@stacksjs/ts-cloud 0.7.98 → 0.7.99

package/dist/bin/cli.js

@@ -8662,7 +8662,7 @@ console.log(JSON.stringify({
 `,"utf8"),async()=>{await Bk(ZS(T,"owner.json")).catch(()=>{}),await Fk(T).catch(()=>{})}}var AX=CE(()=>{E$()});class Ir{client;region;constructor(E="us-east-1",_){this.region=E,this.client=new JE(void 0,{profile:_})}async createLogGroup(E,_){await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.CreateLogGroup","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({logGroupName:E,..._?{tags:_}:{}})})}async putRetentionPolicy(E,_){if(![1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1096,1827,2192,2557,2922,3288,3653].includes(_))throw Error("Unsupported CloudWatch Logs retention period");await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.PutRetentionPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({logGroupName:E,retentionInDays:_})})}async describeLogStreams(E){let _={logGroupName:E.logGroupName};if(E.logStreamNamePrefix)_.logStreamNamePrefix=E.logStreamNamePrefix;if(E.orderBy)_.orderBy=E.orderBy;if(E.descending!==void 0)_.descending=E.descending;if(E.limit)_.limit=E.limit;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.DescribeLogStreams","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async getLogEvents(E){let _={logGroupName:E.logGroupName,logStreamName:E.logStreamName};if(E.startTime)_.startTime=E.startTime;if(E.endTime)_.endTime=E.endTime;if(E.limit)_.limit=E.limit;if(E.startFromHead!==void 0)_.startFromHead=E.startFromHead;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.GetLogEvents","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async describeLogGroups(E){let _={};if(E?.logGroupNamePrefix)_.logGroupNamePrefix=E.logGroupNamePrefix;if(E?.limit)_.limit=E.limit;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.DescribeLogGroups","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async deleteLogGroup(E){await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.DeleteLogGroup","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({logGroupName:E})})}async filterLogEvents(E){let _={logGroupName:E.logGroupName};if(E.logStreamNames)_.logStreamNames=E.logStreamNames;if(E.startTime)_.startTime=E.startTime;if(E.endTime)_.endTime=E.endTime;if(E.filterPattern)_.filterPattern=E.filterPattern;if(E.limit)_.limit=E.limit;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.FilterLogEvents","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}}var sR=CE(()=>{VE()});var gS={};Z_(gS,{LambdaClient:()=>B_});import{deflateRawSync as sk}from"zlib";function oP(E,_){let T=typeof _==="string"?Buffer.from(_,"utf-8"):_,r=sk(T),d=pk(T),t=new Date,R=(t.getHours()<<11|t.getMinutes()<<5|t.getSeconds()>>1)&65535,h=(t.getFullYear()-1980<<9|t.getMonth()+1<<5|t.getDate())&65535,N=Buffer.from(E,"utf-8"),S=Buffer.alloc(30+N.length);S.writeUInt32LE(67324752,0),S.writeUInt16LE(20,4),S.writeUInt16LE(0,6),S.writeUInt16LE(8,8),S.writeUInt16LE(R,10),S.writeUInt16LE(h,12),S.writeUInt32LE(d,14),S.writeUInt32LE(r.length,18),S.writeUInt32LE(T.length,22),S.writeUInt16LE(N.length,26),S.writeUInt16LE(0,28),N.copy(S,30);let A=Buffer.alloc(46+N.length);A.writeUInt32LE(33639248,0),A.writeUInt16LE(20,4),A.writeUInt16LE(20,6),A.writeUInt16LE(0,8),A.writeUInt16LE(8,10),A.writeUInt16LE(R,12),A.writeUInt16LE(h,14),A.writeUInt32LE(d,16),A.writeUInt32LE(r.length,20),A.writeUInt32LE(T.length,24),A.writeUInt16LE(N.length,28),A.writeUInt16LE(0,30),A.writeUInt16LE(0,32),A.writeUInt16LE(0,34),A.writeUInt16LE(0,36),A.writeUInt32LE(0,38),A.writeUInt32LE(0,42),N.copy(A,46);let L=S.length+r.length,O=A.length,c=Buffer.alloc(22);return c.writeUInt32LE(101010256,0),c.writeUInt16LE(0,4),c.writeUInt16LE(0,6),c.writeUInt16LE(1,8),c.writeUInt16LE(1,10),c.writeUInt32LE(O,12),c.writeUInt32LE(L,16),c.writeUInt16LE(0,20),Buffer.concat([S,r,A,c])}function pk(E){let _=[];for(let r=0;r<256;r++){let d=r;for(let t=0;t<8;t++)d=d&1?3988292384^d>>>1:d>>>1;_[r]=d}let T=4294967295;for(let r=0;r<E.length;r++)T=_[(T^E[r])&255]^T>>>8;return(T^4294967295)>>>0}class B_{client;region;constructor(E="us-east-1",_){this.region=E,this.client=new JE(void 0,{profile:_})}async createFunction(E){return await this.client.request({service:"lambda",region:this.region,method:"POST",path:"/2015-03-31/functions",headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})}async getFunction(E){return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2015-03-31/functions/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async updateFunctionCode(E){let{FunctionName:_,...T}=E;return await this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2015-03-31/functions/${encodeURIComponent(_)}/code`,headers:{"Content-Type":"application/json"},body:JSON.stringify(T)})}async updateFunctionCodeInline(E,_,T="index.js"){let r=oP(T,_);return this.updateFunctionCode({FunctionName:E,ZipFile:r.toString("base64")})}async updateFunctionConfiguration(E){let{FunctionName:_,...T}=E;return await this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2015-03-31/functions/${encodeURIComponent(_)}/configuration`,headers:{"Content-Type":"application/json"},body:JSON.stringify(T)})}async deleteFunction(E){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2015-03-31/functions/${encodeURIComponent(E)}`,headers:{"Content-Type":"application/json"}})}async invoke(E){let{FunctionName:_,InvocationType:T="RequestResponse",Payload:r,LogType:d}=E,t={"Content-Type":"application/json","X-Amz-Invocation-Type":T};if(d)t["X-Amz-Log-Type"]=d;let R=r?typeof r==="string"?r:JSON.stringify(r):void 0,h=await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(_)}/invocations`,headers:t,body:R,returnHeaders:!0});return{StatusCode:h.statusCode||200,FunctionError:h.headers?.["x-amz-function-error"],LogResult:h.headers?.["x-amz-log-result"],Payload:typeof h.body==="string"?h.body:JSON.stringify(h.body),ExecutedVersion:h.headers?.["x-amz-executed-version"]}}async listFunctions(E){let _={};if(E?.MaxItems)_.MaxItems=String(E.MaxItems);if(E?.Marker)_.Marker=E.Marker;if(E?.FunctionVersion)_.FunctionVersion=E.FunctionVersion;return await this.client.request({service:"lambda",region:this.region,method:"GET",path:"/2015-03-31/functions",queryParams:Object.keys(_).length>0?_:void 0,headers:{"Content-Type":"application/json"}})}async addPermission(E){let{FunctionName:_,...T}=E;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(_)}/policy`,headers:{"Content-Type":"application/json"},body:JSON.stringify(T)})}async removePermission(E,_){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2015-03-31/functions/${encodeURIComponent(E)}/policy/${encodeURIComponent(_)}`,headers:{"Content-Type":"application/json"}})}async publishVersion(E){let{FunctionName:_,...T}=E;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(_)}/versions`,headers:{"Content-Type":"application/json"},body:JSON.stringify(T)})}async createAlias(E){let{FunctionName:_,...T}=E;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(_)}/aliases`,headers:{"Content-Type":"application/json"},body:JSON.stringify(T)})}async updateAlias(E){let{FunctionName:_,Name:T,...r}=E;return this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2015-03-31/functions/${encodeURIComponent(_)}/aliases/${encodeURIComponent(T)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async getAlias(E,_){try{return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2015-03-31/functions/${encodeURIComponent(E)}/aliases/${encodeURIComponent(_)}`})}catch(T){if(/ResourceNotFound/i.test(String(T?.message)))return null;throw T}}async getProvisionedConcurrencyConfig(E,_){try{return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2019-09-30/functions/${encodeURIComponent(E)}/provisioned-concurrency`,queryParams:{Qualifier:_}})}catch(T){if(/ProvisionedConcurrencyConfigNotFound|ResourceNotFound/i.test(String(T?.message)))return null;throw T}}async putProvisionedConcurrencyConfig(E){let{FunctionName:_,Qualifier:T,ProvisionedConcurrentExecutions:r}=E;return this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2019-09-30/functions/${encodeURIComponent(_)}/provisioned-concurrency`,queryParams:{Qualifier:T},headers:{"Content-Type":"application/json"},body:JSON.stringify({ProvisionedConcurrentExecutions:r})})}async deleteProvisionedConcurrencyConfig(E,_){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2019-09-30/functions/${encodeURIComponent(E)}/provisioned-concurrency`,queryParams:{Qualifier:_}})}async waitForFunctionActive(E,_=60){let T=Date.now(),r=_*1000;while(Date.now()-T<r)try{let d=await this.getFunction(E),t=d.Configuration?.State;if(t==="Active")return d.Configuration;if(t==="Failed")throw Error(`Function ${E} failed: ${d.Configuration?.StateReason}`);await new Promise((R)=>setTimeout(R,2000))}catch(d){if(d.code==="ResourceNotFoundException"){await new Promise((t)=>setTimeout(t,2000));continue}throw d}throw Error(`Timeout waiting for function ${E} to become active`)}async functionExists(E){try{return await this.getFunction(E),!0}catch(_){if(_.code==="ResourceNotFoundException"||_.statusCode===404)return!1;throw _}}async createFunctionUrl(E){let{FunctionName:_,...T}=E;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2021-10-31/functions/${encodeURIComponent(_)}/url`,headers:{"Content-Type":"application/json"},body:JSON.stringify(T)})}async getFunctionUrl(E){try{return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2021-10-31/functions/${encodeURIComponent(E)}/url`,headers:{"Content-Type":"application/json"}})}catch(_){if(_.statusCode===404)return null;throw _}}async deleteFunctionUrl(E){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2021-10-31/functions/${encodeURIComponent(E)}/url`,headers:{"Content-Type":"application/json"}})}async createFunctionWithCode(E){let{Code:_,Filename:T="index.js",...r}=E,d=oP(T,_);return this.createFunction({...r,Code:{ZipFile:d.toString("base64")}})}async addFunctionUrlPermission(E){return this.addPermission({FunctionName:E,StatementId:"FunctionURLAllowPublicAccess",Action:"lambda:InvokeFunctionUrl",Principal:"*",FunctionUrlAuthType:"NONE"})}async publishLayerVersion(E){let{LayerName:_,...T}=E;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2018-10-31/layers/${encodeURIComponent(_)}/versions`,headers:{"Content-Type":"application/json"},body:JSON.stringify(T)})}async listLayerVersions(E,_){let T={};if(_?.CompatibleRuntime)T.CompatibleRuntime=_.CompatibleRuntime;if(_?.CompatibleArchitecture)T.CompatibleArchitecture=_.CompatibleArchitecture;if(_?.MaxItems)T.MaxItems=String(_.MaxItems);if(_?.Marker)T.Marker=_.Marker;return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2018-10-31/layers/${encodeURIComponent(E)}/versions`,queryParams:Object.keys(T).length>0?T:void 0,headers:{"Content-Type":"application/json"}})}async getLayerVersion(E,_){return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2018-10-31/layers/${encodeURIComponent(E)}/versions/${_}`,headers:{"Content-Type":"application/json"}})}async addLayerVersionPermission(E){let{LayerName:_,VersionNumber:T,...r}=E;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2018-10-31/layers/${encodeURIComponent(_)}/versions/${T}/policy`,headers:{"Content-Type":"application/json"},body:JSON.stringify(r)})}async deleteLayerVersion(E,_){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2018-10-31/layers/${encodeURIComponent(E)}/versions/${_}`,headers:{"Content-Type":"application/json"}})}}var Gr=CE(()=>{VE()});var t$={};Z_(t$,{RDSClient:()=>Mr});class Mr{client;region;constructor(E="us-east-1"){this.region=E,this.client=new JE}async describeDBInstances(E){let _={Action:"DescribeDBInstances",Version:"2014-10-31"};if(E?.DBInstanceIdentifier)_.DBInstanceIdentifier=E.DBInstanceIdentifier;if(E?.MaxRecords)_.MaxRecords=E.MaxRecords;if(E?.Marker)_.Marker=E.Marker;if(E?.Filters)E.Filters.forEach((R,h)=>{_[`Filters.Filter.${h+1}.Name`]=R.Name,R.Values.forEach((N,S)=>{_[`Filters.Filter.${h+1}.Values.Value.${S+1}`]=N})});let T=new URLSearchParams(e_(_)).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T}),d=r.DescribeDBInstancesResult||r,t=d.DBInstances?.DBInstance||[];if(!Array.isArray(t))t=t?[t]:[];return{DBInstances:t,Marker:d.Marker}}async describeDBInstance(E){return(await this.describeDBInstances({DBInstanceIdentifier:E})).DBInstances?.[0]}async describeDBClusters(E){let _={Action:"DescribeDBClusters",Version:"2014-10-31"};if(E?.DBClusterIdentifier)_.DBClusterIdentifier=E.DBClusterIdentifier;if(E?.MaxRecords)_.MaxRecords=E.MaxRecords;if(E?.Marker)_.Marker=E.Marker;if(E?.Filters)E.Filters.forEach((R,h)=>{_[`Filters.Filter.${h+1}.Name`]=R.Name,R.Values.forEach((N,S)=>{_[`Filters.Filter.${h+1}.Values.Value.${S+1}`]=N})});let T=new URLSearchParams(e_(_)).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T}),d=r.DescribeDBClustersResult||r,t=d.DBClusters?.DBCluster||[];if(!Array.isArray(t))t=t?[t]:[];return{DBClusters:t,Marker:d.Marker}}async describeDBSnapshots(E){let _={Action:"DescribeDBSnapshots",Version:"2014-10-31"};if(E?.DBInstanceIdentifier)_.DBInstanceIdentifier=E.DBInstanceIdentifier;if(E?.DBSnapshotIdentifier)_.DBSnapshotIdentifier=E.DBSnapshotIdentifier;if(E?.SnapshotType)_.SnapshotType=E.SnapshotType;if(E?.MaxRecords)_.MaxRecords=E.MaxRecords;if(E?.Marker)_.Marker=E.Marker;let T=new URLSearchParams(e_(_)).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T}),d=r.DescribeDBSnapshotsResult||r,t=d.DBSnapshots?.DBSnapshot||[];if(!Array.isArray(t))t=t?[t]:[];return{DBSnapshots:t,Marker:d.Marker}}async describeDBSubnetGroups(E){let _={Action:"DescribeDBSubnetGroups",Version:"2014-10-31"};if(E?.DBSubnetGroupName)_.DBSubnetGroupName=E.DBSubnetGroupName;if(E?.MaxRecords)_.MaxRecords=E.MaxRecords;if(E?.Marker)_.Marker=E.Marker;let T=new URLSearchParams(e_(_)).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T}),d=r.DescribeDBSubnetGroupsResult||r,t=d.DBSubnetGroups?.DBSubnetGroup||[];if(!Array.isArray(t))t=t?[t]:[];return{DBSubnetGroups:t,Marker:d.Marker}}async createDBInstance(E){let _={Action:"CreateDBInstance",Version:"2014-10-31",DBInstanceIdentifier:E.DBInstanceIdentifier,DBInstanceClass:E.DBInstanceClass,Engine:E.Engine};if(E.DBClusterIdentifier)_.DBClusterIdentifier=E.DBClusterIdentifier;if(E.MasterUsername)_.MasterUsername=E.MasterUsername;if(E.MasterUserPassword)_.MasterUserPassword=E.MasterUserPassword;if(E.DBName)_.DBName=E.DBName;if(E.AllocatedStorage)_.AllocatedStorage=E.AllocatedStorage;if(E.DBSubnetGroupName)_.DBSubnetGroupName=E.DBSubnetGroupName;if(E.AvailabilityZone)_.AvailabilityZone=E.AvailabilityZone;if(E.PreferredMaintenanceWindow)_.PreferredMaintenanceWindow=E.PreferredMaintenanceWindow;if(E.PreferredBackupWindow)_.PreferredBackupWindow=E.PreferredBackupWindow;if(E.BackupRetentionPeriod!==void 0)_.BackupRetentionPeriod=E.BackupRetentionPeriod;if(E.MultiAZ!==void 0)_.MultiAZ=E.MultiAZ;if(E.EngineVersion)_.EngineVersion=E.EngineVersion;if(E.AutoMinorVersionUpgrade!==void 0)_.AutoMinorVersionUpgrade=E.AutoMinorVersionUpgrade;if(E.LicenseModel)_.LicenseModel=E.LicenseModel;if(E.PubliclyAccessible!==void 0)_.PubliclyAccessible=E.PubliclyAccessible;if(E.StorageType)_.StorageType=E.StorageType;if(E.StorageEncrypted!==void 0)_.StorageEncrypted=E.StorageEncrypted;if(E.KmsKeyId)_.KmsKeyId=E.KmsKeyId;if(E.DeletionProtection!==void 0)_.DeletionProtection=E.DeletionProtection;if(E.VpcSecurityGroupIds)E.VpcSecurityGroupIds.forEach((t,R)=>{_[`VpcSecurityGroupIds.VpcSecurityGroupId.${R+1}`]=t});if(E.Tags)E.Tags.forEach((t,R)=>{_[`Tags.Tag.${R+1}.Key`]=t.Key,_[`Tags.Tag.${R+1}.Value`]=t.Value});let T=new URLSearchParams(e_(_)).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T});return{DBInstance:(r.CreateDBInstanceResult||r).DBInstance}}async createDBCluster(E){let _={Action:"CreateDBCluster",Version:"2014-10-31",DBClusterIdentifier:E.DBClusterIdentifier,Engine:E.Engine};if(E.EngineVersion)_.EngineVersion=E.EngineVersion;if(E.MasterUsername)_.MasterUsername=E.MasterUsername;if(E.MasterUserPassword)_.MasterUserPassword=E.MasterUserPassword;if(E.DatabaseName)_.DatabaseName=E.DatabaseName;if(E.DBSubnetGroupName)_.DBSubnetGroupName=E.DBSubnetGroupName;if(E.BackupRetentionPeriod!==void 0)_.BackupRetentionPeriod=E.BackupRetentionPeriod;if(E.StorageEncrypted!==void 0)_.StorageEncrypted=E.StorageEncrypted;if(E.KmsKeyId)_.KmsKeyId=E.KmsKeyId;if(E.DeletionProtection!==void 0)_.DeletionProtection=E.DeletionProtection;if(E.ServerlessV2ScalingConfiguration)_["ServerlessV2ScalingConfiguration.MinCapacity"]=E.ServerlessV2ScalingConfiguration.MinCapacity,_["ServerlessV2ScalingConfiguration.MaxCapacity"]=E.ServerlessV2ScalingConfiguration.MaxCapacity;E.VpcSecurityGroupIds?.forEach((d,t)=>{_[`VpcSecurityGroupIds.VpcSecurityGroupId.${t+1}`]=d});let T=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e_(_)).toString()});return{DBCluster:(T.CreateDBClusterResult||T).DBCluster}}async deleteDBInstance(E){let _={Action:"DeleteDBInstance",Version:"2014-10-31",DBInstanceIdentifier:E.DBInstanceIdentifier};if(E.SkipFinalSnapshot!==void 0)_.SkipFinalSnapshot=E.SkipFinalSnapshot;if(E.FinalDBSnapshotIdentifier)_.FinalDBSnapshotIdentifier=E.FinalDBSnapshotIdentifier;if(E.DeleteAutomatedBackups!==void 0)_.DeleteAutomatedBackups=E.DeleteAutomatedBackups;let T=new URLSearchParams(e_(_)).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T});return{DBInstance:(r.DeleteDBInstanceResult||r).DBInstance}}async modifyDBInstance(E){let _={Action:"ModifyDBInstance",Version:"2014-10-31",DBInstanceIdentifier:E.DBInstanceIdentifier};if(E.DBInstanceClass)_.DBInstanceClass=E.DBInstanceClass;if(E.AllocatedStorage)_.AllocatedStorage=E.AllocatedStorage;if(E.MasterUserPassword)_.MasterUserPassword=E.MasterUserPassword;if(E.BackupRetentionPeriod!==void 0)_.BackupRetentionPeriod=E.BackupRetentionPeriod;if(E.PreferredBackupWindow)_.PreferredBackupWindow=E.PreferredBackupWindow;if(E.PreferredMaintenanceWindow)_.PreferredMaintenanceWindow=E.PreferredMaintenanceWindow;if(E.MultiAZ!==void 0)_.MultiAZ=E.MultiAZ;if(E.EngineVersion)_.EngineVersion=E.EngineVersion;if(E.AutoMinorVersionUpgrade!==void 0)_.AutoMinorVersionUpgrade=E.AutoMinorVersionUpgrade;if(E.PubliclyAccessible!==void 0)_.PubliclyAccessible=E.PubliclyAccessible;if(E.ApplyImmediately!==void 0)_.ApplyImmediately=E.ApplyImmediately;if(E.StorageType)_.StorageType=E.StorageType;if(E.DeletionProtection!==void 0)_.DeletionProtection=E.DeletionProtection;if(E.VpcSecurityGroupIds)E.VpcSecurityGroupIds.forEach((t,R)=>{_[`VpcSecurityGroupIds.VpcSecurityGroupId.${R+1}`]=t});let T=new URLSearchParams(e_(_)).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T});return{DBInstance:(r.ModifyDBInstanceResult||r).DBInstance}}async modifyDBCluster(E){let _={Action:"ModifyDBCluster",Version:"2014-10-31",DBClusterIdentifier:E.DBClusterIdentifier};if(E.ServerlessV2ScalingConfiguration)_["ServerlessV2ScalingConfiguration.MinCapacity"]=E.ServerlessV2ScalingConfiguration.MinCapacity,_["ServerlessV2ScalingConfiguration.MaxCapacity"]=E.ServerlessV2ScalingConfiguration.MaxCapacity;if(E.BackupRetentionPeriod!==void 0)_.BackupRetentionPeriod=E.BackupRetentionPeriod;if(E.EngineVersion)_.EngineVersion=E.EngineVersion;if(E.MasterUserPassword)_.MasterUserPassword=E.MasterUserPassword;if(E.DeletionProtection!==void 0)_.DeletionProtection=E.DeletionProtection;if(E.ApplyImmediately!==void 0)_.ApplyImmediately=E.ApplyImmediately;let T=new URLSearchParams(e_(_)).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T});return{DBCluster:(r.ModifyDBClusterResult||r).DBCluster}}async rebootDBCluster(E){let _={Action:"FailoverDBCluster",Version:"2014-10-31",DBClusterIdentifier:E},T=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e_(_)).toString()});return{DBCluster:(T.FailoverDBClusterResult||T).DBCluster}}async createDBClusterSnapshot(E,_){let T={Action:"CreateDBClusterSnapshot",Version:"2014-10-31",DBClusterIdentifier:E,DBClusterSnapshotIdentifier:_};return this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e_(T)).toString()})}async describeDBClusterSnapshots(E={}){let _={Action:"DescribeDBClusterSnapshots",Version:"2014-10-31",...E},T=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e_(_)).toString()}),r=T.DescribeDBClusterSnapshotsResult||T,d=r.DBClusterSnapshots?.DBClusterSnapshot??r.DBClusterSnapshots??[];return{DBClusterSnapshots:Array.isArray(d)?d:[d]}}async deleteDBClusterSnapshot(E){await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e_({Action:"DeleteDBClusterSnapshot",Version:"2014-10-31",DBClusterSnapshotIdentifier:E})).toString()})}async deleteDBCluster(E,_){let T={Action:"DeleteDBCluster",Version:"2014-10-31",DBClusterIdentifier:E,SkipFinalSnapshot:!_};if(_)T.FinalDBSnapshotIdentifier=_;let r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e_(T)).toString()});return{DBCluster:(r.DeleteDBClusterResult||r).DBCluster}}async restoreDBClusterToPointInTime(E){let _={Action:"RestoreDBClusterToPointInTime",Version:"2014-10-31",DBClusterIdentifier:E.DBClusterIdentifier,SourceDBClusterIdentifier:E.SourceDBClusterIdentifier};if(E.RestoreToTime)_.RestoreToTime=E.RestoreToTime.toISOString();if(E.UseLatestRestorableTime)_.UseLatestRestorableTime=!0;if(E.DBSubnetGroupName)_.DBSubnetGroupName=E.DBSubnetGroupName;if(E.VpcSecurityGroupIds)E.VpcSecurityGroupIds.forEach((t,R)=>{_[`VpcSecurityGroupIds.VpcSecurityGroupId.${R+1}`]=t});let T=new URLSearchParams(e_(_)).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T});return{DBCluster:(r.RestoreDBClusterToPointInTimeResult||r).DBCluster}}async restoreDBClusterFromSnapshot(E){let _={Action:"RestoreDBClusterFromSnapshot",Version:"2014-10-31",DBClusterIdentifier:E.DBClusterIdentifier,SnapshotIdentifier:E.SnapshotIdentifier,Engine:E.Engine};if(E.EngineVersion)_.EngineVersion=E.EngineVersion;if(E.DBSubnetGroupName)_.DBSubnetGroupName=E.DBSubnetGroupName;if(E.DeletionProtection!==void 0)_.DeletionProtection=E.DeletionProtection;if(E.VpcSecurityGroupIds?.forEach((d,t)=>{_[`VpcSecurityGroupIds.VpcSecurityGroupId.${t+1}`]=d}),E.ServerlessV2ScalingConfiguration)_["ServerlessV2ScalingConfiguration.MinCapacity"]=E.ServerlessV2ScalingConfiguration.MinCapacity,_["ServerlessV2ScalingConfiguration.MaxCapacity"]=E.ServerlessV2ScalingConfiguration.MaxCapacity;let T=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e_(_)).toString()});return{DBCluster:(T.RestoreDBClusterFromSnapshotResult||T).DBCluster}}async startDBInstance(E){let T=new URLSearchParams(e_({Action:"StartDBInstance",Version:"2014-10-31",DBInstanceIdentifier:E})).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T});return{DBInstance:(r.StartDBInstanceResult||r).DBInstance}}async stopDBInstance(E){let _={Action:"StopDBInstance",Version:"2014-10-31",DBInstanceIdentifier:E.DBInstanceIdentifier};if(E.DBSnapshotIdentifier)_.DBSnapshotIdentifier=E.DBSnapshotIdentifier;let T=new URLSearchParams(e_(_)).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T});return{DBInstance:(r.StopDBInstanceResult||r).DBInstance}}async rebootDBInstance(E){let _={Action:"RebootDBInstance",Version:"2014-10-31",DBInstanceIdentifier:E.DBInstanceIdentifier};if(E.ForceFailover!==void 0)_.ForceFailover=E.ForceFailover;let T=new URLSearchParams(e_(_)).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T});return{DBInstance:(r.RebootDBInstanceResult||r).DBInstance}}async createDBSnapshot(E){let _={Action:"CreateDBSnapshot",Version:"2014-10-31",DBInstanceIdentifier:E.DBInstanceIdentifier,DBSnapshotIdentifier:E.DBSnapshotIdentifier};if(E.Tags)E.Tags.forEach((t,R)=>{_[`Tags.Tag.${R+1}.Key`]=t.Key,_[`Tags.Tag.${R+1}.Value`]=t.Value});let T=new URLSearchParams(e_(_)).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T});return{DBSnapshot:(r.CreateDBSnapshotResult||r).DBSnapshot}}async deleteDBSnapshot(E){let T=new URLSearchParams(e_({Action:"DeleteDBSnapshot",Version:"2014-10-31",DBSnapshotIdentifier:E})).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T});return{DBSnapshot:(r.DeleteDBSnapshotResult||r).DBSnapshot}}async restoreDBInstanceFromDBSnapshot(E){let _={Action:"RestoreDBInstanceFromDBSnapshot",Version:"2014-10-31",DBInstanceIdentifier:E.DBInstanceIdentifier,DBSnapshotIdentifier:E.DBSnapshotIdentifier};if(E.DBInstanceClass)_.DBInstanceClass=E.DBInstanceClass;if(E.Port)_.Port=E.Port;if(E.AvailabilityZone)_.AvailabilityZone=E.AvailabilityZone;if(E.DBSubnetGroupName)_.DBSubnetGroupName=E.DBSubnetGroupName;if(E.MultiAZ!==void 0)_.MultiAZ=E.MultiAZ;if(E.PubliclyAccessible!==void 0)_.PubliclyAccessible=E.PubliclyAccessible;if(E.AutoMinorVersionUpgrade!==void 0)_.AutoMinorVersionUpgrade=E.AutoMinorVersionUpgrade;if(E.StorageType)_.StorageType=E.StorageType;if(E.DeletionProtection!==void 0)_.DeletionProtection=E.DeletionProtection;if(E.VpcSecurityGroupIds)E.VpcSecurityGroupIds.forEach((t,R)=>{_[`VpcSecurityGroupIds.VpcSecurityGroupId.${R+1}`]=t});if(E.Tags)E.Tags.forEach((t,R)=>{_[`Tags.Tag.${R+1}.Key`]=t.Key,_[`Tags.Tag.${R+1}.Value`]=t.Value});let T=new URLSearchParams(e_(_)).toString(),r=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:T});return{DBInstance:(r.RestoreDBInstanceFromDBSnapshotResult||r).DBInstance}}async waitForDBInstanceAvailable(E,_=60,T=30000){for(let r=0;r<_;r++){let d=await this.describeDBInstance(E);if(d?.DBInstanceStatus==="available")return d;if(["deleted","failed","incompatible-restore","incompatible-parameters"].includes(d?.DBInstanceStatus||""))throw Error(`DB instance ${E} is in terminal state: ${d?.DBInstanceStatus}`);await new Promise((t)=>setTimeout(t,T))}throw Error(`Timeout waiting for DB instance ${E} to become available`)}async waitForDBInstanceDeleted(E,_=60,T=30000){for(let r=0;r<_;r++)try{let d=await this.describeDBInstance(E);if(d?.DBInstanceStatus==="deleting"){await new Promise((t)=>setTimeout(t,T));continue}throw Error(`DB instance ${E} is in state: ${d?.DBInstanceStatus}`)}catch(d){if(d.code==="DBInstanceNotFound"||d.code==="DBInstanceNotFoundFault")return;throw d}throw Error(`Timeout waiting for DB instance ${E} to be deleted`)}}var ut=CE(()=>{VE()});class nT{client;region;constructor(E="us-east-1",_){this.region=E,this.client=new JE(BR(_))}async query(E){let _=new URLSearchParams(e_({Version:"2010-08-01",...E})).toString();return this.client.request({service:"monitoring",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:_})}async getMetricStatistics(E){let _={Action:"GetMetricStatistics",Namespace:E.Namespace,MetricName:E.MetricName,StartTime:E.StartTime.toISOString(),EndTime:E.EndTime.toISOString(),Period:E.Period};(E.Statistics??[]).forEach((t,R)=>{_[`Statistics.member.${R+1}`]=t}),(E.ExtendedStatistics??[]).forEach((t,R)=>{_[`ExtendedStatistics.member.${R+1}`]=t}),(E.Dimensions??[]).forEach((t,R)=>{_[`Dimensions.member.${R+1}.Name`]=t.Name,_[`Dimensions.member.${R+1}.Value`]=t.Value});let T=await this.query(_),d=(T.GetMetricStatisticsResult||T)?.Datapoints?.member??[];if(!Array.isArray(d))d=d?[d]:[];return d.map((t)=>{let R={},h=t.ExtendedStatistics?.entry;if(h){if(!Array.isArray(h))h=[h];for(let N of h)if(N?.key!=null)R[N.key]=Number(N.value)}return{Timestamp:t.Timestamp,Sum:t.Sum!=null?Number(t.Sum):void 0,Average:t.Average!=null?Number(t.Average):void 0,Maximum:t.Maximum!=null?Number(t.Maximum):void 0,Minimum:t.Minimum!=null?Number(t.Minimum):void 0,Percentiles:Object.keys(R).length?R:void 0,Unit:t.Unit}})}async getMetricSeries(E){let _=/^p\d/.test(E.Stat);return(await this.getMetricStatistics({Namespace:E.Namespace,MetricName:E.MetricName,Dimensions:E.Dimensions,StartTime:E.StartTime,EndTime:E.EndTime,Period:E.Period,Statistics:_?[]:[E.Stat],ExtendedStatistics:_?[E.Stat]:[]})).slice().sort((r,d)=>new Date(r.Timestamp??0).getTime()-new Date(d.Timestamp??0).getTime()).map((r)=>_?r.Percentiles?.[E.Stat]??0:r[E.Stat]??0)}async describeAlarms(E){let _={Action:"DescribeAlarms"};if(E?.AlarmNamePrefix)_.AlarmNamePrefix=E.AlarmNamePrefix;if(E?.MaxRecords)_.MaxRecords=E.MaxRecords;let T=await this.query(_),d=(T.DescribeAlarmsResult||T)?.MetricAlarms?.member??[];if(!Array.isArray(d))d=d?[d]:[];return d.map((t)=>({AlarmName:t.AlarmName,StateValue:t.StateValue,MetricName:t.MetricName,ComparisonOperator:t.ComparisonOperator,Threshold:t.Threshold!=null?Number(t.Threshold):void 0,Namespace:t.Namespace}))}async putMetricAlarm(E){let _={Action:"PutMetricAlarm",AlarmName:E.AlarmName,Namespace:E.Namespace,MetricName:E.MetricName,ComparisonOperator:E.ComparisonOperator,Threshold:E.Threshold,EvaluationPeriods:E.EvaluationPeriods,Period:E.Period,Statistic:E.Statistic};if(E.AlarmDescription)_.AlarmDescription=E.AlarmDescription;(E.Dimensions??[]).forEach((T,r)=>{_[`Dimensions.member.${r+1}.Name`]=T.Name,_[`Dimensions.member.${r+1}.Value`]=T.Value}),(E.AlarmActions??[]).forEach((T,r)=>{_[`AlarmActions.member.${r+1}`]=T}),await this.query(_)}async deleteAlarms(E){if(!E.length)return;let _={Action:"DeleteAlarms"};E.forEach((T,r)=>{_[`AlarmNames.member.${r+1}`]=T}),await this.query(_)}}var vS=CE(()=>{VE()});class oR{client;region;constructor(E="us-east-1",_){this.region=E,this.client=new JE(void 0,{profile:_})}async createRepository(E){let _={repositoryName:E.repositoryName};if(E.imageTagMutability)_.imageTagMutability=E.imageTagMutability;if(E.imageScanningConfiguration)_.imageScanningConfiguration=E.imageScanningConfiguration;if(E.encryptionConfiguration)_.encryptionConfiguration=E.encryptionConfiguration;if(E.tags&&E.tags.length>0)_.tags=E.tags;let T=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.CreateRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)});return{repository:T.repository?this.parseRepository(T.repository):void 0}}async describeRepositories(E){let _={};if(E?.repositoryNames&&E.repositoryNames.length>0)_.repositoryNames=E.repositoryNames;if(E?.registryId)_.registryId=E.registryId;if(E?.maxResults)_.maxResults=E.maxResults;if(E?.nextToken)_.nextToken=E.nextToken;let T=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeRepositories","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)});return{repositories:T.repositories?.map((r)=>this.parseRepository(r)),nextToken:T.nextToken}}async getAuthorizationToken(E){let _={};if(E&&E.length>0)_.registryIds=E;return{authorizationData:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetAuthorizationToken","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})).authorizationData?.map((r)=>({authorizationToken:r.authorizationToken,expiresAt:r.expiresAt,proxyEndpoint:r.proxyEndpoint}))}}async deleteRepository(E){let _={repositoryName:E.repositoryName};if(E.registryId)_.registryId=E.registryId;if(E.force!==void 0)_.force=E.force;let T=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DeleteRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)});return{repository:T.repository?this.parseRepository(T.repository):void 0}}async describeImages(E){let _={repositoryName:E.repositoryName};if(E.registryId)_.registryId=E.registryId;if(E.imageIds&&E.imageIds.length>0)_.imageIds=E.imageIds;if(E.filter)_.filter=E.filter;if(E.maxResults)_.maxResults=E.maxResults;if(E.nextToken)_.nextToken=E.nextToken;let T=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeImages","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)});return{imageDetails:T.imageDetails?.map((r)=>this.parseImageDetail(r)),nextToken:T.nextToken}}async batchDeleteImage(E){let _={repositoryName:E.repositoryName,imageIds:E.imageIds};if(E.registryId)_.registryId=E.registryId;let T=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.BatchDeleteImage","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)});return{imageIds:T.imageIds,failures:T.failures}}async putLifecyclePolicy(E){let _={repositoryName:E.repositoryName,lifecyclePolicyText:E.lifecyclePolicyText};if(E.registryId)_.registryId=E.registryId;let T=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.PutLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)});return{registryId:T.registryId,repositoryName:T.repositoryName,lifecyclePolicyText:T.lifecyclePolicyText}}async getLifecyclePolicy(E){let _={repositoryName:E.repositoryName};if(E.registryId)_.registryId=E.registryId;let T=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)});return{registryId:T.registryId,repositoryName:T.repositoryName,lifecyclePolicyText:T.lifecyclePolicyText,lastEvaluatedAt:T.lastEvaluatedAt}}async setRepositoryPolicy(E){let _={repositoryName:E.repositoryName,policyText:E.policyText};if(E.registryId)_.registryId=E.registryId;if(E.force!==void 0)_.force=E.force;let T=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.SetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)});return{registryId:T.registryId,repositoryName:T.repositoryName,policyText:T.policyText}}async getRepositoryPolicy(E){let _={repositoryName:E.repositoryName};if(E.registryId)_.registryId=E.registryId;let T=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)});return{registryId:T.registryId,repositoryName:T.repositoryName,policyText:T.policyText}}async tagResource(E){let _={resourceArn:E.resourceArn,tags:E.tags};await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async listTagsForResource(E){let _={resourceArn:E};return{tags:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.ListTagsForResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})).tags}}createLifecyclePolicyText(E){return JSON.stringify({rules:E.map((_)=>({rulePriority:_.rulePriority,description:_.description,selection:_.selection,action:_.action}))})}async getDockerLoginCommand(){let E=await this.getAuthorizationToken();if(!E.authorizationData?.[0])throw Error("Failed to get authorization token");let _=E.authorizationData[0],T=_.authorizationToken||"",r=_.proxyEndpoint||"";return`echo "${Buffer.from(T,"base64").toString("utf8").split(":")[1]}" | docker login --username AWS --password-stdin ${r}`}getRegistryUri(E){return`${E}.dkr.ecr.${this.region}.amazonaws.com`}parseRepository(E){return{repositoryArn:E.repositoryArn,registryId:E.registryId,repositoryName:E.repositoryName,repositoryUri:E.repositoryUri,createdAt:E.createdAt,imageTagMutability:E.imageTagMutability,imageScanningConfiguration:E.imageScanningConfiguration,encryptionConfiguration:E.encryptionConfiguration}}parseImageDetail(E){return{registryId:E.registryId,repositoryName:E.repositoryName,imageDigest:E.imageDigest,imageTags:E.imageTags,imageSizeInBytes:E.imageSizeInBytes,imagePushedAt:E.imagePushedAt,imageScanStatus:E.imageScanStatus,imageScanFindingsSummary:E.imageScanFindingsSummary}}}var Y0=CE(()=>{VE()});var Uy={};Z_(Uy,{buildAndPushServerlessImage:()=>GX});import{execFileSync as Oy}from"node:child_process";import{mkdirSync as QX,mkdtempSync as Au,rmSync as Lu,writeFileSync as L$}from"node:fs";import{tmpdir as Ou}from"node:os";import{dirname as cu,join as Eh}from"node:path";function cy(E,_){for(let T of _){let r=Eh(E,T.name);QX(cu(r),{recursive:!0}),L$(r,T.data,T.mode?{mode:T.mode}:void 0)}}async function GX(E){let{app:_,projectRoot:T,region:r,repository:d}=E,t=_.architecture??"x86_64",R=t==="arm64"?"linux/arm64":"linux/amd64",h=_.kind==="php",N=E.onStep??(()=>{}),S=Au(Eh(Ou(),"tscloud-img-"));try{let A=Eh(S,"app");QX(A,{recursive:!0});let L,O;if(h){Qc({projectRoot:T,app:_,skipBuild:E.skipBuild,onStep:N}),N("staging application tree");let y=Gc(T);cy(A,y),cy(Eh(S,"runtime"),wL().map((M)=>({name:M.path,data:M.contents,mode:M.mode})));let Y=_.handlers?.http??"public/index.php";L={http:Y,queue:_.handlers?.queue??Y,cli:_.handlers?.cli??Y},O=Hc(y.map((M)=>`${M.name}:${M.data.length}`).join("|"))}else{N("bundling application");let y=await BL({projectRoot:T,app:_,skipBuild:E.skipBuild,onStep:N});L$(Eh(A,"index.mjs"),y.bundle),L=y.handlers,O=y.sha256}let c=O.slice(0,16);L$(Eh(S,"Dockerfile"),xC({kind:_.kind??"node",phpVersion:_.phpVersion,architecture:t}));let $=new oR(r),I;try{I=(await $.describeRepositories({repositoryNames:[d]})).repositories?.[0]?.repositoryUri??""}catch{I=""}if(!I)N(`creating ECR repository ${d}`),I=(await $.createRepository({repositoryName:d,imageScanningConfiguration:{scanOnPush:!0}})).repository?.repositoryUri??"";if(!I)throw Error(`could not resolve ECR repository URI for ${d}`);let C=`${I}:${c}`;N("docker build"),Oy("docker",["build","--platform",R,"--provenance=false","--sbom=false","-t",C,S],{stdio:"inherit"}),N("ecr auth + push");let z=(await $.getAuthorizationToken()).authorizationData?.[0];if(!z?.authorizationToken||!z.proxyEndpoint)throw Error("failed to get an ECR authorization token");let F=z.proxyEndpoint.replace(/^https?:\/\//,""),B=Eh(S,".docker");return QX(B,{recursive:!0}),L$(Eh(B,"config.json"),JSON.stringify({auths:{[F]:{auth:z.authorizationToken}}})),Oy("docker",["push",C],{stdio:"inherit",env:{...process.env,DOCKER_CONFIG:B}}),U(`Image: ${C}`),{imageUri:C,tag:c,handlers:L}}finally{Lu(S,{recursive:!0,force:!0})}}var MX=CE(async()=>{fE();Y0();await aE()});var Kr={};Z_(Kr,{setMaintenance:()=>lS,serverlessInfo:()=>_T,scaleServerlessDatabase:()=>KX,runRemoteCommand:()=>it,runDbQuery:()=>Fu,runAndRecordCommand:()=>Ju,rollbackServerlessApp:()=>M0,restoreServerlessDatabase:()=>ju,resolveServerlessFunctions:()=>lt,resolveSecrets:()=>Cy,redeployServerlessApp:()=>G0,listCommandHistory:()=>Jy,infraEnvFromOutputs:()=>U$,getCommandRecord:()=>zu,deployServerlessApp:()=>fX,buildFunctionEnv:()=>nS,assertEnvWithinLimit:()=>$$});import{existsSync as Uu,readdirSync as $u,readFileSync as Du,statSync as Iu}from"node:fs";import{join as $y,relative as Cu}from"node:path";function Pd(E,_){let T=E.environments?.[_]?.app;if(!T)throw Error(`No serverless app configured for environment '${_}'. Add environments.${_}.app to your config.`);let r=E.project.slug,d=E.environments?.[_]?.region||E.project.region||"us-east-1";return{app:T,slug:r,region:d,stackName:Xt(E,_),artifactBucket:NI(r,_),assetsBucket:Xc(r,_)}}function lt(E,_){let T=Pd(E,_),r=`${T.slug}-${_}`;return{region:T.region,slug:T.slug,stackName:T.stackName,functions:{http:`${r}-http`,queue:`${r}-queue`,cli:`${r}-cli`}}}async function rN(E,_=8){let T;for(let r=0;r<_;r++)try{return await E()}catch(d){let t=d?.code||d?.name||"",R=String(d?.message||"");if(t==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(R)){T=d,await new Promise((h)=>setTimeout(h,3000));continue}throw d}throw T}async function c$(E,_,T,r){try{return await E.getObjectJson(_,Dy(T,r))}catch{return null}}async function Iy(E,_,T,r,d){await E.putObjectJson(_,Dy(T,r),d)}async function Cy(E,_){if(!E.secrets)return{};let T=new CT(_),r={},d=Array.isArray(E.secrets)?E.secrets.map((t)=>({envName:t.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:t})):Object.entries(E.secrets).map(([t,R])=>({envName:t,secretId:R}));if(Array.isArray(E.secrets)){let t=new Map;for(let{envName:h,secretId:N}of d)t.set(h,[...t.get(h)??[],N]);let R=[...t.entries()].filter(([,h])=>h.length>1);if(R.length){let h=R.map(([N,S])=>`${N} ← ${S.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${h}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:t,secretId:R}of d){let N=(await T.getSecretValue({SecretId:R})).SecretString??"";try{let S=JSON.parse(N);if(S&&typeof S==="object"&&!Array.isArray(S)){for(let[A,L]of Object.entries(S))r[A]=String(L);continue}}catch{}r[t]=N}return r}function U$(E,_){let T={},r=_.DbProxyEndpoint||_.DbEndpoint;if(r)T.DB_CONNECTION="mysql",T.DB_HOST=r,T.DB_PORT="3306",T.DB_DATABASE=T.DB_DATABASE||"app";if(_.CacheEndpoint){if(T.REDIS_HOST=_.CacheEndpoint,T.REDIS_PORT="6379",E.cache?.driver==="elasticache")T.CACHE_STORE="redis",T.CACHE_DRIVER="redis",T.SESSION_DRIVER="redis"}return T}function nS(E,_,T,r,d,t,R,h={}){let N=E.kind==="php"?kC({cacheDriver:E.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:r,TSCLOUD_ENV:T,MAINTENANCE_MODE:"0",...E.octane?{TSCLOUD_OCTANE:"1"}:{},...E.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...E.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...N,...h,..._.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${_.slug}-${T}-cache`}:{},...R?{TSCLOUD_QUEUE:R,SQS_QUEUE:R}:{},...t?{ASSET_URL:t}:{},...E.env??{},...d}}function wu(E){let _=E.slice(E.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[_]??"application/octet-stream"}function*wy(E){for(let _ of $u(E)){let T=$y(E,_);if(Iu(T).isDirectory())yield*wy(T);else yield T}}async function eu(E,_,T,r,d=!1){let t=0;for(let R of wy(T)){let h=Cu(T,R).replace(/\\/g,"/");if(!d&&h.split("/").some((N)=>N.startsWith(".")))continue;await E.putObject({bucket:_,key:`${r}/${h}`,body:Du(R),contentType:wu(R),cacheControl:"public, max-age=31536000, immutable"}),t++}return t}function $$(E,_){let T=Object.entries(_).reduce((r,[d,t])=>r+Buffer.byteLength(`${d}=${t}`,"utf8"),0);if(T>4096){let r=Object.entries(_).map(([d,t])=>[d,Buffer.byteLength(`${d}=${t}`,"utf8")]).sort((d,t)=>t[1]-d[1]).slice(0,5).map(([d,t])=>`${d} (${t}B)`).join(", ");throw Error(`${E}: environment variables total ${T}B, over AWS's 4096B limit (${T-4096}B too large). Largest: ${r}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function Q0(E,_,T,r){$$(_,T),await rN(()=>E.updateFunctionConfiguration({FunctionName:_,Environment:{Variables:T}})),await E.waitForFunctionActive(_,120);let d=r.kind==="image"?{FunctionName:_,ImageUri:r.imageUri}:{FunctionName:_,S3Bucket:r.bucket,S3Key:r.key};await rN(()=>E.updateFunctionCode(d)),await E.waitForFunctionActive(_,120)}async function O$(E,_){let r=(await rN(()=>E.publishVersion({FunctionName:_}))).Version;if(!r)throw Error(`publishVersion returned no version for ${_}`);return await rN(()=>E.updateAlias({FunctionName:_,Name:"live",FunctionVersion:r})),r}async function fX(E,_,T={}){let r=Pd(E,_),{app:d,slug:t,region:R,stackName:h,artifactBucket:N}=r,S=T.projectRoot??process.cwd();b(`Deploying serverless app: ${t} (${_})`),U(`Stack: ${h}`),U(`Region: ${R}`);let A=new xE(R),L=new oE(R),O=new B_(R),c=d.kind==="php",$=d.packaging==="image",I=Pc(d),C,e,z,F,B=[];if($&&I.usesLayer&&I.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${I.kind}${I.kind==="node"?` ${I.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if($){wE("Building + pushing container image");let{buildAndPushServerlessImage:OE}=await MX().then(() => Uy),RE=await OE({app:d,projectRoot:S,region:R,repository:`${t}-${_}`,skipBuild:T.skipBuild,onStep:(zE)=>U(`  ${zE}`)});C=RE.handlers,e={kind:"image",imageUri:RE.imageUri},z=RE.tag,B.push({ParameterKey:"ImageUri",ParameterValue:RE.imageUri})}else{wE("Packaging application");let OE=c?vC({projectRoot:S,app:d,skipBuild:T.skipBuild,onStep:(BE)=>U(`  ${BE}`)}):await BL({projectRoot:S,app:d,skipBuild:T.skipBuild,onStep:(BE)=>U(`  ${BE}`)}),RE=VC(t,_,OE.sha256);if(U(`Artifact: ${OE.sha256.slice(0,12)} (${(OE.zip.length/1024).toFixed(0)} KB)`),C=OE.handlers,z=OE.sha256,I.usesLayer){let BE=I.layerEnvVar?process.env[I.layerEnvVar]:void 0;if(F=d.layers??(BE?[BE]:void 0),!F?.length){let dE=I.layerKind==="php"?"serverless:build-php-layer":I.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${I.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${I.layerEnvVar} env var (build one with \`cloud ${dE}\`)${I.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await A.bucketExists(N))wE(`Creating artifact bucket ${N}`),await A.createBucket(N);if(await A.headObject(N,RE).then((BE)=>BE!==null).catch(()=>!1))U("Artifact already uploaded — reusing");else wE("Uploading artifact"),await A.putObject({bucket:N,key:RE,body:OE.zip,contentType:"application/zip"});e={kind:"zip",bucket:N,key:RE},B.push({ParameterKey:"ArtifactBucket",ParameterValue:N},{ParameterKey:"ArtifactKey",ParameterValue:RE})}let y=qC({config:E,environment:_,app:d,handlers:C,runtimeLayers:F}),Y=JSON.stringify(y.template),M=["CAPABILITY_NAMED_IAM"],V=await L.describeStacks({stackName:h}).then((OE)=>OE.Stacks[0]?.StackStatus).catch(()=>{return}),g=V!==void 0;if(V&&/DELETE_IN_PROGRESS/.test(V))wE("Waiting for an in-progress stack delete to finish"),await L.waitForStack(h,"stack-delete-complete").catch(()=>{}),g=!1;else if(V&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(V))wE(`Deleting unusable stack (status ${V}) before recreate`),await L.deleteStack(h),await L.waitForStack(h,"stack-delete-complete").catch(()=>{}),g=!1;wE(g?"Updating infrastructure stack":"Creating infrastructure stack");try{if(g)await L.updateStack({stackName:h,templateBody:Y,parameters:B,capabilities:M}),await L.waitForStack(h,"stack-update-complete");else await L.createStack({stackName:h,templateBody:Y,parameters:B,capabilities:M,onFailure:"DELETE"}),await L.waitForStack(h,"stack-create-complete")}catch(OE){if(/No updates are to be performed/i.test(String(OE?.message)))U("No infrastructure changes");else throw OE}let k=await L.getStackOutputs(h).catch(()=>({})),v;if(d.assets){let OE=$y(S,d.assets);if(Uu(OE)){let RE=d.assetDomain||k.AssetsCdnDomain;v=RE?`https://${RE}/${z}`:void 0,wE(`Syncing assets from ${d.assets}`);let zE=await eu(A,r.assetsBucket,OE,z,d.dotFilesAsAssets);U(`Uploaded ${zE} asset(s)${v?` → ${v}`:""}`)}else _E(`Assets directory not found: ${OE}`)}wE("Resolving secrets");let EE=await Cy(d,R);if(d.database?.connection==="aurora-serverless")try{let RE=await new CT(R).getSecretValue({SecretId:`${t}/${_}/db`}),zE=JSON.parse(RE.SecretString??"{}");if(zE.username)EE.DB_USERNAME=zE.username;if(zE.password)EE.DB_PASSWORD=zE.password}catch(OE){_E(`Could not resolve Aurora DB credentials: ${OE.message}`)}if(!await A.bucketExists(N))await A.createBucket(N);let m=await c$(A,N,t,_),rE={},LE=y.queueNames[0],P=U$(d,k);if(wE("Activating functions"),rE.http=nS(d,r,_,"http",EE,v,LE,P),await Q0(O,y.functionNames.http,rE.http,e),rE.cli=nS(d,r,_,"cli",EE,v,LE,P),await Q0(O,y.functionNames.cli,rE.cli,e),y.queueNames.length)rE.queue=nS(d,r,_,"queue",EE,v,LE,P),await Q0(O,y.functionNames.queue,rE.queue,e);let x=(d.provisionedConcurrency??0)>0,s={};if(x){if(wE("Publishing versions + flipping live alias"),s.http=await O$(O,y.functionNames.http),s.cli=await O$(O,y.functionNames.cli),y.queueNames.length)s.queue=await O$(O,y.functionNames.queue)}if(await Iy(A,N,t,_,{sha:z,code:e,previousSha:m?.sha,previousCode:m?.code,previousFunctionEnv:m?.functionEnv,...x?{functionVersions:s,previousFunctionVersions:m?.functionVersions}:{},functionEnv:rE,functionNames:{http:y.functionNames.http,cli:y.functionNames.cli,...y.queueNames.length?{queue:y.functionNames.queue}:{}},assetUrl:v,timestamp:new Date().toISOString()}),!T.skipDeployHooks&&d.deploy?.length){wE("Running deploy hooks");for(let OE of d.deploy){U(`  deploy: ${OE}`);let RE=await O.invoke({FunctionName:y.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:OE},LogType:"Tail"});if(RE.FunctionError)throw Q("Deploy hook failed — the new build is ALREADY LIVE."),U(`  Roll back with: cloud serverless:rollback --env ${_}`),Error(`Deploy hook failed (${OE}): ${RE.Payload}`)}}let TE=k.HttpApiEndpoint;if(!T.skipHealthCheck&&TE){wE("Health check");try{let OE=await fetch(TE,{method:"GET"});U(`GET ${TE} → ${OE.status}`)}catch(OE){_E(`Health check could not reach ${TE}: ${OE.message}`)}}nr(["Serverless deploy complete","",TE?`URL:   ${TE}`:"",`Stack: ${h}`,`Build: ${z.slice(0,12)}`].filter(Boolean).join(`
 `),"green")}async function G0(E,_){let T=Pd(E,_),r=new xE(T.region),d=new B_(T.region),t=await c$(r,T.artifactBucket,T.slug,_);if(!t)throw Error("No previous release to redeploy. Run a full deploy first.");b(`Redeploying ${T.slug} (${_}) — build ${t.sha.slice(0,12)}`);for(let[R,h]of Object.entries(t.functionNames)){if(!h)continue;wE(`Re-activating ${R} (${h})`),await Q0(d,h,t.functionEnv[R]??{},t.code);let N=t.functionVersions?.[R];if(N)await rN(()=>d.updateAlias({FunctionName:h,Name:"live",FunctionVersion:N}))}Z("Redeploy complete")}async function M0(E,_){let T=Pd(E,_),r=new xE(T.region),d=new B_(T.region),t=await c$(r,T.artifactBucket,T.slug,_);if(!t?.previousCode)throw Error("No previous release to roll back to.");b(`Rolling back ${T.slug} (${_}) → ${t.previousSha?.slice(0,12)}`);for(let[R,h]of Object.entries(t.functionNames)){if(!h)continue;wE(`Restoring ${R} (${h})`);let N=t.previousFunctionEnv?.[R]??t.functionEnv[R]??{};await Q0(d,h,N,t.previousCode);let S=t.previousFunctionVersions?.[R];if(S)await rN(()=>d.updateAlias({FunctionName:h,Name:"live",FunctionVersion:S}))}await Iy(r,T.artifactBucket,T.slug,_,{...t,sha:t.previousSha??t.sha,code:t.previousCode,functionEnv:t.previousFunctionEnv??t.functionEnv,functionVersions:t.previousFunctionVersions??t.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),Z("Rollback complete")}async function lS(E,_,T,r){let d=Pd(E,_),t=new B_(d.region),R=`${d.slug}-${_}-http`,N={...(await t.getFunction(R)).Configuration?.Environment?.Variables??{}};if(N.MAINTENANCE_MODE=T?"1":"0",T&&r)N.MAINTENANCE_BYPASS_SECRET=r;if(!T)delete N.MAINTENANCE_BYPASS_SECRET;if(await rN(()=>t.updateFunctionConfiguration({FunctionName:R,Environment:{Variables:N}})),(d.app.provisionedConcurrency??0)>0)await t.waitForFunctionActive(R,120),await O$(t,R);Z(T?"Application is now in maintenance mode (503)":"Application is live")}async function it(E,_,T){let r=Pd(E,_),d=new B_(r.region),t=`${r.slug}-${_}-cli`,R=await d.invoke({FunctionName:t,InvocationType:"RequestResponse",Payload:{command:T},LogType:"Tail"});if(R.FunctionError)throw Error(`Command failed: ${R.Payload}`);return R.Payload??""}async function Xy(E,_,T,r){try{return(await E.getObjectJson(_,ey(T,r)))?.records??[]}catch{return[]}}async function Ju(E,_,T){let r=Pd(E,_),d=new B_(r.region),t=`${r.slug}-${_}-cli`,R=await d.invoke({FunctionName:t,InvocationType:"RequestResponse",Payload:{command:T},LogType:"Tail"}),h=R.Payload??"",N=R.FunctionError?"error":"ok",S=-1;try{let A=new xE(r.region);if(await A.bucketExists(r.artifactBucket)){let L=await Xy(A,r.artifactBucket,r.slug,_);S=L.reduce((O,c)=>Math.max(O,c.id),0)+1,L.push({id:S,command:T,timestamp:new Date().toISOString(),status:N,output:h.slice(0,4000)}),await A.putObjectJson(r.artifactBucket,ey(r.slug,_),{records:L.slice(-Xu)})}}catch{}if(R.FunctionError)throw Error(`Command failed${S>0?` (#${S})`:""}: ${h}`);return{id:S,status:N,output:h}}async function Jy(E,_){let T=Pd(E,_),r=new xE(T.region);return Xy(r,T.artifactBucket,T.slug,_)}async function zu(E,_,T){let r=await Jy(E,_);if(!r.length)return;return T==null?r[r.length-1]:r.find((d)=>d.id===T)}async function Fu(E,_,T){let r=Buffer.from(T,"utf-8").toString("base64");return it(E,_,`tscloud:db-query --sql-base64=${r}`)}async function _T(E,_){let T=Pd(E,_),r=new oE(T.region),d=new B_(T.region),t=new xE(T.region),R="not deployed",h={};try{let{Stacks:$}=await r.describeStacks({stackName:T.stackName});R=$?.[0]?.StackStatus??R;for(let I of $?.[0]?.Outputs??[])if(I.OutputKey)h[I.OutputKey]=I.OutputValue??""}catch{}let N=ZC(T.app,T.slug,_),S=T.app.provisionedConcurrency??0,A=["http","cli",...N.length?["queue"]:[]],L=`${T.slug}-${_}`,O=[];for(let $ of A){let I=`${L}-${$}`,C={mode:$,name:I,version:"$LATEST"};if(S>0){let e=await d.getAlias(I,"live").catch(()=>null);if(e?.FunctionVersion){C.version=e.FunctionVersion;let z=await d.getProvisionedConcurrencyConfig(I,"live").catch(()=>null);if(z)C.provisioned={status:z.Status??"-",allocated:z.AllocatedProvisionedConcurrentExecutions??0,requested:z.RequestedProvisionedConcurrentExecutions??0}}}O.push(C)}let c=await c$(t,T.artifactBucket,T.slug,_).catch(()=>null);return{slug:T.slug,environment:_,region:T.region,stackStatus:R,endpoint:h.HttpApiEndpoint,assetUrl:c?.assetUrl,scheduler:T.app.scheduler??"on",queues:N,provisionedConcurrency:S,functions:O,lastRelease:c?{sha:c.sha,timestamp:c.timestamp}:void 0}}function zy(E,_){return`${E}-${_}-db`}async function KX(E,_,T,r){let d=Pd(E,_);if(d.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:t}=await Promise.resolve().then(() => (ut(),t$)),R=new t(d.region),h=zy(d.slug,_);wE(`Scaling ${h} → ${T}–${r} ACUs`),await R.modifyDBCluster({DBClusterIdentifier:h,ServerlessV2ScalingConfiguration:{MinCapacity:T,MaxCapacity:r},ApplyImmediately:!0}),Z(`Scaling applied to ${h} (takes effect shortly).`)}async function ju(E,_,T){let r=Pd(E,_);if(r.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");if(!T.toTime&&!T.latest)throw Error("Specify a restore point: --to <ISO timestamp> or --latest.");let{RDSClient:d}=await Promise.resolve().then(() => (ut(),t$)),t=new d(r.region),R=zy(r.slug,_),h=T.latest?"latest":T.toTime.toISOString().replace(/[^0-9]/g,"").slice(0,14),N=T.target??`${R}-restore-${h}`;wE(`Restoring ${R} → new cluster ${N} (${T.latest?"latest restorable time":T.toTime.toISOString()})`),await t.restoreDBClusterToPointInTime({DBClusterIdentifier:N,SourceDBClusterIdentifier:R,RestoreToTime:T.toTime,UseLatestRestorableTime:T.latest}),wE("Waiting for the restored cluster to be ready");for(let S=0;S<120;S++){let{DBClusters:A}=await t.describeDBClusters({DBClusterIdentifier:N}),L=A?.[0]?.Status;if(L&&L!=="creating")break;await new Promise((O)=>setTimeout(O,15000))}return wE("Adding a writer instance"),await t.createDBInstance({DBInstanceIdentifier:`${N}-1`,DBClusterIdentifier:N,Engine:"aurora-mysql",DBInstanceClass:"db.serverless"}),Z(`Restore complete → cluster ${N} with writer ${N}-1. Point an env's database at it once available.`),N}var Dy=(E,_)=>`releases/${E}/${_}/current.json`,ey=(E,_)=>`commands/${E}/${_}/history.json`,Xu=50;var TT=CE(async()=>{fE();KT();Gr();z_();Kh();await aE()});import{createHash as Wu}from"node:crypto";import{existsSync as jy,mkdirSync as Hu,readdirSync as Pu,readFileSync as yu,rmSync as Yu,writeFileSync as Qu}from"node:fs";import{homedir as Gu}from"node:os";import{join as iS}from"node:path";function xX(){let E=process.env.XDG_CACHE_HOME;return iS(E&&E.trim()?E:iS(Gu(),".cache"),"ts-cloud","cost-explorer")}function I$(E){return iS(xX(),E??"__default__")}function Hy(E){let _={s:E.start,e:E.end,g:E.granularity,m:[...E.metrics].sort(),gb:[...E.groupBy].map((T)=>`${T.Type}:${T.Key}`).sort(),f:E.filter??null};return Wu("sha256").update(JSON.stringify(_)).digest("hex").slice(0,24)}function Vu(E,_){let T=Date.parse(`${_}T00:00:00Z`);if(Number.isNaN(T))return!1;let r=new Date,d=Date.UTC(r.getUTCFullYear(),r.getUTCMonth(),1);return T<=d}function Zu(E){return Vu(E.start,E.end)?Ku:fu}function Py(E,_){let T=iS(I$(E),`${Hy(_)}.json`);if(!jy(T))return null;let r;try{r=JSON.parse(yu(T,"utf-8"))}catch{return null}if(r.schema!==By)return null;let d=Date.now()-r.savedAt;if(d<0||d>Zu(_))return null;return{response:r.response,ageSeconds:Math.floor(d/1000)}}function yy(E,_,T){let r=I$(E);Hu(r,{recursive:!0});let d={schema:By,savedAt:Date.now(),key:_,response:T};Qu(iS(r,`${Hy(_)}.json`),JSON.stringify(d))}function Yy(E){let _=E===void 0?xX():I$(E);if(!jy(_))return{deletedFiles:0,scope:E??"all profiles"};let T=0;function r(d){for(let t of Pu(d,{withFileTypes:!0})){let R=iS(d,t.name);if(t.isDirectory())r(R);else if(t.isFile()&&t.name.endsWith(".json"))T++}}return r(_),Yu(_,{recursive:!0,force:!0}),{deletedFiles:T,scope:E??"all profiles"}}function Qy(E){return E===void 0?xX():I$(E)}var By=1,Wy=3600000,Mu,fu,Ku;var bX=CE(()=>{Mu=24*Wy,fu=Wy,Ku=30*Mu});class rt{client;profile;useCache;lastCacheAgeSeconds=null;constructor(E,_){this.profile=E,this.useCache=_?.useCache??!0,this.client=new JE(BR(E))}async getCostByService(E){return(await this.getCostByDimension({...E,dimension:"SERVICE"})).map((T)=>({service:T.key,amount:T.amount,unit:T.unit}))}async getCostByDimension(E){let{start:_,end:T,dimension:r,granularity:d="MONTHLY",filter:t}=E,R=["UnblendedCost"],h=[{Type:"DIMENSION",Key:r}],N={start:_,end:T,granularity:d,metrics:R,groupBy:h,filter:t};if(this.useCache){let O=Py(this.profile,N);if(O)return this.lastCacheAgeSeconds=O.ageSeconds,O.response}this.lastCacheAgeSeconds=null;let S=new Map,A;do{let O={TimePeriod:{Start:_,End:T},Granularity:d,Metrics:R,GroupBy:h};if(t)O.Filter=t;if(A)O.NextPageToken=A;let c=await this.client.request({service:"ce",region:"us-east-1",method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"AWSInsightsIndexService.GetCostAndUsage"},body:JSON.stringify(O)});for(let $ of c?.ResultsByTime??[])for(let I of $?.Groups??[]){let C=I.Keys?.[0]??"Unknown",e=Number.parseFloat(I.Metrics?.UnblendedCost?.Amount??"0"),z=I.Metrics?.UnblendedCost?.Unit??"USD",F=S.get(C);S.set(C,{key:C,amount:(F?.amount??0)+e,unit:z})}A=c?.NextPageToken||void 0}while(A);let L=[...S.values()].filter((O)=>O.amount>0).sort((O,c)=>c.amount-O.amount);if(this.useCache)yy(this.profile,N,L);return L}async getDailyTotals(E){return((await this.client.request({service:"ce",region:"us-east-1",method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"AWSInsightsIndexService.GetCostAndUsage"},body:JSON.stringify({TimePeriod:{Start:E.start,End:E.end},Granularity:"DAILY",Metrics:["UnblendedCost"]})}))?.ResultsByTime??[]).map((r)=>Number.parseFloat(r.Total?.UnblendedCost?.Amount??"0"))}}var f0=CE(()=>{VE();bX()});function $2(E={}){let _=new Set;for(let T of Object.values(E)){if(!T.domain)continue;if(T.redirect||T.deploy==="server"||T.start)_.add(T.domain)}return _}function U2(E){return E.replace(/\.$/,"").toLowerCase()}function kv(E,_,T){let r=U2(E.name),d=U2(_),t=U2(T),R=t===d?"@":t.endsWith(`.${d}`)?t.slice(0,-(d.length+1)):t;return r===t||r===R||R==="@"&&(r===""||r===d)}async function D2(E,_,T,r,d="A"){let t=await E.listRecords(_);if(!t.success)return[`could not list ${d} records: ${t.message||"unknown provider error"}`];let R=t.records.filter((S)=>S.type===d&&kv(S,_,T)),h=R.findIndex((S)=>S.content===r);if(R.length<=1||h===-1)return[];let N=[];for(let[S,A]of R.entries()){if(S===h)continue;let L=await E.deleteRecord(_,A);if(!L.success)N.push(`could not remove stale ${A.name} ${d} ${A.content}: ${L.message||"unknown provider error"}`)}return N}function st(E){if(!E)return;let _=E.trim();if(!_)return;if(!_.includes("/"))return _;let[T]=_.split("/");if(!T.endsWith("::"))return T||void 0;return`${T}1`}var TA=()=>{};var X5={};Z_(X5,{EC2Client:()=>ST});class ST{client;region;constructor(E="us-east-1"){this.region=E,this.client=new JE}async describeInstances(E){let _={Action:"DescribeInstances",Version:"2016-11-15"};if(E?.InstanceIds)E.InstanceIds.forEach((d,t)=>{_[`InstanceId.${t+1}`]=d});if(E?.Filters)E.Filters.forEach((d,t)=>{_[`Filter.${t+1}.Name`]=d.Name,d.Values.forEach((R,h)=>{_[`Filter.${t+1}.Value.${h+1}`]=R})});if(E?.MaxResults)_.MaxResults=String(E.MaxResults);if(E?.NextToken)_.NextToken=E.NextToken;let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()}),r=T.DescribeInstancesResponse||T;return{Reservations:this.parseReservations(r.reservationSet?.item),NextToken:r.nextToken}}async getInstance(E){return(await this.describeInstances({InstanceIds:[E]})).Reservations?.[0]?.Instances?.[0]}async getConsoleOutput(E,_){let T={Action:"GetConsoleOutput",Version:"2016-11-15",InstanceId:E};if(_)T.Latest="true";let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(T).toString()}),d=r.GetConsoleOutputResponse||r;return{InstanceId:d.instanceId,Output:d.output,Timestamp:d.timestamp}}async getConsoleOutputDecoded(E,_){let T=await this.getConsoleOutput(E,_?.latest);if(!T.Output)return"No console output available yet";let r=Buffer.from(T.Output,"base64").toString("utf-8");if(_?.tailLines)return r.split(`
 `).slice(-_.tailLines).join(`
-`);return r}async describeInstanceStatus(E){let _={Action:"DescribeInstanceStatus",Version:"2016-11-15"};if(E?.InstanceIds)E.InstanceIds.forEach((r,d)=>{_[`InstanceId.${d+1}`]=r});if(E?.IncludeAllInstances)_.IncludeAllInstances="true";if(E?.Filters)E.Filters.forEach((r,d)=>{_[`Filter.${d+1}.Name`]=r.Name,r.Values.forEach((t,R)=>{_[`Filter.${d+1}.Value.${R+1}`]=t})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{InstanceStatuses:this.parseArray(T.instanceStatusSet?.item).map((r)=>({InstanceId:r.instanceId,InstanceState:r.instanceState?{Code:Number.parseInt(r.instanceState.code),Name:r.instanceState.name}:void 0,InstanceStatus:r.instanceStatus?{Status:r.instanceStatus.status,Details:this.parseArray(r.instanceStatus.details?.item).map((d)=>({Name:d.name,Status:d.status}))}:void 0,SystemStatus:r.systemStatus?{Status:r.systemStatus.status,Details:this.parseArray(r.systemStatus.details?.item).map((d)=>({Name:d.name,Status:d.status}))}:void 0}))}}async startInstances(E){let _={Action:"StartInstances",Version:"2016-11-15"};E.forEach((r,d)=>{_[`InstanceId.${d+1}`]=r});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{StartingInstances:this.parseArray(T.instancesSet?.item).map((r)=>({InstanceId:r.instanceId,CurrentState:r.currentState?{Name:r.currentState.name}:void 0,PreviousState:r.previousState?{Name:r.previousState.name}:void 0}))}}async stopInstances(E,_){let T={Action:"StopInstances",Version:"2016-11-15"};if(E.forEach((d,t)=>{T[`InstanceId.${t+1}`]=d}),_)T.Force="true";let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(T).toString()});return{StoppingInstances:this.parseArray(r.instancesSet?.item).map((d)=>({InstanceId:d.instanceId,CurrentState:d.currentState?{Name:d.currentState.name}:void 0,PreviousState:d.previousState?{Name:d.previousState.name}:void 0}))}}async rebootInstances(E){let _={Action:"RebootInstances",Version:"2016-11-15"};E.forEach((T,r)=>{_[`InstanceId.${r+1}`]=T}),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async terminateInstances(E){let _={Action:"TerminateInstances",Version:"2016-11-15"};E.forEach((r,d)=>{_[`InstanceId.${d+1}`]=r});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{TerminatingInstances:this.parseArray(T.instancesSet?.item).map((r)=>({InstanceId:r.instanceId,CurrentState:r.currentState?{Name:r.currentState.name}:void 0,PreviousState:r.previousState?{Name:r.previousState.name}:void 0}))}}async createImage(E){let _={Action:"CreateImage",Version:"2016-11-15",InstanceId:E.InstanceId,Name:E.Name};if(E.Description)_.Description=E.Description;if(E.NoReboot!==void 0)_.NoReboot=String(E.NoReboot);if(E.TagSpecifications)E.TagSpecifications.forEach((d,t)=>{_[`TagSpecification.${t+1}.ResourceType`]=d.ResourceType,d.Tags.forEach((R,h)=>{_[`TagSpecification.${t+1}.Tag.${h+1}.Key`]=R.Key,_[`TagSpecification.${t+1}.Tag.${h+1}.Value`]=R.Value})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{ImageId:(T.CreateImageResponse||T).imageId}}async deregisterImage(E){await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({Action:"DeregisterImage",Version:"2016-11-15",ImageId:E}).toString()})}async describeVpcs(E){let _={Action:"DescribeVpcs",Version:"2016-11-15"};if(E?.VpcIds)E.VpcIds.forEach((r,d)=>{_[`VpcId.${d+1}`]=r});if(E?.Filters)E.Filters.forEach((r,d)=>{_[`Filter.${d+1}.Name`]=r.Name,r.Values.forEach((t,R)=>{_[`Filter.${d+1}.Value.${R+1}`]=t})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{Vpcs:this.parseArray(T.vpcSet?.item).map((r)=>({VpcId:r.vpcId,CidrBlock:r.cidrBlock,State:r.state,DhcpOptionsId:r.dhcpOptionsId,InstanceTenancy:r.instanceTenancy,IsDefault:r.isDefault==="true",Tags:this.parseTags(r.tagSet?.item)}))}}async describeSubnets(E){let _={Action:"DescribeSubnets",Version:"2016-11-15"};if(E?.SubnetIds)E.SubnetIds.forEach((r,d)=>{_[`SubnetId.${d+1}`]=r});if(E?.Filters)E.Filters.forEach((r,d)=>{_[`Filter.${d+1}.Name`]=r.Name,r.Values.forEach((t,R)=>{_[`Filter.${d+1}.Value.${R+1}`]=t})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{Subnets:this.parseArray(T.subnetSet?.item).map((r)=>({SubnetId:r.subnetId,VpcId:r.vpcId,CidrBlock:r.cidrBlock,AvailabilityZone:r.availabilityZone,AvailableIpAddressCount:Number.parseInt(r.availableIpAddressCount),State:r.state,MapPublicIpOnLaunch:r.mapPublicIpOnLaunch==="true",Tags:this.parseTags(r.tagSet?.item)}))}}async describeSecurityGroups(E){let _={Action:"DescribeSecurityGroups",Version:"2016-11-15"};if(E?.GroupIds)E.GroupIds.forEach((r,d)=>{_[`GroupId.${d+1}`]=r});if(E?.GroupNames)E.GroupNames.forEach((r,d)=>{_[`GroupName.${d+1}`]=r});if(E?.Filters)E.Filters.forEach((r,d)=>{_[`Filter.${d+1}.Name`]=r.Name,r.Values.forEach((t,R)=>{_[`Filter.${d+1}.Value.${R+1}`]=t})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{SecurityGroups:this.parseArray(T.securityGroupInfo?.item).map((r)=>({GroupId:r.groupId,GroupName:r.groupName,Description:r.groupDescription,VpcId:r.vpcId,IpPermissions:this.parseIpPermissions(r.ipPermissions?.item),IpPermissionsEgress:this.parseIpPermissions(r.ipPermissionsEgress?.item),Tags:this.parseTags(r.tagSet?.item)}))}}async describeInternetGateways(E){let _={Action:"DescribeInternetGateways",Version:"2016-11-15"};if(E?.InternetGatewayIds)E.InternetGatewayIds.forEach((r,d)=>{_[`InternetGatewayId.${d+1}`]=r});if(E?.Filters)E.Filters.forEach((r,d)=>{_[`Filter.${d+1}.Name`]=r.Name,r.Values.forEach((t,R)=>{_[`Filter.${d+1}.Value.${R+1}`]=t})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{InternetGateways:this.parseArray(T.internetGatewaySet?.item).map((r)=>({InternetGatewayId:r.internetGatewayId,Attachments:this.parseArray(r.attachmentSet?.item).map((d)=>({VpcId:d.vpcId,State:d.state})),Tags:this.parseTags(r.tagSet?.item)}))}}async describeAddresses(E){let _={Action:"DescribeAddresses",Version:"2016-11-15"};if(E?.AllocationIds)E.AllocationIds.forEach((r,d)=>{_[`AllocationId.${d+1}`]=r});if(E?.PublicIps)E.PublicIps.forEach((r,d)=>{_[`PublicIp.${d+1}`]=r});if(E?.Filters)E.Filters.forEach((r,d)=>{_[`Filter.${d+1}.Name`]=r.Name,r.Values.forEach((t,R)=>{_[`Filter.${d+1}.Value.${R+1}`]=t})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{Addresses:this.parseArray(T.addressesSet?.item).map((r)=>({PublicIp:r.publicIp,AllocationId:r.allocationId,AssociationId:r.associationId,InstanceId:r.instanceId,NetworkInterfaceId:r.networkInterfaceId,PrivateIpAddress:r.privateIpAddress,Domain:r.domain,Tags:this.parseTags(r.tagSet?.item)}))}}async allocateAddress(E){let _={Action:"AllocateAddress",Version:"2016-11-15"};if(E?.Domain)_.Domain=E.Domain;if(E?.TagSpecifications)E.TagSpecifications.forEach((r,d)=>{_[`TagSpecification.${d+1}.ResourceType`]=r.ResourceType,r.Tags.forEach((t,R)=>{_[`TagSpecification.${d+1}.Tag.${R+1}.Key`]=t.Key,_[`TagSpecification.${d+1}.Tag.${R+1}.Value`]=t.Value})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{AllocationId:T.allocationId,PublicIp:T.publicIp,Domain:T.domain}}async associateAddress(E){let _={Action:"AssociateAddress",Version:"2016-11-15"};if(E.AllocationId)_.AllocationId=E.AllocationId;if(E.PublicIp)_.PublicIp=E.PublicIp;if(E.InstanceId)_.InstanceId=E.InstanceId;if(E.NetworkInterfaceId)_.NetworkInterfaceId=E.NetworkInterfaceId;if(E.PrivateIpAddress)_.PrivateIpAddress=E.PrivateIpAddress;if(E.AllowReassociation)_.AllowReassociation="true";return{AssociationId:(await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})).associationId}}async createTags(E){let _={Action:"CreateTags",Version:"2016-11-15"};E.Resources.forEach((T,r)=>{_[`ResourceId.${r+1}`]=T}),E.Tags.forEach((T,r)=>{_[`Tag.${r+1}.Key`]=T.Key,_[`Tag.${r+1}.Value`]=T.Value}),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async waitForInstanceState(E,_,T){let r=T?.maxWaitMs||300000,d=T?.pollIntervalMs||5000,t=Date.now();while(Date.now()-t<r){let R;try{R=await this.getInstance(E)}catch{R=void 0}if(R?.State?.Name===_)return R;await new Promise((h)=>setTimeout(h,d))}return}async createVpc(E){let _={Action:"CreateVpc",Version:"2016-11-15",CidrBlock:E.CidrBlock};if(E.InstanceTenancy)_.InstanceTenancy=E.InstanceTenancy;if(E.TagSpecifications)E.TagSpecifications.forEach((t,R)=>{_[`TagSpecification.${R+1}.ResourceType`]=t.ResourceType,t.Tags.forEach((h,N)=>{_[`TagSpecification.${R+1}.Tag.${N+1}.Key`]=h.Key,_[`TagSpecification.${R+1}.Tag.${N+1}.Value`]=h.Value})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()}),d=(T.CreateVpcResponse||T).vpc;return{Vpc:d?{VpcId:d.vpcId,CidrBlock:d.cidrBlock,State:d.state,DhcpOptionsId:d.dhcpOptionsId,InstanceTenancy:d.instanceTenancy,IsDefault:d.isDefault==="true",Tags:this.parseTags(d.tagSet?.item)}:void 0}}async createSubnet(E){let _={Action:"CreateSubnet",Version:"2016-11-15",VpcId:E.VpcId,CidrBlock:E.CidrBlock};if(E.AvailabilityZone)_.AvailabilityZone=E.AvailabilityZone;if(E.TagSpecifications)E.TagSpecifications.forEach((t,R)=>{_[`TagSpecification.${R+1}.ResourceType`]=t.ResourceType,t.Tags.forEach((h,N)=>{_[`TagSpecification.${R+1}.Tag.${N+1}.Key`]=h.Key,_[`TagSpecification.${R+1}.Tag.${N+1}.Value`]=h.Value})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()}),d=(T.CreateSubnetResponse||T).subnet;return{Subnet:d?{SubnetId:d.subnetId,VpcId:d.vpcId,CidrBlock:d.cidrBlock,AvailabilityZone:d.availabilityZone,AvailableIpAddressCount:d.availableIpAddressCount?Number.parseInt(d.availableIpAddressCount):void 0,State:d.state,MapPublicIpOnLaunch:d.mapPublicIpOnLaunch==="true",Tags:this.parseTags(d.tagSet?.item)}:void 0}}async modifySubnetAttribute(E){let _={Action:"ModifySubnetAttribute",Version:"2016-11-15",SubnetId:E.SubnetId};if(E.MapPublicIpOnLaunch!==void 0)_["MapPublicIpOnLaunch.Value"]=String(E.MapPublicIpOnLaunch.Value);await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async createSecurityGroup(E){let _={Action:"CreateSecurityGroup",Version:"2016-11-15",GroupName:E.GroupName,GroupDescription:E.Description};if(E.VpcId)_.VpcId=E.VpcId;if(E.TagSpecifications)E.TagSpecifications.forEach((d,t)=>{_[`TagSpecification.${t+1}.ResourceType`]=d.ResourceType,d.Tags.forEach((R,h)=>{_[`TagSpecification.${t+1}.Tag.${h+1}.Key`]=R.Key,_[`TagSpecification.${t+1}.Tag.${h+1}.Value`]=R.Value})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{GroupId:(T.CreateSecurityGroupResponse||T).groupId}}async authorizeSecurityGroupIngress(E){let _={Action:"AuthorizeSecurityGroupIngress",Version:"2016-11-15",GroupId:E.GroupId};this.encodeIpPermissions(_,E.IpPermissions),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async authorizeSecurityGroupEgress(E){let _={Action:"AuthorizeSecurityGroupEgress",Version:"2016-11-15",GroupId:E.GroupId};this.encodeIpPermissions(_,E.IpPermissions),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async describeRouteTables(E){let _={Action:"DescribeRouteTables",Version:"2016-11-15"};if(E?.RouteTableIds)E.RouteTableIds.forEach((d,t)=>{_[`RouteTableId.${t+1}`]=d});if(E?.Filters)E.Filters.forEach((d,t)=>{_[`Filter.${t+1}.Name`]=d.Name,d.Values.forEach((R,h)=>{_[`Filter.${t+1}.Value.${h+1}`]=R})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()}),r=T.DescribeRouteTablesResponse||T;return{RouteTables:this.parseArray(r.routeTableSet?.item).map((d)=>({RouteTableId:d.routeTableId,VpcId:d.vpcId,Routes:this.parseArray(d.routeSet?.item).map((t)=>({DestinationCidrBlock:t.destinationCidrBlock,GatewayId:t.gatewayId,NatGatewayId:t.natGatewayId,State:t.state})),Associations:this.parseArray(d.associationSet?.item).map((t)=>({RouteTableAssociationId:t.routeTableAssociationId,SubnetId:t.subnetId,Main:t.main==="true"||t.main===!0})),Tags:this.parseTags(d.tagSet?.item)}))}}async deleteVpc(E){let _={Action:"DeleteVpc",Version:"2016-11-15",VpcId:E};await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async deleteSubnet(E){let _={Action:"DeleteSubnet",Version:"2016-11-15",SubnetId:E};await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async deleteSecurityGroup(E){await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({Action:"DeleteSecurityGroup",Version:"2016-11-15",GroupId:E}).toString()})}async describeNetworkInterfaces(E){let _={Action:"DescribeNetworkInterfaces",Version:"2016-11-15"};if(E?.NetworkInterfaceIds)E.NetworkInterfaceIds.forEach((d,t)=>{_[`NetworkInterfaceId.${t+1}`]=d});if(E?.Filters)E.Filters.forEach((d,t)=>{_[`Filter.${t+1}.Name`]=d.Name,d.Values.forEach((R,h)=>{_[`Filter.${t+1}.Value.${h+1}`]=R})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()}),r=T.DescribeNetworkInterfacesResponse||T;return{NetworkInterfaces:this.parseArray(r.networkInterfaceSet?.item).map((d)=>({NetworkInterfaceId:d.networkInterfaceId,SubnetId:d.subnetId,VpcId:d.vpcId,Status:d.status,Attachment:d.attachment?{AttachmentId:d.attachment.attachmentId,InstanceId:d.attachment.instanceId,Status:d.attachment.status}:void 0}))}}async detachNetworkInterface(E,_){let T={Action:"DetachNetworkInterface",Version:"2016-11-15",AttachmentId:E};if(_)T.Force="true";await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(T).toString()})}async deleteNetworkInterface(E){let _={Action:"DeleteNetworkInterface",Version:"2016-11-15",NetworkInterfaceId:E};await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async describeRegions(){let E={Action:"DescribeRegions",Version:"2016-11-15"},_=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(E).toString()}),T=_.DescribeRegionsResponse||_;return{Regions:this.parseArray(T.regionInfo?.item).map((r)=>({RegionName:r.regionName,Endpoint:r.regionEndpoint}))}}async runInstances(E){let _={Action:"RunInstances",Version:"2016-11-15",ImageId:E.ImageId,InstanceType:E.InstanceType,MinCount:String(E.MinCount),MaxCount:String(E.MaxCount)};if(E.SecurityGroupIds)E.SecurityGroupIds.forEach((d,t)=>{_[`SecurityGroupId.${t+1}`]=d});if(E.SubnetId)_.SubnetId=E.SubnetId;if(E.UserData)_.UserData=E.UserData;if(E.IamInstanceProfile){if(E.IamInstanceProfile.Name)_["IamInstanceProfile.Name"]=E.IamInstanceProfile.Name;if(E.IamInstanceProfile.Arn)_["IamInstanceProfile.Arn"]=E.IamInstanceProfile.Arn}if(E.TagSpecifications)E.TagSpecifications.forEach((d,t)=>{_[`TagSpecification.${t+1}.ResourceType`]=d.ResourceType,d.Tags.forEach((R,h)=>{_[`TagSpecification.${t+1}.Tag.${h+1}.Key`]=R.Key,_[`TagSpecification.${t+1}.Tag.${h+1}.Value`]=R.Value})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()}),r=T.RunInstancesResponse||T;return{Instances:this.parseInstances(r.instancesSet?.item||r.instancesSet)}}encodeIpPermissions(E,_){_.forEach((T,r)=>{let d=`IpPermissions.${r+1}`;if(T.IpProtocol!==void 0)E[`${d}.IpProtocol`]=T.IpProtocol;if(T.FromPort!==void 0)E[`${d}.FromPort`]=String(T.FromPort);if(T.ToPort!==void 0)E[`${d}.ToPort`]=String(T.ToPort);if(T.IpRanges)T.IpRanges.forEach((t,R)=>{if(t.CidrIp)E[`${d}.IpRanges.${R+1}.CidrIp`]=t.CidrIp;if(t.Description)E[`${d}.IpRanges.${R+1}.Description`]=t.Description});if(T.Ipv6Ranges)T.Ipv6Ranges.forEach((t,R)=>{if(t.CidrIpv6)E[`${d}.Ipv6Ranges.${R+1}.CidrIpv6`]=t.CidrIpv6;if(t.Description)E[`${d}.Ipv6Ranges.${R+1}.Description`]=t.Description});if(T.UserIdGroupPairs)T.UserIdGroupPairs.forEach((t,R)=>{if(t.GroupId)E[`${d}.Groups.${R+1}.GroupId`]=t.GroupId;if(t.UserId)E[`${d}.Groups.${R+1}.UserId`]=t.UserId;if(t.Description)E[`${d}.Groups.${R+1}.Description`]=t.Description})})}parseArray(E){if(!E)return[];return Array.isArray(E)?E:[E]}parseFirstIpv6Address(E){for(let _ of this.parseArray(E))for(let T of this.parseArray(_?.ipv6AddressesSet?.item))if(T?.ipv6Address)return T.ipv6Address;return}parseTags(E){return this.parseArray(E).map((_)=>({Key:_.key,Value:_.value}))}parseReservations(E){return this.parseArray(E).map((_)=>({ReservationId:_.reservationId,Instances:this.parseInstances(_.instancesSet?.item||_.instancesSet)}))}parseInstances(E){return this.parseArray(E).map((_)=>({InstanceId:_.instanceId,ImageId:_.imageId,InstanceType:_.instanceType,State:_.instanceState?{Code:Number.parseInt(_.instanceState.code),Name:_.instanceState.name}:void 0,PrivateIpAddress:_.privateIpAddress,PublicIpAddress:_.ipAddress,Ipv6Address:this.parseFirstIpv6Address(_.networkInterfaceSet?.item),SubnetId:_.subnetId,VpcId:_.vpcId,SecurityGroups:this.parseArray(_.groupSet?.item).map((T)=>({GroupId:T.groupId,GroupName:T.groupName})),Tags:this.parseTags(_.tagSet?.item),LaunchTime:_.launchTime,Placement:_.placement?{AvailabilityZone:_.placement.availabilityZone,Tenancy:_.placement.tenancy}:void 0,Architecture:_.architecture,RootDeviceType:_.rootDeviceType,RootDeviceName:_.rootDeviceName,BlockDeviceMappings:this.parseArray(_.blockDeviceMapping?.item).map((T)=>({DeviceName:T.deviceName,Ebs:T.ebs?{VolumeId:T.ebs.volumeId,Status:T.ebs.status,AttachTime:T.ebs.attachTime,DeleteOnTermination:T.ebs.deleteOnTermination==="true"}:void 0})),IamInstanceProfile:_.iamInstanceProfile?{Arn:_.iamInstanceProfile.arn,Id:_.iamInstanceProfile.id}:void 0}))}parseIpPermissions(E){return this.parseArray(E).map((_)=>({IpProtocol:_.ipProtocol,FromPort:_.fromPort?Number.parseInt(_.fromPort):void 0,ToPort:_.toPort?Number.parseInt(_.toPort):void 0,IpRanges:this.parseArray(_.ipRanges?.item).map((T)=>({CidrIp:T.cidrIp,Description:T.description})),Ipv6Ranges:this.parseArray(_.ipv6Ranges?.item).map((T)=>({CidrIpv6:T.cidrIpv6,Description:T.description})),UserIdGroupPairs:this.parseArray(_.groups?.item).map((T)=>({GroupId:T.groupId,UserId:T.userId,Description:T.description}))}))}}var a0=CE(()=>{VE()});function j$(E){return`'${E.split("'").join("'\\''")}'`}function rA(E={}){return["export DEBIAN_FRONTEND=noninteractive","export PANTRY_SERVICE_SCOPE=system","export PANTRY_INSTALL_DIR=/usr/local/bin",E.version?`export PANTRY_VERSION=${j$(E.version)}`:'export PANTRY_VERSION="${PANTRY_VERSION:-latest}"',"command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)","command -v unzip >/dev/null 2>&1 || (apt-get update -y && apt-get install -y unzip)",'command -v pantry >/dev/null 2>&1 || { OS=$(uname -s | tr \'[:upper:]\' \'[:lower:]\'); ARCH=$(uname -m); case "$ARCH" in x86_64|amd64) ARCH=x64 ;; arm64|aarch64) ARCH=arm64 ;; esac; ZIP="pantry-${OS}-${ARCH}.zip"; if [ "${PANTRY_VERSION:-latest}" = latest ]; then REL=\'latest/download\'; else REL="download/v${PANTRY_VERSION}"; fi; TMP=$(mktemp -d); curl -fsSL -o "${TMP}/${ZIP}" "https://github.com/home-lang/pantry/releases/${REL}/${ZIP}"; unzip -o "${TMP}/${ZIP}" -d /usr/local/bin; chmod +x /usr/local/bin/pantry; rm -rf "${TMP}"; }','export PATH="/usr/local/bin:$PATH"',"mkdir -p /opt/pantry"]}function cN(){return'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true'}function Nh(E){if(E.length===0)return[];return[`(cd /opt/pantry && pantry install ${[...new Set(E)].map(j$).join(" ")})`]}function B$(E){return[...new Set(E)].flatMap((_)=>[`(cd /opt/pantry && pantry start ${j$(_)})`,`(cd /opt/pantry && pantry enable ${j$(_)})`])}var J5,BT="/opt/pantry";var hd=CE(()=>{J5={php:"php.net",nginx:"nginx.org",composer:"getcomposer.org",mysql:"mysql.com",mariadb:"mariadb.com/server",postgres:"postgresql.org",vitess:"vitess.io",etcd:"etcd.io",redis:"redis.io",memcached:"memcached.org",meilisearch:"meilisearch.com",git:"git-scm.com",certbot:"certbot.eff.org",bun:"bun.sh",node:"nodejs.org",deno:"deno.land"}});function uv(E){return E===!0||typeof E==="object"&&E!==null}function vv(E){return typeof E==="object"&&E!==null?E:{}}function WT(E){return`'${String(E).split("'").join("'\\''")}'`}function nv(E){let T=[E.version?`vitess.io@${E.version}`:"vitess.io"];if(E.mode!=="combo"&&!E.etcdEndpoint)T.push("etcd.io");return T.push("mysql.com@8.0.43"),T}function C2(E){return`${W5}/${E}.sh`}function dA(E,_){return X2.set(E,iv(_)),`/bin/sh ${C2(E)}`}function F5(){let E=[`mkdir -p ${W5}`];for(let[_,T]of X2)E.push(`cat > ${C2(_)} <<'TS_CLOUD_VITESS_LAUNCHER_EOF'`,T,"TS_CLOUD_VITESS_LAUNCHER_EOF",`chmod 0755 ${C2(_)}`);return E}function iv(E){return["#!/bin/sh","set -e",`cd ${BT}`,`PANTRY_ENV="$(pantry env 2>/dev/null | grep -E '^(export [A-Za-z_]|[A-Za-z_][A-Za-z0-9_]*=)' || true)"`,'if [ -n "$PANTRY_ENV" ]; then eval "$PANTRY_ENV"; fi',`VT_MYSQL_ROOT="$(dirname "$(dirname "$(readlink -f ${Sd}/mysqld 2>/dev/null)")")"`,`VTROOT="$(dirname "$(dirname "$(readlink -f ${Sd}/mysqlctld 2>/dev/null)")")"`,"export VT_MYSQL_ROOT VTROOT",'LD_LIBRARY_PATH="$VT_MYSQL_ROOT/lib:$VTROOT/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"',"export LD_LIBRARY_PATH",`exec ${E.join(" ")}`].join(`
+`);return r}async describeInstanceStatus(E){let _={Action:"DescribeInstanceStatus",Version:"2016-11-15"};if(E?.InstanceIds)E.InstanceIds.forEach((r,d)=>{_[`InstanceId.${d+1}`]=r});if(E?.IncludeAllInstances)_.IncludeAllInstances="true";if(E?.Filters)E.Filters.forEach((r,d)=>{_[`Filter.${d+1}.Name`]=r.Name,r.Values.forEach((t,R)=>{_[`Filter.${d+1}.Value.${R+1}`]=t})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{InstanceStatuses:this.parseArray(T.instanceStatusSet?.item).map((r)=>({InstanceId:r.instanceId,InstanceState:r.instanceState?{Code:Number.parseInt(r.instanceState.code),Name:r.instanceState.name}:void 0,InstanceStatus:r.instanceStatus?{Status:r.instanceStatus.status,Details:this.parseArray(r.instanceStatus.details?.item).map((d)=>({Name:d.name,Status:d.status}))}:void 0,SystemStatus:r.systemStatus?{Status:r.systemStatus.status,Details:this.parseArray(r.systemStatus.details?.item).map((d)=>({Name:d.name,Status:d.status}))}:void 0}))}}async startInstances(E){let _={Action:"StartInstances",Version:"2016-11-15"};E.forEach((r,d)=>{_[`InstanceId.${d+1}`]=r});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{StartingInstances:this.parseArray(T.instancesSet?.item).map((r)=>({InstanceId:r.instanceId,CurrentState:r.currentState?{Name:r.currentState.name}:void 0,PreviousState:r.previousState?{Name:r.previousState.name}:void 0}))}}async stopInstances(E,_){let T={Action:"StopInstances",Version:"2016-11-15"};if(E.forEach((d,t)=>{T[`InstanceId.${t+1}`]=d}),_)T.Force="true";let r=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(T).toString()});return{StoppingInstances:this.parseArray(r.instancesSet?.item).map((d)=>({InstanceId:d.instanceId,CurrentState:d.currentState?{Name:d.currentState.name}:void 0,PreviousState:d.previousState?{Name:d.previousState.name}:void 0}))}}async rebootInstances(E){let _={Action:"RebootInstances",Version:"2016-11-15"};E.forEach((T,r)=>{_[`InstanceId.${r+1}`]=T}),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async terminateInstances(E){let _={Action:"TerminateInstances",Version:"2016-11-15"};E.forEach((r,d)=>{_[`InstanceId.${d+1}`]=r});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{TerminatingInstances:this.parseArray(T.instancesSet?.item).map((r)=>({InstanceId:r.instanceId,CurrentState:r.currentState?{Name:r.currentState.name}:void 0,PreviousState:r.previousState?{Name:r.previousState.name}:void 0}))}}async createImage(E){let _={Action:"CreateImage",Version:"2016-11-15",InstanceId:E.InstanceId,Name:E.Name};if(E.Description)_.Description=E.Description;if(E.NoReboot!==void 0)_.NoReboot=String(E.NoReboot);if(E.TagSpecifications)E.TagSpecifications.forEach((d,t)=>{_[`TagSpecification.${t+1}.ResourceType`]=d.ResourceType,d.Tags.forEach((R,h)=>{_[`TagSpecification.${t+1}.Tag.${h+1}.Key`]=R.Key,_[`TagSpecification.${t+1}.Tag.${h+1}.Value`]=R.Value})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{ImageId:(T.CreateImageResponse||T).imageId}}async deregisterImage(E){await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({Action:"DeregisterImage",Version:"2016-11-15",ImageId:E}).toString()})}async describeVpcs(E){let _={Action:"DescribeVpcs",Version:"2016-11-15"};if(E?.VpcIds)E.VpcIds.forEach((r,d)=>{_[`VpcId.${d+1}`]=r});if(E?.Filters)E.Filters.forEach((r,d)=>{_[`Filter.${d+1}.Name`]=r.Name,r.Values.forEach((t,R)=>{_[`Filter.${d+1}.Value.${R+1}`]=t})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{Vpcs:this.parseArray(T.vpcSet?.item).map((r)=>({VpcId:r.vpcId,CidrBlock:r.cidrBlock,State:r.state,DhcpOptionsId:r.dhcpOptionsId,InstanceTenancy:r.instanceTenancy,IsDefault:r.isDefault==="true",Tags:this.parseTags(r.tagSet?.item)}))}}async describeSubnets(E){let _={Action:"DescribeSubnets",Version:"2016-11-15"};if(E?.SubnetIds)E.SubnetIds.forEach((r,d)=>{_[`SubnetId.${d+1}`]=r});if(E?.Filters)E.Filters.forEach((r,d)=>{_[`Filter.${d+1}.Name`]=r.Name,r.Values.forEach((t,R)=>{_[`Filter.${d+1}.Value.${R+1}`]=t})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{Subnets:this.parseArray(T.subnetSet?.item).map((r)=>({SubnetId:r.subnetId,VpcId:r.vpcId,CidrBlock:r.cidrBlock,AvailabilityZone:r.availabilityZone,AvailableIpAddressCount:Number.parseInt(r.availableIpAddressCount),State:r.state,MapPublicIpOnLaunch:r.mapPublicIpOnLaunch==="true",Tags:this.parseTags(r.tagSet?.item)}))}}async describeSecurityGroups(E){let _={Action:"DescribeSecurityGroups",Version:"2016-11-15"};if(E?.GroupIds)E.GroupIds.forEach((r,d)=>{_[`GroupId.${d+1}`]=r});if(E?.GroupNames)E.GroupNames.forEach((r,d)=>{_[`GroupName.${d+1}`]=r});if(E?.Filters)E.Filters.forEach((r,d)=>{_[`Filter.${d+1}.Name`]=r.Name,r.Values.forEach((t,R)=>{_[`Filter.${d+1}.Value.${R+1}`]=t})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{SecurityGroups:this.parseArray(T.securityGroupInfo?.item).map((r)=>({GroupId:r.groupId,GroupName:r.groupName,Description:r.groupDescription,VpcId:r.vpcId,IpPermissions:this.parseIpPermissions(r.ipPermissions?.item),IpPermissionsEgress:this.parseIpPermissions(r.ipPermissionsEgress?.item),Tags:this.parseTags(r.tagSet?.item)}))}}async describeInternetGateways(E){let _={Action:"DescribeInternetGateways",Version:"2016-11-15"};if(E?.InternetGatewayIds)E.InternetGatewayIds.forEach((r,d)=>{_[`InternetGatewayId.${d+1}`]=r});if(E?.Filters)E.Filters.forEach((r,d)=>{_[`Filter.${d+1}.Name`]=r.Name,r.Values.forEach((t,R)=>{_[`Filter.${d+1}.Value.${R+1}`]=t})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{InternetGateways:this.parseArray(T.internetGatewaySet?.item).map((r)=>({InternetGatewayId:r.internetGatewayId,Attachments:this.parseArray(r.attachmentSet?.item).map((d)=>({VpcId:d.vpcId,State:d.state})),Tags:this.parseTags(r.tagSet?.item)}))}}async describeAddresses(E){let _={Action:"DescribeAddresses",Version:"2016-11-15"};if(E?.AllocationIds)E.AllocationIds.forEach((r,d)=>{_[`AllocationId.${d+1}`]=r});if(E?.PublicIps)E.PublicIps.forEach((r,d)=>{_[`PublicIp.${d+1}`]=r});if(E?.Filters)E.Filters.forEach((r,d)=>{_[`Filter.${d+1}.Name`]=r.Name,r.Values.forEach((t,R)=>{_[`Filter.${d+1}.Value.${R+1}`]=t})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{Addresses:this.parseArray(T.addressesSet?.item).map((r)=>({PublicIp:r.publicIp,AllocationId:r.allocationId,AssociationId:r.associationId,InstanceId:r.instanceId,NetworkInterfaceId:r.networkInterfaceId,PrivateIpAddress:r.privateIpAddress,Domain:r.domain,Tags:this.parseTags(r.tagSet?.item)}))}}async allocateAddress(E){let _={Action:"AllocateAddress",Version:"2016-11-15"};if(E?.Domain)_.Domain=E.Domain;if(E?.TagSpecifications)E.TagSpecifications.forEach((r,d)=>{_[`TagSpecification.${d+1}.ResourceType`]=r.ResourceType,r.Tags.forEach((t,R)=>{_[`TagSpecification.${d+1}.Tag.${R+1}.Key`]=t.Key,_[`TagSpecification.${d+1}.Tag.${R+1}.Value`]=t.Value})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{AllocationId:T.allocationId,PublicIp:T.publicIp,Domain:T.domain}}async associateAddress(E){let _={Action:"AssociateAddress",Version:"2016-11-15"};if(E.AllocationId)_.AllocationId=E.AllocationId;if(E.PublicIp)_.PublicIp=E.PublicIp;if(E.InstanceId)_.InstanceId=E.InstanceId;if(E.NetworkInterfaceId)_.NetworkInterfaceId=E.NetworkInterfaceId;if(E.PrivateIpAddress)_.PrivateIpAddress=E.PrivateIpAddress;if(E.AllowReassociation)_.AllowReassociation="true";return{AssociationId:(await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})).associationId}}async createTags(E){let _={Action:"CreateTags",Version:"2016-11-15"};E.Resources.forEach((T,r)=>{_[`ResourceId.${r+1}`]=T}),E.Tags.forEach((T,r)=>{_[`Tag.${r+1}.Key`]=T.Key,_[`Tag.${r+1}.Value`]=T.Value}),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async waitForInstanceState(E,_,T){let r=T?.maxWaitMs||300000,d=T?.pollIntervalMs||5000,t=Date.now();while(Date.now()-t<r){let R;try{R=await this.getInstance(E)}catch{R=void 0}if(R?.State?.Name===_)return R;await new Promise((h)=>setTimeout(h,d))}return}async createVpc(E){let _={Action:"CreateVpc",Version:"2016-11-15",CidrBlock:E.CidrBlock};if(E.InstanceTenancy)_.InstanceTenancy=E.InstanceTenancy;if(E.TagSpecifications)E.TagSpecifications.forEach((t,R)=>{_[`TagSpecification.${R+1}.ResourceType`]=t.ResourceType,t.Tags.forEach((h,N)=>{_[`TagSpecification.${R+1}.Tag.${N+1}.Key`]=h.Key,_[`TagSpecification.${R+1}.Tag.${N+1}.Value`]=h.Value})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()}),d=(T.CreateVpcResponse||T).vpc;return{Vpc:d?{VpcId:d.vpcId,CidrBlock:d.cidrBlock,State:d.state,DhcpOptionsId:d.dhcpOptionsId,InstanceTenancy:d.instanceTenancy,IsDefault:d.isDefault==="true",Tags:this.parseTags(d.tagSet?.item)}:void 0}}async createSubnet(E){let _={Action:"CreateSubnet",Version:"2016-11-15",VpcId:E.VpcId,CidrBlock:E.CidrBlock};if(E.AvailabilityZone)_.AvailabilityZone=E.AvailabilityZone;if(E.TagSpecifications)E.TagSpecifications.forEach((t,R)=>{_[`TagSpecification.${R+1}.ResourceType`]=t.ResourceType,t.Tags.forEach((h,N)=>{_[`TagSpecification.${R+1}.Tag.${N+1}.Key`]=h.Key,_[`TagSpecification.${R+1}.Tag.${N+1}.Value`]=h.Value})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()}),d=(T.CreateSubnetResponse||T).subnet;return{Subnet:d?{SubnetId:d.subnetId,VpcId:d.vpcId,CidrBlock:d.cidrBlock,AvailabilityZone:d.availabilityZone,AvailableIpAddressCount:d.availableIpAddressCount?Number.parseInt(d.availableIpAddressCount):void 0,State:d.state,MapPublicIpOnLaunch:d.mapPublicIpOnLaunch==="true",Tags:this.parseTags(d.tagSet?.item)}:void 0}}async modifySubnetAttribute(E){let _={Action:"ModifySubnetAttribute",Version:"2016-11-15",SubnetId:E.SubnetId};if(E.MapPublicIpOnLaunch!==void 0)_["MapPublicIpOnLaunch.Value"]=String(E.MapPublicIpOnLaunch.Value);await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async createSecurityGroup(E){let _={Action:"CreateSecurityGroup",Version:"2016-11-15",GroupName:E.GroupName,GroupDescription:E.Description};if(E.VpcId)_.VpcId=E.VpcId;if(E.TagSpecifications)E.TagSpecifications.forEach((d,t)=>{_[`TagSpecification.${t+1}.ResourceType`]=d.ResourceType,d.Tags.forEach((R,h)=>{_[`TagSpecification.${t+1}.Tag.${h+1}.Key`]=R.Key,_[`TagSpecification.${t+1}.Tag.${h+1}.Value`]=R.Value})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()});return{GroupId:(T.CreateSecurityGroupResponse||T).groupId}}async authorizeSecurityGroupIngress(E){let _={Action:"AuthorizeSecurityGroupIngress",Version:"2016-11-15",GroupId:E.GroupId};this.encodeIpPermissions(_,E.IpPermissions),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async authorizeSecurityGroupEgress(E){let _={Action:"AuthorizeSecurityGroupEgress",Version:"2016-11-15",GroupId:E.GroupId};this.encodeIpPermissions(_,E.IpPermissions),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async describeRouteTables(E){let _={Action:"DescribeRouteTables",Version:"2016-11-15"};if(E?.RouteTableIds)E.RouteTableIds.forEach((d,t)=>{_[`RouteTableId.${t+1}`]=d});if(E?.Filters)E.Filters.forEach((d,t)=>{_[`Filter.${t+1}.Name`]=d.Name,d.Values.forEach((R,h)=>{_[`Filter.${t+1}.Value.${h+1}`]=R})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()}),r=T.DescribeRouteTablesResponse||T;return{RouteTables:this.parseArray(r.routeTableSet?.item).map((d)=>({RouteTableId:d.routeTableId,VpcId:d.vpcId,Routes:this.parseArray(d.routeSet?.item).map((t)=>({DestinationCidrBlock:t.destinationCidrBlock,GatewayId:t.gatewayId,NatGatewayId:t.natGatewayId,State:t.state})),Associations:this.parseArray(d.associationSet?.item).map((t)=>({RouteTableAssociationId:t.routeTableAssociationId,SubnetId:t.subnetId,Main:t.main==="true"||t.main===!0})),Tags:this.parseTags(d.tagSet?.item)}))}}async deleteVpc(E){let _={Action:"DeleteVpc",Version:"2016-11-15",VpcId:E};await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async deleteSubnet(E){let _={Action:"DeleteSubnet",Version:"2016-11-15",SubnetId:E};await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async deleteSecurityGroup(E){await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({Action:"DeleteSecurityGroup",Version:"2016-11-15",GroupId:E}).toString()})}async describeNetworkInterfaces(E){let _={Action:"DescribeNetworkInterfaces",Version:"2016-11-15"};if(E?.NetworkInterfaceIds)E.NetworkInterfaceIds.forEach((d,t)=>{_[`NetworkInterfaceId.${t+1}`]=d});if(E?.Filters)E.Filters.forEach((d,t)=>{_[`Filter.${t+1}.Name`]=d.Name,d.Values.forEach((R,h)=>{_[`Filter.${t+1}.Value.${h+1}`]=R})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()}),r=T.DescribeNetworkInterfacesResponse||T;return{NetworkInterfaces:this.parseArray(r.networkInterfaceSet?.item).map((d)=>({NetworkInterfaceId:d.networkInterfaceId,SubnetId:d.subnetId,VpcId:d.vpcId,Status:d.status,Attachment:d.attachment?{AttachmentId:d.attachment.attachmentId,InstanceId:d.attachment.instanceId,Status:d.attachment.status}:void 0}))}}async detachNetworkInterface(E,_){let T={Action:"DetachNetworkInterface",Version:"2016-11-15",AttachmentId:E};if(_)T.Force="true";await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(T).toString()})}async deleteNetworkInterface(E){let _={Action:"DeleteNetworkInterface",Version:"2016-11-15",NetworkInterfaceId:E};await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()})}async describeRegions(){let E={Action:"DescribeRegions",Version:"2016-11-15"},_=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(E).toString()}),T=_.DescribeRegionsResponse||_;return{Regions:this.parseArray(T.regionInfo?.item).map((r)=>({RegionName:r.regionName,Endpoint:r.regionEndpoint}))}}async runInstances(E){let _={Action:"RunInstances",Version:"2016-11-15",ImageId:E.ImageId,InstanceType:E.InstanceType,MinCount:String(E.MinCount),MaxCount:String(E.MaxCount)};if(E.SecurityGroupIds)E.SecurityGroupIds.forEach((d,t)=>{_[`SecurityGroupId.${t+1}`]=d});if(E.SubnetId)_.SubnetId=E.SubnetId;if(E.UserData)_.UserData=E.UserData;if(E.IamInstanceProfile){if(E.IamInstanceProfile.Name)_["IamInstanceProfile.Name"]=E.IamInstanceProfile.Name;if(E.IamInstanceProfile.Arn)_["IamInstanceProfile.Arn"]=E.IamInstanceProfile.Arn}if(E.TagSpecifications)E.TagSpecifications.forEach((d,t)=>{_[`TagSpecification.${t+1}.ResourceType`]=d.ResourceType,d.Tags.forEach((R,h)=>{_[`TagSpecification.${t+1}.Tag.${h+1}.Key`]=R.Key,_[`TagSpecification.${t+1}.Tag.${h+1}.Value`]=R.Value})});let T=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(_).toString()}),r=T.RunInstancesResponse||T;return{Instances:this.parseInstances(r.instancesSet?.item||r.instancesSet)}}encodeIpPermissions(E,_){_.forEach((T,r)=>{let d=`IpPermissions.${r+1}`;if(T.IpProtocol!==void 0)E[`${d}.IpProtocol`]=T.IpProtocol;if(T.FromPort!==void 0)E[`${d}.FromPort`]=String(T.FromPort);if(T.ToPort!==void 0)E[`${d}.ToPort`]=String(T.ToPort);if(T.IpRanges)T.IpRanges.forEach((t,R)=>{if(t.CidrIp)E[`${d}.IpRanges.${R+1}.CidrIp`]=t.CidrIp;if(t.Description)E[`${d}.IpRanges.${R+1}.Description`]=t.Description});if(T.Ipv6Ranges)T.Ipv6Ranges.forEach((t,R)=>{if(t.CidrIpv6)E[`${d}.Ipv6Ranges.${R+1}.CidrIpv6`]=t.CidrIpv6;if(t.Description)E[`${d}.Ipv6Ranges.${R+1}.Description`]=t.Description});if(T.UserIdGroupPairs)T.UserIdGroupPairs.forEach((t,R)=>{if(t.GroupId)E[`${d}.Groups.${R+1}.GroupId`]=t.GroupId;if(t.UserId)E[`${d}.Groups.${R+1}.UserId`]=t.UserId;if(t.Description)E[`${d}.Groups.${R+1}.Description`]=t.Description})})}parseArray(E){if(!E)return[];return Array.isArray(E)?E:[E]}parseFirstIpv6Address(E){for(let _ of this.parseArray(E))for(let T of this.parseArray(_?.ipv6AddressesSet?.item))if(T?.ipv6Address)return T.ipv6Address;return}parseTags(E){return this.parseArray(E).map((_)=>({Key:_.key,Value:_.value}))}parseReservations(E){return this.parseArray(E).map((_)=>({ReservationId:_.reservationId,Instances:this.parseInstances(_.instancesSet?.item||_.instancesSet)}))}parseInstances(E){return this.parseArray(E).map((_)=>({InstanceId:_.instanceId,ImageId:_.imageId,InstanceType:_.instanceType,State:_.instanceState?{Code:Number.parseInt(_.instanceState.code),Name:_.instanceState.name}:void 0,PrivateIpAddress:_.privateIpAddress,PublicIpAddress:_.ipAddress,Ipv6Address:this.parseFirstIpv6Address(_.networkInterfaceSet?.item),SubnetId:_.subnetId,VpcId:_.vpcId,SecurityGroups:this.parseArray(_.groupSet?.item).map((T)=>({GroupId:T.groupId,GroupName:T.groupName})),Tags:this.parseTags(_.tagSet?.item),LaunchTime:_.launchTime,Placement:_.placement?{AvailabilityZone:_.placement.availabilityZone,Tenancy:_.placement.tenancy}:void 0,Architecture:_.architecture,RootDeviceType:_.rootDeviceType,RootDeviceName:_.rootDeviceName,BlockDeviceMappings:this.parseArray(_.blockDeviceMapping?.item).map((T)=>({DeviceName:T.deviceName,Ebs:T.ebs?{VolumeId:T.ebs.volumeId,Status:T.ebs.status,AttachTime:T.ebs.attachTime,DeleteOnTermination:T.ebs.deleteOnTermination==="true"}:void 0})),IamInstanceProfile:_.iamInstanceProfile?{Arn:_.iamInstanceProfile.arn,Id:_.iamInstanceProfile.id}:void 0}))}parseIpPermissions(E){return this.parseArray(E).map((_)=>({IpProtocol:_.ipProtocol,FromPort:_.fromPort?Number.parseInt(_.fromPort):void 0,ToPort:_.toPort?Number.parseInt(_.toPort):void 0,IpRanges:this.parseArray(_.ipRanges?.item).map((T)=>({CidrIp:T.cidrIp,Description:T.description})),Ipv6Ranges:this.parseArray(_.ipv6Ranges?.item).map((T)=>({CidrIpv6:T.cidrIpv6,Description:T.description})),UserIdGroupPairs:this.parseArray(_.groups?.item).map((T)=>({GroupId:T.groupId,UserId:T.userId,Description:T.description}))}))}}var a0=CE(()=>{VE()});function j$(E){return`'${E.split("'").join("'\\''")}'`}function rA(E={}){return["export DEBIAN_FRONTEND=noninteractive","export PANTRY_SERVICE_SCOPE=system","export PANTRY_INSTALL_DIR=/usr/local/bin",E.version?`export PANTRY_VERSION=${j$(E.version)}`:'export PANTRY_VERSION="${PANTRY_VERSION:-latest}"',"command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)","command -v unzip >/dev/null 2>&1 || (apt-get update -y && apt-get install -y unzip)",'OS=$(uname -s | tr \'[:upper:]\' \'[:lower:]\'); ARCH=$(uname -m); case "$ARCH" in x86_64|amd64) ARCH=x64 ;; arm64|aarch64) ARCH=arm64 ;; esac; ZIP="pantry-${OS}-${ARCH}.zip"; if [ "${PANTRY_VERSION:-latest}" = latest ]; then REL=\'latest/download\'; else REL="download/v${PANTRY_VERSION}"; fi; TMP=$(mktemp -d); curl -fsSL -o "${TMP}/${ZIP}" "https://github.com/pantry-pm/pantry/releases/${REL}/${ZIP}"; unzip -o "${TMP}/${ZIP}" -d /usr/local/bin; chmod +x /usr/local/bin/pantry; rm -rf "${TMP}"','export PATH="/usr/local/bin:$PATH"',"mkdir -p /opt/pantry"]}function cN(){return'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true'}function Nh(E){if(E.length===0)return[];return[`(cd /opt/pantry && pantry install ${[...new Set(E)].map(j$).join(" ")})`]}function B$(E){return[...new Set(E)].flatMap((_)=>[`(cd /opt/pantry && pantry start ${j$(_)})`,`(cd /opt/pantry && pantry enable ${j$(_)})`])}var J5,BT="/opt/pantry";var hd=CE(()=>{J5={php:"php.net",nginx:"nginx.org",composer:"getcomposer.org",mysql:"mysql.com",mariadb:"mariadb.com/server",postgres:"postgresql.org",vitess:"vitess.io",etcd:"etcd.io",redis:"redis.io",memcached:"memcached.org",meilisearch:"meilisearch.com",git:"git-scm.com",certbot:"certbot.eff.org",bun:"bun.sh",node:"nodejs.org",deno:"deno.land"}});function uv(E){return E===!0||typeof E==="object"&&E!==null}function vv(E){return typeof E==="object"&&E!==null?E:{}}function WT(E){return`'${String(E).split("'").join("'\\''")}'`}function nv(E){let T=[E.version?`vitess.io@${E.version}`:"vitess.io"];if(E.mode!=="combo"&&!E.etcdEndpoint)T.push("etcd.io");return T.push("mysql.com@8.0.43"),T}function C2(E){return`${W5}/${E}.sh`}function dA(E,_){return X2.set(E,iv(_)),`/bin/sh ${C2(E)}`}function F5(){let E=[`mkdir -p ${W5}`];for(let[_,T]of X2)E.push(`cat > ${C2(_)} <<'TS_CLOUD_VITESS_LAUNCHER_EOF'`,T,"TS_CLOUD_VITESS_LAUNCHER_EOF",`chmod 0755 ${C2(_)}`);return E}function iv(E){return["#!/bin/sh","set -e",`cd ${BT}`,`PANTRY_ENV="$(pantry env 2>/dev/null | grep -E '^(export [A-Za-z_]|[A-Za-z_][A-Za-z0-9_]*=)' || true)"`,'if [ -n "$PANTRY_ENV" ]; then eval "$PANTRY_ENV"; fi',`VT_MYSQL_ROOT="$(dirname "$(dirname "$(readlink -f ${Sd}/mysqld 2>/dev/null)")")"`,`VTROOT="$(dirname "$(dirname "$(readlink -f ${Sd}/mysqlctld 2>/dev/null)")")"`,"export VT_MYSQL_ROOT VTROOT",'LD_LIBRARY_PATH="$VT_MYSQL_ROOT/lib:$VTROOT/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"',"export LD_LIBRARY_PATH",`exec ${E.join(" ")}`].join(`
 `)}function tA(E){let _=["[Unit]",`Description=${E.description}`,`After=network.target${E.after?.length?` ${E.after.join(" ")}`:""}`];if(E.requires?.length)_.push(`Requires=${E.requires.join(" ")}`);return _.push("","[Service]","Type=simple",`User=${Nd}`,`Group=${Nd}`,`Environment="PATH=${lv}"`,`Environment="VTDATAROOT=${pt}"`,...Object.entries(E.environment??{}).map(([T,r])=>`Environment="${T}=${r}"`),...(E.execStartPre??[]).map((T)=>`ExecStartPre=${T}`),`ExecStart=${E.execStart}`,"Restart=always","RestartSec=5","LimitNOFILE=65535","","[Install]","WantedBy=multi-user.target"),_.join(`
 `)}function j5(E,_){return[`cat > /etc/systemd/system/${E}.service <<'TS_CLOUD_VITESS_UNIT_EOF'`,_,"TS_CLOUD_VITESS_UNIT_EOF"]}function av(E){let _=E.cell??"zone1",T=E.vtgatePort??w2,d=`${((E.keyspaces?.length)?E.keyspaces:[{name:"app"}]).map((t)=>{let R=(t.sharded?["-80","80-"]:["0"]).map((h)=>`shards:{name:"${h}"}`).join(" ");return`keyspaces:{name:"${t.name}" ${R}}`}).join(" ")} cells:"${_}"`;return tA({description:"Vitess (vtcombo, single-process development stack)",execStart:dA("vtcombo",[`${Sd}/vtcombo`,`--cell ${_}`,`--proto-topo ${WT(d)}`,`--mysql-server-port ${T}`,"--mysql-server-bind-address 127.0.0.1","--mysql-auth-server-impl none","--start-mysql",`--port ${I2}`,`--grpc-port ${H$}`])})}function mv(){return tA({description:"etcd (Vitess topology store)",execStart:dA("etcd",[`${Sd}/etcd`,`--data-dir ${pt}/etcd`,`--listen-client-urls http://127.0.0.1:${P$}`,`--advertise-client-urls http://127.0.0.1:${P$}`]),execStartPre:[`+/bin/mkdir -p ${pt}/etcd`,`+/bin/chown ${Nd}:${Nd} ${pt}/etcd`]})}function J2(E){return["--topo-implementation etcd2",`--topo-global-server-address ${E.etcdEndpoint??`http://127.0.0.1:${P$}`}`,"--topo-global-root /vitess/global"]}function sv(E){let _=!E.etcdEndpoint;return tA({description:"Vitess vtctld (control plane)",after:_?["vitess-etcd.service"]:[],requires:_?["vitess-etcd.service"]:[],execStart:dA("vtctld",[`${Sd}/vtctld`,...J2(E),`--cell ${E.cell??"zone1"}`,"--service-map grpc-vtctl,grpc-vtctld",`--grpc-port ${H$}`,`--port ${H$+1}`])})}function pv(E,_,T){let r=E.cell??"zone1";return tA({description:`Vitess vttablet (${_}/${T})`,after:["vitess-vtctld.service","vitess-mysqlctld.service"],requires:["vitess-mysqlctld.service"],execStart:dA("vttablet",[`${Sd}/vttablet`,...J2(E),`--tablet-path ${r}-${String(e2).padStart(10,"0")}`,`--init-keyspace ${_}`,`--init-shard ${T}`,"--init-tablet-type replica",`--service-map ${WT("grpc-queryservice,grpc-tabletmanager,grpc-updatestream")}`,`--port ${z5}`,`--grpc-port ${z5+1}`,`--db-port ${E.mysqlPort??3306}`,`--mycnf-mysql-port ${E.mysqlPort??3306}`])})}function ov(E){return tA({description:"Vitess mysqlctld (managed mysqld)",execStart:dA("mysqlctld",[`${Sd}/mysqlctld`,`--tablet-uid ${e2}`,`--mysql-port ${E.mysqlPort??3306}`,'--init-db-sql-file "$VTROOT/config/init_db.sql"',"--wait-time 2m"]),execStartPre:[`+/bin/mkdir -p ${pt}`,`+/bin/chown ${Nd}:${Nd} ${pt}`]})}function En(E){let _=E.username??"vitess",T=E.password??"",r=JSON.stringify({[_]:[{MysqlNativePassword:"",Password:T,UserData:_}]});return["mkdir -p /etc/vitess",`cat > ${W$} <<'TS_CLOUD_VITESS_AUTH_EOF'`,r,"TS_CLOUD_VITESS_AUTH_EOF",`chown ${Nd}:${Nd} ${W$}`,`chmod 0600 ${W$}`]}function _n(E){let _=E.cell??"zone1";return tA({description:"Vitess vtgate (query router)",after:["vitess-vtctld.service"],execStart:dA("vtgate",[`${Sd}/vtgate`,...J2(E),`--cell ${_}`,`--cells-to-watch ${_}`,"--tablet-types-to-wait PRIMARY,REPLICA",`--service-map ${WT("grpc-vtgateservice")}`,`--mysql-server-port ${E.vtgatePort??w2}`,`--mysql-server-bind-address ${E.bindAddress??"127.0.0.1"}`,"--mysql-auth-server-impl static",`--mysql-auth-server-static-file ${W$}`,`--port ${I2}`,`--grpc-port ${I2+1}`])})}function Tn(E){let _=E.cell??"zone1",T=E.etcdEndpoint??`http://127.0.0.1:${P$}`,r=`${Sd}/vtctldclient --server 127.0.0.1:${H$}`,d=[`for i in $(seq 1 30); do ${r} GetCellInfoNames >/dev/null 2>&1 && break; sleep 2; done`,`if ! ${r} GetCellInfoNames 2>/dev/null | grep -qx ${WT(_)}; then`,`  ${r} AddCellInfo --root ${WT(`/vitess/${_}`)} --server-address ${WT(T)} ${WT(_)}`,"fi"];for(let t of E.keyspaces??[]){let R=t.sharded?" --sharded":"";d.push(`if ! ${r} GetKeyspace ${WT(t.name)} >/dev/null 2>&1; then`,`  ${r} CreateKeyspace${R} ${WT(t.name)}`,"fi");let h=`${_}-${String(e2).padStart(10,"0")}`;for(let N of t.sharded?["-80","80-"]:["0"]){let S=`${t.name}/${N}`;d.push("for i in $(seq 1 90); do",`  if ${r} GetShard ${WT(S)} 2>/dev/null | grep -q '"primary_alias": *"[^"]'; then break; fi`,`  ${r} PlannedReparentShard ${WT(S)} --new-primary ${WT(h)} >/dev/null 2>&1 && break`,`  ${r} InitShardPrimary --force ${WT(S)} ${WT(h)} >/dev/null 2>&1 && break`,"  sleep 2","done",`if ! ${r} GetShard ${WT(S)} 2>/dev/null | grep -q '"primary_alias": *"[^"]'; then`,`  echo "no primary could be elected for ${S}" >&2; exit 1`,"fi")}}return d}function B5(E){let _=E.vtgatePort??w2;return["for i in $(seq 1 60); do",`  if (cd ${BT} && eval "$(pantry env 2>/dev/null)"; MYSQL_PWD=${WT(E.password??"")} ${Sd}/mysql -h 127.0.0.1 -P ${_} -u ${WT(E.username??"vitess")} --connect-timeout=2 -e 'SHOW KEYSPACES') >/dev/null 2>&1; then`,`    echo "vtgate is serving on ${_}"; exit 0`,"  fi","  sleep 2","done",`echo "vtgate did not become ready on port ${_}" >&2`,"exit 1"]}function y$(E){if(!uv(E))return[];let _=vv(E),T=_.mode==="combo";X2.clear();let r=[...Nh(nv(_)),`VT_MYSQL_LIB="$(dirname "$(dirname "$(readlink -f ${Sd}/mysqld)")")/lib"`,'if [ -d "$VT_MYSQL_LIB" ]; then',`  printf '%s\\n' "$VT_MYSQL_LIB" > /etc/ld.so.conf.d/vitess-mysql.conf`,"  ldconfig","else",'  echo "mysqld library directory not found under $VT_MYSQL_LIB" >&2; exit 1',"fi",`id -u ${Nd} >/dev/null 2>&1 || useradd --system --home-dir ${pt} --shell /usr/sbin/nologin ${Nd}`,`mkdir -p ${pt}`,`chown -R ${Nd}:${Nd} ${pt}`];if(T)return r.push(...j5("vitess-vtcombo",av(_)),...F5(),"systemctl daemon-reload","systemctl enable --now vitess-vtcombo.service",...B5(_)),r;r.push(...En(_));let d=[];if(!_.etcdEndpoint)d.push(["vitess-etcd",mv()]);d.push(["vitess-vtctld",sv(_)],["vitess-mysqlctld",ov(_)],["vitess-vtgate",_n(_)]);for(let t of _.keyspaces??[])for(let R of t.sharded?["-80","80-"]:["0"])d.push([`vitess-vttablet-${t.name}-${R.replace(/-/g,"x")}`,pv(_,t.name,R)]);for(let[t,R]of d)r.push(...j5(t,R));r.push(...F5()),r.push("systemctl daemon-reload");for(let[t]of d)r.push(`systemctl enable --now ${t}.service`);return r.push(...Tn(_),...B5(_)),r}var Sd,w2=15306,I2=15991,H$=15999,z5=16101,P$=2379,pt="/var/lib/vitess",e2=100,Nd="vitess",lv,W5="/usr/local/lib/vitess",X2,W$="/etc/vitess/auth.json";var z2=CE(()=>{hd();Sd=`${BT}/pantry/.bin`;lv=`${Sd}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,X2=new Map});function H5(E){if(E?.engine&&rn.has(E.engine))return!1;return!E?.host||E.host==="127.0.0.1"||E.host==="localhost"}function RA(E,_="psql"){let T=E?.port??5432;if(H5(E))return`${_} -p ${T} -U postgres`;let r=E?.username||"postgres";return`${E?.password?`PGPASSWORD='${E.password.replace(/'/g,"'\\''")}' `:""}${_} -h ${E.host} -p ${T} -U ${r} -w`}function ot(E){return E===!0||typeof E==="object"&&E!=null}function dn(E){let _=[],T=[];if(ot(E.mysql))_.push(typeof E.mysql==="object"&&E.mysql.version?`mysql.com@${E.mysql.version}`:"mysql.com@8.0.43"),T.push("mysql");else if(ot(E.mariadb))_.push(J5.mariadb),T.push("mariadb");if(ot(E.postgres))_.push("postgresql.org"),T.push("postgres");if(ot(E.redis))_.push("redis.io"),T.push("redis");if(ot(E.memcached))_.push("memcached.org"),T.push("memcached");if(ot(E.meilisearch))_.push("meilisearch.com"),T.push("meilisearch");return{packages:_,services:T}}function Y$(E={},_={}){let T=dn(E),r=y$(E.vitess);if(T.packages.length===0)return r;return[...Nh(T.packages),...B$(T.services),...r]}function hA(E,_={}){if(!E?.name)return[];if(!H5(E))return[];let T=E.name,r=E.username||T,d=E.password||"",t=ot(_.postgres)||E.engine==="postgres",R=ot(_.mariadb)||E.engine==="mariadb",h=ot(_.mysql)||E.engine==="mysql";if(t&&!h&&!R){let c=(F)=>`"${F.replace(/"/g,'""')}"`,$=(F)=>`'${F.replace(/'/g,"''")}'`,I=(F,B)=>["DO $$ BEGIN",`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${$(F)}) THEN`,`    CREATE ROLE ${c(F)} LOGIN PASSWORD ${$(B)};`,"  ELSE",`    ALTER ROLE ${c(F)} LOGIN PASSWORD ${$(B)};`,"  END IF;","END $$;"],C=(F)=>{let B=F.databases&&F.databases.length>0?F.databases:[T],y=[];for(let Y of B)if(F.access==="readonly")y.push(`GRANT CONNECT ON DATABASE ${c(Y)} TO ${c(F.username)};`,`\\connect ${c(Y)}`,`GRANT USAGE ON SCHEMA public TO ${c(F.username)};`,`GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${c(F.username)};`,`ALTER DEFAULT PRIVILEGES FOR ROLE ${c(r)} IN SCHEMA public GRANT SELECT ON TABLES TO ${c(F.username)};`,"\\connect postgres");else y.push(`GRANT ALL PRIVILEGES ON DATABASE ${c(Y)} TO ${c(F.username)};`);return y},e=E.users||[],z=E.port??5432;return[cN(),`for i in $(seq 1 30); do pg_isready -p ${z} -q && break; sleep 2; done`,`${RA(E)} <<'TS_CLOUD_PG_EOF'`,...I(r,d),`SELECT 'CREATE DATABASE ${c(T)} OWNER ${c(r)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${$(T)})\\gexec`,...e.flatMap((F)=>[...I(F.username,F.password),...C(F)]),"TS_CLOUD_PG_EOF"]}let N=R?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock",S=(c)=>c.replace(/`/g,"``"),A=(c)=>c.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),L=(c)=>{let $=c.databases&&c.databases.length>0?c.databases:[T],I=c.access==="readonly"?"SELECT":"ALL PRIVILEGES",C=[`CREATE USER IF NOT EXISTS '${A(c.username)}'@'%' IDENTIFIED BY '${A(c.password)}';`,`CREATE USER IF NOT EXISTS '${A(c.username)}'@'localhost' IDENTIFIED BY '${A(c.password)}';`,`ALTER USER '${A(c.username)}'@'%' IDENTIFIED BY '${A(c.password)}';`,`ALTER USER '${A(c.username)}'@'localhost' IDENTIFIED BY '${A(c.password)}';`];for(let e of $)C.push(`GRANT ${I} ON \`${S(e)}\`.* TO '${A(c.username)}'@'%';`,`GRANT ${I} ON \`${S(e)}\`.* TO '${A(c.username)}'@'localhost';`);return C},O=E.users||[];return[cN(),`for i in $(seq 1 30); do mysqladmin --socket=${N} -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done`,`mysql --socket=${N} -u root <<'TS_CLOUD_SQL_EOF'`,`CREATE DATABASE IF NOT EXISTS \`${S(T)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,...L({username:r,password:d}),...O.flatMap(L),"FLUSH PRIVILEGES;","TS_CLOUD_SQL_EOF"]}function P5(E){if(!E?.name)return{};let _=E.engine==="singlestore",T=E.engine==="vitess",r=E.engine==="postgres"?"pgsql":_?"singlestore":T?"vitess":"mysql",d=E.port??(E.engine==="postgres"?5432:T?15306:3306),t={DB_CONNECTION:r,DB_HOST:E.host||"127.0.0.1",DB_PORT:String(d),DB_DATABASE:E.name};if(E.username)t.DB_USERNAME=E.username;if(E.password)t.DB_PASSWORD=E.password;if((_||T)&&E.ssl!==!1)t.DB_SSL="true";return t}var rn;var NA=CE(()=>{hd();z2();rn=new Set(["singlestore","vitess"])});function Rn(E){if(!E.name)return null;let _=E.host||"127.0.0.1",T=E.engine==="postgres",r=T?"postgresql":"mysql",d=E.port??(T?5432:3306),t=(R)=>R.replace(/\\/g,"\\\\").replace(/'/g,"\\'");return["  {",`    type: '${r}',`,`    name: '${t(E.name)}',`,"    connection: {",`      hostname: '${t(_)}',`,`      port: ${d},`,`      database: '${t(E.name)}',`,`      username: '${t(E.username||E.name)}',`,`      password: '${t(E.password||"")}',`,"      ssl: false,","    },","    includeSchema: true,","    includeData: true,","  },"].join(`
 `)}function hn(E,_){let T=E?Rn(E):null,r=_.bucket?["  destinations: [","    {","      type: 's3',",`      bucket: '${_.bucket}',`,"      prefix: 'db-backups',",..._.endpoint?[`      endpoint: '${_.endpoint}',`]:[],"      optional: false,","    },","  ],"]:[];return["import type { BackupConfig } from 'ts-backups'","","const config: BackupConfig = {","  verbose: true,",`  outputPath: '${F2}',`,"  retention: {",`    count: ${_.retentionCount??5},`,`    maxAge: ${_.retentionDays??30},`,"  },","  databases: [",...T?[T]:[],"  ],",...r,"}","","export default config",""].join(`
@@ -9035,7 +9035,7 @@ ${Object.entries(E).filter(([t])=>!t.startsWith("@_")).map(([t,R])=>d(t,R,"  ","
 │                                                                             │
 │  Verification typically takes 1-2 business days.                            │
 │  After verification, re-run: bunx bunpress deploy                           │
-└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:F,stackName:t,bucket:I,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:F,stackName:t,bucket:I,message:`Stack deployment failed: ${g.message}`}}let Y=(await R.describeStacks({stackName:t})).Stacks[0]?.Outputs||[],M=(g)=>Y.find((k)=>k.OutputKey===g)?.OutputValue,V=M("DistributionDomain");if(V&&N)console.log(`Creating DNS records via ${N.name}...`),await jJ(N,r,V);else if(V&&!N)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:F,stackName:t,bucket:M("BucketName")||I,distributionId:M("DistributionId"),distributionDomain:V,domain:r,certificateArn:S,message:"Static site infrastructure deployed successfully with external DNS"}}async function jJ(E,_,T){if(!E){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(_.split(".").length===2)if(E instanceof uh){console.log(`Creating Route53 alias record for apex domain ${_} -> ${T}`);let t=await E.createCloudFrontAlias({domain:_,name:_,cloudFrontDomainName:T});if(!t.success)console.warn(`Warning: Could not create Route53 alias record: ${t.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${_} -> ${T}`);else console.log(`Created Route53 alias record: ${_} -> ${T}`);let R=`www.${_}`;console.log(`Creating Route53 alias record for ${R} -> ${T}`);let h=await E.createCloudFrontAlias({domain:_,name:R,cloudFrontDomainName:T});if(!h.success)console.warn(`Warning: Could not create www Route53 alias: ${h.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${R} -> ${T}`);else console.log(`Created Route53 alias record: ${R} -> ${T}`)}else{try{let N=await E.listRecords(_,"A");if(N.success)for(let S of N.records){let A=S.name.replace(/\.$/,"");if(A===_||A==="")console.log(`Removing existing root A record (${S.content}) to make room for ALIAS...`),await E.deleteRecord(_,{name:_,type:"A",content:S.content})}}catch(N){console.log(`Note: Could not check for conflicting A records: ${N instanceof Error?N.message:N}`)}console.log(`Creating ALIAS record for apex domain ${_} -> ${T}`);let t=await E.upsertRecord(_,{name:_,type:"ALIAS",content:T,ttl:600});if(!t.success)console.warn(`Warning: Could not create ALIAS record: ${t.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${_} -> ${T}`);else console.log(`Created ALIAS record: ${_} -> ${T}`);let R=`www.${_}`;console.log(`Creating CNAME record for ${R} -> ${T}`);let h=await E.upsertRecord(_,{name:R,type:"CNAME",content:T,ttl:600});if(!h.success)console.warn(`Warning: Could not create www DNS record: ${h.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${R} -> ${T}`);else console.log(`Created CNAME record: ${R} -> ${T}`)}else{console.log(`Creating CNAME record for ${_} -> ${T}`);let t=await E.upsertRecord(_,{name:_,type:"CNAME",content:T,ttl:600});if(!t.success)console.warn(`Warning: Could not create DNS record: ${t.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${_} -> ${T}`);else console.log(`Created CNAME record: ${_} -> ${T}`)}}async function hD(E){let{sourceDir:_,cleanBucket:T=!1,onProgress:r,...d}=E;r?.("infrastructure","Deploying CloudFormation stack...");let t=await RD(d);if(!t.success)return t;if(T){r?.("clean","Cleaning old files from S3...");try{await new xE(d.region||"us-east-1").emptyBucket(t.bucket)}catch(S){console.log(`Note: Could not clean bucket: ${S.message}`)}}r?.("upload","Uploading files to S3...");let{uploadStaticFiles:R}=await Promise.resolve().then(() => (AO(),tD)),h=await R({sourceDir:_,bucket:t.bucket,region:d.region||"us-east-1",cacheControl:d.cacheControl,onProgress:(S,A,L)=>{r?.("upload",`${S}/${A}: ${L}`)}});if(h.errors.length>0)return{...t,success:!1,message:`Upload errors: ${h.errors.join(", ")}`,filesUploaded:h.uploaded};if(t.distributionId&&h.uploaded>0){r?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:S}=await Promise.resolve().then(() => (AO(),tD));await S(t.distributionId)}r?.("complete","Deployment complete!");let N=h.skipped>0?`Deployed ${h.uploaded} files (${h.skipped} unchanged) with external DNS`:`Deployed ${h.uploaded} files successfully with external DNS`;return{...t,filesUploaded:h.uploaded,filesSkipped:h.skipped,message:N}}var LO=CE(()=>{Mt();KT();Vr();z_();sd();xU();He()});var UQ={};Z_(UQ,{inferQuickDeployProvider:()=>Di,buildQuickDeployCi:()=>wi});function $i(E){let _=E.sites||{};for(let T of Object.values(_))if(T?.repository?.url)return{provider:T.repository.provider,branch:T.repository.branch};return}function Di(E){let _=E.trim().toLowerCase();if(_.includes("github.com"))return"github";if(_.includes("gitlab.com"))return"gitlab";if(_.includes("bitbucket.org"))return"bitbucket";return}function cQ(E){return`'${E.replace(/'/g,"'\\''")}'`}function Ii(E){return E.replace(/'/g,"''")}function Ci(E,_){let T=["bunx --bun @stacksjs/ts-cloud deploy","--env",cQ(E)];if(_.site)T.push("--site",cQ(_.site));if(_.skipDnsVerification)T.push("--skip-dns-verification");return T.push("--yes"),T.join(" ")}function wi(E,_="production",T={}){let r=$i(E),d=T.provider||r?.provider;if(d!=="github"&&d!=="gitlab"&&d!=="bitbucket")return null;let t=E.environments?.[_],R=t?.deployBranch||r?.branch||"main",h=Ci(_,T),N=JSON.stringify(R),S=JSON.stringify(_),A=t?.domain?t.domain.startsWith("http")?t.domain:`https://${t.domain}`:void 0,L=A?`
+└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:F,stackName:t,bucket:I,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:F,stackName:t,bucket:I,message:`Stack deployment failed: ${g.message}`}}let Y=(await R.describeStacks({stackName:t})).Stacks[0]?.Outputs||[],M=(g)=>Y.find((k)=>k.OutputKey===g)?.OutputValue,V=M("DistributionDomain");if(V&&N)console.log(`Creating DNS records via ${N.name}...`),await jJ(N,r,V);else if(V&&!N)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:F,stackName:t,bucket:M("BucketName")||I,distributionId:M("DistributionId"),distributionDomain:V,domain:r,certificateArn:S,message:"Static site infrastructure deployed successfully with external DNS"}}async function jJ(E,_,T){if(!E){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(_.split(".").length===2)if(E instanceof uh){console.log(`Creating Route53 alias record for apex domain ${_} -> ${T}`);let t=await E.createCloudFrontAlias({domain:_,name:_,cloudFrontDomainName:T});if(!t.success)console.warn(`Warning: Could not create Route53 alias record: ${t.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${_} -> ${T}`);else console.log(`Created Route53 alias record: ${_} -> ${T}`);let R=`www.${_}`;console.log(`Creating Route53 alias record for ${R} -> ${T}`);let h=await E.createCloudFrontAlias({domain:_,name:R,cloudFrontDomainName:T});if(!h.success)console.warn(`Warning: Could not create www Route53 alias: ${h.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${R} -> ${T}`);else console.log(`Created Route53 alias record: ${R} -> ${T}`)}else{try{let N=await E.listRecords(_,"A");if(N.success)for(let S of N.records){let A=S.name.replace(/\.$/,"");if(A===_||A==="")console.log(`Removing existing root A record (${S.content}) to make room for ALIAS...`),await E.deleteRecord(_,{name:_,type:"A",content:S.content})}}catch(N){console.log(`Note: Could not check for conflicting A records: ${N instanceof Error?N.message:N}`)}console.log(`Creating ALIAS record for apex domain ${_} -> ${T}`);let t=await E.upsertRecord(_,{name:_,type:"ALIAS",content:T,ttl:600});if(!t.success)console.warn(`Warning: Could not create ALIAS record: ${t.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${_} -> ${T}`);else console.log(`Created ALIAS record: ${_} -> ${T}`);let R=`www.${_}`;console.log(`Creating CNAME record for ${R} -> ${T}`);let h=await E.upsertRecord(_,{name:R,type:"CNAME",content:T,ttl:600});if(!h.success)console.warn(`Warning: Could not create www DNS record: ${h.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${R} -> ${T}`);else console.log(`Created CNAME record: ${R} -> ${T}`)}else{console.log(`Creating CNAME record for ${_} -> ${T}`);let t=await E.upsertRecord(_,{name:_,type:"CNAME",content:T,ttl:600});if(!t.success)console.warn(`Warning: Could not create DNS record: ${t.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${_} -> ${T}`);else console.log(`Created CNAME record: ${_} -> ${T}`)}}async function hD(E){let{sourceDir:_,cleanBucket:T=!1,onProgress:r,...d}=E;r?.("infrastructure","Deploying CloudFormation stack...");let t=await RD(d);if(!t.success)return t;if(T){r?.("clean","Cleaning old files from S3...");try{await new xE(d.region||"us-east-1").emptyBucket(t.bucket)}catch(S){console.log(`Note: Could not clean bucket: ${S.message}`)}}r?.("upload","Uploading files to S3...");let{uploadStaticFiles:R}=await Promise.resolve().then(() => (AO(),tD)),h=await R({sourceDir:_,bucket:t.bucket,region:d.region||"us-east-1",cacheControl:d.cacheControl,onProgress:(S,A,L)=>{r?.("upload",`${S}/${A}: ${L}`)}});if(h.errors.length>0)return{...t,success:!1,message:`Upload errors: ${h.errors.join(", ")}`,filesUploaded:h.uploaded};if(t.distributionId&&h.uploaded>0){r?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:S}=await Promise.resolve().then(() => (AO(),tD));await S(t.distributionId)}r?.("complete","Deployment complete!");let N=h.skipped>0?`Deployed ${h.uploaded} files (${h.skipped} unchanged) with external DNS`:`Deployed ${h.uploaded} files successfully with external DNS`;return{...t,filesUploaded:h.uploaded,filesSkipped:h.skipped,message:N}}var LO=CE(()=>{Mt();KT();Vr();z_();sd();xU();He()});var U9={};Z_(U9,{inferQuickDeployProvider:()=>Di,buildQuickDeployCi:()=>wi});function $i(E){let _=E.sites||{};for(let T of Object.values(_))if(T?.repository?.url)return{provider:T.repository.provider,branch:T.repository.branch};return}function Di(E){let _=E.trim().toLowerCase();if(_.includes("github.com"))return"github";if(_.includes("gitlab.com"))return"gitlab";if(_.includes("bitbucket.org"))return"bitbucket";return}function c9(E){return`'${E.replace(/'/g,"'\\''")}'`}function Ii(E){return E.replace(/'/g,"''")}function Ci(E,_){let T=["bunx --bun @stacksjs/ts-cloud deploy","--env",c9(E)];if(_.site)T.push("--site",c9(_.site));if(_.skipDnsVerification)T.push("--skip-dns-verification");return T.push("--yes"),T.join(" ")}function wi(E,_="production",T={}){let r=$i(E),d=T.provider||r?.provider;if(d!=="github"&&d!=="gitlab"&&d!=="bitbucket")return null;let t=E.environments?.[_],R=t?.deployBranch||r?.branch||"main",h=Ci(_,T),N=JSON.stringify(R),S=JSON.stringify(_),A=t?.domain?t.domain.startsWith("http")?t.domain:`https://${t.domain}`:void 0,L=A?`
       url: ${JSON.stringify(A)}`:"",O=T.setup==="pantry"?`      - name: Setup Pantry
         uses: home-lang/pantry/packages/action@main`:`      - uses: oven-sh/setup-bun@v2
       - run: bun install --frozen-lockfile`,c=GT(E)==="hetzner"&&!!E.infrastructure?.compute,$=T.sshPrivateKeySecret||"SSH_PRIVATE_KEY";if(!/^[A-Z_][A-Z0-9_]*$/i.test($))throw Error(`Invalid SSH private key secret name '${$}'`);let I=c?`
@@ -9104,16 +9104,16 @@ ${I}
             - bun install --frozen-lockfile
             - ${h}
           # Set HCLOUD_TOKEN / HETZNER_API_TOKEN / AWS credentials as repo variables.
-`}}var $Q=CE(async()=>{await aE()});class SD{client;region;constructor(E="us-east-1"){this.region=E,this.client=new JE}async describeFileSystems(E){let _=[];if(E?.FileSystemId)_.push(`FileSystemId=${encodeURIComponent(E.FileSystemId)}`);if(E?.CreationToken)_.push(`CreationToken=${encodeURIComponent(E.CreationToken)}`);let T=`/2015-02-01/file-systems${_.length>0?`?${_.join("&")}`:""}`;return{FileSystems:((await this.client.request({service:"elasticfilesystem",region:this.region,method:"GET",path:T,headers:{"Content-Type":"application/json"}})).FileSystems||[]).map((d)=>({FileSystemId:d.FileSystemId,Name:d.Name,CreationTime:d.CreationTime,LifeCycleState:d.LifeCycleState,NumberOfMountTargets:d.NumberOfMountTargets,SizeInBytes:d.SizeInBytes?{Value:d.SizeInBytes.Value,Timestamp:d.SizeInBytes.Timestamp}:void 0,PerformanceMode:d.PerformanceMode,Encrypted:d.Encrypted,ThroughputMode:d.ThroughputMode,Tags:d.Tags}))}}}var GJ=CE(()=>{VE()});var DQ={};Z_(DQ,{SQSClient:()=>AT});class AT{client;region;constructor(E="us-east-1",_){this.region=E,this.client=new JE}async createQueue(E){let T={Action:"CreateQueue",QueueName:E.fifo&&!E.queueName.endsWith(".fifo")?`${E.queueName}.fifo`:E.queueName,Version:"2012-11-05"},r=1;if(E.visibilityTimeout!==void 0)T[`Attribute.${r}.Name`]="VisibilityTimeout",T[`Attribute.${r}.Value`]=E.visibilityTimeout.toString(),r++;if(E.messageRetentionPeriod!==void 0)T[`Attribute.${r}.Name`]="MessageRetentionPeriod",T[`Attribute.${r}.Value`]=E.messageRetentionPeriod.toString(),r++;if(E.delaySeconds!==void 0)T[`Attribute.${r}.Name`]="DelaySeconds",T[`Attribute.${r}.Value`]=E.delaySeconds.toString(),r++;if(E.maxMessageSize!==void 0)T[`Attribute.${r}.Name`]="MaximumMessageSize",T[`Attribute.${r}.Value`]=E.maxMessageSize.toString(),r++;if(E.receiveMessageWaitTime!==void 0)T[`Attribute.${r}.Name`]="ReceiveMessageWaitTimeSeconds",T[`Attribute.${r}.Value`]=E.receiveMessageWaitTime.toString(),r++;if(E.fifo){if(T[`Attribute.${r}.Name`]="FifoQueue",T[`Attribute.${r}.Value`]="true",r++,E.contentBasedDeduplication)T[`Attribute.${r}.Name`]="ContentBasedDeduplication",T[`Attribute.${r}.Value`]="true",r++}if(E.deadLetterTargetArn&&E.maxReceiveCount)T[`Attribute.${r}.Name`]="RedrivePolicy",T[`Attribute.${r}.Value`]=JSON.stringify({deadLetterTargetArn:E.deadLetterTargetArn,maxReceiveCount:E.maxReceiveCount}),r++;if(E.tags&&Object.keys(E.tags).length>0){let t=1;for(let[R,h]of Object.entries(E.tags))T[`Tag.${t}.Key`]=R,T[`Tag.${t}.Value`]=h,t++}let d=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(T).toString()});return{QueueUrl:d.QueueUrl||d.CreateQueueResult?.QueueUrl}}async listQueues(E){let _={Action:"ListQueues",Version:"2012-11-05"};if(E)_.QueueNamePrefix=E;let T=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()}),r=[];if(T.QueueUrl)r.push(T.QueueUrl);else if(T.ListQueuesResult?.QueueUrl)if(Array.isArray(T.ListQueuesResult.QueueUrl))r.push(...T.ListQueuesResult.QueueUrl);else r.push(T.ListQueuesResult.QueueUrl);return{QueueUrls:r}}async getQueueAttributes(E){let _={Action:"GetQueueAttributes",QueueUrl:E,Version:"2012-11-05","AttributeName.1":"All"},T=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()});return{Attributes:T.Attributes||T.GetQueueAttributesResult?.Attributes||{}}}async getQueueUrl(E){let _={Action:"GetQueueUrl",QueueName:E,Version:"2012-11-05"},T=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()});return{QueueUrl:T.QueueUrl||T.GetQueueUrlResult?.QueueUrl}}async deleteQueue(E){let _={Action:"DeleteQueue",QueueUrl:E,Version:"2012-11-05"};await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()})}async purgeQueue(E){let _={Action:"PurgeQueue",QueueUrl:E,Version:"2012-11-05"};await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()})}async sendMessage(E){let _={Action:"SendMessage",QueueUrl:E.queueUrl,MessageBody:E.messageBody,Version:"2012-11-05"};if(E.delaySeconds!==void 0)_.DelaySeconds=E.delaySeconds;if(E.messageGroupId)_.MessageGroupId=E.messageGroupId;if(E.messageDeduplicationId)_.MessageDeduplicationId=E.messageDeduplicationId;let T=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()});return{MessageId:T.MessageId||T.SendMessageResult?.MessageId}}async receiveMessages(E){let _={Action:"ReceiveMessage",QueueUrl:E.queueUrl,Version:"2012-11-05"};if(E.maxMessages!==void 0)_.MaxNumberOfMessages=E.maxMessages;if(E.visibilityTimeout!==void 0)_.VisibilityTimeout=E.visibilityTimeout;if(E.waitTimeSeconds!==void 0)_.WaitTimeSeconds=E.waitTimeSeconds;let T=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()}),r=[],d=T.Message||T.ReceiveMessageResult?.Message;if(d)if(Array.isArray(d))r.push(...d.map((t)=>({MessageId:t.MessageId,ReceiptHandle:t.ReceiptHandle,Body:t.Body})));else r.push({MessageId:d.MessageId,ReceiptHandle:d.ReceiptHandle,Body:d.Body});return{Messages:r}}async deleteMessage(E,_){let T={Action:"DeleteMessage",QueueUrl:E,ReceiptHandle:_,Version:"2012-11-05"};await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(T).toString()})}}var JA=CE(()=>{VE()});class MJ{client;region;constructor(E="us-east-1"){this.region=E,this.client=new JE}async call(E,_){return this.client.request({service:"wafv2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSWAF_20190729.${E}`},body:JSON.stringify(_)})}async listWebACLs(E="REGIONAL"){return(await this.call("ListWebACLs",{Scope:E,Limit:100}))?.WebACLs??[]}async getWebACLRules(E,_,T="REGIONAL"){return((await this.call("GetWebACL",{Name:E,Id:_,Scope:T}))?.WebACL?.Rules??[]).map((t)=>({Name:t.Name,Priority:t.Priority,Action:t.Action?Object.keys(t.Action)[0]:t.OverrideAction?Object.keys(t.OverrideAction)[0]:"count"}))}}var IQ=CE(()=>{VE()});var wQ={};Z_(wQ,{resolveDashboardData:()=>FA});function CQ(E){return String(E).padStart(2,"0")}function zA(E){return`${E.getUTCFullYear()}-${CQ(E.getUTCMonth()+1)}-${CQ(E.getUTCDate())}`}function ei(E){let _=Math.max(0,Math.round((Date.now()-E)/1000));if(_<60)return`${_}s ago`;let T=Math.round(_/60);if(T<60)return`${T}m ago`;let r=Math.round(T/60);if(r<48)return`${r}h ago`;return`${Math.round(r/24)}d ago`}async function $O(E,_,T,r,d,t){let R=await E.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:T,Dimensions:[{Name:"FunctionName",Value:_}],StartTime:d,EndTime:t,Period:86400,Statistics:[r]}).catch(()=>[]);if(!R.length)return 0;if(r==="Sum")return R.reduce((h,N)=>h+(N.Sum??0),0);if(r==="Maximum")return Math.max(...R.map((h)=>h.Maximum??0));return R.reduce((h,N)=>h+(N.Average??0),0)/R.length}async function DO(E,_,T,r,d,t,R){let h=await E.getMetricStatistics({Namespace:_,MetricName:T,Dimensions:r,StartTime:t,EndTime:R,Period:86400,Statistics:[d]}).catch(()=>[]);if(!h.length)return 0;if(d==="Sum")return h.reduce((N,S)=>N+(S.Sum??0),0);if(d==="Maximum")return Math.max(...h.map((N)=>N.Maximum??0));return h.reduce((N,S)=>N+(S.Average??0),0)/h.length}async function fJ(E,_,T,r,d){let t=await E.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:[{Name:"FunctionName",Value:_}],StartTime:r,EndTime:d,Period:86400,ExtendedStatistics:[T]}).catch(()=>[]);return Math.round(t.reduce((R,h)=>R+(h.Percentiles?.[T]??0),0))}async function FA(E,_){let T=await _T(E,_),r=T.region,d=new nT(r),t=new B_(r),R=new Ir(r),h=new Date,N=new Date(h.getTime()-86400000),S=E.environments?.[_]?.app,A={};A.app={name:T.slug,env:_,region:r,runtime:S?.kind==="php"?`php-${S?.phpVersion??"8.3"} (fpm)`:S?.kind??"node",url:T.endpoint??"",build:T.lastRelease?.sha?.slice(0,7)??"—",deployedAt:T.lastRelease?.timestamp??"—"},A.maintenance={enabled:!1},A.scheduler={enabled:T.scheduler!=="off",expression:T.scheduler==="sub-minute"?"rate(1 minute) · sub-minute":"rate(1 minute)",lastRun:"—"};let L=0,O=0,c=0,$=[],I=[],C=[];for(let B of T.functions){let[y,Y,M,V,g,k,v,EE,m]=await Promise.all([$O(d,B.name,"Invocations","Sum",N,h),$O(d,B.name,"Errors","Sum",N,h),$O(d,B.name,"Throttles","Sum",N,h),$O(d,B.name,"Duration","Average",N,h),t.getFunction(B.name).catch(()=>null),fJ(d,B.name,"p50",N,h),fJ(d,B.name,"p95",N,h),fJ(d,B.name,"p99",N,h),d.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:B.name}],StartTime:new Date(h.getTime()-43200000),EndTime:h,Period:3600,Stat:"Sum"}).catch(()=>[])]);L+=y,O+=Y,c=Math.max(c,V);let rE=g?.Configuration?.MemorySize??0,LE=Object.keys(g?.Configuration?.Environment?.Variables??{}),P=[],x=0;try{let{events:TE=[]}=await R.filterLogEvents({logGroupName:`/aws/lambda/${B.name}`,startTime:N.getTime(),limit:120});for(let OE of TE){let RE=(OE.message??"").trim(),zE=/Max Memory Used:\s*(\d+)\s*MB/.exec(RE);if(zE)x=Math.max(x,Number(zE[1]));if(RE&&!/^(?:START|END|REPORT|INIT_START)/.test(RE))C.push({source:B.mode||B.name,timestamp:new Date(OE.timestamp??0).toISOString(),when:ei(OE.timestamp??0),message:RE.slice(0,400),level:/error|exception|fatal|panic|traceback/i.test(RE)?"error":/warn|warning|timeout|retr(?:y|ies)|throttl/i.test(RE)?"warn":"info"})}P=TE.filter((OE)=>!/^(?:START|END|REPORT|INIT_START)/.test((OE.message??"").trim())).slice(-6).map((OE)=>({ts:new Date(OE.timestamp??0).toISOString().slice(11,19),msg:(OE.message??"").trim().slice(0,120),err:/error|exception|fatal/i.test(OE.message??"")}))}catch{}let s=Math.max(1,...m);$.push({key:B.mode,name:B.name,version:B.version,memory:rE,timeout:g?.Configuration?.Timeout??0,runtime:g?.Configuration?.Runtime??"provided.al2023",invocations:Math.round(y),errors:Math.round(Y),p95:v||Math.round(V),status:"active",provisioned:B.provisioned?`${B.provisioned.allocated}/${B.provisioned.requested}`:void 0}),I.push({key:B.mode,name:B.name,runtime:g?.Configuration?.Runtime??"provided.al2023",arch:g?.Configuration?.Architectures?.[0]??"x86_64",memory:rE,timeout:g?.Configuration?.Timeout??0,ephemeral:g?.Configuration?.EphemeralStorage?.Size??512,version:B.version,concurrency:S?.concurrency??"—",invocations:Math.round(y),errors:Math.round(Y),throttles:Math.round(M),p50:k||Math.round(V),p95:v||Math.round(V),p99:EE||Math.round(V),maxMem:x,spark:m.length?m.map((TE)=>Math.round(TE/s*100)):[0],env:LE.length?LE:["(none)"],recent:P.length?P:[{ts:"—",msg:"no recent events",err:!1}]})}A.functions=$,A.functionsDetail=I,A.serverlessLogs=C.sort((B,y)=>String(y.timestamp).localeCompare(String(B.timestamp))).slice(0,600),A.serverlessLogsEmptyReason=C.length?void 0:"No recent function logs were found in CloudWatch for this environment.";let e=L?Number((O/L*100).toFixed(2)):0,z=Math.round(await $O(d,T.functions[0]?.name??"","ConcurrentExecutions","Maximum",N,h));A.metrics={invocations:Math.round(L),errorRatePct:e,p95Ms:Math.round(c),coldStartPct:void 0,concurrency:z,estCostUsd:void 0};try{let B=new AT(r),y=[],Y=[],M=0;try{let{QueueUrl:g}=await B.getQueueUrl(`${T.slug}-${_}-dlq`),{Attributes:k}=await B.getQueueAttributes(g);M=Number(k.ApproximateNumberOfMessages??0)}catch{}let V=S?fh(S,T.slug,_):[];for(let g of V){let k=g.name.replace(`${T.slug}-${_}-`,""),v=0,EE=0;try{let{QueueUrl:rE}=await B.getQueueUrl(g.name),{Attributes:LE}=await B.getQueueAttributes(rE);v=Number(LE.ApproximateNumberOfMessages??0),EE=Number(LE.ApproximateNumberOfMessagesNotVisible??0)}catch{}let m=Math.round(await DO(d,"AWS/SQS","NumberOfMessagesDeleted",[{Name:"QueueName",Value:g.name}],"Sum",N,h));y.push({name:k,visible:v,inFlight:EE,processed:m,dlq:M}),Y.push({name:g.name,short:k,visible:v,inFlight:EE,delayed:0,processed:m,oldestSec:0,concurrency:g.concurrency??S?.queueConcurrency??"—",tries:S?.queueTries??3,visTimeout:(S?.queueTimeout??120)*6,dlq:M})}if(y.length)A.queues=y;if(Y.length)A.queuesDetail=Y;A.dlqItems=[]}catch{}try{let B=new oE(r),{Stacks:y}=await B.describeStacks({stackName:Xt(E,_)}),Y={};for(let M of y?.[0]?.Outputs??[])if(M.OutputKey)Y[M.OutputKey]=M.OutputValue??"";if(S?.database?.connection==="aurora-serverless"){let M=`${T.slug}-${_}-db`,V=[{Name:"DBClusterIdentifier",Value:M}],[g,k]=await Promise.all([DO(d,"AWS/RDS","ServerlessDatabaseCapacity",V,"Average",N,h),DO(d,"AWS/RDS","DatabaseConnections",V,"Maximum",N,h)]);if(A.aurora={id:M,engine:"aurora-mysql",minAcu:S?.database?.minCapacity??0.5,maxAcu:S?.database?.maxCapacity??4,currentAcu:g?Number(g.toFixed(1)):S?.database?.minCapacity??0.5,database:"app",connections:Math.round(k),status:Y.DbEndpoint?"available":"creating"},S?.rdsProxy)A.proxy={name:`${T.slug}-${_}-proxy`,endpoint:Y.DbProxyEndpoint??"—",pooledConns:Math.round(k),status:"available"}}if(S?.cache?.driver==="elasticache"){let M=`${T.slug}-${_}-cache`,V=[{Name:"CacheClusterId",Value:`${M}-001`}],[g,k]=await Promise.all([DO(d,"AWS/ElastiCache","CacheHits",V,"Sum",N,h),DO(d,"AWS/ElastiCache","CacheMisses",V,"Sum",N,h)]),v=g+k>0?Number((g/(g+k)*100).toFixed(1)):0;A.redis={id:M,node:"cache.t4g.micro",engine:"redis",hitRate:v,status:Y.CacheEndpoint?"available":"creating"}}if(S?.efs){let M=0;try{if(Y.EfsFileSystemId){let V=new SD(r),{FileSystems:g}=await V.describeFileSystems({FileSystemId:Y.EfsFileSystemId});M=Number(((g?.[0]?.SizeInBytes?.Value??0)/1048576).toFixed(1))}}catch{}A.efs={id:Y.EfsFileSystemId??"efs",mount:"/mnt/local",sizeMb:M,status:"available"}}A.assetsInfo=Y.AssetsCdnDomain?{bucket:Y.AssetsBucketName??`${T.slug}-${_}-assets`,cdn:Y.AssetsCdnDomain,customDomain:S?.assetDomain??"—",assetUrl:T.assetUrl??"—",files:0,sizeMb:0,cacheHitPct:0,build:A.app.build}:void 0}catch{}if(A.assetsInfo)try{let y=await new xE(r).list({bucket:A.assetsInfo.bucket,maxKeys:1000});A.assetsInfo.files=y.length,A.assetsInfo.sizeMb=Number((y.reduce((Y,M)=>Y+(M.Size??0),0)/1048576).toFixed(1)),A.assetsRecent=y.slice(0,8).map((Y)=>({path:`/${Y.Key}`,size:`${Math.max(1,Math.round((Y.Size??0)/1024))} KB`,type:Y.Key.split(".").pop()??""}))}catch{}try{if(S?.secrets){let B=Array.isArray(S.secrets)?S.secrets.map((y)=>({key:y.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),source:y})):Object.entries(S.secrets).map(([y,Y])=>({key:y,source:String(Y)}));A.secretsList=B.map((y)=>({...y,updated:"—"}))}}catch{}try{let B=new xE(r),y=`${T.slug}-${_}-deployments`,Y=await B.getObjectJson(y,`deployments/${T.slug}/${_}/history.json`).catch(()=>null);if(Y?.records?.length)A.deploymentsDetail=Y.records.slice(-12).reverse().map((M)=>({sha:(M.sha??"").slice(0,7),status:M.status??"success",when:M.timestamp??"—",took:M.took??"—",by:M.by??"—",version:M.version??"—",hooks:M.hooks??[]}))}catch{}A.metricsTotals={invocations:A.metrics.invocations,errors:Math.round(O),errorRatePct:e,p95Ms:A.metrics.p95Ms,throttles:I.reduce((B,y)=>B+y.throttles,0),coldStartPct:void 0,estCostUsd:void 0,concurrency:z},A.metricsPerFn=I.map((B)=>({key:B.key,invocations:B.invocations,errors:B.errors,throttles:B.throttles,avgMs:B.p50,maxMs:B.p99,costUsd:void 0}));try{A.invSpark=await d.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:T.functions.find((B)=>B.mode==="http")?.name??""}],StartTime:new Date(h.getTime()-86400000),EndTime:h,Period:3600,Stat:"Sum"})}catch{}try{let B=new rt,y=h,Y=new Date(Date.UTC(y.getUTCFullYear(),y.getUTCMonth(),1)),M=new Date(Date.UTC(y.getUTCFullYear(),y.getUTCMonth()-1,1)),[V,g]=await Promise.all([B.getCostByService({start:zA(Y),end:zA(y),granularity:"MONTHLY"}).catch(()=>[]),B.getCostByService({start:zA(M),end:zA(Y),granularity:"MONTHLY"}).catch(()=>[])]);if(V.length){let k=V.reduce((x,s)=>x+s.amount,0),v=g.reduce((x,s)=>x+s.amount,0),EE=y.getUTCDate(),m=new Date(Date.UTC(y.getUTCFullYear(),y.getUTCMonth()+1,0)).getUTCDate();A.costSummary={monthToDateUsd:Number(k.toFixed(2)),projectedUsd:Number((k/EE*m).toFixed(2)),lastMonthUsd:Number(v.toFixed(2)),dailyAvgUsd:Number((k/EE).toFixed(2))},A.costServices=V.filter((x)=>x.amount>0).sort((x,s)=>s.amount-x.amount).slice(0,12).map((x)=>({name:x.service,usd:Number(x.amount.toFixed(2)),note:""})),A.metrics.estCostUsd=Number((k/EE).toFixed(2)),A.metricsTotals.estCostUsd=A.metrics.estCostUsd,A.costTrend=await B.getDailyTotals({start:zA(Y),end:zA(y)}).catch(()=>[]);let rE=V.find((x)=>/lambda/i.test(x.service))?.amount??0,LE=(x)=>x.invocations*(x.p50/1000)*(x.memory/1024),P=I.reduce((x,s)=>x+LE(s),0)||1;A.costPerFn=I.map((x)=>({key:x.key,requests:x.invocations,gbSec:Math.round(LE(x)),usd:Number((rE*(LE(x)/P)).toFixed(2))}))}}catch{}if(S?.firewall)try{let B=await d.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"BlockedRequests",StartTime:N,EndTime:h,Period:86400,Statistics:["Sum"]}).catch(()=>[]),y=await d.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"AllowedRequests",StartTime:N,EndTime:h,Period:86400,Statistics:["Sum"]}).catch(()=>[]);A.waf={enabled:!0,scope:"REGIONAL",acl:`${T.slug}-${_}-waf`,allowed24h:Math.round(y.reduce((Y,M)=>Y+(M.Sum??0),0)),blocked24h:Math.round(B.reduce((Y,M)=>Y+(M.Sum??0),0))};try{let Y=new MJ(r),M=await Y.listWebACLs("REGIONAL"),V=M.find((g)=>g.Name?.includes(`${T.slug}-${_}`))??M[0];if(V?.Name&&V.Id){A.waf.acl=V.Name;let g=await Y.getWebACLRules(V.Name,V.Id,"REGIONAL");if(g.length)A.wafRules=g.map((k)=>({name:k.Name??"—",detail:`priority ${k.Priority??0}`,action:k.Action??"count",blocked24h:0}))}}catch{}}catch{}let F=[];if(A.aurora)F.push({name:"Aurora Serverless v2",detail:`${A.aurora.id} · ${A.aurora.minAcu}-${A.aurora.maxAcu} ACU`,status:A.aurora.status});if(A.proxy)F.push({name:"RDS Proxy",detail:A.proxy.name,status:A.proxy.status});if(A.redis)F.push({name:`ElastiCache (${A.redis.engine})`,detail:`${A.redis.node} · ${A.redis.hitRate}% hit rate`,status:A.redis.status});if(A.efs)F.push({name:"EFS",detail:`${A.efs.mount} · ${A.efs.sizeMb} MB`,status:A.efs.status});if(F.length)A.dataServices=F;if(T.scheduler!=="off"&&S?.kind==="php")try{let B=await it(E,_,"schedule:list"),y=[];for(let Y of(B||"").split(`
-`)){let M=/^\s*([\d*/,\-\s]+?)\s{2,}(.+?)(?:\s{2,}Next Due.*)?$/.exec(Y);if(M&&/[*\d]/.test(M[1])&&M[1].trim().split(/\s+/).length===5)y.push({command:M[2].trim().replace(/^php artisan /,""),cron:M[1].trim(),desc:"",lastRun:"—",lastStatus:"ok"})}if(y.length)A.schedulerTasks=y}catch{}return A}var IO=CE(async()=>{KT();vS();sR();f0();GJ();Gr();z_();JA();IQ();await bd([aE(),TT()])});import{createHash as Xi}from"node:crypto";function XQ(E){let _=KJ(E.name),T=VJ(E.publicKey),r=zi([...E.existingKeys??[],{name:_,publicKey:T}]);return zQ(E.configText,r)}function JQ(E){let _=KJ(E.name),T=(E.existingKeys??[]).filter((r)=>r.name!==_);if((E.existingKeys??[]).length===T.length)throw Error(`SSH key '${_}' does not exist in compute.sshKeys`);return zQ(E.configText,T)}function ch(E=[]){return E.map((_)=>({name:_.name,publicKey:_.publicKey,type:Fi(_.publicKey),fingerprint:ji(_.publicKey),added:"configured"}))}function zQ(E,_){let T=Bi(E,"compute"),r=Ji(_),d=Wi(E,T.start,T.end,"sshKeys");if(d){let N=d.propertyStart;while(N>0&&E[N-1]!==`
+`}}var $9=CE(async()=>{await aE()});class SD{client;region;constructor(E="us-east-1"){this.region=E,this.client=new JE}async describeFileSystems(E){let _=[];if(E?.FileSystemId)_.push(`FileSystemId=${encodeURIComponent(E.FileSystemId)}`);if(E?.CreationToken)_.push(`CreationToken=${encodeURIComponent(E.CreationToken)}`);let T=`/2015-02-01/file-systems${_.length>0?`?${_.join("&")}`:""}`;return{FileSystems:((await this.client.request({service:"elasticfilesystem",region:this.region,method:"GET",path:T,headers:{"Content-Type":"application/json"}})).FileSystems||[]).map((d)=>({FileSystemId:d.FileSystemId,Name:d.Name,CreationTime:d.CreationTime,LifeCycleState:d.LifeCycleState,NumberOfMountTargets:d.NumberOfMountTargets,SizeInBytes:d.SizeInBytes?{Value:d.SizeInBytes.Value,Timestamp:d.SizeInBytes.Timestamp}:void 0,PerformanceMode:d.PerformanceMode,Encrypted:d.Encrypted,ThroughputMode:d.ThroughputMode,Tags:d.Tags}))}}}var GJ=CE(()=>{VE()});var D9={};Z_(D9,{SQSClient:()=>AT});class AT{client;region;constructor(E="us-east-1",_){this.region=E,this.client=new JE}async createQueue(E){let T={Action:"CreateQueue",QueueName:E.fifo&&!E.queueName.endsWith(".fifo")?`${E.queueName}.fifo`:E.queueName,Version:"2012-11-05"},r=1;if(E.visibilityTimeout!==void 0)T[`Attribute.${r}.Name`]="VisibilityTimeout",T[`Attribute.${r}.Value`]=E.visibilityTimeout.toString(),r++;if(E.messageRetentionPeriod!==void 0)T[`Attribute.${r}.Name`]="MessageRetentionPeriod",T[`Attribute.${r}.Value`]=E.messageRetentionPeriod.toString(),r++;if(E.delaySeconds!==void 0)T[`Attribute.${r}.Name`]="DelaySeconds",T[`Attribute.${r}.Value`]=E.delaySeconds.toString(),r++;if(E.maxMessageSize!==void 0)T[`Attribute.${r}.Name`]="MaximumMessageSize",T[`Attribute.${r}.Value`]=E.maxMessageSize.toString(),r++;if(E.receiveMessageWaitTime!==void 0)T[`Attribute.${r}.Name`]="ReceiveMessageWaitTimeSeconds",T[`Attribute.${r}.Value`]=E.receiveMessageWaitTime.toString(),r++;if(E.fifo){if(T[`Attribute.${r}.Name`]="FifoQueue",T[`Attribute.${r}.Value`]="true",r++,E.contentBasedDeduplication)T[`Attribute.${r}.Name`]="ContentBasedDeduplication",T[`Attribute.${r}.Value`]="true",r++}if(E.deadLetterTargetArn&&E.maxReceiveCount)T[`Attribute.${r}.Name`]="RedrivePolicy",T[`Attribute.${r}.Value`]=JSON.stringify({deadLetterTargetArn:E.deadLetterTargetArn,maxReceiveCount:E.maxReceiveCount}),r++;if(E.tags&&Object.keys(E.tags).length>0){let t=1;for(let[R,h]of Object.entries(E.tags))T[`Tag.${t}.Key`]=R,T[`Tag.${t}.Value`]=h,t++}let d=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(T).toString()});return{QueueUrl:d.QueueUrl||d.CreateQueueResult?.QueueUrl}}async listQueues(E){let _={Action:"ListQueues",Version:"2012-11-05"};if(E)_.QueueNamePrefix=E;let T=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()}),r=[];if(T.QueueUrl)r.push(T.QueueUrl);else if(T.ListQueuesResult?.QueueUrl)if(Array.isArray(T.ListQueuesResult.QueueUrl))r.push(...T.ListQueuesResult.QueueUrl);else r.push(T.ListQueuesResult.QueueUrl);return{QueueUrls:r}}async getQueueAttributes(E){let _={Action:"GetQueueAttributes",QueueUrl:E,Version:"2012-11-05","AttributeName.1":"All"},T=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()});return{Attributes:T.Attributes||T.GetQueueAttributesResult?.Attributes||{}}}async getQueueUrl(E){let _={Action:"GetQueueUrl",QueueName:E,Version:"2012-11-05"},T=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()});return{QueueUrl:T.QueueUrl||T.GetQueueUrlResult?.QueueUrl}}async deleteQueue(E){let _={Action:"DeleteQueue",QueueUrl:E,Version:"2012-11-05"};await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()})}async purgeQueue(E){let _={Action:"PurgeQueue",QueueUrl:E,Version:"2012-11-05"};await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()})}async sendMessage(E){let _={Action:"SendMessage",QueueUrl:E.queueUrl,MessageBody:E.messageBody,Version:"2012-11-05"};if(E.delaySeconds!==void 0)_.DelaySeconds=E.delaySeconds;if(E.messageGroupId)_.MessageGroupId=E.messageGroupId;if(E.messageDeduplicationId)_.MessageDeduplicationId=E.messageDeduplicationId;let T=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()});return{MessageId:T.MessageId||T.SendMessageResult?.MessageId}}async receiveMessages(E){let _={Action:"ReceiveMessage",QueueUrl:E.queueUrl,Version:"2012-11-05"};if(E.maxMessages!==void 0)_.MaxNumberOfMessages=E.maxMessages;if(E.visibilityTimeout!==void 0)_.VisibilityTimeout=E.visibilityTimeout;if(E.waitTimeSeconds!==void 0)_.WaitTimeSeconds=E.waitTimeSeconds;let T=await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(_).toString()}),r=[],d=T.Message||T.ReceiveMessageResult?.Message;if(d)if(Array.isArray(d))r.push(...d.map((t)=>({MessageId:t.MessageId,ReceiptHandle:t.ReceiptHandle,Body:t.Body})));else r.push({MessageId:d.MessageId,ReceiptHandle:d.ReceiptHandle,Body:d.Body});return{Messages:r}}async deleteMessage(E,_){let T={Action:"DeleteMessage",QueueUrl:E,ReceiptHandle:_,Version:"2012-11-05"};await this.client.request({service:"sqs",region:this.region,method:"POST",path:"/",body:new URLSearchParams(T).toString()})}}var JA=CE(()=>{VE()});class MJ{client;region;constructor(E="us-east-1"){this.region=E,this.client=new JE}async call(E,_){return this.client.request({service:"wafv2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSWAF_20190729.${E}`},body:JSON.stringify(_)})}async listWebACLs(E="REGIONAL"){return(await this.call("ListWebACLs",{Scope:E,Limit:100}))?.WebACLs??[]}async getWebACLRules(E,_,T="REGIONAL"){return((await this.call("GetWebACL",{Name:E,Id:_,Scope:T}))?.WebACL?.Rules??[]).map((t)=>({Name:t.Name,Priority:t.Priority,Action:t.Action?Object.keys(t.Action)[0]:t.OverrideAction?Object.keys(t.OverrideAction)[0]:"count"}))}}var I9=CE(()=>{VE()});var w9={};Z_(w9,{resolveDashboardData:()=>FA});function C9(E){return String(E).padStart(2,"0")}function zA(E){return`${E.getUTCFullYear()}-${C9(E.getUTCMonth()+1)}-${C9(E.getUTCDate())}`}function ei(E){let _=Math.max(0,Math.round((Date.now()-E)/1000));if(_<60)return`${_}s ago`;let T=Math.round(_/60);if(T<60)return`${T}m ago`;let r=Math.round(T/60);if(r<48)return`${r}h ago`;return`${Math.round(r/24)}d ago`}async function $O(E,_,T,r,d,t){let R=await E.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:T,Dimensions:[{Name:"FunctionName",Value:_}],StartTime:d,EndTime:t,Period:86400,Statistics:[r]}).catch(()=>[]);if(!R.length)return 0;if(r==="Sum")return R.reduce((h,N)=>h+(N.Sum??0),0);if(r==="Maximum")return Math.max(...R.map((h)=>h.Maximum??0));return R.reduce((h,N)=>h+(N.Average??0),0)/R.length}async function DO(E,_,T,r,d,t,R){let h=await E.getMetricStatistics({Namespace:_,MetricName:T,Dimensions:r,StartTime:t,EndTime:R,Period:86400,Statistics:[d]}).catch(()=>[]);if(!h.length)return 0;if(d==="Sum")return h.reduce((N,S)=>N+(S.Sum??0),0);if(d==="Maximum")return Math.max(...h.map((N)=>N.Maximum??0));return h.reduce((N,S)=>N+(S.Average??0),0)/h.length}async function fJ(E,_,T,r,d){let t=await E.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:[{Name:"FunctionName",Value:_}],StartTime:r,EndTime:d,Period:86400,ExtendedStatistics:[T]}).catch(()=>[]);return Math.round(t.reduce((R,h)=>R+(h.Percentiles?.[T]??0),0))}async function FA(E,_){let T=await _T(E,_),r=T.region,d=new nT(r),t=new B_(r),R=new Ir(r),h=new Date,N=new Date(h.getTime()-86400000),S=E.environments?.[_]?.app,A={};A.app={name:T.slug,env:_,region:r,runtime:S?.kind==="php"?`php-${S?.phpVersion??"8.3"} (fpm)`:S?.kind??"node",url:T.endpoint??"",build:T.lastRelease?.sha?.slice(0,7)??"—",deployedAt:T.lastRelease?.timestamp??"—"},A.maintenance={enabled:!1},A.scheduler={enabled:T.scheduler!=="off",expression:T.scheduler==="sub-minute"?"rate(1 minute) · sub-minute":"rate(1 minute)",lastRun:"—"};let L=0,O=0,c=0,$=[],I=[],C=[];for(let B of T.functions){let[y,Y,M,V,g,k,v,EE,m]=await Promise.all([$O(d,B.name,"Invocations","Sum",N,h),$O(d,B.name,"Errors","Sum",N,h),$O(d,B.name,"Throttles","Sum",N,h),$O(d,B.name,"Duration","Average",N,h),t.getFunction(B.name).catch(()=>null),fJ(d,B.name,"p50",N,h),fJ(d,B.name,"p95",N,h),fJ(d,B.name,"p99",N,h),d.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:B.name}],StartTime:new Date(h.getTime()-43200000),EndTime:h,Period:3600,Stat:"Sum"}).catch(()=>[])]);L+=y,O+=Y,c=Math.max(c,V);let rE=g?.Configuration?.MemorySize??0,LE=Object.keys(g?.Configuration?.Environment?.Variables??{}),P=[],x=0;try{let{events:TE=[]}=await R.filterLogEvents({logGroupName:`/aws/lambda/${B.name}`,startTime:N.getTime(),limit:120});for(let OE of TE){let RE=(OE.message??"").trim(),zE=/Max Memory Used:\s*(\d+)\s*MB/.exec(RE);if(zE)x=Math.max(x,Number(zE[1]));if(RE&&!/^(?:START|END|REPORT|INIT_START)/.test(RE))C.push({source:B.mode||B.name,timestamp:new Date(OE.timestamp??0).toISOString(),when:ei(OE.timestamp??0),message:RE.slice(0,400),level:/error|exception|fatal|panic|traceback/i.test(RE)?"error":/warn|warning|timeout|retr(?:y|ies)|throttl/i.test(RE)?"warn":"info"})}P=TE.filter((OE)=>!/^(?:START|END|REPORT|INIT_START)/.test((OE.message??"").trim())).slice(-6).map((OE)=>({ts:new Date(OE.timestamp??0).toISOString().slice(11,19),msg:(OE.message??"").trim().slice(0,120),err:/error|exception|fatal/i.test(OE.message??"")}))}catch{}let s=Math.max(1,...m);$.push({key:B.mode,name:B.name,version:B.version,memory:rE,timeout:g?.Configuration?.Timeout??0,runtime:g?.Configuration?.Runtime??"provided.al2023",invocations:Math.round(y),errors:Math.round(Y),p95:v||Math.round(V),status:"active",provisioned:B.provisioned?`${B.provisioned.allocated}/${B.provisioned.requested}`:void 0}),I.push({key:B.mode,name:B.name,runtime:g?.Configuration?.Runtime??"provided.al2023",arch:g?.Configuration?.Architectures?.[0]??"x86_64",memory:rE,timeout:g?.Configuration?.Timeout??0,ephemeral:g?.Configuration?.EphemeralStorage?.Size??512,version:B.version,concurrency:S?.concurrency??"—",invocations:Math.round(y),errors:Math.round(Y),throttles:Math.round(M),p50:k||Math.round(V),p95:v||Math.round(V),p99:EE||Math.round(V),maxMem:x,spark:m.length?m.map((TE)=>Math.round(TE/s*100)):[0],env:LE.length?LE:["(none)"],recent:P.length?P:[{ts:"—",msg:"no recent events",err:!1}]})}A.functions=$,A.functionsDetail=I,A.serverlessLogs=C.sort((B,y)=>String(y.timestamp).localeCompare(String(B.timestamp))).slice(0,600),A.serverlessLogsEmptyReason=C.length?void 0:"No recent function logs were found in CloudWatch for this environment.";let e=L?Number((O/L*100).toFixed(2)):0,z=Math.round(await $O(d,T.functions[0]?.name??"","ConcurrentExecutions","Maximum",N,h));A.metrics={invocations:Math.round(L),errorRatePct:e,p95Ms:Math.round(c),coldStartPct:void 0,concurrency:z,estCostUsd:void 0};try{let B=new AT(r),y=[],Y=[],M=0;try{let{QueueUrl:g}=await B.getQueueUrl(`${T.slug}-${_}-dlq`),{Attributes:k}=await B.getQueueAttributes(g);M=Number(k.ApproximateNumberOfMessages??0)}catch{}let V=S?fh(S,T.slug,_):[];for(let g of V){let k=g.name.replace(`${T.slug}-${_}-`,""),v=0,EE=0;try{let{QueueUrl:rE}=await B.getQueueUrl(g.name),{Attributes:LE}=await B.getQueueAttributes(rE);v=Number(LE.ApproximateNumberOfMessages??0),EE=Number(LE.ApproximateNumberOfMessagesNotVisible??0)}catch{}let m=Math.round(await DO(d,"AWS/SQS","NumberOfMessagesDeleted",[{Name:"QueueName",Value:g.name}],"Sum",N,h));y.push({name:k,visible:v,inFlight:EE,processed:m,dlq:M}),Y.push({name:g.name,short:k,visible:v,inFlight:EE,delayed:0,processed:m,oldestSec:0,concurrency:g.concurrency??S?.queueConcurrency??"—",tries:S?.queueTries??3,visTimeout:(S?.queueTimeout??120)*6,dlq:M})}if(y.length)A.queues=y;if(Y.length)A.queuesDetail=Y;A.dlqItems=[]}catch{}try{let B=new oE(r),{Stacks:y}=await B.describeStacks({stackName:Xt(E,_)}),Y={};for(let M of y?.[0]?.Outputs??[])if(M.OutputKey)Y[M.OutputKey]=M.OutputValue??"";if(S?.database?.connection==="aurora-serverless"){let M=`${T.slug}-${_}-db`,V=[{Name:"DBClusterIdentifier",Value:M}],[g,k]=await Promise.all([DO(d,"AWS/RDS","ServerlessDatabaseCapacity",V,"Average",N,h),DO(d,"AWS/RDS","DatabaseConnections",V,"Maximum",N,h)]);if(A.aurora={id:M,engine:"aurora-mysql",minAcu:S?.database?.minCapacity??0.5,maxAcu:S?.database?.maxCapacity??4,currentAcu:g?Number(g.toFixed(1)):S?.database?.minCapacity??0.5,database:"app",connections:Math.round(k),status:Y.DbEndpoint?"available":"creating"},S?.rdsProxy)A.proxy={name:`${T.slug}-${_}-proxy`,endpoint:Y.DbProxyEndpoint??"—",pooledConns:Math.round(k),status:"available"}}if(S?.cache?.driver==="elasticache"){let M=`${T.slug}-${_}-cache`,V=[{Name:"CacheClusterId",Value:`${M}-001`}],[g,k]=await Promise.all([DO(d,"AWS/ElastiCache","CacheHits",V,"Sum",N,h),DO(d,"AWS/ElastiCache","CacheMisses",V,"Sum",N,h)]),v=g+k>0?Number((g/(g+k)*100).toFixed(1)):0;A.redis={id:M,node:"cache.t4g.micro",engine:"redis",hitRate:v,status:Y.CacheEndpoint?"available":"creating"}}if(S?.efs){let M=0;try{if(Y.EfsFileSystemId){let V=new SD(r),{FileSystems:g}=await V.describeFileSystems({FileSystemId:Y.EfsFileSystemId});M=Number(((g?.[0]?.SizeInBytes?.Value??0)/1048576).toFixed(1))}}catch{}A.efs={id:Y.EfsFileSystemId??"efs",mount:"/mnt/local",sizeMb:M,status:"available"}}A.assetsInfo=Y.AssetsCdnDomain?{bucket:Y.AssetsBucketName??`${T.slug}-${_}-assets`,cdn:Y.AssetsCdnDomain,customDomain:S?.assetDomain??"—",assetUrl:T.assetUrl??"—",files:0,sizeMb:0,cacheHitPct:0,build:A.app.build}:void 0}catch{}if(A.assetsInfo)try{let y=await new xE(r).list({bucket:A.assetsInfo.bucket,maxKeys:1000});A.assetsInfo.files=y.length,A.assetsInfo.sizeMb=Number((y.reduce((Y,M)=>Y+(M.Size??0),0)/1048576).toFixed(1)),A.assetsRecent=y.slice(0,8).map((Y)=>({path:`/${Y.Key}`,size:`${Math.max(1,Math.round((Y.Size??0)/1024))} KB`,type:Y.Key.split(".").pop()??""}))}catch{}try{if(S?.secrets){let B=Array.isArray(S.secrets)?S.secrets.map((y)=>({key:y.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),source:y})):Object.entries(S.secrets).map(([y,Y])=>({key:y,source:String(Y)}));A.secretsList=B.map((y)=>({...y,updated:"—"}))}}catch{}try{let B=new xE(r),y=`${T.slug}-${_}-deployments`,Y=await B.getObjectJson(y,`deployments/${T.slug}/${_}/history.json`).catch(()=>null);if(Y?.records?.length)A.deploymentsDetail=Y.records.slice(-12).reverse().map((M)=>({sha:(M.sha??"").slice(0,7),status:M.status??"success",when:M.timestamp??"—",took:M.took??"—",by:M.by??"—",version:M.version??"—",hooks:M.hooks??[]}))}catch{}A.metricsTotals={invocations:A.metrics.invocations,errors:Math.round(O),errorRatePct:e,p95Ms:A.metrics.p95Ms,throttles:I.reduce((B,y)=>B+y.throttles,0),coldStartPct:void 0,estCostUsd:void 0,concurrency:z},A.metricsPerFn=I.map((B)=>({key:B.key,invocations:B.invocations,errors:B.errors,throttles:B.throttles,avgMs:B.p50,maxMs:B.p99,costUsd:void 0}));try{A.invSpark=await d.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:T.functions.find((B)=>B.mode==="http")?.name??""}],StartTime:new Date(h.getTime()-86400000),EndTime:h,Period:3600,Stat:"Sum"})}catch{}try{let B=new rt,y=h,Y=new Date(Date.UTC(y.getUTCFullYear(),y.getUTCMonth(),1)),M=new Date(Date.UTC(y.getUTCFullYear(),y.getUTCMonth()-1,1)),[V,g]=await Promise.all([B.getCostByService({start:zA(Y),end:zA(y),granularity:"MONTHLY"}).catch(()=>[]),B.getCostByService({start:zA(M),end:zA(Y),granularity:"MONTHLY"}).catch(()=>[])]);if(V.length){let k=V.reduce((x,s)=>x+s.amount,0),v=g.reduce((x,s)=>x+s.amount,0),EE=y.getUTCDate(),m=new Date(Date.UTC(y.getUTCFullYear(),y.getUTCMonth()+1,0)).getUTCDate();A.costSummary={monthToDateUsd:Number(k.toFixed(2)),projectedUsd:Number((k/EE*m).toFixed(2)),lastMonthUsd:Number(v.toFixed(2)),dailyAvgUsd:Number((k/EE).toFixed(2))},A.costServices=V.filter((x)=>x.amount>0).sort((x,s)=>s.amount-x.amount).slice(0,12).map((x)=>({name:x.service,usd:Number(x.amount.toFixed(2)),note:""})),A.metrics.estCostUsd=Number((k/EE).toFixed(2)),A.metricsTotals.estCostUsd=A.metrics.estCostUsd,A.costTrend=await B.getDailyTotals({start:zA(Y),end:zA(y)}).catch(()=>[]);let rE=V.find((x)=>/lambda/i.test(x.service))?.amount??0,LE=(x)=>x.invocations*(x.p50/1000)*(x.memory/1024),P=I.reduce((x,s)=>x+LE(s),0)||1;A.costPerFn=I.map((x)=>({key:x.key,requests:x.invocations,gbSec:Math.round(LE(x)),usd:Number((rE*(LE(x)/P)).toFixed(2))}))}}catch{}if(S?.firewall)try{let B=await d.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"BlockedRequests",StartTime:N,EndTime:h,Period:86400,Statistics:["Sum"]}).catch(()=>[]),y=await d.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"AllowedRequests",StartTime:N,EndTime:h,Period:86400,Statistics:["Sum"]}).catch(()=>[]);A.waf={enabled:!0,scope:"REGIONAL",acl:`${T.slug}-${_}-waf`,allowed24h:Math.round(y.reduce((Y,M)=>Y+(M.Sum??0),0)),blocked24h:Math.round(B.reduce((Y,M)=>Y+(M.Sum??0),0))};try{let Y=new MJ(r),M=await Y.listWebACLs("REGIONAL"),V=M.find((g)=>g.Name?.includes(`${T.slug}-${_}`))??M[0];if(V?.Name&&V.Id){A.waf.acl=V.Name;let g=await Y.getWebACLRules(V.Name,V.Id,"REGIONAL");if(g.length)A.wafRules=g.map((k)=>({name:k.Name??"—",detail:`priority ${k.Priority??0}`,action:k.Action??"count",blocked24h:0}))}}catch{}}catch{}let F=[];if(A.aurora)F.push({name:"Aurora Serverless v2",detail:`${A.aurora.id} · ${A.aurora.minAcu}-${A.aurora.maxAcu} ACU`,status:A.aurora.status});if(A.proxy)F.push({name:"RDS Proxy",detail:A.proxy.name,status:A.proxy.status});if(A.redis)F.push({name:`ElastiCache (${A.redis.engine})`,detail:`${A.redis.node} · ${A.redis.hitRate}% hit rate`,status:A.redis.status});if(A.efs)F.push({name:"EFS",detail:`${A.efs.mount} · ${A.efs.sizeMb} MB`,status:A.efs.status});if(F.length)A.dataServices=F;if(T.scheduler!=="off"&&S?.kind==="php")try{let B=await it(E,_,"schedule:list"),y=[];for(let Y of(B||"").split(`
+`)){let M=/^\s*([\d*/,\-\s]+?)\s{2,}(.+?)(?:\s{2,}Next Due.*)?$/.exec(Y);if(M&&/[*\d]/.test(M[1])&&M[1].trim().split(/\s+/).length===5)y.push({command:M[2].trim().replace(/^php artisan /,""),cron:M[1].trim(),desc:"",lastRun:"—",lastStatus:"ok"})}if(y.length)A.schedulerTasks=y}catch{}return A}var IO=CE(async()=>{KT();vS();sR();f0();GJ();Gr();z_();JA();I9();await bd([aE(),TT()])});import{createHash as Xi}from"node:crypto";function X9(E){let _=KJ(E.name),T=VJ(E.publicKey),r=zi([...E.existingKeys??[],{name:_,publicKey:T}]);return z9(E.configText,r)}function J9(E){let _=KJ(E.name),T=(E.existingKeys??[]).filter((r)=>r.name!==_);if((E.existingKeys??[]).length===T.length)throw Error(`SSH key '${_}' does not exist in compute.sshKeys`);return z9(E.configText,T)}function ch(E=[]){return E.map((_)=>({name:_.name,publicKey:_.publicKey,type:Fi(_.publicKey),fingerprint:ji(_.publicKey),added:"configured"}))}function z9(E,_){let T=Bi(E,"compute"),r=Ji(_),d=Wi(E,T.start,T.end,"sshKeys");if(d){let N=d.propertyStart;while(N>0&&E[N-1]!==`
 `&&/\s/.test(E[N-1]))N--;return`${E.slice(0,N)}${r}${E.slice(d.end+1)}`}let t=E.slice(0,T.end).trimEnd(),R=E.slice(T.end),h=t.endsWith(",")||t.endsWith("{")?"":",";return`${t}${h}
 ${r},
     ${R}`}function Ji(E){if(E.length===0)return"      sshKeys: []";return`      sshKeys: [
-${E.map((T)=>["        {",`          name: '${eQ(T.name)}',`,`          publicKey: '${eQ(VJ(T.publicKey))}',`,"        },"].join(`
+${E.map((T)=>["        {",`          name: '${e9(T.name)}',`,`          publicKey: '${e9(VJ(T.publicKey))}',`,"        },"].join(`
 `)).join(`
 `)}
-      ]`}function zi(E){let _=new Map;for(let T of E){let r=KJ(T.name);if(_.has(r))throw Error(`SSH key '${r}' already exists in compute.sshKeys`);_.set(r,{name:r,publicKey:VJ(T.publicKey)})}return[..._.values()]}function KJ(E){let _=E.trim();if(!/^[\w@.+-]{2,80}$/.test(_))throw Error("SSH key name must be 2-80 characters and use letters, numbers, @, ., +, _, or -.");return _}function VJ(E){let _=E.trim().replace(/\s+/g," "),[T,r]=_.split(" ");if(!/^(?:ssh-(?:ed25519|rsa)|ecdsa-sha2-nistp(?:256|384|521))$/.test(T??"")||!r)throw Error("Public key must be an OpenSSH public key, e.g. ssh-ed25519 AAAA... name@host.");return _}function Fi(E){return E.trim().split(/\s+/)[0]||"ssh"}function ji(E){let _=E.trim().split(/\s+/)[1];if(!_)return"-";try{return`SHA256:${Xi("sha256").update(Buffer.from(_,"base64")).digest("base64").replace(/=+$/,"")}`}catch{return"-"}}function eQ(E){return E.replace(/\\/g,"\\\\").replaceAll(String.fromCharCode(39),"\\'")}function Bi(E,_){let T=new RegExp(`\\b${_}\\s*:\\s*{`,"g").exec(E);if(!T)throw Error(`Could not find ${_}: { ... } in cloud config.`);let r=E.indexOf("{",T.index);return{propertyStart:T.index,start:r,end:CO(E,r,"{","}")}}function Wi(E,_,T,r){let d=E.slice(_+1,T),t=new RegExp(`\\b${r}\\s*:\\s*\\[`,"g").exec(d);if(!t)return null;let R=_+1+t.index,h=E.indexOf("[",R);return{propertyStart:R,start:h,end:CO(E,h,"[","]")}}function CO(E,_,T,r){let d=0,t,R=!1,h=!1,N=!1;for(let S=_;S<E.length;S++){let A=E[S],L=E[S+1];if(h){if(A===`
-`)h=!1;continue}if(N){if(A==="*"&&L==="/")N=!1,S++;continue}if(t){if(R){R=!1;continue}if(A==="\\"){R=!0;continue}if(A===t)t=void 0;continue}if(A==="/"&&L==="/"){h=!0,S++;continue}if(A==="/"&&L==="*"){N=!0,S++;continue}if(A==='"'||A==="'"||A==="`"){t=A;continue}if(A===T)d++;if(A===r){if(d--,d===0)return S}}throw Error(`Could not find matching ${r} in cloud config.`)}var AD=()=>{};var kQ={};Z_(kQ,{sharedBoxProbeScript:()=>jQ,serverLogSources:()=>MQ,resolveServerDashboardData:()=>wO,resolveConfigOnlyServerDashboardData:()=>bQ,parseServerSecurity:()=>ZQ,parseServerLogs:()=>KQ,parseDeployHistory:()=>xQ,parseBlock:()=>WQ,metricsScript:()=>BQ,mergeDiscoveredSites:()=>YQ});import{existsSync as Hi,readFileSync as Pi}from"node:fs";import{join as yi}from"node:path";function jQ(E){let _=String.raw`
+      ]`}function zi(E){let _=new Map;for(let T of E){let r=KJ(T.name);if(_.has(r))throw Error(`SSH key '${r}' already exists in compute.sshKeys`);_.set(r,{name:r,publicKey:VJ(T.publicKey)})}return[..._.values()]}function KJ(E){let _=E.trim();if(!/^[\w@.+-]{2,80}$/.test(_))throw Error("SSH key name must be 2-80 characters and use letters, numbers, @, ., +, _, or -.");return _}function VJ(E){let _=E.trim().replace(/\s+/g," "),[T,r]=_.split(" ");if(!/^(?:ssh-(?:ed25519|rsa)|ecdsa-sha2-nistp(?:256|384|521))$/.test(T??"")||!r)throw Error("Public key must be an OpenSSH public key, e.g. ssh-ed25519 AAAA... name@host.");return _}function Fi(E){return E.trim().split(/\s+/)[0]||"ssh"}function ji(E){let _=E.trim().split(/\s+/)[1];if(!_)return"-";try{return`SHA256:${Xi("sha256").update(Buffer.from(_,"base64")).digest("base64").replace(/=+$/,"")}`}catch{return"-"}}function e9(E){return E.replace(/\\/g,"\\\\").replaceAll(String.fromCharCode(39),"\\'")}function Bi(E,_){let T=new RegExp(`\\b${_}\\s*:\\s*{`,"g").exec(E);if(!T)throw Error(`Could not find ${_}: { ... } in cloud config.`);let r=E.indexOf("{",T.index);return{propertyStart:T.index,start:r,end:CO(E,r,"{","}")}}function Wi(E,_,T,r){let d=E.slice(_+1,T),t=new RegExp(`\\b${r}\\s*:\\s*\\[`,"g").exec(d);if(!t)return null;let R=_+1+t.index,h=E.indexOf("[",R);return{propertyStart:R,start:h,end:CO(E,h,"[","]")}}function CO(E,_,T,r){let d=0,t,R=!1,h=!1,N=!1;for(let S=_;S<E.length;S++){let A=E[S],L=E[S+1];if(h){if(A===`
+`)h=!1;continue}if(N){if(A==="*"&&L==="/")N=!1,S++;continue}if(t){if(R){R=!1;continue}if(A==="\\"){R=!0;continue}if(A===t)t=void 0;continue}if(A==="/"&&L==="/"){h=!0,S++;continue}if(A==="/"&&L==="*"){N=!0,S++;continue}if(A==='"'||A==="'"||A==="`"){t=A;continue}if(A===T)d++;if(A===r){if(d--,d===0)return S}}throw Error(`Could not find matching ${r} in cloud config.`)}var AD=()=>{};var k9={};Z_(k9,{sharedBoxProbeScript:()=>j9,serverLogSources:()=>M9,resolveServerDashboardData:()=>wO,resolveConfigOnlyServerDashboardData:()=>b9,parseServerSecurity:()=>Z9,parseServerLogs:()=>K9,parseDeployHistory:()=>x9,parseBlock:()=>W9,metricsScript:()=>B9,mergeDiscoveredSites:()=>Y9});import{existsSync as Hi,readFileSync as Pi}from"node:fs";import{join as yi}from"node:path";function j9(E){let _=String.raw`
 import { X509Certificate } from 'node:crypto'
 import { existsSync, readdirSync, readFileSync, readlinkSync, statSync } from 'node:fs'
 import { basename, join } from 'node:path'
@@ -9259,7 +9259,7 @@ if (runningUnits.length > 0) {
     ].join('='))
   }
 }
-`;return`echo '${Buffer.from(_).toString("base64")}' | base64 -d | bun -`}function BQ(E={}){let _=["set +e",'echo "CPUS=$(nproc 2>/dev/null || echo 1)"',`read TS_TOTAL_1 TS_IDLE_1 <<EOF
+`;return`echo '${Buffer.from(_).toString("base64")}' | base64 -d | bun -`}function B9(E={}){let _=["set +e",'echo "CPUS=$(nproc 2>/dev/null || echo 1)"',`read TS_TOTAL_1 TS_IDLE_1 <<EOF
 $(awk '/^cpu /{idle=$5+$6; total=0; for(i=2;i<=NF;i++) total+=$i; print total, idle; exit}' /proc/stat 2>/dev/null)
 EOF`,"sleep 0.2",`read TS_TOTAL_2 TS_IDLE_2 <<EOF
 $(awk '/^cpu /{idle=$5+$6; total=0; for(i=2;i<=NF;i++) total+=$i; print total, idle; exit}' /proc/stat 2>/dev/null)
@@ -9267,11 +9267,11 @@ EOF`,`echo "CPUUSED=$(awk -v t1="$TS_TOTAL_1" -v i1="$TS_IDLE_1" -v t2="$TS_TOTA
 $(free -m 2>/dev/null | awk '/^Mem:/{total=$2; used=$3; available=$7; cache=$6} /^Swap:/{print total, used, available, cache, $2, $3}')
 EOF`,'echo "MEMTOTAL=${MEMTOTAL:-0}"','echo "MEMUSED=${MEMUSED:-0}"','echo "MEMAVAILABLE=${MEMAVAILABLE:-0}"','echo "MEMCACHE=${MEMCACHE:-0}"','echo "SWAPTOTAL=${SWAPTOTAL:-0}"','echo "SWAPUSED=${SWAPUSED:-0}"',`read DISKTOTG DISKUSEDG DISKPCT <<EOF
 $(df -BG -P / 2>/dev/null | awk 'NR==2{gsub("G","",$2); gsub("G","",$3); gsub("%","",$5); print $2, $3, $5}')
-EOF`,'echo "DISKPCT=${DISKPCT:-0}"','echo "DISKUSEDG=${DISKUSEDG:-0}"','echo "DISKTOTG=${DISKTOTG:-0}"',`echo "INODEPCT=$(df -Pi / 2>/dev/null | awk 'NR==2{gsub("%","",$5);print $5}')"`,`echo "NETRX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$3} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,`echo "NETTX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$11} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,`echo "PROCESSES=$(ps -e --no-headers 2>/dev/null | awk 'END{print NR+0}')"`,`echo "UPTIME=$(uptime -p 2>/dev/null | sed 's/^up //' || echo unknown)"`,`echo "UPTIME_SECONDS=$(cut -d' ' -f1 /proc/uptime 2>/dev/null || echo 0)"`,'echo "OS=$(. /etc/os-release 2>/dev/null; echo "$PRETTY_NAME")"'];if(E.includeServices!==!1)_.push(`for s in ${Yi.join(" ")}; do st=$(systemctl is-active "$s" 2>/dev/null); if [ -n "$st" ] && [ "$st" != "inactive" ] && [ "$st" != "unknown" ]; then mem=$(systemctl show "$s" -p MemoryCurrent --value 2>/dev/null); en=$(systemctl is-enabled "$s" 2>/dev/null); since=$(systemctl show "$s" -p ActiveEnterTimestamp --value 2>/dev/null); echo "SVC=$s=$st=$mem=$en=$since"; fi; done`);if(E.includeSites!==!1)_.push(jQ(E.projectFilter));return _.push("true"),_}function WQ(E){let _={services:[],discoveredSites:[]};for(let T of E.split(`
-`)){let r=T.trim();if(r.startsWith("DISCOVERED_SITE="))try{let d=JSON.parse(Buffer.from(r.slice(16),"base64").toString("utf8"));if(d?.domain&&d?.route)_.discoveredSites.push(d)}catch{}else if(r.startsWith("SVC=")){let[,d,t,R,h,N]=/^SVC=([^=]+)=([^=]+)(?:=([^=]*)(?:=([^=]*)(?:=(.*))?)?)?$/.exec(r)??[];if(d)_.services.push({name:d,status:t,memBytes:Number(R||0),enabled:h||aT,since:N||aT})}else{let d=r.indexOf("=");if(d>0)_[r.slice(0,d)]=r.slice(d+1)}}return _}function HQ(E){let _=E.infrastructure?.compute,T=[];if(_?.webServer==="rpx"||_?.proxy?.engine==="rpx")T.push({name:"rpx-gateway",status:"configured"});else if(_?.webServer==="nginx"||_?.webServer==null)T.push({name:"ts-cloud-nginx",status:"configured"});let r=_?.php?.versions??(_?.runtime==="php"?["8.3"]:[]);for(let R of r)T.push({name:`php${R}-fpm`,status:"configured"});let d=_?.managedServices??{},t=[["mysql","mysql"],["mariadb","mariadb"],["postgres","postgresql"],["redis","redis"],["memcached","memcached"],["meilisearch","meilisearch"]];for(let[R,h]of t)if(d[R])T.push({name:h,status:"configured"});return T}function Qi(E){let _=E.infrastructure?.compute?.backups,T=!!_?.enabled,r=_?.schedule??"0 2 * * *";return{enabled:T,schedule:r,destination:T?_?.bucket??"local":"off",retention:T?_?.retentionCount??5:0,last:T?"pending first run":"not configured",size:T?aT:"0 MB"}}function PQ(E){return E.infrastructure?.compute?.provider??E.cloud?.provider??E.provider??"aws"}function Gi(E){if(PQ(E)==="hetzner")return Ze(E);return E.project.region??"us-east-1"}function Mi(E,_){let T=yi(process.cwd(),"storage","cloud","state",`${E.project.slug}-${_}.json`);if(!Hi(T))return null;try{return JSON.parse(Pi(T,"utf8"))}catch{return null}}function fi(E){let _=E.sites??{},T=[];for(let[r,d]of Object.entries(_)){let t=d.queues??d.workers;if(Array.isArray(t)){for(let R of t)if(typeof R==="string")T.push({name:`${r}:${R}`,site:r,processes:1,status:"configured"});else if(R?.name)T.push({name:`${r}:${R.name}`,site:r,processes:R.processes??1,status:"configured"})}}return T}function yQ(E){if(!E||E==="")return"/";return E.startsWith("/")?E:`/${E}`}function Ki(E){let _=yQ(E.path);if(!E.domain)return{route:"internal"};return{route:_==="/"?E.domain:`${E.domain}${_}`,href:`https://${E.domain}${_==="/"?"":_}`}}function FQ(E,_){let T=n_(_);if(T==="redirect")return"redirect";let r=String(_.build??"").toLowerCase(),d=String(_.start??"").toLowerCase();if(E==="main"||d.includes("buddy/src/cli.ts serve"))return"stacks";if(E==="api"||d.includes("/serve/api"))return"api";if(r.includes("buildblog"))return"bunpress blog";if(r.includes("bunpress"))return"bunpress";if(r.includes("site:build")||r.includes("stx"))return"stx static";if(T==="server-static")return _.spa?"spa":"static";if(T==="server-app")return"app";if(T==="server-php")return _.type??"php";return"bucket"}function Vi(E){let _=n_(E);if(_==="redirect")return"—";let T=`${E.start??""} ${E.build??""}`.toLowerCase();if(_==="server-static")return T.includes("bunpress")||T.includes("bun ")||T.includes("bunx ")?"static/bun":"static";if(_==="server-app")return T.includes("bun")?"bun":"node";if(_==="server-php")return`php ${E.php??E.phpVersion??"8.3"}`;return"static"}function Zi(E){let _=n_(E);if(_==="redirect")return"redirect";if(_==="server-app")return"service";if(_==="server-static")return"server static";if(_==="server-php")return"php release";return"bucket"}function qi(E){let _=new Map;return Object.entries(E.sites??{}).map(([T,r])=>{let d=yQ(r.path),{route:t,href:R}=Ki(r),h=r.domain?`${r.domain}${d}`:"",N=h?_.get(h):void 0;if(h&&!N)_.set(h,T);return{name:T,route:t,href:R,domain:r.domain??"internal",path:d,kind:FQ(T,r),type:FQ(T,r),runtime:Vi(r),deploy:Zi(r),tls:r.domain?r.ssl===!1?"http":"https":"loopback",ssl:r.domain?r.ssl!==!1:!1,status:N?"shadowed":"live",shadowedBy:N,lastDeploy:aT}})}function YQ(E,_,T){let r=new Map(E.map((d)=>[String(d.route),{...d,project:T,managedBy:"owner"}]));for(let d of _){let t=r.get(d.route),R=t?.name??`${d.project}:${d.name}`;r.set(d.route,{...t,...d,name:R,kind:t?.kind??d.kind,type:t?.type??d.kind,runtime:t?.runtime??d.runtime,deploy:t?.deploy??d.deploy,root:t?.root??d.root,branch:t?.branch??d.branch,managedBy:d.project===T?"owner":"attached"})}return[...r.values()].sort((d,t)=>{if(d.managedBy!==t.managedBy)return d.managedBy==="owner"?-1:1;return String(d.route).localeCompare(String(t.route))})}function ZJ(E){return`'${E.replaceAll("'","'\\''")}'`}function QQ(E){return E.replace(/[\\&/]/g,"\\$&")}function gi(E,_){if(E.length===0)return["true"];return["set +e",...E.map((T)=>{let r=ZJ(`${Td(_,T)}/.ts-cloud/deploy-history.log`),d=QQ(T);return`TS_CLOUD_HISTORY=${r}; { [ -f "$TS_CLOUD_HISTORY" ] && tail -n 24 "$TS_CLOUD_HISTORY" | sed "s/^/DEPLOY=${d}\\t/"; } || true`}),"true"]}function GQ(E){return[...new Set(Object.values(E.sites??{}).map((_)=>_.domain).filter((_)=>typeof _==="string"&&_.length>0))]}function xi(E){return["set +e",'if command -v ss >/dev/null 2>&1; then ss -H -lntup 2>/dev/null | while read -r proto _state _recv _send local _peer rest; do [ -n "$proto" ] && [ -n "$local" ] && printf "PORT=%s\\t%s\\t%s\\n" "$proto" "$local" "$rest"; done; fi','if command -v ufw >/dev/null 2>&1; then ufw status numbered 2>/dev/null | sed "s/^/FIREWALL=/"; else echo "FIREWALL=ufw unavailable"; fi','journalctl _COMM=sshd --no-pager -n 30 -o short-iso 2>/dev/null | sed "s/^/AUTH=/" || true',...GQ(E).map((T)=>{return`TS_CLOUD_DOMAIN=${ZJ(T)}; TS_CLOUD_EXPIRY=$(echo | timeout 8 openssl s_client -servername "$TS_CLOUD_DOMAIN" -connect "$TS_CLOUD_DOMAIN:443" 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2-); [ -n "$TS_CLOUD_EXPIRY" ] && printf "CERT=%s\\t%s\\n" "$TS_CLOUD_DOMAIN" "$TS_CLOUD_EXPIRY" || printf "CERT=%s\\tunavailable\\n" "$TS_CLOUD_DOMAIN"`}),"true"]}function MQ(E){let _=new Map,T=(t,R)=>{if(t&&R&&!_.has(R))_.set(R,{pattern:t,label:R})},r=E.infrastructure?.compute,d=E.project.slug;if(r?.webServer==="rpx"||r?.proxy?.engine==="rpx")T("rpx-gateway","rpx-gateway");else T("nginx","nginx");for(let t of HQ(E))T(t.name,t.name);for(let[t,R]of Object.entries(E.sites??{})){if(n_(R)!=="server-app")continue;if(T(`${d}-${t}`,`${d}-${t}`),Array.isArray(R.queues??R.workers)&&(R.queues??R.workers).length)T(`${d}-${t}-queue-*`,`${d}-${t}-queues`);if(Array.isArray(R.daemons)&&R.daemons.length)T(`${d}-${t}-daemon-*`,`${d}-${t}-daemons`)}return[..._.values()]}function bi(E){let _=MQ(E);if(_.length===0)return["true"];return["set +e",..._.map((T)=>{let r=ZJ(T.pattern),d=QQ(T.label);return`journalctl -u ${r} --no-pager -n 150 -o short-iso 2>/dev/null | sed "s/^/LOG=${d}\\t/" || true`}),'[ -f /var/log/ts-cloud-backup.log ] && tail -n 60 /var/log/ts-cloud-backup.log 2>/dev/null | sed "s/^/LOG=backups\\t/" || true',"true"]}function qJ(E){let _=new Date(E);if(Number.isNaN(_.getTime()))return E||aT;let T=Math.max(0,Math.round((Date.now()-_.getTime())/1000));if(T<60)return`${T}s ago`;let r=Math.round(T/60);if(r<60)return`${r}m ago`;let d=Math.round(r/60);if(d<48)return`${d}h ago`;return`${Math.round(d/24)}d ago`}function fQ(E){if(/(?:error|failed|panic|fatal|exception|denied|unhealthy)/i.test(E))return"error";if(/(?:warn|warning|retry|restart|deprecated|timeout)/i.test(E))return"warn";return"info"}function KQ(E){let _=[];for(let T of E.split(`
-`)){let r=T.trim();if(!r.startsWith("LOG="))continue;let d=r.indexOf("\t");if(d<0)continue;let t=r.slice(4,d),R=r.slice(d+1),h=/^(\d{4}-\d{2}-\d{2}T[^\s]+)\s+(\S+)\s+(.*)$/.exec(R),N=h?.[1]??"",S=h?.[2]??"",A=(h?.[3]??R).trim();if(!A)continue;_.push({source:t,timestamp:N,when:N?qJ(N):aT,host:S,message:A,level:fQ(A)})}return _.sort((T,r)=>String(r.timestamp).localeCompare(String(T.timestamp))).slice(0,600)}function VQ(E){if(/^(?:127\.|localhost:|\[?::1\]?)/.test(E))return"loopback";if(/^(?:10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|169\.254\.|\[?f[cd][0-9a-f:])/i.test(E))return"private";return"public"}function ki(E){if(VQ(E)!=="public")return"ok";if(/:(?:22|80|443)$/.test(E)||/^\*:(?:22|80|443)$/.test(E))return"ok";return"warn"}function ui(E){if(E==null)return"warn";if(E<8)return"bad";if(E<30)return"warn";return"ok"}function ZQ(E){let _=[],T=[],r=[],d=[];for(let h of E.split(`
-`)){let N=h.trim();if(N.startsWith("PORT=")){let[S="",A="",L=""]=N.slice(5).split("\t");if(S&&A)_.push({proto:S,listen:A,processName:L||aT,exposure:VQ(A),tone:ki(A)})}else if(N.startsWith("FIREWALL=")){let S=N.slice(9).trim();if(S)T.push(S)}else if(N.startsWith("AUTH=")){let S=N.slice(5),A=/^(\d{4}-\d{2}-\d{2}T[^\s]+)\s+(\S+)\s+(.*)$/.exec(S),L=(A?.[3]??S).trim();if(L)r.push({timestamp:A?.[1]??"",when:A?.[1]?qJ(A[1]):aT,host:A?.[2]??"",message:L,level:fQ(L)})}else if(N.startsWith("CERT=")){let[S="",A=""]=N.slice(5).split("\t");if(!S)continue;let L=new Date(A),O=Number.isNaN(L.getTime())?null:Math.ceil((L.getTime()-Date.now())/86400000);d.push({domain:S,expires:Number.isNaN(L.getTime())?A||aT:L.toISOString().slice(0,10),daysRemaining:O,status:ui(O)})}}let t=T.some((h)=>/Status:\s*active/i.test(h)),R=T.some((h)=>/unavailable/i.test(h));return{ports:_.slice(0,80),firewall:{status:t?"active":R?"unavailable":"inactive",summary:t?"ufw active":R?"ufw unavailable":"ufw inactive or not configured",rules:T.filter((h)=>h&&!/^Status:/i.test(h)).slice(0,60)},tlsCertificates:d,authEvents:r.sort((h,N)=>String(N.timestamp).localeCompare(String(h.timestamp))).slice(0,30)}}function gJ(E){let T=E.infrastructure?.compute?.firewall??{},r=[...new Set([22,80,443,...T.allowedPorts??[]])],d=GQ(E);return{ports:r.map((t)=>({proto:"tcp",listen:`0.0.0.0:${t}`,processName:"configured firewall",exposure:"public",tone:[22,80,443].includes(Number(t))?"ok":"warn"})),firewall:{status:T.enabled===!1?"disabled":"configured",summary:T.enabled===!1?"host firewall disabled in config":"host firewall configured declaratively",rules:r.map((t)=>`ALLOW ${t}/tcp`)},tlsCertificates:d.map((t)=>({domain:t,expires:aT,daysRemaining:null,status:"warn"})),authEvents:[]}}function qQ(E,_){let T=_.security??gJ(E),r=!!_._serverReachable&&!_.metricsUnavailable,d=_.sites??[],t=d.filter((S)=>S.status==="shadowed"),R=(_.services??[]).filter((S)=>["failed","stopped"].includes(S.status)),h=(T.tlsCertificates??[]).filter((S)=>S.status!=="ok"),N=_.sshKeys??[];return[{name:"Live server probe",status:r?"pass":"warn",detail:r?"Metrics and remote checks are coming from the compute box.":"The dashboard is rendering config/state data until the box probe succeeds."},{name:"Managed services",status:R.length?"fail":"pass",detail:R.length?`${R.length} service(s) need attention.`:`${(_.services??[]).length} service(s) reported healthy or configured.`},{name:"Route conflicts",status:t.length?"warn":"pass",detail:t.length?`${t.map((S)=>S.name).join(", ")} is shadowed by an earlier route.`:`${d.length} site route(s) are unshadowed.`},{name:"SSH access",status:N.length?"pass":"warn",detail:N.length?`${N.length} declarative authorized key(s) configured.`:"No declarative SSH keys are configured."},{name:"Firewall",status:["active","configured"].includes(T.firewall?.status)?"pass":"warn",detail:T.firewall?.summary??"Firewall status unavailable."},{name:"TLS certificates",status:h.length?"warn":"pass",detail:h.length?`${h.length} certificate(s) need renewal visibility.`:`${(T.tlsCertificates??[]).length} certificate(s) look healthy.`}]}function gQ(E){let _=[];for(let T of E.serverDeploymentsDetail??E.serverDeployments??[])_.push({type:"deploy",tone:T.status==="failed"?"bad":"ok",title:`${T.site} deployed ${T.sha}`,detail:`${T.branch} · ${T.status}`,when:T.when,timestamp:T.timestamp});for(let T of E.serverLogs??[])if(T.level==="error"||T.level==="warn")_.push({type:"log",tone:T.level==="error"?"bad":"warn",title:`${T.source} ${T.level}`,detail:T.message,when:T.when,timestamp:T.timestamp});for(let T of E.sshKeys??[])_.push({type:"ssh",tone:"ok",title:`${T.name} authorized`,detail:T.fingerprint,when:T.added??aT,timestamp:""});return _.sort((T,r)=>String(r.timestamp).localeCompare(String(T.timestamp))).slice(0,80)}function xQ(E,_={}){let T=[];for(let r of E.split(`
-`)){let d=r.trim();if(!d.startsWith("DEPLOY="))continue;let t=d.split("\t"),R=t[0]?.replace(/^DEPLOY=/,"")??"",[h,N,S,A,L]=t.slice(1);if(!R||!h||!N)continue;let O=_[R]??{},c=n_(O),$=(S||N).slice(0,7);T.push({sha:$,release:N,commit:S||N,site:R,branch:O.branch??(c==="server-static"?"build artifact":"main"),status:A||"unknown",when:qJ(h),timestamp:h,took:"-",by:"ts-cloud",rc:L?.replace(/^rc=/,"")??"",steps:c==="server-static"?["upload artifact","publish static files"]:["upload artifact","restart service"]})}return T.sort((r,d)=>String(d.timestamp).localeCompare(String(r.timestamp)))}function bQ(E,_){let T=Mi(E,_),r=HQ(E),d=qi(E),t=Math.max(1,Number(E.infrastructure?.compute?.disk?.size??1)),R={server:{name:T?.serverName??`${E.project.slug}-${_}-app`,provider:T?.provider??PQ(E),region:Gi(E),ip:T?.publicIp??aT,os:"Linux",uptime:aT,probeStatus:"unavailable"},systemMetrics:{load:0,load5:0,load15:0,cpuUsedPct:0,cpus:Math.max(1,Number(E.infrastructure?.compute?.instances??1)),memUsedMb:0,memTotalMb:0,memAvailableMb:0,memCacheMb:0,swapUsedMb:0,swapTotalMb:0,diskUsedPct:0,diskUsedGb:0,diskTotalGb:t,inodeUsedPct:0,networkRxBytes:0,networkTxBytes:0,processes:0,uptimeSeconds:0},metricsUnavailable:!0,services:r,servicesDetail:r.map((h)=>({...h,since:aT,memMb:0,auto:!0})),backup:Qi(E),backupHistory:[],workers:fi(E),serverScheduler:{enabled:!1,lastRun:"not configured"},serverDeployments:[],serverDeploymentsDetail:[],deploymentsEmptyReason:"No deployment history has been recorded yet. Future server deploys will write /var/www/<site>/.ts-cloud/deploy-history.log.",serverLogs:[],serverLogsEmptyReason:"Live server logs are unavailable until the dashboard can reach the compute box.",security:gJ(E),securityEmptyReason:"Live security checks are unavailable until the dashboard can reach the compute box.",sites:d,sitesDetail:d.map((h)=>{let N=E.sites?.[h.name]??{},S=n_(N);return{...h,root:S==="server-static"?Td(E.project.slug,h.name):`${Td(E.project.slug,h.name)}/current`,branch:S==="server-static"?"build artifact":"main",build:N.build,php:N.php??N.phpVersion,aliases:Array.isArray(N.aliases)?N.aliases:[],redirects:N.redirects&&typeof N.redirects==="object"?N.redirects:{},envKeys:Object.keys(N.env??N.environment??{})}}),siteHealth:[],sshKeys:ch(E.infrastructure?.compute?.sshKeys??[]),_serverReachable:!1,_metricsStatus:"unavailable"};return R.diagnostics=qQ(E,R),R.activity=gQ(R),R}async function wO(E,_,T={}){if(!E.infrastructure?.compute)return null;let r=null;try{r=x_({config:E})}catch{r=null}let d=null,t=0,R=[];if(r)try{if(R=await r.findComputeTargets({slug:E.project.slug,environment:_,role:"app"}),t=R.length,R.length){let L=(await r.runRemoteDeploy({targets:[R[0]],commands:BQ({includeServices:!T.telemetryOnly,includeSites:T.includeSiteHealth!==!1,projectFilter:E.cloud?.attachTo?E.project.slug:void 0}),comment:`ts-cloud dashboard:build ${E.project.slug}`,tags:{Project:E.project.slug,Environment:_,Role:"app"}})).perInstance?.[0]?.output;if(L)d=WQ(L)}}catch{}let h=bQ(E,_),N=(A,L=0)=>{let O=Number(A);return Number.isFinite(O)?O:L};if(h.server.os=d?.OS||h.server.os,h.server.uptime=d?.UPTIME||h.server.uptime,d){if(h.server.probeStatus="live",h.metricsUnavailable=!1,h._metricsStatus="live",h.systemMetrics={load:N(d.LOAD),load5:N(d.LOAD5),load15:N(d.LOAD15),cpuUsedPct:N(d.CPUUSED),cpus:N(d.CPUS,1),memUsedMb:N(d.MEMUSED),memTotalMb:N(d.MEMTOTAL,1),memAvailableMb:N(d.MEMAVAILABLE),memCacheMb:N(d.MEMCACHE),swapUsedMb:N(d.SWAPUSED),swapTotalMb:N(d.SWAPTOTAL),diskUsedPct:N(d.DISKPCT),diskUsedGb:N(d.DISKUSEDG),diskTotalGb:N(d.DISKTOTG,1),inodeUsedPct:N(d.INODEPCT),networkRxBytes:N(d.NETRX),networkTxBytes:N(d.NETTX),processes:N(d.PROCESSES),uptimeSeconds:N(d.UPTIME_SECONDS)},d.services.length){let A=[...new Map(d.services.map((L)=>[L.name,L])).values()];h.services=A.map((L)=>({name:L.name,status:L.status==="active"?"running":L.status})),h.servicesDetail=A.map((L)=>({name:L.name,status:L.status==="active"?"running":L.status,since:L.since&&L.since!==aT?L.since:h.server.uptime,memMb:Math.max(0,Math.round(Number(L.memBytes??0)/1024/1024)),auto:L.enabled?!["disabled","static","masked"].includes(L.enabled):!0}))}if(d.discoveredSites.length)h.sitesDetail=YQ(h.sitesDetail,d.discoveredSites,E.project.slug),h.sites=h.sitesDetail.map((A)=>({name:A.name,project:A.project,managedBy:A.managedBy,route:A.route,href:A.href,domain:A.domain,path:A.path,kind:A.kind,type:A.type,runtime:A.runtime,deploy:A.deploy,tls:A.tls,status:A.status,httpStatus:A.httpStatus,responseMs:A.responseMs,tlsDaysRemaining:A.tlsDaysRemaining,checkedAt:A.checkedAt})),h.siteHealth=h.sitesDetail.map((A)=>({name:A.name,project:A.project,route:A.route,status:A.status,httpStatus:A.httpStatus,responseMs:A.responseMs,tlsDaysRemaining:A.tlsDaysRemaining,checkedAt:A.checkedAt}))}if(r&&R.length&&!T.telemetryOnly)await Promise.all([(async()=>{try{let A=Object.keys(E.sites??{}),O=(await r.runRemoteDeploy({targets:[R[0]],commands:gi(A,E.project.slug),comment:`ts-cloud dashboard:deploy-history ${E.project.slug}`,tags:{Project:E.project.slug,Environment:_,Role:"app"}})).perInstance?.[0]?.output??"",c=xQ(O,E.sites);h.serverDeployments=c.slice(0,5),h.serverDeploymentsDetail=c.slice(0,50),h.deploymentsEmptyReason=c.length?void 0:"No deployment history was found on the server yet. Deploy again to populate this timeline."}catch{h.deploymentsEmptyReason="Deployment history could not be read from the server."}})(),(async()=>{try{let L=(await r.runRemoteDeploy({targets:[R[0]],commands:bi(E),comment:`ts-cloud dashboard:server-logs ${E.project.slug}`,tags:{Project:E.project.slug,Environment:_,Role:"app"}})).perInstance?.[0]?.output??"",O=KQ(L);h.serverLogs=O,h.serverLogsEmptyReason=O.length?void 0:"No recent journal entries were found for the managed server units."}catch{h.serverLogsEmptyReason="Server logs could not be read from the box."}})(),(async()=>{try{let L=(await r.runRemoteDeploy({targets:[R[0]],commands:xi(E),comment:`ts-cloud dashboard:security ${E.project.slug}`,tags:{Project:E.project.slug,Environment:_,Role:"app"}})).perInstance?.[0]?.output??"",O=ZQ(L),c=gJ(E);if(!O.ports.length)O.ports=c.ports;if(!O.tlsCertificates.length)O.tlsCertificates=c.tlsCertificates;h.security=O,h.securityEmptyReason=void 0}catch{h.securityEmptyReason="Server security checks could not be read from the box."}})()]);else if(r&&t===0)h.deploymentsEmptyReason="No app server target was found for this environment.";let S=E.infrastructure?.compute?.sshKeys??E.infrastructure?.ssh?.keys??E.infrastructure?.sshKeys;if(Array.isArray(S)&&S.length)h.sshKeys=ch(S);return h._serverReachable=t>0&&!!d,h.diagnostics=qQ(E,h),h.activity=gQ(h),h}var Yi,aT="-";var LD=CE(async()=>{_0();AD();await bd([TR(),nR()]);Yi=["rpx-gateway","nginx","php8.3-fpm","php8.2-fpm","mysql","mariadb","postgresql","redis","redis-server","meilisearch"]});import{existsSync as pG}from"node:fs";import $1 from"node:fs/promises";import mF from"node:os";import D1 from"node:path";import Fh from"node:process";import{EventEmitter as oG}from"node:events";import eR from"node:process";import sF from"node:process";import e1 from"node:process";import mO from"node:process";import sA from"node:process";import Ej from"node:tty";import gM,{stdin as dEE,stdout as tEE}from"node:process";import Tj,{stdin as kM,stdout as uM}from"node:process";import vM from"node:readline";class dj{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let E=mF.homedir(),_=D1.join(E,".config","clapp");this.configPath=D1.join(_,"telemetry.json")}async isEnabled(){if(Fh.env.DO_NOT_TRACK==="1"||Fh.env.DO_NOT_TRACK==="true")return!1;if(Fh.env.NO_TELEMETRY==="1"||Fh.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let E=await this.loadConfig();if(E.enabled=!0,!E.userId)E.userId=this.generateUserId();await this.saveConfig(E)}async disable(){let E=await this.loadConfig();E.enabled=!1,await this.saveConfig(E)}async track(E,_){if(!await this.isEnabled())return;let r={event:E,..._,timestamp:Date.now(),platform:mF.platform(),nodeVersion:Fh.version};if(this.events.push(r),this.events.length>=10)await this.send()}async trackCommand(E,_){await this.track("command",{command:E,duration:_})}async trackError(E,_){await this.track("error",{error:E,command:_})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let _=await this.loadConfig();return _.lastSent=Date.now(),await this.saveConfig(_),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let _=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(_),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(E){return new Promise((_)=>setTimeout(_,E))}async status(){let E=await this.loadConfig();return{enabled:E.enabled,doNotTrack:Fh.env.DO_NOT_TRACK==="1"||Fh.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:E.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(pG(this.configPath)){let E=await $1.readFile(this.configPath,"utf-8");return this.config=JSON.parse(E),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(E){this.config=E;try{let _=D1.dirname(this.configPath);await $1.mkdir(_,{recursive:!0}),await $1.writeFile(this.configPath,JSON.stringify(E,null,2),"utf-8")}catch{}}generateUserId(){let E=Math.random().toString(36).substring(2,15),_=Date.now().toString(36);return`${E}-${_}`}}var no=new dj;function EM(E,_={}){let T={_:[]},r=_.alias||{},d=new Set(_.boolean||[]),t={};for(let h of Object.keys(r))for(let N of r[h])t[N]=h;for(let h of d)if(r[h])for(let N of r[h])d.add(N);function R(h,N){let S=t[h]||h;if(T[S]=N,r[S])for(let A of r[S])T[A]=N;if(t[h]&&r[t[h]])for(let A of r[t[h]])T[A]=N;T[h]=N}for(let h=0;h<E.length;h++){let N=E[h];if(N==="--"){T._.push(...E.slice(h+1));break}if(N.startsWith("--")){let S=N.indexOf("=");if(S!==-1){let A=N.slice(2,S),L=N.slice(S+1);R(A,L)}else{let A=N.slice(2);if(A.startsWith("no-")){let O=A.slice(3);R(O,!1);continue}let L=t[A]||A;if(d.has(L)||d.has(A))R(A,!0);else{let O=E[h+1];if(O!==void 0&&!O.startsWith("-"))R(A,O),h++;else R(A,!0)}}}else if(N.startsWith("-")&&N.length>1){let S=N.slice(1);for(let A=0;A<S.length;A++){let L=S[A],O=t[L]||L;if(A===S.length-1&&!d.has(O)&&!d.has(L)){let c=E[h+1];if(c!==void 0&&!c.startsWith("-"))R(L,c),h++;else R(L,!0)}else R(L,!0)}}else T._.push(N)}return T}function w1(E){return E.replace(/[<[].+/,"").trim()}function _M(E){let _=/<([^>]+)>/g,T=/\[([^\]]+)\]/g,r=[],d=(h)=>{let N=!1,S=h[1];if(S.startsWith("..."))S=S.slice(3),N=!0;return{required:h[0].startsWith("<"),value:S,variadic:N}},t;while(t=_.exec(E))r.push(d(t));let R;while(R=T.exec(E))r.push(d(R));return r}function TM(E){let _={alias:{},boolean:[]};for(let[T,r]of E.entries()){if(r.names.length>1)_.alias[r.names[0]]=r.names.slice(1);if(r.isBoolean)if(r.negated){if(!E.some((t,R)=>{return R!==T&&t.names.some((h)=>r.names.includes(h))&&typeof t.required==="boolean"}))_.boolean.push(r.names[0])}else _.boolean.push(r.names[0])}return _}function pF(E){return E.reduce((_,T)=>_.length>=T.length?_:T,"")}function I1(E,_){return E.length>=_?E:`${E}${" ".repeat(_-E.length)}`}function rM(E){return E.replace(/([a-z])-([a-z])/g,(_,T,r)=>{return T+r.toUpperCase()})}function dM(E,_,T){let r=0,d=_.length,t=E,R;for(;r<d;++r)R=t[_[r]],t=t[_[r]]=r===d-1?T:R!=null?R:!!~_[r+1].indexOf(".")||!(+_[r+1]>-1)?{}:[]}function tM(E,_){for(let T of Object.keys(_)){let r=_[T];if(r.shouldTransform){if(E[T]=Array.prototype.concat.call([],E[T]),typeof r.transformFunction==="function")E[T]=E[T].map(r.transformFunction)}}}function RM(E){let _=/([^\\/]+)$/.exec(E);return _?_[1]:""}function tj(E){return E.split(".").map((_,T)=>{return T===0?rM(_):_}).join(".")}class aO extends Error{exitCode=2;isUsageError=!0;constructor(E){super(E);if(this.name=this.constructor.name,typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(E).stack}format(E=!1){if(E&&this.stack)return`${this.message}
+EOF`,'echo "DISKPCT=${DISKPCT:-0}"','echo "DISKUSEDG=${DISKUSEDG:-0}"','echo "DISKTOTG=${DISKTOTG:-0}"',`echo "INODEPCT=$(df -Pi / 2>/dev/null | awk 'NR==2{gsub("%","",$5);print $5}')"`,`echo "NETRX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$3} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,`echo "NETTX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$11} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,`echo "PROCESSES=$(ps -e --no-headers 2>/dev/null | awk 'END{print NR+0}')"`,`echo "UPTIME=$(uptime -p 2>/dev/null | sed 's/^up //' || echo unknown)"`,`echo "UPTIME_SECONDS=$(cut -d' ' -f1 /proc/uptime 2>/dev/null || echo 0)"`,'echo "OS=$(. /etc/os-release 2>/dev/null; echo "$PRETTY_NAME")"'];if(E.includeServices!==!1)_.push(`for s in ${Yi.join(" ")}; do st=$(systemctl is-active "$s" 2>/dev/null); if [ -n "$st" ] && [ "$st" != "inactive" ] && [ "$st" != "unknown" ]; then mem=$(systemctl show "$s" -p MemoryCurrent --value 2>/dev/null); en=$(systemctl is-enabled "$s" 2>/dev/null); since=$(systemctl show "$s" -p ActiveEnterTimestamp --value 2>/dev/null); echo "SVC=$s=$st=$mem=$en=$since"; fi; done`);if(E.includeSites!==!1)_.push(j9(E.projectFilter));return _.push("true"),_}function W9(E){let _={services:[],discoveredSites:[]};for(let T of E.split(`
+`)){let r=T.trim();if(r.startsWith("DISCOVERED_SITE="))try{let d=JSON.parse(Buffer.from(r.slice(16),"base64").toString("utf8"));if(d?.domain&&d?.route)_.discoveredSites.push(d)}catch{}else if(r.startsWith("SVC=")){let[,d,t,R,h,N]=/^SVC=([^=]+)=([^=]+)(?:=([^=]*)(?:=([^=]*)(?:=(.*))?)?)?$/.exec(r)??[];if(d)_.services.push({name:d,status:t,memBytes:Number(R||0),enabled:h||aT,since:N||aT})}else{let d=r.indexOf("=");if(d>0)_[r.slice(0,d)]=r.slice(d+1)}}return _}function H9(E){let _=E.infrastructure?.compute,T=[];if(_?.webServer==="rpx"||_?.proxy?.engine==="rpx")T.push({name:"rpx-gateway",status:"configured"});else if(_?.webServer==="nginx"||_?.webServer==null)T.push({name:"ts-cloud-nginx",status:"configured"});let r=_?.php?.versions??(_?.runtime==="php"?["8.3"]:[]);for(let R of r)T.push({name:`php${R}-fpm`,status:"configured"});let d=_?.managedServices??{},t=[["mysql","mysql"],["mariadb","mariadb"],["postgres","postgresql"],["redis","redis"],["memcached","memcached"],["meilisearch","meilisearch"]];for(let[R,h]of t)if(d[R])T.push({name:h,status:"configured"});return T}function Qi(E){let _=E.infrastructure?.compute?.backups,T=!!_?.enabled,r=_?.schedule??"0 2 * * *";return{enabled:T,schedule:r,destination:T?_?.bucket??"local":"off",retention:T?_?.retentionCount??5:0,last:T?"pending first run":"not configured",size:T?aT:"0 MB"}}function P9(E){return E.infrastructure?.compute?.provider??E.cloud?.provider??E.provider??"aws"}function Gi(E){if(P9(E)==="hetzner")return Ze(E);return E.project.region??"us-east-1"}function Mi(E,_){let T=yi(process.cwd(),"storage","cloud","state",`${E.project.slug}-${_}.json`);if(!Hi(T))return null;try{return JSON.parse(Pi(T,"utf8"))}catch{return null}}function fi(E){let _=E.sites??{},T=[];for(let[r,d]of Object.entries(_)){let t=d.queues??d.workers;if(Array.isArray(t)){for(let R of t)if(typeof R==="string")T.push({name:`${r}:${R}`,site:r,processes:1,status:"configured"});else if(R?.name)T.push({name:`${r}:${R.name}`,site:r,processes:R.processes??1,status:"configured"})}}return T}function y9(E){if(!E||E==="")return"/";return E.startsWith("/")?E:`/${E}`}function Ki(E){let _=y9(E.path);if(!E.domain)return{route:"internal"};return{route:_==="/"?E.domain:`${E.domain}${_}`,href:`https://${E.domain}${_==="/"?"":_}`}}function F9(E,_){let T=n_(_);if(T==="redirect")return"redirect";let r=String(_.build??"").toLowerCase(),d=String(_.start??"").toLowerCase();if(E==="main"||d.includes("buddy/src/cli.ts serve"))return"stacks";if(E==="api"||d.includes("/serve/api"))return"api";if(r.includes("buildblog"))return"bunpress blog";if(r.includes("bunpress"))return"bunpress";if(r.includes("site:build")||r.includes("stx"))return"stx static";if(T==="server-static")return _.spa?"spa":"static";if(T==="server-app")return"app";if(T==="server-php")return _.type??"php";return"bucket"}function Vi(E){let _=n_(E);if(_==="redirect")return"—";let T=`${E.start??""} ${E.build??""}`.toLowerCase();if(_==="server-static")return T.includes("bunpress")||T.includes("bun ")||T.includes("bunx ")?"static/bun":"static";if(_==="server-app")return T.includes("bun")?"bun":"node";if(_==="server-php")return`php ${E.php??E.phpVersion??"8.3"}`;return"static"}function Zi(E){let _=n_(E);if(_==="redirect")return"redirect";if(_==="server-app")return"service";if(_==="server-static")return"server static";if(_==="server-php")return"php release";return"bucket"}function qi(E){let _=new Map;return Object.entries(E.sites??{}).map(([T,r])=>{let d=y9(r.path),{route:t,href:R}=Ki(r),h=r.domain?`${r.domain}${d}`:"",N=h?_.get(h):void 0;if(h&&!N)_.set(h,T);return{name:T,route:t,href:R,domain:r.domain??"internal",path:d,kind:F9(T,r),type:F9(T,r),runtime:Vi(r),deploy:Zi(r),tls:r.domain?r.ssl===!1?"http":"https":"loopback",ssl:r.domain?r.ssl!==!1:!1,status:N?"shadowed":"live",shadowedBy:N,lastDeploy:aT}})}function Y9(E,_,T){let r=new Map(E.map((d)=>[String(d.route),{...d,project:T,managedBy:"owner"}]));for(let d of _){let t=r.get(d.route),R=t?.name??`${d.project}:${d.name}`;r.set(d.route,{...t,...d,name:R,kind:t?.kind??d.kind,type:t?.type??d.kind,runtime:t?.runtime??d.runtime,deploy:t?.deploy??d.deploy,root:t?.root??d.root,branch:t?.branch??d.branch,managedBy:d.project===T?"owner":"attached"})}return[...r.values()].sort((d,t)=>{if(d.managedBy!==t.managedBy)return d.managedBy==="owner"?-1:1;return String(d.route).localeCompare(String(t.route))})}function ZJ(E){return`'${E.replaceAll("'","'\\''")}'`}function Q9(E){return E.replace(/[\\&/]/g,"\\$&")}function gi(E,_){if(E.length===0)return["true"];return["set +e",...E.map((T)=>{let r=ZJ(`${Td(_,T)}/.ts-cloud/deploy-history.log`),d=Q9(T);return`TS_CLOUD_HISTORY=${r}; { [ -f "$TS_CLOUD_HISTORY" ] && tail -n 24 "$TS_CLOUD_HISTORY" | sed "s/^/DEPLOY=${d}\\t/"; } || true`}),"true"]}function G9(E){return[...new Set(Object.values(E.sites??{}).map((_)=>_.domain).filter((_)=>typeof _==="string"&&_.length>0))]}function xi(E){return["set +e",'if command -v ss >/dev/null 2>&1; then ss -H -lntup 2>/dev/null | while read -r proto _state _recv _send local _peer rest; do [ -n "$proto" ] && [ -n "$local" ] && printf "PORT=%s\\t%s\\t%s\\n" "$proto" "$local" "$rest"; done; fi','if command -v ufw >/dev/null 2>&1; then ufw status numbered 2>/dev/null | sed "s/^/FIREWALL=/"; else echo "FIREWALL=ufw unavailable"; fi','journalctl _COMM=sshd --no-pager -n 30 -o short-iso 2>/dev/null | sed "s/^/AUTH=/" || true',...G9(E).map((T)=>{return`TS_CLOUD_DOMAIN=${ZJ(T)}; TS_CLOUD_EXPIRY=$(echo | timeout 8 openssl s_client -servername "$TS_CLOUD_DOMAIN" -connect "$TS_CLOUD_DOMAIN:443" 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2-); [ -n "$TS_CLOUD_EXPIRY" ] && printf "CERT=%s\\t%s\\n" "$TS_CLOUD_DOMAIN" "$TS_CLOUD_EXPIRY" || printf "CERT=%s\\tunavailable\\n" "$TS_CLOUD_DOMAIN"`}),"true"]}function M9(E){let _=new Map,T=(t,R)=>{if(t&&R&&!_.has(R))_.set(R,{pattern:t,label:R})},r=E.infrastructure?.compute,d=E.project.slug;if(r?.webServer==="rpx"||r?.proxy?.engine==="rpx")T("rpx-gateway","rpx-gateway");else T("nginx","nginx");for(let t of H9(E))T(t.name,t.name);for(let[t,R]of Object.entries(E.sites??{})){if(n_(R)!=="server-app")continue;if(T(`${d}-${t}`,`${d}-${t}`),Array.isArray(R.queues??R.workers)&&(R.queues??R.workers).length)T(`${d}-${t}-queue-*`,`${d}-${t}-queues`);if(Array.isArray(R.daemons)&&R.daemons.length)T(`${d}-${t}-daemon-*`,`${d}-${t}-daemons`)}return[..._.values()]}function bi(E){let _=M9(E);if(_.length===0)return["true"];return["set +e",..._.map((T)=>{let r=ZJ(T.pattern),d=Q9(T.label);return`journalctl -u ${r} --no-pager -n 150 -o short-iso 2>/dev/null | sed "s/^/LOG=${d}\\t/" || true`}),'[ -f /var/log/ts-cloud-backup.log ] && tail -n 60 /var/log/ts-cloud-backup.log 2>/dev/null | sed "s/^/LOG=backups\\t/" || true',"true"]}function qJ(E){let _=new Date(E);if(Number.isNaN(_.getTime()))return E||aT;let T=Math.max(0,Math.round((Date.now()-_.getTime())/1000));if(T<60)return`${T}s ago`;let r=Math.round(T/60);if(r<60)return`${r}m ago`;let d=Math.round(r/60);if(d<48)return`${d}h ago`;return`${Math.round(d/24)}d ago`}function f9(E){if(/(?:error|failed|panic|fatal|exception|denied|unhealthy)/i.test(E))return"error";if(/(?:warn|warning|retry|restart|deprecated|timeout)/i.test(E))return"warn";return"info"}function K9(E){let _=[];for(let T of E.split(`
+`)){let r=T.trim();if(!r.startsWith("LOG="))continue;let d=r.indexOf("\t");if(d<0)continue;let t=r.slice(4,d),R=r.slice(d+1),h=/^(\d{4}-\d{2}-\d{2}T[^\s]+)\s+(\S+)\s+(.*)$/.exec(R),N=h?.[1]??"",S=h?.[2]??"",A=(h?.[3]??R).trim();if(!A)continue;_.push({source:t,timestamp:N,when:N?qJ(N):aT,host:S,message:A,level:f9(A)})}return _.sort((T,r)=>String(r.timestamp).localeCompare(String(T.timestamp))).slice(0,600)}function V9(E){if(/^(?:127\.|localhost:|\[?::1\]?)/.test(E))return"loopback";if(/^(?:10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|169\.254\.|\[?f[cd][0-9a-f:])/i.test(E))return"private";return"public"}function ki(E){if(V9(E)!=="public")return"ok";if(/:(?:22|80|443)$/.test(E)||/^\*:(?:22|80|443)$/.test(E))return"ok";return"warn"}function ui(E){if(E==null)return"warn";if(E<8)return"bad";if(E<30)return"warn";return"ok"}function Z9(E){let _=[],T=[],r=[],d=[];for(let h of E.split(`
+`)){let N=h.trim();if(N.startsWith("PORT=")){let[S="",A="",L=""]=N.slice(5).split("\t");if(S&&A)_.push({proto:S,listen:A,processName:L||aT,exposure:V9(A),tone:ki(A)})}else if(N.startsWith("FIREWALL=")){let S=N.slice(9).trim();if(S)T.push(S)}else if(N.startsWith("AUTH=")){let S=N.slice(5),A=/^(\d{4}-\d{2}-\d{2}T[^\s]+)\s+(\S+)\s+(.*)$/.exec(S),L=(A?.[3]??S).trim();if(L)r.push({timestamp:A?.[1]??"",when:A?.[1]?qJ(A[1]):aT,host:A?.[2]??"",message:L,level:f9(L)})}else if(N.startsWith("CERT=")){let[S="",A=""]=N.slice(5).split("\t");if(!S)continue;let L=new Date(A),O=Number.isNaN(L.getTime())?null:Math.ceil((L.getTime()-Date.now())/86400000);d.push({domain:S,expires:Number.isNaN(L.getTime())?A||aT:L.toISOString().slice(0,10),daysRemaining:O,status:ui(O)})}}let t=T.some((h)=>/Status:\s*active/i.test(h)),R=T.some((h)=>/unavailable/i.test(h));return{ports:_.slice(0,80),firewall:{status:t?"active":R?"unavailable":"inactive",summary:t?"ufw active":R?"ufw unavailable":"ufw inactive or not configured",rules:T.filter((h)=>h&&!/^Status:/i.test(h)).slice(0,60)},tlsCertificates:d,authEvents:r.sort((h,N)=>String(N.timestamp).localeCompare(String(h.timestamp))).slice(0,30)}}function gJ(E){let T=E.infrastructure?.compute?.firewall??{},r=[...new Set([22,80,443,...T.allowedPorts??[]])],d=G9(E);return{ports:r.map((t)=>({proto:"tcp",listen:`0.0.0.0:${t}`,processName:"configured firewall",exposure:"public",tone:[22,80,443].includes(Number(t))?"ok":"warn"})),firewall:{status:T.enabled===!1?"disabled":"configured",summary:T.enabled===!1?"host firewall disabled in config":"host firewall configured declaratively",rules:r.map((t)=>`ALLOW ${t}/tcp`)},tlsCertificates:d.map((t)=>({domain:t,expires:aT,daysRemaining:null,status:"warn"})),authEvents:[]}}function q9(E,_){let T=_.security??gJ(E),r=!!_._serverReachable&&!_.metricsUnavailable,d=_.sites??[],t=d.filter((S)=>S.status==="shadowed"),R=(_.services??[]).filter((S)=>["failed","stopped"].includes(S.status)),h=(T.tlsCertificates??[]).filter((S)=>S.status!=="ok"),N=_.sshKeys??[];return[{name:"Live server probe",status:r?"pass":"warn",detail:r?"Metrics and remote checks are coming from the compute box.":"The dashboard is rendering config/state data until the box probe succeeds."},{name:"Managed services",status:R.length?"fail":"pass",detail:R.length?`${R.length} service(s) need attention.`:`${(_.services??[]).length} service(s) reported healthy or configured.`},{name:"Route conflicts",status:t.length?"warn":"pass",detail:t.length?`${t.map((S)=>S.name).join(", ")} is shadowed by an earlier route.`:`${d.length} site route(s) are unshadowed.`},{name:"SSH access",status:N.length?"pass":"warn",detail:N.length?`${N.length} declarative authorized key(s) configured.`:"No declarative SSH keys are configured."},{name:"Firewall",status:["active","configured"].includes(T.firewall?.status)?"pass":"warn",detail:T.firewall?.summary??"Firewall status unavailable."},{name:"TLS certificates",status:h.length?"warn":"pass",detail:h.length?`${h.length} certificate(s) need renewal visibility.`:`${(T.tlsCertificates??[]).length} certificate(s) look healthy.`}]}function g9(E){let _=[];for(let T of E.serverDeploymentsDetail??E.serverDeployments??[])_.push({type:"deploy",tone:T.status==="failed"?"bad":"ok",title:`${T.site} deployed ${T.sha}`,detail:`${T.branch} · ${T.status}`,when:T.when,timestamp:T.timestamp});for(let T of E.serverLogs??[])if(T.level==="error"||T.level==="warn")_.push({type:"log",tone:T.level==="error"?"bad":"warn",title:`${T.source} ${T.level}`,detail:T.message,when:T.when,timestamp:T.timestamp});for(let T of E.sshKeys??[])_.push({type:"ssh",tone:"ok",title:`${T.name} authorized`,detail:T.fingerprint,when:T.added??aT,timestamp:""});return _.sort((T,r)=>String(r.timestamp).localeCompare(String(T.timestamp))).slice(0,80)}function x9(E,_={}){let T=[];for(let r of E.split(`
+`)){let d=r.trim();if(!d.startsWith("DEPLOY="))continue;let t=d.split("\t"),R=t[0]?.replace(/^DEPLOY=/,"")??"",[h,N,S,A,L]=t.slice(1);if(!R||!h||!N)continue;let O=_[R]??{},c=n_(O),$=(S||N).slice(0,7);T.push({sha:$,release:N,commit:S||N,site:R,branch:O.branch??(c==="server-static"?"build artifact":"main"),status:A||"unknown",when:qJ(h),timestamp:h,took:"-",by:"ts-cloud",rc:L?.replace(/^rc=/,"")??"",steps:c==="server-static"?["upload artifact","publish static files"]:["upload artifact","restart service"]})}return T.sort((r,d)=>String(d.timestamp).localeCompare(String(r.timestamp)))}function b9(E,_){let T=Mi(E,_),r=H9(E),d=qi(E),t=Math.max(1,Number(E.infrastructure?.compute?.disk?.size??1)),R={server:{name:T?.serverName??`${E.project.slug}-${_}-app`,provider:T?.provider??P9(E),region:Gi(E),ip:T?.publicIp??aT,os:"Linux",uptime:aT,probeStatus:"unavailable"},systemMetrics:{load:0,load5:0,load15:0,cpuUsedPct:0,cpus:Math.max(1,Number(E.infrastructure?.compute?.instances??1)),memUsedMb:0,memTotalMb:0,memAvailableMb:0,memCacheMb:0,swapUsedMb:0,swapTotalMb:0,diskUsedPct:0,diskUsedGb:0,diskTotalGb:t,inodeUsedPct:0,networkRxBytes:0,networkTxBytes:0,processes:0,uptimeSeconds:0},metricsUnavailable:!0,services:r,servicesDetail:r.map((h)=>({...h,since:aT,memMb:0,auto:!0})),backup:Qi(E),backupHistory:[],workers:fi(E),serverScheduler:{enabled:!1,lastRun:"not configured"},serverDeployments:[],serverDeploymentsDetail:[],deploymentsEmptyReason:"No deployment history has been recorded yet. Future server deploys will write /var/www/<site>/.ts-cloud/deploy-history.log.",serverLogs:[],serverLogsEmptyReason:"Live server logs are unavailable until the dashboard can reach the compute box.",security:gJ(E),securityEmptyReason:"Live security checks are unavailable until the dashboard can reach the compute box.",sites:d,sitesDetail:d.map((h)=>{let N=E.sites?.[h.name]??{},S=n_(N);return{...h,root:S==="server-static"?Td(E.project.slug,h.name):`${Td(E.project.slug,h.name)}/current`,branch:S==="server-static"?"build artifact":"main",build:N.build,php:N.php??N.phpVersion,aliases:Array.isArray(N.aliases)?N.aliases:[],redirects:N.redirects&&typeof N.redirects==="object"?N.redirects:{},envKeys:Object.keys(N.env??N.environment??{})}}),siteHealth:[],sshKeys:ch(E.infrastructure?.compute?.sshKeys??[]),_serverReachable:!1,_metricsStatus:"unavailable"};return R.diagnostics=q9(E,R),R.activity=g9(R),R}async function wO(E,_,T={}){if(!E.infrastructure?.compute)return null;let r=null;try{r=x_({config:E})}catch{r=null}let d=null,t=0,R=[];if(r)try{if(R=await r.findComputeTargets({slug:E.project.slug,environment:_,role:"app"}),t=R.length,R.length){let L=(await r.runRemoteDeploy({targets:[R[0]],commands:B9({includeServices:!T.telemetryOnly,includeSites:T.includeSiteHealth!==!1,projectFilter:E.cloud?.attachTo?E.project.slug:void 0}),comment:`ts-cloud dashboard:build ${E.project.slug}`,tags:{Project:E.project.slug,Environment:_,Role:"app"}})).perInstance?.[0]?.output;if(L)d=W9(L)}}catch{}let h=b9(E,_),N=(A,L=0)=>{let O=Number(A);return Number.isFinite(O)?O:L};if(h.server.os=d?.OS||h.server.os,h.server.uptime=d?.UPTIME||h.server.uptime,d){if(h.server.probeStatus="live",h.metricsUnavailable=!1,h._metricsStatus="live",h.systemMetrics={load:N(d.LOAD),load5:N(d.LOAD5),load15:N(d.LOAD15),cpuUsedPct:N(d.CPUUSED),cpus:N(d.CPUS,1),memUsedMb:N(d.MEMUSED),memTotalMb:N(d.MEMTOTAL,1),memAvailableMb:N(d.MEMAVAILABLE),memCacheMb:N(d.MEMCACHE),swapUsedMb:N(d.SWAPUSED),swapTotalMb:N(d.SWAPTOTAL),diskUsedPct:N(d.DISKPCT),diskUsedGb:N(d.DISKUSEDG),diskTotalGb:N(d.DISKTOTG,1),inodeUsedPct:N(d.INODEPCT),networkRxBytes:N(d.NETRX),networkTxBytes:N(d.NETTX),processes:N(d.PROCESSES),uptimeSeconds:N(d.UPTIME_SECONDS)},d.services.length){let A=[...new Map(d.services.map((L)=>[L.name,L])).values()];h.services=A.map((L)=>({name:L.name,status:L.status==="active"?"running":L.status})),h.servicesDetail=A.map((L)=>({name:L.name,status:L.status==="active"?"running":L.status,since:L.since&&L.since!==aT?L.since:h.server.uptime,memMb:Math.max(0,Math.round(Number(L.memBytes??0)/1024/1024)),auto:L.enabled?!["disabled","static","masked"].includes(L.enabled):!0}))}if(d.discoveredSites.length)h.sitesDetail=Y9(h.sitesDetail,d.discoveredSites,E.project.slug),h.sites=h.sitesDetail.map((A)=>({name:A.name,project:A.project,managedBy:A.managedBy,route:A.route,href:A.href,domain:A.domain,path:A.path,kind:A.kind,type:A.type,runtime:A.runtime,deploy:A.deploy,tls:A.tls,status:A.status,httpStatus:A.httpStatus,responseMs:A.responseMs,tlsDaysRemaining:A.tlsDaysRemaining,checkedAt:A.checkedAt})),h.siteHealth=h.sitesDetail.map((A)=>({name:A.name,project:A.project,route:A.route,status:A.status,httpStatus:A.httpStatus,responseMs:A.responseMs,tlsDaysRemaining:A.tlsDaysRemaining,checkedAt:A.checkedAt}))}if(r&&R.length&&!T.telemetryOnly)await Promise.all([(async()=>{try{let A=Object.keys(E.sites??{}),O=(await r.runRemoteDeploy({targets:[R[0]],commands:gi(A,E.project.slug),comment:`ts-cloud dashboard:deploy-history ${E.project.slug}`,tags:{Project:E.project.slug,Environment:_,Role:"app"}})).perInstance?.[0]?.output??"",c=x9(O,E.sites);h.serverDeployments=c.slice(0,5),h.serverDeploymentsDetail=c.slice(0,50),h.deploymentsEmptyReason=c.length?void 0:"No deployment history was found on the server yet. Deploy again to populate this timeline."}catch{h.deploymentsEmptyReason="Deployment history could not be read from the server."}})(),(async()=>{try{let L=(await r.runRemoteDeploy({targets:[R[0]],commands:bi(E),comment:`ts-cloud dashboard:server-logs ${E.project.slug}`,tags:{Project:E.project.slug,Environment:_,Role:"app"}})).perInstance?.[0]?.output??"",O=K9(L);h.serverLogs=O,h.serverLogsEmptyReason=O.length?void 0:"No recent journal entries were found for the managed server units."}catch{h.serverLogsEmptyReason="Server logs could not be read from the box."}})(),(async()=>{try{let L=(await r.runRemoteDeploy({targets:[R[0]],commands:xi(E),comment:`ts-cloud dashboard:security ${E.project.slug}`,tags:{Project:E.project.slug,Environment:_,Role:"app"}})).perInstance?.[0]?.output??"",O=Z9(L),c=gJ(E);if(!O.ports.length)O.ports=c.ports;if(!O.tlsCertificates.length)O.tlsCertificates=c.tlsCertificates;h.security=O,h.securityEmptyReason=void 0}catch{h.securityEmptyReason="Server security checks could not be read from the box."}})()]);else if(r&&t===0)h.deploymentsEmptyReason="No app server target was found for this environment.";let S=E.infrastructure?.compute?.sshKeys??E.infrastructure?.ssh?.keys??E.infrastructure?.sshKeys;if(Array.isArray(S)&&S.length)h.sshKeys=ch(S);return h._serverReachable=t>0&&!!d,h.diagnostics=q9(E,h),h.activity=g9(h),h}var Yi,aT="-";var LD=CE(async()=>{_0();AD();await bd([TR(),nR()]);Yi=["rpx-gateway","nginx","php8.3-fpm","php8.2-fpm","mysql","mariadb","postgresql","redis","redis-server","meilisearch"]});import{existsSync as pG}from"node:fs";import $1 from"node:fs/promises";import mF from"node:os";import D1 from"node:path";import Fh from"node:process";import{EventEmitter as oG}from"node:events";import eR from"node:process";import sF from"node:process";import e1 from"node:process";import mO from"node:process";import sA from"node:process";import Ej from"node:tty";import gM,{stdin as dEE,stdout as tEE}from"node:process";import Tj,{stdin as kM,stdout as uM}from"node:process";import vM from"node:readline";class dj{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let E=mF.homedir(),_=D1.join(E,".config","clapp");this.configPath=D1.join(_,"telemetry.json")}async isEnabled(){if(Fh.env.DO_NOT_TRACK==="1"||Fh.env.DO_NOT_TRACK==="true")return!1;if(Fh.env.NO_TELEMETRY==="1"||Fh.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let E=await this.loadConfig();if(E.enabled=!0,!E.userId)E.userId=this.generateUserId();await this.saveConfig(E)}async disable(){let E=await this.loadConfig();E.enabled=!1,await this.saveConfig(E)}async track(E,_){if(!await this.isEnabled())return;let r={event:E,..._,timestamp:Date.now(),platform:mF.platform(),nodeVersion:Fh.version};if(this.events.push(r),this.events.length>=10)await this.send()}async trackCommand(E,_){await this.track("command",{command:E,duration:_})}async trackError(E,_){await this.track("error",{error:E,command:_})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let _=await this.loadConfig();return _.lastSent=Date.now(),await this.saveConfig(_),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let _=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(_),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(E){return new Promise((_)=>setTimeout(_,E))}async status(){let E=await this.loadConfig();return{enabled:E.enabled,doNotTrack:Fh.env.DO_NOT_TRACK==="1"||Fh.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:E.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(pG(this.configPath)){let E=await $1.readFile(this.configPath,"utf-8");return this.config=JSON.parse(E),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(E){this.config=E;try{let _=D1.dirname(this.configPath);await $1.mkdir(_,{recursive:!0}),await $1.writeFile(this.configPath,JSON.stringify(E,null,2),"utf-8")}catch{}}generateUserId(){let E=Math.random().toString(36).substring(2,15),_=Date.now().toString(36);return`${E}-${_}`}}var no=new dj;function EM(E,_={}){let T={_:[]},r=_.alias||{},d=new Set(_.boolean||[]),t={};for(let h of Object.keys(r))for(let N of r[h])t[N]=h;for(let h of d)if(r[h])for(let N of r[h])d.add(N);function R(h,N){let S=t[h]||h;if(T[S]=N,r[S])for(let A of r[S])T[A]=N;if(t[h]&&r[t[h]])for(let A of r[t[h]])T[A]=N;T[h]=N}for(let h=0;h<E.length;h++){let N=E[h];if(N==="--"){T._.push(...E.slice(h+1));break}if(N.startsWith("--")){let S=N.indexOf("=");if(S!==-1){let A=N.slice(2,S),L=N.slice(S+1);R(A,L)}else{let A=N.slice(2);if(A.startsWith("no-")){let O=A.slice(3);R(O,!1);continue}let L=t[A]||A;if(d.has(L)||d.has(A))R(A,!0);else{let O=E[h+1];if(O!==void 0&&!O.startsWith("-"))R(A,O),h++;else R(A,!0)}}}else if(N.startsWith("-")&&N.length>1){let S=N.slice(1);for(let A=0;A<S.length;A++){let L=S[A],O=t[L]||L;if(A===S.length-1&&!d.has(O)&&!d.has(L)){let c=E[h+1];if(c!==void 0&&!c.startsWith("-"))R(L,c),h++;else R(L,!0)}else R(L,!0)}}else T._.push(N)}return T}function w1(E){return E.replace(/[<[].+/,"").trim()}function _M(E){let _=/<([^>]+)>/g,T=/\[([^\]]+)\]/g,r=[],d=(h)=>{let N=!1,S=h[1];if(S.startsWith("..."))S=S.slice(3),N=!0;return{required:h[0].startsWith("<"),value:S,variadic:N}},t;while(t=_.exec(E))r.push(d(t));let R;while(R=T.exec(E))r.push(d(R));return r}function TM(E){let _={alias:{},boolean:[]};for(let[T,r]of E.entries()){if(r.names.length>1)_.alias[r.names[0]]=r.names.slice(1);if(r.isBoolean)if(r.negated){if(!E.some((t,R)=>{return R!==T&&t.names.some((h)=>r.names.includes(h))&&typeof t.required==="boolean"}))_.boolean.push(r.names[0])}else _.boolean.push(r.names[0])}return _}function pF(E){return E.reduce((_,T)=>_.length>=T.length?_:T,"")}function I1(E,_){return E.length>=_?E:`${E}${" ".repeat(_-E.length)}`}function rM(E){return E.replace(/([a-z])-([a-z])/g,(_,T,r)=>{return T+r.toUpperCase()})}function dM(E,_,T){let r=0,d=_.length,t=E,R;for(;r<d;++r)R=t[_[r]],t=t[_[r]]=r===d-1?T:R!=null?R:!!~_[r+1].indexOf(".")||!(+_[r+1]>-1)?{}:[]}function tM(E,_){for(let T of Object.keys(_)){let r=_[T];if(r.shouldTransform){if(E[T]=Array.prototype.concat.call([],E[T]),typeof r.transformFunction==="function")E[T]=E[T].map(r.transformFunction)}}}function RM(E){let _=/([^\\/]+)$/.exec(E);return _?_[1]:""}function tj(E){return E.split(".").map((_,T)=>{return T===0?rM(_):_}).join(".")}class aO extends Error{exitCode=2;isUsageError=!0;constructor(E){super(E);if(this.name=this.constructor.name,typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(E).stack}format(E=!1){if(E&&this.stack)return`${this.message}
 
 Stack trace:
 ${this.stack}`;return this.message}}function hM(){let{env:E}=sF,{TERM:_,TERM_PROGRAM:T}=E;if(sF.platform!=="win32")return _!=="linux";return Boolean(E.WT_SESSION)||Boolean(E.TERMINUS_SUBLIME)||E.ConEmuTask==="{cmd::Cmder}"||T==="Terminus-Sublime"||T==="vscode"||_==="xterm-256color"||_==="alacritty"||_==="rxvt-unicode"||_==="rxvt-unicode-256color"||E.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var oO="\x1B",k_=`${oO}[`;var It={to(E,_){if(!_)return`${k_}${E+1}G`;return`${k_}${_+1};${E+1}H`},move(E,_){let T="";if(E<0)T+=`${k_}${-E}D`;else if(E>0)T+=`${k_}${E}C`;if(_<0)T+=`${k_}${-_}A`;else if(_>0)T+=`${k_}${_}B`;return T},up:(E=1)=>`${k_}${E}A`,down:(E=1)=>`${k_}${E}B`,forward:(E=1)=>`${k_}${E}C`,backward:(E=1)=>`${k_}${E}D`,nextLine:(E=1)=>`${k_}E`.repeat(E),prevLine:(E=1)=>`${k_}F`.repeat(E),left:`${k_}G`,hide:`${k_}?25l`,show:`${k_}?25h`,save:`${oO}7`,restore:`${oO}8`};var C1={screen:`${k_}2J`,up:(E=1)=>`${k_}1J`.repeat(E),down:(E=1)=>`${k_}J`.repeat(E),line:`${k_}2K`,lineEnd:`${k_}K`,lineStart:`${k_}1K`,lines(E){let _="";for(let T=0;T<E;T++)_+=this.line+(T<E-1?It.up():"");if(E)_+=It.left;return _}},mo={screen:`${oO}c`};function NM(E,_){let T=[];for(let r=0;r<=_.length;r++)T[r]=[r];for(let r=0;r<=E.length;r++)T[0][r]=r;for(let r=1;r<=_.length;r++)for(let d=1;d<=E.length;d++)if(_.charAt(r-1)===E.charAt(d-1))T[r][d]=T[r-1][d-1];else T[r][d]=Math.min(T[r-1][d-1]+1,T[r][d-1]+1,T[r-1][d]+1);return T[_.length][E.length]}function Rj(E,_,T=2,r=3){return _.map((d)=>({cmd:d,distance:NM(E,d)})).filter(({distance:d})=>d<=T).sort((d,t)=>d.distance-t.distance).slice(0,r).map(({cmd:d})=>d)}class hj{rawName;description;name;names;isBoolean;required;config;negated;constructor(E,_,T){if(this.rawName=E,this.description=_,this.config=Object.assign({},T),E=E.replace(/\.\*/g,""),this.negated=!1,this.names=w1(E).split(",").map((r)=>{let d=r.trim().replace(/^-{1,2}/,"");if(d.startsWith("no-"))this.negated=!0,d=d.replace(/^no-/,"");return tj(d)}).sort((r,d)=>r.length>d.length?1:-1),this.name=this.names[this.names.length-1],this.negated&&this.config.default==null)this.config.default=!0;if(E.includes("<"))this.required=!0;else if(E.includes("["))this.required=!1;else this.isBoolean=!0}}var po=e1.argv,SM=`${e1.platform}-${e1.arch} bun-v${typeof Bun<"u"?Bun.version:"unknown"}`,oF=mO.argv,AM=`${mO.platform}-${mO.arch} node-${mO.version}`;class X1{rawName;description;config;cli;options;aliasNames;name;namespace;args;commandAction;usageText;versionNumber;examples;helpCallback;globalCommand;beforeHooks;afterHooks;middleware;constructor(E,_,T,r){this.rawName=E,this.description=_,this.config=T,this.cli=r,this.options=[],this.aliasNames=[],this.name=w1(E);let d=w1(E),t=d.indexOf(":");if(t>0)this.namespace=d.substring(0,t),this.name=d.substring(t+1);if(this.args=_M(E),this.examples=[],this.beforeHooks=[],this.afterHooks=[],this.middleware=[],!T)this.config={}}usage(E){return this.usageText=E,this}allowUnknownOptions(){return this.config.allowUnknownOptions=!0,this}ignoreOptionDefaultValue(){return this.config.ignoreOptionDefaultValue=!0,this}version(E,_="-v, --version"){return this.versionNumber=E,this.option(_,"Display version number"),this}example(E){return this.examples.push(E),this}option(E,_,T){let r=new hj(E,_,T);return this.options.push(r),this}alias(E){return this.aliasNames.push(E),this}action(E){return this.commandAction=E,this}before(E){return this.beforeHooks.push(E),this}after(E){return this.afterHooks.push(E),this}use(E){return this.middleware.push(E),this}isMatched(E){if(this.aliasNames.includes(E))return!0;if(this.namespace)return`${this.namespace}:${this.name}`===E;return this.name===E}get isDefaultCommand(){return this.name===""||this.aliasNames.includes("!")}get isGlobalCommand(){return this instanceof J1}get displayName(){return this.namespace?`${this.namespace}:${this.name}`:this.name}hasOption(E){return E=E.split(".")[0],!!this.options.find((_)=>{return _.names.includes(E)})}outputHelp(){let{name:E,commands:_}=this.cli,{versionNumber:T,options:r,helpCallback:d}=this.cli.globalCommand,t=[{body:`${E}${T?`/${T}`:""}`}];if(t.push({title:"Usage",body:`  $ ${E} ${this.usageText||this.rawName}`}),(this.isGlobalCommand||this.isDefaultCommand)&&_.length>0){let N=pF(_.map((c)=>c.rawName)),S=new Map,A=[];for(let c of _)if(c.namespace){if(!S.has(c.namespace))S.set(c.namespace,[]);S.get(c.namespace).push(c)}else A.push(c);let L="";if(A.length>0)L+=A.map((c)=>{return`  ${I1(c.rawName,N.length)}  ${c.description}`}).join(`
@@ -9309,7 +9309,7 @@ Run \`${this.name??"cli"} --help\` for usage.`;eR.stderr.write(`${t}${d}${R}
 `).length-1;this.output.write(It.move(-999,E*-1))}render(){let E=rj(this._render(this)??"",Tj.stdout.columns,{hard:!0,trim:!1});if(E===this._prevFrame)return;if(this.state==="initial")this.output.write(It.hide);else{let _=bM(this._prevFrame,E);if(this.restoreCursor(),_&&_?.length===1){let T=_[0];this.output.write(It.move(0,T)),this.output.write(C1.lines(1));let r=E.split(`
 `);this.output.write(r[T]),this._prevFrame=E,this.output.write(It.move(0,r.length-T-1));return}if(_&&_?.length>1){let T=_[0];this.output.write(It.move(0,T)),this.output.write(C1.down());let d=E.split(`
 `).slice(T);this.output.write(d.join(`
-`)),this._prevFrame=E;return}this.output.write(C1.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function iM(E,_){if(E===void 0)return 0;if(_.length===0)return 0;let r=_.findIndex((d)=>d.value===E);return r!==-1?r:0}function aM(E,_){return(_.label??String(_.value)).toLowerCase().includes(E.toLowerCase())}function mM(E,_){if(!_)return;if(E)return _;return _[0]}class sM extends F1{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#T="";#r;#_;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return sO.inverse(sO.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[_,...T]=this.userInput.slice(this._cursor);return`${E}${sO.inverse(_)}${T.join("")}`}get options(){if(typeof this.#_==="function")return this.#_();return this.#_}constructor(E){super(E);this.#_=E.options;let _=this.options;this.filteredOptions=[..._],this.multiple=E.multiple===!0,this.#r=E.filter??aM;let T;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)T=E.initialValue;else T=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)T=[this.options[0].value];if(T)for(let r of T){let d=_.findIndex((t)=>t.value===r);if(d!==-1)this.toggleSelected(r),this.#E=d}this.focusedValue=this.options[this.#E]?.value,this.on("key",(r,d)=>this.#d(r,d)),this.on("userInput",(r)=>this.#t(r))}_isActionKey(E,_){return E==="\t"||this.multiple&&this.isNavigating&&_.name==="space"&&E!==void 0&&E!==""}#d(E,_){let T=_.name==="up",r=_.name==="down",d=_.name==="return";if(T||r){if(this.#E=Math.max(0,Math.min(this.#E+(T?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(d)this.value=mM(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(_.name==="tab"||this.isNavigating&&_.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((_)=>_!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#t(E){if(E!==this.#T){this.#T=E;let _=this.options;if(E)this.filteredOptions=_.filter((T)=>this.#r(E,T));else this.filteredOptions=[..._];if(this.#E=iM(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class pM extends F1{options;cursor=0;#E;getGroupItems(E){return this.options.filter((_)=>_.group===E)}isGroupSelected(E){let _=this.getGroupItems(E),T=this.value;if(T===void 0)return!1;return _.every((r)=>T.includes(r.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let _=String(E.value),T=this.getGroupItems(_);if(this.isGroupSelected(_))this.value=this.value.filter((r)=>T.findIndex((d)=>d.value===r)===-1);else this.value=[...this.value,...T.map((r)=>r.value)];this.value=Array.from(new Set(this.value))}else{let _=this.value.includes(E.value);this.value=_?this.value.filter((T)=>T!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:_}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(_).flatMap(([T,r])=>[{value:T,group:!0,label:T},...r.map((d)=>({...d,group:T}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:T})=>T===E.cursorAt),this.#E?0:1),this.on("cursor",(T)=>{switch(T){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var oM=hM();var P_=(E,_)=>oM?E:_,SEE=P_("◆","*"),AEE=P_("■","x"),LEE=P_("▲","x"),OEE=P_("◇","o"),cEE=P_("┌","T"),E4=P_("│","|"),UEE=P_("└","—"),$EE=P_("●",">"),DEE=P_("○"," "),IEE=P_("◻","[•]"),CEE=P_("◼","[+]"),wEE=P_("◻","[ ]"),eEE=P_("▪","•"),XEE=P_("─","-"),JEE=P_("╮","+"),zEE=P_("├","+"),FEE=P_("╯","+"),jEE=P_("●","•"),BEE=P_("◆","*"),WEE=P_("▲","!"),HEE=P_("■","x");var PEE={light:P_("─","-"),heavy:P_("━","="),block:P_("█","#")};function _4(){return`${sO.gray(E4)}  `}var yEE=_4();var j1="0.7.98";fE();import{existsSync as M1}from"node:fs";import{mkdir as O4,writeFile as Xj}from"node:fs/promises";function f1(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(_)=>{if(b("Initializing ts-cloud Project"),M1("cloud.config.ts")){if(!await DE("cloud.config.ts already exists. Overwrite?",!1)){U("Initialization cancelled");return}}let T=_?.name||await O_("Project name","my-app"),r=_?.mode||await Ec("Select deployment mode",["serverless","server"]),d=_?.region||await Ec("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),t=new n("Creating configuration file...");t.start();let R=`import { defineConfig } from '@ts-cloud/core'
+`)),this._prevFrame=E;return}this.output.write(C1.down())}if(this.output.write(E),this.state==="initial")this.state="active";this._prevFrame=E}}function iM(E,_){if(E===void 0)return 0;if(_.length===0)return 0;let r=_.findIndex((d)=>d.value===E);return r!==-1?r:0}function aM(E,_){return(_.label??String(_.value)).toLowerCase().includes(E.toLowerCase())}function mM(E,_){if(!_)return;if(E)return _;return _[0]}class sM extends F1{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#E=0;#T="";#r;#_;get cursor(){return this.#E}get userInputWithCursor(){if(!this.userInput)return sO.inverse(sO.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let E=this.userInput.slice(0,this._cursor),[_,...T]=this.userInput.slice(this._cursor);return`${E}${sO.inverse(_)}${T.join("")}`}get options(){if(typeof this.#_==="function")return this.#_();return this.#_}constructor(E){super(E);this.#_=E.options;let _=this.options;this.filteredOptions=[..._],this.multiple=E.multiple===!0,this.#r=E.filter??aM;let T;if(E.initialValue&&Array.isArray(E.initialValue))if(this.multiple)T=E.initialValue;else T=E.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)T=[this.options[0].value];if(T)for(let r of T){let d=_.findIndex((t)=>t.value===r);if(d!==-1)this.toggleSelected(r),this.#E=d}this.focusedValue=this.options[this.#E]?.value,this.on("key",(r,d)=>this.#d(r,d)),this.on("userInput",(r)=>this.#t(r))}_isActionKey(E,_){return E==="\t"||this.multiple&&this.isNavigating&&_.name==="space"&&E!==void 0&&E!==""}#d(E,_){let T=_.name==="up",r=_.name==="down",d=_.name==="return";if(T||r){if(this.#E=Math.max(0,Math.min(this.#E+(T?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(d)this.value=mM(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&(_.name==="tab"||this.isNavigating&&_.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(E){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(E))this.selectedValues=this.selectedValues.filter((_)=>_!==E);else this.selectedValues=[...this.selectedValues,E];else this.selectedValues=[E]}#t(E){if(E!==this.#T){this.#T=E;let _=this.options;if(E)this.filteredOptions=_.filter((T)=>this.#r(E,T));else this.filteredOptions=[..._];if(this.#E=iM(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#E]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class pM extends F1{options;cursor=0;#E;getGroupItems(E){return this.options.filter((_)=>_.group===E)}isGroupSelected(E){let _=this.getGroupItems(E),T=this.value;if(T===void 0)return!1;return _.every((r)=>T.includes(r.value))}toggleValue(){let E=this.options[this.cursor];if(this.value===void 0)this.value=[];if(E.group===!0){let _=String(E.value),T=this.getGroupItems(_);if(this.isGroupSelected(_))this.value=this.value.filter((r)=>T.findIndex((d)=>d.value===r)===-1);else this.value=[...this.value,...T.map((r)=>r.value)];this.value=Array.from(new Set(this.value))}else{let _=this.value.includes(E.value);this.value=_?this.value.filter((T)=>T!==E.value):[...this.value,E.value]}}constructor(E){super(E,!1);let{options:_}=E;this.#E=E.selectableGroups!==!1,this.options=Object.entries(_).flatMap(([T,r])=>[{value:T,group:!0,label:T},...r.map((d)=>({...d,group:T}))]),this.value=[...E.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:T})=>T===E.cursorAt),this.#E?0:1),this.on("cursor",(T)=>{switch(T){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let r=this.options[this.cursor]?.group===!0;if(!this.#E&&r)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var oM=hM();var P_=(E,_)=>oM?E:_,SEE=P_("◆","*"),AEE=P_("■","x"),LEE=P_("▲","x"),OEE=P_("◇","o"),cEE=P_("┌","T"),E4=P_("│","|"),UEE=P_("└","—"),$EE=P_("●",">"),DEE=P_("○"," "),IEE=P_("◻","[•]"),CEE=P_("◼","[+]"),wEE=P_("◻","[ ]"),eEE=P_("▪","•"),XEE=P_("─","-"),JEE=P_("╮","+"),zEE=P_("├","+"),FEE=P_("╯","+"),jEE=P_("●","•"),BEE=P_("◆","*"),WEE=P_("▲","!"),HEE=P_("■","x");var PEE={light:P_("─","-"),heavy:P_("━","="),block:P_("█","#")};function _4(){return`${sO.gray(E4)}  `}var yEE=_4();var j1="0.7.99";fE();import{existsSync as M1}from"node:fs";import{mkdir as O4,writeFile as Xj}from"node:fs/promises";function f1(E){E.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(_)=>{if(b("Initializing ts-cloud Project"),M1("cloud.config.ts")){if(!await DE("cloud.config.ts already exists. Overwrite?",!1)){U("Initialization cancelled");return}}let T=_?.name||await O_("Project name","my-app"),r=_?.mode||await Ec("Select deployment mode",["serverless","server"]),d=_?.region||await Ec("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),t=new n("Creating configuration file...");t.start();let R=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -9723,7 +9723,7 @@ Resources to create: ${B}`);let y={};for(let Y of Object.values(S.Resources||{})
 No changes detected - infrastructure is up to date`);return}if(U(`
 Changes detected:
 `),C.length>0){Z(`Resources to add (${C.length}):`);for(let F of C){let B=c[F].Type;U(`  + ${F} (${B})`)}console.log()}if(e.length>0){Q(`Resources to remove (${e.length}):`);for(let F of e){let B=O[F].Type;U(`  - ${F} (${B})`)}console.log()}if(z.length>0){_E(`Resources to modify (${z.length}):`);for(let F of z){let B=c[F].Type;U(`  ~ ${F} (${B})`)}console.log()}U("Summary:"),U(`  - Add: ${C.length}`),U(`  - Remove: ${e.length}`),U(`  - Modify: ${z.length}`),U("\nRun `cloud deploy` to apply these changes")}catch(T){Q(`Diff failed: ${T.message}`)}})}fE();await aE();YS();_0();function kR(E,_=0){let T=Number(E);return Number.isFinite(T)?T:_}function ge(E){return kR(E)*1024}function kb(E){let _=E?.date?.trim(),T=E?.time?.trim();if(!_||!T)return null;let r=new Date(`${_}T${T}Z`);return Number.isFinite(r.getTime())?r.toISOString():null}function ub(E,_,T){let r;try{r=JSON.parse(E)}catch{return[]}let d=(r?.sysstat?.hosts??[]).flatMap((R)=>R.statistics??[]),t=[];for(let R of d){let h=kb(R.timestamp);if(!h)continue;let N=new Date(h).getTime();if(N<_.getTime()||N>T.getTime())continue;let S=R["cpu-load"]?.find((L)=>L.cpu==="all")??R["cpu-load"]?.[0],A=kR(S?.idle,100);t.push({timestamp:h,cpuUsedPercent:Math.max(0,Math.min(100,100-A)),cpuUserPercent:kR(S?.user),cpuSystemPercent:kR(S?.system),cpuIowaitPercent:kR(S?.iowait),memoryUsedPercent:kR(R.memory?.["memused-percent"]),memoryUsedBytes:ge(R.memory?.memused),memoryAvailableBytes:ge(R.memory?.avail),swapUsedPercent:kR(R.memory?.["swpused-percent"]),swapUsedBytes:ge(R.memory?.swpused)})}return t.sort((R,h)=>R.timestamp.localeCompare(h.timestamp))}function vb(E){return Object.fromEntries(Object.entries(E.time_series??{}).map(([_,T])=>[_,(T.values??[]).map(([r,d])=>({timestamp:new Date(Number(r)*1000).toISOString(),value:kR(d,Number.NaN)})).filter((r)=>Number.isFinite(r.value))]))}function AP(E){return E.length?E.reduce((_,T)=>_+T,0)/E.length:null}function xe(E){return E.length?Math.max(...E):null}function nb(E){return E.length?Math.min(...E):null}async function LP(E){let[_,T]=await Promise.all([E.client.getServerMetrics(E.serverId,{types:["cpu","disk","network"],start:E.from,end:E.to,step:E.step}),_d(E.remote.host,"LC_ALL=C sadf -j -- -u -r -S",E.remote).catch(()=>"")]),r=ub(T,E.from,E.to),d=vb(_),R=(d.cpu??[]).map((L)=>Math.max(0,Math.min(100,L.value/Math.max(1,E.cores)))),h=r.map((L)=>L.cpuUsedPercent),N=R.length?R:h,S=r.map((L)=>L.memoryUsedPercent),A=r.map((L)=>L.swapUsedPercent);return{from:E.from.toISOString(),to:E.to.toISOString(),cores:E.cores,host:r,provider:d,summary:{cpuAveragePercent:AP(N),cpuPeakPercent:xe(N),memoryAveragePercent:AP(S),memoryPeakPercent:xe(S),memoryMinimumAvailableBytes:nb(r.map((L)=>L.memoryAvailableBytes)),swapPeakPercent:xe(A)}}}EX();rX();RX();AX();E$();await bd([pe(),mR()]);import{createHash as Wk}from"node:crypto";var WP=async(E)=>{let _=Bun.spawn(E,{stdout:"pipe",stderr:"pipe"}),[T,r,d]=await Promise.all([_.exited,new Response(_.stdout).text(),new Response(_.stderr).text()]);return{code:T,stdout:r,stderr:d}};class HP{async scan(E,_){let T=await WP(["ssh-keyscan","-T","10","-p",String(_),"-t","ed25519",E]),r=T.stdout.split(`
-`).find((d)=>d&&!d.startsWith("#"))?.trim().split(/\s+/);if(T.code!==0||!r?.[1]||!r[2])throw Error(`SSH host-key scan failed: ${T.stderr.trim()||"no key returned"}`);return{algorithm:r[1],key:r[2]}}async exec(E,_){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return WP(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,_])}}var Hk=(E)=>`SHA256:${Wk("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,Pk=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class qt{provider;transport;discoverer;constructor(E,_=new HP,T){this.provider=E;this.transport=_;this.discoverer=T}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let _=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:_.algorithm,hostKeyFingerprint:Hk(_.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let _=await this.transport.exec(E,Pk);if(_.code!==0)throw Error(`Fleet validation failed: ${_.stderr.trim()||_.code}`);try{return JSON.parse(_.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,_){let T=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${_.length}`);if(T.code!==0)throw Error(`Fleet bootstrap failed: ${T.stderr.trim()||T.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function PP(E,_){return{"fleet.bootstrap":async(T)=>{let r=T.operation.input&&typeof T.operation.input==="object"&&!Array.isArray(T.operation.input)?T.operation.input:{},d=E.get(String(r.serverId??""));if(!d)throw Error("Queued fleet server was not found.");let t=_.find((N)=>N.provider===d.provider);if(!t)throw Error(`No ${d.provider} fleet driver is configured.`);let R=Array.isArray(r.steps)?r.steps.map(String):[];if(T.checkpoint("preflight","Rechecking pinned trust and healthy validation."),d.trustState!=="pinned"||!d.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");T.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let h=await t.bootstrap(d,R);return E.update(d.id,{bootstrapVersion:h.version,status:"ready"}),T.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:d.id,bootstrapVersion:h.version,steps:R.length}}}}var _t=(E)=>E==null?void 0:String(E),ah=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},LX=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:_t(E.provider_id),region:_t(E.region),zone:_t(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:_t(E.host_key_algorithm),hostKeyFingerprint:_t(E.host_key_fingerprint),pendingHostKey:_t(E.pending_host_key),roles:ah(E.roles,[]),labels:ah(E.labels,{}),taints:ah(E.taints,[]),capacity:ah(E.capacity,{}),usage:ah(E.usage,{}),capabilities:ah(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:ah(E.validation,void 0),bootstrapVersion:_t(E.bootstrap_version),heartbeatAt:_t(E.heartbeat_at),lastSeenAt:_t(E.last_seen_at),archivedAt:_t(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class Tt{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}get(E){let _=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return _?LX(_):void 0}list(E,_=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(LX).filter((T)=>_||T.status!=="archived")}findProvider(E,_,T){let r=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,_,T);return r?LX(r):void 0}create(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,T,T]),this.get(_)}update(E,_){let T=this.get(E);if(!T)throw Error("Server was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[r.name,r.providerId??null,r.region??null,r.zone??null,r.endpoint,r.sshUser,r.sshPort,r.credentialRef,r.hostKeyAlgorithm??null,r.hostKeyFingerprint??null,r.pendingHostKey??null,JSON.stringify(r.roles),JSON.stringify(r.labels),JSON.stringify(r.taints),JSON.stringify(r.capacity),JSON.stringify(r.usage),JSON.stringify(r.capabilities),r.status,r.trustState,JSON.stringify(r.validation??{}),r.bootstrapVersion??null,r.heartbeatAt??null,r.lastSeenAt??null,r.archivedAt??null,d,E]),this.get(E)}}var yk=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class N0{store;drivers;now;queue;constructor(E,_,T,r=()=>new Date){this.store=E;this.drivers=_;this.now=r;this.queue=T??new lE(E.control)}driver(E){let _=this.drivers.find((T)=>T.provider===E);if(!_)throw Error(`No ${E} fleet driver is configured.`);return _}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!yk.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let _=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(_)return this.store.update(_.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let T=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),r=this.driver(E.provider);return this.store.create({...E,resourceId:T.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:r.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let T=await this.driver(_.provider).test(_);if(!T.reachable)return this.store.update(E,{status:"unreachable"});if(_.hostKeyFingerprint&&_.hostKeyFingerprint!==T.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:T.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:T.hostKeyAlgorithm,hostKeyFingerprint:T.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,_){let T=this.store.get(E);if(!T||T.pendingHostKey!==_)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:_,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let _=this.store.get(E);if(!_||_.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let T=await this.driver(_.provider).validate(_),r=[];if(!["x64","arm64","x86_64","aarch64"].includes(T.arch??""))r.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let R of["curl","tar"])if(!T.tools?.[R])r.push({code:`tool.${R}`,severity:"error",message:`${R} is missing.`,remediation:`Install ${R} before bootstrap.`});if(Math.abs(T.timeSkewSeconds??0)>60)r.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!T.dnsOk)r.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let d={valid:!r.some((R)=>R.severity==="error"),facts:T,findings:r,validatedAt:this.now().toISOString(),validatorVersion:"1"},t={cpu:T.cpuCores??0,memoryBytes:T.memoryBytes??0,diskBytes:T.diskBytes??0};return this.store.update(E,{validation:d,capacity:t,status:d.valid?"ready":"degraded"})}bootstrap(E,_=!1){let T=this.store.get(E);if(!T?.validation?.valid)throw Error("A healthy validation report is required.");let r=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!_)return{preview:!0,steps:r};let d=this.queue.enqueue({projectId:T.projectId,resourceId:T.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:r},lockKey:`server:${E}`,providerKey:T.provider}).operation;return{preview:!1,steps:r,operation:d}}heartbeat(E,_){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let r=this.now().toISOString();return this.store.update(E,{usage:_.usage,capabilities:_.capabilities??T.capabilities,heartbeatAt:r,lastSeenAt:r,status:T.status==="draining"||T.status==="drained"?T.status:"ready"})}drain(E,_=!1){return this.store.update(E,{status:_?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,_){let T=this.store.get(E);if(!T||_!==T.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function Yk(){let E=await p(),_=iE(process.cwd(),E),T=new Tt(_.store),r=new N0(T,[new qt("aws"),new qt("hetzner"),new qt("ssh")]);return{controlPlane:_,store:T,service:r}}async function gt(E){let _=await Yk();try{return await E(_)}finally{_.controlPlane.store.close()}}var mh=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((r)=>r.id===_||r.name===_);if(!T)throw Error(`Server ${_} was not found.`);return T},rd=(E)=>{Q(E instanceof Error?E.message:String(E)),process.exitCode=1};function OX(E,_){let T=Number.parseInt(E??"",10);return Number.isFinite(T)&&T>=0?T:_}function Qk(E="3h"){let _=E.match(/^(\d+)(m|h)$/);if(!_)throw Error("--range must use minutes or hours, for example 30m or 3h.");let T=Number(_[1])*(_[2]==="h"?3600000:60000);if(T<300000||T>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return T}function S0(E,_="%"){return E==null?"unavailable":`${E.toFixed(1)}${_}`}async function Gk(E,_){let T=await p();if(T.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let r=_.env??process.env.CLOUD_ENV??"production",d=C_(T,r),t=await Bd(d);if(!t?.serverId)throw Error(`No pinned Hetzner server was found for ${d}.`);if(![t.serverName,String(t.serverId),t.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${t.serverName}.`);let R=HS(T),h=new ft({apiToken:PS(R.apiToken,T)}),N=await h.getServer(t.serverId),S=t.publicIp??N.public_net.ipv4?.ip;if(!S)throw Error(`Server ${N.name} has no public IPv4 address.`);let A=new Date,L=new Date(A.getTime()-Qk(_.range)),O=Math.min(3600,Math.max(60,OX(_.step,60))),c=await LP({client:h,serverId:N.id,cores:Math.max(1,Number(N.server_type.cores)||1),from:L,to:A,step:O,remote:{host:S,user:t.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15}});if(_.json){console.log(JSON.stringify({schemaVersion:1,server:N.name,result:c},null,2));return}o(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[N.name,`${c.from} to ${c.to}`,`${S0(c.summary.cpuAveragePercent)} / ${S0(c.summary.cpuPeakPercent)}`,`${S0(c.summary.memoryAveragePercent)} / ${S0(c.summary.memoryPeakPercent)}`,c.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(c.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,S0(c.summary.swapPeakPercent)]])}function yP(E){let _=E.targetType.prices?.find((T)=>T.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:_?{hourlyNet:_.price_hourly.net,hourlyGross:_.price_hourly.gross,monthlyNet:_.price_monthly.net,monthlyGross:_.price_monthly.gross}:void 0}}function Mk(E){let _=yP(E);o(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${_.serverName} (${_.serverId})`,_.location,`${_.from} -> ${_.to}`,_.capacityAvailable?"available":"waiting",`${_.target.cores??0} / ${_.target.memoryGb??0} GB / ${_.target.diskGb??0} GB`,_.price?.monthlyGross??_.price?.monthlyNet??"not reported"]])}async function fk(E,_,T){let r=await p();if(r.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let d=T.env??process.env.CLOUD_ENV??"production",t=C_(r,d),R=await Bd(t),h=HS(r),N=new ft({apiToken:PS(h.apiToken,r)}),A=R&&(E===R.serverName||E===String(R.serverId)||E===R.stackName)?await N.getServer(R.serverId):(await N.listServers()).find((Y)=>Y.name===E||String(Y.id)===E);if(!A)throw Error(`Hetzner server ${E} was not found.`);if(R?.serverId&&R.serverId!==A.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${R.serverId}.`);let L=Kt(_),O=T.upgradeDisk!==!1,c=await h0(N,A.id,L,O);if(T.json)console.log(JSON.stringify({schemaVersion:1,plan:yP(c)},null,2));else Mk(c);if(!T.apply){if(!T.json)U(`Preview only. Re-run with --apply --confirm ${A.name} to execute.`);return}if(T.confirm!==A.name)throw Error(`Resize requires --confirm ${A.name}.`);let $=R?.publicIp??A.public_net.ipv4?.ip;if(!$)throw Error(`Server ${A.name} has no public IPv4 address for verification.`);let I={host:$,user:R?.sshUser??h.sshUser,identityFile:h.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},C=await NX(t),e=new Date().toISOString(),z={schemaVersion:1,operationId:C?.targetType===L&&C.serverId===A.id?C.operationId:crypto.randomUUID(),stackName:t,serverId:A.id,serverName:A.name,sourceType:c.currentType.name,targetType:L,upgradeDisk:O,phase:"planning",status:"running",attempts:C?.targetType===L?C.attempts:0,startedAt:C?.targetType===L?C.startedAt:e,updatedAt:e,manifest:C?.targetType===L?C.manifest:void 0};await Zt(z);let F=OX(T.pollSeconds,900)*1000,B=OX(T.maxWaitMinutes,0)*60000,y=Date.now();for(;;){let Y=await h0(N,A.id,L,O);if(!Y.capacityAvailable&&!Y.alreadyComplete){if(z={...z,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await Zt(z),!T.wait){if(!T.json)U(`${L} has no capacity in ${Y.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(B>0&&Date.now()-y>=B)throw Error(`Timed out waiting for ${L} capacity in ${Y.location}.`);if(!T.json)U(`Waiting ${Math.round(F/1000)} seconds for ${L} capacity...`);await Bun.sleep(F);continue}let M=await SX(t);try{let V=await(async()=>{try{return z={...z,status:"running",attempts:z.attempts+1,updatedAt:new Date().toISOString()},await Zt(z),await TX({client:N,serverId:A.id,targetType:L,upgradeDisk:O,resumeFromOff:z.phase==="shutting-down"||z.phase==="resizing"||z.phase==="powering-on"||z.phase==="verifying",manifest:z.manifest,hooks:{preflight:async()=>{let g=await dX(I);return z={...z,manifest:g,updatedAt:new Date().toISOString()},await Zt(z),g},afterBoot:async(g,k,v,EE)=>tX(I,k,v,EE),onPhase:async(g,k)=>{if(z={...z,phase:g,status:g==="waiting-capacity"?"waiting-capacity":g==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await Zt(z),!T.json)U(`${g}${k?` ${JSON.stringify(k)}`:""}`)}}})}finally{await M()}})();if(z={...z,status:V.status==="completed"||V.status==="already-complete"?"completed":V.status==="recovered"?"recovered":"waiting-capacity",lastError:V.status==="recovered"?V.error:void 0,updatedAt:new Date().toISOString()},await Zt(z),T.json)console.log(JSON.stringify({schemaVersion:1,result:V},null,2));else if(V.status==="completed"||V.status==="already-complete")Z(`${A.name} is on ${L} and passed full post-boot verification.`);else if(V.status==="recovered"&&V.retryable&&T.wait){U(`Capacity race recovered safely. Waiting ${Math.round(F/1000)} seconds before retry.`),await Bun.sleep(F);continue}else if(V.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${V.error}`);return}catch(V){throw z={...z,status:"failed",lastError:V instanceof Error?V.message:String(V),updatedAt:new Date().toISOString()},await Zt(z),V}}}async function Kk(E,_){let T=await p();if(T.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let r=_.env??process.env.CLOUD_ENV??"production",d=C_(T,r),t=await Bd(d);if(!t?.serverId)throw Error(`No pinned Hetzner server was found for ${d}.`);if(![t.serverName,String(t.serverId),t.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${t.serverName}.`);let R=HS(T),h=new ft({apiToken:PS(R.apiToken,T)}),N=await h.getServer(t.serverId),S=t.publicIp??N.public_net.ipv4?.ip;if(!S)throw Error(`Server ${N.name} has no public IPv4 address.`);let A=pU(T);if(_.json)console.log(JSON.stringify({schemaVersion:1,server:N.name,plan:A},null,2));else o(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[N.name,A.firewallPorts.join(","),A.monitoring?"on":"off",A.autoUpdates?"on":"off",`${A.swapGb} GB`,"disabled"]]);if(!_.apply){if(!_.json)U(`Preview only. Re-run with --apply --confirm ${N.name} to execute.`);return}if(_.confirm!==N.name)throw Error(`Optimization requires --confirm ${N.name}.`);let L={host:S,user:t.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15},O=await VS(L),c=O.routeProbes.filter((v)=>!v.ok),$=T.infrastructure?.compute,I=$r($)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,C=O.failedUnits.filter((v)=>!I.has(v));if(C.length>0)throw Error(`Preflight found failed services: ${C.join(", ")}`);if(c.length>0)throw Error(`Preflight found unhealthy routes: ${c.map((v)=>v.domain).join(", ")}`);let e=$r($)?[]:Object.values(T.sites??{}).flatMap((v)=>typeof v?.port==="number"&&![80,443].includes(v.port)?[v.port]:[]),z=QS({allowSsh:$?.allowSsh!==!1,sitePorts:e,allowedPorts:$?.firewall?.allowedPorts}),F=(t.firewallId?(await h.listFirewalls()).find((v)=>v.id===t.firewallId):void 0)??(await h.listFirewalls()).find((v)=>v.name===`${T.project.slug}-${r}-app-fw`);if(!F)throw Error(`Managed firewall for ${N.name} was not found.`);let B=await h.setFirewallRules(F.id,z);await Promise.all(B.map((v)=>h.waitForAction(v.id))),await ae(T,L);let[y,Y]=await Promise.all([VS(L),me(L)]),M=se(A,Y),V=CP(O,y),g=y.routeProbes.filter((v)=>!v.ok);if(V.stoppedServices.length>0)M.push(`services stopped: ${V.stoppedServices.join(", ")}`);if(V.changedRouteFragments.length>0)M.push(`route fragments changed: ${V.changedRouteFragments.join(", ")}`);if(V.missingRouteIds.length>0)M.push(`routes disappeared: ${V.missingRouteIds.join(", ")}`);if(V.changedReleaseLinks.length>0)M.push(`release links changed: ${V.changedReleaseLinks.join(", ")}`);if(V.missingData.length>0)M.push(`databases or volumes disappeared: ${V.missingData.join(", ")}`);if(g.length>0)M.push(`unhealthy routes: ${g.map((v)=>v.domain).join(", ")}`);if(M.length>0)throw Error(`Host optimization verification failed: ${M.join("; ")}`);let k={serverId:N.id,serverName:N.name,services:y.runningServices.length,routes:y.routeIds.length,healthyDomains:y.routeProbes.length,releaseLinks:y.releaseLinks.length,databasesAndVolumes:y.dataCatalog.length,report:Y};if(_.json)console.log(JSON.stringify({schemaVersion:1,result:k},null,2));else Z(`${N.name} passed full host, rpx route, service, release, and data verification.`)}function cX(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(_,T)=>{try{await gt(async(r)=>{let d=_?[mh(r,_)]:r.store.list(r.controlPlane.project.id),t=d.flatMap((R)=>Object.entries(R.capabilities).map(([h,N])=>({server:R.name,provider:R.provider,action:h,...N})));if(T.json)console.log(JSON.stringify({schemaVersion:1,targets:t},null,2));else o(["Server","Provider","Action","Support","Explanation"],t.map((R)=>[R.server,R.provider,R.action,R.supported?"supported":"unsupported",R.reason??"—"]))})}catch(r){rd(r)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(_,T,r)=>{try{await fk(_,T,r)}catch(d){rd(d)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(_,T)=>{try{await Kk(_,T)}catch(r){rd(r)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(_,T)=>{try{await Gk(_,T)}catch(r){rd(r)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(_)=>{try{await gt(async(T)=>{let r=T.store.list(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(r,null,2));else o(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],r.map((d)=>[d.name,d.providerId??"—",`${d.provider} / ${d.region??"external"}`,`${d.status} / ${d.trustState}`,d.roles.join(","),`${d.capacity.cpu??0} / ${d.capacity.memoryBytes??0}`,d.heartbeatAt??"never"]))})}catch(T){rd(T)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(_,T)=>{try{await gt(async(r)=>{let d=T.provider;if(!["aws","hetzner","ssh"].includes(d)||!T.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let t=r.service.enroll({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:_,provider:d,providerId:T.providerId,endpoint:T.endpoint,sshUser:T.user??"deploy",credentialRef:T.credentialRef??"secret://fleet/agent",region:T.region,roles:String(T.roles??"application").split(","),labels:Object.fromEntries(String(T.labels??"").split(",").map((R)=>R.split("=")).filter((R)=>R[0]&&R[1]))});Z(`Enrolled ${t.name} as ${t.id}; no remote mutation was performed.`)})}catch(r){rd(r)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(_,T)=>{try{await gt(async(r)=>{let d=mh(r,_);if(d=await r.service.test(d.id),d.trustState==="rotation_pending"){if(!T.acceptHostKey)throw Error(`Host key changed to ${d.pendingHostKey}; review it first.`);d=r.service.reviewHostKey(d.id,T.acceptHostKey)}let t=await r.service.validate(d.id);if(T.json)console.log(JSON.stringify(t.validation,null,2));else o(["Severity","Code","Finding","Remediation"],(t.validation?.findings??[]).map((R)=>[R.severity,R.code,R.message,R.remediation??"—"]));if(!t.validation?.valid)process.exitCode=1})}catch(r){rd(r)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(_,T)=>{try{await gt(async(r)=>{let d=r.service.bootstrap(mh(r,_).id,!!T.apply);if(d.preview)o(["Step"],d.steps.map((t)=>[t]));else Z(`Bootstrap queued: ${d.operation?.id}`)})}catch(r){rd(r)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(_,T)=>{try{await gt(async(r)=>Z(r.service.drain(mh(r,_).id,!!T.complete).status))}catch(r){rd(r)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(_)=>{try{await gt(async(T)=>{T.service.uncordon(mh(T,_).id),Z(`Uncordoned ${_}.`)})}catch(T){rd(T)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(_,T)=>{try{await gt(async(r)=>{r.service.archive(mh(r,_).id,T.confirm??""),Z(`Archived ${_}; provider infrastructure was not terminated.`)})}catch(r){rd(r)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(_)=>{try{await gt(async(T)=>{let r=mh(T,_);if(r.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let d=Bun.spawn(["ssh","-p",String(r.sshPort),"-o","StrictHostKeyChecking=yes",`${r.sshUser}@${r.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),t=await d.exited;if(t)process.exitCode=t})}catch(T){rd(T)}});for(let[_,T]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(_,T).action(async(...r)=>Ed(_.split(" ")[0],{target:String(r[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}fE();var Wd=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},Dr=(E)=>E==null?void 0:String(E),GP=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),qS=(E={})=>({...GP(),...E});function YP(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:Dr(E.region),architecture:Dr(E.architecture),labels:Wd(E.labels,{}),requiredServerLabels:Wd(E.required_server_labels,{}),toleratedTaints:Wd(E.tolerated_taints,[]),capacity:qS(Wd(E.capacity,{})),reserved:Wd(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:Dr(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function QP(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Dr(E.environment_id),resourceId:String(E.resource_id),releaseId:Dr(E.release_id),poolId:String(E.pool_id),serverId:Dr(E.server_id),purpose:String(E.purpose),requirements:Wd(E.requirements,{}),decision:Wd(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Vk(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:Dr(E.resource_id),poolId:String(E.pool_id),placementId:Dr(E.placement_id),operationId:Dr(E.operation_id),sourceSha:String(E.source_sha),buildSpec:Wd(E.build_spec,{}),credentialPolicy:Wd(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:Dr(E.workspace),cacheKey:Dr(E.cache_key),artifactUri:Dr(E.artifact_uri),artifactDigest:Dr(E.artifact_digest),status:String(E.status),cleanupAt:Dr(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class A0{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}createPool(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(qS(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,T,T]),this.getPool(_)}getPool(E){let _=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return _?YP(_):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(YP)}updatePool(E,_){let T=this.getPool(E);if(!T)throw Error("Capacity pool was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.reserved),JSON.stringify(r.capacity),r.concurrency,d,E]),this.getPool(E)}addMember(E,_,T={}){let r=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,_,JSON.stringify(T),r,r])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((_)=>({serverId:String(_.server_id),status:String(_.status),capacityOverride:Wd(_.capacity_override,{})}))}memberStatus(E,_,T){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[T,this.now().toISOString(),E,_])}listPlacements(E,_){let T=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(QP);return _?.length?T.filter((r)=>_.includes(r.status)):T}getPlacement(E){let _=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return _?QP(_):void 0}activeUsage(E,_){let T=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),r=_?T.filter((d)=>String(d.server_id)===_):T;return{resources:r.reduce((d,t)=>{let R=qS(Wd(t.resources,{}));for(let h of Object.keys(d))d[h]+=R[h];return d},GP()),count:r.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let _=this.id(),T=this.id(),r=this.now().toISOString(),d=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[_,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,r,r]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[T,_,E.decision.poolId,E.decision.serverId??null,JSON.stringify(qS(E.requirements.resources)),d,r,r]),this.getPlacement(_)})}transitionPlacement(E,_){if(!this.getPlacement(E))throw Error("Placement was not found.");let r=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[_,r,E]),["released","failed","blocked"].includes(_))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[r,E]);return this.getPlacement(E)}createBuild(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[_,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),T,T]),this.getBuild(_)}getBuild(E){let _=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return _?Vk(_):void 0}updateBuild(E,_){let T=this.getBuild(E);if(!T)throw Error("Remote build was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[r.operationId??null,r.workspace??null,r.cacheKey??null,r.artifactUri??null,r.artifactDigest??null,r.status,r.cleanupAt??null,d,E]),this.getBuild(E)}}var T$=["cpu","memoryBytes","diskBytes","gpu"],MP=(E,_={})=>Object.entries(_).every(([T,r])=>E[T]===r),Zk=(E,_,T)=>Object.fromEntries(T$.map((r)=>[r,Math.max(0,E[r]-_[r]-(T[r]??0))])),qk=(E,_)=>T$.every((T)=>E[T]>=(_[T]??0)),gk=(E,_)=>T$.reduce((T,r)=>T+(_[r]??0)/(E[r]||1),0);class L0{store;fleet;constructor(E,_){this.store=E;this.fleet=_}poolCandidates(E,_,T){let r=[];for(let d of this.store.listPools(E)){if(d.id===T)continue;let t=[];if(d.status!=="active")t.push(`pool is ${d.status}`);if(d.purpose!==_.purpose)t.push(`purpose is ${d.purpose}`);if(_.region&&d.region!==_.region)t.push(`region is ${d.region??"unset"}`);if(_.architecture&&d.architecture!==_.architecture)t.push(`architecture is ${d.architecture??"unset"}`);if(!MP(d.labels,_.labels))t.push("pool labels do not match");if(d.backend==="server"){let R=this.store.members(d.id);if(!R.length)r.push(this.decision(d,void 0,_,[...t,"pool has no servers"]));for(let h of R){let N=this.fleet.get(h.serverId),S=[...t];if(!N)S.push("server is missing");else this.serverReasons(d,N,h.status,_,S);r.push(this.decision(d,N,_,S,h.capacityOverride))}}else r.push(this.decision(d,void 0,_,t))}return r.sort((d,t)=>Number(t.eligible)-Number(d.eligible)||d.score.cost-t.score.cost||d.score.spread-t.score.spread||d.score.fit-t.score.fit||d.poolName.localeCompare(t.poolName)||(d.serverId??"").localeCompare(t.serverId??""))}serverReasons(E,_,T,r,d){if(T!=="active")d.push(`member is ${T}`);if(_.status!=="ready")d.push(`server is ${_.status}`);if(!_.roles.includes(r.purpose==="build"?"build":r.purpose))d.push(`server lacks ${r.purpose} role`);if(!MP(_.labels,E.requiredServerLabels))d.push("server labels do not match pool selector");for(let t of _.taints)if(!E.toleratedTaints.includes(t))d.push(`taint ${t} is not tolerated`)}decision(E,_,T,r,d={}){let t=qS({..._?.capacity,...d}),R=_?Object.fromEntries(T$.map((S)=>[S,Math.min(E.capacity[S],t[S])])):E.capacity,h=this.store.activeUsage(E.id,_?.id),N=Zk(R,h.resources,E.reserved);if(h.count>=E.maxWorkloads)r.push("workload limit reached");if(T.purpose==="build"&&h.count>=E.concurrency)r.push("build concurrency reached");if(!qk(N,T.resources))r.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:_?.id,eligible:r.length===0,reasons:r,available:N,score:{fit:gk(N,T.resources),spread:h.count,cost:E.costWeight}}}explain(E,_){return this.poolCandidates(E,_)}place(E){return this.store.control.transaction(()=>{let _=this.poolCandidates(E.projectId,E.requirements).find((T)=>T.eligible);if(!_)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((T)=>T.reasons).join("; ")}`);return this.store.reserve({...E,decision:_})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let _=this.store.updatePool(E,{status:"draining"}),T=[],r=[];for(let d of this.store.listPlacements(_.projectId,["reserved","active"]).filter((t)=>t.poolId===E)){if(d.stateful){r.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"moving");let t=this.place({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements});T.push(this.activate(t.id)),this.store.transitionPlacement(d.id,"released")}return{pool:_,moved:T,blocked:r}}drainServer(E,_){this.store.memberStatus(E,_,"draining");let T=this.store.getPool(E);if(!T)throw Error("Capacity pool was not found.");let r=[],d=[];for(let t of this.store.listPlacements(T.projectId,["reserved","active"]).filter((R)=>R.poolId===E&&R.serverId===_)){if(t.stateful){d.push(this.store.transitionPlacement(t.id,"blocked"));continue}this.store.transitionPlacement(t.id,"moving");let R=this.poolCandidates(t.projectId,t.requirements).find((N)=>N.eligible);if(!R){d.push(this.store.transitionPlacement(t.id,"blocked"));continue}let h=this.store.reserve({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,releaseId:t.releaseId,requirements:t.requirements,decision:R});r.push(this.activate(h.id)),this.store.transitionPlacement(t.id,"released")}return{moved:r,blocked:d}}reconcileFailure(E){let _=this.fleet.get(E);if(!_)throw Error("Server was not found.");let T=[],r=[];for(let d of this.store.listPlacements(_.projectId,["active"]).filter((t)=>t.serverId===E)){if(d.stateful||!d.autoReschedule){r.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"failed");let t=this.place({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements});T.push(this.activate(t.id))}return{rescheduled:T,blocked:r}}}async function xk(){let E=await p(),_=iE(process.cwd(),E),T=new A0(_.store),r=new L0(T,new Tt(_.store));return{controlPlane:_,store:T,service:r}}async function O0(E){let _=await xk();try{await E(_)}catch(T){Q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var r$=(E)=>Object.fromEntries(String(E??"").split(",").map((_)=>_.split("=")).filter((_)=>_[0]&&_[1])),fP=(E)=>Object.fromEntries(Object.entries(r$(E)).map(([_,T])=>[_,Number(T)]));function UX(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(_)=>O0((T)=>{let r=T.store.listPools(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(r,null,2));else o(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],r.map((d)=>[d.name,d.purpose,d.backend,`${d.region??"any"} / ${d.architecture??"any"}`,d.status,JSON.stringify(d.capacity),String(d.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(_,T)=>O0((r)=>{let{purpose:d,backend:t}=T;if(!["application","build","worker","monitoring","backup"].includes(d)||!["server","ecs","asg"].includes(t))throw Error("Unsupported pool purpose or backend.");let R=r.store.createPool({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:_,purpose:d,backend:t,region:T.region,architecture:T.arch,labels:r$(T.labels),requiredServerLabels:r$(T.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...fP(T.capacity)},maxWorkloads:Number(T.max),costWeight:1,concurrency:Number(T.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});Z(`Created ${R.name} (${R.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(_,T)=>O0((r)=>{let d=r.store.listPools(r.controlPlane.project.id).find((R)=>R.id===_||R.name===_),t=new Tt(r.controlPlane.store).list(r.controlPlane.project.id).find((R)=>R.id===T||R.name===T);if(!d||!t)throw Error("Pool or server was not found.");r.store.addMember(d.id,t.id),Z(`Attached ${t.name} to ${d.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(_)=>O0((T)=>{let r=T.service.explain(T.controlPlane.project.id,{purpose:_.purpose,resources:fP(_.resources),region:_.region,architecture:_.arch,labels:r$(_.labels)});if(_.json)console.log(JSON.stringify(r,null,2));else o(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],r.map((d)=>[d.poolName,d.serverId??"provider-managed",d.eligible?"yes":"no",JSON.stringify(d.available),`${d.score.fit.toFixed(2)} / ${d.score.spread} / ${d.score.cost}`,d.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(_)=>O0((T)=>{let r=T.store.listPools(T.controlPlane.project.id).find((t)=>t.id===_||t.name===_);if(!r)throw Error("Pool was not found.");let d=T.service.drainPool(r.id);Z(`Draining ${r.name}: moved ${d.moved.length}, blocked ${d.blocked.length} stateful placement(s).`)}))}fE();var xt=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},dd=(E)=>E==null?void 0:String(E),KP=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:dd(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:xt(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:xt(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:dd(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),$X=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:dd(E.stack_id),stackRevision:dd(E.stack_revision),status:String(E.status),health:xt(E.health,{}),lastHealthyAt:dd(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),DX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:xt(E.config,{}),status:String(E.status),checkpoint:dd(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:dd(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),IX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:xt(E.weights,{}),desiredWeights:xt(E.desired_weights,{}),status:String(E.status),providerState:xt(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),VP=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:dd(E.operation_id),kind:String(E.kind),requestedRegion:dd(E.requested_region),revision:dd(E.revision),plan:xt(E.plan,[]),currentStep:dd(E.current_step),completedSteps:xt(E.completed_steps,[]),status:String(E.status),error:dd(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class c0{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((t)=>t.region)).size!==E.regions.length||E.regions.filter((t)=>t.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let _=E.regions.find((t)=>t.role==="primary"),T=this.id(),r=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[T,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,_.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),_.region,r,r]);for(let t of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),T,t.region,t.role,t.provider,r,r]);for(let t of E.dataPolicy.replicate)for(let R of E.regions)for(let h of E.regions.filter((N)=>N.region!==R.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,t,R.region,h.region,"{}",r,r]);let d=Object.fromEntries(E.regions.map((t)=>[t.region,t.region===_.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),T,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(d),JSON.stringify(d),r,r]),this.get(T)})}get(E){let _=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return _?KP(_):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(KP)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map($X)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(DX)}route(E){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return _?IX(_):void 0}updateTopology(E,_){let T=this.get(E);if(!T)throw Error("Regional topology was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[r.status,r.activeRegion,r.revision??null,JSON.stringify(r.regions),d,E]),this.get(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!T)throw Error("Regional target was not found.");let r=$X(T),d={...r,..._},t=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[d.role,d.stackId??null,d.stackRevision??null,d.status,JSON.stringify(d.health),d.lastHealthyAt??null,t,E]),$X(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,_){let T=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!T)throw Error("Replication channel was not found.");let r=DX(T),d={...r,..._},t=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[d.status,d.checkpoint??null,d.lagSeconds??null,d.lastVerifiedAt??null,t,E]),DX(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,_){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!T)throw Error("Traffic route was not found.");let r=IX(T),d={...r,..._},t=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(d.weights),JSON.stringify(d.desiredWeights),d.status,JSON.stringify(d.providerState),t,E]),IX(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[_,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),T,T]),this.execution(_)}execution(E){let _=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return _?VP(_):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(VP)}updateExecution(E,_){let T=this.execution(E);if(!T)throw Error("Regional execution was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[r.operationId??null,r.currentStep??null,JSON.stringify(r.completedSteps),r.status,r.error??null,d,E]),this.execution(E)}}class U0{store;queue;constructor(E,_){this.store=E;this.queue=_??new lE(E.control)}create(E){return this.store.create(E)}plan(E,_,T){if(!this.store.get(E))throw Error("Regional topology was not found.");let d=this.store.targets(E),t=this.store.channels(E);if(_==="rollout")return[...d.filter((R)=>R.role==="secondary").map((R)=>`apply:${R.region}`),...d.filter((R)=>R.role==="primary").map((R)=>`apply:${R.region}`),...t.map((R)=>`replicate:${R.kind}:${R.targetRegion}`),"traffic:activate"];if(_==="failover"||_==="failback")return[`health:${T}`,`replication:${T}`,`traffic:${T}`,`roles:${T}`];if(_==="destroy")return["traffic:drain",...d.filter((R)=>R.role==="secondary").map((R)=>`delete:${R.region}`),...d.filter((R)=>R.role==="primary").map((R)=>`delete:${R.region}`),"complete"];return["observe","repair"]}enqueue(E){let _=this.store.get(E.topologyId);if(!_)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!_.regions.some((t)=>t.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===_.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==_.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&_.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let T=this.plan(_.id,E.kind,E.targetRegion),r=this.store.createExecution({topologyId:_.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:T}),d=this.queue.enqueue({projectId:_.projectId,environmentId:_.environmentId,kind:`region.${E.kind}`,input:{executionId:r.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${_.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(r.id,{operationId:d.id}),{execution:this.store.execution(r.id),operation:d}}}var bk=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function ZP(E,_){let T=(S)=>{let A=_.find((L)=>L.provider===S.provider);if(!A)throw Error(`No ${S.provider} regional driver is configured.`);return A},r=(S,A,L)=>{S.throwIfCancellationRequested(),S.checkpoint(L,L),E.updateExecution(A.id,{status:"running",currentStep:L,completedSteps:[...E.execution(A.id).completedSteps,L]})},d=async(S,A)=>{let L=E.route(S.id);if(!L)throw Error("Regional traffic route was not found.");let O=E.targets(S.id).find(($)=>$.region===S.activeRegion)??E.targets(S.id)[0];if(!O)throw Error("Regional traffic target was not found.");E.updateRoute(L.id,{status:"applying",desiredWeights:A});let c=await T(O).applyTraffic({route:E.route(S.id),topology:S,weights:A});E.updateRoute(L.id,{status:Object.values(A).every(($)=>$===0)?"drained":"in_sync",weights:A,providerState:c.providerState})},t=async(S,A,L,O)=>{E.updateTopology(L.id,{status:"provisioning"});let c=A.revision,$=O.manifest??{},I=E.targets(L.id).sort((e,z)=>Number(e.role==="primary")-Number(z.role==="primary"));for(let e of I){r(S,A,`apply:${e.region}`),E.updateTarget(e.id,{status:"provisioning"});let z=await T(e).applyStack({target:e,revision:c,manifest:$,signal:S.signal}),F=await T(e).health({target:E.updateTarget(e.id,{stackId:z.stackId,stackRevision:c})});if(!F.healthy)throw Error(`Regional health gate failed in ${e.region}.`);E.updateTarget(e.id,{status:"ready",health:F.evidence,lastHealthyAt:new Date().toISOString()})}for(let e of E.channels(L.id)){r(S,A,`replicate:${e.kind}:${e.targetRegion}`),E.updateChannel(e.id,{status:"configuring"});let z=I.find((y)=>y.region===e.sourceRegion),F=await T(z).configureReplication({channel:e,topology:L}),B=await T(z).verifyReplication({channel:E.updateChannel(e.id,{checkpoint:F.checkpoint,lagSeconds:F.lagSeconds}),topology:L});if(!B.healthy||B.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${e.kind} replication to ${e.targetRegion} exceeds the RPO.`);E.updateChannel(e.id,{status:"in_sync",checkpoint:B.checkpoint,lagSeconds:B.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(S,A,"traffic:activate");let C=Object.fromEntries(L.regions.map((e)=>[e.region,e.region===L.activeRegion?100:0]));return await d(L,C),E.updateTopology(L.id,{status:"ready",revision:c}),{revision:c,activeRegion:L.activeRegion}},R=async(S,A,L)=>{let O=A.requestedRegion,c=E.targets(L.id).find((C)=>C.region===O);if(!c)throw Error("Requested regional target was not found.");E.updateTopology(L.id,{status:A.kind==="failover"?"failing_over":"failing_back"}),r(S,A,`health:${O}`);let $=await T(c).health({target:c});if(!$.healthy)throw Error(`Target region ${O} is unhealthy.`);E.updateTarget(c.id,{status:"ready",health:$.evidence,lastHealthyAt:new Date().toISOString()}),r(S,A,`replication:${O}`);for(let C of E.channels(L.id).filter((e)=>e.targetRegion===O)){let e=await T(c).verifyReplication({channel:C,topology:L});if(!e.healthy||e.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${C.kind} replication is outside the failover RPO.`);E.updateChannel(C.id,{status:"in_sync",checkpoint:e.checkpoint,lagSeconds:e.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(S,A,`traffic:${O}`),await d(L,Object.fromEntries(L.regions.map((C)=>[C.region,C.region===O?100:0]))),r(S,A,`roles:${O}`);let I=L.regions.map((C)=>({...C,role:C.region===O?"primary":"secondary"}));for(let C of E.targets(L.id))E.updateTarget(C.id,{role:C.region===O?"primary":"secondary"});return E.updateTopology(L.id,{status:A.kind==="failover"?"failed_over":"ready",activeRegion:O,regions:I}),{activeRegion:O}},h=async(S,A,L,O)=>{E.updateTopology(L.id,{status:"destroying"}),r(S,A,"traffic:drain"),await d(L,Object.fromEntries(L.regions.map(($)=>[$.region,0])));let c=O.deleteData!==!0;for(let $ of E.targets(L.id).sort((I,C)=>Number(I.role==="primary")-Number(C.role==="primary")))r(S,A,`delete:${$.region}`),E.updateTarget($.id,{status:"deleting"}),await T($).deleteStack({target:$,retainData:c,signal:S.signal}),E.updateTarget($.id,{status:"deleted"});return r(S,A,"complete"),E.updateTopology(L.id,{status:"destroyed"}),{destroyed:!0,dataRetained:c}},N=async(S)=>{let A=bk(S.operation.input),L=E.execution(String(A.executionId??""));if(!L)throw Error("Regional execution was not found.");let O=E.get(L.topologyId);if(!O)throw Error("Regional topology was not found.");try{let c;if(L.kind==="rollout")c=await t(S,L,O,A);else if(L.kind==="failover"||L.kind==="failback")c=await R(S,L,O);else if(L.kind==="destroy")c=await h(S,L,O,A);else throw Error("Regional reconciliation is not configured.");return E.updateExecution(L.id,{status:"succeeded",currentStep:void 0}),{executionId:L.id,...c}}catch(c){if(E.updateExecution(L.id,{status:S.cancellationRequested()?"cancelled":"failed",error:c instanceof Error?c.message:String(c)}),E.get(O.id)?.status!=="destroyed")E.updateTopology(O.id,{status:"failed"});throw c}};return{"region.rollout":N,"region.failover":N,"region.failback":N,"region.destroy":N,"region.reconcile":N}}class CX{provider;reason;constructor(E,_="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=_}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function kk(){let E=await p(),_=iE(process.cwd(),E),T=new c0(_.store),r=new U0(T);return{controlPlane:_,store:T,service:r}}async function sh(E){let _=await kk();try{await E(_)}catch(T){Q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var $0=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((r)=>r.id===_||r.name===_);if(!T)throw Error("Regional topology was not found.");return T},uk=(E)=>E.split(",").map((_,T)=>{let[r,d="aws"]=_.split(":");return{region:String(r),provider:d,role:T===0?"primary":"secondary"}}),vk=(E)=>{let _=new Set(["s3","dynamodb","secrets"]),T=E.split(",").map((d)=>d.trim()),r=T.find((d)=>!_.has(d));if(r)throw Error(`Unsupported replication kind: ${r}`);return T};function wX(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(_)=>sh((T)=>{let r=T.store.list(T.controlPlane.project.id).map((d)=>({topology:d,targets:T.store.targets(d.id),channels:T.store.channels(d.id),route:T.store.route(d.id),executions:T.store.executions(d.id)}));if(_.json)console.log(JSON.stringify(r,null,2));else o(["Name","Hostname","Active","Status","Revision","Replication"],r.map((d)=>[d.topology.name,d.topology.hostname,d.topology.activeRegion,d.topology.status,d.topology.revision??"—",`${d.channels.filter((t)=>t.status==="in_sync").length}/${d.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(_,T)=>sh((r)=>{if(!T.hostname||!T.regions)throw Error("--hostname and --regions are required.");let d=r.service.create({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:_,hostname:T.hostname,regions:uk(T.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:vk(String(T.replicate)),maxLagSeconds:Number(T.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!T.cdn,wafEnabled:!!T.waf});Z(`Created ${d.name} (${d.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(_,T,r)=>sh((d)=>o(["Step"],d.service.plan($0(d,_).id,T,r.target).map((t)=>[t])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(_,T,r)=>sh(async(d)=>{let t=r.manifest?await Bun.file(r.manifest).json():{},R=d.service.enqueue({topologyId:$0(d,_).id,kind:"rollout",revision:T,manifest:t});Z(`Regional rollout queued: ${R.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(_,T)=>sh((r)=>{let d=r.service.enqueue({topologyId:$0(r,_).id,kind:"failover",targetRegion:T});Z(`Failover queued: ${d.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(_,T)=>sh((r)=>{let d=r.service.enqueue({topologyId:$0(r,_).id,kind:"failback",targetRegion:T});Z(`Failback queued: ${d.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(_,T)=>sh((r)=>{let d=r.service.enqueue({topologyId:$0(r,_).id,kind:"destroy",confirmation:T.confirm});Z(`Regional teardown queued: ${d.operation.id}; replicated data remains retained.`)}))}fE();var D0="0.7.98";import{createHash as eX,createPublicKey as xP,verify as lk}from"node:crypto";function I0(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(I0).join(",")}]`;return`{${Object.keys(E).sort().map((_)=>`${JSON.stringify(_)}:${I0(E[_])}`).join(",")}}`}var bP=(E)=>eX("sha256").update(I0(E)).digest("hex"),d$=(E)=>eX("sha256").update(I0(E)).digest("hex"),kP=(E)=>eX("sha256").update(xP(E).export({type:"spki",format:"der"})).digest("hex");function uP(E,_,T){try{return lk(null,Buffer.from(I0(E)),xP(T),Buffer.from(_,"base64"))}catch{return!1}}var qP=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((_)=>Number(_)||0),gP=(E,_)=>{let T=qP(E),r=qP(_);for(let d=0;d<3;d++){let t=(T[d]??0)-(r[d]??0);if(t)return t}return 0};function vP(E,_){let T=[];if(_.schemaVersion<E.minimumSchema)T.push(`schema ${_.schemaVersion} is below ${E.minimumSchema}`);if(_.schemaVersion>E.maximumSchema)T.push(`schema ${_.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&gP(_.currentVersion,E.minimumVersion)<0)T.push(`platform ${_.currentVersion} is below ${E.minimumVersion}`);if(gP(E.version,_.currentVersion)<=0)T.push(`version ${E.version} is not newer than ${_.currentVersion}`);if(!E.artifacts.some((r)=>r.platform===_.platform&&r.architecture===_.architecture))T.push(`no artifact for ${_.platform}/${_.architecture}`);return{compatible:T.length===0,reasons:T}}var bt=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},FT=(E)=>E==null?void 0:String(E),ik=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:FT(E.revoked_at),createdAt:String(E.created_at)}),nP=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:bt(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:bt(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),lP=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:bt(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),iP=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:FT(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:bt(E.health_gate,{}),status:String(E.status),currentStage:FT(E.current_stage),backupId:FT(E.backup_id),approvedBy:FT(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),XX=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:FT(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:bt(E.evidence,{}),error:FT(E.error),startedAt:FT(E.started_at),finishedAt:FT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),aP=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:bt(E.criteria,{}),candidates:bt(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:FT(E.confirmation),expiresAt:String(E.expires_at),result:bt(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),mP=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:FT(E.backup_policy_id),recoveryPointId:FT(E.recovery_point_id),topologyId:FT(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:FT(E.operation_id),evidence:bt(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:FT(E.error),startedAt:FT(E.started_at),finishedAt:FT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class C0{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}addTrustedKey(E){let _=this.id(),T=this.now().toISOString(),r=kP(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[_,E.organizationId,E.name,E.publicKeyPem,r,T]),this.key(_)}key(E){let _=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return _?ik(_):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let _=this.key(E.keyId);if(!_||_.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(_.revokedAt)throw Error("Update signing key is revoked.");if(!uP(E.document,E.signature,_.publicKeyPem))throw Error("Update manifest signature is invalid.");let T=vP(E.document,E.current),r=bP(E.document),d=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[d,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,r,JSON.stringify(E.document),E.signature,JSON.stringify(T),t]),this.manifest(d)}manifest(E){let _=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return _?nP(_):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(nP)}createWindow(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[_,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,T,T]),this.window(_)}window(E){let _=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return _?lP(_):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(lP)}createCampaign(E){return this.control.transaction(()=>{let _=this.manifest(E.manifestId);if(!_?.compatibility.compatible||_.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let T=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[T,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,r,r]),E.targets.forEach((d,t)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,d.serverId??null,d.target,E.strategy==="canary"?t===0?0:1+Math.floor((t-1)/E.batchSize):Math.floor(t/E.batchSize),d.previousVersion,r,r])),this.campaign(T)})}campaign(E){let _=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return _?iP(_):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(iP)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(XX)}updateCampaign(E,_){let T=this.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let r={...T,..._};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[r.status,r.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!T)throw Error("Upgrade target was not found.");let r={...XX(T),..._};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.evidence),r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),XX(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let _=[...E.candidates].sort((R,h)=>R.id.localeCompare(h.id)),T=d$(_),r=this.id(),d=this.now().toISOString(),t=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[r,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(_),T,_.reduce((R,h)=>R+h.bytes,0),t,d,d]),this.cleanup(r)}cleanup(E){let _=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return _?aP(_):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(aP)}updateCleanup(E,_){let T=this.cleanup(E);if(!T)throw Error("Cleanup plan was not found.");let r={...T,..._};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[r.status,r.confirmation??null,JSON.stringify(r.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[_,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,T,T]),this.drill(_)}drill(E){let _=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return _?mP(_):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(mP)}updateDrill(E,_){let T=this.drill(E);if(!T)throw Error("DR drill was not found.");let r={...T,..._};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,r.operationId??null,JSON.stringify(r.evidence),r.measuredRpoMinutes??null,r.measuredRtoMinutes??null,r.cleanupVerified?1:0,r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}function ak(E,_=new Date){if(!E.enabled)return!1;let T=new Date(E.schedule);if(!Number.isNaN(T.getTime()))return _>=T&&_.getTime()<=T.getTime()+E.durationMinutes*60000;let r=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!r)return!1;let d=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(_),t=Number(d.find((h)=>h.type==="hour")?.value)*60+Number(d.find((h)=>h.type==="minute")?.value),R=Number(r[1])*60+Number(r[2]);return t>=R&&t<R+E.durationMinutes}class w0{store;now;queue;constructor(E,_,T=()=>new Date){this.store=E;this.now=T;this.queue=_??new lE(E.control)}enqueueCampaign(E,_={}){let T=this.store.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let r=T.windowId?this.store.window(T.windowId):void 0;if(r&&!r.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(r&&!_.overrideWindow&&!ak(r,this.now()))throw Error("Upgrade is outside its maintenance window.");if(r?.requireApproval&&!_.approvedBy&&!T.approvedBy)throw Error("Maintenance approval is required.");let d=this.queue.enqueue({projectId:T.projectId,actorId:_.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:d}}async previewCleanup(E,_){let T=_.find((r)=>r.kind===E.kind);if(!T)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await T.discover(E.criteria)})}enqueueCleanup(E,_){let T=this.store.cleanup(E);if(!T||T.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(T.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let r=`DELETE ${T.candidates.length} ${T.kind}`;if(_!==r)throw Error(`Exact confirmation ${r} is required.`);let d=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${T.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:_}),operation:d}}enqueueDrill(E){let _=this.store.drill(E);if(!_||_.status!=="planned")throw Error("A planned DR drill is required.");let T=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${_.scenario}:${_.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:T.id}),operation:T}}}var JX=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function sP(E){return{"maintenance.upgrade":async(d)=>{let t=E.store.campaign(String(JX(d.operation.input).campaignId??""));if(!t||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let R=E.store.manifest(t.manifestId);if(!R?.compatibility.compatible||R.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let h=R.document.artifacts.find((S)=>S.platform===process.platform&&S.architecture===process.arch)??R.document.artifacts[0];if(!h)throw Error("No update artifact matches this platform.");E.store.updateCampaign(t.id,{status:"running",currentStage:"preflight"});let N=[];try{for(let S of[...new Set(E.store.targets(t.id).map((A)=>A.cohort))].sort((A,L)=>A-L)){E.store.updateCampaign(t.id,{currentStage:`cohort:${S}`});for(let A of E.store.targets(t.id).filter((L)=>L.cohort===S)){d.throwIfCancellationRequested(),d.checkpoint(`download:${A.target}`,"Downloading signed platform artifact."),E.store.updateTarget(A.id,{status:"downloading",startedAt:new Date().toISOString()});let L=await E.platform.download({target:A,artifact:h,signal:d.signal});if(L.sha256!==h.sha256)throw Error(`Artifact checksum mismatch for ${A.target}.`);d.checkpoint(`install:${A.target}`,"Installing verified artifact."),E.store.updateTarget(A.id,{status:"installing"}),await E.platform.install({target:A,path:L.path,version:R.version,signal:d.signal}),N.push(A);let O=await E.platform.health({target:A,gate:t.healthGate});if(!O.healthy)throw Error(`Upgrade health gate failed for ${A.target}.`);E.store.updateTarget(A.id,{status:"healthy",evidence:O.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(t.id,{status:"succeeded",currentStage:void 0}),{campaignId:t.id,version:R.version,targets:N.length}}catch(S){E.store.updateCampaign(t.id,{status:"rolling_back",currentStage:"rollback"});for(let A of N.reverse())E.store.updateTarget(A.id,{status:"rolling_back"}),await E.platform.rollback({target:A,version:A.previousVersion,signal:d.signal}),E.store.updateTarget(A.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(t.id,{status:"rolled_back",currentStage:void 0}),S}},"maintenance.cleanup":async(d)=>{let t=E.store.cleanup(String(JX(d.operation.input).planId??""));if(!t||t.status!=="approved")throw Error("Approved cleanup plan was not found.");if(d$([...t.candidates].sort((A,L)=>A.id.localeCompare(L.id)))!==t.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let R=E.cleanup?.find((A)=>A.kind===t.kind);if(!R)throw Error(`No ${t.kind} cleanup driver is configured.`);E.store.updateCleanup(t.id,{status:"running"});let h=[],N=[];for(let A of t.candidates){d.throwIfCancellationRequested();try{await R.remove(A),h.push(A.id)}catch(L){N.push({id:A.id,error:L instanceof Error?L.message:String(L)})}}let S=N.length?h.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(t.id,{status:S,result:{removed:h,failed:N,reclaimedBytes:t.candidates.filter((A)=>h.includes(A.id)).reduce((A,L)=>A+L.bytes,0)}}),N.length)throw Error(`Cleanup failed for ${N.length} candidate(s).`);return{planId:t.id,removed:h.length,reclaimedBytes:t.estimatedBytes}},"maintenance.drill":async(d)=>{let t=E.store.drill(String(JX(d.operation.input).drillId??""));if(!t)throw Error("DR drill was not found.");let R=E.recovery?.find((L)=>L.scenario===t.scenario);if(!R)throw Error(`No ${t.scenario} recovery driver is configured.`);let h=new Date;E.store.updateDrill(t.id,{status:"restoring",startedAt:h.toISOString()});let N=t.isolatedTarget,S={},A={};try{d.checkpoint("restore","Restoring into isolated drill target.");let L=await R.restore({drill:t,signal:d.signal});if(!L.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");N=L.target,S=L.evidence;let O=(h.getTime()-new Date(L.recoveryPointAt).getTime())/60000;E.store.updateDrill(t.id,{status:"verifying",measuredRpoMinutes:O,evidence:{restore:S}}),d.checkpoint("verify","Running recovery health checks without production traffic.");let c=await R.verify({drill:t,target:N});A=c.evidence;let $=(Date.now()-h.getTime())/60000;if(!c.healthy||O>t.expectedRpoMinutes||$>t.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(t.id,{measuredRpoMinutes:O,measuredRtoMinutes:$,evidence:{restore:S,verify:A}})}catch(L){throw E.store.updateDrill(t.id,{status:"failed",error:L instanceof Error?L.message:String(L),evidence:{restore:S,verify:A}}),L}finally{E.store.updateDrill(t.id,{status:"cleaning"});try{await R.cleanup({drill:t,target:N});let L=E.store.drill(t.id);E.store.updateDrill(t.id,{status:L.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(L){E.store.updateDrill(t.id,{status:"cleanup_required",cleanupVerified:!1,error:L instanceof Error?L.message:String(L),finishedAt:new Date().toISOString()})}}return{drillId:t.id,status:E.store.drill(t.id).status}}}}var pP={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class e0{kind;control;projectId;organizationId;constructor(E,_,T,r){this.kind=E;this.control=_;this.projectId=T;this.organizationId=r}async discover(E){let _=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),T=new Date(Date.now()-_*86400000).toISOString(),r=pP[this.kind],d=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(r.select).all(d,T).map((R)=>({id:String(R.id),kind:this.kind,label:`${this.kind}:${String(R.id)}`,bytes:Number(R.bytes??0),metadata:{createdAt:String(R.created_at)}}))}async remove(E){if(this.control.database.run(pP[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function mk(){let E=await p(),_=iE(process.cwd(),E),T=new C0(_.store),r=new w0(T),d=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((t)=>new e0(t,_.store,_.project.id,_.organization.id));return{controlPlane:_,store:T,service:r,cleanup:d}}async function kt(E){let _=await mk();try{await E(_)}catch(T){Q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}function zX(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(_)=>kt((T)=>{let r={manifests:T.store.manifests(T.controlPlane.organization.id),windows:T.store.windows(T.controlPlane.project.id),campaigns:T.store.campaigns(T.controlPlane.project.id),cleanups:T.store.cleanups(T.controlPlane.project.id),drills:T.store.drills(T.controlPlane.project.id)},d=[...r.manifests.map((t)=>["update",t.version,t.compatibility.compatible?"compatible":"blocked",t.compatibility.reasons.join("; ")||t.channel]),...r.campaigns.map((t)=>["upgrade",t.id,t.status,t.currentStage??t.fromVersion]),...r.cleanups.map((t)=>["cleanup",t.kind,t.status,`${t.candidates.length} items / ${t.estimatedBytes} bytes`]),...r.drills.map((t)=>["DR drill",t.scenario,t.status,t.isolatedTarget])];if(_.json)console.log(JSON.stringify(r,null,2));else o(["Area","Name / version","Status","Detail"],d)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(_,T)=>kt(async(r)=>{let d=r.store.addTrustedKey({organizationId:r.controlPlane.organization.id,name:_,publicKeyPem:await Bun.file(T).text()});Z(`Trusted ${d.name}: ${d.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(_,T,r)=>kt(async(d)=>{let t=await Bun.file(_).json(),R=(await Bun.file(T).text()).trim(),h=d.store.importManifest({organizationId:d.controlPlane.organization.id,keyId:r,document:t,signature:R,current:{schemaVersion:d.controlPlane.store.health().schemaVersion,currentVersion:D0,platform:process.platform,architecture:process.arch}});Z(`Verified ${h.version}; ${h.compatibility.compatible?"compatible":"blocked: "+h.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(_,T,r)=>kt((d)=>{let t=d.store.createWindow({projectId:d.controlPlane.project.id,name:_,schedule:T,timezone:r.timezone,durationMinutes:Number(r.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});Z(`Created ${t.name} (${t.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(_,T,r)=>kt((d)=>{let t=new Tt(d.controlPlane.store).list(d.controlPlane.project.id).filter((N)=>N.status==="ready").map((N)=>({serverId:N.id,target:N.name,previousVersion:N.bootstrapVersion??D0}));if(!t.length)t.push({target:"control-plane",previousVersion:D0});let R=d.store.createCampaign({projectId:d.controlPlane.project.id,manifestId:_,fromVersion:D0,strategy:r.strategy==="rolling"?"rolling":"canary",batchSize:Number(r.batch),healthGate:{kind:"platform"},backupId:T,targets:t}),h=d.service.enqueueCampaign(R.id);Z(`Staged upgrade queued: ${h.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(_,T)=>kt(async(r)=>{let d=await r.service.previewCleanup({projectId:r.controlPlane.project.id,kind:_,criteria:{olderThanDays:Number(T.olderThan)}},r.cleanup);o(["ID","Candidate","Bytes"],d.candidates.map((t)=>[t.id,t.label,String(t.bytes)])),U(`Apply with: cloud cleanup:apply ${d.id} --confirm "DELETE ${d.candidates.length} ${d.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(_,T)=>kt((r)=>{let d=r.service.enqueueCleanup(_,String(T.confirm??""));Z(`Cleanup queued: ${d.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(_,T,r)=>kt((d)=>{let t=d.store.createDrill({projectId:d.controlPlane.project.id,scenario:_,isolatedTarget:T,expectedRpoMinutes:Number(r.rpo),expectedRtoMinutes:Number(r.rto),recoveryPointId:r.recoveryPoint,topologyId:r.topology});Z(`Planned isolated drill ${t.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(_)=>kt((T)=>{let r=T.service.enqueueDrill(_);Z(`DR drill queued: ${r.operation.id}`)}))}fE();sR();Gr();async function FX(){try{return(await p()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function jX(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(_)=>{b("Lambda Functions");let T=_?.region||await FX(),r=new B_(T);try{let{Functions:d=[]}=await r.listFunctions({MaxItems:50});if(!d.length){U("No functions found");return}o(["Name","Runtime","Memory","Timeout","Last Modified"],d.map((t)=>[t.FunctionName??"-",t.Runtime??"-",t.MemorySize?`${t.MemorySize} MB`:"-",t.Timeout?`${t.Timeout}s`:"-",t.LastModified??"-"]))}catch(d){Q(`Failed to list functions: ${d.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(_,T)=>{b(`Invoking ${_}`);let r=T?.region||await FX(),d=new B_(r),t=new n("Invoking function...");t.start();try{let R=await d.invoke({FunctionName:_,InvocationType:T?.async?"Event":"RequestResponse",Payload:T?.payload||"{}",LogType:T?.async?"None":"Tail"});if(R.FunctionError){if(t.fail(`Function returned an error (${R.FunctionError})`),R.Payload)U(R.Payload);process.exitCode=1;return}if(t.succeed(`Invoked (status ${R.StatusCode})`),R.Payload)U(`
+`).find((d)=>d&&!d.startsWith("#"))?.trim().split(/\s+/);if(T.code!==0||!r?.[1]||!r[2])throw Error(`SSH host-key scan failed: ${T.stderr.trim()||"no key returned"}`);return{algorithm:r[1],key:r[2]}}async exec(E,_){if(E.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return WP(["ssh","-p",String(E.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${E.sshUser}@${E.endpoint}`,_])}}var Hk=(E)=>`SHA256:${Wk("sha256").update(Buffer.from(E,"base64")).digest("base64").replace(/=+$/,"")}`,Pk=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class qt{provider;transport;discoverer;constructor(E,_=new HP,T){this.provider=E;this.transport=_;this.discoverer=T}discover(E){return this.discoverer?.(E)??Promise.resolve([])}async test(E){try{let _=await this.transport.scan(E.endpoint,E.sshPort);return{reachable:!0,hostKeyAlgorithm:_.algorithm,hostKeyFingerprint:Hk(_.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(E){let _=await this.transport.exec(E,Pk);if(_.code!==0)throw Error(`Fleet validation failed: ${_.stderr.trim()||_.code}`);try{return JSON.parse(_.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(E,_){let T=await this.transport.exec(E,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${_.length}`);if(T.code!==0)throw Error(`Fleet bootstrap failed: ${T.stderr.trim()||T.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function PP(E,_){return{"fleet.bootstrap":async(T)=>{let r=T.operation.input&&typeof T.operation.input==="object"&&!Array.isArray(T.operation.input)?T.operation.input:{},d=E.get(String(r.serverId??""));if(!d)throw Error("Queued fleet server was not found.");let t=_.find((N)=>N.provider===d.provider);if(!t)throw Error(`No ${d.provider} fleet driver is configured.`);let R=Array.isArray(r.steps)?r.steps.map(String):[];if(T.checkpoint("preflight","Rechecking pinned trust and healthy validation."),d.trustState!=="pinned"||!d.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");T.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let h=await t.bootstrap(d,R);return E.update(d.id,{bootstrapVersion:h.version,status:"ready"}),T.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:d.id,bootstrapVersion:h.version,steps:R.length}}}}var _t=(E)=>E==null?void 0:String(E),ah=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},LX=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),resourceId:String(E.resource_id),name:String(E.name),provider:String(E.provider),providerId:_t(E.provider_id),region:_t(E.region),zone:_t(E.zone),endpoint:String(E.endpoint),sshUser:String(E.ssh_user),sshPort:Number(E.ssh_port),credentialRef:String(E.credential_ref),hostKeyAlgorithm:_t(E.host_key_algorithm),hostKeyFingerprint:_t(E.host_key_fingerprint),pendingHostKey:_t(E.pending_host_key),roles:ah(E.roles,[]),labels:ah(E.labels,{}),taints:ah(E.taints,[]),capacity:ah(E.capacity,{}),usage:ah(E.usage,{}),capabilities:ah(E.capabilities,{}),status:String(E.status),trustState:String(E.trust_state),validation:ah(E.validation,void 0),bootstrapVersion:_t(E.bootstrap_version),heartbeatAt:_t(E.heartbeat_at),lastSeenAt:_t(E.last_seen_at),archivedAt:_t(E.archived_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class Tt{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}get(E){let _=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(E);return _?LX(_):void 0}list(E,_=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(E).map(LX).filter((T)=>_||T.status!=="archived")}findProvider(E,_,T){let r=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(E,_,T);return r?LX(r):void 0}create(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.resourceId,E.name,E.provider,E.providerId??null,E.region??null,E.zone??null,E.endpoint,E.sshUser,E.sshPort,E.credentialRef,E.hostKeyAlgorithm??null,E.hostKeyFingerprint??null,E.pendingHostKey??null,JSON.stringify(E.roles),JSON.stringify(E.labels),JSON.stringify(E.taints),JSON.stringify(E.capacity),JSON.stringify(E.usage),JSON.stringify(E.capabilities),E.status,E.trustState,JSON.stringify(E.validation??{}),E.bootstrapVersion??null,E.heartbeatAt??null,E.lastSeenAt??null,E.archivedAt??null,T,T]),this.get(_)}update(E,_){let T=this.get(E);if(!T)throw Error("Server was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[r.name,r.providerId??null,r.region??null,r.zone??null,r.endpoint,r.sshUser,r.sshPort,r.credentialRef,r.hostKeyAlgorithm??null,r.hostKeyFingerprint??null,r.pendingHostKey??null,JSON.stringify(r.roles),JSON.stringify(r.labels),JSON.stringify(r.taints),JSON.stringify(r.capacity),JSON.stringify(r.usage),JSON.stringify(r.capabilities),r.status,r.trustState,JSON.stringify(r.validation??{}),r.bootstrapVersion??null,r.heartbeatAt??null,r.lastSeenAt??null,r.archivedAt??null,d,E]),this.get(E)}}var yk=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class N0{store;drivers;now;queue;constructor(E,_,T,r=()=>new Date){this.store=E;this.drivers=_;this.now=r;this.queue=T??new lE(E.control)}driver(E){let _=this.drivers.find((T)=>T.provider===E);if(!_)throw Error(`No ${E} fleet driver is configured.`);return _}enroll(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Server name is invalid.");if(!yk.test(E.endpoint)||E.sshUser==="root"||!E.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let _=E.providerId?this.store.findProvider(E.organizationId,E.provider,E.providerId):void 0;if(_)return this.store.update(_.id,{endpoint:E.endpoint,region:E.region,zone:E.zone});let T=this.store.control.createResource({projectId:E.projectId,kind:"server",slug:E.name,name:E.name,provider:E.provider,providerId:E.providerId}),r=this.driver(E.provider);return this.store.create({...E,resourceId:T.id,sshPort:E.sshPort??22,labels:E.labels??{},taints:[],capacity:{},usage:{},capabilities:r.capabilities(),status:"pending",trustState:"unverified"})}async test(E){let _=this.store.get(E);if(!_)throw Error("Server was not found.");let T=await this.driver(_.provider).test(_);if(!T.reachable)return this.store.update(E,{status:"unreachable"});if(_.hostKeyFingerprint&&_.hostKeyFingerprint!==T.hostKeyFingerprint)return this.store.update(E,{status:"degraded",trustState:"rotation_pending",pendingHostKey:T.hostKeyFingerprint});return this.store.update(E,{hostKeyAlgorithm:T.hostKeyAlgorithm,hostKeyFingerprint:T.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(E,_){let T=this.store.get(E);if(!T||T.pendingHostKey!==_)throw Error("Pending host key does not match.");return this.store.update(E,{hostKeyFingerprint:_,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(E){let _=this.store.get(E);if(!_||_.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let T=await this.driver(_.provider).validate(_),r=[];if(!["x64","arm64","x86_64","aarch64"].includes(T.arch??""))r.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let R of["curl","tar"])if(!T.tools?.[R])r.push({code:`tool.${R}`,severity:"error",message:`${R} is missing.`,remediation:`Install ${R} before bootstrap.`});if(Math.abs(T.timeSkewSeconds??0)>60)r.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!T.dnsOk)r.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let d={valid:!r.some((R)=>R.severity==="error"),facts:T,findings:r,validatedAt:this.now().toISOString(),validatorVersion:"1"},t={cpu:T.cpuCores??0,memoryBytes:T.memoryBytes??0,diskBytes:T.diskBytes??0};return this.store.update(E,{validation:d,capacity:t,status:d.valid?"ready":"degraded"})}bootstrap(E,_=!1){let T=this.store.get(E);if(!T?.validation?.valid)throw Error("A healthy validation report is required.");let r=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!_)return{preview:!0,steps:r};let d=this.queue.enqueue({projectId:T.projectId,resourceId:T.resourceId,kind:"fleet.bootstrap",input:{serverId:E,steps:r},lockKey:`server:${E}`,providerKey:T.provider}).operation;return{preview:!1,steps:r,operation:d}}heartbeat(E,_){let T=this.store.get(E);if(!T)throw Error("Server was not found.");let r=this.now().toISOString();return this.store.update(E,{usage:_.usage,capabilities:_.capabilities??T.capabilities,heartbeatAt:r,lastSeenAt:r,status:T.status==="draining"||T.status==="drained"?T.status:"ready"})}drain(E,_=!1){return this.store.update(E,{status:_?"drained":"draining"})}uncordon(E){return this.store.update(E,{status:"ready"})}archive(E,_){let T=this.store.get(E);if(!T||_!==T.name)throw Error("Exact server name confirmation is required.");return this.store.update(E,{status:"archived",archivedAt:this.now().toISOString()})}}async function Yk(){let E=await p(),_=iE(process.cwd(),E),T=new Tt(_.store),r=new N0(T,[new qt("aws"),new qt("hetzner"),new qt("ssh")]);return{controlPlane:_,store:T,service:r}}async function gt(E){let _=await Yk();try{return await E(_)}finally{_.controlPlane.store.close()}}var mh=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((r)=>r.id===_||r.name===_);if(!T)throw Error(`Server ${_} was not found.`);return T},rd=(E)=>{Q(E instanceof Error?E.message:String(E)),process.exitCode=1};function OX(E,_){let T=Number.parseInt(E??"",10);return Number.isFinite(T)&&T>=0?T:_}function Qk(E="3h"){let _=E.match(/^(\d+)(m|h)$/);if(!_)throw Error("--range must use minutes or hours, for example 30m or 3h.");let T=Number(_[1])*(_[2]==="h"?3600000:60000);if(T<300000||T>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return T}function S0(E,_="%"){return E==null?"unavailable":`${E.toFixed(1)}${_}`}async function Gk(E,_){let T=await p();if(T.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let r=_.env??process.env.CLOUD_ENV??"production",d=C_(T,r),t=await Bd(d);if(!t?.serverId)throw Error(`No pinned Hetzner server was found for ${d}.`);if(![t.serverName,String(t.serverId),t.stackName].includes(E))throw Error(`Refusing to read ${E}: project state is pinned to ${t.serverName}.`);let R=HS(T),h=new ft({apiToken:PS(R.apiToken,T)}),N=await h.getServer(t.serverId),S=t.publicIp??N.public_net.ipv4?.ip;if(!S)throw Error(`Server ${N.name} has no public IPv4 address.`);let A=new Date,L=new Date(A.getTime()-Qk(_.range)),O=Math.min(3600,Math.max(60,OX(_.step,60))),c=await LP({client:h,serverId:N.id,cores:Math.max(1,Number(N.server_type.cores)||1),from:L,to:A,step:O,remote:{host:S,user:t.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15}});if(_.json){console.log(JSON.stringify({schemaVersion:1,server:N.name,result:c},null,2));return}o(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[N.name,`${c.from} to ${c.to}`,`${S0(c.summary.cpuAveragePercent)} / ${S0(c.summary.cpuPeakPercent)}`,`${S0(c.summary.memoryAveragePercent)} / ${S0(c.summary.memoryPeakPercent)}`,c.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(c.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,S0(c.summary.swapPeakPercent)]])}function yP(E){let _=E.targetType.prices?.find((T)=>T.location===E.location);return{serverId:E.serverId,serverName:E.serverName,location:E.location,from:E.currentType.name,to:E.targetType.name,capacityAvailable:E.capacityAvailable,alreadyComplete:E.alreadyComplete,upgradeDisk:E.upgradeDisk,target:{cores:E.targetType.cores,memoryGb:E.targetType.memory,diskGb:E.targetType.disk,architecture:E.targetType.architecture,cpuType:E.targetType.cpu_type},price:_?{hourlyNet:_.price_hourly.net,hourlyGross:_.price_hourly.gross,monthlyNet:_.price_monthly.net,monthlyGross:_.price_monthly.gross}:void 0}}function Mk(E){let _=yP(E);o(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${_.serverName} (${_.serverId})`,_.location,`${_.from} -> ${_.to}`,_.capacityAvailable?"available":"waiting",`${_.target.cores??0} / ${_.target.memoryGb??0} GB / ${_.target.diskGb??0} GB`,_.price?.monthlyGross??_.price?.monthlyNet??"not reported"]])}async function fk(E,_,T){let r=await p();if(r.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let d=T.env??process.env.CLOUD_ENV??"production",t=C_(r,d),R=await Bd(t),h=HS(r),N=new ft({apiToken:PS(h.apiToken,r)}),A=R&&(E===R.serverName||E===String(R.serverId)||E===R.stackName)?await N.getServer(R.serverId):(await N.listServers()).find((Y)=>Y.name===E||String(Y.id)===E);if(!A)throw Error(`Hetzner server ${E} was not found.`);if(R?.serverId&&R.serverId!==A.id)throw Error(`Refusing to resize ${E}: project state is pinned to server ${R.serverId}.`);let L=Kt(_),O=T.upgradeDisk!==!1,c=await h0(N,A.id,L,O);if(T.json)console.log(JSON.stringify({schemaVersion:1,plan:yP(c)},null,2));else Mk(c);if(!T.apply){if(!T.json)U(`Preview only. Re-run with --apply --confirm ${A.name} to execute.`);return}if(T.confirm!==A.name)throw Error(`Resize requires --confirm ${A.name}.`);let $=R?.publicIp??A.public_net.ipv4?.ip;if(!$)throw Error(`Server ${A.name} has no public IPv4 address for verification.`);let I={host:$,user:R?.sshUser??h.sshUser,identityFile:h.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},C=await NX(t),e=new Date().toISOString(),z={schemaVersion:1,operationId:C?.targetType===L&&C.serverId===A.id?C.operationId:crypto.randomUUID(),stackName:t,serverId:A.id,serverName:A.name,sourceType:c.currentType.name,targetType:L,upgradeDisk:O,phase:"planning",status:"running",attempts:C?.targetType===L?C.attempts:0,startedAt:C?.targetType===L?C.startedAt:e,updatedAt:e,manifest:C?.targetType===L?C.manifest:void 0};await Zt(z);let F=OX(T.pollSeconds,900)*1000,B=OX(T.maxWaitMinutes,0)*60000,y=Date.now();for(;;){let Y=await h0(N,A.id,L,O);if(!Y.capacityAvailable&&!Y.alreadyComplete){if(z={...z,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await Zt(z),!T.wait){if(!T.json)U(`${L} has no capacity in ${Y.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(B>0&&Date.now()-y>=B)throw Error(`Timed out waiting for ${L} capacity in ${Y.location}.`);if(!T.json)U(`Waiting ${Math.round(F/1000)} seconds for ${L} capacity...`);await Bun.sleep(F);continue}let M=await SX(t);try{let V=await(async()=>{try{return z={...z,status:"running",attempts:z.attempts+1,updatedAt:new Date().toISOString()},await Zt(z),await TX({client:N,serverId:A.id,targetType:L,upgradeDisk:O,resumeFromOff:z.phase==="shutting-down"||z.phase==="resizing"||z.phase==="powering-on"||z.phase==="verifying",manifest:z.manifest,hooks:{preflight:async()=>{let g=await dX(I);return z={...z,manifest:g,updatedAt:new Date().toISOString()},await Zt(z),g},afterBoot:async(g,k,v,EE)=>tX(I,k,v,EE),onPhase:async(g,k)=>{if(z={...z,phase:g,status:g==="waiting-capacity"?"waiting-capacity":g==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await Zt(z),!T.json)U(`${g}${k?` ${JSON.stringify(k)}`:""}`)}}})}finally{await M()}})();if(z={...z,status:V.status==="completed"||V.status==="already-complete"?"completed":V.status==="recovered"?"recovered":"waiting-capacity",lastError:V.status==="recovered"?V.error:void 0,updatedAt:new Date().toISOString()},await Zt(z),T.json)console.log(JSON.stringify({schemaVersion:1,result:V},null,2));else if(V.status==="completed"||V.status==="already-complete")Z(`${A.name} is on ${L} and passed full post-boot verification.`);else if(V.status==="recovered"&&V.retryable&&T.wait){U(`Capacity race recovered safely. Waiting ${Math.round(F/1000)} seconds before retry.`),await Bun.sleep(F);continue}else if(V.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${V.error}`);return}catch(V){throw z={...z,status:"failed",lastError:V instanceof Error?V.message:String(V),updatedAt:new Date().toISOString()},await Zt(z),V}}}async function Kk(E,_){let T=await p();if(T.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let r=_.env??process.env.CLOUD_ENV??"production",d=C_(T,r),t=await Bd(d);if(!t?.serverId)throw Error(`No pinned Hetzner server was found for ${d}.`);if(![t.serverName,String(t.serverId),t.stackName].includes(E))throw Error(`Refusing to optimize ${E}: project state is pinned to ${t.serverName}.`);let R=HS(T),h=new ft({apiToken:PS(R.apiToken,T)}),N=await h.getServer(t.serverId),S=t.publicIp??N.public_net.ipv4?.ip;if(!S)throw Error(`Server ${N.name} has no public IPv4 address.`);let A=pU(T);if(_.json)console.log(JSON.stringify({schemaVersion:1,server:N.name,plan:A},null,2));else o(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[N.name,A.firewallPorts.join(","),A.monitoring?"on":"off",A.autoUpdates?"on":"off",`${A.swapGb} GB`,"disabled"]]);if(!_.apply){if(!_.json)U(`Preview only. Re-run with --apply --confirm ${N.name} to execute.`);return}if(_.confirm!==N.name)throw Error(`Optimization requires --confirm ${N.name}.`);let L={host:S,user:t.sshUser??R.sshUser,identityFile:R.sshPrivateKeyPath,connectTimeoutSec:15},O=await VS(L),c=O.routeProbes.filter((v)=>!v.ok),$=T.infrastructure?.compute,I=$r($)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,C=O.failedUnits.filter((v)=>!I.has(v));if(C.length>0)throw Error(`Preflight found failed services: ${C.join(", ")}`);if(c.length>0)throw Error(`Preflight found unhealthy routes: ${c.map((v)=>v.domain).join(", ")}`);let e=$r($)?[]:Object.values(T.sites??{}).flatMap((v)=>typeof v?.port==="number"&&![80,443].includes(v.port)?[v.port]:[]),z=QS({allowSsh:$?.allowSsh!==!1,sitePorts:e,allowedPorts:$?.firewall?.allowedPorts}),F=(t.firewallId?(await h.listFirewalls()).find((v)=>v.id===t.firewallId):void 0)??(await h.listFirewalls()).find((v)=>v.name===`${T.project.slug}-${r}-app-fw`);if(!F)throw Error(`Managed firewall for ${N.name} was not found.`);let B=await h.setFirewallRules(F.id,z);await Promise.all(B.map((v)=>h.waitForAction(v.id))),await ae(T,L);let[y,Y]=await Promise.all([VS(L),me(L)]),M=se(A,Y),V=CP(O,y),g=y.routeProbes.filter((v)=>!v.ok);if(V.stoppedServices.length>0)M.push(`services stopped: ${V.stoppedServices.join(", ")}`);if(V.changedRouteFragments.length>0)M.push(`route fragments changed: ${V.changedRouteFragments.join(", ")}`);if(V.missingRouteIds.length>0)M.push(`routes disappeared: ${V.missingRouteIds.join(", ")}`);if(V.changedReleaseLinks.length>0)M.push(`release links changed: ${V.changedReleaseLinks.join(", ")}`);if(V.missingData.length>0)M.push(`databases or volumes disappeared: ${V.missingData.join(", ")}`);if(g.length>0)M.push(`unhealthy routes: ${g.map((v)=>v.domain).join(", ")}`);if(M.length>0)throw Error(`Host optimization verification failed: ${M.join("; ")}`);let k={serverId:N.id,serverName:N.name,services:y.runningServices.length,routes:y.routeIds.length,healthyDomains:y.routeProbes.length,releaseLinks:y.releaseLinks.length,databasesAndVolumes:y.dataCatalog.length,report:Y};if(_.json)console.log(JSON.stringify({schemaVersion:1,result:k},null,2));else Z(`${N.name} passed full host, rpx route, service, release, and data verification.`)}function cX(E){E.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(_,T)=>{try{await gt(async(r)=>{let d=_?[mh(r,_)]:r.store.list(r.controlPlane.project.id),t=d.flatMap((R)=>Object.entries(R.capabilities).map(([h,N])=>({server:R.name,provider:R.provider,action:h,...N})));if(T.json)console.log(JSON.stringify({schemaVersion:1,targets:t},null,2));else o(["Server","Provider","Action","Support","Explanation"],t.map((R)=>[R.server,R.provider,R.action,R.supported?"supported":"unsupported",R.reason??"—"]))})}catch(r){rd(r)}}),E.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(_,T,r)=>{try{await fk(_,T,r)}catch(d){rd(d)}}),E.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(_,T)=>{try{await Kk(_,T)}catch(r){rd(r)}}),E.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(_,T)=>{try{await Gk(_,T)}catch(r){rd(r)}}),E.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(_)=>{try{await gt(async(T)=>{let r=T.store.list(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(r,null,2));else o(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],r.map((d)=>[d.name,d.providerId??"—",`${d.provider} / ${d.region??"external"}`,`${d.status} / ${d.trustState}`,d.roles.join(","),`${d.capacity.cpu??0} / ${d.capacity.memoryBytes??0}`,d.heartbeatAt??"never"]))})}catch(T){rd(T)}}),E.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(_,T)=>{try{await gt(async(r)=>{let d=T.provider;if(!["aws","hetzner","ssh"].includes(d)||!T.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let t=r.service.enroll({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:_,provider:d,providerId:T.providerId,endpoint:T.endpoint,sshUser:T.user??"deploy",credentialRef:T.credentialRef??"secret://fleet/agent",region:T.region,roles:String(T.roles??"application").split(","),labels:Object.fromEntries(String(T.labels??"").split(",").map((R)=>R.split("=")).filter((R)=>R[0]&&R[1]))});Z(`Enrolled ${t.name} as ${t.id}; no remote mutation was performed.`)})}catch(r){rd(r)}}),E.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(_,T)=>{try{await gt(async(r)=>{let d=mh(r,_);if(d=await r.service.test(d.id),d.trustState==="rotation_pending"){if(!T.acceptHostKey)throw Error(`Host key changed to ${d.pendingHostKey}; review it first.`);d=r.service.reviewHostKey(d.id,T.acceptHostKey)}let t=await r.service.validate(d.id);if(T.json)console.log(JSON.stringify(t.validation,null,2));else o(["Severity","Code","Finding","Remediation"],(t.validation?.findings??[]).map((R)=>[R.severity,R.code,R.message,R.remediation??"—"]));if(!t.validation?.valid)process.exitCode=1})}catch(r){rd(r)}}),E.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(_,T)=>{try{await gt(async(r)=>{let d=r.service.bootstrap(mh(r,_).id,!!T.apply);if(d.preview)o(["Step"],d.steps.map((t)=>[t]));else Z(`Bootstrap queued: ${d.operation?.id}`)})}catch(r){rd(r)}}),E.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(_,T)=>{try{await gt(async(r)=>Z(r.service.drain(mh(r,_).id,!!T.complete).status))}catch(r){rd(r)}}),E.command("server:uncordon <name>","Return a server to scheduling").action(async(_)=>{try{await gt(async(T)=>{T.service.uncordon(mh(T,_).id),Z(`Uncordoned ${_}.`)})}catch(T){rd(T)}}),E.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(_,T)=>{try{await gt(async(r)=>{r.service.archive(mh(r,_).id,T.confirm??""),Z(`Archived ${_}; provider infrastructure was not terminated.`)})}catch(r){rd(r)}}),E.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(_)=>{try{await gt(async(T)=>{let r=mh(T,_);if(r.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let d=Bun.spawn(["ssh","-p",String(r.sshPort),"-o","StrictHostKeyChecking=yes",`${r.sshUser}@${r.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),t=await d.exited;if(t)process.exitCode=t})}catch(T){rd(T)}});for(let[_,T]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])E.command(_,T).action(async(...r)=>Ed(_.split(" ")[0],{target:String(r[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}fE();var Wd=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},Dr=(E)=>E==null?void 0:String(E),GP=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),qS=(E={})=>({...GP(),...E});function YP(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),purpose:String(E.purpose),backend:String(E.backend),region:Dr(E.region),architecture:Dr(E.architecture),labels:Wd(E.labels,{}),requiredServerLabels:Wd(E.required_server_labels,{}),toleratedTaints:Wd(E.tolerated_taints,[]),capacity:qS(Wd(E.capacity,{})),reserved:Wd(E.reserved,{}),maxWorkloads:Number(E.max_workloads),costWeight:Number(E.cost_weight),spreadKey:Dr(E.spread_key),concurrency:Number(E.concurrency),ephemeralWorkspaces:Number(E.ephemeral_workspaces)===1,allowProductionSecrets:Number(E.allow_production_secrets)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function QP(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Dr(E.environment_id),resourceId:String(E.resource_id),releaseId:Dr(E.release_id),poolId:String(E.pool_id),serverId:Dr(E.server_id),purpose:String(E.purpose),requirements:Wd(E.requirements,{}),decision:Wd(E.decision,{}),stateful:Number(E.stateful)===1,autoReschedule:Number(E.auto_reschedule)===1,status:String(E.status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Vk(E){return{id:String(E.id),projectId:String(E.project_id),resourceId:Dr(E.resource_id),poolId:String(E.pool_id),placementId:Dr(E.placement_id),operationId:Dr(E.operation_id),sourceSha:String(E.source_sha),buildSpec:Wd(E.build_spec,{}),credentialPolicy:Wd(E.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:Dr(E.workspace),cacheKey:Dr(E.cache_key),artifactUri:Dr(E.artifact_uri),artifactDigest:Dr(E.artifact_digest),status:String(E.status),cleanupAt:Dr(E.cleanup_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class A0{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}createPool(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.name,E.purpose,E.backend,E.region??null,E.architecture??null,JSON.stringify(E.labels),JSON.stringify(E.requiredServerLabels),JSON.stringify(E.toleratedTaints),JSON.stringify(qS(E.capacity)),"{}",E.maxWorkloads,E.costWeight,E.spreadKey??null,E.concurrency,E.ephemeralWorkspaces?1:0,E.allowProductionSecrets?1:0,E.status,T,T]),this.getPool(_)}getPool(E){let _=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(E);return _?YP(_):void 0}listPools(E){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(E).map(YP)}updatePool(E,_){let T=this.getPool(E);if(!T)throw Error("Capacity pool was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.reserved),JSON.stringify(r.capacity),r.concurrency,d,E]),this.getPool(E)}addMember(E,_,T={}){let r=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[E,_,JSON.stringify(T),r,r])}members(E){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(E).map((_)=>({serverId:String(_.server_id),status:String(_.status),capacityOverride:Wd(_.capacity_override,{})}))}memberStatus(E,_,T){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[T,this.now().toISOString(),E,_])}listPlacements(E,_){let T=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(E).map(QP);return _?.length?T.filter((r)=>_.includes(r.status)):T}getPlacement(E){let _=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(E);return _?QP(_):void 0}activeUsage(E,_){let T=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(E,this.now().toISOString()),r=_?T.filter((d)=>String(d.server_id)===_):T;return{resources:r.reduce((d,t)=>{let R=qS(Wd(t.resources,{}));for(let h of Object.keys(d))d[h]+=R[h];return d},GP()),count:r.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(E){return this.control.transaction(()=>{this.expireLeases();let _=this.id(),T=this.id(),r=this.now().toISOString(),d=new Date(this.now().getTime()+(E.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[_,E.projectId,E.environmentId??null,E.resourceId,E.releaseId??null,E.decision.poolId,E.decision.serverId??null,E.requirements.purpose,JSON.stringify(E.requirements),JSON.stringify(E.decision),E.requirements.stateful?1:0,E.requirements.autoReschedule&&!E.requirements.stateful?1:0,r,r]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[T,_,E.decision.poolId,E.decision.serverId??null,JSON.stringify(qS(E.requirements.resources)),d,r,r]),this.getPlacement(_)})}transitionPlacement(E,_){if(!this.getPlacement(E))throw Error("Placement was not found.");let r=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[_,r,E]),["released","failed","blocked"].includes(_))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[r,E]);return this.getPlacement(E)}createBuild(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[_,E.projectId,E.resourceId??null,E.poolId,E.placementId??null,E.operationId??null,E.sourceSha,JSON.stringify(E.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:E.tokenExpiresAt}),T,T]),this.getBuild(_)}getBuild(E){let _=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(E);return _?Vk(_):void 0}updateBuild(E,_){let T=this.getBuild(E);if(!T)throw Error("Remote build was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[r.operationId??null,r.workspace??null,r.cacheKey??null,r.artifactUri??null,r.artifactDigest??null,r.status,r.cleanupAt??null,d,E]),this.getBuild(E)}}var T$=["cpu","memoryBytes","diskBytes","gpu"],MP=(E,_={})=>Object.entries(_).every(([T,r])=>E[T]===r),Zk=(E,_,T)=>Object.fromEntries(T$.map((r)=>[r,Math.max(0,E[r]-_[r]-(T[r]??0))])),qk=(E,_)=>T$.every((T)=>E[T]>=(_[T]??0)),gk=(E,_)=>T$.reduce((T,r)=>T+(_[r]??0)/(E[r]||1),0);class L0{store;fleet;constructor(E,_){this.store=E;this.fleet=_}poolCandidates(E,_,T){let r=[];for(let d of this.store.listPools(E)){if(d.id===T)continue;let t=[];if(d.status!=="active")t.push(`pool is ${d.status}`);if(d.purpose!==_.purpose)t.push(`purpose is ${d.purpose}`);if(_.region&&d.region!==_.region)t.push(`region is ${d.region??"unset"}`);if(_.architecture&&d.architecture!==_.architecture)t.push(`architecture is ${d.architecture??"unset"}`);if(!MP(d.labels,_.labels))t.push("pool labels do not match");if(d.backend==="server"){let R=this.store.members(d.id);if(!R.length)r.push(this.decision(d,void 0,_,[...t,"pool has no servers"]));for(let h of R){let N=this.fleet.get(h.serverId),S=[...t];if(!N)S.push("server is missing");else this.serverReasons(d,N,h.status,_,S);r.push(this.decision(d,N,_,S,h.capacityOverride))}}else r.push(this.decision(d,void 0,_,t))}return r.sort((d,t)=>Number(t.eligible)-Number(d.eligible)||d.score.cost-t.score.cost||d.score.spread-t.score.spread||d.score.fit-t.score.fit||d.poolName.localeCompare(t.poolName)||(d.serverId??"").localeCompare(t.serverId??""))}serverReasons(E,_,T,r,d){if(T!=="active")d.push(`member is ${T}`);if(_.status!=="ready")d.push(`server is ${_.status}`);if(!_.roles.includes(r.purpose==="build"?"build":r.purpose))d.push(`server lacks ${r.purpose} role`);if(!MP(_.labels,E.requiredServerLabels))d.push("server labels do not match pool selector");for(let t of _.taints)if(!E.toleratedTaints.includes(t))d.push(`taint ${t} is not tolerated`)}decision(E,_,T,r,d={}){let t=qS({..._?.capacity,...d}),R=_?Object.fromEntries(T$.map((S)=>[S,Math.min(E.capacity[S],t[S])])):E.capacity,h=this.store.activeUsage(E.id,_?.id),N=Zk(R,h.resources,E.reserved);if(h.count>=E.maxWorkloads)r.push("workload limit reached");if(T.purpose==="build"&&h.count>=E.concurrency)r.push("build concurrency reached");if(!qk(N,T.resources))r.push("insufficient capacity");return{poolId:E.id,poolName:E.name,serverId:_?.id,eligible:r.length===0,reasons:r,available:N,score:{fit:gk(N,T.resources),spread:h.count,cost:E.costWeight}}}explain(E,_){return this.poolCandidates(E,_)}place(E){return this.store.control.transaction(()=>{let _=this.poolCandidates(E.projectId,E.requirements).find((T)=>T.eligible);if(!_)throw Error(`No eligible capacity: ${this.explain(E.projectId,E.requirements).flatMap((T)=>T.reasons).join("; ")}`);return this.store.reserve({...E,decision:_})})}activate(E){return this.store.transitionPlacement(E,"active")}release(E){return this.store.transitionPlacement(E,"released")}drainPool(E){let _=this.store.updatePool(E,{status:"draining"}),T=[],r=[];for(let d of this.store.listPlacements(_.projectId,["reserved","active"]).filter((t)=>t.poolId===E)){if(d.stateful){r.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"moving");let t=this.place({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements});T.push(this.activate(t.id)),this.store.transitionPlacement(d.id,"released")}return{pool:_,moved:T,blocked:r}}drainServer(E,_){this.store.memberStatus(E,_,"draining");let T=this.store.getPool(E);if(!T)throw Error("Capacity pool was not found.");let r=[],d=[];for(let t of this.store.listPlacements(T.projectId,["reserved","active"]).filter((R)=>R.poolId===E&&R.serverId===_)){if(t.stateful){d.push(this.store.transitionPlacement(t.id,"blocked"));continue}this.store.transitionPlacement(t.id,"moving");let R=this.poolCandidates(t.projectId,t.requirements).find((N)=>N.eligible);if(!R){d.push(this.store.transitionPlacement(t.id,"blocked"));continue}let h=this.store.reserve({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.resourceId,releaseId:t.releaseId,requirements:t.requirements,decision:R});r.push(this.activate(h.id)),this.store.transitionPlacement(t.id,"released")}return{moved:r,blocked:d}}reconcileFailure(E){let _=this.fleet.get(E);if(!_)throw Error("Server was not found.");let T=[],r=[];for(let d of this.store.listPlacements(_.projectId,["active"]).filter((t)=>t.serverId===E)){if(d.stateful||!d.autoReschedule){r.push(this.store.transitionPlacement(d.id,"blocked"));continue}this.store.transitionPlacement(d.id,"failed");let t=this.place({projectId:d.projectId,environmentId:d.environmentId,resourceId:d.resourceId,releaseId:d.releaseId,requirements:d.requirements});T.push(this.activate(t.id))}return{rescheduled:T,blocked:r}}}async function xk(){let E=await p(),_=iE(process.cwd(),E),T=new A0(_.store),r=new L0(T,new Tt(_.store));return{controlPlane:_,store:T,service:r}}async function O0(E){let _=await xk();try{await E(_)}catch(T){Q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var r$=(E)=>Object.fromEntries(String(E??"").split(",").map((_)=>_.split("=")).filter((_)=>_[0]&&_[1])),fP=(E)=>Object.fromEntries(Object.entries(r$(E)).map(([_,T])=>[_,Number(T)]));function UX(E){E.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(_)=>O0((T)=>{let r=T.store.listPools(T.controlPlane.project.id);if(_.json)console.log(JSON.stringify(r,null,2));else o(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],r.map((d)=>[d.name,d.purpose,d.backend,`${d.region??"any"} / ${d.architecture??"any"}`,d.status,JSON.stringify(d.capacity),String(d.concurrency)]))})),E.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(_,T)=>O0((r)=>{let{purpose:d,backend:t}=T;if(!["application","build","worker","monitoring","backup"].includes(d)||!["server","ecs","asg"].includes(t))throw Error("Unsupported pool purpose or backend.");let R=r.store.createPool({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:_,purpose:d,backend:t,region:T.region,architecture:T.arch,labels:r$(T.labels),requiredServerLabels:r$(T.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...fP(T.capacity)},maxWorkloads:Number(T.max),costWeight:1,concurrency:Number(T.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});Z(`Created ${R.name} (${R.id}).`)})),E.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(_,T)=>O0((r)=>{let d=r.store.listPools(r.controlPlane.project.id).find((R)=>R.id===_||R.name===_),t=new Tt(r.controlPlane.store).list(r.controlPlane.project.id).find((R)=>R.id===T||R.name===T);if(!d||!t)throw Error("Pool or server was not found.");r.store.addMember(d.id,t.id),Z(`Attached ${t.name} to ${d.name}.`)})),E.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(_)=>O0((T)=>{let r=T.service.explain(T.controlPlane.project.id,{purpose:_.purpose,resources:fP(_.resources),region:_.region,architecture:_.arch,labels:r$(_.labels)});if(_.json)console.log(JSON.stringify(r,null,2));else o(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],r.map((d)=>[d.poolName,d.serverId??"provider-managed",d.eligible?"yes":"no",JSON.stringify(d.available),`${d.score.fit.toFixed(2)} / ${d.score.spread} / ${d.score.cost}`,d.reasons.join("; ")||"eligible"]))})),E.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(_)=>O0((T)=>{let r=T.store.listPools(T.controlPlane.project.id).find((t)=>t.id===_||t.name===_);if(!r)throw Error("Pool was not found.");let d=T.service.drainPool(r.id);Z(`Draining ${r.name}: moved ${d.moved.length}, blocked ${d.blocked.length} stateful placement(s).`)}))}fE();var xt=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},dd=(E)=>E==null?void 0:String(E),KP=(E)=>({id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:dd(E.environment_id),name:String(E.name),hostname:String(E.hostname),homeRegion:String(E.home_region),regions:xt(E.regions,[]),trafficPolicy:String(E.traffic_policy),dataPolicy:xt(E.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(E.status),activeRegion:String(E.active_region),revision:dd(E.revision),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),$X=(E)=>({id:String(E.id),topologyId:String(E.topology_id),region:String(E.region),role:String(E.role),provider:String(E.provider),stackId:dd(E.stack_id),stackRevision:dd(E.stack_revision),status:String(E.status),health:xt(E.health,{}),lastHealthyAt:dd(E.last_healthy_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),DX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),kind:String(E.kind),sourceRegion:String(E.source_region),targetRegion:String(E.target_region),config:xt(E.config,{}),status:String(E.status),checkpoint:dd(E.checkpoint),lagSeconds:E.lag_seconds==null?void 0:Number(E.lag_seconds),lastVerifiedAt:dd(E.last_verified_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),IX=(E)=>({id:String(E.id),topologyId:String(E.topology_id),hostname:String(E.hostname),dnsProvider:String(E.dns_provider),cdnEnabled:Number(E.cdn_enabled)===1,wafEnabled:Number(E.waf_enabled)===1,weights:xt(E.weights,{}),desiredWeights:xt(E.desired_weights,{}),status:String(E.status),providerState:xt(E.provider_state,{}),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),VP=(E)=>({id:String(E.id),topologyId:String(E.topology_id),operationId:dd(E.operation_id),kind:String(E.kind),requestedRegion:dd(E.requested_region),revision:dd(E.revision),plan:xt(E.plan,[]),currentStep:dd(E.current_step),completedSteps:xt(E.completed_steps,[]),status:String(E.status),error:dd(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class c0{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}create(E){return this.control.transaction(()=>{if(E.regions.length<2||new Set(E.regions.map((t)=>t.region)).size!==E.regions.length||E.regions.filter((t)=>t.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let _=E.regions.find((t)=>t.role==="primary"),T=this.id(),r=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[T,E.organizationId,E.projectId,E.environmentId??null,E.name,E.hostname,_.region,JSON.stringify(E.regions),E.trafficPolicy,JSON.stringify(E.dataPolicy),_.region,r,r]);for(let t of E.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),T,t.region,t.role,t.provider,r,r]);for(let t of E.dataPolicy.replicate)for(let R of E.regions)for(let h of E.regions.filter((N)=>N.region!==R.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,t,R.region,h.region,"{}",r,r]);let d=Object.fromEntries(E.regions.map((t)=>[t.region,t.region===_.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),T,E.hostname,E.dnsProvider??"route53",E.cdnEnabled?1:0,E.wafEnabled?1:0,JSON.stringify(d),JSON.stringify(d),r,r]),this.get(T)})}get(E){let _=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(E);return _?KP(_):void 0}list(E){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(E).map(KP)}targets(E){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(E).map($X)}channels(E){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(E).map(DX)}route(E){let _=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(E);return _?IX(_):void 0}updateTopology(E,_){let T=this.get(E);if(!T)throw Error("Regional topology was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[r.status,r.activeRegion,r.revision??null,JSON.stringify(r.regions),d,E]),this.get(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E);if(!T)throw Error("Regional target was not found.");let r=$X(T),d={...r,..._},t=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[d.role,d.stackId??null,d.stackRevision??null,d.status,JSON.stringify(d.health),d.lastHealthyAt??null,t,E]),$X(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(E))}updateChannel(E,_){let T=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E);if(!T)throw Error("Replication channel was not found.");let r=DX(T),d={...r,..._},t=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[d.status,d.checkpoint??null,d.lagSeconds??null,d.lastVerifiedAt??null,t,E]),DX(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(E))}updateRoute(E,_){let T=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E);if(!T)throw Error("Traffic route was not found.");let r=IX(T),d={...r,..._},t=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(d.weights),JSON.stringify(d.desiredWeights),d.status,JSON.stringify(d.providerState),t,E]),IX(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(E))}createExecution(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[_,E.topologyId,E.operationId??null,E.kind,E.requestedRegion??null,E.revision??null,JSON.stringify(E.plan),T,T]),this.execution(_)}execution(E){let _=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(E);return _?VP(_):void 0}executions(E){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(E).map(VP)}updateExecution(E,_){let T=this.execution(E);if(!T)throw Error("Regional execution was not found.");let r={...T,..._},d=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[r.operationId??null,r.currentStep??null,JSON.stringify(r.completedSteps),r.status,r.error??null,d,E]),this.execution(E)}}class U0{store;queue;constructor(E,_){this.store=E;this.queue=_??new lE(E.control)}create(E){return this.store.create(E)}plan(E,_,T){if(!this.store.get(E))throw Error("Regional topology was not found.");let d=this.store.targets(E),t=this.store.channels(E);if(_==="rollout")return[...d.filter((R)=>R.role==="secondary").map((R)=>`apply:${R.region}`),...d.filter((R)=>R.role==="primary").map((R)=>`apply:${R.region}`),...t.map((R)=>`replicate:${R.kind}:${R.targetRegion}`),"traffic:activate"];if(_==="failover"||_==="failback")return[`health:${T}`,`replication:${T}`,`traffic:${T}`,`roles:${T}`];if(_==="destroy")return["traffic:drain",...d.filter((R)=>R.role==="secondary").map((R)=>`delete:${R.region}`),...d.filter((R)=>R.role==="primary").map((R)=>`delete:${R.region}`),"complete"];return["observe","repair"]}enqueue(E){let _=this.store.get(E.topologyId);if(!_)throw Error("Regional topology was not found.");if(["failover","failback"].includes(E.kind)&&(!E.targetRegion||!_.regions.some((t)=>t.region===E.targetRegion)))throw Error("A topology target region is required.");if(E.kind==="failover"&&E.targetRegion===_.activeRegion)throw Error("Target region is already active.");if((E.kind==="destroy"||E.deleteData)&&E.confirmation!==_.name)throw Error("Exact topology name confirmation is required.");if(E.deleteData&&_.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(E.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(E.revision??""))throw Error("An immutable revision is required.");let T=this.plan(_.id,E.kind,E.targetRegion),r=this.store.createExecution({topologyId:_.id,kind:E.kind,requestedRegion:E.targetRegion,revision:E.revision,plan:T}),d=this.queue.enqueue({projectId:_.projectId,environmentId:_.environmentId,kind:`region.${E.kind}`,input:{executionId:r.id,manifest:E.manifest??{},deleteData:E.deleteData===!0},lockKey:`regional-topology:${_.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(r.id,{operationId:d.id}),{execution:this.store.execution(r.id),operation:d}}}var bk=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function ZP(E,_){let T=(S)=>{let A=_.find((L)=>L.provider===S.provider);if(!A)throw Error(`No ${S.provider} regional driver is configured.`);return A},r=(S,A,L)=>{S.throwIfCancellationRequested(),S.checkpoint(L,L),E.updateExecution(A.id,{status:"running",currentStep:L,completedSteps:[...E.execution(A.id).completedSteps,L]})},d=async(S,A)=>{let L=E.route(S.id);if(!L)throw Error("Regional traffic route was not found.");let O=E.targets(S.id).find(($)=>$.region===S.activeRegion)??E.targets(S.id)[0];if(!O)throw Error("Regional traffic target was not found.");E.updateRoute(L.id,{status:"applying",desiredWeights:A});let c=await T(O).applyTraffic({route:E.route(S.id),topology:S,weights:A});E.updateRoute(L.id,{status:Object.values(A).every(($)=>$===0)?"drained":"in_sync",weights:A,providerState:c.providerState})},t=async(S,A,L,O)=>{E.updateTopology(L.id,{status:"provisioning"});let c=A.revision,$=O.manifest??{},I=E.targets(L.id).sort((e,z)=>Number(e.role==="primary")-Number(z.role==="primary"));for(let e of I){r(S,A,`apply:${e.region}`),E.updateTarget(e.id,{status:"provisioning"});let z=await T(e).applyStack({target:e,revision:c,manifest:$,signal:S.signal}),F=await T(e).health({target:E.updateTarget(e.id,{stackId:z.stackId,stackRevision:c})});if(!F.healthy)throw Error(`Regional health gate failed in ${e.region}.`);E.updateTarget(e.id,{status:"ready",health:F.evidence,lastHealthyAt:new Date().toISOString()})}for(let e of E.channels(L.id)){r(S,A,`replicate:${e.kind}:${e.targetRegion}`),E.updateChannel(e.id,{status:"configuring"});let z=I.find((y)=>y.region===e.sourceRegion),F=await T(z).configureReplication({channel:e,topology:L}),B=await T(z).verifyReplication({channel:E.updateChannel(e.id,{checkpoint:F.checkpoint,lagSeconds:F.lagSeconds}),topology:L});if(!B.healthy||B.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${e.kind} replication to ${e.targetRegion} exceeds the RPO.`);E.updateChannel(e.id,{status:"in_sync",checkpoint:B.checkpoint,lagSeconds:B.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(S,A,"traffic:activate");let C=Object.fromEntries(L.regions.map((e)=>[e.region,e.region===L.activeRegion?100:0]));return await d(L,C),E.updateTopology(L.id,{status:"ready",revision:c}),{revision:c,activeRegion:L.activeRegion}},R=async(S,A,L)=>{let O=A.requestedRegion,c=E.targets(L.id).find((C)=>C.region===O);if(!c)throw Error("Requested regional target was not found.");E.updateTopology(L.id,{status:A.kind==="failover"?"failing_over":"failing_back"}),r(S,A,`health:${O}`);let $=await T(c).health({target:c});if(!$.healthy)throw Error(`Target region ${O} is unhealthy.`);E.updateTarget(c.id,{status:"ready",health:$.evidence,lastHealthyAt:new Date().toISOString()}),r(S,A,`replication:${O}`);for(let C of E.channels(L.id).filter((e)=>e.targetRegion===O)){let e=await T(c).verifyReplication({channel:C,topology:L});if(!e.healthy||e.lagSeconds>L.dataPolicy.maxLagSeconds)throw Error(`${C.kind} replication is outside the failover RPO.`);E.updateChannel(C.id,{status:"in_sync",checkpoint:e.checkpoint,lagSeconds:e.lagSeconds,lastVerifiedAt:new Date().toISOString()})}r(S,A,`traffic:${O}`),await d(L,Object.fromEntries(L.regions.map((C)=>[C.region,C.region===O?100:0]))),r(S,A,`roles:${O}`);let I=L.regions.map((C)=>({...C,role:C.region===O?"primary":"secondary"}));for(let C of E.targets(L.id))E.updateTarget(C.id,{role:C.region===O?"primary":"secondary"});return E.updateTopology(L.id,{status:A.kind==="failover"?"failed_over":"ready",activeRegion:O,regions:I}),{activeRegion:O}},h=async(S,A,L,O)=>{E.updateTopology(L.id,{status:"destroying"}),r(S,A,"traffic:drain"),await d(L,Object.fromEntries(L.regions.map(($)=>[$.region,0])));let c=O.deleteData!==!0;for(let $ of E.targets(L.id).sort((I,C)=>Number(I.role==="primary")-Number(C.role==="primary")))r(S,A,`delete:${$.region}`),E.updateTarget($.id,{status:"deleting"}),await T($).deleteStack({target:$,retainData:c,signal:S.signal}),E.updateTarget($.id,{status:"deleted"});return r(S,A,"complete"),E.updateTopology(L.id,{status:"destroyed"}),{destroyed:!0,dataRetained:c}},N=async(S)=>{let A=bk(S.operation.input),L=E.execution(String(A.executionId??""));if(!L)throw Error("Regional execution was not found.");let O=E.get(L.topologyId);if(!O)throw Error("Regional topology was not found.");try{let c;if(L.kind==="rollout")c=await t(S,L,O,A);else if(L.kind==="failover"||L.kind==="failback")c=await R(S,L,O);else if(L.kind==="destroy")c=await h(S,L,O,A);else throw Error("Regional reconciliation is not configured.");return E.updateExecution(L.id,{status:"succeeded",currentStep:void 0}),{executionId:L.id,...c}}catch(c){if(E.updateExecution(L.id,{status:S.cancellationRequested()?"cancelled":"failed",error:c instanceof Error?c.message:String(c)}),E.get(O.id)?.status!=="destroyed")E.updateTopology(O.id,{status:"failed"});throw c}};return{"region.rollout":N,"region.failover":N,"region.failback":N,"region.destroy":N,"region.reconcile":N}}class CX{provider;reason;constructor(E,_="Configure a regional provider transport before executing this operation."){this.provider=E;this.reason=_}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}async function kk(){let E=await p(),_=iE(process.cwd(),E),T=new c0(_.store),r=new U0(T);return{controlPlane:_,store:T,service:r}}async function sh(E){let _=await kk();try{await E(_)}catch(T){Q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}var $0=(E,_)=>{let T=E.store.list(E.controlPlane.project.id).find((r)=>r.id===_||r.name===_);if(!T)throw Error("Regional topology was not found.");return T},uk=(E)=>E.split(",").map((_,T)=>{let[r,d="aws"]=_.split(":");return{region:String(r),provider:d,role:T===0?"primary":"secondary"}}),vk=(E)=>{let _=new Set(["s3","dynamodb","secrets"]),T=E.split(",").map((d)=>d.trim()),r=T.find((d)=>!_.has(d));if(r)throw Error(`Unsupported replication kind: ${r}`);return T};function wX(E){E.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(_)=>sh((T)=>{let r=T.store.list(T.controlPlane.project.id).map((d)=>({topology:d,targets:T.store.targets(d.id),channels:T.store.channels(d.id),route:T.store.route(d.id),executions:T.store.executions(d.id)}));if(_.json)console.log(JSON.stringify(r,null,2));else o(["Name","Hostname","Active","Status","Revision","Replication"],r.map((d)=>[d.topology.name,d.topology.hostname,d.topology.activeRegion,d.topology.status,d.topology.revision??"—",`${d.channels.filter((t)=>t.status==="in_sync").length}/${d.channels.length} in sync`]))})),E.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(_,T)=>sh((r)=>{if(!T.hostname||!T.regions)throw Error("--hostname and --regions are required.");let d=r.service.create({organizationId:r.controlPlane.organization.id,projectId:r.controlPlane.project.id,name:_,hostname:T.hostname,regions:uk(T.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:vk(String(T.replicate)),maxLagSeconds:Number(T.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!T.cdn,wafEnabled:!!T.waf});Z(`Created ${d.name} (${d.id}); run region:rollout with an immutable manifest.`)})),E.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(_,T,r)=>sh((d)=>o(["Step"],d.service.plan($0(d,_).id,T,r.target).map((t)=>[t])))),E.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(_,T,r)=>sh(async(d)=>{let t=r.manifest?await Bun.file(r.manifest).json():{},R=d.service.enqueue({topologyId:$0(d,_).id,kind:"rollout",revision:T,manifest:t});Z(`Regional rollout queued: ${R.operation.id}`)})),E.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(_,T)=>sh((r)=>{let d=r.service.enqueue({topologyId:$0(r,_).id,kind:"failover",targetRegion:T});Z(`Failover queued: ${d.operation.id}`)})),E.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(_,T)=>sh((r)=>{let d=r.service.enqueue({topologyId:$0(r,_).id,kind:"failback",targetRegion:T});Z(`Failback queued: ${d.operation.id}`)})),E.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(_,T)=>sh((r)=>{let d=r.service.enqueue({topologyId:$0(r,_).id,kind:"destroy",confirmation:T.confirm});Z(`Regional teardown queued: ${d.operation.id}; replicated data remains retained.`)}))}fE();var D0="0.7.99";import{createHash as eX,createPublicKey as xP,verify as lk}from"node:crypto";function I0(E){if(E===null||typeof E!=="object")return JSON.stringify(E);if(Array.isArray(E))return`[${E.map(I0).join(",")}]`;return`{${Object.keys(E).sort().map((_)=>`${JSON.stringify(_)}:${I0(E[_])}`).join(",")}}`}var bP=(E)=>eX("sha256").update(I0(E)).digest("hex"),d$=(E)=>eX("sha256").update(I0(E)).digest("hex"),kP=(E)=>eX("sha256").update(xP(E).export({type:"spki",format:"der"})).digest("hex");function uP(E,_,T){try{return lk(null,Buffer.from(I0(E)),xP(T),Buffer.from(_,"base64"))}catch{return!1}}var qP=(E)=>E.replace(/^v/,"").split(/[.-]/).slice(0,3).map((_)=>Number(_)||0),gP=(E,_)=>{let T=qP(E),r=qP(_);for(let d=0;d<3;d++){let t=(T[d]??0)-(r[d]??0);if(t)return t}return 0};function vP(E,_){let T=[];if(_.schemaVersion<E.minimumSchema)T.push(`schema ${_.schemaVersion} is below ${E.minimumSchema}`);if(_.schemaVersion>E.maximumSchema)T.push(`schema ${_.schemaVersion} is above ${E.maximumSchema}`);if(E.minimumVersion&&gP(_.currentVersion,E.minimumVersion)<0)T.push(`platform ${_.currentVersion} is below ${E.minimumVersion}`);if(gP(E.version,_.currentVersion)<=0)T.push(`version ${E.version} is not newer than ${_.currentVersion}`);if(!E.artifacts.some((r)=>r.platform===_.platform&&r.architecture===_.architecture))T.push(`no artifact for ${_.platform}/${_.architecture}`);return{compatible:T.length===0,reasons:T}}var bt=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}},FT=(E)=>E==null?void 0:String(E),ik=(E)=>({id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),algorithm:"ed25519",publicKeyPem:String(E.public_key_pem),fingerprint:String(E.fingerprint),revokedAt:FT(E.revoked_at),createdAt:String(E.created_at)}),nP=(E)=>({id:String(E.id),organizationId:String(E.organization_id),version:String(E.version),channel:String(E.channel),publishedAt:String(E.published_at),keyId:String(E.key_id),digest:String(E.digest),document:bt(E.document,{}),signature:String(E.signature),verificationStatus:String(E.verification_status),compatibility:bt(E.compatibility,{compatible:!1,reasons:[]}),createdAt:String(E.created_at)}),lP=(E)=>({id:String(E.id),projectId:String(E.project_id),name:String(E.name),schedule:String(E.schedule),timezone:String(E.timezone),durationMinutes:Number(E.duration_minutes),allowedOperations:bt(E.allowed_operations,[]),requireApproval:Number(E.require_approval)===1,enabled:Number(E.enabled)===1,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),iP=(E)=>({id:String(E.id),projectId:String(E.project_id),manifestId:String(E.manifest_id),windowId:FT(E.window_id),fromVersion:String(E.from_version),strategy:String(E.strategy),batchSize:Number(E.batch_size),healthGate:bt(E.health_gate,{}),status:String(E.status),currentStage:FT(E.current_stage),backupId:FT(E.backup_id),approvedBy:FT(E.approved_by),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),XX=(E)=>({id:String(E.id),campaignId:String(E.campaign_id),serverId:FT(E.server_id),target:String(E.target),cohort:Number(E.cohort),previousVersion:String(E.previous_version),status:String(E.status),evidence:bt(E.evidence,{}),error:FT(E.error),startedAt:FT(E.started_at),finishedAt:FT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),aP=(E)=>({id:String(E.id),projectId:String(E.project_id),kind:String(E.kind),criteria:bt(E.criteria,{}),candidates:bt(E.candidates,[]),candidateDigest:String(E.candidate_digest),estimatedBytes:Number(E.estimated_bytes),status:String(E.status),confirmation:FT(E.confirmation),expiresAt:String(E.expires_at),result:bt(E.result,{}),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}),mP=(E)=>({id:String(E.id),projectId:String(E.project_id),backupPolicyId:FT(E.backup_policy_id),recoveryPointId:FT(E.recovery_point_id),topologyId:FT(E.topology_id),scenario:String(E.scenario),isolatedTarget:String(E.isolated_target),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),status:String(E.status),operationId:FT(E.operation_id),evidence:bt(E.evidence,{}),measuredRpoMinutes:E.measured_rpo_minutes==null?void 0:Number(E.measured_rpo_minutes),measuredRtoMinutes:E.measured_rto_minutes==null?void 0:Number(E.measured_rto_minutes),cleanupVerified:Number(E.cleanup_verified)===1,error:FT(E.error),startedAt:FT(E.started_at),finishedAt:FT(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)});class C0{control;now;id;constructor(E,_=()=>new Date,T=()=>crypto.randomUUID()){this.control=E;this.now=_;this.id=T}addTrustedKey(E){let _=this.id(),T=this.now().toISOString(),r=kP(E.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[_,E.organizationId,E.name,E.publicKeyPem,r,T]),this.key(_)}key(E){let _=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(E);return _?ik(_):void 0}revokeKey(E){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),E]),this.key(E)}importManifest(E){let _=this.key(E.keyId);if(!_||_.organizationId!==E.organizationId)throw Error("Trusted update key was not found.");if(_.revokedAt)throw Error("Update signing key is revoked.");if(!uP(E.document,E.signature,_.publicKeyPem))throw Error("Update manifest signature is invalid.");let T=vP(E.document,E.current),r=bP(E.document),d=this.id(),t=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[d,E.organizationId,E.document.version,E.document.channel,new Date(E.document.publishedAt).toISOString(),E.keyId,r,JSON.stringify(E.document),E.signature,JSON.stringify(T),t]),this.manifest(d)}manifest(E){let _=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(E);return _?nP(_):void 0}manifests(E){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(E).map(nP)}createWindow(E){let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[_,E.projectId,E.name,E.schedule,E.timezone,E.durationMinutes,JSON.stringify(E.allowedOperations),E.requireApproval===!1?0:1,T,T]),this.window(_)}window(E){let _=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(E);return _?lP(_):void 0}windows(E){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(E).map(lP)}createCampaign(E){return this.control.transaction(()=>{let _=this.manifest(E.manifestId);if(!_?.compatibility.compatible||_.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!E.backupId)throw Error("A verified pre-upgrade backup is required.");let T=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[T,E.projectId,E.manifestId,E.windowId??null,E.fromVersion,E.strategy,E.batchSize,JSON.stringify(E.healthGate),E.backupId,E.approvedBy??null,r,r]),E.targets.forEach((d,t)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),T,d.serverId??null,d.target,E.strategy==="canary"?t===0?0:1+Math.floor((t-1)/E.batchSize):Math.floor(t/E.batchSize),d.previousVersion,r,r])),this.campaign(T)})}campaign(E){let _=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(E);return _?iP(_):void 0}campaigns(E){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(E).map(iP)}targets(E){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(E).map(XX)}updateCampaign(E,_){let T=this.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let r={...T,..._};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[r.status,r.currentStage??null,this.now().toISOString(),E]),this.campaign(E)}updateTarget(E,_){let T=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E);if(!T)throw Error("Upgrade target was not found.");let r={...XX(T),..._};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,JSON.stringify(r.evidence),r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),XX(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(E))}createCleanup(E){let _=[...E.candidates].sort((R,h)=>R.id.localeCompare(h.id)),T=d$(_),r=this.id(),d=this.now().toISOString(),t=new Date(this.now().getTime()+(E.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[r,E.projectId,E.kind,JSON.stringify(E.criteria),JSON.stringify(_),T,_.reduce((R,h)=>R+h.bytes,0),t,d,d]),this.cleanup(r)}cleanup(E){let _=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(E);return _?aP(_):void 0}cleanups(E){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(E).map(aP)}updateCleanup(E,_){let T=this.cleanup(E);if(!T)throw Error("Cleanup plan was not found.");let r={...T,..._};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[r.status,r.confirmation??null,JSON.stringify(r.result),this.now().toISOString(),E]),this.cleanup(E)}createDrill(E){if(!/^isolated:\/\//.test(E.isolatedTarget))throw Error("DR drills require an isolated target.");let _=this.id(),T=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[_,E.projectId,E.backupPolicyId??null,E.recoveryPointId??null,E.topologyId??null,E.scenario,E.isolatedTarget,E.expectedRpoMinutes,E.expectedRtoMinutes,T,T]),this.drill(_)}drill(E){let _=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(E);return _?mP(_):void 0}drills(E){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(E).map(mP)}updateDrill(E,_){let T=this.drill(E);if(!T)throw Error("DR drill was not found.");let r={...T,..._};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[r.status,r.operationId??null,JSON.stringify(r.evidence),r.measuredRpoMinutes??null,r.measuredRtoMinutes??null,r.cleanupVerified?1:0,r.error??null,r.startedAt??null,r.finishedAt??null,this.now().toISOString(),E]),this.drill(E)}}function ak(E,_=new Date){if(!E.enabled)return!1;let T=new Date(E.schedule);if(!Number.isNaN(T.getTime()))return _>=T&&_.getTime()<=T.getTime()+E.durationMinutes*60000;let r=/^(\d{2}):(\d{2})$/.exec(E.schedule);if(!r)return!1;let d=new Intl.DateTimeFormat("en-US",{timeZone:E.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(_),t=Number(d.find((h)=>h.type==="hour")?.value)*60+Number(d.find((h)=>h.type==="minute")?.value),R=Number(r[1])*60+Number(r[2]);return t>=R&&t<R+E.durationMinutes}class w0{store;now;queue;constructor(E,_,T=()=>new Date){this.store=E;this.now=T;this.queue=_??new lE(E.control)}enqueueCampaign(E,_={}){let T=this.store.campaign(E);if(!T)throw Error("Upgrade campaign was not found.");let r=T.windowId?this.store.window(T.windowId):void 0;if(r&&!r.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(r&&!_.overrideWindow&&!ak(r,this.now()))throw Error("Upgrade is outside its maintenance window.");if(r?.requireApproval&&!_.approvedBy&&!T.approvedBy)throw Error("Maintenance approval is required.");let d=this.queue.enqueue({projectId:T.projectId,actorId:_.approvedBy,kind:"maintenance.upgrade",input:{campaignId:E},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(E,{status:"queued"}),operation:d}}async previewCleanup(E,_){let T=_.find((r)=>r.kind===E.kind);if(!T)throw Error(`No ${E.kind} cleanup driver is configured.`);return this.store.createCleanup({...E,candidates:await T.discover(E.criteria)})}enqueueCleanup(E,_){let T=this.store.cleanup(E);if(!T||T.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(T.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let r=`DELETE ${T.candidates.length} ${T.kind}`;if(_!==r)throw Error(`Exact confirmation ${r} is required.`);let d=this.queue.enqueue({projectId:T.projectId,kind:"maintenance.cleanup",input:{planId:E},lockKey:`cleanup:${T.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(E,{status:"approved",confirmation:_}),operation:d}}enqueueDrill(E){let _=this.store.drill(E);if(!_||_.status!=="planned")throw Error("A planned DR drill is required.");let T=this.queue.enqueue({projectId:_.projectId,kind:"maintenance.drill",input:{drillId:E},lockKey:`drill:${_.scenario}:${_.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(E,{status:"queued",operationId:T.id}),operation:T}}}var JX=(E)=>E&&typeof E==="object"&&!Array.isArray(E)?E:{};function sP(E){return{"maintenance.upgrade":async(d)=>{let t=E.store.campaign(String(JX(d.operation.input).campaignId??""));if(!t||!E.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let R=E.store.manifest(t.manifestId);if(!R?.compatibility.compatible||R.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let h=R.document.artifacts.find((S)=>S.platform===process.platform&&S.architecture===process.arch)??R.document.artifacts[0];if(!h)throw Error("No update artifact matches this platform.");E.store.updateCampaign(t.id,{status:"running",currentStage:"preflight"});let N=[];try{for(let S of[...new Set(E.store.targets(t.id).map((A)=>A.cohort))].sort((A,L)=>A-L)){E.store.updateCampaign(t.id,{currentStage:`cohort:${S}`});for(let A of E.store.targets(t.id).filter((L)=>L.cohort===S)){d.throwIfCancellationRequested(),d.checkpoint(`download:${A.target}`,"Downloading signed platform artifact."),E.store.updateTarget(A.id,{status:"downloading",startedAt:new Date().toISOString()});let L=await E.platform.download({target:A,artifact:h,signal:d.signal});if(L.sha256!==h.sha256)throw Error(`Artifact checksum mismatch for ${A.target}.`);d.checkpoint(`install:${A.target}`,"Installing verified artifact."),E.store.updateTarget(A.id,{status:"installing"}),await E.platform.install({target:A,path:L.path,version:R.version,signal:d.signal}),N.push(A);let O=await E.platform.health({target:A,gate:t.healthGate});if(!O.healthy)throw Error(`Upgrade health gate failed for ${A.target}.`);E.store.updateTarget(A.id,{status:"healthy",evidence:O.evidence,finishedAt:new Date().toISOString()})}}return E.store.updateCampaign(t.id,{status:"succeeded",currentStage:void 0}),{campaignId:t.id,version:R.version,targets:N.length}}catch(S){E.store.updateCampaign(t.id,{status:"rolling_back",currentStage:"rollback"});for(let A of N.reverse())E.store.updateTarget(A.id,{status:"rolling_back"}),await E.platform.rollback({target:A,version:A.previousVersion,signal:d.signal}),E.store.updateTarget(A.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw E.store.updateCampaign(t.id,{status:"rolled_back",currentStage:void 0}),S}},"maintenance.cleanup":async(d)=>{let t=E.store.cleanup(String(JX(d.operation.input).planId??""));if(!t||t.status!=="approved")throw Error("Approved cleanup plan was not found.");if(d$([...t.candidates].sort((A,L)=>A.id.localeCompare(L.id)))!==t.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let R=E.cleanup?.find((A)=>A.kind===t.kind);if(!R)throw Error(`No ${t.kind} cleanup driver is configured.`);E.store.updateCleanup(t.id,{status:"running"});let h=[],N=[];for(let A of t.candidates){d.throwIfCancellationRequested();try{await R.remove(A),h.push(A.id)}catch(L){N.push({id:A.id,error:L instanceof Error?L.message:String(L)})}}let S=N.length?h.length?"partial":"failed":"succeeded";if(E.store.updateCleanup(t.id,{status:S,result:{removed:h,failed:N,reclaimedBytes:t.candidates.filter((A)=>h.includes(A.id)).reduce((A,L)=>A+L.bytes,0)}}),N.length)throw Error(`Cleanup failed for ${N.length} candidate(s).`);return{planId:t.id,removed:h.length,reclaimedBytes:t.estimatedBytes}},"maintenance.drill":async(d)=>{let t=E.store.drill(String(JX(d.operation.input).drillId??""));if(!t)throw Error("DR drill was not found.");let R=E.recovery?.find((L)=>L.scenario===t.scenario);if(!R)throw Error(`No ${t.scenario} recovery driver is configured.`);let h=new Date;E.store.updateDrill(t.id,{status:"restoring",startedAt:h.toISOString()});let N=t.isolatedTarget,S={},A={};try{d.checkpoint("restore","Restoring into isolated drill target.");let L=await R.restore({drill:t,signal:d.signal});if(!L.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");N=L.target,S=L.evidence;let O=(h.getTime()-new Date(L.recoveryPointAt).getTime())/60000;E.store.updateDrill(t.id,{status:"verifying",measuredRpoMinutes:O,evidence:{restore:S}}),d.checkpoint("verify","Running recovery health checks without production traffic.");let c=await R.verify({drill:t,target:N});A=c.evidence;let $=(Date.now()-h.getTime())/60000;if(!c.healthy||O>t.expectedRpoMinutes||$>t.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");E.store.updateDrill(t.id,{measuredRpoMinutes:O,measuredRtoMinutes:$,evidence:{restore:S,verify:A}})}catch(L){throw E.store.updateDrill(t.id,{status:"failed",error:L instanceof Error?L.message:String(L),evidence:{restore:S,verify:A}}),L}finally{E.store.updateDrill(t.id,{status:"cleaning"});try{await R.cleanup({drill:t,target:N});let L=E.store.drill(t.id);E.store.updateDrill(t.id,{status:L.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(L){E.store.updateDrill(t.id,{status:"cleanup_required",cleanupVerified:!1,error:L instanceof Error?L.message:String(L),finishedAt:new Date().toISOString()})}}return{drillId:t.id,status:E.store.drill(t.id).status}}}}var pP={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class e0{kind;control;projectId;organizationId;constructor(E,_,T,r){this.kind=E;this.control=_;this.projectId=T;this.organizationId=r}async discover(E){let _=Math.max(1,Math.min(3650,Number(E.olderThanDays??30))),T=new Date(Date.now()-_*86400000).toISOString(),r=pP[this.kind],d=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(r.select).all(d,T).map((R)=>({id:String(R.id),kind:this.kind,label:`${this.kind}:${String(R.id)}`,bytes:Number(R.bytes??0),metadata:{createdAt:String(R.created_at)}}))}async remove(E){if(this.control.database.run(pP[this.kind].remove,[E.id]).changes!==1)throw Error(`${E.label} changed or is no longer removable.`)}}async function mk(){let E=await p(),_=iE(process.cwd(),E),T=new C0(_.store),r=new w0(T),d=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((t)=>new e0(t,_.store,_.project.id,_.organization.id));return{controlPlane:_,store:T,service:r,cleanup:d}}async function kt(E){let _=await mk();try{await E(_)}catch(T){Q(T instanceof Error?T.message:String(T)),process.exitCode=1}finally{_.controlPlane.store.close()}}function zX(E){E.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(_)=>kt((T)=>{let r={manifests:T.store.manifests(T.controlPlane.organization.id),windows:T.store.windows(T.controlPlane.project.id),campaigns:T.store.campaigns(T.controlPlane.project.id),cleanups:T.store.cleanups(T.controlPlane.project.id),drills:T.store.drills(T.controlPlane.project.id)},d=[...r.manifests.map((t)=>["update",t.version,t.compatibility.compatible?"compatible":"blocked",t.compatibility.reasons.join("; ")||t.channel]),...r.campaigns.map((t)=>["upgrade",t.id,t.status,t.currentStage??t.fromVersion]),...r.cleanups.map((t)=>["cleanup",t.kind,t.status,`${t.candidates.length} items / ${t.estimatedBytes} bytes`]),...r.drills.map((t)=>["DR drill",t.scenario,t.status,t.isolatedTarget])];if(_.json)console.log(JSON.stringify(r,null,2));else o(["Area","Name / version","Status","Detail"],d)})),E.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(_,T)=>kt(async(r)=>{let d=r.store.addTrustedKey({organizationId:r.controlPlane.organization.id,name:_,publicKeyPem:await Bun.file(T).text()});Z(`Trusted ${d.name}: ${d.fingerprint}`)})),E.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(_,T,r)=>kt(async(d)=>{let t=await Bun.file(_).json(),R=(await Bun.file(T).text()).trim(),h=d.store.importManifest({organizationId:d.controlPlane.organization.id,keyId:r,document:t,signature:R,current:{schemaVersion:d.controlPlane.store.health().schemaVersion,currentVersion:D0,platform:process.platform,architecture:process.arch}});Z(`Verified ${h.version}; ${h.compatibility.compatible?"compatible":"blocked: "+h.compatibility.reasons.join("; ")}`)})),E.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(_,T,r)=>kt((d)=>{let t=d.store.createWindow({projectId:d.controlPlane.project.id,name:_,schedule:T,timezone:r.timezone,durationMinutes:Number(r.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});Z(`Created ${t.name} (${t.id}).`)})),E.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(_,T,r)=>kt((d)=>{let t=new Tt(d.controlPlane.store).list(d.controlPlane.project.id).filter((N)=>N.status==="ready").map((N)=>({serverId:N.id,target:N.name,previousVersion:N.bootstrapVersion??D0}));if(!t.length)t.push({target:"control-plane",previousVersion:D0});let R=d.store.createCampaign({projectId:d.controlPlane.project.id,manifestId:_,fromVersion:D0,strategy:r.strategy==="rolling"?"rolling":"canary",batchSize:Number(r.batch),healthGate:{kind:"platform"},backupId:T,targets:t}),h=d.service.enqueueCampaign(R.id);Z(`Staged upgrade queued: ${h.operation.id}`)})),E.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(_,T)=>kt(async(r)=>{let d=await r.service.previewCleanup({projectId:r.controlPlane.project.id,kind:_,criteria:{olderThanDays:Number(T.olderThan)}},r.cleanup);o(["ID","Candidate","Bytes"],d.candidates.map((t)=>[t.id,t.label,String(t.bytes)])),U(`Apply with: cloud cleanup:apply ${d.id} --confirm "DELETE ${d.candidates.length} ${d.kind}"`)})),E.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(_,T)=>kt((r)=>{let d=r.service.enqueueCleanup(_,String(T.confirm??""));Z(`Cleanup queued: ${d.operation.id}`)})),E.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(_,T,r)=>kt((d)=>{let t=d.store.createDrill({projectId:d.controlPlane.project.id,scenario:_,isolatedTarget:T,expectedRpoMinutes:Number(r.rpo),expectedRtoMinutes:Number(r.rto),recoveryPointId:r.recoveryPoint,topologyId:r.topology});Z(`Planned isolated drill ${t.id}.`)})),E.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(_)=>kt((T)=>{let r=T.service.enqueueDrill(_);Z(`DR drill queued: ${r.operation.id}`)}))}fE();sR();Gr();async function FX(){try{return(await p()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function jX(E){E.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(_)=>{b("Lambda Functions");let T=_?.region||await FX(),r=new B_(T);try{let{Functions:d=[]}=await r.listFunctions({MaxItems:50});if(!d.length){U("No functions found");return}o(["Name","Runtime","Memory","Timeout","Last Modified"],d.map((t)=>[t.FunctionName??"-",t.Runtime??"-",t.MemorySize?`${t.MemorySize} MB`:"-",t.Timeout?`${t.Timeout}s`:"-",t.LastModified??"-"]))}catch(d){Q(`Failed to list functions: ${d.message}`),process.exitCode=1}}),E.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(_,T)=>{b(`Invoking ${_}`);let r=T?.region||await FX(),d=new B_(r),t=new n("Invoking function...");t.start();try{let R=await d.invoke({FunctionName:_,InvocationType:T?.async?"Event":"RequestResponse",Payload:T?.payload||"{}",LogType:T?.async?"None":"Tail"});if(R.FunctionError){if(t.fail(`Function returned an error (${R.FunctionError})`),R.Payload)U(R.Payload);process.exitCode=1;return}if(t.succeed(`Invoked (status ${R.StatusCode})`),R.Payload)U(`
 Response:`),U(R.Payload);if(R.LogResult)U(`
 Logs:`),U(Buffer.from(R.LogResult,"base64").toString("utf-8"))}catch(R){t.fail(`Invocation failed: ${R.message}`),process.exitCode=1}}),E.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(_,T)=>{b(`Logs for ${_}`);let r=T?.region||await FX(),d=new Ir(r),t=_.startsWith("/aws/lambda/")?_:`/aws/lambda/${_}`,R=Number(T?.since??15),h=(N)=>{for(let S of N){let A=S.timestamp?new Date(S.timestamp).toISOString():"";U(`${A}  ${(S.message??"").trimEnd()}`)}};try{let N=Date.now()-R*60000,{events:S=[]}=await d.filterLogEvents({logGroupName:t,startTime:N,filterPattern:T?.filter,limit:200});if(h(S),S.length)N=(S[S.length-1].timestamp??N)+1;if(T?.tail){U(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise((L)=>setTimeout(L,3000));let{events:A=[]}=await d.filterLogEvents({logGroupName:t,startTime:N,filterPattern:T?.filter,limit:200});if(A.length)h(A),N=(A[A.length-1].timestamp??N)+1}}}catch(N){Q(`Failed to read logs: ${N.message}`),process.exitCode=1}})}fE();async function Ey(E){let _=Bun.spawn(["docker",...E],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[T,r]=await Promise.all([_.exited,new Response(_.stderr).text()]);return{ok:T===0,exitCode:T,command:["docker",...E].join(" "),stderr:r.trim()}}function BX(E){E.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(_)=>{let T=["build","--file",_.file??"Dockerfile","--tag",_.tag??"latest","."];if(_.dryRun){console.log(`docker ${T.join(" ")}`);return}let r=await Ey(T);if(_.json)console.log(JSON.stringify(r));if(!r.ok)Q(r.stderr||`docker exited ${r.exitCode}`),process.exitCode=r.exitCode;else Z(`Built ${_.tag??"latest"}.`)}),E.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(_)=>{if(!_.image){Q("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(_.dryRun){console.log(`docker push ${_.image}`);return}let T=await Ey(["push",_.image]);if(_.json)console.log(JSON.stringify(T));if(!T.ok)Q(T.stderr),process.exitCode=T.exitCode;else Z(`Pushed ${_.image}.`)}),E.command("container:deploy","Deploy a container image").action(async()=>Ed("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}fE();Mt();sd();function WX(E){E.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(_)=>{b("Domains");try{let T=pd(_?.provider),r=Yr(_?.provider)?.provider||"unknown",d=new n(`Fetching domains from ${r}...`);d.start();let t=await T.listDomains();if(d.succeed(`Found ${t.length} domain(s)`),t.length===0){U("No domains found in this provider");return}let R=t.map((h)=>[h,"Active","-",r.charAt(0).toUpperCase()+r.slice(1)]);o(["Domain","Status","SSL","Provider"],R)}catch(T){Q(`Failed to list domains: ${T instanceof Error?T.message:String(T)}`)}}),E.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(_,T)=>{b(`Adding Domain: ${_}`);try{let r=pd(T?.provider),d=Yr(T?.provider)?.provider||"unknown",t=new n(`Checking if ${d} can manage ${_}...`);if(t.start(),await r.canManageDomain(_))t.succeed(`Domain ${_} is already available in ${d}`),U(`
@@ -9800,17 +9800,17 @@ Deployment complete!`),U(`Total size: ${c} MB`),U(`
 Assets URL: https://${t}.s3.${r}.amazonaws.com${R?`/${R}`:""}`)}catch(T){Q(`Deployment failed: ${T.message}`)}}),E.command("assets:invalidate","Invalidate CloudFront cache").option("--distribution <id>","CloudFront distribution ID").option("--paths <paths>","Paths to invalidate (comma-separated)",{default:"/*"}).option("--wait","Wait for invalidation to complete").action(async(_)=>{b("Invalidating CloudFront Cache");try{let T=_?.distribution;if(!T){Q("--distribution is required");return}let d=(_?.paths||"/*").split(",").map((A)=>A.trim()),t=_?.wait||!1;if(U(`Distribution: ${T}`),U(`Paths: ${d.join(", ")}`),!await DE(`
 Invalidate cache now?`,!0)){U("Invalidation cancelled");return}let h=new __,N=new n("Creating invalidation...");N.start();let S=await h.invalidatePaths(T,d);if(N.succeed("Invalidation created"),Z(`
 Invalidation ID: ${S.Id}`),U(`Status: ${S.Status}`),U(`Created: ${new Date(S.CreateTime).toLocaleString()}`),t){let A=new n("Waiting for invalidation to complete...");A.start(),await h.waitForInvalidation(T,S.Id),A.succeed("Invalidation completed!")}else U(`
-Invalidation is in progress. Use --wait to wait for completion.`)}catch(T){Q(`Invalidation failed: ${T.message}`)}})}function eJ(E){for(let[_,T]of[["team:add <email> <role>","Invite an organization member"],["team:list","List organization members"],["team:remove <email>","Revoke organization membership"]])E.command(_,T).action(async(...r)=>Ed(_.split(" ")[0],{target:String(r[0]??""),message:"Legacy IAM-backed team commands are deprecated and cannot safely represent organization-scoped access.",nextAction:"Use the Team dashboard or organization invitation API; this command exits without changing IAM."}))}fE();VE();KT();Vr();Y0();await aE();import{execSync as UD}from"node:child_process";import{copyFileSync as eO,existsSync as zr,mkdirSync as vi,readFileSync as kJ,writeFileSync as ni}from"node:fs";import{tmpdir as li}from"node:os";import{dirname as ii,join as ai}from"node:path";VE();class Ah{client;region;constructor(E="us-east-1",_){this.region=E,this.client=new JE(void 0,{profile:_})}async describeServices(E){let _={cluster:E.cluster,services:E.services};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async listServices(E,_={}){let T={cluster:E,..._};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(T)})}async listTasks(E,_,T={}){let r={cluster:E,...T};if(_)r.serviceName=_;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async describeTasks(E,_){let T={cluster:E,tasks:_};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(T)})}async updateService(E){let _={cluster:E.cluster,service:E.service};if(E.forceNewDeployment!==void 0)_.forceNewDeployment=E.forceNewDeployment;if(E.desiredCount!==void 0)_.desiredCount=E.desiredCount;if(E.taskDefinition)_.taskDefinition=E.taskDefinition;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.UpdateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async createService(E){let _={cluster:E.cluster,serviceName:E.serviceName,taskDefinition:E.taskDefinition,desiredCount:E.desiredCount};if(E.launchType)_.launchType=E.launchType;if(E.networkConfiguration)_.networkConfiguration=E.networkConfiguration;if(E.loadBalancers)_.loadBalancers=E.loadBalancers;if(E.healthCheckGracePeriodSeconds!==void 0)_.healthCheckGracePeriodSeconds=E.healthCheckGracePeriodSeconds;if(E.deploymentConfiguration)_.deploymentConfiguration=E.deploymentConfiguration;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.CreateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async deleteService(E){let _={cluster:E.cluster,service:E.service};if(E.force!==void 0)_.force=E.force;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeleteService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async listClusters(E={}){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(E)})}async describeClusters(E){let _={clusters:E,include:["ATTACHMENTS","CONFIGURATIONS","SETTINGS","STATISTICS","TAGS"]};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async stopTask(E){let _={cluster:E.cluster,task:E.task};if(E.reason)_.reason=E.reason;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.StopTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async runTask(E){let _={cluster:E.cluster,taskDefinition:E.taskDefinition};if(E.count!==void 0)_.count=E.count;if(E.launchType)_.launchType=E.launchType;if(E.networkConfiguration)_.networkConfiguration=E.networkConfiguration;if(E.overrides)_.overrides=E.overrides;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RunTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async registerTaskDefinition(E){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(E)})}async deregisterTaskDefinition(E){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeregisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:E})})}async describeTaskDefinition(E){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:E,include:["TAGS"]})})}async listTaskDefinitionFamilies(E){let _={};if(E?.familyPrefix)_.familyPrefix=E.familyPrefix;if(E?.status)_.status=E.status;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTaskDefinitionFamilies","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async waitForServiceStable(E,_,T=40,r=15000){for(let d=0;d<T;d++){let R=(await this.describeServices({cluster:E,services:[_]})).services?.[0];if(R){let h=R.deployments?.find((N)=>N.status==="PRIMARY");if(h&&h.runningCount===h.desiredCount&&R.deployments?.length===1)return!0}await new Promise((h)=>setTimeout(h,r))}return!1}async forceNewDeployment(E,_){return this.updateService({cluster:E,service:_,forceNewDeployment:!0})}async scaleService(E,_,T){return this.updateService({cluster:E,service:_,desiredCount:T})}}z_();eN();fE();Vr();function ul(E){if(!E)return[];if(Array.isArray(E))return E.map(String);let _=E,T=_.Items??_.Item;if(!T)return[];if(Array.isArray(T))return T.map(String);if(typeof T==="object"&&T!==null){let r=T;if("Item"in r){let d=r.Item;if(!d)return[];return Array.isArray(d)?d.map(String):[String(d)]}if("CNAME"in r){let d=r.CNAME;if(!d)return[];return Array.isArray(d)?d.map(String):[String(d)]}return Object.values(r).flatMap((d)=>{if(Array.isArray(d))return d.map(String);return typeof d==="string"?[d]:[]})}return[String(T)]}async function dD(E){if(E.length===0)return;let _=new __,T=await _.listDistributions(),r=[...new Set(E.map((d)=>d.toLowerCase()))];for(let d of r){let t=T.find((h)=>{return ul(h.Aliases).some((S)=>S.toLowerCase()===d)});if(!t?.Id){_E(`No CloudFront distribution found for ${d} — skipping dynamic HTTP method sync`);continue}if(await _.ensureDynamicHttpMethods(t.Id))Z(`CloudFront ${t.Id} (${d}): enabled POST/PUT/PATCH/DELETE on dynamic paths`);else U(`CloudFront ${t.Id} (${d}): already allows dynamic HTTP methods`)}}import{execSync as vl}from"node:child_process";async function nl(E,_,T,r={},d=process.cwd()){if(!E)return;if(r.step?.(`Running ${T} hook`),typeof E==="string"){vl(E,{stdio:"inherit",cwd:d});return}await E(_)}async function SO(E,_,T={},r){try{return await nl(E.hooks?.[_],E,_,T,r),!0}catch(d){return T.error?.(`${_} hook failed: ${d?.message||d}`),!1}}TA();LO();sd();await bd([nR(),TR(),NJ()]);await tT();import{createHash as ll}from"node:crypto";var PJ={info:0,low:1,medium:2,high:3,critical:4},yJ={record:0,warn:1,block:2},sY=new Set(["skipped","unavailable","unsupported","stale"]);function V_(E){return typeof E==="string"?E:void 0}function Lh(E,_){try{return JSON.parse(String(E))}catch{return _}}function Gd(E){return JSON.stringify(bE(E))}function il(E){if(!E)return;return String(bE(E,2000))}function BJ(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:V_(E.project_id),environmentId:V_(E.environment_id),resourceId:V_(E.resource_id),releaseId:V_(E.release_id),scannerId:String(E.scanner_id),scannerVersion:String(E.scanner_version),status:String(E.status),error:V_(E.error),metadata:Lh(E.metadata,{}),findingsCount:Number(E.findings_count),startedAt:String(E.started_at),completedAt:String(E.completed_at),durationMs:Number(E.duration_ms)}}function pY(E){return{id:String(E.id),fingerprint:String(E.fingerprint),organizationId:String(E.organization_id),projectId:V_(E.project_id),environmentId:V_(E.environment_id),resourceId:V_(E.resource_id),releaseId:V_(E.release_id),scanRunId:String(E.scan_run_id),scannerId:String(E.scanner_id),scannerVersion:String(E.scanner_version),ruleId:String(E.rule_id),severity:String(E.severity),title:String(E.title),description:String(E.description),evidence:Lh(E.evidence,{}),remediation:V_(E.remediation),subject:String(E.subject),status:String(E.status),ownerActorId:V_(E.owner_actor_id),recurrenceCount:Number(E.recurrence_count),firstSeenAt:String(E.first_seen_at),lastSeenAt:String(E.last_seen_at),resolvedAt:V_(E.resolved_at),updatedAt:String(E.updated_at)}}function WJ(E){return{id:String(E.id),organizationId:String(E.organization_id),environmentId:V_(E.environment_id),name:String(E.name),rules:Lh(E.rules,[]),requiredScanners:Lh(E.required_scanners,[]),scannerFailMode:String(E.scanner_fail_mode),enabled:Number(E.enabled)===1,version:Number(E.version),createdByActorId:V_(E.created_by_actor_id),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function oY(E,_){let T=V_(E.revoked_at),r=String(E.expires_at);return{id:String(E.id),findingId:String(E.finding_id),policyId:V_(E.policy_id),reason:String(E.reason),referenceUrl:V_(E.reference_url),createdByActorId:String(E.created_by_actor_id),expiresAt:r,revokedAt:T,state:T?"revoked":r<=_?"expired":"active",createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function HJ(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:V_(E.environment_id),releaseId:String(E.release_id),kind:String(E.kind),format:String(E.format),digest:String(E.digest),summary:Lh(E.summary,{}),content:V_(E.content),sensitive:Number(E.sensitive)===1,createdAt:String(E.created_at)}}function EQ(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:String(E.environment_id),operationId:V_(E.operation_id),policyId:String(E.policy_id),policyVersion:Number(E.policy_version),outcome:String(E.outcome),scannerVersions:Lh(E.scanner_versions,{}),findingIds:Lh(E.finding_ids,[]),waiverIds:Lh(E.waiver_ids,[]),explanation:String(E.explanation),createdAt:String(E.created_at)}}function al(E,_){let T=[E.trim().toLowerCase(),_.ruleId.trim().toLowerCase(),_.organizationId,_.projectId??"",_.environmentId??"",_.resourceId??"",_.releaseId??"",_.subject.trim().toLowerCase()].join("\x00");return ll("sha256").update(T).digest("hex")}function _Q(E){if(!E)return;let _=new URL(E);if(_.protocol!=="https:"&&_.protocol!=="http:")throw Error("Security references must use HTTP or HTTPS");return _.toString()}function TQ(E){if(!E.length)throw Error("A security policy needs at least one rule");return E.map((_)=>{if(!(_.minimumSeverity in PJ))throw Error(`Unknown security severity: ${_.minimumSeverity}`);if(!(_.action in yJ))throw Error(`Unknown security policy action: ${_.action}`);return{minimumSeverity:_.minimumSeverity,action:_.action,..._.scannerId?{scannerId:_.scannerId.trim()}:{}}})}class Oh{controlPlane;nowFn;idFn;constructor(E,_={}){this.controlPlane=E;this.nowFn=_.now??(()=>new Date),this.idFn=_.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(E,_){this.controlPlane.database.run(E,_)}recordScan(E){if(!E.organizationId||!E.scannerId.trim()||!E.scannerVersion.trim())throw Error("Organization, scanner id, and scanner version are required");let _=E.completedAt??this.now(),T=E.startedAt??_,r=E.durationMs??Math.max(0,new Date(_).getTime()-new Date(T).getTime()),d=E.findings??[],t=this.idFn(),R=new Set,h=[];return this.controlPlane.transaction(()=>{this.run(`INSERT INTO security_scan_runs
+Invalidation is in progress. Use --wait to wait for completion.`)}catch(T){Q(`Invalidation failed: ${T.message}`)}})}function eJ(E){for(let[_,T]of[["team:add <email> <role>","Invite an organization member"],["team:list","List organization members"],["team:remove <email>","Revoke organization membership"]])E.command(_,T).action(async(...r)=>Ed(_.split(" ")[0],{target:String(r[0]??""),message:"Legacy IAM-backed team commands are deprecated and cannot safely represent organization-scoped access.",nextAction:"Use the Team dashboard or organization invitation API; this command exits without changing IAM."}))}fE();VE();KT();Vr();Y0();await aE();import{execSync as UD}from"node:child_process";import{copyFileSync as eO,existsSync as zr,mkdirSync as vi,readFileSync as kJ,writeFileSync as ni}from"node:fs";import{tmpdir as li}from"node:os";import{dirname as ii,join as ai}from"node:path";VE();class Ah{client;region;constructor(E="us-east-1",_){this.region=E,this.client=new JE(void 0,{profile:_})}async describeServices(E){let _={cluster:E.cluster,services:E.services};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async listServices(E,_={}){let T={cluster:E,..._};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(T)})}async listTasks(E,_,T={}){let r={cluster:E,...T};if(_)r.serviceName=_;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async describeTasks(E,_){let T={cluster:E,tasks:_};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(T)})}async updateService(E){let _={cluster:E.cluster,service:E.service};if(E.forceNewDeployment!==void 0)_.forceNewDeployment=E.forceNewDeployment;if(E.desiredCount!==void 0)_.desiredCount=E.desiredCount;if(E.taskDefinition)_.taskDefinition=E.taskDefinition;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.UpdateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async createService(E){let _={cluster:E.cluster,serviceName:E.serviceName,taskDefinition:E.taskDefinition,desiredCount:E.desiredCount};if(E.launchType)_.launchType=E.launchType;if(E.networkConfiguration)_.networkConfiguration=E.networkConfiguration;if(E.loadBalancers)_.loadBalancers=E.loadBalancers;if(E.healthCheckGracePeriodSeconds!==void 0)_.healthCheckGracePeriodSeconds=E.healthCheckGracePeriodSeconds;if(E.deploymentConfiguration)_.deploymentConfiguration=E.deploymentConfiguration;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.CreateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async deleteService(E){let _={cluster:E.cluster,service:E.service};if(E.force!==void 0)_.force=E.force;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeleteService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async listClusters(E={}){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(E)})}async describeClusters(E){let _={clusters:E,include:["ATTACHMENTS","CONFIGURATIONS","SETTINGS","STATISTICS","TAGS"]};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async stopTask(E){let _={cluster:E.cluster,task:E.task};if(E.reason)_.reason=E.reason;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.StopTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async runTask(E){let _={cluster:E.cluster,taskDefinition:E.taskDefinition};if(E.count!==void 0)_.count=E.count;if(E.launchType)_.launchType=E.launchType;if(E.networkConfiguration)_.networkConfiguration=E.networkConfiguration;if(E.overrides)_.overrides=E.overrides;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RunTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async registerTaskDefinition(E){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(E)})}async deregisterTaskDefinition(E){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeregisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:E})})}async describeTaskDefinition(E){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:E,include:["TAGS"]})})}async listTaskDefinitionFamilies(E){let _={};if(E?.familyPrefix)_.familyPrefix=E.familyPrefix;if(E?.status)_.status=E.status;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTaskDefinitionFamilies","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})}async waitForServiceStable(E,_,T=40,r=15000){for(let d=0;d<T;d++){let R=(await this.describeServices({cluster:E,services:[_]})).services?.[0];if(R){let h=R.deployments?.find((N)=>N.status==="PRIMARY");if(h&&h.runningCount===h.desiredCount&&R.deployments?.length===1)return!0}await new Promise((h)=>setTimeout(h,r))}return!1}async forceNewDeployment(E,_){return this.updateService({cluster:E,service:_,forceNewDeployment:!0})}async scaleService(E,_,T){return this.updateService({cluster:E,service:_,desiredCount:T})}}z_();eN();fE();Vr();function ul(E){if(!E)return[];if(Array.isArray(E))return E.map(String);let _=E,T=_.Items??_.Item;if(!T)return[];if(Array.isArray(T))return T.map(String);if(typeof T==="object"&&T!==null){let r=T;if("Item"in r){let d=r.Item;if(!d)return[];return Array.isArray(d)?d.map(String):[String(d)]}if("CNAME"in r){let d=r.CNAME;if(!d)return[];return Array.isArray(d)?d.map(String):[String(d)]}return Object.values(r).flatMap((d)=>{if(Array.isArray(d))return d.map(String);return typeof d==="string"?[d]:[]})}return[String(T)]}async function dD(E){if(E.length===0)return;let _=new __,T=await _.listDistributions(),r=[...new Set(E.map((d)=>d.toLowerCase()))];for(let d of r){let t=T.find((h)=>{return ul(h.Aliases).some((S)=>S.toLowerCase()===d)});if(!t?.Id){_E(`No CloudFront distribution found for ${d} — skipping dynamic HTTP method sync`);continue}if(await _.ensureDynamicHttpMethods(t.Id))Z(`CloudFront ${t.Id} (${d}): enabled POST/PUT/PATCH/DELETE on dynamic paths`);else U(`CloudFront ${t.Id} (${d}): already allows dynamic HTTP methods`)}}import{execSync as vl}from"node:child_process";async function nl(E,_,T,r={},d=process.cwd()){if(!E)return;if(r.step?.(`Running ${T} hook`),typeof E==="string"){vl(E,{stdio:"inherit",cwd:d});return}await E(_)}async function SO(E,_,T={},r){try{return await nl(E.hooks?.[_],E,_,T,r),!0}catch(d){return T.error?.(`${_} hook failed: ${d?.message||d}`),!1}}TA();LO();sd();await bd([nR(),TR(),NJ()]);await tT();import{createHash as ll}from"node:crypto";var PJ={info:0,low:1,medium:2,high:3,critical:4},yJ={record:0,warn:1,block:2},sY=new Set(["skipped","unavailable","unsupported","stale"]);function V_(E){return typeof E==="string"?E:void 0}function Lh(E,_){try{return JSON.parse(String(E))}catch{return _}}function Gd(E){return JSON.stringify(bE(E))}function il(E){if(!E)return;return String(bE(E,2000))}function BJ(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:V_(E.project_id),environmentId:V_(E.environment_id),resourceId:V_(E.resource_id),releaseId:V_(E.release_id),scannerId:String(E.scanner_id),scannerVersion:String(E.scanner_version),status:String(E.status),error:V_(E.error),metadata:Lh(E.metadata,{}),findingsCount:Number(E.findings_count),startedAt:String(E.started_at),completedAt:String(E.completed_at),durationMs:Number(E.duration_ms)}}function pY(E){return{id:String(E.id),fingerprint:String(E.fingerprint),organizationId:String(E.organization_id),projectId:V_(E.project_id),environmentId:V_(E.environment_id),resourceId:V_(E.resource_id),releaseId:V_(E.release_id),scanRunId:String(E.scan_run_id),scannerId:String(E.scanner_id),scannerVersion:String(E.scanner_version),ruleId:String(E.rule_id),severity:String(E.severity),title:String(E.title),description:String(E.description),evidence:Lh(E.evidence,{}),remediation:V_(E.remediation),subject:String(E.subject),status:String(E.status),ownerActorId:V_(E.owner_actor_id),recurrenceCount:Number(E.recurrence_count),firstSeenAt:String(E.first_seen_at),lastSeenAt:String(E.last_seen_at),resolvedAt:V_(E.resolved_at),updatedAt:String(E.updated_at)}}function WJ(E){return{id:String(E.id),organizationId:String(E.organization_id),environmentId:V_(E.environment_id),name:String(E.name),rules:Lh(E.rules,[]),requiredScanners:Lh(E.required_scanners,[]),scannerFailMode:String(E.scanner_fail_mode),enabled:Number(E.enabled)===1,version:Number(E.version),createdByActorId:V_(E.created_by_actor_id),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function oY(E,_){let T=V_(E.revoked_at),r=String(E.expires_at);return{id:String(E.id),findingId:String(E.finding_id),policyId:V_(E.policy_id),reason:String(E.reason),referenceUrl:V_(E.reference_url),createdByActorId:String(E.created_by_actor_id),expiresAt:r,revokedAt:T,state:T?"revoked":r<=_?"expired":"active",createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function HJ(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:V_(E.environment_id),releaseId:String(E.release_id),kind:String(E.kind),format:String(E.format),digest:String(E.digest),summary:Lh(E.summary,{}),content:V_(E.content),sensitive:Number(E.sensitive)===1,createdAt:String(E.created_at)}}function E9(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:String(E.environment_id),operationId:V_(E.operation_id),policyId:String(E.policy_id),policyVersion:Number(E.policy_version),outcome:String(E.outcome),scannerVersions:Lh(E.scanner_versions,{}),findingIds:Lh(E.finding_ids,[]),waiverIds:Lh(E.waiver_ids,[]),explanation:String(E.explanation),createdAt:String(E.created_at)}}function al(E,_){let T=[E.trim().toLowerCase(),_.ruleId.trim().toLowerCase(),_.organizationId,_.projectId??"",_.environmentId??"",_.resourceId??"",_.releaseId??"",_.subject.trim().toLowerCase()].join("\x00");return ll("sha256").update(T).digest("hex")}function _9(E){if(!E)return;let _=new URL(E);if(_.protocol!=="https:"&&_.protocol!=="http:")throw Error("Security references must use HTTP or HTTPS");return _.toString()}function T9(E){if(!E.length)throw Error("A security policy needs at least one rule");return E.map((_)=>{if(!(_.minimumSeverity in PJ))throw Error(`Unknown security severity: ${_.minimumSeverity}`);if(!(_.action in yJ))throw Error(`Unknown security policy action: ${_.action}`);return{minimumSeverity:_.minimumSeverity,action:_.action,..._.scannerId?{scannerId:_.scannerId.trim()}:{}}})}class Oh{controlPlane;nowFn;idFn;constructor(E,_={}){this.controlPlane=E;this.nowFn=_.now??(()=>new Date),this.idFn=_.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(E,_){this.controlPlane.database.run(E,_)}recordScan(E){if(!E.organizationId||!E.scannerId.trim()||!E.scannerVersion.trim())throw Error("Organization, scanner id, and scanner version are required");let _=E.completedAt??this.now(),T=E.startedAt??_,r=E.durationMs??Math.max(0,new Date(_).getTime()-new Date(T).getTime()),d=E.findings??[],t=this.idFn(),R=new Set,h=[];return this.controlPlane.transaction(()=>{this.run(`INSERT INTO security_scan_runs
         (id, organization_id, project_id, environment_id, resource_id, release_id, scanner_id, scanner_version, status, error, metadata, findings_count, started_at, completed_at, duration_ms)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,E.organizationId,E.projectId??null,E.environmentId??null,E.resourceId??null,E.releaseId??null,E.scannerId.trim(),E.scannerVersion.trim(),E.status,il(E.error)??null,Gd(E.metadata??{}),d.length,T,_,Math.max(0,Math.floor(r))]);for(let N of d){let S={...N,organizationId:E.organizationId,projectId:N.projectId??E.projectId,environmentId:N.environmentId??E.environmentId,resourceId:N.resourceId??E.resourceId,releaseId:N.releaseId??E.releaseId},A=S.fingerprint?.trim()||al(E.scannerId,S);R.add(A);let L=this.controlPlane.database.query("SELECT * FROM security_findings WHERE fingerprint = ?").get(A),O=L?this.controlPlane.database.query("SELECT * FROM security_waivers WHERE finding_id = ? AND revoked_at IS NULL AND expires_at > ? ORDER BY expires_at DESC LIMIT 1").get(String(L.id),_):void 0;if(L){let c=String(L.status)==="resolved"?Number(L.recurrence_count)+1:Number(L.recurrence_count),$=O?"waived":String(L.status)==="acknowledged"?"acknowledged":"open";this.run(`UPDATE security_findings SET scan_run_id = ?, scanner_version = ?, severity = ?, title = ?, description = ?, evidence = ?, remediation = ?,
             status = ?, recurrence_count = ?, last_seen_at = ?, resolved_at = NULL, updated_at = ? WHERE id = ?`,[t,E.scannerVersion,S.severity,S.title.trim(),S.description.trim(),Gd(S.evidence??{}),S.remediation?.trim()||null,$,c,_,_,String(L.id)]),h.push(this.getFinding(String(L.id)))}else{let c=this.idFn();this.run(`INSERT INTO security_findings
             (id, fingerprint, organization_id, project_id, environment_id, resource_id, release_id, scan_run_id, scanner_id, scanner_version, rule_id,
             severity, title, description, evidence, remediation, subject, status, first_seen_at, last_seen_at, updated_at)
             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'open', ?, ?, ?)`,[c,A,S.organizationId,S.projectId??null,S.environmentId??null,S.resourceId??null,S.releaseId??null,t,E.scannerId,E.scannerVersion,S.ruleId.trim(),S.severity,S.title.trim(),S.description.trim(),Gd(S.evidence??{}),S.remediation?.trim()||null,S.subject.trim(),_,_,_]),h.push(this.getFinding(c))}}if(E.status==="passed"||E.status==="failed"){let N=this.controlPlane.database.query(`SELECT * FROM security_findings WHERE organization_id = ? AND scanner_id = ?
-          AND project_id IS ? AND environment_id IS ? AND resource_id IS ? AND release_id IS ? AND status != 'resolved'`).all(E.organizationId,E.scannerId,E.projectId??null,E.environmentId??null,E.resourceId??null,E.releaseId??null);for(let S of N){if(R.has(String(S.fingerprint)))continue;this.run("UPDATE security_findings SET status = 'resolved', resolved_at = ?, updated_at = ? WHERE id = ?",[_,_,String(S.id)]),this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,resourceId:E.resourceId,type:"security.finding.resolved",payload:{findingId:String(S.id),scannerId:E.scannerId,reason:"not-observed"}})}}this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,resourceId:E.resourceId,type:"security.scan.completed",level:E.status==="failed"||sY.has(E.status)?"warning":"info",payload:{scanRunId:t,scannerId:E.scannerId,scannerVersion:E.scannerVersion,status:E.status,findingsCount:d.length,durationMs:r}})}),{run:this.getScanRun(t),findings:h.map((N)=>this.getFinding(N.id))}}getScanRun(E){let _=this.controlPlane.database.query("SELECT * FROM security_scan_runs WHERE id = ?").get(E);return _?BJ(_):void 0}listScanRuns(E){return this.controlPlane.database.query("SELECT * FROM security_scan_runs WHERE organization_id = ? AND project_id IS ? AND environment_id IS ? ORDER BY completed_at DESC, id DESC LIMIT ?").all(E.organizationId,E.projectId??null,E.environmentId??null,Math.min(500,Math.max(1,E.limit??100))).map(BJ)}getFinding(E){let _=this.controlPlane.database.query("SELECT * FROM security_findings WHERE id = ?").get(E);return _?pY(_):void 0}listFindings(E){this.expireWaivers();let _=["organization_id = ?"],T=[E.organizationId];if(E.projectId)_.push("project_id = ?"),T.push(E.projectId);if(E.environmentId)_.push("environment_id = ?"),T.push(E.environmentId);if(E.status)_.push("status = ?"),T.push(E.status);if(E.severity)_.push("severity = ?"),T.push(E.severity);return T.push(Math.min(1000,Math.max(1,E.limit??250))),this.controlPlane.database.query(`SELECT * FROM security_findings WHERE ${_.join(" AND ")} ORDER BY CASE severity WHEN 'critical' THEN 4 WHEN 'high' THEN 3 WHEN 'medium' THEN 2 WHEN 'low' THEN 1 ELSE 0 END DESC, last_seen_at DESC LIMIT ?`).all(...T).map(pY)}assignFinding(E,_,T){let r=this.getFinding(E);if(!r)throw Error("Security finding was not found");if(_&&!this.controlPlane.getActor(_))throw Error("Finding owner was not found");return this.run("UPDATE security_findings SET owner_actor_id = ?, updated_at = ? WHERE id = ?",[_??null,this.now(),E]),this.controlPlane.appendEvent({organizationId:r.organizationId,projectId:r.projectId,resourceId:r.resourceId,actorId:T,type:"security.finding.assigned",payload:{findingId:E,ownerActorId:_??null}}),this.getFinding(E)}acknowledgeFinding(E,_){let T=this.getFinding(E);if(!T)throw Error("Security finding was not found");if(T.status==="resolved")throw Error("A resolved finding cannot be acknowledged");return this.run("UPDATE security_findings SET status = 'acknowledged', updated_at = ? WHERE id = ?",[this.now(),E]),this.controlPlane.appendEvent({organizationId:T.organizationId,projectId:T.projectId,resourceId:T.resourceId,actorId:_,type:"security.finding.acknowledged",payload:{findingId:E}}),this.getFinding(E)}addComment(E){let _=this.getFinding(E.findingId);if(!_)throw Error("Security finding was not found");let T=E.body.trim();if(T.length<2||T.length>4000)throw Error("Finding comments must contain 2-4,000 characters");let r=_Q(E.referenceUrl),d=this.idFn(),t=this.now();return this.run("INSERT INTO security_finding_comments (id, finding_id, actor_id, body, reference_url, created_at) VALUES (?, ?, ?, ?, ?, ?)",[d,E.findingId,E.actorId,T,r??null,t]),this.controlPlane.appendEvent({organizationId:_.organizationId,projectId:_.projectId,resourceId:_.resourceId,actorId:E.actorId,type:"security.finding.commented",payload:{findingId:E.findingId,commentId:d,referenceUrl:r??null}}),{id:d,findingId:E.findingId,actorId:E.actorId,body:T,referenceUrl:r,createdAt:t}}listComments(E){return this.controlPlane.database.query("SELECT * FROM security_finding_comments WHERE finding_id = ? ORDER BY created_at, id").all(E).map((_)=>({id:String(_.id),findingId:String(_.finding_id),actorId:String(_.actor_id),body:String(_.body),referenceUrl:V_(_.reference_url),createdAt:String(_.created_at)}))}createWaiver(E){let _=this.getFinding(E.findingId);if(!_)throw Error("Security finding was not found");let T=E.reason.trim();if(T.length<8||T.length>1000)throw Error("A waiver reason must contain 8-1,000 characters");let r=this.now(),d=new Date(E.expiresAt);if(!Number.isFinite(d.getTime())||d.toISOString()<=r)throw Error("A waiver must have a future expiry");if(d.getTime()-new Date(r).getTime()>31536000000)throw Error("A waiver cannot last longer than one year");let t=E.policyId?this.getPolicy(E.policyId):void 0;if(E.policyId&&(!t||t.organizationId!==_.organizationId))throw Error("Waiver policy does not match the finding organization");let R=this.idFn(),h=_Q(E.referenceUrl);return this.controlPlane.transaction(()=>{this.run(`INSERT INTO security_waivers (id, finding_id, policy_id, reason, reference_url, created_by_actor_id, expires_at, created_at, updated_at)
+          AND project_id IS ? AND environment_id IS ? AND resource_id IS ? AND release_id IS ? AND status != 'resolved'`).all(E.organizationId,E.scannerId,E.projectId??null,E.environmentId??null,E.resourceId??null,E.releaseId??null);for(let S of N){if(R.has(String(S.fingerprint)))continue;this.run("UPDATE security_findings SET status = 'resolved', resolved_at = ?, updated_at = ? WHERE id = ?",[_,_,String(S.id)]),this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,resourceId:E.resourceId,type:"security.finding.resolved",payload:{findingId:String(S.id),scannerId:E.scannerId,reason:"not-observed"}})}}this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,resourceId:E.resourceId,type:"security.scan.completed",level:E.status==="failed"||sY.has(E.status)?"warning":"info",payload:{scanRunId:t,scannerId:E.scannerId,scannerVersion:E.scannerVersion,status:E.status,findingsCount:d.length,durationMs:r}})}),{run:this.getScanRun(t),findings:h.map((N)=>this.getFinding(N.id))}}getScanRun(E){let _=this.controlPlane.database.query("SELECT * FROM security_scan_runs WHERE id = ?").get(E);return _?BJ(_):void 0}listScanRuns(E){return this.controlPlane.database.query("SELECT * FROM security_scan_runs WHERE organization_id = ? AND project_id IS ? AND environment_id IS ? ORDER BY completed_at DESC, id DESC LIMIT ?").all(E.organizationId,E.projectId??null,E.environmentId??null,Math.min(500,Math.max(1,E.limit??100))).map(BJ)}getFinding(E){let _=this.controlPlane.database.query("SELECT * FROM security_findings WHERE id = ?").get(E);return _?pY(_):void 0}listFindings(E){this.expireWaivers();let _=["organization_id = ?"],T=[E.organizationId];if(E.projectId)_.push("project_id = ?"),T.push(E.projectId);if(E.environmentId)_.push("environment_id = ?"),T.push(E.environmentId);if(E.status)_.push("status = ?"),T.push(E.status);if(E.severity)_.push("severity = ?"),T.push(E.severity);return T.push(Math.min(1000,Math.max(1,E.limit??250))),this.controlPlane.database.query(`SELECT * FROM security_findings WHERE ${_.join(" AND ")} ORDER BY CASE severity WHEN 'critical' THEN 4 WHEN 'high' THEN 3 WHEN 'medium' THEN 2 WHEN 'low' THEN 1 ELSE 0 END DESC, last_seen_at DESC LIMIT ?`).all(...T).map(pY)}assignFinding(E,_,T){let r=this.getFinding(E);if(!r)throw Error("Security finding was not found");if(_&&!this.controlPlane.getActor(_))throw Error("Finding owner was not found");return this.run("UPDATE security_findings SET owner_actor_id = ?, updated_at = ? WHERE id = ?",[_??null,this.now(),E]),this.controlPlane.appendEvent({organizationId:r.organizationId,projectId:r.projectId,resourceId:r.resourceId,actorId:T,type:"security.finding.assigned",payload:{findingId:E,ownerActorId:_??null}}),this.getFinding(E)}acknowledgeFinding(E,_){let T=this.getFinding(E);if(!T)throw Error("Security finding was not found");if(T.status==="resolved")throw Error("A resolved finding cannot be acknowledged");return this.run("UPDATE security_findings SET status = 'acknowledged', updated_at = ? WHERE id = ?",[this.now(),E]),this.controlPlane.appendEvent({organizationId:T.organizationId,projectId:T.projectId,resourceId:T.resourceId,actorId:_,type:"security.finding.acknowledged",payload:{findingId:E}}),this.getFinding(E)}addComment(E){let _=this.getFinding(E.findingId);if(!_)throw Error("Security finding was not found");let T=E.body.trim();if(T.length<2||T.length>4000)throw Error("Finding comments must contain 2-4,000 characters");let r=_9(E.referenceUrl),d=this.idFn(),t=this.now();return this.run("INSERT INTO security_finding_comments (id, finding_id, actor_id, body, reference_url, created_at) VALUES (?, ?, ?, ?, ?, ?)",[d,E.findingId,E.actorId,T,r??null,t]),this.controlPlane.appendEvent({organizationId:_.organizationId,projectId:_.projectId,resourceId:_.resourceId,actorId:E.actorId,type:"security.finding.commented",payload:{findingId:E.findingId,commentId:d,referenceUrl:r??null}}),{id:d,findingId:E.findingId,actorId:E.actorId,body:T,referenceUrl:r,createdAt:t}}listComments(E){return this.controlPlane.database.query("SELECT * FROM security_finding_comments WHERE finding_id = ? ORDER BY created_at, id").all(E).map((_)=>({id:String(_.id),findingId:String(_.finding_id),actorId:String(_.actor_id),body:String(_.body),referenceUrl:V_(_.reference_url),createdAt:String(_.created_at)}))}createWaiver(E){let _=this.getFinding(E.findingId);if(!_)throw Error("Security finding was not found");let T=E.reason.trim();if(T.length<8||T.length>1000)throw Error("A waiver reason must contain 8-1,000 characters");let r=this.now(),d=new Date(E.expiresAt);if(!Number.isFinite(d.getTime())||d.toISOString()<=r)throw Error("A waiver must have a future expiry");if(d.getTime()-new Date(r).getTime()>31536000000)throw Error("A waiver cannot last longer than one year");let t=E.policyId?this.getPolicy(E.policyId):void 0;if(E.policyId&&(!t||t.organizationId!==_.organizationId))throw Error("Waiver policy does not match the finding organization");let R=this.idFn(),h=_9(E.referenceUrl);return this.controlPlane.transaction(()=>{this.run(`INSERT INTO security_waivers (id, finding_id, policy_id, reason, reference_url, created_by_actor_id, expires_at, created_at, updated_at)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[R,_.id,E.policyId??null,T,h??null,E.actorId,d.toISOString(),r,r]),this.run("UPDATE security_findings SET status = 'waived', updated_at = ? WHERE id = ?",[r,_.id]),this.controlPlane.appendEvent({organizationId:_.organizationId,projectId:_.projectId,resourceId:_.resourceId,actorId:E.actorId,type:"security.waiver.created",level:"warning",payload:{waiverId:R,findingId:_.id,policyId:E.policyId??null,reason:T,expiresAt:d.toISOString(),referenceUrl:h??null}})}),this.getWaiver(R)}revokeWaiver(E,_){let T=this.getWaiver(E);if(!T)throw Error("Security waiver was not found");if(T.revokedAt)return T;let r=this.getFinding(T.findingId),d=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE security_waivers SET revoked_at = ?, updated_at = ? WHERE id = ?",[d,d,E]),this.run("UPDATE security_findings SET status = 'open', updated_at = ? WHERE id = ? AND status = 'waived'",[d,T.findingId]),this.controlPlane.appendEvent({organizationId:r.organizationId,projectId:r.projectId,resourceId:r.resourceId,actorId:_,type:"security.waiver.revoked",level:"warning",payload:{waiverId:E,findingId:T.findingId}})}),this.getWaiver(E)}getWaiver(E){let _=this.controlPlane.database.query("SELECT * FROM security_waivers WHERE id = ?").get(E);return _?oY(_,this.now()):void 0}listWaivers(E){return(E?this.controlPlane.database.query("SELECT * FROM security_waivers WHERE finding_id = ? ORDER BY created_at DESC").all(E):this.controlPlane.database.query("SELECT * FROM security_waivers ORDER BY created_at DESC").all()).map((T)=>oY(T,this.now()))}expireWaivers(){let E=this.now(),_=this.controlPlane.database.query(`SELECT w.id AS waiver_id, f.* FROM security_waivers w JOIN security_findings f ON f.id = w.finding_id
-      WHERE w.revoked_at IS NULL AND w.expires_at <= ? AND f.status = 'waived'`).all(E);for(let T of _)this.run("UPDATE security_findings SET status = 'open', updated_at = ? WHERE id = ?",[E,String(T.id)]),this.controlPlane.appendEvent({organizationId:String(T.organization_id),projectId:V_(T.project_id),resourceId:V_(T.resource_id),type:"security.waiver.expired",level:"warning",payload:{waiverId:String(T.waiver_id),findingId:String(T.id)}});return _.length}createPolicy(E){let _=E.name.trim();if(!_)throw Error("Security policy name is required");let T=TQ(E.rules),r=this.idFn(),d=this.now(),t=[...new Set((E.requiredScanners??[]).map((R)=>R.trim()).filter(Boolean))].sort();return this.run(`INSERT INTO security_policies (id, organization_id, environment_id, name, rules, required_scanners, scanner_fail_mode, created_by_actor_id, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,E.organizationId,E.environmentId??null,_,Gd(T),Gd(t),E.scannerFailMode,E.actorId??null,d,d]),this.controlPlane.appendEvent({organizationId:E.organizationId,actorId:E.actorId,type:"security.policy.created",payload:{policyId:r,environmentId:E.environmentId??null,scannerFailMode:E.scannerFailMode,requiredScanners:t,rules:bE(T)}}),this.getPolicy(r)}updatePolicy(E,_,T){let r=this.getPolicy(E);if(!r||r.version!==_)throw Error(`Security policy ${E} changed since version ${_}`);let d=T.rules?TQ(T.rules):r.rules,t=T.requiredScanners?[...new Set(T.requiredScanners.map((N)=>N.trim()).filter(Boolean))].sort():r.requiredScanners,R=this.now();if(this.controlPlane.database.run("UPDATE security_policies SET name = ?, rules = ?, required_scanners = ?, scanner_fail_mode = ?, enabled = ?, version = version + 1, updated_at = ? WHERE id = ? AND version = ?",[T.name?.trim()||r.name,Gd(d),Gd(t),T.scannerFailMode??r.scannerFailMode,T.enabled??r.enabled?1:0,R,E,_]).changes!==1)throw Error(`Security policy ${E} changed since version ${_}`);return this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:T.actorId,type:"security.policy.updated",payload:{policyId:E,fromVersion:_,toVersion:_+1}}),this.getPolicy(E)}getPolicy(E){let _=this.controlPlane.database.query("SELECT * FROM security_policies WHERE id = ?").get(E);return _?WJ(_):void 0}listPolicies(E){return this.controlPlane.database.query("SELECT * FROM security_policies WHERE organization_id = ? ORDER BY environment_id, name").all(E).map(WJ)}evaluateGate(E){this.expireWaivers();let _=E.policyId?this.getPolicy(E.policyId):this.controlPlane.database.query(`SELECT * FROM security_policies WHERE organization_id = ? AND enabled = 1 AND (environment_id = ? OR environment_id IS NULL)
+      WHERE w.revoked_at IS NULL AND w.expires_at <= ? AND f.status = 'waived'`).all(E);for(let T of _)this.run("UPDATE security_findings SET status = 'open', updated_at = ? WHERE id = ?",[E,String(T.id)]),this.controlPlane.appendEvent({organizationId:String(T.organization_id),projectId:V_(T.project_id),resourceId:V_(T.resource_id),type:"security.waiver.expired",level:"warning",payload:{waiverId:String(T.waiver_id),findingId:String(T.id)}});return _.length}createPolicy(E){let _=E.name.trim();if(!_)throw Error("Security policy name is required");let T=T9(E.rules),r=this.idFn(),d=this.now(),t=[...new Set((E.requiredScanners??[]).map((R)=>R.trim()).filter(Boolean))].sort();return this.run(`INSERT INTO security_policies (id, organization_id, environment_id, name, rules, required_scanners, scanner_fail_mode, created_by_actor_id, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,E.organizationId,E.environmentId??null,_,Gd(T),Gd(t),E.scannerFailMode,E.actorId??null,d,d]),this.controlPlane.appendEvent({organizationId:E.organizationId,actorId:E.actorId,type:"security.policy.created",payload:{policyId:r,environmentId:E.environmentId??null,scannerFailMode:E.scannerFailMode,requiredScanners:t,rules:bE(T)}}),this.getPolicy(r)}updatePolicy(E,_,T){let r=this.getPolicy(E);if(!r||r.version!==_)throw Error(`Security policy ${E} changed since version ${_}`);let d=T.rules?T9(T.rules):r.rules,t=T.requiredScanners?[...new Set(T.requiredScanners.map((N)=>N.trim()).filter(Boolean))].sort():r.requiredScanners,R=this.now();if(this.controlPlane.database.run("UPDATE security_policies SET name = ?, rules = ?, required_scanners = ?, scanner_fail_mode = ?, enabled = ?, version = version + 1, updated_at = ? WHERE id = ? AND version = ?",[T.name?.trim()||r.name,Gd(d),Gd(t),T.scannerFailMode??r.scannerFailMode,T.enabled??r.enabled?1:0,R,E,_]).changes!==1)throw Error(`Security policy ${E} changed since version ${_}`);return this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:T.actorId,type:"security.policy.updated",payload:{policyId:E,fromVersion:_,toVersion:_+1}}),this.getPolicy(E)}getPolicy(E){let _=this.controlPlane.database.query("SELECT * FROM security_policies WHERE id = ?").get(E);return _?WJ(_):void 0}listPolicies(E){return this.controlPlane.database.query("SELECT * FROM security_policies WHERE organization_id = ? ORDER BY environment_id, name").all(E).map(WJ)}evaluateGate(E){this.expireWaivers();let _=E.policyId?this.getPolicy(E.policyId):this.controlPlane.database.query(`SELECT * FROM security_policies WHERE organization_id = ? AND enabled = 1 AND (environment_id = ? OR environment_id IS NULL)
           ORDER BY CASE WHEN environment_id = ? THEN 0 ELSE 1 END, updated_at DESC LIMIT 1`).get(E.organizationId,E.environmentId,E.environmentId),T=_&&"rules"in _&&Array.isArray(_.rules)?_:_?WJ(_):void 0;if(!T||!T.enabled)throw Error("No enabled security policy applies to this environment");let r=this.listFindings({organizationId:E.organizationId,projectId:E.projectId,environmentId:E.environmentId,limit:1000}).filter((Y)=>Y.status!=="resolved"),d=new Map;for(let Y of r){let M=this.listWaivers(Y.id).find((V)=>V.state==="active"&&(!V.policyId||V.policyId===T.id));if(M)d.set(Y.id,M)}let t=(Y)=>T.rules.filter((M)=>(!M.scannerId||M.scannerId===Y.scannerId)&&PJ[Y.severity]>=PJ[M.minimumSeverity]).reduce((M,V)=>yJ[V.action]>yJ[M]?V.action:M,"record"),R=r.filter((Y)=>!d.has(Y.id)&&t(Y)==="block"),h=r.filter((Y)=>!d.has(Y.id)&&t(Y)==="warn"),N=this.controlPlane.database.query(`SELECT run.* FROM security_scan_runs run
       WHERE run.organization_id = ? AND run.project_id = ? AND run.environment_id = ?
       AND run.id = (SELECT candidate.id FROM security_scan_runs candidate
@@ -9818,15 +9818,15 @@ Invalidation is in progress. Use --wait to wait for completion.`)}catch(T){Q(`In
         AND candidate.environment_id = run.environment_id AND candidate.scanner_id = run.scanner_id
         ORDER BY candidate.completed_at DESC, candidate.rowid DESC LIMIT 1)`).all(E.organizationId,E.projectId,E.environmentId),S=E.staleAfterMs??86400000,A=this.nowFn().getTime(),L=N.map(BJ).map((Y)=>A-new Date(Y.completedAt).getTime()>S?{...Y,status:"stale"}:Y),O=new Set(L.map((Y)=>Y.scannerId)),c=T.requiredScanners.filter((Y)=>!O.has(Y)).map((Y)=>({id:`missing:${Y}`,organizationId:E.organizationId,projectId:E.projectId,environmentId:E.environmentId,scannerId:Y,scannerVersion:"unavailable",status:"unavailable",metadata:{},findingsCount:0,startedAt:this.now(),completedAt:this.now(),durationMs:0})),$=[...L,...c],I=$.filter((Y)=>T.requiredScanners.includes(Y.scannerId)&&sY.has(Y.status)),C=Object.fromEntries($.map((Y)=>[Y.scannerId,Y.scannerVersion])),e=T.scannerFailMode==="closed"&&I.length>0,z=R.length||e?"block":h.length||I.length?"warn":"allow",F=[];if(R.length)F.push(`${R.length} finding${R.length===1?"":"s"} blocked by policy`);if(h.length)F.push(`${h.length} warning${h.length===1?"":"s"} require review`);if(I.length)F.push(`${I.length} scanner${I.length===1?"":"s"} ${T.scannerFailMode==="closed"?"failed closed":"failed open"}`);if(d.size)F.push(`${d.size} active time-limited waiver${d.size===1?"":"s"}`);if(!F.length)F.push("All recorded checks satisfy policy");let B=this.idFn(),y=this.now();return this.run(`INSERT INTO security_deploy_decisions
       (id, organization_id, project_id, environment_id, operation_id, policy_id, policy_version, outcome, scanner_versions, finding_ids, waiver_ids, explanation, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[B,E.organizationId,E.projectId,E.environmentId,E.operationId??null,T.id,T.version,z,Gd(C),Gd([...R,...h].map((Y)=>Y.id)),Gd([...d.values()].map((Y)=>Y.id)),F.join("; "),y]),this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,operationId:E.operationId,type:"security.deploy.decision",level:z==="block"?"error":z==="warn"?"warning":"info",payload:{decisionId:B,outcome:z,policyId:T.id,policyVersion:T.version,scannerVersions:C,blockerIds:R.map((Y)=>Y.id),waiverIds:[...d.values()].map((Y)=>Y.id),explanation:F.join("; ")}}),this.getDecision(B)}getDecision(E){let _=this.controlPlane.database.query("SELECT * FROM security_deploy_decisions WHERE id = ?").get(E);return _?EQ(_):void 0}listDecisions(E,_=100){return this.controlPlane.database.query("SELECT * FROM security_deploy_decisions WHERE environment_id = ? ORDER BY created_at DESC LIMIT ?").all(E,Math.min(500,Math.max(1,_))).map(EQ)}addReleaseArtifact(E){let _=this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? AND kind = ? AND digest = ?").get(E.releaseId,E.kind,E.digest);if(_)return HJ(_);let T=this.idFn(),r=this.now();return this.run(`INSERT INTO release_security_artifacts
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[B,E.organizationId,E.projectId,E.environmentId,E.operationId??null,T.id,T.version,z,Gd(C),Gd([...R,...h].map((Y)=>Y.id)),Gd([...d.values()].map((Y)=>Y.id)),F.join("; "),y]),this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,operationId:E.operationId,type:"security.deploy.decision",level:z==="block"?"error":z==="warn"?"warning":"info",payload:{decisionId:B,outcome:z,policyId:T.id,policyVersion:T.version,scannerVersions:C,blockerIds:R.map((Y)=>Y.id),waiverIds:[...d.values()].map((Y)=>Y.id),explanation:F.join("; ")}}),this.getDecision(B)}getDecision(E){let _=this.controlPlane.database.query("SELECT * FROM security_deploy_decisions WHERE id = ?").get(E);return _?E9(_):void 0}listDecisions(E,_=100){return this.controlPlane.database.query("SELECT * FROM security_deploy_decisions WHERE environment_id = ? ORDER BY created_at DESC LIMIT ?").all(E,Math.min(500,Math.max(1,_))).map(E9)}addReleaseArtifact(E){let _=this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? AND kind = ? AND digest = ?").get(E.releaseId,E.kind,E.digest);if(_)return HJ(_);let T=this.idFn(),r=this.now();return this.run(`INSERT INTO release_security_artifacts
       (id, organization_id, project_id, environment_id, release_id, kind, format, digest, summary, content, sensitive, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,E.organizationId,E.projectId,E.environmentId??null,E.releaseId,E.kind,E.format,E.digest,Gd(E.summary),E.content??null,E.sensitive?1:0,r]),this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,type:"security.release_artifact.created",payload:{artifactId:T,releaseId:E.releaseId,kind:E.kind,format:E.format,digest:E.digest,sensitive:E.sensitive}}),HJ(this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE id = ?").get(T))}listReleaseArtifacts(E,_=!1){return this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? ORDER BY created_at, kind").all(E).map(HJ).map((T)=>T.sensitive&&!_?{...T,content:void 0}:T)}summary(E,_,T){let r=this.listFindings({organizationId:E,projectId:_,environmentId:T,limit:1000}),d=this.listScanRuns({organizationId:E,projectId:_,environmentId:T,limit:1000}),t={info:0,low:0,medium:0,high:0,critical:0};for(let h of r)if(h.status==="open"||h.status==="acknowledged")t[h.severity]++;let R={passed:0,failed:0,skipped:0,unavailable:0,unsupported:0,stale:0};for(let h of d)R[h.status]++;return{open:t,waived:r.filter((h)=>h.status==="waived").length,resolved:r.filter((h)=>h.status==="resolved").length,checks:R,lastScannedAt:d[0]?.completedAt}}exportPosture(E){let _=this.controlPlane.listProjects().filter((T)=>T.organizationId===E);return bE({format:"ts-cloud-security-posture",version:1,exportedAt:this.now(),organizationId:E,policies:this.listPolicies(E),findings:this.listFindings({organizationId:E,limit:1000}),waivers:this.listWaivers().filter((T)=>this.getFinding(T.findingId)?.organizationId===E),scans:_.flatMap((T)=>this.listScanRuns({organizationId:E,projectId:T.id,limit:1000})),decisions:_.flatMap((T)=>this.controlPlane.listEnvironments(T.id).flatMap((r)=>this.listDecisions(r.id,1000)))})}}bN();eN();import{existsSync as ml,readdirSync as sl,readFileSync as pl,statSync as ol}from"node:fs";import{extname as Ei,join as _i,relative as Ti}from"node:path";var rQ=[{name:"AWS Access Key ID",pattern:/(?:^|[^A-Z0-9])((AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16})(?:[^A-Z0-9]|$)/g,severity:"critical",description:"AWS Access Key ID detected"},{name:"AWS Secret Access Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key|secretAccessKey)['"]?\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,severity:"critical",description:"AWS Secret Access Key detected"},{name:"AWS Secret Key (Generic)",pattern:/(?:^|['"`:=\s])([A-Za-z0-9/+=]{40})(?:['"`\s]|$)/g,severity:"high",description:"Potential AWS Secret Key (40-char base64)"},{name:"Generic API Key",pattern:/(?:api[_-]?key|apikey|api[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9_\-]{20,})['"]?/gi,severity:"high",description:"Generic API key detected"},{name:"RSA Private Key",pattern:/-----BEGIN RSA PRIVATE KEY-----/g,severity:"critical",description:"RSA private key detected"},{name:"OpenSSH Private Key",pattern:/-----BEGIN OPENSSH PRIVATE KEY-----/g,severity:"critical",description:"OpenSSH private key detected"},{name:"EC Private Key",pattern:/-----BEGIN EC PRIVATE KEY-----/g,severity:"critical",description:"EC private key detected"},{name:"PGP Private Key",pattern:/-----BEGIN PGP PRIVATE KEY BLOCK-----/g,severity:"critical",description:"PGP private key detected"},{name:"GitHub Token",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"critical",description:"GitHub personal access token detected"},{name:"GitHub OAuth",pattern:/github[_-]?oauth[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9_]{40})['"]?/gi,severity:"critical",description:"GitHub OAuth token detected"},{name:"Slack Token",pattern:/xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*/g,severity:"critical",description:"Slack token detected"},{name:"Slack Webhook",pattern:/https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g,severity:"high",description:"Slack webhook URL detected"},{name:"Discord Webhook",pattern:/https:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]+/g,severity:"high",description:"Discord webhook URL detected"},{name:"JWT Token",pattern:/eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,severity:"high",description:"JWT token detected"},{name:"Google API Key",pattern:/AIza[0-9A-Za-z_-]{35}/g,severity:"critical",description:"Google API key detected"},{name:"Google OAuth ID",pattern:/[0-9]+-[A-Za-z0-9_]{32}\.apps\.googleusercontent\.com/g,severity:"high",description:"Google OAuth client ID detected"},{name:"Firebase API Key",pattern:/(?:firebase[_-]?api[_-]?key)\s*[=:]\s*['"]?([A-Za-z0-9_-]{39})['"]?/gi,severity:"critical",description:"Firebase API key detected"},{name:"Cloudflare API Token",pattern:/(?:cloudflare[_-]?api[_-]?token|cf[_-]?api[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{40})['"]?/gi,severity:"critical",description:"Cloudflare API token detected"},{name:"Azure Client Secret",pattern:/(?:azure[_-]?client[_-]?secret|client[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9~._-]{34,})['"]?/gi,severity:"critical",description:"Azure client secret detected"},{name:"Heroku API Key",pattern:/(?:heroku[_-]?api[_-]?key)\s*[=:]\s*['"]?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]?/gi,severity:"critical",description:"Heroku API key detected"},{name:"Database Connection String",pattern:/(?:mysql|postgres|postgresql|mongodb|redis|mongodb\+srv):\/\/[^:]+:[^@]+@[^/\s]+/gi,severity:"critical",description:"Database connection string with credentials detected"},{name:"Database Password",pattern:/(?:db[_-]?password|database[_-]?password|mysql[_-]?password|postgres[_-]?password)\s*[=:]\s*['"]?([^'"\s]{8,})['"]?/gi,severity:"critical",description:"Database password detected"},{name:"Stripe API Key",pattern:/(?:sk|pk)_(?:test|live)_[0-9a-zA-Z]{24,}/g,severity:"critical",description:"Stripe API key detected"},{name:"PayPal Client ID",pattern:/(?:paypal[_-]?client[_-]?id)\s*[=:]\s*['"]?([A-Za-z0-9_-]{80})['"]?/gi,severity:"high",description:"PayPal client ID detected"},{name:"Square Access Token",pattern:/sq0[a-z]{3}-[0-9A-Za-z_-]{22,}/g,severity:"critical",description:"Square access token detected"},{name:"Twilio API Key",pattern:/SK[a-f0-9]{32}/g,severity:"critical",description:"Twilio API key detected"},{name:"SendGrid API Key",pattern:/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,severity:"critical",description:"SendGrid API key detected"},{name:"Mailgun API Key",pattern:/key-[0-9a-zA-Z]{32}/g,severity:"critical",description:"Mailgun API key detected"},{name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"]([^'"]{8,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded password detected"},{name:"Secret/Token Assignment",pattern:/(?:secret|token|auth[_-]?token|access[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9_\-/+=]{16,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded secret or token detected"},{name:"NPM Token",pattern:/(?:npm[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{36})['"]?/gi,severity:"critical",description:"NPM token detected"},{name:"SSH Private Key Path Exposed",pattern:/~\/\.ssh\/id_[a-z]+|\/home\/[^/]+\/\.ssh\/id_[a-z]+/g,severity:"medium",description:"SSH private key path exposed"},{name:"Env Variable with Secret",pattern:/(?:process\.env\.)((?=[A-Z_]*(?:SECRET|KEY|TOKEN|PASSWORD|CREDENTIAL|AUTH))[A-Z_]+)\s*(?:===?\s*['"]([^'"]+)['"])?/g,severity:"medium",description:"Environment variable containing secret may be exposed"}],ri=[".js",".jsx",".ts",".tsx",".mjs",".cjs",".vue",".svelte",".html",".htm",".css",".scss",".less",".json",".yaml",".yml",".toml",".xml",".env",".config",".conf"],di=["node_modules",".git",".svn",".hg","dist","build","coverage",".nyc_output","__pycache__",".pytest_cache","vendor",".idea",".vscode",".turbo",".next",".nuxt","framework.bak","pantry",".pantry","tests","test","__tests__","spec","__mocks__",".github",".gitlab",".circleci"],ti=["package-lock.json","yarn.lock","pnpm-lock.yaml","bun.lockb","bun.lock","*.min.js","*.min.css","*.map","*.d.ts","*.test.ts","*.test.js","*.spec.ts","*.spec.js",".env",".env.*"];class XA{patterns;excludeDirs;excludeFiles;maxFileSize;constructor(E){this.patterns=[...rQ,...E?.customPatterns||[]],this.excludeDirs=[...di,...E?.excludeDirs||[]],this.excludeFiles=[...ti,...E?.excludeFiles||[]],this.maxFileSize=E?.maxFileSize||1048576}async scan(E){let _=Date.now(),T=[],r=0,{directory:d,exclude:t=[],include:R,skipPatterns:h=[]}=E,N=E.failOnSeverity||"critical";if(!ml(d))throw Error(`Directory not found: ${d}`);let S=this.getFilesToScan(d,[...this.excludeDirs,...t],R);for(let $ of S){let I=Ti(d,$);if(this.shouldExcludeFile(I))continue;try{if(ol($).size>this.maxFileSize)continue;let e=pl($,"utf-8"),z=this.scanContent(e,I,h);T.push(...z),r++}catch{continue}}let A={critical:T.filter(($)=>$.pattern.severity==="critical").length,high:T.filter(($)=>$.pattern.severity==="high").length,medium:T.filter(($)=>$.pattern.severity==="medium").length,low:T.filter(($)=>$.pattern.severity==="low").length},L=["low","medium","high","critical"],O=L.indexOf(N),c=!0;for(let $=O;$<L.length;$++)if(A[L[$]]>0){c=!1;break}return{passed:c,findings:T,scannedFiles:r,duration:Date.now()-_,summary:A}}scanContent(E,_,T){let r=[],d=E.split(`
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,E.organizationId,E.projectId,E.environmentId??null,E.releaseId,E.kind,E.format,E.digest,Gd(E.summary),E.content??null,E.sensitive?1:0,r]),this.controlPlane.appendEvent({organizationId:E.organizationId,projectId:E.projectId,type:"security.release_artifact.created",payload:{artifactId:T,releaseId:E.releaseId,kind:E.kind,format:E.format,digest:E.digest,sensitive:E.sensitive}}),HJ(this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE id = ?").get(T))}listReleaseArtifacts(E,_=!1){return this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? ORDER BY created_at, kind").all(E).map(HJ).map((T)=>T.sensitive&&!_?{...T,content:void 0}:T)}summary(E,_,T){let r=this.listFindings({organizationId:E,projectId:_,environmentId:T,limit:1000}),d=this.listScanRuns({organizationId:E,projectId:_,environmentId:T,limit:1000}),t={info:0,low:0,medium:0,high:0,critical:0};for(let h of r)if(h.status==="open"||h.status==="acknowledged")t[h.severity]++;let R={passed:0,failed:0,skipped:0,unavailable:0,unsupported:0,stale:0};for(let h of d)R[h.status]++;return{open:t,waived:r.filter((h)=>h.status==="waived").length,resolved:r.filter((h)=>h.status==="resolved").length,checks:R,lastScannedAt:d[0]?.completedAt}}exportPosture(E){let _=this.controlPlane.listProjects().filter((T)=>T.organizationId===E);return bE({format:"ts-cloud-security-posture",version:1,exportedAt:this.now(),organizationId:E,policies:this.listPolicies(E),findings:this.listFindings({organizationId:E,limit:1000}),waivers:this.listWaivers().filter((T)=>this.getFinding(T.findingId)?.organizationId===E),scans:_.flatMap((T)=>this.listScanRuns({organizationId:E,projectId:T.id,limit:1000})),decisions:_.flatMap((T)=>this.controlPlane.listEnvironments(T.id).flatMap((r)=>this.listDecisions(r.id,1000)))})}}bN();eN();import{existsSync as ml,readdirSync as sl,readFileSync as pl,statSync as ol}from"node:fs";import{extname as Ei,join as _i,relative as Ti}from"node:path";var r9=[{name:"AWS Access Key ID",pattern:/(?:^|[^A-Z0-9])((AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16})(?:[^A-Z0-9]|$)/g,severity:"critical",description:"AWS Access Key ID detected"},{name:"AWS Secret Access Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key|secretAccessKey)['"]?\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,severity:"critical",description:"AWS Secret Access Key detected"},{name:"AWS Secret Key (Generic)",pattern:/(?:^|['"`:=\s])([A-Za-z0-9/+=]{40})(?:['"`\s]|$)/g,severity:"high",description:"Potential AWS Secret Key (40-char base64)"},{name:"Generic API Key",pattern:/(?:api[_-]?key|apikey|api[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9_\-]{20,})['"]?/gi,severity:"high",description:"Generic API key detected"},{name:"RSA Private Key",pattern:/-----BEGIN RSA PRIVATE KEY-----/g,severity:"critical",description:"RSA private key detected"},{name:"OpenSSH Private Key",pattern:/-----BEGIN OPENSSH PRIVATE KEY-----/g,severity:"critical",description:"OpenSSH private key detected"},{name:"EC Private Key",pattern:/-----BEGIN EC PRIVATE KEY-----/g,severity:"critical",description:"EC private key detected"},{name:"PGP Private Key",pattern:/-----BEGIN PGP PRIVATE KEY BLOCK-----/g,severity:"critical",description:"PGP private key detected"},{name:"GitHub Token",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"critical",description:"GitHub personal access token detected"},{name:"GitHub OAuth",pattern:/github[_-]?oauth[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9_]{40})['"]?/gi,severity:"critical",description:"GitHub OAuth token detected"},{name:"Slack Token",pattern:/xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*/g,severity:"critical",description:"Slack token detected"},{name:"Slack Webhook",pattern:/https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g,severity:"high",description:"Slack webhook URL detected"},{name:"Discord Webhook",pattern:/https:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]+/g,severity:"high",description:"Discord webhook URL detected"},{name:"JWT Token",pattern:/eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,severity:"high",description:"JWT token detected"},{name:"Google API Key",pattern:/AIza[0-9A-Za-z_-]{35}/g,severity:"critical",description:"Google API key detected"},{name:"Google OAuth ID",pattern:/[0-9]+-[A-Za-z0-9_]{32}\.apps\.googleusercontent\.com/g,severity:"high",description:"Google OAuth client ID detected"},{name:"Firebase API Key",pattern:/(?:firebase[_-]?api[_-]?key)\s*[=:]\s*['"]?([A-Za-z0-9_-]{39})['"]?/gi,severity:"critical",description:"Firebase API key detected"},{name:"Cloudflare API Token",pattern:/(?:cloudflare[_-]?api[_-]?token|cf[_-]?api[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{40})['"]?/gi,severity:"critical",description:"Cloudflare API token detected"},{name:"Azure Client Secret",pattern:/(?:azure[_-]?client[_-]?secret|client[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9~._-]{34,})['"]?/gi,severity:"critical",description:"Azure client secret detected"},{name:"Heroku API Key",pattern:/(?:heroku[_-]?api[_-]?key)\s*[=:]\s*['"]?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]?/gi,severity:"critical",description:"Heroku API key detected"},{name:"Database Connection String",pattern:/(?:mysql|postgres|postgresql|mongodb|redis|mongodb\+srv):\/\/[^:]+:[^@]+@[^/\s]+/gi,severity:"critical",description:"Database connection string with credentials detected"},{name:"Database Password",pattern:/(?:db[_-]?password|database[_-]?password|mysql[_-]?password|postgres[_-]?password)\s*[=:]\s*['"]?([^'"\s]{8,})['"]?/gi,severity:"critical",description:"Database password detected"},{name:"Stripe API Key",pattern:/(?:sk|pk)_(?:test|live)_[0-9a-zA-Z]{24,}/g,severity:"critical",description:"Stripe API key detected"},{name:"PayPal Client ID",pattern:/(?:paypal[_-]?client[_-]?id)\s*[=:]\s*['"]?([A-Za-z0-9_-]{80})['"]?/gi,severity:"high",description:"PayPal client ID detected"},{name:"Square Access Token",pattern:/sq0[a-z]{3}-[0-9A-Za-z_-]{22,}/g,severity:"critical",description:"Square access token detected"},{name:"Twilio API Key",pattern:/SK[a-f0-9]{32}/g,severity:"critical",description:"Twilio API key detected"},{name:"SendGrid API Key",pattern:/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,severity:"critical",description:"SendGrid API key detected"},{name:"Mailgun API Key",pattern:/key-[0-9a-zA-Z]{32}/g,severity:"critical",description:"Mailgun API key detected"},{name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"]([^'"]{8,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded password detected"},{name:"Secret/Token Assignment",pattern:/(?:secret|token|auth[_-]?token|access[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9_\-/+=]{16,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded secret or token detected"},{name:"NPM Token",pattern:/(?:npm[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{36})['"]?/gi,severity:"critical",description:"NPM token detected"},{name:"SSH Private Key Path Exposed",pattern:/~\/\.ssh\/id_[a-z]+|\/home\/[^/]+\/\.ssh\/id_[a-z]+/g,severity:"medium",description:"SSH private key path exposed"},{name:"Env Variable with Secret",pattern:/(?:process\.env\.)((?=[A-Z_]*(?:SECRET|KEY|TOKEN|PASSWORD|CREDENTIAL|AUTH))[A-Z_]+)\s*(?:===?\s*['"]([^'"]+)['"])?/g,severity:"medium",description:"Environment variable containing secret may be exposed"}],ri=[".js",".jsx",".ts",".tsx",".mjs",".cjs",".vue",".svelte",".html",".htm",".css",".scss",".less",".json",".yaml",".yml",".toml",".xml",".env",".config",".conf"],di=["node_modules",".git",".svn",".hg","dist","build","coverage",".nyc_output","__pycache__",".pytest_cache","vendor",".idea",".vscode",".turbo",".next",".nuxt","framework.bak","pantry",".pantry","tests","test","__tests__","spec","__mocks__",".github",".gitlab",".circleci"],ti=["package-lock.json","yarn.lock","pnpm-lock.yaml","bun.lockb","bun.lock","*.min.js","*.min.css","*.map","*.d.ts","*.test.ts","*.test.js","*.spec.ts","*.spec.js",".env",".env.*"];class XA{patterns;excludeDirs;excludeFiles;maxFileSize;constructor(E){this.patterns=[...r9,...E?.customPatterns||[]],this.excludeDirs=[...di,...E?.excludeDirs||[]],this.excludeFiles=[...ti,...E?.excludeFiles||[]],this.maxFileSize=E?.maxFileSize||1048576}async scan(E){let _=Date.now(),T=[],r=0,{directory:d,exclude:t=[],include:R,skipPatterns:h=[]}=E,N=E.failOnSeverity||"critical";if(!ml(d))throw Error(`Directory not found: ${d}`);let S=this.getFilesToScan(d,[...this.excludeDirs,...t],R);for(let $ of S){let I=Ti(d,$);if(this.shouldExcludeFile(I))continue;try{if(ol($).size>this.maxFileSize)continue;let e=pl($,"utf-8"),z=this.scanContent(e,I,h);T.push(...z),r++}catch{continue}}let A={critical:T.filter(($)=>$.pattern.severity==="critical").length,high:T.filter(($)=>$.pattern.severity==="high").length,medium:T.filter(($)=>$.pattern.severity==="medium").length,low:T.filter(($)=>$.pattern.severity==="low").length},L=["low","medium","high","critical"],O=L.indexOf(N),c=!0;for(let $=O;$<L.length;$++)if(A[L[$]]>0){c=!1;break}return{passed:c,findings:T,scannedFiles:r,duration:Date.now()-_,summary:A}}scanContent(E,_,T){let r=[],d=E.split(`
 `);for(let t of this.patterns){if(T.includes(t.name))continue;t.pattern.lastIndex=0;let R;while((R=t.pattern.exec(E))!==null){let h=E.substring(0,R.index),N=h.split(`
 `).length,S=h.lastIndexOf(`
-`),A=R.index-S,L=d[N-1]||"";if(this.isLikelyPlaceholder(R[0],L))continue;let O=R[1]||R[0];if(t.name==="AWS Secret Key (Generic)"&&/^[a-f0-9]{40}$/i.test(O))continue;if(t.name==="AWS Secret Key (Generic)"&&!this.hasSecretCharacterDiversity(O))continue;if(t.name==="AWS Secret Key (Generic)"&&/^(?:Actions|Commands|Controllers|Handlers|Jobs|Listeners|Middleware|Models|Resources|Services)\//.test(O))continue;if(this.isLowEntropy(O))continue;r.push({file:_,line:N,column:A,match:this.maskSecret(R[0]),pattern:t,context:this.maskSecret(L.trim())})}}return r}isLikelyPlaceholder(E,_){let T=["example","placeholder","your_","YOUR_","xxx","XXX","***","test","TEST","dummy","DUMMY","fake","FAKE","sample","SAMPLE","<your","${","{{","process.env","import.meta.env","CHANGEME","TODO","FIXME"],r=E.toLowerCase(),d=_.toLowerCase();for(let R of T)if(r.includes(R.toLowerCase())||d.includes(R.toLowerCase()))return!0;let t=_.trim();if(t.startsWith("//")||t.startsWith("#")||t.startsWith("*")||t.startsWith("/*")){if(d.includes("example")||d.includes("format:")||d.includes("e.g."))return!0}return!1}isLowEntropy(E){if(E.length<8)return!1;if(new Set(E).size<8)return!0;if(/(.)\1{3,}/.test(E))return!0;return!1}hasSecretCharacterDiversity(E){let _=/[\d+=]/.test(E),T=[/[a-z]/.test(E),/[A-Z]/.test(E),/\d/.test(E),/[/+=]/.test(E)];return _&&T.filter(Boolean).length>=3}maskSecret(E){if(E.length<=8)return"*".repeat(E.length);let _=Math.min(4,Math.floor(E.length*0.2));return E.substring(0,_)+"*".repeat(E.length-_*2)+E.substring(E.length-_)}getFilesToScan(E,_,T){let r=[],d=T||ri,t=(R)=>{let h=sl(R,{withFileTypes:!0});for(let N of h){let S=_i(R,N.name);if(N.isDirectory()){if(!_.includes(N.name))t(S)}else if(N.isFile()){let A=Ei(N.name).toLowerCase();if(d.includes(A)||N.name.startsWith(".env")||N.name.endsWith(".config"))r.push(S)}}};return t(E),r}shouldExcludeFile(E){let _=E.split("/").pop()||"";for(let T of this.excludeFiles)if(T.startsWith("*")){let r=T.substring(1);if(_.endsWith(r))return!0}else if(T.endsWith("*")){let r=T.substring(0,T.length-1);if(_.startsWith(r))return!0}else if(_===T)return!0;return!1}addPattern(E){this.patterns.push(E)}getPatterns(){return[...this.patterns]}}function Ri(E,_){return{status:"unavailable",findings:[],error:`${E.id} exceeded its ${_}ms timeout`,metadata:{timeoutMs:_}}}class XN{posture;defaultTimeoutMs;nowFn;constructor(E,_={}){this.posture=E;this.defaultTimeoutMs=_.defaultTimeoutMs??60000,this.nowFn=_.now??(()=>new Date)}async run(E,_){let T=this.nowFn(),r=Math.max(100,E.timeoutMs??this.defaultTimeoutMs),d=new AbortController,t,R=new Promise((A)=>{t=setTimeout(()=>{d.abort(),A(Ri(E,r))},r)}),h;try{h=await Promise.race([E.scan({..._,signal:d.signal}),R])}catch(A){h={status:"unavailable",findings:[],error:A instanceof Error?A.message:String(A)}}finally{if(t)clearTimeout(t)}let N=this.nowFn(),S={..._,scannerId:E.id,scannerVersion:E.version,status:h.status,findings:h.findings,metadata:h.metadata,error:h.error,startedAt:T.toISOString(),completedAt:N.toISOString(),durationMs:Math.max(0,N.getTime()-T.getTime())};return this.posture.recordScan(S)}async runAll(E,_){return Promise.all(E.map((T)=>this.run(T,_)))}}class OO{scanner;id="source-secrets";version="1.0.0";timeoutMs=30000;constructor(E=new XA){this.scanner=E}async scan(E){if(!E.artifactRoot)return{status:"skipped",findings:[],error:"No artifact root was supplied"};let _=await this.scanner.scan({directory:E.artifactRoot,failOnSeverity:"critical"});return{status:_.passed?"passed":"failed",findings:_.findings.map((T)=>({...E,ruleId:T.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:T.pattern.severity,title:T.pattern.name,description:T.pattern.description,subject:`${T.file}:${T.line}`,evidence:{file:T.file,line:T.line,column:T.column,match:T.match,context:T.context},remediation:"Remove the credential, rotate it at its issuer, and use a managed secret or environment reference."})),metadata:{scannedFiles:_.scannedFiles,summary:_.summary}}}}function hi(E){let _=E?.toLowerCase();return _==="critical"||_==="high"||_==="medium"||_==="low"?_:"info"}class YJ{id="trivy-image";version;timeoutMs;constructor(E={}){this.version=E.version??"local",this.timeoutMs=E.timeoutMs??120000,this.executable=E.executable??"trivy"}executable;async scan(E){if(!E.imageRef)return{status:"skipped",findings:[],error:"No image reference was supplied"};let _;try{_=Bun.spawn([this.executable,"image","--format","json","--quiet","--scanners","vuln",E.imageRef],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",TRIVY_NO_PROGRESS:"true"}})}catch(N){return{status:"unsupported",findings:[],error:N instanceof Error?N.message:String(N)}}let T=()=>_.kill();E.signal.addEventListener("abort",T,{once:!0});let[r,d,t]=await Promise.all([_.exited,new Response(_.stdout).text(),new Response(_.stderr).text()]);if(E.signal.removeEventListener("abort",T),r!==0)return{status:/not found|enoent/i.test(t)?"unsupported":"unavailable",findings:[],error:t.slice(0,2000)||`Trivy exited with ${r}`};let R=JSON.parse(d),h=[];for(let N of R.Results??[])for(let S of N.Vulnerabilities??[]){let A=S.VulnerabilityID??"unknown-vulnerability";h.push({...E,ruleId:A,severity:hi(S.Severity),title:S.Title||A,description:S.Description||`${A} affects ${S.PkgName??"an image package"}.`,subject:`${E.imageRef}:${S.PkgName??"unknown"}:${S.InstalledVersion??"unknown"}`,evidence:{image:E.imageRef,target:N.Target??"",cve:A,package:S.PkgName??"",installedVersion:S.InstalledVersion??"",fixedVersion:S.FixedVersion??"",reference:S.PrimaryURL??""},remediation:S.FixedVersion?`Upgrade ${S.PkgName} to ${S.FixedVersion} or later.`:"Remove or replace the affected package and rescan the image."})}return{status:h.length?"failed":"passed",findings:h,metadata:{imageRef:E.imageRef,vulnerabilityCount:h.length,localOnly:!0}}}}import{createHash as Ni,createVerify as rDE}from"node:crypto";import{existsSync as Si,readFileSync as Ai}from"node:fs";import{basename as Li,join as Oi,resolve as dQ}from"node:path";function cO(E){return Ni("sha256").update(E).digest("hex")}function ci(E){let _=[["dependencies","required"],["optionalDependencies","optional"],["devDependencies","excluded"],["peerDependencies","required"]],T=new Map;for(let[r,d]of _){let t=E[r];if(!t||typeof t!=="object"||Array.isArray(t))continue;for(let[R,h]of Object.entries(t)){let N=String(h).replace(/^[~^]/,""),S=`${R}@${N}`;if(!T.has(S))T.set(S,{type:"library",name:R,version:N,purl:`pkg:npm/${encodeURIComponent(R)}@${encodeURIComponent(N)}`,scope:d})}}return[...T.values()].sort((r,d)=>`${r.name}@${r.version}`.localeCompare(`${d.name}@${d.version}`))}function tQ(E,_={}){let T=Oi(dQ(E),"package.json");if(!Si(T))throw Error(`Cannot generate an SBOM: ${T} was not found`);let r=Ai(T,"utf8"),d=JSON.parse(r),t=String(d.name??Li(dQ(E))),R=String(d.version??"0.0.0"),h=cO(r);return{bomFormat:"CycloneDX",specVersion:"1.5",serialNumber:_.serial??`urn:uuid:${crypto.randomUUID()}`,version:1,metadata:{timestamp:(_.now??new Date).toISOString(),component:{type:"application",name:t,version:R,purl:`pkg:npm/${encodeURIComponent(t)}@${encodeURIComponent(R)}`,hashes:[{alg:"SHA-256",content:h}]},tools:[{vendor:"ts-cloud",name:"security-posture",version:"1.0.0"}]},components:ci(d)}}async function RQ(E,_={}){let T=Bun.spawn([_.executable??"syft",E,"-o","cyclonedx-json"],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",SYFT_CHECK_FOR_APP_UPDATE:"false"}}),r=()=>T.kill();_.signal?.addEventListener("abort",r,{once:!0});let[d,t,R]=await Promise.all([T.exited,new Response(T.stdout).text(),new Response(T.stderr).text()]);if(_.signal?.removeEventListener("abort",r),d!==0)throw Error(R.slice(0,2000)||`Syft exited with ${d}`);return JSON.parse(t)}function QJ(E,_,T){let r=JSON.stringify(T);return E.addReleaseArtifact({..._,kind:"sbom",format:`cyclonedx-${T.specVersion}+json`,digest:`sha256:${cO(r)}`,summary:{component:T.metadata.component.name,version:T.metadata.component.version,components:T.components.length},content:r,sensitive:!0})}function hQ(E,_,T){let r={total:T.length,critical:0,high:0,medium:0,low:0,info:0,fixable:0};for(let t of T){r[t.severity]++;let R=t.evidence;if(typeof R.fixedVersion==="string"&&R.fixedVersion)r.fixable++}let d=JSON.stringify({releaseId:_.releaseId,generatedAt:new Date().toISOString(),findings:T.map((t)=>({id:t.id,ruleId:t.ruleId,severity:t.severity,subject:t.subject,remediation:t.remediation}))});return E.addReleaseArtifact({..._,kind:"vulnerability_summary",format:"ts-cloud-vulnerability-summary+json",digest:`sha256:${cO(d)}`,summary:r,content:d,sensitive:!0})}function NQ(E){if(!E.artifact&&!E.artifactSha256)throw Error("Release provenance requires artifact content or a SHA-256 digest");return{_type:"https://in-toto.io/Statement/v1",subject:[{name:E.artifactName,digest:{sha256:E.artifactSha256?.replace(/^sha256:/,"")??cO(E.artifact)}}],predicateType:"https://slsa.dev/provenance/v1",predicate:{buildDefinition:{buildType:"https://ts-cloud.dev/build/v1",externalParameters:E.externalParameters??{},internalParameters:{},resolvedDependencies:E.resolvedDependencies??[]},runDetails:{builder:{id:"https://ts-cloud.dev/builders/local/v1"},metadata:{invocationId:E.invocationId,startedOn:E.startedAt,finishedOn:E.completedAt}}}}}function SQ(E,_,T){let r=JSON.stringify(T);return E.addReleaseArtifact({..._,kind:"provenance",format:"in-toto+slsa-v1+json",digest:`sha256:${cO(r)}`,summary:{subjects:T.subject.length,builder:T.predicate.runDetails.builder.id,buildType:T.predicate.buildDefinition.buildType},content:r,sensitive:!0})}function Jr(E,_){let T=E.environments.get(_);if(!T)throw Error(`Security scope for environment '${_}' was not found`);return{organizationId:E.organization.id,projectId:E.project.id,environmentId:T.id}}function UO(E,_){let T=new Oh(E.store),r=T.listPolicies(E.organization.id);for(let[d,t]of E.environments){if(r.some((h)=>h.environmentId===t.id))continue;let R=d==="production"||t.kind==="production";r.push(T.createPolicy({organizationId:E.organization.id,environmentId:t.id,name:R?"Production baseline":"Environment baseline",scannerFailMode:R?"closed":"open",requiredScanners:["source-secrets"],rules:R?[{minimumSeverity:"critical",action:"block"},{minimumSeverity:"high",action:"block"},{minimumSeverity:"medium",action:"warn"},{minimumSeverity:"low",action:"record"}]:[{minimumSeverity:"critical",action:"warn"},{minimumSeverity:"high",action:"warn"},{minimumSeverity:"low",action:"record"}],actorId:_}))}return r}function AQ(E,_,T,r={}){let d=T.findings.map((t)=>({..._,ruleId:t.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:t.pattern.severity,title:t.pattern.name,description:t.pattern.description,subject:`${t.file}:${t.line}`,evidence:{file:t.file,line:t.line,column:t.column,match:t.match,context:t.context},remediation:"Remove and rotate the credential, then reference it through a managed secret or environment variable."}));return E.recordScan({..._,scannerId:"source-secrets",scannerVersion:r.scannerVersion??"1.0.0",status:r.skipped?"skipped":T.passed?"passed":"failed",findings:r.skipped?[]:d,metadata:{scannedFiles:T.scannedFiles,durationMs:T.duration,summary:T.summary},durationMs:T.duration,error:r.skipped?"The operator explicitly skipped source-secret scanning.":void 0})}function LQ(E,_,T="The operator explicitly skipped source-secret scanning."){return E.recordScan({..._,scannerId:"source-secrets",scannerVersion:"1.0.0",status:"skipped",findings:[],error:T})}function Ui(E,_){let T=[],r=_.security;if(r?.firewall&&!["active","configured","ok"].includes(String(r.firewall.status)))T.push({...E,ruleId:"host-firewall-disabled",severity:"high",title:"Host firewall is not active",description:String(r.firewall.summary??"The host firewall did not report an active configuration."),subject:"host:firewall",evidence:{status:String(r.firewall.status??"unknown"),rules:Array.isArray(r.firewall.rules)?r.firewall.rules.length:0},remediation:"Apply the declarative firewall policy and confirm only required listeners are public."});for(let d of r?.ports??[]){let t=String(d.listen??""),R=Number(t.match(/:(\d+)$/)?.[1]);if(d.exposure==="public"&&Number.isFinite(R)&&![22,80,443].includes(R))T.push({...E,ruleId:"unexpected-public-listener",severity:"medium",title:`Unexpected public listener on port ${R}`,description:`${String(d.processName??"A process")} is listening publicly outside the standard SSH/HTTP/HTTPS ports.`,subject:`host:port:${R}`,evidence:{protocol:String(d.proto??""),listen:t,process:String(d.processName??"")},remediation:"Bind the service to loopback/private networking or explicitly document and firewall the required public port."})}for(let d of r?.tlsCertificates??[]){let t=Number(d.daysRemaining);if(Number.isFinite(t)&&t<30)T.push({...E,ruleId:"tls-certificate-expiry",severity:t<14?"high":"medium",title:`TLS certificate expires in ${t} days`,description:`${String(d.domain??"A configured domain")} needs renewal.`,subject:`tls:${String(d.domain??"unknown")}`,evidence:{domain:String(d.domain??""),daysRemaining:t,expires:String(d.expires??"")},remediation:"Renew the certificate and verify automatic renewal can complete before expiry."})}for(let d of _.diagnostics??[]){if(d.status==="pass"||d.status==="ok")continue;T.push({...E,ruleId:`diagnostic-${String(d.name??"unknown").toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:d.status==="fail"?"high":"medium",title:String(d.name??"Host security check"),description:String(d.detail??"The host security diagnostic did not pass."),subject:`diagnostic:${String(d.name??"unknown")}`,evidence:{status:String(d.status??"unknown")},remediation:"Follow the diagnostic guidance, rerun the check, and confirm the finding resolves."})}return T}function ND(E,_,T){let r=!!T.security||Array.isArray(T.diagnostics),d=r?Ui(_,T):[];return E.recordScan({..._,scannerId:"host-posture",scannerVersion:"1.0.0",status:!r?"unavailable":d.length?"failed":"passed",findings:d,metadata:{source:"dashboard-live-probe",checks:Array.isArray(T.diagnostics)?T.diagnostics.length:0},error:r?void 0:"Live host posture data was unavailable; source and provider checks remain usable."})}function JN(E,_){let T=E.evaluateGate({..._.scope,operationId:_.operationId}),r=E.listFindings({..._.scope,limit:1000}).filter((d)=>d.status!=="resolved");return{decision:T,summary:{desiredConfigHash:_.desiredConfigHash??null,securityImpact:{critical:r.filter((d)=>d.severity==="critical").length,high:r.filter((d)=>d.severity==="high").length,waived:r.filter((d)=>d.status==="waived").length,assigned:r.filter((d)=>!!d.ownerActorId).length},blockingFindingIds:T.findingIds,policy:{id:T.policyId,version:T.policyVersion},scannerVersions:T.scannerVersions}}}async function OQ(E,_){let T=_.scanner??new YJ({timeoutMs:_.scannerTimeoutMs}),d=await new XN(E,{defaultTimeoutMs:_.scannerTimeoutMs??120000}).run(T,{..._.scope,releaseId:_.releaseId,imageRef:_.imageRef}),t={..._.scope,releaseId:_.releaseId};hQ(E,t,d.findings);let R=_.generateImageSbom??RQ,h=new AbortController,N=Math.max(100,_.sbomTimeoutMs??120000),S,A=new Promise((c,$)=>{S=setTimeout(()=>{h.abort(),$(Error(`syft-sbom exceeded its ${N}ms timeout`))},N)}),L="unavailable";try{let c=await Promise.race([R(_.imageRef,{signal:h.signal}),A]);QJ(E,t,c),E.recordScan({..._.scope,releaseId:_.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"passed",metadata:{imageRef:_.imageRef,format:`cyclonedx-${c.specVersion}+json`,components:c.components.length,localOnly:!0}}),L="image"}catch(c){let $=c instanceof Error?c.message:String(c);try{let I=tQ(_.artifactRoot);QJ(E,t,I),E.recordScan({..._.scope,releaseId:_.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unsupported",error:`Image inventory was unavailable; attached a package-manifest SBOM instead. ${$}`,metadata:{imageRef:_.imageRef,fallback:"package-manifest",components:I.components.length,localOnly:!0}}),L="manifest"}catch(I){E.recordScan({..._.scope,releaseId:_.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unavailable",error:`Image and manifest SBOM generation were unavailable. ${$}; ${I instanceof Error?I.message:String(I)}`,metadata:{imageRef:_.imageRef,localOnly:!0}})}}finally{if(S)clearTimeout(S)}let O=NQ({artifactName:_.imageRef,artifact:_.imageSha256?void 0:_.imageRef,artifactSha256:_.imageSha256,invocationId:_.invocationId,startedAt:_.startedAt,completedAt:_.completedAt??new Date().toISOString(),externalParameters:_.externalParameters??{imageRef:_.imageRef}});return SQ(E,t,O),{scan:d,sbomSource:L}}async function mi(E){let _=H1();if(_.emptyEnvKey||_.emptyEnvSecret)_E("Empty AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY env var detected — likely a misconfigured .env file. Remove the empty lines or fill them in.");U(`AWS credentials: ${_.description}`);try{let r=await new Rt(E).getCallerIdentity();if(r.Arn)U(`AWS identity: ${r.Arn}`)}catch(T){_E(`Could not verify AWS identity: ${T.message}`)}}function si(){try{return UD("git rev-parse --short HEAD",{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{return Date.now().toString(36)}}async function xJ(E,_,T,r){let{ensureManagementDashboard:d}=await RO().then(() => DY);d(E,{logger:{info:U,warn:_E}});let t=E.sites||{},R=Object.entries(t);if(R.length===0)return _E("infrastructure.compute is set but no sites are configured — nothing to deploy. Add sites to `cloud.config.ts`."),!0;if(r&&!t[r])return Q(`Site '${r}' was not found. Configured sites: ${R.map(([C])=>C).join(", ")}`),!1;let h=R.filter(([C,e])=>{if(!e)return!1;if(r&&C!==r)return!1;if(n_(e)==="bucket")return _E(`Site '${C}' targets a bucket — skipping compute deploy (handled by the static-site path).`),!1;return cP(e)});if(h.length===0)return!0;if(r)U(`Deploying only '${r}'. Other sites keep their current release; proxy routes are still regenerated in full.`);let N=E.project.slug,A=(E.infrastructure?.compute||{}).runtime||"bun",L=x_({config:E}),O=si(),c=new Map,$={step:(C)=>wE(C),error:(C)=>Q(C)};if(!await SO(E,"beforeDeploy",$))return!1;if(!await SO(E,"beforeBuild",$))return!1;for(let[C,e]of h){let z=n_(e);if(b(`Preparing site: ${C}`),U(`Domain: ${e.domain||"(none)"}`),U(`Source: ${e.root}`),U(`Kind: ${z==="server-static"?"static (shipped to /var/www)":"app (systemd service)"}`),z==="server-app")U(`Start: ${e.start}`),U(`Port: ${e.port??"(unset)"}`);if(e.build){wE(`Running build: ${e.build}`);try{UD(e.build,{stdio:"inherit",cwd:process.cwd()})}catch(B){return Q(`Build failed for site '${C}': ${B.message}`),!1}}if(!zr(e.root))return Q(`Build output not found at ${e.root} for site '${C}'`),!1;let F=ai(li(),`${N}-${C}-${O}.tar.gz`);wE(`Packaging ${e.root} → ${F}`);try{let B=(e.exclude||[]).map((y)=>`--exclude='${y}'`).join(" ");UD(`tar czf "${F}" -C "${e.root}" ${B} .`,{stdio:"inherit"})}catch(B){return Q(`Failed to package '${C}': ${B.message}`),!1}c.set(C,F)}if(!await SO(E,"afterBuild",$))return!1;let I=await o$({config:r?{...E,sites:Object.fromEntries(h)}:E,rpxConfig:r?E:void 0,environment:_,driver:L,sha:O,runtime:A,tarballForSite:(C)=>{let e=c.get(C);if(!e)throw Error(`Missing tarball for site '${C}'`);return e},logger:{info:(C)=>U(C),warn:(C)=>_E(C),error:(C)=>Q(C),step:(C)=>wE(C),success:(C)=>Z(C)}});if(I&&!await SO(E,"afterDeploy",$))return!1;return I}async function OD(E){let _=new XA;wE("Running pre-deployment security scan...");let T=await _.scan({directory:E.sourceDir,failOnSeverity:E.failOnSeverity||"critical",skipPatterns:E.skipPatterns});return{passed:T.passed,result:T}}function cD(E){let{summary:_,findings:T,scannedFiles:r,duration:d}=E;if(U(`
+`),A=R.index-S,L=d[N-1]||"";if(this.isLikelyPlaceholder(R[0],L))continue;let O=R[1]||R[0];if(t.name==="AWS Secret Key (Generic)"&&/^[a-f0-9]{40}$/i.test(O))continue;if(t.name==="AWS Secret Key (Generic)"&&!this.hasSecretCharacterDiversity(O))continue;if(t.name==="AWS Secret Key (Generic)"&&/^(?:Actions|Commands|Controllers|Handlers|Jobs|Listeners|Middleware|Models|Resources|Services)\//.test(O))continue;if(this.isLowEntropy(O))continue;r.push({file:_,line:N,column:A,match:this.maskSecret(R[0]),pattern:t,context:this.maskSecret(L.trim())})}}return r}isLikelyPlaceholder(E,_){let T=["example","placeholder","your_","YOUR_","xxx","XXX","***","test","TEST","dummy","DUMMY","fake","FAKE","sample","SAMPLE","<your","${","{{","process.env","import.meta.env","CHANGEME","TODO","FIXME"],r=E.toLowerCase(),d=_.toLowerCase();for(let R of T)if(r.includes(R.toLowerCase())||d.includes(R.toLowerCase()))return!0;let t=_.trim();if(t.startsWith("//")||t.startsWith("#")||t.startsWith("*")||t.startsWith("/*")){if(d.includes("example")||d.includes("format:")||d.includes("e.g."))return!0}return!1}isLowEntropy(E){if(E.length<8)return!1;if(new Set(E).size<8)return!0;if(/(.)\1{3,}/.test(E))return!0;return!1}hasSecretCharacterDiversity(E){let _=/[\d+=]/.test(E),T=[/[a-z]/.test(E),/[A-Z]/.test(E),/\d/.test(E),/[/+=]/.test(E)];return _&&T.filter(Boolean).length>=3}maskSecret(E){if(E.length<=8)return"*".repeat(E.length);let _=Math.min(4,Math.floor(E.length*0.2));return E.substring(0,_)+"*".repeat(E.length-_*2)+E.substring(E.length-_)}getFilesToScan(E,_,T){let r=[],d=T||ri,t=(R)=>{let h=sl(R,{withFileTypes:!0});for(let N of h){let S=_i(R,N.name);if(N.isDirectory()){if(!_.includes(N.name))t(S)}else if(N.isFile()){let A=Ei(N.name).toLowerCase();if(d.includes(A)||N.name.startsWith(".env")||N.name.endsWith(".config"))r.push(S)}}};return t(E),r}shouldExcludeFile(E){let _=E.split("/").pop()||"";for(let T of this.excludeFiles)if(T.startsWith("*")){let r=T.substring(1);if(_.endsWith(r))return!0}else if(T.endsWith("*")){let r=T.substring(0,T.length-1);if(_.startsWith(r))return!0}else if(_===T)return!0;return!1}addPattern(E){this.patterns.push(E)}getPatterns(){return[...this.patterns]}}function Ri(E,_){return{status:"unavailable",findings:[],error:`${E.id} exceeded its ${_}ms timeout`,metadata:{timeoutMs:_}}}class XN{posture;defaultTimeoutMs;nowFn;constructor(E,_={}){this.posture=E;this.defaultTimeoutMs=_.defaultTimeoutMs??60000,this.nowFn=_.now??(()=>new Date)}async run(E,_){let T=this.nowFn(),r=Math.max(100,E.timeoutMs??this.defaultTimeoutMs),d=new AbortController,t,R=new Promise((A)=>{t=setTimeout(()=>{d.abort(),A(Ri(E,r))},r)}),h;try{h=await Promise.race([E.scan({..._,signal:d.signal}),R])}catch(A){h={status:"unavailable",findings:[],error:A instanceof Error?A.message:String(A)}}finally{if(t)clearTimeout(t)}let N=this.nowFn(),S={..._,scannerId:E.id,scannerVersion:E.version,status:h.status,findings:h.findings,metadata:h.metadata,error:h.error,startedAt:T.toISOString(),completedAt:N.toISOString(),durationMs:Math.max(0,N.getTime()-T.getTime())};return this.posture.recordScan(S)}async runAll(E,_){return Promise.all(E.map((T)=>this.run(T,_)))}}class OO{scanner;id="source-secrets";version="1.0.0";timeoutMs=30000;constructor(E=new XA){this.scanner=E}async scan(E){if(!E.artifactRoot)return{status:"skipped",findings:[],error:"No artifact root was supplied"};let _=await this.scanner.scan({directory:E.artifactRoot,failOnSeverity:"critical"});return{status:_.passed?"passed":"failed",findings:_.findings.map((T)=>({...E,ruleId:T.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:T.pattern.severity,title:T.pattern.name,description:T.pattern.description,subject:`${T.file}:${T.line}`,evidence:{file:T.file,line:T.line,column:T.column,match:T.match,context:T.context},remediation:"Remove the credential, rotate it at its issuer, and use a managed secret or environment reference."})),metadata:{scannedFiles:_.scannedFiles,summary:_.summary}}}}function hi(E){let _=E?.toLowerCase();return _==="critical"||_==="high"||_==="medium"||_==="low"?_:"info"}class YJ{id="trivy-image";version;timeoutMs;constructor(E={}){this.version=E.version??"local",this.timeoutMs=E.timeoutMs??120000,this.executable=E.executable??"trivy"}executable;async scan(E){if(!E.imageRef)return{status:"skipped",findings:[],error:"No image reference was supplied"};let _;try{_=Bun.spawn([this.executable,"image","--format","json","--quiet","--scanners","vuln",E.imageRef],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",TRIVY_NO_PROGRESS:"true"}})}catch(N){return{status:"unsupported",findings:[],error:N instanceof Error?N.message:String(N)}}let T=()=>_.kill();E.signal.addEventListener("abort",T,{once:!0});let[r,d,t]=await Promise.all([_.exited,new Response(_.stdout).text(),new Response(_.stderr).text()]);if(E.signal.removeEventListener("abort",T),r!==0)return{status:/not found|enoent/i.test(t)?"unsupported":"unavailable",findings:[],error:t.slice(0,2000)||`Trivy exited with ${r}`};let R=JSON.parse(d),h=[];for(let N of R.Results??[])for(let S of N.Vulnerabilities??[]){let A=S.VulnerabilityID??"unknown-vulnerability";h.push({...E,ruleId:A,severity:hi(S.Severity),title:S.Title||A,description:S.Description||`${A} affects ${S.PkgName??"an image package"}.`,subject:`${E.imageRef}:${S.PkgName??"unknown"}:${S.InstalledVersion??"unknown"}`,evidence:{image:E.imageRef,target:N.Target??"",cve:A,package:S.PkgName??"",installedVersion:S.InstalledVersion??"",fixedVersion:S.FixedVersion??"",reference:S.PrimaryURL??""},remediation:S.FixedVersion?`Upgrade ${S.PkgName} to ${S.FixedVersion} or later.`:"Remove or replace the affected package and rescan the image."})}return{status:h.length?"failed":"passed",findings:h,metadata:{imageRef:E.imageRef,vulnerabilityCount:h.length,localOnly:!0}}}}import{createHash as Ni,createVerify as rDE}from"node:crypto";import{existsSync as Si,readFileSync as Ai}from"node:fs";import{basename as Li,join as Oi,resolve as d9}from"node:path";function cO(E){return Ni("sha256").update(E).digest("hex")}function ci(E){let _=[["dependencies","required"],["optionalDependencies","optional"],["devDependencies","excluded"],["peerDependencies","required"]],T=new Map;for(let[r,d]of _){let t=E[r];if(!t||typeof t!=="object"||Array.isArray(t))continue;for(let[R,h]of Object.entries(t)){let N=String(h).replace(/^[~^]/,""),S=`${R}@${N}`;if(!T.has(S))T.set(S,{type:"library",name:R,version:N,purl:`pkg:npm/${encodeURIComponent(R)}@${encodeURIComponent(N)}`,scope:d})}}return[...T.values()].sort((r,d)=>`${r.name}@${r.version}`.localeCompare(`${d.name}@${d.version}`))}function t9(E,_={}){let T=Oi(d9(E),"package.json");if(!Si(T))throw Error(`Cannot generate an SBOM: ${T} was not found`);let r=Ai(T,"utf8"),d=JSON.parse(r),t=String(d.name??Li(d9(E))),R=String(d.version??"0.0.0"),h=cO(r);return{bomFormat:"CycloneDX",specVersion:"1.5",serialNumber:_.serial??`urn:uuid:${crypto.randomUUID()}`,version:1,metadata:{timestamp:(_.now??new Date).toISOString(),component:{type:"application",name:t,version:R,purl:`pkg:npm/${encodeURIComponent(t)}@${encodeURIComponent(R)}`,hashes:[{alg:"SHA-256",content:h}]},tools:[{vendor:"ts-cloud",name:"security-posture",version:"1.0.0"}]},components:ci(d)}}async function R9(E,_={}){let T=Bun.spawn([_.executable??"syft",E,"-o","cyclonedx-json"],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",SYFT_CHECK_FOR_APP_UPDATE:"false"}}),r=()=>T.kill();_.signal?.addEventListener("abort",r,{once:!0});let[d,t,R]=await Promise.all([T.exited,new Response(T.stdout).text(),new Response(T.stderr).text()]);if(_.signal?.removeEventListener("abort",r),d!==0)throw Error(R.slice(0,2000)||`Syft exited with ${d}`);return JSON.parse(t)}function QJ(E,_,T){let r=JSON.stringify(T);return E.addReleaseArtifact({..._,kind:"sbom",format:`cyclonedx-${T.specVersion}+json`,digest:`sha256:${cO(r)}`,summary:{component:T.metadata.component.name,version:T.metadata.component.version,components:T.components.length},content:r,sensitive:!0})}function h9(E,_,T){let r={total:T.length,critical:0,high:0,medium:0,low:0,info:0,fixable:0};for(let t of T){r[t.severity]++;let R=t.evidence;if(typeof R.fixedVersion==="string"&&R.fixedVersion)r.fixable++}let d=JSON.stringify({releaseId:_.releaseId,generatedAt:new Date().toISOString(),findings:T.map((t)=>({id:t.id,ruleId:t.ruleId,severity:t.severity,subject:t.subject,remediation:t.remediation}))});return E.addReleaseArtifact({..._,kind:"vulnerability_summary",format:"ts-cloud-vulnerability-summary+json",digest:`sha256:${cO(d)}`,summary:r,content:d,sensitive:!0})}function N9(E){if(!E.artifact&&!E.artifactSha256)throw Error("Release provenance requires artifact content or a SHA-256 digest");return{_type:"https://in-toto.io/Statement/v1",subject:[{name:E.artifactName,digest:{sha256:E.artifactSha256?.replace(/^sha256:/,"")??cO(E.artifact)}}],predicateType:"https://slsa.dev/provenance/v1",predicate:{buildDefinition:{buildType:"https://ts-cloud.dev/build/v1",externalParameters:E.externalParameters??{},internalParameters:{},resolvedDependencies:E.resolvedDependencies??[]},runDetails:{builder:{id:"https://ts-cloud.dev/builders/local/v1"},metadata:{invocationId:E.invocationId,startedOn:E.startedAt,finishedOn:E.completedAt}}}}}function S9(E,_,T){let r=JSON.stringify(T);return E.addReleaseArtifact({..._,kind:"provenance",format:"in-toto+slsa-v1+json",digest:`sha256:${cO(r)}`,summary:{subjects:T.subject.length,builder:T.predicate.runDetails.builder.id,buildType:T.predicate.buildDefinition.buildType},content:r,sensitive:!0})}function Jr(E,_){let T=E.environments.get(_);if(!T)throw Error(`Security scope for environment '${_}' was not found`);return{organizationId:E.organization.id,projectId:E.project.id,environmentId:T.id}}function UO(E,_){let T=new Oh(E.store),r=T.listPolicies(E.organization.id);for(let[d,t]of E.environments){if(r.some((h)=>h.environmentId===t.id))continue;let R=d==="production"||t.kind==="production";r.push(T.createPolicy({organizationId:E.organization.id,environmentId:t.id,name:R?"Production baseline":"Environment baseline",scannerFailMode:R?"closed":"open",requiredScanners:["source-secrets"],rules:R?[{minimumSeverity:"critical",action:"block"},{minimumSeverity:"high",action:"block"},{minimumSeverity:"medium",action:"warn"},{minimumSeverity:"low",action:"record"}]:[{minimumSeverity:"critical",action:"warn"},{minimumSeverity:"high",action:"warn"},{minimumSeverity:"low",action:"record"}],actorId:_}))}return r}function A9(E,_,T,r={}){let d=T.findings.map((t)=>({..._,ruleId:t.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:t.pattern.severity,title:t.pattern.name,description:t.pattern.description,subject:`${t.file}:${t.line}`,evidence:{file:t.file,line:t.line,column:t.column,match:t.match,context:t.context},remediation:"Remove and rotate the credential, then reference it through a managed secret or environment variable."}));return E.recordScan({..._,scannerId:"source-secrets",scannerVersion:r.scannerVersion??"1.0.0",status:r.skipped?"skipped":T.passed?"passed":"failed",findings:r.skipped?[]:d,metadata:{scannedFiles:T.scannedFiles,durationMs:T.duration,summary:T.summary},durationMs:T.duration,error:r.skipped?"The operator explicitly skipped source-secret scanning.":void 0})}function L9(E,_,T="The operator explicitly skipped source-secret scanning."){return E.recordScan({..._,scannerId:"source-secrets",scannerVersion:"1.0.0",status:"skipped",findings:[],error:T})}function Ui(E,_){let T=[],r=_.security;if(r?.firewall&&!["active","configured","ok"].includes(String(r.firewall.status)))T.push({...E,ruleId:"host-firewall-disabled",severity:"high",title:"Host firewall is not active",description:String(r.firewall.summary??"The host firewall did not report an active configuration."),subject:"host:firewall",evidence:{status:String(r.firewall.status??"unknown"),rules:Array.isArray(r.firewall.rules)?r.firewall.rules.length:0},remediation:"Apply the declarative firewall policy and confirm only required listeners are public."});for(let d of r?.ports??[]){let t=String(d.listen??""),R=Number(t.match(/:(\d+)$/)?.[1]);if(d.exposure==="public"&&Number.isFinite(R)&&![22,80,443].includes(R))T.push({...E,ruleId:"unexpected-public-listener",severity:"medium",title:`Unexpected public listener on port ${R}`,description:`${String(d.processName??"A process")} is listening publicly outside the standard SSH/HTTP/HTTPS ports.`,subject:`host:port:${R}`,evidence:{protocol:String(d.proto??""),listen:t,process:String(d.processName??"")},remediation:"Bind the service to loopback/private networking or explicitly document and firewall the required public port."})}for(let d of r?.tlsCertificates??[]){let t=Number(d.daysRemaining);if(Number.isFinite(t)&&t<30)T.push({...E,ruleId:"tls-certificate-expiry",severity:t<14?"high":"medium",title:`TLS certificate expires in ${t} days`,description:`${String(d.domain??"A configured domain")} needs renewal.`,subject:`tls:${String(d.domain??"unknown")}`,evidence:{domain:String(d.domain??""),daysRemaining:t,expires:String(d.expires??"")},remediation:"Renew the certificate and verify automatic renewal can complete before expiry."})}for(let d of _.diagnostics??[]){if(d.status==="pass"||d.status==="ok")continue;T.push({...E,ruleId:`diagnostic-${String(d.name??"unknown").toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:d.status==="fail"?"high":"medium",title:String(d.name??"Host security check"),description:String(d.detail??"The host security diagnostic did not pass."),subject:`diagnostic:${String(d.name??"unknown")}`,evidence:{status:String(d.status??"unknown")},remediation:"Follow the diagnostic guidance, rerun the check, and confirm the finding resolves."})}return T}function ND(E,_,T){let r=!!T.security||Array.isArray(T.diagnostics),d=r?Ui(_,T):[];return E.recordScan({..._,scannerId:"host-posture",scannerVersion:"1.0.0",status:!r?"unavailable":d.length?"failed":"passed",findings:d,metadata:{source:"dashboard-live-probe",checks:Array.isArray(T.diagnostics)?T.diagnostics.length:0},error:r?void 0:"Live host posture data was unavailable; source and provider checks remain usable."})}function JN(E,_){let T=E.evaluateGate({..._.scope,operationId:_.operationId}),r=E.listFindings({..._.scope,limit:1000}).filter((d)=>d.status!=="resolved");return{decision:T,summary:{desiredConfigHash:_.desiredConfigHash??null,securityImpact:{critical:r.filter((d)=>d.severity==="critical").length,high:r.filter((d)=>d.severity==="high").length,waived:r.filter((d)=>d.status==="waived").length,assigned:r.filter((d)=>!!d.ownerActorId).length},blockingFindingIds:T.findingIds,policy:{id:T.policyId,version:T.policyVersion},scannerVersions:T.scannerVersions}}}async function O9(E,_){let T=_.scanner??new YJ({timeoutMs:_.scannerTimeoutMs}),d=await new XN(E,{defaultTimeoutMs:_.scannerTimeoutMs??120000}).run(T,{..._.scope,releaseId:_.releaseId,imageRef:_.imageRef}),t={..._.scope,releaseId:_.releaseId};h9(E,t,d.findings);let R=_.generateImageSbom??R9,h=new AbortController,N=Math.max(100,_.sbomTimeoutMs??120000),S,A=new Promise((c,$)=>{S=setTimeout(()=>{h.abort(),$(Error(`syft-sbom exceeded its ${N}ms timeout`))},N)}),L="unavailable";try{let c=await Promise.race([R(_.imageRef,{signal:h.signal}),A]);QJ(E,t,c),E.recordScan({..._.scope,releaseId:_.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"passed",metadata:{imageRef:_.imageRef,format:`cyclonedx-${c.specVersion}+json`,components:c.components.length,localOnly:!0}}),L="image"}catch(c){let $=c instanceof Error?c.message:String(c);try{let I=t9(_.artifactRoot);QJ(E,t,I),E.recordScan({..._.scope,releaseId:_.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unsupported",error:`Image inventory was unavailable; attached a package-manifest SBOM instead. ${$}`,metadata:{imageRef:_.imageRef,fallback:"package-manifest",components:I.components.length,localOnly:!0}}),L="manifest"}catch(I){E.recordScan({..._.scope,releaseId:_.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unavailable",error:`Image and manifest SBOM generation were unavailable. ${$}; ${I instanceof Error?I.message:String(I)}`,metadata:{imageRef:_.imageRef,localOnly:!0}})}}finally{if(S)clearTimeout(S)}let O=N9({artifactName:_.imageRef,artifact:_.imageSha256?void 0:_.imageRef,artifactSha256:_.imageSha256,invocationId:_.invocationId,startedAt:_.startedAt,completedAt:_.completedAt??new Date().toISOString(),externalParameters:_.externalParameters??{imageRef:_.imageRef}});return S9(E,t,O),{scan:d,sbomSource:L}}async function mi(E){let _=H1();if(_.emptyEnvKey||_.emptyEnvSecret)_E("Empty AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY env var detected — likely a misconfigured .env file. Remove the empty lines or fill them in.");U(`AWS credentials: ${_.description}`);try{let r=await new Rt(E).getCallerIdentity();if(r.Arn)U(`AWS identity: ${r.Arn}`)}catch(T){_E(`Could not verify AWS identity: ${T.message}`)}}function si(){try{return UD("git rev-parse --short HEAD",{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{return Date.now().toString(36)}}async function xJ(E,_,T,r){let{ensureManagementDashboard:d}=await RO().then(() => DY);d(E,{logger:{info:U,warn:_E}});let t=E.sites||{},R=Object.entries(t);if(R.length===0)return _E("infrastructure.compute is set but no sites are configured — nothing to deploy. Add sites to `cloud.config.ts`."),!0;if(r&&!t[r])return Q(`Site '${r}' was not found. Configured sites: ${R.map(([C])=>C).join(", ")}`),!1;let h=R.filter(([C,e])=>{if(!e)return!1;if(r&&C!==r)return!1;if(n_(e)==="bucket")return _E(`Site '${C}' targets a bucket — skipping compute deploy (handled by the static-site path).`),!1;return cP(e)});if(h.length===0)return!0;if(r)U(`Deploying only '${r}'. Other sites keep their current release; proxy routes are still regenerated in full.`);let N=E.project.slug,A=(E.infrastructure?.compute||{}).runtime||"bun",L=x_({config:E}),O=si(),c=new Map,$={step:(C)=>wE(C),error:(C)=>Q(C)};if(!await SO(E,"beforeDeploy",$))return!1;if(!await SO(E,"beforeBuild",$))return!1;for(let[C,e]of h){let z=n_(e);if(b(`Preparing site: ${C}`),U(`Domain: ${e.domain||"(none)"}`),U(`Source: ${e.root}`),U(`Kind: ${z==="server-static"?"static (shipped to /var/www)":"app (systemd service)"}`),z==="server-app")U(`Start: ${e.start}`),U(`Port: ${e.port??"(unset)"}`);if(e.build){wE(`Running build: ${e.build}`);try{UD(e.build,{stdio:"inherit",cwd:process.cwd()})}catch(B){return Q(`Build failed for site '${C}': ${B.message}`),!1}}if(!zr(e.root))return Q(`Build output not found at ${e.root} for site '${C}'`),!1;let F=ai(li(),`${N}-${C}-${O}.tar.gz`);wE(`Packaging ${e.root} → ${F}`);try{let B=(e.exclude||[]).map((y)=>`--exclude='${y}'`).join(" ");UD(`tar czf "${F}" -C "${e.root}" ${B} .`,{stdio:"inherit"})}catch(B){return Q(`Failed to package '${C}': ${B.message}`),!1}c.set(C,F)}if(!await SO(E,"afterBuild",$))return!1;let I=await o$({config:r?{...E,sites:Object.fromEntries(h)}:E,rpxConfig:r?E:void 0,environment:_,driver:L,sha:O,runtime:A,tarballForSite:(C)=>{let e=c.get(C);if(!e)throw Error(`Missing tarball for site '${C}'`);return e},logger:{info:(C)=>U(C),warn:(C)=>_E(C),error:(C)=>Q(C),step:(C)=>wE(C),success:(C)=>Z(C)}});if(I&&!await SO(E,"afterDeploy",$))return!1;return I}async function OD(E){let _=new XA;wE("Running pre-deployment security scan...");let T=await _.scan({directory:E.sourceDir,failOnSeverity:E.failOnSeverity||"critical",skipPatterns:E.skipPatterns});return{passed:T.passed,result:T}}function cD(E){let{summary:_,findings:T,scannedFiles:r,duration:d}=E;if(U(`
 Scanned ${r} files in ${d}ms`),_.critical>0)Q(`  Critical: ${_.critical}`);else U(`  Critical: ${_.critical}`);if(_.high>0)_E(`  High: ${_.high}`);else U(`  High: ${_.high}`);if(U(`  Medium: ${_.medium}`),U(`  Low: ${_.low}`),T.length>0){U(`
 Findings:`);let t=T.filter((A)=>A.pattern.severity==="critical"),R=T.filter((A)=>A.pattern.severity==="high"),h=T.filter((A)=>A.pattern.severity==="medium"),N=T.filter((A)=>A.pattern.severity==="low"),S=(A,L,O)=>{if(A.length>0){console.log(`
-${FR(`[${L}]`,O)}`);for(let c of A.slice(0,10))U(`  ${c.pattern.name}`),U(`    File: ${c.file}:${c.line}`),U(`    Match: ${c.match}`);if(A.length>10)U(`  ... and ${A.length-10} more ${L.toLowerCase()} findings`)}};S(t,"CRITICAL","red"),S(R,"HIGH","yellow"),S(h,"MEDIUM","blue"),S(N,"LOW","gray")}}function uQ(E,_){let T=Object.keys(E.environments??{});if(_&&T.includes(_))return _;if(T.includes("production"))return"production";if(T[0])return T[0];throw Error("A configured environment is required for security policy evaluation")}function bJ(E,_,T){let r=uQ(E,_),d=iE(process.cwd(),E);try{let t=new Oh(d.store);UO(d);let R=Jr(d,r);if(T)AQ(t,R,T);else LQ(t,R);let h=JN(t,{scope:R,desiredConfigHash:d.project.desiredConfigHash});return U(`Security policy: ${h.decision.policyId} v${h.decision.policyVersion} — ${h.decision.outcome.toUpperCase()}`),U(`Security decision: ${h.decision.explanation}`),{allowed:h.decision.outcome!=="block",explanation:h.decision.explanation}}finally{d.store.close()}}async function pi(E,_){let T=uQ(E),r=iE(process.cwd(),E);try{let d=new Oh(r.store);UO(r);let t=Jr(r,T),R=_.imageSha256?`${_.imageRef}@sha256:${_.imageSha256.replace(/^sha256:/,"")}`:_.imageRef;wE("Scanning the built image and producing release security artifacts...");let h=await OQ(d,{scope:t,releaseId:R,imageRef:_.imageRef,imageSha256:_.imageSha256,artifactRoot:_.artifactRoot,invocationId:_.invocationId,startedAt:_.startedAt,externalParameters:{imageRef:_.imageRef,artifactRoot:_.artifactRoot}});U(`Image scanner: ${h.scan.run.status} (${h.scan.findings.length} findings)`),U(`Release SBOM: ${h.sbomSource==="image"?"full image inventory":h.sbomSource==="manifest"?"package-manifest fallback":"unavailable"}`);let N=JN(d,{scope:t,operationId:_.invocationId,desiredConfigHash:r.project.desiredConfigHash});return U(`Release policy: ${N.decision.policyId} v${N.decision.policyVersion} — ${N.decision.outcome.toUpperCase()}`),U(`Release decision: ${N.decision.explanation}`),{allowed:N.decision.outcome!=="block",explanation:N.decision.explanation}}finally{r.store.close()}}function uJ(E){E.command("deploy:security-scan","Run pre-deployment security scan").option("--source <path>","Source directory to scan",{default:"."}).option("--fail-on <severity>","Fail on severity level (critical, high, medium, low)",{default:"critical"}).option("--skip-patterns <patterns>","Comma-separated list of pattern names to skip").action(async(_)=>{b("Pre-Deployment Security Scan");try{let T=_?.source||".",r=_?.failOn||"critical",d=_?.skipPatterns?.split(",").map((h)=>h.trim())||[];if(!zr(T)){Q(`Source directory not found: ${T}`);return}U(`Source: ${T}`),U(`Fail on: ${r} or higher severity`);let{passed:t,result:R}=await OD({sourceDir:T,failOnSeverity:r,skipPatterns:d});if(cD(R),t)Z(`
+${FR(`[${L}]`,O)}`);for(let c of A.slice(0,10))U(`  ${c.pattern.name}`),U(`    File: ${c.file}:${c.line}`),U(`    Match: ${c.match}`);if(A.length>10)U(`  ... and ${A.length-10} more ${L.toLowerCase()} findings`)}};S(t,"CRITICAL","red"),S(R,"HIGH","yellow"),S(h,"MEDIUM","blue"),S(N,"LOW","gray")}}function u9(E,_){let T=Object.keys(E.environments??{});if(_&&T.includes(_))return _;if(T.includes("production"))return"production";if(T[0])return T[0];throw Error("A configured environment is required for security policy evaluation")}function bJ(E,_,T){let r=u9(E,_),d=iE(process.cwd(),E);try{let t=new Oh(d.store);UO(d);let R=Jr(d,r);if(T)A9(t,R,T);else L9(t,R);let h=JN(t,{scope:R,desiredConfigHash:d.project.desiredConfigHash});return U(`Security policy: ${h.decision.policyId} v${h.decision.policyVersion} — ${h.decision.outcome.toUpperCase()}`),U(`Security decision: ${h.decision.explanation}`),{allowed:h.decision.outcome!=="block",explanation:h.decision.explanation}}finally{d.store.close()}}async function pi(E,_){let T=u9(E),r=iE(process.cwd(),E);try{let d=new Oh(r.store);UO(r);let t=Jr(r,T),R=_.imageSha256?`${_.imageRef}@sha256:${_.imageSha256.replace(/^sha256:/,"")}`:_.imageRef;wE("Scanning the built image and producing release security artifacts...");let h=await O9(d,{scope:t,releaseId:R,imageRef:_.imageRef,imageSha256:_.imageSha256,artifactRoot:_.artifactRoot,invocationId:_.invocationId,startedAt:_.startedAt,externalParameters:{imageRef:_.imageRef,artifactRoot:_.artifactRoot}});U(`Image scanner: ${h.scan.run.status} (${h.scan.findings.length} findings)`),U(`Release SBOM: ${h.sbomSource==="image"?"full image inventory":h.sbomSource==="manifest"?"package-manifest fallback":"unavailable"}`);let N=JN(d,{scope:t,operationId:_.invocationId,desiredConfigHash:r.project.desiredConfigHash});return U(`Release policy: ${N.decision.policyId} v${N.decision.policyVersion} — ${N.decision.outcome.toUpperCase()}`),U(`Release decision: ${N.decision.explanation}`),{allowed:N.decision.outcome!=="block",explanation:N.decision.explanation}}finally{r.store.close()}}function uJ(E){E.command("deploy:security-scan","Run pre-deployment security scan").option("--source <path>","Source directory to scan",{default:"."}).option("--fail-on <severity>","Fail on severity level (critical, high, medium, low)",{default:"critical"}).option("--skip-patterns <patterns>","Comma-separated list of pattern names to skip").action(async(_)=>{b("Pre-Deployment Security Scan");try{let T=_?.source||".",r=_?.failOn||"critical",d=_?.skipPatterns?.split(",").map((h)=>h.trim())||[];if(!zr(T)){Q(`Source directory not found: ${T}`);return}U(`Source: ${T}`),U(`Fail on: ${r} or higher severity`);let{passed:t,result:R}=await OD({sourceDir:T,failOnSeverity:r,skipPatterns:d});if(cD(R),t)Z(`
 ✓ Security scan passed - no blocking issues found`);else Q(`
 ✗ Security scan failed - blocking issues detected`),U(`
 Recommendations:`),U("  1. Remove any hardcoded credentials from your code"),U("  2. Use environment variables or AWS Secrets Manager"),U("  3. Add sensitive files to .gitignore"),U("  4. Use --skip-patterns to ignore false positives"),process.exit(1)}catch(T){Q(`Security scan failed: ${T.message}`),process.exit(1)}}),E.command("deploy","Deploy infrastructure").option("--stack <name>","Stack name").option("--env <environment>","Environment to deploy to").option("--site <name>","Deploy specific site only (routes are still regenerated in full)").option("--skip-security-scan","Skip pre-deployment security scan").option("--skip-dns-verification","Skip DNS provider verification and record creation (use when DNS is already configured)").option("--security-fail-on <severity>","Security scan fail threshold (critical, high, medium, low)",{default:"critical"}).option("--dry-run","Show the deployment plan without making changes").option("--yes","Skip confirmation prompts (non-interactive / CI)").action(async(_)=>{b("Deploying Infrastructure");let T=_?.yes===!0||process.env.CI==="true",r=_?.env||"staging",d=null;d=await oi(r);try{let t=await p(),{errors:R,warnings:h}=ke(t);for(let P of h)_E(P);if(R.length>0){Q(`
@@ -9849,9 +9849,9 @@ Stack trace:`),console.error(t.stack)}finally{if(d)await d()}}),E.command("deplo
 Server deployment complete!`)}catch(T){Q(`Deployment failed: ${T.message}`),process.exitCode=1}}),E.command("deploy:serverless","Deploy a serverless application (http/queue/cli Lambda functions)").option("--env <environment>","Environment (production, staging, development)").option("--skip-build","Skip local build hooks").option("--skip-hooks","Skip remote deploy hooks (e.g. migrations)").option("--redeploy","Re-activate the last build without rebuilding").action(async(_)=>{try{let T=await p(),r=_?.env||"production",d=mN(T);if(d){Q(d),process.exitCode=1;return}let{deployServerlessApp:t,redeployServerlessApp:R}=await TT().then(() => Kr);if(_?.redeploy){await R(T,r);return}await t(T,r,{skipBuild:_?.skipBuild,skipDeployHooks:_?.skipHooks})}catch(T){Q(`Deployment failed: ${T.message}`),process.exitCode=1}}),E.command("serverless:rollback","Roll back a serverless app to the previous build").option("--env <environment>","Environment (production, staging, development)").action(async(_)=>{try{let T=await p(),r=_?.env||"production",{rollbackServerlessApp:d}=await TT().then(() => Kr);await d(T,r)}catch(T){Q(`Rollback failed: ${T.message}`),process.exitCode=1}}),E.command("deploy:rollback [site]","Roll a compute site back to a previous release").option("--env <environment>","Environment (production, staging, development)").option("--to <release>","Release id to roll back to (default: the previous release)").action(async(_,T)=>{b("Rolling Back Release");try{let r=await p(),d=T?.env||"production",t=_||Object.keys(r.sites||{})[0];if(!t){Q("No site configured to roll back."),process.exitCode=1;return}let{rollbackComputeSite:R}=await IA().then(() => hO),h=await R({driver:x_({config:r}),slug:r.project.slug,environment:d,logger:PE},{siteName:t,to:T?.to});if(!h.success){Q(`Rollback failed: ${h.error||"unknown error"}`),process.exitCode=1;return}for(let N of h.perInstance||[])U(`  ${N.instanceId}: ${N.output?.trim()||N.status}`)}catch(r){Q(`Rollback failed: ${r.message}`),process.exitCode=1}}),E.command("deploy:history [site]","Show a compute site's deployment history").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Number of entries to show",{default:"20"}).action(async(_,T)=>{b("Deployment History");try{let r=await p(),d=T?.env||"production",t=_||Object.keys(r.sites||{})[0];if(!t){Q("No site configured."),process.exitCode=1;return}let{getComputeDeployHistory:R}=await IA().then(() => hO),h=await R({driver:x_({config:r}),slug:r.project.slug,environment:d,logger:PE},{siteName:t,limit:Number.parseInt(T?.limit||"20",10)||20});if(!h.success){Q(`Could not read history: ${h.error||"unknown error"}`),process.exitCode=1;return}for(let N of h.perInstance||[])U(`
 ${N.instanceId}:`),U(N.output?.trimEnd()||"(no output)")}catch(r){Q(`History lookup failed: ${r.message}`),process.exitCode=1}}),E.command("deploy:recipe <name> <script>","Run a reusable server recipe (a local bash file) across servers").option("--env <environment>","Environment (production, staging, development)").option("--user <user>","User to run the recipe as",{default:"root"}).action(async(_,T,r)=>{b(`Running Recipe: ${_}`);try{if(!zr(T)){Q(`Recipe script not found: ${T}`),process.exitCode=1;return}let d=await p(),t=r?.env||"production",R=kJ(T,"utf8").split(`
 `),{runComputeRecipe:h}=await IA().then(() => hO),N=await h({driver:x_({config:d}),slug:d.project.slug,environment:t,logger:PE},{name:_,script:R,user:r?.user});for(let S of N.perInstance||[])U(`
-${S.instanceId}:`),U(S.output?.trimEnd()||"(no output)");if(!N.success)process.exitCode=1}catch(d){Q(`Recipe failed: ${d.message}`),process.exitCode=1}}),E.command("db:restore-backup [from]","Restore the app database from an on-box ts-backups dump (latest, or a given file)").option("--env <environment>","Environment (production, staging, development)").action(async(_,T)=>{b("Database Restore");try{let r=await p(),d=T?.env||"production",{restoreDatabaseBackup:t}=await IA().then(() => hO),R=await t({driver:x_({config:r}),slug:r.project.slug,environment:d,logger:PE},{database:U_(r),from:_});for(let h of R.perInstance||[])U(`  ${h.instanceId}: ${h.output?.trim()||h.status}`);if(!R.success)Q(`Restore failed: ${R.error||"unknown error"}`),process.exitCode=1}catch(r){Q(`Restore failed: ${r.message}`),process.exitCode=1}}),E.command("quick-deploy","Generate a push-to-deploy CI pipeline for your git provider (Forge Quick Deploy)").option("--env <environment>","Environment to deploy on push",{default:"production"}).option("--provider <provider>","CI provider (github, gitlab, bitbucket); defaults to the origin remote").option("--site <site>","Deploy only this configured site").option("--skip-dns-verification","Generate a deploy that skips DNS verification and record creation").option("--ssh-key-secret <name>","CI secret/variable containing the Hetzner deployment SSH private key",{default:"SSH_PRIVATE_KEY"}).option("--force","Overwrite an existing pipeline file").action(async(_)=>{b("Quick Deploy (push-to-deploy)");try{let T=await p(),{buildQuickDeployCi:r,inferQuickDeployProvider:d}=await $Q().then(() => UQ),t=_?.provider?.toLowerCase();if(t&&!["github","gitlab","bitbucket"].includes(t))throw Error(`Unsupported CI provider '${_?.provider}'. Use github, gitlab, or bitbucket.`);let R=t;if(!R)try{let N=UD("git remote get-url origin",{stdio:["ignore","pipe","ignore"]}).toString().trim();R=d(N)}catch{}let h=r(T,_?.env||"production",{provider:R,site:_?.site,skipDnsVerification:_?.skipDnsVerification,setup:zr("pantry.lock")?"pantry":"bun",sshPrivateKeySecret:_?.sshKeySecret});if(!h){_E("Could not resolve a GitHub, GitLab, or Bitbucket provider from --provider, the origin remote, or a configured site repository."),process.exitCode=1;return}if(zr(h.path)&&!_?.force){_E(`${h.path} already exists — re-run with --force to overwrite.`);return}vi(ii(h.path),{recursive:!0}),ni(h.path,h.content),Z(`Wrote ${h.path} (${h.provider}, deploys on push to '${h.branch}').`),U("Next: commit it and add your provider credentials as CI secrets/variables.")}catch(T){Q(`Quick deploy setup failed: ${T.message}`),process.exitCode=1}}),E.command("down","Put the serverless app into maintenance mode (503)").option("--env <environment>","Environment (production, staging, development)").option("--secret <secret>","Bypass secret (send as x-maintenance-bypass header)").action(async(_)=>{try{let T=await p(),r=_?.env||"production",{setMaintenance:d}=await TT().then(() => Kr);await d(T,r,!0,_?.secret)}catch(T){Q(`Failed to enable maintenance mode: ${T.message}`),process.exitCode=1}}),E.command("up","Bring the serverless app out of maintenance mode").option("--env <environment>","Environment (production, staging, development)").action(async(_)=>{try{let T=await p(),r=_?.env||"production",{setMaintenance:d}=await TT().then(() => Kr);await d(T,r,!1)}catch(T){Q(`Failed to disable maintenance mode: ${T.message}`),process.exitCode=1}}),E.command("command <cmd>","Run a command on the serverless CLI function (e.g. migrations)").option("--env <environment>","Environment (production, staging, development)").action(async(_,T)=>{try{let r=await p(),d=T?.env||"production",{runAndRecordCommand:t}=await TT().then(() => Kr),{id:R,output:h}=await t(r,d,_);if(U(h),R>0)U(`
+${S.instanceId}:`),U(S.output?.trimEnd()||"(no output)");if(!N.success)process.exitCode=1}catch(d){Q(`Recipe failed: ${d.message}`),process.exitCode=1}}),E.command("db:restore-backup [from]","Restore the app database from an on-box ts-backups dump (latest, or a given file)").option("--env <environment>","Environment (production, staging, development)").action(async(_,T)=>{b("Database Restore");try{let r=await p(),d=T?.env||"production",{restoreDatabaseBackup:t}=await IA().then(() => hO),R=await t({driver:x_({config:r}),slug:r.project.slug,environment:d,logger:PE},{database:U_(r),from:_});for(let h of R.perInstance||[])U(`  ${h.instanceId}: ${h.output?.trim()||h.status}`);if(!R.success)Q(`Restore failed: ${R.error||"unknown error"}`),process.exitCode=1}catch(r){Q(`Restore failed: ${r.message}`),process.exitCode=1}}),E.command("quick-deploy","Generate a push-to-deploy CI pipeline for your git provider (Forge Quick Deploy)").option("--env <environment>","Environment to deploy on push",{default:"production"}).option("--provider <provider>","CI provider (github, gitlab, bitbucket); defaults to the origin remote").option("--site <site>","Deploy only this configured site").option("--skip-dns-verification","Generate a deploy that skips DNS verification and record creation").option("--ssh-key-secret <name>","CI secret/variable containing the Hetzner deployment SSH private key",{default:"SSH_PRIVATE_KEY"}).option("--force","Overwrite an existing pipeline file").action(async(_)=>{b("Quick Deploy (push-to-deploy)");try{let T=await p(),{buildQuickDeployCi:r,inferQuickDeployProvider:d}=await $9().then(() => U9),t=_?.provider?.toLowerCase();if(t&&!["github","gitlab","bitbucket"].includes(t))throw Error(`Unsupported CI provider '${_?.provider}'. Use github, gitlab, or bitbucket.`);let R=t;if(!R)try{let N=UD("git remote get-url origin",{stdio:["ignore","pipe","ignore"]}).toString().trim();R=d(N)}catch{}let h=r(T,_?.env||"production",{provider:R,site:_?.site,skipDnsVerification:_?.skipDnsVerification,setup:zr("pantry.lock")?"pantry":"bun",sshPrivateKeySecret:_?.sshKeySecret});if(!h){_E("Could not resolve a GitHub, GitLab, or Bitbucket provider from --provider, the origin remote, or a configured site repository."),process.exitCode=1;return}if(zr(h.path)&&!_?.force){_E(`${h.path} already exists — re-run with --force to overwrite.`);return}vi(ii(h.path),{recursive:!0}),ni(h.path,h.content),Z(`Wrote ${h.path} (${h.provider}, deploys on push to '${h.branch}').`),U("Next: commit it and add your provider credentials as CI secrets/variables.")}catch(T){Q(`Quick deploy setup failed: ${T.message}`),process.exitCode=1}}),E.command("down","Put the serverless app into maintenance mode (503)").option("--env <environment>","Environment (production, staging, development)").option("--secret <secret>","Bypass secret (send as x-maintenance-bypass header)").action(async(_)=>{try{let T=await p(),r=_?.env||"production",{setMaintenance:d}=await TT().then(() => Kr);await d(T,r,!0,_?.secret)}catch(T){Q(`Failed to enable maintenance mode: ${T.message}`),process.exitCode=1}}),E.command("up","Bring the serverless app out of maintenance mode").option("--env <environment>","Environment (production, staging, development)").action(async(_)=>{try{let T=await p(),r=_?.env||"production",{setMaintenance:d}=await TT().then(() => Kr);await d(T,r,!1)}catch(T){Q(`Failed to disable maintenance mode: ${T.message}`),process.exitCode=1}}),E.command("command <cmd>","Run a command on the serverless CLI function (e.g. migrations)").option("--env <environment>","Environment (production, staging, development)").action(async(_,T)=>{try{let r=await p(),d=T?.env||"production",{runAndRecordCommand:t}=await TT().then(() => Kr),{id:R,output:h}=await t(r,d,_);if(U(h),R>0)U(`
 (recorded as #${R} — re-run with \`cloud command:again ${R}\`)`)}catch(r){Q(`Command failed: ${r.message}`),process.exitCode=1}}),E.command("command:history","List recorded CLI-function command invocations").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Show at most this many (most recent)",{default:"20"}).action(async(_)=>{try{let T=await p(),r=_?.env||"production",{listCommandHistory:d}=await TT().then(() => Kr),t=await d(T,r);if(!t.length){U("No command history yet.");return}let R=Number(_?.limit??20);b(`Command history — ${T.project.slug} (${r})`),o(["#","When","Status","Command"],t.slice(-R).reverse().map((h)=>[String(h.id),h.timestamp,h.status,h.command]))}catch(T){Q(`Failed to read history: ${T.message}`),process.exitCode=1}}),E.command("command:again [id]","Re-run a recorded command (defaults to the most recent)").option("--env <environment>","Environment (production, staging, development)").action(async(_,T)=>{try{let r=await p(),d=T?.env||"production",{getCommandRecord:t,runAndRecordCommand:R}=await TT().then(() => Kr),h=await t(r,d,_?Number(_):void 0);if(!h){Q(_?`No command #${_} in history.`:"No command history to re-run."),process.exitCode=1;return}U(`Re-running #${h.id}: ${h.command}`);let N=await R(r,d,h.command);if(U(N.output),N.id>0)U(`
-(recorded as #${N.id})`)}catch(r){Q(`Command failed: ${r.message}`),process.exitCode=1}}),E.command("serverless:db-shell <sql>","Run a SQL statement against a private serverless database (via the CLI function)").option("--env <environment>","Environment (production, staging, development)").action(async(_,T)=>{try{let r=await p(),d=T?.env||"production",{runDbQuery:t}=await TT().then(() => Kr),R=await t(r,d,_);U(R)}catch(r){Q(`Query failed: ${r.message}`),process.exitCode=1}}),E.command("serverless:db-scale <min> <max>","Rescale the serverless Aurora cluster (min/max ACUs)").option("--env <environment>","Environment (production, staging, development)").action(async(_,T,r)=>{b("Scaling serverless database");try{let d=await p(),t=r?.env||"production",R=Number(_),h=Number(T);if(!(R>0)||!(h>=R)){Q("Provide valid capacities: min > 0 and max >= min (e.g. `serverless:db-scale 0.5 8`)."),process.exitCode=1;return}let{scaleServerlessDatabase:N}=await TT().then(() => Kr);await N(d,t,R,h)}catch(d){Q(`Scale failed: ${d.message}`),process.exitCode=1}}),E.command("serverless:db-restore","Restore the serverless Aurora cluster to a point in time (as a new cluster)").option("--env <environment>","Environment (production, staging, development)").option("--to <timestamp>","Restore to this ISO-8601 time (UTC)").option("--latest","Restore to the latest restorable time").option("--target <id>","New cluster identifier (defaults to <cluster>-restore-<stamp>)").action(async(_)=>{b("Restoring serverless database");try{let T=await p(),r=_?.env||"production",d;if(_?.to){if(d=new Date(_.to),Number.isNaN(d.getTime())){Q(`Invalid --to timestamp: ${_.to} (use ISO-8601, e.g. 2026-06-18T10:00:00Z).`),process.exitCode=1;return}}let{restoreServerlessDatabase:t}=await TT().then(() => Kr);await t(T,r,{toTime:d,latest:_?.latest,target:_?.target})}catch(T){Q(`Restore failed: ${T.message}`),process.exitCode=1}}),E.command("serverless:info","Show an operational summary of a deployed serverless app").option("--env <environment>","Environment (production, staging, development)").action(async(_)=>{try{let T=await p(),r=_?.env||"production",{serverlessInfo:d}=await TT().then(() => Kr),t=await d(T,r);if(b(`${t.slug} (${t.environment})`),U(`Stack:    ${t.stackStatus}`),U(`Region:   ${t.region}`),t.endpoint)U(`URL:      ${t.endpoint}`);if(t.assetUrl)U(`Assets:   ${t.assetUrl}`);if(U(`Scheduler:${t.scheduler==="off"?" off":` ${t.scheduler}`}`),U(`Queues:   ${t.queues.length?t.queues.join(", "):"none"}`),U(`Warming:  ${t.provisionedConcurrency>0?`provisioned concurrency ×${t.provisionedConcurrency}`:"none / ping-warm"}`),t.lastRelease)U(`Release:  ${t.lastRelease.sha.slice(0,12)} @ ${t.lastRelease.timestamp}`);o(["Function","Version","Provisioned"],t.functions.map((R)=>[R.name,R.version,R.provisioned?`${R.provisioned.status} ${R.provisioned.allocated}/${R.provisioned.requested}`:"—"]))}catch(T){Q(`Failed to read info: ${T.message}`),process.exitCode=1}}),E.command("dashboard:build","Build the management dashboard with live data baked in").option("--env <environment>","Environment (production, staging, development)").option("--ui <dir>","UI directory (default ./ui)",{default:"ui"}).action(async(_)=>{b("Building management dashboard (live data)");try{let{existsSync:T}=await import("node:fs"),r=_?.ui||"ui";if(!T(`${r}/package.json`)){Q(`No UI project at ${r}/ (expected ${r}/package.json). Pass --ui <dir>.`),process.exitCode=1;return}let d=await p(),t=_?.env||"production";wE("Gathering live data from AWS");let R=null;if(d.environments?.[t]?.app){let{resolveDashboardData:S}=await IO().then(() => wQ),A=await S(d,t).catch((L)=>{return _E(`Serverless data unavailable (${L.message}) — that view uses sample data.`),null});if(A)R={...R??{},...A}}if(d.infrastructure?.compute){let{resolveServerDashboardData:S}=await LD().then(() => kQ),A=await S(d,t).catch(()=>null);if(A){if(A._serverReachable===!1)_E("Server box not reachable over SSM — server view uses config + sample data.");R={...R??{},...A}}}wE("Building dashboard");let{execSync:h}=await import("node:child_process"),{rmSync:N}=await import("node:fs");for(let S of[".stx/ssg-cache",".stx/cache"])N(`${r}/${S}`,{recursive:!0,force:!0});h("bun run build",{cwd:r,stdio:"inherit",env:{...process.env,...R?{TSCLOUD_DASHBOARD_DATA:JSON.stringify(R)}:{}}}),Z(`Dashboard built → ${r}/dist${R?" (live data)":" (sample data)"}`)}catch(T){Q(`Dashboard build failed: ${T.message}`),process.exitCode=1}}),E.command("serverless:build-php-layer","Build + publish the ts-cloud PHP runtime layer (requires Docker)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--php <version>","PHP version",{default:"8.3"}).option("--name <name>","Layer name",{default:"tscloud-php"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(_)=>{b("Building PHP runtime layer");try{let T=await p().catch(()=>null),r=_?.region||T?.project.region||"us-east-1",d=_?.arch||"x86_64",t=_?.php||"8.3",R=`${_?.name||"tscloud-php"}-${t.replace(".","")}-${d}`,h=_?.bucket||`${T?.project.slug||"tscloud"}-layers`,{buildPhpRuntimeLayerZip:N}=await aE().then(() => WL),{S3Client:S}=await Promise.resolve().then(() => (z_(),kN)),{LambdaClient:A}=await Promise.resolve().then(() => (Gr(),gS)),L=N({architecture:d,phpVersion:t,onStep:(C)=>wE(C)});U(`Layer: ${L.fileCount} files, ${(L.zip.length/1024/1024).toFixed(1)} MB`);let O=new S(r);if(!await O.bucketExists(h))wE(`Creating layer bucket ${h}`),await O.createBucket(h);let c=`layers/${R}.zip`;wE("Uploading layer zip"),await O.putObject({bucket:h,key:c,body:L.zip,contentType:"application/zip"}),wE("Publishing layer version");let I=await new A(r).publishLayerVersion({LayerName:R,Description:`ts-cloud PHP ${t} runtime (${d})`,Content:{S3Bucket:h,S3Key:c},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[d]});nr(["PHP runtime layer published","",`ARN: ${I.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'php', layers: ['${I.LayerVersionArn}'] }`,"or set TSCLOUD_PHP_LAYER_ARN before deploying."].join(`
+(recorded as #${N.id})`)}catch(r){Q(`Command failed: ${r.message}`),process.exitCode=1}}),E.command("serverless:db-shell <sql>","Run a SQL statement against a private serverless database (via the CLI function)").option("--env <environment>","Environment (production, staging, development)").action(async(_,T)=>{try{let r=await p(),d=T?.env||"production",{runDbQuery:t}=await TT().then(() => Kr),R=await t(r,d,_);U(R)}catch(r){Q(`Query failed: ${r.message}`),process.exitCode=1}}),E.command("serverless:db-scale <min> <max>","Rescale the serverless Aurora cluster (min/max ACUs)").option("--env <environment>","Environment (production, staging, development)").action(async(_,T,r)=>{b("Scaling serverless database");try{let d=await p(),t=r?.env||"production",R=Number(_),h=Number(T);if(!(R>0)||!(h>=R)){Q("Provide valid capacities: min > 0 and max >= min (e.g. `serverless:db-scale 0.5 8`)."),process.exitCode=1;return}let{scaleServerlessDatabase:N}=await TT().then(() => Kr);await N(d,t,R,h)}catch(d){Q(`Scale failed: ${d.message}`),process.exitCode=1}}),E.command("serverless:db-restore","Restore the serverless Aurora cluster to a point in time (as a new cluster)").option("--env <environment>","Environment (production, staging, development)").option("--to <timestamp>","Restore to this ISO-8601 time (UTC)").option("--latest","Restore to the latest restorable time").option("--target <id>","New cluster identifier (defaults to <cluster>-restore-<stamp>)").action(async(_)=>{b("Restoring serverless database");try{let T=await p(),r=_?.env||"production",d;if(_?.to){if(d=new Date(_.to),Number.isNaN(d.getTime())){Q(`Invalid --to timestamp: ${_.to} (use ISO-8601, e.g. 2026-06-18T10:00:00Z).`),process.exitCode=1;return}}let{restoreServerlessDatabase:t}=await TT().then(() => Kr);await t(T,r,{toTime:d,latest:_?.latest,target:_?.target})}catch(T){Q(`Restore failed: ${T.message}`),process.exitCode=1}}),E.command("serverless:info","Show an operational summary of a deployed serverless app").option("--env <environment>","Environment (production, staging, development)").action(async(_)=>{try{let T=await p(),r=_?.env||"production",{serverlessInfo:d}=await TT().then(() => Kr),t=await d(T,r);if(b(`${t.slug} (${t.environment})`),U(`Stack:    ${t.stackStatus}`),U(`Region:   ${t.region}`),t.endpoint)U(`URL:      ${t.endpoint}`);if(t.assetUrl)U(`Assets:   ${t.assetUrl}`);if(U(`Scheduler:${t.scheduler==="off"?" off":` ${t.scheduler}`}`),U(`Queues:   ${t.queues.length?t.queues.join(", "):"none"}`),U(`Warming:  ${t.provisionedConcurrency>0?`provisioned concurrency ×${t.provisionedConcurrency}`:"none / ping-warm"}`),t.lastRelease)U(`Release:  ${t.lastRelease.sha.slice(0,12)} @ ${t.lastRelease.timestamp}`);o(["Function","Version","Provisioned"],t.functions.map((R)=>[R.name,R.version,R.provisioned?`${R.provisioned.status} ${R.provisioned.allocated}/${R.provisioned.requested}`:"—"]))}catch(T){Q(`Failed to read info: ${T.message}`),process.exitCode=1}}),E.command("dashboard:build","Build the management dashboard with live data baked in").option("--env <environment>","Environment (production, staging, development)").option("--ui <dir>","UI directory (default ./ui)",{default:"ui"}).action(async(_)=>{b("Building management dashboard (live data)");try{let{existsSync:T}=await import("node:fs"),r=_?.ui||"ui";if(!T(`${r}/package.json`)){Q(`No UI project at ${r}/ (expected ${r}/package.json). Pass --ui <dir>.`),process.exitCode=1;return}let d=await p(),t=_?.env||"production";wE("Gathering live data from AWS");let R=null;if(d.environments?.[t]?.app){let{resolveDashboardData:S}=await IO().then(() => w9),A=await S(d,t).catch((L)=>{return _E(`Serverless data unavailable (${L.message}) — that view uses sample data.`),null});if(A)R={...R??{},...A}}if(d.infrastructure?.compute){let{resolveServerDashboardData:S}=await LD().then(() => k9),A=await S(d,t).catch(()=>null);if(A){if(A._serverReachable===!1)_E("Server box not reachable over SSM — server view uses config + sample data.");R={...R??{},...A}}}wE("Building dashboard");let{execSync:h}=await import("node:child_process"),{rmSync:N}=await import("node:fs");for(let S of[".stx/ssg-cache",".stx/cache"])N(`${r}/${S}`,{recursive:!0,force:!0});h("bun run build",{cwd:r,stdio:"inherit",env:{...process.env,...R?{TSCLOUD_DASHBOARD_DATA:JSON.stringify(R)}:{}}}),Z(`Dashboard built → ${r}/dist${R?" (live data)":" (sample data)"}`)}catch(T){Q(`Dashboard build failed: ${T.message}`),process.exitCode=1}}),E.command("serverless:build-php-layer","Build + publish the ts-cloud PHP runtime layer (requires Docker)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--php <version>","PHP version",{default:"8.3"}).option("--name <name>","Layer name",{default:"tscloud-php"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(_)=>{b("Building PHP runtime layer");try{let T=await p().catch(()=>null),r=_?.region||T?.project.region||"us-east-1",d=_?.arch||"x86_64",t=_?.php||"8.3",R=`${_?.name||"tscloud-php"}-${t.replace(".","")}-${d}`,h=_?.bucket||`${T?.project.slug||"tscloud"}-layers`,{buildPhpRuntimeLayerZip:N}=await aE().then(() => WL),{S3Client:S}=await Promise.resolve().then(() => (z_(),kN)),{LambdaClient:A}=await Promise.resolve().then(() => (Gr(),gS)),L=N({architecture:d,phpVersion:t,onStep:(C)=>wE(C)});U(`Layer: ${L.fileCount} files, ${(L.zip.length/1024/1024).toFixed(1)} MB`);let O=new S(r);if(!await O.bucketExists(h))wE(`Creating layer bucket ${h}`),await O.createBucket(h);let c=`layers/${R}.zip`;wE("Uploading layer zip"),await O.putObject({bucket:h,key:c,body:L.zip,contentType:"application/zip"}),wE("Publishing layer version");let I=await new A(r).publishLayerVersion({LayerName:R,Description:`ts-cloud PHP ${t} runtime (${d})`,Content:{S3Bucket:h,S3Key:c},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[d]});nr(["PHP runtime layer published","",`ARN: ${I.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'php', layers: ['${I.LayerVersionArn}'] }`,"or set TSCLOUD_PHP_LAYER_ARN before deploying."].join(`
 `),"green")}catch(T){Q(`Layer build failed: ${T.message}`),process.exitCode=1}}),E.command("serverless:build-node-layer","Build + publish a ts-cloud Node custom runtime layer (any version, incl. 24)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--node <version>","Node version (e.g. 24)",{default:"24"}).option("--name <name>","Layer name",{default:"tscloud-node"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(_)=>{b("Building Node runtime layer");try{let T=await p().catch(()=>null),r=_?.region||T?.project.region||"us-east-1",d=_?.arch||"x86_64",t=_?.node||"24",{buildNodeRuntimeLayerZip:R}=await aE().then(() => WL),{S3Client:h}=await Promise.resolve().then(() => (z_(),kN)),{LambdaClient:N}=await Promise.resolve().then(() => (Gr(),gS)),S=R({architecture:d,version:t,onStep:(C)=>wE(C)}),A=`${_?.name||"tscloud-node"}-${S.version.split(".")[0]}-${d}`,L=_?.bucket||`${T?.project.slug||"tscloud"}-layers`;U(`Layer: Node ${S.version}, ${(S.zip.length/1024/1024).toFixed(1)} MB`);let O=new h(r);if(!await O.bucketExists(L))wE(`Creating layer bucket ${L}`),await O.createBucket(L);let c=`layers/${A}.zip`;wE("Uploading layer zip"),await O.putObject({bucket:L,key:c,body:S.zip,contentType:"application/zip"}),wE("Publishing layer version");let I=await new N(r).publishLayerVersion({LayerName:A,Description:`ts-cloud Node ${S.version} runtime (${d})`,Content:{S3Bucket:L,S3Key:c},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[d]});nr(["Node runtime layer published","",`ARN: ${I.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'node', runtimeVersion: '${S.version.split(".")[0]}', layers: ['${I.LayerVersionArn}'] }`,"or set TSCLOUD_NODE_LAYER_ARN before deploying."].join(`
 `),"green")}catch(T){Q(`Layer build failed: ${T.message}`),process.exitCode=1}}),E.command("serverless:build-bun-layer","Build + publish a ts-cloud Bun custom runtime layer").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--bun <version>",'Bun version (e.g. 1.3.13, or "latest")',{default:"latest"}).option("--name <name>","Layer name",{default:"tscloud-bun"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(_)=>{b("Building Bun runtime layer");try{let T=await p().catch(()=>null),r=_?.region||T?.project.region||"us-east-1",d=_?.arch||"x86_64",t=_?.bun||"latest",{buildBunRuntimeLayerZip:R}=await aE().then(() => WL),{S3Client:h}=await Promise.resolve().then(() => (z_(),kN)),{LambdaClient:N}=await Promise.resolve().then(() => (Gr(),gS)),S=R({architecture:d,version:t,onStep:(C)=>wE(C)}),A=`${_?.name||"tscloud-bun"}-${S.version.replace(/\./g,"")}-${d}`,L=_?.bucket||`${T?.project.slug||"tscloud"}-layers`;U(`Layer: Bun ${S.version}, ${(S.zip.length/1024/1024).toFixed(1)} MB`);let O=new h(r);if(!await O.bucketExists(L))wE(`Creating layer bucket ${L}`),await O.createBucket(L);let c=`layers/${A}.zip`;wE("Uploading layer zip"),await O.putObject({bucket:L,key:c,body:S.zip,contentType:"application/zip"}),wE("Publishing layer version");let I=await new N(r).publishLayerVersion({LayerName:A,Description:`ts-cloud Bun ${S.version} runtime (${d})`,Content:{S3Bucket:L,S3Key:c},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[d]});nr(["Bun runtime layer published","",`ARN: ${I.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'bun', layers: ['${I.LayerVersionArn}'] }`,"or set TSCLOUD_BUN_LAYER_ARN before deploying."].join(`
 `),"green")}catch(T){Q(`Layer build failed: ${T.message}`),process.exitCode=1}}),E.command("deploy:status","Check deployment status").option("--stack <name>","Stack name").option("--env <environment>","Environment").action(async(_)=>{b("Deployment Status");try{let T=await p(),r=_?.env||"production",d=_?.stack||C_(T,r),t=T.project.region||"us-east-1";U(`Stack: ${d}`),U(`Region: ${t}`);let R=new n("Checking deployment status...");R.start();let N=await new oE(t).describeStacks({stackName:d});if(N.Stacks.length===0){R.fail("Stack not found"),jh("No deployment found for this environment");return}let S=N.Stacks[0];if(R.succeed("Status retrieved"),U(`
@@ -9892,7 +9892,7 @@ CloudFront: ${B.distributionDomain}
 Bucket: ${B.bucket}
 Files: ${y}${Y}
 
-Your site is now live at https://${B.domain}`,"green")}else throw Error(B.message||`Site '${L}' deployment failed`)}}fE();Y0();await aE();import{execFileSync as Ta}from"node:child_process";import{createHash as ra}from"node:crypto";import{existsSync as vQ,mkdirSync as da,mkdtempSync as ta,readdirSync as Ra,readFileSync as ha,rmSync as Na,statSync as nQ,writeFileSync as Sa}from"node:fs";import{tmpdir as Aa}from"node:os";import{basename as La,join as jA,relative as Oa,resolve as vJ}from"node:path";var ca=new Set([".git","node_modules","dist","coverage"]);function lQ(E,_=E){let T=[];for(let r of Ra(E).sort()){if(ca.has(r))continue;let d=jA(E,r);if(rI(d,_))continue;let t=nQ(d);if(t.isDirectory())T.push(...lQ(d,_));else if(t.isFile())T.push(Oa(_,d))}return T}function Ua(E){let _=vJ(E);if(!vQ(_)||!nQ(_).isDirectory())throw Error(`Container context does not exist: ${_}`);let T=ra("sha256");for(let r of lQ(_))T.update(r),T.update("\x00"),T.update(ha(jA(_,r))),T.update("\x00");return T.digest("hex")}function $a(E){return{ecr:new oR(E.region||"us-east-1",E.profile),run:(_,T,r)=>{Ta(_,T,{cwd:r?.cwd,env:r?.env,stdio:r?.stdio||"inherit"})}}}async function iQ(E,_){let T=vJ(E.context),r=vJ(E.dockerfile||jA(T,"Dockerfile"));if(!vQ(r))throw Error(`Dockerfile does not exist: ${r}`);if(!E.repository.split("/").every(($)=>/^[a-z0-9][a-z0-9._-]*$/.test($)&&!/[._-]$/.test($)&&!/[._-]{2}/.test($)))throw Error("ECR repository name is invalid");let R=_||$a(E),h=Ua(T),N=`sha-${h.slice(0,20)}`,S="";try{S=(await R.ecr.describeRepositories({repositoryNames:[E.repository]})).repositories?.[0]?.repositoryUri||""}catch{}if(!S)S=(await R.ecr.createRepository({repositoryName:E.repository,imageTagMutability:"IMMUTABLE",imageScanningConfiguration:{scanOnPush:!0},tags:[{Key:"ManagedBy",Value:"ts-cloud"}]})).repository?.repositoryUri||"";if(!S)throw Error(`Could not resolve ECR repository URI for ${E.repository}`);await R.ecr.putLifecyclePolicy({repositoryName:E.repository,lifecyclePolicyText:JSON.stringify({rules:[{rulePriority:1,description:"Retain the newest 25 release images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:25},action:{type:"expire"}}]})});let A=`${S}:${N}`,L=ta(jA(Aa(),"ts-cloud-container-"));try{R.run("docker",["version"],{stdio:"ignore"}),R.run("docker",["build","--platform",E.platform||"linux/amd64","--provenance=false","--sbom=false","--file",r,"--tag",A,T],{cwd:T});let $=(await R.ecr.getAuthorizationToken()).authorizationData?.[0];if(!$?.authorizationToken||!$.proxyEndpoint)throw Error("ECR did not return Docker authorization data");let I=$.proxyEndpoint.replace(/^https?:\/\//,""),C=jA(L,"docker");da(C,{recursive:!0}),Sa(jA(C,"config.json"),JSON.stringify({auths:{[I]:{auth:$.authorizationToken}}}),{mode:384}),R.run("docker",["push",A],{env:{...process.env,DOCKER_CONFIG:C}})}finally{Na(L,{recursive:!0,force:!0})}let c=(await R.ecr.describeImages({repositoryName:E.repository,imageIds:[{imageTag:N}]})).imageDetails?.[0]?.imageDigest;if(!c||!/^sha256:[a-f0-9]{64}$/i.test(c))throw Error(`ECR did not return an immutable digest for ${La(A)}`);return{repository:E.repository,tag:N,imageUri:A,digest:c,digestUri:`${S}@${c}`,contextSha256:h}}KT();Vr();eN();await aE();import{createHash as Da}from"node:crypto";function Ia(E){let _=E;return String(_?.code||_?.name||_?.statusCode||"")}function Ca(E){return Ia(E)==="ValidationError"&&String(E.message).includes("does not exist")}function wa(E){return Object.fromEntries((E||[]).map((_)=>[_.OutputKey,_.OutputValue]))}function ea(E){let _=E?.Aliases?.Items??E?.Aliases;if(Array.isArray(_))return _.map(String);if(typeof _==="string")return[_];return[]}function aQ(E){if(!/^[a-z][a-z0-9-]{1,62}$/.test(E.slug))throw Error("Slug must be a lowercase DNS-safe identifier");if(!/^[A-Z0-9]{8,32}$/.test(E.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(E.expectedAlias))throw Error("Expected distribution alias is invalid");let _=E.imageUri.match(/@((?:sha256:)[a-f0-9]{64})$/i)?.[1];if(!_)throw Error("Container image must use an immutable ECR digest URI ending in @sha256:<64 hex>");let T=E.stackName||`${E.slug}-backend`;if(!/^[A-Za-z][A-Za-z0-9-]{0,127}$/.test(T))throw Error("CloudFormation stack name is invalid");let r=E.pathPattern||"/api/*";if(!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]+\*$/.test(r)||r==="/*")throw Error("Backend path must be a non-default wildcard pattern");let d=E.originId||`${E.slug}-backend`;if(!/^[A-Za-z0-9_.-]{1,128}$/.test(d))throw Error("CloudFront origin ID is invalid");if(E.originVerifySecret&&E.originVerifySecret.length<24)throw Error("Origin verification secret must contain at least 24 characters");if(!!E.originDomain!==!!E.certificateArn)throw Error("A custom origin domain and matching ACM certificate ARN must be provided together");return{stackName:T,region:E.region||"us-east-1",pathPattern:r,originId:d,digest:_}}function nJ(E){let _=E.region||"us-east-1";return{cloudformation:new oE(_,E.profile),cloudfront:new __(E.profile),sts:new Rt(_,E.profile),fetch,sleep:(T)=>new Promise((r)=>setTimeout(r,T))}}function Xa(E){let _=aQ(E),T=UI({name:E.name,slug:E.slug,domain:E.originDomain||E.expectedAlias,imageUri:E.imageUri,certificateArn:E.certificateArn,originVerifySecret:E.originVerifySecret,desiredCount:E.desiredCount,database:E.database,cache:E.cache,queue:E.queue}),r=cI(T);return r.Description=`Managed backend for existing static frontend ${E.expectedAlias}`,r.Metadata={ManagedBy:"ts-cloud",ExistingDistributionId:E.distributionId,ExistingDistributionAlias:E.expectedAlias,BackendPathPattern:_.pathPattern,ContainerDigest:_.digest},r}async function Ja(E,_,T){let r;for(let d=0;d<30;d++){let t=Date.now();try{let R=await E.fetch(_,{redirect:"manual",headers:T?{"x-origin-verify":T}:void 0}),h=Date.now()-t,N=await R.text(),S=N;try{S=JSON.parse(N)}catch{}if(R.ok)return{url:_,status:R.status,latencyMs:h,body:S};r=Error(`origin returned ${R.status}`)}catch(R){r=R}if(d<29)await E.sleep(1e4)}throw Error(`Backend origin did not become healthy: ${r instanceof Error?r.message:String(r)}`)}async function mQ(E,_){let T=aQ(E),r=_||nJ({region:T.region,profile:E.profile}),[d,t]=await Promise.all([r.sts.getCallerIdentity(),r.cloudfront.getDistribution(E.distributionId)]);if(!d.Account)throw Error("AWS identity did not return an account ID");if(!t.Enabled)throw Error(`CloudFront distribution ${E.distributionId} is disabled`);if(!ea(t).includes(E.expectedAlias))throw Error(`Distribution ${E.distributionId} does not contain expected alias ${E.expectedAlias}`);let R;try{R=(await r.cloudformation.describeStacks({stackName:T.stackName})).Stacks[0]}catch(B){if(!Ca(B))throw B}let h=Xa(E),N=JSON.stringify(h);if(Buffer.byteLength(N)>51200)throw Error("Generated template exceeds the direct CloudFormation template body limit");let S=Object.values(h.Resources||{}).reduce((B,y)=>{return B[y.Type]=(B[y.Type]||0)+1,B},{}),A=[`cloud cdn:origin:remove ${E.distributionId} ${E.originDomain||"ALB_HOST"} --id ${T.originId} --path '${T.pathPattern}' --profile ${E.profile||"default"} --apply --confirm 'remove:${E.distributionId}:${T.pathPattern}'`,`After CloudFront is deployed, restore external DNS if changed and delete stack ${T.stackName} only with an approved data-retention decision.`],L={mode:E.apply?"apply":"plan",accountId:d.Account,stack:{name:T.stackName,existed:!!R,status:R?.StackStatus,templateSha256:Da("sha256").update(N).digest("hex"),resourceCount:Object.keys(h.Resources||{}).length,resourceTypes:S},distribution:{id:t.Id,alias:E.expectedAlias,domainName:t.DomainName,status:t.Status,pathPattern:T.pathPattern,originId:T.originId},artifact:{imageUri:E.imageUri,digest:T.digest},services:{database:E.database!==!1,cache:E.cache!==!1,queue:E.queue!==!1,mail:"ses",desiredCount:E.desiredCount||1},cloudFrontApplied:!1,dnsApplied:!1,applied:!1,rollback:A};if(!E.apply)return L;let O=`${E.distributionId}:${T.pathPattern}:${T.stackName}`;if(E.confirm!==O)throw Error(`Pass exact confirmation token ${O} to provision the backend and change live routing`);if(R)try{await r.cloudformation.updateStack({stackName:T.stackName,templateBody:N,capabilities:["CAPABILITY_NAMED_IAM"],tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:E.slug}]}),await r.cloudformation.waitForStack(T.stackName,"stack-update-complete")}catch(B){if(!String(B.message).includes("No updates are to be performed"))throw B}else await r.cloudformation.createStack({stackName:T.stackName,templateBody:N,capabilities:["CAPABILITY_NAMED_IAM"],onFailure:"ROLLBACK",tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:E.slug}]}),await r.cloudformation.waitForStack(T.stackName,"stack-create-complete");let c=(await r.cloudformation.describeStacks({stackName:T.stackName})).Stacks[0],$=wa(c?.Outputs),I=$.AppLoadBalancerDnsName;if(!I)throw Error("Backend stack did not return AppLoadBalancerDnsName");let C=!1;if(E.originDomain&&E.originDomain!==I){if(!r.dns)throw Error(`External DNS provider is required to map ${E.originDomain} to ${I}`);let B=await r.dns.upsertRecord(E.originDomain,{name:E.originDomain,type:"CNAME",content:I,ttl:300});if(!B.success)throw Error(B.message||"External DNS update failed");C=!0}let e=E.originDomain||I,z=E.certificateArn?"https-only":"http-only",F=E.skipHealthCheck?void 0:await Ja(r,`${z==="https-only"?"https":"http"}://${e}/api/health`,E.originVerifySecret);return await r.cloudfront.upsertExistingDistributionOrigin(E.distributionId,{id:T.originId,domainName:e,pathPattern:T.pathPattern,protocolPolicy:z,customHeaders:E.originVerifySecret?{"X-Origin-Verify":E.originVerifySecret}:void 0}),{...L,outputs:$,health:F,cloudFrontApplied:!0,dnsApplied:C,applied:!0}}function sQ(E={}){let T={fargate:730*(E.desiredCount||1)*0.012342500000000001,applicationLoadBalancer:16.425,natGateway:32.85,postgres:730*(E.multiAzDatabase?0.032:0.016),redis:23.36};return{monthlyUsd:Number(Object.values(T).reduce((r,d)=>r+d,0).toFixed(2)),components:Object.fromEntries(Object.entries(T).map(([r,d])=>[r,Number(d.toFixed(2))])),assumptions:["us-east-1 public on-demand rate snapshot, July 2026","one 0.25 vCPU/0.5 GB Linux Fargate task unless desiredCount is changed","one ALB before LCU charges and one NAT gateway before data processing","single-AZ db.t4g.micro PostgreSQL by default and two cache.t4g.micro Redis nodes","excludes storage, backups, CloudFront, data transfer, public IPv4, logs, email, queue requests, taxes, and free-tier credits"]}}function lJ(E){E.command("container:artifact <repository>","Build, scan, push, and resolve an immutable ECR container artifact").option("--context <path>","Docker build context",{default:"."}).option("--dockerfile <path>","Dockerfile path").option("--platform <platform>","Target platform",{default:"linux/amd64"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--profile <name>","AWS credential profile").action(async(_,T)=>{try{let r=await iQ({repository:_,context:T.context||".",dockerfile:T.dockerfile,platform:T.platform,region:T.region,profile:T.profile});Z("Immutable container artifact published."),U(JSON.stringify(r,null,2))}catch(r){Q(r instanceof Error?r.message:String(r)),process.exitCode=1}}),E.command("deploy:fullstack <distributionId> <alias>","Plan or deploy an ECS/RDS/Redis/SQS/SES backend behind an existing static site").option("--name <name>","Application display name").option("--slug <slug>","Application slug").option("--image <digest-uri>","Immutable ECR image URI with @sha256 digest").option("--stack <name>","Backend CloudFormation stack name").option("--path <pattern>","CloudFront backend path",{default:"/api/*"}).option("--origin-id <id>","CloudFront origin ID").option("--origin-domain <domain>","DNS name for the ALB origin").option("--certificate-arn <arn>","ACM certificate matching the origin domain").option("--dns-provider <provider>","External DNS provider (porkbun, godaddy, cloudflare, route53)").option("--origin-secret-env <name>","Environment variable holding the CloudFront-to-ALB secret",{default:"TS_CLOUD_ORIGIN_SECRET"}).option("--desired-count <count>","Baseline Fargate task count",{default:"1"}).option("--no-database","Do not provision PostgreSQL").option("--no-cache","Do not provision Redis").option("--no-queue","Do not provision SQS").option("--region <region>","AWS region",{default:"us-east-1"}).option("--profile <name>","AWS credential profile").option("--skip-health-check","Skip the ALB health gate before CloudFront").option("--apply","Provision and change live routing").option("--confirm <text>","Exact distribution:path:stack confirmation").action(async(_,T,r)=>{try{if(!r.slug)throw Error("--slug is required");if(!r.image)throw Error("--image must be an immutable digest URI from container:artifact");let d=r.originSecretEnv||"TS_CLOUD_ORIGIN_SECRET",t=process.env[d];if(r.apply&&!t)throw Error(`${d} must contain a stable random CloudFront-to-ALB secret before apply`);let R=nJ({region:r.region,profile:r.profile}),h=r.originDomain&&r.apply?{...R,dns:pd(r.dnsProvider)}:R,N=await mQ({name:r.name||r.slug,slug:r.slug,imageUri:r.image,distributionId:_,expectedAlias:T,stackName:r.stack,pathPattern:r.path,originId:r.originId,originDomain:r.originDomain,certificateArn:r.certificateArn,originVerifySecret:t,desiredCount:Number(r.desiredCount)||1,database:r.database!==!1,cache:r.cache!==!1,queue:r.queue!==!1,region:r.region,profile:r.profile,skipHealthCheck:!!r.skipHealthCheck,apply:!!r.apply,confirm:r.confirm},h);if(U(JSON.stringify(N,null,2)),N.applied)Z("Full-stack backend is healthy and the CloudFront path patch was submitted.");else U(`Plan only. Apply with --confirm '${_}:${N.distribution.pathPattern}:${N.stack.name}'.`)}catch(d){Q(d instanceof Error?d.message:String(d)),process.exitCode=1}}),E.command("deploy:fullstack:cost","Estimate the always-on full-stack backend baseline").option("--desired-count <count>","Fargate task count",{default:"1"}).option("--multi-az-database","Estimate a two-instance database baseline").action((_)=>U(JSON.stringify(sQ({desiredCount:Number(_.desiredCount)||1,multiAzDatabase:!!_.multiAzDatabase}),null,2)))}fE();await bd([aE(),TR()]);function iJ(E){E.command("destroy","Destroy the single-server compute (instance + firewall)").option("--env <env>","Environment",{default:"production"}).option("--force","Skip the confirmation prompt").action(async(_)=>{b("Destroy Compute");let T=await p(),r=_?.env||"production",d=GT(T),t=x_({config:T,provider:d});if(!t.destroyCompute){Q(`The ${d} driver does not support compute teardown`);return}if(_E(`This terminates the ${d} server for ${T.project.slug}/${r} and deletes its firewall.`),!_?.force){if(!await DE("This is irreversible. Continue?",!1)){U("Cancelled");return}}let R=new n("Destroying compute...");R.start();try{let{destroyed:h}=await t.destroyCompute({config:T,environment:r});if(R.succeed("Compute destroyed"),h.length>0)h.forEach((N)=>U(`  removed ${N}`));else U("Nothing to destroy (no matching resources found)")}catch(h){R.fail("Teardown failed"),Q(h instanceof Error?h.message:String(h))}})}fE();KT();import{statSync as za,writeFileSync as Fa}from"node:fs";function aJ(E){E.command("stack:list","List all CloudFormation stacks").action(async()=>{b("CloudFormation Stacks");try{let T=(await p()).project.region||"us-east-1",r=new oE(T),d=new n("Loading stacks...");d.start();let t=await r.listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS"]);if(d.succeed(`Found ${t.StackSummaries.length} stacks`),t.StackSummaries.length===0){U("No stacks found");return}let R=["Stack Name","Status","Created","Updated"],h=t.StackSummaries.map((N)=>[N.StackName,N.StackStatus,new Date(N.CreationTime).toLocaleString(),N.LastUpdatedTime?new Date(N.LastUpdatedTime).toLocaleString():"Never"]);o(R,h)}catch(_){Q(`Failed to list stacks: ${_.message}`)}}),E.command("stack:describe STACK_NAME","Describe a CloudFormation stack").action(async(_)=>{b(`Stack: ${_}`);try{let r=(await p()).project.region||"us-east-1",d=new oE(r),t=new n("Loading stack details...");t.start();let R=await d.describeStacks({stackName:_});if(!R.Stacks||R.Stacks.length===0){t.fail("Stack not found");return}let h=R.Stacks[0];if(t.succeed("Stack details loaded"),U(`
+Your site is now live at https://${B.domain}`,"green")}else throw Error(B.message||`Site '${L}' deployment failed`)}}fE();Y0();await aE();import{execFileSync as Ta}from"node:child_process";import{createHash as ra}from"node:crypto";import{existsSync as v9,mkdirSync as da,mkdtempSync as ta,readdirSync as Ra,readFileSync as ha,rmSync as Na,statSync as n9,writeFileSync as Sa}from"node:fs";import{tmpdir as Aa}from"node:os";import{basename as La,join as jA,relative as Oa,resolve as vJ}from"node:path";var ca=new Set([".git","node_modules","dist","coverage"]);function l9(E,_=E){let T=[];for(let r of Ra(E).sort()){if(ca.has(r))continue;let d=jA(E,r);if(rI(d,_))continue;let t=n9(d);if(t.isDirectory())T.push(...l9(d,_));else if(t.isFile())T.push(Oa(_,d))}return T}function Ua(E){let _=vJ(E);if(!v9(_)||!n9(_).isDirectory())throw Error(`Container context does not exist: ${_}`);let T=ra("sha256");for(let r of l9(_))T.update(r),T.update("\x00"),T.update(ha(jA(_,r))),T.update("\x00");return T.digest("hex")}function $a(E){return{ecr:new oR(E.region||"us-east-1",E.profile),run:(_,T,r)=>{Ta(_,T,{cwd:r?.cwd,env:r?.env,stdio:r?.stdio||"inherit"})}}}async function i9(E,_){let T=vJ(E.context),r=vJ(E.dockerfile||jA(T,"Dockerfile"));if(!v9(r))throw Error(`Dockerfile does not exist: ${r}`);if(!E.repository.split("/").every(($)=>/^[a-z0-9][a-z0-9._-]*$/.test($)&&!/[._-]$/.test($)&&!/[._-]{2}/.test($)))throw Error("ECR repository name is invalid");let R=_||$a(E),h=Ua(T),N=`sha-${h.slice(0,20)}`,S="";try{S=(await R.ecr.describeRepositories({repositoryNames:[E.repository]})).repositories?.[0]?.repositoryUri||""}catch{}if(!S)S=(await R.ecr.createRepository({repositoryName:E.repository,imageTagMutability:"IMMUTABLE",imageScanningConfiguration:{scanOnPush:!0},tags:[{Key:"ManagedBy",Value:"ts-cloud"}]})).repository?.repositoryUri||"";if(!S)throw Error(`Could not resolve ECR repository URI for ${E.repository}`);await R.ecr.putLifecyclePolicy({repositoryName:E.repository,lifecyclePolicyText:JSON.stringify({rules:[{rulePriority:1,description:"Retain the newest 25 release images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:25},action:{type:"expire"}}]})});let A=`${S}:${N}`,L=ta(jA(Aa(),"ts-cloud-container-"));try{R.run("docker",["version"],{stdio:"ignore"}),R.run("docker",["build","--platform",E.platform||"linux/amd64","--provenance=false","--sbom=false","--file",r,"--tag",A,T],{cwd:T});let $=(await R.ecr.getAuthorizationToken()).authorizationData?.[0];if(!$?.authorizationToken||!$.proxyEndpoint)throw Error("ECR did not return Docker authorization data");let I=$.proxyEndpoint.replace(/^https?:\/\//,""),C=jA(L,"docker");da(C,{recursive:!0}),Sa(jA(C,"config.json"),JSON.stringify({auths:{[I]:{auth:$.authorizationToken}}}),{mode:384}),R.run("docker",["push",A],{env:{...process.env,DOCKER_CONFIG:C}})}finally{Na(L,{recursive:!0,force:!0})}let c=(await R.ecr.describeImages({repositoryName:E.repository,imageIds:[{imageTag:N}]})).imageDetails?.[0]?.imageDigest;if(!c||!/^sha256:[a-f0-9]{64}$/i.test(c))throw Error(`ECR did not return an immutable digest for ${La(A)}`);return{repository:E.repository,tag:N,imageUri:A,digest:c,digestUri:`${S}@${c}`,contextSha256:h}}KT();Vr();eN();await aE();import{createHash as Da}from"node:crypto";function Ia(E){let _=E;return String(_?.code||_?.name||_?.statusCode||"")}function Ca(E){return Ia(E)==="ValidationError"&&String(E.message).includes("does not exist")}function wa(E){return Object.fromEntries((E||[]).map((_)=>[_.OutputKey,_.OutputValue]))}function ea(E){let _=E?.Aliases?.Items??E?.Aliases;if(Array.isArray(_))return _.map(String);if(typeof _==="string")return[_];return[]}function a9(E){if(!/^[a-z][a-z0-9-]{1,62}$/.test(E.slug))throw Error("Slug must be a lowercase DNS-safe identifier");if(!/^[A-Z0-9]{8,32}$/.test(E.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(E.expectedAlias))throw Error("Expected distribution alias is invalid");let _=E.imageUri.match(/@((?:sha256:)[a-f0-9]{64})$/i)?.[1];if(!_)throw Error("Container image must use an immutable ECR digest URI ending in @sha256:<64 hex>");let T=E.stackName||`${E.slug}-backend`;if(!/^[A-Za-z][A-Za-z0-9-]{0,127}$/.test(T))throw Error("CloudFormation stack name is invalid");let r=E.pathPattern||"/api/*";if(!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]+\*$/.test(r)||r==="/*")throw Error("Backend path must be a non-default wildcard pattern");let d=E.originId||`${E.slug}-backend`;if(!/^[A-Za-z0-9_.-]{1,128}$/.test(d))throw Error("CloudFront origin ID is invalid");if(E.originVerifySecret&&E.originVerifySecret.length<24)throw Error("Origin verification secret must contain at least 24 characters");if(!!E.originDomain!==!!E.certificateArn)throw Error("A custom origin domain and matching ACM certificate ARN must be provided together");return{stackName:T,region:E.region||"us-east-1",pathPattern:r,originId:d,digest:_}}function nJ(E){let _=E.region||"us-east-1";return{cloudformation:new oE(_,E.profile),cloudfront:new __(E.profile),sts:new Rt(_,E.profile),fetch,sleep:(T)=>new Promise((r)=>setTimeout(r,T))}}function Xa(E){let _=a9(E),T=UI({name:E.name,slug:E.slug,domain:E.originDomain||E.expectedAlias,imageUri:E.imageUri,certificateArn:E.certificateArn,originVerifySecret:E.originVerifySecret,desiredCount:E.desiredCount,database:E.database,cache:E.cache,queue:E.queue}),r=cI(T);return r.Description=`Managed backend for existing static frontend ${E.expectedAlias}`,r.Metadata={ManagedBy:"ts-cloud",ExistingDistributionId:E.distributionId,ExistingDistributionAlias:E.expectedAlias,BackendPathPattern:_.pathPattern,ContainerDigest:_.digest},r}async function Ja(E,_,T){let r;for(let d=0;d<30;d++){let t=Date.now();try{let R=await E.fetch(_,{redirect:"manual",headers:T?{"x-origin-verify":T}:void 0}),h=Date.now()-t,N=await R.text(),S=N;try{S=JSON.parse(N)}catch{}if(R.ok)return{url:_,status:R.status,latencyMs:h,body:S};r=Error(`origin returned ${R.status}`)}catch(R){r=R}if(d<29)await E.sleep(1e4)}throw Error(`Backend origin did not become healthy: ${r instanceof Error?r.message:String(r)}`)}async function m9(E,_){let T=a9(E),r=_||nJ({region:T.region,profile:E.profile}),[d,t]=await Promise.all([r.sts.getCallerIdentity(),r.cloudfront.getDistribution(E.distributionId)]);if(!d.Account)throw Error("AWS identity did not return an account ID");if(!t.Enabled)throw Error(`CloudFront distribution ${E.distributionId} is disabled`);if(!ea(t).includes(E.expectedAlias))throw Error(`Distribution ${E.distributionId} does not contain expected alias ${E.expectedAlias}`);let R;try{R=(await r.cloudformation.describeStacks({stackName:T.stackName})).Stacks[0]}catch(B){if(!Ca(B))throw B}let h=Xa(E),N=JSON.stringify(h);if(Buffer.byteLength(N)>51200)throw Error("Generated template exceeds the direct CloudFormation template body limit");let S=Object.values(h.Resources||{}).reduce((B,y)=>{return B[y.Type]=(B[y.Type]||0)+1,B},{}),A=[`cloud cdn:origin:remove ${E.distributionId} ${E.originDomain||"ALB_HOST"} --id ${T.originId} --path '${T.pathPattern}' --profile ${E.profile||"default"} --apply --confirm 'remove:${E.distributionId}:${T.pathPattern}'`,`After CloudFront is deployed, restore external DNS if changed and delete stack ${T.stackName} only with an approved data-retention decision.`],L={mode:E.apply?"apply":"plan",accountId:d.Account,stack:{name:T.stackName,existed:!!R,status:R?.StackStatus,templateSha256:Da("sha256").update(N).digest("hex"),resourceCount:Object.keys(h.Resources||{}).length,resourceTypes:S},distribution:{id:t.Id,alias:E.expectedAlias,domainName:t.DomainName,status:t.Status,pathPattern:T.pathPattern,originId:T.originId},artifact:{imageUri:E.imageUri,digest:T.digest},services:{database:E.database!==!1,cache:E.cache!==!1,queue:E.queue!==!1,mail:"ses",desiredCount:E.desiredCount||1},cloudFrontApplied:!1,dnsApplied:!1,applied:!1,rollback:A};if(!E.apply)return L;let O=`${E.distributionId}:${T.pathPattern}:${T.stackName}`;if(E.confirm!==O)throw Error(`Pass exact confirmation token ${O} to provision the backend and change live routing`);if(R)try{await r.cloudformation.updateStack({stackName:T.stackName,templateBody:N,capabilities:["CAPABILITY_NAMED_IAM"],tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:E.slug}]}),await r.cloudformation.waitForStack(T.stackName,"stack-update-complete")}catch(B){if(!String(B.message).includes("No updates are to be performed"))throw B}else await r.cloudformation.createStack({stackName:T.stackName,templateBody:N,capabilities:["CAPABILITY_NAMED_IAM"],onFailure:"ROLLBACK",tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:E.slug}]}),await r.cloudformation.waitForStack(T.stackName,"stack-create-complete");let c=(await r.cloudformation.describeStacks({stackName:T.stackName})).Stacks[0],$=wa(c?.Outputs),I=$.AppLoadBalancerDnsName;if(!I)throw Error("Backend stack did not return AppLoadBalancerDnsName");let C=!1;if(E.originDomain&&E.originDomain!==I){if(!r.dns)throw Error(`External DNS provider is required to map ${E.originDomain} to ${I}`);let B=await r.dns.upsertRecord(E.originDomain,{name:E.originDomain,type:"CNAME",content:I,ttl:300});if(!B.success)throw Error(B.message||"External DNS update failed");C=!0}let e=E.originDomain||I,z=E.certificateArn?"https-only":"http-only",F=E.skipHealthCheck?void 0:await Ja(r,`${z==="https-only"?"https":"http"}://${e}/api/health`,E.originVerifySecret);return await r.cloudfront.upsertExistingDistributionOrigin(E.distributionId,{id:T.originId,domainName:e,pathPattern:T.pathPattern,protocolPolicy:z,customHeaders:E.originVerifySecret?{"X-Origin-Verify":E.originVerifySecret}:void 0}),{...L,outputs:$,health:F,cloudFrontApplied:!0,dnsApplied:C,applied:!0}}function s9(E={}){let T={fargate:730*(E.desiredCount||1)*0.012342500000000001,applicationLoadBalancer:16.425,natGateway:32.85,postgres:730*(E.multiAzDatabase?0.032:0.016),redis:23.36};return{monthlyUsd:Number(Object.values(T).reduce((r,d)=>r+d,0).toFixed(2)),components:Object.fromEntries(Object.entries(T).map(([r,d])=>[r,Number(d.toFixed(2))])),assumptions:["us-east-1 public on-demand rate snapshot, July 2026","one 0.25 vCPU/0.5 GB Linux Fargate task unless desiredCount is changed","one ALB before LCU charges and one NAT gateway before data processing","single-AZ db.t4g.micro PostgreSQL by default and two cache.t4g.micro Redis nodes","excludes storage, backups, CloudFront, data transfer, public IPv4, logs, email, queue requests, taxes, and free-tier credits"]}}function lJ(E){E.command("container:artifact <repository>","Build, scan, push, and resolve an immutable ECR container artifact").option("--context <path>","Docker build context",{default:"."}).option("--dockerfile <path>","Dockerfile path").option("--platform <platform>","Target platform",{default:"linux/amd64"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--profile <name>","AWS credential profile").action(async(_,T)=>{try{let r=await i9({repository:_,context:T.context||".",dockerfile:T.dockerfile,platform:T.platform,region:T.region,profile:T.profile});Z("Immutable container artifact published."),U(JSON.stringify(r,null,2))}catch(r){Q(r instanceof Error?r.message:String(r)),process.exitCode=1}}),E.command("deploy:fullstack <distributionId> <alias>","Plan or deploy an ECS/RDS/Redis/SQS/SES backend behind an existing static site").option("--name <name>","Application display name").option("--slug <slug>","Application slug").option("--image <digest-uri>","Immutable ECR image URI with @sha256 digest").option("--stack <name>","Backend CloudFormation stack name").option("--path <pattern>","CloudFront backend path",{default:"/api/*"}).option("--origin-id <id>","CloudFront origin ID").option("--origin-domain <domain>","DNS name for the ALB origin").option("--certificate-arn <arn>","ACM certificate matching the origin domain").option("--dns-provider <provider>","External DNS provider (porkbun, godaddy, cloudflare, route53)").option("--origin-secret-env <name>","Environment variable holding the CloudFront-to-ALB secret",{default:"TS_CLOUD_ORIGIN_SECRET"}).option("--desired-count <count>","Baseline Fargate task count",{default:"1"}).option("--no-database","Do not provision PostgreSQL").option("--no-cache","Do not provision Redis").option("--no-queue","Do not provision SQS").option("--region <region>","AWS region",{default:"us-east-1"}).option("--profile <name>","AWS credential profile").option("--skip-health-check","Skip the ALB health gate before CloudFront").option("--apply","Provision and change live routing").option("--confirm <text>","Exact distribution:path:stack confirmation").action(async(_,T,r)=>{try{if(!r.slug)throw Error("--slug is required");if(!r.image)throw Error("--image must be an immutable digest URI from container:artifact");let d=r.originSecretEnv||"TS_CLOUD_ORIGIN_SECRET",t=process.env[d];if(r.apply&&!t)throw Error(`${d} must contain a stable random CloudFront-to-ALB secret before apply`);let R=nJ({region:r.region,profile:r.profile}),h=r.originDomain&&r.apply?{...R,dns:pd(r.dnsProvider)}:R,N=await m9({name:r.name||r.slug,slug:r.slug,imageUri:r.image,distributionId:_,expectedAlias:T,stackName:r.stack,pathPattern:r.path,originId:r.originId,originDomain:r.originDomain,certificateArn:r.certificateArn,originVerifySecret:t,desiredCount:Number(r.desiredCount)||1,database:r.database!==!1,cache:r.cache!==!1,queue:r.queue!==!1,region:r.region,profile:r.profile,skipHealthCheck:!!r.skipHealthCheck,apply:!!r.apply,confirm:r.confirm},h);if(U(JSON.stringify(N,null,2)),N.applied)Z("Full-stack backend is healthy and the CloudFront path patch was submitted.");else U(`Plan only. Apply with --confirm '${_}:${N.distribution.pathPattern}:${N.stack.name}'.`)}catch(d){Q(d instanceof Error?d.message:String(d)),process.exitCode=1}}),E.command("deploy:fullstack:cost","Estimate the always-on full-stack backend baseline").option("--desired-count <count>","Fargate task count",{default:"1"}).option("--multi-az-database","Estimate a two-instance database baseline").action((_)=>U(JSON.stringify(s9({desiredCount:Number(_.desiredCount)||1,multiAzDatabase:!!_.multiAzDatabase}),null,2)))}fE();await bd([aE(),TR()]);function iJ(E){E.command("destroy","Destroy the single-server compute (instance + firewall)").option("--env <env>","Environment",{default:"production"}).option("--force","Skip the confirmation prompt").action(async(_)=>{b("Destroy Compute");let T=await p(),r=_?.env||"production",d=GT(T),t=x_({config:T,provider:d});if(!t.destroyCompute){Q(`The ${d} driver does not support compute teardown`);return}if(_E(`This terminates the ${d} server for ${T.project.slug}/${r} and deletes its firewall.`),!_?.force){if(!await DE("This is irreversible. Continue?",!1)){U("Cancelled");return}}let R=new n("Destroying compute...");R.start();try{let{destroyed:h}=await t.destroyCompute({config:T,environment:r});if(R.succeed("Compute destroyed"),h.length>0)h.forEach((N)=>U(`  removed ${N}`));else U("Nothing to destroy (no matching resources found)")}catch(h){R.fail("Teardown failed"),Q(h instanceof Error?h.message:String(h))}})}fE();KT();import{statSync as za,writeFileSync as Fa}from"node:fs";function aJ(E){E.command("stack:list","List all CloudFormation stacks").action(async()=>{b("CloudFormation Stacks");try{let T=(await p()).project.region||"us-east-1",r=new oE(T),d=new n("Loading stacks...");d.start();let t=await r.listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS"]);if(d.succeed(`Found ${t.StackSummaries.length} stacks`),t.StackSummaries.length===0){U("No stacks found");return}let R=["Stack Name","Status","Created","Updated"],h=t.StackSummaries.map((N)=>[N.StackName,N.StackStatus,new Date(N.CreationTime).toLocaleString(),N.LastUpdatedTime?new Date(N.LastUpdatedTime).toLocaleString():"Never"]);o(R,h)}catch(_){Q(`Failed to list stacks: ${_.message}`)}}),E.command("stack:describe STACK_NAME","Describe a CloudFormation stack").action(async(_)=>{b(`Stack: ${_}`);try{let r=(await p()).project.region||"us-east-1",d=new oE(r),t=new n("Loading stack details...");t.start();let R=await d.describeStacks({stackName:_});if(!R.Stacks||R.Stacks.length===0){t.fail("Stack not found");return}let h=R.Stacks[0];if(t.succeed("Stack details loaded"),U(`
 Stack Information:`),U(`  - Name: ${h.StackName}`),U(`  - Status: ${h.StackStatus}`),U(`  - Created: ${new Date(h.CreationTime).toLocaleString()}`),h.LastUpdatedTime)U(`  - Updated: ${new Date(h.LastUpdatedTime).toLocaleString()}`);if(h.Parameters&&h.Parameters.length>0){U(`
 Parameters:`);for(let S of h.Parameters)U(`  - ${S.ParameterKey}: ${S.ParameterValue}`)}if(h.Outputs&&h.Outputs.length>0){U(`
 Outputs:`);for(let S of h.Outputs)if(U(`  - ${S.OutputKey}: ${S.OutputValue}`),S.Description)U(`    ${S.Description}`)}if(h.Tags&&h.Tags.length>0){U(`
@@ -9906,9 +9906,9 @@ Template:`),console.log(S)}catch(r){Q(`Failed to export template: ${r.message}`)
 Creating site: ${r}`),U(`Domains: ${d.join(", ")}`),!await DE(`
 Create this site?`,!0)){U("Operation cancelled");return}let R=new n("Creating site...");R.start();let h=`site_${Date.now()}_${Math.random().toString(36).substring(2,9)}`,N=new Date().toISOString();await T.putItem({TableName:_.table,Item:{pk:{S:`SITE#${h}`},sk:{S:`SITE#${h}`},siteId:{S:h},name:{S:r},domains:{L:d.map((S)=>({S}))},isActive:{BOOL:!0},createdAt:{S:N},updatedAt:{S:N}}}),R.succeed("Site created successfully"),Z(`
 Site ID: ${h}`),U(`
-Add the tracking script to your website:`),U(`  <script src="https://analytics.stacksjs.com/track.js" data-site-id="${h}"></script>`)}catch(T){Q(`Failed to create site: ${T.message}`),process.exit(1)}}),E.command("analytics:sites:update <siteId>","Update an analytics site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--name <name>","New site name").option("--domain <domain>","Set domains (replaces existing)").option("--active <boolean>","Set site active/inactive status").action(async(_,T)=>{b("Update Analytics Site");try{let r=new LT(T.region),d=await r.getItem({TableName:T.table,Key:{pk:{S:`SITE#${_}`},sk:{S:`SITE#${_}`}}});if(!d.Item)Q(`Site not found: ${_}`),process.exit(1);let t=LT.unmarshal(d.Item);U(`Updating site: ${t.name||"Unnamed"} (${_})`),U("");let R=[],h={},N={};if(T.name)R.push("#n = :name"),h["#n"]="name",N[":name"]={S:T.name},U(`  Name: ${t.name} -> ${T.name}`);if(T.domain!==void 0){let S=Array.isArray(T.domain)?T.domain:[T.domain];R.push("domains = :domains"),N[":domains"]={L:S.map((A)=>({S:A}))},U(`  Domains: ${JSON.stringify(t.domains||[])} -> ${JSON.stringify(S)}`)}if(T.active!==void 0){let S=T.active==="true"||T.active==="1";R.push("isActive = :active"),N[":active"]={BOOL:S},U(`  Active: ${t.isActive} -> ${S}`)}if(R.length===0){_E("No updates specified. Use --name, --domain, or --active options.");return}R.push("updatedAt = :updatedAt"),N[":updatedAt"]={S:new Date().toISOString()},await r.updateItem({TableName:T.table,Key:{pk:{S:`SITE#${_}`},sk:{S:`SITE#${_}`}},UpdateExpression:`SET ${R.join(", ")}`,ExpressionAttributeNames:Object.keys(h).length>0?h:void 0,ExpressionAttributeValues:N}),U(""),Z("Site updated successfully")}catch(r){Q(`Failed to update site: ${r.message}`),process.exit(1)}}),E.command("analytics:query <siteId>","Query analytics data for a site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--limit <n>","Max items to return",{default:"10"}).option("--type <type>","Filter by type (pageview, event, etc.)").action(async(_,T)=>{b(`Analytics Data: ${_}`);try{let r=new LT(T.region),d=new n("Querying data...");d.start();let t=await r.query({TableName:T.table,KeyConditionExpression:"pk = :pk",ExpressionAttributeValues:{":pk":{S:`SITE#${_}`}},ScanIndexForward:!1,Limit:parseInt(T.limit,10)});if(d.succeed(`Found ${t.Items?.length||0} items`),!t.Items||t.Items.length===0){U("No data found for this site");return}let R=t.Items.map((h)=>LT.unmarshal(h));for(let h of R){if(U(""),U(`SK: ${h.sk}`),h.path)U(`  Path: ${h.path}`);if(h.timestamp)U(`  Time: ${h.timestamp}`);if(h.visitorId)U(`  Visitor: ${h.visitorId}`);if(h.browser)U(`  Browser: ${h.browser}`);if(h.country)U(`  Country: ${h.country}`)}}catch(r){Q(`Failed to query data: ${r.message}`),process.exit(1)}}),E.command("analytics:realtime <siteId>","Check realtime visitors for a site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--minutes <n>","Minutes to look back",{default:"5"}).action(async(_,T)=>{b(`Realtime: ${_}`);try{let r=new LT(T.region),d=new n("Checking realtime...");d.start();let t=parseInt(T.minutes,10),R=new Date(Date.now()-t*60*1000),h=await r.query({TableName:T.table,KeyConditionExpression:"pk = :pk AND sk BETWEEN :start AND :end",ExpressionAttributeValues:{":pk":{S:`SITE#${_}`},":start":{S:`PAGEVIEW#${R.toISOString()}`},":end":{S:"PAGEVIEW#Z"}},ScanIndexForward:!1});if(d.succeed(`Found ${h.Items?.length||0} pageviews in last ${t} minutes`),!h.Items||h.Items.length===0){_E("No recent pageviews found"),U(""),U("Possible issues:"),U("  1. Tracking script not installed correctly"),U("  2. Site ID mismatch"),U("  3. CORS or network issues");return}let N=h.Items.map((L)=>LT.unmarshal(L)),S=new Set(N.map((L)=>L.visitorId)).size;U(""),Z(`${S} unique visitor(s) online`),U("");let A={};for(let L of N){let O=L.path||"/";A[O]=(A[O]||0)+1}U("Active pages:");for(let[L,O]of Object.entries(A).sort((c,$)=>$[1]-c[1]).slice(0,5))U(`  ${L}: ${O} view(s)`);U(""),U("Recent pageviews:");for(let L of N.slice(0,5))U(`  ${L.timestamp} - ${L.path} (${L.browser||"Unknown"})`)}catch(r){Q(`Failed to check realtime: ${r.message}`),process.exit(1)}})}fE();import{chmodSync as to,mkdirSync as Ro,readFileSync as ho,writeFileSync as No}from"node:fs";import{dirname as So,resolve as d1}from"node:path";class pJ extends Error{status;code;requestId;constructor(E,_,T,r){super(T);this.status=E;this.code=_;this.requestId=r}}class $D{options;baseUrl;fetchFn;constructor(E){this.options=E;this.baseUrl=E.baseUrl.replace(/\/$/,""),this.fetchFn=E.fetch??fetch}async request(E,_={}){let T=await this.fetchFn(`${this.baseUrl}${E}`,{..._,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,..._.headers}}),r=await T.json().catch(()=>({}));if(!T.ok)throw new pJ(T.status,r.error?.code??"api_error",r.error?.message??"API request failed.",r.error?.requestId??T.headers.get("x-request-id")??void 0);return r}listProjects(E={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(E).filter(([,_])=>_!==void 0).map(([_,T])=>[_,String(T)])))}`)}listEnvironments(E,_={}){return this.request(`/api/v1/projects/${encodeURIComponent(E)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(_).filter(([,T])=>T!==void 0).map(([T,r])=>[T,String(r)])))}`)}listServices(E,_){return this.request(`/api/v1/services?${new URLSearchParams({projectId:E,..._?{environmentId:_}:{}})}`)}listOperations(E){return this.request(`/api/v1/operations${E?`?projectId=${encodeURIComponent(E)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(E,_){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:E,..._?{environmentId:_}:{}})}`)}previewCompose(E){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}createComposeApplication(E){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}composeServices(E){return this.request(`/api/v1/compose-applications/${encodeURIComponent(E)}/services`)}composeAction(E,_,T={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(E)}/${_}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(T)})}releaseCapabilities(E,_={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:E,health:String(!!_.health),replicas:String(_.replicas??1)})}`)}listReleases(E,_={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:E,..._})}`)}createReleaseArtifact(E){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}createRelease(E){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}releaseAction(E,_,T={}){return this.request(`/api/v1/releases/${encodeURIComponent(E)}/${_}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(T)})}createDeployment(E,_){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":_},body:JSON.stringify(E)})}detectApplication(E){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}planApplication(E){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}listApplicationDrafts(E){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(E)}`)}createApplicationDraft(E){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}updateApplicationDraft(E){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}createApplication(E,_){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":_},body:JSON.stringify(E)})}uploadApplicationArtifact(E,_,T){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":E,"x-artifact-filename":_},body:T})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(E){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}updateRegistryConnection(E){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}disconnectRegistryConnection(E){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:E})})}listQueue(E={}){let _=new URLSearchParams(Object.entries(E).filter(([,T])=>T!==void 0).map(([T,r])=>[T,String(r)]));return this.request(`/api/v1/queue?${_}`)}operationLogs(E,_={}){let T=new URLSearchParams(Object.entries(_).filter(([,r])=>r!==void 0).map(([r,d])=>[r,String(d)]));return this.request(`/api/v1/operations/${encodeURIComponent(E)}/logs?${T}`)}streamOperationLogs(E,_=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(E)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(_)}})}cancelOperation(E){return this.request(`/api/v1/operations/${encodeURIComponent(E)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(E,_,T=0){return this.request(`/api/v1/operations/${encodeURIComponent(E)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:_,delayMs:T})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(E){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:E})})}listPreviews(E){return this.request(`/api/v1/previews${E?`?projectId=${encodeURIComponent(E)}`:""}`)}listPreviewDefinitions(E){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(E)}`)}createPreviewDefinition(E){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}createPreview(E){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}destroyPreview(E,_){return this.request(`/api/v1/previews/${encodeURIComponent(E)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:_})})}extendPreview(E,_){return this.request(`/api/v1/previews/${encodeURIComponent(E)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:_})})}rebuildPreview(E){return this.request(`/api/v1/previews/${encodeURIComponent(E)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}}import{createHash as Wa}from"node:crypto";var oJ="1.6.0";function Ez(){let E={type:"object",required:["error"],properties:{error:{type:"object",required:["code","message","requestId"],properties:{code:{type:"string"},message:{type:"string"},requestId:{type:"string",format:"uuid"},details:{}}}}},_=(r)=>({type:"object",required:["data","page","requestId"],properties:{data:{type:"array",items:r},page:{type:"object",required:["hasMore"],properties:{nextCursor:{type:"string"},hasMore:{type:"boolean"}}},requestId:{type:"string",format:"uuid"}}}),T=(r)=>({"200":{description:"A stable cursor page.",content:{"application/json":{schema:_(r)}}},default:{$ref:"#/components/responses/Error"}});return{openapi:"3.1.0",info:{title:"ts-cloud API",version:"1.6.0",description:"Additive changes are released within v1. Breaking request or response changes require a new URL version."},servers:[{url:"/"}],security:[{bearerAuth:[]}],paths:{"/api/v1/projects":{get:{operationId:"listProjects",summary:"List accessible projects",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/Project"})}},"/api/v1/projects/{projectId}/environments":{get:{operationId:"listEnvironments",summary:"List accessible project environments",parameters:[{$ref:"#/components/parameters/ProjectId"},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/Environment"})}},"/api/v1/services":{get:{operationId:"listServices",summary:"List accessible services",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{name:"environmentId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/Service"})}},"/api/v1/source/connections":{get:{operationId:"listSourceConnections",summary:"List safe Git connection metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/SourceConnection"})},post:{operationId:"createSourceConnection",summary:"Create an encrypted Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["provider","name","host"],properties:{provider:{type:"string",enum:["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"]},name:{type:"string"},host:{type:"string",format:"uri"},token:{type:"string",writeOnly:!0},repositoryFullName:{type:"string"},repositoryUrl:{type:"string"}}}}}},responses:{"201":{description:"Encrypted connection created."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectSourceConnection",summary:"Preview or safely disconnect a Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["id"],properties:{id:{type:"string"},preview:{type:"boolean"}}}}}},responses:{"200":{description:"Impact preview or disconnected connection."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/repositories":{get:{operationId:"listSourceRepositories",summary:"List or synchronize granted repositories",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"sync",in:"query",schema:{type:"boolean"}},{name:"search",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/SourceRepository"})}},"/api/v1/source/refs":{get:{operationId:"listSourceRefs",summary:"List repository branches or tags",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"repository",in:"query",required:!0,schema:{type:"string"}},{name:"repositoryId",in:"query",schema:{type:"string"}},{name:"type",in:"query",schema:{type:"string",enum:["branches","tags"]}}],responses:{"200":{description:"Provider reference page."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/bindings":{post:{operationId:"createSourceBinding",summary:"Bind a repository to an application",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/SourceBindingRequest"}}}},responses:{"201":{description:"Source binding created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/webhooks":{post:{operationId:"createSourceWebhook",summary:"Create and optionally reconcile a signed webhook",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["connectionId","repositoryFullName","baseUrl"],properties:{connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},baseUrl:{type:"string",format:"uri"},events:{type:"array",items:{type:"string",enum:["push","pull_request"]}},reconcile:{type:"boolean"}}}}}},responses:{"201":{description:"Webhook endpoint created; endpoint is revealed once."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-detections":{post:{operationId:"detectApplication",summary:"Detect bounded application build candidates",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["files"],properties:{files:{type:"array",maxItems:1e4,items:{$ref:"#/components/schemas/DetectionFile"}}}}}}},responses:{"200":{description:"Ranked detection candidates with evidence."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-plans":{post:{operationId:"planApplication",summary:"Validate and normalize an application manifest",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["draft"],properties:{draft:{$ref:"#/components/schemas/ApplicationInput"},suppliedSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}}}}}},responses:{"200":{description:"Validated plan, config patch, capabilities, costs, and missing secret names."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-drafts":{get:{operationId:"listApplicationDrafts",summary:"List resumable secret-free drafts",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/ApplicationDraft"})},post:{operationId:"createApplicationDraft",summary:"Create a resumable application draft",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/ApplicationDraftCreateRequest"}}}},responses:{"201":{description:"Draft created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateApplicationDraft",summary:"Optimistically update a draft",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/ApplicationDraftCreateRequest"},{type:"object",required:["id","version","step"],properties:{id:{type:"string"},version:{type:"integer",minimum:1}}}]}}}},responses:{"200":{description:"Updated draft."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/applications":{post:{operationId:"createApplication",summary:"Confirm and queue an application plan",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["draftId","version","confirmEnvironment"],properties:{draftId:{type:"string"},version:{type:"integer",minimum:1},confirmEnvironment:{type:"string",description:"Exact target environment slug."}}}}}},responses:{"202":{description:"Application operation queued; identical requests replay safely."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-artifacts":{post:{operationId:"uploadApplicationArtifact",summary:"Inspect and store a bounded ZIP or TAR source artifact",parameters:[{name:"X-Project-Id",in:"header",required:!0,schema:{type:"string"}},{name:"X-Artifact-Filename",in:"header",required:!0,schema:{type:"string"}}],requestBody:{required:!0,content:{"application/octet-stream":{schema:{type:"string",format:"binary",maxLength:104857600}}}},responses:{"201":{description:"Deduplicated artifact metadata; archive contents are never executed."},"413":{$ref:"#/components/responses/Error"},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/registry-connections":{get:{operationId:"listRegistryConnections",summary:"List safe private-registry metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/RegistryConnection"})},post:{operationId:"createRegistryConnection",summary:"Create an encrypted private-registry connection",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/RegistryConnectionRequest"}}}},responses:{"201":{description:"Encrypted registry connection created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateRegistryConnection",summary:"Test access or rotate write-only credentials",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/RegistryConnectionRequest"},{type:"object",required:["id","action"],properties:{id:{type:"string"},action:{type:"string",enum:["test","rotate"]},image:{type:"string"}}}]}}}},responses:{"200":{description:"Safe connection health metadata."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectRegistryConnection",summary:"Disconnect and erase registry credentials",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["id"],properties:{id:{type:"string"}}}}}},responses:{"200":{description:"Credentials erased and connection disconnected."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue":{get:{operationId:"listQueue",summary:"List authorized durable operations and blocking metadata",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"state",in:"query",schema:{type:"string",enum:["queued","running","succeeded","failed","cancelled","timed_out"]}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/QueueOperation"})}},"/api/v1/preview-definitions":{get:{operationId:"listPreviewDefinitions",summary:"List preview policies",responses:T({type:"object"})},post:{operationId:"createPreviewDefinition",summary:"Configure bounded preview policy",responses:{"200":{description:"Preview definition created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews":{get:{operationId:"listPreviews",summary:"List authorized persistent previews",responses:T({type:"object"})},post:{operationId:"createPreview",summary:"Create or update one immutable preview identity",responses:{"200":{description:"Preview deployment queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/destroy":{post:{operationId:"destroyPreview",summary:"Confirm tagged preview teardown",responses:{"200":{description:"Teardown queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/extend":{post:{operationId:"extendPreview",summary:"Extend preview TTL",responses:{"200":{description:"Expiry extended."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/rebuild":{post:{operationId:"rebuildPreview",summary:"Rebuild the exact recorded commit",responses:{"200":{description:"Rebuild queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/cleanup":{post:{operationId:"cleanupPreviews",summary:"Dry-run or queue TTL/keep-count teardown",responses:{"200":{description:"Cleanup plan or operations."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-templates":{get:{operationId:"listComposeTemplates",summary:"List pinned verified application templates",responses:T({type:"object"})}},"/api/v1/compose-applications":{get:{operationId:"listComposeApplications",summary:"List authorized multi-service applications",responses:T({type:"object"})},post:{operationId:"createComposeApplication",summary:"Import Compose or materialize a template",responses:{"200":{description:"Editable normalized application."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/preview":{post:{operationId:"previewComposeApplication",summary:"Parse and diagnose Compose without mutation",responses:{"200":{description:"Normalized preview and actionable diagnostics."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/services":{get:{operationId:"listComposeServices",summary:"Inspect per-service desired and observed state",responses:{"200":{description:"Service topology and status."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/{action}":{post:{operationId:"operateComposeApplication",summary:"Deploy, redeploy, start, stop, scale, or delete through the durable queue",responses:{"200":{description:"Scoped operation queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/release-artifacts":{post:{operationId:"createReleaseArtifact",summary:"Register a verified content-addressed artifact",responses:{"200":{description:"Artifact identity registered."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases":{get:{operationId:"listReleases",summary:"List unified authorized release history",responses:T({type:"object"})},post:{operationId:"createRelease",summary:"Create an immutable release from an existing artifact",responses:{"200":{description:"Release record created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/capabilities":{get:{operationId:"getReleaseCapabilities",summary:"Explain supported strategies, capacity, cost, and rollback",responses:{"200":{description:"Provider-aware strategy capabilities."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}":{get:{operationId:"getRelease",summary:"Inspect provenance, approvals, health, and transitions",responses:{"200":{description:"Release detail."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}/{action}":{post:{operationId:"operateRelease",summary:"Promote, approve, activate, roll back, report health, or pin",responses:{"200":{description:"Release lifecycle updated."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/settings":{get:{operationId:"getQueueSettings",summary:"Get effective concurrency limits",responses:{"200":{description:"Queue concurrency settings."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateQueueSettings",summary:"Confirm and audit production concurrency changes",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm","concurrency"],properties:{confirm:{const:"update queue limits"},concurrency:{$ref:"#/components/schemas/QueueConcurrency"}}}}}},responses:{"200":{description:"Updated effective limits."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/history":{delete:{operationId:"clearQueueHistory",summary:"Clear terminal jobs whose retention has elapsed",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm"],properties:{confirm:{const:"clear completed"},before:{type:"string",format:"date-time"},projectId:{type:"string"}}}}}},responses:{"200":{description:"Eligible history cleared with an audit event."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs":{get:{operationId:"listOperationLogs",summary:"Resume ordered sanitized operation logs from a cursor",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:{"200":{description:"Ordered log chunks and next cursor."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs/stream":{get:{operationId:"streamOperationLogs",summary:"Stream authorized operation logs with Last-Event-ID resume",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"Last-Event-ID",in:"header",schema:{type:"integer",minimum:0}}],responses:{"200":{description:"Server-sent log and completion events.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/cancel":{post:{operationId:"cancelOperation",summary:"Cancel queued work or request cooperative running cancellation",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{content:{"application/json":{schema:{type:"object"}}}},responses:{"200":{description:"Cancellation state recorded."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/retry":{post:{operationId:"retryOperation",summary:"Retry an allow-listed failure class within the attempt limit",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["errorClass"],properties:{errorClass:{type:"string"},delayMs:{type:"integer",minimum:0}}}}}},responses:{"200":{description:"Retry queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/deployments":{post:{operationId:"createDeployment",summary:"Queue a deployment",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/DeploymentRequest"}}}},responses:{"202":{description:"Queued operation.",content:{"application/json":{schema:{$ref:"#/components/schemas/OperationResponse"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations":{get:{operationId:"listOperations",summary:"List scoped operations",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/Operation"})}},"/api/v1/events":{get:{operationId:"listEvents",summary:"List scoped audit events",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:T({$ref:"#/components/schemas/Event"})}},"/api/v1/events/stream":{get:{operationId:"streamEvents",summary:"Stream scoped audit events",responses:{"200":{description:"Authenticated server-sent event stream.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/openapi.json":{get:{operationId:"getOpenApi",summary:"Get the OpenAPI contract",security:[],responses:{"200":{description:"OpenAPI 3.1 contract."}}}}},components:{securitySchemes:{bearerAuth:{type:"http",scheme:"bearer",bearerFormat:"tsc_v1"}},parameters:{Limit:{name:"limit",in:"query",schema:{type:"integer",minimum:1,maximum:100,default:50}},Cursor:{name:"cursor",in:"query",schema:{type:"string"}},ProjectId:{name:"projectId",in:"path",required:!0,schema:{type:"string"}},OperationId:{name:"operationId",in:"path",required:!0,schema:{type:"string"}}},responses:{Error:{description:"Stable error envelope.",content:{"application/json":{schema:E}}}},schemas:{Project:{type:"object",required:["id","slug","name"],properties:{id:{type:"string"},slug:{type:"string"},name:{type:"string"},description:{type:"string"}}},Environment:{type:"object",required:["id","projectId","slug","name","kind"],properties:{id:{type:"string"},projectId:{type:"string"},slug:{type:"string"},name:{type:"string"},kind:{type:"string"},region:{type:"string"}}},Service:{type:"object",required:["id","projectId","kind","slug","name"],properties:{id:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},kind:{type:"string"},slug:{type:"string"},name:{type:"string"},metadata:{type:"object",additionalProperties:!0}}},SourceConnection:{type:"object",required:["id","provider","name","host","status","credentialConfigured"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},status:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},grantedScopes:{type:"array",items:{type:"string"}}}},SourceRepository:{type:"object",required:["id","connectionId","fullName","cloneUrl","defaultBranch"],properties:{id:{type:"string"},connectionId:{type:"string"},fullName:{type:"string"},cloneUrl:{type:"string"},defaultBranch:{type:"string"},visibility:{type:"string"},archived:{type:"boolean"}}},SourceBindingRequest:{type:"object",additionalProperties:!1,required:["projectId","connectionId","repositoryFullName"],properties:{projectId:{type:"string"},environmentId:{type:"string"},resourceId:{type:"string"},connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},defaultBranch:{type:"string"},branchRule:{type:"string"},tagRule:{type:"string"},monorepoRoot:{type:"string"},includePaths:{type:"array",items:{type:"string"}},excludePaths:{type:"array",items:{type:"string"}},submodules:{type:"boolean"},cloneDepth:{type:"integer",minimum:1},deployKeyId:{type:"string"},autoDeploy:{type:"boolean"},pullRequestPreviews:{type:"boolean"}}},DetectionFile:{type:"object",additionalProperties:!1,required:["path"],properties:{path:{type:"string"},size:{type:"integer",minimum:0},content:{type:"string",maxLength:262144}}},ApplicationInput:{type:"object",additionalProperties:!1,required:["schemaVersion","name","slug","projectId","environmentId","source","build","runtime"],properties:{schemaVersion:{const:1},name:{type:"string"},slug:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},source:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["git","local","artifact","image"]}},additionalProperties:!0},build:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["dockerfile","buildpack","static","server","serverless","prebuilt_image"]},secretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}},additionalProperties:!0},runtime:{type:"object",required:["architecture","target"],properties:{architecture:{type:"string",enum:["x86_64","arm64"]},target:{type:"string",enum:["server","serverless","container"]},port:{type:"integer",minimum:1,maximum:65535},healthCheck:{type:"object",additionalProperties:!0}},additionalProperties:!0},environment:{type:"object",additionalProperties:{oneOf:[{type:"string"},{type:"object",additionalProperties:!1,required:["secretRef"],properties:{secretRef:{type:"string"}}}]}},requiredSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}},domain:{type:"object",properties:{hostname:{type:"string"},path:{type:"string"},tls:{type:"boolean"}}}}},ApplicationDraftCreateRequest:{type:"object",additionalProperties:!1,required:["projectId","draft"],properties:{projectId:{type:"string"},name:{type:"string"},draft:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string",enum:["source","build","runtime","environment","domain","review"]},suppliedSecretNames:{type:"array",uniqueItems:!0,description:"Names only; values must use the secrets boundary.",items:{type:"string"}}}},ApplicationDraft:{type:"object",required:["id","projectId","input","step","status","version"],properties:{id:{type:"string"},projectId:{type:"string"},input:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string"},suppliedSecretNames:{type:"array",items:{type:"string"}},status:{type:"string",enum:["draft","ready","applied"]},version:{type:"integer"},createdAt:{type:"string",format:"date-time"},updatedAt:{type:"string",format:"date-time"}}},RegistryConnectionRequest:{type:"object",properties:{provider:{type:"string",enum:["docker_hub","ghcr","ecr","gcr","generic"]},name:{type:"string"},host:{type:"string"},username:{type:"string",writeOnly:!0},password:{type:"string",writeOnly:!0},token:{type:"string",writeOnly:!0},credentialExpiresAt:{type:"string",format:"date-time"},expiresAt:{type:"string",format:"date-time"}}},RegistryConnection:{type:"object",required:["id","provider","name","host","credentialConfigured","status","version"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},credentialExpiresAt:{type:"string",format:"date-time"},status:{type:"string",enum:["pending","healthy","degraded","expired","disconnected"]},healthMessage:{type:"string"},lastTestedAt:{type:"string",format:"date-time"},version:{type:"integer"}}},QueueConcurrency:{type:"object",additionalProperties:!1,properties:{project:{type:"integer",minimum:1,maximum:100},environment:{type:"integer",minimum:1,maximum:100},provider:{type:"integer",minimum:1,maximum:100},builds:{type:"integer",minimum:1,maximum:100}}},QueueOperation:{allOf:[{$ref:"#/components/schemas/Operation"},{type:"object",required:["queue"],properties:{queue:{type:"object",required:["maxAttempts","availableAt","timeoutSeconds","retryClasses","resumePolicy","cancellationMode","retentionUntil"],properties:{lockKey:{type:"string"},providerKey:{type:"string"},buildSlot:{type:"boolean"},maxAttempts:{type:"integer"},availableAt:{type:"string",format:"date-time"},timeoutSeconds:{type:"integer"},heartbeatAt:{type:"string",format:"date-time"},currentStep:{type:"string"},blockedReason:{type:"string"},retryClasses:{type:"array",items:{type:"string"}},resumePolicy:{type:"string",enum:["fail","requeue"]},cancellationMode:{type:"string",enum:["cooperative","provider_non_cancellable"]},retentionUntil:{type:"string",format:"date-time"}}},approximatePosition:{type:"object",properties:{ahead:{type:"integer"},precision:{const:"bounded"}}}}}]},DeploymentRequest:{type:"object",additionalProperties:!1,required:["projectId","environmentId"],properties:{projectId:{type:"string"},environmentId:{type:"string"},serviceId:{type:"string"},action:{type:"string",enum:["deploy","rollback"],default:"deploy"},revision:{type:"string"}}},Operation:{type:"object",required:["id","state","kind","correlationId","createdAt"],properties:{id:{type:"string"},state:{type:"string"},kind:{type:"string"},correlationId:{type:"string"},createdAt:{type:"string",format:"date-time"}}},OperationResponse:{type:"object",required:["operation","idempotentReplay","requestId"],properties:{operation:{$ref:"#/components/schemas/Operation"},idempotentReplay:{type:"boolean"},requestId:{type:"string",format:"uuid"}}},Event:{type:"object",required:["id","sequence","type","level","correlationId","createdAt"],properties:{id:{type:"string"},sequence:{type:"integer"},type:{type:"string"},level:{type:"string"},correlationId:{type:"string"},payload:{},createdAt:{type:"string",format:"date-time"}}}}}}}await tT();import{createHash as Ba}from"node:crypto";class jE extends Error{code;status;details;constructor(E,_,T,r){super(_);this.code=E;this.status=T;this.details=r}}function _z(E,_){if(E.organizationId!==_.organizationId)return!1;if(E.projectId&&E.projectId!==_.projectId)return!1;if(E.environmentId&&E.environmentId!==_.environmentId)return!1;if(E.resourceId&&E.resourceId!==_.resourceId)return!1;return!0}function pQ(E,_,T){return Ba("sha256").update(`${E.toUpperCase()}
+Add the tracking script to your website:`),U(`  <script src="https://analytics.stacksjs.com/track.js" data-site-id="${h}"></script>`)}catch(T){Q(`Failed to create site: ${T.message}`),process.exit(1)}}),E.command("analytics:sites:update <siteId>","Update an analytics site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--name <name>","New site name").option("--domain <domain>","Set domains (replaces existing)").option("--active <boolean>","Set site active/inactive status").action(async(_,T)=>{b("Update Analytics Site");try{let r=new LT(T.region),d=await r.getItem({TableName:T.table,Key:{pk:{S:`SITE#${_}`},sk:{S:`SITE#${_}`}}});if(!d.Item)Q(`Site not found: ${_}`),process.exit(1);let t=LT.unmarshal(d.Item);U(`Updating site: ${t.name||"Unnamed"} (${_})`),U("");let R=[],h={},N={};if(T.name)R.push("#n = :name"),h["#n"]="name",N[":name"]={S:T.name},U(`  Name: ${t.name} -> ${T.name}`);if(T.domain!==void 0){let S=Array.isArray(T.domain)?T.domain:[T.domain];R.push("domains = :domains"),N[":domains"]={L:S.map((A)=>({S:A}))},U(`  Domains: ${JSON.stringify(t.domains||[])} -> ${JSON.stringify(S)}`)}if(T.active!==void 0){let S=T.active==="true"||T.active==="1";R.push("isActive = :active"),N[":active"]={BOOL:S},U(`  Active: ${t.isActive} -> ${S}`)}if(R.length===0){_E("No updates specified. Use --name, --domain, or --active options.");return}R.push("updatedAt = :updatedAt"),N[":updatedAt"]={S:new Date().toISOString()},await r.updateItem({TableName:T.table,Key:{pk:{S:`SITE#${_}`},sk:{S:`SITE#${_}`}},UpdateExpression:`SET ${R.join(", ")}`,ExpressionAttributeNames:Object.keys(h).length>0?h:void 0,ExpressionAttributeValues:N}),U(""),Z("Site updated successfully")}catch(r){Q(`Failed to update site: ${r.message}`),process.exit(1)}}),E.command("analytics:query <siteId>","Query analytics data for a site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--limit <n>","Max items to return",{default:"10"}).option("--type <type>","Filter by type (pageview, event, etc.)").action(async(_,T)=>{b(`Analytics Data: ${_}`);try{let r=new LT(T.region),d=new n("Querying data...");d.start();let t=await r.query({TableName:T.table,KeyConditionExpression:"pk = :pk",ExpressionAttributeValues:{":pk":{S:`SITE#${_}`}},ScanIndexForward:!1,Limit:parseInt(T.limit,10)});if(d.succeed(`Found ${t.Items?.length||0} items`),!t.Items||t.Items.length===0){U("No data found for this site");return}let R=t.Items.map((h)=>LT.unmarshal(h));for(let h of R){if(U(""),U(`SK: ${h.sk}`),h.path)U(`  Path: ${h.path}`);if(h.timestamp)U(`  Time: ${h.timestamp}`);if(h.visitorId)U(`  Visitor: ${h.visitorId}`);if(h.browser)U(`  Browser: ${h.browser}`);if(h.country)U(`  Country: ${h.country}`)}}catch(r){Q(`Failed to query data: ${r.message}`),process.exit(1)}}),E.command("analytics:realtime <siteId>","Check realtime visitors for a site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--minutes <n>","Minutes to look back",{default:"5"}).action(async(_,T)=>{b(`Realtime: ${_}`);try{let r=new LT(T.region),d=new n("Checking realtime...");d.start();let t=parseInt(T.minutes,10),R=new Date(Date.now()-t*60*1000),h=await r.query({TableName:T.table,KeyConditionExpression:"pk = :pk AND sk BETWEEN :start AND :end",ExpressionAttributeValues:{":pk":{S:`SITE#${_}`},":start":{S:`PAGEVIEW#${R.toISOString()}`},":end":{S:"PAGEVIEW#Z"}},ScanIndexForward:!1});if(d.succeed(`Found ${h.Items?.length||0} pageviews in last ${t} minutes`),!h.Items||h.Items.length===0){_E("No recent pageviews found"),U(""),U("Possible issues:"),U("  1. Tracking script not installed correctly"),U("  2. Site ID mismatch"),U("  3. CORS or network issues");return}let N=h.Items.map((L)=>LT.unmarshal(L)),S=new Set(N.map((L)=>L.visitorId)).size;U(""),Z(`${S} unique visitor(s) online`),U("");let A={};for(let L of N){let O=L.path||"/";A[O]=(A[O]||0)+1}U("Active pages:");for(let[L,O]of Object.entries(A).sort((c,$)=>$[1]-c[1]).slice(0,5))U(`  ${L}: ${O} view(s)`);U(""),U("Recent pageviews:");for(let L of N.slice(0,5))U(`  ${L.timestamp} - ${L.path} (${L.browser||"Unknown"})`)}catch(r){Q(`Failed to check realtime: ${r.message}`),process.exit(1)}})}fE();import{chmodSync as to,mkdirSync as Ro,readFileSync as ho,writeFileSync as No}from"node:fs";import{dirname as So,resolve as d1}from"node:path";class pJ extends Error{status;code;requestId;constructor(E,_,T,r){super(T);this.status=E;this.code=_;this.requestId=r}}class $D{options;baseUrl;fetchFn;constructor(E){this.options=E;this.baseUrl=E.baseUrl.replace(/\/$/,""),this.fetchFn=E.fetch??fetch}async request(E,_={}){let T=await this.fetchFn(`${this.baseUrl}${E}`,{..._,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,..._.headers}}),r=await T.json().catch(()=>({}));if(!T.ok)throw new pJ(T.status,r.error?.code??"api_error",r.error?.message??"API request failed.",r.error?.requestId??T.headers.get("x-request-id")??void 0);return r}listProjects(E={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(E).filter(([,_])=>_!==void 0).map(([_,T])=>[_,String(T)])))}`)}listEnvironments(E,_={}){return this.request(`/api/v1/projects/${encodeURIComponent(E)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(_).filter(([,T])=>T!==void 0).map(([T,r])=>[T,String(r)])))}`)}listServices(E,_){return this.request(`/api/v1/services?${new URLSearchParams({projectId:E,..._?{environmentId:_}:{}})}`)}listOperations(E){return this.request(`/api/v1/operations${E?`?projectId=${encodeURIComponent(E)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(E,_){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:E,..._?{environmentId:_}:{}})}`)}previewCompose(E){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}createComposeApplication(E){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}composeServices(E){return this.request(`/api/v1/compose-applications/${encodeURIComponent(E)}/services`)}composeAction(E,_,T={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(E)}/${_}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(T)})}releaseCapabilities(E,_={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:E,health:String(!!_.health),replicas:String(_.replicas??1)})}`)}listReleases(E,_={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:E,..._})}`)}createReleaseArtifact(E){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}createRelease(E){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}releaseAction(E,_,T={}){return this.request(`/api/v1/releases/${encodeURIComponent(E)}/${_}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(T)})}createDeployment(E,_){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":_},body:JSON.stringify(E)})}detectApplication(E){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}planApplication(E){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}listApplicationDrafts(E){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(E)}`)}createApplicationDraft(E){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}updateApplicationDraft(E){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}createApplication(E,_){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":_},body:JSON.stringify(E)})}uploadApplicationArtifact(E,_,T){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":E,"x-artifact-filename":_},body:T})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(E){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}updateRegistryConnection(E){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}disconnectRegistryConnection(E){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:E})})}listQueue(E={}){let _=new URLSearchParams(Object.entries(E).filter(([,T])=>T!==void 0).map(([T,r])=>[T,String(r)]));return this.request(`/api/v1/queue?${_}`)}operationLogs(E,_={}){let T=new URLSearchParams(Object.entries(_).filter(([,r])=>r!==void 0).map(([r,d])=>[r,String(d)]));return this.request(`/api/v1/operations/${encodeURIComponent(E)}/logs?${T}`)}streamOperationLogs(E,_=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(E)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(_)}})}cancelOperation(E){return this.request(`/api/v1/operations/${encodeURIComponent(E)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(E,_,T=0){return this.request(`/api/v1/operations/${encodeURIComponent(E)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:_,delayMs:T})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(E){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:E})})}listPreviews(E){return this.request(`/api/v1/previews${E?`?projectId=${encodeURIComponent(E)}`:""}`)}listPreviewDefinitions(E){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(E)}`)}createPreviewDefinition(E){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}createPreview(E){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E)})}destroyPreview(E,_){return this.request(`/api/v1/previews/${encodeURIComponent(E)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:_})})}extendPreview(E,_){return this.request(`/api/v1/previews/${encodeURIComponent(E)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:_})})}rebuildPreview(E){return this.request(`/api/v1/previews/${encodeURIComponent(E)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}}import{createHash as Wa}from"node:crypto";var oJ="1.6.0";function Ez(){let E={type:"object",required:["error"],properties:{error:{type:"object",required:["code","message","requestId"],properties:{code:{type:"string"},message:{type:"string"},requestId:{type:"string",format:"uuid"},details:{}}}}},_=(r)=>({type:"object",required:["data","page","requestId"],properties:{data:{type:"array",items:r},page:{type:"object",required:["hasMore"],properties:{nextCursor:{type:"string"},hasMore:{type:"boolean"}}},requestId:{type:"string",format:"uuid"}}}),T=(r)=>({"200":{description:"A stable cursor page.",content:{"application/json":{schema:_(r)}}},default:{$ref:"#/components/responses/Error"}});return{openapi:"3.1.0",info:{title:"ts-cloud API",version:"1.6.0",description:"Additive changes are released within v1. Breaking request or response changes require a new URL version."},servers:[{url:"/"}],security:[{bearerAuth:[]}],paths:{"/api/v1/projects":{get:{operationId:"listProjects",summary:"List accessible projects",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/Project"})}},"/api/v1/projects/{projectId}/environments":{get:{operationId:"listEnvironments",summary:"List accessible project environments",parameters:[{$ref:"#/components/parameters/ProjectId"},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/Environment"})}},"/api/v1/services":{get:{operationId:"listServices",summary:"List accessible services",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{name:"environmentId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/Service"})}},"/api/v1/source/connections":{get:{operationId:"listSourceConnections",summary:"List safe Git connection metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/SourceConnection"})},post:{operationId:"createSourceConnection",summary:"Create an encrypted Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["provider","name","host"],properties:{provider:{type:"string",enum:["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"]},name:{type:"string"},host:{type:"string",format:"uri"},token:{type:"string",writeOnly:!0},repositoryFullName:{type:"string"},repositoryUrl:{type:"string"}}}}}},responses:{"201":{description:"Encrypted connection created."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectSourceConnection",summary:"Preview or safely disconnect a Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["id"],properties:{id:{type:"string"},preview:{type:"boolean"}}}}}},responses:{"200":{description:"Impact preview or disconnected connection."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/repositories":{get:{operationId:"listSourceRepositories",summary:"List or synchronize granted repositories",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"sync",in:"query",schema:{type:"boolean"}},{name:"search",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/SourceRepository"})}},"/api/v1/source/refs":{get:{operationId:"listSourceRefs",summary:"List repository branches or tags",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"repository",in:"query",required:!0,schema:{type:"string"}},{name:"repositoryId",in:"query",schema:{type:"string"}},{name:"type",in:"query",schema:{type:"string",enum:["branches","tags"]}}],responses:{"200":{description:"Provider reference page."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/bindings":{post:{operationId:"createSourceBinding",summary:"Bind a repository to an application",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/SourceBindingRequest"}}}},responses:{"201":{description:"Source binding created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/webhooks":{post:{operationId:"createSourceWebhook",summary:"Create and optionally reconcile a signed webhook",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["connectionId","repositoryFullName","baseUrl"],properties:{connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},baseUrl:{type:"string",format:"uri"},events:{type:"array",items:{type:"string",enum:["push","pull_request"]}},reconcile:{type:"boolean"}}}}}},responses:{"201":{description:"Webhook endpoint created; endpoint is revealed once."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-detections":{post:{operationId:"detectApplication",summary:"Detect bounded application build candidates",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["files"],properties:{files:{type:"array",maxItems:1e4,items:{$ref:"#/components/schemas/DetectionFile"}}}}}}},responses:{"200":{description:"Ranked detection candidates with evidence."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-plans":{post:{operationId:"planApplication",summary:"Validate and normalize an application manifest",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["draft"],properties:{draft:{$ref:"#/components/schemas/ApplicationInput"},suppliedSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}}}}}},responses:{"200":{description:"Validated plan, config patch, capabilities, costs, and missing secret names."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-drafts":{get:{operationId:"listApplicationDrafts",summary:"List resumable secret-free drafts",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/ApplicationDraft"})},post:{operationId:"createApplicationDraft",summary:"Create a resumable application draft",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/ApplicationDraftCreateRequest"}}}},responses:{"201":{description:"Draft created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateApplicationDraft",summary:"Optimistically update a draft",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/ApplicationDraftCreateRequest"},{type:"object",required:["id","version","step"],properties:{id:{type:"string"},version:{type:"integer",minimum:1}}}]}}}},responses:{"200":{description:"Updated draft."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/applications":{post:{operationId:"createApplication",summary:"Confirm and queue an application plan",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["draftId","version","confirmEnvironment"],properties:{draftId:{type:"string"},version:{type:"integer",minimum:1},confirmEnvironment:{type:"string",description:"Exact target environment slug."}}}}}},responses:{"202":{description:"Application operation queued; identical requests replay safely."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-artifacts":{post:{operationId:"uploadApplicationArtifact",summary:"Inspect and store a bounded ZIP or TAR source artifact",parameters:[{name:"X-Project-Id",in:"header",required:!0,schema:{type:"string"}},{name:"X-Artifact-Filename",in:"header",required:!0,schema:{type:"string"}}],requestBody:{required:!0,content:{"application/octet-stream":{schema:{type:"string",format:"binary",maxLength:104857600}}}},responses:{"201":{description:"Deduplicated artifact metadata; archive contents are never executed."},"413":{$ref:"#/components/responses/Error"},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/registry-connections":{get:{operationId:"listRegistryConnections",summary:"List safe private-registry metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/RegistryConnection"})},post:{operationId:"createRegistryConnection",summary:"Create an encrypted private-registry connection",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/RegistryConnectionRequest"}}}},responses:{"201":{description:"Encrypted registry connection created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateRegistryConnection",summary:"Test access or rotate write-only credentials",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/RegistryConnectionRequest"},{type:"object",required:["id","action"],properties:{id:{type:"string"},action:{type:"string",enum:["test","rotate"]},image:{type:"string"}}}]}}}},responses:{"200":{description:"Safe connection health metadata."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectRegistryConnection",summary:"Disconnect and erase registry credentials",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["id"],properties:{id:{type:"string"}}}}}},responses:{"200":{description:"Credentials erased and connection disconnected."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue":{get:{operationId:"listQueue",summary:"List authorized durable operations and blocking metadata",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"state",in:"query",schema:{type:"string",enum:["queued","running","succeeded","failed","cancelled","timed_out"]}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/QueueOperation"})}},"/api/v1/preview-definitions":{get:{operationId:"listPreviewDefinitions",summary:"List preview policies",responses:T({type:"object"})},post:{operationId:"createPreviewDefinition",summary:"Configure bounded preview policy",responses:{"200":{description:"Preview definition created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews":{get:{operationId:"listPreviews",summary:"List authorized persistent previews",responses:T({type:"object"})},post:{operationId:"createPreview",summary:"Create or update one immutable preview identity",responses:{"200":{description:"Preview deployment queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/destroy":{post:{operationId:"destroyPreview",summary:"Confirm tagged preview teardown",responses:{"200":{description:"Teardown queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/extend":{post:{operationId:"extendPreview",summary:"Extend preview TTL",responses:{"200":{description:"Expiry extended."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/rebuild":{post:{operationId:"rebuildPreview",summary:"Rebuild the exact recorded commit",responses:{"200":{description:"Rebuild queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/cleanup":{post:{operationId:"cleanupPreviews",summary:"Dry-run or queue TTL/keep-count teardown",responses:{"200":{description:"Cleanup plan or operations."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-templates":{get:{operationId:"listComposeTemplates",summary:"List pinned verified application templates",responses:T({type:"object"})}},"/api/v1/compose-applications":{get:{operationId:"listComposeApplications",summary:"List authorized multi-service applications",responses:T({type:"object"})},post:{operationId:"createComposeApplication",summary:"Import Compose or materialize a template",responses:{"200":{description:"Editable normalized application."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/preview":{post:{operationId:"previewComposeApplication",summary:"Parse and diagnose Compose without mutation",responses:{"200":{description:"Normalized preview and actionable diagnostics."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/services":{get:{operationId:"listComposeServices",summary:"Inspect per-service desired and observed state",responses:{"200":{description:"Service topology and status."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/{action}":{post:{operationId:"operateComposeApplication",summary:"Deploy, redeploy, start, stop, scale, or delete through the durable queue",responses:{"200":{description:"Scoped operation queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/release-artifacts":{post:{operationId:"createReleaseArtifact",summary:"Register a verified content-addressed artifact",responses:{"200":{description:"Artifact identity registered."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases":{get:{operationId:"listReleases",summary:"List unified authorized release history",responses:T({type:"object"})},post:{operationId:"createRelease",summary:"Create an immutable release from an existing artifact",responses:{"200":{description:"Release record created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/capabilities":{get:{operationId:"getReleaseCapabilities",summary:"Explain supported strategies, capacity, cost, and rollback",responses:{"200":{description:"Provider-aware strategy capabilities."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}":{get:{operationId:"getRelease",summary:"Inspect provenance, approvals, health, and transitions",responses:{"200":{description:"Release detail."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}/{action}":{post:{operationId:"operateRelease",summary:"Promote, approve, activate, roll back, report health, or pin",responses:{"200":{description:"Release lifecycle updated."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/settings":{get:{operationId:"getQueueSettings",summary:"Get effective concurrency limits",responses:{"200":{description:"Queue concurrency settings."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateQueueSettings",summary:"Confirm and audit production concurrency changes",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm","concurrency"],properties:{confirm:{const:"update queue limits"},concurrency:{$ref:"#/components/schemas/QueueConcurrency"}}}}}},responses:{"200":{description:"Updated effective limits."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/history":{delete:{operationId:"clearQueueHistory",summary:"Clear terminal jobs whose retention has elapsed",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm"],properties:{confirm:{const:"clear completed"},before:{type:"string",format:"date-time"},projectId:{type:"string"}}}}}},responses:{"200":{description:"Eligible history cleared with an audit event."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs":{get:{operationId:"listOperationLogs",summary:"Resume ordered sanitized operation logs from a cursor",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:{"200":{description:"Ordered log chunks and next cursor."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs/stream":{get:{operationId:"streamOperationLogs",summary:"Stream authorized operation logs with Last-Event-ID resume",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"Last-Event-ID",in:"header",schema:{type:"integer",minimum:0}}],responses:{"200":{description:"Server-sent log and completion events.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/cancel":{post:{operationId:"cancelOperation",summary:"Cancel queued work or request cooperative running cancellation",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{content:{"application/json":{schema:{type:"object"}}}},responses:{"200":{description:"Cancellation state recorded."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/retry":{post:{operationId:"retryOperation",summary:"Retry an allow-listed failure class within the attempt limit",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["errorClass"],properties:{errorClass:{type:"string"},delayMs:{type:"integer",minimum:0}}}}}},responses:{"200":{description:"Retry queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/deployments":{post:{operationId:"createDeployment",summary:"Queue a deployment",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/DeploymentRequest"}}}},responses:{"202":{description:"Queued operation.",content:{"application/json":{schema:{$ref:"#/components/schemas/OperationResponse"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations":{get:{operationId:"listOperations",summary:"List scoped operations",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:T({$ref:"#/components/schemas/Operation"})}},"/api/v1/events":{get:{operationId:"listEvents",summary:"List scoped audit events",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:T({$ref:"#/components/schemas/Event"})}},"/api/v1/events/stream":{get:{operationId:"streamEvents",summary:"Stream scoped audit events",responses:{"200":{description:"Authenticated server-sent event stream.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/openapi.json":{get:{operationId:"getOpenApi",summary:"Get the OpenAPI contract",security:[],responses:{"200":{description:"OpenAPI 3.1 contract."}}}}},components:{securitySchemes:{bearerAuth:{type:"http",scheme:"bearer",bearerFormat:"tsc_v1"}},parameters:{Limit:{name:"limit",in:"query",schema:{type:"integer",minimum:1,maximum:100,default:50}},Cursor:{name:"cursor",in:"query",schema:{type:"string"}},ProjectId:{name:"projectId",in:"path",required:!0,schema:{type:"string"}},OperationId:{name:"operationId",in:"path",required:!0,schema:{type:"string"}}},responses:{Error:{description:"Stable error envelope.",content:{"application/json":{schema:E}}}},schemas:{Project:{type:"object",required:["id","slug","name"],properties:{id:{type:"string"},slug:{type:"string"},name:{type:"string"},description:{type:"string"}}},Environment:{type:"object",required:["id","projectId","slug","name","kind"],properties:{id:{type:"string"},projectId:{type:"string"},slug:{type:"string"},name:{type:"string"},kind:{type:"string"},region:{type:"string"}}},Service:{type:"object",required:["id","projectId","kind","slug","name"],properties:{id:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},kind:{type:"string"},slug:{type:"string"},name:{type:"string"},metadata:{type:"object",additionalProperties:!0}}},SourceConnection:{type:"object",required:["id","provider","name","host","status","credentialConfigured"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},status:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},grantedScopes:{type:"array",items:{type:"string"}}}},SourceRepository:{type:"object",required:["id","connectionId","fullName","cloneUrl","defaultBranch"],properties:{id:{type:"string"},connectionId:{type:"string"},fullName:{type:"string"},cloneUrl:{type:"string"},defaultBranch:{type:"string"},visibility:{type:"string"},archived:{type:"boolean"}}},SourceBindingRequest:{type:"object",additionalProperties:!1,required:["projectId","connectionId","repositoryFullName"],properties:{projectId:{type:"string"},environmentId:{type:"string"},resourceId:{type:"string"},connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},defaultBranch:{type:"string"},branchRule:{type:"string"},tagRule:{type:"string"},monorepoRoot:{type:"string"},includePaths:{type:"array",items:{type:"string"}},excludePaths:{type:"array",items:{type:"string"}},submodules:{type:"boolean"},cloneDepth:{type:"integer",minimum:1},deployKeyId:{type:"string"},autoDeploy:{type:"boolean"},pullRequestPreviews:{type:"boolean"}}},DetectionFile:{type:"object",additionalProperties:!1,required:["path"],properties:{path:{type:"string"},size:{type:"integer",minimum:0},content:{type:"string",maxLength:262144}}},ApplicationInput:{type:"object",additionalProperties:!1,required:["schemaVersion","name","slug","projectId","environmentId","source","build","runtime"],properties:{schemaVersion:{const:1},name:{type:"string"},slug:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},source:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["git","local","artifact","image"]}},additionalProperties:!0},build:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["dockerfile","buildpack","static","server","serverless","prebuilt_image"]},secretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}},additionalProperties:!0},runtime:{type:"object",required:["architecture","target"],properties:{architecture:{type:"string",enum:["x86_64","arm64"]},target:{type:"string",enum:["server","serverless","container"]},port:{type:"integer",minimum:1,maximum:65535},healthCheck:{type:"object",additionalProperties:!0}},additionalProperties:!0},environment:{type:"object",additionalProperties:{oneOf:[{type:"string"},{type:"object",additionalProperties:!1,required:["secretRef"],properties:{secretRef:{type:"string"}}}]}},requiredSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}},domain:{type:"object",properties:{hostname:{type:"string"},path:{type:"string"},tls:{type:"boolean"}}}}},ApplicationDraftCreateRequest:{type:"object",additionalProperties:!1,required:["projectId","draft"],properties:{projectId:{type:"string"},name:{type:"string"},draft:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string",enum:["source","build","runtime","environment","domain","review"]},suppliedSecretNames:{type:"array",uniqueItems:!0,description:"Names only; values must use the secrets boundary.",items:{type:"string"}}}},ApplicationDraft:{type:"object",required:["id","projectId","input","step","status","version"],properties:{id:{type:"string"},projectId:{type:"string"},input:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string"},suppliedSecretNames:{type:"array",items:{type:"string"}},status:{type:"string",enum:["draft","ready","applied"]},version:{type:"integer"},createdAt:{type:"string",format:"date-time"},updatedAt:{type:"string",format:"date-time"}}},RegistryConnectionRequest:{type:"object",properties:{provider:{type:"string",enum:["docker_hub","ghcr","ecr","gcr","generic"]},name:{type:"string"},host:{type:"string"},username:{type:"string",writeOnly:!0},password:{type:"string",writeOnly:!0},token:{type:"string",writeOnly:!0},credentialExpiresAt:{type:"string",format:"date-time"},expiresAt:{type:"string",format:"date-time"}}},RegistryConnection:{type:"object",required:["id","provider","name","host","credentialConfigured","status","version"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},credentialExpiresAt:{type:"string",format:"date-time"},status:{type:"string",enum:["pending","healthy","degraded","expired","disconnected"]},healthMessage:{type:"string"},lastTestedAt:{type:"string",format:"date-time"},version:{type:"integer"}}},QueueConcurrency:{type:"object",additionalProperties:!1,properties:{project:{type:"integer",minimum:1,maximum:100},environment:{type:"integer",minimum:1,maximum:100},provider:{type:"integer",minimum:1,maximum:100},builds:{type:"integer",minimum:1,maximum:100}}},QueueOperation:{allOf:[{$ref:"#/components/schemas/Operation"},{type:"object",required:["queue"],properties:{queue:{type:"object",required:["maxAttempts","availableAt","timeoutSeconds","retryClasses","resumePolicy","cancellationMode","retentionUntil"],properties:{lockKey:{type:"string"},providerKey:{type:"string"},buildSlot:{type:"boolean"},maxAttempts:{type:"integer"},availableAt:{type:"string",format:"date-time"},timeoutSeconds:{type:"integer"},heartbeatAt:{type:"string",format:"date-time"},currentStep:{type:"string"},blockedReason:{type:"string"},retryClasses:{type:"array",items:{type:"string"}},resumePolicy:{type:"string",enum:["fail","requeue"]},cancellationMode:{type:"string",enum:["cooperative","provider_non_cancellable"]},retentionUntil:{type:"string",format:"date-time"}}},approximatePosition:{type:"object",properties:{ahead:{type:"integer"},precision:{const:"bounded"}}}}}]},DeploymentRequest:{type:"object",additionalProperties:!1,required:["projectId","environmentId"],properties:{projectId:{type:"string"},environmentId:{type:"string"},serviceId:{type:"string"},action:{type:"string",enum:["deploy","rollback"],default:"deploy"},revision:{type:"string"}}},Operation:{type:"object",required:["id","state","kind","correlationId","createdAt"],properties:{id:{type:"string"},state:{type:"string"},kind:{type:"string"},correlationId:{type:"string"},createdAt:{type:"string",format:"date-time"}}},OperationResponse:{type:"object",required:["operation","idempotentReplay","requestId"],properties:{operation:{$ref:"#/components/schemas/Operation"},idempotentReplay:{type:"boolean"},requestId:{type:"string",format:"uuid"}}},Event:{type:"object",required:["id","sequence","type","level","correlationId","createdAt"],properties:{id:{type:"string"},sequence:{type:"integer"},type:{type:"string"},level:{type:"string"},correlationId:{type:"string"},payload:{},createdAt:{type:"string",format:"date-time"}}}}}}}await tT();import{createHash as Ba}from"node:crypto";class jE extends Error{code;status;details;constructor(E,_,T,r){super(_);this.code=E;this.status=T;this.details=r}}function _z(E,_){if(E.organizationId!==_.organizationId)return!1;if(E.projectId&&E.projectId!==_.projectId)return!1;if(E.environmentId&&E.environmentId!==_.environmentId)return!1;if(E.resourceId&&E.resourceId!==_.resourceId)return!1;return!0}function p9(E,_,T){return Ba("sha256").update(`${E.toUpperCase()}
 ${_}
-${JSON.stringify(T)}`).digest("hex")}class DD{controlPlane;identities;queue;constructor(E,_){this.controlPlane=E;this.identities=_;this.queue=new lE(E)}target(E,_){let T=this.controlPlane.resolveAuthorizationTarget(E.serviceAccount.organizationId,_),r=this.controlPlane.resolveAuthorizationTarget(E.serviceAccount.organizationId,E.token.scope);if(!T||!r||!_z(r,T))throw new jE("forbidden","The token does not grant access to this resource.",403);return T}authorize(E,_,T){if(!E.token.capabilities.includes(_))throw new jE("forbidden",`The token is missing the ${_} capability.`,403);let r=this.controlPlane.resolveAuthorizationTarget(E.serviceAccount.organizationId,T),d=this.controlPlane.resolveAuthorizationTarget(E.serviceAccount.organizationId,E.token.scope),t=_==="project:read"&&!!r&&!!d&&_z(r,d);if(!r||!d||!_z(d,r)&&!t)throw new jE("forbidden","The token does not grant access to this resource.",403);let R=t?d:r;if(!Or({membership:E.membership,grants:this.controlPlane.listGrants(E.membership.id),capability:_,target:R}).allowed)throw new jE("forbidden","The service account does not have access to this resource.",403);return r}listProjects(E){return this.controlPlane.listProjects().filter((_)=>_.organizationId===E.serviceAccount.organizationId).filter((_)=>{try{return this.authorize(E,"project:read",{type:"project",id:_.id}),!0}catch{return!1}}).map((_)=>({id:_.id,slug:_.slug,name:_.name,description:_.description,version:_.version,createdAt:_.createdAt,updatedAt:_.updatedAt}))}listEnvironments(E,_){let T=this.controlPlane.getProject(_);if(!T||T.organizationId!==E.serviceAccount.organizationId)throw new jE("not_found","Project was not found.",404);return this.controlPlane.listEnvironments(_).filter((r)=>{try{return this.authorize(E,"project:read",{type:"environment",id:r.id}),!0}catch{return!1}}).map((r)=>({id:r.id,projectId:r.projectId,slug:r.slug,name:r.name,kind:r.kind,region:r.region,version:r.version,createdAt:r.createdAt,updatedAt:r.updatedAt}))}listServices(E,_,T){let r=new Set(this.listEnvironments(E,_).map((d)=>String(d.id)));if(T&&!r.has(T))throw new jE("not_found","Environment was not found.",404);return this.controlPlane.listResources(_,T).filter((d)=>!d.environmentId||r.has(d.environmentId)).filter((d)=>{try{return this.authorize(E,"project:read",{type:"resource",id:d.id}),!0}catch{return!1}}).map((d)=>({id:d.id,projectId:d.projectId,environmentId:d.environmentId,kind:d.kind,slug:d.slug,name:d.name,provider:d.provider,providerId:d.providerId,metadata:bE(d.metadata),version:d.version,createdAt:d.createdAt,updatedAt:d.updatedAt}))}listOperations(E,_){return this.controlPlane.listOperations({projectId:_,limit:500}).filter((r)=>{let d=r.resourceId?{type:"resource",id:r.resourceId}:r.environmentId?{type:"environment",id:r.environmentId}:r.projectId?{type:"project",id:r.projectId}:{type:"organization"};try{return this.authorize(E,"deployments:read",d),!0}catch{return!1}}).map((r)=>this.operation(r))}listEvents(E,_,T){if(_)this.authorize(E,"audit:read",{type:"project",id:_});else this.authorize(E,"audit:read",E.token.scope);return this.controlPlane.listEvents({organizationId:E.serviceAccount.organizationId,projectId:_,afterSequence:T,limit:500}).filter((r)=>{let d=r.resourceId?{type:"resource",id:r.resourceId}:r.projectId?{type:"project",id:r.projectId}:{type:"organization"};try{return this.target(E,d),!0}catch{return!1}}).map((r)=>({id:r.id,sequence:r.sequence,projectId:r.projectId,operationId:r.operationId,resourceId:r.resourceId,correlationId:r.correlationId,type:r.type,level:r.level,payload:bE(r.payload),createdAt:r.createdAt}))}createDeployment(E,_,T){if(!this.controlPlane.listEnvironments(_.projectId).find((S)=>S.id===_.environmentId))throw new jE("not_found","Environment was not found in this project.",404);let d=_.serviceId?{type:"resource",id:_.serviceId}:{type:"environment",id:_.environmentId};this.authorize(E,"deployments:create",d);let t=pQ("POST","/api/v1/deployments",_),R=this.identities.getIdempotency(E.token.id,T);if(R){if(R.requestHash!==t)throw new jE("idempotency_conflict","Idempotency-Key was already used for another request.",409);let S=R.operationId?this.controlPlane.getOperation(R.operationId):void 0;if(!S)throw new jE("idempotency_unavailable","The original operation is no longer available.",409);return{operation:this.operation(S),replay:!0}}if(_.serviceId){let S=this.controlPlane.getResource(_.serviceId);if(!S||S.projectId!==_.projectId||S.environmentId!==_.environmentId)throw new jE("not_found","Service was not found in this environment.",404)}let h=_.serviceId?this.controlPlane.getResource(_.serviceId):void 0,N=this.queue.enqueue({projectId:_.projectId,environmentId:_.environmentId,resourceId:_.serviceId,actorId:E.actor.id,kind:_.action==="rollback"?"deployment.rollback":"deployment.create",idempotencyKey:`api:${E.token.id}:${T}`,input:bE({action:_.action??"deploy",revision:_.revision??null}),lockKey:_.serviceId?`resource:${_.serviceId}`:`environment:${_.environmentId}`,providerKey:h?.provider??"default",buildSlot:_.action!=="rollback",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.identities.saveIdempotency({tokenId:E.token.id,key:T,requestHash:t,operationId:N.id,responseStatus:202,responseBody:{operationId:N.id}}),{operation:this.operation(N),replay:!1}}operation(E){return{id:E.id,state:E.state,kind:E.kind,projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,actorId:E.actorId,correlationId:E.correlationId,input:bE(E.input),output:bE(E.output),error:E.error,attempt:E.attempt,createdAt:E.createdAt,updatedAt:E.updatedAt,startedAt:E.startedAt,finishedAt:E.finishedAt}}}function Ha(E){return Buffer.from(JSON.stringify(E)).toString("base64url")}function Pa(E){if(!E)return;try{let _=JSON.parse(Buffer.from(E,"base64url").toString("utf8"));return _&&typeof _==="object"&&!Array.isArray(_)?_:void 0}catch{return}}function mT(E,_,T,r=["createdAt","id"]){let d=Math.min(100,Math.max(1,Number(_.searchParams.get("limit"))||50)),t=Pa(_.searchParams.get("cursor"));if(_.searchParams.has("cursor")&&!t)throw new jE("invalid_cursor","The pagination cursor is invalid.",400);let R=0;if(t){let A=E.findIndex((L)=>r.every((O)=>L[O]===t[O]));if(A<0)throw new jE("invalid_cursor","The pagination cursor is no longer available.",400);R=A+1}let h=E.slice(R,R+d),N=R+d<E.length,S=h.at(-1);return{data:h,page:{hasMore:N,nextCursor:N&&S?Ha(Object.fromEntries(r.map((A)=>[A,S[A]]))):void 0},requestId:T}}function Tz(E){let _=new DD(E.controlPlane,E.identities),T=new lE(E.controlPlane),r=new Bt(E.controlPlane),d=new jt(E.controlPlane),t=new rR(E.controlPlane),R=new Map,h=E.now??(()=>new Date),N=E.rateLimit??120,S=(L,O,c,$={})=>new Response(JSON.stringify(L),{status:O,headers:{"content-type":"application/json; charset=utf-8","cache-control":"no-store","x-request-id":c,"x-api-version":oJ,...$}}),A=(L,O,c,$,I,C)=>S({error:{code:L,message:O,requestId:$,details:I}},c,$,C);return async(L,O)=>{let c=new URL(L.url);if(!c.pathname.startsWith("/api/v1"))return;let $=crypto.randomUUID();if(c.pathname==="/api/v1/openapi.json"&&L.method==="GET")return S(Ez(),200,$,{"cache-control":"public, max-age=300"});let I=L.headers.get("authorization")??"",C=I.startsWith("Bearer ")?I.slice(7).trim():"",e=C?E.identities.verifyToken(C,O):void 0;if(!e)return A("unauthorized","A valid bearer token is required.",401,$,void 0,{"www-authenticate":'Bearer realm="ts-cloud", error="invalid_token"'});let z=R.get(e.token.id),F=h().getTime(),B=!z||F-z.start>=60000?{start:F,count:0}:z;B.count+=1,R.set(e.token.id,B);let y=Math.max(0,N-B.count),Y={"x-ratelimit-limit":String(N),"x-ratelimit-remaining":String(y),"x-ratelimit-reset":String(Math.ceil((B.start+60000)/1000))};if(B.count>N)return A("rate_limited","API rate limit exceeded.",429,$,void 0,{...Y,"retry-after":String(Math.max(1,Math.ceil((B.start+60000-F)/1000)))});try{let M,V=async()=>{let P=await L.text();if(P.length>1048576)throw new jE("payload_too_large","Request body exceeds 1 MB.",413);try{return JSON.parse(P)}catch{throw new jE("invalid_json","Request body must be valid JSON.",400)}},g=/^\/api\/v1\/projects\/([^/]+)\/environments$/.exec(c.pathname),k=/^\/api\/v1\/operations\/([^/]+)\/logs(?:\/(stream))?$/.exec(c.pathname),v=/^\/api\/v1\/operations\/([^/]+)\/(cancel|retry)$/.exec(c.pathname),EE=/^\/api\/v1\/previews\/([^/]+)\/(destroy|extend|rebuild)$/.exec(c.pathname),m=/^\/api\/v1\/compose-applications\/([^/]+)\/(deploy|redeploy|start|stop|scale|delete)$/.exec(c.pathname),rE=/^\/api\/v1\/compose-applications\/([^/]+)\/services$/.exec(c.pathname),LE=/^\/api\/v1\/releases\/([^/]+)\/(promote|approve|activate|rollback|health|pin)$/.exec(c.pathname);if(L.method==="GET"&&c.pathname==="/api/v1/projects")M=mT(_.listProjects(e),c,$);else if(L.method==="GET"&&g)M=mT(_.listEnvironments(e,decodeURIComponent(g[1])),c,$);else if(L.method==="GET"&&c.pathname==="/api/v1/services"){let P=c.searchParams.get("projectId");if(!P)throw new jE("validation_error","projectId is required.",422);M=mT(_.listServices(e,P,c.searchParams.get("environmentId")??void 0),c,$)}else if(L.method==="GET"&&c.pathname==="/api/v1/operations")M=mT(_.listOperations(e,c.searchParams.get("projectId")??void 0),c,$);else if(L.method==="GET"&&c.pathname==="/api/v1/previews"){let P=c.searchParams.get("projectId")??void 0,x=r.previews.listInstances({projectId:P}).filter((s)=>{try{return _.authorize(e,"deployments:read",{type:"resource",id:s.resourceId}),!0}catch{return!1}}).map((s)=>({...s}));M=mT(x,c,$)}else if(L.method==="GET"&&c.pathname==="/api/v1/compose-templates")M=mT(RS().map((P)=>({...P})),c,$,["id","version"]);else if(L.method==="GET"&&c.pathname==="/api/v1/releases/capabilities"){let P=String(c.searchParams.get("kind")??"");M={capabilities:CN({kind:P,hasHealthGate:c.searchParams.get("health")==="true",replicas:Number(c.searchParams.get("replicas"))||1}),requestId:$}}else if(L.method==="GET"&&c.pathname==="/api/v1/releases"){let P=c.searchParams.get("projectId");if(!P)throw new jE("validation_error","projectId is required.",422);_.authorize(e,"project:read",{type:"project",id:P});let x=t.releases.list({projectId:P,environmentId:c.searchParams.get("environmentId")??void 0,resourceId:c.searchParams.get("resourceId")??void 0}).filter((s)=>{try{return _.authorize(e,"deployments:read",{type:"resource",id:s.resourceId}),!0}catch{return!1}}).map((s)=>({...s,artifact:t.releases.getArtifact(s.artifactId),transitions:t.releases.transitions(s.id),approvals:t.releases.approvals(s.id)}));M=mT(x,c,$)}else if(L.method==="POST"&&c.pathname==="/api/v1/release-artifacts"){let P=await V();_.authorize(e,"applications:manage",{type:"organization"}),M={artifact:t.releases.registerArtifact({organizationId:e.serviceAccount.organizationId,digest:String(P.digest??""),kind:String(P.kind??""),uri:String(P.uri??""),size:Number(P.size),mediaType:typeof P.mediaType==="string"?P.mediaType:void 0,provenance:P.provenance,attestation:P.attestation}),requestId:$}}else if(L.method==="POST"&&c.pathname==="/api/v1/releases"){let P=await V(),x=String(P.resourceId??"");_.authorize(e,"applications:manage",{type:"resource",id:x}),M={release:t.releases.create({organizationId:e.serviceAccount.organizationId,projectId:String(P.projectId??""),environmentId:String(P.environmentId??""),resourceId:x,artifactId:String(P.artifactId??""),kind:String(P.kind??""),sourceSha:typeof P.sourceSha==="string"?P.sourceSha:void 0,config:P.config??{},manifest:P.manifest??{},provenance:P.provenance,strategy:String(P.strategy??"atomic"),healthGate:P.healthGate,hooks:P.hooks,drainSeconds:Number(P.drainSeconds)||void 0,graceSeconds:Number(P.graceSeconds)||void 0,automaticRollback:P.automaticRollback!==!1,actorId:e.actor.id,trigger:typeof P.trigger==="string"?P.trigger:"api",approvalRequired:P.approvalRequired===!0,replicas:Number(P.replicas)||void 0}),requestId:$}}else if(L.method==="GET"&&/^\/api\/v1\/releases\/[^/]+$/.test(c.pathname)){let P=decodeURIComponent(c.pathname.split("/").at(-1)),x=t.releases.get(P);if(!x)throw new jE("not_found","Release was not found.",404);_.authorize(e,"deployments:read",{type:"resource",id:x.resourceId}),M={release:x,artifact:t.releases.getArtifact(x.artifactId),transitions:t.releases.transitions(P),approvals:t.releases.approvals(P),requestId:$}}else if(L.method==="POST"&&LE){let P=t.releases.get(decodeURIComponent(LE[1]));if(!P)throw new jE("not_found","Release was not found.",404);let x=await V(),s=LE[2];if(s==="promote"){let TE=String(x.targetResourceId??"");_.authorize(e,"deployments:create",{type:"resource",id:TE}),M={release:t.releases.promote(P.id,{targetEnvironmentId:String(x.targetEnvironmentId??""),targetResourceId:TE,config:x.config??{},strategy:x.strategy,healthGate:x.healthGate,actorId:e.actor.id,approvalRequired:x.approvalRequired===!0}),requestId:$}}else if(s==="approve")_.authorize(e,"deployments:create",{type:"resource",id:P.resourceId}),M={release:t.releases.approve(P.id,{actorId:e.actor.id,decision:x.decision==="rejected"?"rejected":"approved",comment:typeof x.comment==="string"?x.comment:void 0}),requestId:$};else if(s==="activate")_.authorize(e,"deployments:create",{type:"resource",id:P.resourceId}),M={operation:_.operation(t.enqueueActivation(P,{actorId:e.actor.id})),requestId:$};else if(s==="rollback")_.authorize(e,"deployments:create",{type:"resource",id:P.resourceId}),M={operation:_.operation(t.enqueueRollback(P,{actorId:e.actor.id,targetReleaseId:typeof x.targetReleaseId==="string"?x.targetReleaseId:void 0})),requestId:$};else if(s==="health"){_.authorize(e,"deployments:create",{type:"resource",id:P.resourceId});let TE=t.completeHealthGate(P.id,{healthy:x.healthy===!0,operationId:typeof x.operationId==="string"?x.operationId:void 0,health:x.health,message:typeof x.message==="string"?x.message:void 0});M={release:TE.release,rollbackOperation:TE.rollbackOperation?_.operation(TE.rollbackOperation):void 0,requestId:$}}else _.authorize(e,"deployments:create",{type:"resource",id:P.resourceId}),M={release:t.releases.pin(P.id,x.pinned!==!1,typeof x.reason==="string"?x.reason:void 0),requestId:$}}else if(L.method==="GET"&&c.pathname==="/api/v1/compose-applications"){let P=c.searchParams.get("projectId");if(!P)throw new jE("validation_error","projectId is required.",422);_.authorize(e,"project:read",{type:"project",id:P});let x=d.applications.list({projectId:P,environmentId:c.searchParams.get("environmentId")??void 0}).filter((s)=>{try{return _.authorize(e,"deployments:read",{type:"resource",id:s.resourceId}),!0}catch{return!1}}).map((s)=>({...s,services:d.applications.services(s.id)}));M=mT(x,c,$)}else if(L.method==="POST"&&c.pathname==="/api/v1/compose-applications/preview"){let P=await V(),x=String(P.projectId??"");_.authorize(e,"project:read",{type:"project",id:x}),M={result:d.applications.preview(String(P.source??""),{name:String(P.name??""),slug:typeof P.slug==="string"?P.slug:void 0,projectId:x,environmentId:String(P.environmentId??"")}),requestId:$}}else if(L.method==="POST"&&c.pathname==="/api/v1/compose-applications"){let P=await V(),x=String(P.projectId??"");_.authorize(e,"applications:manage",{type:"environment",id:String(P.environmentId??"")});let s={name:String(P.name??""),slug:typeof P.slug==="string"?P.slug:void 0,projectId:x,environmentId:String(P.environmentId??""),createdByActorId:e.actor.id},TE=typeof P.templateId==="string"?d.applications.fromTemplate(P.templateId,P.inputs&&typeof P.inputs==="object"&&!Array.isArray(P.inputs)?P.inputs:{},{...s,version:typeof P.templateVersion==="string"?P.templateVersion:void 0}):d.applications.import(String(P.source??""),s);M={application:TE.application,diagnostics:TE.parsed.diagnostics,requestId:$}}else if(L.method==="GET"&&rE){let P=d.applications.get(decodeURIComponent(rE[1]));if(!P)throw new jE("not_found","Compose application was not found.",404);_.authorize(e,"deployments:read",{type:"resource",id:P.resourceId}),M={application:P,services:d.applications.services(P.id),requestId:$}}else if(L.method==="POST"&&m){let P=d.applications.get(decodeURIComponent(m[1]));if(!P)throw new jE("not_found","Compose application was not found.",404);let x=m[2],s=await V();_.authorize(e,x==="delete"||x==="stop"?"deployments:cancel":"deployments:create",{type:"resource",id:P.resourceId}),M={operation:_.operation(d.enqueue(P,x,{actorId:e.actor.id,service:typeof s.service==="string"?s.service:void 0,replicas:Number.isFinite(Number(s.replicas))?Number(s.replicas):void 0,removeVolumes:s.removeVolumes===!0,confirmation:typeof s.confirm==="string"?s.confirm:void 0})),requestId:$}}else if(L.method==="GET"&&c.pathname==="/api/v1/preview-definitions"){let P=c.searchParams.get("projectId");if(!P)throw new jE("validation_error","projectId is required.",422);_.authorize(e,"project:read",{type:"project",id:P}),M=mT(r.previews.listDefinitions(P).map((x)=>({...x})),c,$)}else if(L.method==="POST"&&c.pathname==="/api/v1/preview-definitions"){let P=await V();_.authorize(e,"config:write",{type:"resource",id:String(P.resourceId??"")}),M={definition:r.previews.createDefinition({...P,projectId:String(P.projectId??""),resourceId:String(P.resourceId??""),baseEnvironmentId:String(P.baseEnvironmentId??""),domainPattern:String(P.domainPattern??""),createdByActorId:e.actor.id}),requestId:$}}else if(L.method==="POST"&&c.pathname==="/api/v1/previews"){let P=await V(),x=r.previews.getDefinition(String(P.definitionId??""));if(!x)throw new jE("not_found","Preview definition was not found.",404);_.authorize(e,"deployments:create",{type:"resource",id:x.resourceId});let s=r.previews.upsert({definitionId:x.id,sourceProvider:"api",repository:typeof P.repository==="string"?P.repository:"api",branch:String(P.branch??""),pullRequestNumber:Number(P.pullRequestNumber)||void 0,fork:P.fork===!0,commitSha:String(P.commitSha??""),createdByActorId:e.actor.id});M={preview:s.preview,operation:_.operation(r.enqueueDeploy(s.preview,{created:s.created,actorId:e.actor.id})),requestId:$}}else if(L.method==="POST"&&EE){let P=r.previews.getInstance(decodeURIComponent(EE[1]));if(!P)throw new jE("not_found","Preview was not found.",404);let x=await V(),s=EE[2];if(s==="destroy"){if(_.authorize(e,"deployments:cancel",{type:"resource",id:P.resourceId}),x.confirm!==P.name)throw new jE("confirmation_required",`Type ${P.name} to confirm preview teardown.`,409);M={operation:_.operation(r.enqueueDestroy(P,"api",e.actor.id)),requestId:$}}else if(s==="extend")_.authorize(e,"deployments:create",{type:"resource",id:P.resourceId}),M={preview:r.previews.extend(P.id,Number(x.hours)),requestId:$};else _.authorize(e,"deployments:create",{type:"resource",id:P.resourceId}),M={operation:_.operation(r.enqueueDeploy(P,{actorId:e.actor.id,reason:"manual_rebuild"})),requestId:$}}else if(L.method==="POST"&&c.pathname==="/api/v1/previews/cleanup"){_.authorize(e,"automation:manage",{type:"organization"});let P=await V();if(!P.dryRun&&P.confirm!=="cleanup previews")throw new jE("confirmation_required","Type cleanup previews to confirm preview cleanup.",409);M={...r.cleanup({dryRun:P.dryRun===!0,maxAgeHours:Number(P.maxAgeHours)||void 0,keepCount:Number(P.keepCount)||void 0,actorId:e.actor.id}),requestId:$}}else if(L.method==="GET"&&c.pathname==="/api/v1/queue"){let P=c.searchParams.get("projectId")??void 0,x=c.searchParams.get("state"),s=T.list({projectId:P,state:["queued","running","succeeded","failed","cancelled","timed_out"].includes(x)?x:void 0,limit:500}).filter((TE)=>{let OE=TE.operation.resourceId?{type:"resource",id:TE.operation.resourceId}:TE.operation.environmentId?{type:"environment",id:TE.operation.environmentId}:TE.operation.projectId?{type:"project",id:TE.operation.projectId}:{type:"organization"};try{return _.authorize(e,"deployments:read",OE),!0}catch{return!1}}).map((TE)=>({..._.operation(TE.operation),queue:TE.job,approximatePosition:TE.approximatePosition}));M=mT(s,c,$)}else if(L.method==="GET"&&c.pathname==="/api/v1/queue/settings")_.authorize(e,"deployments:read",e.token.scope),M={concurrency:T.limits,requestId:$};else if(L.method==="PATCH"&&c.pathname==="/api/v1/queue/settings"){_.authorize(e,"automation:manage",{type:"organization"});let P=await V();if(P.confirm!=="update queue limits")throw new jE("confirmation_required","Type update queue limits to confirm production concurrency changes.",409);M={concurrency:T.configureConcurrency(P.concurrency??{},{organizationId:e.serviceAccount.organizationId,actorId:e.actor.id}),requestId:$}}else if(L.method==="DELETE"&&c.pathname==="/api/v1/queue/history"){_.authorize(e,"automation:manage",{type:"organization"});let P=await V();if(P.confirm!=="clear completed")throw new jE("confirmation_required","Type clear completed to confirm queue retention cleanup.",409);M={deleted:T.clearCompleted({before:typeof P.before==="string"?P.before:void 0,actorId:e.actor.id,projectId:typeof P.projectId==="string"?P.projectId:void 0}),requestId:$}}else if(L.method==="GET"&&k){let P=E.controlPlane.getOperation(decodeURIComponent(k[1]));if(!P)throw new jE("not_found","Operation was not found.",404);let x=P.resourceId?{type:"resource",id:P.resourceId}:P.environmentId?{type:"environment",id:P.environmentId}:P.projectId?{type:"project",id:P.projectId}:{type:"organization"};_.authorize(e,"deployments:read",x);let s=L.headers.get("last-event-id")?.trim(),TE=Number(s||c.searchParams.get("after")||0);if(k[2]==="stream"){let RE=new TextEncoder,zE=TE,BE,dE=!1,yE=new ReadableStream({start(QE){let NE=()=>{if(dE)return;if(!E.identities.verifyToken(C,O)){if(dE=!0,BE)clearInterval(BE);QE.close();return}let KE=T.logs(P.id,{after:zE,limit:500});for(let sE of KE)zE=sE.sequence,QE.enqueue(RE.encode(`id: ${sE.sequence}
+${JSON.stringify(T)}`).digest("hex")}class DD{controlPlane;identities;queue;constructor(E,_){this.controlPlane=E;this.identities=_;this.queue=new lE(E)}target(E,_){let T=this.controlPlane.resolveAuthorizationTarget(E.serviceAccount.organizationId,_),r=this.controlPlane.resolveAuthorizationTarget(E.serviceAccount.organizationId,E.token.scope);if(!T||!r||!_z(r,T))throw new jE("forbidden","The token does not grant access to this resource.",403);return T}authorize(E,_,T){if(!E.token.capabilities.includes(_))throw new jE("forbidden",`The token is missing the ${_} capability.`,403);let r=this.controlPlane.resolveAuthorizationTarget(E.serviceAccount.organizationId,T),d=this.controlPlane.resolveAuthorizationTarget(E.serviceAccount.organizationId,E.token.scope),t=_==="project:read"&&!!r&&!!d&&_z(r,d);if(!r||!d||!_z(d,r)&&!t)throw new jE("forbidden","The token does not grant access to this resource.",403);let R=t?d:r;if(!Or({membership:E.membership,grants:this.controlPlane.listGrants(E.membership.id),capability:_,target:R}).allowed)throw new jE("forbidden","The service account does not have access to this resource.",403);return r}listProjects(E){return this.controlPlane.listProjects().filter((_)=>_.organizationId===E.serviceAccount.organizationId).filter((_)=>{try{return this.authorize(E,"project:read",{type:"project",id:_.id}),!0}catch{return!1}}).map((_)=>({id:_.id,slug:_.slug,name:_.name,description:_.description,version:_.version,createdAt:_.createdAt,updatedAt:_.updatedAt}))}listEnvironments(E,_){let T=this.controlPlane.getProject(_);if(!T||T.organizationId!==E.serviceAccount.organizationId)throw new jE("not_found","Project was not found.",404);return this.controlPlane.listEnvironments(_).filter((r)=>{try{return this.authorize(E,"project:read",{type:"environment",id:r.id}),!0}catch{return!1}}).map((r)=>({id:r.id,projectId:r.projectId,slug:r.slug,name:r.name,kind:r.kind,region:r.region,version:r.version,createdAt:r.createdAt,updatedAt:r.updatedAt}))}listServices(E,_,T){let r=new Set(this.listEnvironments(E,_).map((d)=>String(d.id)));if(T&&!r.has(T))throw new jE("not_found","Environment was not found.",404);return this.controlPlane.listResources(_,T).filter((d)=>!d.environmentId||r.has(d.environmentId)).filter((d)=>{try{return this.authorize(E,"project:read",{type:"resource",id:d.id}),!0}catch{return!1}}).map((d)=>({id:d.id,projectId:d.projectId,environmentId:d.environmentId,kind:d.kind,slug:d.slug,name:d.name,provider:d.provider,providerId:d.providerId,metadata:bE(d.metadata),version:d.version,createdAt:d.createdAt,updatedAt:d.updatedAt}))}listOperations(E,_){return this.controlPlane.listOperations({projectId:_,limit:500}).filter((r)=>{let d=r.resourceId?{type:"resource",id:r.resourceId}:r.environmentId?{type:"environment",id:r.environmentId}:r.projectId?{type:"project",id:r.projectId}:{type:"organization"};try{return this.authorize(E,"deployments:read",d),!0}catch{return!1}}).map((r)=>this.operation(r))}listEvents(E,_,T){if(_)this.authorize(E,"audit:read",{type:"project",id:_});else this.authorize(E,"audit:read",E.token.scope);return this.controlPlane.listEvents({organizationId:E.serviceAccount.organizationId,projectId:_,afterSequence:T,limit:500}).filter((r)=>{let d=r.resourceId?{type:"resource",id:r.resourceId}:r.projectId?{type:"project",id:r.projectId}:{type:"organization"};try{return this.target(E,d),!0}catch{return!1}}).map((r)=>({id:r.id,sequence:r.sequence,projectId:r.projectId,operationId:r.operationId,resourceId:r.resourceId,correlationId:r.correlationId,type:r.type,level:r.level,payload:bE(r.payload),createdAt:r.createdAt}))}createDeployment(E,_,T){if(!this.controlPlane.listEnvironments(_.projectId).find((S)=>S.id===_.environmentId))throw new jE("not_found","Environment was not found in this project.",404);let d=_.serviceId?{type:"resource",id:_.serviceId}:{type:"environment",id:_.environmentId};this.authorize(E,"deployments:create",d);let t=p9("POST","/api/v1/deployments",_),R=this.identities.getIdempotency(E.token.id,T);if(R){if(R.requestHash!==t)throw new jE("idempotency_conflict","Idempotency-Key was already used for another request.",409);let S=R.operationId?this.controlPlane.getOperation(R.operationId):void 0;if(!S)throw new jE("idempotency_unavailable","The original operation is no longer available.",409);return{operation:this.operation(S),replay:!0}}if(_.serviceId){let S=this.controlPlane.getResource(_.serviceId);if(!S||S.projectId!==_.projectId||S.environmentId!==_.environmentId)throw new jE("not_found","Service was not found in this environment.",404)}let h=_.serviceId?this.controlPlane.getResource(_.serviceId):void 0,N=this.queue.enqueue({projectId:_.projectId,environmentId:_.environmentId,resourceId:_.serviceId,actorId:E.actor.id,kind:_.action==="rollback"?"deployment.rollback":"deployment.create",idempotencyKey:`api:${E.token.id}:${T}`,input:bE({action:_.action??"deploy",revision:_.revision??null}),lockKey:_.serviceId?`resource:${_.serviceId}`:`environment:${_.environmentId}`,providerKey:h?.provider??"default",buildSlot:_.action!=="rollback",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.identities.saveIdempotency({tokenId:E.token.id,key:T,requestHash:t,operationId:N.id,responseStatus:202,responseBody:{operationId:N.id}}),{operation:this.operation(N),replay:!1}}operation(E){return{id:E.id,state:E.state,kind:E.kind,projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,actorId:E.actorId,correlationId:E.correlationId,input:bE(E.input),output:bE(E.output),error:E.error,attempt:E.attempt,createdAt:E.createdAt,updatedAt:E.updatedAt,startedAt:E.startedAt,finishedAt:E.finishedAt}}}function Ha(E){return Buffer.from(JSON.stringify(E)).toString("base64url")}function Pa(E){if(!E)return;try{let _=JSON.parse(Buffer.from(E,"base64url").toString("utf8"));return _&&typeof _==="object"&&!Array.isArray(_)?_:void 0}catch{return}}function mT(E,_,T,r=["createdAt","id"]){let d=Math.min(100,Math.max(1,Number(_.searchParams.get("limit"))||50)),t=Pa(_.searchParams.get("cursor"));if(_.searchParams.has("cursor")&&!t)throw new jE("invalid_cursor","The pagination cursor is invalid.",400);let R=0;if(t){let A=E.findIndex((L)=>r.every((O)=>L[O]===t[O]));if(A<0)throw new jE("invalid_cursor","The pagination cursor is no longer available.",400);R=A+1}let h=E.slice(R,R+d),N=R+d<E.length,S=h.at(-1);return{data:h,page:{hasMore:N,nextCursor:N&&S?Ha(Object.fromEntries(r.map((A)=>[A,S[A]]))):void 0},requestId:T}}function Tz(E){let _=new DD(E.controlPlane,E.identities),T=new lE(E.controlPlane),r=new Bt(E.controlPlane),d=new jt(E.controlPlane),t=new rR(E.controlPlane),R=new Map,h=E.now??(()=>new Date),N=E.rateLimit??120,S=(L,O,c,$={})=>new Response(JSON.stringify(L),{status:O,headers:{"content-type":"application/json; charset=utf-8","cache-control":"no-store","x-request-id":c,"x-api-version":oJ,...$}}),A=(L,O,c,$,I,C)=>S({error:{code:L,message:O,requestId:$,details:I}},c,$,C);return async(L,O)=>{let c=new URL(L.url);if(!c.pathname.startsWith("/api/v1"))return;let $=crypto.randomUUID();if(c.pathname==="/api/v1/openapi.json"&&L.method==="GET")return S(Ez(),200,$,{"cache-control":"public, max-age=300"});let I=L.headers.get("authorization")??"",C=I.startsWith("Bearer ")?I.slice(7).trim():"",e=C?E.identities.verifyToken(C,O):void 0;if(!e)return A("unauthorized","A valid bearer token is required.",401,$,void 0,{"www-authenticate":'Bearer realm="ts-cloud", error="invalid_token"'});let z=R.get(e.token.id),F=h().getTime(),B=!z||F-z.start>=60000?{start:F,count:0}:z;B.count+=1,R.set(e.token.id,B);let y=Math.max(0,N-B.count),Y={"x-ratelimit-limit":String(N),"x-ratelimit-remaining":String(y),"x-ratelimit-reset":String(Math.ceil((B.start+60000)/1000))};if(B.count>N)return A("rate_limited","API rate limit exceeded.",429,$,void 0,{...Y,"retry-after":String(Math.max(1,Math.ceil((B.start+60000-F)/1000)))});try{let M,V=async()=>{let P=await L.text();if(P.length>1048576)throw new jE("payload_too_large","Request body exceeds 1 MB.",413);try{return JSON.parse(P)}catch{throw new jE("invalid_json","Request body must be valid JSON.",400)}},g=/^\/api\/v1\/projects\/([^/]+)\/environments$/.exec(c.pathname),k=/^\/api\/v1\/operations\/([^/]+)\/logs(?:\/(stream))?$/.exec(c.pathname),v=/^\/api\/v1\/operations\/([^/]+)\/(cancel|retry)$/.exec(c.pathname),EE=/^\/api\/v1\/previews\/([^/]+)\/(destroy|extend|rebuild)$/.exec(c.pathname),m=/^\/api\/v1\/compose-applications\/([^/]+)\/(deploy|redeploy|start|stop|scale|delete)$/.exec(c.pathname),rE=/^\/api\/v1\/compose-applications\/([^/]+)\/services$/.exec(c.pathname),LE=/^\/api\/v1\/releases\/([^/]+)\/(promote|approve|activate|rollback|health|pin)$/.exec(c.pathname);if(L.method==="GET"&&c.pathname==="/api/v1/projects")M=mT(_.listProjects(e),c,$);else if(L.method==="GET"&&g)M=mT(_.listEnvironments(e,decodeURIComponent(g[1])),c,$);else if(L.method==="GET"&&c.pathname==="/api/v1/services"){let P=c.searchParams.get("projectId");if(!P)throw new jE("validation_error","projectId is required.",422);M=mT(_.listServices(e,P,c.searchParams.get("environmentId")??void 0),c,$)}else if(L.method==="GET"&&c.pathname==="/api/v1/operations")M=mT(_.listOperations(e,c.searchParams.get("projectId")??void 0),c,$);else if(L.method==="GET"&&c.pathname==="/api/v1/previews"){let P=c.searchParams.get("projectId")??void 0,x=r.previews.listInstances({projectId:P}).filter((s)=>{try{return _.authorize(e,"deployments:read",{type:"resource",id:s.resourceId}),!0}catch{return!1}}).map((s)=>({...s}));M=mT(x,c,$)}else if(L.method==="GET"&&c.pathname==="/api/v1/compose-templates")M=mT(RS().map((P)=>({...P})),c,$,["id","version"]);else if(L.method==="GET"&&c.pathname==="/api/v1/releases/capabilities"){let P=String(c.searchParams.get("kind")??"");M={capabilities:CN({kind:P,hasHealthGate:c.searchParams.get("health")==="true",replicas:Number(c.searchParams.get("replicas"))||1}),requestId:$}}else if(L.method==="GET"&&c.pathname==="/api/v1/releases"){let P=c.searchParams.get("projectId");if(!P)throw new jE("validation_error","projectId is required.",422);_.authorize(e,"project:read",{type:"project",id:P});let x=t.releases.list({projectId:P,environmentId:c.searchParams.get("environmentId")??void 0,resourceId:c.searchParams.get("resourceId")??void 0}).filter((s)=>{try{return _.authorize(e,"deployments:read",{type:"resource",id:s.resourceId}),!0}catch{return!1}}).map((s)=>({...s,artifact:t.releases.getArtifact(s.artifactId),transitions:t.releases.transitions(s.id),approvals:t.releases.approvals(s.id)}));M=mT(x,c,$)}else if(L.method==="POST"&&c.pathname==="/api/v1/release-artifacts"){let P=await V();_.authorize(e,"applications:manage",{type:"organization"}),M={artifact:t.releases.registerArtifact({organizationId:e.serviceAccount.organizationId,digest:String(P.digest??""),kind:String(P.kind??""),uri:String(P.uri??""),size:Number(P.size),mediaType:typeof P.mediaType==="string"?P.mediaType:void 0,provenance:P.provenance,attestation:P.attestation}),requestId:$}}else if(L.method==="POST"&&c.pathname==="/api/v1/releases"){let P=await V(),x=String(P.resourceId??"");_.authorize(e,"applications:manage",{type:"resource",id:x}),M={release:t.releases.create({organizationId:e.serviceAccount.organizationId,projectId:String(P.projectId??""),environmentId:String(P.environmentId??""),resourceId:x,artifactId:String(P.artifactId??""),kind:String(P.kind??""),sourceSha:typeof P.sourceSha==="string"?P.sourceSha:void 0,config:P.config??{},manifest:P.manifest??{},provenance:P.provenance,strategy:String(P.strategy??"atomic"),healthGate:P.healthGate,hooks:P.hooks,drainSeconds:Number(P.drainSeconds)||void 0,graceSeconds:Number(P.graceSeconds)||void 0,automaticRollback:P.automaticRollback!==!1,actorId:e.actor.id,trigger:typeof P.trigger==="string"?P.trigger:"api",approvalRequired:P.approvalRequired===!0,replicas:Number(P.replicas)||void 0}),requestId:$}}else if(L.method==="GET"&&/^\/api\/v1\/releases\/[^/]+$/.test(c.pathname)){let P=decodeURIComponent(c.pathname.split("/").at(-1)),x=t.releases.get(P);if(!x)throw new jE("not_found","Release was not found.",404);_.authorize(e,"deployments:read",{type:"resource",id:x.resourceId}),M={release:x,artifact:t.releases.getArtifact(x.artifactId),transitions:t.releases.transitions(P),approvals:t.releases.approvals(P),requestId:$}}else if(L.method==="POST"&&LE){let P=t.releases.get(decodeURIComponent(LE[1]));if(!P)throw new jE("not_found","Release was not found.",404);let x=await V(),s=LE[2];if(s==="promote"){let TE=String(x.targetResourceId??"");_.authorize(e,"deployments:create",{type:"resource",id:TE}),M={release:t.releases.promote(P.id,{targetEnvironmentId:String(x.targetEnvironmentId??""),targetResourceId:TE,config:x.config??{},strategy:x.strategy,healthGate:x.healthGate,actorId:e.actor.id,approvalRequired:x.approvalRequired===!0}),requestId:$}}else if(s==="approve")_.authorize(e,"deployments:create",{type:"resource",id:P.resourceId}),M={release:t.releases.approve(P.id,{actorId:e.actor.id,decision:x.decision==="rejected"?"rejected":"approved",comment:typeof x.comment==="string"?x.comment:void 0}),requestId:$};else if(s==="activate")_.authorize(e,"deployments:create",{type:"resource",id:P.resourceId}),M={operation:_.operation(t.enqueueActivation(P,{actorId:e.actor.id})),requestId:$};else if(s==="rollback")_.authorize(e,"deployments:create",{type:"resource",id:P.resourceId}),M={operation:_.operation(t.enqueueRollback(P,{actorId:e.actor.id,targetReleaseId:typeof x.targetReleaseId==="string"?x.targetReleaseId:void 0})),requestId:$};else if(s==="health"){_.authorize(e,"deployments:create",{type:"resource",id:P.resourceId});let TE=t.completeHealthGate(P.id,{healthy:x.healthy===!0,operationId:typeof x.operationId==="string"?x.operationId:void 0,health:x.health,message:typeof x.message==="string"?x.message:void 0});M={release:TE.release,rollbackOperation:TE.rollbackOperation?_.operation(TE.rollbackOperation):void 0,requestId:$}}else _.authorize(e,"deployments:create",{type:"resource",id:P.resourceId}),M={release:t.releases.pin(P.id,x.pinned!==!1,typeof x.reason==="string"?x.reason:void 0),requestId:$}}else if(L.method==="GET"&&c.pathname==="/api/v1/compose-applications"){let P=c.searchParams.get("projectId");if(!P)throw new jE("validation_error","projectId is required.",422);_.authorize(e,"project:read",{type:"project",id:P});let x=d.applications.list({projectId:P,environmentId:c.searchParams.get("environmentId")??void 0}).filter((s)=>{try{return _.authorize(e,"deployments:read",{type:"resource",id:s.resourceId}),!0}catch{return!1}}).map((s)=>({...s,services:d.applications.services(s.id)}));M=mT(x,c,$)}else if(L.method==="POST"&&c.pathname==="/api/v1/compose-applications/preview"){let P=await V(),x=String(P.projectId??"");_.authorize(e,"project:read",{type:"project",id:x}),M={result:d.applications.preview(String(P.source??""),{name:String(P.name??""),slug:typeof P.slug==="string"?P.slug:void 0,projectId:x,environmentId:String(P.environmentId??"")}),requestId:$}}else if(L.method==="POST"&&c.pathname==="/api/v1/compose-applications"){let P=await V(),x=String(P.projectId??"");_.authorize(e,"applications:manage",{type:"environment",id:String(P.environmentId??"")});let s={name:String(P.name??""),slug:typeof P.slug==="string"?P.slug:void 0,projectId:x,environmentId:String(P.environmentId??""),createdByActorId:e.actor.id},TE=typeof P.templateId==="string"?d.applications.fromTemplate(P.templateId,P.inputs&&typeof P.inputs==="object"&&!Array.isArray(P.inputs)?P.inputs:{},{...s,version:typeof P.templateVersion==="string"?P.templateVersion:void 0}):d.applications.import(String(P.source??""),s);M={application:TE.application,diagnostics:TE.parsed.diagnostics,requestId:$}}else if(L.method==="GET"&&rE){let P=d.applications.get(decodeURIComponent(rE[1]));if(!P)throw new jE("not_found","Compose application was not found.",404);_.authorize(e,"deployments:read",{type:"resource",id:P.resourceId}),M={application:P,services:d.applications.services(P.id),requestId:$}}else if(L.method==="POST"&&m){let P=d.applications.get(decodeURIComponent(m[1]));if(!P)throw new jE("not_found","Compose application was not found.",404);let x=m[2],s=await V();_.authorize(e,x==="delete"||x==="stop"?"deployments:cancel":"deployments:create",{type:"resource",id:P.resourceId}),M={operation:_.operation(d.enqueue(P,x,{actorId:e.actor.id,service:typeof s.service==="string"?s.service:void 0,replicas:Number.isFinite(Number(s.replicas))?Number(s.replicas):void 0,removeVolumes:s.removeVolumes===!0,confirmation:typeof s.confirm==="string"?s.confirm:void 0})),requestId:$}}else if(L.method==="GET"&&c.pathname==="/api/v1/preview-definitions"){let P=c.searchParams.get("projectId");if(!P)throw new jE("validation_error","projectId is required.",422);_.authorize(e,"project:read",{type:"project",id:P}),M=mT(r.previews.listDefinitions(P).map((x)=>({...x})),c,$)}else if(L.method==="POST"&&c.pathname==="/api/v1/preview-definitions"){let P=await V();_.authorize(e,"config:write",{type:"resource",id:String(P.resourceId??"")}),M={definition:r.previews.createDefinition({...P,projectId:String(P.projectId??""),resourceId:String(P.resourceId??""),baseEnvironmentId:String(P.baseEnvironmentId??""),domainPattern:String(P.domainPattern??""),createdByActorId:e.actor.id}),requestId:$}}else if(L.method==="POST"&&c.pathname==="/api/v1/previews"){let P=await V(),x=r.previews.getDefinition(String(P.definitionId??""));if(!x)throw new jE("not_found","Preview definition was not found.",404);_.authorize(e,"deployments:create",{type:"resource",id:x.resourceId});let s=r.previews.upsert({definitionId:x.id,sourceProvider:"api",repository:typeof P.repository==="string"?P.repository:"api",branch:String(P.branch??""),pullRequestNumber:Number(P.pullRequestNumber)||void 0,fork:P.fork===!0,commitSha:String(P.commitSha??""),createdByActorId:e.actor.id});M={preview:s.preview,operation:_.operation(r.enqueueDeploy(s.preview,{created:s.created,actorId:e.actor.id})),requestId:$}}else if(L.method==="POST"&&EE){let P=r.previews.getInstance(decodeURIComponent(EE[1]));if(!P)throw new jE("not_found","Preview was not found.",404);let x=await V(),s=EE[2];if(s==="destroy"){if(_.authorize(e,"deployments:cancel",{type:"resource",id:P.resourceId}),x.confirm!==P.name)throw new jE("confirmation_required",`Type ${P.name} to confirm preview teardown.`,409);M={operation:_.operation(r.enqueueDestroy(P,"api",e.actor.id)),requestId:$}}else if(s==="extend")_.authorize(e,"deployments:create",{type:"resource",id:P.resourceId}),M={preview:r.previews.extend(P.id,Number(x.hours)),requestId:$};else _.authorize(e,"deployments:create",{type:"resource",id:P.resourceId}),M={operation:_.operation(r.enqueueDeploy(P,{actorId:e.actor.id,reason:"manual_rebuild"})),requestId:$}}else if(L.method==="POST"&&c.pathname==="/api/v1/previews/cleanup"){_.authorize(e,"automation:manage",{type:"organization"});let P=await V();if(!P.dryRun&&P.confirm!=="cleanup previews")throw new jE("confirmation_required","Type cleanup previews to confirm preview cleanup.",409);M={...r.cleanup({dryRun:P.dryRun===!0,maxAgeHours:Number(P.maxAgeHours)||void 0,keepCount:Number(P.keepCount)||void 0,actorId:e.actor.id}),requestId:$}}else if(L.method==="GET"&&c.pathname==="/api/v1/queue"){let P=c.searchParams.get("projectId")??void 0,x=c.searchParams.get("state"),s=T.list({projectId:P,state:["queued","running","succeeded","failed","cancelled","timed_out"].includes(x)?x:void 0,limit:500}).filter((TE)=>{let OE=TE.operation.resourceId?{type:"resource",id:TE.operation.resourceId}:TE.operation.environmentId?{type:"environment",id:TE.operation.environmentId}:TE.operation.projectId?{type:"project",id:TE.operation.projectId}:{type:"organization"};try{return _.authorize(e,"deployments:read",OE),!0}catch{return!1}}).map((TE)=>({..._.operation(TE.operation),queue:TE.job,approximatePosition:TE.approximatePosition}));M=mT(s,c,$)}else if(L.method==="GET"&&c.pathname==="/api/v1/queue/settings")_.authorize(e,"deployments:read",e.token.scope),M={concurrency:T.limits,requestId:$};else if(L.method==="PATCH"&&c.pathname==="/api/v1/queue/settings"){_.authorize(e,"automation:manage",{type:"organization"});let P=await V();if(P.confirm!=="update queue limits")throw new jE("confirmation_required","Type update queue limits to confirm production concurrency changes.",409);M={concurrency:T.configureConcurrency(P.concurrency??{},{organizationId:e.serviceAccount.organizationId,actorId:e.actor.id}),requestId:$}}else if(L.method==="DELETE"&&c.pathname==="/api/v1/queue/history"){_.authorize(e,"automation:manage",{type:"organization"});let P=await V();if(P.confirm!=="clear completed")throw new jE("confirmation_required","Type clear completed to confirm queue retention cleanup.",409);M={deleted:T.clearCompleted({before:typeof P.before==="string"?P.before:void 0,actorId:e.actor.id,projectId:typeof P.projectId==="string"?P.projectId:void 0}),requestId:$}}else if(L.method==="GET"&&k){let P=E.controlPlane.getOperation(decodeURIComponent(k[1]));if(!P)throw new jE("not_found","Operation was not found.",404);let x=P.resourceId?{type:"resource",id:P.resourceId}:P.environmentId?{type:"environment",id:P.environmentId}:P.projectId?{type:"project",id:P.projectId}:{type:"organization"};_.authorize(e,"deployments:read",x);let s=L.headers.get("last-event-id")?.trim(),TE=Number(s||c.searchParams.get("after")||0);if(k[2]==="stream"){let RE=new TextEncoder,zE=TE,BE,dE=!1,yE=new ReadableStream({start(QE){let NE=()=>{if(dE)return;if(!E.identities.verifyToken(C,O)){if(dE=!0,BE)clearInterval(BE);QE.close();return}let KE=T.logs(P.id,{after:zE,limit:500});for(let sE of KE)zE=sE.sequence,QE.enqueue(RE.encode(`id: ${sE.sequence}
 event: log
 data: ${JSON.stringify(sE)}
 
@@ -9925,12 +9925,12 @@ data: ${JSON.stringify(dE)}
 
 `));TE=setInterval(()=>{if(OE)return;let dE=E.identities.verifyToken(C,O);if(!dE){if(OE=!0,TE)clearInterval(TE);zE.close();return}try{let yE=_.listEvents(dE,c.searchParams.get("projectId")??void 0,s);for(let QE of yE)BE(QE),s=Math.max(s,Number(QE.sequence));if(!yE.length)zE.enqueue(x.encode(`: heartbeat ${Date.now()}
 
-`))}catch{if(OE=!0,TE)clearInterval(TE);zE.close()}},1000),L.signal.addEventListener("abort",()=>{if(OE=!0,TE)clearInterval(TE);try{zE.close()}catch{}},{once:!0})},cancel(){if(OE=!0,TE)clearInterval(TE)}});return new Response(RE,{status:200,headers:{"content-type":"text/event-stream","cache-control":"no-store",connection:"keep-alive","x-accel-buffering":"no","x-request-id":$,...Y}})}M=mT(P,c,$,["sequence","id"])}else if(L.method==="POST"&&c.pathname==="/api/v1/deployments"){let P=L.headers.get("idempotency-key")??"";if(!P)throw new jE("idempotency_required","Idempotency-Key is required for deployment requests.",428);let x=await L.text();if(x.length>1048576)throw new jE("payload_too_large","Request body exceeds 1 MB.",413);let s;try{s=JSON.parse(x)}catch{throw new jE("invalid_json","Request body must be valid JSON.",400)}if(!s||typeof s.projectId!=="string"||typeof s.environmentId!=="string"||s.action!==void 0&&!["deploy","rollback"].includes(s.action))throw new jE("validation_error","projectId, environmentId, and a valid action are required.",422);let TE=_.createDeployment(e,s,P);return S({operation:TE.operation,idempotentReplay:TE.replay,requestId:$},202,$,{...Y,...TE.replay?{"idempotent-replayed":"true"}:{}})}else throw new jE("not_found","API resource was not found.",404);return S(M,200,$,Y)}catch(M){if(M instanceof jE)return A(M.code,M.message,M.status,$,M.details,Y);if(c.pathname.startsWith("/api/v1/source/")||c.pathname.startsWith("/api/v1/application")||c.pathname.startsWith("/api/v1/compose-")||c.pathname==="/api/v1/registry-connections")return A("validation_error",M instanceof Error?M.message:"Integration request could not be completed.",422,$,void 0,Y);return A("internal_error","The API request could not be completed.",500,$,void 0,Y)}}}await tT();import{createHash as ya,randomBytes as Ya}from"node:crypto";var E9=new Set(Lr),_9=7776000000,T9=31536000000,r9=86400000;function dR(E){return typeof E==="string"?E:void 0}function oQ(E){return ya("sha256").update(E).digest("hex")}function Qa(E){try{let _=JSON.parse(String(E));return Array.isArray(_)?_.filter((T)=>typeof T==="string"&&E9.has(T)):[]}catch{return[]}}function Ga(E){let _=String(E.scope_type);return _==="organization"?{type:_}:{type:_,id:String(E.scope_id)}}function rz(E){let _=dR(E.disabled_at);return{id:String(E.id),organizationId:String(E.organization_id),actorId:String(E.actor_id),slug:String(E.slug),name:String(E.name),description:dR(E.description),createdByActorId:dR(E.created_by_actor_id),disabledAt:_,createdAt:String(E.created_at),updatedAt:String(E.updated_at),state:_?"disabled":"active"}}function dz(E,_){let T=dR(E.revoked_at),r=String(E.expires_at);return{id:String(E.id),serviceAccountId:String(E.service_account_id),name:String(E.name),prefix:String(E.token_prefix),capabilities:Qa(E.capabilities),scope:Ga(E),expiresAt:r,lastUsedAt:dR(E.last_used_at),lastNetworkHint:dR(E.last_network_hint),revokedAt:T,rotatedFromTokenId:dR(E.rotated_from_token_id),createdByActorId:dR(E.created_by_actor_id),createdAt:String(E.created_at),updatedAt:String(E.updated_at),state:T?"revoked":r<=_?"expired":"active"}}function Ma(E){let _={};try{_=JSON.parse(String(E.response_body))}catch{}return{id:String(E.id),tokenId:String(E.token_id),key:String(E.idempotency_key),requestHash:String(E.request_hash),operationId:dR(E.operation_id),responseStatus:Number(E.response_status),responseBody:_,expiresAt:String(E.expires_at),createdAt:String(E.created_at)}}class ht{controlPlane;nowFn;idFn;constructor(E,_={}){this.controlPlane=E;this.nowFn=_.now??(()=>new Date),this.idFn=_.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(E,_){this.controlPlane.database.run(E,_)}createServiceAccount(E){if(!this.controlPlane.getOrganization(E.organizationId))throw Error("Service-account organization was not found");let _=E.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(_))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let T=E.name.trim().slice(0,100);if(!T)throw Error("Service-account name is required");let r=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${E.organizationId}:${_}`,displayName:T,metadata:{source:"api",serviceAccountSlug:_}}),d=this.idFn(),t=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[d,E.organizationId,r.id,_,T,E.description?.trim().slice(0,500)||null,E.createdByActorId??null,t,t]);let R=this.controlPlane.createMembership({organizationId:E.organizationId,actorId:r.id,roleTemplate:E.roleTemplate,scope:E.scope,source:"manual",performedByActorId:E.createdByActorId}),h=E.scope??{type:"organization"};return this.controlPlane.appendEvent({organizationId:E.organizationId,actorId:E.createdByActorId,type:"api.service_account.created",payload:{serviceAccountId:d,roleTemplate:E.roleTemplate,scope:{type:h.type,id:h.id??null}}}),{serviceAccount:this.getServiceAccount(d),membership:R}}getServiceAccount(E){let _=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE id = ?").get(E);return _?rz(_):void 0}getServiceAccountBySlug(E,_){let T=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? AND slug = ? COLLATE NOCASE").get(E,_.trim());return T?rz(T):void 0}listServiceAccounts(E,_={}){return this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(E).map(rz).filter((T)=>_.includeDisabled||T.state==="active")}disableServiceAccount(E,_){let T=this.getServiceAccount(E);if(!T)throw Error("Service account was not found");let r=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE service_accounts SET disabled_at = ?, updated_at = ? WHERE id = ?",[r,r,E]),this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE service_account_id = ? AND revoked_at IS NULL",[r,r,E]);let d=this.controlPlane.getMembershipForActor(T.organizationId,T.actorId);if(d?.status==="active")this.controlPlane.revokeMembership(d.id)}),this.controlPlane.appendEvent({organizationId:T.organizationId,actorId:_,type:"api.service_account.disabled",payload:{serviceAccountId:E}}),this.getServiceAccount(E)}createToken(E){let _=this.getServiceAccount(E.serviceAccountId);if(!_||_.state!=="active")throw Error("Service account is unavailable");let T=this.controlPlane.getMembershipForActor(_.organizationId,_.actorId);if(!T||T.status!=="active")throw Error("Service-account membership is unavailable");let r=[...new Set(E.capabilities)];if(r.length===0||r.some((O)=>!E9.has(O)))throw Error("API token requires valid explicit capabilities");let d=E.scope??T.scope,t=this.controlPlane.resolveAuthorizationTarget(_.organizationId,d);if(!t)throw Error("API token scope was not found in this organization");for(let O of r)if(!Or({membership:T,grants:this.controlPlane.listGrants(T.id),capability:O,target:t}).allowed)throw Error(`Service-account membership does not grant ${O} at the token scope`);let R=E.expiresAt?new Date(E.expiresAt):new Date(this.nowFn().getTime()+_9);if(!Number.isFinite(R.getTime())||R.getTime()<=this.nowFn().getTime()+60000||R.getTime()>this.nowFn().getTime()+T9)throw Error("API token expiry must be between one minute and one year from now");let h=this.idFn(),N=Ya(32).toString("base64url"),S=`tsc_v1.${h}.${N}`,A=`tsc_v1.${h.slice(0,8)}`,L=this.now();return this.run(`INSERT INTO api_tokens (id, service_account_id, name, token_hash, token_prefix, capabilities, scope_type, scope_id,
-      expires_at, rotated_from_token_id, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[h,_.id,E.name.trim().slice(0,100)||"API token",oQ(S),A,JSON.stringify(r.sort()),d.type,d.type==="organization"?null:d.id??null,R.toISOString(),E.rotatedFromTokenId??null,E.createdByActorId??null,L,L]),this.controlPlane.appendEvent({organizationId:_.organizationId,actorId:E.createdByActorId,type:"api.token.created",payload:{serviceAccountId:_.id,tokenId:h,prefix:A,capabilities:r,scope:{type:d.type,id:d.id??null},expiresAt:R.toISOString(),rotatedFromTokenId:E.rotatedFromTokenId??null}}),{token:this.getToken(h),secret:S}}getToken(E){let _=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ?").get(E);return _?dz(_,this.now()):void 0}listTokens(E,_={}){return this.controlPlane.database.query("SELECT * FROM api_tokens WHERE service_account_id = ? ORDER BY created_at DESC").all(E).map((T)=>dz(T,this.now())).filter((T)=>_.includeInactive||T.state==="active")}verifyToken(E,_){let T=/^tsc_v1\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(E);if(!T)return;let r=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ? AND token_hash = ?").get(T[1],oQ(E));if(!r)return;let d=dz(r,this.now()),t=this.getServiceAccount(d.serviceAccountId);if(!t||t.state!=="active"||d.state!=="active")return;let R=this.controlPlane.getActor(t.actorId),h=this.controlPlane.getMembershipForActor(t.organizationId,t.actorId);if(!R||R.disabledAt||!h||h.status!=="active")return;let N=this.now(),S=!d.lastUsedAt||this.nowFn().getTime()-new Date(d.lastUsedAt).getTime()>=3600000;if(this.run("UPDATE api_tokens SET last_used_at = ?, last_network_hint = ?, updated_at = ? WHERE id = ?",[N,_?.slice(0,128)??null,N,d.id]),S)this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:R.id,type:"api.token.used",payload:{serviceAccountId:t.id,tokenId:d.id,prefix:d.prefix}});return{serviceAccount:t,token:this.getToken(d.id),actor:R,membership:h}}rotateToken(E,_){let T=this.getToken(E);if(!T||T.state!=="active")throw Error("Active API token was not found");let r=this.createToken({serviceAccountId:T.serviceAccountId,name:`${T.name} (rotated)`,capabilities:T.capabilities,scope:T.scope,expiresAt:T.expiresAt,createdByActorId:_,rotatedFromTokenId:T.id}),d=this.getServiceAccount(T.serviceAccountId);return this.controlPlane.appendEvent({organizationId:d?.organizationId,actorId:_,type:"api.token.rotated",payload:{serviceAccountId:T.serviceAccountId,previousTokenId:T.id,tokenId:r.token.id}}),r}revokeToken(E,_){let T=this.getToken(E);if(!T)throw Error("API token was not found");if(T.state==="active"){let r=this.now();this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?",[r,r,E]);let d=this.getServiceAccount(T.serviceAccountId);this.controlPlane.appendEvent({organizationId:d?.organizationId,actorId:_,type:"api.token.revoked",payload:{serviceAccountId:T.serviceAccountId,tokenId:E}})}return this.getToken(E)}getIdempotency(E,_){let T=this.controlPlane.database.query("SELECT * FROM api_idempotency_records WHERE token_id = ? AND idempotency_key = ? AND expires_at > ?").get(E,_,this.now());return T?Ma(T):void 0}saveIdempotency(E){if(!/^[A-Za-z0-9._:-]{8,128}$/.test(E.key))throw Error("Idempotency-Key must contain 8-128 safe characters");let _=this.getIdempotency(E.tokenId,E.key);if(_){if(_.requestHash!==E.requestHash)throw Error("Idempotency-Key was already used for a different request");return _}let T=this.idFn(),r=this.now(),d=new Date(this.nowFn().getTime()+r9).toISOString();return this.run(`INSERT INTO api_idempotency_records (id, token_id, idempotency_key, request_hash, operation_id, response_status, response_body, expires_at, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,E.tokenId,E.key,E.requestHash,E.operationId??null,E.responseStatus,JSON.stringify(E.responseBody),d,r]),this.getIdempotency(E.tokenId,E.key)}purgeExpired(){let E=this.now(),_=this.controlPlane.database.run("DELETE FROM api_tokens WHERE (expires_at < ? OR revoked_at IS NOT NULL) AND created_at < ?",[E,new Date(this.nowFn().getTime()-2592000000).toISOString()]).changes,T=this.controlPlane.database.run("DELETE FROM api_idempotency_records WHERE expires_at < ?",[E]).changes;return{tokens:_,idempotency:T}}}await tT();await aE();import{createHash as Fp}from"node:crypto";import{existsSync as cR,mkdtempSync as dF,readdirSync as LG,rmSync as GN,statSync as eG}from"node:fs";import{readFile as Ot,writeFile as YN}from"node:fs/promises";import{tmpdir as sD}from"node:os";import{dirname as jp,extname as qO,join as w_,normalize as Bp,relative as Wp,resolve as Hp,sep as Pp}from"node:path";import{fileURLToPath as yp}from"node:url";import{createCipheriv as fa,createDecipheriv as Ka,createHash as A9,randomBytes as Va}from"node:crypto";var Zr=(E)=>{if(typeof E!=="string")return{};try{return JSON.parse(E)}catch{return{}}},Y_=(E)=>typeof E==="string"?E:void 0,hz=(E)=>Number(E)===1,Nt=(E,_,T,r)=>{let d=Number(E);return Number.isFinite(d)?Math.min(r,Math.max(T,Math.floor(d))):_},d9=(E)=>A9("sha256").update(E).digest("hex").slice(0,16);function t9(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Y_(E.environment_id),resourceId:Y_(E.resource_id),name:String(E.name),kind:String(E.kind),target:String(E.target),config:Zr(E.config),intervalSeconds:Number(E.interval_seconds),timeoutSeconds:Number(E.timeout_seconds),failureThreshold:Number(E.failure_threshold),recoveryThreshold:Number(E.recovery_threshold),regions:Zr(E.regions),enabled:hz(E.enabled),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function R9(E){return{id:String(E.id),checkId:String(E.check_id),status:String(E.status),agent:String(E.agent),region:Y_(E.region),statusCode:E.status_code==null?void 0:Number(E.status_code),message:Y_(E.message),timings:Zr(E.timings),checkedAt:String(E.checked_at)}}function h9(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Y_(E.environment_id),resourceId:Y_(E.resource_id),healthCheckId:Y_(E.health_check_id),name:String(E.name),signal:String(E.signal),operator:String(E.operator),threshold:E.threshold==null?void 0:Number(E.threshold),recoveryThreshold:E.recovery_threshold==null?void 0:Number(E.recovery_threshold),windowMs:Number(E.window_ms),consecutive:Number(E.consecutive),recoveryConsecutive:Number(E.recovery_consecutive),noDataPolicy:String(E.no_data_policy),severity:String(E.severity),groupBy:Zr(E.group_by),labels:Zr(E.labels),enabled:hz(E.enabled),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function tz(E){return{id:String(E.id),ruleId:String(E.rule_id),projectId:String(E.project_id),environmentId:Y_(E.environment_id),resourceId:Y_(E.resource_id),dedupKey:String(E.dedup_key),groupKey:String(E.group_key),state:String(E.state),severity:String(E.severity),title:String(E.title),evidence:Zr(E.evidence),failureCount:Number(E.failure_count),recoveryCount:Number(E.recovery_count),occurrenceCount:Number(E.occurrence_count),ownerActorId:Y_(E.owner_actor_id),acknowledgedByActorId:Y_(E.acknowledged_by_actor_id),acknowledgedAt:Y_(E.acknowledged_at),firstSeenAt:String(E.first_seen_at),lastSeenAt:String(E.last_seen_at),firingAt:Y_(E.firing_at),resolvedAt:Y_(E.resolved_at),silencedUntil:Y_(E.silenced_until),updatedAt:String(E.updated_at)}}function N9(E){return{id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),kind:String(E.kind),config:Zr(E.config),credentialFingerprint:Y_(E.credential_fingerprint),hasCredential:!!E.credential_ciphertext,status:String(E.status),version:Number(E.version),lastTestedAt:Y_(E.last_tested_at),lastError:Y_(E.last_error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function S9(E){return{id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),priority:Number(E.priority),matcher:Zr(E.matcher),channelIds:Zr(E.channel_ids),quietHours:E.quiet_hours?Zr(E.quiet_hours):void 0,groupWaitSeconds:Number(E.group_wait_seconds),reminderSeconds:E.reminder_seconds==null?void 0:Number(E.reminder_seconds),escalation:Zr(E.escalation),template:Y_(E.template),rateLimitPerMinute:Number(E.rate_limit_per_minute),enabled:hz(E.enabled),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Rz(E){return{id:String(E.id),alertId:Y_(E.alert_id),channelId:String(E.channel_id),routeId:Y_(E.route_id),eventType:String(E.event_type),idempotencyKey:String(E.idempotency_key),state:String(E.state),attempt:Number(E.attempt),maxAttempts:Number(E.max_attempts),nextAttemptAt:Y_(E.next_attempt_at),responseStatus:E.response_status==null?void 0:Number(E.response_status),error:Y_(E.error),payload:Zr(E.payload),createdAt:String(E.created_at),updatedAt:String(E.updated_at),deliveredAt:Y_(E.delivered_at)}}class BA{controlPlane;options;key;constructor(E,_){this.controlPlane=E;this.options=_;this.key=A9("sha256").update(_.encryptionKey).digest()}now(){return(this.options.now?.()??new Date).toISOString()}encrypt(E){let _=Va(12),T=fa("aes-256-gcm",this.key,_),r=Buffer.concat([T.update(E,"utf8"),T.final()]);return`v1.${_.toString("base64url")}.${T.getAuthTag().toString("base64url")}.${r.toString("base64url")}`}decrypt(E){let[,_,T,r]=E.split("."),d=Ka("aes-256-gcm",this.key,Buffer.from(_,"base64url"));return d.setAuthTag(Buffer.from(T,"base64url")),Buffer.concat([d.update(Buffer.from(r,"base64url")),d.final()]).toString("utf8")}createHealthCheck(E){if(!E.name.trim())throw Error("Health checks require a name.");if(!["http","tcp","command"].includes(E.kind))throw Error("Unsupported health check kind.");if(E.kind==="http"&&!/^https?:\/\//.test(E.target)||E.kind==="tcp"&&!/^[a-zA-Z0-9.-]+$/.test(E.target)||E.kind==="command"&&!E.config.command?.length)throw Error("Health check target is invalid.");let _=crypto.randomUUID(),T=this.now();return this.controlPlane.database.run("INSERT INTO health_checks (id,project_id,environment_id,resource_id,name,kind,target,config,interval_seconds,timeout_seconds,failure_threshold,recovery_threshold,regions,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.projectId,E.environmentId??null,E.resourceId??null,E.name.trim().slice(0,100),E.kind,E.target,JSON.stringify(E.config),Nt(E.intervalSeconds,60,10,86400),Nt(E.timeoutSeconds,10,1,300),Nt(E.failureThreshold,3,1,100),Nt(E.recoveryThreshold,2,1,100),JSON.stringify(E.regions.slice(0,20)),E.enabled?1:0,1,T,T]),this.getHealthCheck(_)}getHealthCheck(E){let _=this.controlPlane.database.query("SELECT * FROM health_checks WHERE id=?").get(E);return _?t9(_):void 0}listHealthChecks(E,_){return this.controlPlane.database.query(`SELECT * FROM health_checks WHERE project_id=?${_?" AND environment_id=?":""} ORDER BY updated_at DESC`).all(E,..._?[_]:[]).map(t9)}setHealthCheckEnabled(E,_){this.controlPlane.database.run("UPDATE health_checks SET enabled=?,version=version+1,updated_at=? WHERE id=?",[_?1:0,this.now(),E]);let T=this.getHealthCheck(E);if(!T)throw Error("Health check was not found.");return T}appendHealthResult(E){let _=crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO health_results (id,check_id,status,agent,region,status_code,message,timings,checked_at) VALUES (?,?,?,?,?,?,?,?,?)",[_,E.checkId,E.status,E.agent.slice(0,100),E.region??null,E.statusCode??null,E.message?.slice(0,1000)??null,JSON.stringify(E.timings),E.checkedAt]),R9(this.controlPlane.database.query("SELECT * FROM health_results WHERE id=?").get(_))}listHealthResults(E,_=100){return this.controlPlane.database.query("SELECT * FROM health_results WHERE check_id=? ORDER BY checked_at DESC LIMIT ?").all(E,Math.min(1000,Math.max(1,_))).map(R9)}createRule(E){if(!E.name.trim())throw Error("Alert rules require a name.");if(E.operator!=="unhealthy"&&E.threshold==null)throw Error("Metric alert rules require a threshold.");let _=crypto.randomUUID(),T=this.now();return this.controlPlane.database.run("INSERT INTO alert_rules (id,project_id,environment_id,resource_id,health_check_id,name,signal,operator,threshold,recovery_threshold,window_ms,consecutive,recovery_consecutive,no_data_policy,severity,group_by,labels,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.projectId,E.environmentId??null,E.resourceId??null,E.healthCheckId??null,E.name.trim().slice(0,120),E.signal,E.operator,E.threshold??null,E.recoveryThreshold??null,Nt(E.windowMs,300000,1e4,2678400000),Nt(E.consecutive,3,1,100),Nt(E.recoveryConsecutive,2,1,100),E.noDataPolicy,E.severity,JSON.stringify(E.groupBy.slice(0,20)),JSON.stringify(E.labels),E.enabled?1:0,1,T,T]),this.getRule(_)}getRule(E){let _=this.controlPlane.database.query("SELECT * FROM alert_rules WHERE id=?").get(E);return _?h9(_):void 0}listRules(E,_){return this.controlPlane.database.query(`SELECT * FROM alert_rules WHERE project_id=?${_?" AND environment_id=?":""} ORDER BY updated_at DESC`).all(E,..._?[_]:[]).map(h9)}setRuleEnabled(E,_){this.controlPlane.database.run("UPDATE alert_rules SET enabled=?,version=version+1,updated_at=? WHERE id=?",[_?1:0,this.now(),E]);let T=this.getRule(E);if(!T)throw Error("Alert rule was not found.");return T}getAlertByDedup(E){let _=this.controlPlane.database.query("SELECT * FROM alerts WHERE dedup_key=?").get(E);return _?tz(_):void 0}getAlert(E){let _=this.controlPlane.database.query("SELECT * FROM alerts WHERE id=?").get(E);return _?tz(_):void 0}listAlerts(E,_={}){let T=["project_id=?"],r=[E];if(_.environmentId)T.push("environment_id=?"),r.push(_.environmentId);if(_.states?.length)T.push(`state IN (${_.states.map(()=>"?").join(",")})`),r.push(..._.states);return this.controlPlane.database.query(`SELECT * FROM alerts WHERE ${T.join(" AND ")} ORDER BY updated_at DESC LIMIT ?`).all(...r,Math.min(1000,_.limit??200)).map(tz)}saveAlert(E,_,T){return this.controlPlane.database.run("INSERT INTO alerts (id,rule_id,project_id,environment_id,resource_id,dedup_key,group_key,state,severity,title,evidence,failure_count,recovery_count,occurrence_count,owner_actor_id,acknowledged_by_actor_id,acknowledged_at,first_seen_at,last_seen_at,firing_at,resolved_at,silenced_until,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET state=excluded.state,severity=excluded.severity,title=excluded.title,evidence=excluded.evidence,failure_count=excluded.failure_count,recovery_count=excluded.recovery_count,occurrence_count=excluded.occurrence_count,owner_actor_id=excluded.owner_actor_id,acknowledged_by_actor_id=excluded.acknowledged_by_actor_id,acknowledged_at=excluded.acknowledged_at,last_seen_at=excluded.last_seen_at,firing_at=excluded.firing_at,resolved_at=excluded.resolved_at,silenced_until=excluded.silenced_until,updated_at=excluded.updated_at",[E.id,E.ruleId,E.projectId,E.environmentId??null,E.resourceId??null,E.dedupKey,E.groupKey,E.state,E.severity,E.title,JSON.stringify(E.evidence),E.failureCount,E.recoveryCount,E.occurrenceCount,E.ownerActorId??null,E.acknowledgedByActorId??null,E.acknowledgedAt??null,E.firstSeenAt,E.lastSeenAt,E.firingAt??null,E.resolvedAt??null,E.silencedUntil??null,E.updatedAt]),this.controlPlane.database.run("INSERT INTO alert_events (id,alert_id,type,actor_id,payload,created_at) VALUES (?,?,?,?,?,?)",[crypto.randomUUID(),E.id,_,T??null,JSON.stringify({state:E.state,severity:E.severity,evidence:E.evidence}),E.updatedAt]),this.getAlert(E.id)}acknowledge(E,_){let T=this.getAlert(E);if(!T)throw Error("Alert was not found.");let r=this.now();return this.saveAlert({...T,acknowledgedByActorId:_,acknowledgedAt:r,updatedAt:r},"acknowledged",_)}assign(E,_,T){let r=this.getAlert(E);if(!r)throw Error("Alert was not found.");let d=this.now();return this.saveAlert({...r,ownerActorId:_,updatedAt:d},"assigned",T)}silenceAlert(E,_,T){let r=this.getAlert(E);if(!r)throw Error("Alert was not found.");let d=new Date(_);if(!Number.isFinite(d.getTime())||d<=new Date)throw Error("Silence end must be in the future.");let t=this.now();return this.saveAlert({...r,state:"silenced",silencedUntil:d.toISOString(),updatedAt:t},"silenced",T)}createSilence(E){let _=new Date(E.startsAt),T=new Date(E.endsAt);if(!Number.isFinite(_.getTime())||!Number.isFinite(T.getTime())||_>=T)throw Error("Silence window is invalid.");try{new Intl.DateTimeFormat("en",{timeZone:E.timezone}).format(_)}catch{throw Error("Silence timezone is invalid.")}let r=crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO alert_silences (id,project_id,environment_id,resource_id,matcher,reason,starts_at,ends_at,timezone,created_by_actor_id,created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)",[r,E.projectId,E.environmentId??null,E.resourceId??null,JSON.stringify(E.matcher??{}),E.reason.slice(0,500),_.toISOString(),T.toISOString(),E.timezone,E.actorId??null,this.now()]),r}isSilenced(E,_,T){return this.controlPlane.database.query("SELECT * FROM alert_silences WHERE project_id=? AND starts_at<=? AND ends_at>?").all(E.projectId,T,T).some((d)=>{if(d.environment_id&&d.environment_id!==E.environmentId)return!1;if(d.resource_id&&d.resource_id!==E.resourceId)return!1;let t=Zr(d.matcher);return Object.entries(t).every(([R,h])=>_[R]===h)})}createChannel(E){if(!E.name.trim())throw Error("Notification channels require a name.");let _=crypto.randomUUID(),T=this.now(),r=E.credential?.trim();return this.controlPlane.database.run("INSERT INTO notification_channels (id,organization_id,name,kind,config,credential_ciphertext,credential_fingerprint,status,version,created_by_actor_id,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.name.trim().slice(0,100),E.kind,JSON.stringify(E.config??{}),r?this.encrypt(r):null,r?d9(r):null,"active",1,E.actorId??null,T,T]),this.getChannel(_)}getChannel(E){let _=this.controlPlane.database.query("SELECT * FROM notification_channels WHERE id=?").get(E);return _?N9(_):void 0}channelCredential(E){let _=this.controlPlane.database.query("SELECT credential_ciphertext FROM notification_channels WHERE id=?").get(E);return _?.credential_ciphertext?this.decrypt(String(_.credential_ciphertext)):void 0}listChannels(E){return this.controlPlane.database.query("SELECT * FROM notification_channels WHERE organization_id=? ORDER BY updated_at DESC").all(E).map(N9)}rotateChannel(E,_){let T=this.now();this.controlPlane.database.run("UPDATE notification_channels SET credential_ciphertext=?,credential_fingerprint=?,status='active',last_error=NULL,version=version+1,updated_at=? WHERE id=?",[this.encrypt(_),d9(_),T,E]);let r=this.getChannel(E);if(!r)throw Error("Notification channel was not found.");return r}setChannelStatus(E,_,T){this.controlPlane.database.run("UPDATE notification_channels SET status=?,last_error=?,updated_at=? WHERE id=?",[_,T?.slice(0,1000)??null,this.now(),E]);let r=this.getChannel(E);if(!r)throw Error("Notification channel was not found.");return r}markChannelTest(E,_,T){let r=this.now();return this.controlPlane.database.run("UPDATE notification_channels SET status=?,last_tested_at=?,last_error=?,updated_at=? WHERE id=?",[_?"active":"failing",r,T?.slice(0,1000)??null,r,E]),this.getChannel(E)}createRoute(E){let _=crypto.randomUUID(),T=this.now();return this.controlPlane.database.run("INSERT INTO notification_routes (id,organization_id,name,priority,matcher,channel_ids,quiet_hours,group_wait_seconds,reminder_seconds,escalation,template,rate_limit_per_minute,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.name.trim().slice(0,100),E.priority,JSON.stringify(E.matcher),JSON.stringify(E.channelIds),E.quietHours?JSON.stringify(E.quietHours):null,Nt(E.groupWaitSeconds,30,0,86400),E.reminderSeconds??null,JSON.stringify(E.escalation),E.template?.trim().slice(0,2000)??null,Nt(E.rateLimitPerMinute,60,1,1e4),E.enabled?1:0,1,T,T]),this.getRoute(_)}getRoute(E){let _=this.controlPlane.database.query("SELECT * FROM notification_routes WHERE id=?").get(E);return _?S9(_):void 0}listRoutes(E){return this.controlPlane.database.query("SELECT * FROM notification_routes WHERE organization_id=? ORDER BY priority DESC,created_at ASC").all(E).map(S9)}countRouteDeliveries(E,_){return Number(this.controlPlane.database.query("SELECT COUNT(*) count FROM notification_deliveries WHERE route_id=? AND created_at>=?").get(E,_)?.count??0)}setRouteEnabled(E,_){this.controlPlane.database.run("UPDATE notification_routes SET enabled=?,version=version+1,updated_at=? WHERE id=?",[_?1:0,this.now(),E]);let T=this.getRoute(E);if(!T)throw Error("Notification route was not found.");return T}createDelivery(E){let _=this.controlPlane.database.query("SELECT * FROM notification_deliveries WHERE idempotency_key=?").get(E.idempotencyKey);if(_)return Rz(_);let T=crypto.randomUUID(),r=this.now();return this.controlPlane.database.run("INSERT INTO notification_deliveries (id,alert_id,channel_id,route_id,event_type,idempotency_key,state,attempt,max_attempts,next_attempt_at,payload,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.alertId??null,E.channelId,E.routeId??null,E.eventType,E.idempotencyKey,"pending",0,Nt(E.maxAttempts,3,1,10),E.nextAttemptAt??null,JSON.stringify(E.payload),r,r]),this.getDelivery(T)}getDelivery(E){let _=this.controlPlane.database.query("SELECT * FROM notification_deliveries WHERE id=?").get(E);return _?Rz(_):void 0}listDeliveries(E={}){let _=[],T=[];if(E.alertId)_.push("alert_id=?"),T.push(E.alertId);if(E.states?.length)_.push(`state IN (${E.states.map(()=>"?").join(",")})`),T.push(...E.states);return this.controlPlane.database.query(`SELECT * FROM notification_deliveries${_.length?" WHERE "+_.join(" AND "):""} ORDER BY updated_at DESC LIMIT ?`).all(...T,Math.min(1000,E.limit??200)).map(Rz)}updateDelivery(E,_){return this.controlPlane.database.run("UPDATE notification_deliveries SET state=?,attempt=?,next_attempt_at=?,response_status=?,error=?,delivered_at=?,updated_at=? WHERE id=?",[_.state,_.attempt,_.nextAttemptAt??null,_.responseStatus??null,_.error?.slice(0,1000)??null,_.deliveredAt??null,this.now(),E]),this.getDelivery(E)}}await tT();import{createHash as Za}from"node:crypto";function qa(E,_,T){if(E==="gt")return _>T;if(E==="gte")return _>=T;if(E==="lt")return _<T;if(E==="lte")return _<=T;return _===T}function ga(E,_,T){if(_.status==="no_data"||_.status==null&&_.value==null)return;if(E.operator==="unhealthy")return _.status==="unhealthy";if(_.value==null||E.threshold==null)return;return qa(E.operator,_.value,T&&E.recoveryThreshold!=null?E.recoveryThreshold:E.threshold)}function xa(E,_){let T=Object.fromEntries(E.groupBy.flatMap((d)=>_.group?.[d]==null?[]:[[d,String(_.group[d])]]));return{key:Object.entries(T).sort(([d],[t])=>d.localeCompare(t)).map(([d,t])=>`${d}=${t}`).join(",")||"default",values:T}}function ba(E,_){return Za("sha256").update(`${E}\x00${_}`).digest("hex")}class WA{store;constructor(E){this.store=E}evaluate(E,_){if(!E.enabled)return{transition:"ignored",notify:!1};let T=xa(E,_),r=ba(E.id,T.key),d=this.store.getAlertByDedup(r),t=d?.state==="firing"||d?.state==="silenced",R=ga(E,_,t);if(R==null&&E.noDataPolicy==="ignore")return{alert:d,transition:"ignored",notify:!1};let h=R??E.noDataPolicy==="firing",N=R==null&&E.noDataPolicy==="pending",S=new Date(_.timestamp).toISOString(),A=bE({..._.evidence??{},..._.value==null?{}:{value:_.value},..._.status?{healthStatus:_.status}:{},group:T.values}),L;if(!d){let I=h||N?1:0,C=h&&I>=E.consecutive?"firing":"pending";L={id:crypto.randomUUID(),ruleId:E.id,projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,dedupKey:r,groupKey:T.key,state:C,severity:E.severity,title:E.name,evidence:A,failureCount:I,recoveryCount:0,occurrenceCount:1,firstSeenAt:S,lastSeenAt:S,firingAt:C==="firing"?S:void 0,updatedAt:S}}else if(h||N){let I=d.state==="resolved",C=(I?0:d.failureCount)+1,e=d.silencedUntil&&new Date(d.silencedUntil)>new Date(S),z=N?"pending":C>=E.consecutive?"firing":"pending";if((e||this.store.isSilenced(E,T.values,S))&&z==="firing")z="silenced";L={...d,state:z,severity:E.severity,title:E.name,evidence:A,failureCount:C,recoveryCount:0,occurrenceCount:d.occurrenceCount+1,firstSeenAt:I?S:d.firstSeenAt,lastSeenAt:S,firingAt:z==="firing"||z==="silenced"?d.firingAt??S:void 0,resolvedAt:void 0,updatedAt:S}}else{let I=d.recoveryCount+1,C=I>=E.recoveryConsecutive;L={...d,state:C?"resolved":d.state,evidence:A,failureCount:C?0:d.failureCount,recoveryCount:I,lastSeenAt:S,resolvedAt:C?S:d.resolvedAt,silencedUntil:C?void 0:d.silencedUntil,updatedAt:S}}let O=d?.state!==L.state,c=L.state==="pending"?"pending":L.state==="firing"?O?"firing":"updated":L.state==="silenced"?"silenced":O?"resolved":"updated";return{alert:this.store.saveAlert(L,O||!d?c:"observed"),transition:c,notify:c==="firing"||c==="resolved"}}}import{createHmac as ka}from"node:crypto";function ua(E,_){let T=Object.fromEntries(new Intl.DateTimeFormat("en-US",{timeZone:_,weekday:"short",hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(E).map((d)=>[d.type,d.value])),r=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"];return{minute:Number(T.hour)*60+Number(T.minute),weekday:r.indexOf(T.weekday)}}function L9(E){let _=/^(\d{2}):(\d{2})$/.exec(E);if(!_)throw Error("Quiet hours require HH:MM times.");let T=Number(_[1])*60+Number(_[2]);if(Number(_[1])>23||Number(_[2])>59)throw Error("Quiet hours require valid HH:MM times.");return T}function O9(E,_){if(!E.quietHours)return!1;let T=ua(_,E.quietHours.timezone),r=L9(E.quietHours.start),d=L9(E.quietHours.end);if(E.quietHours.weekdays?.length&&!E.quietHours.weekdays.includes(T.weekday))return!1;return r<=d?T.minute>=r&&T.minute<d:T.minute>=r||T.minute<d}function va(E,_,T){let r=E.matcher;return(!r.projectIds?.length||r.projectIds.includes(_.projectId))&&(!r.environmentIds?.length||!!_.environmentId&&r.environmentIds.includes(_.environmentId))&&(!r.resourceIds?.length||!!_.resourceId&&r.resourceIds.includes(_.resourceId))&&(!r.severities?.length||r.severities.includes(_.severity))&&(!r.eventTypes?.length||r.eventTypes.includes(T))}function na(E){if(!E)return{};try{let _=JSON.parse(E);return _&&typeof _==="object"?_:{value:E}}catch{return{value:E}}}function la(E,_,T){let r={severity:E.severity.toUpperCase(),title:E.title,state:E.state,event:_,projectId:E.projectId,environmentId:E.environmentId??"",resourceId:E.resourceId??"",groupKey:E.groupKey};return(T?.trim()||"[{{severity}}] {{title}} · {{state}}").replace(/\{\{(severity|title|state|event|projectId|environmentId|resourceId|groupKey)\}\}/g,(d,t)=>r[t]).slice(0,2000)}function Nz(E,_,T){return{schemaVersion:1,event:_,notificationText:la(E,_,T),alert:{id:E.id,state:E.state,severity:E.severity,title:E.title,projectId:E.projectId,environmentId:E.environmentId??null,resourceId:E.resourceId??null,groupKey:E.groupKey,firstSeenAt:E.firstSeenAt,lastSeenAt:E.lastSeenAt,firingAt:E.firingAt??null,resolvedAt:E.resolvedAt??null,evidence:E.evidence}}}class HA{store;options;fetchImpl;constructor(E,_={}){this.store=E;this.options=_;this.fetchImpl=_.fetchImpl??globalThis.fetch}now(){return this.options.now?.()??new Date}preview(E,_,T){let r=[];for(let d of this.store.listRoutes(E)){if(!d.enabled||!va(d,_,T))continue;let t=[];for(let R of d.channelIds){let h=this.store.getChannel(R);if(h?.status==="active")t.push(h)}r.push({route:d,channels:t,quiet:O9(d,this.now())})}return r}enqueue(E,_,T){let r=T==="resolved"?_.resolvedAt:T==="firing"?_.firingAt:_.updatedAt,d=[];for(let t of this.preview(E,_,T)){if(t.quiet&&T!=="resolved")continue;let R=T==="resolved"||t.route.groupWaitSeconds===0?void 0:new Date(this.now().getTime()+t.route.groupWaitSeconds*1000).toISOString(),h=T==="resolved"?Number.POSITIVE_INFINITY:Math.max(0,t.route.rateLimitPerMinute-this.store.countRouteDeliveries(t.route.id,new Date(this.now().getTime()-60000).toISOString()));for(let N of t.channels){if(h<=0)break;d.push(this.store.createDelivery({alertId:_.id,channelId:N.id,routeId:t.route.id,eventType:T,idempotencyKey:`${_.id}:${T}:${r}:${N.id}`,payload:Nz(_,T,t.route.template),nextAttemptAt:R})),h--}}return d}enqueueRemindersAndEscalations(E,_){let T=this.now(),r=[];for(let d of _.filter((t)=>t.state==="firing"&&!t.acknowledgedAt&&t.firingAt)){let t=Math.max(0,(T.getTime()-new Date(d.firingAt).getTime())/1000);for(let R of this.preview(E,d,"reminder")){if(R.quiet)continue;if(R.route.reminderSeconds&&t>=R.route.reminderSeconds){let h=Math.floor(t/R.route.reminderSeconds);for(let N of R.channels)r.push(this.store.createDelivery({alertId:d.id,channelId:N.id,routeId:R.route.id,eventType:"reminder",idempotencyKey:`${d.id}:reminder:${R.route.id}:${h}:${N.id}`,payload:Nz(d,"reminder")}))}for(let[h,N]of R.route.escalation.entries())if(t>=N.afterSeconds){for(let S of N.channelIds)if(this.store.getChannel(S)?.status==="active")r.push(this.store.createDelivery({alertId:d.id,channelId:S,routeId:R.route.id,eventType:"escalation",idempotencyKey:`${d.id}:escalation:${R.route.id}:${h}:${S}`,payload:Nz(d,"escalation")}))}}}return r}async send(E,_){let T=na(this.store.channelCredential(E.id)),r=typeof _.notificationText==="string"?_.notificationText:`[${String(_.alert?.severity??"info").toUpperCase()}] ${String(_.alert?.title??"ts-cloud alert")} · ${String(_.alert?.state??_.event)}`;try{if(E.kind==="email"){if(!this.options.emailImpl)return{ok:!1,error:"Email adapter is not configured."};return await this.options.emailImpl({to:E.config.to,from:E.config.from,subject:`[ts-cloud] ${String(_.alert?.title??_.event)}`,text:`${r}
+`))}catch{if(OE=!0,TE)clearInterval(TE);zE.close()}},1000),L.signal.addEventListener("abort",()=>{if(OE=!0,TE)clearInterval(TE);try{zE.close()}catch{}},{once:!0})},cancel(){if(OE=!0,TE)clearInterval(TE)}});return new Response(RE,{status:200,headers:{"content-type":"text/event-stream","cache-control":"no-store",connection:"keep-alive","x-accel-buffering":"no","x-request-id":$,...Y}})}M=mT(P,c,$,["sequence","id"])}else if(L.method==="POST"&&c.pathname==="/api/v1/deployments"){let P=L.headers.get("idempotency-key")??"";if(!P)throw new jE("idempotency_required","Idempotency-Key is required for deployment requests.",428);let x=await L.text();if(x.length>1048576)throw new jE("payload_too_large","Request body exceeds 1 MB.",413);let s;try{s=JSON.parse(x)}catch{throw new jE("invalid_json","Request body must be valid JSON.",400)}if(!s||typeof s.projectId!=="string"||typeof s.environmentId!=="string"||s.action!==void 0&&!["deploy","rollback"].includes(s.action))throw new jE("validation_error","projectId, environmentId, and a valid action are required.",422);let TE=_.createDeployment(e,s,P);return S({operation:TE.operation,idempotentReplay:TE.replay,requestId:$},202,$,{...Y,...TE.replay?{"idempotent-replayed":"true"}:{}})}else throw new jE("not_found","API resource was not found.",404);return S(M,200,$,Y)}catch(M){if(M instanceof jE)return A(M.code,M.message,M.status,$,M.details,Y);if(c.pathname.startsWith("/api/v1/source/")||c.pathname.startsWith("/api/v1/application")||c.pathname.startsWith("/api/v1/compose-")||c.pathname==="/api/v1/registry-connections")return A("validation_error",M instanceof Error?M.message:"Integration request could not be completed.",422,$,void 0,Y);return A("internal_error","The API request could not be completed.",500,$,void 0,Y)}}}await tT();import{createHash as ya,randomBytes as Ya}from"node:crypto";var EQ=new Set(Lr),_Q=7776000000,TQ=31536000000,rQ=86400000;function dR(E){return typeof E==="string"?E:void 0}function o9(E){return ya("sha256").update(E).digest("hex")}function Qa(E){try{let _=JSON.parse(String(E));return Array.isArray(_)?_.filter((T)=>typeof T==="string"&&EQ.has(T)):[]}catch{return[]}}function Ga(E){let _=String(E.scope_type);return _==="organization"?{type:_}:{type:_,id:String(E.scope_id)}}function rz(E){let _=dR(E.disabled_at);return{id:String(E.id),organizationId:String(E.organization_id),actorId:String(E.actor_id),slug:String(E.slug),name:String(E.name),description:dR(E.description),createdByActorId:dR(E.created_by_actor_id),disabledAt:_,createdAt:String(E.created_at),updatedAt:String(E.updated_at),state:_?"disabled":"active"}}function dz(E,_){let T=dR(E.revoked_at),r=String(E.expires_at);return{id:String(E.id),serviceAccountId:String(E.service_account_id),name:String(E.name),prefix:String(E.token_prefix),capabilities:Qa(E.capabilities),scope:Ga(E),expiresAt:r,lastUsedAt:dR(E.last_used_at),lastNetworkHint:dR(E.last_network_hint),revokedAt:T,rotatedFromTokenId:dR(E.rotated_from_token_id),createdByActorId:dR(E.created_by_actor_id),createdAt:String(E.created_at),updatedAt:String(E.updated_at),state:T?"revoked":r<=_?"expired":"active"}}function Ma(E){let _={};try{_=JSON.parse(String(E.response_body))}catch{}return{id:String(E.id),tokenId:String(E.token_id),key:String(E.idempotency_key),requestHash:String(E.request_hash),operationId:dR(E.operation_id),responseStatus:Number(E.response_status),responseBody:_,expiresAt:String(E.expires_at),createdAt:String(E.created_at)}}class ht{controlPlane;nowFn;idFn;constructor(E,_={}){this.controlPlane=E;this.nowFn=_.now??(()=>new Date),this.idFn=_.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(E,_){this.controlPlane.database.run(E,_)}createServiceAccount(E){if(!this.controlPlane.getOrganization(E.organizationId))throw Error("Service-account organization was not found");let _=E.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(_))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let T=E.name.trim().slice(0,100);if(!T)throw Error("Service-account name is required");let r=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${E.organizationId}:${_}`,displayName:T,metadata:{source:"api",serviceAccountSlug:_}}),d=this.idFn(),t=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[d,E.organizationId,r.id,_,T,E.description?.trim().slice(0,500)||null,E.createdByActorId??null,t,t]);let R=this.controlPlane.createMembership({organizationId:E.organizationId,actorId:r.id,roleTemplate:E.roleTemplate,scope:E.scope,source:"manual",performedByActorId:E.createdByActorId}),h=E.scope??{type:"organization"};return this.controlPlane.appendEvent({organizationId:E.organizationId,actorId:E.createdByActorId,type:"api.service_account.created",payload:{serviceAccountId:d,roleTemplate:E.roleTemplate,scope:{type:h.type,id:h.id??null}}}),{serviceAccount:this.getServiceAccount(d),membership:R}}getServiceAccount(E){let _=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE id = ?").get(E);return _?rz(_):void 0}getServiceAccountBySlug(E,_){let T=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? AND slug = ? COLLATE NOCASE").get(E,_.trim());return T?rz(T):void 0}listServiceAccounts(E,_={}){return this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(E).map(rz).filter((T)=>_.includeDisabled||T.state==="active")}disableServiceAccount(E,_){let T=this.getServiceAccount(E);if(!T)throw Error("Service account was not found");let r=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE service_accounts SET disabled_at = ?, updated_at = ? WHERE id = ?",[r,r,E]),this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE service_account_id = ? AND revoked_at IS NULL",[r,r,E]);let d=this.controlPlane.getMembershipForActor(T.organizationId,T.actorId);if(d?.status==="active")this.controlPlane.revokeMembership(d.id)}),this.controlPlane.appendEvent({organizationId:T.organizationId,actorId:_,type:"api.service_account.disabled",payload:{serviceAccountId:E}}),this.getServiceAccount(E)}createToken(E){let _=this.getServiceAccount(E.serviceAccountId);if(!_||_.state!=="active")throw Error("Service account is unavailable");let T=this.controlPlane.getMembershipForActor(_.organizationId,_.actorId);if(!T||T.status!=="active")throw Error("Service-account membership is unavailable");let r=[...new Set(E.capabilities)];if(r.length===0||r.some((O)=>!EQ.has(O)))throw Error("API token requires valid explicit capabilities");let d=E.scope??T.scope,t=this.controlPlane.resolveAuthorizationTarget(_.organizationId,d);if(!t)throw Error("API token scope was not found in this organization");for(let O of r)if(!Or({membership:T,grants:this.controlPlane.listGrants(T.id),capability:O,target:t}).allowed)throw Error(`Service-account membership does not grant ${O} at the token scope`);let R=E.expiresAt?new Date(E.expiresAt):new Date(this.nowFn().getTime()+_Q);if(!Number.isFinite(R.getTime())||R.getTime()<=this.nowFn().getTime()+60000||R.getTime()>this.nowFn().getTime()+TQ)throw Error("API token expiry must be between one minute and one year from now");let h=this.idFn(),N=Ya(32).toString("base64url"),S=`tsc_v1.${h}.${N}`,A=`tsc_v1.${h.slice(0,8)}`,L=this.now();return this.run(`INSERT INTO api_tokens (id, service_account_id, name, token_hash, token_prefix, capabilities, scope_type, scope_id,
+      expires_at, rotated_from_token_id, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[h,_.id,E.name.trim().slice(0,100)||"API token",o9(S),A,JSON.stringify(r.sort()),d.type,d.type==="organization"?null:d.id??null,R.toISOString(),E.rotatedFromTokenId??null,E.createdByActorId??null,L,L]),this.controlPlane.appendEvent({organizationId:_.organizationId,actorId:E.createdByActorId,type:"api.token.created",payload:{serviceAccountId:_.id,tokenId:h,prefix:A,capabilities:r,scope:{type:d.type,id:d.id??null},expiresAt:R.toISOString(),rotatedFromTokenId:E.rotatedFromTokenId??null}}),{token:this.getToken(h),secret:S}}getToken(E){let _=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ?").get(E);return _?dz(_,this.now()):void 0}listTokens(E,_={}){return this.controlPlane.database.query("SELECT * FROM api_tokens WHERE service_account_id = ? ORDER BY created_at DESC").all(E).map((T)=>dz(T,this.now())).filter((T)=>_.includeInactive||T.state==="active")}verifyToken(E,_){let T=/^tsc_v1\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(E);if(!T)return;let r=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ? AND token_hash = ?").get(T[1],o9(E));if(!r)return;let d=dz(r,this.now()),t=this.getServiceAccount(d.serviceAccountId);if(!t||t.state!=="active"||d.state!=="active")return;let R=this.controlPlane.getActor(t.actorId),h=this.controlPlane.getMembershipForActor(t.organizationId,t.actorId);if(!R||R.disabledAt||!h||h.status!=="active")return;let N=this.now(),S=!d.lastUsedAt||this.nowFn().getTime()-new Date(d.lastUsedAt).getTime()>=3600000;if(this.run("UPDATE api_tokens SET last_used_at = ?, last_network_hint = ?, updated_at = ? WHERE id = ?",[N,_?.slice(0,128)??null,N,d.id]),S)this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:R.id,type:"api.token.used",payload:{serviceAccountId:t.id,tokenId:d.id,prefix:d.prefix}});return{serviceAccount:t,token:this.getToken(d.id),actor:R,membership:h}}rotateToken(E,_){let T=this.getToken(E);if(!T||T.state!=="active")throw Error("Active API token was not found");let r=this.createToken({serviceAccountId:T.serviceAccountId,name:`${T.name} (rotated)`,capabilities:T.capabilities,scope:T.scope,expiresAt:T.expiresAt,createdByActorId:_,rotatedFromTokenId:T.id}),d=this.getServiceAccount(T.serviceAccountId);return this.controlPlane.appendEvent({organizationId:d?.organizationId,actorId:_,type:"api.token.rotated",payload:{serviceAccountId:T.serviceAccountId,previousTokenId:T.id,tokenId:r.token.id}}),r}revokeToken(E,_){let T=this.getToken(E);if(!T)throw Error("API token was not found");if(T.state==="active"){let r=this.now();this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?",[r,r,E]);let d=this.getServiceAccount(T.serviceAccountId);this.controlPlane.appendEvent({organizationId:d?.organizationId,actorId:_,type:"api.token.revoked",payload:{serviceAccountId:T.serviceAccountId,tokenId:E}})}return this.getToken(E)}getIdempotency(E,_){let T=this.controlPlane.database.query("SELECT * FROM api_idempotency_records WHERE token_id = ? AND idempotency_key = ? AND expires_at > ?").get(E,_,this.now());return T?Ma(T):void 0}saveIdempotency(E){if(!/^[A-Za-z0-9._:-]{8,128}$/.test(E.key))throw Error("Idempotency-Key must contain 8-128 safe characters");let _=this.getIdempotency(E.tokenId,E.key);if(_){if(_.requestHash!==E.requestHash)throw Error("Idempotency-Key was already used for a different request");return _}let T=this.idFn(),r=this.now(),d=new Date(this.nowFn().getTime()+rQ).toISOString();return this.run(`INSERT INTO api_idempotency_records (id, token_id, idempotency_key, request_hash, operation_id, response_status, response_body, expires_at, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,E.tokenId,E.key,E.requestHash,E.operationId??null,E.responseStatus,JSON.stringify(E.responseBody),d,r]),this.getIdempotency(E.tokenId,E.key)}purgeExpired(){let E=this.now(),_=this.controlPlane.database.run("DELETE FROM api_tokens WHERE (expires_at < ? OR revoked_at IS NOT NULL) AND created_at < ?",[E,new Date(this.nowFn().getTime()-2592000000).toISOString()]).changes,T=this.controlPlane.database.run("DELETE FROM api_idempotency_records WHERE expires_at < ?",[E]).changes;return{tokens:_,idempotency:T}}}await tT();await aE();import{createHash as Fp}from"node:crypto";import{existsSync as cR,mkdtempSync as dF,readdirSync as LG,rmSync as GN,statSync as eG}from"node:fs";import{readFile as Ot,writeFile as YN}from"node:fs/promises";import{tmpdir as sD}from"node:os";import{dirname as jp,extname as qO,join as w_,normalize as Bp,relative as Wp,resolve as Hp,sep as Pp}from"node:path";import{fileURLToPath as yp}from"node:url";import{createCipheriv as fa,createDecipheriv as Ka,createHash as AQ,randomBytes as Va}from"node:crypto";var Zr=(E)=>{if(typeof E!=="string")return{};try{return JSON.parse(E)}catch{return{}}},Y_=(E)=>typeof E==="string"?E:void 0,hz=(E)=>Number(E)===1,Nt=(E,_,T,r)=>{let d=Number(E);return Number.isFinite(d)?Math.min(r,Math.max(T,Math.floor(d))):_},dQ=(E)=>AQ("sha256").update(E).digest("hex").slice(0,16);function tQ(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Y_(E.environment_id),resourceId:Y_(E.resource_id),name:String(E.name),kind:String(E.kind),target:String(E.target),config:Zr(E.config),intervalSeconds:Number(E.interval_seconds),timeoutSeconds:Number(E.timeout_seconds),failureThreshold:Number(E.failure_threshold),recoveryThreshold:Number(E.recovery_threshold),regions:Zr(E.regions),enabled:hz(E.enabled),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function RQ(E){return{id:String(E.id),checkId:String(E.check_id),status:String(E.status),agent:String(E.agent),region:Y_(E.region),statusCode:E.status_code==null?void 0:Number(E.status_code),message:Y_(E.message),timings:Zr(E.timings),checkedAt:String(E.checked_at)}}function hQ(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:Y_(E.environment_id),resourceId:Y_(E.resource_id),healthCheckId:Y_(E.health_check_id),name:String(E.name),signal:String(E.signal),operator:String(E.operator),threshold:E.threshold==null?void 0:Number(E.threshold),recoveryThreshold:E.recovery_threshold==null?void 0:Number(E.recovery_threshold),windowMs:Number(E.window_ms),consecutive:Number(E.consecutive),recoveryConsecutive:Number(E.recovery_consecutive),noDataPolicy:String(E.no_data_policy),severity:String(E.severity),groupBy:Zr(E.group_by),labels:Zr(E.labels),enabled:hz(E.enabled),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function tz(E){return{id:String(E.id),ruleId:String(E.rule_id),projectId:String(E.project_id),environmentId:Y_(E.environment_id),resourceId:Y_(E.resource_id),dedupKey:String(E.dedup_key),groupKey:String(E.group_key),state:String(E.state),severity:String(E.severity),title:String(E.title),evidence:Zr(E.evidence),failureCount:Number(E.failure_count),recoveryCount:Number(E.recovery_count),occurrenceCount:Number(E.occurrence_count),ownerActorId:Y_(E.owner_actor_id),acknowledgedByActorId:Y_(E.acknowledged_by_actor_id),acknowledgedAt:Y_(E.acknowledged_at),firstSeenAt:String(E.first_seen_at),lastSeenAt:String(E.last_seen_at),firingAt:Y_(E.firing_at),resolvedAt:Y_(E.resolved_at),silencedUntil:Y_(E.silenced_until),updatedAt:String(E.updated_at)}}function NQ(E){return{id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),kind:String(E.kind),config:Zr(E.config),credentialFingerprint:Y_(E.credential_fingerprint),hasCredential:!!E.credential_ciphertext,status:String(E.status),version:Number(E.version),lastTestedAt:Y_(E.last_tested_at),lastError:Y_(E.last_error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function SQ(E){return{id:String(E.id),organizationId:String(E.organization_id),name:String(E.name),priority:Number(E.priority),matcher:Zr(E.matcher),channelIds:Zr(E.channel_ids),quietHours:E.quiet_hours?Zr(E.quiet_hours):void 0,groupWaitSeconds:Number(E.group_wait_seconds),reminderSeconds:E.reminder_seconds==null?void 0:Number(E.reminder_seconds),escalation:Zr(E.escalation),template:Y_(E.template),rateLimitPerMinute:Number(E.rate_limit_per_minute),enabled:hz(E.enabled),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Rz(E){return{id:String(E.id),alertId:Y_(E.alert_id),channelId:String(E.channel_id),routeId:Y_(E.route_id),eventType:String(E.event_type),idempotencyKey:String(E.idempotency_key),state:String(E.state),attempt:Number(E.attempt),maxAttempts:Number(E.max_attempts),nextAttemptAt:Y_(E.next_attempt_at),responseStatus:E.response_status==null?void 0:Number(E.response_status),error:Y_(E.error),payload:Zr(E.payload),createdAt:String(E.created_at),updatedAt:String(E.updated_at),deliveredAt:Y_(E.delivered_at)}}class BA{controlPlane;options;key;constructor(E,_){this.controlPlane=E;this.options=_;this.key=AQ("sha256").update(_.encryptionKey).digest()}now(){return(this.options.now?.()??new Date).toISOString()}encrypt(E){let _=Va(12),T=fa("aes-256-gcm",this.key,_),r=Buffer.concat([T.update(E,"utf8"),T.final()]);return`v1.${_.toString("base64url")}.${T.getAuthTag().toString("base64url")}.${r.toString("base64url")}`}decrypt(E){let[,_,T,r]=E.split("."),d=Ka("aes-256-gcm",this.key,Buffer.from(_,"base64url"));return d.setAuthTag(Buffer.from(T,"base64url")),Buffer.concat([d.update(Buffer.from(r,"base64url")),d.final()]).toString("utf8")}createHealthCheck(E){if(!E.name.trim())throw Error("Health checks require a name.");if(!["http","tcp","command"].includes(E.kind))throw Error("Unsupported health check kind.");if(E.kind==="http"&&!/^https?:\/\//.test(E.target)||E.kind==="tcp"&&!/^[a-zA-Z0-9.-]+$/.test(E.target)||E.kind==="command"&&!E.config.command?.length)throw Error("Health check target is invalid.");let _=crypto.randomUUID(),T=this.now();return this.controlPlane.database.run("INSERT INTO health_checks (id,project_id,environment_id,resource_id,name,kind,target,config,interval_seconds,timeout_seconds,failure_threshold,recovery_threshold,regions,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.projectId,E.environmentId??null,E.resourceId??null,E.name.trim().slice(0,100),E.kind,E.target,JSON.stringify(E.config),Nt(E.intervalSeconds,60,10,86400),Nt(E.timeoutSeconds,10,1,300),Nt(E.failureThreshold,3,1,100),Nt(E.recoveryThreshold,2,1,100),JSON.stringify(E.regions.slice(0,20)),E.enabled?1:0,1,T,T]),this.getHealthCheck(_)}getHealthCheck(E){let _=this.controlPlane.database.query("SELECT * FROM health_checks WHERE id=?").get(E);return _?tQ(_):void 0}listHealthChecks(E,_){return this.controlPlane.database.query(`SELECT * FROM health_checks WHERE project_id=?${_?" AND environment_id=?":""} ORDER BY updated_at DESC`).all(E,..._?[_]:[]).map(tQ)}setHealthCheckEnabled(E,_){this.controlPlane.database.run("UPDATE health_checks SET enabled=?,version=version+1,updated_at=? WHERE id=?",[_?1:0,this.now(),E]);let T=this.getHealthCheck(E);if(!T)throw Error("Health check was not found.");return T}appendHealthResult(E){let _=crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO health_results (id,check_id,status,agent,region,status_code,message,timings,checked_at) VALUES (?,?,?,?,?,?,?,?,?)",[_,E.checkId,E.status,E.agent.slice(0,100),E.region??null,E.statusCode??null,E.message?.slice(0,1000)??null,JSON.stringify(E.timings),E.checkedAt]),RQ(this.controlPlane.database.query("SELECT * FROM health_results WHERE id=?").get(_))}listHealthResults(E,_=100){return this.controlPlane.database.query("SELECT * FROM health_results WHERE check_id=? ORDER BY checked_at DESC LIMIT ?").all(E,Math.min(1000,Math.max(1,_))).map(RQ)}createRule(E){if(!E.name.trim())throw Error("Alert rules require a name.");if(E.operator!=="unhealthy"&&E.threshold==null)throw Error("Metric alert rules require a threshold.");let _=crypto.randomUUID(),T=this.now();return this.controlPlane.database.run("INSERT INTO alert_rules (id,project_id,environment_id,resource_id,health_check_id,name,signal,operator,threshold,recovery_threshold,window_ms,consecutive,recovery_consecutive,no_data_policy,severity,group_by,labels,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.projectId,E.environmentId??null,E.resourceId??null,E.healthCheckId??null,E.name.trim().slice(0,120),E.signal,E.operator,E.threshold??null,E.recoveryThreshold??null,Nt(E.windowMs,300000,1e4,2678400000),Nt(E.consecutive,3,1,100),Nt(E.recoveryConsecutive,2,1,100),E.noDataPolicy,E.severity,JSON.stringify(E.groupBy.slice(0,20)),JSON.stringify(E.labels),E.enabled?1:0,1,T,T]),this.getRule(_)}getRule(E){let _=this.controlPlane.database.query("SELECT * FROM alert_rules WHERE id=?").get(E);return _?hQ(_):void 0}listRules(E,_){return this.controlPlane.database.query(`SELECT * FROM alert_rules WHERE project_id=?${_?" AND environment_id=?":""} ORDER BY updated_at DESC`).all(E,..._?[_]:[]).map(hQ)}setRuleEnabled(E,_){this.controlPlane.database.run("UPDATE alert_rules SET enabled=?,version=version+1,updated_at=? WHERE id=?",[_?1:0,this.now(),E]);let T=this.getRule(E);if(!T)throw Error("Alert rule was not found.");return T}getAlertByDedup(E){let _=this.controlPlane.database.query("SELECT * FROM alerts WHERE dedup_key=?").get(E);return _?tz(_):void 0}getAlert(E){let _=this.controlPlane.database.query("SELECT * FROM alerts WHERE id=?").get(E);return _?tz(_):void 0}listAlerts(E,_={}){let T=["project_id=?"],r=[E];if(_.environmentId)T.push("environment_id=?"),r.push(_.environmentId);if(_.states?.length)T.push(`state IN (${_.states.map(()=>"?").join(",")})`),r.push(..._.states);return this.controlPlane.database.query(`SELECT * FROM alerts WHERE ${T.join(" AND ")} ORDER BY updated_at DESC LIMIT ?`).all(...r,Math.min(1000,_.limit??200)).map(tz)}saveAlert(E,_,T){return this.controlPlane.database.run("INSERT INTO alerts (id,rule_id,project_id,environment_id,resource_id,dedup_key,group_key,state,severity,title,evidence,failure_count,recovery_count,occurrence_count,owner_actor_id,acknowledged_by_actor_id,acknowledged_at,first_seen_at,last_seen_at,firing_at,resolved_at,silenced_until,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET state=excluded.state,severity=excluded.severity,title=excluded.title,evidence=excluded.evidence,failure_count=excluded.failure_count,recovery_count=excluded.recovery_count,occurrence_count=excluded.occurrence_count,owner_actor_id=excluded.owner_actor_id,acknowledged_by_actor_id=excluded.acknowledged_by_actor_id,acknowledged_at=excluded.acknowledged_at,last_seen_at=excluded.last_seen_at,firing_at=excluded.firing_at,resolved_at=excluded.resolved_at,silenced_until=excluded.silenced_until,updated_at=excluded.updated_at",[E.id,E.ruleId,E.projectId,E.environmentId??null,E.resourceId??null,E.dedupKey,E.groupKey,E.state,E.severity,E.title,JSON.stringify(E.evidence),E.failureCount,E.recoveryCount,E.occurrenceCount,E.ownerActorId??null,E.acknowledgedByActorId??null,E.acknowledgedAt??null,E.firstSeenAt,E.lastSeenAt,E.firingAt??null,E.resolvedAt??null,E.silencedUntil??null,E.updatedAt]),this.controlPlane.database.run("INSERT INTO alert_events (id,alert_id,type,actor_id,payload,created_at) VALUES (?,?,?,?,?,?)",[crypto.randomUUID(),E.id,_,T??null,JSON.stringify({state:E.state,severity:E.severity,evidence:E.evidence}),E.updatedAt]),this.getAlert(E.id)}acknowledge(E,_){let T=this.getAlert(E);if(!T)throw Error("Alert was not found.");let r=this.now();return this.saveAlert({...T,acknowledgedByActorId:_,acknowledgedAt:r,updatedAt:r},"acknowledged",_)}assign(E,_,T){let r=this.getAlert(E);if(!r)throw Error("Alert was not found.");let d=this.now();return this.saveAlert({...r,ownerActorId:_,updatedAt:d},"assigned",T)}silenceAlert(E,_,T){let r=this.getAlert(E);if(!r)throw Error("Alert was not found.");let d=new Date(_);if(!Number.isFinite(d.getTime())||d<=new Date)throw Error("Silence end must be in the future.");let t=this.now();return this.saveAlert({...r,state:"silenced",silencedUntil:d.toISOString(),updatedAt:t},"silenced",T)}createSilence(E){let _=new Date(E.startsAt),T=new Date(E.endsAt);if(!Number.isFinite(_.getTime())||!Number.isFinite(T.getTime())||_>=T)throw Error("Silence window is invalid.");try{new Intl.DateTimeFormat("en",{timeZone:E.timezone}).format(_)}catch{throw Error("Silence timezone is invalid.")}let r=crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO alert_silences (id,project_id,environment_id,resource_id,matcher,reason,starts_at,ends_at,timezone,created_by_actor_id,created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)",[r,E.projectId,E.environmentId??null,E.resourceId??null,JSON.stringify(E.matcher??{}),E.reason.slice(0,500),_.toISOString(),T.toISOString(),E.timezone,E.actorId??null,this.now()]),r}isSilenced(E,_,T){return this.controlPlane.database.query("SELECT * FROM alert_silences WHERE project_id=? AND starts_at<=? AND ends_at>?").all(E.projectId,T,T).some((d)=>{if(d.environment_id&&d.environment_id!==E.environmentId)return!1;if(d.resource_id&&d.resource_id!==E.resourceId)return!1;let t=Zr(d.matcher);return Object.entries(t).every(([R,h])=>_[R]===h)})}createChannel(E){if(!E.name.trim())throw Error("Notification channels require a name.");let _=crypto.randomUUID(),T=this.now(),r=E.credential?.trim();return this.controlPlane.database.run("INSERT INTO notification_channels (id,organization_id,name,kind,config,credential_ciphertext,credential_fingerprint,status,version,created_by_actor_id,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.name.trim().slice(0,100),E.kind,JSON.stringify(E.config??{}),r?this.encrypt(r):null,r?dQ(r):null,"active",1,E.actorId??null,T,T]),this.getChannel(_)}getChannel(E){let _=this.controlPlane.database.query("SELECT * FROM notification_channels WHERE id=?").get(E);return _?NQ(_):void 0}channelCredential(E){let _=this.controlPlane.database.query("SELECT credential_ciphertext FROM notification_channels WHERE id=?").get(E);return _?.credential_ciphertext?this.decrypt(String(_.credential_ciphertext)):void 0}listChannels(E){return this.controlPlane.database.query("SELECT * FROM notification_channels WHERE organization_id=? ORDER BY updated_at DESC").all(E).map(NQ)}rotateChannel(E,_){let T=this.now();this.controlPlane.database.run("UPDATE notification_channels SET credential_ciphertext=?,credential_fingerprint=?,status='active',last_error=NULL,version=version+1,updated_at=? WHERE id=?",[this.encrypt(_),dQ(_),T,E]);let r=this.getChannel(E);if(!r)throw Error("Notification channel was not found.");return r}setChannelStatus(E,_,T){this.controlPlane.database.run("UPDATE notification_channels SET status=?,last_error=?,updated_at=? WHERE id=?",[_,T?.slice(0,1000)??null,this.now(),E]);let r=this.getChannel(E);if(!r)throw Error("Notification channel was not found.");return r}markChannelTest(E,_,T){let r=this.now();return this.controlPlane.database.run("UPDATE notification_channels SET status=?,last_tested_at=?,last_error=?,updated_at=? WHERE id=?",[_?"active":"failing",r,T?.slice(0,1000)??null,r,E]),this.getChannel(E)}createRoute(E){let _=crypto.randomUUID(),T=this.now();return this.controlPlane.database.run("INSERT INTO notification_routes (id,organization_id,name,priority,matcher,channel_ids,quiet_hours,group_wait_seconds,reminder_seconds,escalation,template,rate_limit_per_minute,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.name.trim().slice(0,100),E.priority,JSON.stringify(E.matcher),JSON.stringify(E.channelIds),E.quietHours?JSON.stringify(E.quietHours):null,Nt(E.groupWaitSeconds,30,0,86400),E.reminderSeconds??null,JSON.stringify(E.escalation),E.template?.trim().slice(0,2000)??null,Nt(E.rateLimitPerMinute,60,1,1e4),E.enabled?1:0,1,T,T]),this.getRoute(_)}getRoute(E){let _=this.controlPlane.database.query("SELECT * FROM notification_routes WHERE id=?").get(E);return _?SQ(_):void 0}listRoutes(E){return this.controlPlane.database.query("SELECT * FROM notification_routes WHERE organization_id=? ORDER BY priority DESC,created_at ASC").all(E).map(SQ)}countRouteDeliveries(E,_){return Number(this.controlPlane.database.query("SELECT COUNT(*) count FROM notification_deliveries WHERE route_id=? AND created_at>=?").get(E,_)?.count??0)}setRouteEnabled(E,_){this.controlPlane.database.run("UPDATE notification_routes SET enabled=?,version=version+1,updated_at=? WHERE id=?",[_?1:0,this.now(),E]);let T=this.getRoute(E);if(!T)throw Error("Notification route was not found.");return T}createDelivery(E){let _=this.controlPlane.database.query("SELECT * FROM notification_deliveries WHERE idempotency_key=?").get(E.idempotencyKey);if(_)return Rz(_);let T=crypto.randomUUID(),r=this.now();return this.controlPlane.database.run("INSERT INTO notification_deliveries (id,alert_id,channel_id,route_id,event_type,idempotency_key,state,attempt,max_attempts,next_attempt_at,payload,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.alertId??null,E.channelId,E.routeId??null,E.eventType,E.idempotencyKey,"pending",0,Nt(E.maxAttempts,3,1,10),E.nextAttemptAt??null,JSON.stringify(E.payload),r,r]),this.getDelivery(T)}getDelivery(E){let _=this.controlPlane.database.query("SELECT * FROM notification_deliveries WHERE id=?").get(E);return _?Rz(_):void 0}listDeliveries(E={}){let _=[],T=[];if(E.alertId)_.push("alert_id=?"),T.push(E.alertId);if(E.states?.length)_.push(`state IN (${E.states.map(()=>"?").join(",")})`),T.push(...E.states);return this.controlPlane.database.query(`SELECT * FROM notification_deliveries${_.length?" WHERE "+_.join(" AND "):""} ORDER BY updated_at DESC LIMIT ?`).all(...T,Math.min(1000,E.limit??200)).map(Rz)}updateDelivery(E,_){return this.controlPlane.database.run("UPDATE notification_deliveries SET state=?,attempt=?,next_attempt_at=?,response_status=?,error=?,delivered_at=?,updated_at=? WHERE id=?",[_.state,_.attempt,_.nextAttemptAt??null,_.responseStatus??null,_.error?.slice(0,1000)??null,_.deliveredAt??null,this.now(),E]),this.getDelivery(E)}}await tT();import{createHash as Za}from"node:crypto";function qa(E,_,T){if(E==="gt")return _>T;if(E==="gte")return _>=T;if(E==="lt")return _<T;if(E==="lte")return _<=T;return _===T}function ga(E,_,T){if(_.status==="no_data"||_.status==null&&_.value==null)return;if(E.operator==="unhealthy")return _.status==="unhealthy";if(_.value==null||E.threshold==null)return;return qa(E.operator,_.value,T&&E.recoveryThreshold!=null?E.recoveryThreshold:E.threshold)}function xa(E,_){let T=Object.fromEntries(E.groupBy.flatMap((d)=>_.group?.[d]==null?[]:[[d,String(_.group[d])]]));return{key:Object.entries(T).sort(([d],[t])=>d.localeCompare(t)).map(([d,t])=>`${d}=${t}`).join(",")||"default",values:T}}function ba(E,_){return Za("sha256").update(`${E}\x00${_}`).digest("hex")}class WA{store;constructor(E){this.store=E}evaluate(E,_){if(!E.enabled)return{transition:"ignored",notify:!1};let T=xa(E,_),r=ba(E.id,T.key),d=this.store.getAlertByDedup(r),t=d?.state==="firing"||d?.state==="silenced",R=ga(E,_,t);if(R==null&&E.noDataPolicy==="ignore")return{alert:d,transition:"ignored",notify:!1};let h=R??E.noDataPolicy==="firing",N=R==null&&E.noDataPolicy==="pending",S=new Date(_.timestamp).toISOString(),A=bE({..._.evidence??{},..._.value==null?{}:{value:_.value},..._.status?{healthStatus:_.status}:{},group:T.values}),L;if(!d){let I=h||N?1:0,C=h&&I>=E.consecutive?"firing":"pending";L={id:crypto.randomUUID(),ruleId:E.id,projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,dedupKey:r,groupKey:T.key,state:C,severity:E.severity,title:E.name,evidence:A,failureCount:I,recoveryCount:0,occurrenceCount:1,firstSeenAt:S,lastSeenAt:S,firingAt:C==="firing"?S:void 0,updatedAt:S}}else if(h||N){let I=d.state==="resolved",C=(I?0:d.failureCount)+1,e=d.silencedUntil&&new Date(d.silencedUntil)>new Date(S),z=N?"pending":C>=E.consecutive?"firing":"pending";if((e||this.store.isSilenced(E,T.values,S))&&z==="firing")z="silenced";L={...d,state:z,severity:E.severity,title:E.name,evidence:A,failureCount:C,recoveryCount:0,occurrenceCount:d.occurrenceCount+1,firstSeenAt:I?S:d.firstSeenAt,lastSeenAt:S,firingAt:z==="firing"||z==="silenced"?d.firingAt??S:void 0,resolvedAt:void 0,updatedAt:S}}else{let I=d.recoveryCount+1,C=I>=E.recoveryConsecutive;L={...d,state:C?"resolved":d.state,evidence:A,failureCount:C?0:d.failureCount,recoveryCount:I,lastSeenAt:S,resolvedAt:C?S:d.resolvedAt,silencedUntil:C?void 0:d.silencedUntil,updatedAt:S}}let O=d?.state!==L.state,c=L.state==="pending"?"pending":L.state==="firing"?O?"firing":"updated":L.state==="silenced"?"silenced":O?"resolved":"updated";return{alert:this.store.saveAlert(L,O||!d?c:"observed"),transition:c,notify:c==="firing"||c==="resolved"}}}import{createHmac as ka}from"node:crypto";function ua(E,_){let T=Object.fromEntries(new Intl.DateTimeFormat("en-US",{timeZone:_,weekday:"short",hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(E).map((d)=>[d.type,d.value])),r=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"];return{minute:Number(T.hour)*60+Number(T.minute),weekday:r.indexOf(T.weekday)}}function LQ(E){let _=/^(\d{2}):(\d{2})$/.exec(E);if(!_)throw Error("Quiet hours require HH:MM times.");let T=Number(_[1])*60+Number(_[2]);if(Number(_[1])>23||Number(_[2])>59)throw Error("Quiet hours require valid HH:MM times.");return T}function OQ(E,_){if(!E.quietHours)return!1;let T=ua(_,E.quietHours.timezone),r=LQ(E.quietHours.start),d=LQ(E.quietHours.end);if(E.quietHours.weekdays?.length&&!E.quietHours.weekdays.includes(T.weekday))return!1;return r<=d?T.minute>=r&&T.minute<d:T.minute>=r||T.minute<d}function va(E,_,T){let r=E.matcher;return(!r.projectIds?.length||r.projectIds.includes(_.projectId))&&(!r.environmentIds?.length||!!_.environmentId&&r.environmentIds.includes(_.environmentId))&&(!r.resourceIds?.length||!!_.resourceId&&r.resourceIds.includes(_.resourceId))&&(!r.severities?.length||r.severities.includes(_.severity))&&(!r.eventTypes?.length||r.eventTypes.includes(T))}function na(E){if(!E)return{};try{let _=JSON.parse(E);return _&&typeof _==="object"?_:{value:E}}catch{return{value:E}}}function la(E,_,T){let r={severity:E.severity.toUpperCase(),title:E.title,state:E.state,event:_,projectId:E.projectId,environmentId:E.environmentId??"",resourceId:E.resourceId??"",groupKey:E.groupKey};return(T?.trim()||"[{{severity}}] {{title}} · {{state}}").replace(/\{\{(severity|title|state|event|projectId|environmentId|resourceId|groupKey)\}\}/g,(d,t)=>r[t]).slice(0,2000)}function Nz(E,_,T){return{schemaVersion:1,event:_,notificationText:la(E,_,T),alert:{id:E.id,state:E.state,severity:E.severity,title:E.title,projectId:E.projectId,environmentId:E.environmentId??null,resourceId:E.resourceId??null,groupKey:E.groupKey,firstSeenAt:E.firstSeenAt,lastSeenAt:E.lastSeenAt,firingAt:E.firingAt??null,resolvedAt:E.resolvedAt??null,evidence:E.evidence}}}class HA{store;options;fetchImpl;constructor(E,_={}){this.store=E;this.options=_;this.fetchImpl=_.fetchImpl??globalThis.fetch}now(){return this.options.now?.()??new Date}preview(E,_,T){let r=[];for(let d of this.store.listRoutes(E)){if(!d.enabled||!va(d,_,T))continue;let t=[];for(let R of d.channelIds){let h=this.store.getChannel(R);if(h?.status==="active")t.push(h)}r.push({route:d,channels:t,quiet:OQ(d,this.now())})}return r}enqueue(E,_,T){let r=T==="resolved"?_.resolvedAt:T==="firing"?_.firingAt:_.updatedAt,d=[];for(let t of this.preview(E,_,T)){if(t.quiet&&T!=="resolved")continue;let R=T==="resolved"||t.route.groupWaitSeconds===0?void 0:new Date(this.now().getTime()+t.route.groupWaitSeconds*1000).toISOString(),h=T==="resolved"?Number.POSITIVE_INFINITY:Math.max(0,t.route.rateLimitPerMinute-this.store.countRouteDeliveries(t.route.id,new Date(this.now().getTime()-60000).toISOString()));for(let N of t.channels){if(h<=0)break;d.push(this.store.createDelivery({alertId:_.id,channelId:N.id,routeId:t.route.id,eventType:T,idempotencyKey:`${_.id}:${T}:${r}:${N.id}`,payload:Nz(_,T,t.route.template),nextAttemptAt:R})),h--}}return d}enqueueRemindersAndEscalations(E,_){let T=this.now(),r=[];for(let d of _.filter((t)=>t.state==="firing"&&!t.acknowledgedAt&&t.firingAt)){let t=Math.max(0,(T.getTime()-new Date(d.firingAt).getTime())/1000);for(let R of this.preview(E,d,"reminder")){if(R.quiet)continue;if(R.route.reminderSeconds&&t>=R.route.reminderSeconds){let h=Math.floor(t/R.route.reminderSeconds);for(let N of R.channels)r.push(this.store.createDelivery({alertId:d.id,channelId:N.id,routeId:R.route.id,eventType:"reminder",idempotencyKey:`${d.id}:reminder:${R.route.id}:${h}:${N.id}`,payload:Nz(d,"reminder")}))}for(let[h,N]of R.route.escalation.entries())if(t>=N.afterSeconds){for(let S of N.channelIds)if(this.store.getChannel(S)?.status==="active")r.push(this.store.createDelivery({alertId:d.id,channelId:S,routeId:R.route.id,eventType:"escalation",idempotencyKey:`${d.id}:escalation:${R.route.id}:${h}:${S}`,payload:Nz(d,"escalation")}))}}}return r}async send(E,_){let T=na(this.store.channelCredential(E.id)),r=typeof _.notificationText==="string"?_.notificationText:`[${String(_.alert?.severity??"info").toUpperCase()}] ${String(_.alert?.title??"ts-cloud alert")} · ${String(_.alert?.state??_.event)}`;try{if(E.kind==="email"){if(!this.options.emailImpl)return{ok:!1,error:"Email adapter is not configured."};return await this.options.emailImpl({to:E.config.to,from:E.config.from,subject:`[ts-cloud] ${String(_.alert?.title??_.event)}`,text:`${r}
 
-${JSON.stringify(_,null,2)}`}),{ok:!0,status:202}}let d=T.url??T.value,t=_,R={"content-type":"application/json"};if(E.kind==="slack")t={text:r};if(E.kind==="discord")t={content:r};if(E.kind==="teams")t={text:r};if(E.kind==="telegram")d=`https://api.telegram.org/bot${T.botToken??T.value}/sendMessage`,t={chat_id:E.config.chatId,text:r};if(!d||!/^https:\/\//.test(d))return{ok:!1,error:"Channel endpoint is unavailable or not HTTPS."};let h=JSON.stringify(t);if(E.kind==="webhook"&&T.signingSecret){let A=Math.floor(this.now().getTime()/1000).toString();R["x-ts-cloud-timestamp"]=A,R["x-ts-cloud-signature"]=`v1=${ka("sha256",T.signingSecret).update(`${A}.${h}`).digest("hex")}`}let N=new AbortController,S=setTimeout(()=>N.abort(),1e4);try{let A=await this.fetchImpl(d,{method:"POST",headers:R,body:h,signal:N.signal});return A.ok?{ok:!0,status:A.status}:{ok:!1,status:A.status,error:`Channel returned HTTP ${A.status}.`}}finally{clearTimeout(S)}}catch(d){return{ok:!1,error:d instanceof Error?d.message:String(d)}}}async deliver(E){let _=this.store.getDelivery(E);if(!_)throw Error("Notification delivery was not found.");if(_.state==="delivered"||_.state==="dead"||_.nextAttemptAt&&_.nextAttemptAt>this.now().toISOString())return _;let T=this.store.getChannel(_.channelId);if(!T||T.status==="disabled"||T.status==="paused")return this.store.updateDelivery(E,{state:"failed",attempt:_.attempt+1,error:"Notification channel is unavailable."});let r=_.attempt+1,d=await this.send(T,_.payload);if(d.ok)return this.store.setChannelStatus(T.id,"active"),this.store.updateDelivery(E,{state:"delivered",attempt:r,responseStatus:d.status,deliveredAt:this.now().toISOString()});let R=!(!d.status||d.status===429||d.status>=500)||r>=_.maxAttempts,h=R?void 0:new Date(this.now().getTime()+Math.min(3600000,30000*2**(r-1))).toISOString();return this.store.setChannelStatus(T.id,"failing",d.error),this.store.updateDelivery(E,{state:R?"dead":"retrying",attempt:r,nextAttemptAt:h,responseStatus:d.status,error:d.error})}async deliverAll(E){return Promise.all(E.map((_)=>this.deliver(_.id)))}async retryDue(){let E=this.now().toISOString(),_=this.store.listDeliveries({states:["pending","retrying"]}).filter((T)=>!T.nextAttemptAt||T.nextAttemptAt<=E);return this.deliverAll(_)}async testChannel(E){let _=this.store.getChannel(E);if(!_)throw Error("Notification channel was not found.");let T=await this.send(_,{schemaVersion:1,event:"test",message:"ts-cloud notification channel test. No incident was created."});return this.store.markChannelTest(E,T.ok,T.error),T}}import{lookup as ia}from"node:dns/promises";import{connect as aa}from"node:net";async function ma(E,_){let T=Bun.spawn(E,{stdout:"pipe",stderr:"pipe"}),r=setTimeout(()=>T.kill(),_);try{return{exitCode:await T.exited,stdout:await new Response(T.stdout).text(),stderr:await new Response(T.stderr).text()}}finally{clearTimeout(r)}}class St{store;options;constructor(E,_={}){this.store=E;this.options=_}now(){return this.options.now?.()??new Date}async probe(E){let _=performance.now(),T=this.now().toISOString(),r=this.options.agent??"local";try{if(E.kind==="http"){let R=new URL(E.target),h=performance.now();await(this.options.lookupImpl??ia)(R.hostname);let N=performance.now()-h,S=new AbortController,A=setTimeout(()=>S.abort(),E.timeoutSeconds*1000);try{let L=performance.now(),O=await(this.options.fetchImpl??fetch)(R.toString(),{method:E.config.method??"GET",headers:E.config.headers,signal:S.signal,redirect:"manual"}),c=performance.now()-L,$=E.config.expectedBody?await O.text():"",I=E.config.expectedStatuses??[200,201,202,204],C=I.includes(O.status)&&(!E.config.expectedBody||$.includes(E.config.expectedBody));return{checkId:E.id,status:C?"healthy":"unhealthy",agent:r,region:this.options.region,statusCode:O.status,message:C?void 0:`Expected ${I.join("/")} and configured body match.`,timings:{dnsMs:N,ttfbMs:c,totalMs:performance.now()-_},checkedAt:T}}finally{clearTimeout(A)}}if(E.kind==="tcp"){let R=Number(E.config.port);if(!Number.isInteger(R)||R<1||R>65535)throw Error("TCP health check requires a valid port.");let h=performance.now();return await new Promise((N,S)=>{let A=aa({host:E.target,port:R}),L=setTimeout(()=>{A.destroy(),S(Error("TCP health check timed out."))},E.timeoutSeconds*1000);A.once("connect",()=>{clearTimeout(L),A.destroy(),N()}),A.once("error",(O)=>{clearTimeout(L),S(O)})}),{checkId:E.id,status:"healthy",agent:r,region:this.options.region,timings:{connectMs:performance.now()-h,totalMs:performance.now()-_},checkedAt:T}}let d=E.config.command??[];if(!d.length)throw Error("Command health check is not configured.");let t=await(this.options.commandImpl??ma)(d,E.timeoutSeconds*1000);return{checkId:E.id,status:t.exitCode===0?"healthy":"unhealthy",agent:r,region:this.options.region,message:t.exitCode===0?void 0:(t.stderr||t.stdout||`Command exited ${t.exitCode}`).slice(0,1000),timings:{totalMs:performance.now()-_},checkedAt:T}}catch(d){return{checkId:E.id,status:"unhealthy",agent:r,region:this.options.region,message:(d instanceof Error?d.message:String(d)).slice(0,1000),timings:{totalMs:performance.now()-_},checkedAt:T}}}async run(E){return this.store.appendHealthResult(await this.probe(E))}async runAndEvaluate(E){let _=await this.run(E),T=new WA(this.store),r=this.store.listRules(E.projectId,E.environmentId).filter((d)=>d.healthCheckId===E.id);return{result:_,evaluations:r.map((d)=>T.evaluate(d,{status:_.status,timestamp:_.checkedAt,group:{agent:_.agent,region:_.region??""},evidence:{healthResultId:_.id,statusCode:_.statusCode??null,message:_.message??null,timings:_.timings}}))}}}var sa=Object.freeze({rawDays:30,downsampleAfterDays:7,downsampleBucketMs:3600000,maxRecords:1e6,samplingRate:1,collectLogs:!0,collectTraces:!0,collectRequestAnalytics:!0,estimatedStorageUsdPerGbMonth:0});function ID(E,_,T,r){let d=Number(E);return Number.isFinite(d)?Math.min(r,Math.max(T,Math.floor(d))):_}function c9(E,_,T,r){let d=Number(E);return Number.isFinite(d)?Math.min(r,Math.max(T,d)):_}function Sz(E,_){return typeof E==="boolean"?E:_}function U9(E,_={...sa}){let T=E&&typeof E==="object"&&!Array.isArray(E)?E:{},r=ID(T.rawDays,_.rawDays,1,3650),d=ID(T.downsampleAfterDays,_.downsampleAfterDays,1,r);return{rawDays:r,downsampleAfterDays:d,downsampleBucketMs:ID(T.downsampleBucketMs,_.downsampleBucketMs,60000,86400000),maxRecords:ID(T.maxRecords,_.maxRecords,1000,1e8),samplingRate:c9(T.samplingRate,_.samplingRate,0.01,1),collectLogs:Sz(T.collectLogs,_.collectLogs),collectTraces:Sz(T.collectTraces,_.collectTraces),collectRequestAnalytics:Sz(T.collectRequestAnalytics,_.collectRequestAnalytics),estimatedStorageUsdPerGbMonth:c9(T.estimatedStorageUsdPerGbMonth,_.estimatedStorageUsdPerGbMonth,0,1e4)}}function $9(E){return`telemetry.policy:${E}`}function tR(E,_){return U9(E.getSetting($9(_)))}function CD(E,_,T){let r=U9(T,tR(E,_));return E.setSetting($9(_),r),r}function wD(E,_){return Number((Math.max(0,E)/1073741824*_.estimatedStorageUsdPerGbMonth).toFixed(4))}var pa=/(?:authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key|session)/i,oa=/\b(?:authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)\s*[=:]\s*[^\s,;&\[]+/gi,Em=/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,_m=/\b(?:\d{1,3}\.){3}\d{1,3}\b/g;function Az(E,_={}){let T=E.replace(/([?&][^=&#\s]+)=([^&#\s]*)/g,"$1=[REDACTED]").replace(oa,"[REDACTED]");if(_.redactEmail!==!1)T=T.replace(Em,"[EMAIL]");if(_.redactIp)T=T.replace(_m,"[IP]");for(let r of _.patterns??[])T=T.replace(r,"[REDACTED]");return T}function XO(E,_={},T){if(T&&pa.test(T))return"[REDACTED]";if(E===null||typeof E==="boolean"||typeof E==="number")return E;if(typeof E==="string")return Az(E,_);if(Array.isArray(E))return E.map((r)=>XO(r,_));if(E&&typeof E==="object"){let r={};for(let[d,t]of Object.entries(E))r[d]=XO(t,_,d);return r}return String(E??"")}function eD(E){if(!E)return;return E.split("?",1)[0].replace(/\b[0-9a-f]{8}-[0-9a-f-]{27,}\b/gi,":id").replace(/\/(?:(?:\d{4,})|(?:[0-9a-f]{16,}))(?:\/|$)/gi,(T)=>T.endsWith("/")?"/:id/":"/:id").slice(0,512)}var D9=65536,Tm=2678400000,rm=new Set(["metric","log","trace","request","event"]);function HT(E){return typeof E==="string"?E:void 0}function JO(E){return E==null?void 0:Number(E)}function dm(E){if(typeof E!=="string")return{};try{return JSON.parse(E)}catch{return{}}}function XD(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:HT(E.environment_id),resourceId:HT(E.resource_id),kind:String(E.kind),source:String(E.source),name:String(E.name),timestamp:String(E.timestamp),observedAt:String(E.observed_at),value:JO(E.value),unit:HT(E.unit),level:HT(E.level),message:HT(E.message),durationMs:JO(E.duration_ms),statusCode:JO(E.status_code),method:HT(E.method),host:HT(E.host),pathTemplate:HT(E.path_template),bytesIn:JO(E.bytes_in),bytesOut:JO(E.bytes_out),region:HT(E.region),cacheResult:HT(E.cache_result),upstream:HT(E.upstream),traceId:HT(E.trace_id),requestId:HT(E.request_id),deploymentId:HT(E.deployment_id),releaseId:HT(E.release_id),workloadId:HT(E.workload_id),sampled:Number(E.sampled)===1,attributes:dm(E.attributes),ingestedBytes:Number(E.ingested_bytes)}}function PA(E,_){let T=new Date(E);if(!E||!Number.isFinite(T.getTime()))throw Error(`${_} must be a valid ISO-8601 instant.`);return T}function JD(E){let _=PA(E.from,"from"),T=PA(E.to,"to");if(_>=T)throw Error("Telemetry from must be earlier than to.");if(T.getTime()-_.getTime()>Tm)throw Error("Telemetry queries are limited to 31 days.");return{from:_,to:T}}function I9(E){if(!E)return;try{let _=JSON.parse(Buffer.from(E,"base64url").toString("utf8"));if(typeof _?.timestamp!=="string"||typeof _?.id!=="string")throw Error();return _}catch{throw Error("Telemetry cursor is invalid.")}}function zD(E){return E?Buffer.from(JSON.stringify({timestamp:E.timestamp,id:E.id})).toString("base64url"):void 0}function tm(E,_){if(!E.length)return;let T=[...E].sort((d,t)=>d-t),r=Math.max(0,Math.min(T.length-1,Math.ceil(_/100*T.length)-1));return T[r]}function zO(E,_){if(_==="count")return E.length;if(!E.length)return;if(_==="sum")return E.reduce((T,r)=>T+r,0);if(_==="avg")return E.reduce((T,r)=>T+r,0)/E.length;if(_==="min")return Math.min(...E);if(_==="max")return Math.max(...E);return tm(E,Number(_.slice(1)))}function Rm(E,_="UTC"){try{return new Intl.DateTimeFormat("en-US",{timeZone:_,month:"short",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZoneName:"short"}).format(E)}catch{throw Error(`Unknown telemetry timezone: ${_}`)}}class RR{controlPlane;options;constructor(E,_={}){this.controlPlane=E;this.options=_}now(){return this.options.now?.()??new Date}append(E){if(!rm.has(E.kind))throw Error(`Unsupported telemetry kind: ${E.kind}`);let _=PA(E.timestamp,"timestamp").toISOString(),T=E.observedAt?PA(E.observedAt,"observedAt").toISOString():this.now().toISOString(),r=XO(E.attributes??{},this.options.redaction),d=E.message?Az(E.message,this.options.redaction).slice(0,32768):void 0,t=eD(E.pathTemplate),R=E.id??crypto.randomUUID(),h=JSON.stringify({...E,id:R,timestamp:_,observedAt:T,attributes:r,message:d,pathTemplate:t}),N=Buffer.byteLength(h);if(N>D9)throw Error(`Telemetry records are limited to ${D9} bytes.`);return this.controlPlane.database.run("INSERT OR IGNORE INTO telemetry_records (id, project_id, environment_id, resource_id, kind, source, name, timestamp, observed_at, value, unit, level, message, duration_ms, status_code, method, host, path_template, bytes_in, bytes_out, region, cache_result, upstream, trace_id, request_id, deployment_id, release_id, workload_id, sampled, attributes, ingested_bytes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[R,E.projectId,E.environmentId??null,E.resourceId??null,E.kind,E.source.slice(0,128),E.name.slice(0,256),_,T,E.value??null,E.unit??null,E.level??null,d??null,E.durationMs??null,E.statusCode??null,E.method?.slice(0,16)??null,E.host?.slice(0,256)??null,t??null,E.bytesIn??null,E.bytesOut??null,E.region?.slice(0,64)??null,E.cacheResult?.slice(0,64)??null,E.upstream?.slice(0,256)??null,E.traceId?.slice(0,256)??null,E.requestId?.slice(0,256)??null,E.deploymentId?.slice(0,256)??null,E.releaseId?.slice(0,256)??null,E.workloadId?.slice(0,512)??null,E.sampled===!1?0:1,JSON.stringify(r),N]),this.get(R)}appendMany(E){if(E.length>1e4)throw Error("Telemetry batches are limited to 10,000 records.");return this.controlPlane.database.transaction((T)=>T.map((r)=>this.append(r)))(E)}get(E){let _=this.controlPlane.database.query("SELECT * FROM telemetry_records WHERE id=?").get(E);return _?XD(_):void 0}query(E){let{from:_,to:T}=JD(E),r=Math.min(5000,Math.max(1,Math.floor(E.limit??500))),d=["project_id=?","timestamp>=?","timestamp<?"],t=[E.projectId,_.toISOString(),T.toISOString()],R=(e,z)=>{if(z)d.push(`${e}=?`),t.push(z)},h=(e,z)=>{let F=[...new Set(z??[])].slice(0,100);if(F.length)d.push(`${e} IN (${F.map(()=>"?").join(",")})`),t.push(...F)};if(R("environment_id",E.environmentId),h("resource_id",E.resourceIds),h("kind",E.kinds),h("name",E.names),h("source",E.sources),h("level",E.levels),R("trace_id",E.traceId),R("request_id",E.requestId),R("deployment_id",E.deploymentId),R("release_id",E.releaseId),R("workload_id",E.workloadId),E.text)d.push("(message LIKE ? OR name LIKE ?)"),t.push(`%${E.text.slice(0,256)}%`,`%${E.text.slice(0,256)}%`);let N=I9(E.cursor);if(N)d.push("(timestamp<? OR (timestamp=? AND id<?))"),t.push(N.timestamp,N.timestamp,N.id);let S=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE ${d.join(" AND ")} ORDER BY timestamp DESC, id DESC LIMIT ?`).all(...t,r+1),A=S.slice(0,r).map(XD),L=S.length>r,O=new Map;for(let e of A)O.set(e.source,[...O.get(e.source)??[],e]);let c=this.now().getTime(),$=[...O].map(([e,z])=>{let F=z.reduce((y,Y)=>Y.observedAt>y?Y.observedAt:y,z[0].observedAt),B=c-new Date(F).getTime();return{source:e,latestAt:F,freshness:B<=120000?"live":B<=600000?"stale":"unavailable",count:z.length}}),I=Math.max(60000,(T.getTime()-_.getTime())/100),C=[...O].flatMap(([e,z])=>{let F=[...new Set(z.map((B)=>new Date(B.timestamp).getTime()))].sort((B,y)=>B-y);return F.slice(1).flatMap((B,y)=>B-F[y]>I?[{from:new Date(F[y]).toISOString(),to:new Date(B).toISOString(),source:e}]:[])});return{records:A,nextCursor:L?zD(A.at(-1)):void 0,truncated:L,scannedRange:{from:_.toISOString(),to:T.toISOString()},sources:$,gaps:C}}tail(E,_){let{from:T,to:r}=JD(E),d=Math.min(1000,Math.max(1,Math.floor(E.limit??200))),t=["project_id=?","timestamp>=?","timestamp<?"],R=[E.projectId,T.toISOString(),r.toISOString()],h=(O,c)=>{if(c)t.push(`${O}=?`),R.push(c)},N=(O,c)=>{let $=[...new Set(c??[])].slice(0,100);if($.length)t.push(`${O} IN (${$.map(()=>"?").join(",")})`),R.push(...$)};if(h("environment_id",E.environmentId),N("resource_id",E.resourceIds),N("kind",E.kinds),N("name",E.names),N("source",E.sources),N("level",E.levels),h("trace_id",E.traceId),h("request_id",E.requestId),h("deployment_id",E.deploymentId),h("release_id",E.releaseId),h("workload_id",E.workloadId),E.text)t.push("(message LIKE ? OR name LIKE ?)"),R.push(`%${E.text.slice(0,256)}%`,`%${E.text.slice(0,256)}%`);let S=I9(_);if(S)t.push("(timestamp>? OR (timestamp=? AND id>?))"),R.push(S.timestamp,S.timestamp,S.id);let A=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE ${t.join(" AND ")} ORDER BY timestamp ASC, id ASC LIMIT ?`).all(...R,d+1),L=A.slice(0,d).map(XD);return{records:L,cursor:zD(L.at(-1))??_,truncated:A.length>d}}series(E){let{from:_,to:T}=JD(E),r=Math.min(86400000,Math.max(1000,Math.floor(E.bucketMs)));if((T.getTime()-_.getTime())/r>2000)throw Error("Telemetry series are limited to 2,000 buckets.");let d=this.query({...E,kinds:["metric"],limit:5000,cursor:void 0}),t=new Map;for(let h of d.records)t.set(`${h.source}\x00${h.name}`,[...t.get(`${h.source}\x00${h.name}`)??[],h]);let R=(h,N,S)=>{let A=new Map;for(let O of h){let c=N.getTime()+Math.floor((new Date(O.timestamp).getTime()-N.getTime())/r)*r;if(c>=N.getTime()&&c<S.getTime()&&O.value!=null)A.set(c,[...A.get(c)??[],O.value])}let L=[];for(let O=N.getTime();O<S.getTime();O+=r){let c=A.get(O)??[],$=zO(c,E.aggregation);L.push({timestamp:new Date(O).toISOString(),label:Rm(new Date(O),E.timezone),value:$,count:c.length,gap:$==null})}return L};return[...t].map(([h,N])=>{let[S,A]=h.split("\x00"),L={name:A,source:S,unit:N.find((O)=>O.unit)?.unit,aggregation:E.aggregation,bucketMs:r,points:R(N,_,T)};if(E.compareFrom&&E.compareTo){let O=this.query({...E,from:E.compareFrom,to:E.compareTo,kinds:["metric"],limit:5000,cursor:void 0}).records.filter((c)=>c.source===S&&c.name===A);L.comparison=R(O,PA(E.compareFrom,"compareFrom"),PA(E.compareTo,"compareTo"))}return L})}status(E,_,T=30,r=1,d){let t=[E],R=_?" AND environment_id=?":"";if(_)t.push(_);let h=[...new Set(d??[])].slice(0,100);if(d&&h.length===0)return[];let N=d?` AND resource_id IN (${h.map(()=>"?").join(",")||"''"})`:"";t.push(...h);let S=this.controlPlane.database.query(`SELECT source, MAX(latest_observed_at) latest, SUM(ingested_bytes) bytes, SUM(record_count) count, MIN(first_observed_at) first FROM telemetry_source_rollups WHERE project_id=?${R}${N} GROUP BY source`).all(...t),A=this.now().getTime();return S.map((L)=>{let O=String(L.latest),c=Math.max(0,Math.floor((A-new Date(O).getTime())/1000)),$=Math.max(1,(new Date(O).getTime()-new Date(String(L.first)).getTime())/86400000);return{source:String(L.source),freshness:c<=120?"live":c<=600?"stale":"unavailable",lastObservedAt:O,lagSeconds:c,samplingRate:r,retentionDays:T,estimatedDailyBytes:Math.round(Number(L.bytes)/$)}})}saveQuery(E,_,T,r){let d=T.trim().slice(0,80);if(!d)throw Error("Saved telemetry queries require a name.");if(JD(r),r.projectId!==E)throw Error("Saved telemetry queries cannot cross project scope.");let t=this.now().toISOString(),R=JSON.stringify(XO(r,this.options.redaction));if(Buffer.byteLength(R)>16384)throw Error("Saved telemetry queries are limited to 16 KB.");let h=this.controlPlane.database.query("SELECT * FROM telemetry_saved_queries WHERE project_id=? AND actor_id IS ? AND name=?").get(E,_??null,d),N=h?String(h.id):crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO telemetry_saved_queries (id, project_id, actor_id, name, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?) ON CONFLICT(project_id, actor_id, name) DO UPDATE SET query=excluded.query, updated_at=excluded.updated_at",[N,E,_??null,d,R,h?String(h.created_at):t,t]),{id:N,projectId:E,actorId:_,name:d,query:JSON.parse(R),createdAt:h?String(h.created_at):t,updatedAt:t}}listSavedQueries(E,_){return this.controlPlane.database.query("SELECT * FROM telemetry_saved_queries WHERE project_id=? AND actor_id IS ? ORDER BY updated_at DESC").all(E,_??null).map((T)=>({id:String(T.id),projectId:String(T.project_id),actorId:HT(T.actor_id),name:String(T.name),query:JSON.parse(String(T.query)),createdAt:String(T.created_at),updatedAt:String(T.updated_at)}))}deleteSavedQuery(E,_,T){return this.controlPlane.database.run("DELETE FROM telemetry_saved_queries WHERE id=? AND project_id=? AND actor_id IS ?",[T,E,_??null]).changes>0}downsample(E,_){let T=Math.min(86400000,Math.max(60000,Math.floor(E.downsampleBucketMs))),r=new Date(this.now().getTime()-Math.max(1,E.downsampleAfterDays)*86400000).toISOString(),d=new Date(this.now().getTime()-Math.max(1,E.rawDays)*86400000).toISOString(),t=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE kind='metric' AND source NOT LIKE '%:rollup' AND timestamp>=? AND timestamp<?${_?" AND project_id=?":""} ORDER BY timestamp ASC LIMIT 50001`).all(d,r,..._?[_]:[]);if(t.length>50000)throw Error("Telemetry downsampling is limited to 50,000 raw points per pass; run compaction more frequently.");let R=t.map(XD),h=new Map;for(let S of R){let A=Math.floor(new Date(S.timestamp).getTime()/T)*T,L=JSON.stringify([S.projectId,S.environmentId??"",S.resourceId??"",S.source,S.name,S.unit??"",A]);h.set(L,[...h.get(L)??[],S])}return this.controlPlane.database.transaction(()=>{for(let S=0;S<R.length;S+=500){let A=R.slice(S,S+500).map((L)=>L.id);if(A.length)this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE id IN (${A.map(()=>"?").join(",")})`,A)}for(let[S,A]of h){let[L,O,c,$,I,C,e]=JSON.parse(S),z=A.flatMap((F)=>F.value==null?[]:[F.value]);this.append({projectId:L,environmentId:O||void 0,resourceId:c||void 0,kind:"metric",source:`${$}:rollup`,name:I,unit:C||void 0,timestamp:new Date(e).toISOString(),value:zO(z,"avg"),attributes:{downsampled:!0,count:z.length,min:zO(z,"min"),max:zO(z,"max"),p95:zO(z,"p95"),bucketMs:T}})}})(),{compacted:R.length,rollups:h.size}}enforceRetention(E,_){let T=this.downsample(E,_),r=Math.min(3650,Math.max(1,Math.floor(E.rawDays))),d=new Date(this.now().getTime()-r*86400000).toISOString(),t=_?" AND project_id=?":"",R=this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE timestamp<?${t}`,_?[d,_]:[d]).changes,h=Number(this.controlPlane.database.query(`SELECT MAX(0, COUNT(*)-?) excess FROM telemetry_records${_?" WHERE project_id=?":""}`).get(E.maxRecords,..._?[_]:[])?.excess??0);if(h>0)this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE id IN (SELECT id FROM telemetry_records${_?" WHERE project_id=?":""} ORDER BY timestamp ASC LIMIT ?)`,_?[_,h]:[h]);return this.rebuildStatusRollups(_),{deleted:R+h,...T}}rebuildStatusRollups(E){let _=E?" WHERE project_id=?":"",T=E?[E]:[];this.controlPlane.database.transaction(()=>{this.controlPlane.database.run(`DELETE FROM telemetry_source_rollups${_}`,T),this.controlPlane.database.run(`INSERT INTO telemetry_source_rollups (
+${JSON.stringify(_,null,2)}`}),{ok:!0,status:202}}let d=T.url??T.value,t=_,R={"content-type":"application/json"};if(E.kind==="slack")t={text:r};if(E.kind==="discord")t={content:r};if(E.kind==="teams")t={text:r};if(E.kind==="telegram")d=`https://api.telegram.org/bot${T.botToken??T.value}/sendMessage`,t={chat_id:E.config.chatId,text:r};if(!d||!/^https:\/\//.test(d))return{ok:!1,error:"Channel endpoint is unavailable or not HTTPS."};let h=JSON.stringify(t);if(E.kind==="webhook"&&T.signingSecret){let A=Math.floor(this.now().getTime()/1000).toString();R["x-ts-cloud-timestamp"]=A,R["x-ts-cloud-signature"]=`v1=${ka("sha256",T.signingSecret).update(`${A}.${h}`).digest("hex")}`}let N=new AbortController,S=setTimeout(()=>N.abort(),1e4);try{let A=await this.fetchImpl(d,{method:"POST",headers:R,body:h,signal:N.signal});return A.ok?{ok:!0,status:A.status}:{ok:!1,status:A.status,error:`Channel returned HTTP ${A.status}.`}}finally{clearTimeout(S)}}catch(d){return{ok:!1,error:d instanceof Error?d.message:String(d)}}}async deliver(E){let _=this.store.getDelivery(E);if(!_)throw Error("Notification delivery was not found.");if(_.state==="delivered"||_.state==="dead"||_.nextAttemptAt&&_.nextAttemptAt>this.now().toISOString())return _;let T=this.store.getChannel(_.channelId);if(!T||T.status==="disabled"||T.status==="paused")return this.store.updateDelivery(E,{state:"failed",attempt:_.attempt+1,error:"Notification channel is unavailable."});let r=_.attempt+1,d=await this.send(T,_.payload);if(d.ok)return this.store.setChannelStatus(T.id,"active"),this.store.updateDelivery(E,{state:"delivered",attempt:r,responseStatus:d.status,deliveredAt:this.now().toISOString()});let R=!(!d.status||d.status===429||d.status>=500)||r>=_.maxAttempts,h=R?void 0:new Date(this.now().getTime()+Math.min(3600000,30000*2**(r-1))).toISOString();return this.store.setChannelStatus(T.id,"failing",d.error),this.store.updateDelivery(E,{state:R?"dead":"retrying",attempt:r,nextAttemptAt:h,responseStatus:d.status,error:d.error})}async deliverAll(E){return Promise.all(E.map((_)=>this.deliver(_.id)))}async retryDue(){let E=this.now().toISOString(),_=this.store.listDeliveries({states:["pending","retrying"]}).filter((T)=>!T.nextAttemptAt||T.nextAttemptAt<=E);return this.deliverAll(_)}async testChannel(E){let _=this.store.getChannel(E);if(!_)throw Error("Notification channel was not found.");let T=await this.send(_,{schemaVersion:1,event:"test",message:"ts-cloud notification channel test. No incident was created."});return this.store.markChannelTest(E,T.ok,T.error),T}}import{lookup as ia}from"node:dns/promises";import{connect as aa}from"node:net";async function ma(E,_){let T=Bun.spawn(E,{stdout:"pipe",stderr:"pipe"}),r=setTimeout(()=>T.kill(),_);try{return{exitCode:await T.exited,stdout:await new Response(T.stdout).text(),stderr:await new Response(T.stderr).text()}}finally{clearTimeout(r)}}class St{store;options;constructor(E,_={}){this.store=E;this.options=_}now(){return this.options.now?.()??new Date}async probe(E){let _=performance.now(),T=this.now().toISOString(),r=this.options.agent??"local";try{if(E.kind==="http"){let R=new URL(E.target),h=performance.now();await(this.options.lookupImpl??ia)(R.hostname);let N=performance.now()-h,S=new AbortController,A=setTimeout(()=>S.abort(),E.timeoutSeconds*1000);try{let L=performance.now(),O=await(this.options.fetchImpl??fetch)(R.toString(),{method:E.config.method??"GET",headers:E.config.headers,signal:S.signal,redirect:"manual"}),c=performance.now()-L,$=E.config.expectedBody?await O.text():"",I=E.config.expectedStatuses??[200,201,202,204],C=I.includes(O.status)&&(!E.config.expectedBody||$.includes(E.config.expectedBody));return{checkId:E.id,status:C?"healthy":"unhealthy",agent:r,region:this.options.region,statusCode:O.status,message:C?void 0:`Expected ${I.join("/")} and configured body match.`,timings:{dnsMs:N,ttfbMs:c,totalMs:performance.now()-_},checkedAt:T}}finally{clearTimeout(A)}}if(E.kind==="tcp"){let R=Number(E.config.port);if(!Number.isInteger(R)||R<1||R>65535)throw Error("TCP health check requires a valid port.");let h=performance.now();return await new Promise((N,S)=>{let A=aa({host:E.target,port:R}),L=setTimeout(()=>{A.destroy(),S(Error("TCP health check timed out."))},E.timeoutSeconds*1000);A.once("connect",()=>{clearTimeout(L),A.destroy(),N()}),A.once("error",(O)=>{clearTimeout(L),S(O)})}),{checkId:E.id,status:"healthy",agent:r,region:this.options.region,timings:{connectMs:performance.now()-h,totalMs:performance.now()-_},checkedAt:T}}let d=E.config.command??[];if(!d.length)throw Error("Command health check is not configured.");let t=await(this.options.commandImpl??ma)(d,E.timeoutSeconds*1000);return{checkId:E.id,status:t.exitCode===0?"healthy":"unhealthy",agent:r,region:this.options.region,message:t.exitCode===0?void 0:(t.stderr||t.stdout||`Command exited ${t.exitCode}`).slice(0,1000),timings:{totalMs:performance.now()-_},checkedAt:T}}catch(d){return{checkId:E.id,status:"unhealthy",agent:r,region:this.options.region,message:(d instanceof Error?d.message:String(d)).slice(0,1000),timings:{totalMs:performance.now()-_},checkedAt:T}}}async run(E){return this.store.appendHealthResult(await this.probe(E))}async runAndEvaluate(E){let _=await this.run(E),T=new WA(this.store),r=this.store.listRules(E.projectId,E.environmentId).filter((d)=>d.healthCheckId===E.id);return{result:_,evaluations:r.map((d)=>T.evaluate(d,{status:_.status,timestamp:_.checkedAt,group:{agent:_.agent,region:_.region??""},evidence:{healthResultId:_.id,statusCode:_.statusCode??null,message:_.message??null,timings:_.timings}}))}}}var sa=Object.freeze({rawDays:30,downsampleAfterDays:7,downsampleBucketMs:3600000,maxRecords:1e6,samplingRate:1,collectLogs:!0,collectTraces:!0,collectRequestAnalytics:!0,estimatedStorageUsdPerGbMonth:0});function ID(E,_,T,r){let d=Number(E);return Number.isFinite(d)?Math.min(r,Math.max(T,Math.floor(d))):_}function cQ(E,_,T,r){let d=Number(E);return Number.isFinite(d)?Math.min(r,Math.max(T,d)):_}function Sz(E,_){return typeof E==="boolean"?E:_}function UQ(E,_={...sa}){let T=E&&typeof E==="object"&&!Array.isArray(E)?E:{},r=ID(T.rawDays,_.rawDays,1,3650),d=ID(T.downsampleAfterDays,_.downsampleAfterDays,1,r);return{rawDays:r,downsampleAfterDays:d,downsampleBucketMs:ID(T.downsampleBucketMs,_.downsampleBucketMs,60000,86400000),maxRecords:ID(T.maxRecords,_.maxRecords,1000,1e8),samplingRate:cQ(T.samplingRate,_.samplingRate,0.01,1),collectLogs:Sz(T.collectLogs,_.collectLogs),collectTraces:Sz(T.collectTraces,_.collectTraces),collectRequestAnalytics:Sz(T.collectRequestAnalytics,_.collectRequestAnalytics),estimatedStorageUsdPerGbMonth:cQ(T.estimatedStorageUsdPerGbMonth,_.estimatedStorageUsdPerGbMonth,0,1e4)}}function $Q(E){return`telemetry.policy:${E}`}function tR(E,_){return UQ(E.getSetting($Q(_)))}function CD(E,_,T){let r=UQ(T,tR(E,_));return E.setSetting($Q(_),r),r}function wD(E,_){return Number((Math.max(0,E)/1073741824*_.estimatedStorageUsdPerGbMonth).toFixed(4))}var pa=/(?:authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key|session)/i,oa=/\b(?:authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)\s*[=:]\s*[^\s,;&\[]+/gi,Em=/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,_m=/\b(?:\d{1,3}\.){3}\d{1,3}\b/g;function Az(E,_={}){let T=E.replace(/([?&][^=&#\s]+)=([^&#\s]*)/g,"$1=[REDACTED]").replace(oa,"[REDACTED]");if(_.redactEmail!==!1)T=T.replace(Em,"[EMAIL]");if(_.redactIp)T=T.replace(_m,"[IP]");for(let r of _.patterns??[])T=T.replace(r,"[REDACTED]");return T}function XO(E,_={},T){if(T&&pa.test(T))return"[REDACTED]";if(E===null||typeof E==="boolean"||typeof E==="number")return E;if(typeof E==="string")return Az(E,_);if(Array.isArray(E))return E.map((r)=>XO(r,_));if(E&&typeof E==="object"){let r={};for(let[d,t]of Object.entries(E))r[d]=XO(t,_,d);return r}return String(E??"")}function eD(E){if(!E)return;return E.split("?",1)[0].replace(/\b[0-9a-f]{8}-[0-9a-f-]{27,}\b/gi,":id").replace(/\/(?:(?:\d{4,})|(?:[0-9a-f]{16,}))(?:\/|$)/gi,(T)=>T.endsWith("/")?"/:id/":"/:id").slice(0,512)}var DQ=65536,Tm=2678400000,rm=new Set(["metric","log","trace","request","event"]);function HT(E){return typeof E==="string"?E:void 0}function JO(E){return E==null?void 0:Number(E)}function dm(E){if(typeof E!=="string")return{};try{return JSON.parse(E)}catch{return{}}}function XD(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:HT(E.environment_id),resourceId:HT(E.resource_id),kind:String(E.kind),source:String(E.source),name:String(E.name),timestamp:String(E.timestamp),observedAt:String(E.observed_at),value:JO(E.value),unit:HT(E.unit),level:HT(E.level),message:HT(E.message),durationMs:JO(E.duration_ms),statusCode:JO(E.status_code),method:HT(E.method),host:HT(E.host),pathTemplate:HT(E.path_template),bytesIn:JO(E.bytes_in),bytesOut:JO(E.bytes_out),region:HT(E.region),cacheResult:HT(E.cache_result),upstream:HT(E.upstream),traceId:HT(E.trace_id),requestId:HT(E.request_id),deploymentId:HT(E.deployment_id),releaseId:HT(E.release_id),workloadId:HT(E.workload_id),sampled:Number(E.sampled)===1,attributes:dm(E.attributes),ingestedBytes:Number(E.ingested_bytes)}}function PA(E,_){let T=new Date(E);if(!E||!Number.isFinite(T.getTime()))throw Error(`${_} must be a valid ISO-8601 instant.`);return T}function JD(E){let _=PA(E.from,"from"),T=PA(E.to,"to");if(_>=T)throw Error("Telemetry from must be earlier than to.");if(T.getTime()-_.getTime()>Tm)throw Error("Telemetry queries are limited to 31 days.");return{from:_,to:T}}function IQ(E){if(!E)return;try{let _=JSON.parse(Buffer.from(E,"base64url").toString("utf8"));if(typeof _?.timestamp!=="string"||typeof _?.id!=="string")throw Error();return _}catch{throw Error("Telemetry cursor is invalid.")}}function zD(E){return E?Buffer.from(JSON.stringify({timestamp:E.timestamp,id:E.id})).toString("base64url"):void 0}function tm(E,_){if(!E.length)return;let T=[...E].sort((d,t)=>d-t),r=Math.max(0,Math.min(T.length-1,Math.ceil(_/100*T.length)-1));return T[r]}function zO(E,_){if(_==="count")return E.length;if(!E.length)return;if(_==="sum")return E.reduce((T,r)=>T+r,0);if(_==="avg")return E.reduce((T,r)=>T+r,0)/E.length;if(_==="min")return Math.min(...E);if(_==="max")return Math.max(...E);return tm(E,Number(_.slice(1)))}function Rm(E,_="UTC"){try{return new Intl.DateTimeFormat("en-US",{timeZone:_,month:"short",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZoneName:"short"}).format(E)}catch{throw Error(`Unknown telemetry timezone: ${_}`)}}class RR{controlPlane;options;constructor(E,_={}){this.controlPlane=E;this.options=_}now(){return this.options.now?.()??new Date}append(E){if(!rm.has(E.kind))throw Error(`Unsupported telemetry kind: ${E.kind}`);let _=PA(E.timestamp,"timestamp").toISOString(),T=E.observedAt?PA(E.observedAt,"observedAt").toISOString():this.now().toISOString(),r=XO(E.attributes??{},this.options.redaction),d=E.message?Az(E.message,this.options.redaction).slice(0,32768):void 0,t=eD(E.pathTemplate),R=E.id??crypto.randomUUID(),h=JSON.stringify({...E,id:R,timestamp:_,observedAt:T,attributes:r,message:d,pathTemplate:t}),N=Buffer.byteLength(h);if(N>DQ)throw Error(`Telemetry records are limited to ${DQ} bytes.`);return this.controlPlane.database.run("INSERT OR IGNORE INTO telemetry_records (id, project_id, environment_id, resource_id, kind, source, name, timestamp, observed_at, value, unit, level, message, duration_ms, status_code, method, host, path_template, bytes_in, bytes_out, region, cache_result, upstream, trace_id, request_id, deployment_id, release_id, workload_id, sampled, attributes, ingested_bytes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[R,E.projectId,E.environmentId??null,E.resourceId??null,E.kind,E.source.slice(0,128),E.name.slice(0,256),_,T,E.value??null,E.unit??null,E.level??null,d??null,E.durationMs??null,E.statusCode??null,E.method?.slice(0,16)??null,E.host?.slice(0,256)??null,t??null,E.bytesIn??null,E.bytesOut??null,E.region?.slice(0,64)??null,E.cacheResult?.slice(0,64)??null,E.upstream?.slice(0,256)??null,E.traceId?.slice(0,256)??null,E.requestId?.slice(0,256)??null,E.deploymentId?.slice(0,256)??null,E.releaseId?.slice(0,256)??null,E.workloadId?.slice(0,512)??null,E.sampled===!1?0:1,JSON.stringify(r),N]),this.get(R)}appendMany(E){if(E.length>1e4)throw Error("Telemetry batches are limited to 10,000 records.");return this.controlPlane.database.transaction((T)=>T.map((r)=>this.append(r)))(E)}get(E){let _=this.controlPlane.database.query("SELECT * FROM telemetry_records WHERE id=?").get(E);return _?XD(_):void 0}query(E){let{from:_,to:T}=JD(E),r=Math.min(5000,Math.max(1,Math.floor(E.limit??500))),d=["project_id=?","timestamp>=?","timestamp<?"],t=[E.projectId,_.toISOString(),T.toISOString()],R=(e,z)=>{if(z)d.push(`${e}=?`),t.push(z)},h=(e,z)=>{let F=[...new Set(z??[])].slice(0,100);if(F.length)d.push(`${e} IN (${F.map(()=>"?").join(",")})`),t.push(...F)};if(R("environment_id",E.environmentId),h("resource_id",E.resourceIds),h("kind",E.kinds),h("name",E.names),h("source",E.sources),h("level",E.levels),R("trace_id",E.traceId),R("request_id",E.requestId),R("deployment_id",E.deploymentId),R("release_id",E.releaseId),R("workload_id",E.workloadId),E.text)d.push("(message LIKE ? OR name LIKE ?)"),t.push(`%${E.text.slice(0,256)}%`,`%${E.text.slice(0,256)}%`);let N=IQ(E.cursor);if(N)d.push("(timestamp<? OR (timestamp=? AND id<?))"),t.push(N.timestamp,N.timestamp,N.id);let S=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE ${d.join(" AND ")} ORDER BY timestamp DESC, id DESC LIMIT ?`).all(...t,r+1),A=S.slice(0,r).map(XD),L=S.length>r,O=new Map;for(let e of A)O.set(e.source,[...O.get(e.source)??[],e]);let c=this.now().getTime(),$=[...O].map(([e,z])=>{let F=z.reduce((y,Y)=>Y.observedAt>y?Y.observedAt:y,z[0].observedAt),B=c-new Date(F).getTime();return{source:e,latestAt:F,freshness:B<=120000?"live":B<=600000?"stale":"unavailable",count:z.length}}),I=Math.max(60000,(T.getTime()-_.getTime())/100),C=[...O].flatMap(([e,z])=>{let F=[...new Set(z.map((B)=>new Date(B.timestamp).getTime()))].sort((B,y)=>B-y);return F.slice(1).flatMap((B,y)=>B-F[y]>I?[{from:new Date(F[y]).toISOString(),to:new Date(B).toISOString(),source:e}]:[])});return{records:A,nextCursor:L?zD(A.at(-1)):void 0,truncated:L,scannedRange:{from:_.toISOString(),to:T.toISOString()},sources:$,gaps:C}}tail(E,_){let{from:T,to:r}=JD(E),d=Math.min(1000,Math.max(1,Math.floor(E.limit??200))),t=["project_id=?","timestamp>=?","timestamp<?"],R=[E.projectId,T.toISOString(),r.toISOString()],h=(O,c)=>{if(c)t.push(`${O}=?`),R.push(c)},N=(O,c)=>{let $=[...new Set(c??[])].slice(0,100);if($.length)t.push(`${O} IN (${$.map(()=>"?").join(",")})`),R.push(...$)};if(h("environment_id",E.environmentId),N("resource_id",E.resourceIds),N("kind",E.kinds),N("name",E.names),N("source",E.sources),N("level",E.levels),h("trace_id",E.traceId),h("request_id",E.requestId),h("deployment_id",E.deploymentId),h("release_id",E.releaseId),h("workload_id",E.workloadId),E.text)t.push("(message LIKE ? OR name LIKE ?)"),R.push(`%${E.text.slice(0,256)}%`,`%${E.text.slice(0,256)}%`);let S=IQ(_);if(S)t.push("(timestamp>? OR (timestamp=? AND id>?))"),R.push(S.timestamp,S.timestamp,S.id);let A=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE ${t.join(" AND ")} ORDER BY timestamp ASC, id ASC LIMIT ?`).all(...R,d+1),L=A.slice(0,d).map(XD);return{records:L,cursor:zD(L.at(-1))??_,truncated:A.length>d}}series(E){let{from:_,to:T}=JD(E),r=Math.min(86400000,Math.max(1000,Math.floor(E.bucketMs)));if((T.getTime()-_.getTime())/r>2000)throw Error("Telemetry series are limited to 2,000 buckets.");let d=this.query({...E,kinds:["metric"],limit:5000,cursor:void 0}),t=new Map;for(let h of d.records)t.set(`${h.source}\x00${h.name}`,[...t.get(`${h.source}\x00${h.name}`)??[],h]);let R=(h,N,S)=>{let A=new Map;for(let O of h){let c=N.getTime()+Math.floor((new Date(O.timestamp).getTime()-N.getTime())/r)*r;if(c>=N.getTime()&&c<S.getTime()&&O.value!=null)A.set(c,[...A.get(c)??[],O.value])}let L=[];for(let O=N.getTime();O<S.getTime();O+=r){let c=A.get(O)??[],$=zO(c,E.aggregation);L.push({timestamp:new Date(O).toISOString(),label:Rm(new Date(O),E.timezone),value:$,count:c.length,gap:$==null})}return L};return[...t].map(([h,N])=>{let[S,A]=h.split("\x00"),L={name:A,source:S,unit:N.find((O)=>O.unit)?.unit,aggregation:E.aggregation,bucketMs:r,points:R(N,_,T)};if(E.compareFrom&&E.compareTo){let O=this.query({...E,from:E.compareFrom,to:E.compareTo,kinds:["metric"],limit:5000,cursor:void 0}).records.filter((c)=>c.source===S&&c.name===A);L.comparison=R(O,PA(E.compareFrom,"compareFrom"),PA(E.compareTo,"compareTo"))}return L})}status(E,_,T=30,r=1,d){let t=[E],R=_?" AND environment_id=?":"";if(_)t.push(_);let h=[...new Set(d??[])].slice(0,100);if(d&&h.length===0)return[];let N=d?` AND resource_id IN (${h.map(()=>"?").join(",")||"''"})`:"";t.push(...h);let S=this.controlPlane.database.query(`SELECT source, MAX(latest_observed_at) latest, SUM(ingested_bytes) bytes, SUM(record_count) count, MIN(first_observed_at) first FROM telemetry_source_rollups WHERE project_id=?${R}${N} GROUP BY source`).all(...t),A=this.now().getTime();return S.map((L)=>{let O=String(L.latest),c=Math.max(0,Math.floor((A-new Date(O).getTime())/1000)),$=Math.max(1,(new Date(O).getTime()-new Date(String(L.first)).getTime())/86400000);return{source:String(L.source),freshness:c<=120?"live":c<=600?"stale":"unavailable",lastObservedAt:O,lagSeconds:c,samplingRate:r,retentionDays:T,estimatedDailyBytes:Math.round(Number(L.bytes)/$)}})}saveQuery(E,_,T,r){let d=T.trim().slice(0,80);if(!d)throw Error("Saved telemetry queries require a name.");if(JD(r),r.projectId!==E)throw Error("Saved telemetry queries cannot cross project scope.");let t=this.now().toISOString(),R=JSON.stringify(XO(r,this.options.redaction));if(Buffer.byteLength(R)>16384)throw Error("Saved telemetry queries are limited to 16 KB.");let h=this.controlPlane.database.query("SELECT * FROM telemetry_saved_queries WHERE project_id=? AND actor_id IS ? AND name=?").get(E,_??null,d),N=h?String(h.id):crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO telemetry_saved_queries (id, project_id, actor_id, name, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?) ON CONFLICT(project_id, actor_id, name) DO UPDATE SET query=excluded.query, updated_at=excluded.updated_at",[N,E,_??null,d,R,h?String(h.created_at):t,t]),{id:N,projectId:E,actorId:_,name:d,query:JSON.parse(R),createdAt:h?String(h.created_at):t,updatedAt:t}}listSavedQueries(E,_){return this.controlPlane.database.query("SELECT * FROM telemetry_saved_queries WHERE project_id=? AND actor_id IS ? ORDER BY updated_at DESC").all(E,_??null).map((T)=>({id:String(T.id),projectId:String(T.project_id),actorId:HT(T.actor_id),name:String(T.name),query:JSON.parse(String(T.query)),createdAt:String(T.created_at),updatedAt:String(T.updated_at)}))}deleteSavedQuery(E,_,T){return this.controlPlane.database.run("DELETE FROM telemetry_saved_queries WHERE id=? AND project_id=? AND actor_id IS ?",[T,E,_??null]).changes>0}downsample(E,_){let T=Math.min(86400000,Math.max(60000,Math.floor(E.downsampleBucketMs))),r=new Date(this.now().getTime()-Math.max(1,E.downsampleAfterDays)*86400000).toISOString(),d=new Date(this.now().getTime()-Math.max(1,E.rawDays)*86400000).toISOString(),t=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE kind='metric' AND source NOT LIKE '%:rollup' AND timestamp>=? AND timestamp<?${_?" AND project_id=?":""} ORDER BY timestamp ASC LIMIT 50001`).all(d,r,..._?[_]:[]);if(t.length>50000)throw Error("Telemetry downsampling is limited to 50,000 raw points per pass; run compaction more frequently.");let R=t.map(XD),h=new Map;for(let S of R){let A=Math.floor(new Date(S.timestamp).getTime()/T)*T,L=JSON.stringify([S.projectId,S.environmentId??"",S.resourceId??"",S.source,S.name,S.unit??"",A]);h.set(L,[...h.get(L)??[],S])}return this.controlPlane.database.transaction(()=>{for(let S=0;S<R.length;S+=500){let A=R.slice(S,S+500).map((L)=>L.id);if(A.length)this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE id IN (${A.map(()=>"?").join(",")})`,A)}for(let[S,A]of h){let[L,O,c,$,I,C,e]=JSON.parse(S),z=A.flatMap((F)=>F.value==null?[]:[F.value]);this.append({projectId:L,environmentId:O||void 0,resourceId:c||void 0,kind:"metric",source:`${$}:rollup`,name:I,unit:C||void 0,timestamp:new Date(e).toISOString(),value:zO(z,"avg"),attributes:{downsampled:!0,count:z.length,min:zO(z,"min"),max:zO(z,"max"),p95:zO(z,"p95"),bucketMs:T}})}})(),{compacted:R.length,rollups:h.size}}enforceRetention(E,_){let T=this.downsample(E,_),r=Math.min(3650,Math.max(1,Math.floor(E.rawDays))),d=new Date(this.now().getTime()-r*86400000).toISOString(),t=_?" AND project_id=?":"",R=this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE timestamp<?${t}`,_?[d,_]:[d]).changes,h=Number(this.controlPlane.database.query(`SELECT MAX(0, COUNT(*)-?) excess FROM telemetry_records${_?" WHERE project_id=?":""}`).get(E.maxRecords,..._?[_]:[])?.excess??0);if(h>0)this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE id IN (SELECT id FROM telemetry_records${_?" WHERE project_id=?":""} ORDER BY timestamp ASC LIMIT ?)`,_?[_,h]:[h]);return this.rebuildStatusRollups(_),{deleted:R+h,...T}}rebuildStatusRollups(E){let _=E?" WHERE project_id=?":"",T=E?[E]:[];this.controlPlane.database.transaction(()=>{this.controlPlane.database.run(`DELETE FROM telemetry_source_rollups${_}`,T),this.controlPlane.database.run(`INSERT INTO telemetry_source_rollups (
           project_id, environment_id, resource_id, source,
           first_observed_at, latest_observed_at, ingested_bytes, record_count
         )
@@ -9938,7 +9938,7 @@ ${JSON.stringify(_,null,2)}`}),{ok:!0,status:202}}let d=T.url??T.value,t=_,R={"c
           project_id, COALESCE(environment_id, ''), COALESCE(resource_id, ''), source,
           MIN(observed_at), MAX(observed_at), SUM(ingested_bytes), COUNT(*)
         FROM telemetry_records${_}
-        GROUP BY project_id, COALESCE(environment_id, ''), COALESCE(resource_id, ''), source`,T)})()}}function FO(E,_,T,r=new Date){let d=new RR(E.controlPlane,{now:()=>r}),t=new WA(E);return E.listRules(_,T).filter((R)=>R.enabled&&!R.healthCheckId).map((R)=>{let h=new Date(r.getTime()-R.windowMs).toISOString(),N=d.query({projectId:_,environmentId:T,resourceIds:R.resourceId?[R.resourceId]:void 0,kinds:["metric"],names:[R.signal],from:h,to:new Date(r.getTime()+1).toISOString(),limit:5000}),S=N.records.flatMap((L)=>L.value==null?[]:[L.value]),A=S.length?R.operator==="gt"||R.operator==="gte"?Math.max(...S):R.operator==="lt"||R.operator==="lte"?Math.min(...S):S.at(0):void 0;return t.evaluate(R,{value:A,status:A==null?"no_data":void 0,timestamp:r.toISOString(),group:{resourceId:R.resourceId??"",source:N.records[0]?.source??""},evidence:{signal:R.signal,windowMs:R.windowMs,sampleCount:S.length,source:N.records[0]?.source??null}})})}VE();class jO{region;client;constructor(E="us-east-1",_=new JE){this.region=E;this.client=_}request(E,_){return this.client.request({service:"backup",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`CryoControllerFrontendService.${E}`},body:JSON.stringify(_)})}startBackupJob(E){return this.request("StartBackupJob",E)}describeBackupJob(E){return this.request("DescribeBackupJob",{BackupJobId:E})}startRestoreJob(E){return this.request("StartRestoreJob",E)}describeRestoreJob(E){return this.request("DescribeRestoreJob",{RestoreJobId:E})}deleteRecoveryPoint(E,_){return this.request("DeleteRecoveryPoint",{BackupVaultName:E,RecoveryPointArn:_})}}ut();Kh();PL();import{isIP as F9}from"node:net";var hm={every_minute:"* * * * *",every_five_minutes:"*/5 * * * *",hourly:"0 * * * *",daily:"0 0 * * *",weekly:"0 0 * * 0"},Nm={JAN:1,FEB:2,MAR:3,APR:4,MAY:5,JUN:6,JUL:7,AUG:8,SEP:9,OCT:10,NOV:11,DEC:12},C9={SUN:0,MON:1,TUE:2,WED:3,THU:4,FRI:5,SAT:6};function w9(E){try{return new Intl.DateTimeFormat("en",{timeZone:E}).format(new Date),E}catch{throw Error(`Unknown schedule timezone: ${E}`)}}function FD(E,_,T,r){let d=_[E.toUpperCase()]??Number(E);if(!Number.isInteger(d)||d<T||d>r)throw Error(`Schedule field value ${E} is outside ${T}-${r}.`);return d}function yA(E,_,T,r={},d){if(E==="*"||E==="?")return;let t=new Set;for(let R of E.split(",")){let[h,N]=R.split("/"),S=N?FD(N,{},1,T-_+1):1,A,L;if(h==="*")A=_,L=T;else if(h.includes("-")){let O=h.split("-");A=FD(O[0],r,_,T),L=FD(O[1],r,_,T)}else A=FD(h,r,_,T),L=A;if(L<A)throw Error("Schedule ranges must be ascending.");for(let O=A;O<=L;O+=S)t.add(d?d(O):O===7&&T===7?0:O)}return t}function Sm(E,_){let T=Object.fromEntries(new Intl.DateTimeFormat("en-US",{timeZone:_,year:"numeric",month:"numeric",day:"numeric",weekday:"short",hour:"numeric",minute:"numeric",hourCycle:"h23"}).formatToParts(E).map((r)=>[r.type,r.value]));return{minute:Number(T.minute),hour:Number(T.hour),day:Number(T.day),month:Number(T.month),weekday:C9[T.weekday.toUpperCase()],year:Number(T.year),key:`${T.year}-${T.month}-${T.day} ${T.hour}:${T.minute}`}}function e9(E){let T=(E.startsWith("cron(")?E.slice(5,-1).trim():E.trim()).split(/\s+/);if(T.length!==5&&T.length!==6)throw Error("Cron schedules require five standard fields or six EventBridge fields.");let[r,d,t,R,h,N]=T,S=T.length===6;return{minute:yA(r,0,59),hour:yA(d,0,23),day:yA(t,1,31),month:yA(R,1,12,Nm),weekday:yA(h,S?1:0,7,C9,S?(A)=>A===7?6:A-1:void 0),year:N?yA(N,1970,2199):void 0,dayWildcard:t==="*"||t==="?",weekdayWildcard:h==="*"||h==="?"}}function Am(E,_){if(!((!_.minute||_.minute.has(E.minute))&&(!_.hour||_.hour.has(E.hour))&&(!_.month||_.month.has(E.month))&&(!_.year||_.year.has(E.year))))return!1;let r=!_.day||_.day.has(E.day),d=!_.weekday||_.weekday.has(E.weekday);return _.dayWildcard?d:_.weekdayWildcard?r:r||d}function X9(E){let _=/^rate\(\s*(\d+)\s+(minute|minutes|hour|hours|day|days)\s*\)$/i.exec(E);if(!_)return;let T=Number(_[1]);if(T<1)throw Error("Rate amount must be positive.");return T*(_[2].toLowerCase().startsWith("minute")?60000:_[2].toLowerCase().startsWith("hour")?3600000:86400000)}function YA(E){let _=E.trim(),T=hm[_.toLowerCase()]??_;if(!T)throw Error("Schedule expression is required.");let r=X9(T);if(r){let d=r/60000;return{original:_,normalized:`rate(${d} minutes)`,kind:"rate",description:d%1440===0?`Every ${d/1440} day(s)`:d%60===0?`Every ${d/60} hour(s)`:`Every ${d} minute(s)`}}return e9(T),{original:_,normalized:T.startsWith("cron(")?T:`cron(${T})`,kind:"cron",description:`Cron ${T.replace(/^cron\(|\)$/g,"")}`}}function hR(E,_,T=new Date,r=5){let d=YA(E),t=w9(_),R=Math.min(20,Math.max(1,r)),h=X9(d.normalized);if(h)return Array.from({length:R},(c,$)=>new Date(T.getTime()+h*($+1)).toISOString());let N=e9(d.normalized),S=[],A=new Set,L=new Date(Math.floor(T.getTime()/60000)*60000+60000),O=0;while(S.length<R&&O<1100000){let c=Sm(L,t);if(Am(c,N)&&!A.has(c.key))S.push(L.toISOString()),A.add(c.key);L=new Date(L.getTime()+60000),O++}if(S.length<R)throw Error("Schedule produced no runs within the bounded preview horizon.");return S}function NR(E,_="UTC",T=new Date,r=5){let d=YA(E),t=hR(d.normalized,_,T,r),R=d.kind==="cron"?["Server cron and EventBridge use the same wall-clock preview; provider-specific extensions are retained only when supported."]:["Rate schedules use elapsed-time intervals and are not shifted by DST."];return{...d,timezone:w9(_),nextRuns:t,capabilities:{server:d.kind==="cron",eventbridge:!0,notes:R}}}function BO(E){let _=YA(E.expression),T=_.normalized.slice(5,-1).trim().split(/\s+/),r=_.kind==="cron"&&T.length===5;if(E.provider==="server")return{provider:"server",supported:r,features:{timezone:!0,flexibleWindow:!1,catchUp:!1,replaceOverlap:!1},notes:[_.kind==="rate"?"Server cron requires a cron expression; use an equivalent cron schedule.":T.length!==5?"EventBridge six-field cron extensions cannot be installed as server cron.":"Cron is reconciled through a root-owned ts-cloud entry.",E.missedRunPolicy==="catch_up"?"Catch-up is handled by the control plane, not cron.":"Missed runs are skipped by cron."]};if(E.provider==="eventbridge")return{provider:"eventbridge",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["Five-field cron is translated explicitly to EventBridge six-field syntax. Flexible windows are provider-native; overlap and catch-up remain control-plane policies."]};if(E.provider==="lambda")return{provider:"lambda",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["The schedule invokes one immutable Lambda target."]};return{provider:"platform",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!0,replaceOverlap:!0},notes:["The durable control-plane worker enforces all configured policies."]}}function Lm(E){if(E.queues===!0)return[{queue:"default",processes:E.queueConcurrency??1}];if(!Array.isArray(E.queues))return[];return E.queues.map((_)=>{if(typeof _==="string")return{queue:_,processes:E.queueConcurrency??1};let[T,r]=Object.entries(_)[0]??["default",E.queueConcurrency??1];return{queue:T,processes:r}})}function QA(E,_,T){let r=new Set,d=new Set,t=new Map(T.resources.map((L)=>[L.slug,L])),R=0,h=0;for(let[L,O]of Object.entries(_.sites??{})){let c=t.get(L);if(O.scheduler){let C=`config:site:${L}:scheduler`;r.add(C),E.upsertConfigJob({organizationId:T.organization.id,projectId:T.project.id,environmentId:T.environment.id,resourceId:c?.id,name:`${L} scheduler`,provider:"server",expression:"* * * * *",timezone:"UTC",flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:`scheduler:run:${L}`},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:300,enabled:!0,origin:"config",sourceKey:C,observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),R++}let $=O,I=Array.isArray($.queues??$.workers)?$.queues??$.workers:[];for(let[C,e]of I.entries()){let z=typeof e==="string"?{queue:e}:e,F=String(z.queue??z.name??"default"),B=`config:site:${L}:worker:${C}:${F}`;d.add(B),E.upsertWorker({organizationId:T.organization.id,projectId:T.project.id,environmentId:T.environment.id,resourceId:c?.id,name:`${L}:${F}`,provider:"systemd",queue:F,processes:Number(z.processes)||1,timeoutSeconds:Number(z.timeout)||60,restartPolicy:"always",target:{operationId:`worker:restart:${L}`,site:L},enabled:!0,origin:"config",sourceKey:B,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),h++}}let N=_.infrastructure?.compute?.backups;if(N?.enabled)r.add("config:platform:backup"),E.upsertConfigJob({organizationId:T.organization.id,projectId:T.project.id,environmentId:T.environment.id,name:"Scheduled backup",provider:"server",expression:String(N.schedule??"0 2 * * *"),timezone:String(N.timezone??"UTC"),flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:"backup:run"},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:60},timeoutSeconds:3600,enabled:!0,origin:"config",sourceKey:"config:platform:backup",observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),R++;let S=_.environments?.[T.environment.slug]?.app;if(S){if(S.scheduler!=="off"){let L=`config:serverless:${T.environment.slug}:scheduler`;r.add(L),E.upsertConfigJob({organizationId:T.organization.id,projectId:T.project.id,environmentId:T.environment.id,name:`${T.environment.name} serverless scheduler`,provider:"eventbridge",expression:"rate(1 minute)",timezone:"UTC",flexibleMinutes:0,target:{kind:"serverless_scheduler",action:"schedule:run"},payloadRefs:{},missedRunPolicy:S.scheduler==="sub-minute"?"catch_up":"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:S.cliTimeout??900,enabled:!0,origin:"config",sourceKey:L,observedState:{source:"cloud.config.ts",mode:S.scheduler??"on"},reconciliationStatus:"pending"}),R++}for(let{queue:L,processes:O}of Lm(S)){let c=`config:serverless:${T.environment.slug}:worker:${L}`;d.add(c),E.upsertWorker({organizationId:T.organization.id,projectId:T.project.id,environmentId:T.environment.id,name:`${T.environment.name}:${L}`,provider:"lambda",queue:L,processes:O,timeoutSeconds:S.queueTimeout??120,restartPolicy:"on_failure",target:{function:"queue",queue:L},enabled:!0,origin:"config",sourceKey:c,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),h++}}let A=0;for(let L of E.list(T.project.id,{environmentId:T.environment.id}).filter((O)=>O.origin==="config"&&O.sourceKey&&!r.has(O.sourceKey)))E.reconcile(L.id,"drifted",{...L.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),A++;for(let L of E.listWorkers(T.project.id,T.environment.id).filter((O)=>O.origin==="config"&&O.sourceKey&&!d.has(O.sourceKey)))E.reconcileWorker(L.id,"drifted",{...L.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),A++;return{jobs:R,workers:h,drifted:A}}class WO{store;queue;constructor(E,_={}){this.store=E;this.queue=_.queue??new lE(E.controlPlane)}enqueue(E,_){let T=new Date(_.scheduledFor??this.store.now()).toISOString(),r=`${E.id}:${_.trigger==="manual"?crypto.randomUUID():T}`,d=this.store.activeExecution(E.id);if(d&&E.overlapPolicy==="forbid")return this.store.createExecution({jobId:E.id,trigger:_.trigger,scheduledFor:T,idempotencyKey:r,status:"skipped",output:{reason:"overlap_forbidden",activeExecutionId:d.id}});if(d&&E.overlapPolicy==="replace"&&d.operationId)try{this.queue.requestCancellation(d.operationId,_.actorId)}catch{}let t=this.store.createExecution({jobId:E.id,trigger:_.trigger,scheduledFor:T,idempotencyKey:r,status:"queued",output:{semantics:"at_least_once"}});if(t.operationId)return t;let R=this.queue.enqueue({projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,actorId:_.actorId,kind:"job.execute",input:{jobId:E.id,executionId:t.id},idempotencyKey:`job-execution:${t.id}`,lockKey:E.overlapPolicy==="allow"?`job-execution:${t.id}`:`job:${E.id}`,maxAttempts:E.retryPolicy.maxAttempts,timeoutSeconds:E.timeoutSeconds,retryClasses:["job_transient"],resumePolicy:"requeue"}).operation;return this.store.attachOperation(t.id,R.id)}tick(E=this.store.now()){let _=[];for(let T of this.store.due(E.toISOString())){let r=T.nextRunAt,d=hR(T.normalizedExpression,T.timezone,E,1)[0];if(T.missedRunPolicy==="catch_up"){let t=r,R=0;while(t<=E.toISOString()&&R<10)_.push(this.enqueue(T,{trigger:t===r?"scheduled":"catch_up",scheduledFor:t})),t=hR(T.normalizedExpression,T.timezone,new Date(t),1)[0],R++}else _.push(this.enqueue(T,{trigger:"scheduled",scheduledFor:r}));this.store.markScheduled(T.id,r,d)}return _}}function J9(E){return{"job.execute":async(T)=>{let r=T.operation.input&&typeof T.operation.input==="object"&&!Array.isArray(T.operation.input)?T.operation.input:{},d=E.store.get(String(r.jobId??"")),t=E.store.getExecution(String(r.executionId??""));if(!d||!t)throw Error("Scheduled job execution is no longer available.");E.store.transitionExecution(t.id,"running",{attempt:T.operation.attempt}),T.checkpoint("execute",`Running ${d.name} on ${d.provider}.`),T.log(`Trigger ${t.trigger}; scheduled for ${t.scheduledFor}; semantics at-least-once.`,{stream:"system"});let R=await E.executor(d,d.target,T);if(R.stdout)T.log(R.stdout,{stream:"stdout"});if(R.stderr)T.log(R.stderr,{stream:"stderr"});if(!R.ok){if(E.store.transitionExecution(t.id,T.operation.attempt>=d.retryPolicy.maxAttempts?"dead":"failed",{attempt:T.operation.attempt,error:R.stderr??"Job execution failed."}),R.retryable)throw new Jd(R.stderr??"Scheduled job failed transiently.","job_transient");throw Error(R.stderr??"Scheduled job failed.")}return E.store.transitionExecution(t.id,"succeeded",{attempt:T.operation.attempt,output:R.output??{}}),{jobId:d.id,executionId:t.id,provider:d.provider}}}}var ZT=(E)=>typeof E==="string"&&E?E:void 0,z9=(E)=>Number(E)===1,zN=(E)=>{try{return JSON.parse(String(E))}catch{return{}}},Uh=(E,_,T,r)=>{let d=Number(E);return Number.isFinite(d)?Math.min(r,Math.max(T,Math.floor(d))):_};function jD(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:ZT(E.environment_id),resourceId:ZT(E.resource_id),name:String(E.name),provider:String(E.provider),expression:String(E.expression),normalizedExpression:String(E.normalized_expression),timezone:String(E.timezone),startsAt:ZT(E.starts_at),endsAt:ZT(E.ends_at),flexibleMinutes:Number(E.flexible_minutes),target:zN(E.target),payloadRefs:zN(E.payload_refs),missedRunPolicy:String(E.missed_run_policy),overlapPolicy:String(E.overlap_policy),retryPolicy:zN(E.retry_policy),timeoutSeconds:Number(E.timeout_seconds),enabled:z9(E.enabled),origin:String(E.origin),sourceKey:ZT(E.source_key),ownerActorId:ZT(E.owner_actor_id),observedState:zN(E.observed_state),reconciliationStatus:String(E.reconciliation_status),nextRunAt:ZT(E.next_run_at),lastScheduledFor:ZT(E.last_scheduled_for),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function BD(E){return{id:String(E.id),jobId:String(E.job_id),operationId:ZT(E.operation_id),trigger:String(E.trigger),scheduledFor:String(E.scheduled_for),idempotencyKey:String(E.idempotency_key),status:String(E.status),attempt:Number(E.attempt),startedAt:ZT(E.started_at),finishedAt:ZT(E.finished_at),output:zN(E.output),error:ZT(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Lz(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:ZT(E.environment_id),resourceId:ZT(E.resource_id),name:String(E.name),provider:String(E.provider),queue:String(E.queue),processes:Number(E.processes),timeoutSeconds:Number(E.timeout_seconds),restartPolicy:String(E.restart_policy),target:zN(E.target),enabled:z9(E.enabled),origin:String(E.origin),sourceKey:ZT(E.source_key),ownerActorId:ZT(E.owner_actor_id),observedState:zN(E.observed_state),reconciliationStatus:String(E.reconciliation_status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class GA{controlPlane;options;constructor(E,_={}){this.controlPlane=E;this.options=_}now(){return this.options.now?.()??new Date}create(E){if(!E.name.trim())throw Error("Scheduled jobs require a name.");let _=NR(E.expression,E.timezone,this.now(),1),T=crypto.randomUUID(),r=this.now().toISOString(),d=E.startsAt?new Date(E.startsAt).toISOString():void 0,t=E.endsAt?new Date(E.endsAt).toISOString():void 0;if(d&&t&&d>=t)throw Error("Schedule start must be before end.");let R=_.nextRuns.find((h)=>(!d||h>=d)&&(!t||h<=t));return this.controlPlane.database.run("INSERT INTO scheduled_jobs (id,organization_id,project_id,environment_id,resource_id,name,provider,expression,normalized_expression,timezone,starts_at,ends_at,flexible_minutes,target,payload_refs,missed_run_policy,overlap_policy,retry_policy,timeout_seconds,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,next_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.environmentId??null,E.resourceId??null,E.name.trim().slice(0,120),E.provider,E.expression,_.normalized,E.timezone,d??null,t??null,Uh(E.flexibleMinutes,0,0,1440),JSON.stringify(E.target),JSON.stringify(E.payloadRefs),E.missedRunPolicy,E.overlapPolicy,JSON.stringify({maxAttempts:Uh(E.retryPolicy.maxAttempts,3,1,20),backoffSeconds:Uh(E.retryPolicy.backoffSeconds,30,0,86400),deadLetterRef:E.retryPolicy.deadLetterRef}),Uh(E.timeoutSeconds,900,1,86400),E.enabled?1:0,E.origin,E.sourceKey??null,E.ownerActorId??null,JSON.stringify(E.observedState),E.reconciliationStatus,R??null,1,r,r]),this.get(T)}get(E){let _=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE id=?").get(E);return _?jD(_):void 0}getBySource(E,_,T){let r=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE project_id=? AND environment_id IS ? AND source_key=?").get(E,_??null,T);return r?jD(r):void 0}list(E,_={}){let T=["project_id=?"],r=[E];if(_.environmentId)T.push("environment_id=?"),r.push(_.environmentId);if(_.resourceIds?.length)T.push(`resource_id IN (${_.resourceIds.map(()=>"?").join(",")})`),r.push(..._.resourceIds);if(_.enabled!=null)T.push("enabled=?"),r.push(_.enabled?1:0);return this.controlPlane.database.query(`SELECT * FROM scheduled_jobs WHERE ${T.join(" AND ")} ORDER BY next_run_at IS NULL,next_run_at,name`).all(...r).map(jD)}setEnabled(E,_){this.controlPlane.database.run("UPDATE scheduled_jobs SET enabled=?,version=version+1,updated_at=? WHERE id=?",[_?1:0,this.now().toISOString(),E]);let T=this.get(E);if(!T)throw Error("Scheduled job was not found.");return T}updateSchedule(E,_){let T=this.get(E);if(!T)throw Error("Scheduled job was not found.");let r=_.expression??T.expression,d=_.timezone??T.timezone,t=NR(r,d,this.now(),1),R=this.now().toISOString();return this.controlPlane.database.run("UPDATE scheduled_jobs SET expression=?,normalized_expression=?,timezone=?,missed_run_policy=?,overlap_policy=?,timeout_seconds=?,next_run_at=?,reconciliation_status=?,version=version+1,updated_at=? WHERE id=?",[r,t.normalized,d,_.missedRunPolicy??T.missedRunPolicy,_.overlapPolicy??T.overlapPolicy,Uh(_.timeoutSeconds,T.timeoutSeconds,1,86400),t.nextRuns[0],"pending",R,E]),this.get(E)}remove(E){let _=this.get(E);if(!_)throw Error("Scheduled job was not found.");if(_.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");this.controlPlane.database.run("DELETE FROM scheduled_jobs WHERE id=?",[E])}markScheduled(E,_,T){this.controlPlane.database.run("UPDATE scheduled_jobs SET last_scheduled_for=?,next_run_at=?,updated_at=? WHERE id=?",[_,T??null,this.now().toISOString(),E])}reconcile(E,_,T){return this.controlPlane.database.run("UPDATE scheduled_jobs SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[_,JSON.stringify(T),this.now().toISOString(),E]),this.get(E)}upsertConfigJob(E){let _=this.getBySource(E.projectId,E.environmentId,E.sourceKey);if(!_)return this.create(E);let T=NR(E.expression,E.timezone,this.now(),1),r=this.now().toISOString();if(_.resourceId===E.resourceId&&_.name===E.name&&_.provider===E.provider&&_.expression===E.expression&&_.normalizedExpression===T.normalized&&_.timezone===E.timezone&&JSON.stringify(_.target)===JSON.stringify(E.target)&&JSON.stringify(_.payloadRefs)===JSON.stringify(E.payloadRefs)&&_.missedRunPolicy===E.missedRunPolicy&&_.overlapPolicy===E.overlapPolicy&&JSON.stringify(_.retryPolicy)===JSON.stringify(E.retryPolicy)&&_.timeoutSeconds===E.timeoutSeconds&&_.enabled===E.enabled)return _;return this.controlPlane.database.run("UPDATE scheduled_jobs SET resource_id=?,name=?,provider=?,expression=?,normalized_expression=?,timezone=?,target=?,payload_refs=?,missed_run_policy=?,overlap_policy=?,retry_policy=?,timeout_seconds=?,enabled=?,observed_state=?,reconciliation_status=?,next_run_at=COALESCE(next_run_at,?),version=version+1,updated_at=? WHERE id=?",[E.resourceId??null,E.name,E.provider,E.expression,T.normalized,E.timezone,JSON.stringify(E.target),JSON.stringify(E.payloadRefs),E.missedRunPolicy,E.overlapPolicy,JSON.stringify(E.retryPolicy),E.timeoutSeconds,E.enabled?1:0,JSON.stringify(E.observedState),E.reconciliationStatus,T.nextRuns[0],r,_.id]),this.get(_.id)}due(E=this.now().toISOString()){return this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE enabled=1 AND next_run_at IS NOT NULL AND next_run_at<=? AND (starts_at IS NULL OR starts_at<=?) AND (ends_at IS NULL OR ends_at>=?) ORDER BY next_run_at LIMIT 200").all(E,E,E).map(jD)}createExecution(E){let _=this.controlPlane.database.query("SELECT * FROM job_executions WHERE idempotency_key=?").get(E.idempotencyKey);if(_)return BD(_);let T=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO job_executions (id,job_id,operation_id,trigger,scheduled_for,idempotency_key,status,attempt,output,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)",[T,E.jobId,E.operationId??null,E.trigger,E.scheduledFor,E.idempotencyKey,E.status,0,JSON.stringify(E.output),r,r]),this.getExecution(T)}getExecution(E){let _=this.controlPlane.database.query("SELECT * FROM job_executions WHERE id=?").get(E);return _?BD(_):void 0}listExecutions(E,_=100){return this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? ORDER BY scheduled_for DESC,created_at DESC LIMIT ?").all(E,Math.min(1000,Math.max(1,_))).map(BD)}activeExecution(E){let _=this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? AND status IN ('queued','running') ORDER BY created_at DESC LIMIT 1").get(E);return _?BD(_):void 0}attachOperation(E,_){return this.controlPlane.database.run("UPDATE job_executions SET operation_id=?,updated_at=? WHERE id=?",[_,this.now().toISOString(),E]),this.getExecution(E)}transitionExecution(E,_,T={}){let r=this.now().toISOString(),d=_==="running"?r:null,t=["succeeded","failed","skipped","dead"].includes(_)?r:null;return this.controlPlane.database.run("UPDATE job_executions SET status=?,attempt=COALESCE(?,attempt),started_at=COALESCE(started_at,?),finished_at=?,output=COALESCE(?,output),error=?,updated_at=? WHERE id=?",[_,T.attempt??null,d,t,T.output?JSON.stringify(T.output):null,T.error?.slice(0,2000)??null,r,E]),this.getExecution(E)}upsertWorker(E){let _=E.sourceKey?this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE project_id=? AND source_key=? AND environment_id IS ?").get(E.projectId,E.sourceKey,E.environmentId??null):void 0,T=_?Lz(_):void 0,r=T?.id??crypto.randomUUID(),d=this.now().toISOString(),t=Uh(E.processes,1,0,1000),R=Uh(E.timeoutSeconds,60,1,86400);if(T&&T.resourceId===E.resourceId&&T.name===E.name.slice(0,120)&&T.provider===E.provider&&T.queue===E.queue.slice(0,200)&&T.processes===t&&T.timeoutSeconds===R&&T.restartPolicy===E.restartPolicy&&JSON.stringify(T.target)===JSON.stringify(E.target)&&T.enabled===E.enabled)return T;return this.controlPlane.database.run("INSERT INTO worker_definitions (id,organization_id,project_id,environment_id,resource_id,name,provider,queue,processes,timeout_seconds,restart_policy,target,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET name=excluded.name,resource_id=excluded.resource_id,provider=excluded.provider,queue=excluded.queue,processes=excluded.processes,timeout_seconds=excluded.timeout_seconds,restart_policy=excluded.restart_policy,target=excluded.target,enabled=excluded.enabled,observed_state=excluded.observed_state,reconciliation_status=excluded.reconciliation_status,version=worker_definitions.version+1,updated_at=excluded.updated_at",[r,E.organizationId,E.projectId,E.environmentId??null,E.resourceId??null,E.name.slice(0,120),E.provider,E.queue.slice(0,200),t,R,E.restartPolicy,JSON.stringify(E.target),E.enabled?1:0,E.origin,E.sourceKey??null,E.ownerActorId??null,JSON.stringify(E.observedState),E.reconciliationStatus,1,T?.createdAt??d,d]),this.getWorker(r)}getWorker(E){let _=this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE id=?").get(E);return _?Lz(_):void 0}listWorkers(E,_){return this.controlPlane.database.query(`SELECT * FROM worker_definitions WHERE project_id=?${_?" AND environment_id=?":""} ORDER BY name`).all(E,..._?[_]:[]).map(Lz)}setWorkerProcesses(E,_){this.controlPlane.database.run("UPDATE worker_definitions SET processes=?,reconciliation_status='pending',version=version+1,updated_at=? WHERE id=?",[Uh(_,1,0,1000),this.now().toISOString(),E]);let T=this.getWorker(E);if(!T)throw Error("Worker was not found.");return T}reconcileWorker(E,_,T){this.controlPlane.database.run("UPDATE worker_definitions SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[_,JSON.stringify(T),this.now().toISOString(),E]);let r=this.getWorker(E);if(!r)throw Error("Worker was not found.");return r}}var N_=(E)=>E==null?void 0:String(E),WD=(E)=>Number(E)===1,$h=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}};function j9(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),provider:String(E.provider),endpoint:N_(E.endpoint),endpointPolicy:String(E.endpoint_policy),bucket:N_(E.bucket),prefix:String(E.prefix),region:N_(E.region),forcePathStyle:WD(E.force_path_style),credentialRef:N_(E.credential_ref),encryption:String(E.encryption),encryptionKeyRef:N_(E.encryption_key_ref),immutability:$h(E.immutability,{}),status:String(E.status),lastTestedAt:N_(E.last_tested_at),lastSuccessAt:N_(E.last_success_at),lastFailureAt:N_(E.last_failure_at),lastError:N_(E.last_error),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Oz(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:N_(E.environment_id),resourceId:N_(E.resource_id),dataServiceId:N_(E.data_service_id),destinationId:String(E.destination_id),name:String(E.name),resourceKind:String(E.resource_kind),schedule:String(E.schedule),timezone:String(E.timezone),retention:$h(E.retention,{}),compression:String(E.compression),encryption:String(E.encryption),includePatterns:$h(E.include_patterns,[]),excludePatterns:$h(E.exclude_patterns,[]),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),healthCheckId:N_(E.health_check_id),enabled:WD(E.enabled),nextRunAt:N_(E.next_run_at),lastRunAt:N_(E.last_run_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function cz(E){return{id:String(E.id),projectId:String(E.project_id),policyId:N_(E.policy_id),destinationId:String(E.destination_id),resourceId:N_(E.resource_id),dataServiceId:N_(E.data_service_id),backupJobId:N_(E.backup_job_id),kind:String(E.kind),pointInTime:String(E.point_in_time),uri:String(E.uri),sizeBytes:Number(E.size_bytes),checksum:String(E.checksum),manifest:$h(E.manifest,{}),toolVersion:N_(E.tool_version),engineVersion:N_(E.engine_version),expiresAt:N_(E.expires_at),lockedUntil:N_(E.locked_until),held:WD(E.held),pinned:WD(E.pinned),status:String(E.status),verificationState:String(E.verification_state),verifiedAt:N_(E.verified_at),durationMs:E.duration_ms==null?void 0:Number(E.duration_ms),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Uz(E){return{id:String(E.id),projectId:String(E.project_id),policyId:N_(E.policy_id),recoveryPointId:N_(E.recovery_point_id),operationId:N_(E.operation_id),kind:String(E.kind),status:String(E.status),idempotencyKey:String(E.idempotency_key),target:$h(E.target,{}),restoreMode:N_(E.restore_mode),cancellability:String(E.cancellability),safetyBackupId:N_(E.safety_backup_id),healthResult:E.health_result?$h(E.health_result,{}):void 0,progress:$h(E.progress,{}),error:N_(E.error),startedAt:N_(E.started_at),finishedAt:N_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Om(E){let _=E.toLowerCase();if(_==="localhost"||_.endsWith(".localhost")||_.endsWith(".local")||_.endsWith(".internal"))return!0;if(F9(_)===6)return _==="::1"||_.startsWith("fe80:");if(F9(_)!==4)return!1;let[T,r]=_.split(".").map(Number);return T===10||T===127||T===0||T===169&&r===254||T===172&&r>=16&&r<=31||T===192&&r===168}function cm(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Backup destination names must be 2-63 lowercase letters, numbers, or dashes.");if(E.provider!=="aws_backup"&&!E.bucket)throw Error("S3 backup destinations require a bucket.");if(E.provider==="s3_compatible"&&!E.endpoint)throw Error("S3-compatible destinations require an explicit endpoint.");if(E.provider==="s3_compatible"&&!E.credentialRef)throw Error("S3-compatible destinations require a credential reference.");if(E.encryption!=="provider"&&!E.encryptionKeyRef)throw Error("Client-side encryption requires an encryption key reference.");if(E.endpoint){let _=new URL(E.endpoint);if(_.protocol!=="https:"||_.username||_.password||_.search||_.hash||_.pathname!=="/")throw Error("Backup endpoints must be origin-only HTTPS URLs without credentials, paths, queries, or fragments.");if(Om(_.hostname)&&E.endpointPolicy!=="allow_private")throw Error("Private backup endpoints require endpointPolicy allow_private.")}}class HO{controlPlane;now;constructor(E,_=()=>new Date){this.controlPlane=E;this.now=_}createDestination(E){cm(E);let _=crypto.randomUUID(),T=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_destinations (id,organization_id,project_id,name,provider,endpoint,endpoint_policy,bucket,prefix,region,force_path_style,credential_ref,encryption,encryption_key_ref,immutability,status,last_tested_at,last_success_at,last_failure_at,last_error,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.name,E.provider,E.endpoint??null,E.endpointPolicy,E.bucket??null,E.prefix,E.region??null,E.forcePathStyle?1:0,E.credentialRef??null,E.encryption,E.encryptionKeyRef??null,JSON.stringify(E.immutability),E.status,E.lastTestedAt??null,E.lastSuccessAt??null,E.lastFailureAt??null,E.lastError??null,1,T,T]),this.getDestination(_)}getDestination(E){let _=this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE id=?").get(E);return _?j9(_):void 0}listDestinations(E){return this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE project_id=? ORDER BY name").all(E).map(j9)}recordDestinationTest(E,_){let T=this.now().toISOString();return this.controlPlane.database.run("UPDATE backup_destinations SET status=?,last_tested_at=?,last_success_at=CASE WHEN ? THEN ? ELSE last_success_at END,last_failure_at=CASE WHEN ? THEN last_failure_at ELSE ? END,last_error=?,version=version+1,updated_at=? WHERE id=?",[_.ok?"healthy":"failing",T,_.ok?1:0,T,_.ok?1:0,T,_.ok?null:String(_.error??"Destination test failed.").slice(0,1000),T,E]),this.getDestination(E)}createPolicy(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Backup policy names must be lowercase slugs.");if(!E.resourceId&&!E.dataServiceId&&!["control_plane","infrastructure"].includes(E.resourceKind))throw Error("A backup policy requires a resource or data service target.");let _=this.getDestination(E.destinationId);if(!_||_.projectId!==E.projectId)throw Error("Backup destination was not found.");if(E.resourceKind==="control_plane"&&_.encryption==="provider")throw Error("Control-plane backups require client-side destination encryption.");if(["logical_database","volume","files","control_plane"].includes(E.resourceKind)&&_.provider==="aws_backup")throw Error(`${E.resourceKind} backups require an object-storage destination.`);if(E.resourceKind==="infrastructure"&&_.provider!=="aws_backup")throw Error("Infrastructure backups require an AWS Backup destination.");let T=YA(E.schedule),r=hR(T.normalized,E.timezone,this.now(),1)[0],d=crypto.randomUUID(),t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_policies (id,organization_id,project_id,environment_id,resource_id,data_service_id,destination_id,name,resource_kind,schedule,timezone,retention,compression,encryption,include_patterns,exclude_patterns,expected_rpo_minutes,expected_rto_minutes,health_check_id,enabled,next_run_at,last_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[d,E.organizationId,E.projectId,E.environmentId??null,E.resourceId??null,E.dataServiceId??null,E.destinationId,E.name,E.resourceKind,T.normalized,E.timezone,JSON.stringify(E.retention),E.compression,E.encryption,JSON.stringify(E.includePatterns),JSON.stringify(E.excludePatterns),E.expectedRpoMinutes,E.expectedRtoMinutes,E.healthCheckId??null,E.enabled?1:0,r,E.lastRunAt??null,1,t,t]),this.getPolicy(d)}getPolicy(E){let _=this.controlPlane.database.query("SELECT * FROM backup_policies WHERE id=?").get(E);return _?Oz(_):void 0}listPolicies(E,_){return this.controlPlane.database.query(`SELECT * FROM backup_policies WHERE project_id=?${_?" AND environment_id=?":""} ORDER BY name`).all(E,..._?[_]:[]).map(Oz)}duePolicies(E=this.now()){return this.controlPlane.database.query("SELECT * FROM backup_policies WHERE enabled=1 AND next_run_at<=? ORDER BY next_run_at,id").all(E.toISOString()).map(Oz)}advancePolicy(E,_){let T=this.getPolicy(E);if(!T)throw Error("Backup policy was not found.");let r=hR(T.schedule,T.timezone,new Date(_),1)[0];return this.controlPlane.database.run("UPDATE backup_policies SET last_run_at=?,next_run_at=?,version=version+1,updated_at=? WHERE id=?",[_,r,this.now().toISOString(),E]),this.getPolicy(E)}createJob(E){let _=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE idempotency_key=?").get(E.idempotencyKey);if(_)return Uz(_);let T=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_jobs (id,project_id,policy_id,recovery_point_id,operation_id,kind,status,idempotency_key,target,restore_mode,cancellability,safety_backup_id,health_result,progress,error,started_at,finished_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.projectId,E.policyId??null,E.recoveryPointId??null,E.operationId??null,E.kind,E.status,E.idempotencyKey,JSON.stringify(E.target),E.restoreMode??null,E.cancellability,E.safetyBackupId??null,E.healthResult?JSON.stringify(E.healthResult):null,JSON.stringify(E.progress),E.error??null,E.startedAt??null,E.finishedAt??null,r,r]),this.getJob(T)}getJob(E){let _=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE id=?").get(E);return _?Uz(_):void 0}listJobs(E){return this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE project_id=? ORDER BY created_at DESC").all(E).map(Uz)}updateJob(E,_){let T=this.getJob(E);if(!T)throw Error("Backup job was not found.");let r={...T,..._};return this.controlPlane.database.run("UPDATE backup_jobs SET status=?,operation_id=?,recovery_point_id=?,progress=?,health_result=?,error=?,started_at=?,finished_at=?,safety_backup_id=?,updated_at=? WHERE id=?",[r.status,r.operationId??null,r.recoveryPointId??null,JSON.stringify(r.progress),r.healthResult?JSON.stringify(r.healthResult):null,r.error??null,r.startedAt??null,r.finishedAt??null,r.safetyBackupId??null,this.now().toISOString(),E]),this.getJob(E)}createRecoveryPoint(E){if(!/^sha256:[a-f0-9]{64}$/i.test(E.checksum))throw Error("Recovery points require a SHA-256 checksum.");if(typeof E.uri!=="string"||!["s3:","aws-backup:","file:"].some((r)=>E.uri.startsWith(r)))throw Error("Recovery point URI uses an unsupported destination scheme.");let _=crypto.randomUUID(),T=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO recovery_points (id,project_id,policy_id,destination_id,resource_id,data_service_id,backup_job_id,kind,point_in_time,uri,size_bytes,checksum,manifest,tool_version,engine_version,expires_at,locked_until,held,pinned,status,verification_state,verified_at,duration_ms,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.projectId,E.policyId??null,E.destinationId,E.resourceId??null,E.dataServiceId??null,E.backupJobId??null,E.kind,E.pointInTime,E.uri,E.sizeBytes,E.checksum,JSON.stringify(E.manifest),E.toolVersion??null,E.engineVersion??null,E.expiresAt??null,E.lockedUntil??null,E.held?1:0,E.pinned?1:0,E.status,E.verificationState,E.verifiedAt??null,E.durationMs??null,T,T]),this.getRecoveryPoint(_)}getRecoveryPoint(E){let _=this.controlPlane.database.query("SELECT * FROM recovery_points WHERE id=?").get(E);return _?cz(_):void 0}listRecoveryPoints(E,_){return this.controlPlane.database.query(`SELECT * FROM recovery_points WHERE project_id=?${_?" AND policy_id=?":""} ORDER BY point_in_time DESC`).all(E,..._?[_]:[]).map(cz)}updateRecoveryPoint(E,_){let T=this.getRecoveryPoint(E);if(!T)throw Error("Recovery point was not found.");let r={...T,..._};return this.controlPlane.database.run("UPDATE recovery_points SET status=?,verification_state=?,verified_at=?,held=?,pinned=?,manifest=?,duration_ms=?,updated_at=? WHERE id=?",[r.status,r.verificationState,r.verifiedAt??null,r.held?1:0,r.pinned?1:0,JSON.stringify(r.manifest),r.durationMs??null,this.now().toISOString(),E]),this.getRecoveryPoint(E)}retentionCandidates(E=this.now()){let _=this.controlPlane.database.query(`SELECT rp.* FROM recovery_points rp
+        GROUP BY project_id, COALESCE(environment_id, ''), COALESCE(resource_id, ''), source`,T)})()}}function FO(E,_,T,r=new Date){let d=new RR(E.controlPlane,{now:()=>r}),t=new WA(E);return E.listRules(_,T).filter((R)=>R.enabled&&!R.healthCheckId).map((R)=>{let h=new Date(r.getTime()-R.windowMs).toISOString(),N=d.query({projectId:_,environmentId:T,resourceIds:R.resourceId?[R.resourceId]:void 0,kinds:["metric"],names:[R.signal],from:h,to:new Date(r.getTime()+1).toISOString(),limit:5000}),S=N.records.flatMap((L)=>L.value==null?[]:[L.value]),A=S.length?R.operator==="gt"||R.operator==="gte"?Math.max(...S):R.operator==="lt"||R.operator==="lte"?Math.min(...S):S.at(0):void 0;return t.evaluate(R,{value:A,status:A==null?"no_data":void 0,timestamp:r.toISOString(),group:{resourceId:R.resourceId??"",source:N.records[0]?.source??""},evidence:{signal:R.signal,windowMs:R.windowMs,sampleCount:S.length,source:N.records[0]?.source??null}})})}VE();class jO{region;client;constructor(E="us-east-1",_=new JE){this.region=E;this.client=_}request(E,_){return this.client.request({service:"backup",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`CryoControllerFrontendService.${E}`},body:JSON.stringify(_)})}startBackupJob(E){return this.request("StartBackupJob",E)}describeBackupJob(E){return this.request("DescribeBackupJob",{BackupJobId:E})}startRestoreJob(E){return this.request("StartRestoreJob",E)}describeRestoreJob(E){return this.request("DescribeRestoreJob",{RestoreJobId:E})}deleteRecoveryPoint(E,_){return this.request("DeleteRecoveryPoint",{BackupVaultName:E,RecoveryPointArn:_})}}ut();Kh();PL();import{isIP as FQ}from"node:net";var hm={every_minute:"* * * * *",every_five_minutes:"*/5 * * * *",hourly:"0 * * * *",daily:"0 0 * * *",weekly:"0 0 * * 0"},Nm={JAN:1,FEB:2,MAR:3,APR:4,MAY:5,JUN:6,JUL:7,AUG:8,SEP:9,OCT:10,NOV:11,DEC:12},CQ={SUN:0,MON:1,TUE:2,WED:3,THU:4,FRI:5,SAT:6};function wQ(E){try{return new Intl.DateTimeFormat("en",{timeZone:E}).format(new Date),E}catch{throw Error(`Unknown schedule timezone: ${E}`)}}function FD(E,_,T,r){let d=_[E.toUpperCase()]??Number(E);if(!Number.isInteger(d)||d<T||d>r)throw Error(`Schedule field value ${E} is outside ${T}-${r}.`);return d}function yA(E,_,T,r={},d){if(E==="*"||E==="?")return;let t=new Set;for(let R of E.split(",")){let[h,N]=R.split("/"),S=N?FD(N,{},1,T-_+1):1,A,L;if(h==="*")A=_,L=T;else if(h.includes("-")){let O=h.split("-");A=FD(O[0],r,_,T),L=FD(O[1],r,_,T)}else A=FD(h,r,_,T),L=A;if(L<A)throw Error("Schedule ranges must be ascending.");for(let O=A;O<=L;O+=S)t.add(d?d(O):O===7&&T===7?0:O)}return t}function Sm(E,_){let T=Object.fromEntries(new Intl.DateTimeFormat("en-US",{timeZone:_,year:"numeric",month:"numeric",day:"numeric",weekday:"short",hour:"numeric",minute:"numeric",hourCycle:"h23"}).formatToParts(E).map((r)=>[r.type,r.value]));return{minute:Number(T.minute),hour:Number(T.hour),day:Number(T.day),month:Number(T.month),weekday:CQ[T.weekday.toUpperCase()],year:Number(T.year),key:`${T.year}-${T.month}-${T.day} ${T.hour}:${T.minute}`}}function eQ(E){let T=(E.startsWith("cron(")?E.slice(5,-1).trim():E.trim()).split(/\s+/);if(T.length!==5&&T.length!==6)throw Error("Cron schedules require five standard fields or six EventBridge fields.");let[r,d,t,R,h,N]=T,S=T.length===6;return{minute:yA(r,0,59),hour:yA(d,0,23),day:yA(t,1,31),month:yA(R,1,12,Nm),weekday:yA(h,S?1:0,7,CQ,S?(A)=>A===7?6:A-1:void 0),year:N?yA(N,1970,2199):void 0,dayWildcard:t==="*"||t==="?",weekdayWildcard:h==="*"||h==="?"}}function Am(E,_){if(!((!_.minute||_.minute.has(E.minute))&&(!_.hour||_.hour.has(E.hour))&&(!_.month||_.month.has(E.month))&&(!_.year||_.year.has(E.year))))return!1;let r=!_.day||_.day.has(E.day),d=!_.weekday||_.weekday.has(E.weekday);return _.dayWildcard?d:_.weekdayWildcard?r:r||d}function XQ(E){let _=/^rate\(\s*(\d+)\s+(minute|minutes|hour|hours|day|days)\s*\)$/i.exec(E);if(!_)return;let T=Number(_[1]);if(T<1)throw Error("Rate amount must be positive.");return T*(_[2].toLowerCase().startsWith("minute")?60000:_[2].toLowerCase().startsWith("hour")?3600000:86400000)}function YA(E){let _=E.trim(),T=hm[_.toLowerCase()]??_;if(!T)throw Error("Schedule expression is required.");let r=XQ(T);if(r){let d=r/60000;return{original:_,normalized:`rate(${d} minutes)`,kind:"rate",description:d%1440===0?`Every ${d/1440} day(s)`:d%60===0?`Every ${d/60} hour(s)`:`Every ${d} minute(s)`}}return eQ(T),{original:_,normalized:T.startsWith("cron(")?T:`cron(${T})`,kind:"cron",description:`Cron ${T.replace(/^cron\(|\)$/g,"")}`}}function hR(E,_,T=new Date,r=5){let d=YA(E),t=wQ(_),R=Math.min(20,Math.max(1,r)),h=XQ(d.normalized);if(h)return Array.from({length:R},(c,$)=>new Date(T.getTime()+h*($+1)).toISOString());let N=eQ(d.normalized),S=[],A=new Set,L=new Date(Math.floor(T.getTime()/60000)*60000+60000),O=0;while(S.length<R&&O<1100000){let c=Sm(L,t);if(Am(c,N)&&!A.has(c.key))S.push(L.toISOString()),A.add(c.key);L=new Date(L.getTime()+60000),O++}if(S.length<R)throw Error("Schedule produced no runs within the bounded preview horizon.");return S}function NR(E,_="UTC",T=new Date,r=5){let d=YA(E),t=hR(d.normalized,_,T,r),R=d.kind==="cron"?["Server cron and EventBridge use the same wall-clock preview; provider-specific extensions are retained only when supported."]:["Rate schedules use elapsed-time intervals and are not shifted by DST."];return{...d,timezone:wQ(_),nextRuns:t,capabilities:{server:d.kind==="cron",eventbridge:!0,notes:R}}}function BO(E){let _=YA(E.expression),T=_.normalized.slice(5,-1).trim().split(/\s+/),r=_.kind==="cron"&&T.length===5;if(E.provider==="server")return{provider:"server",supported:r,features:{timezone:!0,flexibleWindow:!1,catchUp:!1,replaceOverlap:!1},notes:[_.kind==="rate"?"Server cron requires a cron expression; use an equivalent cron schedule.":T.length!==5?"EventBridge six-field cron extensions cannot be installed as server cron.":"Cron is reconciled through a root-owned ts-cloud entry.",E.missedRunPolicy==="catch_up"?"Catch-up is handled by the control plane, not cron.":"Missed runs are skipped by cron."]};if(E.provider==="eventbridge")return{provider:"eventbridge",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["Five-field cron is translated explicitly to EventBridge six-field syntax. Flexible windows are provider-native; overlap and catch-up remain control-plane policies."]};if(E.provider==="lambda")return{provider:"lambda",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["The schedule invokes one immutable Lambda target."]};return{provider:"platform",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!0,replaceOverlap:!0},notes:["The durable control-plane worker enforces all configured policies."]}}function Lm(E){if(E.queues===!0)return[{queue:"default",processes:E.queueConcurrency??1}];if(!Array.isArray(E.queues))return[];return E.queues.map((_)=>{if(typeof _==="string")return{queue:_,processes:E.queueConcurrency??1};let[T,r]=Object.entries(_)[0]??["default",E.queueConcurrency??1];return{queue:T,processes:r}})}function QA(E,_,T){let r=new Set,d=new Set,t=new Map(T.resources.map((L)=>[L.slug,L])),R=0,h=0;for(let[L,O]of Object.entries(_.sites??{})){let c=t.get(L);if(O.scheduler){let C=`config:site:${L}:scheduler`;r.add(C),E.upsertConfigJob({organizationId:T.organization.id,projectId:T.project.id,environmentId:T.environment.id,resourceId:c?.id,name:`${L} scheduler`,provider:"server",expression:"* * * * *",timezone:"UTC",flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:`scheduler:run:${L}`},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:300,enabled:!0,origin:"config",sourceKey:C,observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),R++}let $=O,I=Array.isArray($.queues??$.workers)?$.queues??$.workers:[];for(let[C,e]of I.entries()){let z=typeof e==="string"?{queue:e}:e,F=String(z.queue??z.name??"default"),B=`config:site:${L}:worker:${C}:${F}`;d.add(B),E.upsertWorker({organizationId:T.organization.id,projectId:T.project.id,environmentId:T.environment.id,resourceId:c?.id,name:`${L}:${F}`,provider:"systemd",queue:F,processes:Number(z.processes)||1,timeoutSeconds:Number(z.timeout)||60,restartPolicy:"always",target:{operationId:`worker:restart:${L}`,site:L},enabled:!0,origin:"config",sourceKey:B,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),h++}}let N=_.infrastructure?.compute?.backups;if(N?.enabled)r.add("config:platform:backup"),E.upsertConfigJob({organizationId:T.organization.id,projectId:T.project.id,environmentId:T.environment.id,name:"Scheduled backup",provider:"server",expression:String(N.schedule??"0 2 * * *"),timezone:String(N.timezone??"UTC"),flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:"backup:run"},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:60},timeoutSeconds:3600,enabled:!0,origin:"config",sourceKey:"config:platform:backup",observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),R++;let S=_.environments?.[T.environment.slug]?.app;if(S){if(S.scheduler!=="off"){let L=`config:serverless:${T.environment.slug}:scheduler`;r.add(L),E.upsertConfigJob({organizationId:T.organization.id,projectId:T.project.id,environmentId:T.environment.id,name:`${T.environment.name} serverless scheduler`,provider:"eventbridge",expression:"rate(1 minute)",timezone:"UTC",flexibleMinutes:0,target:{kind:"serverless_scheduler",action:"schedule:run"},payloadRefs:{},missedRunPolicy:S.scheduler==="sub-minute"?"catch_up":"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:S.cliTimeout??900,enabled:!0,origin:"config",sourceKey:L,observedState:{source:"cloud.config.ts",mode:S.scheduler??"on"},reconciliationStatus:"pending"}),R++}for(let{queue:L,processes:O}of Lm(S)){let c=`config:serverless:${T.environment.slug}:worker:${L}`;d.add(c),E.upsertWorker({organizationId:T.organization.id,projectId:T.project.id,environmentId:T.environment.id,name:`${T.environment.name}:${L}`,provider:"lambda",queue:L,processes:O,timeoutSeconds:S.queueTimeout??120,restartPolicy:"on_failure",target:{function:"queue",queue:L},enabled:!0,origin:"config",sourceKey:c,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),h++}}let A=0;for(let L of E.list(T.project.id,{environmentId:T.environment.id}).filter((O)=>O.origin==="config"&&O.sourceKey&&!r.has(O.sourceKey)))E.reconcile(L.id,"drifted",{...L.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),A++;for(let L of E.listWorkers(T.project.id,T.environment.id).filter((O)=>O.origin==="config"&&O.sourceKey&&!d.has(O.sourceKey)))E.reconcileWorker(L.id,"drifted",{...L.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),A++;return{jobs:R,workers:h,drifted:A}}class WO{store;queue;constructor(E,_={}){this.store=E;this.queue=_.queue??new lE(E.controlPlane)}enqueue(E,_){let T=new Date(_.scheduledFor??this.store.now()).toISOString(),r=`${E.id}:${_.trigger==="manual"?crypto.randomUUID():T}`,d=this.store.activeExecution(E.id);if(d&&E.overlapPolicy==="forbid")return this.store.createExecution({jobId:E.id,trigger:_.trigger,scheduledFor:T,idempotencyKey:r,status:"skipped",output:{reason:"overlap_forbidden",activeExecutionId:d.id}});if(d&&E.overlapPolicy==="replace"&&d.operationId)try{this.queue.requestCancellation(d.operationId,_.actorId)}catch{}let t=this.store.createExecution({jobId:E.id,trigger:_.trigger,scheduledFor:T,idempotencyKey:r,status:"queued",output:{semantics:"at_least_once"}});if(t.operationId)return t;let R=this.queue.enqueue({projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,actorId:_.actorId,kind:"job.execute",input:{jobId:E.id,executionId:t.id},idempotencyKey:`job-execution:${t.id}`,lockKey:E.overlapPolicy==="allow"?`job-execution:${t.id}`:`job:${E.id}`,maxAttempts:E.retryPolicy.maxAttempts,timeoutSeconds:E.timeoutSeconds,retryClasses:["job_transient"],resumePolicy:"requeue"}).operation;return this.store.attachOperation(t.id,R.id)}tick(E=this.store.now()){let _=[];for(let T of this.store.due(E.toISOString())){let r=T.nextRunAt,d=hR(T.normalizedExpression,T.timezone,E,1)[0];if(T.missedRunPolicy==="catch_up"){let t=r,R=0;while(t<=E.toISOString()&&R<10)_.push(this.enqueue(T,{trigger:t===r?"scheduled":"catch_up",scheduledFor:t})),t=hR(T.normalizedExpression,T.timezone,new Date(t),1)[0],R++}else _.push(this.enqueue(T,{trigger:"scheduled",scheduledFor:r}));this.store.markScheduled(T.id,r,d)}return _}}function JQ(E){return{"job.execute":async(T)=>{let r=T.operation.input&&typeof T.operation.input==="object"&&!Array.isArray(T.operation.input)?T.operation.input:{},d=E.store.get(String(r.jobId??"")),t=E.store.getExecution(String(r.executionId??""));if(!d||!t)throw Error("Scheduled job execution is no longer available.");E.store.transitionExecution(t.id,"running",{attempt:T.operation.attempt}),T.checkpoint("execute",`Running ${d.name} on ${d.provider}.`),T.log(`Trigger ${t.trigger}; scheduled for ${t.scheduledFor}; semantics at-least-once.`,{stream:"system"});let R=await E.executor(d,d.target,T);if(R.stdout)T.log(R.stdout,{stream:"stdout"});if(R.stderr)T.log(R.stderr,{stream:"stderr"});if(!R.ok){if(E.store.transitionExecution(t.id,T.operation.attempt>=d.retryPolicy.maxAttempts?"dead":"failed",{attempt:T.operation.attempt,error:R.stderr??"Job execution failed."}),R.retryable)throw new Jd(R.stderr??"Scheduled job failed transiently.","job_transient");throw Error(R.stderr??"Scheduled job failed.")}return E.store.transitionExecution(t.id,"succeeded",{attempt:T.operation.attempt,output:R.output??{}}),{jobId:d.id,executionId:t.id,provider:d.provider}}}}var ZT=(E)=>typeof E==="string"&&E?E:void 0,zQ=(E)=>Number(E)===1,zN=(E)=>{try{return JSON.parse(String(E))}catch{return{}}},Uh=(E,_,T,r)=>{let d=Number(E);return Number.isFinite(d)?Math.min(r,Math.max(T,Math.floor(d))):_};function jD(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:ZT(E.environment_id),resourceId:ZT(E.resource_id),name:String(E.name),provider:String(E.provider),expression:String(E.expression),normalizedExpression:String(E.normalized_expression),timezone:String(E.timezone),startsAt:ZT(E.starts_at),endsAt:ZT(E.ends_at),flexibleMinutes:Number(E.flexible_minutes),target:zN(E.target),payloadRefs:zN(E.payload_refs),missedRunPolicy:String(E.missed_run_policy),overlapPolicy:String(E.overlap_policy),retryPolicy:zN(E.retry_policy),timeoutSeconds:Number(E.timeout_seconds),enabled:zQ(E.enabled),origin:String(E.origin),sourceKey:ZT(E.source_key),ownerActorId:ZT(E.owner_actor_id),observedState:zN(E.observed_state),reconciliationStatus:String(E.reconciliation_status),nextRunAt:ZT(E.next_run_at),lastScheduledFor:ZT(E.last_scheduled_for),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function BD(E){return{id:String(E.id),jobId:String(E.job_id),operationId:ZT(E.operation_id),trigger:String(E.trigger),scheduledFor:String(E.scheduled_for),idempotencyKey:String(E.idempotency_key),status:String(E.status),attempt:Number(E.attempt),startedAt:ZT(E.started_at),finishedAt:ZT(E.finished_at),output:zN(E.output),error:ZT(E.error),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Lz(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:ZT(E.environment_id),resourceId:ZT(E.resource_id),name:String(E.name),provider:String(E.provider),queue:String(E.queue),processes:Number(E.processes),timeoutSeconds:Number(E.timeout_seconds),restartPolicy:String(E.restart_policy),target:zN(E.target),enabled:zQ(E.enabled),origin:String(E.origin),sourceKey:ZT(E.source_key),ownerActorId:ZT(E.owner_actor_id),observedState:zN(E.observed_state),reconciliationStatus:String(E.reconciliation_status),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}class GA{controlPlane;options;constructor(E,_={}){this.controlPlane=E;this.options=_}now(){return this.options.now?.()??new Date}create(E){if(!E.name.trim())throw Error("Scheduled jobs require a name.");let _=NR(E.expression,E.timezone,this.now(),1),T=crypto.randomUUID(),r=this.now().toISOString(),d=E.startsAt?new Date(E.startsAt).toISOString():void 0,t=E.endsAt?new Date(E.endsAt).toISOString():void 0;if(d&&t&&d>=t)throw Error("Schedule start must be before end.");let R=_.nextRuns.find((h)=>(!d||h>=d)&&(!t||h<=t));return this.controlPlane.database.run("INSERT INTO scheduled_jobs (id,organization_id,project_id,environment_id,resource_id,name,provider,expression,normalized_expression,timezone,starts_at,ends_at,flexible_minutes,target,payload_refs,missed_run_policy,overlap_policy,retry_policy,timeout_seconds,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,next_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.organizationId,E.projectId,E.environmentId??null,E.resourceId??null,E.name.trim().slice(0,120),E.provider,E.expression,_.normalized,E.timezone,d??null,t??null,Uh(E.flexibleMinutes,0,0,1440),JSON.stringify(E.target),JSON.stringify(E.payloadRefs),E.missedRunPolicy,E.overlapPolicy,JSON.stringify({maxAttempts:Uh(E.retryPolicy.maxAttempts,3,1,20),backoffSeconds:Uh(E.retryPolicy.backoffSeconds,30,0,86400),deadLetterRef:E.retryPolicy.deadLetterRef}),Uh(E.timeoutSeconds,900,1,86400),E.enabled?1:0,E.origin,E.sourceKey??null,E.ownerActorId??null,JSON.stringify(E.observedState),E.reconciliationStatus,R??null,1,r,r]),this.get(T)}get(E){let _=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE id=?").get(E);return _?jD(_):void 0}getBySource(E,_,T){let r=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE project_id=? AND environment_id IS ? AND source_key=?").get(E,_??null,T);return r?jD(r):void 0}list(E,_={}){let T=["project_id=?"],r=[E];if(_.environmentId)T.push("environment_id=?"),r.push(_.environmentId);if(_.resourceIds?.length)T.push(`resource_id IN (${_.resourceIds.map(()=>"?").join(",")})`),r.push(..._.resourceIds);if(_.enabled!=null)T.push("enabled=?"),r.push(_.enabled?1:0);return this.controlPlane.database.query(`SELECT * FROM scheduled_jobs WHERE ${T.join(" AND ")} ORDER BY next_run_at IS NULL,next_run_at,name`).all(...r).map(jD)}setEnabled(E,_){this.controlPlane.database.run("UPDATE scheduled_jobs SET enabled=?,version=version+1,updated_at=? WHERE id=?",[_?1:0,this.now().toISOString(),E]);let T=this.get(E);if(!T)throw Error("Scheduled job was not found.");return T}updateSchedule(E,_){let T=this.get(E);if(!T)throw Error("Scheduled job was not found.");let r=_.expression??T.expression,d=_.timezone??T.timezone,t=NR(r,d,this.now(),1),R=this.now().toISOString();return this.controlPlane.database.run("UPDATE scheduled_jobs SET expression=?,normalized_expression=?,timezone=?,missed_run_policy=?,overlap_policy=?,timeout_seconds=?,next_run_at=?,reconciliation_status=?,version=version+1,updated_at=? WHERE id=?",[r,t.normalized,d,_.missedRunPolicy??T.missedRunPolicy,_.overlapPolicy??T.overlapPolicy,Uh(_.timeoutSeconds,T.timeoutSeconds,1,86400),t.nextRuns[0],"pending",R,E]),this.get(E)}remove(E){let _=this.get(E);if(!_)throw Error("Scheduled job was not found.");if(_.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");this.controlPlane.database.run("DELETE FROM scheduled_jobs WHERE id=?",[E])}markScheduled(E,_,T){this.controlPlane.database.run("UPDATE scheduled_jobs SET last_scheduled_for=?,next_run_at=?,updated_at=? WHERE id=?",[_,T??null,this.now().toISOString(),E])}reconcile(E,_,T){return this.controlPlane.database.run("UPDATE scheduled_jobs SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[_,JSON.stringify(T),this.now().toISOString(),E]),this.get(E)}upsertConfigJob(E){let _=this.getBySource(E.projectId,E.environmentId,E.sourceKey);if(!_)return this.create(E);let T=NR(E.expression,E.timezone,this.now(),1),r=this.now().toISOString();if(_.resourceId===E.resourceId&&_.name===E.name&&_.provider===E.provider&&_.expression===E.expression&&_.normalizedExpression===T.normalized&&_.timezone===E.timezone&&JSON.stringify(_.target)===JSON.stringify(E.target)&&JSON.stringify(_.payloadRefs)===JSON.stringify(E.payloadRefs)&&_.missedRunPolicy===E.missedRunPolicy&&_.overlapPolicy===E.overlapPolicy&&JSON.stringify(_.retryPolicy)===JSON.stringify(E.retryPolicy)&&_.timeoutSeconds===E.timeoutSeconds&&_.enabled===E.enabled)return _;return this.controlPlane.database.run("UPDATE scheduled_jobs SET resource_id=?,name=?,provider=?,expression=?,normalized_expression=?,timezone=?,target=?,payload_refs=?,missed_run_policy=?,overlap_policy=?,retry_policy=?,timeout_seconds=?,enabled=?,observed_state=?,reconciliation_status=?,next_run_at=COALESCE(next_run_at,?),version=version+1,updated_at=? WHERE id=?",[E.resourceId??null,E.name,E.provider,E.expression,T.normalized,E.timezone,JSON.stringify(E.target),JSON.stringify(E.payloadRefs),E.missedRunPolicy,E.overlapPolicy,JSON.stringify(E.retryPolicy),E.timeoutSeconds,E.enabled?1:0,JSON.stringify(E.observedState),E.reconciliationStatus,T.nextRuns[0],r,_.id]),this.get(_.id)}due(E=this.now().toISOString()){return this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE enabled=1 AND next_run_at IS NOT NULL AND next_run_at<=? AND (starts_at IS NULL OR starts_at<=?) AND (ends_at IS NULL OR ends_at>=?) ORDER BY next_run_at LIMIT 200").all(E,E,E).map(jD)}createExecution(E){let _=this.controlPlane.database.query("SELECT * FROM job_executions WHERE idempotency_key=?").get(E.idempotencyKey);if(_)return BD(_);let T=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO job_executions (id,job_id,operation_id,trigger,scheduled_for,idempotency_key,status,attempt,output,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)",[T,E.jobId,E.operationId??null,E.trigger,E.scheduledFor,E.idempotencyKey,E.status,0,JSON.stringify(E.output),r,r]),this.getExecution(T)}getExecution(E){let _=this.controlPlane.database.query("SELECT * FROM job_executions WHERE id=?").get(E);return _?BD(_):void 0}listExecutions(E,_=100){return this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? ORDER BY scheduled_for DESC,created_at DESC LIMIT ?").all(E,Math.min(1000,Math.max(1,_))).map(BD)}activeExecution(E){let _=this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? AND status IN ('queued','running') ORDER BY created_at DESC LIMIT 1").get(E);return _?BD(_):void 0}attachOperation(E,_){return this.controlPlane.database.run("UPDATE job_executions SET operation_id=?,updated_at=? WHERE id=?",[_,this.now().toISOString(),E]),this.getExecution(E)}transitionExecution(E,_,T={}){let r=this.now().toISOString(),d=_==="running"?r:null,t=["succeeded","failed","skipped","dead"].includes(_)?r:null;return this.controlPlane.database.run("UPDATE job_executions SET status=?,attempt=COALESCE(?,attempt),started_at=COALESCE(started_at,?),finished_at=?,output=COALESCE(?,output),error=?,updated_at=? WHERE id=?",[_,T.attempt??null,d,t,T.output?JSON.stringify(T.output):null,T.error?.slice(0,2000)??null,r,E]),this.getExecution(E)}upsertWorker(E){let _=E.sourceKey?this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE project_id=? AND source_key=? AND environment_id IS ?").get(E.projectId,E.sourceKey,E.environmentId??null):void 0,T=_?Lz(_):void 0,r=T?.id??crypto.randomUUID(),d=this.now().toISOString(),t=Uh(E.processes,1,0,1000),R=Uh(E.timeoutSeconds,60,1,86400);if(T&&T.resourceId===E.resourceId&&T.name===E.name.slice(0,120)&&T.provider===E.provider&&T.queue===E.queue.slice(0,200)&&T.processes===t&&T.timeoutSeconds===R&&T.restartPolicy===E.restartPolicy&&JSON.stringify(T.target)===JSON.stringify(E.target)&&T.enabled===E.enabled)return T;return this.controlPlane.database.run("INSERT INTO worker_definitions (id,organization_id,project_id,environment_id,resource_id,name,provider,queue,processes,timeout_seconds,restart_policy,target,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET name=excluded.name,resource_id=excluded.resource_id,provider=excluded.provider,queue=excluded.queue,processes=excluded.processes,timeout_seconds=excluded.timeout_seconds,restart_policy=excluded.restart_policy,target=excluded.target,enabled=excluded.enabled,observed_state=excluded.observed_state,reconciliation_status=excluded.reconciliation_status,version=worker_definitions.version+1,updated_at=excluded.updated_at",[r,E.organizationId,E.projectId,E.environmentId??null,E.resourceId??null,E.name.slice(0,120),E.provider,E.queue.slice(0,200),t,R,E.restartPolicy,JSON.stringify(E.target),E.enabled?1:0,E.origin,E.sourceKey??null,E.ownerActorId??null,JSON.stringify(E.observedState),E.reconciliationStatus,1,T?.createdAt??d,d]),this.getWorker(r)}getWorker(E){let _=this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE id=?").get(E);return _?Lz(_):void 0}listWorkers(E,_){return this.controlPlane.database.query(`SELECT * FROM worker_definitions WHERE project_id=?${_?" AND environment_id=?":""} ORDER BY name`).all(E,..._?[_]:[]).map(Lz)}setWorkerProcesses(E,_){this.controlPlane.database.run("UPDATE worker_definitions SET processes=?,reconciliation_status='pending',version=version+1,updated_at=? WHERE id=?",[Uh(_,1,0,1000),this.now().toISOString(),E]);let T=this.getWorker(E);if(!T)throw Error("Worker was not found.");return T}reconcileWorker(E,_,T){this.controlPlane.database.run("UPDATE worker_definitions SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[_,JSON.stringify(T),this.now().toISOString(),E]);let r=this.getWorker(E);if(!r)throw Error("Worker was not found.");return r}}var N_=(E)=>E==null?void 0:String(E),WD=(E)=>Number(E)===1,$h=(E,_)=>{try{return JSON.parse(String(E))}catch{return _}};function jQ(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),name:String(E.name),provider:String(E.provider),endpoint:N_(E.endpoint),endpointPolicy:String(E.endpoint_policy),bucket:N_(E.bucket),prefix:String(E.prefix),region:N_(E.region),forcePathStyle:WD(E.force_path_style),credentialRef:N_(E.credential_ref),encryption:String(E.encryption),encryptionKeyRef:N_(E.encryption_key_ref),immutability:$h(E.immutability,{}),status:String(E.status),lastTestedAt:N_(E.last_tested_at),lastSuccessAt:N_(E.last_success_at),lastFailureAt:N_(E.last_failure_at),lastError:N_(E.last_error),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Oz(E){return{id:String(E.id),organizationId:String(E.organization_id),projectId:String(E.project_id),environmentId:N_(E.environment_id),resourceId:N_(E.resource_id),dataServiceId:N_(E.data_service_id),destinationId:String(E.destination_id),name:String(E.name),resourceKind:String(E.resource_kind),schedule:String(E.schedule),timezone:String(E.timezone),retention:$h(E.retention,{}),compression:String(E.compression),encryption:String(E.encryption),includePatterns:$h(E.include_patterns,[]),excludePatterns:$h(E.exclude_patterns,[]),expectedRpoMinutes:Number(E.expected_rpo_minutes),expectedRtoMinutes:Number(E.expected_rto_minutes),healthCheckId:N_(E.health_check_id),enabled:WD(E.enabled),nextRunAt:N_(E.next_run_at),lastRunAt:N_(E.last_run_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function cz(E){return{id:String(E.id),projectId:String(E.project_id),policyId:N_(E.policy_id),destinationId:String(E.destination_id),resourceId:N_(E.resource_id),dataServiceId:N_(E.data_service_id),backupJobId:N_(E.backup_job_id),kind:String(E.kind),pointInTime:String(E.point_in_time),uri:String(E.uri),sizeBytes:Number(E.size_bytes),checksum:String(E.checksum),manifest:$h(E.manifest,{}),toolVersion:N_(E.tool_version),engineVersion:N_(E.engine_version),expiresAt:N_(E.expires_at),lockedUntil:N_(E.locked_until),held:WD(E.held),pinned:WD(E.pinned),status:String(E.status),verificationState:String(E.verification_state),verifiedAt:N_(E.verified_at),durationMs:E.duration_ms==null?void 0:Number(E.duration_ms),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Uz(E){return{id:String(E.id),projectId:String(E.project_id),policyId:N_(E.policy_id),recoveryPointId:N_(E.recovery_point_id),operationId:N_(E.operation_id),kind:String(E.kind),status:String(E.status),idempotencyKey:String(E.idempotency_key),target:$h(E.target,{}),restoreMode:N_(E.restore_mode),cancellability:String(E.cancellability),safetyBackupId:N_(E.safety_backup_id),healthResult:E.health_result?$h(E.health_result,{}):void 0,progress:$h(E.progress,{}),error:N_(E.error),startedAt:N_(E.started_at),finishedAt:N_(E.finished_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Om(E){let _=E.toLowerCase();if(_==="localhost"||_.endsWith(".localhost")||_.endsWith(".local")||_.endsWith(".internal"))return!0;if(FQ(_)===6)return _==="::1"||_.startsWith("fe80:");if(FQ(_)!==4)return!1;let[T,r]=_.split(".").map(Number);return T===10||T===127||T===0||T===169&&r===254||T===172&&r>=16&&r<=31||T===192&&r===168}function cm(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Backup destination names must be 2-63 lowercase letters, numbers, or dashes.");if(E.provider!=="aws_backup"&&!E.bucket)throw Error("S3 backup destinations require a bucket.");if(E.provider==="s3_compatible"&&!E.endpoint)throw Error("S3-compatible destinations require an explicit endpoint.");if(E.provider==="s3_compatible"&&!E.credentialRef)throw Error("S3-compatible destinations require a credential reference.");if(E.encryption!=="provider"&&!E.encryptionKeyRef)throw Error("Client-side encryption requires an encryption key reference.");if(E.endpoint){let _=new URL(E.endpoint);if(_.protocol!=="https:"||_.username||_.password||_.search||_.hash||_.pathname!=="/")throw Error("Backup endpoints must be origin-only HTTPS URLs without credentials, paths, queries, or fragments.");if(Om(_.hostname)&&E.endpointPolicy!=="allow_private")throw Error("Private backup endpoints require endpointPolicy allow_private.")}}class HO{controlPlane;now;constructor(E,_=()=>new Date){this.controlPlane=E;this.now=_}createDestination(E){cm(E);let _=crypto.randomUUID(),T=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_destinations (id,organization_id,project_id,name,provider,endpoint,endpoint_policy,bucket,prefix,region,force_path_style,credential_ref,encryption,encryption_key_ref,immutability,status,last_tested_at,last_success_at,last_failure_at,last_error,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.organizationId,E.projectId,E.name,E.provider,E.endpoint??null,E.endpointPolicy,E.bucket??null,E.prefix,E.region??null,E.forcePathStyle?1:0,E.credentialRef??null,E.encryption,E.encryptionKeyRef??null,JSON.stringify(E.immutability),E.status,E.lastTestedAt??null,E.lastSuccessAt??null,E.lastFailureAt??null,E.lastError??null,1,T,T]),this.getDestination(_)}getDestination(E){let _=this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE id=?").get(E);return _?jQ(_):void 0}listDestinations(E){return this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE project_id=? ORDER BY name").all(E).map(jQ)}recordDestinationTest(E,_){let T=this.now().toISOString();return this.controlPlane.database.run("UPDATE backup_destinations SET status=?,last_tested_at=?,last_success_at=CASE WHEN ? THEN ? ELSE last_success_at END,last_failure_at=CASE WHEN ? THEN last_failure_at ELSE ? END,last_error=?,version=version+1,updated_at=? WHERE id=?",[_.ok?"healthy":"failing",T,_.ok?1:0,T,_.ok?1:0,T,_.ok?null:String(_.error??"Destination test failed.").slice(0,1000),T,E]),this.getDestination(E)}createPolicy(E){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(E.name))throw Error("Backup policy names must be lowercase slugs.");if(!E.resourceId&&!E.dataServiceId&&!["control_plane","infrastructure"].includes(E.resourceKind))throw Error("A backup policy requires a resource or data service target.");let _=this.getDestination(E.destinationId);if(!_||_.projectId!==E.projectId)throw Error("Backup destination was not found.");if(E.resourceKind==="control_plane"&&_.encryption==="provider")throw Error("Control-plane backups require client-side destination encryption.");if(["logical_database","volume","files","control_plane"].includes(E.resourceKind)&&_.provider==="aws_backup")throw Error(`${E.resourceKind} backups require an object-storage destination.`);if(E.resourceKind==="infrastructure"&&_.provider!=="aws_backup")throw Error("Infrastructure backups require an AWS Backup destination.");let T=YA(E.schedule),r=hR(T.normalized,E.timezone,this.now(),1)[0],d=crypto.randomUUID(),t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_policies (id,organization_id,project_id,environment_id,resource_id,data_service_id,destination_id,name,resource_kind,schedule,timezone,retention,compression,encryption,include_patterns,exclude_patterns,expected_rpo_minutes,expected_rto_minutes,health_check_id,enabled,next_run_at,last_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[d,E.organizationId,E.projectId,E.environmentId??null,E.resourceId??null,E.dataServiceId??null,E.destinationId,E.name,E.resourceKind,T.normalized,E.timezone,JSON.stringify(E.retention),E.compression,E.encryption,JSON.stringify(E.includePatterns),JSON.stringify(E.excludePatterns),E.expectedRpoMinutes,E.expectedRtoMinutes,E.healthCheckId??null,E.enabled?1:0,r,E.lastRunAt??null,1,t,t]),this.getPolicy(d)}getPolicy(E){let _=this.controlPlane.database.query("SELECT * FROM backup_policies WHERE id=?").get(E);return _?Oz(_):void 0}listPolicies(E,_){return this.controlPlane.database.query(`SELECT * FROM backup_policies WHERE project_id=?${_?" AND environment_id=?":""} ORDER BY name`).all(E,..._?[_]:[]).map(Oz)}duePolicies(E=this.now()){return this.controlPlane.database.query("SELECT * FROM backup_policies WHERE enabled=1 AND next_run_at<=? ORDER BY next_run_at,id").all(E.toISOString()).map(Oz)}advancePolicy(E,_){let T=this.getPolicy(E);if(!T)throw Error("Backup policy was not found.");let r=hR(T.schedule,T.timezone,new Date(_),1)[0];return this.controlPlane.database.run("UPDATE backup_policies SET last_run_at=?,next_run_at=?,version=version+1,updated_at=? WHERE id=?",[_,r,this.now().toISOString(),E]),this.getPolicy(E)}createJob(E){let _=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE idempotency_key=?").get(E.idempotencyKey);if(_)return Uz(_);let T=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_jobs (id,project_id,policy_id,recovery_point_id,operation_id,kind,status,idempotency_key,target,restore_mode,cancellability,safety_backup_id,health_result,progress,error,started_at,finished_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[T,E.projectId,E.policyId??null,E.recoveryPointId??null,E.operationId??null,E.kind,E.status,E.idempotencyKey,JSON.stringify(E.target),E.restoreMode??null,E.cancellability,E.safetyBackupId??null,E.healthResult?JSON.stringify(E.healthResult):null,JSON.stringify(E.progress),E.error??null,E.startedAt??null,E.finishedAt??null,r,r]),this.getJob(T)}getJob(E){let _=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE id=?").get(E);return _?Uz(_):void 0}listJobs(E){return this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE project_id=? ORDER BY created_at DESC").all(E).map(Uz)}updateJob(E,_){let T=this.getJob(E);if(!T)throw Error("Backup job was not found.");let r={...T,..._};return this.controlPlane.database.run("UPDATE backup_jobs SET status=?,operation_id=?,recovery_point_id=?,progress=?,health_result=?,error=?,started_at=?,finished_at=?,safety_backup_id=?,updated_at=? WHERE id=?",[r.status,r.operationId??null,r.recoveryPointId??null,JSON.stringify(r.progress),r.healthResult?JSON.stringify(r.healthResult):null,r.error??null,r.startedAt??null,r.finishedAt??null,r.safetyBackupId??null,this.now().toISOString(),E]),this.getJob(E)}createRecoveryPoint(E){if(!/^sha256:[a-f0-9]{64}$/i.test(E.checksum))throw Error("Recovery points require a SHA-256 checksum.");if(typeof E.uri!=="string"||!["s3:","aws-backup:","file:"].some((r)=>E.uri.startsWith(r)))throw Error("Recovery point URI uses an unsupported destination scheme.");let _=crypto.randomUUID(),T=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO recovery_points (id,project_id,policy_id,destination_id,resource_id,data_service_id,backup_job_id,kind,point_in_time,uri,size_bytes,checksum,manifest,tool_version,engine_version,expires_at,locked_until,held,pinned,status,verification_state,verified_at,duration_ms,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[_,E.projectId,E.policyId??null,E.destinationId,E.resourceId??null,E.dataServiceId??null,E.backupJobId??null,E.kind,E.pointInTime,E.uri,E.sizeBytes,E.checksum,JSON.stringify(E.manifest),E.toolVersion??null,E.engineVersion??null,E.expiresAt??null,E.lockedUntil??null,E.held?1:0,E.pinned?1:0,E.status,E.verificationState,E.verifiedAt??null,E.durationMs??null,T,T]),this.getRecoveryPoint(_)}getRecoveryPoint(E){let _=this.controlPlane.database.query("SELECT * FROM recovery_points WHERE id=?").get(E);return _?cz(_):void 0}listRecoveryPoints(E,_){return this.controlPlane.database.query(`SELECT * FROM recovery_points WHERE project_id=?${_?" AND policy_id=?":""} ORDER BY point_in_time DESC`).all(E,..._?[_]:[]).map(cz)}updateRecoveryPoint(E,_){let T=this.getRecoveryPoint(E);if(!T)throw Error("Recovery point was not found.");let r={...T,..._};return this.controlPlane.database.run("UPDATE recovery_points SET status=?,verification_state=?,verified_at=?,held=?,pinned=?,manifest=?,duration_ms=?,updated_at=? WHERE id=?",[r.status,r.verificationState,r.verifiedAt??null,r.held?1:0,r.pinned?1:0,JSON.stringify(r.manifest),r.durationMs??null,this.now().toISOString(),E]),this.getRecoveryPoint(E)}retentionCandidates(E=this.now()){let _=this.controlPlane.database.query(`SELECT rp.* FROM recovery_points rp
         WHERE rp.status='available' AND rp.held=0 AND rp.pinned=0
           AND rp.expires_at IS NOT NULL AND rp.expires_at<=?
           AND (rp.locked_until IS NULL OR rp.locked_until<=?)
@@ -9946,11 +9946,11 @@ ${JSON.stringify(_,null,2)}`}),{ok:!0,status:202}}let d=T.url??T.value,t=_,R={"c
             SELECT 1 FROM backup_jobs bj WHERE bj.recovery_point_id=rp.id
             AND bj.kind IN ('restore','drill') AND bj.status IN ('queued','running','cleanup_required')
           )
-        ORDER BY rp.expires_at,rp.id`).all(E.toISOString(),E.toISOString()).map(cz),T=new Set;for(let r of new Set(_.map((d)=>d.projectId)))for(let d of this.listPolicies(r)){let t=this.listRecoveryPoints(d.projectId,d.id).filter((h)=>h.status==="available").sort((h,N)=>N.pointInTime.localeCompare(h.pointInTime));for(let h of t.slice(0,Math.max(0,d.retention.keepLast??0)))T.add(h.id);let R=[[d.retention.hourly,(h)=>h.toISOString().slice(0,13)],[d.retention.daily,(h)=>h.toISOString().slice(0,10)],[d.retention.weekly,(h)=>{return new Date(Date.UTC(h.getUTCFullYear(),h.getUTCMonth(),h.getUTCDate()-(h.getUTCDay()+6)%7)).toISOString().slice(0,10)}],[d.retention.monthly,(h)=>h.toISOString().slice(0,7)]];for(let[h,N]of R){let S=new Set;for(let A of t){let L=N(new Date(A.pointInTime));if(S.has(L))continue;if(S.add(L),S.size<=Math.max(0,h??0))T.add(A.id)}}}return _.filter((r)=>!T.has(r.id))}coverage(E,_=this.now()){let T=new Map(this.listDestinations(E).map((r)=>[r.id,r]));return this.listPolicies(E).map((r)=>{let d=this.listRecoveryPoints(E,r.id).filter((h)=>h.status==="available"),t=d[0],R=t?(_.getTime()-new Date(t.pointInTime).getTime())/60000:Number.POSITIVE_INFINITY;return{policy:r,lastRecoveryPoint:t,missedRpo:r.enabled&&R>r.expectedRpoMinutes,unverified:d.filter((h)=>h.verificationState!=="verified").length,destinationHealthy:T.get(r.destinationId)?.status==="healthy"}})}}z_();import{createCipheriv as Um,createDecipheriv as $m,createHash as B9,randomBytes as W9}from"node:crypto";var $z=Buffer.from("TSCB1"),HD=(E)=>`sha256:${B9("sha256").update(E).digest("hex")}`;function H9(E){return B9("sha256").update(E).digest()}function Dm(E,_,T){let r=T?Buffer.from(T):W9(12);if(r.length!==12)throw Error("Backup encryption IV must contain 12 bytes.");let d=Um("aes-256-gcm",H9(_),r),t=Buffer.concat([d.update(E),d.final()]),R=d.getAuthTag();return Buffer.concat([$z,r,R,t])}function Im(E,_){let T=Buffer.from(E);if(!T.subarray(0,$z.length).equals($z))throw Error("Backup does not contain a valid encrypted envelope.");let r=T.subarray(5,17),d=T.subarray(17,33),t=T.subarray(33),R=$m("aes-256-gcm",H9(_),r);return R.setAuthTag(d),Buffer.concat([R.update(t),R.final()])}function Cm(E){let _;try{_=JSON.parse(E)}catch{throw Error("Backup destination credential must be a JSON object with accessKeyId and secretAccessKey.")}if(!_.accessKeyId||!_.secretAccessKey)throw Error("Backup destination credential requires accessKeyId and secretAccessKey.");if(_.expiresAt){let T=new Date(String(_.expiresAt));if(!Number.isFinite(T.getTime()))throw Error("Backup destination credential expiresAt must be an ISO timestamp.");if(T.getTime()<=Date.now())throw Error("Backup destination credential has expired.")}return{accessKeyId:String(_.accessKeyId),secretAccessKey:String(_.secretAccessKey),sessionToken:_.sessionToken?String(_.sessionToken):void 0}}async function P9(E,_,T=new Date){if(!E.credentialRef)return{status:"default"};try{let r=JSON.parse(await _.resolve(E.credentialRef));if(!r.accessKeyId||!r.secretAccessKey)return{status:"invalid"};if(!r.expiresAt)return{status:"static"};let d=new Date(String(r.expiresAt));if(!Number.isFinite(d.getTime()))return{status:"invalid"};let t=d.getTime()-T.getTime();return{status:t<=0?"expired":t<=604800000?"expiring":"valid",expiresAt:d.toISOString()}}catch{return{status:"invalid"}}}class PO{secrets;clientFactory;multipartThreshold;partSize;constructor(E,_=(d,t)=>new xE(d.region??"us-east-1",void 0,{endpoint:d.endpoint?new URL(d.endpoint).host:void 0,forcePathStyle:d.forcePathStyle,credentials:t}),T=8388608,r=8388608){this.secrets=E;this.clientFactory=_;this.multipartThreshold=T;this.partSize=r}async client(E){let _=E.credentialRef?Cm(await this.secrets.resolve(E.credentialRef)):void 0;return this.clientFactory(E,_)}async test(E){if(!E.bucket)throw Error("S3 destination has no configured bucket.");let _=await this.client(E),T=`${E.prefix?`${E.prefix.replace(/\/$/,"")}/`:""}.ts-cloud-health/${crypto.randomUUID()}`;await _.putObject({bucket:E.bucket,key:T,body:"ts-cloud backup destination health check",contentType:"text/plain"});try{let r=await _.getObjectBytes(E.bucket,T);if(Buffer.from(r.body).toString()!=="ts-cloud backup destination health check")throw Error("Backup destination health object was corrupted.")}finally{await _.deleteObject(E.bucket,T)}}async upload(E,_){if(!E.bucket)throw Error("S3 destination has no configured bucket.");let T=await this.client(E),r=HD(_.body),d=E.encryption!=="provider"?await this.secrets.resolve(E.encryptionKeyRef):void 0,t=d?_.resume?.encryptionIv?Buffer.from(_.resume.encryptionIv,"base64url"):W9(12):void 0,R=d?Dm(_.body,d,t):Buffer.from(_.body),h=HD(R),N=`${E.prefix?`${E.prefix.replace(/\/$/,"")}/`:""}${_.key.replace(/^\/+/,"")}`,S=_.contentType??"application/octet-stream",A={"ts-cloud-format":"v1","ts-cloud-sha256":h.slice(7),"ts-cloud-encrypted":d?"true":"false"};if(_.resume&&_.resume.key!==N)throw Error("Multipart checkpoint does not match the requested backup key.");if(_.resume&&d&&!_.resume.encryptionIv)throw Error("Encrypted multipart checkpoint has no resumable envelope state.");if(_.resume&&d&&_.resume.plaintextChecksum!==r)throw Error("Encrypted multipart checkpoint does not match the backup payload.");if(R.length<this.multipartThreshold)await T.putObject({bucket:E.bucket,key:N,body:R,contentType:S,metadata:A});else{let L=_.resume?void 0:await T.createMultipartUpload(E.bucket,N,{contentType:S,metadata:A}),O=_.resume??{uploadId:L.UploadId,key:N,parts:[],bytesUploaded:0,encryptionIv:t?.toString("base64url"),plaintextChecksum:r},c=new Map(O.parts.map((I)=>[I.PartNumber,I])),$=Math.ceil(R.length/this.partSize);for(let I=0;I<$;I++){let C=I+1;if(!c.has(C)){let e=I*this.partSize,z=await T.uploadPart(E.bucket,N,O.uploadId,C,R.subarray(e,Math.min(R.length,e+this.partSize)));c.set(C,{PartNumber:C,ETag:z.ETag})}O.parts=[...c.values()].sort((e,z)=>e.PartNumber-z.PartNumber),O.bytesUploaded=Math.min(R.length,C*this.partSize),_.checkpoint?.(O)}await T.completeMultipartUpload(E.bucket,N,O.uploadId,O.parts)}return{uri:`s3://${E.bucket}/${N}`,key:N,sizeBytes:R.length,checksum:h,manifest:{format:"ts-cloud-backup-v1",encrypted:!!d,plaintextChecksum:r,storageChecksum:h,contentType:S}}}async download(E,_){if(!E.bucket)throw Error("S3 destination has no configured bucket.");let T=await this.client(E),r=await T.getObjectBytes(E.bucket,_.key),d=Buffer.from(r.body);if(HD(d)!==_.checksum)throw Error("Backup checksum verification failed; object is corrupt.");let t=_.manifest.encrypted?Im(d,await this.secrets.resolve(E.encryptionKeyRef)):d;if(HD(t)!==_.manifest.plaintextChecksum)throw Error("Backup plaintext checksum verification failed.");return t}async abortPartial(E,_){if(!E.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(E)).abortMultipartUpload(E.bucket,_.key,_.uploadId)}async delete(E,_){if(!E.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(E)).deleteObject(E.bucket,_)}}import{createHash as wm}from"node:crypto";var em=(E)=>`sha256:${wm("sha256").update(E).digest("hex")}`;class MA{store;queue;now;constructor(E,_,T=()=>new Date){this.store=E;this.queue=_;this.now=T}enqueueBackup(E,_=this.now().toISOString(),T){if(!E.enabled)throw Error("Backup policy is disabled.");let r=this.store.createJob({projectId:E.projectId,policyId:E.id,kind:"backup",status:"queued",idempotencyKey:`backup:${E.id}:${_}`,target:{scheduledFor:_},cancellability:"checkpoint_only",progress:{phase:"queued"}});if(!r.operationId){let d=this.queue.enqueue({projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,actorId:T,kind:"backup.run",input:{backupJobId:r.id},lockKey:E.dataServiceId?`data-service:${E.dataServiceId}`:E.resourceId?`resource:${E.resourceId}`:`backup-policy:${E.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:14400,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(r.id,{operationId:d.operation.id})}return r}enqueueDue(E=this.now()){return this.store.duePolicies(E).map((_)=>{let T=_.nextRunAt;return this.store.advancePolicy(_.id,T),this.enqueueBackup(_,T)})}enqueueVerification(E){let _=this.store.createJob({projectId:E.projectId,policyId:E.policyId,recoveryPointId:E.id,kind:"verify",status:"queued",idempotencyKey:`verify:${E.id}:${E.checksum}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!_.operationId){let T=this.queue.enqueue({projectId:E.projectId,resourceId:E.resourceId,kind:"backup.verify",input:{backupJobId:_.id},lockKey:`recovery-point:${E.id}`,providerKey:"backup",maxAttempts:2,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(_.id,{operationId:T.operation.id})}return _}planRestore(E,_){if(E.status!=="available")throw Error("Only available recovery points can be restored.");if(E.verificationState!=="verified")throw Error("Restore requires a verified recovery point.");if(_.mode==="in_place"){if(!_.recentAuth)throw Error("In-place restore requires recent authentication.");if(_.confirm!==_.targetName)throw Error(`Type ${_.targetName} to confirm in-place restore.`);if(!_.downtimeAcknowledged)throw Error("In-place restore requires downtime acknowledgement.");let T=_.safetyBackupId?this.store.getRecoveryPoint(_.safetyBackupId):void 0;if(!T||T.id===E.id||T.status!=="available"||T.verificationState!=="verified"||T.resourceId!==E.resourceId||T.dataServiceId!==E.dataServiceId)throw Error("In-place restore requires a distinct verified safety backup for the same target.")}return{point:E,mode:_.mode,target:{..._.target,inPlace:_.mode==="in_place",restoreMode:_.mode},warnings:_.mode==="in_place"?["The target is locked against deployments and backup work.","Downtime and data replacement are expected.","Provider cancellation may stop only at a checkpoint."]:["An isolated target is created and health-validated before cleanup."]}}enqueueRestore(E,_){let T=this.planRestore(E,_),r=_.drill?"drill":"restore",d=em(JSON.stringify({point:E.id,mode:_.mode,target:_.target,safety:_.safetyBackupId,drill:!!_.drill})),t=this.store.createJob({projectId:E.projectId,policyId:E.policyId,recoveryPointId:E.id,kind:r,status:"queued",idempotencyKey:`${r}:${d}`,target:T.target,restoreMode:T.mode,cancellability:"checkpoint_only",safetyBackupId:_.safetyBackupId,progress:{phase:"queued",warnings:T.warnings}});if(!t.operationId){let R=this.queue.enqueue({projectId:E.projectId,resourceId:E.resourceId,actorId:_.actorId,kind:_.drill?"backup.drill":"backup.restore",input:{backupJobId:t.id},lockKey:E.dataServiceId?`data-service:${E.dataServiceId}`:E.resourceId?`resource:${E.resourceId}`:`recovery-point:${E.id}`,providerKey:"backup",maxAttempts:1,timeoutSeconds:14400,retryClasses:[],resumePolicy:"fail"});return this.store.updateJob(t.id,{operationId:R.operation.id})}return t}enqueueRetention(E=this.now()){return this.store.retentionCandidates(E).map((_)=>{let T=this.store.createJob({projectId:_.projectId,policyId:_.policyId,recoveryPointId:_.id,kind:"cleanup",status:"queued",idempotencyKey:`cleanup:${_.id}:${_.expiresAt}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!T.operationId){let r=this.queue.enqueue({projectId:_.projectId,resourceId:_.resourceId,kind:"backup.cleanup",input:{backupJobId:T.id},lockKey:`recovery-point:${_.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(T.id,{operationId:r.operation.id})}return T})}}function y9(E){let _=E.now??(()=>new Date),T=new MA(E.store,E.queue,_),r=(h)=>{let N=h.recoveryPointId?E.store.getRecoveryPoint(h.recoveryPointId):void 0,S=h.policyId?E.store.getPolicy(h.policyId):N?.policyId?E.store.getPolicy(N.policyId):void 0;if(!S)throw Error("Backup policy was not found.");let A=E.store.getDestination(N?.destinationId??S.destinationId),L=E.resolveSource(S);if(!A)throw Error("Backup destination was not found.");if(!L)throw Error(`No ${S.resourceKind} backup adapter is configured.`);return{point:N,policy:S,destination:A,source:L}},d=(h)=>{let N=h.operation.input,S=E.store.getJob(String(N.backupJobId??""));if(!S)throw Error("Backup job was not found.");return E.store.updateJob(S.id,{status:"running",startedAt:S.startedAt??_().toISOString(),progress:{...S.progress,phase:"running"}}),S},t=(h,N)=>{let S=E.store.getJob(h.id)??h;E.store.updateJob(h.id,{status:"failed",finishedAt:_().toISOString(),error:N instanceof Error?N.message:String(N),progress:{...S.progress,phase:"failed"}})};return{"backup.run":async(h)=>{let N=d(h);try{let{policy:S,destination:A,source:L}=r(N),O=await L.create(S,h),c=E.resolveDestination(A),$=O.mode==="object"?await(async()=>{if(!c)throw Error("Backup destination adapter is not configured.");let z=E.store.getJob(N.id)?.progress,F=z?.multipart,B=F&&typeof F==="object"&&!Array.isArray(F)&&typeof F.uploadId==="string"&&typeof F.key==="string"&&Array.isArray(F.parts)?F:void 0;return c.upload(A,{key:O.key,body:O.body,contentType:O.contentType,resume:B,checkpoint:(y)=>{h.checkpoint("uploading",`Uploaded ${Number(y.bytesUploaded??0)} backup bytes.`),E.store.updateJob(N.id,{progress:{phase:"uploading",multipart:{...y}}})}})})():{uri:O.uri,key:O.uri,sizeBytes:O.sizeBytes,checksum:O.checksum,manifest:{format:"ts-cloud-backup-v1",encrypted:!1,plaintextChecksum:O.checksum,storageChecksum:O.checksum,contentType:"application/provider-snapshot"}},I=S.retention.expireAfterDays?new Date(_().getTime()+S.retention.expireAfterDays*86400000).toISOString():void 0,C=E.store.getJob(N.id)?.startedAt,e=E.store.createRecoveryPoint({projectId:S.projectId,policyId:S.id,destinationId:A.id,resourceId:S.resourceId,dataServiceId:S.dataServiceId,backupJobId:N.id,kind:S.resourceKind,pointInTime:_().toISOString(),uri:$.uri,sizeBytes:$.sizeBytes,checksum:$.checksum,manifest:{...O.manifest,...$.manifest,storageKey:$.key},toolVersion:O.toolVersion,engineVersion:O.engineVersion,expiresAt:I,lockedUntil:A.immutability.defaultRetentionDays?new Date(_().getTime()+A.immutability.defaultRetentionDays*86400000).toISOString():void 0,held:!1,pinned:!1,status:"available",verificationState:"unverified",durationMs:Math.max(0,_().getTime()-new Date(C??_().toISOString()).getTime())});if(O.mode==="external"&&A.provider==="aws_backup")E.store.recordDestinationTest(A.id,{ok:!0});return E.store.updateJob(N.id,{status:"succeeded",recoveryPointId:e.id,finishedAt:_().toISOString(),progress:{phase:"stored",recoveryPointId:e.id}}),T.enqueueVerification(e),{backupJobId:N.id,recoveryPointId:e.id}}catch(S){let A=E.store.getJob(N.id),L=A?.progress.multipart,O=(()=>{try{return r(N)}catch{return}})();if(O?.destination.provider==="aws_backup")E.store.recordDestinationTest(O.destination.id,{ok:!1,error:S instanceof Error?S.message:String(S)});let c=!1;if(L&&typeof L==="object"&&!Array.isArray(L)&&O){let $=E.resolveDestination(O.destination);if(c=!0,$?.abortPartial)try{await $.abortPartial(O.destination,L),c=!1,E.store.updateJob(N.id,{progress:{...A.progress,partialCleanup:"aborted"}})}catch{E.store.updateJob(N.id,{progress:{...A.progress,partialCleanup:"required"}})}}if(c)E.store.updateJob(N.id,{status:"cleanup_required",finishedAt:_().toISOString(),error:S instanceof Error?S.message:String(S),progress:{...E.store.getJob(N.id)?.progress??{},phase:"cleanup_required"}});else t(N,S);throw S}},"backup.verify":async(h)=>{let N=d(h);try{let{point:S,destination:A,source:L}=r(N);if(!S)throw Error("Recovery point was not found.");E.store.updateRecoveryPoint(S.id,{verificationState:"verifying"});let O;if(S.uri.startsWith("s3:")){let c=E.resolveDestination(A);if(!c)throw Error("Backup destination adapter is not configured.");let $=await c.download(A,{key:String(S.manifest.storageKey??""),checksum:S.checksum,manifest:S.manifest}),I=L.verify?await L.verify(S,$,h):{};O={bytes:$.length,checksum:S.checksum,...I}}else if(L.verifyExternal)O=await L.verifyExternal(S,h);else throw Error("External recovery point verification is not supported.");return E.store.updateRecoveryPoint(S.id,{verificationState:"verified",verifiedAt:_().toISOString(),manifest:{...S.manifest,verification:O}}),E.store.updateJob(N.id,{status:"succeeded",finishedAt:_().toISOString(),progress:{phase:"verified",evidence:O}}),{backupJobId:N.id,recoveryPointId:S.id,evidence:O}}catch(S){if(N.recoveryPointId)E.store.updateRecoveryPoint(N.recoveryPointId,{verificationState:/checksum|corrupt|authentic/i.test(S instanceof Error?S.message:String(S))?"corrupt":"failed"});throw t(N,S),S}},"backup.restore":async(h)=>R(h,!1),"backup.drill":async(h)=>R(h,!0),"backup.cleanup":async(h)=>{let N=d(h);try{let{point:S,destination:A,source:L}=r(N);if(!S)throw Error("Recovery point was not found.");if(!E.store.retentionCandidates(_()).some((O)=>O.id===S.id))throw Error("Recovery point is held, pinned, locked, or in active use.");if(E.store.updateRecoveryPoint(S.id,{status:"deleting"}),S.uri.startsWith("s3:")){let O=E.resolveDestination(A);if(!O)throw Error("Destination cleanup is unavailable.");await O.delete(A,String(S.manifest.storageKey??""))}else if(L.deleteExternal)await L.deleteExternal(S,h);else throw Error("External recovery point cleanup is unavailable.");return E.store.updateRecoveryPoint(S.id,{status:"deleted"}),E.store.updateJob(N.id,{status:"succeeded",finishedAt:_().toISOString(),progress:{phase:"deleted"}}),{backupJobId:N.id,recoveryPointId:S.id,deleted:!0}}catch(S){throw t(N,S),S}}};async function R(h,N){let S=d(h);try{let{point:A,policy:L,destination:O,source:c}=r(S);if(!A)throw Error("Recovery point was not found.");if(N&&!c.cleanup)throw Error("This backup source cannot safely clean a recovery drill target.");let $=A.uri.startsWith("s3:")?E.resolveDestination(O):void 0,I=$?await $.download(O,{key:String(A.manifest.storageKey??""),checksum:A.checksum,manifest:A.manifest}):void 0,C=await c.restore(A,I,S.target,h),e=c.validateHealth?await c.validateHealth({...S.target,...C},h):{healthy:!0,mode:"adapter"},z=E.validateHealth?await E.validateHealth(L,S.target):{healthy:!0,mode:"not_configured"},F={...e,healthy:e.healthy===!0&&z.healthy===!0,configured:z};if(F.healthy!==!0)throw Error("Restored target did not pass its configured health check.");if(N&&c.cleanup)await c.cleanup({...S.target,provider:A.manifest.provider??null},h);return E.store.updateJob(S.id,{status:"succeeded",finishedAt:_().toISOString(),healthResult:F,progress:{phase:N?"drill_cleaned":"restored",restored:C}}),{backupJobId:S.id,recoveryPointId:A.id,restored:C,health:F,cleaned:N}}catch(A){let L=(()=>{try{return r(S)}catch{return}})(),O=A instanceof Error?A.message:String(A),c=!1;if(N&&L?.source.cleanup)try{await L.source.cleanup({...S.target,provider:L.point?.manifest.provider??null},h)}catch{c=!0}if(c)E.store.updateJob(S.id,{status:"cleanup_required",finishedAt:_().toISOString(),error:O,progress:{...S.progress,phase:"cleanup_required"}});else t(S,A);throw A}}}ut();import{createHash as Xm}from"node:crypto";var Jm=(E)=>`sha256:${Xm("sha256").update(E).digest("hex")}`;class Dz{dataServices;client;constructor(E,_=new Mr){this.dataServices=E;this.client=_}service(E){let _=E.dataServiceId?this.dataServices.get(E.dataServiceId):void 0;if(!_||!["aws_rds","aws_aurora"].includes(_.provider))throw Error("Managed database backup policy requires an RDS or Aurora data service.");return _}async waitForSnapshot(E,_,T){for(;;){T.throwIfCancellationRequested?.(),T.heartbeat?.();let r=E==="aws_aurora"?(await this.client.describeDBClusterSnapshots({DBClusterSnapshotIdentifier:_})).DBClusterSnapshots[0]:(await this.client.describeDBSnapshots({DBSnapshotIdentifier:_})).DBSnapshots?.[0];if(!r)throw Error("Provider snapshot was not found.");let d=r,t=String(d.Status??d.DBSnapshotStatus??"unknown");if(T.checkpoint?.("provider_snapshot",`Database snapshot ${_} is ${t}.`),t==="available")return d;if(["deleted","deleting","failed"].includes(t))throw Error(`Provider snapshot ${_} failed with state ${t}.`);await Bun.sleep(5000)}}async create(E,_){let T=this.service(E),r=String(_.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,20),d=`${T.placement.slice(0,42).replace(/-+$/,"")}-${r}`;if(T.provider==="aws_aurora")await this.client.createDBClusterSnapshot(T.placement,d);else await this.client.createDBSnapshot({DBInstanceIdentifier:T.placement,DBSnapshotIdentifier:d});await this.waitForSnapshot(T.provider,d,_);let t=`${T.provider}:${T.placement}:${d}`;return{mode:"external",uri:`aws-backup:${t}`,checksum:Jm(t),sizeBytes:0,manifest:{provider:T.provider,sourceId:T.placement,snapshotId:d,plan:T.plan,engine:T.engine},engineVersion:T.engineVersion,toolVersion:"aws-rds-api-2014-10-31"}}async verifyExternal(E,_){let T=String(E.manifest.snapshotId??""),r=String(E.manifest.provider??"");if(!T)throw Error("Snapshot recovery point has no snapshot ID.");let d=await this.waitForSnapshot(r,T,_),t=String(d.Status??d.DBSnapshotStatus??"unknown");return{snapshotId:T,status:t,encrypted:d.Encrypted??d.StorageEncrypted??!0}}async restore(E,_,T,r){let d=String(T.targetId??""),t=String(E.manifest.snapshotId??""),R=String(E.manifest.provider??"");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(d))throw Error("Managed restore requires a valid distinct targetId.");if(d===E.manifest.sourceId)throw Error("Managed restore target must differ from its source.");if(R==="aws_aurora"){let h=E.manifest.engine==="postgres"?"aurora-postgresql":"aurora-mysql";await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:d,SnapshotIdentifier:t,Engine:h,EngineVersion:E.engineVersion,DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:Number(T.minCapacity)||0.5,MaxCapacity:Number(T.maxCapacity)||4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${d}-writer-1`,DBClusterIdentifier:d,DBInstanceClass:String(T.plan??E.manifest.plan??"db.serverless"),Engine:h,PubliclyAccessible:!1})}else await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:d,DBSnapshotIdentifier:t,DBInstanceClass:String(T.plan??E.manifest.plan??""),PubliclyAccessible:!1,DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud-restore"}]});return{targetId:d,provider:R,status:"creating",isolated:!0}}async validateHealth(E,_){let T=String(E.targetId??""),r=String(E.provider??"");for(;;){_.throwIfCancellationRequested?.(),_.heartbeat?.();let d=r==="aws_aurora"?(await this.client.describeDBClusters({DBClusterIdentifier:T})).DBClusters?.[0]:(await this.client.describeDBInstances({DBInstanceIdentifier:T})).DBInstances?.[0];if(!d)throw Error("Restored managed database was not found.");let t=String(d.Status??d.DBInstanceStatus??"unknown");if(_.checkpoint?.("provider_restore",`Restored database ${T} is ${t}.`),t==="available")return{healthy:!0,targetId:T,provider:r,status:t};if(["deleted","deleting","failed","incompatible-restore"].includes(t))throw Error(`Restored managed database ${T} failed with state ${t}.`);await Bun.sleep(5000)}}async cleanup(E,_){let T=String(E.targetId??""),r=String(E.provider??"");if(!T)throw Error("Restore cleanup target is required.");if(r==="aws_aurora")await this.client.deleteDBInstance({DBInstanceIdentifier:`${T}-writer-1`,SkipFinalSnapshot:!0}),await this.client.modifyDBCluster({DBClusterIdentifier:T,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(T);else await this.client.modifyDBInstance({DBInstanceIdentifier:T,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:T,SkipFinalSnapshot:!0,DeleteAutomatedBackups:!0})}async deleteExternal(E,_){let T=String(E.manifest.snapshotId??"");if(E.manifest.provider==="aws_aurora")await this.client.deleteDBClusterSnapshot(T);else await this.client.deleteDBSnapshot(T)}}await aE();import{existsSync as yO}from"node:fs";import{mkdir as yD,readdir as zm,rename as Iz,rm as fA}from"node:fs/promises";import{relative as Fm,resolve as sT,sep as YD}from"node:path";function FN(E,_){if(_==="gzip")return Buffer.from(Bun.gzipSync(Uint8Array.from(E)));if(_==="zstd")return Buffer.from(Bun.zstdCompressSync(Uint8Array.from(E)));return Buffer.from(E)}function SR(E,_){if(_==="gzip")return Buffer.from(Bun.gunzipSync(Uint8Array.from(E)));if(_==="zstd")return Buffer.from(Bun.zstdDecompressSync(Uint8Array.from(E)));return Buffer.from(E)}async function Cz(E,_){let T=Bun.spawn(["tar",...E],{stdin:_?Buffer.from(_):void 0,stdout:"pipe",stderr:"pipe"}),[r,d,t]=await Promise.all([T.exited,new Response(T.stdout).arrayBuffer(),new Response(T.stderr).text()]);if(r!==0)throw Error(t.trim()||`tar exited with status ${r}.`);return{stdout:Buffer.from(d),stderr:t}}function jm(E){let _=E.replaceAll("\\","/").replace(/^\.\//,"");return!!_&&!_.startsWith("/")&&!_.split("/").includes("..")}class Q9{async create(E,_,T){return(await Cz(["-C",E,"-cf","-",...T.map((d)=>`--exclude=${d}`),"--",..._])).stdout}async extract(E,_){await yD(_,{recursive:!0,mode:448}),await Cz(["-C",_,"-xf","-"],E)}async inspect(E){let _=await Cz(["-tf","-"],E),T=_.stdout.toString().split(`
-`).filter(Boolean);if(T.some((r)=>!jm(r)))throw Error("Backup archive contains an unsafe path.");return{entries:T,bytes:E.byteLength}}}function Y9(E,_){if(!_.trim())throw Error("File backup paths cannot be empty.");let T=sT(E,_),r=Fm(E,T);if(r===".."||r.startsWith(`..${YD}`)||r==="")throw Error(`File backup path ${_} is outside the project root.`);return r}function PD(E){let _=String(E.targetId??E.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(_))throw Error("File restores require a safe target name.");return _}class wz{runtime;root;restoreRoot;constructor(E,_=new Q9,T=f_(E,"restores","files")){this.runtime=_;this.root=sT(E),this.restoreRoot=sT(T)}paths(E){let _=[...new Set(E.includePatterns.map((T)=>Y9(this.root,T)))];if(!_.length)throw Error("File backup policies require at least one project-relative path.");for(let T of _)if(!yO(sT(this.root,T)))throw Error(`File backup path ${T} was not found.`);return _.filter((T)=>!_.some((r)=>r!==T&&T.startsWith(`${r}${YD}`)))}async create(E,_){let T=this.paths(E),r=await this.runtime.create(this.root,T,E.excludePatterns),d=await this.runtime.inspect(r),t=E.compression??"none",R=FN(r,t),h=String(_.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${E.projectId}/files/${h}.tar${t==="none"?"":t==="gzip"?".gz":".zst"}`,body:R,contentType:t==="gzip"?"application/gzip":t==="zstd"?"application/zstd":"application/x-tar",manifest:{archive:"tar",compression:t,sourcePaths:T,excluded:E.excludePatterns,entries:d.entries.length},toolVersion:"system-tar"}}async restore(E,_,T,r){if(!_)throw Error("File restore requires an archive payload.");let d=SR(_,String(E.manifest.compression??"none"));if(await this.runtime.inspect(d),T.restoreMode==="in_place"){let R=sT(this.restoreRoot,`.staging-${PD(T)}`),h=sT(this.restoreRoot,`.rollback-${PD(T)}`),N=Array.isArray(E.manifest.sourcePaths)?E.manifest.sourcePaths.map(String):[];if(!N.length)throw Error("File recovery point has no source path manifest.");await fA(R,{recursive:!0,force:!0}),await fA(h,{recursive:!0,force:!0}),await this.runtime.extract(d,R),await yD(h,{recursive:!0,mode:448});let S=[];try{for(let A of N){let L=sT(this.root,Y9(this.root,A)),O=sT(R,A),c=sT(h,A);if(await yD(sT(c,".."),{recursive:!0}),yO(L))await Iz(L,c);await yD(sT(L,".."),{recursive:!0}),await Iz(O,L),S.push(A)}}catch(A){for(let L of S.reverse()){let O=sT(this.root,L),c=sT(h,L);if(await fA(O,{recursive:!0,force:!0}),yO(c))await Iz(c,O)}throw A}finally{await fA(R,{recursive:!0,force:!0})}return await fA(h,{recursive:!0,force:!0}),{path:this.root,restoredPaths:N,inPlace:!0}}let t=sT(this.restoreRoot,PD(T));if(yO(t))throw Error("The isolated file restore target already exists.");return await this.runtime.extract(d,t),{path:t,isolated:!0}}async verify(E,_,T){let r=SR(_,String(E.manifest.compression??"none")),d=await this.runtime.inspect(r);return{archive:"tar",entries:d.entries.length,uncompressedBytes:d.bytes}}async validateHealth(E,_){let T=String(E.path??"");if(!T||!T.startsWith(`${this.restoreRoot}${YD}`)||!yO(T))throw Error("Isolated file restore target was not found.");let r=await zm(T);return{healthy:!0,path:T,topLevelEntries:r.length}}async cleanup(E,_){let T=PD(E),r=sT(this.restoreRoot,T);if(!r.startsWith(`${this.restoreRoot}${YD}`))throw Error("Refusing to clean a file restore outside the restore root.");await fA(r,{recursive:!0,force:!0})}}class ez{services;secrets;transport;constructor(E,_,T=new nt){this.services=E;this.secrets=_;this.transport=T}async create(E,_){if(!E.dataServiceId)throw Error("Logical database backups require a data service.");let T=this.services.get(E.dataServiceId);if(!T)throw Error("Logical database service was not found.");if(!["container","server"].includes(T.provider))throw Error("Logical database backups require an on-box data service.");let r=await this.transport.exportLogicalBackup(T.id),d=E.compression??"none",t=FN(r.body,d),R=String(_.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${E.projectId}/databases/${T.id}/${R}.sql${d==="none"?"":d==="gzip"?".gz":".zst"}`,body:t,contentType:d==="gzip"?"application/gzip":d==="zstd"?"application/zstd":"application/sql",engineVersion:r.engineVersion,toolVersion:"engine-native",manifest:{format:"logical-sql-v1",sourceDataServiceId:T.id,engine:r.engine,database:r.database,username:r.username,compression:d}}}async restore(E,_,T,r){if(!_)throw Error("Logical database backup body is unavailable.");let d=String(E.dataServiceId??E.manifest.sourceDataServiceId??""),t=String(T.dataServiceId??T.targetId??""),R=T.inPlace===!0;if(!d||!t)throw Error("Logical database restore requires source and target identifiers.");if(R&&t!==d)throw Error("An in-place restore must target the source data service.");let h=this.services.get(d);if(!h?.credentialRef)throw Error("Logical database credential reference was not found.");let N=await this.secrets.resolve(h.credentialRef);return this.transport.restoreLogicalBackup({sourceId:d,targetId:t,body:SR(_,String(E.manifest.compression??"none")),credential:N,inPlace:R})}async cleanup(E,_){if(E.inPlace===!0)throw Error("In-place database restores cannot be cleaned as drills.");let T=String(E.dataServiceId??E.targetId??"");if(!T)throw Error("Database cleanup requires a target identifier.");await this.transport.removeRestoredService(T)}}var Xz=/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/;async function jN(E,_,T=!1){let r=Bun.spawn(["docker",...E],{stdin:_?"pipe":"ignore",stdout:"pipe",stderr:"pipe"}),d=new Response(r.stdout).arrayBuffer(),t=new Response(r.stderr).text();if(_)r.stdin.write(_),r.stdin.end();let[R,h,N]=await Promise.all([r.exited,d,t]);if(R!==0&&!T)throw Error(`Docker volume command failed (${R}): ${N.trim()}`);return{code:R,stdout:Buffer.from(h),stderr:N}}class G9{async exists(E){return(await jN(["volume","inspect",E],void 0,!0)).code===0}async export(E){return(await jN(["run","--rm","-v",`${E}:/source:ro`,"alpine:3.21","tar","-C","/source","-czf","-","."])).stdout}async import(E,_,T=!1){if(!await this.exists(E))await jN(["volume","create",E]);try{if(T)await jN(["run","--rm","-v",`${E}:/target`,"alpine:3.21","sh","-c","find /target -mindepth 1 -delete"]);await jN(["run","--rm","-i","-v",`${E}:/target`,"alpine:3.21","tar","-C","/target","--no-same-owner","-xzf","-"],_)}catch(r){throw await this.remove(E),r}}async remove(E){await jN(["volume","rm",E],void 0,!0)}async probe(E){let _=(await jN(["run","--rm","-v",`${E}:/target:ro`,"alpine:3.21","sh","-c",`find /target -mindepth 1 -printf '%s\\n' | awk '{n+=1;b+=$1} END {print n ":" b}'`])).stdout.toString(),[T,r]=_.trim().split(":").map(Number);if(!Number.isFinite(T)||!Number.isFinite(r))throw Error("Restored volume health probe returned invalid output.");return{entries:T,bytes:r}}}class Jz{runtime;constructor(E=new G9){this.runtime=E}async create(E,_){let T=String(E.includePatterns?.[0]??E.resourceId??"");if(!Xz.test(T))throw Error("Volume backups require a valid named-volume resource identifier.");if(!await this.runtime.exists(T))throw Error(`Volume ${T} was not found.`);let r=await this.runtime.export(T),d=Buffer.from(Bun.gunzipSync(Uint8Array.from(r))),t=E.compression??"gzip",R=t==="gzip"?r:FN(d,t),h=String(_.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${E.projectId}/volumes/${T}/${h}.tar${t==="none"?"":t==="gzip"?".gz":".zst"}`,body:R,contentType:t==="gzip"?"application/gzip":t==="zstd"?"application/zstd":"application/x-tar",toolVersion:"alpine-tar",manifest:{format:"docker-volume-tar-v1",archive:"tar",compression:t,sourceVolume:T}}}async restore(E,_,T,r){if(!_)throw Error("Volume backup body is unavailable.");let d=String(E.manifest.sourceVolume??E.resourceId??""),t=String(T.volumeName??T.targetId??"");if(!Xz.test(t))throw Error("Volume restore requires a valid target volume name.");if(t===d&&T.inPlace!==!0)throw Error("An isolated volume restore requires a distinct target.");let R=await this.runtime.exists(t);if(!T.inPlace&&R)throw Error(`Restore target volume ${t} already exists.`);if(T.inPlace===!0&&t!==d)throw Error("An in-place volume restore must target the source volume.");if(T.inPlace===!0&&!R)throw Error("The in-place target volume was not found.");let h=String(E.manifest.compression??"gzip"),N=h==="gzip"?Buffer.from(_):Buffer.from(Bun.gzipSync(Uint8Array.from(SR(_,h))));await this.runtime.import(t,N,T.inPlace===!0);let S=await this.runtime.probe(t);return{volumeName:t,healthy:!0,...S}}async cleanup(E,_){if(E.inPlace===!0)throw Error("In-place volume restores cannot be cleaned as drills.");let T=String(E.volumeName??E.targetId??"");if(!Xz.test(T))throw Error("Volume cleanup requires a valid target volume name.");await this.runtime.remove(T)}}await aE();import{existsSync as zz}from"node:fs";import{mkdir as Bm,readFile as M9,rm as Wm,writeFile as f9}from"node:fs/promises";import{basename as g9,resolve as Dh,sep as K9}from"node:path";import{Database as Hm}from"bun:sqlite";function V9(E){let _=String(E.targetId??E.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(_))throw Error("Control-plane restores require a safe target name.");return _}function Z9(E){let _=JSON.parse(Buffer.from(E).toString());if(_.format!=="ts-cloud-control-plane-v1"||!_.database)throw Error("Control-plane backup archive is invalid.");if(!Array.isArray(_.config)||_.config.some((T)=>g9(T.name)!==T.name))throw Error("Control-plane backup contains an unsafe config path.");return _}function q9(E){let _=Hm.deserialize(Uint8Array.from(E));try{let T=_.query("PRAGMA integrity_check").get()?.integrity_check??"unknown",r=_.query("SELECT count(*) AS count FROM sqlite_master WHERE type='table'").get()?.count??0;if(T!=="ok")throw Error(`Restored control-plane integrity check failed: ${T}.`);return{integrity:T,tables:r}}finally{_.close()}}class Fz{controlPlane;root;restoreRoot;constructor(E,_,T=f_(_,"restores","control-plane")){this.controlPlane=E;this.root=Dh(_),this.restoreRoot=Dh(T)}async create(E,_){let T=E.includePatterns.length?E.includePatterns:["cloud.config.ts"],r=[];for(let N of T){let S=g9(N),A=Dh(this.root,S);if(S!==N&&N!==`./${S}`)throw Error("Control-plane config paths must be project-root files.");if(zz(A))r.push({name:S,body:(await M9(A)).toString("base64")})}let d={format:"ts-cloud-control-plane-v1",createdAt:new Date().toISOString(),database:Buffer.from(this.controlPlane.database.serialize()).toString("base64"),config:r},t=E.compression??"none",R=FN(Buffer.from(JSON.stringify(d)),t),h=String(_.operation?.id??d.createdAt).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${E.projectId}/control-plane/${h}.json${t==="none"?"":t==="gzip"?".gz":".zst"}`,body:R,contentType:t==="gzip"?"application/gzip":t==="zstd"?"application/zstd":"application/vnd.ts-cloud.control-plane+json",manifest:{format:d.format,configFiles:r.map((N)=>N.name),sensitive:!0,compression:t},toolVersion:"bun-sqlite-serialize"}}async restore(E,_,T,r){if(!_)throw Error("Control-plane restore requires an archive payload.");if(T.restoreMode==="in_place")throw Error("A live control plane can only be restored into an isolated recovery target.");let d=Z9(SR(_,String(E.manifest.compression??"none"))),t=Dh(this.restoreRoot,V9(T));if(zz(t))throw Error("The isolated control-plane restore target already exists.");await Bm(t,{recursive:!0,mode:448}),await f9(Dh(t,"control-plane.sqlite"),Buffer.from(d.database,"base64"),{mode:384});for(let R of d.config)await f9(Dh(t,R.name),Buffer.from(R.body,"base64"),{mode:384});return{path:t,isolated:!0,configFiles:d.config.length}}async verify(E,_,T){let r=Z9(SR(_,String(E.manifest.compression??"none")));return{...q9(Buffer.from(r.database,"base64")),configFiles:r.config.length}}async validateHealth(E,_){let T=String(E.path??""),r=Dh(T,"control-plane.sqlite");if(!T.startsWith(`${this.restoreRoot}${K9}`)||!zz(r))throw Error("Isolated control-plane database was not found.");return{healthy:!0,...q9(await M9(r))}}async cleanup(E,_){let T=Dh(this.restoreRoot,V9(E));if(!T.startsWith(`${this.restoreRoot}${K9}`))throw Error("Refusing to clean a control-plane restore outside the restore root.");await Wm(T,{recursive:!0,force:!0})}}import{createHash as Pm}from"node:crypto";function jz(E,_){return E.find((T)=>T.startsWith(`${_}:`))?.slice(_.length+1)}function ym(E){let _=jz(E.includePatterns,"resource")??E.includePatterns.find((d)=>d.startsWith("arn:")),T=jz(E.includePatterns,"role"),r=jz(E.includePatterns,"vault")??"Default";if(!_?.startsWith("arn:"))throw Error("Infrastructure backups require resource:<arn> in include patterns.");if(!T?.startsWith("arn:"))throw Error("Infrastructure backups require role:<iam-role-arn> in include patterns.");if(!/^[A-Za-z0-9_.-]{2,50}$/.test(r))throw Error("Infrastructure backup vault name is invalid.");return{resourceArn:_,roleArn:T,vaultName:r}}async function Ym(E,_,T){for(;;){T.throwIfCancellationRequested(),T.heartbeat();let r=await E.describeBackupJob(_),d=String(r.State??"");if(T.checkpoint("provider_backup",`AWS Backup job ${_} is ${d||"pending"}.`),d==="COMPLETED"&&r.RecoveryPointArn)return{recoveryPointArn:r.RecoveryPointArn,sizeBytes:Number(r.BackupSizeInBytes??0)};if(["ABORTED","EXPIRED","FAILED"].includes(d))throw Error(`AWS Backup job ${_} failed: ${r.StatusMessage??d}.`);await Bun.sleep(5000)}}async function Qm(E,_,T){for(;;){T.throwIfCancellationRequested(),T.heartbeat();let r=await E.describeRestoreJob(_),d=String(r.Status??"");if(T.checkpoint("provider_restore",`AWS Backup restore ${_} is ${d||"pending"}.`),d==="COMPLETED"&&r.CreatedResourceArn)return r.CreatedResourceArn;if(["ABORTED","FAILED"].includes(d))throw Error(`AWS Backup restore ${_} failed: ${r.StatusMessage??d}.`);await Bun.sleep(5000)}}class Bz{client;constructor(E=new jO){this.client=E}async create(E,_){let T=ym(E),r=String(_.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64),d=await this.client.startBackupJob({BackupVaultName:T.vaultName,ResourceArn:T.resourceArn,IamRoleArn:T.roleArn,IdempotencyToken:r}),t=await Ym(this.client,d.BackupJobId,_),R=`sha256:${Pm("sha256").update(t.recoveryPointArn).digest("hex")}`;return{mode:"external",uri:t.recoveryPointArn,checksum:R,sizeBytes:t.sizeBytes,toolVersion:"aws-backup-api",manifest:{provider:"aws_backup",resourceArn:T.resourceArn,roleArn:T.roleArn,vaultName:T.vaultName,providerBackupJobId:d.BackupJobId,recoveryPointArn:t.recoveryPointArn}}}async verifyExternal(E,_){let T=String(E.manifest.providerBackupJobId??""),r=await this.client.describeBackupJob(T);if(r.State!=="COMPLETED"||r.RecoveryPointArn!==E.uri)throw Error(`AWS Backup recovery point verification failed: ${r.StatusMessage??r.State??"unknown"}.`);return{state:r.State,recoveryPointArn:r.RecoveryPointArn,sizeBytes:Number(r.BackupSizeInBytes??E.sizeBytes)}}async restore(E,_,T,r){if(T.inPlace===!0)throw Error("AWS Backup infrastructure restores must create isolated resources.");let d=String(T.roleArn??E.manifest.roleArn??""),t=T.metadata&&typeof T.metadata==="object"&&!Array.isArray(T.metadata)?Object.fromEntries(Object.entries(T.metadata).map(([N,S])=>[N,String(S)])):{};if(!d.startsWith("arn:"))throw Error("AWS Backup restore requires an IAM role ARN.");if(!Object.keys(t).length)throw Error("AWS Backup restore requires provider restore metadata.");let R=await this.client.startRestoreJob({RecoveryPointArn:E.uri,IamRoleArn:d,Metadata:t,IdempotencyToken:String(r.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64)}),h=await Qm(this.client,R.RestoreJobId,r);return{providerRestoreJobId:R.RestoreJobId,createdResourceArn:h,isolated:!0,healthy:!0}}async validateHealth(E,_){let T=String(E.createdResourceArn??"");return{healthy:T.startsWith("arn:"),createdResourceArn:T}}async deleteExternal(E,_){await this.client.deleteRecoveryPoint(String(E.manifest.vaultName??""),E.uri)}}await bd([ML(),tT()]);function At(E,_,T){return[E,_,T].map((r)=>encodeURIComponent(r)).join(":")}function Gm(E){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((_)=>[_,{supported:!1,reason:E}]))}function BN(E,_,T=["exec","files"]){let r=Gm(_);for(let d of E)r[d]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(d),requiresRecentAuth:T.includes(d)};return r}var Mm=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function LR(E){let _=String(E??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(_))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(_))return"starting";if(["deactivating","stopping","draining","terminating"].includes(_))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(_))return"stopped";if(["degraded","unhealthy","warning"].includes(_))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(_))return"failed";return"unknown"}function AR(E){if(Array.isArray(E))return E.map((T)=>AR(T));if(!E||typeof E!=="object")return E;let _={};for(let[T,r]of Object.entries(E))_[T]=Mm.test(T)?"[REDACTED]":AR(r);return _}function WN(E,_=new Date){if(!E)return;let T=new Date(E).getTime();return Number.isFinite(T)?Math.max(0,Math.floor((_.getTime()-T)/1000)):void 0}function x9(E){let _=Number(E);return Number.isFinite(_)&&_>=0?_:void 0}function fm(E){let _=String(E?.message??E);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(_))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(_))return"unreachable";return"error"}async function b9(E,_={},T={}){let r=_.now??new Date,d=Math.max(100,T.timeoutMs??1e4),t=Math.max(1,T.staleAfterSeconds??60),R=await Promise.all(E.map(async(N)=>{try{let S=await Promise.race([N.discover({..._,now:r}),new Promise((A,L)=>setTimeout(()=>L(Error(`Runtime source ${N.id} timed out after ${d}ms`)),d))]);return{workloads:S,source:{id:N.id,provider:N.provider,status:"fresh",discoveredAt:r.toISOString(),staleAfterSeconds:t,itemCount:S.length}}}catch(S){return{workloads:[],source:{id:N.id,provider:N.provider,status:fm(S),discoveredAt:r.toISOString(),staleAfterSeconds:t,itemCount:0,message:String(S?.message??S).slice(0,500)}}}})),h=R.map((N)=>N.source);return{generatedAt:r.toISOString(),workloads:R.flatMap((N)=>N.workloads).sort((N,S)=>N.name.localeCompare(S.name)||N.id.localeCompare(S.id)),sources:h,degraded:h.some((N)=>N.status!=="fresh")}}await aE();VE();z_();function Km(E,_){if(!_)return E;return E.startsWith(_)?E.slice(_.length):E}function Wz(E,_,T){let r=Km(E,_);return`${T??""}${r}`}function Hz(E,_,T){if(T&&T.some((r)=>E.startsWith(r)))return!1;if(_&&_.length>0)return _.some((r)=>E.startsWith(r));return!0}async function Vm(E,_,T){let r=0,d=[],t=Math.max(1,Math.min(_,E.length||1));for(let R=0;R<t;R++)d.push((async()=>{while(!0){let h=r++;if(h>=E.length)return;await T(E[h],h)}})());await Promise.all(d)}function k9(E){if(E.client)return E.client;return yz({provider:E.provider,region:E.region,endpoint:E.endpoint,forcePathStyle:E.forcePathStyle,credentials:E.credentials})}async function Pz(E){let _=E.concurrency??8,T=k9(E.from),r=k9(E.to),d=await T.listAllObjects({bucket:E.from.bucket,prefix:E.from.prefix}),t={copied:0,skipped:0,excluded:0,bytesCopied:0,errors:[],excludedKeys:[],deleted:[]},R=[];for(let A of d){if(!Hz(A.Key,E.include,E.exclude)){t.excluded++,t.excludedKeys.push(A.Key);continue}R.push({source:A,destKey:Wz(A.Key,E.from.prefix,E.to.prefix)})}if(E.dryRun){t.plan=R.map(({source:O,destKey:c})=>({key:O.Key,destKey:c,size:O.Size}));let A=d.length,L=0;for(let O of d){L++;let c=!Hz(O.Key,E.include,E.exclude);E.onProgress?.({key:O.Key,destKey:c?"":Wz(O.Key,E.from.prefix,E.to.prefix),size:O.Size,action:c?"excluded":"planned",index:L,total:A})}return t}let h=R.length,N=0;await Vm(R,_,async({source:A,destKey:L})=>{let O=++N;try{if(!E.force){let I=await r.headObject(E.to.bucket,L);if(I&&I.ContentLength===A.Size){t.skipped++,E.onProgress?.({key:A.Key,destKey:L,size:A.Size,action:"skipped",index:O,total:h});return}}let{body:c,contentType:$}=await T.getObjectBytes(E.from.bucket,A.Key);await r.putObject({bucket:E.to.bucket,key:L,body:c,contentType:$}),t.copied++,t.bytesCopied+=c.byteLength,E.onProgress?.({key:A.Key,destKey:L,size:A.Size,action:"copied",index:O,total:h})}catch(c){t.errors.push({key:A.Key,message:c?.message??String(c)}),E.onProgress?.({key:A.Key,destKey:L,size:A.Size,action:"error",index:O,total:h})}});let S=new Set(R.map((A)=>A.destKey));if(E.deleteExtraneous){let L=(await r.listAllObjects({bucket:E.to.bucket,prefix:E.to.prefix})).filter((O)=>!S.has(O.Key)).map((O)=>O.Key);for(let O of L)try{await r.deleteObject(E.to.bucket,O),t.deleted.push(O)}catch(c){t.errors.push({key:O,message:`delete failed: ${c?.message??String(c)}`})}}if(E.verify){let A=await r.listAllObjects({bucket:E.to.bucket,prefix:E.to.prefix}),L=new Map(A.map((I)=>[I.Key,I.Size])),O=[],c=[],$=0;for(let{source:I,destKey:C}of R){if(!L.has(C)){O.push(C);continue}let e=L.get(C);if(e!==I.Size){c.push({key:C,expected:I.Size,actual:e});continue}$++}t.verification={ok:O.length===0&&c.length===0,matched:$,missing:O,sizeMismatches:c}}return t}var Zm={aws:"us-east-1",backblaze:"us-west-004",hetzner:"fsn1"};function u9(E,_){switch(E){case"backblaze":return`s3.${_}.backblazeb2.com`;case"hetzner":return`${_}.your-objectstorage.com`;case"aws":default:return}}function qr(...E){for(let _ of E){let T=process.env[_];if(T)return T}return}function qm(E,_){if(_?.accessKeyId&&_.secretAccessKey)return _;let T,r;if(E==="backblaze")T=qr("B2_APPLICATION_KEY_ID","B2_KEY_ID","S3_ACCESS_KEY_ID","AWS_ACCESS_KEY_ID"),r=qr("B2_APPLICATION_KEY","B2_SECRET_KEY","S3_SECRET_ACCESS_KEY","AWS_SECRET_ACCESS_KEY");else if(E==="hetzner")T=qr("HETZNER_S3_ACCESS_KEY","HETZNER_ACCESS_KEY","S3_ACCESS_KEY_ID","AWS_ACCESS_KEY_ID"),r=qr("HETZNER_S3_SECRET_KEY","HETZNER_SECRET_KEY","S3_SECRET_ACCESS_KEY","AWS_SECRET_ACCESS_KEY");else T=qr("S3_ACCESS_KEY_ID"),r=qr("S3_SECRET_ACCESS_KEY");if(T&&r)return{accessKeyId:T,secretAccessKey:r,sessionToken:qr("AWS_SESSION_TOKEN")};return}function v9(E={}){let _=E.provider||qr("OBJECT_STORAGE_PROVIDER","STORAGE_PROVIDER")||"aws",T=E.region||(_==="backblaze"?qr("B2_REGION"):void 0)||(_==="hetzner"?qr("HETZNER_S3_REGION","HETZNER_REGION"):void 0)||qr("S3_REGION","AWS_REGION","AWS_DEFAULT_REGION")||Zm[_],r=E.endpoint||qr("S3_ENDPOINT")||u9(_,T),d=E.forcePathStyle??qr("S3_FORCE_PATH_STYLE")==="true",t=qm(_,E.credentials),R=(h)=>{let N=r||`s3.${T}.amazonaws.com`;return d?`https://${N}/${h}`:`https://${h}.${N}`};return{provider:_,region:T,endpoint:r,forcePathStyle:d,credentials:t,profile:E.profile,publicBaseUrl:R}}function yz(E={}){let _=v9(E),T={endpoint:_.endpoint,forcePathStyle:_.forcePathStyle,credentials:_.credentials};return new xE(_.region,_.profile,T)}KT();f0();a0();z_();Vr();Bh();VE();Mt();Y0();eN();PL();Kh();_L();uN();VE();class Fr{client;region;constructor(E="us-east-1"){this.region=E,this.client=new JE}buildFormBody(E){return Object.entries(E).filter(([,T])=>T!==void 0).map(([T,r])=>`${encodeURIComponent(T)}=${encodeURIComponent(r)}`).join("&")}async createTopic(E){let _={Action:"CreateTopic",Version:"2010-03-31",Name:E.Name};if(E.DisplayName)_["Attributes.entry.1.key"]="DisplayName",_["Attributes.entry.1.value"]=E.DisplayName;if(E.Tags)E.Tags.forEach((r,d)=>{_[`Tags.member.${d+1}.Key`]=r.Key,_[`Tags.member.${d+1}.Value`]=r.Value});if(E.Attributes){let r=E.DisplayName?2:1;Object.entries(E.Attributes).forEach(([d,t])=>{_[`Attributes.entry.${r}.key`]=d,_[`Attributes.entry.${r}.value`]=t,r++})}let T=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)});return{TopicArn:T?.CreateTopicResponse?.CreateTopicResult?.TopicArn||T?.TopicArn}}async deleteTopic(E){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteTopic",Version:"2010-03-31",TopicArn:E})})}async listTopics(E){let _={Action:"ListTopics",Version:"2010-03-31"};if(E)_.NextToken=E;let T=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)}),r=T?.ListTopicsResponse?.ListTopicsResult||T?.ListTopicsResult,d=r?.Topics?.member;return{Topics:Array.isArray(d)?d:d?[d]:[],NextToken:r?.NextToken}}async getTopicAttributes(E){let T=(await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetTopicAttributes",Version:"2010-03-31",TopicArn:E})}))?.GetTopicAttributesResponse?.GetTopicAttributesResult?.Attributes?.entry,r={TopicArn:E};if(Array.isArray(T))T.forEach((d)=>{r[d.key]=d.value});return r}async setTopicAttributes(E){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetTopicAttributes",Version:"2010-03-31",TopicArn:E.TopicArn,AttributeName:E.AttributeName,AttributeValue:E.AttributeValue})})}async subscribe(E){let _={Action:"Subscribe",Version:"2010-03-31",TopicArn:E.TopicArn,Protocol:E.Protocol,Endpoint:E.Endpoint};if(E.ReturnSubscriptionArn)_.ReturnSubscriptionArn="true";if(E.Attributes){let r=1;Object.entries(E.Attributes).forEach(([d,t])=>{_[`Attributes.entry.${r}.key`]=d,_[`Attributes.entry.${r}.value`]=t,r++})}let T=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)});return{SubscriptionArn:T?.SubscribeResponse?.SubscribeResult?.SubscriptionArn||T?.SubscriptionArn}}async unsubscribe(E){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"Unsubscribe",Version:"2010-03-31",SubscriptionArn:E})})}async listSubscriptionsByTopic(E,_){let T={Action:"ListSubscriptionsByTopic",Version:"2010-03-31",TopicArn:E};if(_)T.NextToken=_;let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(T)}),d=r?.ListSubscriptionsByTopicResponse?.ListSubscriptionsByTopicResult?.Subscriptions?.member;return{Subscriptions:Array.isArray(d)?d:d?[d]:[],NextToken:r?.ListSubscriptionsByTopicResponse?.ListSubscriptionsByTopicResult?.NextToken}}async publish(E){let _={Action:"Publish",Version:"2010-03-31",Message:E.Message};if(E.TopicArn)_.TopicArn=E.TopicArn;if(E.TargetArn)_.TargetArn=E.TargetArn;if(E.PhoneNumber)_.PhoneNumber=E.PhoneNumber;if(E.Subject)_.Subject=E.Subject;if(E.MessageStructure)_.MessageStructure=E.MessageStructure;if(E.MessageAttributes){let r=1;Object.entries(E.MessageAttributes).forEach(([d,t])=>{if(_[`MessageAttributes.entry.${r}.Name`]=d,_[`MessageAttributes.entry.${r}.Value.DataType`]=t.DataType,t.StringValue)_[`MessageAttributes.entry.${r}.Value.StringValue`]=t.StringValue;if(t.BinaryValue)_[`MessageAttributes.entry.${r}.Value.BinaryValue`]=t.BinaryValue;r++})}let T=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)});return{MessageId:T?.PublishResponse?.PublishResult?.MessageId||T?.MessageId}}async publishSMS(E,_,T){let r={};if(T)r["AWS.SNS.SMS.SenderID"]={DataType:"String",StringValue:T};return this.publish({PhoneNumber:E,Message:_,MessageAttributes:Object.keys(r).length>0?r:void 0})}async subscribeEmail(E,_){return this.subscribe({TopicArn:E,Protocol:"email",Endpoint:_})}async subscribeLambda(E,_){return this.subscribe({TopicArn:E,Protocol:"lambda",Endpoint:_})}async subscribeSqs(E,_,T){let r={};if(T)r.RawMessageDelivery="true";return this.subscribe({TopicArn:E,Protocol:"sqs",Endpoint:_,Attributes:Object.keys(r).length>0?r:void 0})}async subscribeHttp(E,_,T){let r=_.startsWith("https")?"https":"http",d={};if(T)d.RawMessageDelivery="true";return this.subscribe({TopicArn:E,Protocol:r,Endpoint:_,Attributes:Object.keys(d).length>0?d:void 0})}async subscribeSms(E,_){return this.subscribe({TopicArn:E,Protocol:"sms",Endpoint:_})}async topicExists(E){try{return await this.getTopicAttributes(E),!0}catch(_){if(_.code==="NotFound"||_.statusCode===404)return!1;throw _}}async getSMSAttributes(){let _=(await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetSMSAttributes",Version:"2010-03-31"})}))?.GetSMSAttributesResponse?.GetSMSAttributesResult?.attributes?.entry,T={};if(Array.isArray(_))_.forEach((r)=>{T[r.key]=r.value});else if(_)T[_.key]=_.value;return T}async setSMSAttributes(E){let _={Action:"SetSMSAttributes",Version:"2010-03-31"},T=1;Object.entries(E).forEach(([r,d])=>{if(d!==void 0)_[`attributes.entry.${T}.key`]=r,_[`attributes.entry.${T}.value`]=d,T++}),await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)})}async checkIfPhoneNumberIsOptedOut(E){return(await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CheckIfPhoneNumberIsOptedOut",Version:"2010-03-31",phoneNumber:E})}))?.CheckIfPhoneNumberIsOptedOutResponse?.CheckIfPhoneNumberIsOptedOutResult?.isOptedOut==="true"}async listPhoneNumbersOptedOut(E){let _={Action:"ListPhoneNumbersOptedOut",Version:"2010-03-31"};if(E)_.nextToken=E;let T=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)}),r=T?.ListPhoneNumbersOptedOutResponse?.ListPhoneNumbersOptedOutResult?.phoneNumbers?.member;return{phoneNumbers:Array.isArray(r)?r:r?[r]:[],nextToken:T?.ListPhoneNumbersOptedOutResponse?.ListPhoneNumbersOptedOutResult?.nextToken}}async optInPhoneNumber(E){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"OptInPhoneNumber",Version:"2010-03-31",phoneNumber:E})})}async listSMSSandboxPhoneNumbers(E){let _={Action:"ListSMSSandboxPhoneNumbers",Version:"2010-03-31"};if(E)_.NextToken=E;let T=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)}),r=T?.ListSMSSandboxPhoneNumbersResponse?.ListSMSSandboxPhoneNumbersResult?.PhoneNumbers?.member;return{PhoneNumbers:Array.isArray(r)?r:r?[r]:[],NextToken:T?.ListSMSSandboxPhoneNumbersResponse?.ListSMSSandboxPhoneNumbersResult?.NextToken}}async createSMSSandboxPhoneNumber(E,_){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateSMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:E,LanguageCode:_||"en-US"})})}async verifySMSSandboxPhoneNumber(E,_){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"VerifySMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:E,OneTimePassword:_})})}async deleteSMSSandboxPhoneNumber(E){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteSMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:E})})}async getSMSSandboxAccountStatus(){return{IsInSandbox:(await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetSMSSandboxAccountStatus",Version:"2010-03-31"})}))?.GetSMSSandboxAccountStatusResponse?.GetSMSSandboxAccountStatusResult?.IsInSandbox==="true"}}}JA();Gr();sR();VE();VE();ut();VE();VE();VE();VE();VE();VE();VE();VE();VE();VE();VE();class gr{client;region;constructor(E="us-east-1"){this.region=E,this.client=new JE}async request(E,_){return this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSEvents.${E}`},body:JSON.stringify(_)})}async putRule(E){return this.request("PutRule",E)}async deleteRule(E){return this.request("DeleteRule",E)}async describeRule(E){return this.request("DescribeRule",E)}async listRules(E){return this.request("ListRules",E||{})}async listEventBuses(E){return this.request("ListEventBuses",E||{})}async enableRule(E){return this.request("EnableRule",E)}async disableRule(E){return this.request("DisableRule",E)}async putTargets(E){return this.request("PutTargets",E)}async removeTargets(E){return this.request("RemoveTargets",E)}async listTargetsByRule(E){return this.request("ListTargetsByRule",E)}async putEvents(E){return this.request("PutEvents",E)}async createSchedule(E){return this.client.request({service:"scheduler",region:this.region,method:"POST",path:`/schedules/${E.Name}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})}}VE();class Md{client;region;constructor(E="us-east-1",_){this.region=E,this.client=new JE}async createRule(E){let _={Action:"PutRule",Name:E.name,ScheduleExpression:E.scheduleExpression,Version:"2015-10-07"};if(E.description)_.Description=E.description;if(E.state)_.State=E.state;else _.State="ENABLED";return{RuleArn:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.PutRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:E.name,ScheduleExpression:E.scheduleExpression,State:E.state||"ENABLED",Description:E.description})})).RuleArn}}async putTargets(E,_){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.PutTargets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:E,Targets:_})})}async listRules(E){let _={};if(E)_.NamePrefix=E;return{Rules:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.ListRules","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})).Rules||[]}}async describeRule(E){let _=await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DescribeRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:E})});return{Name:_.Name,Arn:_.Arn,ScheduleExpression:_.ScheduleExpression,State:_.State,Description:_.Description}}async listTargetsByRule(E){return{Targets:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.ListTargetsByRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:E})})).Targets||[]}}async deleteRule(E,_){if(_)try{let T=await this.listTargetsByRule(E);if(T.Targets&&T.Targets.length>0)await this.removeTargets(E,T.Targets.map((r)=>r.Id))}catch{}await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DeleteRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:E,Force:_||!1})})}async removeTargets(E,_){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.RemoveTargets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:E,Ids:_})})}async enableRule(E){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.EnableRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:E})})}async disableRule(E){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DisableRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:E})})}async createLambdaSchedule(E){let _=await this.createRule({name:E.name,scheduleExpression:E.scheduleExpression,description:E.description,state:"ENABLED"});return await this.putTargets(E.name,[{Id:"1",Arn:E.functionArn,Input:E.input}]),_}async createEcsSchedule(E){let _=await this.createRule({name:E.name,scheduleExpression:E.scheduleExpression,description:E.description,state:"ENABLED"});return await this.putTargets(E.name,[{Id:"1",Arn:E.clusterArn,RoleArn:E.roleArn,Input:JSON.stringify({containerOverrides:[]})}]),_}async listSchedules(E){let _={};if(E?.NamePrefix)_.NamePrefix=E.NamePrefix;if(E?.State)_.State=E.State;let T=E?.GroupName||"default";return{Schedules:(await this.client.request({service:"scheduler",region:this.region,method:"GET",path:"/schedules",queryParams:{..._,ScheduleGroup:T}}))?.Schedules||[]}}async getSchedule(E){try{let _={};if(E.GroupName)_.groupName=E.GroupName;return await this.client.request({service:"scheduler",region:this.region,method:"GET",path:`/schedules/${encodeURIComponent(E.Name)}`,queryParams:Object.keys(_).length>0?_:void 0})}catch(_){if(_.statusCode===404||_.code==="ResourceNotFoundException")return null;throw _}}async createSchedule(E){let _={ScheduleExpression:E.ScheduleExpression,FlexibleTimeWindow:E.FlexibleTimeWindow,Target:E.Target};if(E.GroupName)_.GroupName=E.GroupName;if(E.ScheduleExpressionTimezone)_.ScheduleExpressionTimezone=E.ScheduleExpressionTimezone;if(E.Description)_.Description=E.Description;if(E.State)_.State=E.State;if(E.StartDate)_.StartDate=E.StartDate.toISOString();if(E.EndDate)_.EndDate=E.EndDate.toISOString();return{ScheduleArn:(await this.client.request({service:"scheduler",region:this.region,method:"POST",path:`/schedules/${encodeURIComponent(E.Name)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(_)}))?.ScheduleArn||""}}async updateSchedule(E){let _={};if(E.GroupName)_.GroupName=E.GroupName;if(E.ScheduleExpression)_.ScheduleExpression=E.ScheduleExpression;if(E.ScheduleExpressionTimezone)_.ScheduleExpressionTimezone=E.ScheduleExpressionTimezone;if(E.Description!==void 0)_.Description=E.Description;if(E.State)_.State=E.State;if(E.FlexibleTimeWindow)_.FlexibleTimeWindow=E.FlexibleTimeWindow;if(E.Target)_.Target=E.Target;return{ScheduleArn:(await this.client.request({service:"scheduler",region:this.region,method:"PUT",path:`/schedules/${encodeURIComponent(E.Name)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(_)}))?.ScheduleArn||""}}async deleteSchedule(E){let _={};if(E.GroupName)_.groupName=E.GroupName;await this.client.request({service:"scheduler",region:this.region,method:"DELETE",path:`/schedules/${encodeURIComponent(E.Name)}`,queryParams:Object.keys(_).length>0?_:void 0})}async listScheduleGroups(E){let _={};if(E?.NamePrefix)_.NamePrefix=E.NamePrefix;return{ScheduleGroups:(await this.client.request({service:"scheduler",region:this.region,method:"GET",path:"/schedule-groups",queryParams:Object.keys(_).length>0?_:void 0}))?.ScheduleGroups||[]}}}bN();VE();z_();z_();_L();z_();z_();VE();VE();z_();GJ();sd();await TR();function KA(E){return E?.split("/").at(-1)??E?.split(":").at(-1)??"unknown"}function n9(E,_,T,r="ecs:aws",d=[]){let t=T.now??new Date;return E.map((R)=>{let h=R.serviceName??KA(R.serviceArn),N=_.filter((e)=>!R.clusterArn||e.clusterArn===R.clusterArn),S=N.some((e)=>!!e.group)?N.filter((e)=>e.group===`service:${h}`):N,A=R.status==="ACTIVE"?(R.runningCount??0)<(R.desiredCount??0)?"degraded":"running":LR(R.status),L=d.find((e)=>e.taskDefinitionArn===R.taskDefinition),O=Array.isArray(L?.containerDefinitions)?L.containerDefinitions:[],c=[...new Set(O.map((e)=>e.logConfiguration?.options?.["awslogs-group"]).filter((e)=>typeof e==="string"))],$=O.flatMap((e)=>(e.mountPoints??[]).map((z)=>({source:z.sourceVolume,target:z.containerPath,type:"volume",readOnly:!!z.readOnly}))),I=O.flatMap((e)=>(e.portMappings??[]).map((z,F)=>({id:`${e.name??"container"}:${F}`,name:e.name,mode:L?.networkMode,ports:[{container:z.containerPort,host:z.hostPort,protocol:z.protocol}]}))),C=T.project&&T.environment&&h.startsWith(`${T.project}-${T.environment}-`)?h.slice(`${T.project}-${T.environment}-`.length):h;return{id:At("ecs",r,R.serviceArn??h),provider:"ecs",kind:"service",name:h,status:A,rawStatus:R.status,health:A==="running"?"healthy":A==="failed"||A==="degraded"?"unhealthy":"unknown",desiredReplicas:R.desiredCount,runningReplicas:R.runningCount,image:O[0]?.image,runtime:R.launchType??"ECS",version:KA(R.taskDefinition),ageSeconds:WN(R.deployments?.[0]?.createdAt,t),restartCount:0,tags:{},links:{project:T.project,environment:T.environment,service:C,release:KA(R.taskDefinition),providerId:R.serviceArn},replicas:S.map((e)=>{let z=LR(e.lastStatus);return{id:At("ecs",r,e.taskArn??KA(e.taskArn)),name:KA(e.taskArn),status:z,rawStatus:e.lastStatus,createdAt:e.createdAt,startedAt:e.startedAt,stoppedAt:e.stoppedAt,host:e.containerInstanceArn,containers:(e.containers??[]).map((F)=>({id:F.containerArn??F.name??"container",name:F.name??"container",image:O.find((B)=>B.name===F.name)?.image,imageDigest:F.imageDigest,status:LR(F.lastStatus),rawStatus:F.lastStatus,exitCode:F.exitCode,reason:F.reason,runtime:"ecs"}))}}),networks:I,mounts:$,capabilities:BN(["start","stop","restart","redeploy","scale","inspect",...c.length?["logs"]:[]],"This ECS runtime does not expose exec or file transfer; logs require an awslogs task-definition driver"),config:AR({clusterArn:R.clusterArn,taskDefinition:R.taskDefinition,launchType:R.launchType,pendingCount:R.pendingCount,deployments:R.deployments,logGroups:c,executionRoleArn:L?.executionRoleArn,taskRoleArn:L?.taskRoleArn,cpu:L?.cpu,memory:L?.memory}),discoveredAt:t.toISOString(),sourceId:r}})}function l9(E,_,T="lambda:aws"){let r=_.now??new Date;return E.map((d)=>{let t=d.FunctionName??KA(d.FunctionArn),R=d.State==="Active"?"running":LR(d.State);return{id:At("lambda",T,d.FunctionArn??t),provider:"lambda",kind:"function",name:t,status:R,rawStatus:d.State,health:R==="running"?"healthy":R==="failed"?"unhealthy":"unknown",desiredReplicas:void 0,runningReplicas:void 0,image:void 0,runtime:d.Runtime,version:d.Version,architecture:d.Architectures?.join(", "),ageSeconds:WN(d.LastModified,r),restartCount:0,tags:{},links:{project:_.project,environment:_.environment,service:t,providerId:d.FunctionArn},resources:{memoryLimitBytes:d.MemorySize==null?void 0:d.MemorySize*1024*1024},replicas:[],networks:[],mounts:[],capabilities:BN(["logs","inspect"],"Lambda has no persistent process to start, stop, restart, exec, or browse files; deploy a release to replace code"),config:AR({handler:d.Handler,timeout:d.Timeout,codeSize:d.CodeSize,stateReason:d.StateReason,environmentKeys:Object.keys(d.Environment?.Variables??{})}),discoveredAt:r.toISOString(),sourceId:T}})}function nm(E){let _=E.trim();if(!_)return[];let T=JSON.parse(_);if(!Array.isArray(T))throw Error("Docker inspect output must be an array");return T.filter((r)=>r&&typeof r.Id==="string")}function lm(E){let _=Object.entries(E.NetworkSettings?.Ports??{}).flatMap(([T,r])=>{let[d,t]=T.split("/");return(r??[]).map((R)=>({container:Number(d)||void 0,host:Number(R.HostPort)||void 0,protocol:t,address:R.HostIp}))});return Object.entries(E.NetworkSettings?.Networks??{}).map(([T,r])=>({id:r.NetworkID||T,name:T,mode:E.HostConfig?.NetworkMode,addresses:[r.IPAddress,r.GlobalIPv6Address].filter(Boolean),ports:_}))}function im(E){return(E.Mounts??[]).filter((_)=>!!_.Destination).map((_)=>({source:_.Source,target:_.Destination,type:_.Type,readOnly:_.RW===!1}))}function am(E,_,T=_.server??"local"){let r=_.now??new Date;return E.map((d)=>{let t=d.State?.OOMKilled?"oomkilled":d.State?.Restarting?"starting":d.State?.Status,R=LR(t),h=(d.Name??d.Id.slice(0,12)).replace(/^\//,""),N=d.Config?.Labels??{},S=im(d),A=lm(d),L={id:d.Id,name:h,image:d.Config?.Image,imageDigest:d.Image,runtime:"docker",status:R,rawStatus:t,exitCode:d.State?.ExitCode,reason:d.State?.Error,resources:{memoryLimitBytes:d.HostConfig?.Memory||void 0},networks:A,mounts:S};return{id:At("docker",T,d.Id),provider:"docker",kind:"container",name:h,status:R,rawStatus:t,health:R==="running"?"healthy":R==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:R==="running"?1:0,image:d.Config?.Image,runtime:"docker",ageSeconds:WN(d.State?.StartedAt,r),restartCount:d.RestartCount??0,tags:N,links:{project:_.project,environment:_.environment,server:_.server??T.replace(/^docker:/,""),service:N["com.docker.compose.service"]??N["ts-cloud.service"]??h,release:N["ts-cloud.release"],providerId:d.Id},resources:L.resources,replicas:[{id:At("docker",T,`${d.Id}:0`),name:h,status:R,rawStatus:t,startedAt:d.State?.StartedAt,stoppedAt:d.State?.FinishedAt,restartCount:d.RestartCount,containers:[L],resources:L.resources}],networks:A,mounts:S,capabilities:BN(["start","stop","restart","logs","exec","inspect","files"],"Use the owning Compose service for redeploy and scale"),config:AR({image:d.Config?.Image,labels:N,environmentKeys:(d.Config?.Env??[]).map((O)=>O.split("=",1)[0]),networkMode:d.HostConfig?.NetworkMode}),discoveredAt:r.toISOString(),sourceId:T}})}class Yz{inspect;id;provider="docker";constructor(E,_="docker:local"){this.inspect=E;this.id=_}async discover(E){return am(nm(await this.inspect(E)),E,this.id)}}function mm(E){let _=[];for(let T of E.split(`
-`)){if(!T.startsWith("TSCLOUD_SYSTEMD\t"))continue;let[,r,d,t,R,h,N,S,A,L,O,c,$,I]=T.split("\t");if(!r||!/^[A-Za-z0-9_.@:-]+\.service$/.test(r))continue;_.push({unit:r,load:d,active:t,sub:R,description:h,enabled:N,pid:Number(S)||void 0,memoryBytes:x9(A),restartCount:Number(L)||0,activeSince:O||void 0,fragmentPath:c||void 0,workingDirectory:$?.startsWith("/")?$:void 0,user:I||void 0})}return _}function sm(E,_,T=_.server??"local"){let r=_.now??new Date;return E.map((d)=>{let t=LR(d.active==="active"?d.sub||d.active:d.active),R=d.unit.replace(/\.service$/,""),h=/^(.*?) (?:release [^ ]+|queue worker|daemon |scheduler)(?: |$)/.exec(d.description??"")?.[1]??(_.project&&R.startsWith(`${_.project}-`)?R.slice(_.project.length+1).split("@",1)[0]:void 0),N=R.includes("@")?R.slice(R.indexOf("@")+1):void 0,S=d.workingDirectory?[{target:d.workingDirectory,type:"working-directory"}]:[],A=["start","stop","restart","logs","exec","inspect",...S.length?["files"]:[]];return{id:At("systemd",T,d.unit),provider:"systemd",kind:"service",name:R,displayName:d.description||R,status:t,rawStatus:[d.load,d.active,d.sub].filter(Boolean).join("/"),health:t==="running"?"healthy":t==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:t==="running"?1:0,ageSeconds:WN(d.activeSince,r),restartCount:d.restartCount,tags:{enabled:d.enabled??"unknown"},links:{project:_.project,environment:_.environment,server:_.server??T.replace(/^systemd:/,""),service:h,release:N,providerId:d.unit},resources:{memoryBytes:d.memoryBytes},replicas:[{id:At("systemd",T,`${d.unit}:main`),name:"main",status:t,pid:d.pid,startedAt:d.activeSince,restartCount:d.restartCount,resources:{memoryBytes:d.memoryBytes}}],networks:[],mounts:S,capabilities:BN(A,S.length?"This systemd runtime does not support redeploy or replica scaling through the scoped explorer":"File transfer requires a provider-reported service working directory; redeploy and scaling are unavailable"),config:AR({fragmentPath:d.fragmentPath,workingDirectory:d.workingDirectory,user:d.user,environment:d.environment,enabled:d.enabled}),discoveredAt:r.toISOString(),sourceId:T}})}class Qz{read;id;provider="systemd";constructor(E,_="systemd:local"){this.read=E;this.id=_}async discover(E){return sm(mm(await this.read(E)),E,this.id)}}function pm(E,_){if(!E.success)throw Error(E.error||E.perInstance?.[0]?.error||`${_} discovery failed`);return E.perInstance?.[0]?.output??""}function om(){return["set -uo pipefail",'command -v systemctl >/dev/null 2>&1 || { echo "systemctl is unavailable" >&2; exit 127; }',"systemctl list-units --type=service --all --plain --no-legend 2>/dev/null | awk '{print $1}' | while IFS= read -r unit; do",'  [ -n "$unit" ] || continue','  clean() { printf "%s" "$1" | tr "\\t\\r\\n" "   "; }','  load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null || true)','  active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null || true)','  sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null || true)','  description=$(systemctl show "$unit" -p Description --value 2>/dev/null || true)','  enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)','  pid=$(systemctl show "$unit" -p MainPID --value 2>/dev/null || true)','  memory=$(systemctl show "$unit" -p MemoryCurrent --value 2>/dev/null || true)','  restarts=$(systemctl show "$unit" -p NRestarts --value 2>/dev/null || true)','  since=$(systemctl show "$unit" -p ActiveEnterTimestamp --value 2>/dev/null || true)','  fragment=$(systemctl show "$unit" -p FragmentPath --value 2>/dev/null || true)','  working=$(systemctl show "$unit" -p WorkingDirectory --value 2>/dev/null || true)','  user=$(systemctl show "$unit" -p User --value 2>/dev/null || true)','  printf "TSCLOUD_SYSTEMD\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n" "$(clean "$unit")" "$(clean "$load")" "$(clean "$active")" "$(clean "$sub")" "$(clean "$description")" "$(clean "$enabled")" "$(clean "$pid")" "$(clean "$memory")" "$(clean "$restarts")" "$(clean "$since")" "$(clean "$fragment")" "$(clean "$working")" "$(clean "$user")"',"done"]}function Es(){return["set -uo pipefail",'if ! command -v docker >/dev/null 2>&1; then echo "[]"; exit 0; fi',"ids=$(docker ps -aq)",'if [ -z "$ids" ]; then echo "[]"; else docker inspect $ids; fi']}function i9(E,_,T,r,d){let t=`${E}:${T.id}`,R=async()=>pm(await _.runRemoteDeploy({targets:[T],commands:E==="systemd"?om():Es(),timeoutSeconds:30,comment:`ts-cloud runtime discovery:${E}`,tags:{Project:r.project.slug,Environment:d,Role:"app"}}),t);return E==="systemd"?new Qz(R,t):new Yz(R,t)}async function QD(E,_=100){let T=[],r;for(let d=0;d<_;d++){let t=await E(r);if(T.push(...t.items),!t.nextToken)return T;r=t.nextToken}throw Error(`Provider pagination exceeded ${_} pages`)}class a9{client;prefix;id="ecs:aws";provider="ecs";constructor(E,_){this.client=E;this.prefix=_}async discover(E){let _=await QD(async(t)=>{let R=await this.client.listClusters({nextToken:t,maxResults:100});return{items:R.clusterArns??[],nextToken:R.nextToken}}),T=[],r=[],d=[];for(let t of _){let R=(await QD(async(h)=>{let N=await this.client.listServices(t,{nextToken:h,maxResults:100});return{items:N.serviceArns??[],nextToken:N.nextToken}})).filter((h)=>h.split("/").at(-1)?.startsWith(this.prefix));for(let h=0;h<R.length;h+=10){let N=await this.client.describeServices({cluster:t,services:R.slice(h,h+10)});T.push(...N.services??[])}for(let h of T.filter((N)=>N.clusterArn===t||!N.clusterArn)){let N=await QD(async(S)=>{let A=await this.client.listTasks(t,h.serviceName,{nextToken:S,maxResults:100});return{items:A.taskArns??[],nextToken:A.nextToken}});for(let S=0;S<N.length;S+=100){let A=await this.client.describeTasks(t,N.slice(S,S+100));r.push(...A.tasks??[])}}}if(this.client.describeTaskDefinition)for(let t of[...new Set(T.map((R)=>R.taskDefinition).filter((R)=>!!R))]){let R=await this.client.describeTaskDefinition(t);if(R.taskDefinition)d.push(R.taskDefinition)}return n9(T,r,E,this.id,d)}}class m9{client;prefix;id="lambda:aws";provider="lambda";constructor(E,_){this.client=E;this.prefix=_}async discover(E){let _=(await QD(async(T)=>{let r=await this.client.listFunctions({Marker:T,MaxItems:50});return{items:r.Functions??[],nextToken:r.NextMarker}})).filter((T)=>T.FunctionName?.startsWith(this.prefix));return l9(_,E,this.id)}}async function _s(E,_,T={}){let r=[],d=xT(E),t=GT(E),R=E.aws?.profile,h=E.aws?.region??E.project.region??"us-east-1",N=`${E.project.slug}-${_}`;if(d!=="serverless"){let S=T.driver??x_({config:E}),A=await S.findComputeTargets({slug:E.project.slug,environment:_,role:"app"});for(let L of A)r.push(i9("systemd",S,L,E,_)),r.push(i9("docker",S,L,E,_))}if(t==="aws")r.push(new a9(T.ecs??new Ah(h,R),N)),r.push(new m9(T.lambda??new B_(h,R),N));return r}async function fd(E,_,T={}){let r={project:E.project.slug,environment:_};try{return await b9(await _s(E,_,T),r)}catch(d){return{generatedAt:new Date().toISOString(),workloads:[],sources:[{id:"runtime:bootstrap",provider:GT(E)==="aws"?"ecs":"systemd",status:"error",discoveredAt:new Date().toISOString(),staleAfterSeconds:60,itemCount:0,message:String(d?.message??d).slice(0,500)}],degraded:!0}}}sR();await TR();var s9=65536,YO=49152,MD=/^[A-Za-z0-9_.@:-]+\.service$/,fD=/^[a-fA-F0-9]{12,128}$/,Ts=["/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run"];function VA(E){let _=Buffer.from(E);return _.byteLength<=s9?E:`${_.subarray(0,s9-24).toString("utf8")}
-[output truncated]`}function GD(E){return{success:!1,instanceCount:0,perInstance:[],error:E instanceof Error?E.message:String(E)}}function Od(E){return`'${E.replaceAll("'",`'"'"'`)}'`}function rs(E,_){return Number.isFinite(E)?Math.min(1e4,Math.max(0,Math.floor(E))):_}function ds(E){let _=E.config,T=typeof _.clusterArn==="string"?_.clusterArn:void 0,r=E.links.providerId||E.name;return T&&r?{cluster:T,service:r}:void 0}function ts(E,_){return E.find((T)=>T.id===_.links.server)??(E.length===1?E[0]:void 0)}function Rs(E,_){if(E.provider==="systemd"){let T=E.links.providerId;if(!T||!MD.test(T)||!["start","stop","restart"].includes(_))return;return[`systemctl ${_} ${T}`,`systemctl is-active ${T} 2>/dev/null || true`]}if(E.provider==="docker"){let T=E.links.providerId;if(!T||!fD.test(T)||!["start","stop","restart"].includes(_))return;return[`docker ${_} ${T}`,`docker inspect --format '{{.State.Status}}' ${T}`]}return}function hs(E,_){if(!_.startsWith("/")||_.includes("\x00"))return{ok:!1,error:"An absolute path is required."};let T=[];for(let h of _.split("/")){if(!h||h===".")continue;if(h===".."){if(!T.length)return{ok:!1,error:"Path traversal is not allowed."};T.pop()}else T.push(h)}let r=`/${T.join("/")}`;if(Ts.some((h)=>r===h||r.startsWith(`${h}/`)))return{ok:!1,error:"Sensitive host paths are not available through runtime file access."};let d=E.links.project?.replace(/[^A-Za-z0-9_-]/g,""),t=E.links.service?.replace(/[^A-Za-z0-9_-]/g,"");if(![...d&&t?[`/var/www/${d}/${t}`,`/srv/${d}/${t}`]:[],...E.mounts.map((h)=>h.target).filter((h)=>h.startsWith("/"))].some((h)=>r===h||r.startsWith(`${h.replace(/\/$/,"")}/`)))return{ok:!1,error:"Path is outside this service’s owned roots."};return{ok:!0,path:r}}function Ns(E,_){let T=E.links.project?.replace(/[^A-Za-z0-9_-]/g,""),r=E.links.service?.replace(/[^A-Za-z0-9_-]/g,"");return[...T&&r?[`/var/www/${T}/${r}`,`/srv/${T}/${r}`]:[],...E.mounts.map((d)=>d.target).filter((d)=>d.startsWith("/"))].sort((d,t)=>t.length-d.length).find((d)=>_===d||_.startsWith(`${d.replace(/\/$/,"")}/`))}var p9={process:["ps","-eo","pid,ppid,user,%cpu,%mem,etime,command","--sort=-%cpu"],sockets:["ss","-lntup"],filesystem:["df","-h"]};class xr{config;environment;dependencies;region;profile;constructor(E,_,T={}){this.config=E;this.environment=_;this.dependencies=T;this.region=E.aws?.region??E.project.region??"us-east-1",this.profile=E.aws?.profile}async inventory(){return this.dependencies.inventory?.()??fd(this.config,this.environment,{driver:this.dependencies.driver})}async workload(E){return(await this.inventory()).workloads.find((_)=>_.id===E)}async remote(E,_,T,r){let d=this.dependencies.driver??x_({config:this.config}),t=await d.findComputeTargets({slug:this.config.project.slug,environment:this.environment,role:"app"}),R=ts(t,E);if(!R)throw Error("The workload server is no longer reachable in this scope.");return d.runRemoteDeploy({targets:[R],commands:_,timeoutSeconds:T,comment:r,tags:{Project:this.config.project.slug,Environment:this.environment,Role:"app"}})}async run(E){let _=await this.workload(E.workloadId),T={workloadId:E.workloadId,action:E.action};if(!_)return{...T,ok:!1,error:"Workload was not found in the current project and environment."};let r=_.capabilities[E.action];if(!r.supported)return{...T,ok:!1,error:r.reason??`${E.action} is unsupported for ${_.provider}.`};if(r.requiresConfirmation&&E.confirm!==_.name)return{...T,ok:!1,error:`Type "${_.name}" to ${E.action} this workload.`};if(r.requiresRecentAuth&&!E.recentAuth)return{...T,ok:!1,error:"Sign in again before using elevated runtime access."};if(E.action==="inspect")return{...T,ok:!0,workload:_};if(_.provider==="systemd"||_.provider==="docker"){let d=Rs(_,E.action);if(!d)return{...T,ok:!1,error:`${E.action} is not implemented for ${_.provider}.`};let t=await this.remote(_,["set -uo pipefail",...d],60,`ts-cloud runtime:${E.action}`).catch(GD);return{...T,ok:t.success,command:d[0],stdout:VA(t.perInstance?.[0]?.output??""),stderr:VA(t.perInstance?.[0]?.error??t.error??""),error:t.success?void 0:t.error??"Runtime operation failed."}}if(_.provider==="ecs"){let d=ds(_);if(!d)return{...T,ok:!1,error:"ECS cluster or service identity is unavailable."};let t=this.dependencies.ecs??new Ah(this.region,this.profile);if(E.action==="scale"){let R=rs(E.replicas,_.desiredReplicas??1);return await t.scaleService(d.cluster,d.service,R),{...T,ok:!0,command:`ecs scale ${_.name} ${R}`}}if(E.action==="start"||E.action==="stop"){let R=E.action==="stop"?0:Math.max(1,_.desiredReplicas??1);return await t.scaleService(d.cluster,d.service,R),{...T,ok:!0,command:`ecs scale ${_.name} ${R}`}}if(E.action==="restart"||E.action==="redeploy")return await t.forceNewDeployment(d.cluster,d.service),{...T,ok:!0,command:`ecs redeploy ${_.name}`}}return{...T,ok:!1,error:`${E.action} is not implemented for ${_.provider}.`}}async exec(E){let _={workloadId:E.workloadId,preset:E.preset},T=await this.workload(E.workloadId);if(!T)return{..._,ok:!1,error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_EXEC==="0")return{..._,ok:!1,error:"Runtime exec is disabled by TS_CLOUD_RUNTIME_EXEC."};if(!T.capabilities.exec.supported)return{..._,ok:!1,error:T.capabilities.exec.reason??"Exec is unsupported for this workload."};if(E.confirm!==T.name)return{..._,ok:!1,error:`Type "${T.name}" to open exec access.`};if(!E.recentAuth)return{..._,ok:!1,error:"Sign in again before using elevated runtime access."};let r=E.preset&&p9[E.preset];if(!r&&!E.command?.trim())return{..._,ok:!1,error:"Choose a diagnostic preset or provide a command."};if(E.command&&T.provider!=="docker")return{..._,ok:!1,error:"Free-form exec is restricted to isolated containers; use a diagnostic preset for system services."};let d=T.links.providerId??"",t;if(T.provider==="docker"&&fD.test(d)){let h=E.command?.trim()||r.map(Od).join(" ");t=`docker exec ${d} sh -lc ${Od(h)}`}else if(T.provider==="systemd"&&MD.test(d)&&E.preset)t=E.preset==="process"?`systemctl status ${d} --no-pager --full`:p9[E.preset].map(Od).join(" ");if(!t)return{..._,ok:!1,error:"Exec target identity is invalid or unsupported."};let R=await this.remote(T,["set -uo pipefail",t],60,"ts-cloud runtime:exec").catch(GD);return{..._,ok:R.success,command:t,stdout:VA(R.perInstance?.[0]?.output??""),stderr:VA(R.perInstance?.[0]?.error??R.error??""),error:R.success?void 0:R.error??"Exec command failed."}}async readFile(E){let _={workloadId:E.workloadId,path:E.path},T=await this.fileTarget(E);if("error"in T)return{..._,ok:!1,error:T.error};let{workload:r,path:d,root:t,providerId:R}=T,N=`sh -c ${Od('resolved=$(realpath -m "$1"); root=$(realpath -m "$3"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; test -f "$resolved"; size=$(wc -c < "$resolved"); printf "__TSCLOUD_SIZE__=%s\\n" "$size"; head -c "$2" "$resolved" | base64')} sh ${Od(d)} ${YO} ${Od(t)}`,S=r.provider==="docker"?`docker exec ${R} ${N}`:N,A=await this.remote(r,[S],30,"ts-cloud runtime:file-read").catch(GD);if(!A.success)return{..._,ok:!1,error:A.error??A.perInstance?.[0]?.error??"File read failed."};let L=A.perInstance?.[0]?.output??"",O=/__TSCLOUD_SIZE__=(\d+)\r?\n/.exec(L);if(!O)return{..._,ok:!1,error:"The remote file response was invalid."};let c=Number(O[1]),$=L.slice((O.index??0)+O[0].length).replace(/\s+/g,"");if(Buffer.from($,"base64").byteLength>YO)return{..._,ok:!1,error:"The remote file exceeded the transfer limit."};return{..._,ok:!0,contentBase64:$,size:c,truncated:c>YO}}async writeFile(E){let _={workloadId:E.workloadId,path:E.path},T=await this.fileTarget(E);if("error"in T)return{..._,ok:!1,error:T.error};if(!/^[A-Za-z0-9+/]*={0,2}$/.test(E.contentBase64))return{..._,ok:!1,error:"File content must be valid base64."};let r=Buffer.from(E.contentBase64,"base64");if(r.toString("base64")!==E.contentBase64)return{..._,ok:!1,error:"File content must be canonical base64."};if(r.byteLength>YO)return{..._,ok:!1,error:`File uploads are limited to ${YO} bytes.`};let{workload:d,path:t,root:R,providerId:h}=T,S=`sh -c ${Od('resolved=$(realpath -m "$1"); root=$(realpath -m "$2"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; mkdir -p "$(dirname "$resolved")"; tmp="$resolved.ts-cloud-$$"; base64 -d > "$tmp"; chmod 600 "$tmp"; mv "$tmp" "$resolved"')} sh ${Od(t)} ${Od(R)}`,A=d.provider==="docker"?`printf %s ${Od(E.contentBase64)} | docker exec -i ${h} ${S}`:`printf %s ${Od(E.contentBase64)} | ${S}`,L=await this.remote(d,[A],30,"ts-cloud runtime:file-write").catch(GD);return{..._,ok:L.success,size:r.byteLength,truncated:!1,error:L.success?void 0:L.error??L.perInstance?.[0]?.error??"File write failed."}}async fileTarget(E){let _=await this.workload(E.workloadId);if(!_)return{error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_FILE_ACCESS==="0")return{error:"Runtime file access is disabled by TS_CLOUD_RUNTIME_FILE_ACCESS."};if(!_.capabilities.files.supported)return{error:_.capabilities.files.reason??"File access is unsupported for this workload."};if(E.confirm!==_.name)return{error:`Type "${_.name}" to access workload files.`};if(!E.recentAuth)return{error:"Sign in again before using elevated runtime access."};let T=hs(_,E.path);if(!T.ok)return{error:T.error};let r=Ns(_,T.path),d=_.links.providerId??"";if(!r||_.provider==="systemd"&&!MD.test(d)||_.provider==="docker"&&!fD.test(d))return{error:"File target identity is invalid or unsupported."};return{workload:_,path:T.path,root:r,providerId:d}}async logs(E,_={}){let T=await this.workload(E);if(!T)throw Error("Workload was not found in the current project and environment.");if(!T.capabilities.logs.supported)throw Error(T.capabilities.logs.reason??"Logs are unsupported for this workload.");let r=Math.min(1000,Math.max(1,Math.floor(_.limit??200)));if(T.provider==="lambda"||T.provider==="ecs"){let A=this.dependencies.logs??new Ir(this.region,this.profile),L=T.config.logGroups,O=T.provider==="lambda"?`/aws/lambda/${T.name}`:Array.isArray(L)&&typeof L[0]==="string"?L[0]:void 0;if(!O)throw Error("The ECS task definition does not declare an awslogs group.");let c=await A.filterLogEvents({logGroupName:O,startTime:_.since?.getTime(),limit:r}),$=(c.events??[]).slice(0,r).map((I)=>({timestamp:I.timestamp==null?void 0:new Date(I.timestamp).toISOString(),message:VA(String(I.message??""))}));return{workloadId:E,provider:T.provider,lines:$,nextCursor:c.nextToken,truncated:(c.events?.length??0)>=r}}let d=T.links.providerId??"",t=_.since&&Number.isFinite(_.since.getTime())?_.since:void 0,R=T.provider==="systemd"&&MD.test(d)?`journalctl -u ${d} --no-pager -n ${r} -o short-iso${t?` --since ${Od(t.toISOString())}`:""}`:T.provider==="docker"&&fD.test(d)?`docker logs --timestamps --tail ${r}${t?` --since ${Math.floor(t.getTime()/1000)}`:""} ${d} 2>&1`:void 0;if(!R)throw Error("Log target identity is invalid.");let h=await this.remote(T,[R],30,"ts-cloud runtime:logs");if(!h.success)throw Error(h.error??h.perInstance?.[0]?.error??"Log read failed.");let N=VA(h.perInstance?.[0]?.output??""),S=N.split(`
-`).filter(Boolean).slice(-r).map((A)=>{let L=/^(\d{4}-\d{2}-\d{2}T\S+)\s+(.*)$/.exec(A);return{timestamp:L?.[1],message:L?.[2]??A}});return{workloadId:E,provider:T.provider,lines:S,truncated:N.includes("[output truncated]")||S.length>=r}}}import{randomUUID as Ss}from"node:crypto";class Gz{records=new Map;maxBufferBytes;ttlMs;now;constructor(E={}){this.maxBufferBytes=Math.max(1024,E.maxBufferBytes??262144),this.ttlMs=Math.max(1000,E.ttlMs??900000),this.now=E.now??(()=>new Date)}create(E,_){this.sweep();let T=this.now().toISOString(),r={id:Ss(),workloadId:_,kind:E,state:"open",chunks:[],cursor:0,droppedBytes:0,bufferedBytes:0,createdAt:T,updatedAt:T,abort:new AbortController,listeners:new Set};return this.records.set(r.id,r),this.snapshot(r,0)}signal(E){return this.records.get(E)?.abort.signal}append(E,_,T="stdout"){let r=this.records.get(E);if(!r||r.state!=="open"||!_)return r?this.snapshot(r,r.cursor):void 0;let d=Buffer.from(_),t=d.byteLength>this.maxBufferBytes?d.subarray(d.byteLength-this.maxBufferBytes).toString("utf8"):_,R={cursor:++r.cursor,stream:T,data:t,at:this.now().toISOString()};r.chunks.push(R),r.bufferedBytes+=Buffer.byteLength(t),r.updatedAt=R.at;while(r.bufferedBytes>this.maxBufferBytes&&r.chunks.length>1){let h=r.chunks.shift(),N=Buffer.byteLength(h.data);r.bufferedBytes-=N,r.droppedBytes+=N}return this.publish(r),this.snapshot(r,R.cursor-1)}read(E,_,T=0){let r=this.records.get(E);if(!r||r.workloadId!==_)return;return r.updatedAt=this.now().toISOString(),this.snapshot(r,Math.max(0,Math.floor(T)))}close(E,_="complete",T){let r=this.records.get(E);if(!r||r.state!=="open")return r?this.snapshot(r,r.cursor):void 0;if(r.state=_,r.error=T,r.updatedAt=this.now().toISOString(),_==="cancelled")r.abort.abort();return this.publish(r),this.snapshot(r,r.cursor)}cancel(E,_){let T=this.records.get(E);if(!T||T.workloadId!==_)return;return this.close(E,"cancelled")}subscribe(E,_,T){let r=this.records.get(E);if(!r||r.workloadId!==_)return;return r.listeners.add(T),()=>r.listeners.delete(T)}sweep(){let E=this.now().getTime()-this.ttlMs,_=0;for(let[T,r]of this.records){if(new Date(r.updatedAt).getTime()>E)continue;r.abort.abort(),this.records.delete(T),_++}return _}clear(){for(let E of this.records.values())E.abort.abort();this.records.clear()}snapshot(E,_){let T=E.chunks[0]?.cursor??E.cursor+1,r=_>0&&_<T-1;return{id:E.id,workloadId:E.workloadId,kind:E.kind,state:E.state,chunks:E.chunks.filter((d)=>r||d.cursor>_),cursor:E.cursor,reset:r,droppedBytes:E.droppedBytes,createdAt:E.createdAt,updatedAt:E.updatedAt,error:E.error}}publish(E){let _=this.snapshot(E,0);for(let T of E.listeners)T(_)}}import{randomBytes as o9,scryptSync as E8,timingSafeEqual as As}from"node:crypto";function Vz(E,_){if(E.role==="admin")return[..._];return _.filter((T)=>!!E.sites?.[T])}var Mz=32768,fz=8,Kz=1,Ls=32,Os=16;function Ih(E){let _=o9(Os),T=E8(E,_,Ls,{N:Mz,r:fz,p:Kz,maxmem:268435456});return`scrypt$${Mz}$${fz}$${Kz}$${_.toString("base64url")}$${T.toString("base64url")}`}function Kd(E,_){try{let T=_.split("$");if(T.length!==6||T[0]!=="scrypt")return!1;let[,r,d,t,R,h]=T,N=Number(r),S=Number(d),A=Number(t);if(!Number.isFinite(N)||!Number.isFinite(S)||!Number.isFinite(A))return!1;let L=Buffer.from(R,"base64url"),O=Buffer.from(h,"base64url");if(L.length===0||O.length===0)return!1;let c=E8(E,L,O.length,{N,r:S,p:A,maxmem:268435456});return As(c,O)}catch{return!1}}function _8(E){let[_,T,r,d]=E.split("$");return _!=="scrypt"||Number(T)!==Mz||Number(r)!==fz||Number(d)!==Kz}function Zz(){return o9(18).toString("base64url")}await bd([IO(),LD()]);NA();await bd([aE(),TR()]);var cs=new Set(["singlestore","vitess"]);function ZD(E){return cs.has(E)}var VD={mysql:"/var/lib/pantry/mysql/mysqld.sock",mariadb:"/var/lib/pantry/mariadb/mariadbd.sock"};function OR(E){return/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(E)}function Us(E){if(E==="postgres"||E==="pgsql")return"postgres";if(E==="mariadb")return"mariadb";if(E==="singlestore")return"singlestore";if(E==="vitess")return"vitess";return"mysql"}function PN(E){let _=E.infrastructure?.compute,T=U_(E)?.engine;if(T)return Us(T);let r=_?.managedServices??{};if(r.postgres)return"postgres";if(r.mariadb)return"mariadb";return"mysql"}var qz=(E)=>E.replace(/`/g,"``"),Lt=(E)=>E.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),HN=(E)=>`"${E.replace(/"/g,'""')}"`,KD=(E)=>`'${E.replace(/'/g,"''")}'`;function gz(E,_){return[`mysql --socket=${E==="mariadb"?VD.mariadb:VD.mysql} -u root <<'TS_CLOUD_SQL_EOF'`,..._,"TS_CLOUD_SQL_EOF"]}function xz(E,_){return[`${RA(_)} -tA <<'TS_CLOUD_PG_EOF'`,...E,"TS_CLOUD_PG_EOF"]}function $s(E,_){if(E==="vitess")return Ds(_);if(E==="postgres")return xz(["SELECT 'DB=' || datname FROM pg_database WHERE datistemplate = false;","SELECT 'USER=' || usename FROM pg_user;"],_);return gz(E,["SELECT CONCAT('DB=', schema_name) FROM information_schema.schemata WHERE schema_name NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys');","SELECT DISTINCT CONCAT('USER=', User) FROM mysql.user WHERE User NOT IN ('root', 'mysql.sys', 'mysql.session', 'mysql.infoschema', 'debian-sys-maint');"])}function ZA(E,_,T){let r=_?.host??"127.0.0.1",d=_?.username??"root",t=_?.password??"",R=_?.ssl===!1?"":" --ssl-mode=PREFERRED",h=(S)=>`'${String(S).replace(/'/g,"'\\''")}'`;return[`${t?`MYSQL_PWD=${h(t)} `:""}mysql -h ${h(r)} -P ${_?.port??T} -u ${h(d)}${R} --batch --skip-column-names <<'TS_CLOUD_SQL_EOF'`,...E,"TS_CLOUD_SQL_EOF"]}var qA=15306;function Ds(E){let _=ZA(["SHOW KEYSPACES;"],E,qA);return _[0]=`${_[0]} | sed 's/^/DB=/'`,_}function Is(E){return ZA(["SHOW KEYSPACES;","SHOW VITESS_SHARDS;","SHOW VITESS_TABLETS;"],E,qA)}function Cs(E){let _=[],T=[],r=[];for(let d of E.split(`
+        ORDER BY rp.expires_at,rp.id`).all(E.toISOString(),E.toISOString()).map(cz),T=new Set;for(let r of new Set(_.map((d)=>d.projectId)))for(let d of this.listPolicies(r)){let t=this.listRecoveryPoints(d.projectId,d.id).filter((h)=>h.status==="available").sort((h,N)=>N.pointInTime.localeCompare(h.pointInTime));for(let h of t.slice(0,Math.max(0,d.retention.keepLast??0)))T.add(h.id);let R=[[d.retention.hourly,(h)=>h.toISOString().slice(0,13)],[d.retention.daily,(h)=>h.toISOString().slice(0,10)],[d.retention.weekly,(h)=>{return new Date(Date.UTC(h.getUTCFullYear(),h.getUTCMonth(),h.getUTCDate()-(h.getUTCDay()+6)%7)).toISOString().slice(0,10)}],[d.retention.monthly,(h)=>h.toISOString().slice(0,7)]];for(let[h,N]of R){let S=new Set;for(let A of t){let L=N(new Date(A.pointInTime));if(S.has(L))continue;if(S.add(L),S.size<=Math.max(0,h??0))T.add(A.id)}}}return _.filter((r)=>!T.has(r.id))}coverage(E,_=this.now()){let T=new Map(this.listDestinations(E).map((r)=>[r.id,r]));return this.listPolicies(E).map((r)=>{let d=this.listRecoveryPoints(E,r.id).filter((h)=>h.status==="available"),t=d[0],R=t?(_.getTime()-new Date(t.pointInTime).getTime())/60000:Number.POSITIVE_INFINITY;return{policy:r,lastRecoveryPoint:t,missedRpo:r.enabled&&R>r.expectedRpoMinutes,unverified:d.filter((h)=>h.verificationState!=="verified").length,destinationHealthy:T.get(r.destinationId)?.status==="healthy"}})}}z_();import{createCipheriv as Um,createDecipheriv as $m,createHash as BQ,randomBytes as WQ}from"node:crypto";var $z=Buffer.from("TSCB1"),HD=(E)=>`sha256:${BQ("sha256").update(E).digest("hex")}`;function HQ(E){return BQ("sha256").update(E).digest()}function Dm(E,_,T){let r=T?Buffer.from(T):WQ(12);if(r.length!==12)throw Error("Backup encryption IV must contain 12 bytes.");let d=Um("aes-256-gcm",HQ(_),r),t=Buffer.concat([d.update(E),d.final()]),R=d.getAuthTag();return Buffer.concat([$z,r,R,t])}function Im(E,_){let T=Buffer.from(E);if(!T.subarray(0,$z.length).equals($z))throw Error("Backup does not contain a valid encrypted envelope.");let r=T.subarray(5,17),d=T.subarray(17,33),t=T.subarray(33),R=$m("aes-256-gcm",HQ(_),r);return R.setAuthTag(d),Buffer.concat([R.update(t),R.final()])}function Cm(E){let _;try{_=JSON.parse(E)}catch{throw Error("Backup destination credential must be a JSON object with accessKeyId and secretAccessKey.")}if(!_.accessKeyId||!_.secretAccessKey)throw Error("Backup destination credential requires accessKeyId and secretAccessKey.");if(_.expiresAt){let T=new Date(String(_.expiresAt));if(!Number.isFinite(T.getTime()))throw Error("Backup destination credential expiresAt must be an ISO timestamp.");if(T.getTime()<=Date.now())throw Error("Backup destination credential has expired.")}return{accessKeyId:String(_.accessKeyId),secretAccessKey:String(_.secretAccessKey),sessionToken:_.sessionToken?String(_.sessionToken):void 0}}async function PQ(E,_,T=new Date){if(!E.credentialRef)return{status:"default"};try{let r=JSON.parse(await _.resolve(E.credentialRef));if(!r.accessKeyId||!r.secretAccessKey)return{status:"invalid"};if(!r.expiresAt)return{status:"static"};let d=new Date(String(r.expiresAt));if(!Number.isFinite(d.getTime()))return{status:"invalid"};let t=d.getTime()-T.getTime();return{status:t<=0?"expired":t<=604800000?"expiring":"valid",expiresAt:d.toISOString()}}catch{return{status:"invalid"}}}class PO{secrets;clientFactory;multipartThreshold;partSize;constructor(E,_=(d,t)=>new xE(d.region??"us-east-1",void 0,{endpoint:d.endpoint?new URL(d.endpoint).host:void 0,forcePathStyle:d.forcePathStyle,credentials:t}),T=8388608,r=8388608){this.secrets=E;this.clientFactory=_;this.multipartThreshold=T;this.partSize=r}async client(E){let _=E.credentialRef?Cm(await this.secrets.resolve(E.credentialRef)):void 0;return this.clientFactory(E,_)}async test(E){if(!E.bucket)throw Error("S3 destination has no configured bucket.");let _=await this.client(E),T=`${E.prefix?`${E.prefix.replace(/\/$/,"")}/`:""}.ts-cloud-health/${crypto.randomUUID()}`;await _.putObject({bucket:E.bucket,key:T,body:"ts-cloud backup destination health check",contentType:"text/plain"});try{let r=await _.getObjectBytes(E.bucket,T);if(Buffer.from(r.body).toString()!=="ts-cloud backup destination health check")throw Error("Backup destination health object was corrupted.")}finally{await _.deleteObject(E.bucket,T)}}async upload(E,_){if(!E.bucket)throw Error("S3 destination has no configured bucket.");let T=await this.client(E),r=HD(_.body),d=E.encryption!=="provider"?await this.secrets.resolve(E.encryptionKeyRef):void 0,t=d?_.resume?.encryptionIv?Buffer.from(_.resume.encryptionIv,"base64url"):WQ(12):void 0,R=d?Dm(_.body,d,t):Buffer.from(_.body),h=HD(R),N=`${E.prefix?`${E.prefix.replace(/\/$/,"")}/`:""}${_.key.replace(/^\/+/,"")}`,S=_.contentType??"application/octet-stream",A={"ts-cloud-format":"v1","ts-cloud-sha256":h.slice(7),"ts-cloud-encrypted":d?"true":"false"};if(_.resume&&_.resume.key!==N)throw Error("Multipart checkpoint does not match the requested backup key.");if(_.resume&&d&&!_.resume.encryptionIv)throw Error("Encrypted multipart checkpoint has no resumable envelope state.");if(_.resume&&d&&_.resume.plaintextChecksum!==r)throw Error("Encrypted multipart checkpoint does not match the backup payload.");if(R.length<this.multipartThreshold)await T.putObject({bucket:E.bucket,key:N,body:R,contentType:S,metadata:A});else{let L=_.resume?void 0:await T.createMultipartUpload(E.bucket,N,{contentType:S,metadata:A}),O=_.resume??{uploadId:L.UploadId,key:N,parts:[],bytesUploaded:0,encryptionIv:t?.toString("base64url"),plaintextChecksum:r},c=new Map(O.parts.map((I)=>[I.PartNumber,I])),$=Math.ceil(R.length/this.partSize);for(let I=0;I<$;I++){let C=I+1;if(!c.has(C)){let e=I*this.partSize,z=await T.uploadPart(E.bucket,N,O.uploadId,C,R.subarray(e,Math.min(R.length,e+this.partSize)));c.set(C,{PartNumber:C,ETag:z.ETag})}O.parts=[...c.values()].sort((e,z)=>e.PartNumber-z.PartNumber),O.bytesUploaded=Math.min(R.length,C*this.partSize),_.checkpoint?.(O)}await T.completeMultipartUpload(E.bucket,N,O.uploadId,O.parts)}return{uri:`s3://${E.bucket}/${N}`,key:N,sizeBytes:R.length,checksum:h,manifest:{format:"ts-cloud-backup-v1",encrypted:!!d,plaintextChecksum:r,storageChecksum:h,contentType:S}}}async download(E,_){if(!E.bucket)throw Error("S3 destination has no configured bucket.");let T=await this.client(E),r=await T.getObjectBytes(E.bucket,_.key),d=Buffer.from(r.body);if(HD(d)!==_.checksum)throw Error("Backup checksum verification failed; object is corrupt.");let t=_.manifest.encrypted?Im(d,await this.secrets.resolve(E.encryptionKeyRef)):d;if(HD(t)!==_.manifest.plaintextChecksum)throw Error("Backup plaintext checksum verification failed.");return t}async abortPartial(E,_){if(!E.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(E)).abortMultipartUpload(E.bucket,_.key,_.uploadId)}async delete(E,_){if(!E.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(E)).deleteObject(E.bucket,_)}}import{createHash as wm}from"node:crypto";var em=(E)=>`sha256:${wm("sha256").update(E).digest("hex")}`;class MA{store;queue;now;constructor(E,_,T=()=>new Date){this.store=E;this.queue=_;this.now=T}enqueueBackup(E,_=this.now().toISOString(),T){if(!E.enabled)throw Error("Backup policy is disabled.");let r=this.store.createJob({projectId:E.projectId,policyId:E.id,kind:"backup",status:"queued",idempotencyKey:`backup:${E.id}:${_}`,target:{scheduledFor:_},cancellability:"checkpoint_only",progress:{phase:"queued"}});if(!r.operationId){let d=this.queue.enqueue({projectId:E.projectId,environmentId:E.environmentId,resourceId:E.resourceId,actorId:T,kind:"backup.run",input:{backupJobId:r.id},lockKey:E.dataServiceId?`data-service:${E.dataServiceId}`:E.resourceId?`resource:${E.resourceId}`:`backup-policy:${E.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:14400,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(r.id,{operationId:d.operation.id})}return r}enqueueDue(E=this.now()){return this.store.duePolicies(E).map((_)=>{let T=_.nextRunAt;return this.store.advancePolicy(_.id,T),this.enqueueBackup(_,T)})}enqueueVerification(E){let _=this.store.createJob({projectId:E.projectId,policyId:E.policyId,recoveryPointId:E.id,kind:"verify",status:"queued",idempotencyKey:`verify:${E.id}:${E.checksum}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!_.operationId){let T=this.queue.enqueue({projectId:E.projectId,resourceId:E.resourceId,kind:"backup.verify",input:{backupJobId:_.id},lockKey:`recovery-point:${E.id}`,providerKey:"backup",maxAttempts:2,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(_.id,{operationId:T.operation.id})}return _}planRestore(E,_){if(E.status!=="available")throw Error("Only available recovery points can be restored.");if(E.verificationState!=="verified")throw Error("Restore requires a verified recovery point.");if(_.mode==="in_place"){if(!_.recentAuth)throw Error("In-place restore requires recent authentication.");if(_.confirm!==_.targetName)throw Error(`Type ${_.targetName} to confirm in-place restore.`);if(!_.downtimeAcknowledged)throw Error("In-place restore requires downtime acknowledgement.");let T=_.safetyBackupId?this.store.getRecoveryPoint(_.safetyBackupId):void 0;if(!T||T.id===E.id||T.status!=="available"||T.verificationState!=="verified"||T.resourceId!==E.resourceId||T.dataServiceId!==E.dataServiceId)throw Error("In-place restore requires a distinct verified safety backup for the same target.")}return{point:E,mode:_.mode,target:{..._.target,inPlace:_.mode==="in_place",restoreMode:_.mode},warnings:_.mode==="in_place"?["The target is locked against deployments and backup work.","Downtime and data replacement are expected.","Provider cancellation may stop only at a checkpoint."]:["An isolated target is created and health-validated before cleanup."]}}enqueueRestore(E,_){let T=this.planRestore(E,_),r=_.drill?"drill":"restore",d=em(JSON.stringify({point:E.id,mode:_.mode,target:_.target,safety:_.safetyBackupId,drill:!!_.drill})),t=this.store.createJob({projectId:E.projectId,policyId:E.policyId,recoveryPointId:E.id,kind:r,status:"queued",idempotencyKey:`${r}:${d}`,target:T.target,restoreMode:T.mode,cancellability:"checkpoint_only",safetyBackupId:_.safetyBackupId,progress:{phase:"queued",warnings:T.warnings}});if(!t.operationId){let R=this.queue.enqueue({projectId:E.projectId,resourceId:E.resourceId,actorId:_.actorId,kind:_.drill?"backup.drill":"backup.restore",input:{backupJobId:t.id},lockKey:E.dataServiceId?`data-service:${E.dataServiceId}`:E.resourceId?`resource:${E.resourceId}`:`recovery-point:${E.id}`,providerKey:"backup",maxAttempts:1,timeoutSeconds:14400,retryClasses:[],resumePolicy:"fail"});return this.store.updateJob(t.id,{operationId:R.operation.id})}return t}enqueueRetention(E=this.now()){return this.store.retentionCandidates(E).map((_)=>{let T=this.store.createJob({projectId:_.projectId,policyId:_.policyId,recoveryPointId:_.id,kind:"cleanup",status:"queued",idempotencyKey:`cleanup:${_.id}:${_.expiresAt}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!T.operationId){let r=this.queue.enqueue({projectId:_.projectId,resourceId:_.resourceId,kind:"backup.cleanup",input:{backupJobId:T.id},lockKey:`recovery-point:${_.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(T.id,{operationId:r.operation.id})}return T})}}function yQ(E){let _=E.now??(()=>new Date),T=new MA(E.store,E.queue,_),r=(h)=>{let N=h.recoveryPointId?E.store.getRecoveryPoint(h.recoveryPointId):void 0,S=h.policyId?E.store.getPolicy(h.policyId):N?.policyId?E.store.getPolicy(N.policyId):void 0;if(!S)throw Error("Backup policy was not found.");let A=E.store.getDestination(N?.destinationId??S.destinationId),L=E.resolveSource(S);if(!A)throw Error("Backup destination was not found.");if(!L)throw Error(`No ${S.resourceKind} backup adapter is configured.`);return{point:N,policy:S,destination:A,source:L}},d=(h)=>{let N=h.operation.input,S=E.store.getJob(String(N.backupJobId??""));if(!S)throw Error("Backup job was not found.");return E.store.updateJob(S.id,{status:"running",startedAt:S.startedAt??_().toISOString(),progress:{...S.progress,phase:"running"}}),S},t=(h,N)=>{let S=E.store.getJob(h.id)??h;E.store.updateJob(h.id,{status:"failed",finishedAt:_().toISOString(),error:N instanceof Error?N.message:String(N),progress:{...S.progress,phase:"failed"}})};return{"backup.run":async(h)=>{let N=d(h);try{let{policy:S,destination:A,source:L}=r(N),O=await L.create(S,h),c=E.resolveDestination(A),$=O.mode==="object"?await(async()=>{if(!c)throw Error("Backup destination adapter is not configured.");let z=E.store.getJob(N.id)?.progress,F=z?.multipart,B=F&&typeof F==="object"&&!Array.isArray(F)&&typeof F.uploadId==="string"&&typeof F.key==="string"&&Array.isArray(F.parts)?F:void 0;return c.upload(A,{key:O.key,body:O.body,contentType:O.contentType,resume:B,checkpoint:(y)=>{h.checkpoint("uploading",`Uploaded ${Number(y.bytesUploaded??0)} backup bytes.`),E.store.updateJob(N.id,{progress:{phase:"uploading",multipart:{...y}}})}})})():{uri:O.uri,key:O.uri,sizeBytes:O.sizeBytes,checksum:O.checksum,manifest:{format:"ts-cloud-backup-v1",encrypted:!1,plaintextChecksum:O.checksum,storageChecksum:O.checksum,contentType:"application/provider-snapshot"}},I=S.retention.expireAfterDays?new Date(_().getTime()+S.retention.expireAfterDays*86400000).toISOString():void 0,C=E.store.getJob(N.id)?.startedAt,e=E.store.createRecoveryPoint({projectId:S.projectId,policyId:S.id,destinationId:A.id,resourceId:S.resourceId,dataServiceId:S.dataServiceId,backupJobId:N.id,kind:S.resourceKind,pointInTime:_().toISOString(),uri:$.uri,sizeBytes:$.sizeBytes,checksum:$.checksum,manifest:{...O.manifest,...$.manifest,storageKey:$.key},toolVersion:O.toolVersion,engineVersion:O.engineVersion,expiresAt:I,lockedUntil:A.immutability.defaultRetentionDays?new Date(_().getTime()+A.immutability.defaultRetentionDays*86400000).toISOString():void 0,held:!1,pinned:!1,status:"available",verificationState:"unverified",durationMs:Math.max(0,_().getTime()-new Date(C??_().toISOString()).getTime())});if(O.mode==="external"&&A.provider==="aws_backup")E.store.recordDestinationTest(A.id,{ok:!0});return E.store.updateJob(N.id,{status:"succeeded",recoveryPointId:e.id,finishedAt:_().toISOString(),progress:{phase:"stored",recoveryPointId:e.id}}),T.enqueueVerification(e),{backupJobId:N.id,recoveryPointId:e.id}}catch(S){let A=E.store.getJob(N.id),L=A?.progress.multipart,O=(()=>{try{return r(N)}catch{return}})();if(O?.destination.provider==="aws_backup")E.store.recordDestinationTest(O.destination.id,{ok:!1,error:S instanceof Error?S.message:String(S)});let c=!1;if(L&&typeof L==="object"&&!Array.isArray(L)&&O){let $=E.resolveDestination(O.destination);if(c=!0,$?.abortPartial)try{await $.abortPartial(O.destination,L),c=!1,E.store.updateJob(N.id,{progress:{...A.progress,partialCleanup:"aborted"}})}catch{E.store.updateJob(N.id,{progress:{...A.progress,partialCleanup:"required"}})}}if(c)E.store.updateJob(N.id,{status:"cleanup_required",finishedAt:_().toISOString(),error:S instanceof Error?S.message:String(S),progress:{...E.store.getJob(N.id)?.progress??{},phase:"cleanup_required"}});else t(N,S);throw S}},"backup.verify":async(h)=>{let N=d(h);try{let{point:S,destination:A,source:L}=r(N);if(!S)throw Error("Recovery point was not found.");E.store.updateRecoveryPoint(S.id,{verificationState:"verifying"});let O;if(S.uri.startsWith("s3:")){let c=E.resolveDestination(A);if(!c)throw Error("Backup destination adapter is not configured.");let $=await c.download(A,{key:String(S.manifest.storageKey??""),checksum:S.checksum,manifest:S.manifest}),I=L.verify?await L.verify(S,$,h):{};O={bytes:$.length,checksum:S.checksum,...I}}else if(L.verifyExternal)O=await L.verifyExternal(S,h);else throw Error("External recovery point verification is not supported.");return E.store.updateRecoveryPoint(S.id,{verificationState:"verified",verifiedAt:_().toISOString(),manifest:{...S.manifest,verification:O}}),E.store.updateJob(N.id,{status:"succeeded",finishedAt:_().toISOString(),progress:{phase:"verified",evidence:O}}),{backupJobId:N.id,recoveryPointId:S.id,evidence:O}}catch(S){if(N.recoveryPointId)E.store.updateRecoveryPoint(N.recoveryPointId,{verificationState:/checksum|corrupt|authentic/i.test(S instanceof Error?S.message:String(S))?"corrupt":"failed"});throw t(N,S),S}},"backup.restore":async(h)=>R(h,!1),"backup.drill":async(h)=>R(h,!0),"backup.cleanup":async(h)=>{let N=d(h);try{let{point:S,destination:A,source:L}=r(N);if(!S)throw Error("Recovery point was not found.");if(!E.store.retentionCandidates(_()).some((O)=>O.id===S.id))throw Error("Recovery point is held, pinned, locked, or in active use.");if(E.store.updateRecoveryPoint(S.id,{status:"deleting"}),S.uri.startsWith("s3:")){let O=E.resolveDestination(A);if(!O)throw Error("Destination cleanup is unavailable.");await O.delete(A,String(S.manifest.storageKey??""))}else if(L.deleteExternal)await L.deleteExternal(S,h);else throw Error("External recovery point cleanup is unavailable.");return E.store.updateRecoveryPoint(S.id,{status:"deleted"}),E.store.updateJob(N.id,{status:"succeeded",finishedAt:_().toISOString(),progress:{phase:"deleted"}}),{backupJobId:N.id,recoveryPointId:S.id,deleted:!0}}catch(S){throw t(N,S),S}}};async function R(h,N){let S=d(h);try{let{point:A,policy:L,destination:O,source:c}=r(S);if(!A)throw Error("Recovery point was not found.");if(N&&!c.cleanup)throw Error("This backup source cannot safely clean a recovery drill target.");let $=A.uri.startsWith("s3:")?E.resolveDestination(O):void 0,I=$?await $.download(O,{key:String(A.manifest.storageKey??""),checksum:A.checksum,manifest:A.manifest}):void 0,C=await c.restore(A,I,S.target,h),e=c.validateHealth?await c.validateHealth({...S.target,...C},h):{healthy:!0,mode:"adapter"},z=E.validateHealth?await E.validateHealth(L,S.target):{healthy:!0,mode:"not_configured"},F={...e,healthy:e.healthy===!0&&z.healthy===!0,configured:z};if(F.healthy!==!0)throw Error("Restored target did not pass its configured health check.");if(N&&c.cleanup)await c.cleanup({...S.target,provider:A.manifest.provider??null},h);return E.store.updateJob(S.id,{status:"succeeded",finishedAt:_().toISOString(),healthResult:F,progress:{phase:N?"drill_cleaned":"restored",restored:C}}),{backupJobId:S.id,recoveryPointId:A.id,restored:C,health:F,cleaned:N}}catch(A){let L=(()=>{try{return r(S)}catch{return}})(),O=A instanceof Error?A.message:String(A),c=!1;if(N&&L?.source.cleanup)try{await L.source.cleanup({...S.target,provider:L.point?.manifest.provider??null},h)}catch{c=!0}if(c)E.store.updateJob(S.id,{status:"cleanup_required",finishedAt:_().toISOString(),error:O,progress:{...S.progress,phase:"cleanup_required"}});else t(S,A);throw A}}}ut();import{createHash as Xm}from"node:crypto";var Jm=(E)=>`sha256:${Xm("sha256").update(E).digest("hex")}`;class Dz{dataServices;client;constructor(E,_=new Mr){this.dataServices=E;this.client=_}service(E){let _=E.dataServiceId?this.dataServices.get(E.dataServiceId):void 0;if(!_||!["aws_rds","aws_aurora"].includes(_.provider))throw Error("Managed database backup policy requires an RDS or Aurora data service.");return _}async waitForSnapshot(E,_,T){for(;;){T.throwIfCancellationRequested?.(),T.heartbeat?.();let r=E==="aws_aurora"?(await this.client.describeDBClusterSnapshots({DBClusterSnapshotIdentifier:_})).DBClusterSnapshots[0]:(await this.client.describeDBSnapshots({DBSnapshotIdentifier:_})).DBSnapshots?.[0];if(!r)throw Error("Provider snapshot was not found.");let d=r,t=String(d.Status??d.DBSnapshotStatus??"unknown");if(T.checkpoint?.("provider_snapshot",`Database snapshot ${_} is ${t}.`),t==="available")return d;if(["deleted","deleting","failed"].includes(t))throw Error(`Provider snapshot ${_} failed with state ${t}.`);await Bun.sleep(5000)}}async create(E,_){let T=this.service(E),r=String(_.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,20),d=`${T.placement.slice(0,42).replace(/-+$/,"")}-${r}`;if(T.provider==="aws_aurora")await this.client.createDBClusterSnapshot(T.placement,d);else await this.client.createDBSnapshot({DBInstanceIdentifier:T.placement,DBSnapshotIdentifier:d});await this.waitForSnapshot(T.provider,d,_);let t=`${T.provider}:${T.placement}:${d}`;return{mode:"external",uri:`aws-backup:${t}`,checksum:Jm(t),sizeBytes:0,manifest:{provider:T.provider,sourceId:T.placement,snapshotId:d,plan:T.plan,engine:T.engine},engineVersion:T.engineVersion,toolVersion:"aws-rds-api-2014-10-31"}}async verifyExternal(E,_){let T=String(E.manifest.snapshotId??""),r=String(E.manifest.provider??"");if(!T)throw Error("Snapshot recovery point has no snapshot ID.");let d=await this.waitForSnapshot(r,T,_),t=String(d.Status??d.DBSnapshotStatus??"unknown");return{snapshotId:T,status:t,encrypted:d.Encrypted??d.StorageEncrypted??!0}}async restore(E,_,T,r){let d=String(T.targetId??""),t=String(E.manifest.snapshotId??""),R=String(E.manifest.provider??"");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(d))throw Error("Managed restore requires a valid distinct targetId.");if(d===E.manifest.sourceId)throw Error("Managed restore target must differ from its source.");if(R==="aws_aurora"){let h=E.manifest.engine==="postgres"?"aurora-postgresql":"aurora-mysql";await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:d,SnapshotIdentifier:t,Engine:h,EngineVersion:E.engineVersion,DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:Number(T.minCapacity)||0.5,MaxCapacity:Number(T.maxCapacity)||4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${d}-writer-1`,DBClusterIdentifier:d,DBInstanceClass:String(T.plan??E.manifest.plan??"db.serverless"),Engine:h,PubliclyAccessible:!1})}else await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:d,DBSnapshotIdentifier:t,DBInstanceClass:String(T.plan??E.manifest.plan??""),PubliclyAccessible:!1,DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud-restore"}]});return{targetId:d,provider:R,status:"creating",isolated:!0}}async validateHealth(E,_){let T=String(E.targetId??""),r=String(E.provider??"");for(;;){_.throwIfCancellationRequested?.(),_.heartbeat?.();let d=r==="aws_aurora"?(await this.client.describeDBClusters({DBClusterIdentifier:T})).DBClusters?.[0]:(await this.client.describeDBInstances({DBInstanceIdentifier:T})).DBInstances?.[0];if(!d)throw Error("Restored managed database was not found.");let t=String(d.Status??d.DBInstanceStatus??"unknown");if(_.checkpoint?.("provider_restore",`Restored database ${T} is ${t}.`),t==="available")return{healthy:!0,targetId:T,provider:r,status:t};if(["deleted","deleting","failed","incompatible-restore"].includes(t))throw Error(`Restored managed database ${T} failed with state ${t}.`);await Bun.sleep(5000)}}async cleanup(E,_){let T=String(E.targetId??""),r=String(E.provider??"");if(!T)throw Error("Restore cleanup target is required.");if(r==="aws_aurora")await this.client.deleteDBInstance({DBInstanceIdentifier:`${T}-writer-1`,SkipFinalSnapshot:!0}),await this.client.modifyDBCluster({DBClusterIdentifier:T,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(T);else await this.client.modifyDBInstance({DBInstanceIdentifier:T,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:T,SkipFinalSnapshot:!0,DeleteAutomatedBackups:!0})}async deleteExternal(E,_){let T=String(E.manifest.snapshotId??"");if(E.manifest.provider==="aws_aurora")await this.client.deleteDBClusterSnapshot(T);else await this.client.deleteDBSnapshot(T)}}await aE();import{existsSync as yO}from"node:fs";import{mkdir as yD,readdir as zm,rename as Iz,rm as fA}from"node:fs/promises";import{relative as Fm,resolve as sT,sep as YD}from"node:path";function FN(E,_){if(_==="gzip")return Buffer.from(Bun.gzipSync(Uint8Array.from(E)));if(_==="zstd")return Buffer.from(Bun.zstdCompressSync(Uint8Array.from(E)));return Buffer.from(E)}function SR(E,_){if(_==="gzip")return Buffer.from(Bun.gunzipSync(Uint8Array.from(E)));if(_==="zstd")return Buffer.from(Bun.zstdDecompressSync(Uint8Array.from(E)));return Buffer.from(E)}async function Cz(E,_){let T=Bun.spawn(["tar",...E],{stdin:_?Buffer.from(_):void 0,stdout:"pipe",stderr:"pipe"}),[r,d,t]=await Promise.all([T.exited,new Response(T.stdout).arrayBuffer(),new Response(T.stderr).text()]);if(r!==0)throw Error(t.trim()||`tar exited with status ${r}.`);return{stdout:Buffer.from(d),stderr:t}}function jm(E){let _=E.replaceAll("\\","/").replace(/^\.\//,"");return!!_&&!_.startsWith("/")&&!_.split("/").includes("..")}class QQ{async create(E,_,T){return(await Cz(["-C",E,"-cf","-",...T.map((d)=>`--exclude=${d}`),"--",..._])).stdout}async extract(E,_){await yD(_,{recursive:!0,mode:448}),await Cz(["-C",_,"-xf","-"],E)}async inspect(E){let _=await Cz(["-tf","-"],E),T=_.stdout.toString().split(`
+`).filter(Boolean);if(T.some((r)=>!jm(r)))throw Error("Backup archive contains an unsafe path.");return{entries:T,bytes:E.byteLength}}}function YQ(E,_){if(!_.trim())throw Error("File backup paths cannot be empty.");let T=sT(E,_),r=Fm(E,T);if(r===".."||r.startsWith(`..${YD}`)||r==="")throw Error(`File backup path ${_} is outside the project root.`);return r}function PD(E){let _=String(E.targetId??E.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(_))throw Error("File restores require a safe target name.");return _}class wz{runtime;root;restoreRoot;constructor(E,_=new QQ,T=f_(E,"restores","files")){this.runtime=_;this.root=sT(E),this.restoreRoot=sT(T)}paths(E){let _=[...new Set(E.includePatterns.map((T)=>YQ(this.root,T)))];if(!_.length)throw Error("File backup policies require at least one project-relative path.");for(let T of _)if(!yO(sT(this.root,T)))throw Error(`File backup path ${T} was not found.`);return _.filter((T)=>!_.some((r)=>r!==T&&T.startsWith(`${r}${YD}`)))}async create(E,_){let T=this.paths(E),r=await this.runtime.create(this.root,T,E.excludePatterns),d=await this.runtime.inspect(r),t=E.compression??"none",R=FN(r,t),h=String(_.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${E.projectId}/files/${h}.tar${t==="none"?"":t==="gzip"?".gz":".zst"}`,body:R,contentType:t==="gzip"?"application/gzip":t==="zstd"?"application/zstd":"application/x-tar",manifest:{archive:"tar",compression:t,sourcePaths:T,excluded:E.excludePatterns,entries:d.entries.length},toolVersion:"system-tar"}}async restore(E,_,T,r){if(!_)throw Error("File restore requires an archive payload.");let d=SR(_,String(E.manifest.compression??"none"));if(await this.runtime.inspect(d),T.restoreMode==="in_place"){let R=sT(this.restoreRoot,`.staging-${PD(T)}`),h=sT(this.restoreRoot,`.rollback-${PD(T)}`),N=Array.isArray(E.manifest.sourcePaths)?E.manifest.sourcePaths.map(String):[];if(!N.length)throw Error("File recovery point has no source path manifest.");await fA(R,{recursive:!0,force:!0}),await fA(h,{recursive:!0,force:!0}),await this.runtime.extract(d,R),await yD(h,{recursive:!0,mode:448});let S=[];try{for(let A of N){let L=sT(this.root,YQ(this.root,A)),O=sT(R,A),c=sT(h,A);if(await yD(sT(c,".."),{recursive:!0}),yO(L))await Iz(L,c);await yD(sT(L,".."),{recursive:!0}),await Iz(O,L),S.push(A)}}catch(A){for(let L of S.reverse()){let O=sT(this.root,L),c=sT(h,L);if(await fA(O,{recursive:!0,force:!0}),yO(c))await Iz(c,O)}throw A}finally{await fA(R,{recursive:!0,force:!0})}return await fA(h,{recursive:!0,force:!0}),{path:this.root,restoredPaths:N,inPlace:!0}}let t=sT(this.restoreRoot,PD(T));if(yO(t))throw Error("The isolated file restore target already exists.");return await this.runtime.extract(d,t),{path:t,isolated:!0}}async verify(E,_,T){let r=SR(_,String(E.manifest.compression??"none")),d=await this.runtime.inspect(r);return{archive:"tar",entries:d.entries.length,uncompressedBytes:d.bytes}}async validateHealth(E,_){let T=String(E.path??"");if(!T||!T.startsWith(`${this.restoreRoot}${YD}`)||!yO(T))throw Error("Isolated file restore target was not found.");let r=await zm(T);return{healthy:!0,path:T,topLevelEntries:r.length}}async cleanup(E,_){let T=PD(E),r=sT(this.restoreRoot,T);if(!r.startsWith(`${this.restoreRoot}${YD}`))throw Error("Refusing to clean a file restore outside the restore root.");await fA(r,{recursive:!0,force:!0})}}class ez{services;secrets;transport;constructor(E,_,T=new nt){this.services=E;this.secrets=_;this.transport=T}async create(E,_){if(!E.dataServiceId)throw Error("Logical database backups require a data service.");let T=this.services.get(E.dataServiceId);if(!T)throw Error("Logical database service was not found.");if(!["container","server"].includes(T.provider))throw Error("Logical database backups require an on-box data service.");let r=await this.transport.exportLogicalBackup(T.id),d=E.compression??"none",t=FN(r.body,d),R=String(_.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${E.projectId}/databases/${T.id}/${R}.sql${d==="none"?"":d==="gzip"?".gz":".zst"}`,body:t,contentType:d==="gzip"?"application/gzip":d==="zstd"?"application/zstd":"application/sql",engineVersion:r.engineVersion,toolVersion:"engine-native",manifest:{format:"logical-sql-v1",sourceDataServiceId:T.id,engine:r.engine,database:r.database,username:r.username,compression:d}}}async restore(E,_,T,r){if(!_)throw Error("Logical database backup body is unavailable.");let d=String(E.dataServiceId??E.manifest.sourceDataServiceId??""),t=String(T.dataServiceId??T.targetId??""),R=T.inPlace===!0;if(!d||!t)throw Error("Logical database restore requires source and target identifiers.");if(R&&t!==d)throw Error("An in-place restore must target the source data service.");let h=this.services.get(d);if(!h?.credentialRef)throw Error("Logical database credential reference was not found.");let N=await this.secrets.resolve(h.credentialRef);return this.transport.restoreLogicalBackup({sourceId:d,targetId:t,body:SR(_,String(E.manifest.compression??"none")),credential:N,inPlace:R})}async cleanup(E,_){if(E.inPlace===!0)throw Error("In-place database restores cannot be cleaned as drills.");let T=String(E.dataServiceId??E.targetId??"");if(!T)throw Error("Database cleanup requires a target identifier.");await this.transport.removeRestoredService(T)}}var Xz=/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/;async function jN(E,_,T=!1){let r=Bun.spawn(["docker",...E],{stdin:_?"pipe":"ignore",stdout:"pipe",stderr:"pipe"}),d=new Response(r.stdout).arrayBuffer(),t=new Response(r.stderr).text();if(_)r.stdin.write(_),r.stdin.end();let[R,h,N]=await Promise.all([r.exited,d,t]);if(R!==0&&!T)throw Error(`Docker volume command failed (${R}): ${N.trim()}`);return{code:R,stdout:Buffer.from(h),stderr:N}}class GQ{async exists(E){return(await jN(["volume","inspect",E],void 0,!0)).code===0}async export(E){return(await jN(["run","--rm","-v",`${E}:/source:ro`,"alpine:3.21","tar","-C","/source","-czf","-","."])).stdout}async import(E,_,T=!1){if(!await this.exists(E))await jN(["volume","create",E]);try{if(T)await jN(["run","--rm","-v",`${E}:/target`,"alpine:3.21","sh","-c","find /target -mindepth 1 -delete"]);await jN(["run","--rm","-i","-v",`${E}:/target`,"alpine:3.21","tar","-C","/target","--no-same-owner","-xzf","-"],_)}catch(r){throw await this.remove(E),r}}async remove(E){await jN(["volume","rm",E],void 0,!0)}async probe(E){let _=(await jN(["run","--rm","-v",`${E}:/target:ro`,"alpine:3.21","sh","-c",`find /target -mindepth 1 -printf '%s\\n' | awk '{n+=1;b+=$1} END {print n ":" b}'`])).stdout.toString(),[T,r]=_.trim().split(":").map(Number);if(!Number.isFinite(T)||!Number.isFinite(r))throw Error("Restored volume health probe returned invalid output.");return{entries:T,bytes:r}}}class Jz{runtime;constructor(E=new GQ){this.runtime=E}async create(E,_){let T=String(E.includePatterns?.[0]??E.resourceId??"");if(!Xz.test(T))throw Error("Volume backups require a valid named-volume resource identifier.");if(!await this.runtime.exists(T))throw Error(`Volume ${T} was not found.`);let r=await this.runtime.export(T),d=Buffer.from(Bun.gunzipSync(Uint8Array.from(r))),t=E.compression??"gzip",R=t==="gzip"?r:FN(d,t),h=String(_.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${E.projectId}/volumes/${T}/${h}.tar${t==="none"?"":t==="gzip"?".gz":".zst"}`,body:R,contentType:t==="gzip"?"application/gzip":t==="zstd"?"application/zstd":"application/x-tar",toolVersion:"alpine-tar",manifest:{format:"docker-volume-tar-v1",archive:"tar",compression:t,sourceVolume:T}}}async restore(E,_,T,r){if(!_)throw Error("Volume backup body is unavailable.");let d=String(E.manifest.sourceVolume??E.resourceId??""),t=String(T.volumeName??T.targetId??"");if(!Xz.test(t))throw Error("Volume restore requires a valid target volume name.");if(t===d&&T.inPlace!==!0)throw Error("An isolated volume restore requires a distinct target.");let R=await this.runtime.exists(t);if(!T.inPlace&&R)throw Error(`Restore target volume ${t} already exists.`);if(T.inPlace===!0&&t!==d)throw Error("An in-place volume restore must target the source volume.");if(T.inPlace===!0&&!R)throw Error("The in-place target volume was not found.");let h=String(E.manifest.compression??"gzip"),N=h==="gzip"?Buffer.from(_):Buffer.from(Bun.gzipSync(Uint8Array.from(SR(_,h))));await this.runtime.import(t,N,T.inPlace===!0);let S=await this.runtime.probe(t);return{volumeName:t,healthy:!0,...S}}async cleanup(E,_){if(E.inPlace===!0)throw Error("In-place volume restores cannot be cleaned as drills.");let T=String(E.volumeName??E.targetId??"");if(!Xz.test(T))throw Error("Volume cleanup requires a valid target volume name.");await this.runtime.remove(T)}}await aE();import{existsSync as zz}from"node:fs";import{mkdir as Bm,readFile as MQ,rm as Wm,writeFile as fQ}from"node:fs/promises";import{basename as gQ,resolve as Dh,sep as KQ}from"node:path";import{Database as Hm}from"bun:sqlite";function VQ(E){let _=String(E.targetId??E.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(_))throw Error("Control-plane restores require a safe target name.");return _}function ZQ(E){let _=JSON.parse(Buffer.from(E).toString());if(_.format!=="ts-cloud-control-plane-v1"||!_.database)throw Error("Control-plane backup archive is invalid.");if(!Array.isArray(_.config)||_.config.some((T)=>gQ(T.name)!==T.name))throw Error("Control-plane backup contains an unsafe config path.");return _}function qQ(E){let _=Hm.deserialize(Uint8Array.from(E));try{let T=_.query("PRAGMA integrity_check").get()?.integrity_check??"unknown",r=_.query("SELECT count(*) AS count FROM sqlite_master WHERE type='table'").get()?.count??0;if(T!=="ok")throw Error(`Restored control-plane integrity check failed: ${T}.`);return{integrity:T,tables:r}}finally{_.close()}}class Fz{controlPlane;root;restoreRoot;constructor(E,_,T=f_(_,"restores","control-plane")){this.controlPlane=E;this.root=Dh(_),this.restoreRoot=Dh(T)}async create(E,_){let T=E.includePatterns.length?E.includePatterns:["cloud.config.ts"],r=[];for(let N of T){let S=gQ(N),A=Dh(this.root,S);if(S!==N&&N!==`./${S}`)throw Error("Control-plane config paths must be project-root files.");if(zz(A))r.push({name:S,body:(await MQ(A)).toString("base64")})}let d={format:"ts-cloud-control-plane-v1",createdAt:new Date().toISOString(),database:Buffer.from(this.controlPlane.database.serialize()).toString("base64"),config:r},t=E.compression??"none",R=FN(Buffer.from(JSON.stringify(d)),t),h=String(_.operation?.id??d.createdAt).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${E.projectId}/control-plane/${h}.json${t==="none"?"":t==="gzip"?".gz":".zst"}`,body:R,contentType:t==="gzip"?"application/gzip":t==="zstd"?"application/zstd":"application/vnd.ts-cloud.control-plane+json",manifest:{format:d.format,configFiles:r.map((N)=>N.name),sensitive:!0,compression:t},toolVersion:"bun-sqlite-serialize"}}async restore(E,_,T,r){if(!_)throw Error("Control-plane restore requires an archive payload.");if(T.restoreMode==="in_place")throw Error("A live control plane can only be restored into an isolated recovery target.");let d=ZQ(SR(_,String(E.manifest.compression??"none"))),t=Dh(this.restoreRoot,VQ(T));if(zz(t))throw Error("The isolated control-plane restore target already exists.");await Bm(t,{recursive:!0,mode:448}),await fQ(Dh(t,"control-plane.sqlite"),Buffer.from(d.database,"base64"),{mode:384});for(let R of d.config)await fQ(Dh(t,R.name),Buffer.from(R.body,"base64"),{mode:384});return{path:t,isolated:!0,configFiles:d.config.length}}async verify(E,_,T){let r=ZQ(SR(_,String(E.manifest.compression??"none")));return{...qQ(Buffer.from(r.database,"base64")),configFiles:r.config.length}}async validateHealth(E,_){let T=String(E.path??""),r=Dh(T,"control-plane.sqlite");if(!T.startsWith(`${this.restoreRoot}${KQ}`)||!zz(r))throw Error("Isolated control-plane database was not found.");return{healthy:!0,...qQ(await MQ(r))}}async cleanup(E,_){let T=Dh(this.restoreRoot,VQ(E));if(!T.startsWith(`${this.restoreRoot}${KQ}`))throw Error("Refusing to clean a control-plane restore outside the restore root.");await Wm(T,{recursive:!0,force:!0})}}import{createHash as Pm}from"node:crypto";function jz(E,_){return E.find((T)=>T.startsWith(`${_}:`))?.slice(_.length+1)}function ym(E){let _=jz(E.includePatterns,"resource")??E.includePatterns.find((d)=>d.startsWith("arn:")),T=jz(E.includePatterns,"role"),r=jz(E.includePatterns,"vault")??"Default";if(!_?.startsWith("arn:"))throw Error("Infrastructure backups require resource:<arn> in include patterns.");if(!T?.startsWith("arn:"))throw Error("Infrastructure backups require role:<iam-role-arn> in include patterns.");if(!/^[A-Za-z0-9_.-]{2,50}$/.test(r))throw Error("Infrastructure backup vault name is invalid.");return{resourceArn:_,roleArn:T,vaultName:r}}async function Ym(E,_,T){for(;;){T.throwIfCancellationRequested(),T.heartbeat();let r=await E.describeBackupJob(_),d=String(r.State??"");if(T.checkpoint("provider_backup",`AWS Backup job ${_} is ${d||"pending"}.`),d==="COMPLETED"&&r.RecoveryPointArn)return{recoveryPointArn:r.RecoveryPointArn,sizeBytes:Number(r.BackupSizeInBytes??0)};if(["ABORTED","EXPIRED","FAILED"].includes(d))throw Error(`AWS Backup job ${_} failed: ${r.StatusMessage??d}.`);await Bun.sleep(5000)}}async function Qm(E,_,T){for(;;){T.throwIfCancellationRequested(),T.heartbeat();let r=await E.describeRestoreJob(_),d=String(r.Status??"");if(T.checkpoint("provider_restore",`AWS Backup restore ${_} is ${d||"pending"}.`),d==="COMPLETED"&&r.CreatedResourceArn)return r.CreatedResourceArn;if(["ABORTED","FAILED"].includes(d))throw Error(`AWS Backup restore ${_} failed: ${r.StatusMessage??d}.`);await Bun.sleep(5000)}}class Bz{client;constructor(E=new jO){this.client=E}async create(E,_){let T=ym(E),r=String(_.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64),d=await this.client.startBackupJob({BackupVaultName:T.vaultName,ResourceArn:T.resourceArn,IamRoleArn:T.roleArn,IdempotencyToken:r}),t=await Ym(this.client,d.BackupJobId,_),R=`sha256:${Pm("sha256").update(t.recoveryPointArn).digest("hex")}`;return{mode:"external",uri:t.recoveryPointArn,checksum:R,sizeBytes:t.sizeBytes,toolVersion:"aws-backup-api",manifest:{provider:"aws_backup",resourceArn:T.resourceArn,roleArn:T.roleArn,vaultName:T.vaultName,providerBackupJobId:d.BackupJobId,recoveryPointArn:t.recoveryPointArn}}}async verifyExternal(E,_){let T=String(E.manifest.providerBackupJobId??""),r=await this.client.describeBackupJob(T);if(r.State!=="COMPLETED"||r.RecoveryPointArn!==E.uri)throw Error(`AWS Backup recovery point verification failed: ${r.StatusMessage??r.State??"unknown"}.`);return{state:r.State,recoveryPointArn:r.RecoveryPointArn,sizeBytes:Number(r.BackupSizeInBytes??E.sizeBytes)}}async restore(E,_,T,r){if(T.inPlace===!0)throw Error("AWS Backup infrastructure restores must create isolated resources.");let d=String(T.roleArn??E.manifest.roleArn??""),t=T.metadata&&typeof T.metadata==="object"&&!Array.isArray(T.metadata)?Object.fromEntries(Object.entries(T.metadata).map(([N,S])=>[N,String(S)])):{};if(!d.startsWith("arn:"))throw Error("AWS Backup restore requires an IAM role ARN.");if(!Object.keys(t).length)throw Error("AWS Backup restore requires provider restore metadata.");let R=await this.client.startRestoreJob({RecoveryPointArn:E.uri,IamRoleArn:d,Metadata:t,IdempotencyToken:String(r.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64)}),h=await Qm(this.client,R.RestoreJobId,r);return{providerRestoreJobId:R.RestoreJobId,createdResourceArn:h,isolated:!0,healthy:!0}}async validateHealth(E,_){let T=String(E.createdResourceArn??"");return{healthy:T.startsWith("arn:"),createdResourceArn:T}}async deleteExternal(E,_){await this.client.deleteRecoveryPoint(String(E.manifest.vaultName??""),E.uri)}}await bd([ML(),tT()]);function At(E,_,T){return[E,_,T].map((r)=>encodeURIComponent(r)).join(":")}function Gm(E){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((_)=>[_,{supported:!1,reason:E}]))}function BN(E,_,T=["exec","files"]){let r=Gm(_);for(let d of E)r[d]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(d),requiresRecentAuth:T.includes(d)};return r}var Mm=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function LR(E){let _=String(E??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(_))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(_))return"starting";if(["deactivating","stopping","draining","terminating"].includes(_))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(_))return"stopped";if(["degraded","unhealthy","warning"].includes(_))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(_))return"failed";return"unknown"}function AR(E){if(Array.isArray(E))return E.map((T)=>AR(T));if(!E||typeof E!=="object")return E;let _={};for(let[T,r]of Object.entries(E))_[T]=Mm.test(T)?"[REDACTED]":AR(r);return _}function WN(E,_=new Date){if(!E)return;let T=new Date(E).getTime();return Number.isFinite(T)?Math.max(0,Math.floor((_.getTime()-T)/1000)):void 0}function xQ(E){let _=Number(E);return Number.isFinite(_)&&_>=0?_:void 0}function fm(E){let _=String(E?.message??E);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(_))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(_))return"unreachable";return"error"}async function bQ(E,_={},T={}){let r=_.now??new Date,d=Math.max(100,T.timeoutMs??1e4),t=Math.max(1,T.staleAfterSeconds??60),R=await Promise.all(E.map(async(N)=>{try{let S=await Promise.race([N.discover({..._,now:r}),new Promise((A,L)=>setTimeout(()=>L(Error(`Runtime source ${N.id} timed out after ${d}ms`)),d))]);return{workloads:S,source:{id:N.id,provider:N.provider,status:"fresh",discoveredAt:r.toISOString(),staleAfterSeconds:t,itemCount:S.length}}}catch(S){return{workloads:[],source:{id:N.id,provider:N.provider,status:fm(S),discoveredAt:r.toISOString(),staleAfterSeconds:t,itemCount:0,message:String(S?.message??S).slice(0,500)}}}})),h=R.map((N)=>N.source);return{generatedAt:r.toISOString(),workloads:R.flatMap((N)=>N.workloads).sort((N,S)=>N.name.localeCompare(S.name)||N.id.localeCompare(S.id)),sources:h,degraded:h.some((N)=>N.status!=="fresh")}}await aE();VE();z_();function Km(E,_){if(!_)return E;return E.startsWith(_)?E.slice(_.length):E}function Wz(E,_,T){let r=Km(E,_);return`${T??""}${r}`}function Hz(E,_,T){if(T&&T.some((r)=>E.startsWith(r)))return!1;if(_&&_.length>0)return _.some((r)=>E.startsWith(r));return!0}async function Vm(E,_,T){let r=0,d=[],t=Math.max(1,Math.min(_,E.length||1));for(let R=0;R<t;R++)d.push((async()=>{while(!0){let h=r++;if(h>=E.length)return;await T(E[h],h)}})());await Promise.all(d)}function kQ(E){if(E.client)return E.client;return yz({provider:E.provider,region:E.region,endpoint:E.endpoint,forcePathStyle:E.forcePathStyle,credentials:E.credentials})}async function Pz(E){let _=E.concurrency??8,T=kQ(E.from),r=kQ(E.to),d=await T.listAllObjects({bucket:E.from.bucket,prefix:E.from.prefix}),t={copied:0,skipped:0,excluded:0,bytesCopied:0,errors:[],excludedKeys:[],deleted:[]},R=[];for(let A of d){if(!Hz(A.Key,E.include,E.exclude)){t.excluded++,t.excludedKeys.push(A.Key);continue}R.push({source:A,destKey:Wz(A.Key,E.from.prefix,E.to.prefix)})}if(E.dryRun){t.plan=R.map(({source:O,destKey:c})=>({key:O.Key,destKey:c,size:O.Size}));let A=d.length,L=0;for(let O of d){L++;let c=!Hz(O.Key,E.include,E.exclude);E.onProgress?.({key:O.Key,destKey:c?"":Wz(O.Key,E.from.prefix,E.to.prefix),size:O.Size,action:c?"excluded":"planned",index:L,total:A})}return t}let h=R.length,N=0;await Vm(R,_,async({source:A,destKey:L})=>{let O=++N;try{if(!E.force){let I=await r.headObject(E.to.bucket,L);if(I&&I.ContentLength===A.Size){t.skipped++,E.onProgress?.({key:A.Key,destKey:L,size:A.Size,action:"skipped",index:O,total:h});return}}let{body:c,contentType:$}=await T.getObjectBytes(E.from.bucket,A.Key);await r.putObject({bucket:E.to.bucket,key:L,body:c,contentType:$}),t.copied++,t.bytesCopied+=c.byteLength,E.onProgress?.({key:A.Key,destKey:L,size:A.Size,action:"copied",index:O,total:h})}catch(c){t.errors.push({key:A.Key,message:c?.message??String(c)}),E.onProgress?.({key:A.Key,destKey:L,size:A.Size,action:"error",index:O,total:h})}});let S=new Set(R.map((A)=>A.destKey));if(E.deleteExtraneous){let L=(await r.listAllObjects({bucket:E.to.bucket,prefix:E.to.prefix})).filter((O)=>!S.has(O.Key)).map((O)=>O.Key);for(let O of L)try{await r.deleteObject(E.to.bucket,O),t.deleted.push(O)}catch(c){t.errors.push({key:O,message:`delete failed: ${c?.message??String(c)}`})}}if(E.verify){let A=await r.listAllObjects({bucket:E.to.bucket,prefix:E.to.prefix}),L=new Map(A.map((I)=>[I.Key,I.Size])),O=[],c=[],$=0;for(let{source:I,destKey:C}of R){if(!L.has(C)){O.push(C);continue}let e=L.get(C);if(e!==I.Size){c.push({key:C,expected:I.Size,actual:e});continue}$++}t.verification={ok:O.length===0&&c.length===0,matched:$,missing:O,sizeMismatches:c}}return t}var Zm={aws:"us-east-1",backblaze:"us-west-004",hetzner:"fsn1"};function uQ(E,_){switch(E){case"backblaze":return`s3.${_}.backblazeb2.com`;case"hetzner":return`${_}.your-objectstorage.com`;case"aws":default:return}}function qr(...E){for(let _ of E){let T=process.env[_];if(T)return T}return}function qm(E,_){if(_?.accessKeyId&&_.secretAccessKey)return _;let T,r;if(E==="backblaze")T=qr("B2_APPLICATION_KEY_ID","B2_KEY_ID","S3_ACCESS_KEY_ID","AWS_ACCESS_KEY_ID"),r=qr("B2_APPLICATION_KEY","B2_SECRET_KEY","S3_SECRET_ACCESS_KEY","AWS_SECRET_ACCESS_KEY");else if(E==="hetzner")T=qr("HETZNER_S3_ACCESS_KEY","HETZNER_ACCESS_KEY","S3_ACCESS_KEY_ID","AWS_ACCESS_KEY_ID"),r=qr("HETZNER_S3_SECRET_KEY","HETZNER_SECRET_KEY","S3_SECRET_ACCESS_KEY","AWS_SECRET_ACCESS_KEY");else T=qr("S3_ACCESS_KEY_ID"),r=qr("S3_SECRET_ACCESS_KEY");if(T&&r)return{accessKeyId:T,secretAccessKey:r,sessionToken:qr("AWS_SESSION_TOKEN")};return}function vQ(E={}){let _=E.provider||qr("OBJECT_STORAGE_PROVIDER","STORAGE_PROVIDER")||"aws",T=E.region||(_==="backblaze"?qr("B2_REGION"):void 0)||(_==="hetzner"?qr("HETZNER_S3_REGION","HETZNER_REGION"):void 0)||qr("S3_REGION","AWS_REGION","AWS_DEFAULT_REGION")||Zm[_],r=E.endpoint||qr("S3_ENDPOINT")||uQ(_,T),d=E.forcePathStyle??qr("S3_FORCE_PATH_STYLE")==="true",t=qm(_,E.credentials),R=(h)=>{let N=r||`s3.${T}.amazonaws.com`;return d?`https://${N}/${h}`:`https://${h}.${N}`};return{provider:_,region:T,endpoint:r,forcePathStyle:d,credentials:t,profile:E.profile,publicBaseUrl:R}}function yz(E={}){let _=vQ(E),T={endpoint:_.endpoint,forcePathStyle:_.forcePathStyle,credentials:_.credentials};return new xE(_.region,_.profile,T)}KT();f0();a0();z_();Vr();Bh();VE();Mt();Y0();eN();PL();Kh();_L();uN();VE();class Fr{client;region;constructor(E="us-east-1"){this.region=E,this.client=new JE}buildFormBody(E){return Object.entries(E).filter(([,T])=>T!==void 0).map(([T,r])=>`${encodeURIComponent(T)}=${encodeURIComponent(r)}`).join("&")}async createTopic(E){let _={Action:"CreateTopic",Version:"2010-03-31",Name:E.Name};if(E.DisplayName)_["Attributes.entry.1.key"]="DisplayName",_["Attributes.entry.1.value"]=E.DisplayName;if(E.Tags)E.Tags.forEach((r,d)=>{_[`Tags.member.${d+1}.Key`]=r.Key,_[`Tags.member.${d+1}.Value`]=r.Value});if(E.Attributes){let r=E.DisplayName?2:1;Object.entries(E.Attributes).forEach(([d,t])=>{_[`Attributes.entry.${r}.key`]=d,_[`Attributes.entry.${r}.value`]=t,r++})}let T=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)});return{TopicArn:T?.CreateTopicResponse?.CreateTopicResult?.TopicArn||T?.TopicArn}}async deleteTopic(E){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteTopic",Version:"2010-03-31",TopicArn:E})})}async listTopics(E){let _={Action:"ListTopics",Version:"2010-03-31"};if(E)_.NextToken=E;let T=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)}),r=T?.ListTopicsResponse?.ListTopicsResult||T?.ListTopicsResult,d=r?.Topics?.member;return{Topics:Array.isArray(d)?d:d?[d]:[],NextToken:r?.NextToken}}async getTopicAttributes(E){let T=(await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetTopicAttributes",Version:"2010-03-31",TopicArn:E})}))?.GetTopicAttributesResponse?.GetTopicAttributesResult?.Attributes?.entry,r={TopicArn:E};if(Array.isArray(T))T.forEach((d)=>{r[d.key]=d.value});return r}async setTopicAttributes(E){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetTopicAttributes",Version:"2010-03-31",TopicArn:E.TopicArn,AttributeName:E.AttributeName,AttributeValue:E.AttributeValue})})}async subscribe(E){let _={Action:"Subscribe",Version:"2010-03-31",TopicArn:E.TopicArn,Protocol:E.Protocol,Endpoint:E.Endpoint};if(E.ReturnSubscriptionArn)_.ReturnSubscriptionArn="true";if(E.Attributes){let r=1;Object.entries(E.Attributes).forEach(([d,t])=>{_[`Attributes.entry.${r}.key`]=d,_[`Attributes.entry.${r}.value`]=t,r++})}let T=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)});return{SubscriptionArn:T?.SubscribeResponse?.SubscribeResult?.SubscriptionArn||T?.SubscriptionArn}}async unsubscribe(E){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"Unsubscribe",Version:"2010-03-31",SubscriptionArn:E})})}async listSubscriptionsByTopic(E,_){let T={Action:"ListSubscriptionsByTopic",Version:"2010-03-31",TopicArn:E};if(_)T.NextToken=_;let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(T)}),d=r?.ListSubscriptionsByTopicResponse?.ListSubscriptionsByTopicResult?.Subscriptions?.member;return{Subscriptions:Array.isArray(d)?d:d?[d]:[],NextToken:r?.ListSubscriptionsByTopicResponse?.ListSubscriptionsByTopicResult?.NextToken}}async publish(E){let _={Action:"Publish",Version:"2010-03-31",Message:E.Message};if(E.TopicArn)_.TopicArn=E.TopicArn;if(E.TargetArn)_.TargetArn=E.TargetArn;if(E.PhoneNumber)_.PhoneNumber=E.PhoneNumber;if(E.Subject)_.Subject=E.Subject;if(E.MessageStructure)_.MessageStructure=E.MessageStructure;if(E.MessageAttributes){let r=1;Object.entries(E.MessageAttributes).forEach(([d,t])=>{if(_[`MessageAttributes.entry.${r}.Name`]=d,_[`MessageAttributes.entry.${r}.Value.DataType`]=t.DataType,t.StringValue)_[`MessageAttributes.entry.${r}.Value.StringValue`]=t.StringValue;if(t.BinaryValue)_[`MessageAttributes.entry.${r}.Value.BinaryValue`]=t.BinaryValue;r++})}let T=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)});return{MessageId:T?.PublishResponse?.PublishResult?.MessageId||T?.MessageId}}async publishSMS(E,_,T){let r={};if(T)r["AWS.SNS.SMS.SenderID"]={DataType:"String",StringValue:T};return this.publish({PhoneNumber:E,Message:_,MessageAttributes:Object.keys(r).length>0?r:void 0})}async subscribeEmail(E,_){return this.subscribe({TopicArn:E,Protocol:"email",Endpoint:_})}async subscribeLambda(E,_){return this.subscribe({TopicArn:E,Protocol:"lambda",Endpoint:_})}async subscribeSqs(E,_,T){let r={};if(T)r.RawMessageDelivery="true";return this.subscribe({TopicArn:E,Protocol:"sqs",Endpoint:_,Attributes:Object.keys(r).length>0?r:void 0})}async subscribeHttp(E,_,T){let r=_.startsWith("https")?"https":"http",d={};if(T)d.RawMessageDelivery="true";return this.subscribe({TopicArn:E,Protocol:r,Endpoint:_,Attributes:Object.keys(d).length>0?d:void 0})}async subscribeSms(E,_){return this.subscribe({TopicArn:E,Protocol:"sms",Endpoint:_})}async topicExists(E){try{return await this.getTopicAttributes(E),!0}catch(_){if(_.code==="NotFound"||_.statusCode===404)return!1;throw _}}async getSMSAttributes(){let _=(await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetSMSAttributes",Version:"2010-03-31"})}))?.GetSMSAttributesResponse?.GetSMSAttributesResult?.attributes?.entry,T={};if(Array.isArray(_))_.forEach((r)=>{T[r.key]=r.value});else if(_)T[_.key]=_.value;return T}async setSMSAttributes(E){let _={Action:"SetSMSAttributes",Version:"2010-03-31"},T=1;Object.entries(E).forEach(([r,d])=>{if(d!==void 0)_[`attributes.entry.${T}.key`]=r,_[`attributes.entry.${T}.value`]=d,T++}),await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)})}async checkIfPhoneNumberIsOptedOut(E){return(await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CheckIfPhoneNumberIsOptedOut",Version:"2010-03-31",phoneNumber:E})}))?.CheckIfPhoneNumberIsOptedOutResponse?.CheckIfPhoneNumberIsOptedOutResult?.isOptedOut==="true"}async listPhoneNumbersOptedOut(E){let _={Action:"ListPhoneNumbersOptedOut",Version:"2010-03-31"};if(E)_.nextToken=E;let T=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)}),r=T?.ListPhoneNumbersOptedOutResponse?.ListPhoneNumbersOptedOutResult?.phoneNumbers?.member;return{phoneNumbers:Array.isArray(r)?r:r?[r]:[],nextToken:T?.ListPhoneNumbersOptedOutResponse?.ListPhoneNumbersOptedOutResult?.nextToken}}async optInPhoneNumber(E){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"OptInPhoneNumber",Version:"2010-03-31",phoneNumber:E})})}async listSMSSandboxPhoneNumbers(E){let _={Action:"ListSMSSandboxPhoneNumbers",Version:"2010-03-31"};if(E)_.NextToken=E;let T=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(_)}),r=T?.ListSMSSandboxPhoneNumbersResponse?.ListSMSSandboxPhoneNumbersResult?.PhoneNumbers?.member;return{PhoneNumbers:Array.isArray(r)?r:r?[r]:[],NextToken:T?.ListSMSSandboxPhoneNumbersResponse?.ListSMSSandboxPhoneNumbersResult?.NextToken}}async createSMSSandboxPhoneNumber(E,_){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateSMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:E,LanguageCode:_||"en-US"})})}async verifySMSSandboxPhoneNumber(E,_){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"VerifySMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:E,OneTimePassword:_})})}async deleteSMSSandboxPhoneNumber(E){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteSMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:E})})}async getSMSSandboxAccountStatus(){return{IsInSandbox:(await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetSMSSandboxAccountStatus",Version:"2010-03-31"})}))?.GetSMSSandboxAccountStatusResponse?.GetSMSSandboxAccountStatusResult?.IsInSandbox==="true"}}}JA();Gr();sR();VE();VE();ut();VE();VE();VE();VE();VE();VE();VE();VE();VE();VE();VE();class gr{client;region;constructor(E="us-east-1"){this.region=E,this.client=new JE}async request(E,_){return this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSEvents.${E}`},body:JSON.stringify(_)})}async putRule(E){return this.request("PutRule",E)}async deleteRule(E){return this.request("DeleteRule",E)}async describeRule(E){return this.request("DescribeRule",E)}async listRules(E){return this.request("ListRules",E||{})}async listEventBuses(E){return this.request("ListEventBuses",E||{})}async enableRule(E){return this.request("EnableRule",E)}async disableRule(E){return this.request("DisableRule",E)}async putTargets(E){return this.request("PutTargets",E)}async removeTargets(E){return this.request("RemoveTargets",E)}async listTargetsByRule(E){return this.request("ListTargetsByRule",E)}async putEvents(E){return this.request("PutEvents",E)}async createSchedule(E){return this.client.request({service:"scheduler",region:this.region,method:"POST",path:`/schedules/${E.Name}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(E)})}}VE();class Md{client;region;constructor(E="us-east-1",_){this.region=E,this.client=new JE}async createRule(E){let _={Action:"PutRule",Name:E.name,ScheduleExpression:E.scheduleExpression,Version:"2015-10-07"};if(E.description)_.Description=E.description;if(E.state)_.State=E.state;else _.State="ENABLED";return{RuleArn:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.PutRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:E.name,ScheduleExpression:E.scheduleExpression,State:E.state||"ENABLED",Description:E.description})})).RuleArn}}async putTargets(E,_){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.PutTargets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:E,Targets:_})})}async listRules(E){let _={};if(E)_.NamePrefix=E;return{Rules:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.ListRules","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(_)})).Rules||[]}}async describeRule(E){let _=await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DescribeRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:E})});return{Name:_.Name,Arn:_.Arn,ScheduleExpression:_.ScheduleExpression,State:_.State,Description:_.Description}}async listTargetsByRule(E){return{Targets:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.ListTargetsByRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:E})})).Targets||[]}}async deleteRule(E,_){if(_)try{let T=await this.listTargetsByRule(E);if(T.Targets&&T.Targets.length>0)await this.removeTargets(E,T.Targets.map((r)=>r.Id))}catch{}await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DeleteRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:E,Force:_||!1})})}async removeTargets(E,_){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.RemoveTargets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:E,Ids:_})})}async enableRule(E){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.EnableRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:E})})}async disableRule(E){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DisableRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:E})})}async createLambdaSchedule(E){let _=await this.createRule({name:E.name,scheduleExpression:E.scheduleExpression,description:E.description,state:"ENABLED"});return await this.putTargets(E.name,[{Id:"1",Arn:E.functionArn,Input:E.input}]),_}async createEcsSchedule(E){let _=await this.createRule({name:E.name,scheduleExpression:E.scheduleExpression,description:E.description,state:"ENABLED"});return await this.putTargets(E.name,[{Id:"1",Arn:E.clusterArn,RoleArn:E.roleArn,Input:JSON.stringify({containerOverrides:[]})}]),_}async listSchedules(E){let _={};if(E?.NamePrefix)_.NamePrefix=E.NamePrefix;if(E?.State)_.State=E.State;let T=E?.GroupName||"default";return{Schedules:(await this.client.request({service:"scheduler",region:this.region,method:"GET",path:"/schedules",queryParams:{..._,ScheduleGroup:T}}))?.Schedules||[]}}async getSchedule(E){try{let _={};if(E.GroupName)_.groupName=E.GroupName;return await this.client.request({service:"scheduler",region:this.region,method:"GET",path:`/schedules/${encodeURIComponent(E.Name)}`,queryParams:Object.keys(_).length>0?_:void 0})}catch(_){if(_.statusCode===404||_.code==="ResourceNotFoundException")return null;throw _}}async createSchedule(E){let _={ScheduleExpression:E.ScheduleExpression,FlexibleTimeWindow:E.FlexibleTimeWindow,Target:E.Target};if(E.GroupName)_.GroupName=E.GroupName;if(E.ScheduleExpressionTimezone)_.ScheduleExpressionTimezone=E.ScheduleExpressionTimezone;if(E.Description)_.Description=E.Description;if(E.State)_.State=E.State;if(E.StartDate)_.StartDate=E.StartDate.toISOString();if(E.EndDate)_.EndDate=E.EndDate.toISOString();return{ScheduleArn:(await this.client.request({service:"scheduler",region:this.region,method:"POST",path:`/schedules/${encodeURIComponent(E.Name)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(_)}))?.ScheduleArn||""}}async updateSchedule(E){let _={};if(E.GroupName)_.GroupName=E.GroupName;if(E.ScheduleExpression)_.ScheduleExpression=E.ScheduleExpression;if(E.ScheduleExpressionTimezone)_.ScheduleExpressionTimezone=E.ScheduleExpressionTimezone;if(E.Description!==void 0)_.Description=E.Description;if(E.State)_.State=E.State;if(E.FlexibleTimeWindow)_.FlexibleTimeWindow=E.FlexibleTimeWindow;if(E.Target)_.Target=E.Target;return{ScheduleArn:(await this.client.request({service:"scheduler",region:this.region,method:"PUT",path:`/schedules/${encodeURIComponent(E.Name)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(_)}))?.ScheduleArn||""}}async deleteSchedule(E){let _={};if(E.GroupName)_.groupName=E.GroupName;await this.client.request({service:"scheduler",region:this.region,method:"DELETE",path:`/schedules/${encodeURIComponent(E.Name)}`,queryParams:Object.keys(_).length>0?_:void 0})}async listScheduleGroups(E){let _={};if(E?.NamePrefix)_.NamePrefix=E.NamePrefix;return{ScheduleGroups:(await this.client.request({service:"scheduler",region:this.region,method:"GET",path:"/schedule-groups",queryParams:Object.keys(_).length>0?_:void 0}))?.ScheduleGroups||[]}}}bN();VE();z_();z_();_L();z_();z_();VE();VE();z_();GJ();sd();await TR();function KA(E){return E?.split("/").at(-1)??E?.split(":").at(-1)??"unknown"}function nQ(E,_,T,r="ecs:aws",d=[]){let t=T.now??new Date;return E.map((R)=>{let h=R.serviceName??KA(R.serviceArn),N=_.filter((e)=>!R.clusterArn||e.clusterArn===R.clusterArn),S=N.some((e)=>!!e.group)?N.filter((e)=>e.group===`service:${h}`):N,A=R.status==="ACTIVE"?(R.runningCount??0)<(R.desiredCount??0)?"degraded":"running":LR(R.status),L=d.find((e)=>e.taskDefinitionArn===R.taskDefinition),O=Array.isArray(L?.containerDefinitions)?L.containerDefinitions:[],c=[...new Set(O.map((e)=>e.logConfiguration?.options?.["awslogs-group"]).filter((e)=>typeof e==="string"))],$=O.flatMap((e)=>(e.mountPoints??[]).map((z)=>({source:z.sourceVolume,target:z.containerPath,type:"volume",readOnly:!!z.readOnly}))),I=O.flatMap((e)=>(e.portMappings??[]).map((z,F)=>({id:`${e.name??"container"}:${F}`,name:e.name,mode:L?.networkMode,ports:[{container:z.containerPort,host:z.hostPort,protocol:z.protocol}]}))),C=T.project&&T.environment&&h.startsWith(`${T.project}-${T.environment}-`)?h.slice(`${T.project}-${T.environment}-`.length):h;return{id:At("ecs",r,R.serviceArn??h),provider:"ecs",kind:"service",name:h,status:A,rawStatus:R.status,health:A==="running"?"healthy":A==="failed"||A==="degraded"?"unhealthy":"unknown",desiredReplicas:R.desiredCount,runningReplicas:R.runningCount,image:O[0]?.image,runtime:R.launchType??"ECS",version:KA(R.taskDefinition),ageSeconds:WN(R.deployments?.[0]?.createdAt,t),restartCount:0,tags:{},links:{project:T.project,environment:T.environment,service:C,release:KA(R.taskDefinition),providerId:R.serviceArn},replicas:S.map((e)=>{let z=LR(e.lastStatus);return{id:At("ecs",r,e.taskArn??KA(e.taskArn)),name:KA(e.taskArn),status:z,rawStatus:e.lastStatus,createdAt:e.createdAt,startedAt:e.startedAt,stoppedAt:e.stoppedAt,host:e.containerInstanceArn,containers:(e.containers??[]).map((F)=>({id:F.containerArn??F.name??"container",name:F.name??"container",image:O.find((B)=>B.name===F.name)?.image,imageDigest:F.imageDigest,status:LR(F.lastStatus),rawStatus:F.lastStatus,exitCode:F.exitCode,reason:F.reason,runtime:"ecs"}))}}),networks:I,mounts:$,capabilities:BN(["start","stop","restart","redeploy","scale","inspect",...c.length?["logs"]:[]],"This ECS runtime does not expose exec or file transfer; logs require an awslogs task-definition driver"),config:AR({clusterArn:R.clusterArn,taskDefinition:R.taskDefinition,launchType:R.launchType,pendingCount:R.pendingCount,deployments:R.deployments,logGroups:c,executionRoleArn:L?.executionRoleArn,taskRoleArn:L?.taskRoleArn,cpu:L?.cpu,memory:L?.memory}),discoveredAt:t.toISOString(),sourceId:r}})}function lQ(E,_,T="lambda:aws"){let r=_.now??new Date;return E.map((d)=>{let t=d.FunctionName??KA(d.FunctionArn),R=d.State==="Active"?"running":LR(d.State);return{id:At("lambda",T,d.FunctionArn??t),provider:"lambda",kind:"function",name:t,status:R,rawStatus:d.State,health:R==="running"?"healthy":R==="failed"?"unhealthy":"unknown",desiredReplicas:void 0,runningReplicas:void 0,image:void 0,runtime:d.Runtime,version:d.Version,architecture:d.Architectures?.join(", "),ageSeconds:WN(d.LastModified,r),restartCount:0,tags:{},links:{project:_.project,environment:_.environment,service:t,providerId:d.FunctionArn},resources:{memoryLimitBytes:d.MemorySize==null?void 0:d.MemorySize*1024*1024},replicas:[],networks:[],mounts:[],capabilities:BN(["logs","inspect"],"Lambda has no persistent process to start, stop, restart, exec, or browse files; deploy a release to replace code"),config:AR({handler:d.Handler,timeout:d.Timeout,codeSize:d.CodeSize,stateReason:d.StateReason,environmentKeys:Object.keys(d.Environment?.Variables??{})}),discoveredAt:r.toISOString(),sourceId:T}})}function nm(E){let _=E.trim();if(!_)return[];let T=JSON.parse(_);if(!Array.isArray(T))throw Error("Docker inspect output must be an array");return T.filter((r)=>r&&typeof r.Id==="string")}function lm(E){let _=Object.entries(E.NetworkSettings?.Ports??{}).flatMap(([T,r])=>{let[d,t]=T.split("/");return(r??[]).map((R)=>({container:Number(d)||void 0,host:Number(R.HostPort)||void 0,protocol:t,address:R.HostIp}))});return Object.entries(E.NetworkSettings?.Networks??{}).map(([T,r])=>({id:r.NetworkID||T,name:T,mode:E.HostConfig?.NetworkMode,addresses:[r.IPAddress,r.GlobalIPv6Address].filter(Boolean),ports:_}))}function im(E){return(E.Mounts??[]).filter((_)=>!!_.Destination).map((_)=>({source:_.Source,target:_.Destination,type:_.Type,readOnly:_.RW===!1}))}function am(E,_,T=_.server??"local"){let r=_.now??new Date;return E.map((d)=>{let t=d.State?.OOMKilled?"oomkilled":d.State?.Restarting?"starting":d.State?.Status,R=LR(t),h=(d.Name??d.Id.slice(0,12)).replace(/^\//,""),N=d.Config?.Labels??{},S=im(d),A=lm(d),L={id:d.Id,name:h,image:d.Config?.Image,imageDigest:d.Image,runtime:"docker",status:R,rawStatus:t,exitCode:d.State?.ExitCode,reason:d.State?.Error,resources:{memoryLimitBytes:d.HostConfig?.Memory||void 0},networks:A,mounts:S};return{id:At("docker",T,d.Id),provider:"docker",kind:"container",name:h,status:R,rawStatus:t,health:R==="running"?"healthy":R==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:R==="running"?1:0,image:d.Config?.Image,runtime:"docker",ageSeconds:WN(d.State?.StartedAt,r),restartCount:d.RestartCount??0,tags:N,links:{project:_.project,environment:_.environment,server:_.server??T.replace(/^docker:/,""),service:N["com.docker.compose.service"]??N["ts-cloud.service"]??h,release:N["ts-cloud.release"],providerId:d.Id},resources:L.resources,replicas:[{id:At("docker",T,`${d.Id}:0`),name:h,status:R,rawStatus:t,startedAt:d.State?.StartedAt,stoppedAt:d.State?.FinishedAt,restartCount:d.RestartCount,containers:[L],resources:L.resources}],networks:A,mounts:S,capabilities:BN(["start","stop","restart","logs","exec","inspect","files"],"Use the owning Compose service for redeploy and scale"),config:AR({image:d.Config?.Image,labels:N,environmentKeys:(d.Config?.Env??[]).map((O)=>O.split("=",1)[0]),networkMode:d.HostConfig?.NetworkMode}),discoveredAt:r.toISOString(),sourceId:T}})}class Yz{inspect;id;provider="docker";constructor(E,_="docker:local"){this.inspect=E;this.id=_}async discover(E){return am(nm(await this.inspect(E)),E,this.id)}}function mm(E){let _=[];for(let T of E.split(`
+`)){if(!T.startsWith("TSCLOUD_SYSTEMD\t"))continue;let[,r,d,t,R,h,N,S,A,L,O,c,$,I]=T.split("\t");if(!r||!/^[A-Za-z0-9_.@:-]+\.service$/.test(r))continue;_.push({unit:r,load:d,active:t,sub:R,description:h,enabled:N,pid:Number(S)||void 0,memoryBytes:xQ(A),restartCount:Number(L)||0,activeSince:O||void 0,fragmentPath:c||void 0,workingDirectory:$?.startsWith("/")?$:void 0,user:I||void 0})}return _}function sm(E,_,T=_.server??"local"){let r=_.now??new Date;return E.map((d)=>{let t=LR(d.active==="active"?d.sub||d.active:d.active),R=d.unit.replace(/\.service$/,""),h=/^(.*?) (?:release [^ ]+|queue worker|daemon |scheduler)(?: |$)/.exec(d.description??"")?.[1]??(_.project&&R.startsWith(`${_.project}-`)?R.slice(_.project.length+1).split("@",1)[0]:void 0),N=R.includes("@")?R.slice(R.indexOf("@")+1):void 0,S=d.workingDirectory?[{target:d.workingDirectory,type:"working-directory"}]:[],A=["start","stop","restart","logs","exec","inspect",...S.length?["files"]:[]];return{id:At("systemd",T,d.unit),provider:"systemd",kind:"service",name:R,displayName:d.description||R,status:t,rawStatus:[d.load,d.active,d.sub].filter(Boolean).join("/"),health:t==="running"?"healthy":t==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:t==="running"?1:0,ageSeconds:WN(d.activeSince,r),restartCount:d.restartCount,tags:{enabled:d.enabled??"unknown"},links:{project:_.project,environment:_.environment,server:_.server??T.replace(/^systemd:/,""),service:h,release:N,providerId:d.unit},resources:{memoryBytes:d.memoryBytes},replicas:[{id:At("systemd",T,`${d.unit}:main`),name:"main",status:t,pid:d.pid,startedAt:d.activeSince,restartCount:d.restartCount,resources:{memoryBytes:d.memoryBytes}}],networks:[],mounts:S,capabilities:BN(A,S.length?"This systemd runtime does not support redeploy or replica scaling through the scoped explorer":"File transfer requires a provider-reported service working directory; redeploy and scaling are unavailable"),config:AR({fragmentPath:d.fragmentPath,workingDirectory:d.workingDirectory,user:d.user,environment:d.environment,enabled:d.enabled}),discoveredAt:r.toISOString(),sourceId:T}})}class Qz{read;id;provider="systemd";constructor(E,_="systemd:local"){this.read=E;this.id=_}async discover(E){return sm(mm(await this.read(E)),E,this.id)}}function pm(E,_){if(!E.success)throw Error(E.error||E.perInstance?.[0]?.error||`${_} discovery failed`);return E.perInstance?.[0]?.output??""}function om(){return["set -uo pipefail",'command -v systemctl >/dev/null 2>&1 || { echo "systemctl is unavailable" >&2; exit 127; }',"systemctl list-units --type=service --all --plain --no-legend 2>/dev/null | awk '{print $1}' | while IFS= read -r unit; do",'  [ -n "$unit" ] || continue','  clean() { printf "%s" "$1" | tr "\\t\\r\\n" "   "; }','  load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null || true)','  active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null || true)','  sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null || true)','  description=$(systemctl show "$unit" -p Description --value 2>/dev/null || true)','  enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)','  pid=$(systemctl show "$unit" -p MainPID --value 2>/dev/null || true)','  memory=$(systemctl show "$unit" -p MemoryCurrent --value 2>/dev/null || true)','  restarts=$(systemctl show "$unit" -p NRestarts --value 2>/dev/null || true)','  since=$(systemctl show "$unit" -p ActiveEnterTimestamp --value 2>/dev/null || true)','  fragment=$(systemctl show "$unit" -p FragmentPath --value 2>/dev/null || true)','  working=$(systemctl show "$unit" -p WorkingDirectory --value 2>/dev/null || true)','  user=$(systemctl show "$unit" -p User --value 2>/dev/null || true)','  printf "TSCLOUD_SYSTEMD\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n" "$(clean "$unit")" "$(clean "$load")" "$(clean "$active")" "$(clean "$sub")" "$(clean "$description")" "$(clean "$enabled")" "$(clean "$pid")" "$(clean "$memory")" "$(clean "$restarts")" "$(clean "$since")" "$(clean "$fragment")" "$(clean "$working")" "$(clean "$user")"',"done"]}function Es(){return["set -uo pipefail",'if ! command -v docker >/dev/null 2>&1; then echo "[]"; exit 0; fi',"ids=$(docker ps -aq)",'if [ -z "$ids" ]; then echo "[]"; else docker inspect $ids; fi']}function iQ(E,_,T,r,d){let t=`${E}:${T.id}`,R=async()=>pm(await _.runRemoteDeploy({targets:[T],commands:E==="systemd"?om():Es(),timeoutSeconds:30,comment:`ts-cloud runtime discovery:${E}`,tags:{Project:r.project.slug,Environment:d,Role:"app"}}),t);return E==="systemd"?new Qz(R,t):new Yz(R,t)}async function QD(E,_=100){let T=[],r;for(let d=0;d<_;d++){let t=await E(r);if(T.push(...t.items),!t.nextToken)return T;r=t.nextToken}throw Error(`Provider pagination exceeded ${_} pages`)}class aQ{client;prefix;id="ecs:aws";provider="ecs";constructor(E,_){this.client=E;this.prefix=_}async discover(E){let _=await QD(async(t)=>{let R=await this.client.listClusters({nextToken:t,maxResults:100});return{items:R.clusterArns??[],nextToken:R.nextToken}}),T=[],r=[],d=[];for(let t of _){let R=(await QD(async(h)=>{let N=await this.client.listServices(t,{nextToken:h,maxResults:100});return{items:N.serviceArns??[],nextToken:N.nextToken}})).filter((h)=>h.split("/").at(-1)?.startsWith(this.prefix));for(let h=0;h<R.length;h+=10){let N=await this.client.describeServices({cluster:t,services:R.slice(h,h+10)});T.push(...N.services??[])}for(let h of T.filter((N)=>N.clusterArn===t||!N.clusterArn)){let N=await QD(async(S)=>{let A=await this.client.listTasks(t,h.serviceName,{nextToken:S,maxResults:100});return{items:A.taskArns??[],nextToken:A.nextToken}});for(let S=0;S<N.length;S+=100){let A=await this.client.describeTasks(t,N.slice(S,S+100));r.push(...A.tasks??[])}}}if(this.client.describeTaskDefinition)for(let t of[...new Set(T.map((R)=>R.taskDefinition).filter((R)=>!!R))]){let R=await this.client.describeTaskDefinition(t);if(R.taskDefinition)d.push(R.taskDefinition)}return nQ(T,r,E,this.id,d)}}class mQ{client;prefix;id="lambda:aws";provider="lambda";constructor(E,_){this.client=E;this.prefix=_}async discover(E){let _=(await QD(async(T)=>{let r=await this.client.listFunctions({Marker:T,MaxItems:50});return{items:r.Functions??[],nextToken:r.NextMarker}})).filter((T)=>T.FunctionName?.startsWith(this.prefix));return lQ(_,E,this.id)}}async function _s(E,_,T={}){let r=[],d=xT(E),t=GT(E),R=E.aws?.profile,h=E.aws?.region??E.project.region??"us-east-1",N=`${E.project.slug}-${_}`;if(d!=="serverless"){let S=T.driver??x_({config:E}),A=await S.findComputeTargets({slug:E.project.slug,environment:_,role:"app"});for(let L of A)r.push(iQ("systemd",S,L,E,_)),r.push(iQ("docker",S,L,E,_))}if(t==="aws")r.push(new aQ(T.ecs??new Ah(h,R),N)),r.push(new mQ(T.lambda??new B_(h,R),N));return r}async function fd(E,_,T={}){let r={project:E.project.slug,environment:_};try{return await bQ(await _s(E,_,T),r)}catch(d){return{generatedAt:new Date().toISOString(),workloads:[],sources:[{id:"runtime:bootstrap",provider:GT(E)==="aws"?"ecs":"systemd",status:"error",discoveredAt:new Date().toISOString(),staleAfterSeconds:60,itemCount:0,message:String(d?.message??d).slice(0,500)}],degraded:!0}}}sR();await TR();var sQ=65536,YO=49152,MD=/^[A-Za-z0-9_.@:-]+\.service$/,fD=/^[a-fA-F0-9]{12,128}$/,Ts=["/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run"];function VA(E){let _=Buffer.from(E);return _.byteLength<=sQ?E:`${_.subarray(0,sQ-24).toString("utf8")}
+[output truncated]`}function GD(E){return{success:!1,instanceCount:0,perInstance:[],error:E instanceof Error?E.message:String(E)}}function Od(E){return`'${E.replaceAll("'",`'"'"'`)}'`}function rs(E,_){return Number.isFinite(E)?Math.min(1e4,Math.max(0,Math.floor(E))):_}function ds(E){let _=E.config,T=typeof _.clusterArn==="string"?_.clusterArn:void 0,r=E.links.providerId||E.name;return T&&r?{cluster:T,service:r}:void 0}function ts(E,_){return E.find((T)=>T.id===_.links.server)??(E.length===1?E[0]:void 0)}function Rs(E,_){if(E.provider==="systemd"){let T=E.links.providerId;if(!T||!MD.test(T)||!["start","stop","restart"].includes(_))return;return[`systemctl ${_} ${T}`,`systemctl is-active ${T} 2>/dev/null || true`]}if(E.provider==="docker"){let T=E.links.providerId;if(!T||!fD.test(T)||!["start","stop","restart"].includes(_))return;return[`docker ${_} ${T}`,`docker inspect --format '{{.State.Status}}' ${T}`]}return}function hs(E,_){if(!_.startsWith("/")||_.includes("\x00"))return{ok:!1,error:"An absolute path is required."};let T=[];for(let h of _.split("/")){if(!h||h===".")continue;if(h===".."){if(!T.length)return{ok:!1,error:"Path traversal is not allowed."};T.pop()}else T.push(h)}let r=`/${T.join("/")}`;if(Ts.some((h)=>r===h||r.startsWith(`${h}/`)))return{ok:!1,error:"Sensitive host paths are not available through runtime file access."};let d=E.links.project?.replace(/[^A-Za-z0-9_-]/g,""),t=E.links.service?.replace(/[^A-Za-z0-9_-]/g,"");if(![...d&&t?[`/var/www/${d}/${t}`,`/srv/${d}/${t}`]:[],...E.mounts.map((h)=>h.target).filter((h)=>h.startsWith("/"))].some((h)=>r===h||r.startsWith(`${h.replace(/\/$/,"")}/`)))return{ok:!1,error:"Path is outside this service’s owned roots."};return{ok:!0,path:r}}function Ns(E,_){let T=E.links.project?.replace(/[^A-Za-z0-9_-]/g,""),r=E.links.service?.replace(/[^A-Za-z0-9_-]/g,"");return[...T&&r?[`/var/www/${T}/${r}`,`/srv/${T}/${r}`]:[],...E.mounts.map((d)=>d.target).filter((d)=>d.startsWith("/"))].sort((d,t)=>t.length-d.length).find((d)=>_===d||_.startsWith(`${d.replace(/\/$/,"")}/`))}var pQ={process:["ps","-eo","pid,ppid,user,%cpu,%mem,etime,command","--sort=-%cpu"],sockets:["ss","-lntup"],filesystem:["df","-h"]};class xr{config;environment;dependencies;region;profile;constructor(E,_,T={}){this.config=E;this.environment=_;this.dependencies=T;this.region=E.aws?.region??E.project.region??"us-east-1",this.profile=E.aws?.profile}async inventory(){return this.dependencies.inventory?.()??fd(this.config,this.environment,{driver:this.dependencies.driver})}async workload(E){return(await this.inventory()).workloads.find((_)=>_.id===E)}async remote(E,_,T,r){let d=this.dependencies.driver??x_({config:this.config}),t=await d.findComputeTargets({slug:this.config.project.slug,environment:this.environment,role:"app"}),R=ts(t,E);if(!R)throw Error("The workload server is no longer reachable in this scope.");return d.runRemoteDeploy({targets:[R],commands:_,timeoutSeconds:T,comment:r,tags:{Project:this.config.project.slug,Environment:this.environment,Role:"app"}})}async run(E){let _=await this.workload(E.workloadId),T={workloadId:E.workloadId,action:E.action};if(!_)return{...T,ok:!1,error:"Workload was not found in the current project and environment."};let r=_.capabilities[E.action];if(!r.supported)return{...T,ok:!1,error:r.reason??`${E.action} is unsupported for ${_.provider}.`};if(r.requiresConfirmation&&E.confirm!==_.name)return{...T,ok:!1,error:`Type "${_.name}" to ${E.action} this workload.`};if(r.requiresRecentAuth&&!E.recentAuth)return{...T,ok:!1,error:"Sign in again before using elevated runtime access."};if(E.action==="inspect")return{...T,ok:!0,workload:_};if(_.provider==="systemd"||_.provider==="docker"){let d=Rs(_,E.action);if(!d)return{...T,ok:!1,error:`${E.action} is not implemented for ${_.provider}.`};let t=await this.remote(_,["set -uo pipefail",...d],60,`ts-cloud runtime:${E.action}`).catch(GD);return{...T,ok:t.success,command:d[0],stdout:VA(t.perInstance?.[0]?.output??""),stderr:VA(t.perInstance?.[0]?.error??t.error??""),error:t.success?void 0:t.error??"Runtime operation failed."}}if(_.provider==="ecs"){let d=ds(_);if(!d)return{...T,ok:!1,error:"ECS cluster or service identity is unavailable."};let t=this.dependencies.ecs??new Ah(this.region,this.profile);if(E.action==="scale"){let R=rs(E.replicas,_.desiredReplicas??1);return await t.scaleService(d.cluster,d.service,R),{...T,ok:!0,command:`ecs scale ${_.name} ${R}`}}if(E.action==="start"||E.action==="stop"){let R=E.action==="stop"?0:Math.max(1,_.desiredReplicas??1);return await t.scaleService(d.cluster,d.service,R),{...T,ok:!0,command:`ecs scale ${_.name} ${R}`}}if(E.action==="restart"||E.action==="redeploy")return await t.forceNewDeployment(d.cluster,d.service),{...T,ok:!0,command:`ecs redeploy ${_.name}`}}return{...T,ok:!1,error:`${E.action} is not implemented for ${_.provider}.`}}async exec(E){let _={workloadId:E.workloadId,preset:E.preset},T=await this.workload(E.workloadId);if(!T)return{..._,ok:!1,error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_EXEC==="0")return{..._,ok:!1,error:"Runtime exec is disabled by TS_CLOUD_RUNTIME_EXEC."};if(!T.capabilities.exec.supported)return{..._,ok:!1,error:T.capabilities.exec.reason??"Exec is unsupported for this workload."};if(E.confirm!==T.name)return{..._,ok:!1,error:`Type "${T.name}" to open exec access.`};if(!E.recentAuth)return{..._,ok:!1,error:"Sign in again before using elevated runtime access."};let r=E.preset&&pQ[E.preset];if(!r&&!E.command?.trim())return{..._,ok:!1,error:"Choose a diagnostic preset or provide a command."};if(E.command&&T.provider!=="docker")return{..._,ok:!1,error:"Free-form exec is restricted to isolated containers; use a diagnostic preset for system services."};let d=T.links.providerId??"",t;if(T.provider==="docker"&&fD.test(d)){let h=E.command?.trim()||r.map(Od).join(" ");t=`docker exec ${d} sh -lc ${Od(h)}`}else if(T.provider==="systemd"&&MD.test(d)&&E.preset)t=E.preset==="process"?`systemctl status ${d} --no-pager --full`:pQ[E.preset].map(Od).join(" ");if(!t)return{..._,ok:!1,error:"Exec target identity is invalid or unsupported."};let R=await this.remote(T,["set -uo pipefail",t],60,"ts-cloud runtime:exec").catch(GD);return{..._,ok:R.success,command:t,stdout:VA(R.perInstance?.[0]?.output??""),stderr:VA(R.perInstance?.[0]?.error??R.error??""),error:R.success?void 0:R.error??"Exec command failed."}}async readFile(E){let _={workloadId:E.workloadId,path:E.path},T=await this.fileTarget(E);if("error"in T)return{..._,ok:!1,error:T.error};let{workload:r,path:d,root:t,providerId:R}=T,N=`sh -c ${Od('resolved=$(realpath -m "$1"); root=$(realpath -m "$3"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; test -f "$resolved"; size=$(wc -c < "$resolved"); printf "__TSCLOUD_SIZE__=%s\\n" "$size"; head -c "$2" "$resolved" | base64')} sh ${Od(d)} ${YO} ${Od(t)}`,S=r.provider==="docker"?`docker exec ${R} ${N}`:N,A=await this.remote(r,[S],30,"ts-cloud runtime:file-read").catch(GD);if(!A.success)return{..._,ok:!1,error:A.error??A.perInstance?.[0]?.error??"File read failed."};let L=A.perInstance?.[0]?.output??"",O=/__TSCLOUD_SIZE__=(\d+)\r?\n/.exec(L);if(!O)return{..._,ok:!1,error:"The remote file response was invalid."};let c=Number(O[1]),$=L.slice((O.index??0)+O[0].length).replace(/\s+/g,"");if(Buffer.from($,"base64").byteLength>YO)return{..._,ok:!1,error:"The remote file exceeded the transfer limit."};return{..._,ok:!0,contentBase64:$,size:c,truncated:c>YO}}async writeFile(E){let _={workloadId:E.workloadId,path:E.path},T=await this.fileTarget(E);if("error"in T)return{..._,ok:!1,error:T.error};if(!/^[A-Za-z0-9+/]*={0,2}$/.test(E.contentBase64))return{..._,ok:!1,error:"File content must be valid base64."};let r=Buffer.from(E.contentBase64,"base64");if(r.toString("base64")!==E.contentBase64)return{..._,ok:!1,error:"File content must be canonical base64."};if(r.byteLength>YO)return{..._,ok:!1,error:`File uploads are limited to ${YO} bytes.`};let{workload:d,path:t,root:R,providerId:h}=T,S=`sh -c ${Od('resolved=$(realpath -m "$1"); root=$(realpath -m "$2"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; mkdir -p "$(dirname "$resolved")"; tmp="$resolved.ts-cloud-$$"; base64 -d > "$tmp"; chmod 600 "$tmp"; mv "$tmp" "$resolved"')} sh ${Od(t)} ${Od(R)}`,A=d.provider==="docker"?`printf %s ${Od(E.contentBase64)} | docker exec -i ${h} ${S}`:`printf %s ${Od(E.contentBase64)} | ${S}`,L=await this.remote(d,[A],30,"ts-cloud runtime:file-write").catch(GD);return{..._,ok:L.success,size:r.byteLength,truncated:!1,error:L.success?void 0:L.error??L.perInstance?.[0]?.error??"File write failed."}}async fileTarget(E){let _=await this.workload(E.workloadId);if(!_)return{error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_FILE_ACCESS==="0")return{error:"Runtime file access is disabled by TS_CLOUD_RUNTIME_FILE_ACCESS."};if(!_.capabilities.files.supported)return{error:_.capabilities.files.reason??"File access is unsupported for this workload."};if(E.confirm!==_.name)return{error:`Type "${_.name}" to access workload files.`};if(!E.recentAuth)return{error:"Sign in again before using elevated runtime access."};let T=hs(_,E.path);if(!T.ok)return{error:T.error};let r=Ns(_,T.path),d=_.links.providerId??"";if(!r||_.provider==="systemd"&&!MD.test(d)||_.provider==="docker"&&!fD.test(d))return{error:"File target identity is invalid or unsupported."};return{workload:_,path:T.path,root:r,providerId:d}}async logs(E,_={}){let T=await this.workload(E);if(!T)throw Error("Workload was not found in the current project and environment.");if(!T.capabilities.logs.supported)throw Error(T.capabilities.logs.reason??"Logs are unsupported for this workload.");let r=Math.min(1000,Math.max(1,Math.floor(_.limit??200)));if(T.provider==="lambda"||T.provider==="ecs"){let A=this.dependencies.logs??new Ir(this.region,this.profile),L=T.config.logGroups,O=T.provider==="lambda"?`/aws/lambda/${T.name}`:Array.isArray(L)&&typeof L[0]==="string"?L[0]:void 0;if(!O)throw Error("The ECS task definition does not declare an awslogs group.");let c=await A.filterLogEvents({logGroupName:O,startTime:_.since?.getTime(),limit:r}),$=(c.events??[]).slice(0,r).map((I)=>({timestamp:I.timestamp==null?void 0:new Date(I.timestamp).toISOString(),message:VA(String(I.message??""))}));return{workloadId:E,provider:T.provider,lines:$,nextCursor:c.nextToken,truncated:(c.events?.length??0)>=r}}let d=T.links.providerId??"",t=_.since&&Number.isFinite(_.since.getTime())?_.since:void 0,R=T.provider==="systemd"&&MD.test(d)?`journalctl -u ${d} --no-pager -n ${r} -o short-iso${t?` --since ${Od(t.toISOString())}`:""}`:T.provider==="docker"&&fD.test(d)?`docker logs --timestamps --tail ${r}${t?` --since ${Math.floor(t.getTime()/1000)}`:""} ${d} 2>&1`:void 0;if(!R)throw Error("Log target identity is invalid.");let h=await this.remote(T,[R],30,"ts-cloud runtime:logs");if(!h.success)throw Error(h.error??h.perInstance?.[0]?.error??"Log read failed.");let N=VA(h.perInstance?.[0]?.output??""),S=N.split(`
+`).filter(Boolean).slice(-r).map((A)=>{let L=/^(\d{4}-\d{2}-\d{2}T\S+)\s+(.*)$/.exec(A);return{timestamp:L?.[1],message:L?.[2]??A}});return{workloadId:E,provider:T.provider,lines:S,truncated:N.includes("[output truncated]")||S.length>=r}}}import{randomUUID as Ss}from"node:crypto";class Gz{records=new Map;maxBufferBytes;ttlMs;now;constructor(E={}){this.maxBufferBytes=Math.max(1024,E.maxBufferBytes??262144),this.ttlMs=Math.max(1000,E.ttlMs??900000),this.now=E.now??(()=>new Date)}create(E,_){this.sweep();let T=this.now().toISOString(),r={id:Ss(),workloadId:_,kind:E,state:"open",chunks:[],cursor:0,droppedBytes:0,bufferedBytes:0,createdAt:T,updatedAt:T,abort:new AbortController,listeners:new Set};return this.records.set(r.id,r),this.snapshot(r,0)}signal(E){return this.records.get(E)?.abort.signal}append(E,_,T="stdout"){let r=this.records.get(E);if(!r||r.state!=="open"||!_)return r?this.snapshot(r,r.cursor):void 0;let d=Buffer.from(_),t=d.byteLength>this.maxBufferBytes?d.subarray(d.byteLength-this.maxBufferBytes).toString("utf8"):_,R={cursor:++r.cursor,stream:T,data:t,at:this.now().toISOString()};r.chunks.push(R),r.bufferedBytes+=Buffer.byteLength(t),r.updatedAt=R.at;while(r.bufferedBytes>this.maxBufferBytes&&r.chunks.length>1){let h=r.chunks.shift(),N=Buffer.byteLength(h.data);r.bufferedBytes-=N,r.droppedBytes+=N}return this.publish(r),this.snapshot(r,R.cursor-1)}read(E,_,T=0){let r=this.records.get(E);if(!r||r.workloadId!==_)return;return r.updatedAt=this.now().toISOString(),this.snapshot(r,Math.max(0,Math.floor(T)))}close(E,_="complete",T){let r=this.records.get(E);if(!r||r.state!=="open")return r?this.snapshot(r,r.cursor):void 0;if(r.state=_,r.error=T,r.updatedAt=this.now().toISOString(),_==="cancelled")r.abort.abort();return this.publish(r),this.snapshot(r,r.cursor)}cancel(E,_){let T=this.records.get(E);if(!T||T.workloadId!==_)return;return this.close(E,"cancelled")}subscribe(E,_,T){let r=this.records.get(E);if(!r||r.workloadId!==_)return;return r.listeners.add(T),()=>r.listeners.delete(T)}sweep(){let E=this.now().getTime()-this.ttlMs,_=0;for(let[T,r]of this.records){if(new Date(r.updatedAt).getTime()>E)continue;r.abort.abort(),this.records.delete(T),_++}return _}clear(){for(let E of this.records.values())E.abort.abort();this.records.clear()}snapshot(E,_){let T=E.chunks[0]?.cursor??E.cursor+1,r=_>0&&_<T-1;return{id:E.id,workloadId:E.workloadId,kind:E.kind,state:E.state,chunks:E.chunks.filter((d)=>r||d.cursor>_),cursor:E.cursor,reset:r,droppedBytes:E.droppedBytes,createdAt:E.createdAt,updatedAt:E.updatedAt,error:E.error}}publish(E){let _=this.snapshot(E,0);for(let T of E.listeners)T(_)}}import{randomBytes as oQ,scryptSync as E8,timingSafeEqual as As}from"node:crypto";function Vz(E,_){if(E.role==="admin")return[..._];return _.filter((T)=>!!E.sites?.[T])}var Mz=32768,fz=8,Kz=1,Ls=32,Os=16;function Ih(E){let _=oQ(Os),T=E8(E,_,Ls,{N:Mz,r:fz,p:Kz,maxmem:268435456});return`scrypt$${Mz}$${fz}$${Kz}$${_.toString("base64url")}$${T.toString("base64url")}`}function Kd(E,_){try{let T=_.split("$");if(T.length!==6||T[0]!=="scrypt")return!1;let[,r,d,t,R,h]=T,N=Number(r),S=Number(d),A=Number(t);if(!Number.isFinite(N)||!Number.isFinite(S)||!Number.isFinite(A))return!1;let L=Buffer.from(R,"base64url"),O=Buffer.from(h,"base64url");if(L.length===0||O.length===0)return!1;let c=E8(E,L,O.length,{N,r:S,p:A,maxmem:268435456});return As(c,O)}catch{return!1}}function _8(E){let[_,T,r,d]=E.split("$");return _!=="scrypt"||Number(T)!==Mz||Number(r)!==fz||Number(d)!==Kz}function Zz(){return oQ(18).toString("base64url")}await bd([IO(),LD()]);NA();await bd([aE(),TR()]);var cs=new Set(["singlestore","vitess"]);function ZD(E){return cs.has(E)}var VD={mysql:"/var/lib/pantry/mysql/mysqld.sock",mariadb:"/var/lib/pantry/mariadb/mariadbd.sock"};function OR(E){return/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(E)}function Us(E){if(E==="postgres"||E==="pgsql")return"postgres";if(E==="mariadb")return"mariadb";if(E==="singlestore")return"singlestore";if(E==="vitess")return"vitess";return"mysql"}function PN(E){let _=E.infrastructure?.compute,T=U_(E)?.engine;if(T)return Us(T);let r=_?.managedServices??{};if(r.postgres)return"postgres";if(r.mariadb)return"mariadb";return"mysql"}var qz=(E)=>E.replace(/`/g,"``"),Lt=(E)=>E.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),HN=(E)=>`"${E.replace(/"/g,'""')}"`,KD=(E)=>`'${E.replace(/'/g,"''")}'`;function gz(E,_){return[`mysql --socket=${E==="mariadb"?VD.mariadb:VD.mysql} -u root <<'TS_CLOUD_SQL_EOF'`,..._,"TS_CLOUD_SQL_EOF"]}function xz(E,_){return[`${RA(_)} -tA <<'TS_CLOUD_PG_EOF'`,...E,"TS_CLOUD_PG_EOF"]}function $s(E,_){if(E==="vitess")return Ds(_);if(E==="postgres")return xz(["SELECT 'DB=' || datname FROM pg_database WHERE datistemplate = false;","SELECT 'USER=' || usename FROM pg_user;"],_);return gz(E,["SELECT CONCAT('DB=', schema_name) FROM information_schema.schemata WHERE schema_name NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys');","SELECT DISTINCT CONCAT('USER=', User) FROM mysql.user WHERE User NOT IN ('root', 'mysql.sys', 'mysql.session', 'mysql.infoschema', 'debian-sys-maint');"])}function ZA(E,_,T){let r=_?.host??"127.0.0.1",d=_?.username??"root",t=_?.password??"",R=_?.ssl===!1?"":" --ssl-mode=PREFERRED",h=(S)=>`'${String(S).replace(/'/g,"'\\''")}'`;return[`${t?`MYSQL_PWD=${h(t)} `:""}mysql -h ${h(r)} -P ${_?.port??T} -u ${h(d)}${R} --batch --skip-column-names <<'TS_CLOUD_SQL_EOF'`,...E,"TS_CLOUD_SQL_EOF"]}var qA=15306;function Ds(E){let _=ZA(["SHOW KEYSPACES;"],E,qA);return _[0]=`${_[0]} | sed 's/^/DB=/'`,_}function Is(E){return ZA(["SHOW KEYSPACES;","SHOW VITESS_SHARDS;","SHOW VITESS_TABLETS;"],E,qA)}function Cs(E){let _=[],T=[],r=[];for(let d of E.split(`
 `)){let t=d.trim();if(!t)continue;let R=t.split("\t").map((h)=>h.trim()).filter(Boolean);if(R.length>=6){let[h,N,S,A,L,O,c]=R;r.push({cell:h??"",keyspace:N??"",shard:S??"",type:A??"",state:L??"",alias:O??"",hostname:c??""});continue}if(R.length===1){let h=R[0];if(h.includes("/")){let[N,S]=h.split("/");if(N&&S)T.push({keyspace:N,shard:S})}else _.push(h)}}return{keyspaces:[...new Set(_)].filter(Boolean).sort(),shards:T,tablets:r}}function ws(E,_,T){if(E==="postgres")return xz([`SELECT 'CREATE DATABASE ${HN(_)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${KD(_)})\\gexec`],T);return gz(E,[`CREATE DATABASE IF NOT EXISTS \`${qz(_)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`])}function es(E,_,T){let{username:r,password:d,database:t,access:R}=_;if(E==="postgres"){let S=["DO $$ BEGIN",`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${KD(r)}) THEN CREATE ROLE ${HN(r)} LOGIN PASSWORD ${KD(d)};`,`  ELSE ALTER ROLE ${HN(r)} LOGIN PASSWORD ${KD(d)}; END IF;`,"END $$;"];if(t)S.push(R==="readonly"?`GRANT CONNECT ON DATABASE ${HN(t)} TO ${HN(r)};`:`GRANT ALL PRIVILEGES ON DATABASE ${HN(t)} TO ${HN(r)};`);return xz(S,T)}let h=R==="readonly"?"SELECT":"ALL PRIVILEGES",N=[`CREATE USER IF NOT EXISTS '${Lt(r)}'@'%' IDENTIFIED BY '${Lt(d)}';`,`CREATE USER IF NOT EXISTS '${Lt(r)}'@'localhost' IDENTIFIED BY '${Lt(d)}';`,`ALTER USER '${Lt(r)}'@'%' IDENTIFIED BY '${Lt(d)}';`,`ALTER USER '${Lt(r)}'@'localhost' IDENTIFIED BY '${Lt(d)}';`];if(t)N.push(`GRANT ${h} ON \`${qz(t)}\`.* TO '${Lt(r)}'@'%';`,`GRANT ${h} ON \`${qz(t)}\`.* TO '${Lt(r)}'@'localhost';`);return N.push("FLUSH PRIVILEGES;"),gz(E,N)}function Xs(E){let _=[],T=[];for(let r of E.split(`
 `)){let d=r.trim();if(d.startsWith("DB="))_.push(d.slice(3));else if(d.startsWith("USER="))T.push(d.slice(5))}return{databases:[...new Set(_)].filter(Boolean).sort(),users:[...new Set(T)].filter(Boolean).sort()}}async function pT(E,_,T,r){let d;try{d=x_({config:E})}catch(N){return{ok:!1,error:`Could not initialize the cloud driver: ${N?.message??N}`}}let t=E.project.slug,R=await d.findComputeTargets({slug:t,environment:_,role:"app"});if(!R.length)return{ok:!1,error:"No app server target was found for this environment."};let h=await d.runRemoteDeploy({targets:[R[0]],commands:["set -uo pipefail",...T],comment:r,tags:{Project:t,Environment:_,Role:"app"}});return{ok:h.success,stdout:h.perInstance?.[0]?.output??"",stderr:h.perInstance?.[0]?.error??h.error??""}}function qD(E,_){return{ok:!1,error:`${_} is not available for ${E}: it is an external cluster, so this box has no engine to administer. ${E==="vitess"?"Create a keyspace with `vtctldclient CreateKeyspace`, and manage vtgate credentials on the cluster.":"Use the provider console or the cluster's own admin connection."}`}}async function T8(E,_){let T=PN(E);if(ZD(T)&&T!=="vitess")return{...qD(T,"Listing databases"),engine:T,databases:[],users:[]};let r=await pT(E,_,$s(T,U_(E)),"ts-cloud db:list"),d=r.ok&&r.stdout?Xs(r.stdout):{databases:[],users:[]};return{...r,engine:T,...d}}async function r8(E,_,T){let r=PN(E);if(ZD(r))return qD(r,"Creating a database");return pT(E,_,ws(r,T,U_(E)),`ts-cloud db:create ${T}`)}async function d8(E,_,T){let r=PN(E);if(ZD(r))return qD(r,"Creating a database user");return pT(E,_,es(r,T,U_(E)),`ts-cloud db:user ${T.username}`)}var bz="/var/backups/ts-cloud/databases";function Js(E,_,T=bz,r){let d=`${T}/${_}-$(date +%Y%m%d-%H%M%S).sql.gz`,t=`mkdir -p ${T}`;if(E==="postgres")return[t,`${RA(r,"pg_dump")} ${_} | gzip > "${d}"`,`echo "BACKUP=${d}"`,`ls -l "${d}"`];let R=E==="mariadb"?VD.mariadb:VD.mysql;return[t,`mysqldump --socket=${R} -u root ${_} | gzip > "${d}"`,`echo "BACKUP=${d}"`,`ls -l "${d}"`]}function zs(E=bz){return[`ls -1t ${E}/*.sql.gz 2>/dev/null | head -50 | sed 's|^|BACKUP=|' || true`]}function Fs(E){let _=[];for(let T of E.split(`
 `)){let r=T.trim();if(!r.startsWith("BACKUP="))continue;let d=r.slice(7),R=(d.split("/").pop()??d).replace(/-\d{8}-\d{6}\.sql\.gz$/,"");if(d)_.push({file:d,database:R})}return _}async function t8(E,_,T){if(!OR(T))return{ok:!1,error:"Database name must be a valid identifier.",database:T};let r=PN(E);if(ZD(r))return{...qD(r,"Backing up"),database:T};return{...await pT(E,_,Js(r,T,bz,U_(E)),`ts-cloud db:backup ${T}`),database:T}}async function R8(E,_){let T=await pT(E,_,zs(),"ts-cloud db:backups"),r=T.ok&&T.stdout?Fs(T.stdout):[];return{...T,backups:r}}async function h8(E,_){let T=PN(E),r={keyspaces:[],shards:[],tablets:[]};if(T!=="vitess")return{ok:!1,error:"The configured database engine is not Vitess.",engine:T,...r};let d=await pT(E,_,Is(U_(E)),"ts-cloud vitess:topology"),t=d.ok&&d.stdout?Cs(d.stdout):r;return{...d,engine:T,...t}}function N8(E){return E.filter((_)=>_.state.toUpperCase()!=="SERVING")}function S8(E){let _=new Set(E.tablets.filter((T)=>T.type.toUpperCase()==="PRIMARY"&&T.state.toUpperCase()==="SERVING").map((T)=>`${T.keyspace}/${T.shard}`));return E.shards.filter((T)=>!_.has(`${T.keyspace}/${T.shard}`))}await aE();var kz="/usr/local/bin/vtctldclient",js="21.0.0";function xD(E){return`'${String(E).split("'").join("'\\''")}'`}function bD(E){return U_(E)?.vitess??{}}function A8(E){return/^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(E)}function Bs(E){return/^[0-9a-f]{8}(?:_[0-9a-f]{4}){3}_[0-9a-f]{12}$/i.test(E)}function Ws(E=js){let _=xD(E);return[`if ${kz} --version 2>/dev/null | grep -q ${_}; then echo "vtctldclient ${E} already installed"; else`,"  command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)",'  if [ "$(uname -m)" != "x86_64" ]; then','    echo "vtctldclient: Vitess publishes only an x86_64 release tarball; this box is $(uname -m). Build from source or install via pantry." >&2',"    exit 1","  fi",'  tmp="$(mktemp -d)"',`  api="https://api.github.com/repos/vitessio/vitess/releases/tags/v${E}"`,`  url="$(curl -fsSL "$api" | grep -oE '"browser_download_url"[[:space:]]*:[[:space:]]*"[^"]+vitess-[0-9][^"]*\\.tar\\.gz"' | head -1 | sed -E 's/.*"(https[^"]+)"/\\1/')"`,'  if [ -z "$url" ]; then echo "vtctldclient: no release tarball found for v'+E+'" >&2; rm -rf "$tmp"; exit 1; fi',`  curl -fsSL "$url" | tar -xz -C "$tmp" --strip-components=2 --wildcards --occurrence=1 '*/bin/vtctldclient' || true`,'  if [ ! -s "$tmp/vtctldclient" ]; then','    echo "vtctldclient: could not extract the binary from $url" >&2','    rm -rf "$tmp"; exit 1',"  fi",`  install -m 0755 "$tmp/vtctldclient" ${kz}`,'  rm -rf "$tmp"',`  echo "installed vtctldclient ${E}"`,"fi"]}function L8(E){if(!E.vtctldAddr)return null;return`${kz} --server ${xD(E.vtctldAddr)}`}function Hs(E,_,T={}){let r=L8(E);if(!r)return null;let d=T.sharded?" --sharded":"";return[`${r} CreateKeyspace${d} ${xD(_)}`]}function Ps(E,_,T){let r=L8(E);if(!r)return null;return['vschema_tmp="$(mktemp)"',`cat > "$vschema_tmp" <<'TS_CLOUD_VSCHEMA_EOF'`,T,"TS_CLOUD_VSCHEMA_EOF",`${r} ApplyVSchema --vschema-file "$vschema_tmp" ${xD(_)}`,'rm -f "$vschema_tmp"']}function ys(E,_,T="vitess"){return ZA([`SET @@ddl_strategy='${T}';`,_.endsWith(";")?_:`${_};`],E,qA)}function Ys(E,_){let T=_?[`USE ${_.replace(/[^A-Z0-9_]/gi,"")};`,"SHOW VITESS_MIGRATIONS;"]:["SHOW VITESS_MIGRATIONS;"],r=ZA(T,E,qA);return r[0]=r[0].replace(" --skip-column-names",""),r}function Qs(E){let _=E.split(`
@@ -10261,7 +10261,7 @@ data: ${JSON.stringify({cursor:t,at:new Date().toISOString()})}
 ${h}
 ${N}`);return null}return r}catch(d){if(r)GN(r,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${d.message}`);return null}}function tF(E){let _=E.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(E.infrastructure.compute.managedServices)):void 0;if(_?.vitess?.password)_.vitess.password="";return{project:{name:E.project?.name,slug:E.project?.slug,region:E.project?.region},provider:E.provider,environments:Object.keys(E.environments??{}),compute:E.infrastructure?.compute?{provider:E.infrastructure.compute.provider,runtime:E.infrastructure.compute.runtime,webServer:E.infrastructure.compute.webServer,proxy:E.infrastructure.compute.proxy?{engine:E.infrastructure.compute.proxy.engine,onDemandTls:E.infrastructure.compute.proxy.onDemandTls,cdn:!!E.infrastructure.compute.proxy.cdn}:void 0,managedServices:_,sshKeys:ch(vA(E)).map((T)=>({name:T.name,type:T.type,fingerprint:T.fingerprint,added:T.added}))}:void 0,sites:Object.fromEntries(Object.entries(E.sites??{}).map(([T,r])=>[T,{domain:r.domain,path:r.path,type:r.type,deploy:r.deploy,root:r.root,port:r.port,ssl:r.ssl}]))}}function oD(E){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",E],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",E,"--yes"],mutates:!0,confirm:"deploy"}]}function RF(E,_){return oD(_).find((T)=>T.id===E)}function DG(E){if(E.length<=OG)return E;return`${E.slice(0,OG)}
 
-[output truncated]`}async function IG(E,_,T){let r=E.getReader(),d=new TextDecoder,t="";while(!0){let{done:h,value:N}=await r.read();if(h)break;let S=d.decode(N,{stream:!0});if(t+=S,S)T?.(_,S)}let R=d.decode();if(R)t+=R,T?.(_,R);return t}async function rF(E,_){let T=Bun.spawn([process.execPath,_.cliEntry,...E.command],{cwd:_.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,..._.env}}),r=()=>{try{T.kill()}catch{}};if(_.signal?.aborted)r();else _.signal?.addEventListener("abort",r,{once:!0});try{let[d,t,R]=await Promise.all([IG(T.stdout,"stdout",_.onOutput),IG(T.stderr,"stderr",_.onOutput),T.exited]);return{action:E.id,command:["cloud",...E.command].join(" "),exitCode:R,ok:R===0,stdout:DG(d),stderr:DG(t)}}finally{_.signal?.removeEventListener("abort",r)}}function op(){return Object.entries(process.env).filter(([E,_])=>!!_&&_.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(E)).map(([,E])=>E)}var Eo=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function _o(E){let _=qO(E);if(_&&_!==".html")return!1;let T=E.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(T==="/")return!1;return!Eo.has(T)}var To={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function CG(E,_){if(_.role==="admin")return!0;let T=qO(E);if(T&&T!==".html")return!0;if(_.organizationSource==="legacy")return!_o(E);let r=E.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/access-denied")return!0;let d=To[r];return!!d&&!!_.capabilities?.includes(d)}function ro(E,_){let T=decodeURIComponent(_).replace(/^\/+/,""),d=Bp(T===""?"index.html":T);if(d.startsWith("..")||d.includes("/../"))return null;let t=w_(E,d);if(cR(t)&&!eG(t).isDirectory())return t;if(!qO(t)&&cR(`${t}.html`))return`${t}.html`;if(!qO(t)&&cR(w_(t,"index.html")))return w_(t,"index.html");return null}async function wG(E,_){let T=ro(E,_);if(!T){let t=w_(E,"404.html");if(cR(t))return new Response(await Ot(t),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return pD("Not found",404)}if(eG(T).isDirectory())return pD("Not found",404);let r=await Ot(T),d=fp[qO(T)]??"application/octet-stream";return new Response(r,{headers:{"content-type":d}})}var mD=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"];async function E1(E={}){Mp();let _=E.cwd??process.cwd(),T=E.host??Yp,r=E.port??Qp,d=E.cliEntry??process.argv[1];if(E.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await kp(_);let t=E.config??await qU(),R=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,h=U_(t);if(R&&h&&!h.password)h.password=R;let N=t.infrastructure?.compute?.managedServices?.vitess;if(R&&N&&typeof N==="object"&&!N.password)N.password=R;let S=iE(_,t);if(S.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${S.reconciliation.failed} orphaned operation(s) as failed after restart.`);let A=Object.keys(t.environments??{}),L=xp(t,E.environment),O=up(_),c=await QN(t,L),$=new Map([[L,c]]),I=new Map([[L,Date.now()]]),C=new Map([[L,Date.now()]]),e=new Map,z=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),F=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),B=xT(t)!=="serverless",y=(J)=>{let XE=$.get(J);if(XE&&!cG(I.get(J),Date.now(),z))return Promise.resolve(XE);let YE=e.get(J);if(YE)return YE;let eE=!B||cG(C.get(J),Date.now(),F),ZE=QN(t,J,{includeSiteHealth:eE}).then((D_)=>{let G=$.get(J),yT=eE?D_:mp(G,D_);if($.set(J,yT),I.set(J,Date.now()),eE)C.set(J,Date.now());if(G?._serverReachable!==yT._serverReachable||G?._metricsStatus!==yT._metricsStatus||(G?.sitesDetail?.length??0)!==(yT.sitesDetail?.length??0))rE();return yT}).finally(()=>e.delete(J));return e.set(J,ZE),ZE},Y=UA(_),M=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(E.box&&M!=="0"&&(M==="1"||!t.cloud?.attachTo)){let J=!1,XE=Date.now()+300000,YE=async()=>{if(J)return;J=!0;try{let ZE=Date.now(),D_=ZE>=XE;if(D_)XE=ZE+300000;let G=S.environments.get(L);await VO({controlPlane:S.store,projectId:S.project.id,environmentId:G?.id,config:t,environment:L,force:!0,lightweight:!0,includeSiteHealth:D_})}catch(ZE){if(E.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${ZE instanceof Error?ZE.message:String(ZE)}`)}finally{J=!1}};YE(),setInterval(()=>void YE(),60000).unref?.()}let g=new Map,k=new Map,v=new Set,EE=0;function m(J,XE){if(J.role==="admin"&&!S.store.getActorByExternalId("user",`dashboard:${J.username.toLowerCase()}`))return J;let YE=S.store.getActorByExternalId("user",`dashboard:${J.username.toLowerCase()}`),eE=YE?S.store.getMembershipForActor(S.organization.id,YE.id):void 0;if(!eE||eE.status!=="active")return{...J,role:"member",sites:{},capabilities:[]};let ZE=S.store.listGrants(eE.id),D_=S.store.resolveAuthorizationTarget(S.organization.id,eE.scope)??S.store.resolveAuthorizationTarget(S.organization.id,{type:"project",id:S.project.id}),G=rS({membership:eE,grants:ZE,target:D_});if(eE.roleTemplate==="owner"||eE.roleTemplate==="admin")return{...J,role:"admin",sites:{},organizationRole:eE.roleTemplate,organizationSource:eE.source,capabilities:G};let yT=S.environments.get(XE),v_={};for(let vE of S.store.listResources(S.project.id,yT?.id).filter((pE)=>pE.kind==="application")){let pE=S.store.resolveAuthorizationTarget(S.organization.id,{type:"resource",id:vE.id});if(!pE||!Or({membership:eE,grants:ZE,capability:"project:read",target:pE}).allowed)continue;v_[vE.slug]=Or({membership:eE,grants:ZE,capability:"config:write",target:pE}).allowed?"owner":"collaborator"}return{...J,role:"member",sites:v_,organizationRole:eE.roleTemplate,organizationSource:eE.source,capabilities:G}}function rE(){EE+=1,g.clear();for(let J of v)GN(J,{recursive:!0,force:!0});v.clear()}let LE=(J,XE)=>`${XE}:${J.role==="admin"?"admin":`member:${Object.entries(J.sites).sort(([YE],[eE])=>YE.localeCompare(eE)).map(([YE,eE])=>`${YE}=${eE}`).join(",")}`}:${[...J.capabilities??[]].sort().join(",")}`;async function P(J,XE){let YE=m(J,XE),eE=LE(YE,XE),ZE=g.get(eE);if(ZE)return ZE;let D_=k.get(eE);if(D_)return D_;let G=EE,yT=(async()=>{let v_=$.get(XE)??await QN(t,XE);$.set(XE,v_);let vE={...lz(v_,{user:YE,slug:t.project.slug}),viewer:{role:YE.role,organizationRole:YE.organizationRole,organizationSource:YE.organizationSource,capabilities:YE.capabilities??[]}},pE=await pp(_,vE);if(pE&&G!==EE)return GN(pE,{recursive:!0,force:!0}),Y?.uiRoot;if(pE)v.add(pE);let UT=pE??Y?.uiRoot;if(UT)g.set(eE,UT);return UT})();k.set(eE,yT);try{return await yT}finally{k.delete(eE)}}let x=await P({username:"",passwordHash:"",role:"admin",sites:{}},L);if(!x)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let s=new WeakMap,TE=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",OE=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(OE&&E.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let RE=!OE,zE=w8(_),BE=RE?z8(_,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,dE=new Id(S.store,{encryptionKey:q_(_)}),yE=new ht(S.store),QE=new Oh(S.store),NE=new hN(S.store,{encryptionKey:q_(_)}),KE=new v0(S.store),A_=new i0(S.store,{cwd:_}),sE=new l0(S.store,{encryptionKey:q_(_)}),r_=new lE(S.store,{workerId:`dashboard:${process.pid}`}),W_=new oh(S.store),gT=new _N(S.store,q_(_)),PT=new pN(S.store),gd=new bS(W_,r_,gT),$d=t.project?.region??"us-east-1",bO=q_(_),_r=new tS(PT,{encryptionKey:bO,backends:[new MR(S.store,bO),new oN(new CT($d),$d),new ES(new Jt($d),$d),new _S]});await GL(_r,S,t);let N1=new Mr($d),ZG={aws_rds:new J0(new W0(N1)),aws_aurora:new z0(new H0(N1)),aws_elasticache:new F0(new P0(new vT($d))),server:new j0(new nt),container:new B0(new nt)},YF=(J)=>ZG[J.provider],l_=new HO(S.store),eh=new MA(l_,r_),QF=new PO(gT),qG={managed_database:new Dz(W_,N1),logical_database:new ez(W_,gT),volume:new Jz,files:new wz(_),control_plane:new Fz(S.store,_),infrastructure:new Bz(new jO($d))},gG=(J)=>qG[J.resourceKind],xG=(J)=>J.provider==="aws_backup"?void 0:QF,S1=new VR(S.store),A1=[new qh,new qL(f_(_,"volumes"))],$t=new ZL(S1,A1,r_),lA=new Tt(S.store),xd=new N0(lA,[new qt("aws"),new qt("hetzner"),new qt("ssh")],r_),DR=new A0(S.store),GF=new L0(DR,lA),Xh=new c0(S.store),MF=new U0(Xh,r_),Dt=new C0(S.store),L1=new w0(Dt,r_),fF=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((J)=>new e0(J,S.store,S.project.id,S.organization.id)),OT=new GA(S.store),KF=new WO(OT,{queue:r_}),b_=new Bt(S.store),IR=new jt(S.store),br=new rR(S.store),uE=new BA(S.store,{encryptionKey:q_(_)});for(let J of S.environments.values())QA(OT,t,{organization:S.organization,project:S.project,environment:J,resources:S.store.listResources(S.project.id,J.id)});let kr=new HA(uE,{emailImpl:async(J)=>{let{email:XE}=await Promise.resolve().then(() => (uN(),TL));return XE.send(J)}}),VF=async(J)=>{let XE=FO(uE,S.project.id,J),YE=[];for(let eE of XE.filter((ZE)=>ZE.notify&&ZE.alert))YE.push(...await kr.deliverAll(kr.enqueue(S.organization.id,eE.alert,eE.transition)));return YE.push(...await kr.deliverAll(kr.enqueueRemindersAndEscalations(S.organization.id,uE.listAlerts(S.project.id,{environmentId:J,states:["firing"]})))),YE.push(...await kr.retryDue()),{evaluations:XE,deliveries:YE}},O1=!1,bG=async()=>{if(O1)return;O1=!0;try{for(let J of S.environments.values())for(let XE of uE.listHealthChecks(S.project.id,J.id).filter((YE)=>YE.enabled)){let YE=uE.listHealthResults(XE.id,1)[0];if(YE&&Date.now()-new Date(YE.checkedAt).getTime()<XE.intervalSeconds*1000)continue;let eE=await new St(uE).runAndEvaluate(XE);for(let ZE of eE.evaluations.filter((D_)=>D_.notify&&D_.alert))await kr.deliverAll(kr.enqueue(S.organization.id,ZE.alert,ZE.transition))}}finally{O1=!1}},ZF=setInterval(()=>{for(let J of S.environments.values())VF(J.id).catch((XE)=>console.error("ts-cloud alert evaluation failed:",XE))},60000);ZF.unref?.();let qF=setInterval(()=>{bG().catch((J)=>console.error("ts-cloud health check evaluation failed:",J))},30000);qF.unref?.();let gF=setInterval(()=>{try{KF.tick()}catch(J){console.error("ts-cloud scheduled job evaluation failed:",J)}},30000);gF.unref?.();let xF=setInterval(()=>{try{eh.enqueueDue(),eh.enqueueRetention()}catch(J){console.error("ts-cloud backup policy evaluation failed:",J)}},30000);xF.unref?.(),b_.cleanup();let bF=setInterval(()=>{try{b_.cleanup()}catch(J){console.error("ts-cloud preview cleanup failed:",J)}},3600000);bF.unref?.();let kG=E.queueWorker??!0,uG=op(),vG=async(J,XE)=>{let eE=(J.environmentId?S.store.listEnvironments(J.projectId).find((ZE)=>ZE.id===J.environmentId):void 0)?.slug??String(L);if(XE.kind==="dashboard_operation"&&XE.operationId){let ZE=$.get(eE)??c,D_=NO(XE.operationId,t,ZE);if(!D_||D_.danger||!["scheduler","backup","worker"].includes(D_.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let G=await eA(t,eE,D_);return{ok:G.ok,stdout:G.stdout,stderr:G.stderr??G.error,retryable:/temporar|unavailable|timeout|network/i.test(G.stderr??G.error??""),output:{command:G.command??null,operation:G.operation}}}if(XE.kind==="serverless_scheduler"){let ZE=await _F(t,eE,"run");return{ok:ZE.ok,stdout:ZE.stdout,stderr:ZE.error,retryable:/temporar|unavailable|timeout|network/i.test(ZE.error??""),output:{command:ZE.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${XE.kind}.`}},kO=kG?new jw(r_,{...J6({store:S.store,execute:async(J,XE)=>{let YE=XE.operation.input&&typeof XE.operation.input==="object"&&!Array.isArray(XE.operation.input)?XE.operation.input:{},eE=YE.source&&typeof YE.source==="object"?YE.source:void 0,ZE=_,D_,G,yT;try{if(eE?.bindingId&&eE?.connectionId&&eE?.commitSha){let vE=NE.getBinding(String(eE.bindingId)),pE=NE.getConnection(String(eE.connectionId));if(!vE||!pE||vE.connectionId!==pE.id)throw Error("Queued source binding is no longer available");let dT=(vE.repositoryId?NE.getRepository(vE.repositoryId):NE.listRepositories(pE.id).find((qN)=>qN.fullName.toLowerCase()===vE.repositoryFullName.toLowerCase()))?.cloneUrl;if(!dT&&pE.provider==="generic_ssh")dT=`git@${new URL(pE.host).hostname}:${vE.repositoryFullName}.git`;if(!dT)dT=new URL(`/${vE.repositoryFullName}.git`,pE.host.endsWith("/")?pE.host:`${pE.host}/`).href;let AE=vE.deployKeyId?NE.getDeployKey(vE.deployKeyId):void 0,H_=AE&&vE.deployKeyId?{...AE,privateKey:NE.getDeployPrivateKey(vE.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(pE.provider)&&J.target.previewId){let qN=dh(pE,NE.getCredential(pE.id)),tE=b_.previews.getInstance(J.target.previewId);yT=async(ur,lO)=>{try{await qN.setCommitStatus(vE.repositoryFullName,String(eE.commitSha),{state:ur,url:tE?.url,description:lO})}catch(gN){XE.log(`Could not publish source status: ${gN instanceof Error?gN.message:String(gN)}`,{stream:"stderr"})}},await yT("pending",`Preview deployment started for ${String(eE.commitSha).slice(0,12)}`)}D_=dF(w_(sD(),"ts-cloud-queued-source-")),XE.log(`Checking out immutable source commit ${eE.commitSha}.`,{stream:"system"}),ZE=(await r2({remote:dT,binding:vE,destination:w_(D_,"checkout"),ref:String(eE.branch??vE.defaultBranch),commitSha:String(eE.commitSha)},{credential:NE.getCredential(pE.id),deployKey:H_})).directory}if(XE.operation.kind!=="preview.destroy"){let vE=J.target.previewId?b_.previews.getInstance(J.target.previewId):void 0,pE=vE?b_.previews.getDefinition(vE.definitionId):void 0,UT=XE.operation.resourceId?S.store.getResource(XE.operation.resourceId):void 0;if(G=await _r.resolve({projectId:S.project.id,environmentId:XE.operation.environmentId,resourceId:XE.operation.resourceId,functionId:UT?.kind==="function"?UT.id:void 0,previewId:vE?.id,trustedPreview:!!vE&&!vE.fork,allowedPreviewSecrets:pE?.inheritedSecrets}),G.warnings.some((dT)=>dT.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${G.warnings.filter((dT)=>dT.code==="missing_required").map((dT)=>dT.key).join(", ")}`);if(XE.operation.resourceId)for(let dT of Object.values(G.entries))PT.setDependency({entryId:dT.id,resourceId:XE.operation.resourceId,injectionTarget:"environment",required:dT.required,requiresRedeploy:!0});XE.log(`Resolved configuration ${G.configurationHash.slice(0,18)} for ${Object.keys(G.values).length} keys.`,{stream:"system"})}let v_=await rF(J,{cwd:ZE,cliEntry:d,signal:XE.signal,env:G?.values,onOutput:(vE,pE)=>XE.log(pE,{stream:vE,step:"execute",secrets:[...uG,...Object.entries(G?.entries??{}).filter(([,UT])=>UT.kind==="secret").map(([UT])=>G.values[UT]).filter(Boolean)]})});if(v_.ok&&XE.operation.resourceId&&G)for(let vE of Object.values(G.entries))PT.setDependency({entryId:vE.id,resourceId:XE.operation.resourceId,injectionTarget:"environment",required:vE.required,requiresRedeploy:!1,lastDeployedVersion:vE.version});return await yT?.(v_.ok?"success":"failure",v_.ok?`Preview is ready at ${String(eE?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(eE?.commitSha).slice(0,12)}`),v_}catch(v_){throw await yT?.("error",`Preview deployment could not complete at ${String(eE?.commitSha).slice(0,12)}`),v_}finally{if(D_)GN(D_,{recursive:!0,force:!0})}}}),...J9({store:OT,executor:vG}),...ry({store:W_,secrets:gT,resolveAdapter:YF}),...PP(lA,xd.drivers),...ZP(Xh,[new CX("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...sP({store:Dt,cleanup:fF}),...D6(S1,A1),...y9({store:l_,queue:r_,resolveSource:gG,resolveDestination:xG,validateHealth:async(J,XE)=>{if(!J.healthCheckId)return{healthy:!0,mode:"adapter"};let YE=uE.getHealthCheck(J.healthCheckId);if(!YE||YE.projectId!==J.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let eE=await new St(uE).runAndEvaluate(YE);return{healthy:eE.result.status==="healthy",healthCheckId:YE.id,healthResultId:eE.result.id,target:XE}}}),...nY({store:S.store,resolveDriver:E.releaseDriver??((J)=>({name:`${S.store.getResource(J.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:J.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(J,XE)=>{let YE=uE.listHealthChecks(XE.projectId,XE.environmentId).find((ZE)=>ZE.enabled&&ZE.name===J&&(!ZE.resourceId||ZE.resourceId===XE.resourceId));if(!YE)return{healthy:!1,message:`Named health gate ${J} was not found for this release.`};let eE=await new St(uE).runAndEvaluate(YE);return{healthy:eE.result.status==="healthy",evidence:{healthCheckId:YE.id,healthResultId:eE.result.id,status:eE.result.status,timings:eE.result.timings},message:eE.result.message}}})},{parallelism:E.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(J)=>console.error("ts-cloud deployment queue worker failed:",J)}):void 0;if(UO(S),ND(QE,Jr(S,String(L)),c),BE)_U(S,BE.users),B8(dE,S,BE.users);let Q_=F8({cwd:_,enabled:RE,secret:zE,authentication:dE,authorization:{store:S.store,organizationId:S.organization.id,projectId:S.project.id,defaultEnvironment:String(L)}}),i_=new Gz,kF=setInterval(()=>i_.sweep(),60000);kF.unref?.();let uO=new MO,c1=new MO(3,900000,900000),vO=new MO(8,900000,900000),uF=setInterval(()=>uO.prune(),300000),vF=setInterval(()=>c1.prune(),300000),nF=setInterval(()=>vO.prune(),300000);if(uF.unref?.(),vF.unref?.(),nF.unref?.(),RE){if(BE?.generated)console.warn(`
+[output truncated]`}async function IG(E,_,T){let r=E.getReader(),d=new TextDecoder,t="";while(!0){let{done:h,value:N}=await r.read();if(h)break;let S=d.decode(N,{stream:!0});if(t+=S,S)T?.(_,S)}let R=d.decode();if(R)t+=R,T?.(_,R);return t}async function rF(E,_){let T=Bun.spawn([process.execPath,_.cliEntry,...E.command],{cwd:_.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,..._.env}}),r=()=>{try{T.kill()}catch{}};if(_.signal?.aborted)r();else _.signal?.addEventListener("abort",r,{once:!0});try{let[d,t,R]=await Promise.all([IG(T.stdout,"stdout",_.onOutput),IG(T.stderr,"stderr",_.onOutput),T.exited]);return{action:E.id,command:["cloud",...E.command].join(" "),exitCode:R,ok:R===0,stdout:DG(d),stderr:DG(t)}}finally{_.signal?.removeEventListener("abort",r)}}function op(){return Object.entries(process.env).filter(([E,_])=>!!_&&_.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(E)).map(([,E])=>E)}var Eo=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function _o(E){let _=qO(E);if(_&&_!==".html")return!1;let T=E.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(T==="/")return!1;return!Eo.has(T)}var To={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function CG(E,_){if(_.role==="admin")return!0;let T=qO(E);if(T&&T!==".html")return!0;if(_.organizationSource==="legacy")return!_o(E);let r=E.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/access-denied")return!0;let d=To[r];return!!d&&!!_.capabilities?.includes(d)}function ro(E,_){let T=decodeURIComponent(_).replace(/^\/+/,""),d=Bp(T===""?"index.html":T);if(d.startsWith("..")||d.includes("/../"))return null;let t=w_(E,d);if(cR(t)&&!eG(t).isDirectory())return t;if(!qO(t)&&cR(`${t}.html`))return`${t}.html`;if(!qO(t)&&cR(w_(t,"index.html")))return w_(t,"index.html");return null}async function wG(E,_){let T=ro(E,_);if(!T){let t=w_(E,"404.html");if(cR(t))return new Response(await Ot(t),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return pD("Not found",404)}if(eG(T).isDirectory())return pD("Not found",404);let r=await Ot(T),d=fp[qO(T)]??"application/octet-stream";return new Response(r,{headers:{"content-type":d}})}var mD=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"];async function E1(E={}){Mp();let _=E.cwd??process.cwd(),T=E.host??Yp,r=E.port??Qp,d=E.cliEntry??process.argv[1];if(E.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await kp(_);let t=E.config??await qU(),R=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,h=U_(t);if(R&&h&&!h.password)h.password=R;let N=t.infrastructure?.compute?.managedServices?.vitess;if(R&&N&&typeof N==="object"&&!N.password)N.password=R;let S=iE(_,t);if(S.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${S.reconciliation.failed} orphaned operation(s) as failed after restart.`);let A=Object.keys(t.environments??{}),L=xp(t,E.environment),O=up(_),c=await QN(t,L),$=new Map([[L,c]]),I=new Map([[L,Date.now()]]),C=new Map([[L,Date.now()]]),e=new Map,z=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),F=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),B=xT(t)!=="serverless",y=(J)=>{let XE=$.get(J);if(XE&&!cG(I.get(J),Date.now(),z))return Promise.resolve(XE);let YE=e.get(J);if(YE)return YE;let eE=!B||cG(C.get(J),Date.now(),F),ZE=QN(t,J,{includeSiteHealth:eE}).then((D_)=>{let G=$.get(J),yT=eE?D_:mp(G,D_);if($.set(J,yT),I.set(J,Date.now()),eE)C.set(J,Date.now());if(G?._serverReachable!==yT._serverReachable||G?._metricsStatus!==yT._metricsStatus||(G?.sitesDetail?.length??0)!==(yT.sitesDetail?.length??0))rE();return yT}).finally(()=>e.delete(J));return e.set(J,ZE),ZE},Y=UA(_),M=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(E.box&&M!=="0"&&(M==="1"||!t.cloud?.attachTo)){let J=!1,XE=Date.now()+300000,YE=async()=>{if(J)return;J=!0;try{let ZE=Date.now(),D_=ZE>=XE;if(D_)XE=ZE+300000;let G=S.environments.get(L);await VO({controlPlane:S.store,projectId:S.project.id,environmentId:G?.id,config:t,environment:L,force:!0,lightweight:!0,includeSiteHealth:D_})}catch(ZE){if(E.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${ZE instanceof Error?ZE.message:String(ZE)}`)}finally{J=!1}};YE(),setInterval(()=>void YE(),60000).unref?.()}let g=new Map,k=new Map,v=new Set,EE=0;function m(J,XE){if(J.role==="admin"&&!S.store.getActorByExternalId("user",`dashboard:${J.username.toLowerCase()}`))return J;let YE=S.store.getActorByExternalId("user",`dashboard:${J.username.toLowerCase()}`),eE=YE?S.store.getMembershipForActor(S.organization.id,YE.id):void 0;if(!eE||eE.status!=="active")return{...J,role:"member",sites:{},capabilities:[]};let ZE=S.store.listGrants(eE.id),D_=S.store.resolveAuthorizationTarget(S.organization.id,eE.scope)??S.store.resolveAuthorizationTarget(S.organization.id,{type:"project",id:S.project.id}),G=rS({membership:eE,grants:ZE,target:D_});if(eE.roleTemplate==="owner"||eE.roleTemplate==="admin")return{...J,role:"admin",sites:{},organizationRole:eE.roleTemplate,organizationSource:eE.source,capabilities:G};let yT=S.environments.get(XE),v_={};for(let vE of S.store.listResources(S.project.id,yT?.id).filter((pE)=>pE.kind==="application")){let pE=S.store.resolveAuthorizationTarget(S.organization.id,{type:"resource",id:vE.id});if(!pE||!Or({membership:eE,grants:ZE,capability:"project:read",target:pE}).allowed)continue;v_[vE.slug]=Or({membership:eE,grants:ZE,capability:"config:write",target:pE}).allowed?"owner":"collaborator"}return{...J,role:"member",sites:v_,organizationRole:eE.roleTemplate,organizationSource:eE.source,capabilities:G}}function rE(){EE+=1,g.clear();for(let J of v)GN(J,{recursive:!0,force:!0});v.clear()}let LE=(J,XE)=>`${XE}:${J.role==="admin"?"admin":`member:${Object.entries(J.sites).sort(([YE],[eE])=>YE.localeCompare(eE)).map(([YE,eE])=>`${YE}=${eE}`).join(",")}`}:${[...J.capabilities??[]].sort().join(",")}`;async function P(J,XE){let YE=m(J,XE),eE=LE(YE,XE),ZE=g.get(eE);if(ZE)return ZE;let D_=k.get(eE);if(D_)return D_;let G=EE,yT=(async()=>{let v_=$.get(XE)??await QN(t,XE);$.set(XE,v_);let vE={...lz(v_,{user:YE,slug:t.project.slug}),viewer:{role:YE.role,organizationRole:YE.organizationRole,organizationSource:YE.organizationSource,capabilities:YE.capabilities??[]}},pE=await pp(_,vE);if(pE&&G!==EE)return GN(pE,{recursive:!0,force:!0}),Y?.uiRoot;if(pE)v.add(pE);let UT=pE??Y?.uiRoot;if(UT)g.set(eE,UT);return UT})();k.set(eE,yT);try{return await yT}finally{k.delete(eE)}}let x=await P({username:"",passwordHash:"",role:"admin",sites:{}},L);if(!x)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let s=new WeakMap,TE=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",OE=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(OE&&E.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let RE=!OE,zE=w8(_),BE=RE?z8(_,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,dE=new Id(S.store,{encryptionKey:q_(_)}),yE=new ht(S.store),QE=new Oh(S.store),NE=new hN(S.store,{encryptionKey:q_(_)}),KE=new v0(S.store),A_=new i0(S.store,{cwd:_}),sE=new l0(S.store,{encryptionKey:q_(_)}),r_=new lE(S.store,{workerId:`dashboard:${process.pid}`}),W_=new oh(S.store),gT=new _N(S.store,q_(_)),PT=new pN(S.store),gd=new bS(W_,r_,gT),$d=t.project?.region??"us-east-1",bO=q_(_),_r=new tS(PT,{encryptionKey:bO,backends:[new MR(S.store,bO),new oN(new CT($d),$d),new ES(new Jt($d),$d),new _S]});await GL(_r,S,t);let N1=new Mr($d),ZG={aws_rds:new J0(new W0(N1)),aws_aurora:new z0(new H0(N1)),aws_elasticache:new F0(new P0(new vT($d))),server:new j0(new nt),container:new B0(new nt)},YF=(J)=>ZG[J.provider],l_=new HO(S.store),eh=new MA(l_,r_),QF=new PO(gT),qG={managed_database:new Dz(W_,N1),logical_database:new ez(W_,gT),volume:new Jz,files:new wz(_),control_plane:new Fz(S.store,_),infrastructure:new Bz(new jO($d))},gG=(J)=>qG[J.resourceKind],xG=(J)=>J.provider==="aws_backup"?void 0:QF,S1=new VR(S.store),A1=[new qh,new qL(f_(_,"volumes"))],$t=new ZL(S1,A1,r_),lA=new Tt(S.store),xd=new N0(lA,[new qt("aws"),new qt("hetzner"),new qt("ssh")],r_),DR=new A0(S.store),GF=new L0(DR,lA),Xh=new c0(S.store),MF=new U0(Xh,r_),Dt=new C0(S.store),L1=new w0(Dt,r_),fF=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((J)=>new e0(J,S.store,S.project.id,S.organization.id)),OT=new GA(S.store),KF=new WO(OT,{queue:r_}),b_=new Bt(S.store),IR=new jt(S.store),br=new rR(S.store),uE=new BA(S.store,{encryptionKey:q_(_)});for(let J of S.environments.values())QA(OT,t,{organization:S.organization,project:S.project,environment:J,resources:S.store.listResources(S.project.id,J.id)});let kr=new HA(uE,{emailImpl:async(J)=>{let{email:XE}=await Promise.resolve().then(() => (uN(),TL));return XE.send(J)}}),VF=async(J)=>{let XE=FO(uE,S.project.id,J),YE=[];for(let eE of XE.filter((ZE)=>ZE.notify&&ZE.alert))YE.push(...await kr.deliverAll(kr.enqueue(S.organization.id,eE.alert,eE.transition)));return YE.push(...await kr.deliverAll(kr.enqueueRemindersAndEscalations(S.organization.id,uE.listAlerts(S.project.id,{environmentId:J,states:["firing"]})))),YE.push(...await kr.retryDue()),{evaluations:XE,deliveries:YE}},O1=!1,bG=async()=>{if(O1)return;O1=!0;try{for(let J of S.environments.values())for(let XE of uE.listHealthChecks(S.project.id,J.id).filter((YE)=>YE.enabled)){let YE=uE.listHealthResults(XE.id,1)[0];if(YE&&Date.now()-new Date(YE.checkedAt).getTime()<XE.intervalSeconds*1000)continue;let eE=await new St(uE).runAndEvaluate(XE);for(let ZE of eE.evaluations.filter((D_)=>D_.notify&&D_.alert))await kr.deliverAll(kr.enqueue(S.organization.id,ZE.alert,ZE.transition))}}finally{O1=!1}},ZF=setInterval(()=>{for(let J of S.environments.values())VF(J.id).catch((XE)=>console.error("ts-cloud alert evaluation failed:",XE))},60000);ZF.unref?.();let qF=setInterval(()=>{bG().catch((J)=>console.error("ts-cloud health check evaluation failed:",J))},30000);qF.unref?.();let gF=setInterval(()=>{try{KF.tick()}catch(J){console.error("ts-cloud scheduled job evaluation failed:",J)}},30000);gF.unref?.();let xF=setInterval(()=>{try{eh.enqueueDue(),eh.enqueueRetention()}catch(J){console.error("ts-cloud backup policy evaluation failed:",J)}},30000);xF.unref?.(),b_.cleanup();let bF=setInterval(()=>{try{b_.cleanup()}catch(J){console.error("ts-cloud preview cleanup failed:",J)}},3600000);bF.unref?.();let kG=E.queueWorker??!0,uG=op(),vG=async(J,XE)=>{let eE=(J.environmentId?S.store.listEnvironments(J.projectId).find((ZE)=>ZE.id===J.environmentId):void 0)?.slug??String(L);if(XE.kind==="dashboard_operation"&&XE.operationId){let ZE=$.get(eE)??c,D_=NO(XE.operationId,t,ZE);if(!D_||D_.danger||!["scheduler","backup","worker"].includes(D_.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let G=await eA(t,eE,D_);return{ok:G.ok,stdout:G.stdout,stderr:G.stderr??G.error,retryable:/temporar|unavailable|timeout|network/i.test(G.stderr??G.error??""),output:{command:G.command??null,operation:G.operation}}}if(XE.kind==="serverless_scheduler"){let ZE=await _F(t,eE,"run");return{ok:ZE.ok,stdout:ZE.stdout,stderr:ZE.error,retryable:/temporar|unavailable|timeout|network/i.test(ZE.error??""),output:{command:ZE.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${XE.kind}.`}},kO=kG?new jw(r_,{...J6({store:S.store,execute:async(J,XE)=>{let YE=XE.operation.input&&typeof XE.operation.input==="object"&&!Array.isArray(XE.operation.input)?XE.operation.input:{},eE=YE.source&&typeof YE.source==="object"?YE.source:void 0,ZE=_,D_,G,yT;try{if(eE?.bindingId&&eE?.connectionId&&eE?.commitSha){let vE=NE.getBinding(String(eE.bindingId)),pE=NE.getConnection(String(eE.connectionId));if(!vE||!pE||vE.connectionId!==pE.id)throw Error("Queued source binding is no longer available");let dT=(vE.repositoryId?NE.getRepository(vE.repositoryId):NE.listRepositories(pE.id).find((qN)=>qN.fullName.toLowerCase()===vE.repositoryFullName.toLowerCase()))?.cloneUrl;if(!dT&&pE.provider==="generic_ssh")dT=`git@${new URL(pE.host).hostname}:${vE.repositoryFullName}.git`;if(!dT)dT=new URL(`/${vE.repositoryFullName}.git`,pE.host.endsWith("/")?pE.host:`${pE.host}/`).href;let AE=vE.deployKeyId?NE.getDeployKey(vE.deployKeyId):void 0,H_=AE&&vE.deployKeyId?{...AE,privateKey:NE.getDeployPrivateKey(vE.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(pE.provider)&&J.target.previewId){let qN=dh(pE,NE.getCredential(pE.id)),tE=b_.previews.getInstance(J.target.previewId);yT=async(ur,lO)=>{try{await qN.setCommitStatus(vE.repositoryFullName,String(eE.commitSha),{state:ur,url:tE?.url,description:lO})}catch(gN){XE.log(`Could not publish source status: ${gN instanceof Error?gN.message:String(gN)}`,{stream:"stderr"})}},await yT("pending",`Preview deployment started for ${String(eE.commitSha).slice(0,12)}`)}D_=dF(w_(sD(),"ts-cloud-queued-source-")),XE.log(`Checking out immutable source commit ${eE.commitSha}.`,{stream:"system"}),ZE=(await r2({remote:dT,binding:vE,destination:w_(D_,"checkout"),ref:String(eE.branch??vE.defaultBranch),commitSha:String(eE.commitSha)},{credential:NE.getCredential(pE.id),deployKey:H_})).directory}if(XE.operation.kind!=="preview.destroy"){let vE=J.target.previewId?b_.previews.getInstance(J.target.previewId):void 0,pE=vE?b_.previews.getDefinition(vE.definitionId):void 0,UT=XE.operation.resourceId?S.store.getResource(XE.operation.resourceId):void 0;if(G=await _r.resolve({projectId:S.project.id,environmentId:XE.operation.environmentId,resourceId:XE.operation.resourceId,functionId:UT?.kind==="function"?UT.id:void 0,previewId:vE?.id,trustedPreview:!!vE&&!vE.fork,allowedPreviewSecrets:pE?.inheritedSecrets}),G.warnings.some((dT)=>dT.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${G.warnings.filter((dT)=>dT.code==="missing_required").map((dT)=>dT.key).join(", ")}`);if(XE.operation.resourceId)for(let dT of Object.values(G.entries))PT.setDependency({entryId:dT.id,resourceId:XE.operation.resourceId,injectionTarget:"environment",required:dT.required,requiresRedeploy:!0});XE.log(`Resolved configuration ${G.configurationHash.slice(0,18)} for ${Object.keys(G.values).length} keys.`,{stream:"system"})}let v_=await rF(J,{cwd:ZE,cliEntry:d,signal:XE.signal,env:G?.values,onOutput:(vE,pE)=>XE.log(pE,{stream:vE,step:"execute",secrets:[...uG,...Object.entries(G?.entries??{}).filter(([,UT])=>UT.kind==="secret").map(([UT])=>G.values[UT]).filter(Boolean)]})});if(v_.ok&&XE.operation.resourceId&&G)for(let vE of Object.values(G.entries))PT.setDependency({entryId:vE.id,resourceId:XE.operation.resourceId,injectionTarget:"environment",required:vE.required,requiresRedeploy:!1,lastDeployedVersion:vE.version});return await yT?.(v_.ok?"success":"failure",v_.ok?`Preview is ready at ${String(eE?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(eE?.commitSha).slice(0,12)}`),v_}catch(v_){throw await yT?.("error",`Preview deployment could not complete at ${String(eE?.commitSha).slice(0,12)}`),v_}finally{if(D_)GN(D_,{recursive:!0,force:!0})}}}),...JQ({store:OT,executor:vG}),...ry({store:W_,secrets:gT,resolveAdapter:YF}),...PP(lA,xd.drivers),...ZP(Xh,[new CX("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...sP({store:Dt,cleanup:fF}),...D6(S1,A1),...yQ({store:l_,queue:r_,resolveSource:gG,resolveDestination:xG,validateHealth:async(J,XE)=>{if(!J.healthCheckId)return{healthy:!0,mode:"adapter"};let YE=uE.getHealthCheck(J.healthCheckId);if(!YE||YE.projectId!==J.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let eE=await new St(uE).runAndEvaluate(YE);return{healthy:eE.result.status==="healthy",healthCheckId:YE.id,healthResultId:eE.result.id,target:XE}}}),...nY({store:S.store,resolveDriver:E.releaseDriver??((J)=>({name:`${S.store.getResource(J.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:J.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(J,XE)=>{let YE=uE.listHealthChecks(XE.projectId,XE.environmentId).find((ZE)=>ZE.enabled&&ZE.name===J&&(!ZE.resourceId||ZE.resourceId===XE.resourceId));if(!YE)return{healthy:!1,message:`Named health gate ${J} was not found for this release.`};let eE=await new St(uE).runAndEvaluate(YE);return{healthy:eE.result.status==="healthy",evidence:{healthCheckId:YE.id,healthResultId:eE.result.id,status:eE.result.status,timings:eE.result.timings},message:eE.result.message}}})},{parallelism:E.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(J)=>console.error("ts-cloud deployment queue worker failed:",J)}):void 0;if(UO(S),ND(QE,Jr(S,String(L)),c),BE)_U(S,BE.users),B8(dE,S,BE.users);let Q_=F8({cwd:_,enabled:RE,secret:zE,authentication:dE,authorization:{store:S.store,organizationId:S.organization.id,projectId:S.project.id,defaultEnvironment:String(L)}}),i_=new Gz,kF=setInterval(()=>i_.sweep(),60000);kF.unref?.();let uO=new MO,c1=new MO(3,900000,900000),vO=new MO(8,900000,900000),uF=setInterval(()=>uO.prune(),300000),vF=setInterval(()=>c1.prune(),300000),nF=setInterval(()=>vO.prune(),300000);if(uF.unref?.(),vF.unref?.(),nF.unref?.(),RE){if(BE?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${BE.generated.username}
     password: ${BE.generated.password}
@@ -10281,7 +10281,7 @@ data: ${JSON.stringify({state:$E.state,cursor:j})}
 
 This link expires ${f.invitation.expiresAt} and can be used once.`});return X({invitation:f.invitation,token:f.token,acceptUrl:q,delivered:K},201)}catch(f){return X({ok:!1,error:f instanceof Error?f.message:"Invitation could not be created."},422)}}if(G.pathname==="/api/organization/invitations"&&J.method==="DELETE"){let D=await a(J),w=WE(tE);try{return X({invitation:S.store.revokeInvitation(String(D.id??""),w.actor?.id)})}catch(j){return X({ok:!1,error:j instanceof Error?j.message:"Invitation could not be revoked."},409)}}if(G.pathname==="/api/organization/invitations/resend"&&J.method==="POST"){let D=await a(J),w=WE(tE);try{let j=S.store.reissueInvitation(String(D.id??""),w.actor?.id),H=`${G.origin}/accept-invitation?token=${encodeURIComponent(j.token)}`,f=await rL(t,{to:j.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${H}
 
-This replacement link expires ${j.invitation.expiresAt} and can be used once.`});return X({invitation:j.invitation,token:j.token,acceptUrl:H,delivered:f})}catch(j){return X({ok:!1,error:j instanceof Error?j.message:"Invitation could not be resent."},409)}}if(G.pathname==="/api/organization/memberships"&&J.method==="PATCH"){let D=await a(J),w=S.store.getMembership(String(D.id??"")),j=aD(D.roleTemplate),H=ZO(D);if(!w||w.organizationId!==S.organization.id)return X({ok:!1,error:"Membership was not found."},404);if(!j||!H)return X({ok:!1,error:"Choose a valid role template and resource scope."},422);let f=WE(tE);if((w.roleTemplate==="owner"||j==="owner")&&(!Kd(String(D.password??""),tE.passwordHash)||f.membership?.roleTemplate!=="owner"))return X({ok:!1,error:"Ownership changes require an owner to re-enter their password."},401);let K=S.store.resolveAuthorizationTarget(S.organization.id,H)??S.store.resolveAuthorizationTarget(S.organization.id,{type:"project",id:S.project.id}),u=S.store.listGrants(w.id),SE=rS({membership:w,grants:u,target:K}),IE={...w,roleTemplate:j,scope:H},d_=rS({membership:IE,grants:u,target:K}),$E={gained:d_.filter((HE)=>!SE.includes(HE)),lost:SE.filter((HE)=>!d_.includes(HE))};if(D.preview===!0)return X({membership:w,proposed:{roleTemplate:j,scope:H},accessDiff:$E});if(String(D.confirm??"")!==w.id)return X({ok:!1,error:`Confirm this change with membership ID ${w.id}.`,accessDiff:$E},409);try{return X({membership:S.store.updateMembership({id:w.id,roleTemplate:j,scope:H,actorId:f.actor?.id}),accessDiff:$E})}catch(HE){return X({ok:!1,error:HE instanceof Error?HE.message:"Membership could not be updated."},409)}}if(G.pathname==="/api/organization/memberships"&&J.method==="DELETE"){let D=await a(J),w=S.store.getMembership(String(D.id??""));if(!w||w.organizationId!==S.organization.id)return X({ok:!1,error:"Membership was not found."},404);if(String(D.confirm??"")!==w.id)return X({ok:!1,error:`Confirm removal with membership ID ${w.id}.`},409);let j=WE(tE);if(w.roleTemplate==="owner"&&(j.membership?.roleTemplate!=="owner"||!Kd(String(D.password??""),tE.passwordHash)))return X({ok:!1,error:"Removing an owner requires an owner to re-enter their current password."},401);try{return X({membership:S.store.revokeMembership(w.id,j.actor?.id)})}catch(H){return X({ok:!1,error:H instanceof Error?H.message:"Membership could not be removed."},409)}}if(G.pathname==="/api/organization/grants"&&J.method==="POST"){let D=await a(J),w=String(D.capability??""),j=D.effect==="deny"?"deny":D.effect==="allow"?"allow":void 0,H=ZO(D),f=WE(tE);if(!j||!H||!Lr.includes(w))return X({ok:!1,error:"Choose a valid capability, effect, and resource scope."},422);try{return X({grant:S.store.upsertGrant({organizationId:S.organization.id,membershipId:String(D.membershipId??""),effect:j,capability:w,scope:H,actorId:f.actor?.id})},201)}catch(q){return X({ok:!1,error:q instanceof Error?q.message:"Grant could not be created."},422)}}if(G.pathname==="/api/organization/grants"&&J.method==="DELETE"){let D=await a(J),w=WE(tE),j=S.store.getGrant(String(D.id??""));if(!j||j.organizationId!==S.organization.id)return X({ok:!1,error:"Grant was not found."},404);return X({ok:S.store.removeGrant(j.id,w.actor?.id)})}if(G.pathname==="/api/tags"&&J.method==="GET")return X({tags:S.store.listTags(S.project.id),assignments:S.store.listResourceTags(S.project.id)});if(G.pathname==="/api/tags"&&J.method==="POST"){let D=await a(J),w=S.store.upsertTag(S.project.id,String(D.name??""),String(D.color??"#5a8be0"));if(D.resourceId)S.store.assignTag(String(D.resourceId),w.id);return X({tag:w},201)}if(G.pathname==="/api/tags"&&J.method==="DELETE"){let D=await a(J);return S.store.removeTag(String(D.resourceId??""),String(D.tagId??"")),X({ok:!0})}if(G.pathname==="/"&&!CG(G.pathname,ur))return new Response(null,{status:302,headers:{location:`/server/sites?env=${encodeURIComponent(AE)}`}});if(G.pathname==="/"&&H_?.mode==="serverless")return new Response(null,{status:302,headers:{location:`/serverless?env=${encodeURIComponent(AE)}`}});let lO=Y8(G.pathname);if(lO)return new Response(null,{status:308,headers:{location:`${lO}?env=${encodeURIComponent(AE)}`}});if(G.pathname==="/api/env"&&J.method==="POST"){let D=await a(J),w=String(D.env??"");if(!A.includes(w))return X({ok:!1,error:`Unknown environment '${w}'.`,environments:A},404);return X({ok:!0,environment:w,environments:A,href:`?env=${encodeURIComponent(w)}`})}if(G.pathname==="/api/config"){let D={...tF(t),environment:AE,environments:A};return X(G8(D,ur))}if(G.pathname==="/api/ssh-keys"&&J.method==="GET")return X({configPath:O,keys:ch(vA(t))});if(G.pathname==="/api/ssh-keys"&&J.method==="POST"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=await Ot(O,"utf8"),j=vA(t),H=XQ({configText:w,name:String(D.name??""),publicKey:String(D.publicKey??""),existingKeys:j});return await YN(O,H),UG(t,[...j,{name:String(D.name??"").trim(),publicKey:String(D.publicKey??"").trim().replace(/\s+/g," ")}]),X({ok:!0,configPath:O,keys:ch(vA(t))})}if(G.pathname==="/api/ssh-keys"&&J.method==="DELETE"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=String(D.name??G.searchParams.get("name")??""),j=await Ot(O,"utf8"),H=vA(t),f=JQ({configText:j,name:w,existingKeys:H});return await YN(O,f),UG(t,H.filter((q)=>q.name!==w.trim())),X({ok:!0,configPath:O,keys:ch(vA(t))})}if(G.pathname==="/api/firewall"&&J.method==="GET")return X({configPath:O,alwaysOpen:[22,80,443],ports:TF(t)});if(G.pathname==="/api/firewall"&&J.method==="POST"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=Number(D.port);if(!fO(w))return X({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let j=TF(t),H=await Ot(O,"utf8");try{await YN(O,g8(H,w,j))}catch(K){return X({ok:!1,error:K?.message??String(K)},422)}let f=yN([...j,w]);$G(t,f);let q=D.apply===!1?null:await IN(t,AE,`ufw allow ${w}/tcp`).catch((K)=>({ok:!1,error:String(K?.message??K)}));return X({ok:!0,configPath:O,ports:f,apply:q})}if(G.pathname==="/api/firewall"&&J.method==="DELETE"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=Number(D.port??G.searchParams.get("port"));if(!fO(w))return X({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let j=TF(t),H=await Ot(O,"utf8");await YN(O,x8(H,w,j));let f=yN(j.filter((K)=>K!==w));$G(t,f);let q=D.apply===!1?null:await IN(t,AE,`ufw delete allow ${w}/tcp`).catch((K)=>({ok:!1,error:String(K?.message??K)}));return X({ok:!0,configPath:O,ports:f,apply:q})}if(G.pathname==="/api/sites"&&J.method==="POST"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=String(D.name??"").trim(),j=String(D.root??"").trim();if(!w||!j)return X({ok:!1,error:"Site name and root are required."},422);let H={deploy:D.deploy==="bucket"?"bucket":"server",root:j,path:String(D.path??"").trim()||void 0,domain:String(D.domain??"").trim()||void 0,build:String(D.build??"").trim()||void 0,start:String(D.start??"").trim()||void 0,port:D.port?Number(D.port):void 0,type:String(D.type??"").trim()||void 0};if(H.port!==void 0&&(!Number.isInteger(H.port)||H.port<1||H.port>65535))return X({ok:!1,error:"Port must be a number between 1 and 65535."},422);let f=await Ot(O,"utf8"),q=kU({configText:f,name:w,root:H.root,domain:H.domain,path:H.path,deploy:H.deploy,build:H.build,start:H.start,port:H.port,type:H.type});return await YN(O,q),vp(t,w,Object.fromEntries(Object.entries(H).filter(([,K])=>K!==void 0))),H_=await QN(t,AE),$.set(AE,H_),X({ok:!0,configPath:O,site:w,data:H_})}if(G.pathname==="/api/sites"&&J.method==="DELETE"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=String(D.name??G.searchParams.get("name")??"").trim();if(!w||!t.sites?.[w])return X({ok:!1,error:`Site '${w}' was not found.`},404);let j=await Ot(O,"utf8");return await YN(O,oH({configText:j,name:w})),delete t.sites[w],H_=await QN(t,AE),$.set(AE,H_),X({ok:!0,configPath:O,site:w,data:H_})}if(G.pathname==="/api/sites"&&J.method==="PATCH"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=String(D.name??"").trim(),j=t.sites?.[w];if(!w||!j)return X({ok:!1,error:`Site '${w}' was not found.`},404);if(ur.role==="member"){let q=K8(D);if(!q.ok)return X({ok:!1,error:q.error},403);let K=V8({siteName:w,body:D,sites:t.sites??{},ownSites:Object.keys(ur.sites)});if(!K.ok)return X({ok:!1,error:K.error},409)}if(D.port!==void 0&&D.port!==null&&D.port!==""&&(!Number.isInteger(Number(D.port))||Number(D.port)<1||Number(D.port)>65535))return X({ok:!1,error:"Port must be a number between 1 and 65535."},422);if(typeof D.domain==="string"&&D.domain.trim()&&!Ye(D.domain.trim()))return X({ok:!1,error:`Domain '${D.domain.trim()}' is not a valid hostname.`},422);let H=await Ot(O,"utf8"),f=(q,K)=>{H=EP({configText:H,siteName:w,key:q,valueText:K})};if(D.ssl!==void 0)f("ssl",_P(D.ssl)),j.ssl=D.ssl;if(D.env!==void 0&&D.env&&typeof D.env==="object")f("env",rP(D.env)),j.env=D.env;if(D.aliases!==void 0&&Array.isArray(D.aliases)){let q=D.aliases.map((K)=>String(K));f("aliases",dP(q)),j.aliases=q.map((K)=>K.trim().toLowerCase()).filter(Boolean)}if(D.redirects!==void 0&&D.redirects&&typeof D.redirects==="object")f("redirects",tP(D.redirects)),j.redirects=D.redirects;for(let q of["domain","path","build","start","type","root","php"])if(typeof D[q]==="string"&&D[q].trim())f(q,TP(String(D[q]).trim())),j[q]=String(D[q]).trim();if(D.port!==void 0&&D.port!==null&&D.port!=="")f("port",String(Number(D.port))),j.port=Number(D.port);return await YN(O,H),H_=await QN(t,AE),$.set(AE,H_),X({ok:!0,configPath:O,site:w,data:H_})}if(G.pathname==="/api/sites/deploy"&&J.method==="POST"){let D=await a(J),w=String(D.name??"").trim();if(!w||!t.sites?.[w])return X({ok:!1,error:`Site '${w}' was not found.`},404);if(D.confirm!==w)return X({ok:!1,error:`Type "${w}" to deploy this site.`},409);let j=Jr(S,String(AE));await new XN(QE).run(new OO,{...j,artifactRoot:_}),ND(QE,j,H_??{});let H=JN(QE,{scope:j,desiredConfigHash:S.project.desiredConfigHash});if(H.decision.outcome==="block")return X({ok:!1,error:`Deployment blocked by security policy: ${H.decision.explanation}`,securityReview:H},409);let f={id:`deploy:${w}`,label:`Deploy ${w}`,description:`Deploy the ${w} site for ${AE}.`,command:["deploy","--env",AE,"--site",w,"--yes"],mutates:!0},q=await Wt({controlPlane:S,environment:AE,actor:tE,kind:"dashboard.site.deploy",resourceSlug:w,input:{site:w},execute:()=>rF(f,{cwd:_,cliEntry:d})});return X({...q.result,controlPlaneOperation:q.operation,securityReview:H})}if(G.pathname==="/api/actions")return X(oD(AE));if(G.pathname==="/api/server/operations")return X(wA(t,H_));if(G.pathname==="/api/runtime/workloads"&&J.method==="GET"){let D=await fd(t,AE);return X(D)}if(G.pathname==="/api/runtime/logs"&&J.method==="GET"){let D=String(G.searchParams.get("workload")??"");if(!D)return X({ok:!1,error:"A workload query parameter is required."},422);let w=Math.min(1000,Math.max(1,Number(G.searchParams.get("limit"))||200));try{return X(await new xr(t,AE).logs(D,{limit:w}))}catch(j){return X({ok:!1,error:String(j?.message??j)},404)}}if(G.pathname==="/api/runtime/log-sessions"&&J.method==="POST"){let D=await a(J),w=String(D.workloadId??"");if(!w)return X({ok:!1,error:"A workloadId is required."},422);let j=await fd(t,AE),H=j.workloads.find((K)=>K.id===w);if(!H)return X({ok:!1,error:"Workload was not found in the current project and environment."},404);if(!H.capabilities.logs.supported)return X({ok:!1,error:H.capabilities.logs.reason??"Logs are unsupported for this workload."},409);let f=new xr(t,AE,{inventory:async()=>j}),q=i_.create("logs",w);return(async()=>{let K=new Date(Date.now()-Math.min(3600000,Math.max(1000,Number(D.sinceMs)||60000)));try{for(let u=0;u<200&&!i_.signal(q.id)?.aborted;u++){let SE=await f.logs(w,{limit:Math.min(500,Math.max(1,Number(D.limit)||200)),since:K});for(let IE of SE.lines)if(i_.append(q.id,`${IE.timestamp?`${IE.timestamp} `:""}${IE.message}
+This replacement link expires ${j.invitation.expiresAt} and can be used once.`});return X({invitation:j.invitation,token:j.token,acceptUrl:H,delivered:f})}catch(j){return X({ok:!1,error:j instanceof Error?j.message:"Invitation could not be resent."},409)}}if(G.pathname==="/api/organization/memberships"&&J.method==="PATCH"){let D=await a(J),w=S.store.getMembership(String(D.id??"")),j=aD(D.roleTemplate),H=ZO(D);if(!w||w.organizationId!==S.organization.id)return X({ok:!1,error:"Membership was not found."},404);if(!j||!H)return X({ok:!1,error:"Choose a valid role template and resource scope."},422);let f=WE(tE);if((w.roleTemplate==="owner"||j==="owner")&&(!Kd(String(D.password??""),tE.passwordHash)||f.membership?.roleTemplate!=="owner"))return X({ok:!1,error:"Ownership changes require an owner to re-enter their password."},401);let K=S.store.resolveAuthorizationTarget(S.organization.id,H)??S.store.resolveAuthorizationTarget(S.organization.id,{type:"project",id:S.project.id}),u=S.store.listGrants(w.id),SE=rS({membership:w,grants:u,target:K}),IE={...w,roleTemplate:j,scope:H},d_=rS({membership:IE,grants:u,target:K}),$E={gained:d_.filter((HE)=>!SE.includes(HE)),lost:SE.filter((HE)=>!d_.includes(HE))};if(D.preview===!0)return X({membership:w,proposed:{roleTemplate:j,scope:H},accessDiff:$E});if(String(D.confirm??"")!==w.id)return X({ok:!1,error:`Confirm this change with membership ID ${w.id}.`,accessDiff:$E},409);try{return X({membership:S.store.updateMembership({id:w.id,roleTemplate:j,scope:H,actorId:f.actor?.id}),accessDiff:$E})}catch(HE){return X({ok:!1,error:HE instanceof Error?HE.message:"Membership could not be updated."},409)}}if(G.pathname==="/api/organization/memberships"&&J.method==="DELETE"){let D=await a(J),w=S.store.getMembership(String(D.id??""));if(!w||w.organizationId!==S.organization.id)return X({ok:!1,error:"Membership was not found."},404);if(String(D.confirm??"")!==w.id)return X({ok:!1,error:`Confirm removal with membership ID ${w.id}.`},409);let j=WE(tE);if(w.roleTemplate==="owner"&&(j.membership?.roleTemplate!=="owner"||!Kd(String(D.password??""),tE.passwordHash)))return X({ok:!1,error:"Removing an owner requires an owner to re-enter their current password."},401);try{return X({membership:S.store.revokeMembership(w.id,j.actor?.id)})}catch(H){return X({ok:!1,error:H instanceof Error?H.message:"Membership could not be removed."},409)}}if(G.pathname==="/api/organization/grants"&&J.method==="POST"){let D=await a(J),w=String(D.capability??""),j=D.effect==="deny"?"deny":D.effect==="allow"?"allow":void 0,H=ZO(D),f=WE(tE);if(!j||!H||!Lr.includes(w))return X({ok:!1,error:"Choose a valid capability, effect, and resource scope."},422);try{return X({grant:S.store.upsertGrant({organizationId:S.organization.id,membershipId:String(D.membershipId??""),effect:j,capability:w,scope:H,actorId:f.actor?.id})},201)}catch(q){return X({ok:!1,error:q instanceof Error?q.message:"Grant could not be created."},422)}}if(G.pathname==="/api/organization/grants"&&J.method==="DELETE"){let D=await a(J),w=WE(tE),j=S.store.getGrant(String(D.id??""));if(!j||j.organizationId!==S.organization.id)return X({ok:!1,error:"Grant was not found."},404);return X({ok:S.store.removeGrant(j.id,w.actor?.id)})}if(G.pathname==="/api/tags"&&J.method==="GET")return X({tags:S.store.listTags(S.project.id),assignments:S.store.listResourceTags(S.project.id)});if(G.pathname==="/api/tags"&&J.method==="POST"){let D=await a(J),w=S.store.upsertTag(S.project.id,String(D.name??""),String(D.color??"#5a8be0"));if(D.resourceId)S.store.assignTag(String(D.resourceId),w.id);return X({tag:w},201)}if(G.pathname==="/api/tags"&&J.method==="DELETE"){let D=await a(J);return S.store.removeTag(String(D.resourceId??""),String(D.tagId??"")),X({ok:!0})}if(G.pathname==="/"&&!CG(G.pathname,ur))return new Response(null,{status:302,headers:{location:`/server/sites?env=${encodeURIComponent(AE)}`}});if(G.pathname==="/"&&H_?.mode==="serverless")return new Response(null,{status:302,headers:{location:`/serverless?env=${encodeURIComponent(AE)}`}});let lO=Y8(G.pathname);if(lO)return new Response(null,{status:308,headers:{location:`${lO}?env=${encodeURIComponent(AE)}`}});if(G.pathname==="/api/env"&&J.method==="POST"){let D=await a(J),w=String(D.env??"");if(!A.includes(w))return X({ok:!1,error:`Unknown environment '${w}'.`,environments:A},404);return X({ok:!0,environment:w,environments:A,href:`?env=${encodeURIComponent(w)}`})}if(G.pathname==="/api/config"){let D={...tF(t),environment:AE,environments:A};return X(G8(D,ur))}if(G.pathname==="/api/ssh-keys"&&J.method==="GET")return X({configPath:O,keys:ch(vA(t))});if(G.pathname==="/api/ssh-keys"&&J.method==="POST"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=await Ot(O,"utf8"),j=vA(t),H=X9({configText:w,name:String(D.name??""),publicKey:String(D.publicKey??""),existingKeys:j});return await YN(O,H),UG(t,[...j,{name:String(D.name??"").trim(),publicKey:String(D.publicKey??"").trim().replace(/\s+/g," ")}]),X({ok:!0,configPath:O,keys:ch(vA(t))})}if(G.pathname==="/api/ssh-keys"&&J.method==="DELETE"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=String(D.name??G.searchParams.get("name")??""),j=await Ot(O,"utf8"),H=vA(t),f=J9({configText:j,name:w,existingKeys:H});return await YN(O,f),UG(t,H.filter((q)=>q.name!==w.trim())),X({ok:!0,configPath:O,keys:ch(vA(t))})}if(G.pathname==="/api/firewall"&&J.method==="GET")return X({configPath:O,alwaysOpen:[22,80,443],ports:TF(t)});if(G.pathname==="/api/firewall"&&J.method==="POST"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=Number(D.port);if(!fO(w))return X({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let j=TF(t),H=await Ot(O,"utf8");try{await YN(O,g8(H,w,j))}catch(K){return X({ok:!1,error:K?.message??String(K)},422)}let f=yN([...j,w]);$G(t,f);let q=D.apply===!1?null:await IN(t,AE,`ufw allow ${w}/tcp`).catch((K)=>({ok:!1,error:String(K?.message??K)}));return X({ok:!0,configPath:O,ports:f,apply:q})}if(G.pathname==="/api/firewall"&&J.method==="DELETE"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=Number(D.port??G.searchParams.get("port"));if(!fO(w))return X({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let j=TF(t),H=await Ot(O,"utf8");await YN(O,x8(H,w,j));let f=yN(j.filter((K)=>K!==w));$G(t,f);let q=D.apply===!1?null:await IN(t,AE,`ufw delete allow ${w}/tcp`).catch((K)=>({ok:!1,error:String(K?.message??K)}));return X({ok:!0,configPath:O,ports:f,apply:q})}if(G.pathname==="/api/sites"&&J.method==="POST"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=String(D.name??"").trim(),j=String(D.root??"").trim();if(!w||!j)return X({ok:!1,error:"Site name and root are required."},422);let H={deploy:D.deploy==="bucket"?"bucket":"server",root:j,path:String(D.path??"").trim()||void 0,domain:String(D.domain??"").trim()||void 0,build:String(D.build??"").trim()||void 0,start:String(D.start??"").trim()||void 0,port:D.port?Number(D.port):void 0,type:String(D.type??"").trim()||void 0};if(H.port!==void 0&&(!Number.isInteger(H.port)||H.port<1||H.port>65535))return X({ok:!1,error:"Port must be a number between 1 and 65535."},422);let f=await Ot(O,"utf8"),q=kU({configText:f,name:w,root:H.root,domain:H.domain,path:H.path,deploy:H.deploy,build:H.build,start:H.start,port:H.port,type:H.type});return await YN(O,q),vp(t,w,Object.fromEntries(Object.entries(H).filter(([,K])=>K!==void 0))),H_=await QN(t,AE),$.set(AE,H_),X({ok:!0,configPath:O,site:w,data:H_})}if(G.pathname==="/api/sites"&&J.method==="DELETE"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=String(D.name??G.searchParams.get("name")??"").trim();if(!w||!t.sites?.[w])return X({ok:!1,error:`Site '${w}' was not found.`},404);let j=await Ot(O,"utf8");return await YN(O,oH({configText:j,name:w})),delete t.sites[w],H_=await QN(t,AE),$.set(AE,H_),X({ok:!0,configPath:O,site:w,data:H_})}if(G.pathname==="/api/sites"&&J.method==="PATCH"){if(!O)return X({ok:!1,error:"No cloud config file was found in this checkout."},404);let D=await a(J),w=String(D.name??"").trim(),j=t.sites?.[w];if(!w||!j)return X({ok:!1,error:`Site '${w}' was not found.`},404);if(ur.role==="member"){let q=K8(D);if(!q.ok)return X({ok:!1,error:q.error},403);let K=V8({siteName:w,body:D,sites:t.sites??{},ownSites:Object.keys(ur.sites)});if(!K.ok)return X({ok:!1,error:K.error},409)}if(D.port!==void 0&&D.port!==null&&D.port!==""&&(!Number.isInteger(Number(D.port))||Number(D.port)<1||Number(D.port)>65535))return X({ok:!1,error:"Port must be a number between 1 and 65535."},422);if(typeof D.domain==="string"&&D.domain.trim()&&!Ye(D.domain.trim()))return X({ok:!1,error:`Domain '${D.domain.trim()}' is not a valid hostname.`},422);let H=await Ot(O,"utf8"),f=(q,K)=>{H=EP({configText:H,siteName:w,key:q,valueText:K})};if(D.ssl!==void 0)f("ssl",_P(D.ssl)),j.ssl=D.ssl;if(D.env!==void 0&&D.env&&typeof D.env==="object")f("env",rP(D.env)),j.env=D.env;if(D.aliases!==void 0&&Array.isArray(D.aliases)){let q=D.aliases.map((K)=>String(K));f("aliases",dP(q)),j.aliases=q.map((K)=>K.trim().toLowerCase()).filter(Boolean)}if(D.redirects!==void 0&&D.redirects&&typeof D.redirects==="object")f("redirects",tP(D.redirects)),j.redirects=D.redirects;for(let q of["domain","path","build","start","type","root","php"])if(typeof D[q]==="string"&&D[q].trim())f(q,TP(String(D[q]).trim())),j[q]=String(D[q]).trim();if(D.port!==void 0&&D.port!==null&&D.port!=="")f("port",String(Number(D.port))),j.port=Number(D.port);return await YN(O,H),H_=await QN(t,AE),$.set(AE,H_),X({ok:!0,configPath:O,site:w,data:H_})}if(G.pathname==="/api/sites/deploy"&&J.method==="POST"){let D=await a(J),w=String(D.name??"").trim();if(!w||!t.sites?.[w])return X({ok:!1,error:`Site '${w}' was not found.`},404);if(D.confirm!==w)return X({ok:!1,error:`Type "${w}" to deploy this site.`},409);let j=Jr(S,String(AE));await new XN(QE).run(new OO,{...j,artifactRoot:_}),ND(QE,j,H_??{});let H=JN(QE,{scope:j,desiredConfigHash:S.project.desiredConfigHash});if(H.decision.outcome==="block")return X({ok:!1,error:`Deployment blocked by security policy: ${H.decision.explanation}`,securityReview:H},409);let f={id:`deploy:${w}`,label:`Deploy ${w}`,description:`Deploy the ${w} site for ${AE}.`,command:["deploy","--env",AE,"--site",w,"--yes"],mutates:!0},q=await Wt({controlPlane:S,environment:AE,actor:tE,kind:"dashboard.site.deploy",resourceSlug:w,input:{site:w},execute:()=>rF(f,{cwd:_,cliEntry:d})});return X({...q.result,controlPlaneOperation:q.operation,securityReview:H})}if(G.pathname==="/api/actions")return X(oD(AE));if(G.pathname==="/api/server/operations")return X(wA(t,H_));if(G.pathname==="/api/runtime/workloads"&&J.method==="GET"){let D=await fd(t,AE);return X(D)}if(G.pathname==="/api/runtime/logs"&&J.method==="GET"){let D=String(G.searchParams.get("workload")??"");if(!D)return X({ok:!1,error:"A workload query parameter is required."},422);let w=Math.min(1000,Math.max(1,Number(G.searchParams.get("limit"))||200));try{return X(await new xr(t,AE).logs(D,{limit:w}))}catch(j){return X({ok:!1,error:String(j?.message??j)},404)}}if(G.pathname==="/api/runtime/log-sessions"&&J.method==="POST"){let D=await a(J),w=String(D.workloadId??"");if(!w)return X({ok:!1,error:"A workloadId is required."},422);let j=await fd(t,AE),H=j.workloads.find((K)=>K.id===w);if(!H)return X({ok:!1,error:"Workload was not found in the current project and environment."},404);if(!H.capabilities.logs.supported)return X({ok:!1,error:H.capabilities.logs.reason??"Logs are unsupported for this workload."},409);let f=new xr(t,AE,{inventory:async()=>j}),q=i_.create("logs",w);return(async()=>{let K=new Date(Date.now()-Math.min(3600000,Math.max(1000,Number(D.sinceMs)||60000)));try{for(let u=0;u<200&&!i_.signal(q.id)?.aborted;u++){let SE=await f.logs(w,{limit:Math.min(500,Math.max(1,Number(D.limit)||200)),since:K});for(let IE of SE.lines)if(i_.append(q.id,`${IE.timestamp?`${IE.timestamp} `:""}${IE.message}
 `),IE.timestamp)K=new Date(Math.max(K.getTime(),new Date(IE.timestamp).getTime()+1));await Bun.sleep(3000)}if(!i_.signal(q.id)?.aborted)i_.close(q.id,"complete")}catch(u){i_.append(q.id,u instanceof Error?u.message:String(u),"stderr"),i_.close(q.id,"failed",u instanceof Error?u.message:String(u))}})(),X({ok:!0,session:q,streamUrl:`/api/runtime/log-stream?id=${encodeURIComponent(q.id)}&workload=${encodeURIComponent(w)}`},201)}if((G.pathname==="/api/runtime/log-stream"||G.pathname==="/api/runtime/exec-stream")&&J.method==="GET"){let D=String(G.searchParams.get("id")??""),w=String(G.searchParams.get("workload")??""),j=Number(J.headers.get("last-event-id")??G.searchParams.get("after")??0)||0,H=i_.read(D,w,j),f=G.pathname.includes("exec")?"exec":"logs";if(!H||H.kind!==f)return X({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return Kp(i_,H,j,J.signal)}if((G.pathname==="/api/runtime/log-sessions"||G.pathname==="/api/runtime/exec-sessions")&&J.method==="DELETE"){let D=await a(J),w=i_.cancel(String(D.id??""),String(D.workloadId??""));if(!w)return X({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return X({ok:!0,session:w})}if(G.pathname==="/api/runtime/exec-sessions"&&J.method==="POST"){let D=await a(J),w=String(D.workloadId??""),j=await fd(t,AE),H=j.workloads.find((u)=>u.id===w);if(!H)return X({ok:!1,error:"Workload was not found in the current project and environment."},404);let f=Q_.resolveSession(J),q=new xr(t,AE,{inventory:async()=>j}),K=i_.create("exec",w);return Wt({controlPlane:S,environment:AE,actor:tE,kind:"runtime.exec",resourceSlug:H.links.service,input:{workloadId:w,provider:H.provider,preset:D.preset?String(D.preset):null,freeForm:!!String(D.command??"").trim()},execute:()=>q.exec({workloadId:w,preset:["process","sockets","filesystem"].includes(String(D.preset))?String(D.preset):void 0,command:typeof D.command==="string"?D.command:void 0,confirm:String(D.confirm??""),recentAuth:!RE||!!f&&dE.isRecentlyAuthenticated(f)})}).then(({result:u,operation:SE})=>{if(i_.append(K.id,`operation ${SE.id}
 `,"system"),u.stdout)i_.append(K.id,u.stdout,"stdout");if(u.stderr)i_.append(K.id,u.stderr,"stderr");i_.close(K.id,u.ok?"complete":"failed",u.error)}).catch((u)=>{let SE=u instanceof Error?u.message:String(u);i_.append(K.id,SE,"stderr"),i_.close(K.id,"failed",SE)}),X({ok:!0,session:K,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(K.id)}&workload=${encodeURIComponent(w)}`},202)}if(G.pathname==="/api/runtime/files/read"&&J.method==="POST"){let D=await a(J),w=await fd(t,AE),j=Q_.resolveSession(J),H=await new xr(t,AE,{inventory:async()=>w}).readFile({workloadId:String(D.workloadId??""),path:String(D.path??""),confirm:String(D.confirm??""),recentAuth:!RE||!!j&&dE.isRecentlyAuthenticated(j)});return X(H,H.ok?200:409)}if(G.pathname==="/api/runtime/files/write"&&J.method==="POST"){let D=await a(J),w=await fd(t,AE),j=String(D.workloadId??""),H=w.workloads.find((u)=>u.id===j);if(!H)return X({ok:!1,error:"Workload was not found in the current project and environment."},404);let f=Q_.resolveSession(J),q=new xr(t,AE,{inventory:async()=>w}),K=await Wt({controlPlane:S,environment:AE,actor:tE,kind:"runtime.file.write",resourceSlug:H.links.service,input:{workloadId:j,provider:H.provider,path:String(D.path??""),bytes:Buffer.from(String(D.contentBase64??""),"base64").byteLength},execute:()=>q.writeFile({workloadId:j,path:String(D.path??""),contentBase64:String(D.contentBase64??""),confirm:String(D.confirm??""),recentAuth:!RE||!!f&&dE.isRecentlyAuthenticated(f)})});return X({...K.result,controlPlaneOperation:K.operation},K.result.ok?200:409)}if(G.pathname==="/api/runtime/operations"&&J.method==="POST"){let D=await a(J),w=String(D.workloadId??""),j=String(D.action??"");if(!w||!["start","stop","restart","redeploy","scale","inspect"].includes(j))return X({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let H=await fd(t,AE),f=H.workloads.find((SE)=>SE.id===w);if(!f)return X({ok:!1,error:"Workload was not found in the current project and environment."},404);let q=Q_.resolveSession(J),K=new xr(t,AE,{inventory:async()=>H}),u=await Wt({controlPlane:S,environment:AE,actor:tE,kind:`runtime.${j}`,resourceSlug:f.links.service,input:{workloadId:w,provider:f.provider,action:j,replicas:D.replicas==null?null:Number(D.replicas)},execute:()=>K.run({workloadId:w,action:j,replicas:D.replicas==null?void 0:Number(D.replicas),confirm:String(D.confirm??""),recentAuth:!RE||!!q&&dE.isRecentlyAuthenticated(q)})});return X({...u.result,controlPlaneOperation:u.operation},u.result.ok?200:409)}if(G.pathname.startsWith("/api/health/")||G.pathname.startsWith("/api/alerts")||G.pathname.startsWith("/api/notifications/")){let D=S.environments.get(AE),w=S.store.listResources(S.project.id,D?.id),j=tE.role==="admin"||!!D&&iA(tE,D.id,"runtime:read")?w:w.filter((K)=>cT(tE,K.id,"runtime:read")),H=(K)=>!K||j.some((u)=>u.id===K),f=(K)=>{if(!K)return;let u=w.find((SE)=>SE.id===K||SE.slug===K);if(!u)throw Error("Alert resource was not found.");if(!H(u.id))throw Error("Alert resource is outside your authorized scope.");return u.id},q=WE(tE).actor;if(G.pathname==="/api/health/checks"&&J.method==="GET")return X({ok:!0,checks:uE.listHealthChecks(S.project.id,D?.id).filter((K)=>H(K.resourceId)).map((K)=>({...K,results:uE.listHealthResults(K.id,20)}))});if(G.pathname==="/api/health/checks"&&J.method==="POST"){let K=await a(J),u=String(K.kind??"http");if(u==="command"&&tE.role!=="admin")return X({ok:!1,error:"Command health checks require an administrator."},403);let SE={method:String(K.config?.method??"GET").toUpperCase().slice(0,10),path:K.config?.path?String(K.config.path).slice(0,500):void 0,port:K.config?.port==null?void 0:Number(K.config.port),command:Array.isArray(K.config?.command)?K.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(K.config?.expectedStatuses)?K.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:K.config?.expectedBody?String(K.config.expectedBody).slice(0,500):void 0};return X({ok:!0,check:uE.createHealthCheck({projectId:S.project.id,environmentId:D?.id,resourceId:f(K.resourceId??K.resource),name:String(K.name??""),kind:u,target:String(K.target??""),config:SE,intervalSeconds:Number(K.intervalSeconds)||60,timeoutSeconds:Number(K.timeoutSeconds)||10,failureThreshold:Number(K.failureThreshold)||3,recoveryThreshold:Number(K.recoveryThreshold)||2,regions:Array.isArray(K.regions)?K.regions.map(String):["local"],enabled:K.enabled!==!1})},201)}if(G.pathname==="/api/health/checks"&&J.method==="PATCH"){let K=await a(J),u=uE.getHealthCheck(String(K.id??""));if(!u||!H(u.resourceId))return X({ok:!1,error:"Health check was not found."},404);return X({ok:!0,check:uE.setHealthCheckEnabled(u.id,K.enabled!==!1)})}if(G.pathname==="/api/health/checks/test"&&J.method==="POST"){let K=await a(J),u=uE.getHealthCheck(String(K.id??""));if(!u||!H(u.resourceId))return X({ok:!1,error:"Health check was not found."},404);return X({ok:!0,productionIncidentCreated:!1,result:await new St(uE).probe(u)})}if(G.pathname==="/api/health/checks/run"&&J.method==="POST"){let K=await a(J),u=uE.getHealthCheck(String(K.id??""));if(!u||!H(u.resourceId))return X({ok:!1,error:"Health check was not found."},404);let SE=await new St(uE).runAndEvaluate(u),IE=[];for(let d_ of SE.evaluations.filter(($E)=>$E.notify&&$E.alert)){let $E=kr.enqueue(S.organization.id,d_.alert,d_.transition);IE.push(...await kr.deliverAll($E))}return X({ok:!0,...SE,deliveries:IE})}if(G.pathname==="/api/alerts/rules"&&J.method==="GET")return X({ok:!0,rules:uE.listRules(S.project.id,D?.id).filter((K)=>H(K.resourceId))});if(G.pathname==="/api/alerts/rules"&&J.method==="POST"){let K=await a(J),u=K.healthCheckId?uE.getHealthCheck(String(K.healthCheckId)):void 0;if(K.healthCheckId&&(!u||!H(u.resourceId)))return X({ok:!1,error:"Health check was not found."},404);return X({ok:!0,rule:uE.createRule({projectId:S.project.id,environmentId:D?.id,resourceId:f(K.resourceId??K.resource)??u?.resourceId,healthCheckId:u?.id,name:String(K.name??""),signal:String(K.signal??(u?"health":"")),operator:String(K.operator??(u?"unhealthy":"gt")),threshold:K.threshold==null?void 0:Number(K.threshold),recoveryThreshold:K.recoveryThreshold==null?void 0:Number(K.recoveryThreshold),windowMs:Number(K.windowMs)||300000,consecutive:Number(K.consecutive)||u?.failureThreshold||3,recoveryConsecutive:Number(K.recoveryConsecutive)||u?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(K.noDataPolicy))?K.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(K.severity))?K.severity:"warning",groupBy:Array.isArray(K.groupBy)?K.groupBy.map(String):[],labels:K.labels&&typeof K.labels==="object"?K.labels:{},enabled:K.enabled!==!1})},201)}if(G.pathname==="/api/alerts/rules"&&J.method==="PATCH"){let K=await a(J),u=uE.getRule(String(K.id??""));if(!u||!H(u.resourceId))return X({ok:!1,error:"Alert rule was not found."},404);return X({ok:!0,rule:uE.setRuleEnabled(u.id,K.enabled!==!1)})}if(G.pathname==="/api/alerts/evaluate"&&J.method==="POST")return X({ok:!0,...await VF(D?.id)});if(G.pathname==="/api/alerts"&&J.method==="GET")return X({ok:!0,alerts:uE.listAlerts(S.project.id,{environmentId:D?.id,states:G.searchParams.getAll("state").length?G.searchParams.getAll("state"):void 0,limit:Number(G.searchParams.get("limit"))||200}).filter((K)=>H(K.resourceId)).map((K)=>({...K,deliveries:uE.listDeliveries({alertId:K.id,limit:50})}))});if(G.pathname==="/api/alerts/action"&&J.method==="POST"){let K=await a(J),u=uE.getAlert(String(K.id??""));if(!u||!H(u.resourceId))return X({ok:!1,error:"Alert was not found."},404);let SE=String(K.action??"");if(SE==="acknowledge")return X({ok:!0,alert:uE.acknowledge(u.id,q?.id??"")});if(SE==="assign")return X({ok:!0,alert:uE.assign(u.id,K.ownerActorId==="me"?q?.id:K.ownerActorId?String(K.ownerActorId):void 0,q?.id)});if(SE==="silence"){if(tE.role!=="admin")return X({ok:!1,error:"Silencing production alerts requires an administrator."},403);let IE=Q_.resolveSession(J);if(RE&&(!IE||!dE.isRecentlyAuthenticated(IE)))return X({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return X({ok:!0,alert:uE.silenceAlert(u.id,String(K.until??""),q?.id)})}return X({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(G.pathname==="/api/alerts/silences"&&J.method==="POST"){let K=await a(J);return X({ok:!0,id:uE.createSilence({projectId:S.project.id,environmentId:D?.id,resourceId:f(K.resourceId??K.resource),matcher:K.matcher,reason:String(K.reason??""),startsAt:String(K.startsAt??new Date().toISOString()),endsAt:String(K.endsAt??""),timezone:String(K.timezone??"UTC"),actorId:q?.id})},201)}if(G.pathname==="/api/notifications/channels"&&J.method==="GET")return X({ok:!0,channels:uE.listChannels(S.organization.id)});if(G.pathname==="/api/notifications/channels"&&J.method==="POST"){let K=await a(J),u=String(K.kind??""),SE=u==="email"?{to:K.config?.to,from:K.config?.from}:u==="telegram"?{chatId:String(K.config?.chatId??"")}:{};return X({ok:!0,channel:uE.createChannel({organizationId:S.organization.id,name:String(K.name??""),kind:u,config:SE,credential:K.credential?String(K.credential):void 0,actorId:q?.id})},201)}if(G.pathname==="/api/notifications/channels"&&J.method==="PATCH"){let K=await a(J),u=String(K.id??"");if(K.credential)return X({ok:!0,channel:uE.rotateChannel(u,String(K.credential))});let SE=String(K.status??"paused");if(!["active","paused","disabled"].includes(SE))return X({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return X({ok:!0,channel:uE.setChannelStatus(u,SE)})}if(G.pathname==="/api/notifications/channels/test"&&J.method==="POST"){let K=await a(J);return X({ok:!0,productionIncidentCreated:!1,result:await kr.testChannel(String(K.id??""))})}if(G.pathname==="/api/notifications/routes"&&J.method==="GET")return X({ok:!0,routes:uE.listRoutes(S.organization.id)});if(G.pathname==="/api/notifications/routes"&&J.method==="POST"){let K=await a(J),u=Array.isArray(K.channelIds)?K.channelIds.map(String):[];if(u.some((SE)=>uE.getChannel(SE)?.organizationId!==S.organization.id))return X({ok:!1,error:"Route contains an unavailable channel."},422);return X({ok:!0,route:uE.createRoute({organizationId:S.organization.id,name:String(K.name??""),priority:Number(K.priority)||0,matcher:K.matcher&&typeof K.matcher==="object"?K.matcher:{},channelIds:u,quietHours:K.quietHours,groupWaitSeconds:Number(K.groupWaitSeconds)||30,reminderSeconds:K.reminderSeconds==null?void 0:Number(K.reminderSeconds),escalation:Array.isArray(K.escalation)?K.escalation:[],template:K.template?String(K.template):void 0,rateLimitPerMinute:Number(K.rateLimitPerMinute)||60,enabled:K.enabled!==!1})},201)}if(G.pathname==="/api/notifications/routes"&&J.method==="PATCH"){let K=await a(J),u=uE.getRoute(String(K.id??""));if(!u||u.organizationId!==S.organization.id)return X({ok:!1,error:"Notification route was not found."},404);return X({ok:!0,route:uE.setRouteEnabled(u.id,K.enabled!==!1)})}if(G.pathname==="/api/notifications/routes/preview"&&J.method==="POST"){let K=await a(J),SE=(K.alertId?uE.getAlert(String(K.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:S.project.id,environmentId:D?.id,resourceId:f(K.resourceId??K.resource),dedupKey:"preview",groupKey:String(K.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(K.severity))?K.severity:"warning",title:String(K.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return X({ok:!0,productionIncidentCreated:!1,matches:kr.preview(S.organization.id,SE,String(K.eventType??"firing")).map((IE)=>({route:IE.route,channels:IE.channels,quiet:IE.quiet}))})}if(G.pathname==="/api/notifications/deliveries"&&J.method==="GET")return X({ok:!0,deliveries:uE.listDeliveries({alertId:G.searchParams.get("alertId")??void 0,states:G.searchParams.getAll("state"),limit:Number(G.searchParams.get("limit"))||200})});if(G.pathname==="/api/notifications/deliveries/retry"&&J.method==="POST"){let K=await a(J),u=uE.getDelivery(String(K.id??""));if(!u)return X({ok:!1,error:"Delivery was not found."},404);return uE.updateDelivery(u.id,{state:"retrying",attempt:Math.max(0,u.attempt-1),nextAttemptAt:new Date().toISOString()}),X({ok:!0,delivery:await kr.deliver(u.id)})}}if(G.pathname.startsWith("/api/jobs")||G.pathname.startsWith("/api/workers")){let D=S.environments.get(AE),w=S.store.listResources(S.project.id,D?.id),H=tE.role==="admin"||!!D&&iA(tE,D.id,"automation:read")?w:w.filter((cE)=>cT(tE,cE.id,"automation:read")),f=(cE)=>!cE||H.some((FE)=>FE.id===cE),q=WE(tE).actor,K=$.get(AE)??c,u=wA(t,K),SE=u.filter((cE)=>!cE.danger&&["scheduler","backup","worker"].includes(cE.group)),IE=xT(t),d_=()=>{let cE=Q_.resolveSession(J);return!RE||!!cE&&dE.isRecentlyAuthenticated(cE)},$E=(cE)=>{if(!cE||typeof cE!=="object"||Array.isArray(cE))return{};let FE=Object.entries(cE).slice(0,50);if(FE.some(([,nE])=>typeof nE!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(nE)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(FE)},HE=(cE,FE,nE)=>S.store.appendEvent({organizationId:S.organization.id,projectId:S.project.id,resourceId:nE,actorId:q?.id,type:`job.${cE}`,payload:FE});if(G.pathname==="/api/jobs/preview"&&J.method==="POST"){let cE=await a(J);try{return X({ok:!0,productionExecutionCreated:!1,preview:NR(String(cE.expression??""),String(cE.timezone??"UTC"),new Date(cE.from?String(cE.from):Date.now()),Number(cE.count)||5)})}catch(FE){return X({ok:!1,error:FE instanceof Error?FE.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(G.pathname==="/api/jobs"&&J.method==="GET")return X({ok:!0,jobs:OT.list(S.project.id,{environmentId:D?.id}).filter((cE)=>f(cE.resourceId)).map((cE)=>({...cE,preview:NR(cE.normalizedExpression,cE.timezone,new Date,5),capability:BO(cE),lastExecution:OT.listExecutions(cE.id,1)[0]}))});if(G.pathname==="/api/jobs"&&J.method==="POST"){let cE=await a(J),FE=String(cE.provider??(IE==="serverless"?"eventbridge":"server")),nE=IE==="serverless"?"eventbridge":"server";if(FE!==nE)return X({ok:!1,error:`${IE} environments accept ${nE} schedules through this adapter.`},422);let T_=cE.operationId?String(cE.operationId):void 0;if(FE==="server"&&(!T_||!SE.some((a_)=>a_.id===T_)))return X({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let c_=BO({provider:FE,expression:String(cE.expression??""),flexibleMinutes:Number(cE.flexibleMinutes)||0,missedRunPolicy:cE.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(cE.overlapPolicy))?cE.overlapPolicy:"forbid"});if(!c_.supported)return X({ok:!1,error:c_.notes.join(" ")},422);let jr=cE.resourceId?w.find((a_)=>a_.id===cE.resourceId||a_.slug===cE.resourceId):void 0;if(cE.resourceId&&(!jr||!f(jr.id)))return X({ok:!1,error:"Job resource was not found."},404);try{let a_=FE==="server"?{kind:"dashboard_operation",operationId:T_}:{kind:"serverless_scheduler",action:"run"},wR=OT.create({organizationId:S.organization.id,projectId:S.project.id,environmentId:D?.id,resourceId:jr?.id,name:String(cE.name??""),provider:FE,expression:String(cE.expression??""),timezone:String(cE.timezone??"UTC"),startsAt:cE.startsAt?String(cE.startsAt):void 0,endsAt:cE.endsAt?String(cE.endsAt):void 0,flexibleMinutes:Number(cE.flexibleMinutes)||0,target:a_,payloadRefs:$E(cE.payloadRefs),missedRunPolicy:cE.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(cE.overlapPolicy))?cE.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(cE.maxAttempts)||3,backoffSeconds:Number(cE.backoffSeconds)||30,deadLetterRef:cE.deadLetterRef?String(cE.deadLetterRef):void 0},timeoutSeconds:Number(cE.timeoutSeconds)||900,enabled:cE.enabled!==!1,origin:"managed",ownerActorId:q?.id,observedState:{},reconciliationStatus:"pending"});return HE("created",{jobId:wR.id,provider:wR.provider,expression:wR.normalizedExpression},wR.resourceId),X({ok:!0,job:wR,capability:c_},201)}catch(a_){return X({ok:!1,error:a_ instanceof Error?a_.message:"Scheduled job could not be created."},422)}}if(G.pathname==="/api/jobs"&&J.method==="PATCH"){let cE=await a(J),FE=OT.get(String(cE.id??""));if(!FE||!f(FE.resourceId))return X({ok:!1,error:"Scheduled job was not found."},404);if(FE.origin==="config")return X({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let nE=cE.missedRunPolicy==null?void 0:String(cE.missedRunPolicy),T_=cE.overlapPolicy==null?void 0:String(cE.overlapPolicy);if(nE&&!["skip","catch_up"].includes(nE))return X({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(T_&&!["allow","forbid","replace"].includes(T_))return X({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let c_=OT.updateSchedule(FE.id,{expression:cE.expression?String(cE.expression):void 0,timezone:cE.timezone?String(cE.timezone):void 0,missedRunPolicy:nE,overlapPolicy:T_,timeoutSeconds:cE.timeoutSeconds==null?void 0:Number(cE.timeoutSeconds)});return HE("updated",{jobId:c_.id,expression:c_.normalizedExpression,version:c_.version},c_.resourceId),X({ok:!0,job:c_})}catch(c_){return X({ok:!1,error:c_ instanceof Error?c_.message:"Scheduled job could not be updated."},422)}}if(G.pathname==="/api/jobs/action"&&J.method==="POST"){let cE=await a(J),FE=OT.get(String(cE.id??""));if(!FE||!f(FE.resourceId))return X({ok:!1,error:"Scheduled job was not found."},404);let nE=String(cE.action??"");if(nE==="run"){let T_=KF.enqueue(FE,{trigger:"manual",actorId:q?.id});return HE("run_queued",{jobId:FE.id,executionId:T_.id},FE.resourceId),X({ok:!0,execution:T_},202)}if(["disable","delete"].includes(nE)&&D?.kind==="production"){if(String(cE.confirm??"")!==nE)return X({ok:!1,error:`Type "${nE}" to confirm this production change.`},409);if(!d_())return X({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(nE==="enable"||nE==="disable"){let T_=OT.setEnabled(FE.id,nE==="enable");return HE(nE==="enable"?"enabled":"disabled",{jobId:FE.id},FE.resourceId),X({ok:!0,job:T_})}if(nE==="delete")try{return OT.remove(FE.id),HE("deleted",{jobId:FE.id,name:FE.name},FE.resourceId),X({ok:!0,deleted:FE.id})}catch(T_){return X({ok:!1,error:T_ instanceof Error?T_.message:"Scheduled job could not be deleted."},409)}return X({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(G.pathname==="/api/jobs/history"&&J.method==="GET"){let cE=OT.get(String(G.searchParams.get("jobId")??""));if(!cE||!f(cE.resourceId))return X({ok:!1,error:"Scheduled job was not found."},404);return X({ok:!0,executions:OT.listExecutions(cE.id,Number(G.searchParams.get("limit"))||100).map((FE)=>({...FE,logs:FE.operationId?r_.logs(FE.operationId,{limit:500}):[]}))})}if(G.pathname==="/api/jobs/reconcile"&&J.method==="POST"){if(!D)return X({ok:!1,error:"Environment was not found."},404);let cE=QA(OT,t,{organization:S.organization,project:S.project,environment:D,resources:w});return HE("reconciled",cE),X({ok:!0,reconciliation:cE})}if(G.pathname==="/api/workers"&&J.method==="GET"){let cE=Array.isArray(K.workersDetail??K.workers)?K.workersDetail??K.workers:[];return X({ok:!0,workers:OT.listWorkers(S.project.id,D?.id).filter((FE)=>f(FE.resourceId)).map((FE)=>{let nE=cE.find((T_)=>T_.name===FE.name||T_.site===FE.target.site);return nE?{...FE,observedState:{...FE.observedState,status:nE.status??"configured",currentJob:nE.currentJob??null,failures:Number(nE.failed??nE.failures)||0,processed:Number(nE.processed)||0}}:FE})})}if(G.pathname==="/api/workers/action"&&J.method==="POST"){let cE=await a(J),FE=OT.getWorker(String(cE.id??""));if(!FE||!f(FE.resourceId))return X({ok:!1,error:"Worker was not found."},404);let nE=String(cE.action??"");if(nE==="restart"){if(String(cE.confirm??"")!==FE.name)return X({ok:!1,error:`Type "${FE.name}" to restart this worker.`},409);let T_=u.find((a_)=>a_.id===FE.target.operationId);if(!T_)return X({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let c_=await eA(t,AE,T_),jr=OT.reconcileWorker(FE.id,c_.ok?"in_sync":"unavailable",{...FE.observedState,lastRestartAt:new Date().toISOString(),command:c_.command??null,error:c_.error??c_.stderr??null});return HE("worker_restarted",{workerId:FE.id,ok:c_.ok},FE.resourceId),X({...c_,worker:jr},c_.ok?200:409)}if(nE==="scale")return X({ok:!1,error:FE.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return X({ok:!1,error:"Action must be restart or scale."},422)}}if(G.pathname.startsWith("/api/telemetry/")){let D=S.environments.get(AE),w=new RR(S.store),j=S.store.listResources(S.project.id,D?.id),H=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(G.pathname)?"runtime:logs":"runtime:read",f=tE.role==="admin"||!!D&&iA(tE,D.id,H),q=f?j:j.filter(($E)=>cT(tE,$E.id,H)),K=($E)=>rG(q,f,$E),u=($E)=>{let HE=new Date,cE={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},FE=String($E.to??HE.toISOString()),nE=String($E.from??new Date(new Date(FE).getTime()-(cE[String($E.range??"1h")]??cE["1h"])).toISOString()),T_=(jr)=>{let a_=(Array.isArray(jr)?jr:String(jr??"").split(",")).map(String).filter(Boolean);return a_.length?a_:void 0},c_=T_($E.kinds)?.filter((jr)=>["metric","log","trace","request","event"].includes(jr));return{projectId:S.project.id,environmentId:D?.id,resourceIds:K($E.resources),kinds:c_,names:T_($E.names),sources:T_($E.sources),levels:T_($E.levels),from:nE,to:FE,text:String($E.text??"")||void 0,traceId:String($E.traceId??"")||void 0,requestId:String($E.requestId??"")||void 0,deploymentId:String($E.deploymentId??"")||void 0,releaseId:String($E.releaseId??"")||void 0,workloadId:String($E.workloadId??"")||void 0,cursor:String($E.cursor??"")||void 0,limit:Number($E.limit)||void 0}},SE=Object.fromEntries(G.searchParams.entries()),IE=($E=!1)=>VO({controlPlane:S.store,projectId:S.project.id,environmentId:D?.id,config:t,environment:AE,force:$E,lightweight:!$E}),d_=()=>{let $E=S.store.getSetting(`telemetry.collection:${S.project.id}:${D?.id??"all"}`)??{};return{generatedAt:String($E.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray($E.statuses)?$E.statuses:[],errors:Array.isArray($E.errors)?$E.errors:[],policy:$E.policy??tR(S.store,S.project.id)}};if(G.pathname==="/api/telemetry/status"&&J.method==="GET"){IE(!1);let $E=d_(),HE=f?$E.statuses:w.status(S.project.id,D?.id,$E.policy.rawDays,$E.policy.samplingRate,q.map((FE)=>FE.id)),cE=HE.reduce((FE,nE)=>FE+nE.estimatedDailyBytes*30,0);return X({ok:!0,generatedAt:$E.generatedAt,cached:$E.cached,sources:HE,errors:f?$E.errors:[],policy:$E.policy,retention:{rawDays:$E.policy.rawDays,downsampleAfterDays:$E.policy.downsampleAfterDays,downsampleBucketMs:$E.policy.downsampleBucketMs,maxRecords:$E.policy.maxRecords},estimatedMonthlyBytes:cE,estimatedMonthlyCostUsd:wD(cE,$E.policy),costEstimateConfigured:$E.policy.estimatedStorageUsdPerGbMonth>0})}if(G.pathname==="/api/telemetry/settings"&&J.method==="GET")return X({ok:!0,policy:tR(S.store,S.project.id)});if(G.pathname==="/api/telemetry/settings"&&J.method==="PATCH"){let $E=CD(S.store,S.project.id,await a(J));return SG(S.project.id),X({ok:!0,policy:$E})}if(G.pathname==="/api/telemetry/query"&&J.method==="GET"){IE(!1);let $E=d_();return X({ok:!0,collection:{generatedAt:$E.generatedAt,cached:$E.cached},...w.query(u(SE))})}if(G.pathname==="/api/telemetry/tail"&&J.method==="GET"){IE(!1);let $E=new TextEncoder,HE=new Date,cE=u({...SE,kinds:SE.kinds||"log,request,event,trace",from:SE.from||new Date(HE.getTime()-120000).toISOString(),to:HE.toISOString(),limit:Math.min(1000,Number(SE.limit)||200),cursor:void 0}),FE=J.headers.get("last-event-id")||String(SE.cursor??"")||void 0,nE,T_=!1,c_=!1,jr=new ReadableStream({start(a_){let wR=()=>{if(T_)return;if(T_=!0,nE)clearInterval(nE);J.signal.removeEventListener("abort",wR);try{a_.close()}catch{}},iF=async()=>{if(T_||c_)return;c_=!0;try{let zh=w.tail({...cE,to:new Date(Date.now()+1000).toISOString()},FE);for(let aF of zh.records)FE=zD(aF)??FE,a_.enqueue($E.encode(`id: ${FE??""}
 event: record
@@ -10294,7 +10294,7 @@ data: ${JSON.stringify({message:zh instanceof Error?zh.message:String(zh)})}
 data: ${JSON.stringify({cursor:FE,at:new Date().toISOString()})}
 
 `))},5000),nE.unref?.(),J.signal.addEventListener("abort",wR,{once:!0})},cancel(){if(T_=!0,nE)clearInterval(nE)}});return new Response(jr,{headers:{"cache-control":"no-cache, no-transform",connection:"keep-alive","content-type":"text/event-stream; charset=utf-8","x-accel-buffering":"no"}})}if(G.pathname==="/api/telemetry/series"&&J.method==="GET"){IE(!1);let $E=d_(),HE=["sum","avg","min","max","count","p50","p90","p95","p99"].includes(String(SE.aggregation))?SE.aggregation:"avg",cE=u({...SE,kinds:"metric",limit:5000}),FE=w.series({...cE,bucketMs:Number(SE.bucketMs)||60000,aggregation:HE,timezone:String(SE.timezone??"UTC"),compareFrom:SE.compareFrom,compareTo:SE.compareTo});return X({ok:!0,collection:{generatedAt:$E.generatedAt,cached:$E.cached},query:{aggregation:HE,bucketMs:Number(SE.bucketMs)||60000,timezone:String(SE.timezone??"UTC")},series:FE})}if(G.pathname==="/api/telemetry/refresh"&&J.method==="POST")return X({ok:!0,...await IE(!0)});if(G.pathname==="/api/telemetry/export"&&J.method==="POST"){let $E=await a(J);await IE(!1);let HE=w.query({...u($E),limit:Math.min(5000,Number($E.limit)||5000),cursor:void 0});if(($E.format==="csv"?"csv":"json")==="json")return new Response(JSON.stringify({exportedAt:new Date().toISOString(),query:u($E),...HE},null,2),{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.json"',"content-type":"application/json; charset=utf-8"}});let FE=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"],nE=[FE.join(","),...HE.records.map((T_)=>FE.map((c_)=>`"${String(T_[c_]??"").replaceAll('"','""')}"`).join(","))].join(`
-`);return new Response(nE,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(G.pathname==="/api/telemetry/saved-queries"&&J.method==="GET"){let $E=WE(tE);return X({ok:!0,queries:w.listSavedQueries(S.project.id,$E.actor?.id)})}if(G.pathname==="/api/telemetry/saved-queries"&&J.method==="POST"){let $E=await a(J),HE=WE(tE);return X({ok:!0,query:w.saveQuery(S.project.id,HE.actor?.id,String($E.name??""),u($E.query??$E))},201)}if(G.pathname==="/api/telemetry/saved-queries"&&J.method==="DELETE"){let $E=await a(J),HE=WE(tE),cE=w.deleteSavedQuery(S.project.id,HE.actor?.id,String($E.id??""));return X({ok:cE},cE?200:404)}}if(G.pathname.startsWith("/api/configuration")){let D=S.environments.get(AE),w=tE.role==="admin"||!!ur.capabilities?.includes("secrets:read"),j=tE.role==="admin"||!!ur.capabilities?.includes("secrets:write"),H={projectId:S.project.id,environmentId:D?.id},f={"cache-control":"no-store"};if(G.pathname==="/api/configuration"&&J.method==="GET"){let q=Object.fromEntries(G.searchParams),K=q.scopeType||q.scopeId?kA(q,H):void 0,u=["variable","secret"].includes(String(q.kind))?q.kind:void 0,SE=K?.type==="preview"?b_.previews.getInstance(K.id):void 0,IE=SE?b_.previews.getDefinition(SE.definitionId):void 0,d_=K?await _r.resolve({projectId:S.project.id,environmentId:K.environmentId,resourceId:K.resourceId,functionId:K.type==="function"?K.id:void 0,previewId:K.previewId,trustedPreview:!!SE&&!SE.fork,allowedPreviewSecrets:IE?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:w}):void 0,$E=S.store.listResources(S.project.id);return X({ok:!0,entries:_r.list({projectId:S.project.id,scope:K,kind:u,search:q.search,canReadSecretMetadata:w}),effectiveEntries:d_?Object.values(d_.entries).filter((HE)=>!u||HE.kind===u).filter((HE)=>!q.search||HE.key.toLowerCase().includes(String(q.search).toLowerCase())):[],configurationHash:d_?.configurationHash,warnings:d_?.warnings??[],scopes:{project:S.project,environments:S.store.listEnvironments(S.project.id),resources:$E.filter((HE)=>HE.kind!=="function"),functions:$E.filter((HE)=>HE.kind==="function"),previews:b_.previews.listInstances({projectId:S.project.id}).filter((HE)=>HE.status!=="destroyed").map((HE)=>({id:HE.id,name:HE.name,environmentId:HE.baseEnvironmentId,resourceId:HE.resourceId,fork:HE.fork,status:HE.status}))}},200,f)}if(G.pathname==="/api/configuration/export"&&J.method==="GET"){let q=kA(Object.fromEntries(G.searchParams),H);return new Response(_r.exportVariables({projectId:S.project.id,scope:q}),{headers:{...f,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(G.pathname==="/api/configuration/plan"&&J.method==="POST"){let q=await a(J),K=kA(q,H),u=q.values&&typeof q.values==="object"&&!Array.isArray(q.values)?Object.fromEntries(Object.entries(q.values).map(([SE,IE])=>[SE,String(IE)])):{};return X({ok:!0,plan:_r.plan({projectId:S.project.id,scope:K,values:u,removeMissing:q.removeMissing===!0})},200,f)}if(G.pathname==="/api/configuration"&&J.method==="POST"){let q=await a(J),K=kA(q,H),u=q.kind==="secret"?"secret":"variable",SE=String(q.key??"");if(u==="secret"&&!j)return X({ok:!1,error:"Secret write permission is required."},403,f);try{let IE=await _r.set({organizationId:S.organization.id,projectId:S.project.id,scope:K,key:SE,kind:u,value:q.value==null?void 0:String(q.value),reference:q.reference==null?void 0:String(q.reference),backend:q.backend,required:q.required===!0,expectedVersion:q.expectedVersion==null?void 0:Number(q.expectedVersion),confirmed:String(q.confirm??"")===SE,idempotencyKey:J.headers.get("idempotency-key")??q.idempotencyKey,actorId:WE(tE).actor?.id});return X({ok:!0,entry:_r.list({projectId:S.project.id,scope:K,canReadSecretMetadata:w}).find((d_)=>d_.id===IE.entry.id),mutation:IE.mutation,warnings:IE.warnings},IE.mutation.added.length?201:200,f)}catch(IE){return X({ok:!1,error:IE instanceof Error?IE.message:String(IE)},409,f)}}if(G.pathname==="/api/configuration/import"&&J.method==="POST"){let q=await a(J),K=kA(q,H),u=Array.isArray(q.secretKeys)?q.secretKeys.map(String):[];if(u.length&&!j)return X({ok:!1,error:"Secret write permission is required."},403,f);try{let SE=await _r.importDotenv({organizationId:S.organization.id,projectId:S.project.id,scope:K,source:String(q.source??""),secretKeys:u,backend:q.backend,confirmed:q.confirm==="import",idempotencyKey:J.headers.get("idempotency-key")??q.idempotencyKey,actorId:WE(tE).actor?.id});return X({ok:SE.document.valid,diagnostics:SE.document.diagnostics,mutation:SE.mutation,warnings:SE.warnings},SE.document.valid?200:422,f)}catch(SE){return X({ok:!1,error:SE instanceof Error?SE.message:String(SE)},409,f)}}if(G.pathname==="/api/configuration/dependencies"&&J.method==="POST"){let q=await a(J),K=PT.get(String(q.entryId??"")),u=S.store.getResource(String(q.resourceId??""));if(!K||K.projectId!==S.project.id||!u||u.projectId!==S.project.id)return X({ok:!1,error:"Configuration entry or dependent resource was not found."},404,f);return X({ok:!0,dependency:PT.setDependency({entryId:K.id,resourceId:u.id,injectionTarget:["native_reference","file"].includes(String(q.injectionTarget))?q.injectionTarget:"environment",required:q.required!==!1,requiresRedeploy:q.requiresRedeploy!==!1,lastDeployedVersion:q.lastDeployedVersion==null?void 0:Number(q.lastDeployedVersion)})},200,f)}if(G.pathname==="/api/configuration/transfer"&&J.method==="POST"){let q=await a(J),K=PT.get(String(q.id??"")),u=kA({...q,scopeType:q.targetScopeType,scopeId:q.targetScopeId},H);if(!K||K.projectId!==S.project.id)return X({ok:!1,error:"Configuration entry was not found."},404,f);if(K.kind==="secret"&&!j)return X({ok:!1,error:"Secret write permission is required."},403,f);try{let SE=await _r.transfer({entryId:K.id,targetScope:u,mode:q.mode==="move"?"move":"copy",confirmed:q.confirm===K.key,actorId:WE(tE).actor?.id,idempotencyKey:J.headers.get("idempotency-key")??q.idempotencyKey});return X({ok:!0,entry:_r.list({projectId:S.project.id,scope:u,canReadSecretMetadata:w}).find((IE)=>IE.id===SE.entry.id),mutation:SE.mutation},200,f)}catch(SE){return X({ok:!1,error:SE instanceof Error?SE.message:String(SE)},409,f)}}if(G.pathname==="/api/configuration/bulk"&&J.method==="POST"){let q=await a(J),K=Array.isArray(q.ids)?q.ids.map(String).slice(0,500):[],u=K.map((IE)=>PT.get(IE)).filter((IE)=>!!IE&&IE.projectId===S.project.id);if(u.length!==K.length)return X({ok:!1,error:"One or more configuration entries were not found."},404,f);if(u.some((IE)=>IE.kind==="secret")&&!j)return X({ok:!1,error:"Secret write permission is required."},403,f);if(q.action!=="delete"||q.confirm!=="bulk")return X({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,f);let SE=[];try{for(let IE of u)SE.push(await _r.remove({entryId:IE.id,expectedVersion:IE.version,confirmed:!0,actorId:WE(tE).actor?.id}));return X({ok:!0,removed:SE.flatMap((IE)=>IE.removed),affectedResourceIds:[...new Set(SE.flatMap((IE)=>IE.affectedResourceIds))].sort()},200,f)}catch(IE){return X({ok:!1,error:IE instanceof Error?IE.message:String(IE),partial:SE.flatMap((d_)=>d_.removed)},409,f)}}if(G.pathname==="/api/configuration/reveal"&&J.method==="POST"){let q=await a(J),K=Q_.resolveSession(J);try{return X({ok:!0,value:await _r.reveal({entryId:String(q.id??""),canRevealSecrets:w,recentlyAuthenticated:!RE||!!K&&dE.isRecentlyAuthenticated(K),actorId:WE(tE).actor?.id})},200,f)}catch(u){return X({ok:!1,error:u instanceof Error?u.message:String(u)},403,f)}}if(G.pathname==="/api/configuration"&&J.method==="DELETE"){let q=await a(J),K=PT.get(String(q.id??""));if(K?.kind==="secret"&&!j)return X({ok:!1,error:"Secret write permission is required."},403,f);if(!K||K.projectId!==S.project.id)return X({ok:!1,error:"Configuration entry was not found."},404,f);try{return X({ok:!0,mutation:await _r.remove({entryId:K.id,expectedVersion:Number(q.expectedVersion),confirmed:String(q.confirm??"")===K.key,actorId:WE(tE).actor?.id})},200,f)}catch(u){return X({ok:!1,error:u instanceof Error?u.message:String(u)},409,f)}}}if(G.pathname.startsWith("/api/fleet")){let D=WE(tE).actor?.id,w=(j,H=409)=>X({ok:!1,error:j instanceof Error?j.message:String(j)},H,{"cache-control":"no-store"});if(G.pathname==="/api/fleet"&&J.method==="GET")return X({ok:!0,servers:lA.list(S.project.id),resources:S.store.listResources(S.project.id),operations:r_.list({projectId:S.project.id,limit:200}).filter((j)=>j.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(G.pathname==="/api/fleet"&&J.method==="POST"){let j=await a(J);try{return X({ok:!0,server:xd.enroll({organizationId:S.organization.id,projectId:S.project.id,name:String(j.name??""),provider:["aws","hetzner"].includes(String(j.provider))?j.provider:"ssh",providerId:j.providerId?String(j.providerId):void 0,region:j.region?String(j.region):void 0,zone:j.zone?String(j.zone):void 0,endpoint:String(j.endpoint??""),sshUser:String(j.sshUser??"deploy"),sshPort:j.sshPort?Number(j.sshPort):22,credentialRef:String(j.credentialRef??""),roles:Array.isArray(j.roles)?j.roles:[],labels:j.labels&&typeof j.labels==="object"?j.labels:{}})},201)}catch(H){return w(H,422)}}if(G.pathname==="/api/fleet/action"&&J.method==="POST"){let j=await a(J),H=String(j.id??""),f=String(j.action??"");try{if(f==="test")return X({ok:!0,server:await xd.test(H)});if(f==="validate")return X({ok:!0,server:await xd.validate(H)});if(f==="review_host_key")return X({ok:!0,server:xd.reviewHostKey(H,String(j.fingerprint??""))});if(f==="bootstrap")return X({ok:!0,...xd.bootstrap(H,j.confirmed===!0)},j.confirmed===!0?202:200);if(f==="heartbeat")return X({ok:!0,server:xd.heartbeat(H,{usage:j.usage&&typeof j.usage==="object"?j.usage:{}})});if(f==="drain")return X({ok:!0,server:xd.drain(H,j.completed===!0)});if(f==="uncordon")return X({ok:!0,server:xd.uncordon(H)});if(f==="archive")return X({ok:!0,server:xd.archive(H,String(j.confirmation??""))});return w("Unsupported fleet action.",422)}catch(q){return w(q)}}}if(G.pathname.startsWith("/api/capacity")){let D=(w,j=409)=>X({ok:!1,error:w instanceof Error?w.message:String(w)},j,{"cache-control":"no-store"});if(G.pathname==="/api/capacity"&&J.method==="GET")return X({ok:!0,pools:DR.listPools(S.project.id),placements:DR.listPlacements(S.project.id),servers:lA.list(S.project.id)},200,{"cache-control":"no-store"});if(G.pathname==="/api/capacity"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,pool:DR.createPool({organizationId:S.organization.id,projectId:S.project.id,name:String(w.name??""),purpose:String(w.purpose??"application"),backend:String(w.backend??"server"),region:w.region?String(w.region):void 0,architecture:w.architecture?String(w.architecture):void 0,labels:w.labels&&typeof w.labels==="object"?w.labels:{},requiredServerLabels:w.requiredServerLabels&&typeof w.requiredServerLabels==="object"?w.requiredServerLabels:{},toleratedTaints:Array.isArray(w.toleratedTaints)?w.toleratedTaints.map(String):[],capacity:w.capacity&&typeof w.capacity==="object"?w.capacity:{},maxWorkloads:Number(w.maxWorkloads??10),costWeight:Number(w.costWeight??1),spreadKey:w.spreadKey?String(w.spreadKey):void 0,concurrency:Number(w.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(j){return D(j,422)}}if(G.pathname==="/api/capacity/member"&&J.method==="POST"){let w=await a(J);try{return DR.addMember(String(w.poolId??""),String(w.serverId??"")),X({ok:!0,pool:DR.getPool(String(w.poolId??""))})}catch(j){return D(j,422)}}if(G.pathname==="/api/capacity/explain"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,decisions:GF.explain(S.project.id,{purpose:String(w.purpose??"application"),resources:w.resources&&typeof w.resources==="object"?w.resources:{},region:w.region?String(w.region):void 0,architecture:w.architecture?String(w.architecture):void 0,labels:w.labels&&typeof w.labels==="object"?w.labels:{}})})}catch(j){return D(j,422)}}if(G.pathname==="/api/capacity/action"&&J.method==="POST"){let w=await a(J);try{if(w.action==="drain")return X({ok:!0,...GF.drainPool(String(w.poolId??""))});if(w.action==="enable")return X({ok:!0,pool:DR.updatePool(String(w.poolId??""),{status:"active"})});if(w.action==="disable")return X({ok:!0,pool:DR.updatePool(String(w.poolId??""),{status:"disabled"})});return D("Unsupported capacity action.",422)}catch(j){return D(j,422)}}}if(G.pathname.startsWith("/api/regions")){let D=(w,j=409)=>X({ok:!1,error:w instanceof Error?w.message:String(w)},j,{"cache-control":"no-store"});if(G.pathname==="/api/regions"&&J.method==="GET")return X({ok:!0,topologies:Xh.list(S.project.id).map((w)=>({topology:w,targets:Xh.targets(w.id),channels:Xh.channels(w.id),route:Xh.route(w.id),executions:Xh.executions(w.id)}))},200,{"cache-control":"no-store"});if(G.pathname==="/api/regions"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,topology:MF.create({organizationId:S.organization.id,projectId:S.project.id,environmentId:S.environments.get(AE)?.id,name:String(w.name??""),hostname:String(w.hostname??""),regions:Array.isArray(w.regions)?w.regions:[],trafficPolicy:w.trafficPolicy==="weighted"||w.trafficPolicy==="latency"?w.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(w.replicate)?w.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(w.maxLagSeconds??30),retainOnDestroy:w.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:w.cdnEnabled===!0,wafEnabled:w.wafEnabled===!0})},201)}catch(j){return D(j,422)}}if(G.pathname==="/api/regions/action"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,...MF.enqueue({topologyId:String(w.topologyId??""),kind:String(w.action??""),targetRegion:w.targetRegion?String(w.targetRegion):void 0,revision:w.revision?String(w.revision):void 0,manifest:w.manifest&&typeof w.manifest==="object"?w.manifest:{},confirmation:w.confirmation?String(w.confirmation):void 0,deleteData:w.deleteData===!0})},202)}catch(j){return D(j,422)}}}if(G.pathname.startsWith("/api/maintenance")){let D=(w,j=409)=>X({ok:!1,error:w instanceof Error?w.message:String(w)},j,{"cache-control":"no-store"});if(G.pathname==="/api/maintenance"&&J.method==="GET")return X({ok:!0,manifests:Dt.manifests(S.organization.id),windows:Dt.windows(S.project.id),campaigns:Dt.campaigns(S.project.id).map((w)=>({campaign:w,targets:Dt.targets(w.id)})),cleanups:Dt.cleanups(S.project.id),drills:Dt.drills(S.project.id)},200,{"cache-control":"no-store"});if(G.pathname==="/api/maintenance/cleanup-preview"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,plan:await L1.previewCleanup({projectId:S.project.id,kind:String(w.kind??"operations"),criteria:{olderThanDays:Number(w.olderThanDays??30)}},fF)},201)}catch(j){return D(j,422)}}if(G.pathname==="/api/maintenance/cleanup-apply"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,...L1.enqueueCleanup(String(w.planId??""),String(w.confirmation??""))},202)}catch(j){return D(j,422)}}if(G.pathname==="/api/maintenance/drill"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,drill:Dt.createDrill({projectId:S.project.id,scenario:String(w.scenario??"control_plane"),isolatedTarget:String(w.isolatedTarget??""),expectedRpoMinutes:Number(w.expectedRpoMinutes??60),expectedRtoMinutes:Number(w.expectedRtoMinutes??30),recoveryPointId:w.recoveryPointId?String(w.recoveryPointId):void 0,topologyId:w.topologyId?String(w.topologyId):void 0})},201)}catch(j){return D(j,422)}}if(G.pathname==="/api/maintenance/drill-run"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,...L1.enqueueDrill(String(w.drillId??""))},202)}catch(j){return D(j,422)}}}if(G.pathname.startsWith("/api/volumes")){let D=S.environments.get(AE),w=WE(tE).actor?.id,j=(H,f=409)=>X({ok:!1,error:H instanceof Error?H.message:String(H)},f,{"cache-control":"no-store"});if(G.pathname==="/api/volumes"&&J.method==="GET"){let H=S1.inventory(S.project.id,D?.id),f=S.store.listResources(S.project.id,D?.id).map((q)=>({id:q.id,name:q.name,slug:q.slug,kind:q.kind,provider:q.provider,providerId:q.providerId}));return X({ok:!0,volumes:H,resources:f,operations:r_.list({projectId:S.project.id,limit:100}).filter((q)=>q.operation.kind.startsWith("volume.")),recoveryPoints:l_.listRecoveryPoints(S.project.id).filter((q)=>q.kind==="volume"),providers:A1.map((q)=>({provider:q.provider,type:q.type,capabilities:q.capabilities()}))},200,{"cache-control":"no-store"})}if(G.pathname==="/api/volumes"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,...$t.create({organizationId:S.organization.id,projectId:S.project.id,environmentId:D?.id,resourceId:H.resourceId?String(H.resourceId):void 0,name:String(H.name??""),provider:String(H.provider??"docker"),type:H.type==="docker"?"docker":H.type,capacityBytes:H.capacityBytes==null?void 0:Number(H.capacityBytes),filesystem:H.filesystem?String(H.filesystem):void 0,encrypted:H.encrypted===!0,desiredState:H.desiredState&&typeof H.desiredState==="object"?H.desiredState:{},actorId:w})},202,{"cache-control":"no-store"})}catch(f){return j(f,422)}}if(G.pathname==="/api/volumes/attach"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,...$t.attach(String(H.volumeId??""),{resourceId:String(H.resourceId??""),targetPath:String(H.targetPath??""),readOnly:H.readOnly===!0,uid:H.uid==null?void 0:Number(H.uid),gid:H.gid==null?void 0:Number(H.gid),mode:H.mode?String(H.mode):void 0,propagation:H.propagation,driverOptions:H.driverOptions&&typeof H.driverOptions==="object"?H.driverOptions:{},actorId:w})},202)}catch(f){return j(f,422)}}if(G.pathname==="/api/volumes/detach"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,...$t.detach(String(H.volumeId??""),String(H.attachmentId??""),{force:H.force===!0,drained:H.drained===!0,unmounted:H.unmounted===!0,confirmation:H.confirmation?String(H.confirmation):void 0,actorId:w})},202)}catch(f){return j(f)}}if(G.pathname==="/api/volumes/resize"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,...$t.resize(String(H.volumeId??""),Number(H.capacityBytes),{drained:H.drained===!0,actorId:w})},202)}catch(f){return j(f,422)}}if(G.pathname==="/api/volumes/snapshot"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,...$t.snapshot(String(H.volumeId??""),{name:H.name?String(H.name):void 0,actorId:w})},202)}catch(f){return j(f,422)}}if(G.pathname==="/api/volumes/restore"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,...$t.restore(String(H.snapshotId??""),{name:String(H.name??""),actorId:w})},202)}catch(f){return j(f,422)}}if(G.pathname==="/api/volumes/discover"&&J.method==="POST")try{return X({ok:!0,volumes:await $t.discover({organizationId:S.organization.id,projectId:S.project.id,environmentId:D?.id,actorId:w})})}catch(H){return j(H,502)}if(G.pathname==="/api/volumes/adopt"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,volume:$t.adopt(String(H.volumeId??""),{name:String(H.name??""),actorId:w})})}catch(f){return j(f,422)}}if(G.pathname==="/api/volumes"&&J.method==="DELETE"){let H=await a(J),f=Q_.resolveSession(J);try{return X({ok:!0,...$t.delete(String(H.volumeId??""),{recentAuthAt:!RE||f&&dE.isRecentlyAuthenticated(f)?new Date().toISOString():void 0,confirmation:H.confirmation?String(H.confirmation):void 0,backupOverride:H.backupOverride===!0,backupOverrideConfirmation:H.backupOverrideConfirmation?String(H.backupOverrideConfirmation):void 0,actorId:w})},202)}catch(q){return j(q)}}}if(G.pathname==="/api/backups"&&J.method==="GET"){let D=S.environments.get(AE),w=l_.listPolicies(S.project.id,D?.id),j=new Set(w.map((u)=>u.id)),H=l_.listRecoveryPoints(S.project.id).filter((u)=>!u.policyId||j.has(u.policyId)),f=l_.listJobs(S.project.id).filter((u)=>!u.policyId||j.has(u.policyId)),q=(u)=>({...u,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!u.credentialRef,clientEncryptionConfigured:!!u.encryptionKeyRef}),K=await Promise.all(l_.listDestinations(S.project.id).map(async(u)=>({...q(u),credentialStatus:await P9(u,gT)})));return X({ok:!0,destinations:K,policies:w,recoveryPoints:H,jobs:f,coverage:l_.coverage(S.project.id).filter((u)=>j.has(u.policy.id)),resources:D?S.store.listResources(S.project.id,D.id).map((u)=>({id:u.id,name:u.name,slug:u.slug,kind:u.kind})):[]})}if(G.pathname==="/api/backups/destinations"&&J.method==="POST"){let D=await a(J),w=String(D.name??"").trim(),j=String(D.provider??""),H=String(D.encryption??"provider"),f=`secret://data-services/backups/${S.project.id}/${w}`,q=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(j))return X({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(H))return X({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let K,u;if(D.credentials&&typeof D.credentials==="object"&&!Array.isArray(D.credentials))K=`${f}/credentials`,await gT.put(K,JSON.stringify(D.credentials)),q.push(K);if(H!=="provider"){let IE=String(D.encryptionKey??"");if(IE.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");u=`${f}/encryption-key`,await gT.put(u,IE),q.push(u)}let SE=l_.createDestination({organizationId:S.organization.id,projectId:S.project.id,name:w,provider:j,endpoint:D.endpoint?String(D.endpoint):void 0,endpointPolicy:D.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:D.bucket?String(D.bucket):void 0,prefix:String(D.prefix??""),region:D.region?String(D.region):$d,forcePathStyle:D.forcePathStyle===!0,credentialRef:K,encryption:H,encryptionKeyRef:u,immutability:D.immutability&&typeof D.immutability==="object"&&!Array.isArray(D.immutability)?D.immutability:{},status:"untested"});return X({ok:!0,destination:{...SE,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!K,clientEncryptionConfigured:!!u}},201)}catch(K){for(let u of q)await gT.remove(u).catch(()=>{});return X({ok:!1,error:K instanceof Error?K.message:String(K)},422)}}if(G.pathname==="/api/backups/destinations/test"&&J.method==="POST"){let D=await a(J),w=l_.getDestination(String(D.id??""));if(!w||w.projectId!==S.project.id)return X({ok:!1,error:"Backup destination was not found."},404);if(w.provider==="aws_backup")return X({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await QF.test(w),X({ok:!0,destination:l_.recordDestinationTest(w.id,{ok:!0})})}catch(j){let H=j instanceof Error?j.message:String(j);return l_.recordDestinationTest(w.id,{ok:!1,error:H}),X({ok:!1,error:H},502)}}if(G.pathname==="/api/backups/policies"&&J.method==="POST"){let D=await a(J),w=S.environments.get(AE),j=l_.getDestination(String(D.destinationId??"")),H=String(D.resourceKind??""),f=D.dataServiceId?String(D.dataServiceId):void 0,q=f?W_.get(f):void 0,K=D.resourceId?String(D.resourceId):void 0,u=K?S.store.getResource(K):void 0;if(!w)return X({ok:!1,error:"Environment was not found."},404);if(!j||j.projectId!==S.project.id)return X({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(H))return X({ok:!1,error:"A supported backup resource kind is required."},422);if(f&&(!q||q.projectId!==S.project.id||q.environmentId!==w.id))return X({ok:!1,error:"Data service was not found in this environment."},404);if(K&&(!u||u.projectId!==S.project.id||u.environmentId!==w.id))return X({ok:!1,error:"Resource was not found in this environment."},404);if(H==="managed_database"&&!q)return X({ok:!1,error:"Managed database policies require a data service."},422);if(H==="logical_database"&&(!q||!["container","server"].includes(q.provider)))return X({ok:!1,error:"Logical database policies require an on-box data service."},422);if(H==="volume"&&(!u||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(D.volumeName??""))))return X({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let SE=Array.isArray(D.includePatterns)?D.includePatterns.map(String).filter(Boolean):[];if(H==="files"&&(!u||!SE.length))return X({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(H==="control_plane"&&j.encryption==="provider")return X({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(H==="infrastructure"&&(j.provider!=="aws_backup"||!SE.some((IE)=>IE.startsWith("resource:arn:"))||!SE.some((IE)=>IE.startsWith("role:arn:"))))return X({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let IE=l_.createPolicy({organizationId:S.organization.id,projectId:S.project.id,environmentId:w.id,resourceId:K,dataServiceId:f,destinationId:j.id,name:String(D.name??"").trim(),resourceKind:H,schedule:String(D.schedule??"daily"),timezone:String(D.timezone??"UTC"),retention:D.retention&&typeof D.retention==="object"&&!Array.isArray(D.retention)?D.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(D.compression))?D.compression:"gzip",encryption:["destination","client_side","both"].includes(String(D.encryption))?D.encryption:"destination",includePatterns:H==="volume"?[String(D.volumeName),...SE]:SE,excludePatterns:Array.isArray(D.excludePatterns)?D.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(D.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(D.expectedRtoMinutes)||120),healthCheckId:D.healthCheckId?String(D.healthCheckId):void 0,enabled:D.enabled!==!1});return X({ok:!0,policy:IE},201)}catch(IE){return X({ok:!1,error:IE instanceof Error?IE.message:String(IE)},422)}}if(G.pathname==="/api/backups/run"&&J.method==="POST"){let D=await a(J),w=l_.getPolicy(String(D.policyId??"")),j=S.environments.get(AE);if(!w||w.projectId!==S.project.id||w.environmentId!==j?.id)return X({ok:!1,error:"Backup policy was not found in this environment."},404);try{let H=eh.enqueueBackup(w,new Date().toISOString(),WE(tE).actor?.id);return X({ok:!0,job:H},202)}catch(H){return X({ok:!1,error:H instanceof Error?H.message:String(H)},409)}}if(G.pathname==="/api/backups/verify"&&J.method==="POST"){let D=await a(J),w=l_.getRecoveryPoint(String(D.recoveryPointId??""));if(!w||w.projectId!==S.project.id)return X({ok:!1,error:"Recovery point was not found."},404);return X({ok:!0,job:eh.enqueueVerification(w)},202)}if(G.pathname==="/api/backups/restore"&&J.method==="POST"){let D=await a(J),w=l_.getRecoveryPoint(String(D.recoveryPointId??"")),j=D.mode==="in_place"?"in_place":"isolated",H=D.target&&typeof D.target==="object"&&!Array.isArray(D.target)?{...D.target,inPlace:j==="in_place"}:{inPlace:j==="in_place"},f=Q_.resolveSession(J),q={mode:j,target:H,targetName:String(D.targetName??""),confirm:D.confirm?String(D.confirm):void 0,recentAuth:!RE||!!f&&dE.isRecentlyAuthenticated(f),downtimeAcknowledged:D.downtimeAcknowledged===!0,safetyBackupId:D.safetyBackupId?String(D.safetyBackupId):void 0};if(!w||w.projectId!==S.project.id)return X({ok:!1,error:"Recovery point was not found."},404);if(D.drill===!0&&j!=="isolated")return X({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let K=eh.planRestore(w,q);if(D.execute!==!0)return X({ok:!0,plan:K,executionCreated:!1});let u=eh.enqueueRestore(w,{...q,drill:D.drill===!0,actorId:WE(tE).actor?.id});return X({ok:!0,plan:K,job:u},202)}catch(K){return X({ok:!1,error:K instanceof Error?K.message:String(K)},409)}}if(G.pathname==="/api/backups/recovery-points"&&J.method==="POST"){let D=await a(J),w=l_.getRecoveryPoint(String(D.id??""));if(!w||w.projectId!==S.project.id)return X({ok:!1,error:"Recovery point was not found."},404);if(D.held==null&&D.pinned==null)return X({ok:!1,error:"held or pinned must be provided."},422);return X({ok:!0,recoveryPoint:l_.updateRecoveryPoint(w.id,{held:D.held==null?w.held:D.held===!0,pinned:D.pinned==null?w.pinned:D.pinned===!0})})}if(G.pathname==="/api/backups/retention"&&J.method==="POST")return X({ok:!0,jobs:eh.enqueueRetention()},202);if(G.pathname==="/api/data-services/capabilities"&&J.method==="GET"){let D=String(G.searchParams.get("engine")??""),w=String(G.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(D)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(w))return X({ok:!1,error:"A supported engine and provider are required."},422);return X({ok:!0,engine:D,provider:w,capabilities:ph(D,w)})}if(G.pathname==="/api/data-services"&&J.method==="GET"){let D=S.environments.get(AE),w=W_.list(S.project.id,D?.id).map((j)=>{let H=W_.credential(j.id);return{...j,credentialRef:void 0,credential:H?{configured:!0,username:H.username,version:H.version,rotatedAt:H.rotatedAt}:void 0,dependencies:W_.dependencies(j.id).map((f)=>({resourceId:f.resourceId,requiresRedeploy:f.requiresRedeploy}))}});return X({ok:!0,services:w})}if(G.pathname==="/api/data-services/preview"&&J.method==="POST"){let D=await a(J);if(D.id){let H=W_.get(String(D.id)),f=S.environments.get(AE),q=String(D.action??"");if(!H||H.projectId!==S.project.id||H.environmentId!==f?.id)return X({ok:!1,error:"Data service was not found in this environment."},404);if(!mD.includes(q))return X({ok:!1,error:`Action must be one of: ${mD.join(", ")}.`},422);try{return X({ok:!0,plan:gd.plan(H,q,D.changes??{})})}catch(K){return X({ok:!1,error:K instanceof Error?K.message:String(K)},422)}}let w=String(D.engine??""),j=String(D.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(w)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(j))return X({ok:!1,error:"A supported engine and provider are required."},422);return X({ok:!0,capabilities:ph(w,j),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(G.pathname==="/api/data-services"&&J.method==="POST"){let D=await a(J),w=String(D.engine??""),j=String(D.provider??""),H=S.environments.get(AE),f=WE(tE);if(!H)return X({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(w)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(j))return X({ok:!1,error:"A supported engine and provider are required."},422);let q={organizationId:S.organization.id,projectId:S.project.id,environmentId:H.id,resourceId:D.resourceId?String(D.resourceId):void 0,name:String(D.name??"").trim(),engine:w,provider:j,placement:String(D.placement??D.name??"").trim(),engineVersion:D.engineVersion?String(D.engineVersion):void 0,plan:String(D.plan??(j==="aws_elasticache"?"cache.t4g.micro":j==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:D.storageGb==null?void 0:Number(D.storageGb),highAvailability:D.highAvailability===!0,publicExposure:D.publicExposure===!0,allowedCidrs:Array.isArray(D.allowedCidrs)?D.allowedCidrs.map(String):[],desiredState:D.desiredState&&typeof D.desiredState==="object"&&!Array.isArray(D.desiredState)?D.desiredState:{},observedState:{},origin:D.adopt===!0?"adopted":"managed",managementEnabled:D.adopt!==!0,ownerActorId:f.actor?.id,username:D.username?String(D.username):void 0};try{if(D.adopt===!0){let u=W_.create({...q,status:"adopted",credentialRef:void 0});return X({ok:!0,service:u,readOnly:!0},201)}if(!YF({provider:j,engine:w}))return X({ok:!1,error:`No ${j}/${w} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let K=await gd.create(q);return X({ok:!0,service:K.service,operationId:K.operationId,oneTimeCredential:K.credential},201)}catch(K){return X({ok:!1,error:K instanceof Error?K.message:String(K)},422)}}if(G.pathname==="/api/data-services/connections"&&J.method==="GET"){let D=W_.get(String(G.searchParams.get("id")??"")),w=S.environments.get(AE);if(!D||D.projectId!==S.project.id||D.environmentId!==w?.id)return X({ok:!1,error:"Data service was not found in this environment."},404);let j=typeof D.observedState.endpoint==="string"?D.observedState.endpoint:void 0,H=typeof D.observedState.readerEndpoint==="string"?D.observedState.readerEndpoint:void 0,f=Number(D.observedState.port)||(D.engine==="postgres"?5432:D.engine==="redis"?6379:D.engine==="mongodb"?27017:D.engine==="libsql"?8080:3306),q=typeof D.observedState.database==="string"?D.observedState.database:void 0,K=typeof D.observedState.tls==="boolean"?D.observedState.tls:D.provider.startsWith("aws_"),u=[...j?[{type:D.publicExposure?"external":"internal",host:j,port:f,database:q,tls:K}]:[],...H?[{type:"internal",host:H,port:f,database:q,tls:K}]:[],{type:"tunnel",host:j??D.placement,port:f,database:q,tls:K}];return X({ok:!0,serviceId:D.id,guidance:X0(D,u)})}if(G.pathname==="/api/data-services/action"&&J.method==="POST"){let D=await a(J),w=W_.get(String(D.id??"")),j=S.environments.get(AE),H=String(D.action??"");if(!w||w.projectId!==S.project.id||w.environmentId!==j?.id)return X({ok:!1,error:"Data service was not found in this environment."},404);if(!mD.includes(H))return X({ok:!1,error:`Action must be one of: ${mD.join(", ")}.`},422);let f=D.changes&&typeof D.changes==="object"&&!Array.isArray(D.changes)?D.changes:{};try{let q=gd.plan(w,H,f);if(D.execute!==!0)return X({ok:!0,plan:q,productionExecutionCreated:!1});let K=gd.enqueue(w,H,f,WE(tE).actor?.id);return X({ok:!0,plan:q,operationId:K},202)}catch(q){return X({ok:!1,error:q instanceof Error?q.message:String(q)},409)}}if(G.pathname==="/api/data-services/dependencies"&&J.method==="POST"){let D=await a(J),w=W_.get(String(D.id??"")),j=S.environments.get(AE),H=S.store.getResource(String(D.resourceId??""));if(!w||w.projectId!==S.project.id||w.environmentId!==j?.id)return X({ok:!1,error:"Data service was not found in this environment."},404);if(!H||H.projectId!==S.project.id||H.environmentId!==j?.id)return X({ok:!1,error:"Dependent resource was not found in this environment."},404);if(D.remove===!0)return X({ok:W_.removeDependency(w.id,H.id)});return W_.addDependency({serviceId:w.id,resourceId:H.id,secretRef:w.credentialRef??`secret://data-services/${w.projectId}/${w.name}`,requiresRedeploy:D.requiresRedeploy!==!1}),X({ok:!0,dependencies:W_.dependencies(w.id).map((f)=>({resourceId:f.resourceId,requiresRedeploy:f.requiresRedeploy}))})}if(G.pathname==="/api/data-services/management"&&J.method==="POST"){let D=await a(J),w=W_.get(String(D.id??"")),j=S.environments.get(AE);if(!w||w.projectId!==S.project.id||w.environmentId!==j?.id)return X({ok:!1,error:"Data service was not found in this environment."},404);if(w.origin!=="adopted"||D.reviewed!==!0||D.confirm!==w.name)return X({ok:!1,error:`Enabling management requires reviewed=true and typing ${w.name}.`},409);return X({ok:!0,service:W_.update(w.id,w.version,{managementEnabled:!0})})}if(G.pathname==="/api/data-services/reveal"&&J.method==="POST"){let D=await a(J),w=W_.get(String(D.id??"")),j=S.environments.get(AE),H=w?W_.credential(w.id):void 0;if(!w||w.projectId!==S.project.id||w.environmentId!==j?.id)return X({ok:!1,error:"Data service was not found in this environment."},404);if(!H)return X({ok:!1,error:"No managed credential is configured."},404);return X({ok:!0,credential:{username:H.username,password:await gT.resolve(H.secretRef),version:H.version}},200,{"cache-control":"no-store"})}if(G.pathname==="/api/databases"&&J.method==="GET")return X(await T8(t,AE));if(G.pathname==="/api/databases"&&J.method==="POST"){let D=await a(J),w=String(D.name??"").trim();if(!OR(w))return X({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return X({...await r8(t,AE,w),name:w})}if(G.pathname==="/api/databases/vitess"&&J.method==="GET"){let D=await h8(t,AE);return X({...D,unhealthy:N8(D.tablets),missingPrimary:S8(D)})}if(G.pathname==="/api/databases/vitess/provision"&&J.method==="POST"){let D=await a(J);try{return X(await C8(t,AE,{keyspace:String(D.keyspace??""),username:String(D.username??""),password:String(D.password??""),sharded:D.sharded===!0,confirm:String(D.confirm??"")}))}catch(w){return X({ok:!1,error:w instanceof Error?w.message:String(w)},422)}}if(G.pathname==="/api/databases/vitess/migrations"&&J.method==="GET"){let D=G.searchParams.get("keyspace")??void 0;return X(await D8(t,AE,D))}if(G.pathname==="/api/databases/vitess/migrations/action"&&J.method==="POST"){let D=await a(J),w=String(D.uuid??"").trim(),j=String(D.action??"");if(!["retry","cancel","cleanup","complete"].includes(j))return X({ok:!1,error:"Unknown migration action."},422);return X(await I8(t,AE,w,j))}if(G.pathname==="/api/databases/vitess/keyspaces"&&J.method==="POST"){let D=await a(J),w=String(D.name??"").trim(),j=D.sharded===!0;return X(await c8(t,AE,w,{sharded:j}))}if(G.pathname==="/api/databases/vitess/vschema"&&J.method==="POST"){let D=await a(J),w=String(D.keyspace??"").trim(),j=typeof D.vschema==="string"?D.vschema:JSON.stringify(D.vschema??null);return X(await U8(t,AE,w,j))}if(G.pathname==="/api/databases/vitess/schema"&&J.method==="POST"){let D=await a(J),w=String(D.sql??"");return X(await $8(t,AE,w))}if(G.pathname==="/api/databases/vitess/install-client"&&J.method==="POST")return X(await O8(t,AE));if(G.pathname==="/api/databases/backups"&&J.method==="GET")return X(await R8(t,AE));if(G.pathname==="/api/databases/backup"&&J.method==="POST"){let D=await a(J),w=String(D.database??"").trim();if(!OR(w))return X({ok:!1,error:"Database name must be a valid identifier."},422);if(D.confirm!==w)return X({ok:!1,error:`Type "${w}" to back up this database.`},409);return X(await t8(t,AE,w))}if(G.pathname==="/api/databases/users"&&J.method==="POST"){let D=await a(J),w=String(D.username??"").trim(),j=String(D.password??""),H=String(D.database??"").trim()||void 0,f=D.access==="readonly"?"readonly":"all";if(!OR(w))return X({ok:!1,error:"Username must be a valid identifier."},422);if(!j)return X({ok:!1,error:"Password is required."},422);if(H&&!OR(H))return X({ok:!1,error:"Database must be a valid identifier."},422);return X({...await d8(t,AE,{username:w,password:j,database:H,access:f}),username:w})}if(G.pathname==="/api/dashboard-data")return H_=$.get(AE)??await y(AE),y(AE),X(lz(H_,{user:ur,slug:t.project.slug}));if(G.pathname==="/api/users"&&J.method==="GET")return X({ok:!0,users:oT(_).map(bA)});if(G.pathname==="/api/users"&&J.method==="POST"){let D=await a(J),w=String(D.username??"").trim();if(!uD(w))return X({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let j=D.sites&&typeof D.sites==="object"?D.sites:{},H=new Set(Object.keys(t.sites??{})),f={};for(let[u,SE]of Object.entries(j)){if(!H.has(u))return X({ok:!1,error:`Site '${u}' was not found.`},404);if(SE!=="owner"&&SE!=="collaborator")return X({ok:!1,error:`Unknown site role '${SE}'. Use 'owner' or 'collaborator'.`},422);f[u]=SE}let q=typeof D.password==="string"&&D.password.trim()?D.password.trim():void 0;if(q&&q.length<12)return X({ok:!1,error:"Password must be at least 12 characters."},422);let K=GO(_,{username:w,password:q,name:typeof D.name==="string"?D.name:void 0,sites:f});return _U(S,oT(_)),rE(),X({ok:!0,user:bA(K.user),password:K.password})}if(G.pathname==="/api/users"&&J.method==="DELETE"){let D=await a(J),w=String(D.username??"").trim();if(w.toLowerCase()===tE.username.toLowerCase())return X({ok:!1,error:"You cannot remove your own account."},409);let j=cd(oT(_),w),H=j?S.store.getActorByExternalId("user",`dashboard:${j.username.toLowerCase()}`):void 0,f=H?S.store.getMembershipForActor(S.organization.id,H.id):void 0;if(f&&f.source!=="legacy")return X({ok:!1,error:"Organization members must be removed from Organization access."},409);let q=nz(_,w);if(!q.ok)return X(q,409);return _U(S,oT(_)),g.clear(),X({ok:!0,username:w})}if(G.pathname==="/api/actions/run"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=D.action?RF(D.action,AE):void 0;if(!w)return X({ok:!1,error:"Unknown dashboard action."},404);if(w.mutates&&D.confirm!==w.confirm)return X({ok:!1,error:`Type "${w.confirm}" to run this action.`},409);let j=await Wt({controlPlane:S,environment:AE,actor:tE,kind:`dashboard.action.${w.id}`,input:{action:w.id},execute:()=>rF(w,{cwd:_,cliEntry:d})});return X({...j.result,controlPlaneOperation:j.operation})}if(G.pathname==="/api/server/operations/run"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=D.operation?NO(D.operation,t,H_):void 0;if(!w)return X({ok:!1,error:"Unknown or unavailable server operation."},404);if(w.mutates&&D.confirm!==w.confirm)return X({ok:!1,error:`Type "${w.confirm}" to run this operation.`},409);let j=Jr(S,String(AE));await new XN(QE).run(new OO,{...j,artifactRoot:_});let H=JN(QE,{scope:j,desiredConfigHash:S.project.desiredConfigHash});if(H.decision.outcome==="block")return X({ok:!1,error:`Operation blocked by security policy: ${H.decision.explanation}`,securityReview:H},409);let f=await Wt({controlPlane:S,environment:AE,actor:tE,kind:`dashboard.server.${w.id}`,resourceSlug:w.target,input:{operation:w.id,target:w.target,to:D.to??null},execute:()=>eA(t,AE,w,{to:D.to})});return X({...f.result,controlPlaneOperation:f.operation,securityReview:H})}if(G.pathname==="/api/server/command"&&J.method==="POST"){let D=await J.json().catch(()=>({}));if(D.confirm!=="run")return X({ok:!1,error:'Type "run" to execute this command on the server.'},409);let w=await Wt({controlPlane:S,environment:AE,actor:tE,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>IN(t,AE,String(D.command??""))});return X({...w.result,controlPlaneOperation:w.operation})}if(G.pathname==="/api/serverless/operations")return X(pz(t,AE,H_));if(G.pathname==="/api/serverless/operations/run"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=D.operation?u8(D.operation,t,AE,H_):void 0;if(!w)return X({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(w.mutates&&D.confirm!==w.confirm)return X({ok:!1,error:`Type "${w.confirm}" to run this operation.`},409);let j=await Wt({controlPlane:S,environment:AE,actor:tE,kind:`dashboard.serverless.${w.id}`,input:{operation:w.id,min:D.min??null,max:D.max??null},execute:()=>v8(t,AE,w,{min:D.min,max:D.max})});return H_=await QN(t,AE),$.set(AE,H_),X({...j.result,controlPlaneOperation:j.operation})}if(G.pathname==="/api/serverless/command"&&J.method==="POST"){let D=await J.json().catch(()=>({}));if(D.confirm!=="run")return X({ok:!1,error:'Type "run" to execute this command.'},409);return X(await n8(t,AE,String(D.command??"")))}if(G.pathname==="/api/serverless/dlq"&&J.method==="GET"){let D=Number(G.searchParams.get("max"))||10;return X(await l8(t,AE,D))}if(G.pathname==="/api/serverless/dlq/redrive"&&J.method==="POST"){let D=await J.json().catch(()=>({}));if(D.confirm!=="redrive")return X({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return X(await i8(t,AE,{max:D.max,targetQueue:D.targetQueue}))}if(G.pathname==="/api/serverless/dlq/purge"&&J.method==="POST"){if((await J.json().catch(()=>({}))).confirm!=="purge")return X({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return X(await a8(t,AE))}if(G.pathname==="/api/serverless/secrets"&&J.method==="GET")return X({secrets:m8(t,AE)});if(G.pathname==="/api/serverless/secrets"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=String(D.secretId??"").trim();if(!w)return X({ok:!1,error:"A secret id is required."},422);if(typeof D.value!=="string"||D.value==="")return X({ok:!1,error:"A non-empty value is required."},422);return X(await s8(t,AE,w,D.value))}if(G.pathname==="/api/serverless/secrets"&&J.method==="DELETE"){let D=await J.json().catch(()=>({})),w=String(D.secretId??"").trim();if(!w)return X({ok:!1,error:"A secret id is required."},422);if(D.confirm!==w)return X({ok:!1,error:`Type "${w}" to delete this secret.`},409);return X(await p8(t,AE,w))}if(G.pathname==="/api/serverless/functions/config"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=String(D.mode??"").trim();if(D.confirm!==w)return X({ok:!1,error:`Type "${w}" to update this function.`},409);return X(await o8(t,AE,w,{memory:D.memory,timeout:D.timeout}))}if(G.pathname==="/api/serverless/alarms"&&J.method==="GET")return X(await EG(t,AE));if(G.pathname==="/api/serverless/alarms"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=String(D.preset??"").trim(),j=Number(D.threshold);if(!w)return X({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(j))return X({ok:!1,error:"A numeric threshold is required."},422);return X(await _G(t,AE,w,j))}if(G.pathname==="/api/serverless/alarms"&&J.method==="DELETE"){let D=await J.json().catch(()=>({})),w=String(D.name??"").trim();if(!w)return X({ok:!1,error:"An alarm name is required."},422);if(D.confirm!==w)return X({ok:!1,error:`Type "${w}" to delete this alarm.`},409);return X(await TG(t,AE,w))}if(G.pathname==="/api/serverless/traces"&&J.method==="GET"){let D=Number(G.searchParams.get("minutes"))||30;return X(await iD(t,AE,D))}if(G.pathname==="/api/serverless/scheduler"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=String(D.action??"").trim();if(w!=="enable"&&w!=="disable"&&w!=="run")return X({ok:!1,error:"Unknown scheduler action."},422);if(D.confirm!==w)return X({ok:!1,error:`Type "${w}" to ${w} the scheduler.`},409);return X(await _F(t,AE,w))}if(!CG(G.pathname,ur))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(AE)}`}});let gN=await P(tE,AE);if(!gN)return pD("ts-cloud dashboard UI is unavailable.",503);return wG(gN,G.pathname)}catch(Jh){if(E.verbose)console.error(Jh);return X({ok:!1,error:Jh?.message??String(Jh)},500)}})();if(!v_)return v_;if(D_&&(G.pathname.startsWith("/api/")||G.pathname.startsWith("/auth/"))){let vE;if((eE.headers.get("content-type")||"").includes("application/json"))vE=await eE.json().catch(()=>{return});let UT=Q_.resolveUser(J),dT=UT?WE(UT).actor:void 0;S.store.appendEvent({organizationId:S.organization.id,projectId:S.project.id,actorId:dT?.id,correlationId:ZE,type:v_.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:v_.status<400?"info":"warning",payload:Zp(J.method,G.pathname,vE,v_.status,Date.now()-YE)})}return v_.headers.set("x-request-id",ZE),v_}});kO?.start();let lG=ZN.stop.bind(ZN);return ZN.stop=(J)=>{clearInterval(uF),clearInterval(vF),clearInterval(nF),clearInterval(kF),clearInterval(bF),clearInterval(ZF),clearInterval(qF),clearInterval(gF),clearInterval(xF),rE(),i_.clear(),kO?.stop();let XE=lG(J);if(kO)kO.settled().finally(()=>S.store.close());else S.store.close();return XE},{server:ZN,url:`http://${T}:${ZN.port}/`}}function J_(E){return new dS(E?{path:d1(E)}:{})}function Ao(E){let _=E.health();b("Control-plane diagnostics"),U(`Database: ${_.path}`),U(`Schema: ${_.schemaVersion}/${_.supportedSchemaVersion}`),U(`Integrity: ${_.integrity}`),U(`Journal: ${_.journalMode}`),U(`Size: ${_.databaseBytes.toLocaleString()} bytes`),U(`Last backup: ${_.lastBackupAt??"never"}`),U(`Operations: ${Object.entries(_.operations).map(([T,r])=>`${T}=${r}`).join(", ")}`),U(`Pending/retryable: ${_.pendingRetryableOperations}`)}function UR(E,_){let T=E.getOrganization(_)??E.getOrganizationBySlug(_);if(!T)throw Error(`Organization '${_}' was not found.`);return T}function _1(E,_){let T=E??"organization";if(T==="organization")return{type:"organization"};if(!["project","environment","resource"].includes(T)||!_)throw Error("Scoped access requires --scope project|environment|resource and --scope-id <id>.");return{type:T,id:_}}function T1(E,_){let T=_.includes("@")?E.getIdentityByEmail(_):E.getIdentityByUsername(_);if(!T)throw Error(`Authentication identity '${_}' was not found.`);return T}function r1(E,_){return new Id(E,{encryptionKey:q_(d1(_??process.cwd()))})}function JG(E,_="TS_CLOUD_API_TOKEN"){let T=process.env[_]?.trim();if(!T)throw Error(`Set ${_} to a one-time-issued API token.`);return new $D({baseUrl:E??process.env.TS_CLOUD_API_URL??"http://127.0.0.1:7676",token:T})}function hF(E){E.command("dashboard:serve","Run the local Forge-style cloud management UI").option("--host <host>","Host to bind",{default:"127.0.0.1"}).option("--port <port>","Port to bind",{default:"7676"}).option("--env <environment>","Environment to manage").option("--box","Box mode: run on the provisioned server (operate on localhost)").option("--open","Print the URL for opening in a browser").option("--verbose","Print server errors").action(async(_)=>{let T=await E1({host:_?.host,port:Number(_?.port??7676),environment:_?.env,box:_?.box,verbose:_?.verbose});b("ts-cloud Local Dashboard"),Z(`Serving ${T.url}`),U("Use Ctrl+C to stop."),await new Promise((r)=>{let d=()=>{T.server.stop(!0),r()};process.once("SIGINT",d),process.once("SIGTERM",d)})}),E.command("control-plane:status","Inspect local control-plane storage health").option("--path <path>","Use a non-default control-plane database").action((_)=>{let T=J_(_?.path);try{Ao(T)}finally{T.close()}}),E.command("control-plane:backup","Create a consistent local control-plane backup").option("--path <path>","Use a non-default control-plane database").action((_)=>{let T=J_(_?.path);try{let r=T.createBackup("cli");Z(`Backup written to ${r}`)}finally{T.close()}}),E.command("control-plane:export <file>","Export portable control-plane metadata and history").option("--path <path>","Use a non-default control-plane database").action((_,T)=>{let r=d1(_),d=J_(T?.path);try{Ro(So(r),{recursive:!0}),No(r,`${JSON.stringify(d.exportSnapshot(),null,2)}
+`);return new Response(nE,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(G.pathname==="/api/telemetry/saved-queries"&&J.method==="GET"){let $E=WE(tE);return X({ok:!0,queries:w.listSavedQueries(S.project.id,$E.actor?.id)})}if(G.pathname==="/api/telemetry/saved-queries"&&J.method==="POST"){let $E=await a(J),HE=WE(tE);return X({ok:!0,query:w.saveQuery(S.project.id,HE.actor?.id,String($E.name??""),u($E.query??$E))},201)}if(G.pathname==="/api/telemetry/saved-queries"&&J.method==="DELETE"){let $E=await a(J),HE=WE(tE),cE=w.deleteSavedQuery(S.project.id,HE.actor?.id,String($E.id??""));return X({ok:cE},cE?200:404)}}if(G.pathname.startsWith("/api/configuration")){let D=S.environments.get(AE),w=tE.role==="admin"||!!ur.capabilities?.includes("secrets:read"),j=tE.role==="admin"||!!ur.capabilities?.includes("secrets:write"),H={projectId:S.project.id,environmentId:D?.id},f={"cache-control":"no-store"};if(G.pathname==="/api/configuration"&&J.method==="GET"){let q=Object.fromEntries(G.searchParams),K=q.scopeType||q.scopeId?kA(q,H):void 0,u=["variable","secret"].includes(String(q.kind))?q.kind:void 0,SE=K?.type==="preview"?b_.previews.getInstance(K.id):void 0,IE=SE?b_.previews.getDefinition(SE.definitionId):void 0,d_=K?await _r.resolve({projectId:S.project.id,environmentId:K.environmentId,resourceId:K.resourceId,functionId:K.type==="function"?K.id:void 0,previewId:K.previewId,trustedPreview:!!SE&&!SE.fork,allowedPreviewSecrets:IE?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:w}):void 0,$E=S.store.listResources(S.project.id);return X({ok:!0,entries:_r.list({projectId:S.project.id,scope:K,kind:u,search:q.search,canReadSecretMetadata:w}),effectiveEntries:d_?Object.values(d_.entries).filter((HE)=>!u||HE.kind===u).filter((HE)=>!q.search||HE.key.toLowerCase().includes(String(q.search).toLowerCase())):[],configurationHash:d_?.configurationHash,warnings:d_?.warnings??[],scopes:{project:S.project,environments:S.store.listEnvironments(S.project.id),resources:$E.filter((HE)=>HE.kind!=="function"),functions:$E.filter((HE)=>HE.kind==="function"),previews:b_.previews.listInstances({projectId:S.project.id}).filter((HE)=>HE.status!=="destroyed").map((HE)=>({id:HE.id,name:HE.name,environmentId:HE.baseEnvironmentId,resourceId:HE.resourceId,fork:HE.fork,status:HE.status}))}},200,f)}if(G.pathname==="/api/configuration/export"&&J.method==="GET"){let q=kA(Object.fromEntries(G.searchParams),H);return new Response(_r.exportVariables({projectId:S.project.id,scope:q}),{headers:{...f,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(G.pathname==="/api/configuration/plan"&&J.method==="POST"){let q=await a(J),K=kA(q,H),u=q.values&&typeof q.values==="object"&&!Array.isArray(q.values)?Object.fromEntries(Object.entries(q.values).map(([SE,IE])=>[SE,String(IE)])):{};return X({ok:!0,plan:_r.plan({projectId:S.project.id,scope:K,values:u,removeMissing:q.removeMissing===!0})},200,f)}if(G.pathname==="/api/configuration"&&J.method==="POST"){let q=await a(J),K=kA(q,H),u=q.kind==="secret"?"secret":"variable",SE=String(q.key??"");if(u==="secret"&&!j)return X({ok:!1,error:"Secret write permission is required."},403,f);try{let IE=await _r.set({organizationId:S.organization.id,projectId:S.project.id,scope:K,key:SE,kind:u,value:q.value==null?void 0:String(q.value),reference:q.reference==null?void 0:String(q.reference),backend:q.backend,required:q.required===!0,expectedVersion:q.expectedVersion==null?void 0:Number(q.expectedVersion),confirmed:String(q.confirm??"")===SE,idempotencyKey:J.headers.get("idempotency-key")??q.idempotencyKey,actorId:WE(tE).actor?.id});return X({ok:!0,entry:_r.list({projectId:S.project.id,scope:K,canReadSecretMetadata:w}).find((d_)=>d_.id===IE.entry.id),mutation:IE.mutation,warnings:IE.warnings},IE.mutation.added.length?201:200,f)}catch(IE){return X({ok:!1,error:IE instanceof Error?IE.message:String(IE)},409,f)}}if(G.pathname==="/api/configuration/import"&&J.method==="POST"){let q=await a(J),K=kA(q,H),u=Array.isArray(q.secretKeys)?q.secretKeys.map(String):[];if(u.length&&!j)return X({ok:!1,error:"Secret write permission is required."},403,f);try{let SE=await _r.importDotenv({organizationId:S.organization.id,projectId:S.project.id,scope:K,source:String(q.source??""),secretKeys:u,backend:q.backend,confirmed:q.confirm==="import",idempotencyKey:J.headers.get("idempotency-key")??q.idempotencyKey,actorId:WE(tE).actor?.id});return X({ok:SE.document.valid,diagnostics:SE.document.diagnostics,mutation:SE.mutation,warnings:SE.warnings},SE.document.valid?200:422,f)}catch(SE){return X({ok:!1,error:SE instanceof Error?SE.message:String(SE)},409,f)}}if(G.pathname==="/api/configuration/dependencies"&&J.method==="POST"){let q=await a(J),K=PT.get(String(q.entryId??"")),u=S.store.getResource(String(q.resourceId??""));if(!K||K.projectId!==S.project.id||!u||u.projectId!==S.project.id)return X({ok:!1,error:"Configuration entry or dependent resource was not found."},404,f);return X({ok:!0,dependency:PT.setDependency({entryId:K.id,resourceId:u.id,injectionTarget:["native_reference","file"].includes(String(q.injectionTarget))?q.injectionTarget:"environment",required:q.required!==!1,requiresRedeploy:q.requiresRedeploy!==!1,lastDeployedVersion:q.lastDeployedVersion==null?void 0:Number(q.lastDeployedVersion)})},200,f)}if(G.pathname==="/api/configuration/transfer"&&J.method==="POST"){let q=await a(J),K=PT.get(String(q.id??"")),u=kA({...q,scopeType:q.targetScopeType,scopeId:q.targetScopeId},H);if(!K||K.projectId!==S.project.id)return X({ok:!1,error:"Configuration entry was not found."},404,f);if(K.kind==="secret"&&!j)return X({ok:!1,error:"Secret write permission is required."},403,f);try{let SE=await _r.transfer({entryId:K.id,targetScope:u,mode:q.mode==="move"?"move":"copy",confirmed:q.confirm===K.key,actorId:WE(tE).actor?.id,idempotencyKey:J.headers.get("idempotency-key")??q.idempotencyKey});return X({ok:!0,entry:_r.list({projectId:S.project.id,scope:u,canReadSecretMetadata:w}).find((IE)=>IE.id===SE.entry.id),mutation:SE.mutation},200,f)}catch(SE){return X({ok:!1,error:SE instanceof Error?SE.message:String(SE)},409,f)}}if(G.pathname==="/api/configuration/bulk"&&J.method==="POST"){let q=await a(J),K=Array.isArray(q.ids)?q.ids.map(String).slice(0,500):[],u=K.map((IE)=>PT.get(IE)).filter((IE)=>!!IE&&IE.projectId===S.project.id);if(u.length!==K.length)return X({ok:!1,error:"One or more configuration entries were not found."},404,f);if(u.some((IE)=>IE.kind==="secret")&&!j)return X({ok:!1,error:"Secret write permission is required."},403,f);if(q.action!=="delete"||q.confirm!=="bulk")return X({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,f);let SE=[];try{for(let IE of u)SE.push(await _r.remove({entryId:IE.id,expectedVersion:IE.version,confirmed:!0,actorId:WE(tE).actor?.id}));return X({ok:!0,removed:SE.flatMap((IE)=>IE.removed),affectedResourceIds:[...new Set(SE.flatMap((IE)=>IE.affectedResourceIds))].sort()},200,f)}catch(IE){return X({ok:!1,error:IE instanceof Error?IE.message:String(IE),partial:SE.flatMap((d_)=>d_.removed)},409,f)}}if(G.pathname==="/api/configuration/reveal"&&J.method==="POST"){let q=await a(J),K=Q_.resolveSession(J);try{return X({ok:!0,value:await _r.reveal({entryId:String(q.id??""),canRevealSecrets:w,recentlyAuthenticated:!RE||!!K&&dE.isRecentlyAuthenticated(K),actorId:WE(tE).actor?.id})},200,f)}catch(u){return X({ok:!1,error:u instanceof Error?u.message:String(u)},403,f)}}if(G.pathname==="/api/configuration"&&J.method==="DELETE"){let q=await a(J),K=PT.get(String(q.id??""));if(K?.kind==="secret"&&!j)return X({ok:!1,error:"Secret write permission is required."},403,f);if(!K||K.projectId!==S.project.id)return X({ok:!1,error:"Configuration entry was not found."},404,f);try{return X({ok:!0,mutation:await _r.remove({entryId:K.id,expectedVersion:Number(q.expectedVersion),confirmed:String(q.confirm??"")===K.key,actorId:WE(tE).actor?.id})},200,f)}catch(u){return X({ok:!1,error:u instanceof Error?u.message:String(u)},409,f)}}}if(G.pathname.startsWith("/api/fleet")){let D=WE(tE).actor?.id,w=(j,H=409)=>X({ok:!1,error:j instanceof Error?j.message:String(j)},H,{"cache-control":"no-store"});if(G.pathname==="/api/fleet"&&J.method==="GET")return X({ok:!0,servers:lA.list(S.project.id),resources:S.store.listResources(S.project.id),operations:r_.list({projectId:S.project.id,limit:200}).filter((j)=>j.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(G.pathname==="/api/fleet"&&J.method==="POST"){let j=await a(J);try{return X({ok:!0,server:xd.enroll({organizationId:S.organization.id,projectId:S.project.id,name:String(j.name??""),provider:["aws","hetzner"].includes(String(j.provider))?j.provider:"ssh",providerId:j.providerId?String(j.providerId):void 0,region:j.region?String(j.region):void 0,zone:j.zone?String(j.zone):void 0,endpoint:String(j.endpoint??""),sshUser:String(j.sshUser??"deploy"),sshPort:j.sshPort?Number(j.sshPort):22,credentialRef:String(j.credentialRef??""),roles:Array.isArray(j.roles)?j.roles:[],labels:j.labels&&typeof j.labels==="object"?j.labels:{}})},201)}catch(H){return w(H,422)}}if(G.pathname==="/api/fleet/action"&&J.method==="POST"){let j=await a(J),H=String(j.id??""),f=String(j.action??"");try{if(f==="test")return X({ok:!0,server:await xd.test(H)});if(f==="validate")return X({ok:!0,server:await xd.validate(H)});if(f==="review_host_key")return X({ok:!0,server:xd.reviewHostKey(H,String(j.fingerprint??""))});if(f==="bootstrap")return X({ok:!0,...xd.bootstrap(H,j.confirmed===!0)},j.confirmed===!0?202:200);if(f==="heartbeat")return X({ok:!0,server:xd.heartbeat(H,{usage:j.usage&&typeof j.usage==="object"?j.usage:{}})});if(f==="drain")return X({ok:!0,server:xd.drain(H,j.completed===!0)});if(f==="uncordon")return X({ok:!0,server:xd.uncordon(H)});if(f==="archive")return X({ok:!0,server:xd.archive(H,String(j.confirmation??""))});return w("Unsupported fleet action.",422)}catch(q){return w(q)}}}if(G.pathname.startsWith("/api/capacity")){let D=(w,j=409)=>X({ok:!1,error:w instanceof Error?w.message:String(w)},j,{"cache-control":"no-store"});if(G.pathname==="/api/capacity"&&J.method==="GET")return X({ok:!0,pools:DR.listPools(S.project.id),placements:DR.listPlacements(S.project.id),servers:lA.list(S.project.id)},200,{"cache-control":"no-store"});if(G.pathname==="/api/capacity"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,pool:DR.createPool({organizationId:S.organization.id,projectId:S.project.id,name:String(w.name??""),purpose:String(w.purpose??"application"),backend:String(w.backend??"server"),region:w.region?String(w.region):void 0,architecture:w.architecture?String(w.architecture):void 0,labels:w.labels&&typeof w.labels==="object"?w.labels:{},requiredServerLabels:w.requiredServerLabels&&typeof w.requiredServerLabels==="object"?w.requiredServerLabels:{},toleratedTaints:Array.isArray(w.toleratedTaints)?w.toleratedTaints.map(String):[],capacity:w.capacity&&typeof w.capacity==="object"?w.capacity:{},maxWorkloads:Number(w.maxWorkloads??10),costWeight:Number(w.costWeight??1),spreadKey:w.spreadKey?String(w.spreadKey):void 0,concurrency:Number(w.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(j){return D(j,422)}}if(G.pathname==="/api/capacity/member"&&J.method==="POST"){let w=await a(J);try{return DR.addMember(String(w.poolId??""),String(w.serverId??"")),X({ok:!0,pool:DR.getPool(String(w.poolId??""))})}catch(j){return D(j,422)}}if(G.pathname==="/api/capacity/explain"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,decisions:GF.explain(S.project.id,{purpose:String(w.purpose??"application"),resources:w.resources&&typeof w.resources==="object"?w.resources:{},region:w.region?String(w.region):void 0,architecture:w.architecture?String(w.architecture):void 0,labels:w.labels&&typeof w.labels==="object"?w.labels:{}})})}catch(j){return D(j,422)}}if(G.pathname==="/api/capacity/action"&&J.method==="POST"){let w=await a(J);try{if(w.action==="drain")return X({ok:!0,...GF.drainPool(String(w.poolId??""))});if(w.action==="enable")return X({ok:!0,pool:DR.updatePool(String(w.poolId??""),{status:"active"})});if(w.action==="disable")return X({ok:!0,pool:DR.updatePool(String(w.poolId??""),{status:"disabled"})});return D("Unsupported capacity action.",422)}catch(j){return D(j,422)}}}if(G.pathname.startsWith("/api/regions")){let D=(w,j=409)=>X({ok:!1,error:w instanceof Error?w.message:String(w)},j,{"cache-control":"no-store"});if(G.pathname==="/api/regions"&&J.method==="GET")return X({ok:!0,topologies:Xh.list(S.project.id).map((w)=>({topology:w,targets:Xh.targets(w.id),channels:Xh.channels(w.id),route:Xh.route(w.id),executions:Xh.executions(w.id)}))},200,{"cache-control":"no-store"});if(G.pathname==="/api/regions"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,topology:MF.create({organizationId:S.organization.id,projectId:S.project.id,environmentId:S.environments.get(AE)?.id,name:String(w.name??""),hostname:String(w.hostname??""),regions:Array.isArray(w.regions)?w.regions:[],trafficPolicy:w.trafficPolicy==="weighted"||w.trafficPolicy==="latency"?w.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(w.replicate)?w.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(w.maxLagSeconds??30),retainOnDestroy:w.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:w.cdnEnabled===!0,wafEnabled:w.wafEnabled===!0})},201)}catch(j){return D(j,422)}}if(G.pathname==="/api/regions/action"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,...MF.enqueue({topologyId:String(w.topologyId??""),kind:String(w.action??""),targetRegion:w.targetRegion?String(w.targetRegion):void 0,revision:w.revision?String(w.revision):void 0,manifest:w.manifest&&typeof w.manifest==="object"?w.manifest:{},confirmation:w.confirmation?String(w.confirmation):void 0,deleteData:w.deleteData===!0})},202)}catch(j){return D(j,422)}}}if(G.pathname.startsWith("/api/maintenance")){let D=(w,j=409)=>X({ok:!1,error:w instanceof Error?w.message:String(w)},j,{"cache-control":"no-store"});if(G.pathname==="/api/maintenance"&&J.method==="GET")return X({ok:!0,manifests:Dt.manifests(S.organization.id),windows:Dt.windows(S.project.id),campaigns:Dt.campaigns(S.project.id).map((w)=>({campaign:w,targets:Dt.targets(w.id)})),cleanups:Dt.cleanups(S.project.id),drills:Dt.drills(S.project.id)},200,{"cache-control":"no-store"});if(G.pathname==="/api/maintenance/cleanup-preview"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,plan:await L1.previewCleanup({projectId:S.project.id,kind:String(w.kind??"operations"),criteria:{olderThanDays:Number(w.olderThanDays??30)}},fF)},201)}catch(j){return D(j,422)}}if(G.pathname==="/api/maintenance/cleanup-apply"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,...L1.enqueueCleanup(String(w.planId??""),String(w.confirmation??""))},202)}catch(j){return D(j,422)}}if(G.pathname==="/api/maintenance/drill"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,drill:Dt.createDrill({projectId:S.project.id,scenario:String(w.scenario??"control_plane"),isolatedTarget:String(w.isolatedTarget??""),expectedRpoMinutes:Number(w.expectedRpoMinutes??60),expectedRtoMinutes:Number(w.expectedRtoMinutes??30),recoveryPointId:w.recoveryPointId?String(w.recoveryPointId):void 0,topologyId:w.topologyId?String(w.topologyId):void 0})},201)}catch(j){return D(j,422)}}if(G.pathname==="/api/maintenance/drill-run"&&J.method==="POST"){let w=await a(J);try{return X({ok:!0,...L1.enqueueDrill(String(w.drillId??""))},202)}catch(j){return D(j,422)}}}if(G.pathname.startsWith("/api/volumes")){let D=S.environments.get(AE),w=WE(tE).actor?.id,j=(H,f=409)=>X({ok:!1,error:H instanceof Error?H.message:String(H)},f,{"cache-control":"no-store"});if(G.pathname==="/api/volumes"&&J.method==="GET"){let H=S1.inventory(S.project.id,D?.id),f=S.store.listResources(S.project.id,D?.id).map((q)=>({id:q.id,name:q.name,slug:q.slug,kind:q.kind,provider:q.provider,providerId:q.providerId}));return X({ok:!0,volumes:H,resources:f,operations:r_.list({projectId:S.project.id,limit:100}).filter((q)=>q.operation.kind.startsWith("volume.")),recoveryPoints:l_.listRecoveryPoints(S.project.id).filter((q)=>q.kind==="volume"),providers:A1.map((q)=>({provider:q.provider,type:q.type,capabilities:q.capabilities()}))},200,{"cache-control":"no-store"})}if(G.pathname==="/api/volumes"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,...$t.create({organizationId:S.organization.id,projectId:S.project.id,environmentId:D?.id,resourceId:H.resourceId?String(H.resourceId):void 0,name:String(H.name??""),provider:String(H.provider??"docker"),type:H.type==="docker"?"docker":H.type,capacityBytes:H.capacityBytes==null?void 0:Number(H.capacityBytes),filesystem:H.filesystem?String(H.filesystem):void 0,encrypted:H.encrypted===!0,desiredState:H.desiredState&&typeof H.desiredState==="object"?H.desiredState:{},actorId:w})},202,{"cache-control":"no-store"})}catch(f){return j(f,422)}}if(G.pathname==="/api/volumes/attach"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,...$t.attach(String(H.volumeId??""),{resourceId:String(H.resourceId??""),targetPath:String(H.targetPath??""),readOnly:H.readOnly===!0,uid:H.uid==null?void 0:Number(H.uid),gid:H.gid==null?void 0:Number(H.gid),mode:H.mode?String(H.mode):void 0,propagation:H.propagation,driverOptions:H.driverOptions&&typeof H.driverOptions==="object"?H.driverOptions:{},actorId:w})},202)}catch(f){return j(f,422)}}if(G.pathname==="/api/volumes/detach"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,...$t.detach(String(H.volumeId??""),String(H.attachmentId??""),{force:H.force===!0,drained:H.drained===!0,unmounted:H.unmounted===!0,confirmation:H.confirmation?String(H.confirmation):void 0,actorId:w})},202)}catch(f){return j(f)}}if(G.pathname==="/api/volumes/resize"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,...$t.resize(String(H.volumeId??""),Number(H.capacityBytes),{drained:H.drained===!0,actorId:w})},202)}catch(f){return j(f,422)}}if(G.pathname==="/api/volumes/snapshot"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,...$t.snapshot(String(H.volumeId??""),{name:H.name?String(H.name):void 0,actorId:w})},202)}catch(f){return j(f,422)}}if(G.pathname==="/api/volumes/restore"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,...$t.restore(String(H.snapshotId??""),{name:String(H.name??""),actorId:w})},202)}catch(f){return j(f,422)}}if(G.pathname==="/api/volumes/discover"&&J.method==="POST")try{return X({ok:!0,volumes:await $t.discover({organizationId:S.organization.id,projectId:S.project.id,environmentId:D?.id,actorId:w})})}catch(H){return j(H,502)}if(G.pathname==="/api/volumes/adopt"&&J.method==="POST"){let H=await a(J);try{return X({ok:!0,volume:$t.adopt(String(H.volumeId??""),{name:String(H.name??""),actorId:w})})}catch(f){return j(f,422)}}if(G.pathname==="/api/volumes"&&J.method==="DELETE"){let H=await a(J),f=Q_.resolveSession(J);try{return X({ok:!0,...$t.delete(String(H.volumeId??""),{recentAuthAt:!RE||f&&dE.isRecentlyAuthenticated(f)?new Date().toISOString():void 0,confirmation:H.confirmation?String(H.confirmation):void 0,backupOverride:H.backupOverride===!0,backupOverrideConfirmation:H.backupOverrideConfirmation?String(H.backupOverrideConfirmation):void 0,actorId:w})},202)}catch(q){return j(q)}}}if(G.pathname==="/api/backups"&&J.method==="GET"){let D=S.environments.get(AE),w=l_.listPolicies(S.project.id,D?.id),j=new Set(w.map((u)=>u.id)),H=l_.listRecoveryPoints(S.project.id).filter((u)=>!u.policyId||j.has(u.policyId)),f=l_.listJobs(S.project.id).filter((u)=>!u.policyId||j.has(u.policyId)),q=(u)=>({...u,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!u.credentialRef,clientEncryptionConfigured:!!u.encryptionKeyRef}),K=await Promise.all(l_.listDestinations(S.project.id).map(async(u)=>({...q(u),credentialStatus:await PQ(u,gT)})));return X({ok:!0,destinations:K,policies:w,recoveryPoints:H,jobs:f,coverage:l_.coverage(S.project.id).filter((u)=>j.has(u.policy.id)),resources:D?S.store.listResources(S.project.id,D.id).map((u)=>({id:u.id,name:u.name,slug:u.slug,kind:u.kind})):[]})}if(G.pathname==="/api/backups/destinations"&&J.method==="POST"){let D=await a(J),w=String(D.name??"").trim(),j=String(D.provider??""),H=String(D.encryption??"provider"),f=`secret://data-services/backups/${S.project.id}/${w}`,q=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(j))return X({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(H))return X({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let K,u;if(D.credentials&&typeof D.credentials==="object"&&!Array.isArray(D.credentials))K=`${f}/credentials`,await gT.put(K,JSON.stringify(D.credentials)),q.push(K);if(H!=="provider"){let IE=String(D.encryptionKey??"");if(IE.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");u=`${f}/encryption-key`,await gT.put(u,IE),q.push(u)}let SE=l_.createDestination({organizationId:S.organization.id,projectId:S.project.id,name:w,provider:j,endpoint:D.endpoint?String(D.endpoint):void 0,endpointPolicy:D.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:D.bucket?String(D.bucket):void 0,prefix:String(D.prefix??""),region:D.region?String(D.region):$d,forcePathStyle:D.forcePathStyle===!0,credentialRef:K,encryption:H,encryptionKeyRef:u,immutability:D.immutability&&typeof D.immutability==="object"&&!Array.isArray(D.immutability)?D.immutability:{},status:"untested"});return X({ok:!0,destination:{...SE,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!K,clientEncryptionConfigured:!!u}},201)}catch(K){for(let u of q)await gT.remove(u).catch(()=>{});return X({ok:!1,error:K instanceof Error?K.message:String(K)},422)}}if(G.pathname==="/api/backups/destinations/test"&&J.method==="POST"){let D=await a(J),w=l_.getDestination(String(D.id??""));if(!w||w.projectId!==S.project.id)return X({ok:!1,error:"Backup destination was not found."},404);if(w.provider==="aws_backup")return X({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await QF.test(w),X({ok:!0,destination:l_.recordDestinationTest(w.id,{ok:!0})})}catch(j){let H=j instanceof Error?j.message:String(j);return l_.recordDestinationTest(w.id,{ok:!1,error:H}),X({ok:!1,error:H},502)}}if(G.pathname==="/api/backups/policies"&&J.method==="POST"){let D=await a(J),w=S.environments.get(AE),j=l_.getDestination(String(D.destinationId??"")),H=String(D.resourceKind??""),f=D.dataServiceId?String(D.dataServiceId):void 0,q=f?W_.get(f):void 0,K=D.resourceId?String(D.resourceId):void 0,u=K?S.store.getResource(K):void 0;if(!w)return X({ok:!1,error:"Environment was not found."},404);if(!j||j.projectId!==S.project.id)return X({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(H))return X({ok:!1,error:"A supported backup resource kind is required."},422);if(f&&(!q||q.projectId!==S.project.id||q.environmentId!==w.id))return X({ok:!1,error:"Data service was not found in this environment."},404);if(K&&(!u||u.projectId!==S.project.id||u.environmentId!==w.id))return X({ok:!1,error:"Resource was not found in this environment."},404);if(H==="managed_database"&&!q)return X({ok:!1,error:"Managed database policies require a data service."},422);if(H==="logical_database"&&(!q||!["container","server"].includes(q.provider)))return X({ok:!1,error:"Logical database policies require an on-box data service."},422);if(H==="volume"&&(!u||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(D.volumeName??""))))return X({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let SE=Array.isArray(D.includePatterns)?D.includePatterns.map(String).filter(Boolean):[];if(H==="files"&&(!u||!SE.length))return X({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(H==="control_plane"&&j.encryption==="provider")return X({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(H==="infrastructure"&&(j.provider!=="aws_backup"||!SE.some((IE)=>IE.startsWith("resource:arn:"))||!SE.some((IE)=>IE.startsWith("role:arn:"))))return X({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let IE=l_.createPolicy({organizationId:S.organization.id,projectId:S.project.id,environmentId:w.id,resourceId:K,dataServiceId:f,destinationId:j.id,name:String(D.name??"").trim(),resourceKind:H,schedule:String(D.schedule??"daily"),timezone:String(D.timezone??"UTC"),retention:D.retention&&typeof D.retention==="object"&&!Array.isArray(D.retention)?D.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(D.compression))?D.compression:"gzip",encryption:["destination","client_side","both"].includes(String(D.encryption))?D.encryption:"destination",includePatterns:H==="volume"?[String(D.volumeName),...SE]:SE,excludePatterns:Array.isArray(D.excludePatterns)?D.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(D.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(D.expectedRtoMinutes)||120),healthCheckId:D.healthCheckId?String(D.healthCheckId):void 0,enabled:D.enabled!==!1});return X({ok:!0,policy:IE},201)}catch(IE){return X({ok:!1,error:IE instanceof Error?IE.message:String(IE)},422)}}if(G.pathname==="/api/backups/run"&&J.method==="POST"){let D=await a(J),w=l_.getPolicy(String(D.policyId??"")),j=S.environments.get(AE);if(!w||w.projectId!==S.project.id||w.environmentId!==j?.id)return X({ok:!1,error:"Backup policy was not found in this environment."},404);try{let H=eh.enqueueBackup(w,new Date().toISOString(),WE(tE).actor?.id);return X({ok:!0,job:H},202)}catch(H){return X({ok:!1,error:H instanceof Error?H.message:String(H)},409)}}if(G.pathname==="/api/backups/verify"&&J.method==="POST"){let D=await a(J),w=l_.getRecoveryPoint(String(D.recoveryPointId??""));if(!w||w.projectId!==S.project.id)return X({ok:!1,error:"Recovery point was not found."},404);return X({ok:!0,job:eh.enqueueVerification(w)},202)}if(G.pathname==="/api/backups/restore"&&J.method==="POST"){let D=await a(J),w=l_.getRecoveryPoint(String(D.recoveryPointId??"")),j=D.mode==="in_place"?"in_place":"isolated",H=D.target&&typeof D.target==="object"&&!Array.isArray(D.target)?{...D.target,inPlace:j==="in_place"}:{inPlace:j==="in_place"},f=Q_.resolveSession(J),q={mode:j,target:H,targetName:String(D.targetName??""),confirm:D.confirm?String(D.confirm):void 0,recentAuth:!RE||!!f&&dE.isRecentlyAuthenticated(f),downtimeAcknowledged:D.downtimeAcknowledged===!0,safetyBackupId:D.safetyBackupId?String(D.safetyBackupId):void 0};if(!w||w.projectId!==S.project.id)return X({ok:!1,error:"Recovery point was not found."},404);if(D.drill===!0&&j!=="isolated")return X({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let K=eh.planRestore(w,q);if(D.execute!==!0)return X({ok:!0,plan:K,executionCreated:!1});let u=eh.enqueueRestore(w,{...q,drill:D.drill===!0,actorId:WE(tE).actor?.id});return X({ok:!0,plan:K,job:u},202)}catch(K){return X({ok:!1,error:K instanceof Error?K.message:String(K)},409)}}if(G.pathname==="/api/backups/recovery-points"&&J.method==="POST"){let D=await a(J),w=l_.getRecoveryPoint(String(D.id??""));if(!w||w.projectId!==S.project.id)return X({ok:!1,error:"Recovery point was not found."},404);if(D.held==null&&D.pinned==null)return X({ok:!1,error:"held or pinned must be provided."},422);return X({ok:!0,recoveryPoint:l_.updateRecoveryPoint(w.id,{held:D.held==null?w.held:D.held===!0,pinned:D.pinned==null?w.pinned:D.pinned===!0})})}if(G.pathname==="/api/backups/retention"&&J.method==="POST")return X({ok:!0,jobs:eh.enqueueRetention()},202);if(G.pathname==="/api/data-services/capabilities"&&J.method==="GET"){let D=String(G.searchParams.get("engine")??""),w=String(G.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(D)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(w))return X({ok:!1,error:"A supported engine and provider are required."},422);return X({ok:!0,engine:D,provider:w,capabilities:ph(D,w)})}if(G.pathname==="/api/data-services"&&J.method==="GET"){let D=S.environments.get(AE),w=W_.list(S.project.id,D?.id).map((j)=>{let H=W_.credential(j.id);return{...j,credentialRef:void 0,credential:H?{configured:!0,username:H.username,version:H.version,rotatedAt:H.rotatedAt}:void 0,dependencies:W_.dependencies(j.id).map((f)=>({resourceId:f.resourceId,requiresRedeploy:f.requiresRedeploy}))}});return X({ok:!0,services:w})}if(G.pathname==="/api/data-services/preview"&&J.method==="POST"){let D=await a(J);if(D.id){let H=W_.get(String(D.id)),f=S.environments.get(AE),q=String(D.action??"");if(!H||H.projectId!==S.project.id||H.environmentId!==f?.id)return X({ok:!1,error:"Data service was not found in this environment."},404);if(!mD.includes(q))return X({ok:!1,error:`Action must be one of: ${mD.join(", ")}.`},422);try{return X({ok:!0,plan:gd.plan(H,q,D.changes??{})})}catch(K){return X({ok:!1,error:K instanceof Error?K.message:String(K)},422)}}let w=String(D.engine??""),j=String(D.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(w)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(j))return X({ok:!1,error:"A supported engine and provider are required."},422);return X({ok:!0,capabilities:ph(w,j),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(G.pathname==="/api/data-services"&&J.method==="POST"){let D=await a(J),w=String(D.engine??""),j=String(D.provider??""),H=S.environments.get(AE),f=WE(tE);if(!H)return X({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(w)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(j))return X({ok:!1,error:"A supported engine and provider are required."},422);let q={organizationId:S.organization.id,projectId:S.project.id,environmentId:H.id,resourceId:D.resourceId?String(D.resourceId):void 0,name:String(D.name??"").trim(),engine:w,provider:j,placement:String(D.placement??D.name??"").trim(),engineVersion:D.engineVersion?String(D.engineVersion):void 0,plan:String(D.plan??(j==="aws_elasticache"?"cache.t4g.micro":j==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:D.storageGb==null?void 0:Number(D.storageGb),highAvailability:D.highAvailability===!0,publicExposure:D.publicExposure===!0,allowedCidrs:Array.isArray(D.allowedCidrs)?D.allowedCidrs.map(String):[],desiredState:D.desiredState&&typeof D.desiredState==="object"&&!Array.isArray(D.desiredState)?D.desiredState:{},observedState:{},origin:D.adopt===!0?"adopted":"managed",managementEnabled:D.adopt!==!0,ownerActorId:f.actor?.id,username:D.username?String(D.username):void 0};try{if(D.adopt===!0){let u=W_.create({...q,status:"adopted",credentialRef:void 0});return X({ok:!0,service:u,readOnly:!0},201)}if(!YF({provider:j,engine:w}))return X({ok:!1,error:`No ${j}/${w} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let K=await gd.create(q);return X({ok:!0,service:K.service,operationId:K.operationId,oneTimeCredential:K.credential},201)}catch(K){return X({ok:!1,error:K instanceof Error?K.message:String(K)},422)}}if(G.pathname==="/api/data-services/connections"&&J.method==="GET"){let D=W_.get(String(G.searchParams.get("id")??"")),w=S.environments.get(AE);if(!D||D.projectId!==S.project.id||D.environmentId!==w?.id)return X({ok:!1,error:"Data service was not found in this environment."},404);let j=typeof D.observedState.endpoint==="string"?D.observedState.endpoint:void 0,H=typeof D.observedState.readerEndpoint==="string"?D.observedState.readerEndpoint:void 0,f=Number(D.observedState.port)||(D.engine==="postgres"?5432:D.engine==="redis"?6379:D.engine==="mongodb"?27017:D.engine==="libsql"?8080:3306),q=typeof D.observedState.database==="string"?D.observedState.database:void 0,K=typeof D.observedState.tls==="boolean"?D.observedState.tls:D.provider.startsWith("aws_"),u=[...j?[{type:D.publicExposure?"external":"internal",host:j,port:f,database:q,tls:K}]:[],...H?[{type:"internal",host:H,port:f,database:q,tls:K}]:[],{type:"tunnel",host:j??D.placement,port:f,database:q,tls:K}];return X({ok:!0,serviceId:D.id,guidance:X0(D,u)})}if(G.pathname==="/api/data-services/action"&&J.method==="POST"){let D=await a(J),w=W_.get(String(D.id??"")),j=S.environments.get(AE),H=String(D.action??"");if(!w||w.projectId!==S.project.id||w.environmentId!==j?.id)return X({ok:!1,error:"Data service was not found in this environment."},404);if(!mD.includes(H))return X({ok:!1,error:`Action must be one of: ${mD.join(", ")}.`},422);let f=D.changes&&typeof D.changes==="object"&&!Array.isArray(D.changes)?D.changes:{};try{let q=gd.plan(w,H,f);if(D.execute!==!0)return X({ok:!0,plan:q,productionExecutionCreated:!1});let K=gd.enqueue(w,H,f,WE(tE).actor?.id);return X({ok:!0,plan:q,operationId:K},202)}catch(q){return X({ok:!1,error:q instanceof Error?q.message:String(q)},409)}}if(G.pathname==="/api/data-services/dependencies"&&J.method==="POST"){let D=await a(J),w=W_.get(String(D.id??"")),j=S.environments.get(AE),H=S.store.getResource(String(D.resourceId??""));if(!w||w.projectId!==S.project.id||w.environmentId!==j?.id)return X({ok:!1,error:"Data service was not found in this environment."},404);if(!H||H.projectId!==S.project.id||H.environmentId!==j?.id)return X({ok:!1,error:"Dependent resource was not found in this environment."},404);if(D.remove===!0)return X({ok:W_.removeDependency(w.id,H.id)});return W_.addDependency({serviceId:w.id,resourceId:H.id,secretRef:w.credentialRef??`secret://data-services/${w.projectId}/${w.name}`,requiresRedeploy:D.requiresRedeploy!==!1}),X({ok:!0,dependencies:W_.dependencies(w.id).map((f)=>({resourceId:f.resourceId,requiresRedeploy:f.requiresRedeploy}))})}if(G.pathname==="/api/data-services/management"&&J.method==="POST"){let D=await a(J),w=W_.get(String(D.id??"")),j=S.environments.get(AE);if(!w||w.projectId!==S.project.id||w.environmentId!==j?.id)return X({ok:!1,error:"Data service was not found in this environment."},404);if(w.origin!=="adopted"||D.reviewed!==!0||D.confirm!==w.name)return X({ok:!1,error:`Enabling management requires reviewed=true and typing ${w.name}.`},409);return X({ok:!0,service:W_.update(w.id,w.version,{managementEnabled:!0})})}if(G.pathname==="/api/data-services/reveal"&&J.method==="POST"){let D=await a(J),w=W_.get(String(D.id??"")),j=S.environments.get(AE),H=w?W_.credential(w.id):void 0;if(!w||w.projectId!==S.project.id||w.environmentId!==j?.id)return X({ok:!1,error:"Data service was not found in this environment."},404);if(!H)return X({ok:!1,error:"No managed credential is configured."},404);return X({ok:!0,credential:{username:H.username,password:await gT.resolve(H.secretRef),version:H.version}},200,{"cache-control":"no-store"})}if(G.pathname==="/api/databases"&&J.method==="GET")return X(await T8(t,AE));if(G.pathname==="/api/databases"&&J.method==="POST"){let D=await a(J),w=String(D.name??"").trim();if(!OR(w))return X({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return X({...await r8(t,AE,w),name:w})}if(G.pathname==="/api/databases/vitess"&&J.method==="GET"){let D=await h8(t,AE);return X({...D,unhealthy:N8(D.tablets),missingPrimary:S8(D)})}if(G.pathname==="/api/databases/vitess/provision"&&J.method==="POST"){let D=await a(J);try{return X(await C8(t,AE,{keyspace:String(D.keyspace??""),username:String(D.username??""),password:String(D.password??""),sharded:D.sharded===!0,confirm:String(D.confirm??"")}))}catch(w){return X({ok:!1,error:w instanceof Error?w.message:String(w)},422)}}if(G.pathname==="/api/databases/vitess/migrations"&&J.method==="GET"){let D=G.searchParams.get("keyspace")??void 0;return X(await D8(t,AE,D))}if(G.pathname==="/api/databases/vitess/migrations/action"&&J.method==="POST"){let D=await a(J),w=String(D.uuid??"").trim(),j=String(D.action??"");if(!["retry","cancel","cleanup","complete"].includes(j))return X({ok:!1,error:"Unknown migration action."},422);return X(await I8(t,AE,w,j))}if(G.pathname==="/api/databases/vitess/keyspaces"&&J.method==="POST"){let D=await a(J),w=String(D.name??"").trim(),j=D.sharded===!0;return X(await c8(t,AE,w,{sharded:j}))}if(G.pathname==="/api/databases/vitess/vschema"&&J.method==="POST"){let D=await a(J),w=String(D.keyspace??"").trim(),j=typeof D.vschema==="string"?D.vschema:JSON.stringify(D.vschema??null);return X(await U8(t,AE,w,j))}if(G.pathname==="/api/databases/vitess/schema"&&J.method==="POST"){let D=await a(J),w=String(D.sql??"");return X(await $8(t,AE,w))}if(G.pathname==="/api/databases/vitess/install-client"&&J.method==="POST")return X(await O8(t,AE));if(G.pathname==="/api/databases/backups"&&J.method==="GET")return X(await R8(t,AE));if(G.pathname==="/api/databases/backup"&&J.method==="POST"){let D=await a(J),w=String(D.database??"").trim();if(!OR(w))return X({ok:!1,error:"Database name must be a valid identifier."},422);if(D.confirm!==w)return X({ok:!1,error:`Type "${w}" to back up this database.`},409);return X(await t8(t,AE,w))}if(G.pathname==="/api/databases/users"&&J.method==="POST"){let D=await a(J),w=String(D.username??"").trim(),j=String(D.password??""),H=String(D.database??"").trim()||void 0,f=D.access==="readonly"?"readonly":"all";if(!OR(w))return X({ok:!1,error:"Username must be a valid identifier."},422);if(!j)return X({ok:!1,error:"Password is required."},422);if(H&&!OR(H))return X({ok:!1,error:"Database must be a valid identifier."},422);return X({...await d8(t,AE,{username:w,password:j,database:H,access:f}),username:w})}if(G.pathname==="/api/dashboard-data")return H_=$.get(AE)??await y(AE),y(AE),X(lz(H_,{user:ur,slug:t.project.slug}));if(G.pathname==="/api/users"&&J.method==="GET")return X({ok:!0,users:oT(_).map(bA)});if(G.pathname==="/api/users"&&J.method==="POST"){let D=await a(J),w=String(D.username??"").trim();if(!uD(w))return X({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let j=D.sites&&typeof D.sites==="object"?D.sites:{},H=new Set(Object.keys(t.sites??{})),f={};for(let[u,SE]of Object.entries(j)){if(!H.has(u))return X({ok:!1,error:`Site '${u}' was not found.`},404);if(SE!=="owner"&&SE!=="collaborator")return X({ok:!1,error:`Unknown site role '${SE}'. Use 'owner' or 'collaborator'.`},422);f[u]=SE}let q=typeof D.password==="string"&&D.password.trim()?D.password.trim():void 0;if(q&&q.length<12)return X({ok:!1,error:"Password must be at least 12 characters."},422);let K=GO(_,{username:w,password:q,name:typeof D.name==="string"?D.name:void 0,sites:f});return _U(S,oT(_)),rE(),X({ok:!0,user:bA(K.user),password:K.password})}if(G.pathname==="/api/users"&&J.method==="DELETE"){let D=await a(J),w=String(D.username??"").trim();if(w.toLowerCase()===tE.username.toLowerCase())return X({ok:!1,error:"You cannot remove your own account."},409);let j=cd(oT(_),w),H=j?S.store.getActorByExternalId("user",`dashboard:${j.username.toLowerCase()}`):void 0,f=H?S.store.getMembershipForActor(S.organization.id,H.id):void 0;if(f&&f.source!=="legacy")return X({ok:!1,error:"Organization members must be removed from Organization access."},409);let q=nz(_,w);if(!q.ok)return X(q,409);return _U(S,oT(_)),g.clear(),X({ok:!0,username:w})}if(G.pathname==="/api/actions/run"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=D.action?RF(D.action,AE):void 0;if(!w)return X({ok:!1,error:"Unknown dashboard action."},404);if(w.mutates&&D.confirm!==w.confirm)return X({ok:!1,error:`Type "${w.confirm}" to run this action.`},409);let j=await Wt({controlPlane:S,environment:AE,actor:tE,kind:`dashboard.action.${w.id}`,input:{action:w.id},execute:()=>rF(w,{cwd:_,cliEntry:d})});return X({...j.result,controlPlaneOperation:j.operation})}if(G.pathname==="/api/server/operations/run"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=D.operation?NO(D.operation,t,H_):void 0;if(!w)return X({ok:!1,error:"Unknown or unavailable server operation."},404);if(w.mutates&&D.confirm!==w.confirm)return X({ok:!1,error:`Type "${w.confirm}" to run this operation.`},409);let j=Jr(S,String(AE));await new XN(QE).run(new OO,{...j,artifactRoot:_});let H=JN(QE,{scope:j,desiredConfigHash:S.project.desiredConfigHash});if(H.decision.outcome==="block")return X({ok:!1,error:`Operation blocked by security policy: ${H.decision.explanation}`,securityReview:H},409);let f=await Wt({controlPlane:S,environment:AE,actor:tE,kind:`dashboard.server.${w.id}`,resourceSlug:w.target,input:{operation:w.id,target:w.target,to:D.to??null},execute:()=>eA(t,AE,w,{to:D.to})});return X({...f.result,controlPlaneOperation:f.operation,securityReview:H})}if(G.pathname==="/api/server/command"&&J.method==="POST"){let D=await J.json().catch(()=>({}));if(D.confirm!=="run")return X({ok:!1,error:'Type "run" to execute this command on the server.'},409);let w=await Wt({controlPlane:S,environment:AE,actor:tE,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>IN(t,AE,String(D.command??""))});return X({...w.result,controlPlaneOperation:w.operation})}if(G.pathname==="/api/serverless/operations")return X(pz(t,AE,H_));if(G.pathname==="/api/serverless/operations/run"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=D.operation?u8(D.operation,t,AE,H_):void 0;if(!w)return X({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(w.mutates&&D.confirm!==w.confirm)return X({ok:!1,error:`Type "${w.confirm}" to run this operation.`},409);let j=await Wt({controlPlane:S,environment:AE,actor:tE,kind:`dashboard.serverless.${w.id}`,input:{operation:w.id,min:D.min??null,max:D.max??null},execute:()=>v8(t,AE,w,{min:D.min,max:D.max})});return H_=await QN(t,AE),$.set(AE,H_),X({...j.result,controlPlaneOperation:j.operation})}if(G.pathname==="/api/serverless/command"&&J.method==="POST"){let D=await J.json().catch(()=>({}));if(D.confirm!=="run")return X({ok:!1,error:'Type "run" to execute this command.'},409);return X(await n8(t,AE,String(D.command??"")))}if(G.pathname==="/api/serverless/dlq"&&J.method==="GET"){let D=Number(G.searchParams.get("max"))||10;return X(await l8(t,AE,D))}if(G.pathname==="/api/serverless/dlq/redrive"&&J.method==="POST"){let D=await J.json().catch(()=>({}));if(D.confirm!=="redrive")return X({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return X(await i8(t,AE,{max:D.max,targetQueue:D.targetQueue}))}if(G.pathname==="/api/serverless/dlq/purge"&&J.method==="POST"){if((await J.json().catch(()=>({}))).confirm!=="purge")return X({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return X(await a8(t,AE))}if(G.pathname==="/api/serverless/secrets"&&J.method==="GET")return X({secrets:m8(t,AE)});if(G.pathname==="/api/serverless/secrets"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=String(D.secretId??"").trim();if(!w)return X({ok:!1,error:"A secret id is required."},422);if(typeof D.value!=="string"||D.value==="")return X({ok:!1,error:"A non-empty value is required."},422);return X(await s8(t,AE,w,D.value))}if(G.pathname==="/api/serverless/secrets"&&J.method==="DELETE"){let D=await J.json().catch(()=>({})),w=String(D.secretId??"").trim();if(!w)return X({ok:!1,error:"A secret id is required."},422);if(D.confirm!==w)return X({ok:!1,error:`Type "${w}" to delete this secret.`},409);return X(await p8(t,AE,w))}if(G.pathname==="/api/serverless/functions/config"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=String(D.mode??"").trim();if(D.confirm!==w)return X({ok:!1,error:`Type "${w}" to update this function.`},409);return X(await o8(t,AE,w,{memory:D.memory,timeout:D.timeout}))}if(G.pathname==="/api/serverless/alarms"&&J.method==="GET")return X(await EG(t,AE));if(G.pathname==="/api/serverless/alarms"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=String(D.preset??"").trim(),j=Number(D.threshold);if(!w)return X({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(j))return X({ok:!1,error:"A numeric threshold is required."},422);return X(await _G(t,AE,w,j))}if(G.pathname==="/api/serverless/alarms"&&J.method==="DELETE"){let D=await J.json().catch(()=>({})),w=String(D.name??"").trim();if(!w)return X({ok:!1,error:"An alarm name is required."},422);if(D.confirm!==w)return X({ok:!1,error:`Type "${w}" to delete this alarm.`},409);return X(await TG(t,AE,w))}if(G.pathname==="/api/serverless/traces"&&J.method==="GET"){let D=Number(G.searchParams.get("minutes"))||30;return X(await iD(t,AE,D))}if(G.pathname==="/api/serverless/scheduler"&&J.method==="POST"){let D=await J.json().catch(()=>({})),w=String(D.action??"").trim();if(w!=="enable"&&w!=="disable"&&w!=="run")return X({ok:!1,error:"Unknown scheduler action."},422);if(D.confirm!==w)return X({ok:!1,error:`Type "${w}" to ${w} the scheduler.`},409);return X(await _F(t,AE,w))}if(!CG(G.pathname,ur))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(AE)}`}});let gN=await P(tE,AE);if(!gN)return pD("ts-cloud dashboard UI is unavailable.",503);return wG(gN,G.pathname)}catch(Jh){if(E.verbose)console.error(Jh);return X({ok:!1,error:Jh?.message??String(Jh)},500)}})();if(!v_)return v_;if(D_&&(G.pathname.startsWith("/api/")||G.pathname.startsWith("/auth/"))){let vE;if((eE.headers.get("content-type")||"").includes("application/json"))vE=await eE.json().catch(()=>{return});let UT=Q_.resolveUser(J),dT=UT?WE(UT).actor:void 0;S.store.appendEvent({organizationId:S.organization.id,projectId:S.project.id,actorId:dT?.id,correlationId:ZE,type:v_.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:v_.status<400?"info":"warning",payload:Zp(J.method,G.pathname,vE,v_.status,Date.now()-YE)})}return v_.headers.set("x-request-id",ZE),v_}});kO?.start();let lG=ZN.stop.bind(ZN);return ZN.stop=(J)=>{clearInterval(uF),clearInterval(vF),clearInterval(nF),clearInterval(kF),clearInterval(bF),clearInterval(ZF),clearInterval(qF),clearInterval(gF),clearInterval(xF),rE(),i_.clear(),kO?.stop();let XE=lG(J);if(kO)kO.settled().finally(()=>S.store.close());else S.store.close();return XE},{server:ZN,url:`http://${T}:${ZN.port}/`}}function J_(E){return new dS(E?{path:d1(E)}:{})}function Ao(E){let _=E.health();b("Control-plane diagnostics"),U(`Database: ${_.path}`),U(`Schema: ${_.schemaVersion}/${_.supportedSchemaVersion}`),U(`Integrity: ${_.integrity}`),U(`Journal: ${_.journalMode}`),U(`Size: ${_.databaseBytes.toLocaleString()} bytes`),U(`Last backup: ${_.lastBackupAt??"never"}`),U(`Operations: ${Object.entries(_.operations).map(([T,r])=>`${T}=${r}`).join(", ")}`),U(`Pending/retryable: ${_.pendingRetryableOperations}`)}function UR(E,_){let T=E.getOrganization(_)??E.getOrganizationBySlug(_);if(!T)throw Error(`Organization '${_}' was not found.`);return T}function _1(E,_){let T=E??"organization";if(T==="organization")return{type:"organization"};if(!["project","environment","resource"].includes(T)||!_)throw Error("Scoped access requires --scope project|environment|resource and --scope-id <id>.");return{type:T,id:_}}function T1(E,_){let T=_.includes("@")?E.getIdentityByEmail(_):E.getIdentityByUsername(_);if(!T)throw Error(`Authentication identity '${_}' was not found.`);return T}function r1(E,_){return new Id(E,{encryptionKey:q_(d1(_??process.cwd()))})}function JG(E,_="TS_CLOUD_API_TOKEN"){let T=process.env[_]?.trim();if(!T)throw Error(`Set ${_} to a one-time-issued API token.`);return new $D({baseUrl:E??process.env.TS_CLOUD_API_URL??"http://127.0.0.1:7676",token:T})}function hF(E){E.command("dashboard:serve","Run the local Forge-style cloud management UI").option("--host <host>","Host to bind",{default:"127.0.0.1"}).option("--port <port>","Port to bind",{default:"7676"}).option("--env <environment>","Environment to manage").option("--box","Box mode: run on the provisioned server (operate on localhost)").option("--open","Print the URL for opening in a browser").option("--verbose","Print server errors").action(async(_)=>{let T=await E1({host:_?.host,port:Number(_?.port??7676),environment:_?.env,box:_?.box,verbose:_?.verbose});b("ts-cloud Local Dashboard"),Z(`Serving ${T.url}`),U("Use Ctrl+C to stop."),await new Promise((r)=>{let d=()=>{T.server.stop(!0),r()};process.once("SIGINT",d),process.once("SIGTERM",d)})}),E.command("control-plane:status","Inspect local control-plane storage health").option("--path <path>","Use a non-default control-plane database").action((_)=>{let T=J_(_?.path);try{Ao(T)}finally{T.close()}}),E.command("control-plane:backup","Create a consistent local control-plane backup").option("--path <path>","Use a non-default control-plane database").action((_)=>{let T=J_(_?.path);try{let r=T.createBackup("cli");Z(`Backup written to ${r}`)}finally{T.close()}}),E.command("control-plane:export <file>","Export portable control-plane metadata and history").option("--path <path>","Use a non-default control-plane database").action((_,T)=>{let r=d1(_),d=J_(T?.path);try{Ro(So(r),{recursive:!0}),No(r,`${JSON.stringify(d.exportSnapshot(),null,2)}
 `,{mode:384}),to(r,384),Z(`Control-plane snapshot exported to ${r}`)}finally{d.close()}}),E.command("control-plane:import <file>","Import a portable control-plane snapshot").option("--path <path>","Use a non-default control-plane database").option("--replace","Replace existing control-plane records").action((_,T)=>{let r=d1(_),d=JSON.parse(ho(r,"utf8")),t=J_(T?.path);try{let R=T?.replace?t.createBackup("pre-import"):void 0;if(t.importSnapshot(d,{replace:T?.replace}),Z(`Imported control-plane snapshot from ${r}`),R)U(`Previous state backed up to ${R}`)}finally{t.close()}}),E.command("control-plane:compact","Apply history retention and compact control-plane storage").option("--path <path>","Use a non-default control-plane database").option("--event-days <days>","Retain event history for this many days",{default:"90"}).option("--operation-days <days>","Retain terminal operations for this many days",{default:"365"}).option("--no-vacuum","Delete expired records without reclaiming file space").action((_)=>{let T=J_(_?.path);try{let r=T.compact({eventRetentionDays:Number(_?.eventDays??90),operationRetentionDays:Number(_?.operationDays??365),vacuum:_?.vacuum!==!1});if(Z(`Removed ${r.deletedEvents} event(s) and ${r.deletedOperations} terminal operation(s).`),r.vacuumed)U("Database file compacted.")}finally{T.close()}}),E.command("organization:list","List organizations in the local control plane").option("--path <path>","Use a non-default control-plane database").action((_)=>{let T=J_(_?.path);try{b("Organizations");for(let r of T.listOrganizations())U(`${r.slug}  ${r.name}  ${r.id}`)}finally{T.close()}}),E.command("organization:members <organization>","List memberships and scoped grants").option("--path <path>","Use a non-default control-plane database").option("--all","Include revoked memberships").action((_,T)=>{let r=J_(T?.path);try{let d=UR(r,_);b(`${d.name} members`);for(let t of r.listMemberships(d.id,{includeRevoked:T?.all})){let R=r.getActor(t.actorId);U(`${R?.displayName??t.actorId}  ${t.roleTemplate}  ${t.scope.type}:${t.scope.id??d.slug}  ${t.status}  ${t.id}`);for(let h of r.listGrants(t.id))U(`  ${h.effect} ${h.capability} @ ${h.scope.type}:${h.scope.id??d.slug}`)}}finally{r.close()}}),E.command("organization:invite <organization> <email>","Create a hashed, expiring organization invitation").option("--path <path>","Use a non-default control-plane database").option("--role <role>","owner|admin|deployer|operator|viewer|auditor",{default:"viewer"}).option("--scope <scope>","organization|project|environment|resource",{default:"organization"}).option("--scope-id <id>","Project, environment, or resource ID").option("--days <days>","Invitation lifetime in days",{default:"7"}).option("--base-url <url>","Dashboard URL used to print the acceptance link",{default:"http://127.0.0.1:7676"}).action((_,T,r)=>{let d=J_(r?.path);try{let t=UR(d,_);if(!["owner","admin","deployer","operator","viewer","auditor"].includes(r?.role??"viewer"))throw Error("Unknown role template.");let R=d.createInvitation({organizationId:t.id,email:T,roleTemplate:r?.role??"viewer",scope:_1(r?.scope,r?.scopeId),expiresInMs:Number(r?.days??7)*86400000});Z(`Invitation created for ${R.invitation.email}; expires ${R.invitation.expiresAt}`),U(`${String(r?.baseUrl??"http://127.0.0.1:7676").replace(/\/$/,"")}/accept-invitation?token=${encodeURIComponent(R.token)}`),U("This token is shown once. Resending revokes it and creates a new token.")}finally{d.close()}}),E.command("organization:invitations <organization>","List invitation states without exposing tokens").option("--path <path>","Use a non-default control-plane database").action((_,T)=>{let r=J_(T?.path);try{let d=UR(r,_);b(`${d.name} invitations`);for(let t of r.listInvitations(d.id))U(`${t.email}  ${t.roleTemplate}  ${t.scope.type}:${t.scope.id??d.slug}  ${t.state}  ${t.id}`)}finally{r.close()}}),E.command("organization:revoke-invitation <id>","Revoke a pending organization invitation").option("--path <path>","Use a non-default control-plane database").action((_,T)=>{let r=J_(T?.path);try{let d=r.revokeInvitation(_);Z(`Invitation ${d.id} is ${d.state}.`)}finally{r.close()}}),E.command("organization:grant <organization> <membership> <capability>","Add an explicit scoped allow or deny").option("--path <path>","Use a non-default control-plane database").option("--effect <effect>","allow|deny",{default:"allow"}).option("--scope <scope>","organization|project|environment|resource",{default:"organization"}).option("--scope-id <id>","Project, environment, or resource ID").action((_,T,r,d)=>{let t=J_(d?.path);try{let R=UR(t,_);if(!Lr.includes(r))throw Error(`Unknown capability '${r}'.`);if(d?.effect!==void 0&&!["allow","deny"].includes(d.effect))throw Error("Effect must be allow or deny.");let h=t.upsertGrant({organizationId:R.id,membershipId:T,effect:d?.effect??"allow",capability:r,scope:_1(d?.scope,d?.scopeId)});Z(`${h.effect} ${h.capability} added at ${h.scope.type}:${h.scope.id??R.slug}.`)}finally{t.close()}}),E.command("organization:revoke-member <membership>","Revoke a membership and invalidate its sessions").option("--path <path>","Use a non-default control-plane database").option("--confirm <id>","Type the membership ID to confirm").action((_,T)=>{if(T?.confirm!==_)throw Error(`Pass --confirm ${_} to revoke this membership.`);let r=J_(T?.path);try{let d=r.revokeMembership(_);Z(`Membership ${d.id} revoked; session version is now ${d.sessionVersion}.`)}finally{r.close()}}),E.command("auth:identities","List local authentication identities without credential material").option("--path <path>","Use a non-default control-plane database").action((_)=>{let T=J_(_?.path);try{let r=new Id(T);b("Authentication identities");for(let d of r.listIdentities())U(`${d.username}  ${d.email??"no-email"}  ${d.disabledAt?"disabled":"active"}  ${d.id}`)}finally{T.close()}}),E.command("auth:reset-link <identity>","Create a one-time password reset link for offline recovery").option("--path <path>","Use a non-default control-plane database").option("--base-url <url>","Dashboard URL used to print the reset link",{default:"http://127.0.0.1:7676"}).action((_,T)=>{let r=J_(T?.path);try{let d=new Id(r),t=T1(d,_);d.revokeActionTokens(t.id,"password_reset");let R=d.createActionToken(t.id,"password_reset");Z(`Created a one-time reset link for ${t.username}; it expires ${R.actionToken.expiresAt}.`),U(`${String(T?.baseUrl??"http://127.0.0.1:7676").replace(/\/$/,"")}/reset-password?token=${encodeURIComponent(R.token)}`)}finally{r.close()}}),E.command("auth:sessions <identity>","List active and expired sessions for an identity").option("--path <path>","Use a non-default control-plane database").action((_,T)=>{let r=J_(T?.path);try{let d=new Id(r),t=T1(d,_);b(`${t.username} sessions`);for(let R of d.listSessions(t.id,{includeInactive:!0}))U(`${R.state}  ${R.authMethod}  ${R.userAgent??"unknown-device"}  ${R.lastUsedAt}  ${R.id}`)}finally{r.close()}}),E.command("auth:revoke-sessions <identity>","Revoke every dashboard session for an identity").option("--path <path>","Use a non-default control-plane database").option("--confirm <identity>","Type the username or email to confirm").action((_,T)=>{if(T?.confirm!==_)throw Error(`Pass --confirm ${_} to revoke these sessions.`);let r=J_(T?.path);try{let d=new Id(r),t=T1(d,_),R=d.listSessions(t.id);for(let h of R)d.revokeSession(t.id,h.id);Z(`Revoked ${R.length} session(s) for ${t.username}.`)}finally{r.close()}}),E.command("auth:disable-mfa <identity>","Disable MFA through the offline administrative recovery path").option("--path <path>","Use a non-default control-plane database").option("--confirm <identity>","Type the username or email to confirm").action((_,T)=>{if(T?.confirm!==_)throw Error(`Pass --confirm ${_} to disable MFA.`);let r=J_(T?.path);try{let d=new Id(r),t=T1(d,_);d.disableMfa(t.id);for(let R of d.listSessions(t.id))d.revokeSession(t.id,R.id);Z(`Disabled MFA and revoked active sessions for ${t.username}.`)}finally{r.close()}}),E.command("auth:oidc:list <organization>","List OIDC providers without credential material").option("--path <path>","Use a non-default control-plane database").action((_,T)=>{let r=J_(T?.path);try{let d=UR(r,_),t=r1(r);b(`${d.name} OIDC providers`);let R=t.listOidcProviders(d.id,{includeDisabled:!0});if(R.length===0)U("No providers configured.");for(let h of R)U(`${h.enabled?"enabled":"disabled"}  ${h.slug}  ${h.issuer}  role=${h.defaultRole}  enforce=${h.enforceSso}`)}finally{r.close()}}),E.command("auth:oidc:configure <organization> <slug>","Create or update an encrypted OIDC provider configuration").option("--path <path>","Use a non-default control-plane database").option("--auth-root <path>","Directory containing .ts-cloud/auth-encryption-key").option("--name <name>","Provider label shown on the sign-in page").option("--issuer <url>","Exact OIDC issuer URL").option("--client-id <id>","OIDC client ID").option("--secret-env <name>","Environment variable containing the client secret",{default:"TS_CLOUD_OIDC_CLIENT_SECRET"}).option("--domains <domains>","Comma-separated verified email domains").option("--scopes <scopes>","Comma-separated scopes (openid is always included)",{default:"email,profile"}).option("--default-role <role>","Role for provisioned users: admin, deployer, operator, viewer, or auditor",{default:"viewer"}).option("--enforce-sso","Require SSO for matching non-owner local accounts").option("--disabled","Save the provider disabled").action((_,T,r)=>{let d=J_(r?.path);try{let t=UR(d,_),R=r1(d,r?.authRoot),h=R.getOidcProviderBySlug(T),N=r?.secretEnv??"TS_CLOUD_OIDC_CLIENT_SECRET",S=process.env[N]?.trim();if(!h&&!S)throw Error(`Set ${N} to the client secret before creating this provider.`);let A=(r?.domains??h?.allowedDomains.join(",")??"").split(",").map((c)=>c.trim()).filter(Boolean),L=r?.defaultRole??h?.defaultRole??"viewer";if(!["admin","deployer","operator","viewer","auditor"].includes(L))throw Error("Default role must be admin, deployer, operator, viewer, or auditor.");let O=R.upsertOidcProvider({id:h?.id,organizationId:t.id,slug:T,name:r?.name??h?.name??T,issuer:r?.issuer??h?.issuer??"",clientId:r?.clientId??h?.clientId??"",clientSecret:S,allowedDomains:A,scopes:(r?.scopes??h?.scopes.join(",")??"email,profile").split(",").map((c)=>c.trim()).filter(Boolean),defaultRole:L,enforceSso:r?.enforceSso??h?.enforceSso??!1,enabled:r?.disabled?!1:h?.enabled??!0});if(Z(`${O.name} saved as ${O.enabled?"enabled":"disabled"} with encrypted credentials.`),U(`Callback path: /auth/oidc/${O.slug}/callback`),O.enforceSso)U(`Offline recovery: cloud auth:oidc:disable ${O.slug} --confirm ${O.slug}`)}finally{d.close()}}),E.command("auth:oidc:test <slug>","Validate OIDC discovery for a configured provider").option("--path <path>","Use a non-default control-plane database").option("--auth-root <path>","Directory containing .ts-cloud/auth-encryption-key").action(async(_,T)=>{let r=J_(T?.path);try{let t=r1(r,T?.authRoot).getOidcProviderBySlug(_);if(!t)throw Error(`OIDC provider '${_}' was not found.`);let R=await HL(t);Z(`${t.name} discovery is valid and issuer-bound.`),U(`Authorization: ${R.authorization_endpoint}`),U(`Token: ${R.token_endpoint}`),U(`JWKS: ${R.jwks_uri}`)}finally{r.close()}}),E.command("auth:oidc:disable <slug>","Disable an OIDC provider through the offline recovery path").option("--path <path>","Use a non-default control-plane database").option("--auth-root <path>","Directory containing .ts-cloud/auth-encryption-key").option("--confirm <slug>","Type the provider slug to confirm").action((_,T)=>{if(T?.confirm!==_)throw Error(`Pass --confirm ${_} to disable this provider.`);let r=J_(T?.path);try{let d=r1(r,T?.authRoot),t=d.getOidcProviderBySlug(_);if(!t)throw Error(`OIDC provider '${_}' was not found.`);d.setOidcProviderEnabled(t.id,!1),Z(`Disabled ${t.name}, cancelled pending sign-ins, and removed SSO enforcement.`)}finally{r.close()}}),E.command("api:service-accounts <organization>","List service accounts and safe token metadata").option("--path <path>","Use a non-default control-plane database").action((_,T)=>{let r=J_(T?.path);try{let d=UR(r,_),t=new ht(r);b(`${d.name} service accounts`);for(let R of t.listServiceAccounts(d.id,{includeDisabled:!0})){U(`${R.state}  ${R.slug}  ${R.name}  ${R.id}`);for(let h of t.listTokens(R.id,{includeInactive:!0}))U(`  ${h.state}  ${h.prefix}  ${h.name}  expires=${h.expiresAt}  last-used=${h.lastUsedAt??"never"}`)}}finally{r.close()}}),E.command("api:service-account:create <organization> <slug>","Create a scoped service account").option("--path <path>","Use a non-default control-plane database").option("--name <name>","Display name").option("--role <role>","admin, deployer, operator, viewer, or auditor",{default:"deployer"}).option("--scope <scope>","organization, project, environment, or resource",{default:"organization"}).option("--scope-id <id>","Required for non-organization scope").action((_,T,r)=>{let d=J_(r?.path);try{let t=UR(d,_),R=r?.role??"deployer";if(!["admin","deployer","operator","viewer","auditor"].includes(R))throw Error("Service-account role cannot be owner and must be a supported role.");let N=new ht(d).createServiceAccount({organizationId:t.id,slug:T,name:r?.name??T,roleTemplate:R,scope:_1(r?.scope,r?.scopeId)});Z(`Created ${N.serviceAccount.name} (${N.serviceAccount.id}) with ${N.membership.roleTemplate} access.`)}finally{d.close()}}),E.command("api:token:create <organization> <account>","Create and reveal a scoped API token exactly once").option("--path <path>","Use a non-default control-plane database").option("--name <name>","Token label",{default:"CLI token"}).option("--capabilities <list>","Comma-separated capabilities").option("--scope <scope>","organization, project, environment, or resource",{default:"organization"}).option("--scope-id <id>","Required for non-organization scope").option("--expires-days <days>","Expiry in days, maximum 365",{default:"90"}).action((_,T,r)=>{let d=J_(r?.path);try{let t=UR(d,_),R=new ht(d),h=R.getServiceAccount(T)??R.getServiceAccountBySlug(t.id,T);if(!h||h.organizationId!==t.id)throw Error(`Service account '${T}' was not found.`);let N=(r?.capabilities??"").split(",").map((L)=>L.trim()).filter((L)=>Lr.includes(L));if(!N.length)throw Error(`Pass --capabilities with one or more of: ${Lr.join(", ")}`);let S=Math.min(365,Math.max(1,Number(r?.expiresDays??90))),A=R.createToken({serviceAccountId:h.id,name:r?.name??"CLI token",capabilities:N,scope:_1(r?.scope,r?.scopeId),expiresAt:new Date(Date.now()+S*24*60*60*1000).toISOString()});Z(`Created ${A.token.prefix}; copy this secret now. It will not be shown again.`),U(A.secret)}finally{d.close()}}),E.command("api:token:rotate <token>","Create an overlapping replacement for an API token").option("--path <path>","Use a non-default control-plane database").action((_,T)=>{let r=J_(T?.path);try{let d=new ht(r).rotateToken(_);Z(`Created overlapping replacement ${d.token.prefix}; revoke the old token after rollout.`),U(d.secret)}finally{r.close()}}),E.command("api:token:revoke <token>","Immediately revoke an API token").option("--path <path>","Use a non-default control-plane database").option("--confirm <token>","Type the token ID to confirm").action((_,T)=>{if(T?.confirm!==_)throw Error(`Pass --confirm ${_} to revoke this token.`);let r=J_(T?.path);try{let d=new ht(r).revokeToken(_);Z(`Revoked ${d.prefix}; bearer requests stop immediately.`)}finally{r.close()}}),E.command("api:projects","List projects through the public v1 API").option("--base-url <url>","Dashboard base URL").option("--token-env <name>","Environment variable containing the API token",{default:"TS_CLOUD_API_TOKEN"}).action(async(_)=>{let T=await JG(_?.baseUrl,_?.tokenEnv).listProjects();for(let r of T.data)U(`${r.slug}  ${r.name}  ${r.id}`)}),E.command("api:deploy <project> <environment>","Queue a deployment through the public v1 API").option("--base-url <url>","Dashboard base URL").option("--token-env <name>","Environment variable containing the API token",{default:"TS_CLOUD_API_TOKEN"}).option("--service <id>","Optional service resource ID").option("--revision <revision>","Revision or release identifier").option("--idempotency-key <key>","Stable retry key").action(async(_,T,r)=>{let d=r?.idempotencyKey??`cli-${Date.now()}-${crypto.randomUUID().slice(0,8)}`,t=await JG(r?.baseUrl,r?.tokenEnv).createDeployment({projectId:_,environmentId:T,serviceId:r?.service,revision:r?.revision},d);Z(`${t.idempotentReplay?"Replayed":"Queued"} operation ${t.operation.id} (${t.operation.state}).`)})}fE();Vr();sR();Vr();sR();bN();Gr();eN();import{createHash as Lo}from"node:crypto";var Oo=`let coldStart = true
 const initializedAt = new Date().toISOString()
 export const handler = async (event) => {
@@ -10462,7 +10462,7 @@ Full Event Record:`);let S=JSON.parse(N.CloudTrailEvent);console.log(JSON.string
 Create this trail?`,!0)){U("Operation cancelled");return}let t=new n("Creating trail...");t.start();let R=await r.createTrail({Name:_,S3BucketName:T.bucket,S3KeyPrefix:T.prefix,IsMultiRegionTrail:T.multiRegion,EnableLogFileValidation:T.validation,IncludeGlobalServiceEvents:T.globalEvents??!0});t.text="Starting logging...",await r.startLogging(_),t.succeed("Trail created and logging started"),Z(`
 Trail ARN: ${R.TrailARN}`),U(`S3 Bucket: ${R.S3BucketName}`)}catch(r){Q(`Failed to create trail: ${r.message}`),process.exit(1)}}),E.command("audit:start <trailName>","Start CloudTrail logging").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(_,T)=>{b("Start CloudTrail Logging");try{let r=await Ch(T.region),d=new n("Starting logging...");d.start(),await r.startLogging(_),d.succeed("Logging started")}catch(r){Q(`Failed to start logging: ${r.message}`),process.exit(1)}}),E.command("audit:stop <trailName>","Stop CloudTrail logging").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(_,T)=>{b("Stop CloudTrail Logging");try{let r=await Ch(T.region);if(_E(`This will stop logging for trail: ${_}`),!await DE(`
 Stop logging?`,!1)){U("Operation cancelled");return}let t=new n("Stopping logging...");t.start(),await r.stopLogging(_),t.succeed("Logging stopped")}catch(r){Q(`Failed to stop logging: ${r.message}`),process.exit(1)}}),E.command("audit:delete <trailName>","Delete a CloudTrail trail").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(_,T)=>{b("Delete CloudTrail Trail");try{let r=await Ch(T.region);if(_E(`This will permanently delete trail: ${_}`),!await DE(`
-Delete this trail?`,!1)){U("Operation cancelled");return}let t=new n("Deleting trail...");t.start(),await r.deleteTrail(_),t.succeed("Trail deleted")}catch(r){Q(`Failed to delete trail: ${r.message}`),process.exit(1)}})}fE();function XF(E){E.command("status","Show overall infrastructure health dashboard").option("--region <region>","AWS region").action(async(_)=>{b("Infrastructure Status Dashboard");try{let T=await p(),r=_.region||T.project.region||"us-east-1";U(`Region: ${r}`),U(`Project: ${T.project.name||"Unknown"}`),U("");let d=[],t=new n("Checking EC2 instances...");t.start();try{let{EC2Client:I}=await Promise.resolve().then(() => (a0(),X5)),e=await new I(r).describeInstances({Filters:[{Name:"instance-state-name",Values:["running","pending","stopping","stopped"]}]}),z=0,F=0,B=0;for(let y of e.Reservations||[])for(let Y of y.Instances||[])if(B++,Y.State?.Name==="running")z++;else if(Y.State?.Name==="stopped")F++;t.succeed("EC2 instances checked"),d.push({name:"EC2 Instances",status:z>0?"OK":B>0?"WARN":"INFO",details:`${z} running, ${F} stopped, ${B} total`})}catch(I){t.fail("EC2 check failed"),d.push({name:"EC2 Instances",status:"ERROR",details:I.message})}let R=new n("Checking RDS instances...");R.start();try{let{RDSClient:I}=await Promise.resolve().then(() => (ut(),t$)),z=(await new I(r).describeDBInstances()).DBInstances||[],F=z.filter((B)=>B.DBInstanceStatus==="available").length;R.succeed("RDS instances checked"),d.push({name:"RDS Databases",status:z.length>0&&F===z.length?"OK":z.length>0?"WARN":"INFO",details:`${F} available, ${z.length} total`})}catch(I){R.fail("RDS check failed"),d.push({name:"RDS Databases",status:"ERROR",details:I.message})}let h=new n("Checking Lambda functions...");h.start();try{let{LambdaClient:I}=await Promise.resolve().then(() => (Gr(),gS)),z=(await new I(r).listFunctions()).Functions||[];h.succeed("Lambda functions checked"),d.push({name:"Lambda Functions",status:"OK",details:`${z.length} function(s)`})}catch(I){h.fail("Lambda check failed"),d.push({name:"Lambda Functions",status:"ERROR",details:I.message})}let N=new n("Checking S3 buckets...");N.start();try{let{S3Client:I}=await Promise.resolve().then(() => (z_(),kN)),z=(await new I(r).listBuckets()).Buckets||[];N.succeed("S3 buckets checked"),d.push({name:"S3 Buckets",status:"OK",details:`${z.length} bucket(s)`})}catch(I){N.fail("S3 check failed"),d.push({name:"S3 Buckets",status:"ERROR",details:I.message})}let S=new n("Checking CloudFront distributions...");S.start();try{let{CloudFrontClient:I}=await Promise.resolve().then(() => (Vr(),CJ)),e=await new I().listDistributions(),z=e.filter((F)=>F.Status==="Deployed").length;S.succeed("CloudFront checked"),d.push({name:"CloudFront",status:e.length>0&&z===e.length?"OK":e.length>0?"WARN":"INFO",details:`${z} deployed, ${e.length} total`})}catch(I){S.fail("CloudFront check failed"),d.push({name:"CloudFront",status:"ERROR",details:I.message})}let A=new n("Checking SQS queues...");A.start();try{let{SQSClient:I}=await Promise.resolve().then(() => (JA(),DQ)),z=(await new I(r).listQueues()).QueueUrls||[];A.succeed("SQS queues checked"),d.push({name:"SQS Queues",status:"OK",details:`${z.length} queue(s)`})}catch(I){A.fail("SQS check failed"),d.push({name:"SQS Queues",status:"ERROR",details:I.message})}let L=new n("Checking CloudFormation stacks...");L.start();try{let{CloudFormationClient:I}=await Promise.resolve().then(() => (KT(),fe)),z=(await new I(r).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE"])).StackSummaries||[],F=z.filter((Y)=>Y.StackStatus==="CREATE_COMPLETE"||Y.StackStatus==="UPDATE_COMPLETE").length,B=z.filter((Y)=>Y.StackStatus?.includes("IN_PROGRESS")).length,y=z.filter((Y)=>Y.StackStatus?.includes("ROLLBACK")).length;L.succeed("CloudFormation checked"),d.push({name:"CloudFormation",status:y>0?"WARN":B>0?"INFO":"OK",details:`${F} healthy, ${B} in progress, ${y} rolled back`})}catch(I){L.fail("CloudFormation check failed"),d.push({name:"CloudFormation",status:"ERROR",details:I.message})}let O=new n("Checking SSL certificates...");O.start();try{let{ACMClient:I}=await Promise.resolve().then(() => (Mt(),mH)),C=new I("us-east-1"),z=(await C.listCertificates()).CertificateSummaryList||[],F=await Promise.all(z.map((M)=>C.describeCertificate({CertificateArn:M.CertificateArn}))),B=F.filter((M)=>M.Status==="ISSUED").length,y=F.filter((M)=>M.Status==="PENDING_VALIDATION").length,Y=F.filter((M)=>{if(M.NotAfter)return(new Date(M.NotAfter).getTime()-Date.now())/86400000<30;return!1}).length;O.succeed("SSL certificates checked"),d.push({name:"SSL Certificates",status:Y>0?"WARN":y>0?"INFO":"OK",details:`${B} issued, ${y} pending${Y>0?`, ${Y} expiring soon`:""}`})}catch(I){O.fail("ACM check failed"),d.push({name:"SSL Certificates",status:"ERROR",details:I.message})}U(`
+Delete this trail?`,!1)){U("Operation cancelled");return}let t=new n("Deleting trail...");t.start(),await r.deleteTrail(_),t.succeed("Trail deleted")}catch(r){Q(`Failed to delete trail: ${r.message}`),process.exit(1)}})}fE();function XF(E){E.command("status","Show overall infrastructure health dashboard").option("--region <region>","AWS region").action(async(_)=>{b("Infrastructure Status Dashboard");try{let T=await p(),r=_.region||T.project.region||"us-east-1";U(`Region: ${r}`),U(`Project: ${T.project.name||"Unknown"}`),U("");let d=[],t=new n("Checking EC2 instances...");t.start();try{let{EC2Client:I}=await Promise.resolve().then(() => (a0(),X5)),e=await new I(r).describeInstances({Filters:[{Name:"instance-state-name",Values:["running","pending","stopping","stopped"]}]}),z=0,F=0,B=0;for(let y of e.Reservations||[])for(let Y of y.Instances||[])if(B++,Y.State?.Name==="running")z++;else if(Y.State?.Name==="stopped")F++;t.succeed("EC2 instances checked"),d.push({name:"EC2 Instances",status:z>0?"OK":B>0?"WARN":"INFO",details:`${z} running, ${F} stopped, ${B} total`})}catch(I){t.fail("EC2 check failed"),d.push({name:"EC2 Instances",status:"ERROR",details:I.message})}let R=new n("Checking RDS instances...");R.start();try{let{RDSClient:I}=await Promise.resolve().then(() => (ut(),t$)),z=(await new I(r).describeDBInstances()).DBInstances||[],F=z.filter((B)=>B.DBInstanceStatus==="available").length;R.succeed("RDS instances checked"),d.push({name:"RDS Databases",status:z.length>0&&F===z.length?"OK":z.length>0?"WARN":"INFO",details:`${F} available, ${z.length} total`})}catch(I){R.fail("RDS check failed"),d.push({name:"RDS Databases",status:"ERROR",details:I.message})}let h=new n("Checking Lambda functions...");h.start();try{let{LambdaClient:I}=await Promise.resolve().then(() => (Gr(),gS)),z=(await new I(r).listFunctions()).Functions||[];h.succeed("Lambda functions checked"),d.push({name:"Lambda Functions",status:"OK",details:`${z.length} function(s)`})}catch(I){h.fail("Lambda check failed"),d.push({name:"Lambda Functions",status:"ERROR",details:I.message})}let N=new n("Checking S3 buckets...");N.start();try{let{S3Client:I}=await Promise.resolve().then(() => (z_(),kN)),z=(await new I(r).listBuckets()).Buckets||[];N.succeed("S3 buckets checked"),d.push({name:"S3 Buckets",status:"OK",details:`${z.length} bucket(s)`})}catch(I){N.fail("S3 check failed"),d.push({name:"S3 Buckets",status:"ERROR",details:I.message})}let S=new n("Checking CloudFront distributions...");S.start();try{let{CloudFrontClient:I}=await Promise.resolve().then(() => (Vr(),CJ)),e=await new I().listDistributions(),z=e.filter((F)=>F.Status==="Deployed").length;S.succeed("CloudFront checked"),d.push({name:"CloudFront",status:e.length>0&&z===e.length?"OK":e.length>0?"WARN":"INFO",details:`${z} deployed, ${e.length} total`})}catch(I){S.fail("CloudFront check failed"),d.push({name:"CloudFront",status:"ERROR",details:I.message})}let A=new n("Checking SQS queues...");A.start();try{let{SQSClient:I}=await Promise.resolve().then(() => (JA(),D9)),z=(await new I(r).listQueues()).QueueUrls||[];A.succeed("SQS queues checked"),d.push({name:"SQS Queues",status:"OK",details:`${z.length} queue(s)`})}catch(I){A.fail("SQS check failed"),d.push({name:"SQS Queues",status:"ERROR",details:I.message})}let L=new n("Checking CloudFormation stacks...");L.start();try{let{CloudFormationClient:I}=await Promise.resolve().then(() => (KT(),fe)),z=(await new I(r).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE"])).StackSummaries||[],F=z.filter((Y)=>Y.StackStatus==="CREATE_COMPLETE"||Y.StackStatus==="UPDATE_COMPLETE").length,B=z.filter((Y)=>Y.StackStatus?.includes("IN_PROGRESS")).length,y=z.filter((Y)=>Y.StackStatus?.includes("ROLLBACK")).length;L.succeed("CloudFormation checked"),d.push({name:"CloudFormation",status:y>0?"WARN":B>0?"INFO":"OK",details:`${F} healthy, ${B} in progress, ${y} rolled back`})}catch(I){L.fail("CloudFormation check failed"),d.push({name:"CloudFormation",status:"ERROR",details:I.message})}let O=new n("Checking SSL certificates...");O.start();try{let{ACMClient:I}=await Promise.resolve().then(() => (Mt(),mH)),C=new I("us-east-1"),z=(await C.listCertificates()).CertificateSummaryList||[],F=await Promise.all(z.map((M)=>C.describeCertificate({CertificateArn:M.CertificateArn}))),B=F.filter((M)=>M.Status==="ISSUED").length,y=F.filter((M)=>M.Status==="PENDING_VALIDATION").length,Y=F.filter((M)=>{if(M.NotAfter)return(new Date(M.NotAfter).getTime()-Date.now())/86400000<30;return!1}).length;O.succeed("SSL certificates checked"),d.push({name:"SSL Certificates",status:Y>0?"WARN":y>0?"INFO":"OK",details:`${B} issued, ${y} pending${Y>0?`, ${Y} expiring soon`:""}`})}catch(I){O.fail("ACM check failed"),d.push({name:"SSL Certificates",status:"ERROR",details:I.message})}U(`
 `+"=".repeat(60)),U("HEALTH SUMMARY"),U("=".repeat(60)+`
 `);for(let I of d){let C="";if(I.status==="OK")C=`${mE.green}[OK]${mE.reset}`;else if(I.status==="WARN")C=`${mE.yellow}[WARN]${mE.reset}`;else if(I.status==="ERROR")C=`${mE.red}[ERROR]${mE.reset}`;else C=`${mE.blue}[INFO]${mE.reset}`;console.log(`${C} ${I.name.padEnd(20)} ${I.details}`)}let c=d.some((I)=>I.status==="ERROR"),$=d.some((I)=>I.status==="WARN");if(U(""),c)Q("Some services have errors. Check the details above.");else if($)_E("Some services need attention. Check the warnings above.");else Z("All services are healthy!")}catch(T){Q(`Failed to get status: ${T.message}`),process.exit(1)}}),E.command("status:costs","Show current month cost summary").option("--region <region>","AWS region").action(async(_)=>{b("Cost Summary");try{U("Fetching cost data from AWS Cost Explorer..."),U("");let T=new Date,r=new Date(T.getFullYear(),T.getMonth(),1),d=new Date(T.getFullYear(),T.getMonth()+1,0);U(`Period: ${r.toISOString().split("T")[0]} to ${d.toISOString().split("T")[0]}`),U(""),U("Note: Cost data requires AWS Cost Explorer API access."),U("Run `cloud cost` for detailed cost analysis.")}catch(T){Q(`Failed to get cost summary: ${T.message}`),process.exit(1)}}),E.command("status:alarms","Show CloudWatch alarm status").option("--region <region>","AWS region").action(async(_)=>{b("CloudWatch Alarms");try{let T=await p(),r=_.region||T.project.region||"us-east-1",{AWSClient:d}=await Promise.resolve().then(() => (VE(),zR));class t{client;region;constructor(c){this.region=c,this.client=new d}async describeAlarms(){return this.client.request({service:"monitoring",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=DescribeAlarms&Version=2010-08-01"})}}let R=new t(r),h=new n("Fetching alarms...");h.start();let S=(await R.describeAlarms()).MetricAlarms||[];if(h.succeed(`Found ${S.length} alarm(s)`),S.length===0){U("No CloudWatch alarms configured");return}let A=S.filter((c)=>c.StateValue==="ALARM"),L=S.filter((c)=>c.StateValue==="OK"),O=S.filter((c)=>c.StateValue==="INSUFFICIENT_DATA");if(U(""),U(`Alarming: ${A.length}`),U(`OK: ${L.length}`),U(`Insufficient Data: ${O.length}`),A.length>0){U(`
 Alarms in ALARM state:`);for(let c of A)Q(`  - ${c.AlarmName}: ${c.AlarmDescription||"No description"}`)}}catch(T){Q(`Failed to get alarms: ${T.message}`),process.exit(1)}})}fE();async function Zd(E){let{AWSClient:_}=await Promise.resolve().then(() => (VE(),zR));class T{client;region;constructor(r){this.region=r,this.client=new _}async jsonRpcRequest(r,d){return this.client.request({service:"backup",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`CryoControllerFrontendService.${r}`},body:JSON.stringify(d)})}async listBackupVaults(){return this.jsonRpcRequest("ListBackupVaults",{})}async listBackupPlans(){return this.jsonRpcRequest("ListBackupPlans",{})}async listRecoveryPointsByBackupVault(r,d){return this.jsonRpcRequest("ListRecoveryPointsByBackupVault",{BackupVaultName:r,...d})}async describeBackupVault(r){return this.jsonRpcRequest("DescribeBackupVault",{BackupVaultName:r})}async getBackupPlan(r){return this.jsonRpcRequest("GetBackupPlan",{BackupPlanId:r})}async createBackupVault(r,d){return this.jsonRpcRequest("CreateBackupVault",{BackupVaultName:r,...d})}async deleteBackupVault(r){return this.jsonRpcRequest("DeleteBackupVault",{BackupVaultName:r})}async createBackupPlan(r){return this.jsonRpcRequest("CreateBackupPlan",{BackupPlan:r})}async deleteBackupPlan(r){return this.jsonRpcRequest("DeleteBackupPlan",{BackupPlanId:r})}async startBackupJob(r){return this.jsonRpcRequest("StartBackupJob",r)}async startRestoreJob(r){return this.jsonRpcRequest("StartRestoreJob",r)}async describeBackupJob(r){return this.jsonRpcRequest("DescribeBackupJob",{BackupJobId:r})}async describeRestoreJob(r){return this.jsonRpcRequest("DescribeRestoreJob",{RestoreJobId:r})}async listBackupJobs(r){return this.jsonRpcRequest("ListBackupJobs",r||{})}async listRestoreJobs(r){return this.jsonRpcRequest("ListRestoreJobs",r||{})}async createBackupSelection(r,d){return this.jsonRpcRequest("CreateBackupSelection",{BackupPlanId:r,BackupSelection:d})}async listBackupSelections(r){return this.jsonRpcRequest("ListBackupSelections",{BackupPlanId:r})}}return new T(E)}function JF(E){E.command("backup:vaults","List backup vaults").option("--region <region>","AWS region").action(async(_)=>{b("Backup Vaults");try{let T=await p(),r=_.region||T.project.region||"us-east-1",d=await Zd(r),t=new n("Fetching vaults...");t.start();let h=(await d.listBackupVaults()).BackupVaultList||[];if(t.succeed(`Found ${h.length} vault(s)`),h.length===0){U("No backup vaults found"),U("Use `cloud backup:create-vault` to create a new vault");return}o(["Vault Name","Recovery Points","Created","Encrypted"],h.map((N)=>[N.BackupVaultName||"N/A",(N.NumberOfRecoveryPoints||0).toString(),N.CreationDate?new Date(N.CreationDate).toLocaleDateString():"N/A",N.EncryptionKeyArn?"Yes":"Default"]))}catch(T){Q(`Failed to list vaults: ${T.message}`),process.exit(1)}}),E.command("backup:list","List backup plans").option("--region <region>","AWS region").action(async(_)=>{b("Backup Plans");try{let T=await p(),r=_.region||T.project.region||"us-east-1",d=await Zd(r),t=new n("Fetching backup plans...");t.start();let h=(await d.listBackupPlans()).BackupPlansList||[];if(t.succeed(`Found ${h.length} backup plan(s)`),h.length===0){U("No backup plans found"),U("Use `cloud backup:create` to create a backup plan");return}o(["Plan Name","Plan ID","Version","Created"],h.map((N)=>[N.BackupPlanName||"N/A",N.BackupPlanId||"N/A",N.VersionId?.substring(0,8)||"N/A",N.CreationDate?new Date(N.CreationDate).toLocaleDateString():"N/A"]))}catch(T){Q(`Failed to list backup plans: ${T.message}`),process.exit(1)}}),E.command("backup:recovery-points <vaultName>","List recovery points in a vault").option("--region <region>","AWS region").option("--limit <number>","Maximum results",{default:"50"}).action(async(_,T)=>{b(`Recovery Points: ${_}`);try{let r=await p(),d=T.region||r.project.region||"us-east-1",t=await Zd(d),R=new n("Fetching recovery points...");R.start();let N=(await t.listRecoveryPointsByBackupVault(_,{MaxResults:Number.parseInt(T.limit)})).RecoveryPoints||[];if(R.succeed(`Found ${N.length} recovery point(s)`),N.length===0){U("No recovery points found");return}o(["Resource","Status","Created","Size","Lifecycle"],N.map((S)=>[S.ResourceArn?.split(":").pop()||"N/A",S.Status||"N/A",S.CreationDate?new Date(S.CreationDate).toLocaleString():"N/A",S.BackupSizeInBytes?GG(S.BackupSizeInBytes):"N/A",S.Lifecycle?.DeleteAfterDays?`${S.Lifecycle.DeleteAfterDays} days`:"Indefinite"]))}catch(r){Q(`Failed to list recovery points: ${r.message}`),process.exit(1)}}),E.command("backup:create-vault <vaultName>","Create a backup vault").option("--region <region>","AWS region",{default:"us-east-1"}).option("--kms-key <arn>","KMS key ARN for encryption").action(async(_,T)=>{b("Create Backup Vault");try{let r=await Zd(T.region);if(U(`Vault Name: ${_}`),U(`Region: ${T.region}`),U(`Encryption: ${T.kmsKey?"Custom KMS":"AWS Managed"}`),!await DE(`