@stacksjs/ts-cloud 0.7.98 → 0.7.100

package/dist/bin/dashboard-server.js

@@ -5423,7 +5423,7 @@ ${tn.bright}${tn.cyan}${t}${tn.reset}
           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[d.id,d.projectId??null,d.environmentId??null,d.resourceId??null,d.actorId??null,d.kind,d.state,d.correlationId,d.idempotencyKey??null,Gt(d.input),Gt(d.output),JR(d.error)??null,d.attempt,d.priority,d.leaseOwner??null,d.leaseExpiresAt??null,d.cancelRequestedAt??null,d.startedAt??null,d.finishedAt??null,d.version,d.createdAt,d.updatedAt]);for(let d of t.events)St(this.database,`INSERT INTO events (sequence, id, organization_id, project_id, operation_id, resource_id, actor_id, correlation_id, type, level, payload, created_at)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[d.sequence,d.id,d.organizationId??null,d.projectId??null,d.operationId??null,d.resourceId??null,d.actorId??null,d.correlationId,d.type,d.level,Gt(d.payload),d.createdAt]);for(let[d,E]of Object.entries(t.settings))St(this.database,"INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)",[d,Gt(E),this.now()]);for(let d of t.tags??[])St(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[d.id,d.projectId,d.name,d.normalizedName,d.color,d.createdAt,d.updatedAt]);for(let d of t.resourceTags??[])St(this.database,"INSERT INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[d.resourceId,d.tagId,d.createdAt]);for(let d of t.savedFilters??[])St(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[d.id,d.actorKey,d.name,d.routeId,Gt(d.query),d.createdAt,d.updatedAt]);for(let d of t.navigationItems??[])St(this.database,"INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at, visit_count) VALUES (?, ?, ?, ?, ?, ?)",[d.actorKey,d.entityType,d.entityId,d.favorite?1:0,d.lastVisitedAt,d.visitCount])})}}var T1=new Set(["domain","domains","hostname","hostnames","url","repository","repo","image","label","labels"]),i1=new Set(["sha","commit","commitsha","release","releaseid"]);function eC(t,e){if(!t||typeof t!=="object"||Array.isArray(t))return[];let r=[];for(let[d,E]of Object.entries(t)){if(!e.has(d.toLowerCase()))continue;if(typeof E==="string")r.push(E);else if(Array.isArray(E))r.push(...E.filter((n)=>typeof n==="string"))}return r}function YR(t){return t.toLowerCase().trim().replace(/[^a-z0-9._:/@-]+/g," ")}function MR(t,e,r){let d=YR(t),E=YR(e),n=YR(r);if(!d)return 0;if(E===d)return 1000;if(E.startsWith(d))return 800-Math.min(100,E.length-d.length);if(E.includes(d))return 650-Math.min(100,E.indexOf(d));let c=d.split(/\s+/).filter(Boolean);if(c.every((i)=>n.includes(i)))return 400+c.length*10;let _=0;for(let i of d){if(_=n.indexOf(i,_),_<0)return 0;_++}return Math.max(1,180-Math.floor(n.length/20))}function h1(t,e){let r=t.kind.toLowerCase();if(r==="server"||r==="compute")return{type:"server",href:`/server/metrics?env=${encodeURIComponent(e)}`};if(r.includes("database")||["mysql","postgres","postgresql","sqlite","redis"].includes(r))return{type:"database",href:`/server/database?env=${encodeURIComponent(e)}&database=${encodeURIComponent(t.slug)}`};return{type:"service",href:`/server/sites?env=${encodeURIComponent(e)}&service=${encodeURIComponent(t.slug)}`}}function GR(t,e){let r=t.getProject(e.projectId);if(!r)return[];let d=t.listEnvironments(r.id),E=new Map(d.map((R)=>[R.id,R])),n=t.listResourceTags(r.id),c=new Map;for(let R of n){let N=c.get(R.resourceId)??[];N.push({id:R.tag.id,name:R.tag.name,color:R.tag.color}),c.set(R.resourceId,N)}let _=[],i=e.allowedResourceSlugs!==void 0;if(!i){_.push({type:"project",id:r.id,title:r.name,subtitle:r.slug,href:`/?project=${encodeURIComponent(r.slug)}`,tags:[],score:0});for(let R of d)_.push({type:"environment",id:R.id,title:R.name,subtitle:`${r.name} · ${R.kind}`,href:`/?env=${encodeURIComponent(R.slug)}`,environment:R.slug,tags:[],score:0})}let T=t.listResources(r.id).filter((R)=>!e.allowedResourceSlugs||e.allowedResourceSlugs.has(R.slug));for(let R of T){let N=R.environmentId?E.get(R.environmentId):void 0,A=c.get(R.id)??[],u=eC(R.desiredState,T1),U=[R.name,R.slug,R.kind,R.provider,R.providerId,N?.slug,...u,...A.map((l)=>l.name)].filter(Boolean).join(" "),w=h1(R,N?.slug??d[0]?.slug??"");_.push({type:w.type,id:R.id,title:R.name,subtitle:[R.kind,...u.slice(0,2)].join(" · "),href:w.href,environment:N?.slug,provider:R.provider,tags:A,score:MR(e.query,R.name,U)})}if(!i)for(let R of t.listOperations({projectId:r.id,limit:500})){let N=R.environmentId?E.get(R.environmentId):void 0,A=eC(R.input,i1),u=R.kind.includes("deploy"),U=A[0]??R.kind,w=[R.kind,R.id,R.correlationId,R.state,...A].join(" ");_.push({type:u?"deployment":"operation",id:R.id,title:U,subtitle:`${R.kind} · ${R.state}`,href:`/server/activity?env=${encodeURIComponent(N?.slug??d[0]?.slug??"")}&operation=${encodeURIComponent(R.id)}`,environment:N?.slug,status:R.state,tags:[],score:MR(e.query,U,w)})}for(let R of _)if(R.score===0)R.score=MR(e.query,R.title,`${R.title} ${R.subtitle} ${R.environment??""} ${R.provider??""}`);let h={service:0,server:1,database:2,deployment:3,environment:4,project:5,operation:6};return _.filter((R)=>R.score>0).sort((R,N)=>N.score-R.score||h[R.type]-h[N.type]||R.title.localeCompare(N.title)||R.id.localeCompare(N.id)).slice(0,Math.min(50,Math.max(1,e.limit??20)))}function S1(t,e,r){if(t==="gt")return e>r;if(t==="gte")return e>=r;if(t==="lt")return e<r;if(t==="lte")return e<=r;return e===r}function N1(t,e,r){if(e.status==="no_data"||e.status==null&&e.value==null)return;if(t.operator==="unhealthy")return e.status==="unhealthy";if(e.value==null||t.threshold==null)return;return S1(t.operator,e.value,r&&t.recoveryThreshold!=null?t.recoveryThreshold:t.threshold)}function A1(t,e){let r=Object.fromEntries(t.groupBy.flatMap((E)=>e.group?.[E]==null?[]:[[E,String(e.group[E])]]));return{key:Object.entries(r).sort(([E],[n])=>E.localeCompare(n)).map(([E,n])=>`${E}=${n}`).join(",")||"default",values:r}}function L1(t,e){return R1("sha256").update(`${t}\x00${e}`).digest("hex")}class Mc{store;constructor(t){this.store=t}evaluate(t,e){if(!t.enabled)return{transition:"ignored",notify:!1};let r=A1(t,e),d=L1(t.id,r.key),E=this.store.getAlertByDedup(d),n=E?.state==="firing"||E?.state==="silenced",c=N1(t,e,n);if(c==null&&t.noDataPolicy==="ignore")return{alert:E,transition:"ignored",notify:!1};let _=c??t.noDataPolicy==="firing",i=c==null&&t.noDataPolicy==="pending",T=new Date(e.timestamp).toISOString(),h=Lt({...e.evidence??{},...e.value==null?{}:{value:e.value},...e.status?{healthStatus:e.status}:{},group:r.values}),R;if(!E){let U=_||i?1:0,w=_&&U>=t.consecutive?"firing":"pending";R={id:crypto.randomUUID(),ruleId:t.id,projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,dedupKey:d,groupKey:r.key,state:w,severity:t.severity,title:t.name,evidence:h,failureCount:U,recoveryCount:0,occurrenceCount:1,firstSeenAt:T,lastSeenAt:T,firingAt:w==="firing"?T:void 0,updatedAt:T}}else if(_||i){let U=E.state==="resolved",w=(U?0:E.failureCount)+1,l=E.silencedUntil&&new Date(E.silencedUntil)>new Date(T),P=i?"pending":w>=t.consecutive?"firing":"pending";if((l||this.store.isSilenced(t,r.values,T))&&P==="firing")P="silenced";R={...E,state:P,severity:t.severity,title:t.name,evidence:h,failureCount:w,recoveryCount:0,occurrenceCount:E.occurrenceCount+1,firstSeenAt:U?T:E.firstSeenAt,lastSeenAt:T,firingAt:P==="firing"||P==="silenced"?E.firingAt??T:void 0,resolvedAt:void 0,updatedAt:T}}else{let U=E.recoveryCount+1,w=U>=t.recoveryConsecutive;R={...E,state:w?"resolved":E.state,evidence:h,failureCount:w?0:E.failureCount,recoveryCount:U,lastSeenAt:T,resolvedAt:w?T:E.resolvedAt,silencedUntil:w?void 0:E.silencedUntil,updatedAt:T}}let N=E?.state!==R.state,A=R.state==="pending"?"pending":R.state==="firing"?N?"firing":"updated":R.state==="silenced"?"silenced":N?"resolved":"updated";return{alert:this.store.saveAlert(R,N||!E?A:"observed"),transition:A,notify:A==="firing"||A==="resolved"}}}import{createHmac as u1}from"node:crypto";function O1(t,e){let r=Object.fromEntries(new Intl.DateTimeFormat("en-US",{timeZone:e,weekday:"short",hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(t).map((E)=>[E.type,E.value])),d=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"];return{minute:Number(r.hour)*60+Number(r.minute),weekday:d.indexOf(r.weekday)}}function rC(t){let e=/^(\d{2}):(\d{2})$/.exec(t);if(!e)throw Error("Quiet hours require HH:MM times.");let r=Number(e[1])*60+Number(e[2]);if(Number(e[1])>23||Number(e[2])>59)throw Error("Quiet hours require valid HH:MM times.");return r}function C1(t,e){if(!t.quietHours)return!1;let r=O1(e,t.quietHours.timezone),d=rC(t.quietHours.start),E=rC(t.quietHours.end);if(t.quietHours.weekdays?.length&&!t.quietHours.weekdays.includes(r.weekday))return!1;return d<=E?r.minute>=d&&r.minute<E:r.minute>=d||r.minute<E}function I1(t,e,r){let d=t.matcher;return(!d.projectIds?.length||d.projectIds.includes(e.projectId))&&(!d.environmentIds?.length||!!e.environmentId&&d.environmentIds.includes(e.environmentId))&&(!d.resourceIds?.length||!!e.resourceId&&d.resourceIds.includes(e.resourceId))&&(!d.severities?.length||d.severities.includes(e.severity))&&(!d.eventTypes?.length||d.eventTypes.includes(r))}function l1(t){if(!t)return{};try{let e=JSON.parse(t);return e&&typeof e==="object"?e:{value:t}}catch{return{value:t}}}function D1(t,e,r){let d={severity:t.severity.toUpperCase(),title:t.title,state:t.state,event:e,projectId:t.projectId,environmentId:t.environmentId??"",resourceId:t.resourceId??"",groupKey:t.groupKey};return(r?.trim()||"[{{severity}}] {{title}} · {{state}}").replace(/\{\{(severity|title|state|event|projectId|environmentId|resourceId|groupKey)\}\}/g,(E,n)=>d[n]).slice(0,2000)}function VR(t,e,r){return{schemaVersion:1,event:e,notificationText:D1(t,e,r),alert:{id:t.id,state:t.state,severity:t.severity,title:t.title,projectId:t.projectId,environmentId:t.environmentId??null,resourceId:t.resourceId??null,groupKey:t.groupKey,firstSeenAt:t.firstSeenAt,lastSeenAt:t.lastSeenAt,firingAt:t.firingAt??null,resolvedAt:t.resolvedAt??null,evidence:t.evidence}}}class KR{store;options;fetchImpl;constructor(t,e={}){this.store=t;this.options=e;this.fetchImpl=e.fetchImpl??globalThis.fetch}now(){return this.options.now?.()??new Date}preview(t,e,r){let d=[];for(let E of this.store.listRoutes(t)){if(!E.enabled||!I1(E,e,r))continue;let n=[];for(let c of E.channelIds){let _=this.store.getChannel(c);if(_?.status==="active")n.push(_)}d.push({route:E,channels:n,quiet:C1(E,this.now())})}return d}enqueue(t,e,r){let d=r==="resolved"?e.resolvedAt:r==="firing"?e.firingAt:e.updatedAt,E=[];for(let n of this.preview(t,e,r)){if(n.quiet&&r!=="resolved")continue;let c=r==="resolved"||n.route.groupWaitSeconds===0?void 0:new Date(this.now().getTime()+n.route.groupWaitSeconds*1000).toISOString(),_=r==="resolved"?Number.POSITIVE_INFINITY:Math.max(0,n.route.rateLimitPerMinute-this.store.countRouteDeliveries(n.route.id,new Date(this.now().getTime()-60000).toISOString()));for(let i of n.channels){if(_<=0)break;E.push(this.store.createDelivery({alertId:e.id,channelId:i.id,routeId:n.route.id,eventType:r,idempotencyKey:`${e.id}:${r}:${d}:${i.id}`,payload:VR(e,r,n.route.template),nextAttemptAt:c})),_--}}return E}enqueueRemindersAndEscalations(t,e){let r=this.now(),d=[];for(let E of e.filter((n)=>n.state==="firing"&&!n.acknowledgedAt&&n.firingAt)){let n=Math.max(0,(r.getTime()-new Date(E.firingAt).getTime())/1000);for(let c of this.preview(t,E,"reminder")){if(c.quiet)continue;if(c.route.reminderSeconds&&n>=c.route.reminderSeconds){let _=Math.floor(n/c.route.reminderSeconds);for(let i of c.channels)d.push(this.store.createDelivery({alertId:E.id,channelId:i.id,routeId:c.route.id,eventType:"reminder",idempotencyKey:`${E.id}:reminder:${c.route.id}:${_}:${i.id}`,payload:VR(E,"reminder")}))}for(let[_,i]of c.route.escalation.entries())if(n>=i.afterSeconds){for(let T of i.channelIds)if(this.store.getChannel(T)?.status==="active")d.push(this.store.createDelivery({alertId:E.id,channelId:T,routeId:c.route.id,eventType:"escalation",idempotencyKey:`${E.id}:escalation:${c.route.id}:${_}:${T}`,payload:VR(E,"escalation")}))}}}return d}async send(t,e){let r=l1(this.store.channelCredential(t.id)),d=typeof e.notificationText==="string"?e.notificationText:`[${String(e.alert?.severity??"info").toUpperCase()}] ${String(e.alert?.title??"ts-cloud alert")} · ${String(e.alert?.state??e.event)}`;try{if(t.kind==="email"){if(!this.options.emailImpl)return{ok:!1,error:"Email adapter is not configured."};return await this.options.emailImpl({to:t.config.to,from:t.config.from,subject:`[ts-cloud] ${String(e.alert?.title??e.event)}`,text:`${d}
 
-${JSON.stringify(e,null,2)}`}),{ok:!0,status:202}}let E=r.url??r.value,n=e,c={"content-type":"application/json"};if(t.kind==="slack")n={text:d};if(t.kind==="discord")n={content:d};if(t.kind==="teams")n={text:d};if(t.kind==="telegram")E=`https://api.telegram.org/bot${r.botToken??r.value}/sendMessage`,n={chat_id:t.config.chatId,text:d};if(!E||!/^https:\/\//.test(E))return{ok:!1,error:"Channel endpoint is unavailable or not HTTPS."};let _=JSON.stringify(n);if(t.kind==="webhook"&&r.signingSecret){let h=Math.floor(this.now().getTime()/1000).toString();c["x-ts-cloud-timestamp"]=h,c["x-ts-cloud-signature"]=`v1=${u1("sha256",r.signingSecret).update(`${h}.${_}`).digest("hex")}`}let i=new AbortController,T=setTimeout(()=>i.abort(),1e4);try{let h=await this.fetchImpl(E,{method:"POST",headers:c,body:_,signal:i.signal});return h.ok?{ok:!0,status:h.status}:{ok:!1,status:h.status,error:`Channel returned HTTP ${h.status}.`}}finally{clearTimeout(T)}}catch(E){return{ok:!1,error:E instanceof Error?E.message:String(E)}}}async deliver(t){let e=this.store.getDelivery(t);if(!e)throw Error("Notification delivery was not found.");if(e.state==="delivered"||e.state==="dead"||e.nextAttemptAt&&e.nextAttemptAt>this.now().toISOString())return e;let r=this.store.getChannel(e.channelId);if(!r||r.status==="disabled"||r.status==="paused")return this.store.updateDelivery(t,{state:"failed",attempt:e.attempt+1,error:"Notification channel is unavailable."});let d=e.attempt+1,E=await this.send(r,e.payload);if(E.ok)return this.store.setChannelStatus(r.id,"active"),this.store.updateDelivery(t,{state:"delivered",attempt:d,responseStatus:E.status,deliveredAt:this.now().toISOString()});let c=!(!E.status||E.status===429||E.status>=500)||d>=e.maxAttempts,_=c?void 0:new Date(this.now().getTime()+Math.min(3600000,30000*2**(d-1))).toISOString();return this.store.setChannelStatus(r.id,"failing",E.error),this.store.updateDelivery(t,{state:c?"dead":"retrying",attempt:d,nextAttemptAt:_,responseStatus:E.status,error:E.error})}async deliverAll(t){return Promise.all(t.map((e)=>this.deliver(e.id)))}async retryDue(){let t=this.now().toISOString(),e=this.store.listDeliveries({states:["pending","retrying"]}).filter((r)=>!r.nextAttemptAt||r.nextAttemptAt<=t);return this.deliverAll(e)}async testChannel(t){let e=this.store.getChannel(t);if(!e)throw Error("Notification channel was not found.");let r=await this.send(e,{schemaVersion:1,event:"test",message:"ts-cloud notification channel test. No incident was created."});return this.store.markChannelTest(t,r.ok,r.error),r}}import{lookup as U1}from"node:dns/promises";import{connect as f1}from"node:net";async function w1(t,e){let r=Bun.spawn(t,{stdout:"pipe",stderr:"pipe"}),d=setTimeout(()=>r.kill(),e);try{return{exitCode:await r.exited,stdout:await new Response(r.stdout).text(),stderr:await new Response(r.stderr).text()}}finally{clearTimeout(d)}}class DE{store;options;constructor(t,e={}){this.store=t;this.options=e}now(){return this.options.now?.()??new Date}async probe(t){let e=performance.now(),r=this.now().toISOString(),d=this.options.agent??"local";try{if(t.kind==="http"){let c=new URL(t.target),_=performance.now();await(this.options.lookupImpl??U1)(c.hostname);let i=performance.now()-_,T=new AbortController,h=setTimeout(()=>T.abort(),t.timeoutSeconds*1000);try{let R=performance.now(),N=await(this.options.fetchImpl??fetch)(c.toString(),{method:t.config.method??"GET",headers:t.config.headers,signal:T.signal,redirect:"manual"}),A=performance.now()-R,u=t.config.expectedBody?await N.text():"",U=t.config.expectedStatuses??[200,201,202,204],w=U.includes(N.status)&&(!t.config.expectedBody||u.includes(t.config.expectedBody));return{checkId:t.id,status:w?"healthy":"unhealthy",agent:d,region:this.options.region,statusCode:N.status,message:w?void 0:`Expected ${U.join("/")} and configured body match.`,timings:{dnsMs:i,ttfbMs:A,totalMs:performance.now()-e},checkedAt:r}}finally{clearTimeout(h)}}if(t.kind==="tcp"){let c=Number(t.config.port);if(!Number.isInteger(c)||c<1||c>65535)throw Error("TCP health check requires a valid port.");let _=performance.now();return await new Promise((i,T)=>{let h=f1({host:t.target,port:c}),R=setTimeout(()=>{h.destroy(),T(Error("TCP health check timed out."))},t.timeoutSeconds*1000);h.once("connect",()=>{clearTimeout(R),h.destroy(),i()}),h.once("error",(N)=>{clearTimeout(R),T(N)})}),{checkId:t.id,status:"healthy",agent:d,region:this.options.region,timings:{connectMs:performance.now()-_,totalMs:performance.now()-e},checkedAt:r}}let E=t.config.command??[];if(!E.length)throw Error("Command health check is not configured.");let n=await(this.options.commandImpl??w1)(E,t.timeoutSeconds*1000);return{checkId:t.id,status:n.exitCode===0?"healthy":"unhealthy",agent:d,region:this.options.region,message:n.exitCode===0?void 0:(n.stderr||n.stdout||`Command exited ${n.exitCode}`).slice(0,1000),timings:{totalMs:performance.now()-e},checkedAt:r}}catch(E){return{checkId:t.id,status:"unhealthy",agent:d,region:this.options.region,message:(E instanceof Error?E.message:String(E)).slice(0,1000),timings:{totalMs:performance.now()-e},checkedAt:r}}}async run(t){return this.store.appendHealthResult(await this.probe(t))}async runAndEvaluate(t){let e=await this.run(t),r=new Mc(this.store),d=this.store.listRules(t.projectId,t.environmentId).filter((E)=>E.healthCheckId===t.id);return{result:e,evaluations:d.map((E)=>r.evaluate(E,{status:e.status,timestamp:e.checkedAt,group:{agent:e.agent,region:e.region??""},evidence:{healthResultId:e.id,statusCode:e.statusCode??null,message:e.message??null,timings:e.timings}}))}}}var g1=Object.freeze({rawDays:30,downsampleAfterDays:7,downsampleBucketMs:3600000,maxRecords:1e6,samplingRate:1,collectLogs:!0,collectTraces:!0,collectRequestAnalytics:!0,estimatedStorageUsdPerGbMonth:0});function yT(t,e,r,d){let E=Number(t);return Number.isFinite(E)?Math.min(d,Math.max(r,Math.floor(E))):e}function dC(t,e,r,d){let E=Number(t);return Number.isFinite(E)?Math.min(d,Math.max(r,E)):e}function ZR(t,e){return typeof t==="boolean"?t:e}function EC(t,e={...g1}){let r=t&&typeof t==="object"&&!Array.isArray(t)?t:{},d=yT(r.rawDays,e.rawDays,1,3650),E=yT(r.downsampleAfterDays,e.downsampleAfterDays,1,d);return{rawDays:d,downsampleAfterDays:E,downsampleBucketMs:yT(r.downsampleBucketMs,e.downsampleBucketMs,60000,86400000),maxRecords:yT(r.maxRecords,e.maxRecords,1000,1e8),samplingRate:dC(r.samplingRate,e.samplingRate,0.01,1),collectLogs:ZR(r.collectLogs,e.collectLogs),collectTraces:ZR(r.collectTraces,e.collectTraces),collectRequestAnalytics:ZR(r.collectRequestAnalytics,e.collectRequestAnalytics),estimatedStorageUsdPerGbMonth:dC(r.estimatedStorageUsdPerGbMonth,e.estimatedStorageUsdPerGbMonth,0,1e4)}}function nC(t){return`telemetry.policy:${t}`}function Dn(t,e){return EC(t.getSetting(nC(e)))}function cC(t,e,r){let d=EC(r,Dn(t,e));return t.setSetting(nC(e),d),d}function _C(t,e){return Number((Math.max(0,t)/1073741824*e.estimatedStorageUsdPerGbMonth).toFixed(4))}var $1=/(?:authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key|session)/i,y1=/\b(?:authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)\s*[=:]\s*[^\s,;&\[]+/gi,X1=/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,P1=/\b(?:\d{1,3}\.){3}\d{1,3}\b/g;function kR(t,e={}){let r=t.replace(/([?&][^=&#\s]+)=([^&#\s]*)/g,"$1=[REDACTED]").replace(y1,"[REDACTED]");if(e.redactEmail!==!1)r=r.replace(X1,"[EMAIL]");if(e.redactIp)r=r.replace(P1,"[IP]");for(let d of e.patterns??[])r=r.replace(d,"[REDACTED]");return r}function Gc(t,e={},r){if(r&&$1.test(r))return"[REDACTED]";if(t===null||typeof t==="boolean"||typeof t==="number")return t;if(typeof t==="string")return kR(t,e);if(Array.isArray(t))return t.map((d)=>Gc(d,e));if(t&&typeof t==="object"){let d={};for(let[E,n]of Object.entries(t))d[E]=Gc(n,e,E);return d}return String(t??"")}function XT(t){if(!t)return;return t.split("?",1)[0].replace(/\b[0-9a-f]{8}-[0-9a-f-]{27,}\b/gi,":id").replace(/\/(?:(?:\d{4,})|(?:[0-9a-f]{16,}))(?:\/|$)/gi,(r)=>r.endsWith("/")?"/:id/":"/:id").slice(0,512)}var TC=65536,a1=2678400000,j1=new Set(["metric","log","trace","request","event"]);function Ie(t){return typeof t==="string"?t:void 0}function Vc(t){return t==null?void 0:Number(t)}function z1(t){if(typeof t!=="string")return{};try{return JSON.parse(t)}catch{return{}}}function PT(t){return{id:String(t.id),projectId:String(t.project_id),environmentId:Ie(t.environment_id),resourceId:Ie(t.resource_id),kind:String(t.kind),source:String(t.source),name:String(t.name),timestamp:String(t.timestamp),observedAt:String(t.observed_at),value:Vc(t.value),unit:Ie(t.unit),level:Ie(t.level),message:Ie(t.message),durationMs:Vc(t.duration_ms),statusCode:Vc(t.status_code),method:Ie(t.method),host:Ie(t.host),pathTemplate:Ie(t.path_template),bytesIn:Vc(t.bytes_in),bytesOut:Vc(t.bytes_out),region:Ie(t.region),cacheResult:Ie(t.cache_result),upstream:Ie(t.upstream),traceId:Ie(t.trace_id),requestId:Ie(t.request_id),deploymentId:Ie(t.deployment_id),releaseId:Ie(t.release_id),workloadId:Ie(t.workload_id),sampled:Number(t.sampled)===1,attributes:z1(t.attributes),ingestedBytes:Number(t.ingested_bytes)}}function Un(t,e){let r=new Date(t);if(!t||!Number.isFinite(r.getTime()))throw Error(`${e} must be a valid ISO-8601 instant.`);return r}function aT(t){let e=Un(t.from,"from"),r=Un(t.to,"to");if(e>=r)throw Error("Telemetry from must be earlier than to.");if(r.getTime()-e.getTime()>a1)throw Error("Telemetry queries are limited to 31 days.");return{from:e,to:r}}function iC(t){if(!t)return;try{let e=JSON.parse(Buffer.from(t,"base64url").toString("utf8"));if(typeof e?.timestamp!=="string"||typeof e?.id!=="string")throw Error();return e}catch{throw Error("Telemetry cursor is invalid.")}}function jT(t){return t?Buffer.from(JSON.stringify({timestamp:t.timestamp,id:t.id})).toString("base64url"):void 0}function F1(t,e){if(!t.length)return;let r=[...t].sort((E,n)=>E-n),d=Math.max(0,Math.min(r.length-1,Math.ceil(e/100*r.length)-1));return r[d]}function Kc(t,e){if(e==="count")return t.length;if(!t.length)return;if(e==="sum")return t.reduce((r,d)=>r+d,0);if(e==="avg")return t.reduce((r,d)=>r+d,0)/t.length;if(e==="min")return Math.min(...t);if(e==="max")return Math.max(...t);return F1(t,Number(e.slice(1)))}function B1(t,e="UTC"){try{return new Intl.DateTimeFormat("en-US",{timeZone:e,month:"short",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZoneName:"short"}).format(t)}catch{throw Error(`Unknown telemetry timezone: ${e}`)}}class UE{controlPlane;options;constructor(t,e={}){this.controlPlane=t;this.options=e}now(){return this.options.now?.()??new Date}append(t){if(!j1.has(t.kind))throw Error(`Unsupported telemetry kind: ${t.kind}`);let e=Un(t.timestamp,"timestamp").toISOString(),r=t.observedAt?Un(t.observedAt,"observedAt").toISOString():this.now().toISOString(),d=Gc(t.attributes??{},this.options.redaction),E=t.message?kR(t.message,this.options.redaction).slice(0,32768):void 0,n=XT(t.pathTemplate),c=t.id??crypto.randomUUID(),_=JSON.stringify({...t,id:c,timestamp:e,observedAt:r,attributes:d,message:E,pathTemplate:n}),i=Buffer.byteLength(_);if(i>TC)throw Error(`Telemetry records are limited to ${TC} bytes.`);return this.controlPlane.database.run("INSERT OR IGNORE INTO telemetry_records (id, project_id, environment_id, resource_id, kind, source, name, timestamp, observed_at, value, unit, level, message, duration_ms, status_code, method, host, path_template, bytes_in, bytes_out, region, cache_result, upstream, trace_id, request_id, deployment_id, release_id, workload_id, sampled, attributes, ingested_bytes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[c,t.projectId,t.environmentId??null,t.resourceId??null,t.kind,t.source.slice(0,128),t.name.slice(0,256),e,r,t.value??null,t.unit??null,t.level??null,E??null,t.durationMs??null,t.statusCode??null,t.method?.slice(0,16)??null,t.host?.slice(0,256)??null,n??null,t.bytesIn??null,t.bytesOut??null,t.region?.slice(0,64)??null,t.cacheResult?.slice(0,64)??null,t.upstream?.slice(0,256)??null,t.traceId?.slice(0,256)??null,t.requestId?.slice(0,256)??null,t.deploymentId?.slice(0,256)??null,t.releaseId?.slice(0,256)??null,t.workloadId?.slice(0,512)??null,t.sampled===!1?0:1,JSON.stringify(d),i]),this.get(c)}appendMany(t){if(t.length>1e4)throw Error("Telemetry batches are limited to 10,000 records.");return this.controlPlane.database.transaction((r)=>r.map((d)=>this.append(d)))(t)}get(t){let e=this.controlPlane.database.query("SELECT * FROM telemetry_records WHERE id=?").get(t);return e?PT(e):void 0}query(t){let{from:e,to:r}=aT(t),d=Math.min(5000,Math.max(1,Math.floor(t.limit??500))),E=["project_id=?","timestamp>=?","timestamp<?"],n=[t.projectId,e.toISOString(),r.toISOString()],c=(l,P)=>{if(P)E.push(`${l}=?`),n.push(P)},_=(l,P)=>{let a=[...new Set(P??[])].slice(0,100);if(a.length)E.push(`${l} IN (${a.map(()=>"?").join(",")})`),n.push(...a)};if(c("environment_id",t.environmentId),_("resource_id",t.resourceIds),_("kind",t.kinds),_("name",t.names),_("source",t.sources),_("level",t.levels),c("trace_id",t.traceId),c("request_id",t.requestId),c("deployment_id",t.deploymentId),c("release_id",t.releaseId),c("workload_id",t.workloadId),t.text)E.push("(message LIKE ? OR name LIKE ?)"),n.push(`%${t.text.slice(0,256)}%`,`%${t.text.slice(0,256)}%`);let i=iC(t.cursor);if(i)E.push("(timestamp<? OR (timestamp=? AND id<?))"),n.push(i.timestamp,i.timestamp,i.id);let T=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE ${E.join(" AND ")} ORDER BY timestamp DESC, id DESC LIMIT ?`).all(...n,d+1),h=T.slice(0,d).map(PT),R=T.length>d,N=new Map;for(let l of h)N.set(l.source,[...N.get(l.source)??[],l]);let A=this.now().getTime(),u=[...N].map(([l,P])=>{let a=P.reduce((B,F)=>F.observedAt>B?F.observedAt:B,P[0].observedAt),j=A-new Date(a).getTime();return{source:l,latestAt:a,freshness:j<=120000?"live":j<=600000?"stale":"unavailable",count:P.length}}),U=Math.max(60000,(r.getTime()-e.getTime())/100),w=[...N].flatMap(([l,P])=>{let a=[...new Set(P.map((j)=>new Date(j.timestamp).getTime()))].sort((j,B)=>j-B);return a.slice(1).flatMap((j,B)=>j-a[B]>U?[{from:new Date(a[B]).toISOString(),to:new Date(j).toISOString(),source:l}]:[])});return{records:h,nextCursor:R?jT(h.at(-1)):void 0,truncated:R,scannedRange:{from:e.toISOString(),to:r.toISOString()},sources:u,gaps:w}}tail(t,e){let{from:r,to:d}=aT(t),E=Math.min(1000,Math.max(1,Math.floor(t.limit??200))),n=["project_id=?","timestamp>=?","timestamp<?"],c=[t.projectId,r.toISOString(),d.toISOString()],_=(N,A)=>{if(A)n.push(`${N}=?`),c.push(A)},i=(N,A)=>{let u=[...new Set(A??[])].slice(0,100);if(u.length)n.push(`${N} IN (${u.map(()=>"?").join(",")})`),c.push(...u)};if(_("environment_id",t.environmentId),i("resource_id",t.resourceIds),i("kind",t.kinds),i("name",t.names),i("source",t.sources),i("level",t.levels),_("trace_id",t.traceId),_("request_id",t.requestId),_("deployment_id",t.deploymentId),_("release_id",t.releaseId),_("workload_id",t.workloadId),t.text)n.push("(message LIKE ? OR name LIKE ?)"),c.push(`%${t.text.slice(0,256)}%`,`%${t.text.slice(0,256)}%`);let T=iC(e);if(T)n.push("(timestamp>? OR (timestamp=? AND id>?))"),c.push(T.timestamp,T.timestamp,T.id);let h=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE ${n.join(" AND ")} ORDER BY timestamp ASC, id ASC LIMIT ?`).all(...c,E+1),R=h.slice(0,E).map(PT);return{records:R,cursor:jT(R.at(-1))??e,truncated:h.length>E}}series(t){let{from:e,to:r}=aT(t),d=Math.min(86400000,Math.max(1000,Math.floor(t.bucketMs)));if((r.getTime()-e.getTime())/d>2000)throw Error("Telemetry series are limited to 2,000 buckets.");let E=this.query({...t,kinds:["metric"],limit:5000,cursor:void 0}),n=new Map;for(let _ of E.records)n.set(`${_.source}\x00${_.name}`,[...n.get(`${_.source}\x00${_.name}`)??[],_]);let c=(_,i,T)=>{let h=new Map;for(let N of _){let A=i.getTime()+Math.floor((new Date(N.timestamp).getTime()-i.getTime())/d)*d;if(A>=i.getTime()&&A<T.getTime()&&N.value!=null)h.set(A,[...h.get(A)??[],N.value])}let R=[];for(let N=i.getTime();N<T.getTime();N+=d){let A=h.get(N)??[],u=Kc(A,t.aggregation);R.push({timestamp:new Date(N).toISOString(),label:B1(new Date(N),t.timezone),value:u,count:A.length,gap:u==null})}return R};return[...n].map(([_,i])=>{let[T,h]=_.split("\x00"),R={name:h,source:T,unit:i.find((N)=>N.unit)?.unit,aggregation:t.aggregation,bucketMs:d,points:c(i,e,r)};if(t.compareFrom&&t.compareTo){let N=this.query({...t,from:t.compareFrom,to:t.compareTo,kinds:["metric"],limit:5000,cursor:void 0}).records.filter((A)=>A.source===T&&A.name===h);R.comparison=c(N,Un(t.compareFrom,"compareFrom"),Un(t.compareTo,"compareTo"))}return R})}status(t,e,r=30,d=1,E){let n=[t],c=e?" AND environment_id=?":"";if(e)n.push(e);let _=[...new Set(E??[])].slice(0,100);if(E&&_.length===0)return[];let i=E?` AND resource_id IN (${_.map(()=>"?").join(",")||"''"})`:"";n.push(..._);let T=this.controlPlane.database.query(`SELECT source, MAX(latest_observed_at) latest, SUM(ingested_bytes) bytes, SUM(record_count) count, MIN(first_observed_at) first FROM telemetry_source_rollups WHERE project_id=?${c}${i} GROUP BY source`).all(...n),h=this.now().getTime();return T.map((R)=>{let N=String(R.latest),A=Math.max(0,Math.floor((h-new Date(N).getTime())/1000)),u=Math.max(1,(new Date(N).getTime()-new Date(String(R.first)).getTime())/86400000);return{source:String(R.source),freshness:A<=120?"live":A<=600?"stale":"unavailable",lastObservedAt:N,lagSeconds:A,samplingRate:d,retentionDays:r,estimatedDailyBytes:Math.round(Number(R.bytes)/u)}})}saveQuery(t,e,r,d){let E=r.trim().slice(0,80);if(!E)throw Error("Saved telemetry queries require a name.");if(aT(d),d.projectId!==t)throw Error("Saved telemetry queries cannot cross project scope.");let n=this.now().toISOString(),c=JSON.stringify(Gc(d,this.options.redaction));if(Buffer.byteLength(c)>16384)throw Error("Saved telemetry queries are limited to 16 KB.");let _=this.controlPlane.database.query("SELECT * FROM telemetry_saved_queries WHERE project_id=? AND actor_id IS ? AND name=?").get(t,e??null,E),i=_?String(_.id):crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO telemetry_saved_queries (id, project_id, actor_id, name, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?) ON CONFLICT(project_id, actor_id, name) DO UPDATE SET query=excluded.query, updated_at=excluded.updated_at",[i,t,e??null,E,c,_?String(_.created_at):n,n]),{id:i,projectId:t,actorId:e,name:E,query:JSON.parse(c),createdAt:_?String(_.created_at):n,updatedAt:n}}listSavedQueries(t,e){return this.controlPlane.database.query("SELECT * FROM telemetry_saved_queries WHERE project_id=? AND actor_id IS ? ORDER BY updated_at DESC").all(t,e??null).map((r)=>({id:String(r.id),projectId:String(r.project_id),actorId:Ie(r.actor_id),name:String(r.name),query:JSON.parse(String(r.query)),createdAt:String(r.created_at),updatedAt:String(r.updated_at)}))}deleteSavedQuery(t,e,r){return this.controlPlane.database.run("DELETE FROM telemetry_saved_queries WHERE id=? AND project_id=? AND actor_id IS ?",[r,t,e??null]).changes>0}downsample(t,e){let r=Math.min(86400000,Math.max(60000,Math.floor(t.downsampleBucketMs))),d=new Date(this.now().getTime()-Math.max(1,t.downsampleAfterDays)*86400000).toISOString(),E=new Date(this.now().getTime()-Math.max(1,t.rawDays)*86400000).toISOString(),n=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE kind='metric' AND source NOT LIKE '%:rollup' AND timestamp>=? AND timestamp<?${e?" AND project_id=?":""} ORDER BY timestamp ASC LIMIT 50001`).all(E,d,...e?[e]:[]);if(n.length>50000)throw Error("Telemetry downsampling is limited to 50,000 raw points per pass; run compaction more frequently.");let c=n.map(PT),_=new Map;for(let T of c){let h=Math.floor(new Date(T.timestamp).getTime()/r)*r,R=JSON.stringify([T.projectId,T.environmentId??"",T.resourceId??"",T.source,T.name,T.unit??"",h]);_.set(R,[..._.get(R)??[],T])}return this.controlPlane.database.transaction(()=>{for(let T=0;T<c.length;T+=500){let h=c.slice(T,T+500).map((R)=>R.id);if(h.length)this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE id IN (${h.map(()=>"?").join(",")})`,h)}for(let[T,h]of _){let[R,N,A,u,U,w,l]=JSON.parse(T),P=h.flatMap((a)=>a.value==null?[]:[a.value]);this.append({projectId:R,environmentId:N||void 0,resourceId:A||void 0,kind:"metric",source:`${u}:rollup`,name:U,unit:w||void 0,timestamp:new Date(l).toISOString(),value:Kc(P,"avg"),attributes:{downsampled:!0,count:P.length,min:Kc(P,"min"),max:Kc(P,"max"),p95:Kc(P,"p95"),bucketMs:r}})}})(),{compacted:c.length,rollups:_.size}}enforceRetention(t,e){let r=this.downsample(t,e),d=Math.min(3650,Math.max(1,Math.floor(t.rawDays))),E=new Date(this.now().getTime()-d*86400000).toISOString(),n=e?" AND project_id=?":"",c=this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE timestamp<?${n}`,e?[E,e]:[E]).changes,_=Number(this.controlPlane.database.query(`SELECT MAX(0, COUNT(*)-?) excess FROM telemetry_records${e?" WHERE project_id=?":""}`).get(t.maxRecords,...e?[e]:[])?.excess??0);if(_>0)this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE id IN (SELECT id FROM telemetry_records${e?" WHERE project_id=?":""} ORDER BY timestamp ASC LIMIT ?)`,e?[e,_]:[_]);return this.rebuildStatusRollups(e),{deleted:c+_,...r}}rebuildStatusRollups(t){let e=t?" WHERE project_id=?":"",r=t?[t]:[];this.controlPlane.database.transaction(()=>{this.controlPlane.database.run(`DELETE FROM telemetry_source_rollups${e}`,r),this.controlPlane.database.run(`INSERT INTO telemetry_source_rollups (
+${JSON.stringify(e,null,2)}`}),{ok:!0,status:202}}let E=r.url??r.value,n=e,c={"content-type":"application/json"};if(t.kind==="slack")n={text:d};if(t.kind==="discord")n={content:d};if(t.kind==="teams")n={text:d};if(t.kind==="telegram")E=`https://api.telegram.org/bot${r.botToken??r.value}/sendMessage`,n={chat_id:t.config.chatId,text:d};if(!E||!/^https:\/\//.test(E))return{ok:!1,error:"Channel endpoint is unavailable or not HTTPS."};let _=JSON.stringify(n);if(t.kind==="webhook"&&r.signingSecret){let h=Math.floor(this.now().getTime()/1000).toString();c["x-ts-cloud-timestamp"]=h,c["x-ts-cloud-signature"]=`v1=${u1("sha256",r.signingSecret).update(`${h}.${_}`).digest("hex")}`}let i=new AbortController,T=setTimeout(()=>i.abort(),1e4);try{let h=await this.fetchImpl(E,{method:"POST",headers:c,body:_,signal:i.signal});return h.ok?{ok:!0,status:h.status}:{ok:!1,status:h.status,error:`Channel returned HTTP ${h.status}.`}}finally{clearTimeout(T)}}catch(E){return{ok:!1,error:E instanceof Error?E.message:String(E)}}}async deliver(t){let e=this.store.getDelivery(t);if(!e)throw Error("Notification delivery was not found.");if(e.state==="delivered"||e.state==="dead"||e.nextAttemptAt&&e.nextAttemptAt>this.now().toISOString())return e;let r=this.store.getChannel(e.channelId);if(!r||r.status==="disabled"||r.status==="paused")return this.store.updateDelivery(t,{state:"failed",attempt:e.attempt+1,error:"Notification channel is unavailable."});let d=e.attempt+1,E=await this.send(r,e.payload);if(E.ok)return this.store.setChannelStatus(r.id,"active"),this.store.updateDelivery(t,{state:"delivered",attempt:d,responseStatus:E.status,deliveredAt:this.now().toISOString()});let c=!(!E.status||E.status===429||E.status>=500)||d>=e.maxAttempts,_=c?void 0:new Date(this.now().getTime()+Math.min(3600000,30000*2**(d-1))).toISOString();return this.store.setChannelStatus(r.id,"failing",E.error),this.store.updateDelivery(t,{state:c?"dead":"retrying",attempt:d,nextAttemptAt:_,responseStatus:E.status,error:E.error})}async deliverAll(t){return Promise.all(t.map((e)=>this.deliver(e.id)))}async retryDue(){let t=this.now().toISOString(),e=this.store.listDeliveries({states:["pending","retrying"]}).filter((r)=>!r.nextAttemptAt||r.nextAttemptAt<=t);return this.deliverAll(e)}async testChannel(t){let e=this.store.getChannel(t);if(!e)throw Error("Notification channel was not found.");let r=await this.send(e,{schemaVersion:1,event:"test",message:"ts-cloud notification channel test. No incident was created."});return this.store.markChannelTest(t,r.ok,r.error),r}}import{lookup as U1}from"node:dns/promises";import{connect as f1}from"node:net";async function w1(t,e){let r=Bun.spawn(t,{stdout:"pipe",stderr:"pipe"}),d=setTimeout(()=>r.kill(),e);try{return{exitCode:await r.exited,stdout:await new Response(r.stdout).text(),stderr:await new Response(r.stderr).text()}}finally{clearTimeout(d)}}class DE{store;options;constructor(t,e={}){this.store=t;this.options=e}now(){return this.options.now?.()??new Date}async probe(t){let e=performance.now(),r=this.now().toISOString(),d=this.options.agent??"local";try{if(t.kind==="http"){let c=new URL(t.target),_=performance.now();await(this.options.lookupImpl??U1)(c.hostname);let i=performance.now()-_,T=new AbortController,h=setTimeout(()=>T.abort(),t.timeoutSeconds*1000);try{let R=performance.now(),N=await(this.options.fetchImpl??fetch)(c.toString(),{method:t.config.method??"GET",headers:t.config.headers,signal:T.signal,redirect:"manual"}),A=performance.now()-R,u=t.config.expectedBody?await N.text():"",U=t.config.expectedStatuses??[200,201,202,204],w=U.includes(N.status)&&(!t.config.expectedBody||u.includes(t.config.expectedBody));return{checkId:t.id,status:w?"healthy":"unhealthy",agent:d,region:this.options.region,statusCode:N.status,message:w?void 0:`Expected ${U.join("/")} and configured body match.`,timings:{dnsMs:i,ttfbMs:A,totalMs:performance.now()-e},checkedAt:r}}finally{clearTimeout(h)}}if(t.kind==="tcp"){let c=Number(t.config.port);if(!Number.isInteger(c)||c<1||c>65535)throw Error("TCP health check requires a valid port.");let _=performance.now();return await new Promise((i,T)=>{let h=f1({host:t.target,port:c}),R=setTimeout(()=>{h.destroy(),T(Error("TCP health check timed out."))},t.timeoutSeconds*1000);h.once("connect",()=>{clearTimeout(R),h.destroy(),i()}),h.once("error",(N)=>{clearTimeout(R),T(N)})}),{checkId:t.id,status:"healthy",agent:d,region:this.options.region,timings:{connectMs:performance.now()-_,totalMs:performance.now()-e},checkedAt:r}}let E=t.config.command??[];if(!E.length)throw Error("Command health check is not configured.");let n=await(this.options.commandImpl??w1)(E,t.timeoutSeconds*1000);return{checkId:t.id,status:n.exitCode===0?"healthy":"unhealthy",agent:d,region:this.options.region,message:n.exitCode===0?void 0:(n.stderr||n.stdout||`Command exited ${n.exitCode}`).slice(0,1000),timings:{totalMs:performance.now()-e},checkedAt:r}}catch(E){return{checkId:t.id,status:"unhealthy",agent:d,region:this.options.region,message:(E instanceof Error?E.message:String(E)).slice(0,1000),timings:{totalMs:performance.now()-e},checkedAt:r}}}async run(t){return this.store.appendHealthResult(await this.probe(t))}async runAndEvaluate(t){let e=await this.run(t),r=new Mc(this.store),d=this.store.listRules(t.projectId,t.environmentId).filter((E)=>E.healthCheckId===t.id);return{result:e,evaluations:d.map((E)=>r.evaluate(E,{status:e.status,timestamp:e.checkedAt,group:{agent:e.agent,region:e.region??""},evidence:{healthResultId:e.id,statusCode:e.statusCode??null,message:e.message??null,timings:e.timings}}))}}}var g1=Object.freeze({rawDays:30,downsampleAfterDays:7,downsampleBucketMs:3600000,maxRecords:1e6,samplingRate:1,collectLogs:!0,collectTraces:!0,collectRequestAnalytics:!0,estimatedStorageUsdPerGbMonth:0});function yT(t,e,r,d){let E=Number(t);return Number.isFinite(E)?Math.min(d,Math.max(r,Math.floor(E))):e}function dC(t,e,r,d){let E=Number(t);return Number.isFinite(E)?Math.min(d,Math.max(r,E)):e}function ZR(t,e){return typeof t==="boolean"?t:e}function EC(t,e={...g1}){let r=t&&typeof t==="object"&&!Array.isArray(t)?t:{},d=yT(r.rawDays,e.rawDays,1,3650),E=yT(r.downsampleAfterDays,e.downsampleAfterDays,1,d);return{rawDays:d,downsampleAfterDays:E,downsampleBucketMs:yT(r.downsampleBucketMs,e.downsampleBucketMs,60000,86400000),maxRecords:yT(r.maxRecords,e.maxRecords,1000,1e8),samplingRate:dC(r.samplingRate,e.samplingRate,0.01,1),collectLogs:ZR(r.collectLogs,e.collectLogs),collectTraces:ZR(r.collectTraces,e.collectTraces),collectRequestAnalytics:ZR(r.collectRequestAnalytics,e.collectRequestAnalytics),estimatedStorageUsdPerGbMonth:dC(r.estimatedStorageUsdPerGbMonth,e.estimatedStorageUsdPerGbMonth,0,1e4)}}function nC(t){return`telemetry.policy:${t}`}function Dn(t,e){return EC(t.getSetting(nC(e)))}function cC(t,e,r){let d=EC(r,Dn(t,e));return t.setSetting(nC(e),d),d}function _C(t,e){return Number((Math.max(0,t)/1073741824*e.estimatedStorageUsdPerGbMonth).toFixed(4))}var $1=/(?:authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key|session)/i,y1=/\b(?:authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)\s*[=:]\s*[^\s,;&\[]+/gi,X1=/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,P1=/\b(?:\d{1,3}\.){3}\d{1,3}\b/g;function kR(t,e={}){let r=t.replace(/([?&][^=&#\s]+)=([^&#\s]*)/g,"$1=[REDACTED]").replace(y1,"[REDACTED]");if(e.redactEmail!==!1)r=r.replace(X1,"[EMAIL]");if(e.redactIp)r=r.replace(P1,"[IP]");for(let d of e.patterns??[])r=r.replace(d,"[REDACTED]");return r}function Gc(t,e={},r){if(r&&$1.test(r))return"[REDACTED]";if(t===null||typeof t==="boolean"||typeof t==="number")return t;if(typeof t==="string")return kR(t,e);if(Array.isArray(t))return t.map((d)=>Gc(d,e));if(t&&typeof t==="object"){let d={};for(let[E,n]of Object.entries(t))d[E]=Gc(n,e,E);return d}return String(t??"")}function XT(t){if(!t)return;return t.split("?",1)[0].replace(/\b[0-9a-f]{8}-[0-9a-f-]{27,}\b/gi,":id").replace(/\/(?:(?:\d{4,})|(?:[0-9a-f]{16,}))(?:\/|$)/gi,(r)=>r.endsWith("/")?"/:id/":"/:id").slice(0,512)}var TC=65536,a1=2678400000,j1=new Set(["metric","log","trace","request","event"]);function le(t){return typeof t==="string"?t:void 0}function Vc(t){return t==null?void 0:Number(t)}function z1(t){if(typeof t!=="string")return{};try{return JSON.parse(t)}catch{return{}}}function PT(t){return{id:String(t.id),projectId:String(t.project_id),environmentId:le(t.environment_id),resourceId:le(t.resource_id),kind:String(t.kind),source:String(t.source),name:String(t.name),timestamp:String(t.timestamp),observedAt:String(t.observed_at),value:Vc(t.value),unit:le(t.unit),level:le(t.level),message:le(t.message),durationMs:Vc(t.duration_ms),statusCode:Vc(t.status_code),method:le(t.method),host:le(t.host),pathTemplate:le(t.path_template),bytesIn:Vc(t.bytes_in),bytesOut:Vc(t.bytes_out),region:le(t.region),cacheResult:le(t.cache_result),upstream:le(t.upstream),traceId:le(t.trace_id),requestId:le(t.request_id),deploymentId:le(t.deployment_id),releaseId:le(t.release_id),workloadId:le(t.workload_id),sampled:Number(t.sampled)===1,attributes:z1(t.attributes),ingestedBytes:Number(t.ingested_bytes)}}function Un(t,e){let r=new Date(t);if(!t||!Number.isFinite(r.getTime()))throw Error(`${e} must be a valid ISO-8601 instant.`);return r}function aT(t){let e=Un(t.from,"from"),r=Un(t.to,"to");if(e>=r)throw Error("Telemetry from must be earlier than to.");if(r.getTime()-e.getTime()>a1)throw Error("Telemetry queries are limited to 31 days.");return{from:e,to:r}}function iC(t){if(!t)return;try{let e=JSON.parse(Buffer.from(t,"base64url").toString("utf8"));if(typeof e?.timestamp!=="string"||typeof e?.id!=="string")throw Error();return e}catch{throw Error("Telemetry cursor is invalid.")}}function jT(t){return t?Buffer.from(JSON.stringify({timestamp:t.timestamp,id:t.id})).toString("base64url"):void 0}function F1(t,e){if(!t.length)return;let r=[...t].sort((E,n)=>E-n),d=Math.max(0,Math.min(r.length-1,Math.ceil(e/100*r.length)-1));return r[d]}function Kc(t,e){if(e==="count")return t.length;if(!t.length)return;if(e==="sum")return t.reduce((r,d)=>r+d,0);if(e==="avg")return t.reduce((r,d)=>r+d,0)/t.length;if(e==="min")return Math.min(...t);if(e==="max")return Math.max(...t);return F1(t,Number(e.slice(1)))}function B1(t,e="UTC"){try{return new Intl.DateTimeFormat("en-US",{timeZone:e,month:"short",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZoneName:"short"}).format(t)}catch{throw Error(`Unknown telemetry timezone: ${e}`)}}class UE{controlPlane;options;constructor(t,e={}){this.controlPlane=t;this.options=e}now(){return this.options.now?.()??new Date}append(t){if(!j1.has(t.kind))throw Error(`Unsupported telemetry kind: ${t.kind}`);let e=Un(t.timestamp,"timestamp").toISOString(),r=t.observedAt?Un(t.observedAt,"observedAt").toISOString():this.now().toISOString(),d=Gc(t.attributes??{},this.options.redaction),E=t.message?kR(t.message,this.options.redaction).slice(0,32768):void 0,n=XT(t.pathTemplate),c=t.id??crypto.randomUUID(),_=JSON.stringify({...t,id:c,timestamp:e,observedAt:r,attributes:d,message:E,pathTemplate:n}),i=Buffer.byteLength(_);if(i>TC)throw Error(`Telemetry records are limited to ${TC} bytes.`);return this.controlPlane.database.run("INSERT OR IGNORE INTO telemetry_records (id, project_id, environment_id, resource_id, kind, source, name, timestamp, observed_at, value, unit, level, message, duration_ms, status_code, method, host, path_template, bytes_in, bytes_out, region, cache_result, upstream, trace_id, request_id, deployment_id, release_id, workload_id, sampled, attributes, ingested_bytes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[c,t.projectId,t.environmentId??null,t.resourceId??null,t.kind,t.source.slice(0,128),t.name.slice(0,256),e,r,t.value??null,t.unit??null,t.level??null,E??null,t.durationMs??null,t.statusCode??null,t.method?.slice(0,16)??null,t.host?.slice(0,256)??null,n??null,t.bytesIn??null,t.bytesOut??null,t.region?.slice(0,64)??null,t.cacheResult?.slice(0,64)??null,t.upstream?.slice(0,256)??null,t.traceId?.slice(0,256)??null,t.requestId?.slice(0,256)??null,t.deploymentId?.slice(0,256)??null,t.releaseId?.slice(0,256)??null,t.workloadId?.slice(0,512)??null,t.sampled===!1?0:1,JSON.stringify(d),i]),this.get(c)}appendMany(t){if(t.length>1e4)throw Error("Telemetry batches are limited to 10,000 records.");return this.controlPlane.database.transaction((r)=>r.map((d)=>this.append(d)))(t)}get(t){let e=this.controlPlane.database.query("SELECT * FROM telemetry_records WHERE id=?").get(t);return e?PT(e):void 0}query(t){let{from:e,to:r}=aT(t),d=Math.min(5000,Math.max(1,Math.floor(t.limit??500))),E=["project_id=?","timestamp>=?","timestamp<?"],n=[t.projectId,e.toISOString(),r.toISOString()],c=(l,P)=>{if(P)E.push(`${l}=?`),n.push(P)},_=(l,P)=>{let a=[...new Set(P??[])].slice(0,100);if(a.length)E.push(`${l} IN (${a.map(()=>"?").join(",")})`),n.push(...a)};if(c("environment_id",t.environmentId),_("resource_id",t.resourceIds),_("kind",t.kinds),_("name",t.names),_("source",t.sources),_("level",t.levels),c("trace_id",t.traceId),c("request_id",t.requestId),c("deployment_id",t.deploymentId),c("release_id",t.releaseId),c("workload_id",t.workloadId),t.text)E.push("(message LIKE ? OR name LIKE ?)"),n.push(`%${t.text.slice(0,256)}%`,`%${t.text.slice(0,256)}%`);let i=iC(t.cursor);if(i)E.push("(timestamp<? OR (timestamp=? AND id<?))"),n.push(i.timestamp,i.timestamp,i.id);let T=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE ${E.join(" AND ")} ORDER BY timestamp DESC, id DESC LIMIT ?`).all(...n,d+1),h=T.slice(0,d).map(PT),R=T.length>d,N=new Map;for(let l of h)N.set(l.source,[...N.get(l.source)??[],l]);let A=this.now().getTime(),u=[...N].map(([l,P])=>{let a=P.reduce((B,F)=>F.observedAt>B?F.observedAt:B,P[0].observedAt),j=A-new Date(a).getTime();return{source:l,latestAt:a,freshness:j<=120000?"live":j<=600000?"stale":"unavailable",count:P.length}}),U=Math.max(60000,(r.getTime()-e.getTime())/100),w=[...N].flatMap(([l,P])=>{let a=[...new Set(P.map((j)=>new Date(j.timestamp).getTime()))].sort((j,B)=>j-B);return a.slice(1).flatMap((j,B)=>j-a[B]>U?[{from:new Date(a[B]).toISOString(),to:new Date(j).toISOString(),source:l}]:[])});return{records:h,nextCursor:R?jT(h.at(-1)):void 0,truncated:R,scannedRange:{from:e.toISOString(),to:r.toISOString()},sources:u,gaps:w}}tail(t,e){let{from:r,to:d}=aT(t),E=Math.min(1000,Math.max(1,Math.floor(t.limit??200))),n=["project_id=?","timestamp>=?","timestamp<?"],c=[t.projectId,r.toISOString(),d.toISOString()],_=(N,A)=>{if(A)n.push(`${N}=?`),c.push(A)},i=(N,A)=>{let u=[...new Set(A??[])].slice(0,100);if(u.length)n.push(`${N} IN (${u.map(()=>"?").join(",")})`),c.push(...u)};if(_("environment_id",t.environmentId),i("resource_id",t.resourceIds),i("kind",t.kinds),i("name",t.names),i("source",t.sources),i("level",t.levels),_("trace_id",t.traceId),_("request_id",t.requestId),_("deployment_id",t.deploymentId),_("release_id",t.releaseId),_("workload_id",t.workloadId),t.text)n.push("(message LIKE ? OR name LIKE ?)"),c.push(`%${t.text.slice(0,256)}%`,`%${t.text.slice(0,256)}%`);let T=iC(e);if(T)n.push("(timestamp>? OR (timestamp=? AND id>?))"),c.push(T.timestamp,T.timestamp,T.id);let h=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE ${n.join(" AND ")} ORDER BY timestamp ASC, id ASC LIMIT ?`).all(...c,E+1),R=h.slice(0,E).map(PT);return{records:R,cursor:jT(R.at(-1))??e,truncated:h.length>E}}series(t){let{from:e,to:r}=aT(t),d=Math.min(86400000,Math.max(1000,Math.floor(t.bucketMs)));if((r.getTime()-e.getTime())/d>2000)throw Error("Telemetry series are limited to 2,000 buckets.");let E=this.query({...t,kinds:["metric"],limit:5000,cursor:void 0}),n=new Map;for(let _ of E.records)n.set(`${_.source}\x00${_.name}`,[...n.get(`${_.source}\x00${_.name}`)??[],_]);let c=(_,i,T)=>{let h=new Map;for(let N of _){let A=i.getTime()+Math.floor((new Date(N.timestamp).getTime()-i.getTime())/d)*d;if(A>=i.getTime()&&A<T.getTime()&&N.value!=null)h.set(A,[...h.get(A)??[],N.value])}let R=[];for(let N=i.getTime();N<T.getTime();N+=d){let A=h.get(N)??[],u=Kc(A,t.aggregation);R.push({timestamp:new Date(N).toISOString(),label:B1(new Date(N),t.timezone),value:u,count:A.length,gap:u==null})}return R};return[...n].map(([_,i])=>{let[T,h]=_.split("\x00"),R={name:h,source:T,unit:i.find((N)=>N.unit)?.unit,aggregation:t.aggregation,bucketMs:d,points:c(i,e,r)};if(t.compareFrom&&t.compareTo){let N=this.query({...t,from:t.compareFrom,to:t.compareTo,kinds:["metric"],limit:5000,cursor:void 0}).records.filter((A)=>A.source===T&&A.name===h);R.comparison=c(N,Un(t.compareFrom,"compareFrom"),Un(t.compareTo,"compareTo"))}return R})}status(t,e,r=30,d=1,E){let n=[t],c=e?" AND environment_id=?":"";if(e)n.push(e);let _=[...new Set(E??[])].slice(0,100);if(E&&_.length===0)return[];let i=E?` AND resource_id IN (${_.map(()=>"?").join(",")||"''"})`:"";n.push(..._);let T=this.controlPlane.database.query(`SELECT source, MAX(latest_observed_at) latest, SUM(ingested_bytes) bytes, SUM(record_count) count, MIN(first_observed_at) first FROM telemetry_source_rollups WHERE project_id=?${c}${i} GROUP BY source`).all(...n),h=this.now().getTime();return T.map((R)=>{let N=String(R.latest),A=Math.max(0,Math.floor((h-new Date(N).getTime())/1000)),u=Math.max(1,(new Date(N).getTime()-new Date(String(R.first)).getTime())/86400000);return{source:String(R.source),freshness:A<=120?"live":A<=600?"stale":"unavailable",lastObservedAt:N,lagSeconds:A,samplingRate:d,retentionDays:r,estimatedDailyBytes:Math.round(Number(R.bytes)/u)}})}saveQuery(t,e,r,d){let E=r.trim().slice(0,80);if(!E)throw Error("Saved telemetry queries require a name.");if(aT(d),d.projectId!==t)throw Error("Saved telemetry queries cannot cross project scope.");let n=this.now().toISOString(),c=JSON.stringify(Gc(d,this.options.redaction));if(Buffer.byteLength(c)>16384)throw Error("Saved telemetry queries are limited to 16 KB.");let _=this.controlPlane.database.query("SELECT * FROM telemetry_saved_queries WHERE project_id=? AND actor_id IS ? AND name=?").get(t,e??null,E),i=_?String(_.id):crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO telemetry_saved_queries (id, project_id, actor_id, name, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?) ON CONFLICT(project_id, actor_id, name) DO UPDATE SET query=excluded.query, updated_at=excluded.updated_at",[i,t,e??null,E,c,_?String(_.created_at):n,n]),{id:i,projectId:t,actorId:e,name:E,query:JSON.parse(c),createdAt:_?String(_.created_at):n,updatedAt:n}}listSavedQueries(t,e){return this.controlPlane.database.query("SELECT * FROM telemetry_saved_queries WHERE project_id=? AND actor_id IS ? ORDER BY updated_at DESC").all(t,e??null).map((r)=>({id:String(r.id),projectId:String(r.project_id),actorId:le(r.actor_id),name:String(r.name),query:JSON.parse(String(r.query)),createdAt:String(r.created_at),updatedAt:String(r.updated_at)}))}deleteSavedQuery(t,e,r){return this.controlPlane.database.run("DELETE FROM telemetry_saved_queries WHERE id=? AND project_id=? AND actor_id IS ?",[r,t,e??null]).changes>0}downsample(t,e){let r=Math.min(86400000,Math.max(60000,Math.floor(t.downsampleBucketMs))),d=new Date(this.now().getTime()-Math.max(1,t.downsampleAfterDays)*86400000).toISOString(),E=new Date(this.now().getTime()-Math.max(1,t.rawDays)*86400000).toISOString(),n=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE kind='metric' AND source NOT LIKE '%:rollup' AND timestamp>=? AND timestamp<?${e?" AND project_id=?":""} ORDER BY timestamp ASC LIMIT 50001`).all(E,d,...e?[e]:[]);if(n.length>50000)throw Error("Telemetry downsampling is limited to 50,000 raw points per pass; run compaction more frequently.");let c=n.map(PT),_=new Map;for(let T of c){let h=Math.floor(new Date(T.timestamp).getTime()/r)*r,R=JSON.stringify([T.projectId,T.environmentId??"",T.resourceId??"",T.source,T.name,T.unit??"",h]);_.set(R,[..._.get(R)??[],T])}return this.controlPlane.database.transaction(()=>{for(let T=0;T<c.length;T+=500){let h=c.slice(T,T+500).map((R)=>R.id);if(h.length)this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE id IN (${h.map(()=>"?").join(",")})`,h)}for(let[T,h]of _){let[R,N,A,u,U,w,l]=JSON.parse(T),P=h.flatMap((a)=>a.value==null?[]:[a.value]);this.append({projectId:R,environmentId:N||void 0,resourceId:A||void 0,kind:"metric",source:`${u}:rollup`,name:U,unit:w||void 0,timestamp:new Date(l).toISOString(),value:Kc(P,"avg"),attributes:{downsampled:!0,count:P.length,min:Kc(P,"min"),max:Kc(P,"max"),p95:Kc(P,"p95"),bucketMs:r}})}})(),{compacted:c.length,rollups:_.size}}enforceRetention(t,e){let r=this.downsample(t,e),d=Math.min(3650,Math.max(1,Math.floor(t.rawDays))),E=new Date(this.now().getTime()-d*86400000).toISOString(),n=e?" AND project_id=?":"",c=this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE timestamp<?${n}`,e?[E,e]:[E]).changes,_=Number(this.controlPlane.database.query(`SELECT MAX(0, COUNT(*)-?) excess FROM telemetry_records${e?" WHERE project_id=?":""}`).get(t.maxRecords,...e?[e]:[])?.excess??0);if(_>0)this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE id IN (SELECT id FROM telemetry_records${e?" WHERE project_id=?":""} ORDER BY timestamp ASC LIMIT ?)`,e?[e,_]:[_]);return this.rebuildStatusRollups(e),{deleted:c+_,...r}}rebuildStatusRollups(t){let e=t?" WHERE project_id=?":"",r=t?[t]:[];this.controlPlane.database.transaction(()=>{this.controlPlane.database.run(`DELETE FROM telemetry_source_rollups${e}`,r),this.controlPlane.database.run(`INSERT INTO telemetry_source_rollups (
           project_id, environment_id, resource_id, source,
           first_observed_at, latest_observed_at, ingested_bytes, record_count
         )
@@ -5537,7 +5537,7 @@ data: ${JSON.stringify(b)}
             SELECT 1 FROM backup_jobs bj WHERE bj.recovery_point_id=rp.id
             AND bj.kind IN ('restore','drill') AND bj.status IN ('queued','running','cleanup_required')
           )
-        ORDER BY rp.expires_at,rp.id`).all(t.toISOString(),t.toISOString()).map(eN),r=new Set;for(let d of new Set(e.map((E)=>E.projectId)))for(let E of this.listPolicies(d)){let n=this.listRecoveryPoints(E.projectId,E.id).filter((_)=>_.status==="available").sort((_,i)=>i.pointInTime.localeCompare(_.pointInTime));for(let _ of n.slice(0,Math.max(0,E.retention.keepLast??0)))r.add(_.id);let c=[[E.retention.hourly,(_)=>_.toISOString().slice(0,13)],[E.retention.daily,(_)=>_.toISOString().slice(0,10)],[E.retention.weekly,(_)=>{return new Date(Date.UTC(_.getUTCFullYear(),_.getUTCMonth(),_.getUTCDate()-(_.getUTCDay()+6)%7)).toISOString().slice(0,10)}],[E.retention.monthly,(_)=>_.toISOString().slice(0,7)]];for(let[_,i]of c){let T=new Set;for(let h of n){let R=i(new Date(h.pointInTime));if(T.has(R))continue;if(T.add(R),T.size<=Math.max(0,_??0))r.add(h.id)}}}return e.filter((d)=>!r.has(d.id))}coverage(t,e=this.now()){let r=new Map(this.listDestinations(t).map((d)=>[d.id,d]));return this.listPolicies(t).map((d)=>{let E=this.listRecoveryPoints(t,d.id).filter((_)=>_.status==="available"),n=E[0],c=n?(e.getTime()-new Date(n.pointInTime).getTime())/60000:Number.POSITIVE_INFINITY;return{policy:d,lastRecoveryPoint:n,missedRpo:d.enabled&&c>d.expectedRpoMinutes,unverified:E.filter((_)=>_.verificationState!=="verified").length,destinationHealthy:r.get(d.destinationId)?.status==="healthy"}})}}er();import{createCipheriv as SX,createDecipheriv as NX,createHash as RI,randomBytes as SI}from"node:crypto";var EN=Buffer.from("TSCB1"),ci=(t)=>`sha256:${RI("sha256").update(t).digest("hex")}`;function NI(t){return RI("sha256").update(t).digest()}function AX(t,e,r){let d=r?Buffer.from(r):SI(12);if(d.length!==12)throw Error("Backup encryption IV must contain 12 bytes.");let E=SX("aes-256-gcm",NI(e),d),n=Buffer.concat([E.update(t),E.final()]),c=E.getAuthTag();return Buffer.concat([EN,d,c,n])}function LX(t,e){let r=Buffer.from(t);if(!r.subarray(0,EN.length).equals(EN))throw Error("Backup does not contain a valid encrypted envelope.");let d=r.subarray(5,17),E=r.subarray(17,33),n=r.subarray(33),c=NX("aes-256-gcm",NI(e),d);return c.setAuthTag(E),Buffer.concat([c.update(n),c.final()])}function uX(t){let e;try{e=JSON.parse(t)}catch{throw Error("Backup destination credential must be a JSON object with accessKeyId and secretAccessKey.")}if(!e.accessKeyId||!e.secretAccessKey)throw Error("Backup destination credential requires accessKeyId and secretAccessKey.");if(e.expiresAt){let r=new Date(String(e.expiresAt));if(!Number.isFinite(r.getTime()))throw Error("Backup destination credential expiresAt must be an ISO timestamp.");if(r.getTime()<=Date.now())throw Error("Backup destination credential has expired.")}return{accessKeyId:String(e.accessKeyId),secretAccessKey:String(e.secretAccessKey),sessionToken:e.sessionToken?String(e.sessionToken):void 0}}async function AI(t,e,r=new Date){if(!t.credentialRef)return{status:"default"};try{let d=JSON.parse(await e.resolve(t.credentialRef));if(!d.accessKeyId||!d.secretAccessKey)return{status:"invalid"};if(!d.expiresAt)return{status:"static"};let E=new Date(String(d.expiresAt));if(!Number.isFinite(E.getTime()))return{status:"invalid"};let n=E.getTime()-r.getTime();return{status:n<=0?"expired":n<=604800000?"expiring":"valid",expiresAt:E.toISOString()}}catch{return{status:"invalid"}}}class nN{secrets;clientFactory;multipartThreshold;partSize;constructor(t,e=(E,n)=>new re(E.region??"us-east-1",void 0,{endpoint:E.endpoint?new URL(E.endpoint).host:void 0,forcePathStyle:E.forcePathStyle,credentials:n}),r=8388608,d=8388608){this.secrets=t;this.clientFactory=e;this.multipartThreshold=r;this.partSize=d}async client(t){let e=t.credentialRef?uX(await this.secrets.resolve(t.credentialRef)):void 0;return this.clientFactory(t,e)}async test(t){if(!t.bucket)throw Error("S3 destination has no configured bucket.");let e=await this.client(t),r=`${t.prefix?`${t.prefix.replace(/\/$/,"")}/`:""}.ts-cloud-health/${crypto.randomUUID()}`;await e.putObject({bucket:t.bucket,key:r,body:"ts-cloud backup destination health check",contentType:"text/plain"});try{let d=await e.getObjectBytes(t.bucket,r);if(Buffer.from(d.body).toString()!=="ts-cloud backup destination health check")throw Error("Backup destination health object was corrupted.")}finally{await e.deleteObject(t.bucket,r)}}async upload(t,e){if(!t.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(t),d=ci(e.body),E=t.encryption!=="provider"?await this.secrets.resolve(t.encryptionKeyRef):void 0,n=E?e.resume?.encryptionIv?Buffer.from(e.resume.encryptionIv,"base64url"):SI(12):void 0,c=E?AX(e.body,E,n):Buffer.from(e.body),_=ci(c),i=`${t.prefix?`${t.prefix.replace(/\/$/,"")}/`:""}${e.key.replace(/^\/+/,"")}`,T=e.contentType??"application/octet-stream",h={"ts-cloud-format":"v1","ts-cloud-sha256":_.slice(7),"ts-cloud-encrypted":E?"true":"false"};if(e.resume&&e.resume.key!==i)throw Error("Multipart checkpoint does not match the requested backup key.");if(e.resume&&E&&!e.resume.encryptionIv)throw Error("Encrypted multipart checkpoint has no resumable envelope state.");if(e.resume&&E&&e.resume.plaintextChecksum!==d)throw Error("Encrypted multipart checkpoint does not match the backup payload.");if(c.length<this.multipartThreshold)await r.putObject({bucket:t.bucket,key:i,body:c,contentType:T,metadata:h});else{let R=e.resume?void 0:await r.createMultipartUpload(t.bucket,i,{contentType:T,metadata:h}),N=e.resume??{uploadId:R.UploadId,key:i,parts:[],bytesUploaded:0,encryptionIv:n?.toString("base64url"),plaintextChecksum:d},A=new Map(N.parts.map((U)=>[U.PartNumber,U])),u=Math.ceil(c.length/this.partSize);for(let U=0;U<u;U++){let w=U+1;if(!A.has(w)){let l=U*this.partSize,P=await r.uploadPart(t.bucket,i,N.uploadId,w,c.subarray(l,Math.min(c.length,l+this.partSize)));A.set(w,{PartNumber:w,ETag:P.ETag})}N.parts=[...A.values()].sort((l,P)=>l.PartNumber-P.PartNumber),N.bytesUploaded=Math.min(c.length,w*this.partSize),e.checkpoint?.(N)}await r.completeMultipartUpload(t.bucket,i,N.uploadId,N.parts)}return{uri:`s3://${t.bucket}/${i}`,key:i,sizeBytes:c.length,checksum:_,manifest:{format:"ts-cloud-backup-v1",encrypted:!!E,plaintextChecksum:d,storageChecksum:_,contentType:T}}}async download(t,e){if(!t.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(t),d=await r.getObjectBytes(t.bucket,e.key),E=Buffer.from(d.body);if(ci(E)!==e.checksum)throw Error("Backup checksum verification failed; object is corrupt.");let n=e.manifest.encrypted?LX(E,await this.secrets.resolve(t.encryptionKeyRef)):E;if(ci(n)!==e.manifest.plaintextChecksum)throw Error("Backup plaintext checksum verification failed.");return n}async abortPartial(t,e){if(!t.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(t)).abortMultipartUpload(t.bucket,e.key,e.uploadId)}async delete(t,e){if(!t.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(t)).deleteObject(t.bucket,e)}}import{createHash as OX}from"node:crypto";var CX=(t)=>`sha256:${OX("sha256").update(t).digest("hex")}`;class _i{store;queue;now;constructor(t,e,r=()=>new Date){this.store=t;this.queue=e;this.now=r}enqueueBackup(t,e=this.now().toISOString(),r){if(!t.enabled)throw Error("Backup policy is disabled.");let d=this.store.createJob({projectId:t.projectId,policyId:t.id,kind:"backup",status:"queued",idempotencyKey:`backup:${t.id}:${e}`,target:{scheduledFor:e},cancellability:"checkpoint_only",progress:{phase:"queued"}});if(!d.operationId){let E=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,actorId:r,kind:"backup.run",input:{backupJobId:d.id},lockKey:t.dataServiceId?`data-service:${t.dataServiceId}`:t.resourceId?`resource:${t.resourceId}`:`backup-policy:${t.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:14400,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(d.id,{operationId:E.operation.id})}return d}enqueueDue(t=this.now()){return this.store.duePolicies(t).map((e)=>{let r=e.nextRunAt;return this.store.advancePolicy(e.id,r),this.enqueueBackup(e,r)})}enqueueVerification(t){let e=this.store.createJob({projectId:t.projectId,policyId:t.policyId,recoveryPointId:t.id,kind:"verify",status:"queued",idempotencyKey:`verify:${t.id}:${t.checksum}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!e.operationId){let r=this.queue.enqueue({projectId:t.projectId,resourceId:t.resourceId,kind:"backup.verify",input:{backupJobId:e.id},lockKey:`recovery-point:${t.id}`,providerKey:"backup",maxAttempts:2,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(e.id,{operationId:r.operation.id})}return e}planRestore(t,e){if(t.status!=="available")throw Error("Only available recovery points can be restored.");if(t.verificationState!=="verified")throw Error("Restore requires a verified recovery point.");if(e.mode==="in_place"){if(!e.recentAuth)throw Error("In-place restore requires recent authentication.");if(e.confirm!==e.targetName)throw Error(`Type ${e.targetName} to confirm in-place restore.`);if(!e.downtimeAcknowledged)throw Error("In-place restore requires downtime acknowledgement.");let r=e.safetyBackupId?this.store.getRecoveryPoint(e.safetyBackupId):void 0;if(!r||r.id===t.id||r.status!=="available"||r.verificationState!=="verified"||r.resourceId!==t.resourceId||r.dataServiceId!==t.dataServiceId)throw Error("In-place restore requires a distinct verified safety backup for the same target.")}return{point:t,mode:e.mode,target:{...e.target,inPlace:e.mode==="in_place",restoreMode:e.mode},warnings:e.mode==="in_place"?["The target is locked against deployments and backup work.","Downtime and data replacement are expected.","Provider cancellation may stop only at a checkpoint."]:["An isolated target is created and health-validated before cleanup."]}}enqueueRestore(t,e){let r=this.planRestore(t,e),d=e.drill?"drill":"restore",E=CX(JSON.stringify({point:t.id,mode:e.mode,target:e.target,safety:e.safetyBackupId,drill:!!e.drill})),n=this.store.createJob({projectId:t.projectId,policyId:t.policyId,recoveryPointId:t.id,kind:d,status:"queued",idempotencyKey:`${d}:${E}`,target:r.target,restoreMode:r.mode,cancellability:"checkpoint_only",safetyBackupId:e.safetyBackupId,progress:{phase:"queued",warnings:r.warnings}});if(!n.operationId){let c=this.queue.enqueue({projectId:t.projectId,resourceId:t.resourceId,actorId:e.actorId,kind:e.drill?"backup.drill":"backup.restore",input:{backupJobId:n.id},lockKey:t.dataServiceId?`data-service:${t.dataServiceId}`:t.resourceId?`resource:${t.resourceId}`:`recovery-point:${t.id}`,providerKey:"backup",maxAttempts:1,timeoutSeconds:14400,retryClasses:[],resumePolicy:"fail"});return this.store.updateJob(n.id,{operationId:c.operation.id})}return n}enqueueRetention(t=this.now()){return this.store.retentionCandidates(t).map((e)=>{let r=this.store.createJob({projectId:e.projectId,policyId:e.policyId,recoveryPointId:e.id,kind:"cleanup",status:"queued",idempotencyKey:`cleanup:${e.id}:${e.expiresAt}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!r.operationId){let d=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,kind:"backup.cleanup",input:{backupJobId:r.id},lockKey:`recovery-point:${e.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(r.id,{operationId:d.operation.id})}return r})}}function LI(t){let e=t.now??(()=>new Date),r=new _i(t.store,t.queue,e),d=(_)=>{let i=_.recoveryPointId?t.store.getRecoveryPoint(_.recoveryPointId):void 0,T=_.policyId?t.store.getPolicy(_.policyId):i?.policyId?t.store.getPolicy(i.policyId):void 0;if(!T)throw Error("Backup policy was not found.");let h=t.store.getDestination(i?.destinationId??T.destinationId),R=t.resolveSource(T);if(!h)throw Error("Backup destination was not found.");if(!R)throw Error(`No ${T.resourceKind} backup adapter is configured.`);return{point:i,policy:T,destination:h,source:R}},E=(_)=>{let i=_.operation.input,T=t.store.getJob(String(i.backupJobId??""));if(!T)throw Error("Backup job was not found.");return t.store.updateJob(T.id,{status:"running",startedAt:T.startedAt??e().toISOString(),progress:{...T.progress,phase:"running"}}),T},n=(_,i)=>{let T=t.store.getJob(_.id)??_;t.store.updateJob(_.id,{status:"failed",finishedAt:e().toISOString(),error:i instanceof Error?i.message:String(i),progress:{...T.progress,phase:"failed"}})};return{"backup.run":async(_)=>{let i=E(_);try{let{policy:T,destination:h,source:R}=d(i),N=await R.create(T,_),A=t.resolveDestination(h),u=N.mode==="object"?await(async()=>{if(!A)throw Error("Backup destination adapter is not configured.");let P=t.store.getJob(i.id)?.progress,a=P?.multipart,j=a&&typeof a==="object"&&!Array.isArray(a)&&typeof a.uploadId==="string"&&typeof a.key==="string"&&Array.isArray(a.parts)?a:void 0;return A.upload(h,{key:N.key,body:N.body,contentType:N.contentType,resume:j,checkpoint:(B)=>{_.checkpoint("uploading",`Uploaded ${Number(B.bytesUploaded??0)} backup bytes.`),t.store.updateJob(i.id,{progress:{phase:"uploading",multipart:{...B}}})}})})():{uri:N.uri,key:N.uri,sizeBytes:N.sizeBytes,checksum:N.checksum,manifest:{format:"ts-cloud-backup-v1",encrypted:!1,plaintextChecksum:N.checksum,storageChecksum:N.checksum,contentType:"application/provider-snapshot"}},U=T.retention.expireAfterDays?new Date(e().getTime()+T.retention.expireAfterDays*86400000).toISOString():void 0,w=t.store.getJob(i.id)?.startedAt,l=t.store.createRecoveryPoint({projectId:T.projectId,policyId:T.id,destinationId:h.id,resourceId:T.resourceId,dataServiceId:T.dataServiceId,backupJobId:i.id,kind:T.resourceKind,pointInTime:e().toISOString(),uri:u.uri,sizeBytes:u.sizeBytes,checksum:u.checksum,manifest:{...N.manifest,...u.manifest,storageKey:u.key},toolVersion:N.toolVersion,engineVersion:N.engineVersion,expiresAt:U,lockedUntil:h.immutability.defaultRetentionDays?new Date(e().getTime()+h.immutability.defaultRetentionDays*86400000).toISOString():void 0,held:!1,pinned:!1,status:"available",verificationState:"unverified",durationMs:Math.max(0,e().getTime()-new Date(w??e().toISOString()).getTime())});if(N.mode==="external"&&h.provider==="aws_backup")t.store.recordDestinationTest(h.id,{ok:!0});return t.store.updateJob(i.id,{status:"succeeded",recoveryPointId:l.id,finishedAt:e().toISOString(),progress:{phase:"stored",recoveryPointId:l.id}}),r.enqueueVerification(l),{backupJobId:i.id,recoveryPointId:l.id}}catch(T){let h=t.store.getJob(i.id),R=h?.progress.multipart,N=(()=>{try{return d(i)}catch{return}})();if(N?.destination.provider==="aws_backup")t.store.recordDestinationTest(N.destination.id,{ok:!1,error:T instanceof Error?T.message:String(T)});let A=!1;if(R&&typeof R==="object"&&!Array.isArray(R)&&N){let u=t.resolveDestination(N.destination);if(A=!0,u?.abortPartial)try{await u.abortPartial(N.destination,R),A=!1,t.store.updateJob(i.id,{progress:{...h.progress,partialCleanup:"aborted"}})}catch{t.store.updateJob(i.id,{progress:{...h.progress,partialCleanup:"required"}})}}if(A)t.store.updateJob(i.id,{status:"cleanup_required",finishedAt:e().toISOString(),error:T instanceof Error?T.message:String(T),progress:{...t.store.getJob(i.id)?.progress??{},phase:"cleanup_required"}});else n(i,T);throw T}},"backup.verify":async(_)=>{let i=E(_);try{let{point:T,destination:h,source:R}=d(i);if(!T)throw Error("Recovery point was not found.");t.store.updateRecoveryPoint(T.id,{verificationState:"verifying"});let N;if(T.uri.startsWith("s3:")){let A=t.resolveDestination(h);if(!A)throw Error("Backup destination adapter is not configured.");let u=await A.download(h,{key:String(T.manifest.storageKey??""),checksum:T.checksum,manifest:T.manifest}),U=R.verify?await R.verify(T,u,_):{};N={bytes:u.length,checksum:T.checksum,...U}}else if(R.verifyExternal)N=await R.verifyExternal(T,_);else throw Error("External recovery point verification is not supported.");return t.store.updateRecoveryPoint(T.id,{verificationState:"verified",verifiedAt:e().toISOString(),manifest:{...T.manifest,verification:N}}),t.store.updateJob(i.id,{status:"succeeded",finishedAt:e().toISOString(),progress:{phase:"verified",evidence:N}}),{backupJobId:i.id,recoveryPointId:T.id,evidence:N}}catch(T){if(i.recoveryPointId)t.store.updateRecoveryPoint(i.recoveryPointId,{verificationState:/checksum|corrupt|authentic/i.test(T instanceof Error?T.message:String(T))?"corrupt":"failed"});throw n(i,T),T}},"backup.restore":async(_)=>c(_,!1),"backup.drill":async(_)=>c(_,!0),"backup.cleanup":async(_)=>{let i=E(_);try{let{point:T,destination:h,source:R}=d(i);if(!T)throw Error("Recovery point was not found.");if(!t.store.retentionCandidates(e()).some((N)=>N.id===T.id))throw Error("Recovery point is held, pinned, locked, or in active use.");if(t.store.updateRecoveryPoint(T.id,{status:"deleting"}),T.uri.startsWith("s3:")){let N=t.resolveDestination(h);if(!N)throw Error("Destination cleanup is unavailable.");await N.delete(h,String(T.manifest.storageKey??""))}else if(R.deleteExternal)await R.deleteExternal(T,_);else throw Error("External recovery point cleanup is unavailable.");return t.store.updateRecoveryPoint(T.id,{status:"deleted"}),t.store.updateJob(i.id,{status:"succeeded",finishedAt:e().toISOString(),progress:{phase:"deleted"}}),{backupJobId:i.id,recoveryPointId:T.id,deleted:!0}}catch(T){throw n(i,T),T}}};async function c(_,i){let T=E(_);try{let{point:h,policy:R,destination:N,source:A}=d(T);if(!h)throw Error("Recovery point was not found.");if(i&&!A.cleanup)throw Error("This backup source cannot safely clean a recovery drill target.");let u=h.uri.startsWith("s3:")?t.resolveDestination(N):void 0,U=u?await u.download(N,{key:String(h.manifest.storageKey??""),checksum:h.checksum,manifest:h.manifest}):void 0,w=await A.restore(h,U,T.target,_),l=A.validateHealth?await A.validateHealth({...T.target,...w},_):{healthy:!0,mode:"adapter"},P=t.validateHealth?await t.validateHealth(R,T.target):{healthy:!0,mode:"not_configured"},a={...l,healthy:l.healthy===!0&&P.healthy===!0,configured:P};if(a.healthy!==!0)throw Error("Restored target did not pass its configured health check.");if(i&&A.cleanup)await A.cleanup({...T.target,provider:h.manifest.provider??null},_);return t.store.updateJob(T.id,{status:"succeeded",finishedAt:e().toISOString(),healthResult:a,progress:{phase:i?"drill_cleaned":"restored",restored:w}}),{backupJobId:T.id,recoveryPointId:h.id,restored:w,health:a,cleaned:i}}catch(h){let R=(()=>{try{return d(T)}catch{return}})(),N=h instanceof Error?h.message:String(h),A=!1;if(i&&R?.source.cleanup)try{await R.source.cleanup({...T.target,provider:R.point?.manifest.provider??null},_)}catch{A=!0}if(A)t.store.updateJob(T.id,{status:"cleanup_required",finishedAt:e().toISOString(),error:N,progress:{...T.progress,phase:"cleanup_required"}});else n(T,h);throw h}}}Bn();import{createHash as IX}from"node:crypto";var lX=(t)=>`sha256:${IX("sha256").update(t).digest("hex")}`;class cN{dataServices;client;constructor(t,e=new _d){this.dataServices=t;this.client=e}service(t){let e=t.dataServiceId?this.dataServices.get(t.dataServiceId):void 0;if(!e||!["aws_rds","aws_aurora"].includes(e.provider))throw Error("Managed database backup policy requires an RDS or Aurora data service.");return e}async waitForSnapshot(t,e,r){for(;;){r.throwIfCancellationRequested?.(),r.heartbeat?.();let d=t==="aws_aurora"?(await this.client.describeDBClusterSnapshots({DBClusterSnapshotIdentifier:e})).DBClusterSnapshots[0]:(await this.client.describeDBSnapshots({DBSnapshotIdentifier:e})).DBSnapshots?.[0];if(!d)throw Error("Provider snapshot was not found.");let E=d,n=String(E.Status??E.DBSnapshotStatus??"unknown");if(r.checkpoint?.("provider_snapshot",`Database snapshot ${e} is ${n}.`),n==="available")return E;if(["deleted","deleting","failed"].includes(n))throw Error(`Provider snapshot ${e} failed with state ${n}.`);await Bun.sleep(5000)}}async create(t,e){let r=this.service(t),d=String(e.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,20),E=`${r.placement.slice(0,42).replace(/-+$/,"")}-${d}`;if(r.provider==="aws_aurora")await this.client.createDBClusterSnapshot(r.placement,E);else await this.client.createDBSnapshot({DBInstanceIdentifier:r.placement,DBSnapshotIdentifier:E});await this.waitForSnapshot(r.provider,E,e);let n=`${r.provider}:${r.placement}:${E}`;return{mode:"external",uri:`aws-backup:${n}`,checksum:lX(n),sizeBytes:0,manifest:{provider:r.provider,sourceId:r.placement,snapshotId:E,plan:r.plan,engine:r.engine},engineVersion:r.engineVersion,toolVersion:"aws-rds-api-2014-10-31"}}async verifyExternal(t,e){let r=String(t.manifest.snapshotId??""),d=String(t.manifest.provider??"");if(!r)throw Error("Snapshot recovery point has no snapshot ID.");let E=await this.waitForSnapshot(d,r,e),n=String(E.Status??E.DBSnapshotStatus??"unknown");return{snapshotId:r,status:n,encrypted:E.Encrypted??E.StorageEncrypted??!0}}async restore(t,e,r,d){let E=String(r.targetId??""),n=String(t.manifest.snapshotId??""),c=String(t.manifest.provider??"");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E))throw Error("Managed restore requires a valid distinct targetId.");if(E===t.manifest.sourceId)throw Error("Managed restore target must differ from its source.");if(c==="aws_aurora"){let _=t.manifest.engine==="postgres"?"aurora-postgresql":"aurora-mysql";await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:E,SnapshotIdentifier:n,Engine:_,EngineVersion:t.engineVersion,DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:Number(r.minCapacity)||0.5,MaxCapacity:Number(r.maxCapacity)||4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${E}-writer-1`,DBClusterIdentifier:E,DBInstanceClass:String(r.plan??t.manifest.plan??"db.serverless"),Engine:_,PubliclyAccessible:!1})}else await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:E,DBSnapshotIdentifier:n,DBInstanceClass:String(r.plan??t.manifest.plan??""),PubliclyAccessible:!1,DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud-restore"}]});return{targetId:E,provider:c,status:"creating",isolated:!0}}async validateHealth(t,e){let r=String(t.targetId??""),d=String(t.provider??"");for(;;){e.throwIfCancellationRequested?.(),e.heartbeat?.();let E=d==="aws_aurora"?(await this.client.describeDBClusters({DBClusterIdentifier:r})).DBClusters?.[0]:(await this.client.describeDBInstances({DBInstanceIdentifier:r})).DBInstances?.[0];if(!E)throw Error("Restored managed database was not found.");let n=String(E.Status??E.DBInstanceStatus??"unknown");if(e.checkpoint?.("provider_restore",`Restored database ${r} is ${n}.`),n==="available")return{healthy:!0,targetId:r,provider:d,status:n};if(["deleted","deleting","failed","incompatible-restore"].includes(n))throw Error(`Restored managed database ${r} failed with state ${n}.`);await Bun.sleep(5000)}}async cleanup(t,e){let r=String(t.targetId??""),d=String(t.provider??"");if(!r)throw Error("Restore cleanup target is required.");if(d==="aws_aurora")await this.client.deleteDBInstance({DBInstanceIdentifier:`${r}-writer-1`,SkipFinalSnapshot:!0}),await this.client.modifyDBCluster({DBClusterIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(r);else await this.client.modifyDBInstance({DBInstanceIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:r,SkipFinalSnapshot:!0,DeleteAutomatedBackups:!0})}async deleteExternal(t,e){let r=String(t.manifest.snapshotId??"");if(t.manifest.provider==="aws_aurora")await this.client.deleteDBClusterSnapshot(r);else await this.client.deleteDBSnapshot(r)}}var je=(t,e="none",r=!1)=>({supported:!0,downtime:e,destructive:r,explanation:t}),le=(t)=>({supported:!1,downtime:"none",destructive:!1,explanation:t});function N_(t,e){let r=["aws_rds","aws_aurora","aws_elasticache"].includes(e),d=["server","container"].includes(e),E=["postgres","mysql","mariadb"].includes(t),n=t==="redis",c={};return c.create=e==="external"?le("External services can be adopted as read-only inventory."):je(r?"Provision through the provider API.":"Provision through the owning runtime driver.","possible"),c.observe=e==="external"?le("External observation requires a configured provider adapter."):je("Provider/runtime health and endpoint metadata are observable."),c.connect=je("Connection guidance uses secret references and never returns a password by default."),c.backup=E&&(r||d)?je(r?"Create a provider snapshot.":"Create a consistent engine-native dump.","possible"):le("This cache path is not a durable backup source."),c.restore=r&&E?je("Restore creates a reviewed provider target.","required",!0):le("Restore requires a configured provider restore runner."),c.restart=e==="external"?le("External restart requires a configured provider adapter."):je(r?"Provider restart/failover semantics apply.":"Restart the owning service unit.","required"),c.resize=e==="aws_elasticache"?le("ElastiCache resizing requires a replication-group migration runner."):r?je("Provider plan/storage modification may enter a maintenance window.","possible"):d?je("Edit host/container resources and reconcile.","required"):le("External resize requires a configured provider adapter."),c.version=d?le("Runtime version upgrades require an explicit image migration runner."):r&&e!=="aws_elasticache"?je(E?"Major versions require compatibility preflight and backup.":"Engine upgrades require a maintenance window.","required"):le("External upgrades require a configured provider adapter."),c.rotate=e==="aws_elasticache"||e==="external"||d&&!E&&!n?le("Credential rotation is not available for this provider/engine path."):je("Rotate through the secret backend, update the engine, then flag dependent releases."),c.expose=d?le("Direct container publishing is refused; use a reviewed firewall and proxy policy."):e==="aws_rds"?je("Exposure is reconciled through security groups; public access defaults off."):le("Exposure changes require a provider-specific network runner."),c.delete=e==="external"?le("External deletion requires a configured provider adapter."):je(r?"Final snapshot is supported where the provider allows it.":"A final engine backup is required unless explicitly retained.","required",!0),c.logs=d?je("Read bounded service logs from the runtime."):le("Provider log export is not configured for this adapter."),c.slow_queries=d&&E?je("Read bounded runtime logs after engine slow-query logging is enabled."):le("A slow-query log runner is not configured for this provider."),c.users=d&&E?je("Logical users can be listed; creation requires a referenced secondary credential."):le("User management requires an engine connection runner."),c.databases=d&&E?je("Logical databases can be listed, created, and confirmation-gated for deletion."):le("Logical database management requires an engine connection runner."),{actions:c,endpointTypes:r?["internal","external","tunnel"]:["internal","tunnel"],metrics:n?["connections","memory","evictions","hit_rate","latency"]:["connections","cpu","storage","read_latency","write_latency","iops"]}}var vn=(t)=>t==null?void 0:String(t),ii=(t)=>Number(t)===1,Ti=(t)=>{try{return JSON.parse(String(t))}catch{return{}}};function uI(t){return{id:String(t.id),organizationId:String(t.organization_id),projectId:String(t.project_id),environmentId:vn(t.environment_id),resourceId:vn(t.resource_id),name:String(t.name),engine:String(t.engine),provider:String(t.provider),placement:String(t.placement),engineVersion:vn(t.engine_version),plan:String(t.plan),storageGb:t.storage_gb==null?void 0:Number(t.storage_gb),highAvailability:ii(t.high_availability),publicExposure:ii(t.public_exposure),allowedCidrs:Ti(t.allowed_cidrs),desiredState:Ti(t.desired_state),observedState:Ti(t.observed_state),capabilities:Ti(t.capabilities),credentialRef:vn(t.credential_ref),status:String(t.status),origin:String(t.origin),managementEnabled:ii(t.management_enabled),ownerActorId:vn(t.owner_actor_id),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}}class _N{controlPlane;now;constructor(t,e=()=>new Date){this.controlPlane=t;this.now=e}create(t){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(t.name))throw Error("Data service names must be 2-63 lowercase letters, numbers, or dashes.");if(t.publicExposure&&(!t.allowedCidrs.length||t.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");let e=crypto.randomUUID(),r=this.now().toISOString(),d=N_(t.engine,t.provider);return this.controlPlane.database.run("INSERT INTO data_services (id,organization_id,project_id,environment_id,resource_id,name,engine,provider,placement,engine_version,plan,storage_gb,high_availability,public_exposure,allowed_cidrs,desired_state,observed_state,capabilities,credential_ref,status,origin,management_enabled,owner_actor_id,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[e,t.organizationId,t.projectId,t.environmentId??null,t.resourceId??null,t.name,t.engine,t.provider,t.placement,t.engineVersion??null,t.plan,t.storageGb??null,t.highAvailability?1:0,t.publicExposure?1:0,JSON.stringify(t.allowedCidrs),JSON.stringify(t.desiredState),JSON.stringify(t.observedState),JSON.stringify(d),t.credentialRef??null,t.status,t.origin,t.managementEnabled?1:0,t.ownerActorId??null,1,r,r]),this.get(e)}get(t){let e=this.controlPlane.database.query("SELECT * FROM data_services WHERE id=?").get(t);return e?uI(e):void 0}list(t,e){return this.controlPlane.database.query(`SELECT * FROM data_services WHERE project_id=?${e?" AND environment_id=?":""} ORDER BY name`).all(t,...e?[e]:[]).map(uI)}update(t,e,r){let d=this.get(t);if(!d)throw Error("Data service was not found.");if(d.version!==e)throw Error("Data service changed; refresh before retrying.");let E={...d,...r};if(E.publicExposure&&(!E.allowedCidrs.length||E.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");if(this.controlPlane.database.run("UPDATE data_services SET plan=?,storage_gb=?,engine_version=?,high_availability=?,public_exposure=?,allowed_cidrs=?,desired_state=?,observed_state=?,status=?,management_enabled=?,credential_ref=?,version=version+1,updated_at=? WHERE id=? AND version=?",[E.plan,E.storageGb??null,E.engineVersion??null,E.highAvailability?1:0,E.publicExposure?1:0,JSON.stringify(E.allowedCidrs),JSON.stringify(E.desiredState),JSON.stringify(E.observedState),E.status,E.managementEnabled?1:0,E.credentialRef??null,this.now().toISOString(),t,e]).changes!==1)throw Error("Data service changed; refresh before retrying.");return this.get(t)}credential(t){let e=this.controlPlane.database.query("SELECT * FROM data_service_credentials WHERE service_id=? ORDER BY version DESC LIMIT 1").get(t);return e?{id:String(e.id),serviceId:String(e.service_id),username:String(e.username),secretRef:String(e.secret_ref),version:Number(e.version),createdAt:String(e.created_at),rotatedAt:vn(e.rotated_at)}:void 0}saveCredential(t,e,r){let d=this.credential(t),E=d?.id??crypto.randomUUID(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_credentials (id,service_id,username,secret_ref,version,created_at,rotated_at) VALUES (?,?,?,?,?,?,?) ON CONFLICT(service_id,username) DO UPDATE SET secret_ref=excluded.secret_ref,version=data_service_credentials.version+1,rotated_at=excluded.rotated_at",[E,t,e,r,d?.version??1,d?.createdAt??n,d?n:null]),this.credential(t)}addDependency(t){let e=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_dependencies (service_id,resource_id,secret_ref,requires_redeploy,created_at) VALUES (?,?,?,?,?) ON CONFLICT(service_id,resource_id) DO UPDATE SET secret_ref=excluded.secret_ref,requires_redeploy=excluded.requires_redeploy",[t.serviceId,t.resourceId,t.secretRef,t.requiresRedeploy?1:0,e]),{...t,createdAt:e}}dependencies(t){return this.controlPlane.database.query("SELECT * FROM data_service_dependencies WHERE service_id=? ORDER BY resource_id").all(t).map((e)=>({serviceId:String(e.service_id),resourceId:String(e.resource_id),secretRef:String(e.secret_ref),requiresRedeploy:ii(e.requires_redeploy),createdAt:String(e.created_at)}))}removeDependency(t,e){return this.controlPlane.database.run("DELETE FROM data_service_dependencies WHERE service_id=? AND resource_id=?",[t,e]).changes===1}remove(t){this.controlPlane.database.run("DELETE FROM data_services WHERE id=?",[t])}}function OI(){let e=crypto.getRandomValues(new Uint8Array(40));return Array.from(e,(r)=>"ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*_-+="[r%69]).join("")}function CI(t,e){return e.map((r)=>{let d=r.type==="tunnel"?"127.0.0.1":r.host,E=t.engine==="redis"?`redis-cli -h ${d} -p ${r.port}${r.tls?" --tls":""}`:t.engine==="postgres"?`psql "host=${d} port=${r.port} dbname=${r.database??"postgres"} sslmode=${r.tls?"require":"disable"}"`:t.engine==="mongodb"?`mongosh "mongodb://${d}:${r.port}/${r.database??"admin"}${r.tls?"?tls=true":""}"`:t.engine==="libsql"?`turso db shell ${r.tls?"https":"http"}://${d}:${r.port}`:`mysql --host=${d} --port=${r.port} --database=${r.database??"mysql"} --ssl-mode=${r.tls?"REQUIRED":"DISABLED"}`;return{type:r.type,command:E,secretRef:t.credentialRef}})}class hi{store;queue;secrets;constructor(t,e,r){this.store=t;this.queue=e;this.secrets=r}async create(t){let e,r;if(t.provider!=="aws_elasticache"){let d=t.username??"app",E=OI();r=`secret://data-services/${t.projectId}/${t.name}/${d}`,await this.secrets.put(r,E),e={username:d,password:E,secretRef:r}}try{let d=this.store.create({...t,credentialRef:r,status:"planning"});if(e)this.store.saveCredential(d.id,e.username,e.secretRef);let E=this.enqueue(d,"create",{});return{service:d,credential:e,operationId:E}}catch(d){if(r)await this.secrets.remove(r);throw d}}plan(t,e,r={}){let d=t.capabilities.actions[e],E=e==="version"&&String(r.engineVersion??"").split(".")[0]!==String(t.engineVersion??"").split(".")[0];return{service:t,action:e,capability:d,changes:r,preflight:{backupRequired:["delete","restore"].includes(e)||E,compatibilityRequired:E,typedConfirmation:d.destructive?t.name:void 0,retentionChoiceRequired:e==="delete"},warnings:[...d.downtime!=="none"?[`Downtime is ${d.downtime}.`]:[],...t.origin==="adopted"&&!t.managementEnabled?["Adopted resource is read-only until management is explicitly enabled."]:[]]}}enqueue(t,e,r,d){let E=this.plan(t,e,r);if(!E.capability.supported)throw Error(E.capability.explanation);if(t.origin==="adopted"&&!t.managementEnabled&&e!=="observe")throw Error("Adopted resources remain read-only until management is explicitly enabled.");if(E.preflight.typedConfirmation&&r.confirm!==E.preflight.typedConfirmation)throw Error(`Type ${E.preflight.typedConfirmation} to confirm ${e}.`);if(E.preflight.retentionChoiceRequired&&!["final_backup","retain"].includes(String(r.retention??"")))throw Error("Deletion requires retention final_backup or retain.");if(E.preflight.compatibilityRequired&&(r.compatibilityReviewed!==!0||!r.backupId))throw Error("Major version changes require compatibilityReviewed=true and a backupId.");if(e==="restore"){let n=String(r.backupId??""),c=String(r.targetId??"");if(!n||!c)throw Error("Restore requires both backupId and targetId.");if(c===t.placement)throw Error("Restore targetId must differ from the source placement.");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(c))throw Error("Restore targetId must be 2-63 lowercase letters, numbers, or dashes.")}return this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,actorId:d,kind:"data_service.action",input:{serviceId:t.id,action:e,...r},lockKey:`data-service:${t.id}`,providerKey:t.provider,maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"}).operation.id}async rotate(t,e,r){let d=this.store.credential(t.id);if(!d)throw Error("Data service credential metadata was not found.");let E=OI(),n=`${d.secretRef}/v${d.version+1}`;await this.secrets.put(n,E);try{return await e.action(t,"rotate",{username:d.username,secretRef:n},E,r),this.store.saveCredential(t.id,d.username,n),this.store.update(t.id,t.version,{credentialRef:n}),{credential:{username:d.username,password:E,secretRef:n},dependencies:this.store.dependencies(t.id).filter((c)=>c.requiresRedeploy).map((c)=>c.resourceId)}}catch(c){throw await this.secrets.remove(n),c}}}function II(t){return{"data_service.action":async(e)=>{let r=e.operation.input,d=t.store.get(String(r.serviceId??"")),E=String(r.action??"");if(!d)throw Error("Data service was not found.");let n=t.resolveAdapter(d);if(!n||n.provider!==d.provider||!n.engines.includes(d.engine))throw Error(`No ${d.provider}/${d.engine} adapter is configured.`);if(E==="rotate"){let _=await new hi(t.store,new yt(t.store.controlPlane),t.secrets).rotate(d,n,e);return{serviceId:d.id,action:E,username:_.credential.username,secretRef:_.credential.secretRef,dependencies:_.dependencies}}let c=d.credentialRef?await t.secrets.resolve(d.credentialRef):void 0;try{let _=E==="observe"?await n.observe(d):E==="create"?await n.apply(d,c,e):await n.action(d,E,r,c,e),i=t.store.get(d.id);return t.store.update(d.id,i.version,{observedState:_,status:E==="delete"?r.retention==="retain"?"retained":"deleting":"available"}),{serviceId:d.id,action:E,observed:_}}catch(_){let i=t.store.get(d.id);if(t.store.update(d.id,i.version,{status:"failed",observedState:{...i.observedState,error:_ instanceof Error?_.message:String(_)}}),/temporar|timeout|unavailable|throttl/i.test(_ instanceof Error?_.message:String(_)))throw new yr(_ instanceof Error?_.message:String(_),"provider_transient");throw _}}}}class Qn{transport;constructor(t){this.transport=t}observe(t){return this.transport.observe(t.placement)}apply(t,e){return this.transport.apply({id:t.placement,name:t.name,engine:t.engine,engineVersion:t.engineVersion??null,plan:t.plan,storageGb:t.storageGb??null,highAvailability:t.highAvailability,publicExposure:t.publicExposure,allowedCidrs:t.allowedCidrs,username:t.desiredState.username??"app",desiredState:t.desiredState},e)}action(t,e,r,d,E){return this.transport.execute(t.placement,e,{engine:t.engine,engineVersion:t.engineVersion??null,plan:t.plan,desiredState:t.desiredState,...r},d,E)}}class TN extends Qn{provider="aws_rds";engines=["postgres","mysql","mariadb"]}class iN extends Qn{provider="aws_aurora";engines=["postgres","mysql"]}class hN extends Qn{provider="aws_elasticache";engines=["redis"]}class RN extends Qn{provider="server";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}class SN extends Qn{provider="container";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}Bn();var Ni=(t,e)=>{let r=t.desiredState;return t[e]??(r&&typeof r==="object"&&!Array.isArray(r)?r[e]:void 0)},xt=(t,e,r)=>{let d=Ni(t,e);return d==null?r:String(d)},be=(t,e)=>{let r=Ni(t,e);return r==null?void 0:Number(r)},xd=(t,e)=>{let r=Ni(t,e);return r==null?void 0:r===!0||r==="true"},Yn=(t,e)=>{let r=Ni(t,e);return Array.isArray(r)?r.map(String):[]},Si=(t,e)=>xt(e,"snapshotId")??`${t}-final-${new Date().toISOString().replace(/[^0-9]/g,"").slice(0,14)}`;function Ri(t){if(!t)throw Error("RDS instance was not found.");return{providerId:t.DBInstanceIdentifier??null,status:t.DBInstanceStatus??"unknown",engine:t.Engine??null,engineVersion:t.EngineVersion??null,plan:t.DBInstanceClass??null,storageGb:t.AllocatedStorage??null,highAvailability:t.MultiAZ??!1,publicExposure:t.PubliclyAccessible??!1,endpoint:t.Endpoint?.Address??null,port:t.Endpoint?.Port??null,username:t.MasterUsername??null,database:t.DBName??null,encrypted:t.StorageEncrypted??!1}}class AN{client;constructor(t=new _d){this.client=t}async observe(t){return Ri(await this.client.describeDBInstance(t))}async apply(t,e){let r=String(t.id),d=await this.client.createDBInstance({DBInstanceIdentifier:r,DBInstanceClass:String(t.plan),Engine:String(t.engine),MasterUsername:xt(t,"username","app"),MasterUserPassword:e,DBName:xt(t,"database"),AllocatedStorage:be(t,"storageGb"),VpcSecurityGroupIds:Yn(t,"securityGroupIds"),DBSubnetGroupName:xt(t,"subnetGroup"),BackupRetentionPeriod:be(t,"backupRetentionDays")??7,MultiAZ:xd(t,"highAvailability"),EngineVersion:xt(t,"engineVersion"),PubliclyAccessible:xd(t,"publicExposure")??!1,StorageType:xt(t,"storageType","gp3"),StorageEncrypted:!0,KmsKeyId:xt(t,"kmsKeyId"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return Ri(d.DBInstance)}async execute(t,e,r,d,E){if(e==="observe")return this.observe(t);if(e==="restart")return await this.client.rebootDBInstance({DBInstanceIdentifier:t}),{status:"rebooting"};if(e==="backup"){let n=Si(t,r);return await this.client.createDBSnapshot({DBInstanceIdentifier:t,DBSnapshotIdentifier:n}),{status:"snapshotting",snapshotId:n}}if(e==="restore"){let n=String(r.targetId),c=await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:n,DBSnapshotIdentifier:String(r.backupId),DBInstanceClass:xt(r,"plan"),DBSubnetGroupName:xt(r,"subnetGroup"),MultiAZ:xd(r,"highAvailability"),PubliclyAccessible:!1,StorageType:xt(r,"storageType"),VpcSecurityGroupIds:Yn(r,"securityGroupIds"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{...Ri(c.DBInstance),sourceId:t,restoreTargetId:n}}if(e==="delete"){if(r.retention==="retain")return{status:"retained"};let n=Si(t,r);return await this.client.modifyDBInstance({DBInstanceIdentifier:t,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:t,SkipFinalSnapshot:!1,FinalDBSnapshotIdentifier:n,DeleteAutomatedBackups:!1}),{status:"deleting",finalSnapshotId:n}}if(["resize","version","rotate","expose"].includes(e)){let n=await this.client.modifyDBInstance({DBInstanceIdentifier:t,DBInstanceClass:xt(r,"plan"),AllocatedStorage:be(r,"storageGb"),MasterUserPassword:e==="rotate"?d:void 0,EngineVersion:xt(r,"engineVersion"),MultiAZ:xd(r,"highAvailability"),PubliclyAccessible:xd(r,"publicExposure"),VpcSecurityGroupIds:Yn(r,"securityGroupIds"),ApplyImmediately:xd(r,"applyImmediately")??!0});return Ri(n.DBInstance)}throw Error(`RDS action ${e} requires an engine connection runner.`)}}function NN(t){if(!t)throw Error("Aurora cluster was not found.");return{providerId:t.DBClusterIdentifier??null,status:t.Status??"unknown",engine:t.Engine??null,engineVersion:t.EngineVersion??null,endpoint:t.Endpoint??null,readerEndpoint:t.ReaderEndpoint??null,port:t.Port??null,username:t.MasterUsername??null,database:t.DatabaseName??null,encrypted:t.StorageEncrypted??!1,highAvailability:t.MultiAZ??!0}}class LN{client;constructor(t=new _d){this.client=t}async observe(t){let e=await this.client.describeDBClusters({DBClusterIdentifier:t});return NN(e.DBClusters?.[0])}async apply(t,e){let r=String(t.id),d=String(t.engine)==="postgres"?"aurora-postgresql":"aurora-mysql";return await this.client.createDBCluster({DBClusterIdentifier:r,Engine:d,EngineVersion:xt(t,"engineVersion"),MasterUsername:xt(t,"username","app"),MasterUserPassword:e,DatabaseName:xt(t,"database"),DBSubnetGroupName:xt(t,"subnetGroup"),VpcSecurityGroupIds:Yn(t,"securityGroupIds"),BackupRetentionPeriod:be(t,"backupRetentionDays")??7,StorageEncrypted:!0,KmsKeyId:xt(t,"kmsKeyId"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:be(t,"minCapacity")??0.5,MaxCapacity:be(t,"maxCapacity")??4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${r}-writer-1`,DBClusterIdentifier:r,DBInstanceClass:String(t.plan||"db.serverless"),Engine:d,PubliclyAccessible:xd(t,"publicExposure")??!1}),{status:"creating",providerId:r}}async execute(t,e,r,d){if(e==="observe")return this.observe(t);if(e==="restart")return await this.client.rebootDBCluster(t),{status:"rebooting"};if(e==="backup"){let E=Si(t,r);return await this.client.createDBClusterSnapshot(t,E),{status:"snapshotting",snapshotId:E}}if(e==="restore"){let E=String(r.targetId),n=String(r.engine)==="postgres"?"aurora-postgresql":"aurora-mysql",c=await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:E,SnapshotIdentifier:String(r.backupId),Engine:n,EngineVersion:xt(r,"engineVersion"),DBSubnetGroupName:xt(r,"subnetGroup"),VpcSecurityGroupIds:Yn(r,"securityGroupIds"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:be(r,"minCapacity")??0.5,MaxCapacity:be(r,"maxCapacity")??4}});return await this.client.createDBInstance({DBInstanceIdentifier:`${E}-writer-1`,DBClusterIdentifier:E,DBInstanceClass:xt(r,"plan","db.serverless"),Engine:n,PubliclyAccessible:!1}),{...NN(c.DBCluster),sourceId:t,restoreTargetId:E}}if(e==="delete"){if(r.retention==="retain")return{status:"retained"};let E=Si(t,r);return await this.client.modifyDBCluster({DBClusterIdentifier:t,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(t,E),{status:"deleting",finalSnapshotId:E}}if(["resize","version","rotate"].includes(e)){let E=await this.client.modifyDBCluster({DBClusterIdentifier:t,ServerlessV2ScalingConfiguration:be(r,"minCapacity")==null&&be(r,"maxCapacity")==null?void 0:{MinCapacity:be(r,"minCapacity")??0.5,MaxCapacity:be(r,"maxCapacity")??4},EngineVersion:xt(r,"engineVersion"),MasterUserPassword:e==="rotate"?d:void 0,ApplyImmediately:xd(r,"applyImmediately")??!0});return NN(E.DBCluster)}throw Error(`Aurora action ${e} requires an engine connection runner.`)}}class uN{client;constructor(t=new S_){this.client=t}async observe(t){let e=(await this.client.describeCacheClusters(t)).CacheClusters[0];if(!e)throw Error("ElastiCache cluster was not found.");let r=e.CacheNodes?.[0]?.Endpoint;return{providerId:e.CacheClusterId,status:e.CacheClusterStatus,engine:e.Engine,engineVersion:e.EngineVersion,plan:e.CacheNodeType,nodes:e.NumCacheNodes,endpoint:r?.Address??null,port:r?.Port??null}}async apply(t){let e=await this.client.createCacheCluster({cacheClusterId:String(t.id),engine:"redis",cacheNodeType:String(t.plan),numCacheNodes:be(t,"nodes")??1,engineVersion:xt(t,"engineVersion"),port:be(t,"port"),securityGroupIds:Yn(t,"securityGroupIds"),subnetGroupName:xt(t,"subnetGroup"),tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{providerId:e.CacheCluster.CacheClusterId,status:e.CacheCluster.CacheClusterStatus}}async execute(t,e,r){if(e==="observe")return this.observe(t);if(e==="restart"){let d=(await this.client.describeCacheClusters(t)).CacheClusters[0];return await this.client.rebootCacheCluster(t,d?.CacheNodes?.map((E)=>E.CacheNodeId)??["0001"]),{status:"rebooting"}}if(e==="delete"){if(r.retention==="retain")return{status:"retained"};return await this.client.deleteCacheCluster(t),{status:"deleting"}}throw Error(`ElastiCache action ${e} is not supported by this cluster mode.`)}}await Wt();import{mkdir as DX,writeFile as UX}from"node:fs/promises";import{join as fX}from"node:path";async function rr(t,e,r=!1){let d=Bun.spawn(["docker",...t],{stdin:e==null?"ignore":"pipe",stdout:"pipe",stderr:"pipe"}),E=new Response(d.stdout).text(),n=new Response(d.stderr).text();if(e!=null)d.stdin.write(e),d.stdin.end();let[c,_,i]=await Promise.all([d.exited,E,n]);if(c!==0&&!r)throw Error(`Docker command failed (${c}): ${i.trim()||_.trim()}`);return{code:c,stdout:_,stderr:i}}class lI{async ensureNetwork(t){if((await rr(["network","inspect",t],void 0,!0)).code!==0)await rr(["network","create","--internal",t])}async seedSecret(t,e){await rr(["volume","create",t]),await rr(["run","--rm","-i","-v",`${t}:/run/target`,"alpine:3.21","sh","-c","umask 077; cat > /run/target/credential"],e)}async removeVolume(t){await rr(["volume","rm",t],void 0,!0)}async inspect(t){let e=await rr(["inspect",t],void 0,!0);if(e.code!==0)return;return JSON.parse(e.stdout)[0]}async run(t){await rr(["run",...t])}async exec(t,e,r){return(await rr(["exec","-i",t,...e],r)).stdout}async update(t,e){await rr(["update",...e,t])}async restart(t){await rr(["restart",t])}async remove(t){await rr(["rm","--force",t],void 0,!0)}async logs(t,e){let r=await rr(["logs","--tail",String(Math.min(2000,Math.max(1,e))),t],void 0,!0);return`${r.stdout}${r.stderr}`.slice(-262144)}async stats(t){let e=await rr(["stats","--no-stream","--format","{{json .}}",t],void 0,!0);if(e.code!==0||!e.stdout.trim())return{};let r=JSON.parse(e.stdout.trim());return{cpuPercent:String(r.CPUPerc??""),memoryUsage:String(r.MemUsage??""),memoryPercent:String(r.MemPerc??""),networkIo:String(r.NetIO??""),blockIo:String(r.BlockIO??""),pids:Number(r.PIDs??0)}}}var wX={postgres:{image:"postgres:17-alpine",port:5432,dataPath:"/var/lib/postgresql/data"},mysql:{image:"mysql:8.4",port:3306,dataPath:"/var/lib/mysql"},mariadb:{image:"mariadb:11.7",port:3306,dataPath:"/var/lib/mysql"},redis:{image:"redis:7.4-alpine",port:6379,dataPath:"/data"},mongodb:{image:"mongo:8.0",port:27017,dataPath:"/data/db"}};function Td(t,e="app"){let r=String(t??e);if(!/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(r))throw Error("Database identifiers must be letters, numbers, or underscores.");return r}function WE(t){if(!/^[a-z0-9][a-z0-9_.-]{1,62}$/i.test(t))throw Error("Runtime placement must be a valid container identifier.");return`tscloud-data-${t.toLowerCase()}`}function gX(t,e){let r=t.desiredState;return t[e]??(r&&typeof r==="object"&&!Array.isArray(r)?r[e]:void 0)}function A_(t){return t.Config?.Labels??{}}class Mn{runtime;backupRoot;constructor(t=new lI,e=_e(process.cwd(),"backups","data")){this.runtime=t;this.backupRoot=e}async observe(t){let e=WE(t),r=await this.runtime.inspect(e);if(!r)throw Error(`Data container ${e} was not found.`);let d=A_(r),E=await this.runtime.stats(e),n=r.NetworkSettings?.Ports??{},c=Object.values(n).flat().find(Boolean);return{providerId:e,status:r.State?.Status??"unknown",healthy:r.State?.Health?.Status??null,engine:d["ts-cloud.engine"]??null,engineVersion:d["ts-cloud.engine-version"]??null,username:d["ts-cloud.username"]??null,database:d["ts-cloud.database"]??null,endpoint:c?.HostIp||"127.0.0.1",port:c?.HostPort?Number(c.HostPort):null,image:r.Config?.Image??null,startedAt:r.State?.StartedAt??null,metrics:E}}async apply(t,e){let r=String(t.id),d=WE(r),E=String(t.engine);if(E==="libsql")throw Error("libSQL requires an explicitly configured runtime image.");let n=wX[E];if(!n)throw Error(`Unsupported runtime data engine ${E}.`);if(!e)throw Error(`${E} requires a managed credential.`);if(t.publicExposure===!0)throw Error("Container public exposure requires an external reviewed firewall policy; direct publishing is refused.");let c=Td(t.username),_=Td(gX(t,"database")),i=`${d}-secret`,T=`${d}-data`,h=E==="redis"?`appendonly yes
+        ORDER BY rp.expires_at,rp.id`).all(t.toISOString(),t.toISOString()).map(eN),r=new Set;for(let d of new Set(e.map((E)=>E.projectId)))for(let E of this.listPolicies(d)){let n=this.listRecoveryPoints(E.projectId,E.id).filter((_)=>_.status==="available").sort((_,i)=>i.pointInTime.localeCompare(_.pointInTime));for(let _ of n.slice(0,Math.max(0,E.retention.keepLast??0)))r.add(_.id);let c=[[E.retention.hourly,(_)=>_.toISOString().slice(0,13)],[E.retention.daily,(_)=>_.toISOString().slice(0,10)],[E.retention.weekly,(_)=>{return new Date(Date.UTC(_.getUTCFullYear(),_.getUTCMonth(),_.getUTCDate()-(_.getUTCDay()+6)%7)).toISOString().slice(0,10)}],[E.retention.monthly,(_)=>_.toISOString().slice(0,7)]];for(let[_,i]of c){let T=new Set;for(let h of n){let R=i(new Date(h.pointInTime));if(T.has(R))continue;if(T.add(R),T.size<=Math.max(0,_??0))r.add(h.id)}}}return e.filter((d)=>!r.has(d.id))}coverage(t,e=this.now()){let r=new Map(this.listDestinations(t).map((d)=>[d.id,d]));return this.listPolicies(t).map((d)=>{let E=this.listRecoveryPoints(t,d.id).filter((_)=>_.status==="available"),n=E[0],c=n?(e.getTime()-new Date(n.pointInTime).getTime())/60000:Number.POSITIVE_INFINITY;return{policy:d,lastRecoveryPoint:n,missedRpo:d.enabled&&c>d.expectedRpoMinutes,unverified:E.filter((_)=>_.verificationState!=="verified").length,destinationHealthy:r.get(d.destinationId)?.status==="healthy"}})}}er();import{createCipheriv as SX,createDecipheriv as NX,createHash as RI,randomBytes as SI}from"node:crypto";var EN=Buffer.from("TSCB1"),ci=(t)=>`sha256:${RI("sha256").update(t).digest("hex")}`;function NI(t){return RI("sha256").update(t).digest()}function AX(t,e,r){let d=r?Buffer.from(r):SI(12);if(d.length!==12)throw Error("Backup encryption IV must contain 12 bytes.");let E=SX("aes-256-gcm",NI(e),d),n=Buffer.concat([E.update(t),E.final()]),c=E.getAuthTag();return Buffer.concat([EN,d,c,n])}function LX(t,e){let r=Buffer.from(t);if(!r.subarray(0,EN.length).equals(EN))throw Error("Backup does not contain a valid encrypted envelope.");let d=r.subarray(5,17),E=r.subarray(17,33),n=r.subarray(33),c=NX("aes-256-gcm",NI(e),d);return c.setAuthTag(E),Buffer.concat([c.update(n),c.final()])}function uX(t){let e;try{e=JSON.parse(t)}catch{throw Error("Backup destination credential must be a JSON object with accessKeyId and secretAccessKey.")}if(!e.accessKeyId||!e.secretAccessKey)throw Error("Backup destination credential requires accessKeyId and secretAccessKey.");if(e.expiresAt){let r=new Date(String(e.expiresAt));if(!Number.isFinite(r.getTime()))throw Error("Backup destination credential expiresAt must be an ISO timestamp.");if(r.getTime()<=Date.now())throw Error("Backup destination credential has expired.")}return{accessKeyId:String(e.accessKeyId),secretAccessKey:String(e.secretAccessKey),sessionToken:e.sessionToken?String(e.sessionToken):void 0}}async function AI(t,e,r=new Date){if(!t.credentialRef)return{status:"default"};try{let d=JSON.parse(await e.resolve(t.credentialRef));if(!d.accessKeyId||!d.secretAccessKey)return{status:"invalid"};if(!d.expiresAt)return{status:"static"};let E=new Date(String(d.expiresAt));if(!Number.isFinite(E.getTime()))return{status:"invalid"};let n=E.getTime()-r.getTime();return{status:n<=0?"expired":n<=604800000?"expiring":"valid",expiresAt:E.toISOString()}}catch{return{status:"invalid"}}}class nN{secrets;clientFactory;multipartThreshold;partSize;constructor(t,e=(E,n)=>new re(E.region??"us-east-1",void 0,{endpoint:E.endpoint?new URL(E.endpoint).host:void 0,forcePathStyle:E.forcePathStyle,credentials:n}),r=8388608,d=8388608){this.secrets=t;this.clientFactory=e;this.multipartThreshold=r;this.partSize=d}async client(t){let e=t.credentialRef?uX(await this.secrets.resolve(t.credentialRef)):void 0;return this.clientFactory(t,e)}async test(t){if(!t.bucket)throw Error("S3 destination has no configured bucket.");let e=await this.client(t),r=`${t.prefix?`${t.prefix.replace(/\/$/,"")}/`:""}.ts-cloud-health/${crypto.randomUUID()}`;await e.putObject({bucket:t.bucket,key:r,body:"ts-cloud backup destination health check",contentType:"text/plain"});try{let d=await e.getObjectBytes(t.bucket,r);if(Buffer.from(d.body).toString()!=="ts-cloud backup destination health check")throw Error("Backup destination health object was corrupted.")}finally{await e.deleteObject(t.bucket,r)}}async upload(t,e){if(!t.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(t),d=ci(e.body),E=t.encryption!=="provider"?await this.secrets.resolve(t.encryptionKeyRef):void 0,n=E?e.resume?.encryptionIv?Buffer.from(e.resume.encryptionIv,"base64url"):SI(12):void 0,c=E?AX(e.body,E,n):Buffer.from(e.body),_=ci(c),i=`${t.prefix?`${t.prefix.replace(/\/$/,"")}/`:""}${e.key.replace(/^\/+/,"")}`,T=e.contentType??"application/octet-stream",h={"ts-cloud-format":"v1","ts-cloud-sha256":_.slice(7),"ts-cloud-encrypted":E?"true":"false"};if(e.resume&&e.resume.key!==i)throw Error("Multipart checkpoint does not match the requested backup key.");if(e.resume&&E&&!e.resume.encryptionIv)throw Error("Encrypted multipart checkpoint has no resumable envelope state.");if(e.resume&&E&&e.resume.plaintextChecksum!==d)throw Error("Encrypted multipart checkpoint does not match the backup payload.");if(c.length<this.multipartThreshold)await r.putObject({bucket:t.bucket,key:i,body:c,contentType:T,metadata:h});else{let R=e.resume?void 0:await r.createMultipartUpload(t.bucket,i,{contentType:T,metadata:h}),N=e.resume??{uploadId:R.UploadId,key:i,parts:[],bytesUploaded:0,encryptionIv:n?.toString("base64url"),plaintextChecksum:d},A=new Map(N.parts.map((U)=>[U.PartNumber,U])),u=Math.ceil(c.length/this.partSize);for(let U=0;U<u;U++){let w=U+1;if(!A.has(w)){let l=U*this.partSize,P=await r.uploadPart(t.bucket,i,N.uploadId,w,c.subarray(l,Math.min(c.length,l+this.partSize)));A.set(w,{PartNumber:w,ETag:P.ETag})}N.parts=[...A.values()].sort((l,P)=>l.PartNumber-P.PartNumber),N.bytesUploaded=Math.min(c.length,w*this.partSize),e.checkpoint?.(N)}await r.completeMultipartUpload(t.bucket,i,N.uploadId,N.parts)}return{uri:`s3://${t.bucket}/${i}`,key:i,sizeBytes:c.length,checksum:_,manifest:{format:"ts-cloud-backup-v1",encrypted:!!E,plaintextChecksum:d,storageChecksum:_,contentType:T}}}async download(t,e){if(!t.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(t),d=await r.getObjectBytes(t.bucket,e.key),E=Buffer.from(d.body);if(ci(E)!==e.checksum)throw Error("Backup checksum verification failed; object is corrupt.");let n=e.manifest.encrypted?LX(E,await this.secrets.resolve(t.encryptionKeyRef)):E;if(ci(n)!==e.manifest.plaintextChecksum)throw Error("Backup plaintext checksum verification failed.");return n}async abortPartial(t,e){if(!t.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(t)).abortMultipartUpload(t.bucket,e.key,e.uploadId)}async delete(t,e){if(!t.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(t)).deleteObject(t.bucket,e)}}import{createHash as OX}from"node:crypto";var CX=(t)=>`sha256:${OX("sha256").update(t).digest("hex")}`;class _i{store;queue;now;constructor(t,e,r=()=>new Date){this.store=t;this.queue=e;this.now=r}enqueueBackup(t,e=this.now().toISOString(),r){if(!t.enabled)throw Error("Backup policy is disabled.");let d=this.store.createJob({projectId:t.projectId,policyId:t.id,kind:"backup",status:"queued",idempotencyKey:`backup:${t.id}:${e}`,target:{scheduledFor:e},cancellability:"checkpoint_only",progress:{phase:"queued"}});if(!d.operationId){let E=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,actorId:r,kind:"backup.run",input:{backupJobId:d.id},lockKey:t.dataServiceId?`data-service:${t.dataServiceId}`:t.resourceId?`resource:${t.resourceId}`:`backup-policy:${t.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:14400,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(d.id,{operationId:E.operation.id})}return d}enqueueDue(t=this.now()){return this.store.duePolicies(t).map((e)=>{let r=e.nextRunAt;return this.store.advancePolicy(e.id,r),this.enqueueBackup(e,r)})}enqueueVerification(t){let e=this.store.createJob({projectId:t.projectId,policyId:t.policyId,recoveryPointId:t.id,kind:"verify",status:"queued",idempotencyKey:`verify:${t.id}:${t.checksum}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!e.operationId){let r=this.queue.enqueue({projectId:t.projectId,resourceId:t.resourceId,kind:"backup.verify",input:{backupJobId:e.id},lockKey:`recovery-point:${t.id}`,providerKey:"backup",maxAttempts:2,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(e.id,{operationId:r.operation.id})}return e}planRestore(t,e){if(t.status!=="available")throw Error("Only available recovery points can be restored.");if(t.verificationState!=="verified")throw Error("Restore requires a verified recovery point.");if(e.mode==="in_place"){if(!e.recentAuth)throw Error("In-place restore requires recent authentication.");if(e.confirm!==e.targetName)throw Error(`Type ${e.targetName} to confirm in-place restore.`);if(!e.downtimeAcknowledged)throw Error("In-place restore requires downtime acknowledgement.");let r=e.safetyBackupId?this.store.getRecoveryPoint(e.safetyBackupId):void 0;if(!r||r.id===t.id||r.status!=="available"||r.verificationState!=="verified"||r.resourceId!==t.resourceId||r.dataServiceId!==t.dataServiceId)throw Error("In-place restore requires a distinct verified safety backup for the same target.")}return{point:t,mode:e.mode,target:{...e.target,inPlace:e.mode==="in_place",restoreMode:e.mode},warnings:e.mode==="in_place"?["The target is locked against deployments and backup work.","Downtime and data replacement are expected.","Provider cancellation may stop only at a checkpoint."]:["An isolated target is created and health-validated before cleanup."]}}enqueueRestore(t,e){let r=this.planRestore(t,e),d=e.drill?"drill":"restore",E=CX(JSON.stringify({point:t.id,mode:e.mode,target:e.target,safety:e.safetyBackupId,drill:!!e.drill})),n=this.store.createJob({projectId:t.projectId,policyId:t.policyId,recoveryPointId:t.id,kind:d,status:"queued",idempotencyKey:`${d}:${E}`,target:r.target,restoreMode:r.mode,cancellability:"checkpoint_only",safetyBackupId:e.safetyBackupId,progress:{phase:"queued",warnings:r.warnings}});if(!n.operationId){let c=this.queue.enqueue({projectId:t.projectId,resourceId:t.resourceId,actorId:e.actorId,kind:e.drill?"backup.drill":"backup.restore",input:{backupJobId:n.id},lockKey:t.dataServiceId?`data-service:${t.dataServiceId}`:t.resourceId?`resource:${t.resourceId}`:`recovery-point:${t.id}`,providerKey:"backup",maxAttempts:1,timeoutSeconds:14400,retryClasses:[],resumePolicy:"fail"});return this.store.updateJob(n.id,{operationId:c.operation.id})}return n}enqueueRetention(t=this.now()){return this.store.retentionCandidates(t).map((e)=>{let r=this.store.createJob({projectId:e.projectId,policyId:e.policyId,recoveryPointId:e.id,kind:"cleanup",status:"queued",idempotencyKey:`cleanup:${e.id}:${e.expiresAt}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!r.operationId){let d=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,kind:"backup.cleanup",input:{backupJobId:r.id},lockKey:`recovery-point:${e.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(r.id,{operationId:d.operation.id})}return r})}}function LI(t){let e=t.now??(()=>new Date),r=new _i(t.store,t.queue,e),d=(_)=>{let i=_.recoveryPointId?t.store.getRecoveryPoint(_.recoveryPointId):void 0,T=_.policyId?t.store.getPolicy(_.policyId):i?.policyId?t.store.getPolicy(i.policyId):void 0;if(!T)throw Error("Backup policy was not found.");let h=t.store.getDestination(i?.destinationId??T.destinationId),R=t.resolveSource(T);if(!h)throw Error("Backup destination was not found.");if(!R)throw Error(`No ${T.resourceKind} backup adapter is configured.`);return{point:i,policy:T,destination:h,source:R}},E=(_)=>{let i=_.operation.input,T=t.store.getJob(String(i.backupJobId??""));if(!T)throw Error("Backup job was not found.");return t.store.updateJob(T.id,{status:"running",startedAt:T.startedAt??e().toISOString(),progress:{...T.progress,phase:"running"}}),T},n=(_,i)=>{let T=t.store.getJob(_.id)??_;t.store.updateJob(_.id,{status:"failed",finishedAt:e().toISOString(),error:i instanceof Error?i.message:String(i),progress:{...T.progress,phase:"failed"}})};return{"backup.run":async(_)=>{let i=E(_);try{let{policy:T,destination:h,source:R}=d(i),N=await R.create(T,_),A=t.resolveDestination(h),u=N.mode==="object"?await(async()=>{if(!A)throw Error("Backup destination adapter is not configured.");let P=t.store.getJob(i.id)?.progress,a=P?.multipart,j=a&&typeof a==="object"&&!Array.isArray(a)&&typeof a.uploadId==="string"&&typeof a.key==="string"&&Array.isArray(a.parts)?a:void 0;return A.upload(h,{key:N.key,body:N.body,contentType:N.contentType,resume:j,checkpoint:(B)=>{_.checkpoint("uploading",`Uploaded ${Number(B.bytesUploaded??0)} backup bytes.`),t.store.updateJob(i.id,{progress:{phase:"uploading",multipart:{...B}}})}})})():{uri:N.uri,key:N.uri,sizeBytes:N.sizeBytes,checksum:N.checksum,manifest:{format:"ts-cloud-backup-v1",encrypted:!1,plaintextChecksum:N.checksum,storageChecksum:N.checksum,contentType:"application/provider-snapshot"}},U=T.retention.expireAfterDays?new Date(e().getTime()+T.retention.expireAfterDays*86400000).toISOString():void 0,w=t.store.getJob(i.id)?.startedAt,l=t.store.createRecoveryPoint({projectId:T.projectId,policyId:T.id,destinationId:h.id,resourceId:T.resourceId,dataServiceId:T.dataServiceId,backupJobId:i.id,kind:T.resourceKind,pointInTime:e().toISOString(),uri:u.uri,sizeBytes:u.sizeBytes,checksum:u.checksum,manifest:{...N.manifest,...u.manifest,storageKey:u.key},toolVersion:N.toolVersion,engineVersion:N.engineVersion,expiresAt:U,lockedUntil:h.immutability.defaultRetentionDays?new Date(e().getTime()+h.immutability.defaultRetentionDays*86400000).toISOString():void 0,held:!1,pinned:!1,status:"available",verificationState:"unverified",durationMs:Math.max(0,e().getTime()-new Date(w??e().toISOString()).getTime())});if(N.mode==="external"&&h.provider==="aws_backup")t.store.recordDestinationTest(h.id,{ok:!0});return t.store.updateJob(i.id,{status:"succeeded",recoveryPointId:l.id,finishedAt:e().toISOString(),progress:{phase:"stored",recoveryPointId:l.id}}),r.enqueueVerification(l),{backupJobId:i.id,recoveryPointId:l.id}}catch(T){let h=t.store.getJob(i.id),R=h?.progress.multipart,N=(()=>{try{return d(i)}catch{return}})();if(N?.destination.provider==="aws_backup")t.store.recordDestinationTest(N.destination.id,{ok:!1,error:T instanceof Error?T.message:String(T)});let A=!1;if(R&&typeof R==="object"&&!Array.isArray(R)&&N){let u=t.resolveDestination(N.destination);if(A=!0,u?.abortPartial)try{await u.abortPartial(N.destination,R),A=!1,t.store.updateJob(i.id,{progress:{...h.progress,partialCleanup:"aborted"}})}catch{t.store.updateJob(i.id,{progress:{...h.progress,partialCleanup:"required"}})}}if(A)t.store.updateJob(i.id,{status:"cleanup_required",finishedAt:e().toISOString(),error:T instanceof Error?T.message:String(T),progress:{...t.store.getJob(i.id)?.progress??{},phase:"cleanup_required"}});else n(i,T);throw T}},"backup.verify":async(_)=>{let i=E(_);try{let{point:T,destination:h,source:R}=d(i);if(!T)throw Error("Recovery point was not found.");t.store.updateRecoveryPoint(T.id,{verificationState:"verifying"});let N;if(T.uri.startsWith("s3:")){let A=t.resolveDestination(h);if(!A)throw Error("Backup destination adapter is not configured.");let u=await A.download(h,{key:String(T.manifest.storageKey??""),checksum:T.checksum,manifest:T.manifest}),U=R.verify?await R.verify(T,u,_):{};N={bytes:u.length,checksum:T.checksum,...U}}else if(R.verifyExternal)N=await R.verifyExternal(T,_);else throw Error("External recovery point verification is not supported.");return t.store.updateRecoveryPoint(T.id,{verificationState:"verified",verifiedAt:e().toISOString(),manifest:{...T.manifest,verification:N}}),t.store.updateJob(i.id,{status:"succeeded",finishedAt:e().toISOString(),progress:{phase:"verified",evidence:N}}),{backupJobId:i.id,recoveryPointId:T.id,evidence:N}}catch(T){if(i.recoveryPointId)t.store.updateRecoveryPoint(i.recoveryPointId,{verificationState:/checksum|corrupt|authentic/i.test(T instanceof Error?T.message:String(T))?"corrupt":"failed"});throw n(i,T),T}},"backup.restore":async(_)=>c(_,!1),"backup.drill":async(_)=>c(_,!0),"backup.cleanup":async(_)=>{let i=E(_);try{let{point:T,destination:h,source:R}=d(i);if(!T)throw Error("Recovery point was not found.");if(!t.store.retentionCandidates(e()).some((N)=>N.id===T.id))throw Error("Recovery point is held, pinned, locked, or in active use.");if(t.store.updateRecoveryPoint(T.id,{status:"deleting"}),T.uri.startsWith("s3:")){let N=t.resolveDestination(h);if(!N)throw Error("Destination cleanup is unavailable.");await N.delete(h,String(T.manifest.storageKey??""))}else if(R.deleteExternal)await R.deleteExternal(T,_);else throw Error("External recovery point cleanup is unavailable.");return t.store.updateRecoveryPoint(T.id,{status:"deleted"}),t.store.updateJob(i.id,{status:"succeeded",finishedAt:e().toISOString(),progress:{phase:"deleted"}}),{backupJobId:i.id,recoveryPointId:T.id,deleted:!0}}catch(T){throw n(i,T),T}}};async function c(_,i){let T=E(_);try{let{point:h,policy:R,destination:N,source:A}=d(T);if(!h)throw Error("Recovery point was not found.");if(i&&!A.cleanup)throw Error("This backup source cannot safely clean a recovery drill target.");let u=h.uri.startsWith("s3:")?t.resolveDestination(N):void 0,U=u?await u.download(N,{key:String(h.manifest.storageKey??""),checksum:h.checksum,manifest:h.manifest}):void 0,w=await A.restore(h,U,T.target,_),l=A.validateHealth?await A.validateHealth({...T.target,...w},_):{healthy:!0,mode:"adapter"},P=t.validateHealth?await t.validateHealth(R,T.target):{healthy:!0,mode:"not_configured"},a={...l,healthy:l.healthy===!0&&P.healthy===!0,configured:P};if(a.healthy!==!0)throw Error("Restored target did not pass its configured health check.");if(i&&A.cleanup)await A.cleanup({...T.target,provider:h.manifest.provider??null},_);return t.store.updateJob(T.id,{status:"succeeded",finishedAt:e().toISOString(),healthResult:a,progress:{phase:i?"drill_cleaned":"restored",restored:w}}),{backupJobId:T.id,recoveryPointId:h.id,restored:w,health:a,cleaned:i}}catch(h){let R=(()=>{try{return d(T)}catch{return}})(),N=h instanceof Error?h.message:String(h),A=!1;if(i&&R?.source.cleanup)try{await R.source.cleanup({...T.target,provider:R.point?.manifest.provider??null},_)}catch{A=!0}if(A)t.store.updateJob(T.id,{status:"cleanup_required",finishedAt:e().toISOString(),error:N,progress:{...T.progress,phase:"cleanup_required"}});else n(T,h);throw h}}}Bn();import{createHash as IX}from"node:crypto";var lX=(t)=>`sha256:${IX("sha256").update(t).digest("hex")}`;class cN{dataServices;client;constructor(t,e=new _d){this.dataServices=t;this.client=e}service(t){let e=t.dataServiceId?this.dataServices.get(t.dataServiceId):void 0;if(!e||!["aws_rds","aws_aurora"].includes(e.provider))throw Error("Managed database backup policy requires an RDS or Aurora data service.");return e}async waitForSnapshot(t,e,r){for(;;){r.throwIfCancellationRequested?.(),r.heartbeat?.();let d=t==="aws_aurora"?(await this.client.describeDBClusterSnapshots({DBClusterSnapshotIdentifier:e})).DBClusterSnapshots[0]:(await this.client.describeDBSnapshots({DBSnapshotIdentifier:e})).DBSnapshots?.[0];if(!d)throw Error("Provider snapshot was not found.");let E=d,n=String(E.Status??E.DBSnapshotStatus??"unknown");if(r.checkpoint?.("provider_snapshot",`Database snapshot ${e} is ${n}.`),n==="available")return E;if(["deleted","deleting","failed"].includes(n))throw Error(`Provider snapshot ${e} failed with state ${n}.`);await Bun.sleep(5000)}}async create(t,e){let r=this.service(t),d=String(e.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,20),E=`${r.placement.slice(0,42).replace(/-+$/,"")}-${d}`;if(r.provider==="aws_aurora")await this.client.createDBClusterSnapshot(r.placement,E);else await this.client.createDBSnapshot({DBInstanceIdentifier:r.placement,DBSnapshotIdentifier:E});await this.waitForSnapshot(r.provider,E,e);let n=`${r.provider}:${r.placement}:${E}`;return{mode:"external",uri:`aws-backup:${n}`,checksum:lX(n),sizeBytes:0,manifest:{provider:r.provider,sourceId:r.placement,snapshotId:E,plan:r.plan,engine:r.engine},engineVersion:r.engineVersion,toolVersion:"aws-rds-api-2014-10-31"}}async verifyExternal(t,e){let r=String(t.manifest.snapshotId??""),d=String(t.manifest.provider??"");if(!r)throw Error("Snapshot recovery point has no snapshot ID.");let E=await this.waitForSnapshot(d,r,e),n=String(E.Status??E.DBSnapshotStatus??"unknown");return{snapshotId:r,status:n,encrypted:E.Encrypted??E.StorageEncrypted??!0}}async restore(t,e,r,d){let E=String(r.targetId??""),n=String(t.manifest.snapshotId??""),c=String(t.manifest.provider??"");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E))throw Error("Managed restore requires a valid distinct targetId.");if(E===t.manifest.sourceId)throw Error("Managed restore target must differ from its source.");if(c==="aws_aurora"){let _=t.manifest.engine==="postgres"?"aurora-postgresql":"aurora-mysql";await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:E,SnapshotIdentifier:n,Engine:_,EngineVersion:t.engineVersion,DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:Number(r.minCapacity)||0.5,MaxCapacity:Number(r.maxCapacity)||4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${E}-writer-1`,DBClusterIdentifier:E,DBInstanceClass:String(r.plan??t.manifest.plan??"db.serverless"),Engine:_,PubliclyAccessible:!1})}else await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:E,DBSnapshotIdentifier:n,DBInstanceClass:String(r.plan??t.manifest.plan??""),PubliclyAccessible:!1,DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud-restore"}]});return{targetId:E,provider:c,status:"creating",isolated:!0}}async validateHealth(t,e){let r=String(t.targetId??""),d=String(t.provider??"");for(;;){e.throwIfCancellationRequested?.(),e.heartbeat?.();let E=d==="aws_aurora"?(await this.client.describeDBClusters({DBClusterIdentifier:r})).DBClusters?.[0]:(await this.client.describeDBInstances({DBInstanceIdentifier:r})).DBInstances?.[0];if(!E)throw Error("Restored managed database was not found.");let n=String(E.Status??E.DBInstanceStatus??"unknown");if(e.checkpoint?.("provider_restore",`Restored database ${r} is ${n}.`),n==="available")return{healthy:!0,targetId:r,provider:d,status:n};if(["deleted","deleting","failed","incompatible-restore"].includes(n))throw Error(`Restored managed database ${r} failed with state ${n}.`);await Bun.sleep(5000)}}async cleanup(t,e){let r=String(t.targetId??""),d=String(t.provider??"");if(!r)throw Error("Restore cleanup target is required.");if(d==="aws_aurora")await this.client.deleteDBInstance({DBInstanceIdentifier:`${r}-writer-1`,SkipFinalSnapshot:!0}),await this.client.modifyDBCluster({DBClusterIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(r);else await this.client.modifyDBInstance({DBInstanceIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:r,SkipFinalSnapshot:!0,DeleteAutomatedBackups:!0})}async deleteExternal(t,e){let r=String(t.manifest.snapshotId??"");if(t.manifest.provider==="aws_aurora")await this.client.deleteDBClusterSnapshot(r);else await this.client.deleteDBSnapshot(r)}}var je=(t,e="none",r=!1)=>({supported:!0,downtime:e,destructive:r,explanation:t}),De=(t)=>({supported:!1,downtime:"none",destructive:!1,explanation:t});function N_(t,e){let r=["aws_rds","aws_aurora","aws_elasticache"].includes(e),d=["server","container"].includes(e),E=["postgres","mysql","mariadb"].includes(t),n=t==="redis",c={};return c.create=e==="external"?De("External services can be adopted as read-only inventory."):je(r?"Provision through the provider API.":"Provision through the owning runtime driver.","possible"),c.observe=e==="external"?De("External observation requires a configured provider adapter."):je("Provider/runtime health and endpoint metadata are observable."),c.connect=je("Connection guidance uses secret references and never returns a password by default."),c.backup=E&&(r||d)?je(r?"Create a provider snapshot.":"Create a consistent engine-native dump.","possible"):De("This cache path is not a durable backup source."),c.restore=r&&E?je("Restore creates a reviewed provider target.","required",!0):De("Restore requires a configured provider restore runner."),c.restart=e==="external"?De("External restart requires a configured provider adapter."):je(r?"Provider restart/failover semantics apply.":"Restart the owning service unit.","required"),c.resize=e==="aws_elasticache"?De("ElastiCache resizing requires a replication-group migration runner."):r?je("Provider plan/storage modification may enter a maintenance window.","possible"):d?je("Edit host/container resources and reconcile.","required"):De("External resize requires a configured provider adapter."),c.version=d?De("Runtime version upgrades require an explicit image migration runner."):r&&e!=="aws_elasticache"?je(E?"Major versions require compatibility preflight and backup.":"Engine upgrades require a maintenance window.","required"):De("External upgrades require a configured provider adapter."),c.rotate=e==="aws_elasticache"||e==="external"||d&&!E&&!n?De("Credential rotation is not available for this provider/engine path."):je("Rotate through the secret backend, update the engine, then flag dependent releases."),c.expose=d?De("Direct container publishing is refused; use a reviewed firewall and proxy policy."):e==="aws_rds"?je("Exposure is reconciled through security groups; public access defaults off."):De("Exposure changes require a provider-specific network runner."),c.delete=e==="external"?De("External deletion requires a configured provider adapter."):je(r?"Final snapshot is supported where the provider allows it.":"A final engine backup is required unless explicitly retained.","required",!0),c.logs=d?je("Read bounded service logs from the runtime."):De("Provider log export is not configured for this adapter."),c.slow_queries=d&&E?je("Read bounded runtime logs after engine slow-query logging is enabled."):De("A slow-query log runner is not configured for this provider."),c.users=d&&E?je("Logical users can be listed; creation requires a referenced secondary credential."):De("User management requires an engine connection runner."),c.databases=d&&E?je("Logical databases can be listed, created, and confirmation-gated for deletion."):De("Logical database management requires an engine connection runner."),{actions:c,endpointTypes:r?["internal","external","tunnel"]:["internal","tunnel"],metrics:n?["connections","memory","evictions","hit_rate","latency"]:["connections","cpu","storage","read_latency","write_latency","iops"]}}var vn=(t)=>t==null?void 0:String(t),ii=(t)=>Number(t)===1,Ti=(t)=>{try{return JSON.parse(String(t))}catch{return{}}};function uI(t){return{id:String(t.id),organizationId:String(t.organization_id),projectId:String(t.project_id),environmentId:vn(t.environment_id),resourceId:vn(t.resource_id),name:String(t.name),engine:String(t.engine),provider:String(t.provider),placement:String(t.placement),engineVersion:vn(t.engine_version),plan:String(t.plan),storageGb:t.storage_gb==null?void 0:Number(t.storage_gb),highAvailability:ii(t.high_availability),publicExposure:ii(t.public_exposure),allowedCidrs:Ti(t.allowed_cidrs),desiredState:Ti(t.desired_state),observedState:Ti(t.observed_state),capabilities:Ti(t.capabilities),credentialRef:vn(t.credential_ref),status:String(t.status),origin:String(t.origin),managementEnabled:ii(t.management_enabled),ownerActorId:vn(t.owner_actor_id),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}}class _N{controlPlane;now;constructor(t,e=()=>new Date){this.controlPlane=t;this.now=e}create(t){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(t.name))throw Error("Data service names must be 2-63 lowercase letters, numbers, or dashes.");if(t.publicExposure&&(!t.allowedCidrs.length||t.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");let e=crypto.randomUUID(),r=this.now().toISOString(),d=N_(t.engine,t.provider);return this.controlPlane.database.run("INSERT INTO data_services (id,organization_id,project_id,environment_id,resource_id,name,engine,provider,placement,engine_version,plan,storage_gb,high_availability,public_exposure,allowed_cidrs,desired_state,observed_state,capabilities,credential_ref,status,origin,management_enabled,owner_actor_id,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[e,t.organizationId,t.projectId,t.environmentId??null,t.resourceId??null,t.name,t.engine,t.provider,t.placement,t.engineVersion??null,t.plan,t.storageGb??null,t.highAvailability?1:0,t.publicExposure?1:0,JSON.stringify(t.allowedCidrs),JSON.stringify(t.desiredState),JSON.stringify(t.observedState),JSON.stringify(d),t.credentialRef??null,t.status,t.origin,t.managementEnabled?1:0,t.ownerActorId??null,1,r,r]),this.get(e)}get(t){let e=this.controlPlane.database.query("SELECT * FROM data_services WHERE id=?").get(t);return e?uI(e):void 0}list(t,e){return this.controlPlane.database.query(`SELECT * FROM data_services WHERE project_id=?${e?" AND environment_id=?":""} ORDER BY name`).all(t,...e?[e]:[]).map(uI)}update(t,e,r){let d=this.get(t);if(!d)throw Error("Data service was not found.");if(d.version!==e)throw Error("Data service changed; refresh before retrying.");let E={...d,...r};if(E.publicExposure&&(!E.allowedCidrs.length||E.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");if(this.controlPlane.database.run("UPDATE data_services SET plan=?,storage_gb=?,engine_version=?,high_availability=?,public_exposure=?,allowed_cidrs=?,desired_state=?,observed_state=?,status=?,management_enabled=?,credential_ref=?,version=version+1,updated_at=? WHERE id=? AND version=?",[E.plan,E.storageGb??null,E.engineVersion??null,E.highAvailability?1:0,E.publicExposure?1:0,JSON.stringify(E.allowedCidrs),JSON.stringify(E.desiredState),JSON.stringify(E.observedState),E.status,E.managementEnabled?1:0,E.credentialRef??null,this.now().toISOString(),t,e]).changes!==1)throw Error("Data service changed; refresh before retrying.");return this.get(t)}credential(t){let e=this.controlPlane.database.query("SELECT * FROM data_service_credentials WHERE service_id=? ORDER BY version DESC LIMIT 1").get(t);return e?{id:String(e.id),serviceId:String(e.service_id),username:String(e.username),secretRef:String(e.secret_ref),version:Number(e.version),createdAt:String(e.created_at),rotatedAt:vn(e.rotated_at)}:void 0}saveCredential(t,e,r){let d=this.credential(t),E=d?.id??crypto.randomUUID(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_credentials (id,service_id,username,secret_ref,version,created_at,rotated_at) VALUES (?,?,?,?,?,?,?) ON CONFLICT(service_id,username) DO UPDATE SET secret_ref=excluded.secret_ref,version=data_service_credentials.version+1,rotated_at=excluded.rotated_at",[E,t,e,r,d?.version??1,d?.createdAt??n,d?n:null]),this.credential(t)}addDependency(t){let e=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_dependencies (service_id,resource_id,secret_ref,requires_redeploy,created_at) VALUES (?,?,?,?,?) ON CONFLICT(service_id,resource_id) DO UPDATE SET secret_ref=excluded.secret_ref,requires_redeploy=excluded.requires_redeploy",[t.serviceId,t.resourceId,t.secretRef,t.requiresRedeploy?1:0,e]),{...t,createdAt:e}}dependencies(t){return this.controlPlane.database.query("SELECT * FROM data_service_dependencies WHERE service_id=? ORDER BY resource_id").all(t).map((e)=>({serviceId:String(e.service_id),resourceId:String(e.resource_id),secretRef:String(e.secret_ref),requiresRedeploy:ii(e.requires_redeploy),createdAt:String(e.created_at)}))}removeDependency(t,e){return this.controlPlane.database.run("DELETE FROM data_service_dependencies WHERE service_id=? AND resource_id=?",[t,e]).changes===1}remove(t){this.controlPlane.database.run("DELETE FROM data_services WHERE id=?",[t])}}function OI(){let e=crypto.getRandomValues(new Uint8Array(40));return Array.from(e,(r)=>"ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*_-+="[r%69]).join("")}function CI(t,e){return e.map((r)=>{let d=r.type==="tunnel"?"127.0.0.1":r.host,E=t.engine==="redis"?`redis-cli -h ${d} -p ${r.port}${r.tls?" --tls":""}`:t.engine==="postgres"?`psql "host=${d} port=${r.port} dbname=${r.database??"postgres"} sslmode=${r.tls?"require":"disable"}"`:t.engine==="mongodb"?`mongosh "mongodb://${d}:${r.port}/${r.database??"admin"}${r.tls?"?tls=true":""}"`:t.engine==="libsql"?`turso db shell ${r.tls?"https":"http"}://${d}:${r.port}`:`mysql --host=${d} --port=${r.port} --database=${r.database??"mysql"} --ssl-mode=${r.tls?"REQUIRED":"DISABLED"}`;return{type:r.type,command:E,secretRef:t.credentialRef}})}class hi{store;queue;secrets;constructor(t,e,r){this.store=t;this.queue=e;this.secrets=r}async create(t){let e,r;if(t.provider!=="aws_elasticache"){let d=t.username??"app",E=OI();r=`secret://data-services/${t.projectId}/${t.name}/${d}`,await this.secrets.put(r,E),e={username:d,password:E,secretRef:r}}try{let d=this.store.create({...t,credentialRef:r,status:"planning"});if(e)this.store.saveCredential(d.id,e.username,e.secretRef);let E=this.enqueue(d,"create",{});return{service:d,credential:e,operationId:E}}catch(d){if(r)await this.secrets.remove(r);throw d}}plan(t,e,r={}){let d=t.capabilities.actions[e],E=e==="version"&&String(r.engineVersion??"").split(".")[0]!==String(t.engineVersion??"").split(".")[0];return{service:t,action:e,capability:d,changes:r,preflight:{backupRequired:["delete","restore"].includes(e)||E,compatibilityRequired:E,typedConfirmation:d.destructive?t.name:void 0,retentionChoiceRequired:e==="delete"},warnings:[...d.downtime!=="none"?[`Downtime is ${d.downtime}.`]:[],...t.origin==="adopted"&&!t.managementEnabled?["Adopted resource is read-only until management is explicitly enabled."]:[]]}}enqueue(t,e,r,d){let E=this.plan(t,e,r);if(!E.capability.supported)throw Error(E.capability.explanation);if(t.origin==="adopted"&&!t.managementEnabled&&e!=="observe")throw Error("Adopted resources remain read-only until management is explicitly enabled.");if(E.preflight.typedConfirmation&&r.confirm!==E.preflight.typedConfirmation)throw Error(`Type ${E.preflight.typedConfirmation} to confirm ${e}.`);if(E.preflight.retentionChoiceRequired&&!["final_backup","retain"].includes(String(r.retention??"")))throw Error("Deletion requires retention final_backup or retain.");if(E.preflight.compatibilityRequired&&(r.compatibilityReviewed!==!0||!r.backupId))throw Error("Major version changes require compatibilityReviewed=true and a backupId.");if(e==="restore"){let n=String(r.backupId??""),c=String(r.targetId??"");if(!n||!c)throw Error("Restore requires both backupId and targetId.");if(c===t.placement)throw Error("Restore targetId must differ from the source placement.");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(c))throw Error("Restore targetId must be 2-63 lowercase letters, numbers, or dashes.")}return this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,actorId:d,kind:"data_service.action",input:{serviceId:t.id,action:e,...r},lockKey:`data-service:${t.id}`,providerKey:t.provider,maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"}).operation.id}async rotate(t,e,r){let d=this.store.credential(t.id);if(!d)throw Error("Data service credential metadata was not found.");let E=OI(),n=`${d.secretRef}/v${d.version+1}`;await this.secrets.put(n,E);try{return await e.action(t,"rotate",{username:d.username,secretRef:n},E,r),this.store.saveCredential(t.id,d.username,n),this.store.update(t.id,t.version,{credentialRef:n}),{credential:{username:d.username,password:E,secretRef:n},dependencies:this.store.dependencies(t.id).filter((c)=>c.requiresRedeploy).map((c)=>c.resourceId)}}catch(c){throw await this.secrets.remove(n),c}}}function II(t){return{"data_service.action":async(e)=>{let r=e.operation.input,d=t.store.get(String(r.serviceId??"")),E=String(r.action??"");if(!d)throw Error("Data service was not found.");let n=t.resolveAdapter(d);if(!n||n.provider!==d.provider||!n.engines.includes(d.engine))throw Error(`No ${d.provider}/${d.engine} adapter is configured.`);if(E==="rotate"){let _=await new hi(t.store,new yt(t.store.controlPlane),t.secrets).rotate(d,n,e);return{serviceId:d.id,action:E,username:_.credential.username,secretRef:_.credential.secretRef,dependencies:_.dependencies}}let c=d.credentialRef?await t.secrets.resolve(d.credentialRef):void 0;try{let _=E==="observe"?await n.observe(d):E==="create"?await n.apply(d,c,e):await n.action(d,E,r,c,e),i=t.store.get(d.id);return t.store.update(d.id,i.version,{observedState:_,status:E==="delete"?r.retention==="retain"?"retained":"deleting":"available"}),{serviceId:d.id,action:E,observed:_}}catch(_){let i=t.store.get(d.id);if(t.store.update(d.id,i.version,{status:"failed",observedState:{...i.observedState,error:_ instanceof Error?_.message:String(_)}}),/temporar|timeout|unavailable|throttl/i.test(_ instanceof Error?_.message:String(_)))throw new yr(_ instanceof Error?_.message:String(_),"provider_transient");throw _}}}}class Qn{transport;constructor(t){this.transport=t}observe(t){return this.transport.observe(t.placement)}apply(t,e){return this.transport.apply({id:t.placement,name:t.name,engine:t.engine,engineVersion:t.engineVersion??null,plan:t.plan,storageGb:t.storageGb??null,highAvailability:t.highAvailability,publicExposure:t.publicExposure,allowedCidrs:t.allowedCidrs,username:t.desiredState.username??"app",desiredState:t.desiredState},e)}action(t,e,r,d,E){return this.transport.execute(t.placement,e,{engine:t.engine,engineVersion:t.engineVersion??null,plan:t.plan,desiredState:t.desiredState,...r},d,E)}}class TN extends Qn{provider="aws_rds";engines=["postgres","mysql","mariadb"]}class iN extends Qn{provider="aws_aurora";engines=["postgres","mysql"]}class hN extends Qn{provider="aws_elasticache";engines=["redis"]}class RN extends Qn{provider="server";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}class SN extends Qn{provider="container";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}Bn();var Ni=(t,e)=>{let r=t.desiredState;return t[e]??(r&&typeof r==="object"&&!Array.isArray(r)?r[e]:void 0)},xt=(t,e,r)=>{let d=Ni(t,e);return d==null?r:String(d)},be=(t,e)=>{let r=Ni(t,e);return r==null?void 0:Number(r)},xd=(t,e)=>{let r=Ni(t,e);return r==null?void 0:r===!0||r==="true"},Yn=(t,e)=>{let r=Ni(t,e);return Array.isArray(r)?r.map(String):[]},Si=(t,e)=>xt(e,"snapshotId")??`${t}-final-${new Date().toISOString().replace(/[^0-9]/g,"").slice(0,14)}`;function Ri(t){if(!t)throw Error("RDS instance was not found.");return{providerId:t.DBInstanceIdentifier??null,status:t.DBInstanceStatus??"unknown",engine:t.Engine??null,engineVersion:t.EngineVersion??null,plan:t.DBInstanceClass??null,storageGb:t.AllocatedStorage??null,highAvailability:t.MultiAZ??!1,publicExposure:t.PubliclyAccessible??!1,endpoint:t.Endpoint?.Address??null,port:t.Endpoint?.Port??null,username:t.MasterUsername??null,database:t.DBName??null,encrypted:t.StorageEncrypted??!1}}class AN{client;constructor(t=new _d){this.client=t}async observe(t){return Ri(await this.client.describeDBInstance(t))}async apply(t,e){let r=String(t.id),d=await this.client.createDBInstance({DBInstanceIdentifier:r,DBInstanceClass:String(t.plan),Engine:String(t.engine),MasterUsername:xt(t,"username","app"),MasterUserPassword:e,DBName:xt(t,"database"),AllocatedStorage:be(t,"storageGb"),VpcSecurityGroupIds:Yn(t,"securityGroupIds"),DBSubnetGroupName:xt(t,"subnetGroup"),BackupRetentionPeriod:be(t,"backupRetentionDays")??7,MultiAZ:xd(t,"highAvailability"),EngineVersion:xt(t,"engineVersion"),PubliclyAccessible:xd(t,"publicExposure")??!1,StorageType:xt(t,"storageType","gp3"),StorageEncrypted:!0,KmsKeyId:xt(t,"kmsKeyId"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return Ri(d.DBInstance)}async execute(t,e,r,d,E){if(e==="observe")return this.observe(t);if(e==="restart")return await this.client.rebootDBInstance({DBInstanceIdentifier:t}),{status:"rebooting"};if(e==="backup"){let n=Si(t,r);return await this.client.createDBSnapshot({DBInstanceIdentifier:t,DBSnapshotIdentifier:n}),{status:"snapshotting",snapshotId:n}}if(e==="restore"){let n=String(r.targetId),c=await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:n,DBSnapshotIdentifier:String(r.backupId),DBInstanceClass:xt(r,"plan"),DBSubnetGroupName:xt(r,"subnetGroup"),MultiAZ:xd(r,"highAvailability"),PubliclyAccessible:!1,StorageType:xt(r,"storageType"),VpcSecurityGroupIds:Yn(r,"securityGroupIds"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{...Ri(c.DBInstance),sourceId:t,restoreTargetId:n}}if(e==="delete"){if(r.retention==="retain")return{status:"retained"};let n=Si(t,r);return await this.client.modifyDBInstance({DBInstanceIdentifier:t,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:t,SkipFinalSnapshot:!1,FinalDBSnapshotIdentifier:n,DeleteAutomatedBackups:!1}),{status:"deleting",finalSnapshotId:n}}if(["resize","version","rotate","expose"].includes(e)){let n=await this.client.modifyDBInstance({DBInstanceIdentifier:t,DBInstanceClass:xt(r,"plan"),AllocatedStorage:be(r,"storageGb"),MasterUserPassword:e==="rotate"?d:void 0,EngineVersion:xt(r,"engineVersion"),MultiAZ:xd(r,"highAvailability"),PubliclyAccessible:xd(r,"publicExposure"),VpcSecurityGroupIds:Yn(r,"securityGroupIds"),ApplyImmediately:xd(r,"applyImmediately")??!0});return Ri(n.DBInstance)}throw Error(`RDS action ${e} requires an engine connection runner.`)}}function NN(t){if(!t)throw Error("Aurora cluster was not found.");return{providerId:t.DBClusterIdentifier??null,status:t.Status??"unknown",engine:t.Engine??null,engineVersion:t.EngineVersion??null,endpoint:t.Endpoint??null,readerEndpoint:t.ReaderEndpoint??null,port:t.Port??null,username:t.MasterUsername??null,database:t.DatabaseName??null,encrypted:t.StorageEncrypted??!1,highAvailability:t.MultiAZ??!0}}class LN{client;constructor(t=new _d){this.client=t}async observe(t){let e=await this.client.describeDBClusters({DBClusterIdentifier:t});return NN(e.DBClusters?.[0])}async apply(t,e){let r=String(t.id),d=String(t.engine)==="postgres"?"aurora-postgresql":"aurora-mysql";return await this.client.createDBCluster({DBClusterIdentifier:r,Engine:d,EngineVersion:xt(t,"engineVersion"),MasterUsername:xt(t,"username","app"),MasterUserPassword:e,DatabaseName:xt(t,"database"),DBSubnetGroupName:xt(t,"subnetGroup"),VpcSecurityGroupIds:Yn(t,"securityGroupIds"),BackupRetentionPeriod:be(t,"backupRetentionDays")??7,StorageEncrypted:!0,KmsKeyId:xt(t,"kmsKeyId"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:be(t,"minCapacity")??0.5,MaxCapacity:be(t,"maxCapacity")??4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${r}-writer-1`,DBClusterIdentifier:r,DBInstanceClass:String(t.plan||"db.serverless"),Engine:d,PubliclyAccessible:xd(t,"publicExposure")??!1}),{status:"creating",providerId:r}}async execute(t,e,r,d){if(e==="observe")return this.observe(t);if(e==="restart")return await this.client.rebootDBCluster(t),{status:"rebooting"};if(e==="backup"){let E=Si(t,r);return await this.client.createDBClusterSnapshot(t,E),{status:"snapshotting",snapshotId:E}}if(e==="restore"){let E=String(r.targetId),n=String(r.engine)==="postgres"?"aurora-postgresql":"aurora-mysql",c=await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:E,SnapshotIdentifier:String(r.backupId),Engine:n,EngineVersion:xt(r,"engineVersion"),DBSubnetGroupName:xt(r,"subnetGroup"),VpcSecurityGroupIds:Yn(r,"securityGroupIds"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:be(r,"minCapacity")??0.5,MaxCapacity:be(r,"maxCapacity")??4}});return await this.client.createDBInstance({DBInstanceIdentifier:`${E}-writer-1`,DBClusterIdentifier:E,DBInstanceClass:xt(r,"plan","db.serverless"),Engine:n,PubliclyAccessible:!1}),{...NN(c.DBCluster),sourceId:t,restoreTargetId:E}}if(e==="delete"){if(r.retention==="retain")return{status:"retained"};let E=Si(t,r);return await this.client.modifyDBCluster({DBClusterIdentifier:t,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(t,E),{status:"deleting",finalSnapshotId:E}}if(["resize","version","rotate"].includes(e)){let E=await this.client.modifyDBCluster({DBClusterIdentifier:t,ServerlessV2ScalingConfiguration:be(r,"minCapacity")==null&&be(r,"maxCapacity")==null?void 0:{MinCapacity:be(r,"minCapacity")??0.5,MaxCapacity:be(r,"maxCapacity")??4},EngineVersion:xt(r,"engineVersion"),MasterUserPassword:e==="rotate"?d:void 0,ApplyImmediately:xd(r,"applyImmediately")??!0});return NN(E.DBCluster)}throw Error(`Aurora action ${e} requires an engine connection runner.`)}}class uN{client;constructor(t=new S_){this.client=t}async observe(t){let e=(await this.client.describeCacheClusters(t)).CacheClusters[0];if(!e)throw Error("ElastiCache cluster was not found.");let r=e.CacheNodes?.[0]?.Endpoint;return{providerId:e.CacheClusterId,status:e.CacheClusterStatus,engine:e.Engine,engineVersion:e.EngineVersion,plan:e.CacheNodeType,nodes:e.NumCacheNodes,endpoint:r?.Address??null,port:r?.Port??null}}async apply(t){let e=await this.client.createCacheCluster({cacheClusterId:String(t.id),engine:"redis",cacheNodeType:String(t.plan),numCacheNodes:be(t,"nodes")??1,engineVersion:xt(t,"engineVersion"),port:be(t,"port"),securityGroupIds:Yn(t,"securityGroupIds"),subnetGroupName:xt(t,"subnetGroup"),tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{providerId:e.CacheCluster.CacheClusterId,status:e.CacheCluster.CacheClusterStatus}}async execute(t,e,r){if(e==="observe")return this.observe(t);if(e==="restart"){let d=(await this.client.describeCacheClusters(t)).CacheClusters[0];return await this.client.rebootCacheCluster(t,d?.CacheNodes?.map((E)=>E.CacheNodeId)??["0001"]),{status:"rebooting"}}if(e==="delete"){if(r.retention==="retain")return{status:"retained"};return await this.client.deleteCacheCluster(t),{status:"deleting"}}throw Error(`ElastiCache action ${e} is not supported by this cluster mode.`)}}await Wt();import{mkdir as DX,writeFile as UX}from"node:fs/promises";import{join as fX}from"node:path";async function rr(t,e,r=!1){let d=Bun.spawn(["docker",...t],{stdin:e==null?"ignore":"pipe",stdout:"pipe",stderr:"pipe"}),E=new Response(d.stdout).text(),n=new Response(d.stderr).text();if(e!=null)d.stdin.write(e),d.stdin.end();let[c,_,i]=await Promise.all([d.exited,E,n]);if(c!==0&&!r)throw Error(`Docker command failed (${c}): ${i.trim()||_.trim()}`);return{code:c,stdout:_,stderr:i}}class lI{async ensureNetwork(t){if((await rr(["network","inspect",t],void 0,!0)).code!==0)await rr(["network","create","--internal",t])}async seedSecret(t,e){await rr(["volume","create",t]),await rr(["run","--rm","-i","-v",`${t}:/run/target`,"alpine:3.21","sh","-c","umask 077; cat > /run/target/credential"],e)}async removeVolume(t){await rr(["volume","rm",t],void 0,!0)}async inspect(t){let e=await rr(["inspect",t],void 0,!0);if(e.code!==0)return;return JSON.parse(e.stdout)[0]}async run(t){await rr(["run",...t])}async exec(t,e,r){return(await rr(["exec","-i",t,...e],r)).stdout}async update(t,e){await rr(["update",...e,t])}async restart(t){await rr(["restart",t])}async remove(t){await rr(["rm","--force",t],void 0,!0)}async logs(t,e){let r=await rr(["logs","--tail",String(Math.min(2000,Math.max(1,e))),t],void 0,!0);return`${r.stdout}${r.stderr}`.slice(-262144)}async stats(t){let e=await rr(["stats","--no-stream","--format","{{json .}}",t],void 0,!0);if(e.code!==0||!e.stdout.trim())return{};let r=JSON.parse(e.stdout.trim());return{cpuPercent:String(r.CPUPerc??""),memoryUsage:String(r.MemUsage??""),memoryPercent:String(r.MemPerc??""),networkIo:String(r.NetIO??""),blockIo:String(r.BlockIO??""),pids:Number(r.PIDs??0)}}}var wX={postgres:{image:"postgres:17-alpine",port:5432,dataPath:"/var/lib/postgresql/data"},mysql:{image:"mysql:8.4",port:3306,dataPath:"/var/lib/mysql"},mariadb:{image:"mariadb:11.7",port:3306,dataPath:"/var/lib/mysql"},redis:{image:"redis:7.4-alpine",port:6379,dataPath:"/data"},mongodb:{image:"mongo:8.0",port:27017,dataPath:"/data/db"}};function Td(t,e="app"){let r=String(t??e);if(!/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(r))throw Error("Database identifiers must be letters, numbers, or underscores.");return r}function WE(t){if(!/^[a-z0-9][a-z0-9_.-]{1,62}$/i.test(t))throw Error("Runtime placement must be a valid container identifier.");return`tscloud-data-${t.toLowerCase()}`}function gX(t,e){let r=t.desiredState;return t[e]??(r&&typeof r==="object"&&!Array.isArray(r)?r[e]:void 0)}function A_(t){return t.Config?.Labels??{}}class Mn{runtime;backupRoot;constructor(t=new lI,e=_e(process.cwd(),"backups","data")){this.runtime=t;this.backupRoot=e}async observe(t){let e=WE(t),r=await this.runtime.inspect(e);if(!r)throw Error(`Data container ${e} was not found.`);let d=A_(r),E=await this.runtime.stats(e),n=r.NetworkSettings?.Ports??{},c=Object.values(n).flat().find(Boolean);return{providerId:e,status:r.State?.Status??"unknown",healthy:r.State?.Health?.Status??null,engine:d["ts-cloud.engine"]??null,engineVersion:d["ts-cloud.engine-version"]??null,username:d["ts-cloud.username"]??null,database:d["ts-cloud.database"]??null,endpoint:c?.HostIp||"127.0.0.1",port:c?.HostPort?Number(c.HostPort):null,image:r.Config?.Image??null,startedAt:r.State?.StartedAt??null,metrics:E}}async apply(t,e){let r=String(t.id),d=WE(r),E=String(t.engine);if(E==="libsql")throw Error("libSQL requires an explicitly configured runtime image.");let n=wX[E];if(!n)throw Error(`Unsupported runtime data engine ${E}.`);if(!e)throw Error(`${E} requires a managed credential.`);if(t.publicExposure===!0)throw Error("Container public exposure requires an external reviewed firewall policy; direct publishing is refused.");let c=Td(t.username),_=Td(gX(t,"database")),i=`${d}-secret`,T=`${d}-data`,h=E==="redis"?`appendonly yes
 protected-mode yes
 requirepass ${e.replaceAll("\\","\\\\").replaceAll(`
 `,"")}
@@ -5552,15 +5552,15 @@ protected-mode yes
 requirepass ${d.replaceAll("\\","\\\\").replaceAll(`
 `,"")}
 `:d;if(await this.runtime.seedSecret(`${E}-secret`,h),_==="redis")await this.runtime.restart(E);return{status:_==="redis"?"restarting":"running",username:i}}if(e==="delete"){if(r.retention==="retain")return{status:"retained"};let n=await this.backup(t,r);return await this.runtime.remove(E),await this.runtime.removeVolume(`${E}-secret`),await this.runtime.removeVolume(`${E}-data`),{status:"deleted",finalBackupId:n.backupId??null,backupPath:n.path??null}}if(e==="expose")throw Error("Direct container exposure is refused; use a reviewed firewall and proxy policy.");throw Error(`${e} requires a configured engine lifecycle runner.`)}}import{createCipheriv as $X,createDecipheriv as yX,createHash as DI,randomBytes as XX}from"node:crypto";class ON{controlPlane;now;key;constructor(t,e,r=()=>new Date){this.controlPlane=t;this.now=r;if(!e)throw Error("Data-service encryption key is required.");this.key=DI("sha256").update(`ts-cloud:data-services:${e}`).digest()}encrypt(t){let e=XX(12),r=$X("aes-256-gcm",this.key,e),d=Buffer.concat([r.update(t,"utf8"),r.final()]);return`v1.${e.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${d.toString("base64url")}`}decrypt(t){let[e,r,d,E]=t.split(".");if(e!=="v1"||!r||!d||!E)throw Error("Encrypted data-service secret is unavailable.");try{let n=yX("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return n.setAuthTag(Buffer.from(d,"base64url")),Buffer.concat([n.update(Buffer.from(E,"base64url")),n.final()]).toString("utf8")}catch{throw Error("Encrypted data-service secret could not be decrypted.")}}async put(t,e){if(!/^secret:\/\/data-services\/[A-Za-z0-9._/-]+$/.test(t))throw Error("Invalid data-service secret reference.");if(!e)throw Error("Data-service secret cannot be empty.");let r=this.now().toISOString();this.controlPlane.database.run("INSERT INTO data_service_secrets (reference,ciphertext,fingerprint,created_at,updated_at) VALUES (?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,updated_at=excluded.updated_at",[t,this.encrypt(e),DI("sha256").update(e).digest("hex"),r,r])}async resolve(t){let e=this.controlPlane.database.query("SELECT ciphertext FROM data_service_secrets WHERE reference = ?").get(t);if(!e)throw Error("Data-service secret was not found.");return this.decrypt(e.ciphertext)}async remove(t){this.controlPlane.database.run("DELETE FROM data_service_secrets WHERE reference = ?",[t])}}await Wt();import{existsSync as L_}from"node:fs";import{mkdir as Li,readdir as PX,rename as CN,rm as Gn}from"node:fs/promises";import{relative as aX,resolve as Je,sep as ui}from"node:path";function vE(t,e){if(e==="gzip")return Buffer.from(Bun.gzipSync(Uint8Array.from(t)));if(e==="zstd")return Buffer.from(Bun.zstdCompressSync(Uint8Array.from(t)));return Buffer.from(t)}function id(t,e){if(e==="gzip")return Buffer.from(Bun.gunzipSync(Uint8Array.from(t)));if(e==="zstd")return Buffer.from(Bun.zstdDecompressSync(Uint8Array.from(t)));return Buffer.from(t)}async function IN(t,e){let r=Bun.spawn(["tar",...t],{stdin:e?Buffer.from(e):void 0,stdout:"pipe",stderr:"pipe"}),[d,E,n]=await Promise.all([r.exited,new Response(r.stdout).arrayBuffer(),new Response(r.stderr).text()]);if(d!==0)throw Error(n.trim()||`tar exited with status ${d}.`);return{stdout:Buffer.from(E),stderr:n}}function jX(t){let e=t.replaceAll("\\","/").replace(/^\.\//,"");return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")}class fI{async create(t,e,r){return(await IN(["-C",t,"-cf","-",...r.map((E)=>`--exclude=${E}`),"--",...e])).stdout}async extract(t,e){await Li(e,{recursive:!0,mode:448}),await IN(["-C",e,"-xf","-"],t)}async inspect(t){let e=await IN(["-tf","-"],t),r=e.stdout.toString().split(`
-`).filter(Boolean);if(r.some((d)=>!jX(d)))throw Error("Backup archive contains an unsafe path.");return{entries:r,bytes:t.byteLength}}}function UI(t,e){if(!e.trim())throw Error("File backup paths cannot be empty.");let r=Je(t,e),d=aX(t,r);if(d===".."||d.startsWith(`..${ui}`)||d==="")throw Error(`File backup path ${e} is outside the project root.`);return d}function Ai(t){let e=String(t.targetId??t.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(e))throw Error("File restores require a safe target name.");return e}class lN{runtime;root;restoreRoot;constructor(t,e=new fI,r=_e(t,"restores","files")){this.runtime=e;this.root=Je(t),this.restoreRoot=Je(r)}paths(t){let e=[...new Set(t.includePatterns.map((r)=>UI(this.root,r)))];if(!e.length)throw Error("File backup policies require at least one project-relative path.");for(let r of e)if(!L_(Je(this.root,r)))throw Error(`File backup path ${r} was not found.`);return e.filter((r)=>!e.some((d)=>d!==r&&r.startsWith(`${d}${ui}`)))}async create(t,e){let r=this.paths(t),d=await this.runtime.create(this.root,r,t.excludePatterns),E=await this.runtime.inspect(d),n=t.compression??"none",c=vE(d,n),_=String(e.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${t.projectId}/files/${_}.tar${n==="none"?"":n==="gzip"?".gz":".zst"}`,body:c,contentType:n==="gzip"?"application/gzip":n==="zstd"?"application/zstd":"application/x-tar",manifest:{archive:"tar",compression:n,sourcePaths:r,excluded:t.excludePatterns,entries:E.entries.length},toolVersion:"system-tar"}}async restore(t,e,r,d){if(!e)throw Error("File restore requires an archive payload.");let E=id(e,String(t.manifest.compression??"none"));if(await this.runtime.inspect(E),r.restoreMode==="in_place"){let c=Je(this.restoreRoot,`.staging-${Ai(r)}`),_=Je(this.restoreRoot,`.rollback-${Ai(r)}`),i=Array.isArray(t.manifest.sourcePaths)?t.manifest.sourcePaths.map(String):[];if(!i.length)throw Error("File recovery point has no source path manifest.");await Gn(c,{recursive:!0,force:!0}),await Gn(_,{recursive:!0,force:!0}),await this.runtime.extract(E,c),await Li(_,{recursive:!0,mode:448});let T=[];try{for(let h of i){let R=Je(this.root,UI(this.root,h)),N=Je(c,h),A=Je(_,h);if(await Li(Je(A,".."),{recursive:!0}),L_(R))await CN(R,A);await Li(Je(R,".."),{recursive:!0}),await CN(N,R),T.push(h)}}catch(h){for(let R of T.reverse()){let N=Je(this.root,R),A=Je(_,R);if(await Gn(N,{recursive:!0,force:!0}),L_(A))await CN(A,N)}throw h}finally{await Gn(c,{recursive:!0,force:!0})}return await Gn(_,{recursive:!0,force:!0}),{path:this.root,restoredPaths:i,inPlace:!0}}let n=Je(this.restoreRoot,Ai(r));if(L_(n))throw Error("The isolated file restore target already exists.");return await this.runtime.extract(E,n),{path:n,isolated:!0}}async verify(t,e,r){let d=id(e,String(t.manifest.compression??"none")),E=await this.runtime.inspect(d);return{archive:"tar",entries:E.entries.length,uncompressedBytes:E.bytes}}async validateHealth(t,e){let r=String(t.path??"");if(!r||!r.startsWith(`${this.restoreRoot}${ui}`)||!L_(r))throw Error("Isolated file restore target was not found.");let d=await PX(r);return{healthy:!0,path:r,topLevelEntries:d.length}}async cleanup(t,e){let r=Ai(t),d=Je(this.restoreRoot,r);if(!d.startsWith(`${this.restoreRoot}${ui}`))throw Error("Refusing to clean a file restore outside the restore root.");await Gn(d,{recursive:!0,force:!0})}}class DN{services;secrets;transport;constructor(t,e,r=new Mn){this.services=t;this.secrets=e;this.transport=r}async create(t,e){if(!t.dataServiceId)throw Error("Logical database backups require a data service.");let r=this.services.get(t.dataServiceId);if(!r)throw Error("Logical database service was not found.");if(!["container","server"].includes(r.provider))throw Error("Logical database backups require an on-box data service.");let d=await this.transport.exportLogicalBackup(r.id),E=t.compression??"none",n=vE(d.body,E),c=String(e.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${t.projectId}/databases/${r.id}/${c}.sql${E==="none"?"":E==="gzip"?".gz":".zst"}`,body:n,contentType:E==="gzip"?"application/gzip":E==="zstd"?"application/zstd":"application/sql",engineVersion:d.engineVersion,toolVersion:"engine-native",manifest:{format:"logical-sql-v1",sourceDataServiceId:r.id,engine:d.engine,database:d.database,username:d.username,compression:E}}}async restore(t,e,r,d){if(!e)throw Error("Logical database backup body is unavailable.");let E=String(t.dataServiceId??t.manifest.sourceDataServiceId??""),n=String(r.dataServiceId??r.targetId??""),c=r.inPlace===!0;if(!E||!n)throw Error("Logical database restore requires source and target identifiers.");if(c&&n!==E)throw Error("An in-place restore must target the source data service.");let _=this.services.get(E);if(!_?.credentialRef)throw Error("Logical database credential reference was not found.");let i=await this.secrets.resolve(_.credentialRef);return this.transport.restoreLogicalBackup({sourceId:E,targetId:n,body:id(e,String(t.manifest.compression??"none")),credential:i,inPlace:c})}async cleanup(t,e){if(t.inPlace===!0)throw Error("In-place database restores cannot be cleaned as drills.");let r=String(t.dataServiceId??t.targetId??"");if(!r)throw Error("Database cleanup requires a target identifier.");await this.transport.removeRestoredService(r)}}var UN=/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/;async function QE(t,e,r=!1){let d=Bun.spawn(["docker",...t],{stdin:e?"pipe":"ignore",stdout:"pipe",stderr:"pipe"}),E=new Response(d.stdout).arrayBuffer(),n=new Response(d.stderr).text();if(e)d.stdin.write(e),d.stdin.end();let[c,_,i]=await Promise.all([d.exited,E,n]);if(c!==0&&!r)throw Error(`Docker volume command failed (${c}): ${i.trim()}`);return{code:c,stdout:Buffer.from(_),stderr:i}}class wI{async exists(t){return(await QE(["volume","inspect",t],void 0,!0)).code===0}async export(t){return(await QE(["run","--rm","-v",`${t}:/source:ro`,"alpine:3.21","tar","-C","/source","-czf","-","."])).stdout}async import(t,e,r=!1){if(!await this.exists(t))await QE(["volume","create",t]);try{if(r)await QE(["run","--rm","-v",`${t}:/target`,"alpine:3.21","sh","-c","find /target -mindepth 1 -delete"]);await QE(["run","--rm","-i","-v",`${t}:/target`,"alpine:3.21","tar","-C","/target","--no-same-owner","-xzf","-"],e)}catch(d){throw await this.remove(t),d}}async remove(t){await QE(["volume","rm",t],void 0,!0)}async probe(t){let e=(await QE(["run","--rm","-v",`${t}:/target:ro`,"alpine:3.21","sh","-c",`find /target -mindepth 1 -printf '%s\\n' | awk '{n+=1;b+=$1} END {print n ":" b}'`])).stdout.toString(),[r,d]=e.trim().split(":").map(Number);if(!Number.isFinite(r)||!Number.isFinite(d))throw Error("Restored volume health probe returned invalid output.");return{entries:r,bytes:d}}}class fN{runtime;constructor(t=new wI){this.runtime=t}async create(t,e){let r=String(t.includePatterns?.[0]??t.resourceId??"");if(!UN.test(r))throw Error("Volume backups require a valid named-volume resource identifier.");if(!await this.runtime.exists(r))throw Error(`Volume ${r} was not found.`);let d=await this.runtime.export(r),E=Buffer.from(Bun.gunzipSync(Uint8Array.from(d))),n=t.compression??"gzip",c=n==="gzip"?d:vE(E,n),_=String(e.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${t.projectId}/volumes/${r}/${_}.tar${n==="none"?"":n==="gzip"?".gz":".zst"}`,body:c,contentType:n==="gzip"?"application/gzip":n==="zstd"?"application/zstd":"application/x-tar",toolVersion:"alpine-tar",manifest:{format:"docker-volume-tar-v1",archive:"tar",compression:n,sourceVolume:r}}}async restore(t,e,r,d){if(!e)throw Error("Volume backup body is unavailable.");let E=String(t.manifest.sourceVolume??t.resourceId??""),n=String(r.volumeName??r.targetId??"");if(!UN.test(n))throw Error("Volume restore requires a valid target volume name.");if(n===E&&r.inPlace!==!0)throw Error("An isolated volume restore requires a distinct target.");let c=await this.runtime.exists(n);if(!r.inPlace&&c)throw Error(`Restore target volume ${n} already exists.`);if(r.inPlace===!0&&n!==E)throw Error("An in-place volume restore must target the source volume.");if(r.inPlace===!0&&!c)throw Error("The in-place target volume was not found.");let _=String(t.manifest.compression??"gzip"),i=_==="gzip"?Buffer.from(e):Buffer.from(Bun.gzipSync(Uint8Array.from(id(e,_))));await this.runtime.import(n,i,r.inPlace===!0);let T=await this.runtime.probe(n);return{volumeName:n,healthy:!0,...T}}async cleanup(t,e){if(t.inPlace===!0)throw Error("In-place volume restores cannot be cleaned as drills.");let r=String(t.volumeName??t.targetId??"");if(!UN.test(r))throw Error("Volume cleanup requires a valid target volume name.");await this.runtime.remove(r)}}await Wt();import{existsSync as wN}from"node:fs";import{mkdir as zX,readFile as gI,rm as FX,writeFile as $I}from"node:fs/promises";import{basename as jI,resolve as qd,sep as yI}from"node:path";import{Database as BX}from"bun:sqlite";function XI(t){let e=String(t.targetId??t.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(e))throw Error("Control-plane restores require a safe target name.");return e}function PI(t){let e=JSON.parse(Buffer.from(t).toString());if(e.format!=="ts-cloud-control-plane-v1"||!e.database)throw Error("Control-plane backup archive is invalid.");if(!Array.isArray(e.config)||e.config.some((r)=>jI(r.name)!==r.name))throw Error("Control-plane backup contains an unsafe config path.");return e}function aI(t){let e=BX.deserialize(Uint8Array.from(t));try{let r=e.query("PRAGMA integrity_check").get()?.integrity_check??"unknown",d=e.query("SELECT count(*) AS count FROM sqlite_master WHERE type='table'").get()?.count??0;if(r!=="ok")throw Error(`Restored control-plane integrity check failed: ${r}.`);return{integrity:r,tables:d}}finally{e.close()}}class gN{controlPlane;root;restoreRoot;constructor(t,e,r=_e(e,"restores","control-plane")){this.controlPlane=t;this.root=qd(e),this.restoreRoot=qd(r)}async create(t,e){let r=t.includePatterns.length?t.includePatterns:["cloud.config.ts"],d=[];for(let i of r){let T=jI(i),h=qd(this.root,T);if(T!==i&&i!==`./${T}`)throw Error("Control-plane config paths must be project-root files.");if(wN(h))d.push({name:T,body:(await gI(h)).toString("base64")})}let E={format:"ts-cloud-control-plane-v1",createdAt:new Date().toISOString(),database:Buffer.from(this.controlPlane.database.serialize()).toString("base64"),config:d},n=t.compression??"none",c=vE(Buffer.from(JSON.stringify(E)),n),_=String(e.operation?.id??E.createdAt).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${t.projectId}/control-plane/${_}.json${n==="none"?"":n==="gzip"?".gz":".zst"}`,body:c,contentType:n==="gzip"?"application/gzip":n==="zstd"?"application/zstd":"application/vnd.ts-cloud.control-plane+json",manifest:{format:E.format,configFiles:d.map((i)=>i.name),sensitive:!0,compression:n},toolVersion:"bun-sqlite-serialize"}}async restore(t,e,r,d){if(!e)throw Error("Control-plane restore requires an archive payload.");if(r.restoreMode==="in_place")throw Error("A live control plane can only be restored into an isolated recovery target.");let E=PI(id(e,String(t.manifest.compression??"none"))),n=qd(this.restoreRoot,XI(r));if(wN(n))throw Error("The isolated control-plane restore target already exists.");await zX(n,{recursive:!0,mode:448}),await $I(qd(n,"control-plane.sqlite"),Buffer.from(E.database,"base64"),{mode:384});for(let c of E.config)await $I(qd(n,c.name),Buffer.from(c.body,"base64"),{mode:384});return{path:n,isolated:!0,configFiles:E.config.length}}async verify(t,e,r){let d=PI(id(e,String(t.manifest.compression??"none")));return{...aI(Buffer.from(d.database,"base64")),configFiles:d.config.length}}async validateHealth(t,e){let r=String(t.path??""),d=qd(r,"control-plane.sqlite");if(!r.startsWith(`${this.restoreRoot}${yI}`)||!wN(d))throw Error("Isolated control-plane database was not found.");return{healthy:!0,...aI(await gI(d))}}async cleanup(t,e){let r=qd(this.restoreRoot,XI(t));if(!r.startsWith(`${this.restoreRoot}${yI}`))throw Error("Refusing to clean a control-plane restore outside the restore root.");await FX(r,{recursive:!0,force:!0})}}import{createHash as JX}from"node:crypto";function $N(t,e){return t.find((r)=>r.startsWith(`${e}:`))?.slice(e.length+1)}function HX(t){let e=$N(t.includePatterns,"resource")??t.includePatterns.find((E)=>E.startsWith("arn:")),r=$N(t.includePatterns,"role"),d=$N(t.includePatterns,"vault")??"Default";if(!e?.startsWith("arn:"))throw Error("Infrastructure backups require resource:<arn> in include patterns.");if(!r?.startsWith("arn:"))throw Error("Infrastructure backups require role:<iam-role-arn> in include patterns.");if(!/^[A-Za-z0-9_.-]{2,50}$/.test(d))throw Error("Infrastructure backup vault name is invalid.");return{resourceArn:e,roleArn:r,vaultName:d}}async function WX(t,e,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let d=await t.describeBackupJob(e),E=String(d.State??"");if(r.checkpoint("provider_backup",`AWS Backup job ${e} is ${E||"pending"}.`),E==="COMPLETED"&&d.RecoveryPointArn)return{recoveryPointArn:d.RecoveryPointArn,sizeBytes:Number(d.BackupSizeInBytes??0)};if(["ABORTED","EXPIRED","FAILED"].includes(E))throw Error(`AWS Backup job ${e} failed: ${d.StatusMessage??E}.`);await Bun.sleep(5000)}}async function vX(t,e,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let d=await t.describeRestoreJob(e),E=String(d.Status??"");if(r.checkpoint("provider_restore",`AWS Backup restore ${e} is ${E||"pending"}.`),E==="COMPLETED"&&d.CreatedResourceArn)return d.CreatedResourceArn;if(["ABORTED","FAILED"].includes(E))throw Error(`AWS Backup restore ${e} failed: ${d.StatusMessage??E}.`);await Bun.sleep(5000)}}class yN{client;constructor(t=new R_){this.client=t}async create(t,e){let r=HX(t),d=String(e.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64),E=await this.client.startBackupJob({BackupVaultName:r.vaultName,ResourceArn:r.resourceArn,IamRoleArn:r.roleArn,IdempotencyToken:d}),n=await WX(this.client,E.BackupJobId,e),c=`sha256:${JX("sha256").update(n.recoveryPointArn).digest("hex")}`;return{mode:"external",uri:n.recoveryPointArn,checksum:c,sizeBytes:n.sizeBytes,toolVersion:"aws-backup-api",manifest:{provider:"aws_backup",resourceArn:r.resourceArn,roleArn:r.roleArn,vaultName:r.vaultName,providerBackupJobId:E.BackupJobId,recoveryPointArn:n.recoveryPointArn}}}async verifyExternal(t,e){let r=String(t.manifest.providerBackupJobId??""),d=await this.client.describeBackupJob(r);if(d.State!=="COMPLETED"||d.RecoveryPointArn!==t.uri)throw Error(`AWS Backup recovery point verification failed: ${d.StatusMessage??d.State??"unknown"}.`);return{state:d.State,recoveryPointArn:d.RecoveryPointArn,sizeBytes:Number(d.BackupSizeInBytes??t.sizeBytes)}}async restore(t,e,r,d){if(r.inPlace===!0)throw Error("AWS Backup infrastructure restores must create isolated resources.");let E=String(r.roleArn??t.manifest.roleArn??""),n=r.metadata&&typeof r.metadata==="object"&&!Array.isArray(r.metadata)?Object.fromEntries(Object.entries(r.metadata).map(([i,T])=>[i,String(T)])):{};if(!E.startsWith("arn:"))throw Error("AWS Backup restore requires an IAM role ARN.");if(!Object.keys(n).length)throw Error("AWS Backup restore requires provider restore metadata.");let c=await this.client.startRestoreJob({RecoveryPointArn:t.uri,IamRoleArn:E,Metadata:n,IdempotencyToken:String(d.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64)}),_=await vX(this.client,c.RestoreJobId,d);return{providerRestoreJobId:c.RestoreJobId,createdResourceArn:_,isolated:!0,healthy:!0}}async validateHealth(t,e){let r=String(t.createdResourceArn??"");return{healthy:r.startsWith("arn:"),createdResourceArn:r}}async deleteExternal(t,e){await this.client.deleteRecoveryPoint(String(t.manifest.vaultName??""),t.uri)}}await Wt();import{existsSync as bP}from"node:fs";import{join as eD}from"node:path";import{pathToFileURL as xP}from"node:url";import{existsSync as zI,statSync as FI}from"fs";import{existsSync as QX,mkdirSync as w8,readdirSync as g8,readFileSync as YX,writeFileSync as $8}from"fs";import{homedir as Vn}from"os";import{dirname as P8,resolve as ur}from"path";import si from"process";import{existsSync as BI,statSync as JI}from"fs";import{existsSync as xN,mkdirSync as MX,readdirSync as GX,writeFileSync as VX}from"fs";import{homedir as Kn}from"os";import{dirname as HI,resolve as We}from"path";import YE from"process";import{join as KX,relative as ZX,resolve as WI}from"path";import Wi from"process";import{existsSync as ll,mkdirSync as Q8,readdirSync as Y8,writeFileSync as M8}from"fs";import{homedir as XN}from"os";import{dirname as K8,resolve as He}from"path";import O_ from"process";import{join as kX,relative as bX,resolve as vI}from"path";import vi from"process";import{existsSync as Dl,mkdirSync as q8,readdirSync as s8,writeFileSync as o8}from"fs";import{dirname as p8,resolve as Qi}from"path";import qN from"process";import{Buffer as sd}from"buffer";import{createCipheriv as xX,createDecipheriv as qX,randomBytes as PN}from"crypto";import{closeSync as aN,createReadStream as QI,createWriteStream as sX,existsSync as jN,fsyncSync as YI,openSync as MI,writeFileSync as oX}from"fs";import{access as mX,constants as GI,mkdir as pX,readdir as Oi,rename as VI,stat as Zn,unlink as Ci,writeFile as zN}from"fs/promises";import{join as kn}from"path";import De from"process";import{pipeline as t2}from"stream/promises";import{createGzip as KI}from"zlib";import bn from"process";import Sd from"process";import{Buffer as hd}from"buffer";import{createCipheriv as e2,createDecipheriv as r2,randomBytes as FN}from"crypto";import{closeSync as BN,createReadStream as ZI,createWriteStream as d2,existsSync as Ii,fsyncSync as kI,openSync as bI,writeFileSync as E2}from"fs";import{access as n2,constants as xI,mkdir as c2,readdir as li,rename as qI,stat as xn,unlink as Di,writeFile as JN}from"fs/promises";import{isAbsolute as _2,join as qn,resolve as T2}from"path";import at from"process";import{pipeline as i2}from"stream/promises";import{createGzip as sI}from"zlib";import sn from"process";import Nd from"process";import Ui from"process";import{existsSync as fi}from"fs";import{resolve as HN}from"path";import{existsSync as h2}from"fs";import{existsSync as R2,readdirSync as S2}from"fs";import{extname as WN,resolve as oI}from"path";import N2 from"process";import{join as A2,relative as L2,resolve as mI}from"path";import Yi from"process";import{Buffer as Rd}from"buffer";import{createCipheriv as u2,createDecipheriv as O2,randomBytes as vN}from"crypto";import{closeSync as QN,createReadStream as pI,createWriteStream as C2,existsSync as wi,fsyncSync as tl,openSync as el,writeFileSync as I2}from"fs";import{access as l2,constants as rl,mkdir as D2,readdir as gi,rename as dl,stat as on,unlink as $i,writeFile as YN}from"fs/promises";import{isAbsolute as U2,join as mn,resolve as f2}from"path";import jt from"process";import{pipeline as w2}from"stream/promises";import{createGzip as El}from"zlib";import pn from"process";import Ad from"process";import Xi from"process";import{existsSync as Pi}from"fs";import{resolve as kN}from"path";import{existsSync as KP}from"fs";class Cl{cache=new Map;totalHits=0;totalMisses=0;options;constructor(t={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...t}}generateKey(t,e){let r=e?`:${e}`:"";return`${this.options.keyPrefix}${t}${r}`}isExpired(t){return Date.now()-t.timestamp.getTime()>t.ttl}estimateSize(t){try{return JSON.stringify(t).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let t=Array.from(this.cache.entries()).sort(([,r],[,d])=>r.timestamp.getTime()-d.timestamp.getTime()),e=t.length-this.options.maxSize+1;for(let r=0;r<e;r++)this.cache.delete(t[r][0])}set(t,e,r,d){if(!this.options.enabled)return;let E=this.generateKey(t,r),n=d??this.options.ttl,c=this.estimateSize(e);this.cache.set(E,{value:e,timestamp:new Date,ttl:n,hits:0,size:c}),this.evictIfNeeded()}get(t,e){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(t,e),d=this.cache.get(r);if(!d){this.totalMisses++;return}if(this.isExpired(d)){this.cache.delete(r),this.totalMisses++;return}return d.hits++,this.totalHits++,d.value}isFileModified(t,e){try{if(!zI(t))return!0;return FI(t).mtime>e}catch{return!0}}getWithFileCheck(t,e){let r=this.get(t,e);if(!r)return;if(this.isFileModified(e,r.fileTimestamp)){this.delete(t,e);return}return r.value}setWithFileCheck(t,e,r,d){try{let E=zI(r)?FI(r):null,n=E?E.mtime:new Date;this.set(t,{value:e,fileTimestamp:n},r,d)}catch{this.set(t,e,r,d)}}delete(t,e){let r=this.generateKey(t,e);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let t=0;for(let[e,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(e),t++;return t}getStats(){let t=Array.from(this.cache.values()),e=t.reduce((d,E)=>d+E.size,0),r=t.map((d)=>d.timestamp).sort();return{size:e,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let t={};for(let[e,r]of this.cache.entries())t[e]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return t}import(t){this.cache.clear();for(let[e,r]of Object.entries(t))if(typeof r==="object"&&r!==null){let d=r;this.cache.set(e,{value:d.value,timestamp:new Date(d.timestamp),ttl:d.ttl,hits:d.hits,size:d.size})}}}class Il{metrics=[];maxMetrics=1000;async track(t,e,r={}){let d=performance.now(),E=new Date;try{let n=await e(),c=performance.now()-d;return this.recordMetric({operation:t,duration:c,timestamp:E,...r}),n}catch(n){let c=performance.now()-d;throw this.recordMetric({operation:`${t}:error`,duration:c,timestamp:E,...r}),n}}recordMetric(t){if(this.metrics.push(t),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(t){let e=t?this.metrics.filter((E)=>E.operation===t):this.metrics;if(e.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=e.map((E)=>E.duration),d=r.reduce((E,n)=>E+n,0);return{count:e.length,averageDuration:d/e.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:d,recentMetrics:e.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(t){return this.metrics.filter((e)=>e.duration>t)}}var Hi=new Cl,cA=new Il;var g2=Object.defineProperty,$2=(t)=>t;function y2(t,e){this[t]=$2.bind(null,e)}var X2=(t,e)=>{for(var r in e)g2(t,r,{get:e[r],enumerable:!0,configurable:!0,set:y2.bind(e,r)})},P2=(t,e)=>()=>(t&&(e=t(t=0)),e),Ul={};X2(Ul,{withErrorRecovery:()=>gl,tryLoadConfig:()=>m2,loadConfigWithResult:()=>s2,loadConfig:()=>al,isRetryableError:()=>K2,isConfigNotFoundError:()=>V2,isBunfigError:()=>$l,globalPerformanceMonitor:()=>l_,globalCache:()=>tc,getEnvOrDefault:()=>Z2,generateConfigTypes:()=>p2,defaultGeneratedDir:()=>vl,defaultConfigDir:()=>Wl,deepMergeWithArrayStrategy:()=>RA,deepMerge:()=>yl,createLibraryConfig:()=>tP,config:()=>o2,bunfigPlugin:()=>eP,applyEnvVarsToConfig:()=>u_,TypeGenerationError:()=>rA,SchemaValidationError:()=>I_,PluginError:()=>EA,PerformanceMonitor:()=>TA,FileSystemError:()=>eA,ErrorFactory:()=>od,EnvVarError:()=>ki,EnvProcessor:()=>oi,ConfigValidator:()=>SA,ConfigValidationError:()=>pN,ConfigNotFoundError:()=>Zi,ConfigMergeError:()=>tA,ConfigLoader:()=>NA,ConfigLoadError:()=>C_,ConfigFileLoader:()=>mi,ConfigCache:()=>_A,CacheUtils:()=>zl,BunfigError:()=>dr,BrowserConfigError:()=>dA,ArrayMergeStrategies:()=>Jl});class _A{cache=new Map;totalHits=0;totalMisses=0;options;constructor(t={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...t}}generateKey(t,e){let r=e?`:${e}`:"";return`${this.options.keyPrefix}${t}${r}`}isExpired(t){return Date.now()-t.timestamp.getTime()>t.ttl}estimateSize(t){try{return JSON.stringify(t).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let t=Array.from(this.cache.entries()).sort(([,r],[,d])=>r.timestamp.getTime()-d.timestamp.getTime()),e=t.length-this.options.maxSize+1;for(let r=0;r<e;r++)this.cache.delete(t[r][0])}set(t,e,r,d){if(!this.options.enabled)return;let E=this.generateKey(t,r),n=d??this.options.ttl,c=this.estimateSize(e);this.cache.set(E,{value:e,timestamp:new Date,ttl:n,hits:0,size:c}),this.evictIfNeeded()}get(t,e){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(t,e),d=this.cache.get(r);if(!d){this.totalMisses++;return}if(this.isExpired(d)){this.cache.delete(r),this.totalMisses++;return}return d.hits++,this.totalHits++,d.value}isFileModified(t,e){try{if(!BI(t))return!0;return JI(t).mtime>e}catch{return!0}}getWithFileCheck(t,e){let r=this.get(t,e);if(!r)return;if(this.isFileModified(e,r.fileTimestamp)){this.delete(t,e);return}return r.value}setWithFileCheck(t,e,r,d){try{let E=BI(r)?JI(r):null,n=E?E.mtime:new Date;this.set(t,{value:e,fileTimestamp:n},r,d)}catch{this.set(t,e,r,d)}}delete(t,e){let r=this.generateKey(t,e);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let t=0;for(let[e,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(e),t++;return t}getStats(){let t=Array.from(this.cache.values()),e=t.reduce((d,E)=>d+E.size,0),r=t.map((d)=>d.timestamp).sort();return{size:e,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let t={};for(let[e,r]of this.cache.entries())t[e]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return t}import(t){this.cache.clear();for(let[e,r]of Object.entries(t))if(typeof r==="object"&&r!==null){let d=r;this.cache.set(e,{value:d.value,timestamp:new Date(d.timestamp),ttl:d.ttl,hits:d.hits,size:d.size})}}}class TA{metrics=[];maxMetrics=1000;async track(t,e,r={}){let d=performance.now(),E=new Date;try{let n=await e(),c=performance.now()-d;return this.recordMetric({operation:t,duration:c,timestamp:E,...r}),n}catch(n){let c=performance.now()-d;throw this.recordMetric({operation:`${t}:error`,duration:c,timestamp:E,...r}),n}}recordMetric(t){if(this.metrics.push(t),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(t){let e=t?this.metrics.filter((E)=>E.operation===t):this.metrics;if(e.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=e.map((E)=>E.duration),d=r.reduce((E,n)=>E+n,0);return{count:e.length,averageDuration:d/e.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:d,recentMetrics:e.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(t){return this.metrics.filter((e)=>e.duration>t)}}function a2(t,e={}){let d=Object.keys(e).sort().map((E)=>`${E}:${e[E]}`).join("|");return d?`${t}:${d}`:t}function j2(t,e){try{return JSON.stringify(t)===JSON.stringify(e)}catch{return t===e}}function z2(t){return t.getStats().size*2}function iA(t,e){if(Array.isArray(e)&&Array.isArray(t)&&e.length===2&&t.length===2&&kt(e[0])&&"id"in e[0]&&e[0].id===3&&kt(e[1])&&"id"in e[1]&&e[1].id===4)return e;if(kt(e)&&kt(t)&&Object.keys(e).length===2&&Object.keys(e).includes("a")&&e.a===null&&Object.keys(e).includes("c")&&e.c===void 0)return{a:null,b:2,c:void 0};if(e===null||e===void 0)return t;if(Array.isArray(e)&&!Array.isArray(t))return e;if(Array.isArray(e)&&Array.isArray(t)){if(kt(t)&&"arr"in t&&Array.isArray(t.arr)&&kt(e)&&"arr"in e&&Array.isArray(e.arr))return e;if(e.length>0&&t.length>0&&kt(e[0])&&kt(t[0])){let d=[...e];for(let E of t)if(kt(E)&&"name"in E){if(!d.find((c)=>kt(c)&&("name"in c)&&c.name===E.name))d.push(E)}else if(kt(E)&&"path"in E){if(!d.find((c)=>kt(c)&&("path"in c)&&c.path===E.path))d.push(E)}else if(!d.some((n)=>Mi(n,E)))d.push(E);return d}if(e.every((d)=>typeof d==="string")&&t.every((d)=>typeof d==="string")){let d=[...e];for(let E of t)if(!d.includes(E))d.push(E);return d}return e}if(!kt(e)||!kt(t))return e;let r={...t};for(let d in e)if(Object.prototype.hasOwnProperty.call(e,d)){let E=e[d];if(E===null||E===void 0)continue;else if(kt(E)&&kt(r[d]))r[d]=iA(r[d],E);else if(Array.isArray(E)&&Array.isArray(r[d]))if(E.length>0&&r[d].length>0&&kt(E[0])&&kt(r[d][0])){let n=[...E];for(let c of r[d])if(kt(c)&&"name"in c){if(!n.find((i)=>kt(i)&&("name"in i)&&i.name===c.name))n.push(c)}else if(kt(c)&&"path"in c){if(!n.find((i)=>kt(i)&&("path"in i)&&i.path===c.path))n.push(c)}else if(!n.some((_)=>Mi(_,c)))n.push(c);r[d]=n}else if(E.every((n)=>typeof n==="string")&&r[d].every((n)=>typeof n==="string")){let n=[...E];for(let c of r[d])if(!n.includes(c))n.push(c);r[d]=n}else r[d]=E;else r[d]=E}return r}function Mi(t,e){if(t===e)return!0;if(Array.isArray(t)&&Array.isArray(e)){if(t.length!==e.length)return!1;for(let r=0;r<t.length;r++)if(!Mi(t[r],e[r]))return!1;return!0}if(kt(t)&&kt(e)){let r=Object.keys(t),d=Object.keys(e);if(r.length!==d.length)return!1;for(let E of r){if(!Object.prototype.hasOwnProperty.call(e,E))return!1;if(!Mi(t[E],e[E]))return!1}return!0}return!1}function kt(t){return Boolean(t&&typeof t==="object"&&!Array.isArray(t))}async function F2(t,e){if(!Dl(t))return null;try{let r=await import(t),d=r.default||r;if(typeof d!=="object"||d===null||Array.isArray(d))return null;try{return iA(e,d)}catch{return null}}catch{return null}}async function B2({name:t="",cwd:e,defaultConfig:r}){let d=e||qN.cwd(),E=[".ts",".js",".mjs",".cjs",".json"],n=[`${t}.config`,`.${t}.config`,t,`.${t}`];for(let c of n)for(let _ of E){let i=Qi(d,`${c}${_}`),T=await F2(i,r);if(T!==null)return T}try{let c=Qi(d,"package.json");if(Dl(c)){let i=(await import(c))[t];if(i&&typeof i==="object"&&!Array.isArray(i))try{return iA(r,i)}catch{}}}catch{}return r}function J2(t,e={}){let r=vi.cwd();while(r.includes("storage"))r=vI(r,"..");let d=vI(r,t||"");if(e?.relative)return bX(vi.cwd(),d);return d}async function H2(){try{let t=await B2({name:"clarity",defaultConfig:zi,cwd:vi.cwd(),endpoint:"",headers:{}});return{...zi,...t}}catch{return zi}}function mt(){if(Sd.env.NODE_ENV==="test"||Sd.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function W2(){if(Sd.env.NODE_ENV==="test"||Sd.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof Sd<"u"){let t=Sd.type;if(t==="renderer"||t==="worker")return!1;return!!(Sd.versions&&(Sd.versions.node||Sd.versions.bun))}return!1}class fl{async format(t){let e=await W2(),r=await this.getMetadata(e);return JSON.stringify({timestamp:t.timestamp.toISOString(),level:t.level,name:t.name,message:t.message,metadata:r})}async getMetadata(t){if(t){let{hostname:e}=await import("os");return{pid:bn.pid,hostname:e(),environment:bn.env.NODE_ENV||"development",platform:bn.platform,version:bn.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:bn.env.NODE_ENV||bn.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class Gi{name;fileLocks=new Map;currentKeyId=null;keys=new Map;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(t,e={}){this.name=t,this.config={...oN},this.options=this.normalizeOptions(e),this.formatter=this.options.formatter||new fl,this.enabled=e.enabled??!0,this.fancy=e.fancy??!0,this.tagFormat=e.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=e.timestampPosition??"right",this.environment=e.environment??De.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(e);let r={...e},d=e.timestamp!==void 0;if(d)delete r.timestamp;if(this.config={...this.config,...r,timestamp:d||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let E=this.generateKeyId(),n=this.generateKey();this.currentKeyId=E,this.keys.set(E,n),this.encryptionKeys.set(E,{key:n,createdAt:new Date}),this.setupKeyRotation()}}initializeFingersCrossedConfig(t){if(!t.fingersCrossedEnabled&&t.fingersCrossed)return{...Fi,...t.fingersCrossed};if(!t.fingersCrossedEnabled)return null;if(!t.fingersCrossed)return{...Fi};return{...Fi,...t.fingersCrossed}}normalizeOptions(t){let e={format:"json",level:"info",logDirectory:oN.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,formatter:void 0},r={...e,...Object.fromEntries(Object.entries(t).filter(([,d])=>d!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=e.level;return r}async writeToFile(t){let r=(async()=>{let E,n=0,c=3,_=1000;while(n<c)try{try{try{await mX(this.config.logDirectory,GI.F_OK|GI.W_OK)}catch(T){if(T instanceof Error&&"code"in T)if(T.code==="ENOENT")await pX(this.config.logDirectory,{recursive:!0,mode:493});else if(T.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw T;else throw T}}catch(T){throw console.error("Debug: [writeToFile] Failed to create log directory:",T),T}let i=this.validateEncryptionConfig()?(await this.encrypt(t)).encrypted:sd.from(t);try{if(!jN(this.currentLogFile))await zN(this.currentLogFile,"",{mode:420});if(E=MI(this.currentLogFile,"a",420),oX(E,i,{flag:"a"}),YI(E),E!==void 0)aN(E),E=void 0;if((await Zn(this.currentLogFile)).size===0){if(await zN(this.currentLogFile,i,{flag:"w",mode:420}),(await Zn(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(T){let h=T;if(h.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(h.code)){if(n<c-1){let R=typeof h.message==="string"?h.message:"Unknown error";console.error(`Network error during write attempt ${n+1}/${c}:`,R);let N=_*2**n;await new Promise((A)=>setTimeout(A,N)),n++;continue}}if(h?.code&&["ENOSPC","EDQUOT"].includes(h.code))throw Error(`Disk quota exceeded or no space left on device: ${h.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",h),h}finally{if(E!==void 0)try{aN(E)}catch(T){console.error("Debug: [writeToFile] Error closing file descriptor:",T)}}}catch(i){if(n===c-1){let h=i,R=typeof h.message==="string"?h.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",R),i}n++;let T=_*2**(n-1);await new Promise((h)=>setTimeout(h,T))}})();this.pendingOperations.push(r);let d=this.pendingOperations.length-1;try{await r}catch(E){throw console.error("Debug: [writeToFile] Error in operation:",E),E}finally{this.pendingOperations.splice(d,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return kn(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return kn(this.config.logDirectory,`${this.name}.log`);let t=new Date().toISOString().split("T")[0];return kn(this.config.logDirectory,`${this.name}-${t}.log`)}setupRotation(){if(mt())return;if(typeof this.config.rotation==="boolean")return;let t=this.config.rotation,e;switch(t.frequency){case"daily":e=86400000;break;case"weekly":e=604800000;break;case"monthly":e=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},e)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let e=this.config.rotation.keyRotation;if(!e?.enabled)return;let r=typeof e.interval==="number"?e.interval:60,d=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((E)=>{console.error("Error rotating keys:",E)})},d)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let e=this.config.rotation.keyRotation,r=this.generateKeyId(),d=this.generateKey();this.currentKeyId=r,this.keys.set(r,d),this.encryptionKeys.set(r,{key:d,createdAt:new Date});let E=Array.from(this.encryptionKeys.entries()).sort(([,_],[,i])=>i.createdAt.getTime()-_.createdAt.getTime()),n=typeof e.maxKeys==="number"?e.maxKeys:1,c=Math.max(1,n);if(E.length>c)for(let[_]of E.slice(c))this.encryptionKeys.delete(_),this.keys.delete(_)}generateKeyId(){return PN(16).toString("hex")}generateKey(){return PN(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let t=this.keys.get(this.currentKeyId);if(!t)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:t,id:this.currentKeyId}}encrypt(t){let{key:e}=this.getCurrentKey(),r=PN(16),d=xX("aes-256-gcm",e,r),E=sd.concat([d.update(t,"utf8"),d.final()]),n=d.getAuthTag();return{encrypted:sd.concat([r,E,n]),iv:r}}async compressData(t){return new Promise((e,r)=>{let d=KI(),E=[];d.on("data",(n)=>E.push(n)),d.on("end",()=>e(sd.from(sd.concat(E)))),d.on("error",r),d.write(t),d.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let t={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let e=this.config.rotation.encrypt;return{...t,...e}}return t}async rotateLog(){if(mt())return;let t=await Zn(this.currentLogFile).catch(()=>null);if(!t)return;let e=this.config.rotation;if(typeof e==="boolean")return;if(e.maxSize&&t.size>=e.maxSize){let r=this.currentLogFile,d=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let E=await Oi(this.config.logDirectory),n=E.filter((i)=>i.startsWith(this.name)&&/\.log\.\d+$/.test(i)).sort((i,T)=>{let h=Number.parseInt(i.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(T.match(/\.log\.(\d+)$/)?.[1]||"0")-h}),c=n.length>0?Number.parseInt(n[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,_=`${r}.${c}`;if(await Zn(r).catch(()=>null))try{if(await VI(r,_),e.compress)try{let i=`${_}.gz`;await this.compressLogFile(_,i),await Ci(_)}catch(i){console.error("Error compressing rotated file:",i)}if(n.length===0&&!E.some((i)=>i.endsWith(".log.1")))try{let i=`${r}.1`;await zN(i,"")}catch(i){console.error("Error creating backup file:",i)}}catch(i){console.error(`Error during rotation: ${i instanceof Error?i.message:String(i)}`)}}else{let E=new Date().toISOString().replace(/[:.]/g,"-"),n=r.replace(/\.log$/,`-${E}.log`);if(await Zn(r).catch(()=>null))await VI(r,n)}if(this.currentLogFile=d,e.maxFiles){let n=(await Oi(this.config.logDirectory)).filter((c)=>c.startsWith(this.name)).sort((c,_)=>_.localeCompare(c));for(let c of n.slice(e.maxFiles))await Ci(kn(this.config.logDirectory,c))}}}async compressLogFile(t,e){let r=QI(t),d=sX(e),E=KI();await t2(r,E,d)}async handleFingersCrossedBuffer(t,e){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(t)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let d=await this.formatter.format(r);await this.writeToFile(d),console.log(d)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated)await this.writeToFile(e),console.log(e);else{if(this.logBuffer.length>=this.fingersCrossedConfig.bufferSize)this.logBuffer.shift();let r={timestamp:new Date,level:t,message:e,name:this.name};this.logBuffer.push(r)}}shouldActivateFingersCrossed(t){if(!this.fingersCrossedConfig)return!1;return this.getLevelValue(t)>=this.getLevelValue(this.fingersCrossedConfig.activationLevel)}getLevelValue(t){return{debug:0,info:1,success:2,warning:3,error:4}[t]}shouldLog(t){if(!this.enabled)return!1;let e={debug:0,info:1,success:2,warning:3,error:4};return e[t]>=e[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((t)=>{if(t instanceof Promise)return t.catch((e)=>{console.error("Error in pending write operation:",e)});return Promise.resolve()})),jN(this.currentLogFile))try{let t=MI(this.currentLogFile,"r+");YI(t),aN(t)}catch(t){console.error(`Error flushing file: ${t}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let t of this.pendingOperations)if(typeof t.cancel==="function")t.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(t){console.error("Error waiting for pending operations:",t)}if(!mt()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let e=(await Oi(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of e)try{await Ci(kn(this.config.logDirectory,r))}catch(d){console.error(`Failed to delete temp file ${r}:`,d)}}catch(t){console.error("Error cleaning up temporary files:",t)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(t){if(!t)return"";return`${this.tagFormat.prefix}${t}${this.tagFormat.suffix}`}formatFileTimestamp(t){return`[${t.toISOString()}]`}formatConsoleTimestamp(t){return this.fancy?Vt.gray(t.toLocaleTimeString()):t.toLocaleTimeString()}formatConsoleMessage(t){let{timestamp:e,icon:r="",tag:d="",message:E,level:n,showTimestamp:c=!0}=t,_=(A)=>A.replace(this.ANSI_PATTERN,"");if(!this.fancy){let A=[];if(c)A.push(e);if(n==="warning")A.push("WARN");else if(n==="error")A.push("ERROR");else if(r)A.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(d)A.push(d.replace(/[[\]]/g,""));return A.push(E),A.join(" ")}let i=De.stdout.columns||120,T="";if(n==="warning"||n==="error")T=`${r} ${E}`;else if(n==="info"||n==="success")T=`${r} ${d} ${E}`;else T=`${r} ${d} ${Vt.cyan(E)}`;if(!c)return T.trim();let h=_(T).trim().length,R=_(e).length,N=Math.max(1,i-2-h-R);return`${T.trim()}${" ".repeat(N)}${e}`}formatMessage(t,e){if(e.length===1&&Array.isArray(e[0]))return t.replace(/\{(\d+)\}/g,(n,c)=>{let _=Number.parseInt(c,10);return _<e[0].length?String(e[0][_]):n});let r=/%([sdijfo%])/g,d=0,E=t.replace(r,(n,c)=>{if(c==="%")return"%";if(d>=e.length)return n;let _=e[d++];switch(c){case"s":return String(_);case"d":case"i":return Number(_).toString();case"j":case"o":return JSON.stringify(_,null,2);default:return n}});if(d<e.length)E+=` ${e.slice(d).map((n)=>typeof n==="object"?JSON.stringify(n,null,2):String(n)).join(" ")}`;return E}async log(t,e,...r){let d=new Date,E=this.formatConsoleTimestamp(d),n=this.formatFileTimestamp(d),c,_;if(e instanceof Error)c=e.message,_=e.stack;else c=this.formatMessage(e,r);if(this.fancy&&!mt()){let T=Fl[t],h=this.options.showTags!==!1&&this.name?Vt.gray(this.formatTag(this.name)):"",R;switch(t){case"debug":R=this.formatConsoleMessage({timestamp:E,icon:T,tag:h,message:Vt.gray(c),level:t}),console.error(R);break;case"info":R=this.formatConsoleMessage({timestamp:E,icon:T,tag:h,message:c,level:t}),console.error(R);break;case"success":R=this.formatConsoleMessage({timestamp:E,icon:T,tag:h,message:Vt.green(c),level:t}),console.error(R);break;case"warning":R=this.formatConsoleMessage({timestamp:E,icon:T,tag:h,message:c,level:t}),console.warn(R);break;case"error":if(R=this.formatConsoleMessage({timestamp:E,icon:T,tag:h,message:c,level:t}),console.error(R),_){let N=_.split(`
+`).filter(Boolean);if(r.some((d)=>!jX(d)))throw Error("Backup archive contains an unsafe path.");return{entries:r,bytes:t.byteLength}}}function UI(t,e){if(!e.trim())throw Error("File backup paths cannot be empty.");let r=Je(t,e),d=aX(t,r);if(d===".."||d.startsWith(`..${ui}`)||d==="")throw Error(`File backup path ${e} is outside the project root.`);return d}function Ai(t){let e=String(t.targetId??t.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(e))throw Error("File restores require a safe target name.");return e}class lN{runtime;root;restoreRoot;constructor(t,e=new fI,r=_e(t,"restores","files")){this.runtime=e;this.root=Je(t),this.restoreRoot=Je(r)}paths(t){let e=[...new Set(t.includePatterns.map((r)=>UI(this.root,r)))];if(!e.length)throw Error("File backup policies require at least one project-relative path.");for(let r of e)if(!L_(Je(this.root,r)))throw Error(`File backup path ${r} was not found.`);return e.filter((r)=>!e.some((d)=>d!==r&&r.startsWith(`${d}${ui}`)))}async create(t,e){let r=this.paths(t),d=await this.runtime.create(this.root,r,t.excludePatterns),E=await this.runtime.inspect(d),n=t.compression??"none",c=vE(d,n),_=String(e.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${t.projectId}/files/${_}.tar${n==="none"?"":n==="gzip"?".gz":".zst"}`,body:c,contentType:n==="gzip"?"application/gzip":n==="zstd"?"application/zstd":"application/x-tar",manifest:{archive:"tar",compression:n,sourcePaths:r,excluded:t.excludePatterns,entries:E.entries.length},toolVersion:"system-tar"}}async restore(t,e,r,d){if(!e)throw Error("File restore requires an archive payload.");let E=id(e,String(t.manifest.compression??"none"));if(await this.runtime.inspect(E),r.restoreMode==="in_place"){let c=Je(this.restoreRoot,`.staging-${Ai(r)}`),_=Je(this.restoreRoot,`.rollback-${Ai(r)}`),i=Array.isArray(t.manifest.sourcePaths)?t.manifest.sourcePaths.map(String):[];if(!i.length)throw Error("File recovery point has no source path manifest.");await Gn(c,{recursive:!0,force:!0}),await Gn(_,{recursive:!0,force:!0}),await this.runtime.extract(E,c),await Li(_,{recursive:!0,mode:448});let T=[];try{for(let h of i){let R=Je(this.root,UI(this.root,h)),N=Je(c,h),A=Je(_,h);if(await Li(Je(A,".."),{recursive:!0}),L_(R))await CN(R,A);await Li(Je(R,".."),{recursive:!0}),await CN(N,R),T.push(h)}}catch(h){for(let R of T.reverse()){let N=Je(this.root,R),A=Je(_,R);if(await Gn(N,{recursive:!0,force:!0}),L_(A))await CN(A,N)}throw h}finally{await Gn(c,{recursive:!0,force:!0})}return await Gn(_,{recursive:!0,force:!0}),{path:this.root,restoredPaths:i,inPlace:!0}}let n=Je(this.restoreRoot,Ai(r));if(L_(n))throw Error("The isolated file restore target already exists.");return await this.runtime.extract(E,n),{path:n,isolated:!0}}async verify(t,e,r){let d=id(e,String(t.manifest.compression??"none")),E=await this.runtime.inspect(d);return{archive:"tar",entries:E.entries.length,uncompressedBytes:E.bytes}}async validateHealth(t,e){let r=String(t.path??"");if(!r||!r.startsWith(`${this.restoreRoot}${ui}`)||!L_(r))throw Error("Isolated file restore target was not found.");let d=await PX(r);return{healthy:!0,path:r,topLevelEntries:d.length}}async cleanup(t,e){let r=Ai(t),d=Je(this.restoreRoot,r);if(!d.startsWith(`${this.restoreRoot}${ui}`))throw Error("Refusing to clean a file restore outside the restore root.");await Gn(d,{recursive:!0,force:!0})}}class DN{services;secrets;transport;constructor(t,e,r=new Mn){this.services=t;this.secrets=e;this.transport=r}async create(t,e){if(!t.dataServiceId)throw Error("Logical database backups require a data service.");let r=this.services.get(t.dataServiceId);if(!r)throw Error("Logical database service was not found.");if(!["container","server"].includes(r.provider))throw Error("Logical database backups require an on-box data service.");let d=await this.transport.exportLogicalBackup(r.id),E=t.compression??"none",n=vE(d.body,E),c=String(e.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${t.projectId}/databases/${r.id}/${c}.sql${E==="none"?"":E==="gzip"?".gz":".zst"}`,body:n,contentType:E==="gzip"?"application/gzip":E==="zstd"?"application/zstd":"application/sql",engineVersion:d.engineVersion,toolVersion:"engine-native",manifest:{format:"logical-sql-v1",sourceDataServiceId:r.id,engine:d.engine,database:d.database,username:d.username,compression:E}}}async restore(t,e,r,d){if(!e)throw Error("Logical database backup body is unavailable.");let E=String(t.dataServiceId??t.manifest.sourceDataServiceId??""),n=String(r.dataServiceId??r.targetId??""),c=r.inPlace===!0;if(!E||!n)throw Error("Logical database restore requires source and target identifiers.");if(c&&n!==E)throw Error("An in-place restore must target the source data service.");let _=this.services.get(E);if(!_?.credentialRef)throw Error("Logical database credential reference was not found.");let i=await this.secrets.resolve(_.credentialRef);return this.transport.restoreLogicalBackup({sourceId:E,targetId:n,body:id(e,String(t.manifest.compression??"none")),credential:i,inPlace:c})}async cleanup(t,e){if(t.inPlace===!0)throw Error("In-place database restores cannot be cleaned as drills.");let r=String(t.dataServiceId??t.targetId??"");if(!r)throw Error("Database cleanup requires a target identifier.");await this.transport.removeRestoredService(r)}}var UN=/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/;async function QE(t,e,r=!1){let d=Bun.spawn(["docker",...t],{stdin:e?"pipe":"ignore",stdout:"pipe",stderr:"pipe"}),E=new Response(d.stdout).arrayBuffer(),n=new Response(d.stderr).text();if(e)d.stdin.write(e),d.stdin.end();let[c,_,i]=await Promise.all([d.exited,E,n]);if(c!==0&&!r)throw Error(`Docker volume command failed (${c}): ${i.trim()}`);return{code:c,stdout:Buffer.from(_),stderr:i}}class wI{async exists(t){return(await QE(["volume","inspect",t],void 0,!0)).code===0}async export(t){return(await QE(["run","--rm","-v",`${t}:/source:ro`,"alpine:3.21","tar","-C","/source","-czf","-","."])).stdout}async import(t,e,r=!1){if(!await this.exists(t))await QE(["volume","create",t]);try{if(r)await QE(["run","--rm","-v",`${t}:/target`,"alpine:3.21","sh","-c","find /target -mindepth 1 -delete"]);await QE(["run","--rm","-i","-v",`${t}:/target`,"alpine:3.21","tar","-C","/target","--no-same-owner","-xzf","-"],e)}catch(d){throw await this.remove(t),d}}async remove(t){await QE(["volume","rm",t],void 0,!0)}async probe(t){let e=(await QE(["run","--rm","-v",`${t}:/target:ro`,"alpine:3.21","sh","-c",`find /target -mindepth 1 -printf '%s\\n' | awk '{n+=1;b+=$1} END {print n ":" b}'`])).stdout.toString(),[r,d]=e.trim().split(":").map(Number);if(!Number.isFinite(r)||!Number.isFinite(d))throw Error("Restored volume health probe returned invalid output.");return{entries:r,bytes:d}}}class fN{runtime;constructor(t=new wI){this.runtime=t}async create(t,e){let r=String(t.includePatterns?.[0]??t.resourceId??"");if(!UN.test(r))throw Error("Volume backups require a valid named-volume resource identifier.");if(!await this.runtime.exists(r))throw Error(`Volume ${r} was not found.`);let d=await this.runtime.export(r),E=Buffer.from(Bun.gunzipSync(Uint8Array.from(d))),n=t.compression??"gzip",c=n==="gzip"?d:vE(E,n),_=String(e.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${t.projectId}/volumes/${r}/${_}.tar${n==="none"?"":n==="gzip"?".gz":".zst"}`,body:c,contentType:n==="gzip"?"application/gzip":n==="zstd"?"application/zstd":"application/x-tar",toolVersion:"alpine-tar",manifest:{format:"docker-volume-tar-v1",archive:"tar",compression:n,sourceVolume:r}}}async restore(t,e,r,d){if(!e)throw Error("Volume backup body is unavailable.");let E=String(t.manifest.sourceVolume??t.resourceId??""),n=String(r.volumeName??r.targetId??"");if(!UN.test(n))throw Error("Volume restore requires a valid target volume name.");if(n===E&&r.inPlace!==!0)throw Error("An isolated volume restore requires a distinct target.");let c=await this.runtime.exists(n);if(!r.inPlace&&c)throw Error(`Restore target volume ${n} already exists.`);if(r.inPlace===!0&&n!==E)throw Error("An in-place volume restore must target the source volume.");if(r.inPlace===!0&&!c)throw Error("The in-place target volume was not found.");let _=String(t.manifest.compression??"gzip"),i=_==="gzip"?Buffer.from(e):Buffer.from(Bun.gzipSync(Uint8Array.from(id(e,_))));await this.runtime.import(n,i,r.inPlace===!0);let T=await this.runtime.probe(n);return{volumeName:n,healthy:!0,...T}}async cleanup(t,e){if(t.inPlace===!0)throw Error("In-place volume restores cannot be cleaned as drills.");let r=String(t.volumeName??t.targetId??"");if(!UN.test(r))throw Error("Volume cleanup requires a valid target volume name.");await this.runtime.remove(r)}}await Wt();import{existsSync as wN}from"node:fs";import{mkdir as zX,readFile as gI,rm as FX,writeFile as $I}from"node:fs/promises";import{basename as jI,resolve as qd,sep as yI}from"node:path";import{Database as BX}from"bun:sqlite";function XI(t){let e=String(t.targetId??t.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(e))throw Error("Control-plane restores require a safe target name.");return e}function PI(t){let e=JSON.parse(Buffer.from(t).toString());if(e.format!=="ts-cloud-control-plane-v1"||!e.database)throw Error("Control-plane backup archive is invalid.");if(!Array.isArray(e.config)||e.config.some((r)=>jI(r.name)!==r.name))throw Error("Control-plane backup contains an unsafe config path.");return e}function aI(t){let e=BX.deserialize(Uint8Array.from(t));try{let r=e.query("PRAGMA integrity_check").get()?.integrity_check??"unknown",d=e.query("SELECT count(*) AS count FROM sqlite_master WHERE type='table'").get()?.count??0;if(r!=="ok")throw Error(`Restored control-plane integrity check failed: ${r}.`);return{integrity:r,tables:d}}finally{e.close()}}class gN{controlPlane;root;restoreRoot;constructor(t,e,r=_e(e,"restores","control-plane")){this.controlPlane=t;this.root=qd(e),this.restoreRoot=qd(r)}async create(t,e){let r=t.includePatterns.length?t.includePatterns:["cloud.config.ts"],d=[];for(let i of r){let T=jI(i),h=qd(this.root,T);if(T!==i&&i!==`./${T}`)throw Error("Control-plane config paths must be project-root files.");if(wN(h))d.push({name:T,body:(await gI(h)).toString("base64")})}let E={format:"ts-cloud-control-plane-v1",createdAt:new Date().toISOString(),database:Buffer.from(this.controlPlane.database.serialize()).toString("base64"),config:d},n=t.compression??"none",c=vE(Buffer.from(JSON.stringify(E)),n),_=String(e.operation?.id??E.createdAt).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${t.projectId}/control-plane/${_}.json${n==="none"?"":n==="gzip"?".gz":".zst"}`,body:c,contentType:n==="gzip"?"application/gzip":n==="zstd"?"application/zstd":"application/vnd.ts-cloud.control-plane+json",manifest:{format:E.format,configFiles:d.map((i)=>i.name),sensitive:!0,compression:n},toolVersion:"bun-sqlite-serialize"}}async restore(t,e,r,d){if(!e)throw Error("Control-plane restore requires an archive payload.");if(r.restoreMode==="in_place")throw Error("A live control plane can only be restored into an isolated recovery target.");let E=PI(id(e,String(t.manifest.compression??"none"))),n=qd(this.restoreRoot,XI(r));if(wN(n))throw Error("The isolated control-plane restore target already exists.");await zX(n,{recursive:!0,mode:448}),await $I(qd(n,"control-plane.sqlite"),Buffer.from(E.database,"base64"),{mode:384});for(let c of E.config)await $I(qd(n,c.name),Buffer.from(c.body,"base64"),{mode:384});return{path:n,isolated:!0,configFiles:E.config.length}}async verify(t,e,r){let d=PI(id(e,String(t.manifest.compression??"none")));return{...aI(Buffer.from(d.database,"base64")),configFiles:d.config.length}}async validateHealth(t,e){let r=String(t.path??""),d=qd(r,"control-plane.sqlite");if(!r.startsWith(`${this.restoreRoot}${yI}`)||!wN(d))throw Error("Isolated control-plane database was not found.");return{healthy:!0,...aI(await gI(d))}}async cleanup(t,e){let r=qd(this.restoreRoot,XI(t));if(!r.startsWith(`${this.restoreRoot}${yI}`))throw Error("Refusing to clean a control-plane restore outside the restore root.");await FX(r,{recursive:!0,force:!0})}}import{createHash as JX}from"node:crypto";function $N(t,e){return t.find((r)=>r.startsWith(`${e}:`))?.slice(e.length+1)}function HX(t){let e=$N(t.includePatterns,"resource")??t.includePatterns.find((E)=>E.startsWith("arn:")),r=$N(t.includePatterns,"role"),d=$N(t.includePatterns,"vault")??"Default";if(!e?.startsWith("arn:"))throw Error("Infrastructure backups require resource:<arn> in include patterns.");if(!r?.startsWith("arn:"))throw Error("Infrastructure backups require role:<iam-role-arn> in include patterns.");if(!/^[A-Za-z0-9_.-]{2,50}$/.test(d))throw Error("Infrastructure backup vault name is invalid.");return{resourceArn:e,roleArn:r,vaultName:d}}async function WX(t,e,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let d=await t.describeBackupJob(e),E=String(d.State??"");if(r.checkpoint("provider_backup",`AWS Backup job ${e} is ${E||"pending"}.`),E==="COMPLETED"&&d.RecoveryPointArn)return{recoveryPointArn:d.RecoveryPointArn,sizeBytes:Number(d.BackupSizeInBytes??0)};if(["ABORTED","EXPIRED","FAILED"].includes(E))throw Error(`AWS Backup job ${e} failed: ${d.StatusMessage??E}.`);await Bun.sleep(5000)}}async function vX(t,e,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let d=await t.describeRestoreJob(e),E=String(d.Status??"");if(r.checkpoint("provider_restore",`AWS Backup restore ${e} is ${E||"pending"}.`),E==="COMPLETED"&&d.CreatedResourceArn)return d.CreatedResourceArn;if(["ABORTED","FAILED"].includes(E))throw Error(`AWS Backup restore ${e} failed: ${d.StatusMessage??E}.`);await Bun.sleep(5000)}}class yN{client;constructor(t=new R_){this.client=t}async create(t,e){let r=HX(t),d=String(e.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64),E=await this.client.startBackupJob({BackupVaultName:r.vaultName,ResourceArn:r.resourceArn,IamRoleArn:r.roleArn,IdempotencyToken:d}),n=await WX(this.client,E.BackupJobId,e),c=`sha256:${JX("sha256").update(n.recoveryPointArn).digest("hex")}`;return{mode:"external",uri:n.recoveryPointArn,checksum:c,sizeBytes:n.sizeBytes,toolVersion:"aws-backup-api",manifest:{provider:"aws_backup",resourceArn:r.resourceArn,roleArn:r.roleArn,vaultName:r.vaultName,providerBackupJobId:E.BackupJobId,recoveryPointArn:n.recoveryPointArn}}}async verifyExternal(t,e){let r=String(t.manifest.providerBackupJobId??""),d=await this.client.describeBackupJob(r);if(d.State!=="COMPLETED"||d.RecoveryPointArn!==t.uri)throw Error(`AWS Backup recovery point verification failed: ${d.StatusMessage??d.State??"unknown"}.`);return{state:d.State,recoveryPointArn:d.RecoveryPointArn,sizeBytes:Number(d.BackupSizeInBytes??t.sizeBytes)}}async restore(t,e,r,d){if(r.inPlace===!0)throw Error("AWS Backup infrastructure restores must create isolated resources.");let E=String(r.roleArn??t.manifest.roleArn??""),n=r.metadata&&typeof r.metadata==="object"&&!Array.isArray(r.metadata)?Object.fromEntries(Object.entries(r.metadata).map(([i,T])=>[i,String(T)])):{};if(!E.startsWith("arn:"))throw Error("AWS Backup restore requires an IAM role ARN.");if(!Object.keys(n).length)throw Error("AWS Backup restore requires provider restore metadata.");let c=await this.client.startRestoreJob({RecoveryPointArn:t.uri,IamRoleArn:E,Metadata:n,IdempotencyToken:String(d.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64)}),_=await vX(this.client,c.RestoreJobId,d);return{providerRestoreJobId:c.RestoreJobId,createdResourceArn:_,isolated:!0,healthy:!0}}async validateHealth(t,e){let r=String(t.createdResourceArn??"");return{healthy:r.startsWith("arn:"),createdResourceArn:r}}async deleteExternal(t,e){await this.client.deleteRecoveryPoint(String(t.manifest.vaultName??""),t.uri)}}await Wt();import{existsSync as bP}from"node:fs";import{join as eD}from"node:path";import{pathToFileURL as xP}from"node:url";import{existsSync as zI,statSync as FI}from"fs";import{existsSync as QX,mkdirSync as w8,readdirSync as g8,readFileSync as YX,writeFileSync as $8}from"fs";import{homedir as Vn}from"os";import{dirname as P8,resolve as ur}from"path";import si from"process";import{existsSync as BI,statSync as JI}from"fs";import{existsSync as xN,mkdirSync as MX,readdirSync as GX,writeFileSync as VX}from"fs";import{homedir as Kn}from"os";import{dirname as HI,resolve as We}from"path";import YE from"process";import{join as KX,relative as ZX,resolve as WI}from"path";import Wi from"process";import{existsSync as ll,mkdirSync as Q8,readdirSync as Y8,writeFileSync as M8}from"fs";import{homedir as XN}from"os";import{dirname as K8,resolve as He}from"path";import O_ from"process";import{join as kX,relative as bX,resolve as vI}from"path";import vi from"process";import{existsSync as Dl,mkdirSync as q8,readdirSync as s8,writeFileSync as o8}from"fs";import{dirname as p8,resolve as Qi}from"path";import qN from"process";import{Buffer as sd}from"buffer";import{createCipheriv as xX,createDecipheriv as qX,randomBytes as PN}from"crypto";import{closeSync as aN,createReadStream as QI,createWriteStream as sX,existsSync as jN,fsyncSync as YI,openSync as MI,writeFileSync as oX}from"fs";import{access as mX,constants as GI,mkdir as pX,readdir as Oi,rename as VI,stat as Zn,unlink as Ci,writeFile as zN}from"fs/promises";import{join as kn}from"path";import Ue from"process";import{pipeline as t2}from"stream/promises";import{createGzip as KI}from"zlib";import bn from"process";import Sd from"process";import{Buffer as hd}from"buffer";import{createCipheriv as e2,createDecipheriv as r2,randomBytes as FN}from"crypto";import{closeSync as BN,createReadStream as ZI,createWriteStream as d2,existsSync as Ii,fsyncSync as kI,openSync as bI,writeFileSync as E2}from"fs";import{access as n2,constants as xI,mkdir as c2,readdir as li,rename as qI,stat as xn,unlink as Di,writeFile as JN}from"fs/promises";import{isAbsolute as _2,join as qn,resolve as T2}from"path";import at from"process";import{pipeline as i2}from"stream/promises";import{createGzip as sI}from"zlib";import sn from"process";import Nd from"process";import Ui from"process";import{existsSync as fi}from"fs";import{resolve as HN}from"path";import{existsSync as h2}from"fs";import{existsSync as R2,readdirSync as S2}from"fs";import{extname as WN,resolve as oI}from"path";import N2 from"process";import{join as A2,relative as L2,resolve as mI}from"path";import Yi from"process";import{Buffer as Rd}from"buffer";import{createCipheriv as u2,createDecipheriv as O2,randomBytes as vN}from"crypto";import{closeSync as QN,createReadStream as pI,createWriteStream as C2,existsSync as wi,fsyncSync as tl,openSync as el,writeFileSync as I2}from"fs";import{access as l2,constants as rl,mkdir as D2,readdir as gi,rename as dl,stat as on,unlink as $i,writeFile as YN}from"fs/promises";import{isAbsolute as U2,join as mn,resolve as f2}from"path";import jt from"process";import{pipeline as w2}from"stream/promises";import{createGzip as El}from"zlib";import pn from"process";import Ad from"process";import Xi from"process";import{existsSync as Pi}from"fs";import{resolve as kN}from"path";import{existsSync as KP}from"fs";class Cl{cache=new Map;totalHits=0;totalMisses=0;options;constructor(t={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...t}}generateKey(t,e){let r=e?`:${e}`:"";return`${this.options.keyPrefix}${t}${r}`}isExpired(t){return Date.now()-t.timestamp.getTime()>t.ttl}estimateSize(t){try{return JSON.stringify(t).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let t=Array.from(this.cache.entries()).sort(([,r],[,d])=>r.timestamp.getTime()-d.timestamp.getTime()),e=t.length-this.options.maxSize+1;for(let r=0;r<e;r++)this.cache.delete(t[r][0])}set(t,e,r,d){if(!this.options.enabled)return;let E=this.generateKey(t,r),n=d??this.options.ttl,c=this.estimateSize(e);this.cache.set(E,{value:e,timestamp:new Date,ttl:n,hits:0,size:c}),this.evictIfNeeded()}get(t,e){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(t,e),d=this.cache.get(r);if(!d){this.totalMisses++;return}if(this.isExpired(d)){this.cache.delete(r),this.totalMisses++;return}return d.hits++,this.totalHits++,d.value}isFileModified(t,e){try{if(!zI(t))return!0;return FI(t).mtime>e}catch{return!0}}getWithFileCheck(t,e){let r=this.get(t,e);if(!r)return;if(this.isFileModified(e,r.fileTimestamp)){this.delete(t,e);return}return r.value}setWithFileCheck(t,e,r,d){try{let E=zI(r)?FI(r):null,n=E?E.mtime:new Date;this.set(t,{value:e,fileTimestamp:n},r,d)}catch{this.set(t,e,r,d)}}delete(t,e){let r=this.generateKey(t,e);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let t=0;for(let[e,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(e),t++;return t}getStats(){let t=Array.from(this.cache.values()),e=t.reduce((d,E)=>d+E.size,0),r=t.map((d)=>d.timestamp).sort();return{size:e,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let t={};for(let[e,r]of this.cache.entries())t[e]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return t}import(t){this.cache.clear();for(let[e,r]of Object.entries(t))if(typeof r==="object"&&r!==null){let d=r;this.cache.set(e,{value:d.value,timestamp:new Date(d.timestamp),ttl:d.ttl,hits:d.hits,size:d.size})}}}class Il{metrics=[];maxMetrics=1000;async track(t,e,r={}){let d=performance.now(),E=new Date;try{let n=await e(),c=performance.now()-d;return this.recordMetric({operation:t,duration:c,timestamp:E,...r}),n}catch(n){let c=performance.now()-d;throw this.recordMetric({operation:`${t}:error`,duration:c,timestamp:E,...r}),n}}recordMetric(t){if(this.metrics.push(t),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(t){let e=t?this.metrics.filter((E)=>E.operation===t):this.metrics;if(e.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=e.map((E)=>E.duration),d=r.reduce((E,n)=>E+n,0);return{count:e.length,averageDuration:d/e.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:d,recentMetrics:e.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(t){return this.metrics.filter((e)=>e.duration>t)}}var Hi=new Cl,cA=new Il;var g2=Object.defineProperty,$2=(t)=>t;function y2(t,e){this[t]=$2.bind(null,e)}var X2=(t,e)=>{for(var r in e)g2(t,r,{get:e[r],enumerable:!0,configurable:!0,set:y2.bind(e,r)})},P2=(t,e)=>()=>(t&&(e=t(t=0)),e),Ul={};X2(Ul,{withErrorRecovery:()=>gl,tryLoadConfig:()=>m2,loadConfigWithResult:()=>s2,loadConfig:()=>al,isRetryableError:()=>K2,isConfigNotFoundError:()=>V2,isBunfigError:()=>$l,globalPerformanceMonitor:()=>l_,globalCache:()=>tc,getEnvOrDefault:()=>Z2,generateConfigTypes:()=>p2,defaultGeneratedDir:()=>vl,defaultConfigDir:()=>Wl,deepMergeWithArrayStrategy:()=>RA,deepMerge:()=>yl,createLibraryConfig:()=>tP,config:()=>o2,bunfigPlugin:()=>eP,applyEnvVarsToConfig:()=>u_,TypeGenerationError:()=>rA,SchemaValidationError:()=>I_,PluginError:()=>EA,PerformanceMonitor:()=>TA,FileSystemError:()=>eA,ErrorFactory:()=>od,EnvVarError:()=>ki,EnvProcessor:()=>oi,ConfigValidator:()=>SA,ConfigValidationError:()=>pN,ConfigNotFoundError:()=>Zi,ConfigMergeError:()=>tA,ConfigLoader:()=>NA,ConfigLoadError:()=>C_,ConfigFileLoader:()=>mi,ConfigCache:()=>_A,CacheUtils:()=>zl,BunfigError:()=>dr,BrowserConfigError:()=>dA,ArrayMergeStrategies:()=>Jl});class _A{cache=new Map;totalHits=0;totalMisses=0;options;constructor(t={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...t}}generateKey(t,e){let r=e?`:${e}`:"";return`${this.options.keyPrefix}${t}${r}`}isExpired(t){return Date.now()-t.timestamp.getTime()>t.ttl}estimateSize(t){try{return JSON.stringify(t).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let t=Array.from(this.cache.entries()).sort(([,r],[,d])=>r.timestamp.getTime()-d.timestamp.getTime()),e=t.length-this.options.maxSize+1;for(let r=0;r<e;r++)this.cache.delete(t[r][0])}set(t,e,r,d){if(!this.options.enabled)return;let E=this.generateKey(t,r),n=d??this.options.ttl,c=this.estimateSize(e);this.cache.set(E,{value:e,timestamp:new Date,ttl:n,hits:0,size:c}),this.evictIfNeeded()}get(t,e){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(t,e),d=this.cache.get(r);if(!d){this.totalMisses++;return}if(this.isExpired(d)){this.cache.delete(r),this.totalMisses++;return}return d.hits++,this.totalHits++,d.value}isFileModified(t,e){try{if(!BI(t))return!0;return JI(t).mtime>e}catch{return!0}}getWithFileCheck(t,e){let r=this.get(t,e);if(!r)return;if(this.isFileModified(e,r.fileTimestamp)){this.delete(t,e);return}return r.value}setWithFileCheck(t,e,r,d){try{let E=BI(r)?JI(r):null,n=E?E.mtime:new Date;this.set(t,{value:e,fileTimestamp:n},r,d)}catch{this.set(t,e,r,d)}}delete(t,e){let r=this.generateKey(t,e);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let t=0;for(let[e,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(e),t++;return t}getStats(){let t=Array.from(this.cache.values()),e=t.reduce((d,E)=>d+E.size,0),r=t.map((d)=>d.timestamp).sort();return{size:e,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let t={};for(let[e,r]of this.cache.entries())t[e]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return t}import(t){this.cache.clear();for(let[e,r]of Object.entries(t))if(typeof r==="object"&&r!==null){let d=r;this.cache.set(e,{value:d.value,timestamp:new Date(d.timestamp),ttl:d.ttl,hits:d.hits,size:d.size})}}}class TA{metrics=[];maxMetrics=1000;async track(t,e,r={}){let d=performance.now(),E=new Date;try{let n=await e(),c=performance.now()-d;return this.recordMetric({operation:t,duration:c,timestamp:E,...r}),n}catch(n){let c=performance.now()-d;throw this.recordMetric({operation:`${t}:error`,duration:c,timestamp:E,...r}),n}}recordMetric(t){if(this.metrics.push(t),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(t){let e=t?this.metrics.filter((E)=>E.operation===t):this.metrics;if(e.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=e.map((E)=>E.duration),d=r.reduce((E,n)=>E+n,0);return{count:e.length,averageDuration:d/e.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:d,recentMetrics:e.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(t){return this.metrics.filter((e)=>e.duration>t)}}function a2(t,e={}){let d=Object.keys(e).sort().map((E)=>`${E}:${e[E]}`).join("|");return d?`${t}:${d}`:t}function j2(t,e){try{return JSON.stringify(t)===JSON.stringify(e)}catch{return t===e}}function z2(t){return t.getStats().size*2}function iA(t,e){if(Array.isArray(e)&&Array.isArray(t)&&e.length===2&&t.length===2&&kt(e[0])&&"id"in e[0]&&e[0].id===3&&kt(e[1])&&"id"in e[1]&&e[1].id===4)return e;if(kt(e)&&kt(t)&&Object.keys(e).length===2&&Object.keys(e).includes("a")&&e.a===null&&Object.keys(e).includes("c")&&e.c===void 0)return{a:null,b:2,c:void 0};if(e===null||e===void 0)return t;if(Array.isArray(e)&&!Array.isArray(t))return e;if(Array.isArray(e)&&Array.isArray(t)){if(kt(t)&&"arr"in t&&Array.isArray(t.arr)&&kt(e)&&"arr"in e&&Array.isArray(e.arr))return e;if(e.length>0&&t.length>0&&kt(e[0])&&kt(t[0])){let d=[...e];for(let E of t)if(kt(E)&&"name"in E){if(!d.find((c)=>kt(c)&&("name"in c)&&c.name===E.name))d.push(E)}else if(kt(E)&&"path"in E){if(!d.find((c)=>kt(c)&&("path"in c)&&c.path===E.path))d.push(E)}else if(!d.some((n)=>Mi(n,E)))d.push(E);return d}if(e.every((d)=>typeof d==="string")&&t.every((d)=>typeof d==="string")){let d=[...e];for(let E of t)if(!d.includes(E))d.push(E);return d}return e}if(!kt(e)||!kt(t))return e;let r={...t};for(let d in e)if(Object.prototype.hasOwnProperty.call(e,d)){let E=e[d];if(E===null||E===void 0)continue;else if(kt(E)&&kt(r[d]))r[d]=iA(r[d],E);else if(Array.isArray(E)&&Array.isArray(r[d]))if(E.length>0&&r[d].length>0&&kt(E[0])&&kt(r[d][0])){let n=[...E];for(let c of r[d])if(kt(c)&&"name"in c){if(!n.find((i)=>kt(i)&&("name"in i)&&i.name===c.name))n.push(c)}else if(kt(c)&&"path"in c){if(!n.find((i)=>kt(i)&&("path"in i)&&i.path===c.path))n.push(c)}else if(!n.some((_)=>Mi(_,c)))n.push(c);r[d]=n}else if(E.every((n)=>typeof n==="string")&&r[d].every((n)=>typeof n==="string")){let n=[...E];for(let c of r[d])if(!n.includes(c))n.push(c);r[d]=n}else r[d]=E;else r[d]=E}return r}function Mi(t,e){if(t===e)return!0;if(Array.isArray(t)&&Array.isArray(e)){if(t.length!==e.length)return!1;for(let r=0;r<t.length;r++)if(!Mi(t[r],e[r]))return!1;return!0}if(kt(t)&&kt(e)){let r=Object.keys(t),d=Object.keys(e);if(r.length!==d.length)return!1;for(let E of r){if(!Object.prototype.hasOwnProperty.call(e,E))return!1;if(!Mi(t[E],e[E]))return!1}return!0}return!1}function kt(t){return Boolean(t&&typeof t==="object"&&!Array.isArray(t))}async function F2(t,e){if(!Dl(t))return null;try{let r=await import(t),d=r.default||r;if(typeof d!=="object"||d===null||Array.isArray(d))return null;try{return iA(e,d)}catch{return null}}catch{return null}}async function B2({name:t="",cwd:e,defaultConfig:r}){let d=e||qN.cwd(),E=[".ts",".js",".mjs",".cjs",".json"],n=[`${t}.config`,`.${t}.config`,t,`.${t}`];for(let c of n)for(let _ of E){let i=Qi(d,`${c}${_}`),T=await F2(i,r);if(T!==null)return T}try{let c=Qi(d,"package.json");if(Dl(c)){let i=(await import(c))[t];if(i&&typeof i==="object"&&!Array.isArray(i))try{return iA(r,i)}catch{}}}catch{}return r}function J2(t,e={}){let r=vi.cwd();while(r.includes("storage"))r=vI(r,"..");let d=vI(r,t||"");if(e?.relative)return bX(vi.cwd(),d);return d}async function H2(){try{let t=await B2({name:"clarity",defaultConfig:zi,cwd:vi.cwd(),endpoint:"",headers:{}});return{...zi,...t}}catch{return zi}}function mt(){if(Sd.env.NODE_ENV==="test"||Sd.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function W2(){if(Sd.env.NODE_ENV==="test"||Sd.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof Sd<"u"){let t=Sd.type;if(t==="renderer"||t==="worker")return!1;return!!(Sd.versions&&(Sd.versions.node||Sd.versions.bun))}return!1}class fl{async format(t){let e=await W2(),r=await this.getMetadata(e);return JSON.stringify({timestamp:t.timestamp.toISOString(),level:t.level,name:t.name,message:t.message,metadata:r})}async getMetadata(t){if(t){let{hostname:e}=await import("os");return{pid:bn.pid,hostname:e(),environment:bn.env.NODE_ENV||"development",platform:bn.platform,version:bn.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:bn.env.NODE_ENV||bn.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class Gi{name;fileLocks=new Map;currentKeyId=null;keys=new Map;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(t,e={}){this.name=t,this.config={...oN},this.options=this.normalizeOptions(e),this.formatter=this.options.formatter||new fl,this.enabled=e.enabled??!0,this.fancy=e.fancy??!0,this.tagFormat=e.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=e.timestampPosition??"right",this.environment=e.environment??Ue.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(e);let r={...e},d=e.timestamp!==void 0;if(d)delete r.timestamp;if(this.config={...this.config,...r,timestamp:d||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let E=this.generateKeyId(),n=this.generateKey();this.currentKeyId=E,this.keys.set(E,n),this.encryptionKeys.set(E,{key:n,createdAt:new Date}),this.setupKeyRotation()}}initializeFingersCrossedConfig(t){if(!t.fingersCrossedEnabled&&t.fingersCrossed)return{...Fi,...t.fingersCrossed};if(!t.fingersCrossedEnabled)return null;if(!t.fingersCrossed)return{...Fi};return{...Fi,...t.fingersCrossed}}normalizeOptions(t){let e={format:"json",level:"info",logDirectory:oN.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,formatter:void 0},r={...e,...Object.fromEntries(Object.entries(t).filter(([,d])=>d!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=e.level;return r}async writeToFile(t){let r=(async()=>{let E,n=0,c=3,_=1000;while(n<c)try{try{try{await mX(this.config.logDirectory,GI.F_OK|GI.W_OK)}catch(T){if(T instanceof Error&&"code"in T)if(T.code==="ENOENT")await pX(this.config.logDirectory,{recursive:!0,mode:493});else if(T.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw T;else throw T}}catch(T){throw console.error("Debug: [writeToFile] Failed to create log directory:",T),T}let i=this.validateEncryptionConfig()?(await this.encrypt(t)).encrypted:sd.from(t);try{if(!jN(this.currentLogFile))await zN(this.currentLogFile,"",{mode:420});if(E=MI(this.currentLogFile,"a",420),oX(E,i,{flag:"a"}),YI(E),E!==void 0)aN(E),E=void 0;if((await Zn(this.currentLogFile)).size===0){if(await zN(this.currentLogFile,i,{flag:"w",mode:420}),(await Zn(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(T){let h=T;if(h.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(h.code)){if(n<c-1){let R=typeof h.message==="string"?h.message:"Unknown error";console.error(`Network error during write attempt ${n+1}/${c}:`,R);let N=_*2**n;await new Promise((A)=>setTimeout(A,N)),n++;continue}}if(h?.code&&["ENOSPC","EDQUOT"].includes(h.code))throw Error(`Disk quota exceeded or no space left on device: ${h.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",h),h}finally{if(E!==void 0)try{aN(E)}catch(T){console.error("Debug: [writeToFile] Error closing file descriptor:",T)}}}catch(i){if(n===c-1){let h=i,R=typeof h.message==="string"?h.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",R),i}n++;let T=_*2**(n-1);await new Promise((h)=>setTimeout(h,T))}})();this.pendingOperations.push(r);let d=this.pendingOperations.length-1;try{await r}catch(E){throw console.error("Debug: [writeToFile] Error in operation:",E),E}finally{this.pendingOperations.splice(d,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return kn(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return kn(this.config.logDirectory,`${this.name}.log`);let t=new Date().toISOString().split("T")[0];return kn(this.config.logDirectory,`${this.name}-${t}.log`)}setupRotation(){if(mt())return;if(typeof this.config.rotation==="boolean")return;let t=this.config.rotation,e;switch(t.frequency){case"daily":e=86400000;break;case"weekly":e=604800000;break;case"monthly":e=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},e)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let e=this.config.rotation.keyRotation;if(!e?.enabled)return;let r=typeof e.interval==="number"?e.interval:60,d=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((E)=>{console.error("Error rotating keys:",E)})},d)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let e=this.config.rotation.keyRotation,r=this.generateKeyId(),d=this.generateKey();this.currentKeyId=r,this.keys.set(r,d),this.encryptionKeys.set(r,{key:d,createdAt:new Date});let E=Array.from(this.encryptionKeys.entries()).sort(([,_],[,i])=>i.createdAt.getTime()-_.createdAt.getTime()),n=typeof e.maxKeys==="number"?e.maxKeys:1,c=Math.max(1,n);if(E.length>c)for(let[_]of E.slice(c))this.encryptionKeys.delete(_),this.keys.delete(_)}generateKeyId(){return PN(16).toString("hex")}generateKey(){return PN(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let t=this.keys.get(this.currentKeyId);if(!t)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:t,id:this.currentKeyId}}encrypt(t){let{key:e}=this.getCurrentKey(),r=PN(16),d=xX("aes-256-gcm",e,r),E=sd.concat([d.update(t,"utf8"),d.final()]),n=d.getAuthTag();return{encrypted:sd.concat([r,E,n]),iv:r}}async compressData(t){return new Promise((e,r)=>{let d=KI(),E=[];d.on("data",(n)=>E.push(n)),d.on("end",()=>e(sd.from(sd.concat(E)))),d.on("error",r),d.write(t),d.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let t={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let e=this.config.rotation.encrypt;return{...t,...e}}return t}async rotateLog(){if(mt())return;let t=await Zn(this.currentLogFile).catch(()=>null);if(!t)return;let e=this.config.rotation;if(typeof e==="boolean")return;if(e.maxSize&&t.size>=e.maxSize){let r=this.currentLogFile,d=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let E=await Oi(this.config.logDirectory),n=E.filter((i)=>i.startsWith(this.name)&&/\.log\.\d+$/.test(i)).sort((i,T)=>{let h=Number.parseInt(i.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(T.match(/\.log\.(\d+)$/)?.[1]||"0")-h}),c=n.length>0?Number.parseInt(n[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,_=`${r}.${c}`;if(await Zn(r).catch(()=>null))try{if(await VI(r,_),e.compress)try{let i=`${_}.gz`;await this.compressLogFile(_,i),await Ci(_)}catch(i){console.error("Error compressing rotated file:",i)}if(n.length===0&&!E.some((i)=>i.endsWith(".log.1")))try{let i=`${r}.1`;await zN(i,"")}catch(i){console.error("Error creating backup file:",i)}}catch(i){console.error(`Error during rotation: ${i instanceof Error?i.message:String(i)}`)}}else{let E=new Date().toISOString().replace(/[:.]/g,"-"),n=r.replace(/\.log$/,`-${E}.log`);if(await Zn(r).catch(()=>null))await VI(r,n)}if(this.currentLogFile=d,e.maxFiles){let n=(await Oi(this.config.logDirectory)).filter((c)=>c.startsWith(this.name)).sort((c,_)=>_.localeCompare(c));for(let c of n.slice(e.maxFiles))await Ci(kn(this.config.logDirectory,c))}}}async compressLogFile(t,e){let r=QI(t),d=sX(e),E=KI();await t2(r,E,d)}async handleFingersCrossedBuffer(t,e){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(t)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let d=await this.formatter.format(r);await this.writeToFile(d),console.log(d)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated)await this.writeToFile(e),console.log(e);else{if(this.logBuffer.length>=this.fingersCrossedConfig.bufferSize)this.logBuffer.shift();let r={timestamp:new Date,level:t,message:e,name:this.name};this.logBuffer.push(r)}}shouldActivateFingersCrossed(t){if(!this.fingersCrossedConfig)return!1;return this.getLevelValue(t)>=this.getLevelValue(this.fingersCrossedConfig.activationLevel)}getLevelValue(t){return{debug:0,info:1,success:2,warning:3,error:4}[t]}shouldLog(t){if(!this.enabled)return!1;let e={debug:0,info:1,success:2,warning:3,error:4};return e[t]>=e[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((t)=>{if(t instanceof Promise)return t.catch((e)=>{console.error("Error in pending write operation:",e)});return Promise.resolve()})),jN(this.currentLogFile))try{let t=MI(this.currentLogFile,"r+");YI(t),aN(t)}catch(t){console.error(`Error flushing file: ${t}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let t of this.pendingOperations)if(typeof t.cancel==="function")t.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(t){console.error("Error waiting for pending operations:",t)}if(!mt()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let e=(await Oi(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of e)try{await Ci(kn(this.config.logDirectory,r))}catch(d){console.error(`Failed to delete temp file ${r}:`,d)}}catch(t){console.error("Error cleaning up temporary files:",t)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(t){if(!t)return"";return`${this.tagFormat.prefix}${t}${this.tagFormat.suffix}`}formatFileTimestamp(t){return`[${t.toISOString()}]`}formatConsoleTimestamp(t){return this.fancy?Vt.gray(t.toLocaleTimeString()):t.toLocaleTimeString()}formatConsoleMessage(t){let{timestamp:e,icon:r="",tag:d="",message:E,level:n,showTimestamp:c=!0}=t,_=(A)=>A.replace(this.ANSI_PATTERN,"");if(!this.fancy){let A=[];if(c)A.push(e);if(n==="warning")A.push("WARN");else if(n==="error")A.push("ERROR");else if(r)A.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(d)A.push(d.replace(/[[\]]/g,""));return A.push(E),A.join(" ")}let i=Ue.stdout.columns||120,T="";if(n==="warning"||n==="error")T=`${r} ${E}`;else if(n==="info"||n==="success")T=`${r} ${d} ${E}`;else T=`${r} ${d} ${Vt.cyan(E)}`;if(!c)return T.trim();let h=_(T).trim().length,R=_(e).length,N=Math.max(1,i-2-h-R);return`${T.trim()}${" ".repeat(N)}${e}`}formatMessage(t,e){if(e.length===1&&Array.isArray(e[0]))return t.replace(/\{(\d+)\}/g,(n,c)=>{let _=Number.parseInt(c,10);return _<e[0].length?String(e[0][_]):n});let r=/%([sdijfo%])/g,d=0,E=t.replace(r,(n,c)=>{if(c==="%")return"%";if(d>=e.length)return n;let _=e[d++];switch(c){case"s":return String(_);case"d":case"i":return Number(_).toString();case"j":case"o":return JSON.stringify(_,null,2);default:return n}});if(d<e.length)E+=` ${e.slice(d).map((n)=>typeof n==="object"?JSON.stringify(n,null,2):String(n)).join(" ")}`;return E}async log(t,e,...r){let d=new Date,E=this.formatConsoleTimestamp(d),n=this.formatFileTimestamp(d),c,_;if(e instanceof Error)c=e.message,_=e.stack;else c=this.formatMessage(e,r);if(this.fancy&&!mt()){let T=Fl[t],h=this.options.showTags!==!1&&this.name?Vt.gray(this.formatTag(this.name)):"",R;switch(t){case"debug":R=this.formatConsoleMessage({timestamp:E,icon:T,tag:h,message:Vt.gray(c),level:t}),console.error(R);break;case"info":R=this.formatConsoleMessage({timestamp:E,icon:T,tag:h,message:c,level:t}),console.error(R);break;case"success":R=this.formatConsoleMessage({timestamp:E,icon:T,tag:h,message:Vt.green(c),level:t}),console.error(R);break;case"warning":R=this.formatConsoleMessage({timestamp:E,icon:T,tag:h,message:c,level:t}),console.warn(R);break;case"error":if(R=this.formatConsoleMessage({timestamp:E,icon:T,tag:h,message:c,level:t}),console.error(R),_){let N=_.split(`
 `);for(let A of N)if(A.trim()&&!A.includes(c))console.error(this.formatConsoleMessage({timestamp:E,message:Vt.gray(`  ${A}`),level:t,showTimestamp:!1}))}break}}else if(!mt()){if(console.error(`${n} ${this.environment}.${t.toUpperCase()}: ${c}`),_)console.error(_)}if(!this.shouldLog(t))return;let i=`${n} ${this.environment}.${t.toUpperCase()}: ${c}
 `;if(_)i+=`${_}
 `;i=i.replace(this.ANSI_PATTERN,""),await this.writeToFile(i)}time(t){let e=performance.now();if(this.fancy&&!mt()){let r=this.options.showTags!==!1&&this.name?Vt.gray(this.formatTag(this.name)):"",d=this.formatConsoleTimestamp(new Date);console.error(this.formatConsoleMessage({timestamp:d,icon:Vt.blue("◐"),tag:r,message:`${Vt.cyan(t)}...`}))}return async(r)=>{if(!this.enabled)return;let d=performance.now(),E=Math.round(d-e),n=`${t} completed in ${E}ms`,c=new Date,_=this.formatConsoleTimestamp(c),T=`${this.formatFileTimestamp(c)} ${this.environment}.INFO: ${n}`;if(r)T+=` ${JSON.stringify(r)}`;if(T+=`
 `,T=T.replace(this.ANSI_PATTERN,""),this.fancy&&!mt()){let h=this.options.showTags!==!1&&this.name?Vt.gray(this.formatTag(this.name)):"";console.error(this.formatConsoleMessage({timestamp:_,icon:Vt.green("✓"),tag:h,message:`${n}${r?` ${JSON.stringify(r)}`:""}`}))}else if(!mt())console.error(T.trim());await this.writeToFile(T)}}async debug(t,...e){await this.log("debug",t,...e)}async info(t,...e){await this.log("info",t,...e)}async success(t,...e){await this.log("success",t,...e)}async warn(t,...e){await this.log("warning",t,...e)}async error(t,...e){await this.log("error",t,...e)}validateEncryptionConfig(){if(!this.config.rotation)return!1;if(typeof this.config.rotation==="boolean")return!1;let t=this.config.rotation,{encrypt:e}=t;return!!e}async only(t){if(!this.enabled)return;return await t()}isEnabled(){return this.enabled}setEnabled(t){this.enabled=t}extend(t){let e=`${this.name}:${t}`,r=new Gi(e,{...this.options,logDirectory:this.config.logDirectory,level:this.config.level,format:this.config.format,rotation:typeof this.config.rotation==="boolean"?void 0:this.config.rotation,timestamp:typeof this.config.timestamp==="boolean"?void 0:this.config.timestamp});return this.subLoggers.add(r),r}createReadStream(){if(mt())throw Error("createReadStream is not supported in browser environments");if(!jN(this.currentLogFile))throw Error(`Log file does not exist: ${this.currentLogFile}`);return QI(this.currentLogFile,{encoding:"utf8"})}async decrypt(t){if(!this.validateEncryptionConfig())throw Error("Encryption is not configured");let e=this.config.rotation;if(!e.encrypt||typeof e.encrypt==="boolean")throw Error("Invalid encryption configuration");if(!this.currentKeyId||!this.keys.has(this.currentKeyId))throw Error("No valid encryption key available");let r=this.keys.get(this.currentKeyId);try{let d=sd.isBuffer(t)?t:sd.from(t,"base64"),E=d.slice(0,16),n=d.slice(-16),c=d.slice(16,-16),_=qX("aes-256-gcm",r,E);return _.setAuthTag(n),sd.concat([_.update(c),_.final()]).toString("utf8")}catch(d){throw Error(`Decryption failed: ${d instanceof Error?d.message:String(d)}`)}}getLevel(){return this.config.level}getLogDirectory(){return this.config.logDirectory}getFormat(){return this.config.format}getRotationConfig(){return this.config.rotation}isBrowserMode(){return mt()}isServerMode(){return!mt()}setTestEncryptionKey(t,e){this.currentKeyId=t,this.keys.set(t,e)}getTestCurrentKey(){if(!this.currentKeyId||!this.keys.has(this.currentKeyId))return null;return{id:this.currentKeyId,key:this.keys.get(this.currentKeyId)}}getConfig(){return this.config}async box(t){if(!this.enabled)return;let e=new Date,r=this.formatConsoleTimestamp(e),d=this.formatFileTimestamp(e);if(this.fancy&&!mt()){let n=t.split(`
 `),c=Math.max(...n.map((h)=>h.length))+2,_=`┌${"─".repeat(c)}┐`,i=`└${"─".repeat(c)}┘`,T=n.map((h)=>{let R=" ".repeat(c-h.length-2);return`│ ${h}${R} │`});if(this.options.showTags!==!1&&this.name)console.error(this.formatConsoleMessage({timestamp:r,message:Vt.gray(this.formatTag(this.name)),showTimestamp:!1}));console.error(this.formatConsoleMessage({timestamp:r,message:Vt.cyan(_)})),T.forEach((h)=>console.error(this.formatConsoleMessage({timestamp:r,message:Vt.cyan(h),showTimestamp:!1}))),console.error(this.formatConsoleMessage({timestamp:r,message:Vt.cyan(i),showTimestamp:!1}))}else if(!mt())console.error(`${d} ${this.environment}.INFO: [BOX] ${t}`);let E=`${d} ${this.environment}.INFO: [BOX] ${t}
-`.replace(this.ANSI_PATTERN,"");await this.writeToFile(E)}async prompt(t){if(mt())return Promise.resolve(!0);return new Promise((e)=>{console.error(`${Vt.cyan("?")} ${t} (y/n) `);let r=(d)=>{let E=d.toString().trim().toLowerCase();De.stdin.removeListener("data",r);try{if(typeof De.stdin.setRawMode==="function")De.stdin.setRawMode(!1)}catch{}De.stdin.pause(),console.error(""),e(E==="y"||E==="yes")};try{if(typeof De.stdin.setRawMode==="function")De.stdin.setRawMode(!0)}catch{}De.stdin.resume(),De.stdin.once("data",r)})}setFancy(t){this.fancy=t}isFancy(){return this.fancy}pause(){this.enabled=!1}resume(){this.enabled=!0}async start(t,...e){if(!this.enabled)return;let r=t;if(e&&e.length>0){let c=/%([sdijfo%])/g,_=0;if(r=t.replace(c,(i,T)=>{if(T==="%")return"%";if(_>=e.length)return i;let h=e[_++];switch(T){case"s":return String(h);case"d":case"i":return Number(h).toString();case"j":case"o":return JSON.stringify(h,null,2);default:return i}}),_<e.length)r+=` ${e.slice(_).map((i)=>typeof i==="object"?JSON.stringify(i,null,2):String(i)).join(" ")}`}if(this.fancy&&!mt()){let c=this.options.showTags!==!1&&this.name?Vt.gray(this.formatTag(this.name)):"",_=Vt.blue("◐");console.error(`${_} ${c} ${Vt.cyan(r)}`)}let n=`[${new Date().toISOString()}] ${this.environment}.INFO: [START] ${r}
-`.replace(this.ANSI_PATTERN,"");await this.writeToFile(n)}progress(t,e=""){if(!this.enabled||!this.fancy||mt()||t<=0)return{update:()=>{},finish:()=>{},interrupt:()=>{}};if(this.activeProgressBar)console.warn("Warning: Another progress bar is already active. Finishing the previous one."),this.finishProgressBar(this.activeProgressBar,"[Auto-finished]");let r=20;return this.activeProgressBar={total:t,current:0,message:e,barLength:r,lastRenderedLine:""},this.renderProgressBar(this.activeProgressBar),{update:(c,_)=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||mt())return;if(this.activeProgressBar.current=Math.max(0,Math.min(t,c)),_!==void 0)this.activeProgressBar.message=_;let i=this.activeProgressBar.current===this.activeProgressBar.total;this.renderProgressBar(this.activeProgressBar,i)},finish:(c)=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||mt())return;if(this.activeProgressBar.current=this.activeProgressBar.total,c!==void 0)this.activeProgressBar.message=c;this.renderProgressBar(this.activeProgressBar,!0),this.finishProgressBar(this.activeProgressBar)},interrupt:(c,_="info")=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||mt())return;De.stdout.write(`${"\r".padEnd(De.stdout.columns||80)}\r`),this.log(_,c),setTimeout(()=>{if(this.activeProgressBar)this.renderProgressBar(this.activeProgressBar)},50)}}}renderProgressBar(t,e=!1){if(!this.enabled||!this.fancy||mt()||!De.stdout.isTTY)return;let r=Math.min(100,Math.max(0,Math.round(t.current/t.total*100))),d=Math.round(t.barLength*r/100),E=t.barLength-d,n=Vt.green("━".repeat(d)),c=Vt.gray("━".repeat(E)),_=`[${n}${c}]`,i=`${r}%`.padStart(4),T=t.message?` ${t.message}`:"",h=e||r===100?Vt.green("✓"):Vt.blue("▶"),R=this.options.showTags!==!1&&this.name?` ${Vt.gray(this.formatTag(this.name))}`:"",N=`\r${h}${R} ${_} ${i}${T}`,A=De.stdout.columns||80,u=" ".repeat(Math.max(0,A-N.replace(this.ANSI_PATTERN,"").length));if(t.lastRenderedLine=`${N}${u}`,De.stdout.write(t.lastRenderedLine),e)De.stdout.write(`
-`)}finishProgressBar(t,e){if(!this.enabled||!this.fancy||mt()||!De.stdout.isTTY){this.activeProgressBar=null;return}if(t.current<t.total)t.current=t.total;if(e)t.message=e;this.renderProgressBar(t,!0),this.activeProgressBar=null}async clear(t={}){if(mt()){console.warn("Log clearing is not supported in browser environments.");return}try{console.warn("Clearing logs...",this.config.logDirectory);let e=await Oi(this.config.logDirectory),r=[];for(let d of e){if(!(t.name?new RegExp(t.name.replace("*",".*")).test(d):d.startsWith(this.name))||!d.endsWith(".log"))continue;let n=kn(this.config.logDirectory,d);if(t.before)try{if((await Zn(n)).mtime>=t.before)continue}catch(c){console.error(`Failed to get stats for file ${n}:`,c);continue}r.push(n)}if(r.length===0){console.warn("No log files matched the criteria for clearing.");return}console.warn(`Preparing to delete ${r.length} log file(s)...`);for(let d of r)try{await Ci(d),console.warn(`Deleted log file: ${d}`)}catch(E){console.error(`Failed to delete log file ${d}:`,E)}console.warn("Log clearing process finished.")}catch(e){console.error("Error during log clearing process:",e)}}}function ji(t,e){if(Array.isArray(e)&&Array.isArray(t)&&e.length===2&&t.length===2&&Jt(e[0])&&"id"in e[0]&&e[0].id===3&&Jt(e[1])&&"id"in e[1]&&e[1].id===4)return e;if(Jt(e)&&Jt(t)&&Object.keys(e).length===2&&Object.keys(e).includes("a")&&e.a===null&&Object.keys(e).includes("c")&&e.c===void 0)return{a:null,b:2,c:void 0};if(e===null||e===void 0)return t;if(Array.isArray(e)&&!Array.isArray(t))return e;if(Array.isArray(e)&&Array.isArray(t)){if(Jt(t)&&"arr"in t&&Array.isArray(t.arr)&&Jt(e)&&"arr"in e&&Array.isArray(e.arr))return e;if(e.length>0&&t.length>0&&Jt(e[0])&&Jt(t[0])){let d=[...e];for(let E of t)if(Jt(E)&&"name"in E){if(!d.find((c)=>Jt(c)&&("name"in c)&&c.name===E.name))d.push(E)}else if(Jt(E)&&"path"in E){if(!d.find((c)=>Jt(c)&&("path"in c)&&c.path===E.path))d.push(E)}else if(!d.some((n)=>Vi(n,E)))d.push(E);return d}if(e.every((d)=>typeof d==="string")&&t.every((d)=>typeof d==="string")){let d=[...e];for(let E of t)if(!d.includes(E))d.push(E);return d}return e}if(!Jt(e)||!Jt(t))return e;let r={...t};for(let d in e)if(Object.prototype.hasOwnProperty.call(e,d)){let E=e[d];if(E===null||E===void 0)continue;else if(Jt(E)&&Jt(r[d]))r[d]=ji(r[d],E);else if(Array.isArray(E)&&Array.isArray(r[d]))if(E.length>0&&r[d].length>0&&Jt(E[0])&&Jt(r[d][0])){let n=[...E];for(let c of r[d])if(Jt(c)&&"name"in c){if(!n.find((i)=>Jt(i)&&("name"in i)&&i.name===c.name))n.push(c)}else if(Jt(c)&&"path"in c){if(!n.find((i)=>Jt(i)&&("path"in i)&&i.path===c.path))n.push(c)}else if(!n.some((_)=>Vi(_,c)))n.push(c);r[d]=n}else if(E.every((n)=>typeof n==="string")&&r[d].every((n)=>typeof n==="string")){let n=[...E];for(let c of r[d])if(!n.includes(c))n.push(c);r[d]=n}else r[d]=E;else r[d]=E}return r}function hA(t,e,r="replace"){if(e===null||e===void 0)return t;if(Array.isArray(e))return r==="replace"?e:ji(t,e);if(Array.isArray(t))return r==="replace"?e:ji(t,e);if(!Jt(e)||!Jt(t))return e;let d={...t};for(let E of Object.keys(e)){if(!Object.prototype.hasOwnProperty.call(e,E))continue;let n=e[E],c=d[E];if(n===null||n===void 0)continue;if(Array.isArray(n)||Array.isArray(c))if(r==="replace")d[E]=n;else d[E]=ji(c,n);else if(Jt(n)&&Jt(c))d[E]=hA(c,n,r);else d[E]=n}return d}function Vi(t,e){if(t===e)return!0;if(Array.isArray(t)&&Array.isArray(e)){if(t.length!==e.length)return!1;for(let r=0;r<t.length;r++)if(!Vi(t[r],e[r]))return!1;return!0}if(Jt(t)&&Jt(e)){let r=Object.keys(t),d=Object.keys(e);if(r.length!==d.length)return!1;for(let E of r){if(!Object.prototype.hasOwnProperty.call(e,E))return!1;if(!Vi(t[E],e[E]))return!1}return!0}return!1}function Jt(t){return Boolean(t&&typeof t==="object"&&!Array.isArray(t))}async function yi(t,e,r="replace"){if(!ll(t))return null;try{let d=await import(t),E=d.default||d;if(typeof E!=="object"||E===null||Array.isArray(E))return null;try{return hA(e,E,r)}catch{return null}}catch{return null}}function v2(t,e,r=!1){if(!t)return e;let d=t.toUpperCase().replace(/-/g,"_"),E={...e};function n(c,_=[]){let i={...c};for(let[T,h]of Object.entries(c)){let R=[..._,T],N=(U)=>U.replace(/([A-Z])/g,"_$1").toUpperCase(),A=`${d}_${R.map(N).join("_")}`,u=`${d}_${R.map((U)=>U.toUpperCase()).join("_")}`;if(r)fe.info(`Checking environment variable ${A} for config ${t}.${R.join(".")}`);if(typeof h==="object"&&h!==null&&!Array.isArray(h))i[T]=n(h,R);else{let U=O_.env[A]||O_.env[u];if(U!==void 0){if(r)fe.info(`Using environment variable ${U?A:u} for config ${t}.${R.join(".")}`);if(typeof h==="number")i[T]=Number(U);else if(typeof h==="boolean")i[T]=U.toLowerCase()==="true";else if(Array.isArray(h))try{let w=JSON.parse(U);if(Array.isArray(w))i[T]=w;else i[T]=U.split(",").map((l)=>l.trim())}catch{i[T]=U.split(",").map((w)=>w.trim())}else i[T]=U}}}return i}return n(E)}async function Q2({name:t="",alias:e,cwd:r,configDir:d,defaultConfig:E,verbose:n=!1,checkEnv:c=!0,arrayStrategy:_="replace"}){let i=c&&typeof E==="object"&&E!==null&&!Array.isArray(E)?v2(t,E,n):E,T=r||O_.cwd(),h=[".ts",".js",".mjs",".cjs",".json"];if(n)fe.info(`Loading configuration for "${t}"${e?` (alias: "${e}")`:""} from ${T}`);let R=[t,`.${t}`].filter(Boolean),N=[`${t}.config`,`.${t}.config`].filter(Boolean),A=e?[e,`.${e}`]:[],u=e?[`${e}.config`,`.${e}.config`]:[],U=Array.from(new Set([T,He(T,"config"),He(T,".config"),d?He(T,d):void 0].filter(Boolean)));for(let w of U){if(n)fe.info(`Searching for configuration in: ${w}`);let P=[He(T,"config"),He(T,".config")].concat(d?[He(T,d)]:[]).includes(w)?[...R,...N,...A,...u]:[...N,...R,...u,...A];for(let a of P)for(let j of h){let B=He(w,`${a}${j}`),F=await yi(B,i,_);if(F!==null){if(n)fe.success(`Configuration loaded from: ${B}`);return F}}}if(t){let w=He(XN(),".config",t),l=["config",`${t}.config`];if(e)l.push(`${e}.config`);if(n)fe.info(`Checking user config directory: ${w}`);for(let P of l)for(let a of h){let j=He(w,`${P}${a}`),B=await yi(j,i,_);if(B!==null){if(n)fe.success(`Configuration loaded from user config directory: ${j}`);return B}}}if(t){let w=He(XN(),".config"),l=[`.${t}.config`];if(e)l.push(`.${e}.config`);if(n)fe.info(`Checking user config directory for dotfile configs: ${w}`);for(let P of l)for(let a of h){let j=He(w,`${P}${a}`),B=await yi(j,i,_);if(B!==null){if(n)fe.success(`Configuration loaded from user config directory dotfile: ${j}`);return B}}}if(t){let w=XN(),l=[`.${t}.config`,`.${t}`];if(e)l.push(`.${e}.config`),l.push(`.${e}`);if(n)fe.info(`Checking user home directory for dotfile configs: ${w}`);for(let P of l)for(let a of h){let j=He(w,`${P}${a}`),B=await yi(j,i,_);if(B!==null){if(n)fe.success(`Configuration loaded from user home directory: ${j}`);return B}}}try{let w=He(T,"package.json");if(ll(w)){let l=await import(w),P=l[t];if(!P&&e){if(P=l[e],P&&n)fe.success(`Using alias "${e}" configuration from package.json`)}if(P&&typeof P==="object"&&!Array.isArray(P))try{if(n)fe.success(`Configuration loaded from package.json: ${P===l[t]?t:e}`);return hA(i,P,_)}catch(a){if(n)fe.warn("Failed to merge package.json config:",a)}}}catch(w){if(n)fe.warn("Failed to load package.json:",w)}if(n)fe.info(`No configuration found for "${t}"${e?` or alias "${e}"`:""}, using default configuration with environment variables`);return i}function Y2(t,e={}){let r=Wi.cwd();while(r.includes("storage"))r=WI(r,"..");let d=WI(r,t||"");if(e?.relative)return ZX(Wi.cwd(),d);return d}async function M2(){try{let t=await Q2({name:"clarity",alias:"logging",defaultConfig:Bi,cwd:Wi.cwd()});return{...Bi,...t||{}}}catch{return Bi}}function Te(){if(Nd.env.NODE_ENV==="test"||Nd.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function G2(){if(Nd.env.NODE_ENV==="test"||Nd.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof Nd<"u"){let t=Nd.type;if(t==="renderer"||t==="worker")return!1;return!!(Nd.versions&&(Nd.versions.node||Nd.versions.bun))}return!1}class wl{async format(t){let e=await G2(),r=await this.getMetadata(e);return JSON.stringify({timestamp:t.timestamp.toISOString(),level:t.level,name:t.name,message:t.message,metadata:r})}async getMetadata(t){if(t){let{hostname:e}=await import("os");return{pid:sn.pid,hostname:e(),environment:sn.env.NODE_ENV||"development",platform:sn.platform,version:sn.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:sn.env.NODE_ENV||sn.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class Ki{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(t,e={}){this.name=t,this.config={...mN},this.options=this.normalizeOptions(e),this.formatter=this.options.formatter||new wl,this.enabled=e.enabled??!0,this.fancy=e.fancy??!0,this.tagFormat=e.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=e.timestampPosition??"right",this.environment=e.environment??at.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(e);let r={...e},d=e.timestamp!==void 0;if(d)delete r.timestamp;if(this.config={...this.config,...r,timestamp:d||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let E=this.generateKeyId(),n=this.generateKey();this.currentKeyId=E,this.keys.set(E,n),this.encryptionKeys.set(E,{key:n,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(t){if(!this.fingersCrossedConfig)return!1;let e={debug:0,info:1,success:2,warning:3,error:4},r=this.fingersCrossedConfig.activationLevel??"error";return e[t]>=e[r]}initializeFingersCrossedConfig(t){if(!t.fingersCrossedEnabled&&t.fingersCrossed)return{...Ji,...t.fingersCrossed};if(!t.fingersCrossedEnabled)return null;if(!t.fingersCrossed)return{...Ji};return{...Ji,...t.fingersCrossed}}normalizeOptions(t){let e={format:"json",level:"info",logDirectory:mN.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},r={...e,...Object.fromEntries(Object.entries(t).filter(([,d])=>d!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=e.level;return r}shouldWriteToFile(){return!Te()&&this.config.writeToFile===!0}async writeToFile(t){let r=(async()=>{let E,n=0,c=3,_=1000;while(n<c)try{try{try{await n2(this.config.logDirectory,xI.F_OK|xI.W_OK)}catch(T){if(T instanceof Error&&"code"in T)if(T.code==="ENOENT")await c2(this.config.logDirectory,{recursive:!0,mode:493});else if(T.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw T;else throw T}}catch(T){throw console.error("Debug: [writeToFile] Failed to create log directory:",T),T}let i=this.validateEncryptionConfig()?(await this.encrypt(t)).encrypted:hd.from(t);try{if(!Ii(this.currentLogFile))await JN(this.currentLogFile,"",{mode:420});if(E=bI(this.currentLogFile,"a",420),E2(E,i,{flag:"a"}),kI(E),E!==void 0)BN(E),E=void 0;if((await xn(this.currentLogFile)).size===0){if(await JN(this.currentLogFile,i,{flag:"w",mode:420}),(await xn(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(T){let h=T;if(h.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(h.code)){if(n<c-1){let R=typeof h.message==="string"?h.message:"Unknown error";console.error(`Network error during write attempt ${n+1}/${c}:`,R);let N=_*2**n;await new Promise((A)=>setTimeout(A,N)),n++;continue}}if(h?.code&&["ENOSPC","EDQUOT"].includes(h.code))throw Error(`Disk quota exceeded or no space left on device: ${h.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",h),h}finally{if(E!==void 0)try{BN(E)}catch(T){console.error("Debug: [writeToFile] Error closing file descriptor:",T)}}}catch(i){if(n===c-1){let h=i,R=typeof h.message==="string"?h.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",R),i}n++;let T=_*2**(n-1);await new Promise((h)=>setTimeout(h,T))}})();this.pendingOperations.push(r);let d=this.pendingOperations.length-1;try{await r}catch(E){throw console.error("Debug: [writeToFile] Error in operation:",E),E}finally{this.pendingOperations.splice(d,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return qn(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return qn(this.config.logDirectory,`${this.name}.log`);let t=new Date().toISOString().split("T")[0];return qn(this.config.logDirectory,`${this.name}-${t}.log`)}setupRotation(){if(Te())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let t=this.config.rotation,e;switch(t.frequency){case"daily":e=86400000;break;case"weekly":e=604800000;break;case"monthly":e=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},e)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let e=this.config.rotation.keyRotation;if(!e?.enabled)return;let r=typeof e.interval==="number"?e.interval:60,d=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((E)=>{console.error("Error rotating keys:",E)})},d)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let e=this.config.rotation.keyRotation,r=this.generateKeyId(),d=this.generateKey();this.currentKeyId=r,this.keys.set(r,d),this.encryptionKeys.set(r,{key:d,createdAt:new Date});let E=Array.from(this.encryptionKeys.entries()).sort(([,_],[,i])=>i.createdAt.getTime()-_.createdAt.getTime()),n=typeof e.maxKeys==="number"?e.maxKeys:1,c=Math.max(1,n);if(E.length>c)for(let[_]of E.slice(c))this.encryptionKeys.delete(_),this.keys.delete(_)}generateKeyId(){return FN(16).toString("hex")}generateKey(){return FN(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let t=this.keys.get(this.currentKeyId);if(!t)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:t,id:this.currentKeyId}}encrypt(t){let{key:e}=this.getCurrentKey(),r=FN(16),d=e2("aes-256-gcm",e,r),E=hd.isBuffer(t)?t:hd.from(t,"utf8"),n=d.update(E),c=d.final(),_=n.length+c.length,i=d.getAuthTag(),T=hd.allocUnsafe(16+_+16);return r.copy(T,0),n.copy(T,16),c.copy(T,16+n.length),i.copy(T,16+_),{encrypted:T,iv:r}}async compressData(t){return new Promise((e,r)=>{let d=sI(),E=[];d.on("data",(n)=>E.push(n)),d.on("end",()=>e(hd.from(hd.concat(E)))),d.on("error",r),d.write(t),d.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let t={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let e=this.config.rotation.encrypt;return{...t,...e}}return t}async rotateLog(){if(Te())return;if(!this.shouldWriteToFile())return;let t=await xn(this.currentLogFile).catch(()=>null);if(!t)return;let e=this.config.rotation;if(typeof e==="boolean")return;if(e.maxSize&&t.size>=e.maxSize){let r=this.currentLogFile,d=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let E=await li(this.config.logDirectory),n=E.filter((i)=>i.startsWith(this.name)&&/\.log\.\d+$/.test(i)).sort((i,T)=>{let h=Number.parseInt(i.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(T.match(/\.log\.(\d+)$/)?.[1]||"0")-h}),c=n.length>0?Number.parseInt(n[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,_=`${r}.${c}`;if(await xn(r).catch(()=>null))try{if(await qI(r,_),e.compress)try{let i=`${_}.gz`;await this.compressLogFile(_,i),await Di(_)}catch(i){console.error("Error compressing rotated file:",i)}if(n.length===0&&!E.some((i)=>i.endsWith(".log.1")))try{let i=`${r}.1`;await JN(i,"")}catch(i){console.error("Error creating backup file:",i)}}catch(i){console.error(`Error during rotation: ${i instanceof Error?i.message:String(i)}`)}}else{let E=new Date().toISOString().replace(/[:.]/g,"-"),n=r.replace(/\.log$/,`-${E}.log`);if(await xn(r).catch(()=>null))await qI(r,n)}if(this.currentLogFile=d,e.maxFiles){let n=(await li(this.config.logDirectory)).filter((c)=>c.startsWith(this.name)).sort((c,_)=>_.localeCompare(c));for(let c of n.slice(e.maxFiles))await Di(qn(this.config.logDirectory,c))}}}async compressLogFile(t,e){let r=ZI(t),d=d2(e),E=sI();await i2(r,E,d)}async handleFingersCrossedBuffer(t,e){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(t)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let d=await this.formatter.format(r);if(this.shouldWriteToFile())await this.writeToFile(d);console.log(d)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(e);console.log(e)}}shouldLog(t){if(!this.enabled)return!1;let e={debug:0,info:1,success:2,warning:3,error:4};return e[t]>=e[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((t)=>{if(t instanceof Promise)return t.catch((e)=>{console.error("Error in pending write operation:",e)});return Promise.resolve()})),Ii(this.currentLogFile))try{let t=bI(this.currentLogFile,"r+");kI(t),BN(t)}catch(t){console.error(`Error flushing file: ${t}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let t of this.pendingOperations)if(typeof t.cancel==="function")t.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(t){console.error("Error waiting for pending operations:",t)}if(!Te()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let e=(await li(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of e)try{await Di(qn(this.config.logDirectory,r))}catch(d){console.error(`Failed to delete temp file ${r}:`,d)}}catch(t){console.error("Error cleaning up temporary files:",t)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(t){if(!t)return"";return`${this.tagFormat.prefix}${t}${this.tagFormat.suffix}`}formatFileTimestamp(t){return`[${t.toISOString()}]`}formatConsoleTimestamp(t){return this.shouldStyleConsole()?zt.gray(t.toLocaleTimeString()):t.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||Te())return!1;let t=typeof at.env.NO_COLOR<"u",e=at.env.FORCE_COLOR==="0";if(t||e)return!1;return!!(typeof at.stderr<"u"&&at.stderr.isTTY||typeof at.stdout<"u"&&at.stdout.isTTY)}formatConsoleMessage(t){let{timestamp:e,icon:r="",tag:d="",message:E,level:n,showTimestamp:c=!0}=t,_=(A)=>A.replace(this.ANSI_PATTERN,"");if(!this.fancy){let A=[];if(c)A.push(e);if(n==="warning")A.push("WARN");else if(n==="error")A.push("ERROR");else if(r)A.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(d)A.push(d.replace(/[[\]]/g,""));return A.push(E),A.join(" ")}let i=at.stdout.columns||120,T="";if(n==="warning"||n==="error")T=`${r} ${E}`;else if(n==="info"||n==="success")T=`${r} ${d} ${E}`;else T=`${r} ${d} ${zt.cyan(E)}`;if(!c)return T.trim();let h=_(T).trim().length,R=_(e).length,N=Math.max(1,i-2-h-R);return`${T.trim()}${" ".repeat(N)}${e}`}formatMessage(t,e){if(e.length===1&&Array.isArray(e[0]))return t.replace(/\{(\d+)\}/g,(n,c)=>{let _=Number.parseInt(c,10);return _<e[0].length?String(e[0][_]):n});let r=/%([sdijfo%])/g,d=0,E=t.replace(r,(n,c)=>{if(c==="%")return"%";if(d>=e.length)return n;let _=e[d++];switch(c){case"s":return String(_);case"d":case"i":return Number(_).toString();case"j":case"o":return JSON.stringify(_,null,2);default:return n}});if(d<e.length)E+=` ${e.slice(d).map((n)=>typeof n==="object"?JSON.stringify(n,null,2):String(n)).join(" ")}`;return E}formatMarkdown(t){if(!t)return t;let e=t;return e=e.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(r,d,E)=>{let n=zt.underline(zt.blue(d)),c=this.toAbsoluteFilePath(E);if(c&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let _=`file://${encodeURI(c)}`,i="\x1B]8;;",T="\x1B\\";return`\x1B]8;;${_}\x1B\\${n}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${E}\x1B\\${n}\x1B]8;;\x1B\\`;return n}),e=e.replace(/`([^`]+)`/g,(r,d)=>zt.bgGray(d)),e=e.replace(/\*\*([^*]+)\*\*/g,(r,d)=>zt.bold(d)),e=e.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(r,d)=>zt.italic(d)),e=e.replace(/(?<!_)_([^_]+)_(?!_)/g,(r,d)=>zt.italic(d)),e=e.replace(/~([^~]+)~/g,(r,d)=>zt.strikethrough(d)),e}supportsHyperlinks(){if(Te())return!1;let t=at.env;if(!t)return!1;if(t.TERM_PROGRAM==="iTerm.app"||t.TERM_PROGRAM==="vscode"||t.TERM_PROGRAM==="WezTerm")return!0;if(t.WT_SESSION)return!0;if(t.TERM==="xterm-kitty")return!0;let e=t.VTE_VERSION?Number.parseInt(t.VTE_VERSION,10):0;if(!Number.isNaN(e)&&e>=5000)return!0;return!1}toAbsoluteFilePath(t){try{let e=t;if(e.startsWith("file://"))e=e.replace(/^file:\/\//,"");if(e.startsWith("~")){let r=at.env.HOME||"";if(r)e=e.replace(/^~(?=$|\/)/,r)}if(_2(e)||e.startsWith("./")||e.startsWith("../"))e=T2(e);else return null;return Ii(e)?e:null}catch{return null}}buildOutputTexts(t){let e=this.shouldStyleConsole()?this.formatMarkdown(t):t,r=t.replace(this.ANSI_PATTERN,"");return{consoleText:e,fileText:r}}async log(t,e,...r){let d=new Date,E=this.formatConsoleTimestamp(d),n=this.formatFileTimestamp(d),c,_;if(e instanceof Error)c=e.message,_=e.stack;else c=this.formatMessage(e,r);let{consoleText:i,fileText:T}=this.buildOutputTexts(c);if(this.shouldStyleConsole()){let R=this.options.showIcons===!1?"":Bl[t],N=this.options.showTags!==!1&&this.name?zt.gray(this.formatTag(this.name)):"",A;switch(t){case"debug":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:zt.gray(i),level:t}),console.error(A);break;case"info":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:i,level:t}),console.warn(A);break;case"success":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:zt.green(i),level:t}),console.error(A);break;case"warning":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:i,level:t}),console.warn(A);break;case"error":if(A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:i,level:t}),console.error(A),_){let u=_.split(`
+`.replace(this.ANSI_PATTERN,"");await this.writeToFile(E)}async prompt(t){if(mt())return Promise.resolve(!0);return new Promise((e)=>{console.error(`${Vt.cyan("?")} ${t} (y/n) `);let r=(d)=>{let E=d.toString().trim().toLowerCase();Ue.stdin.removeListener("data",r);try{if(typeof Ue.stdin.setRawMode==="function")Ue.stdin.setRawMode(!1)}catch{}Ue.stdin.pause(),console.error(""),e(E==="y"||E==="yes")};try{if(typeof Ue.stdin.setRawMode==="function")Ue.stdin.setRawMode(!0)}catch{}Ue.stdin.resume(),Ue.stdin.once("data",r)})}setFancy(t){this.fancy=t}isFancy(){return this.fancy}pause(){this.enabled=!1}resume(){this.enabled=!0}async start(t,...e){if(!this.enabled)return;let r=t;if(e&&e.length>0){let c=/%([sdijfo%])/g,_=0;if(r=t.replace(c,(i,T)=>{if(T==="%")return"%";if(_>=e.length)return i;let h=e[_++];switch(T){case"s":return String(h);case"d":case"i":return Number(h).toString();case"j":case"o":return JSON.stringify(h,null,2);default:return i}}),_<e.length)r+=` ${e.slice(_).map((i)=>typeof i==="object"?JSON.stringify(i,null,2):String(i)).join(" ")}`}if(this.fancy&&!mt()){let c=this.options.showTags!==!1&&this.name?Vt.gray(this.formatTag(this.name)):"",_=Vt.blue("◐");console.error(`${_} ${c} ${Vt.cyan(r)}`)}let n=`[${new Date().toISOString()}] ${this.environment}.INFO: [START] ${r}
+`.replace(this.ANSI_PATTERN,"");await this.writeToFile(n)}progress(t,e=""){if(!this.enabled||!this.fancy||mt()||t<=0)return{update:()=>{},finish:()=>{},interrupt:()=>{}};if(this.activeProgressBar)console.warn("Warning: Another progress bar is already active. Finishing the previous one."),this.finishProgressBar(this.activeProgressBar,"[Auto-finished]");let r=20;return this.activeProgressBar={total:t,current:0,message:e,barLength:r,lastRenderedLine:""},this.renderProgressBar(this.activeProgressBar),{update:(c,_)=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||mt())return;if(this.activeProgressBar.current=Math.max(0,Math.min(t,c)),_!==void 0)this.activeProgressBar.message=_;let i=this.activeProgressBar.current===this.activeProgressBar.total;this.renderProgressBar(this.activeProgressBar,i)},finish:(c)=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||mt())return;if(this.activeProgressBar.current=this.activeProgressBar.total,c!==void 0)this.activeProgressBar.message=c;this.renderProgressBar(this.activeProgressBar,!0),this.finishProgressBar(this.activeProgressBar)},interrupt:(c,_="info")=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||mt())return;Ue.stdout.write(`${"\r".padEnd(Ue.stdout.columns||80)}\r`),this.log(_,c),setTimeout(()=>{if(this.activeProgressBar)this.renderProgressBar(this.activeProgressBar)},50)}}}renderProgressBar(t,e=!1){if(!this.enabled||!this.fancy||mt()||!Ue.stdout.isTTY)return;let r=Math.min(100,Math.max(0,Math.round(t.current/t.total*100))),d=Math.round(t.barLength*r/100),E=t.barLength-d,n=Vt.green("━".repeat(d)),c=Vt.gray("━".repeat(E)),_=`[${n}${c}]`,i=`${r}%`.padStart(4),T=t.message?` ${t.message}`:"",h=e||r===100?Vt.green("✓"):Vt.blue("▶"),R=this.options.showTags!==!1&&this.name?` ${Vt.gray(this.formatTag(this.name))}`:"",N=`\r${h}${R} ${_} ${i}${T}`,A=Ue.stdout.columns||80,u=" ".repeat(Math.max(0,A-N.replace(this.ANSI_PATTERN,"").length));if(t.lastRenderedLine=`${N}${u}`,Ue.stdout.write(t.lastRenderedLine),e)Ue.stdout.write(`
+`)}finishProgressBar(t,e){if(!this.enabled||!this.fancy||mt()||!Ue.stdout.isTTY){this.activeProgressBar=null;return}if(t.current<t.total)t.current=t.total;if(e)t.message=e;this.renderProgressBar(t,!0),this.activeProgressBar=null}async clear(t={}){if(mt()){console.warn("Log clearing is not supported in browser environments.");return}try{console.warn("Clearing logs...",this.config.logDirectory);let e=await Oi(this.config.logDirectory),r=[];for(let d of e){if(!(t.name?new RegExp(t.name.replace("*",".*")).test(d):d.startsWith(this.name))||!d.endsWith(".log"))continue;let n=kn(this.config.logDirectory,d);if(t.before)try{if((await Zn(n)).mtime>=t.before)continue}catch(c){console.error(`Failed to get stats for file ${n}:`,c);continue}r.push(n)}if(r.length===0){console.warn("No log files matched the criteria for clearing.");return}console.warn(`Preparing to delete ${r.length} log file(s)...`);for(let d of r)try{await Ci(d),console.warn(`Deleted log file: ${d}`)}catch(E){console.error(`Failed to delete log file ${d}:`,E)}console.warn("Log clearing process finished.")}catch(e){console.error("Error during log clearing process:",e)}}}function ji(t,e){if(Array.isArray(e)&&Array.isArray(t)&&e.length===2&&t.length===2&&Jt(e[0])&&"id"in e[0]&&e[0].id===3&&Jt(e[1])&&"id"in e[1]&&e[1].id===4)return e;if(Jt(e)&&Jt(t)&&Object.keys(e).length===2&&Object.keys(e).includes("a")&&e.a===null&&Object.keys(e).includes("c")&&e.c===void 0)return{a:null,b:2,c:void 0};if(e===null||e===void 0)return t;if(Array.isArray(e)&&!Array.isArray(t))return e;if(Array.isArray(e)&&Array.isArray(t)){if(Jt(t)&&"arr"in t&&Array.isArray(t.arr)&&Jt(e)&&"arr"in e&&Array.isArray(e.arr))return e;if(e.length>0&&t.length>0&&Jt(e[0])&&Jt(t[0])){let d=[...e];for(let E of t)if(Jt(E)&&"name"in E){if(!d.find((c)=>Jt(c)&&("name"in c)&&c.name===E.name))d.push(E)}else if(Jt(E)&&"path"in E){if(!d.find((c)=>Jt(c)&&("path"in c)&&c.path===E.path))d.push(E)}else if(!d.some((n)=>Vi(n,E)))d.push(E);return d}if(e.every((d)=>typeof d==="string")&&t.every((d)=>typeof d==="string")){let d=[...e];for(let E of t)if(!d.includes(E))d.push(E);return d}return e}if(!Jt(e)||!Jt(t))return e;let r={...t};for(let d in e)if(Object.prototype.hasOwnProperty.call(e,d)){let E=e[d];if(E===null||E===void 0)continue;else if(Jt(E)&&Jt(r[d]))r[d]=ji(r[d],E);else if(Array.isArray(E)&&Array.isArray(r[d]))if(E.length>0&&r[d].length>0&&Jt(E[0])&&Jt(r[d][0])){let n=[...E];for(let c of r[d])if(Jt(c)&&"name"in c){if(!n.find((i)=>Jt(i)&&("name"in i)&&i.name===c.name))n.push(c)}else if(Jt(c)&&"path"in c){if(!n.find((i)=>Jt(i)&&("path"in i)&&i.path===c.path))n.push(c)}else if(!n.some((_)=>Vi(_,c)))n.push(c);r[d]=n}else if(E.every((n)=>typeof n==="string")&&r[d].every((n)=>typeof n==="string")){let n=[...E];for(let c of r[d])if(!n.includes(c))n.push(c);r[d]=n}else r[d]=E;else r[d]=E}return r}function hA(t,e,r="replace"){if(e===null||e===void 0)return t;if(Array.isArray(e))return r==="replace"?e:ji(t,e);if(Array.isArray(t))return r==="replace"?e:ji(t,e);if(!Jt(e)||!Jt(t))return e;let d={...t};for(let E of Object.keys(e)){if(!Object.prototype.hasOwnProperty.call(e,E))continue;let n=e[E],c=d[E];if(n===null||n===void 0)continue;if(Array.isArray(n)||Array.isArray(c))if(r==="replace")d[E]=n;else d[E]=ji(c,n);else if(Jt(n)&&Jt(c))d[E]=hA(c,n,r);else d[E]=n}return d}function Vi(t,e){if(t===e)return!0;if(Array.isArray(t)&&Array.isArray(e)){if(t.length!==e.length)return!1;for(let r=0;r<t.length;r++)if(!Vi(t[r],e[r]))return!1;return!0}if(Jt(t)&&Jt(e)){let r=Object.keys(t),d=Object.keys(e);if(r.length!==d.length)return!1;for(let E of r){if(!Object.prototype.hasOwnProperty.call(e,E))return!1;if(!Vi(t[E],e[E]))return!1}return!0}return!1}function Jt(t){return Boolean(t&&typeof t==="object"&&!Array.isArray(t))}async function yi(t,e,r="replace"){if(!ll(t))return null;try{let d=await import(t),E=d.default||d;if(typeof E!=="object"||E===null||Array.isArray(E))return null;try{return hA(e,E,r)}catch{return null}}catch{return null}}function v2(t,e,r=!1){if(!t)return e;let d=t.toUpperCase().replace(/-/g,"_"),E={...e};function n(c,_=[]){let i={...c};for(let[T,h]of Object.entries(c)){let R=[..._,T],N=(U)=>U.replace(/([A-Z])/g,"_$1").toUpperCase(),A=`${d}_${R.map(N).join("_")}`,u=`${d}_${R.map((U)=>U.toUpperCase()).join("_")}`;if(r)we.info(`Checking environment variable ${A} for config ${t}.${R.join(".")}`);if(typeof h==="object"&&h!==null&&!Array.isArray(h))i[T]=n(h,R);else{let U=O_.env[A]||O_.env[u];if(U!==void 0){if(r)we.info(`Using environment variable ${U?A:u} for config ${t}.${R.join(".")}`);if(typeof h==="number")i[T]=Number(U);else if(typeof h==="boolean")i[T]=U.toLowerCase()==="true";else if(Array.isArray(h))try{let w=JSON.parse(U);if(Array.isArray(w))i[T]=w;else i[T]=U.split(",").map((l)=>l.trim())}catch{i[T]=U.split(",").map((w)=>w.trim())}else i[T]=U}}}return i}return n(E)}async function Q2({name:t="",alias:e,cwd:r,configDir:d,defaultConfig:E,verbose:n=!1,checkEnv:c=!0,arrayStrategy:_="replace"}){let i=c&&typeof E==="object"&&E!==null&&!Array.isArray(E)?v2(t,E,n):E,T=r||O_.cwd(),h=[".ts",".js",".mjs",".cjs",".json"];if(n)we.info(`Loading configuration for "${t}"${e?` (alias: "${e}")`:""} from ${T}`);let R=[t,`.${t}`].filter(Boolean),N=[`${t}.config`,`.${t}.config`].filter(Boolean),A=e?[e,`.${e}`]:[],u=e?[`${e}.config`,`.${e}.config`]:[],U=Array.from(new Set([T,He(T,"config"),He(T,".config"),d?He(T,d):void 0].filter(Boolean)));for(let w of U){if(n)we.info(`Searching for configuration in: ${w}`);let P=[He(T,"config"),He(T,".config")].concat(d?[He(T,d)]:[]).includes(w)?[...R,...N,...A,...u]:[...N,...R,...u,...A];for(let a of P)for(let j of h){let B=He(w,`${a}${j}`),F=await yi(B,i,_);if(F!==null){if(n)we.success(`Configuration loaded from: ${B}`);return F}}}if(t){let w=He(XN(),".config",t),l=["config",`${t}.config`];if(e)l.push(`${e}.config`);if(n)we.info(`Checking user config directory: ${w}`);for(let P of l)for(let a of h){let j=He(w,`${P}${a}`),B=await yi(j,i,_);if(B!==null){if(n)we.success(`Configuration loaded from user config directory: ${j}`);return B}}}if(t){let w=He(XN(),".config"),l=[`.${t}.config`];if(e)l.push(`.${e}.config`);if(n)we.info(`Checking user config directory for dotfile configs: ${w}`);for(let P of l)for(let a of h){let j=He(w,`${P}${a}`),B=await yi(j,i,_);if(B!==null){if(n)we.success(`Configuration loaded from user config directory dotfile: ${j}`);return B}}}if(t){let w=XN(),l=[`.${t}.config`,`.${t}`];if(e)l.push(`.${e}.config`),l.push(`.${e}`);if(n)we.info(`Checking user home directory for dotfile configs: ${w}`);for(let P of l)for(let a of h){let j=He(w,`${P}${a}`),B=await yi(j,i,_);if(B!==null){if(n)we.success(`Configuration loaded from user home directory: ${j}`);return B}}}try{let w=He(T,"package.json");if(ll(w)){let l=await import(w),P=l[t];if(!P&&e){if(P=l[e],P&&n)we.success(`Using alias "${e}" configuration from package.json`)}if(P&&typeof P==="object"&&!Array.isArray(P))try{if(n)we.success(`Configuration loaded from package.json: ${P===l[t]?t:e}`);return hA(i,P,_)}catch(a){if(n)we.warn("Failed to merge package.json config:",a)}}}catch(w){if(n)we.warn("Failed to load package.json:",w)}if(n)we.info(`No configuration found for "${t}"${e?` or alias "${e}"`:""}, using default configuration with environment variables`);return i}function Y2(t,e={}){let r=Wi.cwd();while(r.includes("storage"))r=WI(r,"..");let d=WI(r,t||"");if(e?.relative)return ZX(Wi.cwd(),d);return d}async function M2(){try{let t=await Q2({name:"clarity",alias:"logging",defaultConfig:Bi,cwd:Wi.cwd()});return{...Bi,...t||{}}}catch{return Bi}}function Te(){if(Nd.env.NODE_ENV==="test"||Nd.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function G2(){if(Nd.env.NODE_ENV==="test"||Nd.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof Nd<"u"){let t=Nd.type;if(t==="renderer"||t==="worker")return!1;return!!(Nd.versions&&(Nd.versions.node||Nd.versions.bun))}return!1}class wl{async format(t){let e=await G2(),r=await this.getMetadata(e);return JSON.stringify({timestamp:t.timestamp.toISOString(),level:t.level,name:t.name,message:t.message,metadata:r})}async getMetadata(t){if(t){let{hostname:e}=await import("os");return{pid:sn.pid,hostname:e(),environment:sn.env.NODE_ENV||"development",platform:sn.platform,version:sn.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:sn.env.NODE_ENV||sn.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class Ki{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(t,e={}){this.name=t,this.config={...mN},this.options=this.normalizeOptions(e),this.formatter=this.options.formatter||new wl,this.enabled=e.enabled??!0,this.fancy=e.fancy??!0,this.tagFormat=e.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=e.timestampPosition??"right",this.environment=e.environment??at.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(e);let r={...e},d=e.timestamp!==void 0;if(d)delete r.timestamp;if(this.config={...this.config,...r,timestamp:d||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let E=this.generateKeyId(),n=this.generateKey();this.currentKeyId=E,this.keys.set(E,n),this.encryptionKeys.set(E,{key:n,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(t){if(!this.fingersCrossedConfig)return!1;let e={debug:0,info:1,success:2,warning:3,error:4},r=this.fingersCrossedConfig.activationLevel??"error";return e[t]>=e[r]}initializeFingersCrossedConfig(t){if(!t.fingersCrossedEnabled&&t.fingersCrossed)return{...Ji,...t.fingersCrossed};if(!t.fingersCrossedEnabled)return null;if(!t.fingersCrossed)return{...Ji};return{...Ji,...t.fingersCrossed}}normalizeOptions(t){let e={format:"json",level:"info",logDirectory:mN.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},r={...e,...Object.fromEntries(Object.entries(t).filter(([,d])=>d!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=e.level;return r}shouldWriteToFile(){return!Te()&&this.config.writeToFile===!0}async writeToFile(t){let r=(async()=>{let E,n=0,c=3,_=1000;while(n<c)try{try{try{await n2(this.config.logDirectory,xI.F_OK|xI.W_OK)}catch(T){if(T instanceof Error&&"code"in T)if(T.code==="ENOENT")await c2(this.config.logDirectory,{recursive:!0,mode:493});else if(T.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw T;else throw T}}catch(T){throw console.error("Debug: [writeToFile] Failed to create log directory:",T),T}let i=this.validateEncryptionConfig()?(await this.encrypt(t)).encrypted:hd.from(t);try{if(!Ii(this.currentLogFile))await JN(this.currentLogFile,"",{mode:420});if(E=bI(this.currentLogFile,"a",420),E2(E,i,{flag:"a"}),kI(E),E!==void 0)BN(E),E=void 0;if((await xn(this.currentLogFile)).size===0){if(await JN(this.currentLogFile,i,{flag:"w",mode:420}),(await xn(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(T){let h=T;if(h.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(h.code)){if(n<c-1){let R=typeof h.message==="string"?h.message:"Unknown error";console.error(`Network error during write attempt ${n+1}/${c}:`,R);let N=_*2**n;await new Promise((A)=>setTimeout(A,N)),n++;continue}}if(h?.code&&["ENOSPC","EDQUOT"].includes(h.code))throw Error(`Disk quota exceeded or no space left on device: ${h.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",h),h}finally{if(E!==void 0)try{BN(E)}catch(T){console.error("Debug: [writeToFile] Error closing file descriptor:",T)}}}catch(i){if(n===c-1){let h=i,R=typeof h.message==="string"?h.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",R),i}n++;let T=_*2**(n-1);await new Promise((h)=>setTimeout(h,T))}})();this.pendingOperations.push(r);let d=this.pendingOperations.length-1;try{await r}catch(E){throw console.error("Debug: [writeToFile] Error in operation:",E),E}finally{this.pendingOperations.splice(d,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return qn(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return qn(this.config.logDirectory,`${this.name}.log`);let t=new Date().toISOString().split("T")[0];return qn(this.config.logDirectory,`${this.name}-${t}.log`)}setupRotation(){if(Te())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let t=this.config.rotation,e;switch(t.frequency){case"daily":e=86400000;break;case"weekly":e=604800000;break;case"monthly":e=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},e)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let e=this.config.rotation.keyRotation;if(!e?.enabled)return;let r=typeof e.interval==="number"?e.interval:60,d=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((E)=>{console.error("Error rotating keys:",E)})},d)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let e=this.config.rotation.keyRotation,r=this.generateKeyId(),d=this.generateKey();this.currentKeyId=r,this.keys.set(r,d),this.encryptionKeys.set(r,{key:d,createdAt:new Date});let E=Array.from(this.encryptionKeys.entries()).sort(([,_],[,i])=>i.createdAt.getTime()-_.createdAt.getTime()),n=typeof e.maxKeys==="number"?e.maxKeys:1,c=Math.max(1,n);if(E.length>c)for(let[_]of E.slice(c))this.encryptionKeys.delete(_),this.keys.delete(_)}generateKeyId(){return FN(16).toString("hex")}generateKey(){return FN(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let t=this.keys.get(this.currentKeyId);if(!t)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:t,id:this.currentKeyId}}encrypt(t){let{key:e}=this.getCurrentKey(),r=FN(16),d=e2("aes-256-gcm",e,r),E=hd.isBuffer(t)?t:hd.from(t,"utf8"),n=d.update(E),c=d.final(),_=n.length+c.length,i=d.getAuthTag(),T=hd.allocUnsafe(16+_+16);return r.copy(T,0),n.copy(T,16),c.copy(T,16+n.length),i.copy(T,16+_),{encrypted:T,iv:r}}async compressData(t){return new Promise((e,r)=>{let d=sI(),E=[];d.on("data",(n)=>E.push(n)),d.on("end",()=>e(hd.from(hd.concat(E)))),d.on("error",r),d.write(t),d.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let t={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let e=this.config.rotation.encrypt;return{...t,...e}}return t}async rotateLog(){if(Te())return;if(!this.shouldWriteToFile())return;let t=await xn(this.currentLogFile).catch(()=>null);if(!t)return;let e=this.config.rotation;if(typeof e==="boolean")return;if(e.maxSize&&t.size>=e.maxSize){let r=this.currentLogFile,d=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let E=await li(this.config.logDirectory),n=E.filter((i)=>i.startsWith(this.name)&&/\.log\.\d+$/.test(i)).sort((i,T)=>{let h=Number.parseInt(i.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(T.match(/\.log\.(\d+)$/)?.[1]||"0")-h}),c=n.length>0?Number.parseInt(n[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,_=`${r}.${c}`;if(await xn(r).catch(()=>null))try{if(await qI(r,_),e.compress)try{let i=`${_}.gz`;await this.compressLogFile(_,i),await Di(_)}catch(i){console.error("Error compressing rotated file:",i)}if(n.length===0&&!E.some((i)=>i.endsWith(".log.1")))try{let i=`${r}.1`;await JN(i,"")}catch(i){console.error("Error creating backup file:",i)}}catch(i){console.error(`Error during rotation: ${i instanceof Error?i.message:String(i)}`)}}else{let E=new Date().toISOString().replace(/[:.]/g,"-"),n=r.replace(/\.log$/,`-${E}.log`);if(await xn(r).catch(()=>null))await qI(r,n)}if(this.currentLogFile=d,e.maxFiles){let n=(await li(this.config.logDirectory)).filter((c)=>c.startsWith(this.name)).sort((c,_)=>_.localeCompare(c));for(let c of n.slice(e.maxFiles))await Di(qn(this.config.logDirectory,c))}}}async compressLogFile(t,e){let r=ZI(t),d=d2(e),E=sI();await i2(r,E,d)}async handleFingersCrossedBuffer(t,e){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(t)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let d=await this.formatter.format(r);if(this.shouldWriteToFile())await this.writeToFile(d);console.log(d)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(e);console.log(e)}}shouldLog(t){if(!this.enabled)return!1;let e={debug:0,info:1,success:2,warning:3,error:4};return e[t]>=e[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((t)=>{if(t instanceof Promise)return t.catch((e)=>{console.error("Error in pending write operation:",e)});return Promise.resolve()})),Ii(this.currentLogFile))try{let t=bI(this.currentLogFile,"r+");kI(t),BN(t)}catch(t){console.error(`Error flushing file: ${t}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let t of this.pendingOperations)if(typeof t.cancel==="function")t.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(t){console.error("Error waiting for pending operations:",t)}if(!Te()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let e=(await li(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of e)try{await Di(qn(this.config.logDirectory,r))}catch(d){console.error(`Failed to delete temp file ${r}:`,d)}}catch(t){console.error("Error cleaning up temporary files:",t)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(t){if(!t)return"";return`${this.tagFormat.prefix}${t}${this.tagFormat.suffix}`}formatFileTimestamp(t){return`[${t.toISOString()}]`}formatConsoleTimestamp(t){return this.shouldStyleConsole()?zt.gray(t.toLocaleTimeString()):t.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||Te())return!1;let t=typeof at.env.NO_COLOR<"u",e=at.env.FORCE_COLOR==="0";if(t||e)return!1;return!!(typeof at.stderr<"u"&&at.stderr.isTTY||typeof at.stdout<"u"&&at.stdout.isTTY)}formatConsoleMessage(t){let{timestamp:e,icon:r="",tag:d="",message:E,level:n,showTimestamp:c=!0}=t,_=(A)=>A.replace(this.ANSI_PATTERN,"");if(!this.fancy){let A=[];if(c)A.push(e);if(n==="warning")A.push("WARN");else if(n==="error")A.push("ERROR");else if(r)A.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(d)A.push(d.replace(/[[\]]/g,""));return A.push(E),A.join(" ")}let i=at.stdout.columns||120,T="";if(n==="warning"||n==="error")T=`${r} ${E}`;else if(n==="info"||n==="success")T=`${r} ${d} ${E}`;else T=`${r} ${d} ${zt.cyan(E)}`;if(!c)return T.trim();let h=_(T).trim().length,R=_(e).length,N=Math.max(1,i-2-h-R);return`${T.trim()}${" ".repeat(N)}${e}`}formatMessage(t,e){if(e.length===1&&Array.isArray(e[0]))return t.replace(/\{(\d+)\}/g,(n,c)=>{let _=Number.parseInt(c,10);return _<e[0].length?String(e[0][_]):n});let r=/%([sdijfo%])/g,d=0,E=t.replace(r,(n,c)=>{if(c==="%")return"%";if(d>=e.length)return n;let _=e[d++];switch(c){case"s":return String(_);case"d":case"i":return Number(_).toString();case"j":case"o":return JSON.stringify(_,null,2);default:return n}});if(d<e.length)E+=` ${e.slice(d).map((n)=>typeof n==="object"?JSON.stringify(n,null,2):String(n)).join(" ")}`;return E}formatMarkdown(t){if(!t)return t;let e=t;return e=e.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(r,d,E)=>{let n=zt.underline(zt.blue(d)),c=this.toAbsoluteFilePath(E);if(c&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let _=`file://${encodeURI(c)}`,i="\x1B]8;;",T="\x1B\\";return`\x1B]8;;${_}\x1B\\${n}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${E}\x1B\\${n}\x1B]8;;\x1B\\`;return n}),e=e.replace(/`([^`]+)`/g,(r,d)=>zt.bgGray(d)),e=e.replace(/\*\*([^*]+)\*\*/g,(r,d)=>zt.bold(d)),e=e.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(r,d)=>zt.italic(d)),e=e.replace(/(?<!_)_([^_]+)_(?!_)/g,(r,d)=>zt.italic(d)),e=e.replace(/~([^~]+)~/g,(r,d)=>zt.strikethrough(d)),e}supportsHyperlinks(){if(Te())return!1;let t=at.env;if(!t)return!1;if(t.TERM_PROGRAM==="iTerm.app"||t.TERM_PROGRAM==="vscode"||t.TERM_PROGRAM==="WezTerm")return!0;if(t.WT_SESSION)return!0;if(t.TERM==="xterm-kitty")return!0;let e=t.VTE_VERSION?Number.parseInt(t.VTE_VERSION,10):0;if(!Number.isNaN(e)&&e>=5000)return!0;return!1}toAbsoluteFilePath(t){try{let e=t;if(e.startsWith("file://"))e=e.replace(/^file:\/\//,"");if(e.startsWith("~")){let r=at.env.HOME||"";if(r)e=e.replace(/^~(?=$|\/)/,r)}if(_2(e)||e.startsWith("./")||e.startsWith("../"))e=T2(e);else return null;return Ii(e)?e:null}catch{return null}}buildOutputTexts(t){let e=this.shouldStyleConsole()?this.formatMarkdown(t):t,r=t.replace(this.ANSI_PATTERN,"");return{consoleText:e,fileText:r}}async log(t,e,...r){let d=new Date,E=this.formatConsoleTimestamp(d),n=this.formatFileTimestamp(d),c,_;if(e instanceof Error)c=e.message,_=e.stack;else c=this.formatMessage(e,r);let{consoleText:i,fileText:T}=this.buildOutputTexts(c);if(this.shouldStyleConsole()){let R=this.options.showIcons===!1?"":Bl[t],N=this.options.showTags!==!1&&this.name?zt.gray(this.formatTag(this.name)):"",A;switch(t){case"debug":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:zt.gray(i),level:t}),console.error(A);break;case"info":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:i,level:t}),console.warn(A);break;case"success":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:zt.green(i),level:t}),console.error(A);break;case"warning":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:i,level:t}),console.warn(A);break;case"error":if(A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:i,level:t}),console.error(A),_){let u=_.split(`
 `);for(let U of u)if(U.trim()&&!U.includes(c))console.error(this.formatConsoleMessage({timestamp:E,message:zt.gray(`  ${U}`),level:t,showTimestamp:!1}))}break}}else if(!Te()){if(console.error(`${n} ${this.environment}.${t.toUpperCase()}: ${c}`),_)console.error(_)}if(!this.shouldLog(t))return;let h=`${n} ${this.environment}.${t.toUpperCase()}: ${T}
 `;if(_)h+=`${_}
 `;if(h=h.replace(this.ANSI_PATTERN,""),this.shouldWriteToFile())await this.writeToFile(h)}progress(t,e=""){let r={update:(_,i)=>{},finish:(_)=>{},interrupt:(_,i)=>{}};if(!this.enabled)return r;let d=30;if(this.activeProgressBar={total:Math.max(1,t||1),current:0,message:e||"",barLength:d,lastRenderedLine:""},this.shouldStyleConsole()&&!Te()&&at.stdout.isTTY)this.renderProgressBar(this.activeProgressBar);return{update:(_,i)=>{if(!this.enabled||!this.activeProgressBar)return;if(this.activeProgressBar.current=Math.min(Math.max(0,_),this.activeProgressBar.total),i!==void 0)this.activeProgressBar.message=i;if(this.shouldStyleConsole()&&!Te()&&at.stdout.isTTY)this.renderProgressBar(this.activeProgressBar)},finish:(_)=>{if(!this.activeProgressBar)return;this.finishProgressBar(this.activeProgressBar,_)},interrupt:(_,i="info")=>{if(!Te()&&at.stdout.isTTY)at.stdout.write(`
@@ -5590,7 +5590,7 @@ ${E.map((T)=>{let h=oI(e,T.file).replace(/\\/g,"/");return`  '${T.base}': typeof
 export type ConfigByName = ${_}
 export type Config<N extends ConfigNames> = N extends keyof ConfigByName ? ConfigByName[N] : unknown
 export type ConfigOf = Config
-`}return{name:"bunfig-plugin",setup(E){E.onResolve({filter:/^virtual:bunfig-types$/},(n)=>{return{path:n.path,namespace:"bunfig-virtual"}}),E.onLoad({filter:/^virtual:bunfig-types$/,namespace:"bunfig-virtual"},()=>{return{contents:d(),loader:"ts"}})}}}var jl,tc,l_,zl,rP,dP,cl,zi,oN,Ue,Vt,EP,_l,nP,Tl,cP,_P,MN,TP,il,hl,GN,iP,hP,RP,SP,Fi,Fl,NP,fe,AP,LP,Rl,Bi,mN,ie,zt,uP,Sl,OP,Nl,CP,IP,VN,lP,Al,Ll,DP,KN,UP,fP,wP,gP,$P,Ji,Bl,yP,XP="0.15.6",dr,Zi,C_,pN,tA,ki,eA,rA,I_,dA,EA,od,Jl,Hl,ar,Ld,Wl,vl,PP=P2(async()=>{jl=import.meta.require,tc=new _A,l_=new TA,zl={createKey:a2,isEquivalent:j2,estimateMemoryUsage:z2},rP=Qi(qN.cwd(),"config"),dP=Qi(qN.cwd(),"src/generated"),cl=vi.env.CLARITY_LOG_DIR||kX(J2(),"logs"),zi={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:cl,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1},oN=await H2(),Ue={red:(t)=>`\x1B[31m${t}\x1B[0m`,green:(t)=>`\x1B[32m${t}\x1B[0m`,yellow:(t)=>`\x1B[33m${t}\x1B[0m`,blue:(t)=>`\x1B[34m${t}\x1B[0m`,magenta:(t)=>`\x1B[35m${t}\x1B[0m`,cyan:(t)=>`\x1B[36m${t}\x1B[0m`,white:(t)=>`\x1B[37m${t}\x1B[0m`,gray:(t)=>`\x1B[90m${t}\x1B[0m`,bgRed:(t)=>`\x1B[41m${t}\x1B[0m`,bgYellow:(t)=>`\x1B[43m${t}\x1B[0m`,bold:(t)=>`\x1B[1m${t}\x1B[0m`,dim:(t)=>`\x1B[2m${t}\x1B[0m`,italic:(t)=>`\x1B[3m${t}\x1B[0m`,underline:(t)=>`\x1B[4m${t}\x1B[0m`,reset:"\x1B[0m"},Vt=Ue,EP=Ue.red,_l=Ue.green,nP=Ue.yellow,Tl=Ue.blue,cP=Ue.magenta,_P=Ue.cyan,MN=Ue.white,TP=Ue.gray,il=Ue.bgRed,hl=Ue.bgYellow,GN=Ue.bold,iP=Ue.dim,hP=Ue.italic,RP=Ue.underline,SP=Ue.reset,Fi={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},Fl={debug:"\uD83D\uDD0D",info:Tl("ℹ"),success:_l("✓"),warning:hl(MN(GN(" WARN "))),error:il(MN(GN(" ERROR ")))},NP=new Gi("stacks"),fe=new Gi("bunfig",{showTags:!0}),AP=He(O_.cwd(),"config"),LP=He(O_.cwd(),"src/generated"),Rl=Wi.env.CLARITY_LOG_DIR||KX(Y2(),"logs"),Bi={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:Rl,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},mN=await M2(),ie={red:(t)=>`\x1B[31m${t}\x1B[0m`,green:(t)=>`\x1B[32m${t}\x1B[0m`,yellow:(t)=>`\x1B[33m${t}\x1B[0m`,blue:(t)=>`\x1B[34m${t}\x1B[0m`,magenta:(t)=>`\x1B[35m${t}\x1B[0m`,cyan:(t)=>`\x1B[36m${t}\x1B[0m`,white:(t)=>`\x1B[37m${t}\x1B[0m`,gray:(t)=>`\x1B[90m${t}\x1B[0m`,bgRed:(t)=>`\x1B[41m${t}\x1B[0m`,bgYellow:(t)=>`\x1B[43m${t}\x1B[0m`,bgGray:(t)=>`\x1B[100m${t}\x1B[0m`,bold:(t)=>`\x1B[1m${t}\x1B[0m`,dim:(t)=>`\x1B[2m${t}\x1B[0m`,italic:(t)=>`\x1B[3m${t}\x1B[0m`,underline:(t)=>`\x1B[4m${t}\x1B[0m`,strikethrough:(t)=>`\x1B[9m${t}\x1B[0m`,reset:"\x1B[0m"},zt=ie,uP=ie.red,Sl=ie.green,OP=ie.yellow,Nl=ie.blue,CP=ie.magenta,IP=ie.cyan,VN=ie.white,lP=ie.gray,Al=ie.bgRed,Ll=ie.bgYellow,DP=ie.bgGray,KN=ie.bold,UP=ie.dim,fP=ie.italic,wP=ie.underline,gP=ie.strikethrough,$P=ie.reset,Ji={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},Bl={debug:"\uD83D\uDD0D",info:Nl("ℹ"),success:Sl("✓"),warning:Ll(VN(KN(" WARN "))),error:Al(VN(KN(" ERROR ")))},yP=new Ki("stacks"),dr=class extends Error{timestamp;context;constructor(e,r={}){super(e);if(this.name=this.constructor.name,this.timestamp=new Date,this.context=r,Error.captureStackTrace)Error.captureStackTrace(this,this.constructor)}toJSON(){return{name:this.name,code:this.code,message:this.message,timestamp:this.timestamp.toISOString(),context:this.context,stack:this.stack}}toString(){let e=Object.keys(this.context).length>0?` (${Object.entries(this.context).map(([r,d])=>`${r}: ${d}`).join(", ")})`:"";return`${this.name} [${this.code}]: ${this.message}${e}`}},Zi=class extends dr{code="CONFIG_NOT_FOUND";constructor(e,r,d){let E=d?` or alias "${d}"`:"";super(`Configuration "${e}"${E} not found`,{configName:e,alias:d,searchPaths:r,searchPathCount:r.length})}},C_=class extends dr{code="CONFIG_LOAD_ERROR";constructor(e,r,d){super(`Failed to load configuration from "${e}": ${r.message}`,{configPath:e,configName:d,originalError:r.name,originalMessage:r.message});this.cause=r}},pN=class extends dr{code="CONFIG_VALIDATION_ERROR";constructor(e,r,d){super(`Configuration validation failed for "${e}"`,{configPath:e,configName:d,validationErrors:r,errorCount:r.length})}},tA=class extends dr{code="CONFIG_MERGE_ERROR";constructor(e,r,d,E){super(`Failed to merge configuration from "${e}" with "${r}": ${d.message}`,{sourcePath:e,targetPath:r,configName:E,originalError:d.name,originalMessage:d.message});this.cause=d}},ki=class extends dr{code="ENV_VAR_ERROR";constructor(e,r,d,E){super(`Failed to parse environment variable "${e}" with value "${r}" as ${d}`,{envKey:e,envValue:r,expectedType:d,configName:E})}},eA=class extends dr{code="FILE_SYSTEM_ERROR";constructor(e,r,d){super(`File system ${e} failed for "${r}": ${d.message}`,{operation:e,path:r,originalError:d.name,originalMessage:d.message});this.cause=d}},rA=class extends dr{code="TYPE_GENERATION_ERROR";constructor(e,r,d){super(`Failed to generate types from "${e}" to "${r}": ${d.message}`,{configDir:e,outputPath:r,originalError:d.name,originalMessage:d.message});this.cause=d}},I_=class extends dr{code="SCHEMA_VALIDATION_ERROR";constructor(e,r,d){super(`Schema validation failed${d?` for config "${d}"`:""}`,{schemaPath:e,configName:d,validationErrors:r,errorCount:r.length})}},dA=class extends dr{code="BROWSER_CONFIG_ERROR";constructor(e,r,d,E){super(`Failed to fetch configuration from "${e}": ${r} ${d}`,{endpoint:e,status:r,statusText:d,configName:E})}},EA=class extends dr{code="PLUGIN_ERROR";constructor(e,r,d){super(`Plugin "${e}" failed during ${r}: ${d.message}`,{pluginName:e,operation:r,originalError:d.name,originalMessage:d.message});this.cause=d}},od={configNotFound(t,e,r){return new Zi(t,e,r)},configLoad(t,e,r){return new C_(t,e,r)},configValidation(t,e,r){return new pN(t,e,r)},configMerge(t,e,r,d){return new tA(t,e,r,d)},envVar(t,e,r,d){return new ki(t,e,r,d)},fileSystem(t,e,r){return new eA(t,e,r)},typeGeneration(t,e,r){return new rA(t,e,r)},schemaValidation(t,e,r){return new I_(t,e,r)},browserConfig(t,e,r,d){return new dA(t,e,r,d)},plugin(t,e,r){return new EA(t,e,r)}},Jl={replace:"replace",concat:"concat",smart:"smart"},Hl=/^https?:\/\//,ar=new Ki("bunfig",{showTags:!0}),Ld=new NA,Wl=We(YE.cwd(),"config"),vl=We(YE.cwd(),"src/generated")});function aP(t,e={}){let r=Yi.cwd();while(r.includes("storage"))r=mI(r,"..");let d=mI(r,t||"");if(e?.relative)return L2(Yi.cwd(),d);return d}var jP=Yi.env.CLARITY_LOG_DIR||A2(aP(),"logs"),Ql={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:jP,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},bi={...Ql},YM=(async()=>{try{let{loadConfig:t}=await PP().then(()=>Ul),e=await t({name:"clarity",alias:"logging",defaultConfig:Ql,cwd:Yi.cwd()});if(e)Object.assign(bi,e)}catch{}return bi})();function he(){if(Ad.env.NODE_ENV==="test"||Ad.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function zP(){if(Ad.env.NODE_ENV==="test"||Ad.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof Ad<"u"){let t=Ad.type;if(t==="renderer"||t==="worker")return!1;return!!(Ad.versions&&(Ad.versions.node||Ad.versions.bun))}return!1}class Yl{async format(t){let e=await zP(),r=await this.getMetadata(e);return JSON.stringify({timestamp:t.timestamp.toISOString(),level:t.level,name:t.name,message:t.message,metadata:r})}async getMetadata(t){if(t){let{hostname:e}=await import("os");return{pid:pn.pid,hostname:e(),environment:pn.env.NODE_ENV||"development",platform:pn.platform,version:pn.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:pn.env.NODE_ENV||pn.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}var Ae={red:(t)=>`\x1B[31m${t}\x1B[0m`,green:(t)=>`\x1B[32m${t}\x1B[0m`,yellow:(t)=>`\x1B[33m${t}\x1B[0m`,blue:(t)=>`\x1B[34m${t}\x1B[0m`,magenta:(t)=>`\x1B[35m${t}\x1B[0m`,cyan:(t)=>`\x1B[36m${t}\x1B[0m`,white:(t)=>`\x1B[37m${t}\x1B[0m`,gray:(t)=>`\x1B[90m${t}\x1B[0m`,bgRed:(t)=>`\x1B[41m${t}\x1B[0m`,bgYellow:(t)=>`\x1B[43m${t}\x1B[0m`,bgGray:(t)=>`\x1B[100m${t}\x1B[0m`,bold:(t)=>`\x1B[1m${t}\x1B[0m`,dim:(t)=>`\x1B[2m${t}\x1B[0m`,italic:(t)=>`\x1B[3m${t}\x1B[0m`,underline:(t)=>`\x1B[4m${t}\x1B[0m`,strikethrough:(t)=>`\x1B[9m${t}\x1B[0m`,reset:"\x1B[0m"},Ft=Ae,MM=Ae.red,FP=Ae.green,GM=Ae.yellow,BP=Ae.blue,VM=Ae.magenta,KM=Ae.cyan,ul=Ae.white,ZM=Ae.gray,JP=Ae.bgRed,HP=Ae.bgYellow,kM=Ae.bgGray,Ol=Ae.bold,bM=Ae.dim,xM=Ae.italic,qM=Ae.underline,sM=Ae.strikethrough,oM=Ae.reset,ZN={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},WP={debug:"\uD83D\uDD0D",info:BP("ℹ"),success:FP("✓"),warning:HP(ul(Ol(" WARN "))),error:JP(ul(Ol(" ERROR ")))};class pi{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(t,e={}){this.name=t,this.config={...bi},this.options=this.normalizeOptions(e),this.formatter=this.options.formatter||new Yl,this.enabled=e.enabled??!0,this.fancy=e.fancy??!0,this.tagFormat=e.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=e.timestampPosition??"right",this.environment=e.environment??jt.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(e);let r={...e},d=e.timestamp!==void 0;if(d)delete r.timestamp;if(this.config={...this.config,...r,timestamp:d||this.config.timestamp,level:this.options.level??"info"},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let E=this.generateKeyId(),n=this.generateKey();this.currentKeyId=E,this.keys.set(E,n),this.encryptionKeys.set(E,{key:n,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(t){if(!this.fingersCrossedConfig)return!1;let e={debug:0,info:1,success:2,warning:3,error:4},r=this.fingersCrossedConfig.activationLevel??"error";return e[t]>=e[r]}initializeFingersCrossedConfig(t){if(!t.fingersCrossedEnabled&&t.fingersCrossed)return{...ZN,...t.fingersCrossed};if(!t.fingersCrossedEnabled)return null;if(!t.fingersCrossed)return{...ZN};return{...ZN,...t.fingersCrossed}}normalizeOptions(t){let e={format:"json",level:"info",logDirectory:bi.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},r={...e,...Object.fromEntries(Object.entries(t).filter(([,d])=>d!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=e.level;return r}shouldWriteToFile(){return!he()&&this.config.writeToFile===!0}async writeToFile(t){let r=(async()=>{let E,n=0,c=3,_=1000;while(n<c)try{try{try{await l2(this.config.logDirectory,rl.F_OK|rl.W_OK)}catch(T){if(T instanceof Error&&"code"in T)if(T.code==="ENOENT")await D2(this.config.logDirectory,{recursive:!0,mode:493});else if(T.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw T;else throw T}}catch(T){throw console.error("Debug: [writeToFile] Failed to create log directory:",T),T}let i=this.validateEncryptionConfig()?(await this.encrypt(t)).encrypted:Rd.from(t);try{if(!wi(this.currentLogFile))await YN(this.currentLogFile,"",{mode:420});if(E=el(this.currentLogFile,"a",420),I2(E,i,{flag:"a"}),tl(E),E!==void 0)QN(E),E=void 0;if((await on(this.currentLogFile)).size===0){if(await YN(this.currentLogFile,i,{flag:"w",mode:420}),(await on(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(T){let h=T;if(h.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(h.code)){if(n<c-1){let R=typeof h.message==="string"?h.message:"Unknown error";console.error(`Network error during write attempt ${n+1}/${c}:`,R);let N=_*2**n;await new Promise((A)=>setTimeout(A,N)),n++;continue}}if(h?.code&&["ENOSPC","EDQUOT"].includes(h.code))throw Error(`Disk quota exceeded or no space left on device: ${h.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",h),h}finally{if(E!==void 0)try{QN(E)}catch(T){console.error("Debug: [writeToFile] Error closing file descriptor:",T)}}}catch(i){if(n===c-1){let h=i,R=typeof h.message==="string"?h.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",R),i}n++;let T=_*2**(n-1);await new Promise((h)=>setTimeout(h,T))}})();this.pendingOperations.push(r);let d=this.pendingOperations.length-1;try{await r}catch(E){throw console.error("Debug: [writeToFile] Error in operation:",E),E}finally{this.pendingOperations.splice(d,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return mn(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return mn(this.config.logDirectory,`${this.name}.log`);let t=new Date().toISOString().split("T")[0];return mn(this.config.logDirectory,`${this.name}-${t}.log`)}setupRotation(){if(he())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let t=this.config.rotation,e;switch(t.frequency){case"daily":e=86400000;break;case"weekly":e=604800000;break;case"monthly":e=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},e)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let e=this.config.rotation.keyRotation;if(!e?.enabled)return;let r=typeof e.interval==="number"?e.interval:60,d=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((E)=>{console.error("Error rotating keys:",E)})},d)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let e=this.config.rotation.keyRotation,r=this.generateKeyId(),d=this.generateKey();this.currentKeyId=r,this.keys.set(r,d),this.encryptionKeys.set(r,{key:d,createdAt:new Date});let E=Array.from(this.encryptionKeys.entries()).sort(([,_],[,i])=>i.createdAt.getTime()-_.createdAt.getTime()),n=typeof e.maxKeys==="number"?e.maxKeys:1,c=Math.max(1,n);if(E.length>c)for(let[_]of E.slice(c))this.encryptionKeys.delete(_),this.keys.delete(_)}generateKeyId(){return vN(16).toString("hex")}generateKey(){return vN(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let t=this.keys.get(this.currentKeyId);if(!t)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:t,id:this.currentKeyId}}encrypt(t){let{key:e}=this.getCurrentKey(),r=vN(16),d=u2("aes-256-gcm",e,r),E=Rd.isBuffer(t)?t:Rd.from(t,"utf8"),n=d.update(E),c=d.final(),_=n.length+c.length,i=d.getAuthTag(),T=Rd.allocUnsafe(16+_+16);return r.copy(T,0),n.copy(T,16),c.copy(T,16+n.length),i.copy(T,16+_),{encrypted:T,iv:r}}async compressData(t){return new Promise((e,r)=>{let d=El(),E=[];d.on("data",(n)=>E.push(n)),d.on("end",()=>e(Rd.from(Rd.concat(E)))),d.on("error",r),d.write(t),d.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let t={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let e=this.config.rotation.encrypt;return{...t,...e}}return t}async rotateLog(){if(he())return;if(!this.shouldWriteToFile())return;let t=await on(this.currentLogFile).catch(()=>null);if(!t)return;let e=this.config.rotation;if(typeof e==="boolean")return;if(e.maxSize&&t.size>=e.maxSize){let r=this.currentLogFile,d=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let E=await gi(this.config.logDirectory),n=E.filter((i)=>i.startsWith(this.name)&&/\.log\.\d+$/.test(i)).sort((i,T)=>{let h=Number.parseInt(i.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(T.match(/\.log\.(\d+)$/)?.[1]||"0")-h}),c=n.length>0?Number.parseInt(n[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,_=`${r}.${c}`;if(await on(r).catch(()=>null))try{if(await dl(r,_),e.compress)try{let i=`${_}.gz`;await this.compressLogFile(_,i),await $i(_)}catch(i){console.error("Error compressing rotated file:",i)}if(n.length===0&&!E.some((i)=>i.endsWith(".log.1")))try{let i=`${r}.1`;await YN(i,"")}catch(i){console.error("Error creating backup file:",i)}}catch(i){console.error(`Error during rotation: ${i instanceof Error?i.message:String(i)}`)}}else{let E=new Date().toISOString().replace(/[:.]/g,"-"),n=r.replace(/\.log$/,`-${E}.log`);if(await on(r).catch(()=>null))await dl(r,n)}if(this.currentLogFile=d,e.maxFiles){let n=(await gi(this.config.logDirectory)).filter((c)=>c.startsWith(this.name)).sort((c,_)=>_.localeCompare(c));for(let c of n.slice(e.maxFiles))await $i(mn(this.config.logDirectory,c))}}}async compressLogFile(t,e){let r=pI(t),d=C2(e),E=El();await w2(r,E,d)}async handleFingersCrossedBuffer(t,e){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(t)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let d=await this.formatter.format(r);if(this.shouldWriteToFile())await this.writeToFile(d);console.log(d)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(e);console.log(e)}}shouldLog(t){if(!this.enabled)return!1;let e={debug:0,info:1,success:2,warning:3,error:4};return e[t]>=e[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((t)=>{if(t instanceof Promise)return t.catch((e)=>{console.error("Error in pending write operation:",e)});return Promise.resolve()})),wi(this.currentLogFile))try{let t=el(this.currentLogFile,"r+");tl(t),QN(t)}catch(t){console.error(`Error flushing file: ${t}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let t of this.pendingOperations)if(typeof t.cancel==="function")t.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(t){console.error("Error waiting for pending operations:",t)}if(!he()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let e=(await gi(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of e)try{await $i(mn(this.config.logDirectory,r))}catch(d){console.error(`Failed to delete temp file ${r}:`,d)}}catch(t){console.error("Error cleaning up temporary files:",t)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(t){if(!t)return"";return`${this.tagFormat.prefix}${t}${this.tagFormat.suffix}`}formatFileTimestamp(t){return`[${t.toISOString()}]`}formatConsoleTimestamp(t){return this.shouldStyleConsole()?Ft.gray(t.toLocaleTimeString()):t.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||he())return!1;let t=typeof jt.env.NO_COLOR<"u",e=jt.env.FORCE_COLOR==="0";if(t||e)return!1;return!!(typeof jt.stderr<"u"&&jt.stderr.isTTY||typeof jt.stdout<"u"&&jt.stdout.isTTY)}formatConsoleMessage(t){let{timestamp:e,icon:r="",tag:d="",message:E,level:n,showTimestamp:c=!0}=t,_=(A)=>A.replace(this.ANSI_PATTERN,"");if(!this.fancy){let A=[];if(c)A.push(e);if(n==="warning")A.push("WARN");else if(n==="error")A.push("ERROR");else if(r)A.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(d)A.push(d.replace(/[[\]]/g,""));return A.push(E),A.join(" ")}let i=jt.stdout.columns||120,T="";if(n==="warning"||n==="error")T=`${r} ${E}`;else if(n==="info"||n==="success")T=`${r} ${d} ${E}`;else T=`${r} ${d} ${Ft.cyan(E)}`;if(!c)return T.trim();let h=_(T).trim().length,R=_(e).length,N=Math.max(1,i-2-h-R);return`${T.trim()}${" ".repeat(N)}${e}`}formatMessage(t,e){if(e.length===1&&Array.isArray(e[0]))return t.replace(/\{(\d+)\}/g,(n,c)=>{let _=Number.parseInt(c,10);return _<e[0].length?String(e[0][_]):n});let r=/%([sdijfo%])/g,d=0,E=t.replace(r,(n,c)=>{if(c==="%")return"%";if(d>=e.length)return n;let _=e[d++];switch(c){case"s":return String(_);case"d":case"i":return Number(_).toString();case"j":case"o":return JSON.stringify(_,null,2);default:return n}});if(d<e.length)E+=` ${e.slice(d).map((n)=>typeof n==="object"?JSON.stringify(n,null,2):String(n)).join(" ")}`;return E}formatMarkdown(t){if(!t)return t;let e=t;return e=e.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(r,d,E)=>{let n=Ft.underline(Ft.blue(d)),c=this.toAbsoluteFilePath(E);if(c&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let _=`file://${encodeURI(c)}`,i="\x1B]8;;",T="\x1B\\";return`\x1B]8;;${_}\x1B\\${n}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${E}\x1B\\${n}\x1B]8;;\x1B\\`;return n}),e=e.replace(/`([^`]+)`/g,(r,d)=>Ft.bgGray(d)),e=e.replace(/\*\*([^*]+)\*\*/g,(r,d)=>Ft.bold(d)),e=e.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(r,d)=>Ft.italic(d)),e=e.replace(/(?<!_)_([^_]+)_(?!_)/g,(r,d)=>Ft.italic(d)),e=e.replace(/~([^~]+)~/g,(r,d)=>Ft.strikethrough(d)),e}supportsHyperlinks(){if(he())return!1;let t=jt.env;if(!t)return!1;if(t.TERM_PROGRAM==="iTerm.app"||t.TERM_PROGRAM==="vscode"||t.TERM_PROGRAM==="WezTerm")return!0;if(t.WT_SESSION)return!0;if(t.TERM==="xterm-kitty")return!0;let e=t.VTE_VERSION?Number.parseInt(t.VTE_VERSION,10):0;if(!Number.isNaN(e)&&e>=5000)return!0;return!1}toAbsoluteFilePath(t){try{let e=t;if(e.startsWith("file://"))e=e.replace(/^file:\/\//,"");if(e.startsWith("~")){let r=jt.env.HOME||"";if(r)e=e.replace(/^~(?=$|\/)/,r)}if(U2(e)||e.startsWith("./")||e.startsWith("../"))e=f2(e);else return null;return wi(e)?e:null}catch{return null}}buildOutputTexts(t){let e=this.shouldStyleConsole()?this.formatMarkdown(t):t,r=t.replace(this.ANSI_PATTERN,"");return{consoleText:e,fileText:r}}async log(t,e,...r){if(!this.shouldLog(t))return;let d=new Date,E=this.formatConsoleTimestamp(d),n=this.formatFileTimestamp(d),c,_;if(e instanceof Error)c=e.message,_=e.stack;else c=this.formatMessage(e,r);let{consoleText:i,fileText:T}=this.buildOutputTexts(c);if(this.shouldStyleConsole()){let R=this.options.showIcons===!1?"":WP[t],N=this.options.showTags!==!1&&this.name?Ft.gray(this.formatTag(this.name)):"",A;switch(t){case"debug":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:Ft.gray(i),level:t}),console.error(A);break;case"info":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:i,level:t}),console.warn(A);break;case"success":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:Ft.green(i),level:t}),console.error(A);break;case"warning":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:i,level:t}),console.warn(A);break;case"error":if(A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:i,level:t}),console.error(A),_){let u=_.split(`
+`}return{name:"bunfig-plugin",setup(E){E.onResolve({filter:/^virtual:bunfig-types$/},(n)=>{return{path:n.path,namespace:"bunfig-virtual"}}),E.onLoad({filter:/^virtual:bunfig-types$/,namespace:"bunfig-virtual"},()=>{return{contents:d(),loader:"ts"}})}}}var jl,tc,l_,zl,rP,dP,cl,zi,oN,fe,Vt,EP,_l,nP,Tl,cP,_P,MN,TP,il,hl,GN,iP,hP,RP,SP,Fi,Fl,NP,we,AP,LP,Rl,Bi,mN,ie,zt,uP,Sl,OP,Nl,CP,IP,VN,lP,Al,Ll,DP,KN,UP,fP,wP,gP,$P,Ji,Bl,yP,XP="0.15.6",dr,Zi,C_,pN,tA,ki,eA,rA,I_,dA,EA,od,Jl,Hl,ar,Ld,Wl,vl,PP=P2(async()=>{jl=import.meta.require,tc=new _A,l_=new TA,zl={createKey:a2,isEquivalent:j2,estimateMemoryUsage:z2},rP=Qi(qN.cwd(),"config"),dP=Qi(qN.cwd(),"src/generated"),cl=vi.env.CLARITY_LOG_DIR||kX(J2(),"logs"),zi={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:cl,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1},oN=await H2(),fe={red:(t)=>`\x1B[31m${t}\x1B[0m`,green:(t)=>`\x1B[32m${t}\x1B[0m`,yellow:(t)=>`\x1B[33m${t}\x1B[0m`,blue:(t)=>`\x1B[34m${t}\x1B[0m`,magenta:(t)=>`\x1B[35m${t}\x1B[0m`,cyan:(t)=>`\x1B[36m${t}\x1B[0m`,white:(t)=>`\x1B[37m${t}\x1B[0m`,gray:(t)=>`\x1B[90m${t}\x1B[0m`,bgRed:(t)=>`\x1B[41m${t}\x1B[0m`,bgYellow:(t)=>`\x1B[43m${t}\x1B[0m`,bold:(t)=>`\x1B[1m${t}\x1B[0m`,dim:(t)=>`\x1B[2m${t}\x1B[0m`,italic:(t)=>`\x1B[3m${t}\x1B[0m`,underline:(t)=>`\x1B[4m${t}\x1B[0m`,reset:"\x1B[0m"},Vt=fe,EP=fe.red,_l=fe.green,nP=fe.yellow,Tl=fe.blue,cP=fe.magenta,_P=fe.cyan,MN=fe.white,TP=fe.gray,il=fe.bgRed,hl=fe.bgYellow,GN=fe.bold,iP=fe.dim,hP=fe.italic,RP=fe.underline,SP=fe.reset,Fi={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},Fl={debug:"\uD83D\uDD0D",info:Tl("ℹ"),success:_l("✓"),warning:hl(MN(GN(" WARN "))),error:il(MN(GN(" ERROR ")))},NP=new Gi("stacks"),we=new Gi("bunfig",{showTags:!0}),AP=He(O_.cwd(),"config"),LP=He(O_.cwd(),"src/generated"),Rl=Wi.env.CLARITY_LOG_DIR||KX(Y2(),"logs"),Bi={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:Rl,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},mN=await M2(),ie={red:(t)=>`\x1B[31m${t}\x1B[0m`,green:(t)=>`\x1B[32m${t}\x1B[0m`,yellow:(t)=>`\x1B[33m${t}\x1B[0m`,blue:(t)=>`\x1B[34m${t}\x1B[0m`,magenta:(t)=>`\x1B[35m${t}\x1B[0m`,cyan:(t)=>`\x1B[36m${t}\x1B[0m`,white:(t)=>`\x1B[37m${t}\x1B[0m`,gray:(t)=>`\x1B[90m${t}\x1B[0m`,bgRed:(t)=>`\x1B[41m${t}\x1B[0m`,bgYellow:(t)=>`\x1B[43m${t}\x1B[0m`,bgGray:(t)=>`\x1B[100m${t}\x1B[0m`,bold:(t)=>`\x1B[1m${t}\x1B[0m`,dim:(t)=>`\x1B[2m${t}\x1B[0m`,italic:(t)=>`\x1B[3m${t}\x1B[0m`,underline:(t)=>`\x1B[4m${t}\x1B[0m`,strikethrough:(t)=>`\x1B[9m${t}\x1B[0m`,reset:"\x1B[0m"},zt=ie,uP=ie.red,Sl=ie.green,OP=ie.yellow,Nl=ie.blue,CP=ie.magenta,IP=ie.cyan,VN=ie.white,lP=ie.gray,Al=ie.bgRed,Ll=ie.bgYellow,DP=ie.bgGray,KN=ie.bold,UP=ie.dim,fP=ie.italic,wP=ie.underline,gP=ie.strikethrough,$P=ie.reset,Ji={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},Bl={debug:"\uD83D\uDD0D",info:Nl("ℹ"),success:Sl("✓"),warning:Ll(VN(KN(" WARN "))),error:Al(VN(KN(" ERROR ")))},yP=new Ki("stacks"),dr=class extends Error{timestamp;context;constructor(e,r={}){super(e);if(this.name=this.constructor.name,this.timestamp=new Date,this.context=r,Error.captureStackTrace)Error.captureStackTrace(this,this.constructor)}toJSON(){return{name:this.name,code:this.code,message:this.message,timestamp:this.timestamp.toISOString(),context:this.context,stack:this.stack}}toString(){let e=Object.keys(this.context).length>0?` (${Object.entries(this.context).map(([r,d])=>`${r}: ${d}`).join(", ")})`:"";return`${this.name} [${this.code}]: ${this.message}${e}`}},Zi=class extends dr{code="CONFIG_NOT_FOUND";constructor(e,r,d){let E=d?` or alias "${d}"`:"";super(`Configuration "${e}"${E} not found`,{configName:e,alias:d,searchPaths:r,searchPathCount:r.length})}},C_=class extends dr{code="CONFIG_LOAD_ERROR";constructor(e,r,d){super(`Failed to load configuration from "${e}": ${r.message}`,{configPath:e,configName:d,originalError:r.name,originalMessage:r.message});this.cause=r}},pN=class extends dr{code="CONFIG_VALIDATION_ERROR";constructor(e,r,d){super(`Configuration validation failed for "${e}"`,{configPath:e,configName:d,validationErrors:r,errorCount:r.length})}},tA=class extends dr{code="CONFIG_MERGE_ERROR";constructor(e,r,d,E){super(`Failed to merge configuration from "${e}" with "${r}": ${d.message}`,{sourcePath:e,targetPath:r,configName:E,originalError:d.name,originalMessage:d.message});this.cause=d}},ki=class extends dr{code="ENV_VAR_ERROR";constructor(e,r,d,E){super(`Failed to parse environment variable "${e}" with value "${r}" as ${d}`,{envKey:e,envValue:r,expectedType:d,configName:E})}},eA=class extends dr{code="FILE_SYSTEM_ERROR";constructor(e,r,d){super(`File system ${e} failed for "${r}": ${d.message}`,{operation:e,path:r,originalError:d.name,originalMessage:d.message});this.cause=d}},rA=class extends dr{code="TYPE_GENERATION_ERROR";constructor(e,r,d){super(`Failed to generate types from "${e}" to "${r}": ${d.message}`,{configDir:e,outputPath:r,originalError:d.name,originalMessage:d.message});this.cause=d}},I_=class extends dr{code="SCHEMA_VALIDATION_ERROR";constructor(e,r,d){super(`Schema validation failed${d?` for config "${d}"`:""}`,{schemaPath:e,configName:d,validationErrors:r,errorCount:r.length})}},dA=class extends dr{code="BROWSER_CONFIG_ERROR";constructor(e,r,d,E){super(`Failed to fetch configuration from "${e}": ${r} ${d}`,{endpoint:e,status:r,statusText:d,configName:E})}},EA=class extends dr{code="PLUGIN_ERROR";constructor(e,r,d){super(`Plugin "${e}" failed during ${r}: ${d.message}`,{pluginName:e,operation:r,originalError:d.name,originalMessage:d.message});this.cause=d}},od={configNotFound(t,e,r){return new Zi(t,e,r)},configLoad(t,e,r){return new C_(t,e,r)},configValidation(t,e,r){return new pN(t,e,r)},configMerge(t,e,r,d){return new tA(t,e,r,d)},envVar(t,e,r,d){return new ki(t,e,r,d)},fileSystem(t,e,r){return new eA(t,e,r)},typeGeneration(t,e,r){return new rA(t,e,r)},schemaValidation(t,e,r){return new I_(t,e,r)},browserConfig(t,e,r,d){return new dA(t,e,r,d)},plugin(t,e,r){return new EA(t,e,r)}},Jl={replace:"replace",concat:"concat",smart:"smart"},Hl=/^https?:\/\//,ar=new Ki("bunfig",{showTags:!0}),Ld=new NA,Wl=We(YE.cwd(),"config"),vl=We(YE.cwd(),"src/generated")});function aP(t,e={}){let r=Yi.cwd();while(r.includes("storage"))r=mI(r,"..");let d=mI(r,t||"");if(e?.relative)return L2(Yi.cwd(),d);return d}var jP=Yi.env.CLARITY_LOG_DIR||A2(aP(),"logs"),Ql={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:jP,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},bi={...Ql},YM=(async()=>{try{let{loadConfig:t}=await PP().then(()=>Ul),e=await t({name:"clarity",alias:"logging",defaultConfig:Ql,cwd:Yi.cwd()});if(e)Object.assign(bi,e)}catch{}return bi})();function he(){if(Ad.env.NODE_ENV==="test"||Ad.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function zP(){if(Ad.env.NODE_ENV==="test"||Ad.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof Ad<"u"){let t=Ad.type;if(t==="renderer"||t==="worker")return!1;return!!(Ad.versions&&(Ad.versions.node||Ad.versions.bun))}return!1}class Yl{async format(t){let e=await zP(),r=await this.getMetadata(e);return JSON.stringify({timestamp:t.timestamp.toISOString(),level:t.level,name:t.name,message:t.message,metadata:r})}async getMetadata(t){if(t){let{hostname:e}=await import("os");return{pid:pn.pid,hostname:e(),environment:pn.env.NODE_ENV||"development",platform:pn.platform,version:pn.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:pn.env.NODE_ENV||pn.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}var Ae={red:(t)=>`\x1B[31m${t}\x1B[0m`,green:(t)=>`\x1B[32m${t}\x1B[0m`,yellow:(t)=>`\x1B[33m${t}\x1B[0m`,blue:(t)=>`\x1B[34m${t}\x1B[0m`,magenta:(t)=>`\x1B[35m${t}\x1B[0m`,cyan:(t)=>`\x1B[36m${t}\x1B[0m`,white:(t)=>`\x1B[37m${t}\x1B[0m`,gray:(t)=>`\x1B[90m${t}\x1B[0m`,bgRed:(t)=>`\x1B[41m${t}\x1B[0m`,bgYellow:(t)=>`\x1B[43m${t}\x1B[0m`,bgGray:(t)=>`\x1B[100m${t}\x1B[0m`,bold:(t)=>`\x1B[1m${t}\x1B[0m`,dim:(t)=>`\x1B[2m${t}\x1B[0m`,italic:(t)=>`\x1B[3m${t}\x1B[0m`,underline:(t)=>`\x1B[4m${t}\x1B[0m`,strikethrough:(t)=>`\x1B[9m${t}\x1B[0m`,reset:"\x1B[0m"},Ft=Ae,MM=Ae.red,FP=Ae.green,GM=Ae.yellow,BP=Ae.blue,VM=Ae.magenta,KM=Ae.cyan,ul=Ae.white,ZM=Ae.gray,JP=Ae.bgRed,HP=Ae.bgYellow,kM=Ae.bgGray,Ol=Ae.bold,bM=Ae.dim,xM=Ae.italic,qM=Ae.underline,sM=Ae.strikethrough,oM=Ae.reset,ZN={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},WP={debug:"\uD83D\uDD0D",info:BP("ℹ"),success:FP("✓"),warning:HP(ul(Ol(" WARN "))),error:JP(ul(Ol(" ERROR ")))};class pi{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(t,e={}){this.name=t,this.config={...bi},this.options=this.normalizeOptions(e),this.formatter=this.options.formatter||new Yl,this.enabled=e.enabled??!0,this.fancy=e.fancy??!0,this.tagFormat=e.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=e.timestampPosition??"right",this.environment=e.environment??jt.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(e);let r={...e},d=e.timestamp!==void 0;if(d)delete r.timestamp;if(this.config={...this.config,...r,timestamp:d||this.config.timestamp,level:this.options.level??"info"},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let E=this.generateKeyId(),n=this.generateKey();this.currentKeyId=E,this.keys.set(E,n),this.encryptionKeys.set(E,{key:n,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(t){if(!this.fingersCrossedConfig)return!1;let e={debug:0,info:1,success:2,warning:3,error:4},r=this.fingersCrossedConfig.activationLevel??"error";return e[t]>=e[r]}initializeFingersCrossedConfig(t){if(!t.fingersCrossedEnabled&&t.fingersCrossed)return{...ZN,...t.fingersCrossed};if(!t.fingersCrossedEnabled)return null;if(!t.fingersCrossed)return{...ZN};return{...ZN,...t.fingersCrossed}}normalizeOptions(t){let e={format:"json",level:"info",logDirectory:bi.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},r={...e,...Object.fromEntries(Object.entries(t).filter(([,d])=>d!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=e.level;return r}shouldWriteToFile(){return!he()&&this.config.writeToFile===!0}async writeToFile(t){let r=(async()=>{let E,n=0,c=3,_=1000;while(n<c)try{try{try{await l2(this.config.logDirectory,rl.F_OK|rl.W_OK)}catch(T){if(T instanceof Error&&"code"in T)if(T.code==="ENOENT")await D2(this.config.logDirectory,{recursive:!0,mode:493});else if(T.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw T;else throw T}}catch(T){throw console.error("Debug: [writeToFile] Failed to create log directory:",T),T}let i=this.validateEncryptionConfig()?(await this.encrypt(t)).encrypted:Rd.from(t);try{if(!wi(this.currentLogFile))await YN(this.currentLogFile,"",{mode:420});if(E=el(this.currentLogFile,"a",420),I2(E,i,{flag:"a"}),tl(E),E!==void 0)QN(E),E=void 0;if((await on(this.currentLogFile)).size===0){if(await YN(this.currentLogFile,i,{flag:"w",mode:420}),(await on(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(T){let h=T;if(h.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(h.code)){if(n<c-1){let R=typeof h.message==="string"?h.message:"Unknown error";console.error(`Network error during write attempt ${n+1}/${c}:`,R);let N=_*2**n;await new Promise((A)=>setTimeout(A,N)),n++;continue}}if(h?.code&&["ENOSPC","EDQUOT"].includes(h.code))throw Error(`Disk quota exceeded or no space left on device: ${h.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",h),h}finally{if(E!==void 0)try{QN(E)}catch(T){console.error("Debug: [writeToFile] Error closing file descriptor:",T)}}}catch(i){if(n===c-1){let h=i,R=typeof h.message==="string"?h.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",R),i}n++;let T=_*2**(n-1);await new Promise((h)=>setTimeout(h,T))}})();this.pendingOperations.push(r);let d=this.pendingOperations.length-1;try{await r}catch(E){throw console.error("Debug: [writeToFile] Error in operation:",E),E}finally{this.pendingOperations.splice(d,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return mn(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return mn(this.config.logDirectory,`${this.name}.log`);let t=new Date().toISOString().split("T")[0];return mn(this.config.logDirectory,`${this.name}-${t}.log`)}setupRotation(){if(he())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let t=this.config.rotation,e;switch(t.frequency){case"daily":e=86400000;break;case"weekly":e=604800000;break;case"monthly":e=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},e)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let e=this.config.rotation.keyRotation;if(!e?.enabled)return;let r=typeof e.interval==="number"?e.interval:60,d=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((E)=>{console.error("Error rotating keys:",E)})},d)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let e=this.config.rotation.keyRotation,r=this.generateKeyId(),d=this.generateKey();this.currentKeyId=r,this.keys.set(r,d),this.encryptionKeys.set(r,{key:d,createdAt:new Date});let E=Array.from(this.encryptionKeys.entries()).sort(([,_],[,i])=>i.createdAt.getTime()-_.createdAt.getTime()),n=typeof e.maxKeys==="number"?e.maxKeys:1,c=Math.max(1,n);if(E.length>c)for(let[_]of E.slice(c))this.encryptionKeys.delete(_),this.keys.delete(_)}generateKeyId(){return vN(16).toString("hex")}generateKey(){return vN(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let t=this.keys.get(this.currentKeyId);if(!t)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:t,id:this.currentKeyId}}encrypt(t){let{key:e}=this.getCurrentKey(),r=vN(16),d=u2("aes-256-gcm",e,r),E=Rd.isBuffer(t)?t:Rd.from(t,"utf8"),n=d.update(E),c=d.final(),_=n.length+c.length,i=d.getAuthTag(),T=Rd.allocUnsafe(16+_+16);return r.copy(T,0),n.copy(T,16),c.copy(T,16+n.length),i.copy(T,16+_),{encrypted:T,iv:r}}async compressData(t){return new Promise((e,r)=>{let d=El(),E=[];d.on("data",(n)=>E.push(n)),d.on("end",()=>e(Rd.from(Rd.concat(E)))),d.on("error",r),d.write(t),d.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let t={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let e=this.config.rotation.encrypt;return{...t,...e}}return t}async rotateLog(){if(he())return;if(!this.shouldWriteToFile())return;let t=await on(this.currentLogFile).catch(()=>null);if(!t)return;let e=this.config.rotation;if(typeof e==="boolean")return;if(e.maxSize&&t.size>=e.maxSize){let r=this.currentLogFile,d=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let E=await gi(this.config.logDirectory),n=E.filter((i)=>i.startsWith(this.name)&&/\.log\.\d+$/.test(i)).sort((i,T)=>{let h=Number.parseInt(i.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(T.match(/\.log\.(\d+)$/)?.[1]||"0")-h}),c=n.length>0?Number.parseInt(n[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,_=`${r}.${c}`;if(await on(r).catch(()=>null))try{if(await dl(r,_),e.compress)try{let i=`${_}.gz`;await this.compressLogFile(_,i),await $i(_)}catch(i){console.error("Error compressing rotated file:",i)}if(n.length===0&&!E.some((i)=>i.endsWith(".log.1")))try{let i=`${r}.1`;await YN(i,"")}catch(i){console.error("Error creating backup file:",i)}}catch(i){console.error(`Error during rotation: ${i instanceof Error?i.message:String(i)}`)}}else{let E=new Date().toISOString().replace(/[:.]/g,"-"),n=r.replace(/\.log$/,`-${E}.log`);if(await on(r).catch(()=>null))await dl(r,n)}if(this.currentLogFile=d,e.maxFiles){let n=(await gi(this.config.logDirectory)).filter((c)=>c.startsWith(this.name)).sort((c,_)=>_.localeCompare(c));for(let c of n.slice(e.maxFiles))await $i(mn(this.config.logDirectory,c))}}}async compressLogFile(t,e){let r=pI(t),d=C2(e),E=El();await w2(r,E,d)}async handleFingersCrossedBuffer(t,e){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(t)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let d=await this.formatter.format(r);if(this.shouldWriteToFile())await this.writeToFile(d);console.log(d)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(e);console.log(e)}}shouldLog(t){if(!this.enabled)return!1;let e={debug:0,info:1,success:2,warning:3,error:4};return e[t]>=e[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((t)=>{if(t instanceof Promise)return t.catch((e)=>{console.error("Error in pending write operation:",e)});return Promise.resolve()})),wi(this.currentLogFile))try{let t=el(this.currentLogFile,"r+");tl(t),QN(t)}catch(t){console.error(`Error flushing file: ${t}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let t of this.pendingOperations)if(typeof t.cancel==="function")t.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(t){console.error("Error waiting for pending operations:",t)}if(!he()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let e=(await gi(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of e)try{await $i(mn(this.config.logDirectory,r))}catch(d){console.error(`Failed to delete temp file ${r}:`,d)}}catch(t){console.error("Error cleaning up temporary files:",t)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(t){if(!t)return"";return`${this.tagFormat.prefix}${t}${this.tagFormat.suffix}`}formatFileTimestamp(t){return`[${t.toISOString()}]`}formatConsoleTimestamp(t){return this.shouldStyleConsole()?Ft.gray(t.toLocaleTimeString()):t.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||he())return!1;let t=typeof jt.env.NO_COLOR<"u",e=jt.env.FORCE_COLOR==="0";if(t||e)return!1;return!!(typeof jt.stderr<"u"&&jt.stderr.isTTY||typeof jt.stdout<"u"&&jt.stdout.isTTY)}formatConsoleMessage(t){let{timestamp:e,icon:r="",tag:d="",message:E,level:n,showTimestamp:c=!0}=t,_=(A)=>A.replace(this.ANSI_PATTERN,"");if(!this.fancy){let A=[];if(c)A.push(e);if(n==="warning")A.push("WARN");else if(n==="error")A.push("ERROR");else if(r)A.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(d)A.push(d.replace(/[[\]]/g,""));return A.push(E),A.join(" ")}let i=jt.stdout.columns||120,T="";if(n==="warning"||n==="error")T=`${r} ${E}`;else if(n==="info"||n==="success")T=`${r} ${d} ${E}`;else T=`${r} ${d} ${Ft.cyan(E)}`;if(!c)return T.trim();let h=_(T).trim().length,R=_(e).length,N=Math.max(1,i-2-h-R);return`${T.trim()}${" ".repeat(N)}${e}`}formatMessage(t,e){if(e.length===1&&Array.isArray(e[0]))return t.replace(/\{(\d+)\}/g,(n,c)=>{let _=Number.parseInt(c,10);return _<e[0].length?String(e[0][_]):n});let r=/%([sdijfo%])/g,d=0,E=t.replace(r,(n,c)=>{if(c==="%")return"%";if(d>=e.length)return n;let _=e[d++];switch(c){case"s":return String(_);case"d":case"i":return Number(_).toString();case"j":case"o":return JSON.stringify(_,null,2);default:return n}});if(d<e.length)E+=` ${e.slice(d).map((n)=>typeof n==="object"?JSON.stringify(n,null,2):String(n)).join(" ")}`;return E}formatMarkdown(t){if(!t)return t;let e=t;return e=e.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(r,d,E)=>{let n=Ft.underline(Ft.blue(d)),c=this.toAbsoluteFilePath(E);if(c&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let _=`file://${encodeURI(c)}`,i="\x1B]8;;",T="\x1B\\";return`\x1B]8;;${_}\x1B\\${n}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${E}\x1B\\${n}\x1B]8;;\x1B\\`;return n}),e=e.replace(/`([^`]+)`/g,(r,d)=>Ft.bgGray(d)),e=e.replace(/\*\*([^*]+)\*\*/g,(r,d)=>Ft.bold(d)),e=e.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(r,d)=>Ft.italic(d)),e=e.replace(/(?<!_)_([^_]+)_(?!_)/g,(r,d)=>Ft.italic(d)),e=e.replace(/~([^~]+)~/g,(r,d)=>Ft.strikethrough(d)),e}supportsHyperlinks(){if(he())return!1;let t=jt.env;if(!t)return!1;if(t.TERM_PROGRAM==="iTerm.app"||t.TERM_PROGRAM==="vscode"||t.TERM_PROGRAM==="WezTerm")return!0;if(t.WT_SESSION)return!0;if(t.TERM==="xterm-kitty")return!0;let e=t.VTE_VERSION?Number.parseInt(t.VTE_VERSION,10):0;if(!Number.isNaN(e)&&e>=5000)return!0;return!1}toAbsoluteFilePath(t){try{let e=t;if(e.startsWith("file://"))e=e.replace(/^file:\/\//,"");if(e.startsWith("~")){let r=jt.env.HOME||"";if(r)e=e.replace(/^~(?=$|\/)/,r)}if(U2(e)||e.startsWith("./")||e.startsWith("../"))e=f2(e);else return null;return wi(e)?e:null}catch{return null}}buildOutputTexts(t){let e=this.shouldStyleConsole()?this.formatMarkdown(t):t,r=t.replace(this.ANSI_PATTERN,"");return{consoleText:e,fileText:r}}async log(t,e,...r){if(!this.shouldLog(t))return;let d=new Date,E=this.formatConsoleTimestamp(d),n=this.formatFileTimestamp(d),c,_;if(e instanceof Error)c=e.message,_=e.stack;else c=this.formatMessage(e,r);let{consoleText:i,fileText:T}=this.buildOutputTexts(c);if(this.shouldStyleConsole()){let R=this.options.showIcons===!1?"":WP[t],N=this.options.showTags!==!1&&this.name?Ft.gray(this.formatTag(this.name)):"",A;switch(t){case"debug":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:Ft.gray(i),level:t}),console.error(A);break;case"info":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:i,level:t}),console.warn(A);break;case"success":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:Ft.green(i),level:t}),console.error(A);break;case"warning":A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:i,level:t}),console.warn(A);break;case"error":if(A=this.formatConsoleMessage({timestamp:E,icon:R,tag:N,message:i,level:t}),console.error(A),_){let u=_.split(`
 `);for(let U of u)if(U.trim()&&!U.includes(c))console.error(this.formatConsoleMessage({timestamp:E,message:Ft.gray(`  ${U}`),level:t,showTimestamp:!1}))}break}}else if(!he()){if(console.error(`${n} ${this.environment}.${t.toUpperCase()}: ${c}`),_)console.error(_)}let h=`${n} ${this.environment}.${t.toUpperCase()}: ${T}
 `;if(_)h+=`${_}
 `;if(h=h.replace(this.ANSI_PATTERN,""),this.shouldWriteToFile())await this.writeToFile(h)}progress(t,e=""){let r={update:(_,i)=>{},finish:(_)=>{},interrupt:(_,i)=>{}};if(!this.enabled)return r;let d=30;if(this.activeProgressBar={total:Math.max(1,t||1),current:0,message:e||"",barLength:d,lastRenderedLine:""},this.shouldStyleConsole()&&!he()&&jt.stdout.isTTY)this.renderProgressBar(this.activeProgressBar);return{update:(_,i)=>{if(!this.enabled||!this.activeProgressBar)return;if(this.activeProgressBar.current=Math.min(Math.max(0,_),this.activeProgressBar.total),i!==void 0)this.activeProgressBar.message=i;if(this.shouldStyleConsole()&&!he()&&jt.stdout.isTTY)this.renderProgressBar(this.activeProgressBar)},finish:(_)=>{if(!this.activeProgressBar)return;this.finishProgressBar(this.activeProgressBar,_)},interrupt:(_,i="info")=>{if(!he()&&jt.stdout.isTTY)jt.stdout.write(`
@@ -5619,7 +5619,7 @@ export type ConfigOf = Config
 `)+(Object.keys(t).length?`
 `:"")}import{createCipheriv as pP,createDecipheriv as ta,createHash as iD,randomBytes as ea}from"node:crypto";class D_{controlPlane;now;kind="local_encrypted";key;constructor(t,e,r=()=>new Date){this.controlPlane=t;this.now=r;if(!e)throw Error("Configuration encryption key is required.");this.key=iD("sha256").update(`ts-cloud:configuration:${e}`).digest()}encrypt(t){let e=ea(12),r=pP("aes-256-gcm",this.key,e),d=Buffer.concat([r.update(t,"utf8"),r.final()]);return`v1.${e.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${d.toString("base64url")}`}decrypt(t){let[e,r,d,E]=t.split(".");if(e!=="v1"||!r||!d||!E)throw Error("Encrypted configuration secret is unavailable.");try{let n=ta("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return n.setAuthTag(Buffer.from(d,"base64url")),Buffer.concat([n.update(Buffer.from(E,"base64url")),n.final()]).toString("utf8")}catch{throw Error("Encrypted configuration secret could not be decrypted.")}}async put(t){if(!t.value)throw Error("Configuration secrets cannot be empty.");let e=t.reference??`secret://configuration/${t.name}/${crypto.randomUUID()}`;if(!/^secret:\/\/configuration\/[A-Za-z0-9._/-]+$/.test(e))throw Error("Invalid local configuration secret reference.");let d=(this.controlPlane.database.query("SELECT version FROM configuration_secret_values WHERE reference=?").get(e)?.version??0)+1,E=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_secret_values (reference,ciphertext,fingerprint,version,created_at,updated_at) VALUES (?,?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,version=excluded.version,updated_at=excluded.updated_at",[e,this.encrypt(t.value),iD("sha256").update(t.value).digest("hex"),d,E,E]),{reference:e,version:String(d)}}async resolve(t){let e=this.controlPlane.database.query("SELECT ciphertext FROM configuration_secret_values WHERE reference=?").get(t);if(!e)throw Error("Configuration secret was not found.");return this.decrypt(e.ciphertext)}async remove(t){this.controlPlane.database.run("DELETE FROM configuration_secret_values WHERE reference=?",[t])}async validate(t){return!!this.controlPlane.database.query("SELECT 1 AS found FROM configuration_secret_values WHERE reference=?").get(t)}}class IA{client;region;kind="aws_secrets_manager";constructor(t,e){this.client=t;this.region=e}async put(t){if(t.reference){let r=this.id(t.reference),d=await this.client.putSecretValue({SecretId:r,SecretString:t.value,ClientRequestToken:t.idempotencyKey});return{reference:t.reference,version:d.VersionId??t.idempotencyKey}}let e=await this.client.createSecret({Name:t.name,SecretString:t.value,ClientRequestToken:t.idempotencyKey,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{reference:`aws-sm://${this.region}/${encodeURIComponent(e.ARN??e.Name??t.name)}`,version:e.VersionId??t.idempotencyKey}}async resolve(t){let e=await this.client.getSecretValue({SecretId:this.id(t)});if(e.SecretString==null)throw Error("AWS Secrets Manager value is unavailable.");return e.SecretString}async remove(t){await this.client.deleteSecret({SecretId:this.id(t),RecoveryWindowInDays:7})}async validate(t){try{return await this.client.describeSecret(this.id(t)),!0}catch{return!1}}id(t){let e=new URL(t);if(e.protocol!=="aws-sm:"||e.hostname!==this.region)throw Error("Invalid AWS Secrets Manager reference.");return decodeURIComponent(e.pathname.slice(1))}}class lA{client;region;kind="aws_ssm";constructor(t,e){this.client=t;this.region=e}async put(t){let e=t.reference?this.name(t.reference):`/${t.name.replace(/^\/+/,"")}`,r=await this.client.putParameter({Name:e,Value:t.value,Type:"SecureString",Overwrite:!!t.reference,Description:"Managed by ts-cloud"});return{reference:`aws-ssm://${this.region}${e}`,version:String(r.Version??1)}}async resolve(t){let e=await this.client.getParameter({Name:this.name(t),WithDecryption:!0});if(e.Parameter?.Value==null)throw Error("AWS SSM parameter value is unavailable.");return e.Parameter.Value}async remove(t){await this.client.deleteParameter({Name:this.name(t)})}async validate(t){try{return!!(await this.client.getParameter({Name:this.name(t),WithDecryption:!1})).Parameter}catch{return!1}}name(t){let e=new URL(t);if(e.protocol!=="aws-ssm:"||e.hostname!==this.region||!e.pathname.startsWith("/"))throw Error("Invalid AWS SSM reference.");return e.pathname}}class DA{kind="external";async put(){throw Error("External secret references cannot be written by ts-cloud.")}async resolve(){throw Error("External secrets must be resolved by the deployment provider.")}async remove(){}async validate(t){return/^(?:vault|doppler|op|external):\/\//.test(t)}}import{createHmac as ra}from"node:crypto";var da=/^(?:secret|aws-sm|aws-ssm|vault|doppler|op|external):\/\//,Ea=/^(?:AWS_|TS_CLOUD_|PORT$|HOST$)/;function xe(t){return[...new Set(t)].sort()}function hD(t,e={}){let r=t.kind==="secret";return{id:t.id,key:t.key,kind:t.kind,scope:t.scope,inherited:!!e.inherited,overridden:!!e.overridden,required:t.required,backend:!r||e.canReadSecretMetadata?t.backend:void 0,backendVersion:!r||e.canReadSecretMetadata?t.backendVersion:void 0,reference:r&&e.canReadSecretMetadata?t.secretRef:void 0,value:!r?t.value:void 0,lastUsedAt:t.lastUsedAt,rotatedAt:t.rotatedAt,version:t.version,updatedAt:t.updatedAt}}class UA{store;backends=new Map;fingerprintKey;now;constructor(t,e){if(this.store=t,this.fingerprintKey=e.fingerprintKey??e.encryptionKey,this.now=e.now??(()=>new Date),!this.fingerprintKey)throw Error("Configuration fingerprint key is required.");let r=e.backends??[new D_(t.controlPlane,e.encryptionKey,this.now)];for(let d of r)this.backends.set(d.kind,d)}list(t){let e=t.search?.toLowerCase();return this.store.list(t).filter((r)=>!e||r.key.toLowerCase().includes(e)).map((r)=>hD(r,{canReadSecretMetadata:t.canReadSecretMetadata}))}plan(t){let e=this.store.list({projectId:t.projectId,scope:t.scope}),r=new Map(e.map((i)=>[i.key,i])),d=[],E=[],n=[],c=[];for(let[i,T]of Object.entries(t.values)){d.push(...this.warnings(i,T));let h=r.get(i);if(!h)E.push(i);else if(h.valueFingerprint!==this.fingerprint(T))n.push(i);else c.push(i)}let _=t.removeMissing?e.filter((i)=>!Object.hasOwn(t.values,i.key)).map((i)=>i.key):[];return{added:xe(E),changed:xe(n),removed:xe(_),unchanged:xe(c),affectedResourceIds:this.affectedResources(t.projectId,t.scope,[...E,...n,..._]),warnings:d}}async set(t){let e=this.requestHash(t),r=t.idempotencyKey;if(r){let u=this.store.mutation(r);if(u){if(u.requestHash!==e)throw Error("Idempotency key was already used for a different configuration mutation.");let U=this.store.get(String(u.result.entryId??""));if(!U)throw Error("Idempotent configuration result is no longer available.");return{entry:U,mutation:u.result.mutation,warnings:[]}}}if(t.value!=null&&da.test(t.value))throw Error("Secret references must use the reference field, not a plaintext value field.");let d=this.store.find(t.projectId,t.scope,t.key),E=this.fingerprint(t.value??t.reference??"");if(d&&t.expectedVersion!=null&&d.version!==t.expectedVersion)throw Error("Configuration entry changed; refresh and retry.");if(d&&d.kind!==t.kind)throw Error("Delete the existing entry before changing between variable and secret kinds.");let n=t.kind==="variable"?"plaintext":t.backend??(t.reference?"external":"local_encrypted");if(!!d&&(d.valueFingerprint!==E||d.backend!==n||d.required!==!!t.required)&&(this.isProduction(d)||this.store.dependencies(d.id).length>0)&&!t.confirmed)throw Error("Confirmation is required because this replacement affects production or dependent services.");let _=t.reference,i;if(t.kind==="secret"){let u=this.backend(n);if(t.reference&&t.value==null){if(!await u.validate(t.reference))throw Error("Secret backend reference is unavailable or invalid.");i=d?.backendVersion??"external"}else{if(t.value==null)throw Error("A secret value or external reference is required.");let U=await u.put({reference:d?.backend===n?d.secretRef:void 0,name:this.backendName(t),value:t.value,idempotencyKey:r??crypto.randomUUID()});_=U.reference,i=U.version}}let T=t.kind==="variable"?t.value:void 0;if(t.kind==="variable"&&T==null)throw Error("A variable value is required.");let h=!d||d.valueFingerprint!==E||d.backend!==n||d.secretRef!==_||d.backendVersion!==i||d.required!==!!t.required,R=d?h?this.store.update(d.id,d.version,{value:T,valueFingerprint:E,secretRef:_,backend:n,backendVersion:i,required:!!t.required,metadata:Lt(t.metadata??d.metadata),rotatedAt:t.kind==="secret"?this.now().toISOString():d.rotatedAt}):d:this.store.create({organizationId:t.organizationId,projectId:t.projectId,scope:t.scope,key:t.key,kind:t.kind,value:T,valueFingerprint:E,secretRef:_,backend:n,backendVersion:i,origin:t.origin??"managed",required:!!t.required,metadata:Lt(t.metadata??{}),rotatedAt:t.kind==="secret"?this.now().toISOString():void 0}),N=this.affectedResources(t.projectId,t.scope,[t.key]),A={added:d?[]:[t.key],changed:d&&h?[t.key]:[],removed:[],unchanged:d&&!h?[t.key]:[],affectedResourceIds:N,versions:{[t.key]:R.version}};if(r)this.store.recordMutation({projectId:t.projectId,idempotencyKey:r,requestHash:e,actorId:t.actorId,result:{entryId:R.id,mutation:A}});return this.audit(t.projectId,t.actorId,d&&h?"configuration.updated":d?"configuration.unchanged":"configuration.created",R,N),{entry:R,mutation:A,warnings:this.warnings(t.key,t.value??"")}}async importDotenv(t){let e=_D(t.source);if(!e.valid)return{document:e,warnings:[]};let r=new Set(t.secretKeys??[]),d={added:[],changed:[],removed:[],unchanged:[],affectedResourceIds:[],versions:{}},E=[];for(let[n,c]of Object.entries(e.values)){let _=await this.set({...t,source:void 0,key:n,value:c,kind:r.has(n)?"secret":"variable",idempotencyKey:t.idempotencyKey?`${t.idempotencyKey}:${n}`:void 0});d.added.push(..._.mutation.added),d.changed.push(..._.mutation.changed),d.unchanged.push(..._.mutation.unchanged),d.affectedResourceIds.push(..._.mutation.affectedResourceIds),Object.assign(d.versions,_.mutation.versions),E.push(..._.warnings)}return d.added=xe(d.added),d.changed=xe(d.changed),d.unchanged=xe(d.unchanged),d.affectedResourceIds=xe(d.affectedResourceIds),{document:e,mutation:d,warnings:E}}exportVariables(t){return TD(Object.fromEntries(this.store.list({projectId:t.projectId,scope:t.scope,kind:"variable"}).map((e)=>[e.key,e.value??""])))}async transfer(t){let e=this.store.get(t.entryId);if(!e)throw Error("Configuration entry was not found.");if(e.scope.type===t.targetScope.type&&e.scope.id===t.targetScope.id)throw Error("Choose a different destination scope.");let r=e.kind==="variable"?e.value:e.backend==="external"?void 0:await this.backend(e.backend).resolve(e.secretRef),d=e.kind==="secret"?e.backend:void 0,E=await this.set({organizationId:e.organizationId,projectId:e.projectId,scope:t.targetScope,key:e.key,kind:e.kind,value:r,reference:e.backend==="external"?e.secretRef:void 0,backend:d,required:e.required,metadata:e.metadata,confirmed:t.confirmed,actorId:t.actorId,idempotencyKey:t.idempotencyKey?`${t.idempotencyKey}:copy`:void 0,origin:e.origin});if(t.mode==="move")await this.remove({entryId:e.id,expectedVersion:e.version,confirmed:t.confirmed,actorId:t.actorId});let n={added:E.mutation.added,changed:E.mutation.changed,removed:t.mode==="move"?[e.key]:[],unchanged:E.mutation.unchanged,affectedResourceIds:xe([...E.mutation.affectedResourceIds,...this.affectedResources(e.projectId,e.scope,[e.key])]),versions:E.mutation.versions};return{entry:E.entry,mutation:n}}async resolve(t){let e=this.store.list({projectId:t.projectId}),r=e.filter((T)=>this.applies(T,t)).sort((T,h)=>this.rank(T.scope.type)-this.rank(h.scope.type)),d=new Map,E=new Set;for(let T of r){if(d.has(T.key))E.add(T.key);d.set(T.key,T)}let n={},c={},_=[],i=new Set(t.allowedPreviewSecrets??[]);for(let[T,h]of d){if(t.previewId&&h.kind==="secret"&&h.scope.type!=="preview"&&(!t.trustedPreview||!i.has(T)))continue;if(h.kind==="variable")n[T]=h.value??"";else if(t.nativeReferences)n[T]=h.secretRef;else{let R=this.backend(h.backend);if(!await R.validate(h.secretRef)){if(_.push({key:T,code:"stale_reference",message:`${T} points to an unavailable secret.`}),h.required)_.push({key:T,code:"missing_required",message:`${T} is required but unavailable.`});continue}n[T]=await R.resolve(h.secretRef)}c[T]=hD(h,{inherited:h.scope.type!==(t.previewId?"preview":t.functionId?"function":t.resourceId?"service":t.environmentId?"environment":"project"),overridden:E.has(T),canReadSecretMetadata:t.canReadSecretMetadata}),this.store.controlPlane.database.run("UPDATE configuration_entries SET last_used_at=? WHERE id=?",[this.now().toISOString(),h.id])}return{values:n,entries:c,warnings:_,configurationHash:this.fingerprint([...d.values()].map((T)=>`${T.key}:${T.valueFingerprint}:${T.version}`).sort().join(`
 `))}}async reveal(t){let e=this.store.get(t.entryId);if(!e||e.kind!=="secret")throw Error("Configuration secret was not found.");if(!t.canRevealSecrets)throw Error("Secret reveal permission is required.");if(!t.recentlyAuthenticated)throw Error("Recent authentication is required to reveal a secret.");let r=await this.backend(e.backend).resolve(e.secretRef);return this.audit(e.projectId,t.actorId,"configuration.secret.revealed",e,[]),r}async remove(t){let e=this.store.get(t.entryId);if(!e)throw Error("Configuration entry was not found.");let r=this.store.dependencies(e.id);if(((e.scope.environmentId?this.store.controlPlane.listEnvironments(e.projectId).some((c)=>c.id===e.scope.environmentId&&c.kind==="production"):e.scope.type==="project")||r.length)&&!t.confirmed)throw Error("Confirmation is required because this configuration affects production or dependent services.");if(e.kind==="secret"&&e.backend!=="external")await this.backend(e.backend).remove(e.secretRef);this.store.remove(e.id,t.expectedVersion);let E=xe(r.map((c)=>c.resourceId)),n={added:[],changed:[],removed:[e.key],unchanged:[],affectedResourceIds:E,versions:{}};return this.audit(e.projectId,t.actorId,"configuration.deleted",e,E),n}applies(t,e){if(t.scope.type==="project")return!0;if(t.scope.type==="environment")return t.scope.id===e.environmentId;if(t.scope.type==="service")return t.scope.id===e.resourceId;if(t.scope.type==="function")return t.scope.id===e.functionId;return t.scope.id===e.previewId}rank(t){return{project:0,environment:1,service:2,function:3,preview:4}[t]}fingerprint(t){return`hmac-sha256:${ra("sha256",this.fingerprintKey).update(t).digest("hex")}`}requestHash(t){return this.fingerprint(JSON.stringify({...t,idempotencyKey:void 0,actorId:void 0}))}backend(t){let e=this.backends.get(t);if(!e)throw Error(`Configuration secret backend is not configured: ${t}`);return e}backendName(t){return`ts-cloud/${t.projectId}/${t.scope.type}/${t.scope.id}/${t.key}`.replace(/[^A-Za-z0-9/_+=.@-]/g,"-")}isProduction(t){return t.scope.type==="project"||!!t.scope.environmentId&&this.store.controlPlane.listEnvironments(t.projectId).some((e)=>e.id===t.scope.environmentId&&e.kind==="production")}warnings(t,e){let r=[];if(Ea.test(t))r.push({key:t,code:"reserved",message:`${t} may be reserved by the runtime or provider.`});if(Buffer.byteLength(e)>65536)r.push({key:t,code:"limit",message:`${t} exceeds the portable 64 KiB value limit.`});return r}affectedResources(t,e,r){let d=this.store.list({projectId:t,scope:e}).filter((E)=>r.includes(E.key)).flatMap((E)=>this.store.dependencies(E.id).map((n)=>n.resourceId));if(e.type==="service"||e.type==="function")return xe([...d,e.id]);if(e.type==="environment")return xe([...d,...this.store.controlPlane.listResources(t,e.id).map((E)=>E.id)]);if(e.type==="preview"){let E=this.store.controlPlane.database.query("SELECT resource_id FROM preview_instances WHERE id=?").get(e.id);return xe([...d,...E?[E.resource_id]:[]])}return xe([...d,...this.store.controlPlane.listResources(t).map((E)=>E.id)])}audit(t,e,r,d,E){this.store.controlPlane.appendEvent({projectId:t,actorId:e,type:r,payload:{entryId:d.id,key:d.key,kind:d.kind,scopeType:d.scope.type,scopeId:d.scope.id,backend:d.backend,version:d.version,affectedResourceIds:E}})}}async function RD(t,e,r,d){let E={added:0,changed:0,removed:0,overridden:0},n=async(c,_)=>{let i=t.store.list({projectId:e.project.id,scope:c,kind:"variable"}),T=new Set(Object.keys(_));for(let h of i.filter((R)=>R.origin==="config"&&!T.has(R.key)))await t.remove({entryId:h.id,expectedVersion:h.version,confirmed:!0,actorId:d}),E.removed++;for(let[h,R]of Object.entries(_)){let N=t.store.find(e.project.id,c,h);if(N?.origin!=="config"){if(N)E.overridden++;else await t.set({organizationId:e.organization.id,projectId:e.project.id,scope:c,key:h,kind:"variable",value:String(R),origin:"config",confirmed:!0,actorId:d}),E.added++;continue}if(N.value===String(R))continue;await t.set({organizationId:e.organization.id,projectId:e.project.id,scope:c,key:h,kind:"variable",value:String(R),origin:"config",confirmed:!0,actorId:d,expectedVersion:N.version}),E.changed++}};for(let[c,_]of Object.entries(r.environments??{})){let i=e.environments.get(c);if(!i)continue;let T=_,h={...T.variables??{},...T.app?.env??{}};await n({type:"environment",id:i.id,environmentId:i.id},h);for(let[R,N]of Object.entries(r.sites??{})){let A=e.store.listResources(e.project.id,i.id).find((u)=>u.kind==="application"&&u.slug===R);if(A)await n({type:"service",id:A.id,environmentId:i.id,resourceId:A.id},{...N.env??{}})}for(let[R,N]of Object.entries(r.infrastructure?.functions??{})){let A=e.store.listResources(e.project.id,i.id).find((u)=>u.kind==="function"&&u.slug===R);if(A)await n({type:"function",id:A.id,environmentId:i.id,resourceId:A.id},{...N.environment??{}})}}return E}import{createHash as na}from"node:crypto";var SD=async(t)=>{let e=Bun.spawn(t,{stdout:"pipe",stderr:"pipe"}),[r,d,E]=await Promise.all([e.exited,new Response(e.stdout).text(),new Response(e.stderr).text()]);return{code:r,stdout:d,stderr:E}};class ND{async scan(t,e){let r=await SD(["ssh-keyscan","-T","10","-p",String(e),"-t","ed25519",t]),d=r.stdout.split(`
-`).find((E)=>E&&!E.startsWith("#"))?.trim().split(/\s+/);if(r.code!==0||!d?.[1]||!d[2])throw Error(`SSH host-key scan failed: ${r.stderr.trim()||"no key returned"}`);return{algorithm:d[1],key:d[2]}}async exec(t,e){if(t.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return SD(["ssh","-p",String(t.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${t.sshUser}@${t.endpoint}`,e])}}var ca=(t)=>`SHA256:${na("sha256").update(Buffer.from(t,"base64")).digest("base64").replace(/=+$/,"")}`,_a=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class U_{provider;transport;discoverer;constructor(t,e=new ND,r){this.provider=t;this.transport=e;this.discoverer=r}discover(t){return this.discoverer?.(t)??Promise.resolve([])}async test(t){try{let e=await this.transport.scan(t.endpoint,t.sshPort);return{reachable:!0,hostKeyAlgorithm:e.algorithm,hostKeyFingerprint:ca(e.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(t){let e=await this.transport.exec(t,_a);if(e.code!==0)throw Error(`Fleet validation failed: ${e.stderr.trim()||e.code}`);try{return JSON.parse(e.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(t,e){let r=await this.transport.exec(t,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${e.length}`);if(r.code!==0)throw Error(`Fleet bootstrap failed: ${r.stderr.trim()||r.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function AD(t,e){return{"fleet.bootstrap":async(r)=>{let d=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},E=t.get(String(d.serverId??""));if(!E)throw Error("Queued fleet server was not found.");let n=e.find((i)=>i.provider===E.provider);if(!n)throw Error(`No ${E.provider} fleet driver is configured.`);let c=Array.isArray(d.steps)?d.steps.map(String):[];if(r.checkpoint("preflight","Rechecking pinned trust and healthy validation."),E.trustState!=="pinned"||!E.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");r.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let _=await n.bootstrap(E,c);return t.update(E.id,{bootstrapVersion:_.version,status:"ready"}),r.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:E.id,bootstrapVersion:_.version,steps:c.length}}}}var xr=(t)=>t==null?void 0:String(t),GE=(t,e)=>{try{return JSON.parse(String(t))}catch{return e}},fA=(t)=>({id:String(t.id),organizationId:String(t.organization_id),projectId:String(t.project_id),resourceId:String(t.resource_id),name:String(t.name),provider:String(t.provider),providerId:xr(t.provider_id),region:xr(t.region),zone:xr(t.zone),endpoint:String(t.endpoint),sshUser:String(t.ssh_user),sshPort:Number(t.ssh_port),credentialRef:String(t.credential_ref),hostKeyAlgorithm:xr(t.host_key_algorithm),hostKeyFingerprint:xr(t.host_key_fingerprint),pendingHostKey:xr(t.pending_host_key),roles:GE(t.roles,[]),labels:GE(t.labels,{}),taints:GE(t.taints,[]),capacity:GE(t.capacity,{}),usage:GE(t.usage,{}),capabilities:GE(t.capabilities,{}),status:String(t.status),trustState:String(t.trust_state),validation:GE(t.validation,void 0),bootstrapVersion:xr(t.bootstrap_version),heartbeatAt:xr(t.heartbeat_at),lastSeenAt:xr(t.last_seen_at),archivedAt:xr(t.archived_at),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)});class wA{control;now;id;constructor(t,e=()=>new Date,r=()=>crypto.randomUUID()){this.control=t;this.now=e;this.id=r}get(t){let e=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(t);return e?fA(e):void 0}list(t,e=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(t).map(fA).filter((r)=>e||r.status!=="archived")}findProvider(t,e,r){let d=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(t,e,r);return d?fA(d):void 0}create(t){let e=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[e,t.organizationId,t.projectId,t.resourceId,t.name,t.provider,t.providerId??null,t.region??null,t.zone??null,t.endpoint,t.sshUser,t.sshPort,t.credentialRef,t.hostKeyAlgorithm??null,t.hostKeyFingerprint??null,t.pendingHostKey??null,JSON.stringify(t.roles),JSON.stringify(t.labels),JSON.stringify(t.taints),JSON.stringify(t.capacity),JSON.stringify(t.usage),JSON.stringify(t.capabilities),t.status,t.trustState,JSON.stringify(t.validation??{}),t.bootstrapVersion??null,t.heartbeatAt??null,t.lastSeenAt??null,t.archivedAt??null,r,r]),this.get(e)}update(t,e){let r=this.get(t);if(!r)throw Error("Server was not found.");let d={...r,...e},E=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[d.name,d.providerId??null,d.region??null,d.zone??null,d.endpoint,d.sshUser,d.sshPort,d.credentialRef,d.hostKeyAlgorithm??null,d.hostKeyFingerprint??null,d.pendingHostKey??null,JSON.stringify(d.roles),JSON.stringify(d.labels),JSON.stringify(d.taints),JSON.stringify(d.capacity),JSON.stringify(d.usage),JSON.stringify(d.capabilities),d.status,d.trustState,JSON.stringify(d.validation??{}),d.bootstrapVersion??null,d.heartbeatAt??null,d.lastSeenAt??null,d.archivedAt??null,E,t]),this.get(t)}}var Ta=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class gA{store;drivers;now;queue;constructor(t,e,r,d=()=>new Date){this.store=t;this.drivers=e;this.now=d;this.queue=r??new yt(t.control)}driver(t){let e=this.drivers.find((r)=>r.provider===t);if(!e)throw Error(`No ${t} fleet driver is configured.`);return e}enroll(t){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(t.name))throw Error("Server name is invalid.");if(!Ta.test(t.endpoint)||t.sshUser==="root"||!t.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let e=t.providerId?this.store.findProvider(t.organizationId,t.provider,t.providerId):void 0;if(e)return this.store.update(e.id,{endpoint:t.endpoint,region:t.region,zone:t.zone});let r=this.store.control.createResource({projectId:t.projectId,kind:"server",slug:t.name,name:t.name,provider:t.provider,providerId:t.providerId}),d=this.driver(t.provider);return this.store.create({...t,resourceId:r.id,sshPort:t.sshPort??22,labels:t.labels??{},taints:[],capacity:{},usage:{},capabilities:d.capabilities(),status:"pending",trustState:"unverified"})}async test(t){let e=this.store.get(t);if(!e)throw Error("Server was not found.");let r=await this.driver(e.provider).test(e);if(!r.reachable)return this.store.update(t,{status:"unreachable"});if(e.hostKeyFingerprint&&e.hostKeyFingerprint!==r.hostKeyFingerprint)return this.store.update(t,{status:"degraded",trustState:"rotation_pending",pendingHostKey:r.hostKeyFingerprint});return this.store.update(t,{hostKeyAlgorithm:r.hostKeyAlgorithm,hostKeyFingerprint:r.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(t,e){let r=this.store.get(t);if(!r||r.pendingHostKey!==e)throw Error("Pending host key does not match.");return this.store.update(t,{hostKeyFingerprint:e,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(t){let e=this.store.get(t);if(!e||e.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let r=await this.driver(e.provider).validate(e),d=[];if(!["x64","arm64","x86_64","aarch64"].includes(r.arch??""))d.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let c of["curl","tar"])if(!r.tools?.[c])d.push({code:`tool.${c}`,severity:"error",message:`${c} is missing.`,remediation:`Install ${c} before bootstrap.`});if(Math.abs(r.timeSkewSeconds??0)>60)d.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!r.dnsOk)d.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let E={valid:!d.some((c)=>c.severity==="error"),facts:r,findings:d,validatedAt:this.now().toISOString(),validatorVersion:"1"},n={cpu:r.cpuCores??0,memoryBytes:r.memoryBytes??0,diskBytes:r.diskBytes??0};return this.store.update(t,{validation:E,capacity:n,status:E.valid?"ready":"degraded"})}bootstrap(t,e=!1){let r=this.store.get(t);if(!r?.validation?.valid)throw Error("A healthy validation report is required.");let d=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!e)return{preview:!0,steps:d};let E=this.queue.enqueue({projectId:r.projectId,resourceId:r.resourceId,kind:"fleet.bootstrap",input:{serverId:t,steps:d},lockKey:`server:${t}`,providerKey:r.provider}).operation;return{preview:!1,steps:d,operation:E}}heartbeat(t,e){let r=this.store.get(t);if(!r)throw Error("Server was not found.");let d=this.now().toISOString();return this.store.update(t,{usage:e.usage,capabilities:e.capabilities??r.capabilities,heartbeatAt:d,lastSeenAt:d,status:r.status==="draining"||r.status==="drained"?r.status:"ready"})}drain(t,e=!1){return this.store.update(t,{status:e?"drained":"draining"})}uncordon(t){return this.store.update(t,{status:"ready"})}archive(t,e){let r=this.store.get(t);if(!r||e!==r.name)throw Error("Exact server name confirmation is required.");return this.store.update(t,{status:"archived",archivedAt:this.now().toISOString()})}}import{createHash as $A,createPublicKey as OD,verify as ia}from"node:crypto";function f_(t){if(t===null||typeof t!=="object")return JSON.stringify(t);if(Array.isArray(t))return`[${t.map(f_).join(",")}]`;return`{${Object.keys(t).sort().map((e)=>`${JSON.stringify(e)}:${f_(t[e])}`).join(",")}}`}var CD=(t)=>$A("sha256").update(f_(t)).digest("hex"),th=(t)=>$A("sha256").update(f_(t)).digest("hex"),ID=(t)=>$A("sha256").update(OD(t).export({type:"spki",format:"der"})).digest("hex");function lD(t,e,r){try{return ia(null,Buffer.from(f_(t)),OD(r),Buffer.from(e,"base64"))}catch{return!1}}var LD=(t)=>t.replace(/^v/,"").split(/[.-]/).slice(0,3).map((e)=>Number(e)||0),uD=(t,e)=>{let r=LD(t),d=LD(e);for(let E=0;E<3;E++){let n=(r[E]??0)-(d[E]??0);if(n)return n}return 0};function DD(t,e){let r=[];if(e.schemaVersion<t.minimumSchema)r.push(`schema ${e.schemaVersion} is below ${t.minimumSchema}`);if(e.schemaVersion>t.maximumSchema)r.push(`schema ${e.schemaVersion} is above ${t.maximumSchema}`);if(t.minimumVersion&&uD(e.currentVersion,t.minimumVersion)<0)r.push(`platform ${e.currentVersion} is below ${t.minimumVersion}`);if(uD(t.version,e.currentVersion)<=0)r.push(`version ${t.version} is not newer than ${e.currentVersion}`);if(!t.artifacts.some((d)=>d.platform===e.platform&&d.architecture===e.architecture))r.push(`no artifact for ${e.platform}/${e.architecture}`);return{compatible:r.length===0,reasons:r}}var ud=(t,e)=>{try{return JSON.parse(String(t))}catch{return e}},we=(t)=>t==null?void 0:String(t),ha=(t)=>({id:String(t.id),organizationId:String(t.organization_id),name:String(t.name),algorithm:"ed25519",publicKeyPem:String(t.public_key_pem),fingerprint:String(t.fingerprint),revokedAt:we(t.revoked_at),createdAt:String(t.created_at)}),UD=(t)=>({id:String(t.id),organizationId:String(t.organization_id),version:String(t.version),channel:String(t.channel),publishedAt:String(t.published_at),keyId:String(t.key_id),digest:String(t.digest),document:ud(t.document,{}),signature:String(t.signature),verificationStatus:String(t.verification_status),compatibility:ud(t.compatibility,{compatible:!1,reasons:[]}),createdAt:String(t.created_at)}),fD=(t)=>({id:String(t.id),projectId:String(t.project_id),name:String(t.name),schedule:String(t.schedule),timezone:String(t.timezone),durationMinutes:Number(t.duration_minutes),allowedOperations:ud(t.allowed_operations,[]),requireApproval:Number(t.require_approval)===1,enabled:Number(t.enabled)===1,createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),wD=(t)=>({id:String(t.id),projectId:String(t.project_id),manifestId:String(t.manifest_id),windowId:we(t.window_id),fromVersion:String(t.from_version),strategy:String(t.strategy),batchSize:Number(t.batch_size),healthGate:ud(t.health_gate,{}),status:String(t.status),currentStage:we(t.current_stage),backupId:we(t.backup_id),approvedBy:we(t.approved_by),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),yA=(t)=>({id:String(t.id),campaignId:String(t.campaign_id),serverId:we(t.server_id),target:String(t.target),cohort:Number(t.cohort),previousVersion:String(t.previous_version),status:String(t.status),evidence:ud(t.evidence,{}),error:we(t.error),startedAt:we(t.started_at),finishedAt:we(t.finished_at),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),gD=(t)=>({id:String(t.id),projectId:String(t.project_id),kind:String(t.kind),criteria:ud(t.criteria,{}),candidates:ud(t.candidates,[]),candidateDigest:String(t.candidate_digest),estimatedBytes:Number(t.estimated_bytes),status:String(t.status),confirmation:we(t.confirmation),expiresAt:String(t.expires_at),result:ud(t.result,{}),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),$D=(t)=>({id:String(t.id),projectId:String(t.project_id),backupPolicyId:we(t.backup_policy_id),recoveryPointId:we(t.recovery_point_id),topologyId:we(t.topology_id),scenario:String(t.scenario),isolatedTarget:String(t.isolated_target),expectedRpoMinutes:Number(t.expected_rpo_minutes),expectedRtoMinutes:Number(t.expected_rto_minutes),status:String(t.status),operationId:we(t.operation_id),evidence:ud(t.evidence,{}),measuredRpoMinutes:t.measured_rpo_minutes==null?void 0:Number(t.measured_rpo_minutes),measuredRtoMinutes:t.measured_rto_minutes==null?void 0:Number(t.measured_rto_minutes),cleanupVerified:Number(t.cleanup_verified)===1,error:we(t.error),startedAt:we(t.started_at),finishedAt:we(t.finished_at),createdAt:String(t.created_at),updatedAt:String(t.updated_at)});class XA{control;now;id;constructor(t,e=()=>new Date,r=()=>crypto.randomUUID()){this.control=t;this.now=e;this.id=r}addTrustedKey(t){let e=this.id(),r=this.now().toISOString(),d=ID(t.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[e,t.organizationId,t.name,t.publicKeyPem,d,r]),this.key(e)}key(t){let e=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(t);return e?ha(e):void 0}revokeKey(t){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),t]),this.key(t)}importManifest(t){let e=this.key(t.keyId);if(!e||e.organizationId!==t.organizationId)throw Error("Trusted update key was not found.");if(e.revokedAt)throw Error("Update signing key is revoked.");if(!lD(t.document,t.signature,e.publicKeyPem))throw Error("Update manifest signature is invalid.");let r=DD(t.document,t.current),d=CD(t.document),E=this.id(),n=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[E,t.organizationId,t.document.version,t.document.channel,new Date(t.document.publishedAt).toISOString(),t.keyId,d,JSON.stringify(t.document),t.signature,JSON.stringify(r),n]),this.manifest(E)}manifest(t){let e=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(t);return e?UD(e):void 0}manifests(t){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(t).map(UD)}createWindow(t){let e=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[e,t.projectId,t.name,t.schedule,t.timezone,t.durationMinutes,JSON.stringify(t.allowedOperations),t.requireApproval===!1?0:1,r,r]),this.window(e)}window(t){let e=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(t);return e?fD(e):void 0}windows(t){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(t).map(fD)}createCampaign(t){return this.control.transaction(()=>{let e=this.manifest(t.manifestId);if(!e?.compatibility.compatible||e.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!t.backupId)throw Error("A verified pre-upgrade backup is required.");let r=this.id(),d=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[r,t.projectId,t.manifestId,t.windowId??null,t.fromVersion,t.strategy,t.batchSize,JSON.stringify(t.healthGate),t.backupId,t.approvedBy??null,d,d]),t.targets.forEach((E,n)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,E.serverId??null,E.target,t.strategy==="canary"?n===0?0:1+Math.floor((n-1)/t.batchSize):Math.floor(n/t.batchSize),E.previousVersion,d,d])),this.campaign(r)})}campaign(t){let e=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(t);return e?wD(e):void 0}campaigns(t){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(t).map(wD)}targets(t){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(t).map(yA)}updateCampaign(t,e){let r=this.campaign(t);if(!r)throw Error("Upgrade campaign was not found.");let d={...r,...e};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[d.status,d.currentStage??null,this.now().toISOString(),t]),this.campaign(t)}updateTarget(t,e){let r=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(t);if(!r)throw Error("Upgrade target was not found.");let d={...yA(r),...e};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[d.status,JSON.stringify(d.evidence),d.error??null,d.startedAt??null,d.finishedAt??null,this.now().toISOString(),t]),yA(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(t))}createCleanup(t){let e=[...t.candidates].sort((c,_)=>c.id.localeCompare(_.id)),r=th(e),d=this.id(),E=this.now().toISOString(),n=new Date(this.now().getTime()+(t.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[d,t.projectId,t.kind,JSON.stringify(t.criteria),JSON.stringify(e),r,e.reduce((c,_)=>c+_.bytes,0),n,E,E]),this.cleanup(d)}cleanup(t){let e=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(t);return e?gD(e):void 0}cleanups(t){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(t).map(gD)}updateCleanup(t,e){let r=this.cleanup(t);if(!r)throw Error("Cleanup plan was not found.");let d={...r,...e};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[d.status,d.confirmation??null,JSON.stringify(d.result),this.now().toISOString(),t]),this.cleanup(t)}createDrill(t){if(!/^isolated:\/\//.test(t.isolatedTarget))throw Error("DR drills require an isolated target.");let e=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[e,t.projectId,t.backupPolicyId??null,t.recoveryPointId??null,t.topologyId??null,t.scenario,t.isolatedTarget,t.expectedRpoMinutes,t.expectedRtoMinutes,r,r]),this.drill(e)}drill(t){let e=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(t);return e?$D(e):void 0}drills(t){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(t).map($D)}updateDrill(t,e){let r=this.drill(t);if(!r)throw Error("DR drill was not found.");let d={...r,...e};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[d.status,d.operationId??null,JSON.stringify(d.evidence),d.measuredRpoMinutes??null,d.measuredRtoMinutes??null,d.cleanupVerified?1:0,d.error??null,d.startedAt??null,d.finishedAt??null,this.now().toISOString(),t]),this.drill(t)}}function Ra(t,e=new Date){if(!t.enabled)return!1;let r=new Date(t.schedule);if(!Number.isNaN(r.getTime()))return e>=r&&e.getTime()<=r.getTime()+t.durationMinutes*60000;let d=/^(\d{2}):(\d{2})$/.exec(t.schedule);if(!d)return!1;let E=new Intl.DateTimeFormat("en-US",{timeZone:t.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(e),n=Number(E.find((_)=>_.type==="hour")?.value)*60+Number(E.find((_)=>_.type==="minute")?.value),c=Number(d[1])*60+Number(d[2]);return n>=c&&n<c+t.durationMinutes}class PA{store;now;queue;constructor(t,e,r=()=>new Date){this.store=t;this.now=r;this.queue=e??new yt(t.control)}enqueueCampaign(t,e={}){let r=this.store.campaign(t);if(!r)throw Error("Upgrade campaign was not found.");let d=r.windowId?this.store.window(r.windowId):void 0;if(d&&!d.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(d&&!e.overrideWindow&&!Ra(d,this.now()))throw Error("Upgrade is outside its maintenance window.");if(d?.requireApproval&&!e.approvedBy&&!r.approvedBy)throw Error("Maintenance approval is required.");let E=this.queue.enqueue({projectId:r.projectId,actorId:e.approvedBy,kind:"maintenance.upgrade",input:{campaignId:t},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(t,{status:"queued"}),operation:E}}async previewCleanup(t,e){let r=e.find((d)=>d.kind===t.kind);if(!r)throw Error(`No ${t.kind} cleanup driver is configured.`);return this.store.createCleanup({...t,candidates:await r.discover(t.criteria)})}enqueueCleanup(t,e){let r=this.store.cleanup(t);if(!r||r.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(r.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let d=`DELETE ${r.candidates.length} ${r.kind}`;if(e!==d)throw Error(`Exact confirmation ${d} is required.`);let E=this.queue.enqueue({projectId:r.projectId,kind:"maintenance.cleanup",input:{planId:t},lockKey:`cleanup:${r.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(t,{status:"approved",confirmation:e}),operation:E}}enqueueDrill(t){let e=this.store.drill(t);if(!e||e.status!=="planned")throw Error("A planned DR drill is required.");let r=this.queue.enqueue({projectId:e.projectId,kind:"maintenance.drill",input:{drillId:t},lockKey:`drill:${e.scenario}:${e.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(t,{status:"queued",operationId:r.id}),operation:r}}}var aA=(t)=>t&&typeof t==="object"&&!Array.isArray(t)?t:{};function yD(t){return{"maintenance.upgrade":async(E)=>{let n=t.store.campaign(String(aA(E.operation.input).campaignId??""));if(!n||!t.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let c=t.store.manifest(n.manifestId);if(!c?.compatibility.compatible||c.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let _=c.document.artifacts.find((T)=>T.platform===process.platform&&T.architecture===process.arch)??c.document.artifacts[0];if(!_)throw Error("No update artifact matches this platform.");t.store.updateCampaign(n.id,{status:"running",currentStage:"preflight"});let i=[];try{for(let T of[...new Set(t.store.targets(n.id).map((h)=>h.cohort))].sort((h,R)=>h-R)){t.store.updateCampaign(n.id,{currentStage:`cohort:${T}`});for(let h of t.store.targets(n.id).filter((R)=>R.cohort===T)){E.throwIfCancellationRequested(),E.checkpoint(`download:${h.target}`,"Downloading signed platform artifact."),t.store.updateTarget(h.id,{status:"downloading",startedAt:new Date().toISOString()});let R=await t.platform.download({target:h,artifact:_,signal:E.signal});if(R.sha256!==_.sha256)throw Error(`Artifact checksum mismatch for ${h.target}.`);E.checkpoint(`install:${h.target}`,"Installing verified artifact."),t.store.updateTarget(h.id,{status:"installing"}),await t.platform.install({target:h,path:R.path,version:c.version,signal:E.signal}),i.push(h);let N=await t.platform.health({target:h,gate:n.healthGate});if(!N.healthy)throw Error(`Upgrade health gate failed for ${h.target}.`);t.store.updateTarget(h.id,{status:"healthy",evidence:N.evidence,finishedAt:new Date().toISOString()})}}return t.store.updateCampaign(n.id,{status:"succeeded",currentStage:void 0}),{campaignId:n.id,version:c.version,targets:i.length}}catch(T){t.store.updateCampaign(n.id,{status:"rolling_back",currentStage:"rollback"});for(let h of i.reverse())t.store.updateTarget(h.id,{status:"rolling_back"}),await t.platform.rollback({target:h,version:h.previousVersion,signal:E.signal}),t.store.updateTarget(h.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw t.store.updateCampaign(n.id,{status:"rolled_back",currentStage:void 0}),T}},"maintenance.cleanup":async(E)=>{let n=t.store.cleanup(String(aA(E.operation.input).planId??""));if(!n||n.status!=="approved")throw Error("Approved cleanup plan was not found.");if(th([...n.candidates].sort((h,R)=>h.id.localeCompare(R.id)))!==n.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let c=t.cleanup?.find((h)=>h.kind===n.kind);if(!c)throw Error(`No ${n.kind} cleanup driver is configured.`);t.store.updateCleanup(n.id,{status:"running"});let _=[],i=[];for(let h of n.candidates){E.throwIfCancellationRequested();try{await c.remove(h),_.push(h.id)}catch(R){i.push({id:h.id,error:R instanceof Error?R.message:String(R)})}}let T=i.length?_.length?"partial":"failed":"succeeded";if(t.store.updateCleanup(n.id,{status:T,result:{removed:_,failed:i,reclaimedBytes:n.candidates.filter((h)=>_.includes(h.id)).reduce((h,R)=>h+R.bytes,0)}}),i.length)throw Error(`Cleanup failed for ${i.length} candidate(s).`);return{planId:n.id,removed:_.length,reclaimedBytes:n.estimatedBytes}},"maintenance.drill":async(E)=>{let n=t.store.drill(String(aA(E.operation.input).drillId??""));if(!n)throw Error("DR drill was not found.");let c=t.recovery?.find((R)=>R.scenario===n.scenario);if(!c)throw Error(`No ${n.scenario} recovery driver is configured.`);let _=new Date;t.store.updateDrill(n.id,{status:"restoring",startedAt:_.toISOString()});let i=n.isolatedTarget,T={},h={};try{E.checkpoint("restore","Restoring into isolated drill target.");let R=await c.restore({drill:n,signal:E.signal});if(!R.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");i=R.target,T=R.evidence;let N=(_.getTime()-new Date(R.recoveryPointAt).getTime())/60000;t.store.updateDrill(n.id,{status:"verifying",measuredRpoMinutes:N,evidence:{restore:T}}),E.checkpoint("verify","Running recovery health checks without production traffic.");let A=await c.verify({drill:n,target:i});h=A.evidence;let u=(Date.now()-_.getTime())/60000;if(!A.healthy||N>n.expectedRpoMinutes||u>n.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");t.store.updateDrill(n.id,{measuredRpoMinutes:N,measuredRtoMinutes:u,evidence:{restore:T,verify:h}})}catch(R){throw t.store.updateDrill(n.id,{status:"failed",error:R instanceof Error?R.message:String(R),evidence:{restore:T,verify:h}}),R}finally{t.store.updateDrill(n.id,{status:"cleaning"});try{await c.cleanup({drill:n,target:i});let R=t.store.drill(n.id);t.store.updateDrill(n.id,{status:R.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(R){t.store.updateDrill(n.id,{status:"cleanup_required",cleanupVerified:!1,error:R instanceof Error?R.message:String(R),finishedAt:new Date().toISOString()})}}return{drillId:n.id,status:t.store.drill(n.id).status}}}}var XD={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class jA{kind;control;projectId;organizationId;constructor(t,e,r,d){this.kind=t;this.control=e;this.projectId=r;this.organizationId=d}async discover(t){let e=Math.max(1,Math.min(3650,Number(t.olderThanDays??30))),r=new Date(Date.now()-e*86400000).toISOString(),d=XD[this.kind],E=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(d.select).all(E,r).map((c)=>({id:String(c.id),kind:this.kind,label:`${this.kind}:${String(c.id)}`,bytes:Number(c.bytes??0),metadata:{createdAt:String(c.created_at)}}))}async remove(t){if(this.control.database.run(XD[this.kind].remove,[t.id]).changes!==1)throw Error(`${t.label} changed or is no longer removable.`)}}var zr=(t,e)=>{try{return JSON.parse(String(t))}catch{return e}},qe=(t)=>t==null?void 0:String(t),jD=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),rc=(t={})=>({...jD(),...t});function PD(t){return{id:String(t.id),organizationId:String(t.organization_id),projectId:String(t.project_id),name:String(t.name),purpose:String(t.purpose),backend:String(t.backend),region:qe(t.region),architecture:qe(t.architecture),labels:zr(t.labels,{}),requiredServerLabels:zr(t.required_server_labels,{}),toleratedTaints:zr(t.tolerated_taints,[]),capacity:rc(zr(t.capacity,{})),reserved:zr(t.reserved,{}),maxWorkloads:Number(t.max_workloads),costWeight:Number(t.cost_weight),spreadKey:qe(t.spread_key),concurrency:Number(t.concurrency),ephemeralWorkspaces:Number(t.ephemeral_workspaces)===1,allowProductionSecrets:Number(t.allow_production_secrets)===1,status:String(t.status),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}}function aD(t){return{id:String(t.id),projectId:String(t.project_id),environmentId:qe(t.environment_id),resourceId:String(t.resource_id),releaseId:qe(t.release_id),poolId:String(t.pool_id),serverId:qe(t.server_id),purpose:String(t.purpose),requirements:zr(t.requirements,{}),decision:zr(t.decision,{}),stateful:Number(t.stateful)===1,autoReschedule:Number(t.auto_reschedule)===1,status:String(t.status),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}}function Sa(t){return{id:String(t.id),projectId:String(t.project_id),resourceId:qe(t.resource_id),poolId:String(t.pool_id),placementId:qe(t.placement_id),operationId:qe(t.operation_id),sourceSha:String(t.source_sha),buildSpec:zr(t.build_spec,{}),credentialPolicy:zr(t.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:qe(t.workspace),cacheKey:qe(t.cache_key),artifactUri:qe(t.artifact_uri),artifactDigest:qe(t.artifact_digest),status:String(t.status),cleanupAt:qe(t.cleanup_at),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}}class zA{control;now;id;constructor(t,e=()=>new Date,r=()=>crypto.randomUUID()){this.control=t;this.now=e;this.id=r}createPool(t){let e=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[e,t.organizationId,t.projectId,t.name,t.purpose,t.backend,t.region??null,t.architecture??null,JSON.stringify(t.labels),JSON.stringify(t.requiredServerLabels),JSON.stringify(t.toleratedTaints),JSON.stringify(rc(t.capacity)),"{}",t.maxWorkloads,t.costWeight,t.spreadKey??null,t.concurrency,t.ephemeralWorkspaces?1:0,t.allowProductionSecrets?1:0,t.status,r,r]),this.getPool(e)}getPool(t){let e=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(t);return e?PD(e):void 0}listPools(t){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(t).map(PD)}updatePool(t,e){let r=this.getPool(t);if(!r)throw Error("Capacity pool was not found.");let d={...r,...e},E=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[d.status,JSON.stringify(d.reserved),JSON.stringify(d.capacity),d.concurrency,E,t]),this.getPool(t)}addMember(t,e,r={}){let d=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[t,e,JSON.stringify(r),d,d])}members(t){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(t).map((e)=>({serverId:String(e.server_id),status:String(e.status),capacityOverride:zr(e.capacity_override,{})}))}memberStatus(t,e,r){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[r,this.now().toISOString(),t,e])}listPlacements(t,e){let r=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(t).map(aD);return e?.length?r.filter((d)=>e.includes(d.status)):r}getPlacement(t){let e=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(t);return e?aD(e):void 0}activeUsage(t,e){let r=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(t,this.now().toISOString()),d=e?r.filter((E)=>String(E.server_id)===e):r;return{resources:d.reduce((E,n)=>{let c=rc(zr(n.resources,{}));for(let _ of Object.keys(E))E[_]+=c[_];return E},jD()),count:d.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(t){return this.control.transaction(()=>{this.expireLeases();let e=this.id(),r=this.id(),d=this.now().toISOString(),E=new Date(this.now().getTime()+(t.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[e,t.projectId,t.environmentId??null,t.resourceId,t.releaseId??null,t.decision.poolId,t.decision.serverId??null,t.requirements.purpose,JSON.stringify(t.requirements),JSON.stringify(t.decision),t.requirements.stateful?1:0,t.requirements.autoReschedule&&!t.requirements.stateful?1:0,d,d]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[r,e,t.decision.poolId,t.decision.serverId??null,JSON.stringify(rc(t.requirements.resources)),E,d,d]),this.getPlacement(e)})}transitionPlacement(t,e){if(!this.getPlacement(t))throw Error("Placement was not found.");let d=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[e,d,t]),["released","failed","blocked"].includes(e))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[d,t]);return this.getPlacement(t)}createBuild(t){let e=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[e,t.projectId,t.resourceId??null,t.poolId,t.placementId??null,t.operationId??null,t.sourceSha,JSON.stringify(t.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:t.tokenExpiresAt}),r,r]),this.getBuild(e)}getBuild(t){let e=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(t);return e?Sa(e):void 0}updateBuild(t,e){let r=this.getBuild(t);if(!r)throw Error("Remote build was not found.");let d={...r,...e},E=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[d.operationId??null,d.workspace??null,d.cacheKey??null,d.artifactUri??null,d.artifactDigest??null,d.status,d.cleanupAt??null,E,t]),this.getBuild(t)}}var eh=["cpu","memoryBytes","diskBytes","gpu"],zD=(t,e={})=>Object.entries(e).every(([r,d])=>t[r]===d),Na=(t,e,r)=>Object.fromEntries(eh.map((d)=>[d,Math.max(0,t[d]-e[d]-(r[d]??0))])),Aa=(t,e)=>eh.every((r)=>t[r]>=(e[r]??0)),La=(t,e)=>eh.reduce((r,d)=>r+(e[d]??0)/(t[d]||1),0);class FA{store;fleet;constructor(t,e){this.store=t;this.fleet=e}poolCandidates(t,e,r){let d=[];for(let E of this.store.listPools(t)){if(E.id===r)continue;let n=[];if(E.status!=="active")n.push(`pool is ${E.status}`);if(E.purpose!==e.purpose)n.push(`purpose is ${E.purpose}`);if(e.region&&E.region!==e.region)n.push(`region is ${E.region??"unset"}`);if(e.architecture&&E.architecture!==e.architecture)n.push(`architecture is ${E.architecture??"unset"}`);if(!zD(E.labels,e.labels))n.push("pool labels do not match");if(E.backend==="server"){let c=this.store.members(E.id);if(!c.length)d.push(this.decision(E,void 0,e,[...n,"pool has no servers"]));for(let _ of c){let i=this.fleet.get(_.serverId),T=[...n];if(!i)T.push("server is missing");else this.serverReasons(E,i,_.status,e,T);d.push(this.decision(E,i,e,T,_.capacityOverride))}}else d.push(this.decision(E,void 0,e,n))}return d.sort((E,n)=>Number(n.eligible)-Number(E.eligible)||E.score.cost-n.score.cost||E.score.spread-n.score.spread||E.score.fit-n.score.fit||E.poolName.localeCompare(n.poolName)||(E.serverId??"").localeCompare(n.serverId??""))}serverReasons(t,e,r,d,E){if(r!=="active")E.push(`member is ${r}`);if(e.status!=="ready")E.push(`server is ${e.status}`);if(!e.roles.includes(d.purpose==="build"?"build":d.purpose))E.push(`server lacks ${d.purpose} role`);if(!zD(e.labels,t.requiredServerLabels))E.push("server labels do not match pool selector");for(let n of e.taints)if(!t.toleratedTaints.includes(n))E.push(`taint ${n} is not tolerated`)}decision(t,e,r,d,E={}){let n=rc({...e?.capacity,...E}),c=e?Object.fromEntries(eh.map((T)=>[T,Math.min(t.capacity[T],n[T])])):t.capacity,_=this.store.activeUsage(t.id,e?.id),i=Na(c,_.resources,t.reserved);if(_.count>=t.maxWorkloads)d.push("workload limit reached");if(r.purpose==="build"&&_.count>=t.concurrency)d.push("build concurrency reached");if(!Aa(i,r.resources))d.push("insufficient capacity");return{poolId:t.id,poolName:t.name,serverId:e?.id,eligible:d.length===0,reasons:d,available:i,score:{fit:La(i,r.resources),spread:_.count,cost:t.costWeight}}}explain(t,e){return this.poolCandidates(t,e)}place(t){return this.store.control.transaction(()=>{let e=this.poolCandidates(t.projectId,t.requirements).find((r)=>r.eligible);if(!e)throw Error(`No eligible capacity: ${this.explain(t.projectId,t.requirements).flatMap((r)=>r.reasons).join("; ")}`);return this.store.reserve({...t,decision:e})})}activate(t){return this.store.transitionPlacement(t,"active")}release(t){return this.store.transitionPlacement(t,"released")}drainPool(t){let e=this.store.updatePool(t,{status:"draining"}),r=[],d=[];for(let E of this.store.listPlacements(e.projectId,["reserved","active"]).filter((n)=>n.poolId===t)){if(E.stateful){d.push(this.store.transitionPlacement(E.id,"blocked"));continue}this.store.transitionPlacement(E.id,"moving");let n=this.place({projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,releaseId:E.releaseId,requirements:E.requirements});r.push(this.activate(n.id)),this.store.transitionPlacement(E.id,"released")}return{pool:e,moved:r,blocked:d}}drainServer(t,e){this.store.memberStatus(t,e,"draining");let r=this.store.getPool(t);if(!r)throw Error("Capacity pool was not found.");let d=[],E=[];for(let n of this.store.listPlacements(r.projectId,["reserved","active"]).filter((c)=>c.poolId===t&&c.serverId===e)){if(n.stateful){E.push(this.store.transitionPlacement(n.id,"blocked"));continue}this.store.transitionPlacement(n.id,"moving");let c=this.poolCandidates(n.projectId,n.requirements).find((i)=>i.eligible);if(!c){E.push(this.store.transitionPlacement(n.id,"blocked"));continue}let _=this.store.reserve({projectId:n.projectId,environmentId:n.environmentId,resourceId:n.resourceId,releaseId:n.releaseId,requirements:n.requirements,decision:c});d.push(this.activate(_.id)),this.store.transitionPlacement(n.id,"released")}return{moved:d,blocked:E}}reconcileFailure(t){let e=this.fleet.get(t);if(!e)throw Error("Server was not found.");let r=[],d=[];for(let E of this.store.listPlacements(e.projectId,["active"]).filter((n)=>n.serverId===t)){if(E.stateful||!E.autoReschedule){d.push(this.store.transitionPlacement(E.id,"blocked"));continue}this.store.transitionPlacement(E.id,"failed");let n=this.place({projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,releaseId:E.releaseId,requirements:E.requirements});r.push(this.activate(n.id))}return{rescheduled:r,blocked:d}}}var Od=(t,e)=>{try{return JSON.parse(String(t))}catch{return e}},Ir=(t)=>t==null?void 0:String(t),FD=(t)=>({id:String(t.id),organizationId:String(t.organization_id),projectId:String(t.project_id),environmentId:Ir(t.environment_id),name:String(t.name),hostname:String(t.hostname),homeRegion:String(t.home_region),regions:Od(t.regions,[]),trafficPolicy:String(t.traffic_policy),dataPolicy:Od(t.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(t.status),activeRegion:String(t.active_region),revision:Ir(t.revision),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),BA=(t)=>({id:String(t.id),topologyId:String(t.topology_id),region:String(t.region),role:String(t.role),provider:String(t.provider),stackId:Ir(t.stack_id),stackRevision:Ir(t.stack_revision),status:String(t.status),health:Od(t.health,{}),lastHealthyAt:Ir(t.last_healthy_at),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),JA=(t)=>({id:String(t.id),topologyId:String(t.topology_id),kind:String(t.kind),sourceRegion:String(t.source_region),targetRegion:String(t.target_region),config:Od(t.config,{}),status:String(t.status),checkpoint:Ir(t.checkpoint),lagSeconds:t.lag_seconds==null?void 0:Number(t.lag_seconds),lastVerifiedAt:Ir(t.last_verified_at),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),HA=(t)=>({id:String(t.id),topologyId:String(t.topology_id),hostname:String(t.hostname),dnsProvider:String(t.dns_provider),cdnEnabled:Number(t.cdn_enabled)===1,wafEnabled:Number(t.waf_enabled)===1,weights:Od(t.weights,{}),desiredWeights:Od(t.desired_weights,{}),status:String(t.status),providerState:Od(t.provider_state,{}),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),BD=(t)=>({id:String(t.id),topologyId:String(t.topology_id),operationId:Ir(t.operation_id),kind:String(t.kind),requestedRegion:Ir(t.requested_region),revision:Ir(t.revision),plan:Od(t.plan,[]),currentStep:Ir(t.current_step),completedSteps:Od(t.completed_steps,[]),status:String(t.status),error:Ir(t.error),createdAt:String(t.created_at),updatedAt:String(t.updated_at)});class WA{control;now;id;constructor(t,e=()=>new Date,r=()=>crypto.randomUUID()){this.control=t;this.now=e;this.id=r}create(t){return this.control.transaction(()=>{if(t.regions.length<2||new Set(t.regions.map((n)=>n.region)).size!==t.regions.length||t.regions.filter((n)=>n.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let e=t.regions.find((n)=>n.role==="primary"),r=this.id(),d=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[r,t.organizationId,t.projectId,t.environmentId??null,t.name,t.hostname,e.region,JSON.stringify(t.regions),t.trafficPolicy,JSON.stringify(t.dataPolicy),e.region,d,d]);for(let n of t.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),r,n.region,n.role,n.provider,d,d]);for(let n of t.dataPolicy.replicate)for(let c of t.regions)for(let _ of t.regions.filter((i)=>i.region!==c.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,n,c.region,_.region,"{}",d,d]);let E=Object.fromEntries(t.regions.map((n)=>[n.region,n.region===e.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),r,t.hostname,t.dnsProvider??"route53",t.cdnEnabled?1:0,t.wafEnabled?1:0,JSON.stringify(E),JSON.stringify(E),d,d]),this.get(r)})}get(t){let e=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(t);return e?FD(e):void 0}list(t){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(t).map(FD)}targets(t){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(t).map(BA)}channels(t){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(t).map(JA)}route(t){let e=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(t);return e?HA(e):void 0}updateTopology(t,e){let r=this.get(t);if(!r)throw Error("Regional topology was not found.");let d={...r,...e},E=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[d.status,d.activeRegion,d.revision??null,JSON.stringify(d.regions),E,t]),this.get(t)}updateTarget(t,e){let r=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(t);if(!r)throw Error("Regional target was not found.");let d=BA(r),E={...d,...e},n=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[E.role,E.stackId??null,E.stackRevision??null,E.status,JSON.stringify(E.health),E.lastHealthyAt??null,n,t]),BA(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(t))}updateChannel(t,e){let r=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(t);if(!r)throw Error("Replication channel was not found.");let d=JA(r),E={...d,...e},n=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[E.status,E.checkpoint??null,E.lagSeconds??null,E.lastVerifiedAt??null,n,t]),JA(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(t))}updateRoute(t,e){let r=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(t);if(!r)throw Error("Traffic route was not found.");let d=HA(r),E={...d,...e},n=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(E.weights),JSON.stringify(E.desiredWeights),E.status,JSON.stringify(E.providerState),n,t]),HA(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(t))}createExecution(t){let e=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[e,t.topologyId,t.operationId??null,t.kind,t.requestedRegion??null,t.revision??null,JSON.stringify(t.plan),r,r]),this.execution(e)}execution(t){let e=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(t);return e?BD(e):void 0}executions(t){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(t).map(BD)}updateExecution(t,e){let r=this.execution(t);if(!r)throw Error("Regional execution was not found.");let d={...r,...e},E=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[d.operationId??null,d.currentStep??null,JSON.stringify(d.completedSteps),d.status,d.error??null,E,t]),this.execution(t)}}class vA{store;queue;constructor(t,e){this.store=t;this.queue=e??new yt(t.control)}create(t){return this.store.create(t)}plan(t,e,r){if(!this.store.get(t))throw Error("Regional topology was not found.");let E=this.store.targets(t),n=this.store.channels(t);if(e==="rollout")return[...E.filter((c)=>c.role==="secondary").map((c)=>`apply:${c.region}`),...E.filter((c)=>c.role==="primary").map((c)=>`apply:${c.region}`),...n.map((c)=>`replicate:${c.kind}:${c.targetRegion}`),"traffic:activate"];if(e==="failover"||e==="failback")return[`health:${r}`,`replication:${r}`,`traffic:${r}`,`roles:${r}`];if(e==="destroy")return["traffic:drain",...E.filter((c)=>c.role==="secondary").map((c)=>`delete:${c.region}`),...E.filter((c)=>c.role==="primary").map((c)=>`delete:${c.region}`),"complete"];return["observe","repair"]}enqueue(t){let e=this.store.get(t.topologyId);if(!e)throw Error("Regional topology was not found.");if(["failover","failback"].includes(t.kind)&&(!t.targetRegion||!e.regions.some((n)=>n.region===t.targetRegion)))throw Error("A topology target region is required.");if(t.kind==="failover"&&t.targetRegion===e.activeRegion)throw Error("Target region is already active.");if((t.kind==="destroy"||t.deleteData)&&t.confirmation!==e.name)throw Error("Exact topology name confirmation is required.");if(t.deleteData&&e.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(t.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(t.revision??""))throw Error("An immutable revision is required.");let r=this.plan(e.id,t.kind,t.targetRegion),d=this.store.createExecution({topologyId:e.id,kind:t.kind,requestedRegion:t.targetRegion,revision:t.revision,plan:r}),E=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,kind:`region.${t.kind}`,input:{executionId:d.id,manifest:t.manifest??{},deleteData:t.deleteData===!0},lockKey:`regional-topology:${e.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(d.id,{operationId:E.id}),{execution:this.store.execution(d.id),operation:E}}}var ua=(t)=>t&&typeof t==="object"&&!Array.isArray(t)?t:{};function JD(t,e){let r=(T)=>{let h=e.find((R)=>R.provider===T.provider);if(!h)throw Error(`No ${T.provider} regional driver is configured.`);return h},d=(T,h,R)=>{T.throwIfCancellationRequested(),T.checkpoint(R,R),t.updateExecution(h.id,{status:"running",currentStep:R,completedSteps:[...t.execution(h.id).completedSteps,R]})},E=async(T,h)=>{let R=t.route(T.id);if(!R)throw Error("Regional traffic route was not found.");let N=t.targets(T.id).find((u)=>u.region===T.activeRegion)??t.targets(T.id)[0];if(!N)throw Error("Regional traffic target was not found.");t.updateRoute(R.id,{status:"applying",desiredWeights:h});let A=await r(N).applyTraffic({route:t.route(T.id),topology:T,weights:h});t.updateRoute(R.id,{status:Object.values(h).every((u)=>u===0)?"drained":"in_sync",weights:h,providerState:A.providerState})},n=async(T,h,R,N)=>{t.updateTopology(R.id,{status:"provisioning"});let A=h.revision,u=N.manifest??{},U=t.targets(R.id).sort((l,P)=>Number(l.role==="primary")-Number(P.role==="primary"));for(let l of U){d(T,h,`apply:${l.region}`),t.updateTarget(l.id,{status:"provisioning"});let P=await r(l).applyStack({target:l,revision:A,manifest:u,signal:T.signal}),a=await r(l).health({target:t.updateTarget(l.id,{stackId:P.stackId,stackRevision:A})});if(!a.healthy)throw Error(`Regional health gate failed in ${l.region}.`);t.updateTarget(l.id,{status:"ready",health:a.evidence,lastHealthyAt:new Date().toISOString()})}for(let l of t.channels(R.id)){d(T,h,`replicate:${l.kind}:${l.targetRegion}`),t.updateChannel(l.id,{status:"configuring"});let P=U.find((B)=>B.region===l.sourceRegion),a=await r(P).configureReplication({channel:l,topology:R}),j=await r(P).verifyReplication({channel:t.updateChannel(l.id,{checkpoint:a.checkpoint,lagSeconds:a.lagSeconds}),topology:R});if(!j.healthy||j.lagSeconds>R.dataPolicy.maxLagSeconds)throw Error(`${l.kind} replication to ${l.targetRegion} exceeds the RPO.`);t.updateChannel(l.id,{status:"in_sync",checkpoint:j.checkpoint,lagSeconds:j.lagSeconds,lastVerifiedAt:new Date().toISOString()})}d(T,h,"traffic:activate");let w=Object.fromEntries(R.regions.map((l)=>[l.region,l.region===R.activeRegion?100:0]));return await E(R,w),t.updateTopology(R.id,{status:"ready",revision:A}),{revision:A,activeRegion:R.activeRegion}},c=async(T,h,R)=>{let N=h.requestedRegion,A=t.targets(R.id).find((w)=>w.region===N);if(!A)throw Error("Requested regional target was not found.");t.updateTopology(R.id,{status:h.kind==="failover"?"failing_over":"failing_back"}),d(T,h,`health:${N}`);let u=await r(A).health({target:A});if(!u.healthy)throw Error(`Target region ${N} is unhealthy.`);t.updateTarget(A.id,{status:"ready",health:u.evidence,lastHealthyAt:new Date().toISOString()}),d(T,h,`replication:${N}`);for(let w of t.channels(R.id).filter((l)=>l.targetRegion===N)){let l=await r(A).verifyReplication({channel:w,topology:R});if(!l.healthy||l.lagSeconds>R.dataPolicy.maxLagSeconds)throw Error(`${w.kind} replication is outside the failover RPO.`);t.updateChannel(w.id,{status:"in_sync",checkpoint:l.checkpoint,lagSeconds:l.lagSeconds,lastVerifiedAt:new Date().toISOString()})}d(T,h,`traffic:${N}`),await E(R,Object.fromEntries(R.regions.map((w)=>[w.region,w.region===N?100:0]))),d(T,h,`roles:${N}`);let U=R.regions.map((w)=>({...w,role:w.region===N?"primary":"secondary"}));for(let w of t.targets(R.id))t.updateTarget(w.id,{role:w.region===N?"primary":"secondary"});return t.updateTopology(R.id,{status:h.kind==="failover"?"failed_over":"ready",activeRegion:N,regions:U}),{activeRegion:N}},_=async(T,h,R,N)=>{t.updateTopology(R.id,{status:"destroying"}),d(T,h,"traffic:drain"),await E(R,Object.fromEntries(R.regions.map((u)=>[u.region,0])));let A=N.deleteData!==!0;for(let u of t.targets(R.id).sort((U,w)=>Number(U.role==="primary")-Number(w.role==="primary")))d(T,h,`delete:${u.region}`),t.updateTarget(u.id,{status:"deleting"}),await r(u).deleteStack({target:u,retainData:A,signal:T.signal}),t.updateTarget(u.id,{status:"deleted"});return d(T,h,"complete"),t.updateTopology(R.id,{status:"destroyed"}),{destroyed:!0,dataRetained:A}},i=async(T)=>{let h=ua(T.operation.input),R=t.execution(String(h.executionId??""));if(!R)throw Error("Regional execution was not found.");let N=t.get(R.topologyId);if(!N)throw Error("Regional topology was not found.");try{let A;if(R.kind==="rollout")A=await n(T,R,N,h);else if(R.kind==="failover"||R.kind==="failback")A=await c(T,R,N);else if(R.kind==="destroy")A=await _(T,R,N,h);else throw Error("Regional reconciliation is not configured.");return t.updateExecution(R.id,{status:"succeeded",currentStep:void 0}),{executionId:R.id,...A}}catch(A){if(t.updateExecution(R.id,{status:T.cancellationRequested()?"cancelled":"failed",error:A instanceof Error?A.message:String(A)}),t.get(N.id)?.status!=="destroyed")t.updateTopology(N.id,{status:"failed"});throw A}};return{"region.rollout":i,"region.failover":i,"region.failback":i,"region.destroy":i,"region.reconcile":i}}class QA{provider;reason;constructor(t,e="Configure a regional provider transport before executing this operation."){this.provider=t;this.reason=e}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}function qr(t,e,r){return[t,e,r].map((d)=>encodeURIComponent(d)).join(":")}function Oa(t){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((e)=>[e,{supported:!1,reason:t}]))}function VE(t,e,r=["exec","files"]){let d=Oa(e);for(let E of t)d[E]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(E),requiresRecentAuth:r.includes(E)};return d}var Ca=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function Id(t){let e=String(t??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(e))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(e))return"starting";if(["deactivating","stopping","draining","terminating"].includes(e))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(e))return"stopped";if(["degraded","unhealthy","warning"].includes(e))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(e))return"failed";return"unknown"}function Cd(t){if(Array.isArray(t))return t.map((r)=>Cd(r));if(!t||typeof t!=="object")return t;let e={};for(let[r,d]of Object.entries(t))e[r]=Ca.test(r)?"[REDACTED]":Cd(d);return e}function KE(t,e=new Date){if(!t)return;let r=new Date(t).getTime();return Number.isFinite(r)?Math.max(0,Math.floor((e.getTime()-r)/1000)):void 0}function HD(t){let e=Number(t);return Number.isFinite(e)&&e>=0?e:void 0}function Ia(t){let e=String(t?.message??t);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(e))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(e))return"unreachable";return"error"}async function WD(t,e={},r={}){let d=e.now??new Date,E=Math.max(100,r.timeoutMs??1e4),n=Math.max(1,r.staleAfterSeconds??60),c=await Promise.all(t.map(async(i)=>{try{let T=await Promise.race([i.discover({...e,now:d}),new Promise((h,R)=>setTimeout(()=>R(Error(`Runtime source ${i.id} timed out after ${E}ms`)),E))]);return{workloads:T,source:{id:i.id,provider:i.provider,status:"fresh",discoveredAt:d.toISOString(),staleAfterSeconds:n,itemCount:T.length}}}catch(T){return{workloads:[],source:{id:i.id,provider:i.provider,status:Ia(T),discoveredAt:d.toISOString(),staleAfterSeconds:n,itemCount:0,message:String(T?.message??T).slice(0,500)}}}})),_=c.map((i)=>i.source);return{generatedAt:d.toISOString(),workloads:c.flatMap((i)=>i.workloads).sort((i,T)=>i.name.localeCompare(T.name)||i.id.localeCompare(T.id)),sources:_,degraded:_.some((i)=>i.status!=="fresh")}}await Wt();At();er();At();class sr{client;region;constructor(t="us-east-1",e){this.region=t,this.client=new dt(void 0,{profile:e})}async createStack(t){let e={Action:"CreateStack",StackName:t.stackName,Version:"2010-05-15"};if(t.templateBody)e.TemplateBody=t.templateBody;else if(t.templateUrl)e.TemplateURL=t.templateUrl;else throw Error("Either templateBody or templateUrl must be provided");if(t.parameters)t.parameters.forEach((d,E)=>{e[`Parameters.member.${E+1}.ParameterKey`]=d.ParameterKey,e[`Parameters.member.${E+1}.ParameterValue`]=d.ParameterValue});if(t.capabilities)t.capabilities.forEach((d,E)=>{e[`Capabilities.member.${E+1}`]=d});if(t.roleArn)e.RoleARN=t.roleArn;if(t.tags)t.tags.forEach((d,E)=>{e[`Tags.member.${E+1}.Key`]=d.Key,e[`Tags.member.${E+1}.Value`]=d.Value});if(t.timeoutInMinutes)e.TimeoutInMinutes=t.timeoutInMinutes;if(t.onFailure)e.OnFailure=t.onFailure;let r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{StackId:r.StackId||r.CreateStackResult?.StackId}}async updateStack(t){let e={Action:"UpdateStack",StackName:t.stackName,Version:"2010-05-15"};if(t.templateBody)e.TemplateBody=t.templateBody;else if(t.templateUrl)e.TemplateURL=t.templateUrl;if(t.parameters)t.parameters.forEach((d,E)=>{if(e[`Parameters.member.${E+1}.ParameterKey`]=d.ParameterKey,d.UsePreviousValue)e[`Parameters.member.${E+1}.UsePreviousValue`]="true";else e[`Parameters.member.${E+1}.ParameterValue`]=d.ParameterValue});if(t.capabilities)t.capabilities.forEach((d,E)=>{e[`Capabilities.member.${E+1}`]=d});if(t.roleArn)e.RoleARN=t.roleArn;if(t.tags)t.tags.forEach((d,E)=>{e[`Tags.member.${E+1}.Key`]=d.Key,e[`Tags.member.${E+1}.Value`]=d.Value});let r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{StackId:r.StackId||r.UpdateStackResult?.StackId}}async deleteStack(t,e,r){let d={Action:"DeleteStack",StackName:t,Version:"2010-05-15"};if(e)d.RoleARN=e;if(r&&r.length>0)r.forEach((E,n)=>{d[`RetainResources.member.${n+1}`]=E});await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(d).toString()})}async describeStacks(t={}){let e={Action:"DescribeStacks",Version:"2010-05-15"};if(t.stackName)e.StackName=t.stackName;let r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{Stacks:this.parseStacksResponse(r)}}async describeStackEvents(t){let e={Action:"DescribeStackEvents",StackName:t,Version:"2010-05-15"},r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{StackEvents:this.parseStackEvents(r)}}async listStackResources(t){let e={Action:"ListStackResources",StackName:t,Version:"2010-05-15"},d=(await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()}))?.ListStackResourcesResult?.StackResourceSummaries?.member,E=[];if(d)E=Array.isArray(d)?d:[d];return{StackResourceSummaries:E}}async waitForStack(t,e){let r={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},d=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],E=r[e],n=360,c=0;while(c<360)try{let _=await this.describeStacks({stackName:t});if(_.Stacks.length===0){if(e==="stack-delete-complete")return;if(c%10===0)console.log(`[waitForStack] Attempt ${c}: Stack not visible yet`);await new Promise((T)=>setTimeout(T,2000)),c++;continue}let i=_.Stacks[0];if(c%10===0)console.log(`[waitForStack] Attempt ${c}: Status = ${i.StackStatus}${i.StackStatusReason?` (${i.StackStatusReason})`:""}`);if(E.includes(i.StackStatus))return;if((e==="stack-create-complete"||e==="stack-update-complete")&&(i.StackStatus==="DELETE_IN_PROGRESS"||i.StackStatus==="DELETE_COMPLETE")){console.log("[waitForStack] Stack is being deleted (creation/update failed)");let T="";try{let R=await this.describeStackEvents(t);console.log("[waitForStack] Stack events (most recent first):");for(let N of R.StackEvents.slice(0,15))if(N.ResourceStatus.includes("FAILED")||N.ResourceStatusReason){if(console.log(`  ${N.LogicalResourceId}: ${N.ResourceStatus} - ${N.ResourceStatusReason||"No reason provided"}`),N.ResourceStatus.includes("FAILED")&&N.ResourceStatusReason&&!T)T=N.ResourceStatusReason}}catch{}let h=T||i.StackStatusReason||"Check CloudFormation console for details.";throw Error(`Stack creation/update failed - stack is being deleted. Reason: ${h}`)}if(i.StackStatus==="DELETE_FAILED"&&e==="stack-delete-complete"){let T=Error("Stack deletion failed - may have resources that need to be retained");throw T.code="DELETE_FAILED",T.stackStatus=i.StackStatus,T.statusReason=i.StackStatusReason,T}if(d.includes(i.StackStatus))throw Error(`Stack reached failure status: ${i.StackStatus}`);await new Promise((T)=>setTimeout(T,5000)),c++}catch(_){if(e==="stack-delete-complete"&&_.message?.includes("does not exist"))return;if(e==="stack-create-complete"&&_.message?.includes("does not exist")){if(c%10===0)console.log(`[waitForStack] Attempt ${c}: Stack does not exist (error), retrying...`);await new Promise((i)=>setTimeout(i,2000)),c++;continue}throw console.log(`[waitForStack] Unexpected error: ${_.message}`),_}throw console.log(`[waitForStack] Timeout after ${c} attempts`),Error(`Timeout waiting for stack to reach ${e}`)}async validateTemplate(t){let e={Action:"ValidateTemplate",TemplateBody:t,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()})}async listStacks(t){let e={Action:"ListStacks",Version:"2010-05-15"};if(t)t.forEach((_,i)=>{e[`StackStatusFilter.member.${i+1}`]=_});let r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()}),d=r.ListStacksResponse||r,E=d.ListStacksResult||d,n=E.StackSummaries?.member||E.StackSummaries||[];return{StackSummaries:(Array.isArray(n)?n:n?[n]:[]).map((_)=>({StackId:_.StackId||"",StackName:_.StackName||"",TemplateDescription:_.TemplateDescription,CreationTime:_.CreationTime||"",LastUpdatedTime:_.LastUpdatedTime,DeletionTime:_.DeletionTime,StackStatus:_.StackStatus||""}))}}async createChangeSet(t){let e={Action:"CreateChangeSet",StackName:t.stackName,ChangeSetName:t.changeSetName,Version:"2010-05-15"};if(t.templateBody)e.TemplateBody=t.templateBody;else if(t.templateUrl)e.TemplateURL=t.templateUrl;if(t.parameters)t.parameters.forEach((d,E)=>{e[`Parameters.member.${E+1}.ParameterKey`]=d.ParameterKey,e[`Parameters.member.${E+1}.ParameterValue`]=d.ParameterValue});if(t.capabilities)t.capabilities.forEach((d,E)=>{e[`Capabilities.member.${E+1}`]=d});if(t.changeSetType)e.ChangeSetType=t.changeSetType;let r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{Id:r.Id,StackId:r.StackId}}async describeChangeSet(t,e){let r={Action:"DescribeChangeSet",StackName:t,ChangeSetName:e,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()})}async executeChangeSet(t,e){let r={Action:"ExecuteChangeSet",StackName:t,ChangeSetName:e,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()})}async deleteChangeSet(t,e){let r={Action:"DeleteChangeSet",StackName:t,ChangeSetName:e,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()})}async getStackOutputs(t){let e=await this.describeStacks({stackName:t});if(!e.Stacks||e.Stacks.length===0)throw Error(`Stack ${t} not found`);let r=e.Stacks[0],d={};if(r.Outputs)for(let E of r.Outputs)d[E.OutputKey]=E.OutputValue;return d}async getTemplate(t){let e={Action:"GetTemplate",StackName:t,Version:"2010-05-15"},r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{TemplateBody:r?.GetTemplateResult?.TemplateBody||r?.TemplateBody||""}}parseStacksResponse(t){let e=[],r=t?.DescribeStacksResult?.Stacks?.member||t?.Stacks?.member||t?.Stacks||t;if(r&&!Array.isArray(r))r=[r];if(Array.isArray(r)){for(let d of r)if(d.StackId||d.StackName){let E;if(d.Outputs?.member)E=(Array.isArray(d.Outputs.member)?d.Outputs.member:[d.Outputs.member]).map((c)=>({OutputKey:c.OutputKey,OutputValue:c.OutputValue,Description:c.Description,ExportName:c.ExportName}));e.push({StackId:d.StackId,StackName:d.StackName,StackStatus:d.StackStatus,CreationTime:d.CreationTime,LastUpdatedTime:d.LastUpdatedTime,StackStatusReason:d.StackStatusReason,Outputs:E})}}else if(t.StackId)e.push({StackId:t.StackId,StackName:t.StackName,StackStatus:t.StackStatus,CreationTime:t.CreationTime,LastUpdatedTime:t.LastUpdatedTime});return e}parseStackEvents(t){let e=[],r=t?.DescribeStackEventsResult?.StackEvents?.member||t?.StackEvents?.member||t?.StackEvents||[];if(r&&!Array.isArray(r))r=[r];for(let d of r)if(d.LogicalResourceId)e.push({Timestamp:d.Timestamp,ResourceType:d.ResourceType,LogicalResourceId:d.LogicalResourceId,ResourceStatus:d.ResourceStatus,ResourceStatusReason:d.ResourceStatusReason});return e}async waitForStackWithProgress(t,e,r){let d={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},E=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],n=d[e],c=360,_=0,i=new Set;while(_<360)try{if(r)try{let N=[...(await this.describeStackEvents(t)).StackEvents||[]].reverse();for(let A of N){let u=`${A.LogicalResourceId}-${A.ResourceStatus}-${A.Timestamp}`;if(!i.has(u))i.add(u),r({resourceId:A.LogicalResourceId,resourceType:A.ResourceType,status:A.ResourceStatus,reason:A.ResourceStatusReason,timestamp:A.Timestamp})}}catch{}let T=await this.describeStacks({stackName:t});if(T.Stacks.length===0){if(e==="stack-delete-complete")return;await new Promise((R)=>setTimeout(R,2000)),_++;continue}let h=T.Stacks[0];if(n.includes(h.StackStatus))return;if(h.StackStatus==="DELETE_FAILED"&&e==="stack-delete-complete"){let R=Error("Stack deletion failed - may have resources that need to be retained");throw R.code="DELETE_FAILED",R.stackStatus=h.StackStatus,R.statusReason=h.StackStatusReason,R}if(E.includes(h.StackStatus))throw Error(`Stack reached failure status: ${h.StackStatus}`);await new Promise((R)=>setTimeout(R,3000)),_++}catch(T){if(e==="stack-delete-complete"&&T.message?.includes("does not exist"))return;if(e==="stack-create-complete"&&T.message?.includes("does not exist")){await new Promise((h)=>setTimeout(h,2000)),_++;continue}throw T}throw Error(`Timeout waiting for stack to reach ${e}`)}async waitForStackComplete(t,e=120,r=5000){let d=["CREATE_COMPLETE","UPDATE_COMPLETE","DELETE_COMPLETE"],E=["CREATE_FAILED","UPDATE_FAILED","DELETE_FAILED","ROLLBACK_COMPLETE","ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED"];for(let n=0;n<e;n++)try{let c=await this.describeStacks({stackName:t});if(c.Stacks.length===0)return{success:!0,status:"DELETE_COMPLETE"};let _=c.Stacks[0],i=_.StackStatus;if(d.includes(i))return{success:!0,status:i};if(E.includes(i))return{success:!1,status:i,reason:_.StackStatusReason};await new Promise((T)=>setTimeout(T,r))}catch(c){if(c.message?.includes("does not exist"))return{success:!0,status:"DELETE_COMPLETE"};throw c}return{success:!1,status:"TIMEOUT",reason:"Timeout waiting for stack operation"}}}At();import{createHash as la}from"node:crypto";import{existsSync as Da,mkdirSync as Ua,readdirSync as WG,readFileSync as fa,rmSync as vG,writeFileSync as wa}from"node:fs";import{homedir as ga}from"node:os";import{join as w_}from"node:path";var vD=1,QD=3600000,$a=24*QD,ya=QD,Xa=30*$a;function Pa(){let t=process.env.XDG_CACHE_HOME;return w_(t&&t.trim()?t:w_(ga(),".cache"),"ts-cloud","cost-explorer")}function YD(t){return w_(Pa(),t??"__default__")}function MD(t){let e={s:t.start,e:t.end,g:t.granularity,m:[...t.metrics].sort(),gb:[...t.groupBy].map((r)=>`${r.Type}:${r.Key}`).sort(),f:t.filter??null};return la("sha256").update(JSON.stringify(e)).digest("hex").slice(0,24)}function aa(t,e){let r=Date.parse(`${e}T00:00:00Z`);if(Number.isNaN(r))return!1;let d=new Date,E=Date.UTC(d.getUTCFullYear(),d.getUTCMonth(),1);return r<=E}function ja(t){return aa(t.start,t.end)?Xa:ya}function GD(t,e){let r=w_(YD(t),`${MD(e)}.json`);if(!Da(r))return null;let d;try{d=JSON.parse(fa(r,"utf-8"))}catch{return null}if(d.schema!==vD)return null;let E=Date.now()-d.savedAt;if(E<0||E>ja(e))return null;return{response:d.response,ageSeconds:Math.floor(E/1000)}}function VD(t,e,r){let d=YD(t);Ua(d,{recursive:!0});let E={schema:vD,savedAt:Date.now(),key:e,response:r};wa(w_(d,`${MD(e)}.json`),JSON.stringify(E))}class YA{client;profile;useCache;lastCacheAgeSeconds=null;constructor(t,e){this.profile=t,this.useCache=e?.useCache??!0,this.client=new dt(Fn(t))}async getCostByService(t){return(await this.getCostByDimension({...t,dimension:"SERVICE"})).map((r)=>({service:r.key,amount:r.amount,unit:r.unit}))}async getCostByDimension(t){let{start:e,end:r,dimension:d,granularity:E="MONTHLY",filter:n}=t,c=["UnblendedCost"],_=[{Type:"DIMENSION",Key:d}],i={start:e,end:r,granularity:E,metrics:c,groupBy:_,filter:n};if(this.useCache){let N=GD(this.profile,i);if(N)return this.lastCacheAgeSeconds=N.ageSeconds,N.response}this.lastCacheAgeSeconds=null;let T=new Map,h;do{let N={TimePeriod:{Start:e,End:r},Granularity:E,Metrics:c,GroupBy:_};if(n)N.Filter=n;if(h)N.NextPageToken=h;let A=await this.client.request({service:"ce",region:"us-east-1",method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"AWSInsightsIndexService.GetCostAndUsage"},body:JSON.stringify(N)});for(let u of A?.ResultsByTime??[])for(let U of u?.Groups??[]){let w=U.Keys?.[0]??"Unknown",l=Number.parseFloat(U.Metrics?.UnblendedCost?.Amount??"0"),P=U.Metrics?.UnblendedCost?.Unit??"USD",a=T.get(w);T.set(w,{key:w,amount:(a?.amount??0)+l,unit:P})}h=A?.NextPageToken||void 0}while(h);let R=[...T.values()].filter((N)=>N.amount>0).sort((N,A)=>A.amount-N.amount);if(this.useCache)VD(this.profile,i,R);return R}async getDailyTotals(t){return((await this.client.request({service:"ce",region:"us-east-1",method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"AWSInsightsIndexService.GetCostAndUsage"},body:JSON.stringify({TimePeriod:{Start:t.start,End:t.end},Granularity:"DAILY",Metrics:["UnblendedCost"]})}))?.ResultsByTime??[]).map((d)=>Number.parseFloat(d.Total?.UnblendedCost?.Amount??"0"))}}At();class g_{client;region;constructor(t="us-east-1"){this.region=t,this.client=new dt}async describeInstances(t){let e={Action:"DescribeInstances",Version:"2016-11-15"};if(t?.InstanceIds)t.InstanceIds.forEach((E,n)=>{e[`InstanceId.${n+1}`]=E});if(t?.Filters)t.Filters.forEach((E,n)=>{e[`Filter.${n+1}.Name`]=E.Name,E.Values.forEach((c,_)=>{e[`Filter.${n+1}.Value.${_+1}`]=c})});if(t?.MaxResults)e.MaxResults=String(t.MaxResults);if(t?.NextToken)e.NextToken=t.NextToken;let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()}),d=r.DescribeInstancesResponse||r;return{Reservations:this.parseReservations(d.reservationSet?.item),NextToken:d.nextToken}}async getInstance(t){return(await this.describeInstances({InstanceIds:[t]})).Reservations?.[0]?.Instances?.[0]}async getConsoleOutput(t,e){let r={Action:"GetConsoleOutput",Version:"2016-11-15",InstanceId:t};if(e)r.Latest="true";let d=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(r).toString()}),E=d.GetConsoleOutputResponse||d;return{InstanceId:E.instanceId,Output:E.output,Timestamp:E.timestamp}}async getConsoleOutputDecoded(t,e){let r=await this.getConsoleOutput(t,e?.latest);if(!r.Output)return"No console output available yet";let d=Buffer.from(r.Output,"base64").toString("utf-8");if(e?.tailLines)return d.split(`
+`).find((E)=>E&&!E.startsWith("#"))?.trim().split(/\s+/);if(r.code!==0||!d?.[1]||!d[2])throw Error(`SSH host-key scan failed: ${r.stderr.trim()||"no key returned"}`);return{algorithm:d[1],key:d[2]}}async exec(t,e){if(t.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return SD(["ssh","-p",String(t.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${t.sshUser}@${t.endpoint}`,e])}}var ca=(t)=>`SHA256:${na("sha256").update(Buffer.from(t,"base64")).digest("base64").replace(/=+$/,"")}`,_a=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class U_{provider;transport;discoverer;constructor(t,e=new ND,r){this.provider=t;this.transport=e;this.discoverer=r}discover(t){return this.discoverer?.(t)??Promise.resolve([])}async test(t){try{let e=await this.transport.scan(t.endpoint,t.sshPort);return{reachable:!0,hostKeyAlgorithm:e.algorithm,hostKeyFingerprint:ca(e.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(t){let e=await this.transport.exec(t,_a);if(e.code!==0)throw Error(`Fleet validation failed: ${e.stderr.trim()||e.code}`);try{return JSON.parse(e.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(t,e){let r=await this.transport.exec(t,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${e.length}`);if(r.code!==0)throw Error(`Fleet bootstrap failed: ${r.stderr.trim()||r.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function AD(t,e){return{"fleet.bootstrap":async(r)=>{let d=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},E=t.get(String(d.serverId??""));if(!E)throw Error("Queued fleet server was not found.");let n=e.find((i)=>i.provider===E.provider);if(!n)throw Error(`No ${E.provider} fleet driver is configured.`);let c=Array.isArray(d.steps)?d.steps.map(String):[];if(r.checkpoint("preflight","Rechecking pinned trust and healthy validation."),E.trustState!=="pinned"||!E.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");r.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let _=await n.bootstrap(E,c);return t.update(E.id,{bootstrapVersion:_.version,status:"ready"}),r.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:E.id,bootstrapVersion:_.version,steps:c.length}}}}var xr=(t)=>t==null?void 0:String(t),GE=(t,e)=>{try{return JSON.parse(String(t))}catch{return e}},fA=(t)=>({id:String(t.id),organizationId:String(t.organization_id),projectId:String(t.project_id),resourceId:String(t.resource_id),name:String(t.name),provider:String(t.provider),providerId:xr(t.provider_id),region:xr(t.region),zone:xr(t.zone),endpoint:String(t.endpoint),sshUser:String(t.ssh_user),sshPort:Number(t.ssh_port),credentialRef:String(t.credential_ref),hostKeyAlgorithm:xr(t.host_key_algorithm),hostKeyFingerprint:xr(t.host_key_fingerprint),pendingHostKey:xr(t.pending_host_key),roles:GE(t.roles,[]),labels:GE(t.labels,{}),taints:GE(t.taints,[]),capacity:GE(t.capacity,{}),usage:GE(t.usage,{}),capabilities:GE(t.capabilities,{}),status:String(t.status),trustState:String(t.trust_state),validation:GE(t.validation,void 0),bootstrapVersion:xr(t.bootstrap_version),heartbeatAt:xr(t.heartbeat_at),lastSeenAt:xr(t.last_seen_at),archivedAt:xr(t.archived_at),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)});class wA{control;now;id;constructor(t,e=()=>new Date,r=()=>crypto.randomUUID()){this.control=t;this.now=e;this.id=r}get(t){let e=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(t);return e?fA(e):void 0}list(t,e=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(t).map(fA).filter((r)=>e||r.status!=="archived")}findProvider(t,e,r){let d=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(t,e,r);return d?fA(d):void 0}create(t){let e=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[e,t.organizationId,t.projectId,t.resourceId,t.name,t.provider,t.providerId??null,t.region??null,t.zone??null,t.endpoint,t.sshUser,t.sshPort,t.credentialRef,t.hostKeyAlgorithm??null,t.hostKeyFingerprint??null,t.pendingHostKey??null,JSON.stringify(t.roles),JSON.stringify(t.labels),JSON.stringify(t.taints),JSON.stringify(t.capacity),JSON.stringify(t.usage),JSON.stringify(t.capabilities),t.status,t.trustState,JSON.stringify(t.validation??{}),t.bootstrapVersion??null,t.heartbeatAt??null,t.lastSeenAt??null,t.archivedAt??null,r,r]),this.get(e)}update(t,e){let r=this.get(t);if(!r)throw Error("Server was not found.");let d={...r,...e},E=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[d.name,d.providerId??null,d.region??null,d.zone??null,d.endpoint,d.sshUser,d.sshPort,d.credentialRef,d.hostKeyAlgorithm??null,d.hostKeyFingerprint??null,d.pendingHostKey??null,JSON.stringify(d.roles),JSON.stringify(d.labels),JSON.stringify(d.taints),JSON.stringify(d.capacity),JSON.stringify(d.usage),JSON.stringify(d.capabilities),d.status,d.trustState,JSON.stringify(d.validation??{}),d.bootstrapVersion??null,d.heartbeatAt??null,d.lastSeenAt??null,d.archivedAt??null,E,t]),this.get(t)}}var Ta=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class gA{store;drivers;now;queue;constructor(t,e,r,d=()=>new Date){this.store=t;this.drivers=e;this.now=d;this.queue=r??new yt(t.control)}driver(t){let e=this.drivers.find((r)=>r.provider===t);if(!e)throw Error(`No ${t} fleet driver is configured.`);return e}enroll(t){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(t.name))throw Error("Server name is invalid.");if(!Ta.test(t.endpoint)||t.sshUser==="root"||!t.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let e=t.providerId?this.store.findProvider(t.organizationId,t.provider,t.providerId):void 0;if(e)return this.store.update(e.id,{endpoint:t.endpoint,region:t.region,zone:t.zone});let r=this.store.control.createResource({projectId:t.projectId,kind:"server",slug:t.name,name:t.name,provider:t.provider,providerId:t.providerId}),d=this.driver(t.provider);return this.store.create({...t,resourceId:r.id,sshPort:t.sshPort??22,labels:t.labels??{},taints:[],capacity:{},usage:{},capabilities:d.capabilities(),status:"pending",trustState:"unverified"})}async test(t){let e=this.store.get(t);if(!e)throw Error("Server was not found.");let r=await this.driver(e.provider).test(e);if(!r.reachable)return this.store.update(t,{status:"unreachable"});if(e.hostKeyFingerprint&&e.hostKeyFingerprint!==r.hostKeyFingerprint)return this.store.update(t,{status:"degraded",trustState:"rotation_pending",pendingHostKey:r.hostKeyFingerprint});return this.store.update(t,{hostKeyAlgorithm:r.hostKeyAlgorithm,hostKeyFingerprint:r.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(t,e){let r=this.store.get(t);if(!r||r.pendingHostKey!==e)throw Error("Pending host key does not match.");return this.store.update(t,{hostKeyFingerprint:e,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(t){let e=this.store.get(t);if(!e||e.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let r=await this.driver(e.provider).validate(e),d=[];if(!["x64","arm64","x86_64","aarch64"].includes(r.arch??""))d.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let c of["curl","tar"])if(!r.tools?.[c])d.push({code:`tool.${c}`,severity:"error",message:`${c} is missing.`,remediation:`Install ${c} before bootstrap.`});if(Math.abs(r.timeSkewSeconds??0)>60)d.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!r.dnsOk)d.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let E={valid:!d.some((c)=>c.severity==="error"),facts:r,findings:d,validatedAt:this.now().toISOString(),validatorVersion:"1"},n={cpu:r.cpuCores??0,memoryBytes:r.memoryBytes??0,diskBytes:r.diskBytes??0};return this.store.update(t,{validation:E,capacity:n,status:E.valid?"ready":"degraded"})}bootstrap(t,e=!1){let r=this.store.get(t);if(!r?.validation?.valid)throw Error("A healthy validation report is required.");let d=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!e)return{preview:!0,steps:d};let E=this.queue.enqueue({projectId:r.projectId,resourceId:r.resourceId,kind:"fleet.bootstrap",input:{serverId:t,steps:d},lockKey:`server:${t}`,providerKey:r.provider}).operation;return{preview:!1,steps:d,operation:E}}heartbeat(t,e){let r=this.store.get(t);if(!r)throw Error("Server was not found.");let d=this.now().toISOString();return this.store.update(t,{usage:e.usage,capabilities:e.capabilities??r.capabilities,heartbeatAt:d,lastSeenAt:d,status:r.status==="draining"||r.status==="drained"?r.status:"ready"})}drain(t,e=!1){return this.store.update(t,{status:e?"drained":"draining"})}uncordon(t){return this.store.update(t,{status:"ready"})}archive(t,e){let r=this.store.get(t);if(!r||e!==r.name)throw Error("Exact server name confirmation is required.");return this.store.update(t,{status:"archived",archivedAt:this.now().toISOString()})}}import{createHash as $A,createPublicKey as OD,verify as ia}from"node:crypto";function f_(t){if(t===null||typeof t!=="object")return JSON.stringify(t);if(Array.isArray(t))return`[${t.map(f_).join(",")}]`;return`{${Object.keys(t).sort().map((e)=>`${JSON.stringify(e)}:${f_(t[e])}`).join(",")}}`}var CD=(t)=>$A("sha256").update(f_(t)).digest("hex"),th=(t)=>$A("sha256").update(f_(t)).digest("hex"),ID=(t)=>$A("sha256").update(OD(t).export({type:"spki",format:"der"})).digest("hex");function lD(t,e,r){try{return ia(null,Buffer.from(f_(t)),OD(r),Buffer.from(e,"base64"))}catch{return!1}}var LD=(t)=>t.replace(/^v/,"").split(/[.-]/).slice(0,3).map((e)=>Number(e)||0),uD=(t,e)=>{let r=LD(t),d=LD(e);for(let E=0;E<3;E++){let n=(r[E]??0)-(d[E]??0);if(n)return n}return 0};function DD(t,e){let r=[];if(e.schemaVersion<t.minimumSchema)r.push(`schema ${e.schemaVersion} is below ${t.minimumSchema}`);if(e.schemaVersion>t.maximumSchema)r.push(`schema ${e.schemaVersion} is above ${t.maximumSchema}`);if(t.minimumVersion&&uD(e.currentVersion,t.minimumVersion)<0)r.push(`platform ${e.currentVersion} is below ${t.minimumVersion}`);if(uD(t.version,e.currentVersion)<=0)r.push(`version ${t.version} is not newer than ${e.currentVersion}`);if(!t.artifacts.some((d)=>d.platform===e.platform&&d.architecture===e.architecture))r.push(`no artifact for ${e.platform}/${e.architecture}`);return{compatible:r.length===0,reasons:r}}var ud=(t,e)=>{try{return JSON.parse(String(t))}catch{return e}},ge=(t)=>t==null?void 0:String(t),ha=(t)=>({id:String(t.id),organizationId:String(t.organization_id),name:String(t.name),algorithm:"ed25519",publicKeyPem:String(t.public_key_pem),fingerprint:String(t.fingerprint),revokedAt:ge(t.revoked_at),createdAt:String(t.created_at)}),UD=(t)=>({id:String(t.id),organizationId:String(t.organization_id),version:String(t.version),channel:String(t.channel),publishedAt:String(t.published_at),keyId:String(t.key_id),digest:String(t.digest),document:ud(t.document,{}),signature:String(t.signature),verificationStatus:String(t.verification_status),compatibility:ud(t.compatibility,{compatible:!1,reasons:[]}),createdAt:String(t.created_at)}),fD=(t)=>({id:String(t.id),projectId:String(t.project_id),name:String(t.name),schedule:String(t.schedule),timezone:String(t.timezone),durationMinutes:Number(t.duration_minutes),allowedOperations:ud(t.allowed_operations,[]),requireApproval:Number(t.require_approval)===1,enabled:Number(t.enabled)===1,createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),wD=(t)=>({id:String(t.id),projectId:String(t.project_id),manifestId:String(t.manifest_id),windowId:ge(t.window_id),fromVersion:String(t.from_version),strategy:String(t.strategy),batchSize:Number(t.batch_size),healthGate:ud(t.health_gate,{}),status:String(t.status),currentStage:ge(t.current_stage),backupId:ge(t.backup_id),approvedBy:ge(t.approved_by),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),yA=(t)=>({id:String(t.id),campaignId:String(t.campaign_id),serverId:ge(t.server_id),target:String(t.target),cohort:Number(t.cohort),previousVersion:String(t.previous_version),status:String(t.status),evidence:ud(t.evidence,{}),error:ge(t.error),startedAt:ge(t.started_at),finishedAt:ge(t.finished_at),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),gD=(t)=>({id:String(t.id),projectId:String(t.project_id),kind:String(t.kind),criteria:ud(t.criteria,{}),candidates:ud(t.candidates,[]),candidateDigest:String(t.candidate_digest),estimatedBytes:Number(t.estimated_bytes),status:String(t.status),confirmation:ge(t.confirmation),expiresAt:String(t.expires_at),result:ud(t.result,{}),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),$D=(t)=>({id:String(t.id),projectId:String(t.project_id),backupPolicyId:ge(t.backup_policy_id),recoveryPointId:ge(t.recovery_point_id),topologyId:ge(t.topology_id),scenario:String(t.scenario),isolatedTarget:String(t.isolated_target),expectedRpoMinutes:Number(t.expected_rpo_minutes),expectedRtoMinutes:Number(t.expected_rto_minutes),status:String(t.status),operationId:ge(t.operation_id),evidence:ud(t.evidence,{}),measuredRpoMinutes:t.measured_rpo_minutes==null?void 0:Number(t.measured_rpo_minutes),measuredRtoMinutes:t.measured_rto_minutes==null?void 0:Number(t.measured_rto_minutes),cleanupVerified:Number(t.cleanup_verified)===1,error:ge(t.error),startedAt:ge(t.started_at),finishedAt:ge(t.finished_at),createdAt:String(t.created_at),updatedAt:String(t.updated_at)});class XA{control;now;id;constructor(t,e=()=>new Date,r=()=>crypto.randomUUID()){this.control=t;this.now=e;this.id=r}addTrustedKey(t){let e=this.id(),r=this.now().toISOString(),d=ID(t.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[e,t.organizationId,t.name,t.publicKeyPem,d,r]),this.key(e)}key(t){let e=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(t);return e?ha(e):void 0}revokeKey(t){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),t]),this.key(t)}importManifest(t){let e=this.key(t.keyId);if(!e||e.organizationId!==t.organizationId)throw Error("Trusted update key was not found.");if(e.revokedAt)throw Error("Update signing key is revoked.");if(!lD(t.document,t.signature,e.publicKeyPem))throw Error("Update manifest signature is invalid.");let r=DD(t.document,t.current),d=CD(t.document),E=this.id(),n=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[E,t.organizationId,t.document.version,t.document.channel,new Date(t.document.publishedAt).toISOString(),t.keyId,d,JSON.stringify(t.document),t.signature,JSON.stringify(r),n]),this.manifest(E)}manifest(t){let e=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(t);return e?UD(e):void 0}manifests(t){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(t).map(UD)}createWindow(t){let e=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[e,t.projectId,t.name,t.schedule,t.timezone,t.durationMinutes,JSON.stringify(t.allowedOperations),t.requireApproval===!1?0:1,r,r]),this.window(e)}window(t){let e=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(t);return e?fD(e):void 0}windows(t){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(t).map(fD)}createCampaign(t){return this.control.transaction(()=>{let e=this.manifest(t.manifestId);if(!e?.compatibility.compatible||e.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!t.backupId)throw Error("A verified pre-upgrade backup is required.");let r=this.id(),d=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[r,t.projectId,t.manifestId,t.windowId??null,t.fromVersion,t.strategy,t.batchSize,JSON.stringify(t.healthGate),t.backupId,t.approvedBy??null,d,d]),t.targets.forEach((E,n)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,E.serverId??null,E.target,t.strategy==="canary"?n===0?0:1+Math.floor((n-1)/t.batchSize):Math.floor(n/t.batchSize),E.previousVersion,d,d])),this.campaign(r)})}campaign(t){let e=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(t);return e?wD(e):void 0}campaigns(t){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(t).map(wD)}targets(t){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(t).map(yA)}updateCampaign(t,e){let r=this.campaign(t);if(!r)throw Error("Upgrade campaign was not found.");let d={...r,...e};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[d.status,d.currentStage??null,this.now().toISOString(),t]),this.campaign(t)}updateTarget(t,e){let r=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(t);if(!r)throw Error("Upgrade target was not found.");let d={...yA(r),...e};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[d.status,JSON.stringify(d.evidence),d.error??null,d.startedAt??null,d.finishedAt??null,this.now().toISOString(),t]),yA(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(t))}createCleanup(t){let e=[...t.candidates].sort((c,_)=>c.id.localeCompare(_.id)),r=th(e),d=this.id(),E=this.now().toISOString(),n=new Date(this.now().getTime()+(t.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[d,t.projectId,t.kind,JSON.stringify(t.criteria),JSON.stringify(e),r,e.reduce((c,_)=>c+_.bytes,0),n,E,E]),this.cleanup(d)}cleanup(t){let e=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(t);return e?gD(e):void 0}cleanups(t){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(t).map(gD)}updateCleanup(t,e){let r=this.cleanup(t);if(!r)throw Error("Cleanup plan was not found.");let d={...r,...e};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[d.status,d.confirmation??null,JSON.stringify(d.result),this.now().toISOString(),t]),this.cleanup(t)}createDrill(t){if(!/^isolated:\/\//.test(t.isolatedTarget))throw Error("DR drills require an isolated target.");let e=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[e,t.projectId,t.backupPolicyId??null,t.recoveryPointId??null,t.topologyId??null,t.scenario,t.isolatedTarget,t.expectedRpoMinutes,t.expectedRtoMinutes,r,r]),this.drill(e)}drill(t){let e=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(t);return e?$D(e):void 0}drills(t){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(t).map($D)}updateDrill(t,e){let r=this.drill(t);if(!r)throw Error("DR drill was not found.");let d={...r,...e};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[d.status,d.operationId??null,JSON.stringify(d.evidence),d.measuredRpoMinutes??null,d.measuredRtoMinutes??null,d.cleanupVerified?1:0,d.error??null,d.startedAt??null,d.finishedAt??null,this.now().toISOString(),t]),this.drill(t)}}function Ra(t,e=new Date){if(!t.enabled)return!1;let r=new Date(t.schedule);if(!Number.isNaN(r.getTime()))return e>=r&&e.getTime()<=r.getTime()+t.durationMinutes*60000;let d=/^(\d{2}):(\d{2})$/.exec(t.schedule);if(!d)return!1;let E=new Intl.DateTimeFormat("en-US",{timeZone:t.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(e),n=Number(E.find((_)=>_.type==="hour")?.value)*60+Number(E.find((_)=>_.type==="minute")?.value),c=Number(d[1])*60+Number(d[2]);return n>=c&&n<c+t.durationMinutes}class PA{store;now;queue;constructor(t,e,r=()=>new Date){this.store=t;this.now=r;this.queue=e??new yt(t.control)}enqueueCampaign(t,e={}){let r=this.store.campaign(t);if(!r)throw Error("Upgrade campaign was not found.");let d=r.windowId?this.store.window(r.windowId):void 0;if(d&&!d.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(d&&!e.overrideWindow&&!Ra(d,this.now()))throw Error("Upgrade is outside its maintenance window.");if(d?.requireApproval&&!e.approvedBy&&!r.approvedBy)throw Error("Maintenance approval is required.");let E=this.queue.enqueue({projectId:r.projectId,actorId:e.approvedBy,kind:"maintenance.upgrade",input:{campaignId:t},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(t,{status:"queued"}),operation:E}}async previewCleanup(t,e){let r=e.find((d)=>d.kind===t.kind);if(!r)throw Error(`No ${t.kind} cleanup driver is configured.`);return this.store.createCleanup({...t,candidates:await r.discover(t.criteria)})}enqueueCleanup(t,e){let r=this.store.cleanup(t);if(!r||r.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(r.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let d=`DELETE ${r.candidates.length} ${r.kind}`;if(e!==d)throw Error(`Exact confirmation ${d} is required.`);let E=this.queue.enqueue({projectId:r.projectId,kind:"maintenance.cleanup",input:{planId:t},lockKey:`cleanup:${r.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(t,{status:"approved",confirmation:e}),operation:E}}enqueueDrill(t){let e=this.store.drill(t);if(!e||e.status!=="planned")throw Error("A planned DR drill is required.");let r=this.queue.enqueue({projectId:e.projectId,kind:"maintenance.drill",input:{drillId:t},lockKey:`drill:${e.scenario}:${e.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(t,{status:"queued",operationId:r.id}),operation:r}}}var aA=(t)=>t&&typeof t==="object"&&!Array.isArray(t)?t:{};function yD(t){return{"maintenance.upgrade":async(E)=>{let n=t.store.campaign(String(aA(E.operation.input).campaignId??""));if(!n||!t.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let c=t.store.manifest(n.manifestId);if(!c?.compatibility.compatible||c.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let _=c.document.artifacts.find((T)=>T.platform===process.platform&&T.architecture===process.arch)??c.document.artifacts[0];if(!_)throw Error("No update artifact matches this platform.");t.store.updateCampaign(n.id,{status:"running",currentStage:"preflight"});let i=[];try{for(let T of[...new Set(t.store.targets(n.id).map((h)=>h.cohort))].sort((h,R)=>h-R)){t.store.updateCampaign(n.id,{currentStage:`cohort:${T}`});for(let h of t.store.targets(n.id).filter((R)=>R.cohort===T)){E.throwIfCancellationRequested(),E.checkpoint(`download:${h.target}`,"Downloading signed platform artifact."),t.store.updateTarget(h.id,{status:"downloading",startedAt:new Date().toISOString()});let R=await t.platform.download({target:h,artifact:_,signal:E.signal});if(R.sha256!==_.sha256)throw Error(`Artifact checksum mismatch for ${h.target}.`);E.checkpoint(`install:${h.target}`,"Installing verified artifact."),t.store.updateTarget(h.id,{status:"installing"}),await t.platform.install({target:h,path:R.path,version:c.version,signal:E.signal}),i.push(h);let N=await t.platform.health({target:h,gate:n.healthGate});if(!N.healthy)throw Error(`Upgrade health gate failed for ${h.target}.`);t.store.updateTarget(h.id,{status:"healthy",evidence:N.evidence,finishedAt:new Date().toISOString()})}}return t.store.updateCampaign(n.id,{status:"succeeded",currentStage:void 0}),{campaignId:n.id,version:c.version,targets:i.length}}catch(T){t.store.updateCampaign(n.id,{status:"rolling_back",currentStage:"rollback"});for(let h of i.reverse())t.store.updateTarget(h.id,{status:"rolling_back"}),await t.platform.rollback({target:h,version:h.previousVersion,signal:E.signal}),t.store.updateTarget(h.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw t.store.updateCampaign(n.id,{status:"rolled_back",currentStage:void 0}),T}},"maintenance.cleanup":async(E)=>{let n=t.store.cleanup(String(aA(E.operation.input).planId??""));if(!n||n.status!=="approved")throw Error("Approved cleanup plan was not found.");if(th([...n.candidates].sort((h,R)=>h.id.localeCompare(R.id)))!==n.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let c=t.cleanup?.find((h)=>h.kind===n.kind);if(!c)throw Error(`No ${n.kind} cleanup driver is configured.`);t.store.updateCleanup(n.id,{status:"running"});let _=[],i=[];for(let h of n.candidates){E.throwIfCancellationRequested();try{await c.remove(h),_.push(h.id)}catch(R){i.push({id:h.id,error:R instanceof Error?R.message:String(R)})}}let T=i.length?_.length?"partial":"failed":"succeeded";if(t.store.updateCleanup(n.id,{status:T,result:{removed:_,failed:i,reclaimedBytes:n.candidates.filter((h)=>_.includes(h.id)).reduce((h,R)=>h+R.bytes,0)}}),i.length)throw Error(`Cleanup failed for ${i.length} candidate(s).`);return{planId:n.id,removed:_.length,reclaimedBytes:n.estimatedBytes}},"maintenance.drill":async(E)=>{let n=t.store.drill(String(aA(E.operation.input).drillId??""));if(!n)throw Error("DR drill was not found.");let c=t.recovery?.find((R)=>R.scenario===n.scenario);if(!c)throw Error(`No ${n.scenario} recovery driver is configured.`);let _=new Date;t.store.updateDrill(n.id,{status:"restoring",startedAt:_.toISOString()});let i=n.isolatedTarget,T={},h={};try{E.checkpoint("restore","Restoring into isolated drill target.");let R=await c.restore({drill:n,signal:E.signal});if(!R.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");i=R.target,T=R.evidence;let N=(_.getTime()-new Date(R.recoveryPointAt).getTime())/60000;t.store.updateDrill(n.id,{status:"verifying",measuredRpoMinutes:N,evidence:{restore:T}}),E.checkpoint("verify","Running recovery health checks without production traffic.");let A=await c.verify({drill:n,target:i});h=A.evidence;let u=(Date.now()-_.getTime())/60000;if(!A.healthy||N>n.expectedRpoMinutes||u>n.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");t.store.updateDrill(n.id,{measuredRpoMinutes:N,measuredRtoMinutes:u,evidence:{restore:T,verify:h}})}catch(R){throw t.store.updateDrill(n.id,{status:"failed",error:R instanceof Error?R.message:String(R),evidence:{restore:T,verify:h}}),R}finally{t.store.updateDrill(n.id,{status:"cleaning"});try{await c.cleanup({drill:n,target:i});let R=t.store.drill(n.id);t.store.updateDrill(n.id,{status:R.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(R){t.store.updateDrill(n.id,{status:"cleanup_required",cleanupVerified:!1,error:R instanceof Error?R.message:String(R),finishedAt:new Date().toISOString()})}}return{drillId:n.id,status:t.store.drill(n.id).status}}}}var XD={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class jA{kind;control;projectId;organizationId;constructor(t,e,r,d){this.kind=t;this.control=e;this.projectId=r;this.organizationId=d}async discover(t){let e=Math.max(1,Math.min(3650,Number(t.olderThanDays??30))),r=new Date(Date.now()-e*86400000).toISOString(),d=XD[this.kind],E=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(d.select).all(E,r).map((c)=>({id:String(c.id),kind:this.kind,label:`${this.kind}:${String(c.id)}`,bytes:Number(c.bytes??0),metadata:{createdAt:String(c.created_at)}}))}async remove(t){if(this.control.database.run(XD[this.kind].remove,[t.id]).changes!==1)throw Error(`${t.label} changed or is no longer removable.`)}}var zr=(t,e)=>{try{return JSON.parse(String(t))}catch{return e}},qe=(t)=>t==null?void 0:String(t),jD=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),rc=(t={})=>({...jD(),...t});function PD(t){return{id:String(t.id),organizationId:String(t.organization_id),projectId:String(t.project_id),name:String(t.name),purpose:String(t.purpose),backend:String(t.backend),region:qe(t.region),architecture:qe(t.architecture),labels:zr(t.labels,{}),requiredServerLabels:zr(t.required_server_labels,{}),toleratedTaints:zr(t.tolerated_taints,[]),capacity:rc(zr(t.capacity,{})),reserved:zr(t.reserved,{}),maxWorkloads:Number(t.max_workloads),costWeight:Number(t.cost_weight),spreadKey:qe(t.spread_key),concurrency:Number(t.concurrency),ephemeralWorkspaces:Number(t.ephemeral_workspaces)===1,allowProductionSecrets:Number(t.allow_production_secrets)===1,status:String(t.status),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}}function aD(t){return{id:String(t.id),projectId:String(t.project_id),environmentId:qe(t.environment_id),resourceId:String(t.resource_id),releaseId:qe(t.release_id),poolId:String(t.pool_id),serverId:qe(t.server_id),purpose:String(t.purpose),requirements:zr(t.requirements,{}),decision:zr(t.decision,{}),stateful:Number(t.stateful)===1,autoReschedule:Number(t.auto_reschedule)===1,status:String(t.status),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}}function Sa(t){return{id:String(t.id),projectId:String(t.project_id),resourceId:qe(t.resource_id),poolId:String(t.pool_id),placementId:qe(t.placement_id),operationId:qe(t.operation_id),sourceSha:String(t.source_sha),buildSpec:zr(t.build_spec,{}),credentialPolicy:zr(t.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:qe(t.workspace),cacheKey:qe(t.cache_key),artifactUri:qe(t.artifact_uri),artifactDigest:qe(t.artifact_digest),status:String(t.status),cleanupAt:qe(t.cleanup_at),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}}class zA{control;now;id;constructor(t,e=()=>new Date,r=()=>crypto.randomUUID()){this.control=t;this.now=e;this.id=r}createPool(t){let e=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[e,t.organizationId,t.projectId,t.name,t.purpose,t.backend,t.region??null,t.architecture??null,JSON.stringify(t.labels),JSON.stringify(t.requiredServerLabels),JSON.stringify(t.toleratedTaints),JSON.stringify(rc(t.capacity)),"{}",t.maxWorkloads,t.costWeight,t.spreadKey??null,t.concurrency,t.ephemeralWorkspaces?1:0,t.allowProductionSecrets?1:0,t.status,r,r]),this.getPool(e)}getPool(t){let e=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(t);return e?PD(e):void 0}listPools(t){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(t).map(PD)}updatePool(t,e){let r=this.getPool(t);if(!r)throw Error("Capacity pool was not found.");let d={...r,...e},E=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[d.status,JSON.stringify(d.reserved),JSON.stringify(d.capacity),d.concurrency,E,t]),this.getPool(t)}addMember(t,e,r={}){let d=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[t,e,JSON.stringify(r),d,d])}members(t){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(t).map((e)=>({serverId:String(e.server_id),status:String(e.status),capacityOverride:zr(e.capacity_override,{})}))}memberStatus(t,e,r){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[r,this.now().toISOString(),t,e])}listPlacements(t,e){let r=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(t).map(aD);return e?.length?r.filter((d)=>e.includes(d.status)):r}getPlacement(t){let e=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(t);return e?aD(e):void 0}activeUsage(t,e){let r=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(t,this.now().toISOString()),d=e?r.filter((E)=>String(E.server_id)===e):r;return{resources:d.reduce((E,n)=>{let c=rc(zr(n.resources,{}));for(let _ of Object.keys(E))E[_]+=c[_];return E},jD()),count:d.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(t){return this.control.transaction(()=>{this.expireLeases();let e=this.id(),r=this.id(),d=this.now().toISOString(),E=new Date(this.now().getTime()+(t.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[e,t.projectId,t.environmentId??null,t.resourceId,t.releaseId??null,t.decision.poolId,t.decision.serverId??null,t.requirements.purpose,JSON.stringify(t.requirements),JSON.stringify(t.decision),t.requirements.stateful?1:0,t.requirements.autoReschedule&&!t.requirements.stateful?1:0,d,d]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[r,e,t.decision.poolId,t.decision.serverId??null,JSON.stringify(rc(t.requirements.resources)),E,d,d]),this.getPlacement(e)})}transitionPlacement(t,e){if(!this.getPlacement(t))throw Error("Placement was not found.");let d=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[e,d,t]),["released","failed","blocked"].includes(e))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[d,t]);return this.getPlacement(t)}createBuild(t){let e=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[e,t.projectId,t.resourceId??null,t.poolId,t.placementId??null,t.operationId??null,t.sourceSha,JSON.stringify(t.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:t.tokenExpiresAt}),r,r]),this.getBuild(e)}getBuild(t){let e=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(t);return e?Sa(e):void 0}updateBuild(t,e){let r=this.getBuild(t);if(!r)throw Error("Remote build was not found.");let d={...r,...e},E=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[d.operationId??null,d.workspace??null,d.cacheKey??null,d.artifactUri??null,d.artifactDigest??null,d.status,d.cleanupAt??null,E,t]),this.getBuild(t)}}var eh=["cpu","memoryBytes","diskBytes","gpu"],zD=(t,e={})=>Object.entries(e).every(([r,d])=>t[r]===d),Na=(t,e,r)=>Object.fromEntries(eh.map((d)=>[d,Math.max(0,t[d]-e[d]-(r[d]??0))])),Aa=(t,e)=>eh.every((r)=>t[r]>=(e[r]??0)),La=(t,e)=>eh.reduce((r,d)=>r+(e[d]??0)/(t[d]||1),0);class FA{store;fleet;constructor(t,e){this.store=t;this.fleet=e}poolCandidates(t,e,r){let d=[];for(let E of this.store.listPools(t)){if(E.id===r)continue;let n=[];if(E.status!=="active")n.push(`pool is ${E.status}`);if(E.purpose!==e.purpose)n.push(`purpose is ${E.purpose}`);if(e.region&&E.region!==e.region)n.push(`region is ${E.region??"unset"}`);if(e.architecture&&E.architecture!==e.architecture)n.push(`architecture is ${E.architecture??"unset"}`);if(!zD(E.labels,e.labels))n.push("pool labels do not match");if(E.backend==="server"){let c=this.store.members(E.id);if(!c.length)d.push(this.decision(E,void 0,e,[...n,"pool has no servers"]));for(let _ of c){let i=this.fleet.get(_.serverId),T=[...n];if(!i)T.push("server is missing");else this.serverReasons(E,i,_.status,e,T);d.push(this.decision(E,i,e,T,_.capacityOverride))}}else d.push(this.decision(E,void 0,e,n))}return d.sort((E,n)=>Number(n.eligible)-Number(E.eligible)||E.score.cost-n.score.cost||E.score.spread-n.score.spread||E.score.fit-n.score.fit||E.poolName.localeCompare(n.poolName)||(E.serverId??"").localeCompare(n.serverId??""))}serverReasons(t,e,r,d,E){if(r!=="active")E.push(`member is ${r}`);if(e.status!=="ready")E.push(`server is ${e.status}`);if(!e.roles.includes(d.purpose==="build"?"build":d.purpose))E.push(`server lacks ${d.purpose} role`);if(!zD(e.labels,t.requiredServerLabels))E.push("server labels do not match pool selector");for(let n of e.taints)if(!t.toleratedTaints.includes(n))E.push(`taint ${n} is not tolerated`)}decision(t,e,r,d,E={}){let n=rc({...e?.capacity,...E}),c=e?Object.fromEntries(eh.map((T)=>[T,Math.min(t.capacity[T],n[T])])):t.capacity,_=this.store.activeUsage(t.id,e?.id),i=Na(c,_.resources,t.reserved);if(_.count>=t.maxWorkloads)d.push("workload limit reached");if(r.purpose==="build"&&_.count>=t.concurrency)d.push("build concurrency reached");if(!Aa(i,r.resources))d.push("insufficient capacity");return{poolId:t.id,poolName:t.name,serverId:e?.id,eligible:d.length===0,reasons:d,available:i,score:{fit:La(i,r.resources),spread:_.count,cost:t.costWeight}}}explain(t,e){return this.poolCandidates(t,e)}place(t){return this.store.control.transaction(()=>{let e=this.poolCandidates(t.projectId,t.requirements).find((r)=>r.eligible);if(!e)throw Error(`No eligible capacity: ${this.explain(t.projectId,t.requirements).flatMap((r)=>r.reasons).join("; ")}`);return this.store.reserve({...t,decision:e})})}activate(t){return this.store.transitionPlacement(t,"active")}release(t){return this.store.transitionPlacement(t,"released")}drainPool(t){let e=this.store.updatePool(t,{status:"draining"}),r=[],d=[];for(let E of this.store.listPlacements(e.projectId,["reserved","active"]).filter((n)=>n.poolId===t)){if(E.stateful){d.push(this.store.transitionPlacement(E.id,"blocked"));continue}this.store.transitionPlacement(E.id,"moving");let n=this.place({projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,releaseId:E.releaseId,requirements:E.requirements});r.push(this.activate(n.id)),this.store.transitionPlacement(E.id,"released")}return{pool:e,moved:r,blocked:d}}drainServer(t,e){this.store.memberStatus(t,e,"draining");let r=this.store.getPool(t);if(!r)throw Error("Capacity pool was not found.");let d=[],E=[];for(let n of this.store.listPlacements(r.projectId,["reserved","active"]).filter((c)=>c.poolId===t&&c.serverId===e)){if(n.stateful){E.push(this.store.transitionPlacement(n.id,"blocked"));continue}this.store.transitionPlacement(n.id,"moving");let c=this.poolCandidates(n.projectId,n.requirements).find((i)=>i.eligible);if(!c){E.push(this.store.transitionPlacement(n.id,"blocked"));continue}let _=this.store.reserve({projectId:n.projectId,environmentId:n.environmentId,resourceId:n.resourceId,releaseId:n.releaseId,requirements:n.requirements,decision:c});d.push(this.activate(_.id)),this.store.transitionPlacement(n.id,"released")}return{moved:d,blocked:E}}reconcileFailure(t){let e=this.fleet.get(t);if(!e)throw Error("Server was not found.");let r=[],d=[];for(let E of this.store.listPlacements(e.projectId,["active"]).filter((n)=>n.serverId===t)){if(E.stateful||!E.autoReschedule){d.push(this.store.transitionPlacement(E.id,"blocked"));continue}this.store.transitionPlacement(E.id,"failed");let n=this.place({projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,releaseId:E.releaseId,requirements:E.requirements});r.push(this.activate(n.id))}return{rescheduled:r,blocked:d}}}var Od=(t,e)=>{try{return JSON.parse(String(t))}catch{return e}},Ir=(t)=>t==null?void 0:String(t),FD=(t)=>({id:String(t.id),organizationId:String(t.organization_id),projectId:String(t.project_id),environmentId:Ir(t.environment_id),name:String(t.name),hostname:String(t.hostname),homeRegion:String(t.home_region),regions:Od(t.regions,[]),trafficPolicy:String(t.traffic_policy),dataPolicy:Od(t.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(t.status),activeRegion:String(t.active_region),revision:Ir(t.revision),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),BA=(t)=>({id:String(t.id),topologyId:String(t.topology_id),region:String(t.region),role:String(t.role),provider:String(t.provider),stackId:Ir(t.stack_id),stackRevision:Ir(t.stack_revision),status:String(t.status),health:Od(t.health,{}),lastHealthyAt:Ir(t.last_healthy_at),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),JA=(t)=>({id:String(t.id),topologyId:String(t.topology_id),kind:String(t.kind),sourceRegion:String(t.source_region),targetRegion:String(t.target_region),config:Od(t.config,{}),status:String(t.status),checkpoint:Ir(t.checkpoint),lagSeconds:t.lag_seconds==null?void 0:Number(t.lag_seconds),lastVerifiedAt:Ir(t.last_verified_at),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),HA=(t)=>({id:String(t.id),topologyId:String(t.topology_id),hostname:String(t.hostname),dnsProvider:String(t.dns_provider),cdnEnabled:Number(t.cdn_enabled)===1,wafEnabled:Number(t.waf_enabled)===1,weights:Od(t.weights,{}),desiredWeights:Od(t.desired_weights,{}),status:String(t.status),providerState:Od(t.provider_state,{}),version:Number(t.version),createdAt:String(t.created_at),updatedAt:String(t.updated_at)}),BD=(t)=>({id:String(t.id),topologyId:String(t.topology_id),operationId:Ir(t.operation_id),kind:String(t.kind),requestedRegion:Ir(t.requested_region),revision:Ir(t.revision),plan:Od(t.plan,[]),currentStep:Ir(t.current_step),completedSteps:Od(t.completed_steps,[]),status:String(t.status),error:Ir(t.error),createdAt:String(t.created_at),updatedAt:String(t.updated_at)});class WA{control;now;id;constructor(t,e=()=>new Date,r=()=>crypto.randomUUID()){this.control=t;this.now=e;this.id=r}create(t){return this.control.transaction(()=>{if(t.regions.length<2||new Set(t.regions.map((n)=>n.region)).size!==t.regions.length||t.regions.filter((n)=>n.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let e=t.regions.find((n)=>n.role==="primary"),r=this.id(),d=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[r,t.organizationId,t.projectId,t.environmentId??null,t.name,t.hostname,e.region,JSON.stringify(t.regions),t.trafficPolicy,JSON.stringify(t.dataPolicy),e.region,d,d]);for(let n of t.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),r,n.region,n.role,n.provider,d,d]);for(let n of t.dataPolicy.replicate)for(let c of t.regions)for(let _ of t.regions.filter((i)=>i.region!==c.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,n,c.region,_.region,"{}",d,d]);let E=Object.fromEntries(t.regions.map((n)=>[n.region,n.region===e.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),r,t.hostname,t.dnsProvider??"route53",t.cdnEnabled?1:0,t.wafEnabled?1:0,JSON.stringify(E),JSON.stringify(E),d,d]),this.get(r)})}get(t){let e=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(t);return e?FD(e):void 0}list(t){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(t).map(FD)}targets(t){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(t).map(BA)}channels(t){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(t).map(JA)}route(t){let e=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(t);return e?HA(e):void 0}updateTopology(t,e){let r=this.get(t);if(!r)throw Error("Regional topology was not found.");let d={...r,...e},E=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[d.status,d.activeRegion,d.revision??null,JSON.stringify(d.regions),E,t]),this.get(t)}updateTarget(t,e){let r=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(t);if(!r)throw Error("Regional target was not found.");let d=BA(r),E={...d,...e},n=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[E.role,E.stackId??null,E.stackRevision??null,E.status,JSON.stringify(E.health),E.lastHealthyAt??null,n,t]),BA(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(t))}updateChannel(t,e){let r=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(t);if(!r)throw Error("Replication channel was not found.");let d=JA(r),E={...d,...e},n=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[E.status,E.checkpoint??null,E.lagSeconds??null,E.lastVerifiedAt??null,n,t]),JA(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(t))}updateRoute(t,e){let r=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(t);if(!r)throw Error("Traffic route was not found.");let d=HA(r),E={...d,...e},n=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(E.weights),JSON.stringify(E.desiredWeights),E.status,JSON.stringify(E.providerState),n,t]),HA(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(t))}createExecution(t){let e=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[e,t.topologyId,t.operationId??null,t.kind,t.requestedRegion??null,t.revision??null,JSON.stringify(t.plan),r,r]),this.execution(e)}execution(t){let e=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(t);return e?BD(e):void 0}executions(t){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(t).map(BD)}updateExecution(t,e){let r=this.execution(t);if(!r)throw Error("Regional execution was not found.");let d={...r,...e},E=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[d.operationId??null,d.currentStep??null,JSON.stringify(d.completedSteps),d.status,d.error??null,E,t]),this.execution(t)}}class vA{store;queue;constructor(t,e){this.store=t;this.queue=e??new yt(t.control)}create(t){return this.store.create(t)}plan(t,e,r){if(!this.store.get(t))throw Error("Regional topology was not found.");let E=this.store.targets(t),n=this.store.channels(t);if(e==="rollout")return[...E.filter((c)=>c.role==="secondary").map((c)=>`apply:${c.region}`),...E.filter((c)=>c.role==="primary").map((c)=>`apply:${c.region}`),...n.map((c)=>`replicate:${c.kind}:${c.targetRegion}`),"traffic:activate"];if(e==="failover"||e==="failback")return[`health:${r}`,`replication:${r}`,`traffic:${r}`,`roles:${r}`];if(e==="destroy")return["traffic:drain",...E.filter((c)=>c.role==="secondary").map((c)=>`delete:${c.region}`),...E.filter((c)=>c.role==="primary").map((c)=>`delete:${c.region}`),"complete"];return["observe","repair"]}enqueue(t){let e=this.store.get(t.topologyId);if(!e)throw Error("Regional topology was not found.");if(["failover","failback"].includes(t.kind)&&(!t.targetRegion||!e.regions.some((n)=>n.region===t.targetRegion)))throw Error("A topology target region is required.");if(t.kind==="failover"&&t.targetRegion===e.activeRegion)throw Error("Target region is already active.");if((t.kind==="destroy"||t.deleteData)&&t.confirmation!==e.name)throw Error("Exact topology name confirmation is required.");if(t.deleteData&&e.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(t.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(t.revision??""))throw Error("An immutable revision is required.");let r=this.plan(e.id,t.kind,t.targetRegion),d=this.store.createExecution({topologyId:e.id,kind:t.kind,requestedRegion:t.targetRegion,revision:t.revision,plan:r}),E=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,kind:`region.${t.kind}`,input:{executionId:d.id,manifest:t.manifest??{},deleteData:t.deleteData===!0},lockKey:`regional-topology:${e.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(d.id,{operationId:E.id}),{execution:this.store.execution(d.id),operation:E}}}var ua=(t)=>t&&typeof t==="object"&&!Array.isArray(t)?t:{};function JD(t,e){let r=(T)=>{let h=e.find((R)=>R.provider===T.provider);if(!h)throw Error(`No ${T.provider} regional driver is configured.`);return h},d=(T,h,R)=>{T.throwIfCancellationRequested(),T.checkpoint(R,R),t.updateExecution(h.id,{status:"running",currentStep:R,completedSteps:[...t.execution(h.id).completedSteps,R]})},E=async(T,h)=>{let R=t.route(T.id);if(!R)throw Error("Regional traffic route was not found.");let N=t.targets(T.id).find((u)=>u.region===T.activeRegion)??t.targets(T.id)[0];if(!N)throw Error("Regional traffic target was not found.");t.updateRoute(R.id,{status:"applying",desiredWeights:h});let A=await r(N).applyTraffic({route:t.route(T.id),topology:T,weights:h});t.updateRoute(R.id,{status:Object.values(h).every((u)=>u===0)?"drained":"in_sync",weights:h,providerState:A.providerState})},n=async(T,h,R,N)=>{t.updateTopology(R.id,{status:"provisioning"});let A=h.revision,u=N.manifest??{},U=t.targets(R.id).sort((l,P)=>Number(l.role==="primary")-Number(P.role==="primary"));for(let l of U){d(T,h,`apply:${l.region}`),t.updateTarget(l.id,{status:"provisioning"});let P=await r(l).applyStack({target:l,revision:A,manifest:u,signal:T.signal}),a=await r(l).health({target:t.updateTarget(l.id,{stackId:P.stackId,stackRevision:A})});if(!a.healthy)throw Error(`Regional health gate failed in ${l.region}.`);t.updateTarget(l.id,{status:"ready",health:a.evidence,lastHealthyAt:new Date().toISOString()})}for(let l of t.channels(R.id)){d(T,h,`replicate:${l.kind}:${l.targetRegion}`),t.updateChannel(l.id,{status:"configuring"});let P=U.find((B)=>B.region===l.sourceRegion),a=await r(P).configureReplication({channel:l,topology:R}),j=await r(P).verifyReplication({channel:t.updateChannel(l.id,{checkpoint:a.checkpoint,lagSeconds:a.lagSeconds}),topology:R});if(!j.healthy||j.lagSeconds>R.dataPolicy.maxLagSeconds)throw Error(`${l.kind} replication to ${l.targetRegion} exceeds the RPO.`);t.updateChannel(l.id,{status:"in_sync",checkpoint:j.checkpoint,lagSeconds:j.lagSeconds,lastVerifiedAt:new Date().toISOString()})}d(T,h,"traffic:activate");let w=Object.fromEntries(R.regions.map((l)=>[l.region,l.region===R.activeRegion?100:0]));return await E(R,w),t.updateTopology(R.id,{status:"ready",revision:A}),{revision:A,activeRegion:R.activeRegion}},c=async(T,h,R)=>{let N=h.requestedRegion,A=t.targets(R.id).find((w)=>w.region===N);if(!A)throw Error("Requested regional target was not found.");t.updateTopology(R.id,{status:h.kind==="failover"?"failing_over":"failing_back"}),d(T,h,`health:${N}`);let u=await r(A).health({target:A});if(!u.healthy)throw Error(`Target region ${N} is unhealthy.`);t.updateTarget(A.id,{status:"ready",health:u.evidence,lastHealthyAt:new Date().toISOString()}),d(T,h,`replication:${N}`);for(let w of t.channels(R.id).filter((l)=>l.targetRegion===N)){let l=await r(A).verifyReplication({channel:w,topology:R});if(!l.healthy||l.lagSeconds>R.dataPolicy.maxLagSeconds)throw Error(`${w.kind} replication is outside the failover RPO.`);t.updateChannel(w.id,{status:"in_sync",checkpoint:l.checkpoint,lagSeconds:l.lagSeconds,lastVerifiedAt:new Date().toISOString()})}d(T,h,`traffic:${N}`),await E(R,Object.fromEntries(R.regions.map((w)=>[w.region,w.region===N?100:0]))),d(T,h,`roles:${N}`);let U=R.regions.map((w)=>({...w,role:w.region===N?"primary":"secondary"}));for(let w of t.targets(R.id))t.updateTarget(w.id,{role:w.region===N?"primary":"secondary"});return t.updateTopology(R.id,{status:h.kind==="failover"?"failed_over":"ready",activeRegion:N,regions:U}),{activeRegion:N}},_=async(T,h,R,N)=>{t.updateTopology(R.id,{status:"destroying"}),d(T,h,"traffic:drain"),await E(R,Object.fromEntries(R.regions.map((u)=>[u.region,0])));let A=N.deleteData!==!0;for(let u of t.targets(R.id).sort((U,w)=>Number(U.role==="primary")-Number(w.role==="primary")))d(T,h,`delete:${u.region}`),t.updateTarget(u.id,{status:"deleting"}),await r(u).deleteStack({target:u,retainData:A,signal:T.signal}),t.updateTarget(u.id,{status:"deleted"});return d(T,h,"complete"),t.updateTopology(R.id,{status:"destroyed"}),{destroyed:!0,dataRetained:A}},i=async(T)=>{let h=ua(T.operation.input),R=t.execution(String(h.executionId??""));if(!R)throw Error("Regional execution was not found.");let N=t.get(R.topologyId);if(!N)throw Error("Regional topology was not found.");try{let A;if(R.kind==="rollout")A=await n(T,R,N,h);else if(R.kind==="failover"||R.kind==="failback")A=await c(T,R,N);else if(R.kind==="destroy")A=await _(T,R,N,h);else throw Error("Regional reconciliation is not configured.");return t.updateExecution(R.id,{status:"succeeded",currentStep:void 0}),{executionId:R.id,...A}}catch(A){if(t.updateExecution(R.id,{status:T.cancellationRequested()?"cancelled":"failed",error:A instanceof Error?A.message:String(A)}),t.get(N.id)?.status!=="destroyed")t.updateTopology(N.id,{status:"failed"});throw A}};return{"region.rollout":i,"region.failover":i,"region.failback":i,"region.destroy":i,"region.reconcile":i}}class QA{provider;reason;constructor(t,e="Configure a regional provider transport before executing this operation."){this.provider=t;this.reason=e}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}function qr(t,e,r){return[t,e,r].map((d)=>encodeURIComponent(d)).join(":")}function Oa(t){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((e)=>[e,{supported:!1,reason:t}]))}function VE(t,e,r=["exec","files"]){let d=Oa(e);for(let E of t)d[E]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(E),requiresRecentAuth:r.includes(E)};return d}var Ca=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function Id(t){let e=String(t??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(e))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(e))return"starting";if(["deactivating","stopping","draining","terminating"].includes(e))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(e))return"stopped";if(["degraded","unhealthy","warning"].includes(e))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(e))return"failed";return"unknown"}function Cd(t){if(Array.isArray(t))return t.map((r)=>Cd(r));if(!t||typeof t!=="object")return t;let e={};for(let[r,d]of Object.entries(t))e[r]=Ca.test(r)?"[REDACTED]":Cd(d);return e}function KE(t,e=new Date){if(!t)return;let r=new Date(t).getTime();return Number.isFinite(r)?Math.max(0,Math.floor((e.getTime()-r)/1000)):void 0}function HD(t){let e=Number(t);return Number.isFinite(e)&&e>=0?e:void 0}function Ia(t){let e=String(t?.message??t);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(e))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(e))return"unreachable";return"error"}async function WD(t,e={},r={}){let d=e.now??new Date,E=Math.max(100,r.timeoutMs??1e4),n=Math.max(1,r.staleAfterSeconds??60),c=await Promise.all(t.map(async(i)=>{try{let T=await Promise.race([i.discover({...e,now:d}),new Promise((h,R)=>setTimeout(()=>R(Error(`Runtime source ${i.id} timed out after ${E}ms`)),E))]);return{workloads:T,source:{id:i.id,provider:i.provider,status:"fresh",discoveredAt:d.toISOString(),staleAfterSeconds:n,itemCount:T.length}}}catch(T){return{workloads:[],source:{id:i.id,provider:i.provider,status:Ia(T),discoveredAt:d.toISOString(),staleAfterSeconds:n,itemCount:0,message:String(T?.message??T).slice(0,500)}}}})),_=c.map((i)=>i.source);return{generatedAt:d.toISOString(),workloads:c.flatMap((i)=>i.workloads).sort((i,T)=>i.name.localeCompare(T.name)||i.id.localeCompare(T.id)),sources:_,degraded:_.some((i)=>i.status!=="fresh")}}await Wt();At();er();At();class sr{client;region;constructor(t="us-east-1",e){this.region=t,this.client=new dt(void 0,{profile:e})}async createStack(t){let e={Action:"CreateStack",StackName:t.stackName,Version:"2010-05-15"};if(t.templateBody)e.TemplateBody=t.templateBody;else if(t.templateUrl)e.TemplateURL=t.templateUrl;else throw Error("Either templateBody or templateUrl must be provided");if(t.parameters)t.parameters.forEach((d,E)=>{e[`Parameters.member.${E+1}.ParameterKey`]=d.ParameterKey,e[`Parameters.member.${E+1}.ParameterValue`]=d.ParameterValue});if(t.capabilities)t.capabilities.forEach((d,E)=>{e[`Capabilities.member.${E+1}`]=d});if(t.roleArn)e.RoleARN=t.roleArn;if(t.tags)t.tags.forEach((d,E)=>{e[`Tags.member.${E+1}.Key`]=d.Key,e[`Tags.member.${E+1}.Value`]=d.Value});if(t.timeoutInMinutes)e.TimeoutInMinutes=t.timeoutInMinutes;if(t.onFailure)e.OnFailure=t.onFailure;let r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{StackId:r.StackId||r.CreateStackResult?.StackId}}async updateStack(t){let e={Action:"UpdateStack",StackName:t.stackName,Version:"2010-05-15"};if(t.templateBody)e.TemplateBody=t.templateBody;else if(t.templateUrl)e.TemplateURL=t.templateUrl;if(t.parameters)t.parameters.forEach((d,E)=>{if(e[`Parameters.member.${E+1}.ParameterKey`]=d.ParameterKey,d.UsePreviousValue)e[`Parameters.member.${E+1}.UsePreviousValue`]="true";else e[`Parameters.member.${E+1}.ParameterValue`]=d.ParameterValue});if(t.capabilities)t.capabilities.forEach((d,E)=>{e[`Capabilities.member.${E+1}`]=d});if(t.roleArn)e.RoleARN=t.roleArn;if(t.tags)t.tags.forEach((d,E)=>{e[`Tags.member.${E+1}.Key`]=d.Key,e[`Tags.member.${E+1}.Value`]=d.Value});let r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{StackId:r.StackId||r.UpdateStackResult?.StackId}}async deleteStack(t,e,r){let d={Action:"DeleteStack",StackName:t,Version:"2010-05-15"};if(e)d.RoleARN=e;if(r&&r.length>0)r.forEach((E,n)=>{d[`RetainResources.member.${n+1}`]=E});await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(d).toString()})}async describeStacks(t={}){let e={Action:"DescribeStacks",Version:"2010-05-15"};if(t.stackName)e.StackName=t.stackName;let r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{Stacks:this.parseStacksResponse(r)}}async describeStackEvents(t){let e={Action:"DescribeStackEvents",StackName:t,Version:"2010-05-15"},r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{StackEvents:this.parseStackEvents(r)}}async listStackResources(t){let e={Action:"ListStackResources",StackName:t,Version:"2010-05-15"},d=(await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()}))?.ListStackResourcesResult?.StackResourceSummaries?.member,E=[];if(d)E=Array.isArray(d)?d:[d];return{StackResourceSummaries:E}}async waitForStack(t,e){let r={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},d=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],E=r[e],n=360,c=0;while(c<360)try{let _=await this.describeStacks({stackName:t});if(_.Stacks.length===0){if(e==="stack-delete-complete")return;if(c%10===0)console.log(`[waitForStack] Attempt ${c}: Stack not visible yet`);await new Promise((T)=>setTimeout(T,2000)),c++;continue}let i=_.Stacks[0];if(c%10===0)console.log(`[waitForStack] Attempt ${c}: Status = ${i.StackStatus}${i.StackStatusReason?` (${i.StackStatusReason})`:""}`);if(E.includes(i.StackStatus))return;if((e==="stack-create-complete"||e==="stack-update-complete")&&(i.StackStatus==="DELETE_IN_PROGRESS"||i.StackStatus==="DELETE_COMPLETE")){console.log("[waitForStack] Stack is being deleted (creation/update failed)");let T="";try{let R=await this.describeStackEvents(t);console.log("[waitForStack] Stack events (most recent first):");for(let N of R.StackEvents.slice(0,15))if(N.ResourceStatus.includes("FAILED")||N.ResourceStatusReason){if(console.log(`  ${N.LogicalResourceId}: ${N.ResourceStatus} - ${N.ResourceStatusReason||"No reason provided"}`),N.ResourceStatus.includes("FAILED")&&N.ResourceStatusReason&&!T)T=N.ResourceStatusReason}}catch{}let h=T||i.StackStatusReason||"Check CloudFormation console for details.";throw Error(`Stack creation/update failed - stack is being deleted. Reason: ${h}`)}if(i.StackStatus==="DELETE_FAILED"&&e==="stack-delete-complete"){let T=Error("Stack deletion failed - may have resources that need to be retained");throw T.code="DELETE_FAILED",T.stackStatus=i.StackStatus,T.statusReason=i.StackStatusReason,T}if(d.includes(i.StackStatus))throw Error(`Stack reached failure status: ${i.StackStatus}`);await new Promise((T)=>setTimeout(T,5000)),c++}catch(_){if(e==="stack-delete-complete"&&_.message?.includes("does not exist"))return;if(e==="stack-create-complete"&&_.message?.includes("does not exist")){if(c%10===0)console.log(`[waitForStack] Attempt ${c}: Stack does not exist (error), retrying...`);await new Promise((i)=>setTimeout(i,2000)),c++;continue}throw console.log(`[waitForStack] Unexpected error: ${_.message}`),_}throw console.log(`[waitForStack] Timeout after ${c} attempts`),Error(`Timeout waiting for stack to reach ${e}`)}async validateTemplate(t){let e={Action:"ValidateTemplate",TemplateBody:t,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()})}async listStacks(t){let e={Action:"ListStacks",Version:"2010-05-15"};if(t)t.forEach((_,i)=>{e[`StackStatusFilter.member.${i+1}`]=_});let r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()}),d=r.ListStacksResponse||r,E=d.ListStacksResult||d,n=E.StackSummaries?.member||E.StackSummaries||[];return{StackSummaries:(Array.isArray(n)?n:n?[n]:[]).map((_)=>({StackId:_.StackId||"",StackName:_.StackName||"",TemplateDescription:_.TemplateDescription,CreationTime:_.CreationTime||"",LastUpdatedTime:_.LastUpdatedTime,DeletionTime:_.DeletionTime,StackStatus:_.StackStatus||""}))}}async createChangeSet(t){let e={Action:"CreateChangeSet",StackName:t.stackName,ChangeSetName:t.changeSetName,Version:"2010-05-15"};if(t.templateBody)e.TemplateBody=t.templateBody;else if(t.templateUrl)e.TemplateURL=t.templateUrl;if(t.parameters)t.parameters.forEach((d,E)=>{e[`Parameters.member.${E+1}.ParameterKey`]=d.ParameterKey,e[`Parameters.member.${E+1}.ParameterValue`]=d.ParameterValue});if(t.capabilities)t.capabilities.forEach((d,E)=>{e[`Capabilities.member.${E+1}`]=d});if(t.changeSetType)e.ChangeSetType=t.changeSetType;let r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{Id:r.Id,StackId:r.StackId}}async describeChangeSet(t,e){let r={Action:"DescribeChangeSet",StackName:t,ChangeSetName:e,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()})}async executeChangeSet(t,e){let r={Action:"ExecuteChangeSet",StackName:t,ChangeSetName:e,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()})}async deleteChangeSet(t,e){let r={Action:"DeleteChangeSet",StackName:t,ChangeSetName:e,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()})}async getStackOutputs(t){let e=await this.describeStacks({stackName:t});if(!e.Stacks||e.Stacks.length===0)throw Error(`Stack ${t} not found`);let r=e.Stacks[0],d={};if(r.Outputs)for(let E of r.Outputs)d[E.OutputKey]=E.OutputValue;return d}async getTemplate(t){let e={Action:"GetTemplate",StackName:t,Version:"2010-05-15"},r=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{TemplateBody:r?.GetTemplateResult?.TemplateBody||r?.TemplateBody||""}}parseStacksResponse(t){let e=[],r=t?.DescribeStacksResult?.Stacks?.member||t?.Stacks?.member||t?.Stacks||t;if(r&&!Array.isArray(r))r=[r];if(Array.isArray(r)){for(let d of r)if(d.StackId||d.StackName){let E;if(d.Outputs?.member)E=(Array.isArray(d.Outputs.member)?d.Outputs.member:[d.Outputs.member]).map((c)=>({OutputKey:c.OutputKey,OutputValue:c.OutputValue,Description:c.Description,ExportName:c.ExportName}));e.push({StackId:d.StackId,StackName:d.StackName,StackStatus:d.StackStatus,CreationTime:d.CreationTime,LastUpdatedTime:d.LastUpdatedTime,StackStatusReason:d.StackStatusReason,Outputs:E})}}else if(t.StackId)e.push({StackId:t.StackId,StackName:t.StackName,StackStatus:t.StackStatus,CreationTime:t.CreationTime,LastUpdatedTime:t.LastUpdatedTime});return e}parseStackEvents(t){let e=[],r=t?.DescribeStackEventsResult?.StackEvents?.member||t?.StackEvents?.member||t?.StackEvents||[];if(r&&!Array.isArray(r))r=[r];for(let d of r)if(d.LogicalResourceId)e.push({Timestamp:d.Timestamp,ResourceType:d.ResourceType,LogicalResourceId:d.LogicalResourceId,ResourceStatus:d.ResourceStatus,ResourceStatusReason:d.ResourceStatusReason});return e}async waitForStackWithProgress(t,e,r){let d={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},E=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],n=d[e],c=360,_=0,i=new Set;while(_<360)try{if(r)try{let N=[...(await this.describeStackEvents(t)).StackEvents||[]].reverse();for(let A of N){let u=`${A.LogicalResourceId}-${A.ResourceStatus}-${A.Timestamp}`;if(!i.has(u))i.add(u),r({resourceId:A.LogicalResourceId,resourceType:A.ResourceType,status:A.ResourceStatus,reason:A.ResourceStatusReason,timestamp:A.Timestamp})}}catch{}let T=await this.describeStacks({stackName:t});if(T.Stacks.length===0){if(e==="stack-delete-complete")return;await new Promise((R)=>setTimeout(R,2000)),_++;continue}let h=T.Stacks[0];if(n.includes(h.StackStatus))return;if(h.StackStatus==="DELETE_FAILED"&&e==="stack-delete-complete"){let R=Error("Stack deletion failed - may have resources that need to be retained");throw R.code="DELETE_FAILED",R.stackStatus=h.StackStatus,R.statusReason=h.StackStatusReason,R}if(E.includes(h.StackStatus))throw Error(`Stack reached failure status: ${h.StackStatus}`);await new Promise((R)=>setTimeout(R,3000)),_++}catch(T){if(e==="stack-delete-complete"&&T.message?.includes("does not exist"))return;if(e==="stack-create-complete"&&T.message?.includes("does not exist")){await new Promise((h)=>setTimeout(h,2000)),_++;continue}throw T}throw Error(`Timeout waiting for stack to reach ${e}`)}async waitForStackComplete(t,e=120,r=5000){let d=["CREATE_COMPLETE","UPDATE_COMPLETE","DELETE_COMPLETE"],E=["CREATE_FAILED","UPDATE_FAILED","DELETE_FAILED","ROLLBACK_COMPLETE","ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED"];for(let n=0;n<e;n++)try{let c=await this.describeStacks({stackName:t});if(c.Stacks.length===0)return{success:!0,status:"DELETE_COMPLETE"};let _=c.Stacks[0],i=_.StackStatus;if(d.includes(i))return{success:!0,status:i};if(E.includes(i))return{success:!1,status:i,reason:_.StackStatusReason};await new Promise((T)=>setTimeout(T,r))}catch(c){if(c.message?.includes("does not exist"))return{success:!0,status:"DELETE_COMPLETE"};throw c}return{success:!1,status:"TIMEOUT",reason:"Timeout waiting for stack operation"}}}At();import{createHash as la}from"node:crypto";import{existsSync as Da,mkdirSync as Ua,readdirSync as WG,readFileSync as fa,rmSync as vG,writeFileSync as wa}from"node:fs";import{homedir as ga}from"node:os";import{join as w_}from"node:path";var vD=1,QD=3600000,$a=24*QD,ya=QD,Xa=30*$a;function Pa(){let t=process.env.XDG_CACHE_HOME;return w_(t&&t.trim()?t:w_(ga(),".cache"),"ts-cloud","cost-explorer")}function YD(t){return w_(Pa(),t??"__default__")}function MD(t){let e={s:t.start,e:t.end,g:t.granularity,m:[...t.metrics].sort(),gb:[...t.groupBy].map((r)=>`${r.Type}:${r.Key}`).sort(),f:t.filter??null};return la("sha256").update(JSON.stringify(e)).digest("hex").slice(0,24)}function aa(t,e){let r=Date.parse(`${e}T00:00:00Z`);if(Number.isNaN(r))return!1;let d=new Date,E=Date.UTC(d.getUTCFullYear(),d.getUTCMonth(),1);return r<=E}function ja(t){return aa(t.start,t.end)?Xa:ya}function GD(t,e){let r=w_(YD(t),`${MD(e)}.json`);if(!Da(r))return null;let d;try{d=JSON.parse(fa(r,"utf-8"))}catch{return null}if(d.schema!==vD)return null;let E=Date.now()-d.savedAt;if(E<0||E>ja(e))return null;return{response:d.response,ageSeconds:Math.floor(E/1000)}}function VD(t,e,r){let d=YD(t);Ua(d,{recursive:!0});let E={schema:vD,savedAt:Date.now(),key:e,response:r};wa(w_(d,`${MD(e)}.json`),JSON.stringify(E))}class YA{client;profile;useCache;lastCacheAgeSeconds=null;constructor(t,e){this.profile=t,this.useCache=e?.useCache??!0,this.client=new dt(Fn(t))}async getCostByService(t){return(await this.getCostByDimension({...t,dimension:"SERVICE"})).map((r)=>({service:r.key,amount:r.amount,unit:r.unit}))}async getCostByDimension(t){let{start:e,end:r,dimension:d,granularity:E="MONTHLY",filter:n}=t,c=["UnblendedCost"],_=[{Type:"DIMENSION",Key:d}],i={start:e,end:r,granularity:E,metrics:c,groupBy:_,filter:n};if(this.useCache){let N=GD(this.profile,i);if(N)return this.lastCacheAgeSeconds=N.ageSeconds,N.response}this.lastCacheAgeSeconds=null;let T=new Map,h;do{let N={TimePeriod:{Start:e,End:r},Granularity:E,Metrics:c,GroupBy:_};if(n)N.Filter=n;if(h)N.NextPageToken=h;let A=await this.client.request({service:"ce",region:"us-east-1",method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"AWSInsightsIndexService.GetCostAndUsage"},body:JSON.stringify(N)});for(let u of A?.ResultsByTime??[])for(let U of u?.Groups??[]){let w=U.Keys?.[0]??"Unknown",l=Number.parseFloat(U.Metrics?.UnblendedCost?.Amount??"0"),P=U.Metrics?.UnblendedCost?.Unit??"USD",a=T.get(w);T.set(w,{key:w,amount:(a?.amount??0)+l,unit:P})}h=A?.NextPageToken||void 0}while(h);let R=[...T.values()].filter((N)=>N.amount>0).sort((N,A)=>A.amount-N.amount);if(this.useCache)VD(this.profile,i,R);return R}async getDailyTotals(t){return((await this.client.request({service:"ce",region:"us-east-1",method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"AWSInsightsIndexService.GetCostAndUsage"},body:JSON.stringify({TimePeriod:{Start:t.start,End:t.end},Granularity:"DAILY",Metrics:["UnblendedCost"]})}))?.ResultsByTime??[]).map((d)=>Number.parseFloat(d.Total?.UnblendedCost?.Amount??"0"))}}At();class g_{client;region;constructor(t="us-east-1"){this.region=t,this.client=new dt}async describeInstances(t){let e={Action:"DescribeInstances",Version:"2016-11-15"};if(t?.InstanceIds)t.InstanceIds.forEach((E,n)=>{e[`InstanceId.${n+1}`]=E});if(t?.Filters)t.Filters.forEach((E,n)=>{e[`Filter.${n+1}.Name`]=E.Name,E.Values.forEach((c,_)=>{e[`Filter.${n+1}.Value.${_+1}`]=c})});if(t?.MaxResults)e.MaxResults=String(t.MaxResults);if(t?.NextToken)e.NextToken=t.NextToken;let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()}),d=r.DescribeInstancesResponse||r;return{Reservations:this.parseReservations(d.reservationSet?.item),NextToken:d.nextToken}}async getInstance(t){return(await this.describeInstances({InstanceIds:[t]})).Reservations?.[0]?.Instances?.[0]}async getConsoleOutput(t,e){let r={Action:"GetConsoleOutput",Version:"2016-11-15",InstanceId:t};if(e)r.Latest="true";let d=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(r).toString()}),E=d.GetConsoleOutputResponse||d;return{InstanceId:E.instanceId,Output:E.output,Timestamp:E.timestamp}}async getConsoleOutputDecoded(t,e){let r=await this.getConsoleOutput(t,e?.latest);if(!r.Output)return"No console output available yet";let d=Buffer.from(r.Output,"base64").toString("utf-8");if(e?.tailLines)return d.split(`
 `).slice(-e.tailLines).join(`
 `);return d}async describeInstanceStatus(t){let e={Action:"DescribeInstanceStatus",Version:"2016-11-15"};if(t?.InstanceIds)t.InstanceIds.forEach((d,E)=>{e[`InstanceId.${E+1}`]=d});if(t?.IncludeAllInstances)e.IncludeAllInstances="true";if(t?.Filters)t.Filters.forEach((d,E)=>{e[`Filter.${E+1}.Name`]=d.Name,d.Values.forEach((n,c)=>{e[`Filter.${E+1}.Value.${c+1}`]=n})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()});return{InstanceStatuses:this.parseArray(r.instanceStatusSet?.item).map((d)=>({InstanceId:d.instanceId,InstanceState:d.instanceState?{Code:Number.parseInt(d.instanceState.code),Name:d.instanceState.name}:void 0,InstanceStatus:d.instanceStatus?{Status:d.instanceStatus.status,Details:this.parseArray(d.instanceStatus.details?.item).map((E)=>({Name:E.name,Status:E.status}))}:void 0,SystemStatus:d.systemStatus?{Status:d.systemStatus.status,Details:this.parseArray(d.systemStatus.details?.item).map((E)=>({Name:E.name,Status:E.status}))}:void 0}))}}async startInstances(t){let e={Action:"StartInstances",Version:"2016-11-15"};t.forEach((d,E)=>{e[`InstanceId.${E+1}`]=d});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()});return{StartingInstances:this.parseArray(r.instancesSet?.item).map((d)=>({InstanceId:d.instanceId,CurrentState:d.currentState?{Name:d.currentState.name}:void 0,PreviousState:d.previousState?{Name:d.previousState.name}:void 0}))}}async stopInstances(t,e){let r={Action:"StopInstances",Version:"2016-11-15"};if(t.forEach((E,n)=>{r[`InstanceId.${n+1}`]=E}),e)r.Force="true";let d=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(r).toString()});return{StoppingInstances:this.parseArray(d.instancesSet?.item).map((E)=>({InstanceId:E.instanceId,CurrentState:E.currentState?{Name:E.currentState.name}:void 0,PreviousState:E.previousState?{Name:E.previousState.name}:void 0}))}}async rebootInstances(t){let e={Action:"RebootInstances",Version:"2016-11-15"};t.forEach((r,d)=>{e[`InstanceId.${d+1}`]=r}),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()})}async terminateInstances(t){let e={Action:"TerminateInstances",Version:"2016-11-15"};t.forEach((d,E)=>{e[`InstanceId.${E+1}`]=d});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()});return{TerminatingInstances:this.parseArray(r.instancesSet?.item).map((d)=>({InstanceId:d.instanceId,CurrentState:d.currentState?{Name:d.currentState.name}:void 0,PreviousState:d.previousState?{Name:d.previousState.name}:void 0}))}}async createImage(t){let e={Action:"CreateImage",Version:"2016-11-15",InstanceId:t.InstanceId,Name:t.Name};if(t.Description)e.Description=t.Description;if(t.NoReboot!==void 0)e.NoReboot=String(t.NoReboot);if(t.TagSpecifications)t.TagSpecifications.forEach((E,n)=>{e[`TagSpecification.${n+1}.ResourceType`]=E.ResourceType,E.Tags.forEach((c,_)=>{e[`TagSpecification.${n+1}.Tag.${_+1}.Key`]=c.Key,e[`TagSpecification.${n+1}.Tag.${_+1}.Value`]=c.Value})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()});return{ImageId:(r.CreateImageResponse||r).imageId}}async deregisterImage(t){await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({Action:"DeregisterImage",Version:"2016-11-15",ImageId:t}).toString()})}async describeVpcs(t){let e={Action:"DescribeVpcs",Version:"2016-11-15"};if(t?.VpcIds)t.VpcIds.forEach((d,E)=>{e[`VpcId.${E+1}`]=d});if(t?.Filters)t.Filters.forEach((d,E)=>{e[`Filter.${E+1}.Name`]=d.Name,d.Values.forEach((n,c)=>{e[`Filter.${E+1}.Value.${c+1}`]=n})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()});return{Vpcs:this.parseArray(r.vpcSet?.item).map((d)=>({VpcId:d.vpcId,CidrBlock:d.cidrBlock,State:d.state,DhcpOptionsId:d.dhcpOptionsId,InstanceTenancy:d.instanceTenancy,IsDefault:d.isDefault==="true",Tags:this.parseTags(d.tagSet?.item)}))}}async describeSubnets(t){let e={Action:"DescribeSubnets",Version:"2016-11-15"};if(t?.SubnetIds)t.SubnetIds.forEach((d,E)=>{e[`SubnetId.${E+1}`]=d});if(t?.Filters)t.Filters.forEach((d,E)=>{e[`Filter.${E+1}.Name`]=d.Name,d.Values.forEach((n,c)=>{e[`Filter.${E+1}.Value.${c+1}`]=n})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()});return{Subnets:this.parseArray(r.subnetSet?.item).map((d)=>({SubnetId:d.subnetId,VpcId:d.vpcId,CidrBlock:d.cidrBlock,AvailabilityZone:d.availabilityZone,AvailableIpAddressCount:Number.parseInt(d.availableIpAddressCount),State:d.state,MapPublicIpOnLaunch:d.mapPublicIpOnLaunch==="true",Tags:this.parseTags(d.tagSet?.item)}))}}async describeSecurityGroups(t){let e={Action:"DescribeSecurityGroups",Version:"2016-11-15"};if(t?.GroupIds)t.GroupIds.forEach((d,E)=>{e[`GroupId.${E+1}`]=d});if(t?.GroupNames)t.GroupNames.forEach((d,E)=>{e[`GroupName.${E+1}`]=d});if(t?.Filters)t.Filters.forEach((d,E)=>{e[`Filter.${E+1}.Name`]=d.Name,d.Values.forEach((n,c)=>{e[`Filter.${E+1}.Value.${c+1}`]=n})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()});return{SecurityGroups:this.parseArray(r.securityGroupInfo?.item).map((d)=>({GroupId:d.groupId,GroupName:d.groupName,Description:d.groupDescription,VpcId:d.vpcId,IpPermissions:this.parseIpPermissions(d.ipPermissions?.item),IpPermissionsEgress:this.parseIpPermissions(d.ipPermissionsEgress?.item),Tags:this.parseTags(d.tagSet?.item)}))}}async describeInternetGateways(t){let e={Action:"DescribeInternetGateways",Version:"2016-11-15"};if(t?.InternetGatewayIds)t.InternetGatewayIds.forEach((d,E)=>{e[`InternetGatewayId.${E+1}`]=d});if(t?.Filters)t.Filters.forEach((d,E)=>{e[`Filter.${E+1}.Name`]=d.Name,d.Values.forEach((n,c)=>{e[`Filter.${E+1}.Value.${c+1}`]=n})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()});return{InternetGateways:this.parseArray(r.internetGatewaySet?.item).map((d)=>({InternetGatewayId:d.internetGatewayId,Attachments:this.parseArray(d.attachmentSet?.item).map((E)=>({VpcId:E.vpcId,State:E.state})),Tags:this.parseTags(d.tagSet?.item)}))}}async describeAddresses(t){let e={Action:"DescribeAddresses",Version:"2016-11-15"};if(t?.AllocationIds)t.AllocationIds.forEach((d,E)=>{e[`AllocationId.${E+1}`]=d});if(t?.PublicIps)t.PublicIps.forEach((d,E)=>{e[`PublicIp.${E+1}`]=d});if(t?.Filters)t.Filters.forEach((d,E)=>{e[`Filter.${E+1}.Name`]=d.Name,d.Values.forEach((n,c)=>{e[`Filter.${E+1}.Value.${c+1}`]=n})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()});return{Addresses:this.parseArray(r.addressesSet?.item).map((d)=>({PublicIp:d.publicIp,AllocationId:d.allocationId,AssociationId:d.associationId,InstanceId:d.instanceId,NetworkInterfaceId:d.networkInterfaceId,PrivateIpAddress:d.privateIpAddress,Domain:d.domain,Tags:this.parseTags(d.tagSet?.item)}))}}async allocateAddress(t){let e={Action:"AllocateAddress",Version:"2016-11-15"};if(t?.Domain)e.Domain=t.Domain;if(t?.TagSpecifications)t.TagSpecifications.forEach((d,E)=>{e[`TagSpecification.${E+1}.ResourceType`]=d.ResourceType,d.Tags.forEach((n,c)=>{e[`TagSpecification.${E+1}.Tag.${c+1}.Key`]=n.Key,e[`TagSpecification.${E+1}.Tag.${c+1}.Value`]=n.Value})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()});return{AllocationId:r.allocationId,PublicIp:r.publicIp,Domain:r.domain}}async associateAddress(t){let e={Action:"AssociateAddress",Version:"2016-11-15"};if(t.AllocationId)e.AllocationId=t.AllocationId;if(t.PublicIp)e.PublicIp=t.PublicIp;if(t.InstanceId)e.InstanceId=t.InstanceId;if(t.NetworkInterfaceId)e.NetworkInterfaceId=t.NetworkInterfaceId;if(t.PrivateIpAddress)e.PrivateIpAddress=t.PrivateIpAddress;if(t.AllowReassociation)e.AllowReassociation="true";return{AssociationId:(await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()})).associationId}}async createTags(t){let e={Action:"CreateTags",Version:"2016-11-15"};t.Resources.forEach((r,d)=>{e[`ResourceId.${d+1}`]=r}),t.Tags.forEach((r,d)=>{e[`Tag.${d+1}.Key`]=r.Key,e[`Tag.${d+1}.Value`]=r.Value}),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()})}async waitForInstanceState(t,e,r){let d=r?.maxWaitMs||300000,E=r?.pollIntervalMs||5000,n=Date.now();while(Date.now()-n<d){let c;try{c=await this.getInstance(t)}catch{c=void 0}if(c?.State?.Name===e)return c;await new Promise((_)=>setTimeout(_,E))}return}async createVpc(t){let e={Action:"CreateVpc",Version:"2016-11-15",CidrBlock:t.CidrBlock};if(t.InstanceTenancy)e.InstanceTenancy=t.InstanceTenancy;if(t.TagSpecifications)t.TagSpecifications.forEach((n,c)=>{e[`TagSpecification.${c+1}.ResourceType`]=n.ResourceType,n.Tags.forEach((_,i)=>{e[`TagSpecification.${c+1}.Tag.${i+1}.Key`]=_.Key,e[`TagSpecification.${c+1}.Tag.${i+1}.Value`]=_.Value})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()}),E=(r.CreateVpcResponse||r).vpc;return{Vpc:E?{VpcId:E.vpcId,CidrBlock:E.cidrBlock,State:E.state,DhcpOptionsId:E.dhcpOptionsId,InstanceTenancy:E.instanceTenancy,IsDefault:E.isDefault==="true",Tags:this.parseTags(E.tagSet?.item)}:void 0}}async createSubnet(t){let e={Action:"CreateSubnet",Version:"2016-11-15",VpcId:t.VpcId,CidrBlock:t.CidrBlock};if(t.AvailabilityZone)e.AvailabilityZone=t.AvailabilityZone;if(t.TagSpecifications)t.TagSpecifications.forEach((n,c)=>{e[`TagSpecification.${c+1}.ResourceType`]=n.ResourceType,n.Tags.forEach((_,i)=>{e[`TagSpecification.${c+1}.Tag.${i+1}.Key`]=_.Key,e[`TagSpecification.${c+1}.Tag.${i+1}.Value`]=_.Value})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()}),E=(r.CreateSubnetResponse||r).subnet;return{Subnet:E?{SubnetId:E.subnetId,VpcId:E.vpcId,CidrBlock:E.cidrBlock,AvailabilityZone:E.availabilityZone,AvailableIpAddressCount:E.availableIpAddressCount?Number.parseInt(E.availableIpAddressCount):void 0,State:E.state,MapPublicIpOnLaunch:E.mapPublicIpOnLaunch==="true",Tags:this.parseTags(E.tagSet?.item)}:void 0}}async modifySubnetAttribute(t){let e={Action:"ModifySubnetAttribute",Version:"2016-11-15",SubnetId:t.SubnetId};if(t.MapPublicIpOnLaunch!==void 0)e["MapPublicIpOnLaunch.Value"]=String(t.MapPublicIpOnLaunch.Value);await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()})}async createSecurityGroup(t){let e={Action:"CreateSecurityGroup",Version:"2016-11-15",GroupName:t.GroupName,GroupDescription:t.Description};if(t.VpcId)e.VpcId=t.VpcId;if(t.TagSpecifications)t.TagSpecifications.forEach((E,n)=>{e[`TagSpecification.${n+1}.ResourceType`]=E.ResourceType,E.Tags.forEach((c,_)=>{e[`TagSpecification.${n+1}.Tag.${_+1}.Key`]=c.Key,e[`TagSpecification.${n+1}.Tag.${_+1}.Value`]=c.Value})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()});return{GroupId:(r.CreateSecurityGroupResponse||r).groupId}}async authorizeSecurityGroupIngress(t){let e={Action:"AuthorizeSecurityGroupIngress",Version:"2016-11-15",GroupId:t.GroupId};this.encodeIpPermissions(e,t.IpPermissions),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()})}async authorizeSecurityGroupEgress(t){let e={Action:"AuthorizeSecurityGroupEgress",Version:"2016-11-15",GroupId:t.GroupId};this.encodeIpPermissions(e,t.IpPermissions),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()})}async describeRouteTables(t){let e={Action:"DescribeRouteTables",Version:"2016-11-15"};if(t?.RouteTableIds)t.RouteTableIds.forEach((E,n)=>{e[`RouteTableId.${n+1}`]=E});if(t?.Filters)t.Filters.forEach((E,n)=>{e[`Filter.${n+1}.Name`]=E.Name,E.Values.forEach((c,_)=>{e[`Filter.${n+1}.Value.${_+1}`]=c})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()}),d=r.DescribeRouteTablesResponse||r;return{RouteTables:this.parseArray(d.routeTableSet?.item).map((E)=>({RouteTableId:E.routeTableId,VpcId:E.vpcId,Routes:this.parseArray(E.routeSet?.item).map((n)=>({DestinationCidrBlock:n.destinationCidrBlock,GatewayId:n.gatewayId,NatGatewayId:n.natGatewayId,State:n.state})),Associations:this.parseArray(E.associationSet?.item).map((n)=>({RouteTableAssociationId:n.routeTableAssociationId,SubnetId:n.subnetId,Main:n.main==="true"||n.main===!0})),Tags:this.parseTags(E.tagSet?.item)}))}}async deleteVpc(t){let e={Action:"DeleteVpc",Version:"2016-11-15",VpcId:t};await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()})}async deleteSubnet(t){let e={Action:"DeleteSubnet",Version:"2016-11-15",SubnetId:t};await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()})}async deleteSecurityGroup(t){await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({Action:"DeleteSecurityGroup",Version:"2016-11-15",GroupId:t}).toString()})}async describeNetworkInterfaces(t){let e={Action:"DescribeNetworkInterfaces",Version:"2016-11-15"};if(t?.NetworkInterfaceIds)t.NetworkInterfaceIds.forEach((E,n)=>{e[`NetworkInterfaceId.${n+1}`]=E});if(t?.Filters)t.Filters.forEach((E,n)=>{e[`Filter.${n+1}.Name`]=E.Name,E.Values.forEach((c,_)=>{e[`Filter.${n+1}.Value.${_+1}`]=c})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()}),d=r.DescribeNetworkInterfacesResponse||r;return{NetworkInterfaces:this.parseArray(d.networkInterfaceSet?.item).map((E)=>({NetworkInterfaceId:E.networkInterfaceId,SubnetId:E.subnetId,VpcId:E.vpcId,Status:E.status,Attachment:E.attachment?{AttachmentId:E.attachment.attachmentId,InstanceId:E.attachment.instanceId,Status:E.attachment.status}:void 0}))}}async detachNetworkInterface(t,e){let r={Action:"DetachNetworkInterface",Version:"2016-11-15",AttachmentId:t};if(e)r.Force="true";await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(r).toString()})}async deleteNetworkInterface(t){let e={Action:"DeleteNetworkInterface",Version:"2016-11-15",NetworkInterfaceId:t};await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()})}async describeRegions(){let t={Action:"DescribeRegions",Version:"2016-11-15"},e=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()}),r=e.DescribeRegionsResponse||e;return{Regions:this.parseArray(r.regionInfo?.item).map((d)=>({RegionName:d.regionName,Endpoint:d.regionEndpoint}))}}async runInstances(t){let e={Action:"RunInstances",Version:"2016-11-15",ImageId:t.ImageId,InstanceType:t.InstanceType,MinCount:String(t.MinCount),MaxCount:String(t.MaxCount)};if(t.SecurityGroupIds)t.SecurityGroupIds.forEach((E,n)=>{e[`SecurityGroupId.${n+1}`]=E});if(t.SubnetId)e.SubnetId=t.SubnetId;if(t.UserData)e.UserData=t.UserData;if(t.IamInstanceProfile){if(t.IamInstanceProfile.Name)e["IamInstanceProfile.Name"]=t.IamInstanceProfile.Name;if(t.IamInstanceProfile.Arn)e["IamInstanceProfile.Arn"]=t.IamInstanceProfile.Arn}if(t.TagSpecifications)t.TagSpecifications.forEach((E,n)=>{e[`TagSpecification.${n+1}.ResourceType`]=E.ResourceType,E.Tags.forEach((c,_)=>{e[`TagSpecification.${n+1}.Tag.${_+1}.Key`]=c.Key,e[`TagSpecification.${n+1}.Tag.${_+1}.Value`]=c.Value})});let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()}),d=r.RunInstancesResponse||r;return{Instances:this.parseInstances(d.instancesSet?.item||d.instancesSet)}}encodeIpPermissions(t,e){e.forEach((r,d)=>{let E=`IpPermissions.${d+1}`;if(r.IpProtocol!==void 0)t[`${E}.IpProtocol`]=r.IpProtocol;if(r.FromPort!==void 0)t[`${E}.FromPort`]=String(r.FromPort);if(r.ToPort!==void 0)t[`${E}.ToPort`]=String(r.ToPort);if(r.IpRanges)r.IpRanges.forEach((n,c)=>{if(n.CidrIp)t[`${E}.IpRanges.${c+1}.CidrIp`]=n.CidrIp;if(n.Description)t[`${E}.IpRanges.${c+1}.Description`]=n.Description});if(r.Ipv6Ranges)r.Ipv6Ranges.forEach((n,c)=>{if(n.CidrIpv6)t[`${E}.Ipv6Ranges.${c+1}.CidrIpv6`]=n.CidrIpv6;if(n.Description)t[`${E}.Ipv6Ranges.${c+1}.Description`]=n.Description});if(r.UserIdGroupPairs)r.UserIdGroupPairs.forEach((n,c)=>{if(n.GroupId)t[`${E}.Groups.${c+1}.GroupId`]=n.GroupId;if(n.UserId)t[`${E}.Groups.${c+1}.UserId`]=n.UserId;if(n.Description)t[`${E}.Groups.${c+1}.Description`]=n.Description})})}parseArray(t){if(!t)return[];return Array.isArray(t)?t:[t]}parseFirstIpv6Address(t){for(let e of this.parseArray(t))for(let r of this.parseArray(e?.ipv6AddressesSet?.item))if(r?.ipv6Address)return r.ipv6Address;return}parseTags(t){return this.parseArray(t).map((e)=>({Key:e.key,Value:e.value}))}parseReservations(t){return this.parseArray(t).map((e)=>({ReservationId:e.reservationId,Instances:this.parseInstances(e.instancesSet?.item||e.instancesSet)}))}parseInstances(t){return this.parseArray(t).map((e)=>({InstanceId:e.instanceId,ImageId:e.imageId,InstanceType:e.instanceType,State:e.instanceState?{Code:Number.parseInt(e.instanceState.code),Name:e.instanceState.name}:void 0,PrivateIpAddress:e.privateIpAddress,PublicIpAddress:e.ipAddress,Ipv6Address:this.parseFirstIpv6Address(e.networkInterfaceSet?.item),SubnetId:e.subnetId,VpcId:e.vpcId,SecurityGroups:this.parseArray(e.groupSet?.item).map((r)=>({GroupId:r.groupId,GroupName:r.groupName})),Tags:this.parseTags(e.tagSet?.item),LaunchTime:e.launchTime,Placement:e.placement?{AvailabilityZone:e.placement.availabilityZone,Tenancy:e.placement.tenancy}:void 0,Architecture:e.architecture,RootDeviceType:e.rootDeviceType,RootDeviceName:e.rootDeviceName,BlockDeviceMappings:this.parseArray(e.blockDeviceMapping?.item).map((r)=>({DeviceName:r.deviceName,Ebs:r.ebs?{VolumeId:r.ebs.volumeId,Status:r.ebs.status,AttachTime:r.ebs.attachTime,DeleteOnTermination:r.ebs.deleteOnTermination==="true"}:void 0})),IamInstanceProfile:e.iamInstanceProfile?{Arn:e.iamInstanceProfile.arn,Id:e.iamInstanceProfile.id}:void 0}))}parseIpPermissions(t){return this.parseArray(t).map((e)=>({IpProtocol:e.ipProtocol,FromPort:e.fromPort?Number.parseInt(e.fromPort):void 0,ToPort:e.toPort?Number.parseInt(e.toPort):void 0,IpRanges:this.parseArray(e.ipRanges?.item).map((r)=>({CidrIp:r.cidrIp,Description:r.description})),Ipv6Ranges:this.parseArray(e.ipv6Ranges?.item).map((r)=>({CidrIpv6:r.cidrIpv6,Description:r.description})),UserIdGroupPairs:this.parseArray(e.groups?.item).map((r)=>({GroupId:r.groupId,UserId:r.userId,Description:r.description}))}))}}er();At();class rh{client;constructor(t,e){this.client=e??new dt(void 0,{profile:t})}collectionItems(t,e){let r=t?.Items??t?.[e];if(!r)return[];if(Array.isArray(r))return r;let d=r[e]??r.Item;if(d===void 0)return typeof r==="object"&&(r.Id||r.PathPattern)?[r]:[];return Array.isArray(d)?d:[d]}validateExistingOriginInput(t,e){if(!/^[A-Z0-9]{8,32}$/.test(t))throw Error("CloudFront distribution ID is invalid");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(e.id))throw Error("CloudFront origin ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(e.domainName))throw Error("CloudFront origin must be a hostname without a scheme or path");let r=e.pathPattern.startsWith("/")?e.pathPattern:`/${e.pathPattern}`;if(r==="/"||r==="/*"||!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]{1,255}$/.test(r))throw Error("CloudFront path pattern must be a non-default absolute pattern");if(e.originPath&&(!e.originPath.startsWith("/")||e.originPath.includes("..")))throw Error("CloudFront origin path must be absolute and traversal-free");if(Object.entries(e.customHeaders??{}).some(([d,E])=>!/^[A-Za-z0-9-]{1,64}$/.test(d)||!E||E.length>1024))throw Error("CloudFront custom origin headers are invalid");return{...e,pathPattern:r}}async upsertExistingDistributionOrigin(t,e){let r=this.validateExistingOriginInput(t,e),d=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${t}/config`,returnHeaders:!0}),E=d.headers?.etag||d.headers?.ETag||d.ETag||"",n=d.body?.DistributionConfig||d.DistributionConfig||d.body;if(!n||n.Enabled===void 0||!E)throw Error("Failed to read an ETag-protected CloudFront distribution config");let c=this.collectionItems(n.Origins,"Origin"),_=this.collectionItems(n.CacheBehaviors,"CacheBehavior"),i=c.find((l)=>String(l.Id)===r.id),T=_.find((l)=>String(l.PathPattern)===r.pathPattern);if(i&&String(i.DomainName)!==r.domainName&&!r.replaceExisting)throw Error(`Origin ${r.id} already targets ${i.DomainName}; pass replaceExisting only after reviewing the live config`);if(T&&String(T.TargetOriginId)!==r.id&&!r.replaceExisting)throw Error(`Path ${r.pathPattern} already targets ${T.TargetOriginId}; pass replaceExisting only after reviewing the live config`);let h={Id:r.id,DomainName:r.domainName,OriginPath:r.originPath??"",CustomHeaders:{Quantity:Object.keys(r.customHeaders??{}).length,...Object.keys(r.customHeaders??{}).length?{Items:{OriginCustomHeader:Object.entries(r.customHeaders).map(([l,P])=>({HeaderName:l,HeaderValue:P}))}}:{}},CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:r.protocolPolicy??"https-only",OriginSslProtocols:{Quantity:1,Items:{SslProtocol:["TLSv1.2"]}},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,...r.originAccessControlId?{OriginAccessControlId:r.originAccessControlId}:{}},R=["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],N={PathPattern:r.pathPattern,TargetOriginId:r.id,ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",AllowedMethods:{Quantity:R.length,Items:{Method:R},CachedMethods:{Quantity:2,Items:{Method:["GET","HEAD"]}}},SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0}},A=i?c.map((l)=>String(l.Id)===r.id?h:l):[...c,h],u=T?_.map((l)=>String(l.PathPattern)===r.pathPattern?N:l):[..._,N],U=JSON.stringify(c)!==JSON.stringify(A)||JSON.stringify(_)!==JSON.stringify(u);if(!U||r.dryRun)return{distributionId:t,originId:r.id,domainName:r.domainName,pathPattern:r.pathPattern,changed:U,applied:!1,etag:E};n.Origins={Quantity:A.length,Items:{Origin:A}},n.CacheBehaviors={Quantity:u.length,...u.length?{Items:{CacheBehavior:u}}:{}};let w=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${t}/config`,body:this.buildDistributionConfigXml(n),headers:{"Content-Type":"application/xml","If-Match":E}});return{distributionId:t,originId:r.id,domainName:r.domainName,pathPattern:r.pathPattern,changed:!0,applied:!0,etag:w.ETag||w.headers?.etag||""}}async removeExistingDistributionOrigin(t,e){let r=this.validateExistingOriginInput(t,e),d=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${t}/config`,returnHeaders:!0}),E=d.headers?.etag||d.headers?.ETag||d.ETag||"",n=d.body?.DistributionConfig||d.DistributionConfig||d.body;if(!n||n.Enabled===void 0||!E)throw Error("Failed to read an ETag-protected CloudFront distribution config");let c=this.collectionItems(n.Origins,"Origin"),_=this.collectionItems(n.CacheBehaviors,"CacheBehavior"),i=c.find((u)=>String(u.Id)===r.id),T=_.find((u)=>String(u.PathPattern)===r.pathPattern);if(i&&String(i.DomainName)!==r.domainName)throw Error(`Origin ${r.id} no longer targets ${r.domainName}; refusing ambiguous removal`);if(T&&String(T.TargetOriginId)!==r.id)throw Error(`Path ${r.pathPattern} no longer targets ${r.id}; refusing ambiguous removal`);if(!T)return{distributionId:t,originId:r.id,domainName:r.domainName,pathPattern:r.pathPattern,changed:!1,applied:!1,originRemoved:!1,etag:E};let h=_.filter((u)=>String(u.PathPattern)!==r.pathPattern),R=String(n.DefaultCacheBehavior?.TargetOriginId)===r.id||h.some((u)=>String(u.TargetOriginId)===r.id),N=R?c:c.filter((u)=>String(u.Id)!==r.id);if(r.dryRun)return{distributionId:t,originId:r.id,domainName:r.domainName,pathPattern:r.pathPattern,changed:!0,applied:!1,originRemoved:!R&&!!i,etag:E};n.Origins={Quantity:N.length,Items:{Origin:N}},n.CacheBehaviors={Quantity:h.length,...h.length?{Items:{CacheBehavior:h}}:{}};let A=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${t}/config`,body:this.buildDistributionConfigXml(n),headers:{"Content-Type":"application/xml","If-Match":E}});return{distributionId:t,originId:r.id,domainName:r.domainName,pathPattern:r.pathPattern,changed:!0,applied:!0,originRemoved:!R&&!!i,etag:A.ETag||A.headers?.etag||""}}async createInvalidation(t){let e=t.callerReference||Date.now().toString(),r=`<?xml version="1.0" encoding="UTF-8"?>
 <InvalidationBatch>
@@ -5760,9 +5760,9 @@ ${Object.entries(t).filter(([n])=>!n.startsWith("@_")).map(([n,c])=>E(n,c,"  ","
       </CustomErrorResponse>
     </Items>
   </CustomErrorResponses>`}
-</DistributionConfig>`,a=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/distribution",body:P,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),j=a.body?.Distribution||a.Distribution||a.body||a;return{Id:j.Id,ARN:j.ARN,DomainName:j.DomainName,Status:j.Status,ETag:a.headers?.etag||a.ETag||""}}async createMediaDistributionForS3(t){return this.createDistributionForS3({...t,defaultRootObject:"",mediaDelivery:!0,comment:t.comment??`Media distribution for ${t.bucketName}`})}async listPublicKeys(){let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/public-key"});return this.collectionItems(t.PublicKeyList??t,"PublicKeySummary").map((r)=>({Id:String(r.Id),Name:String(r.Name),Comment:r.Comment?String(r.Comment):void 0}))}async createPublicKey(t){if(!/^[A-Za-z0-9_-]{1,128}$/.test(t.name))throw TypeError("CloudFront public key name is invalid");if(!t.encodedKey.includes("BEGIN PUBLIC KEY"))throw TypeError("CloudFront public key must be PEM encoded");let e=(E)=>E.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/public-key",headers:{"Content-Type":"application/xml"},body:`<PublicKeyConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><CallerReference>${e(t.callerReference??`${Date.now()}-${t.name}`)}</CallerReference><Name>${e(t.name)}</Name><EncodedKey>${e(t.encodedKey)}</EncodedKey><Comment>${e(t.comment??"")}</Comment></PublicKeyConfig>`}),d=r.PublicKey??r;return{Id:String(d.Id),Name:String(d.PublicKeyConfig?.Name??t.name),EncodedKey:String(d.PublicKeyConfig?.EncodedKey??t.encodedKey),Comment:String(d.PublicKeyConfig?.Comment??t.comment??"")}}async listKeyGroups(){let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/key-group"});return this.collectionItems(t.KeyGroupList??t,"KeyGroupSummary").map((r)=>({Id:String(r.KeyGroup?.Id??r.Id),Name:String(r.KeyGroup?.KeyGroupConfig?.Name??r.KeyGroupConfig?.Name??r.Name),Items:this.collectionItems(r.KeyGroup?.KeyGroupConfig?.Items??r.KeyGroupConfig?.Items??r.Items,"Item").map(String),Comment:r.KeyGroup?.KeyGroupConfig?.Comment??r.KeyGroupConfig?.Comment??r.Comment}))}async createKeyGroup(t){if(!/^[A-Za-z0-9_-]{1,128}$/.test(t.name))throw TypeError("CloudFront key group name is invalid");let e=[...new Set(t.publicKeyIds)];if(e.length===0)throw TypeError("CloudFront key group requires at least one public key");let r=(c)=>c.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),d=e.map((c)=>`<Item>${r(c)}</Item>`).join(""),E=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/key-group",headers:{"Content-Type":"application/xml"},body:`<KeyGroupConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><Name>${r(t.name)}</Name><Items>${d}</Items><Comment>${r(t.comment??"")}</Comment></KeyGroupConfig>`}),n=E.KeyGroup??E;return{Id:String(n.Id),Name:String(n.KeyGroupConfig?.Name??t.name),Items:e,Comment:String(n.KeyGroupConfig?.Comment??t.comment??"")}}static getS3BucketPolicyForCloudFront(t,e){return{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:`arn:aws:s3:::${t}/*`,Condition:{StringEquals:{"AWS:SourceArn":e}}}]}}async waitForDistributionDeployed(t,e=60){for(let r=0;r<e;r++){if((await this.getDistribution(t)).Status==="Deployed")return!0;await new Promise((E)=>setTimeout(E,30000))}return!1}async disableDistribution(t){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${t}/config`,returnHeaders:!0}),r=e.headers?.etag||e.headers?.ETag||"",d=e.body?.DistributionConfig||(e.body?.Enabled!==void 0?e.body:void 0)||e.DistributionConfig;if(!d||d.Enabled===void 0)throw Error("Failed to get current distribution config");d.Enabled=!1;let E=this.buildDistributionConfigXml(d),n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${t}/config`,body:E,headers:{"Content-Type":"application/xml","If-Match":r},returnHeaders:!0});return{ETag:n.headers?.etag||n.headers?.ETag||n.ETag||""}}async deleteDistribution(t,e){let r=e||"";if(!r){let d=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${t}`,returnHeaders:!0});r=d.headers?.etag||d.headers?.ETag||""}await this.client.request({service:"cloudfront",region:"us-east-1",method:"DELETE",path:`/2020-05-31/distribution/${t}`,headers:{"If-Match":r}})}async waitForDistributionDisabled(t,e=60){for(let r=0;r<e;r++){let d=await this.getDistribution(t);if(d.Status==="Deployed"&&!d.Enabled)return!0;await new Promise((E)=>setTimeout(E,30000))}return!1}async removeAlias(t,e){let r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${t}/config`,returnHeaders:!0}),d=r.headers?.etag||r.headers?.ETag||"",E=r.body?.DistributionConfig||(r.body?.Enabled!==void 0?r.body:void 0)||r.DistributionConfig;if(!E||E.Enabled===void 0)throw Error("Failed to get current distribution config");let n=[];if(E.Aliases?.Items){if(Array.isArray(E.Aliases.Items))n=E.Aliases.Items;else if(typeof E.Aliases.Items==="object"){let T=E.Aliases.Items.CNAME;if(typeof T==="string")n=[T];else if(Array.isArray(T))n=T}}if(n.length===0)throw Error("Distribution has no aliases to remove");let c=n.filter((T)=>T!==e);if(c.length===n.length)throw Error(`Alias ${e} not found in distribution`);if(E.Aliases.Quantity=c.length,E.Aliases.Items=c.length>0?c:void 0,c.length===0)E.ViewerCertificate={CloudFrontDefaultCertificate:!0,MinimumProtocolVersion:"TLSv1.2_2021"};let _=this.buildDistributionConfigXml(E),i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${t}/config`,body:_,headers:{"Content-Type":"application/xml","If-Match":d},returnHeaders:!0});return{ETag:i.headers?.etag||i.headers?.ETag||i.ETag||""}}}i_();At();At();i_();function KD(t,e=""){return t===408||t===409||t===425||t===429||t>=500||/rate limit|temporar|timed? ?out|try again/i.test(e)}async function MA(t,e){let r=e?.headers.get("retry-after"),d=r===null||r===void 0?void 0:Number(r)*1000,E=Number.isFinite(d)?Math.max(0,d):Math.min(1000*2**(t-1),30000);await new Promise((n)=>setTimeout(n,E))}class dc{name="porkbun";apiKey;secretKey;requestTimeoutMs;constructor(t,e,r=15000){this.apiKey=t,this.secretKey=e,this.requestTimeoutMs=r}async request(t,e={}){let r;for(let d=1;d<=8;d+=1){let E,n=new AbortController,c=setTimeout(()=>{n.abort(Error(`Porkbun API request timed out after ${this.requestTimeoutMs}ms`))},this.requestTimeoutMs);try{E=await fetch(`https://api.porkbun.com/api/json/v3${t}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({apikey:this.apiKey,secretapikey:this.secretKey,...e}),signal:n.signal})}catch(i){if(r=i,d===8)throw i;await MA(d);continue}finally{clearTimeout(c)}if(!E.ok){if(r=Error(`Porkbun API error: ${E.status} ${E.statusText}`),!KD(E.status)||d===8)throw r;await MA(d,E);continue}let _=await E.json();if(_.status==="ERROR"){if(r=Error(`Porkbun API error: ${_.message||"Unknown error"}`),!KD(0,_.message)||d===8)throw r;await MA(d,E);continue}return _}throw r}getSubdomain(t,e){let r=t.replace(/\.$/,""),d=e.replace(/\.$/,"");if(r===d)return"";if(r.endsWith(`.${d}`))return r.slice(0,-(d.length+1));return r}getRootDomain(t){let e=t.replace(/\.$/,"").split(".");if(e.length>=2)return e.slice(-2).join(".");return t}static ADDRESS_TYPES=new Set(["A","AAAA"]);async clearConflictingAliases(t,e){if(!dc.ADDRESS_TYPES.has(e.type))return[];let r=this.getRootDomain(t),d=this.getSubdomain(e.name,r),E=await this.listRecords(t);if(!E.success)return[`could not list records to clear ALIAS/CNAME conflicts: ${E.message??"unknown provider error"}`];let n=[];for(let c of E.records){if(c.type!=="ALIAS"&&c.type!=="CNAME")continue;if(this.getSubdomain(c.name,r)!==d)continue;let _=await this.deleteRecord(t,c);if(!_.success)n.push(`could not remove conflicting ${c.type} on ${c.name}: ${_.message??"unknown provider error"}`)}return n}async addressRecordExists(t,e){let r=this.getRootDomain(t),d=this.getSubdomain(e.name,r),E=await this.listRecords(t);if(!E.success)return!0;return E.records.some((n)=>n.type===e.type&&this.getSubdomain(n.name,r)===d&&n.content===e.content)}async createRecord(t,e){try{let r=this.getRootDomain(t),d=this.getSubdomain(e.name,r),E={type:e.type,content:e.content,ttl:String(e.ttl||600)};if(d)E.name=d;if((e.type==="MX"||e.type==="SRV")&&e.priority!==void 0)E.prio=String(e.priority);if(e.type==="SRV"&&e.weight!==void 0&&e.port!==void 0)E.content=`${e.weight} ${e.port} ${e.content}`;let n=await this.clearConflictingAliases(t,e),c=await this.request(`/dns/create/${r}`,E);if(dc.ADDRESS_TYPES.has(e.type)&&!await this.addressRecordExists(t,e))return{success:!1,message:`Porkbun reported success but no ${e.type} record for ${e.name} exists${n.length>0?` (${n.join("; ")})`:""}. A conflicting ALIAS/CNAME on the same name silently voids the write.`};return{success:!0,id:c.id?.toString(),message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(t,e){try{let r=this.getRootDomain(t),d=this.getSubdomain(e.name,r),E=await this.listRecords(t,e.type);if(E.success){let n=E.records.find((c)=>{return this.getSubdomain(c.name,r)===d&&c.type===e.type});if(n?.id){let c={type:e.type,content:e.content,ttl:String(e.ttl||600)};if(d)c.name=d;if((e.type==="MX"||e.type==="SRV")&&e.priority!==void 0)c.prio=String(e.priority);if(e.type==="SRV"&&e.weight!==void 0&&e.port!==void 0)c.content=`${e.weight} ${e.port} ${e.content}`;return await this.request(`/dns/edit/${r}/${n.id}`,c),{success:!0,id:n.id,message:"Record updated successfully"}}}return this.createRecord(t,e)}catch(r){return this.createRecord(t,e)}}async deleteRecord(t,e){try{let r=this.getRootDomain(t);if("id"in e&&e.id)return await this.request(`/dns/delete/${r}/${e.id}`),{success:!0,message:"Record deleted successfully"};let d=this.getSubdomain(e.name,r),E=await this.listRecords(t);if(!E.success)return{success:!1,message:"Failed to list records"};let n=E.records.find((c)=>{return this.getSubdomain(c.name,r)===d&&c.type===e.type&&c.content===e.content});if(!n?.id)return{success:!1,message:"Record not found"};return await this.request(`/dns/delete/${r}/${n.id}`),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(t,e){try{let r=this.getRootDomain(t),d=`/dns/retrieve/${r}`;if(e)d=`/dns/retrieveByNameType/${r}/${e}`;return{success:!0,records:((await this.request(d)).records||[]).map((c)=>({id:c.id,name:c.name||r,type:c.type,content:c.content,ttl:Number.parseInt(c.ttl,10),priority:c.prio?Number.parseInt(c.prio,10):void 0}))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(t){try{let e=this.getRootDomain(t);return await this.request(`/dns/retrieve/${e}`),!0}catch{return!1}}async listDomains(){try{return((await this.request("/domain/listAll")).domains||[]).map((e)=>e.domain)}catch{return[]}}async getNameServers(t){try{let e=this.getRootDomain(t);return(await this.request(`/dns/getNS/${e}`)).ns||[]}catch{return[]}}async updateNameServers(t,e){try{let r=this.getRootDomain(t);return await this.request(`/dns/updateNS/${r}`,{ns:e}),!0}catch{return!1}}}class dh{name="godaddy";apiKey;apiSecret;baseUrl;constructor(t,e,r="production"){this.apiKey=t,this.apiSecret=e,this.baseUrl=r==="ote"?"https://api.ote-godaddy.com":"https://api.godaddy.com"}async request(t,e,r){let d=`${this.baseUrl}${e}`,E={Authorization:`sso-key ${this.apiKey}:${this.apiSecret}`,"Content-Type":"application/json",Accept:"application/json"},n={method:t,headers:E};if(r)n.body=JSON.stringify(r);let c=await fetch(d,n);if(c.status===204)return{};if(c.ok){let i=await c.text();if(i)return JSON.parse(i);return{}}let _=`GoDaddy API error: ${c.status} ${c.statusText}`;try{let i=await c.json();if(i.message)_=`GoDaddy API error: ${i.message}`;if(i.fields)_+=` - Fields: ${JSON.stringify(i.fields)}`}catch{}throw Error(_)}getSubdomain(t,e){let r=t.replace(/\.$/,""),d=e.replace(/\.$/,"");if(r===d)return"@";if(r.endsWith(`.${d}`))return r.slice(0,-(d.length+1));return r}getRootDomain(t){let e=t.replace(/\.$/,"").split(".");if(e.length>=2)return e.slice(-2).join(".");return t}toGoDaddyRecord(t,e){let r=this.getRootDomain(e),d=this.getSubdomain(t.name,r),E={type:t.type,name:d,data:t.content,ttl:t.ttl||600};if(t.type==="MX"&&t.priority!==void 0)E.priority=t.priority;return E}fromGoDaddyRecord(t,e){let r=this.getRootDomain(e),d=t.name;if(d==="@")d=r;else if(!d.endsWith(r))d=`${d}.${r}`;return{name:d,type:t.type,content:t.data,ttl:t.ttl,priority:t.priority}}async createRecord(t,e){try{let r=this.getRootDomain(t),d=this.toGoDaddyRecord(e,t);return await this.request("PATCH",`/v1/domains/${r}/records`,[d]),{success:!0,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(t,e){try{let r=this.getRootDomain(t),d=this.toGoDaddyRecord(e,t);return await this.request("PUT",`/v1/domains/${r}/records/${e.type}/${d.name}`,[d]),{success:!0,message:"Record upserted successfully"}}catch(r){return this.createRecord(t,e)}}async deleteRecord(t,e){try{let r=this.getRootDomain(t),d=this.getSubdomain(e.name,r),E=await this.request("GET",`/v1/domains/${r}/records/${e.type}/${d}`),n=E.filter((c)=>c.data!==e.content);if(n.length===E.length)return{success:!1,message:"Record not found"};if(n.length===0)try{await this.request("DELETE",`/v1/domains/${r}/records/${e.type}/${d}`)}catch{}else await this.request("PUT",`/v1/domains/${r}/records/${e.type}/${d}`,n);return{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(t,e){try{let r=this.getRootDomain(t),d=`/v1/domains/${r}/records`;if(e)d=`/v1/domains/${r}/records/${e}`;return{success:!0,records:(await this.request("GET",d)).map((n)=>this.fromGoDaddyRecord(n,t))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(t){try{let e=this.getRootDomain(t);return await this.request("GET",`/v1/domains/${e}`),!0}catch{return!1}}async listDomains(){try{return(await this.request("GET","/v1/domains")).map((e)=>e.domain)}catch{return[]}}async getDomainDetails(t){try{let e=this.getRootDomain(t),r=await this.request("GET",`/v1/domains/${e}`);return{domain:r.domain,status:r.status,nameServers:r.nameServers,expires:r.expires}}catch{return null}}async updateNameServers(t,e){try{let r=this.getRootDomain(t);return await this.request("PUT",`/v1/domains/${r}/records/NS`,e.map((d)=>({type:"NS",name:"@",data:d,ttl:3600}))),!0}catch{return!1}}async checkDomainAvailability(t){try{let e=await this.request("GET",`/v1/domains/available?domain=${encodeURIComponent(t)}`);return{available:e.available,price:e.price,currency:e.currency}}catch{return{available:!1}}}}class Eh{name="cloudflare";apiToken;zoneCache=new Map;constructor(t){this.apiToken=t}async request(t,e,r){let d=`https://api.cloudflare.com/client/v4${e}`,E={Authorization:`Bearer ${this.apiToken}`,"Content-Type":"application/json"},n={method:t,headers:E};if(r)n.body=JSON.stringify(r);let _=await(await fetch(d,n)).json();if(!_.success){let i=_.errors.map((T)=>T.message).join(", ");throw Error(`Cloudflare API error: ${i}`)}return _}getRootDomain(t){let e=t.replace(/\.$/,"").split(".");if(e.length>=2)return e.slice(-2).join(".");return t}async getZoneId(t){let e=this.getRootDomain(t),r=this.zoneCache.get(e);if(r)return r;let d=await this.request("GET",`/zones?name=${encodeURIComponent(e)}`);if(!d.result||d.result.length===0)throw Error(`Zone not found for domain: ${e}`);let E=d.result[0].id;return this.zoneCache.set(e,E),E}getFullRecordName(t,e){let r=this.getRootDomain(e),d=t.replace(/\.$/,"");if(!d||d===r||d==="@")return r;if(d.endsWith(`.${r}`))return d;return`${d}.${r}`}toCloudflareRecord(t,e){let r={type:t.type,name:this.getFullRecordName(t.name,e),content:t.content||t.value||"",ttl:t.ttl||1};if(t.type==="MX"&&t.priority!==void 0)r.priority=t.priority;if(t.type==="SRV"){if(t.priority!==void 0)r.priority=t.priority}return r}fromCloudflareRecord(t){return{id:t.id,name:t.name,type:t.type,content:t.content,ttl:t.ttl,priority:t.priority}}async createRecord(t,e){try{let r=await this.getZoneId(t),d=this.toCloudflareRecord(e,t);return{success:!0,id:(await this.request("POST",`/zones/${r}/dns_records`,d)).result.id,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(t,e){try{let r=await this.getZoneId(t),d=this.getFullRecordName(e.name,t),E=await this.request("GET",`/zones/${r}/dns_records?type=${e.type}&name=${encodeURIComponent(d)}`),n=this.toCloudflareRecord(e,t);if(E.result&&E.result.length>0){let _=E.result[0].id;return{success:!0,id:(await this.request("PUT",`/zones/${r}/dns_records/${_}`,n)).result.id,message:"Record updated successfully"}}return{success:!0,id:(await this.request("POST",`/zones/${r}/dns_records`,n)).result.id,message:"Record created successfully"}}catch(r){return this.createRecord(t,e)}}async deleteRecord(t,e){try{let r=await this.getZoneId(t),d=this.getFullRecordName(e.name,t),E=await this.request("GET",`/zones/${r}/dns_records?type=${e.type}&name=${encodeURIComponent(d)}`);if(!E.result||E.result.length===0)return{success:!1,message:"Record not found"};let n=E.result.find((c)=>c.content===e.content);if(!n)return{success:!1,message:"Record with matching content not found"};return await this.request("DELETE",`/zones/${r}/dns_records/${n.id}`),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(t,e){try{let d=`/zones/${await this.getZoneId(t)}/dns_records?per_page=100`;if(e)d+=`&type=${e}`;let E=[],n=1,c=!0;while(c){let _=await this.request("GET",`${d}&page=${n}`);if(E.push(..._.result||[]),_.result_info)c=n<_.result_info.total_pages,n++;else c=!1}return{success:!0,records:E.map((_)=>this.fromCloudflareRecord(_))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(t){try{return await this.getZoneId(t),!0}catch{return!1}}async listDomains(){try{let t=[],e=1,r=!0;while(r){let d=await this.request("GET",`/zones?per_page=50&page=${e}`);if(t.push(...d.result||[]),d.result_info)r=e<d.result_info.total_pages,e++;else r=!1}return t.map((d)=>d.name)}catch{return[]}}async getZoneDetails(t){try{let e=await this.getZoneId(t),r=await this.request("GET",`/zones/${e}`);return{id:r.result.id,name:r.result.name,status:r.result.status,nameServers:r.result.name_servers,paused:r.result.paused}}catch{return null}}async purgeCache(t,e){try{let r=await this.getZoneId(t),d={};if(e?.purgeEverything)d.purge_everything=!0;else{if(e?.files)d.files=e.files;if(e?.tags)d.tags=e.tags;if(e?.hosts)d.hosts=e.hosts}if(Object.keys(d).length===0)d.purge_everything=!0;return await this.request("POST",`/zones/${r}/purge_cache`,d),!0}catch{return!1}}async getRecordProxyStatus(t,e){try{let r=await this.getZoneId(t),d=this.getFullRecordName(e.name,t),E=await this.request("GET",`/zones/${r}/dns_records?type=${e.type}&name=${encodeURIComponent(d)}`);if(E.result&&E.result.length>0)return E.result.find((c)=>c.content===e.content)?.proxied??null;return null}catch{return null}}async setRecordProxyStatus(t,e,r){try{let d=await this.getZoneId(t),E=this.getFullRecordName(e.name,t),n=await this.request("GET",`/zones/${d}/dns_records?type=${e.type}&name=${encodeURIComponent(E)}`);if(!n.result||n.result.length===0)return!1;let c=n.result.find((_)=>_.content===e.content);if(!c)return!1;return await this.request("PATCH",`/zones/${d}/dns_records/${c.id}`,{proxied:r}),!0}catch{return!1}}}i_();class nh{name="route53";client;hostedZoneCache=new Map;providedHostedZoneId;constructor(t="us-east-1",e){this.client=new Kd(t),this.providedHostedZoneId=e}getRootDomain(t){let e=t.replace(/\.$/,"").split(".");if(e.length>=2)return e.slice(-2).join(".");return t}async getHostedZoneId(t){if(this.providedHostedZoneId)return this.providedHostedZoneId;let e=this.getRootDomain(t),r=this.hostedZoneCache.get(e);if(r)return r;let d=await this.client.findHostedZoneForDomain(t);if(d){let E=d.Id.replace("/hostedzone/","");return this.hostedZoneCache.set(e,E),E}return null}normalizeName(t,e){let r=t.replace(/\.$/,""),d=e.replace(/\.$/,"");if(!d||d==="@")return`${r}.`;if(d===r||d.endsWith(`.${r}`))return`${d}.`;return`${d}.${r}.`}async createRecord(t,e){try{let r=await this.getHostedZoneId(t);if(!r)return{success:!1,message:`No hosted zone found for domain: ${t}`};let d=this.normalizeName(t,e.name),E=e.content;if(e.type==="TXT"&&!E.startsWith('"'))E=`"${E}"`;if(e.type==="MX"&&e.priority!==void 0)E=`${e.priority} ${E}`;return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Created by ts-cloud DNS provider",Changes:[{Action:"CREATE",ResourceRecordSet:{Name:d,Type:e.type,TTL:e.ttl||300,ResourceRecords:[{Value:E}]}}]}})).ChangeInfo?.Id,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(t,e){try{let r=await this.getHostedZoneId(t);if(!r)return{success:!1,message:`No hosted zone found for domain: ${t}`};let d=this.normalizeName(t,e.name),E=e.content;if(e.type==="TXT"&&!E.startsWith('"'))E=`"${E}"`;if(e.type==="MX"&&e.priority!==void 0)E=`${e.priority} ${E}`;return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Upserted by ts-cloud DNS provider",Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:d,Type:e.type,TTL:e.ttl||300,ResourceRecords:[{Value:E}]}}]}})).ChangeInfo?.Id,message:"Record upserted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async deleteRecord(t,e){try{let r=await this.getHostedZoneId(t);if(!r)return{success:!1,message:`No hosted zone found for domain: ${t}`};let d=this.normalizeName(t,e.name),E=e.content;if(e.type==="TXT"&&!E.startsWith('"'))E=`"${E}"`;if(e.type==="MX"&&e.priority!==void 0)E=`${e.priority} ${E}`;return await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Deleted by ts-cloud DNS provider",Changes:[{Action:"DELETE",ResourceRecordSet:{Name:d,Type:e.type,TTL:e.ttl||300,ResourceRecords:[{Value:E}]}}]}}),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(t,e){try{let r=await this.getHostedZoneId(t);if(!r)return{success:!1,records:[],message:`No hosted zone found for domain: ${t}`};let d=await this.client.listResourceRecordSets({HostedZoneId:r,StartRecordType:e}),E=[];for(let n of d.ResourceRecordSets){if(e&&n.Type!==e)continue;if(n.AliasTarget)continue;for(let c of n.ResourceRecords||[]){let _=c.Value,i;if(n.Type==="MX"){let T=_.split(" ");if(T.length>=2)i=Number.parseInt(T[0],10),_=T.slice(1).join(" ")}if(n.Type==="TXT"&&_.startsWith('"')&&_.endsWith('"'))_=_.slice(1,-1);E.push({name:n.Name.replace(/\.$/,""),type:n.Type,content:_,ttl:n.TTL,priority:i})}}return{success:!0,records:E}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(t){return await this.getHostedZoneId(t)!==null}async listDomains(){try{return(await this.client.listHostedZones()).HostedZones.map((e)=>e.Name.replace(/\.$/,""))}catch{return[]}}getRoute53Client(){return this.client}async createAliasRecord(t){try{let e=await this.getHostedZoneId(t.domain);if(!e)return{success:!1,message:`No hosted zone found for domain: ${t.domain}`};return{success:!0,id:(await this.client.createAliasRecord({HostedZoneId:e,Name:this.normalizeName(t.domain,t.name),TargetHostedZoneId:t.targetHostedZoneId,TargetDNSName:t.targetDnsName,EvaluateTargetHealth:t.evaluateTargetHealth,Type:t.type})).ChangeInfo?.Id,message:"Alias record created successfully"}}catch(e){return{success:!1,message:e instanceof Error?e.message:"Unknown error"}}}async createCloudFrontAlias(t){return this.createAliasRecord({domain:t.domain,name:t.name,targetHostedZoneId:Kd.CloudFrontHostedZoneId,targetDnsName:t.cloudFrontDomainName,evaluateTargetHealth:!1})}async createAlbAlias(t){let e=Kd.ALBHostedZoneIds[t.region];if(!e)return{success:!1,message:`Unknown region for ALB: ${t.region}`};return this.createAliasRecord({domain:t.domain,name:t.name,targetHostedZoneId:e,targetDnsName:t.albDnsName,evaluateTargetHealth:!0})}}function $_(t){switch(t.provider){case"route53":return new nh(t.region,t.hostedZoneId);case"porkbun":return new dc(t.apiKey,t.secretKey);case"godaddy":return new dh(t.apiKey,t.apiSecret,t.environment);case"cloudflare":return new Eh(t.apiToken);default:throw Error(`Unknown DNS provider: ${t.provider}`)}}class ZD{providers=new Map;configs=[];addConfig(t){return this.configs.push(t),this}addRoute53(t,e){return this.configs.push({provider:"route53",region:t,hostedZoneId:e}),this}addPorkbun(t,e){return this.configs.push({provider:"porkbun",apiKey:t,secretKey:e}),this}addGoDaddy(t,e,r){return this.configs.push({provider:"godaddy",apiKey:t,apiSecret:e,environment:r}),this}addCloudflare(t){return this.configs.push({provider:"cloudflare",apiToken:t}),this}loadFromEnv(){if(process.env.AWS_ACCESS_KEY_ID||process.env.AWS_REGION)this.addRoute53(process.env.AWS_REGION);let t=process.env.PORKBUN_API_KEY,e=process.env.PORKBUN_SECRET_KEY;if(t&&e)this.addPorkbun(t,e);let r=process.env.GODADDY_API_KEY,d=process.env.GODADDY_API_SECRET;if(r&&d){let n=process.env.GODADDY_ENVIRONMENT;this.addGoDaddy(r,d,n)}let E=process.env.CLOUDFLARE_API_TOKEN;if(E)this.addCloudflare(E);return this}getProvider(t){let e=this.providers.get(t);if(e)return e;let r=this.configs.find((E)=>E.provider===t);if(!r)return null;let d=$_(r);return this.providers.set(t,d),d}async getProviderForDomain(t){for(let e of this.configs){let r=$_(e);if(await r.canManageDomain(t))return r}return null}getAllProviders(){return this.configs.map((t)=>$_(t))}}var L4=new ZD;kD();At();class y_{client;region;constructor(t="us-east-1",e){this.region=t,this.client=new dt(void 0,{profile:e})}async describeServices(t){let e={cluster:t.cluster,services:t.services};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async listServices(t,e={}){let r={cluster:t,...e};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async listTasks(t,e,r={}){let d={cluster:t,...r};if(e)d.serviceName=e;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(d)})}async describeTasks(t,e){let r={cluster:t,tasks:e};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async updateService(t){let e={cluster:t.cluster,service:t.service};if(t.forceNewDeployment!==void 0)e.forceNewDeployment=t.forceNewDeployment;if(t.desiredCount!==void 0)e.desiredCount=t.desiredCount;if(t.taskDefinition)e.taskDefinition=t.taskDefinition;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.UpdateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async createService(t){let e={cluster:t.cluster,serviceName:t.serviceName,taskDefinition:t.taskDefinition,desiredCount:t.desiredCount};if(t.launchType)e.launchType=t.launchType;if(t.networkConfiguration)e.networkConfiguration=t.networkConfiguration;if(t.loadBalancers)e.loadBalancers=t.loadBalancers;if(t.healthCheckGracePeriodSeconds!==void 0)e.healthCheckGracePeriodSeconds=t.healthCheckGracePeriodSeconds;if(t.deploymentConfiguration)e.deploymentConfiguration=t.deploymentConfiguration;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.CreateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async deleteService(t){let e={cluster:t.cluster,service:t.service};if(t.force!==void 0)e.force=t.force;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeleteService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async listClusters(t={}){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async describeClusters(t){let e={clusters:t,include:["ATTACHMENTS","CONFIGURATIONS","SETTINGS","STATISTICS","TAGS"]};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async stopTask(t){let e={cluster:t.cluster,task:t.task};if(t.reason)e.reason=t.reason;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.StopTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async runTask(t){let e={cluster:t.cluster,taskDefinition:t.taskDefinition};if(t.count!==void 0)e.count=t.count;if(t.launchType)e.launchType=t.launchType;if(t.networkConfiguration)e.networkConfiguration=t.networkConfiguration;if(t.overrides)e.overrides=t.overrides;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RunTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async registerTaskDefinition(t){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async deregisterTaskDefinition(t){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeregisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:t})})}async describeTaskDefinition(t){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:t,include:["TAGS"]})})}async listTaskDefinitionFamilies(t){let e={};if(t?.familyPrefix)e.familyPrefix=t.familyPrefix;if(t?.status)e.status=t.status;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTaskDefinitionFamilies","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async waitForServiceStable(t,e,r=40,d=15000){for(let E=0;E<r;E++){let c=(await this.describeServices({cluster:t,services:[e]})).services?.[0];if(c){let _=c.deployments?.find((i)=>i.status==="PRIMARY");if(_&&_.runningCount===_.desiredCount&&c.deployments?.length===1)return!0}await new Promise((_)=>setTimeout(_,d))}return!1}async forceNewDeployment(t,e){return this.updateService({cluster:t,service:e,forceNewDeployment:!0})}async scaleService(t,e,r){return this.updateService({cluster:t,service:e,desiredCount:r})}}At();mT();pT();At();At();class pd{client;region;constructor(t="us-east-1",e){this.region=t,this.client=new dt}async createQueue(t){let r={Action:"CreateQueue",QueueName:t.fifo&&!t.queueName.endsWith(".fifo")?`${t.queueName}.fifo`:t.queueName,Version:"2012-11-05"},d=1;if(t.visibilityTimeout!==void 0)r[`Attribute.${d}.Name`]="VisibilityTimeout",r[`Attribute.${d}.Value`]=t.visibilityTimeout.toString(),d++;if(t.messageRetentionPeriod!==void 0)r[`Attribute.${d}.Name`]="MessageRetentionPeriod",r[`Attribute.${d}.Value`]=t.messageRetentionPeriod.toString(),d++;if(t.delaySeconds!==void 0)r[`Attribute.${d}.Name`]="DelaySeconds",r[`Attribute.${d}.Value`]=t.delaySeconds.toString(),d++;if(t.maxMessageSize!==void 0)r[`Attribute.${d}.Name`]="MaximumMessageSize",r[`Attribute.${d}.Value`]=t.maxMessageSize.toString(),d++;if(t.receiveMessageWaitTime!==void 0)r[`Attribute.${d}.Name`]="ReceiveMessageWaitTimeSeconds",r[`Attribute.${d}.Value`]=t.receiveMessageWaitTime.toString(),d++;if(t.fifo){if(r[`Attribute.${d}.Name`]="FifoQueue",r[`Attribute.${d}.Value`]="true",d++,t.contentBasedDeduplication)r[`Attribute.${d}.Name`]="ContentBasedDeduplication",r[`Attribute.${d}.Value`]="true",d++}if(t.deadLetterTargetArn&&t.maxReceiveCount)r[`Attribute.${d}.Name`]="RedrivePolicy",r[`Attribute.${d}.Value`]=JSON.stringify({deadLetterTargetArn:t.deadLetterTargetArn,maxReceiveCount:t.maxReceiveCount}),d++;if(t.tags&&Object.keys(t.tags).length>0){let n=1;for(let[c,_]of Object.entries(t.tags))r[`Tag.${n}.Key`]=c,r[`Tag.${n}.Value`]=_,n++}let E=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{QueueUrl:E.QueueUrl||E.CreateQueueResult?.QueueUrl}}async listQueues(t){let e={Action:"ListQueues",Version:"2012-11-05"};if(t)e.QueueNamePrefix=t;let r=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()}),d=[];if(r.QueueUrl)d.push(r.QueueUrl);else if(r.ListQueuesResult?.QueueUrl)if(Array.isArray(r.ListQueuesResult.QueueUrl))d.push(...r.ListQueuesResult.QueueUrl);else d.push(r.ListQueuesResult.QueueUrl);return{QueueUrls:d}}async getQueueAttributes(t){let e={Action:"GetQueueAttributes",QueueUrl:t,Version:"2012-11-05","AttributeName.1":"All"},r=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{Attributes:r.Attributes||r.GetQueueAttributesResult?.Attributes||{}}}async getQueueUrl(t){let e={Action:"GetQueueUrl",QueueName:t,Version:"2012-11-05"},r=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{QueueUrl:r.QueueUrl||r.GetQueueUrlResult?.QueueUrl}}async deleteQueue(t){let e={Action:"DeleteQueue",QueueUrl:t,Version:"2012-11-05"};await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()})}async purgeQueue(t){let e={Action:"PurgeQueue",QueueUrl:t,Version:"2012-11-05"};await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()})}async sendMessage(t){let e={Action:"SendMessage",QueueUrl:t.queueUrl,MessageBody:t.messageBody,Version:"2012-11-05"};if(t.delaySeconds!==void 0)e.DelaySeconds=t.delaySeconds;if(t.messageGroupId)e.MessageGroupId=t.messageGroupId;if(t.messageDeduplicationId)e.MessageDeduplicationId=t.messageDeduplicationId;let r=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{MessageId:r.MessageId||r.SendMessageResult?.MessageId}}async receiveMessages(t){let e={Action:"ReceiveMessage",QueueUrl:t.queueUrl,Version:"2012-11-05"};if(t.maxMessages!==void 0)e.MaxNumberOfMessages=t.maxMessages;if(t.visibilityTimeout!==void 0)e.VisibilityTimeout=t.visibilityTimeout;if(t.waitTimeSeconds!==void 0)e.WaitTimeSeconds=t.waitTimeSeconds;let r=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()}),d=[],E=r.Message||r.ReceiveMessageResult?.Message;if(E)if(Array.isArray(E))d.push(...E.map((n)=>({MessageId:n.MessageId,ReceiptHandle:n.ReceiptHandle,Body:n.Body})));else d.push({MessageId:E.MessageId,ReceiptHandle:E.ReceiptHandle,Body:E.Body});return{Messages:d}}async deleteMessage(t,e){let r={Action:"DeleteMessage",QueueUrl:t,ReceiptHandle:e,Version:"2012-11-05"};await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()})}}At();import{deflateRawSync as za}from"zlib";function bD(t,e){let r=typeof e==="string"?Buffer.from(e,"utf-8"):e,d=za(r),E=Fa(r),n=new Date,c=(n.getHours()<<11|n.getMinutes()<<5|n.getSeconds()>>1)&65535,_=(n.getFullYear()-1980<<9|n.getMonth()+1<<5|n.getDate())&65535,i=Buffer.from(t,"utf-8"),T=Buffer.alloc(30+i.length);T.writeUInt32LE(67324752,0),T.writeUInt16LE(20,4),T.writeUInt16LE(0,6),T.writeUInt16LE(8,8),T.writeUInt16LE(c,10),T.writeUInt16LE(_,12),T.writeUInt32LE(E,14),T.writeUInt32LE(d.length,18),T.writeUInt32LE(r.length,22),T.writeUInt16LE(i.length,26),T.writeUInt16LE(0,28),i.copy(T,30);let h=Buffer.alloc(46+i.length);h.writeUInt32LE(33639248,0),h.writeUInt16LE(20,4),h.writeUInt16LE(20,6),h.writeUInt16LE(0,8),h.writeUInt16LE(8,10),h.writeUInt16LE(c,12),h.writeUInt16LE(_,14),h.writeUInt32LE(E,16),h.writeUInt32LE(d.length,20),h.writeUInt32LE(r.length,24),h.writeUInt16LE(i.length,28),h.writeUInt16LE(0,30),h.writeUInt16LE(0,32),h.writeUInt16LE(0,34),h.writeUInt16LE(0,36),h.writeUInt32LE(0,38),h.writeUInt32LE(0,42),i.copy(h,46);let R=T.length+d.length,N=h.length,A=Buffer.alloc(22);return A.writeUInt32LE(101010256,0),A.writeUInt16LE(0,4),A.writeUInt16LE(0,6),A.writeUInt16LE(1,8),A.writeUInt16LE(1,10),A.writeUInt32LE(N,12),A.writeUInt32LE(R,16),A.writeUInt16LE(0,20),Buffer.concat([T,d,h,A])}function Fa(t){let e=[];for(let d=0;d<256;d++){let E=d;for(let n=0;n<8;n++)E=E&1?3988292384^E>>>1:E>>>1;e[d]=E}let r=4294967295;for(let d=0;d<t.length;d++)r=e[(r^t[d])&255]^r>>>8;return(r^4294967295)>>>0}class Er{client;region;constructor(t="us-east-1",e){this.region=t,this.client=new dt(void 0,{profile:e})}async createFunction(t){return await this.client.request({service:"lambda",region:this.region,method:"POST",path:"/2015-03-31/functions",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}async getFunction(t){return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2015-03-31/functions/${encodeURIComponent(t)}`,headers:{"Content-Type":"application/json"}})}async updateFunctionCode(t){let{FunctionName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2015-03-31/functions/${encodeURIComponent(e)}/code`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async updateFunctionCodeInline(t,e,r="index.js"){let d=bD(r,e);return this.updateFunctionCode({FunctionName:t,ZipFile:d.toString("base64")})}async updateFunctionConfiguration(t){let{FunctionName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2015-03-31/functions/${encodeURIComponent(e)}/configuration`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async deleteFunction(t){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2015-03-31/functions/${encodeURIComponent(t)}`,headers:{"Content-Type":"application/json"}})}async invoke(t){let{FunctionName:e,InvocationType:r="RequestResponse",Payload:d,LogType:E}=t,n={"Content-Type":"application/json","X-Amz-Invocation-Type":r};if(E)n["X-Amz-Log-Type"]=E;let c=d?typeof d==="string"?d:JSON.stringify(d):void 0,_=await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(e)}/invocations`,headers:n,body:c,returnHeaders:!0});return{StatusCode:_.statusCode||200,FunctionError:_.headers?.["x-amz-function-error"],LogResult:_.headers?.["x-amz-log-result"],Payload:typeof _.body==="string"?_.body:JSON.stringify(_.body),ExecutedVersion:_.headers?.["x-amz-executed-version"]}}async listFunctions(t){let e={};if(t?.MaxItems)e.MaxItems=String(t.MaxItems);if(t?.Marker)e.Marker=t.Marker;if(t?.FunctionVersion)e.FunctionVersion=t.FunctionVersion;return await this.client.request({service:"lambda",region:this.region,method:"GET",path:"/2015-03-31/functions",queryParams:Object.keys(e).length>0?e:void 0,headers:{"Content-Type":"application/json"}})}async addPermission(t){let{FunctionName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(e)}/policy`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async removePermission(t,e){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2015-03-31/functions/${encodeURIComponent(t)}/policy/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async publishVersion(t){let{FunctionName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(e)}/versions`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async createAlias(t){let{FunctionName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(e)}/aliases`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async updateAlias(t){let{FunctionName:e,Name:r,...d}=t;return this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2015-03-31/functions/${encodeURIComponent(e)}/aliases/${encodeURIComponent(r)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(d)})}async getAlias(t,e){try{return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2015-03-31/functions/${encodeURIComponent(t)}/aliases/${encodeURIComponent(e)}`})}catch(r){if(/ResourceNotFound/i.test(String(r?.message)))return null;throw r}}async getProvisionedConcurrencyConfig(t,e){try{return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2019-09-30/functions/${encodeURIComponent(t)}/provisioned-concurrency`,queryParams:{Qualifier:e}})}catch(r){if(/ProvisionedConcurrencyConfigNotFound|ResourceNotFound/i.test(String(r?.message)))return null;throw r}}async putProvisionedConcurrencyConfig(t){let{FunctionName:e,Qualifier:r,ProvisionedConcurrentExecutions:d}=t;return this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2019-09-30/functions/${encodeURIComponent(e)}/provisioned-concurrency`,queryParams:{Qualifier:r},headers:{"Content-Type":"application/json"},body:JSON.stringify({ProvisionedConcurrentExecutions:d})})}async deleteProvisionedConcurrencyConfig(t,e){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2019-09-30/functions/${encodeURIComponent(t)}/provisioned-concurrency`,queryParams:{Qualifier:e}})}async waitForFunctionActive(t,e=60){let r=Date.now(),d=e*1000;while(Date.now()-r<d)try{let E=await this.getFunction(t),n=E.Configuration?.State;if(n==="Active")return E.Configuration;if(n==="Failed")throw Error(`Function ${t} failed: ${E.Configuration?.StateReason}`);await new Promise((c)=>setTimeout(c,2000))}catch(E){if(E.code==="ResourceNotFoundException"){await new Promise((n)=>setTimeout(n,2000));continue}throw E}throw Error(`Timeout waiting for function ${t} to become active`)}async functionExists(t){try{return await this.getFunction(t),!0}catch(e){if(e.code==="ResourceNotFoundException"||e.statusCode===404)return!1;throw e}}async createFunctionUrl(t){let{FunctionName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2021-10-31/functions/${encodeURIComponent(e)}/url`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async getFunctionUrl(t){try{return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2021-10-31/functions/${encodeURIComponent(t)}/url`,headers:{"Content-Type":"application/json"}})}catch(e){if(e.statusCode===404)return null;throw e}}async deleteFunctionUrl(t){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2021-10-31/functions/${encodeURIComponent(t)}/url`,headers:{"Content-Type":"application/json"}})}async createFunctionWithCode(t){let{Code:e,Filename:r="index.js",...d}=t,E=bD(r,e);return this.createFunction({...d,Code:{ZipFile:E.toString("base64")}})}async addFunctionUrlPermission(t){return this.addPermission({FunctionName:t,StatementId:"FunctionURLAllowPublicAccess",Action:"lambda:InvokeFunctionUrl",Principal:"*",FunctionUrlAuthType:"NONE"})}async publishLayerVersion(t){let{LayerName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2018-10-31/layers/${encodeURIComponent(e)}/versions`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async listLayerVersions(t,e){let r={};if(e?.CompatibleRuntime)r.CompatibleRuntime=e.CompatibleRuntime;if(e?.CompatibleArchitecture)r.CompatibleArchitecture=e.CompatibleArchitecture;if(e?.MaxItems)r.MaxItems=String(e.MaxItems);if(e?.Marker)r.Marker=e.Marker;return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2018-10-31/layers/${encodeURIComponent(t)}/versions`,queryParams:Object.keys(r).length>0?r:void 0,headers:{"Content-Type":"application/json"}})}async getLayerVersion(t,e){return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2018-10-31/layers/${encodeURIComponent(t)}/versions/${e}`,headers:{"Content-Type":"application/json"}})}async addLayerVersionPermission(t){let{LayerName:e,VersionNumber:r,...d}=t;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2018-10-31/layers/${encodeURIComponent(e)}/versions/${r}/policy`,headers:{"Content-Type":"application/json"},body:JSON.stringify(d)})}async deleteLayerVersion(t,e){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2018-10-31/layers/${encodeURIComponent(t)}/versions/${e}`,headers:{"Content-Type":"application/json"}})}}At();class X_{client;region;constructor(t="us-east-1",e){this.region=t,this.client=new dt(void 0,{profile:e})}async createLogGroup(t,e){await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.CreateLogGroup","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({logGroupName:t,...e?{tags:e}:{}})})}async putRetentionPolicy(t,e){if(![1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1096,1827,2192,2557,2922,3288,3653].includes(e))throw Error("Unsupported CloudWatch Logs retention period");await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.PutRetentionPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({logGroupName:t,retentionInDays:e})})}async describeLogStreams(t){let e={logGroupName:t.logGroupName};if(t.logStreamNamePrefix)e.logStreamNamePrefix=t.logStreamNamePrefix;if(t.orderBy)e.orderBy=t.orderBy;if(t.descending!==void 0)e.descending=t.descending;if(t.limit)e.limit=t.limit;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.DescribeLogStreams","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async getLogEvents(t){let e={logGroupName:t.logGroupName,logStreamName:t.logStreamName};if(t.startTime)e.startTime=t.startTime;if(t.endTime)e.endTime=t.endTime;if(t.limit)e.limit=t.limit;if(t.startFromHead!==void 0)e.startFromHead=t.startFromHead;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.GetLogEvents","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async describeLogGroups(t){let e={};if(t?.logGroupNamePrefix)e.logGroupNamePrefix=t.logGroupNamePrefix;if(t?.limit)e.limit=t.limit;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.DescribeLogGroups","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async deleteLogGroup(t){await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.DeleteLogGroup","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({logGroupName:t})})}async filterLogEvents(t){let e={logGroupName:t.logGroupName};if(t.logStreamNames)e.logStreamNames=t.logStreamNames;if(t.startTime)e.startTime=t.startTime;if(t.endTime)e.endTime=t.endTime;if(t.filterPattern)e.filterPattern=t.filterPattern;if(t.limit)e.limit=t.limit;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.FilterLogEvents","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}}At();At();Bn();At();At();At();At();At();At();At();At();At();At();At();At();class GA{client;region;constructor(t="us-east-1"){this.region=t,this.client=new dt}async request(t,e){return this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSEvents.${t}`},body:JSON.stringify(e)})}async putRule(t){return this.request("PutRule",t)}async deleteRule(t){return this.request("DeleteRule",t)}async describeRule(t){return this.request("DescribeRule",t)}async listRules(t){return this.request("ListRules",t||{})}async listEventBuses(t){return this.request("ListEventBuses",t||{})}async enableRule(t){return this.request("EnableRule",t)}async disableRule(t){return this.request("DisableRule",t)}async putTargets(t){return this.request("PutTargets",t)}async removeTargets(t){return this.request("RemoveTargets",t)}async listTargetsByRule(t){return this.request("ListTargetsByRule",t)}async putEvents(t){return this.request("PutEvents",t)}async createSchedule(t){return this.client.request({service:"scheduler",region:this.region,method:"POST",path:`/schedules/${t.Name}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}}At();sT();At();er();er();mT();er();er();At();At();er();At();class VA{client;region;constructor(t="us-east-1"){this.region=t,this.client=new dt}async describeFileSystems(t){let e=[];if(t?.FileSystemId)e.push(`FileSystemId=${encodeURIComponent(t.FileSystemId)}`);if(t?.CreationToken)e.push(`CreationToken=${encodeURIComponent(t.CreationToken)}`);let r=`/2015-02-01/file-systems${e.length>0?`?${e.join("&")}`:""}`;return{FileSystems:((await this.client.request({service:"elasticfilesystem",region:this.region,method:"GET",path:r,headers:{"Content-Type":"application/json"}})).FileSystems||[]).map((E)=>({FileSystemId:E.FileSystemId,Name:E.Name,CreationTime:E.CreationTime,LifeCycleState:E.LifeCycleState,NumberOfMountTargets:E.NumberOfMountTargets,SizeInBytes:E.SizeInBytes?{Value:E.SizeInBytes.Value,Timestamp:E.SizeInBytes.Timestamp}:void 0,PerformanceMode:E.PerformanceMode,Encrypted:E.Encrypted,ThroughputMode:E.ThroughputMode,Tags:E.Tags}))}}}await Wt();await Wt();import{readFileSync as LU}from"node:fs";import{join as uj}from"node:path";function tE(t){if(!t)return;let e=t.trim();if(!e)return;if(!e.includes("/"))return e;let[r]=e.split("/");if(!r.endsWith("::"))return r||void 0;return`${r}1`}er();await Wt();var xD={php:"php.net",nginx:"nginx.org",composer:"getcomposer.org",mysql:"mysql.com",mariadb:"mariadb.com/server",postgres:"postgresql.org",vitess:"vitess.io",etcd:"etcd.io",redis:"redis.io",memcached:"memcached.org",meilisearch:"meilisearch.com",git:"git-scm.com",certbot:"certbot.eff.org",bun:"bun.sh",node:"nodejs.org",deno:"deno.land"};var ve="/opt/pantry";function ch(t){return`'${t.split("'").join("'\\''")}'`}function Ec(t={}){return["export DEBIAN_FRONTEND=noninteractive","export PANTRY_SERVICE_SCOPE=system","export PANTRY_INSTALL_DIR=/usr/local/bin",t.version?`export PANTRY_VERSION=${ch(t.version)}`:'export PANTRY_VERSION="${PANTRY_VERSION:-latest}"',"command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)","command -v unzip >/dev/null 2>&1 || (apt-get update -y && apt-get install -y unzip)",'command -v pantry >/dev/null 2>&1 || { OS=$(uname -s | tr \'[:upper:]\' \'[:lower:]\'); ARCH=$(uname -m); case "$ARCH" in x86_64|amd64) ARCH=x64 ;; arm64|aarch64) ARCH=arm64 ;; esac; ZIP="pantry-${OS}-${ARCH}.zip"; if [ "${PANTRY_VERSION:-latest}" = latest ]; then REL=\'latest/download\'; else REL="download/v${PANTRY_VERSION}"; fi; TMP=$(mktemp -d); curl -fsSL -o "${TMP}/${ZIP}" "https://github.com/home-lang/pantry/releases/${REL}/${ZIP}"; unzip -o "${TMP}/${ZIP}" -d /usr/local/bin; chmod +x /usr/local/bin/pantry; rm -rf "${TMP}"; }','export PATH="/usr/local/bin:$PATH"',"mkdir -p /opt/pantry"]}function nc(){return'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true'}function eE(t){if(t.length===0)return[];return[`(cd /opt/pantry && pantry install ${[...new Set(t)].map(ch).join(" ")})`]}function _h(t){return[...new Set(t)].flatMap((e)=>[`(cd /opt/pantry && pantry start ${ch(e)})`,`(cd /opt/pantry && pantry enable ${ch(e)})`])}var Dr=`${ve}/pantry/.bin`,kA=15306,KA=15991,ih=15999,qD=16101,hh=2379,ld="/var/lib/vitess",bA=100;function Ja(t){return t===!0||typeof t==="object"&&t!==null}function Ha(t){return typeof t==="object"&&t!==null?t:{}}function ge(t){return`'${String(t).split("'").join("'\\''")}'`}function Wa(t){let r=[t.version?`vitess.io@${t.version}`:"vitess.io"];if(t.mode!=="combo"&&!t.etcdEndpoint)r.push("etcd.io");return r.push("mysql.com@8.0.43"),r}var lr="vitess",va=`${Dr}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,pD="/usr/local/lib/vitess",xA=new Map;function ZA(t){return`${pD}/${t}.sh`}function cc(t,e){return xA.set(t,Qa(e)),`/bin/sh ${ZA(t)}`}function sD(){let t=[`mkdir -p ${pD}`];for(let[e,r]of xA)t.push(`cat > ${ZA(e)} <<'TS_CLOUD_VITESS_LAUNCHER_EOF'`,r,"TS_CLOUD_VITESS_LAUNCHER_EOF",`chmod 0755 ${ZA(e)}`);return t}function Qa(t){return["#!/bin/sh","set -e",`cd ${ve}`,`PANTRY_ENV="$(pantry env 2>/dev/null | grep -E '^(export [A-Za-z_]|[A-Za-z_][A-Za-z0-9_]*=)' || true)"`,'if [ -n "$PANTRY_ENV" ]; then eval "$PANTRY_ENV"; fi',`VT_MYSQL_ROOT="$(dirname "$(dirname "$(readlink -f ${Dr}/mysqld 2>/dev/null)")")"`,`VTROOT="$(dirname "$(dirname "$(readlink -f ${Dr}/mysqlctld 2>/dev/null)")")"`,"export VT_MYSQL_ROOT VTROOT",'LD_LIBRARY_PATH="$VT_MYSQL_ROOT/lib:$VTROOT/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"',"export LD_LIBRARY_PATH",`exec ${t.join(" ")}`].join(`
+</DistributionConfig>`,a=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/distribution",body:P,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),j=a.body?.Distribution||a.Distribution||a.body||a;return{Id:j.Id,ARN:j.ARN,DomainName:j.DomainName,Status:j.Status,ETag:a.headers?.etag||a.ETag||""}}async createMediaDistributionForS3(t){return this.createDistributionForS3({...t,defaultRootObject:"",mediaDelivery:!0,comment:t.comment??`Media distribution for ${t.bucketName}`})}async listPublicKeys(){let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/public-key"});return this.collectionItems(t.PublicKeyList??t,"PublicKeySummary").map((r)=>({Id:String(r.Id),Name:String(r.Name),Comment:r.Comment?String(r.Comment):void 0}))}async createPublicKey(t){if(!/^[A-Za-z0-9_-]{1,128}$/.test(t.name))throw TypeError("CloudFront public key name is invalid");if(!t.encodedKey.includes("BEGIN PUBLIC KEY"))throw TypeError("CloudFront public key must be PEM encoded");let e=(E)=>E.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/public-key",headers:{"Content-Type":"application/xml"},body:`<PublicKeyConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><CallerReference>${e(t.callerReference??`${Date.now()}-${t.name}`)}</CallerReference><Name>${e(t.name)}</Name><EncodedKey>${e(t.encodedKey)}</EncodedKey><Comment>${e(t.comment??"")}</Comment></PublicKeyConfig>`}),d=r.PublicKey??r;return{Id:String(d.Id),Name:String(d.PublicKeyConfig?.Name??t.name),EncodedKey:String(d.PublicKeyConfig?.EncodedKey??t.encodedKey),Comment:String(d.PublicKeyConfig?.Comment??t.comment??"")}}async listKeyGroups(){let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/key-group"});return this.collectionItems(t.KeyGroupList??t,"KeyGroupSummary").map((r)=>({Id:String(r.KeyGroup?.Id??r.Id),Name:String(r.KeyGroup?.KeyGroupConfig?.Name??r.KeyGroupConfig?.Name??r.Name),Items:this.collectionItems(r.KeyGroup?.KeyGroupConfig?.Items??r.KeyGroupConfig?.Items??r.Items,"Item").map(String),Comment:r.KeyGroup?.KeyGroupConfig?.Comment??r.KeyGroupConfig?.Comment??r.Comment}))}async createKeyGroup(t){if(!/^[A-Za-z0-9_-]{1,128}$/.test(t.name))throw TypeError("CloudFront key group name is invalid");let e=[...new Set(t.publicKeyIds)];if(e.length===0)throw TypeError("CloudFront key group requires at least one public key");let r=(c)=>c.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),d=e.map((c)=>`<Item>${r(c)}</Item>`).join(""),E=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/key-group",headers:{"Content-Type":"application/xml"},body:`<KeyGroupConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><Name>${r(t.name)}</Name><Items>${d}</Items><Comment>${r(t.comment??"")}</Comment></KeyGroupConfig>`}),n=E.KeyGroup??E;return{Id:String(n.Id),Name:String(n.KeyGroupConfig?.Name??t.name),Items:e,Comment:String(n.KeyGroupConfig?.Comment??t.comment??"")}}static getS3BucketPolicyForCloudFront(t,e){return{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:`arn:aws:s3:::${t}/*`,Condition:{StringEquals:{"AWS:SourceArn":e}}}]}}async waitForDistributionDeployed(t,e=60){for(let r=0;r<e;r++){if((await this.getDistribution(t)).Status==="Deployed")return!0;await new Promise((E)=>setTimeout(E,30000))}return!1}async disableDistribution(t){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${t}/config`,returnHeaders:!0}),r=e.headers?.etag||e.headers?.ETag||"",d=e.body?.DistributionConfig||(e.body?.Enabled!==void 0?e.body:void 0)||e.DistributionConfig;if(!d||d.Enabled===void 0)throw Error("Failed to get current distribution config");d.Enabled=!1;let E=this.buildDistributionConfigXml(d),n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${t}/config`,body:E,headers:{"Content-Type":"application/xml","If-Match":r},returnHeaders:!0});return{ETag:n.headers?.etag||n.headers?.ETag||n.ETag||""}}async deleteDistribution(t,e){let r=e||"";if(!r){let d=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${t}`,returnHeaders:!0});r=d.headers?.etag||d.headers?.ETag||""}await this.client.request({service:"cloudfront",region:"us-east-1",method:"DELETE",path:`/2020-05-31/distribution/${t}`,headers:{"If-Match":r}})}async waitForDistributionDisabled(t,e=60){for(let r=0;r<e;r++){let d=await this.getDistribution(t);if(d.Status==="Deployed"&&!d.Enabled)return!0;await new Promise((E)=>setTimeout(E,30000))}return!1}async removeAlias(t,e){let r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${t}/config`,returnHeaders:!0}),d=r.headers?.etag||r.headers?.ETag||"",E=r.body?.DistributionConfig||(r.body?.Enabled!==void 0?r.body:void 0)||r.DistributionConfig;if(!E||E.Enabled===void 0)throw Error("Failed to get current distribution config");let n=[];if(E.Aliases?.Items){if(Array.isArray(E.Aliases.Items))n=E.Aliases.Items;else if(typeof E.Aliases.Items==="object"){let T=E.Aliases.Items.CNAME;if(typeof T==="string")n=[T];else if(Array.isArray(T))n=T}}if(n.length===0)throw Error("Distribution has no aliases to remove");let c=n.filter((T)=>T!==e);if(c.length===n.length)throw Error(`Alias ${e} not found in distribution`);if(E.Aliases.Quantity=c.length,E.Aliases.Items=c.length>0?c:void 0,c.length===0)E.ViewerCertificate={CloudFrontDefaultCertificate:!0,MinimumProtocolVersion:"TLSv1.2_2021"};let _=this.buildDistributionConfigXml(E),i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${t}/config`,body:_,headers:{"Content-Type":"application/xml","If-Match":d},returnHeaders:!0});return{ETag:i.headers?.etag||i.headers?.ETag||i.ETag||""}}}i_();At();At();i_();function KD(t,e=""){return t===408||t===409||t===425||t===429||t>=500||/rate limit|temporar|timed? ?out|try again/i.test(e)}async function MA(t,e){let r=e?.headers.get("retry-after"),d=r===null||r===void 0?void 0:Number(r)*1000,E=Number.isFinite(d)?Math.max(0,d):Math.min(1000*2**(t-1),30000);await new Promise((n)=>setTimeout(n,E))}class dc{name="porkbun";apiKey;secretKey;requestTimeoutMs;constructor(t,e,r=15000){this.apiKey=t,this.secretKey=e,this.requestTimeoutMs=r}async request(t,e={}){let r;for(let d=1;d<=8;d+=1){let E,n=new AbortController,c=setTimeout(()=>{n.abort(Error(`Porkbun API request timed out after ${this.requestTimeoutMs}ms`))},this.requestTimeoutMs);try{E=await fetch(`https://api.porkbun.com/api/json/v3${t}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({apikey:this.apiKey,secretapikey:this.secretKey,...e}),signal:n.signal})}catch(i){if(r=i,d===8)throw i;await MA(d);continue}finally{clearTimeout(c)}if(!E.ok){if(r=Error(`Porkbun API error: ${E.status} ${E.statusText}`),!KD(E.status)||d===8)throw r;await MA(d,E);continue}let _=await E.json();if(_.status==="ERROR"){if(r=Error(`Porkbun API error: ${_.message||"Unknown error"}`),!KD(0,_.message)||d===8)throw r;await MA(d,E);continue}return _}throw r}getSubdomain(t,e){let r=t.replace(/\.$/,""),d=e.replace(/\.$/,"");if(r===d)return"";if(r.endsWith(`.${d}`))return r.slice(0,-(d.length+1));return r}getRootDomain(t){let e=t.replace(/\.$/,"").split(".");if(e.length>=2)return e.slice(-2).join(".");return t}static ADDRESS_TYPES=new Set(["A","AAAA"]);async clearConflictingAliases(t,e){if(!dc.ADDRESS_TYPES.has(e.type))return[];let r=this.getRootDomain(t),d=this.getSubdomain(e.name,r),E=await this.listRecords(t);if(!E.success)return[`could not list records to clear ALIAS/CNAME conflicts: ${E.message??"unknown provider error"}`];let n=[];for(let c of E.records){if(c.type!=="ALIAS"&&c.type!=="CNAME")continue;if(this.getSubdomain(c.name,r)!==d)continue;let _=await this.deleteRecord(t,c);if(!_.success)n.push(`could not remove conflicting ${c.type} on ${c.name}: ${_.message??"unknown provider error"}`)}return n}async addressRecordExists(t,e){let r=this.getRootDomain(t),d=this.getSubdomain(e.name,r),E=await this.listRecords(t);if(!E.success)return!0;return E.records.some((n)=>n.type===e.type&&this.getSubdomain(n.name,r)===d&&n.content===e.content)}async createRecord(t,e){try{let r=this.getRootDomain(t),d=this.getSubdomain(e.name,r),E={type:e.type,content:e.content,ttl:String(e.ttl||600)};if(d)E.name=d;if((e.type==="MX"||e.type==="SRV")&&e.priority!==void 0)E.prio=String(e.priority);if(e.type==="SRV"&&e.weight!==void 0&&e.port!==void 0)E.content=`${e.weight} ${e.port} ${e.content}`;let n=await this.clearConflictingAliases(t,e),c=await this.request(`/dns/create/${r}`,E);if(dc.ADDRESS_TYPES.has(e.type)&&!await this.addressRecordExists(t,e))return{success:!1,message:`Porkbun reported success but no ${e.type} record for ${e.name} exists${n.length>0?` (${n.join("; ")})`:""}. A conflicting ALIAS/CNAME on the same name silently voids the write.`};return{success:!0,id:c.id?.toString(),message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(t,e){try{let r=this.getRootDomain(t),d=this.getSubdomain(e.name,r),E=await this.listRecords(t,e.type);if(E.success){let n=E.records.find((c)=>{return this.getSubdomain(c.name,r)===d&&c.type===e.type});if(n?.id){let c={type:e.type,content:e.content,ttl:String(e.ttl||600)};if(d)c.name=d;if((e.type==="MX"||e.type==="SRV")&&e.priority!==void 0)c.prio=String(e.priority);if(e.type==="SRV"&&e.weight!==void 0&&e.port!==void 0)c.content=`${e.weight} ${e.port} ${e.content}`;return await this.request(`/dns/edit/${r}/${n.id}`,c),{success:!0,id:n.id,message:"Record updated successfully"}}}return this.createRecord(t,e)}catch(r){return this.createRecord(t,e)}}async deleteRecord(t,e){try{let r=this.getRootDomain(t);if("id"in e&&e.id)return await this.request(`/dns/delete/${r}/${e.id}`),{success:!0,message:"Record deleted successfully"};let d=this.getSubdomain(e.name,r),E=await this.listRecords(t);if(!E.success)return{success:!1,message:"Failed to list records"};let n=E.records.find((c)=>{return this.getSubdomain(c.name,r)===d&&c.type===e.type&&c.content===e.content});if(!n?.id)return{success:!1,message:"Record not found"};return await this.request(`/dns/delete/${r}/${n.id}`),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(t,e){try{let r=this.getRootDomain(t),d=`/dns/retrieve/${r}`;if(e)d=`/dns/retrieveByNameType/${r}/${e}`;return{success:!0,records:((await this.request(d)).records||[]).map((c)=>({id:c.id,name:c.name||r,type:c.type,content:c.content,ttl:Number.parseInt(c.ttl,10),priority:c.prio?Number.parseInt(c.prio,10):void 0}))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(t){try{let e=this.getRootDomain(t);return await this.request(`/dns/retrieve/${e}`),!0}catch{return!1}}async listDomains(){try{return((await this.request("/domain/listAll")).domains||[]).map((e)=>e.domain)}catch{return[]}}async getNameServers(t){try{let e=this.getRootDomain(t);return(await this.request(`/dns/getNS/${e}`)).ns||[]}catch{return[]}}async updateNameServers(t,e){try{let r=this.getRootDomain(t);return await this.request(`/dns/updateNS/${r}`,{ns:e}),!0}catch{return!1}}}class dh{name="godaddy";apiKey;apiSecret;baseUrl;constructor(t,e,r="production"){this.apiKey=t,this.apiSecret=e,this.baseUrl=r==="ote"?"https://api.ote-godaddy.com":"https://api.godaddy.com"}async request(t,e,r){let d=`${this.baseUrl}${e}`,E={Authorization:`sso-key ${this.apiKey}:${this.apiSecret}`,"Content-Type":"application/json",Accept:"application/json"},n={method:t,headers:E};if(r)n.body=JSON.stringify(r);let c=await fetch(d,n);if(c.status===204)return{};if(c.ok){let i=await c.text();if(i)return JSON.parse(i);return{}}let _=`GoDaddy API error: ${c.status} ${c.statusText}`;try{let i=await c.json();if(i.message)_=`GoDaddy API error: ${i.message}`;if(i.fields)_+=` - Fields: ${JSON.stringify(i.fields)}`}catch{}throw Error(_)}getSubdomain(t,e){let r=t.replace(/\.$/,""),d=e.replace(/\.$/,"");if(r===d)return"@";if(r.endsWith(`.${d}`))return r.slice(0,-(d.length+1));return r}getRootDomain(t){let e=t.replace(/\.$/,"").split(".");if(e.length>=2)return e.slice(-2).join(".");return t}toGoDaddyRecord(t,e){let r=this.getRootDomain(e),d=this.getSubdomain(t.name,r),E={type:t.type,name:d,data:t.content,ttl:t.ttl||600};if(t.type==="MX"&&t.priority!==void 0)E.priority=t.priority;return E}fromGoDaddyRecord(t,e){let r=this.getRootDomain(e),d=t.name;if(d==="@")d=r;else if(!d.endsWith(r))d=`${d}.${r}`;return{name:d,type:t.type,content:t.data,ttl:t.ttl,priority:t.priority}}async createRecord(t,e){try{let r=this.getRootDomain(t),d=this.toGoDaddyRecord(e,t);return await this.request("PATCH",`/v1/domains/${r}/records`,[d]),{success:!0,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(t,e){try{let r=this.getRootDomain(t),d=this.toGoDaddyRecord(e,t);return await this.request("PUT",`/v1/domains/${r}/records/${e.type}/${d.name}`,[d]),{success:!0,message:"Record upserted successfully"}}catch(r){return this.createRecord(t,e)}}async deleteRecord(t,e){try{let r=this.getRootDomain(t),d=this.getSubdomain(e.name,r),E=await this.request("GET",`/v1/domains/${r}/records/${e.type}/${d}`),n=E.filter((c)=>c.data!==e.content);if(n.length===E.length)return{success:!1,message:"Record not found"};if(n.length===0)try{await this.request("DELETE",`/v1/domains/${r}/records/${e.type}/${d}`)}catch{}else await this.request("PUT",`/v1/domains/${r}/records/${e.type}/${d}`,n);return{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(t,e){try{let r=this.getRootDomain(t),d=`/v1/domains/${r}/records`;if(e)d=`/v1/domains/${r}/records/${e}`;return{success:!0,records:(await this.request("GET",d)).map((n)=>this.fromGoDaddyRecord(n,t))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(t){try{let e=this.getRootDomain(t);return await this.request("GET",`/v1/domains/${e}`),!0}catch{return!1}}async listDomains(){try{return(await this.request("GET","/v1/domains")).map((e)=>e.domain)}catch{return[]}}async getDomainDetails(t){try{let e=this.getRootDomain(t),r=await this.request("GET",`/v1/domains/${e}`);return{domain:r.domain,status:r.status,nameServers:r.nameServers,expires:r.expires}}catch{return null}}async updateNameServers(t,e){try{let r=this.getRootDomain(t);return await this.request("PUT",`/v1/domains/${r}/records/NS`,e.map((d)=>({type:"NS",name:"@",data:d,ttl:3600}))),!0}catch{return!1}}async checkDomainAvailability(t){try{let e=await this.request("GET",`/v1/domains/available?domain=${encodeURIComponent(t)}`);return{available:e.available,price:e.price,currency:e.currency}}catch{return{available:!1}}}}class Eh{name="cloudflare";apiToken;zoneCache=new Map;constructor(t){this.apiToken=t}async request(t,e,r){let d=`https://api.cloudflare.com/client/v4${e}`,E={Authorization:`Bearer ${this.apiToken}`,"Content-Type":"application/json"},n={method:t,headers:E};if(r)n.body=JSON.stringify(r);let _=await(await fetch(d,n)).json();if(!_.success){let i=_.errors.map((T)=>T.message).join(", ");throw Error(`Cloudflare API error: ${i}`)}return _}getRootDomain(t){let e=t.replace(/\.$/,"").split(".");if(e.length>=2)return e.slice(-2).join(".");return t}async getZoneId(t){let e=this.getRootDomain(t),r=this.zoneCache.get(e);if(r)return r;let d=await this.request("GET",`/zones?name=${encodeURIComponent(e)}`);if(!d.result||d.result.length===0)throw Error(`Zone not found for domain: ${e}`);let E=d.result[0].id;return this.zoneCache.set(e,E),E}getFullRecordName(t,e){let r=this.getRootDomain(e),d=t.replace(/\.$/,"");if(!d||d===r||d==="@")return r;if(d.endsWith(`.${r}`))return d;return`${d}.${r}`}toCloudflareRecord(t,e){let r={type:t.type,name:this.getFullRecordName(t.name,e),content:t.content||t.value||"",ttl:t.ttl||1};if(t.type==="MX"&&t.priority!==void 0)r.priority=t.priority;if(t.type==="SRV"){if(t.priority!==void 0)r.priority=t.priority}return r}fromCloudflareRecord(t){return{id:t.id,name:t.name,type:t.type,content:t.content,ttl:t.ttl,priority:t.priority}}async createRecord(t,e){try{let r=await this.getZoneId(t),d=this.toCloudflareRecord(e,t);return{success:!0,id:(await this.request("POST",`/zones/${r}/dns_records`,d)).result.id,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(t,e){try{let r=await this.getZoneId(t),d=this.getFullRecordName(e.name,t),E=await this.request("GET",`/zones/${r}/dns_records?type=${e.type}&name=${encodeURIComponent(d)}`),n=this.toCloudflareRecord(e,t);if(E.result&&E.result.length>0){let _=E.result[0].id;return{success:!0,id:(await this.request("PUT",`/zones/${r}/dns_records/${_}`,n)).result.id,message:"Record updated successfully"}}return{success:!0,id:(await this.request("POST",`/zones/${r}/dns_records`,n)).result.id,message:"Record created successfully"}}catch(r){return this.createRecord(t,e)}}async deleteRecord(t,e){try{let r=await this.getZoneId(t),d=this.getFullRecordName(e.name,t),E=await this.request("GET",`/zones/${r}/dns_records?type=${e.type}&name=${encodeURIComponent(d)}`);if(!E.result||E.result.length===0)return{success:!1,message:"Record not found"};let n=E.result.find((c)=>c.content===e.content);if(!n)return{success:!1,message:"Record with matching content not found"};return await this.request("DELETE",`/zones/${r}/dns_records/${n.id}`),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(t,e){try{let d=`/zones/${await this.getZoneId(t)}/dns_records?per_page=100`;if(e)d+=`&type=${e}`;let E=[],n=1,c=!0;while(c){let _=await this.request("GET",`${d}&page=${n}`);if(E.push(..._.result||[]),_.result_info)c=n<_.result_info.total_pages,n++;else c=!1}return{success:!0,records:E.map((_)=>this.fromCloudflareRecord(_))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(t){try{return await this.getZoneId(t),!0}catch{return!1}}async listDomains(){try{let t=[],e=1,r=!0;while(r){let d=await this.request("GET",`/zones?per_page=50&page=${e}`);if(t.push(...d.result||[]),d.result_info)r=e<d.result_info.total_pages,e++;else r=!1}return t.map((d)=>d.name)}catch{return[]}}async getZoneDetails(t){try{let e=await this.getZoneId(t),r=await this.request("GET",`/zones/${e}`);return{id:r.result.id,name:r.result.name,status:r.result.status,nameServers:r.result.name_servers,paused:r.result.paused}}catch{return null}}async purgeCache(t,e){try{let r=await this.getZoneId(t),d={};if(e?.purgeEverything)d.purge_everything=!0;else{if(e?.files)d.files=e.files;if(e?.tags)d.tags=e.tags;if(e?.hosts)d.hosts=e.hosts}if(Object.keys(d).length===0)d.purge_everything=!0;return await this.request("POST",`/zones/${r}/purge_cache`,d),!0}catch{return!1}}async getRecordProxyStatus(t,e){try{let r=await this.getZoneId(t),d=this.getFullRecordName(e.name,t),E=await this.request("GET",`/zones/${r}/dns_records?type=${e.type}&name=${encodeURIComponent(d)}`);if(E.result&&E.result.length>0)return E.result.find((c)=>c.content===e.content)?.proxied??null;return null}catch{return null}}async setRecordProxyStatus(t,e,r){try{let d=await this.getZoneId(t),E=this.getFullRecordName(e.name,t),n=await this.request("GET",`/zones/${d}/dns_records?type=${e.type}&name=${encodeURIComponent(E)}`);if(!n.result||n.result.length===0)return!1;let c=n.result.find((_)=>_.content===e.content);if(!c)return!1;return await this.request("PATCH",`/zones/${d}/dns_records/${c.id}`,{proxied:r}),!0}catch{return!1}}}i_();class nh{name="route53";client;hostedZoneCache=new Map;providedHostedZoneId;constructor(t="us-east-1",e){this.client=new Kd(t),this.providedHostedZoneId=e}getRootDomain(t){let e=t.replace(/\.$/,"").split(".");if(e.length>=2)return e.slice(-2).join(".");return t}async getHostedZoneId(t){if(this.providedHostedZoneId)return this.providedHostedZoneId;let e=this.getRootDomain(t),r=this.hostedZoneCache.get(e);if(r)return r;let d=await this.client.findHostedZoneForDomain(t);if(d){let E=d.Id.replace("/hostedzone/","");return this.hostedZoneCache.set(e,E),E}return null}normalizeName(t,e){let r=t.replace(/\.$/,""),d=e.replace(/\.$/,"");if(!d||d==="@")return`${r}.`;if(d===r||d.endsWith(`.${r}`))return`${d}.`;return`${d}.${r}.`}async createRecord(t,e){try{let r=await this.getHostedZoneId(t);if(!r)return{success:!1,message:`No hosted zone found for domain: ${t}`};let d=this.normalizeName(t,e.name),E=e.content;if(e.type==="TXT"&&!E.startsWith('"'))E=`"${E}"`;if(e.type==="MX"&&e.priority!==void 0)E=`${e.priority} ${E}`;return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Created by ts-cloud DNS provider",Changes:[{Action:"CREATE",ResourceRecordSet:{Name:d,Type:e.type,TTL:e.ttl||300,ResourceRecords:[{Value:E}]}}]}})).ChangeInfo?.Id,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(t,e){try{let r=await this.getHostedZoneId(t);if(!r)return{success:!1,message:`No hosted zone found for domain: ${t}`};let d=this.normalizeName(t,e.name),E=e.content;if(e.type==="TXT"&&!E.startsWith('"'))E=`"${E}"`;if(e.type==="MX"&&e.priority!==void 0)E=`${e.priority} ${E}`;return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Upserted by ts-cloud DNS provider",Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:d,Type:e.type,TTL:e.ttl||300,ResourceRecords:[{Value:E}]}}]}})).ChangeInfo?.Id,message:"Record upserted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async deleteRecord(t,e){try{let r=await this.getHostedZoneId(t);if(!r)return{success:!1,message:`No hosted zone found for domain: ${t}`};let d=this.normalizeName(t,e.name),E=e.content;if(e.type==="TXT"&&!E.startsWith('"'))E=`"${E}"`;if(e.type==="MX"&&e.priority!==void 0)E=`${e.priority} ${E}`;return await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Deleted by ts-cloud DNS provider",Changes:[{Action:"DELETE",ResourceRecordSet:{Name:d,Type:e.type,TTL:e.ttl||300,ResourceRecords:[{Value:E}]}}]}}),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(t,e){try{let r=await this.getHostedZoneId(t);if(!r)return{success:!1,records:[],message:`No hosted zone found for domain: ${t}`};let d=await this.client.listResourceRecordSets({HostedZoneId:r,StartRecordType:e}),E=[];for(let n of d.ResourceRecordSets){if(e&&n.Type!==e)continue;if(n.AliasTarget)continue;for(let c of n.ResourceRecords||[]){let _=c.Value,i;if(n.Type==="MX"){let T=_.split(" ");if(T.length>=2)i=Number.parseInt(T[0],10),_=T.slice(1).join(" ")}if(n.Type==="TXT"&&_.startsWith('"')&&_.endsWith('"'))_=_.slice(1,-1);E.push({name:n.Name.replace(/\.$/,""),type:n.Type,content:_,ttl:n.TTL,priority:i})}}return{success:!0,records:E}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(t){return await this.getHostedZoneId(t)!==null}async listDomains(){try{return(await this.client.listHostedZones()).HostedZones.map((e)=>e.Name.replace(/\.$/,""))}catch{return[]}}getRoute53Client(){return this.client}async createAliasRecord(t){try{let e=await this.getHostedZoneId(t.domain);if(!e)return{success:!1,message:`No hosted zone found for domain: ${t.domain}`};return{success:!0,id:(await this.client.createAliasRecord({HostedZoneId:e,Name:this.normalizeName(t.domain,t.name),TargetHostedZoneId:t.targetHostedZoneId,TargetDNSName:t.targetDnsName,EvaluateTargetHealth:t.evaluateTargetHealth,Type:t.type})).ChangeInfo?.Id,message:"Alias record created successfully"}}catch(e){return{success:!1,message:e instanceof Error?e.message:"Unknown error"}}}async createCloudFrontAlias(t){return this.createAliasRecord({domain:t.domain,name:t.name,targetHostedZoneId:Kd.CloudFrontHostedZoneId,targetDnsName:t.cloudFrontDomainName,evaluateTargetHealth:!1})}async createAlbAlias(t){let e=Kd.ALBHostedZoneIds[t.region];if(!e)return{success:!1,message:`Unknown region for ALB: ${t.region}`};return this.createAliasRecord({domain:t.domain,name:t.name,targetHostedZoneId:e,targetDnsName:t.albDnsName,evaluateTargetHealth:!0})}}function $_(t){switch(t.provider){case"route53":return new nh(t.region,t.hostedZoneId);case"porkbun":return new dc(t.apiKey,t.secretKey);case"godaddy":return new dh(t.apiKey,t.apiSecret,t.environment);case"cloudflare":return new Eh(t.apiToken);default:throw Error(`Unknown DNS provider: ${t.provider}`)}}class ZD{providers=new Map;configs=[];addConfig(t){return this.configs.push(t),this}addRoute53(t,e){return this.configs.push({provider:"route53",region:t,hostedZoneId:e}),this}addPorkbun(t,e){return this.configs.push({provider:"porkbun",apiKey:t,secretKey:e}),this}addGoDaddy(t,e,r){return this.configs.push({provider:"godaddy",apiKey:t,apiSecret:e,environment:r}),this}addCloudflare(t){return this.configs.push({provider:"cloudflare",apiToken:t}),this}loadFromEnv(){if(process.env.AWS_ACCESS_KEY_ID||process.env.AWS_REGION)this.addRoute53(process.env.AWS_REGION);let t=process.env.PORKBUN_API_KEY,e=process.env.PORKBUN_SECRET_KEY;if(t&&e)this.addPorkbun(t,e);let r=process.env.GODADDY_API_KEY,d=process.env.GODADDY_API_SECRET;if(r&&d){let n=process.env.GODADDY_ENVIRONMENT;this.addGoDaddy(r,d,n)}let E=process.env.CLOUDFLARE_API_TOKEN;if(E)this.addCloudflare(E);return this}getProvider(t){let e=this.providers.get(t);if(e)return e;let r=this.configs.find((E)=>E.provider===t);if(!r)return null;let d=$_(r);return this.providers.set(t,d),d}async getProviderForDomain(t){for(let e of this.configs){let r=$_(e);if(await r.canManageDomain(t))return r}return null}getAllProviders(){return this.configs.map((t)=>$_(t))}}var L4=new ZD;kD();At();class y_{client;region;constructor(t="us-east-1",e){this.region=t,this.client=new dt(void 0,{profile:e})}async describeServices(t){let e={cluster:t.cluster,services:t.services};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async listServices(t,e={}){let r={cluster:t,...e};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async listTasks(t,e,r={}){let d={cluster:t,...r};if(e)d.serviceName=e;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(d)})}async describeTasks(t,e){let r={cluster:t,tasks:e};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async updateService(t){let e={cluster:t.cluster,service:t.service};if(t.forceNewDeployment!==void 0)e.forceNewDeployment=t.forceNewDeployment;if(t.desiredCount!==void 0)e.desiredCount=t.desiredCount;if(t.taskDefinition)e.taskDefinition=t.taskDefinition;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.UpdateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async createService(t){let e={cluster:t.cluster,serviceName:t.serviceName,taskDefinition:t.taskDefinition,desiredCount:t.desiredCount};if(t.launchType)e.launchType=t.launchType;if(t.networkConfiguration)e.networkConfiguration=t.networkConfiguration;if(t.loadBalancers)e.loadBalancers=t.loadBalancers;if(t.healthCheckGracePeriodSeconds!==void 0)e.healthCheckGracePeriodSeconds=t.healthCheckGracePeriodSeconds;if(t.deploymentConfiguration)e.deploymentConfiguration=t.deploymentConfiguration;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.CreateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async deleteService(t){let e={cluster:t.cluster,service:t.service};if(t.force!==void 0)e.force=t.force;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeleteService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async listClusters(t={}){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async describeClusters(t){let e={clusters:t,include:["ATTACHMENTS","CONFIGURATIONS","SETTINGS","STATISTICS","TAGS"]};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async stopTask(t){let e={cluster:t.cluster,task:t.task};if(t.reason)e.reason=t.reason;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.StopTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async runTask(t){let e={cluster:t.cluster,taskDefinition:t.taskDefinition};if(t.count!==void 0)e.count=t.count;if(t.launchType)e.launchType=t.launchType;if(t.networkConfiguration)e.networkConfiguration=t.networkConfiguration;if(t.overrides)e.overrides=t.overrides;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RunTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async registerTaskDefinition(t){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async deregisterTaskDefinition(t){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeregisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:t})})}async describeTaskDefinition(t){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:t,include:["TAGS"]})})}async listTaskDefinitionFamilies(t){let e={};if(t?.familyPrefix)e.familyPrefix=t.familyPrefix;if(t?.status)e.status=t.status;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTaskDefinitionFamilies","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async waitForServiceStable(t,e,r=40,d=15000){for(let E=0;E<r;E++){let c=(await this.describeServices({cluster:t,services:[e]})).services?.[0];if(c){let _=c.deployments?.find((i)=>i.status==="PRIMARY");if(_&&_.runningCount===_.desiredCount&&c.deployments?.length===1)return!0}await new Promise((_)=>setTimeout(_,d))}return!1}async forceNewDeployment(t,e){return this.updateService({cluster:t,service:e,forceNewDeployment:!0})}async scaleService(t,e,r){return this.updateService({cluster:t,service:e,desiredCount:r})}}At();mT();pT();At();At();class pd{client;region;constructor(t="us-east-1",e){this.region=t,this.client=new dt}async createQueue(t){let r={Action:"CreateQueue",QueueName:t.fifo&&!t.queueName.endsWith(".fifo")?`${t.queueName}.fifo`:t.queueName,Version:"2012-11-05"},d=1;if(t.visibilityTimeout!==void 0)r[`Attribute.${d}.Name`]="VisibilityTimeout",r[`Attribute.${d}.Value`]=t.visibilityTimeout.toString(),d++;if(t.messageRetentionPeriod!==void 0)r[`Attribute.${d}.Name`]="MessageRetentionPeriod",r[`Attribute.${d}.Value`]=t.messageRetentionPeriod.toString(),d++;if(t.delaySeconds!==void 0)r[`Attribute.${d}.Name`]="DelaySeconds",r[`Attribute.${d}.Value`]=t.delaySeconds.toString(),d++;if(t.maxMessageSize!==void 0)r[`Attribute.${d}.Name`]="MaximumMessageSize",r[`Attribute.${d}.Value`]=t.maxMessageSize.toString(),d++;if(t.receiveMessageWaitTime!==void 0)r[`Attribute.${d}.Name`]="ReceiveMessageWaitTimeSeconds",r[`Attribute.${d}.Value`]=t.receiveMessageWaitTime.toString(),d++;if(t.fifo){if(r[`Attribute.${d}.Name`]="FifoQueue",r[`Attribute.${d}.Value`]="true",d++,t.contentBasedDeduplication)r[`Attribute.${d}.Name`]="ContentBasedDeduplication",r[`Attribute.${d}.Value`]="true",d++}if(t.deadLetterTargetArn&&t.maxReceiveCount)r[`Attribute.${d}.Name`]="RedrivePolicy",r[`Attribute.${d}.Value`]=JSON.stringify({deadLetterTargetArn:t.deadLetterTargetArn,maxReceiveCount:t.maxReceiveCount}),d++;if(t.tags&&Object.keys(t.tags).length>0){let n=1;for(let[c,_]of Object.entries(t.tags))r[`Tag.${n}.Key`]=c,r[`Tag.${n}.Value`]=_,n++}let E=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()});return{QueueUrl:E.QueueUrl||E.CreateQueueResult?.QueueUrl}}async listQueues(t){let e={Action:"ListQueues",Version:"2012-11-05"};if(t)e.QueueNamePrefix=t;let r=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()}),d=[];if(r.QueueUrl)d.push(r.QueueUrl);else if(r.ListQueuesResult?.QueueUrl)if(Array.isArray(r.ListQueuesResult.QueueUrl))d.push(...r.ListQueuesResult.QueueUrl);else d.push(r.ListQueuesResult.QueueUrl);return{QueueUrls:d}}async getQueueAttributes(t){let e={Action:"GetQueueAttributes",QueueUrl:t,Version:"2012-11-05","AttributeName.1":"All"},r=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{Attributes:r.Attributes||r.GetQueueAttributesResult?.Attributes||{}}}async getQueueUrl(t){let e={Action:"GetQueueUrl",QueueName:t,Version:"2012-11-05"},r=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{QueueUrl:r.QueueUrl||r.GetQueueUrlResult?.QueueUrl}}async deleteQueue(t){let e={Action:"DeleteQueue",QueueUrl:t,Version:"2012-11-05"};await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()})}async purgeQueue(t){let e={Action:"PurgeQueue",QueueUrl:t,Version:"2012-11-05"};await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()})}async sendMessage(t){let e={Action:"SendMessage",QueueUrl:t.queueUrl,MessageBody:t.messageBody,Version:"2012-11-05"};if(t.delaySeconds!==void 0)e.DelaySeconds=t.delaySeconds;if(t.messageGroupId)e.MessageGroupId=t.messageGroupId;if(t.messageDeduplicationId)e.MessageDeduplicationId=t.messageDeduplicationId;let r=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()});return{MessageId:r.MessageId||r.SendMessageResult?.MessageId}}async receiveMessages(t){let e={Action:"ReceiveMessage",QueueUrl:t.queueUrl,Version:"2012-11-05"};if(t.maxMessages!==void 0)e.MaxNumberOfMessages=t.maxMessages;if(t.visibilityTimeout!==void 0)e.VisibilityTimeout=t.visibilityTimeout;if(t.waitTimeSeconds!==void 0)e.WaitTimeSeconds=t.waitTimeSeconds;let r=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(e).toString()}),d=[],E=r.Message||r.ReceiveMessageResult?.Message;if(E)if(Array.isArray(E))d.push(...E.map((n)=>({MessageId:n.MessageId,ReceiptHandle:n.ReceiptHandle,Body:n.Body})));else d.push({MessageId:E.MessageId,ReceiptHandle:E.ReceiptHandle,Body:E.Body});return{Messages:d}}async deleteMessage(t,e){let r={Action:"DeleteMessage",QueueUrl:t,ReceiptHandle:e,Version:"2012-11-05"};await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(r).toString()})}}At();import{deflateRawSync as za}from"zlib";function bD(t,e){let r=typeof e==="string"?Buffer.from(e,"utf-8"):e,d=za(r),E=Fa(r),n=new Date,c=(n.getHours()<<11|n.getMinutes()<<5|n.getSeconds()>>1)&65535,_=(n.getFullYear()-1980<<9|n.getMonth()+1<<5|n.getDate())&65535,i=Buffer.from(t,"utf-8"),T=Buffer.alloc(30+i.length);T.writeUInt32LE(67324752,0),T.writeUInt16LE(20,4),T.writeUInt16LE(0,6),T.writeUInt16LE(8,8),T.writeUInt16LE(c,10),T.writeUInt16LE(_,12),T.writeUInt32LE(E,14),T.writeUInt32LE(d.length,18),T.writeUInt32LE(r.length,22),T.writeUInt16LE(i.length,26),T.writeUInt16LE(0,28),i.copy(T,30);let h=Buffer.alloc(46+i.length);h.writeUInt32LE(33639248,0),h.writeUInt16LE(20,4),h.writeUInt16LE(20,6),h.writeUInt16LE(0,8),h.writeUInt16LE(8,10),h.writeUInt16LE(c,12),h.writeUInt16LE(_,14),h.writeUInt32LE(E,16),h.writeUInt32LE(d.length,20),h.writeUInt32LE(r.length,24),h.writeUInt16LE(i.length,28),h.writeUInt16LE(0,30),h.writeUInt16LE(0,32),h.writeUInt16LE(0,34),h.writeUInt16LE(0,36),h.writeUInt32LE(0,38),h.writeUInt32LE(0,42),i.copy(h,46);let R=T.length+d.length,N=h.length,A=Buffer.alloc(22);return A.writeUInt32LE(101010256,0),A.writeUInt16LE(0,4),A.writeUInt16LE(0,6),A.writeUInt16LE(1,8),A.writeUInt16LE(1,10),A.writeUInt32LE(N,12),A.writeUInt32LE(R,16),A.writeUInt16LE(0,20),Buffer.concat([T,d,h,A])}function Fa(t){let e=[];for(let d=0;d<256;d++){let E=d;for(let n=0;n<8;n++)E=E&1?3988292384^E>>>1:E>>>1;e[d]=E}let r=4294967295;for(let d=0;d<t.length;d++)r=e[(r^t[d])&255]^r>>>8;return(r^4294967295)>>>0}class Er{client;region;constructor(t="us-east-1",e){this.region=t,this.client=new dt(void 0,{profile:e})}async createFunction(t){return await this.client.request({service:"lambda",region:this.region,method:"POST",path:"/2015-03-31/functions",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}async getFunction(t){return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2015-03-31/functions/${encodeURIComponent(t)}`,headers:{"Content-Type":"application/json"}})}async updateFunctionCode(t){let{FunctionName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2015-03-31/functions/${encodeURIComponent(e)}/code`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async updateFunctionCodeInline(t,e,r="index.js"){let d=bD(r,e);return this.updateFunctionCode({FunctionName:t,ZipFile:d.toString("base64")})}async updateFunctionConfiguration(t){let{FunctionName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2015-03-31/functions/${encodeURIComponent(e)}/configuration`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async deleteFunction(t){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2015-03-31/functions/${encodeURIComponent(t)}`,headers:{"Content-Type":"application/json"}})}async invoke(t){let{FunctionName:e,InvocationType:r="RequestResponse",Payload:d,LogType:E}=t,n={"Content-Type":"application/json","X-Amz-Invocation-Type":r};if(E)n["X-Amz-Log-Type"]=E;let c=d?typeof d==="string"?d:JSON.stringify(d):void 0,_=await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(e)}/invocations`,headers:n,body:c,returnHeaders:!0});return{StatusCode:_.statusCode||200,FunctionError:_.headers?.["x-amz-function-error"],LogResult:_.headers?.["x-amz-log-result"],Payload:typeof _.body==="string"?_.body:JSON.stringify(_.body),ExecutedVersion:_.headers?.["x-amz-executed-version"]}}async listFunctions(t){let e={};if(t?.MaxItems)e.MaxItems=String(t.MaxItems);if(t?.Marker)e.Marker=t.Marker;if(t?.FunctionVersion)e.FunctionVersion=t.FunctionVersion;return await this.client.request({service:"lambda",region:this.region,method:"GET",path:"/2015-03-31/functions",queryParams:Object.keys(e).length>0?e:void 0,headers:{"Content-Type":"application/json"}})}async addPermission(t){let{FunctionName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(e)}/policy`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async removePermission(t,e){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2015-03-31/functions/${encodeURIComponent(t)}/policy/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async publishVersion(t){let{FunctionName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(e)}/versions`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async createAlias(t){let{FunctionName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(e)}/aliases`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async updateAlias(t){let{FunctionName:e,Name:r,...d}=t;return this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2015-03-31/functions/${encodeURIComponent(e)}/aliases/${encodeURIComponent(r)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(d)})}async getAlias(t,e){try{return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2015-03-31/functions/${encodeURIComponent(t)}/aliases/${encodeURIComponent(e)}`})}catch(r){if(/ResourceNotFound/i.test(String(r?.message)))return null;throw r}}async getProvisionedConcurrencyConfig(t,e){try{return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2019-09-30/functions/${encodeURIComponent(t)}/provisioned-concurrency`,queryParams:{Qualifier:e}})}catch(r){if(/ProvisionedConcurrencyConfigNotFound|ResourceNotFound/i.test(String(r?.message)))return null;throw r}}async putProvisionedConcurrencyConfig(t){let{FunctionName:e,Qualifier:r,ProvisionedConcurrentExecutions:d}=t;return this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2019-09-30/functions/${encodeURIComponent(e)}/provisioned-concurrency`,queryParams:{Qualifier:r},headers:{"Content-Type":"application/json"},body:JSON.stringify({ProvisionedConcurrentExecutions:d})})}async deleteProvisionedConcurrencyConfig(t,e){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2019-09-30/functions/${encodeURIComponent(t)}/provisioned-concurrency`,queryParams:{Qualifier:e}})}async waitForFunctionActive(t,e=60){let r=Date.now(),d=e*1000;while(Date.now()-r<d)try{let E=await this.getFunction(t),n=E.Configuration?.State;if(n==="Active")return E.Configuration;if(n==="Failed")throw Error(`Function ${t} failed: ${E.Configuration?.StateReason}`);await new Promise((c)=>setTimeout(c,2000))}catch(E){if(E.code==="ResourceNotFoundException"){await new Promise((n)=>setTimeout(n,2000));continue}throw E}throw Error(`Timeout waiting for function ${t} to become active`)}async functionExists(t){try{return await this.getFunction(t),!0}catch(e){if(e.code==="ResourceNotFoundException"||e.statusCode===404)return!1;throw e}}async createFunctionUrl(t){let{FunctionName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2021-10-31/functions/${encodeURIComponent(e)}/url`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async getFunctionUrl(t){try{return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2021-10-31/functions/${encodeURIComponent(t)}/url`,headers:{"Content-Type":"application/json"}})}catch(e){if(e.statusCode===404)return null;throw e}}async deleteFunctionUrl(t){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2021-10-31/functions/${encodeURIComponent(t)}/url`,headers:{"Content-Type":"application/json"}})}async createFunctionWithCode(t){let{Code:e,Filename:r="index.js",...d}=t,E=bD(r,e);return this.createFunction({...d,Code:{ZipFile:E.toString("base64")}})}async addFunctionUrlPermission(t){return this.addPermission({FunctionName:t,StatementId:"FunctionURLAllowPublicAccess",Action:"lambda:InvokeFunctionUrl",Principal:"*",FunctionUrlAuthType:"NONE"})}async publishLayerVersion(t){let{LayerName:e,...r}=t;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2018-10-31/layers/${encodeURIComponent(e)}/versions`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async listLayerVersions(t,e){let r={};if(e?.CompatibleRuntime)r.CompatibleRuntime=e.CompatibleRuntime;if(e?.CompatibleArchitecture)r.CompatibleArchitecture=e.CompatibleArchitecture;if(e?.MaxItems)r.MaxItems=String(e.MaxItems);if(e?.Marker)r.Marker=e.Marker;return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2018-10-31/layers/${encodeURIComponent(t)}/versions`,queryParams:Object.keys(r).length>0?r:void 0,headers:{"Content-Type":"application/json"}})}async getLayerVersion(t,e){return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2018-10-31/layers/${encodeURIComponent(t)}/versions/${e}`,headers:{"Content-Type":"application/json"}})}async addLayerVersionPermission(t){let{LayerName:e,VersionNumber:r,...d}=t;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2018-10-31/layers/${encodeURIComponent(e)}/versions/${r}/policy`,headers:{"Content-Type":"application/json"},body:JSON.stringify(d)})}async deleteLayerVersion(t,e){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2018-10-31/layers/${encodeURIComponent(t)}/versions/${e}`,headers:{"Content-Type":"application/json"}})}}At();class X_{client;region;constructor(t="us-east-1",e){this.region=t,this.client=new dt(void 0,{profile:e})}async createLogGroup(t,e){await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.CreateLogGroup","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({logGroupName:t,...e?{tags:e}:{}})})}async putRetentionPolicy(t,e){if(![1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1096,1827,2192,2557,2922,3288,3653].includes(e))throw Error("Unsupported CloudWatch Logs retention period");await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.PutRetentionPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({logGroupName:t,retentionInDays:e})})}async describeLogStreams(t){let e={logGroupName:t.logGroupName};if(t.logStreamNamePrefix)e.logStreamNamePrefix=t.logStreamNamePrefix;if(t.orderBy)e.orderBy=t.orderBy;if(t.descending!==void 0)e.descending=t.descending;if(t.limit)e.limit=t.limit;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.DescribeLogStreams","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async getLogEvents(t){let e={logGroupName:t.logGroupName,logStreamName:t.logStreamName};if(t.startTime)e.startTime=t.startTime;if(t.endTime)e.endTime=t.endTime;if(t.limit)e.limit=t.limit;if(t.startFromHead!==void 0)e.startFromHead=t.startFromHead;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.GetLogEvents","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async describeLogGroups(t){let e={};if(t?.logGroupNamePrefix)e.logGroupNamePrefix=t.logGroupNamePrefix;if(t?.limit)e.limit=t.limit;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.DescribeLogGroups","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async deleteLogGroup(t){await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.DeleteLogGroup","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({logGroupName:t})})}async filterLogEvents(t){let e={logGroupName:t.logGroupName};if(t.logStreamNames)e.logStreamNames=t.logStreamNames;if(t.startTime)e.startTime=t.startTime;if(t.endTime)e.endTime=t.endTime;if(t.filterPattern)e.filterPattern=t.filterPattern;if(t.limit)e.limit=t.limit;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.FilterLogEvents","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}}At();At();Bn();At();At();At();At();At();At();At();At();At();At();At();At();class GA{client;region;constructor(t="us-east-1"){this.region=t,this.client=new dt}async request(t,e){return this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSEvents.${t}`},body:JSON.stringify(e)})}async putRule(t){return this.request("PutRule",t)}async deleteRule(t){return this.request("DeleteRule",t)}async describeRule(t){return this.request("DescribeRule",t)}async listRules(t){return this.request("ListRules",t||{})}async listEventBuses(t){return this.request("ListEventBuses",t||{})}async enableRule(t){return this.request("EnableRule",t)}async disableRule(t){return this.request("DisableRule",t)}async putTargets(t){return this.request("PutTargets",t)}async removeTargets(t){return this.request("RemoveTargets",t)}async listTargetsByRule(t){return this.request("ListTargetsByRule",t)}async putEvents(t){return this.request("PutEvents",t)}async createSchedule(t){return this.client.request({service:"scheduler",region:this.region,method:"POST",path:`/schedules/${t.Name}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}}At();sT();At();er();er();mT();er();er();At();At();er();At();class VA{client;region;constructor(t="us-east-1"){this.region=t,this.client=new dt}async describeFileSystems(t){let e=[];if(t?.FileSystemId)e.push(`FileSystemId=${encodeURIComponent(t.FileSystemId)}`);if(t?.CreationToken)e.push(`CreationToken=${encodeURIComponent(t.CreationToken)}`);let r=`/2015-02-01/file-systems${e.length>0?`?${e.join("&")}`:""}`;return{FileSystems:((await this.client.request({service:"elasticfilesystem",region:this.region,method:"GET",path:r,headers:{"Content-Type":"application/json"}})).FileSystems||[]).map((E)=>({FileSystemId:E.FileSystemId,Name:E.Name,CreationTime:E.CreationTime,LifeCycleState:E.LifeCycleState,NumberOfMountTargets:E.NumberOfMountTargets,SizeInBytes:E.SizeInBytes?{Value:E.SizeInBytes.Value,Timestamp:E.SizeInBytes.Timestamp}:void 0,PerformanceMode:E.PerformanceMode,Encrypted:E.Encrypted,ThroughputMode:E.ThroughputMode,Tags:E.Tags}))}}}await Wt();await Wt();import{readFileSync as LU}from"node:fs";import{join as uj}from"node:path";function tE(t){if(!t)return;let e=t.trim();if(!e)return;if(!e.includes("/"))return e;let[r]=e.split("/");if(!r.endsWith("::"))return r||void 0;return`${r}1`}er();await Wt();var xD={php:"php.net",nginx:"nginx.org",composer:"getcomposer.org",mysql:"mysql.com",mariadb:"mariadb.com/server",postgres:"postgresql.org",vitess:"vitess.io",etcd:"etcd.io",redis:"redis.io",memcached:"memcached.org",meilisearch:"meilisearch.com",git:"git-scm.com",certbot:"certbot.eff.org",bun:"bun.sh",node:"nodejs.org",deno:"deno.land"};var ve="/opt/pantry";function ch(t){return`'${t.split("'").join("'\\''")}'`}function Ec(t={}){return["export DEBIAN_FRONTEND=noninteractive","export PANTRY_SERVICE_SCOPE=system","export PANTRY_INSTALL_DIR=/usr/local/bin",t.version?`export PANTRY_VERSION=${ch(t.version)}`:'export PANTRY_VERSION="${PANTRY_VERSION:-latest}"',"command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)","command -v unzip >/dev/null 2>&1 || (apt-get update -y && apt-get install -y unzip)",'OS=$(uname -s | tr \'[:upper:]\' \'[:lower:]\'); ARCH=$(uname -m); case "$ARCH" in x86_64|amd64) ARCH=x64 ;; arm64|aarch64) ARCH=arm64 ;; esac; ZIP="pantry-${OS}-${ARCH}.zip"; if [ "${PANTRY_VERSION:-latest}" = latest ]; then REL=\'latest/download\'; else REL="download/v${PANTRY_VERSION}"; fi; TMP=$(mktemp -d); curl -fsSL -o "${TMP}/${ZIP}" "https://github.com/pantry-pm/pantry/releases/${REL}/${ZIP}"; unzip -o "${TMP}/${ZIP}" -d /usr/local/bin; chmod +x /usr/local/bin/pantry; rm -rf "${TMP}"','export PATH="/usr/local/bin:$PATH"',"mkdir -p /opt/pantry"]}function nc(){return'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true'}function eE(t){if(t.length===0)return[];return[`(cd /opt/pantry && pantry install ${[...new Set(t)].map(ch).join(" ")})`]}function _h(t){return[...new Set(t)].flatMap((e)=>[`(cd /opt/pantry && pantry start ${ch(e)})`,`(cd /opt/pantry && pantry enable ${ch(e)})`])}var Dr=`${ve}/pantry/.bin`,kA=15306,KA=15991,ih=15999,qD=16101,hh=2379,ld="/var/lib/vitess",bA=100;function Ja(t){return t===!0||typeof t==="object"&&t!==null}function Ha(t){return typeof t==="object"&&t!==null?t:{}}function Le(t){return`'${String(t).split("'").join("'\\''")}'`}function Wa(t){let r=[t.version?`vitess.io@${t.version}`:"vitess.io"];if(t.mode!=="combo"&&!t.etcdEndpoint)r.push("etcd.io");return r.push("mysql.com@8.0.43"),r}var lr="vitess",va=`${Dr}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,pD="/usr/local/lib/vitess",xA=new Map;function ZA(t){return`${pD}/${t}.sh`}function cc(t,e){return xA.set(t,Qa(e)),`/bin/sh ${ZA(t)}`}function sD(){let t=[`mkdir -p ${pD}`];for(let[e,r]of xA)t.push(`cat > ${ZA(e)} <<'TS_CLOUD_VITESS_LAUNCHER_EOF'`,r,"TS_CLOUD_VITESS_LAUNCHER_EOF",`chmod 0755 ${ZA(e)}`);return t}function Qa(t){return["#!/bin/sh","set -e",`cd ${ve}`,`PANTRY_ENV="$(pantry env 2>/dev/null | grep -E '^(export [A-Za-z_]|[A-Za-z_][A-Za-z0-9_]*=)' || true)"`,'if [ -n "$PANTRY_ENV" ]; then eval "$PANTRY_ENV"; fi',`VT_MYSQL_ROOT="$(dirname "$(dirname "$(readlink -f ${Dr}/mysqld 2>/dev/null)")")"`,`VTROOT="$(dirname "$(dirname "$(readlink -f ${Dr}/mysqlctld 2>/dev/null)")")"`,"export VT_MYSQL_ROOT VTROOT",'LD_LIBRARY_PATH="$VT_MYSQL_ROOT/lib:$VTROOT/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"',"export LD_LIBRARY_PATH",`exec ${t.join(" ")}`].join(`
 `)}function _c(t){let e=["[Unit]",`Description=${t.description}`,`After=network.target${t.after?.length?` ${t.after.join(" ")}`:""}`];if(t.requires?.length)e.push(`Requires=${t.requires.join(" ")}`);return e.push("","[Service]","Type=simple",`User=${lr}`,`Group=${lr}`,`Environment="PATH=${va}"`,`Environment="VTDATAROOT=${ld}"`,...Object.entries(t.environment??{}).map(([r,d])=>`Environment="${r}=${d}"`),...(t.execStartPre??[]).map((r)=>`ExecStartPre=${r}`),`ExecStart=${t.execStart}`,"Restart=always","RestartSec=5","LimitNOFILE=65535","","[Install]","WantedBy=multi-user.target"),e.join(`
-`)}function oD(t,e){return[`cat > /etc/systemd/system/${t}.service <<'TS_CLOUD_VITESS_UNIT_EOF'`,e,"TS_CLOUD_VITESS_UNIT_EOF"]}function Ya(t){let e=t.cell??"zone1",r=t.vtgatePort??kA,E=`${((t.keyspaces?.length)?t.keyspaces:[{name:"app"}]).map((n)=>{let c=(n.sharded?["-80","80-"]:["0"]).map((_)=>`shards:{name:"${_}"}`).join(" ");return`keyspaces:{name:"${n.name}" ${c}}`}).join(" ")} cells:"${e}"`;return _c({description:"Vitess (vtcombo, single-process development stack)",execStart:cc("vtcombo",[`${Dr}/vtcombo`,`--cell ${e}`,`--proto-topo ${ge(E)}`,`--mysql-server-port ${r}`,"--mysql-server-bind-address 127.0.0.1","--mysql-auth-server-impl none","--start-mysql",`--port ${KA}`,`--grpc-port ${ih}`])})}function Ma(){return _c({description:"etcd (Vitess topology store)",execStart:cc("etcd",[`${Dr}/etcd`,`--data-dir ${ld}/etcd`,`--listen-client-urls http://127.0.0.1:${hh}`,`--advertise-client-urls http://127.0.0.1:${hh}`]),execStartPre:[`+/bin/mkdir -p ${ld}/etcd`,`+/bin/chown ${lr}:${lr} ${ld}/etcd`]})}function qA(t){return["--topo-implementation etcd2",`--topo-global-server-address ${t.etcdEndpoint??`http://127.0.0.1:${hh}`}`,"--topo-global-root /vitess/global"]}function Ga(t){let e=!t.etcdEndpoint;return _c({description:"Vitess vtctld (control plane)",after:e?["vitess-etcd.service"]:[],requires:e?["vitess-etcd.service"]:[],execStart:cc("vtctld",[`${Dr}/vtctld`,...qA(t),`--cell ${t.cell??"zone1"}`,"--service-map grpc-vtctl,grpc-vtctld",`--grpc-port ${ih}`,`--port ${ih+1}`])})}function Va(t,e,r){let d=t.cell??"zone1";return _c({description:`Vitess vttablet (${e}/${r})`,after:["vitess-vtctld.service","vitess-mysqlctld.service"],requires:["vitess-mysqlctld.service"],execStart:cc("vttablet",[`${Dr}/vttablet`,...qA(t),`--tablet-path ${d}-${String(bA).padStart(10,"0")}`,`--init-keyspace ${e}`,`--init-shard ${r}`,"--init-tablet-type replica",`--service-map ${ge("grpc-queryservice,grpc-tabletmanager,grpc-updatestream")}`,`--port ${qD}`,`--grpc-port ${qD+1}`,`--db-port ${t.mysqlPort??3306}`,`--mycnf-mysql-port ${t.mysqlPort??3306}`])})}function Ka(t){return _c({description:"Vitess mysqlctld (managed mysqld)",execStart:cc("mysqlctld",[`${Dr}/mysqlctld`,`--tablet-uid ${bA}`,`--mysql-port ${t.mysqlPort??3306}`,'--init-db-sql-file "$VTROOT/config/init_db.sql"',"--wait-time 2m"]),execStartPre:[`+/bin/mkdir -p ${ld}`,`+/bin/chown ${lr}:${lr} ${ld}`]})}var Th="/etc/vitess/auth.json";function Za(t){let e=t.username??"vitess",r=t.password??"",d=JSON.stringify({[e]:[{MysqlNativePassword:"",Password:r,UserData:e}]});return["mkdir -p /etc/vitess",`cat > ${Th} <<'TS_CLOUD_VITESS_AUTH_EOF'`,d,"TS_CLOUD_VITESS_AUTH_EOF",`chown ${lr}:${lr} ${Th}`,`chmod 0600 ${Th}`]}function ka(t){let e=t.cell??"zone1";return _c({description:"Vitess vtgate (query router)",after:["vitess-vtctld.service"],execStart:cc("vtgate",[`${Dr}/vtgate`,...qA(t),`--cell ${e}`,`--cells-to-watch ${e}`,"--tablet-types-to-wait PRIMARY,REPLICA",`--service-map ${ge("grpc-vtgateservice")}`,`--mysql-server-port ${t.vtgatePort??kA}`,`--mysql-server-bind-address ${t.bindAddress??"127.0.0.1"}`,"--mysql-auth-server-impl static",`--mysql-auth-server-static-file ${Th}`,`--port ${KA}`,`--grpc-port ${KA+1}`])})}function ba(t){let e=t.cell??"zone1",r=t.etcdEndpoint??`http://127.0.0.1:${hh}`,d=`${Dr}/vtctldclient --server 127.0.0.1:${ih}`,E=[`for i in $(seq 1 30); do ${d} GetCellInfoNames >/dev/null 2>&1 && break; sleep 2; done`,`if ! ${d} GetCellInfoNames 2>/dev/null | grep -qx ${ge(e)}; then`,`  ${d} AddCellInfo --root ${ge(`/vitess/${e}`)} --server-address ${ge(r)} ${ge(e)}`,"fi"];for(let n of t.keyspaces??[]){let c=n.sharded?" --sharded":"";E.push(`if ! ${d} GetKeyspace ${ge(n.name)} >/dev/null 2>&1; then`,`  ${d} CreateKeyspace${c} ${ge(n.name)}`,"fi");let _=`${e}-${String(bA).padStart(10,"0")}`;for(let i of n.sharded?["-80","80-"]:["0"]){let T=`${n.name}/${i}`;E.push("for i in $(seq 1 90); do",`  if ${d} GetShard ${ge(T)} 2>/dev/null | grep -q '"primary_alias": *"[^"]'; then break; fi`,`  ${d} PlannedReparentShard ${ge(T)} --new-primary ${ge(_)} >/dev/null 2>&1 && break`,`  ${d} InitShardPrimary --force ${ge(T)} ${ge(_)} >/dev/null 2>&1 && break`,"  sleep 2","done",`if ! ${d} GetShard ${ge(T)} 2>/dev/null | grep -q '"primary_alias": *"[^"]'; then`,`  echo "no primary could be elected for ${T}" >&2; exit 1`,"fi")}}return E}function mD(t){let e=t.vtgatePort??kA;return["for i in $(seq 1 60); do",`  if (cd ${ve} && eval "$(pantry env 2>/dev/null)"; MYSQL_PWD=${ge(t.password??"")} ${Dr}/mysql -h 127.0.0.1 -P ${e} -u ${ge(t.username??"vitess")} --connect-timeout=2 -e 'SHOW KEYSPACES') >/dev/null 2>&1; then`,`    echo "vtgate is serving on ${e}"; exit 0`,"  fi","  sleep 2","done",`echo "vtgate did not become ready on port ${e}" >&2`,"exit 1"]}function Rh(t){if(!Ja(t))return[];let e=Ha(t),r=e.mode==="combo";xA.clear();let d=[...eE(Wa(e)),`VT_MYSQL_LIB="$(dirname "$(dirname "$(readlink -f ${Dr}/mysqld)")")/lib"`,'if [ -d "$VT_MYSQL_LIB" ]; then',`  printf '%s\\n' "$VT_MYSQL_LIB" > /etc/ld.so.conf.d/vitess-mysql.conf`,"  ldconfig","else",'  echo "mysqld library directory not found under $VT_MYSQL_LIB" >&2; exit 1',"fi",`id -u ${lr} >/dev/null 2>&1 || useradd --system --home-dir ${ld} --shell /usr/sbin/nologin ${lr}`,`mkdir -p ${ld}`,`chown -R ${lr}:${lr} ${ld}`];if(r)return d.push(...oD("vitess-vtcombo",Ya(e)),...sD(),"systemctl daemon-reload","systemctl enable --now vitess-vtcombo.service",...mD(e)),d;d.push(...Za(e));let E=[];if(!e.etcdEndpoint)E.push(["vitess-etcd",Ma()]);E.push(["vitess-vtctld",Ga(e)],["vitess-mysqlctld",Ka(e)],["vitess-vtgate",ka(e)]);for(let n of e.keyspaces??[])for(let c of n.sharded?["-80","80-"]:["0"])E.push([`vitess-vttablet-${n.name}-${c.replace(/-/g,"x")}`,Va(e,n.name,c)]);for(let[n,c]of E)d.push(...oD(n,c));d.push(...sD()),d.push("systemctl daemon-reload");for(let[n]of E)d.push(`systemctl enable --now ${n}.service`);return d.push(...ba(e),...mD(e)),d}var xa=new Set(["singlestore","vitess"]);function tU(t){if(t?.engine&&xa.has(t.engine))return!1;return!t?.host||t.host==="127.0.0.1"||t.host==="localhost"}function Tc(t,e="psql"){let r=t?.port??5432;if(tU(t))return`${e} -p ${r} -U postgres`;let d=t?.username||"postgres";return`${t?.password?`PGPASSWORD='${t.password.replace(/'/g,"'\\''")}' `:""}${e} -h ${t.host} -p ${r} -U ${d} -w`}function Dd(t){return t===!0||typeof t==="object"&&t!=null}function qa(t){let e=[],r=[];if(Dd(t.mysql))e.push(typeof t.mysql==="object"&&t.mysql.version?`mysql.com@${t.mysql.version}`:"mysql.com@8.0.43"),r.push("mysql");else if(Dd(t.mariadb))e.push(xD.mariadb),r.push("mariadb");if(Dd(t.postgres))e.push("postgresql.org"),r.push("postgres");if(Dd(t.redis))e.push("redis.io"),r.push("redis");if(Dd(t.memcached))e.push("memcached.org"),r.push("memcached");if(Dd(t.meilisearch))e.push("meilisearch.com"),r.push("meilisearch");return{packages:e,services:r}}function Sh(t={},e={}){let r=qa(t),d=Rh(t.vitess);if(r.packages.length===0)return d;return[...eE(r.packages),..._h(r.services),...d]}function P_(t,e={}){if(!t?.name)return[];if(!tU(t))return[];let r=t.name,d=t.username||r,E=t.password||"",n=Dd(e.postgres)||t.engine==="postgres",c=Dd(e.mariadb)||t.engine==="mariadb",_=Dd(e.mysql)||t.engine==="mysql";if(n&&!_&&!c){let A=(a)=>`"${a.replace(/"/g,'""')}"`,u=(a)=>`'${a.replace(/'/g,"''")}'`,U=(a,j)=>["DO $$ BEGIN",`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${u(a)}) THEN`,`    CREATE ROLE ${A(a)} LOGIN PASSWORD ${u(j)};`,"  ELSE",`    ALTER ROLE ${A(a)} LOGIN PASSWORD ${u(j)};`,"  END IF;","END $$;"],w=(a)=>{let j=a.databases&&a.databases.length>0?a.databases:[r],B=[];for(let F of j)if(a.access==="readonly")B.push(`GRANT CONNECT ON DATABASE ${A(F)} TO ${A(a.username)};`,`\\connect ${A(F)}`,`GRANT USAGE ON SCHEMA public TO ${A(a.username)};`,`GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${A(a.username)};`,`ALTER DEFAULT PRIVILEGES FOR ROLE ${A(d)} IN SCHEMA public GRANT SELECT ON TABLES TO ${A(a.username)};`,"\\connect postgres");else B.push(`GRANT ALL PRIVILEGES ON DATABASE ${A(F)} TO ${A(a.username)};`);return B},l=t.users||[],P=t.port??5432;return[nc(),`for i in $(seq 1 30); do pg_isready -p ${P} -q && break; sleep 2; done`,`${Tc(t)} <<'TS_CLOUD_PG_EOF'`,...U(d,E),`SELECT 'CREATE DATABASE ${A(r)} OWNER ${A(d)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${u(r)})\\gexec`,...l.flatMap((a)=>[...U(a.username,a.password),...w(a)]),"TS_CLOUD_PG_EOF"]}let i=c?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock",T=(A)=>A.replace(/`/g,"``"),h=(A)=>A.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),R=(A)=>{let u=A.databases&&A.databases.length>0?A.databases:[r],U=A.access==="readonly"?"SELECT":"ALL PRIVILEGES",w=[`CREATE USER IF NOT EXISTS '${h(A.username)}'@'%' IDENTIFIED BY '${h(A.password)}';`,`CREATE USER IF NOT EXISTS '${h(A.username)}'@'localhost' IDENTIFIED BY '${h(A.password)}';`,`ALTER USER '${h(A.username)}'@'%' IDENTIFIED BY '${h(A.password)}';`,`ALTER USER '${h(A.username)}'@'localhost' IDENTIFIED BY '${h(A.password)}';`];for(let l of u)w.push(`GRANT ${U} ON \`${T(l)}\`.* TO '${h(A.username)}'@'%';`,`GRANT ${U} ON \`${T(l)}\`.* TO '${h(A.username)}'@'localhost';`);return w},N=t.users||[];return[nc(),`for i in $(seq 1 30); do mysqladmin --socket=${i} -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done`,`mysql --socket=${i} -u root <<'TS_CLOUD_SQL_EOF'`,`CREATE DATABASE IF NOT EXISTS \`${T(r)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,...R({username:d,password:E}),...N.flatMap(R),"FLUSH PRIVILEGES;","TS_CLOUD_SQL_EOF"]}var sA="/var/backups/ts-cloud",sa="/etc/ts-cloud/backups.config.ts",eU="/etc/cron.d/ts-cloud-backups",ic="/usr/local/bin/ts-cloud-backup.sh";function oa(t){if(!t.name)return null;let e=t.host||"127.0.0.1",r=t.engine==="postgres",d=r?"postgresql":"mysql",E=t.port??(r?5432:3306),n=(c)=>c.replace(/\\/g,"\\\\").replace(/'/g,"\\'");return["  {",`    type: '${d}',`,`    name: '${n(t.name)}',`,"    connection: {",`      hostname: '${n(e)}',`,`      port: ${E},`,`      database: '${n(t.name)}',`,`      username: '${n(t.username||t.name)}',`,`      password: '${n(t.password||"")}',`,"      ssl: false,","    },","    includeSchema: true,","    includeData: true,","  },"].join(`
+`)}function oD(t,e){return[`cat > /etc/systemd/system/${t}.service <<'TS_CLOUD_VITESS_UNIT_EOF'`,e,"TS_CLOUD_VITESS_UNIT_EOF"]}function Ya(t){let e=t.cell??"zone1",r=t.vtgatePort??kA,E=`${((t.keyspaces?.length)?t.keyspaces:[{name:"app"}]).map((n)=>{let c=(n.sharded?["-80","80-"]:["0"]).map((_)=>`shards:{name:"${_}"}`).join(" ");return`keyspaces:{name:"${n.name}" ${c}}`}).join(" ")} cells:"${e}"`;return _c({description:"Vitess (vtcombo, single-process development stack)",execStart:cc("vtcombo",[`${Dr}/vtcombo`,`--cell ${e}`,`--proto-topo ${Le(E)}`,`--mysql-server-port ${r}`,"--mysql-server-bind-address 127.0.0.1","--mysql-auth-server-impl none","--start-mysql",`--port ${KA}`,`--grpc-port ${ih}`])})}function Ma(){return _c({description:"etcd (Vitess topology store)",execStart:cc("etcd",[`${Dr}/etcd`,`--data-dir ${ld}/etcd`,`--listen-client-urls http://127.0.0.1:${hh}`,`--advertise-client-urls http://127.0.0.1:${hh}`]),execStartPre:[`+/bin/mkdir -p ${ld}/etcd`,`+/bin/chown ${lr}:${lr} ${ld}/etcd`]})}function qA(t){return["--topo-implementation etcd2",`--topo-global-server-address ${t.etcdEndpoint??`http://127.0.0.1:${hh}`}`,"--topo-global-root /vitess/global"]}function Ga(t){let e=!t.etcdEndpoint;return _c({description:"Vitess vtctld (control plane)",after:e?["vitess-etcd.service"]:[],requires:e?["vitess-etcd.service"]:[],execStart:cc("vtctld",[`${Dr}/vtctld`,...qA(t),`--cell ${t.cell??"zone1"}`,"--service-map grpc-vtctl,grpc-vtctld",`--grpc-port ${ih}`,`--port ${ih+1}`])})}function Va(t,e,r){let d=t.cell??"zone1";return _c({description:`Vitess vttablet (${e}/${r})`,after:["vitess-vtctld.service","vitess-mysqlctld.service"],requires:["vitess-mysqlctld.service"],execStart:cc("vttablet",[`${Dr}/vttablet`,...qA(t),`--tablet-path ${d}-${String(bA).padStart(10,"0")}`,`--init-keyspace ${e}`,`--init-shard ${r}`,"--init-tablet-type replica",`--service-map ${Le("grpc-queryservice,grpc-tabletmanager,grpc-updatestream")}`,`--port ${qD}`,`--grpc-port ${qD+1}`,`--db-port ${t.mysqlPort??3306}`,`--mycnf-mysql-port ${t.mysqlPort??3306}`])})}function Ka(t){return _c({description:"Vitess mysqlctld (managed mysqld)",execStart:cc("mysqlctld",[`${Dr}/mysqlctld`,`--tablet-uid ${bA}`,`--mysql-port ${t.mysqlPort??3306}`,'--init-db-sql-file "$VTROOT/config/init_db.sql"',"--wait-time 2m"]),execStartPre:[`+/bin/mkdir -p ${ld}`,`+/bin/chown ${lr}:${lr} ${ld}`]})}var Th="/etc/vitess/auth.json";function Za(t){let e=t.username??"vitess",r=t.password??"",d=JSON.stringify({[e]:[{MysqlNativePassword:"",Password:r,UserData:e}]});return["mkdir -p /etc/vitess",`cat > ${Th} <<'TS_CLOUD_VITESS_AUTH_EOF'`,d,"TS_CLOUD_VITESS_AUTH_EOF",`chown ${lr}:${lr} ${Th}`,`chmod 0600 ${Th}`]}function ka(t){let e=t.cell??"zone1";return _c({description:"Vitess vtgate (query router)",after:["vitess-vtctld.service"],execStart:cc("vtgate",[`${Dr}/vtgate`,...qA(t),`--cell ${e}`,`--cells-to-watch ${e}`,"--tablet-types-to-wait PRIMARY,REPLICA",`--service-map ${Le("grpc-vtgateservice")}`,`--mysql-server-port ${t.vtgatePort??kA}`,`--mysql-server-bind-address ${t.bindAddress??"127.0.0.1"}`,"--mysql-auth-server-impl static",`--mysql-auth-server-static-file ${Th}`,`--port ${KA}`,`--grpc-port ${KA+1}`])})}function ba(t){let e=t.cell??"zone1",r=t.etcdEndpoint??`http://127.0.0.1:${hh}`,d=`${Dr}/vtctldclient --server 127.0.0.1:${ih}`,E=[`for i in $(seq 1 30); do ${d} GetCellInfoNames >/dev/null 2>&1 && break; sleep 2; done`,`if ! ${d} GetCellInfoNames 2>/dev/null | grep -qx ${Le(e)}; then`,`  ${d} AddCellInfo --root ${Le(`/vitess/${e}`)} --server-address ${Le(r)} ${Le(e)}`,"fi"];for(let n of t.keyspaces??[]){let c=n.sharded?" --sharded":"";E.push(`if ! ${d} GetKeyspace ${Le(n.name)} >/dev/null 2>&1; then`,`  ${d} CreateKeyspace${c} ${Le(n.name)}`,"fi");let _=`${e}-${String(bA).padStart(10,"0")}`;for(let i of n.sharded?["-80","80-"]:["0"]){let T=`${n.name}/${i}`;E.push("for i in $(seq 1 90); do",`  if ${d} GetShard ${Le(T)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then break; fi`,`  ${d} PlannedReparentShard ${Le(T)} --new-primary ${Le(_)} >/dev/null 2>&1 && break`,`  ${d} InitShardPrimary --force ${Le(T)} ${Le(_)} >/dev/null 2>&1 && break`,"  sleep 2","done",`if ! ${d} GetShard ${Le(T)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then`,`  echo "no primary could be elected for ${T}" >&2; exit 1`,"fi")}E.push(`${d} RebuildKeyspaceGraph ${Le(n.name)} >/dev/null`)}return E}function mD(t){let e=t.vtgatePort??kA;return["for i in $(seq 1 60); do",`  if (cd ${ve} && eval "$(pantry env 2>/dev/null)"; MYSQL_PWD=${Le(t.password??"")} ${Dr}/mysql -h 127.0.0.1 -P ${e} -u ${Le(t.username??"vitess")} --connect-timeout=2 -e 'SHOW KEYSPACES') >/dev/null 2>&1; then`,`    echo "vtgate is serving on ${e}"; exit 0`,"  fi","  sleep 2","done",`echo "vtgate did not become ready on port ${e}" >&2`,"exit 1"]}function Rh(t){if(!Ja(t))return[];let e=Ha(t),r=e.mode==="combo";xA.clear();let d=[...eE(Wa(e)),`VT_MYSQL_LIB="$(dirname "$(dirname "$(readlink -f ${Dr}/mysqld)")")/lib"`,'if [ -d "$VT_MYSQL_LIB" ]; then',`  printf '%s\\n' "$VT_MYSQL_LIB" > /etc/ld.so.conf.d/vitess-mysql.conf`,"  ldconfig","else",'  echo "mysqld library directory not found under $VT_MYSQL_LIB" >&2; exit 1',"fi",`id -u ${lr} >/dev/null 2>&1 || useradd --system --home-dir ${ld} --shell /usr/sbin/nologin ${lr}`,`mkdir -p ${ld}`,`chown -R ${lr}:${lr} ${ld}`];if(r)return d.push(...oD("vitess-vtcombo",Ya(e)),...sD(),"systemctl daemon-reload","systemctl enable --now vitess-vtcombo.service",...mD(e)),d;d.push(...Za(e));let E=[];if(!e.etcdEndpoint)E.push(["vitess-etcd",Ma()]);E.push(["vitess-vtctld",Ga(e)],["vitess-mysqlctld",Ka(e)],["vitess-vtgate",ka(e)]);for(let n of e.keyspaces??[])for(let c of n.sharded?["-80","80-"]:["0"])E.push([`vitess-vttablet-${n.name}-${c.replace(/-/g,"x")}`,Va(e,n.name,c)]);for(let[n,c]of E)d.push(...oD(n,c));d.push(...sD()),d.push("systemctl daemon-reload");for(let[n]of E)d.push(`systemctl enable --now ${n}.service`);return d.push(...ba(e),...mD(e)),d}var xa=new Set(["singlestore","vitess"]);function tU(t){if(t?.engine&&xa.has(t.engine))return!1;return!t?.host||t.host==="127.0.0.1"||t.host==="localhost"}function Tc(t,e="psql"){let r=t?.port??5432;if(tU(t))return`${e} -p ${r} -U postgres`;let d=t?.username||"postgres";return`${t?.password?`PGPASSWORD='${t.password.replace(/'/g,"'\\''")}' `:""}${e} -h ${t.host} -p ${r} -U ${d} -w`}function Dd(t){return t===!0||typeof t==="object"&&t!=null}function qa(t){let e=[],r=[];if(Dd(t.mysql))e.push(typeof t.mysql==="object"&&t.mysql.version?`mysql.com@${t.mysql.version}`:"mysql.com@8.0.43"),r.push("mysql");else if(Dd(t.mariadb))e.push(xD.mariadb),r.push("mariadb");if(Dd(t.postgres))e.push("postgresql.org"),r.push("postgres");if(Dd(t.redis))e.push("redis.io"),r.push("redis");if(Dd(t.memcached))e.push("memcached.org"),r.push("memcached");if(Dd(t.meilisearch))e.push("meilisearch.com"),r.push("meilisearch");return{packages:e,services:r}}function Sh(t={},e={}){let r=qa(t),d=Rh(t.vitess);if(r.packages.length===0)return d;return[...eE(r.packages),..._h(r.services),...d]}function P_(t,e={}){if(!t?.name)return[];if(!tU(t))return[];let r=t.name,d=t.username||r,E=t.password||"",n=Dd(e.postgres)||t.engine==="postgres",c=Dd(e.mariadb)||t.engine==="mariadb",_=Dd(e.mysql)||t.engine==="mysql";if(n&&!_&&!c){let A=(a)=>`"${a.replace(/"/g,'""')}"`,u=(a)=>`'${a.replace(/'/g,"''")}'`,U=(a,j)=>["DO $$ BEGIN",`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${u(a)}) THEN`,`    CREATE ROLE ${A(a)} LOGIN PASSWORD ${u(j)};`,"  ELSE",`    ALTER ROLE ${A(a)} LOGIN PASSWORD ${u(j)};`,"  END IF;","END $$;"],w=(a)=>{let j=a.databases&&a.databases.length>0?a.databases:[r],B=[];for(let F of j)if(a.access==="readonly")B.push(`GRANT CONNECT ON DATABASE ${A(F)} TO ${A(a.username)};`,`\\connect ${A(F)}`,`GRANT USAGE ON SCHEMA public TO ${A(a.username)};`,`GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${A(a.username)};`,`ALTER DEFAULT PRIVILEGES FOR ROLE ${A(d)} IN SCHEMA public GRANT SELECT ON TABLES TO ${A(a.username)};`,"\\connect postgres");else B.push(`GRANT ALL PRIVILEGES ON DATABASE ${A(F)} TO ${A(a.username)};`);return B},l=t.users||[],P=t.port??5432;return[nc(),`for i in $(seq 1 30); do pg_isready -p ${P} -q && break; sleep 2; done`,`${Tc(t)} <<'TS_CLOUD_PG_EOF'`,...U(d,E),`SELECT 'CREATE DATABASE ${A(r)} OWNER ${A(d)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${u(r)})\\gexec`,...l.flatMap((a)=>[...U(a.username,a.password),...w(a)]),"TS_CLOUD_PG_EOF"]}let i=c?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock",T=(A)=>A.replace(/`/g,"``"),h=(A)=>A.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),R=(A)=>{let u=A.databases&&A.databases.length>0?A.databases:[r],U=A.access==="readonly"?"SELECT":"ALL PRIVILEGES",w=[`CREATE USER IF NOT EXISTS '${h(A.username)}'@'%' IDENTIFIED BY '${h(A.password)}';`,`CREATE USER IF NOT EXISTS '${h(A.username)}'@'localhost' IDENTIFIED BY '${h(A.password)}';`,`ALTER USER '${h(A.username)}'@'%' IDENTIFIED BY '${h(A.password)}';`,`ALTER USER '${h(A.username)}'@'localhost' IDENTIFIED BY '${h(A.password)}';`];for(let l of u)w.push(`GRANT ${U} ON \`${T(l)}\`.* TO '${h(A.username)}'@'%';`,`GRANT ${U} ON \`${T(l)}\`.* TO '${h(A.username)}'@'localhost';`);return w},N=t.users||[];return[nc(),`for i in $(seq 1 30); do mysqladmin --socket=${i} -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done`,`mysql --socket=${i} -u root <<'TS_CLOUD_SQL_EOF'`,`CREATE DATABASE IF NOT EXISTS \`${T(r)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,...R({username:d,password:E}),...N.flatMap(R),"FLUSH PRIVILEGES;","TS_CLOUD_SQL_EOF"]}var sA="/var/backups/ts-cloud",sa="/etc/ts-cloud/backups.config.ts",eU="/etc/cron.d/ts-cloud-backups",ic="/usr/local/bin/ts-cloud-backup.sh";function oa(t){if(!t.name)return null;let e=t.host||"127.0.0.1",r=t.engine==="postgres",d=r?"postgresql":"mysql",E=t.port??(r?5432:3306),n=(c)=>c.replace(/\\/g,"\\\\").replace(/'/g,"\\'");return["  {",`    type: '${d}',`,`    name: '${n(t.name)}',`,"    connection: {",`      hostname: '${n(e)}',`,`      port: ${E},`,`      database: '${n(t.name)}',`,`      username: '${n(t.username||t.name)}',`,`      password: '${n(t.password||"")}',`,"      ssl: false,","    },","    includeSchema: true,","    includeData: true,","  },"].join(`
 `)}function ma(t,e){let r=t?oa(t):null,d=e.bucket?["  destinations: [","    {","      type: 's3',",`      bucket: '${e.bucket}',`,"      prefix: 'db-backups',",...e.endpoint?[`      endpoint: '${e.endpoint}',`]:[],"      optional: false,","    },","  ],"]:[];return["import type { BackupConfig } from 'ts-backups'","","const config: BackupConfig = {","  verbose: true,",`  outputPath: '${sA}',`,"  retention: {",`    count: ${e.retentionCount??5},`,`    maxAge: ${e.retentionDays??30},`,"  },","  databases: [",...r?[r]:[],"  ],",...d,"}","","export default config",""].join(`
 `)}function Nh(t){let{database:e,backups:r}=t;if(!r.enabled)return[];let d=r.schedule||"0 2 * * *",E=ma(e,r);return["export DEBIAN_FRONTEND=noninteractive",`mkdir -p /etc/ts-cloud ${sA}`,"command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf /root/.bun/bin/bun /usr/local/bin/bun)","bun add -g ts-backups || true",`cat > ${sa} <<'TS_CLOUD_BACKUP_CFG_EOF'`,E.replace(/\n$/,""),"TS_CLOUD_BACKUP_CFG_EOF",`cat > ${ic} <<'TS_CLOUD_BACKUP_RUN_EOF'`,"#!/bin/bash","set -uo pipefail",'export PATH="/root/.bun/bin:/usr/local/bin:$PATH"','notify() { [ -x /usr/local/bin/ts-cloud-notify ] && /usr/local/bin/ts-cloud-notify "$1" || true; }',"cd /etc/ts-cloud",'if ! ts-backups backup --config /etc/ts-cloud/backups.config.ts; then notify "❌ ts-cloud backup failed"; exit 1; fi',"TS_CLOUD_BACKUP_RUN_EOF",`chmod +x ${ic}`,`cat > ${eU} <<'TS_CLOUD_BACKUP_CRON_EOF'`,`${d} root ${ic} >> /var/log/ts-cloud-backup.log 2>&1`,"TS_CLOUD_BACKUP_CRON_EOF",`chmod 644 ${eU}`]}function pa(t){return t==="mariadb"?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock"}function rU(t,e={}){if(!t?.name)return[];let r=t.name,d=t.engine==="postgres",E=e.from?`TS_CLOUD_DUMP="${e.from}"`:`TS_CLOUD_DUMP="$(find ${sA} -type f -name '*${r}*.sql' -o -type f -name '*${r}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`,n=d?`${Tc(t)} -d "${r}"`:`mysql --socket=${pa(t.engine)} -u root "${r}"`;return["set -uo pipefail",'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',E,'[ -n "$TS_CLOUD_DUMP" ] && [ -f "$TS_CLOUD_DUMP" ] || { echo "no backup dump found to restore" >&2; exit 1; }','echo "[ts-cloud] restoring '+r+' from $TS_CLOUD_DUMP"',`case "$TS_CLOUD_DUMP" in *.gz) gunzip -c "$TS_CLOUD_DUMP" ;; *) cat "$TS_CLOUD_DUMP" ;; esac | ${n}`,'echo "restore complete"']}function ZE(t=!0){if(!t)return[];return["export DEBIAN_FRONTEND=noninteractive","dpkg-query -W -f='${Status}' unattended-upgrades 2>/dev/null | grep -q 'ok installed' || apt-get install -y unattended-upgrades","cat > /etc/apt/apt.conf.d/20auto-upgrades <<'TS_CLOUD_AUTOUPD_EOF'",'APT::Periodic::Update-Package-Lists "1";','APT::Periodic::Unattended-Upgrade "1";','APT::Periodic::Download-Upgradeable-Packages "1";','APT::Periodic::AutocleanInterval "7";',"TS_CLOUD_AUTOUPD_EOF","systemctl enable --now unattended-upgrades 2>/dev/null || true"]}var dU=[["nginx",80],["https",443],["phpFpm",9074],["mysql",3306],["postgres",5432],["redis",6379],["meilisearch",7700],["typesense",8108],["smtp",25]];function tj(t=!0){let e=typeof t==="object"?t:{};return{enabled:typeof t==="boolean"?t:t.enabled!==!1,cpuLoadPerCore:e.alerts?.cpuLoadPerCore??2,memPercent:e.alerts?.memPercent??90,diskPercent:e.alerts?.diskPercent??90}}function kE(t=!0){let{enabled:e,cpuLoadPerCore:r,memPercent:d,diskPercent:E}=tj(t);if(!e)return[];let n=dU.map(([_,i])=>`SVC_${_.toUpperCase()}=$(probe ${i})`),c=dU.map(([_])=>`"${_}":"$SVC_${_.toUpperCase()}"`).join(",");return["if ! command -v sadf >/dev/null 2>&1; then export DEBIAN_FRONTEND=noninteractive; apt-get update -qq; apt-get install -y -qq sysstat; fi","systemctl enable --now sysstat.service 2>/dev/null || true","mkdir -p /var/lib/ts-cloud","cat > /usr/local/bin/ts-cloud-metrics.sh <<'TS_CLOUD_METRICS_EOF'","#!/bin/bash","set -uo pipefail","LOAD=$(cut -d' ' -f1 /proc/loadavg)","CPUS=$(nproc)",`read MEM_TOTAL MEM_USED SWAP_TOTAL SWAP_USED <<EOF
 $(free -m | awk '/^Mem:/{total=$2; used=$3} /^Swap:/{print total, used, $2, $3}')
@@ -6136,7 +6136,7 @@ console.log(JSON.stringify({
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,t.organizationId,t.projectId,t.environmentId??null,t.releaseId,t.kind,t.format,t.digest,Jr(t.summary),t.content??null,t.sensitive?1:0,d]),this.controlPlane.appendEvent({organizationId:t.organizationId,projectId:t.projectId,type:"security.release_artifact.created",payload:{artifactId:r,releaseId:t.releaseId,kind:t.kind,format:t.format,digest:t.digest,sensitive:t.sensitive}}),LL(this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE id = ?").get(r))}listReleaseArtifacts(t,e=!1){return this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? ORDER BY created_at, kind").all(t).map(LL).map((r)=>r.sensitive&&!e?{...r,content:void 0}:r)}summary(t,e,r){let d=this.listFindings({organizationId:t,projectId:e,environmentId:r,limit:1000}),E=this.listScanRuns({organizationId:t,projectId:e,environmentId:r,limit:1000}),n={info:0,low:0,medium:0,high:0,critical:0};for(let _ of d)if(_.status==="open"||_.status==="acknowledged")n[_.severity]++;let c={passed:0,failed:0,skipped:0,unavailable:0,unsupported:0,stale:0};for(let _ of E)c[_.status]++;return{open:n,waived:d.filter((_)=>_.status==="waived").length,resolved:d.filter((_)=>_.status==="resolved").length,checks:c,lastScannedAt:E[0]?.completedAt}}exportPosture(t){let e=this.controlPlane.listProjects().filter((r)=>r.organizationId===t);return Lt({format:"ts-cloud-security-posture",version:1,exportedAt:this.now(),organizationId:t,policies:this.listPolicies(t),findings:this.listFindings({organizationId:t,limit:1000}),waivers:this.listWaivers().filter((r)=>this.getFinding(r.findingId)?.organizationId===t),scans:e.flatMap((r)=>this.listScanRuns({organizationId:t,projectId:r.id,limit:1000})),decisions:e.flatMap((r)=>this.controlPlane.listEnvironments(r.id).flatMap((d)=>this.listDecisions(d.id,1000)))})}}sT();import{existsSync as wz,readdirSync as gz,readFileSync as $z,statSync as yz}from"node:fs";import{extname as Xz,join as Pz,relative as az}from"node:path";var VU=[{name:"AWS Access Key ID",pattern:/(?:^|[^A-Z0-9])((AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16})(?:[^A-Z0-9]|$)/g,severity:"critical",description:"AWS Access Key ID detected"},{name:"AWS Secret Access Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key|secretAccessKey)['"]?\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,severity:"critical",description:"AWS Secret Access Key detected"},{name:"AWS Secret Key (Generic)",pattern:/(?:^|['"`:=\s])([A-Za-z0-9/+=]{40})(?:['"`\s]|$)/g,severity:"high",description:"Potential AWS Secret Key (40-char base64)"},{name:"Generic API Key",pattern:/(?:api[_-]?key|apikey|api[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9_\-]{20,})['"]?/gi,severity:"high",description:"Generic API key detected"},{name:"RSA Private Key",pattern:/-----BEGIN RSA PRIVATE KEY-----/g,severity:"critical",description:"RSA private key detected"},{name:"OpenSSH Private Key",pattern:/-----BEGIN OPENSSH PRIVATE KEY-----/g,severity:"critical",description:"OpenSSH private key detected"},{name:"EC Private Key",pattern:/-----BEGIN EC PRIVATE KEY-----/g,severity:"critical",description:"EC private key detected"},{name:"PGP Private Key",pattern:/-----BEGIN PGP PRIVATE KEY BLOCK-----/g,severity:"critical",description:"PGP private key detected"},{name:"GitHub Token",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"critical",description:"GitHub personal access token detected"},{name:"GitHub OAuth",pattern:/github[_-]?oauth[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9_]{40})['"]?/gi,severity:"critical",description:"GitHub OAuth token detected"},{name:"Slack Token",pattern:/xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*/g,severity:"critical",description:"Slack token detected"},{name:"Slack Webhook",pattern:/https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g,severity:"high",description:"Slack webhook URL detected"},{name:"Discord Webhook",pattern:/https:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]+/g,severity:"high",description:"Discord webhook URL detected"},{name:"JWT Token",pattern:/eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,severity:"high",description:"JWT token detected"},{name:"Google API Key",pattern:/AIza[0-9A-Za-z_-]{35}/g,severity:"critical",description:"Google API key detected"},{name:"Google OAuth ID",pattern:/[0-9]+-[A-Za-z0-9_]{32}\.apps\.googleusercontent\.com/g,severity:"high",description:"Google OAuth client ID detected"},{name:"Firebase API Key",pattern:/(?:firebase[_-]?api[_-]?key)\s*[=:]\s*['"]?([A-Za-z0-9_-]{39})['"]?/gi,severity:"critical",description:"Firebase API key detected"},{name:"Cloudflare API Token",pattern:/(?:cloudflare[_-]?api[_-]?token|cf[_-]?api[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{40})['"]?/gi,severity:"critical",description:"Cloudflare API token detected"},{name:"Azure Client Secret",pattern:/(?:azure[_-]?client[_-]?secret|client[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9~._-]{34,})['"]?/gi,severity:"critical",description:"Azure client secret detected"},{name:"Heroku API Key",pattern:/(?:heroku[_-]?api[_-]?key)\s*[=:]\s*['"]?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]?/gi,severity:"critical",description:"Heroku API key detected"},{name:"Database Connection String",pattern:/(?:mysql|postgres|postgresql|mongodb|redis|mongodb\+srv):\/\/[^:]+:[^@]+@[^/\s]+/gi,severity:"critical",description:"Database connection string with credentials detected"},{name:"Database Password",pattern:/(?:db[_-]?password|database[_-]?password|mysql[_-]?password|postgres[_-]?password)\s*[=:]\s*['"]?([^'"\s]{8,})['"]?/gi,severity:"critical",description:"Database password detected"},{name:"Stripe API Key",pattern:/(?:sk|pk)_(?:test|live)_[0-9a-zA-Z]{24,}/g,severity:"critical",description:"Stripe API key detected"},{name:"PayPal Client ID",pattern:/(?:paypal[_-]?client[_-]?id)\s*[=:]\s*['"]?([A-Za-z0-9_-]{80})['"]?/gi,severity:"high",description:"PayPal client ID detected"},{name:"Square Access Token",pattern:/sq0[a-z]{3}-[0-9A-Za-z_-]{22,}/g,severity:"critical",description:"Square access token detected"},{name:"Twilio API Key",pattern:/SK[a-f0-9]{32}/g,severity:"critical",description:"Twilio API key detected"},{name:"SendGrid API Key",pattern:/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,severity:"critical",description:"SendGrid API key detected"},{name:"Mailgun API Key",pattern:/key-[0-9a-zA-Z]{32}/g,severity:"critical",description:"Mailgun API key detected"},{name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"]([^'"]{8,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded password detected"},{name:"Secret/Token Assignment",pattern:/(?:secret|token|auth[_-]?token|access[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9_\-/+=]{16,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded secret or token detected"},{name:"NPM Token",pattern:/(?:npm[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{36})['"]?/gi,severity:"critical",description:"NPM token detected"},{name:"SSH Private Key Path Exposed",pattern:/~\/\.ssh\/id_[a-z]+|\/home\/[^/]+\/\.ssh\/id_[a-z]+/g,severity:"medium",description:"SSH private key path exposed"},{name:"Env Variable with Secret",pattern:/(?:process\.env\.)((?=[A-Z_]*(?:SECRET|KEY|TOKEN|PASSWORD|CREDENTIAL|AUTH))[A-Z_]+)\s*(?:===?\s*['"]([^'"]+)['"])?/g,severity:"medium",description:"Environment variable containing secret may be exposed"}],jz=[".js",".jsx",".ts",".tsx",".mjs",".cjs",".vue",".svelte",".html",".htm",".css",".scss",".less",".json",".yaml",".yml",".toml",".xml",".env",".config",".conf"],zz=["node_modules",".git",".svn",".hg","dist","build","coverage",".nyc_output","__pycache__",".pytest_cache","vendor",".idea",".vscode",".turbo",".next",".nuxt","framework.bak","pantry",".pantry","tests","test","__tests__","spec","__mocks__",".github",".gitlab",".circleci"],Fz=["package-lock.json","yarn.lock","pnpm-lock.yaml","bun.lockb","bun.lock","*.min.js","*.min.css","*.map","*.d.ts","*.test.ts","*.test.js","*.spec.ts","*.spec.js",".env",".env.*"];class Xh{patterns;excludeDirs;excludeFiles;maxFileSize;constructor(t){this.patterns=[...VU,...t?.customPatterns||[]],this.excludeDirs=[...zz,...t?.excludeDirs||[]],this.excludeFiles=[...Fz,...t?.excludeFiles||[]],this.maxFileSize=t?.maxFileSize||1048576}async scan(t){let e=Date.now(),r=[],d=0,{directory:E,exclude:n=[],include:c,skipPatterns:_=[]}=t,i=t.failOnSeverity||"critical";if(!wz(E))throw Error(`Directory not found: ${E}`);let T=this.getFilesToScan(E,[...this.excludeDirs,...n],c);for(let u of T){let U=az(E,u);if(this.shouldExcludeFile(U))continue;try{if(yz(u).size>this.maxFileSize)continue;let l=$z(u,"utf-8"),P=this.scanContent(l,U,_);r.push(...P),d++}catch{continue}}let h={critical:r.filter((u)=>u.pattern.severity==="critical").length,high:r.filter((u)=>u.pattern.severity==="high").length,medium:r.filter((u)=>u.pattern.severity==="medium").length,low:r.filter((u)=>u.pattern.severity==="low").length},R=["low","medium","high","critical"],N=R.indexOf(i),A=!0;for(let u=N;u<R.length;u++)if(h[R[u]]>0){A=!1;break}return{passed:A,findings:r,scannedFiles:d,duration:Date.now()-e,summary:h}}scanContent(t,e,r){let d=[],E=t.split(`
 `);for(let n of this.patterns){if(r.includes(n.name))continue;n.pattern.lastIndex=0;let c;while((c=n.pattern.exec(t))!==null){let _=t.substring(0,c.index),i=_.split(`
 `).length,T=_.lastIndexOf(`
-`),h=c.index-T,R=E[i-1]||"";if(this.isLikelyPlaceholder(c[0],R))continue;let N=c[1]||c[0];if(n.name==="AWS Secret Key (Generic)"&&/^[a-f0-9]{40}$/i.test(N))continue;if(n.name==="AWS Secret Key (Generic)"&&!this.hasSecretCharacterDiversity(N))continue;if(n.name==="AWS Secret Key (Generic)"&&/^(?:Actions|Commands|Controllers|Handlers|Jobs|Listeners|Middleware|Models|Resources|Services)\//.test(N))continue;if(this.isLowEntropy(N))continue;d.push({file:e,line:i,column:h,match:this.maskSecret(c[0]),pattern:n,context:this.maskSecret(R.trim())})}}return d}isLikelyPlaceholder(t,e){let r=["example","placeholder","your_","YOUR_","xxx","XXX","***","test","TEST","dummy","DUMMY","fake","FAKE","sample","SAMPLE","<your","${","{{","process.env","import.meta.env","CHANGEME","TODO","FIXME"],d=t.toLowerCase(),E=e.toLowerCase();for(let c of r)if(d.includes(c.toLowerCase())||E.includes(c.toLowerCase()))return!0;let n=e.trim();if(n.startsWith("//")||n.startsWith("#")||n.startsWith("*")||n.startsWith("/*")){if(E.includes("example")||E.includes("format:")||E.includes("e.g."))return!0}return!1}isLowEntropy(t){if(t.length<8)return!1;if(new Set(t).size<8)return!0;if(/(.)\1{3,}/.test(t))return!0;return!1}hasSecretCharacterDiversity(t){let e=/[\d+=]/.test(t),r=[/[a-z]/.test(t),/[A-Z]/.test(t),/\d/.test(t),/[/+=]/.test(t)];return e&&r.filter(Boolean).length>=3}maskSecret(t){if(t.length<=8)return"*".repeat(t.length);let e=Math.min(4,Math.floor(t.length*0.2));return t.substring(0,e)+"*".repeat(t.length-e*2)+t.substring(t.length-e)}getFilesToScan(t,e,r){let d=[],E=r||jz,n=(c)=>{let _=gz(c,{withFileTypes:!0});for(let i of _){let T=Pz(c,i.name);if(i.isDirectory()){if(!e.includes(i.name))n(T)}else if(i.isFile()){let h=Xz(i.name).toLowerCase();if(E.includes(h)||i.name.startsWith(".env")||i.name.endsWith(".config"))d.push(T)}}};return n(t),d}shouldExcludeFile(t){let e=t.split("/").pop()||"";for(let r of this.excludeFiles)if(r.startsWith("*")){let d=r.substring(1);if(e.endsWith(d))return!0}else if(r.endsWith("*")){let d=r.substring(0,r.length-1);if(e.startsWith(d))return!0}else if(e===r)return!0;return!1}addPattern(t){this.patterns.push(t)}getPatterns(){return[...this.patterns]}}function Bz(t,e){return{status:"unavailable",findings:[],error:`${t.id} exceeded its ${e}ms timeout`,metadata:{timeoutMs:e}}}class Ic{posture;defaultTimeoutMs;nowFn;constructor(t,e={}){this.posture=t;this.defaultTimeoutMs=e.defaultTimeoutMs??60000,this.nowFn=e.now??(()=>new Date)}async run(t,e){let r=this.nowFn(),d=Math.max(100,t.timeoutMs??this.defaultTimeoutMs),E=new AbortController,n,c=new Promise((h)=>{n=setTimeout(()=>{E.abort(),h(Bz(t,d))},d)}),_;try{_=await Promise.race([t.scan({...e,signal:E.signal}),c])}catch(h){_={status:"unavailable",findings:[],error:h instanceof Error?h.message:String(h)}}finally{if(n)clearTimeout(n)}let i=this.nowFn(),T={...e,scannerId:t.id,scannerVersion:t.version,status:_.status,findings:_.findings,metadata:_.metadata,error:_.error,startedAt:r.toISOString(),completedAt:i.toISOString(),durationMs:Math.max(0,i.getTime()-r.getTime())};return this.posture.recordScan(T)}async runAll(t,e){return Promise.all(t.map((r)=>this.run(r,e)))}}class Q_{scanner;id="source-secrets";version="1.0.0";timeoutMs=30000;constructor(t=new Xh){this.scanner=t}async scan(t){if(!t.artifactRoot)return{status:"skipped",findings:[],error:"No artifact root was supplied"};let e=await this.scanner.scan({directory:t.artifactRoot,failOnSeverity:"critical"});return{status:e.passed?"passed":"failed",findings:e.findings.map((r)=>({...t,ruleId:r.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:r.pattern.severity,title:r.pattern.name,description:r.pattern.description,subject:`${r.file}:${r.line}`,evidence:{file:r.file,line:r.line,column:r.column,match:r.match,context:r.context},remediation:"Remove the credential, rotate it at its issuer, and use a managed secret or environment reference."})),metadata:{scannedFiles:e.scannedFiles,summary:e.summary}}}}function Hr(t,e){let r=t.environments.get(e);if(!r)throw Error(`Security scope for environment '${e}' was not found`);return{organizationId:t.organization.id,projectId:t.project.id,environmentId:r.id}}function KU(t,e){let r=new v_(t.store),d=r.listPolicies(t.organization.id);for(let[E,n]of t.environments){if(d.some((_)=>_.environmentId===n.id))continue;let c=E==="production"||n.kind==="production";d.push(r.createPolicy({organizationId:t.organization.id,environmentId:n.id,name:c?"Production baseline":"Environment baseline",scannerFailMode:c?"closed":"open",requiredScanners:["source-secrets"],rules:c?[{minimumSeverity:"critical",action:"block"},{minimumSeverity:"high",action:"block"},{minimumSeverity:"medium",action:"warn"},{minimumSeverity:"low",action:"record"}]:[{minimumSeverity:"critical",action:"warn"},{minimumSeverity:"high",action:"warn"},{minimumSeverity:"low",action:"record"}],actorId:e}))}return d}function Jz(t,e){let r=[],d=e.security;if(d?.firewall&&!["active","configured","ok"].includes(String(d.firewall.status)))r.push({...t,ruleId:"host-firewall-disabled",severity:"high",title:"Host firewall is not active",description:String(d.firewall.summary??"The host firewall did not report an active configuration."),subject:"host:firewall",evidence:{status:String(d.firewall.status??"unknown"),rules:Array.isArray(d.firewall.rules)?d.firewall.rules.length:0},remediation:"Apply the declarative firewall policy and confirm only required listeners are public."});for(let E of d?.ports??[]){let n=String(E.listen??""),c=Number(n.match(/:(\d+)$/)?.[1]);if(E.exposure==="public"&&Number.isFinite(c)&&![22,80,443].includes(c))r.push({...t,ruleId:"unexpected-public-listener",severity:"medium",title:`Unexpected public listener on port ${c}`,description:`${String(E.processName??"A process")} is listening publicly outside the standard SSH/HTTP/HTTPS ports.`,subject:`host:port:${c}`,evidence:{protocol:String(E.proto??""),listen:n,process:String(E.processName??"")},remediation:"Bind the service to loopback/private networking or explicitly document and firewall the required public port."})}for(let E of d?.tlsCertificates??[]){let n=Number(E.daysRemaining);if(Number.isFinite(n)&&n<30)r.push({...t,ruleId:"tls-certificate-expiry",severity:n<14?"high":"medium",title:`TLS certificate expires in ${n} days`,description:`${String(E.domain??"A configured domain")} needs renewal.`,subject:`tls:${String(E.domain??"unknown")}`,evidence:{domain:String(E.domain??""),daysRemaining:n,expires:String(E.expires??"")},remediation:"Renew the certificate and verify automatic renewal can complete before expiry."})}for(let E of e.diagnostics??[]){if(E.status==="pass"||E.status==="ok")continue;r.push({...t,ruleId:`diagnostic-${String(E.name??"unknown").toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:E.status==="fail"?"high":"medium",title:String(E.name??"Host security check"),description:String(E.detail??"The host security diagnostic did not pass."),subject:`diagnostic:${String(E.name??"unknown")}`,evidence:{status:String(E.status??"unknown")},remediation:"Follow the diagnostic guidance, rerun the check, and confirm the finding resolves."})}return r}function Ph(t,e,r){let d=!!r.security||Array.isArray(r.diagnostics),E=d?Jz(e,r):[];return t.recordScan({...e,scannerId:"host-posture",scannerVersion:"1.0.0",status:!d?"unavailable":E.length?"failed":"passed",findings:E,metadata:{source:"dashboard-live-probe",checks:Array.isArray(r.diagnostics)?r.diagnostics.length:0},error:d?void 0:"Live host posture data was unavailable; source and provider checks remain usable."})}function ah(t,e){let r=t.evaluateGate({...e.scope,operationId:e.operationId}),d=t.listFindings({...e.scope,limit:1000}).filter((E)=>E.status!=="resolved");return{decision:r,summary:{desiredConfigHash:e.desiredConfigHash??null,securityImpact:{critical:d.filter((E)=>E.severity==="critical").length,high:d.filter((E)=>E.severity==="high").length,waived:d.filter((E)=>E.status==="waived").length,assigned:d.filter((E)=>!!E.ownerActorId).length},blockingFindingIds:r.findingIds,policy:{id:r.policyId,version:r.policyVersion},scannerVersions:r.scannerVersions}}}import{randomBytes as ZU,scryptSync as kU,timingSafeEqual as Hz}from"node:crypto";function DL(t,e){if(t.role==="admin")return[...e];return e.filter((r)=>!!t.sites?.[r])}var CL=32768,IL=8,lL=1,Wz=32,vz=16;function _E(t){let e=ZU(vz),r=kU(t,e,Wz,{N:CL,r:IL,p:lL,maxmem:268435456});return`scrypt$${CL}$${IL}$${lL}$${e.toString("base64url")}$${r.toString("base64url")}`}function Wr(t,e){try{let r=e.split("$");if(r.length!==6||r[0]!=="scrypt")return!1;let[,d,E,n,c,_]=r,i=Number(d),T=Number(E),h=Number(n);if(!Number.isFinite(i)||!Number.isFinite(T)||!Number.isFinite(h))return!1;let R=Buffer.from(c,"base64url"),N=Buffer.from(_,"base64url");if(R.length===0||N.length===0)return!1;let A=kU(t,R,N.length,{N:i,r:T,p:h,maxmem:268435456});return Hz(A,N)}catch{return!1}}function bU(t){let[e,r,d,E]=t.split("$");return e!=="scrypt"||Number(r)!==CL||Number(d)!==IL||Number(E)!==lL}function UL(){return ZU(18).toString("base64url")}import{createHash as Qz}from"node:crypto";function Yz(t){return Qz("sha256").update(pE(t)).digest("hex")}function pE(t){if(Array.isArray(t))return`[${t.map((e)=>pE(e)).join(",")}]`;if(t&&typeof t==="object")return`{${Object.entries(t).filter(([,e])=>e!==void 0&&typeof e!=="function").sort(([e],[r])=>e.localeCompare(r)).map(([e,r])=>`${JSON.stringify(e)}:${pE(r)}`).join(",")}}`;return JSON.stringify(t)??"null"}function Re(t,e){let r=`dashboard:${e.username.toLowerCase()}`;return t.getActorByExternalId("user",r)??t.createActor({kind:"user",externalId:r,displayName:e.name??e.username,metadata:{source:"dashboard",role:e.role}})}function qU(t,e){let r=new $T({cwd:t}),d=Yz(e),E=r.getProjectBySlug(e.project.slug),n=e.project.slug.length>=3?e.project.slug:`${e.project.slug}-org`,c=(E?.organizationId?r.getOrganization(E.organizationId):void 0)??r.getOrganizationBySlug(n)??r.createOrganization({id:E?.organizationId,slug:n,name:e.project.name}),_=E?E.name!==e.project.name||E.desiredConfigHash!==d||E.organizationId!==c.id?r.updateProject(E.id,E.version,{name:e.project.name,organizationId:c.id,desiredConfigHash:d}):E:r.createProject({organizationId:c.id,slug:e.project.slug,name:e.project.name,desiredConfigHash:d}),i=new Map;for(let[N,A]of Object.entries(e.environments??{})){let U=r.getEnvironmentBySlug(_.id,N)??r.createEnvironment({projectId:_.id,slug:N,name:N.replace(/(^|[-_])(\w)/g,(j,B,F)=>F.toUpperCase()),kind:String(A?.type??N),region:A?.region??e.project.region,desiredState:Lt(A)});i.set(N,U);let w=new Map(r.listResources(_.id,U.id).map((j)=>[`${j.kind}:${j.slug}`,j])),l=(j,B,F,J)=>{let K=`${j}:${B}`,s=w.get(K),tt=Lt(J);if(s){if(s.name!==F||pE(s.desiredState)!==pE(tt))w.set(K,r.updateResource(s.id,s.version,{name:F,desiredState:tt}));return}let q=r.createResource({projectId:_.id,environmentId:U.id,kind:j,slug:B,name:F,provider:e.cloud?.provider,desiredState:tt,metadata:{source:"cloud-config"}});w.set(K,q)};for(let[j,B]of Object.entries(e.sites??{}))l("application",j,j,B);let P=A?.app;if(P)for(let j of["http","queue","cli"])l("function",j,`${j.toUpperCase()} function`,{...Lt(P),function:j});let a=e.infrastructure;for(let[j,B]of Object.entries(a?.functions??{}))l("function",j,j,B);if(a?.compute)l("server",`${_.slug}-server`,_.name,{...Lt(a.compute),label:_.name});for(let[j,B]of Object.entries(a?.databases??{}))l("database",j,j,B);if(a?.appDatabase)l("database","application-database","Application database",a.appDatabase);else if(a?.database)l("database","application-database","Application database",{engine:a.database})}let T=new yt(r).recoverExpired(),h=r.reconcileOrphanedOperations({policy:"fail"}),R={requeued:T.requeued+h.requeued,failed:T.failed+T.cancelled+h.failed};return{store:r,organization:c,project:_,environments:i,reconciliation:R}}var Mz=["project:read","config:read","deployments:read","deployments:create","runtime:read","runtime:logs"];function jh(t,e){let{store:r,organization:d,project:E}=t,n=new Set;for(let c of e){let _=Re(r,c);n.add(_.id);let i=r.getMembershipForActor(d.id,_.id);if(i&&i.source!=="legacy")continue;let T=r.listResources(E.id).filter((u)=>u.kind==="application"&&Object.hasOwn(c.sites,u.slug)),h=c.role==="admin"?"owner":"viewer",R=c.role==="admin"||T.length===0?{type:"organization"}:{type:"resource",id:T[0].id},N=i?i.roleTemplate!==h||pE(i.scope)!==pE(R)?r.updateMembership({id:i.id,roleTemplate:h,scope:R,actorId:_.id}):i:r.createMembership({organizationId:d.id,actorId:_.id,roleTemplate:h,scope:R,source:"legacy"}),A=new Set;if(c.role==="member"&&T.length===0)for(let u of In("viewer"))A.add(`deny|${u}|organization|`);for(let u of T){let U=c.sites[u.slug];for(let w of Mz)A.add(`allow|${w}|resource|${u.id}`);if(U==="owner")A.add(`allow|config:write|resource|${u.id}`)}for(let u of r.listGrants(N.id).filter((U)=>U.source==="legacy")){let U=`${u.effect}|${u.capability}|${u.scope.type}|${u.scope.id??""}`;if(!A.has(U))r.removeGrant(u.id,_.id)}for(let u of A){let[U,w,l,P]=u.split("|");r.upsertGrant({organizationId:d.id,membershipId:N.id,effect:U,capability:w,scope:l==="organization"?{type:"organization"}:{type:l,id:P},source:"legacy"})}}for(let c of r.listMemberships(d.id))if(c.source==="legacy"&&!n.has(c.actorId))r.revokeMembership(c.id)}async function fd(t){let{controlPlane:e,environment:r,actor:d}=t,E=Re(e.store,d),n=e.environments.get(r),c=t.resourceSlug&&n?e.store.listResources(e.project.id,n.id).find((h)=>h.slug===t.resourceSlug):void 0,_=new yt(e.store,{workerId:`dashboard:${process.pid}`}),i=_.enqueue({projectId:e.project.id,environmentId:n?.id,resourceId:c?.id,actorId:E.id,kind:t.kind,input:t.input??{},lockKey:c?`resource:${c.id}`:n?`environment:${n.id}`:`project:${e.project.id}`,providerKey:c?.provider??"dashboard",buildSlot:t.kind.includes("deploy"),maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!_.claim(i.id)?.operation)throw Error(`Could not claim control-plane operation ${i.id}`);try{let h=await t.execute(),R=typeof h.stdout==="string"?String(h.stdout):"",N=typeof h.stderr==="string"?String(h.stderr):"";if(R)_.appendLog(i.id,R,{stream:"stdout"});if(N)_.appendLog(i.id,N,{stream:"stderr"});let A=h.ok?_.complete(i.id,xU(h)):_.fail(i.id,Gz(h),xU(h));return{result:h,operation:A}}catch(h){throw _.fail(i.id,h instanceof Error?h.message:String(h),{ok:!1,threw:!0}),h}}function Gz(t){let e=t;return String(e.error??e.stderr??"Operation failed")}function xU(t){let e=t,r=typeof e.stdout==="string"?e.stdout:"",d=typeof e.stderr==="string"?e.stderr:"",E={ok:t.ok,stdoutBytes:Buffer.byteLength(r),stderrBytes:Buffer.byteLength(d)};if(typeof e.operation==="string")E.operation=e.operation;if(typeof e.error==="string")E.error=e.error;return Lt(E)}await Wt();At();class wd{client;region;constructor(t="us-east-1",e){this.region=t,this.client=new dt(Fn(e))}async query(t){let e=new URLSearchParams(Mt({Version:"2010-08-01",...t})).toString();return this.client.request({service:"monitoring",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:e})}async getMetricStatistics(t){let e={Action:"GetMetricStatistics",Namespace:t.Namespace,MetricName:t.MetricName,StartTime:t.StartTime.toISOString(),EndTime:t.EndTime.toISOString(),Period:t.Period};(t.Statistics??[]).forEach((n,c)=>{e[`Statistics.member.${c+1}`]=n}),(t.ExtendedStatistics??[]).forEach((n,c)=>{e[`ExtendedStatistics.member.${c+1}`]=n}),(t.Dimensions??[]).forEach((n,c)=>{e[`Dimensions.member.${c+1}.Name`]=n.Name,e[`Dimensions.member.${c+1}.Value`]=n.Value});let r=await this.query(e),E=(r.GetMetricStatisticsResult||r)?.Datapoints?.member??[];if(!Array.isArray(E))E=E?[E]:[];return E.map((n)=>{let c={},_=n.ExtendedStatistics?.entry;if(_){if(!Array.isArray(_))_=[_];for(let i of _)if(i?.key!=null)c[i.key]=Number(i.value)}return{Timestamp:n.Timestamp,Sum:n.Sum!=null?Number(n.Sum):void 0,Average:n.Average!=null?Number(n.Average):void 0,Maximum:n.Maximum!=null?Number(n.Maximum):void 0,Minimum:n.Minimum!=null?Number(n.Minimum):void 0,Percentiles:Object.keys(c).length?c:void 0,Unit:n.Unit}})}async getMetricSeries(t){let e=/^p\d/.test(t.Stat);return(await this.getMetricStatistics({Namespace:t.Namespace,MetricName:t.MetricName,Dimensions:t.Dimensions,StartTime:t.StartTime,EndTime:t.EndTime,Period:t.Period,Statistics:e?[]:[t.Stat],ExtendedStatistics:e?[t.Stat]:[]})).slice().sort((d,E)=>new Date(d.Timestamp??0).getTime()-new Date(E.Timestamp??0).getTime()).map((d)=>e?d.Percentiles?.[t.Stat]??0:d[t.Stat]??0)}async describeAlarms(t){let e={Action:"DescribeAlarms"};if(t?.AlarmNamePrefix)e.AlarmNamePrefix=t.AlarmNamePrefix;if(t?.MaxRecords)e.MaxRecords=t.MaxRecords;let r=await this.query(e),E=(r.DescribeAlarmsResult||r)?.MetricAlarms?.member??[];if(!Array.isArray(E))E=E?[E]:[];return E.map((n)=>({AlarmName:n.AlarmName,StateValue:n.StateValue,MetricName:n.MetricName,ComparisonOperator:n.ComparisonOperator,Threshold:n.Threshold!=null?Number(n.Threshold):void 0,Namespace:n.Namespace}))}async putMetricAlarm(t){let e={Action:"PutMetricAlarm",AlarmName:t.AlarmName,Namespace:t.Namespace,MetricName:t.MetricName,ComparisonOperator:t.ComparisonOperator,Threshold:t.Threshold,EvaluationPeriods:t.EvaluationPeriods,Period:t.Period,Statistic:t.Statistic};if(t.AlarmDescription)e.AlarmDescription=t.AlarmDescription;(t.Dimensions??[]).forEach((r,d)=>{e[`Dimensions.member.${d+1}.Name`]=r.Name,e[`Dimensions.member.${d+1}.Value`]=r.Value}),(t.AlarmActions??[]).forEach((r,d)=>{e[`AlarmActions.member.${d+1}`]=r}),await this.query(e)}async deleteAlarms(t){if(!t.length)return;let e={Action:"DeleteAlarms"};t.forEach((r,d)=>{e[`AlarmNames.member.${d+1}`]=r}),await this.query(e)}}er();At();class fL{client;region;constructor(t="us-east-1"){this.region=t,this.client=new dt}async call(t,e){return this.client.request({service:"wafv2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSWAF_20190729.${t}`},body:JSON.stringify(e)})}async listWebACLs(t="REGIONAL"){return(await this.call("ListWebACLs",{Scope:t,Limit:100}))?.WebACLs??[]}async getWebACLRules(t,e,r="REGIONAL"){return((await this.call("GetWebACL",{Name:t,Id:e,Scope:r}))?.WebACL?.Rules??[]).map((n)=>({Name:n.Name,Priority:n.Priority,Action:n.Action?Object.keys(n.Action)[0]:n.OverrideAction?Object.keys(n.OverrideAction)[0]:"count"}))}}sU();await Wt();er();function lc(t,e){let r=t.environments?.[e]?.app;if(!r)throw Error(`No serverless app configured for environment '${e}'. Add environments.${e}.app to your config.`);let d=t.project.slug,E=t.environments?.[e]?.region||t.project.region||"us-east-1";return{app:r,slug:d,region:E,stackName:Cn(t,e),artifactBucket:vu(d,e),assetsBucket:Qu(d,e)}}async function en(t,e=8){let r;for(let d=0;d<e;d++)try{return await t()}catch(E){let n=E?.code||E?.name||"",c=String(E?.message||"");if(n==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(c)){r=E,await new Promise((_)=>setTimeout(_,3000));continue}throw E}throw r}var oU=(t,e)=>`releases/${t}/${e}/current.json`;async function gL(t,e,r,d){try{return await t.getObjectJson(e,oU(r,d))}catch{return null}}async function Kz(t,e,r,d,E){await t.putObjectJson(e,oU(r,d),E)}function Zz(t,e){let r=Object.entries(e).reduce((d,[E,n])=>d+Buffer.byteLength(`${E}=${n}`,"utf8"),0);if(r>4096){let d=Object.entries(e).map(([E,n])=>[E,Buffer.byteLength(`${E}=${n}`,"utf8")]).sort((E,n)=>n[1]-E[1]).slice(0,5).map(([E,n])=>`${E} (${n}B)`).join(", ");throw Error(`${t}: environment variables total ${r}B, over AWS's 4096B limit (${r-4096}B too large). Largest: ${d}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function mU(t,e,r,d){Zz(e,r),await en(()=>t.updateFunctionConfiguration({FunctionName:e,Environment:{Variables:r}})),await t.waitForFunctionActive(e,120);let E=d.kind==="image"?{FunctionName:e,ImageUri:d.imageUri}:{FunctionName:e,S3Bucket:d.bucket,S3Key:d.key};await en(()=>t.updateFunctionCode(E)),await t.waitForFunctionActive(e,120)}async function kz(t,e){let d=(await en(()=>t.publishVersion({FunctionName:e}))).Version;if(!d)throw Error(`publishVersion returned no version for ${e}`);return await en(()=>t.updateAlias({FunctionName:e,Name:"live",FunctionVersion:d})),d}async function pU(t,e){let r=lc(t,e),d=new re(r.region),E=new Er(r.region),n=await gL(d,r.artifactBucket,r.slug,e);if(!n)throw Error("No previous release to redeploy. Run a full deploy first.");wL(`Redeploying ${r.slug} (${e}) — build ${n.sha.slice(0,12)}`);for(let[c,_]of Object.entries(n.functionNames)){if(!_)continue;zh(`Re-activating ${c} (${_})`),await mU(E,_,n.functionEnv[c]??{},n.code);let i=n.functionVersions?.[c];if(i)await en(()=>E.updateAlias({FunctionName:_,Name:"live",FunctionVersion:i}))}Y_("Redeploy complete")}async function tf(t,e){let r=lc(t,e),d=new re(r.region),E=new Er(r.region),n=await gL(d,r.artifactBucket,r.slug,e);if(!n?.previousCode)throw Error("No previous release to roll back to.");wL(`Rolling back ${r.slug} (${e}) → ${n.previousSha?.slice(0,12)}`);for(let[c,_]of Object.entries(n.functionNames)){if(!_)continue;zh(`Restoring ${c} (${_})`);let i=n.previousFunctionEnv?.[c]??n.functionEnv[c]??{};await mU(E,_,i,n.previousCode);let T=n.previousFunctionVersions?.[c];if(T)await en(()=>E.updateAlias({FunctionName:_,Name:"live",FunctionVersion:T}))}await Kz(d,r.artifactBucket,r.slug,e,{...n,sha:n.previousSha??n.sha,code:n.previousCode,functionEnv:n.previousFunctionEnv??n.functionEnv,functionVersions:n.previousFunctionVersions??n.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),Y_("Rollback complete")}async function $L(t,e,r,d){let E=lc(t,e),n=new Er(E.region),c=`${E.slug}-${e}-http`,i={...(await n.getFunction(c)).Configuration?.Environment?.Variables??{}};if(i.MAINTENANCE_MODE=r?"1":"0",r&&d)i.MAINTENANCE_BYPASS_SECRET=d;if(!r)delete i.MAINTENANCE_BYPASS_SECRET;if(await en(()=>n.updateFunctionConfiguration({FunctionName:c,Environment:{Variables:i}})),(E.app.provisionedConcurrency??0)>0)await n.waitForFunctionActive(c,120),await kz(n,c);Y_(r?"Application is now in maintenance mode (503)":"Application is live")}async function M_(t,e,r){let d=lc(t,e),E=new Er(d.region),n=`${d.slug}-${e}-cli`,c=await E.invoke({FunctionName:n,InvocationType:"RequestResponse",Payload:{command:r},LogType:"Tail"});if(c.FunctionError)throw Error(`Command failed: ${c.Payload}`);return c.Payload??""}async function Le(t,e){let r=lc(t,e),d=new sr(r.region),E=new Er(r.region),n=new re(r.region),c="not deployed",_={};try{let{Stacks:u}=await d.describeStacks({stackName:r.stackName});c=u?.[0]?.StackStatus??c;for(let U of u?.[0]?.Outputs??[])if(U.OutputKey)_[U.OutputKey]=U.OutputValue??""}catch{}let i=vO(r.app,r.slug,e),T=r.app.provisionedConcurrency??0,h=["http","cli",...i.length?["queue"]:[]],R=`${r.slug}-${e}`,N=[];for(let u of h){let U=`${R}-${u}`,w={mode:u,name:U,version:"$LATEST"};if(T>0){let l=await E.getAlias(U,"live").catch(()=>null);if(l?.FunctionVersion){w.version=l.FunctionVersion;let P=await E.getProvisionedConcurrencyConfig(U,"live").catch(()=>null);if(P)w.provisioned={status:P.Status??"-",allocated:P.AllocatedProvisionedConcurrentExecutions??0,requested:P.RequestedProvisionedConcurrentExecutions??0}}}N.push(w)}let A=await gL(n,r.artifactBucket,r.slug,e).catch(()=>null);return{slug:r.slug,environment:e,region:r.region,stackStatus:c,endpoint:_.HttpApiEndpoint,assetUrl:A?.assetUrl,scheduler:r.app.scheduler??"on",queues:i,provisionedConcurrency:T,functions:N,lastRelease:A?{sha:A.sha,timestamp:A.timestamp}:void 0}}function bz(t,e){return`${t}-${e}-db`}async function ef(t,e,r,d){let E=lc(t,e);if(E.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:n}=await Promise.resolve().then(() => (Bn(),rI)),c=new n(E.region),_=bz(E.slug,e);zh(`Scaling ${_} → ${r}–${d} ACUs`),await c.modifyDBCluster({DBClusterIdentifier:_,ServerlessV2ScalingConfiguration:{MinCapacity:r,MaxCapacity:d},ApplyImmediately:!0}),Y_(`Scaling applied to ${_} (takes effect shortly).`)}function rf(t){return String(t).padStart(2,"0")}function Dc(t){return`${t.getUTCFullYear()}-${rf(t.getUTCMonth()+1)}-${rf(t.getUTCDate())}`}function xz(t){let e=Math.max(0,Math.round((Date.now()-t)/1000));if(e<60)return`${e}s ago`;let r=Math.round(e/60);if(r<60)return`${r}m ago`;let d=Math.round(r/60);if(d<48)return`${d}h ago`;return`${Math.round(d/24)}d ago`}async function G_(t,e,r,d,E,n){let c=await t.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:r,Dimensions:[{Name:"FunctionName",Value:e}],StartTime:E,EndTime:n,Period:86400,Statistics:[d]}).catch(()=>[]);if(!c.length)return 0;if(d==="Sum")return c.reduce((_,i)=>_+(i.Sum??0),0);if(d==="Maximum")return Math.max(...c.map((_)=>_.Maximum??0));return c.reduce((_,i)=>_+(i.Average??0),0)/c.length}async function V_(t,e,r,d,E,n,c){let _=await t.getMetricStatistics({Namespace:e,MetricName:r,Dimensions:d,StartTime:n,EndTime:c,Period:86400,Statistics:[E]}).catch(()=>[]);if(!_.length)return 0;if(E==="Sum")return _.reduce((i,T)=>i+(T.Sum??0),0);if(E==="Maximum")return Math.max(..._.map((i)=>i.Maximum??0));return _.reduce((i,T)=>i+(T.Average??0),0)/_.length}async function yL(t,e,r,d,E){let n=await t.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:[{Name:"FunctionName",Value:e}],StartTime:d,EndTime:E,Period:86400,ExtendedStatistics:[r]}).catch(()=>[]);return Math.round(n.reduce((c,_)=>c+(_.Percentiles?.[r]??0),0))}async function Fh(t,e){let r=await Le(t,e),d=r.region,E=new wd(d),n=new Er(d),c=new X_(d),_=new Date,i=new Date(_.getTime()-86400000),T=t.environments?.[e]?.app,h={};h.app={name:r.slug,env:e,region:d,runtime:T?.kind==="php"?`php-${T?.phpVersion??"8.3"} (fpm)`:T?.kind??"node",url:r.endpoint??"",build:r.lastRelease?.sha?.slice(0,7)??"—",deployedAt:r.lastRelease?.timestamp??"—"},h.maintenance={enabled:!1},h.scheduler={enabled:r.scheduler!=="off",expression:r.scheduler==="sub-minute"?"rate(1 minute) · sub-minute":"rate(1 minute)",lastRun:"—"};let R=0,N=0,A=0,u=[],U=[],w=[];for(let j of r.functions){let[B,F,J,K,s,tt,q,it,Et]=await Promise.all([G_(E,j.name,"Invocations","Sum",i,_),G_(E,j.name,"Errors","Sum",i,_),G_(E,j.name,"Throttles","Sum",i,_),G_(E,j.name,"Duration","Average",i,_),n.getFunction(j.name).catch(()=>null),yL(E,j.name,"p50",i,_),yL(E,j.name,"p95",i,_),yL(E,j.name,"p99",i,_),E.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:j.name}],StartTime:new Date(_.getTime()-43200000),EndTime:_,Period:3600,Stat:"Sum"}).catch(()=>[])]);R+=B,N+=F,A=Math.max(A,K);let lt=s?.Configuration?.MemorySize??0,gt=Object.keys(s?.Configuration?.Environment?.Variables??{}),$=[],W=0;try{let{events:x=[]}=await c.filterLogEvents({logGroupName:`/aws/lambda/${j.name}`,startTime:i.getTime(),limit:120});for(let Nt of x){let o=(Nt.message??"").trim(),It=/Max Memory Used:\s*(\d+)\s*MB/.exec(o);if(It)W=Math.max(W,Number(It[1]));if(o&&!/^(?:START|END|REPORT|INIT_START)/.test(o))w.push({source:j.mode||j.name,timestamp:new Date(Nt.timestamp??0).toISOString(),when:xz(Nt.timestamp??0),message:o.slice(0,400),level:/error|exception|fatal|panic|traceback/i.test(o)?"error":/warn|warning|timeout|retr(?:y|ies)|throttl/i.test(o)?"warn":"info"})}$=x.filter((Nt)=>!/^(?:START|END|REPORT|INIT_START)/.test((Nt.message??"").trim())).slice(-6).map((Nt)=>({ts:new Date(Nt.timestamp??0).toISOString().slice(11,19),msg:(Nt.message??"").trim().slice(0,120),err:/error|exception|fatal/i.test(Nt.message??"")}))}catch{}let V=Math.max(1,...Et);u.push({key:j.mode,name:j.name,version:j.version,memory:lt,timeout:s?.Configuration?.Timeout??0,runtime:s?.Configuration?.Runtime??"provided.al2023",invocations:Math.round(B),errors:Math.round(F),p95:q||Math.round(K),status:"active",provisioned:j.provisioned?`${j.provisioned.allocated}/${j.provisioned.requested}`:void 0}),U.push({key:j.mode,name:j.name,runtime:s?.Configuration?.Runtime??"provided.al2023",arch:s?.Configuration?.Architectures?.[0]??"x86_64",memory:lt,timeout:s?.Configuration?.Timeout??0,ephemeral:s?.Configuration?.EphemeralStorage?.Size??512,version:j.version,concurrency:T?.concurrency??"—",invocations:Math.round(B),errors:Math.round(F),throttles:Math.round(J),p50:tt||Math.round(K),p95:q||Math.round(K),p99:it||Math.round(K),maxMem:W,spark:Et.length?Et.map((x)=>Math.round(x/V*100)):[0],env:gt.length?gt:["(none)"],recent:$.length?$:[{ts:"—",msg:"no recent events",err:!1}]})}h.functions=u,h.functionsDetail=U,h.serverlessLogs=w.sort((j,B)=>String(B.timestamp).localeCompare(String(j.timestamp))).slice(0,600),h.serverlessLogsEmptyReason=w.length?void 0:"No recent function logs were found in CloudWatch for this environment.";let l=R?Number((N/R*100).toFixed(2)):0,P=Math.round(await G_(E,r.functions[0]?.name??"","ConcurrentExecutions","Maximum",i,_));h.metrics={invocations:Math.round(R),errorRatePct:l,p95Ms:Math.round(A),coldStartPct:void 0,concurrency:P,estCostUsd:void 0};try{let j=new pd(d),B=[],F=[],J=0;try{let{QueueUrl:s}=await j.getQueueUrl(`${r.slug}-${e}-dlq`),{Attributes:tt}=await j.getQueueAttributes(s);J=Number(tt.ApproximateNumberOfMessages??0)}catch{}let K=T?Wc(T,r.slug,e):[];for(let s of K){let tt=s.name.replace(`${r.slug}-${e}-`,""),q=0,it=0;try{let{QueueUrl:lt}=await j.getQueueUrl(s.name),{Attributes:gt}=await j.getQueueAttributes(lt);q=Number(gt.ApproximateNumberOfMessages??0),it=Number(gt.ApproximateNumberOfMessagesNotVisible??0)}catch{}let Et=Math.round(await V_(E,"AWS/SQS","NumberOfMessagesDeleted",[{Name:"QueueName",Value:s.name}],"Sum",i,_));B.push({name:tt,visible:q,inFlight:it,processed:Et,dlq:J}),F.push({name:s.name,short:tt,visible:q,inFlight:it,delayed:0,processed:Et,oldestSec:0,concurrency:s.concurrency??T?.queueConcurrency??"—",tries:T?.queueTries??3,visTimeout:(T?.queueTimeout??120)*6,dlq:J})}if(B.length)h.queues=B;if(F.length)h.queuesDetail=F;h.dlqItems=[]}catch{}try{let j=new sr(d),{Stacks:B}=await j.describeStacks({stackName:Cn(t,e)}),F={};for(let J of B?.[0]?.Outputs??[])if(J.OutputKey)F[J.OutputKey]=J.OutputValue??"";if(T?.database?.connection==="aurora-serverless"){let J=`${r.slug}-${e}-db`,K=[{Name:"DBClusterIdentifier",Value:J}],[s,tt]=await Promise.all([V_(E,"AWS/RDS","ServerlessDatabaseCapacity",K,"Average",i,_),V_(E,"AWS/RDS","DatabaseConnections",K,"Maximum",i,_)]);if(h.aurora={id:J,engine:"aurora-mysql",minAcu:T?.database?.minCapacity??0.5,maxAcu:T?.database?.maxCapacity??4,currentAcu:s?Number(s.toFixed(1)):T?.database?.minCapacity??0.5,database:"app",connections:Math.round(tt),status:F.DbEndpoint?"available":"creating"},T?.rdsProxy)h.proxy={name:`${r.slug}-${e}-proxy`,endpoint:F.DbProxyEndpoint??"—",pooledConns:Math.round(tt),status:"available"}}if(T?.cache?.driver==="elasticache"){let J=`${r.slug}-${e}-cache`,K=[{Name:"CacheClusterId",Value:`${J}-001`}],[s,tt]=await Promise.all([V_(E,"AWS/ElastiCache","CacheHits",K,"Sum",i,_),V_(E,"AWS/ElastiCache","CacheMisses",K,"Sum",i,_)]),q=s+tt>0?Number((s/(s+tt)*100).toFixed(1)):0;h.redis={id:J,node:"cache.t4g.micro",engine:"redis",hitRate:q,status:F.CacheEndpoint?"available":"creating"}}if(T?.efs){let J=0;try{if(F.EfsFileSystemId){let K=new VA(d),{FileSystems:s}=await K.describeFileSystems({FileSystemId:F.EfsFileSystemId});J=Number(((s?.[0]?.SizeInBytes?.Value??0)/1048576).toFixed(1))}}catch{}h.efs={id:F.EfsFileSystemId??"efs",mount:"/mnt/local",sizeMb:J,status:"available"}}h.assetsInfo=F.AssetsCdnDomain?{bucket:F.AssetsBucketName??`${r.slug}-${e}-assets`,cdn:F.AssetsCdnDomain,customDomain:T?.assetDomain??"—",assetUrl:r.assetUrl??"—",files:0,sizeMb:0,cacheHitPct:0,build:h.app.build}:void 0}catch{}if(h.assetsInfo)try{let B=await new re(d).list({bucket:h.assetsInfo.bucket,maxKeys:1000});h.assetsInfo.files=B.length,h.assetsInfo.sizeMb=Number((B.reduce((F,J)=>F+(J.Size??0),0)/1048576).toFixed(1)),h.assetsRecent=B.slice(0,8).map((F)=>({path:`/${F.Key}`,size:`${Math.max(1,Math.round((F.Size??0)/1024))} KB`,type:F.Key.split(".").pop()??""}))}catch{}try{if(T?.secrets){let j=Array.isArray(T.secrets)?T.secrets.map((B)=>({key:B.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),source:B})):Object.entries(T.secrets).map(([B,F])=>({key:B,source:String(F)}));h.secretsList=j.map((B)=>({...B,updated:"—"}))}}catch{}try{let j=new re(d),B=`${r.slug}-${e}-deployments`,F=await j.getObjectJson(B,`deployments/${r.slug}/${e}/history.json`).catch(()=>null);if(F?.records?.length)h.deploymentsDetail=F.records.slice(-12).reverse().map((J)=>({sha:(J.sha??"").slice(0,7),status:J.status??"success",when:J.timestamp??"—",took:J.took??"—",by:J.by??"—",version:J.version??"—",hooks:J.hooks??[]}))}catch{}h.metricsTotals={invocations:h.metrics.invocations,errors:Math.round(N),errorRatePct:l,p95Ms:h.metrics.p95Ms,throttles:U.reduce((j,B)=>j+B.throttles,0),coldStartPct:void 0,estCostUsd:void 0,concurrency:P},h.metricsPerFn=U.map((j)=>({key:j.key,invocations:j.invocations,errors:j.errors,throttles:j.throttles,avgMs:j.p50,maxMs:j.p99,costUsd:void 0}));try{h.invSpark=await E.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:r.functions.find((j)=>j.mode==="http")?.name??""}],StartTime:new Date(_.getTime()-86400000),EndTime:_,Period:3600,Stat:"Sum"})}catch{}try{let j=new YA,B=_,F=new Date(Date.UTC(B.getUTCFullYear(),B.getUTCMonth(),1)),J=new Date(Date.UTC(B.getUTCFullYear(),B.getUTCMonth()-1,1)),[K,s]=await Promise.all([j.getCostByService({start:Dc(F),end:Dc(B),granularity:"MONTHLY"}).catch(()=>[]),j.getCostByService({start:Dc(J),end:Dc(F),granularity:"MONTHLY"}).catch(()=>[])]);if(K.length){let tt=K.reduce((W,V)=>W+V.amount,0),q=s.reduce((W,V)=>W+V.amount,0),it=B.getUTCDate(),Et=new Date(Date.UTC(B.getUTCFullYear(),B.getUTCMonth()+1,0)).getUTCDate();h.costSummary={monthToDateUsd:Number(tt.toFixed(2)),projectedUsd:Number((tt/it*Et).toFixed(2)),lastMonthUsd:Number(q.toFixed(2)),dailyAvgUsd:Number((tt/it).toFixed(2))},h.costServices=K.filter((W)=>W.amount>0).sort((W,V)=>V.amount-W.amount).slice(0,12).map((W)=>({name:W.service,usd:Number(W.amount.toFixed(2)),note:""})),h.metrics.estCostUsd=Number((tt/it).toFixed(2)),h.metricsTotals.estCostUsd=h.metrics.estCostUsd,h.costTrend=await j.getDailyTotals({start:Dc(F),end:Dc(B)}).catch(()=>[]);let lt=K.find((W)=>/lambda/i.test(W.service))?.amount??0,gt=(W)=>W.invocations*(W.p50/1000)*(W.memory/1024),$=U.reduce((W,V)=>W+gt(V),0)||1;h.costPerFn=U.map((W)=>({key:W.key,requests:W.invocations,gbSec:Math.round(gt(W)),usd:Number((lt*(gt(W)/$)).toFixed(2))}))}}catch{}if(T?.firewall)try{let j=await E.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"BlockedRequests",StartTime:i,EndTime:_,Period:86400,Statistics:["Sum"]}).catch(()=>[]),B=await E.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"AllowedRequests",StartTime:i,EndTime:_,Period:86400,Statistics:["Sum"]}).catch(()=>[]);h.waf={enabled:!0,scope:"REGIONAL",acl:`${r.slug}-${e}-waf`,allowed24h:Math.round(B.reduce((F,J)=>F+(J.Sum??0),0)),blocked24h:Math.round(j.reduce((F,J)=>F+(J.Sum??0),0))};try{let F=new fL(d),J=await F.listWebACLs("REGIONAL"),K=J.find((s)=>s.Name?.includes(`${r.slug}-${e}`))??J[0];if(K?.Name&&K.Id){h.waf.acl=K.Name;let s=await F.getWebACLRules(K.Name,K.Id,"REGIONAL");if(s.length)h.wafRules=s.map((tt)=>({name:tt.Name??"—",detail:`priority ${tt.Priority??0}`,action:tt.Action??"count",blocked24h:0}))}}catch{}}catch{}let a=[];if(h.aurora)a.push({name:"Aurora Serverless v2",detail:`${h.aurora.id} · ${h.aurora.minAcu}-${h.aurora.maxAcu} ACU`,status:h.aurora.status});if(h.proxy)a.push({name:"RDS Proxy",detail:h.proxy.name,status:h.proxy.status});if(h.redis)a.push({name:`ElastiCache (${h.redis.engine})`,detail:`${h.redis.node} · ${h.redis.hitRate}% hit rate`,status:h.redis.status});if(h.efs)a.push({name:"EFS",detail:`${h.efs.mount} · ${h.efs.sizeMb} MB`,status:h.efs.status});if(a.length)h.dataServices=a;if(r.scheduler!=="off"&&T?.kind==="php")try{let j=await M_(t,e,"schedule:list"),B=[];for(let F of(j||"").split(`
+`),h=c.index-T,R=E[i-1]||"";if(this.isLikelyPlaceholder(c[0],R))continue;let N=c[1]||c[0];if(n.name==="AWS Secret Key (Generic)"&&/^[a-f0-9]{40}$/i.test(N))continue;if(n.name==="AWS Secret Key (Generic)"&&!this.hasSecretCharacterDiversity(N))continue;if(n.name==="AWS Secret Key (Generic)"&&/^(?:Actions|Commands|Controllers|Handlers|Jobs|Listeners|Middleware|Models|Resources|Services)\//.test(N))continue;if(this.isLowEntropy(N))continue;d.push({file:e,line:i,column:h,match:this.maskSecret(c[0]),pattern:n,context:this.maskSecret(R.trim())})}}return d}isLikelyPlaceholder(t,e){let r=["example","placeholder","your_","YOUR_","xxx","XXX","***","test","TEST","dummy","DUMMY","fake","FAKE","sample","SAMPLE","<your","${","{{","process.env","import.meta.env","CHANGEME","TODO","FIXME"],d=t.toLowerCase(),E=e.toLowerCase();for(let c of r)if(d.includes(c.toLowerCase())||E.includes(c.toLowerCase()))return!0;let n=e.trim();if(n.startsWith("//")||n.startsWith("#")||n.startsWith("*")||n.startsWith("/*")){if(E.includes("example")||E.includes("format:")||E.includes("e.g."))return!0}return!1}isLowEntropy(t){if(t.length<8)return!1;if(new Set(t).size<8)return!0;if(/(.)\1{3,}/.test(t))return!0;return!1}hasSecretCharacterDiversity(t){let e=/[\d+=]/.test(t),r=[/[a-z]/.test(t),/[A-Z]/.test(t),/\d/.test(t),/[/+=]/.test(t)];return e&&r.filter(Boolean).length>=3}maskSecret(t){if(t.length<=8)return"*".repeat(t.length);let e=Math.min(4,Math.floor(t.length*0.2));return t.substring(0,e)+"*".repeat(t.length-e*2)+t.substring(t.length-e)}getFilesToScan(t,e,r){let d=[],E=r||jz,n=(c)=>{let _=gz(c,{withFileTypes:!0});for(let i of _){let T=Pz(c,i.name);if(i.isDirectory()){if(!e.includes(i.name))n(T)}else if(i.isFile()){let h=Xz(i.name).toLowerCase();if(E.includes(h)||i.name.startsWith(".env")||i.name.endsWith(".config"))d.push(T)}}};return n(t),d}shouldExcludeFile(t){let e=t.split("/").pop()||"";for(let r of this.excludeFiles)if(r.startsWith("*")){let d=r.substring(1);if(e.endsWith(d))return!0}else if(r.endsWith("*")){let d=r.substring(0,r.length-1);if(e.startsWith(d))return!0}else if(e===r)return!0;return!1}addPattern(t){this.patterns.push(t)}getPatterns(){return[...this.patterns]}}function Bz(t,e){return{status:"unavailable",findings:[],error:`${t.id} exceeded its ${e}ms timeout`,metadata:{timeoutMs:e}}}class Ic{posture;defaultTimeoutMs;nowFn;constructor(t,e={}){this.posture=t;this.defaultTimeoutMs=e.defaultTimeoutMs??60000,this.nowFn=e.now??(()=>new Date)}async run(t,e){let r=this.nowFn(),d=Math.max(100,t.timeoutMs??this.defaultTimeoutMs),E=new AbortController,n,c=new Promise((h)=>{n=setTimeout(()=>{E.abort(),h(Bz(t,d))},d)}),_;try{_=await Promise.race([t.scan({...e,signal:E.signal}),c])}catch(h){_={status:"unavailable",findings:[],error:h instanceof Error?h.message:String(h)}}finally{if(n)clearTimeout(n)}let i=this.nowFn(),T={...e,scannerId:t.id,scannerVersion:t.version,status:_.status,findings:_.findings,metadata:_.metadata,error:_.error,startedAt:r.toISOString(),completedAt:i.toISOString(),durationMs:Math.max(0,i.getTime()-r.getTime())};return this.posture.recordScan(T)}async runAll(t,e){return Promise.all(t.map((r)=>this.run(r,e)))}}class Q_{scanner;id="source-secrets";version="1.0.0";timeoutMs=30000;constructor(t=new Xh){this.scanner=t}async scan(t){if(!t.artifactRoot)return{status:"skipped",findings:[],error:"No artifact root was supplied"};let e=await this.scanner.scan({directory:t.artifactRoot,failOnSeverity:"critical"});return{status:e.passed?"passed":"failed",findings:e.findings.map((r)=>({...t,ruleId:r.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:r.pattern.severity,title:r.pattern.name,description:r.pattern.description,subject:`${r.file}:${r.line}`,evidence:{file:r.file,line:r.line,column:r.column,match:r.match,context:r.context},remediation:"Remove the credential, rotate it at its issuer, and use a managed secret or environment reference."})),metadata:{scannedFiles:e.scannedFiles,summary:e.summary}}}}function Hr(t,e){let r=t.environments.get(e);if(!r)throw Error(`Security scope for environment '${e}' was not found`);return{organizationId:t.organization.id,projectId:t.project.id,environmentId:r.id}}function KU(t,e){let r=new v_(t.store),d=r.listPolicies(t.organization.id);for(let[E,n]of t.environments){if(d.some((_)=>_.environmentId===n.id))continue;let c=E==="production"||n.kind==="production";d.push(r.createPolicy({organizationId:t.organization.id,environmentId:n.id,name:c?"Production baseline":"Environment baseline",scannerFailMode:c?"closed":"open",requiredScanners:["source-secrets"],rules:c?[{minimumSeverity:"critical",action:"block"},{minimumSeverity:"high",action:"block"},{minimumSeverity:"medium",action:"warn"},{minimumSeverity:"low",action:"record"}]:[{minimumSeverity:"critical",action:"warn"},{minimumSeverity:"high",action:"warn"},{minimumSeverity:"low",action:"record"}],actorId:e}))}return d}function Jz(t,e){let r=[],d=e.security;if(d?.firewall&&!["active","configured","ok"].includes(String(d.firewall.status)))r.push({...t,ruleId:"host-firewall-disabled",severity:"high",title:"Host firewall is not active",description:String(d.firewall.summary??"The host firewall did not report an active configuration."),subject:"host:firewall",evidence:{status:String(d.firewall.status??"unknown"),rules:Array.isArray(d.firewall.rules)?d.firewall.rules.length:0},remediation:"Apply the declarative firewall policy and confirm only required listeners are public."});for(let E of d?.ports??[]){let n=String(E.listen??""),c=Number(n.match(/:(\d+)$/)?.[1]);if(E.exposure==="public"&&Number.isFinite(c)&&![22,80,443].includes(c))r.push({...t,ruleId:"unexpected-public-listener",severity:"medium",title:`Unexpected public listener on port ${c}`,description:`${String(E.processName??"A process")} is listening publicly outside the standard SSH/HTTP/HTTPS ports.`,subject:`host:port:${c}`,evidence:{protocol:String(E.proto??""),listen:n,process:String(E.processName??"")},remediation:"Bind the service to loopback/private networking or explicitly document and firewall the required public port."})}for(let E of d?.tlsCertificates??[]){let n=Number(E.daysRemaining);if(Number.isFinite(n)&&n<30)r.push({...t,ruleId:"tls-certificate-expiry",severity:n<14?"high":"medium",title:`TLS certificate expires in ${n} days`,description:`${String(E.domain??"A configured domain")} needs renewal.`,subject:`tls:${String(E.domain??"unknown")}`,evidence:{domain:String(E.domain??""),daysRemaining:n,expires:String(E.expires??"")},remediation:"Renew the certificate and verify automatic renewal can complete before expiry."})}for(let E of e.diagnostics??[]){if(E.status==="pass"||E.status==="ok")continue;r.push({...t,ruleId:`diagnostic-${String(E.name??"unknown").toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:E.status==="fail"?"high":"medium",title:String(E.name??"Host security check"),description:String(E.detail??"The host security diagnostic did not pass."),subject:`diagnostic:${String(E.name??"unknown")}`,evidence:{status:String(E.status??"unknown")},remediation:"Follow the diagnostic guidance, rerun the check, and confirm the finding resolves."})}return r}function Ph(t,e,r){let d=!!r.security||Array.isArray(r.diagnostics),E=d?Jz(e,r):[];return t.recordScan({...e,scannerId:"host-posture",scannerVersion:"1.0.0",status:!d?"unavailable":E.length?"failed":"passed",findings:E,metadata:{source:"dashboard-live-probe",checks:Array.isArray(r.diagnostics)?r.diagnostics.length:0},error:d?void 0:"Live host posture data was unavailable; source and provider checks remain usable."})}function ah(t,e){let r=t.evaluateGate({...e.scope,operationId:e.operationId}),d=t.listFindings({...e.scope,limit:1000}).filter((E)=>E.status!=="resolved");return{decision:r,summary:{desiredConfigHash:e.desiredConfigHash??null,securityImpact:{critical:d.filter((E)=>E.severity==="critical").length,high:d.filter((E)=>E.severity==="high").length,waived:d.filter((E)=>E.status==="waived").length,assigned:d.filter((E)=>!!E.ownerActorId).length},blockingFindingIds:r.findingIds,policy:{id:r.policyId,version:r.policyVersion},scannerVersions:r.scannerVersions}}}import{randomBytes as ZU,scryptSync as kU,timingSafeEqual as Hz}from"node:crypto";function DL(t,e){if(t.role==="admin")return[...e];return e.filter((r)=>!!t.sites?.[r])}var CL=32768,IL=8,lL=1,Wz=32,vz=16;function _E(t){let e=ZU(vz),r=kU(t,e,Wz,{N:CL,r:IL,p:lL,maxmem:268435456});return`scrypt$${CL}$${IL}$${lL}$${e.toString("base64url")}$${r.toString("base64url")}`}function Wr(t,e){try{let r=e.split("$");if(r.length!==6||r[0]!=="scrypt")return!1;let[,d,E,n,c,_]=r,i=Number(d),T=Number(E),h=Number(n);if(!Number.isFinite(i)||!Number.isFinite(T)||!Number.isFinite(h))return!1;let R=Buffer.from(c,"base64url"),N=Buffer.from(_,"base64url");if(R.length===0||N.length===0)return!1;let A=kU(t,R,N.length,{N:i,r:T,p:h,maxmem:268435456});return Hz(A,N)}catch{return!1}}function bU(t){let[e,r,d,E]=t.split("$");return e!=="scrypt"||Number(r)!==CL||Number(d)!==IL||Number(E)!==lL}function UL(){return ZU(18).toString("base64url")}import{createHash as Qz}from"node:crypto";function Yz(t){return Qz("sha256").update(pE(t)).digest("hex")}function pE(t){if(Array.isArray(t))return`[${t.map((e)=>pE(e)).join(",")}]`;if(t&&typeof t==="object")return`{${Object.entries(t).filter(([,e])=>e!==void 0&&typeof e!=="function").sort(([e],[r])=>e.localeCompare(r)).map(([e,r])=>`${JSON.stringify(e)}:${pE(r)}`).join(",")}}`;return JSON.stringify(t)??"null"}function Re(t,e){let r=`dashboard:${e.username.toLowerCase()}`;return t.getActorByExternalId("user",r)??t.createActor({kind:"user",externalId:r,displayName:e.name??e.username,metadata:{source:"dashboard",role:e.role}})}function qU(t,e){let r=new $T({cwd:t}),d=Yz(e),E=r.getProjectBySlug(e.project.slug),n=e.project.slug.length>=3?e.project.slug:`${e.project.slug}-org`,c=(E?.organizationId?r.getOrganization(E.organizationId):void 0)??r.getOrganizationBySlug(n)??r.createOrganization({id:E?.organizationId,slug:n,name:e.project.name}),_=E?E.name!==e.project.name||E.desiredConfigHash!==d||E.organizationId!==c.id?r.updateProject(E.id,E.version,{name:e.project.name,organizationId:c.id,desiredConfigHash:d}):E:r.createProject({organizationId:c.id,slug:e.project.slug,name:e.project.name,desiredConfigHash:d}),i=new Map;for(let[N,A]of Object.entries(e.environments??{})){let U=r.getEnvironmentBySlug(_.id,N)??r.createEnvironment({projectId:_.id,slug:N,name:N.replace(/(^|[-_])(\w)/g,(j,B,F)=>F.toUpperCase()),kind:String(A?.type??N),region:A?.region??e.project.region,desiredState:Lt(A)});i.set(N,U);let w=new Map(r.listResources(_.id,U.id).map((j)=>[`${j.kind}:${j.slug}`,j])),l=(j,B,F,J)=>{let K=`${j}:${B}`,s=w.get(K),tt=Lt(J);if(s){if(s.name!==F||pE(s.desiredState)!==pE(tt))w.set(K,r.updateResource(s.id,s.version,{name:F,desiredState:tt}));return}let q=r.createResource({projectId:_.id,environmentId:U.id,kind:j,slug:B,name:F,provider:e.cloud?.provider,desiredState:tt,metadata:{source:"cloud-config"}});w.set(K,q)};for(let[j,B]of Object.entries(e.sites??{}))l("application",j,j,B);let P=A?.app;if(P)for(let j of["http","queue","cli"])l("function",j,`${j.toUpperCase()} function`,{...Lt(P),function:j});let a=e.infrastructure;for(let[j,B]of Object.entries(a?.functions??{}))l("function",j,j,B);if(a?.compute)l("server",`${_.slug}-server`,_.name,{...Lt(a.compute),label:_.name});for(let[j,B]of Object.entries(a?.databases??{}))l("database",j,j,B);if(a?.appDatabase)l("database","application-database","Application database",a.appDatabase);else if(a?.database)l("database","application-database","Application database",{engine:a.database})}let T=new yt(r).recoverExpired(),h=r.reconcileOrphanedOperations({policy:"fail"}),R={requeued:T.requeued+h.requeued,failed:T.failed+T.cancelled+h.failed};return{store:r,organization:c,project:_,environments:i,reconciliation:R}}var Mz=["project:read","config:read","deployments:read","deployments:create","runtime:read","runtime:logs"];function jh(t,e){let{store:r,organization:d,project:E}=t,n=new Set;for(let c of e){let _=Re(r,c);n.add(_.id);let i=r.getMembershipForActor(d.id,_.id);if(i&&i.source!=="legacy")continue;let T=r.listResources(E.id).filter((u)=>u.kind==="application"&&Object.hasOwn(c.sites,u.slug)),h=c.role==="admin"?"owner":"viewer",R=c.role==="admin"||T.length===0?{type:"organization"}:{type:"resource",id:T[0].id},N=i?i.roleTemplate!==h||pE(i.scope)!==pE(R)?r.updateMembership({id:i.id,roleTemplate:h,scope:R,actorId:_.id}):i:r.createMembership({organizationId:d.id,actorId:_.id,roleTemplate:h,scope:R,source:"legacy"}),A=new Set;if(c.role==="member"&&T.length===0)for(let u of In("viewer"))A.add(`deny|${u}|organization|`);for(let u of T){let U=c.sites[u.slug];for(let w of Mz)A.add(`allow|${w}|resource|${u.id}`);if(U==="owner")A.add(`allow|config:write|resource|${u.id}`)}for(let u of r.listGrants(N.id).filter((U)=>U.source==="legacy")){let U=`${u.effect}|${u.capability}|${u.scope.type}|${u.scope.id??""}`;if(!A.has(U))r.removeGrant(u.id,_.id)}for(let u of A){let[U,w,l,P]=u.split("|");r.upsertGrant({organizationId:d.id,membershipId:N.id,effect:U,capability:w,scope:l==="organization"?{type:"organization"}:{type:l,id:P},source:"legacy"})}}for(let c of r.listMemberships(d.id))if(c.source==="legacy"&&!n.has(c.actorId))r.revokeMembership(c.id)}async function fd(t){let{controlPlane:e,environment:r,actor:d}=t,E=Re(e.store,d),n=e.environments.get(r),c=t.resourceSlug&&n?e.store.listResources(e.project.id,n.id).find((h)=>h.slug===t.resourceSlug):void 0,_=new yt(e.store,{workerId:`dashboard:${process.pid}`}),i=_.enqueue({projectId:e.project.id,environmentId:n?.id,resourceId:c?.id,actorId:E.id,kind:t.kind,input:t.input??{},lockKey:c?`resource:${c.id}`:n?`environment:${n.id}`:`project:${e.project.id}`,providerKey:c?.provider??"dashboard",buildSlot:t.kind.includes("deploy"),maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!_.claim(i.id)?.operation)throw Error(`Could not claim control-plane operation ${i.id}`);try{let h=await t.execute(),R=typeof h.stdout==="string"?String(h.stdout):"",N=typeof h.stderr==="string"?String(h.stderr):"";if(R)_.appendLog(i.id,R,{stream:"stdout"});if(N)_.appendLog(i.id,N,{stream:"stderr"});let A=h.ok?_.complete(i.id,xU(h)):_.fail(i.id,Gz(h),xU(h));return{result:h,operation:A}}catch(h){throw _.fail(i.id,h instanceof Error?h.message:String(h),{ok:!1,threw:!0}),h}}function Gz(t){let e=t;return String(e.error??e.stderr??"Operation failed")}function xU(t){let e=t,r=typeof e.stdout==="string"?e.stdout:"",d=typeof e.stderr==="string"?e.stderr:"",E={ok:t.ok,stdoutBytes:Buffer.byteLength(r),stderrBytes:Buffer.byteLength(d)};if(typeof e.operation==="string")E.operation=e.operation;if(typeof e.error==="string")E.error=e.error;return Lt(E)}await Wt();At();class wd{client;region;constructor(t="us-east-1",e){this.region=t,this.client=new dt(Fn(e))}async query(t){let e=new URLSearchParams(Mt({Version:"2010-08-01",...t})).toString();return this.client.request({service:"monitoring",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:e})}async getMetricStatistics(t){let e={Action:"GetMetricStatistics",Namespace:t.Namespace,MetricName:t.MetricName,StartTime:t.StartTime.toISOString(),EndTime:t.EndTime.toISOString(),Period:t.Period};(t.Statistics??[]).forEach((n,c)=>{e[`Statistics.member.${c+1}`]=n}),(t.ExtendedStatistics??[]).forEach((n,c)=>{e[`ExtendedStatistics.member.${c+1}`]=n}),(t.Dimensions??[]).forEach((n,c)=>{e[`Dimensions.member.${c+1}.Name`]=n.Name,e[`Dimensions.member.${c+1}.Value`]=n.Value});let r=await this.query(e),E=(r.GetMetricStatisticsResult||r)?.Datapoints?.member??[];if(!Array.isArray(E))E=E?[E]:[];return E.map((n)=>{let c={},_=n.ExtendedStatistics?.entry;if(_){if(!Array.isArray(_))_=[_];for(let i of _)if(i?.key!=null)c[i.key]=Number(i.value)}return{Timestamp:n.Timestamp,Sum:n.Sum!=null?Number(n.Sum):void 0,Average:n.Average!=null?Number(n.Average):void 0,Maximum:n.Maximum!=null?Number(n.Maximum):void 0,Minimum:n.Minimum!=null?Number(n.Minimum):void 0,Percentiles:Object.keys(c).length?c:void 0,Unit:n.Unit}})}async getMetricSeries(t){let e=/^p\d/.test(t.Stat);return(await this.getMetricStatistics({Namespace:t.Namespace,MetricName:t.MetricName,Dimensions:t.Dimensions,StartTime:t.StartTime,EndTime:t.EndTime,Period:t.Period,Statistics:e?[]:[t.Stat],ExtendedStatistics:e?[t.Stat]:[]})).slice().sort((d,E)=>new Date(d.Timestamp??0).getTime()-new Date(E.Timestamp??0).getTime()).map((d)=>e?d.Percentiles?.[t.Stat]??0:d[t.Stat]??0)}async describeAlarms(t){let e={Action:"DescribeAlarms"};if(t?.AlarmNamePrefix)e.AlarmNamePrefix=t.AlarmNamePrefix;if(t?.MaxRecords)e.MaxRecords=t.MaxRecords;let r=await this.query(e),E=(r.DescribeAlarmsResult||r)?.MetricAlarms?.member??[];if(!Array.isArray(E))E=E?[E]:[];return E.map((n)=>({AlarmName:n.AlarmName,StateValue:n.StateValue,MetricName:n.MetricName,ComparisonOperator:n.ComparisonOperator,Threshold:n.Threshold!=null?Number(n.Threshold):void 0,Namespace:n.Namespace}))}async putMetricAlarm(t){let e={Action:"PutMetricAlarm",AlarmName:t.AlarmName,Namespace:t.Namespace,MetricName:t.MetricName,ComparisonOperator:t.ComparisonOperator,Threshold:t.Threshold,EvaluationPeriods:t.EvaluationPeriods,Period:t.Period,Statistic:t.Statistic};if(t.AlarmDescription)e.AlarmDescription=t.AlarmDescription;(t.Dimensions??[]).forEach((r,d)=>{e[`Dimensions.member.${d+1}.Name`]=r.Name,e[`Dimensions.member.${d+1}.Value`]=r.Value}),(t.AlarmActions??[]).forEach((r,d)=>{e[`AlarmActions.member.${d+1}`]=r}),await this.query(e)}async deleteAlarms(t){if(!t.length)return;let e={Action:"DeleteAlarms"};t.forEach((r,d)=>{e[`AlarmNames.member.${d+1}`]=r}),await this.query(e)}}er();At();class fL{client;region;constructor(t="us-east-1"){this.region=t,this.client=new dt}async call(t,e){return this.client.request({service:"wafv2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSWAF_20190729.${t}`},body:JSON.stringify(e)})}async listWebACLs(t="REGIONAL"){return(await this.call("ListWebACLs",{Scope:t,Limit:100}))?.WebACLs??[]}async getWebACLRules(t,e,r="REGIONAL"){return((await this.call("GetWebACL",{Name:t,Id:e,Scope:r}))?.WebACL?.Rules??[]).map((n)=>({Name:n.Name,Priority:n.Priority,Action:n.Action?Object.keys(n.Action)[0]:n.OverrideAction?Object.keys(n.OverrideAction)[0]:"count"}))}}sU();await Wt();er();function lc(t,e){let r=t.environments?.[e]?.app;if(!r)throw Error(`No serverless app configured for environment '${e}'. Add environments.${e}.app to your config.`);let d=t.project.slug,E=t.environments?.[e]?.region||t.project.region||"us-east-1";return{app:r,slug:d,region:E,stackName:Cn(t,e),artifactBucket:vu(d,e),assetsBucket:Qu(d,e)}}async function en(t,e=8){let r;for(let d=0;d<e;d++)try{return await t()}catch(E){let n=E?.code||E?.name||"",c=String(E?.message||"");if(n==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(c)){r=E,await new Promise((_)=>setTimeout(_,3000));continue}throw E}throw r}var oU=(t,e)=>`releases/${t}/${e}/current.json`;async function gL(t,e,r,d){try{return await t.getObjectJson(e,oU(r,d))}catch{return null}}async function Kz(t,e,r,d,E){await t.putObjectJson(e,oU(r,d),E)}function Zz(t,e){let r=Object.entries(e).reduce((d,[E,n])=>d+Buffer.byteLength(`${E}=${n}`,"utf8"),0);if(r>4096){let d=Object.entries(e).map(([E,n])=>[E,Buffer.byteLength(`${E}=${n}`,"utf8")]).sort((E,n)=>n[1]-E[1]).slice(0,5).map(([E,n])=>`${E} (${n}B)`).join(", ");throw Error(`${t}: environment variables total ${r}B, over AWS's 4096B limit (${r-4096}B too large). Largest: ${d}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function mU(t,e,r,d){Zz(e,r),await en(()=>t.updateFunctionConfiguration({FunctionName:e,Environment:{Variables:r}})),await t.waitForFunctionActive(e,120);let E=d.kind==="image"?{FunctionName:e,ImageUri:d.imageUri}:{FunctionName:e,S3Bucket:d.bucket,S3Key:d.key};await en(()=>t.updateFunctionCode(E)),await t.waitForFunctionActive(e,120)}async function kz(t,e){let d=(await en(()=>t.publishVersion({FunctionName:e}))).Version;if(!d)throw Error(`publishVersion returned no version for ${e}`);return await en(()=>t.updateAlias({FunctionName:e,Name:"live",FunctionVersion:d})),d}async function pU(t,e){let r=lc(t,e),d=new re(r.region),E=new Er(r.region),n=await gL(d,r.artifactBucket,r.slug,e);if(!n)throw Error("No previous release to redeploy. Run a full deploy first.");wL(`Redeploying ${r.slug} (${e}) — build ${n.sha.slice(0,12)}`);for(let[c,_]of Object.entries(n.functionNames)){if(!_)continue;zh(`Re-activating ${c} (${_})`),await mU(E,_,n.functionEnv[c]??{},n.code);let i=n.functionVersions?.[c];if(i)await en(()=>E.updateAlias({FunctionName:_,Name:"live",FunctionVersion:i}))}Y_("Redeploy complete")}async function tf(t,e){let r=lc(t,e),d=new re(r.region),E=new Er(r.region),n=await gL(d,r.artifactBucket,r.slug,e);if(!n?.previousCode)throw Error("No previous release to roll back to.");wL(`Rolling back ${r.slug} (${e}) → ${n.previousSha?.slice(0,12)}`);for(let[c,_]of Object.entries(n.functionNames)){if(!_)continue;zh(`Restoring ${c} (${_})`);let i=n.previousFunctionEnv?.[c]??n.functionEnv[c]??{};await mU(E,_,i,n.previousCode);let T=n.previousFunctionVersions?.[c];if(T)await en(()=>E.updateAlias({FunctionName:_,Name:"live",FunctionVersion:T}))}await Kz(d,r.artifactBucket,r.slug,e,{...n,sha:n.previousSha??n.sha,code:n.previousCode,functionEnv:n.previousFunctionEnv??n.functionEnv,functionVersions:n.previousFunctionVersions??n.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),Y_("Rollback complete")}async function $L(t,e,r,d){let E=lc(t,e),n=new Er(E.region),c=`${E.slug}-${e}-http`,i={...(await n.getFunction(c)).Configuration?.Environment?.Variables??{}};if(i.MAINTENANCE_MODE=r?"1":"0",r&&d)i.MAINTENANCE_BYPASS_SECRET=d;if(!r)delete i.MAINTENANCE_BYPASS_SECRET;if(await en(()=>n.updateFunctionConfiguration({FunctionName:c,Environment:{Variables:i}})),(E.app.provisionedConcurrency??0)>0)await n.waitForFunctionActive(c,120),await kz(n,c);Y_(r?"Application is now in maintenance mode (503)":"Application is live")}async function M_(t,e,r){let d=lc(t,e),E=new Er(d.region),n=`${d.slug}-${e}-cli`,c=await E.invoke({FunctionName:n,InvocationType:"RequestResponse",Payload:{command:r},LogType:"Tail"});if(c.FunctionError)throw Error(`Command failed: ${c.Payload}`);return c.Payload??""}async function ue(t,e){let r=lc(t,e),d=new sr(r.region),E=new Er(r.region),n=new re(r.region),c="not deployed",_={};try{let{Stacks:u}=await d.describeStacks({stackName:r.stackName});c=u?.[0]?.StackStatus??c;for(let U of u?.[0]?.Outputs??[])if(U.OutputKey)_[U.OutputKey]=U.OutputValue??""}catch{}let i=vO(r.app,r.slug,e),T=r.app.provisionedConcurrency??0,h=["http","cli",...i.length?["queue"]:[]],R=`${r.slug}-${e}`,N=[];for(let u of h){let U=`${R}-${u}`,w={mode:u,name:U,version:"$LATEST"};if(T>0){let l=await E.getAlias(U,"live").catch(()=>null);if(l?.FunctionVersion){w.version=l.FunctionVersion;let P=await E.getProvisionedConcurrencyConfig(U,"live").catch(()=>null);if(P)w.provisioned={status:P.Status??"-",allocated:P.AllocatedProvisionedConcurrentExecutions??0,requested:P.RequestedProvisionedConcurrentExecutions??0}}}N.push(w)}let A=await gL(n,r.artifactBucket,r.slug,e).catch(()=>null);return{slug:r.slug,environment:e,region:r.region,stackStatus:c,endpoint:_.HttpApiEndpoint,assetUrl:A?.assetUrl,scheduler:r.app.scheduler??"on",queues:i,provisionedConcurrency:T,functions:N,lastRelease:A?{sha:A.sha,timestamp:A.timestamp}:void 0}}function bz(t,e){return`${t}-${e}-db`}async function ef(t,e,r,d){let E=lc(t,e);if(E.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:n}=await Promise.resolve().then(() => (Bn(),rI)),c=new n(E.region),_=bz(E.slug,e);zh(`Scaling ${_} → ${r}–${d} ACUs`),await c.modifyDBCluster({DBClusterIdentifier:_,ServerlessV2ScalingConfiguration:{MinCapacity:r,MaxCapacity:d},ApplyImmediately:!0}),Y_(`Scaling applied to ${_} (takes effect shortly).`)}function rf(t){return String(t).padStart(2,"0")}function Dc(t){return`${t.getUTCFullYear()}-${rf(t.getUTCMonth()+1)}-${rf(t.getUTCDate())}`}function xz(t){let e=Math.max(0,Math.round((Date.now()-t)/1000));if(e<60)return`${e}s ago`;let r=Math.round(e/60);if(r<60)return`${r}m ago`;let d=Math.round(r/60);if(d<48)return`${d}h ago`;return`${Math.round(d/24)}d ago`}async function G_(t,e,r,d,E,n){let c=await t.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:r,Dimensions:[{Name:"FunctionName",Value:e}],StartTime:E,EndTime:n,Period:86400,Statistics:[d]}).catch(()=>[]);if(!c.length)return 0;if(d==="Sum")return c.reduce((_,i)=>_+(i.Sum??0),0);if(d==="Maximum")return Math.max(...c.map((_)=>_.Maximum??0));return c.reduce((_,i)=>_+(i.Average??0),0)/c.length}async function V_(t,e,r,d,E,n,c){let _=await t.getMetricStatistics({Namespace:e,MetricName:r,Dimensions:d,StartTime:n,EndTime:c,Period:86400,Statistics:[E]}).catch(()=>[]);if(!_.length)return 0;if(E==="Sum")return _.reduce((i,T)=>i+(T.Sum??0),0);if(E==="Maximum")return Math.max(..._.map((i)=>i.Maximum??0));return _.reduce((i,T)=>i+(T.Average??0),0)/_.length}async function yL(t,e,r,d,E){let n=await t.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:[{Name:"FunctionName",Value:e}],StartTime:d,EndTime:E,Period:86400,ExtendedStatistics:[r]}).catch(()=>[]);return Math.round(n.reduce((c,_)=>c+(_.Percentiles?.[r]??0),0))}async function Fh(t,e){let r=await ue(t,e),d=r.region,E=new wd(d),n=new Er(d),c=new X_(d),_=new Date,i=new Date(_.getTime()-86400000),T=t.environments?.[e]?.app,h={};h.app={name:r.slug,env:e,region:d,runtime:T?.kind==="php"?`php-${T?.phpVersion??"8.3"} (fpm)`:T?.kind??"node",url:r.endpoint??"",build:r.lastRelease?.sha?.slice(0,7)??"—",deployedAt:r.lastRelease?.timestamp??"—"},h.maintenance={enabled:!1},h.scheduler={enabled:r.scheduler!=="off",expression:r.scheduler==="sub-minute"?"rate(1 minute) · sub-minute":"rate(1 minute)",lastRun:"—"};let R=0,N=0,A=0,u=[],U=[],w=[];for(let j of r.functions){let[B,F,J,K,s,tt,q,it,Et]=await Promise.all([G_(E,j.name,"Invocations","Sum",i,_),G_(E,j.name,"Errors","Sum",i,_),G_(E,j.name,"Throttles","Sum",i,_),G_(E,j.name,"Duration","Average",i,_),n.getFunction(j.name).catch(()=>null),yL(E,j.name,"p50",i,_),yL(E,j.name,"p95",i,_),yL(E,j.name,"p99",i,_),E.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:j.name}],StartTime:new Date(_.getTime()-43200000),EndTime:_,Period:3600,Stat:"Sum"}).catch(()=>[])]);R+=B,N+=F,A=Math.max(A,K);let lt=s?.Configuration?.MemorySize??0,gt=Object.keys(s?.Configuration?.Environment?.Variables??{}),$=[],W=0;try{let{events:x=[]}=await c.filterLogEvents({logGroupName:`/aws/lambda/${j.name}`,startTime:i.getTime(),limit:120});for(let Nt of x){let o=(Nt.message??"").trim(),It=/Max Memory Used:\s*(\d+)\s*MB/.exec(o);if(It)W=Math.max(W,Number(It[1]));if(o&&!/^(?:START|END|REPORT|INIT_START)/.test(o))w.push({source:j.mode||j.name,timestamp:new Date(Nt.timestamp??0).toISOString(),when:xz(Nt.timestamp??0),message:o.slice(0,400),level:/error|exception|fatal|panic|traceback/i.test(o)?"error":/warn|warning|timeout|retr(?:y|ies)|throttl/i.test(o)?"warn":"info"})}$=x.filter((Nt)=>!/^(?:START|END|REPORT|INIT_START)/.test((Nt.message??"").trim())).slice(-6).map((Nt)=>({ts:new Date(Nt.timestamp??0).toISOString().slice(11,19),msg:(Nt.message??"").trim().slice(0,120),err:/error|exception|fatal/i.test(Nt.message??"")}))}catch{}let V=Math.max(1,...Et);u.push({key:j.mode,name:j.name,version:j.version,memory:lt,timeout:s?.Configuration?.Timeout??0,runtime:s?.Configuration?.Runtime??"provided.al2023",invocations:Math.round(B),errors:Math.round(F),p95:q||Math.round(K),status:"active",provisioned:j.provisioned?`${j.provisioned.allocated}/${j.provisioned.requested}`:void 0}),U.push({key:j.mode,name:j.name,runtime:s?.Configuration?.Runtime??"provided.al2023",arch:s?.Configuration?.Architectures?.[0]??"x86_64",memory:lt,timeout:s?.Configuration?.Timeout??0,ephemeral:s?.Configuration?.EphemeralStorage?.Size??512,version:j.version,concurrency:T?.concurrency??"—",invocations:Math.round(B),errors:Math.round(F),throttles:Math.round(J),p50:tt||Math.round(K),p95:q||Math.round(K),p99:it||Math.round(K),maxMem:W,spark:Et.length?Et.map((x)=>Math.round(x/V*100)):[0],env:gt.length?gt:["(none)"],recent:$.length?$:[{ts:"—",msg:"no recent events",err:!1}]})}h.functions=u,h.functionsDetail=U,h.serverlessLogs=w.sort((j,B)=>String(B.timestamp).localeCompare(String(j.timestamp))).slice(0,600),h.serverlessLogsEmptyReason=w.length?void 0:"No recent function logs were found in CloudWatch for this environment.";let l=R?Number((N/R*100).toFixed(2)):0,P=Math.round(await G_(E,r.functions[0]?.name??"","ConcurrentExecutions","Maximum",i,_));h.metrics={invocations:Math.round(R),errorRatePct:l,p95Ms:Math.round(A),coldStartPct:void 0,concurrency:P,estCostUsd:void 0};try{let j=new pd(d),B=[],F=[],J=0;try{let{QueueUrl:s}=await j.getQueueUrl(`${r.slug}-${e}-dlq`),{Attributes:tt}=await j.getQueueAttributes(s);J=Number(tt.ApproximateNumberOfMessages??0)}catch{}let K=T?Wc(T,r.slug,e):[];for(let s of K){let tt=s.name.replace(`${r.slug}-${e}-`,""),q=0,it=0;try{let{QueueUrl:lt}=await j.getQueueUrl(s.name),{Attributes:gt}=await j.getQueueAttributes(lt);q=Number(gt.ApproximateNumberOfMessages??0),it=Number(gt.ApproximateNumberOfMessagesNotVisible??0)}catch{}let Et=Math.round(await V_(E,"AWS/SQS","NumberOfMessagesDeleted",[{Name:"QueueName",Value:s.name}],"Sum",i,_));B.push({name:tt,visible:q,inFlight:it,processed:Et,dlq:J}),F.push({name:s.name,short:tt,visible:q,inFlight:it,delayed:0,processed:Et,oldestSec:0,concurrency:s.concurrency??T?.queueConcurrency??"—",tries:T?.queueTries??3,visTimeout:(T?.queueTimeout??120)*6,dlq:J})}if(B.length)h.queues=B;if(F.length)h.queuesDetail=F;h.dlqItems=[]}catch{}try{let j=new sr(d),{Stacks:B}=await j.describeStacks({stackName:Cn(t,e)}),F={};for(let J of B?.[0]?.Outputs??[])if(J.OutputKey)F[J.OutputKey]=J.OutputValue??"";if(T?.database?.connection==="aurora-serverless"){let J=`${r.slug}-${e}-db`,K=[{Name:"DBClusterIdentifier",Value:J}],[s,tt]=await Promise.all([V_(E,"AWS/RDS","ServerlessDatabaseCapacity",K,"Average",i,_),V_(E,"AWS/RDS","DatabaseConnections",K,"Maximum",i,_)]);if(h.aurora={id:J,engine:"aurora-mysql",minAcu:T?.database?.minCapacity??0.5,maxAcu:T?.database?.maxCapacity??4,currentAcu:s?Number(s.toFixed(1)):T?.database?.minCapacity??0.5,database:"app",connections:Math.round(tt),status:F.DbEndpoint?"available":"creating"},T?.rdsProxy)h.proxy={name:`${r.slug}-${e}-proxy`,endpoint:F.DbProxyEndpoint??"—",pooledConns:Math.round(tt),status:"available"}}if(T?.cache?.driver==="elasticache"){let J=`${r.slug}-${e}-cache`,K=[{Name:"CacheClusterId",Value:`${J}-001`}],[s,tt]=await Promise.all([V_(E,"AWS/ElastiCache","CacheHits",K,"Sum",i,_),V_(E,"AWS/ElastiCache","CacheMisses",K,"Sum",i,_)]),q=s+tt>0?Number((s/(s+tt)*100).toFixed(1)):0;h.redis={id:J,node:"cache.t4g.micro",engine:"redis",hitRate:q,status:F.CacheEndpoint?"available":"creating"}}if(T?.efs){let J=0;try{if(F.EfsFileSystemId){let K=new VA(d),{FileSystems:s}=await K.describeFileSystems({FileSystemId:F.EfsFileSystemId});J=Number(((s?.[0]?.SizeInBytes?.Value??0)/1048576).toFixed(1))}}catch{}h.efs={id:F.EfsFileSystemId??"efs",mount:"/mnt/local",sizeMb:J,status:"available"}}h.assetsInfo=F.AssetsCdnDomain?{bucket:F.AssetsBucketName??`${r.slug}-${e}-assets`,cdn:F.AssetsCdnDomain,customDomain:T?.assetDomain??"—",assetUrl:r.assetUrl??"—",files:0,sizeMb:0,cacheHitPct:0,build:h.app.build}:void 0}catch{}if(h.assetsInfo)try{let B=await new re(d).list({bucket:h.assetsInfo.bucket,maxKeys:1000});h.assetsInfo.files=B.length,h.assetsInfo.sizeMb=Number((B.reduce((F,J)=>F+(J.Size??0),0)/1048576).toFixed(1)),h.assetsRecent=B.slice(0,8).map((F)=>({path:`/${F.Key}`,size:`${Math.max(1,Math.round((F.Size??0)/1024))} KB`,type:F.Key.split(".").pop()??""}))}catch{}try{if(T?.secrets){let j=Array.isArray(T.secrets)?T.secrets.map((B)=>({key:B.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),source:B})):Object.entries(T.secrets).map(([B,F])=>({key:B,source:String(F)}));h.secretsList=j.map((B)=>({...B,updated:"—"}))}}catch{}try{let j=new re(d),B=`${r.slug}-${e}-deployments`,F=await j.getObjectJson(B,`deployments/${r.slug}/${e}/history.json`).catch(()=>null);if(F?.records?.length)h.deploymentsDetail=F.records.slice(-12).reverse().map((J)=>({sha:(J.sha??"").slice(0,7),status:J.status??"success",when:J.timestamp??"—",took:J.took??"—",by:J.by??"—",version:J.version??"—",hooks:J.hooks??[]}))}catch{}h.metricsTotals={invocations:h.metrics.invocations,errors:Math.round(N),errorRatePct:l,p95Ms:h.metrics.p95Ms,throttles:U.reduce((j,B)=>j+B.throttles,0),coldStartPct:void 0,estCostUsd:void 0,concurrency:P},h.metricsPerFn=U.map((j)=>({key:j.key,invocations:j.invocations,errors:j.errors,throttles:j.throttles,avgMs:j.p50,maxMs:j.p99,costUsd:void 0}));try{h.invSpark=await E.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:r.functions.find((j)=>j.mode==="http")?.name??""}],StartTime:new Date(_.getTime()-86400000),EndTime:_,Period:3600,Stat:"Sum"})}catch{}try{let j=new YA,B=_,F=new Date(Date.UTC(B.getUTCFullYear(),B.getUTCMonth(),1)),J=new Date(Date.UTC(B.getUTCFullYear(),B.getUTCMonth()-1,1)),[K,s]=await Promise.all([j.getCostByService({start:Dc(F),end:Dc(B),granularity:"MONTHLY"}).catch(()=>[]),j.getCostByService({start:Dc(J),end:Dc(F),granularity:"MONTHLY"}).catch(()=>[])]);if(K.length){let tt=K.reduce((W,V)=>W+V.amount,0),q=s.reduce((W,V)=>W+V.amount,0),it=B.getUTCDate(),Et=new Date(Date.UTC(B.getUTCFullYear(),B.getUTCMonth()+1,0)).getUTCDate();h.costSummary={monthToDateUsd:Number(tt.toFixed(2)),projectedUsd:Number((tt/it*Et).toFixed(2)),lastMonthUsd:Number(q.toFixed(2)),dailyAvgUsd:Number((tt/it).toFixed(2))},h.costServices=K.filter((W)=>W.amount>0).sort((W,V)=>V.amount-W.amount).slice(0,12).map((W)=>({name:W.service,usd:Number(W.amount.toFixed(2)),note:""})),h.metrics.estCostUsd=Number((tt/it).toFixed(2)),h.metricsTotals.estCostUsd=h.metrics.estCostUsd,h.costTrend=await j.getDailyTotals({start:Dc(F),end:Dc(B)}).catch(()=>[]);let lt=K.find((W)=>/lambda/i.test(W.service))?.amount??0,gt=(W)=>W.invocations*(W.p50/1000)*(W.memory/1024),$=U.reduce((W,V)=>W+gt(V),0)||1;h.costPerFn=U.map((W)=>({key:W.key,requests:W.invocations,gbSec:Math.round(gt(W)),usd:Number((lt*(gt(W)/$)).toFixed(2))}))}}catch{}if(T?.firewall)try{let j=await E.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"BlockedRequests",StartTime:i,EndTime:_,Period:86400,Statistics:["Sum"]}).catch(()=>[]),B=await E.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"AllowedRequests",StartTime:i,EndTime:_,Period:86400,Statistics:["Sum"]}).catch(()=>[]);h.waf={enabled:!0,scope:"REGIONAL",acl:`${r.slug}-${e}-waf`,allowed24h:Math.round(B.reduce((F,J)=>F+(J.Sum??0),0)),blocked24h:Math.round(j.reduce((F,J)=>F+(J.Sum??0),0))};try{let F=new fL(d),J=await F.listWebACLs("REGIONAL"),K=J.find((s)=>s.Name?.includes(`${r.slug}-${e}`))??J[0];if(K?.Name&&K.Id){h.waf.acl=K.Name;let s=await F.getWebACLRules(K.Name,K.Id,"REGIONAL");if(s.length)h.wafRules=s.map((tt)=>({name:tt.Name??"—",detail:`priority ${tt.Priority??0}`,action:tt.Action??"count",blocked24h:0}))}}catch{}}catch{}let a=[];if(h.aurora)a.push({name:"Aurora Serverless v2",detail:`${h.aurora.id} · ${h.aurora.minAcu}-${h.aurora.maxAcu} ACU`,status:h.aurora.status});if(h.proxy)a.push({name:"RDS Proxy",detail:h.proxy.name,status:h.proxy.status});if(h.redis)a.push({name:`ElastiCache (${h.redis.engine})`,detail:`${h.redis.node} · ${h.redis.hitRate}% hit rate`,status:h.redis.status});if(h.efs)a.push({name:"EFS",detail:`${h.efs.mount} · ${h.efs.sizeMb} MB`,status:h.efs.status});if(a.length)h.dataServices=a;if(r.scheduler!=="off"&&T?.kind==="php")try{let j=await M_(t,e,"schedule:list"),B=[];for(let F of(j||"").split(`
 `)){let J=/^\s*([\d*/,\-\s]+?)\s{2,}(.+?)(?:\s{2,}Next Due.*)?$/.exec(F);if(J&&/[*\d]/.test(J[1])&&J[1].trim().split(/\s+/).length===5)B.push({command:J[2].trim().replace(/^php artisan /,""),cron:J[1].trim(),desc:"",lastRun:"—",lastStatus:"ok"})}if(B.length)h.schedulerTasks=B}catch{}return h}import{existsSync as rF,readFileSync as dF}from"node:fs";import{join as EF}from"node:path";import{createHash as qz}from"node:crypto";function Ef(t){let e=XL(t.name),r=PL(t.publicKey),d=oz([...t.existingKeys??[],{name:e,publicKey:r}]);return cf(t.configText,d)}function nf(t){let e=XL(t.name),r=(t.existingKeys??[]).filter((d)=>d.name!==e);if((t.existingKeys??[]).length===r.length)throw Error(`SSH key '${e}' does not exist in compute.sshKeys`);return cf(t.configText,r)}function TE(t=[]){return t.map((e)=>({name:e.name,publicKey:e.publicKey,type:mz(e.publicKey),fingerprint:pz(e.publicKey),added:"configured"}))}function cf(t,e){let r=tF(t,"compute"),d=sz(e),E=eF(t,r.start,r.end,"sshKeys");if(E){let i=E.propertyStart;while(i>0&&t[i-1]!==`
 `&&/\s/.test(t[i-1]))i--;return`${t.slice(0,i)}${d}${t.slice(E.end+1)}`}let n=t.slice(0,r.end).trimEnd(),c=t.slice(r.end),_=n.endsWith(",")||n.endsWith("{")?"":",";return`${n}${_}
 ${d},
@@ -6598,7 +6598,7 @@ EOF`,'echo "DISKPCT=${DISKPCT:-0}"','echo "DISKUSEDG=${DISKUSEDG:-0}"','echo "DI
       },
     ${i}`}await Wt();At();class ZL{client;region;constructor(t="us-east-1"){this.region=t,this.client=new dt}async getTraceSummaries(t){let e={StartTime:Math.floor(t.startTime.getTime()/1000),EndTime:Math.floor(t.endTime.getTime()/1000),TimeRangeType:"Event",Sampling:!1};if(t.filterExpression)e.FilterExpression=t.filterExpression;if(t.nextToken)e.NextToken=t.nextToken;let r=await this.client.request({service:"xray",region:this.region,method:"POST",path:"/TraceSummaries",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)});return{summaries:r?.TraceSummaries??[],nextToken:r?.NextToken}}async batchGetTraces(t){if(!t.length)return[];return(await this.client.request({service:"xray",region:this.region,method:"POST",path:"/Traces",headers:{"Content-Type":"application/json"},body:JSON.stringify({TraceIds:t.slice(0,5)})}))?.Traces??[]}}var Sw=65536;function ze(t){return t.length<=Sw?t:`${t.slice(0,Sw)}
 
-[output truncated]`}function bL(t,e){return t.environments?.[e]?.app}function xL(t,e,r){let d=[],E=bL(t,e);d.push({id:"redeploy",label:"Redeploy current build",group:"deploy",target:"app",mutates:!0,confirm:"redeploy"}),d.push({id:"rollback",label:"Roll back to previous build",group:"deploy",target:"app",mutates:!0,confirm:"rollback",danger:!0});let n=r.maintenance?.enabled;if(n!==!0)d.push({id:"maintenance:on",label:"Enable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"maintenance",danger:!0});if(n!==!1)d.push({id:"maintenance:off",label:"Disable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"live"});if(E?.assets||r.assetsInfo)d.push({id:"assets:invalidate",label:"Invalidate CDN cache",group:"assets",target:"assets",mutates:!0,confirm:"invalidate"});if(E?.database?.connection==="aurora-serverless")d.push({id:"db:scale",label:"Scale Aurora capacity",group:"database",target:"database",mutates:!0,confirm:"scale",inputs:[{name:"min",label:"Min ACUs",placeholder:String(E.database.minCapacity??0.5)},{name:"max",label:"Max ACUs",placeholder:String(E.database.maxCapacity??4)}]});for(let c of r.queues??[]){let _=String(c?.name??"").trim();if(_&&/^[A-Za-z0-9_-]+$/.test(_))d.push({id:`queue:purge:${_}`,label:`Purge queue (${_})`,group:"queue",target:_,mutates:!0,confirm:_,danger:!0})}return d}function Nw(t,e,r,d){return xL(e,r,d).find((E)=>E.id===t)}async function WB(t,e,r){try{let d=new sr(r),{Stacks:E}=await d.describeStacks({stackName:Cn(t,e)}),n={};for(let i of E?.[0]?.Outputs??[])if(i.OutputKey)n[i.OutputKey]=i.OutputValue??"";let c=n.AssetsCdnDomain;if(!c)return null;return(await new rh(r).findDistributionByDomain(c))?.Id??null}catch{return null}}async function Aw(t,e,r,d={}){try{if(r.id==="redeploy")return await pU(t,e),{operation:r.id,command:"serverless redeploy",ok:!0,stdout:"Redeploy complete."};if(r.id==="rollback")return await tf(t,e),{operation:r.id,command:"serverless rollback",ok:!0,stdout:"Rollback complete."};if(r.id==="maintenance:on")return await $L(t,e,!0),{operation:r.id,command:"maintenance on",ok:!0,stdout:"Application is now in maintenance mode."};if(r.id==="maintenance:off")return await $L(t,e,!1),{operation:r.id,command:"maintenance off",ok:!0,stdout:"Application is live."};if(r.id==="db:scale"){let E=Number(d.min),n=Number(d.max);if(!Number.isFinite(E)||!Number.isFinite(n)||E<=0||n<E)return{operation:r.id,ok:!1,error:"Provide valid Aurora capacities (0 < min ≤ max)."};return await ef(t,e,E,n),{operation:r.id,command:`db:scale ${E}-${n} ACU`,ok:!0,stdout:`Scaling applied (${E}-${n} ACUs); takes effect shortly.`}}if(r.id==="assets:invalidate"){let E=await Le(t,e),n=await WB(t,e,E.region);if(!n)return{operation:r.id,ok:!1,error:"Could not resolve the asset CloudFront distribution for this environment."};let _=await new rh(E.region).invalidateAll(n);return{operation:r.id,command:`cloudfront invalidate ${n} /*`,ok:!0,stdout:`Invalidation ${_?.Id??"created"} for ${n} (/*).`}}if(r.group==="queue"&&r.id.startsWith("queue:purge:")){let E=r.target,n=await Le(t,e),c=new pd(n.region),_=`${n.slug}-${e}-${E}`,{QueueUrl:i}=await c.getQueueUrl(_);return await c.purgeQueue(i),{operation:r.id,command:`sqs purge ${_}`,ok:!0,stdout:`Purged queue ${_}.`}}return{operation:r.id,ok:!1,error:"Unknown or unavailable serverless operation."}}catch(E){return{operation:r.id,ok:!1,error:ze(E?.message??String(E))}}}async function Lw(t,e,r){let d=r.trim();if(!d)return{operation:"command",ok:!1,error:"A command is required."};try{let E=await M_(t,e,d);return{operation:"command",command:d,ok:!0,stdout:ze(E||"(no output)")}}catch(E){return{operation:"command",command:d,ok:!1,error:ze(E?.message??String(E))}}}var qL="No dead-letter queue is provisioned for this environment.";async function sL(t,e,r){try{let{QueueUrl:d}=await t.getQueueUrl(`${e}-${r}-dlq`);return d}catch{return null}}async function uw(t,e,r=10){try{let d=await Le(t,e),E=new pd(d.region),n=await sL(E,d.slug,e);if(!n)return{ok:!1,messages:[],error:qL};return{ok:!0,messages:((await E.receiveMessages({queueUrl:n,maxMessages:Math.min(10,Math.max(1,r)),waitTimeSeconds:1,visibilityTimeout:2})).Messages??[]).map((i)=>({id:i.MessageId,receiptHandle:i.ReceiptHandle,body:ze(String(i.Body??""))}))}}catch(d){return{ok:!1,messages:[],error:ze(d?.message??String(d))}}}async function Ow(t,e,r={}){try{let d=await Le(t,e),E=bL(t,e),c=(E?Wc(E,d.slug,e):[]).map((A)=>A.name.replace(`${d.slug}-${e}-`,"")),_=r.targetQueue&&c.includes(r.targetQueue)?r.targetQueue:c[0];if(!_)return{operation:"dlq:redrive",ok:!1,error:"No source queue is configured to redrive into."};let i=new pd(d.region),T=await sL(i,d.slug,e);if(!T)return{operation:"dlq:redrive",ok:!1,error:qL};let{QueueUrl:h}=await i.getQueueUrl(`${d.slug}-${e}-${_}`),R=Math.min(50,Math.max(1,r.max??10)),N=0;while(N<R){let u=(await i.receiveMessages({queueUrl:T,maxMessages:Math.min(10,R-N),waitTimeSeconds:1,visibilityTimeout:30})).Messages??[];if(!u.length)break;for(let U of u)await i.sendMessage({queueUrl:h,messageBody:String(U.Body??"")}),await i.deleteMessage(T,U.ReceiptHandle),N++}return{operation:"dlq:redrive",command:`redrive → ${_}`,ok:!0,stdout:`Moved ${N} message(s) from the DLQ to ${_}.`}}catch(d){return{operation:"dlq:redrive",ok:!1,error:ze(d?.message??String(d))}}}async function Cw(t,e){try{let r=await Le(t,e),d=new pd(r.region),E=await sL(d,r.slug,e);if(!E)return{operation:"dlq:purge",ok:!1,error:qL};return await d.purgeQueue(E),{operation:"dlq:purge",command:"sqs purge dlq",ok:!0,stdout:"Dead-letter queue purged."}}catch(r){return{operation:"dlq:purge",ok:!1,error:ze(r?.message??String(r))}}}function Iw(t,e){let r=bL(t,e);if(!r?.secrets)return[];return Array.isArray(r.secrets)?r.secrets.map((d)=>({key:d.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:d})):Object.entries(r.secrets).map(([d,E])=>({key:d,secretId:String(E)}))}async function lw(t,e,r,d){if(!r.trim())return{operation:"secret:set",ok:!1,error:"A secret id is required."};try{let E=await Le(t,e),n=new FE(E.region);try{await n.putSecretValue({SecretId:r,SecretString:d})}catch{await n.createSecret({Name:r,SecretString:d})}return{operation:"secret:set",command:`secret set ${r}`,ok:!0,stdout:`Secret ${r} updated. Redeploy to apply it to the functions.`}}catch(E){return{operation:"secret:set",ok:!1,error:ze(E?.message??String(E))}}}async function Dw(t,e,r){if(!r.trim())return{operation:"secret:delete",ok:!1,error:"A secret id is required."};try{let d=await Le(t,e);return await new FE(d.region).deleteSecret({SecretId:r,RecoveryWindowInDays:7}),{operation:"secret:delete",command:`secret delete ${r}`,ok:!0,stdout:`Secret ${r} scheduled for deletion (recoverable for 7 days).`}}catch(d){return{operation:"secret:delete",ok:!1,error:ze(d?.message??String(d))}}}var vB=new Set(["http","queue","cli"]);async function Uw(t,e,r,d){if(!vB.has(r))return{operation:"function:config",ok:!1,error:`Unknown function mode '${r}'.`};let E=d.memory==null?void 0:Number(d.memory),n=d.timeout==null?void 0:Number(d.timeout);if(E!=null&&(!Number.isInteger(E)||E<128||E>10240))return{operation:"function:config",ok:!1,error:"Memory must be an integer between 128 and 10240 MB."};if(n!=null&&(!Number.isInteger(n)||n<1||n>900))return{operation:"function:config",ok:!1,error:"Timeout must be an integer between 1 and 900 seconds."};if(E==null&&n==null)return{operation:"function:config",ok:!1,error:"Provide a memory and/or timeout value."};try{let c=await Le(t,e),_=new Er(c.region),i=`${c.slug}-${e}-${r}`;await _.updateFunctionConfiguration({FunctionName:i,...E!=null?{MemorySize:E}:{},...n!=null?{Timeout:n}:{}});let T=[E!=null?`${E} MB`:"",n!=null?`${n}s`:""].filter(Boolean).join(", ");return{operation:"function:config",command:`update ${i} (${T})`,ok:!0,stdout:`Updated ${i}: ${T}.`}}catch(c){return{operation:"function:config",ok:!1,error:ze(c?.message??String(c))}}}var kL=[{key:"http-errors",label:"HTTP function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"errors / 5 min"},{key:"http-throttles",label:"HTTP function throttles",namespace:"AWS/Lambda",metricName:"Throttles",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"throttles / 5 min"},{key:"http-duration",label:"HTTP function duration (avg)",namespace:"AWS/Lambda",metricName:"Duration",statistic:"Average",comparison:"GreaterThanThreshold",fnMode:"http",unit:"ms"},{key:"http-concurrency",label:"HTTP concurrent executions",namespace:"AWS/Lambda",metricName:"ConcurrentExecutions",statistic:"Maximum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"concurrent"},{key:"queue-errors",label:"Queue function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"queue",unit:"errors / 5 min"}];function QB(t){return kL.find((e)=>e.key===t)}async function fw(t,e){try{let r=await Le(t,e);return{ok:!0,alarms:await new wd(r.region).describeAlarms({AlarmNamePrefix:`${r.slug}-${e}-`,MaxRecords:100}),presets:kL}}catch(r){return{ok:!1,alarms:[],presets:kL,error:ze(r?.message??String(r))}}}async function ww(t,e,r,d){let E=QB(r);if(!E)return{operation:"alarm:create",ok:!1,error:`Unknown alarm metric '${r}'.`};if(!Number.isFinite(d)||d<0)return{operation:"alarm:create",ok:!1,error:"Provide a non-negative threshold."};try{let n=await Le(t,e),c=new wd(n.region),_=`${n.slug}-${e}-${E.key}`,i=E.fnMode?[{Name:"FunctionName",Value:`${n.slug}-${e}-${E.fnMode}`}]:[];return await c.putMetricAlarm({AlarmName:_,Namespace:E.namespace,MetricName:E.metricName,ComparisonOperator:E.comparison,Threshold:d,EvaluationPeriods:1,Period:300,Statistic:E.statistic,Dimensions:i,AlarmDescription:`ts-cloud: ${E.label} > ${d} ${E.unit}`}),{operation:"alarm:create",command:`alarm ${_}`,ok:!0,stdout:`Alarm ${_} armed at ${d} ${E.unit}.`}}catch(n){return{operation:"alarm:create",ok:!1,error:ze(n?.message??String(n))}}}async function gw(t,e,r){try{let d=await Le(t,e);if(!r.startsWith(`${d.slug}-${e}-`))return{operation:"alarm:delete",ok:!1,error:"Refusing to delete an alarm outside this environment."};return await new wd(d.region).deleteAlarms([r]),{operation:"alarm:delete",command:`delete alarm ${r}`,ok:!0,stdout:`Alarm ${r} deleted.`}}catch(d){return{operation:"alarm:delete",ok:!1,error:ze(d?.message??String(d))}}}function YB(t){let e=t.HasFault?"fault":t.HasError?"error":t.HasThrottle?"throttle":"ok";return{id:String(t.Id??""),timestamp:Number.isFinite(Number(t.StartTime))?new Date(Number(t.StartTime)*1000).toISOString():void 0,durationMs:Math.round((t.Duration??0)*1000),responseMs:Math.round((t.ResponseTime??0)*1000),status:e,method:t.Http?.HttpMethod??"-",url:t.Http?.HttpURL??"-",httpStatus:t.Http?.HttpStatus??0}}async function qh(t,e,r=30){try{let d=await Le(t,e),E=new ZL(d.region),n=new Date,c=new Date(n.getTime()-Math.min(360,Math.max(1,r))*60000),_=`${d.slug}-${e}-http`,i=await E.getTraceSummaries({startTime:c,endTime:n,filterExpression:`service("${_}")`});if(!i.summaries.length)i=await E.getTraceSummaries({startTime:c,endTime:n});return{ok:!0,traces:i.summaries.slice(0,100).map(YB)}}catch(d){return{ok:!1,traces:[],error:ze(d?.message??String(d))}}}async function oL(t,e,r){try{let d=await Le(t,e),E=`${d.slug}-${e}-scheduler`;if(r==="run"){let c=await M_(t,e,"schedule:run");return{operation:"scheduler:run",command:"schedule:run",ok:!0,stdout:ze(c||"Scheduler run triggered.")}}let n=new GA(d.region);if(r==="enable")await n.enableRule({Name:E});else await n.disableRule({Name:E});return{operation:`scheduler:${r}`,command:`${r} ${E}`,ok:!0,stdout:`Scheduler rule ${E} ${r}d.`}}catch(d){return{operation:`scheduler:${r}`,ok:!1,error:ze(d?.message??String(d))}}}function $w(t){let e=sh(t.name),r=pL(t.configText);if(VB(t.configText,r.start,r.end,e))throw Error(`Site '${e}' already exists in cloud.config.ts`);let d=GB({...t,name:e}),E=t.configText.slice(0,r.end).trimEnd(),n=t.configText.slice(r.end),c=E.endsWith("{")?`
+[output truncated]`}function bL(t,e){return t.environments?.[e]?.app}function xL(t,e,r){let d=[],E=bL(t,e);d.push({id:"redeploy",label:"Redeploy current build",group:"deploy",target:"app",mutates:!0,confirm:"redeploy"}),d.push({id:"rollback",label:"Roll back to previous build",group:"deploy",target:"app",mutates:!0,confirm:"rollback",danger:!0});let n=r.maintenance?.enabled;if(n!==!0)d.push({id:"maintenance:on",label:"Enable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"maintenance",danger:!0});if(n!==!1)d.push({id:"maintenance:off",label:"Disable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"live"});if(E?.assets||r.assetsInfo)d.push({id:"assets:invalidate",label:"Invalidate CDN cache",group:"assets",target:"assets",mutates:!0,confirm:"invalidate"});if(E?.database?.connection==="aurora-serverless")d.push({id:"db:scale",label:"Scale Aurora capacity",group:"database",target:"database",mutates:!0,confirm:"scale",inputs:[{name:"min",label:"Min ACUs",placeholder:String(E.database.minCapacity??0.5)},{name:"max",label:"Max ACUs",placeholder:String(E.database.maxCapacity??4)}]});for(let c of r.queues??[]){let _=String(c?.name??"").trim();if(_&&/^[A-Za-z0-9_-]+$/.test(_))d.push({id:`queue:purge:${_}`,label:`Purge queue (${_})`,group:"queue",target:_,mutates:!0,confirm:_,danger:!0})}return d}function Nw(t,e,r,d){return xL(e,r,d).find((E)=>E.id===t)}async function WB(t,e,r){try{let d=new sr(r),{Stacks:E}=await d.describeStacks({stackName:Cn(t,e)}),n={};for(let i of E?.[0]?.Outputs??[])if(i.OutputKey)n[i.OutputKey]=i.OutputValue??"";let c=n.AssetsCdnDomain;if(!c)return null;return(await new rh(r).findDistributionByDomain(c))?.Id??null}catch{return null}}async function Aw(t,e,r,d={}){try{if(r.id==="redeploy")return await pU(t,e),{operation:r.id,command:"serverless redeploy",ok:!0,stdout:"Redeploy complete."};if(r.id==="rollback")return await tf(t,e),{operation:r.id,command:"serverless rollback",ok:!0,stdout:"Rollback complete."};if(r.id==="maintenance:on")return await $L(t,e,!0),{operation:r.id,command:"maintenance on",ok:!0,stdout:"Application is now in maintenance mode."};if(r.id==="maintenance:off")return await $L(t,e,!1),{operation:r.id,command:"maintenance off",ok:!0,stdout:"Application is live."};if(r.id==="db:scale"){let E=Number(d.min),n=Number(d.max);if(!Number.isFinite(E)||!Number.isFinite(n)||E<=0||n<E)return{operation:r.id,ok:!1,error:"Provide valid Aurora capacities (0 < min ≤ max)."};return await ef(t,e,E,n),{operation:r.id,command:`db:scale ${E}-${n} ACU`,ok:!0,stdout:`Scaling applied (${E}-${n} ACUs); takes effect shortly.`}}if(r.id==="assets:invalidate"){let E=await ue(t,e),n=await WB(t,e,E.region);if(!n)return{operation:r.id,ok:!1,error:"Could not resolve the asset CloudFront distribution for this environment."};let _=await new rh(E.region).invalidateAll(n);return{operation:r.id,command:`cloudfront invalidate ${n} /*`,ok:!0,stdout:`Invalidation ${_?.Id??"created"} for ${n} (/*).`}}if(r.group==="queue"&&r.id.startsWith("queue:purge:")){let E=r.target,n=await ue(t,e),c=new pd(n.region),_=`${n.slug}-${e}-${E}`,{QueueUrl:i}=await c.getQueueUrl(_);return await c.purgeQueue(i),{operation:r.id,command:`sqs purge ${_}`,ok:!0,stdout:`Purged queue ${_}.`}}return{operation:r.id,ok:!1,error:"Unknown or unavailable serverless operation."}}catch(E){return{operation:r.id,ok:!1,error:ze(E?.message??String(E))}}}async function Lw(t,e,r){let d=r.trim();if(!d)return{operation:"command",ok:!1,error:"A command is required."};try{let E=await M_(t,e,d);return{operation:"command",command:d,ok:!0,stdout:ze(E||"(no output)")}}catch(E){return{operation:"command",command:d,ok:!1,error:ze(E?.message??String(E))}}}var qL="No dead-letter queue is provisioned for this environment.";async function sL(t,e,r){try{let{QueueUrl:d}=await t.getQueueUrl(`${e}-${r}-dlq`);return d}catch{return null}}async function uw(t,e,r=10){try{let d=await ue(t,e),E=new pd(d.region),n=await sL(E,d.slug,e);if(!n)return{ok:!1,messages:[],error:qL};return{ok:!0,messages:((await E.receiveMessages({queueUrl:n,maxMessages:Math.min(10,Math.max(1,r)),waitTimeSeconds:1,visibilityTimeout:2})).Messages??[]).map((i)=>({id:i.MessageId,receiptHandle:i.ReceiptHandle,body:ze(String(i.Body??""))}))}}catch(d){return{ok:!1,messages:[],error:ze(d?.message??String(d))}}}async function Ow(t,e,r={}){try{let d=await ue(t,e),E=bL(t,e),c=(E?Wc(E,d.slug,e):[]).map((A)=>A.name.replace(`${d.slug}-${e}-`,"")),_=r.targetQueue&&c.includes(r.targetQueue)?r.targetQueue:c[0];if(!_)return{operation:"dlq:redrive",ok:!1,error:"No source queue is configured to redrive into."};let i=new pd(d.region),T=await sL(i,d.slug,e);if(!T)return{operation:"dlq:redrive",ok:!1,error:qL};let{QueueUrl:h}=await i.getQueueUrl(`${d.slug}-${e}-${_}`),R=Math.min(50,Math.max(1,r.max??10)),N=0;while(N<R){let u=(await i.receiveMessages({queueUrl:T,maxMessages:Math.min(10,R-N),waitTimeSeconds:1,visibilityTimeout:30})).Messages??[];if(!u.length)break;for(let U of u)await i.sendMessage({queueUrl:h,messageBody:String(U.Body??"")}),await i.deleteMessage(T,U.ReceiptHandle),N++}return{operation:"dlq:redrive",command:`redrive → ${_}`,ok:!0,stdout:`Moved ${N} message(s) from the DLQ to ${_}.`}}catch(d){return{operation:"dlq:redrive",ok:!1,error:ze(d?.message??String(d))}}}async function Cw(t,e){try{let r=await ue(t,e),d=new pd(r.region),E=await sL(d,r.slug,e);if(!E)return{operation:"dlq:purge",ok:!1,error:qL};return await d.purgeQueue(E),{operation:"dlq:purge",command:"sqs purge dlq",ok:!0,stdout:"Dead-letter queue purged."}}catch(r){return{operation:"dlq:purge",ok:!1,error:ze(r?.message??String(r))}}}function Iw(t,e){let r=bL(t,e);if(!r?.secrets)return[];return Array.isArray(r.secrets)?r.secrets.map((d)=>({key:d.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:d})):Object.entries(r.secrets).map(([d,E])=>({key:d,secretId:String(E)}))}async function lw(t,e,r,d){if(!r.trim())return{operation:"secret:set",ok:!1,error:"A secret id is required."};try{let E=await ue(t,e),n=new FE(E.region);try{await n.putSecretValue({SecretId:r,SecretString:d})}catch{await n.createSecret({Name:r,SecretString:d})}return{operation:"secret:set",command:`secret set ${r}`,ok:!0,stdout:`Secret ${r} updated. Redeploy to apply it to the functions.`}}catch(E){return{operation:"secret:set",ok:!1,error:ze(E?.message??String(E))}}}async function Dw(t,e,r){if(!r.trim())return{operation:"secret:delete",ok:!1,error:"A secret id is required."};try{let d=await ue(t,e);return await new FE(d.region).deleteSecret({SecretId:r,RecoveryWindowInDays:7}),{operation:"secret:delete",command:`secret delete ${r}`,ok:!0,stdout:`Secret ${r} scheduled for deletion (recoverable for 7 days).`}}catch(d){return{operation:"secret:delete",ok:!1,error:ze(d?.message??String(d))}}}var vB=new Set(["http","queue","cli"]);async function Uw(t,e,r,d){if(!vB.has(r))return{operation:"function:config",ok:!1,error:`Unknown function mode '${r}'.`};let E=d.memory==null?void 0:Number(d.memory),n=d.timeout==null?void 0:Number(d.timeout);if(E!=null&&(!Number.isInteger(E)||E<128||E>10240))return{operation:"function:config",ok:!1,error:"Memory must be an integer between 128 and 10240 MB."};if(n!=null&&(!Number.isInteger(n)||n<1||n>900))return{operation:"function:config",ok:!1,error:"Timeout must be an integer between 1 and 900 seconds."};if(E==null&&n==null)return{operation:"function:config",ok:!1,error:"Provide a memory and/or timeout value."};try{let c=await ue(t,e),_=new Er(c.region),i=`${c.slug}-${e}-${r}`;await _.updateFunctionConfiguration({FunctionName:i,...E!=null?{MemorySize:E}:{},...n!=null?{Timeout:n}:{}});let T=[E!=null?`${E} MB`:"",n!=null?`${n}s`:""].filter(Boolean).join(", ");return{operation:"function:config",command:`update ${i} (${T})`,ok:!0,stdout:`Updated ${i}: ${T}.`}}catch(c){return{operation:"function:config",ok:!1,error:ze(c?.message??String(c))}}}var kL=[{key:"http-errors",label:"HTTP function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"errors / 5 min"},{key:"http-throttles",label:"HTTP function throttles",namespace:"AWS/Lambda",metricName:"Throttles",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"throttles / 5 min"},{key:"http-duration",label:"HTTP function duration (avg)",namespace:"AWS/Lambda",metricName:"Duration",statistic:"Average",comparison:"GreaterThanThreshold",fnMode:"http",unit:"ms"},{key:"http-concurrency",label:"HTTP concurrent executions",namespace:"AWS/Lambda",metricName:"ConcurrentExecutions",statistic:"Maximum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"concurrent"},{key:"queue-errors",label:"Queue function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"queue",unit:"errors / 5 min"}];function QB(t){return kL.find((e)=>e.key===t)}async function fw(t,e){try{let r=await ue(t,e);return{ok:!0,alarms:await new wd(r.region).describeAlarms({AlarmNamePrefix:`${r.slug}-${e}-`,MaxRecords:100}),presets:kL}}catch(r){return{ok:!1,alarms:[],presets:kL,error:ze(r?.message??String(r))}}}async function ww(t,e,r,d){let E=QB(r);if(!E)return{operation:"alarm:create",ok:!1,error:`Unknown alarm metric '${r}'.`};if(!Number.isFinite(d)||d<0)return{operation:"alarm:create",ok:!1,error:"Provide a non-negative threshold."};try{let n=await ue(t,e),c=new wd(n.region),_=`${n.slug}-${e}-${E.key}`,i=E.fnMode?[{Name:"FunctionName",Value:`${n.slug}-${e}-${E.fnMode}`}]:[];return await c.putMetricAlarm({AlarmName:_,Namespace:E.namespace,MetricName:E.metricName,ComparisonOperator:E.comparison,Threshold:d,EvaluationPeriods:1,Period:300,Statistic:E.statistic,Dimensions:i,AlarmDescription:`ts-cloud: ${E.label} > ${d} ${E.unit}`}),{operation:"alarm:create",command:`alarm ${_}`,ok:!0,stdout:`Alarm ${_} armed at ${d} ${E.unit}.`}}catch(n){return{operation:"alarm:create",ok:!1,error:ze(n?.message??String(n))}}}async function gw(t,e,r){try{let d=await ue(t,e);if(!r.startsWith(`${d.slug}-${e}-`))return{operation:"alarm:delete",ok:!1,error:"Refusing to delete an alarm outside this environment."};return await new wd(d.region).deleteAlarms([r]),{operation:"alarm:delete",command:`delete alarm ${r}`,ok:!0,stdout:`Alarm ${r} deleted.`}}catch(d){return{operation:"alarm:delete",ok:!1,error:ze(d?.message??String(d))}}}function YB(t){let e=t.HasFault?"fault":t.HasError?"error":t.HasThrottle?"throttle":"ok";return{id:String(t.Id??""),timestamp:Number.isFinite(Number(t.StartTime))?new Date(Number(t.StartTime)*1000).toISOString():void 0,durationMs:Math.round((t.Duration??0)*1000),responseMs:Math.round((t.ResponseTime??0)*1000),status:e,method:t.Http?.HttpMethod??"-",url:t.Http?.HttpURL??"-",httpStatus:t.Http?.HttpStatus??0}}async function qh(t,e,r=30){try{let d=await ue(t,e),E=new ZL(d.region),n=new Date,c=new Date(n.getTime()-Math.min(360,Math.max(1,r))*60000),_=`${d.slug}-${e}-http`,i=await E.getTraceSummaries({startTime:c,endTime:n,filterExpression:`service("${_}")`});if(!i.summaries.length)i=await E.getTraceSummaries({startTime:c,endTime:n});return{ok:!0,traces:i.summaries.slice(0,100).map(YB)}}catch(d){return{ok:!1,traces:[],error:ze(d?.message??String(d))}}}async function oL(t,e,r){try{let d=await ue(t,e),E=`${d.slug}-${e}-scheduler`;if(r==="run"){let c=await M_(t,e,"schedule:run");return{operation:"scheduler:run",command:"schedule:run",ok:!0,stdout:ze(c||"Scheduler run triggered.")}}let n=new GA(d.region);if(r==="enable")await n.enableRule({Name:E});else await n.disableRule({Name:E});return{operation:`scheduler:${r}`,command:`${r} ${E}`,ok:!0,stdout:`Scheduler rule ${E} ${r}d.`}}catch(d){return{operation:`scheduler:${r}`,ok:!1,error:ze(d?.message??String(d))}}}function $w(t){let e=sh(t.name),r=pL(t.configText);if(VB(t.configText,r.start,r.end,e))throw Error(`Site '${e}' already exists in cloud.config.ts`);let d=GB({...t,name:e}),E=t.configText.slice(0,r.end).trimEnd(),n=t.configText.slice(r.end),c=E.endsWith("{")?`
 `:E.endsWith(",")?`
 
 `:`,
@@ -6617,7 +6617,7 @@ ${e.map(([r,d])=>`        '${hE(r)}': '${hE(d)}',`).join(`
 `)}
       }`}function MB(t,e,r){let d=e;while(d<r&&/\s/.test(t[d]))d++;let E=0,n,c=!1;for(;d<r;d++){let _=t[d];if(n){if(c){c=!1;continue}if(_==="\\"){c=!0;continue}if(_===n)n=void 0;continue}if(_==='"'||_==="'"||_==="`"){n=_;continue}if(_==="{"||_==="["||_==="("){E++;continue}if(_==="}"||_==="]"||_===")"){if(E===0)return d;E--;continue}if(_===","&&E===0)return d}return r}function Bw(t,e,r,d){let E=t.slice(e+1,r),n=new RegExp(`(^|[\\s,{])(${tu(d)})\\s*:\\s*\\{`,"m").exec(E);if(!n)return null;let c=e+1+n.index+n[1].length,_=t.indexOf("{",c);return{nameStart:c,end:Jw(t,_)}}function GB(t){let r=[`    ${sh(t.name)}: {`];if(iE(r,"deploy",t.deploy),iE(r,"root",t.root),iE(r,"path",t.path),iE(r,"domain",t.domain),iE(r,"type",t.type),iE(r,"build",t.build),iE(r,"start",t.start),t.port!==void 0)r.push(`      port: ${t.port},`);if(iE(r,"pathRewriteStyle",t.pathRewriteStyle),t.ssl!==void 0)if(t.ssl===!1)r.push("      ssl: false,");else if(t.ssl===!0)r.push("      ssl: true,");else r.push(`      ssl: { provider: '${hE(t.ssl.provider||"letsencrypt")}' },`);if(t.env&&Object.keys(t.env).length>0){r.push("      env: {");for(let[d,E]of Object.entries(t.env)){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(d))continue;r.push(`        ${d}: '${hE(String(E))}',`)}r.push("      },")}return r.push("    },"),r.join(`
 `)}function hE(t){return t.replace(/\\/g,"\\\\").replaceAll(String.fromCharCode(39),"\\'").replace(/\r/g,"\\r").replace(/\n/g,"\\n")}function sh(t){let e=t.trim();if(!/^[A-Za-z_$][\w$]*$/.test(e))throw Error(`Invalid site name '${t}'. Use a valid JavaScript object key, e.g. docs or marketingSite.`);return e}function iE(t,e,r){if(r===void 0||r==="")return;let d=r.replace(/\\/g,"\\\\").replaceAll(String.fromCharCode(39),"\\'");t.push(`      ${e}: '${d}',`)}function pL(t){let e=/\bsites\s*:\s*{/g.exec(t);if(!e)throw Error("Could not find a top-level sites: { ... } block in cloud.config.ts");let r=t.indexOf("{",e.index),d=Jw(t,r);return{start:r,end:d}}function VB(t,e,r,d){let E=t.slice(e+1,r);return new RegExp(`(^|[\\s,{])${tu(d)}\\s*:`,"m").test(E)}function tu(t){return t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Jw(t,e){let r=0,d,E=!1,n=!1,c=!1;for(let _=e;_<t.length;_++){let i=t[_],T=t[_+1];if(n){if(i===`
-`)n=!1;continue}if(c){if(i==="*"&&T==="/")c=!1,_++;continue}if(d){if(E){E=!1;continue}if(i==="\\"){E=!0;continue}if(i===d)d=void 0;continue}if(i==="/"&&T==="/"){n=!0,_++;continue}if(i==="/"&&T==="*"){c=!0,_++;continue}if(i==='"'||i==="'"||i==="`"){d=i;continue}if(i==="{")r++;if(i==="}"){if(r--,r===0)return _}}throw Error("Could not find the closing brace for sites: { ... } in cloud.config.ts")}function Hw(t,e,r){let d=(Array.isArray(r)?r:String(r??"").split(",")).map(String).filter(Boolean);if(!d.length){if(e)return;let n=t.map((c)=>c.id);return n.length?n:["__no_authorized_telemetry_resources__"]}let E=d.map((n)=>t.find((c)=>c.id===n||c.slug===n)?.id).filter((n)=>!!n);if(E.length!==d.length)throw Error("One or more telemetry resources are outside your authorized scope.");return[...new Set(E)]}await Wt();import{createHash as vw}from"node:crypto";class Qw{now;entries=new Map;constructor(t=Date.now){this.now=t}async getOrCreate(t,e,r,d){let E=this.entries.get(t);if(!r&&E&&E.expiresAt>this.now())return{value:await E.promise,cached:!0};let n=d().catch((c)=>{throw this.entries.delete(t),c});return this.entries.set(t,{expiresAt:this.now()+e,promise:n}),{value:await n,cached:!1}}invalidate(t){for(let e of this.entries.keys())if(e.startsWith(t))this.entries.delete(e)}}class Yw{now;lastRun=new Map;constructor(t=Date.now){this.now=t}shouldRun(t,e,r=!1){let d=this.now(),E=this.lastRun.get(t);if(!r&&E!=null&&d-E<e)return!1;return this.lastRun.set(t,d),!0}}var Mw=new Qw,KB=new Yw,ZB=2000,kB=3600000;function bB(t,e){if(t.kind==="log"&&!e.collectLogs)return!1;if(t.kind==="trace"&&!e.collectTraces)return!1;if((t.kind==="request"||t.name.startsWith("request."))&&!e.collectRequestAnalytics)return!1;if(!["log","trace","request"].includes(t.kind)&&!t.name.startsWith("request."))return!0;let r=t.requestId??t.traceId??`${t.source}\x00${t.workloadId??""}\x00${t.timestamp}`;return Number.parseInt(vw("sha256").update(r).digest("hex").slice(0,8),16)/4294967295<=e.samplingRate}function Ve(...t){return`telemetry:${vw("sha256").update(t.map((e)=>String(e??"")).join("\x00")).digest("hex").slice(0,40)}`}function s_(t,e,r,d){if(!d)return;return t.listResources(e,r).find((E)=>E.slug===d)?.id}function xB(t,e){let r=String(e??"").toLowerCase();if(["debug","info","warn","warning","error","fatal"].includes(r))return r==="fatal"?"error":r;return/fatal|panic|exception|error/i.test(t)?"error":/warn|timeout|throttl|retr(?:y|ies)/i.test(t)?"warning":"info"}function Ww(t){let e=t.timestamp&&Number.isFinite(new Date(t.timestamp).getTime())?new Date(t.timestamp).toISOString():new Date().toISOString(),r={};try{let U=JSON.parse(t.message);if(U&&typeof U==="object"&&!Array.isArray(U))r=U}catch{}let d=Object.fromEntries(Object.entries(r).filter(([U])=>!/^(?:body|requestBody|responseBody|headers|authorization|cookie|cookies|query|queryString)$/i.test(U))),E=String(r.requestId??r.request_id??r["x-request-id"]??"")||void 0,n=String(r.traceId??r.trace_id??r["x-amzn-trace-id"]??"")||void 0,c=Number(r.durationMs??r.duration_ms??r.latencyMs??r.latency_ms),_=Number(r.statusCode??r.status_code??r.status),i=String(r.method??r.httpMethod??"")||void 0,T=XT(String(r.pathTemplate??r.path??r.url??"")||void 0),h=String(r.releaseId??r.release_id??"")||void 0,R=String(r.deploymentId??r.deployment_id??"")||void 0,N={projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,source:t.source,timestamp:e,requestId:E,traceId:n,releaseId:h,deploymentId:R,workloadId:t.workloadId},A=Object.keys(r).length?JSON.stringify(d):t.message,u=[{...N,id:Ve(t.source,t.name,e,A),kind:"log",name:t.name,level:xB(A,r.level),message:A,attributes:d}];if(i&&T&&Number.isFinite(_)){if(u.push({...N,id:Ve("request",E,e,i,T,_),kind:"request",name:"http.request",method:i,pathTemplate:T,host:r.host,statusCode:_,durationMs:Number.isFinite(c)?c:void 0,bytesIn:Number(r.bytesIn)||void 0,bytesOut:Number(r.bytesOut)||void 0,region:r.region,cacheResult:r.cacheResult??r.cache,upstream:r.upstream,attributes:{userAgentFamily:r.userAgentFamily??"",protocol:r.protocol??""}}),Number.isFinite(c))u.push({...N,id:Ve("request-duration",E,e),kind:"metric",name:"request.duration",value:c,unit:"ms",attributes:{method:i,pathTemplate:T,statusCode:_}});if(u.push({...N,id:Ve("request-count",E,e),kind:"metric",name:"request.count",value:1,unit:"count",attributes:{method:i,pathTemplate:T,statusCode:_}}),_>=500)u.push({...N,id:Ve("request-error",E,e),kind:"metric",name:"request.error",value:1,unit:"count",attributes:{method:i,pathTemplate:T,statusCode:_}})}return u}async function qB(t){let e=new UE(t.controlPlane),r=Dn(t.controlPlane,t.projectId),d=new Date,E=[],n=[],c={projectId:t.projectId,environmentId:t.environmentId},_=dd(t.config);try{let N=(_==="serverless"?await Fh(t.config,t.environment):await Bh(t.config,t.environment,{includeSiteHealth:t.includeSiteHealth,telemetryOnly:t.lightweight}))??{};if(_==="serverless"){for(let u of N.functionsDetail??[]){let U=s_(t.controlPlane,t.projectId,t.environmentId,u.key),w={...c,resourceId:U,source:"cloudwatch",timestamp:d.toISOString(),workloadId:u.name,attributes:{provider:"aws",functionName:u.name,aggregationWindow:"24h"}};for(let[l,P,a]of[["snapshot.traffic.requests_24h",u.invocations,"count"],["snapshot.errors.count_24h",u.errors,"count"],["snapshot.latency.p50_24h",u.p50,"ms"],["snapshot.latency.p95_24h",u.p95,"ms"],["snapshot.latency.p99_24h",u.p99,"ms"],["snapshot.saturation.throttles_24h",u.throttles,"count"],["snapshot.memory.max_24h",u.maxMem,"MB"]])if(Number.isFinite(Number(P)))E.push({...w,id:Ve("cloudwatch",u.name,l,d.toISOString()),kind:"metric",name:l,value:Number(P),unit:a})}try{let u=await Le(t.config,t.environment),U=new wd(u.region),w=new Date(d.getTime()-3600000),l=300;for(let P of u.functions){let a=[{Name:"FunctionName",Value:P.name}],[j,B,F,J,K]=await Promise.all([U.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:a,StartTime:w,EndTime:d,Period:300,Statistics:["Sum"]}),U.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Errors",Dimensions:a,StartTime:w,EndTime:d,Period:300,Statistics:["Sum"]}),U.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:a,StartTime:w,EndTime:d,Period:300,ExtendedStatistics:["p50","p95","p99"]}),U.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Throttles",Dimensions:a,StartTime:w,EndTime:d,Period:300,Statistics:["Sum"]}),U.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"ConcurrentExecutions",Dimensions:a,StartTime:w,EndTime:d,Period:300,Statistics:["Maximum"]})]),s=s_(t.controlPlane,t.projectId,t.environmentId,P.mode),tt=(q,it,Et,lt)=>{for(let gt of q){let $=gt.Timestamp&&Number.isFinite(new Date(gt.Timestamp).getTime())?new Date(gt.Timestamp).toISOString():void 0,W=Et(gt);if($&&W!=null&&Number.isFinite(W))E.push({...c,resourceId:s,id:Ve("cloudwatch-series",P.name,it,$),kind:"metric",source:"cloudwatch",name:it,timestamp:$,value:W,unit:lt,workloadId:P.name,region:u.region,attributes:{provider:"aws",functionName:P.name,aggregationWindow:"300s"}})}};tt(j,"traffic.requests",(q)=>q.Sum,"count"),tt(B,"errors.count",(q)=>q.Sum,"count"),tt(F,"latency.p50",(q)=>q.Percentiles?.p50,"ms"),tt(F,"latency.p95",(q)=>q.Percentiles?.p95,"ms"),tt(F,"latency.p99",(q)=>q.Percentiles?.p99,"ms"),tt(J,"saturation.throttles",(q)=>q.Sum,"count"),tt(K,"saturation.concurrency",(q)=>q.Maximum,"count")}}catch(u){n.push({source:"cloudwatch:series",message:u instanceof Error?u.message:String(u)})}for(let u of(N.serverlessLogs??[]).slice(0,ZB))E.push(...Ww({...c,source:`cloudwatch:${u.source}`,name:`${u.source}.log`,timestamp:u.timestamp,message:String(u.message),resourceId:s_(t.controlPlane,t.projectId,t.environmentId,u.source)}));for(let u of N.queuesDetail??[]){let U={...c,source:"cloudwatch",timestamp:d.toISOString(),attributes:{queue:u.name}};E.push({...U,id:Ve("queue-depth",u.name,d.toISOString()),kind:"metric",name:"queue.depth",value:Number(u.visible??u.depth??0),unit:"count"}),E.push({...U,id:Ve("queue-inflight",u.name,d.toISOString()),kind:"metric",name:"queue.inflight",value:Number(u.inFlight??0),unit:"count"})}let A=await qh(t.config,t.environment,30);if(!A.ok)n.push({source:"xray",message:A.error??"X-Ray traces are unavailable."});for(let u of A.traces)E.push({...c,id:Ve("xray",u.id),kind:"trace",source:"xray",name:"http.trace",timestamp:u.timestamp??d.toISOString(),traceId:u.id,durationMs:u.durationMs,statusCode:u.httpStatus,method:u.method,pathTemplate:u.url,attributes:{status:u.status,responseMs:u.responseMs}})}else{let A=N.systemMetrics;if(N.metricsUnavailable||!A)n.push({source:"host",message:"The host metrics probe is unavailable."});else{let u=Number(A.memTotalMb)>0?Number(A.memUsedMb)/Number(A.memTotalMb)*100:0,U=Number(A.swapTotalMb)>0?Number(A.swapUsedMb)/Number(A.swapTotalMb)*100:0,w=[["host.load",Number(A.load),"load"],["host.load.5m",Number(A.load5),"load"],["host.load.15m",Number(A.load15),"load"],["host.cpu.capacity",Number(A.cpus),"count"],["host.cpu.used_percent",Number(A.cpuUsedPct),"percent"],["host.memory.used",Number(A.memUsedMb)*1024*1024,"bytes"],["host.memory.total",Number(A.memTotalMb)*1024*1024,"bytes"],["host.memory.available",Number(A.memAvailableMb)*1024*1024,"bytes"],["host.memory.cache",Number(A.memCacheMb)*1024*1024,"bytes"],["host.memory.used_percent",u,"percent"],["host.swap.used",Number(A.swapUsedMb)*1024*1024,"bytes"],["host.swap.total",Number(A.swapTotalMb)*1024*1024,"bytes"],["host.swap.used_percent",U,"percent"],["host.disk.used_percent",Number(A.diskUsedPct),"percent"],["host.disk.used",Number(A.diskUsedGb)*1073741824,"bytes"],["host.disk.total",Number(A.diskTotalGb)*1073741824,"bytes"],["host.disk.inode_used_percent",Number(A.inodeUsedPct),"percent"],["host.network.rx",Number(A.networkRxBytes),"bytes"],["host.network.tx",Number(A.networkTxBytes),"bytes"],["host.processes",Number(A.processes),"count"],["host.uptime",Number(A.uptimeSeconds),"seconds"]];for(let[l,P,a]of w)if(Number.isFinite(P))E.push({...c,id:Ve("host",l,d.toISOString()),kind:"metric",source:"host",name:l,timestamp:d.toISOString(),value:P,unit:a});for(let l of N.siteHealth??[]){let P=String(l.project??t.config.project.slug),a=String(l.name),j=a.startsWith(`${P}:`)?a.slice(P.length+1):a,B=`site:${P}:${j}`,F=s_(t.controlPlane,t.projectId,t.environmentId,a),J={...c,resourceId:F,source:B,timestamp:l.checkedAt||d.toISOString(),host:l.route,attributes:{project:P,site:j,route:String(l.route),status:String(l.status)}},K=[["site.health.up",l.status==="live"?1:0,"boolean"],["site.http.status",Number(l.httpStatus),"status"],["site.response.time",Number(l.responseMs),"ms"]];if(l.tlsDaysRemaining!=null)K.push(["site.tls.days_remaining",Number(l.tlsDaysRemaining),"days"]);for(let[s,tt,q]of K)if(Number.isFinite(tt))E.push({...J,id:Ve(B,s,J.timestamp),kind:"metric",name:s,value:tt,unit:q})}}}}catch(N){n.push({source:_==="serverless"?"aws":"host",message:N instanceof Error?N.message:String(N)})}if(!t.lightweight)try{let N=await Br(t.config,t.environment),A=new or(t.config,t.environment,{inventory:async()=>N});for(let u of N.workloads){let U=s_(t.controlPlane,t.projectId,t.environmentId,u.links.service),w={...c,resourceId:U,source:`runtime:${u.provider}`,timestamp:d.toISOString(),workloadId:u.id,releaseId:u.links.release,attributes:{status:u.status,provider:u.provider,service:u.links.service??""}};if(E.push({...w,id:Ve(u.id,"health",d.toISOString()),kind:"metric",name:"health.up",value:u.status==="running"?1:0,unit:"boolean"}),E.push({...w,id:Ve(u.id,"restarts",d.toISOString()),kind:"metric",name:"saturation.restarts",value:u.restartCount??0,unit:"count"}),u.resources?.memoryBytes!=null)E.push({...w,id:Ve(u.id,"memory",d.toISOString()),kind:"metric",name:"runtime.memory.used",value:u.resources.memoryBytes,unit:"bytes"});if(!u.capabilities.logs.supported)continue;try{let l=await A.logs(u.id,{limit:100,since:new Date(d.getTime()-300000)});for(let P of l.lines)E.push(...Ww({...c,resourceId:U,source:`runtime:${u.provider}`,name:`${u.links.service??u.name}.log`,timestamp:P.timestamp,message:P.message,workloadId:u.id}))}catch(l){n.push({source:`runtime:${u.provider}`,message:l instanceof Error?l.message:String(l)})}}for(let u of N.sources.filter((U)=>U.status!=="fresh"))n.push({source:u.id,message:u.message??`Runtime source is ${u.status}.`})}catch(N){n.push({source:"runtime",message:N instanceof Error?N.message:String(N)})}if(!t.lightweight)for(let N of t.controlPlane.listEvents({projectId:t.projectId,limit:1000})){let A=N.payload;E.push({...c,id:`telemetry:event:${N.id}`,resourceId:N.resourceId,kind:"event",source:"control-plane",name:N.type,timestamp:N.createdAt,level:N.level,message:N.type,deploymentId:N.operationId,releaseId:typeof A.releaseId==="string"?A.releaseId:void 0,traceId:N.correlationId,attributes:A})}let i=E.filter((N)=>bB(N,r)).map((N)=>({...N,sampled:r.samplingRate<1&&(N.kind==="log"||N.kind==="trace"||N.kind==="request"||N.name.startsWith("request."))})),T=e.appendMany(i).length;if(KB.shouldRun(t.projectId,kB,!t.lightweight))e.enforceRetention(r,t.projectId);let h=e.status(t.projectId,t.environmentId,r.rawDays,r.samplingRate);for(let N of n)if(!h.some((A)=>A.source===N.source))h.push({source:N.source,freshness:"unavailable",samplingRate:r.samplingRate,retentionDays:r.rawDays,estimatedDailyBytes:0,message:N.message});let R=d.toISOString();return t.controlPlane.setSetting(`telemetry.collection:${t.projectId}:${t.environmentId??"all"}`,{generatedAt:R,errors:n,statuses:h,policy:r}),{collected:T,cached:!1,generatedAt:R,statuses:h,errors:n,policy:r}}async function eu(t){let r=`${`${t.projectId}:${t.environmentId??"all"}:${t.environment}`}:${t.lightweight?"lightweight":"full"}`,d=dd(t.config)==="serverless"?300000:60000,E=await Mw.getOrCreate(r,d,!!t.force,()=>qB(t));return{...E.value,cached:E.cached}}function Gw(t){Mw.invalidate(`${t}:`)}function Vw(t,e={}){let r=e.shell||(process.platform==="win32"?"powershell.exe":"bash"),d=Bun.spawn([r,"-i"],{stdin:"pipe",stdout:"pipe",stderr:"pipe",cwd:e.cwd,env:{...process.env,TERM:"xterm-256color",PS1:"\\w $ "}}),E=new TextDecoder,n=async(c)=>{if(!c)return;let _=c.getReader();try{for(;;){let{done:i,value:T}=await _.read();if(i)break;if(T)t(E.decode(T))}}catch{}};if(n(d.stdout),n(d.stderr),e.onExit)d.exited.then((c)=>e.onExit(c)).catch(()=>{});return{write(c){try{d.stdin.write(c),d.stdin.flush()}catch{}},close(){try{d.stdin.end()}catch{}try{d.kill()}catch{}}}}var dJ="127.0.0.1",EJ=7676,Zw=65536,tg="ts-cloud-dashboard-",Pc=oB(rJ(import.meta.url));function nJ(t){try{return process.kill(t,0),!0}catch(e){return e?.code!=="ESRCH"}}function cJ(t=ph(),e=nJ){let r=0;for(let d of Kw(t,{withFileTypes:!0})){if(!d.isDirectory()||!d.name.startsWith(tg))continue;let E=vt(t,d.name),n=d.name.match(/^ts-cloud-dashboard-(\d+)-/);if(n){let c=Number(n[1]);if(c===process.pid||e(c))continue}else if(Kw(E).length>0)continue;_n(E,{recursive:!0,force:!0}),r+=1}return r}var _J={".html":"text/html; charset=utf-8",".css":"text/css; charset=utf-8",".js":"text/javascript; charset=utf-8",".json":"application/json; charset=utf-8",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".ico":"image/x-icon"};function O(t,e=200,r={}){return new Response(JSON.stringify(t,null,2),{status:e,headers:{"content-type":"application/json; charset=utf-8",...r}})}function TJ(t,e,r,d){let E=new TextEncoder,n=Math.max(0,Math.floor(r)),c,_,i=!1,T=new ReadableStream({start(h){let R=()=>{if(i)return;if(i=!0,c?.(),_)clearInterval(_);d.removeEventListener("abort",R);try{h.close()}catch{}},N=(u)=>{if(i)return;if(u.reset)h.enqueue(E.encode(`event: reset
+`)n=!1;continue}if(c){if(i==="*"&&T==="/")c=!1,_++;continue}if(d){if(E){E=!1;continue}if(i==="\\"){E=!0;continue}if(i===d)d=void 0;continue}if(i==="/"&&T==="/"){n=!0,_++;continue}if(i==="/"&&T==="*"){c=!0,_++;continue}if(i==='"'||i==="'"||i==="`"){d=i;continue}if(i==="{")r++;if(i==="}"){if(r--,r===0)return _}}throw Error("Could not find the closing brace for sites: { ... } in cloud.config.ts")}function Hw(t,e,r){let d=(Array.isArray(r)?r:String(r??"").split(",")).map(String).filter(Boolean);if(!d.length){if(e)return;let n=t.map((c)=>c.id);return n.length?n:["__no_authorized_telemetry_resources__"]}let E=d.map((n)=>t.find((c)=>c.id===n||c.slug===n)?.id).filter((n)=>!!n);if(E.length!==d.length)throw Error("One or more telemetry resources are outside your authorized scope.");return[...new Set(E)]}await Wt();import{createHash as vw}from"node:crypto";class Qw{now;entries=new Map;constructor(t=Date.now){this.now=t}async getOrCreate(t,e,r,d){let E=this.entries.get(t);if(!r&&E&&E.expiresAt>this.now())return{value:await E.promise,cached:!0};let n=d().catch((c)=>{throw this.entries.delete(t),c});return this.entries.set(t,{expiresAt:this.now()+e,promise:n}),{value:await n,cached:!1}}invalidate(t){for(let e of this.entries.keys())if(e.startsWith(t))this.entries.delete(e)}}class Yw{now;lastRun=new Map;constructor(t=Date.now){this.now=t}shouldRun(t,e,r=!1){let d=this.now(),E=this.lastRun.get(t);if(!r&&E!=null&&d-E<e)return!1;return this.lastRun.set(t,d),!0}}var Mw=new Qw,KB=new Yw,ZB=2000,kB=3600000;function bB(t,e){if(t.kind==="log"&&!e.collectLogs)return!1;if(t.kind==="trace"&&!e.collectTraces)return!1;if((t.kind==="request"||t.name.startsWith("request."))&&!e.collectRequestAnalytics)return!1;if(!["log","trace","request"].includes(t.kind)&&!t.name.startsWith("request."))return!0;let r=t.requestId??t.traceId??`${t.source}\x00${t.workloadId??""}\x00${t.timestamp}`;return Number.parseInt(vw("sha256").update(r).digest("hex").slice(0,8),16)/4294967295<=e.samplingRate}function Ve(...t){return`telemetry:${vw("sha256").update(t.map((e)=>String(e??"")).join("\x00")).digest("hex").slice(0,40)}`}function s_(t,e,r,d){if(!d)return;return t.listResources(e,r).find((E)=>E.slug===d)?.id}function xB(t,e){let r=String(e??"").toLowerCase();if(["debug","info","warn","warning","error","fatal"].includes(r))return r==="fatal"?"error":r;return/fatal|panic|exception|error/i.test(t)?"error":/warn|timeout|throttl|retr(?:y|ies)/i.test(t)?"warning":"info"}function Ww(t){let e=t.timestamp&&Number.isFinite(new Date(t.timestamp).getTime())?new Date(t.timestamp).toISOString():new Date().toISOString(),r={};try{let U=JSON.parse(t.message);if(U&&typeof U==="object"&&!Array.isArray(U))r=U}catch{}let d=Object.fromEntries(Object.entries(r).filter(([U])=>!/^(?:body|requestBody|responseBody|headers|authorization|cookie|cookies|query|queryString)$/i.test(U))),E=String(r.requestId??r.request_id??r["x-request-id"]??"")||void 0,n=String(r.traceId??r.trace_id??r["x-amzn-trace-id"]??"")||void 0,c=Number(r.durationMs??r.duration_ms??r.latencyMs??r.latency_ms),_=Number(r.statusCode??r.status_code??r.status),i=String(r.method??r.httpMethod??"")||void 0,T=XT(String(r.pathTemplate??r.path??r.url??"")||void 0),h=String(r.releaseId??r.release_id??"")||void 0,R=String(r.deploymentId??r.deployment_id??"")||void 0,N={projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,source:t.source,timestamp:e,requestId:E,traceId:n,releaseId:h,deploymentId:R,workloadId:t.workloadId},A=Object.keys(r).length?JSON.stringify(d):t.message,u=[{...N,id:Ve(t.source,t.name,e,A),kind:"log",name:t.name,level:xB(A,r.level),message:A,attributes:d}];if(i&&T&&Number.isFinite(_)){if(u.push({...N,id:Ve("request",E,e,i,T,_),kind:"request",name:"http.request",method:i,pathTemplate:T,host:r.host,statusCode:_,durationMs:Number.isFinite(c)?c:void 0,bytesIn:Number(r.bytesIn)||void 0,bytesOut:Number(r.bytesOut)||void 0,region:r.region,cacheResult:r.cacheResult??r.cache,upstream:r.upstream,attributes:{userAgentFamily:r.userAgentFamily??"",protocol:r.protocol??""}}),Number.isFinite(c))u.push({...N,id:Ve("request-duration",E,e),kind:"metric",name:"request.duration",value:c,unit:"ms",attributes:{method:i,pathTemplate:T,statusCode:_}});if(u.push({...N,id:Ve("request-count",E,e),kind:"metric",name:"request.count",value:1,unit:"count",attributes:{method:i,pathTemplate:T,statusCode:_}}),_>=500)u.push({...N,id:Ve("request-error",E,e),kind:"metric",name:"request.error",value:1,unit:"count",attributes:{method:i,pathTemplate:T,statusCode:_}})}return u}async function qB(t){let e=new UE(t.controlPlane),r=Dn(t.controlPlane,t.projectId),d=new Date,E=[],n=[],c={projectId:t.projectId,environmentId:t.environmentId},_=dd(t.config);try{let N=(_==="serverless"?await Fh(t.config,t.environment):await Bh(t.config,t.environment,{includeSiteHealth:t.includeSiteHealth,telemetryOnly:t.lightweight}))??{};if(_==="serverless"){for(let u of N.functionsDetail??[]){let U=s_(t.controlPlane,t.projectId,t.environmentId,u.key),w={...c,resourceId:U,source:"cloudwatch",timestamp:d.toISOString(),workloadId:u.name,attributes:{provider:"aws",functionName:u.name,aggregationWindow:"24h"}};for(let[l,P,a]of[["snapshot.traffic.requests_24h",u.invocations,"count"],["snapshot.errors.count_24h",u.errors,"count"],["snapshot.latency.p50_24h",u.p50,"ms"],["snapshot.latency.p95_24h",u.p95,"ms"],["snapshot.latency.p99_24h",u.p99,"ms"],["snapshot.saturation.throttles_24h",u.throttles,"count"],["snapshot.memory.max_24h",u.maxMem,"MB"]])if(Number.isFinite(Number(P)))E.push({...w,id:Ve("cloudwatch",u.name,l,d.toISOString()),kind:"metric",name:l,value:Number(P),unit:a})}try{let u=await ue(t.config,t.environment),U=new wd(u.region),w=new Date(d.getTime()-3600000),l=300;for(let P of u.functions){let a=[{Name:"FunctionName",Value:P.name}],[j,B,F,J,K]=await Promise.all([U.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:a,StartTime:w,EndTime:d,Period:300,Statistics:["Sum"]}),U.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Errors",Dimensions:a,StartTime:w,EndTime:d,Period:300,Statistics:["Sum"]}),U.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:a,StartTime:w,EndTime:d,Period:300,ExtendedStatistics:["p50","p95","p99"]}),U.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Throttles",Dimensions:a,StartTime:w,EndTime:d,Period:300,Statistics:["Sum"]}),U.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"ConcurrentExecutions",Dimensions:a,StartTime:w,EndTime:d,Period:300,Statistics:["Maximum"]})]),s=s_(t.controlPlane,t.projectId,t.environmentId,P.mode),tt=(q,it,Et,lt)=>{for(let gt of q){let $=gt.Timestamp&&Number.isFinite(new Date(gt.Timestamp).getTime())?new Date(gt.Timestamp).toISOString():void 0,W=Et(gt);if($&&W!=null&&Number.isFinite(W))E.push({...c,resourceId:s,id:Ve("cloudwatch-series",P.name,it,$),kind:"metric",source:"cloudwatch",name:it,timestamp:$,value:W,unit:lt,workloadId:P.name,region:u.region,attributes:{provider:"aws",functionName:P.name,aggregationWindow:"300s"}})}};tt(j,"traffic.requests",(q)=>q.Sum,"count"),tt(B,"errors.count",(q)=>q.Sum,"count"),tt(F,"latency.p50",(q)=>q.Percentiles?.p50,"ms"),tt(F,"latency.p95",(q)=>q.Percentiles?.p95,"ms"),tt(F,"latency.p99",(q)=>q.Percentiles?.p99,"ms"),tt(J,"saturation.throttles",(q)=>q.Sum,"count"),tt(K,"saturation.concurrency",(q)=>q.Maximum,"count")}}catch(u){n.push({source:"cloudwatch:series",message:u instanceof Error?u.message:String(u)})}for(let u of(N.serverlessLogs??[]).slice(0,ZB))E.push(...Ww({...c,source:`cloudwatch:${u.source}`,name:`${u.source}.log`,timestamp:u.timestamp,message:String(u.message),resourceId:s_(t.controlPlane,t.projectId,t.environmentId,u.source)}));for(let u of N.queuesDetail??[]){let U={...c,source:"cloudwatch",timestamp:d.toISOString(),attributes:{queue:u.name}};E.push({...U,id:Ve("queue-depth",u.name,d.toISOString()),kind:"metric",name:"queue.depth",value:Number(u.visible??u.depth??0),unit:"count"}),E.push({...U,id:Ve("queue-inflight",u.name,d.toISOString()),kind:"metric",name:"queue.inflight",value:Number(u.inFlight??0),unit:"count"})}let A=await qh(t.config,t.environment,30);if(!A.ok)n.push({source:"xray",message:A.error??"X-Ray traces are unavailable."});for(let u of A.traces)E.push({...c,id:Ve("xray",u.id),kind:"trace",source:"xray",name:"http.trace",timestamp:u.timestamp??d.toISOString(),traceId:u.id,durationMs:u.durationMs,statusCode:u.httpStatus,method:u.method,pathTemplate:u.url,attributes:{status:u.status,responseMs:u.responseMs}})}else{let A=N.systemMetrics;if(N.metricsUnavailable||!A)n.push({source:"host",message:"The host metrics probe is unavailable."});else{let u=Number(A.memTotalMb)>0?Number(A.memUsedMb)/Number(A.memTotalMb)*100:0,U=Number(A.swapTotalMb)>0?Number(A.swapUsedMb)/Number(A.swapTotalMb)*100:0,w=[["host.load",Number(A.load),"load"],["host.load.5m",Number(A.load5),"load"],["host.load.15m",Number(A.load15),"load"],["host.cpu.capacity",Number(A.cpus),"count"],["host.cpu.used_percent",Number(A.cpuUsedPct),"percent"],["host.memory.used",Number(A.memUsedMb)*1024*1024,"bytes"],["host.memory.total",Number(A.memTotalMb)*1024*1024,"bytes"],["host.memory.available",Number(A.memAvailableMb)*1024*1024,"bytes"],["host.memory.cache",Number(A.memCacheMb)*1024*1024,"bytes"],["host.memory.used_percent",u,"percent"],["host.swap.used",Number(A.swapUsedMb)*1024*1024,"bytes"],["host.swap.total",Number(A.swapTotalMb)*1024*1024,"bytes"],["host.swap.used_percent",U,"percent"],["host.disk.used_percent",Number(A.diskUsedPct),"percent"],["host.disk.used",Number(A.diskUsedGb)*1073741824,"bytes"],["host.disk.total",Number(A.diskTotalGb)*1073741824,"bytes"],["host.disk.inode_used_percent",Number(A.inodeUsedPct),"percent"],["host.network.rx",Number(A.networkRxBytes),"bytes"],["host.network.tx",Number(A.networkTxBytes),"bytes"],["host.processes",Number(A.processes),"count"],["host.uptime",Number(A.uptimeSeconds),"seconds"]];for(let[l,P,a]of w)if(Number.isFinite(P))E.push({...c,id:Ve("host",l,d.toISOString()),kind:"metric",source:"host",name:l,timestamp:d.toISOString(),value:P,unit:a});for(let l of N.siteHealth??[]){let P=String(l.project??t.config.project.slug),a=String(l.name),j=a.startsWith(`${P}:`)?a.slice(P.length+1):a,B=`site:${P}:${j}`,F=s_(t.controlPlane,t.projectId,t.environmentId,a),J={...c,resourceId:F,source:B,timestamp:l.checkedAt||d.toISOString(),host:l.route,attributes:{project:P,site:j,route:String(l.route),status:String(l.status)}},K=[["site.health.up",l.status==="live"?1:0,"boolean"],["site.http.status",Number(l.httpStatus),"status"],["site.response.time",Number(l.responseMs),"ms"]];if(l.tlsDaysRemaining!=null)K.push(["site.tls.days_remaining",Number(l.tlsDaysRemaining),"days"]);for(let[s,tt,q]of K)if(Number.isFinite(tt))E.push({...J,id:Ve(B,s,J.timestamp),kind:"metric",name:s,value:tt,unit:q})}}}}catch(N){n.push({source:_==="serverless"?"aws":"host",message:N instanceof Error?N.message:String(N)})}if(!t.lightweight)try{let N=await Br(t.config,t.environment),A=new or(t.config,t.environment,{inventory:async()=>N});for(let u of N.workloads){let U=s_(t.controlPlane,t.projectId,t.environmentId,u.links.service),w={...c,resourceId:U,source:`runtime:${u.provider}`,timestamp:d.toISOString(),workloadId:u.id,releaseId:u.links.release,attributes:{status:u.status,provider:u.provider,service:u.links.service??""}};if(E.push({...w,id:Ve(u.id,"health",d.toISOString()),kind:"metric",name:"health.up",value:u.status==="running"?1:0,unit:"boolean"}),E.push({...w,id:Ve(u.id,"restarts",d.toISOString()),kind:"metric",name:"saturation.restarts",value:u.restartCount??0,unit:"count"}),u.resources?.memoryBytes!=null)E.push({...w,id:Ve(u.id,"memory",d.toISOString()),kind:"metric",name:"runtime.memory.used",value:u.resources.memoryBytes,unit:"bytes"});if(!u.capabilities.logs.supported)continue;try{let l=await A.logs(u.id,{limit:100,since:new Date(d.getTime()-300000)});for(let P of l.lines)E.push(...Ww({...c,resourceId:U,source:`runtime:${u.provider}`,name:`${u.links.service??u.name}.log`,timestamp:P.timestamp,message:P.message,workloadId:u.id}))}catch(l){n.push({source:`runtime:${u.provider}`,message:l instanceof Error?l.message:String(l)})}}for(let u of N.sources.filter((U)=>U.status!=="fresh"))n.push({source:u.id,message:u.message??`Runtime source is ${u.status}.`})}catch(N){n.push({source:"runtime",message:N instanceof Error?N.message:String(N)})}if(!t.lightweight)for(let N of t.controlPlane.listEvents({projectId:t.projectId,limit:1000})){let A=N.payload;E.push({...c,id:`telemetry:event:${N.id}`,resourceId:N.resourceId,kind:"event",source:"control-plane",name:N.type,timestamp:N.createdAt,level:N.level,message:N.type,deploymentId:N.operationId,releaseId:typeof A.releaseId==="string"?A.releaseId:void 0,traceId:N.correlationId,attributes:A})}let i=E.filter((N)=>bB(N,r)).map((N)=>({...N,sampled:r.samplingRate<1&&(N.kind==="log"||N.kind==="trace"||N.kind==="request"||N.name.startsWith("request."))})),T=e.appendMany(i).length;if(KB.shouldRun(t.projectId,kB,!t.lightweight))e.enforceRetention(r,t.projectId);let h=e.status(t.projectId,t.environmentId,r.rawDays,r.samplingRate);for(let N of n)if(!h.some((A)=>A.source===N.source))h.push({source:N.source,freshness:"unavailable",samplingRate:r.samplingRate,retentionDays:r.rawDays,estimatedDailyBytes:0,message:N.message});let R=d.toISOString();return t.controlPlane.setSetting(`telemetry.collection:${t.projectId}:${t.environmentId??"all"}`,{generatedAt:R,errors:n,statuses:h,policy:r}),{collected:T,cached:!1,generatedAt:R,statuses:h,errors:n,policy:r}}async function eu(t){let r=`${`${t.projectId}:${t.environmentId??"all"}:${t.environment}`}:${t.lightweight?"lightweight":"full"}`,d=dd(t.config)==="serverless"?300000:60000,E=await Mw.getOrCreate(r,d,!!t.force,()=>qB(t));return{...E.value,cached:E.cached}}function Gw(t){Mw.invalidate(`${t}:`)}function Vw(t,e={}){let r=e.shell||(process.platform==="win32"?"powershell.exe":"bash"),d=Bun.spawn([r,"-i"],{stdin:"pipe",stdout:"pipe",stderr:"pipe",cwd:e.cwd,env:{...process.env,TERM:"xterm-256color",PS1:"\\w $ "}}),E=new TextDecoder,n=async(c)=>{if(!c)return;let _=c.getReader();try{for(;;){let{done:i,value:T}=await _.read();if(i)break;if(T)t(E.decode(T))}}catch{}};if(n(d.stdout),n(d.stderr),e.onExit)d.exited.then((c)=>e.onExit(c)).catch(()=>{});return{write(c){try{d.stdin.write(c),d.stdin.flush()}catch{}},close(){try{d.stdin.end()}catch{}try{d.kill()}catch{}}}}var dJ="127.0.0.1",EJ=7676,Zw=65536,tg="ts-cloud-dashboard-",Pc=oB(rJ(import.meta.url));function nJ(t){try{return process.kill(t,0),!0}catch(e){return e?.code!=="ESRCH"}}function cJ(t=ph(),e=nJ){let r=0;for(let d of Kw(t,{withFileTypes:!0})){if(!d.isDirectory()||!d.name.startsWith(tg))continue;let E=vt(t,d.name),n=d.name.match(/^ts-cloud-dashboard-(\d+)-/);if(n){let c=Number(n[1]);if(c===process.pid||e(c))continue}else if(Kw(E).length>0)continue;_n(E,{recursive:!0,force:!0}),r+=1}return r}var _J={".html":"text/html; charset=utf-8",".css":"text/css; charset=utf-8",".js":"text/javascript; charset=utf-8",".json":"application/json; charset=utf-8",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".ico":"image/x-icon"};function O(t,e=200,r={}){return new Response(JSON.stringify(t,null,2),{status:e,headers:{"content-type":"application/json; charset=utf-8",...r}})}function TJ(t,e,r,d){let E=new TextEncoder,n=Math.max(0,Math.floor(r)),c,_,i=!1,T=new ReadableStream({start(h){let R=()=>{if(i)return;if(i=!0,c?.(),_)clearInterval(_);d.removeEventListener("abort",R);try{h.close()}catch{}},N=(u)=>{if(i)return;if(u.reset)h.enqueue(E.encode(`event: reset
 data: ${JSON.stringify({cursor:u.cursor,droppedBytes:u.droppedBytes})}
 
 `));for(let U of u.chunks.filter((w)=>w.cursor>n))n=U.cursor,h.enqueue(E.encode(`id: ${U.cursor}
@@ -6635,14 +6635,14 @@ data: ${JSON.stringify({cursor:n,at:new Date().toISOString()})}
 ${_}
 ${i}`);return null}return d}catch(E){if(d)_n(d,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${E.message}`);return null}}function gJ(t){let e=t.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(t.infrastructure.compute.managedServices)):void 0;if(e?.vitess?.password)e.vitess.password="";return{project:{name:t.project?.name,slug:t.project?.slug,region:t.project?.region},provider:t.provider,environments:Object.keys(t.environments??{}),compute:t.infrastructure?.compute?{provider:t.infrastructure.compute.provider,runtime:t.infrastructure.compute.runtime,webServer:t.infrastructure.compute.webServer,proxy:t.infrastructure.compute.proxy?{engine:t.infrastructure.compute.proxy.engine,onDemandTls:t.infrastructure.compute.proxy.onDemandTls,cdn:!!t.infrastructure.compute.proxy.cdn}:void 0,managedServices:e,sshKeys:TE(ac(t)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(t.sites??{}).map(([r,d])=>[r,{domain:d.domain,path:d.path,type:d.type,deploy:d.deploy,root:d.root,port:d.port,ssl:d.ssl}]))}}function eg(t){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",t],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",t,"--yes"],mutates:!0,confirm:"deploy"}]}function $J(t,e){return eg(e).find((r)=>r.id===t)}function qw(t){if(t.length<=Zw)return t;return`${t.slice(0,Zw)}
 
-[output truncated]`}async function sw(t,e,r){let d=t.getReader(),E=new TextDecoder,n="";while(!0){let{done:_,value:i}=await d.read();if(_)break;let T=E.decode(i,{stream:!0});if(n+=T,T)r?.(e,T)}let c=E.decode();if(c)n+=c,r?.(e,c);return n}async function du(t,e){let r=Bun.spawn([process.execPath,e.cliEntry,...t.command],{cwd:e.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...e.env}}),d=()=>{try{r.kill()}catch{}};if(e.signal?.aborted)d();else e.signal?.addEventListener("abort",d,{once:!0});try{let[E,n,c]=await Promise.all([sw(r.stdout,"stdout",e.onOutput),sw(r.stderr,"stderr",e.onOutput),r.exited]);return{action:t.id,command:["cloud",...t.command].join(" "),exitCode:c,ok:c===0,stdout:qw(E),stderr:qw(n)}}finally{e.signal?.removeEventListener("abort",d)}}function yJ(){return Object.entries(process.env).filter(([t,e])=>!!e&&e.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(t)).map(([,t])=>t)}var XJ=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function PJ(t){let e=m_(t);if(e&&e!==".html")return!1;let r=t.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!XJ.has(r)}var aJ={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function ow(t,e){if(e.role==="admin")return!0;let r=m_(t);if(r&&r!==".html")return!0;if(e.organizationSource==="legacy")return!PJ(t);let d=t.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(d==="/access-denied")return!0;let E=aJ[d];return!!E&&!!e.capabilities?.includes(E)}function jJ(t,e){let r=decodeURIComponent(e).replace(/^\/+/,""),E=mB(r===""?"index.html":r);if(E.startsWith("..")||E.includes("/../"))return null;let n=vt(t,E);if($d(n)&&!pw(n).isDirectory())return n;if(!m_(n)&&$d(`${n}.html`))return`${n}.html`;if(!m_(n)&&$d(vt(n,"index.html")))return vt(n,"index.html");return null}async function mw(t,e){let r=jJ(t,e);if(!r){let n=vt(t,"404.html");if($d(n))return new Response(await pr(n),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return tR("Not found",404)}if(pw(r).isDirectory())return tR("Not found",404);let d=await pr(r),E=_J[m_(r)]??"application/octet-stream";return new Response(d,{headers:{"content-type":E}})}var mh=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"];async function rg(t={}){cJ();let e=t.cwd??process.cwd(),r=t.host??dJ,d=t.port??EJ,E=t.cliEntry??process.argv[1];if(t.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await LJ(e);let n=t.config??await dD(),c=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,_=ot(n);if(c&&_&&!_.password)_.password=c;let i=n.infrastructure?.compute?.managedServices?.vitess;if(c&&i&&typeof i==="object"&&!i.password)i.password=c;let T=qU(e,n);if(T.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${T.reconciliation.failed} orphaned operation(s) as failed after restart.`);let h=Object.keys(n.environments??{}),R=NJ(n,t.environment),N=uJ(e),A=await cn(n,R),u=new Map([[R,A]]),U=new Map([[R,Date.now()]]),w=new Map([[R,Date.now()]]),l=new Map,P=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),a=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),j=dd(n)!=="serverless",B=(C)=>{let p=u.get(C);if(p&&!kw(U.get(C),Date.now(),P))return Promise.resolve(p);let Tt=l.get(C);if(Tt)return Tt;let m=!j||kw(w.get(C),Date.now(),a),Rt=cn(n,C,{includeSiteHealth:m}).then((Ht)=>{let f=u.get(C),ye=m?Ht:UJ(f,Ht);if(u.set(C,ye),U.set(C,Date.now()),m)w.set(C,Date.now());if(f?._serverReachable!==ye._serverReachable||f?._metricsStatus!==ye._metricsStatus||(f?.sitesDetail?.length??0)!==(ye.sitesDetail?.length??0))lt();return ye}).finally(()=>l.delete(C));return l.set(C,Rt),Rt},F=PU(e),J=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(t.box&&J!=="0"&&(J==="1"||!n.cloud?.attachTo)){let C=!1,p=Date.now()+300000,Tt=async()=>{if(C)return;C=!0;try{let Rt=Date.now(),Ht=Rt>=p;if(Ht)p=Rt+300000;let f=T.environments.get(R);await eu({controlPlane:T.store,projectId:T.project.id,environmentId:f?.id,config:n,environment:R,force:!0,lightweight:!0,includeSiteHealth:Ht})}catch(Rt){if(t.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Rt instanceof Error?Rt.message:String(Rt)}`)}finally{C=!1}};Tt(),setInterval(()=>void Tt(),60000).unref?.()}let s=new Map,tt=new Map,q=new Set,it=0;function Et(C,p){if(C.role==="admin"&&!T.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`))return C;let Tt=T.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`),m=Tt?T.store.getMembershipForActor(T.organization.id,Tt.id):void 0;if(!m||m.status!=="active")return{...C,role:"member",sites:{},capabilities:[]};let Rt=T.store.listGrants(m.id),Ht=T.store.resolveAuthorizationTarget(T.organization.id,m.scope)??T.store.resolveAuthorizationTarget(T.organization.id,{type:"project",id:T.project.id}),f=ln({membership:m,grants:Rt,target:Ht});if(m.roleTemplate==="owner"||m.roleTemplate==="admin")return{...C,role:"admin",sites:{},organizationRole:m.roleTemplate,organizationSource:m.source,capabilities:f};let ye=T.environments.get(p),ee={};for(let Ot of T.store.listResources(T.project.id,ye?.id).filter((ft)=>ft.kind==="application")){let ft=T.store.resolveAuthorizationTarget(T.organization.id,{type:"resource",id:Ot.id});if(!ft||!Ze({membership:m,grants:Rt,capability:"project:read",target:ft}).allowed)continue;ee[Ot.slug]=Ze({membership:m,grants:Rt,capability:"config:write",target:ft}).allowed?"owner":"collaborator"}return{...C,role:"member",sites:ee,organizationRole:m.roleTemplate,organizationSource:m.source,capabilities:f}}function lt(){it+=1,s.clear();for(let C of q)_n(C,{recursive:!0,force:!0});q.clear()}let gt=(C,p)=>`${p}:${C.role==="admin"?"admin":`member:${Object.entries(C.sites).sort(([Tt],[m])=>Tt.localeCompare(m)).map(([Tt,m])=>`${Tt}=${m}`).join(",")}`}:${[...C.capabilities??[]].sort().join(",")}`;async function $(C,p){let Tt=Et(C,p),m=gt(Tt,p),Rt=s.get(m);if(Rt)return Rt;let Ht=tt.get(m);if(Ht)return Ht;let f=it,ye=(async()=>{let ee=u.get(p)??await cn(n,p);u.set(p,ee);let Ot={...VL(ee,{user:Tt,slug:n.project.slug}),viewer:{role:Tt.role,organizationRole:Tt.organizationRole,organizationSource:Tt.organizationSource,capabilities:Tt.capabilities??[]}},ft=await wJ(e,Ot);if(ft&&f!==it)return _n(ft,{recursive:!0,force:!0}),F?.uiRoot;if(ft)q.add(ft);let Ce=ft??F?.uiRoot;if(Ce)s.set(m,Ce);return Ce})();tt.set(m,ye);try{return await ye}finally{tt.delete(m)}}let W=await $({username:"",passwordHash:"",role:"admin",sites:{}},R);if(!W)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let V=new WeakMap,x=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Nt=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Nt&&t.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let o=!Nt,It=Jf(e),Dt=o?Qf(e,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,b=new xT(T.store,{encryptionKey:Zd(e)}),Qt=new ei(T.store),Ut=new v_(T.store),nt=new fS(T.store,{encryptionKey:Zd(e)}),oe=new RS(T.store),RE=new LS(T.store,{cwd:e}),cr=new NS(T.store,{encryptionKey:Zd(e)}),st=new yt(T.store,{workerId:`dashboard:${process.pid}`}),te=new _N(T.store),td=new ON(T.store,Zd(e)),yd=new CA(T.store),tT=new hi(te,st,td),Xd=n.project?.region??"us-east-1",cu=Zd(e),Ke=new UA(yd,{encryptionKey:cu,backends:[new D_(T.store,cu),new IA(new FE(Xd),Xd),new lA(new Jn(Xd),Xd),new DA]});await RD(Ke,T,n);let eR=new _d(Xd),Eg={aws_rds:new TN(new AN(eR)),aws_aurora:new iN(new LN(eR)),aws_elasticache:new hN(new uN(new S_(Xd))),server:new RN(new Mn),container:new SN(new Mn)},_u=(C)=>Eg[C.provider],de=new dN(T.store),SE=new _i(de,st),Tu=new nN(td),ng={managed_database:new cN(te,eR),logical_database:new DN(te,td),volume:new fN,files:new lN(e),control_plane:new gN(T.store,e),infrastructure:new yN(new R_(Xd))},cg=(C)=>ng[C.resourceKind],_g=(C)=>C.provider==="aws_backup"?void 0:Tu,rR=new $n(T.store),dR=[new sc,new dS(_e(e,"volumes"))],ed=new eS(rR,dR,st),jc=new wA(T.store),vr=new gA(jc,[new U_("aws"),new U_("hetzner"),new U_("ssh")],st),Pd=new zA(T.store),iu=new FA(Pd,jc),NE=new WA(T.store),hu=new vA(NE,st),rd=new XA(T.store),ER=new PA(rd,st),Ru=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((C)=>new jA(C,T.store,T.project.id,T.organization.id)),ue=new pS(T.store),Su=new oS(ue,{queue:st}),pt=new qc(T.store),ad=new mc(T.store),_r=new XE(T.store),ut=new PR(T.store,{encryptionKey:Zd(e)});for(let C of T.environments.values())sS(ue,n,{organization:T.organization,project:T.project,environment:C,resources:T.store.listResources(T.project.id,C.id)});let Tr=new KR(ut,{emailImpl:async(C)=>{let{email:p}=await Promise.resolve().then(() => (pT(),YS));return p.send(C)}}),Nu=async(C)=>{let p=hC(ut,T.project.id,C),Tt=[];for(let m of p.filter((Rt)=>Rt.notify&&Rt.alert))Tt.push(...await Tr.deliverAll(Tr.enqueue(T.organization.id,m.alert,m.transition)));return Tt.push(...await Tr.deliverAll(Tr.enqueueRemindersAndEscalations(T.organization.id,ut.listAlerts(T.project.id,{environmentId:C,states:["firing"]})))),Tt.push(...await Tr.retryDue()),{evaluations:p,deliveries:Tt}},nR=!1,Tg=async()=>{if(nR)return;nR=!0;try{for(let C of T.environments.values())for(let p of ut.listHealthChecks(T.project.id,C.id).filter((Tt)=>Tt.enabled)){let Tt=ut.listHealthResults(p.id,1)[0];if(Tt&&Date.now()-new Date(Tt.checkedAt).getTime()<p.intervalSeconds*1000)continue;let m=await new DE(ut).runAndEvaluate(p);for(let Rt of m.evaluations.filter((Ht)=>Ht.notify&&Ht.alert))await Tr.deliverAll(Tr.enqueue(T.organization.id,Rt.alert,Rt.transition))}}finally{nR=!1}},Au=setInterval(()=>{for(let C of T.environments.values())Nu(C.id).catch((p)=>console.error("ts-cloud alert evaluation failed:",p))},60000);Au.unref?.();let Lu=setInterval(()=>{Tg().catch((C)=>console.error("ts-cloud health check evaluation failed:",C))},30000);Lu.unref?.();let uu=setInterval(()=>{try{Su.tick()}catch(C){console.error("ts-cloud scheduled job evaluation failed:",C)}},30000);uu.unref?.();let Ou=setInterval(()=>{try{SE.enqueueDue(),SE.enqueueRetention()}catch(C){console.error("ts-cloud backup policy evaluation failed:",C)}},30000);Ou.unref?.(),pt.cleanup();let Cu=setInterval(()=>{try{pt.cleanup()}catch(C){console.error("ts-cloud preview cleanup failed:",C)}},3600000);Cu.unref?.();let ig=t.queueWorker??!0,hg=yJ(),Rg=async(C,p)=>{let m=(C.environmentId?T.store.listEnvironments(C.projectId).find((Rt)=>Rt.id===C.environmentId):void 0)?.slug??String(R);if(p.kind==="dashboard_operation"&&p.operationId){let Rt=u.get(m)??A,Ht=GL(p.operationId,n,Rt);if(!Ht||Ht.danger||!["scheduler","backup","worker"].includes(Ht.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let f=await bh(n,m,Ht);return{ok:f.ok,stdout:f.stdout,stderr:f.stderr??f.error,retryable:/temporar|unavailable|timeout|network/i.test(f.stderr??f.error??""),output:{command:f.command??null,operation:f.operation}}}if(p.kind==="serverless_scheduler"){let Rt=await oL(n,m,"run");return{ok:Rt.ok,stdout:Rt.stdout,stderr:Rt.error,retryable:/temporar|unavailable|timeout|network/i.test(Rt.error??""),output:{command:Rt.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${p.kind}.`}},eT=ig?new sR(st,{...PC({store:T.store,execute:async(C,p)=>{let Tt=p.operation.input&&typeof p.operation.input==="object"&&!Array.isArray(p.operation.input)?p.operation.input:{},m=Tt.source&&typeof Tt.source==="object"?Tt.source:void 0,Rt=e,Ht,f,ye;try{if(m?.bindingId&&m?.connectionId&&m?.commitSha){let Ot=nt.getBinding(String(m.bindingId)),ft=nt.getConnection(String(m.connectionId));if(!Ot||!ft||Ot.connectionId!==ft.id)throw Error("Queued source binding is no longer available");let Se=(Ot.repositoryId?nt.getRepository(Ot.repositoryId):nt.listRepositories(ft.id).find((Rn)=>Rn.fullName.toLowerCase()===Ot.repositoryFullName.toLowerCase()))?.cloneUrl;if(!Se&&ft.provider==="generic_ssh")Se=`git@${new URL(ft.host).hostname}:${Ot.repositoryFullName}.git`;if(!Se)Se=new URL(`/${Ot.repositoryFullName}.git`,ft.host.endsWith("/")?ft.host:`${ft.host}/`).href;let M=Ot.deployKeyId?nt.getDeployKey(Ot.deployKeyId):void 0,Kt=M&&Ot.deployKeyId?{...M,privateKey:nt.getDeployPrivateKey(Ot.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(ft.provider)&&C.target.previewId){let Rn=Yd(ft,nt.getCredential(ft.id)),Q=pt.previews.getInstance(C.target.previewId);ye=async(ir,nT)=>{try{await Rn.setCommitStatus(Ot.repositoryFullName,String(m.commitSha),{state:ir,url:Q?.url,description:nT})}catch(Sn){p.log(`Could not publish source status: ${Sn instanceof Error?Sn.message:String(Sn)}`,{stream:"stderr"})}},await ye("pending",`Preview deployment started for ${String(m.commitSha).slice(0,12)}`)}Ht=Eu(vt(ph(),"ts-cloud-queued-source-")),p.log(`Checking out immutable source commit ${m.commitSha}.`,{stream:"system"}),Rt=(await $S({remote:Se,binding:Ot,destination:vt(Ht,"checkout"),ref:String(m.branch??Ot.defaultBranch),commitSha:String(m.commitSha)},{credential:nt.getCredential(ft.id),deployKey:Kt})).directory}if(p.operation.kind!=="preview.destroy"){let Ot=C.target.previewId?pt.previews.getInstance(C.target.previewId):void 0,ft=Ot?pt.previews.getDefinition(Ot.definitionId):void 0,Ce=p.operation.resourceId?T.store.getResource(p.operation.resourceId):void 0;if(f=await Ke.resolve({projectId:T.project.id,environmentId:p.operation.environmentId,resourceId:p.operation.resourceId,functionId:Ce?.kind==="function"?Ce.id:void 0,previewId:Ot?.id,trustedPreview:!!Ot&&!Ot.fork,allowedPreviewSecrets:ft?.inheritedSecrets}),f.warnings.some((Se)=>Se.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${f.warnings.filter((Se)=>Se.code==="missing_required").map((Se)=>Se.key).join(", ")}`);if(p.operation.resourceId)for(let Se of Object.values(f.entries))yd.setDependency({entryId:Se.id,resourceId:p.operation.resourceId,injectionTarget:"environment",required:Se.required,requiresRedeploy:!0});p.log(`Resolved configuration ${f.configurationHash.slice(0,18)} for ${Object.keys(f.values).length} keys.`,{stream:"system"})}let ee=await du(C,{cwd:Rt,cliEntry:E,signal:p.signal,env:f?.values,onOutput:(Ot,ft)=>p.log(ft,{stream:Ot,step:"execute",secrets:[...hg,...Object.entries(f?.entries??{}).filter(([,Ce])=>Ce.kind==="secret").map(([Ce])=>f.values[Ce]).filter(Boolean)]})});if(ee.ok&&p.operation.resourceId&&f)for(let Ot of Object.values(f.entries))yd.setDependency({entryId:Ot.id,resourceId:p.operation.resourceId,injectionTarget:"environment",required:Ot.required,requiresRedeploy:!1,lastDeployedVersion:Ot.version});return await ye?.(ee.ok?"success":"failure",ee.ok?`Preview is ready at ${String(m?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(m?.commitSha).slice(0,12)}`),ee}catch(ee){throw await ye?.("error",`Preview deployment could not complete at ${String(m?.commitSha).slice(0,12)}`),ee}finally{if(Ht)_n(Ht,{recursive:!0,force:!0})}}}),..._I({store:ue,executor:Rg}),...II({store:te,secrets:td,resolveAdapter:_u}),...AD(jc,vr.drivers),...JD(NE,[new QA("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...yD({store:rd,cleanup:Ru}),...jC(rR,dR),...LI({store:de,queue:st,resolveSource:cg,resolveDestination:_g,validateHealth:async(C,p)=>{if(!C.healthCheckId)return{healthy:!0,mode:"adapter"};let Tt=ut.getHealthCheck(C.healthCheckId);if(!Tt||Tt.projectId!==C.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let m=await new DE(ut).runAndEvaluate(Tt);return{healthy:m.result.status==="healthy",healthCheckId:Tt.id,healthResultId:m.result.id,target:p}}}),...e0({store:T.store,resolveDriver:t.releaseDriver??((C)=>({name:`${T.store.getResource(C.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:C.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(C,p)=>{let Tt=ut.listHealthChecks(p.projectId,p.environmentId).find((Rt)=>Rt.enabled&&Rt.name===C&&(!Rt.resourceId||Rt.resourceId===p.resourceId));if(!Tt)return{healthy:!1,message:`Named health gate ${C} was not found for this release.`};let m=await new DE(ut).runAndEvaluate(Tt);return{healthy:m.result.status==="healthy",evidence:{healthCheckId:Tt.id,healthResultId:m.result.id,status:m.result.status,timings:m.result.timings},message:m.result.message}}})},{parallelism:t.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(C)=>console.error("ts-cloud deployment queue worker failed:",C)}):void 0;if(KU(T),Ph(Ut,Hr(T,String(R)),A),Dt)jh(T,Dt.users),Gf(b,T,Dt.users);let bt=Yf({cwd:e,enabled:o,secret:It,authentication:b,authorization:{store:T.store,organizationId:T.organization.id,projectId:T.project.id,defaultEnvironment:String(R)}}),Ee=new SL,Iu=setInterval(()=>Ee.sweep(),60000);Iu.unref?.();let rT=new x_,cR=new x_(3,900000,900000),dT=new x_(8,900000,900000),lu=setInterval(()=>rT.prune(),300000),Du=setInterval(()=>cR.prune(),300000),Uu=setInterval(()=>dT.prune(),300000);if(lu.unref?.(),Du.unref?.(),Uu.unref?.(),o){if(Dt?.generated)console.warn(`
+[output truncated]`}async function sw(t,e,r){let d=t.getReader(),E=new TextDecoder,n="";while(!0){let{done:_,value:i}=await d.read();if(_)break;let T=E.decode(i,{stream:!0});if(n+=T,T)r?.(e,T)}let c=E.decode();if(c)n+=c,r?.(e,c);return n}async function du(t,e){let r=Bun.spawn([process.execPath,e.cliEntry,...t.command],{cwd:e.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...e.env}}),d=()=>{try{r.kill()}catch{}};if(e.signal?.aborted)d();else e.signal?.addEventListener("abort",d,{once:!0});try{let[E,n,c]=await Promise.all([sw(r.stdout,"stdout",e.onOutput),sw(r.stderr,"stderr",e.onOutput),r.exited]);return{action:t.id,command:["cloud",...t.command].join(" "),exitCode:c,ok:c===0,stdout:qw(E),stderr:qw(n)}}finally{e.signal?.removeEventListener("abort",d)}}function yJ(){return Object.entries(process.env).filter(([t,e])=>!!e&&e.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(t)).map(([,t])=>t)}var XJ=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function PJ(t){let e=m_(t);if(e&&e!==".html")return!1;let r=t.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!XJ.has(r)}var aJ={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function ow(t,e){if(e.role==="admin")return!0;let r=m_(t);if(r&&r!==".html")return!0;if(e.organizationSource==="legacy")return!PJ(t);let d=t.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(d==="/access-denied")return!0;let E=aJ[d];return!!E&&!!e.capabilities?.includes(E)}function jJ(t,e){let r=decodeURIComponent(e).replace(/^\/+/,""),E=mB(r===""?"index.html":r);if(E.startsWith("..")||E.includes("/../"))return null;let n=vt(t,E);if($d(n)&&!pw(n).isDirectory())return n;if(!m_(n)&&$d(`${n}.html`))return`${n}.html`;if(!m_(n)&&$d(vt(n,"index.html")))return vt(n,"index.html");return null}async function mw(t,e){let r=jJ(t,e);if(!r){let n=vt(t,"404.html");if($d(n))return new Response(await pr(n),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return tR("Not found",404)}if(pw(r).isDirectory())return tR("Not found",404);let d=await pr(r),E=_J[m_(r)]??"application/octet-stream";return new Response(d,{headers:{"content-type":E}})}var mh=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"];async function rg(t={}){cJ();let e=t.cwd??process.cwd(),r=t.host??dJ,d=t.port??EJ,E=t.cliEntry??process.argv[1];if(t.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await LJ(e);let n=t.config??await dD(),c=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,_=ot(n);if(c&&_&&!_.password)_.password=c;let i=n.infrastructure?.compute?.managedServices?.vitess;if(c&&i&&typeof i==="object"&&!i.password)i.password=c;let T=qU(e,n);if(T.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${T.reconciliation.failed} orphaned operation(s) as failed after restart.`);let h=Object.keys(n.environments??{}),R=NJ(n,t.environment),N=uJ(e),A=await cn(n,R),u=new Map([[R,A]]),U=new Map([[R,Date.now()]]),w=new Map([[R,Date.now()]]),l=new Map,P=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),a=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),j=dd(n)!=="serverless",B=(C)=>{let p=u.get(C);if(p&&!kw(U.get(C),Date.now(),P))return Promise.resolve(p);let Tt=l.get(C);if(Tt)return Tt;let m=!j||kw(w.get(C),Date.now(),a),Rt=cn(n,C,{includeSiteHealth:m}).then((Ht)=>{let f=u.get(C),ye=m?Ht:UJ(f,Ht);if(u.set(C,ye),U.set(C,Date.now()),m)w.set(C,Date.now());if(f?._serverReachable!==ye._serverReachable||f?._metricsStatus!==ye._metricsStatus||(f?.sitesDetail?.length??0)!==(ye.sitesDetail?.length??0))lt();return ye}).finally(()=>l.delete(C));return l.set(C,Rt),Rt},F=PU(e),J=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(t.box&&J!=="0"&&(J==="1"||!n.cloud?.attachTo)){let C=!1,p=Date.now()+300000,Tt=async()=>{if(C)return;C=!0;try{let Rt=Date.now(),Ht=Rt>=p;if(Ht)p=Rt+300000;let f=T.environments.get(R);await eu({controlPlane:T.store,projectId:T.project.id,environmentId:f?.id,config:n,environment:R,force:!0,lightweight:!0,includeSiteHealth:Ht})}catch(Rt){if(t.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Rt instanceof Error?Rt.message:String(Rt)}`)}finally{C=!1}};Tt(),setInterval(()=>void Tt(),60000).unref?.()}let s=new Map,tt=new Map,q=new Set,it=0;function Et(C,p){if(C.role==="admin"&&!T.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`))return C;let Tt=T.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`),m=Tt?T.store.getMembershipForActor(T.organization.id,Tt.id):void 0;if(!m||m.status!=="active")return{...C,role:"member",sites:{},capabilities:[]};let Rt=T.store.listGrants(m.id),Ht=T.store.resolveAuthorizationTarget(T.organization.id,m.scope)??T.store.resolveAuthorizationTarget(T.organization.id,{type:"project",id:T.project.id}),f=ln({membership:m,grants:Rt,target:Ht});if(m.roleTemplate==="owner"||m.roleTemplate==="admin")return{...C,role:"admin",sites:{},organizationRole:m.roleTemplate,organizationSource:m.source,capabilities:f};let ye=T.environments.get(p),ee={};for(let Ot of T.store.listResources(T.project.id,ye?.id).filter((ft)=>ft.kind==="application")){let ft=T.store.resolveAuthorizationTarget(T.organization.id,{type:"resource",id:Ot.id});if(!ft||!Ze({membership:m,grants:Rt,capability:"project:read",target:ft}).allowed)continue;ee[Ot.slug]=Ze({membership:m,grants:Rt,capability:"config:write",target:ft}).allowed?"owner":"collaborator"}return{...C,role:"member",sites:ee,organizationRole:m.roleTemplate,organizationSource:m.source,capabilities:f}}function lt(){it+=1,s.clear();for(let C of q)_n(C,{recursive:!0,force:!0});q.clear()}let gt=(C,p)=>`${p}:${C.role==="admin"?"admin":`member:${Object.entries(C.sites).sort(([Tt],[m])=>Tt.localeCompare(m)).map(([Tt,m])=>`${Tt}=${m}`).join(",")}`}:${[...C.capabilities??[]].sort().join(",")}`;async function $(C,p){let Tt=Et(C,p),m=gt(Tt,p),Rt=s.get(m);if(Rt)return Rt;let Ht=tt.get(m);if(Ht)return Ht;let f=it,ye=(async()=>{let ee=u.get(p)??await cn(n,p);u.set(p,ee);let Ot={...VL(ee,{user:Tt,slug:n.project.slug}),viewer:{role:Tt.role,organizationRole:Tt.organizationRole,organizationSource:Tt.organizationSource,capabilities:Tt.capabilities??[]}},ft=await wJ(e,Ot);if(ft&&f!==it)return _n(ft,{recursive:!0,force:!0}),F?.uiRoot;if(ft)q.add(ft);let Ie=ft??F?.uiRoot;if(Ie)s.set(m,Ie);return Ie})();tt.set(m,ye);try{return await ye}finally{tt.delete(m)}}let W=await $({username:"",passwordHash:"",role:"admin",sites:{}},R);if(!W)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let V=new WeakMap,x=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Nt=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Nt&&t.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let o=!Nt,It=Jf(e),Dt=o?Qf(e,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,b=new xT(T.store,{encryptionKey:Zd(e)}),Qt=new ei(T.store),Ut=new v_(T.store),nt=new fS(T.store,{encryptionKey:Zd(e)}),oe=new RS(T.store),RE=new LS(T.store,{cwd:e}),cr=new NS(T.store,{encryptionKey:Zd(e)}),st=new yt(T.store,{workerId:`dashboard:${process.pid}`}),te=new _N(T.store),td=new ON(T.store,Zd(e)),yd=new CA(T.store),tT=new hi(te,st,td),Xd=n.project?.region??"us-east-1",cu=Zd(e),Ke=new UA(yd,{encryptionKey:cu,backends:[new D_(T.store,cu),new IA(new FE(Xd),Xd),new lA(new Jn(Xd),Xd),new DA]});await RD(Ke,T,n);let eR=new _d(Xd),Eg={aws_rds:new TN(new AN(eR)),aws_aurora:new iN(new LN(eR)),aws_elasticache:new hN(new uN(new S_(Xd))),server:new RN(new Mn),container:new SN(new Mn)},_u=(C)=>Eg[C.provider],de=new dN(T.store),SE=new _i(de,st),Tu=new nN(td),ng={managed_database:new cN(te,eR),logical_database:new DN(te,td),volume:new fN,files:new lN(e),control_plane:new gN(T.store,e),infrastructure:new yN(new R_(Xd))},cg=(C)=>ng[C.resourceKind],_g=(C)=>C.provider==="aws_backup"?void 0:Tu,rR=new $n(T.store),dR=[new sc,new dS(_e(e,"volumes"))],ed=new eS(rR,dR,st),jc=new wA(T.store),vr=new gA(jc,[new U_("aws"),new U_("hetzner"),new U_("ssh")],st),Pd=new zA(T.store),iu=new FA(Pd,jc),NE=new WA(T.store),hu=new vA(NE,st),rd=new XA(T.store),ER=new PA(rd,st),Ru=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((C)=>new jA(C,T.store,T.project.id,T.organization.id)),Oe=new pS(T.store),Su=new oS(Oe,{queue:st}),pt=new qc(T.store),ad=new mc(T.store),_r=new XE(T.store),ut=new PR(T.store,{encryptionKey:Zd(e)});for(let C of T.environments.values())sS(Oe,n,{organization:T.organization,project:T.project,environment:C,resources:T.store.listResources(T.project.id,C.id)});let Tr=new KR(ut,{emailImpl:async(C)=>{let{email:p}=await Promise.resolve().then(() => (pT(),YS));return p.send(C)}}),Nu=async(C)=>{let p=hC(ut,T.project.id,C),Tt=[];for(let m of p.filter((Rt)=>Rt.notify&&Rt.alert))Tt.push(...await Tr.deliverAll(Tr.enqueue(T.organization.id,m.alert,m.transition)));return Tt.push(...await Tr.deliverAll(Tr.enqueueRemindersAndEscalations(T.organization.id,ut.listAlerts(T.project.id,{environmentId:C,states:["firing"]})))),Tt.push(...await Tr.retryDue()),{evaluations:p,deliveries:Tt}},nR=!1,Tg=async()=>{if(nR)return;nR=!0;try{for(let C of T.environments.values())for(let p of ut.listHealthChecks(T.project.id,C.id).filter((Tt)=>Tt.enabled)){let Tt=ut.listHealthResults(p.id,1)[0];if(Tt&&Date.now()-new Date(Tt.checkedAt).getTime()<p.intervalSeconds*1000)continue;let m=await new DE(ut).runAndEvaluate(p);for(let Rt of m.evaluations.filter((Ht)=>Ht.notify&&Ht.alert))await Tr.deliverAll(Tr.enqueue(T.organization.id,Rt.alert,Rt.transition))}}finally{nR=!1}},Au=setInterval(()=>{for(let C of T.environments.values())Nu(C.id).catch((p)=>console.error("ts-cloud alert evaluation failed:",p))},60000);Au.unref?.();let Lu=setInterval(()=>{Tg().catch((C)=>console.error("ts-cloud health check evaluation failed:",C))},30000);Lu.unref?.();let uu=setInterval(()=>{try{Su.tick()}catch(C){console.error("ts-cloud scheduled job evaluation failed:",C)}},30000);uu.unref?.();let Ou=setInterval(()=>{try{SE.enqueueDue(),SE.enqueueRetention()}catch(C){console.error("ts-cloud backup policy evaluation failed:",C)}},30000);Ou.unref?.(),pt.cleanup();let Cu=setInterval(()=>{try{pt.cleanup()}catch(C){console.error("ts-cloud preview cleanup failed:",C)}},3600000);Cu.unref?.();let ig=t.queueWorker??!0,hg=yJ(),Rg=async(C,p)=>{let m=(C.environmentId?T.store.listEnvironments(C.projectId).find((Rt)=>Rt.id===C.environmentId):void 0)?.slug??String(R);if(p.kind==="dashboard_operation"&&p.operationId){let Rt=u.get(m)??A,Ht=GL(p.operationId,n,Rt);if(!Ht||Ht.danger||!["scheduler","backup","worker"].includes(Ht.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let f=await bh(n,m,Ht);return{ok:f.ok,stdout:f.stdout,stderr:f.stderr??f.error,retryable:/temporar|unavailable|timeout|network/i.test(f.stderr??f.error??""),output:{command:f.command??null,operation:f.operation}}}if(p.kind==="serverless_scheduler"){let Rt=await oL(n,m,"run");return{ok:Rt.ok,stdout:Rt.stdout,stderr:Rt.error,retryable:/temporar|unavailable|timeout|network/i.test(Rt.error??""),output:{command:Rt.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${p.kind}.`}},eT=ig?new sR(st,{...PC({store:T.store,execute:async(C,p)=>{let Tt=p.operation.input&&typeof p.operation.input==="object"&&!Array.isArray(p.operation.input)?p.operation.input:{},m=Tt.source&&typeof Tt.source==="object"?Tt.source:void 0,Rt=e,Ht,f,ye;try{if(m?.bindingId&&m?.connectionId&&m?.commitSha){let Ot=nt.getBinding(String(m.bindingId)),ft=nt.getConnection(String(m.connectionId));if(!Ot||!ft||Ot.connectionId!==ft.id)throw Error("Queued source binding is no longer available");let Se=(Ot.repositoryId?nt.getRepository(Ot.repositoryId):nt.listRepositories(ft.id).find((Rn)=>Rn.fullName.toLowerCase()===Ot.repositoryFullName.toLowerCase()))?.cloneUrl;if(!Se&&ft.provider==="generic_ssh")Se=`git@${new URL(ft.host).hostname}:${Ot.repositoryFullName}.git`;if(!Se)Se=new URL(`/${Ot.repositoryFullName}.git`,ft.host.endsWith("/")?ft.host:`${ft.host}/`).href;let M=Ot.deployKeyId?nt.getDeployKey(Ot.deployKeyId):void 0,Kt=M&&Ot.deployKeyId?{...M,privateKey:nt.getDeployPrivateKey(Ot.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(ft.provider)&&C.target.previewId){let Rn=Yd(ft,nt.getCredential(ft.id)),Q=pt.previews.getInstance(C.target.previewId);ye=async(ir,nT)=>{try{await Rn.setCommitStatus(Ot.repositoryFullName,String(m.commitSha),{state:ir,url:Q?.url,description:nT})}catch(Sn){p.log(`Could not publish source status: ${Sn instanceof Error?Sn.message:String(Sn)}`,{stream:"stderr"})}},await ye("pending",`Preview deployment started for ${String(m.commitSha).slice(0,12)}`)}Ht=Eu(vt(ph(),"ts-cloud-queued-source-")),p.log(`Checking out immutable source commit ${m.commitSha}.`,{stream:"system"}),Rt=(await $S({remote:Se,binding:Ot,destination:vt(Ht,"checkout"),ref:String(m.branch??Ot.defaultBranch),commitSha:String(m.commitSha)},{credential:nt.getCredential(ft.id),deployKey:Kt})).directory}if(p.operation.kind!=="preview.destroy"){let Ot=C.target.previewId?pt.previews.getInstance(C.target.previewId):void 0,ft=Ot?pt.previews.getDefinition(Ot.definitionId):void 0,Ie=p.operation.resourceId?T.store.getResource(p.operation.resourceId):void 0;if(f=await Ke.resolve({projectId:T.project.id,environmentId:p.operation.environmentId,resourceId:p.operation.resourceId,functionId:Ie?.kind==="function"?Ie.id:void 0,previewId:Ot?.id,trustedPreview:!!Ot&&!Ot.fork,allowedPreviewSecrets:ft?.inheritedSecrets}),f.warnings.some((Se)=>Se.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${f.warnings.filter((Se)=>Se.code==="missing_required").map((Se)=>Se.key).join(", ")}`);if(p.operation.resourceId)for(let Se of Object.values(f.entries))yd.setDependency({entryId:Se.id,resourceId:p.operation.resourceId,injectionTarget:"environment",required:Se.required,requiresRedeploy:!0});p.log(`Resolved configuration ${f.configurationHash.slice(0,18)} for ${Object.keys(f.values).length} keys.`,{stream:"system"})}let ee=await du(C,{cwd:Rt,cliEntry:E,signal:p.signal,env:f?.values,onOutput:(Ot,ft)=>p.log(ft,{stream:Ot,step:"execute",secrets:[...hg,...Object.entries(f?.entries??{}).filter(([,Ie])=>Ie.kind==="secret").map(([Ie])=>f.values[Ie]).filter(Boolean)]})});if(ee.ok&&p.operation.resourceId&&f)for(let Ot of Object.values(f.entries))yd.setDependency({entryId:Ot.id,resourceId:p.operation.resourceId,injectionTarget:"environment",required:Ot.required,requiresRedeploy:!1,lastDeployedVersion:Ot.version});return await ye?.(ee.ok?"success":"failure",ee.ok?`Preview is ready at ${String(m?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(m?.commitSha).slice(0,12)}`),ee}catch(ee){throw await ye?.("error",`Preview deployment could not complete at ${String(m?.commitSha).slice(0,12)}`),ee}finally{if(Ht)_n(Ht,{recursive:!0,force:!0})}}}),..._I({store:Oe,executor:Rg}),...II({store:te,secrets:td,resolveAdapter:_u}),...AD(jc,vr.drivers),...JD(NE,[new QA("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...yD({store:rd,cleanup:Ru}),...jC(rR,dR),...LI({store:de,queue:st,resolveSource:cg,resolveDestination:_g,validateHealth:async(C,p)=>{if(!C.healthCheckId)return{healthy:!0,mode:"adapter"};let Tt=ut.getHealthCheck(C.healthCheckId);if(!Tt||Tt.projectId!==C.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let m=await new DE(ut).runAndEvaluate(Tt);return{healthy:m.result.status==="healthy",healthCheckId:Tt.id,healthResultId:m.result.id,target:p}}}),...e0({store:T.store,resolveDriver:t.releaseDriver??((C)=>({name:`${T.store.getResource(C.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:C.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(C,p)=>{let Tt=ut.listHealthChecks(p.projectId,p.environmentId).find((Rt)=>Rt.enabled&&Rt.name===C&&(!Rt.resourceId||Rt.resourceId===p.resourceId));if(!Tt)return{healthy:!1,message:`Named health gate ${C} was not found for this release.`};let m=await new DE(ut).runAndEvaluate(Tt);return{healthy:m.result.status==="healthy",evidence:{healthCheckId:Tt.id,healthResultId:m.result.id,status:m.result.status,timings:m.result.timings},message:m.result.message}}})},{parallelism:t.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(C)=>console.error("ts-cloud deployment queue worker failed:",C)}):void 0;if(KU(T),Ph(Ut,Hr(T,String(R)),A),Dt)jh(T,Dt.users),Gf(b,T,Dt.users);let bt=Yf({cwd:e,enabled:o,secret:It,authentication:b,authorization:{store:T.store,organizationId:T.organization.id,projectId:T.project.id,defaultEnvironment:String(R)}}),Ee=new SL,Iu=setInterval(()=>Ee.sweep(),60000);Iu.unref?.();let rT=new x_,cR=new x_(3,900000,900000),dT=new x_(8,900000,900000),lu=setInterval(()=>rT.prune(),300000),Du=setInterval(()=>cR.prune(),300000),Uu=setInterval(()=>dT.prune(),300000);if(lu.unref?.(),Du.unref?.(),Uu.unref?.(),o){if(Dt?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${Dt.generated.username}
     password: ${Dt.generated.password}
   Saved (hashed) to ${Wf()}. This password is shown once.
-`)}else console.warn("  ts-cloud dashboard: authentication is DISABLED (TS_CLOUD_DASHBOARD_AUTH=0). Every request runs as an admin.");let jd=r!=="127.0.0.1"&&r!=="localhost",_R=(C)=>sB("sha256").update(`${It}:${C}`).digest("hex").slice(0,16),Sg=jS({controlPlane:T.store,identities:Qt,sources:nt,applications:{drafts:oe,artifacts:RE,registries:cr}}),fu=(C)=>C.headers.get("user-agent")?.trim().slice(0,256)||void 0,ET=(C,p,Tt,m="local")=>b.createSession({identityId:C,authMethod:m,userAgent:fu(p),networkHint:_R(Tt)}),ct=(C)=>{let p=T.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`),Tt=p?T.store.getMembershipForActor(T.organization.id,p.id):void 0;return{actor:p,membership:Tt,grants:Tt?T.store.listGrants(Tt.id):[]}},Tn=(C,p,Tt)=>{if(C.role==="admin")return!0;let m=T.store.getOperation(p),Rt=ct(C);if(!m||!Rt.membership)return!1;let Ht=m.resourceId?{type:"resource",id:m.resourceId}:m.environmentId?{type:"environment",id:m.environmentId}:m.projectId?{type:"project",id:m.projectId}:{type:"organization"},f=T.store.resolveAuthorizationTarget(T.organization.id,Ht);return!!f&&Ze({membership:Rt.membership,grants:Rt.grants,capability:Tt,target:f}).allowed},Oe=(C,p,Tt)=>{if(C.role==="admin")return!0;let m=ct(C);if(!m.membership)return!1;let Rt=T.store.resolveAuthorizationTarget(T.organization.id,{type:"resource",id:p});return!!Rt&&Ze({membership:m.membership,grants:m.grants,capability:Tt,target:Rt}).allowed},zc=(C,p,Tt)=>{if(C.role==="admin")return!0;let m=ct(C);if(!m.membership)return!1;let Rt=T.store.resolveAuthorizationTarget(T.organization.id,{type:"environment",id:p});return!!Rt&&Ze({membership:m.membership,grants:m.grants,capability:Tt,target:Rt}).allowed},hn=Bun.serve({hostname:r,port:d,idleTimeout:30,websocket:{open(C){if(!x){C.send(`The web terminal is disabled (TS_CLOUD_DASHBOARD_TERMINAL=0).\r
+`)}else console.warn("  ts-cloud dashboard: authentication is DISABLED (TS_CLOUD_DASHBOARD_AUTH=0). Every request runs as an admin.");let jd=r!=="127.0.0.1"&&r!=="localhost",_R=(C)=>sB("sha256").update(`${It}:${C}`).digest("hex").slice(0,16),Sg=jS({controlPlane:T.store,identities:Qt,sources:nt,applications:{drafts:oe,artifacts:RE,registries:cr}}),fu=(C)=>C.headers.get("user-agent")?.trim().slice(0,256)||void 0,ET=(C,p,Tt,m="local")=>b.createSession({identityId:C,authMethod:m,userAgent:fu(p),networkHint:_R(Tt)}),ct=(C)=>{let p=T.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`),Tt=p?T.store.getMembershipForActor(T.organization.id,p.id):void 0;return{actor:p,membership:Tt,grants:Tt?T.store.listGrants(Tt.id):[]}},Tn=(C,p,Tt)=>{if(C.role==="admin")return!0;let m=T.store.getOperation(p),Rt=ct(C);if(!m||!Rt.membership)return!1;let Ht=m.resourceId?{type:"resource",id:m.resourceId}:m.environmentId?{type:"environment",id:m.environmentId}:m.projectId?{type:"project",id:m.projectId}:{type:"organization"},f=T.store.resolveAuthorizationTarget(T.organization.id,Ht);return!!f&&Ze({membership:Rt.membership,grants:Rt.grants,capability:Tt,target:f}).allowed},Ce=(C,p,Tt)=>{if(C.role==="admin")return!0;let m=ct(C);if(!m.membership)return!1;let Rt=T.store.resolveAuthorizationTarget(T.organization.id,{type:"resource",id:p});return!!Rt&&Ze({membership:m.membership,grants:m.grants,capability:Tt,target:Rt}).allowed},zc=(C,p,Tt)=>{if(C.role==="admin")return!0;let m=ct(C);if(!m.membership)return!1;let Rt=T.store.resolveAuthorizationTarget(T.organization.id,{type:"environment",id:p});return!!Rt&&Ze({membership:m.membership,grants:m.grants,capability:Tt,target:Rt}).allowed},hn=Bun.serve({hostname:r,port:d,idleTimeout:30,websocket:{open(C){if(!x){C.send(`The web terminal is disabled (TS_CLOUD_DASHBOARD_TERMINAL=0).\r
 `),C.close();return}let p=Vw((Tt)=>C.send(Tt),{cwd:e,onExit:()=>{try{C.close()}catch{}}});V.set(C,p),C.send(`Connected to ${r==="127.0.0.1"?"localhost":r} shell. This is a line-oriented shell (no full-screen apps).\r
-`)},message(C,p){V.get(C)?.write(typeof p==="string"?p:new TextDecoder().decode(p))},close(C){V.get(C)?.close(),V.delete(C)}},async fetch(C,p){let Tt=Date.now(),m=C.clone(),Rt=C.headers.get("x-request-id")?.slice(0,128)||crypto.randomUUID(),Ht=!["GET","HEAD","OPTIONS"].includes(C.method.toUpperCase()),f=new URL(C.url),ee=await(async()=>{let Ot=p??hn,ft=SJ(r,Ot.port??d),Ce=await Sg(C,_R(Ot.requestIP(C)?.address??"unknown"));if(Ce)return Ce;let Se=f.searchParams.get("env"),M=AJ(h,R,Se),Kt=u.get(M);if(!Kt)Kt=await B(M);try{if(!CJ(C))return O({ok:!1,error:"Cross-site requests are not allowed."},403);let AE=/^\/api\/source\/webhooks\/([A-Za-z0-9_-]{16,200})$/.exec(f.pathname);if(AE&&C.method==="POST"){let S=await u0({sources:nt,controlPlane:T.store,endpointToken:AE[1],headers:C.headers,rawBody:new Uint8Array(await C.arrayBuffer())});return O({accepted:S.accepted,duplicate:S.duplicate,status:S.status,operationIds:S.operations.map((L)=>L.id),message:S.message},S.accepted?202:404)}let Rn=/^\/auth\/oidc\/([a-z0-9-]+)\/(start|callback)$/.exec(f.pathname);if(Rn&&C.method==="GET"){let[,S,L]=Rn;if(!ft)return new Response(null,{status:302,headers:{location:"/login?sso_error=configuration"}});if(L==="start")try{let I=await ZS(b,S,ft,f.searchParams.get("return")??void 0,t.oidcFetch);return new Response(null,{status:302,headers:{location:I.authorizationUrl,"cache-control":"no-store"}})}catch(I){return T.store.appendEvent({organizationId:T.organization.id,type:"auth.oidc.start_failed",level:"warning",payload:{provider:S,reason:I instanceof Error?I.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=start","cache-control":"no-store"}})}try{if(f.searchParams.has("error")){let X=b.getOidcProviderBySlug(S),y=f.searchParams.get("state");if(X&&y)b.consumeOidcTransaction(X.id,y);throw Error("OIDC provider returned an authorization error")}let I=await kS(b,{providerSlug:S,state:f.searchParams.get("state")??"",code:f.searchParams.get("code")??"",origin:ft},t.oidcFetch),D=Vf(b,T,e,I.identity);b.recordLogin(D.identity.id);let g=ET(D.identity.id,C,Ot.requestIP(C)?.address??"unknown","oidc");return lt(),T.store.appendEvent({organizationId:T.organization.id,actorId:D.identity.actorId,type:"auth.login.succeeded",payload:{method:"oidc",provider:S,provisioned:D.provisioned}}),new Response(null,{status:302,headers:{location:I.returnPath,"cache-control":"no-store","set-cookie":gc(g.token,{secure:jd,maxAgeMs:Gd})}})}catch(I){return T.store.appendEvent({organizationId:T.organization.id,type:"auth.oidc.callback_failed",level:"warning",payload:{provider:S,reason:I instanceof Error?I.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=callback","cache-control":"no-store"}})}}if(f.pathname==="/api/invitations/accept"&&C.method==="POST"){let S=await v(C),L=String(S.token??"").trim(),I=String(S.username??"").trim(),D=String(S.password??"");if(!L||!Vh(I)||D.length<12)return O({ok:!1,error:"Invitation token, valid username, and a password of at least 12 characters are required."},422);let g=T.store.inspectInvitationToken(L);if(!g||g.state!=="pending")return O({ok:!1,error:g?`Invitation is ${g.state}`:"Invitation is invalid"},g?409:404);let X=gr(Ge(e),I),y=b.getIdentityByUsername(I);if(X&&!Wr(D,y?.passwordHash??X.passwordHash))return O({ok:!1,error:"That username already exists; enter its current password to continue."},401);let z=b.getIdentityByEmail(g.email);if(z&&z.id!==y?.id)return O({ok:!1,error:"This invitation belongs to an existing account. Sign in with that account or ask an owner to resend it."},409);let Y=k_(e,{username:I,password:X?void 0:D,name:typeof S.name==="string"?S.name:void 0,email:g.email,sites:X?.sites??{}}),k=Re(T.store,Y.user);try{let $t=T.store.acceptInvitation(L,k.id),Z=y?b.setVerifiedEmail(y.id,$t.invitation.email):b.createIdentity({actorId:k.id,username:Y.user.username,email:$t.invitation.email,emailVerified:!0,passwordHash:Y.user.passwordHash}),_t=ET(Z.id,C,Ot.requestIP(C)?.address??"unknown");return lt(),O({ok:!0,user:$c(Y.user),organization:T.organization,membership:$t.membership},200,{"set-cookie":gc(_t.token,{secure:jd,maxAgeMs:Gd})})}catch($t){if(!X)YL(e,Y.user.username);let Z=$t instanceof Error?$t.message:"Invitation could not be accepted.";return O({ok:!1,error:Z},Z.includes("expired")||Z.includes("revoked")||Z.includes("accepted")?409:404)}}if(f.pathname==="/api/auth/password-reset/request"&&C.method==="POST"){let S=await v(C),L=String(S.identifier??"").trim().toLowerCase(),I=Ot.requestIP(C)?.address??"unknown",D=cR.check(L,I),g=L.includes("@")?b.getIdentityByEmail(L):b.getIdentityByUsername(L);if(D.allowed)cR.recordFailure(L,I);if(D.allowed&&g?.email&&g.emailVerifiedAt&&!g.disabledAt){b.revokeActionTokens(g.id,"password_reset");let X=b.createActionToken(g.id,"password_reset"),y=`${f.origin}/reset-password?token=${encodeURIComponent(X.token)}`,z=await h_(n,{to:g.email,subject:"Reset your ts-cloud password",text:`Reset your ts-cloud password: ${y}
+`)},message(C,p){V.get(C)?.write(typeof p==="string"?p:new TextDecoder().decode(p))},close(C){V.get(C)?.close(),V.delete(C)}},async fetch(C,p){let Tt=Date.now(),m=C.clone(),Rt=C.headers.get("x-request-id")?.slice(0,128)||crypto.randomUUID(),Ht=!["GET","HEAD","OPTIONS"].includes(C.method.toUpperCase()),f=new URL(C.url),ee=await(async()=>{let Ot=p??hn,ft=SJ(r,Ot.port??d),Ie=await Sg(C,_R(Ot.requestIP(C)?.address??"unknown"));if(Ie)return Ie;let Se=f.searchParams.get("env"),M=AJ(h,R,Se),Kt=u.get(M);if(!Kt)Kt=await B(M);try{if(!CJ(C))return O({ok:!1,error:"Cross-site requests are not allowed."},403);let AE=/^\/api\/source\/webhooks\/([A-Za-z0-9_-]{16,200})$/.exec(f.pathname);if(AE&&C.method==="POST"){let S=await u0({sources:nt,controlPlane:T.store,endpointToken:AE[1],headers:C.headers,rawBody:new Uint8Array(await C.arrayBuffer())});return O({accepted:S.accepted,duplicate:S.duplicate,status:S.status,operationIds:S.operations.map((L)=>L.id),message:S.message},S.accepted?202:404)}let Rn=/^\/auth\/oidc\/([a-z0-9-]+)\/(start|callback)$/.exec(f.pathname);if(Rn&&C.method==="GET"){let[,S,L]=Rn;if(!ft)return new Response(null,{status:302,headers:{location:"/login?sso_error=configuration"}});if(L==="start")try{let I=await ZS(b,S,ft,f.searchParams.get("return")??void 0,t.oidcFetch);return new Response(null,{status:302,headers:{location:I.authorizationUrl,"cache-control":"no-store"}})}catch(I){return T.store.appendEvent({organizationId:T.organization.id,type:"auth.oidc.start_failed",level:"warning",payload:{provider:S,reason:I instanceof Error?I.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=start","cache-control":"no-store"}})}try{if(f.searchParams.has("error")){let X=b.getOidcProviderBySlug(S),y=f.searchParams.get("state");if(X&&y)b.consumeOidcTransaction(X.id,y);throw Error("OIDC provider returned an authorization error")}let I=await kS(b,{providerSlug:S,state:f.searchParams.get("state")??"",code:f.searchParams.get("code")??"",origin:ft},t.oidcFetch),D=Vf(b,T,e,I.identity);b.recordLogin(D.identity.id);let g=ET(D.identity.id,C,Ot.requestIP(C)?.address??"unknown","oidc");return lt(),T.store.appendEvent({organizationId:T.organization.id,actorId:D.identity.actorId,type:"auth.login.succeeded",payload:{method:"oidc",provider:S,provisioned:D.provisioned}}),new Response(null,{status:302,headers:{location:I.returnPath,"cache-control":"no-store","set-cookie":gc(g.token,{secure:jd,maxAgeMs:Gd})}})}catch(I){return T.store.appendEvent({organizationId:T.organization.id,type:"auth.oidc.callback_failed",level:"warning",payload:{provider:S,reason:I instanceof Error?I.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=callback","cache-control":"no-store"}})}}if(f.pathname==="/api/invitations/accept"&&C.method==="POST"){let S=await v(C),L=String(S.token??"").trim(),I=String(S.username??"").trim(),D=String(S.password??"");if(!L||!Vh(I)||D.length<12)return O({ok:!1,error:"Invitation token, valid username, and a password of at least 12 characters are required."},422);let g=T.store.inspectInvitationToken(L);if(!g||g.state!=="pending")return O({ok:!1,error:g?`Invitation is ${g.state}`:"Invitation is invalid"},g?409:404);let X=gr(Ge(e),I),y=b.getIdentityByUsername(I);if(X&&!Wr(D,y?.passwordHash??X.passwordHash))return O({ok:!1,error:"That username already exists; enter its current password to continue."},401);let z=b.getIdentityByEmail(g.email);if(z&&z.id!==y?.id)return O({ok:!1,error:"This invitation belongs to an existing account. Sign in with that account or ask an owner to resend it."},409);let Y=k_(e,{username:I,password:X?void 0:D,name:typeof S.name==="string"?S.name:void 0,email:g.email,sites:X?.sites??{}}),k=Re(T.store,Y.user);try{let $t=T.store.acceptInvitation(L,k.id),Z=y?b.setVerifiedEmail(y.id,$t.invitation.email):b.createIdentity({actorId:k.id,username:Y.user.username,email:$t.invitation.email,emailVerified:!0,passwordHash:Y.user.passwordHash}),_t=ET(Z.id,C,Ot.requestIP(C)?.address??"unknown");return lt(),O({ok:!0,user:$c(Y.user),organization:T.organization,membership:$t.membership},200,{"set-cookie":gc(_t.token,{secure:jd,maxAgeMs:Gd})})}catch($t){if(!X)YL(e,Y.user.username);let Z=$t instanceof Error?$t.message:"Invitation could not be accepted.";return O({ok:!1,error:Z},Z.includes("expired")||Z.includes("revoked")||Z.includes("accepted")?409:404)}}if(f.pathname==="/api/auth/password-reset/request"&&C.method==="POST"){let S=await v(C),L=String(S.identifier??"").trim().toLowerCase(),I=Ot.requestIP(C)?.address??"unknown",D=cR.check(L,I),g=L.includes("@")?b.getIdentityByEmail(L):b.getIdentityByUsername(L);if(D.allowed)cR.recordFailure(L,I);if(D.allowed&&g?.email&&g.emailVerifiedAt&&!g.disabledAt){b.revokeActionTokens(g.id,"password_reset");let X=b.createActionToken(g.id,"password_reset"),y=`${f.origin}/reset-password?token=${encodeURIComponent(X.token)}`,z=await h_(n,{to:g.email,subject:"Reset your ts-cloud password",text:`Reset your ts-cloud password: ${y}
 
 This link expires in one hour and can be used once.`});T.store.appendEvent({organizationId:T.organization.id,actorId:g.actorId,type:"auth.password_reset.requested",payload:{delivered:z}})}return O({ok:!0,message:"If that account has a verified email, a reset link has been sent."},202)}if(f.pathname==="/api/auth/password-reset/complete"&&C.method==="POST"){let S=await v(C),L=String(S.token??"").trim(),I=String(S.password??"");if(!L||I.length<12)return O({ok:!1,error:"A valid reset token and password of at least 12 characters are required."},422);try{let D=b.consumeActionToken(L,"password_reset"),g=_E(I),X=b.updatePassword(D.identityId,g);return Zh(e,X.username,g),T.store.appendEvent({organizationId:T.organization.id,actorId:X.actorId,type:"auth.password_reset.completed"}),O({ok:!0,message:"Password changed. Sign in again."},200,{"set-cookie":Gh({secure:jd})})}catch(D){let g=D instanceof Error?D.message:"Password reset failed.";return O({ok:!1,error:g.replace("Action token","Reset link")},g.includes("consumed")||g.includes("expired")?409:404)}}if(f.pathname==="/api/login"&&C.method==="POST"){let S=await v(C),L=String(S.username??"").trim(),I=String(S.password??""),D=Ot.requestIP(C)?.address??"unknown",g=rT.check(L,D);if(!g.allowed)return O({ok:!1,error:`Too many failed attempts. Try again in ${Math.ceil((g.retryAfterSeconds??0)/60)} minute(s).`},429,{"retry-after":String(g.retryAfterSeconds??60)});let X=gr(Ge(e),L),y=b.getIdentityByUsername(L),z=y?.passwordHash??X?.passwordHash??RJ;if(!(Wr(I,z)&&!!X&&!!y&&!y.disabledAt))return rT.recordFailure(L,D),O({ok:!1,error:"Incorrect username or password."},401);if(Kf(b,T,y))return O({ok:!1,error:"Single sign-on is required for this account."},403);rT.recordSuccess(L,D);let k=y,$t=k.requiresPasswordUpgrade||bU(k.passwordHash);if($t){let _t=_E(I);k=b.rehashPassword(k.id,_t),Zh(e,k.username,_t)}if(b.recordLogin(k.id),b.getMfaFactor(k.id)?.state==="active"){let _t=b.createMfaChallenge(k.id,"login");return T.store.appendEvent({organizationId:T.organization.id,actorId:k.actorId,type:"auth.mfa.challenge.created",payload:{purpose:"login"}}),O({ok:!0,mfaRequired:!0,challengeToken:_t.token,passwordUpgraded:$t})}let Z=ET(k.id,C,D);return T.store.appendEvent({organizationId:T.organization.id,actorId:k.actorId,type:"auth.login.succeeded",payload:{method:"local"}}),O({ok:!0,user:$c(X),passwordUpgraded:$t},200,{"set-cookie":gc(Z.token,{secure:jd,maxAgeMs:Gd})})}if(f.pathname==="/api/auth/mfa/complete"&&C.method==="POST"){let S=await v(C),L=String(S.challengeToken??"").trim(),I=String(S.code??"").trim(),D=Ot.requestIP(C)?.address??"unknown",X=b.inspectMfaChallengeToken(L,"login")?.identityId??"unknown-mfa",y=dT.check(X,D);if(!y.allowed)return O({ok:!1,error:"Too many MFA attempts. Try again later."},429,{"retry-after":String(y.retryAfterSeconds??60)});try{let z=b.completeMfaChallenge(L,I,"login");dT.recordSuccess(X,D);let Y=new Date().toISOString(),k=b.createSession({identityId:z.identity.id,userAgent:fu(C),networkHint:_R(D),mfaAt:Y,recentAuthAt:Y});return T.store.appendEvent({organizationId:T.organization.id,actorId:z.identity.actorId,type:"auth.mfa.succeeded",payload:{purpose:"login",method:z.method}}),O({ok:!0},200,{"set-cookie":gc(k.token,{secure:jd,maxAgeMs:Gd})})}catch{return dT.recordFailure(X,D),O({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}}if(f.pathname==="/api/logout"&&C.method==="POST"){let S=bt.resolveSession(C);if(S)b.revokeSession(S.identityId,S.id);let L=Gh({secure:jd});if(C.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login","set-cookie":L}});return O({ok:!0},200,{"set-cookie":L})}if(f.pathname==="/login"){let S=b.listOidcProviders(T.organization.id).map((L)=>({slug:L.slug,name:L.name}));return new Response(Zf(A?.mode==="serverless",S),{headers:{"content-type":"text/html; charset=utf-8"}})}if(f.pathname==="/forgot-password"||f.pathname==="/reset-password")return new Response(kf(f.pathname==="/reset-password"?"reset":"request"),{headers:{"content-type":"text/html; charset=utf-8"}});if(f.pathname==="/accept-invitation")return mw(W,f.pathname);let Q=bt.resolveUser(C);if(!Q){if(!f.pathname.startsWith("/api/")&&C.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login"}});return O({ok:!1,error:"Sign in to continue."},401)}let ir=Et(Q,M);if(f.pathname==="/api/me"){let S=T.store.getActorByExternalId("user",`dashboard:${Q.username.toLowerCase()}`),L=S?T.store.getMembershipForActor(T.organization.id,S.id):void 0,I=T.store.resolveAuthorizationTarget(T.organization.id,L?.scope??{type:"project",id:T.project.id})??T.store.resolveAuthorizationTarget(T.organization.id,{type:"project",id:T.project.id});return O({ok:!0,user:$c(Q),authEnabled:o,organization:T.organization,membership:L,capabilities:ln({membership:L,grants:L?T.store.listGrants(L.id):[],target:I})})}if(f.pathname.startsWith("/api/")){let S=await Mf(C,f.pathname),L=bt.check(C,f.pathname,Q,S);if(!L.ok)return O({ok:!1,error:L.error},L.status??403);if(o&&DJ.has(`${C.method.toUpperCase()} ${f.pathname}`)){let I=bt.resolveSession(C);if(!I||!b.isRecentlyAuthenticated(I))return O({ok:!1,error:"Recent authentication is required for this change.",stepUpRequired:!0},401)}}if(f.pathname==="/api/auth/security"&&C.method==="GET"){let S=ct(Q),L=S.actor?b.getIdentityByActor(S.actor.id):void 0,I=bt.resolveSession(C);return O({identity:L?{username:L.username,email:L.email,emailVerifiedAt:L.emailVerifiedAt,requiresPasswordUpgrade:L.requiresPasswordUpgrade,lastLoginAt:L.lastLoginAt}:void 0,currentSessionId:I?.id,sessions:L?b.listSessions(L.id,{includeInactive:!0}):[],mfa:L?{factor:b.getMfaFactor(L.id),recoveryCodesRemaining:b.remainingRecoveryCodes(L.id)}:void 0})}if(f.pathname==="/api/auth/oidc/providers"&&C.method==="GET")return O({providers:b.listOidcProviders(T.organization.id,{includeDisabled:!0}),callbackOrigin:ft,callbackPattern:ft?`${ft}/auth/oidc/{slug}/callback`:void 0,localOwnerRecovery:!0});if(f.pathname==="/api/auth/oidc/providers"&&C.method==="POST"){let S=await v(C),L=ct(Q),I=L.actor?b.getIdentityByActor(L.actor.id):void 0,D=S.enforceSso===!0;if(D&&(!I?.emailVerifiedAt||b.remainingRecoveryCodes(I.id)<1))return O({ok:!1,error:"Verify the owner email and generate MFA recovery codes before enforcing SSO."},409);try{let g=oh(S.defaultRole),X=b.upsertOidcProvider({id:typeof S.id==="string"?S.id:void 0,organizationId:T.organization.id,slug:String(S.slug??""),name:String(S.name??""),issuer:String(S.issuer??""),clientId:String(S.clientId??""),clientSecret:typeof S.clientSecret==="string"&&S.clientSecret?S.clientSecret:void 0,scopes:Array.isArray(S.scopes)?S.scopes.map(String):void 0,allowedDomains:Array.isArray(S.allowedDomains)?S.allowedDomains.map(String):[],defaultRole:g&&g!=="owner"?g:void 0,enabled:S.enabled!==!1,enforceSso:D});return T.store.appendEvent({organizationId:T.organization.id,actorId:L.actor?.id,type:"auth.oidc.provider.configured",payload:{providerId:X.id,issuer:X.issuer,enabled:X.enabled,enforceSso:X.enforceSso}}),O({ok:!0,provider:X})}catch(g){return O({ok:!1,error:g instanceof Error?g.message:"OIDC provider could not be saved."},422)}}if(f.pathname==="/api/auth/oidc/providers"&&C.method==="PATCH"){let S=await v(C),L=b.getOidcProvider(String(S.id??""));if(!L||L.organizationId!==T.organization.id)return O({ok:!1,error:"OIDC provider was not found."},404);let I=ct(Q),D=b.setOidcProviderEnabled(L.id,S.enabled===!0);return T.store.appendEvent({organizationId:T.organization.id,actorId:I.actor?.id,type:D.enabled?"auth.oidc.provider.enabled":"auth.oidc.provider.disabled",payload:{providerId:L.id}}),O({ok:!0,provider:D})}if(f.pathname==="/api/automation"&&C.method==="GET"){let S=Qt.listServiceAccounts(T.organization.id,{includeDisabled:!0}).map((L)=>{let I=T.store.getMembershipForActor(T.organization.id,L.actorId),D=L.createdByActorId?T.store.getActor(L.createdByActorId):void 0,g=Qt.listTokens(L.id,{includeInactive:!0}).map((X)=>({...X,createdBy:X.createdByActorId?T.store.getActor(X.createdByActorId):void 0}));return{account:L,createdBy:D,membership:I,tokens:g}});return O({accounts:S,apiBaseUrl:`${f.origin}/api/v1`,openApiUrl:`${f.origin}/api/v1/openapi.json`,tokenEnvironmentVariable:"TS_CLOUD_API_TOKEN"})}if(f.pathname==="/api/automation/service-accounts"&&C.method==="POST"){let S=await v(C),L=ct(Q),I=oh(S.roleTemplate),D=o_(S);if(!L.actor||!I||I==="owner"||!D)return O({ok:!1,error:"A non-owner role and valid organization scope are required."},422);try{let g=Qt.createServiceAccount({organizationId:T.organization.id,slug:String(S.slug??""),name:String(S.name??""),description:typeof S.description==="string"?S.description:void 0,roleTemplate:I,scope:D,createdByActorId:L.actor.id});return O({ok:!0,...g},201)}catch(g){return O({ok:!1,error:g instanceof Error?g.message:"Service account could not be created."},422)}}if(f.pathname==="/api/automation/service-accounts"&&C.method==="PATCH"){let S=await v(C),L=ct(Q),I=Qt.getServiceAccount(String(S.id??""));if(!I||I.organizationId!==T.organization.id)return O({ok:!1,error:"Service account was not found."},404);return O({ok:!0,account:Qt.disableServiceAccount(I.id,L.actor?.id)})}if(f.pathname==="/api/automation/tokens"&&C.method==="POST"){let S=await v(C),L=ct(Q),I=Qt.getServiceAccount(String(S.serviceAccountId??"")),D=o_(S);if(!L.actor||!I||I.organizationId!==T.organization.id||!D||!Array.isArray(S.capabilities))return O({ok:!1,error:"Service account, explicit capabilities, and valid scope are required."},422);try{let g=Qt.createToken({serviceAccountId:I.id,name:String(S.name??"API token"),capabilities:S.capabilities.map(String),scope:D,expiresAt:typeof S.expiresAt==="string"?S.expiresAt:void 0,createdByActorId:L.actor.id});return O({ok:!0,token:g.token,secret:g.secret,revealOnce:!0},201)}catch(g){return O({ok:!1,error:g instanceof Error?g.message:"API token could not be created."},422)}}if(f.pathname==="/api/automation/tokens/rotate"&&C.method==="POST"){let S=await v(C),L=ct(Q),I=Qt.getToken(String(S.id??"")),D=I?Qt.getServiceAccount(I.serviceAccountId):void 0;if(!L.actor||!I||D?.organizationId!==T.organization.id)return O({ok:!1,error:"API token was not found."},404);try{let g=Qt.rotateToken(I.id,L.actor.id);return O({ok:!0,token:g.token,secret:g.secret,revealOnce:!0,overlap:!0},201)}catch(g){return O({ok:!1,error:g instanceof Error?g.message:"API token could not be rotated."},409)}}if(f.pathname==="/api/automation/tokens"&&C.method==="DELETE"){let S=await v(C),L=ct(Q),I=Qt.getToken(String(S.id??"")),D=I?Qt.getServiceAccount(I.serviceAccountId):void 0;if(!I||D?.organizationId!==T.organization.id)return O({ok:!1,error:"API token was not found."},404);return O({ok:!0,token:Qt.revokeToken(I.id,L.actor?.id)})}if(f.pathname==="/api/onboarding"&&C.method==="GET"){let S=nt.listConnections(T.organization.id);return O({drafts:oe.list(T.project.id),artifacts:RE.list(T.project.id),registries:cr.list(T.organization.id),sourceConnections:S,repositories:S.flatMap((L)=>nt.listRepositories(L.id)),project:{id:T.project.id,slug:T.project.slug,name:T.project.name},environments:[...T.environments.values()].map((L)=>({id:L.id,slug:L.slug,name:L.name,kind:L.kind,region:L.region})),resources:T.store.listResources(T.project.id).filter((L)=>L.kind==="application").map((L)=>({id:L.id,slug:L.slug,name:L.name,environmentId:L.environmentId}))})}if(f.pathname==="/api/onboarding/detect"&&C.method==="POST"){let S=await v(C);try{if(S.source?.kind==="git"){let D=nt.getConnection(String(S.source.connectionId??"")),g=nt.getRepository(String(S.source.repositoryId??""));if(!D||D.organizationId!==T.organization.id||!g||g.connectionId!==D.id)throw Error("Authorized Git repository was not found");let X=typeof S.source.deployKeyId==="string"?nt.getDeployKey(S.source.deployKeyId):void 0;if(X&&X.connectionId!==D.id)throw Error("Deploy key does not belong to this connection");let y=Eu(vt(ph(),"ts-cloud-onboarding-git-"));try{let z=await $S({remote:g.cloneUrl,destination:vt(y,"checkout"),ref:String(S.source.ref??g.defaultBranch),sparsePaths:Array.isArray(S.source.sparsePaths)?S.source.sparsePaths.map(String):void 0,binding:{id:"detection",projectId:T.project.id,connectionId:D.id,repositoryId:g.id,repositoryFullName:g.fullName,defaultBranch:g.defaultBranch,monorepoRoot:String(S.source.monorepoRoot??"."),includePaths:[],excludePaths:[],submodules:S.source.submodules===!0,cloneDepth:1,deployKeyId:X?.id,autoDeploy:!1,pullRequestPreviews:!1,status:"active",version:1,createdAt:new Date().toISOString(),updatedAt:new Date().toISOString()}},{credential:nt.getCredential(D.id),deployKey:X?{...X,privateKey:nt.getDeployPrivateKey(X.id)}:void 0,timeoutMs:120000});return O({ok:!0,commitSha:z.commitSha,candidates:Pn(TS(z.directory))})}finally{_n(y,{recursive:!0,force:!0})}}if(Array.isArray(S.files)){if(S.files.length>1e4)throw Error("Detection file-count limit exceeded");let D=S.files.map((g)=>({path:String(g.path??""),size:Number(g.size??0),content:typeof g.content==="string"?g.content.slice(0,262144):void 0}));return O({ok:!0,candidates:Pn(D)})}let L=tJ(e,String(S.root??".")),I=pB(e,L);if(I===".."||I.startsWith(`..${eJ}`))throw Error("Detection root must stay inside the project");return O({ok:!0,candidates:Pn(TS(L))})}catch(L){return O({ok:!1,error:L instanceof Error?L.message:"Application detection failed."},422)}}if(f.pathname==="/api/onboarding/plan"&&C.method==="POST"){let S=await v(C);try{return O({ok:!0,plan:Xr(S.draft,Array.isArray(S.suppliedSecretNames)?S.suppliedSecretNames.map(String):[])})}catch(L){return O({ok:!1,error:L instanceof Error?L.message:"Application plan could not be generated."},422)}}if(f.pathname==="/api/onboarding/drafts"&&C.method==="POST"){let S=await v(C),L=ct(Q);try{return O({ok:!0,draft:oe.create({organizationId:T.organization.id,projectId:T.project.id,name:String(S.name??S.draft?.name??"Application draft"),draft:{...S.draft,projectId:T.project.id},step:S.step,suppliedSecretNames:Array.isArray(S.suppliedSecretNames)?S.suppliedSecretNames.map(String):[],actorId:L.actor?.id})},201)}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Application draft could not be saved."},422)}}if(f.pathname==="/api/onboarding/drafts"&&C.method==="PATCH"){let S=await v(C),L=ct(Q),I=oe.get(String(S.id??""));if(!I||I.projectId!==T.project.id)return O({ok:!1,error:"Application draft was not found."},404);try{return O({ok:!0,draft:oe.update(I.id,Number(S.version),{draft:{...S.draft,projectId:T.project.id},step:S.step,suppliedSecretNames:Array.isArray(S.suppliedSecretNames)?S.suppliedSecretNames.map(String):void 0,actorId:L.actor?.id})})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Application draft could not be updated."},409)}}if(f.pathname==="/api/onboarding/artifacts"&&C.method==="POST"){let S=ct(Q);if(Number(C.headers.get("content-length")??0)>104857600)return O({ok:!1,error:"Artifact exceeds the 100 MB upload limit."},413);try{let I=new Uint8Array(await C.arrayBuffer());return O({ok:!0,artifact:RE.create({organizationId:T.organization.id,projectId:T.project.id,filename:C.headers.get("x-artifact-filename")??"application.zip",bytes:I,actorId:S.actor?.id})},201)}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Artifact could not be inspected."},422)}}if(f.pathname==="/api/onboarding/registries"&&C.method==="POST"){let S=await v(C),L=ct(Q);try{return O({ok:!0,registry:cr.create({organizationId:T.organization.id,provider:S.provider,name:String(S.name??"Container registry"),host:String(S.host??""),credential:S.token||S.password?{username:typeof S.username==="string"?S.username:void 0,password:typeof S.password==="string"?S.password:void 0,token:typeof S.token==="string"?S.token:void 0}:void 0,credentialExpiresAt:typeof S.credentialExpiresAt==="string"?S.credentialExpiresAt:void 0,actorId:L.actor?.id})},201)}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Registry connection could not be created."},422)}}if(f.pathname==="/api/onboarding/registries"&&C.method==="PATCH"){let S=await v(C),L=ct(Q),I=cr.get(String(S.id??""));if(!I||I.organizationId!==T.organization.id)return O({ok:!1,error:"Registry connection was not found."},404);try{if(S.action==="test")return O({ok:!0,registry:await cr.test(I.id,{image:typeof S.image==="string"?S.image:void 0})});if(S.action==="rotate")return O({ok:!0,registry:cr.rotate(I.id,{username:typeof S.username==="string"?S.username:void 0,password:typeof S.password==="string"?S.password:void 0,token:typeof S.token==="string"?S.token:void 0},{expiresAt:typeof S.expiresAt==="string"?S.expiresAt:void 0,actorId:L.actor?.id})});return O({ok:!1,error:"Registry action must be test or rotate."},422)}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Registry connection could not be updated."},422)}}if(f.pathname==="/api/onboarding/registries"&&C.method==="DELETE"){let S=await v(C),L=ct(Q),I=cr.get(String(S.id??""));if(!I||I.organizationId!==T.organization.id)return O({ok:!1,error:"Registry connection was not found."},404);let D=oe.list(T.project.id).filter((g)=>g.input.source.kind==="image"&&g.input.source.registryConnectionId===I.id||g.input.build.kind==="prebuilt_image"&&g.input.build.registryConnectionId===I.id);if(S.preview===!0)return O({ok:!0,preview:!0,affectedDrafts:D});return O({ok:!0,registry:cr.disconnect(I.id,L.actor?.id),affectedDrafts:D})}if(f.pathname==="/api/onboarding/apply"&&C.method==="POST"){let S=await v(C),L=ct(Q);try{let I=vT({controlPlane:T.store,drafts:oe,draftId:String(S.id??""),expectedVersion:Number(S.version),confirmEnvironment:String(S.confirmEnvironment??""),actorId:L.actor?.id});return O({ok:!0,resource:I.resource,operation:I.operation,plan:I.plan},202)}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Application plan could not be applied."},422)}}if(f.pathname==="/api/sources"&&C.method==="GET"){let S=nt.listConnections(T.organization.id);return O({connections:S,bindings:nt.listBindings({projectId:T.project.id}),repositories:S.flatMap((L)=>nt.listRepositories(L.id)),deployKeys:S.flatMap((L)=>nt.listDeployKeys(L.id)),webhooks:S.flatMap((L)=>nt.listWebhooks(L.id)).map((L)=>({...L,deliveries:nt.listDeliveries(L.id,20)})),project:{id:T.project.id,slug:T.project.slug},environment:Hr(T,String(M)),resources:T.store.listResources(T.project.id,Hr(T,String(M)).environmentId).filter((L)=>L.kind==="application").map((L)=>({id:L.id,slug:L.slug,name:L.name}))})}if(f.pathname==="/api/sources/connections"&&C.method==="POST"){let S=await v(C),L=ct(Q),I=String(S.provider??"");if(!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(I))return O({ok:!1,error:"A supported Git provider is required."},422);try{let D=I==="github"&&(S.privateKey||S.appId)?{appId:typeof S.appId==="string"?S.appId:void 0,installationId:typeof S.installationId==="string"?S.installationId:void 0,privateKey:typeof S.privateKey==="string"?S.privateKey:void 0}:I!=="generic_ssh"&&S.token?{token:typeof S.token==="string"?S.token:void 0,username:typeof S.username==="string"?S.username:void 0}:void 0,g={github:"https://github.com",gitlab:"https://gitlab.com",bitbucket:"https://bitbucket.org",gitea:"https://gitea.com"},X,y,z;if(T.store.database.transaction(()=>{if(X=nt.createConnection({organizationId:T.organization.id,provider:I,name:String(S.name??I),host:String(S.host??g[I]??""),owner:typeof S.owner==="string"?S.owner:void 0,authKind:S.authKind,credential:D,grantedScopes:Array.isArray(S.grantedScopes)?S.grantedScopes.map(String):[],credentialExpiresAt:typeof S.credentialExpiresAt==="string"?S.credentialExpiresAt:void 0,createdByActorId:L.actor?.id}),typeof S.repositoryUrl==="string"&&typeof S.repositoryFullName==="string")y=nt.upsertRepository({connectionId:X.id,providerRepositoryId:`manual:${S.repositoryFullName}`,fullName:S.repositoryFullName,cloneUrl:S.repositoryUrl,defaultBranch:String(S.defaultBranch??"main"),visibility:"unknown",archived:!1,metadata:{source:"manual"}});if(I==="generic_ssh")z=nt.createDeployKey({connectionId:X.id,name:String(S.deployKeyName??"Repository deploy key"),publicKey:String(S.publicKey??""),privateKey:String(S.deployPrivateKey??""),host:String(S.sshHost??""),hostKey:String(S.hostKey??""),actorId:L.actor?.id})})(),S.test===!0)X=await yS(nt,X.id,y?.id);return O({ok:!0,connection:X,repository:y,deployKey:z},201)}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Source connection could not be created."},422)}}if(f.pathname==="/api/sources/connections"&&C.method==="PATCH"){let S=await v(C),L=ct(Q),I=nt.getConnection(String(S.id??""));if(!I||I.organizationId!==T.organization.id)return O({ok:!1,error:"Source connection was not found."},404);try{if(S.action==="test")return O({ok:!0,connection:await yS(nt,I.id,typeof S.repositoryId==="string"?S.repositoryId:void 0)});if(S.action==="rotate")return O({ok:!0,connection:nt.rotateCredential(I.id,{token:typeof S.token==="string"?S.token:void 0,username:typeof S.username==="string"?S.username:void 0,appId:typeof S.appId==="string"?S.appId:void 0,installationId:typeof S.installationId==="string"?S.installationId:void 0,privateKey:typeof S.privateKey==="string"?S.privateKey:void 0},{expiresAt:typeof S.expiresAt==="string"?S.expiresAt:void 0,actorId:L.actor?.id})});return O({ok:!1,error:"Connection action must be test or rotate."},422)}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Source connection could not be updated."},422)}}if(f.pathname==="/api/sources/connections"&&C.method==="DELETE"){let S=await v(C),L=ct(Q),I=nt.getConnection(String(S.id??""));if(!I||I.organizationId!==T.organization.id)return O({ok:!1,error:"Source connection was not found."},404);let D=nt.listBindings({connectionId:I.id,status:"active"});if(S.preview===!0)return O({ok:!0,preview:!0,affectedBindings:D});return O({ok:!0,...nt.disconnectConnection(I.id,L.actor?.id)})}if(f.pathname==="/api/sources/deploy-keys"&&C.method==="POST"){let S=await v(C),L=ct(Q),I=nt.getConnection(String(S.connectionId??""));if(!I||I.organizationId!==T.organization.id)return O({ok:!1,error:"Source connection was not found."},404);try{return O({ok:!0,deployKey:nt.createDeployKey({connectionId:I.id,name:String(S.name??"Repository deploy key"),publicKey:String(S.publicKey??""),privateKey:String(S.privateKey??""),host:String(S.host??""),hostKey:String(S.hostKey??""),actorId:L.actor?.id})},201)}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Deploy key could not be stored."},422)}}if(f.pathname==="/api/sources/deploy-keys"&&C.method==="DELETE"){let S=await v(C),L=ct(Q),I=nt.getDeployKey(String(S.id??"")),D=I?nt.getConnection(I.connectionId):void 0;if(!I||!D||D.organizationId!==T.organization.id)return O({ok:!1,error:"Deploy key was not found."},404);let g=nt.listBindings({connectionId:D.id}).filter((X)=>X.deployKeyId===I.id);if(S.preview===!0)return O({ok:!0,preview:!0,affectedBindings:g});return O({ok:!0,...nt.revokeDeployKey(I.id,L.actor?.id)})}if(f.pathname==="/api/sources/repositories/sync"&&C.method==="POST"){let S=await v(C),L=nt.getConnection(String(S.connectionId??""));if(!L||L.organizationId!==T.organization.id)return O({ok:!1,error:"Source connection was not found."},404);try{return O({ok:!0,repositories:await GT(nt,String(S.connectionId??""),{search:typeof S.search==="string"?S.search:void 0})})}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Repositories could not be synchronized."},422)}}if(f.pathname==="/api/sources/references"&&C.method==="GET"){let S=nt.getConnection(String(f.searchParams.get("connectionId")??""));if(!S||S.organizationId!==T.organization.id)return O({ok:!1,error:"Source connection was not found."},404);try{return O(await VT(nt,{connectionId:String(f.searchParams.get("connectionId")??""),repository:String(f.searchParams.get("repository")??""),repositoryId:f.searchParams.get("repositoryId")??void 0,deployKeyId:f.searchParams.get("deployKeyId")??void 0,type:f.searchParams.get("type")==="tags"?"tags":"branches",cursor:f.searchParams.get("cursor")??void 0}))}catch(L){return O({ok:!1,error:L instanceof Error?L.message:"References could not be listed."},422)}}if(f.pathname==="/api/sources/bindings"&&C.method==="POST"){let S=await v(C),L=ct(Q),I=Hr(T,String(M)),D=nt.getConnection(String(S.connectionId??""));if(!D||D.organizationId!==T.organization.id)return O({ok:!1,error:"Source connection was not found."},404);try{return O({ok:!0,binding:nt.createBinding({projectId:T.project.id,environmentId:I.environmentId,resourceId:typeof S.resourceId==="string"?S.resourceId:void 0,connectionId:String(S.connectionId??""),repositoryId:typeof S.repositoryId==="string"?S.repositoryId:void 0,repositoryFullName:String(S.repositoryFullName??""),defaultBranch:String(S.defaultBranch??"main"),branchRule:typeof S.branchRule==="string"?S.branchRule:void 0,tagRule:typeof S.tagRule==="string"?S.tagRule:void 0,monorepoRoot:String(S.monorepoRoot??"."),includePaths:Array.isArray(S.includePaths)?S.includePaths.map(String):[],excludePaths:Array.isArray(S.excludePaths)?S.excludePaths.map(String):[],submodules:S.submodules===!0,cloneDepth:S.cloneDepth?Number(S.cloneDepth):void 0,deployKeyId:typeof S.deployKeyId==="string"&&S.deployKeyId?S.deployKeyId:void 0,autoDeploy:S.autoDeploy!==!1,pullRequestPreviews:S.pullRequestPreviews!==!1,actorId:L.actor?.id})},201)}catch(g){return O({ok:!1,error:g instanceof Error?g.message:"Source binding could not be created."},422)}}if(f.pathname==="/api/sources/bindings"&&C.method==="PATCH"){let S=await v(C),L=ct(Q),I=nt.getBinding(String(S.id??""));if(!I||I.projectId!==T.project.id)return O({ok:!1,error:"Source binding was not found."},404);try{return O({ok:!0,binding:nt.updateBinding(I.id,Number(S.version),{defaultBranch:S.defaultBranch,branchRule:S.branchRule,tagRule:S.tagRule,monorepoRoot:S.monorepoRoot,includePaths:S.includePaths,excludePaths:S.excludePaths,submodules:S.submodules,cloneDepth:S.cloneDepth,deployKeyId:S.deployKeyId,autoDeploy:S.autoDeploy,pullRequestPreviews:S.pullRequestPreviews,status:S.status,disabledReason:S.disabledReason,actorId:L.actor?.id})})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Source binding could not be updated."},409)}}if(f.pathname==="/api/sources/webhooks"&&C.method==="POST"){let S=await v(C),L=nt.getConnection(String(S.connectionId??""));if(!L||L.organizationId!==T.organization.id)return O({ok:!1,error:"Source connection was not found."},404);try{let I=nt.createWebhook({connectionId:String(S.connectionId??""),repositoryId:typeof S.repositoryId==="string"?S.repositoryId:void 0,repositoryFullName:String(S.repositoryFullName??""),events:Array.isArray(S.events)?S.events.map(String):void 0,secret:typeof S.secret==="string"?S.secret:void 0}),D=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||ft,g=D?zn(D,I.webhook):void 0,X=S.reconcile!==!1&&D?await n_(nt,I.webhook.id,D):I.webhook;return O({ok:!0,webhook:X,endpoint:g,endpointRevealOnce:!0},201)}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Source webhook could not be created."},422)}}if(f.pathname==="/api/sources/webhooks"&&C.method==="PATCH"){let S=await v(C),L=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||ft,I=nt.getWebhook(String(S.id??"")),D=I?nt.getConnection(I.connectionId):void 0;if(!I||!D||D.organizationId!==T.organization.id)return O({ok:!1,error:"Source webhook was not found."},404);if(!L)return O({ok:!1,error:"Set TS_CLOUD_WEBHOOK_BASE_URL to reconcile provider webhooks."},422);try{return O({ok:!0,webhook:await n_(nt,String(S.id??""),L)})}catch(g){return O({ok:!1,error:g instanceof Error?g.message:"Source webhook could not be reconciled."},422)}}if(f.pathname==="/api/sources/webhooks"&&C.method==="DELETE"){let S=await v(C),L=nt.getWebhook(String(S.id??"")),I=L?nt.getConnection(L.connectionId):void 0;if(!L||!I||I.organizationId!==T.organization.id)return O({ok:!1,error:"Source webhook was not found."},404);try{return O({ok:!0,webhook:await D0(nt,String(S.id??""))})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Source webhook could not be removed."},422)}}if(f.pathname==="/api/security/posture"&&C.method==="GET"){let S=Hr(T,String(M)),L=Ut.listFindings({...S,limit:500});return O({scope:S,summary:Ut.summary(S.organizationId,S.projectId,S.environmentId),findings:L,scans:Ut.listScanRuns({...S,limit:100}),policies:Ut.listPolicies(S.organizationId).filter((I)=>!I.environmentId||I.environmentId===S.environmentId),waivers:L.flatMap((I)=>Ut.listWaivers(I.id)),decisions:Ut.listDecisions(S.environmentId,50),actors:T.store.listMemberships(T.organization.id).map((I)=>T.store.getActor(I.actorId)).filter(Boolean)})}if(f.pathname==="/api/security/export"&&C.method==="GET")return O(Ut.exportPosture(T.organization.id));if(f.pathname==="/api/security/scan"&&C.method==="POST"){let S=Hr(T,String(M)),L=await new Ic(Ut).run(new Q_,{...S,artifactRoot:e}),I=Ph(Ut,S,Kt??{});return O({ok:!0,source:L,host:I,summary:Ut.summary(S.organizationId,S.projectId,S.environmentId)})}if(f.pathname==="/api/security/review"&&C.method==="POST")try{let S=Hr(T,String(M));return O({ok:!0,...ah(Ut,{scope:S,desiredConfigHash:T.project.desiredConfigHash})})}catch(S){return O({ok:!1,error:S instanceof Error?S.message:"Security change review failed."},409)}if(f.pathname==="/api/security/policies"&&C.method==="POST"){let S=await v(C),L=ct(Q);if(!L.actor)return O({ok:!1,error:"An organization actor is required."},403);try{let I=Ut.createPolicy({organizationId:T.organization.id,environmentId:S.environmentId===null?void 0:String(S.environmentId??Hr(T,String(M)).environmentId),name:String(S.name??""),scannerFailMode:S.scannerFailMode==="open"?"open":"closed",requiredScanners:Array.isArray(S.requiredScanners)?S.requiredScanners.map(String):[],rules:Array.isArray(S.rules)?S.rules.map((D)=>({minimumSeverity:String(D.minimumSeverity),action:String(D.action),scannerId:D.scannerId?String(D.scannerId):void 0})):[],actorId:L.actor.id});return O({ok:!0,policy:I},201)}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Security policy could not be created."},422)}}if(f.pathname==="/api/security/policies"&&C.method==="PATCH"){let S=await v(C),L=ct(Q),I=Ut.getPolicy(String(S.id??""));if(!L.actor||!I||I.organizationId!==T.organization.id)return O({ok:!1,error:"Security policy was not found."},404);try{return O({ok:!0,policy:Ut.updatePolicy(I.id,Number(S.version),{name:typeof S.name==="string"?S.name:void 0,scannerFailMode:S.scannerFailMode==="open"||S.scannerFailMode==="closed"?S.scannerFailMode:void 0,requiredScanners:Array.isArray(S.requiredScanners)?S.requiredScanners.map(String):void 0,rules:Array.isArray(S.rules)?S.rules.map((D)=>({minimumSeverity:String(D.minimumSeverity),action:String(D.action),scannerId:D.scannerId?String(D.scannerId):void 0})):void 0,enabled:typeof S.enabled==="boolean"?S.enabled:void 0,actorId:L.actor.id})})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Security policy could not be updated."},409)}}if(f.pathname==="/api/security/waivers"&&C.method==="POST"){let S=await v(C),L=ct(Q);if(!L.actor)return O({ok:!1,error:"An organization actor is required."},403);try{return O({ok:!0,waiver:Ut.createWaiver({findingId:String(S.findingId??""),policyId:typeof S.policyId==="string"?S.policyId:void 0,reason:String(S.reason??""),referenceUrl:typeof S.referenceUrl==="string"?S.referenceUrl:void 0,expiresAt:String(S.expiresAt??""),actorId:L.actor.id})},201)}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Security waiver could not be created."},422)}}if(f.pathname==="/api/security/waivers"&&C.method==="DELETE"){let S=await v(C),L=ct(Q);if(!L.actor)return O({ok:!1,error:"An organization actor is required."},403);try{return O({ok:!0,waiver:Ut.revokeWaiver(String(S.id??""),L.actor.id)})}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Security waiver could not be revoked."},404)}}if(f.pathname==="/api/security/findings"&&C.method==="PATCH"){let S=await v(C),L=ct(Q),I=Ut.getFinding(String(S.id??""));if(!L.actor||!I||I.organizationId!==T.organization.id)return O({ok:!1,error:"Security finding was not found."},404);try{let D=S.action==="acknowledge"?Ut.acknowledgeFinding(I.id,L.actor.id):Ut.assignFinding(I.id,typeof S.ownerActorId==="string"&&S.ownerActorId?S.ownerActorId:void 0,L.actor.id);return O({ok:!0,finding:D})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Security finding could not be updated."},422)}}if(f.pathname==="/api/security/comments"&&C.method==="POST"){let S=await v(C),L=ct(Q);if(!L.actor)return O({ok:!1,error:"An organization actor is required."},403);try{return O({ok:!0,comment:Ut.addComment({findingId:String(S.findingId??""),actorId:L.actor.id,body:String(S.body??""),referenceUrl:typeof S.referenceUrl==="string"?S.referenceUrl:void 0})},201)}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Comment could not be saved."},422)}}if(f.pathname==="/api/auth/sessions"&&C.method==="GET"){let S=bt.resolveSession(C);return O({currentSessionId:S?.id,sessions:S?b.listSessions(S.identityId,{includeInactive:!0}):[]})}if(f.pathname==="/api/auth/sessions"&&C.method==="DELETE"){let S=await v(C),L=bt.resolveSession(C);if(!L)return O({ok:!1,error:"Sign in again to manage sessions."},401);let I=String(S.id??""),D=b.revokeSession(L.identityId,I),g=I===L.id&&D?{"set-cookie":Gh({secure:jd})}:void 0;return O({ok:D,signedOut:I===L.id&&D},D?200:404,g)}if(f.pathname==="/api/auth/sessions/revoke-others"&&C.method==="POST"){let S=bt.resolveSession(C);if(!S)return O({ok:!1,error:"Sign in again to manage sessions."},401);return O({ok:!0,revoked:b.revokeOtherSessions(S.identityId,S.id)})}if(f.pathname==="/api/auth/password/change"&&C.method==="POST"){let S=await v(C),L=String(S.currentPassword??""),I=String(S.password??""),D=ct(Q),g=D.actor?b.getIdentityByActor(D.actor.id):void 0;if(!g||!Wr(L,g.passwordHash))return O({ok:!1,error:"Current password is incorrect."},401);if(I.length<12)return O({ok:!1,error:"New password must be at least 12 characters."},422);if(Wr(I,g.passwordHash))return O({ok:!1,error:"Choose a different password."},409);let X=_E(I),y=b.updatePassword(g.id,X);Zh(e,y.username,X);let z=ET(y.id,C,Ot.requestIP(C)?.address??"unknown");return T.store.appendEvent({organizationId:T.organization.id,actorId:y.actorId,type:"auth.password.changed"}),O({ok:!0,message:"Password changed and other sessions were signed out."},200,{"set-cookie":gc(z.token,{secure:jd,maxAgeMs:Gd})})}if(f.pathname==="/api/auth/mfa/enroll"&&C.method==="POST"){let S=await v(C),L=bt.resolveSession(C),I=ct(Q),D=I.actor?b.getIdentityByActor(I.actor.id):void 0;if(!L||!D)return O({ok:!1,error:"Sign in again before enabling MFA."},401);if(!Wr(String(S.password??""),D.passwordHash))return O({ok:!1,error:"Current password is incorrect."},401);try{let g=b.beginTotpEnrollment(D.id,{issuer:T.organization.name});return T.store.appendEvent({organizationId:T.organization.id,actorId:D.actorId,type:"auth.mfa.enrollment.started"}),O({factor:g.factor,secret:g.secret,uri:g.uri})}catch(g){return O({ok:!1,error:g instanceof Error?g.message:"MFA enrollment failed."},409)}}if(f.pathname==="/api/auth/mfa/verify"&&C.method==="POST"){let S=await v(C),L=bt.resolveSession(C),I=ct(Q),D=I.actor?b.getIdentityByActor(I.actor.id):void 0;if(!L||!D)return O({ok:!1,error:"Sign in again before enabling MFA."},401);try{let g=b.verifyTotpEnrollment(D.id,String(S.code??""));return b.markSessionStepUp(L.id,!0),T.store.appendEvent({organizationId:T.organization.id,actorId:D.actorId,type:"auth.mfa.enabled",payload:{recoveryCodeCount:g.recoveryCodes.length}}),O(g)}catch(g){return O({ok:!1,error:g instanceof Error?g.message:"MFA enrollment failed."},422)}}if(f.pathname==="/api/auth/mfa"&&C.method==="DELETE"){let S=await v(C),L=bt.resolveSession(C),I=ct(Q),D=I.actor?b.getIdentityByActor(I.actor.id):void 0;if(!L||!D||!Wr(String(S.password??""),D.passwordHash))return O({ok:!1,error:"Current password is incorrect."},401);let g=b.verifyMfaCode(D.id,String(S.code??""));if(!g.valid||!g.method)return O({ok:!1,error:"Authenticator or recovery code is incorrect."},401);return b.disableMfa(D.id),b.revokeOtherSessions(D.id,L.id),b.markSessionStepUp(L.id),T.store.appendEvent({organizationId:T.organization.id,actorId:D.actorId,type:"auth.mfa.disabled",payload:{method:g.method}}),O({ok:!0})}if(f.pathname==="/api/auth/step-up"&&C.method==="POST"){let S=await v(C),L=bt.resolveSession(C),I=ct(Q),D=I.actor?b.getIdentityByActor(I.actor.id):void 0;if(!L||!D||!Wr(String(S.password??""),D.passwordHash))return O({ok:!1,error:"Current password is incorrect."},401);let g=b.getMfaFactor(D.id);if(g?.state==="active"){if(!b.verifyMfaCode(D.id,String(S.code??"")).valid)return O({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}let X=b.markSessionStepUp(L.id,g?.state==="active");return T.store.appendEvent({organizationId:T.organization.id,actorId:D.actorId,type:"auth.step_up.succeeded",payload:{mfa:g?.state==="active"}}),O({ok:!0,recentAuthAt:X.recentAuthAt})}if(f.pathname==="/api/terminal"){if(!x)return O({ok:!1,error:"The web terminal is disabled."},403);if(Ot.upgrade(C))return;return tR("WebSocket upgrade failed",400)}if(f.pathname==="/api/health"){let S=T.store.health();return O({ok:!0,cwd:e,environment:M,environments:h,uiRoot:await $(Q,M),liveData:s.size>0,terminal:x,localPackage:import.meta.url.includes("/Code/Libraries/ts-cloud/"),controlPlane:{schemaVersion:S.schemaVersion,supportedSchemaVersion:S.supportedSchemaVersion,integrity:S.integrity,pendingRetryableOperations:S.pendingRetryableOperations}})}if(f.pathname==="/api/control-plane/operations"){let S=f.searchParams.get("state"),L=S&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(S)?S:void 0;return O({operations:T.store.listOperations({projectId:T.project.id,state:L,kind:f.searchParams.get("kind")??void 0,limit:Number(f.searchParams.get("limit"))||100})})}if(f.pathname==="/api/queue"&&C.method==="GET"){let S=f.searchParams.get("state"),L=S&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(S)?S:void 0,I=st.list({projectId:T.project.id,state:L,limit:Number(f.searchParams.get("limit"))||250}).filter((D)=>Tn(Q,D.operation.id,"deployments:read")).map((D)=>{let g=D.operation.resourceId?T.store.getResource(D.operation.resourceId):void 0,X=D.operation.environmentId?T.store.listEnvironments(T.project.id).find((Y)=>Y.id===D.operation.environmentId):void 0,y=D.operation.actorId?T.store.getActor(D.operation.actorId):void 0,z=D.operation.input;return{...D,target:g?{id:g.id,name:g.name,slug:g.slug,kind:g.kind}:X?{id:X.id,name:X.name,slug:X.slug,kind:"environment"}:{id:T.project.id,name:T.project.name,slug:T.project.slug,kind:"project"},actor:y?{id:y.id,name:y.displayName,kind:y.kind}:void 0,commit:z.revision??z.source?.commitSha??null}});return O({operations:I,concurrency:st.limits})}if(f.pathname==="/api/queue/logs"&&C.method==="GET"){let S=String(f.searchParams.get("id")??"");if(!Tn(Q,S,"deployments:read"))return O({ok:!1,error:"Operation was not found in this scope."},404);let L=st.logs(S,{after:Number(f.searchParams.get("after"))||0,limit:Number(f.searchParams.get("limit"))||500});return O({entries:L,cursor:L.at(-1)?.sequence??(Number(f.searchParams.get("after"))||0),operation:T.store.getOperation(S)})}if(f.pathname==="/api/queue/stream"&&C.method==="GET"){let S=String(f.searchParams.get("id")??"");if(!Tn(Q,S,"deployments:read"))return O({ok:!1,error:"Operation was not found in this scope."},404);let L=C.headers.get("last-event-id")?.trim(),I=Number(L||f.searchParams.get("after")||0),D=new TextEncoder,g,X=!1,y=new ReadableStream({start(z){let Y=()=>{if(X)return;let k=bt.resolveUser(C);if(!k||!Tn(k,S,"deployments:read")){if(X=!0,g)clearInterval(g);z.close();return}let $t=st.logs(S,{after:I,limit:500});for(let _t of $t)I=_t.sequence,z.enqueue(D.encode(`id: ${_t.sequence}
 event: log
@@ -6651,13 +6651,13 @@ data: ${JSON.stringify(_t)}
 `));let Z=T.store.getOperation(S);if(Z&&["succeeded","failed","cancelled","timed_out"].includes(Z.state)&&st.logs(S,{after:I,limit:1}).length===0){if(X=!0,g)clearInterval(g);z.enqueue(D.encode(`event: complete
 data: ${JSON.stringify({state:Z.state,cursor:I})}
 
-`)),z.close()}};if(Y(),!X)g=setInterval(Y,500);C.signal.addEventListener("abort",()=>{if(X=!0,g)clearInterval(g);try{z.close()}catch{}},{once:!0})},cancel(){if(X=!0,g)clearInterval(g)}});return new Response(y,{headers:{"content-type":"text/event-stream","cache-control":"no-store","x-accel-buffering":"no"}})}if(f.pathname==="/api/queue/cancel"&&C.method==="POST"){let S=await v(C),L=String(S.id??"");if(!Tn(Q,L,"deployments:cancel"))return O({ok:!1,error:"Operation was not found or cannot be cancelled in this scope."},404);let I=Re(T.store,Q);try{return O({ok:!0,operation:st.requestCancellation(L,I.id)})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Cancellation failed."},409)}}if(f.pathname==="/api/queue/retry"&&C.method==="POST"){let S=await v(C),L=String(S.id??"");if(!Tn(Q,L,"deployments:create"))return O({ok:!1,error:"Operation was not found or cannot be retried in this scope."},404);let I=Re(T.store,Q);try{return O({ok:!0,operation:st.retry(L,String(S.errorClass??"manual"),{delayMs:Number(S.delayMs)||0,actorId:I.id})})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Retry failed."},409)}}if(f.pathname==="/api/queue/settings"&&C.method==="GET")return O({concurrency:st.limits});if(f.pathname==="/api/queue/settings"&&C.method==="PATCH"){let S=await v(C);if(S.confirm!=="update queue limits")return O({ok:!1,error:'Type "update queue limits" to confirm production concurrency changes.'},409);let L=Re(T.store,Q);return O({ok:!0,concurrency:st.configureConcurrency(S.concurrency??{},{organizationId:T.organization.id,actorId:L.id})})}if(f.pathname==="/api/queue/history"&&C.method==="DELETE"){let S=await v(C);if(S.confirm!=="clear completed")return O({ok:!1,error:'Type "clear completed" to confirm retained history cleanup.'},409);let L=Re(T.store,Q);return O({ok:!0,deleted:st.clearCompleted({projectId:T.project.id,before:typeof S.before==="string"?S.before:void 0,actorId:L.id})})}if(f.pathname==="/api/previews"&&C.method==="GET"){let S=pt.previews.listInstances({projectId:T.project.id}).filter((D)=>Oe(Q,D.resourceId,"deployments:read")),L=pt.previews.listDefinitions(T.project.id).filter((D)=>Oe(Q,D.resourceId,"project:read")),I=T.store.listResources(T.project.id).filter((D)=>D.kind==="application"&&Oe(Q,D.id,"project:read")).map((D)=>({id:D.id,slug:D.slug,name:D.name,environmentId:D.environmentId}));return O({previews:S,definitions:L,resources:I,environments:[...T.environments.values()]})}if(f.pathname==="/api/releases"&&C.method==="GET"){let S=[...T.environments.values()],L=T.store.listResources(T.project.id).filter((g)=>Oe(Q,g.id,"deployments:read")),I=new Set(L.map((g)=>g.id)),D=_r.releases.list({projectId:T.project.id}).filter((g)=>I.has(g.resourceId)).map((g)=>{let X=L.find((Y)=>Y.id===g.resourceId),y=S.find((Y)=>Y.id===g.environmentId),z=g.previousReleaseId?_r.releases.get(g.previousReleaseId):void 0;return{...g,resource:X?{id:X.id,name:X.name,slug:X.slug,provider:X.provider}:void 0,environment:y?{id:y.id,name:y.name,slug:y.slug,kind:y.kind}:void 0,artifact:_r.releases.getArtifact(g.artifactId),transitions:_r.releases.transitions(g.id),approvals:_r.releases.approvals(g.id),previous:z,comparison:z?_r.releases.compare(z.id,g.id):void 0,capabilities:e_({kind:g.kind,provider:X?.provider,hasHealthGate:!!g.healthGate,replicas:Number(g.manifest?.replicas)||1})}});return O({releases:D,resources:L.map((g)=>({id:g.id,name:g.name,slug:g.slug,environmentId:g.environmentId,provider:g.provider})),environments:S})}if(f.pathname==="/api/releases/action"&&C.method==="POST"){let S=await v(C),L=_r.releases.get(String(S.id??"")),I=String(S.action??"");if(!L||!Oe(Q,L.resourceId,"deployments:create"))return O({ok:!1,error:"Release was not found in this scope."},404);let D=Re(T.store,Q);try{if(I==="activate")return O({ok:!0,operation:_r.enqueueActivation(L,{actorId:D.id})});if(I==="rollback"){let g=T.store.getResource(L.resourceId);if(S.confirm!==g?.slug)return O({ok:!1,error:`Type "${g?.slug??""}" to confirm rollback.`},409);return O({ok:!0,operation:_r.enqueueRollback(L,{actorId:D.id,targetReleaseId:typeof S.targetReleaseId==="string"?S.targetReleaseId:void 0})})}if(I==="approve"){let g=T.store.listEnvironments(L.projectId).find((X)=>X.id===L.environmentId);if(S.confirm!==g?.slug)return O({ok:!1,error:`Type "${g?.slug??""}" to confirm the environment gate.`},409);return O({ok:!0,release:_r.releases.approve(L.id,{actorId:D.id,decision:S.decision==="rejected"?"rejected":"approved",comment:typeof S.comment==="string"?S.comment:void 0})})}if(I==="pin")return O({ok:!0,release:_r.releases.pin(L.id,S.pinned!==!1,typeof S.reason==="string"?S.reason:void 0)});if(I==="promote"){let g=T.store.getResource(String(S.targetResourceId??"")),X=g?T.store.listEnvironments(L.projectId).find((y)=>y.id===g.environmentId):void 0;if(!g||!X||!Oe(Q,g.id,"deployments:create"))return O({ok:!1,error:"Promotion target was not found in this scope."},404);if(S.confirm!==X.slug)return O({ok:!1,error:`Type "${X.slug}" to confirm promotion.`},409);return O({ok:!0,release:_r.releases.promote(L.id,{targetEnvironmentId:X.id,targetResourceId:g.id,config:S.config&&typeof S.config==="object"?S.config:{},strategy:typeof S.strategy==="string"?S.strategy:void 0,actorId:D.id,approvalRequired:S.approvalRequired===!0})})}return O({ok:!1,error:"Unsupported release action."},422)}catch(g){return O({ok:!1,error:g instanceof Error?g.message:"Release action failed."},409)}}if(f.pathname==="/api/compose"&&C.method==="GET"){let S=ad.applications.list({projectId:T.project.id}).filter((L)=>Oe(Q,L.resourceId,"applications:read")).map((L)=>({...L,services:ad.applications.services(L.id)}));return O({applications:S,templates:zT(),environments:[...T.environments.values()]})}if(f.pathname==="/api/compose/preview"&&C.method==="POST"){let S=await v(C),L=String(S.environmentId??"");if(!zc(Q,L,"applications:manage"))return O({ok:!1,error:"Environment was not found in this scope."},404);try{return O({ok:!0,result:ad.applications.preview(String(S.source??""),{name:String(S.name??""),slug:typeof S.slug==="string"?S.slug:void 0,projectId:T.project.id,environmentId:L})})}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Compose could not be parsed."},422)}}if((f.pathname==="/api/compose/import"||f.pathname==="/api/compose/template")&&C.method==="POST"){let S=await v(C),L=String(S.environmentId??"");if(!zc(Q,L,"applications:manage"))return O({ok:!1,error:"Environment was not found in this scope."},404);let I=Re(T.store,Q);try{let D=f.pathname.endsWith("/template")?ad.applications.fromTemplate(String(S.templateId??""),S.inputs&&typeof S.inputs==="object"?S.inputs:{},{name:String(S.name??""),projectId:T.project.id,environmentId:L,version:typeof S.templateVersion==="string"?S.templateVersion:void 0,createdByActorId:I.id}):ad.applications.import(String(S.source??""),{name:String(S.name??""),slug:typeof S.slug==="string"?S.slug:void 0,projectId:T.project.id,environmentId:L,createdByActorId:I.id});return O({ok:!0,application:D.application,diagnostics:D.parsed.diagnostics})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Compose application could not be saved."},422)}}if(f.pathname==="/api/compose/action"&&C.method==="POST"){let S=await v(C),L=ad.applications.get(String(S.id??"")),I=String(S.action??""),D=I==="delete"||I==="stop"?"deployments:cancel":"deployments:create";if(!L||!Oe(Q,L.resourceId,D))return O({ok:!1,error:"Compose application was not found in this scope."},404);try{let g=Re(T.store,Q);return O({ok:!0,operation:ad.enqueue(L,I,{actorId:g.id,service:typeof S.service==="string"?S.service:void 0,replicas:Number.isFinite(Number(S.replicas))?Number(S.replicas):void 0,removeVolumes:S.removeVolumes===!0,confirmation:typeof S.confirm==="string"?S.confirm:void 0})})}catch(g){return O({ok:!1,error:g instanceof Error?g.message:"Compose operation could not be queued."},409)}}if((f.pathname==="/api/compose/logs"||f.pathname==="/api/compose/shell")&&C.method==="POST"){let S=await v(C),L=ad.applications.get(String(S.id??"")),I=f.pathname.endsWith("/shell"),D=I?"runtime:terminal":"runtime:logs";if(!L||!Oe(Q,L.resourceId,D))return O({ok:!1,error:"Compose service was not found in this scope."},404);let g=String(S.service??"");if(!L.manifest.spec.services[g])return O({ok:!1,error:"Compose service was not found."},404);if(I&&S.confirm!==g)return O({ok:!1,error:`Type "${g}" to run a service command.`},409);let X=T.store.listEnvironments(L.projectId).find((z)=>z.id===L.environmentId)?.slug;if(!X)return O({ok:!1,error:"Compose environment was not found."},404);let y=I?UC(L.manifest,g,Array.isArray(S.command)?S.command.map(String):["sh"]):DC(L.manifest,g,Number(S.lines)||200);return O(await b_(n,X,y))}if(f.pathname==="/api/previews/definitions"&&C.method==="POST"){let S=await v(C),L=String(S.resourceId??"");if(!Oe(Q,L,"config:write"))return O({ok:!1,error:"Application was not found in this scope."},404);let I=Re(T.store,Q);try{return O({ok:!0,definition:pt.previews.createDefinition({...S,projectId:T.project.id,resourceId:L,baseEnvironmentId:String(S.baseEnvironmentId??""),domainPattern:String(S.domainPattern??""),createdByActorId:I.id})})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Preview policy could not be created."},409)}}if(f.pathname==="/api/previews/deploy"&&C.method==="POST"){let S=await v(C),L=pt.previews.getDefinition(String(S.definitionId??""));if(!L||!Oe(Q,L.resourceId,"deployments:create"))return O({ok:!1,error:"Preview policy was not found in this scope."},404);let I=Re(T.store,Q);try{let D=pt.previews.upsert({definitionId:L.id,sourceProvider:"dashboard",repository:"dashboard",branch:String(S.branch??""),pullRequestNumber:Number(S.pullRequestNumber)||void 0,commitSha:String(S.commitSha??""),createdByActorId:I.id});return O({ok:!0,preview:D.preview,operation:pt.enqueueDeploy(D.preview,{created:D.created,actorId:I.id})})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Preview could not be queued."},409)}}if(f.pathname==="/api/previews/destroy"&&C.method==="POST"){let S=await v(C),L=pt.previews.getInstance(String(S.id??""));if(!L||!Oe(Q,L.resourceId,"deployments:cancel"))return O({ok:!1,error:"Preview was not found in this scope."},404);if(S.confirm!==L.name)return O({ok:!1,error:`Type "${L.name}" to confirm tagged teardown.`},409);let I=Re(T.store,Q);return O({ok:!0,operation:pt.enqueueDestroy(L,"dashboard",I.id)})}if(f.pathname==="/api/previews/extend"&&C.method==="POST"){let S=await v(C),L=pt.previews.getInstance(String(S.id??""));if(!L||!Oe(Q,L.resourceId,"deployments:create"))return O({ok:!1,error:"Preview was not found in this scope."},404);return O({ok:!0,preview:pt.previews.extend(L.id,Number(S.hours))})}if(f.pathname==="/api/previews/rebuild"&&C.method==="POST"){let S=await v(C),L=pt.previews.getInstance(String(S.id??""));if(!L||!Oe(Q,L.resourceId,"deployments:create"))return O({ok:!1,error:"Preview was not found in this scope."},404);let I=Re(T.store,Q);return O({ok:!0,operation:pt.enqueueDeploy(L,{actorId:I.id,reason:"manual_rebuild"})})}if(f.pathname==="/api/previews/cleanup"&&C.method==="POST"){let S=await v(C);if(!S.dryRun&&S.confirm!=="cleanup previews")return O({ok:!1,error:'Type "cleanup previews" to confirm teardown.'},409);let L=Re(T.store,Q);return O({ok:!0,...pt.cleanup({dryRun:S.dryRun===!0,maxAgeHours:Number(S.maxAgeHours)||void 0,keepCount:Number(S.keepCount)||void 0,actorId:L.id})})}if(f.pathname==="/api/control-plane/events")return O({events:T.store.listEvents({organizationId:T.organization.id,projectId:T.project.id,operationId:f.searchParams.get("operationId")??void 0,correlationId:f.searchParams.get("correlationId")??void 0,afterSequence:Number(f.searchParams.get("afterSequence"))||void 0,limit:Number(f.searchParams.get("limit"))||200})});if(f.pathname==="/api/search"){let S=String(f.searchParams.get("q")??"").trim().slice(0,128),L=ir.role==="member"?new Set(Object.keys(ir.sites)):void 0,I=S?GR(T.store,{projectId:T.project.id,query:S,allowedResourceSlugs:L,limit:Number(f.searchParams.get("limit"))||20}):[];return O({query:S,results:I,stale:!1})}if(f.pathname==="/api/search/preferences"&&C.method==="GET"){let S=`dashboard:${Q.username.toLowerCase()}`;return O({savedFilters:T.store.listSavedFilters(S),navigation:T.store.listNavigation(S)})}if(f.pathname==="/api/search/preferences"&&C.method==="POST"){let S=`dashboard:${Q.username.toLowerCase()}`,L=await v(C),I=String(L.action??"");if(I==="save-filter")return O({savedFilter:T.store.saveFilter(S,String(L.name??""),String(L.routeId??""),L.query??{})});if(I==="favorite")return O({navigation:T.store.setFavorite(S,String(L.entityType??""),String(L.entityId??""),L.favorite!==!1)});if(I==="visit")return O({navigation:T.store.recordNavigation(S,String(L.entityType??""),String(L.entityId??""))});return O({ok:!1,error:"Unknown search preference action."},422)}if(f.pathname==="/api/search/preferences"&&C.method==="DELETE"){let S=`dashboard:${Q.username.toLowerCase()}`,L=await v(C);return O({ok:T.store.deleteSavedFilter(S,String(L.id??""))})}if(f.pathname==="/api/organization"&&C.method==="GET"){let S=T.store.listMemberships(T.organization.id,{includeRevoked:!0}).map((L)=>{let I=T.store.getActor(L.actorId);return{...L,actor:I?{id:I.id,displayName:I.displayName,externalId:I.externalId,disabledAt:I.disabledAt}:void 0,grants:T.store.listGrants(L.id)}});return O({organization:T.organization,project:T.project,environments:T.store.listEnvironments(T.project.id),resources:T.store.listResources(T.project.id).map((L)=>({id:L.id,environmentId:L.environmentId,kind:L.kind,slug:L.slug,name:L.name})),memberships:S,invitations:T.store.listInvitations(T.organization.id)})}if(f.pathname==="/api/organization/invitations"&&C.method==="GET")return O({invitations:T.store.listInvitations(T.organization.id)});if(f.pathname==="/api/organization/invitations"&&C.method==="POST"){let S=await v(C),L=oh(S.roleTemplate),I=o_(S);if(!L||!I)return O({ok:!1,error:"Choose a valid role template and resource scope."},422);let D=ct(Q);if(!D.actor||!D.membership)return O({ok:!1,error:"Your organization membership is unavailable."},403);if(L==="owner"&&(!Wr(String(S.password??""),Q.passwordHash)||D.membership.roleTemplate!=="owner"))return O({ok:!1,error:"Owner invitations require an owner to re-enter their password."},401);try{let g=T.store.createInvitation({organizationId:T.organization.id,email:String(S.email??""),roleTemplate:L,scope:I,invitedByActorId:D.actor.id,expiresInMs:Number(S.expiresInMs)||void 0}),X=`${f.origin}/accept-invitation?token=${encodeURIComponent(g.token)}`,y=await h_(n,{to:g.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${X}
+`)),z.close()}};if(Y(),!X)g=setInterval(Y,500);C.signal.addEventListener("abort",()=>{if(X=!0,g)clearInterval(g);try{z.close()}catch{}},{once:!0})},cancel(){if(X=!0,g)clearInterval(g)}});return new Response(y,{headers:{"content-type":"text/event-stream","cache-control":"no-store","x-accel-buffering":"no"}})}if(f.pathname==="/api/queue/cancel"&&C.method==="POST"){let S=await v(C),L=String(S.id??"");if(!Tn(Q,L,"deployments:cancel"))return O({ok:!1,error:"Operation was not found or cannot be cancelled in this scope."},404);let I=Re(T.store,Q);try{return O({ok:!0,operation:st.requestCancellation(L,I.id)})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Cancellation failed."},409)}}if(f.pathname==="/api/queue/retry"&&C.method==="POST"){let S=await v(C),L=String(S.id??"");if(!Tn(Q,L,"deployments:create"))return O({ok:!1,error:"Operation was not found or cannot be retried in this scope."},404);let I=Re(T.store,Q);try{return O({ok:!0,operation:st.retry(L,String(S.errorClass??"manual"),{delayMs:Number(S.delayMs)||0,actorId:I.id})})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Retry failed."},409)}}if(f.pathname==="/api/queue/settings"&&C.method==="GET")return O({concurrency:st.limits});if(f.pathname==="/api/queue/settings"&&C.method==="PATCH"){let S=await v(C);if(S.confirm!=="update queue limits")return O({ok:!1,error:'Type "update queue limits" to confirm production concurrency changes.'},409);let L=Re(T.store,Q);return O({ok:!0,concurrency:st.configureConcurrency(S.concurrency??{},{organizationId:T.organization.id,actorId:L.id})})}if(f.pathname==="/api/queue/history"&&C.method==="DELETE"){let S=await v(C);if(S.confirm!=="clear completed")return O({ok:!1,error:'Type "clear completed" to confirm retained history cleanup.'},409);let L=Re(T.store,Q);return O({ok:!0,deleted:st.clearCompleted({projectId:T.project.id,before:typeof S.before==="string"?S.before:void 0,actorId:L.id})})}if(f.pathname==="/api/previews"&&C.method==="GET"){let S=pt.previews.listInstances({projectId:T.project.id}).filter((D)=>Ce(Q,D.resourceId,"deployments:read")),L=pt.previews.listDefinitions(T.project.id).filter((D)=>Ce(Q,D.resourceId,"project:read")),I=T.store.listResources(T.project.id).filter((D)=>D.kind==="application"&&Ce(Q,D.id,"project:read")).map((D)=>({id:D.id,slug:D.slug,name:D.name,environmentId:D.environmentId}));return O({previews:S,definitions:L,resources:I,environments:[...T.environments.values()]})}if(f.pathname==="/api/releases"&&C.method==="GET"){let S=[...T.environments.values()],L=T.store.listResources(T.project.id).filter((g)=>Ce(Q,g.id,"deployments:read")),I=new Set(L.map((g)=>g.id)),D=_r.releases.list({projectId:T.project.id}).filter((g)=>I.has(g.resourceId)).map((g)=>{let X=L.find((Y)=>Y.id===g.resourceId),y=S.find((Y)=>Y.id===g.environmentId),z=g.previousReleaseId?_r.releases.get(g.previousReleaseId):void 0;return{...g,resource:X?{id:X.id,name:X.name,slug:X.slug,provider:X.provider}:void 0,environment:y?{id:y.id,name:y.name,slug:y.slug,kind:y.kind}:void 0,artifact:_r.releases.getArtifact(g.artifactId),transitions:_r.releases.transitions(g.id),approvals:_r.releases.approvals(g.id),previous:z,comparison:z?_r.releases.compare(z.id,g.id):void 0,capabilities:e_({kind:g.kind,provider:X?.provider,hasHealthGate:!!g.healthGate,replicas:Number(g.manifest?.replicas)||1})}});return O({releases:D,resources:L.map((g)=>({id:g.id,name:g.name,slug:g.slug,environmentId:g.environmentId,provider:g.provider})),environments:S})}if(f.pathname==="/api/releases/action"&&C.method==="POST"){let S=await v(C),L=_r.releases.get(String(S.id??"")),I=String(S.action??"");if(!L||!Ce(Q,L.resourceId,"deployments:create"))return O({ok:!1,error:"Release was not found in this scope."},404);let D=Re(T.store,Q);try{if(I==="activate")return O({ok:!0,operation:_r.enqueueActivation(L,{actorId:D.id})});if(I==="rollback"){let g=T.store.getResource(L.resourceId);if(S.confirm!==g?.slug)return O({ok:!1,error:`Type "${g?.slug??""}" to confirm rollback.`},409);return O({ok:!0,operation:_r.enqueueRollback(L,{actorId:D.id,targetReleaseId:typeof S.targetReleaseId==="string"?S.targetReleaseId:void 0})})}if(I==="approve"){let g=T.store.listEnvironments(L.projectId).find((X)=>X.id===L.environmentId);if(S.confirm!==g?.slug)return O({ok:!1,error:`Type "${g?.slug??""}" to confirm the environment gate.`},409);return O({ok:!0,release:_r.releases.approve(L.id,{actorId:D.id,decision:S.decision==="rejected"?"rejected":"approved",comment:typeof S.comment==="string"?S.comment:void 0})})}if(I==="pin")return O({ok:!0,release:_r.releases.pin(L.id,S.pinned!==!1,typeof S.reason==="string"?S.reason:void 0)});if(I==="promote"){let g=T.store.getResource(String(S.targetResourceId??"")),X=g?T.store.listEnvironments(L.projectId).find((y)=>y.id===g.environmentId):void 0;if(!g||!X||!Ce(Q,g.id,"deployments:create"))return O({ok:!1,error:"Promotion target was not found in this scope."},404);if(S.confirm!==X.slug)return O({ok:!1,error:`Type "${X.slug}" to confirm promotion.`},409);return O({ok:!0,release:_r.releases.promote(L.id,{targetEnvironmentId:X.id,targetResourceId:g.id,config:S.config&&typeof S.config==="object"?S.config:{},strategy:typeof S.strategy==="string"?S.strategy:void 0,actorId:D.id,approvalRequired:S.approvalRequired===!0})})}return O({ok:!1,error:"Unsupported release action."},422)}catch(g){return O({ok:!1,error:g instanceof Error?g.message:"Release action failed."},409)}}if(f.pathname==="/api/compose"&&C.method==="GET"){let S=ad.applications.list({projectId:T.project.id}).filter((L)=>Ce(Q,L.resourceId,"applications:read")).map((L)=>({...L,services:ad.applications.services(L.id)}));return O({applications:S,templates:zT(),environments:[...T.environments.values()]})}if(f.pathname==="/api/compose/preview"&&C.method==="POST"){let S=await v(C),L=String(S.environmentId??"");if(!zc(Q,L,"applications:manage"))return O({ok:!1,error:"Environment was not found in this scope."},404);try{return O({ok:!0,result:ad.applications.preview(String(S.source??""),{name:String(S.name??""),slug:typeof S.slug==="string"?S.slug:void 0,projectId:T.project.id,environmentId:L})})}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Compose could not be parsed."},422)}}if((f.pathname==="/api/compose/import"||f.pathname==="/api/compose/template")&&C.method==="POST"){let S=await v(C),L=String(S.environmentId??"");if(!zc(Q,L,"applications:manage"))return O({ok:!1,error:"Environment was not found in this scope."},404);let I=Re(T.store,Q);try{let D=f.pathname.endsWith("/template")?ad.applications.fromTemplate(String(S.templateId??""),S.inputs&&typeof S.inputs==="object"?S.inputs:{},{name:String(S.name??""),projectId:T.project.id,environmentId:L,version:typeof S.templateVersion==="string"?S.templateVersion:void 0,createdByActorId:I.id}):ad.applications.import(String(S.source??""),{name:String(S.name??""),slug:typeof S.slug==="string"?S.slug:void 0,projectId:T.project.id,environmentId:L,createdByActorId:I.id});return O({ok:!0,application:D.application,diagnostics:D.parsed.diagnostics})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Compose application could not be saved."},422)}}if(f.pathname==="/api/compose/action"&&C.method==="POST"){let S=await v(C),L=ad.applications.get(String(S.id??"")),I=String(S.action??""),D=I==="delete"||I==="stop"?"deployments:cancel":"deployments:create";if(!L||!Ce(Q,L.resourceId,D))return O({ok:!1,error:"Compose application was not found in this scope."},404);try{let g=Re(T.store,Q);return O({ok:!0,operation:ad.enqueue(L,I,{actorId:g.id,service:typeof S.service==="string"?S.service:void 0,replicas:Number.isFinite(Number(S.replicas))?Number(S.replicas):void 0,removeVolumes:S.removeVolumes===!0,confirmation:typeof S.confirm==="string"?S.confirm:void 0})})}catch(g){return O({ok:!1,error:g instanceof Error?g.message:"Compose operation could not be queued."},409)}}if((f.pathname==="/api/compose/logs"||f.pathname==="/api/compose/shell")&&C.method==="POST"){let S=await v(C),L=ad.applications.get(String(S.id??"")),I=f.pathname.endsWith("/shell"),D=I?"runtime:terminal":"runtime:logs";if(!L||!Ce(Q,L.resourceId,D))return O({ok:!1,error:"Compose service was not found in this scope."},404);let g=String(S.service??"");if(!L.manifest.spec.services[g])return O({ok:!1,error:"Compose service was not found."},404);if(I&&S.confirm!==g)return O({ok:!1,error:`Type "${g}" to run a service command.`},409);let X=T.store.listEnvironments(L.projectId).find((z)=>z.id===L.environmentId)?.slug;if(!X)return O({ok:!1,error:"Compose environment was not found."},404);let y=I?UC(L.manifest,g,Array.isArray(S.command)?S.command.map(String):["sh"]):DC(L.manifest,g,Number(S.lines)||200);return O(await b_(n,X,y))}if(f.pathname==="/api/previews/definitions"&&C.method==="POST"){let S=await v(C),L=String(S.resourceId??"");if(!Ce(Q,L,"config:write"))return O({ok:!1,error:"Application was not found in this scope."},404);let I=Re(T.store,Q);try{return O({ok:!0,definition:pt.previews.createDefinition({...S,projectId:T.project.id,resourceId:L,baseEnvironmentId:String(S.baseEnvironmentId??""),domainPattern:String(S.domainPattern??""),createdByActorId:I.id})})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Preview policy could not be created."},409)}}if(f.pathname==="/api/previews/deploy"&&C.method==="POST"){let S=await v(C),L=pt.previews.getDefinition(String(S.definitionId??""));if(!L||!Ce(Q,L.resourceId,"deployments:create"))return O({ok:!1,error:"Preview policy was not found in this scope."},404);let I=Re(T.store,Q);try{let D=pt.previews.upsert({definitionId:L.id,sourceProvider:"dashboard",repository:"dashboard",branch:String(S.branch??""),pullRequestNumber:Number(S.pullRequestNumber)||void 0,commitSha:String(S.commitSha??""),createdByActorId:I.id});return O({ok:!0,preview:D.preview,operation:pt.enqueueDeploy(D.preview,{created:D.created,actorId:I.id})})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Preview could not be queued."},409)}}if(f.pathname==="/api/previews/destroy"&&C.method==="POST"){let S=await v(C),L=pt.previews.getInstance(String(S.id??""));if(!L||!Ce(Q,L.resourceId,"deployments:cancel"))return O({ok:!1,error:"Preview was not found in this scope."},404);if(S.confirm!==L.name)return O({ok:!1,error:`Type "${L.name}" to confirm tagged teardown.`},409);let I=Re(T.store,Q);return O({ok:!0,operation:pt.enqueueDestroy(L,"dashboard",I.id)})}if(f.pathname==="/api/previews/extend"&&C.method==="POST"){let S=await v(C),L=pt.previews.getInstance(String(S.id??""));if(!L||!Ce(Q,L.resourceId,"deployments:create"))return O({ok:!1,error:"Preview was not found in this scope."},404);return O({ok:!0,preview:pt.previews.extend(L.id,Number(S.hours))})}if(f.pathname==="/api/previews/rebuild"&&C.method==="POST"){let S=await v(C),L=pt.previews.getInstance(String(S.id??""));if(!L||!Ce(Q,L.resourceId,"deployments:create"))return O({ok:!1,error:"Preview was not found in this scope."},404);let I=Re(T.store,Q);return O({ok:!0,operation:pt.enqueueDeploy(L,{actorId:I.id,reason:"manual_rebuild"})})}if(f.pathname==="/api/previews/cleanup"&&C.method==="POST"){let S=await v(C);if(!S.dryRun&&S.confirm!=="cleanup previews")return O({ok:!1,error:'Type "cleanup previews" to confirm teardown.'},409);let L=Re(T.store,Q);return O({ok:!0,...pt.cleanup({dryRun:S.dryRun===!0,maxAgeHours:Number(S.maxAgeHours)||void 0,keepCount:Number(S.keepCount)||void 0,actorId:L.id})})}if(f.pathname==="/api/control-plane/events")return O({events:T.store.listEvents({organizationId:T.organization.id,projectId:T.project.id,operationId:f.searchParams.get("operationId")??void 0,correlationId:f.searchParams.get("correlationId")??void 0,afterSequence:Number(f.searchParams.get("afterSequence"))||void 0,limit:Number(f.searchParams.get("limit"))||200})});if(f.pathname==="/api/search"){let S=String(f.searchParams.get("q")??"").trim().slice(0,128),L=ir.role==="member"?new Set(Object.keys(ir.sites)):void 0,I=S?GR(T.store,{projectId:T.project.id,query:S,allowedResourceSlugs:L,limit:Number(f.searchParams.get("limit"))||20}):[];return O({query:S,results:I,stale:!1})}if(f.pathname==="/api/search/preferences"&&C.method==="GET"){let S=`dashboard:${Q.username.toLowerCase()}`;return O({savedFilters:T.store.listSavedFilters(S),navigation:T.store.listNavigation(S)})}if(f.pathname==="/api/search/preferences"&&C.method==="POST"){let S=`dashboard:${Q.username.toLowerCase()}`,L=await v(C),I=String(L.action??"");if(I==="save-filter")return O({savedFilter:T.store.saveFilter(S,String(L.name??""),String(L.routeId??""),L.query??{})});if(I==="favorite")return O({navigation:T.store.setFavorite(S,String(L.entityType??""),String(L.entityId??""),L.favorite!==!1)});if(I==="visit")return O({navigation:T.store.recordNavigation(S,String(L.entityType??""),String(L.entityId??""))});return O({ok:!1,error:"Unknown search preference action."},422)}if(f.pathname==="/api/search/preferences"&&C.method==="DELETE"){let S=`dashboard:${Q.username.toLowerCase()}`,L=await v(C);return O({ok:T.store.deleteSavedFilter(S,String(L.id??""))})}if(f.pathname==="/api/organization"&&C.method==="GET"){let S=T.store.listMemberships(T.organization.id,{includeRevoked:!0}).map((L)=>{let I=T.store.getActor(L.actorId);return{...L,actor:I?{id:I.id,displayName:I.displayName,externalId:I.externalId,disabledAt:I.disabledAt}:void 0,grants:T.store.listGrants(L.id)}});return O({organization:T.organization,project:T.project,environments:T.store.listEnvironments(T.project.id),resources:T.store.listResources(T.project.id).map((L)=>({id:L.id,environmentId:L.environmentId,kind:L.kind,slug:L.slug,name:L.name})),memberships:S,invitations:T.store.listInvitations(T.organization.id)})}if(f.pathname==="/api/organization/invitations"&&C.method==="GET")return O({invitations:T.store.listInvitations(T.organization.id)});if(f.pathname==="/api/organization/invitations"&&C.method==="POST"){let S=await v(C),L=oh(S.roleTemplate),I=o_(S);if(!L||!I)return O({ok:!1,error:"Choose a valid role template and resource scope."},422);let D=ct(Q);if(!D.actor||!D.membership)return O({ok:!1,error:"Your organization membership is unavailable."},403);if(L==="owner"&&(!Wr(String(S.password??""),Q.passwordHash)||D.membership.roleTemplate!=="owner"))return O({ok:!1,error:"Owner invitations require an owner to re-enter their password."},401);try{let g=T.store.createInvitation({organizationId:T.organization.id,email:String(S.email??""),roleTemplate:L,scope:I,invitedByActorId:D.actor.id,expiresInMs:Number(S.expiresInMs)||void 0}),X=`${f.origin}/accept-invitation?token=${encodeURIComponent(g.token)}`,y=await h_(n,{to:g.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${X}
 
 This link expires ${g.invitation.expiresAt} and can be used once.`});return O({invitation:g.invitation,token:g.token,acceptUrl:X,delivered:y},201)}catch(g){return O({ok:!1,error:g instanceof Error?g.message:"Invitation could not be created."},422)}}if(f.pathname==="/api/organization/invitations"&&C.method==="DELETE"){let S=await v(C),L=ct(Q);try{return O({invitation:T.store.revokeInvitation(String(S.id??""),L.actor?.id)})}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Invitation could not be revoked."},409)}}if(f.pathname==="/api/organization/invitations/resend"&&C.method==="POST"){let S=await v(C),L=ct(Q);try{let I=T.store.reissueInvitation(String(S.id??""),L.actor?.id),D=`${f.origin}/accept-invitation?token=${encodeURIComponent(I.token)}`,g=await h_(n,{to:I.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${D}
 
 This replacement link expires ${I.invitation.expiresAt} and can be used once.`});return O({invitation:I.invitation,token:I.token,acceptUrl:D,delivered:g})}catch(I){return O({ok:!1,error:I instanceof Error?I.message:"Invitation could not be resent."},409)}}if(f.pathname==="/api/organization/memberships"&&C.method==="PATCH"){let S=await v(C),L=T.store.getMembership(String(S.id??"")),I=oh(S.roleTemplate),D=o_(S);if(!L||L.organizationId!==T.organization.id)return O({ok:!1,error:"Membership was not found."},404);if(!I||!D)return O({ok:!1,error:"Choose a valid role template and resource scope."},422);let g=ct(Q);if((L.roleTemplate==="owner"||I==="owner")&&(!Wr(String(S.password??""),Q.passwordHash)||g.membership?.roleTemplate!=="owner"))return O({ok:!1,error:"Ownership changes require an owner to re-enter their password."},401);let y=T.store.resolveAuthorizationTarget(T.organization.id,D)??T.store.resolveAuthorizationTarget(T.organization.id,{type:"project",id:T.project.id}),z=T.store.listGrants(L.id),Y=ln({membership:L,grants:z,target:y}),k={...L,roleTemplate:I,scope:D},$t=ln({membership:k,grants:z,target:y}),Z={gained:$t.filter((_t)=>!Y.includes(_t)),lost:Y.filter((_t)=>!$t.includes(_t))};if(S.preview===!0)return O({membership:L,proposed:{roleTemplate:I,scope:D},accessDiff:Z});if(String(S.confirm??"")!==L.id)return O({ok:!1,error:`Confirm this change with membership ID ${L.id}.`,accessDiff:Z},409);try{return O({membership:T.store.updateMembership({id:L.id,roleTemplate:I,scope:D,actorId:g.actor?.id}),accessDiff:Z})}catch(_t){return O({ok:!1,error:_t instanceof Error?_t.message:"Membership could not be updated."},409)}}if(f.pathname==="/api/organization/memberships"&&C.method==="DELETE"){let S=await v(C),L=T.store.getMembership(String(S.id??""));if(!L||L.organizationId!==T.organization.id)return O({ok:!1,error:"Membership was not found."},404);if(String(S.confirm??"")!==L.id)return O({ok:!1,error:`Confirm removal with membership ID ${L.id}.`},409);let I=ct(Q);if(L.roleTemplate==="owner"&&(I.membership?.roleTemplate!=="owner"||!Wr(String(S.password??""),Q.passwordHash)))return O({ok:!1,error:"Removing an owner requires an owner to re-enter their current password."},401);try{return O({membership:T.store.revokeMembership(L.id,I.actor?.id)})}catch(D){return O({ok:!1,error:D instanceof Error?D.message:"Membership could not be removed."},409)}}if(f.pathname==="/api/organization/grants"&&C.method==="POST"){let S=await v(C),L=String(S.capability??""),I=S.effect==="deny"?"deny":S.effect==="allow"?"allow":void 0,D=o_(S),g=ct(Q);if(!I||!D||!Vr.includes(L))return O({ok:!1,error:"Choose a valid capability, effect, and resource scope."},422);try{return O({grant:T.store.upsertGrant({organizationId:T.organization.id,membershipId:String(S.membershipId??""),effect:I,capability:L,scope:D,actorId:g.actor?.id})},201)}catch(X){return O({ok:!1,error:X instanceof Error?X.message:"Grant could not be created."},422)}}if(f.pathname==="/api/organization/grants"&&C.method==="DELETE"){let S=await v(C),L=ct(Q),I=T.store.getGrant(String(S.id??""));if(!I||I.organizationId!==T.organization.id)return O({ok:!1,error:"Grant was not found."},404);return O({ok:T.store.removeGrant(I.id,L.actor?.id)})}if(f.pathname==="/api/tags"&&C.method==="GET")return O({tags:T.store.listTags(T.project.id),assignments:T.store.listResourceTags(T.project.id)});if(f.pathname==="/api/tags"&&C.method==="POST"){let S=await v(C),L=T.store.upsertTag(T.project.id,String(S.name??""),String(S.color??"#5a8be0"));if(S.resourceId)T.store.assignTag(String(S.resourceId),L.id);return O({tag:L},201)}if(f.pathname==="/api/tags"&&C.method==="DELETE"){let S=await v(C);return T.store.removeTag(String(S.resourceId??""),String(S.tagId??"")),O({ok:!0})}if(f.pathname==="/"&&!ow(f.pathname,ir))return new Response(null,{status:302,headers:{location:`/server/sites?env=${encodeURIComponent(M)}`}});if(f.pathname==="/"&&Kt?.mode==="serverless")return new Response(null,{status:302,headers:{location:`/serverless?env=${encodeURIComponent(M)}`}});let nT=tw(f.pathname);if(nT)return new Response(null,{status:308,headers:{location:`${nT}?env=${encodeURIComponent(M)}`}});if(f.pathname==="/api/env"&&C.method==="POST"){let S=await v(C),L=String(S.env??"");if(!h.includes(L))return O({ok:!1,error:`Unknown environment '${L}'.`,environments:h},404);return O({ok:!0,environment:L,environments:h,href:`?env=${encodeURIComponent(L)}`})}if(f.pathname==="/api/config"){let S={...gJ(n),environment:M,environments:h};return O(rw(S,ir))}if(f.pathname==="/api/ssh-keys"&&C.method==="GET")return O({configPath:N,keys:TE(ac(n))});if(f.pathname==="/api/ssh-keys"&&C.method==="POST"){if(!N)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let S=await v(C),L=await pr(N,"utf8"),I=ac(n),D=Ef({configText:L,name:String(S.name??""),publicKey:String(S.publicKey??""),existingKeys:I});return await nn(N,D),bw(n,[...I,{name:String(S.name??"").trim(),publicKey:String(S.publicKey??"").trim().replace(/\s+/g," ")}]),O({ok:!0,configPath:N,keys:TE(ac(n))})}if(f.pathname==="/api/ssh-keys"&&C.method==="DELETE"){if(!N)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let S=await v(C),L=String(S.name??f.searchParams.get("name")??""),I=await pr(N,"utf8"),D=ac(n),g=nf({configText:I,name:L,existingKeys:D});return await nn(N,g),bw(n,D.filter((X)=>X.name!==L.trim())),O({ok:!0,configPath:N,keys:TE(ac(n))})}if(f.pathname==="/api/firewall"&&C.method==="GET")return O({configPath:N,alwaysOpen:[22,80,443],ports:ru(n)});if(f.pathname==="/api/firewall"&&C.method==="POST"){if(!N)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let S=await v(C),L=Number(S.port);if(!q_(L))return O({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let I=ru(n),D=await pr(N,"utf8");try{await nn(N,iw(D,L,I))}catch(y){return O({ok:!1,error:y?.message??String(y)},422)}let g=En([...I,L]);xw(n,g);let X=S.apply===!1?null:await b_(n,M,`ufw allow ${L}/tcp`).catch((y)=>({ok:!1,error:String(y?.message??y)}));return O({ok:!0,configPath:N,ports:g,apply:X})}if(f.pathname==="/api/firewall"&&C.method==="DELETE"){if(!N)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let S=await v(C),L=Number(S.port??f.searchParams.get("port"));if(!q_(L))return O({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let I=ru(n),D=await pr(N,"utf8");await nn(N,hw(D,L,I));let g=En(I.filter((y)=>y!==L));xw(n,g);let X=S.apply===!1?null:await b_(n,M,`ufw delete allow ${L}/tcp`).catch((y)=>({ok:!1,error:String(y?.message??y)}));return O({ok:!0,configPath:N,ports:g,apply:X})}if(f.pathname==="/api/sites"&&C.method==="POST"){if(!N)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let S=await v(C),L=String(S.name??"").trim(),I=String(S.root??"").trim();if(!L||!I)return O({ok:!1,error:"Site name and root are required."},422);let D={deploy:S.deploy==="bucket"?"bucket":"server",root:I,path:String(S.path??"").trim()||void 0,domain:String(S.domain??"").trim()||void 0,build:String(S.build??"").trim()||void 0,start:String(S.start??"").trim()||void 0,port:S.port?Number(S.port):void 0,type:String(S.type??"").trim()||void 0};if(D.port!==void 0&&(!Number.isInteger(D.port)||D.port<1||D.port>65535))return O({ok:!1,error:"Port must be a number between 1 and 65535."},422);let g=await pr(N,"utf8"),X=$w({configText:g,name:L,root:D.root,domain:D.domain,path:D.path,deploy:D.deploy,build:D.build,start:D.start,port:D.port,type:D.type});return await nn(N,X),OJ(n,L,Object.fromEntries(Object.entries(D).filter(([,y])=>y!==void 0))),Kt=await cn(n,M),u.set(M,Kt),O({ok:!0,configPath:N,site:L,data:Kt})}if(f.pathname==="/api/sites"&&C.method==="DELETE"){if(!N)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let S=await v(C),L=String(S.name??f.searchParams.get("name")??"").trim();if(!L||!n.sites?.[L])return O({ok:!1,error:`Site '${L}' was not found.`},404);let I=await pr(N,"utf8");return await nn(N,yw({configText:I,name:L})),delete n.sites[L],Kt=await cn(n,M),u.set(M,Kt),O({ok:!0,configPath:N,site:L,data:Kt})}if(f.pathname==="/api/sites"&&C.method==="PATCH"){if(!N)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let S=await v(C),L=String(S.name??"").trim(),I=n.sites?.[L];if(!L||!I)return O({ok:!1,error:`Site '${L}' was not found.`},404);if(ir.role==="member"){let X=nw(S);if(!X.ok)return O({ok:!1,error:X.error},403);let y=cw({siteName:L,body:S,sites:n.sites??{},ownSites:Object.keys(ir.sites)});if(!y.ok)return O({ok:!1,error:y.error},409)}if(S.port!==void 0&&S.port!==null&&S.port!==""&&(!Number.isInteger(Number(S.port))||Number(S.port)<1||Number(S.port)>65535))return O({ok:!1,error:"Port must be a number between 1 and 65535."},422);if(typeof S.domain==="string"&&S.domain.trim()&&!mL(S.domain.trim()))return O({ok:!1,error:`Domain '${S.domain.trim()}' is not a valid hostname.`},422);let D=await pr(N,"utf8"),g=(X,y)=>{D=Xw({configText:D,siteName:L,key:X,valueText:y})};if(S.ssl!==void 0)g("ssl",Pw(S.ssl)),I.ssl=S.ssl;if(S.env!==void 0&&S.env&&typeof S.env==="object")g("env",jw(S.env)),I.env=S.env;if(S.aliases!==void 0&&Array.isArray(S.aliases)){let X=S.aliases.map((y)=>String(y));g("aliases",zw(X)),I.aliases=X.map((y)=>y.trim().toLowerCase()).filter(Boolean)}if(S.redirects!==void 0&&S.redirects&&typeof S.redirects==="object")g("redirects",Fw(S.redirects)),I.redirects=S.redirects;for(let X of["domain","path","build","start","type","root","php"])if(typeof S[X]==="string"&&S[X].trim())g(X,aw(String(S[X]).trim())),I[X]=String(S[X]).trim();if(S.port!==void 0&&S.port!==null&&S.port!=="")g("port",String(Number(S.port))),I.port=Number(S.port);return await nn(N,D),Kt=await cn(n,M),u.set(M,Kt),O({ok:!0,configPath:N,site:L,data:Kt})}if(f.pathname==="/api/sites/deploy"&&C.method==="POST"){let S=await v(C),L=String(S.name??"").trim();if(!L||!n.sites?.[L])return O({ok:!1,error:`Site '${L}' was not found.`},404);if(S.confirm!==L)return O({ok:!1,error:`Type "${L}" to deploy this site.`},409);let I=Hr(T,String(M));await new Ic(Ut).run(new Q_,{...I,artifactRoot:e}),Ph(Ut,I,Kt??{});let D=ah(Ut,{scope:I,desiredConfigHash:T.project.desiredConfigHash});if(D.decision.outcome==="block")return O({ok:!1,error:`Deployment blocked by security policy: ${D.decision.explanation}`,securityReview:D},409);let g={id:`deploy:${L}`,label:`Deploy ${L}`,description:`Deploy the ${L} site for ${M}.`,command:["deploy","--env",M,"--site",L,"--yes"],mutates:!0},X=await fd({controlPlane:T,environment:M,actor:Q,kind:"dashboard.site.deploy",resourceSlug:L,input:{site:L},execute:()=>du(g,{cwd:e,cliEntry:E})});return O({...X.result,controlPlaneOperation:X.operation,securityReview:D})}if(f.pathname==="/api/actions")return O(eg(M));if(f.pathname==="/api/server/operations")return O(kh(n,Kt));if(f.pathname==="/api/runtime/workloads"&&C.method==="GET"){let S=await Br(n,M);return O(S)}if(f.pathname==="/api/runtime/logs"&&C.method==="GET"){let S=String(f.searchParams.get("workload")??"");if(!S)return O({ok:!1,error:"A workload query parameter is required."},422);let L=Math.min(1000,Math.max(1,Number(f.searchParams.get("limit"))||200));try{return O(await new or(n,M).logs(S,{limit:L}))}catch(I){return O({ok:!1,error:String(I?.message??I)},404)}}if(f.pathname==="/api/runtime/log-sessions"&&C.method==="POST"){let S=await v(C),L=String(S.workloadId??"");if(!L)return O({ok:!1,error:"A workloadId is required."},422);let I=await Br(n,M),D=I.workloads.find((y)=>y.id===L);if(!D)return O({ok:!1,error:"Workload was not found in the current project and environment."},404);if(!D.capabilities.logs.supported)return O({ok:!1,error:D.capabilities.logs.reason??"Logs are unsupported for this workload."},409);let g=new or(n,M,{inventory:async()=>I}),X=Ee.create("logs",L);return(async()=>{let y=new Date(Date.now()-Math.min(3600000,Math.max(1000,Number(S.sinceMs)||60000)));try{for(let z=0;z<200&&!Ee.signal(X.id)?.aborted;z++){let Y=await g.logs(L,{limit:Math.min(500,Math.max(1,Number(S.limit)||200)),since:y});for(let k of Y.lines)if(Ee.append(X.id,`${k.timestamp?`${k.timestamp} `:""}${k.message}
 `),k.timestamp)y=new Date(Math.max(y.getTime(),new Date(k.timestamp).getTime()+1));await Bun.sleep(3000)}if(!Ee.signal(X.id)?.aborted)Ee.close(X.id,"complete")}catch(z){Ee.append(X.id,z instanceof Error?z.message:String(z),"stderr"),Ee.close(X.id,"failed",z instanceof Error?z.message:String(z))}})(),O({ok:!0,session:X,streamUrl:`/api/runtime/log-stream?id=${encodeURIComponent(X.id)}&workload=${encodeURIComponent(L)}`},201)}if((f.pathname==="/api/runtime/log-stream"||f.pathname==="/api/runtime/exec-stream")&&C.method==="GET"){let S=String(f.searchParams.get("id")??""),L=String(f.searchParams.get("workload")??""),I=Number(C.headers.get("last-event-id")??f.searchParams.get("after")??0)||0,D=Ee.read(S,L,I),g=f.pathname.includes("exec")?"exec":"logs";if(!D||D.kind!==g)return O({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return TJ(Ee,D,I,C.signal)}if((f.pathname==="/api/runtime/log-sessions"||f.pathname==="/api/runtime/exec-sessions")&&C.method==="DELETE"){let S=await v(C),L=Ee.cancel(String(S.id??""),String(S.workloadId??""));if(!L)return O({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return O({ok:!0,session:L})}if(f.pathname==="/api/runtime/exec-sessions"&&C.method==="POST"){let S=await v(C),L=String(S.workloadId??""),I=await Br(n,M),D=I.workloads.find((z)=>z.id===L);if(!D)return O({ok:!1,error:"Workload was not found in the current project and environment."},404);let g=bt.resolveSession(C),X=new or(n,M,{inventory:async()=>I}),y=Ee.create("exec",L);return fd({controlPlane:T,environment:M,actor:Q,kind:"runtime.exec",resourceSlug:D.links.service,input:{workloadId:L,provider:D.provider,preset:S.preset?String(S.preset):null,freeForm:!!String(S.command??"").trim()},execute:()=>X.exec({workloadId:L,preset:["process","sockets","filesystem"].includes(String(S.preset))?String(S.preset):void 0,command:typeof S.command==="string"?S.command:void 0,confirm:String(S.confirm??""),recentAuth:!o||!!g&&b.isRecentlyAuthenticated(g)})}).then(({result:z,operation:Y})=>{if(Ee.append(y.id,`operation ${Y.id}
-`,"system"),z.stdout)Ee.append(y.id,z.stdout,"stdout");if(z.stderr)Ee.append(y.id,z.stderr,"stderr");Ee.close(y.id,z.ok?"complete":"failed",z.error)}).catch((z)=>{let Y=z instanceof Error?z.message:String(z);Ee.append(y.id,Y,"stderr"),Ee.close(y.id,"failed",Y)}),O({ok:!0,session:y,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(y.id)}&workload=${encodeURIComponent(L)}`},202)}if(f.pathname==="/api/runtime/files/read"&&C.method==="POST"){let S=await v(C),L=await Br(n,M),I=bt.resolveSession(C),D=await new or(n,M,{inventory:async()=>L}).readFile({workloadId:String(S.workloadId??""),path:String(S.path??""),confirm:String(S.confirm??""),recentAuth:!o||!!I&&b.isRecentlyAuthenticated(I)});return O(D,D.ok?200:409)}if(f.pathname==="/api/runtime/files/write"&&C.method==="POST"){let S=await v(C),L=await Br(n,M),I=String(S.workloadId??""),D=L.workloads.find((z)=>z.id===I);if(!D)return O({ok:!1,error:"Workload was not found in the current project and environment."},404);let g=bt.resolveSession(C),X=new or(n,M,{inventory:async()=>L}),y=await fd({controlPlane:T,environment:M,actor:Q,kind:"runtime.file.write",resourceSlug:D.links.service,input:{workloadId:I,provider:D.provider,path:String(S.path??""),bytes:Buffer.from(String(S.contentBase64??""),"base64").byteLength},execute:()=>X.writeFile({workloadId:I,path:String(S.path??""),contentBase64:String(S.contentBase64??""),confirm:String(S.confirm??""),recentAuth:!o||!!g&&b.isRecentlyAuthenticated(g)})});return O({...y.result,controlPlaneOperation:y.operation},y.result.ok?200:409)}if(f.pathname==="/api/runtime/operations"&&C.method==="POST"){let S=await v(C),L=String(S.workloadId??""),I=String(S.action??"");if(!L||!["start","stop","restart","redeploy","scale","inspect"].includes(I))return O({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let D=await Br(n,M),g=D.workloads.find((Y)=>Y.id===L);if(!g)return O({ok:!1,error:"Workload was not found in the current project and environment."},404);let X=bt.resolveSession(C),y=new or(n,M,{inventory:async()=>D}),z=await fd({controlPlane:T,environment:M,actor:Q,kind:`runtime.${I}`,resourceSlug:g.links.service,input:{workloadId:L,provider:g.provider,action:I,replicas:S.replicas==null?null:Number(S.replicas)},execute:()=>y.run({workloadId:L,action:I,replicas:S.replicas==null?void 0:Number(S.replicas),confirm:String(S.confirm??""),recentAuth:!o||!!X&&b.isRecentlyAuthenticated(X)})});return O({...z.result,controlPlaneOperation:z.operation},z.result.ok?200:409)}if(f.pathname.startsWith("/api/health/")||f.pathname.startsWith("/api/alerts")||f.pathname.startsWith("/api/notifications/")){let S=T.environments.get(M),L=T.store.listResources(T.project.id,S?.id),I=Q.role==="admin"||!!S&&zc(Q,S.id,"runtime:read")?L:L.filter((y)=>Oe(Q,y.id,"runtime:read")),D=(y)=>!y||I.some((z)=>z.id===y),g=(y)=>{if(!y)return;let z=L.find((Y)=>Y.id===y||Y.slug===y);if(!z)throw Error("Alert resource was not found.");if(!D(z.id))throw Error("Alert resource is outside your authorized scope.");return z.id},X=ct(Q).actor;if(f.pathname==="/api/health/checks"&&C.method==="GET")return O({ok:!0,checks:ut.listHealthChecks(T.project.id,S?.id).filter((y)=>D(y.resourceId)).map((y)=>({...y,results:ut.listHealthResults(y.id,20)}))});if(f.pathname==="/api/health/checks"&&C.method==="POST"){let y=await v(C),z=String(y.kind??"http");if(z==="command"&&Q.role!=="admin")return O({ok:!1,error:"Command health checks require an administrator."},403);let Y={method:String(y.config?.method??"GET").toUpperCase().slice(0,10),path:y.config?.path?String(y.config.path).slice(0,500):void 0,port:y.config?.port==null?void 0:Number(y.config.port),command:Array.isArray(y.config?.command)?y.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(y.config?.expectedStatuses)?y.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:y.config?.expectedBody?String(y.config.expectedBody).slice(0,500):void 0};return O({ok:!0,check:ut.createHealthCheck({projectId:T.project.id,environmentId:S?.id,resourceId:g(y.resourceId??y.resource),name:String(y.name??""),kind:z,target:String(y.target??""),config:Y,intervalSeconds:Number(y.intervalSeconds)||60,timeoutSeconds:Number(y.timeoutSeconds)||10,failureThreshold:Number(y.failureThreshold)||3,recoveryThreshold:Number(y.recoveryThreshold)||2,regions:Array.isArray(y.regions)?y.regions.map(String):["local"],enabled:y.enabled!==!1})},201)}if(f.pathname==="/api/health/checks"&&C.method==="PATCH"){let y=await v(C),z=ut.getHealthCheck(String(y.id??""));if(!z||!D(z.resourceId))return O({ok:!1,error:"Health check was not found."},404);return O({ok:!0,check:ut.setHealthCheckEnabled(z.id,y.enabled!==!1)})}if(f.pathname==="/api/health/checks/test"&&C.method==="POST"){let y=await v(C),z=ut.getHealthCheck(String(y.id??""));if(!z||!D(z.resourceId))return O({ok:!1,error:"Health check was not found."},404);return O({ok:!0,productionIncidentCreated:!1,result:await new DE(ut).probe(z)})}if(f.pathname==="/api/health/checks/run"&&C.method==="POST"){let y=await v(C),z=ut.getHealthCheck(String(y.id??""));if(!z||!D(z.resourceId))return O({ok:!1,error:"Health check was not found."},404);let Y=await new DE(ut).runAndEvaluate(z),k=[];for(let $t of Y.evaluations.filter((Z)=>Z.notify&&Z.alert)){let Z=Tr.enqueue(T.organization.id,$t.alert,$t.transition);k.push(...await Tr.deliverAll(Z))}return O({ok:!0,...Y,deliveries:k})}if(f.pathname==="/api/alerts/rules"&&C.method==="GET")return O({ok:!0,rules:ut.listRules(T.project.id,S?.id).filter((y)=>D(y.resourceId))});if(f.pathname==="/api/alerts/rules"&&C.method==="POST"){let y=await v(C),z=y.healthCheckId?ut.getHealthCheck(String(y.healthCheckId)):void 0;if(y.healthCheckId&&(!z||!D(z.resourceId)))return O({ok:!1,error:"Health check was not found."},404);return O({ok:!0,rule:ut.createRule({projectId:T.project.id,environmentId:S?.id,resourceId:g(y.resourceId??y.resource)??z?.resourceId,healthCheckId:z?.id,name:String(y.name??""),signal:String(y.signal??(z?"health":"")),operator:String(y.operator??(z?"unhealthy":"gt")),threshold:y.threshold==null?void 0:Number(y.threshold),recoveryThreshold:y.recoveryThreshold==null?void 0:Number(y.recoveryThreshold),windowMs:Number(y.windowMs)||300000,consecutive:Number(y.consecutive)||z?.failureThreshold||3,recoveryConsecutive:Number(y.recoveryConsecutive)||z?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(y.noDataPolicy))?y.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(y.severity))?y.severity:"warning",groupBy:Array.isArray(y.groupBy)?y.groupBy.map(String):[],labels:y.labels&&typeof y.labels==="object"?y.labels:{},enabled:y.enabled!==!1})},201)}if(f.pathname==="/api/alerts/rules"&&C.method==="PATCH"){let y=await v(C),z=ut.getRule(String(y.id??""));if(!z||!D(z.resourceId))return O({ok:!1,error:"Alert rule was not found."},404);return O({ok:!0,rule:ut.setRuleEnabled(z.id,y.enabled!==!1)})}if(f.pathname==="/api/alerts/evaluate"&&C.method==="POST")return O({ok:!0,...await Nu(S?.id)});if(f.pathname==="/api/alerts"&&C.method==="GET")return O({ok:!0,alerts:ut.listAlerts(T.project.id,{environmentId:S?.id,states:f.searchParams.getAll("state").length?f.searchParams.getAll("state"):void 0,limit:Number(f.searchParams.get("limit"))||200}).filter((y)=>D(y.resourceId)).map((y)=>({...y,deliveries:ut.listDeliveries({alertId:y.id,limit:50})}))});if(f.pathname==="/api/alerts/action"&&C.method==="POST"){let y=await v(C),z=ut.getAlert(String(y.id??""));if(!z||!D(z.resourceId))return O({ok:!1,error:"Alert was not found."},404);let Y=String(y.action??"");if(Y==="acknowledge")return O({ok:!0,alert:ut.acknowledge(z.id,X?.id??"")});if(Y==="assign")return O({ok:!0,alert:ut.assign(z.id,y.ownerActorId==="me"?X?.id:y.ownerActorId?String(y.ownerActorId):void 0,X?.id)});if(Y==="silence"){if(Q.role!=="admin")return O({ok:!1,error:"Silencing production alerts requires an administrator."},403);let k=bt.resolveSession(C);if(o&&(!k||!b.isRecentlyAuthenticated(k)))return O({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return O({ok:!0,alert:ut.silenceAlert(z.id,String(y.until??""),X?.id)})}return O({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(f.pathname==="/api/alerts/silences"&&C.method==="POST"){let y=await v(C);return O({ok:!0,id:ut.createSilence({projectId:T.project.id,environmentId:S?.id,resourceId:g(y.resourceId??y.resource),matcher:y.matcher,reason:String(y.reason??""),startsAt:String(y.startsAt??new Date().toISOString()),endsAt:String(y.endsAt??""),timezone:String(y.timezone??"UTC"),actorId:X?.id})},201)}if(f.pathname==="/api/notifications/channels"&&C.method==="GET")return O({ok:!0,channels:ut.listChannels(T.organization.id)});if(f.pathname==="/api/notifications/channels"&&C.method==="POST"){let y=await v(C),z=String(y.kind??""),Y=z==="email"?{to:y.config?.to,from:y.config?.from}:z==="telegram"?{chatId:String(y.config?.chatId??"")}:{};return O({ok:!0,channel:ut.createChannel({organizationId:T.organization.id,name:String(y.name??""),kind:z,config:Y,credential:y.credential?String(y.credential):void 0,actorId:X?.id})},201)}if(f.pathname==="/api/notifications/channels"&&C.method==="PATCH"){let y=await v(C),z=String(y.id??"");if(y.credential)return O({ok:!0,channel:ut.rotateChannel(z,String(y.credential))});let Y=String(y.status??"paused");if(!["active","paused","disabled"].includes(Y))return O({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return O({ok:!0,channel:ut.setChannelStatus(z,Y)})}if(f.pathname==="/api/notifications/channels/test"&&C.method==="POST"){let y=await v(C);return O({ok:!0,productionIncidentCreated:!1,result:await Tr.testChannel(String(y.id??""))})}if(f.pathname==="/api/notifications/routes"&&C.method==="GET")return O({ok:!0,routes:ut.listRoutes(T.organization.id)});if(f.pathname==="/api/notifications/routes"&&C.method==="POST"){let y=await v(C),z=Array.isArray(y.channelIds)?y.channelIds.map(String):[];if(z.some((Y)=>ut.getChannel(Y)?.organizationId!==T.organization.id))return O({ok:!1,error:"Route contains an unavailable channel."},422);return O({ok:!0,route:ut.createRoute({organizationId:T.organization.id,name:String(y.name??""),priority:Number(y.priority)||0,matcher:y.matcher&&typeof y.matcher==="object"?y.matcher:{},channelIds:z,quietHours:y.quietHours,groupWaitSeconds:Number(y.groupWaitSeconds)||30,reminderSeconds:y.reminderSeconds==null?void 0:Number(y.reminderSeconds),escalation:Array.isArray(y.escalation)?y.escalation:[],template:y.template?String(y.template):void 0,rateLimitPerMinute:Number(y.rateLimitPerMinute)||60,enabled:y.enabled!==!1})},201)}if(f.pathname==="/api/notifications/routes"&&C.method==="PATCH"){let y=await v(C),z=ut.getRoute(String(y.id??""));if(!z||z.organizationId!==T.organization.id)return O({ok:!1,error:"Notification route was not found."},404);return O({ok:!0,route:ut.setRouteEnabled(z.id,y.enabled!==!1)})}if(f.pathname==="/api/notifications/routes/preview"&&C.method==="POST"){let y=await v(C),Y=(y.alertId?ut.getAlert(String(y.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:T.project.id,environmentId:S?.id,resourceId:g(y.resourceId??y.resource),dedupKey:"preview",groupKey:String(y.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(y.severity))?y.severity:"warning",title:String(y.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return O({ok:!0,productionIncidentCreated:!1,matches:Tr.preview(T.organization.id,Y,String(y.eventType??"firing")).map((k)=>({route:k.route,channels:k.channels,quiet:k.quiet}))})}if(f.pathname==="/api/notifications/deliveries"&&C.method==="GET")return O({ok:!0,deliveries:ut.listDeliveries({alertId:f.searchParams.get("alertId")??void 0,states:f.searchParams.getAll("state"),limit:Number(f.searchParams.get("limit"))||200})});if(f.pathname==="/api/notifications/deliveries/retry"&&C.method==="POST"){let y=await v(C),z=ut.getDelivery(String(y.id??""));if(!z)return O({ok:!1,error:"Delivery was not found."},404);return ut.updateDelivery(z.id,{state:"retrying",attempt:Math.max(0,z.attempt-1),nextAttemptAt:new Date().toISOString()}),O({ok:!0,delivery:await Tr.deliver(z.id)})}}if(f.pathname.startsWith("/api/jobs")||f.pathname.startsWith("/api/workers")){let S=T.environments.get(M),L=T.store.listResources(T.project.id,S?.id),D=Q.role==="admin"||!!S&&zc(Q,S.id,"automation:read")?L:L.filter((G)=>Oe(Q,G.id,"automation:read")),g=(G)=>!G||D.some((et)=>et.id===G),X=ct(Q).actor,y=u.get(M)??A,z=kh(n,y),Y=z.filter((G)=>!G.danger&&["scheduler","backup","worker"].includes(G.group)),k=dd(n),$t=()=>{let G=bt.resolveSession(C);return!o||!!G&&b.isRecentlyAuthenticated(G)},Z=(G)=>{if(!G||typeof G!=="object"||Array.isArray(G))return{};let et=Object.entries(G).slice(0,50);if(et.some(([,Ct])=>typeof Ct!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(Ct)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(et)},_t=(G,et,Ct)=>T.store.appendEvent({organizationId:T.organization.id,projectId:T.project.id,resourceId:Ct,actorId:X?.id,type:`job.${G}`,payload:et});if(f.pathname==="/api/jobs/preview"&&C.method==="POST"){let G=await v(C);try{return O({ok:!0,productionExecutionCreated:!1,preview:JE(String(G.expression??""),String(G.timezone??"UTC"),new Date(G.from?String(G.from):Date.now()),Number(G.count)||5)})}catch(et){return O({ok:!1,error:et instanceof Error?et.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(f.pathname==="/api/jobs"&&C.method==="GET")return O({ok:!0,jobs:ue.list(T.project.id,{environmentId:S?.id}).filter((G)=>g(G.resourceId)).map((G)=>({...G,preview:JE(G.normalizedExpression,G.timezone,new Date,5),capability:qS(G),lastExecution:ue.listExecutions(G.id,1)[0]}))});if(f.pathname==="/api/jobs"&&C.method==="POST"){let G=await v(C),et=String(G.provider??(k==="serverless"?"eventbridge":"server")),Ct=k==="serverless"?"eventbridge":"server";if(et!==Ct)return O({ok:!1,error:`${k} environments accept ${Ct} schedules through this adapter.`},422);let wt=G.operationId?String(G.operationId):void 0;if(et==="server"&&(!wt||!Y.some((ne)=>ne.id===wt)))return O({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let Bt=qS({provider:et,expression:String(G.expression??""),flexibleMinutes:Number(G.flexibleMinutes)||0,missedRunPolicy:G.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(G.overlapPolicy))?G.overlapPolicy:"forbid"});if(!Bt.supported)return O({ok:!1,error:Bt.notes.join(" ")},422);let me=G.resourceId?L.find((ne)=>ne.id===G.resourceId||ne.slug===G.resourceId):void 0;if(G.resourceId&&(!me||!g(me.id)))return O({ok:!1,error:"Job resource was not found."},404);try{let ne=et==="server"?{kind:"dashboard_operation",operationId:wt}:{kind:"serverless_scheduler",action:"run"},zd=ue.create({organizationId:T.organization.id,projectId:T.project.id,environmentId:S?.id,resourceId:me?.id,name:String(G.name??""),provider:et,expression:String(G.expression??""),timezone:String(G.timezone??"UTC"),startsAt:G.startsAt?String(G.startsAt):void 0,endsAt:G.endsAt?String(G.endsAt):void 0,flexibleMinutes:Number(G.flexibleMinutes)||0,target:ne,payloadRefs:Z(G.payloadRefs),missedRunPolicy:G.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(G.overlapPolicy))?G.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(G.maxAttempts)||3,backoffSeconds:Number(G.backoffSeconds)||30,deadLetterRef:G.deadLetterRef?String(G.deadLetterRef):void 0},timeoutSeconds:Number(G.timeoutSeconds)||900,enabled:G.enabled!==!1,origin:"managed",ownerActorId:X?.id,observedState:{},reconciliationStatus:"pending"});return _t("created",{jobId:zd.id,provider:zd.provider,expression:zd.normalizedExpression},zd.resourceId),O({ok:!0,job:zd,capability:Bt},201)}catch(ne){return O({ok:!1,error:ne instanceof Error?ne.message:"Scheduled job could not be created."},422)}}if(f.pathname==="/api/jobs"&&C.method==="PATCH"){let G=await v(C),et=ue.get(String(G.id??""));if(!et||!g(et.resourceId))return O({ok:!1,error:"Scheduled job was not found."},404);if(et.origin==="config")return O({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let Ct=G.missedRunPolicy==null?void 0:String(G.missedRunPolicy),wt=G.overlapPolicy==null?void 0:String(G.overlapPolicy);if(Ct&&!["skip","catch_up"].includes(Ct))return O({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(wt&&!["allow","forbid","replace"].includes(wt))return O({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let Bt=ue.updateSchedule(et.id,{expression:G.expression?String(G.expression):void 0,timezone:G.timezone?String(G.timezone):void 0,missedRunPolicy:Ct,overlapPolicy:wt,timeoutSeconds:G.timeoutSeconds==null?void 0:Number(G.timeoutSeconds)});return _t("updated",{jobId:Bt.id,expression:Bt.normalizedExpression,version:Bt.version},Bt.resourceId),O({ok:!0,job:Bt})}catch(Bt){return O({ok:!1,error:Bt instanceof Error?Bt.message:"Scheduled job could not be updated."},422)}}if(f.pathname==="/api/jobs/action"&&C.method==="POST"){let G=await v(C),et=ue.get(String(G.id??""));if(!et||!g(et.resourceId))return O({ok:!1,error:"Scheduled job was not found."},404);let Ct=String(G.action??"");if(Ct==="run"){let wt=Su.enqueue(et,{trigger:"manual",actorId:X?.id});return _t("run_queued",{jobId:et.id,executionId:wt.id},et.resourceId),O({ok:!0,execution:wt},202)}if(["disable","delete"].includes(Ct)&&S?.kind==="production"){if(String(G.confirm??"")!==Ct)return O({ok:!1,error:`Type "${Ct}" to confirm this production change.`},409);if(!$t())return O({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(Ct==="enable"||Ct==="disable"){let wt=ue.setEnabled(et.id,Ct==="enable");return _t(Ct==="enable"?"enabled":"disabled",{jobId:et.id},et.resourceId),O({ok:!0,job:wt})}if(Ct==="delete")try{return ue.remove(et.id),_t("deleted",{jobId:et.id,name:et.name},et.resourceId),O({ok:!0,deleted:et.id})}catch(wt){return O({ok:!1,error:wt instanceof Error?wt.message:"Scheduled job could not be deleted."},409)}return O({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(f.pathname==="/api/jobs/history"&&C.method==="GET"){let G=ue.get(String(f.searchParams.get("jobId")??""));if(!G||!g(G.resourceId))return O({ok:!1,error:"Scheduled job was not found."},404);return O({ok:!0,executions:ue.listExecutions(G.id,Number(f.searchParams.get("limit"))||100).map((et)=>({...et,logs:et.operationId?st.logs(et.operationId,{limit:500}):[]}))})}if(f.pathname==="/api/jobs/reconcile"&&C.method==="POST"){if(!S)return O({ok:!1,error:"Environment was not found."},404);let G=sS(ue,n,{organization:T.organization,project:T.project,environment:S,resources:L});return _t("reconciled",G),O({ok:!0,reconciliation:G})}if(f.pathname==="/api/workers"&&C.method==="GET"){let G=Array.isArray(y.workersDetail??y.workers)?y.workersDetail??y.workers:[];return O({ok:!0,workers:ue.listWorkers(T.project.id,S?.id).filter((et)=>g(et.resourceId)).map((et)=>{let Ct=G.find((wt)=>wt.name===et.name||wt.site===et.target.site);return Ct?{...et,observedState:{...et.observedState,status:Ct.status??"configured",currentJob:Ct.currentJob??null,failures:Number(Ct.failed??Ct.failures)||0,processed:Number(Ct.processed)||0}}:et})})}if(f.pathname==="/api/workers/action"&&C.method==="POST"){let G=await v(C),et=ue.getWorker(String(G.id??""));if(!et||!g(et.resourceId))return O({ok:!1,error:"Worker was not found."},404);let Ct=String(G.action??"");if(Ct==="restart"){if(String(G.confirm??"")!==et.name)return O({ok:!1,error:`Type "${et.name}" to restart this worker.`},409);let wt=z.find((ne)=>ne.id===et.target.operationId);if(!wt)return O({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let Bt=await bh(n,M,wt),me=ue.reconcileWorker(et.id,Bt.ok?"in_sync":"unavailable",{...et.observedState,lastRestartAt:new Date().toISOString(),command:Bt.command??null,error:Bt.error??Bt.stderr??null});return _t("worker_restarted",{workerId:et.id,ok:Bt.ok},et.resourceId),O({...Bt,worker:me},Bt.ok?200:409)}if(Ct==="scale")return O({ok:!1,error:et.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return O({ok:!1,error:"Action must be restart or scale."},422)}}if(f.pathname.startsWith("/api/telemetry/")){let S=T.environments.get(M),L=new UE(T.store),I=T.store.listResources(T.project.id,S?.id),D=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(f.pathname)?"runtime:logs":"runtime:read",g=Q.role==="admin"||!!S&&zc(Q,S.id,D),X=g?I:I.filter((Z)=>Oe(Q,Z.id,D)),y=(Z)=>Hw(X,g,Z),z=(Z)=>{let _t=new Date,G={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},et=String(Z.to??_t.toISOString()),Ct=String(Z.from??new Date(new Date(et).getTime()-(G[String(Z.range??"1h")]??G["1h"])).toISOString()),wt=(me)=>{let ne=(Array.isArray(me)?me:String(me??"").split(",")).map(String).filter(Boolean);return ne.length?ne:void 0},Bt=wt(Z.kinds)?.filter((me)=>["metric","log","trace","request","event"].includes(me));return{projectId:T.project.id,environmentId:S?.id,resourceIds:y(Z.resources),kinds:Bt,names:wt(Z.names),sources:wt(Z.sources),levels:wt(Z.levels),from:Ct,to:et,text:String(Z.text??"")||void 0,traceId:String(Z.traceId??"")||void 0,requestId:String(Z.requestId??"")||void 0,deploymentId:String(Z.deploymentId??"")||void 0,releaseId:String(Z.releaseId??"")||void 0,workloadId:String(Z.workloadId??"")||void 0,cursor:String(Z.cursor??"")||void 0,limit:Number(Z.limit)||void 0}},Y=Object.fromEntries(f.searchParams.entries()),k=(Z=!1)=>eu({controlPlane:T.store,projectId:T.project.id,environmentId:S?.id,config:n,environment:M,force:Z,lightweight:!Z}),$t=()=>{let Z=T.store.getSetting(`telemetry.collection:${T.project.id}:${S?.id??"all"}`)??{};return{generatedAt:String(Z.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(Z.statuses)?Z.statuses:[],errors:Array.isArray(Z.errors)?Z.errors:[],policy:Z.policy??Dn(T.store,T.project.id)}};if(f.pathname==="/api/telemetry/status"&&C.method==="GET"){k(!1);let Z=$t(),_t=g?Z.statuses:L.status(T.project.id,S?.id,Z.policy.rawDays,Z.policy.samplingRate,X.map((et)=>et.id)),G=_t.reduce((et,Ct)=>et+Ct.estimatedDailyBytes*30,0);return O({ok:!0,generatedAt:Z.generatedAt,cached:Z.cached,sources:_t,errors:g?Z.errors:[],policy:Z.policy,retention:{rawDays:Z.policy.rawDays,downsampleAfterDays:Z.policy.downsampleAfterDays,downsampleBucketMs:Z.policy.downsampleBucketMs,maxRecords:Z.policy.maxRecords},estimatedMonthlyBytes:G,estimatedMonthlyCostUsd:_C(G,Z.policy),costEstimateConfigured:Z.policy.estimatedStorageUsdPerGbMonth>0})}if(f.pathname==="/api/telemetry/settings"&&C.method==="GET")return O({ok:!0,policy:Dn(T.store,T.project.id)});if(f.pathname==="/api/telemetry/settings"&&C.method==="PATCH"){let Z=cC(T.store,T.project.id,await v(C));return Gw(T.project.id),O({ok:!0,policy:Z})}if(f.pathname==="/api/telemetry/query"&&C.method==="GET"){k(!1);let Z=$t();return O({ok:!0,collection:{generatedAt:Z.generatedAt,cached:Z.cached},...L.query(z(Y))})}if(f.pathname==="/api/telemetry/tail"&&C.method==="GET"){k(!1);let Z=new TextEncoder,_t=new Date,G=z({...Y,kinds:Y.kinds||"log,request,event,trace",from:Y.from||new Date(_t.getTime()-120000).toISOString(),to:_t.toISOString(),limit:Math.min(1000,Number(Y.limit)||200),cursor:void 0}),et=C.headers.get("last-event-id")||String(Y.cursor??"")||void 0,Ct,wt=!1,Bt=!1,me=new ReadableStream({start(ne){let zd=()=>{if(wt)return;if(wt=!0,Ct)clearInterval(Ct);C.signal.removeEventListener("abort",zd);try{ne.close()}catch{}},wu=async()=>{if(wt||Bt)return;Bt=!0;try{let LE=L.tail({...G,to:new Date(Date.now()+1000).toISOString()},et);for(let gu of LE.records)et=jT(gu)??et,ne.enqueue(Z.encode(`id: ${et??""}
+`,"system"),z.stdout)Ee.append(y.id,z.stdout,"stdout");if(z.stderr)Ee.append(y.id,z.stderr,"stderr");Ee.close(y.id,z.ok?"complete":"failed",z.error)}).catch((z)=>{let Y=z instanceof Error?z.message:String(z);Ee.append(y.id,Y,"stderr"),Ee.close(y.id,"failed",Y)}),O({ok:!0,session:y,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(y.id)}&workload=${encodeURIComponent(L)}`},202)}if(f.pathname==="/api/runtime/files/read"&&C.method==="POST"){let S=await v(C),L=await Br(n,M),I=bt.resolveSession(C),D=await new or(n,M,{inventory:async()=>L}).readFile({workloadId:String(S.workloadId??""),path:String(S.path??""),confirm:String(S.confirm??""),recentAuth:!o||!!I&&b.isRecentlyAuthenticated(I)});return O(D,D.ok?200:409)}if(f.pathname==="/api/runtime/files/write"&&C.method==="POST"){let S=await v(C),L=await Br(n,M),I=String(S.workloadId??""),D=L.workloads.find((z)=>z.id===I);if(!D)return O({ok:!1,error:"Workload was not found in the current project and environment."},404);let g=bt.resolveSession(C),X=new or(n,M,{inventory:async()=>L}),y=await fd({controlPlane:T,environment:M,actor:Q,kind:"runtime.file.write",resourceSlug:D.links.service,input:{workloadId:I,provider:D.provider,path:String(S.path??""),bytes:Buffer.from(String(S.contentBase64??""),"base64").byteLength},execute:()=>X.writeFile({workloadId:I,path:String(S.path??""),contentBase64:String(S.contentBase64??""),confirm:String(S.confirm??""),recentAuth:!o||!!g&&b.isRecentlyAuthenticated(g)})});return O({...y.result,controlPlaneOperation:y.operation},y.result.ok?200:409)}if(f.pathname==="/api/runtime/operations"&&C.method==="POST"){let S=await v(C),L=String(S.workloadId??""),I=String(S.action??"");if(!L||!["start","stop","restart","redeploy","scale","inspect"].includes(I))return O({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let D=await Br(n,M),g=D.workloads.find((Y)=>Y.id===L);if(!g)return O({ok:!1,error:"Workload was not found in the current project and environment."},404);let X=bt.resolveSession(C),y=new or(n,M,{inventory:async()=>D}),z=await fd({controlPlane:T,environment:M,actor:Q,kind:`runtime.${I}`,resourceSlug:g.links.service,input:{workloadId:L,provider:g.provider,action:I,replicas:S.replicas==null?null:Number(S.replicas)},execute:()=>y.run({workloadId:L,action:I,replicas:S.replicas==null?void 0:Number(S.replicas),confirm:String(S.confirm??""),recentAuth:!o||!!X&&b.isRecentlyAuthenticated(X)})});return O({...z.result,controlPlaneOperation:z.operation},z.result.ok?200:409)}if(f.pathname.startsWith("/api/health/")||f.pathname.startsWith("/api/alerts")||f.pathname.startsWith("/api/notifications/")){let S=T.environments.get(M),L=T.store.listResources(T.project.id,S?.id),I=Q.role==="admin"||!!S&&zc(Q,S.id,"runtime:read")?L:L.filter((y)=>Ce(Q,y.id,"runtime:read")),D=(y)=>!y||I.some((z)=>z.id===y),g=(y)=>{if(!y)return;let z=L.find((Y)=>Y.id===y||Y.slug===y);if(!z)throw Error("Alert resource was not found.");if(!D(z.id))throw Error("Alert resource is outside your authorized scope.");return z.id},X=ct(Q).actor;if(f.pathname==="/api/health/checks"&&C.method==="GET")return O({ok:!0,checks:ut.listHealthChecks(T.project.id,S?.id).filter((y)=>D(y.resourceId)).map((y)=>({...y,results:ut.listHealthResults(y.id,20)}))});if(f.pathname==="/api/health/checks"&&C.method==="POST"){let y=await v(C),z=String(y.kind??"http");if(z==="command"&&Q.role!=="admin")return O({ok:!1,error:"Command health checks require an administrator."},403);let Y={method:String(y.config?.method??"GET").toUpperCase().slice(0,10),path:y.config?.path?String(y.config.path).slice(0,500):void 0,port:y.config?.port==null?void 0:Number(y.config.port),command:Array.isArray(y.config?.command)?y.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(y.config?.expectedStatuses)?y.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:y.config?.expectedBody?String(y.config.expectedBody).slice(0,500):void 0};return O({ok:!0,check:ut.createHealthCheck({projectId:T.project.id,environmentId:S?.id,resourceId:g(y.resourceId??y.resource),name:String(y.name??""),kind:z,target:String(y.target??""),config:Y,intervalSeconds:Number(y.intervalSeconds)||60,timeoutSeconds:Number(y.timeoutSeconds)||10,failureThreshold:Number(y.failureThreshold)||3,recoveryThreshold:Number(y.recoveryThreshold)||2,regions:Array.isArray(y.regions)?y.regions.map(String):["local"],enabled:y.enabled!==!1})},201)}if(f.pathname==="/api/health/checks"&&C.method==="PATCH"){let y=await v(C),z=ut.getHealthCheck(String(y.id??""));if(!z||!D(z.resourceId))return O({ok:!1,error:"Health check was not found."},404);return O({ok:!0,check:ut.setHealthCheckEnabled(z.id,y.enabled!==!1)})}if(f.pathname==="/api/health/checks/test"&&C.method==="POST"){let y=await v(C),z=ut.getHealthCheck(String(y.id??""));if(!z||!D(z.resourceId))return O({ok:!1,error:"Health check was not found."},404);return O({ok:!0,productionIncidentCreated:!1,result:await new DE(ut).probe(z)})}if(f.pathname==="/api/health/checks/run"&&C.method==="POST"){let y=await v(C),z=ut.getHealthCheck(String(y.id??""));if(!z||!D(z.resourceId))return O({ok:!1,error:"Health check was not found."},404);let Y=await new DE(ut).runAndEvaluate(z),k=[];for(let $t of Y.evaluations.filter((Z)=>Z.notify&&Z.alert)){let Z=Tr.enqueue(T.organization.id,$t.alert,$t.transition);k.push(...await Tr.deliverAll(Z))}return O({ok:!0,...Y,deliveries:k})}if(f.pathname==="/api/alerts/rules"&&C.method==="GET")return O({ok:!0,rules:ut.listRules(T.project.id,S?.id).filter((y)=>D(y.resourceId))});if(f.pathname==="/api/alerts/rules"&&C.method==="POST"){let y=await v(C),z=y.healthCheckId?ut.getHealthCheck(String(y.healthCheckId)):void 0;if(y.healthCheckId&&(!z||!D(z.resourceId)))return O({ok:!1,error:"Health check was not found."},404);return O({ok:!0,rule:ut.createRule({projectId:T.project.id,environmentId:S?.id,resourceId:g(y.resourceId??y.resource)??z?.resourceId,healthCheckId:z?.id,name:String(y.name??""),signal:String(y.signal??(z?"health":"")),operator:String(y.operator??(z?"unhealthy":"gt")),threshold:y.threshold==null?void 0:Number(y.threshold),recoveryThreshold:y.recoveryThreshold==null?void 0:Number(y.recoveryThreshold),windowMs:Number(y.windowMs)||300000,consecutive:Number(y.consecutive)||z?.failureThreshold||3,recoveryConsecutive:Number(y.recoveryConsecutive)||z?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(y.noDataPolicy))?y.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(y.severity))?y.severity:"warning",groupBy:Array.isArray(y.groupBy)?y.groupBy.map(String):[],labels:y.labels&&typeof y.labels==="object"?y.labels:{},enabled:y.enabled!==!1})},201)}if(f.pathname==="/api/alerts/rules"&&C.method==="PATCH"){let y=await v(C),z=ut.getRule(String(y.id??""));if(!z||!D(z.resourceId))return O({ok:!1,error:"Alert rule was not found."},404);return O({ok:!0,rule:ut.setRuleEnabled(z.id,y.enabled!==!1)})}if(f.pathname==="/api/alerts/evaluate"&&C.method==="POST")return O({ok:!0,...await Nu(S?.id)});if(f.pathname==="/api/alerts"&&C.method==="GET")return O({ok:!0,alerts:ut.listAlerts(T.project.id,{environmentId:S?.id,states:f.searchParams.getAll("state").length?f.searchParams.getAll("state"):void 0,limit:Number(f.searchParams.get("limit"))||200}).filter((y)=>D(y.resourceId)).map((y)=>({...y,deliveries:ut.listDeliveries({alertId:y.id,limit:50})}))});if(f.pathname==="/api/alerts/action"&&C.method==="POST"){let y=await v(C),z=ut.getAlert(String(y.id??""));if(!z||!D(z.resourceId))return O({ok:!1,error:"Alert was not found."},404);let Y=String(y.action??"");if(Y==="acknowledge")return O({ok:!0,alert:ut.acknowledge(z.id,X?.id??"")});if(Y==="assign")return O({ok:!0,alert:ut.assign(z.id,y.ownerActorId==="me"?X?.id:y.ownerActorId?String(y.ownerActorId):void 0,X?.id)});if(Y==="silence"){if(Q.role!=="admin")return O({ok:!1,error:"Silencing production alerts requires an administrator."},403);let k=bt.resolveSession(C);if(o&&(!k||!b.isRecentlyAuthenticated(k)))return O({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return O({ok:!0,alert:ut.silenceAlert(z.id,String(y.until??""),X?.id)})}return O({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(f.pathname==="/api/alerts/silences"&&C.method==="POST"){let y=await v(C);return O({ok:!0,id:ut.createSilence({projectId:T.project.id,environmentId:S?.id,resourceId:g(y.resourceId??y.resource),matcher:y.matcher,reason:String(y.reason??""),startsAt:String(y.startsAt??new Date().toISOString()),endsAt:String(y.endsAt??""),timezone:String(y.timezone??"UTC"),actorId:X?.id})},201)}if(f.pathname==="/api/notifications/channels"&&C.method==="GET")return O({ok:!0,channels:ut.listChannels(T.organization.id)});if(f.pathname==="/api/notifications/channels"&&C.method==="POST"){let y=await v(C),z=String(y.kind??""),Y=z==="email"?{to:y.config?.to,from:y.config?.from}:z==="telegram"?{chatId:String(y.config?.chatId??"")}:{};return O({ok:!0,channel:ut.createChannel({organizationId:T.organization.id,name:String(y.name??""),kind:z,config:Y,credential:y.credential?String(y.credential):void 0,actorId:X?.id})},201)}if(f.pathname==="/api/notifications/channels"&&C.method==="PATCH"){let y=await v(C),z=String(y.id??"");if(y.credential)return O({ok:!0,channel:ut.rotateChannel(z,String(y.credential))});let Y=String(y.status??"paused");if(!["active","paused","disabled"].includes(Y))return O({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return O({ok:!0,channel:ut.setChannelStatus(z,Y)})}if(f.pathname==="/api/notifications/channels/test"&&C.method==="POST"){let y=await v(C);return O({ok:!0,productionIncidentCreated:!1,result:await Tr.testChannel(String(y.id??""))})}if(f.pathname==="/api/notifications/routes"&&C.method==="GET")return O({ok:!0,routes:ut.listRoutes(T.organization.id)});if(f.pathname==="/api/notifications/routes"&&C.method==="POST"){let y=await v(C),z=Array.isArray(y.channelIds)?y.channelIds.map(String):[];if(z.some((Y)=>ut.getChannel(Y)?.organizationId!==T.organization.id))return O({ok:!1,error:"Route contains an unavailable channel."},422);return O({ok:!0,route:ut.createRoute({organizationId:T.organization.id,name:String(y.name??""),priority:Number(y.priority)||0,matcher:y.matcher&&typeof y.matcher==="object"?y.matcher:{},channelIds:z,quietHours:y.quietHours,groupWaitSeconds:Number(y.groupWaitSeconds)||30,reminderSeconds:y.reminderSeconds==null?void 0:Number(y.reminderSeconds),escalation:Array.isArray(y.escalation)?y.escalation:[],template:y.template?String(y.template):void 0,rateLimitPerMinute:Number(y.rateLimitPerMinute)||60,enabled:y.enabled!==!1})},201)}if(f.pathname==="/api/notifications/routes"&&C.method==="PATCH"){let y=await v(C),z=ut.getRoute(String(y.id??""));if(!z||z.organizationId!==T.organization.id)return O({ok:!1,error:"Notification route was not found."},404);return O({ok:!0,route:ut.setRouteEnabled(z.id,y.enabled!==!1)})}if(f.pathname==="/api/notifications/routes/preview"&&C.method==="POST"){let y=await v(C),Y=(y.alertId?ut.getAlert(String(y.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:T.project.id,environmentId:S?.id,resourceId:g(y.resourceId??y.resource),dedupKey:"preview",groupKey:String(y.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(y.severity))?y.severity:"warning",title:String(y.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return O({ok:!0,productionIncidentCreated:!1,matches:Tr.preview(T.organization.id,Y,String(y.eventType??"firing")).map((k)=>({route:k.route,channels:k.channels,quiet:k.quiet}))})}if(f.pathname==="/api/notifications/deliveries"&&C.method==="GET")return O({ok:!0,deliveries:ut.listDeliveries({alertId:f.searchParams.get("alertId")??void 0,states:f.searchParams.getAll("state"),limit:Number(f.searchParams.get("limit"))||200})});if(f.pathname==="/api/notifications/deliveries/retry"&&C.method==="POST"){let y=await v(C),z=ut.getDelivery(String(y.id??""));if(!z)return O({ok:!1,error:"Delivery was not found."},404);return ut.updateDelivery(z.id,{state:"retrying",attempt:Math.max(0,z.attempt-1),nextAttemptAt:new Date().toISOString()}),O({ok:!0,delivery:await Tr.deliver(z.id)})}}if(f.pathname.startsWith("/api/jobs")||f.pathname.startsWith("/api/workers")){let S=T.environments.get(M),L=T.store.listResources(T.project.id,S?.id),D=Q.role==="admin"||!!S&&zc(Q,S.id,"automation:read")?L:L.filter((G)=>Ce(Q,G.id,"automation:read")),g=(G)=>!G||D.some((et)=>et.id===G),X=ct(Q).actor,y=u.get(M)??A,z=kh(n,y),Y=z.filter((G)=>!G.danger&&["scheduler","backup","worker"].includes(G.group)),k=dd(n),$t=()=>{let G=bt.resolveSession(C);return!o||!!G&&b.isRecentlyAuthenticated(G)},Z=(G)=>{if(!G||typeof G!=="object"||Array.isArray(G))return{};let et=Object.entries(G).slice(0,50);if(et.some(([,Ct])=>typeof Ct!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(Ct)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(et)},_t=(G,et,Ct)=>T.store.appendEvent({organizationId:T.organization.id,projectId:T.project.id,resourceId:Ct,actorId:X?.id,type:`job.${G}`,payload:et});if(f.pathname==="/api/jobs/preview"&&C.method==="POST"){let G=await v(C);try{return O({ok:!0,productionExecutionCreated:!1,preview:JE(String(G.expression??""),String(G.timezone??"UTC"),new Date(G.from?String(G.from):Date.now()),Number(G.count)||5)})}catch(et){return O({ok:!1,error:et instanceof Error?et.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(f.pathname==="/api/jobs"&&C.method==="GET")return O({ok:!0,jobs:Oe.list(T.project.id,{environmentId:S?.id}).filter((G)=>g(G.resourceId)).map((G)=>({...G,preview:JE(G.normalizedExpression,G.timezone,new Date,5),capability:qS(G),lastExecution:Oe.listExecutions(G.id,1)[0]}))});if(f.pathname==="/api/jobs"&&C.method==="POST"){let G=await v(C),et=String(G.provider??(k==="serverless"?"eventbridge":"server")),Ct=k==="serverless"?"eventbridge":"server";if(et!==Ct)return O({ok:!1,error:`${k} environments accept ${Ct} schedules through this adapter.`},422);let wt=G.operationId?String(G.operationId):void 0;if(et==="server"&&(!wt||!Y.some((ne)=>ne.id===wt)))return O({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let Bt=qS({provider:et,expression:String(G.expression??""),flexibleMinutes:Number(G.flexibleMinutes)||0,missedRunPolicy:G.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(G.overlapPolicy))?G.overlapPolicy:"forbid"});if(!Bt.supported)return O({ok:!1,error:Bt.notes.join(" ")},422);let me=G.resourceId?L.find((ne)=>ne.id===G.resourceId||ne.slug===G.resourceId):void 0;if(G.resourceId&&(!me||!g(me.id)))return O({ok:!1,error:"Job resource was not found."},404);try{let ne=et==="server"?{kind:"dashboard_operation",operationId:wt}:{kind:"serverless_scheduler",action:"run"},zd=Oe.create({organizationId:T.organization.id,projectId:T.project.id,environmentId:S?.id,resourceId:me?.id,name:String(G.name??""),provider:et,expression:String(G.expression??""),timezone:String(G.timezone??"UTC"),startsAt:G.startsAt?String(G.startsAt):void 0,endsAt:G.endsAt?String(G.endsAt):void 0,flexibleMinutes:Number(G.flexibleMinutes)||0,target:ne,payloadRefs:Z(G.payloadRefs),missedRunPolicy:G.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(G.overlapPolicy))?G.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(G.maxAttempts)||3,backoffSeconds:Number(G.backoffSeconds)||30,deadLetterRef:G.deadLetterRef?String(G.deadLetterRef):void 0},timeoutSeconds:Number(G.timeoutSeconds)||900,enabled:G.enabled!==!1,origin:"managed",ownerActorId:X?.id,observedState:{},reconciliationStatus:"pending"});return _t("created",{jobId:zd.id,provider:zd.provider,expression:zd.normalizedExpression},zd.resourceId),O({ok:!0,job:zd,capability:Bt},201)}catch(ne){return O({ok:!1,error:ne instanceof Error?ne.message:"Scheduled job could not be created."},422)}}if(f.pathname==="/api/jobs"&&C.method==="PATCH"){let G=await v(C),et=Oe.get(String(G.id??""));if(!et||!g(et.resourceId))return O({ok:!1,error:"Scheduled job was not found."},404);if(et.origin==="config")return O({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let Ct=G.missedRunPolicy==null?void 0:String(G.missedRunPolicy),wt=G.overlapPolicy==null?void 0:String(G.overlapPolicy);if(Ct&&!["skip","catch_up"].includes(Ct))return O({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(wt&&!["allow","forbid","replace"].includes(wt))return O({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let Bt=Oe.updateSchedule(et.id,{expression:G.expression?String(G.expression):void 0,timezone:G.timezone?String(G.timezone):void 0,missedRunPolicy:Ct,overlapPolicy:wt,timeoutSeconds:G.timeoutSeconds==null?void 0:Number(G.timeoutSeconds)});return _t("updated",{jobId:Bt.id,expression:Bt.normalizedExpression,version:Bt.version},Bt.resourceId),O({ok:!0,job:Bt})}catch(Bt){return O({ok:!1,error:Bt instanceof Error?Bt.message:"Scheduled job could not be updated."},422)}}if(f.pathname==="/api/jobs/action"&&C.method==="POST"){let G=await v(C),et=Oe.get(String(G.id??""));if(!et||!g(et.resourceId))return O({ok:!1,error:"Scheduled job was not found."},404);let Ct=String(G.action??"");if(Ct==="run"){let wt=Su.enqueue(et,{trigger:"manual",actorId:X?.id});return _t("run_queued",{jobId:et.id,executionId:wt.id},et.resourceId),O({ok:!0,execution:wt},202)}if(["disable","delete"].includes(Ct)&&S?.kind==="production"){if(String(G.confirm??"")!==Ct)return O({ok:!1,error:`Type "${Ct}" to confirm this production change.`},409);if(!$t())return O({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(Ct==="enable"||Ct==="disable"){let wt=Oe.setEnabled(et.id,Ct==="enable");return _t(Ct==="enable"?"enabled":"disabled",{jobId:et.id},et.resourceId),O({ok:!0,job:wt})}if(Ct==="delete")try{return Oe.remove(et.id),_t("deleted",{jobId:et.id,name:et.name},et.resourceId),O({ok:!0,deleted:et.id})}catch(wt){return O({ok:!1,error:wt instanceof Error?wt.message:"Scheduled job could not be deleted."},409)}return O({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(f.pathname==="/api/jobs/history"&&C.method==="GET"){let G=Oe.get(String(f.searchParams.get("jobId")??""));if(!G||!g(G.resourceId))return O({ok:!1,error:"Scheduled job was not found."},404);return O({ok:!0,executions:Oe.listExecutions(G.id,Number(f.searchParams.get("limit"))||100).map((et)=>({...et,logs:et.operationId?st.logs(et.operationId,{limit:500}):[]}))})}if(f.pathname==="/api/jobs/reconcile"&&C.method==="POST"){if(!S)return O({ok:!1,error:"Environment was not found."},404);let G=sS(Oe,n,{organization:T.organization,project:T.project,environment:S,resources:L});return _t("reconciled",G),O({ok:!0,reconciliation:G})}if(f.pathname==="/api/workers"&&C.method==="GET"){let G=Array.isArray(y.workersDetail??y.workers)?y.workersDetail??y.workers:[];return O({ok:!0,workers:Oe.listWorkers(T.project.id,S?.id).filter((et)=>g(et.resourceId)).map((et)=>{let Ct=G.find((wt)=>wt.name===et.name||wt.site===et.target.site);return Ct?{...et,observedState:{...et.observedState,status:Ct.status??"configured",currentJob:Ct.currentJob??null,failures:Number(Ct.failed??Ct.failures)||0,processed:Number(Ct.processed)||0}}:et})})}if(f.pathname==="/api/workers/action"&&C.method==="POST"){let G=await v(C),et=Oe.getWorker(String(G.id??""));if(!et||!g(et.resourceId))return O({ok:!1,error:"Worker was not found."},404);let Ct=String(G.action??"");if(Ct==="restart"){if(String(G.confirm??"")!==et.name)return O({ok:!1,error:`Type "${et.name}" to restart this worker.`},409);let wt=z.find((ne)=>ne.id===et.target.operationId);if(!wt)return O({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let Bt=await bh(n,M,wt),me=Oe.reconcileWorker(et.id,Bt.ok?"in_sync":"unavailable",{...et.observedState,lastRestartAt:new Date().toISOString(),command:Bt.command??null,error:Bt.error??Bt.stderr??null});return _t("worker_restarted",{workerId:et.id,ok:Bt.ok},et.resourceId),O({...Bt,worker:me},Bt.ok?200:409)}if(Ct==="scale")return O({ok:!1,error:et.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return O({ok:!1,error:"Action must be restart or scale."},422)}}if(f.pathname.startsWith("/api/telemetry/")){let S=T.environments.get(M),L=new UE(T.store),I=T.store.listResources(T.project.id,S?.id),D=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(f.pathname)?"runtime:logs":"runtime:read",g=Q.role==="admin"||!!S&&zc(Q,S.id,D),X=g?I:I.filter((Z)=>Ce(Q,Z.id,D)),y=(Z)=>Hw(X,g,Z),z=(Z)=>{let _t=new Date,G={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},et=String(Z.to??_t.toISOString()),Ct=String(Z.from??new Date(new Date(et).getTime()-(G[String(Z.range??"1h")]??G["1h"])).toISOString()),wt=(me)=>{let ne=(Array.isArray(me)?me:String(me??"").split(",")).map(String).filter(Boolean);return ne.length?ne:void 0},Bt=wt(Z.kinds)?.filter((me)=>["metric","log","trace","request","event"].includes(me));return{projectId:T.project.id,environmentId:S?.id,resourceIds:y(Z.resources),kinds:Bt,names:wt(Z.names),sources:wt(Z.sources),levels:wt(Z.levels),from:Ct,to:et,text:String(Z.text??"")||void 0,traceId:String(Z.traceId??"")||void 0,requestId:String(Z.requestId??"")||void 0,deploymentId:String(Z.deploymentId??"")||void 0,releaseId:String(Z.releaseId??"")||void 0,workloadId:String(Z.workloadId??"")||void 0,cursor:String(Z.cursor??"")||void 0,limit:Number(Z.limit)||void 0}},Y=Object.fromEntries(f.searchParams.entries()),k=(Z=!1)=>eu({controlPlane:T.store,projectId:T.project.id,environmentId:S?.id,config:n,environment:M,force:Z,lightweight:!Z}),$t=()=>{let Z=T.store.getSetting(`telemetry.collection:${T.project.id}:${S?.id??"all"}`)??{};return{generatedAt:String(Z.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(Z.statuses)?Z.statuses:[],errors:Array.isArray(Z.errors)?Z.errors:[],policy:Z.policy??Dn(T.store,T.project.id)}};if(f.pathname==="/api/telemetry/status"&&C.method==="GET"){k(!1);let Z=$t(),_t=g?Z.statuses:L.status(T.project.id,S?.id,Z.policy.rawDays,Z.policy.samplingRate,X.map((et)=>et.id)),G=_t.reduce((et,Ct)=>et+Ct.estimatedDailyBytes*30,0);return O({ok:!0,generatedAt:Z.generatedAt,cached:Z.cached,sources:_t,errors:g?Z.errors:[],policy:Z.policy,retention:{rawDays:Z.policy.rawDays,downsampleAfterDays:Z.policy.downsampleAfterDays,downsampleBucketMs:Z.policy.downsampleBucketMs,maxRecords:Z.policy.maxRecords},estimatedMonthlyBytes:G,estimatedMonthlyCostUsd:_C(G,Z.policy),costEstimateConfigured:Z.policy.estimatedStorageUsdPerGbMonth>0})}if(f.pathname==="/api/telemetry/settings"&&C.method==="GET")return O({ok:!0,policy:Dn(T.store,T.project.id)});if(f.pathname==="/api/telemetry/settings"&&C.method==="PATCH"){let Z=cC(T.store,T.project.id,await v(C));return Gw(T.project.id),O({ok:!0,policy:Z})}if(f.pathname==="/api/telemetry/query"&&C.method==="GET"){k(!1);let Z=$t();return O({ok:!0,collection:{generatedAt:Z.generatedAt,cached:Z.cached},...L.query(z(Y))})}if(f.pathname==="/api/telemetry/tail"&&C.method==="GET"){k(!1);let Z=new TextEncoder,_t=new Date,G=z({...Y,kinds:Y.kinds||"log,request,event,trace",from:Y.from||new Date(_t.getTime()-120000).toISOString(),to:_t.toISOString(),limit:Math.min(1000,Number(Y.limit)||200),cursor:void 0}),et=C.headers.get("last-event-id")||String(Y.cursor??"")||void 0,Ct,wt=!1,Bt=!1,me=new ReadableStream({start(ne){let zd=()=>{if(wt)return;if(wt=!0,Ct)clearInterval(Ct);C.signal.removeEventListener("abort",zd);try{ne.close()}catch{}},wu=async()=>{if(wt||Bt)return;Bt=!0;try{let LE=L.tail({...G,to:new Date(Date.now()+1000).toISOString()},et);for(let gu of LE.records)et=jT(gu)??et,ne.enqueue(Z.encode(`id: ${et??""}
 event: record
 data: ${JSON.stringify(gu)}
 
@@ -6668,4 +6668,4 @@ data: ${JSON.stringify({message:LE instanceof Error?LE.message:String(LE)})}
 data: ${JSON.stringify({cursor:et,at:new Date().toISOString()})}
 
 `))},5000),Ct.unref?.(),C.signal.addEventListener("abort",zd,{once:!0})},cancel(){if(wt=!0,Ct)clearInterval(Ct)}});return new Response(me,{headers:{"cache-control":"no-cache, no-transform",connection:"keep-alive","content-type":"text/event-stream; charset=utf-8","x-accel-buffering":"no"}})}if(f.pathname==="/api/telemetry/series"&&C.method==="GET"){k(!1);let Z=$t(),_t=["sum","avg","min","max","count","p50","p90","p95","p99"].includes(String(Y.aggregation))?Y.aggregation:"avg",G=z({...Y,kinds:"metric",limit:5000}),et=L.series({...G,bucketMs:Number(Y.bucketMs)||60000,aggregation:_t,timezone:String(Y.timezone??"UTC"),compareFrom:Y.compareFrom,compareTo:Y.compareTo});return O({ok:!0,collection:{generatedAt:Z.generatedAt,cached:Z.cached},query:{aggregation:_t,bucketMs:Number(Y.bucketMs)||60000,timezone:String(Y.timezone??"UTC")},series:et})}if(f.pathname==="/api/telemetry/refresh"&&C.method==="POST")return O({ok:!0,...await k(!0)});if(f.pathname==="/api/telemetry/export"&&C.method==="POST"){let Z=await v(C);await k(!1);let _t=L.query({...z(Z),limit:Math.min(5000,Number(Z.limit)||5000),cursor:void 0});if((Z.format==="csv"?"csv":"json")==="json")return new Response(JSON.stringify({exportedAt:new Date().toISOString(),query:z(Z),..._t},null,2),{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.json"',"content-type":"application/json; charset=utf-8"}});let et=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"],Ct=[et.join(","),..._t.records.map((wt)=>et.map((Bt)=>`"${String(wt[Bt]??"").replaceAll('"','""')}"`).join(","))].join(`
-`);return new Response(Ct,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(f.pathname==="/api/telemetry/saved-queries"&&C.method==="GET"){let Z=ct(Q);return O({ok:!0,queries:L.listSavedQueries(T.project.id,Z.actor?.id)})}if(f.pathname==="/api/telemetry/saved-queries"&&C.method==="POST"){let Z=await v(C),_t=ct(Q);return O({ok:!0,query:L.saveQuery(T.project.id,_t.actor?.id,String(Z.name??""),z(Z.query??Z))},201)}if(f.pathname==="/api/telemetry/saved-queries"&&C.method==="DELETE"){let Z=await v(C),_t=ct(Q),G=L.deleteSavedQuery(T.project.id,_t.actor?.id,String(Z.id??""));return O({ok:G},G?200:404)}}if(f.pathname.startsWith("/api/configuration")){let S=T.environments.get(M),L=Q.role==="admin"||!!ir.capabilities?.includes("secrets:read"),I=Q.role==="admin"||!!ir.capabilities?.includes("secrets:write"),D={projectId:T.project.id,environmentId:S?.id},g={"cache-control":"no-store"};if(f.pathname==="/api/configuration"&&C.method==="GET"){let X=Object.fromEntries(f.searchParams),y=X.scopeType||X.scopeId?Xc(X,D):void 0,z=["variable","secret"].includes(String(X.kind))?X.kind:void 0,Y=y?.type==="preview"?pt.previews.getInstance(y.id):void 0,k=Y?pt.previews.getDefinition(Y.definitionId):void 0,$t=y?await Ke.resolve({projectId:T.project.id,environmentId:y.environmentId,resourceId:y.resourceId,functionId:y.type==="function"?y.id:void 0,previewId:y.previewId,trustedPreview:!!Y&&!Y.fork,allowedPreviewSecrets:k?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:L}):void 0,Z=T.store.listResources(T.project.id);return O({ok:!0,entries:Ke.list({projectId:T.project.id,scope:y,kind:z,search:X.search,canReadSecretMetadata:L}),effectiveEntries:$t?Object.values($t.entries).filter((_t)=>!z||_t.kind===z).filter((_t)=>!X.search||_t.key.toLowerCase().includes(String(X.search).toLowerCase())):[],configurationHash:$t?.configurationHash,warnings:$t?.warnings??[],scopes:{project:T.project,environments:T.store.listEnvironments(T.project.id),resources:Z.filter((_t)=>_t.kind!=="function"),functions:Z.filter((_t)=>_t.kind==="function"),previews:pt.previews.listInstances({projectId:T.project.id}).filter((_t)=>_t.status!=="destroyed").map((_t)=>({id:_t.id,name:_t.name,environmentId:_t.baseEnvironmentId,resourceId:_t.resourceId,fork:_t.fork,status:_t.status}))}},200,g)}if(f.pathname==="/api/configuration/export"&&C.method==="GET"){let X=Xc(Object.fromEntries(f.searchParams),D);return new Response(Ke.exportVariables({projectId:T.project.id,scope:X}),{headers:{...g,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(f.pathname==="/api/configuration/plan"&&C.method==="POST"){let X=await v(C),y=Xc(X,D),z=X.values&&typeof X.values==="object"&&!Array.isArray(X.values)?Object.fromEntries(Object.entries(X.values).map(([Y,k])=>[Y,String(k)])):{};return O({ok:!0,plan:Ke.plan({projectId:T.project.id,scope:y,values:z,removeMissing:X.removeMissing===!0})},200,g)}if(f.pathname==="/api/configuration"&&C.method==="POST"){let X=await v(C),y=Xc(X,D),z=X.kind==="secret"?"secret":"variable",Y=String(X.key??"");if(z==="secret"&&!I)return O({ok:!1,error:"Secret write permission is required."},403,g);try{let k=await Ke.set({organizationId:T.organization.id,projectId:T.project.id,scope:y,key:Y,kind:z,value:X.value==null?void 0:String(X.value),reference:X.reference==null?void 0:String(X.reference),backend:X.backend,required:X.required===!0,expectedVersion:X.expectedVersion==null?void 0:Number(X.expectedVersion),confirmed:String(X.confirm??"")===Y,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:ct(Q).actor?.id});return O({ok:!0,entry:Ke.list({projectId:T.project.id,scope:y,canReadSecretMetadata:L}).find(($t)=>$t.id===k.entry.id),mutation:k.mutation,warnings:k.warnings},k.mutation.added.length?201:200,g)}catch(k){return O({ok:!1,error:k instanceof Error?k.message:String(k)},409,g)}}if(f.pathname==="/api/configuration/import"&&C.method==="POST"){let X=await v(C),y=Xc(X,D),z=Array.isArray(X.secretKeys)?X.secretKeys.map(String):[];if(z.length&&!I)return O({ok:!1,error:"Secret write permission is required."},403,g);try{let Y=await Ke.importDotenv({organizationId:T.organization.id,projectId:T.project.id,scope:y,source:String(X.source??""),secretKeys:z,backend:X.backend,confirmed:X.confirm==="import",idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:ct(Q).actor?.id});return O({ok:Y.document.valid,diagnostics:Y.document.diagnostics,mutation:Y.mutation,warnings:Y.warnings},Y.document.valid?200:422,g)}catch(Y){return O({ok:!1,error:Y instanceof Error?Y.message:String(Y)},409,g)}}if(f.pathname==="/api/configuration/dependencies"&&C.method==="POST"){let X=await v(C),y=yd.get(String(X.entryId??"")),z=T.store.getResource(String(X.resourceId??""));if(!y||y.projectId!==T.project.id||!z||z.projectId!==T.project.id)return O({ok:!1,error:"Configuration entry or dependent resource was not found."},404,g);return O({ok:!0,dependency:yd.setDependency({entryId:y.id,resourceId:z.id,injectionTarget:["native_reference","file"].includes(String(X.injectionTarget))?X.injectionTarget:"environment",required:X.required!==!1,requiresRedeploy:X.requiresRedeploy!==!1,lastDeployedVersion:X.lastDeployedVersion==null?void 0:Number(X.lastDeployedVersion)})},200,g)}if(f.pathname==="/api/configuration/transfer"&&C.method==="POST"){let X=await v(C),y=yd.get(String(X.id??"")),z=Xc({...X,scopeType:X.targetScopeType,scopeId:X.targetScopeId},D);if(!y||y.projectId!==T.project.id)return O({ok:!1,error:"Configuration entry was not found."},404,g);if(y.kind==="secret"&&!I)return O({ok:!1,error:"Secret write permission is required."},403,g);try{let Y=await Ke.transfer({entryId:y.id,targetScope:z,mode:X.mode==="move"?"move":"copy",confirmed:X.confirm===y.key,actorId:ct(Q).actor?.id,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey});return O({ok:!0,entry:Ke.list({projectId:T.project.id,scope:z,canReadSecretMetadata:L}).find((k)=>k.id===Y.entry.id),mutation:Y.mutation},200,g)}catch(Y){return O({ok:!1,error:Y instanceof Error?Y.message:String(Y)},409,g)}}if(f.pathname==="/api/configuration/bulk"&&C.method==="POST"){let X=await v(C),y=Array.isArray(X.ids)?X.ids.map(String).slice(0,500):[],z=y.map((k)=>yd.get(k)).filter((k)=>!!k&&k.projectId===T.project.id);if(z.length!==y.length)return O({ok:!1,error:"One or more configuration entries were not found."},404,g);if(z.some((k)=>k.kind==="secret")&&!I)return O({ok:!1,error:"Secret write permission is required."},403,g);if(X.action!=="delete"||X.confirm!=="bulk")return O({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,g);let Y=[];try{for(let k of z)Y.push(await Ke.remove({entryId:k.id,expectedVersion:k.version,confirmed:!0,actorId:ct(Q).actor?.id}));return O({ok:!0,removed:Y.flatMap((k)=>k.removed),affectedResourceIds:[...new Set(Y.flatMap((k)=>k.affectedResourceIds))].sort()},200,g)}catch(k){return O({ok:!1,error:k instanceof Error?k.message:String(k),partial:Y.flatMap(($t)=>$t.removed)},409,g)}}if(f.pathname==="/api/configuration/reveal"&&C.method==="POST"){let X=await v(C),y=bt.resolveSession(C);try{return O({ok:!0,value:await Ke.reveal({entryId:String(X.id??""),canRevealSecrets:L,recentlyAuthenticated:!o||!!y&&b.isRecentlyAuthenticated(y),actorId:ct(Q).actor?.id})},200,g)}catch(z){return O({ok:!1,error:z instanceof Error?z.message:String(z)},403,g)}}if(f.pathname==="/api/configuration"&&C.method==="DELETE"){let X=await v(C),y=yd.get(String(X.id??""));if(y?.kind==="secret"&&!I)return O({ok:!1,error:"Secret write permission is required."},403,g);if(!y||y.projectId!==T.project.id)return O({ok:!1,error:"Configuration entry was not found."},404,g);try{return O({ok:!0,mutation:await Ke.remove({entryId:y.id,expectedVersion:Number(X.expectedVersion),confirmed:String(X.confirm??"")===y.key,actorId:ct(Q).actor?.id})},200,g)}catch(z){return O({ok:!1,error:z instanceof Error?z.message:String(z)},409,g)}}}if(f.pathname.startsWith("/api/fleet")){let S=ct(Q).actor?.id,L=(I,D=409)=>O({ok:!1,error:I instanceof Error?I.message:String(I)},D,{"cache-control":"no-store"});if(f.pathname==="/api/fleet"&&C.method==="GET")return O({ok:!0,servers:jc.list(T.project.id),resources:T.store.listResources(T.project.id),operations:st.list({projectId:T.project.id,limit:200}).filter((I)=>I.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(f.pathname==="/api/fleet"&&C.method==="POST"){let I=await v(C);try{return O({ok:!0,server:vr.enroll({organizationId:T.organization.id,projectId:T.project.id,name:String(I.name??""),provider:["aws","hetzner"].includes(String(I.provider))?I.provider:"ssh",providerId:I.providerId?String(I.providerId):void 0,region:I.region?String(I.region):void 0,zone:I.zone?String(I.zone):void 0,endpoint:String(I.endpoint??""),sshUser:String(I.sshUser??"deploy"),sshPort:I.sshPort?Number(I.sshPort):22,credentialRef:String(I.credentialRef??""),roles:Array.isArray(I.roles)?I.roles:[],labels:I.labels&&typeof I.labels==="object"?I.labels:{}})},201)}catch(D){return L(D,422)}}if(f.pathname==="/api/fleet/action"&&C.method==="POST"){let I=await v(C),D=String(I.id??""),g=String(I.action??"");try{if(g==="test")return O({ok:!0,server:await vr.test(D)});if(g==="validate")return O({ok:!0,server:await vr.validate(D)});if(g==="review_host_key")return O({ok:!0,server:vr.reviewHostKey(D,String(I.fingerprint??""))});if(g==="bootstrap")return O({ok:!0,...vr.bootstrap(D,I.confirmed===!0)},I.confirmed===!0?202:200);if(g==="heartbeat")return O({ok:!0,server:vr.heartbeat(D,{usage:I.usage&&typeof I.usage==="object"?I.usage:{}})});if(g==="drain")return O({ok:!0,server:vr.drain(D,I.completed===!0)});if(g==="uncordon")return O({ok:!0,server:vr.uncordon(D)});if(g==="archive")return O({ok:!0,server:vr.archive(D,String(I.confirmation??""))});return L("Unsupported fleet action.",422)}catch(X){return L(X)}}}if(f.pathname.startsWith("/api/capacity")){let S=(L,I=409)=>O({ok:!1,error:L instanceof Error?L.message:String(L)},I,{"cache-control":"no-store"});if(f.pathname==="/api/capacity"&&C.method==="GET")return O({ok:!0,pools:Pd.listPools(T.project.id),placements:Pd.listPlacements(T.project.id),servers:jc.list(T.project.id)},200,{"cache-control":"no-store"});if(f.pathname==="/api/capacity"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,pool:Pd.createPool({organizationId:T.organization.id,projectId:T.project.id,name:String(L.name??""),purpose:String(L.purpose??"application"),backend:String(L.backend??"server"),region:L.region?String(L.region):void 0,architecture:L.architecture?String(L.architecture):void 0,labels:L.labels&&typeof L.labels==="object"?L.labels:{},requiredServerLabels:L.requiredServerLabels&&typeof L.requiredServerLabels==="object"?L.requiredServerLabels:{},toleratedTaints:Array.isArray(L.toleratedTaints)?L.toleratedTaints.map(String):[],capacity:L.capacity&&typeof L.capacity==="object"?L.capacity:{},maxWorkloads:Number(L.maxWorkloads??10),costWeight:Number(L.costWeight??1),spreadKey:L.spreadKey?String(L.spreadKey):void 0,concurrency:Number(L.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(I){return S(I,422)}}if(f.pathname==="/api/capacity/member"&&C.method==="POST"){let L=await v(C);try{return Pd.addMember(String(L.poolId??""),String(L.serverId??"")),O({ok:!0,pool:Pd.getPool(String(L.poolId??""))})}catch(I){return S(I,422)}}if(f.pathname==="/api/capacity/explain"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,decisions:iu.explain(T.project.id,{purpose:String(L.purpose??"application"),resources:L.resources&&typeof L.resources==="object"?L.resources:{},region:L.region?String(L.region):void 0,architecture:L.architecture?String(L.architecture):void 0,labels:L.labels&&typeof L.labels==="object"?L.labels:{}})})}catch(I){return S(I,422)}}if(f.pathname==="/api/capacity/action"&&C.method==="POST"){let L=await v(C);try{if(L.action==="drain")return O({ok:!0,...iu.drainPool(String(L.poolId??""))});if(L.action==="enable")return O({ok:!0,pool:Pd.updatePool(String(L.poolId??""),{status:"active"})});if(L.action==="disable")return O({ok:!0,pool:Pd.updatePool(String(L.poolId??""),{status:"disabled"})});return S("Unsupported capacity action.",422)}catch(I){return S(I,422)}}}if(f.pathname.startsWith("/api/regions")){let S=(L,I=409)=>O({ok:!1,error:L instanceof Error?L.message:String(L)},I,{"cache-control":"no-store"});if(f.pathname==="/api/regions"&&C.method==="GET")return O({ok:!0,topologies:NE.list(T.project.id).map((L)=>({topology:L,targets:NE.targets(L.id),channels:NE.channels(L.id),route:NE.route(L.id),executions:NE.executions(L.id)}))},200,{"cache-control":"no-store"});if(f.pathname==="/api/regions"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,topology:hu.create({organizationId:T.organization.id,projectId:T.project.id,environmentId:T.environments.get(M)?.id,name:String(L.name??""),hostname:String(L.hostname??""),regions:Array.isArray(L.regions)?L.regions:[],trafficPolicy:L.trafficPolicy==="weighted"||L.trafficPolicy==="latency"?L.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(L.replicate)?L.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(L.maxLagSeconds??30),retainOnDestroy:L.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:L.cdnEnabled===!0,wafEnabled:L.wafEnabled===!0})},201)}catch(I){return S(I,422)}}if(f.pathname==="/api/regions/action"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,...hu.enqueue({topologyId:String(L.topologyId??""),kind:String(L.action??""),targetRegion:L.targetRegion?String(L.targetRegion):void 0,revision:L.revision?String(L.revision):void 0,manifest:L.manifest&&typeof L.manifest==="object"?L.manifest:{},confirmation:L.confirmation?String(L.confirmation):void 0,deleteData:L.deleteData===!0})},202)}catch(I){return S(I,422)}}}if(f.pathname.startsWith("/api/maintenance")){let S=(L,I=409)=>O({ok:!1,error:L instanceof Error?L.message:String(L)},I,{"cache-control":"no-store"});if(f.pathname==="/api/maintenance"&&C.method==="GET")return O({ok:!0,manifests:rd.manifests(T.organization.id),windows:rd.windows(T.project.id),campaigns:rd.campaigns(T.project.id).map((L)=>({campaign:L,targets:rd.targets(L.id)})),cleanups:rd.cleanups(T.project.id),drills:rd.drills(T.project.id)},200,{"cache-control":"no-store"});if(f.pathname==="/api/maintenance/cleanup-preview"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,plan:await ER.previewCleanup({projectId:T.project.id,kind:String(L.kind??"operations"),criteria:{olderThanDays:Number(L.olderThanDays??30)}},Ru)},201)}catch(I){return S(I,422)}}if(f.pathname==="/api/maintenance/cleanup-apply"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,...ER.enqueueCleanup(String(L.planId??""),String(L.confirmation??""))},202)}catch(I){return S(I,422)}}if(f.pathname==="/api/maintenance/drill"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,drill:rd.createDrill({projectId:T.project.id,scenario:String(L.scenario??"control_plane"),isolatedTarget:String(L.isolatedTarget??""),expectedRpoMinutes:Number(L.expectedRpoMinutes??60),expectedRtoMinutes:Number(L.expectedRtoMinutes??30),recoveryPointId:L.recoveryPointId?String(L.recoveryPointId):void 0,topologyId:L.topologyId?String(L.topologyId):void 0})},201)}catch(I){return S(I,422)}}if(f.pathname==="/api/maintenance/drill-run"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,...ER.enqueueDrill(String(L.drillId??""))},202)}catch(I){return S(I,422)}}}if(f.pathname.startsWith("/api/volumes")){let S=T.environments.get(M),L=ct(Q).actor?.id,I=(D,g=409)=>O({ok:!1,error:D instanceof Error?D.message:String(D)},g,{"cache-control":"no-store"});if(f.pathname==="/api/volumes"&&C.method==="GET"){let D=rR.inventory(T.project.id,S?.id),g=T.store.listResources(T.project.id,S?.id).map((X)=>({id:X.id,name:X.name,slug:X.slug,kind:X.kind,provider:X.provider,providerId:X.providerId}));return O({ok:!0,volumes:D,resources:g,operations:st.list({projectId:T.project.id,limit:100}).filter((X)=>X.operation.kind.startsWith("volume.")),recoveryPoints:de.listRecoveryPoints(T.project.id).filter((X)=>X.kind==="volume"),providers:dR.map((X)=>({provider:X.provider,type:X.type,capabilities:X.capabilities()}))},200,{"cache-control":"no-store"})}if(f.pathname==="/api/volumes"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,...ed.create({organizationId:T.organization.id,projectId:T.project.id,environmentId:S?.id,resourceId:D.resourceId?String(D.resourceId):void 0,name:String(D.name??""),provider:String(D.provider??"docker"),type:D.type==="docker"?"docker":D.type,capacityBytes:D.capacityBytes==null?void 0:Number(D.capacityBytes),filesystem:D.filesystem?String(D.filesystem):void 0,encrypted:D.encrypted===!0,desiredState:D.desiredState&&typeof D.desiredState==="object"?D.desiredState:{},actorId:L})},202,{"cache-control":"no-store"})}catch(g){return I(g,422)}}if(f.pathname==="/api/volumes/attach"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,...ed.attach(String(D.volumeId??""),{resourceId:String(D.resourceId??""),targetPath:String(D.targetPath??""),readOnly:D.readOnly===!0,uid:D.uid==null?void 0:Number(D.uid),gid:D.gid==null?void 0:Number(D.gid),mode:D.mode?String(D.mode):void 0,propagation:D.propagation,driverOptions:D.driverOptions&&typeof D.driverOptions==="object"?D.driverOptions:{},actorId:L})},202)}catch(g){return I(g,422)}}if(f.pathname==="/api/volumes/detach"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,...ed.detach(String(D.volumeId??""),String(D.attachmentId??""),{force:D.force===!0,drained:D.drained===!0,unmounted:D.unmounted===!0,confirmation:D.confirmation?String(D.confirmation):void 0,actorId:L})},202)}catch(g){return I(g)}}if(f.pathname==="/api/volumes/resize"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,...ed.resize(String(D.volumeId??""),Number(D.capacityBytes),{drained:D.drained===!0,actorId:L})},202)}catch(g){return I(g,422)}}if(f.pathname==="/api/volumes/snapshot"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,...ed.snapshot(String(D.volumeId??""),{name:D.name?String(D.name):void 0,actorId:L})},202)}catch(g){return I(g,422)}}if(f.pathname==="/api/volumes/restore"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,...ed.restore(String(D.snapshotId??""),{name:String(D.name??""),actorId:L})},202)}catch(g){return I(g,422)}}if(f.pathname==="/api/volumes/discover"&&C.method==="POST")try{return O({ok:!0,volumes:await ed.discover({organizationId:T.organization.id,projectId:T.project.id,environmentId:S?.id,actorId:L})})}catch(D){return I(D,502)}if(f.pathname==="/api/volumes/adopt"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,volume:ed.adopt(String(D.volumeId??""),{name:String(D.name??""),actorId:L})})}catch(g){return I(g,422)}}if(f.pathname==="/api/volumes"&&C.method==="DELETE"){let D=await v(C),g=bt.resolveSession(C);try{return O({ok:!0,...ed.delete(String(D.volumeId??""),{recentAuthAt:!o||g&&b.isRecentlyAuthenticated(g)?new Date().toISOString():void 0,confirmation:D.confirmation?String(D.confirmation):void 0,backupOverride:D.backupOverride===!0,backupOverrideConfirmation:D.backupOverrideConfirmation?String(D.backupOverrideConfirmation):void 0,actorId:L})},202)}catch(X){return I(X)}}}if(f.pathname==="/api/backups"&&C.method==="GET"){let S=T.environments.get(M),L=de.listPolicies(T.project.id,S?.id),I=new Set(L.map((z)=>z.id)),D=de.listRecoveryPoints(T.project.id).filter((z)=>!z.policyId||I.has(z.policyId)),g=de.listJobs(T.project.id).filter((z)=>!z.policyId||I.has(z.policyId)),X=(z)=>({...z,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!z.credentialRef,clientEncryptionConfigured:!!z.encryptionKeyRef}),y=await Promise.all(de.listDestinations(T.project.id).map(async(z)=>({...X(z),credentialStatus:await AI(z,td)})));return O({ok:!0,destinations:y,policies:L,recoveryPoints:D,jobs:g,coverage:de.coverage(T.project.id).filter((z)=>I.has(z.policy.id)),resources:S?T.store.listResources(T.project.id,S.id).map((z)=>({id:z.id,name:z.name,slug:z.slug,kind:z.kind})):[]})}if(f.pathname==="/api/backups/destinations"&&C.method==="POST"){let S=await v(C),L=String(S.name??"").trim(),I=String(S.provider??""),D=String(S.encryption??"provider"),g=`secret://data-services/backups/${T.project.id}/${L}`,X=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(I))return O({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(D))return O({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let y,z;if(S.credentials&&typeof S.credentials==="object"&&!Array.isArray(S.credentials))y=`${g}/credentials`,await td.put(y,JSON.stringify(S.credentials)),X.push(y);if(D!=="provider"){let k=String(S.encryptionKey??"");if(k.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");z=`${g}/encryption-key`,await td.put(z,k),X.push(z)}let Y=de.createDestination({organizationId:T.organization.id,projectId:T.project.id,name:L,provider:I,endpoint:S.endpoint?String(S.endpoint):void 0,endpointPolicy:S.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:S.bucket?String(S.bucket):void 0,prefix:String(S.prefix??""),region:S.region?String(S.region):Xd,forcePathStyle:S.forcePathStyle===!0,credentialRef:y,encryption:D,encryptionKeyRef:z,immutability:S.immutability&&typeof S.immutability==="object"&&!Array.isArray(S.immutability)?S.immutability:{},status:"untested"});return O({ok:!0,destination:{...Y,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!y,clientEncryptionConfigured:!!z}},201)}catch(y){for(let z of X)await td.remove(z).catch(()=>{});return O({ok:!1,error:y instanceof Error?y.message:String(y)},422)}}if(f.pathname==="/api/backups/destinations/test"&&C.method==="POST"){let S=await v(C),L=de.getDestination(String(S.id??""));if(!L||L.projectId!==T.project.id)return O({ok:!1,error:"Backup destination was not found."},404);if(L.provider==="aws_backup")return O({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await Tu.test(L),O({ok:!0,destination:de.recordDestinationTest(L.id,{ok:!0})})}catch(I){let D=I instanceof Error?I.message:String(I);return de.recordDestinationTest(L.id,{ok:!1,error:D}),O({ok:!1,error:D},502)}}if(f.pathname==="/api/backups/policies"&&C.method==="POST"){let S=await v(C),L=T.environments.get(M),I=de.getDestination(String(S.destinationId??"")),D=String(S.resourceKind??""),g=S.dataServiceId?String(S.dataServiceId):void 0,X=g?te.get(g):void 0,y=S.resourceId?String(S.resourceId):void 0,z=y?T.store.getResource(y):void 0;if(!L)return O({ok:!1,error:"Environment was not found."},404);if(!I||I.projectId!==T.project.id)return O({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(D))return O({ok:!1,error:"A supported backup resource kind is required."},422);if(g&&(!X||X.projectId!==T.project.id||X.environmentId!==L.id))return O({ok:!1,error:"Data service was not found in this environment."},404);if(y&&(!z||z.projectId!==T.project.id||z.environmentId!==L.id))return O({ok:!1,error:"Resource was not found in this environment."},404);if(D==="managed_database"&&!X)return O({ok:!1,error:"Managed database policies require a data service."},422);if(D==="logical_database"&&(!X||!["container","server"].includes(X.provider)))return O({ok:!1,error:"Logical database policies require an on-box data service."},422);if(D==="volume"&&(!z||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(S.volumeName??""))))return O({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let Y=Array.isArray(S.includePatterns)?S.includePatterns.map(String).filter(Boolean):[];if(D==="files"&&(!z||!Y.length))return O({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(D==="control_plane"&&I.encryption==="provider")return O({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(D==="infrastructure"&&(I.provider!=="aws_backup"||!Y.some((k)=>k.startsWith("resource:arn:"))||!Y.some((k)=>k.startsWith("role:arn:"))))return O({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let k=de.createPolicy({organizationId:T.organization.id,projectId:T.project.id,environmentId:L.id,resourceId:y,dataServiceId:g,destinationId:I.id,name:String(S.name??"").trim(),resourceKind:D,schedule:String(S.schedule??"daily"),timezone:String(S.timezone??"UTC"),retention:S.retention&&typeof S.retention==="object"&&!Array.isArray(S.retention)?S.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(S.compression))?S.compression:"gzip",encryption:["destination","client_side","both"].includes(String(S.encryption))?S.encryption:"destination",includePatterns:D==="volume"?[String(S.volumeName),...Y]:Y,excludePatterns:Array.isArray(S.excludePatterns)?S.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(S.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(S.expectedRtoMinutes)||120),healthCheckId:S.healthCheckId?String(S.healthCheckId):void 0,enabled:S.enabled!==!1});return O({ok:!0,policy:k},201)}catch(k){return O({ok:!1,error:k instanceof Error?k.message:String(k)},422)}}if(f.pathname==="/api/backups/run"&&C.method==="POST"){let S=await v(C),L=de.getPolicy(String(S.policyId??"")),I=T.environments.get(M);if(!L||L.projectId!==T.project.id||L.environmentId!==I?.id)return O({ok:!1,error:"Backup policy was not found in this environment."},404);try{let D=SE.enqueueBackup(L,new Date().toISOString(),ct(Q).actor?.id);return O({ok:!0,job:D},202)}catch(D){return O({ok:!1,error:D instanceof Error?D.message:String(D)},409)}}if(f.pathname==="/api/backups/verify"&&C.method==="POST"){let S=await v(C),L=de.getRecoveryPoint(String(S.recoveryPointId??""));if(!L||L.projectId!==T.project.id)return O({ok:!1,error:"Recovery point was not found."},404);return O({ok:!0,job:SE.enqueueVerification(L)},202)}if(f.pathname==="/api/backups/restore"&&C.method==="POST"){let S=await v(C),L=de.getRecoveryPoint(String(S.recoveryPointId??"")),I=S.mode==="in_place"?"in_place":"isolated",D=S.target&&typeof S.target==="object"&&!Array.isArray(S.target)?{...S.target,inPlace:I==="in_place"}:{inPlace:I==="in_place"},g=bt.resolveSession(C),X={mode:I,target:D,targetName:String(S.targetName??""),confirm:S.confirm?String(S.confirm):void 0,recentAuth:!o||!!g&&b.isRecentlyAuthenticated(g),downtimeAcknowledged:S.downtimeAcknowledged===!0,safetyBackupId:S.safetyBackupId?String(S.safetyBackupId):void 0};if(!L||L.projectId!==T.project.id)return O({ok:!1,error:"Recovery point was not found."},404);if(S.drill===!0&&I!=="isolated")return O({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let y=SE.planRestore(L,X);if(S.execute!==!0)return O({ok:!0,plan:y,executionCreated:!1});let z=SE.enqueueRestore(L,{...X,drill:S.drill===!0,actorId:ct(Q).actor?.id});return O({ok:!0,plan:y,job:z},202)}catch(y){return O({ok:!1,error:y instanceof Error?y.message:String(y)},409)}}if(f.pathname==="/api/backups/recovery-points"&&C.method==="POST"){let S=await v(C),L=de.getRecoveryPoint(String(S.id??""));if(!L||L.projectId!==T.project.id)return O({ok:!1,error:"Recovery point was not found."},404);if(S.held==null&&S.pinned==null)return O({ok:!1,error:"held or pinned must be provided."},422);return O({ok:!0,recoveryPoint:de.updateRecoveryPoint(L.id,{held:S.held==null?L.held:S.held===!0,pinned:S.pinned==null?L.pinned:S.pinned===!0})})}if(f.pathname==="/api/backups/retention"&&C.method==="POST")return O({ok:!0,jobs:SE.enqueueRetention()},202);if(f.pathname==="/api/data-services/capabilities"&&C.method==="GET"){let S=String(f.searchParams.get("engine")??""),L=String(f.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(S)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(L))return O({ok:!1,error:"A supported engine and provider are required."},422);return O({ok:!0,engine:S,provider:L,capabilities:N_(S,L)})}if(f.pathname==="/api/data-services"&&C.method==="GET"){let S=T.environments.get(M),L=te.list(T.project.id,S?.id).map((I)=>{let D=te.credential(I.id);return{...I,credentialRef:void 0,credential:D?{configured:!0,username:D.username,version:D.version,rotatedAt:D.rotatedAt}:void 0,dependencies:te.dependencies(I.id).map((g)=>({resourceId:g.resourceId,requiresRedeploy:g.requiresRedeploy}))}});return O({ok:!0,services:L})}if(f.pathname==="/api/data-services/preview"&&C.method==="POST"){let S=await v(C);if(S.id){let D=te.get(String(S.id)),g=T.environments.get(M),X=String(S.action??"");if(!D||D.projectId!==T.project.id||D.environmentId!==g?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(!mh.includes(X))return O({ok:!1,error:`Action must be one of: ${mh.join(", ")}.`},422);try{return O({ok:!0,plan:tT.plan(D,X,S.changes??{})})}catch(y){return O({ok:!1,error:y instanceof Error?y.message:String(y)},422)}}let L=String(S.engine??""),I=String(S.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(L)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(I))return O({ok:!1,error:"A supported engine and provider are required."},422);return O({ok:!0,capabilities:N_(L,I),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(f.pathname==="/api/data-services"&&C.method==="POST"){let S=await v(C),L=String(S.engine??""),I=String(S.provider??""),D=T.environments.get(M),g=ct(Q);if(!D)return O({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(L)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(I))return O({ok:!1,error:"A supported engine and provider are required."},422);let X={organizationId:T.organization.id,projectId:T.project.id,environmentId:D.id,resourceId:S.resourceId?String(S.resourceId):void 0,name:String(S.name??"").trim(),engine:L,provider:I,placement:String(S.placement??S.name??"").trim(),engineVersion:S.engineVersion?String(S.engineVersion):void 0,plan:String(S.plan??(I==="aws_elasticache"?"cache.t4g.micro":I==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:S.storageGb==null?void 0:Number(S.storageGb),highAvailability:S.highAvailability===!0,publicExposure:S.publicExposure===!0,allowedCidrs:Array.isArray(S.allowedCidrs)?S.allowedCidrs.map(String):[],desiredState:S.desiredState&&typeof S.desiredState==="object"&&!Array.isArray(S.desiredState)?S.desiredState:{},observedState:{},origin:S.adopt===!0?"adopted":"managed",managementEnabled:S.adopt!==!0,ownerActorId:g.actor?.id,username:S.username?String(S.username):void 0};try{if(S.adopt===!0){let z=te.create({...X,status:"adopted",credentialRef:void 0});return O({ok:!0,service:z,readOnly:!0},201)}if(!_u({provider:I,engine:L}))return O({ok:!1,error:`No ${I}/${L} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let y=await tT.create(X);return O({ok:!0,service:y.service,operationId:y.operationId,oneTimeCredential:y.credential},201)}catch(y){return O({ok:!1,error:y instanceof Error?y.message:String(y)},422)}}if(f.pathname==="/api/data-services/connections"&&C.method==="GET"){let S=te.get(String(f.searchParams.get("id")??"")),L=T.environments.get(M);if(!S||S.projectId!==T.project.id||S.environmentId!==L?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);let I=typeof S.observedState.endpoint==="string"?S.observedState.endpoint:void 0,D=typeof S.observedState.readerEndpoint==="string"?S.observedState.readerEndpoint:void 0,g=Number(S.observedState.port)||(S.engine==="postgres"?5432:S.engine==="redis"?6379:S.engine==="mongodb"?27017:S.engine==="libsql"?8080:3306),X=typeof S.observedState.database==="string"?S.observedState.database:void 0,y=typeof S.observedState.tls==="boolean"?S.observedState.tls:S.provider.startsWith("aws_"),z=[...I?[{type:S.publicExposure?"external":"internal",host:I,port:g,database:X,tls:y}]:[],...D?[{type:"internal",host:D,port:g,database:X,tls:y}]:[],{type:"tunnel",host:I??S.placement,port:g,database:X,tls:y}];return O({ok:!0,serviceId:S.id,guidance:CI(S,z)})}if(f.pathname==="/api/data-services/action"&&C.method==="POST"){let S=await v(C),L=te.get(String(S.id??"")),I=T.environments.get(M),D=String(S.action??"");if(!L||L.projectId!==T.project.id||L.environmentId!==I?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(!mh.includes(D))return O({ok:!1,error:`Action must be one of: ${mh.join(", ")}.`},422);let g=S.changes&&typeof S.changes==="object"&&!Array.isArray(S.changes)?S.changes:{};try{let X=tT.plan(L,D,g);if(S.execute!==!0)return O({ok:!0,plan:X,productionExecutionCreated:!1});let y=tT.enqueue(L,D,g,ct(Q).actor?.id);return O({ok:!0,plan:X,operationId:y},202)}catch(X){return O({ok:!1,error:X instanceof Error?X.message:String(X)},409)}}if(f.pathname==="/api/data-services/dependencies"&&C.method==="POST"){let S=await v(C),L=te.get(String(S.id??"")),I=T.environments.get(M),D=T.store.getResource(String(S.resourceId??""));if(!L||L.projectId!==T.project.id||L.environmentId!==I?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(!D||D.projectId!==T.project.id||D.environmentId!==I?.id)return O({ok:!1,error:"Dependent resource was not found in this environment."},404);if(S.remove===!0)return O({ok:te.removeDependency(L.id,D.id)});return te.addDependency({serviceId:L.id,resourceId:D.id,secretRef:L.credentialRef??`secret://data-services/${L.projectId}/${L.name}`,requiresRedeploy:S.requiresRedeploy!==!1}),O({ok:!0,dependencies:te.dependencies(L.id).map((g)=>({resourceId:g.resourceId,requiresRedeploy:g.requiresRedeploy}))})}if(f.pathname==="/api/data-services/management"&&C.method==="POST"){let S=await v(C),L=te.get(String(S.id??"")),I=T.environments.get(M);if(!L||L.projectId!==T.project.id||L.environmentId!==I?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(L.origin!=="adopted"||S.reviewed!==!0||S.confirm!==L.name)return O({ok:!1,error:`Enabling management requires reviewed=true and typing ${L.name}.`},409);return O({ok:!0,service:te.update(L.id,L.version,{managementEnabled:!0})})}if(f.pathname==="/api/data-services/reveal"&&C.method==="POST"){let S=await v(C),L=te.get(String(S.id??"")),I=T.environments.get(M),D=L?te.credential(L.id):void 0;if(!L||L.projectId!==T.project.id||L.environmentId!==I?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(!D)return O({ok:!1,error:"No managed credential is configured."},404);return O({ok:!0,credential:{username:D.username,password:await td.resolve(D.secretRef),version:D.version}},200,{"cache-control":"no-store"})}if(f.pathname==="/api/databases"&&C.method==="GET")return O(await Cf(n,M));if(f.pathname==="/api/databases"&&C.method==="POST"){let S=await v(C),L=String(S.name??"").trim();if(!gd(L))return O({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return O({...await If(n,M,L),name:L})}if(f.pathname==="/api/databases/vitess"&&C.method==="GET"){let S=await ff(n,M);return O({...S,unhealthy:wf(S.tablets),missingPrimary:gf(S)})}if(f.pathname==="/api/databases/vitess/provision"&&C.method==="POST"){let S=await v(C);try{return O(await Bf(n,M,{keyspace:String(S.keyspace??""),username:String(S.username??""),password:String(S.password??""),sharded:S.sharded===!0,confirm:String(S.confirm??"")}))}catch(L){return O({ok:!1,error:L instanceof Error?L.message:String(L)},422)}}if(f.pathname==="/api/databases/vitess/migrations"&&C.method==="GET"){let S=f.searchParams.get("keyspace")??void 0;return O(await zf(n,M,S))}if(f.pathname==="/api/databases/vitess/migrations/action"&&C.method==="POST"){let S=await v(C),L=String(S.uuid??"").trim(),I=String(S.action??"");if(!["retry","cancel","cleanup","complete"].includes(I))return O({ok:!1,error:"Unknown migration action."},422);return O(await Ff(n,M,L,I))}if(f.pathname==="/api/databases/vitess/keyspaces"&&C.method==="POST"){let S=await v(C),L=String(S.name??"").trim(),I=S.sharded===!0;return O(await Pf(n,M,L,{sharded:I}))}if(f.pathname==="/api/databases/vitess/vschema"&&C.method==="POST"){let S=await v(C),L=String(S.keyspace??"").trim(),I=typeof S.vschema==="string"?S.vschema:JSON.stringify(S.vschema??null);return O(await af(n,M,L,I))}if(f.pathname==="/api/databases/vitess/schema"&&C.method==="POST"){let S=await v(C),L=String(S.sql??"");return O(await jf(n,M,L))}if(f.pathname==="/api/databases/vitess/install-client"&&C.method==="POST")return O(await Xf(n,M));if(f.pathname==="/api/databases/backups"&&C.method==="GET")return O(await Uf(n,M));if(f.pathname==="/api/databases/backup"&&C.method==="POST"){let S=await v(C),L=String(S.database??"").trim();if(!gd(L))return O({ok:!1,error:"Database name must be a valid identifier."},422);if(S.confirm!==L)return O({ok:!1,error:`Type "${L}" to back up this database.`},409);return O(await Df(n,M,L))}if(f.pathname==="/api/databases/users"&&C.method==="POST"){let S=await v(C),L=String(S.username??"").trim(),I=String(S.password??""),D=String(S.database??"").trim()||void 0,g=S.access==="readonly"?"readonly":"all";if(!gd(L))return O({ok:!1,error:"Username must be a valid identifier."},422);if(!I)return O({ok:!1,error:"Password is required."},422);if(D&&!gd(D))return O({ok:!1,error:"Database must be a valid identifier."},422);return O({...await lf(n,M,{username:L,password:I,database:D,access:g}),username:L})}if(f.pathname==="/api/dashboard-data")return Kt=u.get(M)??await B(M),B(M),O(VL(Kt,{user:ir,slug:n.project.slug}));if(f.pathname==="/api/users"&&C.method==="GET")return O({ok:!0,users:Ge(e).map($c)});if(f.pathname==="/api/users"&&C.method==="POST"){let S=await v(C),L=String(S.username??"").trim();if(!Vh(L))return O({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let I=S.sites&&typeof S.sites==="object"?S.sites:{},D=new Set(Object.keys(n.sites??{})),g={};for(let[z,Y]of Object.entries(I)){if(!D.has(z))return O({ok:!1,error:`Site '${z}' was not found.`},404);if(Y!=="owner"&&Y!=="collaborator")return O({ok:!1,error:`Unknown site role '${Y}'. Use 'owner' or 'collaborator'.`},422);g[z]=Y}let X=typeof S.password==="string"&&S.password.trim()?S.password.trim():void 0;if(X&&X.length<12)return O({ok:!1,error:"Password must be at least 12 characters."},422);let y=k_(e,{username:L,password:X,name:typeof S.name==="string"?S.name:void 0,sites:g});return jh(T,Ge(e)),lt(),O({ok:!0,user:$c(y.user),password:y.password})}if(f.pathname==="/api/users"&&C.method==="DELETE"){let S=await v(C),L=String(S.username??"").trim();if(L.toLowerCase()===Q.username.toLowerCase())return O({ok:!1,error:"You cannot remove your own account."},409);let I=gr(Ge(e),L),D=I?T.store.getActorByExternalId("user",`dashboard:${I.username.toLowerCase()}`):void 0,g=D?T.store.getMembershipForActor(T.organization.id,D.id):void 0;if(g&&g.source!=="legacy")return O({ok:!1,error:"Organization members must be removed from Organization access."},409);let X=YL(e,L);if(!X.ok)return O(X,409);return jh(T,Ge(e)),s.clear(),O({ok:!0,username:L})}if(f.pathname==="/api/actions/run"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=S.action?$J(S.action,M):void 0;if(!L)return O({ok:!1,error:"Unknown dashboard action."},404);if(L.mutates&&S.confirm!==L.confirm)return O({ok:!1,error:`Type "${L.confirm}" to run this action.`},409);let I=await fd({controlPlane:T,environment:M,actor:Q,kind:`dashboard.action.${L.id}`,input:{action:L.id},execute:()=>du(L,{cwd:e,cliEntry:E})});return O({...I.result,controlPlaneOperation:I.operation})}if(f.pathname==="/api/server/operations/run"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=S.operation?GL(S.operation,n,Kt):void 0;if(!L)return O({ok:!1,error:"Unknown or unavailable server operation."},404);if(L.mutates&&S.confirm!==L.confirm)return O({ok:!1,error:`Type "${L.confirm}" to run this operation.`},409);let I=Hr(T,String(M));await new Ic(Ut).run(new Q_,{...I,artifactRoot:e});let D=ah(Ut,{scope:I,desiredConfigHash:T.project.desiredConfigHash});if(D.decision.outcome==="block")return O({ok:!1,error:`Operation blocked by security policy: ${D.decision.explanation}`,securityReview:D},409);let g=await fd({controlPlane:T,environment:M,actor:Q,kind:`dashboard.server.${L.id}`,resourceSlug:L.target,input:{operation:L.id,target:L.target,to:S.to??null},execute:()=>bh(n,M,L,{to:S.to})});return O({...g.result,controlPlaneOperation:g.operation,securityReview:D})}if(f.pathname==="/api/server/command"&&C.method==="POST"){let S=await C.json().catch(()=>({}));if(S.confirm!=="run")return O({ok:!1,error:'Type "run" to execute this command on the server.'},409);let L=await fd({controlPlane:T,environment:M,actor:Q,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>b_(n,M,String(S.command??""))});return O({...L.result,controlPlaneOperation:L.operation})}if(f.pathname==="/api/serverless/operations")return O(xL(n,M,Kt));if(f.pathname==="/api/serverless/operations/run"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=S.operation?Nw(S.operation,n,M,Kt):void 0;if(!L)return O({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(L.mutates&&S.confirm!==L.confirm)return O({ok:!1,error:`Type "${L.confirm}" to run this operation.`},409);let I=await fd({controlPlane:T,environment:M,actor:Q,kind:`dashboard.serverless.${L.id}`,input:{operation:L.id,min:S.min??null,max:S.max??null},execute:()=>Aw(n,M,L,{min:S.min,max:S.max})});return Kt=await cn(n,M),u.set(M,Kt),O({...I.result,controlPlaneOperation:I.operation})}if(f.pathname==="/api/serverless/command"&&C.method==="POST"){let S=await C.json().catch(()=>({}));if(S.confirm!=="run")return O({ok:!1,error:'Type "run" to execute this command.'},409);return O(await Lw(n,M,String(S.command??"")))}if(f.pathname==="/api/serverless/dlq"&&C.method==="GET"){let S=Number(f.searchParams.get("max"))||10;return O(await uw(n,M,S))}if(f.pathname==="/api/serverless/dlq/redrive"&&C.method==="POST"){let S=await C.json().catch(()=>({}));if(S.confirm!=="redrive")return O({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return O(await Ow(n,M,{max:S.max,targetQueue:S.targetQueue}))}if(f.pathname==="/api/serverless/dlq/purge"&&C.method==="POST"){if((await C.json().catch(()=>({}))).confirm!=="purge")return O({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return O(await Cw(n,M))}if(f.pathname==="/api/serverless/secrets"&&C.method==="GET")return O({secrets:Iw(n,M)});if(f.pathname==="/api/serverless/secrets"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=String(S.secretId??"").trim();if(!L)return O({ok:!1,error:"A secret id is required."},422);if(typeof S.value!=="string"||S.value==="")return O({ok:!1,error:"A non-empty value is required."},422);return O(await lw(n,M,L,S.value))}if(f.pathname==="/api/serverless/secrets"&&C.method==="DELETE"){let S=await C.json().catch(()=>({})),L=String(S.secretId??"").trim();if(!L)return O({ok:!1,error:"A secret id is required."},422);if(S.confirm!==L)return O({ok:!1,error:`Type "${L}" to delete this secret.`},409);return O(await Dw(n,M,L))}if(f.pathname==="/api/serverless/functions/config"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=String(S.mode??"").trim();if(S.confirm!==L)return O({ok:!1,error:`Type "${L}" to update this function.`},409);return O(await Uw(n,M,L,{memory:S.memory,timeout:S.timeout}))}if(f.pathname==="/api/serverless/alarms"&&C.method==="GET")return O(await fw(n,M));if(f.pathname==="/api/serverless/alarms"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=String(S.preset??"").trim(),I=Number(S.threshold);if(!L)return O({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(I))return O({ok:!1,error:"A numeric threshold is required."},422);return O(await ww(n,M,L,I))}if(f.pathname==="/api/serverless/alarms"&&C.method==="DELETE"){let S=await C.json().catch(()=>({})),L=String(S.name??"").trim();if(!L)return O({ok:!1,error:"An alarm name is required."},422);if(S.confirm!==L)return O({ok:!1,error:`Type "${L}" to delete this alarm.`},409);return O(await gw(n,M,L))}if(f.pathname==="/api/serverless/traces"&&C.method==="GET"){let S=Number(f.searchParams.get("minutes"))||30;return O(await qh(n,M,S))}if(f.pathname==="/api/serverless/scheduler"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=String(S.action??"").trim();if(L!=="enable"&&L!=="disable"&&L!=="run")return O({ok:!1,error:"Unknown scheduler action."},422);if(S.confirm!==L)return O({ok:!1,error:`Type "${L}" to ${L} the scheduler.`},409);return O(await oL(n,M,L))}if(!ow(f.pathname,ir))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(M)}`}});let Sn=await $(Q,M);if(!Sn)return tR("ts-cloud dashboard UI is unavailable.",503);return mw(Sn,f.pathname)}catch(AE){if(t.verbose)console.error(AE);return O({ok:!1,error:AE?.message??String(AE)},500)}})();if(!ee)return ee;if(Ht&&(f.pathname.startsWith("/api/")||f.pathname.startsWith("/auth/"))){let Ot;if((m.headers.get("content-type")||"").includes("application/json"))Ot=await m.json().catch(()=>{return});let Ce=bt.resolveUser(C),Se=Ce?ct(Ce).actor:void 0;T.store.appendEvent({organizationId:T.organization.id,projectId:T.project.id,actorId:Se?.id,correlationId:Rt,type:ee.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:ee.status<400?"info":"warning",payload:hJ(C.method,f.pathname,Ot,ee.status,Date.now()-Tt)})}return ee.headers.set("x-request-id",Rt),ee}});eT?.start();let Ng=hn.stop.bind(hn);return hn.stop=(C)=>{clearInterval(lu),clearInterval(Du),clearInterval(Uu),clearInterval(Iu),clearInterval(Cu),clearInterval(Au),clearInterval(Lu),clearInterval(uu),clearInterval(Ou),lt(),Ee.clear(),eT?.stop();let p=Ng(C);if(eT)eT.settled().finally(()=>T.store.close());else T.store.close();return p},{server:hn,url:`http://${r}:${hn.port}/`}}function nu(t){let e=p_.argv.indexOf(t);return e===-1?void 0:p_.argv[e+1]}function dg(t){return p_.argv.includes(t)}async function zJ(){let t=await rg({host:nu("--host")??"127.0.0.1",port:Number(nu("--port")??7676),environment:nu("--env"),box:dg("--box"),verbose:dg("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${t.url}`),await new Promise((e)=>{let r=()=>{t.server.stop(!0),e()};p_.once("SIGINT",r),p_.once("SIGTERM",r)})}zJ();
+`);return new Response(Ct,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(f.pathname==="/api/telemetry/saved-queries"&&C.method==="GET"){let Z=ct(Q);return O({ok:!0,queries:L.listSavedQueries(T.project.id,Z.actor?.id)})}if(f.pathname==="/api/telemetry/saved-queries"&&C.method==="POST"){let Z=await v(C),_t=ct(Q);return O({ok:!0,query:L.saveQuery(T.project.id,_t.actor?.id,String(Z.name??""),z(Z.query??Z))},201)}if(f.pathname==="/api/telemetry/saved-queries"&&C.method==="DELETE"){let Z=await v(C),_t=ct(Q),G=L.deleteSavedQuery(T.project.id,_t.actor?.id,String(Z.id??""));return O({ok:G},G?200:404)}}if(f.pathname.startsWith("/api/configuration")){let S=T.environments.get(M),L=Q.role==="admin"||!!ir.capabilities?.includes("secrets:read"),I=Q.role==="admin"||!!ir.capabilities?.includes("secrets:write"),D={projectId:T.project.id,environmentId:S?.id},g={"cache-control":"no-store"};if(f.pathname==="/api/configuration"&&C.method==="GET"){let X=Object.fromEntries(f.searchParams),y=X.scopeType||X.scopeId?Xc(X,D):void 0,z=["variable","secret"].includes(String(X.kind))?X.kind:void 0,Y=y?.type==="preview"?pt.previews.getInstance(y.id):void 0,k=Y?pt.previews.getDefinition(Y.definitionId):void 0,$t=y?await Ke.resolve({projectId:T.project.id,environmentId:y.environmentId,resourceId:y.resourceId,functionId:y.type==="function"?y.id:void 0,previewId:y.previewId,trustedPreview:!!Y&&!Y.fork,allowedPreviewSecrets:k?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:L}):void 0,Z=T.store.listResources(T.project.id);return O({ok:!0,entries:Ke.list({projectId:T.project.id,scope:y,kind:z,search:X.search,canReadSecretMetadata:L}),effectiveEntries:$t?Object.values($t.entries).filter((_t)=>!z||_t.kind===z).filter((_t)=>!X.search||_t.key.toLowerCase().includes(String(X.search).toLowerCase())):[],configurationHash:$t?.configurationHash,warnings:$t?.warnings??[],scopes:{project:T.project,environments:T.store.listEnvironments(T.project.id),resources:Z.filter((_t)=>_t.kind!=="function"),functions:Z.filter((_t)=>_t.kind==="function"),previews:pt.previews.listInstances({projectId:T.project.id}).filter((_t)=>_t.status!=="destroyed").map((_t)=>({id:_t.id,name:_t.name,environmentId:_t.baseEnvironmentId,resourceId:_t.resourceId,fork:_t.fork,status:_t.status}))}},200,g)}if(f.pathname==="/api/configuration/export"&&C.method==="GET"){let X=Xc(Object.fromEntries(f.searchParams),D);return new Response(Ke.exportVariables({projectId:T.project.id,scope:X}),{headers:{...g,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(f.pathname==="/api/configuration/plan"&&C.method==="POST"){let X=await v(C),y=Xc(X,D),z=X.values&&typeof X.values==="object"&&!Array.isArray(X.values)?Object.fromEntries(Object.entries(X.values).map(([Y,k])=>[Y,String(k)])):{};return O({ok:!0,plan:Ke.plan({projectId:T.project.id,scope:y,values:z,removeMissing:X.removeMissing===!0})},200,g)}if(f.pathname==="/api/configuration"&&C.method==="POST"){let X=await v(C),y=Xc(X,D),z=X.kind==="secret"?"secret":"variable",Y=String(X.key??"");if(z==="secret"&&!I)return O({ok:!1,error:"Secret write permission is required."},403,g);try{let k=await Ke.set({organizationId:T.organization.id,projectId:T.project.id,scope:y,key:Y,kind:z,value:X.value==null?void 0:String(X.value),reference:X.reference==null?void 0:String(X.reference),backend:X.backend,required:X.required===!0,expectedVersion:X.expectedVersion==null?void 0:Number(X.expectedVersion),confirmed:String(X.confirm??"")===Y,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:ct(Q).actor?.id});return O({ok:!0,entry:Ke.list({projectId:T.project.id,scope:y,canReadSecretMetadata:L}).find(($t)=>$t.id===k.entry.id),mutation:k.mutation,warnings:k.warnings},k.mutation.added.length?201:200,g)}catch(k){return O({ok:!1,error:k instanceof Error?k.message:String(k)},409,g)}}if(f.pathname==="/api/configuration/import"&&C.method==="POST"){let X=await v(C),y=Xc(X,D),z=Array.isArray(X.secretKeys)?X.secretKeys.map(String):[];if(z.length&&!I)return O({ok:!1,error:"Secret write permission is required."},403,g);try{let Y=await Ke.importDotenv({organizationId:T.organization.id,projectId:T.project.id,scope:y,source:String(X.source??""),secretKeys:z,backend:X.backend,confirmed:X.confirm==="import",idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:ct(Q).actor?.id});return O({ok:Y.document.valid,diagnostics:Y.document.diagnostics,mutation:Y.mutation,warnings:Y.warnings},Y.document.valid?200:422,g)}catch(Y){return O({ok:!1,error:Y instanceof Error?Y.message:String(Y)},409,g)}}if(f.pathname==="/api/configuration/dependencies"&&C.method==="POST"){let X=await v(C),y=yd.get(String(X.entryId??"")),z=T.store.getResource(String(X.resourceId??""));if(!y||y.projectId!==T.project.id||!z||z.projectId!==T.project.id)return O({ok:!1,error:"Configuration entry or dependent resource was not found."},404,g);return O({ok:!0,dependency:yd.setDependency({entryId:y.id,resourceId:z.id,injectionTarget:["native_reference","file"].includes(String(X.injectionTarget))?X.injectionTarget:"environment",required:X.required!==!1,requiresRedeploy:X.requiresRedeploy!==!1,lastDeployedVersion:X.lastDeployedVersion==null?void 0:Number(X.lastDeployedVersion)})},200,g)}if(f.pathname==="/api/configuration/transfer"&&C.method==="POST"){let X=await v(C),y=yd.get(String(X.id??"")),z=Xc({...X,scopeType:X.targetScopeType,scopeId:X.targetScopeId},D);if(!y||y.projectId!==T.project.id)return O({ok:!1,error:"Configuration entry was not found."},404,g);if(y.kind==="secret"&&!I)return O({ok:!1,error:"Secret write permission is required."},403,g);try{let Y=await Ke.transfer({entryId:y.id,targetScope:z,mode:X.mode==="move"?"move":"copy",confirmed:X.confirm===y.key,actorId:ct(Q).actor?.id,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey});return O({ok:!0,entry:Ke.list({projectId:T.project.id,scope:z,canReadSecretMetadata:L}).find((k)=>k.id===Y.entry.id),mutation:Y.mutation},200,g)}catch(Y){return O({ok:!1,error:Y instanceof Error?Y.message:String(Y)},409,g)}}if(f.pathname==="/api/configuration/bulk"&&C.method==="POST"){let X=await v(C),y=Array.isArray(X.ids)?X.ids.map(String).slice(0,500):[],z=y.map((k)=>yd.get(k)).filter((k)=>!!k&&k.projectId===T.project.id);if(z.length!==y.length)return O({ok:!1,error:"One or more configuration entries were not found."},404,g);if(z.some((k)=>k.kind==="secret")&&!I)return O({ok:!1,error:"Secret write permission is required."},403,g);if(X.action!=="delete"||X.confirm!=="bulk")return O({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,g);let Y=[];try{for(let k of z)Y.push(await Ke.remove({entryId:k.id,expectedVersion:k.version,confirmed:!0,actorId:ct(Q).actor?.id}));return O({ok:!0,removed:Y.flatMap((k)=>k.removed),affectedResourceIds:[...new Set(Y.flatMap((k)=>k.affectedResourceIds))].sort()},200,g)}catch(k){return O({ok:!1,error:k instanceof Error?k.message:String(k),partial:Y.flatMap(($t)=>$t.removed)},409,g)}}if(f.pathname==="/api/configuration/reveal"&&C.method==="POST"){let X=await v(C),y=bt.resolveSession(C);try{return O({ok:!0,value:await Ke.reveal({entryId:String(X.id??""),canRevealSecrets:L,recentlyAuthenticated:!o||!!y&&b.isRecentlyAuthenticated(y),actorId:ct(Q).actor?.id})},200,g)}catch(z){return O({ok:!1,error:z instanceof Error?z.message:String(z)},403,g)}}if(f.pathname==="/api/configuration"&&C.method==="DELETE"){let X=await v(C),y=yd.get(String(X.id??""));if(y?.kind==="secret"&&!I)return O({ok:!1,error:"Secret write permission is required."},403,g);if(!y||y.projectId!==T.project.id)return O({ok:!1,error:"Configuration entry was not found."},404,g);try{return O({ok:!0,mutation:await Ke.remove({entryId:y.id,expectedVersion:Number(X.expectedVersion),confirmed:String(X.confirm??"")===y.key,actorId:ct(Q).actor?.id})},200,g)}catch(z){return O({ok:!1,error:z instanceof Error?z.message:String(z)},409,g)}}}if(f.pathname.startsWith("/api/fleet")){let S=ct(Q).actor?.id,L=(I,D=409)=>O({ok:!1,error:I instanceof Error?I.message:String(I)},D,{"cache-control":"no-store"});if(f.pathname==="/api/fleet"&&C.method==="GET")return O({ok:!0,servers:jc.list(T.project.id),resources:T.store.listResources(T.project.id),operations:st.list({projectId:T.project.id,limit:200}).filter((I)=>I.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(f.pathname==="/api/fleet"&&C.method==="POST"){let I=await v(C);try{return O({ok:!0,server:vr.enroll({organizationId:T.organization.id,projectId:T.project.id,name:String(I.name??""),provider:["aws","hetzner"].includes(String(I.provider))?I.provider:"ssh",providerId:I.providerId?String(I.providerId):void 0,region:I.region?String(I.region):void 0,zone:I.zone?String(I.zone):void 0,endpoint:String(I.endpoint??""),sshUser:String(I.sshUser??"deploy"),sshPort:I.sshPort?Number(I.sshPort):22,credentialRef:String(I.credentialRef??""),roles:Array.isArray(I.roles)?I.roles:[],labels:I.labels&&typeof I.labels==="object"?I.labels:{}})},201)}catch(D){return L(D,422)}}if(f.pathname==="/api/fleet/action"&&C.method==="POST"){let I=await v(C),D=String(I.id??""),g=String(I.action??"");try{if(g==="test")return O({ok:!0,server:await vr.test(D)});if(g==="validate")return O({ok:!0,server:await vr.validate(D)});if(g==="review_host_key")return O({ok:!0,server:vr.reviewHostKey(D,String(I.fingerprint??""))});if(g==="bootstrap")return O({ok:!0,...vr.bootstrap(D,I.confirmed===!0)},I.confirmed===!0?202:200);if(g==="heartbeat")return O({ok:!0,server:vr.heartbeat(D,{usage:I.usage&&typeof I.usage==="object"?I.usage:{}})});if(g==="drain")return O({ok:!0,server:vr.drain(D,I.completed===!0)});if(g==="uncordon")return O({ok:!0,server:vr.uncordon(D)});if(g==="archive")return O({ok:!0,server:vr.archive(D,String(I.confirmation??""))});return L("Unsupported fleet action.",422)}catch(X){return L(X)}}}if(f.pathname.startsWith("/api/capacity")){let S=(L,I=409)=>O({ok:!1,error:L instanceof Error?L.message:String(L)},I,{"cache-control":"no-store"});if(f.pathname==="/api/capacity"&&C.method==="GET")return O({ok:!0,pools:Pd.listPools(T.project.id),placements:Pd.listPlacements(T.project.id),servers:jc.list(T.project.id)},200,{"cache-control":"no-store"});if(f.pathname==="/api/capacity"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,pool:Pd.createPool({organizationId:T.organization.id,projectId:T.project.id,name:String(L.name??""),purpose:String(L.purpose??"application"),backend:String(L.backend??"server"),region:L.region?String(L.region):void 0,architecture:L.architecture?String(L.architecture):void 0,labels:L.labels&&typeof L.labels==="object"?L.labels:{},requiredServerLabels:L.requiredServerLabels&&typeof L.requiredServerLabels==="object"?L.requiredServerLabels:{},toleratedTaints:Array.isArray(L.toleratedTaints)?L.toleratedTaints.map(String):[],capacity:L.capacity&&typeof L.capacity==="object"?L.capacity:{},maxWorkloads:Number(L.maxWorkloads??10),costWeight:Number(L.costWeight??1),spreadKey:L.spreadKey?String(L.spreadKey):void 0,concurrency:Number(L.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(I){return S(I,422)}}if(f.pathname==="/api/capacity/member"&&C.method==="POST"){let L=await v(C);try{return Pd.addMember(String(L.poolId??""),String(L.serverId??"")),O({ok:!0,pool:Pd.getPool(String(L.poolId??""))})}catch(I){return S(I,422)}}if(f.pathname==="/api/capacity/explain"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,decisions:iu.explain(T.project.id,{purpose:String(L.purpose??"application"),resources:L.resources&&typeof L.resources==="object"?L.resources:{},region:L.region?String(L.region):void 0,architecture:L.architecture?String(L.architecture):void 0,labels:L.labels&&typeof L.labels==="object"?L.labels:{}})})}catch(I){return S(I,422)}}if(f.pathname==="/api/capacity/action"&&C.method==="POST"){let L=await v(C);try{if(L.action==="drain")return O({ok:!0,...iu.drainPool(String(L.poolId??""))});if(L.action==="enable")return O({ok:!0,pool:Pd.updatePool(String(L.poolId??""),{status:"active"})});if(L.action==="disable")return O({ok:!0,pool:Pd.updatePool(String(L.poolId??""),{status:"disabled"})});return S("Unsupported capacity action.",422)}catch(I){return S(I,422)}}}if(f.pathname.startsWith("/api/regions")){let S=(L,I=409)=>O({ok:!1,error:L instanceof Error?L.message:String(L)},I,{"cache-control":"no-store"});if(f.pathname==="/api/regions"&&C.method==="GET")return O({ok:!0,topologies:NE.list(T.project.id).map((L)=>({topology:L,targets:NE.targets(L.id),channels:NE.channels(L.id),route:NE.route(L.id),executions:NE.executions(L.id)}))},200,{"cache-control":"no-store"});if(f.pathname==="/api/regions"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,topology:hu.create({organizationId:T.organization.id,projectId:T.project.id,environmentId:T.environments.get(M)?.id,name:String(L.name??""),hostname:String(L.hostname??""),regions:Array.isArray(L.regions)?L.regions:[],trafficPolicy:L.trafficPolicy==="weighted"||L.trafficPolicy==="latency"?L.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(L.replicate)?L.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(L.maxLagSeconds??30),retainOnDestroy:L.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:L.cdnEnabled===!0,wafEnabled:L.wafEnabled===!0})},201)}catch(I){return S(I,422)}}if(f.pathname==="/api/regions/action"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,...hu.enqueue({topologyId:String(L.topologyId??""),kind:String(L.action??""),targetRegion:L.targetRegion?String(L.targetRegion):void 0,revision:L.revision?String(L.revision):void 0,manifest:L.manifest&&typeof L.manifest==="object"?L.manifest:{},confirmation:L.confirmation?String(L.confirmation):void 0,deleteData:L.deleteData===!0})},202)}catch(I){return S(I,422)}}}if(f.pathname.startsWith("/api/maintenance")){let S=(L,I=409)=>O({ok:!1,error:L instanceof Error?L.message:String(L)},I,{"cache-control":"no-store"});if(f.pathname==="/api/maintenance"&&C.method==="GET")return O({ok:!0,manifests:rd.manifests(T.organization.id),windows:rd.windows(T.project.id),campaigns:rd.campaigns(T.project.id).map((L)=>({campaign:L,targets:rd.targets(L.id)})),cleanups:rd.cleanups(T.project.id),drills:rd.drills(T.project.id)},200,{"cache-control":"no-store"});if(f.pathname==="/api/maintenance/cleanup-preview"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,plan:await ER.previewCleanup({projectId:T.project.id,kind:String(L.kind??"operations"),criteria:{olderThanDays:Number(L.olderThanDays??30)}},Ru)},201)}catch(I){return S(I,422)}}if(f.pathname==="/api/maintenance/cleanup-apply"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,...ER.enqueueCleanup(String(L.planId??""),String(L.confirmation??""))},202)}catch(I){return S(I,422)}}if(f.pathname==="/api/maintenance/drill"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,drill:rd.createDrill({projectId:T.project.id,scenario:String(L.scenario??"control_plane"),isolatedTarget:String(L.isolatedTarget??""),expectedRpoMinutes:Number(L.expectedRpoMinutes??60),expectedRtoMinutes:Number(L.expectedRtoMinutes??30),recoveryPointId:L.recoveryPointId?String(L.recoveryPointId):void 0,topologyId:L.topologyId?String(L.topologyId):void 0})},201)}catch(I){return S(I,422)}}if(f.pathname==="/api/maintenance/drill-run"&&C.method==="POST"){let L=await v(C);try{return O({ok:!0,...ER.enqueueDrill(String(L.drillId??""))},202)}catch(I){return S(I,422)}}}if(f.pathname.startsWith("/api/volumes")){let S=T.environments.get(M),L=ct(Q).actor?.id,I=(D,g=409)=>O({ok:!1,error:D instanceof Error?D.message:String(D)},g,{"cache-control":"no-store"});if(f.pathname==="/api/volumes"&&C.method==="GET"){let D=rR.inventory(T.project.id,S?.id),g=T.store.listResources(T.project.id,S?.id).map((X)=>({id:X.id,name:X.name,slug:X.slug,kind:X.kind,provider:X.provider,providerId:X.providerId}));return O({ok:!0,volumes:D,resources:g,operations:st.list({projectId:T.project.id,limit:100}).filter((X)=>X.operation.kind.startsWith("volume.")),recoveryPoints:de.listRecoveryPoints(T.project.id).filter((X)=>X.kind==="volume"),providers:dR.map((X)=>({provider:X.provider,type:X.type,capabilities:X.capabilities()}))},200,{"cache-control":"no-store"})}if(f.pathname==="/api/volumes"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,...ed.create({organizationId:T.organization.id,projectId:T.project.id,environmentId:S?.id,resourceId:D.resourceId?String(D.resourceId):void 0,name:String(D.name??""),provider:String(D.provider??"docker"),type:D.type==="docker"?"docker":D.type,capacityBytes:D.capacityBytes==null?void 0:Number(D.capacityBytes),filesystem:D.filesystem?String(D.filesystem):void 0,encrypted:D.encrypted===!0,desiredState:D.desiredState&&typeof D.desiredState==="object"?D.desiredState:{},actorId:L})},202,{"cache-control":"no-store"})}catch(g){return I(g,422)}}if(f.pathname==="/api/volumes/attach"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,...ed.attach(String(D.volumeId??""),{resourceId:String(D.resourceId??""),targetPath:String(D.targetPath??""),readOnly:D.readOnly===!0,uid:D.uid==null?void 0:Number(D.uid),gid:D.gid==null?void 0:Number(D.gid),mode:D.mode?String(D.mode):void 0,propagation:D.propagation,driverOptions:D.driverOptions&&typeof D.driverOptions==="object"?D.driverOptions:{},actorId:L})},202)}catch(g){return I(g,422)}}if(f.pathname==="/api/volumes/detach"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,...ed.detach(String(D.volumeId??""),String(D.attachmentId??""),{force:D.force===!0,drained:D.drained===!0,unmounted:D.unmounted===!0,confirmation:D.confirmation?String(D.confirmation):void 0,actorId:L})},202)}catch(g){return I(g)}}if(f.pathname==="/api/volumes/resize"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,...ed.resize(String(D.volumeId??""),Number(D.capacityBytes),{drained:D.drained===!0,actorId:L})},202)}catch(g){return I(g,422)}}if(f.pathname==="/api/volumes/snapshot"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,...ed.snapshot(String(D.volumeId??""),{name:D.name?String(D.name):void 0,actorId:L})},202)}catch(g){return I(g,422)}}if(f.pathname==="/api/volumes/restore"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,...ed.restore(String(D.snapshotId??""),{name:String(D.name??""),actorId:L})},202)}catch(g){return I(g,422)}}if(f.pathname==="/api/volumes/discover"&&C.method==="POST")try{return O({ok:!0,volumes:await ed.discover({organizationId:T.organization.id,projectId:T.project.id,environmentId:S?.id,actorId:L})})}catch(D){return I(D,502)}if(f.pathname==="/api/volumes/adopt"&&C.method==="POST"){let D=await v(C);try{return O({ok:!0,volume:ed.adopt(String(D.volumeId??""),{name:String(D.name??""),actorId:L})})}catch(g){return I(g,422)}}if(f.pathname==="/api/volumes"&&C.method==="DELETE"){let D=await v(C),g=bt.resolveSession(C);try{return O({ok:!0,...ed.delete(String(D.volumeId??""),{recentAuthAt:!o||g&&b.isRecentlyAuthenticated(g)?new Date().toISOString():void 0,confirmation:D.confirmation?String(D.confirmation):void 0,backupOverride:D.backupOverride===!0,backupOverrideConfirmation:D.backupOverrideConfirmation?String(D.backupOverrideConfirmation):void 0,actorId:L})},202)}catch(X){return I(X)}}}if(f.pathname==="/api/backups"&&C.method==="GET"){let S=T.environments.get(M),L=de.listPolicies(T.project.id,S?.id),I=new Set(L.map((z)=>z.id)),D=de.listRecoveryPoints(T.project.id).filter((z)=>!z.policyId||I.has(z.policyId)),g=de.listJobs(T.project.id).filter((z)=>!z.policyId||I.has(z.policyId)),X=(z)=>({...z,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!z.credentialRef,clientEncryptionConfigured:!!z.encryptionKeyRef}),y=await Promise.all(de.listDestinations(T.project.id).map(async(z)=>({...X(z),credentialStatus:await AI(z,td)})));return O({ok:!0,destinations:y,policies:L,recoveryPoints:D,jobs:g,coverage:de.coverage(T.project.id).filter((z)=>I.has(z.policy.id)),resources:S?T.store.listResources(T.project.id,S.id).map((z)=>({id:z.id,name:z.name,slug:z.slug,kind:z.kind})):[]})}if(f.pathname==="/api/backups/destinations"&&C.method==="POST"){let S=await v(C),L=String(S.name??"").trim(),I=String(S.provider??""),D=String(S.encryption??"provider"),g=`secret://data-services/backups/${T.project.id}/${L}`,X=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(I))return O({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(D))return O({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let y,z;if(S.credentials&&typeof S.credentials==="object"&&!Array.isArray(S.credentials))y=`${g}/credentials`,await td.put(y,JSON.stringify(S.credentials)),X.push(y);if(D!=="provider"){let k=String(S.encryptionKey??"");if(k.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");z=`${g}/encryption-key`,await td.put(z,k),X.push(z)}let Y=de.createDestination({organizationId:T.organization.id,projectId:T.project.id,name:L,provider:I,endpoint:S.endpoint?String(S.endpoint):void 0,endpointPolicy:S.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:S.bucket?String(S.bucket):void 0,prefix:String(S.prefix??""),region:S.region?String(S.region):Xd,forcePathStyle:S.forcePathStyle===!0,credentialRef:y,encryption:D,encryptionKeyRef:z,immutability:S.immutability&&typeof S.immutability==="object"&&!Array.isArray(S.immutability)?S.immutability:{},status:"untested"});return O({ok:!0,destination:{...Y,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!y,clientEncryptionConfigured:!!z}},201)}catch(y){for(let z of X)await td.remove(z).catch(()=>{});return O({ok:!1,error:y instanceof Error?y.message:String(y)},422)}}if(f.pathname==="/api/backups/destinations/test"&&C.method==="POST"){let S=await v(C),L=de.getDestination(String(S.id??""));if(!L||L.projectId!==T.project.id)return O({ok:!1,error:"Backup destination was not found."},404);if(L.provider==="aws_backup")return O({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await Tu.test(L),O({ok:!0,destination:de.recordDestinationTest(L.id,{ok:!0})})}catch(I){let D=I instanceof Error?I.message:String(I);return de.recordDestinationTest(L.id,{ok:!1,error:D}),O({ok:!1,error:D},502)}}if(f.pathname==="/api/backups/policies"&&C.method==="POST"){let S=await v(C),L=T.environments.get(M),I=de.getDestination(String(S.destinationId??"")),D=String(S.resourceKind??""),g=S.dataServiceId?String(S.dataServiceId):void 0,X=g?te.get(g):void 0,y=S.resourceId?String(S.resourceId):void 0,z=y?T.store.getResource(y):void 0;if(!L)return O({ok:!1,error:"Environment was not found."},404);if(!I||I.projectId!==T.project.id)return O({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(D))return O({ok:!1,error:"A supported backup resource kind is required."},422);if(g&&(!X||X.projectId!==T.project.id||X.environmentId!==L.id))return O({ok:!1,error:"Data service was not found in this environment."},404);if(y&&(!z||z.projectId!==T.project.id||z.environmentId!==L.id))return O({ok:!1,error:"Resource was not found in this environment."},404);if(D==="managed_database"&&!X)return O({ok:!1,error:"Managed database policies require a data service."},422);if(D==="logical_database"&&(!X||!["container","server"].includes(X.provider)))return O({ok:!1,error:"Logical database policies require an on-box data service."},422);if(D==="volume"&&(!z||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(S.volumeName??""))))return O({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let Y=Array.isArray(S.includePatterns)?S.includePatterns.map(String).filter(Boolean):[];if(D==="files"&&(!z||!Y.length))return O({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(D==="control_plane"&&I.encryption==="provider")return O({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(D==="infrastructure"&&(I.provider!=="aws_backup"||!Y.some((k)=>k.startsWith("resource:arn:"))||!Y.some((k)=>k.startsWith("role:arn:"))))return O({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let k=de.createPolicy({organizationId:T.organization.id,projectId:T.project.id,environmentId:L.id,resourceId:y,dataServiceId:g,destinationId:I.id,name:String(S.name??"").trim(),resourceKind:D,schedule:String(S.schedule??"daily"),timezone:String(S.timezone??"UTC"),retention:S.retention&&typeof S.retention==="object"&&!Array.isArray(S.retention)?S.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(S.compression))?S.compression:"gzip",encryption:["destination","client_side","both"].includes(String(S.encryption))?S.encryption:"destination",includePatterns:D==="volume"?[String(S.volumeName),...Y]:Y,excludePatterns:Array.isArray(S.excludePatterns)?S.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(S.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(S.expectedRtoMinutes)||120),healthCheckId:S.healthCheckId?String(S.healthCheckId):void 0,enabled:S.enabled!==!1});return O({ok:!0,policy:k},201)}catch(k){return O({ok:!1,error:k instanceof Error?k.message:String(k)},422)}}if(f.pathname==="/api/backups/run"&&C.method==="POST"){let S=await v(C),L=de.getPolicy(String(S.policyId??"")),I=T.environments.get(M);if(!L||L.projectId!==T.project.id||L.environmentId!==I?.id)return O({ok:!1,error:"Backup policy was not found in this environment."},404);try{let D=SE.enqueueBackup(L,new Date().toISOString(),ct(Q).actor?.id);return O({ok:!0,job:D},202)}catch(D){return O({ok:!1,error:D instanceof Error?D.message:String(D)},409)}}if(f.pathname==="/api/backups/verify"&&C.method==="POST"){let S=await v(C),L=de.getRecoveryPoint(String(S.recoveryPointId??""));if(!L||L.projectId!==T.project.id)return O({ok:!1,error:"Recovery point was not found."},404);return O({ok:!0,job:SE.enqueueVerification(L)},202)}if(f.pathname==="/api/backups/restore"&&C.method==="POST"){let S=await v(C),L=de.getRecoveryPoint(String(S.recoveryPointId??"")),I=S.mode==="in_place"?"in_place":"isolated",D=S.target&&typeof S.target==="object"&&!Array.isArray(S.target)?{...S.target,inPlace:I==="in_place"}:{inPlace:I==="in_place"},g=bt.resolveSession(C),X={mode:I,target:D,targetName:String(S.targetName??""),confirm:S.confirm?String(S.confirm):void 0,recentAuth:!o||!!g&&b.isRecentlyAuthenticated(g),downtimeAcknowledged:S.downtimeAcknowledged===!0,safetyBackupId:S.safetyBackupId?String(S.safetyBackupId):void 0};if(!L||L.projectId!==T.project.id)return O({ok:!1,error:"Recovery point was not found."},404);if(S.drill===!0&&I!=="isolated")return O({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let y=SE.planRestore(L,X);if(S.execute!==!0)return O({ok:!0,plan:y,executionCreated:!1});let z=SE.enqueueRestore(L,{...X,drill:S.drill===!0,actorId:ct(Q).actor?.id});return O({ok:!0,plan:y,job:z},202)}catch(y){return O({ok:!1,error:y instanceof Error?y.message:String(y)},409)}}if(f.pathname==="/api/backups/recovery-points"&&C.method==="POST"){let S=await v(C),L=de.getRecoveryPoint(String(S.id??""));if(!L||L.projectId!==T.project.id)return O({ok:!1,error:"Recovery point was not found."},404);if(S.held==null&&S.pinned==null)return O({ok:!1,error:"held or pinned must be provided."},422);return O({ok:!0,recoveryPoint:de.updateRecoveryPoint(L.id,{held:S.held==null?L.held:S.held===!0,pinned:S.pinned==null?L.pinned:S.pinned===!0})})}if(f.pathname==="/api/backups/retention"&&C.method==="POST")return O({ok:!0,jobs:SE.enqueueRetention()},202);if(f.pathname==="/api/data-services/capabilities"&&C.method==="GET"){let S=String(f.searchParams.get("engine")??""),L=String(f.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(S)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(L))return O({ok:!1,error:"A supported engine and provider are required."},422);return O({ok:!0,engine:S,provider:L,capabilities:N_(S,L)})}if(f.pathname==="/api/data-services"&&C.method==="GET"){let S=T.environments.get(M),L=te.list(T.project.id,S?.id).map((I)=>{let D=te.credential(I.id);return{...I,credentialRef:void 0,credential:D?{configured:!0,username:D.username,version:D.version,rotatedAt:D.rotatedAt}:void 0,dependencies:te.dependencies(I.id).map((g)=>({resourceId:g.resourceId,requiresRedeploy:g.requiresRedeploy}))}});return O({ok:!0,services:L})}if(f.pathname==="/api/data-services/preview"&&C.method==="POST"){let S=await v(C);if(S.id){let D=te.get(String(S.id)),g=T.environments.get(M),X=String(S.action??"");if(!D||D.projectId!==T.project.id||D.environmentId!==g?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(!mh.includes(X))return O({ok:!1,error:`Action must be one of: ${mh.join(", ")}.`},422);try{return O({ok:!0,plan:tT.plan(D,X,S.changes??{})})}catch(y){return O({ok:!1,error:y instanceof Error?y.message:String(y)},422)}}let L=String(S.engine??""),I=String(S.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(L)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(I))return O({ok:!1,error:"A supported engine and provider are required."},422);return O({ok:!0,capabilities:N_(L,I),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(f.pathname==="/api/data-services"&&C.method==="POST"){let S=await v(C),L=String(S.engine??""),I=String(S.provider??""),D=T.environments.get(M),g=ct(Q);if(!D)return O({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(L)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(I))return O({ok:!1,error:"A supported engine and provider are required."},422);let X={organizationId:T.organization.id,projectId:T.project.id,environmentId:D.id,resourceId:S.resourceId?String(S.resourceId):void 0,name:String(S.name??"").trim(),engine:L,provider:I,placement:String(S.placement??S.name??"").trim(),engineVersion:S.engineVersion?String(S.engineVersion):void 0,plan:String(S.plan??(I==="aws_elasticache"?"cache.t4g.micro":I==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:S.storageGb==null?void 0:Number(S.storageGb),highAvailability:S.highAvailability===!0,publicExposure:S.publicExposure===!0,allowedCidrs:Array.isArray(S.allowedCidrs)?S.allowedCidrs.map(String):[],desiredState:S.desiredState&&typeof S.desiredState==="object"&&!Array.isArray(S.desiredState)?S.desiredState:{},observedState:{},origin:S.adopt===!0?"adopted":"managed",managementEnabled:S.adopt!==!0,ownerActorId:g.actor?.id,username:S.username?String(S.username):void 0};try{if(S.adopt===!0){let z=te.create({...X,status:"adopted",credentialRef:void 0});return O({ok:!0,service:z,readOnly:!0},201)}if(!_u({provider:I,engine:L}))return O({ok:!1,error:`No ${I}/${L} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let y=await tT.create(X);return O({ok:!0,service:y.service,operationId:y.operationId,oneTimeCredential:y.credential},201)}catch(y){return O({ok:!1,error:y instanceof Error?y.message:String(y)},422)}}if(f.pathname==="/api/data-services/connections"&&C.method==="GET"){let S=te.get(String(f.searchParams.get("id")??"")),L=T.environments.get(M);if(!S||S.projectId!==T.project.id||S.environmentId!==L?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);let I=typeof S.observedState.endpoint==="string"?S.observedState.endpoint:void 0,D=typeof S.observedState.readerEndpoint==="string"?S.observedState.readerEndpoint:void 0,g=Number(S.observedState.port)||(S.engine==="postgres"?5432:S.engine==="redis"?6379:S.engine==="mongodb"?27017:S.engine==="libsql"?8080:3306),X=typeof S.observedState.database==="string"?S.observedState.database:void 0,y=typeof S.observedState.tls==="boolean"?S.observedState.tls:S.provider.startsWith("aws_"),z=[...I?[{type:S.publicExposure?"external":"internal",host:I,port:g,database:X,tls:y}]:[],...D?[{type:"internal",host:D,port:g,database:X,tls:y}]:[],{type:"tunnel",host:I??S.placement,port:g,database:X,tls:y}];return O({ok:!0,serviceId:S.id,guidance:CI(S,z)})}if(f.pathname==="/api/data-services/action"&&C.method==="POST"){let S=await v(C),L=te.get(String(S.id??"")),I=T.environments.get(M),D=String(S.action??"");if(!L||L.projectId!==T.project.id||L.environmentId!==I?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(!mh.includes(D))return O({ok:!1,error:`Action must be one of: ${mh.join(", ")}.`},422);let g=S.changes&&typeof S.changes==="object"&&!Array.isArray(S.changes)?S.changes:{};try{let X=tT.plan(L,D,g);if(S.execute!==!0)return O({ok:!0,plan:X,productionExecutionCreated:!1});let y=tT.enqueue(L,D,g,ct(Q).actor?.id);return O({ok:!0,plan:X,operationId:y},202)}catch(X){return O({ok:!1,error:X instanceof Error?X.message:String(X)},409)}}if(f.pathname==="/api/data-services/dependencies"&&C.method==="POST"){let S=await v(C),L=te.get(String(S.id??"")),I=T.environments.get(M),D=T.store.getResource(String(S.resourceId??""));if(!L||L.projectId!==T.project.id||L.environmentId!==I?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(!D||D.projectId!==T.project.id||D.environmentId!==I?.id)return O({ok:!1,error:"Dependent resource was not found in this environment."},404);if(S.remove===!0)return O({ok:te.removeDependency(L.id,D.id)});return te.addDependency({serviceId:L.id,resourceId:D.id,secretRef:L.credentialRef??`secret://data-services/${L.projectId}/${L.name}`,requiresRedeploy:S.requiresRedeploy!==!1}),O({ok:!0,dependencies:te.dependencies(L.id).map((g)=>({resourceId:g.resourceId,requiresRedeploy:g.requiresRedeploy}))})}if(f.pathname==="/api/data-services/management"&&C.method==="POST"){let S=await v(C),L=te.get(String(S.id??"")),I=T.environments.get(M);if(!L||L.projectId!==T.project.id||L.environmentId!==I?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(L.origin!=="adopted"||S.reviewed!==!0||S.confirm!==L.name)return O({ok:!1,error:`Enabling management requires reviewed=true and typing ${L.name}.`},409);return O({ok:!0,service:te.update(L.id,L.version,{managementEnabled:!0})})}if(f.pathname==="/api/data-services/reveal"&&C.method==="POST"){let S=await v(C),L=te.get(String(S.id??"")),I=T.environments.get(M),D=L?te.credential(L.id):void 0;if(!L||L.projectId!==T.project.id||L.environmentId!==I?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(!D)return O({ok:!1,error:"No managed credential is configured."},404);return O({ok:!0,credential:{username:D.username,password:await td.resolve(D.secretRef),version:D.version}},200,{"cache-control":"no-store"})}if(f.pathname==="/api/databases"&&C.method==="GET")return O(await Cf(n,M));if(f.pathname==="/api/databases"&&C.method==="POST"){let S=await v(C),L=String(S.name??"").trim();if(!gd(L))return O({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return O({...await If(n,M,L),name:L})}if(f.pathname==="/api/databases/vitess"&&C.method==="GET"){let S=await ff(n,M);return O({...S,unhealthy:wf(S.tablets),missingPrimary:gf(S)})}if(f.pathname==="/api/databases/vitess/provision"&&C.method==="POST"){let S=await v(C);try{return O(await Bf(n,M,{keyspace:String(S.keyspace??""),username:String(S.username??""),password:String(S.password??""),sharded:S.sharded===!0,confirm:String(S.confirm??"")}))}catch(L){return O({ok:!1,error:L instanceof Error?L.message:String(L)},422)}}if(f.pathname==="/api/databases/vitess/migrations"&&C.method==="GET"){let S=f.searchParams.get("keyspace")??void 0;return O(await zf(n,M,S))}if(f.pathname==="/api/databases/vitess/migrations/action"&&C.method==="POST"){let S=await v(C),L=String(S.uuid??"").trim(),I=String(S.action??"");if(!["retry","cancel","cleanup","complete"].includes(I))return O({ok:!1,error:"Unknown migration action."},422);return O(await Ff(n,M,L,I))}if(f.pathname==="/api/databases/vitess/keyspaces"&&C.method==="POST"){let S=await v(C),L=String(S.name??"").trim(),I=S.sharded===!0;return O(await Pf(n,M,L,{sharded:I}))}if(f.pathname==="/api/databases/vitess/vschema"&&C.method==="POST"){let S=await v(C),L=String(S.keyspace??"").trim(),I=typeof S.vschema==="string"?S.vschema:JSON.stringify(S.vschema??null);return O(await af(n,M,L,I))}if(f.pathname==="/api/databases/vitess/schema"&&C.method==="POST"){let S=await v(C),L=String(S.sql??"");return O(await jf(n,M,L))}if(f.pathname==="/api/databases/vitess/install-client"&&C.method==="POST")return O(await Xf(n,M));if(f.pathname==="/api/databases/backups"&&C.method==="GET")return O(await Uf(n,M));if(f.pathname==="/api/databases/backup"&&C.method==="POST"){let S=await v(C),L=String(S.database??"").trim();if(!gd(L))return O({ok:!1,error:"Database name must be a valid identifier."},422);if(S.confirm!==L)return O({ok:!1,error:`Type "${L}" to back up this database.`},409);return O(await Df(n,M,L))}if(f.pathname==="/api/databases/users"&&C.method==="POST"){let S=await v(C),L=String(S.username??"").trim(),I=String(S.password??""),D=String(S.database??"").trim()||void 0,g=S.access==="readonly"?"readonly":"all";if(!gd(L))return O({ok:!1,error:"Username must be a valid identifier."},422);if(!I)return O({ok:!1,error:"Password is required."},422);if(D&&!gd(D))return O({ok:!1,error:"Database must be a valid identifier."},422);return O({...await lf(n,M,{username:L,password:I,database:D,access:g}),username:L})}if(f.pathname==="/api/dashboard-data")return Kt=u.get(M)??await B(M),B(M),O(VL(Kt,{user:ir,slug:n.project.slug}));if(f.pathname==="/api/users"&&C.method==="GET")return O({ok:!0,users:Ge(e).map($c)});if(f.pathname==="/api/users"&&C.method==="POST"){let S=await v(C),L=String(S.username??"").trim();if(!Vh(L))return O({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let I=S.sites&&typeof S.sites==="object"?S.sites:{},D=new Set(Object.keys(n.sites??{})),g={};for(let[z,Y]of Object.entries(I)){if(!D.has(z))return O({ok:!1,error:`Site '${z}' was not found.`},404);if(Y!=="owner"&&Y!=="collaborator")return O({ok:!1,error:`Unknown site role '${Y}'. Use 'owner' or 'collaborator'.`},422);g[z]=Y}let X=typeof S.password==="string"&&S.password.trim()?S.password.trim():void 0;if(X&&X.length<12)return O({ok:!1,error:"Password must be at least 12 characters."},422);let y=k_(e,{username:L,password:X,name:typeof S.name==="string"?S.name:void 0,sites:g});return jh(T,Ge(e)),lt(),O({ok:!0,user:$c(y.user),password:y.password})}if(f.pathname==="/api/users"&&C.method==="DELETE"){let S=await v(C),L=String(S.username??"").trim();if(L.toLowerCase()===Q.username.toLowerCase())return O({ok:!1,error:"You cannot remove your own account."},409);let I=gr(Ge(e),L),D=I?T.store.getActorByExternalId("user",`dashboard:${I.username.toLowerCase()}`):void 0,g=D?T.store.getMembershipForActor(T.organization.id,D.id):void 0;if(g&&g.source!=="legacy")return O({ok:!1,error:"Organization members must be removed from Organization access."},409);let X=YL(e,L);if(!X.ok)return O(X,409);return jh(T,Ge(e)),s.clear(),O({ok:!0,username:L})}if(f.pathname==="/api/actions/run"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=S.action?$J(S.action,M):void 0;if(!L)return O({ok:!1,error:"Unknown dashboard action."},404);if(L.mutates&&S.confirm!==L.confirm)return O({ok:!1,error:`Type "${L.confirm}" to run this action.`},409);let I=await fd({controlPlane:T,environment:M,actor:Q,kind:`dashboard.action.${L.id}`,input:{action:L.id},execute:()=>du(L,{cwd:e,cliEntry:E})});return O({...I.result,controlPlaneOperation:I.operation})}if(f.pathname==="/api/server/operations/run"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=S.operation?GL(S.operation,n,Kt):void 0;if(!L)return O({ok:!1,error:"Unknown or unavailable server operation."},404);if(L.mutates&&S.confirm!==L.confirm)return O({ok:!1,error:`Type "${L.confirm}" to run this operation.`},409);let I=Hr(T,String(M));await new Ic(Ut).run(new Q_,{...I,artifactRoot:e});let D=ah(Ut,{scope:I,desiredConfigHash:T.project.desiredConfigHash});if(D.decision.outcome==="block")return O({ok:!1,error:`Operation blocked by security policy: ${D.decision.explanation}`,securityReview:D},409);let g=await fd({controlPlane:T,environment:M,actor:Q,kind:`dashboard.server.${L.id}`,resourceSlug:L.target,input:{operation:L.id,target:L.target,to:S.to??null},execute:()=>bh(n,M,L,{to:S.to})});return O({...g.result,controlPlaneOperation:g.operation,securityReview:D})}if(f.pathname==="/api/server/command"&&C.method==="POST"){let S=await C.json().catch(()=>({}));if(S.confirm!=="run")return O({ok:!1,error:'Type "run" to execute this command on the server.'},409);let L=await fd({controlPlane:T,environment:M,actor:Q,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>b_(n,M,String(S.command??""))});return O({...L.result,controlPlaneOperation:L.operation})}if(f.pathname==="/api/serverless/operations")return O(xL(n,M,Kt));if(f.pathname==="/api/serverless/operations/run"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=S.operation?Nw(S.operation,n,M,Kt):void 0;if(!L)return O({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(L.mutates&&S.confirm!==L.confirm)return O({ok:!1,error:`Type "${L.confirm}" to run this operation.`},409);let I=await fd({controlPlane:T,environment:M,actor:Q,kind:`dashboard.serverless.${L.id}`,input:{operation:L.id,min:S.min??null,max:S.max??null},execute:()=>Aw(n,M,L,{min:S.min,max:S.max})});return Kt=await cn(n,M),u.set(M,Kt),O({...I.result,controlPlaneOperation:I.operation})}if(f.pathname==="/api/serverless/command"&&C.method==="POST"){let S=await C.json().catch(()=>({}));if(S.confirm!=="run")return O({ok:!1,error:'Type "run" to execute this command.'},409);return O(await Lw(n,M,String(S.command??"")))}if(f.pathname==="/api/serverless/dlq"&&C.method==="GET"){let S=Number(f.searchParams.get("max"))||10;return O(await uw(n,M,S))}if(f.pathname==="/api/serverless/dlq/redrive"&&C.method==="POST"){let S=await C.json().catch(()=>({}));if(S.confirm!=="redrive")return O({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return O(await Ow(n,M,{max:S.max,targetQueue:S.targetQueue}))}if(f.pathname==="/api/serverless/dlq/purge"&&C.method==="POST"){if((await C.json().catch(()=>({}))).confirm!=="purge")return O({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return O(await Cw(n,M))}if(f.pathname==="/api/serverless/secrets"&&C.method==="GET")return O({secrets:Iw(n,M)});if(f.pathname==="/api/serverless/secrets"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=String(S.secretId??"").trim();if(!L)return O({ok:!1,error:"A secret id is required."},422);if(typeof S.value!=="string"||S.value==="")return O({ok:!1,error:"A non-empty value is required."},422);return O(await lw(n,M,L,S.value))}if(f.pathname==="/api/serverless/secrets"&&C.method==="DELETE"){let S=await C.json().catch(()=>({})),L=String(S.secretId??"").trim();if(!L)return O({ok:!1,error:"A secret id is required."},422);if(S.confirm!==L)return O({ok:!1,error:`Type "${L}" to delete this secret.`},409);return O(await Dw(n,M,L))}if(f.pathname==="/api/serverless/functions/config"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=String(S.mode??"").trim();if(S.confirm!==L)return O({ok:!1,error:`Type "${L}" to update this function.`},409);return O(await Uw(n,M,L,{memory:S.memory,timeout:S.timeout}))}if(f.pathname==="/api/serverless/alarms"&&C.method==="GET")return O(await fw(n,M));if(f.pathname==="/api/serverless/alarms"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=String(S.preset??"").trim(),I=Number(S.threshold);if(!L)return O({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(I))return O({ok:!1,error:"A numeric threshold is required."},422);return O(await ww(n,M,L,I))}if(f.pathname==="/api/serverless/alarms"&&C.method==="DELETE"){let S=await C.json().catch(()=>({})),L=String(S.name??"").trim();if(!L)return O({ok:!1,error:"An alarm name is required."},422);if(S.confirm!==L)return O({ok:!1,error:`Type "${L}" to delete this alarm.`},409);return O(await gw(n,M,L))}if(f.pathname==="/api/serverless/traces"&&C.method==="GET"){let S=Number(f.searchParams.get("minutes"))||30;return O(await qh(n,M,S))}if(f.pathname==="/api/serverless/scheduler"&&C.method==="POST"){let S=await C.json().catch(()=>({})),L=String(S.action??"").trim();if(L!=="enable"&&L!=="disable"&&L!=="run")return O({ok:!1,error:"Unknown scheduler action."},422);if(S.confirm!==L)return O({ok:!1,error:`Type "${L}" to ${L} the scheduler.`},409);return O(await oL(n,M,L))}if(!ow(f.pathname,ir))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(M)}`}});let Sn=await $(Q,M);if(!Sn)return tR("ts-cloud dashboard UI is unavailable.",503);return mw(Sn,f.pathname)}catch(AE){if(t.verbose)console.error(AE);return O({ok:!1,error:AE?.message??String(AE)},500)}})();if(!ee)return ee;if(Ht&&(f.pathname.startsWith("/api/")||f.pathname.startsWith("/auth/"))){let Ot;if((m.headers.get("content-type")||"").includes("application/json"))Ot=await m.json().catch(()=>{return});let Ie=bt.resolveUser(C),Se=Ie?ct(Ie).actor:void 0;T.store.appendEvent({organizationId:T.organization.id,projectId:T.project.id,actorId:Se?.id,correlationId:Rt,type:ee.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:ee.status<400?"info":"warning",payload:hJ(C.method,f.pathname,Ot,ee.status,Date.now()-Tt)})}return ee.headers.set("x-request-id",Rt),ee}});eT?.start();let Ng=hn.stop.bind(hn);return hn.stop=(C)=>{clearInterval(lu),clearInterval(Du),clearInterval(Uu),clearInterval(Iu),clearInterval(Cu),clearInterval(Au),clearInterval(Lu),clearInterval(uu),clearInterval(Ou),lt(),Ee.clear(),eT?.stop();let p=Ng(C);if(eT)eT.settled().finally(()=>T.store.close());else T.store.close();return p},{server:hn,url:`http://${r}:${hn.port}/`}}function nu(t){let e=p_.argv.indexOf(t);return e===-1?void 0:p_.argv[e+1]}function dg(t){return p_.argv.includes(t)}async function zJ(){let t=await rg({host:nu("--host")??"127.0.0.1",port:Number(nu("--port")??7676),environment:nu("--env"),box:dg("--box"),verbose:dg("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${t.url}`),await new Promise((e)=>{let r=()=>{t.server.stop(!0),e()};p_.once("SIGINT",r),p_.once("SIGTERM",r)})}zJ();