@stacksjs/ts-cloud 0.7.92 → 0.7.94

package/dist/{chunk-29fwqkb7.js → chunk-0htae1c2.js}

@@ -45,7 +45,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-fbwcv2vf.js";
+} from "./chunk-bs3jfnzp.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,
@@ -92,7 +92,7 @@ import {
 import { createHash as createHash5 } from "node:crypto";
 
 // src/control-plane/migrations.ts
-var CONTROL_PLANE_SCHEMA_VERSION = 35;
+var CONTROL_PLANE_SCHEMA_VERSION = 36;
 var controlPlaneMigrations = [
   {
     version: 1,
@@ -1506,11 +1506,56 @@ var controlPlaneMigrations = [
     CREATE INDEX cleanup_plan_status ON cleanup_plans(project_id,status,expires_at);
     CREATE INDEX dr_drill_status ON disaster_recovery_drills(project_id,status,created_at DESC);
   `
+  },
+  {
+    version: 36,
+    name: "telemetry_source_rollups",
+    sql: `
+      CREATE TABLE telemetry_source_rollups (
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT NOT NULL DEFAULT '',
+        resource_id TEXT NOT NULL DEFAULT '',
+        source TEXT NOT NULL,
+        first_observed_at TEXT NOT NULL,
+        latest_observed_at TEXT NOT NULL,
+        ingested_bytes INTEGER NOT NULL DEFAULT 0 CHECK (ingested_bytes >= 0),
+        record_count INTEGER NOT NULL DEFAULT 0 CHECK (record_count >= 0),
+        PRIMARY KEY(project_id, environment_id, resource_id, source)
+      ) STRICT;
+
+      INSERT INTO telemetry_source_rollups (
+        project_id, environment_id, resource_id, source,
+        first_observed_at, latest_observed_at, ingested_bytes, record_count
+      )
+      SELECT
+        project_id, COALESCE(environment_id, ''), COALESCE(resource_id, ''), source,
+        MIN(observed_at), MAX(observed_at), SUM(ingested_bytes), COUNT(*)
+      FROM telemetry_records
+      GROUP BY project_id, COALESCE(environment_id, ''), COALESCE(resource_id, ''), source;
+
+      CREATE TRIGGER telemetry_source_rollups_insert
+      AFTER INSERT ON telemetry_records
+      BEGIN
+        INSERT INTO telemetry_source_rollups (
+          project_id, environment_id, resource_id, source,
+          first_observed_at, latest_observed_at, ingested_bytes, record_count
+        )
+        VALUES (
+          NEW.project_id, COALESCE(NEW.environment_id, ''), COALESCE(NEW.resource_id, ''), NEW.source,
+          NEW.observed_at, NEW.observed_at, NEW.ingested_bytes, 1
+        )
+        ON CONFLICT(project_id, environment_id, resource_id, source) DO UPDATE SET
+          first_observed_at = MIN(first_observed_at, excluded.first_observed_at),
+          latest_observed_at = MAX(latest_observed_at, excluded.latest_observed_at),
+          ingested_bytes = ingested_bytes + excluded.ingested_bytes,
+          record_count = record_count + 1;
+      END;
+    `
   }
 ];
 // src/control-plane/store.ts
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, statSync } from "node:fs";
 import { dirname } from "node:path";
 import { Database } from "bun:sqlite";
 
@@ -1978,6 +2023,12 @@ class ControlPlaneStore {
       } catch {}
     }
   }
+  backupTo(path) {
+    this.database.run("VACUUM INTO ?", [path]);
+    try {
+      chmodSync(path, 384);
+    } catch {}
+  }
   migrate() {
     const row = this.database.query("PRAGMA user_version").get();
     const current = Number(row?.user_version ?? 0);
@@ -1988,7 +2039,7 @@ class ControlPlaneStore {
     let backupPath;
     if (current > 0 && this.path !== ":memory:") {
       backupPath = `${this.path}.v${current}.${Date.now()}.bak`;
-      writeFileSync(backupPath, this.database.serialize(), { mode: 384 });
+      this.backupTo(backupPath);
     }
     try {
       const apply = this.database.transaction(() => {
@@ -2263,7 +2314,7 @@ class ControlPlaneStore {
     return row ? mapMembership(row) : undefined;
   }
   listMemberships(organizationId, options = {}) {
-    const revoked = options.includeRevoked ? "" : "AND status = 'active'";
+    const revoked = options.includeRevoked ? "" : `AND status = 'active'`;
     return this.database.query(`SELECT * FROM organization_memberships WHERE organization_id = ? ${revoked} ORDER BY created_at, id`).all(organizationId).map(mapMembership);
   }
   updateMembership(input) {
@@ -2314,7 +2365,7 @@ class ControlPlaneStore {
     return membership;
   }
   assertAnotherOwner(current) {
-    const owners = Number(this.database.query("SELECT COUNT(*) AS count FROM organization_memberships WHERE organization_id = ? AND status = ? AND role_template = 'owner'").get(current.organizationId, "active")?.count ?? 0);
+    const owners = Number(this.database.query(`SELECT COUNT(*) AS count FROM organization_memberships WHERE organization_id = ? AND status = ? AND role_template = 'owner'`).get(current.organizationId, "active")?.count ?? 0);
     if (owners <= 1)
       throw new Error("Cannot remove or demote the last organization owner");
   }
@@ -2873,7 +2924,7 @@ class ControlPlaneStore {
     if (this.path === ":memory:")
       throw new Error("Cannot create a filesystem backup for an in-memory control plane");
     const backupPath = `${this.path}.${Date.now()}.bak`;
-    writeFileSync(backupPath, this.database.serialize(), { mode: 384 });
+    this.backupTo(backupPath);
     this.setSetting("storage.last_backup", { path: backupPath, createdAt: this.now(), reason });
     return backupPath;
   }
@@ -7990,7 +8041,7 @@ function estimateExistingStaticFullStackMonthlyCost(options = {}) {
 // src/deploy/container-image.ts
 import { execFileSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, mkdtempSync, readdirSync, readFileSync, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, mkdtempSync, readdirSync, readFileSync, rmSync, statSync as statSync2, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename as basename2, join as join3, relative, resolve as resolve2 } from "node:path";
 var IGNORED_DIRECTORIES = new Set([".git", "node_modules", "dist", "coverage"]);
@@ -8093,7 +8144,7 @@ async function buildAndPushContainerImage(options, injected) {
     const registry = auth.proxyEndpoint.replace(/^https?:\/\//, "");
     const dockerConfig = join3(temporaryDirectory, "docker");
     mkdirSync2(dockerConfig, { recursive: true });
-    writeFileSync2(join3(dockerConfig, "config.json"), JSON.stringify({ auths: { [registry]: { auth: auth.authorizationToken } } }), { mode: 384 });
+    writeFileSync(join3(dockerConfig, "config.json"), JSON.stringify({ auths: { [registry]: { auth: auth.authorizationToken } } }), { mode: 384 });
     dependencies2.run("docker", ["push", imageUri], { env: { ...process.env, DOCKER_CONFIG: dockerConfig } });
   } finally {
     rmSync(temporaryDirectory, { recursive: true, force: true });
@@ -10895,9 +10946,11 @@ class TelemetryStore {
     if (environmentId)
       bindings.push(environmentId);
     const boundedResources = [...new Set(resourceIds ?? [])].slice(0, 100);
+    if (resourceIds && boundedResources.length === 0)
+      return [];
     const resources = resourceIds ? ` AND resource_id IN (${boundedResources.map(() => "?").join(",") || "''"})` : "";
     bindings.push(...boundedResources);
-    const rows = this.controlPlane.database.query(`SELECT source, MAX(observed_at) latest, SUM(ingested_bytes) bytes, COUNT(*) count, MIN(observed_at) first FROM telemetry_records WHERE project_id=?${environment2}${resources} GROUP BY source`).all(...bindings);
+    const rows = this.controlPlane.database.query(`SELECT source, MAX(latest_observed_at) latest, SUM(ingested_bytes) bytes, SUM(record_count) count, MIN(first_observed_at) first FROM telemetry_source_rollups WHERE project_id=?${environment2}${resources} GROUP BY source`).all(...bindings);
     const now = this.now().getTime();
     return rows.map((row) => {
       const latest = String(row.latest);
@@ -11016,8 +11069,26 @@ class TelemetryStore {
     const excess = Number(this.controlPlane.database.query(`SELECT MAX(0, COUNT(*)-?) excess FROM telemetry_records${projectId ? " WHERE project_id=?" : ""}`).get(policy.maxRecords, ...projectId ? [projectId] : [])?.excess ?? 0);
     if (excess > 0)
       this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE id IN (SELECT id FROM telemetry_records${projectId ? " WHERE project_id=?" : ""} ORDER BY timestamp ASC LIMIT ?)`, projectId ? [projectId, excess] : [excess]);
+    this.rebuildStatusRollups(projectId);
     return { deleted: removed + excess, ...downsampled };
   }
+  rebuildStatusRollups(projectId) {
+    const scope = projectId ? " WHERE project_id=?" : "";
+    const bindings = projectId ? [projectId] : [];
+    const rebuild = this.controlPlane.database.transaction(() => {
+      this.controlPlane.database.run(`DELETE FROM telemetry_source_rollups${scope}`, bindings);
+      this.controlPlane.database.run(`INSERT INTO telemetry_source_rollups (
+          project_id, environment_id, resource_id, source,
+          first_observed_at, latest_observed_at, ingested_bytes, record_count
+        )
+        SELECT
+          project_id, COALESCE(environment_id, ''), COALESCE(resource_id, ''), source,
+          MIN(observed_at), MAX(observed_at), SUM(ingested_bytes), COUNT(*)
+        FROM telemetry_records${scope}
+        GROUP BY project_id, COALESCE(environment_id, ''), COALESCE(resource_id, ''), source`, bindings);
+    });
+    rebuild();
+  }
 }
 // src/alerts/telemetry.ts
 function evaluateTelemetryAlertRules(store4, projectId, environmentId, now = new Date) {
@@ -12075,7 +12146,7 @@ async function manifestRequest(fetchFn, root, image, token, signal, authorizatio
 }
 // src/onboarding/artifact-store.ts
 import { createHash as createHash12 } from "node:crypto";
-import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync3, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync3, renameSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { basename as basename3, join as join5 } from "node:path";
 function map2(row) {
   return {
@@ -12122,7 +12193,7 @@ class ApplicationArtifactStore {
     const path = join5(this.root, `${id}.archive`);
     const temporary = `${path}.partial`;
     try {
-      writeFileSync3(temporary, input.bytes, { mode: 384, flag: "wx" });
+      writeFileSync2(temporary, input.bytes, { mode: 384, flag: "wx" });
       renameSync(temporary, path);
       chmodSync2(path, 384);
       this.controlPlane.database.run("INSERT INTO application_artifacts (id, organization_id, project_id, filename, storage_path, sha256, size, format, entry_count, expanded_bytes, created_by_actor_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", [
@@ -14755,7 +14826,7 @@ function webhookEndpoint(baseUrl, webhook) {
   return new URL(`/api/source/webhooks/${encodeURIComponent(webhook.endpointToken)}`, base).href;
 }
 // src/source/git-workspace.ts
-import { chmodSync as chmodSync3, mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { chmodSync as chmodSync3, mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join6, resolve as resolve5 } from "node:path";
 function validateRemote(value, deployKey) {
@@ -14802,8 +14873,8 @@ function transportEnvironment(options) {
     directory = mkdtempSync2(join6(tmpdir2(), "ts-cloud-git-transport-"));
     const keyPath = join6(directory, "key");
     const knownHostsPath = join6(directory, "known_hosts");
-    writeFileSync4(keyPath, options.deployKey.privateKey, { mode: 384 });
-    writeFileSync4(knownHostsPath, `${options.deployKey.host} ${options.deployKey.hostKey}
+    writeFileSync3(keyPath, options.deployKey.privateKey, { mode: 384 });
+    writeFileSync3(knownHostsPath, `${options.deployKey.host} ${options.deployKey.hostKey}
 `, { mode: 384 });
     chmodSync3(keyPath, 384);
     chmodSync3(knownHostsPath, 384);
@@ -18280,7 +18351,7 @@ async function sendAuthenticationEmail(config, message) {
 }
 // src/auth/encryption.ts
 import { randomBytes as randomBytes6 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { chmodSync as chmodSync4, existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
 function authEncryptionKeyFile() {
   return statePath("auth-encryption-key");
@@ -18300,7 +18371,7 @@ function resolveAuthEncryptionKey(cwd) {
   const key = randomBytes6(32).toString("base64url");
   try {
     mkdirSync4(dirname2(file), { recursive: true, mode: 448 });
-    writeFileSync5(file, `${key}
+    writeFileSync4(file, `${key}
 `, { mode: 384 });
     chmodSync4(file, 384);
   } catch {}
@@ -23027,7 +23098,7 @@ import { homedir as homedir3 } from "os";
 import { dirname as dirname4, resolve as resolve12 } from "path";
 import process20 from "process";
 import { existsSync as existsSync22, statSync as statSync22 } from "fs";
-import { existsSync as existsSync82, mkdirSync as mkdirSync32, readdirSync as readdirSync32, writeFileSync as writeFileSync52 } from "fs";
+import { existsSync as existsSync82, mkdirSync as mkdirSync32, readdirSync as readdirSync32, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname3, resolve as resolve72 } from "path";
 import process12 from "process";
@@ -28162,7 +28233,7 @@ function generateConfigTypes(options) {
   const content = `// Generated by bunfig v${version}
 export type ConfigNames = ${files.length ? `'${files.join("' | '")}'` : "string"}
 `;
-  writeFileSync52(outputFile, content, { mode: 438 });
+  writeFileSync5(outputFile, content, { mode: 438 });
 }
 function createLibraryConfig(options) {
   let configCache = null;
@@ -39416,6 +39487,10 @@ async function resolveServerDashboardData(config6, environment2, options = {}) {
 }
 
 // src/deploy/dashboard-database.ts
+var EXTERNAL_ENGINES = new Set(["singlestore", "vitess"]);
+function isExternalEngine(engine) {
+  return EXTERNAL_ENGINES.has(engine);
+}
 var SOCKETS = {
   mysql: "/var/lib/pantry/mysql/mysqld.sock",
   mariadb: "/var/lib/pantry/mariadb/mariadbd.sock"
@@ -39428,6 +39503,10 @@ function normalizeEngine(engine) {
     return "postgres";
   if (engine === "mariadb")
     return "mariadb";
+  if (engine === "singlestore")
+    return "singlestore";
+  if (engine === "vitess")
+    return "vitess";
   return "mysql";
 }
 function resolveDbEngine(config6) {
@@ -39454,6 +39533,8 @@ function pgExec(sql, database) {
   return [`${pgAdminCommand(database)} -tA <<'TS_CLOUD_PG_EOF'`, ...sql, "TS_CLOUD_PG_EOF"];
 }
 function buildListScript(engine, database) {
+  if (engine === "vitess")
+    return buildVitessListScript(database);
   if (engine === "postgres") {
     return pgExec([
       "SELECT 'DB=' || datname FROM pg_database WHERE datistemplate = false;",
@@ -39465,6 +39546,72 @@ function buildListScript(engine, database) {
     "SELECT DISTINCT CONCAT('USER=', User) FROM mysql.user WHERE User NOT IN ('root', 'mysql.sys', 'mysql.session', 'mysql.infoschema', 'debian-sys-maint');"
   ]);
 }
+function externalMysqlExec(sql, database, port) {
+  const host2 = database?.host ?? "127.0.0.1";
+  const user = database?.username ?? "root";
+  const pass = database?.password ?? "";
+  const tls = database?.ssl === false ? "" : " --ssl-mode=PREFERRED";
+  const shq = (v) => `'${String(v).replace(/'/g, `'\\''`)}'`;
+  const env = pass ? `MYSQL_PWD=${shq(pass)} ` : "";
+  return [
+    `${env}mysql -h ${shq(host2)} -P ${database?.port ?? port} -u ${shq(user)}${tls} --batch --skip-column-names <<'TS_CLOUD_SQL_EOF'`,
+    ...sql,
+    "TS_CLOUD_SQL_EOF"
+  ];
+}
+var VTGATE_DEFAULT_PORT = 15306;
+function buildVitessListScript(database) {
+  const script = externalMysqlExec(["SHOW KEYSPACES;"], database, VTGATE_DEFAULT_PORT);
+  script[0] = `${script[0]} | sed 's/^/DB=/'`;
+  return script;
+}
+function buildVitessTopologyScript(database) {
+  return externalMysqlExec([
+    `SHOW KEYSPACES;`,
+    `SHOW VITESS_SHARDS;`,
+    `SHOW VITESS_TABLETS;`
+  ], database, VTGATE_DEFAULT_PORT);
+}
+function parseVitessTopology(output) {
+  const keyspaces = [];
+  const shards = [];
+  const tablets = [];
+  for (const rawLine of output.split(`
+`)) {
+    const line = rawLine.trim();
+    if (!line)
+      continue;
+    const cols = line.split("\t").map((c) => c.trim()).filter(Boolean);
+    if (cols.length >= 6) {
+      const [cell, keyspace, shard, type, state, alias, hostname] = cols;
+      tablets.push({
+        cell: cell ?? "",
+        keyspace: keyspace ?? "",
+        shard: shard ?? "",
+        type: type ?? "",
+        state: state ?? "",
+        alias: alias ?? "",
+        hostname: hostname ?? ""
+      });
+      continue;
+    }
+    if (cols.length === 1) {
+      const only = cols[0];
+      if (only.includes("/")) {
+        const [keyspace, shard] = only.split("/");
+        if (keyspace && shard)
+          shards.push({ keyspace, shard });
+      } else {
+        keyspaces.push(only);
+      }
+    }
+  }
+  return {
+    keyspaces: [...new Set(keyspaces)].filter(Boolean).sort(),
+    shards,
+    tablets
+  };
+}
 function buildCreateDatabaseScript(engine, name, database) {
   if (engine === "postgres") {
     return pgExec([
@@ -39541,18 +39688,31 @@ async function runDb(config6, environment2, commands, comment) {
     stderr: result2.perInstance?.[0]?.error ?? result2.error ?? ""
   };
 }
+function externalEngineRefusal(engine, action) {
+  const where = engine === "vitess" ? "Create a keyspace with `vtctldclient CreateKeyspace`, and manage vtgate credentials on the cluster." : "Use the provider console or the cluster's own admin connection.";
+  return {
+    ok: false,
+    error: `${action} is not available for ${engine}: it is an external cluster, so this box has no engine to administer. ${where}`
+  };
+}
 async function listDatabases(config6, environment2) {
   const engine = resolveDbEngine(config6);
+  if (isExternalEngine(engine) && engine !== "vitess")
+    return { ...externalEngineRefusal(engine, "Listing databases"), engine, databases: [], users: [] };
   const r = await runDb(config6, environment2, buildListScript(engine, resolveAppDatabase(config6)), "ts-cloud db:list");
   const parsed = r.ok && r.stdout ? parseDbList(r.stdout) : { databases: [], users: [] };
   return { ...r, engine, ...parsed };
 }
 async function createDatabase(config6, environment2, name) {
   const engine = resolveDbEngine(config6);
+  if (isExternalEngine(engine))
+    return externalEngineRefusal(engine, "Creating a database");
   return runDb(config6, environment2, buildCreateDatabaseScript(engine, name, resolveAppDatabase(config6)), `ts-cloud db:create ${name}`);
 }
 async function createDatabaseUser(config6, environment2, input) {
   const engine = resolveDbEngine(config6);
+  if (isExternalEngine(engine))
+    return externalEngineRefusal(engine, "Creating a database user");
   return runDb(config6, environment2, buildCreateUserScript(engine, input, resolveAppDatabase(config6)), `ts-cloud db:user ${input.username}`);
 }
 var DB_BACKUP_DIR = "/var/backups/ts-cloud/databases";
@@ -39596,6 +39756,8 @@ async function backupDatabase(config6, environment2, name) {
   if (!isValidDbIdentifier(name))
     return { ok: false, error: "Database name must be a valid identifier.", database: name };
   const engine = resolveDbEngine(config6);
+  if (isExternalEngine(engine))
+    return { ...externalEngineRefusal(engine, "Backing up"), database: name };
   const r = await runDb(config6, environment2, buildBackupScript(engine, name, DB_BACKUP_DIR, resolveAppDatabase(config6)), `ts-cloud db:backup ${name}`);
   return { ...r, database: name };
 }
@@ -39604,6 +39766,233 @@ async function listDatabaseBackups(config6, environment2) {
   const backups = r.ok && r.stdout ? parseBackups(r.stdout) : [];
   return { ...r, backups };
 }
+async function describeVitess(config6, environment2) {
+  const engine = resolveDbEngine(config6);
+  const empty = { keyspaces: [], shards: [], tablets: [] };
+  if (engine !== "vitess")
+    return { ok: false, error: "The configured database engine is not Vitess.", engine, ...empty };
+  const r = await runDb(config6, environment2, buildVitessTopologyScript(resolveAppDatabase(config6)), "ts-cloud vitess:topology");
+  const parsed = r.ok && r.stdout ? parseVitessTopology(r.stdout) : empty;
+  return { ...r, engine, ...parsed };
+}
+function unhealthyTablets(tablets) {
+  return tablets.filter((t) => t.state.toUpperCase() !== "SERVING");
+}
+function shardsMissingPrimary(topology2) {
+  const withPrimary = new Set(topology2.tablets.filter((t) => t.type.toUpperCase() === "PRIMARY" && t.state.toUpperCase() === "SERVING").map((t) => `${t.keyspace}/${t.shard}`));
+  return topology2.shards.filter((s) => !withPrimary.has(`${s.keyspace}/${s.shard}`));
+}
+
+// src/deploy/dashboard-vitess.ts
+var VTCTLDCLIENT_BIN = "/usr/local/bin/vtctldclient";
+var DEFAULT_VTCTLDCLIENT_VERSION = "21.0.0";
+function sh(value2) {
+  return `'${String(value2).split("'").join("'\\''")}'`;
+}
+function resolveVitessConfig(config6) {
+  return resolveAppDatabase(config6)?.vitess ?? {};
+}
+function isValidKeyspaceName(value2) {
+  return /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(value2);
+}
+function isValidMigrationUuid(value2) {
+  return /^[0-9a-f]{8}(?:_[0-9a-f]{4}){3}_[0-9a-f]{12}$/i.test(value2);
+}
+function buildVtctldClientInstallScript(version3 = DEFAULT_VTCTLDCLIENT_VERSION) {
+  const v = sh(version3);
+  return [
+    `if ${VTCTLDCLIENT_BIN} --version 2>/dev/null | grep -q ${v}; then echo "vtctldclient ${version3} already installed"; else`,
+    "  command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)",
+    '  if [ "$(uname -m)" != "x86_64" ]; then',
+    '    echo "vtctldclient: Vitess publishes only an x86_64 release tarball; this box is $(uname -m). Build from source or install via pantry." >&2',
+    "    exit 1",
+    "  fi",
+    '  tmp="$(mktemp -d)"',
+    `  api="https://api.github.com/repos/vitessio/vitess/releases/tags/v${version3}"`,
+    `  url="$(curl -fsSL "$api" | grep -oE '"browser_download_url"[[:space:]]*:[[:space:]]*"[^"]+vitess-[0-9][^"]*\\.tar\\.gz"' | head -1 | sed -E 's/.*"(https[^"]+)"/\\1/')"`,
+    '  if [ -z "$url" ]; then echo "vtctldclient: no release tarball found for v' + version3 + '" >&2; rm -rf "$tmp"; exit 1; fi',
+    `  curl -fsSL "$url" | tar -xz -C "$tmp" --strip-components=2 --wildcards --occurrence=1 '*/bin/vtctldclient' || true`,
+    '  if [ ! -s "$tmp/vtctldclient" ]; then',
+    '    echo "vtctldclient: could not extract the binary from $url" >&2',
+    '    rm -rf "$tmp"; exit 1',
+    "  fi",
+    `  install -m 0755 "$tmp/vtctldclient" ${VTCTLDCLIENT_BIN}`,
+    '  rm -rf "$tmp"',
+    `  echo "installed vtctldclient ${version3}"`,
+    "fi"
+  ];
+}
+function vtctldCommand(vitess) {
+  if (!vitess.vtctldAddr)
+    return null;
+  return `${VTCTLDCLIENT_BIN} --server ${sh(vitess.vtctldAddr)}`;
+}
+function buildCreateKeyspaceScript(vitess, name, options = {}) {
+  const base = vtctldCommand(vitess);
+  if (!base)
+    return null;
+  const sharded = options.sharded ? " --sharded" : "";
+  return [`${base} CreateKeyspace${sharded} ${sh(name)}`];
+}
+function buildApplyVSchemaScript(vitess, keyspace, vschemaJson) {
+  const base = vtctldCommand(vitess);
+  if (!base)
+    return null;
+  return [
+    'vschema_tmp="$(mktemp)"',
+    `cat > "$vschema_tmp" <<'TS_CLOUD_VSCHEMA_EOF'`,
+    vschemaJson,
+    "TS_CLOUD_VSCHEMA_EOF",
+    `${base} ApplyVSchema --vschema-file "$vschema_tmp" ${sh(keyspace)}`,
+    'rm -f "$vschema_tmp"'
+  ];
+}
+function buildApplySchemaScript(database, sql, strategy2 = "vitess") {
+  return externalMysqlExec([`SET @@ddl_strategy='${strategy2}';`, sql.endsWith(";") ? sql : `${sql};`], database, VTGATE_DEFAULT_PORT);
+}
+function buildMigrationsScript(database, keyspace) {
+  const statements = keyspace ? [`USE ${keyspace.replace(/[^A-Z0-9_]/gi, "")};`, "SHOW VITESS_MIGRATIONS;"] : ["SHOW VITESS_MIGRATIONS;"];
+  const script = externalMysqlExec(statements, database, VTGATE_DEFAULT_PORT);
+  script[0] = script[0].replace(" --skip-column-names", "");
+  return script;
+}
+function parseMigrations(output) {
+  const lines = output.split(`
+`).map((l) => l.trimEnd()).filter((l) => l.trim().length > 0);
+  if (lines.length === 0)
+    return [];
+  const header3 = lines[0].split("\t").map((c) => c.trim());
+  const col = (name) => header3.indexOf(name);
+  const columns = {
+    uuid: col("migration_uuid"),
+    keyspace: col("keyspace"),
+    shard: col("shard"),
+    table: col("mysql_table"),
+    status: col("migration_status"),
+    strategy: col("strategy"),
+    added: col("added_timestamp"),
+    completed: col("completed_timestamp"),
+    progress: col("progress")
+  };
+  if (columns.uuid === -1)
+    return [];
+  const rows = [];
+  for (const line of lines.slice(1)) {
+    const cells = line.split("\t");
+    const at = (i) => i >= 0 ? (cells[i] ?? "").trim() : "";
+    const uuid = at(columns.uuid);
+    if (!uuid)
+      continue;
+    rows.push({
+      uuid,
+      keyspace: at(columns.keyspace),
+      shard: at(columns.shard),
+      table: at(columns.table),
+      status: at(columns.status),
+      strategy: at(columns.strategy),
+      added: at(columns.added),
+      completed: at(columns.completed),
+      progress: at(columns.progress)
+    });
+  }
+  return rows;
+}
+function failedMigrations(migrations2) {
+  return migrations2.filter((m) => m.status.toLowerCase() === "failed");
+}
+function runningMigrations(migrations2) {
+  return migrations2.filter((m) => ["running", "queued", "ready"].includes(m.status.toLowerCase()));
+}
+function buildMigrationActionScript(database, uuid, action) {
+  const verb = action.toUpperCase();
+  return externalMysqlExec([`ALTER VITESS_MIGRATION '${uuid}' ${verb};`], database, VTGATE_DEFAULT_PORT);
+}
+function requireVitess(config6) {
+  if (resolveDbEngine(config6) !== "vitess")
+    return { ok: false, error: "The configured database engine is not Vitess." };
+  return null;
+}
+function requireControlPlane(vitess) {
+  if (!vitess.vtctldAddr) {
+    return {
+      ok: false,
+      error: "No vtctld address is configured. Creating keyspaces and applying a VSchema are topology operations that vtgate cannot perform. " + "Set `infrastructure.appDatabase.vitess.vtctldAddr` (for example `vtctld.internal:15999`) and redeploy."
+    };
+  }
+  return null;
+}
+async function installVtctldClient(config6, environment2) {
+  const wrong = requireVitess(config6);
+  if (wrong)
+    return wrong;
+  const vitess = resolveVitessConfig(config6);
+  return runDb(config6, environment2, buildVtctldClientInstallScript(vitess.clientVersion), "ts-cloud vitess:install-client");
+}
+async function createKeyspace(config6, environment2, name, options = {}) {
+  const wrong = requireVitess(config6);
+  if (wrong)
+    return { ...wrong, keyspace: name };
+  if (!isValidKeyspaceName(name))
+    return { ok: false, error: "Keyspace name must be a valid identifier.", keyspace: name };
+  const vitess = resolveVitessConfig(config6);
+  const missing = requireControlPlane(vitess);
+  if (missing)
+    return { ...missing, keyspace: name };
+  const script = buildCreateKeyspaceScript(vitess, name, options);
+  if (!script)
+    return { ...requireControlPlane({}), keyspace: name };
+  const r = await runDb(config6, environment2, script, `ts-cloud vitess:create-keyspace ${name}`);
+  return { ...r, keyspace: name };
+}
+async function applyVSchema(config6, environment2, keyspace, vschemaJson) {
+  const wrong = requireVitess(config6);
+  if (wrong)
+    return { ...wrong, keyspace };
+  if (!isValidKeyspaceName(keyspace))
+    return { ok: false, error: "Keyspace name must be a valid identifier.", keyspace };
+  try {
+    const parsed = JSON.parse(vschemaJson);
+    if (!parsed || typeof parsed !== "object")
+      return { ok: false, error: "The VSchema must be a JSON object.", keyspace };
+  } catch (error2) {
+    return { ok: false, error: `The VSchema is not valid JSON: ${error2?.message ?? error2}`, keyspace };
+  }
+  const vitess = resolveVitessConfig(config6);
+  const missing = requireControlPlane(vitess);
+  if (missing)
+    return { ...missing, keyspace };
+  const script = buildApplyVSchemaScript(vitess, keyspace, vschemaJson);
+  if (!script)
+    return { ...requireControlPlane({}), keyspace };
+  const r = await runDb(config6, environment2, script, `ts-cloud vitess:apply-vschema ${keyspace}`);
+  return { ...r, keyspace };
+}
+async function applySchemaChange(config6, environment2, sql) {
+  const wrong = requireVitess(config6);
+  if (wrong)
+    return wrong;
+  if (!sql.trim())
+    return { ok: false, error: "No SQL was provided." };
+  const vitess = resolveVitessConfig(config6);
+  return runDb(config6, environment2, buildApplySchemaScript(resolveAppDatabase(config6), sql, vitess.ddlStrategy ?? "vitess"), "ts-cloud vitess:apply-schema");
+}
+async function listMigrations(config6, environment2, keyspace) {
+  const wrong = requireVitess(config6);
+  if (wrong)
+    return { ...wrong, migrations: [], failed: [], running: [] };
+  const r = await runDb(config6, environment2, buildMigrationsScript(resolveAppDatabase(config6), keyspace), "ts-cloud vitess:migrations");
+  const migrations2 = r.ok && r.stdout ? parseMigrations(r.stdout) : [];
+  return { ...r, migrations: migrations2, failed: failedMigrations(migrations2), running: runningMigrations(migrations2) };
+}
+async function actOnMigration(config6, environment2, uuid, action) {
+  const wrong = requireVitess(config6);
+  if (wrong)
+    return { ...wrong, uuid };
+  if (!isValidMigrationUuid(uuid))
+    return { ok: false, error: "Migration UUID is not in the expected format.", uuid };
+  const r = await runDb(config6, environment2, buildMigrationActionScript(resolveAppDatabase(config6), uuid, action), `ts-cloud vitess:migration ${action} ${uuid}`);
+  return { ...r, uuid };
+}
 
 // src/deploy/dashboard-policy.ts
 var FAIL_CLOSED = {
@@ -39843,6 +40232,13 @@ var POLICIES = {
   "DELETE /api/firewall": { capability: "fleet:manage" },
   "GET /api/databases": { capability: "data:read" },
   "POST /api/databases": { capability: "data:admin" },
+  "GET /api/databases/vitess": { capability: "data:read" },
+  "GET /api/databases/vitess/migrations": { capability: "data:read" },
+  "POST /api/databases/vitess/migrations/action": { capability: "data:admin" },
+  "POST /api/databases/vitess/keyspaces": { capability: "data:admin" },
+  "POST /api/databases/vitess/vschema": { capability: "data:admin" },
+  "POST /api/databases/vitess/schema": { capability: "data:admin" },
+  "POST /api/databases/vitess/install-client": { capability: "data:admin" },
   "GET /api/databases/backups": { capability: "backups:read" },
   "POST /api/databases/backup": { capability: "backups:create" },
   "POST /api/databases/users": { capability: "data:admin" },
@@ -40133,7 +40529,7 @@ function clearSessionCookie(options = { secure: true }) {
 }
 
 // src/deploy/dashboard-users.ts
-import { chmodSync as chmodSync6, existsSync as existsSync19, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "node:fs";
+import { chmodSync as chmodSync6, existsSync as existsSync19, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname8 } from "node:path";
 function usersFile() {
   return statePath("dashboard-users.json");
@@ -40188,7 +40584,7 @@ function loadUsers(cwd) {
 function saveUsers(cwd, users) {
   const file = usersFilePath(cwd);
   mkdirSync7(dirname8(file), { recursive: true });
-  writeFileSync10(file, `${JSON.stringify({ users }, null, 2)}
+  writeFileSync9(file, `${JSON.stringify({ users }, null, 2)}
 `);
   chmodSync6(file, 384);
 }
@@ -48816,6 +49212,45 @@ data: ${JSON.stringify({ cursor: position, at: new Date().toISOString() })}
               }, 422);
             return json15({ ...await createDatabase(config6, environment2, name), name });
           }
+          if (url.pathname === "/api/databases/vitess" && req.method === "GET") {
+            const topology2 = await describeVitess(config6, environment2);
+            return json15({
+              ...topology2,
+              unhealthy: unhealthyTablets(topology2.tablets),
+              missingPrimary: shardsMissingPrimary(topology2)
+            });
+          }
+          if (url.pathname === "/api/databases/vitess/migrations" && req.method === "GET") {
+            const keyspace = url.searchParams.get("keyspace") ?? undefined;
+            return json15(await listMigrations(config6, environment2, keyspace));
+          }
+          if (url.pathname === "/api/databases/vitess/migrations/action" && req.method === "POST") {
+            const body = await readJsonBody(req);
+            const uuid = String(body.uuid ?? "").trim();
+            const action = String(body.action ?? "");
+            if (!["retry", "cancel", "cleanup", "complete"].includes(action))
+              return json15({ ok: false, error: "Unknown migration action." }, 422);
+            return json15(await actOnMigration(config6, environment2, uuid, action));
+          }
+          if (url.pathname === "/api/databases/vitess/keyspaces" && req.method === "POST") {
+            const body = await readJsonBody(req);
+            const name = String(body.name ?? "").trim();
+            const sharded = body.sharded === true;
+            return json15(await createKeyspace(config6, environment2, name, { sharded }));
+          }
+          if (url.pathname === "/api/databases/vitess/vschema" && req.method === "POST") {
+            const body = await readJsonBody(req);
+            const keyspace = String(body.keyspace ?? "").trim();
+            const vschema = typeof body.vschema === "string" ? body.vschema : JSON.stringify(body.vschema ?? null);
+            return json15(await applyVSchema(config6, environment2, keyspace, vschema));
+          }
+          if (url.pathname === "/api/databases/vitess/schema" && req.method === "POST") {
+            const body = await readJsonBody(req);
+            const sql = String(body.sql ?? "");
+            return json15(await applySchemaChange(config6, environment2, sql));
+          }
+          if (url.pathname === "/api/databases/vitess/install-client" && req.method === "POST")
+            return json15(await installVtctldClient(config6, environment2));
           if (url.pathname === "/api/databases/backups" && req.method === "GET")
             return json15(await listDatabaseBackups(config6, environment2));
           if (url.pathname === "/api/databases/backup" && req.method === "POST") {