributes,this._textNodeName=this.options.textNodeName,this._commentPropName=this.options.commentPropName,this._cdataPropName=this.options.cdataPropName,this._piPropName=this.options.piPropName,this._alwaysCreateTextNode=this.options.alwaysCreateTextNode,this._trimValues=this.options.trimValues,this._processEntities=this.options.processEntities,this._parseTagValue=this.options.parseTagValue,this._parseAttributeValue=this.options.parseAttributeValue,this._removeNSPrefix=this.options.removeNSPrefix,this._attrPrefix=this.options.attributeNamePrefix,this._attrsGroupName=this.options.attributesGroupName,this._ignorePiTags=this.options.ignorePiTags,this._ignoreDeclaration=this.options.ignoreDeclaration,this.needsJPath=this.options.stopNodes.length>0||this.options.isArray!==void 0||this.options.updateTag!==void 0||this.options.tagValueProcessor!==void 0||this.options.attributeValueProcessor!==void 0}addEntity(E,T){this.entityDecoder.addEntity(E,T)}parse(E){if(E instanceof Uint8Array)E=new TextDecoder().decode(E);let T=E;if(this.options.preserveOrder)return this.parseOrdered(T);return this.parseUnordered(T)}parseUnordered(E){let T={},_=E.length,r=0;if(_>0&&E.charCodeAt(0)===65279)r=1;return r=this.parseChildren(E,r,_,T,"",[]),T}parseOrdered(E){let T=E.length,_=0;if(T>0&&E.charCodeAt(0)===65279)_=1;let r=[];return this.parseChildrenOrdered(E,_,T,r,""),r}readTagName(E,T,_){return e9(E,T,_)}extractTagName(E,T,_){let r=E.substring(T,_);if(this._removeNSPrefix){let t=r.indexOf(":");if(t!==-1)r=r.substring(t+1)}if(this.options.transformTagName)r=this.options.transformTagName(r);return r}parseAttributes(E,T,_,r,t){let d=0,R=this._removeNSPrefix,h=this.options.transformAttributeName,S=this._trimValues,N=this._processEntities,A=this.options.attributeValueProcessor;while(T<_){let L=E.charCodeAt(T);while(L===32||L===9||L===10||L===13){if(T++,T>=_)break;L=E.charCodeAt(T)}if(T>=_)break;if(L===62||L===47)break;let O=T;if(!t$(L))break;T++;while(T<_&&gF(E.charCodeAt(T)))T++;let c=E.substring(O,T);if(R){let U=c.indexOf(":");if(U!==-1)c=c.substring(U+1)}if(h)c=h(c);while(T<_&&qr(E.charCodeAt(T)))T++;if(T<_&&E.charCodeAt(T)===61){T++;while(T<_&&qr(E.charCodeAt(T)))T++;if(T>=_)break;let U=E.charCodeAt(T);if(U===34||U===39){T++;let $=T;while(T<_&&E.charCodeAt(T)!==U)T++;let I=E.substring($,T);if(S&&I.length>0){let w=I.charCodeAt(0),z=I.charCodeAt(I.length-1);if(w<=32||z<=32)I=I.trim()}if(N)I=this.entityDecoder.decodeEntities(I);if(A)I=A(c,I,r)??I;if(t[c]=I,d++,T<_)T++}}else t[c]="true",d++}return d>0?-T-1:T}processTagValue(E,T,_,r,t){if(this._trimValues){let d=E.length;if(d>0){let R=E.charCodeAt(0),h=E.charCodeAt(d-1);if(R<=32||h<=32)E=E.trim()}}if(this._processEntities)E=this.entityDecoder.decodeEntities(E);if(this.options.tagValueProcessor){let d=this.options.tagValueProcessor(T,E,_,r,t);if(d!==void 0)E=d}if(!E)return E;if(this._parseTagValue)return this.parseValue(E);return E}parseValue(E){if(E==="true")return!0;if(E==="false")return!1;if(!E)return E;let T=E.charCodeAt(0);if(!(T>=48&&T<=57||T===43||T===45||T===46))return E;let r=this.options.numberParseOptions;if(r.skipLike?.test(E))return E;if(r.hex&&T===48&&L9.test(E))return Number.parseInt(E,16);if(E.length>1&&T===48&&E.charCodeAt(1)!==46){if(r.leadingZeros)return E}if(r.scientific&&O9.test(E)){let t=Number(E);if(!Number.isNaN(t))return t}if(c9.test(E)){let t=Number(E);if(!Number.isNaN(t))return t}return E}parseAttributeValue(E){if(!this._parseAttributeValue)return E;return this.parseValue(E)}isStopNode(E){if(this.exactStopNodes.has(E))return!0;for(let T of this.wildcardStopSuffixes)if(E.endsWith(`.${T}`)||E===T)return!0;return!1}readStopNodeContent(E,T,_,r){let t=`</${r}`,d=E.indexOf(t,T);if(d===-1)return{content:E.substring(T),pos:_};let R=E.substring(T,d),h=d+t.length;while(h<_&&E.charCodeAt(h)!==62)h++;if(h<_)h++;return{content:R,pos:h}}addToObj(E,T,_,r,t,d){let R=E[T];if(R!==void 0)if(!Array.isArray(R))E[T]=[R,_];else R.push(_);else if(this.options.isArray?.(T,r,t,d))E[T]=[_];else E[T]=_}flushText(E,T,_,r){if(!E&&!T)return;let t=this._textNodeName;if(T){let d=E;if(d&&this._processEntities)d=this.entityDecoder.decodeEntities(d);let R=T+d;if(this._trimValues&&R.length>0){let h=R.charCodeAt(0),S=R.charCodeAt(R.length-1);if(h<=32||S<=32)R=R.trim()}if(this.options.tagValueProcessor){let h=this.options.tagValueProcessor(t,R,_,!1,!0);if(h!==void 0)R=h}if(R){let h=this._parseTagValue?this.parseValue(R):R;if(h!==void 0&&h!=="")this.addToObj(r,t,h,_,!0,!1)}}else{let d=this.processTagValue(E,t,_,!1,!0);if(d!==void 0&&d!=="")this.addToObj(r,t,d,_,!0,!1)}}parseChildren(E,T,_,r,t,d){let R="",h="",S=this.needsJPath;while(T<_){if(E.charCodeAt(T)!==60){let w=T;T++;while(T<_&&E.charCodeAt(T)!==60)T++;if(!R)R=E.substring(w,T);else R+=E.substring(w,T);continue}if(T+1>=_)break;let A=E.charCodeAt(T+1);if(A===33&&T+3<_&&E.charCodeAt(T+2)===45&&E.charCodeAt(T+3)===45){if(R||h)this.flushText(R,h,t,r),R="",h="";T+=4;let w=E.indexOf("-->",T);if(w===-1){T=_;break}if(this._commentPropName){let z=E.substring(T,w);this.addToObj(r,this._commentPropName,z,t,!0,!1)}T=w+3;continue}if(A===33&&T+8<_&&VF(E,T+2)){T+=9;let w=E.indexOf("]]>",T);if(w===-1){T=_;break}let z=E.substring(T,w);if(this._cdataPropName)this.flushText(R,h,t,r),R="",h="",this.addToObj(r,this._cdataPropName,z,t,!0,!1);else{if(R){let F=R;if(this._processEntities)F=this.entityDecoder.decodeEntities(F);h+=F,R=""}h+=z}T=w+3;continue}if(A===33&&T+9<_&&KF(E,T+2)){T+=9;let w=1;while(T<_&&w>0){let z=E.charCodeAt(T);if(z===60)w++;else if(z===62)w--;T++}continue}if(A===63){T+=2;let w=T;while(T<_&&!qr(E.charCodeAt(T))&&E.charCodeAt(T)!==63)T++;let z=E.substring(w,T),F=E.indexOf("?>",T);if(F===-1){T=_;break}let j=E.substring(T,F).trim();if(z==="xml"){if(!this._ignoreDeclaration&&this._piPropName){let Y=this.parsePiAttributes(j);this.addToObj(r,this._piPropName,{[z]:Y},t,!0,!1)}}else if(!this._ignorePiTags&&this._piPropName)this.addToObj(r,this._piPropName,{[z]:j},t,!0,!1);T=F+2;continue}if(A===47){if(R||h)this.flushText(R,h,t,r),R="",h="";T+=2;let w=T,z=this.readTagName(E,T,_),F=this.extractTagName(E,w,z);T=z;while(T<_&&qr(E.charCodeAt(T)))T++;if(T<_&&E.charCodeAt(T)===62)T++;if(d.length>0&&d[d.length-1]===F){d.pop();continue}return T}if(R||h)this.flushText(R,h,t,r),R="",h="";T++;let L=T,O=this.readTagName(E,T,_),c=this.extractTagName(E,L,O);if(!c){T=O+1;continue}T=O;let U=S?t?`${t}.${c}`:c:"",$={},I=!1;if(!this._ignoreAttributes){let w=this.parseAttributes(E,T,_,U,$);if(w<0)T=-w-1,I=!0;else T=w}else while(T<_){let w=E.charCodeAt(T);if(w===62||w===47)break;if(w===34||w===39){T++;while(T<_&&E.charCodeAt(T)!==w)T++}T++}if(this.options.updateTag){if(this.options.updateTag(c,U,$)===!1){while(T<_&&qr(E.charCodeAt(T)))T++;if(T<_&&E.charCodeAt(T)===47)T+=2;else if(T<_&&E.charCodeAt(T)===62){T++;let z=`</${c}>`,F=E.indexOf(z,T);if(F!==-1)T=F+z.length}continue}}while(T<_&&qr(E.charCodeAt(T)))T++;if(T<_&&E.charCodeAt(T)===47){if(T+=2,I||this._alwaysCreateTextNode){let w={};if(I)this.applyAttributes(w,$,U);if(this._alwaysCreateTextNode)w[this._textNodeName]="";this.addToObj(r,c,w,U,!0,!1)}else this.addToObj(r,c,"",U,!0,!1);continue}if(T<_&&E.charCodeAt(T)===62){if(T++,this.unpairedSet.has(c)){if(I){let j={};this.applyAttributes(j,$,U),this.addToObj(r,c,j,U,!0,!1)}else this.addToObj(r,c,"",U,!0,!1);d.push(c);continue}if(this.exactStopNodes.size>0||this.wildcardStopSuffixes.length>0){if(this.isStopNode(U)){let j=this.readStopNodeContent(E,T,_,c),Y={};if(I)this.applyAttributes(Y,$,U);if(j.content)Y[this._textNodeName]=j.content;this.addToObj(r,c,Y,U,!0,!1),T=j.pos;continue}}let w={};if(I)this.applyAttributes(w,$,U);T=this.parseChildren(E,T,_,w,U,d);let z=this._textNodeName,F=w[z];if(!I&&!this._alwaysCreateTextNode){let j=!0;for(let Y in w)if(Y!==z){j=!1;break}if(j){this.addToObj(r,c,F!==void 0?F:"",U,!0,!1);continue}}this.addToObj(r,c,w,U,!1,!1)}}if(R||h)this.flushText(R,h,t,r);return T}parseChildrenOrdered(E,T,_,r,t){let d="",R=this.needsJPath;while(T<_){if(E.charCodeAt(T)!==60){let I=T;T++;while(T<_&&E.charCodeAt(T)!==60)T++;if(!d)d=E.substring(I,T);else d+=E.substring(I,T);continue}if(T+1>=_)break;let S=E.charCodeAt(T+1);if(S===33&&T+3<_&&E.charCodeAt(T+2)===45&&E.charCodeAt(T+3)===45){if(d){let w=this.processTagValue(d,this._textNodeName,t,!1,!0);if(w!==void 0&&w!=="")r.push({[this._textNodeName]:w});d=""}T+=4;let I=E.indexOf("-->",T);if(I===-1){T=_;break}if(this._commentPropName)r.push({[this._commentPropName]:[{[this._textNodeName]:E.substring(T,I)}]});T=I+3;continue}if(S===33&&T+8<_&&VF(E,T+2)){T+=9;let I=E.indexOf("]]>",T);if(I===-1){T=_;break}let w=E.substring(T,I);if(this._cdataPropName){if(d){let z=this.processTagValue(d,this._textNodeName,t,!1,!0);if(z!==void 0&&z!=="")r.push({[this._textNodeName]:z});d=""}r.push({[this._cdataPropName]:[{[this._textNodeName]:w}]})}else d+=w;T=I+3;continue}if(S===33&&T+9<_&&KF(E,T+2)){T+=9;let I=1;while(T<_&&I>0){let w=E.charCodeAt(T);if(w===60)I++;else if(w===62)I--;T++}continue}if(S===63){T+=2;let I=E.indexOf("?>",T);if(I===-1){T=_;break}T=I+2;continue}if(S===47){if(d){let w=this.processTagValue(d,this._textNodeName,t,!1,!0);if(w!==void 0&&w!=="")r.push({[this._textNodeName]:w});d=""}T+=2,T=this.readTagName(E,T,_);while(T<_&&qr(E.charCodeAt(T)))T++;if(T<_&&E.charCodeAt(T)===62)T++;return T}if(d){let I=this.processTagValue(d,this._textNodeName,t,!1,!0);if(I!==void 0&&I!=="")r.push({[this._textNodeName]:I});d=""}T++;let N=T,A=this.readTagName(E,T,_),L=this.extractTagName(E,N,A);if(!L){T=A+1;continue}T=A;let O=R?t?`${t}.${L}`:L:"",c={},U=!1;if(!this._ignoreAttributes){let I=this.parseAttributes(E,T,_,O,c);if(I<0)T=-I-1,U=!0;else T=I}else while(T<_){let I=E.charCodeAt(T);if(I===62||I===47)break;if(I===34||I===39){T++;while(T<_&&E.charCodeAt(T)!==I)T++}T++}while(T<_&&qr(E.charCodeAt(T)))T++;let $={[L]:[]};if(U){$[":@"]={};for(let w in c)$[":@"][this._attrPrefix+w]=this.parseAttributeValue(c[w])}if(T<_&&E.charCodeAt(T)===47){T+=2,r.push($);continue}if(T<_&&E.charCodeAt(T)===62)T++,T=this.parseChildrenOrdered(E,T,_,$[L],O),r.push($)}if(d){let h=this.processTagValue(d,this._textNodeName,t,!1,!0);if(h!==void 0&&h!=="")r.push({[this._textNodeName]:h})}return T}applyAttributes(E,T,_){let r=this._attrPrefix;if(this._attrsGroupName){let t={};for(let d in T)t[r+d]=this.parseAttributeValue(T[d]);E[this._attrsGroupName]=t}else for(let t in T)E[r+t]=this.parseAttributeValue(T[t])}parsePiAttributes(E){let T={},_=0,r=E.length;while(_<r){while(_<r&&qr(E.charCodeAt(_)))_++;if(_>=r)break;let t=_;while(_<r&&!qr(E.charCodeAt(_))&&E.charCodeAt(_)!==61)_++;let d=E.substring(t,_);if(!d)break;while(_<r&&qr(E.charCodeAt(_)))_++;if(_<r&&E.charCodeAt(_)===61){_++;while(_<r&&qr(E.charCodeAt(_)))_++;if(_<r){let R=E.charCodeAt(_);if(R===34||R===39){_++;let h=_;while(_<r&&E.charCodeAt(_)!==R)_++;if(T[d]=E.substring(h,_),_<r)_++}}}}return T}}var S9,N9,ZA,A9,L9,O9,c9;var qF=wE(()=>{S9={amp:"&",lt:"<",gt:">",quot:'"',apos:"'"},N9={nbsp:" ",copy:"©",reg:"®",trade:"™",euro:"€",pound:"£",yen:"¥",cent:"¢",deg:"°",micro:"µ",middot:"·",bull:"•",hellip:"…",prime:"′",Prime:"″",laquo:"«",raquo:"»",lsquo:"‘",rsquo:"’",ldquo:"“",rdquo:"”",ndash:"–",mdash:"—",iexcl:"¡",iquest:"¿",sect:"§",para:"¶",dagger:"†",Dagger:"‡",lsaquo:"‹",rsaquo:"›",oline:"‾",frasl:"⁄",ensp:" ",emsp:" ",thinsp:" ",zwnj:"‌",zwj:"‍",lrm:"‎",rlm:"‏",times:"×",divide:"÷",plusmn:"±",ne:"≠",le:"≤",ge:"≥",infin:"∞",fnof:"ƒ",Alpha:"Α",Beta:"Β",Gamma:"Γ",Delta:"Δ",Epsilon:"Ε",Zeta:"Ζ",Eta:"Η",Theta:"Θ",Iota:"Ι",Kappa:"Κ",Lambda:"Λ",Mu:"Μ",Nu:"Ν",Xi:"Ξ",Omicron:"Ο",Pi:"Π",Rho:"Ρ",Sigma:"Σ",Tau:"Τ",Upsilon:"Υ",Phi:"Φ",Chi:"Χ",Psi:"Ψ",Omega:"Ω",alpha:"α",beta:"β",gamma:"γ",delta:"δ",epsilon:"ε",zeta:"ζ",eta:"η",theta:"θ",iota:"ι",kappa:"κ",lambda:"λ",mu:"μ",nu:"ν",xi:"ξ",omicron:"ο",pi:"π",rho:"ρ",sigmaf:"ς",sigma:"σ",tau:"τ",upsilon:"υ",phi:"φ",chi:"χ",psi:"ψ",omega:"ω",thetasym:"ϑ",upsih:"ϒ",piv:"ϖ",larr:"←",uarr:"↑",rarr:"→",darr:"↓",harr:"↔",crarr:"↵",lArr:"⇐",uArr:"⇑",rArr:"⇒",dArr:"⇓",hArr:"⇔",forall:"∀",part:"∂",exist:"∃",empty:"∅",nabla:"∇",isin:"∈",notin:"∉",ni:"∋",prod:"∏",sum:"∑",minus:"−",lowast:"∗",radic:"√",prop:"∝",ang:"∠",and:"∧",or:"∨",cap:"∩",cup:"∪",int:"∫",there4:"∴",sim:"∼",cong:"≅",asymp:"≈",equiv:"≡",sub:"⊂",sup:"⊃",nsub:"⊄",sube:"⊆",supe:"⊇",oplus:"⊕",otimes:"⊗",perp:"⊥",sdot:"⋅",lceil:"⌈",rceil:"⌉",lfloor:"⌊",rfloor:"⌋",lang:"〈",rang:"〉",loz:"◊",spades:"♠",clubs:"♣",hearts:"♥",diams:"♦",Agrave:"À",Aacute:"Á",Acirc:"Â",Atilde:"Ã",Auml:"Ä",Aring:"Å",AElig:"Æ",Ccedil:"Ç",Egrave:"È",Eacute:"É",Ecirc:"Ê",Euml:"Ë",Igrave:"Ì",Iacute:"Í",Icirc:"Î",Iuml:"Ï",ETH:"Ð",Ntilde:"Ñ",Ograve:"Ò",Oacute:"Ó",Ocirc:"Ô",Otilde:"Õ",Ouml:"Ö",Oslash:"Ø",Ugrave:"Ù",Uacute:"Ú",Ucirc:"Û",Uuml:"Ü",Yacute:"Ý",THORN:"Þ",szlig:"ß",agrave:"à",aacute:"á",acirc:"â",atilde:"ã",auml:"ä",aring:"å",aelig:"æ",ccedil:"ç",egrave:"è",eacute:"é",ecirc:"ê",euml:"ë",igrave:"ì",iacute:"í",icirc:"î",iuml:"ï",eth:"ð",ntilde:"ñ",ograve:"ò",oacute:"ó",ocirc:"ô",otilde:"õ",ouml:"ö",oslash:"ø",ugrave:"ù",uacute:"ú",ucirc:"û",uuml:"ü",yacute:"ý",thorn:"þ",yuml:"ÿ",OElig:"Œ",oelig:"œ",Scaron:"Š",scaron:"š",Yuml:"Ÿ",circ:"ˆ",tilde:"˜"};ZA=[];ZA[38]="&amp;";ZA[60]="&lt;";ZA[62]="&gt;";ZA[34]="&quot;";ZA[39]="&apos;";A9={attributeNamePrefix:"@_",attributesGroupName:!1,textNodeName:"#text",ignoreAttributes:!0,removeNSPrefix:!1,allowBooleanAttributes:!1,alwaysCreateTextNode:!1,trimValues:!0,parseTagValue:!0,parseAttributeValue:!1,processEntities:!0,htmlEntities:!1,commentPropName:!1,cdataPropName:!1,piPropName:!1,preserveOrder:!1,stopNodes:[],unpairedTags:[],isArray:void 0,tagValueProcessor:void 0,attributeValueProcessor:void 0,updateTag:void 0,numberParseOptions:{hex:!0,leadingZeros:!0,scientific:!0},ignorePiTags:!1,transformAttributeName:void 0,transformTagName:void 0,ignoreDeclaration:!1};L9=/^0x[\da-fA-F]+$/,O9=/^[+-]?\d+(\.\d+)?[eE][+-]?\d+$/,c9=/^[+-]?(\d+\.?\d*|\.\d+)$/});var UR={};MT(UR,{resolveS3Endpoint:()=>gA,detectCredentialSource:()=>R$,buildQueryParams:()=>IT,AWSClient:()=>zE});import*as eR from"node:crypto";import{existsSync as xF,readFileSync as U9}from"node:fs";import{homedir as bF}from"node:os";import{join as kF}from"node:path";function gA(E){let T=E.endpoint||`s3.${E.region}.amazonaws.com`,_=new URL(/^https?:\/\//i.test(T)?T:`https://${T}`);if(_.protocol!=="http:"&&_.protocol!=="https:"||_.pathname!=="/"&&_.pathname!==""||_.search||_.hash||_.username||_.password)throw Error("S3 endpoint must be an HTTP(S) origin without a path");let r=_.protocol.slice(0,-1),t=_.host;if(!E.bucket)return{protocol:r,host:t,path:E.path};if(E.forcePathStyle){let d=E.path==="/"?`/${E.bucket}`:`/${E.bucket}${E.path}`;return{protocol:r,host:t,path:d}}return{protocol:r,host:`${E.bucket}.${t}`,path:E.path}}class zE{credentials;config;cache;xmlParser;constructor(E,T){this.config={maxRetries:3,retryDelay:1000,cacheEnabled:!0,defaultCacheTTL:60000,...T},this.credentials=E||this.loadCredentials(),this.cache=new Map,this.xmlParser=new d$({ignoreAttributes:!1,attributeNamePrefix:"@_",textNodeName:"#text",parseAttributeValue:!0,trimValues:!0})}loadCredentials(){let E=process.env.AWS_ACCESS_KEY_ID,T=process.env.AWS_SECRET_ACCESS_KEY,_=process.env.AWS_SESSION_TOKEN;if(E&&T)return{accessKeyId:E,secretAccessKey:T,sessionToken:_};let r=this.loadCredentialsFromFile();if(r)return r;return{accessKeyId:"",secretAccessKey:""}}loadCredentialsFromFile(){let E=this.config?.profile||process.env.AWS_PROFILE||"default",T=process.env.AWS_SHARED_CREDENTIALS_FILE||kF(bF(),".aws","credentials");if(!xF(T))return null;try{let _=U9(T,"utf-8"),r=this.parseCredentialsFile(_,E);if(r.accessKeyId&&r.secretAccessKey)return r}catch{}return null}parseCredentialsFile(E,T){let _=E.split(`
 `),r="",t="",d="",R;for(let h of _){let S=h.trim();if(!S||S.startsWith("#"))continue;let N=S.match(/^\[([^\]]+)\]$/);if(N){r=N[1];continue}if(r===T){let[A,...L]=S.split("="),O=L.join("=").trim();if(A.trim()==="aws_access_key_id")t=O;else if(A.trim()==="aws_secret_access_key")d=O;else if(A.trim()==="aws_session_token")R=O}}return{accessKeyId:t,secretAccessKey:d,sessionToken:R}}ec2CredentialsCache;async getCredentials(){let E=process.env.AWS_ACCESS_KEY_ID,T=process.env.AWS_SECRET_ACCESS_KEY;if(E&&T)return{accessKeyId:E,secretAccessKey:T,sessionToken:process.env.AWS_SESSION_TOKEN};let _=this.loadCredentialsFromFile();if(_)return _;if(this.ec2CredentialsCache){let r=Date.now();if(this.ec2CredentialsCache.expiration>r+300000)return this.ec2CredentialsCache.credentials}try{let t=await(await fetch("http://169.254.169.254/latest/api/token",{method:"PUT",headers:{"X-aws-ec2-metadata-token-ttl-seconds":"21600"}})).text(),R=await(await fetch("http://169.254.169.254/latest/meta-data/iam/security-credentials/",{headers:{"X-aws-ec2-metadata-token":t}})).text(),S=await(await fetch(`http://169.254.169.254/latest/meta-data/iam/security-credentials/${R}`,{headers:{"X-aws-ec2-metadata-token":t}})).json(),N={accessKeyId:S.AccessKeyId,secretAccessKey:S.SecretAccessKey,sessionToken:S.Token};return this.ec2CredentialsCache={credentials:N,expiration:new Date(S.Expiration).getTime()},N}catch(r){throw Error("AWS credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, or run on an EC2 instance with an IAM role.")}}async request(E){if(E.method==="GET"&&this.config.cacheEnabled&&E.cacheKey){let r=this.getFromCache(E.cacheKey);if(r!==null)return r}let T=E.retries??this.config.maxRetries??3,_=null;for(let r=0;r<=T;r++)try{let t=await this.makeRequest(E);if(E.method==="GET"&&this.config.cacheEnabled&&E.cacheKey)this.setInCache(E.cacheKey,t,E.cacheTTL??this.config.defaultCacheTTL??60000);return t}catch(t){if(_=t,!this.shouldRetry(t))throw t;if(r===T)throw t;let R=this.calculateRetryDelay(r);await this.sleep(R)}throw _||Error("Request failed after retries")}async makeRequest(E){let T=E.credentials||(this.credentials?.accessKeyId?this.credentials:await this.getCredentials());if(!T||!T.accessKeyId||!T.secretAccessKey)throw Error("AWS credentials not provided");let _=this.buildUrl(E),r=this.signRequest(E,T),t=await fetch(_,{method:E.method,headers:r,body:E.body}),d=await t.text();if(!t.ok)throw this.parseError(d,t.status,t.headers);if(!d||d.trim()===""){if(E.returnHeaders)return{body:null,headers:this.headersToObject(t.headers)};return null}if(E.rawResponse){if(E.returnHeaders)return{body:d,headers:this.headersToObject(t.headers)};return d}let R;if(d.startsWith("<"))R=this.parseXmlResponse(d);else try{R=JSON.parse(d)}catch{R=d}if(E.returnHeaders)return{body:R,headers:this.headersToObject(t.headers)};return R}headersToObject(E){let T={};return E.forEach((_,r)=>{T[r]=_}),T}buildUrl(E){let{service:T,region:_,queryParams:r}=E,{path:t}=E,d,R="https";if(T==="s3"){let S=gA({region:_,path:t,bucket:E.bucket,endpoint:this.config.endpoint,forcePathStyle:this.config.forcePathStyle});R=S.protocol,d=S.host,t=S.path}else if(T==="cloudfront")d="cloudfront.amazonaws.com";else if(T==="iam")d="iam.amazonaws.com";else if(T==="route53")d="route53.amazonaws.com";else if(T==="route53domains")d="route53domains.us-east-1.amazonaws.com";else if(T==="ecr")d=`api.ecr.${_}.amazonaws.com`;else if(T==="ses")d=`email.${_}.amazonaws.com`;else d=`${T}.${_}.amazonaws.com`;let h=`${R}://${d}${t}`;if(r&&Object.keys(r).length>0){let S=Object.keys(r).map((N)=>`${this.uriEncode(N)}=${this.uriEncode(r[N])}`).join("&");h+=`?${S}`}return h}signRequest(E,T){let{service:_,region:r,method:t,queryParams:d,body:R}=E,{path:h}=E,S=new Date,N=this.getAmzDate(S),A=this.getDateStamp(S),L;if(_==="s3"){let n=gA({region:r,path:h,bucket:E.bucket,endpoint:this.config.endpoint,forcePathStyle:this.config.forcePathStyle});L=n.host,h=n.path}else if(_==="cloudfront")L="cloudfront.amazonaws.com";else if(_==="iam")L="iam.amazonaws.com";else if(_==="route53")L="route53.amazonaws.com";else if(_==="route53domains")L="route53domains.us-east-1.amazonaws.com";else if(_==="ecr")L=`api.ecr.${r}.amazonaws.com`;else if(_==="ses")L=`email.${r}.amazonaws.com`;else L=`${_}.${r}.amazonaws.com`;let O={host:L,"x-amz-date":N,...E.headers||{}};if(T.sessionToken)O["x-amz-security-token"]=T.sessionToken;if(R){if(!Object.keys(O).some((TE)=>TE.toLowerCase()==="content-type"))O["content-type"]="application/x-www-form-urlencoded";O["content-length"]=Buffer.byteLength(R).toString()}let c=this.sha256(R||"");O["x-amz-content-sha256"]=c;let U=h,$=d?Object.keys(d).sort().map((n)=>`${this.uriEncode(n)}=${this.uriEncode(d[n])}`).join("&"):"",I=Object.keys(O).sort((n,TE)=>n.toLowerCase().localeCompare(TE.toLowerCase())),w=I.map((n)=>`${n.toLowerCase()}:${O[n].trim()}
 `).join(""),z=I.map((n)=>n.toLowerCase()).join(";"),F=[t,U,$,w,z,c].join(`
 `),j="AWS4-HMAC-SHA256",Y=_;if(_==="email")Y="ses";let H=`${A}/${r}/${Y}/aws4_request`,Q=[j,N,H,this.sha256(F)].join(`
-`),K=this.getSignatureKey(T.secretAccessKey,A,r,Y),x=this.hmac(K,Q),k=`${j} Credential=${T.accessKeyId}/${H}, SignedHeaders=${z}, Signature=${x}`;return{...O,Authorization:k}}getAmzDate(E){return E.toISOString().replace(/[:-]|\.\d{3}/g,"")}getDateStamp(E){return E.toISOString().slice(0,10).replace(/-/g,"")}uriEncode(E){return encodeURIComponent(E).replace(/[!'()*]/g,(T)=>`%${T.charCodeAt(0).toString(16).toUpperCase()}`)}sha256(E){return eR.createHash("sha256").update(E,"utf8").digest("hex")}hmac(E,T){return eR.createHmac("sha256",E).update(T,"utf8").digest("hex")}getSignatureKey(E,T,_,r){let t=eR.createHmac("sha256",`AWS4${E}`).update(T).digest(),d=eR.createHmac("sha256",t).update(_).digest(),R=eR.createHmac("sha256",d).update(r).digest();return eR.createHmac("sha256",R).update("aws4_request").digest()}parseXmlResponse(E){try{let T=this.xmlParser.parse(E);if(T.ErrorResponse)throw this.createErrorFromXml(T.ErrorResponse.Error);let _=Object.keys(T);if(_.length===1)return T[_[0]];return T}catch(T){if(T.code||T.statusCode)throw T;return{}}}parseError(E,T,_){let r=Error();if(r.statusCode=T,r.requestId=_.get("x-amzn-requestid")||_.get("x-amz-request-id")||void 0,E.startsWith("<"))try{let t=this.xmlParser.parse(E);if(t.ErrorResponse?.Error){let d=t.ErrorResponse.Error;return r.code=d.Code,r.message=`AWS Error [${d.Code}]: ${d.Message||"Unknown error"}`,r.type=d.Type,r}if(t.Error)return r.code=t.Error.Code,r.message=`AWS Error [${t.Error.Code}]: ${t.Error.Message||"Unknown error"}`,r}catch{}try{let t=JSON.parse(E);if(t.__type||t.code)return r.code=t.__type||t.code,r.message=`AWS Error [${r.code}]: ${t.message||t.Message||"Unknown error"}`,r}catch{}return r.message=`AWS API Error (${T}): ${E}`,r}createErrorFromXml(E){let T=Error();return T.code=E.Code,T.message=`AWS Error [${E.Code}]: ${E.Message||"Unknown error"}`,T.type=E.Type,T}isRetryableError(E){return["RequestTimeout","RequestTimeoutException","PriorRequestNotComplete","ConnectionError","ThrottlingException","Throttling","TooManyRequestsException","ProvisionedThroughputExceededException","RequestLimitExceeded","BandwidthLimitExceeded","SlowDown","ServiceUnavailable","ServiceUnavailableException","InternalError","InternalFailure","InternalServerError","InternalServiceException","TransientError","TransientFailure","IDPCommunicationErrorException","NetworkError","ConnectionRefusedException","EC2ThrottledException","503 Slow Down","500 InternalError"].includes(E)}isRetryableStatusCode(E){return E>=500||E===429}shouldRetry(E){if(E.name==="FetchError"||E.name==="TypeError"||E.code==="ECONNRESET")return!0;if(E.code&&this.isRetryableError(E.code))return!0;if(E.statusCode&&this.isRetryableStatusCode(E.statusCode))return!0;if(E.statusCode&&E.statusCode>=400&&E.statusCode<500&&E.statusCode!==429)return!1;if(E.statusCode)return!1;return!0}calculateRetryDelay(E){let T=this.config.retryDelay??1000,_=30000,r=Math.min(T*2**E,30000),t=Math.random()*0.3*r;return r+t}sleep(E){return new Promise((T)=>setTimeout(T,E))}getFromCache(E){let T=this.cache.get(E);if(!T)return null;if(Date.now()>T.expires)return this.cache.delete(E),null;return T.data}setInCache(E,T,_){this.cache.set(E,{data:T,expires:Date.now()+_})}clearCache(){this.cache.clear()}clearExpiredCache(){let E=Date.now();for(let[T,_]of this.cache.entries())if(E>_.expires)this.cache.delete(T)}}function IT(E){let T={};for(let[_,r]of Object.entries(E)){if(r===void 0||r===null)continue;if(Array.isArray(r))r.forEach((t,d)=>{T[`${_}.${d+1}`]=String(t)});else if(typeof r==="object")for(let[t,d]of Object.entries(r))T[`${_}.${t}`]=String(d);else T[_]=String(r)}return T}function R$(){let E=process.env.AWS_ACCESS_KEY_ID,T=process.env.AWS_SECRET_ACCESS_KEY,_=E==="",r=T==="";if(E&&T)return{source:"env",emptyEnvKey:_,emptyEnvSecret:r,description:"environment variables (AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY)"};let t=process.env.AWS_PROFILE||"default",d=process.env.AWS_SHARED_CREDENTIALS_FILE||kF(bF(),".aws","credentials");if(xF(d))return{source:"file",profile:t,emptyEnvKey:_,emptyEnvSecret:r,description:`~/.aws/credentials (profile: ${t})`};return{source:"ec2",emptyEnvKey:_,emptyEnvSecret:r,description:"EC2 instance metadata service (IMDSv2)"}}var ME=wE(()=>{qF()});var HE={};MT(HE,{warning:()=>Dh,warn:()=>_E,table:()=>EE,success:()=>Z,step:()=>CE,select:()=>qO,prompt:()=>LT,info:()=>e,header:()=>b,getAwsRegions:()=>L$,getAwsAccountId:()=>A$,formatDuration:()=>D8,formatBytes:()=>GS,error:()=>f,confirm:()=>UE,colors:()=>sE,colorize:()=>DR,checkAwsCredentials:()=>N$,checkAwsCli:()=>S$,box:()=>xr,Spinner:()=>v,ProgressBar:()=>nF});function DR(E,T){return`${sE[T]}${E}${sE.reset}`}function Z(E){console.log(`${sE.green}✓${sE.reset} ${E}`)}function f(E){console.error(`${sE.red}✗${sE.reset} ${E}`)}function _E(E){console.warn(`${sE.yellow}⚠${sE.reset} ${E}`)}function e(E){console.log(`${sE.blue}ℹ${sE.reset} ${E}`)}function CE(E){console.log(`${sE.cyan}→${sE.reset} ${E}`)}function b(E){console.log(`
+`),K=this.getSignatureKey(T.secretAccessKey,A,r,Y),x=this.hmac(K,Q),k=`${j} Credential=${T.accessKeyId}/${H}, SignedHeaders=${z}, Signature=${x}`;return{...O,Authorization:k}}getAmzDate(E){return E.toISOString().replace(/[:-]|\.\d{3}/g,"")}getDateStamp(E){return E.toISOString().slice(0,10).replace(/-/g,"")}uriEncode(E){return encodeURIComponent(E).replace(/[!'()*]/g,(T)=>`%${T.charCodeAt(0).toString(16).toUpperCase()}`)}sha256(E){return eR.createHash("sha256").update(E,"utf8").digest("hex")}hmac(E,T){return eR.createHmac("sha256",E).update(T,"utf8").digest("hex")}getSignatureKey(E,T,_,r){let t=eR.createHmac("sha256",`AWS4${E}`).update(T).digest(),d=eR.createHmac("sha256",t).update(_).digest(),R=eR.createHmac("sha256",d).update(r).digest();return eR.createHmac("sha256",R).update("aws4_request").digest()}parseXmlResponse(E){try{let T=this.xmlParser.parse(E);if(T.ErrorResponse)throw this.createErrorFromXml(T.ErrorResponse.Error);let _=Object.keys(T);if(_.length===1)return T[_[0]];return T}catch(T){if(T.code||T.statusCode)throw T;return{}}}parseError(E,T,_){let r=Error();if(r.statusCode=T,r.requestId=_.get("x-amzn-requestid")||_.get("x-amz-request-id")||void 0,E.startsWith("<"))try{let t=this.xmlParser.parse(E);if(t.ErrorResponse?.Error){let d=t.ErrorResponse.Error;return r.code=d.Code,r.message=`AWS Error [${d.Code}]: ${d.Message||"Unknown error"}`,r.type=d.Type,r}if(t.Error)return r.code=t.Error.Code,r.message=`AWS Error [${t.Error.Code}]: ${t.Error.Message||"Unknown error"}`,r}catch{}try{let t=JSON.parse(E);if(t.__type||t.code)return r.code=t.__type||t.code,r.message=`AWS Error [${r.code}]: ${t.message||t.Message||"Unknown error"}`,r}catch{}return r.message=`AWS API Error (${T}): ${E}`,r}createErrorFromXml(E){let T=Error();return T.code=E.Code,T.message=`AWS Error [${E.Code}]: ${E.Message||"Unknown error"}`,T.type=E.Type,T}isRetryableError(E){return["RequestTimeout","RequestTimeoutException","PriorRequestNotComplete","ConnectionError","ThrottlingException","Throttling","TooManyRequestsException","ProvisionedThroughputExceededException","RequestLimitExceeded","BandwidthLimitExceeded","SlowDown","ServiceUnavailable","ServiceUnavailableException","InternalError","InternalFailure","InternalServerError","InternalServiceException","TransientError","TransientFailure","IDPCommunicationErrorException","NetworkError","ConnectionRefusedException","EC2ThrottledException","503 Slow Down","500 InternalError"].includes(E)}isRetryableStatusCode(E){return E>=500||E===429}shouldRetry(E){if(E.name==="FetchError"||E.name==="TypeError"||E.code==="ECONNRESET")return!0;if(E.code&&this.isRetryableError(E.code))return!0;if(E.statusCode&&this.isRetryableStatusCode(E.statusCode))return!0;if(E.statusCode&&E.statusCode>=400&&E.statusCode<500&&E.statusCode!==429)return!1;if(E.statusCode)return!1;return!0}calculateRetryDelay(E){let T=this.config.retryDelay??1000,_=30000,r=Math.min(T*2**E,30000),t=Math.random()*0.3*r;return r+t}sleep(E){return new Promise((T)=>setTimeout(T,E))}getFromCache(E){let T=this.cache.get(E);if(!T)return null;if(Date.now()>T.expires)return this.cache.delete(E),null;return T.data}setInCache(E,T,_){this.cache.set(E,{data:T,expires:Date.now()+_})}clearCache(){this.cache.clear()}clearExpiredCache(){let E=Date.now();for(let[T,_]of this.cache.entries())if(E>_.expires)this.cache.delete(T)}}function IT(E){let T={};for(let[_,r]of Object.entries(E)){if(r===void 0||r===null)continue;if(Array.isArray(r))r.forEach((t,d)=>{T[`${_}.${d+1}`]=String(t)});else if(typeof r==="object")for(let[t,d]of Object.entries(r))T[`${_}.${t}`]=String(d);else T[_]=String(r)}return T}function R$(){let E=process.env.AWS_ACCESS_KEY_ID,T=process.env.AWS_SECRET_ACCESS_KEY,_=E==="",r=T==="";if(E&&T)return{source:"env",emptyEnvKey:_,emptyEnvSecret:r,description:"environment variables (AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY)"};let t=process.env.AWS_PROFILE||"default",d=process.env.AWS_SHARED_CREDENTIALS_FILE||kF(bF(),".aws","credentials");if(xF(d))return{source:"file",profile:t,emptyEnvKey:_,emptyEnvSecret:r,description:`~/.aws/credentials (profile: ${t})`};return{source:"ec2",emptyEnvKey:_,emptyEnvSecret:r,description:"EC2 instance metadata service (IMDSv2)"}}var ME=wE(()=>{qF()});var HE={};MT(HE,{warning:()=>Dh,warn:()=>_E,table:()=>EE,success:()=>Z,step:()=>CE,select:()=>qO,prompt:()=>LT,info:()=>e,header:()=>b,getAwsRegions:()=>L$,getAwsAccountId:()=>A$,formatDuration:()=>D9,formatBytes:()=>GS,error:()=>f,confirm:()=>UE,colors:()=>sE,colorize:()=>DR,checkAwsCredentials:()=>N$,checkAwsCli:()=>S$,box:()=>xr,Spinner:()=>v,ProgressBar:()=>nF});function DR(E,T){return`${sE[T]}${E}${sE.reset}`}function Z(E){console.log(`${sE.green}✓${sE.reset} ${E}`)}function f(E){console.error(`${sE.red}✗${sE.reset} ${E}`)}function _E(E){console.warn(`${sE.yellow}⚠${sE.reset} ${E}`)}function e(E){console.log(`${sE.blue}ℹ${sE.reset} ${E}`)}function CE(E){console.log(`${sE.cyan}→${sE.reset} ${E}`)}function b(E){console.log(`
 ${sE.bright}${sE.cyan}${E}${sE.reset}
 `)}class v{frames=["⠋","⠙","⠹","⠸","⠼","⠴","⠦","⠧","⠇","⠏"];interval=null;currentFrame=0;message;constructor(E){this.message=E}get text(){return this.message}set text(E){if(this.message=E,h$&&this.interval)console.log(`  ${E}`)}start(){if(h$){console.log(`  ${this.message}`),this.interval=!0;return}this.interval=setInterval(()=>{process.stdout.write(`\r${sE.cyan}${this.frames[this.currentFrame]}${sE.reset} ${this.message}`),this.currentFrame=(this.currentFrame+1)%this.frames.length},80)}succeed(E){this.stop(),Z(E||this.message)}fail(E){this.stop(),f(E||this.message)}warn(E){this.stop(),Dh(E||this.message)}stop(){if(this.interval){if(!h$)process.stdout.write("\r");if(typeof this.interval==="object")clearInterval(this.interval);this.interval=null}}}class nF{total;current=0;width=40;constructor(E){this.total=E}update(E){this.current=E,this.render()}increment(){this.current++,this.render()}render(){let E=Math.floor(this.current/this.total*100),T=Math.floor(this.current/this.total*this.width),_=this.width-T,r=`${"█".repeat(T)}${"░".repeat(_)}`;if(process.stdout.write(`\r${sE.cyan}${r}${sE.reset} ${E}% (${this.current}/${this.total})`),this.current>=this.total)process.stdout.write(`
-`)}}async function LT(E,T){let r=(await import("node:readline")).createInterface({input:process.stdin,output:process.stdout});return new Promise((t)=>{let d=T?`${sE.cyan}?${sE.reset} ${E} ${sE.gray}(${T})${sE.reset}: `:`${sE.cyan}?${sE.reset} ${E}: `;r.question(d,(R)=>{r.close(),t(R||T||"")})})}async function UE(E,T=!1){let _=await LT(`${E} (y/n)`,T?"y":"n");return _.toLowerCase()==="y"||_.toLowerCase()==="yes"}async function qO(E,T){console.log(`${sE.cyan}?${sE.reset} ${E}`),T.forEach((t,d)=>{console.log(`  ${sE.gray}${d+1}.${sE.reset} ${t}`)});let _=await LT("Select","1"),r=Number.parseInt(_)-1;if(r>=0&&r<T.length)return T[r];return T[0]}function EE(E,T){let _=E.map((t,d)=>{let R=Math.max(...T.map((h)=>(h[d]||"").length));return Math.max(t.length,R)}),r=E.map((t,d)=>t.padEnd(_[d])).join("  ");console.log(DR(r,"bright")),console.log(DR("─".repeat(r.length),"gray")),T.forEach((t)=>{let d=t.map((R,h)=>(R||"").padEnd(_[h])).join("  ");console.log(d)})}function GS(E){if(E===0)return"0 B";let T=1024,_=["B","KB","MB","GB","TB"],r=Math.floor(Math.log(E)/Math.log(T));return`${Number.parseFloat((E/T**r).toFixed(2))} ${_[r]}`}function D8(E){if(E<1000)return`${E}ms`;let T=Math.floor(E/1000);if(T<60)return`${T}s`;let _=Math.floor(T/60),r=T%60;if(_<60)return`${_}m ${r}s`;let t=Math.floor(_/60),d=_%60;return`${t}h ${d}m`}function xr(E,T="cyan"){let _=E.split(`
-`),r=Math.max(..._.map((d)=>d.length)),t="─".repeat(r+2);console.log(DR(`┌${t}┐`,T)),_.forEach((d)=>{console.log(DR(`│ ${d.padEnd(r)} │`,T))}),console.log(DR(`└${t}┘`,T))}async function S$(){return!0}async function N$(){try{let{AWSClient:E}=await Promise.resolve().then(() => (ME(),UR));return await new E().request({service:"sts",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"GetCallerIdentity",Version:"2011-06-15"}).toString()}),!0}catch{return!1}}async function A$(){try{let{AWSClient:E}=await Promise.resolve().then(() => (ME(),UR)),_=await new E().request({service:"sts",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"GetCallerIdentity",Version:"2011-06-15"}).toString()});return _.Account||_.GetCallerIdentityResult?.Account||null}catch{return null}}async function L$(){try{let{AWSClient:E}=await Promise.resolve().then(() => (ME(),UR)),_=await new E().request({service:"ec2",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"DescribeRegions",Version:"2016-11-15"}).toString()}),r=[];if(_.regionInfo){let t=Array.isArray(_.regionInfo)?_.regionInfo:[_.regionInfo];r.push(...t.map((d)=>d.regionName))}return r.length>0?r:uF()}catch{return uF()}}function uF(){return["us-east-1","us-east-2","us-west-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1","ap-northeast-1"]}var sE,Dh,h$;var QE=wE(()=>{sE={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};Dh=_E;h$=!!(process.env.CI||process.env.GITHUB_ACTIONS||process.env.BUILDKITE||process.env.CIRCLECI||process.env.GITLAB_CI)});function P8(E,T){let _=[`Action=${E}`,"Version=2010-05-08"];for(let[r,t]of Object.entries(T)){if(t===void 0||t===null)continue;if(Array.isArray(t))t.forEach((d,R)=>{if(typeof d==="object"&&d!==null)for(let[h,S]of Object.entries(d))_.push(`${r}.member.${R+1}.${h}=${encodeURIComponent(String(S))}`);else _.push(`${r}.member.${R+1}=${encodeURIComponent(String(d))}`)});else if(typeof t==="object"){for(let[d,R]of Object.entries(t))if(R!==void 0&&R!==null)_.push(`${r}.${d}=${encodeURIComponent(String(R))}`)}else _.push(`${r}=${encodeURIComponent(String(t))}`)}return _.join("&")}function a(E,T){let _=new RegExp(`<${T}>([^<]*)</${T}>`),r=E.match(_);return r?r[1]:void 0}function P_(E,T,_){let r=new RegExp(`<${T}>([\\s\\S]*?)</${T}>`),t=E.match(r);if(!t)return[];let d=[],R=new RegExp(`<${_}>([\\s\\S]*?)</${_}>`,"g"),h;while((h=R.exec(t[1]))!==null)d.push(h[1]);return d}class U_{client;region;constructor(E="us-east-1",T){this.client=new zE(void 0,{profile:T}),this.region=E}async request(E,T={}){let _=P8(E,T);return await this.client.request({service:"iam",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:_})}async createUser(E){let T=await this.request("CreateUser",E);return this.parseUser(T)}async getUser(E={}){let T=await this.request("GetUser",E);return this.parseUser(T)}async listUsers(E={}){let T=await this.request("ListUsers",E),_=this.parseUsers(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Users:_,IsTruncated:r,Marker:t}}async updateUser(E){await this.request("UpdateUser",E)}async deleteUser(E){await this.request("DeleteUser",E)}parseUser(E){return{UserName:a(E,"UserName")||"",UserId:a(E,"UserId")||"",Arn:a(E,"Arn")||"",Path:a(E,"Path"),CreateDate:a(E,"CreateDate"),PasswordLastUsed:a(E,"PasswordLastUsed")}}parseUsers(E){return P_(E,"Users","member").map((_)=>({UserName:a(_,"UserName")||"",UserId:a(_,"UserId")||"",Arn:a(_,"Arn")||"",Path:a(_,"Path"),CreateDate:a(_,"CreateDate"),PasswordLastUsed:a(_,"PasswordLastUsed")}))}async createGroup(E){let T=await this.request("CreateGroup",E);return this.parseGroup(T)}async getGroup(E){let T=await this.request("GetGroup",E),_=this.parseGroup(T),r=this.parseUsers(T),t=a(T,"IsTruncated")==="true",d=a(T,"Marker");return{Group:_,Users:r,IsTruncated:t,Marker:d}}async listGroups(E={}){let T=await this.request("ListGroups",E),_=this.parseGroups(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Groups:_,IsTruncated:r,Marker:t}}async updateGroup(E){await this.request("UpdateGroup",E)}async deleteGroup(E){await this.request("DeleteGroup",E)}async addUserToGroup(E){await this.request("AddUserToGroup",E)}async removeUserFromGroup(E){await this.request("RemoveUserFromGroup",E)}async listGroupsForUser(E){let T=await this.request("ListGroupsForUser",E),_=this.parseGroups(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Groups:_,IsTruncated:r,Marker:t}}parseGroup(E){return{GroupName:a(E,"GroupName")||"",GroupId:a(E,"GroupId")||"",Arn:a(E,"Arn")||"",Path:a(E,"Path"),CreateDate:a(E,"CreateDate")}}parseGroups(E){return P_(E,"Groups","member").map((_)=>({GroupName:a(_,"GroupName")||"",GroupId:a(_,"GroupId")||"",Arn:a(_,"Arn")||"",Path:a(_,"Path"),CreateDate:a(_,"CreateDate")}))}async createRole(E){let T=await this.request("CreateRole",E);return this.parseRole(T)}async getRole(E){let T=await this.request("GetRole",E);return this.parseRole(T)}async listRoles(E={}){let T=await this.request("ListRoles",E),_=this.parseRoles(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Roles:_,IsTruncated:r,Marker:t}}async updateRole(E){await this.request("UpdateRole",E)}async updateRoleDescription(E){let T=await this.request("UpdateRoleDescription",E);return this.parseRole(T)}async updateAssumeRolePolicy(E){await this.request("UpdateAssumeRolePolicy",E)}async deleteRole(E){await this.request("DeleteRole",E)}async tagRole(E){await this.request("TagRole",E)}async untagRole(E){await this.request("UntagRole",E)}async listRoleTags(E){let T=await this.request("ListRoleTags",E),_=this.parseTags(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Tags:_,IsTruncated:r,Marker:t}}parseRole(E){return{RoleName:a(E,"RoleName")||"",RoleId:a(E,"RoleId")||"",Arn:a(E,"Arn")||"",Path:a(E,"Path"),CreateDate:a(E,"CreateDate"),AssumeRolePolicyDocument:a(E,"AssumeRolePolicyDocument"),Description:a(E,"Description"),MaxSessionDuration:a(E,"MaxSessionDuration")?Number.parseInt(a(E,"MaxSessionDuration"),10):void 0}}parseRoles(E){return P_(E,"Roles","member").map((_)=>({RoleName:a(_,"RoleName")||"",RoleId:a(_,"RoleId")||"",Arn:a(_,"Arn")||"",Path:a(_,"Path"),CreateDate:a(_,"CreateDate"),AssumeRolePolicyDocument:a(_,"AssumeRolePolicyDocument"),Description:a(_,"Description"),MaxSessionDuration:a(_,"MaxSessionDuration")?Number.parseInt(a(_,"MaxSessionDuration"),10):void 0}))}parseTags(E){return P_(E,"Tags","member").map((_)=>({Key:a(_,"Key")||"",Value:a(_,"Value")||""}))}async createPolicy(E){let T=await this.request("CreatePolicy",E);return this.parsePolicy(T)}async getPolicy(E){let T=await this.request("GetPolicy",E);return this.parsePolicy(T)}async getPolicyVersion(E){let T=await this.request("GetPolicyVersion",E);return{VersionId:a(T,"VersionId")||"",IsDefaultVersion:a(T,"IsDefaultVersion")==="true",CreateDate:a(T,"CreateDate"),Document:a(T,"Document")}}async listPolicies(E={}){let T=await this.request("ListPolicies",E),_=this.parsePolicies(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Policies:_,IsTruncated:r,Marker:t}}async listPolicyVersions(E){let T=await this.request("ListPolicyVersions",E),_=this.parsePolicyVersions(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Versions:_,IsTruncated:r,Marker:t}}async createPolicyVersion(E){let T=await this.request("CreatePolicyVersion",E);return{VersionId:a(T,"VersionId")||"",IsDefaultVersion:a(T,"IsDefaultVersion")==="true",CreateDate:a(T,"CreateDate")}}async deletePolicyVersion(E){await this.request("DeletePolicyVersion",E)}async setDefaultPolicyVersion(E){await this.request("SetDefaultPolicyVersion",E)}async deletePolicy(E){await this.request("DeletePolicy",E)}async attachUserPolicy(E){await this.request("AttachUserPolicy",E)}async detachUserPolicy(E){await this.request("DetachUserPolicy",E)}async attachGroupPolicy(E){await this.request("AttachGroupPolicy",E)}async detachGroupPolicy(E){await this.request("DetachGroupPolicy",E)}async attachRolePolicy(E){await this.request("AttachRolePolicy",E)}async detachRolePolicy(E){await this.request("DetachRolePolicy",E)}async listAttachedUserPolicies(E){let T=await this.request("ListAttachedUserPolicies",E),_=this.parseAttachedPolicies(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{AttachedPolicies:_,IsTruncated:r,Marker:t}}async listAttachedGroupPolicies(E){let T=await this.request("ListAttachedGroupPolicies",E),_=this.parseAttachedPolicies(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{AttachedPolicies:_,IsTruncated:r,Marker:t}}async listAttachedRolePolicies(E){let T=await this.request("ListAttachedRolePolicies",E),_=this.parseAttachedPolicies(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{AttachedPolicies:_,IsTruncated:r,Marker:t}}parsePolicy(E){return{PolicyName:a(E,"PolicyName")||"",PolicyId:a(E,"PolicyId")||"",Arn:a(E,"Arn")||"",Path:a(E,"Path"),DefaultVersionId:a(E,"DefaultVersionId"),AttachmentCount:a(E,"AttachmentCount")?Number.parseInt(a(E,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:a(E,"PermissionsBoundaryUsageCount")?Number.parseInt(a(E,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:a(E,"IsAttachable")==="true",Description:a(E,"Description"),CreateDate:a(E,"CreateDate"),UpdateDate:a(E,"UpdateDate")}}parsePolicies(E){return P_(E,"Policies","member").map((_)=>({PolicyName:a(_,"PolicyName")||"",PolicyId:a(_,"PolicyId")||"",Arn:a(_,"Arn")||"",Path:a(_,"Path"),DefaultVersionId:a(_,"DefaultVersionId"),AttachmentCount:a(_,"AttachmentCount")?Number.parseInt(a(_,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:a(_,"PermissionsBoundaryUsageCount")?Number.parseInt(a(_,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:a(_,"IsAttachable")==="true",Description:a(_,"Description"),CreateDate:a(_,"CreateDate"),UpdateDate:a(_,"UpdateDate")}))}parsePolicyVersions(E){return P_(E,"Versions","member").map((_)=>({VersionId:a(_,"VersionId")||"",IsDefaultVersion:a(_,"IsDefaultVersion")==="true",CreateDate:a(_,"CreateDate")}))}parseAttachedPolicies(E){return P_(E,"AttachedPolicies","member").map((_)=>({PolicyName:a(_,"PolicyName")||"",PolicyArn:a(_,"PolicyArn")||""}))}async putUserPolicy(E){await this.request("PutUserPolicy",E)}async getUserPolicy(E){let T=await this.request("GetUserPolicy",E);return{UserName:a(T,"UserName")||"",PolicyName:a(T,"PolicyName")||"",PolicyDocument:decodeURIComponent(a(T,"PolicyDocument")||"")}}async deleteUserPolicy(E){await this.request("DeleteUserPolicy",E)}async listUserPolicies(E){let T=await this.request("ListUserPolicies",E),_=P_(T,"PolicyNames","member"),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{PolicyNames:_,IsTruncated:r,Marker:t}}async putGroupPolicy(E){await this.request("PutGroupPolicy",E)}async getGroupPolicy(E){let T=await this.request("GetGroupPolicy",E);return{GroupName:a(T,"GroupName")||"",PolicyName:a(T,"PolicyName")||"",PolicyDocument:decodeURIComponent(a(T,"PolicyDocument")||"")}}async deleteGroupPolicy(E){await this.request("DeleteGroupPolicy",E)}async listGroupPolicies(E){let T=await this.request("ListGroupPolicies",E),_=P_(T,"PolicyNames","member"),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{PolicyNames:_,IsTruncated:r,Marker:t}}async putRolePolicy(E){await this.request("PutRolePolicy",E)}async getRolePolicy(E){let T=await this.request("GetRolePolicy",E);return{RoleName:a(T,"RoleName")||"",PolicyName:a(T,"PolicyName")||"",PolicyDocument:decodeURIComponent(a(T,"PolicyDocument")||"")}}async deleteRolePolicy(E){await this.request("DeleteRolePolicy",E)}async listRolePolicies(E){let T=await this.request("ListRolePolicies",E),_=P_(T,"PolicyNames","member"),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{PolicyNames:_,IsTruncated:r,Marker:t}}async createAccessKey(E={}){let T=await this.request("CreateAccessKey",E);if(typeof T==="object"){let _=T?.CreateAccessKeyResult?.AccessKey||T?.AccessKey;if(_)return{AccessKey:{UserName:_.UserName||"",AccessKeyId:_.AccessKeyId||"",Status:_.Status||"Active",SecretAccessKey:_.SecretAccessKey||"",CreateDate:_.CreateDate}}}return{AccessKey:{UserName:a(T,"UserName")||"",AccessKeyId:a(T,"AccessKeyId")||"",Status:a(T,"Status")||"Active",SecretAccessKey:a(T,"SecretAccessKey")||"",CreateDate:a(T,"CreateDate")}}}async listAccessKeys(E={}){let T=await this.request("ListAccessKeys",E),_=this.parseAccessKeys(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{AccessKeyMetadata:_,IsTruncated:r,Marker:t}}async updateAccessKey(E){await this.request("UpdateAccessKey",E)}async deleteAccessKey(E){await this.request("DeleteAccessKey",E)}async getAccessKeyLastUsed(E){let T=await this.request("GetAccessKeyLastUsed",E);return{UserName:a(T,"UserName")||"",AccessKeyLastUsed:{LastUsedDate:a(T,"LastUsedDate"),ServiceName:a(T,"ServiceName"),Region:a(T,"Region")}}}parseAccessKeys(E){return P_(E,"AccessKeyMetadata","member").map((_)=>({UserName:a(_,"UserName"),AccessKeyId:a(_,"AccessKeyId")||"",Status:a(_,"Status")||"Active",CreateDate:a(_,"CreateDate")}))}async createInstanceProfile(E){let T=await this.request("CreateInstanceProfile",E);return this.parseInstanceProfile(T)}async getInstanceProfile(E){let T=await this.request("GetInstanceProfile",E);return this.parseInstanceProfile(T)}async listInstanceProfiles(E={}){let T=await this.request("ListInstanceProfiles",E),_=this.parseInstanceProfiles(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{InstanceProfiles:_,IsTruncated:r,Marker:t}}async listInstanceProfilesForRole(E){let T=await this.request("ListInstanceProfilesForRole",E),_=this.parseInstanceProfiles(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{InstanceProfiles:_,IsTruncated:r,Marker:t}}async addRoleToInstanceProfile(E){await this.request("AddRoleToInstanceProfile",E)}async removeRoleFromInstanceProfile(E){await this.request("RemoveRoleFromInstanceProfile",E)}async deleteInstanceProfile(E){await this.request("DeleteInstanceProfile",E)}parseInstanceProfile(E){return{InstanceProfileName:a(E,"InstanceProfileName")||"",InstanceProfileId:a(E,"InstanceProfileId")||"",Arn:a(E,"Arn")||"",Path:a(E,"Path"),CreateDate:a(E,"CreateDate")}}parseInstanceProfiles(E){return P_(E,"InstanceProfiles","member").map((_)=>({InstanceProfileName:a(_,"InstanceProfileName")||"",InstanceProfileId:a(_,"InstanceProfileId")||"",Arn:a(_,"Arn")||"",Path:a(_,"Path"),CreateDate:a(_,"CreateDate")}))}async getAccountPasswordPolicy(){let E=await this.request("GetAccountPasswordPolicy");return{MinimumPasswordLength:a(E,"MinimumPasswordLength")?Number.parseInt(a(E,"MinimumPasswordLength"),10):void 0,RequireSymbols:a(E,"RequireSymbols")==="true",RequireNumbers:a(E,"RequireNumbers")==="true",RequireUppercaseCharacters:a(E,"RequireUppercaseCharacters")==="true",RequireLowercaseCharacters:a(E,"RequireLowercaseCharacters")==="true",AllowUsersToChangePassword:a(E,"AllowUsersToChangePassword")==="true",ExpirePasswords:a(E,"ExpirePasswords")==="true",MaxPasswordAge:a(E,"MaxPasswordAge")?Number.parseInt(a(E,"MaxPasswordAge"),10):void 0,PasswordReusePrevention:a(E,"PasswordReusePrevention")?Number.parseInt(a(E,"PasswordReusePrevention"),10):void 0,HardExpiry:a(E,"HardExpiry")==="true"}}async updateAccountPasswordPolicy(E){await this.request("UpdateAccountPasswordPolicy",E)}async deleteAccountPasswordPolicy(){await this.request("DeleteAccountPasswordPolicy")}async getAccountSummary(){let E=await this.request("GetAccountSummary"),T={},_=P_(E,"SummaryMap","entry");for(let r of _){let t=a(r,"key"),d=a(r,"value");if(t&&d)T[t]=Number.parseInt(d,10)}return T}async listAccountAliases(){let E=await this.request("ListAccountAliases"),T=P_(E,"AccountAliases","member"),_=a(E,"IsTruncated")==="true",r=a(E,"Marker");return{AccountAliases:T,IsTruncated:_,Marker:r}}async createAccountAlias(E){await this.request("CreateAccountAlias",E)}async deleteAccountAlias(E){await this.request("DeleteAccountAlias",E)}async simulatePrincipalPolicy(E){let T=await this.request("SimulatePrincipalPolicy",E);return this.parseSimulationResults(T)}parseSimulationResults(E){let _=P_(E,"EvaluationResults","member").map((d)=>{let h=P_(d,"MatchedStatements","member").map((S)=>({SourcePolicyId:a(S,"SourcePolicyId"),SourcePolicyType:a(S,"SourcePolicyType")}));return{EvalActionName:a(d,"EvalActionName")||"",EvalResourceName:a(d,"EvalResourceName"),EvalDecision:a(d,"EvalDecision")||"",MatchedStatements:h.length>0?h:void 0}}),r=a(E,"IsTruncated")==="true",t=a(E,"Marker");return{EvaluationResults:_,IsTruncated:r,Marker:t}}}var QS=wE(()=>{ME()});var D_;var $h=wE(()=>{ME();D_=class D_{client;region;constructor(E="us-east-1"){this.region=E,this.client=new zE}async createHostedZone(E){let T=E.CallerReference||`${Date.now()}-${Math.random().toString(36).slice(2)}`,_=`<?xml version="1.0" encoding="UTF-8"?>
+`)}}async function LT(E,T){let r=(await import("node:readline")).createInterface({input:process.stdin,output:process.stdout});return new Promise((t)=>{let d=T?`${sE.cyan}?${sE.reset} ${E} ${sE.gray}(${T})${sE.reset}: `:`${sE.cyan}?${sE.reset} ${E}: `;r.question(d,(R)=>{r.close(),t(R||T||"")})})}async function UE(E,T=!1){let _=await LT(`${E} (y/n)`,T?"y":"n");return _.toLowerCase()==="y"||_.toLowerCase()==="yes"}async function qO(E,T){console.log(`${sE.cyan}?${sE.reset} ${E}`),T.forEach((t,d)=>{console.log(`  ${sE.gray}${d+1}.${sE.reset} ${t}`)});let _=await LT("Select","1"),r=Number.parseInt(_)-1;if(r>=0&&r<T.length)return T[r];return T[0]}function EE(E,T){let _=E.map((t,d)=>{let R=Math.max(...T.map((h)=>(h[d]||"").length));return Math.max(t.length,R)}),r=E.map((t,d)=>t.padEnd(_[d])).join("  ");console.log(DR(r,"bright")),console.log(DR("─".repeat(r.length),"gray")),T.forEach((t)=>{let d=t.map((R,h)=>(R||"").padEnd(_[h])).join("  ");console.log(d)})}function GS(E){if(E===0)return"0 B";let T=1024,_=["B","KB","MB","GB","TB"],r=Math.floor(Math.log(E)/Math.log(T));return`${Number.parseFloat((E/T**r).toFixed(2))} ${_[r]}`}function D9(E){if(E<1000)return`${E}ms`;let T=Math.floor(E/1000);if(T<60)return`${T}s`;let _=Math.floor(T/60),r=T%60;if(_<60)return`${_}m ${r}s`;let t=Math.floor(_/60),d=_%60;return`${t}h ${d}m`}function xr(E,T="cyan"){let _=E.split(`
+`),r=Math.max(..._.map((d)=>d.length)),t="─".repeat(r+2);console.log(DR(`┌${t}┐`,T)),_.forEach((d)=>{console.log(DR(`│ ${d.padEnd(r)} │`,T))}),console.log(DR(`└${t}┘`,T))}async function S$(){return!0}async function N$(){try{let{AWSClient:E}=await Promise.resolve().then(() => (ME(),UR));return await new E().request({service:"sts",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"GetCallerIdentity",Version:"2011-06-15"}).toString()}),!0}catch{return!1}}async function A$(){try{let{AWSClient:E}=await Promise.resolve().then(() => (ME(),UR)),_=await new E().request({service:"sts",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"GetCallerIdentity",Version:"2011-06-15"}).toString()});return _.Account||_.GetCallerIdentityResult?.Account||null}catch{return null}}async function L$(){try{let{AWSClient:E}=await Promise.resolve().then(() => (ME(),UR)),_=await new E().request({service:"ec2",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"DescribeRegions",Version:"2016-11-15"}).toString()}),r=[];if(_.regionInfo){let t=Array.isArray(_.regionInfo)?_.regionInfo:[_.regionInfo];r.push(...t.map((d)=>d.regionName))}return r.length>0?r:uF()}catch{return uF()}}function uF(){return["us-east-1","us-east-2","us-west-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1","ap-northeast-1"]}var sE,Dh,h$;var QE=wE(()=>{sE={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};Dh=_E;h$=!!(process.env.CI||process.env.GITHUB_ACTIONS||process.env.BUILDKITE||process.env.CIRCLECI||process.env.GITLAB_CI)});function P9(E,T){let _=[`Action=${E}`,"Version=2010-05-08"];for(let[r,t]of Object.entries(T)){if(t===void 0||t===null)continue;if(Array.isArray(t))t.forEach((d,R)=>{if(typeof d==="object"&&d!==null)for(let[h,S]of Object.entries(d))_.push(`${r}.member.${R+1}.${h}=${encodeURIComponent(String(S))}`);else _.push(`${r}.member.${R+1}=${encodeURIComponent(String(d))}`)});else if(typeof t==="object"){for(let[d,R]of Object.entries(t))if(R!==void 0&&R!==null)_.push(`${r}.${d}=${encodeURIComponent(String(R))}`)}else _.push(`${r}=${encodeURIComponent(String(t))}`)}return _.join("&")}function a(E,T){let _=new RegExp(`<${T}>([^<]*)</${T}>`),r=E.match(_);return r?r[1]:void 0}function P_(E,T,_){let r=new RegExp(`<${T}>([\\s\\S]*?)</${T}>`),t=E.match(r);if(!t)return[];let d=[],R=new RegExp(`<${_}>([\\s\\S]*?)</${_}>`,"g"),h;while((h=R.exec(t[1]))!==null)d.push(h[1]);return d}class U_{client;region;constructor(E="us-east-1",T){this.client=new zE(void 0,{profile:T}),this.region=E}async request(E,T={}){let _=P9(E,T);return await this.client.request({service:"iam",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:_})}async createUser(E){let T=await this.request("CreateUser",E);return this.parseUser(T)}async getUser(E={}){let T=await this.request("GetUser",E);return this.parseUser(T)}async listUsers(E={}){let T=await this.request("ListUsers",E),_=this.parseUsers(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Users:_,IsTruncated:r,Marker:t}}async updateUser(E){await this.request("UpdateUser",E)}async deleteUser(E){await this.request("DeleteUser",E)}parseUser(E){return{UserName:a(E,"UserName")||"",UserId:a(E,"UserId")||"",Arn:a(E,"Arn")||"",Path:a(E,"Path"),CreateDate:a(E,"CreateDate"),PasswordLastUsed:a(E,"PasswordLastUsed")}}parseUsers(E){return P_(E,"Users","member").map((_)=>({UserName:a(_,"UserName")||"",UserId:a(_,"UserId")||"",Arn:a(_,"Arn")||"",Path:a(_,"Path"),CreateDate:a(_,"CreateDate"),PasswordLastUsed:a(_,"PasswordLastUsed")}))}async createGroup(E){let T=await this.request("CreateGroup",E);return this.parseGroup(T)}async getGroup(E){let T=await this.request("GetGroup",E),_=this.parseGroup(T),r=this.parseUsers(T),t=a(T,"IsTruncated")==="true",d=a(T,"Marker");return{Group:_,Users:r,IsTruncated:t,Marker:d}}async listGroups(E={}){let T=await this.request("ListGroups",E),_=this.parseGroups(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Groups:_,IsTruncated:r,Marker:t}}async updateGroup(E){await this.request("UpdateGroup",E)}async deleteGroup(E){await this.request("DeleteGroup",E)}async addUserToGroup(E){await this.request("AddUserToGroup",E)}async removeUserFromGroup(E){await this.request("RemoveUserFromGroup",E)}async listGroupsForUser(E){let T=await this.request("ListGroupsForUser",E),_=this.parseGroups(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Groups:_,IsTruncated:r,Marker:t}}parseGroup(E){return{GroupName:a(E,"GroupName")||"",GroupId:a(E,"GroupId")||"",Arn:a(E,"Arn")||"",Path:a(E,"Path"),CreateDate:a(E,"CreateDate")}}parseGroups(E){return P_(E,"Groups","member").map((_)=>({GroupName:a(_,"GroupName")||"",GroupId:a(_,"GroupId")||"",Arn:a(_,"Arn")||"",Path:a(_,"Path"),CreateDate:a(_,"CreateDate")}))}async createRole(E){let T=await this.request("CreateRole",E);return this.parseRole(T)}async getRole(E){let T=await this.request("GetRole",E);return this.parseRole(T)}async listRoles(E={}){let T=await this.request("ListRoles",E),_=this.parseRoles(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Roles:_,IsTruncated:r,Marker:t}}async updateRole(E){await this.request("UpdateRole",E)}async updateRoleDescription(E){let T=await this.request("UpdateRoleDescription",E);return this.parseRole(T)}async updateAssumeRolePolicy(E){await this.request("UpdateAssumeRolePolicy",E)}async deleteRole(E){await this.request("DeleteRole",E)}async tagRole(E){await this.request("TagRole",E)}async untagRole(E){await this.request("UntagRole",E)}async listRoleTags(E){let T=await this.request("ListRoleTags",E),_=this.parseTags(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Tags:_,IsTruncated:r,Marker:t}}parseRole(E){return{RoleName:a(E,"RoleName")||"",RoleId:a(E,"RoleId")||"",Arn:a(E,"Arn")||"",Path:a(E,"Path"),CreateDate:a(E,"CreateDate"),AssumeRolePolicyDocument:a(E,"AssumeRolePolicyDocument"),Description:a(E,"Description"),MaxSessionDuration:a(E,"MaxSessionDuration")?Number.parseInt(a(E,"MaxSessionDuration"),10):void 0}}parseRoles(E){return P_(E,"Roles","member").map((_)=>({RoleName:a(_,"RoleName")||"",RoleId:a(_,"RoleId")||"",Arn:a(_,"Arn")||"",Path:a(_,"Path"),CreateDate:a(_,"CreateDate"),AssumeRolePolicyDocument:a(_,"AssumeRolePolicyDocument"),Description:a(_,"Description"),MaxSessionDuration:a(_,"MaxSessionDuration")?Number.parseInt(a(_,"MaxSessionDuration"),10):void 0}))}parseTags(E){return P_(E,"Tags","member").map((_)=>({Key:a(_,"Key")||"",Value:a(_,"Value")||""}))}async createPolicy(E){let T=await this.request("CreatePolicy",E);return this.parsePolicy(T)}async getPolicy(E){let T=await this.request("GetPolicy",E);return this.parsePolicy(T)}async getPolicyVersion(E){let T=await this.request("GetPolicyVersion",E);return{VersionId:a(T,"VersionId")||"",IsDefaultVersion:a(T,"IsDefaultVersion")==="true",CreateDate:a(T,"CreateDate"),Document:a(T,"Document")}}async listPolicies(E={}){let T=await this.request("ListPolicies",E),_=this.parsePolicies(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Policies:_,IsTruncated:r,Marker:t}}async listPolicyVersions(E){let T=await this.request("ListPolicyVersions",E),_=this.parsePolicyVersions(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{Versions:_,IsTruncated:r,Marker:t}}async createPolicyVersion(E){let T=await this.request("CreatePolicyVersion",E);return{VersionId:a(T,"VersionId")||"",IsDefaultVersion:a(T,"IsDefaultVersion")==="true",CreateDate:a(T,"CreateDate")}}async deletePolicyVersion(E){await this.request("DeletePolicyVersion",E)}async setDefaultPolicyVersion(E){await this.request("SetDefaultPolicyVersion",E)}async deletePolicy(E){await this.request("DeletePolicy",E)}async attachUserPolicy(E){await this.request("AttachUserPolicy",E)}async detachUserPolicy(E){await this.request("DetachUserPolicy",E)}async attachGroupPolicy(E){await this.request("AttachGroupPolicy",E)}async detachGroupPolicy(E){await this.request("DetachGroupPolicy",E)}async attachRolePolicy(E){await this.request("AttachRolePolicy",E)}async detachRolePolicy(E){await this.request("DetachRolePolicy",E)}async listAttachedUserPolicies(E){let T=await this.request("ListAttachedUserPolicies",E),_=this.parseAttachedPolicies(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{AttachedPolicies:_,IsTruncated:r,Marker:t}}async listAttachedGroupPolicies(E){let T=await this.request("ListAttachedGroupPolicies",E),_=this.parseAttachedPolicies(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{AttachedPolicies:_,IsTruncated:r,Marker:t}}async listAttachedRolePolicies(E){let T=await this.request("ListAttachedRolePolicies",E),_=this.parseAttachedPolicies(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{AttachedPolicies:_,IsTruncated:r,Marker:t}}parsePolicy(E){return{PolicyName:a(E,"PolicyName")||"",PolicyId:a(E,"PolicyId")||"",Arn:a(E,"Arn")||"",Path:a(E,"Path"),DefaultVersionId:a(E,"DefaultVersionId"),AttachmentCount:a(E,"AttachmentCount")?Number.parseInt(a(E,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:a(E,"PermissionsBoundaryUsageCount")?Number.parseInt(a(E,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:a(E,"IsAttachable")==="true",Description:a(E,"Description"),CreateDate:a(E,"CreateDate"),UpdateDate:a(E,"UpdateDate")}}parsePolicies(E){return P_(E,"Policies","member").map((_)=>({PolicyName:a(_,"PolicyName")||"",PolicyId:a(_,"PolicyId")||"",Arn:a(_,"Arn")||"",Path:a(_,"Path"),DefaultVersionId:a(_,"DefaultVersionId"),AttachmentCount:a(_,"AttachmentCount")?Number.parseInt(a(_,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:a(_,"PermissionsBoundaryUsageCount")?Number.parseInt(a(_,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:a(_,"IsAttachable")==="true",Description:a(_,"Description"),CreateDate:a(_,"CreateDate"),UpdateDate:a(_,"UpdateDate")}))}parsePolicyVersions(E){return P_(E,"Versions","member").map((_)=>({VersionId:a(_,"VersionId")||"",IsDefaultVersion:a(_,"IsDefaultVersion")==="true",CreateDate:a(_,"CreateDate")}))}parseAttachedPolicies(E){return P_(E,"AttachedPolicies","member").map((_)=>({PolicyName:a(_,"PolicyName")||"",PolicyArn:a(_,"PolicyArn")||""}))}async putUserPolicy(E){await this.request("PutUserPolicy",E)}async getUserPolicy(E){let T=await this.request("GetUserPolicy",E);return{UserName:a(T,"UserName")||"",PolicyName:a(T,"PolicyName")||"",PolicyDocument:decodeURIComponent(a(T,"PolicyDocument")||"")}}async deleteUserPolicy(E){await this.request("DeleteUserPolicy",E)}async listUserPolicies(E){let T=await this.request("ListUserPolicies",E),_=P_(T,"PolicyNames","member"),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{PolicyNames:_,IsTruncated:r,Marker:t}}async putGroupPolicy(E){await this.request("PutGroupPolicy",E)}async getGroupPolicy(E){let T=await this.request("GetGroupPolicy",E);return{GroupName:a(T,"GroupName")||"",PolicyName:a(T,"PolicyName")||"",PolicyDocument:decodeURIComponent(a(T,"PolicyDocument")||"")}}async deleteGroupPolicy(E){await this.request("DeleteGroupPolicy",E)}async listGroupPolicies(E){let T=await this.request("ListGroupPolicies",E),_=P_(T,"PolicyNames","member"),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{PolicyNames:_,IsTruncated:r,Marker:t}}async putRolePolicy(E){await this.request("PutRolePolicy",E)}async getRolePolicy(E){let T=await this.request("GetRolePolicy",E);return{RoleName:a(T,"RoleName")||"",PolicyName:a(T,"PolicyName")||"",PolicyDocument:decodeURIComponent(a(T,"PolicyDocument")||"")}}async deleteRolePolicy(E){await this.request("DeleteRolePolicy",E)}async listRolePolicies(E){let T=await this.request("ListRolePolicies",E),_=P_(T,"PolicyNames","member"),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{PolicyNames:_,IsTruncated:r,Marker:t}}async createAccessKey(E={}){let T=await this.request("CreateAccessKey",E);if(typeof T==="object"){let _=T?.CreateAccessKeyResult?.AccessKey||T?.AccessKey;if(_)return{AccessKey:{UserName:_.UserName||"",AccessKeyId:_.AccessKeyId||"",Status:_.Status||"Active",SecretAccessKey:_.SecretAccessKey||"",CreateDate:_.CreateDate}}}return{AccessKey:{UserName:a(T,"UserName")||"",AccessKeyId:a(T,"AccessKeyId")||"",Status:a(T,"Status")||"Active",SecretAccessKey:a(T,"SecretAccessKey")||"",CreateDate:a(T,"CreateDate")}}}async listAccessKeys(E={}){let T=await this.request("ListAccessKeys",E),_=this.parseAccessKeys(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{AccessKeyMetadata:_,IsTruncated:r,Marker:t}}async updateAccessKey(E){await this.request("UpdateAccessKey",E)}async deleteAccessKey(E){await this.request("DeleteAccessKey",E)}async getAccessKeyLastUsed(E){let T=await this.request("GetAccessKeyLastUsed",E);return{UserName:a(T,"UserName")||"",AccessKeyLastUsed:{LastUsedDate:a(T,"LastUsedDate"),ServiceName:a(T,"ServiceName"),Region:a(T,"Region")}}}parseAccessKeys(E){return P_(E,"AccessKeyMetadata","member").map((_)=>({UserName:a(_,"UserName"),AccessKeyId:a(_,"AccessKeyId")||"",Status:a(_,"Status")||"Active",CreateDate:a(_,"CreateDate")}))}async createInstanceProfile(E){let T=await this.request("CreateInstanceProfile",E);return this.parseInstanceProfile(T)}async getInstanceProfile(E){let T=await this.request("GetInstanceProfile",E);return this.parseInstanceProfile(T)}async listInstanceProfiles(E={}){let T=await this.request("ListInstanceProfiles",E),_=this.parseInstanceProfiles(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{InstanceProfiles:_,IsTruncated:r,Marker:t}}async listInstanceProfilesForRole(E){let T=await this.request("ListInstanceProfilesForRole",E),_=this.parseInstanceProfiles(T),r=a(T,"IsTruncated")==="true",t=a(T,"Marker");return{InstanceProfiles:_,IsTruncated:r,Marker:t}}async addRoleToInstanceProfile(E){await this.request("AddRoleToInstanceProfile",E)}async removeRoleFromInstanceProfile(E){await this.request("RemoveRoleFromInstanceProfile",E)}async deleteInstanceProfile(E){await this.request("DeleteInstanceProfile",E)}parseInstanceProfile(E){return{InstanceProfileName:a(E,"InstanceProfileName")||"",InstanceProfileId:a(E,"InstanceProfileId")||"",Arn:a(E,"Arn")||"",Path:a(E,"Path"),CreateDate:a(E,"CreateDate")}}parseInstanceProfiles(E){return P_(E,"InstanceProfiles","member").map((_)=>({InstanceProfileName:a(_,"InstanceProfileName")||"",InstanceProfileId:a(_,"InstanceProfileId")||"",Arn:a(_,"Arn")||"",Path:a(_,"Path"),CreateDate:a(_,"CreateDate")}))}async getAccountPasswordPolicy(){let E=await this.request("GetAccountPasswordPolicy");return{MinimumPasswordLength:a(E,"MinimumPasswordLength")?Number.parseInt(a(E,"MinimumPasswordLength"),10):void 0,RequireSymbols:a(E,"RequireSymbols")==="true",RequireNumbers:a(E,"RequireNumbers")==="true",RequireUppercaseCharacters:a(E,"RequireUppercaseCharacters")==="true",RequireLowercaseCharacters:a(E,"RequireLowercaseCharacters")==="true",AllowUsersToChangePassword:a(E,"AllowUsersToChangePassword")==="true",ExpirePasswords:a(E,"ExpirePasswords")==="true",MaxPasswordAge:a(E,"MaxPasswordAge")?Number.parseInt(a(E,"MaxPasswordAge"),10):void 0,PasswordReusePrevention:a(E,"PasswordReusePrevention")?Number.parseInt(a(E,"PasswordReusePrevention"),10):void 0,HardExpiry:a(E,"HardExpiry")==="true"}}async updateAccountPasswordPolicy(E){await this.request("UpdateAccountPasswordPolicy",E)}async deleteAccountPasswordPolicy(){await this.request("DeleteAccountPasswordPolicy")}async getAccountSummary(){let E=await this.request("GetAccountSummary"),T={},_=P_(E,"SummaryMap","entry");for(let r of _){let t=a(r,"key"),d=a(r,"value");if(t&&d)T[t]=Number.parseInt(d,10)}return T}async listAccountAliases(){let E=await this.request("ListAccountAliases"),T=P_(E,"AccountAliases","member"),_=a(E,"IsTruncated")==="true",r=a(E,"Marker");return{AccountAliases:T,IsTruncated:_,Marker:r}}async createAccountAlias(E){await this.request("CreateAccountAlias",E)}async deleteAccountAlias(E){await this.request("DeleteAccountAlias",E)}async simulatePrincipalPolicy(E){let T=await this.request("SimulatePrincipalPolicy",E);return this.parseSimulationResults(T)}parseSimulationResults(E){let _=P_(E,"EvaluationResults","member").map((d)=>{let h=P_(d,"MatchedStatements","member").map((S)=>({SourcePolicyId:a(S,"SourcePolicyId"),SourcePolicyType:a(S,"SourcePolicyType")}));return{EvalActionName:a(d,"EvalActionName")||"",EvalResourceName:a(d,"EvalResourceName"),EvalDecision:a(d,"EvalDecision")||"",MatchedStatements:h.length>0?h:void 0}}),r=a(E,"IsTruncated")==="true",t=a(E,"Marker");return{EvaluationResults:_,IsTruncated:r,Marker:t}}}var QS=wE(()=>{ME()});var D_;var $h=wE(()=>{ME();D_=class D_{client;region;constructor(E="us-east-1"){this.region=E,this.client=new zE}async createHostedZone(E){let T=E.CallerReference||`${Date.now()}-${Math.random().toString(36).slice(2)}`,_=`<?xml version="1.0" encoding="UTF-8"?>
 <CreateHostedZoneRequest xmlns="https://route53.amazonaws.com/doc/2013-04-01/">
   <Name>${E.Name}</Name>
   <CallerReference>${T}</CallerReference>`;if(E.HostedZoneConfig){if(_+=`
@@ -57,7 +57,7 @@ ${sE.bright}${sE.cyan}${E}${sE.reset}
     </Changes>
   </ChangeBatch>
 </ChangeResourceRecordSetsRequest>`;let r=await this.client.request({service:"route53",region:this.region,method:"POST",path:`/2013-04-01/hostedzone/${T}/rrset`,headers:{"content-type":"application/xml"},body:_});return this.parseChangeResourceRecordSetsResponse(r)}escapeXml(E){return E.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}parseCreateHostedZoneResponse(E){let T=E.CreateHostedZoneResponse||E;return{HostedZone:this.parseHostedZone(T.HostedZone),ChangeInfo:{Id:T.ChangeInfo?.Id||"",Status:T.ChangeInfo?.Status||"",SubmittedAt:T.ChangeInfo?.SubmittedAt||""},DelegationSet:this.parseDelegationSet(T.DelegationSet),Location:T.Location||""}}parseListHostedZonesResponse(E){let T=E.ListHostedZonesResponse||E.ListHostedZonesByNameResponse||E,_=T.HostedZones?.HostedZone||T.HostedZones||[];if(!Array.isArray(_))_=_?[_]:[];return{HostedZones:_.map((r)=>this.parseHostedZone(r)),IsTruncated:T.IsTruncated==="true"||T.IsTruncated===!0,MaxItems:T.MaxItems||"100",Marker:T.Marker,NextMarker:T.NextMarker}}parseGetHostedZoneResponse(E){let T=E.GetHostedZoneResponse||E;return{HostedZone:this.parseHostedZone(T.HostedZone),DelegationSet:this.parseDelegationSet(T.DelegationSet),VPCs:T.VPCs?.VPC?Array.isArray(T.VPCs.VPC)?T.VPCs.VPC:[T.VPCs.VPC]:void 0}}parseListResourceRecordSetsResponse(E){let T=E.ListResourceRecordSetsResponse||E,_=T.ResourceRecordSets?.ResourceRecordSet||T.ResourceRecordSets||[];if(!Array.isArray(_))_=_?[_]:[];return{ResourceRecordSets:_.map((r)=>this.parseResourceRecordSet(r)),IsTruncated:T.IsTruncated==="true"||T.IsTruncated===!0,MaxItems:T.MaxItems||"100",NextRecordName:T.NextRecordName,NextRecordType:T.NextRecordType,NextRecordIdentifier:T.NextRecordIdentifier}}parseChangeResourceRecordSetsResponse(E){let T=E.ChangeResourceRecordSetsResponse||E;return{ChangeInfo:{Id:T.ChangeInfo?.Id||"",Status:T.ChangeInfo?.Status||"",SubmittedAt:T.ChangeInfo?.SubmittedAt||"",Comment:T.ChangeInfo?.Comment}}}parseHostedZone(E){if(!E)return{Id:"",Name:""};return{Id:E.Id||"",Name:E.Name||"",CallerReference:E.CallerReference,Config:E.Config?{Comment:E.Config.Comment,PrivateZone:E.Config.PrivateZone==="true"||E.Config.PrivateZone===!0}:void 0,ResourceRecordSetCount:E.ResourceRecordSetCount?Number(E.ResourceRecordSetCount):void 0}}parseDelegationSet(E){if(!E)return{NameServers:[]};let T=E.NameServers?.NameServer||E.NameServers||[];if(!Array.isArray(T))T=T?[T]:[];return{Id:E.Id,CallerReference:E.CallerReference,NameServers:T}}parseResourceRecordSet(E){if(!E)return{Name:"",Type:""};let T=E.ResourceRecords?.ResourceRecord||E.ResourceRecords||[];if(!Array.isArray(T))T=T?[T]:[];return{Name:E.Name||"",Type:E.Type||"",TTL:E.TTL?Number(E.TTL):void 0,ResourceRecords:T.map((_)=>({Value:_.Value||_})),AliasTarget:E.AliasTarget?{HostedZoneId:E.AliasTarget.HostedZoneId,DNSName:E.AliasTarget.DNSName,EvaluateTargetHealth:E.AliasTarget.EvaluateTargetHealth==="true"||E.AliasTarget.EvaluateTargetHealth===!0}:void 0,SetIdentifier:E.SetIdentifier,Weight:E.Weight?Number(E.Weight):void 0,Region:E.Region,GeoLocation:E.GeoLocation,Failover:E.Failover,HealthCheckId:E.HealthCheckId}}async findHostedZoneByName(E){let T=E.endsWith(".")?E:`${E}.`;return(await this.listHostedZonesByName({DNSName:T})).HostedZones.find((t)=>t.Name===T)||null}async createARecord(E){let T=Array.isArray(E.Value)?E.Value:[E.Value];return this.changeResourceRecordSets({HostedZoneId:E.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:E.Name,Type:"A",TTL:E.TTL||300,ResourceRecords:T.map((_)=>({Value:_}))}}]}})}async createCnameRecord(E){return this.changeResourceRecordSets({HostedZoneId:E.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:E.Name,Type:"CNAME",TTL:E.TTL||300,ResourceRecords:[{Value:E.Value}]}}]}})}async createAliasRecord(E){return this.changeResourceRecordSets({HostedZoneId:E.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:E.Name,Type:E.Type||"A",AliasTarget:{HostedZoneId:E.TargetHostedZoneId,DNSName:E.TargetDNSName,EvaluateTargetHealth:E.EvaluateTargetHealth??!1}}}]}})}async createTxtRecord(E){let _=(Array.isArray(E.Value)?E.Value:[E.Value]).map((r)=>{if(!r.startsWith('"'))return`"${r}"`;return r});return this.changeResourceRecordSets({HostedZoneId:E.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:E.Name,Type:"TXT",TTL:E.TTL||300,ResourceRecords:_.map((r)=>({Value:r}))}}]}})}async createMxRecord(E){return this.changeResourceRecordSets({HostedZoneId:E.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:E.Name,Type:"MX",TTL:E.TTL||300,ResourceRecords:E.Values.map((T)=>({Value:`${T.priority} ${T.mailServer}`}))}}]}})}async deleteRecord(E){return this.changeResourceRecordSets({HostedZoneId:E.HostedZoneId,ChangeBatch:{Changes:[{Action:"DELETE",ResourceRecordSet:E.RecordSet}]}})}async waitForChange(E,T=60,_=5000){let r=E.replace("/change/","");for(let t=0;t<T;t++){let d=await this.client.request({service:"route53",region:this.region,method:"GET",path:`/2013-04-01/change/${r}`});if((d.GetChangeResponse?.ChangeInfo?.Status||d.ChangeInfo?.Status)==="INSYNC")return!0;await new Promise((h)=>setTimeout(h,_))}return!1}async findOrCreateHostedZone(E){let T=E.domainName.endsWith(".")?E.domainName:`${E.domainName}.`,_=await this.findHostedZoneByName(T);if(_){let t=await this.getHostedZone({Id:_.Id});return{hostedZone:_,nameServers:t.DelegationSet.NameServers,isNew:!1}}let r=await this.createHostedZone({Name:T,HostedZoneConfig:{Comment:E.comment||`Hosted zone for ${E.domainName}`,PrivateZone:E.privateZone},VPC:E.vpc});return{hostedZone:r.HostedZone,nameServers:r.DelegationSet.NameServers,isNew:!0}}static getRootDomain(E){let T=E.replace(/\.$/,"").split(".");if(T.length<=2)return E;return T.slice(-2).join(".")}async findHostedZoneForDomain(E){let _=E.replace(/\.$/,"").split(".");for(let r=0;r<_.length-1;r++){let t=_.slice(r).join("."),d=await this.findHostedZoneByName(t);if(d)return d}return null}async ensureHostedZone(E){let T=await this.findOrCreateHostedZone({domainName:E.domainName,comment:E.comment});return{hostedZoneId:T.hostedZone.Id.replace("/hostedzone/",""),nameServers:T.nameServers,isNew:T.isNew,action:T.isNew?"created":"found"}}async setupDomainDns(E){let{domain:T,createIfNotExists:_=!0}=E,r=await this.findHostedZoneByName(T);if(r){let d=await this.getHostedZone({Id:r.Id});return{success:!0,hostedZoneId:r.Id.replace("/hostedzone/",""),nameServers:d.DelegationSet.NameServers,isNew:!1,message:`Found existing hosted zone for ${T}`}}if(!_)return{success:!1,hostedZoneId:null,nameServers:[],isNew:!1,message:`No hosted zone found for ${T} and createIfNotExists is false`};let t=await this.createHostedZone({Name:T,HostedZoneConfig:{Comment:`Created automatically by ts-cloud for ${T}`}});return{success:!0,hostedZoneId:t.HostedZone.Id.replace("/hostedzone/",""),nameServers:t.DelegationSet.NameServers,isNew:!0,message:`Created new hosted zone for ${T}. Please update your domain registrar with these name servers: ${t.DelegationSet.NameServers.join(", ")}`}}static CloudFrontHostedZoneId="Z2FDTNDATAQYW2";static S3WebsiteHostedZoneIds={"us-east-1":"Z3AQBSTGFYJSTF","us-east-2":"Z2O1EMRO9K5GLX","us-west-1":"Z2F56UZL2M1ACD","us-west-2":"Z3BJ6K6RIION7M","ap-east-1":"ZNB98KWMFR0R6","ap-south-1":"Z11RGJOFQNVJUP","ap-northeast-1":"Z2M4EHUR26P7ZW","ap-northeast-2":"Z3W03O7B5YMIYP","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"Z3O0J2DXBE1FTB","ap-southeast-2":"Z1WCIGYICN2BYD","ca-central-1":"Z1QDHH18159H29","eu-central-1":"Z21DNDUVLTQW6Q","eu-west-1":"Z1BKCTXD74EZPE","eu-west-2":"Z3GKZC51ZF0DB4","eu-west-3":"Z3R1K369G5AVDG","eu-north-1":"Z3BAZG2TWCNX0D","sa-east-1":"Z7KQH4QJS55SO"};static ALBHostedZoneIds={"us-east-1":"Z35SXDOTRQ7X7K","us-east-2":"Z3AADJGX6KTTL2","us-west-1":"Z368ELLRRE2KJ0","us-west-2":"Z1H1FL5HABSF5","ap-east-1":"Z3DQVH9N71FHZ0","ap-south-1":"ZP97RAFLXTNZK","ap-northeast-1":"Z14GRHDCWA56QT","ap-northeast-2":"ZWKZPGTI48KDX","ap-northeast-3":"Z5LXEBD8Y73MNV","ap-southeast-1":"Z1LMS91P8CMLE5","ap-southeast-2":"Z1GM3OXH4ZPM65","ca-central-1":"ZQSVJUPU6J1EY","eu-central-1":"Z215JYRZR1TBD5","eu-west-1":"Z32O12XQLNTSW2","eu-west-2":"ZHURV8PSTC4K8","eu-west-3":"Z3Q77PNBQS71R4","eu-north-1":"Z23TAZ6LKFMNIO","sa-east-1":"Z2P70J7HTTTPLU"};static APIGatewayHostedZoneIds={"us-east-1":"Z1UJRXOUMOOFQ8","us-east-2":"ZOJJZC49E0EPZ","us-west-1":"Z2MUQ32089INYE","us-west-2":"Z2OJLYMUO9EFXC","ap-east-1":"Z3FD1VL90ND7K5","ap-south-1":"Z3VO1THU9YC4UR","ap-northeast-1":"Z1YSHQZHG15GKL","ap-northeast-2":"Z20JF4UZKIW1U8","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"ZL327KTPIQFUL","ap-southeast-2":"Z2RPCDW04V8134","ca-central-1":"Z19DQILCV0OWEC","eu-central-1":"Z1U9ULNL0V5AJ3","eu-west-1":"ZLY8HYME6SFDD","eu-west-2":"ZJ5UAJN8Y3Z2Q","eu-west-3":"Z3KY65QIEKYHQQ","eu-north-1":"Z3UWIKFBOOGXPP","sa-east-1":"ZCMLWB8V5SYIT"}}});function IR(E){if(E){let r=dj(E);if(!r)throw Error(`AWS profile '${E}' not found in ~/.aws/credentials`);return r}let T=process.env.AWS_ACCESS_KEY_ID,_=process.env.AWS_SECRET_ACCESS_KEY;if(T&&_)return{accessKeyId:T,secretAccessKey:_,sessionToken:process.env.AWS_SESSION_TOKEN};return dj(process.env.AWS_PROFILE||"default")??{accessKeyId:"",secretAccessKey:""}}function dj(E){let{existsSync:T,readFileSync:_}=kE("node:fs"),{homedir:r}=kE("node:os"),{join:t}=kE("node:path"),d=process.env.AWS_SHARED_CREDENTIALS_FILE||t(r(),".aws","credentials");if(!T(d))return null;let R=_(d,"utf-8"),h=null,S,N,A;for(let L of R.split(`
-`)){let O=L.trim();if(!O||O.startsWith("#")||O.startsWith(";"))continue;let c=O.match(/^\[([^\]]+)\]$/);if(c){if(h===E&&S&&N)return{accessKeyId:S,secretAccessKey:N,sessionToken:A};h=c[1],S=void 0,N=void 0,A=void 0;continue}if(h===E){let[U,...$]=O.split("="),I=$.join("=").trim();switch(U.trim().toLowerCase()){case"aws_access_key_id":S=I;break;case"aws_secret_access_key":N=I;break;case"aws_session_token":A=I;break}}}if(h===E&&S&&N)return{accessKeyId:S,secretAccessKey:N,sessionToken:A};return null}var MS={};MT(MS,{S3Client:()=>qE});import*as fE from"node:crypto";import{readFileSync as Rj}from"node:fs";import{readdir as W8}from"node:fs/promises";import{join as H8}from"node:path";function hj(E){let{buffer:T,byteOffset:_,byteLength:r}=E;if(T instanceof ArrayBuffer)return T.slice(_,_+r);let t=new ArrayBuffer(r);return new Uint8Array(t).set(new Uint8Array(E)),t}class qE{client;region;explicitProfile;endpoint;endpointProtocol="https";forcePathStyle;explicitCredentials;constructor(E="us-east-1",T,_){let r=typeof E==="string"?_:E,t=typeof E==="string"?E:E.region??"us-east-1",d=typeof E==="string"?T:E.profile,R=r?.endpoint?gA({region:t,path:"/",endpoint:r.endpoint}):void 0;this.region=t,this.explicitProfile=d,this.endpoint=R?.host,this.endpointProtocol=R?.protocol??"https",this.forcePathStyle=r?.forcePathStyle,this.explicitCredentials=r?.credentials,this.client=new zE(r?.credentials,{profile:d,endpoint:r?.endpoint,forcePathStyle:r?.forcePathStyle})}getCredentials(){if(this.explicitCredentials?.accessKeyId&&this.explicitCredentials.secretAccessKey)return this.explicitCredentials;let E=IR(this.explicitProfile);if(E.accessKeyId&&E.secretAccessKey)return E;throw Error("S3 credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or pass explicit credentials/profile), or configure ~/.aws/credentials.")}s3BaseHost(){return this.endpoint||`s3.${this.region}.amazonaws.com`}s3VirtualHost(E){return this.forcePathStyle?this.s3BaseHost():`${E}.${this.s3BaseHost()}`}objectPath(E,T){return this.forcePathStyle?`/${E}/${T}`:`/${T}`}objectUrl(E,T){return`${this.endpointProtocol}://${this.s3VirtualHost(E)}${this.objectPath(E,T)}`}async listBuckets(){let E=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/"}),T=[],r=(E?.ListAllMyBucketsResult??E)?.Buckets?.Bucket;if(r){let t=Array.isArray(r)?r:[r];for(let d of t)T.push({Name:d.Name,CreationDate:d.CreationDate})}return{Buckets:T}}async createBucket(E,T){let _={};if(T?.acl)_["x-amz-acl"]=T.acl;let r;if(this.region!=="us-east-1"&&!this.endpoint)r=`<?xml version="1.0" encoding="UTF-8"?>
+`)){let O=L.trim();if(!O||O.startsWith("#")||O.startsWith(";"))continue;let c=O.match(/^\[([^\]]+)\]$/);if(c){if(h===E&&S&&N)return{accessKeyId:S,secretAccessKey:N,sessionToken:A};h=c[1],S=void 0,N=void 0,A=void 0;continue}if(h===E){let[U,...$]=O.split("="),I=$.join("=").trim();switch(U.trim().toLowerCase()){case"aws_access_key_id":S=I;break;case"aws_secret_access_key":N=I;break;case"aws_session_token":A=I;break}}}if(h===E&&S&&N)return{accessKeyId:S,secretAccessKey:N,sessionToken:A};return null}var MS={};MT(MS,{S3Client:()=>qE});import*as fE from"node:crypto";import{readFileSync as Rj}from"node:fs";import{readdir as W9}from"node:fs/promises";import{join as H9}from"node:path";function hj(E){let{buffer:T,byteOffset:_,byteLength:r}=E;if(T instanceof ArrayBuffer)return T.slice(_,_+r);let t=new ArrayBuffer(r);return new Uint8Array(t).set(new Uint8Array(E)),t}class qE{client;region;explicitProfile;endpoint;endpointProtocol="https";forcePathStyle;explicitCredentials;constructor(E="us-east-1",T,_){let r=typeof E==="string"?_:E,t=typeof E==="string"?E:E.region??"us-east-1",d=typeof E==="string"?T:E.profile,R=r?.endpoint?gA({region:t,path:"/",endpoint:r.endpoint}):void 0;this.region=t,this.explicitProfile=d,this.endpoint=R?.host,this.endpointProtocol=R?.protocol??"https",this.forcePathStyle=r?.forcePathStyle,this.explicitCredentials=r?.credentials,this.client=new zE(r?.credentials,{profile:d,endpoint:r?.endpoint,forcePathStyle:r?.forcePathStyle})}getCredentials(){if(this.explicitCredentials?.accessKeyId&&this.explicitCredentials.secretAccessKey)return this.explicitCredentials;let E=IR(this.explicitProfile);if(E.accessKeyId&&E.secretAccessKey)return E;throw Error("S3 credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or pass explicit credentials/profile), or configure ~/.aws/credentials.")}s3BaseHost(){return this.endpoint||`s3.${this.region}.amazonaws.com`}s3VirtualHost(E){return this.forcePathStyle?this.s3BaseHost():`${E}.${this.s3BaseHost()}`}objectPath(E,T){return this.forcePathStyle?`/${E}/${T}`:`/${T}`}objectUrl(E,T){return`${this.endpointProtocol}://${this.s3VirtualHost(E)}${this.objectPath(E,T)}`}async listBuckets(){let E=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/"}),T=[],r=(E?.ListAllMyBucketsResult??E)?.Buckets?.Bucket;if(r){let t=Array.isArray(r)?r:[r];for(let d of t)T.push({Name:d.Name,CreationDate:d.CreationDate})}return{Buckets:T}}async createBucket(E,T){let _={};if(T?.acl)_["x-amz-acl"]=T.acl;let r;if(this.region!=="us-east-1"&&!this.endpoint)r=`<?xml version="1.0" encoding="UTF-8"?>
 <CreateBucketConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
   <LocationConstraint>${this.region}</LocationConstraint>
 </CreateBucketConfiguration>`,_["Content-Type"]="application/xml";await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${E}`,headers:_,body:r})}async deleteBucket(E){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${E}`})}async emptyAndDeleteBucket(E){let T=!0;while(T){let _=await this.listAllObjects({bucket:E});if(_.length===0){T=!1;break}let r=_.map((t)=>t.Key);for(let t=0;t<r.length;t+=1000){let d=r.slice(t,t+1000);await this.deleteObjects(E,d)}}await this.deleteBucket(E)}async listAllObjects(E){let T=[],_;do{let r={"list-type":"2","max-keys":"1000"};if(E.prefix)r.prefix=E.prefix;if(_)r["continuation-token"]=_;let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${E.bucket}`,queryParams:r}),d=t?.ListBucketResult??t,R=d?.Contents;if(R){let S=Array.isArray(R)?R:[R];for(let N of S)T.push({Key:N.Key,LastModified:N.LastModified||"",Size:Number.parseInt(N.Size||"0"),ETag:N.ETag})}let h=d?.IsTruncated;_=h==="true"||h===!0?d?.NextContinuationToken:void 0}while(_);return T}async list(E){let T=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${E.bucket}`}),_=[],t=(T?.ListBucketResult??T)?.Contents;if(t){let d=Array.isArray(t)?t:[t];for(let R of d){if(E.prefix&&!R.Key?.startsWith(E.prefix))continue;if(_.push({Key:R.Key||"",LastModified:R.LastModified||"",Size:Number.parseInt(R.Size||"0"),ETag:R.ETag}),E.maxKeys&&_.length>=E.maxKeys)break}}return _}async putObject(E){let T={};if(E.acl)T["x-amz-acl"]=E.acl;if(E.cacheControl)T["Cache-Control"]=E.cacheControl;if(E.contentType)T["Content-Type"]=E.contentType;if(E.metadata)for(let[t,d]of Object.entries(E.metadata))T[`x-amz-meta-${t}`]=d;let _=E.key.split("/").map((t)=>encodeURIComponent(t)).join("/"),r=E.body instanceof Uint8Array&&!Buffer.isBuffer(E.body)?Buffer.from(E.body):E.body;if(Buffer.isBuffer(r)||r instanceof Uint8Array){let t=Buffer.isBuffer(r)?r:Buffer.from(r),{accessKeyId:d,secretAccessKey:R,sessionToken:h}=this.getCredentials(),S=this.s3VirtualHost(E.bucket),N=this.objectPath(E.bucket,_),A=this.objectUrl(E.bucket,_),L=new Date,O=L.toISOString().replace(/[:-]|\.\d{3}/g,""),c=L.toISOString().slice(0,10).replace(/-/g,""),U=fE.createHash("sha256").update(t).digest("hex"),$={host:S,"x-amz-date":O,"x-amz-content-sha256":U,...T};if(h)$["x-amz-security-token"]=h;let I=Object.keys($).sort().map((s)=>`${s.toLowerCase()}:${$[s].trim()}
@@ -70,7 +70,7 @@ ${sE.bright}${sE.cyan}${E}${sE.reset}
 <Delete>
   ${T.map((t)=>`<Object><Key>${t}</Key></Object>`).join(`
   `)}
-</Delete>`,r=fE.createHash("md5").update(_).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${E}`,queryParams:{delete:""},body:_,headers:{"Content-Type":"application/xml","Content-MD5":r}})}async bucketExists(E){try{return await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${E}`}),!0}catch{return!1}}async copy(E){let T=Rj(E.source);await this.putObject({bucket:E.bucket,key:E.key,body:T,acl:E.acl,cacheControl:E.cacheControl,contentType:E.contentType,metadata:E.metadata})}async sync(E){let T=await this.listFilesRecursive(E.source);for(let _ of T){if(E.exclude&&E.exclude.some((d)=>_.includes(d)))continue;if(E.include&&!E.include.some((d)=>_.includes(d)))continue;let r=_.substring(E.source.length+1),t=E.prefix?`${E.prefix}/${r}`:r;if(!E.dryRun){let d=Rj(_);await this.putObject({bucket:E.bucket,key:t,body:d,acl:E.acl,cacheControl:E.cacheControl,contentType:E.contentType,metadata:E.metadata})}}}async delete(E,T){await this.deleteObject(E,T)}async deletePrefix(E,T){let r=(await this.list({bucket:E,prefix:T})).map((t)=>t.Key);if(r.length>0)await this.deleteObjects(E,r)}async getBucketSize(E,T){return(await this.list({bucket:E,prefix:T})).reduce((r,t)=>r+t.Size,0)}async listFilesRecursive(E){let T=[],_=await W8(E,{withFileTypes:!0});for(let r of _){let t=H8(E,r.name);if(r.isDirectory()){let d=await this.listFilesRecursive(t);T.push(...d)}else T.push(t)}return T}async putBucketPolicy(E,T){let{accessKeyId:_,secretAccessKey:r,sessionToken:t}=this.getCredentials(),d=this.s3BaseHost(),R=typeof T==="string"?T:JSON.stringify(T),h=new Date,S=h.toISOString().replace(/[:-]|\.\d{3}/g,""),N=h.toISOString().slice(0,10).replace(/-/g,""),A=fE.createHash("sha256").update(R).digest("hex"),L="/"+E,O="policy=",c={host:d,"x-amz-date":S,"x-amz-content-sha256":A,"content-type":"application/json"};if(t)c["x-amz-security-token"]=t;let U=Object.keys(c).sort().map((TE)=>`${TE.toLowerCase()}:${c[TE].trim()}
+</Delete>`,r=fE.createHash("md5").update(_).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${E}`,queryParams:{delete:""},body:_,headers:{"Content-Type":"application/xml","Content-MD5":r}})}async bucketExists(E){try{return await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${E}`}),!0}catch{return!1}}async copy(E){let T=Rj(E.source);await this.putObject({bucket:E.bucket,key:E.key,body:T,acl:E.acl,cacheControl:E.cacheControl,contentType:E.contentType,metadata:E.metadata})}async sync(E){let T=await this.listFilesRecursive(E.source);for(let _ of T){if(E.exclude&&E.exclude.some((d)=>_.includes(d)))continue;if(E.include&&!E.include.some((d)=>_.includes(d)))continue;let r=_.substring(E.source.length+1),t=E.prefix?`${E.prefix}/${r}`:r;if(!E.dryRun){let d=Rj(_);await this.putObject({bucket:E.bucket,key:t,body:d,acl:E.acl,cacheControl:E.cacheControl,contentType:E.contentType,metadata:E.metadata})}}}async delete(E,T){await this.deleteObject(E,T)}async deletePrefix(E,T){let r=(await this.list({bucket:E,prefix:T})).map((t)=>t.Key);if(r.length>0)await this.deleteObjects(E,r)}async getBucketSize(E,T){return(await this.list({bucket:E,prefix:T})).reduce((r,t)=>r+t.Size,0)}async listFilesRecursive(E){let T=[],_=await W9(E,{withFileTypes:!0});for(let r of _){let t=H9(E,r.name);if(r.isDirectory()){let d=await this.listFilesRecursive(t);T.push(...d)}else T.push(t)}return T}async putBucketPolicy(E,T){let{accessKeyId:_,secretAccessKey:r,sessionToken:t}=this.getCredentials(),d=this.s3BaseHost(),R=typeof T==="string"?T:JSON.stringify(T),h=new Date,S=h.toISOString().replace(/[:-]|\.\d{3}/g,""),N=h.toISOString().slice(0,10).replace(/-/g,""),A=fE.createHash("sha256").update(R).digest("hex"),L="/"+E,O="policy=",c={host:d,"x-amz-date":S,"x-amz-content-sha256":A,"content-type":"application/json"};if(t)c["x-amz-security-token"]=t;let U=Object.keys(c).sort().map((TE)=>`${TE.toLowerCase()}:${c[TE].trim()}
 `).join(""),$=Object.keys(c).sort().map((TE)=>TE.toLowerCase()).join(";"),I=["PUT",L,"policy=",U,$,A].join(`
 `),w="AWS4-HMAC-SHA256",z=`${N}/${this.region}/s3/aws4_request`,F=[w,S,z,fE.createHash("sha256").update(I).digest("hex")].join(`
 `),j=fE.createHmac("sha256","AWS4"+r).update(N).digest(),Y=fE.createHmac("sha256",j).update(this.region).digest(),H=fE.createHmac("sha256",Y).update("s3").digest(),Q=fE.createHmac("sha256",H).update("aws4_request").digest(),K=fE.createHmac("sha256",Q).update(F).digest("hex"),x=`${w} Credential=${_}/${z}, SignedHeaders=${$}, Signature=${K}`,k=`${this.endpointProtocol}://${d}${L}?policy=`,n=await fetch(k,{method:"PUT",headers:{...c,Authorization:x},body:R});if(!n.ok){let TE=await n.text();throw Error(`Failed to put bucket policy: ${n.status} ${TE}`)}}async getBucketPolicy(E){let{accessKeyId:T,secretAccessKey:_,sessionToken:r}=this.getCredentials(),t=this.s3BaseHost(),d=new Date,R=d.toISOString().replace(/[:-]|\.\d{3}/g,""),h=d.toISOString().slice(0,10).replace(/-/g,""),S=fE.createHash("sha256").update("").digest("hex"),N="/"+E,A="policy=",L={host:t,"x-amz-date":R,"x-amz-content-sha256":S};if(r)L["x-amz-security-token"]=r;let O=Object.keys(L).sort().map((n)=>`${n.toLowerCase()}:${L[n].trim()}
@@ -146,7 +146,7 @@ host:${R}
   <Quiet>true</Quiet>
   ${T.map((t)=>`<Object><Key>${t.Key}</Key>${t.VersionId?`<VersionId>${t.VersionId}</VersionId>`:""}</Object>`).join(`
   `)}
-</Delete>`,r=fE.createHash("md5").update(_).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${E}`,queryParams:{delete:""},body:_,headers:{"Content-Type":"application/xml","Content-MD5":r}})}}var XT=wE(()=>{ME()});class s_{client;region;constructor(E="us-east-1",T){this.region=E,this.client=new zE(T)}async createEmailIdentity(E){return await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/identities",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})}async getEmailIdentity(E){let T=await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/identities/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}});return{IdentityType:T.IdentityType,IdentityName:E,SendingEnabled:T.VerifiedForSendingStatus,VerificationStatus:T.VerificationStatus,DkimAttributes:T.DkimAttributes,MailFromAttributes:T.MailFromAttributes}}async putEmailIdentityMailFromAttributes(E,T){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(E)}/mail-from`,headers:{"Content-Type":"application/json"},body:JSON.stringify(T)})}async listEmailIdentities(E){let T="/v2/email/identities",_=[];if(E?.PageSize)_.push(`PageSize=${E.PageSize}`);if(E?.NextToken)_.push(`NextToken=${encodeURIComponent(E.NextToken)}`);if(_.length>0)T+=`?${_.join("&")}`;let r=await this.client.request({service:"email",region:this.region,method:"GET",path:T,headers:{"Content-Type":"application/json"}});return{EmailIdentities:r.EmailIdentities,NextToken:r.NextToken}}async deleteEmailIdentity(E){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/identities/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async putEmailIdentityDkimAttributes(E){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(E.EmailIdentity)}/dkim`,headers:{"Content-Type":"application/json"},body:JSON.stringify({SigningEnabled:E.SigningEnabled})})}async sendEmail(E){return{MessageId:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})).MessageId}}async sendBulkEmail(E){return{BulkEmailEntryResults:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-bulk-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})).BulkEmailEntryResults}}async createEmailTemplate(E){await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/templates",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})}async getEmailTemplate(E){return await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/templates/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async deleteEmailTemplate(E){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/templates/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async listEmailTemplates(E){let T="/v2/email/templates",_=[];if(E?.PageSize)_.push(`PageSize=${E.PageSize}`);if(E?.NextToken)_.push(`NextToken=${encodeURIComponent(E.NextToken)}`);if(_.length>0)T+=`?${_.join("&")}`;return await this.client.request({service:"email",region:this.region,method:"GET",path:T,headers:{"Content-Type":"application/json"}})}async getSendStatistics(){return{SendDataPoints:(await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendStatistics&Version=2010-12-01"})).GetSendStatisticsResponse?.GetSendStatisticsResult?.SendDataPoints?.member}}async getSendQuota(){let T=(await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendQuota&Version=2010-12-01"})).GetSendQuotaResponse?.GetSendQuotaResult;return{Max24HourSend:T?.Max24HourSend?Number(T.Max24HourSend):void 0,MaxSendRate:T?.MaxSendRate?Number(T.MaxSendRate):void 0,SentLast24Hours:T?.SentLast24Hours?Number(T.SentLast24Hours):void 0}}async verifyDomain(E){let T=await this.createEmailIdentity({EmailIdentity:E});return{dkimTokens:T.DkimAttributes?.Tokens,verificationStatus:T.DkimAttributes?.Status}}async sendSimpleEmail(E){let T=Array.isArray(E.to)?E.to:[E.to],_=E.replyTo?Array.isArray(E.replyTo)?E.replyTo:[E.replyTo]:void 0,r={};if(E.text)r.Text={Data:E.text};if(E.html)r.Html={Data:E.html};return this.sendEmail({FromEmailAddress:E.from,Destination:{ToAddresses:T},Content:{Simple:{Subject:{Data:E.subject},Body:r}},ReplyToAddresses:_})}async sendTemplatedEmail(E){let T=Array.isArray(E.to)?E.to:[E.to],_=E.replyTo?Array.isArray(E.replyTo)?E.replyTo:[E.replyTo]:void 0;return this.sendEmail({FromEmailAddress:E.from,Destination:{ToAddresses:T},Content:{Template:{TemplateName:E.templateName,TemplateData:JSON.stringify(E.templateData)}},ReplyToAddresses:_})}async getDkimRecords(E){let T=await this.getEmailIdentity(E);if(!T.DkimAttributes?.Tokens)return[];return T.DkimAttributes.Tokens.map((_)=>({name:`${_}._domainkey.${E}`,type:"CNAME",value:`${_}.dkim.amazonses.com`}))}async isDomainVerified(E){try{let T=await this.getEmailIdentity(E);return T.VerificationStatus==="SUCCESS"&&T.SendingEnabled===!0}catch{return!1}}async waitForDomainVerification(E,T=60,_=30000){for(let r=0;r<T;r++){if(await this.isDomainVerified(E))return!0;await new Promise((d)=>setTimeout(d,_))}return!1}buildFormBody(E){return Object.entries(E).filter(([,_])=>_!==void 0).map(([_,r])=>`${encodeURIComponent(_)}=${encodeURIComponent(r)}`).join("&")}async createReceiptRuleSet(E){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})})}async deleteReceiptRuleSet(E){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})})}async setActiveReceiptRuleSet(E){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetActiveReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})})}async listReceiptRuleSets(E){let T={Action:"ListReceiptRuleSets",Version:"2010-12-01"};if(E)T.NextToken=E;let _=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(T)}),r=_?.ListReceiptRuleSetsResponse?.ListReceiptRuleSetsResult||_?.ListReceiptRuleSetsResult,t=r?.RuleSets?.member;return{RuleSets:Array.isArray(t)?t:t?[t]:[],NextToken:r?.NextToken}}async describeReceiptRuleSet(E){let T=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})}),_=T?.DescribeReceiptRuleSetResponse?.DescribeReceiptRuleSetResult||T?.DescribeReceiptRuleSetResult,r=_?.Rules?.member;return{Metadata:_?.Metadata,Rules:Array.isArray(r)?r:r?[r]:[]}}async createReceiptRule(E){let T={Action:"CreateReceiptRule",Version:"2010-12-01",RuleSetName:E.RuleSetName,"Rule.Name":E.Rule.Name,"Rule.Enabled":E.Rule.Enabled!==!1?"true":"false"};if(E.Rule.TlsPolicy)T["Rule.TlsPolicy"]=E.Rule.TlsPolicy;if(E.Rule.ScanEnabled!==void 0)T["Rule.ScanEnabled"]=E.Rule.ScanEnabled?"true":"false";if(E.After)T.After=E.After;if(E.Rule.Recipients)E.Rule.Recipients.forEach((_,r)=>{T[`Rule.Recipients.member.${r+1}`]=_});E.Rule.Actions.forEach((_,r)=>{let t=r+1;if(_.S3Action){if(T[`Rule.Actions.member.${t}.S3Action.BucketName`]=_.S3Action.BucketName,_.S3Action.ObjectKeyPrefix)T[`Rule.Actions.member.${t}.S3Action.ObjectKeyPrefix`]=_.S3Action.ObjectKeyPrefix;if(_.S3Action.KmsKeyArn)T[`Rule.Actions.member.${t}.S3Action.KmsKeyArn`]=_.S3Action.KmsKeyArn}if(_.LambdaAction)T[`Rule.Actions.member.${t}.LambdaAction.FunctionArn`]=_.LambdaAction.FunctionArn,T[`Rule.Actions.member.${t}.LambdaAction.InvocationType`]=_.LambdaAction.InvocationType||"Event";if(_.SNSAction){if(T[`Rule.Actions.member.${t}.SNSAction.TopicArn`]=_.SNSAction.TopicArn,_.SNSAction.Encoding)T[`Rule.Actions.member.${t}.SNSAction.Encoding`]=_.SNSAction.Encoding}if(_.StopAction){if(T[`Rule.Actions.member.${t}.StopAction.Scope`]=_.StopAction.Scope,_.StopAction.TopicArn)T[`Rule.Actions.member.${t}.StopAction.TopicArn`]=_.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(T)})}async deleteReceiptRule(E,T){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRule",Version:"2010-12-01",RuleSetName:E,RuleName:T})})}async receiptRuleSetExists(E){try{return await this.describeReceiptRuleSet(E),!0}catch(T){if(T.code==="RuleSetDoesNotExist"||T.statusCode===400)return!1;throw T}}async getActiveReceiptRuleSet(){let E=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeActiveReceiptRuleSet",Version:"2010-12-01"})}),T=E?.DescribeActiveReceiptRuleSetResponse?.DescribeActiveReceiptRuleSetResult||E?.DescribeActiveReceiptRuleSetResult;if(!T?.Metadata)return null;let _=T?.Rules?.member;return{Metadata:T?.Metadata,Rules:Array.isArray(_)?_:_?[_]:[]}}async updateReceiptRule(E){let T={Action:"UpdateReceiptRule",Version:"2010-12-01",RuleSetName:E.RuleSetName,"Rule.Name":E.Rule.Name};if(E.Rule.Enabled!==void 0)T["Rule.Enabled"]=E.Rule.Enabled?"true":"false";if(E.Rule.TlsPolicy)T["Rule.TlsPolicy"]=E.Rule.TlsPolicy;if(E.Rule.ScanEnabled!==void 0)T["Rule.ScanEnabled"]=E.Rule.ScanEnabled?"true":"false";if(E.Rule.Recipients)E.Rule.Recipients.forEach((_,r)=>{T[`Rule.Recipients.member.${r+1}`]=_});E.Rule.Actions.forEach((_,r)=>{let t=r+1;if(_.S3Action){if(T[`Rule.Actions.member.${t}.S3Action.BucketName`]=_.S3Action.BucketName,_.S3Action.ObjectKeyPrefix)T[`Rule.Actions.member.${t}.S3Action.ObjectKeyPrefix`]=_.S3Action.ObjectKeyPrefix;if(_.S3Action.KmsKeyArn)T[`Rule.Actions.member.${t}.S3Action.KmsKeyArn`]=_.S3Action.KmsKeyArn}if(_.LambdaAction)T[`Rule.Actions.member.${t}.LambdaAction.FunctionArn`]=_.LambdaAction.FunctionArn,T[`Rule.Actions.member.${t}.LambdaAction.InvocationType`]=_.LambdaAction.InvocationType||"Event";if(_.SNSAction){if(T[`Rule.Actions.member.${t}.SNSAction.TopicArn`]=_.SNSAction.TopicArn,_.SNSAction.Encoding)T[`Rule.Actions.member.${t}.SNSAction.Encoding`]=_.SNSAction.Encoding}if(_.StopAction){if(T[`Rule.Actions.member.${t}.StopAction.Scope`]=_.StopAction.Scope,_.StopAction.TopicArn)T[`Rule.Actions.member.${t}.StopAction.TopicArn`]=_.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(T)})}async sendRawEmail(E){let T=Buffer.from(E.rawMessage).toString("base64"),_={Action:"SendRawEmail",Version:"2010-12-01",Source:E.source,"RawMessage.Data":T};E.destinations.forEach((d,R)=>{_[`Destinations.member.${R+1}`]=d});let r=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)});return{MessageId:(r?.SendRawEmailResponse?.SendRawEmailResult||r?.SendRawEmailResult)?.MessageId}}async getSuppressedDestination(E){try{return(await this.client.request({service:"ses",region:this.region,method:"GET",path:`/v2/email/suppression/addresses/${encodeURIComponent(E)}`}))?.SuppressedDestination||null}catch(T){if(T.message?.includes("404")||T.message?.includes("NotFoundException"))return null;throw T}}async deleteSuppressedDestination(E){await this.client.request({service:"ses",region:this.region,method:"DELETE",path:`/v2/email/suppression/addresses/${encodeURIComponent(E)}`})}}var xA=wE(()=>{ME()});var bA={};MT(bA,{email:()=>Y8,EmailClient:()=>uO});class uO{ses;s3;iam;route53;region;domain;defaultFrom;constructor(E={}){this.region=E.region||"us-east-1",this.domain=E.domain,this.defaultFrom=E.defaultFrom,this.ses=new s_(this.region),this.s3=new qE(this.region),this.iam=new U_(this.region),this.route53=new D_(this.region)}async send(E){let T=E.from||this.defaultFrom;if(!T)throw Error("From address is required. Set defaultFrom in constructor or provide from in options.");let _=E.fromName?`${E.fromName} <${T}>`:T,r=Array.isArray(E.to)?E.to:[E.to];if(!E.attachments||E.attachments.length===0)return{messageId:(await this.ses.sendSimpleEmail({from:_,to:r,subject:E.subject,text:E.text,html:E.html,replyTo:E.replyTo})).MessageId||""};let t=this.buildRawEmail(E,_,r);return{messageId:(await this.ses.sendEmail({FromEmailAddress:_,Destination:{ToAddresses:r,CcAddresses:E.cc?Array.isArray(E.cc)?E.cc:[E.cc]:void 0,BccAddresses:E.bcc?Array.isArray(E.bcc)?E.bcc:[E.bcc]:void 0},Content:{Raw:{Data:Buffer.from(t).toString("base64")}}})).MessageId||""}}async sendTemplate(E){let T=E.from||this.defaultFrom;if(!T)throw Error("From address is required");let _=E.fromName?`${E.fromName} <${T}>`:T;return{messageId:(await this.ses.sendTemplatedEmail({from:_,to:E.to,templateName:E.templateName,templateData:E.templateData,replyTo:E.replyTo})).MessageId||""}}async sendBulk(E){let T=E.from||this.defaultFrom;if(!T)throw Error("From address is required");let _=E.recipients.map((t)=>({Destination:{ToAddresses:Array.isArray(t.to)?t.to:[t.to]},ReplacementEmailContent:t.templateData?{ReplacementTemplate:{ReplacementTemplateData:JSON.stringify(t.templateData)}}:void 0}));return{results:(await this.ses.sendBulkEmail({FromEmailAddress:T,BulkEmailEntries:_,DefaultContent:{Template:{TemplateName:E.templateName,TemplateData:JSON.stringify(E.defaultTemplateData)}}})).BulkEmailEntryResults?.map((t)=>({status:t.Status||"UNKNOWN",messageId:t.MessageId,error:t.Error}))||[]}}async setupDomain(E){let T;try{T=await this.ses.getEmailIdentity(E)}catch{let r=await this.ses.createEmailIdentity({EmailIdentity:E});T={VerificationStatus:r.DkimAttributes?.Status,DkimAttributes:r.DkimAttributes,SendingEnabled:r.VerifiedForSendingStatus}}try{await this.ses.putEmailIdentityDkimAttributes({EmailIdentity:E,SigningEnabled:!0})}catch{}try{await this.ses.putEmailIdentityMailFromAttributes(E,{MailFromDomain:`mail.${E}`,BehaviorOnMxFailure:"USE_DEFAULT_VALUE"})}catch{}let _=await this.ses.getDkimRecords(E);return{domainVerified:T.SendingEnabled===!0,dkimStatus:T.DkimAttributes?.Status||"UNKNOWN",dkimTokens:T.DkimAttributes?.Tokens,mailFromStatus:T.MailFromAttributes?.MailFromDomainStatus}}async getDnsRecords(E){let T=[],_=await this.ses.getDkimRecords(E);for(let r of _)T.push({type:r.type,name:r.name,value:r.value,ttl:1800});return T.push({type:"MX",name:E,value:`inbound-smtp.${this.region}.amazonaws.com`,priority:10,ttl:3600}),T.push({type:"MX",name:`mail.${E}`,value:`feedback-smtp.${this.region}.amazonses.com`,priority:10,ttl:3600}),T.push({type:"TXT",name:`mail.${E}`,value:"v=spf1 include:amazonses.com ~all",ttl:3600}),T.push({type:"TXT",name:`_dmarc.${E}`,value:`v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${E}`,ttl:3600}),T}async isDomainReady(E){try{let T=await this.ses.getEmailIdentity(E);return T.SendingEnabled===!0&&T.DkimAttributes?.Status==="SUCCESS"}catch{return!1}}async setupReceiving(E){let T={Version:"2012-10-17",Statement:[{Sid:"AllowSESPuts",Effect:"Allow",Principal:{Service:"ses.amazonaws.com"},Action:"s3:PutObject",Resource:`arn:aws:s3:::${E.bucketName}/*`,Condition:{StringEquals:{"AWS:SourceAccount":E.accountId}}}]};await this.s3.putBucketPolicy(E.bucketName,T);try{await this.ses.createReceiptRuleSet(E.ruleSetName)}catch(r){if(!r.message?.includes("already exists")&&r.code!=="AlreadyExists")throw r}let _=[{S3Action:{BucketName:E.bucketName,ObjectKeyPrefix:E.prefix||"inbox/"}}];if(E.lambdaArn)_.push({LambdaAction:{FunctionArn:E.lambdaArn,InvocationType:"Event"}});try{await this.ses.createReceiptRule({RuleSetName:E.ruleSetName,Rule:{Name:E.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:E.recipients||[E.domain],ScanEnabled:E.scanEnabled!==!1,Actions:_}})}catch(r){if(r.message?.includes("already exists"))await this.ses.deleteReceiptRule(E.ruleSetName,E.ruleName),await this.ses.createReceiptRule({RuleSetName:E.ruleSetName,Rule:{Name:E.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:E.recipients||[E.domain],ScanEnabled:E.scanEnabled!==!1,Actions:_}});else throw r}await this.ses.setActiveReceiptRuleSet(E.ruleSetName)}async getIncomingEmails(E){return(await this.s3.list({bucket:E.bucket,prefix:E.prefix||"incoming/",maxKeys:E.maxResults||100})).map((_)=>({key:_.Key||"",lastModified:_.LastModified||"",size:_.Size||0}))}async readEmail(E){return await this.s3.getObject(E.bucket,E.key)}async createSmtpCredentials(E){let T=`ses-smtp-${E.username.replace(/[^a-zA-Z0-9]/g,"-")}`,{AWSClient:_}=await Promise.resolve().then(() => (ME(),UR)),r=new _,t=(A,L)=>{let O={Action:A,Version:"2010-05-08",...L};return Object.entries(O).map(([c,U])=>`${encodeURIComponent(c)}=${encodeURIComponent(U)}`).join("&")};try{await r.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t("CreateUser",{UserName:T})})}catch(A){if(!A.message?.includes("EntityAlreadyExists"))throw A}let d={Version:"2012-10-17",Statement:[{Effect:"Allow",Action:"ses:SendRawEmail",Resource:"*",Condition:{StringLike:{"ses:FromAddress":`*@${E.domain}`}}}]},R=`ses-smtp-policy-${E.domain.replace(/\./g,"-")}`;try{await r.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t("PutUserPolicy",{UserName:T,PolicyName:R,PolicyDocument:JSON.stringify(d)})})}catch{}let S=(await r.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t("CreateAccessKey",{UserName:T})}))?.CreateAccessKeyResult?.AccessKey;if(!S?.AccessKeyId||!S?.SecretAccessKey)throw Error("Failed to create access key");let N=this.deriveSmtpPassword(S.SecretAccessKey);return{username:S.AccessKeyId,password:N,server:`email-smtp.${this.region}.amazonaws.com`,port:587}}deriveSmtpPassword(E){let T=kE("node:crypto"),_="SendRawEmail",r=Buffer.from([4]),t=T.createHmac("sha256",`AWS4${E}`).update("11111111").digest();return t=T.createHmac("sha256",t).update(this.region).digest(),t=T.createHmac("sha256",t).update("ses").digest(),t=T.createHmac("sha256",t).update("aws4_request").digest(),t=T.createHmac("sha256",t).update("SendRawEmail").digest(),Buffer.concat([r,t]).toString("base64")}async createTemplate(E){await this.ses.createEmailTemplate({TemplateName:E.name,TemplateContent:{Subject:E.subject,Text:E.text,Html:E.html}})}async getTemplate(E){try{let T=await this.ses.getEmailTemplate(E);return{name:T.TemplateName||E,subject:T.TemplateContent?.Subject,text:T.TemplateContent?.Text,html:T.TemplateContent?.Html}}catch{return null}}async deleteTemplate(E){await this.ses.deleteEmailTemplate(E)}async listTemplates(){return(await this.ses.listEmailTemplates()).TemplatesMetadata?.map((T)=>({name:T.TemplateName||"",createdAt:T.CreatedTimestamp}))||[]}async deploy(E){let T=`${E.appName}-${E.environment}-email-rules`,_=`${E.appName}-inbound-email`,r=E.storage?.bucketName||`${E.appName}-${E.environment}-email`,t=await this.setupDomain(E.domain);if(!(await this.s3.listBuckets()).Buckets?.some((S)=>S.Name===r))await this.s3.createBucket(r);await this.setupReceiving({domain:E.domain,ruleSetName:T,ruleName:_,bucketName:r,prefix:E.storage?.prefix||"inbox/",accountId:E.accountId,recipients:E.catchAll?[E.domain]:E.mailboxes,scanEnabled:!0});let h=await this.getDnsRecords(E.domain);return{success:!0,domainVerified:t.domainVerified,dkimStatus:t.dkimStatus,receiptRuleSet:T,storageBucket:r,dnsRecords:h}}async undeploy(E){let T=`${E.appName}-${E.environment}-email-rules`,_=`${E.appName}-inbound-email`,r=`${E.appName}-${E.environment}-email`;try{await this.ses.deleteReceiptRule(T,_)}catch{}try{await this.ses.deleteReceiptRuleSet(T)}catch{}if(E.deleteBucket)try{await this.s3.emptyAndDeleteBucket(r)}catch{}}async getSendingStats(){let E=await this.ses.getSendQuota();return{sentLast24Hours:E.SentLast24Hours||0,maxSendRate:E.MaxSendRate||0,max24HourSend:E.Max24HourSend||0}}buildRawEmail(E,T,_){let r=`----=_Part_${Date.now()}_${Math.random().toString(36).substring(2)}`,t="";if(t+=`From: ${T}\r
+</Delete>`,r=fE.createHash("md5").update(_).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${E}`,queryParams:{delete:""},body:_,headers:{"Content-Type":"application/xml","Content-MD5":r}})}}var XT=wE(()=>{ME()});class s_{client;region;constructor(E="us-east-1",T){this.region=E,this.client=new zE(T)}async createEmailIdentity(E){return await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/identities",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})}async getEmailIdentity(E){let T=await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/identities/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}});return{IdentityType:T.IdentityType,IdentityName:E,SendingEnabled:T.VerifiedForSendingStatus,VerificationStatus:T.VerificationStatus,DkimAttributes:T.DkimAttributes,MailFromAttributes:T.MailFromAttributes}}async putEmailIdentityMailFromAttributes(E,T){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(E)}/mail-from`,headers:{"Content-Type":"application/json"},body:JSON.stringify(T)})}async listEmailIdentities(E){let T="/v2/email/identities",_=[];if(E?.PageSize)_.push(`PageSize=${E.PageSize}`);if(E?.NextToken)_.push(`NextToken=${encodeURIComponent(E.NextToken)}`);if(_.length>0)T+=`?${_.join("&")}`;let r=await this.client.request({service:"email",region:this.region,method:"GET",path:T,headers:{"Content-Type":"application/json"}});return{EmailIdentities:r.EmailIdentities,NextToken:r.NextToken}}async deleteEmailIdentity(E){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/identities/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async putEmailIdentityDkimAttributes(E){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(E.EmailIdentity)}/dkim`,headers:{"Content-Type":"application/json"},body:JSON.stringify({SigningEnabled:E.SigningEnabled})})}async sendEmail(E){return{MessageId:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})).MessageId}}async sendBulkEmail(E){return{BulkEmailEntryResults:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-bulk-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})).BulkEmailEntryResults}}async createEmailTemplate(E){await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/templates",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})}async getEmailTemplate(E){return await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/templates/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async deleteEmailTemplate(E){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/templates/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async listEmailTemplates(E){let T="/v2/email/templates",_=[];if(E?.PageSize)_.push(`PageSize=${E.PageSize}`);if(E?.NextToken)_.push(`NextToken=${encodeURIComponent(E.NextToken)}`);if(_.length>0)T+=`?${_.join("&")}`;return await this.client.request({service:"email",region:this.region,method:"GET",path:T,headers:{"Content-Type":"application/json"}})}async getSendStatistics(){return{SendDataPoints:(await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendStatistics&Version=2010-12-01"})).GetSendStatisticsResponse?.GetSendStatisticsResult?.SendDataPoints?.member}}async getSendQuota(){let T=(await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendQuota&Version=2010-12-01"})).GetSendQuotaResponse?.GetSendQuotaResult;return{Max24HourSend:T?.Max24HourSend?Number(T.Max24HourSend):void 0,MaxSendRate:T?.MaxSendRate?Number(T.MaxSendRate):void 0,SentLast24Hours:T?.SentLast24Hours?Number(T.SentLast24Hours):void 0}}async verifyDomain(E){let T=await this.createEmailIdentity({EmailIdentity:E});return{dkimTokens:T.DkimAttributes?.Tokens,verificationStatus:T.DkimAttributes?.Status}}async sendSimpleEmail(E){let T=Array.isArray(E.to)?E.to:[E.to],_=E.replyTo?Array.isArray(E.replyTo)?E.replyTo:[E.replyTo]:void 0,r={};if(E.text)r.Text={Data:E.text};if(E.html)r.Html={Data:E.html};return this.sendEmail({FromEmailAddress:E.from,Destination:{ToAddresses:T},Content:{Simple:{Subject:{Data:E.subject},Body:r}},ReplyToAddresses:_})}async sendTemplatedEmail(E){let T=Array.isArray(E.to)?E.to:[E.to],_=E.replyTo?Array.isArray(E.replyTo)?E.replyTo:[E.replyTo]:void 0;return this.sendEmail({FromEmailAddress:E.from,Destination:{ToAddresses:T},Content:{Template:{TemplateName:E.templateName,TemplateData:JSON.stringify(E.templateData)}},ReplyToAddresses:_})}async getDkimRecords(E){let T=await this.getEmailIdentity(E);if(!T.DkimAttributes?.Tokens)return[];return T.DkimAttributes.Tokens.map((_)=>({name:`${_}._domainkey.${E}`,type:"CNAME",value:`${_}.dkim.amazonses.com`}))}async isDomainVerified(E){try{let T=await this.getEmailIdentity(E);return T.VerificationStatus==="SUCCESS"&&T.SendingEnabled===!0}catch{return!1}}async waitForDomainVerification(E,T=60,_=30000){for(let r=0;r<T;r++){if(await this.isDomainVerified(E))return!0;await new Promise((d)=>setTimeout(d,_))}return!1}buildFormBody(E){return Object.entries(E).filter(([,_])=>_!==void 0).map(([_,r])=>`${encodeURIComponent(_)}=${encodeURIComponent(r)}`).join("&")}async createReceiptRuleSet(E){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})})}async deleteReceiptRuleSet(E){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})})}async setActiveReceiptRuleSet(E){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetActiveReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})})}async listReceiptRuleSets(E){let T={Action:"ListReceiptRuleSets",Version:"2010-12-01"};if(E)T.NextToken=E;let _=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(T)}),r=_?.ListReceiptRuleSetsResponse?.ListReceiptRuleSetsResult||_?.ListReceiptRuleSetsResult,t=r?.RuleSets?.member;return{RuleSets:Array.isArray(t)?t:t?[t]:[],NextToken:r?.NextToken}}async describeReceiptRuleSet(E){let T=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeReceiptRuleSet",Version:"2010-12-01",RuleSetName:E})}),_=T?.DescribeReceiptRuleSetResponse?.DescribeReceiptRuleSetResult||T?.DescribeReceiptRuleSetResult,r=_?.Rules?.member;return{Metadata:_?.Metadata,Rules:Array.isArray(r)?r:r?[r]:[]}}async createReceiptRule(E){let T={Action:"CreateReceiptRule",Version:"2010-12-01",RuleSetName:E.RuleSetName,"Rule.Name":E.Rule.Name,"Rule.Enabled":E.Rule.Enabled!==!1?"true":"false"};if(E.Rule.TlsPolicy)T["Rule.TlsPolicy"]=E.Rule.TlsPolicy;if(E.Rule.ScanEnabled!==void 0)T["Rule.ScanEnabled"]=E.Rule.ScanEnabled?"true":"false";if(E.After)T.After=E.After;if(E.Rule.Recipients)E.Rule.Recipients.forEach((_,r)=>{T[`Rule.Recipients.member.${r+1}`]=_});E.Rule.Actions.forEach((_,r)=>{let t=r+1;if(_.S3Action){if(T[`Rule.Actions.member.${t}.S3Action.BucketName`]=_.S3Action.BucketName,_.S3Action.ObjectKeyPrefix)T[`Rule.Actions.member.${t}.S3Action.ObjectKeyPrefix`]=_.S3Action.ObjectKeyPrefix;if(_.S3Action.KmsKeyArn)T[`Rule.Actions.member.${t}.S3Action.KmsKeyArn`]=_.S3Action.KmsKeyArn}if(_.LambdaAction)T[`Rule.Actions.member.${t}.LambdaAction.FunctionArn`]=_.LambdaAction.FunctionArn,T[`Rule.Actions.member.${t}.LambdaAction.InvocationType`]=_.LambdaAction.InvocationType||"Event";if(_.SNSAction){if(T[`Rule.Actions.member.${t}.SNSAction.TopicArn`]=_.SNSAction.TopicArn,_.SNSAction.Encoding)T[`Rule.Actions.member.${t}.SNSAction.Encoding`]=_.SNSAction.Encoding}if(_.StopAction){if(T[`Rule.Actions.member.${t}.StopAction.Scope`]=_.StopAction.Scope,_.StopAction.TopicArn)T[`Rule.Actions.member.${t}.StopAction.TopicArn`]=_.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(T)})}async deleteReceiptRule(E,T){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRule",Version:"2010-12-01",RuleSetName:E,RuleName:T})})}async receiptRuleSetExists(E){try{return await this.describeReceiptRuleSet(E),!0}catch(T){if(T.code==="RuleSetDoesNotExist"||T.statusCode===400)return!1;throw T}}async getActiveReceiptRuleSet(){let E=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeActiveReceiptRuleSet",Version:"2010-12-01"})}),T=E?.DescribeActiveReceiptRuleSetResponse?.DescribeActiveReceiptRuleSetResult||E?.DescribeActiveReceiptRuleSetResult;if(!T?.Metadata)return null;let _=T?.Rules?.member;return{Metadata:T?.Metadata,Rules:Array.isArray(_)?_:_?[_]:[]}}async updateReceiptRule(E){let T={Action:"UpdateReceiptRule",Version:"2010-12-01",RuleSetName:E.RuleSetName,"Rule.Name":E.Rule.Name};if(E.Rule.Enabled!==void 0)T["Rule.Enabled"]=E.Rule.Enabled?"true":"false";if(E.Rule.TlsPolicy)T["Rule.TlsPolicy"]=E.Rule.TlsPolicy;if(E.Rule.ScanEnabled!==void 0)T["Rule.ScanEnabled"]=E.Rule.ScanEnabled?"true":"false";if(E.Rule.Recipients)E.Rule.Recipients.forEach((_,r)=>{T[`Rule.Recipients.member.${r+1}`]=_});E.Rule.Actions.forEach((_,r)=>{let t=r+1;if(_.S3Action){if(T[`Rule.Actions.member.${t}.S3Action.BucketName`]=_.S3Action.BucketName,_.S3Action.ObjectKeyPrefix)T[`Rule.Actions.member.${t}.S3Action.ObjectKeyPrefix`]=_.S3Action.ObjectKeyPrefix;if(_.S3Action.KmsKeyArn)T[`Rule.Actions.member.${t}.S3Action.KmsKeyArn`]=_.S3Action.KmsKeyArn}if(_.LambdaAction)T[`Rule.Actions.member.${t}.LambdaAction.FunctionArn`]=_.LambdaAction.FunctionArn,T[`Rule.Actions.member.${t}.LambdaAction.InvocationType`]=_.LambdaAction.InvocationType||"Event";if(_.SNSAction){if(T[`Rule.Actions.member.${t}.SNSAction.TopicArn`]=_.SNSAction.TopicArn,_.SNSAction.Encoding)T[`Rule.Actions.member.${t}.SNSAction.Encoding`]=_.SNSAction.Encoding}if(_.StopAction){if(T[`Rule.Actions.member.${t}.StopAction.Scope`]=_.StopAction.Scope,_.StopAction.TopicArn)T[`Rule.Actions.member.${t}.StopAction.TopicArn`]=_.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(T)})}async sendRawEmail(E){let T=Buffer.from(E.rawMessage).toString("base64"),_={Action:"SendRawEmail",Version:"2010-12-01",Source:E.source,"RawMessage.Data":T};E.destinations.forEach((d,R)=>{_[`Destinations.member.${R+1}`]=d});let r=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)});return{MessageId:(r?.SendRawEmailResponse?.SendRawEmailResult||r?.SendRawEmailResult)?.MessageId}}async getSuppressedDestination(E){try{return(await this.client.request({service:"ses",region:this.region,method:"GET",path:`/v2/email/suppression/addresses/${encodeURIComponent(E)}`}))?.SuppressedDestination||null}catch(T){if(T.message?.includes("404")||T.message?.includes("NotFoundException"))return null;throw T}}async deleteSuppressedDestination(E){await this.client.request({service:"ses",region:this.region,method:"DELETE",path:`/v2/email/suppression/addresses/${encodeURIComponent(E)}`})}}var xA=wE(()=>{ME()});var bA={};MT(bA,{email:()=>Y9,EmailClient:()=>uO});class uO{ses;s3;iam;route53;region;domain;defaultFrom;constructor(E={}){this.region=E.region||"us-east-1",this.domain=E.domain,this.defaultFrom=E.defaultFrom,this.ses=new s_(this.region),this.s3=new qE(this.region),this.iam=new U_(this.region),this.route53=new D_(this.region)}async send(E){let T=E.from||this.defaultFrom;if(!T)throw Error("From address is required. Set defaultFrom in constructor or provide from in options.");let _=E.fromName?`${E.fromName} <${T}>`:T,r=Array.isArray(E.to)?E.to:[E.to];if(!E.attachments||E.attachments.length===0)return{messageId:(await this.ses.sendSimpleEmail({from:_,to:r,subject:E.subject,text:E.text,html:E.html,replyTo:E.replyTo})).MessageId||""};let t=this.buildRawEmail(E,_,r);return{messageId:(await this.ses.sendEmail({FromEmailAddress:_,Destination:{ToAddresses:r,CcAddresses:E.cc?Array.isArray(E.cc)?E.cc:[E.cc]:void 0,BccAddresses:E.bcc?Array.isArray(E.bcc)?E.bcc:[E.bcc]:void 0},Content:{Raw:{Data:Buffer.from(t).toString("base64")}}})).MessageId||""}}async sendTemplate(E){let T=E.from||this.defaultFrom;if(!T)throw Error("From address is required");let _=E.fromName?`${E.fromName} <${T}>`:T;return{messageId:(await this.ses.sendTemplatedEmail({from:_,to:E.to,templateName:E.templateName,templateData:E.templateData,replyTo:E.replyTo})).MessageId||""}}async sendBulk(E){let T=E.from||this.defaultFrom;if(!T)throw Error("From address is required");let _=E.recipients.map((t)=>({Destination:{ToAddresses:Array.isArray(t.to)?t.to:[t.to]},ReplacementEmailContent:t.templateData?{ReplacementTemplate:{ReplacementTemplateData:JSON.stringify(t.templateData)}}:void 0}));return{results:(await this.ses.sendBulkEmail({FromEmailAddress:T,BulkEmailEntries:_,DefaultContent:{Template:{TemplateName:E.templateName,TemplateData:JSON.stringify(E.defaultTemplateData)}}})).BulkEmailEntryResults?.map((t)=>({status:t.Status||"UNKNOWN",messageId:t.MessageId,error:t.Error}))||[]}}async setupDomain(E){let T;try{T=await this.ses.getEmailIdentity(E)}catch{let r=await this.ses.createEmailIdentity({EmailIdentity:E});T={VerificationStatus:r.DkimAttributes?.Status,DkimAttributes:r.DkimAttributes,SendingEnabled:r.VerifiedForSendingStatus}}try{await this.ses.putEmailIdentityDkimAttributes({EmailIdentity:E,SigningEnabled:!0})}catch{}try{await this.ses.putEmailIdentityMailFromAttributes(E,{MailFromDomain:`mail.${E}`,BehaviorOnMxFailure:"USE_DEFAULT_VALUE"})}catch{}let _=await this.ses.getDkimRecords(E);return{domainVerified:T.SendingEnabled===!0,dkimStatus:T.DkimAttributes?.Status||"UNKNOWN",dkimTokens:T.DkimAttributes?.Tokens,mailFromStatus:T.MailFromAttributes?.MailFromDomainStatus}}async getDnsRecords(E){let T=[],_=await this.ses.getDkimRecords(E);for(let r of _)T.push({type:r.type,name:r.name,value:r.value,ttl:1800});return T.push({type:"MX",name:E,value:`inbound-smtp.${this.region}.amazonaws.com`,priority:10,ttl:3600}),T.push({type:"MX",name:`mail.${E}`,value:`feedback-smtp.${this.region}.amazonses.com`,priority:10,ttl:3600}),T.push({type:"TXT",name:`mail.${E}`,value:"v=spf1 include:amazonses.com ~all",ttl:3600}),T.push({type:"TXT",name:`_dmarc.${E}`,value:`v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${E}`,ttl:3600}),T}async isDomainReady(E){try{let T=await this.ses.getEmailIdentity(E);return T.SendingEnabled===!0&&T.DkimAttributes?.Status==="SUCCESS"}catch{return!1}}async setupReceiving(E){let T={Version:"2012-10-17",Statement:[{Sid:"AllowSESPuts",Effect:"Allow",Principal:{Service:"ses.amazonaws.com"},Action:"s3:PutObject",Resource:`arn:aws:s3:::${E.bucketName}/*`,Condition:{StringEquals:{"AWS:SourceAccount":E.accountId}}}]};await this.s3.putBucketPolicy(E.bucketName,T);try{await this.ses.createReceiptRuleSet(E.ruleSetName)}catch(r){if(!r.message?.includes("already exists")&&r.code!=="AlreadyExists")throw r}let _=[{S3Action:{BucketName:E.bucketName,ObjectKeyPrefix:E.prefix||"inbox/"}}];if(E.lambdaArn)_.push({LambdaAction:{FunctionArn:E.lambdaArn,InvocationType:"Event"}});try{await this.ses.createReceiptRule({RuleSetName:E.ruleSetName,Rule:{Name:E.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:E.recipients||[E.domain],ScanEnabled:E.scanEnabled!==!1,Actions:_}})}catch(r){if(r.message?.includes("already exists"))await this.ses.deleteReceiptRule(E.ruleSetName,E.ruleName),await this.ses.createReceiptRule({RuleSetName:E.ruleSetName,Rule:{Name:E.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:E.recipients||[E.domain],ScanEnabled:E.scanEnabled!==!1,Actions:_}});else throw r}await this.ses.setActiveReceiptRuleSet(E.ruleSetName)}async getIncomingEmails(E){return(await this.s3.list({bucket:E.bucket,prefix:E.prefix||"incoming/",maxKeys:E.maxResults||100})).map((_)=>({key:_.Key||"",lastModified:_.LastModified||"",size:_.Size||0}))}async readEmail(E){return await this.s3.getObject(E.bucket,E.key)}async createSmtpCredentials(E){let T=`ses-smtp-${E.username.replace(/[^a-zA-Z0-9]/g,"-")}`,{AWSClient:_}=await Promise.resolve().then(() => (ME(),UR)),r=new _,t=(A,L)=>{let O={Action:A,Version:"2010-05-08",...L};return Object.entries(O).map(([c,U])=>`${encodeURIComponent(c)}=${encodeURIComponent(U)}`).join("&")};try{await r.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t("CreateUser",{UserName:T})})}catch(A){if(!A.message?.includes("EntityAlreadyExists"))throw A}let d={Version:"2012-10-17",Statement:[{Effect:"Allow",Action:"ses:SendRawEmail",Resource:"*",Condition:{StringLike:{"ses:FromAddress":`*@${E.domain}`}}}]},R=`ses-smtp-policy-${E.domain.replace(/\./g,"-")}`;try{await r.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t("PutUserPolicy",{UserName:T,PolicyName:R,PolicyDocument:JSON.stringify(d)})})}catch{}let S=(await r.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t("CreateAccessKey",{UserName:T})}))?.CreateAccessKeyResult?.AccessKey;if(!S?.AccessKeyId||!S?.SecretAccessKey)throw Error("Failed to create access key");let N=this.deriveSmtpPassword(S.SecretAccessKey);return{username:S.AccessKeyId,password:N,server:`email-smtp.${this.region}.amazonaws.com`,port:587}}deriveSmtpPassword(E){let T=kE("node:crypto"),_="SendRawEmail",r=Buffer.from([4]),t=T.createHmac("sha256",`AWS4${E}`).update("11111111").digest();return t=T.createHmac("sha256",t).update(this.region).digest(),t=T.createHmac("sha256",t).update("ses").digest(),t=T.createHmac("sha256",t).update("aws4_request").digest(),t=T.createHmac("sha256",t).update("SendRawEmail").digest(),Buffer.concat([r,t]).toString("base64")}async createTemplate(E){await this.ses.createEmailTemplate({TemplateName:E.name,TemplateContent:{Subject:E.subject,Text:E.text,Html:E.html}})}async getTemplate(E){try{let T=await this.ses.getEmailTemplate(E);return{name:T.TemplateName||E,subject:T.TemplateContent?.Subject,text:T.TemplateContent?.Text,html:T.TemplateContent?.Html}}catch{return null}}async deleteTemplate(E){await this.ses.deleteEmailTemplate(E)}async listTemplates(){return(await this.ses.listEmailTemplates()).TemplatesMetadata?.map((T)=>({name:T.TemplateName||"",createdAt:T.CreatedTimestamp}))||[]}async deploy(E){let T=`${E.appName}-${E.environment}-email-rules`,_=`${E.appName}-inbound-email`,r=E.storage?.bucketName||`${E.appName}-${E.environment}-email`,t=await this.setupDomain(E.domain);if(!(await this.s3.listBuckets()).Buckets?.some((S)=>S.Name===r))await this.s3.createBucket(r);await this.setupReceiving({domain:E.domain,ruleSetName:T,ruleName:_,bucketName:r,prefix:E.storage?.prefix||"inbox/",accountId:E.accountId,recipients:E.catchAll?[E.domain]:E.mailboxes,scanEnabled:!0});let h=await this.getDnsRecords(E.domain);return{success:!0,domainVerified:t.domainVerified,dkimStatus:t.dkimStatus,receiptRuleSet:T,storageBucket:r,dnsRecords:h}}async undeploy(E){let T=`${E.appName}-${E.environment}-email-rules`,_=`${E.appName}-inbound-email`,r=`${E.appName}-${E.environment}-email`;try{await this.ses.deleteReceiptRule(T,_)}catch{}try{await this.ses.deleteReceiptRuleSet(T)}catch{}if(E.deleteBucket)try{await this.s3.emptyAndDeleteBucket(r)}catch{}}async getSendingStats(){let E=await this.ses.getSendQuota();return{sentLast24Hours:E.SentLast24Hours||0,maxSendRate:E.MaxSendRate||0,max24HourSend:E.Max24HourSend||0}}buildRawEmail(E,T,_){let r=`----=_Part_${Date.now()}_${Math.random().toString(36).substring(2)}`,t="";if(t+=`From: ${T}\r
 `,t+=`To: ${_.join(", ")}\r
 `,E.cc){let d=Array.isArray(E.cc)?E.cc:[E.cc];t+=`Cc: ${d.join(", ")}\r
 `}if(t+=`Subject: ${E.subject}\r
@@ -178,24 +178,24 @@ host:${R}
 `,t+=`\r
 `,t+=`${d.content}\r
 `;return t+=`--${r}--\r
-`,t}}var Y8;var VS=wE(()=>{QS();$h();XT();xA();Y8=new uO});var cL={};MT(cL,{xrayManager:()=>_K,withTimeout:()=>$V,withSecurity:()=>H4,withQueue:()=>Q4,withMonitoring:()=>W4,withDatabase:()=>Y4,withCache:()=>f4,withCDN:()=>G4,validateTemplateSize:()=>o8,validateTemplate:()=>k8,validateResourceLimits:()=>EM,validateCredentials:()=>a4,validateConfiguration:()=>l4,validateCommand:()=>r7,validateAgainstSchema:()=>BV,validateAccountStructure:()=>W7,templateCache:()=>rV,syntheticsManager:()=>dK,suggestRegions:()=>$7,suggestRegionPairs:()=>I7,suggestQuotaIncrease:()=>EV,suggestIAMPolicy:()=>s4,suggestFlags:()=>E7,suggestCommand:()=>N1,storageAdvancedManager:()=>fZ,staticSiteManager:()=>YZ,statePath:()=>Zt,stateDir:()=>hL,stackDependencyManager:()=>A7,signRequestAsync:()=>rc,signRequest:()=>W_,sharedRuntimeLoop:()=>CI,sha256:()=>ec,setStateDir:()=>Q$,serviceMeshManager:()=>$K,sequence:()=>DV,senderReputationManager:()=>WK,securityScanningManager:()=>cK,securityHubManager:()=>s7,secretsRotationManager:()=>AK,secretsManager:()=>LK,searchCommands:()=>pV,sanitizeName:()=>rM,runPhpBuildHooks:()=>Ic,runBuildHooks:()=>Vy,route53RoutingManager:()=>FK,route53ResolverManager:()=>yK,responseToResult:()=>iy,resourceManagementManager:()=>MZ,resolveStorageBucketName:()=>tM,resolveStatePath:()=>fT,resolveSiteStackName:()=>K$,resolveSiteResourceName:()=>Z$,resolveSiteBucketName:()=>g$,resolveServerlessRuntime:()=>Uc,resolveServerlessAssetBucketName:()=>hc,resolveServerlessArtifactBucketName:()=>q$,resolveServerlessAppStackName:()=>ed,resolveRegion:()=>dy,resolveQueues:()=>yh,resolveQueueNames:()=>DI,resolveProjectStackName:()=>DT,resolveManagementDashboardSites:()=>AL,resolveManagementDashboardSite:()=>y4,resolveDeploymentMode:()=>K_,resolveDeployBucketName:()=>Vj,resolveDashboardDomains:()=>mj,resolveDashboardDomain:()=>aj,resolveCredentials:()=>Lc,resolveCloudProvider:()=>H_,resolveAppDatabase:()=>uT,resolveApp:()=>dZ,requiresReplacement:()=>XV,replicaManager:()=>hK,regionPairManager:()=>N7,quickHash:()=>LV,queueManagementManager:()=>MK,progressiveDeploymentManager:()=>TK,processInChunks:()=>IV,previewNotifications:()=>KV,previewManager:()=>GV,phpRuntimeLayerAssets:()=>dL,phpLayerPackages:()=>gy,phpLayerBuildStage:()=>II,performanceManager:()=>SK,parseXMLResponse:()=>pA,parseJSONResponse:()=>yj,parallelWithRetry:()=>UV,parallelMap:()=>eV,parallel:()=>Oc,packageServerlessApp:()=>OL,packagePhpApp:()=>zI,organizationManager:()=>F7,networkSecurityManager:()=>QZ,multiRegionManager:()=>R7,multiAccountManager:()=>z7,migrationManager:()=>RK,metricsManager:()=>rK,mergeInfrastructure:()=>jh,managementDashboardSiteName:()=>P$,makeAWSRequestOnce:()=>Fj,makeAWSRequestAsync:()=>jj,makeAWSRequest:()=>Xh,logsManager:()=>tK,laravelServerlessEnvDefaults:()=>XI,lambdaVersionsManager:()=>wK,lambdaVPCManager:()=>JK,lambdaLayersManager:()=>IK,lambdaDestinationsManager:()=>XK,lambdaDLQManager:()=>zK,lambdaConcurrencyManager:()=>CK,isWebCryptoAvailable:()=>Hj,isValidRegion:()=>U7,isStatePath:()=>M$,isNodeCryptoAvailable:()=>Wj,isManagementDashboardSiteName:()=>Ac,isLocalDevelopment:()=>PV,isLikelyTypo:()=>mV,imageScanningManager:()=>eK,healthCheckManager:()=>GZ,hashString:()=>_1,hashManifest:()=>AV,hashFile:()=>T1,hashDirectory:()=>NV,hashBuffer:()=>SV,hasManagementDashboardSite:()=>Fh,guardDutyManager:()=>m7,globalResourceManager:()=>S7,getTimestamp:()=>_M,getSigningKeyCacheSize:()=>Pj,getRequiredPermissions:()=>cy,getRegionsByPricingTier:()=>e7,getRegionsByLocation:()=>O7,getRegionsByCompliance:()=>c7,getRegionStats:()=>J7,getRegion:()=>gS,getRecommendedStructure:()=>B7,getQuotaUsageSummary:()=>o4,getLocalEnvVars:()=>YV,getLocalEndpoint:()=>WV,getLocalCredentials:()=>HV,getLocalConfig:()=>cc,getErrorDetails:()=>Oy,getDiffSummary:()=>CV,getDiffStats:()=>jV,getDeploymentStrategy:()=>FV,getCredentials:()=>LL,getContextualHelp:()=>sV,getCommandUsage:()=>_7,getClosestRegion:()=>D7,getAllRegions:()=>L7,getAccountId:()=>Ry,generateScheduledWorkflow:()=>Q7,generateScheduledPipeline:()=>g7,generateScheduledConfig:()=>k7,generateResourceName:()=>RE,generatePreviewWorkflow:()=>QV,generatePreviewPipeline:()=>Z7,generatePhpLayerDockerfile:()=>qy,generatePhpFpmConfig:()=>py,generateParallelConfig:()=>n7,generatePRPreviewWorkflow:()=>G7,generateMultiEnvWorkflow:()=>f7,generateMultiEnvPipeline:()=>K7,generateMultiEnvConfig:()=>b7,generateMatrixWorkflow:()=>M7,generateManualPipeline:()=>q7,generateLogicalId:()=>i,generateDeploymentWorkflow:()=>Y7,generateDeploymentPipeline:()=>V7,generateDeploymentConfig:()=>x7,generateCrossAccountRoleCF:()=>P7,generateCostReportWorkflow:()=>VV,generateCleanupWorkflow:()=>MV,generateBootstrap:()=>My,generateApprovalConfig:()=>u7,generateAppImageDockerfile:()=>wI,fromWebIdentity:()=>ty,fromSharedCredentials:()=>Ty,fromEnvironment:()=>Ey,fromECSMetadata:()=>ry,fromEC2Metadata:()=>_y,formatTree:()=>xV,formatTable:()=>ZV,formatSuggestion:()=>aV,formatRegionList:()=>X7,formatRegion:()=>Py,formatProgressBar:()=>bV,formatList:()=>nV,formatKeyValue:()=>vV,formatHistoryStats:()=>d7,formatHistory:()=>t7,formatFlagSuggestions:()=>T7,formatDuration:()=>uV,formatDiff:()=>SM,formatBytes:()=>kV,formatAccountStructure:()=>H7,findChangedFiles:()=>OV,fifoQueueManager:()=>fK,extendPreset:()=>W$,eventToRequest:()=>ly,emailTemplateManager:()=>HK,emailAnalyticsManager:()=>PK,drManager:()=>l7,dnssecManager:()=>jK,dlqMonitoringManager:()=>GK,diffTemplates:()=>wV,detectServiceRegion:()=>_c,detectMisconfigurations:()=>i4,detectDeploymentTargets:()=>V$,deriveManagementDashboardPort:()=>vj,deploymentCoexistenceError:()=>bS,defaultLocalConfig:()=>r1,databaseUserManager:()=>NK,crossRegionReferenceManager:()=>h7,createZip:()=>kS,createWordPressPreset:()=>e4,createTraditionalWebAppPreset:()=>C4,createStaticSitePreset:()=>S4,createServerlessNodePreset:()=>L4,createServerlessLaravelPreset:()=>J4,createS3Client:()=>v4,createRealtimeAppPreset:()=>$4,createQueueHandler:()=>my,createPresignedUrlAsync:()=>$j,createPresignedUrl:()=>f$,createPreset:()=>P4,createNodeJsServerlessPreset:()=>A4,createNodeJsServerPreset:()=>N4,createMockAWS:()=>fV,createMicroservicesPreset:()=>D4,createMLApiPreset:()=>w4,createLaravelPreset:()=>X4,createJamstackPreset:()=>U4,createHttpHandler:()=>ay,createHandlers:()=>AZ,createFullStackAppPreset:()=>O4,createExistingStaticFullStackPreset:()=>v$,createError:()=>Y$,createDataPipelinePreset:()=>I4,createDashboardSite:()=>z4,createCredentialProvider:()=>V4,createCliHandler:()=>sy,createApiBackendPreset:()=>c4,containerRegistryManager:()=>DK,composeServerlessAppTemplate:()=>$I,composePresets:()=>B4,collectPhpAppEntries:()=>wc,cloudTrailManager:()=>a7,cloudConfigSchema:()=>yV,clearSigningKeyCache:()=>Bj,chunk:()=>Iy,checkServiceQuotas:()=>p4,checkIAMPermissions:()=>m4,certificateManager:()=>OK,categorizeChanges:()=>zV,canaryManager:()=>o7,buildPhpRuntimeLayerZip:()=>FZ,buildOptimizationManager:()=>UK,buildNodeRuntimeLayerZip:()=>_Z,buildCloudFormationTemplate:()=>n$,buildBunRuntimeLayerZip:()=>rZ,bounceComplaintHandler:()=>BK,blueGreenManager:()=>p7,batchProcessingManager:()=>QK,batch:()=>cV,backupManager:()=>v7,awsConfigManager:()=>i7,autocomplete:()=>oV,artifactKey:()=>UI,analyzeStackDiff:()=>dM,abTestManager:()=>EK,XRayManager:()=>j1,Workflow:()=>xj,ValidationError:()=>s$,TemplateCache:()=>o$,TemplateBuilder:()=>Rc,TaskList:()=>zy,SyntheticsManager:()=>Ch,StorageAdvancedManager:()=>jI,Storage:()=>Lt,StaticSiteManager:()=>FI,StacksIntegration:()=>cM,StackDependencyManager:()=>e1,Spinner:()=>Jy,SmsHandlers:()=>qj,SmsAdvanced:()=>Qy,Sftp:()=>Sc,ServiceMeshManager:()=>g1,SenderReputationManager:()=>s1,SecurityScanningManager:()=>M1,SecurityHubManager:()=>wh,Security:()=>xT,SecretsRotationManager:()=>f1,SecretsManager:()=>G1,Secrets:()=>ZS,Search:()=>JR,STATE_DIR_ENV_VAR:()=>Gj,SMS:()=>Er,S3Error:()=>tr,S3Client:()=>m$,Route53RoutingManager:()=>v1,Route53ResolverManager:()=>i1,ResourceManagementManager:()=>PI,ReplicaManager:()=>W1,Registry:()=>Mt,RegionPairManager:()=>c1,Redirects:()=>cd,RealtimePresets:()=>x8,RateLimiter:()=>$y,REPLContext:()=>jy,REPLCommandBuilder:()=>yy,REPL:()=>Fy,RECOMMENDED_SCPS:()=>j7,RECOMMENDED_ACCOUNT_STRUCTURES:()=>Wy,QueuePresets:()=>q8,QueueManagementManager:()=>eI,Queue:()=>dr,Pseudo:()=>TM,ProgressiveDeploymentManager:()=>F1,ProgressBar:()=>Cy,PreviewNotificationService:()=>S1,PreviewEnvironmentManager:()=>h1,PhoneHandlers:()=>gj,PhoneAdvanced:()=>Gy,Phone:()=>Vt,Permissions:()=>zr,PerformanceManager:()=>H1,ParameterStore:()=>mT,PHP_LAYER_EXTENSIONS:()=>Zy,PHP_DEFAULT_EXCLUDES:()=>dB,OrganizationManager:()=>D1,NetworkSecurityManager:()=>BI,Network:()=>YT,MultiStepProgress:()=>Xy,MultiRegionManager:()=>A1,MultiAccountManager:()=>U1,Monitoring:()=>NL,MockS3:()=>d1,MockDynamoDB:()=>R1,MockCloudFormation:()=>t1,MigrationManager:()=>P1,MetricsManager:()=>y1,Messaging:()=>Jr,MANAGEMENT_DASHBOARD_SITE_PREFIX:()=>l$,MANAGED_NODE_VERSIONS:()=>Ky,LogsManager:()=>B1,LambdaVersionsManager:()=>x1,LambdaVPCManager:()=>u1,LambdaLayersManager:()=>q1,LambdaDestinationsManager:()=>k1,LambdaDLQManager:()=>n1,LambdaConcurrencyManager:()=>b1,LARAVEL_SERVERLESS_BUILD_STEPS:()=>EB,JobLoader:()=>Od,ImageScanningManager:()=>V1,HealthCheckManager:()=>yI,HashCache:()=>Uy,GuardDutyManager:()=>X1,GlobalResourceManager:()=>O1,Fn:()=>B,FileSystem:()=>Kt,FileCache:()=>p$,FIFOQueueManager:()=>LI,ErrorCodes:()=>Ly,EmailTemplateManager:()=>p1,EmailHandlers:()=>Yy,EmailAnalyticsManager:()=>m1,EmailAdvanced:()=>Hy,Email:()=>UT,DisasterRecoveryManager:()=>I1,DeploymentError:()=>Ny,Deployment:()=>_r,DependencyGraph:()=>Kj,DebugLogger:()=>Fr,DatabaseUserManager:()=>Y1,Database:()=>FR,DNSSECManager:()=>l1,DNS:()=>o_,DLQMonitoringManager:()=>OI,DEFAULT_STATE_DIR:()=>G$,DEFAULT_SERVICE_LIMITS:()=>p_,DASHBOARD_STATE_DIR:()=>bj,DASHBOARD_PORT_SPAN:()=>nj,DASHBOARD_PORT_BASE:()=>uj,DASHBOARD_ENTRY:()=>kj,CrossRegionReferenceManager:()=>L1,CredentialError:()=>CR,ContainerRegistryManager:()=>Z1,ConfigurationError:()=>EL,Compute:()=>gE,Communication:()=>rr,CommandHistory:()=>By,CloudTrailManager:()=>C1,CloudFrontClient:()=>Sy,CloudFormationClient:()=>hy,CloudFormationBuilder:()=>u$,CloudError:()=>gt,CertificateManager:()=>Q1,CanaryManager:()=>tL,Cache:()=>SL,COMMON_CROSS_ACCOUNT_ROLES:()=>y7,CDN:()=>At,BuildOptimizationManager:()=>K1,BounceComplaintHandler:()=>a1,BlueGreenManager:()=>J1,BatchProcessingManager:()=>cI,BackupManager:()=>$1,Auth:()=>Tr,AssetHasher:()=>$_,Arn:()=>_L,ApiGateway:()=>Nc,AWS_REGIONS:()=>ct,AWS_PSEUDO_PARAMETERS:()=>zM,AWSConfigManager:()=>w1,AWSAPIError:()=>Ay,AI:()=>Ot,ABTestManager:()=>z1});import{createRequire as f8}from"node:module";import{isAbsolute as y$,join as oO,relative as b8}from"node:path";import{existsSync as vA,readdirSync as NM}from"node:fs";import{join as wR}from"node:path";import{createHash as IM}from"node:crypto";import{copyFileSync as wM,existsSync as C$,readdirSync as CM,readFileSync as nO,statSync as XM,writeFileSync as vO}from"node:fs";import{basename as JM,dirname as Sj,extname as Nj,join as lA}from"node:path";import{existsSync as sj,readFileSync as a$}from"node:fs";import{homedir as pj}from"node:os";import{join as oj}from"node:path";import{createHash as ey}from"node:crypto";import{existsSync as iO,mkdirSync as TV,readdirSync as cj,readFileSync as ej,unlinkSync as iA,writeFileSync as _V}from"node:fs";import{join as J$}from"node:path";import{createHash as E1}from"node:crypto";import{createReadStream as tV,readdirSync as dV,statSync as Ec}from"node:fs";import{join as RV,relative as hV}from"node:path";import{deflateRawSync as VK}from"node:zlib";import{execSync as xK}from"node:child_process";import{createHash as bK}from"node:crypto";import{cpSync as kK,mkdtempSync as uK,rmSync as nK,writeFileSync as vK}from"node:fs";import{tmpdir as lK}from"node:os";import{dirname as iK,isAbsolute as aK,join as mA,resolve as mK}from"node:path";import{fileURLToPath as sK}from"node:url";import{execFileSync as Dc}from"node:child_process";import{mkdtempSync as xy,readFileSync as $c,rmSync as by}from"node:fs";import{tmpdir as ky}from"node:os";import{dirname as EZ,join as zR}from"node:path";import{fileURLToPath as TZ}from"node:url";import{readFileSync as LZ}from"node:fs";import{dirname as OZ,join as oy}from"node:path";import{fileURLToPath as cZ}from"node:url";import{execFileSync as aO}from"node:child_process";import{existsSync as UZ,mkdirSync as DZ,mkdtempSync as $Z,readdirSync as IZ,readFileSync as wZ,rmSync as CZ,statSync as TB,writeFileSync as XZ}from"node:fs";import{tmpdir as JZ}from"node:os";import{join as KS,relative as zZ}from"node:path";import{execSync as jZ}from"node:child_process";import{createHash as yZ}from"node:crypto";import{readdirSync as BZ,readFileSync as PZ,statSync as rB}from"node:fs";import{join as WZ,relative as tB,resolve as JI}from"node:path";function M8(E,T){this[E]=Q8.bind(null,T)}function _c(E){let T=typeof E==="string"?new URL(E):E,{hostname:_,pathname:r}=T;if(_.endsWith(".on.aws")){let h=_.match(/^[^.]+\.lambda-url\.([^.]+)\.on\.aws$/);if(h)return{service:"lambda",region:h[1]};return{service:"",region:""}}if(_.endsWith(".r2.cloudflarestorage.com"))return{service:"s3",region:"auto"};if(_.endsWith(".backblazeb2.com")){let h=_.match(/^(?:[^.]+\.)?s3\.([^.]+)\.backblazeb2\.com$/);if(h)return{service:"s3",region:h[1]};return{service:"",region:""}}let t=_.replace("dualstack.","").match(/([^.]+)\.(?:([^.]+)\.)?amazonaws\.com(?:\.cn)?$/);if(!t)return{service:"",region:""};let d=t[1],R=t[2]||"";if(R==="us-gov")R="us-gov-west-1";else if(R==="s3"||R==="s3-accelerate")R="us-east-1",d="s3";else if(d==="iot")if(_.startsWith("iot."))d="execute-api";else if(_.startsWith("data.jobs.iot."))d="iot-jobs-data";else d=r==="/mqtt"?"iotdevicegateway":"iotdata";else if(d==="autoscaling");else if(!R&&d.startsWith("s3-"))R=d.slice(3).replace(/^fips-|^external-1/,""),d="s3";else if(d.endsWith("-fips"))d=d.slice(0,-5);else if(R&&/-\d$/.test(d)&&!/-\d$/.test(R))[d,R]=[R,d];return d=fj[d]||d,{service:d,region:R||"us-east-1"}}function W_(E){let{method:T,url:_,body:r="",accessKeyId:t,secretAccessKey:d,sessionToken:R,signQuery:h=!1,expiresIn:S=86400,datetime:N}=E,A=new URL(_),L=A.hostname,O=_c(A),c=E.service||O.service,U=E.region||O.region;if(!c)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!U)throw Error("Could not detect region from URL. Please provide region explicitly.");let $=N||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),I=$.substring(0,8),w=[I,U,c,"aws4_request"].join("/"),z="AWS4-HMAC-SHA256";if(h)return Z8({urlObj:A,method:T,body:r,accessKeyId:t,secretAccessKey:d,sessionToken:R,service:c,region:U,timestamp:$,date:I,credentialScope:w,algorithm:z,expiresIn:S,cache:E.cache});let F=A.pathname||"/",j=tc(A.searchParams),Y={host:L,"x-amz-date":$,...E.headers};if(R)Y["x-amz-security-token"]=R;let H=Object.keys(Y).some((W)=>W.toLowerCase()==="content-type");if(r&&!H)Y["content-type"]="application/x-amz-json-1.0";if(c==="s3"&&!Y["x-amz-content-sha256"])Y["x-amz-content-sha256"]=sA(r);let Q=Ij(Y),K=wj(Y),x=Y["x-amz-content-sha256"]||sA(r),k=[T,dc(F),j,Q,K,x].join(`
+`,t}}var Y9;var VS=wE(()=>{QS();$h();XT();xA();Y9=new uO});var cL={};MT(cL,{xrayManager:()=>_K,withTimeout:()=>$V,withSecurity:()=>H4,withQueue:()=>Q4,withMonitoring:()=>W4,withDatabase:()=>Y4,withCache:()=>f4,withCDN:()=>G4,validateTemplateSize:()=>o9,validateTemplate:()=>k9,validateResourceLimits:()=>EM,validateCredentials:()=>a4,validateConfiguration:()=>l4,validateCommand:()=>r7,validateAgainstSchema:()=>BV,validateAccountStructure:()=>W7,templateCache:()=>rV,syntheticsManager:()=>dK,suggestRegions:()=>$7,suggestRegionPairs:()=>I7,suggestQuotaIncrease:()=>EV,suggestIAMPolicy:()=>s4,suggestFlags:()=>E7,suggestCommand:()=>N1,storageAdvancedManager:()=>fZ,staticSiteManager:()=>YZ,statePath:()=>Zt,stateDir:()=>hL,stackDependencyManager:()=>A7,signRequestAsync:()=>rc,signRequest:()=>W_,sharedRuntimeLoop:()=>CI,sha256:()=>ec,setStateDir:()=>Q$,serviceMeshManager:()=>$K,sequence:()=>DV,senderReputationManager:()=>WK,securityScanningManager:()=>cK,securityHubManager:()=>s7,secretsRotationManager:()=>AK,secretsManager:()=>LK,searchCommands:()=>pV,sanitizeName:()=>rM,runPhpBuildHooks:()=>Ic,runBuildHooks:()=>Vy,route53RoutingManager:()=>FK,route53ResolverManager:()=>yK,responseToResult:()=>iy,resourceManagementManager:()=>MZ,resolveStorageBucketName:()=>tM,resolveStatePath:()=>fT,resolveSiteStackName:()=>K$,resolveSiteResourceName:()=>Z$,resolveSiteBucketName:()=>g$,resolveServerlessRuntime:()=>Uc,resolveServerlessAssetBucketName:()=>hc,resolveServerlessArtifactBucketName:()=>q$,resolveServerlessAppStackName:()=>ed,resolveRegion:()=>dy,resolveQueues:()=>yh,resolveQueueNames:()=>DI,resolveProjectStackName:()=>DT,resolveManagementDashboardSites:()=>AL,resolveManagementDashboardSite:()=>y4,resolveDeploymentMode:()=>K_,resolveDeployBucketName:()=>Vj,resolveDashboardDomains:()=>mj,resolveDashboardDomain:()=>aj,resolveCredentials:()=>Lc,resolveCloudProvider:()=>H_,resolveAppDatabase:()=>uT,resolveApp:()=>dZ,requiresReplacement:()=>XV,replicaManager:()=>hK,regionPairManager:()=>N7,quickHash:()=>LV,queueManagementManager:()=>MK,progressiveDeploymentManager:()=>TK,processInChunks:()=>IV,previewNotifications:()=>KV,previewManager:()=>GV,phpRuntimeLayerAssets:()=>dL,phpLayerPackages:()=>gy,phpLayerBuildStage:()=>II,performanceManager:()=>SK,parseXMLResponse:()=>pA,parseJSONResponse:()=>yj,parallelWithRetry:()=>UV,parallelMap:()=>eV,parallel:()=>Oc,packageServerlessApp:()=>OL,packagePhpApp:()=>zI,organizationManager:()=>F7,networkSecurityManager:()=>QZ,multiRegionManager:()=>R7,multiAccountManager:()=>z7,migrationManager:()=>RK,metricsManager:()=>rK,mergeInfrastructure:()=>jh,managementDashboardSiteName:()=>P$,makeAWSRequestOnce:()=>Fj,makeAWSRequestAsync:()=>jj,makeAWSRequest:()=>Xh,logsManager:()=>tK,laravelServerlessEnvDefaults:()=>XI,lambdaVersionsManager:()=>wK,lambdaVPCManager:()=>JK,lambdaLayersManager:()=>IK,lambdaDestinationsManager:()=>XK,lambdaDLQManager:()=>zK,lambdaConcurrencyManager:()=>CK,isWebCryptoAvailable:()=>Hj,isValidRegion:()=>U7,isStatePath:()=>M$,isNodeCryptoAvailable:()=>Wj,isManagementDashboardSiteName:()=>Ac,isLocalDevelopment:()=>PV,isLikelyTypo:()=>mV,imageScanningManager:()=>eK,healthCheckManager:()=>GZ,hashString:()=>_1,hashManifest:()=>AV,hashFile:()=>T1,hashDirectory:()=>NV,hashBuffer:()=>SV,hasManagementDashboardSite:()=>Fh,guardDutyManager:()=>m7,globalResourceManager:()=>S7,getTimestamp:()=>_M,getSigningKeyCacheSize:()=>Pj,getRequiredPermissions:()=>cy,getRegionsByPricingTier:()=>e7,getRegionsByLocation:()=>O7,getRegionsByCompliance:()=>c7,getRegionStats:()=>J7,getRegion:()=>gS,getRecommendedStructure:()=>B7,getQuotaUsageSummary:()=>o4,getLocalEnvVars:()=>YV,getLocalEndpoint:()=>WV,getLocalCredentials:()=>HV,getLocalConfig:()=>cc,getErrorDetails:()=>Oy,getDiffSummary:()=>CV,getDiffStats:()=>jV,getDeploymentStrategy:()=>FV,getCredentials:()=>LL,getContextualHelp:()=>sV,getCommandUsage:()=>_7,getClosestRegion:()=>D7,getAllRegions:()=>L7,getAccountId:()=>Ry,generateScheduledWorkflow:()=>Q7,generateScheduledPipeline:()=>g7,generateScheduledConfig:()=>k7,generateResourceName:()=>RE,generatePreviewWorkflow:()=>QV,generatePreviewPipeline:()=>Z7,generatePhpLayerDockerfile:()=>qy,generatePhpFpmConfig:()=>py,generateParallelConfig:()=>n7,generatePRPreviewWorkflow:()=>G7,generateMultiEnvWorkflow:()=>f7,generateMultiEnvPipeline:()=>K7,generateMultiEnvConfig:()=>b7,generateMatrixWorkflow:()=>M7,generateManualPipeline:()=>q7,generateLogicalId:()=>i,generateDeploymentWorkflow:()=>Y7,generateDeploymentPipeline:()=>V7,generateDeploymentConfig:()=>x7,generateCrossAccountRoleCF:()=>P7,generateCostReportWorkflow:()=>VV,generateCleanupWorkflow:()=>MV,generateBootstrap:()=>My,generateApprovalConfig:()=>u7,generateAppImageDockerfile:()=>wI,fromWebIdentity:()=>ty,fromSharedCredentials:()=>Ty,fromEnvironment:()=>Ey,fromECSMetadata:()=>ry,fromEC2Metadata:()=>_y,formatTree:()=>xV,formatTable:()=>ZV,formatSuggestion:()=>aV,formatRegionList:()=>X7,formatRegion:()=>Py,formatProgressBar:()=>bV,formatList:()=>nV,formatKeyValue:()=>vV,formatHistoryStats:()=>d7,formatHistory:()=>t7,formatFlagSuggestions:()=>T7,formatDuration:()=>uV,formatDiff:()=>SM,formatBytes:()=>kV,formatAccountStructure:()=>H7,findChangedFiles:()=>OV,fifoQueueManager:()=>fK,extendPreset:()=>W$,eventToRequest:()=>ly,emailTemplateManager:()=>HK,emailAnalyticsManager:()=>PK,drManager:()=>l7,dnssecManager:()=>jK,dlqMonitoringManager:()=>GK,diffTemplates:()=>wV,detectServiceRegion:()=>_c,detectMisconfigurations:()=>i4,detectDeploymentTargets:()=>V$,deriveManagementDashboardPort:()=>vj,deploymentCoexistenceError:()=>bS,defaultLocalConfig:()=>r1,databaseUserManager:()=>NK,crossRegionReferenceManager:()=>h7,createZip:()=>kS,createWordPressPreset:()=>e4,createTraditionalWebAppPreset:()=>C4,createStaticSitePreset:()=>S4,createServerlessNodePreset:()=>L4,createServerlessLaravelPreset:()=>J4,createS3Client:()=>v4,createRealtimeAppPreset:()=>$4,createQueueHandler:()=>my,createPresignedUrlAsync:()=>$j,createPresignedUrl:()=>f$,createPreset:()=>P4,createNodeJsServerlessPreset:()=>A4,createNodeJsServerPreset:()=>N4,createMockAWS:()=>fV,createMicroservicesPreset:()=>D4,createMLApiPreset:()=>w4,createLaravelPreset:()=>X4,createJamstackPreset:()=>U4,createHttpHandler:()=>ay,createHandlers:()=>AZ,createFullStackAppPreset:()=>O4,createExistingStaticFullStackPreset:()=>v$,createError:()=>Y$,createDataPipelinePreset:()=>I4,createDashboardSite:()=>z4,createCredentialProvider:()=>V4,createCliHandler:()=>sy,createApiBackendPreset:()=>c4,containerRegistryManager:()=>DK,composeServerlessAppTemplate:()=>$I,composePresets:()=>B4,collectPhpAppEntries:()=>wc,cloudTrailManager:()=>a7,cloudConfigSchema:()=>yV,clearSigningKeyCache:()=>Bj,chunk:()=>Iy,checkServiceQuotas:()=>p4,checkIAMPermissions:()=>m4,certificateManager:()=>OK,categorizeChanges:()=>zV,canaryManager:()=>o7,buildPhpRuntimeLayerZip:()=>FZ,buildOptimizationManager:()=>UK,buildNodeRuntimeLayerZip:()=>_Z,buildCloudFormationTemplate:()=>n$,buildBunRuntimeLayerZip:()=>rZ,bounceComplaintHandler:()=>BK,blueGreenManager:()=>p7,batchProcessingManager:()=>QK,batch:()=>cV,backupManager:()=>v7,awsConfigManager:()=>i7,autocomplete:()=>oV,artifactKey:()=>UI,analyzeStackDiff:()=>dM,abTestManager:()=>EK,XRayManager:()=>j1,Workflow:()=>xj,ValidationError:()=>s$,TemplateCache:()=>o$,TemplateBuilder:()=>Rc,TaskList:()=>zy,SyntheticsManager:()=>Ch,StorageAdvancedManager:()=>jI,Storage:()=>Lt,StaticSiteManager:()=>FI,StacksIntegration:()=>cM,StackDependencyManager:()=>e1,Spinner:()=>Jy,SmsHandlers:()=>qj,SmsAdvanced:()=>Qy,Sftp:()=>Sc,ServiceMeshManager:()=>g1,SenderReputationManager:()=>s1,SecurityScanningManager:()=>M1,SecurityHubManager:()=>wh,Security:()=>xT,SecretsRotationManager:()=>f1,SecretsManager:()=>G1,Secrets:()=>ZS,Search:()=>JR,STATE_DIR_ENV_VAR:()=>Gj,SMS:()=>Er,S3Error:()=>tr,S3Client:()=>m$,Route53RoutingManager:()=>v1,Route53ResolverManager:()=>i1,ResourceManagementManager:()=>PI,ReplicaManager:()=>W1,Registry:()=>Mt,RegionPairManager:()=>c1,Redirects:()=>cd,RealtimePresets:()=>x9,RateLimiter:()=>$y,REPLContext:()=>jy,REPLCommandBuilder:()=>yy,REPL:()=>Fy,RECOMMENDED_SCPS:()=>j7,RECOMMENDED_ACCOUNT_STRUCTURES:()=>Wy,QueuePresets:()=>q9,QueueManagementManager:()=>eI,Queue:()=>dr,Pseudo:()=>TM,ProgressiveDeploymentManager:()=>F1,ProgressBar:()=>Cy,PreviewNotificationService:()=>S1,PreviewEnvironmentManager:()=>h1,PhoneHandlers:()=>gj,PhoneAdvanced:()=>Gy,Phone:()=>Vt,Permissions:()=>zr,PerformanceManager:()=>H1,ParameterStore:()=>mT,PHP_LAYER_EXTENSIONS:()=>Zy,PHP_DEFAULT_EXCLUDES:()=>dB,OrganizationManager:()=>D1,NetworkSecurityManager:()=>BI,Network:()=>YT,MultiStepProgress:()=>Xy,MultiRegionManager:()=>A1,MultiAccountManager:()=>U1,Monitoring:()=>NL,MockS3:()=>d1,MockDynamoDB:()=>R1,MockCloudFormation:()=>t1,MigrationManager:()=>P1,MetricsManager:()=>y1,Messaging:()=>Jr,MANAGEMENT_DASHBOARD_SITE_PREFIX:()=>l$,MANAGED_NODE_VERSIONS:()=>Ky,LogsManager:()=>B1,LambdaVersionsManager:()=>x1,LambdaVPCManager:()=>u1,LambdaLayersManager:()=>q1,LambdaDestinationsManager:()=>k1,LambdaDLQManager:()=>n1,LambdaConcurrencyManager:()=>b1,LARAVEL_SERVERLESS_BUILD_STEPS:()=>EB,JobLoader:()=>Od,ImageScanningManager:()=>V1,HealthCheckManager:()=>yI,HashCache:()=>Uy,GuardDutyManager:()=>X1,GlobalResourceManager:()=>O1,Fn:()=>B,FileSystem:()=>Kt,FileCache:()=>p$,FIFOQueueManager:()=>LI,ErrorCodes:()=>Ly,EmailTemplateManager:()=>p1,EmailHandlers:()=>Yy,EmailAnalyticsManager:()=>m1,EmailAdvanced:()=>Hy,Email:()=>UT,DisasterRecoveryManager:()=>I1,DeploymentError:()=>Ny,Deployment:()=>_r,DependencyGraph:()=>Kj,DebugLogger:()=>Fr,DatabaseUserManager:()=>Y1,Database:()=>FR,DNSSECManager:()=>l1,DNS:()=>o_,DLQMonitoringManager:()=>OI,DEFAULT_STATE_DIR:()=>G$,DEFAULT_SERVICE_LIMITS:()=>p_,DASHBOARD_STATE_DIR:()=>bj,DASHBOARD_PORT_SPAN:()=>nj,DASHBOARD_PORT_BASE:()=>uj,DASHBOARD_ENTRY:()=>kj,CrossRegionReferenceManager:()=>L1,CredentialError:()=>CR,ContainerRegistryManager:()=>Z1,ConfigurationError:()=>EL,Compute:()=>gE,Communication:()=>rr,CommandHistory:()=>By,CloudTrailManager:()=>C1,CloudFrontClient:()=>Sy,CloudFormationClient:()=>hy,CloudFormationBuilder:()=>u$,CloudError:()=>gt,CertificateManager:()=>Q1,CanaryManager:()=>tL,Cache:()=>SL,COMMON_CROSS_ACCOUNT_ROLES:()=>y7,CDN:()=>At,BuildOptimizationManager:()=>K1,BounceComplaintHandler:()=>a1,BlueGreenManager:()=>J1,BatchProcessingManager:()=>cI,BackupManager:()=>$1,Auth:()=>Tr,AssetHasher:()=>$_,Arn:()=>_L,ApiGateway:()=>Nc,AWS_REGIONS:()=>ct,AWS_PSEUDO_PARAMETERS:()=>zM,AWSConfigManager:()=>w1,AWSAPIError:()=>Ay,AI:()=>Ot,ABTestManager:()=>z1});import{createRequire as f9}from"node:module";import{isAbsolute as y$,join as oO,relative as b9}from"node:path";import{existsSync as vA,readdirSync as NM}from"node:fs";import{join as wR}from"node:path";import{createHash as IM}from"node:crypto";import{copyFileSync as wM,existsSync as C$,readdirSync as CM,readFileSync as nO,statSync as XM,writeFileSync as vO}from"node:fs";import{basename as JM,dirname as Sj,extname as Nj,join as lA}from"node:path";import{existsSync as sj,readFileSync as a$}from"node:fs";import{homedir as pj}from"node:os";import{join as oj}from"node:path";import{createHash as ey}from"node:crypto";import{existsSync as iO,mkdirSync as TV,readdirSync as cj,readFileSync as ej,unlinkSync as iA,writeFileSync as _V}from"node:fs";import{join as J$}from"node:path";import{createHash as E1}from"node:crypto";import{createReadStream as tV,readdirSync as dV,statSync as Ec}from"node:fs";import{join as RV,relative as hV}from"node:path";import{deflateRawSync as VK}from"node:zlib";import{execSync as xK}from"node:child_process";import{createHash as bK}from"node:crypto";import{cpSync as kK,mkdtempSync as uK,rmSync as nK,writeFileSync as vK}from"node:fs";import{tmpdir as lK}from"node:os";import{dirname as iK,isAbsolute as aK,join as mA,resolve as mK}from"node:path";import{fileURLToPath as sK}from"node:url";import{execFileSync as Dc}from"node:child_process";import{mkdtempSync as xy,readFileSync as $c,rmSync as by}from"node:fs";import{tmpdir as ky}from"node:os";import{dirname as EZ,join as zR}from"node:path";import{fileURLToPath as TZ}from"node:url";import{readFileSync as LZ}from"node:fs";import{dirname as OZ,join as oy}from"node:path";import{fileURLToPath as cZ}from"node:url";import{execFileSync as aO}from"node:child_process";import{existsSync as UZ,mkdirSync as DZ,mkdtempSync as $Z,readdirSync as IZ,readFileSync as wZ,rmSync as CZ,statSync as TB,writeFileSync as XZ}from"node:fs";import{tmpdir as JZ}from"node:os";import{join as KS,relative as zZ}from"node:path";import{execSync as jZ}from"node:child_process";import{createHash as yZ}from"node:crypto";import{readdirSync as BZ,readFileSync as PZ,statSync as rB}from"node:fs";import{join as WZ,relative as tB,resolve as JI}from"node:path";function M9(E,T){this[E]=Q9.bind(null,T)}function _c(E){let T=typeof E==="string"?new URL(E):E,{hostname:_,pathname:r}=T;if(_.endsWith(".on.aws")){let h=_.match(/^[^.]+\.lambda-url\.([^.]+)\.on\.aws$/);if(h)return{service:"lambda",region:h[1]};return{service:"",region:""}}if(_.endsWith(".r2.cloudflarestorage.com"))return{service:"s3",region:"auto"};if(_.endsWith(".backblazeb2.com")){let h=_.match(/^(?:[^.]+\.)?s3\.([^.]+)\.backblazeb2\.com$/);if(h)return{service:"s3",region:h[1]};return{service:"",region:""}}let t=_.replace("dualstack.","").match(/([^.]+)\.(?:([^.]+)\.)?amazonaws\.com(?:\.cn)?$/);if(!t)return{service:"",region:""};let d=t[1],R=t[2]||"";if(R==="us-gov")R="us-gov-west-1";else if(R==="s3"||R==="s3-accelerate")R="us-east-1",d="s3";else if(d==="iot")if(_.startsWith("iot."))d="execute-api";else if(_.startsWith("data.jobs.iot."))d="iot-jobs-data";else d=r==="/mqtt"?"iotdevicegateway":"iotdata";else if(d==="autoscaling");else if(!R&&d.startsWith("s3-"))R=d.slice(3).replace(/^fips-|^external-1/,""),d="s3";else if(d.endsWith("-fips"))d=d.slice(0,-5);else if(R&&/-\d$/.test(d)&&!/-\d$/.test(R))[d,R]=[R,d];return d=fj[d]||d,{service:d,region:R||"us-east-1"}}function W_(E){let{method:T,url:_,body:r="",accessKeyId:t,secretAccessKey:d,sessionToken:R,signQuery:h=!1,expiresIn:S=86400,datetime:N}=E,A=new URL(_),L=A.hostname,O=_c(A),c=E.service||O.service,U=E.region||O.region;if(!c)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!U)throw Error("Could not detect region from URL. Please provide region explicitly.");let $=N||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),I=$.substring(0,8),w=[I,U,c,"aws4_request"].join("/"),z="AWS4-HMAC-SHA256";if(h)return Z9({urlObj:A,method:T,body:r,accessKeyId:t,secretAccessKey:d,sessionToken:R,service:c,region:U,timestamp:$,date:I,credentialScope:w,algorithm:z,expiresIn:S,cache:E.cache});let F=A.pathname||"/",j=tc(A.searchParams),Y={host:L,"x-amz-date":$,...E.headers};if(R)Y["x-amz-security-token"]=R;let H=Object.keys(Y).some((W)=>W.toLowerCase()==="content-type");if(r&&!H)Y["content-type"]="application/x-amz-json-1.0";if(c==="s3"&&!Y["x-amz-content-sha256"])Y["x-amz-content-sha256"]=sA(r);let Q=Ij(Y),K=wj(Y),x=Y["x-amz-content-sha256"]||sA(r),k=[T,dc(F),j,Q,K,x].join(`
 `),n=sA(k),TE=[z,$,w,n].join(`
-`),s=E.cache??zh,dE=Xj(d,I,U,c,TE,s),AE=[`${z} Credential=${t}/${w}`,`SignedHeaders=${K}`,`Signature=${dE}`].join(", ");return Y.authorization=AE,{url:_,method:T,headers:Y,body:r||void 0}}async function rc(E){let{method:T,url:_,body:r="",accessKeyId:t,secretAccessKey:d,sessionToken:R,signQuery:h=!1,expiresIn:S=86400,datetime:N}=E,A=new URL(_),L=A.hostname,O=_c(A),c=E.service||O.service,U=E.region||O.region;if(!c)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!U)throw Error("Could not detect region from URL. Please provide region explicitly.");let $=N||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),I=$.substring(0,8),w=[I,U,c,"aws4_request"].join("/"),z="AWS4-HMAC-SHA256";if(h)return g8({urlObj:A,method:T,body:r,accessKeyId:t,secretAccessKey:d,sessionToken:R,service:c,region:U,timestamp:$,date:I,credentialScope:w,algorithm:z,expiresIn:S,cache:E.cache});let F=A.pathname||"/",j=tc(A.searchParams),Y={host:L,"x-amz-date":$,...E.headers};if(R)Y["x-amz-security-token"]=R;let H=Object.keys(Y).some((q)=>q.toLowerCase()==="content-type");if(r&&!H)Y["content-type"]="application/x-amz-json-1.0";let Q=await mO(r);if(c==="s3"&&!Y["x-amz-content-sha256"])Y["x-amz-content-sha256"]=Q;let K=Ij(Y),x=wj(Y),k=Y["x-amz-content-sha256"]||Q,n=[T,dc(F),j,K,x,k].join(`
+`),s=E.cache??zh,dE=Xj(d,I,U,c,TE,s),AE=[`${z} Credential=${t}/${w}`,`SignedHeaders=${K}`,`Signature=${dE}`].join(", ");return Y.authorization=AE,{url:_,method:T,headers:Y,body:r||void 0}}async function rc(E){let{method:T,url:_,body:r="",accessKeyId:t,secretAccessKey:d,sessionToken:R,signQuery:h=!1,expiresIn:S=86400,datetime:N}=E,A=new URL(_),L=A.hostname,O=_c(A),c=E.service||O.service,U=E.region||O.region;if(!c)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!U)throw Error("Could not detect region from URL. Please provide region explicitly.");let $=N||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),I=$.substring(0,8),w=[I,U,c,"aws4_request"].join("/"),z="AWS4-HMAC-SHA256";if(h)return g9({urlObj:A,method:T,body:r,accessKeyId:t,secretAccessKey:d,sessionToken:R,service:c,region:U,timestamp:$,date:I,credentialScope:w,algorithm:z,expiresIn:S,cache:E.cache});let F=A.pathname||"/",j=tc(A.searchParams),Y={host:L,"x-amz-date":$,...E.headers};if(R)Y["x-amz-security-token"]=R;let H=Object.keys(Y).some((q)=>q.toLowerCase()==="content-type");if(r&&!H)Y["content-type"]="application/x-amz-json-1.0";let Q=await mO(r);if(c==="s3"&&!Y["x-amz-content-sha256"])Y["x-amz-content-sha256"]=Q;let K=Ij(Y),x=wj(Y),k=Y["x-amz-content-sha256"]||Q,n=[T,dc(F),j,K,x,k].join(`
 `),TE=await mO(n),s=[z,$,w,TE].join(`
-`),dE=E.cache??zh,AE=await Jj(d,I,U,c,s,dE),W=[`${z} Credential=${t}/${w}`,`SignedHeaders=${x}`,`Signature=${AE}`].join(", ");return Y.authorization=W,{url:_,method:T,headers:Y,body:r||void 0}}function Z8(E){let{urlObj:T,method:_,body:r,accessKeyId:t,secretAccessKey:d,sessionToken:R,service:h,region:S,timestamp:N,date:A,credentialScope:L,algorithm:O,expiresIn:c,cache:U}=E,$=new URL(T.toString());$.searchParams.set("X-Amz-Algorithm",O),$.searchParams.set("X-Amz-Credential",`${t}/${L}`),$.searchParams.set("X-Amz-Date",N),$.searchParams.set("X-Amz-Expires",String(c));let I=h==="s3"?"UNSIGNED-PAYLOAD":sA(r);if(h==="s3")$.searchParams.set("X-Amz-Content-Sha256",I);let w="host";if($.searchParams.set("X-Amz-SignedHeaders",w),R)$.searchParams.set("X-Amz-Security-Token",R);let z=dc($.pathname||"/"),F=`host:${$.hostname}
+`),dE=E.cache??zh,AE=await Jj(d,I,U,c,s,dE),W=[`${z} Credential=${t}/${w}`,`SignedHeaders=${x}`,`Signature=${AE}`].join(", ");return Y.authorization=W,{url:_,method:T,headers:Y,body:r||void 0}}function Z9(E){let{urlObj:T,method:_,body:r,accessKeyId:t,secretAccessKey:d,sessionToken:R,service:h,region:S,timestamp:N,date:A,credentialScope:L,algorithm:O,expiresIn:c,cache:U}=E,$=new URL(T.toString());$.searchParams.set("X-Amz-Algorithm",O),$.searchParams.set("X-Amz-Credential",`${t}/${L}`),$.searchParams.set("X-Amz-Date",N),$.searchParams.set("X-Amz-Expires",String(c));let I=h==="s3"?"UNSIGNED-PAYLOAD":sA(r);if(h==="s3")$.searchParams.set("X-Amz-Content-Sha256",I);let w="host";if($.searchParams.set("X-Amz-SignedHeaders",w),R)$.searchParams.set("X-Amz-Security-Token",R);let z=dc($.pathname||"/"),F=`host:${$.hostname}
 `,j=tc($.searchParams),Y=[_,z,j,F,w,I].join(`
 `),H=[O,N,L,sA(Y)].join(`
-`),K=Xj(d,A,S,h,H,U??zh);return $.searchParams.set("X-Amz-Signature",K),{url:$.toString(),method:_,headers:{},body:r||void 0}}async function g8(E){let{urlObj:T,method:_,body:r,accessKeyId:t,secretAccessKey:d,sessionToken:R,service:h,region:S,timestamp:N,date:A,credentialScope:L,algorithm:O,expiresIn:c,cache:U}=E,$=new URL(T.toString());$.searchParams.set("X-Amz-Algorithm",O),$.searchParams.set("X-Amz-Credential",`${t}/${L}`),$.searchParams.set("X-Amz-Date",N),$.searchParams.set("X-Amz-Expires",String(c));let I=h==="s3"?"UNSIGNED-PAYLOAD":await mO(r);if(h==="s3")$.searchParams.set("X-Amz-Content-Sha256",I);let w="host";if($.searchParams.set("X-Amz-SignedHeaders",w),R)$.searchParams.set("X-Amz-Security-Token",R);let z=dc($.pathname||"/"),F=`host:${$.hostname}
+`),K=Xj(d,A,S,h,H,U??zh);return $.searchParams.set("X-Amz-Signature",K),{url:$.toString(),method:_,headers:{},body:r||void 0}}async function g9(E){let{urlObj:T,method:_,body:r,accessKeyId:t,secretAccessKey:d,sessionToken:R,service:h,region:S,timestamp:N,date:A,credentialScope:L,algorithm:O,expiresIn:c,cache:U}=E,$=new URL(T.toString());$.searchParams.set("X-Amz-Algorithm",O),$.searchParams.set("X-Amz-Credential",`${t}/${L}`),$.searchParams.set("X-Amz-Date",N),$.searchParams.set("X-Amz-Expires",String(c));let I=h==="s3"?"UNSIGNED-PAYLOAD":await mO(r);if(h==="s3")$.searchParams.set("X-Amz-Content-Sha256",I);let w="host";if($.searchParams.set("X-Amz-SignedHeaders",w),R)$.searchParams.set("X-Amz-Security-Token",R);let z=dc($.pathname||"/"),F=`host:${$.hostname}
 `,j=tc($.searchParams),Y=[_,z,j,F,w,I].join(`
 `),H=[O,N,L,await mO(Y)].join(`
 `),K=await Jj(d,A,S,h,H,U??zh);return $.searchParams.set("X-Amz-Signature",K),{url:$.toString(),method:_,headers:{},body:r||void 0}}function f$(E){let{url:T,method:_="GET",expiresIn:r=3600,...t}=E,d=Math.min(r,604800);return W_({...t,url:T,method:_,signQuery:!0,expiresIn:d}).url}async function $j(E){let{url:T,method:_="GET",expiresIn:r=3600,...t}=E,d=Math.min(r,604800);return(await rc({...t,url:T,method:_,signQuery:!0,expiresIn:d})).url}function Ij(E){return Object.keys(E).sort().map((T)=>`${T.toLowerCase()}:${E[T].trim().replace(/\s+/g," ")}`).join(`
 `)+`
-`}function wj(E){return Object.keys(E).sort().map((T)=>T.toLowerCase()).join(";")}function tc(E){let T=[];return E.forEach((_,r)=>{T.push([j$(r),j$(_)])}),T.sort((_,r)=>{if(_[0]<r[0])return-1;if(_[0]>r[0])return 1;if(_[1]<r[1])return-1;if(_[1]>r[1])return 1;return 0}),T.map(([_,r])=>`${_}=${r}`).join("&")}function dc(E){return E.split("/").map((T)=>j$(T)).join("/")}function j$(E){return encodeURIComponent(E).replace(/[!'()*]/g,(T)=>`%${T.charCodeAt(0).toString(16).toUpperCase()}`)}function sA(E){if(!xS)throw Error("Synchronous hash not available in browser. Use signRequestAsync() instead.");return xS.createHash("sha256").update(E,"utf8").digest("hex")}function uA(E,T){if(!xS)throw Error("Synchronous hmac not available in browser. Use signRequestAsync() instead.");return xS.createHmac("sha256",E).update(T,"utf8").digest()}async function mO(E){let _=new TextEncoder().encode(E),r=await crypto.subtle.digest("SHA-256",_);return Cj(new Uint8Array(r))}async function nA(E,T){let _=new TextEncoder,r=typeof E==="string"?_.encode(E):E,t=_.encode(T),d=await crypto.subtle.importKey("raw",r.buffer,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),R=await crypto.subtle.sign("HMAC",d,t.buffer);return new Uint8Array(R)}function Cj(E){return Array.from(E).map((T)=>T.toString(16).padStart(2,"0")).join("")}function Xj(E,T,_,r,t,d){let R=`${E}:${T}:${_}:${r}`,h=d.get(R);if(!h){let S=uA(`AWS4${E}`,T),N=uA(S,_),A=uA(N,r);if(h=uA(A,"aws4_request"),d.size>=Yj){let L=d.keys().next().value;if(L)d.delete(L)}d.set(R,h)}return uA(h,t).toString("hex")}async function Jj(E,T,_,r,t,d){let R=`${E}:${T}:${_}:${r}`,h=d.get(R);if(!h){let N=await nA(`AWS4${E}`,T),A=await nA(N,_),L=await nA(A,r);if(h=await nA(L,"aws4_request"),d.size>=Yj){let O=d.keys().next().value;if(O)d.delete(O)}d.set(R,h)}let S=await nA(h,t);return Cj(S)}function zj(E,T){return T.includes(E)}function sO(E,T,_){let r=T*Math.pow(2,E),t=Math.random()*0.3*r;return Math.min(r+t,_)}function pO(E){return new Promise((T)=>setTimeout(T,E))}async function Xh(E,T){let{maxRetries:_=3,initialDelayMs:r=100,maxDelayMs:t=5000,retryableStatusCodes:d=[429,500,502,503,504],timeoutMs:R=30000}=T??{},h,S;for(let N=0;N<=_;N++){let A=W_(E),L={method:A.method,headers:A.headers};if(A.body)L.body=A.body;let O=new AbortController,c=setTimeout(()=>O.abort(),R);L.signal=O.signal;try{let U=await fetch(A.url,L);if(clearTimeout(c),S=U,U.ok)return U;if(N<_&&zj(U.status,d)){let I=sO(N,r,t);await pO(I);continue}let $=await U.text();throw Error(`AWS API request failed (${U.status}): ${$}`)}catch(U){if(clearTimeout(c),h=U,U instanceof Error&&U.name==="AbortError")h=Error(`Request timed out after ${R}ms`);if(N<_&&!(U instanceof Error&&U.message.includes("AWS API request failed"))){let $=sO(N,r,t);await pO($);continue}throw h}}throw h??Error("Request failed after retries")}async function Fj(E){return Xh(E,{maxRetries:0})}async function jj(E,T){let{maxRetries:_=3,initialDelayMs:r=100,maxDelayMs:t=5000,retryableStatusCodes:d=[429,500,502,503,504],timeoutMs:R=30000}=T??{},h;for(let S=0;S<=_;S++){let N=await rc(E),A={method:N.method,headers:N.headers};if(N.body)A.body=N.body;let L=new AbortController,O=setTimeout(()=>L.abort(),R);A.signal=L.signal;try{let c=await fetch(N.url,A);if(clearTimeout(O),c.ok)return c;if(S<_&&zj(c.status,d)){let $=sO(S,r,t);await pO($);continue}let U=await c.text();throw Error(`AWS API request failed (${c.status}): ${U}`)}catch(c){if(clearTimeout(O),h=c,c instanceof Error&&c.name==="AbortError")h=Error(`Request timed out after ${R}ms`);if(S<_&&!(c instanceof Error&&c.message.includes("AWS API request failed"))){let U=sO(S,r,t);await pO(U);continue}throw h}}throw h??Error("Request failed after retries")}async function pA(E){let T=await E.text(),_={},r=/<(\w+)>([^<]+)<\/\1>/g,t;while((t=r.exec(T))!==null){let[,d,R]=t;_[d]=R}return _}async function yj(E){return await E.json()}function Bj(){zh.clear()}function Pj(){return zh.size}function Wj(){return xS!==void 0}function Hj(){return typeof crypto<"u"&&typeof crypto.subtle<"u"}function Q$(E){Qj=E?.trim()||null}function hL(){return process.env[Gj]?.trim()||Qj||G$}function Zt(...E){return oO(hL(),...E)}function fT(E,...T){let _=hL();return y$(_)?oO(_,...T):oO(E,_,...T)}function M$(E,T=process.cwd()){let _=(t,d)=>{let R=b8(t,d);return R===""||!R.startsWith("..")&&!y$(R)},r=y$(E)?E:oO(T,E);return _(fT(T),r)}function V$(E){let T=E.infrastructure?.compute!=null,_=Object.values(E.environments??{}).some((r)=>r?.app!=null);return{server:T,serverless:_}}function K_(E){if(E.mode==="server"||E.mode==="serverless")return E.mode;let{serverless:T}=V$(E);return T?"serverless":"server"}function bS(E){let{server:T,serverless:_}=V$(E);if(T&&_)return"A project cannot be both a server and a serverless deployment. Found `infrastructure.compute` (server) AND `environments.<env>.app` (serverless Lambda). Keep one: remove `infrastructure.compute` for a serverless app, or remove `environments.<env>.app` for a server.";if(E.mode==="server"&&_&&!T)return"Config sets `mode: 'server'` but declares a serverless app (`environments.<env>.app`). Remove the app or change the mode.";if(E.mode==="serverless"&&T&&!_)return"Config sets `mode: 'serverless'` but declares a server (`infrastructure.compute`). Remove the compute block or change the mode.";return null}function uT(E){return E.infrastructure?.appDatabase??E.infrastructure?.compute?.database}function H_(E){if(E.cloud?.provider)return E.cloud.provider;if(E.hetzner?.apiToken)return"hetzner";return"aws"}class Rc{template;constructor(E){this.template={AWSTemplateFormatVersion:"2010-09-09",Description:E,Resources:{}}}addResource(E,T){return this.template.Resources[E]=T,this}addResources(E){return Object.assign(this.template.Resources,E),this}addParameter(E,T){if(!this.template.Parameters)this.template.Parameters={};return this.template.Parameters[E]=T,this}addOutput(E,T){if(!this.template.Outputs)this.template.Outputs={};return this.template.Outputs[E]=T,this}hasResource(E){return E in this.template.Resources}getResources(){return this.template.Resources}build(){return this.template}toJSON(E=!0){return JSON.stringify(this.template,null,E?2:0)}toYAML(){return this.convertToYAML(this.template)}convertToYAML(E,T=0){let _="  ".repeat(T),r="";for(let[t,d]of Object.entries(E)){if(d===null||d===void 0)continue;if(typeof d==="object"&&!Array.isArray(d))r+=`${_}${t}:
+`}function wj(E){return Object.keys(E).sort().map((T)=>T.toLowerCase()).join(";")}function tc(E){let T=[];return E.forEach((_,r)=>{T.push([j$(r),j$(_)])}),T.sort((_,r)=>{if(_[0]<r[0])return-1;if(_[0]>r[0])return 1;if(_[1]<r[1])return-1;if(_[1]>r[1])return 1;return 0}),T.map(([_,r])=>`${_}=${r}`).join("&")}function dc(E){return E.split("/").map((T)=>j$(T)).join("/")}function j$(E){return encodeURIComponent(E).replace(/[!'()*]/g,(T)=>`%${T.charCodeAt(0).toString(16).toUpperCase()}`)}function sA(E){if(!xS)throw Error("Synchronous hash not available in browser. Use signRequestAsync() instead.");return xS.createHash("sha256").update(E,"utf8").digest("hex")}function uA(E,T){if(!xS)throw Error("Synchronous hmac not available in browser. Use signRequestAsync() instead.");return xS.createHmac("sha256",E).update(T,"utf8").digest()}async function mO(E){let _=new TextEncoder().encode(E),r=await crypto.subtle.digest("SHA-256",_);return Cj(new Uint8Array(r))}async function nA(E,T){let _=new TextEncoder,r=typeof E==="string"?_.encode(E):E,t=_.encode(T),d=await crypto.subtle.importKey("raw",r.buffer,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),R=await crypto.subtle.sign("HMAC",d,t.buffer);return new Uint8Array(R)}function Cj(E){return Array.from(E).map((T)=>T.toString(16).padStart(2,"0")).join("")}function Xj(E,T,_,r,t,d){let R=`${E}:${T}:${_}:${r}`,h=d.get(R);if(!h){let S=uA(`AWS4${E}`,T),N=uA(S,_),A=uA(N,r);if(h=uA(A,"aws4_request"),d.size>=Yj){let L=d.keys().next().value;if(L)d.delete(L)}d.set(R,h)}return uA(h,t).toString("hex")}async function Jj(E,T,_,r,t,d){let R=`${E}:${T}:${_}:${r}`,h=d.get(R);if(!h){let N=await nA(`AWS4${E}`,T),A=await nA(N,_),L=await nA(A,r);if(h=await nA(L,"aws4_request"),d.size>=Yj){let O=d.keys().next().value;if(O)d.delete(O)}d.set(R,h)}let S=await nA(h,t);return Cj(S)}function zj(E,T){return T.includes(E)}function sO(E,T,_){let r=T*Math.pow(2,E),t=Math.random()*0.3*r;return Math.min(r+t,_)}function pO(E){return new Promise((T)=>setTimeout(T,E))}async function Xh(E,T){let{maxRetries:_=3,initialDelayMs:r=100,maxDelayMs:t=5000,retryableStatusCodes:d=[429,500,502,503,504],timeoutMs:R=30000}=T??{},h,S;for(let N=0;N<=_;N++){let A=W_(E),L={method:A.method,headers:A.headers};if(A.body)L.body=A.body;let O=new AbortController,c=setTimeout(()=>O.abort(),R);L.signal=O.signal;try{let U=await fetch(A.url,L);if(clearTimeout(c),S=U,U.ok)return U;if(N<_&&zj(U.status,d)){let I=sO(N,r,t);await pO(I);continue}let $=await U.text();throw Error(`AWS API request failed (${U.status}): ${$}`)}catch(U){if(clearTimeout(c),h=U,U instanceof Error&&U.name==="AbortError")h=Error(`Request timed out after ${R}ms`);if(N<_&&!(U instanceof Error&&U.message.includes("AWS API request failed"))){let $=sO(N,r,t);await pO($);continue}throw h}}throw h??Error("Request failed after retries")}async function Fj(E){return Xh(E,{maxRetries:0})}async function jj(E,T){let{maxRetries:_=3,initialDelayMs:r=100,maxDelayMs:t=5000,retryableStatusCodes:d=[429,500,502,503,504],timeoutMs:R=30000}=T??{},h;for(let S=0;S<=_;S++){let N=await rc(E),A={method:N.method,headers:N.headers};if(N.body)A.body=N.body;let L=new AbortController,O=setTimeout(()=>L.abort(),R);A.signal=L.signal;try{let c=await fetch(N.url,A);if(clearTimeout(O),c.ok)return c;if(S<_&&zj(c.status,d)){let $=sO(S,r,t);await pO($);continue}let U=await c.text();throw Error(`AWS API request failed (${c.status}): ${U}`)}catch(c){if(clearTimeout(O),h=c,c instanceof Error&&c.name==="AbortError")h=Error(`Request timed out after ${R}ms`);if(S<_&&!(c instanceof Error&&c.message.includes("AWS API request failed"))){let U=sO(S,r,t);await pO(U);continue}throw h}}throw h??Error("Request failed after retries")}async function pA(E){let T=await E.text(),_={},r=/<(\w+)>([^<]+)<\/\1>/g,t;while((t=r.exec(T))!==null){let[,d,R]=t;_[d]=R}return _}async function yj(E){return await E.json()}function Bj(){zh.clear()}function Pj(){return zh.size}function Wj(){return xS!==void 0}function Hj(){return typeof crypto<"u"&&typeof crypto.subtle<"u"}function Q$(E){Qj=E?.trim()||null}function hL(){return process.env[Gj]?.trim()||Qj||G$}function Zt(...E){return oO(hL(),...E)}function fT(E,...T){let _=hL();return y$(_)?oO(_,...T):oO(E,_,...T)}function M$(E,T=process.cwd()){let _=(t,d)=>{let R=b9(t,d);return R===""||!R.startsWith("..")&&!y$(R)},r=y$(E)?E:oO(T,E);return _(fT(T),r)}function V$(E){let T=E.infrastructure?.compute!=null,_=Object.values(E.environments??{}).some((r)=>r?.app!=null);return{server:T,serverless:_}}function K_(E){if(E.mode==="server"||E.mode==="serverless")return E.mode;let{serverless:T}=V$(E);return T?"serverless":"server"}function bS(E){let{server:T,serverless:_}=V$(E);if(T&&_)return"A project cannot be both a server and a serverless deployment. Found `infrastructure.compute` (server) AND `environments.<env>.app` (serverless Lambda). Keep one: remove `infrastructure.compute` for a serverless app, or remove `environments.<env>.app` for a server.";if(E.mode==="server"&&_&&!T)return"Config sets `mode: 'server'` but declares a serverless app (`environments.<env>.app`). Remove the app or change the mode.";if(E.mode==="serverless"&&T&&!_)return"Config sets `mode: 'serverless'` but declares a server (`infrastructure.compute`). Remove the compute block or change the mode.";return null}function uT(E){return E.infrastructure?.appDatabase??E.infrastructure?.compute?.database}function H_(E){if(E.cloud?.provider)return E.cloud.provider;if(E.hetzner?.apiToken)return"hetzner";return"aws"}class Rc{template;constructor(E){this.template={AWSTemplateFormatVersion:"2010-09-09",Description:E,Resources:{}}}addResource(E,T){return this.template.Resources[E]=T,this}addResources(E){return Object.assign(this.template.Resources,E),this}addParameter(E,T){if(!this.template.Parameters)this.template.Parameters={};return this.template.Parameters[E]=T,this}addOutput(E,T){if(!this.template.Outputs)this.template.Outputs={};return this.template.Outputs[E]=T,this}hasResource(E){return E in this.template.Resources}getResources(){return this.template.Resources}build(){return this.template}toJSON(E=!0){return JSON.stringify(this.template,null,E?2:0)}toYAML(){return this.convertToYAML(this.template)}convertToYAML(E,T=0){let _="  ".repeat(T),r="";for(let[t,d]of Object.entries(E)){if(d===null||d===void 0)continue;if(typeof d==="object"&&!Array.isArray(d))r+=`${_}${t}:
 ${this.convertToYAML(d,T+1)}`;else if(Array.isArray(d)){r+=`${_}${t}:
 `;for(let R of d)if(typeof R==="object")r+=`${_}  -
 ${this.convertToYAML(R,T+2)}`;else r+=`${_}  - ${R}
 `}else r+=`${_}${t}: ${d}
-`}return r}}function k8(E){let T=[],_=[],r=[];if(u8(E,T),E.Resources)n8(E.Resources,T,_);else T.push({path:"Resources",message:"Template must contain at least one resource",severity:"error"});if(E.Parameters)v8(E.Parameters,T,_);if(E.Outputs)l8(E.Outputs,T);i8(E,T);let t=a8(E);if(t.length>0)for(let d of t)T.push({path:"Resources",message:`Circular dependency detected: ${d.join(" → ")}`,severity:"error"});return s8(E,_,r),{valid:T.length===0,errors:T,warnings:_,info:r}}function u8(E,T){if(!E.AWSTemplateFormatVersion)T.push({path:"AWSTemplateFormatVersion",message:"Template should specify AWSTemplateFormatVersion",severity:"error"});else if(E.AWSTemplateFormatVersion!=="2010-09-09")T.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion must be "2010-09-09"',severity:"error"})}function n8(E,T,_){let r=Object.keys(E);if(r.length===0){T.push({path:"Resources",message:"Template must contain at least one resource",severity:"error"});return}if(r.length>500)_.push({path:"Resources",message:`Template contains ${r.length} resources (limit is 500)`,severity:"warning"});for(let t of r){let d=E[t];if(!/^[a-zA-Z0-9]+$/.test(t))T.push({path:`Resources.${t}`,message:"Logical ID must contain only alphanumeric characters",severity:"error"});if(!d.Type)T.push({path:`Resources.${t}.Type`,message:"Resource Type is required",severity:"error"});else if(!d.Type.startsWith("AWS::")&&!d.Type.startsWith("Custom::"))T.push({path:`Resources.${t}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(d.DeletionPolicy&&!["Delete","Retain","Snapshot"].includes(d.DeletionPolicy))T.push({path:`Resources.${t}.DeletionPolicy`,message:'DeletionPolicy must be "Delete", "Retain", or "Snapshot"',severity:"error"});if(!d.DeletionPolicy&&Mj(d.Type))_.push({path:`Resources.${t}.DeletionPolicy`,message:`${d.Type} should specify DeletionPolicy to prevent accidental data loss`,severity:"warning"})}}function v8(E,T,_){let r=Object.keys(E);if(r.length>200)_.push({path:"Parameters",message:`Template contains ${r.length} parameters (limit is 200)`,severity:"warning"});for(let t of r){let d=E[t];if(!d.Type)T.push({path:`Parameters.${t}.Type`,message:"Parameter Type is required",severity:"error"});let R=["String","Number","List<Number>","CommaDelimitedList","AWS::EC2::AvailabilityZone::Name","AWS::EC2::Image::Id","AWS::EC2::Instance::Id","AWS::EC2::KeyPair::KeyName","AWS::EC2::SecurityGroup::GroupName","AWS::EC2::SecurityGroup::Id","AWS::EC2::Subnet::Id","AWS::EC2::Volume::Id","AWS::EC2::VPC::Id","AWS::Route53::HostedZone::Id","List<AWS::EC2::AvailabilityZone::Name>","List<AWS::EC2::Image::Id>","List<AWS::EC2::Instance::Id>","List<AWS::EC2::SecurityGroup::GroupName>","List<AWS::EC2::SecurityGroup::Id>","List<AWS::EC2::Subnet::Id>","List<AWS::EC2::Volume::Id>","List<AWS::EC2::VPC::Id>","List<AWS::Route53::HostedZone::Id>","AWS::SSM::Parameter::Name","AWS::SSM::Parameter::Value<String>","AWS::SSM::Parameter::Value<List<String>>","AWS::SSM::Parameter::Value<CommaDelimitedList>"];if(d.Type&&!R.includes(d.Type))T.push({path:`Parameters.${t}.Type`,message:`Invalid parameter type: ${d.Type}`,severity:"error"})}}function l8(E,T){let _=Object.keys(E);for(let r of _)if(!E[r].Value)T.push({path:`Outputs.${r}.Value`,message:"Output Value is required",severity:"error"})}function i8(E,T){let _=E.Resources||{},r=E.Parameters||{},t=new Set(Object.keys(_)),d=new Set(Object.keys(r));function R(h,S){if(typeof h!=="object"||h===null)return;if(h.Ref){let N=h.Ref;if(!t.has(N)&&!d.has(N)&&N!=="AWS::Region"&&N!=="AWS::AccountId"&&N!=="AWS::StackName"&&N!=="AWS::StackId"&&N!=="AWS::URLSuffix"&&N!=="AWS::Partition"&&N!=="AWS::NoValue")T.push({path:S,message:`Reference to non-existent resource or parameter: ${N}`,severity:"error"})}if(h["Fn::GetAtt"]){let N=h["Fn::GetAtt"];if(Array.isArray(N)&&N.length>=1){let A=N[0];if(!t.has(A))T.push({path:S,message:`GetAtt references non-existent resource: ${A}`,severity:"error"})}}for(let N in h)R(h[N],`${S}.${N}`)}for(let h in _)R(_[h],`Resources.${h}`);if(E.Outputs)for(let h in E.Outputs)R(E.Outputs[h],`Outputs.${h}`)}function a8(E){let T=E.Resources||{},_=new Map;for(let h in T){let S=new Set,N=T[h];if(N.DependsOn)if(Array.isArray(N.DependsOn))N.DependsOn.forEach((L)=>S.add(L));else S.add(N.DependsOn);m8(N).forEach((L)=>S.add(L)),_.set(h,S)}let r=[],t=new Set,d=new Set;function R(h,S){t.add(h),d.add(h),S.push(h);let N=_.get(h)||new Set;for(let A of N)if(!t.has(A))R(A,[...S]);else if(d.has(A)){let L=S.indexOf(A),O=[...S.slice(L),A];r.push(O)}d.delete(h)}for(let h of _.keys())if(!t.has(h))R(h,[]);return r}function m8(E){let T=new Set;function _(r){if(typeof r!=="object"||r===null)return;if(r.Ref&&typeof r.Ref==="string"){if(!r.Ref.startsWith("AWS::"))T.add(r.Ref)}if(r["Fn::GetAtt"]&&Array.isArray(r["Fn::GetAtt"]))T.add(r["Fn::GetAtt"][0]);for(let t in r)_(r[t])}return _(E),T}function Mj(E){return["AWS::S3::Bucket","AWS::DynamoDB::Table","AWS::RDS::DBInstance","AWS::RDS::DBCluster","AWS::ElastiCache::CacheCluster","AWS::ElastiCache::ReplicationGroup","AWS::EFS::FileSystem","AWS::OpenSearchService::Domain"].includes(E)}function s8(E,T,_){let r=E.Resources||{};if(!E.Description)_.push({path:"Description",message:"Consider adding a Description to the template",severity:"info"});for(let t in r){let d=r[t],R=d.Properties;if(R&&!R.Tags&&p8(d.Type))_.push({path:`Resources.${t}`,message:`Consider adding Tags to ${d.Type}`,severity:"info"});if(Mj(d.Type)){if(d.Type==="AWS::S3::Bucket"&&!R?.BucketEncryption)T.push({path:`Resources.${t}`,message:"S3 bucket should enable encryption",severity:"warning"});if(d.Type==="AWS::RDS::DBInstance"&&!R?.StorageEncrypted)T.push({path:`Resources.${t}`,message:"RDS instance should enable storage encryption",severity:"warning"})}}}function p8(E){return!["AWS::CloudFormation::Stack","AWS::CloudFormation::WaitCondition","AWS::CloudFormation::WaitConditionHandle"].includes(E)}function o8(E){let T=[],_=[],r=[],t=Buffer.byteLength(E,"utf8"),d=t/1024,R=51200,h=460800;if(t>460800)T.push({path:"Template",message:`Template size (${d.toFixed(2)} KB) exceeds maximum size of 450 KB`,severity:"error"});else if(t>51200)_.push({path:"Template",message:`Template size (${d.toFixed(2)} KB) exceeds 50 KB. Must use S3 for deployment.`,severity:"warning"});return{valid:T.length===0,errors:T,warnings:_,info:r}}function EM(E){let T=[],_=[],r=[],t=E.Resources||{},d=E.Parameters||{},R=E.Outputs||{};if(Object.keys(t).length>500)T.push({path:"Resources",message:`Template has ${Object.keys(t).length} resources (limit is 500)`,severity:"error"});if(Object.keys(d).length>200)T.push({path:"Parameters",message:`Template has ${Object.keys(d).length} parameters (limit is 200)`,severity:"error"});if(Object.keys(R).length>200)T.push({path:"Outputs",message:`Template has ${Object.keys(R).length} outputs (limit is 200)`,severity:"error"});return{valid:T.length===0,errors:T,warnings:_,info:r}}function RE(E){let{slug:T,environment:_,resourceType:r,timestamp:t,suffix:d}=E,R=[T,_,r];if(t)R.push(t);if(d)R.push(d);return R.join("-")}function i(E){return E.split("-").map((T)=>T.charAt(0).toUpperCase()+T.slice(1)).join("")}function _M(){return Date.now().toString()}function rM(E){return E.toLowerCase().replace(/[^a-z0-9-]/g,"-").replace(/^-+|-+$/g,"").replace(/-+/g,"-")}function DT(E,T){return E.project.stackName??`${E.project.slug}-${T}`}function K$(E,T,_,r){return _.stackName??`${E.project.slug}-${r}-${T}-site`}function Z$(E,T){return`${E.project.slug}-${T}`}function g$(E,T,_,r){if(r)return r;if(_==="main")return`${E}-${T}-site`;return`${E}-${T}-${_}`}function tM(E,T,_,r){return r??`${E}-${T}-${_}`}function Vj(E,T){return`${E}-${T}-deploy`}function ed(E,T){return`${E.project.slug}-${T}-app`}function q$(E,T){return`${E}-${T}-deployments`}function hc(E,T){return`${E}-${T}-assets`}class Kj{nodes=new Map;addResource(E,T){let _=this.extractDependencies(T);this.nodes.set(E,{logicalId:E,resource:T,dependencies:_})}extractDependencies(E){let T=new Set;if(E.DependsOn)if(Array.isArray(E.DependsOn))E.DependsOn.forEach((_)=>T.add(_));else T.add(E.DependsOn);return this.findReferences(E.Properties||{},T),T}findReferences(E,T){if(!E||typeof E!=="object")return;if("Ref"in E&&typeof E.Ref==="string"){if(!E.Ref.startsWith("AWS::"))T.add(E.Ref)}if("Fn::GetAtt"in E&&Array.isArray(E["Fn::GetAtt"]))T.add(E["Fn::GetAtt"][0]);for(let _ of Object.values(E))if(typeof _==="object")this.findReferences(_,T)}topologicalSort(){let E=[],T=new Set,_=new Set,r=(t)=>{if(T.has(t))return;if(_.has(t))throw Error(`Circular dependency detected: ${t}`);_.add(t);let d=this.nodes.get(t);if(d)for(let R of d.dependencies)r(R);_.delete(t),T.add(t),E.push(t)};for(let t of this.nodes.keys())r(t);return E}validate(){for(let[E,T]of this.nodes.entries())for(let _ of T.dependencies)if(!this.nodes.has(_))throw Error(`Resource "${E}" depends on "${_}" which does not exist`)}getDependents(E){let T=[];for(let[_,r]of this.nodes.entries())if(r.dependencies.has(E))T.push(_);return T}}function dM(E,T){let _=[],r=[],t=[],d=[],R=[],h=E.Resources||{},S=T.Resources||{},N=new Set([...Object.keys(h),...Object.keys(S)]);for(let L of N){let O=h[L],c=S[L];if(!O&&c)_.push({logicalId:L,action:"add",resourceType:c.Type});else if(O&&!c)r.push({logicalId:L,action:"remove",resourceType:O.Type});else if(O&&c)if(O.Type!==c.Type)d.push({logicalId:L,action:"replace",resourceType:c.Type,reason:`Type changed from ${O.Type} to ${c.Type}`});else{let U=Zj(O.Properties||{},c.Properties||{});if(U.length>0)if(RM(O.Type,U))d.push({logicalId:L,action:"replace",resourceType:c.Type,changes:U,reason:"Property changes require replacement"});else t.push({logicalId:L,action:"update",resourceType:c.Type,changes:U});else R.push(L)}}let A=hM([...r,...d,...t]);return{added:_,removed:r,updated:t,replaced:d,unchanged:R,summary:{totalChanges:_.length+r.length+t.length+d.length,requiresReplacement:d.length>0,dangerousChanges:A}}}function Zj(E,T,_=""){let r=[],t=new Set([...Object.keys(E),...Object.keys(T)]);for(let d of t){let R=_?`${_}.${d}`:d,h=E[d],S=T[d];if(h===void 0&&S!==void 0)r.push({path:R,oldValue:void 0,newValue:S});else if(h!==void 0&&S===void 0)r.push({path:R,oldValue:h,newValue:void 0});else if(typeof h!==typeof S)r.push({path:R,oldValue:h,newValue:S});else if(typeof h==="object"&&h!==null)if(Array.isArray(h)&&Array.isArray(S)){if(JSON.stringify(h)!==JSON.stringify(S))r.push({path:R,oldValue:h,newValue:S})}else if(!Array.isArray(h)&&!Array.isArray(S)){let N=Zj(h,S,R);r.push(...N)}else r.push({path:R,oldValue:h,newValue:S});else if(h!==S)r.push({path:R,oldValue:h,newValue:S})}return r}function RM(E,T){let r={"AWS::S3::Bucket":new Set(["BucketName"]),"AWS::DynamoDB::Table":new Set(["TableName","KeySchema"]),"AWS::RDS::DBInstance":new Set(["DBInstanceIdentifier","DBName","Engine"]),"AWS::Lambda::Function":new Set(["FunctionName"]),"AWS::EC2::Instance":new Set(["ImageId","InstanceType","KeyName"]),"AWS::ECS::TaskDefinition":new Set(["Family","ContainerDefinitions"]),"AWS::ElastiCache::CacheCluster":new Set(["CacheNodeType","Engine"]),"AWS::CloudFront::Distribution":new Set([]),"AWS::Route53::HostedZone":new Set(["Name"]),"AWS::IAM::Role":new Set(["RoleName","Path"]),"AWS::KMS::Key":new Set(["KeyPolicy"]),"AWS::Cognito::UserPool":new Set(["UserPoolName"]),"AWS::OpenSearchService::Domain":new Set(["DomainName"])}[E];if(!r)return!1;for(let t of T){let d=t.path.split(".")[0];if(r.has(d))return!0}return!1}function hM(E){let T=[];for(let _ of E){if(_.action==="remove"&&(_.resourceType==="AWS::RDS::DBInstance"||_.resourceType==="AWS::DynamoDB::Table"||_.resourceType==="AWS::ElastiCache::CacheCluster"))T.push(`Removing ${_.resourceType} ${_.logicalId} - data loss risk!`);if(_.action==="replace"&&(_.resourceType==="AWS::RDS::DBInstance"||_.resourceType==="AWS::DynamoDB::Table"))T.push(`Replacing ${_.resourceType} ${_.logicalId} - data loss risk!`);if((_.action==="remove"||_.action==="replace")&&_.resourceType==="AWS::S3::Bucket")T.push(`${_.action==="remove"?"Removing":"Replacing"} S3 bucket ${_.logicalId} - data loss risk!`);if(_.action==="replace"&&_.resourceType==="AWS::EC2::Instance")T.push(`Replacing EC2 instance ${_.logicalId} - downtime expected`);if(_.action==="update"&&_.resourceType==="AWS::EC2::SecurityGroup")T.push(`Updating security group ${_.logicalId} - may affect connectivity`);if((_.action==="update"||_.action==="replace")&&(_.resourceType==="AWS::IAM::Role"||_.resourceType==="AWS::IAM::Policy"))T.push(`Modifying IAM ${_.resourceType.split("::")[2]} ${_.logicalId} - may affect permissions`)}return T}function SM(E){let T=[];if(T.push(`=== Stack Update Analysis ===
+`}return r}}function k9(E){let T=[],_=[],r=[];if(u9(E,T),E.Resources)n9(E.Resources,T,_);else T.push({path:"Resources",message:"Template must contain at least one resource",severity:"error"});if(E.Parameters)v9(E.Parameters,T,_);if(E.Outputs)l9(E.Outputs,T);i9(E,T);let t=a9(E);if(t.length>0)for(let d of t)T.push({path:"Resources",message:`Circular dependency detected: ${d.join(" → ")}`,severity:"error"});return s9(E,_,r),{valid:T.length===0,errors:T,warnings:_,info:r}}function u9(E,T){if(!E.AWSTemplateFormatVersion)T.push({path:"AWSTemplateFormatVersion",message:"Template should specify AWSTemplateFormatVersion",severity:"error"});else if(E.AWSTemplateFormatVersion!=="2010-09-09")T.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion must be "2010-09-09"',severity:"error"})}function n9(E,T,_){let r=Object.keys(E);if(r.length===0){T.push({path:"Resources",message:"Template must contain at least one resource",severity:"error"});return}if(r.length>500)_.push({path:"Resources",message:`Template contains ${r.length} resources (limit is 500)`,severity:"warning"});for(let t of r){let d=E[t];if(!/^[a-zA-Z0-9]+$/.test(t))T.push({path:`Resources.${t}`,message:"Logical ID must contain only alphanumeric characters",severity:"error"});if(!d.Type)T.push({path:`Resources.${t}.Type`,message:"Resource Type is required",severity:"error"});else if(!d.Type.startsWith("AWS::")&&!d.Type.startsWith("Custom::"))T.push({path:`Resources.${t}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(d.DeletionPolicy&&!["Delete","Retain","Snapshot"].includes(d.DeletionPolicy))T.push({path:`Resources.${t}.DeletionPolicy`,message:'DeletionPolicy must be "Delete", "Retain", or "Snapshot"',severity:"error"});if(!d.DeletionPolicy&&Mj(d.Type))_.push({path:`Resources.${t}.DeletionPolicy`,message:`${d.Type} should specify DeletionPolicy to prevent accidental data loss`,severity:"warning"})}}function v9(E,T,_){let r=Object.keys(E);if(r.length>200)_.push({path:"Parameters",message:`Template contains ${r.length} parameters (limit is 200)`,severity:"warning"});for(let t of r){let d=E[t];if(!d.Type)T.push({path:`Parameters.${t}.Type`,message:"Parameter Type is required",severity:"error"});let R=["String","Number","List<Number>","CommaDelimitedList","AWS::EC2::AvailabilityZone::Name","AWS::EC2::Image::Id","AWS::EC2::Instance::Id","AWS::EC2::KeyPair::KeyName","AWS::EC2::SecurityGroup::GroupName","AWS::EC2::SecurityGroup::Id","AWS::EC2::Subnet::Id","AWS::EC2::Volume::Id","AWS::EC2::VPC::Id","AWS::Route53::HostedZone::Id","List<AWS::EC2::AvailabilityZone::Name>","List<AWS::EC2::Image::Id>","List<AWS::EC2::Instance::Id>","List<AWS::EC2::SecurityGroup::GroupName>","List<AWS::EC2::SecurityGroup::Id>","List<AWS::EC2::Subnet::Id>","List<AWS::EC2::Volume::Id>","List<AWS::EC2::VPC::Id>","List<AWS::Route53::HostedZone::Id>","AWS::SSM::Parameter::Name","AWS::SSM::Parameter::Value<String>","AWS::SSM::Parameter::Value<List<String>>","AWS::SSM::Parameter::Value<CommaDelimitedList>"];if(d.Type&&!R.includes(d.Type))T.push({path:`Parameters.${t}.Type`,message:`Invalid parameter type: ${d.Type}`,severity:"error"})}}function l9(E,T){let _=Object.keys(E);for(let r of _)if(!E[r].Value)T.push({path:`Outputs.${r}.Value`,message:"Output Value is required",severity:"error"})}function i9(E,T){let _=E.Resources||{},r=E.Parameters||{},t=new Set(Object.keys(_)),d=new Set(Object.keys(r));function R(h,S){if(typeof h!=="object"||h===null)return;if(h.Ref){let N=h.Ref;if(!t.has(N)&&!d.has(N)&&N!=="AWS::Region"&&N!=="AWS::AccountId"&&N!=="AWS::StackName"&&N!=="AWS::StackId"&&N!=="AWS::URLSuffix"&&N!=="AWS::Partition"&&N!=="AWS::NoValue")T.push({path:S,message:`Reference to non-existent resource or parameter: ${N}`,severity:"error"})}if(h["Fn::GetAtt"]){let N=h["Fn::GetAtt"];if(Array.isArray(N)&&N.length>=1){let A=N[0];if(!t.has(A))T.push({path:S,message:`GetAtt references non-existent resource: ${A}`,severity:"error"})}}for(let N in h)R(h[N],`${S}.${N}`)}for(let h in _)R(_[h],`Resources.${h}`);if(E.Outputs)for(let h in E.Outputs)R(E.Outputs[h],`Outputs.${h}`)}function a9(E){let T=E.Resources||{},_=new Map;for(let h in T){let S=new Set,N=T[h];if(N.DependsOn)if(Array.isArray(N.DependsOn))N.DependsOn.forEach((L)=>S.add(L));else S.add(N.DependsOn);m9(N).forEach((L)=>S.add(L)),_.set(h,S)}let r=[],t=new Set,d=new Set;function R(h,S){t.add(h),d.add(h),S.push(h);let N=_.get(h)||new Set;for(let A of N)if(!t.has(A))R(A,[...S]);else if(d.has(A)){let L=S.indexOf(A),O=[...S.slice(L),A];r.push(O)}d.delete(h)}for(let h of _.keys())if(!t.has(h))R(h,[]);return r}function m9(E){let T=new Set;function _(r){if(typeof r!=="object"||r===null)return;if(r.Ref&&typeof r.Ref==="string"){if(!r.Ref.startsWith("AWS::"))T.add(r.Ref)}if(r["Fn::GetAtt"]&&Array.isArray(r["Fn::GetAtt"]))T.add(r["Fn::GetAtt"][0]);for(let t in r)_(r[t])}return _(E),T}function Mj(E){return["AWS::S3::Bucket","AWS::DynamoDB::Table","AWS::RDS::DBInstance","AWS::RDS::DBCluster","AWS::ElastiCache::CacheCluster","AWS::ElastiCache::ReplicationGroup","AWS::EFS::FileSystem","AWS::OpenSearchService::Domain"].includes(E)}function s9(E,T,_){let r=E.Resources||{};if(!E.Description)_.push({path:"Description",message:"Consider adding a Description to the template",severity:"info"});for(let t in r){let d=r[t],R=d.Properties;if(R&&!R.Tags&&p9(d.Type))_.push({path:`Resources.${t}`,message:`Consider adding Tags to ${d.Type}`,severity:"info"});if(Mj(d.Type)){if(d.Type==="AWS::S3::Bucket"&&!R?.BucketEncryption)T.push({path:`Resources.${t}`,message:"S3 bucket should enable encryption",severity:"warning"});if(d.Type==="AWS::RDS::DBInstance"&&!R?.StorageEncrypted)T.push({path:`Resources.${t}`,message:"RDS instance should enable storage encryption",severity:"warning"})}}}function p9(E){return!["AWS::CloudFormation::Stack","AWS::CloudFormation::WaitCondition","AWS::CloudFormation::WaitConditionHandle"].includes(E)}function o9(E){let T=[],_=[],r=[],t=Buffer.byteLength(E,"utf8"),d=t/1024,R=51200,h=460800;if(t>460800)T.push({path:"Template",message:`Template size (${d.toFixed(2)} KB) exceeds maximum size of 450 KB`,severity:"error"});else if(t>51200)_.push({path:"Template",message:`Template size (${d.toFixed(2)} KB) exceeds 50 KB. Must use S3 for deployment.`,severity:"warning"});return{valid:T.length===0,errors:T,warnings:_,info:r}}function EM(E){let T=[],_=[],r=[],t=E.Resources||{},d=E.Parameters||{},R=E.Outputs||{};if(Object.keys(t).length>500)T.push({path:"Resources",message:`Template has ${Object.keys(t).length} resources (limit is 500)`,severity:"error"});if(Object.keys(d).length>200)T.push({path:"Parameters",message:`Template has ${Object.keys(d).length} parameters (limit is 200)`,severity:"error"});if(Object.keys(R).length>200)T.push({path:"Outputs",message:`Template has ${Object.keys(R).length} outputs (limit is 200)`,severity:"error"});return{valid:T.length===0,errors:T,warnings:_,info:r}}function RE(E){let{slug:T,environment:_,resourceType:r,timestamp:t,suffix:d}=E,R=[T,_,r];if(t)R.push(t);if(d)R.push(d);return R.join("-")}function i(E){return E.split("-").map((T)=>T.charAt(0).toUpperCase()+T.slice(1)).join("")}function _M(){return Date.now().toString()}function rM(E){return E.toLowerCase().replace(/[^a-z0-9-]/g,"-").replace(/^-+|-+$/g,"").replace(/-+/g,"-")}function DT(E,T){return E.project.stackName??`${E.project.slug}-${T}`}function K$(E,T,_,r){return _.stackName??`${E.project.slug}-${r}-${T}-site`}function Z$(E,T){return`${E.project.slug}-${T}`}function g$(E,T,_,r){if(r)return r;if(_==="main")return`${E}-${T}-site`;return`${E}-${T}-${_}`}function tM(E,T,_,r){return r??`${E}-${T}-${_}`}function Vj(E,T){return`${E}-${T}-deploy`}function ed(E,T){return`${E.project.slug}-${T}-app`}function q$(E,T){return`${E}-${T}-deployments`}function hc(E,T){return`${E}-${T}-assets`}class Kj{nodes=new Map;addResource(E,T){let _=this.extractDependencies(T);this.nodes.set(E,{logicalId:E,resource:T,dependencies:_})}extractDependencies(E){let T=new Set;if(E.DependsOn)if(Array.isArray(E.DependsOn))E.DependsOn.forEach((_)=>T.add(_));else T.add(E.DependsOn);return this.findReferences(E.Properties||{},T),T}findReferences(E,T){if(!E||typeof E!=="object")return;if("Ref"in E&&typeof E.Ref==="string"){if(!E.Ref.startsWith("AWS::"))T.add(E.Ref)}if("Fn::GetAtt"in E&&Array.isArray(E["Fn::GetAtt"]))T.add(E["Fn::GetAtt"][0]);for(let _ of Object.values(E))if(typeof _==="object")this.findReferences(_,T)}topologicalSort(){let E=[],T=new Set,_=new Set,r=(t)=>{if(T.has(t))return;if(_.has(t))throw Error(`Circular dependency detected: ${t}`);_.add(t);let d=this.nodes.get(t);if(d)for(let R of d.dependencies)r(R);_.delete(t),T.add(t),E.push(t)};for(let t of this.nodes.keys())r(t);return E}validate(){for(let[E,T]of this.nodes.entries())for(let _ of T.dependencies)if(!this.nodes.has(_))throw Error(`Resource "${E}" depends on "${_}" which does not exist`)}getDependents(E){let T=[];for(let[_,r]of this.nodes.entries())if(r.dependencies.has(E))T.push(_);return T}}function dM(E,T){let _=[],r=[],t=[],d=[],R=[],h=E.Resources||{},S=T.Resources||{},N=new Set([...Object.keys(h),...Object.keys(S)]);for(let L of N){let O=h[L],c=S[L];if(!O&&c)_.push({logicalId:L,action:"add",resourceType:c.Type});else if(O&&!c)r.push({logicalId:L,action:"remove",resourceType:O.Type});else if(O&&c)if(O.Type!==c.Type)d.push({logicalId:L,action:"replace",resourceType:c.Type,reason:`Type changed from ${O.Type} to ${c.Type}`});else{let U=Zj(O.Properties||{},c.Properties||{});if(U.length>0)if(RM(O.Type,U))d.push({logicalId:L,action:"replace",resourceType:c.Type,changes:U,reason:"Property changes require replacement"});else t.push({logicalId:L,action:"update",resourceType:c.Type,changes:U});else R.push(L)}}let A=hM([...r,...d,...t]);return{added:_,removed:r,updated:t,replaced:d,unchanged:R,summary:{totalChanges:_.length+r.length+t.length+d.length,requiresReplacement:d.length>0,dangerousChanges:A}}}function Zj(E,T,_=""){let r=[],t=new Set([...Object.keys(E),...Object.keys(T)]);for(let d of t){let R=_?`${_}.${d}`:d,h=E[d],S=T[d];if(h===void 0&&S!==void 0)r.push({path:R,oldValue:void 0,newValue:S});else if(h!==void 0&&S===void 0)r.push({path:R,oldValue:h,newValue:void 0});else if(typeof h!==typeof S)r.push({path:R,oldValue:h,newValue:S});else if(typeof h==="object"&&h!==null)if(Array.isArray(h)&&Array.isArray(S)){if(JSON.stringify(h)!==JSON.stringify(S))r.push({path:R,oldValue:h,newValue:S})}else if(!Array.isArray(h)&&!Array.isArray(S)){let N=Zj(h,S,R);r.push(...N)}else r.push({path:R,oldValue:h,newValue:S});else if(h!==S)r.push({path:R,oldValue:h,newValue:S})}return r}function RM(E,T){let r={"AWS::S3::Bucket":new Set(["BucketName"]),"AWS::DynamoDB::Table":new Set(["TableName","KeySchema"]),"AWS::RDS::DBInstance":new Set(["DBInstanceIdentifier","DBName","Engine"]),"AWS::Lambda::Function":new Set(["FunctionName"]),"AWS::EC2::Instance":new Set(["ImageId","InstanceType","KeyName"]),"AWS::ECS::TaskDefinition":new Set(["Family","ContainerDefinitions"]),"AWS::ElastiCache::CacheCluster":new Set(["CacheNodeType","Engine"]),"AWS::CloudFront::Distribution":new Set([]),"AWS::Route53::HostedZone":new Set(["Name"]),"AWS::IAM::Role":new Set(["RoleName","Path"]),"AWS::KMS::Key":new Set(["KeyPolicy"]),"AWS::Cognito::UserPool":new Set(["UserPoolName"]),"AWS::OpenSearchService::Domain":new Set(["DomainName"])}[E];if(!r)return!1;for(let t of T){let d=t.path.split(".")[0];if(r.has(d))return!0}return!1}function hM(E){let T=[];for(let _ of E){if(_.action==="remove"&&(_.resourceType==="AWS::RDS::DBInstance"||_.resourceType==="AWS::DynamoDB::Table"||_.resourceType==="AWS::ElastiCache::CacheCluster"))T.push(`Removing ${_.resourceType} ${_.logicalId} - data loss risk!`);if(_.action==="replace"&&(_.resourceType==="AWS::RDS::DBInstance"||_.resourceType==="AWS::DynamoDB::Table"))T.push(`Replacing ${_.resourceType} ${_.logicalId} - data loss risk!`);if((_.action==="remove"||_.action==="replace")&&_.resourceType==="AWS::S3::Bucket")T.push(`${_.action==="remove"?"Removing":"Replacing"} S3 bucket ${_.logicalId} - data loss risk!`);if(_.action==="replace"&&_.resourceType==="AWS::EC2::Instance")T.push(`Replacing EC2 instance ${_.logicalId} - downtime expected`);if(_.action==="update"&&_.resourceType==="AWS::EC2::SecurityGroup")T.push(`Updating security group ${_.logicalId} - may affect connectivity`);if((_.action==="update"||_.action==="replace")&&(_.resourceType==="AWS::IAM::Role"||_.resourceType==="AWS::IAM::Policy"))T.push(`Modifying IAM ${_.resourceType.split("::")[2]} ${_.logicalId} - may affect permissions`)}return T}function SM(E){let T=[];if(T.push(`=== Stack Update Analysis ===
 `),E.summary.totalChanges===0)return T.push(`No changes detected.
 `),T.join(`
 `);if(T.push(`Total changes: ${E.summary.totalChanges}`),T.push(`Requires replacement: ${E.summary.requiresReplacement?"Yes":"No"}
@@ -376,7 +376,7 @@ rpm -U ./amazon-cloudwatch-agent.rpm || true
 # Install Node.js or PHP/Python based on app needs
 # Configure application server (PM2, Nginx, Apache)
 # Mount EFS for shared file storage
-`}},storage:{uploads:{type:"efs",performanceMode:"generalPurpose",throughputMode:"bursting",encrypted:!0,lifecyclePolicy:{transitionToIA:30}},backups:{public:!1,versioning:!0,encryption:!0,lifecycleRules:[{id:"ArchiveOldBackups",enabled:!0,transitions:[{days:90,storageClass:"GLACIER"}]}]},static:{public:!0,versioning:!1,encryption:!1,cors:[{allowedOrigins:[r||"*"],allowedMethods:["GET","HEAD"]}]}},cdn:{enabled:!0,origins:[{originId:"static-assets",domainName:`${_}-static.s3.amazonaws.com`,pathPattern:"/static/*"}],customDomain:r?{domain:r,certificateArn:"TO_BE_GENERATED"}:void 0,cachePolicy:{minTTL:0,defaultTTL:86400,maxTTL:31536000},compress:!0,http3:!0},databases:h==="mysql"?{mysql:{engine:"mysql",version:"8.0",instanceClass:"db.t3.medium",allocatedStorage:100,maxAllocatedStorage:500,multiAZ:!0,backupRetentionDays:14,preferredBackupWindow:"03:00-04:00",preferredMaintenanceWindow:"sun:04:00-sun:05:00",enablePerformanceInsights:!0,performanceInsightsRetention:7,deletionProtection:!0,parameters:{max_connections:"500",innodb_buffer_pool_size:"{DBInstanceClassMemory*3/4}",slow_query_log:"1",long_query_time:"2"}}}:{postgres:{engine:"postgres",version:"15",instanceClass:"db.t3.medium",allocatedStorage:100,maxAllocatedStorage:500,multiAZ:!0,backupRetentionDays:14,preferredBackupWindow:"03:00-04:00",preferredMaintenanceWindow:"sun:04:00-sun:05:00",enablePerformanceInsights:!0,performanceInsightsRetention:7,deletionProtection:!0,parameters:{max_connections:"500",shared_buffers:"{DBInstanceClassMemory/4}",log_min_duration_statement:"2000"}}},cache:S==="redis"?{redis:{nodeType:"cache.t3.medium",numCacheNodes:2,engine:"redis",engineVersion:"7.0",port:6379,parameterGroup:{maxmemoryPolicy:"allkeys-lru",timeout:"300"},snapshotRetentionLimit:5,snapshotWindow:"03:00-05:00",automaticFailoverEnabled:!0}}:void 0,queues:{jobs:{fifo:!1,visibilityTimeout:900,messageRetentionPeriod:345600,receiveMessageWaitTime:20,deadLetterQueue:!0,maxReceiveCount:3},emails:{fifo:!1,visibilityTimeout:300,messageRetentionPeriod:86400,deadLetterQueue:!0}},functions:{"job-worker":{runtime:"nodejs20.x",handler:"dist/workers/jobs.handler",memory:2048,timeout:900,events:[{type:"sqs",queueName:`${_}-jobs`,batchSize:10}]},"email-sender":{runtime:"nodejs20.x",handler:"dist/workers/email.handler",memory:512,timeout:60,events:[{type:"sqs",queueName:`${_}-emails`,batchSize:10}]},cleanup:{runtime:"nodejs20.x",handler:"dist/tasks/cleanup.handler",memory:512,timeout:300,events:[{type:"schedule",expression:"cron(0 2 * * ? *)"}]}},monitoring:{dashboard:{name:`${_}-web-app`,widgets:[{type:"metric",metrics:["EC2CPUUtilization","ALBRequestCount","ALBTargetResponseTime","RDSCPUUtilization","RDSDatabaseConnections","RDSReadLatency","RDSWriteLatency"]}]},alarms:[{metric:"EC2CPUUtilization",threshold:80,evaluationPeriods:2},{metric:"RDSCPUUtilization",threshold:80,evaluationPeriods:2},{metric:"RDSDatabaseConnections",threshold:400,evaluationPeriods:1},{metric:"ALBTargetResponseTime",threshold:2000,evaluationPeriods:2},{metric:"ALBUnhealthyHostCount",threshold:1,evaluationPeriods:1}],logs:{retention:14,groups:[`${_}-app`,`${_}-nginx`,`${_}-workers`]}},security:{certificate:r?{domain:r,validationMethod:"DNS"}:void 0,waf:{enabled:!0,rules:["rateLimit","sqlInjection","xss","knownBadInputs"]},securityGroups:{alb:{ingress:[{port:80,protocol:"tcp",cidr:"0.0.0.0/0"},{port:443,protocol:"tcp",cidr:"0.0.0.0/0"}]},app:{ingress:[{port:3000,protocol:"tcp",source:"alb-sg"}]},database:{ingress:[{port:h==="mysql"?3306:5432,protocol:"tcp",source:"app-sg"}]},...S==="redis"&&{cache:{ingress:[{port:6379,protocol:"tcp",source:"app-sg"}]}}}}}}}function X4(E){let{name:T,slug:_,domain:r,repository:t,phpVersion:d="8.3",size:R="small",database:h=_.replace(/-/g,"_"),databasePassword:S,sslEmail:N,deployStrategy:A="push",provider:L="hetzner"}=E;return{project:{name:T,slug:_,region:"us-east-1"},mode:"server",cloud:{provider:L},environments:{production:{type:"production",domain:r}},infrastructure:{compute:{mode:"server",size:R,runtime:"php",webServer:"nginx",php:{versions:[d],default:d},managedServices:{mysql:!0,redis:!0},firewall:{enabled:!0},autoUpdates:!0,monitoring:!0,backups:{enabled:!0,schedule:"0 2 * * *",retentionCount:7}},appDatabase:{engine:"mysql",name:h,username:h,password:S}},sites:{main:{root:".",type:"laravel",domain:r,phpVersion:d,repository:{...t,strategy:A},scheduler:!0,queues:[{connection:"redis",queue:"default",processes:1}],ssl:{provider:"letsencrypt",email:N}}}}}function J4(E){let{name:T,slug:_,domain:r,layers:t,phpVersion:d="8.3",architecture:R="x86_64",memory:h=1024,build:S,deploy:N=["migrate --force"],cache:A="dynamodb",scheduler:L="on",region:O="us-east-1"}=E;return{project:{name:T,slug:_,region:O},mode:"serverless",environments:{production:{type:"production",domain:r,app:{kind:"php",runtime:"provided.al2023",phpVersion:d,architecture:R,layers:t,memory:h,build:S,deploy:N,assets:"public",queues:!0,scheduler:L,cache:{driver:A},domain:r}}}}}function z4(E){return{root:E.root??"packages/ui/dist",deploy:"server",type:"static",domain:E.domain,build:E.build??"cd packages/ui && bun install && bun run build",ssl:{provider:"letsencrypt"},auth:{username:E.username??"admin",password:E.password}}}function F4(E){let T=E.split(".").filter(Boolean);return T.length<=2?E:T.slice(-2).join(".")}function j4(E){let T=2166136261;for(let _=0;_<E.length;_++)T^=E.charCodeAt(_),T=Math.imul(T,16777619);return T>>>0}function vj(E){return uj+j4(E)%nj}function lj(E,T){let _=F4(E);if(_===E)return`dashboard.${_}`;for(let r of T)if(r===_)return`dashboard.${_}`;return`dashboard.${E}`}function ij(E,T){let _=[],r=E.infrastructure?.dns?.domain;if(r&&!E.cloud?.attachTo)_.push(r);if(T&&E.environments?.[T]?.domain)_.push(E.environments[T].domain);for(let t of Object.values(E.sites??{})){let d=t;if(!d||d.redirect)continue;let R=d.domain;if(typeof R==="string")_.push(R);else if(Array.isArray(R))_.push(...R.filter((h)=>typeof h==="string"))}return _.filter((t)=>t&&!t.startsWith("dashboard."))}function aj(E,T,_){if(_)return _;let r=ij(E,T),t=r[0];if(!t)return null;return lj(t,r)}function mj(E,T,_){if(_)return[_];let r=ij(E,T),t=[];for(let d of r){let R=lj(d,r);if(!t.includes(R))t.push(R)}return t}function Fh(E){return Object.entries(E.sites??{}).some(([T,_])=>{if(!_)return!1;let r=_.root??"";return Ac(T)||r==="ui/dist"||r.endsWith("/ui/dist")||r.endsWith("/dist/ui")})}function P$(E){return l$+E.replace(/^dashboard\./,"").replace(/\./g,"-")}function Ac(E){return E==="dashboard"||E.startsWith(l$)}function AL(E,T,_){if(Fh(E))return[];if(E.cloud?.attachTo)return[];let r=_.password?{auth:{username:_.username||"admin",password:_.password,realm:_.realm}}:{},t=_.build===!1||_.build===void 0?{}:{build:_.build};if(_.live!==!1){let R=aj(E,T,_.domain);if(!R)return[];let h=_.port??vj(R),S={root:_.uiRoot,deploy:"server",domain:R,preStart:["bun install --production --no-save"],start:`bun ${kj} dashboard:serve --box --host 127.0.0.1 --port ${h}`,port:h,env:{APP_ENV:"production",NODE_ENV:"production",TS_CLOUD_DASHBOARD_TELEMETRY:"1"},zeroDowntime:!1,sharedPaths:[bj],healthCheck:{path:"/login"},ssl:{provider:"letsencrypt"}};return[{name:P$(R),site:S}]}return mj(E,T,_.domain).map((R)=>({name:P$(R),site:{root:_.uiRoot,deploy:"server",type:"static",domain:R,ssl:{provider:"letsencrypt"},...t,...r}}))}function y4(E,T,_){return AL(E,T,_)[0]??null}function i$(E,T){let _={...E};for(let r in T){let t=T[r],d=_[r];if(t===void 0)continue;if(Array.isArray(t)&&Array.isArray(d))_[r]=[...d,...t];else if(typeof t==="object"&&t!==null&&!Array.isArray(t)&&typeof d==="object"&&d!==null&&!Array.isArray(d))_[r]=i$(d,t);else _[r]=t}return _}function W$(E,T){return i$(E,T)}function B4(...E){return E.reduce((T,_)=>i$(T,_),{})}function P4(E,T){return(_)=>{let r=E(_);if(typeof T==="function")return W$(r,T(r,_));return W$(r,T)}}function jh(E){return{infrastructure:E}}function W4(E){return jh({monitoring:E})}function H4(E){return jh({security:E})}function Y4(E){return jh({databases:E})}function f4(E){return jh({cache:E})}function G4(E){return jh({cdn:E})}function Q4(E){return jh({queues:E})}function Ey(){let E=process.env.AWS_ACCESS_KEY_ID,T=process.env.AWS_SECRET_ACCESS_KEY;if(!E||!T)return null;return{accessKeyId:E,secretAccessKey:T,sessionToken:process.env.AWS_SESSION_TOKEN}}function Ty(E){let T=E?.profile||process.env.AWS_PROFILE||"default",_=E?.credentialsFile||oj(pj(),".aws","credentials");if(!sj(_))return null;try{let r=a$(_,"utf-8");return M4(r,T)}catch{return null}}function M4(E,T){let _=E.split(`
+`}},storage:{uploads:{type:"efs",performanceMode:"generalPurpose",throughputMode:"bursting",encrypted:!0,lifecyclePolicy:{transitionToIA:30}},backups:{public:!1,versioning:!0,encryption:!0,lifecycleRules:[{id:"ArchiveOldBackups",enabled:!0,transitions:[{days:90,storageClass:"GLACIER"}]}]},static:{public:!0,versioning:!1,encryption:!1,cors:[{allowedOrigins:[r||"*"],allowedMethods:["GET","HEAD"]}]}},cdn:{enabled:!0,origins:[{originId:"static-assets",domainName:`${_}-static.s3.amazonaws.com`,pathPattern:"/static/*"}],customDomain:r?{domain:r,certificateArn:"TO_BE_GENERATED"}:void 0,cachePolicy:{minTTL:0,defaultTTL:86400,maxTTL:31536000},compress:!0,http3:!0},databases:h==="mysql"?{mysql:{engine:"mysql",version:"8.0",instanceClass:"db.t3.medium",allocatedStorage:100,maxAllocatedStorage:500,multiAZ:!0,backupRetentionDays:14,preferredBackupWindow:"03:00-04:00",preferredMaintenanceWindow:"sun:04:00-sun:05:00",enablePerformanceInsights:!0,performanceInsightsRetention:7,deletionProtection:!0,parameters:{max_connections:"500",innodb_buffer_pool_size:"{DBInstanceClassMemory*3/4}",slow_query_log:"1",long_query_time:"2"}}}:{postgres:{engine:"postgres",version:"15",instanceClass:"db.t3.medium",allocatedStorage:100,maxAllocatedStorage:500,multiAZ:!0,backupRetentionDays:14,preferredBackupWindow:"03:00-04:00",preferredMaintenanceWindow:"sun:04:00-sun:05:00",enablePerformanceInsights:!0,performanceInsightsRetention:7,deletionProtection:!0,parameters:{max_connections:"500",shared_buffers:"{DBInstanceClassMemory/4}",log_min_duration_statement:"2000"}}},cache:S==="redis"?{redis:{nodeType:"cache.t3.medium",numCacheNodes:2,engine:"redis",engineVersion:"7.0",port:6379,parameterGroup:{maxmemoryPolicy:"allkeys-lru",timeout:"300"},snapshotRetentionLimit:5,snapshotWindow:"03:00-05:00",automaticFailoverEnabled:!0}}:void 0,queues:{jobs:{fifo:!1,visibilityTimeout:900,messageRetentionPeriod:345600,receiveMessageWaitTime:20,deadLetterQueue:!0,maxReceiveCount:3},emails:{fifo:!1,visibilityTimeout:300,messageRetentionPeriod:86400,deadLetterQueue:!0}},functions:{"job-worker":{runtime:"nodejs20.x",handler:"dist/workers/jobs.handler",memory:2048,timeout:900,events:[{type:"sqs",queueName:`${_}-jobs`,batchSize:10}]},"email-sender":{runtime:"nodejs20.x",handler:"dist/workers/email.handler",memory:512,timeout:60,events:[{type:"sqs",queueName:`${_}-emails`,batchSize:10}]},cleanup:{runtime:"nodejs20.x",handler:"dist/tasks/cleanup.handler",memory:512,timeout:300,events:[{type:"schedule",expression:"cron(0 2 * * ? *)"}]}},monitoring:{dashboard:{name:`${_}-web-app`,widgets:[{type:"metric",metrics:["EC2CPUUtilization","ALBRequestCount","ALBTargetResponseTime","RDSCPUUtilization","RDSDatabaseConnections","RDSReadLatency","RDSWriteLatency"]}]},alarms:[{metric:"EC2CPUUtilization",threshold:80,evaluationPeriods:2},{metric:"RDSCPUUtilization",threshold:80,evaluationPeriods:2},{metric:"RDSDatabaseConnections",threshold:400,evaluationPeriods:1},{metric:"ALBTargetResponseTime",threshold:2000,evaluationPeriods:2},{metric:"ALBUnhealthyHostCount",threshold:1,evaluationPeriods:1}],logs:{retention:14,groups:[`${_}-app`,`${_}-nginx`,`${_}-workers`]}},security:{certificate:r?{domain:r,validationMethod:"DNS"}:void 0,waf:{enabled:!0,rules:["rateLimit","sqlInjection","xss","knownBadInputs"]},securityGroups:{alb:{ingress:[{port:80,protocol:"tcp",cidr:"0.0.0.0/0"},{port:443,protocol:"tcp",cidr:"0.0.0.0/0"}]},app:{ingress:[{port:3000,protocol:"tcp",source:"alb-sg"}]},database:{ingress:[{port:h==="mysql"?3306:5432,protocol:"tcp",source:"app-sg"}]},...S==="redis"&&{cache:{ingress:[{port:6379,protocol:"tcp",source:"app-sg"}]}}}}}}}function X4(E){let{name:T,slug:_,domain:r,repository:t,phpVersion:d="8.3",size:R="small",database:h=_.replace(/-/g,"_"),databasePassword:S,sslEmail:N,deployStrategy:A="push",provider:L="hetzner"}=E;return{project:{name:T,slug:_,region:"us-east-1"},mode:"server",cloud:{provider:L},environments:{production:{type:"production",domain:r}},infrastructure:{compute:{mode:"server",size:R,runtime:"php",webServer:"nginx",php:{versions:[d],default:d},managedServices:{mysql:!0,redis:!0},firewall:{enabled:!0},autoUpdates:!0,monitoring:!0,backups:{enabled:!0,schedule:"0 2 * * *",retentionCount:7}},appDatabase:{engine:"mysql",name:h,username:h,password:S}},sites:{main:{root:".",type:"laravel",domain:r,phpVersion:d,repository:{...t,strategy:A},scheduler:!0,queues:[{connection:"redis",queue:"default",processes:1}],ssl:{provider:"letsencrypt",email:N}}}}}function J4(E){let{name:T,slug:_,domain:r,layers:t,phpVersion:d="8.3",architecture:R="x86_64",memory:h=1024,build:S,deploy:N=["migrate --force"],cache:A="dynamodb",scheduler:L="on",region:O="us-east-1"}=E;return{project:{name:T,slug:_,region:O},mode:"serverless",environments:{production:{type:"production",domain:r,app:{kind:"php",runtime:"provided.al2023",phpVersion:d,architecture:R,layers:t,memory:h,build:S,deploy:N,assets:"public",queues:!0,scheduler:L,cache:{driver:A},domain:r}}}}}function z4(E){return{root:E.root??"packages/ui/dist",deploy:"server",type:"static",domain:E.domain,build:E.build??"cd packages/ui && bun install && bun run build",ssl:{provider:"letsencrypt"},auth:{username:E.username??"admin",password:E.password}}}function F4(E){let T=E.split(".").filter(Boolean);return T.length<=2?E:T.slice(-2).join(".")}function j4(E){let T=2166136261;for(let _=0;_<E.length;_++)T^=E.charCodeAt(_),T=Math.imul(T,16777619);return T>>>0}function vj(E){return uj+j4(E)%nj}function lj(E,T){let _=F4(E);if(_===E)return`dashboard.${_}`;for(let r of T)if(r===_)return`dashboard.${_}`;return`dashboard.${E}`}function ij(E,T){let _=[],r=E.infrastructure?.dns?.domain;if(r&&!E.cloud?.attachTo)_.push(r);if(T&&E.environments?.[T]?.domain)_.push(E.environments[T].domain);for(let t of Object.values(E.sites??{})){let d=t;if(!d||d.redirect)continue;let R=d.domain;if(typeof R==="string")_.push(R);else if(Array.isArray(R))_.push(...R.filter((h)=>typeof h==="string"))}return _.filter((t)=>t&&!t.startsWith("dashboard."))}function aj(E,T,_){if(_)return _;let r=ij(E,T),t=r[0];if(!t)return null;return lj(t,r)}function mj(E,T,_){if(_)return[_];let r=ij(E,T),t=[];for(let d of r){let R=lj(d,r);if(!t.includes(R))t.push(R)}return t}function Fh(E){return Object.entries(E.sites??{}).some(([T,_])=>{if(!_)return!1;let r=_.root??"";return Ac(T)||r==="ui/dist"||r.endsWith("/ui/dist")||r.endsWith("/dist/ui")})}function P$(E){return l$+E.replace(/^dashboard\./,"").replace(/\./g,"-")}function Ac(E){return E==="dashboard"||E.startsWith(l$)}function AL(E,T,_){if(Fh(E))return[];if(E.cloud?.attachTo)return[];let r=_.password?{auth:{username:_.username||"admin",password:_.password,realm:_.realm}}:{},t=_.build===!1||_.build===void 0?{}:{build:_.build};if(_.live!==!1){let R=aj(E,T,_.domain);if(!R)return[];let h=_.port??vj(R),S={root:_.uiRoot,deploy:"server",domain:R,preStart:["bun install --production --no-save"],start:`bun ${kj} --box --host 127.0.0.1 --port ${h}`,port:h,env:{APP_ENV:"production",NODE_ENV:"production",TS_CLOUD_DASHBOARD_TELEMETRY:"1"},zeroDowntime:!1,sharedPaths:[bj],healthCheck:{path:"/login"},ssl:{provider:"letsencrypt"}};return[{name:P$(R),site:S}]}return mj(E,T,_.domain).map((R)=>({name:P$(R),site:{root:_.uiRoot,deploy:"server",type:"static",domain:R,ssl:{provider:"letsencrypt"},...t,...r}}))}function y4(E,T,_){return AL(E,T,_)[0]??null}function i$(E,T){let _={...E};for(let r in T){let t=T[r],d=_[r];if(t===void 0)continue;if(Array.isArray(t)&&Array.isArray(d))_[r]=[...d,...t];else if(typeof t==="object"&&t!==null&&!Array.isArray(t)&&typeof d==="object"&&d!==null&&!Array.isArray(d))_[r]=i$(d,t);else _[r]=t}return _}function W$(E,T){return i$(E,T)}function B4(...E){return E.reduce((T,_)=>i$(T,_),{})}function P4(E,T){return(_)=>{let r=E(_);if(typeof T==="function")return W$(r,T(r,_));return W$(r,T)}}function jh(E){return{infrastructure:E}}function W4(E){return jh({monitoring:E})}function H4(E){return jh({security:E})}function Y4(E){return jh({databases:E})}function f4(E){return jh({cache:E})}function G4(E){return jh({cdn:E})}function Q4(E){return jh({queues:E})}function Ey(){let E=process.env.AWS_ACCESS_KEY_ID,T=process.env.AWS_SECRET_ACCESS_KEY;if(!E||!T)return null;return{accessKeyId:E,secretAccessKey:T,sessionToken:process.env.AWS_SESSION_TOKEN}}function Ty(E){let T=E?.profile||process.env.AWS_PROFILE||"default",_=E?.credentialsFile||oj(pj(),".aws","credentials");if(!sj(_))return null;try{let r=a$(_,"utf-8");return M4(r,T)}catch{return null}}function M4(E,T){let _=E.split(`
 `),r=null,t,d,R;for(let h of _){let S=h.trim();if(!S||S.startsWith("#")||S.startsWith(";"))continue;let N=S.match(/^\[([^\]]+)\]$/);if(N){if(r===T&&t&&d)return{accessKeyId:t,secretAccessKey:d,sessionToken:R};r=N[1],t=void 0,d=void 0,R=void 0;continue}if(r===T){let[A,...L]=S.split("="),O=L.join("=").trim();switch(A.trim().toLowerCase()){case"aws_access_key_id":t=O;break;case"aws_secret_access_key":d=O;break;case"aws_session_token":R=O;break}}}if(r===T&&t&&d)return{accessKeyId:t,secretAccessKey:d,sessionToken:R};return null}async function _y(E){let T=E?.timeout??1000,_="http://169.254.169.254";try{let r=await oA("http://169.254.169.254/latest/api/token",{method:"PUT",headers:{"X-aws-ec2-metadata-token-ttl-seconds":"21600"}},T);if(!r.ok)return null;let t=await r.text(),d=await oA("http://169.254.169.254/latest/meta-data/iam/security-credentials/",{headers:{"X-aws-ec2-metadata-token":t}},T);if(!d.ok)return null;let R=(await d.text()).trim(),h=await oA(`http://169.254.169.254/latest/meta-data/iam/security-credentials/${R}`,{headers:{"X-aws-ec2-metadata-token":t}},T);if(!h.ok)return null;let S=await h.json();return{accessKeyId:S.AccessKeyId,secretAccessKey:S.SecretAccessKey,sessionToken:S.Token,expiration:new Date(S.Expiration)}}catch{return null}}async function ry(E){let T=E?.timeout??1000,_=process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI,r=process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI,t=null;if(_)t=`http://169.254.170.2${_}`;else if(r)t=r;if(!t)return null;try{let d={},R=process.env.AWS_CONTAINER_AUTHORIZATION_TOKEN;if(R)d.Authorization=R;let h=await oA(t,{headers:d},T);if(!h.ok)return null;let S=await h.json();return{accessKeyId:S.AccessKeyId,secretAccessKey:S.SecretAccessKey,sessionToken:S.Token,expiration:new Date(S.Expiration)}}catch{return null}}async function ty(E){let T=E?.timeout??5000,_=process.env.AWS_WEB_IDENTITY_TOKEN_FILE,r=process.env.AWS_ROLE_ARN,t=process.env.AWS_ROLE_SESSION_NAME||"ts-cloud-session";if(!_||!r)return null;try{let d=a$(_,"utf-8").trim(),R=process.env.AWS_REGION||process.env.AWS_DEFAULT_REGION||"us-east-1",h=R.startsWith("us-gov")?`https://sts.${R}.amazonaws.com`:R==="us-east-1"?"https://sts.amazonaws.com":`https://sts.${R}.amazonaws.com`,S=new URLSearchParams({Action:"AssumeRoleWithWebIdentity",Version:"2011-06-15",RoleArn:r,RoleSessionName:t,WebIdentityToken:d}),N=await oA(`${h}/?${S.toString()}`,{method:"POST"},T);if(!N.ok)return null;let A=await N.text(),L=aA(A,"AccessKeyId"),O=aA(A,"SecretAccessKey"),c=aA(A,"SessionToken"),U=aA(A,"Expiration");if(!L||!O)return null;return{accessKeyId:L,secretAccessKey:O,sessionToken:c??void 0,expiration:U?new Date(U):void 0}}catch{return null}}async function LL(E){let T=Ey();if(T)return T;let _=Ty(E);if(_)return _;let r=await ty(E);if(r)return r;let t=await ry(E);if(t)return t;let d=await _y(E);if(d)return d;throw Error("Could not find AWS credentials. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, or configure ~/.aws/credentials, or run on an EC2 instance with an IAM role.")}function V4(E){let T=null,_=null;return async()=>{if(T){if(!T.expiration)return T;let r=300000;if(T.expiration.getTime()-Date.now()>r)return T}if(_)return _;return _=LL(E).then((r)=>{return T=r,_=null,r}).catch((r)=>{throw _=null,r}),_}}async function oA(E,T,_){let r=new AbortController,t=setTimeout(()=>r.abort(),_);try{let d=await fetch(E,{...T,signal:r.signal});return clearTimeout(t),d}catch(d){throw clearTimeout(t),d}}function aA(E,T){let _=new RegExp(`<${T}>([^<]+)</${T}>`),r=E.match(_);return r?r[1]:null}async function Lc(E){return LL({profile:E})}function dy(E){let T=process.env.AWS_REGION||process.env.AWS_DEFAULT_REGION;if(T)return T;let _=oj(pj(),".aws","config");if(sj(_))try{let r=a$(_,"utf-8"),t=E||process.env.AWS_PROFILE||"default",d=t==="default"?"[default]":`[profile ${t}]`,R=r.split(`
 `),h=!1;for(let S of R){let N=S.trim();if(N.startsWith("[")){h=N===d;continue}if(h&&N.startsWith("region")){let[,A]=N.split("=");if(A)return A.trim()}}}catch{}return"us-east-1"}async function Ry(E){let T=E||await LL(),_=dy(),{signRequest:r}=await RL().then(()=>Dj),t=_.startsWith("us-gov")?`https://sts.${_}.amazonaws.com`:_==="us-east-1"?"https://sts.amazonaws.com":`https://sts.${_}.amazonaws.com`,d="Action=GetCallerIdentity&Version=2011-06-15",R=r({method:"POST",url:t,body:"Action=GetCallerIdentity&Version=2011-06-15",headers:{"Content-Type":"application/x-www-form-urlencoded"},...T,service:"sts",region:_}),h=await fetch(R.url,{method:R.method,headers:R.headers,body:R.body});if(!h.ok)throw Error(`Failed to get account ID: ${await h.text()}`);let S=await h.text(),N=aA(S,"Account");if(!N)throw Error("Failed to parse account ID from response");return N}class hy{profile;credentials=null;region;constructor(E="us-east-1",T="default"){this.profile=T,this.region=E}async init(){if(this.credentials=await Lc(this.profile),this.credentials.region)this.region=this.credentials.region}async ensureCredentials(){if(!this.credentials)await this.init();return this.credentials}async request(E,T){let _=await this.ensureCredentials(),r={Action:E,Version:"2010-05-15",...H$(T)},t=new URLSearchParams(r).toString(),R=await(await Xh({method:"POST",url:`https://cloudformation.${this.region}.amazonaws.com/`,service:"cloudformation",region:this.region,headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t,accessKeyId:_.accessKeyId,secretAccessKey:_.secretAccessKey,sessionToken:_.sessionToken})).text();return K4(R)}async createStack(E){let T={StackName:E.stackName};if(E.templateBody)T.TemplateBody=E.templateBody;else if(E.templateURL)T.TemplateURL=E.templateURL;else throw Error("Either templateBody or templateURL must be provided");if(E.parameters)for(let[t,[d,R]]of Object.entries(E.parameters).entries())T[`Parameters.member.${t+1}.ParameterKey`]=d,T[`Parameters.member.${t+1}.ParameterValue`]=R;if(E.capabilities)for(let[t,d]of E.capabilities.entries())T[`Capabilities.member.${t+1}`]=d;if(E.tags)for(let[t,[d,R]]of Object.entries(E.tags).entries())T[`Tags.member.${t+1}.Key`]=d,T[`Tags.member.${t+1}.Value`]=R;if(E.timeoutInMinutes)T.TimeoutInMinutes=E.timeoutInMinutes;if(E.onFailure)T.OnFailure=E.onFailure;let _=await this.request("CreateStack",T);return(_?.CreateStackResult||_?.CreateStackResponse?.CreateStackResult||_)?.StackId}async updateStack(E){let T={StackName:E.stackName};if(E.templateBody)T.TemplateBody=E.templateBody;else if(E.templateURL)T.TemplateURL=E.templateURL;if(E.parameters)for(let[t,[d,R]]of Object.entries(E.parameters).entries())T[`Parameters.member.${t+1}.ParameterKey`]=d,T[`Parameters.member.${t+1}.ParameterValue`]=R;if(E.capabilities)for(let[t,d]of E.capabilities.entries())T[`Capabilities.member.${t+1}`]=d;if(E.tags)for(let[t,[d,R]]of Object.entries(E.tags).entries())T[`Tags.member.${t+1}.Key`]=d,T[`Tags.member.${t+1}.Value`]=R;let _=await this.request("UpdateStack",T);return(_?.UpdateStackResult||_?.UpdateStackResponse?.UpdateStackResult||_)?.StackId}async deleteStack(E){await this.request("DeleteStack",{StackName:E})}async describeStack(E){let T=await this.request("DescribeStacks",{StackName:E}),r=(T?.DescribeStacksResult||T?.DescribeStacksResponse?.DescribeStacksResult||T)?.Stacks?.member,t=Array.isArray(r)?r[0]:r;if(!t)throw Error(`Stack ${E} not found`);return Z4(t)}async listStacks(E){let T={};if(E)for(let[r,t]of E.entries())T[`StackStatusFilter.member.${r+1}`]=t;let _=await this.request("ListStacks",T);return g4(_)}async describeStackEvents(E){let T=await this.request("DescribeStackEvents",{StackName:E});return q4(T)}async waitForStack(E,T,_){let d=0,R=null;while(d<360){d++;let h=await this.describeStack(E);if(_)try{let S=await this.describeStackEvents(E),N=[];if(R){for(let A of S){if(A.EventId===R)break;N.push(A)}N.reverse()}else if(S.length>0)N=[S[0]];for(let A of N)_(A);if(S.length>0)R=S[0].EventId}catch{}if(h.StackStatus&&T.includes(h.StackStatus))return h;if(h.StackStatus?.includes("FAILED")||h.StackStatus?.includes("ROLLBACK"))throw Error(`Stack reached failed state: ${h.StackStatus}
 Reason: ${h.StackStatusReason||"Unknown"}`);await new Promise((S)=>setTimeout(S,5000))}throw Error(`Timeout waiting for stack ${E} to complete`)}async waitForStackWithProgress(E,T,_){let t={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]}[T];if(!t)throw Error(`Unknown waiter: ${T}`);return this.waitForStack(E,t,_)}async createChangeSet(E){let T={StackName:E.stackName,ChangeSetName:E.changeSetName,ChangeSetType:"UPDATE"};if(E.templateBody)T.TemplateBody=E.templateBody;else if(E.templateURL)T.TemplateURL=E.templateURL;if(E.parameters)for(let[r,[t,d]]of Object.entries(E.parameters).entries())T[`Parameters.member.${r+1}.ParameterKey`]=t,T[`Parameters.member.${r+1}.ParameterValue`]=d;if(E.capabilities)for(let[r,t]of E.capabilities.entries())T[`Capabilities.member.${r+1}`]=t;return(await this.request("CreateChangeSet",T)).ChangeSetId}async executeChangeSet(E,T){await this.request("ExecuteChangeSet",{ChangeSetName:E,StackName:T})}async describeStacks(E){let T=typeof E==="string"?E:E.stackName;try{return{Stacks:[await this.describeStack(T)]}}catch{return{Stacks:[]}}}async getStackOutputs(E){let T=await this.request("DescribeStacks",{StackName:E}),r=(T?.DescribeStacksResult||T?.DescribeStacksResponse?.DescribeStacksResult||T)?.Stacks?.member,t=Array.isArray(r)?r[0]:r;if(!t)return{};let d={},R=t.Outputs?.member;if(R){let h=Array.isArray(R)?R:[R];for(let S of h)if(S.OutputKey&&S.OutputValue)d[S.OutputKey]=S.OutputValue}return d}}function H$(E,T=""){let _={};for(let[r,t]of Object.entries(E)){let d=T?`${T}.${r}`:r;if(Array.isArray(t))t.forEach((R,h)=>{if(typeof R==="object")Object.assign(_,H$(R,`${d}.${h+1}`));else _[`${d}.${h+1}`]=String(R)});else if(typeof t==="object"&&t!==null)Object.assign(_,H$(t,d));else if(t!==void 0&&t!==null)_[d]=String(t)}return _}function K4(E){E=E.replace(/<\?xml[^?]*\?>\s*/,"").trim();function T(t,d,R){let h=1,S=R,N=`<${d}`,A=`</${d}>`;while(S<t.length&&h>0){let L=t.indexOf(N,S),O=t.indexOf(A,S);if(O===-1)return-1;if(L!==-1&&L<O){let c=t[L+N.length];if(c===">"||c===" "||c==="/"){let U=t.indexOf(">",L);if(U!==-1&&t[U-1]==="/")S=U+1;else h++,S=U+1}else S=L+N.length}else{if(h--,h===0)return O;S=O+A.length}}return-1}function _(t,d){while(d<t.length&&/\s/.test(t[d]))d++;if(d>=t.length||t[d]!=="<"){let $=t.indexOf("<",d);if($===-1)return{value:t.slice(d).trim(),end:t.length};return{value:t.slice(d,$).trim(),end:$}}if(t[d+1]==="/")return{value:void 0,end:d};let R=t.slice(d).match(/^<(\w+)([^>]*?)\/?>/);if(!R)return{value:void 0,end:d+1};let h=R[1];if(R[0].endsWith("/>"))return{value:"",end:d+R[0].length};let N=d+R[0].length,A=`</${h}>`,L=T(t,h,N);if(L===-1)return{value:void 0,end:d+R[0].length};let O=t.slice(N,L).trim();if(!O.includes("<"))return{value:O,end:L+A.length};let c={},U=N;while(U<L){while(U<L&&/\s/.test(t[U]))U++;if(U>=L)break;if(t[U]!=="<"||t[U+1]==="/")break;let $=t.slice(U).match(/^<(\w+)/);if(!$)break;let I=$[1],w=_(t,U);if(w.value===void 0){U++;continue}if(I==="member"||c[I]!==void 0){if(!Array.isArray(c[I]))c[I]=c[I]!==void 0?[c[I]]:[];c[I].push(w.value)}else c[I]=w.value;U=w.end}return{value:c,end:L+A.length}}return _(E,0).value||{}}function Z4(E){return{StackName:E.StackName||"",StackId:E.StackId,StackStatus:E.StackStatus,CreationTime:E.CreationTime,LastUpdatedTime:E.LastUpdatedTime,StackStatusReason:E.StackStatusReason,Description:E.Description}}function g4(E){let _=(E?.ListStacksResult||E?.ListStacksResponse?.ListStacksResult||E)?.StackSummaries?.member;if(!_)return[];return(Array.isArray(_)?_:[_]).map((t)=>({StackName:t.StackName||"",StackId:t.StackId,StackStatus:t.StackStatus,CreationTime:t.CreationTime,LastUpdatedTime:t.LastUpdatedTime,StackStatusReason:t.StackStatusReason,Description:t.Description}))}function q4(E){let _=(E?.DescribeStackEventsResult||E?.DescribeStackEventsResponse?.DescribeStackEventsResult||E)?.StackEvents?.member;if(!_)return[];return(Array.isArray(_)?_:[_]).map((t)=>({StackId:t.StackId||"",EventId:t.EventId||"",StackName:t.StackName||"",LogicalResourceId:t.LogicalResourceId||"",PhysicalResourceId:t.PhysicalResourceId,ResourceType:t.ResourceType||"",Timestamp:t.Timestamp||"",ResourceStatus:t.ResourceStatus||"",ResourceStatusReason:t.ResourceStatusReason}))}class m${region;endpoint;forcePathStyle;credentials;credentialOptions;retryOptions;constructor(E={}){this.region=E.region||process.env.AWS_REGION||"us-east-1",this.endpoint=E.endpoint||`https://s3.${this.region}.amazonaws.com`,this.forcePathStyle=E.forcePathStyle||!1,this.credentials=E.credentials,this.credentialOptions=E.credentialOptions,this.retryOptions=E.retryOptions||{}}async getCredentials(){if(this.credentials)return this.credentials;return LL(this.credentialOptions)}buildUrl(E,T){let _=T?encodeURIComponent(T).replace(/%2F/g,"/"):"";if(this.forcePathStyle)return T?`${this.endpoint}/${E}/${_}`:`${this.endpoint}/${E}`;let r=new URL(this.endpoint);return r.hostname=`${E}.${r.hostname}`,T?`${r.origin}/${_}`:r.origin}async get(E,T,_={}){let r=await this.getCredentials(),t=this.buildUrl(E,T),d={};if(_.range)d.Range=_.range;if(_.ifModifiedSince)d["If-Modified-Since"]=_.ifModifiedSince.toUTCString();if(_.ifMatch)d["If-Match"]=_.ifMatch;if(_.ifNoneMatch)d["If-None-Match"]=_.ifNoneMatch;let R=new URL(t);if(_.responseContentType)R.searchParams.set("response-content-type",_.responseContentType);if(_.responseContentDisposition)R.searchParams.set("response-content-disposition",_.responseContentDisposition);let h=W_({method:"GET",url:R.toString(),headers:d,...r,service:"s3",region:this.region}),S=await fetch(h.url,{method:h.method,headers:h.headers});if(!S.ok&&S.status!==304){let N=await S.text();throw new tr(`Failed to get object: ${N}`,S.status,E,T)}return S}async getText(E,T,_={}){return(await this.get(E,T,_)).text()}async getJSON(E,T,_={}){return(await this.get(E,T,_)).json()}async getBuffer(E,T,_={}){return(await this.get(E,T,_)).arrayBuffer()}async put(E,T,_,r={}){let t,d;if(typeof _==="string")t=new TextEncoder().encode(_).length,d=_;else if(_ instanceof ArrayBuffer)t=_.byteLength,d=_;else if(_ instanceof Uint8Array)t=_.byteLength,d=_;else if(_ instanceof Blob)t=_.size,d=_;else return this.uploadMultipart(E,T,_,{...r,partSize:X$});if(t>b4){let R=n4(d).stream();return this.uploadMultipart(E,T,R,{...r,partSize:X$})}return this.putSimple(E,T,d,t,r)}async putSimple(E,T,_,r,t){let d=await this.getCredentials(),R=this.buildUrl(E,T),h={"Content-Length":String(r),"Content-Type":t.contentType||Oj(T)};if(t.contentEncoding)h["Content-Encoding"]=t.contentEncoding;if(t.cacheControl)h["Cache-Control"]=t.cacheControl;if(t.contentDisposition)h["Content-Disposition"]=t.contentDisposition;if(t.storageClass)h["x-amz-storage-class"]=t.storageClass;if(t.serverSideEncryption)h["x-amz-server-side-encryption"]=t.serverSideEncryption;if(t.acl)h["x-amz-acl"]=t.acl;if(t.tagging)h["x-amz-tagging"]=t.tagging;if(t.metadata)for(let[O,c]of Object.entries(t.metadata))h[`x-amz-meta-${O.toLowerCase()}`]=c;let S;if(typeof _==="string")S=_;else if(_ instanceof Blob)S=await _.text();else S=new TextDecoder().decode(_ instanceof ArrayBuffer?new Uint8Array(_):_);let N=W_({method:"PUT",url:R,headers:h,body:S,...d,service:"s3",region:this.region}),A=await fetch(N.url,{method:N.method,headers:N.headers,body:_});if(!A.ok){let O=await A.text();throw new tr(`Failed to put object: ${O}`,A.status,E,T)}return{etag:(A.headers.get("ETag")||"").replace(/"/g,"")}}async delete(E,T){let _=await this.getCredentials(),r=this.buildUrl(E,T),t=W_({method:"DELETE",url:r,..._,service:"s3",region:this.region}),d=await fetch(t.url,{method:t.method,headers:t.headers});if(!d.ok&&d.status!==204){let R=await d.text();throw new tr(`Failed to delete object: ${R}`,d.status,E,T)}}async deleteMany(E,T){let _=await this.getCredentials(),r=`${this.buildUrl(E)}?delete`,d=`<?xml version="1.0" encoding="UTF-8"?><Delete><Quiet>false</Quiet>${T.map((U)=>`<Object><Key>${u4(U)}</Key></Object>`).join("")}</Delete>`,R=W_({method:"POST",url:r,headers:{"Content-Type":"application/xml"},body:d,..._,service:"s3",region:this.region}),h=await fetch(R.url,{method:R.method,headers:R.headers,body:d});if(!h.ok){let U=await h.text();throw new tr(`Failed to delete objects: ${U}`,h.status,E)}let S=await h.text(),N=[],A=[],L=/<Deleted><Key>([^<]+)<\/Key>/g,O;while((O=L.exec(S))!==null)N.push(O[1]);let c=/<Error><Key>([^<]+)<\/Key><Code>([^<]+)<\/Code><Message>([^<]+)<\/Message>/g;while((O=c.exec(S))!==null)A.push({key:O[1],error:`${O[2]}: ${O[3]}`});return{deleted:N,errors:A}}async list(E,T={}){let _=await this.getCredentials(),r=new URL(this.buildUrl(E));if(r.searchParams.set("list-type","2"),T.prefix)r.searchParams.set("prefix",T.prefix);if(T.delimiter)r.searchParams.set("delimiter",T.delimiter);if(T.maxKeys)r.searchParams.set("max-keys",String(T.maxKeys));if(T.continuationToken)r.searchParams.set("continuation-token",T.continuationToken);if(T.startAfter)r.searchParams.set("start-after",T.startAfter);let t=W_({method:"GET",url:r.toString(),..._,service:"s3",region:this.region}),d=await fetch(t.url,{method:t.method,headers:t.headers});if(!d.ok){let h=await d.text();throw new tr(`Failed to list objects: ${h}`,d.status,E)}let R=await d.text();return k4(R)}async*listAll(E,T={}){let _;do{let r=await this.list(E,{...T,continuationToken:_});for(let t of r.contents)yield t;_=r.nextContinuationToken}while(_)}async head(E,T){let _=await this.getCredentials(),r=this.buildUrl(E,T),t=W_({method:"HEAD",url:r,..._,service:"s3",region:this.region}),d=await fetch(t.url,{method:t.method,headers:t.headers});if(d.status===404)return null;if(!d.ok){let h=await d.text();throw new tr(`Failed to head object: ${h}`,d.status,E,T)}let R={};return d.headers.forEach((h,S)=>{if(S.toLowerCase().startsWith("x-amz-meta-"))R[S.slice(11)]=h}),{contentLength:Number(d.headers.get("Content-Length")||0),contentType:d.headers.get("Content-Type")||"application/octet-stream",etag:(d.headers.get("ETag")||"").replace(/"/g,""),lastModified:new Date(d.headers.get("Last-Modified")||0),metadata:R,storageClass:d.headers.get("x-amz-storage-class")||void 0,serverSideEncryption:d.headers.get("x-amz-server-side-encryption")||void 0}}async exists(E,T){return await this.head(E,T)!==null}async copy(E,T,_,r,t={}){let d=await this.getCredentials(),R=this.buildUrl(_,r),h={"x-amz-copy-source":`/${E}/${encodeURIComponent(T)}`};if(t.metadataDirective)h["x-amz-metadata-directive"]=t.metadataDirective;if(t.contentType)h["Content-Type"]=t.contentType;if(t.storageClass)h["x-amz-storage-class"]=t.storageClass;if(t.acl)h["x-amz-acl"]=t.acl;if(t.metadata)for(let[c,U]of Object.entries(t.metadata))h[`x-amz-meta-${c.toLowerCase()}`]=U;let S=W_({method:"PUT",url:R,headers:h,...d,service:"s3",region:this.region}),N=await fetch(S.url,{method:S.method,headers:S.headers});if(!N.ok){let c=await N.text();throw new tr(`Failed to copy object: ${c}`,N.status,_,r)}let L=(await N.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:L?L[1]:""}}async getPresignedUrl(E,T,_={}){let r=await this.getCredentials(),t=this.buildUrl(E,T);return f$({url:t,method:_.method||"GET",expiresIn:_.expiresIn||3600,...r,service:"s3",region:this.region})}async uploadMultipart(E,T,_,r={}){let t=await this.getCredentials(),d=Math.max(r.partSize||X$,x4),R,h;if(_ instanceof ReadableStream)R=_;else if(_ instanceof Blob)R=_.stream(),h=_.size;else{let A=new Blob([_]);R=A.stream(),h=A.size}let{uploadId:S,baseUrl:N}=await this.initiateMultipartUpload(E,T,r);try{let A=await this.uploadParts(E,T,N,S,R,d,t,h,r.concurrency||4,r.onProgress);return await this.completeMultipartUpload(E,T,N,S,A)}catch(A){throw await this.abortMultipartUpload(E,T,S,N).catch(()=>{}),A}}async initiateMultipartUpload(E,T,_){let r=await this.getCredentials(),t=this.buildUrl(E,T),d=`${t}?uploads`,R={"Content-Type":_.contentType||Oj(T)};if(_.storageClass)R["x-amz-storage-class"]=_.storageClass;if(_.serverSideEncryption)R["x-amz-server-side-encryption"]=_.serverSideEncryption;if(_.acl)R["x-amz-acl"]=_.acl;if(_.metadata)for(let[O,c]of Object.entries(_.metadata))R[`x-amz-meta-${O.toLowerCase()}`]=c;let h=W_({method:"POST",url:d,headers:R,...r,service:"s3",region:this.region}),S=await fetch(h.url,{method:h.method,headers:h.headers});if(!S.ok){let O=await S.text();throw new tr(`Failed to initiate multipart upload: ${O}`,S.status,E,T)}let A=(await S.text()).match(/<UploadId>([^<]+)<\/UploadId>/);if(!A)throw new tr("Failed to parse upload ID from response",0,E,T);let L=t;if(S.url)try{let O=new URL(S.url);O.search="",L=O.toString()}catch{}return{uploadId:A[1],baseUrl:L}}async uploadParts(E,T,_,r,t,d,R,h,S,N){let A=[],L=t.getReader(),O=1,c=new Uint8Array(0),U=0,$=h?Math.ceil(h/d):void 0,I=new Map,w=async(F,j)=>{let Y=`${_}?partNumber=${j}&uploadId=${encodeURIComponent(r)}`,H={"Content-Length":String(F.byteLength),"x-amz-content-sha256":"UNSIGNED-PAYLOAD"},Q=W_({method:"PUT",url:Y,headers:H,...R,service:"s3",region:this.region}),K=await fetch(Q.url,{method:Q.method,headers:Q.headers,body:F,redirect:"error"});if(!K.ok){let k=await K.text();throw new tr(`Failed to upload part ${j}: ${k}`,K.status,E,T)}let x=(K.headers.get("ETag")||"").replace(/"/g,"");if(!x)throw new tr(`Missing ETag for part ${j}`,K.status,E,T);return{partNumber:j,etag:x}},z=async()=>{let F=await Promise.race(I.values());I.delete(F.partNumber),A.push(F)};while(!0){let{done:F,value:j}=await L.read();if(j){let Y=new Uint8Array(c.length+j.length);Y.set(c),Y.set(j,c.length),c=Y}while(c.length>=d||F&&c.length>0){let Y=c.slice(0,d);c=c.slice(d);let H=O++;if(I.size>=S)await z();if(I.set(H,w(Y,H)),U+=Y.byteLength,N)N({loaded:U,total:h||U,part:H,totalParts:$||H})}if(F)break}while(I.size>0)await z();return A.sort((F,j)=>F.partNumber-j.partNumber),A}async completeMultipartUpload(E,T,_,r,t){let d=await this.getCredentials(),R=`${_}?uploadId=${encodeURIComponent(r)}`,S=`<?xml version="1.0" encoding="UTF-8"?><CompleteMultipartUpload>${t.map((U)=>`<Part><PartNumber>${U.partNumber}</PartNumber><ETag>"${U.etag}"</ETag></Part>`).join("")}</CompleteMultipartUpload>`,N=W_({method:"POST",url:R,headers:{"Content-Type":"application/xml"},body:S,...d,service:"s3",region:this.region}),A=await fetch(N.url,{method:N.method,headers:N.headers,body:S});if(!A.ok){let U=await A.text();throw new tr(`Failed to complete multipart upload: ${U}`,A.status,E,T)}let O=(await A.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:O?O[1]:""}}async abortMultipartUpload(E,T,_,r){let t=await this.getCredentials(),d=`${r??this.buildUrl(E,T)}?uploadId=${encodeURIComponent(_)}`,R=W_({method:"DELETE",url:d,...t,service:"s3",region:this.region});await fetch(R.url,{method:R.method,headers:R.headers})}async emptyAndDeleteBucket(E){let _=[];for await(let R of this.listAll(E,{}))if(_.push(R.key),_.length>=1000)await this.deleteMany(E,_),_=[];if(_.length>0)await this.deleteMany(E,_);let r=await this.getCredentials(),t=this.buildUrl(E),d=W_({method:"DELETE",url:t,...r,service:"s3",region:this.region});await fetch(d.url,{method:d.method,headers:d.headers})}}function k4(E){let T=[],_=[],r=/<Contents>([\s\S]*?)<\/Contents>/g,t;while((t=r.exec(E))!==null){let R=t[1];T.push({key:br(R,"Key")||"",lastModified:new Date(br(R,"LastModified")||0),etag:(br(R,"ETag")||"").replace(/"/g,""),size:Number(br(R,"Size")||0),storageClass:br(R,"StorageClass")||"STANDARD"})}let d=/<CommonPrefixes><Prefix>([^<]+)<\/Prefix><\/CommonPrefixes>/g;while((t=d.exec(E))!==null)_.push(t[1]);return{contents:T,commonPrefixes:_,isTruncated:br(E,"IsTruncated")==="true",continuationToken:br(E,"ContinuationToken")||void 0,nextContinuationToken:br(E,"NextContinuationToken")||void 0,keyCount:Number(br(E,"KeyCount")||0),maxKeys:Number(br(E,"MaxKeys")||1000),prefix:br(E,"Prefix")||void 0,delimiter:br(E,"Delimiter")||void 0}}function br(E,T){let _=new RegExp(`<${T}>([^<]*)</${T}>`),r=E.match(_);return r?r[1]:null}function u4(E){return E.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}function Oj(E){let T=E.split(".").pop()?.toLowerCase();return{html:"text/html",htm:"text/html",css:"text/css",js:"application/javascript",mjs:"application/javascript",json:"application/json",xml:"application/xml",txt:"text/plain",md:"text/markdown",csv:"text/csv",jpg:"image/jpeg",jpeg:"image/jpeg",png:"image/png",gif:"image/gif",webp:"image/webp",svg:"image/svg+xml",ico:"image/x-icon",avif:"image/avif",mp4:"video/mp4",webm:"video/webm",mov:"video/quicktime",avi:"video/x-msvideo",mp3:"audio/mpeg",wav:"audio/wav",ogg:"audio/ogg",pdf:"application/pdf",doc:"application/msword",docx:"application/vnd.openxmlformats-officedocument.wordprocessingml.document",xls:"application/vnd.ms-excel",xlsx:"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",ppt:"application/vnd.ms-powerpoint",pptx:"application/vnd.openxmlformats-officedocument.presentationml.presentation",zip:"application/zip",gz:"application/gzip",tar:"application/x-tar",rar:"application/vnd.rar","7z":"application/x-7z-compressed",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",eot:"application/vnd.ms-fontobject",wasm:"application/wasm"}[T||""]||"application/octet-stream"}function n4(E){if(E instanceof Blob)return E;if(typeof E==="string")return new Blob([E],{type:"text/plain"});return new Blob([E])}function v4(E){return new m$(E)}class Sy{profile;credentials=null;constructor(E="default"){this.profile=E}async init(){this.credentials=await Lc(this.profile)}async ensureCredentials(){if(!this.credentials)await this.init();return this.credentials}async createInvalidation(E){let T=await this.ensureCredentials(),_=E.callerReference||`invalidation-${Date.now()}`,r=`<?xml version="1.0" encoding="UTF-8"?>
@@ -3839,7 +3839,7 @@ decorate_workers_output = no
 php_admin_value[error_log] = /dev/stderr
 php_admin_flag[log_errors] = on
 clear_env = no
-`}function eZ(){return oy(OZ(cZ(import.meta.url)),"runtime-assets")}function dL(){let E=eZ(),T=(_)=>LZ(oy(E,_),"utf-8");return[{path:"bootstrap",contents:T("bootstrap"),mode:493},{path:"tscloud/runtime.php",contents:T("runtime.php"),mode:420},{path:"tscloud/octane-runtime.php",contents:T("octane-runtime.php"),mode:420},{path:"tscloud/cli-runtime.php",contents:T("cli-runtime.php"),mode:420},{path:"tscloud/fastcgi-client.php",contents:T("fastcgi-client.php"),mode:420},{path:"tscloud/php-fpm.conf",contents:py(),mode:420}]}function XI(E={}){let T=E.cacheDriver??"dynamodb";return{APP_ENV:"production",LOG_CHANNEL:"stderr",CACHE_STORE:T,CACHE_DRIVER:T,SESSION_DRIVER:T,QUEUE_CONNECTION:"sqs",FILESYSTEM_DISK:"s3",VIEW_COMPILED_PATH:"/tmp/storage/framework/views",APP_SERVICES_CACHE:"/tmp/bootstrap/cache/services.php",APP_PACKAGES_CACHE:"/tmp/bootstrap/cache/packages.php",APP_CONFIG_CACHE:"/tmp/bootstrap/cache/config.php",APP_ROUTES_CACHE:"/tmp/bootstrap/cache/routes.php",APP_EVENTS_CACHE:"/tmp/bootstrap/cache/events.php"}}function*_B(E){for(let T of IZ(E)){let _=KS(E,T);if(TB(_).isDirectory())yield*_B(_);else yield _}}function FZ(E={}){let T=E.architecture??"x86_64",_=E.platform??(T==="arm64"?"linux/arm64":"linux/amd64"),r=E.onStep??(()=>{}),t=$Z(KS(JZ(),"tscloud-php-layer-")),d="tscloud-php-layer:build";try{XZ(KS(t,"Dockerfile"),qy(E)),r("Building PHP runtime image (docker)"),aO("docker",["build","--platform",_,"-t","tscloud-php-layer:build",t],{stdio:"inherit"}),r("Extracting /opt/php from image");let R=aO("docker",["create","--platform",_,"tscloud-php-layer:build"],{encoding:"utf-8"}).trim(),h=KS(t,"opt");DZ(h,{recursive:!0});try{aO("docker",["cp",`${R}:/opt/php`,KS(h,"php")],{stdio:"inherit"})}finally{aO("docker",["rm",R],{stdio:"ignore"})}if(!UZ(KS(h,"php","bin","php")))throw Error("layer build produced no /opt/php/bin/php");let S=[];for(let O of _B(h)){let c=zZ(h,O).replace(/\\/g,"/"),U=TB(O).mode&73?493:420;S.push({name:c,data:wZ(O),mode:U})}r("Injecting runtime assets");let N=new Set(dL().map((O)=>O.path)),A=S.filter((O)=>!N.has(O.name));for(let O of dL())A.push({name:O.path,data:O.contents,mode:O.mode});return r("Packaging layer ZIP"),{zip:kS(A),architecture:T,fileCount:A.length}}finally{CZ(t,{recursive:!0,force:!0})}}function HZ(E,T){return T.some((_)=>E===_||E.startsWith(`${_}/`))}function*RB(E,T,_){for(let r of BZ(E)){let t=WZ(E,r),d=tB(T,t).replace(/\\/g,"/");if(HZ(d,_))continue;if(rB(t).isDirectory())yield*RB(t,T,_);else yield t}}function Ic(E){if(E.skipBuild)return;let T=JI(E.projectRoot??process.cwd()),_=E.app.build??EB;for(let r of _)E.onStep?.(`build: ${r}`),jZ(r,{stdio:"inherit",cwd:T})}function wc(E,T=[]){let _=JI(E),r=[...dB,hL(),...T],t=[];for(let d of RB(_,_,r)){let R=tB(_,d).replace(/\\/g,"/"),h=(rB(d).mode&73)!==0;t.push({name:R,data:PZ(d),mode:h?493:420})}return t}function zI(E){let T=JI(E.projectRoot??process.cwd());Ic(E),E.onStep?.("packaging application tree");let _=wc(T,E.exclude);if(!_.length)throw Error(`No files to package under ${T}`);let r=kS(_),t=E.app.handlers?.http??"public/index.php";return{zip:r,sha256:yZ("sha256").update(r).digest("hex"),handlers:{http:t,queue:E.app.handlers?.queue??t,cli:E.app.handlers?.cli??t},fileCount:_.length}}class FI{optimizations=new Map;imageConfigs=new Map;ssgConfigs=new Map;prerenderConfigs=new Map;counter=0;createAssetOptimization(E){let T=`asset-opt-${Date.now()}-${this.counter++}`,_={id:T,...E};return this.optimizations.set(T,_),_}createImageOptimization(E){let T=`image-opt-${Date.now()}-${this.counter++}`,_={id:T,...E};return this.imageConfigs.set(T,_),_}createSSGConfig(E){let T=`ssg-${Date.now()}-${this.counter++}`,_={id:T,...E};return this.ssgConfigs.set(T,_),_}createPrerenderConfig(E){let T=`prerender-${Date.now()}-${this.counter++}`,_={id:T,...E};return this.prerenderConfigs.set(T,_),_}listOptimizations(){return Array.from(this.optimizations.values())}listImageConfigs(){return Array.from(this.imageConfigs.values())}clear(){this.optimizations.clear(),this.imageConfigs.clear(),this.ssgConfigs.clear(),this.prerenderConfigs.clear()}}class jI{policies=new Map;versioningConfigs=new Map;replicationRules=new Map;tieringConfigs=new Map;objectLocks=new Map;transferAcceleration=new Map;accessPoints=new Map;glacierConfigs=new Map;inventories=new Map;batchOps=new Map;eventNotifications=new Map;counter=0;createLifecyclePolicy(E,T){let _=`lifecycle-${Date.now()}-${this.counter++}`,r={id:_,transitions:E,expiration:T};return this.policies.set(_,r),r}enableVersioning(E=!1){let T=`versioning-${Date.now()}-${this.counter++}`,_={id:T,enabled:!0,mfaDelete:E};return this.versioningConfigs.set(T,_),_}createReplicationRule(E,T,_){let r=`replication-${Date.now()}-${this.counter++}`,t={id:r,sourceRegion:E,destRegion:T,destBucket:_};return this.replicationRules.set(r,t),t}createIntelligentTiering(E,T){let _=`tiering-${Date.now()}-${this.counter++}`,r={id:_,archiveDays:E,deepArchiveDays:T};return this.tieringConfigs.set(_,r),r}enableObjectLock(E){let T=`object-lock-${Date.now()}-${this.counter++}`,_={id:T,bucketName:E.bucketName,mode:E.mode||"COMPLIANCE",retentionDays:E.retentionDays,retentionYears:E.retentionYears,legalHoldEnabled:E.legalHoldEnabled||!1};return this.objectLocks.set(T,_),_}enableTransferAcceleration(E){let T=`transfer-accel-${Date.now()}-${this.counter++}`,_={id:T,bucketName:E,enabled:!0,endpoint:`${E}.s3-accelerate.amazonaws.com`};return this.transferAcceleration.set(T,_),_}createAccessPoint(E){let T=`access-point-${Date.now()}-${this.counter++}`,_={id:T,name:E.name,bucketName:E.bucketName,vpcId:E.vpcId,publicAccessBlock:E.publicAccessBlock!==!1,policy:E.policy};return this.accessPoints.set(T,_),_}createGlacierArchive(E){let T=`glacier-${Date.now()}-${this.counter++}`,_={id:T,bucketName:E.bucketName,archiveType:E.archiveType,transitionDays:E.transitionDays,restoreConfig:E.restoreTier?{tier:E.restoreTier,days:E.restoreDays||7}:void 0};return this.glacierConfigs.set(T,_),_}createInventory(E){let T=`inventory-${Date.now()}-${this.counter++}`,_={id:T,sourceBucket:E.sourceBucket,destinationBucket:E.destinationBucket,schedule:E.schedule||"Daily",format:E.format||"CSV",includedFields:E.includedFields||["Size","LastModifiedDate","StorageClass","ETag"],prefix:E.prefix};return this.inventories.set(T,_),_}createBatchOperation(E){let T=`batch-op-${Date.now()}-${this.counter++}`,_={id:T,operation:E.operation,manifestBucket:E.manifestBucket,manifestKey:E.manifestKey,priority:E.priority||10,status:"pending"};return this.batchOps.set(T,_),_}executeBatchOperation(E){let T=this.batchOps.get(E);if(!T)throw Error(`Batch operation not found: ${E}`);return T.status="in_progress",T.totalObjects=1000,T.processedObjects=0,T}getBatchOperationStatus(E){return this.batchOps.get(E)}createLambdaNotification(E){let T=`event-${Date.now()}-${this.counter++}`,_={id:T,bucketName:E.bucketName,events:E.events,destination:{type:"Lambda",arn:E.lambdaArn},filter:E.prefix||E.suffix?{prefix:E.prefix,suffix:E.suffix}:void 0};return this.eventNotifications.set(T,_),_}createSQSNotification(E){let T=`event-${Date.now()}-${this.counter++}`,_={id:T,bucketName:E.bucketName,events:E.events,destination:{type:"SQS",arn:E.queueArn},filter:E.prefix||E.suffix?{prefix:E.prefix,suffix:E.suffix}:void 0};return this.eventNotifications.set(T,_),_}createSNSNotification(E){let T=`event-${Date.now()}-${this.counter++}`,_={id:T,bucketName:E.bucketName,events:E.events,destination:{type:"SNS",arn:E.topicArn},filter:E.prefix||E.suffix?{prefix:E.prefix,suffix:E.suffix}:void 0};return this.eventNotifications.set(T,_),_}generateObjectLockCF(E){let T={ObjectLockEnabled:"Enabled",ObjectLockConfiguration:{ObjectLockEnabled:"Enabled",Rule:{DefaultRetention:{Mode:E.mode}}}};if(E.retentionDays)T.ObjectLockConfiguration.Rule.DefaultRetention.Days=E.retentionDays;if(E.retentionYears)T.ObjectLockConfiguration.Rule.DefaultRetention.Years=E.retentionYears;return T}generateTransferAccelerationCF(E){return{AccelerateConfiguration:{AccelerationStatus:E.enabled?"Enabled":"Suspended"}}}generateAccessPointCF(E){return{Type:"AWS::S3::AccessPoint",Properties:{Name:E.name,Bucket:E.bucketName,...E.vpcId&&{VpcConfiguration:{VpcId:E.vpcId}},PublicAccessBlockConfiguration:E.publicAccessBlock?{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}:void 0,...E.policy&&{Policy:E.policy}}}}generateInventoryCF(E){return{Type:"AWS::S3::Bucket",Properties:{InventoryConfigurations:[{Id:E.id,Destination:{BucketArn:`arn:aws:s3:::${E.destinationBucket}`,Format:E.format},Enabled:!0,IncludedObjectVersions:"Current",OptionalFields:E.includedFields,ScheduleFrequency:E.schedule,...E.prefix&&{Prefix:E.prefix}}]}}}generateEventNotificationCF(E){let T=E.destination.type==="Lambda"?"LambdaConfigurations":E.destination.type==="SQS"?"QueueConfigurations":"TopicConfigurations",_=E.destination.type==="Lambda"?"Function":E.destination.type==="SQS"?"Queue":"Topic",r={Event:E.events[0],[_]:E.destination.arn};if(E.filter)r.Filter={S3Key:{Rules:[...E.filter.prefix?[{Name:"prefix",Value:E.filter.prefix}]:[],...E.filter.suffix?[{Name:"suffix",Value:E.filter.suffix}]:[]]}};return{NotificationConfiguration:{[T]:[r]}}}clear(){this.policies.clear(),this.versioningConfigs.clear(),this.replicationRules.clear(),this.tieringConfigs.clear(),this.objectLocks.clear(),this.transferAcceleration.clear(),this.accessPoints.clear(),this.glacierConfigs.clear(),this.inventories.clear(),this.batchOps.clear(),this.eventNotifications.clear()}}class yI{checks=new Map;synthetics=new Map;uptimeTrackers=new Map;counter=0;createHealthCheck(E,T=30,_=10){let r=`health-${Date.now()}-${this.counter++}`,t={id:r,url:E,interval:T,timeout:_,status:"healthy"};return this.checks.set(r,t),t}createSyntheticMonitor(E,T,_,r){let t=`synthetic-${Date.now()}-${this.counter++}`,d={id:t,name:E,script:T,frequency:_,locations:r};return this.synthetics.set(t,d),d}trackUptime(E,T,_){let r=`uptime-${Date.now()}-${this.counter++}`,t=T/(T+_)*100,d={id:r,resource:E,uptime:T,downtime:_,availability:t};return this.uptimeTrackers.set(r,d),d}clear(){this.checks.clear(),this.synthetics.clear(),this.uptimeTrackers.clear()}}class BI{wafRules=new Map;shieldProtections=new Map;securityGroups=new Map;nacls=new Map;counter=0;createWAFRule(E,T,_,r){let t=`waf-${Date.now()}-${this.counter++}`,d={id:t,name:E,priority:T,action:_,conditions:r};return this.wafRules.set(t,d),d}enableShield(E,T="standard"){let _=`shield-${Date.now()}-${this.counter++}`,r={id:_,resourceArn:E,protectionType:T};return this.shieldProtections.set(_,r),r}createSecurityGroup(E,T,_){let r=`sg-${Date.now()}-${this.counter++}`,t={id:r,name:E,vpcId:T,rules:_};return this.securityGroups.set(r,t),t}createNACL(E,T){let _=`nacl-${Date.now()}-${this.counter++}`,r={id:_,vpcId:E,rules:T};return this.nacls.set(_,r),r}clear(){this.wafRules.clear(),this.shieldProtections.clear(),this.securityGroups.clear(),this.nacls.clear()}}class PI{strategies=new Map;allocations=new Map;groups=new Map;counter=0;createTaggingStrategy(E,T){let _=`tagging-${Date.now()}-${this.counter++}`,r={id:_,tags:E,resources:T};return this.strategies.set(_,r),r}createCostAllocation(E,T){let _=`cost-${Date.now()}-${this.counter++}`,r={id:_,tagKey:E,allocations:T};return this.allocations.set(_,r),r}createResourceGroup(E,T,_){let r=`group-${Date.now()}-${this.counter++}`,t={id:r,name:E,query:{resourceTypeFilters:T,tagFilters:_}};return this.groups.set(r,t),t}clear(){this.strategies.clear(),this.allocations.clear(),this.groups.clear()}}var G8,Q8=(E)=>E,Jh=(E,T)=>{for(var _ in T)G8(E,_,{get:T[_],enumerable:!0,configurable:!0,set:M8.bind(T,_)})},V8=(E,T)=>()=>(E&&(T=E(E=0)),T),K8,Dj,xS,zh,Yj=100,fj,RL,q8,x8,G$=".ts-cloud",Gj="TS_CLOUD_STATE_DIR",Qj=null,OE,TM,Lt,Mt,At,o_,xT,gE,UT,gj,x$=`
+`}function eZ(){return oy(OZ(cZ(import.meta.url)),"runtime-assets")}function dL(){let E=eZ(),T=(_)=>LZ(oy(E,_),"utf-8");return[{path:"bootstrap",contents:T("bootstrap"),mode:493},{path:"tscloud/runtime.php",contents:T("runtime.php"),mode:420},{path:"tscloud/octane-runtime.php",contents:T("octane-runtime.php"),mode:420},{path:"tscloud/cli-runtime.php",contents:T("cli-runtime.php"),mode:420},{path:"tscloud/fastcgi-client.php",contents:T("fastcgi-client.php"),mode:420},{path:"tscloud/php-fpm.conf",contents:py(),mode:420}]}function XI(E={}){let T=E.cacheDriver??"dynamodb";return{APP_ENV:"production",LOG_CHANNEL:"stderr",CACHE_STORE:T,CACHE_DRIVER:T,SESSION_DRIVER:T,QUEUE_CONNECTION:"sqs",FILESYSTEM_DISK:"s3",VIEW_COMPILED_PATH:"/tmp/storage/framework/views",APP_SERVICES_CACHE:"/tmp/bootstrap/cache/services.php",APP_PACKAGES_CACHE:"/tmp/bootstrap/cache/packages.php",APP_CONFIG_CACHE:"/tmp/bootstrap/cache/config.php",APP_ROUTES_CACHE:"/tmp/bootstrap/cache/routes.php",APP_EVENTS_CACHE:"/tmp/bootstrap/cache/events.php"}}function*_B(E){for(let T of IZ(E)){let _=KS(E,T);if(TB(_).isDirectory())yield*_B(_);else yield _}}function FZ(E={}){let T=E.architecture??"x86_64",_=E.platform??(T==="arm64"?"linux/arm64":"linux/amd64"),r=E.onStep??(()=>{}),t=$Z(KS(JZ(),"tscloud-php-layer-")),d="tscloud-php-layer:build";try{XZ(KS(t,"Dockerfile"),qy(E)),r("Building PHP runtime image (docker)"),aO("docker",["build","--platform",_,"-t","tscloud-php-layer:build",t],{stdio:"inherit"}),r("Extracting /opt/php from image");let R=aO("docker",["create","--platform",_,"tscloud-php-layer:build"],{encoding:"utf-8"}).trim(),h=KS(t,"opt");DZ(h,{recursive:!0});try{aO("docker",["cp",`${R}:/opt/php`,KS(h,"php")],{stdio:"inherit"})}finally{aO("docker",["rm",R],{stdio:"ignore"})}if(!UZ(KS(h,"php","bin","php")))throw Error("layer build produced no /opt/php/bin/php");let S=[];for(let O of _B(h)){let c=zZ(h,O).replace(/\\/g,"/"),U=TB(O).mode&73?493:420;S.push({name:c,data:wZ(O),mode:U})}r("Injecting runtime assets");let N=new Set(dL().map((O)=>O.path)),A=S.filter((O)=>!N.has(O.name));for(let O of dL())A.push({name:O.path,data:O.contents,mode:O.mode});return r("Packaging layer ZIP"),{zip:kS(A),architecture:T,fileCount:A.length}}finally{CZ(t,{recursive:!0,force:!0})}}function HZ(E,T){return T.some((_)=>E===_||E.startsWith(`${_}/`))}function*RB(E,T,_){for(let r of BZ(E)){let t=WZ(E,r),d=tB(T,t).replace(/\\/g,"/");if(HZ(d,_))continue;if(rB(t).isDirectory())yield*RB(t,T,_);else yield t}}function Ic(E){if(E.skipBuild)return;let T=JI(E.projectRoot??process.cwd()),_=E.app.build??EB;for(let r of _)E.onStep?.(`build: ${r}`),jZ(r,{stdio:"inherit",cwd:T})}function wc(E,T=[]){let _=JI(E),r=[...dB,hL(),...T],t=[];for(let d of RB(_,_,r)){let R=tB(_,d).replace(/\\/g,"/"),h=(rB(d).mode&73)!==0;t.push({name:R,data:PZ(d),mode:h?493:420})}return t}function zI(E){let T=JI(E.projectRoot??process.cwd());Ic(E),E.onStep?.("packaging application tree");let _=wc(T,E.exclude);if(!_.length)throw Error(`No files to package under ${T}`);let r=kS(_),t=E.app.handlers?.http??"public/index.php";return{zip:r,sha256:yZ("sha256").update(r).digest("hex"),handlers:{http:t,queue:E.app.handlers?.queue??t,cli:E.app.handlers?.cli??t},fileCount:_.length}}class FI{optimizations=new Map;imageConfigs=new Map;ssgConfigs=new Map;prerenderConfigs=new Map;counter=0;createAssetOptimization(E){let T=`asset-opt-${Date.now()}-${this.counter++}`,_={id:T,...E};return this.optimizations.set(T,_),_}createImageOptimization(E){let T=`image-opt-${Date.now()}-${this.counter++}`,_={id:T,...E};return this.imageConfigs.set(T,_),_}createSSGConfig(E){let T=`ssg-${Date.now()}-${this.counter++}`,_={id:T,...E};return this.ssgConfigs.set(T,_),_}createPrerenderConfig(E){let T=`prerender-${Date.now()}-${this.counter++}`,_={id:T,...E};return this.prerenderConfigs.set(T,_),_}listOptimizations(){return Array.from(this.optimizations.values())}listImageConfigs(){return Array.from(this.imageConfigs.values())}clear(){this.optimizations.clear(),this.imageConfigs.clear(),this.ssgConfigs.clear(),this.prerenderConfigs.clear()}}class jI{policies=new Map;versioningConfigs=new Map;replicationRules=new Map;tieringConfigs=new Map;objectLocks=new Map;transferAcceleration=new Map;accessPoints=new Map;glacierConfigs=new Map;inventories=new Map;batchOps=new Map;eventNotifications=new Map;counter=0;createLifecyclePolicy(E,T){let _=`lifecycle-${Date.now()}-${this.counter++}`,r={id:_,transitions:E,expiration:T};return this.policies.set(_,r),r}enableVersioning(E=!1){let T=`versioning-${Date.now()}-${this.counter++}`,_={id:T,enabled:!0,mfaDelete:E};return this.versioningConfigs.set(T,_),_}createReplicationRule(E,T,_){let r=`replication-${Date.now()}-${this.counter++}`,t={id:r,sourceRegion:E,destRegion:T,destBucket:_};return this.replicationRules.set(r,t),t}createIntelligentTiering(E,T){let _=`tiering-${Date.now()}-${this.counter++}`,r={id:_,archiveDays:E,deepArchiveDays:T};return this.tieringConfigs.set(_,r),r}enableObjectLock(E){let T=`object-lock-${Date.now()}-${this.counter++}`,_={id:T,bucketName:E.bucketName,mode:E.mode||"COMPLIANCE",retentionDays:E.retentionDays,retentionYears:E.retentionYears,legalHoldEnabled:E.legalHoldEnabled||!1};return this.objectLocks.set(T,_),_}enableTransferAcceleration(E){let T=`transfer-accel-${Date.now()}-${this.counter++}`,_={id:T,bucketName:E,enabled:!0,endpoint:`${E}.s3-accelerate.amazonaws.com`};return this.transferAcceleration.set(T,_),_}createAccessPoint(E){let T=`access-point-${Date.now()}-${this.counter++}`,_={id:T,name:E.name,bucketName:E.bucketName,vpcId:E.vpcId,publicAccessBlock:E.publicAccessBlock!==!1,policy:E.policy};return this.accessPoints.set(T,_),_}createGlacierArchive(E){let T=`glacier-${Date.now()}-${this.counter++}`,_={id:T,bucketName:E.bucketName,archiveType:E.archiveType,transitionDays:E.transitionDays,restoreConfig:E.restoreTier?{tier:E.restoreTier,days:E.restoreDays||7}:void 0};return this.glacierConfigs.set(T,_),_}createInventory(E){let T=`inventory-${Date.now()}-${this.counter++}`,_={id:T,sourceBucket:E.sourceBucket,destinationBucket:E.destinationBucket,schedule:E.schedule||"Daily",format:E.format||"CSV",includedFields:E.includedFields||["Size","LastModifiedDate","StorageClass","ETag"],prefix:E.prefix};return this.inventories.set(T,_),_}createBatchOperation(E){let T=`batch-op-${Date.now()}-${this.counter++}`,_={id:T,operation:E.operation,manifestBucket:E.manifestBucket,manifestKey:E.manifestKey,priority:E.priority||10,status:"pending"};return this.batchOps.set(T,_),_}executeBatchOperation(E){let T=this.batchOps.get(E);if(!T)throw Error(`Batch operation not found: ${E}`);return T.status="in_progress",T.totalObjects=1000,T.processedObjects=0,T}getBatchOperationStatus(E){return this.batchOps.get(E)}createLambdaNotification(E){let T=`event-${Date.now()}-${this.counter++}`,_={id:T,bucketName:E.bucketName,events:E.events,destination:{type:"Lambda",arn:E.lambdaArn},filter:E.prefix||E.suffix?{prefix:E.prefix,suffix:E.suffix}:void 0};return this.eventNotifications.set(T,_),_}createSQSNotification(E){let T=`event-${Date.now()}-${this.counter++}`,_={id:T,bucketName:E.bucketName,events:E.events,destination:{type:"SQS",arn:E.queueArn},filter:E.prefix||E.suffix?{prefix:E.prefix,suffix:E.suffix}:void 0};return this.eventNotifications.set(T,_),_}createSNSNotification(E){let T=`event-${Date.now()}-${this.counter++}`,_={id:T,bucketName:E.bucketName,events:E.events,destination:{type:"SNS",arn:E.topicArn},filter:E.prefix||E.suffix?{prefix:E.prefix,suffix:E.suffix}:void 0};return this.eventNotifications.set(T,_),_}generateObjectLockCF(E){let T={ObjectLockEnabled:"Enabled",ObjectLockConfiguration:{ObjectLockEnabled:"Enabled",Rule:{DefaultRetention:{Mode:E.mode}}}};if(E.retentionDays)T.ObjectLockConfiguration.Rule.DefaultRetention.Days=E.retentionDays;if(E.retentionYears)T.ObjectLockConfiguration.Rule.DefaultRetention.Years=E.retentionYears;return T}generateTransferAccelerationCF(E){return{AccelerateConfiguration:{AccelerationStatus:E.enabled?"Enabled":"Suspended"}}}generateAccessPointCF(E){return{Type:"AWS::S3::AccessPoint",Properties:{Name:E.name,Bucket:E.bucketName,...E.vpcId&&{VpcConfiguration:{VpcId:E.vpcId}},PublicAccessBlockConfiguration:E.publicAccessBlock?{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}:void 0,...E.policy&&{Policy:E.policy}}}}generateInventoryCF(E){return{Type:"AWS::S3::Bucket",Properties:{InventoryConfigurations:[{Id:E.id,Destination:{BucketArn:`arn:aws:s3:::${E.destinationBucket}`,Format:E.format},Enabled:!0,IncludedObjectVersions:"Current",OptionalFields:E.includedFields,ScheduleFrequency:E.schedule,...E.prefix&&{Prefix:E.prefix}}]}}}generateEventNotificationCF(E){let T=E.destination.type==="Lambda"?"LambdaConfigurations":E.destination.type==="SQS"?"QueueConfigurations":"TopicConfigurations",_=E.destination.type==="Lambda"?"Function":E.destination.type==="SQS"?"Queue":"Topic",r={Event:E.events[0],[_]:E.destination.arn};if(E.filter)r.Filter={S3Key:{Rules:[...E.filter.prefix?[{Name:"prefix",Value:E.filter.prefix}]:[],...E.filter.suffix?[{Name:"suffix",Value:E.filter.suffix}]:[]]}};return{NotificationConfiguration:{[T]:[r]}}}clear(){this.policies.clear(),this.versioningConfigs.clear(),this.replicationRules.clear(),this.tieringConfigs.clear(),this.objectLocks.clear(),this.transferAcceleration.clear(),this.accessPoints.clear(),this.glacierConfigs.clear(),this.inventories.clear(),this.batchOps.clear(),this.eventNotifications.clear()}}class yI{checks=new Map;synthetics=new Map;uptimeTrackers=new Map;counter=0;createHealthCheck(E,T=30,_=10){let r=`health-${Date.now()}-${this.counter++}`,t={id:r,url:E,interval:T,timeout:_,status:"healthy"};return this.checks.set(r,t),t}createSyntheticMonitor(E,T,_,r){let t=`synthetic-${Date.now()}-${this.counter++}`,d={id:t,name:E,script:T,frequency:_,locations:r};return this.synthetics.set(t,d),d}trackUptime(E,T,_){let r=`uptime-${Date.now()}-${this.counter++}`,t=T/(T+_)*100,d={id:r,resource:E,uptime:T,downtime:_,availability:t};return this.uptimeTrackers.set(r,d),d}clear(){this.checks.clear(),this.synthetics.clear(),this.uptimeTrackers.clear()}}class BI{wafRules=new Map;shieldProtections=new Map;securityGroups=new Map;nacls=new Map;counter=0;createWAFRule(E,T,_,r){let t=`waf-${Date.now()}-${this.counter++}`,d={id:t,name:E,priority:T,action:_,conditions:r};return this.wafRules.set(t,d),d}enableShield(E,T="standard"){let _=`shield-${Date.now()}-${this.counter++}`,r={id:_,resourceArn:E,protectionType:T};return this.shieldProtections.set(_,r),r}createSecurityGroup(E,T,_){let r=`sg-${Date.now()}-${this.counter++}`,t={id:r,name:E,vpcId:T,rules:_};return this.securityGroups.set(r,t),t}createNACL(E,T){let _=`nacl-${Date.now()}-${this.counter++}`,r={id:_,vpcId:E,rules:T};return this.nacls.set(_,r),r}clear(){this.wafRules.clear(),this.shieldProtections.clear(),this.securityGroups.clear(),this.nacls.clear()}}class PI{strategies=new Map;allocations=new Map;groups=new Map;counter=0;createTaggingStrategy(E,T){let _=`tagging-${Date.now()}-${this.counter++}`,r={id:_,tags:E,resources:T};return this.strategies.set(_,r),r}createCostAllocation(E,T){let _=`cost-${Date.now()}-${this.counter++}`,r={id:_,tagKey:E,allocations:T};return this.allocations.set(_,r),r}createResourceGroup(E,T,_){let r=`group-${Date.now()}-${this.counter++}`,t={id:r,name:E,query:{resourceTypeFilters:T,tagFilters:_}};return this.groups.set(r,t),t}clear(){this.strategies.clear(),this.allocations.clear(),this.groups.clear()}}var G9,Q9=(E)=>E,Jh=(E,T)=>{for(var _ in T)G9(E,_,{get:T[_],enumerable:!0,configurable:!0,set:M9.bind(T,_)})},V9=(E,T)=>()=>(E&&(T=E(E=0)),T),K9,Dj,xS,zh,Yj=100,fj,RL,q9,x9,G$=".ts-cloud",Gj="TS_CLOUD_STATE_DIR",Qj=null,OE,TM,Lt,Mt,At,o_,xT,gE,UT,gj,x$=`
 const { SNSClient, PublishCommand } = require('@aws-sdk/client-sns');
 const { DynamoDBClient, PutItemCommand } = require('@aws-sdk/client-dynamodb');
 
@@ -4663,7 +4663,7 @@ function resolveTemplate(template, data) {
   }
   return result;
 }
-`,DM,Er,Ot,FR,SL,zr,Nc,Jr,xj,NL,Tr,_r,$_,ZS,mT,JR,cd,B,_L,zM,bj,kj="./node_modules/@stacksjs/ts-cloud/dist/bin/cli.js",uj=20000,nj=12000,l$="dashboard-",x4=5242880,X$=5242880,b4=5242880,tr,gt,EL,CR,Ny,s$,Ay,Ly,p_,z$=null,yV,r1,GV,KV,R7,h7,S7,N7,A7,ct,z7,F7,Wy,j7,y7,v7,l7,i7,a7,m7,wh,s7,p7,tL,o7,EK,TK,_K,rK,tK,Ch,dK,RK,hK,SK,NK,AK,LK,OK,cK,eK,UK,DK,$K,IK,wK,CK,XK,JK,zK,FK,jK,yK,BK,PK,WK,HK,Hy,Ih,_I,rI,Yy,fy=`
+`,DM,Er,Ot,FR,SL,zr,Nc,Jr,xj,NL,Tr,_r,$_,ZS,mT,JR,cd,B,_L,zM,bj,kj="./node_modules/@stacksjs/ts-cloud/dist/bin/dashboard-server.js",uj=20000,nj=12000,l$="dashboard-",x4=5242880,X$=5242880,b4=5242880,tr,gt,EL,CR,Ny,s$,Ay,Ly,p_,z$=null,yV,r1,GV,KV,R7,h7,S7,N7,A7,ct,z7,F7,Wy,j7,y7,v7,l7,i7,a7,m7,wh,s7,p7,tL,o7,EK,TK,_K,rK,tK,Ch,dK,RK,hK,SK,NK,AK,LK,OK,cK,eK,UK,DK,$K,IK,wK,CK,XK,JK,zK,FK,jK,yK,BK,PK,WK,HK,Hy,Ih,_I,rI,Yy,fy=`
 const { S3Client, GetObjectCommand, PutObjectCommand, CopyObjectCommand } = require('@aws-sdk/client-s3');
 const s3 = new S3Client({});
 
@@ -4821,7 +4821,7 @@ catch (error) {
 
   return { statusCode: 200, body: 'OK' };
 };
-`,YK,Gy,qS,Qy,SI,NI,fK,GK,QK,MK,KK,Ky,Zy,RZ,EB,dB,YZ,fZ,GZ,QZ,MZ;var aE=wE(async()=>{G8=Object.defineProperty;K8=f8(import.meta.url),Dj={};Jh(Dj,{signRequestAsync:()=>rc,signRequest:()=>W_,parseXMLResponse:()=>pA,parseJSONResponse:()=>yj,makeAWSRequestOnce:()=>Fj,makeAWSRequestAsync:()=>jj,makeAWSRequest:()=>Xh,isWebCryptoAvailable:()=>Hj,isNodeCryptoAvailable:()=>Wj,getSigningKeyCacheSize:()=>Pj,detectServiceRegion:()=>_c,createPresignedUrlAsync:()=>$j,createPresignedUrl:()=>f$,clearSigningKeyCache:()=>Bj});RL=V8(async()=>{try{xS=await import("node:crypto")}catch{}zh=new Map,fj={appstream2:"appstream",cloudhsmv2:"cloudhsm",email:"ses",marketplace:"aws-marketplace",mobile:"AWSMobileHubService",pinpoint:"mobiletargeting",queue:"sqs","git-codecommit":"codecommit","mturk-requester-sandbox":"mturk-requester","personalize-runtime":"personalize"}}),q8={backgroundJobs:{visibilityTimeout:120,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fifo:{fifo:!0,contentBasedDeduplication:!0,visibilityTimeout:30,encrypted:!0},highThroughput:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0},delayed:{delaySeconds:60,visibilityTimeout:60,encrypted:!0},longRunning:{visibilityTimeout:900,messageRetentionPeriod:1209600,deadLetterQueue:!0,maxReceiveCount:2,encrypted:!0},monitored:{visibilityTimeout:60,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0,alarms:{enabled:!0,queueDepthThreshold:1000,messageAgeThreshold:3600,dlqAlarm:!0}},lambdaOptimized:{visibilityTimeout:360,receiveMessageWaitTime:20,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fanOut:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0}},x8={serverless:{development:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:!0},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:1000,handlerMemory:128}},production:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:30,inactivityTimeout:60}},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST",pointInTimeRecovery:!0,connectionTTL:86400}},scaling:{maxConnections:50000,messagesPerSecond:5000,handlerMemory:256,handlerTimeout:30},monitoring:{enabled:!0,connectionThreshold:40000,errorThreshold:100,latencyThreshold:500},keepAlive:!0,keepAliveInterval:30,idleTimeout:600},notifications:{enabled:!0,mode:"serverless",channels:{public:!1,private:!0,presence:!1},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:50000,messagesPerSecond:2000,handlerMemory:128},keepAlive:!0,keepAliveInterval:60,idleTimeout:1800}},server:{development:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"ws",driver:"bun",idleTimeout:120,perMessageDeflate:!1,metrics:!1}},production:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,maxPayloadLength:16777216,backpressureLimit:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"broadcasting:"},rateLimit:{enabled:!0,max:100,window:60000,perChannel:!0,perUser:!0},loadManagement:{enabled:!0,maxConnections:1e4,maxSubscriptionsPerConnection:100,shedLoadThreshold:0.8},metrics:!0,autoScaling:{min:2,max:10,targetCPU:70}},monitoring:{enabled:!0,connectionThreshold:8000,errorThreshold:100}},highPerformance:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:60,maxPayloadLength:8388608,backpressureLimit:2097152,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!0,instances:4,redis:{enabled:!0,useElastiCache:!0,keyPrefix:"rt:"},rateLimit:{enabled:!0,max:200,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:25000,maxSubscriptionsPerConnection:50,shedLoadThreshold:0.7},metrics:{enabled:!0,path:"/metrics"},autoScaling:{min:4,max:20,targetCPU:60,targetConnections:20000}},monitoring:{enabled:!0,connectionThreshold:80000,errorThreshold:50,latencyThreshold:50}},chat:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:200,heartbeatInterval:20,inactivityTimeout:60}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:300,maxPayloadLength:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"chat:"},rateLimit:{enabled:!0,max:60,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:15000,maxSubscriptionsPerConnection:20},metrics:!0},keepAlive:!0,keepAliveInterval:25,idleTimeout:900},gaming:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:10,inactivityTimeout:30}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:30,maxPayloadLength:65536,backpressureLimit:524288,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!1,instances:4,redis:{enabled:!0,useElastiCache:!0},rateLimit:{enabled:!0,max:120,window:60000},loadManagement:{enabled:!0,maxConnections:5000,maxSubscriptionsPerConnection:10,shedLoadThreshold:0.6},metrics:!0,autoScaling:{min:4,max:16,targetCPU:50}},keepAlive:!0,keepAliveInterval:10,idleTimeout:60},single:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,sendPings:!0,perMessageDeflate:!0,instances:1,rateLimit:{enabled:!0,max:100,window:60000},loadManagement:{enabled:!0,maxConnections:1e4},metrics:!0}}}};OE={Ref:(E)=>({Ref:E}),GetAtt:(E,T)=>({"Fn::GetAtt":[E,T]}),Sub:(E,T)=>{if(T)return{"Fn::Sub":[E,T]};return{"Fn::Sub":E}},Join:(E,T)=>({"Fn::Join":[E,T]}),Select:(E,T)=>({"Fn::Select":[E,T]}),Split:(E,T)=>({"Fn::Split":[E,T]}),GetAZs:(E="")=>({"Fn::GetAZs":E}),ImportValue:(E)=>({"Fn::ImportValue":E}),If:(E,T,_)=>({"Fn::If":[E,T,_]}),Equals:(E,T)=>({"Fn::Equals":[E,T]}),And:(...E)=>({"Fn::And":E}),Or:(...E)=>({"Fn::Or":E}),Not:(E)=>({"Fn::Not":[E]}),Base64:(E)=>({"Fn::Base64":E})},TM={AccountId:{Ref:"AWS::AccountId"},Region:{Ref:"AWS::Region"},StackId:{Ref:"AWS::StackId"},StackName:{Ref:"AWS::StackName"},NotificationARNs:{Ref:"AWS::NotificationARNs"},Partition:{Ref:"AWS::Partition"},URLSuffix:{Ref:"AWS::URLSuffix"},NoValue:{Ref:"AWS::NoValue"}};Lt=class Lt{static createBucket(E){let{name:T,bucketName:_,slug:r,environment:t,public:d=!1,versioning:R=!1,website:h=!1,encryption:S=!0,intelligentTiering:N=!1,cors:A,lifecycleRules:L}=E,O=_??RE({slug:r,environment:t,resourceType:"s3",suffix:T}),c=i(O),U={Type:"AWS::S3::Bucket",Properties:{BucketName:O}};if(S)U.Properties.BucketEncryption={ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:{SSEAlgorithm:"AES256"}}]};if(R)U.Properties.VersioningConfiguration={Status:"Enabled"};if(h)U.Properties.WebsiteConfiguration={IndexDocument:"index.html",ErrorDocument:"error.html"};if(!d)U.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0};if(A&&A.length>0)U.Properties.CorsConfiguration={CorsRules:A.map((I)=>({AllowedOrigins:I.allowedOrigins,AllowedMethods:I.allowedMethods,AllowedHeaders:I.allowedHeaders,MaxAge:I.maxAge}))};if(L&&L.length>0)U.Properties.LifecycleConfiguration={Rules:L.map((I)=>({Id:I.id,Status:I.enabled?"Enabled":"Disabled",ExpirationInDays:I.expirationDays,Transitions:I.transitions?.map((w)=>({TransitionInDays:w.days,StorageClass:w.storageClass}))}))};if(N&&L){let I={id:"IntelligentTieringRule",enabled:!0,transitions:[{days:0,storageClass:"INTELLIGENT_TIERING"}]};if(!U.Properties.LifecycleConfiguration)U.Properties.LifecycleConfiguration={Rules:[]};U.Properties.LifecycleConfiguration.Rules.push({Id:I.id,Status:"Enabled",Transitions:I.transitions?.map((w)=>({TransitionInDays:w.days,StorageClass:w.storageClass}))})}let $;if(d)$={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:OE.Ref(c),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadGetObject",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[OE.Join("",[OE.GetAtt(c,"Arn"),"/*"])]}]}}};return{bucket:U,bucketPolicy:$,logicalId:c}}static enableVersioning(E){if(!E.Properties)E.Properties={};return E.Properties.VersioningConfiguration={Status:"Enabled"},E}static enableWebsiteHosting(E,T="index.html",_="error.html"){if(!E.Properties)E.Properties={};return E.Properties.WebsiteConfiguration={IndexDocument:T,ErrorDocument:_},E}static setLifecycleRules(E,T){if(!E.Properties)E.Properties={};return E.Properties.LifecycleConfiguration={Rules:T.map((_)=>({Id:_.id,Status:_.enabled?"Enabled":"Disabled",ExpirationInDays:_.expirationDays,Transitions:_.transitions?.map((r)=>({TransitionInDays:r.days,StorageClass:r.storageClass}))}))},E}static enableIntelligentTiering(E){if(!E.Properties)E.Properties={};if(!E.Properties.LifecycleConfiguration)E.Properties.LifecycleConfiguration={Rules:[]};return E.Properties.LifecycleConfiguration.Rules.push({Id:"IntelligentTieringRule",Status:"Enabled",Transitions:[{TransitionInDays:0,StorageClass:"INTELLIGENT_TIERING"}]}),E}static addLambdaNotification(E,T){if(!E.Properties)E.Properties={};if(!E.Properties.NotificationConfiguration)E.Properties.NotificationConfiguration={};if(!E.Properties.NotificationConfiguration.LambdaConfigurations)E.Properties.NotificationConfiguration.LambdaConfigurations=[];let _={Event:T.events[0],Function:T.functionArn};if(T.filter)_.Filter={S3Key:{Rules:[...T.filter.prefix?[{Name:"prefix",Value:T.filter.prefix}]:[],...T.filter.suffix?[{Name:"suffix",Value:T.filter.suffix}]:[]]}};for(let r of T.events){let t={..._,Event:r};E.Properties.NotificationConfiguration.LambdaConfigurations.push(t)}return E}static Notifications={onObjectCreated:(E)=>({functionArn:E,events:["s3:ObjectCreated:*"]}),onObjectRemoved:(E)=>({functionArn:E,events:["s3:ObjectRemoved:*"]}),onImageUpload:(E,T)=>({functionArn:E,events:["s3:ObjectCreated:*"],filter:{prefix:T,suffix:".jpg"}}),onFileType:(E,T,_)=>({functionArn:E,events:["s3:ObjectCreated:*"],filter:{prefix:_,suffix:T}}),onFolderUpload:(E,T)=>({functionArn:E,events:["s3:ObjectCreated:*"],filter:{prefix:T.endsWith("/")?T:`${T}/`}})};static createBackupPlan(E){let{name:T,slug:_,environment:r,bucketLogicalIds:t,retentionDays:d,schedule:R="cron(0 5 * * ? *)",vaultName:h,enableContinuousBackup:S=!1,moveToColdStorageAfterDays:N}=E,A=h||RE({slug:_,environment:r,resourceType:"backup-vault",suffix:T}),L=i(A),O={Type:"AWS::Backup::BackupVault",Properties:{BackupVaultName:A}},c=RE({slug:_,environment:r,resourceType:"backup-role",suffix:T}),U=i(c),$={Type:"AWS::IAM::Role",Properties:{RoleName:c,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"backup.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup","arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores"]}},I=RE({slug:_,environment:r,resourceType:"backup-plan",suffix:T}),w=i(I),z={DeleteAfterDays:d};if(N&&N<d)z.MoveToColdStorageAfterDays=N;let F={Type:"AWS::Backup::BackupPlan",Properties:{BackupPlan:{BackupPlanName:I,BackupPlanRule:[{RuleName:`${T}-daily-backup`,TargetBackupVault:OE.Ref(L),ScheduleExpression:R,StartWindowMinutes:60,CompletionWindowMinutes:120,Lifecycle:z,EnableContinuousBackup:S}]}}},j=RE({slug:_,environment:r,resourceType:"backup-selection",suffix:T}),Y=i(j),H=t.map((K)=>OE.GetAtt(K,"Arn")),Q={Type:"AWS::Backup::BackupSelection",Properties:{BackupPlanId:OE.Ref(w),BackupSelection:{SelectionName:j,IamRoleArn:OE.GetAtt(U,"Arn"),Resources:H}}};return{vault:O,plan:F,selection:Q,role:$,vaultLogicalId:L,planLogicalId:w,selectionLogicalId:Y,roleLogicalId:U}}static BackupSchedules={HOURLY:"cron(0 * * * ? *)",DAILY_5AM:"cron(0 5 * * ? *)",DAILY_MIDNIGHT:"cron(0 0 * * ? *)",WEEKLY_SUNDAY:"cron(0 5 ? * SUN *)",WEEKLY_SATURDAY:"cron(0 5 ? * SAT *)",MONTHLY_FIRST:"cron(0 5 1 * ? *)",EVERY_12_HOURS:"cron(0 */12 * * ? *)",EVERY_6_HOURS:"cron(0 */6 * * ? *)"};static BackupRetention={ONE_DAY:1,ONE_WEEK:7,TWO_WEEKS:14,ONE_MONTH:30,THREE_MONTHS:90,SIX_MONTHS:180,ONE_YEAR:365,TWO_YEARS:730,FIVE_YEARS:1825,SEVEN_YEARS:2555};static createWwwRedirectBucket(E){let{slug:T,environment:_,sourceDomain:r,targetDomain:t,protocol:d="https"}=E,R=RE({slug:T,environment:_,resourceType:"s3",suffix:"www-redirect"}),h=i(R),S={Type:"AWS::S3::Bucket",Properties:{BucketName:r,WebsiteConfiguration:{RedirectAllRequestsTo:{HostName:t,Protocol:d}},PublicAccessBlockConfiguration:{BlockPublicAcls:!1,BlockPublicPolicy:!1,IgnorePublicAcls:!1,RestrictPublicBuckets:!1}}},N={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:OE.Ref(h),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadForRedirect",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[OE.Join("",[OE.GetAtt(h,"Arn"),"/*"])]}]}}};return{bucket:S,bucketPolicy:N,logicalId:h}}static createDocsBucket(E){let{slug:T,environment:_,domain:r}=E,t=r||RE({slug:T,environment:_,resourceType:"s3",suffix:"docs"}),d=i(t);return{bucket:{Type:"AWS::S3::Bucket",Properties:{BucketName:t,BucketEncryption:{ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:{SSEAlgorithm:"AES256"}}]},PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},Tags:[{Key:"backup",Value:"weekly"}]}},logicalId:d}}static createEmailBucket(E){let{slug:T,environment:_}=E,r=RE({slug:T,environment:_,resourceType:"s3",suffix:"email"}),t=i(r),d={Type:"AWS::S3::Bucket",Properties:{BucketName:r,BucketEncryption:{ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:{SSEAlgorithm:"AES256"}}]},PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"EmailRetention",Status:"Enabled",ExpirationInDays:90,Transitions:[{TransitionInDays:30,StorageClass:"STANDARD_IA"}]}]}}},R={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:OE.Ref(t),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowSESPuts",Effect:"Allow",Principal:{Service:"ses.amazonaws.com"},Action:"s3:PutObject",Resource:OE.Join("",[OE.GetAtt(t,"Arn"),"/*"]),Condition:{StringEquals:{"AWS:SourceAccount":OE.Ref("AWS::AccountId")}}}]}}};return{bucket:d,bucketPolicy:R,logicalId:t}}static docsExist(E={}){let{projectRoot:T=process.cwd(),docsPaths:_=["docs","documentation","doc"]}=E;for(let r of _){let t=wR(T,r);if(vA(t)){let d=["dist","build",".bunpress/dist","_site","out","public"];for(let R of d){let h=wR(t,R);if(vA(h))try{if(NM(h).length>0)return{exists:!0,path:t,hasDistFolder:!0,distPath:h}}catch{}}return{exists:!0,path:t,hasDistFolder:!1,distPath:null}}}return{exists:!1,path:null,hasDistFolder:!1,distPath:null}}static createDocsBucketIfExists(E){let T=Lt.docsExist({projectRoot:E.projectRoot,docsPaths:E.docsPaths});if(!T.exists)return{bucket:null,logicalId:null,docsInfo:T};let _=Lt.createDocsBucket({slug:E.slug,environment:E.environment,domain:E.domain});return{bucket:_.bucket,bucketPolicy:_.bucketPolicy,logicalId:_.logicalId,docsInfo:T}}static createPrivateBucket(E){let{slug:T,environment:_,enableVersioning:r=!0,retentionDays:t,encryptionKeyArn:d}=E,R=RE({slug:T,environment:_,resourceType:"s3",suffix:"private"}),h=i(R);return{bucket:{Type:"AWS::S3::Bucket",Properties:{BucketName:R,BucketEncryption:{ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:d?{SSEAlgorithm:"aws:kms",KMSMasterKeyID:d}:{SSEAlgorithm:"AES256"}}]},PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},VersioningConfiguration:r?{Status:"Enabled"}:void 0,LifecycleConfiguration:t?{Rules:[{Id:"RetentionPolicy",Status:"Enabled",ExpirationInDays:t}]}:void 0,Tags:[{Key:"backup",Value:"daily"}]}},logicalId:h}}static checkSourcePaths(E={}){let{projectRoot:T=process.cwd(),paths:_={}}=E,r=_.web||"views/web/dist",t=_.docs||"docs/dist",d=_.private||"private";return{web:{exists:vA(wR(T,r)),path:wR(T,r)},docs:{exists:vA(wR(T,t)),path:wR(T,t)},private:{exists:vA(wR(T,d)),path:wR(T,d)}}}static createDeploymentBuckets(E){let{slug:T,environment:_,domain:r,projectRoot:t,paths:d}=E,R=Lt.checkSourcePaths({projectRoot:t,paths:d}),h={},S={web:!1,docs:!1,private:!1},N=Lt.createBucket({name:"web",slug:T,environment:_,public:!1,versioning:!1,encryption:!0});if(h[N.logicalId]=N.bucket,S.web=!0,R.docs.exists){let A=Lt.createDocsBucket({slug:T,environment:_,domain:r?`docs.${r}`:void 0});if(h[A.logicalId]=A.bucket,A.bucketPolicy)h[`${A.logicalId}Policy`]=A.bucketPolicy;S.docs=!0}if(R.private.exists){let A=Lt.createPrivateBucket({slug:T,environment:_,enableVersioning:!0});h[A.logicalId]=A.bucket,S.private=!0}return{resources:h,created:S,sourcePaths:R}}};Mt=class Mt{static createRepository(E){let{name:T,slug:_,environment:r,scanOnPush:t=!0,imageMutability:d="MUTABLE",encryption:R="AES256",kmsKey:h,lifecyclePolicy:S,tags:N}=E,A=RE({slug:_,environment:r,resourceType:"ecr",suffix:T}),L=i(A),O={Type:"AWS::ECR::Repository",Properties:{RepositoryName:A,ImageTagMutability:d,ImageScanningConfiguration:{ScanOnPush:t},EncryptionConfiguration:{EncryptionType:R,...h&&R==="KMS"?{KmsKey:h}:{}}}};if(S)O.Properties.LifecyclePolicy={LifecyclePolicyText:JSON.stringify(Mt.generateLifecyclePolicy(S))};if(N)O.Properties.Tags=Object.entries(N).map(([c,U])=>({Key:c,Value:U}));return{repository:O,logicalId:L}}static generateLifecyclePolicy(E){let T=[];if(E.untaggedImageExpireDays!==void 0)T.push({rulePriority:1,description:"Delete untagged images",selection:{tagStatus:"untagged",countType:"sinceImagePushed",countNumber:E.untaggedImageExpireDays,countUnit:"days"},action:{type:"expire"}});if(E.maxImageCount!==void 0)T.push({rulePriority:T.length+1,description:"Keep only most recent images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:E.maxImageCount},action:{type:"expire"}});if(E.maxImageAgeDays!==void 0)T.push({rulePriority:T.length+1,description:"Delete images older than specified days",selection:{tagStatus:"any",countType:"sinceImagePushed",countNumber:E.maxImageAgeDays,countUnit:"days"},action:{type:"expire"}});return{rules:T}}static LifecyclePolicies={production:{maxImageCount:10,untaggedImageExpireDays:7},development:{maxImageCount:5,untaggedImageExpireDays:3},minimal:{maxImageCount:3,untaggedImageExpireDays:1},archive:{maxImageCount:50,untaggedImageExpireDays:30}};static enableImmutableTags(E){if(!E.Properties)E.Properties={};return E.Properties.ImageTagMutability="IMMUTABLE",E}static enableScanOnPush(E){if(!E.Properties)E.Properties={};return E.Properties.ImageScanningConfiguration={ScanOnPush:!0},E}static setLifecyclePolicy(E,T){if(!E.Properties)E.Properties={};return E.Properties.LifecyclePolicy={LifecyclePolicyText:JSON.stringify(Mt.generateLifecyclePolicy(T))},E}static addCrossAccountAccess(E,T){if(!E.Properties)E.Properties={};return E.Properties.RepositoryPolicyText={Version:"2012-10-17",Statement:[{Sid:"CrossAccountPull",Effect:"Allow",Principal:{AWS:T.map((_)=>`arn:aws:iam::${_}:root`)},Action:["ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","ecr:BatchCheckLayerAvailability"]}]},E}static addLambdaAccess(E){if(!E.Properties)E.Properties={};return E.Properties.RepositoryPolicyText={Version:"2012-10-17",Statement:[{Sid:"LambdaECRImageRetrievalPolicy",Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:["ecr:GetDownloadUrlForLayer","ecr:BatchGetImage"]}]},E}static generateBunDockerfile(E){let{baseImage:T="oven/bun:1-debian",serverPath:_,port:r=3000,additionalDirs:t=[],healthCheckEndpoint:d="/health",nodeCompatible:R=!1,envVars:h={},buildCommands:S=[],runCommand:N}=E,A=["app","config",...t],L=N||`bun run ${_}`,O=`# Multi-stage build for Bun application
+`,YK,Gy,qS,Qy,SI,NI,fK,GK,QK,MK,KK,Ky,Zy,RZ,EB,dB,YZ,fZ,GZ,QZ,MZ;var aE=wE(async()=>{G9=Object.defineProperty;K9=f9(import.meta.url),Dj={};Jh(Dj,{signRequestAsync:()=>rc,signRequest:()=>W_,parseXMLResponse:()=>pA,parseJSONResponse:()=>yj,makeAWSRequestOnce:()=>Fj,makeAWSRequestAsync:()=>jj,makeAWSRequest:()=>Xh,isWebCryptoAvailable:()=>Hj,isNodeCryptoAvailable:()=>Wj,getSigningKeyCacheSize:()=>Pj,detectServiceRegion:()=>_c,createPresignedUrlAsync:()=>$j,createPresignedUrl:()=>f$,clearSigningKeyCache:()=>Bj});RL=V9(async()=>{try{xS=await import("node:crypto")}catch{}zh=new Map,fj={appstream2:"appstream",cloudhsmv2:"cloudhsm",email:"ses",marketplace:"aws-marketplace",mobile:"AWSMobileHubService",pinpoint:"mobiletargeting",queue:"sqs","git-codecommit":"codecommit","mturk-requester-sandbox":"mturk-requester","personalize-runtime":"personalize"}}),q9={backgroundJobs:{visibilityTimeout:120,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fifo:{fifo:!0,contentBasedDeduplication:!0,visibilityTimeout:30,encrypted:!0},highThroughput:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0},delayed:{delaySeconds:60,visibilityTimeout:60,encrypted:!0},longRunning:{visibilityTimeout:900,messageRetentionPeriod:1209600,deadLetterQueue:!0,maxReceiveCount:2,encrypted:!0},monitored:{visibilityTimeout:60,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0,alarms:{enabled:!0,queueDepthThreshold:1000,messageAgeThreshold:3600,dlqAlarm:!0}},lambdaOptimized:{visibilityTimeout:360,receiveMessageWaitTime:20,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fanOut:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0}},x9={serverless:{development:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:!0},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:1000,handlerMemory:128}},production:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:30,inactivityTimeout:60}},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST",pointInTimeRecovery:!0,connectionTTL:86400}},scaling:{maxConnections:50000,messagesPerSecond:5000,handlerMemory:256,handlerTimeout:30},monitoring:{enabled:!0,connectionThreshold:40000,errorThreshold:100,latencyThreshold:500},keepAlive:!0,keepAliveInterval:30,idleTimeout:600},notifications:{enabled:!0,mode:"serverless",channels:{public:!1,private:!0,presence:!1},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:50000,messagesPerSecond:2000,handlerMemory:128},keepAlive:!0,keepAliveInterval:60,idleTimeout:1800}},server:{development:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"ws",driver:"bun",idleTimeout:120,perMessageDeflate:!1,metrics:!1}},production:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,maxPayloadLength:16777216,backpressureLimit:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"broadcasting:"},rateLimit:{enabled:!0,max:100,window:60000,perChannel:!0,perUser:!0},loadManagement:{enabled:!0,maxConnections:1e4,maxSubscriptionsPerConnection:100,shedLoadThreshold:0.8},metrics:!0,autoScaling:{min:2,max:10,targetCPU:70}},monitoring:{enabled:!0,connectionThreshold:8000,errorThreshold:100}},highPerformance:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:60,maxPayloadLength:8388608,backpressureLimit:2097152,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!0,instances:4,redis:{enabled:!0,useElastiCache:!0,keyPrefix:"rt:"},rateLimit:{enabled:!0,max:200,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:25000,maxSubscriptionsPerConnection:50,shedLoadThreshold:0.7},metrics:{enabled:!0,path:"/metrics"},autoScaling:{min:4,max:20,targetCPU:60,targetConnections:20000}},monitoring:{enabled:!0,connectionThreshold:80000,errorThreshold:50,latencyThreshold:50}},chat:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:200,heartbeatInterval:20,inactivityTimeout:60}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:300,maxPayloadLength:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"chat:"},rateLimit:{enabled:!0,max:60,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:15000,maxSubscriptionsPerConnection:20},metrics:!0},keepAlive:!0,keepAliveInterval:25,idleTimeout:900},gaming:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:10,inactivityTimeout:30}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:30,maxPayloadLength:65536,backpressureLimit:524288,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!1,instances:4,redis:{enabled:!0,useElastiCache:!0},rateLimit:{enabled:!0,max:120,window:60000},loadManagement:{enabled:!0,maxConnections:5000,maxSubscriptionsPerConnection:10,shedLoadThreshold:0.6},metrics:!0,autoScaling:{min:4,max:16,targetCPU:50}},keepAlive:!0,keepAliveInterval:10,idleTimeout:60},single:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,sendPings:!0,perMessageDeflate:!0,instances:1,rateLimit:{enabled:!0,max:100,window:60000},loadManagement:{enabled:!0,maxConnections:1e4},metrics:!0}}}};OE={Ref:(E)=>({Ref:E}),GetAtt:(E,T)=>({"Fn::GetAtt":[E,T]}),Sub:(E,T)=>{if(T)return{"Fn::Sub":[E,T]};return{"Fn::Sub":E}},Join:(E,T)=>({"Fn::Join":[E,T]}),Select:(E,T)=>({"Fn::Select":[E,T]}),Split:(E,T)=>({"Fn::Split":[E,T]}),GetAZs:(E="")=>({"Fn::GetAZs":E}),ImportValue:(E)=>({"Fn::ImportValue":E}),If:(E,T,_)=>({"Fn::If":[E,T,_]}),Equals:(E,T)=>({"Fn::Equals":[E,T]}),And:(...E)=>({"Fn::And":E}),Or:(...E)=>({"Fn::Or":E}),Not:(E)=>({"Fn::Not":[E]}),Base64:(E)=>({"Fn::Base64":E})},TM={AccountId:{Ref:"AWS::AccountId"},Region:{Ref:"AWS::Region"},StackId:{Ref:"AWS::StackId"},StackName:{Ref:"AWS::StackName"},NotificationARNs:{Ref:"AWS::NotificationARNs"},Partition:{Ref:"AWS::Partition"},URLSuffix:{Ref:"AWS::URLSuffix"},NoValue:{Ref:"AWS::NoValue"}};Lt=class Lt{static createBucket(E){let{name:T,bucketName:_,slug:r,environment:t,public:d=!1,versioning:R=!1,website:h=!1,encryption:S=!0,intelligentTiering:N=!1,cors:A,lifecycleRules:L}=E,O=_??RE({slug:r,environment:t,resourceType:"s3",suffix:T}),c=i(O),U={Type:"AWS::S3::Bucket",Properties:{BucketName:O}};if(S)U.Properties.BucketEncryption={ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:{SSEAlgorithm:"AES256"}}]};if(R)U.Properties.VersioningConfiguration={Status:"Enabled"};if(h)U.Properties.WebsiteConfiguration={IndexDocument:"index.html",ErrorDocument:"error.html"};if(!d)U.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0};if(A&&A.length>0)U.Properties.CorsConfiguration={CorsRules:A.map((I)=>({AllowedOrigins:I.allowedOrigins,AllowedMethods:I.allowedMethods,AllowedHeaders:I.allowedHeaders,MaxAge:I.maxAge}))};if(L&&L.length>0)U.Properties.LifecycleConfiguration={Rules:L.map((I)=>({Id:I.id,Status:I.enabled?"Enabled":"Disabled",ExpirationInDays:I.expirationDays,Transitions:I.transitions?.map((w)=>({TransitionInDays:w.days,StorageClass:w.storageClass}))}))};if(N&&L){let I={id:"IntelligentTieringRule",enabled:!0,transitions:[{days:0,storageClass:"INTELLIGENT_TIERING"}]};if(!U.Properties.LifecycleConfiguration)U.Properties.LifecycleConfiguration={Rules:[]};U.Properties.LifecycleConfiguration.Rules.push({Id:I.id,Status:"Enabled",Transitions:I.transitions?.map((w)=>({TransitionInDays:w.days,StorageClass:w.storageClass}))})}let $;if(d)$={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:OE.Ref(c),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadGetObject",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[OE.Join("",[OE.GetAtt(c,"Arn"),"/*"])]}]}}};return{bucket:U,bucketPolicy:$,logicalId:c}}static enableVersioning(E){if(!E.Properties)E.Properties={};return E.Properties.VersioningConfiguration={Status:"Enabled"},E}static enableWebsiteHosting(E,T="index.html",_="error.html"){if(!E.Properties)E.Properties={};return E.Properties.WebsiteConfiguration={IndexDocument:T,ErrorDocument:_},E}static setLifecycleRules(E,T){if(!E.Properties)E.Properties={};return E.Properties.LifecycleConfiguration={Rules:T.map((_)=>({Id:_.id,Status:_.enabled?"Enabled":"Disabled",ExpirationInDays:_.expirationDays,Transitions:_.transitions?.map((r)=>({TransitionInDays:r.days,StorageClass:r.storageClass}))}))},E}static enableIntelligentTiering(E){if(!E.Properties)E.Properties={};if(!E.Properties.LifecycleConfiguration)E.Properties.LifecycleConfiguration={Rules:[]};return E.Properties.LifecycleConfiguration.Rules.push({Id:"IntelligentTieringRule",Status:"Enabled",Transitions:[{TransitionInDays:0,StorageClass:"INTELLIGENT_TIERING"}]}),E}static addLambdaNotification(E,T){if(!E.Properties)E.Properties={};if(!E.Properties.NotificationConfiguration)E.Properties.NotificationConfiguration={};if(!E.Properties.NotificationConfiguration.LambdaConfigurations)E.Properties.NotificationConfiguration.LambdaConfigurations=[];let _={Event:T.events[0],Function:T.functionArn};if(T.filter)_.Filter={S3Key:{Rules:[...T.filter.prefix?[{Name:"prefix",Value:T.filter.prefix}]:[],...T.filter.suffix?[{Name:"suffix",Value:T.filter.suffix}]:[]]}};for(let r of T.events){let t={..._,Event:r};E.Properties.NotificationConfiguration.LambdaConfigurations.push(t)}return E}static Notifications={onObjectCreated:(E)=>({functionArn:E,events:["s3:ObjectCreated:*"]}),onObjectRemoved:(E)=>({functionArn:E,events:["s3:ObjectRemoved:*"]}),onImageUpload:(E,T)=>({functionArn:E,events:["s3:ObjectCreated:*"],filter:{prefix:T,suffix:".jpg"}}),onFileType:(E,T,_)=>({functionArn:E,events:["s3:ObjectCreated:*"],filter:{prefix:_,suffix:T}}),onFolderUpload:(E,T)=>({functionArn:E,events:["s3:ObjectCreated:*"],filter:{prefix:T.endsWith("/")?T:`${T}/`}})};static createBackupPlan(E){let{name:T,slug:_,environment:r,bucketLogicalIds:t,retentionDays:d,schedule:R="cron(0 5 * * ? *)",vaultName:h,enableContinuousBackup:S=!1,moveToColdStorageAfterDays:N}=E,A=h||RE({slug:_,environment:r,resourceType:"backup-vault",suffix:T}),L=i(A),O={Type:"AWS::Backup::BackupVault",Properties:{BackupVaultName:A}},c=RE({slug:_,environment:r,resourceType:"backup-role",suffix:T}),U=i(c),$={Type:"AWS::IAM::Role",Properties:{RoleName:c,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"backup.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup","arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores"]}},I=RE({slug:_,environment:r,resourceType:"backup-plan",suffix:T}),w=i(I),z={DeleteAfterDays:d};if(N&&N<d)z.MoveToColdStorageAfterDays=N;let F={Type:"AWS::Backup::BackupPlan",Properties:{BackupPlan:{BackupPlanName:I,BackupPlanRule:[{RuleName:`${T}-daily-backup`,TargetBackupVault:OE.Ref(L),ScheduleExpression:R,StartWindowMinutes:60,CompletionWindowMinutes:120,Lifecycle:z,EnableContinuousBackup:S}]}}},j=RE({slug:_,environment:r,resourceType:"backup-selection",suffix:T}),Y=i(j),H=t.map((K)=>OE.GetAtt(K,"Arn")),Q={Type:"AWS::Backup::BackupSelection",Properties:{BackupPlanId:OE.Ref(w),BackupSelection:{SelectionName:j,IamRoleArn:OE.GetAtt(U,"Arn"),Resources:H}}};return{vault:O,plan:F,selection:Q,role:$,vaultLogicalId:L,planLogicalId:w,selectionLogicalId:Y,roleLogicalId:U}}static BackupSchedules={HOURLY:"cron(0 * * * ? *)",DAILY_5AM:"cron(0 5 * * ? *)",DAILY_MIDNIGHT:"cron(0 0 * * ? *)",WEEKLY_SUNDAY:"cron(0 5 ? * SUN *)",WEEKLY_SATURDAY:"cron(0 5 ? * SAT *)",MONTHLY_FIRST:"cron(0 5 1 * ? *)",EVERY_12_HOURS:"cron(0 */12 * * ? *)",EVERY_6_HOURS:"cron(0 */6 * * ? *)"};static BackupRetention={ONE_DAY:1,ONE_WEEK:7,TWO_WEEKS:14,ONE_MONTH:30,THREE_MONTHS:90,SIX_MONTHS:180,ONE_YEAR:365,TWO_YEARS:730,FIVE_YEARS:1825,SEVEN_YEARS:2555};static createWwwRedirectBucket(E){let{slug:T,environment:_,sourceDomain:r,targetDomain:t,protocol:d="https"}=E,R=RE({slug:T,environment:_,resourceType:"s3",suffix:"www-redirect"}),h=i(R),S={Type:"AWS::S3::Bucket",Properties:{BucketName:r,WebsiteConfiguration:{RedirectAllRequestsTo:{HostName:t,Protocol:d}},PublicAccessBlockConfiguration:{BlockPublicAcls:!1,BlockPublicPolicy:!1,IgnorePublicAcls:!1,RestrictPublicBuckets:!1}}},N={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:OE.Ref(h),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadForRedirect",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[OE.Join("",[OE.GetAtt(h,"Arn"),"/*"])]}]}}};return{bucket:S,bucketPolicy:N,logicalId:h}}static createDocsBucket(E){let{slug:T,environment:_,domain:r}=E,t=r||RE({slug:T,environment:_,resourceType:"s3",suffix:"docs"}),d=i(t);return{bucket:{Type:"AWS::S3::Bucket",Properties:{BucketName:t,BucketEncryption:{ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:{SSEAlgorithm:"AES256"}}]},PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},Tags:[{Key:"backup",Value:"weekly"}]}},logicalId:d}}static createEmailBucket(E){let{slug:T,environment:_}=E,r=RE({slug:T,environment:_,resourceType:"s3",suffix:"email"}),t=i(r),d={Type:"AWS::S3::Bucket",Properties:{BucketName:r,BucketEncryption:{ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:{SSEAlgorithm:"AES256"}}]},PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"EmailRetention",Status:"Enabled",ExpirationInDays:90,Transitions:[{TransitionInDays:30,StorageClass:"STANDARD_IA"}]}]}}},R={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:OE.Ref(t),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowSESPuts",Effect:"Allow",Principal:{Service:"ses.amazonaws.com"},Action:"s3:PutObject",Resource:OE.Join("",[OE.GetAtt(t,"Arn"),"/*"]),Condition:{StringEquals:{"AWS:SourceAccount":OE.Ref("AWS::AccountId")}}}]}}};return{bucket:d,bucketPolicy:R,logicalId:t}}static docsExist(E={}){let{projectRoot:T=process.cwd(),docsPaths:_=["docs","documentation","doc"]}=E;for(let r of _){let t=wR(T,r);if(vA(t)){let d=["dist","build",".bunpress/dist","_site","out","public"];for(let R of d){let h=wR(t,R);if(vA(h))try{if(NM(h).length>0)return{exists:!0,path:t,hasDistFolder:!0,distPath:h}}catch{}}return{exists:!0,path:t,hasDistFolder:!1,distPath:null}}}return{exists:!1,path:null,hasDistFolder:!1,distPath:null}}static createDocsBucketIfExists(E){let T=Lt.docsExist({projectRoot:E.projectRoot,docsPaths:E.docsPaths});if(!T.exists)return{bucket:null,logicalId:null,docsInfo:T};let _=Lt.createDocsBucket({slug:E.slug,environment:E.environment,domain:E.domain});return{bucket:_.bucket,bucketPolicy:_.bucketPolicy,logicalId:_.logicalId,docsInfo:T}}static createPrivateBucket(E){let{slug:T,environment:_,enableVersioning:r=!0,retentionDays:t,encryptionKeyArn:d}=E,R=RE({slug:T,environment:_,resourceType:"s3",suffix:"private"}),h=i(R);return{bucket:{Type:"AWS::S3::Bucket",Properties:{BucketName:R,BucketEncryption:{ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:d?{SSEAlgorithm:"aws:kms",KMSMasterKeyID:d}:{SSEAlgorithm:"AES256"}}]},PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},VersioningConfiguration:r?{Status:"Enabled"}:void 0,LifecycleConfiguration:t?{Rules:[{Id:"RetentionPolicy",Status:"Enabled",ExpirationInDays:t}]}:void 0,Tags:[{Key:"backup",Value:"daily"}]}},logicalId:h}}static checkSourcePaths(E={}){let{projectRoot:T=process.cwd(),paths:_={}}=E,r=_.web||"views/web/dist",t=_.docs||"docs/dist",d=_.private||"private";return{web:{exists:vA(wR(T,r)),path:wR(T,r)},docs:{exists:vA(wR(T,t)),path:wR(T,t)},private:{exists:vA(wR(T,d)),path:wR(T,d)}}}static createDeploymentBuckets(E){let{slug:T,environment:_,domain:r,projectRoot:t,paths:d}=E,R=Lt.checkSourcePaths({projectRoot:t,paths:d}),h={},S={web:!1,docs:!1,private:!1},N=Lt.createBucket({name:"web",slug:T,environment:_,public:!1,versioning:!1,encryption:!0});if(h[N.logicalId]=N.bucket,S.web=!0,R.docs.exists){let A=Lt.createDocsBucket({slug:T,environment:_,domain:r?`docs.${r}`:void 0});if(h[A.logicalId]=A.bucket,A.bucketPolicy)h[`${A.logicalId}Policy`]=A.bucketPolicy;S.docs=!0}if(R.private.exists){let A=Lt.createPrivateBucket({slug:T,environment:_,enableVersioning:!0});h[A.logicalId]=A.bucket,S.private=!0}return{resources:h,created:S,sourcePaths:R}}};Mt=class Mt{static createRepository(E){let{name:T,slug:_,environment:r,scanOnPush:t=!0,imageMutability:d="MUTABLE",encryption:R="AES256",kmsKey:h,lifecyclePolicy:S,tags:N}=E,A=RE({slug:_,environment:r,resourceType:"ecr",suffix:T}),L=i(A),O={Type:"AWS::ECR::Repository",Properties:{RepositoryName:A,ImageTagMutability:d,ImageScanningConfiguration:{ScanOnPush:t},EncryptionConfiguration:{EncryptionType:R,...h&&R==="KMS"?{KmsKey:h}:{}}}};if(S)O.Properties.LifecyclePolicy={LifecyclePolicyText:JSON.stringify(Mt.generateLifecyclePolicy(S))};if(N)O.Properties.Tags=Object.entries(N).map(([c,U])=>({Key:c,Value:U}));return{repository:O,logicalId:L}}static generateLifecyclePolicy(E){let T=[];if(E.untaggedImageExpireDays!==void 0)T.push({rulePriority:1,description:"Delete untagged images",selection:{tagStatus:"untagged",countType:"sinceImagePushed",countNumber:E.untaggedImageExpireDays,countUnit:"days"},action:{type:"expire"}});if(E.maxImageCount!==void 0)T.push({rulePriority:T.length+1,description:"Keep only most recent images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:E.maxImageCount},action:{type:"expire"}});if(E.maxImageAgeDays!==void 0)T.push({rulePriority:T.length+1,description:"Delete images older than specified days",selection:{tagStatus:"any",countType:"sinceImagePushed",countNumber:E.maxImageAgeDays,countUnit:"days"},action:{type:"expire"}});return{rules:T}}static LifecyclePolicies={production:{maxImageCount:10,untaggedImageExpireDays:7},development:{maxImageCount:5,untaggedImageExpireDays:3},minimal:{maxImageCount:3,untaggedImageExpireDays:1},archive:{maxImageCount:50,untaggedImageExpireDays:30}};static enableImmutableTags(E){if(!E.Properties)E.Properties={};return E.Properties.ImageTagMutability="IMMUTABLE",E}static enableScanOnPush(E){if(!E.Properties)E.Properties={};return E.Properties.ImageScanningConfiguration={ScanOnPush:!0},E}static setLifecyclePolicy(E,T){if(!E.Properties)E.Properties={};return E.Properties.LifecyclePolicy={LifecyclePolicyText:JSON.stringify(Mt.generateLifecyclePolicy(T))},E}static addCrossAccountAccess(E,T){if(!E.Properties)E.Properties={};return E.Properties.RepositoryPolicyText={Version:"2012-10-17",Statement:[{Sid:"CrossAccountPull",Effect:"Allow",Principal:{AWS:T.map((_)=>`arn:aws:iam::${_}:root`)},Action:["ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","ecr:BatchCheckLayerAvailability"]}]},E}static addLambdaAccess(E){if(!E.Properties)E.Properties={};return E.Properties.RepositoryPolicyText={Version:"2012-10-17",Statement:[{Sid:"LambdaECRImageRetrievalPolicy",Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:["ecr:GetDownloadUrlForLayer","ecr:BatchGetImage"]}]},E}static generateBunDockerfile(E){let{baseImage:T="oven/bun:1-debian",serverPath:_,port:r=3000,additionalDirs:t=[],healthCheckEndpoint:d="/health",nodeCompatible:R=!1,envVars:h={},buildCommands:S=[],runCommand:N}=E,A=["app","config",...t],L=N||`bun run ${_}`,O=`# Multi-stage build for Bun application
 # Generated by ts-cloud
 
 # Builder stage
@@ -5966,7 +5966,7 @@ else if (encoding === 'quoted-printable') {
 | fields @timestamp, @message
 | filter @message like /ERROR|WARN|Exception/
 | sort @timestamp desc
-| limit 50`,region:r,title:"Recent Errors and Warnings"}}),R+=6;return NL.createDashboard({slug:T,environment:_,widgets:d})}static DashboardTemplates={staticWebsite:(E)=>({slug:E.slug,environment:E.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${E.slug.toUpperCase()} Static Website Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"CloudFront Requests",region:"us-east-1",metrics:[["AWS/CloudFront","Requests","DistributionId",E.cloudFrontDistributionId,"Region","Global"]],period:300,stat:"Sum"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"Error Rate",region:"us-east-1",metrics:[["AWS/CloudFront","4xxErrorRate","DistributionId",E.cloudFrontDistributionId,"Region","Global",{label:"4XX"}],["AWS/CloudFront","5xxErrorRate","DistributionId",E.cloudFrontDistributionId,"Region","Global",{label:"5XX"}]],period:300,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"Bytes Downloaded",region:"us-east-1",metrics:[["AWS/CloudFront","BytesDownloaded","DistributionId",E.cloudFrontDistributionId,"Region","Global"]],period:300,stat:"Sum"}},{type:"metric",x:0,y:7,width:12,height:6,properties:{title:"S3 Bucket Size",region:E.region||"us-east-1",metrics:[["AWS/S3","BucketSizeBytes","BucketName",E.s3BucketName,"StorageType","StandardStorage"]],period:86400,stat:"Average"}},{type:"metric",x:12,y:7,width:12,height:6,properties:{title:"S3 Number of Objects",region:E.region||"us-east-1",metrics:[["AWS/S3","NumberOfObjects","BucketName",E.s3BucketName,"StorageType","AllStorageTypes"]],period:86400,stat:"Average"}}]}),serverlessApi:(E)=>({slug:E.slug,environment:E.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${E.slug.toUpperCase()} Serverless API Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"API Requests",region:E.region||"us-east-1",metrics:[["AWS/ApiGateway","Count","ApiName",E.apiGatewayName]],period:60,stat:"Sum"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"API Latency",region:E.region||"us-east-1",metrics:[["AWS/ApiGateway","Latency","ApiName",E.apiGatewayName]],period:60,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"API Errors",region:E.region||"us-east-1",metrics:[["AWS/ApiGateway","4XXError","ApiName",E.apiGatewayName,{label:"4XX"}],["AWS/ApiGateway","5XXError","ApiName",E.apiGatewayName,{label:"5XX"}]],period:60,stat:"Sum"}},...E.lambdaFunctionNames.map((T,_)=>({type:"metric",x:_%3*8,y:7+Math.floor(_/3)*6,width:8,height:6,properties:{title:`${T} Metrics`,region:E.region||"us-east-1",metrics:[["AWS/Lambda","Invocations","FunctionName",T],["AWS/Lambda","Duration","FunctionName",T],["AWS/Lambda","Errors","FunctionName",T]],period:300,stat:"Sum"}}))]}),containerService:(E)=>({slug:E.slug,environment:E.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${E.slug.toUpperCase()} Container Service Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"ECS CPU",region:E.region||"us-east-1",metrics:[["AWS/ECS","CPUUtilization","ClusterName",E.ecsClusterName,"ServiceName",E.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"ECS Memory",region:E.region||"us-east-1",metrics:[["AWS/ECS","MemoryUtilization","ClusterName",E.ecsClusterName,"ServiceName",E.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"Running Tasks",region:E.region||"us-east-1",metrics:[["ECS/ContainerInsights","RunningTaskCount","ClusterName",E.ecsClusterName,"ServiceName",E.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:0,y:7,width:8,height:6,properties:{title:"ALB Requests",region:E.region||"us-east-1",metrics:[["AWS/ApplicationELB","RequestCount","LoadBalancer",E.albName]],period:60,stat:"Sum"}},{type:"metric",x:8,y:7,width:8,height:6,properties:{title:"Response Time",region:E.region||"us-east-1",metrics:[["AWS/ApplicationELB","TargetResponseTime","LoadBalancer",E.albName]],period:60,stat:"Average"}},{type:"metric",x:16,y:7,width:8,height:6,properties:{title:"Healthy Hosts",region:E.region||"us-east-1",metrics:[["AWS/ApplicationELB","HealthyHostCount","LoadBalancer",E.albName]],period:60,stat:"Average"}},...E.rdsInstanceId?[{type:"metric",x:0,y:13,width:12,height:6,properties:{title:"RDS CPU",region:E.region||"us-east-1",metrics:[["AWS/RDS","CPUUtilization","DBInstanceIdentifier",E.rdsInstanceId]],period:300,stat:"Average"}},{type:"metric",x:12,y:13,width:12,height:6,properties:{title:"RDS Connections",region:E.region||"us-east-1",metrics:[["AWS/RDS","DatabaseConnections","DBInstanceIdentifier",E.rdsInstanceId]],period:60,stat:"Sum"}}]:[]]})};static Config={createAlarmConfig:(E)=>{let{metricName:T,namespace:_,threshold:r,comparisonOperator:t="GreaterThanThreshold",evaluationPeriods:d=1,period:R=300,statistic:h="Average",treatMissingData:S="missing"}=E;return{MetricName:T,Namespace:_,Threshold:r,ComparisonOperator:t,EvaluationPeriods:d,Period:R,Statistic:h,TreatMissingData:S}},namespaces:{ec2:"AWS/EC2",ecs:"AWS/ECS",lambda:"AWS/Lambda",rds:"AWS/RDS",sqs:"AWS/SQS",sns:"AWS/SNS",s3:"AWS/S3",cloudfront:"AWS/CloudFront",alb:"AWS/ApplicationELB",nlb:"AWS/NetworkELB",apiGateway:"AWS/ApiGateway",dynamodb:"AWS/DynamoDB",elasticache:"AWS/ElastiCache"},comparisonOperators:{greaterThan:"GreaterThanThreshold",greaterOrEqual:"GreaterThanOrEqualToThreshold",lessThan:"LessThanThreshold",lessOrEqual:"LessThanOrEqualToThreshold"},metrics:{ec2:{cpu:{metricName:"CPUUtilization",namespace:"AWS/EC2"},networkIn:{metricName:"NetworkIn",namespace:"AWS/EC2"},networkOut:{metricName:"NetworkOut",namespace:"AWS/EC2"},statusCheck:{metricName:"StatusCheckFailed",namespace:"AWS/EC2"}},ecs:{cpu:{metricName:"CPUUtilization",namespace:"AWS/ECS"},memory:{metricName:"MemoryUtilization",namespace:"AWS/ECS"}},lambda:{invocations:{metricName:"Invocations",namespace:"AWS/Lambda"},errors:{metricName:"Errors",namespace:"AWS/Lambda"},duration:{metricName:"Duration",namespace:"AWS/Lambda"},throttles:{metricName:"Throttles",namespace:"AWS/Lambda"},concurrentExecutions:{metricName:"ConcurrentExecutions",namespace:"AWS/Lambda"}},rds:{cpu:{metricName:"CPUUtilization",namespace:"AWS/RDS"},connections:{metricName:"DatabaseConnections",namespace:"AWS/RDS"},freeStorage:{metricName:"FreeStorageSpace",namespace:"AWS/RDS"},readLatency:{metricName:"ReadLatency",namespace:"AWS/RDS"},writeLatency:{metricName:"WriteLatency",namespace:"AWS/RDS"}},alb:{requestCount:{metricName:"RequestCount",namespace:"AWS/ApplicationELB"},responseTime:{metricName:"TargetResponseTime",namespace:"AWS/ApplicationELB"},httpCode4xx:{metricName:"HTTPCode_Target_4XX_Count",namespace:"AWS/ApplicationELB"},httpCode5xx:{metricName:"HTTPCode_Target_5XX_Count",namespace:"AWS/ApplicationELB"},healthyHosts:{metricName:"HealthyHostCount",namespace:"AWS/ApplicationELB"}},sqs:{messagesVisible:{metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS"},messagesDelayed:{metricName:"ApproximateNumberOfMessagesDelayed",namespace:"AWS/SQS"},messageAge:{metricName:"ApproximateAgeOfOldestMessage",namespace:"AWS/SQS"}}},presets:{highCpu:(E=80)=>({metricName:"CPUUtilization",threshold:E,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),highMemory:(E=80)=>({metricName:"MemoryUtilization",threshold:E,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),highErrors:(E=10)=>({metricName:"Errors",threshold:E,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:1,period:60,statistic:"Sum"}),highLatency:(E=5000)=>({metricName:"Duration",threshold:E,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),lowHealthyHosts:(E=1)=>({metricName:"HealthyHostCount",namespace:"AWS/ApplicationELB",threshold:E,comparisonOperator:"LessThanThreshold",evaluationPeriods:2,period:60,statistic:"Minimum"}),queueDepth:(E=1000)=>({metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS",threshold:E,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),lowStorage:(E=10737418240)=>({metricName:"FreeStorageSpace",namespace:"AWS/RDS",threshold:E,comparisonOperator:"LessThanThreshold",evaluationPeriods:1,period:300,statistic:"Average"})}}};Tr=class Tr{static createUserPool(E){let{slug:T,environment:_,userPoolName:r,aliasAttributes:t,autoVerifiedAttributes:d,passwordPolicy:R,mfaConfiguration:h,emailConfiguration:S,smsConfiguration:N,lambdaTriggers:A,userPoolAddOns:L,accountRecoverySetting:O}=E,c=r||RE({slug:T,environment:_,resourceType:"user-pool"}),U=i(c),$={Type:"AWS::Cognito::UserPool",Properties:{UserPoolName:c,Policies:R?{PasswordPolicy:{MinimumLength:R.minimumLength,RequireLowercase:R.requireLowercase,RequireUppercase:R.requireUppercase,RequireNumbers:R.requireNumbers,RequireSymbols:R.requireSymbols,TemporaryPasswordValidityDays:R.temporaryPasswordValidityDays}}:void 0,MfaConfiguration:h,Schema:[{Name:"email",AttributeDataType:"String",Required:!0,Mutable:!1}]}};if(t&&t.length>0)$.Properties.UsernameAttributes=t;if(d&&d.length>0)$.Properties.AutoVerifiedAttributes=d;if(S)$.Properties.EmailConfiguration={EmailSendingAccount:S.emailSendingAccount,From:S.from,ReplyToEmailAddress:S.replyToEmailAddress,SourceArn:S.sourceArn,ConfigurationSet:S.configurationSet};if(N)$.Properties.SmsConfiguration={ExternalId:N.externalId,SnsCallerArn:N.snsCallerArn};if(A)$.Properties.LambdaConfig={PreSignUp:A.preSignUp,PostConfirmation:A.postConfirmation,PreAuthentication:A.preAuthentication,PostAuthentication:A.postAuthentication,CustomMessage:A.customMessage,DefineAuthChallenge:A.defineAuthChallenge,CreateAuthChallenge:A.createAuthChallenge,VerifyAuthChallengeResponse:A.verifyAuthChallengeResponse,PreTokenGeneration:A.preTokenGeneration,UserMigration:A.userMigration};if(L)$.Properties.UserPoolAddOns={AdvancedSecurityMode:L.advancedSecurityMode};if(O)$.Properties.AccountRecoverySetting={RecoveryMechanisms:O.recoveryMechanisms};return{userPool:$,logicalId:U}}static createUserPoolClient(E,T){let{slug:_,environment:r,clientName:t,generateSecret:d=!1,refreshTokenValidity:R,accessTokenValidity:h,idTokenValidity:S,tokenValidityUnits:N,readAttributes:A,writeAttributes:L,explicitAuthFlows:O,preventUserExistenceErrors:c,enableTokenRevocation:U,callbackURLs:$,logoutURLs:I,allowedOAuthFlows:w,allowedOAuthScopes:z,allowedOAuthFlowsUserPoolClient:F,supportedIdentityProviders:j}=T,Y=t||RE({slug:_,environment:r,resourceType:"user-pool-client"}),H=i(Y);return{client:{Type:"AWS::Cognito::UserPoolClient",Properties:{ClientName:Y,UserPoolId:OE.Ref(E),GenerateSecret:d,RefreshTokenValidity:R,AccessTokenValidity:h,IdTokenValidity:S,TokenValidityUnits:N,ReadAttributes:A,WriteAttributes:L,ExplicitAuthFlows:O,PreventUserExistenceErrors:c,EnableTokenRevocation:U,CallbackURLs:$,LogoutURLs:I,AllowedOAuthFlows:w,AllowedOAuthScopes:z,AllowedOAuthFlowsUserPoolClient:F,SupportedIdentityProviders:j}},logicalId:H}}static createUserPoolDomain(E,T){let{slug:_,environment:r,domain:t,customDomainConfig:d}=T,R=RE({slug:_,environment:r,resourceType:"user-pool-domain"}),h=i(R);return{domain:{Type:"AWS::Cognito::UserPoolDomain",Properties:{Domain:t,UserPoolId:OE.Ref(E),CustomDomainConfig:d}},logicalId:h}}static createIdentityPool(E){let{slug:T,environment:_,identityPoolName:r,allowUnauthenticatedIdentities:t=!1,cognitoIdentityProviders:d,supportedLoginProviders:R,samlProviderARNs:h,openIdConnectProviderARNs:S}=E,N=r||RE({slug:T,environment:_,resourceType:"identity-pool"}),A=i(N);return{identityPool:{Type:"AWS::Cognito::IdentityPool",Properties:{IdentityPoolName:N,AllowUnauthenticatedIdentities:t,CognitoIdentityProviders:d,SupportedLoginProviders:R,SamlProviderARNs:h,OpenIdConnectProviderARNs:S}},logicalId:A}}static createIdentityPoolRoleAttachment(E,T){let{slug:_,environment:r,authenticatedRole:t,unauthenticatedRole:d,roleMappings:R}=T,h=RE({slug:_,environment:r,resourceType:"identity-pool-role-attachment"}),S=i(h),N={authenticated:t};if(d)N.unauthenticated=d;return{attachment:{Type:"AWS::Cognito::IdentityPoolRoleAttachment",Properties:{IdentityPoolId:OE.Ref(E),Roles:N,RoleMappings:R}},logicalId:S}}static createAuthenticatedRole(E){let{slug:T,environment:_,identityPoolLogicalId:r}=E,t=RE({slug:T,environment:_,resourceType:"cognito-authenticated-role"}),d=i(t);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:t,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Federated:"cognito-identity.amazonaws.com"},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{"cognito-identity.amazonaws.com:aud":OE.Ref(r)},"ForAnyValue:StringLike":{"cognito-identity.amazonaws.com:amr":"authenticated"}}}]},Policies:[{PolicyName:"CognitoAuthenticatedPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["cognito-sync:*","cognito-identity:*"],Resource:"*"}]}}],Tags:[{Key:"Name",Value:t},{Key:"Environment",Value:_}]}},logicalId:d}}static createUnauthenticatedRole(E){let{slug:T,environment:_,identityPoolLogicalId:r}=E,t=RE({slug:T,environment:_,resourceType:"cognito-unauthenticated-role"}),d=i(t);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:t,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Federated:"cognito-identity.amazonaws.com"},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{"cognito-identity.amazonaws.com:aud":OE.Ref(r)},"ForAnyValue:StringLike":{"cognito-identity.amazonaws.com:amr":"unauthenticated"}}}]},Policies:[{PolicyName:"CognitoUnauthenticatedPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["cognito-sync:*"],Resource:"*"}]}}],Tags:[{Key:"Name",Value:t},{Key:"Environment",Value:_}]}},logicalId:d}}static PasswordPolicies={relaxed:()=>({minimumLength:8,requireLowercase:!1,requireUppercase:!1,requireNumbers:!1,requireSymbols:!1,temporaryPasswordValidityDays:7}),standard:()=>({minimumLength:8,requireLowercase:!0,requireUppercase:!0,requireNumbers:!0,requireSymbols:!1,temporaryPasswordValidityDays:3}),strict:()=>({minimumLength:12,requireLowercase:!0,requireUppercase:!0,requireNumbers:!0,requireSymbols:!0,temporaryPasswordValidityDays:1})};static AuthFlows={standard:["ALLOW_USER_SRP_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],admin:["ALLOW_ADMIN_USER_PASSWORD_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],custom:["ALLOW_CUSTOM_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],all:["ALLOW_USER_SRP_AUTH","ALLOW_USER_PASSWORD_AUTH","ALLOW_ADMIN_USER_PASSWORD_AUTH","ALLOW_CUSTOM_AUTH","ALLOW_REFRESH_TOKEN_AUTH"]};static OAuthScopes={basic:["openid","email","profile"],all:["openid","email","profile","phone","aws.cognito.signin.user.admin"]};static UseCases={webApp:(E,T,_)=>{let{userPool:r,logicalId:t}=Tr.createUserPool({slug:E,environment:T,aliasAttributes:["email"],autoVerifiedAttributes:["email"],passwordPolicy:Tr.PasswordPolicies.standard(),mfaConfiguration:"OPTIONAL"}),{client:d,logicalId:R}=Tr.createUserPoolClient(t,{slug:E,environment:T,explicitAuthFlows:[...Tr.AuthFlows.standard],callbackURLs:[_],allowedOAuthFlows:["code"],allowedOAuthScopes:[...Tr.OAuthScopes.basic],allowedOAuthFlowsUserPoolClient:!0});return{userPool:r,poolId:t,client:d,clientId:R}},mobileApp:(E,T)=>{let{userPool:_,logicalId:r}=Tr.createUserPool({slug:E,environment:T,aliasAttributes:["email"],autoVerifiedAttributes:["email"],passwordPolicy:Tr.PasswordPolicies.standard(),mfaConfiguration:"OPTIONAL"}),{client:t,logicalId:d}=Tr.createUserPoolClient(r,{slug:E,environment:T,explicitAuthFlows:[...Tr.AuthFlows.standard]}),{identityPool:R,logicalId:h}=Tr.createIdentityPool({slug:E,environment:T,allowUnauthenticatedIdentities:!1,cognitoIdentityProviders:[{ClientId:OE.Ref(d),ProviderName:OE.GetAtt(r,"ProviderName")}]}),{role:S,logicalId:N}=Tr.createAuthenticatedRole({slug:E,environment:T,identityPoolLogicalId:h}),{attachment:A,logicalId:L}=Tr.createIdentityPoolRoleAttachment(h,{slug:E,environment:T,authenticatedRole:OE.GetAtt(N,"Arn")});return{userPool:_,poolId:r,client:t,clientId:d,identityPool:R,identityPoolId:h,authRole:S,authRoleId:N,attachment:A,attachmentId:L}}}};_r=class _r{static createApplication(E){let{slug:T,environment:_,applicationName:r,computePlatform:t}=E,d=r||RE({slug:T,environment:_,resourceType:"deploy-app"}),R=i(d);return{application:{Type:"AWS::CodeDeploy::Application",Properties:{ApplicationName:d,ComputePlatform:t,Tags:[{Key:"Name",Value:d},{Key:"Environment",Value:_}]}},logicalId:R}}static createDeploymentGroup(E,T){let{slug:_,environment:r,deploymentGroupName:t,serviceRoleArn:d,autoScalingGroups:R,ec2TagFilters:h,deploymentConfigName:S,autoRollbackConfiguration:N,alarmConfiguration:A,loadBalancerInfo:L,blueGreenDeploymentConfiguration:O}=T,c=t||RE({slug:_,environment:r,resourceType:"deploy-group"}),U=i(c);return{deploymentGroup:{Type:"AWS::CodeDeploy::DeploymentGroup",Properties:{ApplicationName:OE.Ref(E),DeploymentGroupName:c,ServiceRoleArn:d,AutoScalingGroups:R,Ec2TagFilters:h?.map((I)=>({Key:I.key,Value:I.value,Type:I.type})),DeploymentConfigName:S,AutoRollbackConfiguration:N?{Enabled:N.enabled,Events:N.events}:void 0,AlarmConfiguration:A?{Enabled:A.enabled,Alarms:A.alarms?.map((I)=>({Name:I.name})),IgnorePollAlarmFailure:A.ignorePollAlarmFailure}:void 0,LoadBalancerInfo:L?{TargetGroupInfoList:L.targetGroupInfoList?.map((I)=>({Name:I.name})),ElbInfoList:L.elbInfoList?.map((I)=>({Name:I.name}))}:void 0,BlueGreenDeploymentConfiguration:O?{TerminateBlueInstancesOnDeploymentSuccess:O.terminateBlueInstancesOnDeploymentSuccess?{Action:O.terminateBlueInstancesOnDeploymentSuccess.action,TerminationWaitTimeInMinutes:O.terminateBlueInstancesOnDeploymentSuccess.terminationWaitTimeInMinutes}:void 0,DeploymentReadyOption:O.deploymentReadyOption?{ActionOnTimeout:O.deploymentReadyOption.actionOnTimeout,WaitTimeInMinutes:O.deploymentReadyOption.waitTimeInMinutes}:void 0,GreenFleetProvisioningOption:O.greenFleetProvisioningOption?{Action:O.greenFleetProvisioningOption.action}:void 0}:void 0,Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:r}]}},logicalId:U}}static createDeploymentConfig(E){let{slug:T,environment:_,deploymentConfigName:r,minimumHealthyHosts:t,trafficRoutingConfig:d}=E,R=r||RE({slug:T,environment:_,resourceType:"deploy-config"}),h=i(R);return{deploymentConfig:{Type:"AWS::CodeDeploy::DeploymentConfig",Properties:{DeploymentConfigName:R,MinimumHealthyHosts:t?{Type:t.type,Value:t.value}:void 0,TrafficRoutingConfig:d?{Type:d.type,TimeBasedCanary:d.timeBasedCanary?{CanaryPercentage:d.timeBasedCanary.canaryPercentage,CanaryInterval:d.timeBasedCanary.canaryInterval}:void 0,TimeBasedLinear:d.timeBasedLinear?{LinearPercentage:d.timeBasedLinear.linearPercentage,LinearInterval:d.timeBasedLinear.linearInterval}:void 0}:void 0}},logicalId:h}}static DeploymentConfigs={allAtOnce:()=>({type:"FLEET_PERCENT",value:0}),halfAtATime:()=>({type:"FLEET_PERCENT",value:50}),oneAtATime:()=>({type:"HOST_COUNT",value:1}),custom:(E,T)=>({type:E,value:T})};static TrafficRouting={allAtOnce:()=>({type:"AllAtOnce"}),canary:(E,T)=>({type:"TimeBasedCanary",timeBasedCanary:{canaryPercentage:E,canaryInterval:T}}),linear:(E,T)=>({type:"TimeBasedLinear",timeBasedLinear:{linearPercentage:E,linearInterval:T}})};static RollbackConfigs={onFailure:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE"]}),onAlarmOrFailure:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM"]}),onAllEvents:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM","DEPLOYMENT_STOP_ON_REQUEST"]}),disabled:()=>({enabled:!1})};static BlueGreenConfigs={standard:()=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:5},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),withDelay:(E)=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:E},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),withManualApproval:(E)=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:5},deploymentReadyOption:{actionOnTimeout:"STOP_DEPLOYMENT",waitTimeInMinutes:E},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),keepBlue:()=>({terminateBlueInstancesOnDeploymentSuccess:{action:"KEEP_ALIVE"},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}})};static UseCases={ec2Deployment:(E,T,_,r)=>{let{application:t,logicalId:d}=_r.createApplication({slug:E,environment:T,computePlatform:"Server"}),{deploymentGroup:R,logicalId:h}=_r.createDeploymentGroup(d,{slug:E,environment:T,serviceRoleArn:_,autoScalingGroups:r,deploymentConfigName:"CodeDeployDefault.OneAtATime",autoRollbackConfiguration:_r.RollbackConfigs.onFailure()});return{application:t,appId:d,deploymentGroup:R,groupId:h}},lambdaCanaryDeployment:(E,T,_,r=10,t=5)=>{let{application:d,logicalId:R}=_r.createApplication({slug:E,environment:T,computePlatform:"Lambda"}),{deploymentConfig:h,logicalId:S}=_r.createDeploymentConfig({slug:E,environment:T,trafficRoutingConfig:_r.TrafficRouting.canary(r,t)}),{deploymentGroup:N,logicalId:A}=_r.createDeploymentGroup(R,{slug:E,environment:T,serviceRoleArn:_,deploymentConfigName:OE.Ref(S),autoRollbackConfiguration:_r.RollbackConfigs.onAlarmOrFailure()});return{application:d,appId:R,deploymentConfig:h,configId:S,deploymentGroup:N,groupId:A}},ecsBlueGreenDeployment:(E,T,_,r)=>{let{application:t,logicalId:d}=_r.createApplication({slug:E,environment:T,computePlatform:"ECS"}),{deploymentGroup:R,logicalId:h}=_r.createDeploymentGroup(d,{slug:E,environment:T,serviceRoleArn:_,loadBalancerInfo:{targetGroupInfoList:[{name:r}]},blueGreenDeploymentConfiguration:_r.BlueGreenConfigs.standard(),autoRollbackConfiguration:_r.RollbackConfigs.onFailure()});return{application:t,appId:d,deploymentGroup:R,groupId:h}}};static Strategies={rolling:(E=25)=>({type:"rolling",batchPercentage:E}),blueGreen:()=>({type:"blue-green"}),canary:(E=10,T=5)=>({type:"canary",canaryPercentage:E,canaryInterval:T}),allAtOnce:()=>({type:"all-at-once"})}};$_=class $_{static ContentTypes={".html":"text/html",".htm":"text/html",".css":"text/css",".js":"application/javascript",".mjs":"application/javascript",".json":"application/json",".xml":"application/xml",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".avif":"image/avif",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".ttf":"font/ttf",".otf":"font/otf",".eot":"application/vnd.ms-fontobject",".pdf":"application/pdf",".txt":"text/plain",".md":"text/markdown",".map":"application/json"};static NoHashPatterns=[/^index\.html$/,/^favicon\.ico$/,/^robots\.txt$/,/^sitemap\.xml$/,/^manifest\.json$/,/^\.well-known\//,/^_redirects$/,/^_headers$/];static computeFileHash(E,T="md5"){let _=nO(E);return IM(T).update(_).digest("hex")}static computeShortHash(E){return $_.computeFileHash(E).slice(0,8)}static getContentType(E){let T=Nj(E).toLowerCase();return $_.ContentTypes[T]||"application/octet-stream"}static shouldHashFile(E,T){return![...$_.NoHashPatterns,...T||[]].some((r)=>r.test(E))}static generateHashedFilename(E,T){let _=Nj(E),r=JM(E,_),t=Sj(E);if(t===".")return`${r}.${T}${_}`;return lA(t,`${r}.${T}${_}`)}static collectFiles(E,T){let _=[],r=T||E;if(!C$(E))return _;let t=CM(E,{withFileTypes:!0});for(let d of t){let R=lA(E,d.name);if(d.isDirectory())_.push(...$_.collectFiles(R,r));else if(d.isFile())_.push(R)}return _}static hashDirectory(E){let{sourceDir:T,outputDir:_,excludePatterns:r=[],hashAlgorithm:t="md5",copyUnhashed:d=!0}=E,R=$_.collectFiles(T),h=[],S={};for(let A of R){let L=A.replace(T,"").replace(/^[/\\]/,""),O=$_.shouldHashFile(L,r),c=XM(A),U=O?$_.computeFileHash(A,t).slice(0,8):"",$=O?$_.generateHashedFilename(L,U):L,I={originalPath:L,hashedPath:$,hash:U,size:c.size,contentType:$_.getContentType(A)};if(h.push(I),S[L]=$,_){let w=lA(_,$),z=Sj(w);if(!C$(z)){let{mkdirSync:F}=K8("node:fs");F(z,{recursive:!0})}if(O||d)wM(A,w)}}let N={version:"1.0",timestamp:new Date().toISOString(),assets:h,hashMap:S};if(_){let A=lA(_,"asset-manifest.json");vO(A,JSON.stringify(N,null,2))}return N}static getInvalidationPaths(E,T){let _=[];if(!E)return["/*"];let r=E.hashMap,t=T.hashMap;for(let[d,R]of Object.entries(t)){let h=r[d];if(!h||h!==R){if(_.push(`/${d}`),h&&h!==R)_.push(`/${h}`)}}for(let[d,R]of Object.entries(r))if(!t[d])_.push(`/${d}`),_.push(`/${R}`);if(_.length>100)return["/*"];return[...new Set(_)]}static updateHtmlReferences(E){let{htmlDir:T,manifest:_,basePath:r=""}=E,t=$_.collectFiles(T).filter((d)=>d.endsWith(".html")||d.endsWith(".htm"));for(let d of t){let R=nO(d,"utf-8");for(let[h,S]of Object.entries(_.hashMap)){if(h===S)continue;let N=[new RegExp(`(src|href)=["']${r}/?${$_.escapeRegExp(h)}["']`,"g"),new RegExp(`url\\(["']?${r}/?${$_.escapeRegExp(h)}["']?\\)`,"g")];for(let A of N)R=R.replace(A,(L)=>{return L.replace(h,S)})}vO(d,R)}}static updateCssReferences(E){let{cssDir:T,manifest:_,basePath:r=""}=E,t=$_.collectFiles(T).filter((d)=>d.endsWith(".css"));for(let d of t){let R=nO(d,"utf-8");for(let[h,S]of Object.entries(_.hashMap)){if(h===S)continue;let N=new RegExp(`url\\(["']?${r}/?${$_.escapeRegExp(h)}["']?\\)`,"g");R=R.replace(N,`url(${r}/${S})`)}vO(d,R)}}static escapeRegExp(E){return E.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}static generateS3DeploymentManifest(E){let{sourceDir:T,keyPrefix:_="",excludePatterns:r=[],cacheControl:t={hashed:"public, max-age=31536000, immutable",unhashed:"public, max-age=3600",html:"public, max-age=0, must-revalidate"}}=E;return $_.hashDirectory({sourceDir:T,excludePatterns:r}).assets.map((R)=>{let h=R.hash!=="",S=R.contentType==="text/html",N=t.unhashed||"public, max-age=3600";if(S)N=t.html||"public, max-age=0, must-revalidate";else if(h)N=t.hashed||"public, max-age=31536000, immutable";return{localPath:lA(T,R.originalPath),s3Key:_?`${_}/${R.hashedPath}`:R.hashedPath,contentType:R.contentType,cacheControl:N,hash:R.hash}})}static compareManifests(E,T){let _={added:[],removed:[],changed:[],unchanged:[]},r=new Set(Object.keys(E.hashMap)),t=new Set(Object.keys(T.hashMap));for(let d of t)if(!r.has(d))_.added.push(d);for(let d of r)if(!t.has(d))_.removed.push(d);for(let d of t)if(r.has(d))if(E.hashMap[d]!==T.hashMap[d])_.changed.push(d);else _.unchanged.push(d);return _}static loadManifest(E){if(!C$(E))return null;try{let T=nO(E,"utf-8");return JSON.parse(T)}catch{return null}}static saveManifest(E,T){vO(T,JSON.stringify(E,null,2))}};ZS=class ZS{static createSecret(E){let{slug:T,environment:_,secretName:r,description:t,secretString:d,kmsKeyId:R,tags:h}=E,S=r||RE({slug:T,environment:_,resourceType:"secret"}),N=i(S),A={Type:"AWS::SecretsManager::Secret",Properties:{Name:S,Description:t,SecretString:d,Tags:[{Key:"Name",Value:S},{Key:"Environment",Value:_},...h?Object.entries(h).map(([L,O])=>({Key:L,Value:O})):[]]}};if(R)A.Properties.KmsKeyId=R;return{secret:A,logicalId:N}}static createGeneratedSecret(E){let{slug:T,environment:_,secretName:r,description:t,excludeCharacters:d,excludeLowercase:R,excludeNumbers:h,excludePunctuation:S,excludeUppercase:N,passwordLength:A,requireEachIncludedType:L,kmsKeyId:O,tags:c}=E,U=r||RE({slug:T,environment:_,resourceType:"secret"}),$=i(U),I={Type:"AWS::SecretsManager::Secret",Properties:{Name:U,Description:t,GenerateSecretString:{ExcludeCharacters:d,ExcludeLowercase:R,ExcludeNumbers:h,ExcludePunctuation:S,ExcludeUppercase:N,PasswordLength:A||32,RequireEachIncludedType:L!==!1},Tags:[{Key:"Name",Value:U},{Key:"Environment",Value:_},...c?Object.entries(c).map(([w,z])=>({Key:w,Value:z})):[]]}};if(O)I.Properties.KmsKeyId=O;return{secret:I,logicalId:$}}static createDatabaseSecret(E){let{slug:T,environment:_,secretName:r,username:t,dbname:d,engine:R,host:h,port:S,kmsKeyId:N}=E,A=r||RE({slug:T,environment:_,resourceType:"db-secret"}),L=i(A),O={username:t};if(d)O.dbname=d;if(R)O.engine=R;if(h)O.host=h;if(S)O.port=S;let c={Type:"AWS::SecretsManager::Secret",Properties:{Name:A,Description:`Database credentials for ${t}`,GenerateSecretString:{SecretStringTemplate:JSON.stringify(O),GenerateStringKey:"password",PasswordLength:32,ExcludeCharacters:'"@/\\',RequireEachIncludedType:!0},Tags:[{Key:"Name",Value:A},{Key:"Environment",Value:_},{Key:"Type",Value:"database"}]}};if(N)c.Properties.KmsKeyId=N;return{secret:c,logicalId:L}}static attachToDatabase(E){let{slug:T,environment:_,secretId:r,targetId:t,targetType:d}=E,R=RE({slug:T,environment:_,resourceType:"secret-attachment"}),h=i(R);return{attachment:{Type:"AWS::SecretsManager::SecretTargetAttachment",Properties:{SecretId:r,TargetId:t,TargetType:d}},logicalId:h}}static enableRotation(E){let{slug:T,environment:_,secretId:r,rotationLambdaArn:t,automaticallyAfterDays:d,rotationType:R,kmsKeyArn:h,vpcSecurityGroupIds:S,vpcSubnetIds:N}=E,A=RE({slug:T,environment:_,resourceType:"secret-rotation"}),L=i(A),O={Type:"AWS::SecretsManager::RotationSchedule",Properties:{SecretId:r,RotationRules:{AutomaticallyAfterDays:d||30}}};if(t)O.Properties.RotationLambdaARN=t;else if(R)O.Properties.HostedRotationLambda={RotationType:R,KmsKeyArn:h,VpcSecurityGroupIds:S,VpcSubnetIds:N};return{rotation:O,logicalId:L}}static SecretTypes={apiKey:(E,T,_)=>{return ZS.createGeneratedSecret({slug:E,environment:T,secretName:`${E}-${T}-${_}-api-key`,description:`API key for ${_}`,passwordLength:32,excludePunctuation:!0,excludeLowercase:!1,excludeUppercase:!1,excludeNumbers:!1})},oauthClientSecret:(E,T,_)=>{return ZS.createGeneratedSecret({slug:E,environment:T,secretName:`${E}-${T}-${_}-oauth-secret`,description:`OAuth client secret for ${_}`,passwordLength:64,excludeCharacters:"\"'`\\/@",requireEachIncludedType:!0})},jwtSecret:(E,T)=>{return ZS.createGeneratedSecret({slug:E,environment:T,secretName:`${E}-${T}-jwt-secret`,description:"JWT signing secret",passwordLength:64,excludePunctuation:!0})},encryptionKey:(E,T)=>{return ZS.createGeneratedSecret({slug:E,environment:T,secretName:`${E}-${T}-encryption-key`,description:"Data encryption key",passwordLength:64,excludeCharacters:"+/=",excludePunctuation:!0})}};static RotationTypes={MySQLSingleUser:"MySQLSingleUser",MySQLMultiUser:"MySQLMultiUser",PostgreSQLSingleUser:"PostgreSQLSingleUser",PostgreSQLMultiUser:"PostgreSQLMultiUser",OracleSingleUser:"OracleSingleUser",OracleMultiUser:"OracleMultiUser",MariaDBSingleUser:"MariaDBSingleUser",MariaDBMultiUser:"MariaDBMultiUser",SQLServerSingleUser:"SQLServerSingleUser",SQLServerMultiUser:"SQLServerMultiUser",RedshiftSingleUser:"RedshiftSingleUser",RedshiftMultiUser:"RedshiftMultiUser",MongoDBSingleUser:"MongoDBSingleUser",MongoDBMultiUser:"MongoDBMultiUser"}};mT=class mT{static createParameter(E){let{slug:T,environment:_,parameterName:r,value:t,type:d="String",description:R,tier:h="Standard",tags:S}=E,N=r||RE({slug:T,environment:_,resourceType:"parameter"}),A=i(N);return{parameter:{Type:"AWS::SSM::Parameter",Properties:{Name:`/${T}/${_}/${N}`,Type:d,Value:t,Description:R,Tier:h,Tags:{Name:N,Environment:_,...S}}},logicalId:A}}static createString(E,T,_,r,t){return mT.createParameter({slug:E,environment:T,parameterName:_,value:r,type:"String",description:t})}static createSecureString(E,T,_,r,t){return mT.createParameter({slug:E,environment:T,parameterName:_,value:r,type:"SecureString",description:t})}static createStringList(E,T,_,r,t){return mT.createParameter({slug:E,environment:T,parameterName:_,value:r.join(","),type:"StringList",description:t})}static Parameters={databaseUrl:(E,T,_)=>{return mT.createSecureString(E,T,"database-url",_,"Database connection URL")},apiEndpoint:(E,T,_)=>{return mT.createString(E,T,"api-endpoint",_,"API endpoint URL")},appVersion:(E,T,_)=>{return mT.createString(E,T,"app-version",_,"Application version")},featureFlags:(E,T,_)=>{return mT.createStringList(E,T,"feature-flags",_,"Enabled feature flags")},apiKey:(E,T,_,r)=>{return mT.createSecureString(E,T,`${_}-api-key`,r,`API key for ${_}`)},oauthCredentials:(E,T,_,r)=>{let t=mT.createString(E,T,"oauth-client-id",_,"OAuth client ID"),d=mT.createSecureString(E,T,"oauth-client-secret",r,"OAuth client secret");return{clientId:t,clientSecret:d}},smtpCredentials:(E,T,_,r,t,d)=>{let R=mT.createString(E,T,"smtp-username",_,"SMTP username"),h=mT.createSecureString(E,T,"smtp-password",r,"SMTP password"),S=mT.createString(E,T,"smtp-host",t,"SMTP host"),N=mT.createString(E,T,"smtp-port",d.toString(),"SMTP port");return{username:R,password:h,host:S,port:N}},redisUrl:(E,T,_)=>{return mT.createSecureString(E,T,"redis-url",_,"Redis connection URL")},s3Bucket:(E,T,_)=>{return mT.createString(E,T,"s3-bucket",_,"S3 bucket name")},cloudFrontDistribution:(E,T,_)=>{return mT.createString(E,T,"cloudfront-distribution-id",_,"CloudFront distribution ID")}}};JR=class JR{static createDomain(E){let{slug:T,environment:_,domainName:r,engineVersion:t="OpenSearch_2.11",instanceType:d="t3.small.search",instanceCount:R=1,volumeSize:h=10,volumeType:S="gp3",dedicatedMaster:N=!1,dedicatedMasterType:A,dedicatedMasterCount:L=3,multiAz:O=!1,availabilityZoneCount:c=2,vpc:U,encryption:$,enforceHttps:I=!0,tlsSecurityPolicy:w="Policy-Min-TLS-1-2-2019-07",advancedSecurity:z,autoSnapshotHour:F=0,autoTune:j=!0,tags:Y={}}=E,H=r||RE({slug:T,environment:_,resourceType:"search"}),Q=i(H);return{domain:{Type:"AWS::OpenSearchService::Domain",Properties:{DomainName:H,EngineVersion:t,ClusterConfig:{InstanceType:d,InstanceCount:R,DedicatedMasterEnabled:N,...N&&{DedicatedMasterType:A||d,DedicatedMasterCount:L},ZoneAwarenessEnabled:O,...O&&{ZoneAwarenessConfig:{AvailabilityZoneCount:c}}},EBSOptions:{EBSEnabled:!0,VolumeType:S,VolumeSize:h},DomainEndpointOptions:{EnforceHTTPS:I,TLSSecurityPolicy:w},SnapshotOptions:{AutomatedSnapshotStartHour:F},...U&&{VPCOptions:{SubnetIds:U.subnetIds,SecurityGroupIds:U.securityGroupIds}},...$&&{EncryptionAtRestOptions:{Enabled:$.atRest??!0,...$.kmsKeyId&&{KmsKeyId:$.kmsKeyId}},NodeToNodeEncryptionOptions:{Enabled:$.nodeToNode??!0}},...z&&{AdvancedSecurityOptions:{Enabled:z.enabled,InternalUserDatabaseEnabled:z.internalUserDatabase??!0,...z.masterUserName&&z.masterUserPassword&&{MasterUserOptions:{MasterUserName:z.masterUserName,MasterUserPassword:z.masterUserPassword}},...z.masterUserArn&&{MasterUserOptions:{MasterUserARN:z.masterUserArn}}}},...j&&{AutoTuneOptions:{DesiredState:"ENABLED"}},Tags:[{Key:"Name",Value:H},{Key:"Environment",Value:_},...Object.entries(Y).map(([x,k])=>({Key:x,Value:k}))]}},logicalId:Q}}static createAccessPolicy(E,T){let{ipAddresses:_,iamPrincipalArns:r,allowAll:t,vpcEndpoint:d}=T;if(t)return{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:E}]};let R=[];if(r&&r.length>0)R.push({Effect:"Allow",Principal:{AWS:r},Action:"es:*",Resource:E});if(_&&_.length>0)R.push({Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:E,Condition:{IpAddress:{"aws:SourceIp":_}}});if(d)return{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:E}]};return{Version:"2012-10-17",Statement:R}}static DomainPresets={development:(E,T)=>{return JR.createDomain({slug:E,environment:T,instanceType:"t3.small.search",instanceCount:1,volumeSize:10,multiAz:!1,dedicatedMaster:!1,encryption:{atRest:!0,nodeToNode:!0},autoTune:!1})},production:(E,T,_)=>{return JR.createDomain({slug:E,environment:T,instanceType:"m6g.large.search",instanceCount:3,volumeSize:100,volumeType:"gp3",multiAz:!0,availabilityZoneCount:3,dedicatedMaster:!0,dedicatedMasterType:"m6g.large.search",dedicatedMasterCount:3,vpc:_,encryption:{atRest:!0,nodeToNode:!0},advancedSecurity:{enabled:!0,internalUserDatabase:!0},autoTune:!0})},costOptimized:(E,T)=>{return JR.createDomain({slug:E,environment:T,instanceType:"t3.medium.search",instanceCount:2,volumeSize:20,volumeType:"gp3",multiAz:!0,dedicatedMaster:!1,encryption:{atRest:!0,nodeToNode:!0},autoTune:!0})},highPerformance:(E,T,_)=>{return JR.createDomain({slug:E,environment:T,instanceType:"r6g.2xlarge.search",instanceCount:6,volumeSize:500,volumeType:"gp3",multiAz:!0,availabilityZoneCount:3,dedicatedMaster:!0,dedicatedMasterType:"c6g.xlarge.search",dedicatedMasterCount:3,vpc:_,encryption:{atRest:!0,nodeToNode:!0},advancedSecurity:{enabled:!0,internalUserDatabase:!1},autoTune:!0})}};static InstanceTypes={"t3.small.search":"t3.small.search","t3.medium.search":"t3.medium.search","m6g.large.search":"m6g.large.search","m6g.xlarge.search":"m6g.xlarge.search","m6g.2xlarge.search":"m6g.2xlarge.search","r6g.large.search":"r6g.large.search","r6g.xlarge.search":"r6g.xlarge.search","r6g.2xlarge.search":"r6g.2xlarge.search","r6g.4xlarge.search":"r6g.4xlarge.search","c6g.large.search":"c6g.large.search","c6g.xlarge.search":"c6g.xlarge.search","c6g.2xlarge.search":"c6g.2xlarge.search"};static EngineVersions={"OpenSearch_2.11":"OpenSearch_2.11","OpenSearch_2.9":"OpenSearch_2.9","OpenSearch_2.7":"OpenSearch_2.7","OpenSearch_1.3":"OpenSearch_1.3","Elasticsearch_7.10":"Elasticsearch_7.10"}};cd=class cd{static createDomainRedirectBucket(E){let{slug:T,environment:_,sourceDomain:r,targetDomain:t,protocol:d="https"}=E,R=RE({slug:T,environment:_,resourceType:"s3",suffix:"redirect"}),h=i(R),S=i(`${R}-policy`),N={Type:"AWS::S3::Bucket",Properties:{BucketName:r,WebsiteConfiguration:{RedirectAllRequestsTo:{HostName:t,Protocol:d}},PublicAccessBlockConfiguration:{BlockPublicAcls:!1,BlockPublicPolicy:!1,IgnorePublicAcls:!1,RestrictPublicBuckets:!1},Tags:[{Key:"Name",Value:R},{Key:"Environment",Value:_},{Key:"Purpose",Value:"Domain Redirect"}]}},A={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:OE.Ref(h),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadForRedirect",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[OE.Join("",[OE.GetAtt(h,"Arn"),"/*"])]}]}}};return{bucket:N,bucketPolicy:A,logicalId:h,policyLogicalId:S}}static createPathRedirectFunction(E){let{slug:T,environment:_,rules:r}=E,t=RE({slug:T,environment:_,resourceType:"cf-redirect"}),d=i(t),R=cd.generateRedirectFunctionCode(r);return{function:{Type:"AWS::CloudFront::Function",Properties:{Name:t,AutoPublish:!0,FunctionConfig:{Comment:`Path redirect function for ${T} (${_})`,Runtime:"cloudfront-js-2.0"},FunctionCode:R}},logicalId:d,functionCode:R}}static generateRedirectFunctionCode(E){return`function handler(event) {
+| limit 50`,region:r,title:"Recent Errors and Warnings"}}),R+=6;return NL.createDashboard({slug:T,environment:_,widgets:d})}static DashboardTemplates={staticWebsite:(E)=>({slug:E.slug,environment:E.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${E.slug.toUpperCase()} Static Website Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"CloudFront Requests",region:"us-east-1",metrics:[["AWS/CloudFront","Requests","DistributionId",E.cloudFrontDistributionId,"Region","Global"]],period:300,stat:"Sum"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"Error Rate",region:"us-east-1",metrics:[["AWS/CloudFront","4xxErrorRate","DistributionId",E.cloudFrontDistributionId,"Region","Global",{label:"4XX"}],["AWS/CloudFront","5xxErrorRate","DistributionId",E.cloudFrontDistributionId,"Region","Global",{label:"5XX"}]],period:300,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"Bytes Downloaded",region:"us-east-1",metrics:[["AWS/CloudFront","BytesDownloaded","DistributionId",E.cloudFrontDistributionId,"Region","Global"]],period:300,stat:"Sum"}},{type:"metric",x:0,y:7,width:12,height:6,properties:{title:"S3 Bucket Size",region:E.region||"us-east-1",metrics:[["AWS/S3","BucketSizeBytes","BucketName",E.s3BucketName,"StorageType","StandardStorage"]],period:86400,stat:"Average"}},{type:"metric",x:12,y:7,width:12,height:6,properties:{title:"S3 Number of Objects",region:E.region||"us-east-1",metrics:[["AWS/S3","NumberOfObjects","BucketName",E.s3BucketName,"StorageType","AllStorageTypes"]],period:86400,stat:"Average"}}]}),serverlessApi:(E)=>({slug:E.slug,environment:E.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${E.slug.toUpperCase()} Serverless API Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"API Requests",region:E.region||"us-east-1",metrics:[["AWS/ApiGateway","Count","ApiName",E.apiGatewayName]],period:60,stat:"Sum"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"API Latency",region:E.region||"us-east-1",metrics:[["AWS/ApiGateway","Latency","ApiName",E.apiGatewayName]],period:60,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"API Errors",region:E.region||"us-east-1",metrics:[["AWS/ApiGateway","4XXError","ApiName",E.apiGatewayName,{label:"4XX"}],["AWS/ApiGateway","5XXError","ApiName",E.apiGatewayName,{label:"5XX"}]],period:60,stat:"Sum"}},...E.lambdaFunctionNames.map((T,_)=>({type:"metric",x:_%3*8,y:7+Math.floor(_/3)*6,width:8,height:6,properties:{title:`${T} Metrics`,region:E.region||"us-east-1",metrics:[["AWS/Lambda","Invocations","FunctionName",T],["AWS/Lambda","Duration","FunctionName",T],["AWS/Lambda","Errors","FunctionName",T]],period:300,stat:"Sum"}}))]}),containerService:(E)=>({slug:E.slug,environment:E.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${E.slug.toUpperCase()} Container Service Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"ECS CPU",region:E.region||"us-east-1",metrics:[["AWS/ECS","CPUUtilization","ClusterName",E.ecsClusterName,"ServiceName",E.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"ECS Memory",region:E.region||"us-east-1",metrics:[["AWS/ECS","MemoryUtilization","ClusterName",E.ecsClusterName,"ServiceName",E.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"Running Tasks",region:E.region||"us-east-1",metrics:[["ECS/ContainerInsights","RunningTaskCount","ClusterName",E.ecsClusterName,"ServiceName",E.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:0,y:7,width:8,height:6,properties:{title:"ALB Requests",region:E.region||"us-east-1",metrics:[["AWS/ApplicationELB","RequestCount","LoadBalancer",E.albName]],period:60,stat:"Sum"}},{type:"metric",x:8,y:7,width:8,height:6,properties:{title:"Response Time",region:E.region||"us-east-1",metrics:[["AWS/ApplicationELB","TargetResponseTime","LoadBalancer",E.albName]],period:60,stat:"Average"}},{type:"metric",x:16,y:7,width:8,height:6,properties:{title:"Healthy Hosts",region:E.region||"us-east-1",metrics:[["AWS/ApplicationELB","HealthyHostCount","LoadBalancer",E.albName]],period:60,stat:"Average"}},...E.rdsInstanceId?[{type:"metric",x:0,y:13,width:12,height:6,properties:{title:"RDS CPU",region:E.region||"us-east-1",metrics:[["AWS/RDS","CPUUtilization","DBInstanceIdentifier",E.rdsInstanceId]],period:300,stat:"Average"}},{type:"metric",x:12,y:13,width:12,height:6,properties:{title:"RDS Connections",region:E.region||"us-east-1",metrics:[["AWS/RDS","DatabaseConnections","DBInstanceIdentifier",E.rdsInstanceId]],period:60,stat:"Sum"}}]:[]]})};static Config={createAlarmConfig:(E)=>{let{metricName:T,namespace:_,threshold:r,comparisonOperator:t="GreaterThanThreshold",evaluationPeriods:d=1,period:R=300,statistic:h="Average",treatMissingData:S="missing"}=E;return{MetricName:T,Namespace:_,Threshold:r,ComparisonOperator:t,EvaluationPeriods:d,Period:R,Statistic:h,TreatMissingData:S}},namespaces:{ec2:"AWS/EC2",ecs:"AWS/ECS",lambda:"AWS/Lambda",rds:"AWS/RDS",sqs:"AWS/SQS",sns:"AWS/SNS",s3:"AWS/S3",cloudfront:"AWS/CloudFront",alb:"AWS/ApplicationELB",nlb:"AWS/NetworkELB",apiGateway:"AWS/ApiGateway",dynamodb:"AWS/DynamoDB",elasticache:"AWS/ElastiCache"},comparisonOperators:{greaterThan:"GreaterThanThreshold",greaterOrEqual:"GreaterThanOrEqualToThreshold",lessThan:"LessThanThreshold",lessOrEqual:"LessThanOrEqualToThreshold"},metrics:{ec2:{cpu:{metricName:"CPUUtilization",namespace:"AWS/EC2"},networkIn:{metricName:"NetworkIn",namespace:"AWS/EC2"},networkOut:{metricName:"NetworkOut",namespace:"AWS/EC2"},statusCheck:{metricName:"StatusCheckFailed",namespace:"AWS/EC2"}},ecs:{cpu:{metricName:"CPUUtilization",namespace:"AWS/ECS"},memory:{metricName:"MemoryUtilization",namespace:"AWS/ECS"}},lambda:{invocations:{metricName:"Invocations",namespace:"AWS/Lambda"},errors:{metricName:"Errors",namespace:"AWS/Lambda"},duration:{metricName:"Duration",namespace:"AWS/Lambda"},throttles:{metricName:"Throttles",namespace:"AWS/Lambda"},concurrentExecutions:{metricName:"ConcurrentExecutions",namespace:"AWS/Lambda"}},rds:{cpu:{metricName:"CPUUtilization",namespace:"AWS/RDS"},connections:{metricName:"DatabaseConnections",namespace:"AWS/RDS"},freeStorage:{metricName:"FreeStorageSpace",namespace:"AWS/RDS"},readLatency:{metricName:"ReadLatency",namespace:"AWS/RDS"},writeLatency:{metricName:"WriteLatency",namespace:"AWS/RDS"}},alb:{requestCount:{metricName:"RequestCount",namespace:"AWS/ApplicationELB"},responseTime:{metricName:"TargetResponseTime",namespace:"AWS/ApplicationELB"},httpCode4xx:{metricName:"HTTPCode_Target_4XX_Count",namespace:"AWS/ApplicationELB"},httpCode5xx:{metricName:"HTTPCode_Target_5XX_Count",namespace:"AWS/ApplicationELB"},healthyHosts:{metricName:"HealthyHostCount",namespace:"AWS/ApplicationELB"}},sqs:{messagesVisible:{metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS"},messagesDelayed:{metricName:"ApproximateNumberOfMessagesDelayed",namespace:"AWS/SQS"},messageAge:{metricName:"ApproximateAgeOfOldestMessage",namespace:"AWS/SQS"}}},presets:{highCpu:(E=80)=>({metricName:"CPUUtilization",threshold:E,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),highMemory:(E=80)=>({metricName:"MemoryUtilization",threshold:E,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),highErrors:(E=10)=>({metricName:"Errors",threshold:E,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:1,period:60,statistic:"Sum"}),highLatency:(E=5000)=>({metricName:"Duration",threshold:E,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),lowHealthyHosts:(E=1)=>({metricName:"HealthyHostCount",namespace:"AWS/ApplicationELB",threshold:E,comparisonOperator:"LessThanThreshold",evaluationPeriods:2,period:60,statistic:"Minimum"}),queueDepth:(E=1000)=>({metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS",threshold:E,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),lowStorage:(E=10737418240)=>({metricName:"FreeStorageSpace",namespace:"AWS/RDS",threshold:E,comparisonOperator:"LessThanThreshold",evaluationPeriods:1,period:300,statistic:"Average"})}}};Tr=class Tr{static createUserPool(E){let{slug:T,environment:_,userPoolName:r,aliasAttributes:t,autoVerifiedAttributes:d,passwordPolicy:R,mfaConfiguration:h,emailConfiguration:S,smsConfiguration:N,lambdaTriggers:A,userPoolAddOns:L,accountRecoverySetting:O}=E,c=r||RE({slug:T,environment:_,resourceType:"user-pool"}),U=i(c),$={Type:"AWS::Cognito::UserPool",Properties:{UserPoolName:c,Policies:R?{PasswordPolicy:{MinimumLength:R.minimumLength,RequireLowercase:R.requireLowercase,RequireUppercase:R.requireUppercase,RequireNumbers:R.requireNumbers,RequireSymbols:R.requireSymbols,TemporaryPasswordValidityDays:R.temporaryPasswordValidityDays}}:void 0,MfaConfiguration:h,Schema:[{Name:"email",AttributeDataType:"String",Required:!0,Mutable:!1}]}};if(t&&t.length>0)$.Properties.UsernameAttributes=t;if(d&&d.length>0)$.Properties.AutoVerifiedAttributes=d;if(S)$.Properties.EmailConfiguration={EmailSendingAccount:S.emailSendingAccount,From:S.from,ReplyToEmailAddress:S.replyToEmailAddress,SourceArn:S.sourceArn,ConfigurationSet:S.configurationSet};if(N)$.Properties.SmsConfiguration={ExternalId:N.externalId,SnsCallerArn:N.snsCallerArn};if(A)$.Properties.LambdaConfig={PreSignUp:A.preSignUp,PostConfirmation:A.postConfirmation,PreAuthentication:A.preAuthentication,PostAuthentication:A.postAuthentication,CustomMessage:A.customMessage,DefineAuthChallenge:A.defineAuthChallenge,CreateAuthChallenge:A.createAuthChallenge,VerifyAuthChallengeResponse:A.verifyAuthChallengeResponse,PreTokenGeneration:A.preTokenGeneration,UserMigration:A.userMigration};if(L)$.Properties.UserPoolAddOns={AdvancedSecurityMode:L.advancedSecurityMode};if(O)$.Properties.AccountRecoverySetting={RecoveryMechanisms:O.recoveryMechanisms};return{userPool:$,logicalId:U}}static createUserPoolClient(E,T){let{slug:_,environment:r,clientName:t,generateSecret:d=!1,refreshTokenValidity:R,accessTokenValidity:h,idTokenValidity:S,tokenValidityUnits:N,readAttributes:A,writeAttributes:L,explicitAuthFlows:O,preventUserExistenceErrors:c,enableTokenRevocation:U,callbackURLs:$,logoutURLs:I,allowedOAuthFlows:w,allowedOAuthScopes:z,allowedOAuthFlowsUserPoolClient:F,supportedIdentityProviders:j}=T,Y=t||RE({slug:_,environment:r,resourceType:"user-pool-client"}),H=i(Y);return{client:{Type:"AWS::Cognito::UserPoolClient",Properties:{ClientName:Y,UserPoolId:OE.Ref(E),GenerateSecret:d,RefreshTokenValidity:R,AccessTokenValidity:h,IdTokenValidity:S,TokenValidityUnits:N,ReadAttributes:A,WriteAttributes:L,ExplicitAuthFlows:O,PreventUserExistenceErrors:c,EnableTokenRevocation:U,CallbackURLs:$,LogoutURLs:I,AllowedOAuthFlows:w,AllowedOAuthScopes:z,AllowedOAuthFlowsUserPoolClient:F,SupportedIdentityProviders:j}},logicalId:H}}static createUserPoolDomain(E,T){let{slug:_,environment:r,domain:t,customDomainConfig:d}=T,R=RE({slug:_,environment:r,resourceType:"user-pool-domain"}),h=i(R);return{domain:{Type:"AWS::Cognito::UserPoolDomain",Properties:{Domain:t,UserPoolId:OE.Ref(E),CustomDomainConfig:d}},logicalId:h}}static createIdentityPool(E){let{slug:T,environment:_,identityPoolName:r,allowUnauthenticatedIdentities:t=!1,cognitoIdentityProviders:d,supportedLoginProviders:R,samlProviderARNs:h,openIdConnectProviderARNs:S}=E,N=r||RE({slug:T,environment:_,resourceType:"identity-pool"}),A=i(N);return{identityPool:{Type:"AWS::Cognito::IdentityPool",Properties:{IdentityPoolName:N,AllowUnauthenticatedIdentities:t,CognitoIdentityProviders:d,SupportedLoginProviders:R,SamlProviderARNs:h,OpenIdConnectProviderARNs:S}},logicalId:A}}static createIdentityPoolRoleAttachment(E,T){let{slug:_,environment:r,authenticatedRole:t,unauthenticatedRole:d,roleMappings:R}=T,h=RE({slug:_,environment:r,resourceType:"identity-pool-role-attachment"}),S=i(h),N={authenticated:t};if(d)N.unauthenticated=d;return{attachment:{Type:"AWS::Cognito::IdentityPoolRoleAttachment",Properties:{IdentityPoolId:OE.Ref(E),Roles:N,RoleMappings:R}},logicalId:S}}static createAuthenticatedRole(E){let{slug:T,environment:_,identityPoolLogicalId:r}=E,t=RE({slug:T,environment:_,resourceType:"cognito-authenticated-role"}),d=i(t);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:t,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Federated:"cognito-identity.amazonaws.com"},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{"cognito-identity.amazonaws.com:aud":OE.Ref(r)},"ForAnyValue:StringLike":{"cognito-identity.amazonaws.com:amr":"authenticated"}}}]},Policies:[{PolicyName:"CognitoAuthenticatedPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["cognito-sync:*","cognito-identity:*"],Resource:"*"}]}}],Tags:[{Key:"Name",Value:t},{Key:"Environment",Value:_}]}},logicalId:d}}static createUnauthenticatedRole(E){let{slug:T,environment:_,identityPoolLogicalId:r}=E,t=RE({slug:T,environment:_,resourceType:"cognito-unauthenticated-role"}),d=i(t);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:t,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Federated:"cognito-identity.amazonaws.com"},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{"cognito-identity.amazonaws.com:aud":OE.Ref(r)},"ForAnyValue:StringLike":{"cognito-identity.amazonaws.com:amr":"unauthenticated"}}}]},Policies:[{PolicyName:"CognitoUnauthenticatedPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["cognito-sync:*"],Resource:"*"}]}}],Tags:[{Key:"Name",Value:t},{Key:"Environment",Value:_}]}},logicalId:d}}static PasswordPolicies={relaxed:()=>({minimumLength:8,requireLowercase:!1,requireUppercase:!1,requireNumbers:!1,requireSymbols:!1,temporaryPasswordValidityDays:7}),standard:()=>({minimumLength:8,requireLowercase:!0,requireUppercase:!0,requireNumbers:!0,requireSymbols:!1,temporaryPasswordValidityDays:3}),strict:()=>({minimumLength:12,requireLowercase:!0,requireUppercase:!0,requireNumbers:!0,requireSymbols:!0,temporaryPasswordValidityDays:1})};static AuthFlows={standard:["ALLOW_USER_SRP_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],admin:["ALLOW_ADMIN_USER_PASSWORD_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],custom:["ALLOW_CUSTOM_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],all:["ALLOW_USER_SRP_AUTH","ALLOW_USER_PASSWORD_AUTH","ALLOW_ADMIN_USER_PASSWORD_AUTH","ALLOW_CUSTOM_AUTH","ALLOW_REFRESH_TOKEN_AUTH"]};static OAuthScopes={basic:["openid","email","profile"],all:["openid","email","profile","phone","aws.cognito.signin.user.admin"]};static UseCases={webApp:(E,T,_)=>{let{userPool:r,logicalId:t}=Tr.createUserPool({slug:E,environment:T,aliasAttributes:["email"],autoVerifiedAttributes:["email"],passwordPolicy:Tr.PasswordPolicies.standard(),mfaConfiguration:"OPTIONAL"}),{client:d,logicalId:R}=Tr.createUserPoolClient(t,{slug:E,environment:T,explicitAuthFlows:[...Tr.AuthFlows.standard],callbackURLs:[_],allowedOAuthFlows:["code"],allowedOAuthScopes:[...Tr.OAuthScopes.basic],allowedOAuthFlowsUserPoolClient:!0});return{userPool:r,poolId:t,client:d,clientId:R}},mobileApp:(E,T)=>{let{userPool:_,logicalId:r}=Tr.createUserPool({slug:E,environment:T,aliasAttributes:["email"],autoVerifiedAttributes:["email"],passwordPolicy:Tr.PasswordPolicies.standard(),mfaConfiguration:"OPTIONAL"}),{client:t,logicalId:d}=Tr.createUserPoolClient(r,{slug:E,environment:T,explicitAuthFlows:[...Tr.AuthFlows.standard]}),{identityPool:R,logicalId:h}=Tr.createIdentityPool({slug:E,environment:T,allowUnauthenticatedIdentities:!1,cognitoIdentityProviders:[{ClientId:OE.Ref(d),ProviderName:OE.GetAtt(r,"ProviderName")}]}),{role:S,logicalId:N}=Tr.createAuthenticatedRole({slug:E,environment:T,identityPoolLogicalId:h}),{attachment:A,logicalId:L}=Tr.createIdentityPoolRoleAttachment(h,{slug:E,environment:T,authenticatedRole:OE.GetAtt(N,"Arn")});return{userPool:_,poolId:r,client:t,clientId:d,identityPool:R,identityPoolId:h,authRole:S,authRoleId:N,attachment:A,attachmentId:L}}}};_r=class _r{static createApplication(E){let{slug:T,environment:_,applicationName:r,computePlatform:t}=E,d=r||RE({slug:T,environment:_,resourceType:"deploy-app"}),R=i(d);return{application:{Type:"AWS::CodeDeploy::Application",Properties:{ApplicationName:d,ComputePlatform:t,Tags:[{Key:"Name",Value:d},{Key:"Environment",Value:_}]}},logicalId:R}}static createDeploymentGroup(E,T){let{slug:_,environment:r,deploymentGroupName:t,serviceRoleArn:d,autoScalingGroups:R,ec2TagFilters:h,deploymentConfigName:S,autoRollbackConfiguration:N,alarmConfiguration:A,loadBalancerInfo:L,blueGreenDeploymentConfiguration:O}=T,c=t||RE({slug:_,environment:r,resourceType:"deploy-group"}),U=i(c);return{deploymentGroup:{Type:"AWS::CodeDeploy::DeploymentGroup",Properties:{ApplicationName:OE.Ref(E),DeploymentGroupName:c,ServiceRoleArn:d,AutoScalingGroups:R,Ec2TagFilters:h?.map((I)=>({Key:I.key,Value:I.value,Type:I.type})),DeploymentConfigName:S,AutoRollbackConfiguration:N?{Enabled:N.enabled,Events:N.events}:void 0,AlarmConfiguration:A?{Enabled:A.enabled,Alarms:A.alarms?.map((I)=>({Name:I.name})),IgnorePollAlarmFailure:A.ignorePollAlarmFailure}:void 0,LoadBalancerInfo:L?{TargetGroupInfoList:L.targetGroupInfoList?.map((I)=>({Name:I.name})),ElbInfoList:L.elbInfoList?.map((I)=>({Name:I.name}))}:void 0,BlueGreenDeploymentConfiguration:O?{TerminateBlueInstancesOnDeploymentSuccess:O.terminateBlueInstancesOnDeploymentSuccess?{Action:O.terminateBlueInstancesOnDeploymentSuccess.action,TerminationWaitTimeInMinutes:O.terminateBlueInstancesOnDeploymentSuccess.terminationWaitTimeInMinutes}:void 0,DeploymentReadyOption:O.deploymentReadyOption?{ActionOnTimeout:O.deploymentReadyOption.actionOnTimeout,WaitTimeInMinutes:O.deploymentReadyOption.waitTimeInMinutes}:void 0,GreenFleetProvisioningOption:O.greenFleetProvisioningOption?{Action:O.greenFleetProvisioningOption.action}:void 0}:void 0,Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:r}]}},logicalId:U}}static createDeploymentConfig(E){let{slug:T,environment:_,deploymentConfigName:r,minimumHealthyHosts:t,trafficRoutingConfig:d}=E,R=r||RE({slug:T,environment:_,resourceType:"deploy-config"}),h=i(R);return{deploymentConfig:{Type:"AWS::CodeDeploy::DeploymentConfig",Properties:{DeploymentConfigName:R,MinimumHealthyHosts:t?{Type:t.type,Value:t.value}:void 0,TrafficRoutingConfig:d?{Type:d.type,TimeBasedCanary:d.timeBasedCanary?{CanaryPercentage:d.timeBasedCanary.canaryPercentage,CanaryInterval:d.timeBasedCanary.canaryInterval}:void 0,TimeBasedLinear:d.timeBasedLinear?{LinearPercentage:d.timeBasedLinear.linearPercentage,LinearInterval:d.timeBasedLinear.linearInterval}:void 0}:void 0}},logicalId:h}}static DeploymentConfigs={allAtOnce:()=>({type:"FLEET_PERCENT",value:0}),halfAtATime:()=>({type:"FLEET_PERCENT",value:50}),oneAtATime:()=>({type:"HOST_COUNT",value:1}),custom:(E,T)=>({type:E,value:T})};static TrafficRouting={allAtOnce:()=>({type:"AllAtOnce"}),canary:(E,T)=>({type:"TimeBasedCanary",timeBasedCanary:{canaryPercentage:E,canaryInterval:T}}),linear:(E,T)=>({type:"TimeBasedLinear",timeBasedLinear:{linearPercentage:E,linearInterval:T}})};static RollbackConfigs={onFailure:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE"]}),onAlarmOrFailure:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM"]}),onAllEvents:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM","DEPLOYMENT_STOP_ON_REQUEST"]}),disabled:()=>({enabled:!1})};static BlueGreenConfigs={standard:()=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:5},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),withDelay:(E)=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:E},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),withManualApproval:(E)=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:5},deploymentReadyOption:{actionOnTimeout:"STOP_DEPLOYMENT",waitTimeInMinutes:E},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),keepBlue:()=>({terminateBlueInstancesOnDeploymentSuccess:{action:"KEEP_ALIVE"},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}})};static UseCases={ec2Deployment:(E,T,_,r)=>{let{application:t,logicalId:d}=_r.createApplication({slug:E,environment:T,computePlatform:"Server"}),{deploymentGroup:R,logicalId:h}=_r.createDeploymentGroup(d,{slug:E,environment:T,serviceRoleArn:_,autoScalingGroups:r,deploymentConfigName:"CodeDeployDefault.OneAtATime",autoRollbackConfiguration:_r.RollbackConfigs.onFailure()});return{application:t,appId:d,deploymentGroup:R,groupId:h}},lambdaCanaryDeployment:(E,T,_,r=10,t=5)=>{let{application:d,logicalId:R}=_r.createApplication({slug:E,environment:T,computePlatform:"Lambda"}),{deploymentConfig:h,logicalId:S}=_r.createDeploymentConfig({slug:E,environment:T,trafficRoutingConfig:_r.TrafficRouting.canary(r,t)}),{deploymentGroup:N,logicalId:A}=_r.createDeploymentGroup(R,{slug:E,environment:T,serviceRoleArn:_,deploymentConfigName:OE.Ref(S),autoRollbackConfiguration:_r.RollbackConfigs.onAlarmOrFailure()});return{application:d,appId:R,deploymentConfig:h,configId:S,deploymentGroup:N,groupId:A}},ecsBlueGreenDeployment:(E,T,_,r)=>{let{application:t,logicalId:d}=_r.createApplication({slug:E,environment:T,computePlatform:"ECS"}),{deploymentGroup:R,logicalId:h}=_r.createDeploymentGroup(d,{slug:E,environment:T,serviceRoleArn:_,loadBalancerInfo:{targetGroupInfoList:[{name:r}]},blueGreenDeploymentConfiguration:_r.BlueGreenConfigs.standard(),autoRollbackConfiguration:_r.RollbackConfigs.onFailure()});return{application:t,appId:d,deploymentGroup:R,groupId:h}}};static Strategies={rolling:(E=25)=>({type:"rolling",batchPercentage:E}),blueGreen:()=>({type:"blue-green"}),canary:(E=10,T=5)=>({type:"canary",canaryPercentage:E,canaryInterval:T}),allAtOnce:()=>({type:"all-at-once"})}};$_=class $_{static ContentTypes={".html":"text/html",".htm":"text/html",".css":"text/css",".js":"application/javascript",".mjs":"application/javascript",".json":"application/json",".xml":"application/xml",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".avif":"image/avif",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".ttf":"font/ttf",".otf":"font/otf",".eot":"application/vnd.ms-fontobject",".pdf":"application/pdf",".txt":"text/plain",".md":"text/markdown",".map":"application/json"};static NoHashPatterns=[/^index\.html$/,/^favicon\.ico$/,/^robots\.txt$/,/^sitemap\.xml$/,/^manifest\.json$/,/^\.well-known\//,/^_redirects$/,/^_headers$/];static computeFileHash(E,T="md5"){let _=nO(E);return IM(T).update(_).digest("hex")}static computeShortHash(E){return $_.computeFileHash(E).slice(0,8)}static getContentType(E){let T=Nj(E).toLowerCase();return $_.ContentTypes[T]||"application/octet-stream"}static shouldHashFile(E,T){return![...$_.NoHashPatterns,...T||[]].some((r)=>r.test(E))}static generateHashedFilename(E,T){let _=Nj(E),r=JM(E,_),t=Sj(E);if(t===".")return`${r}.${T}${_}`;return lA(t,`${r}.${T}${_}`)}static collectFiles(E,T){let _=[],r=T||E;if(!C$(E))return _;let t=CM(E,{withFileTypes:!0});for(let d of t){let R=lA(E,d.name);if(d.isDirectory())_.push(...$_.collectFiles(R,r));else if(d.isFile())_.push(R)}return _}static hashDirectory(E){let{sourceDir:T,outputDir:_,excludePatterns:r=[],hashAlgorithm:t="md5",copyUnhashed:d=!0}=E,R=$_.collectFiles(T),h=[],S={};for(let A of R){let L=A.replace(T,"").replace(/^[/\\]/,""),O=$_.shouldHashFile(L,r),c=XM(A),U=O?$_.computeFileHash(A,t).slice(0,8):"",$=O?$_.generateHashedFilename(L,U):L,I={originalPath:L,hashedPath:$,hash:U,size:c.size,contentType:$_.getContentType(A)};if(h.push(I),S[L]=$,_){let w=lA(_,$),z=Sj(w);if(!C$(z)){let{mkdirSync:F}=K9("node:fs");F(z,{recursive:!0})}if(O||d)wM(A,w)}}let N={version:"1.0",timestamp:new Date().toISOString(),assets:h,hashMap:S};if(_){let A=lA(_,"asset-manifest.json");vO(A,JSON.stringify(N,null,2))}return N}static getInvalidationPaths(E,T){let _=[];if(!E)return["/*"];let r=E.hashMap,t=T.hashMap;for(let[d,R]of Object.entries(t)){let h=r[d];if(!h||h!==R){if(_.push(`/${d}`),h&&h!==R)_.push(`/${h}`)}}for(let[d,R]of Object.entries(r))if(!t[d])_.push(`/${d}`),_.push(`/${R}`);if(_.length>100)return["/*"];return[...new Set(_)]}static updateHtmlReferences(E){let{htmlDir:T,manifest:_,basePath:r=""}=E,t=$_.collectFiles(T).filter((d)=>d.endsWith(".html")||d.endsWith(".htm"));for(let d of t){let R=nO(d,"utf-8");for(let[h,S]of Object.entries(_.hashMap)){if(h===S)continue;let N=[new RegExp(`(src|href)=["']${r}/?${$_.escapeRegExp(h)}["']`,"g"),new RegExp(`url\\(["']?${r}/?${$_.escapeRegExp(h)}["']?\\)`,"g")];for(let A of N)R=R.replace(A,(L)=>{return L.replace(h,S)})}vO(d,R)}}static updateCssReferences(E){let{cssDir:T,manifest:_,basePath:r=""}=E,t=$_.collectFiles(T).filter((d)=>d.endsWith(".css"));for(let d of t){let R=nO(d,"utf-8");for(let[h,S]of Object.entries(_.hashMap)){if(h===S)continue;let N=new RegExp(`url\\(["']?${r}/?${$_.escapeRegExp(h)}["']?\\)`,"g");R=R.replace(N,`url(${r}/${S})`)}vO(d,R)}}static escapeRegExp(E){return E.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}static generateS3DeploymentManifest(E){let{sourceDir:T,keyPrefix:_="",excludePatterns:r=[],cacheControl:t={hashed:"public, max-age=31536000, immutable",unhashed:"public, max-age=3600",html:"public, max-age=0, must-revalidate"}}=E;return $_.hashDirectory({sourceDir:T,excludePatterns:r}).assets.map((R)=>{let h=R.hash!=="",S=R.contentType==="text/html",N=t.unhashed||"public, max-age=3600";if(S)N=t.html||"public, max-age=0, must-revalidate";else if(h)N=t.hashed||"public, max-age=31536000, immutable";return{localPath:lA(T,R.originalPath),s3Key:_?`${_}/${R.hashedPath}`:R.hashedPath,contentType:R.contentType,cacheControl:N,hash:R.hash}})}static compareManifests(E,T){let _={added:[],removed:[],changed:[],unchanged:[]},r=new Set(Object.keys(E.hashMap)),t=new Set(Object.keys(T.hashMap));for(let d of t)if(!r.has(d))_.added.push(d);for(let d of r)if(!t.has(d))_.removed.push(d);for(let d of t)if(r.has(d))if(E.hashMap[d]!==T.hashMap[d])_.changed.push(d);else _.unchanged.push(d);return _}static loadManifest(E){if(!C$(E))return null;try{let T=nO(E,"utf-8");return JSON.parse(T)}catch{return null}}static saveManifest(E,T){vO(T,JSON.stringify(E,null,2))}};ZS=class ZS{static createSecret(E){let{slug:T,environment:_,secretName:r,description:t,secretString:d,kmsKeyId:R,tags:h}=E,S=r||RE({slug:T,environment:_,resourceType:"secret"}),N=i(S),A={Type:"AWS::SecretsManager::Secret",Properties:{Name:S,Description:t,SecretString:d,Tags:[{Key:"Name",Value:S},{Key:"Environment",Value:_},...h?Object.entries(h).map(([L,O])=>({Key:L,Value:O})):[]]}};if(R)A.Properties.KmsKeyId=R;return{secret:A,logicalId:N}}static createGeneratedSecret(E){let{slug:T,environment:_,secretName:r,description:t,excludeCharacters:d,excludeLowercase:R,excludeNumbers:h,excludePunctuation:S,excludeUppercase:N,passwordLength:A,requireEachIncludedType:L,kmsKeyId:O,tags:c}=E,U=r||RE({slug:T,environment:_,resourceType:"secret"}),$=i(U),I={Type:"AWS::SecretsManager::Secret",Properties:{Name:U,Description:t,GenerateSecretString:{ExcludeCharacters:d,ExcludeLowercase:R,ExcludeNumbers:h,ExcludePunctuation:S,ExcludeUppercase:N,PasswordLength:A||32,RequireEachIncludedType:L!==!1},Tags:[{Key:"Name",Value:U},{Key:"Environment",Value:_},...c?Object.entries(c).map(([w,z])=>({Key:w,Value:z})):[]]}};if(O)I.Properties.KmsKeyId=O;return{secret:I,logicalId:$}}static createDatabaseSecret(E){let{slug:T,environment:_,secretName:r,username:t,dbname:d,engine:R,host:h,port:S,kmsKeyId:N}=E,A=r||RE({slug:T,environment:_,resourceType:"db-secret"}),L=i(A),O={username:t};if(d)O.dbname=d;if(R)O.engine=R;if(h)O.host=h;if(S)O.port=S;let c={Type:"AWS::SecretsManager::Secret",Properties:{Name:A,Description:`Database credentials for ${t}`,GenerateSecretString:{SecretStringTemplate:JSON.stringify(O),GenerateStringKey:"password",PasswordLength:32,ExcludeCharacters:'"@/\\',RequireEachIncludedType:!0},Tags:[{Key:"Name",Value:A},{Key:"Environment",Value:_},{Key:"Type",Value:"database"}]}};if(N)c.Properties.KmsKeyId=N;return{secret:c,logicalId:L}}static attachToDatabase(E){let{slug:T,environment:_,secretId:r,targetId:t,targetType:d}=E,R=RE({slug:T,environment:_,resourceType:"secret-attachment"}),h=i(R);return{attachment:{Type:"AWS::SecretsManager::SecretTargetAttachment",Properties:{SecretId:r,TargetId:t,TargetType:d}},logicalId:h}}static enableRotation(E){let{slug:T,environment:_,secretId:r,rotationLambdaArn:t,automaticallyAfterDays:d,rotationType:R,kmsKeyArn:h,vpcSecurityGroupIds:S,vpcSubnetIds:N}=E,A=RE({slug:T,environment:_,resourceType:"secret-rotation"}),L=i(A),O={Type:"AWS::SecretsManager::RotationSchedule",Properties:{SecretId:r,RotationRules:{AutomaticallyAfterDays:d||30}}};if(t)O.Properties.RotationLambdaARN=t;else if(R)O.Properties.HostedRotationLambda={RotationType:R,KmsKeyArn:h,VpcSecurityGroupIds:S,VpcSubnetIds:N};return{rotation:O,logicalId:L}}static SecretTypes={apiKey:(E,T,_)=>{return ZS.createGeneratedSecret({slug:E,environment:T,secretName:`${E}-${T}-${_}-api-key`,description:`API key for ${_}`,passwordLength:32,excludePunctuation:!0,excludeLowercase:!1,excludeUppercase:!1,excludeNumbers:!1})},oauthClientSecret:(E,T,_)=>{return ZS.createGeneratedSecret({slug:E,environment:T,secretName:`${E}-${T}-${_}-oauth-secret`,description:`OAuth client secret for ${_}`,passwordLength:64,excludeCharacters:"\"'`\\/@",requireEachIncludedType:!0})},jwtSecret:(E,T)=>{return ZS.createGeneratedSecret({slug:E,environment:T,secretName:`${E}-${T}-jwt-secret`,description:"JWT signing secret",passwordLength:64,excludePunctuation:!0})},encryptionKey:(E,T)=>{return ZS.createGeneratedSecret({slug:E,environment:T,secretName:`${E}-${T}-encryption-key`,description:"Data encryption key",passwordLength:64,excludeCharacters:"+/=",excludePunctuation:!0})}};static RotationTypes={MySQLSingleUser:"MySQLSingleUser",MySQLMultiUser:"MySQLMultiUser",PostgreSQLSingleUser:"PostgreSQLSingleUser",PostgreSQLMultiUser:"PostgreSQLMultiUser",OracleSingleUser:"OracleSingleUser",OracleMultiUser:"OracleMultiUser",MariaDBSingleUser:"MariaDBSingleUser",MariaDBMultiUser:"MariaDBMultiUser",SQLServerSingleUser:"SQLServerSingleUser",SQLServerMultiUser:"SQLServerMultiUser",RedshiftSingleUser:"RedshiftSingleUser",RedshiftMultiUser:"RedshiftMultiUser",MongoDBSingleUser:"MongoDBSingleUser",MongoDBMultiUser:"MongoDBMultiUser"}};mT=class mT{static createParameter(E){let{slug:T,environment:_,parameterName:r,value:t,type:d="String",description:R,tier:h="Standard",tags:S}=E,N=r||RE({slug:T,environment:_,resourceType:"parameter"}),A=i(N);return{parameter:{Type:"AWS::SSM::Parameter",Properties:{Name:`/${T}/${_}/${N}`,Type:d,Value:t,Description:R,Tier:h,Tags:{Name:N,Environment:_,...S}}},logicalId:A}}static createString(E,T,_,r,t){return mT.createParameter({slug:E,environment:T,parameterName:_,value:r,type:"String",description:t})}static createSecureString(E,T,_,r,t){return mT.createParameter({slug:E,environment:T,parameterName:_,value:r,type:"SecureString",description:t})}static createStringList(E,T,_,r,t){return mT.createParameter({slug:E,environment:T,parameterName:_,value:r.join(","),type:"StringList",description:t})}static Parameters={databaseUrl:(E,T,_)=>{return mT.createSecureString(E,T,"database-url",_,"Database connection URL")},apiEndpoint:(E,T,_)=>{return mT.createString(E,T,"api-endpoint",_,"API endpoint URL")},appVersion:(E,T,_)=>{return mT.createString(E,T,"app-version",_,"Application version")},featureFlags:(E,T,_)=>{return mT.createStringList(E,T,"feature-flags",_,"Enabled feature flags")},apiKey:(E,T,_,r)=>{return mT.createSecureString(E,T,`${_}-api-key`,r,`API key for ${_}`)},oauthCredentials:(E,T,_,r)=>{let t=mT.createString(E,T,"oauth-client-id",_,"OAuth client ID"),d=mT.createSecureString(E,T,"oauth-client-secret",r,"OAuth client secret");return{clientId:t,clientSecret:d}},smtpCredentials:(E,T,_,r,t,d)=>{let R=mT.createString(E,T,"smtp-username",_,"SMTP username"),h=mT.createSecureString(E,T,"smtp-password",r,"SMTP password"),S=mT.createString(E,T,"smtp-host",t,"SMTP host"),N=mT.createString(E,T,"smtp-port",d.toString(),"SMTP port");return{username:R,password:h,host:S,port:N}},redisUrl:(E,T,_)=>{return mT.createSecureString(E,T,"redis-url",_,"Redis connection URL")},s3Bucket:(E,T,_)=>{return mT.createString(E,T,"s3-bucket",_,"S3 bucket name")},cloudFrontDistribution:(E,T,_)=>{return mT.createString(E,T,"cloudfront-distribution-id",_,"CloudFront distribution ID")}}};JR=class JR{static createDomain(E){let{slug:T,environment:_,domainName:r,engineVersion:t="OpenSearch_2.11",instanceType:d="t3.small.search",instanceCount:R=1,volumeSize:h=10,volumeType:S="gp3",dedicatedMaster:N=!1,dedicatedMasterType:A,dedicatedMasterCount:L=3,multiAz:O=!1,availabilityZoneCount:c=2,vpc:U,encryption:$,enforceHttps:I=!0,tlsSecurityPolicy:w="Policy-Min-TLS-1-2-2019-07",advancedSecurity:z,autoSnapshotHour:F=0,autoTune:j=!0,tags:Y={}}=E,H=r||RE({slug:T,environment:_,resourceType:"search"}),Q=i(H);return{domain:{Type:"AWS::OpenSearchService::Domain",Properties:{DomainName:H,EngineVersion:t,ClusterConfig:{InstanceType:d,InstanceCount:R,DedicatedMasterEnabled:N,...N&&{DedicatedMasterType:A||d,DedicatedMasterCount:L},ZoneAwarenessEnabled:O,...O&&{ZoneAwarenessConfig:{AvailabilityZoneCount:c}}},EBSOptions:{EBSEnabled:!0,VolumeType:S,VolumeSize:h},DomainEndpointOptions:{EnforceHTTPS:I,TLSSecurityPolicy:w},SnapshotOptions:{AutomatedSnapshotStartHour:F},...U&&{VPCOptions:{SubnetIds:U.subnetIds,SecurityGroupIds:U.securityGroupIds}},...$&&{EncryptionAtRestOptions:{Enabled:$.atRest??!0,...$.kmsKeyId&&{KmsKeyId:$.kmsKeyId}},NodeToNodeEncryptionOptions:{Enabled:$.nodeToNode??!0}},...z&&{AdvancedSecurityOptions:{Enabled:z.enabled,InternalUserDatabaseEnabled:z.internalUserDatabase??!0,...z.masterUserName&&z.masterUserPassword&&{MasterUserOptions:{MasterUserName:z.masterUserName,MasterUserPassword:z.masterUserPassword}},...z.masterUserArn&&{MasterUserOptions:{MasterUserARN:z.masterUserArn}}}},...j&&{AutoTuneOptions:{DesiredState:"ENABLED"}},Tags:[{Key:"Name",Value:H},{Key:"Environment",Value:_},...Object.entries(Y).map(([x,k])=>({Key:x,Value:k}))]}},logicalId:Q}}static createAccessPolicy(E,T){let{ipAddresses:_,iamPrincipalArns:r,allowAll:t,vpcEndpoint:d}=T;if(t)return{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:E}]};let R=[];if(r&&r.length>0)R.push({Effect:"Allow",Principal:{AWS:r},Action:"es:*",Resource:E});if(_&&_.length>0)R.push({Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:E,Condition:{IpAddress:{"aws:SourceIp":_}}});if(d)return{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:E}]};return{Version:"2012-10-17",Statement:R}}static DomainPresets={development:(E,T)=>{return JR.createDomain({slug:E,environment:T,instanceType:"t3.small.search",instanceCount:1,volumeSize:10,multiAz:!1,dedicatedMaster:!1,encryption:{atRest:!0,nodeToNode:!0},autoTune:!1})},production:(E,T,_)=>{return JR.createDomain({slug:E,environment:T,instanceType:"m6g.large.search",instanceCount:3,volumeSize:100,volumeType:"gp3",multiAz:!0,availabilityZoneCount:3,dedicatedMaster:!0,dedicatedMasterType:"m6g.large.search",dedicatedMasterCount:3,vpc:_,encryption:{atRest:!0,nodeToNode:!0},advancedSecurity:{enabled:!0,internalUserDatabase:!0},autoTune:!0})},costOptimized:(E,T)=>{return JR.createDomain({slug:E,environment:T,instanceType:"t3.medium.search",instanceCount:2,volumeSize:20,volumeType:"gp3",multiAz:!0,dedicatedMaster:!1,encryption:{atRest:!0,nodeToNode:!0},autoTune:!0})},highPerformance:(E,T,_)=>{return JR.createDomain({slug:E,environment:T,instanceType:"r6g.2xlarge.search",instanceCount:6,volumeSize:500,volumeType:"gp3",multiAz:!0,availabilityZoneCount:3,dedicatedMaster:!0,dedicatedMasterType:"c6g.xlarge.search",dedicatedMasterCount:3,vpc:_,encryption:{atRest:!0,nodeToNode:!0},advancedSecurity:{enabled:!0,internalUserDatabase:!1},autoTune:!0})}};static InstanceTypes={"t3.small.search":"t3.small.search","t3.medium.search":"t3.medium.search","m6g.large.search":"m6g.large.search","m6g.xlarge.search":"m6g.xlarge.search","m6g.2xlarge.search":"m6g.2xlarge.search","r6g.large.search":"r6g.large.search","r6g.xlarge.search":"r6g.xlarge.search","r6g.2xlarge.search":"r6g.2xlarge.search","r6g.4xlarge.search":"r6g.4xlarge.search","c6g.large.search":"c6g.large.search","c6g.xlarge.search":"c6g.xlarge.search","c6g.2xlarge.search":"c6g.2xlarge.search"};static EngineVersions={"OpenSearch_2.11":"OpenSearch_2.11","OpenSearch_2.9":"OpenSearch_2.9","OpenSearch_2.7":"OpenSearch_2.7","OpenSearch_1.3":"OpenSearch_1.3","Elasticsearch_7.10":"Elasticsearch_7.10"}};cd=class cd{static createDomainRedirectBucket(E){let{slug:T,environment:_,sourceDomain:r,targetDomain:t,protocol:d="https"}=E,R=RE({slug:T,environment:_,resourceType:"s3",suffix:"redirect"}),h=i(R),S=i(`${R}-policy`),N={Type:"AWS::S3::Bucket",Properties:{BucketName:r,WebsiteConfiguration:{RedirectAllRequestsTo:{HostName:t,Protocol:d}},PublicAccessBlockConfiguration:{BlockPublicAcls:!1,BlockPublicPolicy:!1,IgnorePublicAcls:!1,RestrictPublicBuckets:!1},Tags:[{Key:"Name",Value:R},{Key:"Environment",Value:_},{Key:"Purpose",Value:"Domain Redirect"}]}},A={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:OE.Ref(h),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadForRedirect",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[OE.Join("",[OE.GetAtt(h,"Arn"),"/*"])]}]}}};return{bucket:N,bucketPolicy:A,logicalId:h,policyLogicalId:S}}static createPathRedirectFunction(E){let{slug:T,environment:_,rules:r}=E,t=RE({slug:T,environment:_,resourceType:"cf-redirect"}),d=i(t),R=cd.generateRedirectFunctionCode(r);return{function:{Type:"AWS::CloudFront::Function",Properties:{Name:t,AutoPublish:!0,FunctionConfig:{Comment:`Path redirect function for ${T} (${_})`,Runtime:"cloudfront-js-2.0"},FunctionCode:R}},logicalId:d,functionCode:R}}static generateRedirectFunctionCode(E){return`function handler(event) {
   const request = event.request;
   const uri = request.uri;
   const querystring = request.querystring;
@@ -9218,10 +9218,10 @@ EOF`,'echo "DISKPCT=${DISKPCT:-0}"','echo "DISKUSEDG=${DISKUSEDG:-0}"','echo "DI
 `)){let r=_.trim();if(r.startsWith("DISCOVERED_SITE="))try{let t=JSON.parse(Buffer.from(r.slice(16),"base64").toString("utf8"));if(t?.domain&&t?.route)T.discoveredSites.push(t)}catch{}else if(r.startsWith("SVC=")){let[,t,d,R,h,S]=/^SVC=([^=]+)=([^=]+)(?:=([^=]*)(?:=([^=]*)(?:=(.*))?)?)?$/.exec(r)??[];if(t)T.services.push({name:t,status:d,memBytes:Number(R||0),enabled:h||n_,since:S||n_})}else{let t=r.indexOf("=");if(t>0)T[r.slice(0,t)]=r.slice(t+1)}}return T}function vY(E){let T=E.infrastructure?.compute,_=[];if(T?.webServer==="rpx"||T?.proxy?.engine==="rpx")_.push({name:"rpx-gateway",status:"configured"});else if(T?.webServer==="nginx"||T?.webServer==null)_.push({name:"ts-cloud-nginx",status:"configured"});let r=T?.php?.versions??(T?.runtime==="php"?["8.3"]:[]);for(let R of r)_.push({name:`php${R}-fpm`,status:"configured"});let t=T?.managedServices??{},d=[["mysql","mysql"],["mariadb","mariadb"],["postgres","postgresql"],["redis","redis"],["memcached","memcached"],["meilisearch","meilisearch"]];for(let[R,h]of d)if(t[R])_.push({name:h,status:"configured"});return _}function Dl(E){let T=E.infrastructure?.compute?.backups,_=!!T?.enabled,r=T?.schedule??"0 2 * * *";return{enabled:_,schedule:r,destination:_?T?.bucket??"local":"off",retention:_?T?.retentionCount??5:0,last:_?"pending first run":"not configured",size:_?n_:"0 MB"}}function lY(E){return E.infrastructure?.compute?.provider??E.cloud?.provider??E.provider??"aws"}function $l(E){if(lY(E)==="hetzner")return DC(E);return E.project.region??"us-east-1"}function Il(E,T){let _=el(process.cwd(),"storage","cloud","state",`${E.project.slug}-${T}.json`);if(!Ol(_))return null;try{return JSON.parse(cl(_,"utf8"))}catch{return null}}function wl(E){let T=E.sites??{},_=[];for(let[r,t]of Object.entries(T)){let d=t.queues??t.workers;if(Array.isArray(d)){for(let R of d)if(typeof R==="string")_.push({name:`${r}:${R}`,site:r,processes:1,status:"configured"});else if(R?.name)_.push({name:`${r}:${R.name}`,site:r,processes:R.processes??1,status:"configured"})}}return _}function iY(E){if(!E||E==="")return"/";return E.startsWith("/")?E:`/${E}`}function Cl(E){let T=iY(E.path);if(!E.domain)return{route:"internal"};return{route:T==="/"?E.domain:`${E.domain}${T}`,href:`https://${E.domain}${T==="/"?"":T}`}}function bY(E,T){let _=nT(T);if(_==="redirect")return"redirect";let r=String(T.build??"").toLowerCase(),t=String(T.start??"").toLowerCase();if(E==="main"||t.includes("buddy/src/cli.ts serve"))return"stacks";if(E==="api"||t.includes("/serve/api"))return"api";if(r.includes("buildblog"))return"bunpress blog";if(r.includes("bunpress"))return"bunpress";if(r.includes("site:build")||r.includes("stx"))return"stx static";if(_==="server-static")return T.spa?"spa":"static";if(_==="server-app")return"app";if(_==="server-php")return T.type??"php";return"bucket"}function Xl(E){let T=nT(E);if(T==="redirect")return"—";let _=`${E.start??""} ${E.build??""}`.toLowerCase();if(T==="server-static")return _.includes("bunpress")||_.includes("bun ")||_.includes("bunx ")?"static/bun":"static";if(T==="server-app")return _.includes("bun")?"bun":"node";if(T==="server-php")return`php ${E.php??E.phpVersion??"8.3"}`;return"static"}function Jl(E){let T=nT(E);if(T==="redirect")return"redirect";if(T==="server-app")return"service";if(T==="server-static")return"server static";if(T==="server-php")return"php release";return"bucket"}function zl(E){let T=new Map;return Object.entries(E.sites??{}).map(([_,r])=>{let t=iY(r.path),{route:d,href:R}=Cl(r),h=r.domain?`${r.domain}${t}`:"",S=h?T.get(h):void 0;if(h&&!S)T.set(h,_);return{name:_,route:d,href:R,domain:r.domain??"internal",path:t,kind:bY(_,r),type:bY(_,r),runtime:Xl(r),deploy:Jl(r),tls:r.domain?r.ssl===!1?"http":"https":"loopback",ssl:r.domain?r.ssl!==!1:!1,status:S?"shadowed":"live",shadowedBy:S,lastDeploy:n_}})}function aY(E,T,_){let r=new Map(E.map((t)=>[String(t.route),{...t,project:_,managedBy:"owner"}]));for(let t of T){let d=r.get(t.route),R=d?.name??`${t.project}:${t.name}`;r.set(t.route,{...d,...t,name:R,kind:d?.kind??t.kind,type:d?.type??t.kind,runtime:d?.runtime??t.runtime,deploy:d?.deploy??t.deploy,root:d?.root??t.root,branch:d?.branch??t.branch,managedBy:t.project===_?"owner":"attached"})}return[...r.values()].sort((t,d)=>{if(t.managedBy!==d.managedBy)return t.managedBy==="owner"?-1:1;return String(t.route).localeCompare(String(d.route))})}function AJ(E){return`'${E.replaceAll("'","'\\''")}'`}function mY(E){return E.replace(/[\\&/]/g,"\\$&")}function Fl(E,T){if(E.length===0)return["true"];return["set +e",...E.map((_)=>{let r=AJ(`${sr(T,_)}/.ts-cloud/deploy-history.log`),t=mY(_);return`TS_CLOUD_HISTORY=${r}; { [ -f "$TS_CLOUD_HISTORY" ] && tail -n 24 "$TS_CLOUD_HISTORY" | sed "s/^/DEPLOY=${t}\\t/"; } || true`}),"true"]}function sY(E){return[...new Set(Object.values(E.sites??{}).map((T)=>T.domain).filter((T)=>typeof T==="string"&&T.length>0))]}function jl(E){return["set +e",'if command -v ss >/dev/null 2>&1; then ss -H -lntup 2>/dev/null | while read -r proto _state _recv _send local _peer rest; do [ -n "$proto" ] && [ -n "$local" ] && printf "PORT=%s\\t%s\\t%s\\n" "$proto" "$local" "$rest"; done; fi','if command -v ufw >/dev/null 2>&1; then ufw status numbered 2>/dev/null | sed "s/^/FIREWALL=/"; else echo "FIREWALL=ufw unavailable"; fi','journalctl _COMM=sshd --no-pager -n 30 -o short-iso 2>/dev/null | sed "s/^/AUTH=/" || true',...sY(E).map((_)=>{return`TS_CLOUD_DOMAIN=${AJ(_)}; TS_CLOUD_EXPIRY=$(echo | timeout 8 openssl s_client -servername "$TS_CLOUD_DOMAIN" -connect "$TS_CLOUD_DOMAIN:443" 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2-); [ -n "$TS_CLOUD_EXPIRY" ] && printf "CERT=%s\\t%s\\n" "$TS_CLOUD_DOMAIN" "$TS_CLOUD_EXPIRY" || printf "CERT=%s\\tunavailable\\n" "$TS_CLOUD_DOMAIN"`}),"true"]}function pY(E){let T=new Map,_=(d,R)=>{if(d&&R&&!T.has(R))T.set(R,{pattern:d,label:R})},r=E.infrastructure?.compute,t=E.project.slug;if(r?.webServer==="rpx"||r?.proxy?.engine==="rpx")_("rpx-gateway","rpx-gateway");else _("nginx","nginx");for(let d of vY(E))_(d.name,d.name);for(let[d,R]of Object.entries(E.sites??{})){if(nT(R)!=="server-app")continue;if(_(`${t}-${d}`,`${t}-${d}`),Array.isArray(R.queues??R.workers)&&(R.queues??R.workers).length)_(`${t}-${d}-queue-*`,`${t}-${d}-queues`);if(Array.isArray(R.daemons)&&R.daemons.length)_(`${t}-${d}-daemon-*`,`${t}-${d}-daemons`)}return[...T.values()]}function yl(E){let T=pY(E);if(T.length===0)return["true"];return["set +e",...T.map((_)=>{let r=AJ(_.pattern),t=mY(_.label);return`journalctl -u ${r} --no-pager -n 150 -o short-iso 2>/dev/null | sed "s/^/LOG=${t}\\t/" || true`}),'[ -f /var/log/ts-cloud-backup.log ] && tail -n 60 /var/log/ts-cloud-backup.log 2>/dev/null | sed "s/^/LOG=backups\\t/" || true',"true"]}function LJ(E){let T=new Date(E);if(Number.isNaN(T.getTime()))return E||n_;let _=Math.max(0,Math.round((Date.now()-T.getTime())/1000));if(_<60)return`${_}s ago`;let r=Math.round(_/60);if(r<60)return`${r}m ago`;let t=Math.round(r/60);if(t<48)return`${t}h ago`;return`${Math.round(t/24)}d ago`}function oY(E){if(/(?:error|failed|panic|fatal|exception|denied|unhealthy)/i.test(E))return"error";if(/(?:warn|warning|retry|restart|deprecated|timeout)/i.test(E))return"warn";return"info"}function Ef(E){let T=[];for(let _ of E.split(`
 `)){let r=_.trim();if(!r.startsWith("LOG="))continue;let t=r.indexOf("\t");if(t<0)continue;let d=r.slice(4,t),R=r.slice(t+1),h=/^(\d{4}-\d{2}-\d{2}T[^\s]+)\s+(\S+)\s+(.*)$/.exec(R),S=h?.[1]??"",N=h?.[2]??"",A=(h?.[3]??R).trim();if(!A)continue;T.push({source:d,timestamp:S,when:S?LJ(S):n_,host:N,message:A,level:oY(A)})}return T.sort((_,r)=>String(r.timestamp).localeCompare(String(_.timestamp))).slice(0,600)}function Tf(E){if(/^(?:127\.|localhost:|\[?::1\]?)/.test(E))return"loopback";if(/^(?:10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|169\.254\.|\[?f[cd][0-9a-f:])/i.test(E))return"private";return"public"}function Bl(E){if(Tf(E)!=="public")return"ok";if(/:(?:22|80|443)$/.test(E)||/^\*:(?:22|80|443)$/.test(E))return"ok";return"warn"}function Pl(E){if(E==null)return"warn";if(E<8)return"bad";if(E<30)return"warn";return"ok"}function _f(E){let T=[],_=[],r=[],t=[];for(let h of E.split(`
 `)){let S=h.trim();if(S.startsWith("PORT=")){let[N="",A="",L=""]=S.slice(5).split("\t");if(N&&A)T.push({proto:N,listen:A,processName:L||n_,exposure:Tf(A),tone:Bl(A)})}else if(S.startsWith("FIREWALL=")){let N=S.slice(9).trim();if(N)_.push(N)}else if(S.startsWith("AUTH=")){let N=S.slice(5),A=/^(\d{4}-\d{2}-\d{2}T[^\s]+)\s+(\S+)\s+(.*)$/.exec(N),L=(A?.[3]??N).trim();if(L)r.push({timestamp:A?.[1]??"",when:A?.[1]?LJ(A[1]):n_,host:A?.[2]??"",message:L,level:oY(L)})}else if(S.startsWith("CERT=")){let[N="",A=""]=S.slice(5).split("\t");if(!N)continue;let L=new Date(A),O=Number.isNaN(L.getTime())?null:Math.ceil((L.getTime()-Date.now())/86400000);t.push({domain:N,expires:Number.isNaN(L.getTime())?A||n_:L.toISOString().slice(0,10),daysRemaining:O,status:Pl(O)})}}let d=_.some((h)=>/Status:\s*active/i.test(h)),R=_.some((h)=>/unavailable/i.test(h));return{ports:T.slice(0,80),firewall:{status:d?"active":R?"unavailable":"inactive",summary:d?"ufw active":R?"ufw unavailable":"ufw inactive or not configured",rules:_.filter((h)=>h&&!/^Status:/i.test(h)).slice(0,60)},tlsCertificates:t,authEvents:r.sort((h,S)=>String(S.timestamp).localeCompare(String(h.timestamp))).slice(0,30)}}function OJ(E){let _=E.infrastructure?.compute?.firewall??{},r=[...new Set([22,80,443,..._.allowedPorts??[]])],t=sY(E);return{ports:r.map((d)=>({proto:"tcp",listen:`0.0.0.0:${d}`,processName:"configured firewall",exposure:"public",tone:[22,80,443].includes(Number(d))?"ok":"warn"})),firewall:{status:_.enabled===!1?"disabled":"configured",summary:_.enabled===!1?"host firewall disabled in config":"host firewall configured declaratively",rules:r.map((d)=>`ALLOW ${d}/tcp`)},tlsCertificates:t.map((d)=>({domain:d,expires:n_,daysRemaining:null,status:"warn"})),authEvents:[]}}function rf(E,T){let _=T.security??OJ(E),r=!!T._serverReachable&&!T.metricsUnavailable,t=T.sites??[],d=t.filter((N)=>N.status==="shadowed"),R=(T.services??[]).filter((N)=>["failed","stopped"].includes(N.status)),h=(_.tlsCertificates??[]).filter((N)=>N.status!=="ok"),S=T.sshKeys??[];return[{name:"Live server probe",status:r?"pass":"warn",detail:r?"Metrics and remote checks are coming from the compute box.":"The dashboard is rendering config/state data until the box probe succeeds."},{name:"Managed services",status:R.length?"fail":"pass",detail:R.length?`${R.length} service(s) need attention.`:`${(T.services??[]).length} service(s) reported healthy or configured.`},{name:"Route conflicts",status:d.length?"warn":"pass",detail:d.length?`${d.map((N)=>N.name).join(", ")} is shadowed by an earlier route.`:`${t.length} site route(s) are unshadowed.`},{name:"SSH access",status:S.length?"pass":"warn",detail:S.length?`${S.length} declarative authorized key(s) configured.`:"No declarative SSH keys are configured."},{name:"Firewall",status:["active","configured"].includes(_.firewall?.status)?"pass":"warn",detail:_.firewall?.summary??"Firewall status unavailable."},{name:"TLS certificates",status:h.length?"warn":"pass",detail:h.length?`${h.length} certificate(s) need renewal visibility.`:`${(_.tlsCertificates??[]).length} certificate(s) look healthy.`}]}function tf(E){let T=[];for(let _ of E.serverDeploymentsDetail??E.serverDeployments??[])T.push({type:"deploy",tone:_.status==="failed"?"bad":"ok",title:`${_.site} deployed ${_.sha}`,detail:`${_.branch} · ${_.status}`,when:_.when,timestamp:_.timestamp});for(let _ of E.serverLogs??[])if(_.level==="error"||_.level==="warn")T.push({type:"log",tone:_.level==="error"?"bad":"warn",title:`${_.source} ${_.level}`,detail:_.message,when:_.when,timestamp:_.timestamp});for(let _ of E.sshKeys??[])T.push({type:"ssh",tone:"ok",title:`${_.name} authorized`,detail:_.fingerprint,when:_.added??n_,timestamp:""});return T.sort((_,r)=>String(r.timestamp).localeCompare(String(_.timestamp))).slice(0,80)}function df(E,T={}){let _=[];for(let r of E.split(`
-`)){let t=r.trim();if(!t.startsWith("DEPLOY="))continue;let d=t.split("\t"),R=d[0]?.replace(/^DEPLOY=/,"")??"",[h,S,N,A,L]=d.slice(1);if(!R||!h||!S)continue;let O=T[R]??{},c=nT(O),U=(N||S).slice(0,7);_.push({sha:U,release:S,commit:N||S,site:R,branch:O.branch??(c==="server-static"?"build artifact":"main"),status:A||"unknown",when:LJ(h),timestamp:h,took:"-",by:"ts-cloud",rc:L?.replace(/^rc=/,"")??"",steps:c==="server-static"?["upload artifact","publish static files"]:["upload artifact","restart service"]})}return _.sort((r,t)=>String(t.timestamp).localeCompare(String(r.timestamp)))}function Rf(E,T){let _=Il(E,T),r=vY(E),t=zl(E),d=Math.max(1,Number(E.infrastructure?.compute?.disk?.size??1)),R={server:{name:_?.serverName??`${E.project.slug}-${T}-app`,provider:_?.provider??lY(E),region:$l(E),ip:_?.publicIp??n_,os:"Linux",uptime:n_,probeStatus:"unavailable"},systemMetrics:{load:0,load5:0,load15:0,cpuUsedPct:0,cpus:Math.max(1,Number(E.infrastructure?.compute?.instances??1)),memUsedMb:0,memTotalMb:0,memAvailableMb:0,memCacheMb:0,swapUsedMb:0,swapTotalMb:0,diskUsedPct:0,diskUsedGb:0,diskTotalGb:d,inodeUsedPct:0,networkRxBytes:0,networkTxBytes:0,processes:0,uptimeSeconds:0},metricsUnavailable:!0,services:r,servicesDetail:r.map((h)=>({...h,since:n_,memMb:0,auto:!0})),backup:Dl(E),backupHistory:[],workers:wl(E),serverScheduler:{enabled:!1,lastRun:"not configured"},serverDeployments:[],serverDeploymentsDetail:[],deploymentsEmptyReason:"No deployment history has been recorded yet. Future server deploys will write /var/www/<site>/.ts-cloud/deploy-history.log.",serverLogs:[],serverLogsEmptyReason:"Live server logs are unavailable until the dashboard can reach the compute box.",security:OJ(E),securityEmptyReason:"Live security checks are unavailable until the dashboard can reach the compute box.",sites:t,sitesDetail:t.map((h)=>{let S=E.sites?.[h.name]??{},N=nT(S);return{...h,root:N==="server-static"?sr(E.project.slug,h.name):`${sr(E.project.slug,h.name)}/current`,branch:N==="server-static"?"build artifact":"main",build:S.build,php:S.php??S.phpVersion,aliases:Array.isArray(S.aliases)?S.aliases:[],redirects:S.redirects&&typeof S.redirects==="object"?S.redirects:{},envKeys:Object.keys(S.env??S.environment??{})}}),siteHealth:[],sshKeys:th(E.infrastructure?.compute?.sshKeys??[]),_serverReachable:!1,_metricsStatus:"unavailable"};return R.diagnostics=rf(E,R),R.activity=tf(R),R}async function dO(E,T,_={}){if(!E.infrastructure?.compute)return null;let r=null;try{r=ZT({config:E})}catch{r=null}let t=null,d=0,R=[];if(r)try{if(R=await r.findComputeTargets({slug:E.project.slug,environment:T,role:"app"}),d=R.length,R.length){let L=(await r.runRemoteDeploy({targets:[R[0]],commands:uY({includeServices:!_.telemetryOnly,includeSites:_.includeSiteHealth!==!1,projectFilter:E.cloud?.attachTo?E.project.slug:void 0}),comment:`ts-cloud dashboard:build ${E.project.slug}`,tags:{Project:E.project.slug,Environment:T,Role:"app"}})).perInstance?.[0]?.output;if(L)t=nY(L)}}catch{}let h=Rf(E,T),S=(A,L=0)=>{let O=Number(A);return Number.isFinite(O)?O:L};if(h.server.os=t?.OS||h.server.os,h.server.uptime=t?.UPTIME||h.server.uptime,t){if(h.server.probeStatus="live",h.metricsUnavailable=!1,h._metricsStatus="live",h.systemMetrics={load:S(t.LOAD),load5:S(t.LOAD5),load15:S(t.LOAD15),cpuUsedPct:S(t.CPUUSED),cpus:S(t.CPUS,1),memUsedMb:S(t.MEMUSED),memTotalMb:S(t.MEMTOTAL,1),memAvailableMb:S(t.MEMAVAILABLE),memCacheMb:S(t.MEMCACHE),swapUsedMb:S(t.SWAPUSED),swapTotalMb:S(t.SWAPTOTAL),diskUsedPct:S(t.DISKPCT),diskUsedGb:S(t.DISKUSEDG),diskTotalGb:S(t.DISKTOTG,1),inodeUsedPct:S(t.INODEPCT),networkRxBytes:S(t.NETRX),networkTxBytes:S(t.NETTX),processes:S(t.PROCESSES),uptimeSeconds:S(t.UPTIME_SECONDS)},t.services.length){let A=[...new Map(t.services.map((L)=>[L.name,L])).values()];h.services=A.map((L)=>({name:L.name,status:L.status==="active"?"running":L.status})),h.servicesDetail=A.map((L)=>({name:L.name,status:L.status==="active"?"running":L.status,since:L.since&&L.since!==n_?L.since:h.server.uptime,memMb:Math.max(0,Math.round(Number(L.memBytes??0)/1024/1024)),auto:L.enabled?!["disabled","static","masked"].includes(L.enabled):!0}))}if(t.discoveredSites.length)h.sitesDetail=aY(h.sitesDetail,t.discoveredSites,E.project.slug),h.sites=h.sitesDetail.map((A)=>({name:A.name,project:A.project,managedBy:A.managedBy,route:A.route,href:A.href,domain:A.domain,path:A.path,kind:A.kind,type:A.type,runtime:A.runtime,deploy:A.deploy,tls:A.tls,status:A.status,httpStatus:A.httpStatus,responseMs:A.responseMs,tlsDaysRemaining:A.tlsDaysRemaining,checkedAt:A.checkedAt})),h.siteHealth=h.sitesDetail.map((A)=>({name:A.name,project:A.project,route:A.route,status:A.status,httpStatus:A.httpStatus,responseMs:A.responseMs,tlsDaysRemaining:A.tlsDaysRemaining,checkedAt:A.checkedAt}))}if(r&&R.length&&!_.telemetryOnly)await Promise.all([(async()=>{try{let A=Object.keys(E.sites??{}),O=(await r.runRemoteDeploy({targets:[R[0]],commands:Fl(A,E.project.slug),comment:`ts-cloud dashboard:deploy-history ${E.project.slug}`,tags:{Project:E.project.slug,Environment:T,Role:"app"}})).perInstance?.[0]?.output??"",c=df(O,E.sites);h.serverDeployments=c.slice(0,5),h.serverDeploymentsDetail=c.slice(0,50),h.deploymentsEmptyReason=c.length?void 0:"No deployment history was found on the server yet. Deploy again to populate this timeline."}catch{h.deploymentsEmptyReason="Deployment history could not be read from the server."}})(),(async()=>{try{let L=(await r.runRemoteDeploy({targets:[R[0]],commands:yl(E),comment:`ts-cloud dashboard:server-logs ${E.project.slug}`,tags:{Project:E.project.slug,Environment:T,Role:"app"}})).perInstance?.[0]?.output??"",O=Ef(L);h.serverLogs=O,h.serverLogsEmptyReason=O.length?void 0:"No recent journal entries were found for the managed server units."}catch{h.serverLogsEmptyReason="Server logs could not be read from the box."}})(),(async()=>{try{let L=(await r.runRemoteDeploy({targets:[R[0]],commands:jl(E),comment:`ts-cloud dashboard:security ${E.project.slug}`,tags:{Project:E.project.slug,Environment:T,Role:"app"}})).perInstance?.[0]?.output??"",O=_f(L),c=OJ(E);if(!O.ports.length)O.ports=c.ports;if(!O.tlsCertificates.length)O.tlsCertificates=c.tlsCertificates;h.security=O,h.securityEmptyReason=void 0}catch{h.securityEmptyReason="Server security checks could not be read from the box."}})()]);else if(r&&d===0)h.deploymentsEmptyReason="No app server target was found for this environment.";let N=E.infrastructure?.compute?.sshKeys??E.infrastructure?.ssh?.keys??E.infrastructure?.sshKeys;if(Array.isArray(N)&&N.length)h.sshKeys=th(N);return h._serverReachable=d>0&&!!t,h.diagnostics=rf(E,h),h.activity=tf(h),h}var Ul,n_="-";var lU=wE(async()=>{qL();vU();await Qt([id(),gR()]);Ul=["rpx-gateway","nginx","php8.3-fpm","php8.2-fpm","mysql","mariadb","postgresql","redis","redis-server","meilisearch"]});import{existsSync as r9}from"node:fs";import lD from"node:fs/promises";import XF from"node:os";import iD from"node:path";import Uh from"node:process";import{EventEmitter as t9}from"node:events";import OR from"node:process";import JF from"node:process";import pD from"node:process";import VO from"node:process";import KA from"node:process";import jF from"node:tty";import n9,{stdin as Jp,stdout as zp}from"node:process";import BF,{stdin as i9,stdout as a9}from"node:process";import m9 from"node:readline";class WF{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let E=XF.homedir(),T=iD.join(E,".config","clapp");this.configPath=iD.join(T,"telemetry.json")}async isEnabled(){if(Uh.env.DO_NOT_TRACK==="1"||Uh.env.DO_NOT_TRACK==="true")return!1;if(Uh.env.NO_TELEMETRY==="1"||Uh.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let E=await this.loadConfig();if(E.enabled=!0,!E.userId)E.userId=this.generateUserId();await this.saveConfig(E)}async disable(){let E=await this.loadConfig();E.enabled=!1,await this.saveConfig(E)}async track(E,T){if(!await this.isEnabled())return;let r={event:E,...T,timestamp:Date.now(),platform:XF.platform(),nodeVersion:Uh.version};if(this.events.push(r),this.events.length>=10)await this.send()}async trackCommand(E,T){await this.track("command",{command:E,duration:T})}async trackError(E,T){await this.track("error",{error:E,command:T})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let T=await this.loadConfig();return T.lastSent=Date.now(),await this.saveConfig(T),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let T=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(T),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(E){return new Promise((T)=>setTimeout(T,E))}async status(){let E=await this.loadConfig();return{enabled:E.enabled,doNotTrack:Uh.env.DO_NOT_TRACK==="1"||Uh.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:E.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(r9(this.configPath)){let E=await lD.readFile(this.configPath,"utf-8");return this.config=JSON.parse(E),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(E){this.config=E;try{let T=iD.dirname(this.configPath);await lD.mkdir(T,{recursive:!0}),await lD.writeFile(this.configPath,JSON.stringify(E,null,2),"utf-8")}catch{}}generateUserId(){let E=Math.random().toString(36).substring(2,15),T=Date.now().toString(36);return`${E}-${T}`}}var Ap=new WF;function d9(E,T={}){let _={_:[]},r=T.alias||{},t=new Set(T.boolean||[]),d={};for(let h of Object.keys(r))for(let S of r[h])d[S]=h;for(let h of t)if(r[h])for(let S of r[h])t.add(S);function R(h,S){let N=d[h]||h;if(_[N]=S,r[N])for(let A of r[N])_[A]=S;if(d[h]&&r[d[h]])for(let A of r[d[h]])_[A]=S;_[h]=S}for(let h=0;h<E.length;h++){let S=E[h];if(S==="--"){_._.push(...E.slice(h+1));break}if(S.startsWith("--")){let N=S.indexOf("=");if(N!==-1){let A=S.slice(2,N),L=S.slice(N+1);R(A,L)}else{let A=S.slice(2);if(A.startsWith("no-")){let O=A.slice(3);R(O,!1);continue}let L=d[A]||A;if(t.has(L)||t.has(A))R(A,!0);else{let O=E[h+1];if(O!==void 0&&!O.startsWith("-"))R(A,O),h++;else R(A,!0)}}}else if(S.startsWith("-")&&S.length>1){let N=S.slice(1);for(let A=0;A<N.length;A++){let L=N[A],O=d[L]||L;if(A===N.length-1&&!t.has(O)&&!t.has(L)){let c=E[h+1];if(c!==void 0&&!c.startsWith("-"))R(L,c),h++;else R(L,!0)}else R(L,!0)}}else _._.push(S)}return _}function sD(E){return E.replace(/[<[].+/,"").trim()}function R9(E){let T=/<([^>]+)>/g,_=/\[([^\]]+)\]/g,r=[],t=(h)=>{let S=!1,N=h[1];if(N.startsWith("..."))N=N.slice(3),S=!0;return{required:h[0].startsWith("<"),value:N,variadic:S}},d;while(d=T.exec(E))r.push(t(d));let R;while(R=_.exec(E))r.push(t(R));return r}function h9(E){let T={alias:{},boolean:[]};for(let[_,r]of E.entries()){if(r.names.length>1)T.alias[r.names[0]]=r.names.slice(1);if(r.isBoolean)if(r.negated){if(!E.some((d,R)=>{return R!==_&&d.names.some((h)=>r.names.includes(h))&&typeof d.required==="boolean"}))T.boolean.push(r.names[0])}else T.boolean.push(r.names[0])}return T}function zF(E){return E.reduce((T,_)=>T.length>=_.length?T:_,"")}function aD(E,T){return E.length>=T?E:`${E}${" ".repeat(T-E.length)}`}function S9(E){return E.replace(/([a-z])-([a-z])/g,(T,_,r)=>{return _+r.toUpperCase()})}function N9(E,T,_){let r=0,t=T.length,d=E,R;for(;r<t;++r)R=d[T[r]],d=d[T[r]]=r===t-1?_:R!=null?R:!!~T[r+1].indexOf(".")||!(+T[r+1]>-1)?{}:[]}function A9(E,T){for(let _ of Object.keys(T)){let r=T[_];if(r.shouldTransform){if(E[_]=Array.prototype.concat.call([],E[_]),typeof r.transformFunction==="function")E[_]=E[_].map(r.transformFunction)}}}function L9(E){let T=/([^\\/]+)$/.exec(E);return T?T[1]:""}function HF(E){return E.split(".").map((T,_)=>{return _===0?S9(T):T}).join(".")}class MO extends Error{exitCode=2;isUsageError=!0;constructor(E){super(E);if(this.name=this.constructor.name,typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(E).stack}format(E=!1){if(E&&this.stack)return`${this.message}
+`)){let t=r.trim();if(!t.startsWith("DEPLOY="))continue;let d=t.split("\t"),R=d[0]?.replace(/^DEPLOY=/,"")??"",[h,S,N,A,L]=d.slice(1);if(!R||!h||!S)continue;let O=T[R]??{},c=nT(O),U=(N||S).slice(0,7);_.push({sha:U,release:S,commit:N||S,site:R,branch:O.branch??(c==="server-static"?"build artifact":"main"),status:A||"unknown",when:LJ(h),timestamp:h,took:"-",by:"ts-cloud",rc:L?.replace(/^rc=/,"")??"",steps:c==="server-static"?["upload artifact","publish static files"]:["upload artifact","restart service"]})}return _.sort((r,t)=>String(t.timestamp).localeCompare(String(r.timestamp)))}function Rf(E,T){let _=Il(E,T),r=vY(E),t=zl(E),d=Math.max(1,Number(E.infrastructure?.compute?.disk?.size??1)),R={server:{name:_?.serverName??`${E.project.slug}-${T}-app`,provider:_?.provider??lY(E),region:$l(E),ip:_?.publicIp??n_,os:"Linux",uptime:n_,probeStatus:"unavailable"},systemMetrics:{load:0,load5:0,load15:0,cpuUsedPct:0,cpus:Math.max(1,Number(E.infrastructure?.compute?.instances??1)),memUsedMb:0,memTotalMb:0,memAvailableMb:0,memCacheMb:0,swapUsedMb:0,swapTotalMb:0,diskUsedPct:0,diskUsedGb:0,diskTotalGb:d,inodeUsedPct:0,networkRxBytes:0,networkTxBytes:0,processes:0,uptimeSeconds:0},metricsUnavailable:!0,services:r,servicesDetail:r.map((h)=>({...h,since:n_,memMb:0,auto:!0})),backup:Dl(E),backupHistory:[],workers:wl(E),serverScheduler:{enabled:!1,lastRun:"not configured"},serverDeployments:[],serverDeploymentsDetail:[],deploymentsEmptyReason:"No deployment history has been recorded yet. Future server deploys will write /var/www/<site>/.ts-cloud/deploy-history.log.",serverLogs:[],serverLogsEmptyReason:"Live server logs are unavailable until the dashboard can reach the compute box.",security:OJ(E),securityEmptyReason:"Live security checks are unavailable until the dashboard can reach the compute box.",sites:t,sitesDetail:t.map((h)=>{let S=E.sites?.[h.name]??{},N=nT(S);return{...h,root:N==="server-static"?sr(E.project.slug,h.name):`${sr(E.project.slug,h.name)}/current`,branch:N==="server-static"?"build artifact":"main",build:S.build,php:S.php??S.phpVersion,aliases:Array.isArray(S.aliases)?S.aliases:[],redirects:S.redirects&&typeof S.redirects==="object"?S.redirects:{},envKeys:Object.keys(S.env??S.environment??{})}}),siteHealth:[],sshKeys:th(E.infrastructure?.compute?.sshKeys??[]),_serverReachable:!1,_metricsStatus:"unavailable"};return R.diagnostics=rf(E,R),R.activity=tf(R),R}async function dO(E,T,_={}){if(!E.infrastructure?.compute)return null;let r=null;try{r=ZT({config:E})}catch{r=null}let t=null,d=0,R=[];if(r)try{if(R=await r.findComputeTargets({slug:E.project.slug,environment:T,role:"app"}),d=R.length,R.length){let L=(await r.runRemoteDeploy({targets:[R[0]],commands:uY({includeServices:!_.telemetryOnly,includeSites:_.includeSiteHealth!==!1,projectFilter:E.cloud?.attachTo?E.project.slug:void 0}),comment:`ts-cloud dashboard:build ${E.project.slug}`,tags:{Project:E.project.slug,Environment:T,Role:"app"}})).perInstance?.[0]?.output;if(L)t=nY(L)}}catch{}let h=Rf(E,T),S=(A,L=0)=>{let O=Number(A);return Number.isFinite(O)?O:L};if(h.server.os=t?.OS||h.server.os,h.server.uptime=t?.UPTIME||h.server.uptime,t){if(h.server.probeStatus="live",h.metricsUnavailable=!1,h._metricsStatus="live",h.systemMetrics={load:S(t.LOAD),load5:S(t.LOAD5),load15:S(t.LOAD15),cpuUsedPct:S(t.CPUUSED),cpus:S(t.CPUS,1),memUsedMb:S(t.MEMUSED),memTotalMb:S(t.MEMTOTAL,1),memAvailableMb:S(t.MEMAVAILABLE),memCacheMb:S(t.MEMCACHE),swapUsedMb:S(t.SWAPUSED),swapTotalMb:S(t.SWAPTOTAL),diskUsedPct:S(t.DISKPCT),diskUsedGb:S(t.DISKUSEDG),diskTotalGb:S(t.DISKTOTG,1),inodeUsedPct:S(t.INODEPCT),networkRxBytes:S(t.NETRX),networkTxBytes:S(t.NETTX),processes:S(t.PROCESSES),uptimeSeconds:S(t.UPTIME_SECONDS)},t.services.length){let A=[...new Map(t.services.map((L)=>[L.name,L])).values()];h.services=A.map((L)=>({name:L.name,status:L.status==="active"?"running":L.status})),h.servicesDetail=A.map((L)=>({name:L.name,status:L.status==="active"?"running":L.status,since:L.since&&L.since!==n_?L.since:h.server.uptime,memMb:Math.max(0,Math.round(Number(L.memBytes??0)/1024/1024)),auto:L.enabled?!["disabled","static","masked"].includes(L.enabled):!0}))}if(t.discoveredSites.length)h.sitesDetail=aY(h.sitesDetail,t.discoveredSites,E.project.slug),h.sites=h.sitesDetail.map((A)=>({name:A.name,project:A.project,managedBy:A.managedBy,route:A.route,href:A.href,domain:A.domain,path:A.path,kind:A.kind,type:A.type,runtime:A.runtime,deploy:A.deploy,tls:A.tls,status:A.status,httpStatus:A.httpStatus,responseMs:A.responseMs,tlsDaysRemaining:A.tlsDaysRemaining,checkedAt:A.checkedAt})),h.siteHealth=h.sitesDetail.map((A)=>({name:A.name,project:A.project,route:A.route,status:A.status,httpStatus:A.httpStatus,responseMs:A.responseMs,tlsDaysRemaining:A.tlsDaysRemaining,checkedAt:A.checkedAt}))}if(r&&R.length&&!_.telemetryOnly)await Promise.all([(async()=>{try{let A=Object.keys(E.sites??{}),O=(await r.runRemoteDeploy({targets:[R[0]],commands:Fl(A,E.project.slug),comment:`ts-cloud dashboard:deploy-history ${E.project.slug}`,tags:{Project:E.project.slug,Environment:T,Role:"app"}})).perInstance?.[0]?.output??"",c=df(O,E.sites);h.serverDeployments=c.slice(0,5),h.serverDeploymentsDetail=c.slice(0,50),h.deploymentsEmptyReason=c.length?void 0:"No deployment history was found on the server yet. Deploy again to populate this timeline."}catch{h.deploymentsEmptyReason="Deployment history could not be read from the server."}})(),(async()=>{try{let L=(await r.runRemoteDeploy({targets:[R[0]],commands:yl(E),comment:`ts-cloud dashboard:server-logs ${E.project.slug}`,tags:{Project:E.project.slug,Environment:T,Role:"app"}})).perInstance?.[0]?.output??"",O=Ef(L);h.serverLogs=O,h.serverLogsEmptyReason=O.length?void 0:"No recent journal entries were found for the managed server units."}catch{h.serverLogsEmptyReason="Server logs could not be read from the box."}})(),(async()=>{try{let L=(await r.runRemoteDeploy({targets:[R[0]],commands:jl(E),comment:`ts-cloud dashboard:security ${E.project.slug}`,tags:{Project:E.project.slug,Environment:T,Role:"app"}})).perInstance?.[0]?.output??"",O=_f(L),c=OJ(E);if(!O.ports.length)O.ports=c.ports;if(!O.tlsCertificates.length)O.tlsCertificates=c.tlsCertificates;h.security=O,h.securityEmptyReason=void 0}catch{h.securityEmptyReason="Server security checks could not be read from the box."}})()]);else if(r&&d===0)h.deploymentsEmptyReason="No app server target was found for this environment.";let N=E.infrastructure?.compute?.sshKeys??E.infrastructure?.ssh?.keys??E.infrastructure?.sshKeys;if(Array.isArray(N)&&N.length)h.sshKeys=th(N);return h._serverReachable=d>0&&!!t,h.diagnostics=rf(E,h),h.activity=tf(h),h}var Ul,n_="-";var lU=wE(async()=>{qL();vU();await Qt([id(),gR()]);Ul=["rpx-gateway","nginx","php8.3-fpm","php8.2-fpm","mysql","mariadb","postgresql","redis","redis-server","meilisearch"]});import{existsSync as r8}from"node:fs";import lD from"node:fs/promises";import XF from"node:os";import iD from"node:path";import Uh from"node:process";import{EventEmitter as t8}from"node:events";import OR from"node:process";import JF from"node:process";import pD from"node:process";import VO from"node:process";import KA from"node:process";import jF from"node:tty";import n8,{stdin as Jp,stdout as zp}from"node:process";import BF,{stdin as i8,stdout as a8}from"node:process";import m8 from"node:readline";class WF{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let E=XF.homedir(),T=iD.join(E,".config","clapp");this.configPath=iD.join(T,"telemetry.json")}async isEnabled(){if(Uh.env.DO_NOT_TRACK==="1"||Uh.env.DO_NOT_TRACK==="true")return!1;if(Uh.env.NO_TELEMETRY==="1"||Uh.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let E=await this.loadConfig();if(E.enabled=!0,!E.userId)E.userId=this.generateUserId();await this.saveConfig(E)}async disable(){let E=await this.loadConfig();E.enabled=!1,await this.saveConfig(E)}async track(E,T){if(!await this.isEnabled())return;let r={event:E,...T,timestamp:Date.now(),platform:XF.platform(),nodeVersion:Uh.version};if(this.events.push(r),this.events.length>=10)await this.send()}async trackCommand(E,T){await this.track("command",{command:E,duration:T})}async trackError(E,T){await this.track("error",{error:E,command:T})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let T=await this.loadConfig();return T.lastSent=Date.now(),await this.saveConfig(T),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let T=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(T),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(E){return new Promise((T)=>setTimeout(T,E))}async status(){let E=await this.loadConfig();return{enabled:E.enabled,doNotTrack:Uh.env.DO_NOT_TRACK==="1"||Uh.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:E.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(r8(this.configPath)){let E=await lD.readFile(this.configPath,"utf-8");return this.config=JSON.parse(E),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(E){this.config=E;try{let T=iD.dirname(this.configPath);await lD.mkdir(T,{recursive:!0}),await lD.writeFile(this.configPath,JSON.stringify(E,null,2),"utf-8")}catch{}}generateUserId(){let E=Math.random().toString(36).substring(2,15),T=Date.now().toString(36);return`${E}-${T}`}}var Ap=new WF;function d8(E,T={}){let _={_:[]},r=T.alias||{},t=new Set(T.boolean||[]),d={};for(let h of Object.keys(r))for(let S of r[h])d[S]=h;for(let h of t)if(r[h])for(let S of r[h])t.add(S);function R(h,S){let N=d[h]||h;if(_[N]=S,r[N])for(let A of r[N])_[A]=S;if(d[h]&&r[d[h]])for(let A of r[d[h]])_[A]=S;_[h]=S}for(let h=0;h<E.length;h++){let S=E[h];if(S==="--"){_._.push(...E.slice(h+1));break}if(S.startsWith("--")){let N=S.indexOf("=");if(N!==-1){let A=S.slice(2,N),L=S.slice(N+1);R(A,L)}else{let A=S.slice(2);if(A.startsWith("no-")){let O=A.slice(3);R(O,!1);continue}let L=d[A]||A;if(t.has(L)||t.has(A))R(A,!0);else{let O=E[h+1];if(O!==void 0&&!O.startsWith("-"))R(A,O),h++;else R(A,!0)}}}else if(S.startsWith("-")&&S.length>1){let N=S.slice(1);for(let A=0;A<N.length;A++){let L=N[A],O=d[L]||L;if(A===N.length-1&&!t.has(O)&&!t.has(L)){let c=E[h+1];if(c!==void 0&&!c.startsWith("-"))R(L,c),h++;else R(L,!0)}else R(L,!0)}}else _._.push(S)}return _}function sD(E){return E.replace(/[<[].+/,"").trim()}function R8(E){let T=/<([^>]+)>/g,_=/\[([^\]]+)\]/g,r=[],t=(h)=>{let S=!1,N=h[1];if(N.startsWith("..."))N=N.slice(3),S=!0;return{required:h[0].startsWith("<"),value:N,variadic:S}},d;while(d=T.exec(E))r.push(t(d));let R;while(R=_.exec(E))r.push(t(R));return r}function h8(E){let T={alias:{},boolean:[]};for(let[_,r]of E.entries()){if(r.names.length>1)T.alias[r.names[0]]=r.names.slice(1);if(r.isBoolean)if(r.negated){if(!E.some((d,R)=>{return R!==_&&d.names.some((h)=>r.names.includes(h))&&typeof d.required==="boolean"}))T.boolean.push(r.names[0])}else T.boolean.push(r.names[0])}return T}function zF(E){return E.reduce((T,_)=>T.length>=_.length?T:_,"")}function aD(E,T){return E.length>=T?E:`${E}${" ".repeat(T-E.length)}`}function S8(E){return E.replace(/([a-z])-([a-z])/g,(T,_,r)=>{return _+r.toUpperCase()})}function N8(E,T,_){let r=0,t=T.length,d=E,R;for(;r<t;++r)R=d[T[r]],d=d[T[r]]=r===t-1?_:R!=null?R:!!~T[r+1].indexOf(".")||!(+T[r+1]>-1)?{}:[]}function A8(E,T){for(let _ of Object.keys(T)){let r=T[_];if(r.shouldTransform){if(E[_]=Array.prototype.concat.call([],E[_]),typeof r.transformFunction==="function")E[_]=E[_].map(r.transformFunction)}}}function L8(E){let T=/([^\\/]+)$/.exec(E);return T?T[1]:""}function HF(E){return E.split(".").map((T,_)=>{return _===0?S8(T):T}).join(".")}class MO extends Error{exitCode=2;isUsageError=!0;constructor(E){super(E);if(this.name=this.constructor.name,typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(E).stack}format(E=!1){if(E&&this.stack)return`${this.message}
 
 Stack trace:
-${this.stack}`;return this.message}}function O9(){let{env:E}=JF,{TERM:T,TERM_PROGRAM:_}=E;if(JF.platform!=="win32")return T!=="linux";return Boolean(E.WT_SESSION)||Boolean(E.TERMINUS_SUBLIME)||E.ConEmuTask==="{cmd::Cmder}"||_==="Terminus-Sublime"||_==="vscode"||T==="xterm-256color"||T==="alacritty"||T==="rxvt-unicode"||T==="rxvt-unicode-256color"||E.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var gO="\x1B",qT=`${gO}[`;var Ad={to(E,T){if(!T)return`${qT}${E+1}G`;return`${qT}${T+1};${E+1}H`},move(E,T){let _="";if(E<0)_+=`${qT}${-E}D`;else if(E>0)_+=`${qT}${E}C`;if(T<0)_+=`${qT}${-T}A`;else if(T>0)_+=`${qT}${T}B`;return _},up:(E=1)=>`${qT}${E}A`,down:(E=1)=>`${qT}${E}B`,forward:(E=1)=>`${qT}${E}C`,backward:(E=1)=>`${qT}${E}D`,nextLine:(E=1)=>`${qT}E`.repeat(E),prevLine:(E=1)=>`${qT}F`.repeat(E),left:`${qT}G`,hide:`${qT}?25l`,show:`${qT}?25h`,save:`${gO}7`,restore:`${gO}8`};var mD={screen:`${qT}2J`,up:(E=1)=>`${qT}1J`.repeat(E),down:(E=1)=>`${qT}J`.repeat(E),line:`${qT}2K`,lineEnd:`${qT}K`,lineStart:`${qT}1K`,lines(E){let T="";for(let _=0;_<E;_++)T+=this.line+(_<E-1?Ad.up():"");if(E)T+=Ad.left;return T}},ep={screen:`${gO}c`};function c9(E,T){let _=[];for(let r=0;r<=T.length;r++)_[r]=[r];for(let r=0;r<=E.length;r++)_[0][r]=r;for(let r=1;r<=T.length;r++)for(let t=1;t<=E.length;t++)if(T.charAt(r-1)===E.charAt(t-1))_[r][t]=_[r-1][t-1];else _[r][t]=Math.min(_[r-1][t-1]+1,_[r][t-1]+1,_[r-1][t]+1);return _[T.length][E.length]}function YF(E,T,_=2,r=3){return T.map((t)=>({cmd:t,distance:c9(E,t)})).filter(({distance:t})=>t<=_).sort((t,d)=>t.distance-d.distance).slice(0,r).map(({cmd:t})=>t)}class fF{rawName;description;name;names;isBoolean;required;config;negated;constructor(E,T,_){if(this.rawName=E,this.description=T,this.config=Object.assign({},_),E=E.replace(/\.\*/g,""),this.negated=!1,this.names=sD(E).split(",").map((r)=>{let t=r.trim().replace(/^-{1,2}/,"");if(t.startsWith("no-"))this.negated=!0,t=t.replace(/^no-/,"");return HF(t)}).sort((r,t)=>r.length>t.length?1:-1),this.name=this.names[this.names.length-1],this.negated&&this.config.default==null)this.config.default=!0;if(E.includes("<"))this.required=!0;else if(E.includes("["))this.required=!1;else this.isBoolean=!0}}var Dp=pD.argv,e9=`${pD.platform}-${pD.arch} bun-v${typeof Bun<"u"?Bun.version:"unknown"}`,FF=VO.argv,U9=`${VO.platform}-${VO.arch} node-${VO.version}`;class oD{rawName;description;config;cli;options;aliasNames;name;namespace;args;commandAction;usageText;versionNumber;examples;helpCallback;globalCommand;beforeHooks;afterHooks;middleware;constructor(E,T,_,r){this.rawName=E,this.description=T,this.config=_,this.cli=r,this.options=[],this.aliasNames=[],this.name=sD(E);let t=sD(E),d=t.indexOf(":");if(d>0)this.namespace=t.substring(0,d),this.name=t.substring(d+1);if(this.args=R9(E),this.examples=[],this.beforeHooks=[],this.afterHooks=[],this.middleware=[],!_)this.config={}}usage(E){return this.usageText=E,this}allowUnknownOptions(){return this.config.allowUnknownOptions=!0,this}ignoreOptionDefaultValue(){return this.config.ignoreOptionDefaultValue=!0,this}version(E,T="-v, --version"){return this.versionNumber=E,this.option(T,"Display version number"),this}example(E){return this.examples.push(E),this}option(E,T,_){let r=new fF(E,T,_);return this.options.push(r),this}alias(E){return this.aliasNames.push(E),this}action(E){return this.commandAction=E,this}before(E){return this.beforeHooks.push(E),this}after(E){return this.afterHooks.push(E),this}use(E){return this.middleware.push(E),this}isMatched(E){if(this.aliasNames.includes(E))return!0;if(this.namespace)return`${this.namespace}:${this.name}`===E;return this.name===E}get isDefaultCommand(){return this.name===""||this.aliasNames.includes("!")}get isGlobalCommand(){return this instanceof E$}get displayName(){return this.namespace?`${this.namespace}:${this.name}`:this.name}hasOption(E){return E=E.split(".")[0],!!this.options.find((T)=>{return T.names.includes(E)})}outputHelp(){let{name:E,commands:T}=this.cli,{versionNumber:_,options:r,helpCallback:t}=this.cli.globalCommand,d=[{body:`${E}${_?`/${_}`:""}`}];if(d.push({title:"Usage",body:`  $ ${E} ${this.usageText||this.rawName}`}),(this.isGlobalCommand||this.isDefaultCommand)&&T.length>0){let S=zF(T.map((c)=>c.rawName)),N=new Map,A=[];for(let c of T)if(c.namespace){if(!N.has(c.namespace))N.set(c.namespace,[]);N.get(c.namespace).push(c)}else A.push(c);let L="";if(A.length>0)L+=A.map((c)=>{return`  ${aD(c.rawName,S.length)}  ${c.description}`}).join(`
+${this.stack}`;return this.message}}function O8(){let{env:E}=JF,{TERM:T,TERM_PROGRAM:_}=E;if(JF.platform!=="win32")return T!=="linux";return Boolean(E.WT_SESSION)||Boolean(E.TERMINUS_SUBLIME)||E.ConEmuTask==="{cmd::Cmder}"||_==="Terminus-Sublime"||_==="vscode"||T==="xterm-256color"||T==="alacritty"||T==="rxvt-unicode"||T==="rxvt-unicode-256color"||E.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var gO="\x1B",qT=`${gO}[`;var Ad={to(E,T){if(!T)return`${qT}${E+1}G`;return`${qT}${T+1};${E+1}H`},move(E,T){let _="";if(E<0)_+=`${qT}${-E}D`;else if(E>0)_+=`${qT}${E}C`;if(T<0)_+=`${qT}${-T}A`;else if(T>0)_+=`${qT}${T}B`;return _},up:(E=1)=>`${qT}${E}A`,down:(E=1)=>`${qT}${E}B`,forward:(E=1)=>`${qT}${E}C`,backward:(E=1)=>`${qT}${E}D`,nextLine:(E=1)=>`${qT}E`.repeat(E),prevLine:(E=1)=>`${qT}F`.repeat(E),left:`${qT}G`,hide:`${qT}?25l`,show:`${qT}?25h`,save:`${gO}7`,restore:`${gO}8`};var mD={screen:`${qT}2J`,up:(E=1)=>`${qT}1J`.repeat(E),down:(E=1)=>`${qT}J`.repeat(E),line:`${qT}2K`,lineEnd:`${qT}K`,lineStart:`${qT}1K`,lines(E){let T="";for(let _=0;_<E;_++)T+=this.line+(_<E-1?Ad.up():"");if(E)T+=Ad.left;return T}},ep={screen:`${gO}c`};function c8(E,T){let _=[];for(let r=0;r<=T.length;r++)_[r]=[r];for(let r=0;r<=E.length;r++)_[0][r]=r;for(let r=1;r<=T.length;r++)for(let t=1;t<=E.length;t++)if(T.charAt(r-1)===E.charAt(t-1))_[r][t]=_[r-1][t-1];else _[r][t]=Math.min(_[r-1][t-1]+1,_[r][t-1]+1,_[r-1][t]+1);return _[T.length][E.length]}function YF(E,T,_=2,r=3){return T.map((t)=>({cmd:t,distance:c8(E,t)})).filter(({distance:t})=>t<=_).sort((t,d)=>t.distance-d.distance).slice(0,r).map(({cmd:t})=>t)}class fF{rawName;description;name;names;isBoolean;required;config;negated;constructor(E,T,_){if(this.rawName=E,this.description=T,this.config=Object.assign({},_),E=E.replace(/\.\*/g,""),this.negated=!1,this.names=sD(E).split(",").map((r)=>{let t=r.trim().replace(/^-{1,2}/,"");if(t.startsWith("no-"))this.negated=!0,t=t.replace(/^no-/,"");return HF(t)}).sort((r,t)=>r.length>t.length?1:-1),this.name=this.names[this.names.length-1],this.negated&&this.config.default==null)this.config.default=!0;if(E.includes("<"))this.required=!0;else if(E.includes("["))this.required=!1;else this.isBoolean=!0}}var Dp=pD.argv,e8=`${pD.platform}-${pD.arch} bun-v${typeof Bun<"u"?Bun.version:"unknown"}`,FF=VO.argv,U8=`${VO.platform}-${VO.arch} node-${VO.version}`;class oD{rawName;description;config;cli;options;aliasNames;name;namespace;args;commandAction;usageText;versionNumber;examples;helpCallback;globalCommand;beforeHooks;afterHooks;middleware;constructor(E,T,_,r){this.rawName=E,this.description=T,this.config=_,this.cli=r,this.options=[],this.aliasNames=[],this.name=sD(E);let t=sD(E),d=t.indexOf(":");if(d>0)this.namespace=t.substring(0,d),this.name=t.substring(d+1);if(this.args=R8(E),this.examples=[],this.beforeHooks=[],this.afterHooks=[],this.middleware=[],!_)this.config={}}usage(E){return this.usageText=E,this}allowUnknownOptions(){return this.config.allowUnknownOptions=!0,this}ignoreOptionDefaultValue(){return this.config.ignoreOptionDefaultValue=!0,this}version(E,T="-v, --version"){return this.versionNumber=E,this.option(T,"Display version number"),this}example(E){return this.examples.push(E),this}option(E,T,_){let r=new fF(E,T,_);return this.options.push(r),this}alias(E){return this.aliasNames.push(E),this}action(E){return this.commandAction=E,this}before(E){return this.beforeHooks.push(E),this}after(E){return this.afterHooks.push(E),this}use(E){return this.middleware.push(E),this}isMatched(E){if(this.aliasNames.includes(E))return!0;if(this.namespace)return`${this.namespace}:${this.name}`===E;return this.name===E}get isDefaultCommand(){return this.name===""||this.aliasNames.includes("!")}get isGlobalCommand(){return this instanceof E$}get displayName(){return this.namespace?`${this.namespace}:${this.name}`:this.name}hasOption(E){return E=E.split(".")[0],!!this.options.find((T)=>{return T.names.includes(E)})}outputHelp(){let{name:E,commands:T}=this.cli,{versionNumber:_,options:r,helpCallback:t}=this.cli.globalCommand,d=[{body:`${E}${_?`/${_}`:""}`}];if(d.push({title:"Usage",body:`  $ ${E} ${this.usageText||this.rawName}`}),(this.isGlobalCommand||this.isDefaultCommand)&&T.length>0){let S=zF(T.map((c)=>c.rawName)),N=new Map,A=[];for(let c of T)if(c.namespace){if(!N.has(c.namespace))N.set(c.namespace,[]);N.get(c.namespace).push(c)}else A.push(c);let L="";if(A.length>0)L+=A.map((c)=>{return`  ${aD(c.rawName,S.length)}  ${c.description}`}).join(`
 `);let O=Array.from(N.keys()).sort();for(let c of O){let U=N.get(c);if(L.length>0)L+=`
 
 `;L+=`  ${c}:
@@ -9232,7 +9232,7 @@ ${this.stack}`;return this.message}}function O9(){let{env:E}=JF,{TERM:T,TERM_PRO
 `)});if(t)d=t(d)||d;console.log(d.map((S)=>{return S.title?`${S.title}:
 ${S.body}`:S.body}).join(`
 
-`))}outputVersion(){let{name:E}=this.cli,{versionNumber:T}=this.cli.globalCommand;if(T)console.log(`${E}/${T} ${typeof Bun<"u"?e9:U9}`)}checkRequiredArgs(){let E=this.args.filter((T)=>T.required).length;if(this.cli.args.length<E){let _=this.args.filter((t)=>t.required).slice(this.cli.args.length),r=_.map((t)=>`<${t.value}>`).join(" ");throw new MO(`Missing required argument${_.length>1?"s":""}: ${r}
+`))}outputVersion(){let{name:E}=this.cli,{versionNumber:T}=this.cli.globalCommand;if(T)console.log(`${E}/${T} ${typeof Bun<"u"?e8:U8}`)}checkRequiredArgs(){let E=this.args.filter((T)=>T.required).length;if(this.cli.args.length<E){let _=this.args.filter((t)=>t.required).slice(this.cli.args.length),r=_.map((t)=>`<${t.value}>`).join(" ");throw new MO(`Missing required argument${_.length>1?"s":""}: ${r}
 
 Run \`${this.cli.name} ${this.rawName} --help\` for usage information.`)}}checkUnknownOptions(){let{options:E,globalCommand:T}=this.cli;if(!this.config.allowUnknownOptions){for(let _ of Object.keys(E))if(_!=="--"&&!this.hasOption(_)&&!T.hasOption(_)){let t=[...T.options,...this.options].flatMap((S)=>S.names),d=_.length>1?`--${_}`:`-${_}`,R=YF(_,t),h=`Unknown option \`${d}\``;if(R.length>0)h+=`
 
@@ -9241,22 +9241,22 @@ Did you mean one of these?`,R.forEach((S)=>{let N=S.length>1?`--${S}`:`-${S}`;h+
 
 Run \`${this.cli.name} ${this.rawName} --help\` to see available options.`,new MO(h)}}}checkOptionValue(){let{options:E,globalCommand:T}=this.cli,_=[...T.options,...this.options];for(let r of _){let t=E[r.name.split(".")[0]];if(r.required){let d=_.some((R)=>R.negated&&R.names.includes(r.name));if(t===!0||t===!1&&!d)throw new MO(`Option \`${r.rawName}\` requires a value.
 
-Example: ${this.cli.name} ${this.rawName} ${r.rawName} <value>`)}}}}class E$ extends oD{constructor(E){super("@@global@@","",{},E)}}var D9=oD,cR={red:["\x1B[31m","\x1B[39m"],green:["\x1B[32m","\x1B[39m"],blue:["\x1B[34m","\x1B[39m"],yellow:["\x1B[33m","\x1B[39m"],cyan:["\x1B[36m","\x1B[39m"],magenta:["\x1B[35m","\x1B[39m"],white:["\x1B[37m","\x1B[39m"],gray:["\x1B[90m","\x1B[39m"],bgRed:["\x1B[41m","\x1B[49m"],bgGreen:["\x1B[42m","\x1B[49m"],bgBlue:["\x1B[44m","\x1B[49m"],bgYellow:["\x1B[43m","\x1B[49m"],bgCyan:["\x1B[46m","\x1B[49m"],bgMagenta:["\x1B[45m","\x1B[49m"],bold:["\x1B[1m","\x1B[22m"],italic:["\x1B[3m","\x1B[23m"],underline:["\x1B[4m","\x1B[24m"],dim:["\x1B[2m","\x1B[22m"],inverse:["\x1B[7m","\x1B[27m"],hidden:["\x1B[8m","\x1B[28m"],strikethrough:["\x1B[9m","\x1B[29m"]};var MA={primary:"blue",secondary:"cyan",success:"green",warning:"yellow",error:"red",info:"magenta",muted:"gray"};function $9(){return!0}function I9(){let E={};E.supportsColor=$9();function T(r,t=[]){let d=r===""?[]:[...t,r],R=function(S){if(!E.supportsColor)return S;let N="",A="";for(let L of d)if(L in MA&&MA[L]in cR){let O=MA[L];N+=cR[O][0],A=cR[O][1]+A}else if(L in cR)N+=cR[L][0],A=cR[L][1]+A;return N+S+A},h=[...Object.keys(cR),...Object.keys(MA)];for(let S of h)if(!(S in R))Object.defineProperty(R,S,{get(){return T(S,d)}});return R}let _=[...Object.keys(cR),...Object.keys(MA)];for(let r of _)if(!(r in E))Object.defineProperty(E,r,{get(){return T(r)}});return E}var VA=I9();class T$ extends t9{name;commands;globalCommand;matchedCommand;matchedCommandName;rawArgs;args;options;showHelpOnExit;showVersionOnExit;enableDidYouMean=!0;signalHandlersSet=!1;isVerbose=!1;isQuiet=!1;isDebug=!1;isNoInteraction=!1;environment;isDryRun=!1;isForce=!1;useEmoji=!0;theme;isNoCache=!1;constructor(E=""){super();this.name=E,this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.globalCommand=new E$(this),this.globalCommand.usage("<command> [options]")}handleSignals(E){if(this.signalHandlersSet)return this;let T=async(_)=>{if(console.log(`
+Example: ${this.cli.name} ${this.rawName} ${r.rawName} <value>`)}}}}class E$ extends oD{constructor(E){super("@@global@@","",{},E)}}var D8=oD,cR={red:["\x1B[31m","\x1B[39m"],green:["\x1B[32m","\x1B[39m"],blue:["\x1B[34m","\x1B[39m"],yellow:["\x1B[33m","\x1B[39m"],cyan:["\x1B[36m","\x1B[39m"],magenta:["\x1B[35m","\x1B[39m"],white:["\x1B[37m","\x1B[39m"],gray:["\x1B[90m","\x1B[39m"],bgRed:["\x1B[41m","\x1B[49m"],bgGreen:["\x1B[42m","\x1B[49m"],bgBlue:["\x1B[44m","\x1B[49m"],bgYellow:["\x1B[43m","\x1B[49m"],bgCyan:["\x1B[46m","\x1B[49m"],bgMagenta:["\x1B[45m","\x1B[49m"],bold:["\x1B[1m","\x1B[22m"],italic:["\x1B[3m","\x1B[23m"],underline:["\x1B[4m","\x1B[24m"],dim:["\x1B[2m","\x1B[22m"],inverse:["\x1B[7m","\x1B[27m"],hidden:["\x1B[8m","\x1B[28m"],strikethrough:["\x1B[9m","\x1B[29m"]};var MA={primary:"blue",secondary:"cyan",success:"green",warning:"yellow",error:"red",info:"magenta",muted:"gray"};function $8(){return!0}function I8(){let E={};E.supportsColor=$8();function T(r,t=[]){let d=r===""?[]:[...t,r],R=function(S){if(!E.supportsColor)return S;let N="",A="";for(let L of d)if(L in MA&&MA[L]in cR){let O=MA[L];N+=cR[O][0],A=cR[O][1]+A}else if(L in cR)N+=cR[L][0],A=cR[L][1]+A;return N+S+A},h=[...Object.keys(cR),...Object.keys(MA)];for(let S of h)if(!(S in R))Object.defineProperty(R,S,{get(){return T(S,d)}});return R}let _=[...Object.keys(cR),...Object.keys(MA)];for(let r of _)if(!(r in E))Object.defineProperty(E,r,{get(){return T(r)}});return E}var VA=I8();class T$ extends t8{name;commands;globalCommand;matchedCommand;matchedCommandName;rawArgs;args;options;showHelpOnExit;showVersionOnExit;enableDidYouMean=!0;signalHandlersSet=!1;isVerbose=!1;isQuiet=!1;isDebug=!1;isNoInteraction=!1;environment;isDryRun=!1;isForce=!1;useEmoji=!0;theme;isNoCache=!1;constructor(E=""){super();this.name=E,this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.globalCommand=new E$(this),this.globalCommand.usage("<command> [options]")}handleSignals(E){if(this.signalHandlersSet)return this;let T=async(_)=>{if(console.log(`
 
-Received ${_}, cleaning up...`),E)try{await E()}catch(r){console.error("Error during cleanup:",r)}OR.exit(0)};return OR.on("SIGINT",()=>T("SIGINT")),OR.on("SIGTERM",()=>T("SIGTERM")),this.signalHandlersSet=!0,this}didYouMean(E=!0){return this.enableDidYouMean=E,this}verbose(){return this.globalCommand.option("-v, --verbose","Enable verbose output"),this}quiet(){return this.globalCommand.option("-q, --quiet","Suppress non-essential output"),this}debug(){return this.globalCommand.option("--debug","Enable debug mode with detailed error information"),this}noInteraction(){return this.globalCommand.option("-n, --no-interaction","Do not ask any interactive questions (for CI/CD)"),this}env(){return this.globalCommand.option("--env <environment>","Target environment (e.g., production, staging, local)"),this}dryRun(){return this.globalCommand.option("--dry-run","Preview actions without executing them"),this}force(){return this.globalCommand.option("-f, --force","Skip confirmation prompts"),this}emoji(){return this.globalCommand.option("--no-emoji","Disable emoji in output"),this}themes(){return this.globalCommand.option("--theme <theme>","Color theme (default, dracula, nord, solarized, monokai)"),this}cache(){return this.globalCommand.option("--no-cache","Disable caching"),this}usage(E){return this.globalCommand.usage(E),this}command(E,T,_){if(!_)_={};let r=new D9(E,T||"",_,this);return r.globalCommand=this.globalCommand,this.commands.push(r),r}option(E,T,_){return this.globalCommand.option(E,T,_),this}help(E){return this.globalCommand.option("-h, --help","Display this message"),this.globalCommand.helpCallback=E,this.showHelpOnExit=!0,this}version(E,T="-v, --version"){return this.globalCommand.version(E,T),this.showVersionOnExit=!0,this}example(E){return this.globalCommand.example(E),this}outputHelp(){if(this.matchedCommand)this.matchedCommand.outputHelp();else this.globalCommand.outputHelp()}outputVersion(){this.globalCommand.outputVersion()}setParsedInfo({args:E,options:T},_,r){if(this.args=E,this.options=T,_)this.matchedCommand=_;if(r)this.matchedCommandName=r;return this}unsetMatchedCommand(){this.matchedCommand=void 0,this.matchedCommandName=void 0}showCommandNotFound(E){if(console.log(VA.red(`
+Received ${_}, cleaning up...`),E)try{await E()}catch(r){console.error("Error during cleanup:",r)}OR.exit(0)};return OR.on("SIGINT",()=>T("SIGINT")),OR.on("SIGTERM",()=>T("SIGTERM")),this.signalHandlersSet=!0,this}didYouMean(E=!0){return this.enableDidYouMean=E,this}verbose(){return this.globalCommand.option("-v, --verbose","Enable verbose output"),this}quiet(){return this.globalCommand.option("-q, --quiet","Suppress non-essential output"),this}debug(){return this.globalCommand.option("--debug","Enable debug mode with detailed error information"),this}noInteraction(){return this.globalCommand.option("-n, --no-interaction","Do not ask any interactive questions (for CI/CD)"),this}env(){return this.globalCommand.option("--env <environment>","Target environment (e.g., production, staging, local)"),this}dryRun(){return this.globalCommand.option("--dry-run","Preview actions without executing them"),this}force(){return this.globalCommand.option("-f, --force","Skip confirmation prompts"),this}emoji(){return this.globalCommand.option("--no-emoji","Disable emoji in output"),this}themes(){return this.globalCommand.option("--theme <theme>","Color theme (default, dracula, nord, solarized, monokai)"),this}cache(){return this.globalCommand.option("--no-cache","Disable caching"),this}usage(E){return this.globalCommand.usage(E),this}command(E,T,_){if(!_)_={};let r=new D8(E,T||"",_,this);return r.globalCommand=this.globalCommand,this.commands.push(r),r}option(E,T,_){return this.globalCommand.option(E,T,_),this}help(E){return this.globalCommand.option("-h, --help","Display this message"),this.globalCommand.helpCallback=E,this.showHelpOnExit=!0,this}version(E,T="-v, --version"){return this.globalCommand.version(E,T),this.showVersionOnExit=!0,this}example(E){return this.globalCommand.example(E),this}outputHelp(){if(this.matchedCommand)this.matchedCommand.outputHelp();else this.globalCommand.outputHelp()}outputVersion(){this.globalCommand.outputVersion()}setParsedInfo({args:E,options:T},_,r){if(this.args=E,this.options=T,_)this.matchedCommand=_;if(r)this.matchedCommandName=r;return this}unsetMatchedCommand(){this.matchedCommand=void 0,this.matchedCommandName=void 0}showCommandNotFound(E){if(console.log(VA.red(`
 ✗ Command "${E}" not found.
-`)),this.enableDidYouMean){let T=[];for(let r of this.commands){if(r.displayName)T.push(r.displayName);if(r.aliasNames)T.push(...r.aliasNames)}let _=YF(E,T);if(_.length>0)console.log(VA.yellow("Did you mean one of these?")),_.forEach((r)=>console.log(`  ${VA.dim("•")} ${this.name} ${r}`)),console.log("")}console.log(VA.dim("Run"),`${this.name} --help`,VA.dim("to see all available commands")),OR.exit(1)}async parse(E=FF,T={}){let{run:_=!0,exitOnError:r=!1}=T;if(r)try{return await this.parse(E,{run:_})}catch(S){throw this.handleUsageError(S),S}if(this.rawArgs=E,!this.name)this.name=E[1]?L9(E[1]):"cli";let t=!0,d=E.slice(2),R=d[0];if(R&&!R.startsWith("-")){for(let S of this.commands)if(S.isMatched(R)){let N=this.mri(d,S);t=!1;let A={...N,args:N.args.slice(1)};this.setParsedInfo(A,S,R),this.emit(`command:${R}`,S);break}}if(t){for(let S of this.commands)if(S.name===""){t=!1;let N=this.mri(d,S);this.setParsedInfo(N,S),this.emit("command:!",S);break}}if(t){let S=this.mri(E.slice(2));this.setParsedInfo(S)}if(this.options.verbose)this.isVerbose=!0;if(this.options.quiet)this.isQuiet=!0;if(this.options.debug)this.isDebug=!0;if(this.options.noInteraction)this.isNoInteraction=!0;if(this.options.env)this.environment=String(this.options.env);if(this.options.dryRun)this.isDryRun=!0;if(this.options.force)this.isForce=!0;if(this.options.noEmoji!==void 0)this.useEmoji=!this.options.noEmoji;if(this.options.theme)this.theme=String(this.options.theme);if(this.options.noCache!==void 0)this.isNoCache=Boolean(this.options.noCache);if(this.options.help&&this.showHelpOnExit)this.outputHelp(),_=!1,this.unsetMatchedCommand();if(this.options.version&&this.showVersionOnExit&&this.matchedCommandName==null)this.outputVersion(),_=!1,this.unsetMatchedCommand();let h={args:this.args,options:this.options};if(_)await this.runMatchedCommand();if(!this.matchedCommand&&this.args[0]){if(this.emit("command:*"),!(this.listenerCount("command:*")>0))this.showCommandNotFound(this.args[0])}return h}mri(E,T){let _=[...this.globalCommand.options,...T?T.options:[]],r=h9(_),t=[],d=E.indexOf("--");if(d>-1)t=E.slice(d+1),E=E.slice(0,d);let R=d9(E,r),h={_:R._};for(let O of Object.keys(R))if(O!=="_")h[HF(O)]=R[O];let S=h._,N={"--":t},A=T&&T.config.ignoreOptionDefaultValue?T.config.ignoreOptionDefaultValue:this.globalCommand.config.ignoreOptionDefaultValue,L=Object.create(null);for(let O of _){if(!A&&O.config.default!==void 0)for(let c of O.names)N[c]=O.config.default;if(Array.isArray(O.config.type)){if(L[O.name]===void 0)L[O.name]={shouldTransform:!0,transformFunction:O.config.type[0]}}}for(let O of Object.keys(h))if(O!=="_"){let c=O.split(".");N9(N,c,h[O]),A9(N,L)}return{args:S,options:N}}async run(E=FF){return this.parse(E,{run:!0,exitOnError:!0})}handleUsageError(E){if(!(!!E&&typeof E==="object"&&E.name==="ClappError"&&E.isUsageError!==!1))return;let r=E,t=r.message??"command-line error",d=this.name?`${this.name}: `:"",R=/--help/.test(t)?"":`
+`)),this.enableDidYouMean){let T=[];for(let r of this.commands){if(r.displayName)T.push(r.displayName);if(r.aliasNames)T.push(...r.aliasNames)}let _=YF(E,T);if(_.length>0)console.log(VA.yellow("Did you mean one of these?")),_.forEach((r)=>console.log(`  ${VA.dim("•")} ${this.name} ${r}`)),console.log("")}console.log(VA.dim("Run"),`${this.name} --help`,VA.dim("to see all available commands")),OR.exit(1)}async parse(E=FF,T={}){let{run:_=!0,exitOnError:r=!1}=T;if(r)try{return await this.parse(E,{run:_})}catch(S){throw this.handleUsageError(S),S}if(this.rawArgs=E,!this.name)this.name=E[1]?L8(E[1]):"cli";let t=!0,d=E.slice(2),R=d[0];if(R&&!R.startsWith("-")){for(let S of this.commands)if(S.isMatched(R)){let N=this.mri(d,S);t=!1;let A={...N,args:N.args.slice(1)};this.setParsedInfo(A,S,R),this.emit(`command:${R}`,S);break}}if(t){for(let S of this.commands)if(S.name===""){t=!1;let N=this.mri(d,S);this.setParsedInfo(N,S),this.emit("command:!",S);break}}if(t){let S=this.mri(E.slice(2));this.setParsedInfo(S)}if(this.options.verbose)this.isVerbose=!0;if(this.options.quiet)this.isQuiet=!0;if(this.options.debug)this.isDebug=!0;if(this.options.noInteraction)this.isNoInteraction=!0;if(this.options.env)this.environment=String(this.options.env);if(this.options.dryRun)this.isDryRun=!0;if(this.options.force)this.isForce=!0;if(this.options.noEmoji!==void 0)this.useEmoji=!this.options.noEmoji;if(this.options.theme)this.theme=String(this.options.theme);if(this.options.noCache!==void 0)this.isNoCache=Boolean(this.options.noCache);if(this.options.help&&this.showHelpOnExit)this.outputHelp(),_=!1,this.unsetMatchedCommand();if(this.options.version&&this.showVersionOnExit&&this.matchedCommandName==null)this.outputVersion(),_=!1,this.unsetMatchedCommand();let h={args:this.args,options:this.options};if(_)await this.runMatchedCommand();if(!this.matchedCommand&&this.args[0]){if(this.emit("command:*"),!(this.listenerCount("command:*")>0))this.showCommandNotFound(this.args[0])}return h}mri(E,T){let _=[...this.globalCommand.options,...T?T.options:[]],r=h8(_),t=[],d=E.indexOf("--");if(d>-1)t=E.slice(d+1),E=E.slice(0,d);let R=d8(E,r),h={_:R._};for(let O of Object.keys(R))if(O!=="_")h[HF(O)]=R[O];let S=h._,N={"--":t},A=T&&T.config.ignoreOptionDefaultValue?T.config.ignoreOptionDefaultValue:this.globalCommand.config.ignoreOptionDefaultValue,L=Object.create(null);for(let O of _){if(!A&&O.config.default!==void 0)for(let c of O.names)N[c]=O.config.default;if(Array.isArray(O.config.type)){if(L[O.name]===void 0)L[O.name]={shouldTransform:!0,transformFunction:O.config.type[0]}}}for(let O of Object.keys(h))if(O!=="_"){let c=O.split(".");N8(N,c,h[O]),A8(N,L)}return{args:S,options:N}}async run(E=FF){return this.parse(E,{run:!0,exitOnError:!0})}handleUsageError(E){if(!(!!E&&typeof E==="object"&&E.name==="ClappError"&&E.isUsageError!==!1))return;let r=E,t=r.message??"command-line error",d=this.name?`${this.name}: `:"",R=/--help/.test(t)?"":`
 Run \`${this.name??"cli"} --help\` for usage.`;OR.stderr.write(`${d}${t}${R}
-`),OR.exit(r.exitCode??2)}async runMatchedCommand(){let{args:E,options:T,matchedCommand:_}=this;if(!_||!_.commandAction)return;_.checkUnknownOptions(),_.checkOptionValue(),_.checkRequiredArgs();let r=[];_.args.forEach((h,S)=>{if(h.variadic)r.push(E.slice(S));else r.push(E[S])}),r.push(T);let t={command:_,args:r,options:T};for(let h of _.beforeHooks)await h(t);let d,R=async()=>{let h=_.commandAction.apply(this,r);if(h instanceof Promise)d=await h;else d=h;return d};if(_.middleware.length>0){let h=0,S=async()=>{if(h<_.middleware.length){let N=_.middleware[h++];await N({...t,next:S})}else await R()};await S()}else await R();for(let h of _.afterHooks)await h(t);return d}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return OR.removeAllListeners("SIGINT"),OR.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class GF{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(E){if(!this.enabled){this.misses++;return}let T=this.cache.get(E);if(!T){this.misses++;return}if(Date.now()-T.timestamp>T.ttl){this.cache.delete(E),this.misses++;return}return this.hits++,T.value}set(E,T,_=5000){if(!this.enabled)return;this.cache.set(E,{value:T,timestamp:Date.now(),ttl:_})}has(E){if(!this.enabled)return!1;let T=this.cache.get(E);if(!T)return!1;if(Date.now()-T.timestamp>T.ttl)return this.cache.delete(E),!1;return!0}delete(E){this.cache.delete(E)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let E=Date.now();for(let[T,_]of this.cache.entries())if(E-_.timestamp>_.ttl)this.cache.delete(T)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var Ip=new GF;function w9(){if("FORCE_COLOR"in KA.env)return KA.env.FORCE_COLOR!=="0";if("NO_COLOR"in KA.env||KA.env.TERM==="dumb")return!1;if(KA.platform==="win32")return!0;return jF.isatty(1)&&jF.isatty(2)}var QF=w9();function HT(E,T){if(!QF)return(_)=>_;return(_)=>E+_+T}var C9=HT("\x1B[0m","\x1B[0m"),X9=HT("\x1B[31m","\x1B[39m"),J9=HT("\x1B[32m","\x1B[39m"),z9=HT("\x1B[33m","\x1B[39m"),F9=HT("\x1B[34m","\x1B[39m"),j9=HT("\x1B[35m","\x1B[39m"),y9=HT("\x1B[36m","\x1B[39m"),B9=HT("\x1B[37m","\x1B[39m"),P9=HT("\x1B[90m","\x1B[39m"),W9=HT("\x1B[1m","\x1B[22m"),H9=HT("\x1B[3m","\x1B[23m"),Y9=HT("\x1B[4m","\x1B[24m"),f9=HT("\x1B[2m","\x1B[22m"),G9=HT("\x1B[7m","\x1B[27m"),Q9=HT("\x1B[8m","\x1B[28m"),M9=HT("\x1B[9m","\x1B[29m"),V9=HT("\x1B[41m","\x1B[49m"),K9=HT("\x1B[42m","\x1B[49m"),Z9=HT("\x1B[43m","\x1B[49m"),g9=HT("\x1B[44m","\x1B[49m"),q9=HT("\x1B[45m","\x1B[49m"),x9=HT("\x1B[46m","\x1B[49m"),b9=HT("\x1B[47m","\x1B[49m"),k9=QF,u9={reset:C9,red:X9,green:J9,yellow:z9,blue:F9,magenta:j9,cyan:y9,white:B9,gray:P9,bold:W9,italic:H9,underline:Y9,dim:f9,inverse:G9,hidden:Q9,strikethrough:M9,bgRed:V9,bgGreen:K9,bgYellow:Z9,bgBlue:g9,bgMagenta:q9,bgCyan:x9,bgWhite:b9,isColorSupported:k9},KO=u9,v9=["up","down","left","right","space","enter","cancel"],ZO={actions:new Set(v9),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};function MF(E,T){if(typeof E==="string")return ZO.aliases.get(E)===T;for(let _ of E){if(_===void 0)continue;if(MF(_,T))return!0}return!1}function l9(E,T){if(E===T)return[];let _=E.split(`
+`),OR.exit(r.exitCode??2)}async runMatchedCommand(){let{args:E,options:T,matchedCommand:_}=this;if(!_||!_.commandAction)return;_.checkUnknownOptions(),_.checkOptionValue(),_.checkRequiredArgs();let r=[];_.args.forEach((h,S)=>{if(h.variadic)r.push(E.slice(S));else r.push(E[S])}),r.push(T);let t={command:_,args:r,options:T};for(let h of _.beforeHooks)await h(t);let d,R=async()=>{let h=_.commandAction.apply(this,r);if(h instanceof Promise)d=await h;else d=h;return d};if(_.middleware.length>0){let h=0,S=async()=>{if(h<_.middleware.length){let N=_.middleware[h++];await N({...t,next:S})}else await R()};await S()}else await R();for(let h of _.afterHooks)await h(t);return d}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return OR.removeAllListeners("SIGINT"),OR.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class GF{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(E){if(!this.enabled){this.misses++;return}let T=this.cache.get(E);if(!T){this.misses++;return}if(Date.now()-T.timestamp>T.ttl){this.cache.delete(E),this.misses++;return}return this.hits++,T.value}set(E,T,_=5000){if(!this.enabled)return;this.cache.set(E,{value:T,timestamp:Date.now(),ttl:_})}has(E){if(!this.enabled)return!1;let T=this.cache.get(E);if(!T)return!1;if(Date.now()-T.timestamp>T.ttl)return this.cache.delete(E),!1;return!0}delete(E){this.cache.delete(E)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let E=Date.now();for(let[T,_]of this.cache.entries())if(E-_.timestamp>_.ttl)this.cache.delete(T)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var Ip=new GF;function w8(){if("FORCE_COLOR"in KA.env)return KA.env.FORCE_COLOR!=="0";if("NO_COLOR"in KA.env||KA.env.TERM==="dumb")return!1;if(KA.platform==="win32")return!0;return jF.isatty(1)&&jF.isatty(2)}var QF=w8();function HT(E,T){if(!QF)return(_)=>_;return(_)=>E+_+T}var C8=HT("\x1B[0m","\x1B[0m"),X8=HT("\x1B[31m","\x1B[39m"),J8=HT("\x1B[32m","\x1B[39m"),z8=HT("\x1B[33m","\x1B[39m"),F8=HT("\x1B[34m","\x1B[39m"),j8=HT("\x1B[35m","\x1B[39m"),y8=HT("\x1B[36m","\x1B[39m"),B8=HT("\x1B[37m","\x1B[39m"),P8=HT("\x1B[90m","\x1B[39m"),W8=HT("\x1B[1m","\x1B[22m"),H8=HT("\x1B[3m","\x1B[23m"),Y8=HT("\x1B[4m","\x1B[24m"),f8=HT("\x1B[2m","\x1B[22m"),G8=HT("\x1B[7m","\x1B[27m"),Q8=HT("\x1B[8m","\x1B[28m"),M8=HT("\x1B[9m","\x1B[29m"),V8=HT("\x1B[41m","\x1B[49m"),K8=HT("\x1B[42m","\x1B[49m"),Z8=HT("\x1B[43m","\x1B[49m"),g8=HT("\x1B[44m","\x1B[49m"),q8=HT("\x1B[45m","\x1B[49m"),x8=HT("\x1B[46m","\x1B[49m"),b8=HT("\x1B[47m","\x1B[49m"),k8=QF,u8={reset:C8,red:X8,green:J8,yellow:z8,blue:F8,magenta:j8,cyan:y8,white:B8,gray:P8,bold:W8,italic:H8,underline:Y8,dim:f8,inverse:G8,hidden:Q8,strikethrough:M8,bgRed:V8,bgGreen:K8,bgYellow:Z8,bgBlue:g8,bgMagenta:q8,bgCyan:x8,bgWhite:b8,isColorSupported:k8},KO=u8,v8=["up","down","left","right","space","enter","cancel"],ZO={actions:new Set(v8),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};function MF(E,T){if(typeof E==="string")return ZO.aliases.get(E)===T;for(let _ of E){if(_===void 0)continue;if(MF(_,T))return!0}return!1}function l8(E,T){if(E===T)return[];let _=E.split(`
 `),r=T.split(`
-`),t=[];for(let d=0;d<Math.max(_.length,r.length);d++)if(_[d]!==r[d])t.push(d);return t}var Fp=n9.platform.startsWith("win"),yF=Symbol("clapp:cancel");function QO(E,T){let _=E;if(_.isTTY)_.setRawMode(T)}function s9(E){return E.replace(/\x1b\[[0-9;]*m/g,"")}function p9(E){return s9(E).length}function PF(E,T,_){if(!T||T<1)return E;let r=_?.hard??!1,t=_?.trim??!0,d=E.split(`
-`),R=[];for(let h of d){if(p9(h)<=T){R.push(t?h.trimEnd():h);continue}if(r){let S="",N=0,A=0;while(A<h.length){let L=h.slice(A).match(/^\x1b\[[0-9;]*m/);if(L){S+=L[0],A+=L[0].length;continue}if(N>=T)R.push(t?S.trimEnd():S),S="",N=0;S+=h[A],N++,A++}if(S)R.push(t?S.trimEnd():S)}else R.push(t?h.trimEnd():h)}return R.join(`
-`)}class _${input;output;_abortSignal;rl;opts;_render;_track=!1;_prevFrame="";_subscribers=new Map;_cursor=0;_manualLine="";state="initial";error="";value;userInput="";constructor(E,T=!0){let{input:_=i9,output:r=a9,render:t,signal:d,...R}=E;this.opts=R,this.onKeypress=this.onKeypress.bind(this),this.close=this.close.bind(this),this.render=this.render.bind(this),this._render=t.bind(this),this._track=T,this._abortSignal=d,this.input=_,this.output=r}unsubscribe(){this._subscribers.clear()}setSubscriber(E,T){let _=this._subscribers.get(E)??[];_.push(T),this._subscribers.set(E,_)}on(E,T){return this.setSubscriber(E,{cb:T}),this}once(E,T){return this.setSubscriber(E,{cb:T,once:!0}),this}emit(E,...T){let _=this._subscribers.get(E)??[],r=[];for(let t of _)if(t.cb(...T),t.once)r.push(()=>_.splice(_.indexOf(t),1));for(let t of r)t();return this}prompt(){return new Promise((E)=>{if(this._abortSignal){if(this._abortSignal.aborted)return this.state="cancel",this.close(),E(yF);this._abortSignal.addEventListener("abort",()=>{this.state="cancel",this.close()},{once:!0})}if(this.rl=m9.createInterface({input:this.input,tabSize:2,prompt:"",escapeCodeTimeout:50,terminal:!0}),this.rl.prompt(),this.opts.initialUserInput!==void 0)this._setUserInput(this.opts.initialUserInput,!0);this.input.on("keypress",this.onKeypress),QO(this.input,!0),this.output.on("resize",this.render),this.render(),this.once("submit",()=>{this.output.write(Ad.show),this.output.off("resize",this.render),QO(this.input,!1),E(this.value)}),this.once("cancel",()=>{this.output.write(Ad.show),this.output.off("resize",this.render),QO(this.input,!1),E(yF)})})}_isActionKey(E,T){return E==="\t"}_setValue(E){this.value=E,this.emit("value",this.value)}_setUserInput(E,T){if(this.userInput=E??"",this.emit("userInput",this.userInput),T&&this._track&&this.rl)this.rl.write(this.userInput),this._cursor=this.rl.cursor}onKeypress(E,T){if(this._track&&T.name!=="return"){if(T.name&&this._isActionKey(E,T))this.rl?.write(null,{ctrl:!0,name:"h"});this._cursor=this.rl?.cursor??0;let _=T.name==="tab"||T.name==="escape"||T.name==="backspace"||T.name==="delete"||T.name==="enter"||T.name==="return"||T.name&&["up","down","left","right"].includes(T.name);if(E&&!_&&E.length===1&&E>=" ")this._manualLine+=E;else if(T.name==="backspace"&&this._manualLine.length>0)this._manualLine=this._manualLine.slice(0,-1);let r=this._manualLine.length>=(this.rl?.line?.length||0)?this._manualLine:this.rl?.line;this._setUserInput(r)}if(this.state==="error")this.state="active",this.error="";if(T?.name){if(!this._track&&ZO.aliases.has(T.name))this.emit("cursor",ZO.aliases.get(T.name));if(ZO.actions.has(T.name))this.emit("cursor",T.name)}if(E&&(E.toLowerCase()==="y"||E.toLowerCase()==="n"))this.emit("confirm",E.toLowerCase()==="y");if(this.emit("key",E?.toLowerCase(),T),T?.name==="return"){if(this.opts.validate){let _=this.opts.validate(this.value);if(_)this.error=_ instanceof Error?_.message:_,this.state="error"}if(this.state!=="error")this.state="submit"}if(MF([E,T?.name,T?.sequence],"cancel"))this.state="cancel";if(this.state==="submit"||this.state==="cancel")this.emit("finalize");if(this.render(),this.state==="submit"||this.state==="cancel")this.close()}close(){if(this.input.unpipe(),this.input.removeListener("keypress",this.onKeypress),this.output.write(`
+`),t=[];for(let d=0;d<Math.max(_.length,r.length);d++)if(_[d]!==r[d])t.push(d);return t}var Fp=n8.platform.startsWith("win"),yF=Symbol("clapp:cancel");function QO(E,T){let _=E;if(_.isTTY)_.setRawMode(T)}function s8(E){return E.replace(/\x1b\[[0-9;]*m/g,"")}function p8(E){return s8(E).length}function PF(E,T,_){if(!T||T<1)return E;let r=_?.hard??!1,t=_?.trim??!0,d=E.split(`
+`),R=[];for(let h of d){if(p8(h)<=T){R.push(t?h.trimEnd():h);continue}if(r){let S="",N=0,A=0;while(A<h.length){let L=h.slice(A).match(/^\x1b\[[0-9;]*m/);if(L){S+=L[0],A+=L[0].length;continue}if(N>=T)R.push(t?S.trimEnd():S),S="",N=0;S+=h[A],N++,A++}if(S)R.push(t?S.trimEnd():S)}else R.push(t?h.trimEnd():h)}return R.join(`
+`)}class _${input;output;_abortSignal;rl;opts;_render;_track=!1;_prevFrame="";_subscribers=new Map;_cursor=0;_manualLine="";state="initial";error="";value;userInput="";constructor(E,T=!0){let{input:_=i8,output:r=a8,render:t,signal:d,...R}=E;this.opts=R,this.onKeypress=this.onKeypress.bind(this),this.close=this.close.bind(this),this.render=this.render.bind(this),this._render=t.bind(this),this._track=T,this._abortSignal=d,this.input=_,this.output=r}unsubscribe(){this._subscribers.clear()}setSubscriber(E,T){let _=this._subscribers.get(E)??[];_.push(T),this._subscribers.set(E,_)}on(E,T){return this.setSubscriber(E,{cb:T}),this}once(E,T){return this.setSubscriber(E,{cb:T,once:!0}),this}emit(E,...T){let _=this._subscribers.get(E)??[],r=[];for(let t of _)if(t.cb(...T),t.once)r.push(()=>_.splice(_.indexOf(t),1));for(let t of r)t();return this}prompt(){return new Promise((E)=>{if(this._abortSignal){if(this._abortSignal.aborted)return this.state="cancel",this.close(),E(yF);this._abortSignal.addEventListener("abort",()=>{this.state="cancel",this.close()},{once:!0})}if(this.rl=m8.createInterface({input:this.input,tabSize:2,prompt:"",escapeCodeTimeout:50,terminal:!0}),this.rl.prompt(),this.opts.initialUserInput!==void 0)this._setUserInput(this.opts.initialUserInput,!0);this.input.on("keypress",this.onKeypress),QO(this.input,!0),this.output.on("resize",this.render),this.render(),this.once("submit",()=>{this.output.write(Ad.show),this.output.off("resize",this.render),QO(this.input,!1),E(this.value)}),this.once("cancel",()=>{this.output.write(Ad.show),this.output.off("resize",this.render),QO(this.input,!1),E(yF)})})}_isActionKey(E,T){return E==="\t"}_setValue(E){this.value=E,this.emit("value",this.value)}_setUserInput(E,T){if(this.userInput=E??"",this.emit("userInput",this.userInput),T&&this._track&&this.rl)this.rl.write(this.userInput),this._cursor=this.rl.cursor}onKeypress(E,T){if(this._track&&T.name!=="return"){if(T.name&&this._isActionKey(E,T))this.rl?.write(null,{ctrl:!0,name:"h"});this._cursor=this.rl?.cursor??0;let _=T.name==="tab"||T.name==="escape"||T.name==="backspace"||T.name==="delete"||T.name==="enter"||T.name==="return"||T.name&&["up","down","left","right"].includes(T.name);if(E&&!_&&E.length===1&&E>=" ")this._manualLine+=E;else if(T.name==="backspace"&&this._manualLine.length>0)this._manualLine=this._manualLine.slice(0,-1);let r=this._manualLine.length>=(this.rl?.line?.length||0)?this._manualLine:this.rl?.line;this._setUserInput(r)}if(this.state==="error")this.state="active",this.error="";if(T?.name){if(!this._track&&ZO.aliases.has(T.name))this.emit("cursor",ZO.aliases.get(T.name));if(ZO.actions.has(T.name))this.emit("cursor",T.name)}if(E&&(E.toLowerCase()==="y"||E.toLowerCase()==="n"))this.emit("confirm",E.toLowerCase()==="y");if(this.emit("key",E?.toLowerCase(),T),T?.name==="return"){if(this.opts.validate){let _=this.opts.validate(this.value);if(_)this.error=_ instanceof Error?_.message:_,this.state="error"}if(this.state!=="error")this.state="submit"}if(MF([E,T?.name,T?.sequence],"cancel"))this.state="cancel";if(this.state==="submit"||this.state==="cancel")this.emit("finalize");if(this.render(),this.state==="submit"||this.state==="cancel")this.close()}close(){if(this.input.unpipe(),this.input.removeListener("keypress",this.onKeypress),this.output.write(`
 `),QO(this.input,!1),this.rl?.close(),this.rl=void 0,this.emit(`${this.state}`,this.value),this.state==="cancel")setTimeout(()=>{this.unsubscribe()},10);else this.unsubscribe()}restoreCursor(){let E=PF(this._prevFrame,BF.stdout.columns,{hard:!0,trim:!1}).split(`
-`).length-1;this.output.write(Ad.move(-999,E*-1))}render(){let E=PF(this._render(this)??"",BF.stdout.columns,{hard:!0,trim:!1});if(E===this._prevFrame)return;if(this.state==="initial")this.output.write(Ad.hide);else{let T=l9(this._prevFrame,E);if(this.restoreCursor(),T&&T?.length===1){let _=T[0];this.output.write(Ad.move(0,_)),this.output.write(mD.lines(1));let r=E.split(`
+`).length-1;this.output.write(Ad.move(-999,E*-1))}render(){let E=PF(this._render(this)??"",BF.stdout.columns,{hard:!0,trim:!1});if(E===this._prevFrame)return;if(this.state==="initial")this.output.write(Ad.hide);else{let T=l8(this._prevFrame,E);if(this.restoreCursor(),T&&T?.length===1){let _=T[0];this.output.write(Ad.move(0,_)),this.output.write(mD.lines(1));let r=E.split(`
 `);this.output.write(r[_]),this._prevFrame=E,this.output.write(Ad.move(0,r.length-_-1));return}if(T&&T?.length>1){let _=T[0];this.output.write(Ad.move(0,_)),this.output.write(mD.down());let t=E.split(`
 `).slice(_);this.output.write(t.join(`
-`)),this._prevFrame=E;return}this.output.write(mD.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function o9(E,T){if(E===void 0)return 0;if(T.length===0)return 0;let r=T.findIndex((t)=>t.value===E);return r!==-1?r:0}function E8(E,T){return(T.label??String(T.value)).toLowerCase().includes(E.toLowerCase())}function T8(E,T){if(!T)return;if(E)return T;return T[0]}class _8 extends _${filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#_="";#r;#T;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return KO.inverse(KO.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[T,..._]=this.userInput.slice(this._cursor);return`${E}${KO.inverse(T)}${_.join("")}`}get options(){if(typeof this.#T==="function")return this.#T();return this.#T}constructor(E){super(E);this.#T=E.options;let T=this.options;this.filteredOptions=[...T],this.multiple=E.multiple===!0,this.#r=E.filter??E8;let _;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)_=E.initialValue;else _=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)_=[this.options[0].value];if(_)for(let r of _){let t=T.findIndex((d)=>d.value===r);if(t!==-1)this.toggleSelected(r),this.#E=t}this.focusedValue=this.options[this.#E]?.value,this.on("key",(r,t)=>this.#t(r,t)),this.on("userInput",(r)=>this.#d(r))}_isActionKey(E,T){return E==="\t"||this.multiple&&this.isNavigating&&T.name==="space"&&E!==void 0&&E!==""}#t(E,T){let _=T.name==="up",r=T.name==="down",t=T.name==="return";if(_||r){if(this.#E=Math.max(0,Math.min(this.#E+(_?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(t)this.value=T8(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(T.name==="tab"||this.isNavigating&&T.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((T)=>T!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#d(E){if(E!==this.#_){this.#_=E;let T=this.options;if(E)this.filteredOptions=T.filter((_)=>this.#r(E,_));else this.filteredOptions=[...T];if(this.#E=o9(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class r8 extends _${options;cursor=0;#E;getGroupItems(E){return this.options.filter((T)=>T.group===E)}isGroupSelected(E){let T=this.getGroupItems(E),_=this.value;if(_===void 0)return!1;return T.every((r)=>_.includes(r.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let T=String(E.value),_=this.getGroupItems(T);if(this.isGroupSelected(T))this.value=this.value.filter((r)=>_.findIndex((t)=>t.value===r)===-1);else this.value=[...this.value,..._.map((r)=>r.value)];this.value=Array.from(new Set(this.value))}else{let T=this.value.includes(E.value);this.value=T?this.value.filter((_)=>_!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:T}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(T).flatMap(([_,r])=>[{value:_,group:!0,label:_},...r.map((t)=>({...t,group:_}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:_})=>_===E.cursorAt),this.#E?0:1),this.on("cursor",(_)=>{switch(_){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var t8=O9();var yT=(E,T)=>t8?E:T,Bp=yT("◆","*"),Pp=yT("■","x"),Wp=yT("▲","x"),Hp=yT("◇","o"),Yp=yT("┌","T"),d8=yT("│","|"),fp=yT("└","—"),Gp=yT("●",">"),Qp=yT("○"," "),Mp=yT("◻","[•]"),Vp=yT("◼","[+]"),Kp=yT("◻","[ ]"),Zp=yT("▪","•"),gp=yT("─","-"),qp=yT("╮","+"),xp=yT("├","+"),bp=yT("╯","+"),kp=yT("●","•"),up=yT("◆","*"),np=yT("▲","!"),vp=yT("■","x");var lp={light:yT("─","-"),heavy:yT("━","="),block:yT("█","#")};function R8(){return`${KO.gray(d8)}  `}var ip=R8();var r$="0.7.87";QE();import{existsSync as O$}from"node:fs";import{mkdir as $8,writeFile as vF}from"node:fs/promises";function c$(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(T)=>{if(b("Initializing ts-cloud Project"),O$("cloud.config.ts")){if(!await UE("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let _=T?.name||await LT("Project name","my-app"),r=T?.mode||await qO("Select deployment mode",["serverless","server"]),t=T?.region||await qO("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),d=new v("Creating configuration file...");d.start();let R=`import { defineConfig } from '@ts-cloud/core'
+`)),this._prevFrame=E;return}this.output.write(mD.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function o8(E,T){if(E===void 0)return 0;if(T.length===0)return 0;let r=T.findIndex((t)=>t.value===E);return r!==-1?r:0}function E9(E,T){return(T.label??String(T.value)).toLowerCase().includes(E.toLowerCase())}function T9(E,T){if(!T)return;if(E)return T;return T[0]}class _9 extends _${filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#_="";#r;#T;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return KO.inverse(KO.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[T,..._]=this.userInput.slice(this._cursor);return`${E}${KO.inverse(T)}${_.join("")}`}get options(){if(typeof this.#T==="function")return this.#T();return this.#T}constructor(E){super(E);this.#T=E.options;let T=this.options;this.filteredOptions=[...T],this.multiple=E.multiple===!0,this.#r=E.filter??E9;let _;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)_=E.initialValue;else _=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)_=[this.options[0].value];if(_)for(let r of _){let t=T.findIndex((d)=>d.value===r);if(t!==-1)this.toggleSelected(r),this.#E=t}this.focusedValue=this.options[this.#E]?.value,this.on("key",(r,t)=>this.#t(r,t)),this.on("userInput",(r)=>this.#d(r))}_isActionKey(E,T){return E==="\t"||this.multiple&&this.isNavigating&&T.name==="space"&&E!==void 0&&E!==""}#t(E,T){let _=T.name==="up",r=T.name==="down",t=T.name==="return";if(_||r){if(this.#E=Math.max(0,Math.min(this.#E+(_?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(t)this.value=T9(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(T.name==="tab"||this.isNavigating&&T.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((T)=>T!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#d(E){if(E!==this.#_){this.#_=E;let T=this.options;if(E)this.filteredOptions=T.filter((_)=>this.#r(E,_));else this.filteredOptions=[...T];if(this.#E=o8(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class r9 extends _${options;cursor=0;#E;getGroupItems(E){return this.options.filter((T)=>T.group===E)}isGroupSelected(E){let T=this.getGroupItems(E),_=this.value;if(_===void 0)return!1;return T.every((r)=>_.includes(r.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let T=String(E.value),_=this.getGroupItems(T);if(this.isGroupSelected(T))this.value=this.value.filter((r)=>_.findIndex((t)=>t.value===r)===-1);else this.value=[...this.value,..._.map((r)=>r.value)];this.value=Array.from(new Set(this.value))}else{let T=this.value.includes(E.value);this.value=T?this.value.filter((_)=>_!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:T}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(T).flatMap(([_,r])=>[{value:_,group:!0,label:_},...r.map((t)=>({...t,group:_}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:_})=>_===E.cursorAt),this.#E?0:1),this.on("cursor",(_)=>{switch(_){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var t9=O8();var yT=(E,T)=>t9?E:T,Bp=yT("◆","*"),Pp=yT("■","x"),Wp=yT("▲","x"),Hp=yT("◇","o"),Yp=yT("┌","T"),d9=yT("│","|"),fp=yT("└","—"),Gp=yT("●",">"),Qp=yT("○"," "),Mp=yT("◻","[•]"),Vp=yT("◼","[+]"),Kp=yT("◻","[ ]"),Zp=yT("▪","•"),gp=yT("─","-"),qp=yT("╮","+"),xp=yT("├","+"),bp=yT("╯","+"),kp=yT("●","•"),up=yT("◆","*"),np=yT("▲","!"),vp=yT("■","x");var lp={light:yT("─","-"),heavy:yT("━","="),block:yT("█","#")};function R9(){return`${KO.gray(d9)}  `}var ip=R9();var r$="0.7.88";QE();import{existsSync as O$}from"node:fs";import{mkdir as $9,writeFile as vF}from"node:fs/promises";function c$(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(T)=>{if(b("Initializing ts-cloud Project"),O$("cloud.config.ts")){if(!await UE("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let _=T?.name||await LT("Project name","my-app"),r=T?.mode||await qO("Select deployment mode",["serverless","server"]),t=T?.region||await qO("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),d=new v("Creating configuration file...");d.start();let R=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -9287,21 +9287,21 @@ dist/
 cloudformation/
 *.log
 .DS_Store
-`),Z("Created .gitignore");if(!O$("cloudformation"))await $8("cloudformation",{recursive:!0}),Z("Created cloudformation/ directory");xr(`ts-cloud project initialized!
+`),Z("Created .gitignore");if(!O$("cloudformation"))await $9("cloudformation",{recursive:!0}),Z("Created cloudformation/ directory");xr(`ts-cloud project initialized!
 
 Next steps:
   1. Edit cloud.config.ts to configure your infrastructure
   2. Run 'cloud generate' to create CloudFormation templates
-  3. Run 'cloud deploy' to deploy your infrastructure`,"green")}),E.command("init:server","Initialize server-based (EC2) project").action(async()=>{b("Initializing Server-Based Project"),await E.parse(["init","--mode","server"])}),E.command("init:serverless","Initialize serverless (Fargate/Lambda) project").action(async()=>{b("Initializing Serverless Project"),await E.parse(["init","--mode","serverless"])}),E.command("init:hybrid","Initialize hybrid project").action(async()=>{b("Initializing Hybrid Project"),await E.parse(["init","--mode","hybrid"])})}QE();import{readFile as FW,writeFile as Xb}from"node:fs/promises";import{resolve as Pe}from"node:path";import{createCipheriv as C8,createDecipheriv as X8,createHash as oF,randomBytes as Ld}from"node:crypto";import{createHmac as I8,timingSafeEqual as w8}from"node:crypto";var e$="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function xO(E){let T=0,_=0,r="";for(let t of E){_=_<<8|t,T+=8;while(T>=5)r+=e$[_>>>T-5&31],T-=5}if(T>0)r+=e$[_<<5-T&31];return r}function lF(E){let T=E.toUpperCase().replace(/[^A-Z2-7]/g,""),_=0,r=0,t=[];for(let d of T){let R=e$.indexOf(d);if(R<0)throw Error("Invalid base32 secret");if(r=r<<5|R,_+=5,_>=8)t.push(r>>>_-8&255),_-=8}return Buffer.from(t)}function iF(E,T,_=6){let r=Buffer.alloc(8);r.writeBigUInt64BE(BigInt(T));let t=I8("sha1",lF(E)).update(r).digest(),d=t[t.length-1]&15,R=(t[d]&127)<<24|(t[d+1]&255)<<16|(t[d+2]&255)<<8|t[d+3]&255;return String(R%10**_).padStart(_,"0")}function bO(E,T,_=Date.now(),r=1){let t=T.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(t))return;let d=Buffer.from(t),R=Math.floor(_/1000/30);for(let h=-r;h<=r;h++){if(R+h<0)continue;let S=Buffer.from(iF(E,R+h));if(d.length===S.length&&w8(d,S))return R+h}return}function U$(E){let T=E.issuer?.trim()||"ts-cloud",_=`${T}:${E.account}`;return`otpauth://totp/${encodeURIComponent(_)}?secret=${encodeURIComponent(E.secret)}&issuer=${encodeURIComponent(T)}&algorithm=SHA1&digits=6&period=30`}var Ej=1800000,$R=43200000,Tj=3600000,_j=300000,rj=600000;function Xr(E){return typeof E==="string"?E:void 0}function tj(E){if(typeof E!=="string")return{};try{return JSON.parse(E)}catch{return{}}}function J8(E){let T=E.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(T))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return T}function D$(E){if(E===void 0||!E.trim())return;let T=E.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(T)||T.length>254)throw Error("A valid email address is required");return T}function z8(E){let T=E.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(T))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return T}function F8(E){let T=new URL(E.trim());if(T.search||T.hash||T.username||T.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(T.protocol!=="https:"&&!(T.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(T.hostname)))throw Error("OIDC issuer must use HTTPS");return T.href.replace(/\/$/,"")}function j8(E){let T=[...new Set(E.map((_)=>_.trim().toLowerCase()).filter(Boolean))];if(T.length===0)throw Error("At least one explicit OIDC email domain is required");if(T.some((_)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(_)||!_.includes(".")||_.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return T}function y8(E){let T=[...new Set(["openid",...E??["email","profile"]].map((_)=>_.trim()).filter(Boolean))];if(T.some((_)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(_)))throw Error("OIDC scopes contain unsupported characters");return T}function St(E){return oF("sha256").update(E).digest("hex")}function qA(E){return{id:String(E.id),actorId:String(E.actor_id),username:String(E.username),email:Xr(E.email),emailVerifiedAt:Xr(E.email_verified_at),passwordHash:String(E.password_hash),credentialVersion:Number(E.credential_version),requiresPasswordUpgrade:Number(E.requires_password_upgrade)===1,disabledAt:Xr(E.disabled_at),lastLoginAt:Xr(E.last_login_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function aF(E,T){let _=Xr(E.consumed_at),r=String(E.expires_at);return{id:String(E.id),identityId:String(E.identity_id),type:String(E.type),metadata:tj(E.metadata),expiresAt:r,consumedAt:_,createdAt:String(E.created_at),state:_?"consumed":r<=T?"expired":"pending"}}function $$(E,T){let _=Xr(E.revoked_at),r=String(E.idle_expires_at),t=String(E.absolute_expires_at);return{id:String(E.id),identityId:String(E.identity_id),credentialVersion:Number(E.credential_version),authMethod:String(E.auth_method),userAgent:Xr(E.user_agent),networkHint:Xr(E.network_hint),createdAt:String(E.created_at),lastUsedAt:String(E.last_used_at),idleExpiresAt:r,absoluteExpiresAt:t,recentAuthAt:String(E.recent_auth_at),mfaAt:Xr(E.mfa_at),revokedAt:_,state:_?"revoked":r<=T||t<=T?"expired":"active"}}function mF(E){let T=Xr(E.verified_at),_=Xr(E.disabled_at);return{id:String(E.id),identityId:String(E.identity_id),type:"totp",label:String(E.label),createdAt:String(E.created_at),verifiedAt:T,disabledAt:_,state:_?"disabled":T?"active":"pending"}}function I$(E,T){let _=Xr(E.consumed_at),r=String(E.expires_at),t=Number(E.attempts);return{id:String(E.id),identityId:String(E.identity_id),purpose:String(E.purpose),attempts:t,expiresAt:r,consumedAt:_,createdAt:String(E.created_at),state:_?"consumed":t>=5?"locked":r<=T?"expired":"pending"}}function sF(E){let T=tj(E);return Array.isArray(T)?T.filter((_)=>typeof _==="string"):[]}function kO(E){return{id:String(E.id),organizationId:String(E.organization_id),slug:String(E.slug),name:String(E.name),issuer:String(E.issuer),clientId:String(E.client_id),hasClientSecret:typeof E.client_secret_ciphertext==="string"&&E.client_secret_ciphertext.length>0,scopes:sF(E.scopes),allowedDomains:sF(E.allowed_domains),defaultRole:String(E.default_role),enabled:Number(E.enabled)===1,enforceSso:Number(E.enforce_sso)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function pF(E,T){let _=Xr(E.consumed_at),r=String(E.expires_at);return{id:String(E.id),providerId:String(E.provider_id),redirectUri:String(E.redirect_uri),returnPath:String(E.return_path),expiresAt:r,consumedAt:_,createdAt:String(E.created_at),state:_?"consumed":r<=T?"expired":"pending"}}function B8(E){return{id:String(E.id),providerId:String(E.provider_id),identityId:String(E.identity_id),subject:String(E.subject),email:String(E.email),linkedAt:String(E.linked_at),lastLoginAt:String(E.last_login_at)}}class Nt{controlPlane;nowFn;idFn;encryptionKey;constructor(E,T={}){this.controlPlane=E;this.nowFn=T.now??(()=>new Date),this.idFn=T.id??(()=>crypto.randomUUID()),this.encryptionKey=T.encryptionKey?oF("sha256").update(T.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(E,T){this.controlPlane.database.run(E,T)}encrypt(E){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let T=Ld(12),_=C8("aes-256-gcm",this.encryptionKey,T),r=Buffer.concat([_.update(E,"utf8"),_.final()]);return`v1.${T.toString("base64url")}.${_.getAuthTag().toString("base64url")}.${r.toString("base64url")}`}decrypt(E){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[T,_,r,t]=E.split(".");if(T!=="v1"||!_||!r||!t)throw Error("Encrypted authentication value is unavailable");let d=X8("aes-256-gcm",this.encryptionKey,Buffer.from(_,"base64url"));return d.setAuthTag(Buffer.from(r,"base64url")),Buffer.concat([d.update(Buffer.from(t,"base64url")),d.final()]).toString("utf8")}createIdentity(E){if(!this.controlPlane.getActor(E.actorId))throw Error("Authentication actor was not found");let T=J8(E.username),_=D$(E.email),r=E.id??this.idFn(),t=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
+  3. Run 'cloud deploy' to deploy your infrastructure`,"green")}),E.command("init:server","Initialize server-based (EC2) project").action(async()=>{b("Initializing Server-Based Project"),await E.parse(["init","--mode","server"])}),E.command("init:serverless","Initialize serverless (Fargate/Lambda) project").action(async()=>{b("Initializing Serverless Project"),await E.parse(["init","--mode","serverless"])}),E.command("init:hybrid","Initialize hybrid project").action(async()=>{b("Initializing Hybrid Project"),await E.parse(["init","--mode","hybrid"])})}QE();import{readFile as FW,writeFile as Xb}from"node:fs/promises";import{resolve as Pe}from"node:path";import{createCipheriv as C9,createDecipheriv as X9,createHash as oF,randomBytes as Ld}from"node:crypto";import{createHmac as I9,timingSafeEqual as w9}from"node:crypto";var e$="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function xO(E){let T=0,_=0,r="";for(let t of E){_=_<<8|t,T+=8;while(T>=5)r+=e$[_>>>T-5&31],T-=5}if(T>0)r+=e$[_<<5-T&31];return r}function lF(E){let T=E.toUpperCase().replace(/[^A-Z2-7]/g,""),_=0,r=0,t=[];for(let d of T){let R=e$.indexOf(d);if(R<0)throw Error("Invalid base32 secret");if(r=r<<5|R,_+=5,_>=8)t.push(r>>>_-8&255),_-=8}return Buffer.from(t)}function iF(E,T,_=6){let r=Buffer.alloc(8);r.writeBigUInt64BE(BigInt(T));let t=I9("sha1",lF(E)).update(r).digest(),d=t[t.length-1]&15,R=(t[d]&127)<<24|(t[d+1]&255)<<16|(t[d+2]&255)<<8|t[d+3]&255;return String(R%10**_).padStart(_,"0")}function bO(E,T,_=Date.now(),r=1){let t=T.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(t))return;let d=Buffer.from(t),R=Math.floor(_/1000/30);for(let h=-r;h<=r;h++){if(R+h<0)continue;let S=Buffer.from(iF(E,R+h));if(d.length===S.length&&w9(d,S))return R+h}return}function U$(E){let T=E.issuer?.trim()||"ts-cloud",_=`${T}:${E.account}`;return`otpauth://totp/${encodeURIComponent(_)}?secret=${encodeURIComponent(E.secret)}&issuer=${encodeURIComponent(T)}&algorithm=SHA1&digits=6&period=30`}var Ej=1800000,$R=43200000,Tj=3600000,_j=300000,rj=600000;function Xr(E){return typeof E==="string"?E:void 0}function tj(E){if(typeof E!=="string")return{};try{return JSON.parse(E)}catch{return{}}}function J9(E){let T=E.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(T))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return T}function D$(E){if(E===void 0||!E.trim())return;let T=E.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(T)||T.length>254)throw Error("A valid email address is required");return T}function z9(E){let T=E.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(T))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return T}function F9(E){let T=new URL(E.trim());if(T.search||T.hash||T.username||T.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(T.protocol!=="https:"&&!(T.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(T.hostname)))throw Error("OIDC issuer must use HTTPS");return T.href.replace(/\/$/,"")}function j9(E){let T=[...new Set(E.map((_)=>_.trim().toLowerCase()).filter(Boolean))];if(T.length===0)throw Error("At least one explicit OIDC email domain is required");if(T.some((_)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(_)||!_.includes(".")||_.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return T}function y9(E){let T=[...new Set(["openid",...E??["email","profile"]].map((_)=>_.trim()).filter(Boolean))];if(T.some((_)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(_)))throw Error("OIDC scopes contain unsupported characters");return T}function St(E){return oF("sha256").update(E).digest("hex")}function qA(E){return{id:String(E.id),actorId:String(E.actor_id),username:String(E.username),email:Xr(E.email),emailVerifiedAt:Xr(E.email_verified_at),passwordHash:String(E.password_hash),credentialVersion:Number(E.credential_version),requiresPasswordUpgrade:Number(E.requires_password_upgrade)===1,disabledAt:Xr(E.disabled_at),lastLoginAt:Xr(E.last_login_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function aF(E,T){let _=Xr(E.consumed_at),r=String(E.expires_at);return{id:String(E.id),identityId:String(E.identity_id),type:String(E.type),metadata:tj(E.metadata),expiresAt:r,consumedAt:_,createdAt:String(E.created_at),state:_?"consumed":r<=T?"expired":"pending"}}function $$(E,T){let _=Xr(E.revoked_at),r=String(E.idle_expires_at),t=String(E.absolute_expires_at);return{id:String(E.id),identityId:String(E.identity_id),credentialVersion:Number(E.credential_version),authMethod:String(E.auth_method),userAgent:Xr(E.user_agent),networkHint:Xr(E.network_hint),createdAt:String(E.created_at),lastUsedAt:String(E.last_used_at),idleExpiresAt:r,absoluteExpiresAt:t,recentAuthAt:String(E.recent_auth_at),mfaAt:Xr(E.mfa_at),revokedAt:_,state:_?"revoked":r<=T||t<=T?"expired":"active"}}function mF(E){let T=Xr(E.verified_at),_=Xr(E.disabled_at);return{id:String(E.id),identityId:String(E.identity_id),type:"totp",label:String(E.label),createdAt:String(E.created_at),verifiedAt:T,disabledAt:_,state:_?"disabled":T?"active":"pending"}}function I$(E,T){let _=Xr(E.consumed_at),r=String(E.expires_at),t=Number(E.attempts);return{id:String(E.id),identityId:String(E.identity_id),purpose:String(E.purpose),attempts:t,expiresAt:r,consumedAt:_,createdAt:String(E.created_at),state:_?"consumed":t>=5?"locked":r<=T?"expired":"pending"}}function sF(E){let T=tj(E);return Array.isArray(T)?T.filter((_)=>typeof _==="string"):[]}function kO(E){return{id:String(E.id),organizationId:String(E.organization_id),slug:String(E.slug),name:String(E.name),issuer:String(E.issuer),clientId:String(E.client_id),hasClientSecret:typeof E.client_secret_ciphertext==="string"&&E.client_secret_ciphertext.length>0,scopes:sF(E.scopes),allowedDomains:sF(E.allowed_domains),defaultRole:String(E.default_role),enabled:Number(E.enabled)===1,enforceSso:Number(E.enforce_sso)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function pF(E,T){let _=Xr(E.consumed_at),r=String(E.expires_at);return{id:String(E.id),providerId:String(E.provider_id),redirectUri:String(E.redirect_uri),returnPath:String(E.return_path),expiresAt:r,consumedAt:_,createdAt:String(E.created_at),state:_?"consumed":r<=T?"expired":"pending"}}function B9(E){return{id:String(E.id),providerId:String(E.provider_id),identityId:String(E.identity_id),subject:String(E.subject),email:String(E.email),linkedAt:String(E.linked_at),lastLoginAt:String(E.last_login_at)}}class Nt{controlPlane;nowFn;idFn;encryptionKey;constructor(E,T={}){this.controlPlane=E;this.nowFn=T.now??(()=>new Date),this.idFn=T.id??(()=>crypto.randomUUID()),this.encryptionKey=T.encryptionKey?oF("sha256").update(T.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(E,T){this.controlPlane.database.run(E,T)}encrypt(E){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let T=Ld(12),_=C9("aes-256-gcm",this.encryptionKey,T),r=Buffer.concat([_.update(E,"utf8"),_.final()]);return`v1.${T.toString("base64url")}.${_.getAuthTag().toString("base64url")}.${r.toString("base64url")}`}decrypt(E){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[T,_,r,t]=E.split(".");if(T!=="v1"||!_||!r||!t)throw Error("Encrypted authentication value is unavailable");let d=X9("aes-256-gcm",this.encryptionKey,Buffer.from(_,"base64url"));return d.setAuthTag(Buffer.from(r,"base64url")),Buffer.concat([d.update(Buffer.from(t,"base64url")),d.final()]).toString("utf8")}createIdentity(E){if(!this.controlPlane.getActor(E.actorId))throw Error("Authentication actor was not found");let T=J9(E.username),_=D$(E.email),r=E.id??this.idFn(),t=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,E.actorId,T,_??null,E.emailVerified&&_?t:null,E.passwordHash,E.requiresPasswordUpgrade?1:0,t,t]),this.getIdentity(r)}getIdentity(E){let T=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE id = ?").get(E);return T?qA(T):void 0}getIdentityByActor(E){let T=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE actor_id = ?").get(E);return T?qA(T):void 0}getIdentityByUsername(E){let T=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE username = ? COLLATE NOCASE").get(E.trim());return T?qA(T):void 0}getIdentityByEmail(E){let T=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE email = ? COLLATE NOCASE").get(E.trim().toLowerCase());return T?qA(T):void 0}listIdentities(){return this.controlPlane.database.query("SELECT * FROM auth_identities ORDER BY username COLLATE NOCASE").all().map(qA)}updatePassword(E,T,_={}){if(!this.getIdentity(E))throw Error("Authentication identity was not found");let t=this.now();return this.controlPlane.transaction(()=>{if(this.run(`UPDATE auth_identities SET password_hash = ?, credential_version = credential_version + 1,
         requires_password_upgrade = ?, updated_at = ? WHERE id = ?`,[T,_.requiresUpgrade?1:0,t,E]),_.revokeSessions!==!1)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[t,E])}),this.getIdentity(E)}rehashPassword(E,T){let _=this.now();this.run("UPDATE auth_identities SET password_hash = ?, requires_password_upgrade = 0, updated_at = ? WHERE id = ?",[T,_,E]);let r=this.getIdentity(E);if(!r)throw Error("Authentication identity was not found");return r}setVerifiedEmail(E,T){let _=D$(T),r=this.now();this.run("UPDATE auth_identities SET email = ?, email_verified_at = ?, updated_at = ? WHERE id = ?",[_,r,r,E]);let t=this.getIdentity(E);if(!t)throw Error("Authentication identity was not found");return t}recordLogin(E){let T=this.now();this.run("UPDATE auth_identities SET last_login_at = ?, updated_at = ? WHERE id = ?",[T,T,E]);let _=this.getIdentity(E);if(!_)throw Error("Authentication identity was not found");return _}setDisabled(E,T){let _=this.now();this.controlPlane.transaction(()=>{if(this.run("UPDATE auth_identities SET disabled_at = ?, credential_version = credential_version + 1, updated_at = ? WHERE id = ?",[T?_:null,_,E]),T)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[_,E])});let r=this.getIdentity(E);if(!r)throw Error("Authentication identity was not found");return r}createActionToken(E,T,_={}){if(!this.getIdentity(E))throw Error("Authentication identity was not found");let r=Ld(32).toString("base64url"),t=this.idFn(),d=this.now(),R=new Date(this.nowFn().getTime()+Math.min(86400000,Math.max(60000,_.ttlMs??Tj))).toISOString();return this.run("INSERT INTO auth_action_tokens (id, identity_id, type, token_hash, metadata, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[t,E,T,St(r),JSON.stringify(_.metadata??{}),R,d]),{actionToken:this.getActionToken(t),token:r}}getActionToken(E){let T=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE id = ?").get(E);return T?aF(T,this.now()):void 0}consumeActionToken(E,T){return this.controlPlane.transaction(()=>{let _=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE token_hash = ? AND type = ?").get(St(E),T);if(!_)throw Error("Action token is invalid");let r=aF(_,this.now());if(r.state!=="pending")throw Error(`Action token is ${r.state}`);if(this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),r.id,this.now()]).changes!==1)throw Error("Action token is no longer available");return this.getActionToken(r.id)})}revokeActionTokens(E,T){return this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE identity_id = ? AND type = ? AND consumed_at IS NULL",[this.now(),E,T]).changes}createSession(E){let T=this.getIdentity(E.identityId);if(!T||T.disabledAt)throw Error("Authentication identity is unavailable");let _=this.idFn(),r=Ld(32).toString("base64url"),t=`v2.${_}.${r}`,d=this.now(),R=Math.min(86400000,Math.max(60000,E.idleTtlMs??Ej)),h=Math.min(2592000000,Math.max(R,E.absoluteTtlMs??$R));return this.run(`INSERT INTO auth_sessions (id, identity_id, token_hash, credential_version, auth_method, user_agent, network_hint,
       created_at, last_used_at, idle_expires_at, absolute_expires_at, recent_auth_at, mfa_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[_,T.id,St(t),T.credentialVersion,E.authMethod??"local",E.userAgent?.slice(0,256)??null,E.networkHint?.slice(0,128)??null,d,d,new Date(this.nowFn().getTime()+R).toISOString(),new Date(this.nowFn().getTime()+h).toISOString(),E.recentAuthAt??d,E.mfaAt??null]),{session:this.getSession(_),token:t}}getSession(E){let T=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE id = ?").get(E);return T?$$(T,this.now()):void 0}verifySessionToken(E){let T=/^v2\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(E);if(!T)return;let _=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE id = ? AND token_hash = ?").get(T[1],St(E));if(!_)return;let r=$$(_,this.now()),t=this.getIdentity(r.identityId);if(!t||t.disabledAt||r.state!=="active"||r.credentialVersion!==t.credentialVersion)return;let d=this.now(),R=new Date(_.idle_expires_at).getTime()-new Date(_.last_used_at).getTime();return this.run("UPDATE auth_sessions SET last_used_at = ?, idle_expires_at = ? WHERE id = ?",[d,new Date(Math.min(this.nowFn().getTime()+R,new Date(r.absoluteExpiresAt).getTime())).toISOString(),r.id]),{identity:t,session:this.getSession(r.id)}}listSessions(E,T={}){let _=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE identity_id = ? ORDER BY last_used_at DESC").all(E).map((r)=>$$(r,this.now()));return T.includeInactive?_:_.filter((r)=>r.state==="active")}revokeSession(E,T){return this.controlPlane.database.run("UPDATE auth_sessions SET revoked_at = ? WHERE id = ? AND identity_id = ? AND revoked_at IS NULL",[this.now(),T,E]).changes===1}revokeOtherSessions(E,T){return this.controlPlane.database.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND id != ? AND revoked_at IS NULL",[this.now(),E,T]).changes}getMfaFactor(E){let T=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ?").get(E);return T?mF(T):void 0}beginTotpEnrollment(E,T={}){let _=this.getIdentity(E);if(!_)throw Error("Authentication identity was not found");let r=this.getMfaFactor(E);if(r?.state==="active")throw Error("MFA is already enabled");let t=xO(Ld(20)),d=T.label?.trim().slice(0,80)||_.email||_.username,R=r?.id??this.idFn(),h=this.now();return this.controlPlane.transaction(()=>{if(r)this.run("UPDATE auth_mfa_factors SET label = ?, secret_ciphertext = ?, created_at = ?, verified_at = NULL, disabled_at = NULL WHERE id = ?",[d,this.encrypt(t),h,R]);else this.run("INSERT INTO auth_mfa_factors (id, identity_id, label, secret_ciphertext, created_at) VALUES (?, ?, ?, ?, ?)",[R,E,d,this.encrypt(t),h]);this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[E])}),{factor:this.getMfaFactor(E),secret:t,uri:U$({secret:t,account:d,issuer:T.issuer})}}verifyTotpEnrollment(E,T){let _=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ?").get(E);if(!_||mF(_).state!=="pending")throw Error("MFA enrollment is not pending");let r=bO(this.decrypt(String(_.secret_ciphertext)),T,this.nowFn().getTime());if(r===void 0)throw Error("Authenticator code is invalid");let t=Array.from({length:10},()=>{let R=xO(Ld(8)).slice(0,12);return`${R.slice(0,4)}-${R.slice(4,8)}-${R.slice(8)}`}),d=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_factors SET verified_at = ?, disabled_at = NULL, last_used_step = ? WHERE identity_id = ?",[d,r,E]),this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[E]);for(let R of t)this.run("INSERT INTO auth_recovery_codes (id, identity_id, code_hash, created_at) VALUES (?, ?, ?, ?)",[this.idFn(),E,St(`${E}:${R.replace(/-/g,"").toUpperCase()}`),d])}),{factor:this.getMfaFactor(E),recoveryCodes:t}}verifyMfaCode(E,T,_={}){let r=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ? AND verified_at IS NOT NULL AND disabled_at IS NULL").get(E);if(!r)return{valid:!1};let t=bO(this.decrypt(String(r.secret_ciphertext)),T,this.nowFn().getTime());if(t!==void 0){if(this.controlPlane.database.run("UPDATE auth_mfa_factors SET last_used_step = ? WHERE identity_id = ? AND (last_used_step IS NULL OR last_used_step < ?)",[t,E,t]).changes===1)return{valid:!0,method:"totp"}}let d=T.replace(/[-\s]/g,"").toUpperCase();if(!/^[A-Z2-7]{12}$/.test(d))return{valid:!1};let R=St(`${E}:${d}`),h=this.controlPlane.database.query("SELECT * FROM auth_recovery_codes WHERE identity_id = ? AND code_hash = ? AND consumed_at IS NULL").get(E,R);if(!h)return{valid:!1};if(_.consumeRecovery!==!1){if(this.controlPlane.database.run("UPDATE auth_recovery_codes SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL",[this.now(),String(h.id)]).changes!==1)return{valid:!1}}return{valid:!0,method:"recovery"}}remainingRecoveryCodes(E){return Number(this.controlPlane.database.query("SELECT COUNT(*) AS count FROM auth_recovery_codes WHERE identity_id = ? AND consumed_at IS NULL").get(E)?.count??0)}disableMfa(E){let T=this.now();this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_factors SET disabled_at = ? WHERE identity_id = ? AND disabled_at IS NULL",[T,E]),this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[E]),this.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE identity_id = ? AND consumed_at IS NULL",[T,E])})}createMfaChallenge(E,T){if(this.getMfaFactor(E)?.state!=="active")throw Error("MFA is not enabled");let _=Ld(32).toString("base64url"),r=this.idFn(),t=this.now(),d=new Date(this.nowFn().getTime()+_j).toISOString();return this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE identity_id = ? AND purpose = ? AND consumed_at IS NULL",[t,E,T]),this.run("INSERT INTO auth_mfa_challenges (id, identity_id, purpose, token_hash, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?)",[r,E,T,St(_),d,t])}),{challenge:this.getMfaChallenge(r),token:_}}getMfaChallenge(E){let T=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE id = ?").get(E);return T?I$(T,this.now()):void 0}inspectMfaChallengeToken(E,T){let _=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE token_hash = ? AND purpose = ?").get(St(E),T);return _?I$(_,this.now()):void 0}completeMfaChallenge(E,T,_){let r=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE token_hash = ? AND purpose = ?").get(St(E),_);if(!r)throw Error("MFA challenge is invalid");let t=I$(r,this.now());if(t.state!=="pending")throw Error(`MFA challenge is ${t.state}`);let d=this.verifyMfaCode(t.identityId,T);if(!d.valid||!d.method)throw this.run("UPDATE auth_mfa_challenges SET attempts = attempts + 1 WHERE id = ?",[t.id]),Error("Authenticator or recovery code is invalid");if(this.controlPlane.database.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND attempts < 5 AND expires_at > ?",[this.now(),t.id,this.now()]).changes!==1)throw Error("MFA challenge is no longer available");return{identity:this.getIdentity(t.identityId),challenge:this.getMfaChallenge(t.id),method:d.method}}markSessionStepUp(E,T=!1){let _=this.now();this.run("UPDATE auth_sessions SET recent_auth_at = ?, mfa_at = CASE WHEN ? = 1 THEN ? ELSE mfa_at END WHERE id = ? AND revoked_at IS NULL",[_,T?1:0,_,E]);let r=this.getSession(E);if(!r)throw Error("Authentication session was not found");return r}isRecentlyAuthenticated(E,T=600000){return this.nowFn().getTime()-new Date(E.recentAuthAt).getTime()<=T}upsertOidcProvider(E){if(!this.controlPlane.getOrganization(E.organizationId))throw Error("OIDC provider organization was not found");let T=z8(E.slug),_=E.name.trim().slice(0,80);if(!_)throw Error("OIDC provider name is required");let r=F8(E.issuer),t=E.clientId.trim();if(!t||t.length>512)throw Error("OIDC client ID is required");let d=y8(E.scopes),R=j8(E.allowedDomains),h=E.id?this.getOidcProvider(E.id):this.getOidcProviderBySlug(T),S=this.now();if(h){if(h.organizationId!==E.organizationId)throw Error("OIDC provider belongs to another organization");return this.run(`UPDATE auth_oidc_providers SET slug = ?, name = ?, issuer = ?, client_id = ?,
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[_,T.id,St(t),T.credentialVersion,E.authMethod??"local",E.userAgent?.slice(0,256)??null,E.networkHint?.slice(0,128)??null,d,d,new Date(this.nowFn().getTime()+R).toISOString(),new Date(this.nowFn().getTime()+h).toISOString(),E.recentAuthAt??d,E.mfaAt??null]),{session:this.getSession(_),token:t}}getSession(E){let T=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE id = ?").get(E);return T?$$(T,this.now()):void 0}verifySessionToken(E){let T=/^v2\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(E);if(!T)return;let _=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE id = ? AND token_hash = ?").get(T[1],St(E));if(!_)return;let r=$$(_,this.now()),t=this.getIdentity(r.identityId);if(!t||t.disabledAt||r.state!=="active"||r.credentialVersion!==t.credentialVersion)return;let d=this.now(),R=new Date(_.idle_expires_at).getTime()-new Date(_.last_used_at).getTime();return this.run("UPDATE auth_sessions SET last_used_at = ?, idle_expires_at = ? WHERE id = ?",[d,new Date(Math.min(this.nowFn().getTime()+R,new Date(r.absoluteExpiresAt).getTime())).toISOString(),r.id]),{identity:t,session:this.getSession(r.id)}}listSessions(E,T={}){let _=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE identity_id = ? ORDER BY last_used_at DESC").all(E).map((r)=>$$(r,this.now()));return T.includeInactive?_:_.filter((r)=>r.state==="active")}revokeSession(E,T){return this.controlPlane.database.run("UPDATE auth_sessions SET revoked_at = ? WHERE id = ? AND identity_id = ? AND revoked_at IS NULL",[this.now(),T,E]).changes===1}revokeOtherSessions(E,T){return this.controlPlane.database.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND id != ? AND revoked_at IS NULL",[this.now(),E,T]).changes}getMfaFactor(E){let T=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ?").get(E);return T?mF(T):void 0}beginTotpEnrollment(E,T={}){let _=this.getIdentity(E);if(!_)throw Error("Authentication identity was not found");let r=this.getMfaFactor(E);if(r?.state==="active")throw Error("MFA is already enabled");let t=xO(Ld(20)),d=T.label?.trim().slice(0,80)||_.email||_.username,R=r?.id??this.idFn(),h=this.now();return this.controlPlane.transaction(()=>{if(r)this.run("UPDATE auth_mfa_factors SET label = ?, secret_ciphertext = ?, created_at = ?, verified_at = NULL, disabled_at = NULL WHERE id = ?",[d,this.encrypt(t),h,R]);else this.run("INSERT INTO auth_mfa_factors (id, identity_id, label, secret_ciphertext, created_at) VALUES (?, ?, ?, ?, ?)",[R,E,d,this.encrypt(t),h]);this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[E])}),{factor:this.getMfaFactor(E),secret:t,uri:U$({secret:t,account:d,issuer:T.issuer})}}verifyTotpEnrollment(E,T){let _=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ?").get(E);if(!_||mF(_).state!=="pending")throw Error("MFA enrollment is not pending");let r=bO(this.decrypt(String(_.secret_ciphertext)),T,this.nowFn().getTime());if(r===void 0)throw Error("Authenticator code is invalid");let t=Array.from({length:10},()=>{let R=xO(Ld(8)).slice(0,12);return`${R.slice(0,4)}-${R.slice(4,8)}-${R.slice(8)}`}),d=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_factors SET verified_at = ?, disabled_at = NULL, last_used_step = ? WHERE identity_id = ?",[d,r,E]),this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[E]);for(let R of t)this.run("INSERT INTO auth_recovery_codes (id, identity_id, code_hash, created_at) VALUES (?, ?, ?, ?)",[this.idFn(),E,St(`${E}:${R.replace(/-/g,"").toUpperCase()}`),d])}),{factor:this.getMfaFactor(E),recoveryCodes:t}}verifyMfaCode(E,T,_={}){let r=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ? AND verified_at IS NOT NULL AND disabled_at IS NULL").get(E);if(!r)return{valid:!1};let t=bO(this.decrypt(String(r.secret_ciphertext)),T,this.nowFn().getTime());if(t!==void 0){if(this.controlPlane.database.run("UPDATE auth_mfa_factors SET last_used_step = ? WHERE identity_id = ? AND (last_used_step IS NULL OR last_used_step < ?)",[t,E,t]).changes===1)return{valid:!0,method:"totp"}}let d=T.replace(/[-\s]/g,"").toUpperCase();if(!/^[A-Z2-7]{12}$/.test(d))return{valid:!1};let R=St(`${E}:${d}`),h=this.controlPlane.database.query("SELECT * FROM auth_recovery_codes WHERE identity_id = ? AND code_hash = ? AND consumed_at IS NULL").get(E,R);if(!h)return{valid:!1};if(_.consumeRecovery!==!1){if(this.controlPlane.database.run("UPDATE auth_recovery_codes SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL",[this.now(),String(h.id)]).changes!==1)return{valid:!1}}return{valid:!0,method:"recovery"}}remainingRecoveryCodes(E){return Number(this.controlPlane.database.query("SELECT COUNT(*) AS count FROM auth_recovery_codes WHERE identity_id = ? AND consumed_at IS NULL").get(E)?.count??0)}disableMfa(E){let T=this.now();this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_factors SET disabled_at = ? WHERE identity_id = ? AND disabled_at IS NULL",[T,E]),this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[E]),this.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE identity_id = ? AND consumed_at IS NULL",[T,E])})}createMfaChallenge(E,T){if(this.getMfaFactor(E)?.state!=="active")throw Error("MFA is not enabled");let _=Ld(32).toString("base64url"),r=this.idFn(),t=this.now(),d=new Date(this.nowFn().getTime()+_j).toISOString();return this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE identity_id = ? AND purpose = ? AND consumed_at IS NULL",[t,E,T]),this.run("INSERT INTO auth_mfa_challenges (id, identity_id, purpose, token_hash, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?)",[r,E,T,St(_),d,t])}),{challenge:this.getMfaChallenge(r),token:_}}getMfaChallenge(E){let T=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE id = ?").get(E);return T?I$(T,this.now()):void 0}inspectMfaChallengeToken(E,T){let _=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE token_hash = ? AND purpose = ?").get(St(E),T);return _?I$(_,this.now()):void 0}completeMfaChallenge(E,T,_){let r=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE token_hash = ? AND purpose = ?").get(St(E),_);if(!r)throw Error("MFA challenge is invalid");let t=I$(r,this.now());if(t.state!=="pending")throw Error(`MFA challenge is ${t.state}`);let d=this.verifyMfaCode(t.identityId,T);if(!d.valid||!d.method)throw this.run("UPDATE auth_mfa_challenges SET attempts = attempts + 1 WHERE id = ?",[t.id]),Error("Authenticator or recovery code is invalid");if(this.controlPlane.database.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND attempts < 5 AND expires_at > ?",[this.now(),t.id,this.now()]).changes!==1)throw Error("MFA challenge is no longer available");return{identity:this.getIdentity(t.identityId),challenge:this.getMfaChallenge(t.id),method:d.method}}markSessionStepUp(E,T=!1){let _=this.now();this.run("UPDATE auth_sessions SET recent_auth_at = ?, mfa_at = CASE WHEN ? = 1 THEN ? ELSE mfa_at END WHERE id = ? AND revoked_at IS NULL",[_,T?1:0,_,E]);let r=this.getSession(E);if(!r)throw Error("Authentication session was not found");return r}isRecentlyAuthenticated(E,T=600000){return this.nowFn().getTime()-new Date(E.recentAuthAt).getTime()<=T}upsertOidcProvider(E){if(!this.controlPlane.getOrganization(E.organizationId))throw Error("OIDC provider organization was not found");let T=z9(E.slug),_=E.name.trim().slice(0,80);if(!_)throw Error("OIDC provider name is required");let r=F9(E.issuer),t=E.clientId.trim();if(!t||t.length>512)throw Error("OIDC client ID is required");let d=y9(E.scopes),R=j9(E.allowedDomains),h=E.id?this.getOidcProvider(E.id):this.getOidcProviderBySlug(T),S=this.now();if(h){if(h.organizationId!==E.organizationId)throw Error("OIDC provider belongs to another organization");return this.run(`UPDATE auth_oidc_providers SET slug = ?, name = ?, issuer = ?, client_id = ?,
         client_secret_ciphertext = COALESCE(?, client_secret_ciphertext), scopes = ?, allowed_domains = ?,
         default_role = ?, enabled = ?, enforce_sso = ?, updated_at = ? WHERE id = ?`,[T,_,r,t,E.clientSecret?this.encrypt(E.clientSecret):null,JSON.stringify(d),JSON.stringify(R),E.defaultRole??h.defaultRole,E.enabled??h.enabled?1:0,E.enforceSso??h.enforceSso?1:0,S,h.id]),this.getOidcProvider(h.id)}if(!E.clientSecret)throw Error("OIDC client secret is required for a new provider");let N=E.id??this.idFn();return this.run(`INSERT INTO auth_oidc_providers (id, organization_id, slug, name, issuer, client_id,
       client_secret_ciphertext, scopes, allowed_domains, default_role, enabled, enforce_sso, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[N,E.organizationId,T,_,r,t,this.encrypt(E.clientSecret),JSON.stringify(d),JSON.stringify(R),E.defaultRole??"viewer",E.enabled===!1?0:1,E.enforceSso?1:0,S,S]),this.getOidcProvider(N)}getOidcProvider(E){let T=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(E);return T?kO(T):void 0}getOidcProviderBySlug(E){let T=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE slug = ? COLLATE NOCASE").get(E.trim());return T?kO(T):void 0}listOidcProviders(E,T={}){return(E?this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(E):this.controlPlane.database.query("SELECT * FROM auth_oidc_providers ORDER BY name COLLATE NOCASE").all()).map(kO).filter((r)=>T.includeDisabled||r.enabled)}setOidcProviderEnabled(E,T){let _=this.now();if(this.controlPlane.database.run("UPDATE auth_oidc_providers SET enabled = ?, enforce_sso = CASE WHEN ? = 0 THEN 0 ELSE enforce_sso END, updated_at = ? WHERE id = ?",[T?1:0,T?1:0,_,E]).changes!==1)throw Error("OIDC provider was not found");if(!T)this.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE provider_id = ? AND consumed_at IS NULL",[_,E]);return this.getOidcProvider(E)}getOidcProviderCredentials(E){let T=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(E);if(!T||typeof T.client_secret_ciphertext!=="string")throw Error("OIDC provider credentials are unavailable");return{provider:kO(T),clientSecret:this.decrypt(T.client_secret_ciphertext)}}beginOidcTransaction(E,T,_){if(!this.getOidcProvider(E)?.enabled)throw Error("OIDC provider is unavailable");let t=this.idFn(),d=Ld(32).toString("base64url"),R=Ld(32).toString("base64url"),h=Ld(64).toString("base64url"),S=this.now(),N=new Date(this.nowFn().getTime()+rj).toISOString();return this.run(`INSERT INTO auth_oidc_transactions (id, provider_id, state_hash, nonce_ciphertext, verifier_ciphertext,
-      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,E,St(d),this.encrypt(R),this.encrypt(h),T,_,N,S]),{transaction:this.getOidcTransaction(t),state:d,nonce:R,verifier:h}}getOidcTransaction(E){let T=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(E);return T?pF(T,this.now()):void 0}consumeOidcTransaction(E,T){return this.controlPlane.transaction(()=>{let _=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(E,St(T));if(!_)throw Error("OIDC transaction is invalid");let r=pF(_,this.now());if(r.state!=="pending")throw Error(`OIDC transaction is ${r.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),r.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(r.id),nonce:this.decrypt(String(_.nonce_ciphertext)),verifier:this.decrypt(String(_.verifier_ciphertext))}})}getOidcSubject(E,T){let _=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(E,T);return _?B8(_):void 0}linkOidcSubject(E,T,_,r){let t=this.getOidcProvider(E),d=this.getIdentity(T);if(!t||!d)throw Error("OIDC provider or identity was not found");let R=D$(r);if(!_.trim()||_.length>512)throw Error("OIDC subject is invalid");let h=this.getOidcSubject(E,_);if(h&&h.identityId!==T)throw Error("OIDC subject is already linked to another identity");let S=this.now();if(h)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[R,S,h.id]),this.getOidcSubject(E,_);let N=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[N,E,T,_,R,S,S]),this.getOidcSubject(E,_)}purgeExpired(){let E=this.now(),T=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[E]).changes,_=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[E,E]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[E]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[E]),{actionTokens:T,sessions:_}}}async function kA(E,T){let _=E.notifications?.email?.from;if(!_)return!1;try{let{EmailClient:r}=await Promise.resolve().then(() => (VS(),bA));return await new r({region:E.project.region,defaultFrom:_}).send(T),!0}catch{return!1}}await aE();import{randomBytes as VZ}from"node:crypto";import{chmodSync as KZ,existsSync as ZZ,mkdirSync as gZ,readFileSync as qZ,writeFileSync as xZ}from"node:fs";import{dirname as bZ}from"node:path";function VT(E){let T=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(T)return T;let _=fT(E,"auth-encryption-key");try{if(ZZ(_)){let t=qZ(_,"utf8").trim();if(t)return t}}catch{}let r=VZ(32).toString("base64url");try{gZ(bZ(_),{recursive:!0,mode:448}),xZ(_,`${r}
+      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,E,St(d),this.encrypt(R),this.encrypt(h),T,_,N,S]),{transaction:this.getOidcTransaction(t),state:d,nonce:R,verifier:h}}getOidcTransaction(E){let T=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(E);return T?pF(T,this.now()):void 0}consumeOidcTransaction(E,T){return this.controlPlane.transaction(()=>{let _=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(E,St(T));if(!_)throw Error("OIDC transaction is invalid");let r=pF(_,this.now());if(r.state!=="pending")throw Error(`OIDC transaction is ${r.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),r.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(r.id),nonce:this.decrypt(String(_.nonce_ciphertext)),verifier:this.decrypt(String(_.verifier_ciphertext))}})}getOidcSubject(E,T){let _=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(E,T);return _?B9(_):void 0}linkOidcSubject(E,T,_,r){let t=this.getOidcProvider(E),d=this.getIdentity(T);if(!t||!d)throw Error("OIDC provider or identity was not found");let R=D$(r);if(!_.trim()||_.length>512)throw Error("OIDC subject is invalid");let h=this.getOidcSubject(E,_);if(h&&h.identityId!==T)throw Error("OIDC subject is already linked to another identity");let S=this.now();if(h)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[R,S,h.id]),this.getOidcSubject(E,_);let N=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[N,E,T,_,R,S,S]),this.getOidcSubject(E,_)}purgeExpired(){let E=this.now(),T=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[E]).changes,_=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[E,E]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[E]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[E]),{actionTokens:T,sessions:_}}}async function kA(E,T){let _=E.notifications?.email?.from;if(!_)return!1;try{let{EmailClient:r}=await Promise.resolve().then(() => (VS(),bA));return await new r({region:E.project.region,defaultFrom:_}).send(T),!0}catch{return!1}}await aE();import{randomBytes as VZ}from"node:crypto";import{chmodSync as KZ,existsSync as ZZ,mkdirSync as gZ,readFileSync as qZ,writeFileSync as xZ}from"node:fs";import{dirname as bZ}from"node:path";function VT(E){let T=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(T)return T;let _=fT(E,"auth-encryption-key");try{if(ZZ(_)){let t=qZ(_,"utf8").trim();if(t)return t}}catch{}let r=VZ(32).toString("base64url");try{gZ(bZ(_),{recursive:!0,mode:448}),xZ(_,`${r}
 `,{mode:384}),KZ(_,384)}catch{}return r}import{constants as hB,createHash as WI,createPublicKey as kZ,createVerify as uZ,timingSafeEqual as nZ}from"node:crypto";var NB=new Set(["RS256","PS256","ES256"]),SB=60;function Cc(E,T){let _=new URL(E),r=["127.0.0.1","::1","localhost"].includes(_.hostname);if(_.protocol!=="https:"&&!(_.protocol==="http:"&&r))throw Error(`${T} must use HTTPS`);if(_.username||_.password||_.hash)throw Error(`${T} contains unsupported URL components`);return _}function HI(E,T){if(!E||typeof E!=="object"||Array.isArray(E))throw Error(`${T} is invalid`);return E}async function YI(E,T){if(!E.ok)throw Error(`${T} failed with HTTP ${E.status}`);if(!(E.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${T} returned an unsupported content type`);if(Number(E.headers.get("content-length")??0)>1048576)throw Error(`${T} response is too large`);let t=await E.text();if(t.length>1048576)throw Error(`${T} response is too large`);try{return HI(JSON.parse(t),T)}catch(d){if(d instanceof Error&&d.message===`${T} is invalid`)throw d;throw Error(`${T} returned invalid JSON`)}}function vZ(E,T){let _=WI("sha256").update(E).digest(),r=WI("sha256").update(T).digest();return nZ(_,r)}function AB(E){if(!E)return"/";let T=E.trim();if(!T.startsWith("/")||T.startsWith("//")||T.includes("\\")||/[\r\n]/.test(T))return"/";try{let _=new URL(T,"https://local.invalid");return _.origin==="https://local.invalid"?`${_.pathname}${_.search}${_.hash}`:"/"}catch{return"/"}}async function eL(E,T=fetch){let _=Cc(E.issuer,"OIDC issuer"),r=new URL(`${_.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,_.origin),t=await YI(await T(r,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(t.issuer!==E.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let R of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof t[R]!=="string")throw Error(`OIDC discovery is missing ${R}`);Cc(t[R],`OIDC ${R}`)}if(Array.isArray(t.response_types_supported)&&!t.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(t.code_challenge_methods_supported)&&!t.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let d=Array.isArray(t.id_token_signing_alg_values_supported)?t.id_token_signing_alg_values_supported.filter((R)=>typeof R==="string"):[];if(d.length>0&&!d.some((R)=>NB.has(R)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return t}async function fI(E,T,_,r,t=fetch){let d=E.getOidcProviderBySlug(T);if(!d?.enabled)throw Error("OIDC provider is unavailable");let R=Cc(_,"Application origin").origin,h=await eL(d,t),S=`${R}/auth/oidc/${encodeURIComponent(d.slug)}/callback`,N=E.beginOidcTransaction(d.id,S,AB(r)),A=new URL(h.authorization_endpoint);return A.searchParams.set("response_type","code"),A.searchParams.set("client_id",d.clientId),A.searchParams.set("redirect_uri",S),A.searchParams.set("scope",d.scopes.join(" ")),A.searchParams.set("state",N.state),A.searchParams.set("nonce",N.nonce),A.searchParams.set("code_challenge",WI("sha256").update(N.verifier).digest("base64url")),A.searchParams.set("code_challenge_method","S256"),{authorizationUrl:A.href,expiresAt:N.transaction.expiresAt}}function lZ(E){if(E.length>32768)throw Error("OIDC ID token is too large");let T=E.split(".");if(T.length!==3||T.some((_)=>!_))throw Error("OIDC ID token is malformed");try{return{header:HI(JSON.parse(Buffer.from(T[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:HI(JSON.parse(Buffer.from(T[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${T[0]}.${T[1]}`,signature:Buffer.from(T[2],"base64url")}}catch(_){if(_ instanceof Error&&_.message.startsWith("OIDC"))throw _;throw Error("OIDC ID token is malformed")}}async function iZ(E,T,_){let r=lZ(E),t=typeof r.header.alg==="string"?r.header.alg:"",d=typeof r.header.kid==="string"?r.header.kid:"";if(!NB.has(t)||!d)throw Error("OIDC ID token uses an unsupported signing key");if(T.id_token_signing_alg_values_supported&&!T.id_token_signing_alg_values_supported.includes(t))throw Error("OIDC ID-token algorithm was not advertised by the provider");let R=await YI(await _(T.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(R.keys))throw Error("OIDC signing-key response is invalid");let h=R.keys.find((L)=>{if(!L||typeof L!=="object"||Array.isArray(L))return!1;let O=L;return O.kid===d&&(!O.alg||O.alg===t)&&(!O.use||O.use==="sig")});if(!h)throw Error("OIDC ID-token signing key was not found");let S=kZ({key:h,format:"jwk"}),N=uZ("SHA256").update(r.signingInput).end();if(!(t==="PS256"?N.verify({key:S,padding:hB.RSA_PKCS1_PSS_PADDING,saltLength:32},r.signature):t==="ES256"?N.verify({key:S,dsaEncoding:"ieee-p1363"},r.signature):N.verify(S,r.signature)))throw Error("OIDC ID-token signature is invalid");return r.claims}function aZ(E,T,_,r){if(E.iss!==T.issuer)throw Error("OIDC ID-token issuer is invalid");let t=typeof E.aud==="string"?[E.aud]:Array.isArray(E.aud)?E.aud.filter((S)=>typeof S==="string"):[];if(!t.includes(T.clientId))throw Error("OIDC ID-token audience is invalid");if((t.length>1||E.azp!==void 0)&&E.azp!==T.clientId)throw Error("OIDC ID-token authorized party is invalid");let d=Math.floor(r.getTime()/1000);if(typeof E.exp!=="number"||E.exp<d-SB)throw Error("OIDC ID token is expired");if(typeof E.iat!=="number"||E.iat>d+SB)throw Error("OIDC ID-token issued-at time is invalid");if(typeof E.nonce!=="string"||!vZ(E.nonce,_))throw Error("OIDC ID-token nonce is invalid");if(typeof E.sub!=="string"||!E.sub||E.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(E.email_verified!==!0||typeof E.email!=="string")throw Error("OIDC provider did not return a verified email address");let R=E.email.trim().toLowerCase();if(R.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(R))throw Error("OIDC provider returned an invalid email address");let h=R.split("@")[1];if(!h||!T.allowedDomains.includes(h))throw Error("OIDC email domain is not allowed for this organization");return{provider:T,subject:E.sub,email:R,name:typeof E.name==="string"?E.name.slice(0,120):void 0,claims:E}}async function GI(E,T,_=fetch){let r=E.getOidcProviderBySlug(T.providerSlug);if(!r?.enabled)throw Error("OIDC provider is unavailable");if(!T.state||T.state.length>512||!T.code||T.code.length>4096)throw Error("OIDC callback is incomplete");let t=Cc(T.origin,"Application origin").origin,d=E.consumeOidcTransaction(r.id,T.state),R=`${t}/auth/oidc/${encodeURIComponent(r.slug)}/callback`;if(d.transaction.redirectUri!==R)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:h}=E.getOidcProviderCredentials(r.id),S=await eL(r,_),N=new URLSearchParams({grant_type:"authorization_code",code:T.code,redirect_uri:d.transaction.redirectUri,code_verifier:d.verifier}),A={accept:"application/json","content-type":"application/x-www-form-urlencoded"},L=S.token_endpoint_auth_methods_supported??["client_secret_basic"];if(L.includes("client_secret_basic")){let U=(I)=>new URLSearchParams({value:I}).toString().slice(6),$=`${U(r.clientId)}:${U(h)}`;A.authorization=`Basic ${Buffer.from($).toString("base64")}`}else if(L.includes("client_secret_post"))N.set("client_id",r.clientId),N.set("client_secret",h);else throw Error("OIDC provider does not support a configured client authentication method");let O=await YI(await _(S.token_endpoint,{method:"POST",headers:A,body:N,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof O.id_token!=="string")throw Error("OIDC token response did not include an ID token");let c=await iZ(O.id_token,S,_);return{identity:aZ(c,r,d.nonce,T.now??new Date),returnPath:d.transaction.returnPath}}Bh();UL();await CL();await d_();import{createHash as Eq}from"node:crypto";class XL extends Error{constructor(){super("Operation cancellation was requested")}}class fc extends Error{timeoutSeconds;constructor(E){super(`Operation exceeded its ${E}s timeout`);this.timeoutSeconds=E}}class et extends Error{errorClass;constructor(E,T){super(E);this.errorClass=T}}await d_();var Gc={project:2,environment:1,provider:2,builds:1},Ug=30,BB=16384,Dg=["succeeded","failed","cancelled","timed_out"],Tw=new Map,PB=new WeakMap;function WB(E){if(E.path===":memory:"){let r=PB.get(E);if(r)return r;let t=new Set;return PB.set(E,t),t}let T=Tw.get(E.path);if(T)return T;let _=new Set;return Tw.set(E.path,_),_}function Wh(E){return typeof E==="string"&&E?E:void 0}function $g(E){try{let T=JSON.parse(String(E));return Array.isArray(T)?T.map(String):[]}catch{return[]}}function Ig(E){return{operationId:String(E.operation_id),lockKey:Wh(E.lock_key),providerKey:Wh(E.provider_key),buildSlot:Number(E.build_slot)===1,maxAttempts:Number(E.max_attempts),availableAt:String(E.available_at),timeoutSeconds:Number(E.timeout_seconds),heartbeatAt:Wh(E.heartbeat_at),currentStep:Wh(E.current_step),blockedReason:Wh(E.blocked_reason),retryClasses:$g(E.retry_classes),resumePolicy:String(E.resume_policy),cancellationMode:String(E.cancellation_mode),retentionUntil:String(E.retention_until),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function HB(E){return{sequence:Number(E.sequence),id:String(E.id),operationId:String(E.operation_id),stream:String(E.stream),step:Wh(E.step),message:String(E.message),redacted:Number(E.redacted)===1,truncated:Number(E.truncated)===1,createdAt:String(E.created_at)}}function ur(E,T,_){return Number.isFinite(E)?Math.min(_,Math.max(1,Math.floor(E))):T}class lE{controlPlane;nowFn;idFn;workerId;leaseMs;limits;constructor(E,T={}){this.controlPlane=E;this.workerId=T.workerId??`worker:${process.pid}:${crypto.randomUUID()}`,this.leaseMs=ur(T.leaseMs,60000,3600000),this.nowFn=T.now??(()=>new Date),this.idFn=T.id??(()=>crypto.randomUUID());let _=E.getSetting("queue.concurrency");this.limits={project:ur(T.limits?.project??_?.project,Gc.project,100),environment:ur(T.limits?.environment??_?.environment,Gc.environment,100),provider:ur(T.limits?.provider??_?.provider,Gc.provider,100),builds:ur(T.limits?.builds??_?.builds,Gc.builds,100)}}now(){return this.nowFn().toISOString()}leaseExpiry(){return new Date(this.nowFn().getTime()+this.leaseMs).toISOString()}enqueue(E){let T=this.controlPlane.createOperation(E);if(this.getJob(T.id))return this.view(T.id);let r=this.now(),t=ur(E.maxAttempts,1,20),d=ur(E.timeoutSeconds,1800,86400),R=ur(E.retentionDays,Ug,3650),h=E.availableAt?new Date(E.availableAt).toISOString():r,S=new Date(this.nowFn().getTime()+R*24*60*60*1000).toISOString();this.controlPlane.database.run(`INSERT OR IGNORE INTO operation_jobs (operation_id, lock_key, provider_key, build_slot, max_attempts, available_at, timeout_seconds, retry_classes, resume_policy, cancellation_mode, retention_until, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T.id,E.lockKey??E.resourceId??null,E.providerKey??null,E.buildSlot?1:0,t,h,d,JSON.stringify([...new Set(E.retryClasses??[])]),E.resumePolicy??"fail",E.cancellationMode??"cooperative",S,r,r]),this.appendLog(T.id,"Queued for durable execution.",{stream:"system"});let N=this.view(T.id);return this.notifyAvailable(),N}onAvailable(E){let T=WB(this.controlPlane);return T.add(E),()=>{if(T.delete(E),T.size===0&&this.controlPlane.path!==":memory:")Tw.delete(this.controlPlane.path)}}notifyAvailable(){for(let E of WB(this.controlPlane))E()}getJob(E){let T=this.controlPlane.database.query("SELECT * FROM operation_jobs WHERE operation_id=?").get(E);return T?Ig(T):void 0}view(E){let T=this.controlPlane.getOperation(E),_=this.getJob(E);if(!T||!_)return;let r;if(T.state==="queued")r={ahead:Number(this.controlPlane.database.query("SELECT COUNT(*) AS count FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='queued' AND j.available_at<=? AND (o.priority>? OR (o.priority=? AND o.created_at<?))").get(this.now(),T.priority,T.priority,T.createdAt)?.count??0),precision:"bounded"};return{operation:T,job:_,approximatePosition:r}}list(E={}){return this.controlPlane.listOperations({projectId:E.projectId,state:E.state,limit:E.limit??200}).map((T)=>this.view(T.id)).filter((T)=>!!T)}configureConcurrency(E,T={}){let _={project:ur(E.project,this.limits.project,100),environment:ur(E.environment,this.limits.environment,100),provider:ur(E.provider,this.limits.provider,100),builds:ur(E.builds,this.limits.builds,100)};return Object.assign(this.limits,_),this.controlPlane.setSetting("queue.concurrency",_),this.controlPlane.appendEvent({organizationId:T.organizationId,actorId:T.actorId,type:"queue.concurrency.updated",level:"warning",payload:_}),_}runningCount(E,T){return Number(this.controlPlane.database.query(E).get(...T)?.count??0)}blockReason(E,T){if(T.lockKey){if(this.controlPlane.database.query("SELECT * FROM operation_locks WHERE lock_key=? AND operation_id!=? AND lease_expires_at>?").get(T.lockKey,E.id,this.now()))return`resource_lock:${T.lockKey}`}if(E.projectId&&this.runningCount("SELECT COUNT(*) AS count FROM operations WHERE state='running' AND project_id=?",[E.projectId])>=this.limits.project)return"project_concurrency";if(E.environmentId&&this.runningCount("SELECT COUNT(*) AS count FROM operations WHERE state='running' AND environment_id=?",[E.environmentId])>=this.limits.environment)return"environment_concurrency";if(T.providerKey&&this.runningCount("SELECT COUNT(*) AS count FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='running' AND j.provider_key=?",[T.providerKey])>=this.limits.provider)return"provider_concurrency";if(T.buildSlot&&this.runningCount("SELECT COUNT(*) AS count FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='running' AND j.build_slot=1",[])>=this.limits.builds)return"build_concurrency";return}claim(E){return this.controlPlane.transaction(()=>{let T=this.now();this.controlPlane.database.run("DELETE FROM operation_locks WHERE lease_expires_at<=?",[T]);let _=this.controlPlane.getOperation(E),r=_?this.getJob(_.id):void 0;if(!_||!r||_.state!=="queued"||r.availableAt>T)return;if(_.cancelRequestedAt){this.controlPlane.transitionOperation(_.id,{to:"cancelled",expectedVersion:_.version,output:{cancelledBeforeStart:!0}}),this.appendLog(_.id,"Cancelled before execution began.",{stream:"system"});return}let t=this.blockReason(_,r);if(t){this.controlPlane.database.run("UPDATE operation_jobs SET blocked_reason=?, updated_at=? WHERE operation_id=?",[t,T,_.id]);return}let d=this.controlPlane.claimOperation(_.id,this.workerId,this.leaseMs);if(!d)return;let R=d.leaseExpiresAt??this.leaseExpiry();if(r.lockKey)this.controlPlane.database.run("INSERT INTO operation_locks (lock_key, operation_id, lease_owner, lease_expires_at, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)",[r.lockKey,_.id,this.workerId,R,T,T]);return this.controlPlane.database.run("UPDATE operation_jobs SET heartbeat_at=?, blocked_reason=NULL, updated_at=? WHERE operation_id=?",[T,T,_.id]),this.appendLog(_.id,`Claimed by ${this.workerId}; attempt ${d.attempt}.`,{stream:"system"}),this.view(_.id)})}claimNext(E){let T=this.now(),_=E?.length?`AND o.kind IN (${E.map(()=>"?").join(",")})`:"",r=this.controlPlane.database.query(`SELECT o.id FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='queued' AND j.available_at<=? ${_} ORDER BY o.priority DESC, o.created_at ASC, o.rowid ASC LIMIT 100`).all(T,...E??[]);for(let t of r){let d=this.claim(String(t.id));if(d)return d}return}heartbeat(E,T){let _=this.controlPlane.getOperation(E);if(!_||_.state!=="running"||_.leaseOwner!==this.workerId)throw Error("Operation lease is not owned by this worker");let r=this.now(),t=this.leaseExpiry(),d=this.getJob(E);if(this.controlPlane.database.run("UPDATE operations SET lease_expires_at=?, updated_at=?, version=version+1 WHERE id=? AND state='running' AND lease_owner=? AND version=?",[t,r,E,this.workerId,_.version]).changes!==1)throw Error("Operation lease changed before heartbeat");if(this.controlPlane.database.run("UPDATE operation_jobs SET heartbeat_at=?, current_step=COALESCE(?, current_step), updated_at=? WHERE operation_id=?",[r,T??null,r,E]),d?.lockKey)this.controlPlane.database.run("UPDATE operation_locks SET lease_expires_at=?, updated_at=? WHERE lock_key=? AND operation_id=? AND lease_owner=?",[t,r,d.lockKey,E,this.workerId]);if(T&&T!==d?.currentStep)this.controlPlane.appendEvent({projectId:_.projectId,operationId:E,resourceId:_.resourceId,actorId:_.actorId,correlationId:_.correlationId,type:"operation.step",payload:{step:T}})}appendLog(E,T,_={}){if(!this.getJob(E))throw Error(`Queue job ${E} was not found`);let r=T,t=!1;for(let A of _.secrets??[])if(A&&r.includes(A))r=r.split(A).join("[REDACTED]"),t=!0;let d=xE({message:r});if(d.message!==r)t=!0;r=d.message??"[output unavailable]";let R=Buffer.from(r),h=R.byteLength>BB;if(h)r=`${R.subarray(0,BB-32).toString("utf8")}
 [output truncated]`;let S=this.idFn(),N=this.now();return this.controlPlane.database.run("INSERT INTO operation_logs (id, operation_id, stream, step, message, redacted, truncated, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",[S,E,_.stream??"stdout",_.step??null,r,t?1:0,h?1:0,N]),HB(this.controlPlane.database.query("SELECT * FROM operation_logs WHERE id=?").get(S))}logs(E,T={}){let _=Math.min(1000,Math.max(1,T.limit??200));return this.controlPlane.database.query("SELECT * FROM operation_logs WHERE operation_id=? AND sequence>? ORDER BY sequence ASC LIMIT ?").all(E,T.after??0,_).map(HB)}requestCancellation(E,T){let _=this.controlPlane.getOperation(E);if(!_||Dg.includes(_.state))throw Error("Only queued or running operations can be cancelled");let r=this.controlPlane.requestCancellation(E);if(this.controlPlane.appendEvent({projectId:_.projectId,operationId:E,resourceId:_.resourceId,actorId:T,correlationId:_.correlationId,type:"operation.cancellation_requested",level:"warning",payload:{state:_.state}}),this.appendLog(E,_.state==="queued"?"Cancellation accepted before execution.":"Cancellation requested; waiting for the current provider step.",{stream:"system"}),r.state==="queued")return this.finish(E,"cancelled",{cancelledBeforeStart:!0});return r}retry(E,T,_={}){let r=this.controlPlane.getOperation(E),t=this.getJob(E);if(!r||!t||!["failed","cancelled","timed_out"].includes(r.state))throw Error("Only failed, cancelled, or timed-out queue jobs can be retried");if(r.attempt>=t.maxAttempts)throw Error(`Operation reached its ${t.maxAttempts}-attempt limit`);if(!t.retryClasses.includes(T))throw Error(`Retry class ${T} is not allowed for this operation`);let d=this.controlPlane.transitionOperation(E,{to:"queued",expectedVersion:r.version,error:`Retry requested after ${T}`}),R=new Date(this.nowFn().getTime()+Math.max(0,_.delayMs??0)).toISOString();this.controlPlane.database.run("UPDATE operations SET cancel_requested_at=NULL, finished_at=NULL WHERE id=?",[E]),this.controlPlane.database.run("UPDATE operation_jobs SET available_at=?, blocked_reason=NULL, updated_at=? WHERE operation_id=?",[R,this.now(),E]),this.controlPlane.appendEvent({projectId:r.projectId,operationId:E,resourceId:r.resourceId,actorId:_.actorId,correlationId:r.correlationId,type:"operation.retry_requested",payload:{errorClass:T,availableAt:R,nextAttempt:r.attempt+1}}),this.appendLog(E,`Retry queued for error class ${T}.`,{stream:"system"});let h=this.controlPlane.getOperation(d.id);return this.notifyAvailable(),h}release(E){this.controlPlane.database.run("DELETE FROM operation_locks WHERE operation_id=?",[E])}finish(E,T,_={},r){let t=this.controlPlane.getOperation(E);if(!t)throw Error(`Operation ${E} was not found`);let d=this.controlPlane.transitionOperation(E,{to:T,expectedVersion:t.version,output:_,error:r});return this.release(E),d}complete(E,T={}){let _=this.controlPlane.getOperation(E);if(!_||_.state!=="running"||_.leaseOwner!==this.workerId)throw Error("Only the lease owner can complete a running operation");return this.appendLog(E,"Operation completed successfully.",{stream:"system"}),this.finish(E,"succeeded",T)}fail(E,T,_={}){let r=this.controlPlane.getOperation(E);if(!r||r.state!=="running"||r.leaseOwner!==this.workerId)throw Error("Only the lease owner can fail a running operation");return this.appendLog(E,T,{stream:"stderr"}),this.finish(E,"failed",_,T)}async runOne(E){let T=this.claimNext(Object.keys(E));if(!T)return{handled:!1};let{operation:_,job:r}=T,t=E[_.kind];if(!t)return{handled:!1};let d=new AbortController,R=!1,h=setTimeout(()=>{R=!0,d.abort(new fc(r.timeoutSeconds))},r.timeoutSeconds*1000),S=setInterval(()=>{try{this.heartbeat(_.id)}catch{}},Math.max(250,Math.floor(this.leaseMs/3))),N=setInterval(()=>{if(this.controlPlane.getOperation(_.id)?.cancelRequestedAt)d.abort(new XL)},100),A={operation:_,signal:d.signal,log:(L,O)=>this.appendLog(_.id,L,O),checkpoint:(L,O)=>{this.heartbeat(_.id,L),this.appendLog(_.id,O??L,{stream:"step",step:L})},heartbeat:()=>this.heartbeat(_.id),cancellationRequested:()=>!!this.controlPlane.getOperation(_.id)?.cancelRequestedAt,throwIfCancellationRequested:()=>{if(this.controlPlane.getOperation(_.id)?.cancelRequestedAt)throw new XL}};try{let L=await Promise.race([t(A),new Promise((U,$)=>d.signal.addEventListener("abort",()=>$(d.signal.reason),{once:!0}))]);if(this.controlPlane.getOperation(_.id).cancelRequestedAt){let U=r.cancellationMode==="provider_non_cancellable";return this.appendLog(_.id,U?"Provider step completed after cancellation was requested; reconciliation is required.":"Operation cancelled cooperatively.",{stream:"system"}),{handled:!0,operation:this.finish(_.id,"cancelled",{providerCompleted:U,reconciliationRequired:U}),terminalState:"cancelled"}}return{handled:!0,operation:this.complete(_.id,L??{}),terminalState:"succeeded"}}catch(L){if(R||L instanceof fc)return this.appendLog(_.id,`Timed out after ${r.timeoutSeconds}s.`,{stream:"system"}),{handled:!0,operation:this.finish(_.id,"timed_out",{reconciliationRequired:r.cancellationMode==="provider_non_cancellable"},L instanceof Error?L.message:String(L)),terminalState:"timed_out"};if(L instanceof XL||this.controlPlane.getOperation(_.id)?.cancelRequestedAt)return{handled:!0,operation:this.finish(_.id,"cancelled",{cooperativelyCancelled:!0}),terminalState:"cancelled"};if(L instanceof et&&r.retryClasses.includes(L.errorClass)&&_.attempt<r.maxAttempts){let U=this.controlPlane.getOperation(_.id);this.controlPlane.transitionOperation(_.id,{to:"queued",expectedVersion:U.version,error:L.message});let $=Math.min(60000,1000*2**Math.max(0,_.attempt-1)),I=new Date(this.nowFn().getTime()+$).toISOString();return this.controlPlane.database.run("UPDATE operation_jobs SET available_at=?, blocked_reason=?, updated_at=? WHERE operation_id=?",[I,`retry_backoff:${L.errorClass}`,this.now(),_.id]),this.release(_.id),this.appendLog(_.id,`Retryable ${L.errorClass} failure; next attempt is delayed.`,{stream:"system"}),{handled:!0,operation:this.controlPlane.getOperation(_.id),requeued:!0}}let O=L instanceof Error?L.message:String(L);return this.appendLog(_.id,O,{stream:"stderr"}),{handled:!0,operation:this.finish(_.id,"failed",{},O),terminalState:"failed"}}finally{clearTimeout(h),clearInterval(S),clearInterval(N)}}recoverExpired(){let E=this.controlPlane.database.query("SELECT o.id FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state='running' AND (o.lease_expires_at IS NULL OR o.lease_expires_at<=?)").all(this.now()),T={requeued:0,failed:0,cancelled:0};for(let _ of E){let r=this.controlPlane.getOperation(String(_.id)),t=this.getJob(r.id);if(this.release(r.id),r.cancelRequestedAt){this.finish(r.id,"cancelled",{recoveredAfterWorkerLoss:!0}),T.cancelled++;continue}if(t.resumePolicy==="requeue"&&r.attempt<t.maxAttempts)this.controlPlane.transitionOperation(r.id,{to:"queued",expectedVersion:r.version,error:"Worker lease expired; safely requeued from the last checkpoint."}),this.controlPlane.database.run("UPDATE operation_jobs SET available_at=?, blocked_reason='worker_restart', updated_at=? WHERE operation_id=?",[this.now(),this.now(),r.id]),this.appendLog(r.id,"Worker lease expired; operation requeued from its persisted checkpoint.",{stream:"system"}),T.requeued++;else this.finish(r.id,"failed",{recoverable:!0,lastCheckpoint:t.currentStep??null},"Worker lease expired; retry explicitly after reconciling provider state."),T.failed++}return T}clearCompleted(E={}){let T=this.now(),_=[T],r=E.projectId?"AND o.project_id=?":"";if(E.projectId)_.push(E.projectId);let t=E.before?"AND o.finished_at<=?":"";if(E.before)_.push(new Date(E.before).toISOString());let d=this.controlPlane.database.query(`SELECT o.id, o.project_id, o.correlation_id FROM operations o JOIN operation_jobs j ON j.operation_id=o.id WHERE o.state IN ('succeeded','failed','cancelled','timed_out') AND j.retention_until<=? ${r} ${t}`).all(..._);for(let R of d)this.controlPlane.appendEvent({projectId:Wh(R.project_id),actorId:E.actorId,correlationId:String(R.correlation_id),type:"queue.history.cleared",level:"warning",payload:{operationId:String(R.id),retentionCutoff:T}}),this.controlPlane.database.run("DELETE FROM operations WHERE id=?",[String(R.id)]);return d.length}}function YB(E,T,_){if(!Number.isFinite(E))return T;return Math.min(_,Math.max(1,Math.floor(E)))}class _w{queue;handlers;parallelism;pollIntervalMs;onResult;onError;waits=new Map;nextWaitId=0;lanes=[];running=!1;unsubscribeAvailability;constructor(E,T,_={}){this.queue=E;this.handlers=T;this.parallelism=YB(_.parallelism,4,100),this.pollIntervalMs=YB(_.pollIntervalMs,5000,60000),this.onResult=_.onResult,this.onError=_.onError}get active(){return this.running}start(){if(this.running)return this;return this.running=!0,this.unsubscribeAvailability=this.queue.onAvailable(()=>this.wake()),this.lanes=Array.from({length:this.parallelism},(E,T)=>this.runLane(T)),this}stop(){this.running=!1,this.unsubscribeAvailability?.(),this.unsubscribeAvailability=void 0,this.wake()}wake(){for(let{resolve:E,timer:T}of this.waits.values()){if(T)clearTimeout(T);E()}this.waits.clear()}async settled(){await Promise.allSettled(this.lanes)}async drain(){let E=[];while(!0){let T=await Promise.all(Array.from({length:this.parallelism},()=>this.queue.runOne(this.handlers)));if(E.push(...T.filter((_)=>_.handled)),!T.some((_)=>_.handled))return E}}wait(E){return new Promise((T)=>{let _=++this.nextWaitId,r=E?setTimeout(()=>{this.waits.delete(_),T()},this.pollIntervalMs):void 0;r?.unref?.(),this.waits.set(_,{resolve:T,timer:r})})}async runLane(E){while(this.running){try{let T=await this.queue.runOne(this.handlers);if(!this.running)break;if(T.handled){this.onResult?.(T),this.wake();continue}}catch(T){this.onError?.(T)}await this.wait(E===0)}}}import{createHash as wg}from"node:crypto";var MB=/^[a-z0-9](?:[a-z0-9_.-]{0,62})$/,Cg=/^[A-Za-z_][A-Za-z0-9_]{0,127}$/,Xg=/(?:secret|token|password|passwd|private.?key|api.?key|credential)/i,Jg=new Set(["image","build","command","entrypoint","environment","ports","volumes","networks","depends_on","healthcheck","restart","deploy","labels"]),fB=new Map([["privileged","Privileged containers are blocked."],["network_mode","Host/custom network modes are blocked."],["pid","Host PID namespaces are blocked."],["ipc","Host IPC namespaces are blocked."],["devices","Device access is blocked."],["cap_add","Additional Linux capabilities require an external policy exception."],["security_opt","Custom security options require an external policy exception."]]);function R_(E){return E&&typeof E==="object"&&!Array.isArray(E)?E:{}}function tw(E){return Array.isArray(E)?E:E==null?[]:[E]}function zg(E){return E.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"").slice(0,63)||"compose-app"}function JL(E){if(Array.isArray(E))return E.map(String);if(typeof E==="string"&&E.trim())return["sh","-c",E];return}function rw(E,T){let _=String(E??""),r=/^(\d+(?:\.\d+)?)(ms|s|m|h)?$/.exec(_);if(!r)return T;let t=Number(r[1]);return Math.max(0,Math.round(t*(r[2]==="ms"?0.001:r[2]==="m"?60:r[2]==="h"?3600:1)))}function GB(E){let T=/^(\d+(?:\.\d+)?)\s*(b|k|kb|kib|m|mb|mib|g|gb|gib)?$/i.exec(String(E??""));if(!T)return;let _=Number(T[1]),r=String(T[2]??"b").toLowerCase(),t=_*(r.startsWith("g")?1073741824:r.startsWith("m")?1048576:r.startsWith("k")?1024:1);return Math.max(1,Math.round(t/1024/1024))}function Fg(E){if(E==null)return"";return/^\$\{([A-Za-z_][A-Za-z0-9_]*)(?::[-?][^}]*)?\}$/.exec(String(E))?.[1]}function VB(E,T,_){let r={},t=Array.isArray(E)?E.map((d)=>{let[R,...h]=String(d).split("=");return[R,h.length?h.join("="):null]}):Object.entries(R_(E));for(let[d,R]of t){let h=String(d);if(!Cg.test(h)){_.push({severity:"error",path:`${T}.${h}`,code:"environment.name",message:"Environment variable names must use portable shell identifiers."});continue}let S=Fg(R);if(S!==void 0){r[h]={secretRef:S||h};continue}if(Xg.test(h)){_.push({severity:"error",path:`${T}.${h}`,code:"secret.literal",message:"Literal secret-like environment values are not stored.",alternative:`Use \${${h}} and supply ${h} through the secret store.`}),r[h]={secretRef:h};continue}r[h]=String(R??"")}return r}function jg(E,T,_){let r=[];for(let[t,d]of tw(E).entries()){let R,h,S="tcp";if(typeof d==="number")R=d;else if(typeof d==="string"){let[N,A]=d.split("/");S=A==="udp"?"udp":"tcp";let L=N.split(":");R=Number(L.at(-1)),h=L.length>1?Number(L.at(-2)):void 0}else{let N=R_(d);R=Number(N.target),h=N.published==null?void 0:Number(N.published),S=N.protocol==="udp"?"udp":"tcp"}if(!Number.isInteger(R)||R<1||R>65535||h!=null&&(!Number.isInteger(h)||h<1||h>65535))_.push({severity:"error",path:`${T}[${t}]`,code:"port.invalid",message:"Ports must be integers from 1 through 65535."});else r.push({target:R,...h?{published:h}:{},protocol:S})}return r}function yg(E,T,_,r){let t=[];for(let[d,R]of tw(E).entries()){let h="",S="",N=!1,A="volume";if(typeof R==="string"){let L=R.split(":");h=L[0]??"",S=L[1]??"",N=L.slice(2).includes("ro"),A=h.startsWith("/")||h.startsWith(".")?"bind":"volume"}else{let L=R_(R);h=String(L.source??""),S=String(L.target??""),N=L.read_only===!0,A=String(L.type??"volume")}if(A!=="volume"||h.startsWith("/")||h.startsWith(".")){r.push({severity:"error",path:`${_}[${d}]`,code:"volume.host_mount",message:"Host and bind mounts are blocked; use a named volume.",alternative:"Declare the volume at the top level and mount it by name."});continue}if(!MB.test(h)||!S.startsWith("/")){r.push({severity:"error",path:`${_}[${d}]`,code:"volume.invalid",message:"A named source and absolute container target are required."});continue}if(!T.has(h))r.push({severity:"warning",path:`${_}[${d}]`,code:"volume.implicit",message:`Named volume ${h} is implicit and will be declared on export.`});T.add(h),t.push({source:h,target:S,readOnly:N})}return t}function Bg(E){return Array.isArray(E)?E.map((T)=>({service:String(T),condition:"service_started"})):Object.entries(R_(E)).map(([T,_])=>({service:T,condition:["service_started","service_healthy","service_completed_successfully"].includes(String(R_(_).condition))?String(R_(_).condition):"service_started"}))}function QB(E){let T=R_(E);if(!Object.keys(T).length||T.disable===!0)return;let _=JL(T.test);return _?{test:_,intervalSeconds:rw(T.interval,30),timeoutSeconds:rw(T.timeout,5),retries:Math.max(1,Number(T.retries)||3),...T.start_period?{startPeriodSeconds:rw(T.start_period,0)}:{}}:void 0}function Pg(E,T,_){if(!E)return;let r=typeof E==="string"?{context:E}:R_(E),t=String(r.context??"."),d=String(r.dockerfile??"Dockerfile");if(t.startsWith("/")||t.split("/").includes("..")||d.startsWith("/")||d.split("/").includes(".."))_.push({severity:"error",path:T,code:"build.traversal",message:"Build context and Dockerfile must stay inside the repository."});return{context:t,dockerfile:d,...r.target?{target:String(r.target)}:{},args:VB(r.args,`${T}.args`,_)}}function Wg(E,T,_){let r=Array.isArray(E)?Object.fromEntries(E.map((d)=>String(d).split("=",2))):R_(E),t=String(r["ts-cloud.domains"]??r["ts-cloud.domain"]??"").split(",").map((d)=>d.trim()).filter(Boolean);for(let d of t)if(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(d))_.push({severity:"error",path:T,code:"domain.invalid",message:`Invalid service domain ${d}.`});return t.filter((d)=>/\./.test(d))}function Hg(E,T){let _=[],r=new Set,t=new Set,d=(R)=>{if(t.has(R))return;if(r.has(R)){T.push({severity:"error",path:`services.${R}.depends_on`,code:"dependency.cycle",message:"Service dependencies contain a cycle."});return}r.add(R);for(let h of E[R]?.dependsOn??[])if(!E[h.service])T.push({severity:"error",path:`services.${R}.depends_on.${h.service}`,code:"dependency.missing",message:`Dependency ${h.service} does not exist.`});else d(h.service);r.delete(R),t.add(R),_.push(R)};return Object.keys(E).sort().forEach(d),_}function PR(E,T){if(Buffer.byteLength(E)>524288)throw Error("Compose source exceeds the 512 KiB limit");let _;try{_=R_(Bun.YAML.parse(E))}catch(O){throw Error(`Compose YAML could not be parsed: ${O instanceof Error?O.message:String(O)}`)}let r=[],t=R_(_.services),d=Object.keys(t);if(!d.length)r.push({severity:"error",path:"services",code:"services.required",message:"At least one service is required."});if(d.length>64)r.push({severity:"error",path:"services",code:"services.limit",message:"A Compose application may contain at most 64 services."});let R=new Set(Object.keys(R_(_.volumes))),h=new Set(Object.keys(R_(_.networks))),S={};for(let O of d.sort()){let c=`services.${O}`,U=R_(t[O]);if(!MB.test(O)){r.push({severity:"error",path:c,code:"service.name",message:"Service names must be portable lowercase identifiers."});continue}for(let[H,Q]of fB)if(U[H]!=null&&U[H]!==!1&&(!Array.isArray(U[H])||U[H].length))r.push({severity:"error",path:`${c}.${H}`,code:`unsafe.${H}`,message:Q});for(let H of Object.keys(U))if(!Jg.has(H)&&!fB.has(H))r.push({severity:"warning",path:`${c}.${H}`,code:"field.unsupported",message:`Compose field ${H} is not in the supported subset and will not be deployed.`});let $=U.image?String(U.image):void 0,I=Pg(U.build,`${c}.build`,r);if(!$&&!I)r.push({severity:"error",path:c,code:"service.source",message:"Each service requires image or build."});if($&&!$.includes("@sha256:")&&(!$.includes(":")||$.endsWith(":latest")))r.push({severity:"warning",path:`${c}.image`,code:"image.floating",message:`Image ${$} is not pinned to a digest or explicit tag.`});let w=tw(U.networks).map((H)=>typeof H==="string"?H:String(R_(H).name??"")).filter(Boolean);w.forEach((H)=>h.add(H));let z=R_(U.deploy),F=R_(z.resources),j=R_(F.limits),Y=["no","always","on-failure","unless-stopped"].includes(String(U.restart))?String(U.restart):"unless-stopped";S[O]={name:O,...$?{image:$}:{},...I?{build:I}:{},...JL(U.command)?{command:JL(U.command)}:{},...JL(U.entrypoint)?{entrypoint:JL(U.entrypoint)}:{},environment:VB(U.environment,`${c}.environment`,r),ports:jg(U.ports,`${c}.ports`,r),volumes:yg(U.volumes,R,`${c}.volumes`,r),networks:w,dependsOn:Bg(U.depends_on),...QB(U.healthcheck)?{healthCheck:QB(U.healthcheck)}:{},restart:Y,...Number(j.cpus)>0?{cpu:Number(j.cpus)}:{},...GB(j.memory)?{memoryMb:GB(j.memory)}:{},replicas:Math.max(1,Math.min(100,Number(z.replicas)||1)),domains:Wg(U.labels,`${c}.labels`,r)}}let N=Hg(S,r),A={apiVersion:"ts-cloud.dev/v1",kind:"ComposeApplication",metadata:{name:T.name.trim(),slug:zg(T.slug??T.name),projectId:T.projectId,environmentId:T.environmentId},spec:{services:S,networks:[...h].sort(),volumes:[...R].sort(),dependencyOrder:N}},L=zL(A);return{valid:!r.some((O)=>O.severity==="error"),manifest:A,diagnostics:r,redactedSource:L,sourceHash:wg("sha256").update(E).digest("hex")}}function zL(E){let T=Object.fromEntries(Object.entries(E.spec.services).map(([_,r])=>[_,{...r.image?{image:r.image}:{},...r.build?{build:{context:r.build.context,dockerfile:r.build.dockerfile,...r.build.target?{target:r.build.target}:{},...Object.keys(r.build.args).length?{args:Object.fromEntries(Object.entries(r.build.args).map(([t,d])=>[t,typeof d==="string"?d:`\${${d.secretRef}:?required secret ${d.secretRef}}`]))}:{}}}:{},...r.command?{command:r.command}:{},...r.entrypoint?{entrypoint:r.entrypoint}:{},...Object.keys(r.environment).length?{environment:Object.fromEntries(Object.entries(r.environment).map(([t,d])=>[t,typeof d==="string"?d:`\${${d.secretRef}:?required secret ${d.secretRef}}`]))}:{},...r.ports.length?{ports:r.ports.map((t)=>`${t.published?`${t.published}:`:""}${t.target}${t.protocol==="udp"?"/udp":""}`)}:{},...r.volumes.length?{volumes:r.volumes.map((t)=>`${t.source}:${t.target}${t.readOnly?":ro":""}`)}:{},...r.networks.length?{networks:r.networks}:{},...r.dependsOn.length?{depends_on:Object.fromEntries(r.dependsOn.map((t)=>[t.service,{condition:t.condition}]))}:{},...r.healthCheck?{healthcheck:{test:r.healthCheck.test,interval:`${r.healthCheck.intervalSeconds}s`,timeout:`${r.healthCheck.timeoutSeconds}s`,retries:r.healthCheck.retries,...r.healthCheck.startPeriodSeconds!=null?{start_period:`${r.healthCheck.startPeriodSeconds}s`}:{}}}:{},restart:r.restart,...r.cpu||r.memoryMb||r.replicas!==1?{deploy:{replicas:r.replicas,resources:{limits:{...r.cpu?{cpus:String(r.cpu)}:{},...r.memoryMb?{memory:`${r.memoryMb}M`}:{}}}}}:{},...r.domains.length?{labels:{"ts-cloud.domains":r.domains.join(",")}}:{}}]));return Bun.YAML.stringify({services:T,...E.spec.networks.length?{networks:Object.fromEntries(E.spec.networks.map((_)=>[_,{}]))}:{},...E.spec.volumes.length?{volumes:Object.fromEntries(E.spec.volumes.map((_)=>[_,{}]))}:{}})}function dw(E,T){let _=[],r=(t,d,R)=>{if(JSON.stringify(d)===JSON.stringify(R))return;if(d&&R&&typeof d==="object"&&typeof R==="object"&&!Array.isArray(d)&&!Array.isArray(R)){for(let h of[...new Set([...Object.keys(d),...Object.keys(R)])].sort())r(t?`${t}.${h}`:h,d[h],R[h]);return}_.push({path:t,...d!==void 0?{before:d}:{},...R!==void 0?{after:R}:{}})};return r("",E,T),_}import{createHash as KB}from"node:crypto";var Yg="2026-07-21T00:00:00.000Z",ZB=[{id:"bun-postgres-redis",name:"Bun + Postgres + Redis",description:"Web and worker services with durable Postgres and Redis dependencies.",category:"application",version:"1.0.0",sourceVersion:"oven/bun:1.2.21,postgres:17.5,redis:8.0.3",architecture:"web → Postgres + Redis; worker → Postgres + Redis",minimumResources:{cpu:2,memoryMb:3072},exposedServices:["web"],maintenanceNotes:"Back up the Postgres volume before major upgrades.",inputs:[{name:"domain",label:"Web domain",required:!0,secret:!1}],source:`services:
@@ -9670,7 +9670,7 @@ Resources to create: ${j}`);let Y={};for(let H of Object.values(N.Resources||{})
 No changes detected - infrastructure is up to date`);return}if(e(`
 Changes detected:
 `),I.length>0){Z(`Resources to add (${I.length}):`);for(let F of I){let j=c[F].Type;e(`  + ${F} (${j})`)}console.log()}if(w.length>0){f(`Resources to remove (${w.length}):`);for(let F of w){let j=O[F].Type;e(`  - ${F} (${j})`)}console.log()}if(z.length>0){_E(`Resources to modify (${z.length}):`);for(let F of z){let j=c[F].Type;e(`  ~ ${F} (${j})`)}console.log()}e("Summary:"),e(`  - Add: ${I.length}`),e(`  - Remove: ${w.length}`),e(`  - Modify: ${z.length}`),e("\nRun `cloud deploy` to apply these changes")}catch(_){f(`Diff failed: ${_.message}`)}})}QE();await aE();JN();qL();function VR(E,T=0){let _=Number(E);return Number.isFinite(_)?_:T}function IC(E){return VR(E)*1024}function lb(E){let T=E?.date?.trim(),_=E?.time?.trim();if(!T||!_)return null;let r=new Date(`${T}T${_}Z`);return Number.isFinite(r.getTime())?r.toISOString():null}function ib(E,T,_){let r;try{r=JSON.parse(E)}catch{return[]}let t=(r?.sysstat?.hosts??[]).flatMap((R)=>R.statistics??[]),d=[];for(let R of t){let h=lb(R.timestamp);if(!h)continue;let S=new Date(h).getTime();if(S<T.getTime()||S>_.getTime())continue;let N=R["cpu-load"]?.find((L)=>L.cpu==="all")??R["cpu-load"]?.[0],A=VR(N?.idle,100);d.push({timestamp:h,cpuUsedPercent:Math.max(0,Math.min(100,100-A)),cpuUserPercent:VR(N?.user),cpuSystemPercent:VR(N?.system),cpuIowaitPercent:VR(N?.iowait),memoryUsedPercent:VR(R.memory?.["memused-percent"]),memoryUsedBytes:IC(R.memory?.memused),memoryAvailableBytes:IC(R.memory?.avail),swapUsedPercent:VR(R.memory?.["swpused-percent"]),swapUsedBytes:IC(R.memory?.swpused)})}return d.sort((R,h)=>R.timestamp.localeCompare(h.timestamp))}function ab(E){return Object.fromEntries(Object.entries(E.time_series??{}).map(([T,_])=>[T,(_.values??[]).map(([r,t])=>({timestamp:new Date(Number(r)*1000).toISOString(),value:VR(t,Number.NaN)})).filter((r)=>Number.isFinite(r.value))]))}function KW(E){return E.length?E.reduce((T,_)=>T+_,0)/E.length:null}function wC(E){return E.length?Math.max(...E):null}function mb(E){return E.length?Math.min(...E):null}async function ZW(E){let[T,_]=await Promise.all([E.client.getServerMetrics(E.serverId,{types:["cpu","disk","network"],start:E.from,end:E.to,step:E.step}),mr(E.remote.host,"LC_ALL=C sadf -j -- -u -r -S",E.remote).catch(()=>"")]),r=ib(_,E.from,E.to),t=ab(T),R=(t.cpu??[]).map((L)=>Math.max(0,Math.min(100,L.value/Math.max(1,E.cores)))),h=r.map((L)=>L.cpuUsedPercent),S=R.length?R:h,N=r.map((L)=>L.memoryUsedPercent),A=r.map((L)=>L.swapUsedPercent);return{from:E.from.toISOString(),to:E.to.toISOString(),cores:E.cores,host:r,provider:t,summary:{cpuAveragePercent:KW(S),cpuPeakPercent:wC(S),memoryAveragePercent:KW(N),memoryPeakPercent:wC(N),memoryMinimumAvailableBytes:mb(r.map((L)=>L.memoryAvailableBytes)),swapPeakPercent:wC(A)}}}fC();MC();ZC();bC();qe();await Qt([HC(),bR()]);import{createHash as H3}from"node:crypto";var oW=async(E)=>{let T=Bun.spawn(E,{stdout:"pipe",stderr:"pipe"}),[_,r,t]=await Promise.all([T.exited,new Response(T.stdout).text(),new Response(T.stderr).text()]);return{code:_,stdout:r,stderr:t}};class EH{async scan(E,T){let _=await oW(["ssh-keyscan","-T","10","-p",String(T),"-t","ed25519",E]),r=_.stdout.split(`
-`).find((t)=>t&&!t.startsWith("#"))?.trim().split(/\s+/);if(_.code!==0||!r?.[1]||!r[2])throw Error(`SSH host-key scan failed: ${_.stderr.trim()||"no key returned"}`);return{algorithm:r[1],key:r[2]}}async exec(E,T){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return oW(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,T])}}var Y3=(E)=>`SHA256:${H3("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,f3=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class fd{provider;transport;discoverer;constructor(E,T=new EH,_){this.provider=E;this.transport=T;this.discoverer=_}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let T=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:T.algorithm,hostKeyFingerprint:Y3(T.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let T=await this.transport.exec(E,f3);if(T.code!==0)throw Error(`Fleet validation failed: ${T.stderr.trim()||T.code}`);try{return JSON.parse(T.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,T){let _=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${T.length}`);if(_.code!==0)throw Error(`Fleet bootstrap failed: ${_.stderr.trim()||_.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function TH(E,T){return{"fleet.bootstrap":async(_)=>{let r=_.operation.input&&typeof _.operation.input==="object"&&!Array.isArray(_.operation.input)?_.operation.input:{},t=E.get(String(r.serverId??""));if(!t)throw Error("Queued fleet server was not found.");let d=T.find((S)=>S.provider===t.provider);if(!d)throw Error(`No ${t.provider} fleet driver is configured.`);let R=Array.isArray(r.steps)?r.steps.map(String):[];if(_.checkpoint("preflight","Rechecking pinned trust and healthy validation."),t.trustState!=="pinned"||!t.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");_.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let h=await d.bootstrap(t,R);return E.update(t.id,{bootstrapVersion:h.version,status:"ready"}),_.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:t.id,bootstrapVersion:h.version,steps:R.length}}}}var lt=(E)=>E==null?void 0:String(E),bh=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},kC=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:lt(E.provider_id),region:lt(E.region),zone:lt(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:lt(E.host_key_algorithm),hostKeyFingerprint:lt(E.host_key_fingerprint),pendingHostKey:lt(E.pending_host_key),roles:bh(E.roles,[]),labels:bh(E.labels,{}),taints:bh(E.taints,[]),capacity:bh(E.capacity,{}),usage:bh(E.usage,{}),capabilities:bh(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:bh(E.validation,void 0),bootstrapVersion:lt(E.bootstrap_version),heartbeatAt:lt(E.heartbeat_at),lastSeenAt:lt(E.last_seen_at),archivedAt:lt(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class it{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}get(E){let T=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return T?kC(T):void 0}list(E,T=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(kC).filter((_)=>T||_.status!=="archived")}findProvider(E,T,_){let r=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,T,_);return r?kC(r):void 0}create(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,_,_]),this.get(T)}update(E,T){let _=this.get(E);if(!_)throw Error("Server was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[r.name,r.providerId??null,r.region??null,r.zone??null,r.endpoint,r.sshUser,r.sshPort,r.credentialRef,r.hostKeyAlgorithm??null,r.hostKeyFingerprint??null,r.pendingHostKey??null,JSON.stringify(r.roles),JSON.stringify(r.labels),JSON.stringify(r.taints),JSON.stringify(r.capacity),JSON.stringify(r.usage),JSON.stringify(r.capabilities),r.status,r.trustState,JSON.stringify(r.validation??{}),r.bootstrapVersion??null,r.heartbeatAt??null,r.lastSeenAt??null,r.archivedAt??null,t,E]),this.get(E)}}var G3=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class lL{store;drivers;now;queue;constructor(E,T,_,r=()=>new Date){this.store=E;this.drivers=T;this.now=r;this.queue=_??new lE(E.control)}driver(E){let T=this.drivers.find((_)=>_.provider===E);if(!T)throw Error(`No ${E} fleet driver is configured.`);return T}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!G3.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let T=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(T)return this.store.update(T.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let _=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),r=this.driver(E.provider);return this.store.create({...E,resourceId:_.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:r.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let _=await this.driver(T.provider).test(T);if(!_.reachable)return this.store.update(E,{status:"unreachable"});if(T.hostKeyFingerprint&&T.hostKeyFingerprint!==_.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:_.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:_.hostKeyAlgorithm,hostKeyFingerprint:_.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,T){let _=this.store.get(E);if(!_||_.pendingHostKey!==T)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:T,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let T=this.store.get(E);if(!T||T.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let _=await this.driver(T.provider).validate(T),r=[];if(!["x64","arm64","x86_64","aarch64"].includes(_.arch??""))r.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let R of["curl","tar"])if(!_.tools?.[R])r.push({code:`tool.${R}`,severity:"error",message:`${R} is missing.`,remediation:`Install ${R} before bootstrap.`});if(Math.abs(_.timeSkewSeconds??0)>60)r.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!_.dnsOk)r.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let t={valid:!r.some((R)=>R.severity==="error"),facts:_,findings:r,validatedAt:this.now().toISOString(),validatorVersion:"1"},d={cpu:_.cpuCores??0,memoryBytes:_.memoryBytes??0,diskBytes:_.diskBytes??0};return this.store.update(E,{validation:t,capacity:d,status:t.valid?"ready":"degraded"})}bootstrap(E,T=!1){let _=this.store.get(E);if(!_?.validation?.valid)throw Error("A healthy validation report is required.");let r=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!T)return{preview:!0,steps:r};let t=this.queue.enqueue({projectId:_.projectId,resourceId:_.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:r},lockKey:`server:${E}`,providerKey:_.provider}).operation;return{preview:!1,steps:r,operation:t}}heartbeat(E,T){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let r=this.now().toISOString();return this.store.update(E,{usage:T.usage,capabilities:T.capabilities??_.capabilities,heartbeatAt:r,lastSeenAt:r,status:_.status==="draining"||_.status==="drained"?_.status:"ready"})}drain(E,T=!1){return this.store.update(E,{status:T?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,T){let _=this.store.get(E);if(!_||T!==_.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function Q3(){let E=await o(),T=iE(process.cwd(),E),_=new it(T.store),r=new lL(_,[new fd("aws"),new fd("hetzner"),new fd("ssh")]);return{controlPlane:T,store:_,service:r}}async function Gd(E){let T=await Q3();try{return await E(T)}finally{T.controlPlane.store.close()}}var kh=(E,T)=>{let _=E.store.list(E.controlPlane.project.id).find((r)=>r.id===T||r.name===T);if(!_)throw Error(`Server ${T} was not found.`);return _},or=(E)=>{f(E instanceof Error?E.message:String(E)),process.exitCode=1};function uC(E,T){let _=Number.parseInt(E??"",10);return Number.isFinite(_)&&_>=0?_:T}function M3(E="3h"){let T=E.match(/^(\d+)(m|h)$/);if(!T)throw Error("--range must use minutes or hours, for example 30m or 3h.");let _=Number(T[1])*(T[2]==="h"?3600000:60000);if(_<300000||_>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return _}function iL(E,T="%"){return E==null?"unavailable":`${E.toFixed(1)}${T}`}async function V3(E,T){let _=await o();if(_.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let r=T.env??process.env.CLOUD_ENV??"production",t=DT(_,r),d=await It(t);if(!d?.serverId)throw Error(`No pinned Hetzner server was found for ${t}.`);if(![d.serverName,String(d.serverId),d.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${d.serverName}.`);let R=CN(_),h=new Pd({apiToken:MR(R.apiToken,_)}),S=await h.getServer(d.serverId),N=d.publicIp??S.public_net.ipv4?.ip;if(!N)throw Error(`Server ${S.name} has no public IPv4 address.`);let A=new Date,L=new Date(A.getTime()-M3(T.range)),O=Math.min(3600,Math.max(60,uC(T.step,60))),c=await ZW({client:h,serverId:S.id,cores:Math.max(1,Number(S.server_type.cores)||1),from:L,to:A,step:O,remote:{host:N,user:d.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15}});if(T.json){console.log(JSON.stringify({schemaVersion:1,server:S.name,result:c},null,2));return}EE(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[S.name,`${c.from} to ${c.to}`,`${iL(c.summary.cpuAveragePercent)} / ${iL(c.summary.cpuPeakPercent)}`,`${iL(c.summary.memoryAveragePercent)} / ${iL(c.summary.memoryPeakPercent)}`,c.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(c.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,iL(c.summary.swapPeakPercent)]])}function _H(E){let T=E.targetType.prices?.find((_)=>_.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:T?{hourlyNet:T.price_hourly.net,hourlyGross:T.price_hourly.gross,monthlyNet:T.price_monthly.net,monthlyGross:T.price_monthly.gross}:void 0}}function K3(E){let T=_H(E);EE(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${T.serverName} (${T.serverId})`,T.location,`${T.from} -> ${T.to}`,T.capacityAvailable?"available":"waiting",`${T.target.cores??0} / ${T.target.memoryGb??0} GB / ${T.target.diskGb??0} GB`,T.price?.monthlyGross??T.price?.monthlyNet??"not reported"]])}async function Z3(E,T,_){let r=await o();if(r.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let t=_.env??process.env.CLOUD_ENV??"production",d=DT(r,t),R=await It(d),h=CN(r),S=new Pd({apiToken:MR(h.apiToken,r)}),A=R&&(E===R.serverName||E===String(R.serverId)||E===R.stackName)?await S.getServer(R.serverId):(await S.listServers()).find((H)=>H.name===E||String(H.id)===E);if(!A)throw Error(`Hetzner server ${E} was not found.`);if(R?.serverId&&R.serverId!==A.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${R.serverId}.`);let L=Wd(T),O=_.upgradeDisk!==!1,c=await vL(S,A.id,L,O);if(_.json)console.log(JSON.stringify({schemaVersion:1,plan:_H(c)},null,2));else K3(c);if(!_.apply){if(!_.json)e(`Preview only. Re-run with --apply --confirm ${A.name} to execute.`);return}if(_.confirm!==A.name)throw Error(`Resize requires --confirm ${A.name}.`);let U=R?.publicIp??A.public_net.ipv4?.ip;if(!U)throw Error(`Server ${A.name} has no public IPv4 address for verification.`);let $={host:U,user:R?.sshUser??h.sshUser,identityFile:h.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},I=await qC(d),w=new Date().toISOString(),z={schemaVersion:1,operationId:I?.targetType===L&&I.serverId===A.id?I.operationId:crypto.randomUUID(),stackName:d,serverId:A.id,serverName:A.name,sourceType:c.currentType.name,targetType:L,upgradeDisk:O,phase:"planning",status:"running",attempts:I?.targetType===L?I.attempts:0,startedAt:I?.targetType===L?I.startedAt:w,updatedAt:w,manifest:I?.targetType===L?I.manifest:void 0};await Yd(z);let F=uC(_.pollSeconds,900)*1000,j=uC(_.maxWaitMinutes,0)*60000,Y=Date.now();for(;;){let H=await vL(S,A.id,L,O);if(!H.capacityAvailable&&!H.alreadyComplete){if(z={...z,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await Yd(z),!_.wait){if(!_.json)e(`${L} has no capacity in ${H.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(j>0&&Date.now()-Y>=j)throw Error(`Timed out waiting for ${L} capacity in ${H.location}.`);if(!_.json)e(`Waiting ${Math.round(F/1000)} seconds for ${L} capacity...`);await Bun.sleep(F);continue}let Q=await xC(d);try{let K=await(async()=>{try{return z={...z,status:"running",attempts:z.attempts+1,updatedAt:new Date().toISOString()},await Yd(z),await QC({client:S,serverId:A.id,targetType:L,upgradeDisk:O,resumeFromOff:z.phase==="shutting-down"||z.phase==="resizing"||z.phase==="powering-on"||z.phase==="verifying",manifest:z.manifest,hooks:{preflight:async()=>{let x=await VC($);return z={...z,manifest:x,updatedAt:new Date().toISOString()},await Yd(z),x},afterBoot:async(x,k,n,TE)=>KC($,k,n,TE),onPhase:async(x,k)=>{if(z={...z,phase:x,status:x==="waiting-capacity"?"waiting-capacity":x==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await Yd(z),!_.json)e(`${x}${k?` ${JSON.stringify(k)}`:""}`)}}})}finally{await Q()}})();if(z={...z,status:K.status==="completed"||K.status==="already-complete"?"completed":K.status==="recovered"?"recovered":"waiting-capacity",lastError:K.status==="recovered"?K.error:void 0,updatedAt:new Date().toISOString()},await Yd(z),_.json)console.log(JSON.stringify({schemaVersion:1,result:K},null,2));else if(K.status==="completed"||K.status==="already-complete")Z(`${A.name} is on ${L} and passed full post-boot verification.`);else if(K.status==="recovered"&&K.retryable&&_.wait){e(`Capacity race recovered safely. Waiting ${Math.round(F/1000)} seconds before retry.`),await Bun.sleep(F);continue}else if(K.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${K.error}`);return}catch(K){throw z={...z,status:"failed",lastError:K instanceof Error?K.message:String(K),updatedAt:new Date().toISOString()},await Yd(z),K}}}async function g3(E,T){let _=await o();if(_.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let r=T.env??process.env.CLOUD_ENV??"production",t=DT(_,r),d=await It(t);if(!d?.serverId)throw Error(`No pinned Hetzner server was found for ${t}.`);if(![d.serverName,String(d.serverId),d.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${d.serverName}.`);let R=CN(_),h=new Pd({apiToken:MR(R.apiToken,_)}),S=await h.getServer(d.serverId),N=d.publicIp??S.public_net.ipv4?.ip;if(!N)throw Error(`Server ${S.name} has no public IPv4 address.`);let A=Ze(_);if(T.json)console.log(JSON.stringify({schemaVersion:1,server:S.name,plan:A},null,2));else EE(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[S.name,A.firewallPorts.join(","),A.monitoring?"on":"off",A.autoUpdates?"on":"off",`${A.swapGb} GB`,"disabled"]]);if(!T.apply){if(!T.json)e(`Preview only. Re-run with --apply --confirm ${S.name} to execute.`);return}if(T.confirm!==S.name)throw Error(`Optimization requires --confirm ${S.name}.`);let L={host:N,user:d.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15},O=await BN(L),c=O.routeProbes.filter((n)=>!n.ok),U=_.infrastructure?.compute,$=Ar(U)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,I=O.failedUnits.filter((n)=>!$.has(n));if(I.length>0)throw Error(`Preflight found failed services: ${I.join(", ")}`);if(c.length>0)throw Error(`Preflight found unhealthy routes: ${c.map((n)=>n.domain).join(", ")}`);let w=Ar(U)?[]:Object.values(_.sites??{}).flatMap((n)=>typeof n?.port==="number"&&![80,443].includes(n.port)?[n.port]:[]),z=zN({allowSsh:U?.allowSsh!==!1,sitePorts:w,allowedPorts:U?.firewall?.allowedPorts}),F=(d.firewallId?(await h.listFirewalls()).find((n)=>n.id===d.firewallId):void 0)??(await h.listFirewalls()).find((n)=>n.name===`${_.project.slug}-${r}-app-fw`);if(!F)throw Error(`Managed firewall for ${S.name} was not found.`);let j=await h.setFirewallRules(F.id,z);await Promise.all(j.map((n)=>h.waitForAction(n.id))),await BC(_,L);let[Y,H]=await Promise.all([BN(L),PC(L)]),Q=WC(A,H),K=uW(O,Y),x=Y.routeProbes.filter((n)=>!n.ok);if(K.stoppedServices.length>0)Q.push(`services stopped: ${K.stoppedServices.join(", ")}`);if(K.changedRouteFragments.length>0)Q.push(`route fragments changed: ${K.changedRouteFragments.join(", ")}`);if(K.missingRouteIds.length>0)Q.push(`routes disappeared: ${K.missingRouteIds.join(", ")}`);if(K.changedReleaseLinks.length>0)Q.push(`release links changed: ${K.changedReleaseLinks.join(", ")}`);if(K.missingData.length>0)Q.push(`databases or volumes disappeared: ${K.missingData.join(", ")}`);if(x.length>0)Q.push(`unhealthy routes: ${x.map((n)=>n.domain).join(", ")}`);if(Q.length>0)throw Error(`Host optimization verification failed: ${Q.join("; ")}`);let k={serverId:S.id,serverName:S.name,services:Y.runningServices.length,routes:Y.routeIds.length,healthyDomains:Y.routeProbes.length,releaseLinks:Y.releaseLinks.length,databasesAndVolumes:Y.dataCatalog.length,report:H};if(T.json)console.log(JSON.stringify({schemaVersion:1,result:k},null,2));else Z(`${S.name} passed full host, rpx route, service, release, and data verification.`)}function nC(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(T,_)=>{try{await Gd(async(r)=>{let t=T?[kh(r,T)]:r.store.list(r.controlPlane.project.id),d=t.flatMap((R)=>Object.entries(R.capabilities).map(([h,S])=>({server:R.name,provider:R.provider,action:h,...S})));if(_.json)console.log(JSON.stringify({schemaVersion:1,targets:d},null,2));else EE(["Server","Provider","Action","Support","Explanation"],d.map((R)=>[R.server,R.provider,R.action,R.supported?"supported":"unsupported",R.reason??"—"]))})}catch(r){or(r)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(T,_,r)=>{try{await Z3(T,_,r)}catch(t){or(t)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(T,_)=>{try{await g3(T,_)}catch(r){or(r)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(T,_)=>{try{await V3(T,_)}catch(r){or(r)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(T)=>{try{await Gd(async(_)=>{let r=_.store.list(_.controlPlane.project.id);if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],r.map((t)=>[t.name,t.providerId??"—",`${t.provider} / ${t.region??"external"}`,`${t.status} / ${t.trustState}`,t.roles.join(","),`${t.capacity.cpu??0} / ${t.capacity.memoryBytes??0}`,t.heartbeatAt??"never"]))})}catch(_){or(_)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(T,_)=>{try{await Gd(async(r)=>{let t=_.provider;if(!["aws","hetzner","ssh"].includes(t)||!_.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let d=r.service.enroll({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:T,provider:t,providerId:_.providerId,endpoint:_.endpoint,sshUser:_.user??"deploy",credentialRef:_.credentialRef??"secret://fleet/agent",region:_.region,roles:String(_.roles??"application").split(","),labels:Object.fromEntries(String(_.labels??"").split(",").map((R)=>R.split("=")).filter((R)=>R[0]&&R[1]))});Z(`Enrolled ${d.name} as ${d.id}; no remote mutation was performed.`)})}catch(r){or(r)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(T,_)=>{try{await Gd(async(r)=>{let t=kh(r,T);if(t=await r.service.test(t.id),t.trustState==="rotation_pending"){if(!_.acceptHostKey)throw Error(`Host key changed to ${t.pendingHostKey}; review it first.`);t=r.service.reviewHostKey(t.id,_.acceptHostKey)}let d=await r.service.validate(t.id);if(_.json)console.log(JSON.stringify(d.validation,null,2));else EE(["Severity","Code","Finding","Remediation"],(d.validation?.findings??[]).map((R)=>[R.severity,R.code,R.message,R.remediation??"—"]));if(!d.validation?.valid)process.exitCode=1})}catch(r){or(r)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(T,_)=>{try{await Gd(async(r)=>{let t=r.service.bootstrap(kh(r,T).id,!!_.apply);if(t.preview)EE(["Step"],t.steps.map((d)=>[d]));else Z(`Bootstrap queued: ${t.operation?.id}`)})}catch(r){or(r)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(T,_)=>{try{await Gd(async(r)=>Z(r.service.drain(kh(r,T).id,!!_.complete).status))}catch(r){or(r)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(T)=>{try{await Gd(async(_)=>{_.service.uncordon(kh(_,T).id),Z(`Uncordoned ${T}.`)})}catch(_){or(_)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(T,_)=>{try{await Gd(async(r)=>{r.service.archive(kh(r,T).id,_.confirm??""),Z(`Archived ${T}; provider infrastructure was not terminated.`)})}catch(r){or(r)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(T)=>{try{await Gd(async(_)=>{let r=kh(_,T);if(r.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let t=Bun.spawn(["ssh","-p",String(r.sshPort),"-o","StrictHostKeyChecking=yes",`${r.sshUser}@${r.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),d=await t.exited;if(d)process.exitCode=d})}catch(_){or(_)}});for(let[T,_]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(T,_).action(async(...r)=>ar(T.split(" ")[0],{target:String(r[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}QE();var wt=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},Lr=(E)=>E==null?void 0:String(E),dH=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),WN=(E={})=>({...dH(),...E});function rH(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:Lr(E.region),architecture:Lr(E.architecture),labels:wt(E.labels,{}),requiredServerLabels:wt(E.required_server_labels,{}),toleratedTaints:wt(E.tolerated_taints,[]),capacity:WN(wt(E.capacity,{})),reserved:wt(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:Lr(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function tH(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Lr(E.environment_id),resourceId:String(E.resource_id),releaseId:Lr(E.release_id),poolId:String(E.pool_id),serverId:Lr(E.server_id),purpose:String(E.purpose),requirements:wt(E.requirements,{}),decision:wt(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function q3(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:Lr(E.resource_id),poolId:String(E.pool_id),placementId:Lr(E.placement_id),operationId:Lr(E.operation_id),sourceSha:String(E.source_sha),buildSpec:wt(E.build_spec,{}),credentialPolicy:wt(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:Lr(E.workspace),cacheKey:Lr(E.cache_key),artifactUri:Lr(E.artifact_uri),artifactDigest:Lr(E.artifact_digest),status:String(E.status),cleanupAt:Lr(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class aL{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}createPool(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(WN(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,_,_]),this.getPool(T)}getPool(E){let T=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return T?rH(T):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(rH)}updatePool(E,T){let _=this.getPool(E);if(!_)throw Error("Capacity pool was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.reserved),JSON.stringify(r.capacity),r.concurrency,t,E]),this.getPool(E)}addMember(E,T,_={}){let r=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,T,JSON.stringify(_),r,r])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((T)=>({serverId:String(T.server_id),status:String(T.status),capacityOverride:wt(T.capacity_override,{})}))}memberStatus(E,T,_){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[_,this.now().toISOString(),E,T])}listPlacements(E,T){let _=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(tH);return T?.length?_.filter((r)=>T.includes(r.status)):_}getPlacement(E){let T=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return T?tH(T):void 0}activeUsage(E,T){let _=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),r=T?_.filter((t)=>String(t.server_id)===T):_;return{resources:r.reduce((t,d)=>{let R=WN(wt(d.resources,{}));for(let h of Object.keys(t))t[h]+=R[h];return t},dH()),count:r.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let T=this.id(),_=this.id(),r=this.now().toISOString(),t=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[T,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,r,r]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[_,T,E.decision.poolId,E.decision.serverId??null,JSON.stringify(WN(E.requirements.resources)),t,r,r]),this.getPlacement(T)})}transitionPlacement(E,T){if(!this.getPlacement(E))throw Error("Placement was not found.");let r=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[T,r,E]),["released","failed","blocked"].includes(T))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[r,E]);return this.getPlacement(E)}createBuild(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[T,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),_,_]),this.getBuild(T)}getBuild(E){let T=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return T?q3(T):void 0}updateBuild(E,T){let _=this.getBuild(E);if(!_)throw Error("Remote build was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[r.operationId??null,r.workspace??null,r.cacheKey??null,r.artifactUri??null,r.artifactDigest??null,r.status,r.cleanupAt??null,t,E]),this.getBuild(E)}}var be=["cpu","memoryBytes","diskBytes","gpu"],RH=(E,T={})=>Object.entries(T).every(([_,r])=>E[_]===r),x3=(E,T,_)=>Object.fromEntries(be.map((r)=>[r,Math.max(0,E[r]-T[r]-(_[r]??0))])),b3=(E,T)=>be.every((_)=>E[_]>=(T[_]??0)),k3=(E,T)=>be.reduce((_,r)=>_+(T[r]??0)/(E[r]||1),0);class mL{store;fleet;constructor(E,T){this.store=E;this.fleet=T}poolCandidates(E,T,_){let r=[];for(let t of this.store.listPools(E)){if(t.id===_)continue;let d=[];if(t.status!=="active")d.push(`pool is ${t.status}`);if(t.purpose!==T.purpose)d.push(`purpose is ${t.purpose}`);if(T.region&&t.region!==T.region)d.push(`region is ${t.region??"unset"}`);if(T.architecture&&t.architecture!==T.architecture)d.push(`architecture is ${t.architecture??"unset"}`);if(!RH(t.labels,T.labels))d.push("pool labels do not match");if(t.backend==="server"){let R=this.store.members(t.id);if(!R.length)r.push(this.decision(t,void 0,T,[...d,"pool has no servers"]));for(let h of R){let S=this.fleet.get(h.serverId),N=[...d];if(!S)N.push("server is missing");else this.serverReasons(t,S,h.status,T,N);r.push(this.decision(t,S,T,N,h.capacityOverride))}}else r.push(this.decision(t,void 0,T,d))}return r.sort((t,d)=>Number(d.eligible)-Number(t.eligible)||t.score.cost-d.score.cost||t.score.spread-d.score.spread||t.score.fit-d.score.fit||t.poolName.localeCompare(d.poolName)||(t.serverId??"").localeCompare(d.serverId??""))}serverReasons(E,T,_,r,t){if(_!=="active")t.push(`member is ${_}`);if(T.status!=="ready")t.push(`server is ${T.status}`);if(!T.roles.includes(r.purpose==="build"?"build":r.purpose))t.push(`server lacks ${r.purpose} role`);if(!RH(T.labels,E.requiredServerLabels))t.push("server labels do not match pool selector");for(let d of T.taints)if(!E.toleratedTaints.includes(d))t.push(`taint ${d} is not tolerated`)}decision(E,T,_,r,t={}){let d=WN({...T?.capacity,...t}),R=T?Object.fromEntries(be.map((N)=>[N,Math.min(E.capacity[N],d[N])])):E.capacity,h=this.store.activeUsage(E.id,T?.id),S=x3(R,h.resources,E.reserved);if(h.count>=E.maxWorkloads)r.push("workload limit reached");if(_.purpose==="build"&&h.count>=E.concurrency)r.push("build concurrency reached");if(!b3(S,_.resources))r.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:T?.id,eligible:r.length===0,reasons:r,available:S,score:{fit:k3(S,_.resources),spread:h.count,cost:E.costWeight}}}explain(E,T){return this.poolCandidates(E,T)}place(E){return this.store.control.transaction(()=>{let T=this.poolCandidates(E.projectId,E.requirements).find((_)=>_.eligible);if(!T)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((_)=>_.reasons).join("; ")}`);return this.store.reserve({...E,decision:T})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let T=this.store.updatePool(E,{status:"draining"}),_=[],r=[];for(let t of this.store.listPlacements(T.projectId,["reserved","active"]).filter((d)=>d.poolId===E)){if(t.stateful){r.push(this.store.transitionPlacement(t.id,"blocked"));continue}this.store.transitionPlacement(t.id,"moving");let d=this.place({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,releaseId:t.releaseId,requirements:t.requirements});_.push(this.activate(d.id)),this.store.transitionPlacement(t.id,"released")}return{pool:T,moved:_,blocked:r}}drainServer(E,T){this.store.memberStatus(E,T,"draining");let _=this.store.getPool(E);if(!_)throw Error("Capacity pool was not found.");let r=[],t=[];for(let d of this.store.listPlacements(_.projectId,["reserved","active"]).filter((R)=>R.poolId===E&&R.serverId===T)){if(d.stateful){t.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"moving");let R=this.poolCandidates(d.projectId,d.requirements).find((S)=>S.eligible);if(!R){t.push(this.store.transitionPlacement(d.id,"blocked"));continue}let h=this.store.reserve({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements,decision:R});r.push(this.activate(h.id)),this.store.transitionPlacement(d.id,"released")}return{moved:r,blocked:t}}reconcileFailure(E){let T=this.fleet.get(E);if(!T)throw Error("Server was not found.");let _=[],r=[];for(let t of this.store.listPlacements(T.projectId,["active"]).filter((d)=>d.serverId===E)){if(t.stateful||!t.autoReschedule){r.push(this.store.transitionPlacement(t.id,"blocked"));continue}this.store.transitionPlacement(t.id,"failed");let d=this.place({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,releaseId:t.releaseId,requirements:t.requirements});_.push(this.activate(d.id))}return{rescheduled:_,blocked:r}}}async function u3(){let E=await o(),T=iE(process.cwd(),E),_=new aL(T.store),r=new mL(_,new it(T.store));return{controlPlane:T,store:_,service:r}}async function sL(E){let T=await u3();try{await E(T)}catch(_){f(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}var ke=(E)=>Object.fromEntries(String(E??"").split(",").map((T)=>T.split("=")).filter((T)=>T[0]&&T[1])),hH=(E)=>Object.fromEntries(Object.entries(ke(E)).map(([T,_])=>[T,Number(_)]));function vC(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(T)=>sL((_)=>{let r=_.store.listPools(_.controlPlane.project.id);if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],r.map((t)=>[t.name,t.purpose,t.backend,`${t.region??"any"} / ${t.architecture??"any"}`,t.status,JSON.stringify(t.capacity),String(t.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(T,_)=>sL((r)=>{let{purpose:t,backend:d}=_;if(!["application","build","worker","monitoring","backup"].includes(t)||!["server","ecs","asg"].includes(d))throw Error("Unsupported pool purpose or backend.");let R=r.store.createPool({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:T,purpose:t,backend:d,region:_.region,architecture:_.arch,labels:ke(_.labels),requiredServerLabels:ke(_.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...hH(_.capacity)},maxWorkloads:Number(_.max),costWeight:1,concurrency:Number(_.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});Z(`Created ${R.name} (${R.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(T,_)=>sL((r)=>{let t=r.store.listPools(r.controlPlane.project.id).find((R)=>R.id===T||R.name===T),d=new it(r.controlPlane.store).list(r.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!t||!d)throw Error("Pool or server was not found.");r.store.addMember(t.id,d.id),Z(`Attached ${d.name} to ${t.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(T)=>sL((_)=>{let r=_.service.explain(_.controlPlane.project.id,{purpose:T.purpose,resources:hH(T.resources),region:T.region,architecture:T.arch,labels:ke(T.labels)});if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],r.map((t)=>[t.poolName,t.serverId??"provider-managed",t.eligible?"yes":"no",JSON.stringify(t.available),`${t.score.fit.toFixed(2)} / ${t.score.spread} / ${t.score.cost}`,t.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(T)=>sL((_)=>{let r=_.store.listPools(_.controlPlane.project.id).find((d)=>d.id===T||d.name===T);if(!r)throw Error("Pool was not found.");let t=_.service.drainPool(r.id);Z(`Draining ${r.name}: moved ${t.moved.length}, blocked ${t.blocked.length} stateful placement(s).`)}))}QE();var Qd=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},Et=(E)=>E==null?void 0:String(E),SH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:Et(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:Qd(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:Qd(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:Et(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),lC=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:Et(E.stack_id),stackRevision:Et(E.stack_revision),status:String(E.status),health:Qd(E.health,{}),lastHealthyAt:Et(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),iC=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:Qd(E.config,{}),status:String(E.status),checkpoint:Et(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:Et(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),aC=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:Qd(E.weights,{}),desiredWeights:Qd(E.desired_weights,{}),status:String(E.status),providerState:Qd(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),NH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:Et(E.operation_id),kind:String(E.kind),requestedRegion:Et(E.requested_region),revision:Et(E.revision),plan:Qd(E.plan,[]),currentStep:Et(E.current_step),completedSteps:Qd(E.completed_steps,[]),status:String(E.status),error:Et(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class pL{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((d)=>d.region)).size!==E.regions.length||E.regions.filter((d)=>d.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let T=E.regions.find((d)=>d.role==="primary"),_=this.id(),r=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[_,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,T.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),T.region,r,r]);for(let d of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),_,d.region,d.role,d.provider,r,r]);for(let d of E.dataPolicy.replicate)for(let R of E.regions)for(let h of E.regions.filter((S)=>S.region!==R.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),_,d,R.region,h.region,"{}",r,r]);let t=Object.fromEntries(E.regions.map((d)=>[d.region,d.region===T.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),_,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(t),JSON.stringify(t),r,r]),this.get(_)})}get(E){let T=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return T?SH(T):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(SH)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(lC)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(iC)}route(E){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return T?aC(T):void 0}updateTopology(E,T){let _=this.get(E);if(!_)throw Error("Regional topology was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[r.status,r.activeRegion,r.revision??null,JSON.stringify(r.regions),t,E]),this.get(E)}updateTarget(E,T){let _=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!_)throw Error("Regional target was not found.");let r=lC(_),t={...r,...T},d=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[t.role,t.stackId??null,t.stackRevision??null,t.status,JSON.stringify(t.health),t.lastHealthyAt??null,d,E]),lC(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,T){let _=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!_)throw Error("Replication channel was not found.");let r=iC(_),t={...r,...T},d=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[t.status,t.checkpoint??null,t.lagSeconds??null,t.lastVerifiedAt??null,d,E]),iC(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,T){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!_)throw Error("Traffic route was not found.");let r=aC(_),t={...r,...T},d=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(t.weights),JSON.stringify(t.desiredWeights),t.status,JSON.stringify(t.providerState),d,E]),aC(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[T,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),_,_]),this.execution(T)}execution(E){let T=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return T?NH(T):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(NH)}updateExecution(E,T){let _=this.execution(E);if(!_)throw Error("Regional execution was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[r.operationId??null,r.currentStep??null,JSON.stringify(r.completedSteps),r.status,r.error??null,t,E]),this.execution(E)}}class oL{store;queue;constructor(E,T){this.store=E;this.queue=T??new lE(E.control)}create(E){return this.store.create(E)}plan(E,T,_){if(!this.store.get(E))throw Error("Regional topology was not found.");let t=this.store.targets(E),d=this.store.channels(E);if(T==="rollout")return[...t.filter((R)=>R.role==="secondary").map((R)=>`apply:${R.region}`),...t.filter((R)=>R.role==="primary").map((R)=>`apply:${R.region}`),...d.map((R)=>`replicate:${R.kind}:${R.targetRegion}`),"traffic:activate"];if(T==="failover"||T==="failback")return[`health:${_}`,`replication:${_}`,`traffic:${_}`,`roles:${_}`];if(T==="destroy")return["traffic:drain",...t.filter((R)=>R.role==="secondary").map((R)=>`delete:${R.region}`),...t.filter((R)=>R.role==="primary").map((R)=>`delete:${R.region}`),"complete"];return["observe","repair"]}enqueue(E){let T=this.store.get(E.topologyId);if(!T)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!T.regions.some((d)=>d.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===T.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==T.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&T.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let _=this.plan(T.id,E.kind,E.targetRegion),r=this.store.createExecution({topologyId:T.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:_}),t=this.queue.enqueue({projectId:T.projectId,environmentId:T.environmentId,kind:`region.${E.kind}`,input:{executionId:r.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${T.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(r.id,{operationId:t.id}),{execution:this.store.execution(r.id),operation:t}}}var n3=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function AH(E,T){let _=(N)=>{let A=T.find((L)=>L.provider===N.provider);if(!A)throw Error(`No ${N.provider} regional driver is configured.`);return A},r=(N,A,L)=>{N.throwIfCancellationRequested(),N.checkpoint(L,L),E.updateExecution(A.id,{status:"running",currentStep:L,completedSteps:[...E.execution(A.id).completedSteps,L]})},t=async(N,A)=>{let L=E.route(N.id);if(!L)throw Error("Regional traffic route was not found.");let O=E.targets(N.id).find((U)=>U.region===N.activeRegion)??E.targets(N.id)[0];if(!O)throw Error("Regional traffic target was not found.");E.updateRoute(L.id,{status:"applying",desiredWeights:A});let c=await _(O).applyTraffic({route:E.route(N.id),topology:N,weights:A});E.updateRoute(L.id,{status:Object.values(A).every((U)=>U===0)?"drained":"in_sync",weights:A,providerState:c.providerState})},d=async(N,A,L,O)=>{E.updateTopology(L.id,{status:"provisioning"});let c=A.revision,U=O.manifest??{},$=E.targets(L.id).sort((w,z)=>Number(w.role==="primary")-Number(z.role==="primary"));for(let w of $){r(N,A,`apply:${w.region}`),E.updateTarget(w.id,{status:"provisioning"});let z=await _(w).applyStack({target:w,revision:c,manifest:U,signal:N.signal}),F=await _(w).health({target:E.updateTarget(w.id,{stackId:z.stackId,stackRevision:c})});if(!F.healthy)throw Error(`Regional health gate failed in ${w.region}.`);E.updateTarget(w.id,{status:"ready",health:F.evidence,lastHealthyAt:new Date().toISOString()})}for(let w of E.channels(L.id)){r(N,A,`replicate:${w.kind}:${w.targetRegion}`),E.updateChannel(w.id,{status:"configuring"});let z=$.find((Y)=>Y.region===w.sourceRegion),F=await _(z).configureReplication({channel:w,topology:L}),j=await _(z).verifyReplication({channel:E.updateChannel(w.id,{checkpoint:F.checkpoint,lagSeconds:F.lagSeconds}),topology:L});if(!j.healthy||j.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${w.kind} replication to ${w.targetRegion} exceeds the RPO.`);E.updateChannel(w.id,{status:"in_sync",checkpoint:j.checkpoint,lagSeconds:j.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(N,A,"traffic:activate");let I=Object.fromEntries(L.regions.map((w)=>[w.region,w.region===L.activeRegion?100:0]));return await t(L,I),E.updateTopology(L.id,{status:"ready",revision:c}),{revision:c,activeRegion:L.activeRegion}},R=async(N,A,L)=>{let O=A.requestedRegion,c=E.targets(L.id).find((I)=>I.region===O);if(!c)throw Error("Requested regional target was not found.");E.updateTopology(L.id,{status:A.kind==="failover"?"failing_over":"failing_back"}),r(N,A,`health:${O}`);let U=await _(c).health({target:c});if(!U.healthy)throw Error(`Target region ${O} is unhealthy.`);E.updateTarget(c.id,{status:"ready",health:U.evidence,lastHealthyAt:new Date().toISOString()}),r(N,A,`replication:${O}`);for(let I of E.channels(L.id).filter((w)=>w.targetRegion===O)){let w=await _(c).verifyReplication({channel:I,topology:L});if(!w.healthy||w.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${I.kind} replication is outside the failover RPO.`);E.updateChannel(I.id,{status:"in_sync",checkpoint:w.checkpoint,lagSeconds:w.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(N,A,`traffic:${O}`),await t(L,Object.fromEntries(L.regions.map((I)=>[I.region,I.region===O?100:0]))),r(N,A,`roles:${O}`);let $=L.regions.map((I)=>({...I,role:I.region===O?"primary":"secondary"}));for(let I of E.targets(L.id))E.updateTarget(I.id,{role:I.region===O?"primary":"secondary"});return E.updateTopology(L.id,{status:A.kind==="failover"?"failed_over":"ready",activeRegion:O,regions:$}),{activeRegion:O}},h=async(N,A,L,O)=>{E.updateTopology(L.id,{status:"destroying"}),r(N,A,"traffic:drain"),await t(L,Object.fromEntries(L.regions.map((U)=>[U.region,0])));let c=O.deleteData!==!0;for(let U of E.targets(L.id).sort(($,I)=>Number($.role==="primary")-Number(I.role==="primary")))r(N,A,`delete:${U.region}`),E.updateTarget(U.id,{status:"deleting"}),await _(U).deleteStack({target:U,retainData:c,signal:N.signal}),E.updateTarget(U.id,{status:"deleted"});return r(N,A,"complete"),E.updateTopology(L.id,{status:"destroyed"}),{destroyed:!0,dataRetained:c}},S=async(N)=>{let A=n3(N.operation.input),L=E.execution(String(A.executionId??""));if(!L)throw Error("Regional execution was not found.");let O=E.get(L.topologyId);if(!O)throw Error("Regional topology was not found.");try{let c;if(L.kind==="rollout")c=await d(N,L,O,A);else if(L.kind==="failover"||L.kind==="failback")c=await R(N,L,O);else if(L.kind==="destroy")c=await h(N,L,O,A);else throw Error("Regional reconciliation is not configured.");return E.updateExecution(L.id,{status:"succeeded",currentStep:void 0}),{executionId:L.id,...c}}catch(c){if(E.updateExecution(L.id,{status:N.cancellationRequested()?"cancelled":"failed",error:c instanceof Error?c.message:String(c)}),E.get(O.id)?.status!=="destroyed")E.updateTopology(O.id,{status:"failed"});throw c}};return{"region.rollout":S,"region.failover":S,"region.failback":S,"region.destroy":S,"region.reconcile":S}}class mC{provider;reason;constructor(E,T="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=T}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function v3(){let E=await o(),T=iE(process.cwd(),E),_=new pL(T.store),r=new oL(_);return{controlPlane:T,store:_,service:r}}async function uh(E){let T=await v3();try{await E(T)}catch(_){f(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}var E0=(E,T)=>{let _=E.store.list(E.controlPlane.project.id).find((r)=>r.id===T||r.name===T);if(!_)throw Error("Regional topology was not found.");return _},l3=(E)=>E.split(",").map((T,_)=>{let[r,t="aws"]=T.split(":");return{region:String(r),provider:t,role:_===0?"primary":"secondary"}}),i3=(E)=>{let T=new Set(["s3","dynamodb","secrets"]),_=E.split(",").map((t)=>t.trim()),r=_.find((t)=>!T.has(t));if(r)throw Error(`Unsupported replication kind: ${r}`);return _};function sC(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(T)=>uh((_)=>{let r=_.store.list(_.controlPlane.project.id).map((t)=>({topology:t,targets:_.store.targets(t.id),channels:_.store.channels(t.id),route:_.store.route(t.id),executions:_.store.executions(t.id)}));if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Name","Hostname","Active","Status","Revision","Replication"],r.map((t)=>[t.topology.name,t.topology.hostname,t.topology.activeRegion,t.topology.status,t.topology.revision??"—",`${t.channels.filter((d)=>d.status==="in_sync").length}/${t.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(T,_)=>uh((r)=>{if(!_.hostname||!_.regions)throw Error("--hostname and --regions are required.");let t=r.service.create({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:T,hostname:_.hostname,regions:l3(_.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:i3(String(_.replicate)),maxLagSeconds:Number(_.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!_.cdn,wafEnabled:!!_.waf});Z(`Created ${t.name} (${t.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(T,_,r)=>uh((t)=>EE(["Step"],t.service.plan(E0(t,T).id,_,r.target).map((d)=>[d])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(T,_,r)=>uh(async(t)=>{let d=r.manifest?await Bun.file(r.manifest).json():{},R=t.service.enqueue({topologyId:E0(t,T).id,kind:"rollout",revision:_,manifest:d});Z(`Regional rollout queued: ${R.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(T,_)=>uh((r)=>{let t=r.service.enqueue({topologyId:E0(r,T).id,kind:"failover",targetRegion:_});Z(`Failover queued: ${t.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(T,_)=>uh((r)=>{let t=r.service.enqueue({topologyId:E0(r,T).id,kind:"failback",targetRegion:_});Z(`Failback queued: ${t.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(T,_)=>uh((r)=>{let t=r.service.enqueue({topologyId:E0(r,T).id,kind:"destroy",confirmation:_.confirm});Z(`Regional teardown queued: ${t.operation.id}; replicated data remains retained.`)}))}QE();var T0="0.7.87";import{createHash as pC,createPublicKey as cH,verify as m3}from"node:crypto";function _0(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(_0).join(",")}]`;return`{${Object.keys(E).sort().map((T)=>`${JSON.stringify(T)}:${_0(E[T])}`).join(",")}}`}var eH=(E)=>pC("sha256").update(_0(E)).digest("hex"),ue=(E)=>pC("sha256").update(_0(E)).digest("hex"),UH=(E)=>pC("sha256").update(cH(E).export({type:"spki",format:"der"})).digest("hex");function DH(E,T,_){try{return m3(null,Buffer.from(_0(E)),cH(_),Buffer.from(T,"base64"))}catch{return!1}}var LH=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((T)=>Number(T)||0),OH=(E,T)=>{let _=LH(E),r=LH(T);for(let t=0;t<3;t++){let d=(_[t]??0)-(r[t]??0);if(d)return d}return 0};function $H(E,T){let _=[];if(T.schemaVersion<E.minimumSchema)_.push(`schema ${T.schemaVersion} is below ${E.minimumSchema}`);if(T.schemaVersion>E.maximumSchema)_.push(`schema ${T.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&OH(T.currentVersion,E.minimumVersion)<0)_.push(`platform ${T.currentVersion} is below ${E.minimumVersion}`);if(OH(E.version,T.currentVersion)<=0)_.push(`version ${E.version} is not newer than ${T.currentVersion}`);if(!E.artifacts.some((r)=>r.platform===T.platform&&r.architecture===T.architecture))_.push(`no artifact for ${T.platform}/${T.architecture}`);return{compatible:_.length===0,reasons:_}}var Md=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},F_=(E)=>E==null?void 0:String(E),s3=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:F_(E.revoked_at),createdAt:String(E.created_at)}),IH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:Md(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:Md(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),wH=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:Md(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),CH=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:F_(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:Md(E.health_gate,{}),status:String(E.status),currentStage:F_(E.current_stage),backupId:F_(E.backup_id),approvedBy:F_(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),oC=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:F_(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:Md(E.evidence,{}),error:F_(E.error),startedAt:F_(E.started_at),finishedAt:F_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),XH=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:Md(E.criteria,{}),candidates:Md(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:F_(E.confirmation),expiresAt:String(E.expires_at),result:Md(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),JH=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:F_(E.backup_policy_id),recoveryPointId:F_(E.recovery_point_id),topologyId:F_(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:F_(E.operation_id),evidence:Md(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:F_(E.error),startedAt:F_(E.started_at),finishedAt:F_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class r0{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}addTrustedKey(E){let T=this.id(),_=this.now().toISOString(),r=UH(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[T,E.organizationId,E.name,E.publicKeyPem,r,_]),this.key(T)}key(E){let T=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return T?s3(T):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let T=this.key(E.keyId);if(!T||T.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(T.revokedAt)throw Error("Update signing key is revoked.");if(!DH(E.document,E.signature,T.publicKeyPem))throw Error("Update manifest signature is invalid.");let _=$H(E.document,E.current),r=eH(E.document),t=this.id(),d=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[t,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,r,JSON.stringify(E.document),E.signature,JSON.stringify(_),d]),this.manifest(t)}manifest(E){let T=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return T?IH(T):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(IH)}createWindow(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[T,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,_,_]),this.window(T)}window(E){let T=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return T?wH(T):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(wH)}createCampaign(E){return this.control.transaction(()=>{let T=this.manifest(E.manifestId);if(!T?.compatibility.compatible||T.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let _=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[_,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,r,r]),E.targets.forEach((t,d)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),_,t.serverId??null,t.target,E.strategy==="canary"?d===0?0:1+Math.floor((d-1)/E.batchSize):Math.floor(d/E.batchSize),t.previousVersion,r,r])),this.campaign(_)})}campaign(E){let T=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return T?CH(T):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(CH)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(oC)}updateCampaign(E,T){let _=this.campaign(E);if(!_)throw Error("Upgrade campaign was not found.");let r={..._,...T};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[r.status,r.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,T){let _=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!_)throw Error("Upgrade target was not found.");let r={...oC(_),...T};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.evidence),r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),oC(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let T=[...E.candidates].sort((R,h)=>R.id.localeCompare(h.id)),_=ue(T),r=this.id(),t=this.now().toISOString(),d=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[r,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(T),_,T.reduce((R,h)=>R+h.bytes,0),d,t,t]),this.cleanup(r)}cleanup(E){let T=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return T?XH(T):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(XH)}updateCleanup(E,T){let _=this.cleanup(E);if(!_)throw Error("Cleanup plan was not found.");let r={..._,...T};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[r.status,r.confirmation??null,JSON.stringify(r.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[T,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,_,_]),this.drill(T)}drill(E){let T=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return T?JH(T):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(JH)}updateDrill(E,T){let _=this.drill(E);if(!_)throw Error("DR drill was not found.");let r={..._,...T};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,r.operationId??null,JSON.stringify(r.evidence),r.measuredRpoMinutes??null,r.measuredRtoMinutes??null,r.cleanupVerified?1:0,r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}function p3(E,T=new Date){if(!E.enabled)return!1;let _=new Date(E.schedule);if(!Number.isNaN(_.getTime()))return T>=_&&T.getTime()<=_.getTime()+E.durationMinutes*60000;let r=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!r)return!1;let t=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(T),d=Number(t.find((h)=>h.type==="hour")?.value)*60+Number(t.find((h)=>h.type==="minute")?.value),R=Number(r[1])*60+Number(r[2]);return d>=R&&d<R+E.durationMinutes}class t0{store;now;queue;constructor(E,T,_=()=>new Date){this.store=E;this.now=_;this.queue=T??new lE(E.control)}enqueueCampaign(E,T={}){let _=this.store.campaign(E);if(!_)throw Error("Upgrade campaign was not found.");let r=_.windowId?this.store.window(_.windowId):void 0;if(r&&!r.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(r&&!T.overrideWindow&&!p3(r,this.now()))throw Error("Upgrade is outside its maintenance window.");if(r?.requireApproval&&!T.approvedBy&&!_.approvedBy)throw Error("Maintenance approval is required.");let t=this.queue.enqueue({projectId:_.projectId,actorId:T.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:t}}async previewCleanup(E,T){let _=T.find((r)=>r.kind===E.kind);if(!_)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await _.discover(E.criteria)})}enqueueCleanup(E,T){let _=this.store.cleanup(E);if(!_||_.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(_.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let r=`DELETE ${_.candidates.length} ${_.kind}`;if(T!==r)throw Error(`Exact confirmation ${r} is required.`);let t=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${_.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:T}),operation:t}}enqueueDrill(E){let T=this.store.drill(E);if(!T||T.status!=="planned")throw Error("A planned DR drill is required.");let _=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${T.scenario}:${T.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:_.id}),operation:_}}}var EX=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function zH(E){return{"maintenance.upgrade":async(t)=>{let d=E.store.campaign(String(EX(t.operation.input).campaignId??""));if(!d||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let R=E.store.manifest(d.manifestId);if(!R?.compatibility.compatible||R.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let h=R.document.artifacts.find((N)=>N.platform===process.platform&&N.architecture===process.arch)??R.document.artifacts[0];if(!h)throw Error("No update artifact matches this platform.");E.store.updateCampaign(d.id,{status:"running",currentStage:"preflight"});let S=[];try{for(let N of[...new Set(E.store.targets(d.id).map((A)=>A.cohort))].sort((A,L)=>A-L)){E.store.updateCampaign(d.id,{currentStage:`cohort:${N}`});for(let A of E.store.targets(d.id).filter((L)=>L.cohort===N)){t.throwIfCancellationRequested(),t.checkpoint(`download:${A.target}`,"Downloading signed platform artifact."),E.store.updateTarget(A.id,{status:"downloading",startedAt:new Date().toISOString()});let L=await E.platform.download({target:A,artifact:h,signal:t.signal});if(L.sha256!==h.sha256)throw Error(`Artifact checksum mismatch for ${A.target}.`);t.checkpoint(`install:${A.target}`,"Installing verified artifact."),E.store.updateTarget(A.id,{status:"installing"}),await E.platform.install({target:A,path:L.path,version:R.version,signal:t.signal}),S.push(A);let O=await E.platform.health({target:A,gate:d.healthGate});if(!O.healthy)throw Error(`Upgrade health gate failed for ${A.target}.`);E.store.updateTarget(A.id,{status:"healthy",evidence:O.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(d.id,{status:"succeeded",currentStage:void 0}),{campaignId:d.id,version:R.version,targets:S.length}}catch(N){E.store.updateCampaign(d.id,{status:"rolling_back",currentStage:"rollback"});for(let A of S.reverse())E.store.updateTarget(A.id,{status:"rolling_back"}),await E.platform.rollback({target:A,version:A.previousVersion,signal:t.signal}),E.store.updateTarget(A.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(d.id,{status:"rolled_back",currentStage:void 0}),N}},"maintenance.cleanup":async(t)=>{let d=E.store.cleanup(String(EX(t.operation.input).planId??""));if(!d||d.status!=="approved")throw Error("Approved cleanup plan was not found.");if(ue([...d.candidates].sort((A,L)=>A.id.localeCompare(L.id)))!==d.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let R=E.cleanup?.find((A)=>A.kind===d.kind);if(!R)throw Error(`No ${d.kind} cleanup driver is configured.`);E.store.updateCleanup(d.id,{status:"running"});let h=[],S=[];for(let A of d.candidates){t.throwIfCancellationRequested();try{await R.remove(A),h.push(A.id)}catch(L){S.push({id:A.id,error:L instanceof Error?L.message:String(L)})}}let N=S.length?h.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(d.id,{status:N,result:{removed:h,failed:S,reclaimedBytes:d.candidates.filter((A)=>h.includes(A.id)).reduce((A,L)=>A+L.bytes,0)}}),S.length)throw Error(`Cleanup failed for ${S.length} candidate(s).`);return{planId:d.id,removed:h.length,reclaimedBytes:d.estimatedBytes}},"maintenance.drill":async(t)=>{let d=E.store.drill(String(EX(t.operation.input).drillId??""));if(!d)throw Error("DR drill was not found.");let R=E.recovery?.find((L)=>L.scenario===d.scenario);if(!R)throw Error(`No ${d.scenario} recovery driver is configured.`);let h=new Date;E.store.updateDrill(d.id,{status:"restoring",startedAt:h.toISOString()});let S=d.isolatedTarget,N={},A={};try{t.checkpoint("restore","Restoring into isolated drill target.");let L=await R.restore({drill:d,signal:t.signal});if(!L.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");S=L.target,N=L.evidence;let O=(h.getTime()-new Date(L.recoveryPointAt).getTime())/60000;E.store.updateDrill(d.id,{status:"verifying",measuredRpoMinutes:O,evidence:{restore:N}}),t.checkpoint("verify","Running recovery health checks without production traffic.");let c=await R.verify({drill:d,target:S});A=c.evidence;let U=(Date.now()-h.getTime())/60000;if(!c.healthy||O>d.expectedRpoMinutes||U>d.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(d.id,{measuredRpoMinutes:O,measuredRtoMinutes:U,evidence:{restore:N,verify:A}})}catch(L){throw E.store.updateDrill(d.id,{status:"failed",error:L instanceof Error?L.message:String(L),evidence:{restore:N,verify:A}}),L}finally{E.store.updateDrill(d.id,{status:"cleaning"});try{await R.cleanup({drill:d,target:S});let L=E.store.drill(d.id);E.store.updateDrill(d.id,{status:L.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(L){E.store.updateDrill(d.id,{status:"cleanup_required",cleanupVerified:!1,error:L instanceof Error?L.message:String(L),finishedAt:new Date().toISOString()})}}return{drillId:d.id,status:E.store.drill(d.id).status}}}}var FH={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class d0{kind;control;projectId;organizationId;constructor(E,T,_,r){this.kind=E;this.control=T;this.projectId=_;this.organizationId=r}async discover(E){let T=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),_=new Date(Date.now()-T*86400000).toISOString(),r=FH[this.kind],t=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(r.select).all(t,_).map((R)=>({id:String(R.id),kind:this.kind,label:`${this.kind}:${String(R.id)}`,bytes:Number(R.bytes??0),metadata:{createdAt:String(R.created_at)}}))}async remove(E){if(this.control.database.run(FH[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function o3(){let E=await o(),T=iE(process.cwd(),E),_=new r0(T.store),r=new t0(_),t=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((d)=>new d0(d,T.store,T.project.id,T.organization.id));return{controlPlane:T,store:_,service:r,cleanup:t}}async function Vd(E){let T=await o3();try{await E(T)}catch(_){f(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}function TX(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(T)=>Vd((_)=>{let r={manifests:_.store.manifests(_.controlPlane.organization.id),windows:_.store.windows(_.controlPlane.project.id),campaigns:_.store.campaigns(_.controlPlane.project.id),cleanups:_.store.cleanups(_.controlPlane.project.id),drills:_.store.drills(_.controlPlane.project.id)},t=[...r.manifests.map((d)=>["update",d.version,d.compatibility.compatible?"compatible":"blocked",d.compatibility.reasons.join("; ")||d.channel]),...r.campaigns.map((d)=>["upgrade",d.id,d.status,d.currentStage??d.fromVersion]),...r.cleanups.map((d)=>["cleanup",d.kind,d.status,`${d.candidates.length} items / ${d.estimatedBytes} bytes`]),...r.drills.map((d)=>["DR drill",d.scenario,d.status,d.isolatedTarget])];if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Area","Name / version","Status","Detail"],t)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(T,_)=>Vd(async(r)=>{let t=r.store.addTrustedKey({organizationId:r.controlPlane.organization.id,name:T,publicKeyPem:await Bun.file(_).text()});Z(`Trusted ${t.name}: ${t.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(T,_,r)=>Vd(async(t)=>{let d=await Bun.file(T).json(),R=(await Bun.file(_).text()).trim(),h=t.store.importManifest({organizationId:t.controlPlane.organization.id,keyId:r,document:d,signature:R,current:{schemaVersion:t.controlPlane.store.health().schemaVersion,currentVersion:T0,platform:process.platform,architecture:process.arch}});Z(`Verified ${h.version}; ${h.compatibility.compatible?"compatible":"blocked: "+h.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(T,_,r)=>Vd((t)=>{let d=t.store.createWindow({projectId:t.controlPlane.project.id,name:T,schedule:_,timezone:r.timezone,durationMinutes:Number(r.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});Z(`Created ${d.name} (${d.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(T,_,r)=>Vd((t)=>{let d=new it(t.controlPlane.store).list(t.controlPlane.project.id).filter((S)=>S.status==="ready").map((S)=>({serverId:S.id,target:S.name,previousVersion:S.bootstrapVersion??T0}));if(!d.length)d.push({target:"control-plane",previousVersion:T0});let R=t.store.createCampaign({projectId:t.controlPlane.project.id,manifestId:T,fromVersion:T0,strategy:r.strategy==="rolling"?"rolling":"canary",batchSize:Number(r.batch),healthGate:{kind:"platform"},backupId:_,targets:d}),h=t.service.enqueueCampaign(R.id);Z(`Staged upgrade queued: ${h.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(T,_)=>Vd(async(r)=>{let t=await r.service.previewCleanup({projectId:r.controlPlane.project.id,kind:T,criteria:{olderThanDays:Number(_.olderThan)}},r.cleanup);EE(["ID","Candidate","Bytes"],t.candidates.map((d)=>[d.id,d.label,String(d.bytes)])),e(`Apply with: cloud cleanup:apply ${t.id} --confirm "DELETE ${t.candidates.length} ${t.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(T,_)=>Vd((r)=>{let t=r.service.enqueueCleanup(T,String(_.confirm??""));Z(`Cleanup queued: ${t.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(T,_,r)=>Vd((t)=>{let d=t.store.createDrill({projectId:t.controlPlane.project.id,scenario:T,isolatedTarget:_,expectedRpoMinutes:Number(r.rpo),expectedRtoMinutes:Number(r.rto),recoveryPointId:r.recoveryPoint,topologyId:r.topology});Z(`Planned isolated drill ${d.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(T)=>Vd((_)=>{let r=_.service.enqueueDrill(T);Z(`DR drill queued: ${r.operation.id}`)}))}QE();kR();Br();async function _X(){try{return(await o()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function rX(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(T)=>{b("Lambda Functions");let _=T?.region||await _X(),r=new FT(_);try{let{Functions:t=[]}=await r.listFunctions({MaxItems:50});if(!t.length){e("No functions found");return}EE(["Name","Runtime","Memory","Timeout","Last Modified"],t.map((d)=>[d.FunctionName??"-",d.Runtime??"-",d.MemorySize?`${d.MemorySize} MB`:"-",d.Timeout?`${d.Timeout}s`:"-",d.LastModified??"-"]))}catch(t){f(`Failed to list functions: ${t.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(T,_)=>{b(`Invoking ${T}`);let r=_?.region||await _X(),t=new FT(r),d=new v("Invoking function...");d.start();try{let R=await t.invoke({FunctionName:T,InvocationType:_?.async?"Event":"RequestResponse",Payload:_?.payload||"{}",LogType:_?.async?"None":"Tail"});if(R.FunctionError){if(d.fail(`Function returned an error (${R.FunctionError})`),R.Payload)e(R.Payload);process.exitCode=1;return}if(d.succeed(`Invoked (status ${R.StatusCode})`),R.Payload)e(`
+`).find((t)=>t&&!t.startsWith("#"))?.trim().split(/\s+/);if(_.code!==0||!r?.[1]||!r[2])throw Error(`SSH host-key scan failed: ${_.stderr.trim()||"no key returned"}`);return{algorithm:r[1],key:r[2]}}async exec(E,T){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return oW(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,T])}}var Y3=(E)=>`SHA256:${H3("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,f3=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class fd{provider;transport;discoverer;constructor(E,T=new EH,_){this.provider=E;this.transport=T;this.discoverer=_}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let T=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:T.algorithm,hostKeyFingerprint:Y3(T.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let T=await this.transport.exec(E,f3);if(T.code!==0)throw Error(`Fleet validation failed: ${T.stderr.trim()||T.code}`);try{return JSON.parse(T.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,T){let _=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${T.length}`);if(_.code!==0)throw Error(`Fleet bootstrap failed: ${_.stderr.trim()||_.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function TH(E,T){return{"fleet.bootstrap":async(_)=>{let r=_.operation.input&&typeof _.operation.input==="object"&&!Array.isArray(_.operation.input)?_.operation.input:{},t=E.get(String(r.serverId??""));if(!t)throw Error("Queued fleet server was not found.");let d=T.find((S)=>S.provider===t.provider);if(!d)throw Error(`No ${t.provider} fleet driver is configured.`);let R=Array.isArray(r.steps)?r.steps.map(String):[];if(_.checkpoint("preflight","Rechecking pinned trust and healthy validation."),t.trustState!=="pinned"||!t.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");_.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let h=await d.bootstrap(t,R);return E.update(t.id,{bootstrapVersion:h.version,status:"ready"}),_.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:t.id,bootstrapVersion:h.version,steps:R.length}}}}var lt=(E)=>E==null?void 0:String(E),bh=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},kC=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:lt(E.provider_id),region:lt(E.region),zone:lt(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:lt(E.host_key_algorithm),hostKeyFingerprint:lt(E.host_key_fingerprint),pendingHostKey:lt(E.pending_host_key),roles:bh(E.roles,[]),labels:bh(E.labels,{}),taints:bh(E.taints,[]),capacity:bh(E.capacity,{}),usage:bh(E.usage,{}),capabilities:bh(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:bh(E.validation,void 0),bootstrapVersion:lt(E.bootstrap_version),heartbeatAt:lt(E.heartbeat_at),lastSeenAt:lt(E.last_seen_at),archivedAt:lt(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class it{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}get(E){let T=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return T?kC(T):void 0}list(E,T=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(kC).filter((_)=>T||_.status!=="archived")}findProvider(E,T,_){let r=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,T,_);return r?kC(r):void 0}create(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,_,_]),this.get(T)}update(E,T){let _=this.get(E);if(!_)throw Error("Server was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[r.name,r.providerId??null,r.region??null,r.zone??null,r.endpoint,r.sshUser,r.sshPort,r.credentialRef,r.hostKeyAlgorithm??null,r.hostKeyFingerprint??null,r.pendingHostKey??null,JSON.stringify(r.roles),JSON.stringify(r.labels),JSON.stringify(r.taints),JSON.stringify(r.capacity),JSON.stringify(r.usage),JSON.stringify(r.capabilities),r.status,r.trustState,JSON.stringify(r.validation??{}),r.bootstrapVersion??null,r.heartbeatAt??null,r.lastSeenAt??null,r.archivedAt??null,t,E]),this.get(E)}}var G3=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class lL{store;drivers;now;queue;constructor(E,T,_,r=()=>new Date){this.store=E;this.drivers=T;this.now=r;this.queue=_??new lE(E.control)}driver(E){let T=this.drivers.find((_)=>_.provider===E);if(!T)throw Error(`No ${E} fleet driver is configured.`);return T}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!G3.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let T=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(T)return this.store.update(T.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let _=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),r=this.driver(E.provider);return this.store.create({...E,resourceId:_.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:r.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let _=await this.driver(T.provider).test(T);if(!_.reachable)return this.store.update(E,{status:"unreachable"});if(T.hostKeyFingerprint&&T.hostKeyFingerprint!==_.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:_.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:_.hostKeyAlgorithm,hostKeyFingerprint:_.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,T){let _=this.store.get(E);if(!_||_.pendingHostKey!==T)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:T,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let T=this.store.get(E);if(!T||T.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let _=await this.driver(T.provider).validate(T),r=[];if(!["x64","arm64","x86_64","aarch64"].includes(_.arch??""))r.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let R of["curl","tar"])if(!_.tools?.[R])r.push({code:`tool.${R}`,severity:"error",message:`${R} is missing.`,remediation:`Install ${R} before bootstrap.`});if(Math.abs(_.timeSkewSeconds??0)>60)r.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!_.dnsOk)r.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let t={valid:!r.some((R)=>R.severity==="error"),facts:_,findings:r,validatedAt:this.now().toISOString(),validatorVersion:"1"},d={cpu:_.cpuCores??0,memoryBytes:_.memoryBytes??0,diskBytes:_.diskBytes??0};return this.store.update(E,{validation:t,capacity:d,status:t.valid?"ready":"degraded"})}bootstrap(E,T=!1){let _=this.store.get(E);if(!_?.validation?.valid)throw Error("A healthy validation report is required.");let r=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!T)return{preview:!0,steps:r};let t=this.queue.enqueue({projectId:_.projectId,resourceId:_.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:r},lockKey:`server:${E}`,providerKey:_.provider}).operation;return{preview:!1,steps:r,operation:t}}heartbeat(E,T){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let r=this.now().toISOString();return this.store.update(E,{usage:T.usage,capabilities:T.capabilities??_.capabilities,heartbeatAt:r,lastSeenAt:r,status:_.status==="draining"||_.status==="drained"?_.status:"ready"})}drain(E,T=!1){return this.store.update(E,{status:T?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,T){let _=this.store.get(E);if(!_||T!==_.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function Q3(){let E=await o(),T=iE(process.cwd(),E),_=new it(T.store),r=new lL(_,[new fd("aws"),new fd("hetzner"),new fd("ssh")]);return{controlPlane:T,store:_,service:r}}async function Gd(E){let T=await Q3();try{return await E(T)}finally{T.controlPlane.store.close()}}var kh=(E,T)=>{let _=E.store.list(E.controlPlane.project.id).find((r)=>r.id===T||r.name===T);if(!_)throw Error(`Server ${T} was not found.`);return _},or=(E)=>{f(E instanceof Error?E.message:String(E)),process.exitCode=1};function uC(E,T){let _=Number.parseInt(E??"",10);return Number.isFinite(_)&&_>=0?_:T}function M3(E="3h"){let T=E.match(/^(\d+)(m|h)$/);if(!T)throw Error("--range must use minutes or hours, for example 30m or 3h.");let _=Number(T[1])*(T[2]==="h"?3600000:60000);if(_<300000||_>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return _}function iL(E,T="%"){return E==null?"unavailable":`${E.toFixed(1)}${T}`}async function V3(E,T){let _=await o();if(_.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let r=T.env??process.env.CLOUD_ENV??"production",t=DT(_,r),d=await It(t);if(!d?.serverId)throw Error(`No pinned Hetzner server was found for ${t}.`);if(![d.serverName,String(d.serverId),d.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${d.serverName}.`);let R=CN(_),h=new Pd({apiToken:MR(R.apiToken,_)}),S=await h.getServer(d.serverId),N=d.publicIp??S.public_net.ipv4?.ip;if(!N)throw Error(`Server ${S.name} has no public IPv4 address.`);let A=new Date,L=new Date(A.getTime()-M3(T.range)),O=Math.min(3600,Math.max(60,uC(T.step,60))),c=await ZW({client:h,serverId:S.id,cores:Math.max(1,Number(S.server_type.cores)||1),from:L,to:A,step:O,remote:{host:N,user:d.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15}});if(T.json){console.log(JSON.stringify({schemaVersion:1,server:S.name,result:c},null,2));return}EE(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[S.name,`${c.from} to ${c.to}`,`${iL(c.summary.cpuAveragePercent)} / ${iL(c.summary.cpuPeakPercent)}`,`${iL(c.summary.memoryAveragePercent)} / ${iL(c.summary.memoryPeakPercent)}`,c.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(c.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,iL(c.summary.swapPeakPercent)]])}function _H(E){let T=E.targetType.prices?.find((_)=>_.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:T?{hourlyNet:T.price_hourly.net,hourlyGross:T.price_hourly.gross,monthlyNet:T.price_monthly.net,monthlyGross:T.price_monthly.gross}:void 0}}function K3(E){let T=_H(E);EE(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${T.serverName} (${T.serverId})`,T.location,`${T.from} -> ${T.to}`,T.capacityAvailable?"available":"waiting",`${T.target.cores??0} / ${T.target.memoryGb??0} GB / ${T.target.diskGb??0} GB`,T.price?.monthlyGross??T.price?.monthlyNet??"not reported"]])}async function Z3(E,T,_){let r=await o();if(r.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let t=_.env??process.env.CLOUD_ENV??"production",d=DT(r,t),R=await It(d),h=CN(r),S=new Pd({apiToken:MR(h.apiToken,r)}),A=R&&(E===R.serverName||E===String(R.serverId)||E===R.stackName)?await S.getServer(R.serverId):(await S.listServers()).find((H)=>H.name===E||String(H.id)===E);if(!A)throw Error(`Hetzner server ${E} was not found.`);if(R?.serverId&&R.serverId!==A.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${R.serverId}.`);let L=Wd(T),O=_.upgradeDisk!==!1,c=await vL(S,A.id,L,O);if(_.json)console.log(JSON.stringify({schemaVersion:1,plan:_H(c)},null,2));else K3(c);if(!_.apply){if(!_.json)e(`Preview only. Re-run with --apply --confirm ${A.name} to execute.`);return}if(_.confirm!==A.name)throw Error(`Resize requires --confirm ${A.name}.`);let U=R?.publicIp??A.public_net.ipv4?.ip;if(!U)throw Error(`Server ${A.name} has no public IPv4 address for verification.`);let $={host:U,user:R?.sshUser??h.sshUser,identityFile:h.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},I=await qC(d),w=new Date().toISOString(),z={schemaVersion:1,operationId:I?.targetType===L&&I.serverId===A.id?I.operationId:crypto.randomUUID(),stackName:d,serverId:A.id,serverName:A.name,sourceType:c.currentType.name,targetType:L,upgradeDisk:O,phase:"planning",status:"running",attempts:I?.targetType===L?I.attempts:0,startedAt:I?.targetType===L?I.startedAt:w,updatedAt:w,manifest:I?.targetType===L?I.manifest:void 0};await Yd(z);let F=uC(_.pollSeconds,900)*1000,j=uC(_.maxWaitMinutes,0)*60000,Y=Date.now();for(;;){let H=await vL(S,A.id,L,O);if(!H.capacityAvailable&&!H.alreadyComplete){if(z={...z,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await Yd(z),!_.wait){if(!_.json)e(`${L} has no capacity in ${H.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(j>0&&Date.now()-Y>=j)throw Error(`Timed out waiting for ${L} capacity in ${H.location}.`);if(!_.json)e(`Waiting ${Math.round(F/1000)} seconds for ${L} capacity...`);await Bun.sleep(F);continue}let Q=await xC(d);try{let K=await(async()=>{try{return z={...z,status:"running",attempts:z.attempts+1,updatedAt:new Date().toISOString()},await Yd(z),await QC({client:S,serverId:A.id,targetType:L,upgradeDisk:O,resumeFromOff:z.phase==="shutting-down"||z.phase==="resizing"||z.phase==="powering-on"||z.phase==="verifying",manifest:z.manifest,hooks:{preflight:async()=>{let x=await VC($);return z={...z,manifest:x,updatedAt:new Date().toISOString()},await Yd(z),x},afterBoot:async(x,k,n,TE)=>KC($,k,n,TE),onPhase:async(x,k)=>{if(z={...z,phase:x,status:x==="waiting-capacity"?"waiting-capacity":x==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await Yd(z),!_.json)e(`${x}${k?` ${JSON.stringify(k)}`:""}`)}}})}finally{await Q()}})();if(z={...z,status:K.status==="completed"||K.status==="already-complete"?"completed":K.status==="recovered"?"recovered":"waiting-capacity",lastError:K.status==="recovered"?K.error:void 0,updatedAt:new Date().toISOString()},await Yd(z),_.json)console.log(JSON.stringify({schemaVersion:1,result:K},null,2));else if(K.status==="completed"||K.status==="already-complete")Z(`${A.name} is on ${L} and passed full post-boot verification.`);else if(K.status==="recovered"&&K.retryable&&_.wait){e(`Capacity race recovered safely. Waiting ${Math.round(F/1000)} seconds before retry.`),await Bun.sleep(F);continue}else if(K.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${K.error}`);return}catch(K){throw z={...z,status:"failed",lastError:K instanceof Error?K.message:String(K),updatedAt:new Date().toISOString()},await Yd(z),K}}}async function g3(E,T){let _=await o();if(_.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let r=T.env??process.env.CLOUD_ENV??"production",t=DT(_,r),d=await It(t);if(!d?.serverId)throw Error(`No pinned Hetzner server was found for ${t}.`);if(![d.serverName,String(d.serverId),d.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${d.serverName}.`);let R=CN(_),h=new Pd({apiToken:MR(R.apiToken,_)}),S=await h.getServer(d.serverId),N=d.publicIp??S.public_net.ipv4?.ip;if(!N)throw Error(`Server ${S.name} has no public IPv4 address.`);let A=Ze(_);if(T.json)console.log(JSON.stringify({schemaVersion:1,server:S.name,plan:A},null,2));else EE(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[S.name,A.firewallPorts.join(","),A.monitoring?"on":"off",A.autoUpdates?"on":"off",`${A.swapGb} GB`,"disabled"]]);if(!T.apply){if(!T.json)e(`Preview only. Re-run with --apply --confirm ${S.name} to execute.`);return}if(T.confirm!==S.name)throw Error(`Optimization requires --confirm ${S.name}.`);let L={host:N,user:d.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15},O=await BN(L),c=O.routeProbes.filter((n)=>!n.ok),U=_.infrastructure?.compute,$=Ar(U)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,I=O.failedUnits.filter((n)=>!$.has(n));if(I.length>0)throw Error(`Preflight found failed services: ${I.join(", ")}`);if(c.length>0)throw Error(`Preflight found unhealthy routes: ${c.map((n)=>n.domain).join(", ")}`);let w=Ar(U)?[]:Object.values(_.sites??{}).flatMap((n)=>typeof n?.port==="number"&&![80,443].includes(n.port)?[n.port]:[]),z=zN({allowSsh:U?.allowSsh!==!1,sitePorts:w,allowedPorts:U?.firewall?.allowedPorts}),F=(d.firewallId?(await h.listFirewalls()).find((n)=>n.id===d.firewallId):void 0)??(await h.listFirewalls()).find((n)=>n.name===`${_.project.slug}-${r}-app-fw`);if(!F)throw Error(`Managed firewall for ${S.name} was not found.`);let j=await h.setFirewallRules(F.id,z);await Promise.all(j.map((n)=>h.waitForAction(n.id))),await BC(_,L);let[Y,H]=await Promise.all([BN(L),PC(L)]),Q=WC(A,H),K=uW(O,Y),x=Y.routeProbes.filter((n)=>!n.ok);if(K.stoppedServices.length>0)Q.push(`services stopped: ${K.stoppedServices.join(", ")}`);if(K.changedRouteFragments.length>0)Q.push(`route fragments changed: ${K.changedRouteFragments.join(", ")}`);if(K.missingRouteIds.length>0)Q.push(`routes disappeared: ${K.missingRouteIds.join(", ")}`);if(K.changedReleaseLinks.length>0)Q.push(`release links changed: ${K.changedReleaseLinks.join(", ")}`);if(K.missingData.length>0)Q.push(`databases or volumes disappeared: ${K.missingData.join(", ")}`);if(x.length>0)Q.push(`unhealthy routes: ${x.map((n)=>n.domain).join(", ")}`);if(Q.length>0)throw Error(`Host optimization verification failed: ${Q.join("; ")}`);let k={serverId:S.id,serverName:S.name,services:Y.runningServices.length,routes:Y.routeIds.length,healthyDomains:Y.routeProbes.length,releaseLinks:Y.releaseLinks.length,databasesAndVolumes:Y.dataCatalog.length,report:H};if(T.json)console.log(JSON.stringify({schemaVersion:1,result:k},null,2));else Z(`${S.name} passed full host, rpx route, service, release, and data verification.`)}function nC(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(T,_)=>{try{await Gd(async(r)=>{let t=T?[kh(r,T)]:r.store.list(r.controlPlane.project.id),d=t.flatMap((R)=>Object.entries(R.capabilities).map(([h,S])=>({server:R.name,provider:R.provider,action:h,...S})));if(_.json)console.log(JSON.stringify({schemaVersion:1,targets:d},null,2));else EE(["Server","Provider","Action","Support","Explanation"],d.map((R)=>[R.server,R.provider,R.action,R.supported?"supported":"unsupported",R.reason??"—"]))})}catch(r){or(r)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(T,_,r)=>{try{await Z3(T,_,r)}catch(t){or(t)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(T,_)=>{try{await g3(T,_)}catch(r){or(r)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(T,_)=>{try{await V3(T,_)}catch(r){or(r)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(T)=>{try{await Gd(async(_)=>{let r=_.store.list(_.controlPlane.project.id);if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],r.map((t)=>[t.name,t.providerId??"—",`${t.provider} / ${t.region??"external"}`,`${t.status} / ${t.trustState}`,t.roles.join(","),`${t.capacity.cpu??0} / ${t.capacity.memoryBytes??0}`,t.heartbeatAt??"never"]))})}catch(_){or(_)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(T,_)=>{try{await Gd(async(r)=>{let t=_.provider;if(!["aws","hetzner","ssh"].includes(t)||!_.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let d=r.service.enroll({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:T,provider:t,providerId:_.providerId,endpoint:_.endpoint,sshUser:_.user??"deploy",credentialRef:_.credentialRef??"secret://fleet/agent",region:_.region,roles:String(_.roles??"application").split(","),labels:Object.fromEntries(String(_.labels??"").split(",").map((R)=>R.split("=")).filter((R)=>R[0]&&R[1]))});Z(`Enrolled ${d.name} as ${d.id}; no remote mutation was performed.`)})}catch(r){or(r)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(T,_)=>{try{await Gd(async(r)=>{let t=kh(r,T);if(t=await r.service.test(t.id),t.trustState==="rotation_pending"){if(!_.acceptHostKey)throw Error(`Host key changed to ${t.pendingHostKey}; review it first.`);t=r.service.reviewHostKey(t.id,_.acceptHostKey)}let d=await r.service.validate(t.id);if(_.json)console.log(JSON.stringify(d.validation,null,2));else EE(["Severity","Code","Finding","Remediation"],(d.validation?.findings??[]).map((R)=>[R.severity,R.code,R.message,R.remediation??"—"]));if(!d.validation?.valid)process.exitCode=1})}catch(r){or(r)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(T,_)=>{try{await Gd(async(r)=>{let t=r.service.bootstrap(kh(r,T).id,!!_.apply);if(t.preview)EE(["Step"],t.steps.map((d)=>[d]));else Z(`Bootstrap queued: ${t.operation?.id}`)})}catch(r){or(r)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(T,_)=>{try{await Gd(async(r)=>Z(r.service.drain(kh(r,T).id,!!_.complete).status))}catch(r){or(r)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(T)=>{try{await Gd(async(_)=>{_.service.uncordon(kh(_,T).id),Z(`Uncordoned ${T}.`)})}catch(_){or(_)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(T,_)=>{try{await Gd(async(r)=>{r.service.archive(kh(r,T).id,_.confirm??""),Z(`Archived ${T}; provider infrastructure was not terminated.`)})}catch(r){or(r)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(T)=>{try{await Gd(async(_)=>{let r=kh(_,T);if(r.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let t=Bun.spawn(["ssh","-p",String(r.sshPort),"-o","StrictHostKeyChecking=yes",`${r.sshUser}@${r.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),d=await t.exited;if(d)process.exitCode=d})}catch(_){or(_)}});for(let[T,_]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(T,_).action(async(...r)=>ar(T.split(" ")[0],{target:String(r[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}QE();var wt=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},Lr=(E)=>E==null?void 0:String(E),dH=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),WN=(E={})=>({...dH(),...E});function rH(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:Lr(E.region),architecture:Lr(E.architecture),labels:wt(E.labels,{}),requiredServerLabels:wt(E.required_server_labels,{}),toleratedTaints:wt(E.tolerated_taints,[]),capacity:WN(wt(E.capacity,{})),reserved:wt(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:Lr(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function tH(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Lr(E.environment_id),resourceId:String(E.resource_id),releaseId:Lr(E.release_id),poolId:String(E.pool_id),serverId:Lr(E.server_id),purpose:String(E.purpose),requirements:wt(E.requirements,{}),decision:wt(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function q3(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:Lr(E.resource_id),poolId:String(E.pool_id),placementId:Lr(E.placement_id),operationId:Lr(E.operation_id),sourceSha:String(E.source_sha),buildSpec:wt(E.build_spec,{}),credentialPolicy:wt(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:Lr(E.workspace),cacheKey:Lr(E.cache_key),artifactUri:Lr(E.artifact_uri),artifactDigest:Lr(E.artifact_digest),status:String(E.status),cleanupAt:Lr(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class aL{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}createPool(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(WN(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,_,_]),this.getPool(T)}getPool(E){let T=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return T?rH(T):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(rH)}updatePool(E,T){let _=this.getPool(E);if(!_)throw Error("Capacity pool was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.reserved),JSON.stringify(r.capacity),r.concurrency,t,E]),this.getPool(E)}addMember(E,T,_={}){let r=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,T,JSON.stringify(_),r,r])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((T)=>({serverId:String(T.server_id),status:String(T.status),capacityOverride:wt(T.capacity_override,{})}))}memberStatus(E,T,_){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[_,this.now().toISOString(),E,T])}listPlacements(E,T){let _=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(tH);return T?.length?_.filter((r)=>T.includes(r.status)):_}getPlacement(E){let T=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return T?tH(T):void 0}activeUsage(E,T){let _=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),r=T?_.filter((t)=>String(t.server_id)===T):_;return{resources:r.reduce((t,d)=>{let R=WN(wt(d.resources,{}));for(let h of Object.keys(t))t[h]+=R[h];return t},dH()),count:r.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let T=this.id(),_=this.id(),r=this.now().toISOString(),t=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[T,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,r,r]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[_,T,E.decision.poolId,E.decision.serverId??null,JSON.stringify(WN(E.requirements.resources)),t,r,r]),this.getPlacement(T)})}transitionPlacement(E,T){if(!this.getPlacement(E))throw Error("Placement was not found.");let r=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[T,r,E]),["released","failed","blocked"].includes(T))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[r,E]);return this.getPlacement(E)}createBuild(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[T,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),_,_]),this.getBuild(T)}getBuild(E){let T=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return T?q3(T):void 0}updateBuild(E,T){let _=this.getBuild(E);if(!_)throw Error("Remote build was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[r.operationId??null,r.workspace??null,r.cacheKey??null,r.artifactUri??null,r.artifactDigest??null,r.status,r.cleanupAt??null,t,E]),this.getBuild(E)}}var be=["cpu","memoryBytes","diskBytes","gpu"],RH=(E,T={})=>Object.entries(T).every(([_,r])=>E[_]===r),x3=(E,T,_)=>Object.fromEntries(be.map((r)=>[r,Math.max(0,E[r]-T[r]-(_[r]??0))])),b3=(E,T)=>be.every((_)=>E[_]>=(T[_]??0)),k3=(E,T)=>be.reduce((_,r)=>_+(T[r]??0)/(E[r]||1),0);class mL{store;fleet;constructor(E,T){this.store=E;this.fleet=T}poolCandidates(E,T,_){let r=[];for(let t of this.store.listPools(E)){if(t.id===_)continue;let d=[];if(t.status!=="active")d.push(`pool is ${t.status}`);if(t.purpose!==T.purpose)d.push(`purpose is ${t.purpose}`);if(T.region&&t.region!==T.region)d.push(`region is ${t.region??"unset"}`);if(T.architecture&&t.architecture!==T.architecture)d.push(`architecture is ${t.architecture??"unset"}`);if(!RH(t.labels,T.labels))d.push("pool labels do not match");if(t.backend==="server"){let R=this.store.members(t.id);if(!R.length)r.push(this.decision(t,void 0,T,[...d,"pool has no servers"]));for(let h of R){let S=this.fleet.get(h.serverId),N=[...d];if(!S)N.push("server is missing");else this.serverReasons(t,S,h.status,T,N);r.push(this.decision(t,S,T,N,h.capacityOverride))}}else r.push(this.decision(t,void 0,T,d))}return r.sort((t,d)=>Number(d.eligible)-Number(t.eligible)||t.score.cost-d.score.cost||t.score.spread-d.score.spread||t.score.fit-d.score.fit||t.poolName.localeCompare(d.poolName)||(t.serverId??"").localeCompare(d.serverId??""))}serverReasons(E,T,_,r,t){if(_!=="active")t.push(`member is ${_}`);if(T.status!=="ready")t.push(`server is ${T.status}`);if(!T.roles.includes(r.purpose==="build"?"build":r.purpose))t.push(`server lacks ${r.purpose} role`);if(!RH(T.labels,E.requiredServerLabels))t.push("server labels do not match pool selector");for(let d of T.taints)if(!E.toleratedTaints.includes(d))t.push(`taint ${d} is not tolerated`)}decision(E,T,_,r,t={}){let d=WN({...T?.capacity,...t}),R=T?Object.fromEntries(be.map((N)=>[N,Math.min(E.capacity[N],d[N])])):E.capacity,h=this.store.activeUsage(E.id,T?.id),S=x3(R,h.resources,E.reserved);if(h.count>=E.maxWorkloads)r.push("workload limit reached");if(_.purpose==="build"&&h.count>=E.concurrency)r.push("build concurrency reached");if(!b3(S,_.resources))r.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:T?.id,eligible:r.length===0,reasons:r,available:S,score:{fit:k3(S,_.resources),spread:h.count,cost:E.costWeight}}}explain(E,T){return this.poolCandidates(E,T)}place(E){return this.store.control.transaction(()=>{let T=this.poolCandidates(E.projectId,E.requirements).find((_)=>_.eligible);if(!T)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((_)=>_.reasons).join("; ")}`);return this.store.reserve({...E,decision:T})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let T=this.store.updatePool(E,{status:"draining"}),_=[],r=[];for(let t of this.store.listPlacements(T.projectId,["reserved","active"]).filter((d)=>d.poolId===E)){if(t.stateful){r.push(this.store.transitionPlacement(t.id,"blocked"));continue}this.store.transitionPlacement(t.id,"moving");let d=this.place({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,releaseId:t.releaseId,requirements:t.requirements});_.push(this.activate(d.id)),this.store.transitionPlacement(t.id,"released")}return{pool:T,moved:_,blocked:r}}drainServer(E,T){this.store.memberStatus(E,T,"draining");let _=this.store.getPool(E);if(!_)throw Error("Capacity pool was not found.");let r=[],t=[];for(let d of this.store.listPlacements(_.projectId,["reserved","active"]).filter((R)=>R.poolId===E&&R.serverId===T)){if(d.stateful){t.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"moving");let R=this.poolCandidates(d.projectId,d.requirements).find((S)=>S.eligible);if(!R){t.push(this.store.transitionPlacement(d.id,"blocked"));continue}let h=this.store.reserve({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements,decision:R});r.push(this.activate(h.id)),this.store.transitionPlacement(d.id,"released")}return{moved:r,blocked:t}}reconcileFailure(E){let T=this.fleet.get(E);if(!T)throw Error("Server was not found.");let _=[],r=[];for(let t of this.store.listPlacements(T.projectId,["active"]).filter((d)=>d.serverId===E)){if(t.stateful||!t.autoReschedule){r.push(this.store.transitionPlacement(t.id,"blocked"));continue}this.store.transitionPlacement(t.id,"failed");let d=this.place({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,releaseId:t.releaseId,requirements:t.requirements});_.push(this.activate(d.id))}return{rescheduled:_,blocked:r}}}async function u3(){let E=await o(),T=iE(process.cwd(),E),_=new aL(T.store),r=new mL(_,new it(T.store));return{controlPlane:T,store:_,service:r}}async function sL(E){let T=await u3();try{await E(T)}catch(_){f(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}var ke=(E)=>Object.fromEntries(String(E??"").split(",").map((T)=>T.split("=")).filter((T)=>T[0]&&T[1])),hH=(E)=>Object.fromEntries(Object.entries(ke(E)).map(([T,_])=>[T,Number(_)]));function vC(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(T)=>sL((_)=>{let r=_.store.listPools(_.controlPlane.project.id);if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],r.map((t)=>[t.name,t.purpose,t.backend,`${t.region??"any"} / ${t.architecture??"any"}`,t.status,JSON.stringify(t.capacity),String(t.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(T,_)=>sL((r)=>{let{purpose:t,backend:d}=_;if(!["application","build","worker","monitoring","backup"].includes(t)||!["server","ecs","asg"].includes(d))throw Error("Unsupported pool purpose or backend.");let R=r.store.createPool({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:T,purpose:t,backend:d,region:_.region,architecture:_.arch,labels:ke(_.labels),requiredServerLabels:ke(_.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...hH(_.capacity)},maxWorkloads:Number(_.max),costWeight:1,concurrency:Number(_.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});Z(`Created ${R.name} (${R.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(T,_)=>sL((r)=>{let t=r.store.listPools(r.controlPlane.project.id).find((R)=>R.id===T||R.name===T),d=new it(r.controlPlane.store).list(r.controlPlane.project.id).find((R)=>R.id===_||R.name===_);if(!t||!d)throw Error("Pool or server was not found.");r.store.addMember(t.id,d.id),Z(`Attached ${d.name} to ${t.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(T)=>sL((_)=>{let r=_.service.explain(_.controlPlane.project.id,{purpose:T.purpose,resources:hH(T.resources),region:T.region,architecture:T.arch,labels:ke(T.labels)});if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],r.map((t)=>[t.poolName,t.serverId??"provider-managed",t.eligible?"yes":"no",JSON.stringify(t.available),`${t.score.fit.toFixed(2)} / ${t.score.spread} / ${t.score.cost}`,t.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(T)=>sL((_)=>{let r=_.store.listPools(_.controlPlane.project.id).find((d)=>d.id===T||d.name===T);if(!r)throw Error("Pool was not found.");let t=_.service.drainPool(r.id);Z(`Draining ${r.name}: moved ${t.moved.length}, blocked ${t.blocked.length} stateful placement(s).`)}))}QE();var Qd=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},Et=(E)=>E==null?void 0:String(E),SH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:Et(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:Qd(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:Qd(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:Et(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),lC=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:Et(E.stack_id),stackRevision:Et(E.stack_revision),status:String(E.status),health:Qd(E.health,{}),lastHealthyAt:Et(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),iC=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:Qd(E.config,{}),status:String(E.status),checkpoint:Et(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:Et(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),aC=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:Qd(E.weights,{}),desiredWeights:Qd(E.desired_weights,{}),status:String(E.status),providerState:Qd(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),NH=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:Et(E.operation_id),kind:String(E.kind),requestedRegion:Et(E.requested_region),revision:Et(E.revision),plan:Qd(E.plan,[]),currentStep:Et(E.current_step),completedSteps:Qd(E.completed_steps,[]),status:String(E.status),error:Et(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class pL{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((d)=>d.region)).size!==E.regions.length||E.regions.filter((d)=>d.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let T=E.regions.find((d)=>d.role==="primary"),_=this.id(),r=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[_,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,T.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),T.region,r,r]);for(let d of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),_,d.region,d.role,d.provider,r,r]);for(let d of E.dataPolicy.replicate)for(let R of E.regions)for(let h of E.regions.filter((S)=>S.region!==R.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),_,d,R.region,h.region,"{}",r,r]);let t=Object.fromEntries(E.regions.map((d)=>[d.region,d.region===T.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),_,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(t),JSON.stringify(t),r,r]),this.get(_)})}get(E){let T=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return T?SH(T):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(SH)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map(lC)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(iC)}route(E){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return T?aC(T):void 0}updateTopology(E,T){let _=this.get(E);if(!_)throw Error("Regional topology was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[r.status,r.activeRegion,r.revision??null,JSON.stringify(r.regions),t,E]),this.get(E)}updateTarget(E,T){let _=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!_)throw Error("Regional target was not found.");let r=lC(_),t={...r,...T},d=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[t.role,t.stackId??null,t.stackRevision??null,t.status,JSON.stringify(t.health),t.lastHealthyAt??null,d,E]),lC(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,T){let _=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!_)throw Error("Replication channel was not found.");let r=iC(_),t={...r,...T},d=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[t.status,t.checkpoint??null,t.lagSeconds??null,t.lastVerifiedAt??null,d,E]),iC(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,T){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!_)throw Error("Traffic route was not found.");let r=aC(_),t={...r,...T},d=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(t.weights),JSON.stringify(t.desiredWeights),t.status,JSON.stringify(t.providerState),d,E]),aC(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[T,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),_,_]),this.execution(T)}execution(E){let T=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return T?NH(T):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(NH)}updateExecution(E,T){let _=this.execution(E);if(!_)throw Error("Regional execution was not found.");let r={..._,...T},t=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[r.operationId??null,r.currentStep??null,JSON.stringify(r.completedSteps),r.status,r.error??null,t,E]),this.execution(E)}}class oL{store;queue;constructor(E,T){this.store=E;this.queue=T??new lE(E.control)}create(E){return this.store.create(E)}plan(E,T,_){if(!this.store.get(E))throw Error("Regional topology was not found.");let t=this.store.targets(E),d=this.store.channels(E);if(T==="rollout")return[...t.filter((R)=>R.role==="secondary").map((R)=>`apply:${R.region}`),...t.filter((R)=>R.role==="primary").map((R)=>`apply:${R.region}`),...d.map((R)=>`replicate:${R.kind}:${R.targetRegion}`),"traffic:activate"];if(T==="failover"||T==="failback")return[`health:${_}`,`replication:${_}`,`traffic:${_}`,`roles:${_}`];if(T==="destroy")return["traffic:drain",...t.filter((R)=>R.role==="secondary").map((R)=>`delete:${R.region}`),...t.filter((R)=>R.role==="primary").map((R)=>`delete:${R.region}`),"complete"];return["observe","repair"]}enqueue(E){let T=this.store.get(E.topologyId);if(!T)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!T.regions.some((d)=>d.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===T.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==T.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&T.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let _=this.plan(T.id,E.kind,E.targetRegion),r=this.store.createExecution({topologyId:T.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:_}),t=this.queue.enqueue({projectId:T.projectId,environmentId:T.environmentId,kind:`region.${E.kind}`,input:{executionId:r.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${T.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(r.id,{operationId:t.id}),{execution:this.store.execution(r.id),operation:t}}}var n3=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function AH(E,T){let _=(N)=>{let A=T.find((L)=>L.provider===N.provider);if(!A)throw Error(`No ${N.provider} regional driver is configured.`);return A},r=(N,A,L)=>{N.throwIfCancellationRequested(),N.checkpoint(L,L),E.updateExecution(A.id,{status:"running",currentStep:L,completedSteps:[...E.execution(A.id).completedSteps,L]})},t=async(N,A)=>{let L=E.route(N.id);if(!L)throw Error("Regional traffic route was not found.");let O=E.targets(N.id).find((U)=>U.region===N.activeRegion)??E.targets(N.id)[0];if(!O)throw Error("Regional traffic target was not found.");E.updateRoute(L.id,{status:"applying",desiredWeights:A});let c=await _(O).applyTraffic({route:E.route(N.id),topology:N,weights:A});E.updateRoute(L.id,{status:Object.values(A).every((U)=>U===0)?"drained":"in_sync",weights:A,providerState:c.providerState})},d=async(N,A,L,O)=>{E.updateTopology(L.id,{status:"provisioning"});let c=A.revision,U=O.manifest??{},$=E.targets(L.id).sort((w,z)=>Number(w.role==="primary")-Number(z.role==="primary"));for(let w of $){r(N,A,`apply:${w.region}`),E.updateTarget(w.id,{status:"provisioning"});let z=await _(w).applyStack({target:w,revision:c,manifest:U,signal:N.signal}),F=await _(w).health({target:E.updateTarget(w.id,{stackId:z.stackId,stackRevision:c})});if(!F.healthy)throw Error(`Regional health gate failed in ${w.region}.`);E.updateTarget(w.id,{status:"ready",health:F.evidence,lastHealthyAt:new Date().toISOString()})}for(let w of E.channels(L.id)){r(N,A,`replicate:${w.kind}:${w.targetRegion}`),E.updateChannel(w.id,{status:"configuring"});let z=$.find((Y)=>Y.region===w.sourceRegion),F=await _(z).configureReplication({channel:w,topology:L}),j=await _(z).verifyReplication({channel:E.updateChannel(w.id,{checkpoint:F.checkpoint,lagSeconds:F.lagSeconds}),topology:L});if(!j.healthy||j.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${w.kind} replication to ${w.targetRegion} exceeds the RPO.`);E.updateChannel(w.id,{status:"in_sync",checkpoint:j.checkpoint,lagSeconds:j.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(N,A,"traffic:activate");let I=Object.fromEntries(L.regions.map((w)=>[w.region,w.region===L.activeRegion?100:0]));return await t(L,I),E.updateTopology(L.id,{status:"ready",revision:c}),{revision:c,activeRegion:L.activeRegion}},R=async(N,A,L)=>{let O=A.requestedRegion,c=E.targets(L.id).find((I)=>I.region===O);if(!c)throw Error("Requested regional target was not found.");E.updateTopology(L.id,{status:A.kind==="failover"?"failing_over":"failing_back"}),r(N,A,`health:${O}`);let U=await _(c).health({target:c});if(!U.healthy)throw Error(`Target region ${O} is unhealthy.`);E.updateTarget(c.id,{status:"ready",health:U.evidence,lastHealthyAt:new Date().toISOString()}),r(N,A,`replication:${O}`);for(let I of E.channels(L.id).filter((w)=>w.targetRegion===O)){let w=await _(c).verifyReplication({channel:I,topology:L});if(!w.healthy||w.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${I.kind} replication is outside the failover RPO.`);E.updateChannel(I.id,{status:"in_sync",checkpoint:w.checkpoint,lagSeconds:w.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(N,A,`traffic:${O}`),await t(L,Object.fromEntries(L.regions.map((I)=>[I.region,I.region===O?100:0]))),r(N,A,`roles:${O}`);let $=L.regions.map((I)=>({...I,role:I.region===O?"primary":"secondary"}));for(let I of E.targets(L.id))E.updateTarget(I.id,{role:I.region===O?"primary":"secondary"});return E.updateTopology(L.id,{status:A.kind==="failover"?"failed_over":"ready",activeRegion:O,regions:$}),{activeRegion:O}},h=async(N,A,L,O)=>{E.updateTopology(L.id,{status:"destroying"}),r(N,A,"traffic:drain"),await t(L,Object.fromEntries(L.regions.map((U)=>[U.region,0])));let c=O.deleteData!==!0;for(let U of E.targets(L.id).sort(($,I)=>Number($.role==="primary")-Number(I.role==="primary")))r(N,A,`delete:${U.region}`),E.updateTarget(U.id,{status:"deleting"}),await _(U).deleteStack({target:U,retainData:c,signal:N.signal}),E.updateTarget(U.id,{status:"deleted"});return r(N,A,"complete"),E.updateTopology(L.id,{status:"destroyed"}),{destroyed:!0,dataRetained:c}},S=async(N)=>{let A=n3(N.operation.input),L=E.execution(String(A.executionId??""));if(!L)throw Error("Regional execution was not found.");let O=E.get(L.topologyId);if(!O)throw Error("Regional topology was not found.");try{let c;if(L.kind==="rollout")c=await d(N,L,O,A);else if(L.kind==="failover"||L.kind==="failback")c=await R(N,L,O);else if(L.kind==="destroy")c=await h(N,L,O,A);else throw Error("Regional reconciliation is not configured.");return E.updateExecution(L.id,{status:"succeeded",currentStep:void 0}),{executionId:L.id,...c}}catch(c){if(E.updateExecution(L.id,{status:N.cancellationRequested()?"cancelled":"failed",error:c instanceof Error?c.message:String(c)}),E.get(O.id)?.status!=="destroyed")E.updateTopology(O.id,{status:"failed"});throw c}};return{"region.rollout":S,"region.failover":S,"region.failback":S,"region.destroy":S,"region.reconcile":S}}class mC{provider;reason;constructor(E,T="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=T}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function v3(){let E=await o(),T=iE(process.cwd(),E),_=new pL(T.store),r=new oL(_);return{controlPlane:T,store:_,service:r}}async function uh(E){let T=await v3();try{await E(T)}catch(_){f(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}var E0=(E,T)=>{let _=E.store.list(E.controlPlane.project.id).find((r)=>r.id===T||r.name===T);if(!_)throw Error("Regional topology was not found.");return _},l3=(E)=>E.split(",").map((T,_)=>{let[r,t="aws"]=T.split(":");return{region:String(r),provider:t,role:_===0?"primary":"secondary"}}),i3=(E)=>{let T=new Set(["s3","dynamodb","secrets"]),_=E.split(",").map((t)=>t.trim()),r=_.find((t)=>!T.has(t));if(r)throw Error(`Unsupported replication kind: ${r}`);return _};function sC(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(T)=>uh((_)=>{let r=_.store.list(_.controlPlane.project.id).map((t)=>({topology:t,targets:_.store.targets(t.id),channels:_.store.channels(t.id),route:_.store.route(t.id),executions:_.store.executions(t.id)}));if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Name","Hostname","Active","Status","Revision","Replication"],r.map((t)=>[t.topology.name,t.topology.hostname,t.topology.activeRegion,t.topology.status,t.topology.revision??"—",`${t.channels.filter((d)=>d.status==="in_sync").length}/${t.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(T,_)=>uh((r)=>{if(!_.hostname||!_.regions)throw Error("--hostname and --regions are required.");let t=r.service.create({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:T,hostname:_.hostname,regions:l3(_.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:i3(String(_.replicate)),maxLagSeconds:Number(_.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!_.cdn,wafEnabled:!!_.waf});Z(`Created ${t.name} (${t.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(T,_,r)=>uh((t)=>EE(["Step"],t.service.plan(E0(t,T).id,_,r.target).map((d)=>[d])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(T,_,r)=>uh(async(t)=>{let d=r.manifest?await Bun.file(r.manifest).json():{},R=t.service.enqueue({topologyId:E0(t,T).id,kind:"rollout",revision:_,manifest:d});Z(`Regional rollout queued: ${R.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(T,_)=>uh((r)=>{let t=r.service.enqueue({topologyId:E0(r,T).id,kind:"failover",targetRegion:_});Z(`Failover queued: ${t.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(T,_)=>uh((r)=>{let t=r.service.enqueue({topologyId:E0(r,T).id,kind:"failback",targetRegion:_});Z(`Failback queued: ${t.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(T,_)=>uh((r)=>{let t=r.service.enqueue({topologyId:E0(r,T).id,kind:"destroy",confirmation:_.confirm});Z(`Regional teardown queued: ${t.operation.id}; replicated data remains retained.`)}))}QE();var T0="0.7.88";import{createHash as pC,createPublicKey as cH,verify as m3}from"node:crypto";function _0(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(_0).join(",")}]`;return`{${Object.keys(E).sort().map((T)=>`${JSON.stringify(T)}:${_0(E[T])}`).join(",")}}`}var eH=(E)=>pC("sha256").update(_0(E)).digest("hex"),ue=(E)=>pC("sha256").update(_0(E)).digest("hex"),UH=(E)=>pC("sha256").update(cH(E).export({type:"spki",format:"der"})).digest("hex");function DH(E,T,_){try{return m3(null,Buffer.from(_0(E)),cH(_),Buffer.from(T,"base64"))}catch{return!1}}var LH=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((T)=>Number(T)||0),OH=(E,T)=>{let _=LH(E),r=LH(T);for(let t=0;t<3;t++){let d=(_[t]??0)-(r[t]??0);if(d)return d}return 0};function $H(E,T){let _=[];if(T.schemaVersion<E.minimumSchema)_.push(`schema ${T.schemaVersion} is below ${E.minimumSchema}`);if(T.schemaVersion>E.maximumSchema)_.push(`schema ${T.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&OH(T.currentVersion,E.minimumVersion)<0)_.push(`platform ${T.currentVersion} is below ${E.minimumVersion}`);if(OH(E.version,T.currentVersion)<=0)_.push(`version ${E.version} is not newer than ${T.currentVersion}`);if(!E.artifacts.some((r)=>r.platform===T.platform&&r.architecture===T.architecture))_.push(`no artifact for ${T.platform}/${T.architecture}`);return{compatible:_.length===0,reasons:_}}var Md=(E,T)=>{try{return JSON.parse(String(E))}catch{return T}},F_=(E)=>E==null?void 0:String(E),s3=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:F_(E.revoked_at),createdAt:String(E.created_at)}),IH=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:Md(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:Md(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),wH=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:Md(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),CH=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:F_(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:Md(E.health_gate,{}),status:String(E.status),currentStage:F_(E.current_stage),backupId:F_(E.backup_id),approvedBy:F_(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),oC=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:F_(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:Md(E.evidence,{}),error:F_(E.error),startedAt:F_(E.started_at),finishedAt:F_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),XH=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:Md(E.criteria,{}),candidates:Md(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:F_(E.confirmation),expiresAt:String(E.expires_at),result:Md(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),JH=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:F_(E.backup_policy_id),recoveryPointId:F_(E.recovery_point_id),topologyId:F_(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:F_(E.operation_id),evidence:Md(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:F_(E.error),startedAt:F_(E.started_at),finishedAt:F_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class r0{control;now;id;constructor(E,T=()=>new Date,_=()=>crypto.randomUUID()){this.control=E;this.now=T;this.id=_}addTrustedKey(E){let T=this.id(),_=this.now().toISOString(),r=UH(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[T,E.organizationId,E.name,E.publicKeyPem,r,_]),this.key(T)}key(E){let T=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return T?s3(T):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let T=this.key(E.keyId);if(!T||T.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(T.revokedAt)throw Error("Update signing key is revoked.");if(!DH(E.document,E.signature,T.publicKeyPem))throw Error("Update manifest signature is invalid.");let _=$H(E.document,E.current),r=eH(E.document),t=this.id(),d=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[t,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,r,JSON.stringify(E.document),E.signature,JSON.stringify(_),d]),this.manifest(t)}manifest(E){let T=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return T?IH(T):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(IH)}createWindow(E){let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[T,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,_,_]),this.window(T)}window(E){let T=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return T?wH(T):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(wH)}createCampaign(E){return this.control.transaction(()=>{let T=this.manifest(E.manifestId);if(!T?.compatibility.compatible||T.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let _=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[_,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,r,r]),E.targets.forEach((t,d)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),_,t.serverId??null,t.target,E.strategy==="canary"?d===0?0:1+Math.floor((d-1)/E.batchSize):Math.floor(d/E.batchSize),t.previousVersion,r,r])),this.campaign(_)})}campaign(E){let T=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return T?CH(T):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(CH)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(oC)}updateCampaign(E,T){let _=this.campaign(E);if(!_)throw Error("Upgrade campaign was not found.");let r={..._,...T};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[r.status,r.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,T){let _=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!_)throw Error("Upgrade target was not found.");let r={...oC(_),...T};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.evidence),r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),oC(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let T=[...E.candidates].sort((R,h)=>R.id.localeCompare(h.id)),_=ue(T),r=this.id(),t=this.now().toISOString(),d=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[r,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(T),_,T.reduce((R,h)=>R+h.bytes,0),d,t,t]),this.cleanup(r)}cleanup(E){let T=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return T?XH(T):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(XH)}updateCleanup(E,T){let _=this.cleanup(E);if(!_)throw Error("Cleanup plan was not found.");let r={..._,...T};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[r.status,r.confirmation??null,JSON.stringify(r.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let T=this.id(),_=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[T,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,_,_]),this.drill(T)}drill(E){let T=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return T?JH(T):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(JH)}updateDrill(E,T){let _=this.drill(E);if(!_)throw Error("DR drill was not found.");let r={..._,...T};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,r.operationId??null,JSON.stringify(r.evidence),r.measuredRpoMinutes??null,r.measuredRtoMinutes??null,r.cleanupVerified?1:0,r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}function p3(E,T=new Date){if(!E.enabled)return!1;let _=new Date(E.schedule);if(!Number.isNaN(_.getTime()))return T>=_&&T.getTime()<=_.getTime()+E.durationMinutes*60000;let r=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!r)return!1;let t=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(T),d=Number(t.find((h)=>h.type==="hour")?.value)*60+Number(t.find((h)=>h.type==="minute")?.value),R=Number(r[1])*60+Number(r[2]);return d>=R&&d<R+E.durationMinutes}class t0{store;now;queue;constructor(E,T,_=()=>new Date){this.store=E;this.now=_;this.queue=T??new lE(E.control)}enqueueCampaign(E,T={}){let _=this.store.campaign(E);if(!_)throw Error("Upgrade campaign was not found.");let r=_.windowId?this.store.window(_.windowId):void 0;if(r&&!r.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(r&&!T.overrideWindow&&!p3(r,this.now()))throw Error("Upgrade is outside its maintenance window.");if(r?.requireApproval&&!T.approvedBy&&!_.approvedBy)throw Error("Maintenance approval is required.");let t=this.queue.enqueue({projectId:_.projectId,actorId:T.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:t}}async previewCleanup(E,T){let _=T.find((r)=>r.kind===E.kind);if(!_)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await _.discover(E.criteria)})}enqueueCleanup(E,T){let _=this.store.cleanup(E);if(!_||_.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(_.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let r=`DELETE ${_.candidates.length} ${_.kind}`;if(T!==r)throw Error(`Exact confirmation ${r} is required.`);let t=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${_.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:T}),operation:t}}enqueueDrill(E){let T=this.store.drill(E);if(!T||T.status!=="planned")throw Error("A planned DR drill is required.");let _=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${T.scenario}:${T.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:_.id}),operation:_}}}var EX=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function zH(E){return{"maintenance.upgrade":async(t)=>{let d=E.store.campaign(String(EX(t.operation.input).campaignId??""));if(!d||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let R=E.store.manifest(d.manifestId);if(!R?.compatibility.compatible||R.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let h=R.document.artifacts.find((N)=>N.platform===process.platform&&N.architecture===process.arch)??R.document.artifacts[0];if(!h)throw Error("No update artifact matches this platform.");E.store.updateCampaign(d.id,{status:"running",currentStage:"preflight"});let S=[];try{for(let N of[...new Set(E.store.targets(d.id).map((A)=>A.cohort))].sort((A,L)=>A-L)){E.store.updateCampaign(d.id,{currentStage:`cohort:${N}`});for(let A of E.store.targets(d.id).filter((L)=>L.cohort===N)){t.throwIfCancellationRequested(),t.checkpoint(`download:${A.target}`,"Downloading signed platform artifact."),E.store.updateTarget(A.id,{status:"downloading",startedAt:new Date().toISOString()});let L=await E.platform.download({target:A,artifact:h,signal:t.signal});if(L.sha256!==h.sha256)throw Error(`Artifact checksum mismatch for ${A.target}.`);t.checkpoint(`install:${A.target}`,"Installing verified artifact."),E.store.updateTarget(A.id,{status:"installing"}),await E.platform.install({target:A,path:L.path,version:R.version,signal:t.signal}),S.push(A);let O=await E.platform.health({target:A,gate:d.healthGate});if(!O.healthy)throw Error(`Upgrade health gate failed for ${A.target}.`);E.store.updateTarget(A.id,{status:"healthy",evidence:O.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(d.id,{status:"succeeded",currentStage:void 0}),{campaignId:d.id,version:R.version,targets:S.length}}catch(N){E.store.updateCampaign(d.id,{status:"rolling_back",currentStage:"rollback"});for(let A of S.reverse())E.store.updateTarget(A.id,{status:"rolling_back"}),await E.platform.rollback({target:A,version:A.previousVersion,signal:t.signal}),E.store.updateTarget(A.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(d.id,{status:"rolled_back",currentStage:void 0}),N}},"maintenance.cleanup":async(t)=>{let d=E.store.cleanup(String(EX(t.operation.input).planId??""));if(!d||d.status!=="approved")throw Error("Approved cleanup plan was not found.");if(ue([...d.candidates].sort((A,L)=>A.id.localeCompare(L.id)))!==d.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let R=E.cleanup?.find((A)=>A.kind===d.kind);if(!R)throw Error(`No ${d.kind} cleanup driver is configured.`);E.store.updateCleanup(d.id,{status:"running"});let h=[],S=[];for(let A of d.candidates){t.throwIfCancellationRequested();try{await R.remove(A),h.push(A.id)}catch(L){S.push({id:A.id,error:L instanceof Error?L.message:String(L)})}}let N=S.length?h.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(d.id,{status:N,result:{removed:h,failed:S,reclaimedBytes:d.candidates.filter((A)=>h.includes(A.id)).reduce((A,L)=>A+L.bytes,0)}}),S.length)throw Error(`Cleanup failed for ${S.length} candidate(s).`);return{planId:d.id,removed:h.length,reclaimedBytes:d.estimatedBytes}},"maintenance.drill":async(t)=>{let d=E.store.drill(String(EX(t.operation.input).drillId??""));if(!d)throw Error("DR drill was not found.");let R=E.recovery?.find((L)=>L.scenario===d.scenario);if(!R)throw Error(`No ${d.scenario} recovery driver is configured.`);let h=new Date;E.store.updateDrill(d.id,{status:"restoring",startedAt:h.toISOString()});let S=d.isolatedTarget,N={},A={};try{t.checkpoint("restore","Restoring into isolated drill target.");let L=await R.restore({drill:d,signal:t.signal});if(!L.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");S=L.target,N=L.evidence;let O=(h.getTime()-new Date(L.recoveryPointAt).getTime())/60000;E.store.updateDrill(d.id,{status:"verifying",measuredRpoMinutes:O,evidence:{restore:N}}),t.checkpoint("verify","Running recovery health checks without production traffic.");let c=await R.verify({drill:d,target:S});A=c.evidence;let U=(Date.now()-h.getTime())/60000;if(!c.healthy||O>d.expectedRpoMinutes||U>d.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(d.id,{measuredRpoMinutes:O,measuredRtoMinutes:U,evidence:{restore:N,verify:A}})}catch(L){throw E.store.updateDrill(d.id,{status:"failed",error:L instanceof Error?L.message:String(L),evidence:{restore:N,verify:A}}),L}finally{E.store.updateDrill(d.id,{status:"cleaning"});try{await R.cleanup({drill:d,target:S});let L=E.store.drill(d.id);E.store.updateDrill(d.id,{status:L.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(L){E.store.updateDrill(d.id,{status:"cleanup_required",cleanupVerified:!1,error:L instanceof Error?L.message:String(L),finishedAt:new Date().toISOString()})}}return{drillId:d.id,status:E.store.drill(d.id).status}}}}var FH={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class d0{kind;control;projectId;organizationId;constructor(E,T,_,r){this.kind=E;this.control=T;this.projectId=_;this.organizationId=r}async discover(E){let T=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),_=new Date(Date.now()-T*86400000).toISOString(),r=FH[this.kind],t=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(r.select).all(t,_).map((R)=>({id:String(R.id),kind:this.kind,label:`${this.kind}:${String(R.id)}`,bytes:Number(R.bytes??0),metadata:{createdAt:String(R.created_at)}}))}async remove(E){if(this.control.database.run(FH[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function o3(){let E=await o(),T=iE(process.cwd(),E),_=new r0(T.store),r=new t0(_),t=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((d)=>new d0(d,T.store,T.project.id,T.organization.id));return{controlPlane:T,store:_,service:r,cleanup:t}}async function Vd(E){let T=await o3();try{await E(T)}catch(_){f(_ instanceof Error?_.message:String(_)),process.exitCode=1}finally{T.controlPlane.store.close()}}function TX(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(T)=>Vd((_)=>{let r={manifests:_.store.manifests(_.controlPlane.organization.id),windows:_.store.windows(_.controlPlane.project.id),campaigns:_.store.campaigns(_.controlPlane.project.id),cleanups:_.store.cleanups(_.controlPlane.project.id),drills:_.store.drills(_.controlPlane.project.id)},t=[...r.manifests.map((d)=>["update",d.version,d.compatibility.compatible?"compatible":"blocked",d.compatibility.reasons.join("; ")||d.channel]),...r.campaigns.map((d)=>["upgrade",d.id,d.status,d.currentStage??d.fromVersion]),...r.cleanups.map((d)=>["cleanup",d.kind,d.status,`${d.candidates.length} items / ${d.estimatedBytes} bytes`]),...r.drills.map((d)=>["DR drill",d.scenario,d.status,d.isolatedTarget])];if(T.json)console.log(JSON.stringify(r,null,2));else EE(["Area","Name / version","Status","Detail"],t)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(T,_)=>Vd(async(r)=>{let t=r.store.addTrustedKey({organizationId:r.controlPlane.organization.id,name:T,publicKeyPem:await Bun.file(_).text()});Z(`Trusted ${t.name}: ${t.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(T,_,r)=>Vd(async(t)=>{let d=await Bun.file(T).json(),R=(await Bun.file(_).text()).trim(),h=t.store.importManifest({organizationId:t.controlPlane.organization.id,keyId:r,document:d,signature:R,current:{schemaVersion:t.controlPlane.store.health().schemaVersion,currentVersion:T0,platform:process.platform,architecture:process.arch}});Z(`Verified ${h.version}; ${h.compatibility.compatible?"compatible":"blocked: "+h.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(T,_,r)=>Vd((t)=>{let d=t.store.createWindow({projectId:t.controlPlane.project.id,name:T,schedule:_,timezone:r.timezone,durationMinutes:Number(r.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});Z(`Created ${d.name} (${d.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(T,_,r)=>Vd((t)=>{let d=new it(t.controlPlane.store).list(t.controlPlane.project.id).filter((S)=>S.status==="ready").map((S)=>({serverId:S.id,target:S.name,previousVersion:S.bootstrapVersion??T0}));if(!d.length)d.push({target:"control-plane",previousVersion:T0});let R=t.store.createCampaign({projectId:t.controlPlane.project.id,manifestId:T,fromVersion:T0,strategy:r.strategy==="rolling"?"rolling":"canary",batchSize:Number(r.batch),healthGate:{kind:"platform"},backupId:_,targets:d}),h=t.service.enqueueCampaign(R.id);Z(`Staged upgrade queued: ${h.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(T,_)=>Vd(async(r)=>{let t=await r.service.previewCleanup({projectId:r.controlPlane.project.id,kind:T,criteria:{olderThanDays:Number(_.olderThan)}},r.cleanup);EE(["ID","Candidate","Bytes"],t.candidates.map((d)=>[d.id,d.label,String(d.bytes)])),e(`Apply with: cloud cleanup:apply ${t.id} --confirm "DELETE ${t.candidates.length} ${t.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(T,_)=>Vd((r)=>{let t=r.service.enqueueCleanup(T,String(_.confirm??""));Z(`Cleanup queued: ${t.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(T,_,r)=>Vd((t)=>{let d=t.store.createDrill({projectId:t.controlPlane.project.id,scenario:T,isolatedTarget:_,expectedRpoMinutes:Number(r.rpo),expectedRtoMinutes:Number(r.rto),recoveryPointId:r.recoveryPoint,topologyId:r.topology});Z(`Planned isolated drill ${d.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(T)=>Vd((_)=>{let r=_.service.enqueueDrill(T);Z(`DR drill queued: ${r.operation.id}`)}))}QE();kR();Br();async function _X(){try{return(await o()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function rX(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(T)=>{b("Lambda Functions");let _=T?.region||await _X(),r=new FT(_);try{let{Functions:t=[]}=await r.listFunctions({MaxItems:50});if(!t.length){e("No functions found");return}EE(["Name","Runtime","Memory","Timeout","Last Modified"],t.map((d)=>[d.FunctionName??"-",d.Runtime??"-",d.MemorySize?`${d.MemorySize} MB`:"-",d.Timeout?`${d.Timeout}s`:"-",d.LastModified??"-"]))}catch(t){f(`Failed to list functions: ${t.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(T,_)=>{b(`Invoking ${T}`);let r=_?.region||await _X(),t=new FT(r),d=new v("Invoking function...");d.start();try{let R=await t.invoke({FunctionName:T,InvocationType:_?.async?"Event":"RequestResponse",Payload:_?.payload||"{}",LogType:_?.async?"None":"Tail"});if(R.FunctionError){if(d.fail(`Function returned an error (${R.FunctionError})`),R.Payload)e(R.Payload);process.exitCode=1;return}if(d.succeed(`Invoked (status ${R.StatusCode})`),R.Payload)e(`
 Response:`),e(R.Payload);if(R.LogResult)e(`
 Logs:`),e(Buffer.from(R.LogResult,"base64").toString("utf-8"))}catch(R){d.fail(`Invocation failed: ${R.message}`),process.exitCode=1}}),E.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(T,_)=>{b(`Logs for ${T}`);let r=_?.region||await _X(),t=new Or(r),d=T.startsWith("/aws/lambda/")?T:`/aws/lambda/${T}`,R=Number(_?.since??15),h=(S)=>{for(let N of S){let A=N.timestamp?new Date(N.timestamp).toISOString():"";e(`${A}  ${(N.message??"").trimEnd()}`)}};try{let S=Date.now()-R*60000,{events:N=[]}=await t.filterLogEvents({logGroupName:d,startTime:S,filterPattern:_?.filter,limit:200});if(h(N),N.length)S=(N[N.length-1].timestamp??S)+1;if(_?.tail){e(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise((L)=>setTimeout(L,3000));let{events:A=[]}=await t.filterLogEvents({logGroupName:d,startTime:S,filterPattern:_?.filter,limit:200});if(A.length)h(A),S=(A[A.length-1].timestamp??S)+1}}}catch(S){f(`Failed to read logs: ${S.message}`),process.exitCode=1}})}QE();async function yH(E){let T=Bun.spawn(["docker",...E],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[_,r]=await Promise.all([T.exited,new Response(T.stderr).text()]);return{ok:_===0,exitCode:_,command:["docker",...E].join(" "),stderr:r.trim()}}function tX(E){E.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(T)=>{let _=["build","--file",T.file??"Dockerfile","--tag",T.tag??"latest","."];if(T.dryRun){console.log(`docker ${_.join(" ")}`);return}let r=await yH(_);if(T.json)console.log(JSON.stringify(r));if(!r.ok)f(r.stderr||`docker exited ${r.exitCode}`),process.exitCode=r.exitCode;else Z(`Built ${T.tag??"latest"}.`)}),E.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(T)=>{if(!T.image){f("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(T.dryRun){console.log(`docker push ${T.image}`);return}let _=await yH(["push",T.image]);if(T.json)console.log(JSON.stringify(_));if(!_.ok)f(_.stderr),process.exitCode=_.exitCode;else Z(`Pushed ${T.image}.`)}),E.command("container:deploy","Deploy a container image").action(async()=>ar("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}QE();Bd();kt();function dX(E){E.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(T)=>{b("Domains");try{let _=ut(T?.provider),r=yr(T?.provider)?.provider||"unknown",t=new v(`Fetching domains from ${r}...`);t.start();let d=await _.listDomains();if(t.succeed(`Found ${d.length} domain(s)`),d.length===0){e("No domains found in this provider");return}let R=d.map((h)=>[h,"Active","-",r.charAt(0).toUpperCase()+r.slice(1)]);EE(["Domain","Status","SSL","Provider"],R)}catch(_){f(`Failed to list domains: ${_ instanceof Error?_.message:String(_)}`)}}),E.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(T,_)=>{b(`Adding Domain: ${T}`);try{let r=ut(_?.provider),t=yr(_?.provider)?.provider||"unknown",d=new v(`Checking if ${t} can manage ${T}...`);if(d.start(),await r.canManageDomain(T))d.succeed(`Domain ${T} is already available in ${t}`),e(`