@stacksjs/ts-cloud 0.9.3 → 0.9.4

package/dist/bin/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import{i as d1,j as KJ,k as z1,l as jJ,n as BJ,o as b2}from"./chunk-hzgz13nf.js";import{v as o1}from"./chunk-rytk89az.js";import{$ as u1,A as B4,Aa as y2,B as x4,Ba as S$,C as _1,Ca as GY,D as O0,Da as l0,E as i4,Ea as hY,F as o4,Fa as yY,G as $9,Ga as CY,H as J9,Ha as i5,I as Y9,Ia as fY,J as G9,Ja as s5,K as X9,Ka as LY,L as Q9,La as EY,M as m$,Ma as TY,N as K9,Na as P5,O as y1,Oa as b$,P as e6,Pa as l$,Q as j9,Qa as Q0,R as B9,Ra as l5,S as V9,Sa as PY,T as A9,Ta as Q6,U as q9,V as R9,W as L9,X as E9,Y as T9,Z as o6,_ as C1,aa as u9,ba as l9,ca as TJ,da as r9,ea as a9,fa as n9,ga as s9,ha as DJ,ia as i9,ja as t9,ka as e9,la as o9,ma as bY,na as IY,oa as kY,pa as K2,qa as j2,ra as B2,sa as W5,ta as z5,ua as I2,va as F5,w as S0,wa as U5,x as Q$,xa as k2,y as JY,ya as h2,z as u,za as M5}from"./chunk-b5gd39s8.js";import"./chunk-38pq971s.js";import{$a as Z2,$b as y9,Ab as k9,Bb as qJ,Gc as f9,Jc as g9,Pc as d$,Tc as v9,Uc as RJ,Vc as LJ,Wa as v$,Wc as m9,Ya as G2,Za as X2,_a as Q2,_b as h9,ab as W2,bb as z2,cb as F2,db as U2,eb as M2,fb as UY,hb as MY,ib as HY,jb as KY,kb as H2,lb as p1,mb as w4,nb as r1,pb as F1,qb as D5,rb as x5,sb as a5,tb as DY,ub as xY,xb as NY,xc as C9,yb as N5}from"./chunk-hzqw8xm5.js";import{cd as P0}from"./chunk-hm08xdxf.js";import{dd as h1}from"./chunk-fhc6ntvd.js";import{ed as eJ,fd as oJ,gd as $5,id as B0,kd as n6,ld as U0,md as O6}from"./chunk-ctd2vg9w.js";import{nd as $$}from"./chunk-gavvf0pg.js";import"./chunk-bz828v8q.js";import{sd as o$,td as f0,ud as P9,vd as S9,wd as N0}from"./chunk-57y1zxbf.js";import{yd as X0}from"./chunk-4vrqm9h0.js";import{Ad as V0,Ed as Y2,zd as M0}from"./chunk-3r4fb59r.js";import{Rd as e$}from"./chunk-p66ptpmr.js";import{$d as m4,Sd as D6,Td as b1,Ud as o0,Vd as $1,Wd as g4,Xd as C6,Yd as rJ,Zd as f6,_d as v4,ae as d4,be as c4,ce as u4,de as l4,ee as g6,fe as r4,ge as v6,he as a4,ie as p4,je as I1,ke as n4,le as j0,me as s4,ne as G5,oe as e1,pe as uJ,qe as X5,re as c$,te as Q5,ue as Z5}from"./chunk-sgyffpgm.js";import{Me as VJ}from"./chunk-3gykfyq4.js";import{Ue as HJ}from"./chunk-ax9mr6wm.js";import{Xe as E$}from"./chunk-ggn7ax8p.js";import"./chunk-r3kv0vm9.js";import{jf as B1,kf as iJ,lf as J5,mf as Y5,nf as S2,of as _2}from"./chunk-r9hjwcj9.js";import"./chunk-axhnkn5g.js";import{Uf as Y$}from"./chunk-h5pa5men.js";import{Vf as K$,Wf as u$}from"./chunk-09nwf2gy.js";import"./chunk-j703btc5.js";import{$f as Z$,_f as x9}from"./chunk-fy8j3y8p.js";import{ag as A4,dg as q4,eg as R4,fg as L4,gg as E4,hg as T4,ig as O4}from"./chunk-ynjvbphf.js";import{jg as G6,ng as OY,og as YY}from"./chunk-ry030a6b.js";import"./chunk-waayf9ay.js";import{rg as V1}from"./chunk-mr0atd2s.js";import{Ag as R,Bg as E,Cg as p,Dg as k,Eg as E6,Fg as w,Gg as q1,Hg as n$,Ig as i2,Jg as t2,Kg as e2,Lg as o2,Mg as v,sg as Z0,tg as w2,ug as B,vg as K,wg as N,xg as X1,yg as W,zg as y}from"./chunk-271gk1n2.js";import{Og as WJ,Qg as O2}from"./chunk-fpm59y25.js";import{Ah as i$,Ai as a2,Bh as x2,Ch as N2,Dh as P2,Gh as J2,Mh as P6,Qh as S6,Rh as F$,Sh as _4,Th as N1,Uh as H0,Xh as _6,ai as b4,bi as y0,ci as P1,di as b6,ei as I4,fi as k4,ii as h4,lh as m2,nh as j1,oh as sJ,oi as y4,ph as D2,pi as S1,qh as c0,rh as N4,vi as r2,wh as P4,xh as S4}from"./chunk-jpjamjey.js";import{Vo as h}from"./chunk-mh0kdzqp.js";import{existsSync as gY}from"node:fs";import F6 from"node:fs/promises";import o5 from"node:os";import U6 from"node:path";import E0 from"node:process";import{EventEmitter as vY}from"node:events";import z0 from"node:process";import $4 from"node:process";import j6 from"node:process";import T1 from"node:process";import n0 from"node:process";import G4 from"node:tty";import x8,{stdin as QZ,stdout as ZZ}from"node:process";import Q4,{stdin as S8,stdout as _8}from"node:process";import b8 from"node:readline";class W4{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let G=o5.homedir(),$=U6.join(G,".config","clapp");this.configPath=U6.join($,"telemetry.json")}async isEnabled(){if(E0.env.DO_NOT_TRACK==="1"||E0.env.DO_NOT_TRACK==="true")return!1;if(E0.env.NO_TELEMETRY==="1"||E0.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let G=await this.loadConfig();if(G.enabled=!0,!G.userId)G.userId=this.generateUserId();await this.saveConfig(G)}async disable(){let G=await this.loadConfig();G.enabled=!1,await this.saveConfig(G)}async track(G,$){if(!await this.isEnabled())return;let Y={event:G,...$,timestamp:Date.now(),platform:o5.platform(),nodeVersion:E0.version};if(this.events.push(Y),this.events.length>=10)await this.send()}async trackCommand(G,$){await this.track("command",{command:G,duration:$})}async trackError(G,$){await this.track("error",{error:G,command:$})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let $=await this.loadConfig();return $.lastSent=Date.now(),await this.saveConfig($),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let $=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep($),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(G){return new Promise(($)=>setTimeout($,G))}async status(){let G=await this.loadConfig();return{enabled:G.enabled,doNotTrack:E0.env.DO_NOT_TRACK==="1"||E0.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:G.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(gY(this.configPath)){let G=await F6.readFile(this.configPath,"utf-8");return this.config=JSON.parse(G),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(G){this.config=G;try{let $=U6.dirname(this.configPath);await F6.mkdir($,{recursive:!0}),await F6.writeFile(this.configPath,JSON.stringify(G,null,2),"utf-8")}catch{}}generateUserId(){let G=Math.random().toString(36).substring(2,15),$=Date.now().toString(36);return`${G}-${$}`}}var pQ=new W4;function mY(G,$={}){let J={_:[]},Y=$.alias||{},X=new Set($.boolean||[]),Q={};for(let z of Object.keys(Y))for(let F of Y[z])Q[F]=z;for(let z of X)if(Y[z])for(let F of Y[z])X.add(F);function Z(z,F){let U=Q[z]||z;if(J[U]=F,Y[U])for(let M of Y[U])J[M]=F;if(Q[z]&&Y[Q[z]])for(let M of Y[Q[z]])J[M]=F;J[z]=F}for(let z=0;z<G.length;z++){let F=G[z];if(F==="--"){J._.push(...G.slice(z+1));break}if(F.startsWith("--")){let U=F.indexOf("=");if(U!==-1){let M=F.slice(2,U),H=F.slice(U+1);Z(M,H)}else{let M=F.slice(2);if(M.startsWith("no-")){let j=M.slice(3);Z(j,!1);continue}let H=Q[M]||M;if(X.has(H)||X.has(M))Z(M,!0);else{let j=G[z+1];if(j!==void 0&&!j.startsWith("-"))Z(M,j),z++;else Z(M,!0)}}}else if(F.startsWith("-")&&F.length>1){let U=F.slice(1);for(let M=0;M<U.length;M++){let H=U[M],j=Q[H]||H;if(M===U.length-1&&!X.has(j)&&!X.has(H)){let V=G[z+1];if(V!==void 0&&!V.startsWith("-"))Z(H,V),z++;else Z(H,!0)}else Z(H,!0)}}else J._.push(F)}return J}function K6(G){return G.replace(/[<[].+/,"").trim()}function dY(G){let $=/<([^>]+)>/g,J=/\[([^\]]+)\]/g,Y=[],X=(z)=>{let F=!1,U=z[1];if(U.startsWith("..."))U=U.slice(3),F=!0;return{required:z[0].startsWith("<"),value:U,variadic:F}},Q;while(Q=$.exec(G))Y.push(X(Q));let Z;while(Z=J.exec(G))Y.push(X(Z));return Y}function cY(G){let $={alias:{},boolean:[]};for(let[J,Y]of G.entries()){if(Y.names.length>1)$.alias[Y.names[0]]=Y.names.slice(1);if(Y.isBoolean)if(Y.negated){if(!G.some((Q,Z)=>{return Z!==J&&Q.names.some((z)=>Y.names.includes(z))&&typeof Q.required==="boolean"}))$.boolean.push(Y.names[0])}else $.boolean.push(Y.names[0])}return $}function J4(G){return G.reduce(($,J)=>$.length>=J.length?$:J,"")}function M6(G,$){return G.length>=$?G:`${G}${" ".repeat($-G.length)}`}function uY(G){return G.replace(/([a-z])-([a-z])/g,($,J,Y)=>{return J+Y.toUpperCase()})}function lY(G,$,J){let Y=0,X=$.length,Q=G,Z;for(;Y<X;++Y)Z=Q[$[Y]],Q=Q[$[Y]]=Y===X-1?J:Z!=null?Z:!!~$[Y+1].indexOf(".")||!(+$[Y+1]>-1)?{}:[]}function rY(G,$){for(let J of Object.keys($)){let Y=$[J];if(Y.shouldTransform){if(G[J]=Array.prototype.concat.call([],G[J]),typeof Y.transformFunction==="function")G[J]=G[J].map(Y.transformFunction)}}}function aY(G){let $=/([^\\/]+)$/.exec(G);return $?$[1]:""}function z4(G){return G.split(".").map(($,J)=>{return J===0?uY($):$}).join(".")}class E1 extends Error{exitCode=2;isUsageError=!0;constructor(G){super(G);if(this.name=this.constructor.name,typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(G).stack}format(G=!1){if(G&&this.stack)return`${this.message}
+import{i as d1,j as KJ,k as z1,l as jJ,n as BJ,o as b2}from"./chunk-hzgz13nf.js";import{v as o1}from"./chunk-rytk89az.js";import{$ as u1,A as B4,Aa as y2,B as x4,Ba as S$,C as _1,Ca as GY,D as O0,Da as l0,E as i4,Ea as hY,F as o4,Fa as yY,G as $9,Ga as CY,H as J9,Ha as i5,I as Y9,Ia as fY,J as G9,Ja as s5,K as X9,Ka as LY,L as Q9,La as EY,M as m$,Ma as TY,N as K9,Na as P5,O as y1,Oa as b$,P as e6,Pa as l$,Q as j9,Qa as Q0,R as B9,Ra as l5,S as V9,Sa as PY,T as A9,Ta as Q6,U as q9,V as R9,W as L9,X as E9,Y as T9,Z as o6,_ as C1,aa as u9,ba as l9,ca as TJ,da as r9,ea as a9,fa as n9,ga as s9,ha as DJ,ia as i9,ja as t9,ka as e9,la as o9,ma as bY,na as IY,oa as kY,pa as K2,qa as j2,ra as B2,sa as W5,ta as z5,ua as I2,va as F5,w as S0,wa as U5,x as Q$,xa as k2,y as JY,ya as h2,z as u,za as M5}from"./chunk-5erkxpt7.js";import"./chunk-38pq971s.js";import{$a as Z2,$b as y9,Ab as k9,Bb as qJ,Gc as f9,Jc as g9,Pc as d$,Tc as v9,Uc as RJ,Vc as LJ,Wa as v$,Wc as m9,Ya as G2,Za as X2,_a as Q2,_b as h9,ab as W2,bb as z2,cb as F2,db as U2,eb as M2,fb as UY,hb as MY,ib as HY,jb as KY,kb as H2,lb as p1,mb as w4,nb as r1,pb as F1,qb as D5,rb as x5,sb as a5,tb as DY,ub as xY,xb as NY,xc as C9,yb as N5}from"./chunk-1k5kszjp.js";import{cd as P0}from"./chunk-hm08xdxf.js";import{dd as h1}from"./chunk-fhc6ntvd.js";import{ed as eJ,fd as oJ,gd as $5,id as B0,kd as n6,ld as U0,md as O6}from"./chunk-ctd2vg9w.js";import{nd as $$}from"./chunk-gavvf0pg.js";import"./chunk-y7s5r8y6.js";import{sd as o$,td as f0,ud as P9,vd as S9,wd as N0}from"./chunk-vm3q5gf2.js";import{yd as X0}from"./chunk-4vrqm9h0.js";import{Ad as V0,Ed as Y2,zd as M0}from"./chunk-mz0wbbsj.js";import{Rd as e$}from"./chunk-p66ptpmr.js";import{$d as m4,Sd as D6,Td as b1,Ud as o0,Vd as $1,Wd as g4,Xd as C6,Yd as rJ,Zd as f6,_d as v4,ae as d4,be as c4,ce as u4,de as l4,ee as g6,fe as r4,ge as v6,he as a4,ie as p4,je as I1,ke as n4,le as j0,me as s4,ne as G5,oe as e1,pe as uJ,qe as X5,re as c$,te as Q5,ue as Z5}from"./chunk-zmegvjp8.js";import{Me as VJ}from"./chunk-3gykfyq4.js";import{Ue as HJ}from"./chunk-ax9mr6wm.js";import{Xe as E$}from"./chunk-ggn7ax8p.js";import"./chunk-ddk4rt4j.js";import{jf as B1,kf as iJ,lf as J5,mf as Y5,nf as S2,of as _2}from"./chunk-tga3hhwk.js";import"./chunk-axhnkn5g.js";import{Uf as Y$}from"./chunk-h5pa5men.js";import{Vf as K$,Wf as u$}from"./chunk-09nwf2gy.js";import"./chunk-j703btc5.js";import{$f as Z$,_f as x9}from"./chunk-fy8j3y8p.js";import{ag as A4,dg as q4,eg as R4,fg as L4,gg as E4,hg as T4,ig as O4}from"./chunk-tx0tqq2k.js";import{jg as G6,ng as OY,og as YY}from"./chunk-etrb03mt.js";import"./chunk-2empps47.js";import{rg as V1}from"./chunk-mr0atd2s.js";import{Ag as R,Bg as E,Cg as p,Dg as k,Eg as E6,Fg as w,Gg as q1,Hg as n$,Ig as i2,Jg as t2,Kg as e2,Lg as o2,Mg as v,sg as Z0,tg as w2,ug as B,vg as K,wg as N,xg as X1,yg as W,zg as y}from"./chunk-271gk1n2.js";import{Og as WJ,Qg as O2}from"./chunk-fpm59y25.js";import{Ah as i$,Ai as a2,Bh as x2,Ch as N2,Dh as P2,Gh as J2,Mh as P6,Qh as S6,Rh as F$,Sh as _4,Th as N1,Uh as H0,Xh as _6,ai as b4,bi as y0,ci as P1,di as b6,ei as I4,fi as k4,ii as h4,lh as m2,nh as j1,oh as sJ,oi as y4,ph as D2,pi as S1,qh as c0,rh as N4,vi as r2,wh as P4,xh as S4}from"./chunk-rxcvf10f.js";import{Vo as h}from"./chunk-mh0kdzqp.js";import{existsSync as gY}from"node:fs";import F6 from"node:fs/promises";import o5 from"node:os";import U6 from"node:path";import E0 from"node:process";import{EventEmitter as vY}from"node:events";import z0 from"node:process";import $4 from"node:process";import j6 from"node:process";import T1 from"node:process";import n0 from"node:process";import G4 from"node:tty";import x8,{stdin as QZ,stdout as ZZ}from"node:process";import Q4,{stdin as S8,stdout as _8}from"node:process";import b8 from"node:readline";class W4{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let G=o5.homedir(),$=U6.join(G,".config","clapp");this.configPath=U6.join($,"telemetry.json")}async isEnabled(){if(E0.env.DO_NOT_TRACK==="1"||E0.env.DO_NOT_TRACK==="true")return!1;if(E0.env.NO_TELEMETRY==="1"||E0.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let G=await this.loadConfig();if(G.enabled=!0,!G.userId)G.userId=this.generateUserId();await this.saveConfig(G)}async disable(){let G=await this.loadConfig();G.enabled=!1,await this.saveConfig(G)}async track(G,$){if(!await this.isEnabled())return;let Y={event:G,...$,timestamp:Date.now(),platform:o5.platform(),nodeVersion:E0.version};if(this.events.push(Y),this.events.length>=10)await this.send()}async trackCommand(G,$){await this.track("command",{command:G,duration:$})}async trackError(G,$){await this.track("error",{error:G,command:$})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let $=await this.loadConfig();return $.lastSent=Date.now(),await this.saveConfig($),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let $=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep($),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(G){return new Promise(($)=>setTimeout($,G))}async status(){let G=await this.loadConfig();return{enabled:G.enabled,doNotTrack:E0.env.DO_NOT_TRACK==="1"||E0.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:G.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(gY(this.configPath)){let G=await F6.readFile(this.configPath,"utf-8");return this.config=JSON.parse(G),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(G){this.config=G;try{let $=U6.dirname(this.configPath);await F6.mkdir($,{recursive:!0}),await F6.writeFile(this.configPath,JSON.stringify(G,null,2),"utf-8")}catch{}}generateUserId(){let G=Math.random().toString(36).substring(2,15),$=Date.now().toString(36);return`${G}-${$}`}}var pQ=new W4;function mY(G,$={}){let J={_:[]},Y=$.alias||{},X=new Set($.boolean||[]),Q={};for(let z of Object.keys(Y))for(let F of Y[z])Q[F]=z;for(let z of X)if(Y[z])for(let F of Y[z])X.add(F);function Z(z,F){let U=Q[z]||z;if(J[U]=F,Y[U])for(let M of Y[U])J[M]=F;if(Q[z]&&Y[Q[z]])for(let M of Y[Q[z]])J[M]=F;J[z]=F}for(let z=0;z<G.length;z++){let F=G[z];if(F==="--"){J._.push(...G.slice(z+1));break}if(F.startsWith("--")){let U=F.indexOf("=");if(U!==-1){let M=F.slice(2,U),H=F.slice(U+1);Z(M,H)}else{let M=F.slice(2);if(M.startsWith("no-")){let j=M.slice(3);Z(j,!1);continue}let H=Q[M]||M;if(X.has(H)||X.has(M))Z(M,!0);else{let j=G[z+1];if(j!==void 0&&!j.startsWith("-"))Z(M,j),z++;else Z(M,!0)}}}else if(F.startsWith("-")&&F.length>1){let U=F.slice(1);for(let M=0;M<U.length;M++){let H=U[M],j=Q[H]||H;if(M===U.length-1&&!X.has(j)&&!X.has(H)){let V=G[z+1];if(V!==void 0&&!V.startsWith("-"))Z(H,V),z++;else Z(H,!0)}else Z(H,!0)}}else J._.push(F)}return J}function K6(G){return G.replace(/[<[].+/,"").trim()}function dY(G){let $=/<([^>]+)>/g,J=/\[([^\]]+)\]/g,Y=[],X=(z)=>{let F=!1,U=z[1];if(U.startsWith("..."))U=U.slice(3),F=!0;return{required:z[0].startsWith("<"),value:U,variadic:F}},Q;while(Q=$.exec(G))Y.push(X(Q));let Z;while(Z=J.exec(G))Y.push(X(Z));return Y}function cY(G){let $={alias:{},boolean:[]};for(let[J,Y]of G.entries()){if(Y.names.length>1)$.alias[Y.names[0]]=Y.names.slice(1);if(Y.isBoolean)if(Y.negated){if(!G.some((Q,Z)=>{return Z!==J&&Q.names.some((z)=>Y.names.includes(z))&&typeof Q.required==="boolean"}))$.boolean.push(Y.names[0])}else $.boolean.push(Y.names[0])}return $}function J4(G){return G.reduce(($,J)=>$.length>=J.length?$:J,"")}function M6(G,$){return G.length>=$?G:`${G}${" ".repeat($-G.length)}`}function uY(G){return G.replace(/([a-z])-([a-z])/g,($,J,Y)=>{return J+Y.toUpperCase()})}function lY(G,$,J){let Y=0,X=$.length,Q=G,Z;for(;Y<X;++Y)Z=Q[$[Y]],Q=Q[$[Y]]=Y===X-1?J:Z!=null?Z:!!~$[Y+1].indexOf(".")||!(+$[Y+1]>-1)?{}:[]}function rY(G,$){for(let J of Object.keys($)){let Y=$[J];if(Y.shouldTransform){if(G[J]=Array.prototype.concat.call([],G[J]),typeof Y.transformFunction==="function")G[J]=G[J].map(Y.transformFunction)}}}function aY(G){let $=/([^\\/]+)$/.exec(G);return $?$[1]:""}function z4(G){return G.split(".").map(($,J)=>{return J===0?uY($):$}).join(".")}class E1 extends Error{exitCode=2;isUsageError=!0;constructor(G){super(G);if(this.name=this.constructor.name,typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(G).stack}format(G=!1){if(G&&this.stack)return`${this.message}
 
 Stack trace:
 ${this.stack}`;return this.message}}function pY(){let{env:G}=$4,{TERM:$,TERM_PROGRAM:J}=G;if($4.platform!=="win32")return $!=="linux";return Boolean(G.WT_SESSION)||Boolean(G.TERMINUS_SUBLIME)||G.ConEmuTask==="{cmd::Cmder}"||J==="Terminus-Sublime"||J==="vscode"||$==="xterm-256color"||$==="alacritty"||$==="rxvt-unicode"||$==="rxvt-unicode-256color"||G.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var D1="\x1B",J$=`${D1}[`;var p$={to(G,$){if(!$)return`${J$}${G+1}G`;return`${J$}${$+1};${G+1}H`},move(G,$){let J="";if(G<0)J+=`${J$}${-G}D`;else if(G>0)J+=`${J$}${G}C`;if($<0)J+=`${J$}${-$}A`;else if($>0)J+=`${J$}${$}B`;return J},up:(G=1)=>`${J$}${G}A`,down:(G=1)=>`${J$}${G}B`,forward:(G=1)=>`${J$}${G}C`,backward:(G=1)=>`${J$}${G}D`,nextLine:(G=1)=>`${J$}E`.repeat(G),prevLine:(G=1)=>`${J$}F`.repeat(G),left:`${J$}G`,hide:`${J$}?25l`,show:`${J$}?25h`,save:`${D1}7`,restore:`${D1}8`};var H6={screen:`${J$}2J`,up:(G=1)=>`${J$}1J`.repeat(G),down:(G=1)=>`${J$}J`.repeat(G),line:`${J$}2K`,lineEnd:`${J$}K`,lineStart:`${J$}1K`,lines(G){let $="";for(let J=0;J<G;J++)$+=this.line+(J<G-1?p$.up():"");if(G)$+=p$.left;return $}},tQ={screen:`${D1}c`};function nY(G,$){let J=[];for(let Y=0;Y<=$.length;Y++)J[Y]=[Y];for(let Y=0;Y<=G.length;Y++)J[0][Y]=Y;for(let Y=1;Y<=$.length;Y++)for(let X=1;X<=G.length;X++)if($.charAt(Y-1)===G.charAt(X-1))J[Y][X]=J[Y-1][X-1];else J[Y][X]=Math.min(J[Y-1][X-1]+1,J[Y][X-1]+1,J[Y-1][X]+1);return J[$.length][G.length]}function F4(G,$,J=2,Y=3){return $.map((X)=>({cmd:X,distance:nY(G,X)})).filter(({distance:X})=>X<=J).sort((X,Q)=>X.distance-Q.distance).slice(0,Y).map(({cmd:X})=>X)}class U4{rawName;description;name;names;isBoolean;required;config;negated;constructor(G,$,J){if(this.rawName=G,this.description=$,this.config=Object.assign({},J),G=G.replace(/\.\*/g,""),this.negated=!1,this.names=K6(G).split(",").map((Y)=>{let X=Y.trim().replace(/^-{1,2}/,"");if(X.startsWith("no-"))this.negated=!0,X=X.replace(/^no-/,"");return z4(X)}).sort((Y,X)=>Y.length>X.length?1:-1),this.name=this.names[this.names.length-1],this.negated&&this.config.default==null)this.config.default=!0;if(G.includes("<"))this.required=!0;else if(G.includes("["))this.required=!1;else this.isBoolean=!0}}var oQ=j6.argv,sY=`${j6.platform}-${j6.arch} bun-v${typeof Bun<"u"?Bun.version:"unknown"}`,Y4=T1.argv,iY=`${T1.platform}-${T1.arch} node-${T1.version}`;class B6{rawName;description;config;cli;options;aliasNames;name;namespace;args;commandAction;usageText;versionNumber;examples;helpCallback;globalCommand;beforeHooks;afterHooks;middleware;constructor(G,$,J,Y){this.rawName=G,this.description=$,this.config=J,this.cli=Y,this.options=[],this.aliasNames=[],this.name=K6(G);let X=K6(G),Q=X.indexOf(":");if(Q>0)this.namespace=X.substring(0,Q),this.name=X.substring(Q+1);if(this.args=dY(G),this.examples=[],this.beforeHooks=[],this.afterHooks=[],this.middleware=[],!J)this.config={}}usage(G){return this.usageText=G,this}allowUnknownOptions(){return this.config.allowUnknownOptions=!0,this}ignoreOptionDefaultValue(){return this.config.ignoreOptionDefaultValue=!0,this}version(G,$="-v, --version"){return this.versionNumber=G,this.option($,"Display version number"),this}example(G){return this.examples.push(G),this}option(G,$,J){let Y=new U4(G,$,J);return this.options.push(Y),this}alias(G){return this.aliasNames.push(G),this}action(G){return this.commandAction=G,this}before(G){return this.beforeHooks.push(G),this}after(G){return this.afterHooks.push(G),this}use(G){return this.middleware.push(G),this}isMatched(G){if(this.aliasNames.includes(G))return!0;if(this.namespace)return`${this.namespace}:${this.name}`===G;return this.name===G}get isDefaultCommand(){return this.name===""||this.aliasNames.includes("!")}get isGlobalCommand(){return this instanceof V6}get displayName(){return this.namespace?`${this.namespace}:${this.name}`:this.name}hasOption(G){return G=G.split(".")[0],!!this.options.find(($)=>{return $.names.includes(G)})}outputHelp(){let{name:G,commands:$}=this.cli,{versionNumber:J,options:Y,helpCallback:X}=this.cli.globalCommand,Q=[{body:`${G}${J?`/${J}`:""}`}];if(Q.push({title:"Usage",body:`  $ ${G} ${this.usageText||this.rawName}`}),(this.isGlobalCommand||this.isDefaultCommand)&&$.length>0){let F=J4($.map((V)=>V.rawName)),U=new Map,M=[];for(let V of $)if(V.namespace){if(!U.has(V.namespace))U.set(V.namespace,[]);U.get(V.namespace).push(V)}else M.push(V);let H="";if(M.length>0)H+=M.map((V)=>{return`  ${M6(V.rawName,F.length)}  ${V.description}`}).join(`
@@ -37,7 +37,7 @@ Run \`${this.name??"cli"} --help\` for usage.`;z0.stderr.write(`${Q}${X}${Z}
 `).length-1;this.output.write(p$.move(-999,G*-1))}render(){let G=Z4(this._render(this)??"",Q4.stdout.columns,{hard:!0,trim:!1});if(G===this._prevFrame)return;if(this.state==="initial")this.output.write(p$.hide);else{let $=P8(this._prevFrame,G);if(this.restoreCursor(),$&&$?.length===1){let J=$[0];this.output.write(p$.move(0,J)),this.output.write(H6.lines(1));let Y=G.split(`
 `);this.output.write(Y[J]),this._prevFrame=G,this.output.write(p$.move(0,Y.length-J-1));return}if($&&$?.length>1){let J=$[0];this.output.write(p$.move(0,J)),this.output.write(H6.down());let X=G.split(`
 `).slice(J);this.output.write(X.join(`
-`)),this._prevFrame=G;return}this.output.write(H6.down())}if(this.output.write(G),this.state==="initial")this.state="active";this._prevFrame=G}}function h8(G,$){if(G===void 0)return 0;if($.length===0)return 0;let Y=$.findIndex((X)=>X.value===G);return Y!==-1?Y:0}function y8(G,$){return($.label??String($.value)).toLowerCase().includes(G.toLowerCase())}function C8(G,$){if(!$)return;if(G)return $;return $[0]}class f8 extends q6{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#$=0;#Y="";#G;#J;get cursor(){return this.#$}get userInputWithCursor(){if(!this.userInput)return O1.inverse(O1.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let G=this.userInput.slice(0,this._cursor),[$,...J]=this.userInput.slice(this._cursor);return`${G}${O1.inverse($)}${J.join("")}`}get options(){if(typeof this.#J==="function")return this.#J();return this.#J}constructor(G){super(G);this.#J=G.options;let $=this.options;this.filteredOptions=[...$],this.multiple=G.multiple===!0,this.#G=G.filter??y8;let J;if(G.initialValue&&Array.isArray(G.initialValue))if(this.multiple)J=G.initialValue;else J=G.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)J=[this.options[0].value];if(J)for(let Y of J){let X=$.findIndex((Q)=>Q.value===Y);if(X!==-1)this.toggleSelected(Y),this.#$=X}this.focusedValue=this.options[this.#$]?.value,this.on("key",(Y,X)=>this.#X(Y,X)),this.on("userInput",(Y)=>this.#Q(Y))}_isActionKey(G,$){return G==="\t"||this.multiple&&this.isNavigating&&$.name==="space"&&G!==void 0&&G!==""}#X(G,$){let J=$.name==="up",Y=$.name==="down",X=$.name==="return";if(J||Y){if(this.#$=Math.max(0,Math.min(this.#$+(J?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#$]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(X)this.value=C8(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&($.name==="tab"||this.isNavigating&&$.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(G){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(G))this.selectedValues=this.selectedValues.filter(($)=>$!==G);else this.selectedValues=[...this.selectedValues,G];else this.selectedValues=[G]}#Q(G){if(G!==this.#Y){this.#Y=G;let $=this.options;if(G)this.filteredOptions=$.filter((J)=>this.#G(G,J));else this.filteredOptions=[...$];if(this.#$=h8(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#$]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class g8 extends q6{options;cursor=0;#$;getGroupItems(G){return this.options.filter(($)=>$.group===G)}isGroupSelected(G){let $=this.getGroupItems(G),J=this.value;if(J===void 0)return!1;return $.every((Y)=>J.includes(Y.value))}toggleValue(){let G=this.options[this.cursor];if(this.value===void 0)this.value=[];if(G.group===!0){let $=String(G.value),J=this.getGroupItems($);if(this.isGroupSelected($))this.value=this.value.filter((Y)=>J.findIndex((X)=>X.value===Y)===-1);else this.value=[...this.value,...J.map((Y)=>Y.value)];this.value=Array.from(new Set(this.value))}else{let $=this.value.includes(G.value);this.value=$?this.value.filter((J)=>J!==G.value):[...this.value,G.value]}}constructor(G){super(G,!1);let{options:$}=G;this.#$=G.selectableGroups!==!1,this.options=Object.entries($).flatMap(([J,Y])=>[{value:J,group:!0,label:J},...Y.map((X)=>({...X,group:J}))]),this.value=[...G.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:J})=>J===G.cursorAt),this.#$?0:1),this.on("cursor",(J)=>{switch(J){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let Y=this.options[this.cursor]?.group===!0;if(!this.#$&&Y)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let Y=this.options[this.cursor]?.group===!0;if(!this.#$&&Y)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var v8=pY();var t=(G,$)=>v8?G:$,UZ=t("◆","*"),MZ=t("■","x"),HZ=t("▲","x"),KZ=t("◇","o"),jZ=t("┌","T"),m8=t("│","|"),BZ=t("└","—"),VZ=t("●",">"),AZ=t("○"," "),qZ=t("◻","[•]"),RZ=t("◼","[+]"),LZ=t("◻","[ ]"),EZ=t("▪","•"),TZ=t("─","-"),OZ=t("╮","+"),wZ=t("├","+"),DZ=t("╯","+"),xZ=t("●","•"),NZ=t("◆","*"),PZ=t("▲","!"),SZ=t("■","x");var _Z={light:t("─","-"),heavy:t("━","="),block:t("█","#")};function d8(){return`${O1.gray(m8)}  `}var bZ=d8();var R6="0.9.3";import{existsSync as L6}from"node:fs";import{mkdir as u8,writeFile as j4}from"node:fs/promises";function T6(G){G.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async($)=>{if(R("Initializing ts-cloud Project"),L6("cloud.config.ts")){if(!await k("cloud.config.ts already exists. Overwrite?",!1)){W("Initialization cancelled");return}}let J=$?.name||await p("Project name","my-app"),Y=$?.mode||await E6("Select deployment mode",["serverless","server"]),X=$?.region||await E6("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),Q=new E("Creating configuration file...");Q.start();let Z=`import { defineConfig } from '@ts-cloud/core'
+`)),this._prevFrame=G;return}this.output.write(H6.down())}if(this.output.write(G),this.state==="initial")this.state="active";this._prevFrame=G}}function h8(G,$){if(G===void 0)return 0;if($.length===0)return 0;let Y=$.findIndex((X)=>X.value===G);return Y!==-1?Y:0}function y8(G,$){return($.label??String($.value)).toLowerCase().includes(G.toLowerCase())}function C8(G,$){if(!$)return;if(G)return $;return $[0]}class f8 extends q6{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#$=0;#Y="";#G;#J;get cursor(){return this.#$}get userInputWithCursor(){if(!this.userInput)return O1.inverse(O1.hidden("_"));if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let G=this.userInput.slice(0,this._cursor),[$,...J]=this.userInput.slice(this._cursor);return`${G}${O1.inverse($)}${J.join("")}`}get options(){if(typeof this.#J==="function")return this.#J();return this.#J}constructor(G){super(G);this.#J=G.options;let $=this.options;this.filteredOptions=[...$],this.multiple=G.multiple===!0,this.#G=G.filter??y8;let J;if(G.initialValue&&Array.isArray(G.initialValue))if(this.multiple)J=G.initialValue;else J=G.initialValue.slice(0,1);else if(!this.multiple&&this.options.length>0)J=[this.options[0].value];if(J)for(let Y of J){let X=$.findIndex((Q)=>Q.value===Y);if(X!==-1)this.toggleSelected(Y),this.#$=X}this.focusedValue=this.options[this.#$]?.value,this.on("key",(Y,X)=>this.#X(Y,X)),this.on("userInput",(Y)=>this.#Q(Y))}_isActionKey(G,$){return G==="\t"||this.multiple&&this.isNavigating&&$.name==="space"&&G!==void 0&&G!==""}#X(G,$){let J=$.name==="up",Y=$.name==="down",X=$.name==="return";if(J||Y){if(this.#$=Math.max(0,Math.min(this.#$+(J?-1:1),this.filteredOptions.length-1)),this.focusedValue=this.filteredOptions[this.#$]?.value,!this.multiple)this.selectedValues=[this.focusedValue];this.isNavigating=!0}else if(X)this.value=C8(this.multiple,this.selectedValues);else if(this.multiple)if(this.focusedValue!==void 0&&($.name==="tab"||this.isNavigating&&$.name==="space"))this.toggleSelected(this.focusedValue);else this.isNavigating=!1;else{if(this.focusedValue)this.selectedValues=[this.focusedValue];this.isNavigating=!1}}deselectAll(){this.selectedValues=[]}toggleSelected(G){if(this.filteredOptions.length===0)return;if(this.multiple)if(this.selectedValues.includes(G))this.selectedValues=this.selectedValues.filter(($)=>$!==G);else this.selectedValues=[...this.selectedValues,G];else this.selectedValues=[G]}#Q(G){if(G!==this.#Y){this.#Y=G;let $=this.options;if(G)this.filteredOptions=$.filter((J)=>this.#G(G,J));else this.filteredOptions=[...$];if(this.#$=h8(this.focusedValue,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#$]?.value,!this.multiple)if(this.focusedValue!==void 0)this.toggleSelected(this.focusedValue);else this.deselectAll()}}}class g8 extends q6{options;cursor=0;#$;getGroupItems(G){return this.options.filter(($)=>$.group===G)}isGroupSelected(G){let $=this.getGroupItems(G),J=this.value;if(J===void 0)return!1;return $.every((Y)=>J.includes(Y.value))}toggleValue(){let G=this.options[this.cursor];if(this.value===void 0)this.value=[];if(G.group===!0){let $=String(G.value),J=this.getGroupItems($);if(this.isGroupSelected($))this.value=this.value.filter((Y)=>J.findIndex((X)=>X.value===Y)===-1);else this.value=[...this.value,...J.map((Y)=>Y.value)];this.value=Array.from(new Set(this.value))}else{let $=this.value.includes(G.value);this.value=$?this.value.filter((J)=>J!==G.value):[...this.value,G.value]}}constructor(G){super(G,!1);let{options:$}=G;this.#$=G.selectableGroups!==!1,this.options=Object.entries($).flatMap(([J,Y])=>[{value:J,group:!0,label:J},...Y.map((X)=>({...X,group:J}))]),this.value=[...G.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:J})=>J===G.cursorAt),this.#$?0:1),this.on("cursor",(J)=>{switch(J){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let Y=this.options[this.cursor]?.group===!0;if(!this.#$&&Y)this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let Y=this.options[this.cursor]?.group===!0;if(!this.#$&&Y)this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;break}case"space":this.toggleValue();break}})}}var v8=pY();var t=(G,$)=>v8?G:$,UZ=t("◆","*"),MZ=t("■","x"),HZ=t("▲","x"),KZ=t("◇","o"),jZ=t("┌","T"),m8=t("│","|"),BZ=t("└","—"),VZ=t("●",">"),AZ=t("○"," "),qZ=t("◻","[•]"),RZ=t("◼","[+]"),LZ=t("◻","[ ]"),EZ=t("▪","•"),TZ=t("─","-"),OZ=t("╮","+"),wZ=t("├","+"),DZ=t("╯","+"),xZ=t("●","•"),NZ=t("◆","*"),PZ=t("▲","!"),SZ=t("■","x");var _Z={light:t("─","-"),heavy:t("━","="),block:t("█","#")};function d8(){return`${O1.gray(m8)}  `}var bZ=d8();var R6="0.9.4";import{existsSync as L6}from"node:fs";import{mkdir as u8,writeFile as j4}from"node:fs/promises";function T6(G){G.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async($)=>{if(R("Initializing ts-cloud Project"),L6("cloud.config.ts")){if(!await k("cloud.config.ts already exists. Overwrite?",!1)){W("Initialization cancelled");return}}let J=$?.name||await p("Project name","my-app"),Y=$?.mode||await E6("Select deployment mode",["serverless","server"]),X=$?.region||await E6("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),Q=new E("Creating configuration file...");Q.start();let Z=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -74,7 +74,7 @@ Next steps:
   1. Edit cloud.config.ts to configure your infrastructure
   2. Run 'cloud generate' to create CloudFormation templates
   3. Run 'cloud deploy' to deploy your infrastructure`,"green")}),G.command("init:server","Initialize server-based (EC2) project").action(async()=>{R("Initializing Server-Based Project"),await G.parse(["init","--mode","server"])}),G.command("init:serverless","Initialize serverless (Fargate/Lambda) project").action(async()=>{R("Initializing Serverless Project"),await G.parse(["init","--mode","serverless"])}),G.command("init:hybrid","Initialize hybrid project").action(async()=>{R("Initializing Hybrid Project"),await G.parse(["init","--mode","hybrid"])})}import{readFile as V4,writeFile as l8}from"node:fs/promises";import{resolve as x1}from"node:path";async function x(){let G=await B4();if(!G.project)throw Error("Missing required project configuration in cloud.config.ts");return G}function U$(G){if(G)switch(G.toLowerCase()){case"porkbun":{let Y=process.env.PORKBUN_API_KEY,X=process.env.PORKBUN_SECRET_KEY;if(!Y||!X)throw Error("PORKBUN_API_KEY and PORKBUN_SECRET_KEY environment variables are required for Porkbun provider");return{provider:"porkbun",apiKey:Y,secretKey:X}}case"godaddy":{let Y=process.env.GODADDY_API_KEY,X=process.env.GODADDY_API_SECRET;if(!Y||!X)throw Error("GODADDY_API_KEY and GODADDY_API_SECRET environment variables are required for GoDaddy provider");let Q=process.env.GODADDY_ENVIRONMENT||"production";return{provider:"godaddy",apiKey:Y,apiSecret:X,environment:Q}}case"route53":{let Y=process.env.AWS_REGION||"us-east-1",X=process.env.AWS_HOSTED_ZONE_ID;return{provider:"route53",region:Y,hostedZoneId:X}}case"cloudflare":{let Y=process.env.CLOUDFLARE_API_TOKEN;if(!Y)throw Error("CLOUDFLARE_API_TOKEN environment variable is required for Cloudflare provider");return{provider:"cloudflare",apiToken:Y,zoneId:process.env.CLOUDFLARE_ZONE_ID,accountId:process.env.CLOUDFLARE_ACCOUNT_ID}}default:throw Error(`Unknown DNS provider: ${G}. Supported: porkbun, godaddy, route53, cloudflare`)}if(new O6().loadFromEnv().getAllProviders().length===0)return null;if(process.env.PORKBUN_API_KEY&&process.env.PORKBUN_SECRET_KEY)return{provider:"porkbun",apiKey:process.env.PORKBUN_API_KEY,secretKey:process.env.PORKBUN_SECRET_KEY};if(process.env.GODADDY_API_KEY&&process.env.GODADDY_API_SECRET)return{provider:"godaddy",apiKey:process.env.GODADDY_API_KEY,apiSecret:process.env.GODADDY_API_SECRET,environment:process.env.GODADDY_ENVIRONMENT||"production"};if(process.env.AWS_ACCESS_KEY_ID||process.env.AWS_REGION)return{provider:"route53",region:process.env.AWS_REGION||"us-east-1",hostedZoneId:process.env.AWS_HOSTED_ZONE_ID};if(process.env.CLOUDFLARE_API_TOKEN)return{provider:"cloudflare",apiToken:process.env.CLOUDFLARE_API_TOKEN,zoneId:process.env.CLOUDFLARE_ZONE_ID,accountId:process.env.CLOUDFLARE_ACCOUNT_ID};return null}function C$(G){let $=U$(G);if(!$)throw Error("No DNS provider configured. Set environment variables for Porkbun (PORKBUN_API_KEY, PORKBUN_SECRET_KEY), GoDaddy (GODADDY_API_KEY, GODADDY_API_SECRET), Cloudflare (CLOUDFLARE_API_TOKEN), or Route53 (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)");return U0($)}async function r8(G){let $=await x(),J=u(process.cwd(),$),Y=G??Object.keys($.environments??{})[0]??"production",X=J.environments.get(Y);if(!X)throw J.store.close(),Error(`Environment ${Y} was not found.`);let Q=$.project?.region??"us-east-1",Z=Q$(process.cwd()),z=new A4(J.store),F=new T4(z,{encryptionKey:Z,backends:[new q4(J.store,Z),new R4(new M0(Q),Q),new L4(new D6(Q),Q),new E4]}),U=J.store.getActorByExternalId("system","cli")??J.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});return await O4(F,J,$,U.id),{config:$,controlPlane:J,env:Y,environmentRecord:X,store:z,service:F,actor:U}}async function f$(G,$){let J=await r8(G);try{return await $(J)}finally{J.controlPlane.store.close()}}async function B$(G){try{await G()}catch($){K($ instanceof Error?$.message:String($))}}function a8(G){return G.map(($)=>[$.key,$.kind,$.scope.type,$.inherited?"inherited":$.overridden?"override":"direct",$.kind==="secret"?$.backend??"restricted":$.value??"",$.backendVersion??"—",$.required?"required":"optional",$.updatedAt])}function D4(G,$=process.env){if(G.value!=null)throw Error("Secret values are not accepted in command arguments; use --from-env or the interactive prompt.");if(!G.fromEnv)return;let J=$[G.fromEnv];if(!J)throw Error(`${G.fromEnv} is empty or unavailable.`);return J}function w$(G,$){let J=$.scope??"environment";if(J==="project")return{type:J,id:G.controlPlane.project.id};if(J==="environment"){let Y=$.target?G.controlPlane.store.listEnvironments(G.controlPlane.project.id).find((X)=>X.id===$.target||X.slug===$.target):G.environmentRecord;if(!Y)throw Error(`Environment ${$.target} was not found.`);return{type:J,id:Y.id,environmentId:Y.id}}if(J==="service"){let Y=G.controlPlane.store.listResources(G.controlPlane.project.id),X=Y.find((Q)=>Q.id===$.target||Q.slug===$.target);if(!X)throw Error("Service scope requires --target with a resource ID or slug.");return{type:J,id:X.id,environmentId:X.environmentId,resourceId:X.id}}if(J==="function"){let Y=G.controlPlane.store.listResources(G.controlPlane.project.id),X=Y.find((Q)=>Q.kind==="function"&&(Q.id===$.target||Q.slug===$.target));if(!X)throw Error("Function scope requires --target with a function resource ID or slug.");return{type:J,id:X.id,environmentId:X.environmentId,resourceId:X.id}}if(J==="preview"){let Y=new w4(G.controlPlane.store).listInstances({projectId:G.controlPlane.project.id}).find((X)=>X.id===$.target||X.name===$.target);if(!Y)throw Error("Preview scope requires --target with a preview ID or name.");return{type:J,id:Y.id,environmentId:Y.baseEnvironmentId,resourceId:Y.resourceId,previewId:Y.id}}throw Error("--scope must be project, environment, service, function, or preview.")}function w6(G){let $=G??"local_encrypted";if(!["local_encrypted","aws_secrets_manager","aws_ssm","external"].includes($))throw Error("--backend must be local_encrypted, aws_secrets_manager, aws_ssm, or external.");return $}function h0(G,$,J){let Y=G.store.find(G.controlPlane.project.id,J,$);if(!Y)throw Error(`${$} was not found in the selected scope.`);return Y}async function p8(G,$){if(G==="secret")return D4($)??await p("Enter secret value (input is write-only)","");if($.fromEnv){let J=process.env[$.fromEnv];if(J==null)throw Error(`${$.fromEnv} is unavailable.`);return J}if($.value!=null)return $.value;return await p("Enter variable value","")}function g$(G){return G.option("--env <environment>","Dashboard environment").option("--scope <scope>","project, environment, service, function, or preview",{default:"environment"}).option("--target <id>","Environment, resource, function, or preview ID/name")}function x6(G){G.command("config","Show validated file configuration").action(async()=>B$(async()=>{let $=await x();console.log(JSON.stringify($,null,2))})),G.command("config:validate","Validate configuration file").action(async()=>B$(async()=>{let $=await x();if(!$.project?.name||!$.project?.slug||!$.mode)throw Error("project.name, project.slug, and mode are required.");B(`Configuration is valid: ${$.project.name} · ${$.mode} · ${$.project.region||"us-east-1"}`)})),g$(G.command("config:list","List scoped variables and write-only secret metadata")).option("--kind <kind>","variable or secret").option("--search <text>","Filter key names").option("--json","Print structured JSON").action(async($)=>B$(async()=>f$($.env,async(J)=>{let Y=w$(J,$),X=["variable","secret"].includes($.kind??"")?$.kind:void 0,Q=J.service.list({projectId:J.controlPlane.project.id,scope:Y,kind:X,search:$.search,canReadSecretMetadata:!0});if($.json)console.log(JSON.stringify(Q,null,2));else w(["Key","Kind","Scope","Precedence","Value/backend","Backend version","Requirement","Updated"],a8(Q))}))),g$(G.command("config:set <key>","Create or replace a scoped variable or secret")).option("--value <value>","Plaintext variable value only").option("--from-env <name>","Read the value from an environment variable").option("--secret","Store a write-only secret").option("--backend <backend>","local_encrypted, aws_secrets_manager, aws_ssm, or external").option("--reference <uri>","External provider reference").option("--required","Fail deployments when unavailable").option("--confirm <key>","Exact key confirmation for production replacements").option("--json","Print structured JSON").action(async($,J)=>B$(async()=>f$(J.env,async(Y)=>{let X=w$(Y,J),Q=J.secret?"secret":"variable",Z=Q==="secret"?w6(J.backend):void 0,z=Z==="external"?void 0:await p8(Q,J),F=await Y.service.set({organizationId:Y.controlPlane.organization.id,projectId:Y.controlPlane.project.id,scope:X,key:$,kind:Q,value:z,reference:J.reference,backend:Z,required:!!J.required,confirmed:J.confirm===$,actorId:Y.actor.id,idempotencyKey:`cli:${crypto.randomUUID()}`});if(J.json)console.log(JSON.stringify({entry:Y.service.list({projectId:Y.controlPlane.project.id,scope:X,canReadSecretMetadata:!0}).find((U)=>U.id===F.entry.id),mutation:F.mutation,warnings:F.warnings},null,2));else B(`${$}: ${F.mutation.added.length?"created":F.mutation.changed.length?"updated":"unchanged"}; ${F.mutation.affectedResourceIds.length} affected service(s).`)}))),g$(G.command("config:delete <key>","Delete a scoped variable or secret")).option("--confirm <key>","Exact key confirmation").action(async($,J)=>B$(async()=>f$(J.env,async(Y)=>{let X=h0(Y,$,w$(Y,J));await Y.service.remove({entryId:X.id,expectedVersion:X.version,confirmed:J.confirm===$,actorId:Y.actor.id}),B(`Deleted ${$}.`)}))),g$(G.command("config:import <file>","Validate and import a dotenv file")).option("--secret-keys <keys>","Comma-separated secret keys").option("--backend <backend>","Secret backend").option("--confirm <word>","Use import for production replacement confirmation").option("--json","Print structured JSON").action(async($,J)=>B$(async()=>f$(J.env,async(Y)=>{let X=await Y.service.importDotenv({organizationId:Y.controlPlane.organization.id,projectId:Y.controlPlane.project.id,scope:w$(Y,J),source:await V4(x1($),"utf8"),secretKeys:J.secretKeys?.split(",").map((Q)=>Q.trim()).filter(Boolean),backend:w6(J.backend),confirmed:J.confirm==="import",actorId:Y.actor.id,idempotencyKey:`cli-import:${crypto.randomUUID()}`});if(!X.document.valid)throw Error(X.document.diagnostics.map((Q)=>`line ${Q.line}: ${Q.message}`).join(`
-`));if(J.json)console.log(JSON.stringify({mutation:X.mutation,diagnostics:X.document.diagnostics,warnings:X.warnings},null,2));else B(`Imported ${X.mutation?.added.length??0} new, ${X.mutation?.changed.length??0} changed, and ${X.mutation?.unchanged.length??0} unchanged entries.`)}))),g$(G.command("config:plan <file>","Preview dotenv drift using key names only")).option("--remove-missing","Include managed keys absent from the file").option("--json","Print structured JSON").action(async($,J)=>B$(async()=>f$(J.env,async(Y)=>{let{parseDotenv:X}=await import("./chunk-gqf6jsmy.js"),Q=X(await V4(x1($),"utf8"));if(!Q.valid)throw Error(Q.diagnostics.map((z)=>`line ${z.line}: ${z.message}`).join(`
+`));if(J.json)console.log(JSON.stringify({mutation:X.mutation,diagnostics:X.document.diagnostics,warnings:X.warnings},null,2));else B(`Imported ${X.mutation?.added.length??0} new, ${X.mutation?.changed.length??0} changed, and ${X.mutation?.unchanged.length??0} unchanged entries.`)}))),g$(G.command("config:plan <file>","Preview dotenv drift using key names only")).option("--remove-missing","Include managed keys absent from the file").option("--json","Print structured JSON").action(async($,J)=>B$(async()=>f$(J.env,async(Y)=>{let{parseDotenv:X}=await import("./chunk-9knpg30y.js"),Q=X(await V4(x1($),"utf8"));if(!Q.valid)throw Error(Q.diagnostics.map((z)=>`line ${z.line}: ${z.message}`).join(`
 `));let Z=Y.service.plan({projectId:Y.controlPlane.project.id,scope:w$(Y,J),values:Q.values,removeMissing:!!J.removeMissing});if(J.json)console.log(JSON.stringify(Z,null,2));else w(["Action","Keys"],[["Add",Z.added.join(", ")||"—"],["Change",Z.changed.join(", ")||"—"],["Remove",Z.removed.join(", ")||"—"],["Unchanged",Z.unchanged.join(", ")||"—"]]),W(`${Z.affectedResourceIds.length} affected service(s); no secret values were printed.`)}))),g$(G.command("config:export [file]","Export plaintext variables only as dotenv")).action(async($,J)=>B$(async()=>f$(J.env,async(Y)=>{let X=Y.service.exportVariables({projectId:Y.controlPlane.project.id,scope:w$(Y,J)});if($)await l8(x1($),X,{mode:384}),B(`Exported variables to ${x1($)}; secrets were excluded.`);else process.stdout.write(X)}))),g$(G.command("config:transfer <key>","Copy or move an entry between scopes")).option("--to-scope <scope>","Destination scope").option("--to-target <id>","Destination ID or slug").option("--move","Remove the source after copying").option("--confirm <key>","Exact key confirmation").action(async($,J)=>B$(async()=>f$(J.env,async(Y)=>{let X=w$(Y,J),Q=h0(Y,$,X),Z=w$(Y,{env:J.env,scope:J.toScope,target:J.toTarget}),z=await Y.service.transfer({entryId:Q.id,targetScope:Z,mode:J.move?"move":"copy",confirmed:J.confirm===$,actorId:Y.actor.id,idempotencyKey:`cli-transfer:${crypto.randomUUID()}`});B(`${$} ${J.move?"moved":"copied"}; ${z.mutation.affectedResourceIds.length} affected service(s).`)}))),g$(G.command("config:reveal <key>","Reveal a secret after exact confirmation")).option("--confirm <key>","Exact key confirmation").action(async($,J)=>B$(async()=>f$(J.env,async(Y)=>{if(J.confirm!==$)throw Error(`Use --confirm ${$} to reveal this secret.`);let X=h0(Y,$,w$(Y,J));console.log(await Y.service.reveal({entryId:X.id,canRevealSecrets:!0,recentlyAuthenticated:!0,actorId:Y.actor.id}))}))),g$(G.command("config:env","Backward-compatible variable management")).option("--list","List variables").option("--set <key=value>","Set a variable").option("--unset <key>","Delete a variable").option("--environment <environment>","Target environment").action(async($)=>B$(async()=>f$($.environment??$.env,async(J)=>{let Y=w$(J,{env:$.environment,scope:"environment",target:$.environment});if($.list)w(["Key","Value","Updated"],J.service.list({projectId:J.controlPlane.project.id,scope:Y,kind:"variable"}).map((X)=>[X.key,X.value??"",X.updatedAt]));else if($.set){let X=$.set.indexOf("=");if(X<1)throw Error("Use --set KEY=VALUE.");let Q=$.set.slice(0,X),Z=$.set.slice(X+1);await J.service.set({organizationId:J.controlPlane.organization.id,projectId:J.controlPlane.project.id,scope:Y,key:Q,kind:"variable",value:Z,confirmed:!1,actorId:J.actor.id}),B(`Set ${Q}.`)}else if($.unset){let X=h0(J,$.unset,Y);await J.service.remove({entryId:X.id,expectedVersion:X.version,confirmed:await k(`Delete ${X.key}?`,!1),actorId:J.actor.id}),B(`Deleted ${X.key}.`)}else W("Use --list, --set KEY=VALUE, or --unset KEY.")}))),g$(G.command("config:secrets","Backward-compatible write-only secret management")).option("--list","List secret metadata").option("--create <key>","Create a secret").option("--update <key>","Rotate a secret").option("--get <key>","Reveal a secret").option("--delete <key>","Delete a secret").option("--from-env <name>","Read new value from an environment variable").option("--backend <backend>","Secret backend").option("--confirm <key>","Exact key confirmation").action(async($)=>B$(async()=>f$($.env,async(J)=>{let Y=w$(J,$);if($.list)w(["Key","Backend","Version","Rotated"],J.service.list({projectId:J.controlPlane.project.id,scope:Y,kind:"secret",canReadSecretMetadata:!0}).map((X)=>[X.key,X.backend??"restricted",X.backendVersion??"—",X.rotatedAt??"never"]));else if($.create||$.update){let X=$.create??$.update,Q=D4($)??await p("Enter secret value (write-only)","");await J.service.set({organizationId:J.controlPlane.organization.id,projectId:J.controlPlane.project.id,scope:Y,key:X,kind:"secret",value:Q,backend:w6($.backend),confirmed:$.confirm===X,actorId:J.actor.id}),B(`${X} ${$.update?"rotated":"created"}.`)}else if($.get){if($.confirm!==$.get)throw Error(`Use --confirm ${$.get} to reveal.`);let X=h0(J,$.get,Y);console.log(await J.service.reveal({entryId:X.id,canRevealSecrets:!0,recentlyAuthenticated:!0,actorId:J.actor.id}))}else if($.delete){let X=h0(J,$.delete,Y);await J.service.remove({entryId:X.id,expectedVersion:X.version,confirmed:$.confirm===X.key,actorId:J.actor.id}),B(`Deleted ${X.key}.`)}else W("Use --list, --create, --update, --get, or --delete.")})))}import{existsSync as n8}from"node:fs";import{readFile as s8,writeFile as i8}from"node:fs/promises";function N6(G){G.command("site:add <name>","Add a site entry to cloud.config.ts").option("--config <path>","Path to cloud config file").option("--root <path>","Directory to deploy").option("--domain <domain>","Domain for the site").option("--path <path>","Path prefix for the site").option("--deploy <target>","Deployment target: server or bucket").option("--build <command>","Build command to run before deployment").option("--start <command>","Start command for server apps").option("--port <port>","Port for server apps").option("--type <type>","Site type, e.g. static, laravel, php").option("--path-rewrite-style <style>","Static rewrite style: directory or flat").option("--dry-run","Print the updated config without writing").action(async($,J)=>{let Y=J?.config||"cloud.config.ts",X=J?.root;if(!X){K("Missing --root <path>");return}if(!n8(Y)){K(`Config file not found: ${Y}`);return}try{let Q=x4({configText:await s8(Y,"utf8"),name:$,root:X,domain:J?.domain,path:J?.path,deploy:t8(J?.deploy),build:J?.build,start:J?.start,port:o8(J?.port),type:J?.type,pathRewriteStyle:e8(J?.pathRewriteStyle)});if(J?.dryRun){console.log(Q);return}await i8(Y,Q),B(`Added site '${$}' to ${Y}`)}catch(Q){K(Q instanceof Error?Q.message:String(Q))}})}function t8(G){if(!G)return;if(G==="bucket"||G==="server")return G;throw Error(`Invalid --deploy '${G}'. Expected 'server' or 'bucket'.`)}function e8(G){if(!G)return;if(G==="directory"||G==="flat")return G;throw Error(`Invalid --path-rewrite-style '${G}'. Expected 'directory' or 'flat'.`)}function o8(G){if(!G)return;let $=Number.parseInt(G,10);if(!Number.isInteger($)||$<1||$>65535)throw Error(`Invalid --port '${G}'. Expected a TCP port between 1 and 65535.`);return $}import{existsSync as XG}from"node:fs";import{mkdir as QG,writeFile as ZG}from"node:fs/promises";import{join as WG}from"node:path";class C0{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;constructor(G){this.config=G.config,this.environment=G.environment,this.builder=new N4(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let $=this.config.environments[this.environment]?.infrastructure;if(!$)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...$,compute:{...this.config.infrastructure?.compute,...$.compute},storage:{...this.config.infrastructure?.storage,...$.storage},functions:{...this.config.infrastructure?.functions,...$.functions},servers:{...this.config.infrastructure?.servers,...$.servers},databases:{...this.config.infrastructure?.databases,...$.databases},cdn:{...this.config.infrastructure?.cdn,...$.cdn},sftp:$.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...$.queues},redirects:{...this.config.infrastructure?.redirects,...$.redirects},realtime:{...this.config.infrastructure?.realtime,...$.realtime},cache:{...this.config.infrastructure?.cache,...$.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...$.fileSystem},email:{...this.config.infrastructure?.email,...$.email},search:{...this.config.infrastructure?.search,...$.search},ai:{...this.config.infrastructure?.ai,...$.ai}}}}shouldDeploy(G){if(G.environments&&!G.environments.includes(this.environment))return!1;if(G.requiresFeatures){let $=this.config.features||{};if(!G.requiresFeatures.every((Y)=>$[Y]===!0))return!1}if(G.regions){let $=this.config.environments[this.environment]?.region||this.config.project.region;if(!G.regions.includes($))return!1}if(G.condition&&typeof G.condition==="function")return G.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let G=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,$=Number(G||3008);return Number.isFinite($)&&$>0?$:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(G,$){return G==="public"||$.routeCompute===!0}storageBucketName(G,$,J){return this.mergedConfig.infrastructure?.storage?.[J]?.bucket??`${G}-${$}-${J}`}fileSystemLogicalId(G,$,J){return S4(P4({slug:`${G}-${J}`,environment:$,resourceType:"efs"}))}resolveSftpStorage(G,$,J){let Y=G.storage;if(Y?.type==="efs"&&Y.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[Y.fileSystem])throw Error(`sftp: storage.fileSystem "${Y.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId($,J,Y.fileSystem)},posixProfile:Y.posixProfile}}if(Y?.type==="s3"&&Y.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[Y.storageBucket])throw Error(`sftp: storage.storageBucket "${Y.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName($,J,Y.storageBucket)}}return}resolveComputeCachePathPatterns(G){if(G&&G.length>0)return G;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(G,$){return{PathPattern:G,TargetOriginId:$,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(G,$,J,Y,X,Q){let Z=this.serverEipLogicalIds.get("app"),z=this.serverEipLogicalIds.get("appInstance");if(!Z)return;let F=`EC2-${Y}-${X}-api`,U=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",M=U==="us-east-1"?".compute-1.amazonaws.com":`.${U}.compute.amazonaws.com`,H={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:Z}]}]},M]]},j=this.resolveApiOriginPort();if(G.push({Id:F,DomainName:H,CustomOriginConfig:{HTTPPort:j,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),J.push(Z),z)J.push(z);for(let V of Q)$.push(this.createComputeCacheBehavior(V,F))}buildCaddyfile(G){let $=G.filter(([,X])=>typeof X.domain==="string"&&X.domain&&typeof X.port==="number");if($.length===0)return;let J=new Map;for(let[,X]of $){let Q=J.get(X.domain)??[];Q.push({port:X.port,path:X.path}),J.set(X.domain,Q)}let Y=[];for(let[X,Q]of J){let z=[...Q].sort((F,U)=>{let M=!F.path||F.path==="/",H=!U.path||U.path==="/";if(M&&!H)return 1;if(!M&&H)return-1;return(U.path?.length??0)-(F.path?.length??0)}).map((F)=>{let U=!F.path||F.path==="/",M=`reverse_proxy localhost:${F.port}`;return U?`  handle {
     ${M}
   }`:`  handle ${F.path} {
@@ -297,12 +297,12 @@ ${$.loadManagement?.enabled?`
 Generated ${L} resources:`);let D=O.getResources(),P={};for(let _ of Object.values(D)){let S=_.Type;P[S]=(P[S]||0)+1}let b=Object.entries(P).sort((_,S)=>S[1]-_[1]);for(let[_,S]of b)W(`  - ${_}: ${S}`);W(`
 Next steps:
   1. Review the generated templates in ${X}/
-  2. Run 'cloud deploy' to deploy your infrastructure`)}catch(Y){J.fail("Failed to generate templates"),K(Y instanceof Error?Y.message:"Unknown error")}}),G.command("generate:preview","Preview what will be generated").action(async()=>{V$("generate:preview",{message:"The legacy preview renderer has no stable output contract.",nextAction:"Run `cloud generate` into a temporary output directory and inspect the generated templates."})}),G.command("diff","Show diff between local config and deployed stack").alias("generate:diff").option("--stack <name>","Stack name to compare against").option("--env <environment>","Environment (production, staging, development)").action(async($)=>{R("Infrastructure Diff");try{let J=await x(),Y=$?.env||"production",{resolveProjectStackName:X}=await import("./chunk-p8q9bq9g.js"),Q=$?.stack||X(J,Y),Z=J.project.region||"us-east-1";W(`Stack: ${Q}`),W(`Region: ${Z}`),W(`Environment: ${Y}`),y("Generating template from configuration...");let z=new C0({config:J,environment:Y});z.generate();let F=z.toJSON(),U=JSON.parse(F);y("Fetching deployed template...");let M=new Y$(Z),H=null;try{let D=await M.getTemplate(Q);if(D.TemplateBody)H=JSON.parse(D.TemplateBody)}catch(D){if(D.message?.includes("does not exist")){N(`Stack "${Q}" does not exist yet`),W(`
+  2. Run 'cloud deploy' to deploy your infrastructure`)}catch(Y){J.fail("Failed to generate templates"),K(Y instanceof Error?Y.message:"Unknown error")}}),G.command("generate:preview","Preview what will be generated").action(async()=>{V$("generate:preview",{message:"The legacy preview renderer has no stable output contract.",nextAction:"Run `cloud generate` into a temporary output directory and inspect the generated templates."})}),G.command("diff","Show diff between local config and deployed stack").alias("generate:diff").option("--stack <name>","Stack name to compare against").option("--env <environment>","Environment (production, staging, development)").action(async($)=>{R("Infrastructure Diff");try{let J=await x(),Y=$?.env||"production",{resolveProjectStackName:X}=await import("./chunk-5n9fmabb.js"),Q=$?.stack||X(J,Y),Z=J.project.region||"us-east-1";W(`Stack: ${Q}`),W(`Region: ${Z}`),W(`Environment: ${Y}`),y("Generating template from configuration...");let z=new C0({config:J,environment:Y});z.generate();let F=z.toJSON(),U=JSON.parse(F);y("Fetching deployed template...");let M=new Y$(Z),H=null;try{let D=await M.getTemplate(Q);if(D.TemplateBody)H=JSON.parse(D.TemplateBody)}catch(D){if(D.message?.includes("does not exist")){N(`Stack "${Q}" does not exist yet`),W(`
 This will be a new deployment with the following resources:`);let P=Object.keys(U.Resources||{}).length;W(`
 Resources to create: ${P}`);let b={};for(let _ of Object.values(U.Resources||{})){let S=_.Type;b[S]=(b[S]||0)+1}for(let[_,S]of Object.entries(b).sort((I,g)=>g[1]-I[1]))W(`  + ${_}: ${S}`);W("\nRun `cloud deploy` to create this stack");return}throw D}y("Comparing templates...");let j=H.Resources||{},V=U.Resources||{},T=new Set(Object.keys(j)),A=new Set(Object.keys(V)),q=[];for(let D of A)if(!T.has(D))q.push(D);let O=[];for(let D of T)if(!A.has(D))O.push(D);let L=[];for(let D of A)if(T.has(D)){let P=JSON.stringify(j[D]),b=JSON.stringify(V[D]);if(P!==b)L.push(D)}if(q.length===0&&O.length===0&&L.length===0){B(`
 No changes detected - infrastructure is up to date`);return}if(W(`
 Changes detected:
-`),q.length>0){B(`Resources to add (${q.length}):`);for(let D of q){let P=V[D].Type;W(`  + ${D} (${P})`)}console.log()}if(O.length>0){K(`Resources to remove (${O.length}):`);for(let D of O){let P=j[D].Type;W(`  - ${D} (${P})`)}console.log()}if(L.length>0){N(`Resources to modify (${L.length}):`);for(let D of L){let P=V[D].Type;W(`  ~ ${D} (${P})`)}console.log()}W("Summary:"),W(`  - Add: ${q.length}`),W(`  - Remove: ${O.length}`),W(`  - Modify: ${L.length}`),W("\nRun `cloud deploy` to apply these changes")}catch(J){K(`Diff failed: ${J.message}`)}})}function K0(G,$=0){let J=Number(G);return Number.isFinite(J)?J:$}function h6(G){return K0(G)*1024}function zG(G){let $=G?.date?.trim(),J=G?.time?.trim();if(!$||!J)return null;let Y=new Date(`${$}T${J}Z`);return Number.isFinite(Y.getTime())?Y.toISOString():null}function FG(G,$,J){let Y;try{Y=JSON.parse(G)}catch{return[]}let X=(Y?.sysstat?.hosts??[]).flatMap((Z)=>Z.statistics??[]),Q=[];for(let Z of X){let z=zG(Z.timestamp);if(!z)continue;let F=new Date(z).getTime();if(F<$.getTime()||F>J.getTime())continue;let U=Z["cpu-load"]?.find((H)=>H.cpu==="all")??Z["cpu-load"]?.[0],M=K0(U?.idle,100);Q.push({timestamp:z,cpuUsedPercent:Math.max(0,Math.min(100,100-M)),cpuUserPercent:K0(U?.user),cpuSystemPercent:K0(U?.system),cpuIowaitPercent:K0(U?.iowait),memoryUsedPercent:K0(Z.memory?.["memused-percent"]),memoryUsedBytes:h6(Z.memory?.memused),memoryAvailableBytes:h6(Z.memory?.avail),swapUsedPercent:K0(Z.memory?.["swpused-percent"]),swapUsedBytes:h6(Z.memory?.swpused)})}return Q.sort((Z,z)=>Z.timestamp.localeCompare(z.timestamp))}function UG(G){return Object.fromEntries(Object.entries(G.time_series??{}).map(([$,J])=>[$,(J.values??[]).map(([Y,X])=>({timestamp:new Date(Number(Y)*1000).toISOString(),value:K0(X,Number.NaN)})).filter((Y)=>Number.isFinite(Y.value))]))}function C4(G){return G.length?G.reduce(($,J)=>$+J,0)/G.length:null}function y6(G){return G.length?Math.max(...G):null}function MG(G){return G.length?Math.min(...G):null}async function f4(G){let[$,J]=await Promise.all([G.client.getServerMetrics(G.serverId,{types:["cpu","disk","network"],start:G.from,end:G.to,step:G.step}),C6(G.remote.host,"LC_ALL=C sadf -j -- -u -r -S",G.remote).catch(()=>"")]),Y=FG(J,G.from,G.to),X=UG($),Z=(X.cpu??[]).map((H)=>Math.max(0,Math.min(100,H.value/Math.max(1,G.cores)))),z=Y.map((H)=>H.cpuUsedPercent),F=Z.length?Z:z,U=Y.map((H)=>H.memoryUsedPercent),M=Y.map((H)=>H.swapUsedPercent);return{from:G.from.toISOString(),to:G.to.toISOString(),cores:G.cores,host:Y,provider:X,summary:{cpuAveragePercent:C4(F),cpuPeakPercent:y6(F),memoryAveragePercent:C4(U),memoryPeakPercent:y6(U),memoryMinimumAvailableBytes:MG(Y.map((H)=>H.memoryAvailableBytes)),swapPeakPercent:y6(M)}}}async function HG(){let G=await x(),$=u(process.cwd(),G),J=new O0($.store),Y=new i4(J,[new _1("aws"),new _1("hetzner"),new _1("ssh")]);return{controlPlane:$,store:J,service:Y}}async function s$(G){let $=await HG();try{return await G($)}finally{$.controlPlane.store.close()}}var T0=(G,$)=>{let J=G.store.list(G.controlPlane.project.id).find((Y)=>Y.id===$||Y.name===$);if(!J)throw Error(`Server ${$} was not found.`);return J},A$=(G)=>{K(G instanceof Error?G.message:String(G)),process.exitCode=1};function m6(G,$){let J=Number.parseInt(G??"",10);return Number.isFinite(J)&&J>=0?J:$}function KG(G="3h"){let $=G.match(/^(\d+)(m|h)$/);if(!$)throw Error("--range must use minutes or hours, for example 30m or 3h.");let J=Number($[1])*($[2]==="h"?3600000:60000);if(J<300000||J>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return J}function e0(G,$="%"){return G==null?"unavailable":`${G.toFixed(1)}${$}`}async function jG(G,$){let J=await x();if(J.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let Y=$.env??process.env.CLOUD_ENV??"production",X=i$(J,Y),Q=await I1(X);if(!Q?.serverId)throw Error(`No pinned Hetzner server was found for ${X}.`);if(![Q.serverName,String(Q.serverId),Q.stackName].includes(G))throw Error(`Refusing to read ${G}: project state is pinned to ${Q.serverName}.`);let Z=b1(J),z=new o0({apiToken:$1(Z.apiToken,J)}),F=await z.getServer(Q.serverId),U=Q.publicIp??F.public_net.ipv4?.ip;if(!U)throw Error(`Server ${F.name} has no public IPv4 address.`);let M=new Date,H=new Date(M.getTime()-KG($.range)),j=Math.min(3600,Math.max(60,m6($.step,60))),V=await f4({client:z,serverId:F.id,cores:Math.max(1,Number(F.server_type.cores)||1),from:H,to:M,step:j,remote:{host:U,user:Q.sshUser??Z.sshUser,identityFile:Z.sshPrivateKeyPath,connectTimeoutSec:15}});if($.json){console.log(JSON.stringify({schemaVersion:1,server:F.name,result:V},null,2));return}w(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[F.name,`${V.from} to ${V.to}`,`${e0(V.summary.cpuAveragePercent)} / ${e0(V.summary.cpuPeakPercent)}`,`${e0(V.summary.memoryAveragePercent)} / ${e0(V.summary.memoryPeakPercent)}`,V.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(V.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,e0(V.summary.swapPeakPercent)]])}function t4(G){let $=G.targetType.prices?.find((J)=>J.location===G.location);return{serverId:G.serverId,serverName:G.serverName,location:G.location,from:G.currentType.name,to:G.targetType.name,capacityAvailable:G.capacityAvailable,alreadyComplete:G.alreadyComplete,upgradeDisk:G.upgradeDisk,target:{cores:G.targetType.cores,memoryGb:G.targetType.memory,diskGb:G.targetType.disk,architecture:G.targetType.architecture,cpuType:G.targetType.cpu_type},price:$?{hourlyNet:$.price_hourly.net,hourlyGross:$.price_hourly.gross,monthlyNet:$.price_monthly.net,monthlyGross:$.price_monthly.gross}:void 0}}function BG(G){let $=t4(G);w(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${$.serverName} (${$.serverId})`,$.location,`${$.from} -> ${$.to}`,$.capacityAvailable?"available":"waiting",`${$.target.cores??0} / ${$.target.memoryGb??0} GB / ${$.target.diskGb??0} GB`,$.price?.monthlyGross??$.price?.monthlyNet??"not reported"]])}async function VG(G,$,J){let Y=await x();if(Y.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let X=J.env??process.env.CLOUD_ENV??"production",Q=i$(Y,X),Z=await I1(Q),z=b1(Y),F=new o0({apiToken:$1(z.apiToken,Y)}),M=Z&&(G===Z.serverName||G===String(Z.serverId)||G===Z.stackName)?await F.getServer(Z.serverId):(await F.listServers()).find((_)=>_.name===G||String(_.id)===G);if(!M)throw Error(`Hetzner server ${G} was not found.`);if(Z?.serverId&&Z.serverId!==M.id)throw Error(`Refusing to resize ${G}: project state is pinned to server ${Z.serverId}.`);let H=l4($),j=J.upgradeDisk!==!1,V=await g6(F,M.id,H,j);if(J.json)console.log(JSON.stringify({schemaVersion:1,plan:t4(V)},null,2));else BG(V);if(!J.apply){if(!J.json)W(`Preview only. Re-run with --apply --confirm ${M.name} to execute.`);return}if(J.confirm!==M.name)throw Error(`Resize requires --confirm ${M.name}.`);let T=Z?.publicIp??M.public_net.ipv4?.ip;if(!T)throw Error(`Server ${M.name} has no public IPv4 address for verification.`);let A={host:T,user:Z?.sshUser??z.sshUser,identityFile:z.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},q=await n4(Q),O=new Date().toISOString(),L={schemaVersion:1,operationId:q?.targetType===H&&q.serverId===M.id?q.operationId:crypto.randomUUID(),stackName:Q,serverId:M.id,serverName:M.name,sourceType:V.currentType.name,targetType:H,upgradeDisk:j,phase:"planning",status:"running",attempts:q?.targetType===H?q.attempts:0,startedAt:q?.targetType===H?q.startedAt:O,updatedAt:O,manifest:q?.targetType===H?q.manifest:void 0};await j0(L);let D=m6(J.pollSeconds,900)*1000,P=m6(J.maxWaitMinutes,0)*60000,b=Date.now();for(;;){let _=await g6(F,M.id,H,j);if(!_.capacityAvailable&&!_.alreadyComplete){if(L={...L,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await j0(L),!J.wait){if(!J.json)W(`${H} has no capacity in ${_.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(P>0&&Date.now()-b>=P)throw Error(`Timed out waiting for ${H} capacity in ${_.location}.`);if(!J.json)W(`Waiting ${Math.round(D/1000)} seconds for ${H} capacity...`);await Bun.sleep(D);continue}let S=await s4(Q);try{let I=await(async()=>{try{return L={...L,status:"running",attempts:L.attempts+1,updatedAt:new Date().toISOString()},await j0(L),await r4({client:F,serverId:M.id,targetType:H,upgradeDisk:j,resumeFromOff:L.phase==="shutting-down"||L.phase==="resizing"||L.phase==="powering-on"||L.phase==="verifying",manifest:L.manifest,hooks:{preflight:async()=>{let g=await a4(A);return L={...L,manifest:g,updatedAt:new Date().toISOString()},await j0(L),g},afterBoot:async(g,f,d,r)=>p4(A,f,d,r),onPhase:async(g,f)=>{if(L={...L,phase:g,status:g==="waiting-capacity"?"waiting-capacity":g==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await j0(L),!J.json)W(`${g}${f?` ${JSON.stringify(f)}`:""}`)}}})}finally{await S()}})();if(L={...L,status:I.status==="completed"||I.status==="already-complete"?"completed":I.status==="recovered"?"recovered":"waiting-capacity",lastError:I.status==="recovered"?I.error:void 0,updatedAt:new Date().toISOString()},await j0(L),J.json)console.log(JSON.stringify({schemaVersion:1,result:I},null,2));else if(I.status==="completed"||I.status==="already-complete")B(`${M.name} is on ${H} and passed full post-boot verification.`);else if(I.status==="recovered"&&I.retryable&&J.wait){W(`Capacity race recovered safely. Waiting ${Math.round(D/1000)} seconds before retry.`),await Bun.sleep(D);continue}else if(I.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${I.error}`);return}catch(I){throw L={...L,status:"failed",lastError:I instanceof Error?I.message:String(I),updatedAt:new Date().toISOString()},await j0(L),I}}}async function AG(G,$){let J=await x();if(J.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let Y=$.env??process.env.CLOUD_ENV??"production",X=i$(J,Y),Q=await I1(X);if(!Q?.serverId)throw Error(`No pinned Hetzner server was found for ${X}.`);if(![Q.serverName,String(Q.serverId),Q.stackName].includes(G))throw Error(`Refusing to optimize ${G}: project state is pinned to ${Q.serverName}.`);let Z=b1(J),z=new o0({apiToken:$1(Z.apiToken,J)}),F=await z.getServer(Q.serverId),U=Q.publicIp??F.public_net.ipv4?.ip;if(!U)throw Error(`Server ${F.name} has no public IPv4 address.`);let M=m4(J);if($.json)console.log(JSON.stringify({schemaVersion:1,server:F.name,plan:M},null,2));else w(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[F.name,M.firewallPorts.join(","),M.monitoring?"on":"off",M.autoUpdates?"on":"off",`${M.swapGb} GB`,"disabled"]]);if(!$.apply){if(!$.json)W(`Preview only. Re-run with --apply --confirm ${F.name} to execute.`);return}if($.confirm!==F.name)throw Error(`Optimization requires --confirm ${F.name}.`);let H={host:U,user:Q.sshUser??Z.sshUser,identityFile:Z.sshPrivateKeyPath,connectTimeoutSec:15},j=await v6(H),V=j.routeProbes.filter((d)=>!d.ok),T=J.infrastructure?.compute,A=f6(T)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,q=j.failedUnits.filter((d)=>!A.has(d));if(q.length>0)throw Error(`Preflight found failed services: ${q.join(", ")}`);if(V.length>0)throw Error(`Preflight found unhealthy routes: ${V.map((d)=>d.domain).join(", ")}`);let O=f6(T)?[]:Object.values(J.sites??{}).flatMap((d)=>typeof d?.port==="number"&&![80,443].includes(d.port)?[d.port]:[]),L=g4({allowSsh:T?.allowSsh!==!1,sitePorts:O,allowedPorts:T?.firewall?.allowedPorts}),D=(Q.firewallId?(await z.listFirewalls()).find((d)=>d.id===Q.firewallId):void 0)??(await z.listFirewalls()).find((d)=>d.name===`${J.project.slug}-${Y}-app-fw`);if(!D)throw Error(`Managed firewall for ${F.name} was not found.`);let P=await z.setFirewallRules(D.id,L);await Promise.all(P.map((d)=>z.waitForAction(d.id))),await d4(J,H);let[b,_]=await Promise.all([v6(H),c4(H)]),S=u4(M,_),I=v4(j,b),g=b.routeProbes.filter((d)=>!d.ok);if(I.stoppedServices.length>0)S.push(`services stopped: ${I.stoppedServices.join(", ")}`);if(I.changedRouteFragments.length>0)S.push(`route fragments changed: ${I.changedRouteFragments.join(", ")}`);if(I.missingRouteIds.length>0)S.push(`routes disappeared: ${I.missingRouteIds.join(", ")}`);if(I.changedReleaseLinks.length>0)S.push(`release links changed: ${I.changedReleaseLinks.join(", ")}`);if(I.missingData.length>0)S.push(`databases or volumes disappeared: ${I.missingData.join(", ")}`);if(g.length>0)S.push(`unhealthy routes: ${g.map((d)=>d.domain).join(", ")}`);if(S.length>0)throw Error(`Host optimization verification failed: ${S.join("; ")}`);let f={serverId:F.id,serverName:F.name,services:b.runningServices.length,routes:b.routeIds.length,healthyDomains:b.routeProbes.length,releaseLinks:b.releaseLinks.length,databasesAndVolumes:b.dataCatalog.length,report:_};if($.json)console.log(JSON.stringify({schemaVersion:1,result:f},null,2));else B(`${F.name} passed full host, rpx route, service, release, and data verification.`)}function d6(G){G.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async($,J)=>{try{await s$(async(Y)=>{let X=$?[T0(Y,$)]:Y.store.list(Y.controlPlane.project.id),Q=X.flatMap((Z)=>Object.entries(Z.capabilities).map(([z,F])=>({server:Z.name,provider:Z.provider,action:z,...F})));if(J.json)console.log(JSON.stringify({schemaVersion:1,targets:Q},null,2));else w(["Server","Provider","Action","Support","Explanation"],Q.map((Z)=>[Z.server,Z.provider,Z.action,Z.supported?"supported":"unsupported",Z.reason??"—"]))})}catch(Y){A$(Y)}}),G.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async($,J,Y)=>{try{await VG($,J,Y)}catch(X){A$(X)}}),G.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async($,J)=>{try{await AG($,J)}catch(Y){A$(Y)}}),G.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async($,J)=>{try{await jG($,J)}catch(Y){A$(Y)}}),G.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async($)=>{try{await s$(async(J)=>{let Y=J.store.list(J.controlPlane.project.id);if($.json)console.log(JSON.stringify(Y,null,2));else w(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],Y.map((X)=>[X.name,X.providerId??"—",`${X.provider} / ${X.region??"external"}`,`${X.status} / ${X.trustState}`,X.roles.join(","),`${X.capacity.cpu??0} / ${X.capacity.memoryBytes??0}`,X.heartbeatAt??"never"]))})}catch(J){A$(J)}}),G.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async($,J)=>{try{await s$(async(Y)=>{let X=J.provider;if(!["aws","hetzner","ssh"].includes(X)||!J.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let Q=Y.service.enroll({organizationId:Y.controlPlane.organization.id,projectId:Y.controlPlane.project.id,name:$,provider:X,providerId:J.providerId,endpoint:J.endpoint,sshUser:J.user??"deploy",credentialRef:J.credentialRef??"secret://fleet/agent",region:J.region,roles:String(J.roles??"application").split(","),labels:Object.fromEntries(String(J.labels??"").split(",").map((Z)=>Z.split("=")).filter((Z)=>Z[0]&&Z[1]))});B(`Enrolled ${Q.name} as ${Q.id}; no remote mutation was performed.`)})}catch(Y){A$(Y)}}),G.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async($,J)=>{try{await s$(async(Y)=>{let X=T0(Y,$);if(X=await Y.service.test(X.id),X.trustState==="rotation_pending"){if(!J.acceptHostKey)throw Error(`Host key changed to ${X.pendingHostKey}; review it first.`);X=Y.service.reviewHostKey(X.id,J.acceptHostKey)}let Q=await Y.service.validate(X.id);if(J.json)console.log(JSON.stringify(Q.validation,null,2));else w(["Severity","Code","Finding","Remediation"],(Q.validation?.findings??[]).map((Z)=>[Z.severity,Z.code,Z.message,Z.remediation??"—"]));if(!Q.validation?.valid)process.exitCode=1})}catch(Y){A$(Y)}}),G.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async($,J)=>{try{await s$(async(Y)=>{let X=Y.service.bootstrap(T0(Y,$).id,!!J.apply);if(X.preview)w(["Step"],X.steps.map((Q)=>[Q]));else B(`Bootstrap queued: ${X.operation?.id}`)})}catch(Y){A$(Y)}}),G.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async($,J)=>{try{await s$(async(Y)=>B(Y.service.drain(T0(Y,$).id,!!J.complete).status))}catch(Y){A$(Y)}}),G.command("server:uncordon <name>","Return a server to scheduling").action(async($)=>{try{await s$(async(J)=>{J.service.uncordon(T0(J,$).id),B(`Uncordoned ${$}.`)})}catch(J){A$(J)}}),G.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async($,J)=>{try{await s$(async(Y)=>{Y.service.archive(T0(Y,$).id,J.confirm??""),B(`Archived ${$}; provider infrastructure was not terminated.`)})}catch(Y){A$(Y)}}),G.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async($)=>{try{await s$(async(J)=>{let Y=T0(J,$);if(Y.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let X=Bun.spawn(["ssh","-p",String(Y.sshPort),"-o","StrictHostKeyChecking=yes",`${Y.sshUser}@${Y.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),Q=await X.exited;if(Q)process.exitCode=Q})}catch(J){A$(J)}});for(let[$,J]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])G.command($,J).action(async(...Y)=>V$($.split(" ")[0],{target:String(Y[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}async function qG(){let G=await x(),$=u(process.cwd(),G),J=new o4($.store),Y=new $9(J,new O0($.store));return{controlPlane:$,store:J,service:Y}}async function J1(G){let $=await qG();try{await G($)}catch(J){K(J instanceof Error?J.message:String(J)),process.exitCode=1}finally{$.controlPlane.store.close()}}var k1=(G)=>Object.fromEntries(String(G??"").split(",").map(($)=>$.split("=")).filter(($)=>$[0]&&$[1])),e4=(G)=>Object.fromEntries(Object.entries(k1(G)).map(([$,J])=>[$,Number(J)]));function c6(G){G.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async($)=>J1((J)=>{let Y=J.store.listPools(J.controlPlane.project.id);if($.json)console.log(JSON.stringify(Y,null,2));else w(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],Y.map((X)=>[X.name,X.purpose,X.backend,`${X.region??"any"} / ${X.architecture??"any"}`,X.status,JSON.stringify(X.capacity),String(X.concurrency)]))})),G.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async($,J)=>J1((Y)=>{let{purpose:X,backend:Q}=J;if(!["application","build","worker","monitoring","backup"].includes(X)||!["server","ecs","asg"].includes(Q))throw Error("Unsupported pool purpose or backend.");let Z=Y.store.createPool({organizationId:Y.controlPlane.organization.id,projectId:Y.controlPlane.project.id,name:$,purpose:X,backend:Q,region:J.region,architecture:J.arch,labels:k1(J.labels),requiredServerLabels:k1(J.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...e4(J.capacity)},maxWorkloads:Number(J.max),costWeight:1,concurrency:Number(J.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});B(`Created ${Z.name} (${Z.id}).`)})),G.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async($,J)=>J1((Y)=>{let X=Y.store.listPools(Y.controlPlane.project.id).find((Z)=>Z.id===$||Z.name===$),Q=new O0(Y.controlPlane.store).list(Y.controlPlane.project.id).find((Z)=>Z.id===J||Z.name===J);if(!X||!Q)throw Error("Pool or server was not found.");Y.store.addMember(X.id,Q.id),B(`Attached ${Q.name} to ${X.name}.`)})),G.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async($)=>J1((J)=>{let Y=J.service.explain(J.controlPlane.project.id,{purpose:$.purpose,resources:e4($.resources),region:$.region,architecture:$.arch,labels:k1($.labels)});if($.json)console.log(JSON.stringify(Y,null,2));else w(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],Y.map((X)=>[X.poolName,X.serverId??"provider-managed",X.eligible?"yes":"no",JSON.stringify(X.available),`${X.score.fit.toFixed(2)} / ${X.score.spread} / ${X.score.cost}`,X.reasons.join("; ")||"eligible"]))})),G.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async($)=>J1((J)=>{let Y=J.store.listPools(J.controlPlane.project.id).find((Q)=>Q.id===$||Q.name===$);if(!Y)throw Error("Pool was not found.");let X=J.service.drainPool(Y.id);B(`Draining ${Y.name}: moved ${X.moved.length}, blocked ${X.blocked.length} stateful placement(s).`)}))}async function RG(){let G=await x(),$=u(process.cwd(),G),J=new J9($.store),Y=new Y9(J);return{controlPlane:$,store:J,service:Y}}async function w0(G){let $=await RG();try{await G($)}catch(J){K(J instanceof Error?J.message:String(J)),process.exitCode=1}finally{$.controlPlane.store.close()}}var Y1=(G,$)=>{let J=G.store.list(G.controlPlane.project.id).find((Y)=>Y.id===$||Y.name===$);if(!J)throw Error("Regional topology was not found.");return J},LG=(G)=>G.split(",").map(($,J)=>{let[Y,X="aws"]=$.split(":");return{region:String(Y),provider:X,role:J===0?"primary":"secondary"}}),EG=(G)=>{let $=new Set(["s3","dynamodb","secrets"]),J=G.split(",").map((X)=>X.trim()),Y=J.find((X)=>!$.has(X));if(Y)throw Error(`Unsupported replication kind: ${Y}`);return J};function u6(G){G.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async($)=>w0((J)=>{let Y=J.store.list(J.controlPlane.project.id).map((X)=>({topology:X,targets:J.store.targets(X.id),channels:J.store.channels(X.id),route:J.store.route(X.id),executions:J.store.executions(X.id)}));if($.json)console.log(JSON.stringify(Y,null,2));else w(["Name","Hostname","Active","Status","Revision","Replication"],Y.map((X)=>[X.topology.name,X.topology.hostname,X.topology.activeRegion,X.topology.status,X.topology.revision??"—",`${X.channels.filter((Q)=>Q.status==="in_sync").length}/${X.channels.length} in sync`]))})),G.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async($,J)=>w0((Y)=>{if(!J.hostname||!J.regions)throw Error("--hostname and --regions are required.");let X=Y.service.create({organizationId:Y.controlPlane.organization.id,projectId:Y.controlPlane.project.id,name:$,hostname:J.hostname,regions:LG(J.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:EG(String(J.replicate)),maxLagSeconds:Number(J.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!J.cdn,wafEnabled:!!J.waf});B(`Created ${X.name} (${X.id}); run region:rollout with an immutable manifest.`)})),G.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async($,J,Y)=>w0((X)=>w(["Step"],X.service.plan(Y1(X,$).id,J,Y.target).map((Q)=>[Q])))),G.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async($,J,Y)=>w0(async(X)=>{let Q=Y.manifest?await Bun.file(Y.manifest).json():{},Z=X.service.enqueue({topologyId:Y1(X,$).id,kind:"rollout",revision:J,manifest:Q});B(`Regional rollout queued: ${Z.operation.id}`)})),G.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async($,J)=>w0((Y)=>{let X=Y.service.enqueue({topologyId:Y1(Y,$).id,kind:"failover",targetRegion:J});B(`Failover queued: ${X.operation.id}`)})),G.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async($,J)=>w0((Y)=>{let X=Y.service.enqueue({topologyId:Y1(Y,$).id,kind:"failback",targetRegion:J});B(`Failback queued: ${X.operation.id}`)})),G.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async($,J)=>w0((Y)=>{let X=Y.service.enqueue({topologyId:Y1(Y,$).id,kind:"destroy",confirmation:J.confirm});B(`Regional teardown queued: ${X.operation.id}; replicated data remains retained.`)}))}var G1="0.9.3";async function OG(){let G=await x(),$=u(process.cwd(),G),J=new G9($.store),Y=new X9(J),X=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((Q)=>new Q9(Q,$.store,$.project.id,$.organization.id));return{controlPlane:$,store:J,service:Y,cleanup:X}}async function t$(G){let $=await OG();try{await G($)}catch(J){K(J instanceof Error?J.message:String(J)),process.exitCode=1}finally{$.controlPlane.store.close()}}function l6(G){G.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async($)=>t$((J)=>{let Y={manifests:J.store.manifests(J.controlPlane.organization.id),windows:J.store.windows(J.controlPlane.project.id),campaigns:J.store.campaigns(J.controlPlane.project.id),cleanups:J.store.cleanups(J.controlPlane.project.id),drills:J.store.drills(J.controlPlane.project.id)},X=[...Y.manifests.map((Q)=>["update",Q.version,Q.compatibility.compatible?"compatible":"blocked",Q.compatibility.reasons.join("; ")||Q.channel]),...Y.campaigns.map((Q)=>["upgrade",Q.id,Q.status,Q.currentStage??Q.fromVersion]),...Y.cleanups.map((Q)=>["cleanup",Q.kind,Q.status,`${Q.candidates.length} items / ${Q.estimatedBytes} bytes`]),...Y.drills.map((Q)=>["DR drill",Q.scenario,Q.status,Q.isolatedTarget])];if($.json)console.log(JSON.stringify(Y,null,2));else w(["Area","Name / version","Status","Detail"],X)})),G.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async($,J)=>t$(async(Y)=>{let X=Y.store.addTrustedKey({organizationId:Y.controlPlane.organization.id,name:$,publicKeyPem:await Bun.file(J).text()});B(`Trusted ${X.name}: ${X.fingerprint}`)})),G.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async($,J,Y)=>t$(async(X)=>{let Q=await Bun.file($).json(),Z=(await Bun.file(J).text()).trim(),z=X.store.importManifest({organizationId:X.controlPlane.organization.id,keyId:Y,document:Q,signature:Z,current:{schemaVersion:X.controlPlane.store.health().schemaVersion,currentVersion:G1,platform:process.platform,architecture:process.arch}});B(`Verified ${z.version}; ${z.compatibility.compatible?"compatible":"blocked: "+z.compatibility.reasons.join("; ")}`)})),G.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async($,J,Y)=>t$((X)=>{let Q=X.store.createWindow({projectId:X.controlPlane.project.id,name:$,schedule:J,timezone:Y.timezone,durationMinutes:Number(Y.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});B(`Created ${Q.name} (${Q.id}).`)})),G.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async($,J,Y)=>t$((X)=>{let Q=new O0(X.controlPlane.store).list(X.controlPlane.project.id).filter((F)=>F.status==="ready").map((F)=>({serverId:F.id,target:F.name,previousVersion:F.bootstrapVersion??G1}));if(!Q.length)Q.push({target:"control-plane",previousVersion:G1});let Z=X.store.createCampaign({projectId:X.controlPlane.project.id,manifestId:$,fromVersion:G1,strategy:Y.strategy==="rolling"?"rolling":"canary",batchSize:Number(Y.batch),healthGate:{kind:"platform"},backupId:J,targets:Q}),z=X.service.enqueueCampaign(Z.id);B(`Staged upgrade queued: ${z.operation.id}`)})),G.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async($,J)=>t$(async(Y)=>{let X=await Y.service.previewCleanup({projectId:Y.controlPlane.project.id,kind:$,criteria:{olderThanDays:Number(J.olderThan)}},Y.cleanup);w(["ID","Candidate","Bytes"],X.candidates.map((Q)=>[Q.id,Q.label,String(Q.bytes)])),W(`Apply with: cloud cleanup:apply ${X.id} --confirm "DELETE ${X.candidates.length} ${X.kind}"`)})),G.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async($,J)=>t$((Y)=>{let X=Y.service.enqueueCleanup($,String(J.confirm??""));B(`Cleanup queued: ${X.operation.id}`)})),G.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async($,J,Y)=>t$((X)=>{let Q=X.store.createDrill({projectId:X.controlPlane.project.id,scenario:$,isolatedTarget:J,expectedRpoMinutes:Number(Y.rpo),expectedRtoMinutes:Number(Y.rto),recoveryPointId:Y.recoveryPoint,topologyId:Y.topology});B(`Planned isolated drill ${Q.id}.`)})),G.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async($)=>t$((J)=>{let Y=J.service.enqueueDrill($);B(`DR drill queued: ${Y.operation.id}`)}))}async function r6(){try{return(await x()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function a6(G){G.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async($)=>{R("Lambda Functions");let J=$?.region||await r6(),Y=new e$(J);try{let{Functions:X=[]}=await Y.listFunctions({MaxItems:50});if(!X.length){W("No functions found");return}w(["Name","Runtime","Memory","Timeout","Last Modified"],X.map((Q)=>[Q.FunctionName??"-",Q.Runtime??"-",Q.MemorySize?`${Q.MemorySize} MB`:"-",Q.Timeout?`${Q.Timeout}s`:"-",Q.LastModified??"-"]))}catch(X){K(`Failed to list functions: ${X.message}`),process.exitCode=1}}),G.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async($,J)=>{R(`Invoking ${$}`);let Y=J?.region||await r6(),X=new e$(Y),Q=new E("Invoking function...");Q.start();try{let Z=await X.invoke({FunctionName:$,InvocationType:J?.async?"Event":"RequestResponse",Payload:J?.payload||"{}",LogType:J?.async?"None":"Tail"});if(Z.FunctionError){if(Q.fail(`Function returned an error (${Z.FunctionError})`),Z.Payload)W(Z.Payload);process.exitCode=1;return}if(Q.succeed(`Invoked (status ${Z.StatusCode})`),Z.Payload)W(`
+`),q.length>0){B(`Resources to add (${q.length}):`);for(let D of q){let P=V[D].Type;W(`  + ${D} (${P})`)}console.log()}if(O.length>0){K(`Resources to remove (${O.length}):`);for(let D of O){let P=j[D].Type;W(`  - ${D} (${P})`)}console.log()}if(L.length>0){N(`Resources to modify (${L.length}):`);for(let D of L){let P=V[D].Type;W(`  ~ ${D} (${P})`)}console.log()}W("Summary:"),W(`  - Add: ${q.length}`),W(`  - Remove: ${O.length}`),W(`  - Modify: ${L.length}`),W("\nRun `cloud deploy` to apply these changes")}catch(J){K(`Diff failed: ${J.message}`)}})}function K0(G,$=0){let J=Number(G);return Number.isFinite(J)?J:$}function h6(G){return K0(G)*1024}function zG(G){let $=G?.date?.trim(),J=G?.time?.trim();if(!$||!J)return null;let Y=new Date(`${$}T${J}Z`);return Number.isFinite(Y.getTime())?Y.toISOString():null}function FG(G,$,J){let Y;try{Y=JSON.parse(G)}catch{return[]}let X=(Y?.sysstat?.hosts??[]).flatMap((Z)=>Z.statistics??[]),Q=[];for(let Z of X){let z=zG(Z.timestamp);if(!z)continue;let F=new Date(z).getTime();if(F<$.getTime()||F>J.getTime())continue;let U=Z["cpu-load"]?.find((H)=>H.cpu==="all")??Z["cpu-load"]?.[0],M=K0(U?.idle,100);Q.push({timestamp:z,cpuUsedPercent:Math.max(0,Math.min(100,100-M)),cpuUserPercent:K0(U?.user),cpuSystemPercent:K0(U?.system),cpuIowaitPercent:K0(U?.iowait),memoryUsedPercent:K0(Z.memory?.["memused-percent"]),memoryUsedBytes:h6(Z.memory?.memused),memoryAvailableBytes:h6(Z.memory?.avail),swapUsedPercent:K0(Z.memory?.["swpused-percent"]),swapUsedBytes:h6(Z.memory?.swpused)})}return Q.sort((Z,z)=>Z.timestamp.localeCompare(z.timestamp))}function UG(G){return Object.fromEntries(Object.entries(G.time_series??{}).map(([$,J])=>[$,(J.values??[]).map(([Y,X])=>({timestamp:new Date(Number(Y)*1000).toISOString(),value:K0(X,Number.NaN)})).filter((Y)=>Number.isFinite(Y.value))]))}function C4(G){return G.length?G.reduce(($,J)=>$+J,0)/G.length:null}function y6(G){return G.length?Math.max(...G):null}function MG(G){return G.length?Math.min(...G):null}async function f4(G){let[$,J]=await Promise.all([G.client.getServerMetrics(G.serverId,{types:["cpu","disk","network"],start:G.from,end:G.to,step:G.step}),C6(G.remote.host,"LC_ALL=C sadf -j -- -u -r -S",G.remote).catch(()=>"")]),Y=FG(J,G.from,G.to),X=UG($),Z=(X.cpu??[]).map((H)=>Math.max(0,Math.min(100,H.value/Math.max(1,G.cores)))),z=Y.map((H)=>H.cpuUsedPercent),F=Z.length?Z:z,U=Y.map((H)=>H.memoryUsedPercent),M=Y.map((H)=>H.swapUsedPercent);return{from:G.from.toISOString(),to:G.to.toISOString(),cores:G.cores,host:Y,provider:X,summary:{cpuAveragePercent:C4(F),cpuPeakPercent:y6(F),memoryAveragePercent:C4(U),memoryPeakPercent:y6(U),memoryMinimumAvailableBytes:MG(Y.map((H)=>H.memoryAvailableBytes)),swapPeakPercent:y6(M)}}}async function HG(){let G=await x(),$=u(process.cwd(),G),J=new O0($.store),Y=new i4(J,[new _1("aws"),new _1("hetzner"),new _1("ssh")]);return{controlPlane:$,store:J,service:Y}}async function s$(G){let $=await HG();try{return await G($)}finally{$.controlPlane.store.close()}}var T0=(G,$)=>{let J=G.store.list(G.controlPlane.project.id).find((Y)=>Y.id===$||Y.name===$);if(!J)throw Error(`Server ${$} was not found.`);return J},A$=(G)=>{K(G instanceof Error?G.message:String(G)),process.exitCode=1};function m6(G,$){let J=Number.parseInt(G??"",10);return Number.isFinite(J)&&J>=0?J:$}function KG(G="3h"){let $=G.match(/^(\d+)(m|h)$/);if(!$)throw Error("--range must use minutes or hours, for example 30m or 3h.");let J=Number($[1])*($[2]==="h"?3600000:60000);if(J<300000||J>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return J}function e0(G,$="%"){return G==null?"unavailable":`${G.toFixed(1)}${$}`}async function jG(G,$){let J=await x();if(J.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let Y=$.env??process.env.CLOUD_ENV??"production",X=i$(J,Y),Q=await I1(X);if(!Q?.serverId)throw Error(`No pinned Hetzner server was found for ${X}.`);if(![Q.serverName,String(Q.serverId),Q.stackName].includes(G))throw Error(`Refusing to read ${G}: project state is pinned to ${Q.serverName}.`);let Z=b1(J),z=new o0({apiToken:$1(Z.apiToken,J)}),F=await z.getServer(Q.serverId),U=Q.publicIp??F.public_net.ipv4?.ip;if(!U)throw Error(`Server ${F.name} has no public IPv4 address.`);let M=new Date,H=new Date(M.getTime()-KG($.range)),j=Math.min(3600,Math.max(60,m6($.step,60))),V=await f4({client:z,serverId:F.id,cores:Math.max(1,Number(F.server_type.cores)||1),from:H,to:M,step:j,remote:{host:U,user:Q.sshUser??Z.sshUser,identityFile:Z.sshPrivateKeyPath,connectTimeoutSec:15}});if($.json){console.log(JSON.stringify({schemaVersion:1,server:F.name,result:V},null,2));return}w(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[F.name,`${V.from} to ${V.to}`,`${e0(V.summary.cpuAveragePercent)} / ${e0(V.summary.cpuPeakPercent)}`,`${e0(V.summary.memoryAveragePercent)} / ${e0(V.summary.memoryPeakPercent)}`,V.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(V.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,e0(V.summary.swapPeakPercent)]])}function t4(G){let $=G.targetType.prices?.find((J)=>J.location===G.location);return{serverId:G.serverId,serverName:G.serverName,location:G.location,from:G.currentType.name,to:G.targetType.name,capacityAvailable:G.capacityAvailable,alreadyComplete:G.alreadyComplete,upgradeDisk:G.upgradeDisk,target:{cores:G.targetType.cores,memoryGb:G.targetType.memory,diskGb:G.targetType.disk,architecture:G.targetType.architecture,cpuType:G.targetType.cpu_type},price:$?{hourlyNet:$.price_hourly.net,hourlyGross:$.price_hourly.gross,monthlyNet:$.price_monthly.net,monthlyGross:$.price_monthly.gross}:void 0}}function BG(G){let $=t4(G);w(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${$.serverName} (${$.serverId})`,$.location,`${$.from} -> ${$.to}`,$.capacityAvailable?"available":"waiting",`${$.target.cores??0} / ${$.target.memoryGb??0} GB / ${$.target.diskGb??0} GB`,$.price?.monthlyGross??$.price?.monthlyNet??"not reported"]])}async function VG(G,$,J){let Y=await x();if(Y.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let X=J.env??process.env.CLOUD_ENV??"production",Q=i$(Y,X),Z=await I1(Q),z=b1(Y),F=new o0({apiToken:$1(z.apiToken,Y)}),M=Z&&(G===Z.serverName||G===String(Z.serverId)||G===Z.stackName)?await F.getServer(Z.serverId):(await F.listServers()).find((_)=>_.name===G||String(_.id)===G);if(!M)throw Error(`Hetzner server ${G} was not found.`);if(Z?.serverId&&Z.serverId!==M.id)throw Error(`Refusing to resize ${G}: project state is pinned to server ${Z.serverId}.`);let H=l4($),j=J.upgradeDisk!==!1,V=await g6(F,M.id,H,j);if(J.json)console.log(JSON.stringify({schemaVersion:1,plan:t4(V)},null,2));else BG(V);if(!J.apply){if(!J.json)W(`Preview only. Re-run with --apply --confirm ${M.name} to execute.`);return}if(J.confirm!==M.name)throw Error(`Resize requires --confirm ${M.name}.`);let T=Z?.publicIp??M.public_net.ipv4?.ip;if(!T)throw Error(`Server ${M.name} has no public IPv4 address for verification.`);let A={host:T,user:Z?.sshUser??z.sshUser,identityFile:z.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},q=await n4(Q),O=new Date().toISOString(),L={schemaVersion:1,operationId:q?.targetType===H&&q.serverId===M.id?q.operationId:crypto.randomUUID(),stackName:Q,serverId:M.id,serverName:M.name,sourceType:V.currentType.name,targetType:H,upgradeDisk:j,phase:"planning",status:"running",attempts:q?.targetType===H?q.attempts:0,startedAt:q?.targetType===H?q.startedAt:O,updatedAt:O,manifest:q?.targetType===H?q.manifest:void 0};await j0(L);let D=m6(J.pollSeconds,900)*1000,P=m6(J.maxWaitMinutes,0)*60000,b=Date.now();for(;;){let _=await g6(F,M.id,H,j);if(!_.capacityAvailable&&!_.alreadyComplete){if(L={...L,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await j0(L),!J.wait){if(!J.json)W(`${H} has no capacity in ${_.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(P>0&&Date.now()-b>=P)throw Error(`Timed out waiting for ${H} capacity in ${_.location}.`);if(!J.json)W(`Waiting ${Math.round(D/1000)} seconds for ${H} capacity...`);await Bun.sleep(D);continue}let S=await s4(Q);try{let I=await(async()=>{try{return L={...L,status:"running",attempts:L.attempts+1,updatedAt:new Date().toISOString()},await j0(L),await r4({client:F,serverId:M.id,targetType:H,upgradeDisk:j,resumeFromOff:L.phase==="shutting-down"||L.phase==="resizing"||L.phase==="powering-on"||L.phase==="verifying",manifest:L.manifest,hooks:{preflight:async()=>{let g=await a4(A);return L={...L,manifest:g,updatedAt:new Date().toISOString()},await j0(L),g},afterBoot:async(g,f,d,r)=>p4(A,f,d,r),onPhase:async(g,f)=>{if(L={...L,phase:g,status:g==="waiting-capacity"?"waiting-capacity":g==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await j0(L),!J.json)W(`${g}${f?` ${JSON.stringify(f)}`:""}`)}}})}finally{await S()}})();if(L={...L,status:I.status==="completed"||I.status==="already-complete"?"completed":I.status==="recovered"?"recovered":"waiting-capacity",lastError:I.status==="recovered"?I.error:void 0,updatedAt:new Date().toISOString()},await j0(L),J.json)console.log(JSON.stringify({schemaVersion:1,result:I},null,2));else if(I.status==="completed"||I.status==="already-complete")B(`${M.name} is on ${H} and passed full post-boot verification.`);else if(I.status==="recovered"&&I.retryable&&J.wait){W(`Capacity race recovered safely. Waiting ${Math.round(D/1000)} seconds before retry.`),await Bun.sleep(D);continue}else if(I.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${I.error}`);return}catch(I){throw L={...L,status:"failed",lastError:I instanceof Error?I.message:String(I),updatedAt:new Date().toISOString()},await j0(L),I}}}async function AG(G,$){let J=await x();if(J.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let Y=$.env??process.env.CLOUD_ENV??"production",X=i$(J,Y),Q=await I1(X);if(!Q?.serverId)throw Error(`No pinned Hetzner server was found for ${X}.`);if(![Q.serverName,String(Q.serverId),Q.stackName].includes(G))throw Error(`Refusing to optimize ${G}: project state is pinned to ${Q.serverName}.`);let Z=b1(J),z=new o0({apiToken:$1(Z.apiToken,J)}),F=await z.getServer(Q.serverId),U=Q.publicIp??F.public_net.ipv4?.ip;if(!U)throw Error(`Server ${F.name} has no public IPv4 address.`);let M=m4(J);if($.json)console.log(JSON.stringify({schemaVersion:1,server:F.name,plan:M},null,2));else w(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[F.name,M.firewallPorts.join(","),M.monitoring?"on":"off",M.autoUpdates?"on":"off",`${M.swapGb} GB`,"disabled"]]);if(!$.apply){if(!$.json)W(`Preview only. Re-run with --apply --confirm ${F.name} to execute.`);return}if($.confirm!==F.name)throw Error(`Optimization requires --confirm ${F.name}.`);let H={host:U,user:Q.sshUser??Z.sshUser,identityFile:Z.sshPrivateKeyPath,connectTimeoutSec:15},j=await v6(H),V=j.routeProbes.filter((d)=>!d.ok),T=J.infrastructure?.compute,A=f6(T)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,q=j.failedUnits.filter((d)=>!A.has(d));if(q.length>0)throw Error(`Preflight found failed services: ${q.join(", ")}`);if(V.length>0)throw Error(`Preflight found unhealthy routes: ${V.map((d)=>d.domain).join(", ")}`);let O=f6(T)?[]:Object.values(J.sites??{}).flatMap((d)=>typeof d?.port==="number"&&![80,443].includes(d.port)?[d.port]:[]),L=g4({allowSsh:T?.allowSsh!==!1,sitePorts:O,allowedPorts:T?.firewall?.allowedPorts}),D=(Q.firewallId?(await z.listFirewalls()).find((d)=>d.id===Q.firewallId):void 0)??(await z.listFirewalls()).find((d)=>d.name===`${J.project.slug}-${Y}-app-fw`);if(!D)throw Error(`Managed firewall for ${F.name} was not found.`);let P=await z.setFirewallRules(D.id,L);await Promise.all(P.map((d)=>z.waitForAction(d.id))),await d4(J,H);let[b,_]=await Promise.all([v6(H),c4(H)]),S=u4(M,_),I=v4(j,b),g=b.routeProbes.filter((d)=>!d.ok);if(I.stoppedServices.length>0)S.push(`services stopped: ${I.stoppedServices.join(", ")}`);if(I.changedRouteFragments.length>0)S.push(`route fragments changed: ${I.changedRouteFragments.join(", ")}`);if(I.missingRouteIds.length>0)S.push(`routes disappeared: ${I.missingRouteIds.join(", ")}`);if(I.changedReleaseLinks.length>0)S.push(`release links changed: ${I.changedReleaseLinks.join(", ")}`);if(I.missingData.length>0)S.push(`databases or volumes disappeared: ${I.missingData.join(", ")}`);if(g.length>0)S.push(`unhealthy routes: ${g.map((d)=>d.domain).join(", ")}`);if(S.length>0)throw Error(`Host optimization verification failed: ${S.join("; ")}`);let f={serverId:F.id,serverName:F.name,services:b.runningServices.length,routes:b.routeIds.length,healthyDomains:b.routeProbes.length,releaseLinks:b.releaseLinks.length,databasesAndVolumes:b.dataCatalog.length,report:_};if($.json)console.log(JSON.stringify({schemaVersion:1,result:f},null,2));else B(`${F.name} passed full host, rpx route, service, release, and data verification.`)}function d6(G){G.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async($,J)=>{try{await s$(async(Y)=>{let X=$?[T0(Y,$)]:Y.store.list(Y.controlPlane.project.id),Q=X.flatMap((Z)=>Object.entries(Z.capabilities).map(([z,F])=>({server:Z.name,provider:Z.provider,action:z,...F})));if(J.json)console.log(JSON.stringify({schemaVersion:1,targets:Q},null,2));else w(["Server","Provider","Action","Support","Explanation"],Q.map((Z)=>[Z.server,Z.provider,Z.action,Z.supported?"supported":"unsupported",Z.reason??"—"]))})}catch(Y){A$(Y)}}),G.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async($,J,Y)=>{try{await VG($,J,Y)}catch(X){A$(X)}}),G.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async($,J)=>{try{await AG($,J)}catch(Y){A$(Y)}}),G.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async($,J)=>{try{await jG($,J)}catch(Y){A$(Y)}}),G.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async($)=>{try{await s$(async(J)=>{let Y=J.store.list(J.controlPlane.project.id);if($.json)console.log(JSON.stringify(Y,null,2));else w(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],Y.map((X)=>[X.name,X.providerId??"—",`${X.provider} / ${X.region??"external"}`,`${X.status} / ${X.trustState}`,X.roles.join(","),`${X.capacity.cpu??0} / ${X.capacity.memoryBytes??0}`,X.heartbeatAt??"never"]))})}catch(J){A$(J)}}),G.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async($,J)=>{try{await s$(async(Y)=>{let X=J.provider;if(!["aws","hetzner","ssh"].includes(X)||!J.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let Q=Y.service.enroll({organizationId:Y.controlPlane.organization.id,projectId:Y.controlPlane.project.id,name:$,provider:X,providerId:J.providerId,endpoint:J.endpoint,sshUser:J.user??"deploy",credentialRef:J.credentialRef??"secret://fleet/agent",region:J.region,roles:String(J.roles??"application").split(","),labels:Object.fromEntries(String(J.labels??"").split(",").map((Z)=>Z.split("=")).filter((Z)=>Z[0]&&Z[1]))});B(`Enrolled ${Q.name} as ${Q.id}; no remote mutation was performed.`)})}catch(Y){A$(Y)}}),G.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async($,J)=>{try{await s$(async(Y)=>{let X=T0(Y,$);if(X=await Y.service.test(X.id),X.trustState==="rotation_pending"){if(!J.acceptHostKey)throw Error(`Host key changed to ${X.pendingHostKey}; review it first.`);X=Y.service.reviewHostKey(X.id,J.acceptHostKey)}let Q=await Y.service.validate(X.id);if(J.json)console.log(JSON.stringify(Q.validation,null,2));else w(["Severity","Code","Finding","Remediation"],(Q.validation?.findings??[]).map((Z)=>[Z.severity,Z.code,Z.message,Z.remediation??"—"]));if(!Q.validation?.valid)process.exitCode=1})}catch(Y){A$(Y)}}),G.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async($,J)=>{try{await s$(async(Y)=>{let X=Y.service.bootstrap(T0(Y,$).id,!!J.apply);if(X.preview)w(["Step"],X.steps.map((Q)=>[Q]));else B(`Bootstrap queued: ${X.operation?.id}`)})}catch(Y){A$(Y)}}),G.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async($,J)=>{try{await s$(async(Y)=>B(Y.service.drain(T0(Y,$).id,!!J.complete).status))}catch(Y){A$(Y)}}),G.command("server:uncordon <name>","Return a server to scheduling").action(async($)=>{try{await s$(async(J)=>{J.service.uncordon(T0(J,$).id),B(`Uncordoned ${$}.`)})}catch(J){A$(J)}}),G.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async($,J)=>{try{await s$(async(Y)=>{Y.service.archive(T0(Y,$).id,J.confirm??""),B(`Archived ${$}; provider infrastructure was not terminated.`)})}catch(Y){A$(Y)}}),G.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async($)=>{try{await s$(async(J)=>{let Y=T0(J,$);if(Y.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let X=Bun.spawn(["ssh","-p",String(Y.sshPort),"-o","StrictHostKeyChecking=yes",`${Y.sshUser}@${Y.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),Q=await X.exited;if(Q)process.exitCode=Q})}catch(J){A$(J)}});for(let[$,J]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])G.command($,J).action(async(...Y)=>V$($.split(" ")[0],{target:String(Y[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}async function qG(){let G=await x(),$=u(process.cwd(),G),J=new o4($.store),Y=new $9(J,new O0($.store));return{controlPlane:$,store:J,service:Y}}async function J1(G){let $=await qG();try{await G($)}catch(J){K(J instanceof Error?J.message:String(J)),process.exitCode=1}finally{$.controlPlane.store.close()}}var k1=(G)=>Object.fromEntries(String(G??"").split(",").map(($)=>$.split("=")).filter(($)=>$[0]&&$[1])),e4=(G)=>Object.fromEntries(Object.entries(k1(G)).map(([$,J])=>[$,Number(J)]));function c6(G){G.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async($)=>J1((J)=>{let Y=J.store.listPools(J.controlPlane.project.id);if($.json)console.log(JSON.stringify(Y,null,2));else w(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],Y.map((X)=>[X.name,X.purpose,X.backend,`${X.region??"any"} / ${X.architecture??"any"}`,X.status,JSON.stringify(X.capacity),String(X.concurrency)]))})),G.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async($,J)=>J1((Y)=>{let{purpose:X,backend:Q}=J;if(!["application","build","worker","monitoring","backup"].includes(X)||!["server","ecs","asg"].includes(Q))throw Error("Unsupported pool purpose or backend.");let Z=Y.store.createPool({organizationId:Y.controlPlane.organization.id,projectId:Y.controlPlane.project.id,name:$,purpose:X,backend:Q,region:J.region,architecture:J.arch,labels:k1(J.labels),requiredServerLabels:k1(J.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...e4(J.capacity)},maxWorkloads:Number(J.max),costWeight:1,concurrency:Number(J.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});B(`Created ${Z.name} (${Z.id}).`)})),G.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async($,J)=>J1((Y)=>{let X=Y.store.listPools(Y.controlPlane.project.id).find((Z)=>Z.id===$||Z.name===$),Q=new O0(Y.controlPlane.store).list(Y.controlPlane.project.id).find((Z)=>Z.id===J||Z.name===J);if(!X||!Q)throw Error("Pool or server was not found.");Y.store.addMember(X.id,Q.id),B(`Attached ${Q.name} to ${X.name}.`)})),G.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async($)=>J1((J)=>{let Y=J.service.explain(J.controlPlane.project.id,{purpose:$.purpose,resources:e4($.resources),region:$.region,architecture:$.arch,labels:k1($.labels)});if($.json)console.log(JSON.stringify(Y,null,2));else w(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],Y.map((X)=>[X.poolName,X.serverId??"provider-managed",X.eligible?"yes":"no",JSON.stringify(X.available),`${X.score.fit.toFixed(2)} / ${X.score.spread} / ${X.score.cost}`,X.reasons.join("; ")||"eligible"]))})),G.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async($)=>J1((J)=>{let Y=J.store.listPools(J.controlPlane.project.id).find((Q)=>Q.id===$||Q.name===$);if(!Y)throw Error("Pool was not found.");let X=J.service.drainPool(Y.id);B(`Draining ${Y.name}: moved ${X.moved.length}, blocked ${X.blocked.length} stateful placement(s).`)}))}async function RG(){let G=await x(),$=u(process.cwd(),G),J=new J9($.store),Y=new Y9(J);return{controlPlane:$,store:J,service:Y}}async function w0(G){let $=await RG();try{await G($)}catch(J){K(J instanceof Error?J.message:String(J)),process.exitCode=1}finally{$.controlPlane.store.close()}}var Y1=(G,$)=>{let J=G.store.list(G.controlPlane.project.id).find((Y)=>Y.id===$||Y.name===$);if(!J)throw Error("Regional topology was not found.");return J},LG=(G)=>G.split(",").map(($,J)=>{let[Y,X="aws"]=$.split(":");return{region:String(Y),provider:X,role:J===0?"primary":"secondary"}}),EG=(G)=>{let $=new Set(["s3","dynamodb","secrets"]),J=G.split(",").map((X)=>X.trim()),Y=J.find((X)=>!$.has(X));if(Y)throw Error(`Unsupported replication kind: ${Y}`);return J};function u6(G){G.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async($)=>w0((J)=>{let Y=J.store.list(J.controlPlane.project.id).map((X)=>({topology:X,targets:J.store.targets(X.id),channels:J.store.channels(X.id),route:J.store.route(X.id),executions:J.store.executions(X.id)}));if($.json)console.log(JSON.stringify(Y,null,2));else w(["Name","Hostname","Active","Status","Revision","Replication"],Y.map((X)=>[X.topology.name,X.topology.hostname,X.topology.activeRegion,X.topology.status,X.topology.revision??"—",`${X.channels.filter((Q)=>Q.status==="in_sync").length}/${X.channels.length} in sync`]))})),G.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async($,J)=>w0((Y)=>{if(!J.hostname||!J.regions)throw Error("--hostname and --regions are required.");let X=Y.service.create({organizationId:Y.controlPlane.organization.id,projectId:Y.controlPlane.project.id,name:$,hostname:J.hostname,regions:LG(J.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:EG(String(J.replicate)),maxLagSeconds:Number(J.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!J.cdn,wafEnabled:!!J.waf});B(`Created ${X.name} (${X.id}); run region:rollout with an immutable manifest.`)})),G.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async($,J,Y)=>w0((X)=>w(["Step"],X.service.plan(Y1(X,$).id,J,Y.target).map((Q)=>[Q])))),G.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async($,J,Y)=>w0(async(X)=>{let Q=Y.manifest?await Bun.file(Y.manifest).json():{},Z=X.service.enqueue({topologyId:Y1(X,$).id,kind:"rollout",revision:J,manifest:Q});B(`Regional rollout queued: ${Z.operation.id}`)})),G.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async($,J)=>w0((Y)=>{let X=Y.service.enqueue({topologyId:Y1(Y,$).id,kind:"failover",targetRegion:J});B(`Failover queued: ${X.operation.id}`)})),G.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async($,J)=>w0((Y)=>{let X=Y.service.enqueue({topologyId:Y1(Y,$).id,kind:"failback",targetRegion:J});B(`Failback queued: ${X.operation.id}`)})),G.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async($,J)=>w0((Y)=>{let X=Y.service.enqueue({topologyId:Y1(Y,$).id,kind:"destroy",confirmation:J.confirm});B(`Regional teardown queued: ${X.operation.id}; replicated data remains retained.`)}))}var G1="0.9.4";async function OG(){let G=await x(),$=u(process.cwd(),G),J=new G9($.store),Y=new X9(J),X=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((Q)=>new Q9(Q,$.store,$.project.id,$.organization.id));return{controlPlane:$,store:J,service:Y,cleanup:X}}async function t$(G){let $=await OG();try{await G($)}catch(J){K(J instanceof Error?J.message:String(J)),process.exitCode=1}finally{$.controlPlane.store.close()}}function l6(G){G.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async($)=>t$((J)=>{let Y={manifests:J.store.manifests(J.controlPlane.organization.id),windows:J.store.windows(J.controlPlane.project.id),campaigns:J.store.campaigns(J.controlPlane.project.id),cleanups:J.store.cleanups(J.controlPlane.project.id),drills:J.store.drills(J.controlPlane.project.id)},X=[...Y.manifests.map((Q)=>["update",Q.version,Q.compatibility.compatible?"compatible":"blocked",Q.compatibility.reasons.join("; ")||Q.channel]),...Y.campaigns.map((Q)=>["upgrade",Q.id,Q.status,Q.currentStage??Q.fromVersion]),...Y.cleanups.map((Q)=>["cleanup",Q.kind,Q.status,`${Q.candidates.length} items / ${Q.estimatedBytes} bytes`]),...Y.drills.map((Q)=>["DR drill",Q.scenario,Q.status,Q.isolatedTarget])];if($.json)console.log(JSON.stringify(Y,null,2));else w(["Area","Name / version","Status","Detail"],X)})),G.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async($,J)=>t$(async(Y)=>{let X=Y.store.addTrustedKey({organizationId:Y.controlPlane.organization.id,name:$,publicKeyPem:await Bun.file(J).text()});B(`Trusted ${X.name}: ${X.fingerprint}`)})),G.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async($,J,Y)=>t$(async(X)=>{let Q=await Bun.file($).json(),Z=(await Bun.file(J).text()).trim(),z=X.store.importManifest({organizationId:X.controlPlane.organization.id,keyId:Y,document:Q,signature:Z,current:{schemaVersion:X.controlPlane.store.health().schemaVersion,currentVersion:G1,platform:process.platform,architecture:process.arch}});B(`Verified ${z.version}; ${z.compatibility.compatible?"compatible":"blocked: "+z.compatibility.reasons.join("; ")}`)})),G.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async($,J,Y)=>t$((X)=>{let Q=X.store.createWindow({projectId:X.controlPlane.project.id,name:$,schedule:J,timezone:Y.timezone,durationMinutes:Number(Y.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});B(`Created ${Q.name} (${Q.id}).`)})),G.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async($,J,Y)=>t$((X)=>{let Q=new O0(X.controlPlane.store).list(X.controlPlane.project.id).filter((F)=>F.status==="ready").map((F)=>({serverId:F.id,target:F.name,previousVersion:F.bootstrapVersion??G1}));if(!Q.length)Q.push({target:"control-plane",previousVersion:G1});let Z=X.store.createCampaign({projectId:X.controlPlane.project.id,manifestId:$,fromVersion:G1,strategy:Y.strategy==="rolling"?"rolling":"canary",batchSize:Number(Y.batch),healthGate:{kind:"platform"},backupId:J,targets:Q}),z=X.service.enqueueCampaign(Z.id);B(`Staged upgrade queued: ${z.operation.id}`)})),G.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async($,J)=>t$(async(Y)=>{let X=await Y.service.previewCleanup({projectId:Y.controlPlane.project.id,kind:$,criteria:{olderThanDays:Number(J.olderThan)}},Y.cleanup);w(["ID","Candidate","Bytes"],X.candidates.map((Q)=>[Q.id,Q.label,String(Q.bytes)])),W(`Apply with: cloud cleanup:apply ${X.id} --confirm "DELETE ${X.candidates.length} ${X.kind}"`)})),G.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async($,J)=>t$((Y)=>{let X=Y.service.enqueueCleanup($,String(J.confirm??""));B(`Cleanup queued: ${X.operation.id}`)})),G.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async($,J,Y)=>t$((X)=>{let Q=X.store.createDrill({projectId:X.controlPlane.project.id,scenario:$,isolatedTarget:J,expectedRpoMinutes:Number(Y.rpo),expectedRtoMinutes:Number(Y.rto),recoveryPointId:Y.recoveryPoint,topologyId:Y.topology});B(`Planned isolated drill ${Q.id}.`)})),G.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async($)=>t$((J)=>{let Y=J.service.enqueueDrill($);B(`DR drill queued: ${Y.operation.id}`)}))}async function r6(){try{return(await x()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function a6(G){G.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async($)=>{R("Lambda Functions");let J=$?.region||await r6(),Y=new e$(J);try{let{Functions:X=[]}=await Y.listFunctions({MaxItems:50});if(!X.length){W("No functions found");return}w(["Name","Runtime","Memory","Timeout","Last Modified"],X.map((Q)=>[Q.FunctionName??"-",Q.Runtime??"-",Q.MemorySize?`${Q.MemorySize} MB`:"-",Q.Timeout?`${Q.Timeout}s`:"-",Q.LastModified??"-"]))}catch(X){K(`Failed to list functions: ${X.message}`),process.exitCode=1}}),G.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async($,J)=>{R(`Invoking ${$}`);let Y=J?.region||await r6(),X=new e$(Y),Q=new E("Invoking function...");Q.start();try{let Z=await X.invoke({FunctionName:$,InvocationType:J?.async?"Event":"RequestResponse",Payload:J?.payload||"{}",LogType:J?.async?"None":"Tail"});if(Z.FunctionError){if(Q.fail(`Function returned an error (${Z.FunctionError})`),Z.Payload)W(Z.Payload);process.exitCode=1;return}if(Q.succeed(`Invoked (status ${Z.StatusCode})`),Z.Payload)W(`
 Response:`),W(Z.Payload);if(Z.LogResult)W(`
 Logs:`),W(Buffer.from(Z.LogResult,"base64").toString("utf-8"))}catch(Z){Q.fail(`Invocation failed: ${Z.message}`),process.exitCode=1}}),G.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async($,J)=>{R(`Logs for ${$}`);let Y=J?.region||await r6(),X=new o$(Y),Q=$.startsWith("/aws/lambda/")?$:`/aws/lambda/${$}`,Z=Number(J?.since??15),z=(F)=>{for(let U of F){let M=U.timestamp?new Date(U.timestamp).toISOString():"";W(`${M}  ${(U.message??"").trimEnd()}`)}};try{let F=Date.now()-Z*60000,{events:U=[]}=await X.filterLogEvents({logGroupName:Q,startTime:F,filterPattern:J?.filter,limit:200});if(z(U),U.length)F=(U[U.length-1].timestamp??F)+1;if(J?.tail){W(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise((H)=>setTimeout(H,3000));let{events:M=[]}=await X.filterLogEvents({logGroupName:Q,startTime:F,filterPattern:J?.filter,limit:200});if(M.length)z(M),F=(M[M.length-1].timestamp??F)+1}}}catch(F){K(`Failed to read logs: ${F.message}`),process.exitCode=1}})}async function Z9(G){let $=Bun.spawn(["docker",...G],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[J,Y]=await Promise.all([$.exited,new Response($.stderr).text()]);return{ok:J===0,exitCode:J,command:["docker",...G].join(" "),stderr:Y.trim()}}function p6(G){G.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async($)=>{let J=["build","--file",$.file??"Dockerfile","--tag",$.tag??"latest","."];if($.dryRun){console.log(`docker ${J.join(" ")}`);return}let Y=await Z9(J);if($.json)console.log(JSON.stringify(Y));if(!Y.ok)K(Y.stderr||`docker exited ${Y.exitCode}`),process.exitCode=Y.exitCode;else B(`Built ${$.tag??"latest"}.`)}),G.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async($)=>{if(!$.image){K("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if($.dryRun){console.log(`docker push ${$.image}`);return}let J=await Z9(["push",$.image]);if($.json)console.log(JSON.stringify(J));if(!J.ok)K(J.stderr),process.exitCode=J.exitCode;else B(`Pushed ${$.image}.`)}),G.command("container:deploy","Deploy a container image").action(async()=>V$("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}function s6(G){G.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async($)=>{R("Domains");try{let J=C$($?.provider),Y=U$($?.provider)?.provider||"unknown",X=new E(`Fetching domains from ${Y}...`);X.start();let Q=await J.listDomains();if(X.succeed(`Found ${Q.length} domain(s)`),Q.length===0){W("No domains found in this provider");return}let Z=Q.map((z)=>[z,"Active","-",Y.charAt(0).toUpperCase()+Y.slice(1)]);w(["Domain","Status","SSL","Provider"],Z)}catch(J){K(`Failed to list domains: ${J instanceof Error?J.message:String(J)}`)}}),G.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async($,J)=>{R(`Adding Domain: ${$}`);try{let Y=C$(J?.provider),X=U$(J?.provider)?.provider||"unknown",Q=new E(`Checking if ${X} can manage ${$}...`);if(Q.start(),await Y.canManageDomain($))Q.succeed(`Domain ${$} is already available in ${X}`),W(`
@@ -359,7 +359,7 @@ Deployment complete!`),W(`Total size: ${V} MB`),W(`
 Assets URL: https://${Q}.s3.${Y}.amazonaws.com${Z?`/${Z}`:""}`)}catch(J){K(`Deployment failed: ${J.message}`)}}),G.command("assets:invalidate","Invalidate CloudFront cache").option("--distribution <id>","CloudFront distribution ID").option("--paths <paths>","Paths to invalidate (comma-separated)",{default:"/*"}).option("--wait","Wait for invalidation to complete").action(async($)=>{R("Invalidating CloudFront Cache");try{let J=$?.distribution;if(!J){K("--distribution is required");return}let X=($?.paths||"/*").split(",").map((M)=>M.trim()),Q=$?.wait||!1;if(W(`Distribution: ${J}`),W(`Paths: ${X.join(", ")}`),!await k(`
 Invalidate cache now?`,!0)){W("Invalidation cancelled");return}let z=new $$,F=new E("Creating invalidation...");F.start();let U=await z.invalidatePaths(J,X);if(F.succeed("Invalidation created"),B(`
 Invalidation ID: ${U.Id}`),W(`Status: ${U.Status}`),W(`Created: ${new Date(U.CreateTime).toLocaleString()}`),Q){let M=new E("Waiting for invalidation to complete...");M.start(),await z.waitForInvalidation(J,U.Id),M.succeed("Invalidation completed!")}else W(`
-Invalidation is in progress. Use --wait to wait for completion.`)}catch(J){K(`Invalidation failed: ${J.message}`)}})}function hJ(G){for(let[$,J]of[["team:add <email> <role>","Invite an organization member"],["team:list","List organization members"],["team:remove <email>","Revoke organization membership"]])G.command($,J).action(async(...Y)=>V$($.split(" ")[0],{target:String(Y[0]??""),message:"Legacy IAM-backed team commands are deprecated and cannot safely represent organization-scoped access.",nextAction:"Use the Team dashboard or organization invitation API; this command exits without changing IAM."}))}import{execFileSync as ZX,execSync as H5}from"node:child_process";import{copyFileSync as K1,existsSync as H$,mkdirSync as C2,readFileSync as tJ,writeFileSync as WX}from"node:fs";import{tmpdir as f2}from"node:os";import{dirname as zX,join as g2,resolve as FX}from"node:path";import{existsSync as yJ,readdirSync as V2,statSync as CJ}from"node:fs";import{join as n1}from"node:path";var oG=new Set([".DS_Store","Thumbs.db",".gitkeep",".keep"]);function A2(G){return oG.has(G)}function q2(G,$=0){if($>8)return!0;let J;try{J=V2(G)}catch{return!1}for(let Y of J){if(A2(Y))continue;let X=n1(G,Y),Q;try{Q=CJ(X)}catch{continue}if(Q.isFile())return!0;if(Q.isDirectory()&&q2(X,$+1))return!0}return!1}function $X(G){let $;try{$=V2(G)}catch{return[]}let J=[];for(let Y of $){if(A2(Y))continue;let X=n1(G,Y);try{if(CJ(X).isDirectory()&&yJ(n1(X,"index.html")))J.push(Y)}catch{}}return J.sort((Y,X)=>Y.localeCompare(X))}function R2(G){let{root:$,siteName:J,expectIndex:Y}=G,X=[];if(!yJ($))return X.push({level:"error",message:`Build output not found at ${$} for site '${J}'`}),X;if(!CJ($).isDirectory())return X.push({level:"error",message:`Site '${J}' has root ${$}, which is a file, not a directory`}),X;if(!q2($))return X.push({level:"error",message:`Site '${J}' would ship an empty release: ${$} contains no files. Check that the build ran and wrote where 'root' points.`}),X;if(!Y)return X;if(yJ(n1($,"index.html")))return X;let Q=$X($);if(Q.length===1){let Z=`${$.replace(/\/+$/,"")}/${Q[0]}`;return X.push({level:"error",message:`Site '${J}' has no index.html at the top of ${$}, but ${Z} has one. The generator wrote one level down, so this release would serve 404s at the domain root. Set root: '${Z}'.`}),X}if(Q.length>1)return X.push({level:"warning",message:`Site '${J}' has no index.html at the top of ${$}. These subdirectories have one: ${Q.join(", ")}. The domain root will 404.`}),X;return X.push({level:"warning",message:`Site '${J}' has no index.html anywhere under ${$}. The domain root will 404.`}),X}function JX(G){if(!G)return[];if(Array.isArray(G))return G.map(String);let $=G,J=$.Items??$.Item;if(!J)return[];if(Array.isArray(J))return J.map(String);if(typeof J==="object"&&J!==null){let Y=J;if("Item"in Y){let X=Y.Item;if(!X)return[];return Array.isArray(X)?X.map(String):[String(X)]}if("CNAME"in Y){let X=Y.CNAME;if(!X)return[];return Array.isArray(X)?X.map(String):[String(X)]}return Object.values(Y).flatMap((X)=>{if(Array.isArray(X))return X.map(String);return typeof X==="string"?[X]:[]})}return[String(J)]}async function s1(G){if(G.length===0)return;let $=new $$,J=await $.listDistributions(),Y=[...new Set(G.map((X)=>X.toLowerCase()))];for(let X of Y){let Q=J.find((z)=>{return JX(z.Aliases).some((U)=>U.toLowerCase()===X)});if(!Q?.Id){N(`No CloudFront distribution found for ${X} — skipping dynamic HTTP method sync`);continue}if(await $.ensureDynamicHttpMethods(Q.Id))B(`CloudFront ${Q.Id} (${X}): enabled POST/PUT/PATCH/DELETE on dynamic paths`);else W(`CloudFront ${Q.Id} (${X}): already allows dynamic HTTP methods`)}}import{execSync as YX}from"node:child_process";async function GX(G,$,J,Y={},X=process.cwd()){if(!G)return;if(Y.step?.(`Running ${J} hook`),typeof G==="string"){YX(G,{stdio:"inherit",cwd:X});return}await G($)}async function M1(G,$,J={},Y){try{return await GX(G.hooks?.[$],G,$,J,Y),!0}catch(X){return J.error?.(`${$} hook failed: ${X?.message||X}`),!1}}var L2=["js","mjs","cjs","css","map","woff","woff2","ttf","otf","eot","png","jpg","jpeg","gif","webp","avif","svg","ico","mp4","webm","ogg","mp3","wav","pdf","wasm"];function fJ(G){return`"${G.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function E2(G){return`{${G.map(fJ).join(" ")}}`}function gJ(G){if(G.length===1)return`http.host eq ${fJ(G[0])}`;return`http.host in ${E2(G)}`}function vJ(G,$={}){if($.enabled===!1||G.length===0)return[];let J=gJ(G),Y=[],X=$.bypassPaths??[],Q=X.length>0?`(${X.map((U)=>`starts_with(http.request.uri.path, ${fJ(U)})`).join(" or ")})`:void 0;if(Q)Y.push({action:"set_cache_settings",description:"bypass cache",expression:`(${J} and ${Q})`,enabled:!0,action_parameters:{cache:!1}});let Z=Q?`${J} and not ${Q}`:J,z=$.assetExtensions??L2,F=z.length>0?`lower(http.request.uri.path.extension) in ${E2([...z])}`:void 0;if(F)Y.push({action:"set_cache_settings",description:"cache fingerprinted assets",expression:`(${Z} and ${F})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:$.assetEdgeTtl??2592000},browser_ttl:{mode:"override_origin",default:$.assetBrowserTtl??31536000}}});return Y.push({action:"set_cache_settings",description:"cache documents",expression:F?`(${Z} and not ${F})`:`(${Z})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:$.documentEdgeTtl??3600},browser_ttl:{mode:"override_origin",default:$.documentBrowserTtl??0}}}),Y}function mJ(G,$,J){if(G.length===0||!$||!J)return[];return[{action:"rewrite",description:"origin guard header",expression:`(${gJ(G)})`,enabled:!0,action_parameters:{headers:{[$]:{operation:"set",value:J}}}}]}var Y0=(G)=>G===void 0?void 0:G?"on":"off";function dJ(G){let $={ssl:G.ssl,always_use_https:Y0(G.alwaysUseHttps),automatic_https_rewrites:Y0(G.automaticHttpsRewrites),min_tls_version:G.minTlsVersion,tls_1_3:Y0(G.tls13),brotli:Y0(G.brotli),http3:Y0(G.http3),"0rtt":Y0(G.zeroRtt),early_hints:Y0(G.earlyHints),browser_cache_ttl:G.browserCacheTtl,always_online:Y0(G.alwaysOnline),websockets:Y0(G.websockets)};if(G.hsts)$.security_header={strict_transport_security:{enabled:G.hsts.enabled,max_age:G.hsts.maxAge??31536000,include_subdomains:G.hsts.includeSubdomains??!1,preload:G.hsts.preload??!1,nosniff:G.hsts.noSniff??!0}};for(let J of Object.keys($))if($[J]===void 0)delete $[J];return{...$,...G.raw??{}}}var H1={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,browserCacheTtl:0};import{connect as XX}from"node:tls";async function cJ(G){let{address:$,serverName:J,port:Y=443,timeoutMs:X=5000}=G;return new Promise((Q)=>{let Z=!1,z=(U)=>{if(Z)return;Z=!0;try{F.destroy()}catch{}Q(U)},F=XX({host:$,port:Y,servername:J,rejectUnauthorized:!1,timeout:X});F.once("secureConnect",()=>{if(F.authorized){z({reachable:!0,trusted:!0});return}z({reachable:!0,trusted:!1,reason:F.authorizationError?String(F.authorizationError):"origin certificate is not trusted for this hostname"})}),F.once("timeout",()=>{z({reachable:!1,trusted:!1,reason:`no TLS handshake within ${X}ms`})}),F.once("error",(U)=>{z({reachable:!1,trusted:!1,reason:U.message})})})}async function lJ(G){let{provider:$,zone:J,hosts:Y,ipv4:X,ipv6:Q,proxied:Z=!0,settings:z=H1,cache:F,originGuard:U,purge:M=!0,ttl:H=300,skipOriginProbe:j=!1}=G,V={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(Y.length===0)return V;let T=[];for(let q of Y){let O=Z;if(Z&&!j){let D=await cJ({address:X,serverName:q});if(!D.trusted){O=!1;let P=D.reason||"origin is not serving a trusted certificate";V.deferredProxy.push({host:q,reason:P}),V.warnings.push(`${q}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${P}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(O)T.push(q);let L=[{type:"A",content:X}];if(Q&&uJ(q))L.push({type:"AAAA",content:Q});for(let{type:D,content:P}of L){let b=await $.upsertRecord(J,{name:q,type:D,content:P,ttl:H,proxied:O});if(b.success)V.records.push({host:q,type:D,content:P,proxied:O});else V.warnings.push(`${q} ${D} → ${P} failed: ${b.message||"unknown provider error"}`)}}if(T.length===0){if(Z)V.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return V}try{let q=dJ(z),O=await $.applyZoneSettings(J,q);V.settingsChanged=O.changed;for(let L of O.failed)V.warnings.push(`zone setting '${L.id}' could not be applied: ${L.error}`)}catch(q){V.warnings.push(`zone settings could not be read: ${q instanceof Error?q.message:String(q)}`)}let A=vJ(T,F);if(A.length>0){let q=await $.putManagedPhaseRules(J,"http_request_cache_settings",A);if(q.success)V.cacheRules=A.length;else V.warnings.push(`cache rules could not be written: ${q.message}`)}if(U){let q=mJ(T,U.header,U.value);if(q.length>0){let O=await $.putManagedPhaseRules(J,"http_request_late_transform",q);if(O.success)V.originGuard=!0;else V.warnings.push(`origin guard header could not be written: ${O.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(M){if(V.purged=await $.purgeCache(J,{hosts:T}),!V.purged)V.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return V}var QX=(G)=>process.env[G];function T2(G,$){let J=G.replace(/\.$/,"").toLowerCase();if($){let Y=$.replace(/\.$/,"").toLowerCase();if(J===Y||J.endsWith(`.${Y}`))return Y}return J.split(".").slice(-2).join(".")}function aJ(G,$={}){let J=$.env??QX,Y=G.infrastructure?.compute?.proxy?.cdn,X=[];if(!Y||Y.provider!=="cloudflare")return{plan:null,errors:X};if(Y.originDomain)X.push(`compute.proxy.cdn.originDomain (${Y.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let Q=J("CLOUDFLARE_API_TOKEN");if(!Q)return X.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:X};let Z=G.sites??{},z=Y.frontedHosts?.length?[...new Set(Y.frontedHosts.map((j)=>j.toLowerCase()))]:rJ(Z,{autoWww:G.infrastructure?.compute?.proxy?.autoWww!==!1});if(z.length===0)return X.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:X};let F=G.infrastructure?.dns?.domain,U=new Set(z.map((j)=>T2(j,F)));if(U.size>1)return X.push(`Fronted hosts span more than one zone (${[...U].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:X};let M=Y.cloudflare??{},H=Y.secret?{header:Y.secretHeader??"X-Origin-Verify",value:Y.secret}:void 0;return{plan:{zone:[...U][0],hosts:z,apiToken:Q,zoneId:M.zoneId??J("CLOUDFLARE_ZONE_ID"),accountId:M.accountId??J("CLOUDFLARE_ACCOUNT_ID"),proxied:M.proxied!==!1,settings:M.settings??H1,cache:M.cache,originGuard:H,purge:M.purgeOnDeploy!==!1,skipOriginProbe:M.skipOriginProbe===!0},errors:X}}async function UX(G){let $=O2();if($.emptyEnvKey||$.emptyEnvSecret)N("Empty AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY env var detected — likely a misconfigured .env file. Remove the empty lines or fill them in.");W(`AWS credentials: ${$.description}`);try{let Y=await new P0(G).getCallerIdentity();if(Y.Arn)W(`AWS identity: ${Y.Arn}`)}catch(J){N(`Could not verify AWS identity: ${J.message}`)}}function MX(){try{return H5("git rev-parse --short HEAD",{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{return Date.now().toString(36)}}async function pJ(G,$,J,Y){let{ensureManagementDashboard:X}=await import("./chunk-avm7tnwe.js");X(G,{logger:{info:W,warn:N}});let Q=G.sites||{},Z=Object.entries(Q);if(Z.length===0)return N("infrastructure.compute is set but no sites are configured — nothing to deploy. Add sites to `cloud.config.ts`."),!0;if(Y&&!Q[Y])return K(`Site '${Y}' was not found. Configured sites: ${Z.map(([O])=>O).join(", ")}`),!1;let z=Z.filter(([O,L])=>{if(!L)return!1;if(Y&&O!==Y)return!1;if(B1(L)==="bucket")return N(`Site '${O}' targets a bucket — skipping compute deploy (handled by the static-site path).`),!1;return Y5(L)});if(Y)W(`Deploying only '${Y}'. Other sites keep their current release; proxy routes are still regenerated in full.`);let F=G.project.slug,M=(G.infrastructure?.compute||{}).runtime||"bun",H=c$({config:G}),j=MX(),V=new Map,T=new Map,A={step:(O)=>y(O),error:(O)=>K(O)};if(!await M1(G,"beforeDeploy",A))return!1;if(!await M1(G,"beforeBuild",A))return!1;for(let[O,L]of z){let D=B1(L);if(R(`Preparing site: ${O}`),W(`Domain: ${L.domain||"(none)"}`),W(`Source: ${L.root}`),W(`Kind: ${D==="server-static"?"static (shipped to /var/www)":"app (systemd service)"}`),D==="server-app")W(`Start: ${L.start}`),W(`Port: ${L.port??"(unset)"}`);if(L.build){y(`Running build: ${L.build}`);try{H5(L.build,{stdio:"inherit",cwd:process.cwd()})}catch(I){return K(`Build failed for site '${O}': ${I.message}`),!1}}let P=R2({root:L.root,siteName:O,expectIndex:D==="server-static"});for(let I of P)if(I.level==="error")K(I.message);else N(I.message);if(P.some((I)=>I.level==="error"))return!1;let b=L.build?void 0:JSON.stringify([FX(L.root),[...L.exclude||[]].sort()]),_=b?T.get(b):void 0;if(_){y(`Reusing package for ${L.root} → ${_}`),V.set(O,_);continue}let S=g2(f2(),`${F}-${O}-${j}.tar.gz`);y(`Packaging ${L.root} → ${S}`);try{let I=(L.exclude||[]).map((g)=>`--exclude=${g}`);ZX("tar",["czf",S,"-C",L.root,...I,"."],{stdio:"inherit",env:{...process.env,COPYFILE_DISABLE:"1"}})}catch(I){return K(`Failed to package '${O}': ${I.message}`),!1}if(V.set(O,S),b)T.set(b,S)}if(!await M1(G,"afterBuild",A))return!1;let q=await Q5({config:Y?{...G,sites:Object.fromEntries(z)}:G,rpxConfig:Y?G:void 0,environment:$,driver:H,sha:j,runtime:M,tarballForSite:(O)=>{let L=V.get(O);if(!L)throw Error(`Missing tarball for site '${O}'`);return L},logger:{info:(O)=>W(O),warn:(O)=>N(O),error:(O)=>K(O),step:(O)=>y(O),success:(O)=>B(O)}});if(q&&!await M1(G,"afterDeploy",A))return!1;return q}async function i1(G){let $=new I2;if(y("Running pre-deployment security scan..."),G.exclude?.length)W(`Excluding from the scan: ${G.exclude.join(", ")}`);let J=await $.scan({directory:G.sourceDir,failOnSeverity:G.failOnSeverity||"critical",skipPatterns:G.skipPatterns,exclude:G.exclude});return{passed:J.passed,result:J}}function HX(){let G=g2(f2(),`ts-cloud-empty-scan-${process.pid}`);return C2(G,{recursive:!0}),G}function t1(G){let{summary:$,findings:J,scannedFiles:Y,duration:X}=G;if(W(`
+Invalidation is in progress. Use --wait to wait for completion.`)}catch(J){K(`Invalidation failed: ${J.message}`)}})}function hJ(G){for(let[$,J]of[["team:add <email> <role>","Invite an organization member"],["team:list","List organization members"],["team:remove <email>","Revoke organization membership"]])G.command($,J).action(async(...Y)=>V$($.split(" ")[0],{target:String(Y[0]??""),message:"Legacy IAM-backed team commands are deprecated and cannot safely represent organization-scoped access.",nextAction:"Use the Team dashboard or organization invitation API; this command exits without changing IAM."}))}import{execFileSync as ZX,execSync as H5}from"node:child_process";import{copyFileSync as K1,existsSync as H$,mkdirSync as C2,readFileSync as tJ,writeFileSync as WX}from"node:fs";import{tmpdir as f2}from"node:os";import{dirname as zX,join as g2,resolve as FX}from"node:path";import{existsSync as yJ,readdirSync as V2,statSync as CJ}from"node:fs";import{join as n1}from"node:path";var oG=new Set([".DS_Store","Thumbs.db",".gitkeep",".keep"]);function A2(G){return oG.has(G)}function q2(G,$=0){if($>8)return!0;let J;try{J=V2(G)}catch{return!1}for(let Y of J){if(A2(Y))continue;let X=n1(G,Y),Q;try{Q=CJ(X)}catch{continue}if(Q.isFile())return!0;if(Q.isDirectory()&&q2(X,$+1))return!0}return!1}function $X(G){let $;try{$=V2(G)}catch{return[]}let J=[];for(let Y of $){if(A2(Y))continue;let X=n1(G,Y);try{if(CJ(X).isDirectory()&&yJ(n1(X,"index.html")))J.push(Y)}catch{}}return J.sort((Y,X)=>Y.localeCompare(X))}function R2(G){let{root:$,siteName:J,expectIndex:Y}=G,X=[];if(!yJ($))return X.push({level:"error",message:`Build output not found at ${$} for site '${J}'`}),X;if(!CJ($).isDirectory())return X.push({level:"error",message:`Site '${J}' has root ${$}, which is a file, not a directory`}),X;if(!q2($))return X.push({level:"error",message:`Site '${J}' would ship an empty release: ${$} contains no files. Check that the build ran and wrote where 'root' points.`}),X;if(!Y)return X;if(yJ(n1($,"index.html")))return X;let Q=$X($);if(Q.length===1){let Z=`${$.replace(/\/+$/,"")}/${Q[0]}`;return X.push({level:"error",message:`Site '${J}' has no index.html at the top of ${$}, but ${Z} has one. The generator wrote one level down, so this release would serve 404s at the domain root. Set root: '${Z}'.`}),X}if(Q.length>1)return X.push({level:"warning",message:`Site '${J}' has no index.html at the top of ${$}. These subdirectories have one: ${Q.join(", ")}. The domain root will 404.`}),X;return X.push({level:"warning",message:`Site '${J}' has no index.html anywhere under ${$}. The domain root will 404.`}),X}function JX(G){if(!G)return[];if(Array.isArray(G))return G.map(String);let $=G,J=$.Items??$.Item;if(!J)return[];if(Array.isArray(J))return J.map(String);if(typeof J==="object"&&J!==null){let Y=J;if("Item"in Y){let X=Y.Item;if(!X)return[];return Array.isArray(X)?X.map(String):[String(X)]}if("CNAME"in Y){let X=Y.CNAME;if(!X)return[];return Array.isArray(X)?X.map(String):[String(X)]}return Object.values(Y).flatMap((X)=>{if(Array.isArray(X))return X.map(String);return typeof X==="string"?[X]:[]})}return[String(J)]}async function s1(G){if(G.length===0)return;let $=new $$,J=await $.listDistributions(),Y=[...new Set(G.map((X)=>X.toLowerCase()))];for(let X of Y){let Q=J.find((z)=>{return JX(z.Aliases).some((U)=>U.toLowerCase()===X)});if(!Q?.Id){N(`No CloudFront distribution found for ${X} — skipping dynamic HTTP method sync`);continue}if(await $.ensureDynamicHttpMethods(Q.Id))B(`CloudFront ${Q.Id} (${X}): enabled POST/PUT/PATCH/DELETE on dynamic paths`);else W(`CloudFront ${Q.Id} (${X}): already allows dynamic HTTP methods`)}}import{execSync as YX}from"node:child_process";async function GX(G,$,J,Y={},X=process.cwd()){if(!G)return;if(Y.step?.(`Running ${J} hook`),typeof G==="string"){YX(G,{stdio:"inherit",cwd:X});return}await G($)}async function M1(G,$,J={},Y){try{return await GX(G.hooks?.[$],G,$,J,Y),!0}catch(X){return J.error?.(`${$} hook failed: ${X?.message||X}`),!1}}var L2=["js","mjs","cjs","css","map","woff","woff2","ttf","otf","eot","png","jpg","jpeg","gif","webp","avif","svg","ico","mp4","webm","ogg","mp3","wav","pdf","wasm"];function fJ(G){return`"${G.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function E2(G){return`{${G.map(fJ).join(" ")}}`}function gJ(G){if(G.length===1)return`http.host eq ${fJ(G[0])}`;return`http.host in ${E2(G)}`}function vJ(G,$={}){if($.enabled===!1||G.length===0)return[];let J=gJ(G),Y=[],X=$.bypassPaths??[],Q=X.length>0?`(${X.map((U)=>`starts_with(http.request.uri.path, ${fJ(U)})`).join(" or ")})`:void 0;if(Q)Y.push({action:"set_cache_settings",description:"bypass cache",expression:`(${J} and ${Q})`,enabled:!0,action_parameters:{cache:!1}});let Z=Q?`${J} and not ${Q}`:J,z=$.assetExtensions??L2,F=z.length>0?`lower(http.request.uri.path.extension) in ${E2([...z])}`:void 0;if(F)Y.push({action:"set_cache_settings",description:"cache fingerprinted assets",expression:`(${Z} and ${F})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:$.assetEdgeTtl??2592000},browser_ttl:{mode:"override_origin",default:$.assetBrowserTtl??31536000}}});return Y.push({action:"set_cache_settings",description:"cache documents",expression:F?`(${Z} and not ${F})`:`(${Z})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:$.documentEdgeTtl??3600},browser_ttl:{mode:"override_origin",default:$.documentBrowserTtl??0}}}),Y}function mJ(G,$,J){if(G.length===0||!$||!J)return[];return[{action:"rewrite",description:"origin guard header",expression:`(${gJ(G)})`,enabled:!0,action_parameters:{headers:{[$]:{operation:"set",value:J}}}}]}var Y0=(G)=>G===void 0?void 0:G?"on":"off";function dJ(G){let $={ssl:G.ssl,always_use_https:Y0(G.alwaysUseHttps),automatic_https_rewrites:Y0(G.automaticHttpsRewrites),min_tls_version:G.minTlsVersion,tls_1_3:Y0(G.tls13),brotli:Y0(G.brotli),http3:Y0(G.http3),"0rtt":Y0(G.zeroRtt),early_hints:Y0(G.earlyHints),browser_cache_ttl:G.browserCacheTtl,always_online:Y0(G.alwaysOnline),websockets:Y0(G.websockets)};if(G.hsts)$.security_header={strict_transport_security:{enabled:G.hsts.enabled,max_age:G.hsts.maxAge??31536000,include_subdomains:G.hsts.includeSubdomains??!1,preload:G.hsts.preload??!1,nosniff:G.hsts.noSniff??!0}};for(let J of Object.keys($))if($[J]===void 0)delete $[J];return{...$,...G.raw??{}}}var H1={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,browserCacheTtl:0};import{connect as XX}from"node:tls";async function cJ(G){let{address:$,serverName:J,port:Y=443,timeoutMs:X=5000}=G;return new Promise((Q)=>{let Z=!1,z=(U)=>{if(Z)return;Z=!0;try{F.destroy()}catch{}Q(U)},F=XX({host:$,port:Y,servername:J,rejectUnauthorized:!1,timeout:X});F.once("secureConnect",()=>{if(F.authorized){z({reachable:!0,trusted:!0});return}z({reachable:!0,trusted:!1,reason:F.authorizationError?String(F.authorizationError):"origin certificate is not trusted for this hostname"})}),F.once("timeout",()=>{z({reachable:!1,trusted:!1,reason:`no TLS handshake within ${X}ms`})}),F.once("error",(U)=>{z({reachable:!1,trusted:!1,reason:U.message})})})}async function lJ(G){let{provider:$,zone:J,hosts:Y,ipv4:X,ipv6:Q,proxied:Z=!0,settings:z=H1,cache:F,originGuard:U,purge:M=!0,ttl:H=300,skipOriginProbe:j=!1}=G,V={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(Y.length===0)return V;let T=[];for(let q of Y){let O=Z;if(Z&&!j){let D=await cJ({address:X,serverName:q});if(!D.trusted){O=!1;let P=D.reason||"origin is not serving a trusted certificate";V.deferredProxy.push({host:q,reason:P}),V.warnings.push(`${q}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${P}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(O)T.push(q);let L=[{type:"A",content:X}];if(Q&&uJ(q))L.push({type:"AAAA",content:Q});for(let{type:D,content:P}of L){let b=await $.upsertRecord(J,{name:q,type:D,content:P,ttl:H,proxied:O});if(b.success)V.records.push({host:q,type:D,content:P,proxied:O});else V.warnings.push(`${q} ${D} → ${P} failed: ${b.message||"unknown provider error"}`)}}if(T.length===0){if(Z)V.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return V}try{let q=dJ(z),O=await $.applyZoneSettings(J,q);V.settingsChanged=O.changed;for(let L of O.failed)V.warnings.push(`zone setting '${L.id}' could not be applied: ${L.error}`)}catch(q){V.warnings.push(`zone settings could not be read: ${q instanceof Error?q.message:String(q)}`)}let A=vJ(T,F);if(A.length>0){let q=await $.putManagedPhaseRules(J,"http_request_cache_settings",A);if(q.success)V.cacheRules=A.length;else V.warnings.push(`cache rules could not be written: ${q.message}`)}if(U){let q=mJ(T,U.header,U.value);if(q.length>0){let O=await $.putManagedPhaseRules(J,"http_request_late_transform",q);if(O.success)V.originGuard=!0;else V.warnings.push(`origin guard header could not be written: ${O.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(M){if(V.purged=await $.purgeCache(J,{hosts:T}),!V.purged)V.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return V}var QX=(G)=>process.env[G];function T2(G,$){let J=G.replace(/\.$/,"").toLowerCase();if($){let Y=$.replace(/\.$/,"").toLowerCase();if(J===Y||J.endsWith(`.${Y}`))return Y}return J.split(".").slice(-2).join(".")}function aJ(G,$={}){let J=$.env??QX,Y=G.infrastructure?.compute?.proxy?.cdn,X=[];if(!Y||Y.provider!=="cloudflare")return{plan:null,errors:X};if(Y.originDomain)X.push(`compute.proxy.cdn.originDomain (${Y.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let Q=J("CLOUDFLARE_API_TOKEN");if(!Q)return X.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:X};let Z=G.sites??{},z=Y.frontedHosts?.length?[...new Set(Y.frontedHosts.map((j)=>j.toLowerCase()))]:rJ(Z,{autoWww:G.infrastructure?.compute?.proxy?.autoWww!==!1});if(z.length===0)return X.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:X};let F=G.infrastructure?.dns?.domain,U=new Set(z.map((j)=>T2(j,F)));if(U.size>1)return X.push(`Fronted hosts span more than one zone (${[...U].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:X};let M=Y.cloudflare??{},H=Y.secret?{header:Y.secretHeader??"X-Origin-Verify",value:Y.secret}:void 0;return{plan:{zone:[...U][0],hosts:z,apiToken:Q,zoneId:M.zoneId??J("CLOUDFLARE_ZONE_ID"),accountId:M.accountId??J("CLOUDFLARE_ACCOUNT_ID"),proxied:M.proxied!==!1,settings:M.settings??H1,cache:M.cache,originGuard:H,purge:M.purgeOnDeploy!==!1,skipOriginProbe:M.skipOriginProbe===!0},errors:X}}async function UX(G){let $=O2();if($.emptyEnvKey||$.emptyEnvSecret)N("Empty AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY env var detected — likely a misconfigured .env file. Remove the empty lines or fill them in.");W(`AWS credentials: ${$.description}`);try{let Y=await new P0(G).getCallerIdentity();if(Y.Arn)W(`AWS identity: ${Y.Arn}`)}catch(J){N(`Could not verify AWS identity: ${J.message}`)}}function MX(){try{return H5("git rev-parse --short HEAD",{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{return Date.now().toString(36)}}async function pJ(G,$,J,Y){let{ensureManagementDashboard:X}=await import("./chunk-e0rkrq70.js");X(G,{logger:{info:W,warn:N}});let Q=G.sites||{},Z=Object.entries(Q);if(Z.length===0)return N("infrastructure.compute is set but no sites are configured — nothing to deploy. Add sites to `cloud.config.ts`."),!0;if(Y&&!Q[Y])return K(`Site '${Y}' was not found. Configured sites: ${Z.map(([O])=>O).join(", ")}`),!1;let z=Z.filter(([O,L])=>{if(!L)return!1;if(Y&&O!==Y)return!1;if(B1(L)==="bucket")return N(`Site '${O}' targets a bucket — skipping compute deploy (handled by the static-site path).`),!1;return Y5(L)});if(Y)W(`Deploying only '${Y}'. Other sites keep their current release; proxy routes are still regenerated in full.`);let F=G.project.slug,M=(G.infrastructure?.compute||{}).runtime||"bun",H=c$({config:G}),j=MX(),V=new Map,T=new Map,A={step:(O)=>y(O),error:(O)=>K(O)};if(!await M1(G,"beforeDeploy",A))return!1;if(!await M1(G,"beforeBuild",A))return!1;for(let[O,L]of z){let D=B1(L);if(R(`Preparing site: ${O}`),W(`Domain: ${L.domain||"(none)"}`),W(`Source: ${L.root}`),W(`Kind: ${D==="server-static"?"static (shipped to /var/www)":"app (systemd service)"}`),D==="server-app")W(`Start: ${L.start}`),W(`Port: ${L.port??"(unset)"}`);if(L.build){y(`Running build: ${L.build}`);try{H5(L.build,{stdio:"inherit",cwd:process.cwd()})}catch(I){return K(`Build failed for site '${O}': ${I.message}`),!1}}let P=R2({root:L.root,siteName:O,expectIndex:D==="server-static"});for(let I of P)if(I.level==="error")K(I.message);else N(I.message);if(P.some((I)=>I.level==="error"))return!1;let b=L.build?void 0:JSON.stringify([FX(L.root),[...L.exclude||[]].sort()]),_=b?T.get(b):void 0;if(_){y(`Reusing package for ${L.root} → ${_}`),V.set(O,_);continue}let S=g2(f2(),`${F}-${O}-${j}.tar.gz`);y(`Packaging ${L.root} → ${S}`);try{let I=(L.exclude||[]).map((g)=>`--exclude=${g}`);ZX("tar",["czf",S,"-C",L.root,...I,"."],{stdio:"inherit",env:{...process.env,COPYFILE_DISABLE:"1"}})}catch(I){return K(`Failed to package '${O}': ${I.message}`),!1}if(V.set(O,S),b)T.set(b,S)}if(!await M1(G,"afterBuild",A))return!1;let q=await Q5({config:Y?{...G,sites:Object.fromEntries(z)}:G,rpxConfig:Y?G:void 0,environment:$,driver:H,sha:j,runtime:M,tarballForSite:(O)=>{let L=V.get(O);if(!L)throw Error(`Missing tarball for site '${O}'`);return L},logger:{info:(O)=>W(O),warn:(O)=>N(O),error:(O)=>K(O),step:(O)=>y(O),success:(O)=>B(O)}});if(q&&!await M1(G,"afterDeploy",A))return!1;return q}async function i1(G){let $=new I2;if(y("Running pre-deployment security scan..."),G.exclude?.length)W(`Excluding from the scan: ${G.exclude.join(", ")}`);let J=await $.scan({directory:G.sourceDir,failOnSeverity:G.failOnSeverity||"critical",skipPatterns:G.skipPatterns,exclude:G.exclude});return{passed:J.passed,result:J}}function HX(){let G=g2(f2(),`ts-cloud-empty-scan-${process.pid}`);return C2(G,{recursive:!0}),G}function t1(G){let{summary:$,findings:J,scannedFiles:Y,duration:X}=G;if(W(`
 Scanned ${Y} files in ${X}ms`),$.critical>0)K(`  Critical: ${$.critical}`);else W(`  Critical: ${$.critical}`);if($.high>0)N(`  High: ${$.high}`);else W(`  High: ${$.high}`);if(W(`  Medium: ${$.medium}`),W(`  Low: ${$.low}`),J.length>0){W(`
 Findings:`);let Q=J.filter((M)=>M.pattern.severity==="critical"),Z=J.filter((M)=>M.pattern.severity==="high"),z=J.filter((M)=>M.pattern.severity==="medium"),F=J.filter((M)=>M.pattern.severity==="low"),U=(M,H,j)=>{if(M.length>0){console.log(`
 ${w2(`[${H}]`,j)}`);for(let V of M.slice(0,10))W(`  ${V.pattern.name}`),W(`    File: ${V.file}:${V.line}`),W(`    Match: ${V.match}`);if(M.length>10)W(`  ... and ${M.length-10} more ${H.toLowerCase()} findings`)}};U(Q,"CRITICAL","red"),U(Z,"HIGH","yellow"),U(z,"MEDIUM","blue"),U(F,"LOW","gray")}}function v2(G,$){let J=Object.keys(G.environments??{});if($&&J.includes($))return $;if(J.includes("production"))return"production";if(J[0])return J[0];throw Error("A configured environment is required for security policy evaluation")}function nJ(G,$,J){let Y=v2(G,$),X=u(process.cwd(),G);try{let Q=new z5(X.store);U5(X);let Z=F5(X,Y);if(J)k2(Q,Z,J);else h2(Q,Z);let z=M5(Q,{scope:Z,desiredConfigHash:X.project.desiredConfigHash});return W(`Security policy: ${z.decision.policyId} v${z.decision.policyVersion} — ${z.decision.outcome.toUpperCase()}`),W(`Security decision: ${z.decision.explanation}`),{allowed:z.decision.outcome!=="block",explanation:z.decision.explanation}}finally{X.store.close()}}async function KX(G,$){let J=v2(G),Y=u(process.cwd(),G);try{let X=new z5(Y.store);U5(Y);let Q=F5(Y,J),Z=$.imageSha256?`${$.imageRef}@sha256:${$.imageSha256.replace(/^sha256:/,"")}`:$.imageRef;y("Scanning the built image and producing release security artifacts...");let z=await y2(X,{scope:Q,releaseId:Z,imageRef:$.imageRef,imageSha256:$.imageSha256,artifactRoot:$.artifactRoot,invocationId:$.invocationId,startedAt:$.startedAt,externalParameters:{imageRef:$.imageRef,artifactRoot:$.artifactRoot}});W(`Image scanner: ${z.scan.run.status} (${z.scan.findings.length} findings)`),W(`Release SBOM: ${z.sbomSource==="image"?"full image inventory":z.sbomSource==="manifest"?"package-manifest fallback":"unavailable"}`);let F=M5(X,{scope:Q,operationId:$.invocationId,desiredConfigHash:Y.project.desiredConfigHash});return W(`Release policy: ${F.decision.policyId} v${F.decision.policyVersion} — ${F.decision.outcome.toUpperCase()}`),W(`Release decision: ${F.decision.explanation}`),{allowed:F.decision.outcome!=="block",explanation:F.decision.explanation}}finally{Y.store.close()}}function jX(G){try{let $=u(process.cwd(),G),J=new z1($.store).current();if(!J.attackMode&&!J.mitigationPause&&J.ipRules.allow.length===0&&J.ipRules.block.length===0)return G;let Y=b2(G,J);return W(`Applying protection controls: ${J.ipRules.allow.length} allow, ${J.ipRules.block.length} block${J.attackMode?", attack mode ON":""}${J.mitigationPause?", mitigation PAUSED":""}`),Y}catch{return G}}function K5(G){G.command("deploy:security-scan","Run pre-deployment security scan").option("--source <path>","Source directory to scan",{default:"."}).option("--fail-on <severity>","Fail on severity level (critical, high, medium, low)",{default:"critical"}).option("--skip-patterns <patterns>","Comma-separated list of pattern names to skip").action(async($)=>{R("Pre-Deployment Security Scan");try{let J=$?.source||".",Y=$?.failOn||"critical",X=$?.skipPatterns?.split(",").map((z)=>z.trim())||[];if(!H$(J)){K(`Source directory not found: ${J}`);return}W(`Source: ${J}`),W(`Fail on: ${Y} or higher severity`);let{passed:Q,result:Z}=await i1({sourceDir:J,failOnSeverity:Y,skipPatterns:X});if(t1(Z),Q)B(`
@@ -369,7 +369,7 @@ Recommendations:`),W("  1. Remove any hardcoded credentials from your code"),W("
 ✗ Deployment configuration is invalid:`);for(let C of z)K(`  • ${C}`);process.exitCode=1;return}if($?.dryRun){if($.site&&!Z.sites?.[$.site]){K(`Site '${$.site}' was not found. Configured sites: ${Object.keys(Z.sites||{}).join(", ")||"none"}`),process.exitCode=1;return}let C=j1(Z),c=$.stack||i$(Z,Y),z$=c0(Z),X$=Z.project.region||"us-east-1",h$=$.site?[$.site]:Object.keys(Z.sites||{});R("Deployment Plan"),W(`Cloud provider: ${z$}`),W(`Mode: ${C}`),W(`Stack: ${c}`),W(`Region: ${X$}`),W(`Environment: ${Y}`),W(`Sites: ${h$.length>0?h$.join(", "):"none"}`),B("Dry run complete. No infrastructure, DNS, certificates, or application files were changed.");return}if(c0(Z)==="aws"){let C=Z.project?.region||"us-east-1";await UX(C)}let U;if(!$?.skipSecurityScan){let C=_2(Z,$?.site);if(!C)W("This deploy ships no files — every site in scope is a redirect or proxy route, so only gateway routes and certificates change. Scanning an empty artifact.");let{result:c}=await i1({sourceDir:C?process.cwd():HX(),failOnSeverity:$?.securityFailOn||"critical",exclude:Z.infrastructure?.security?.scan?.exclude});t1(c),U=c}else N(`Security scan skipped (--skip-security-scan)
 `);let M=nJ(Z,Y,U);if(!M.allowed){K(`
 ✗ Deployment blocked by security policy: ${M.explanation}`),W("Remediate the findings or create an authorized, time-limited waiver in the Security posture center."),process.exitCode=1;return}if(B(`✓ Security policy allows this deployment
-`),j1(Z)==="serverless"){y("Serverless project detected: deploying the Lambda application");let{deployServerlessApp:C}=await import("./chunk-41x17hw1.js");await C(Z,Y,{}),B("Serverless deployment complete");return}let H=$?.stack||i$(Z,Y),j=Z.project.region||"us-east-1",V=Z.infrastructure?.deployStack!==!1,T=Z.sites&&Object.keys(Z.sites).length>0,A=Z.infrastructure?.dns?.provider;if(T&&A){if(await RX(Z,$?.site,A,j,$?.skipDnsVerification,Y,J),!V){if(Z.infrastructure?.compute){let C=Object.values(Z.sites).map((c)=>c.domain).filter((c)=>!!c);if(C.length>0)y("Syncing CloudFront dynamic HTTP methods for app domains..."),await s1(C)}return}}if(!V){W("Infrastructure stack deployment disabled (infrastructure.deployStack: false)");return}let q=c0(Z);if(W(`Cloud provider: ${q}`),W(`Stack: ${H}`),W(`Region: ${j}`),W(`Environment: ${Y}`),(q==="hetzner"||Z.infrastructure?.compute?.mode==="server")&&iJ(Z)){y(`Provisioning ${q} compute infrastructure...`);let C=c$({config:Z,provider:q});if(!C.provisionComputeInfrastructure){K(`${q} driver does not support compute provisioning`),process.exitCode=1;return}let c=await C.provisionComputeInfrastructure({config:Z,environment:Y});if(B(`${q} compute infrastructure ready`),c.appPublicIp)W(`App server: ${c.appPublicIp}`);if(c.appInstanceId)W(`Server ID: ${c.appInstanceId}`);if(!await pJ(Z,Y,j,$?.site))K(`App deploy to ${q} compute reported a failure`),process.exitCode=1;else{if(B(`App deployed to ${q} compute`),$?.skipDnsVerification)W("DNS verification and record reconciliation skipped (--skip-dns-verification)");else await VX(Z,c.appPublicIp,A,c.appPublicIpv6),await AX(Z,A);let X$=await Z5({config:Z,environment:Y,driver:C,logger:{info:W,warn:N,error:K,step:y,success:B}});if(!X$)K("App deployed, but rpx TLS certificate reconciliation failed");if(!X$)process.exitCode=1;if(!$?.skipDnsVerification)await qX(Z,c.appPublicIp,c.appPublicIpv6)}return}y("Generating CloudFormation template...");let L=new C0({config:Z,environment:Y});L.generate();let D=L.toJSON(),P=JSON.parse(D);if(Object.keys(P.Resources||{}).length===0){W(`No infrastructure resources to deploy for environment '${Y}' — skipping stack ${H}.`);return}y("Validating template...");let _=s0(P),S=i0(D),I=t0(P),g=[..._.errors,...S.errors,...I.errors];if(g.length>0){K("Template validation failed:");for(let C of g)K(`  - ${C.path}: ${C.message}`);return}let f=[..._.warnings,...S.warnings,...I.warnings];if(f.length>0)for(let C of f)N(`  - ${C.path}: ${C.message}`);B("Template validated successfully");let d=Object.keys(P.Resources).length;W(`
+`),j1(Z)==="serverless"){y("Serverless project detected: deploying the Lambda application");let{deployServerlessApp:C}=await import("./chunk-5mrtzemj.js");await C(Z,Y,{}),B("Serverless deployment complete");return}let H=$?.stack||i$(Z,Y),j=Z.project.region||"us-east-1",V=Z.infrastructure?.deployStack!==!1,T=Z.sites&&Object.keys(Z.sites).length>0,A=Z.infrastructure?.dns?.provider;if(T&&A){if(await RX(Z,$?.site,A,j,$?.skipDnsVerification,Y,J),!V){if(Z.infrastructure?.compute){let C=Object.values(Z.sites).map((c)=>c.domain).filter((c)=>!!c);if(C.length>0)y("Syncing CloudFront dynamic HTTP methods for app domains..."),await s1(C)}return}}if(!V){W("Infrastructure stack deployment disabled (infrastructure.deployStack: false)");return}let q=c0(Z);if(W(`Cloud provider: ${q}`),W(`Stack: ${H}`),W(`Region: ${j}`),W(`Environment: ${Y}`),(q==="hetzner"||Z.infrastructure?.compute?.mode==="server")&&iJ(Z)){y(`Provisioning ${q} compute infrastructure...`);let C=c$({config:Z,provider:q});if(!C.provisionComputeInfrastructure){K(`${q} driver does not support compute provisioning`),process.exitCode=1;return}let c=await C.provisionComputeInfrastructure({config:Z,environment:Y});if(B(`${q} compute infrastructure ready`),c.appPublicIp)W(`App server: ${c.appPublicIp}`);if(c.appInstanceId)W(`Server ID: ${c.appInstanceId}`);if(!await pJ(Z,Y,j,$?.site))K(`App deploy to ${q} compute reported a failure`),process.exitCode=1;else{if(B(`App deployed to ${q} compute`),$?.skipDnsVerification)W("DNS verification and record reconciliation skipped (--skip-dns-verification)");else await VX(Z,c.appPublicIp,A,c.appPublicIpv6),await AX(Z,A);let X$=await Z5({config:Z,environment:Y,driver:C,logger:{info:W,warn:N,error:K,step:y,success:B}});if(!X$)K("App deployed, but rpx TLS certificate reconciliation failed");if(!X$)process.exitCode=1;if(!$?.skipDnsVerification)await qX(Z,c.appPublicIp,c.appPublicIpv6)}return}y("Generating CloudFormation template...");let L=new C0({config:Z,environment:Y});L.generate();let D=L.toJSON(),P=JSON.parse(D);if(Object.keys(P.Resources||{}).length===0){W(`No infrastructure resources to deploy for environment '${Y}' — skipping stack ${H}.`);return}y("Validating template...");let _=s0(P),S=i0(D),I=t0(P),g=[..._.errors,...S.errors,...I.errors];if(g.length>0){K("Template validation failed:");for(let C of g)K(`  - ${C.path}: ${C.message}`);return}let f=[..._.warnings,...S.warnings,...I.warnings];if(f.length>0)for(let C of f)N(`  - ${C.path}: ${C.message}`);B("Template validated successfully");let d=Object.keys(P.Resources).length;W(`
 Resources to deploy: ${d}`);let r={};for(let C of Object.values(P.Resources)){let c=C.Type;r[c]=(r[c]||0)+1}for(let[C,c]of Object.entries(r).sort((z$,X$)=>X$[1]-z$[1]).slice(0,5))W(`  - ${C}: ${c}`);if(!(J||await k(`
 Deploy now?`,!0))){W("Deployment cancelled");return}let l=new Y$(j);y("Checking stack status...");let s=!1;try{let C=await l.describeStacks({stackName:H});s=C.Stacks&&C.Stacks.length>0}catch(C){s=!1}if(s){W("Stack exists, updating...");let C=new E("Updating CloudFormation stack...");C.start();try{await l.updateStack({stackName:H,templateBody:D,capabilities:["CAPABILITY_IAM","CAPABILITY_NAMED_IAM"],tags:[{Key:"Project",Value:Z.project.name},{Key:"Environment",Value:Y},{Key:"ManagedBy",Value:"ts-cloud"}]}),C.succeed("Update initiated"),y("Waiting for stack update to complete..."),await l.waitForStack(H,"stack-update-complete"),B("Stack updated successfully!")}catch(c){if(c.message.includes("No updates are to be performed"))C.succeed("No changes detected"),W("Stack is already up to date — continuing to app deploy");else throw c}}else{W("Creating new stack...");let C=new E("Creating CloudFormation stack...");C.start(),await l.createStack({stackName:H,templateBody:D,capabilities:["CAPABILITY_IAM","CAPABILITY_NAMED_IAM"],tags:[{Key:"Project",Value:Z.project.name},{Key:"Environment",Value:Y},{Key:"ManagedBy",Value:"ts-cloud"}]}),C.succeed("Stack creation initiated"),y("Waiting for stack creation to complete..."),await l.waitForStack(H,"stack-create-complete"),B("Stack created successfully!")}let e=await l.getStackOutputs(H);if(n$(`Deployment Complete!
 
@@ -382,14 +382,14 @@ View in console:
 https://console.aws.amazon.com/cloudformation/home?region=${j}#/stacks/stackinfo?stackId=${encodeURIComponent(H)}`,"green"),Object.keys(e).length>0){W(`
 Stack Outputs:`);for(let[C,c]of Object.entries(e))W(`  - ${C}: ${c}`)}if(Z.infrastructure?.storage)for(let[C,c]of Object.entries(Z.infrastructure.storage)){if(!c.website||!c.root)continue;let z$=e[`${C}BucketName`]||e.FrontendBucketName,X$=e[`${C}CloudFrontDistributionId`];if(!z$){N(`Could not find bucket name for storage '${C}' — skipping file upload`);continue}if(!H$(c.root)){N(`Source directory not found: ${c.root} — skipping file upload for '${C}'`);continue}y(`Uploading files from ${c.root} to s3://${z$}...`);let{uploadStaticFiles:h$,invalidateCache:k0}=await import("./chunk-ngcyftm2.js"),j$=await h$({sourceDir:c.root,bucket:z$,region:j,onProgress:(a,i,O$)=>{if(a%10===0||a===i)W(`  ${a}/${i}: ${O$}`)}});if(j$.errors.length>0)N(`Upload completed with errors: ${j$.errors.join(", ")}`);else{let a=j$.skipped>0?`Uploaded ${j$.uploaded} files (${j$.skipped} unchanged)`:`Uploaded ${j$.uploaded} files`;B(a)}if(X$&&j$.uploaded>0){y("Invalidating CloudFront cache...");let{invalidationId:a}=await k0(X$);B(`Cache invalidation created: ${a}`)}}if(Z.infrastructure?.compute)await pJ(Z,Y,j,$?.site);if(Z.infrastructure?.compute&&Z.sites){let C=Object.values(Z.sites).map((c)=>c.domain).filter((c)=>!!c);if(C.length>0)y("Syncing CloudFront dynamic HTTP methods for app domains..."),await s1(C)}}catch(Q){if(K(`Deployment failed: ${Q.message}`),process.exitCode=1,Q.stack)W(`
 Stack trace:`),console.error(Q.stack)}finally{if(X)await X()}}),G.command("deploy:server","Deploy EC2 infrastructure").option("--env <environment>","Environment (production, staging, development)").option("--site <name>","Deploy specific site only (routes are still regenerated in full)").action(async($)=>{R("Deploying Server Infrastructure");try{let J=await x(),Y=$?.env||"production",X=J.project.region||"us-east-1",Q=sJ(J);if(Q){K(Q),process.exitCode=1;return}if(!iJ(J)){K("No `infrastructure.compute` configured — nothing to deploy as a server."),W("Add an EC2 compute block to cloud.config, or use `cloud deploy:serverless` for Lambda apps."),process.exitCode=1;return}if(W(`Region: ${X}`),W(`Environment: ${Y}`),!await pJ(J,Y,X,$?.site)){process.exitCode=1;return}if(J.sites){let z=Object.values(J.sites).map((F)=>F.domain).filter((F)=>!!F);if(z.length>0)y("Syncing CloudFront dynamic HTTP methods for app domains..."),await s1(z)}B(`
-Server deployment complete!`)}catch(J){K(`Deployment failed: ${J.message}`),process.exitCode=1}}),G.command("deploy:serverless","Deploy a serverless application (http/queue/cli Lambda functions)").option("--env <environment>","Environment (production, staging, development)").option("--skip-build","Skip local build hooks").option("--skip-hooks","Skip remote deploy hooks (e.g. migrations)").option("--redeploy","Re-activate the last build without rebuilding").action(async($)=>{try{let J=await x(),Y=$?.env||"production",X=sJ(J);if(X){K(X),process.exitCode=1;return}let{deployServerlessApp:Q,redeployServerlessApp:Z}=await import("./chunk-41x17hw1.js");if($?.redeploy){await Z(J,Y);return}await Q(J,Y,{skipBuild:$?.skipBuild,skipDeployHooks:$?.skipHooks})}catch(J){K(`Deployment failed: ${J.message}`),process.exitCode=1}}),G.command("serverless:rollback","Roll back a serverless app to the previous build").option("--env <environment>","Environment (production, staging, development)").action(async($)=>{try{let J=await x(),Y=$?.env||"production",{rollbackServerlessApp:X}=await import("./chunk-41x17hw1.js");await X(J,Y)}catch(J){K(`Rollback failed: ${J.message}`),process.exitCode=1}}),G.command("deploy:rollback [site]","Roll a compute site back to a previous release").option("--env <environment>","Environment (production, staging, development)").option("--to <release>","Release id to roll back to (default: the previous release)").action(async($,J)=>{R("Rolling Back Release");try{let Y=await x(),X=J?.env||"production",Q=$||Object.keys(Y.sites||{})[0];if(!Q){K("No site configured to roll back."),process.exitCode=1;return}let{rollbackComputeSite:Z}=await import("./chunk-92mea34a.js"),z=await Z({driver:c$({config:Y}),slug:Y.project.slug,environment:X,logger:v},{siteName:Q,to:J?.to});if(!z.success){K(`Rollback failed: ${z.error||"unknown error"}`),process.exitCode=1;return}for(let F of z.perInstance||[])W(`  ${F.instanceId}: ${F.output?.trim()||F.status}`)}catch(Y){K(`Rollback failed: ${Y.message}`),process.exitCode=1}}),G.command("deploy:history [site]","Show a compute site's deployment history").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Number of entries to show",{default:"20"}).action(async($,J)=>{R("Deployment History");try{let Y=await x(),X=J?.env||"production",Q=$||Object.keys(Y.sites||{})[0];if(!Q){K("No site configured."),process.exitCode=1;return}let{getComputeDeployHistory:Z}=await import("./chunk-92mea34a.js"),z=await Z({driver:c$({config:Y}),slug:Y.project.slug,environment:X,logger:v},{siteName:Q,limit:Number.parseInt(J?.limit||"20",10)||20});if(!z.success){K(`Could not read history: ${z.error||"unknown error"}`),process.exitCode=1;return}for(let F of z.perInstance||[])W(`
+Server deployment complete!`)}catch(J){K(`Deployment failed: ${J.message}`),process.exitCode=1}}),G.command("deploy:serverless","Deploy a serverless application (http/queue/cli Lambda functions)").option("--env <environment>","Environment (production, staging, development)").option("--skip-build","Skip local build hooks").option("--skip-hooks","Skip remote deploy hooks (e.g. migrations)").option("--redeploy","Re-activate the last build without rebuilding").action(async($)=>{try{let J=await x(),Y=$?.env||"production",X=sJ(J);if(X){K(X),process.exitCode=1;return}let{deployServerlessApp:Q,redeployServerlessApp:Z}=await import("./chunk-5mrtzemj.js");if($?.redeploy){await Z(J,Y);return}await Q(J,Y,{skipBuild:$?.skipBuild,skipDeployHooks:$?.skipHooks})}catch(J){K(`Deployment failed: ${J.message}`),process.exitCode=1}}),G.command("serverless:rollback","Roll back a serverless app to the previous build").option("--env <environment>","Environment (production, staging, development)").action(async($)=>{try{let J=await x(),Y=$?.env||"production",{rollbackServerlessApp:X}=await import("./chunk-5mrtzemj.js");await X(J,Y)}catch(J){K(`Rollback failed: ${J.message}`),process.exitCode=1}}),G.command("deploy:rollback [site]","Roll a compute site back to a previous release").option("--env <environment>","Environment (production, staging, development)").option("--to <release>","Release id to roll back to (default: the previous release)").action(async($,J)=>{R("Rolling Back Release");try{let Y=await x(),X=J?.env||"production",Q=$||Object.keys(Y.sites||{})[0];if(!Q){K("No site configured to roll back."),process.exitCode=1;return}let{rollbackComputeSite:Z}=await import("./chunk-m7dgskt1.js"),z=await Z({driver:c$({config:Y}),slug:Y.project.slug,environment:X,logger:v},{siteName:Q,to:J?.to});if(!z.success){K(`Rollback failed: ${z.error||"unknown error"}`),process.exitCode=1;return}for(let F of z.perInstance||[])W(`  ${F.instanceId}: ${F.output?.trim()||F.status}`)}catch(Y){K(`Rollback failed: ${Y.message}`),process.exitCode=1}}),G.command("deploy:history [site]","Show a compute site's deployment history").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Number of entries to show",{default:"20"}).action(async($,J)=>{R("Deployment History");try{let Y=await x(),X=J?.env||"production",Q=$||Object.keys(Y.sites||{})[0];if(!Q){K("No site configured."),process.exitCode=1;return}let{getComputeDeployHistory:Z}=await import("./chunk-m7dgskt1.js"),z=await Z({driver:c$({config:Y}),slug:Y.project.slug,environment:X,logger:v},{siteName:Q,limit:Number.parseInt(J?.limit||"20",10)||20});if(!z.success){K(`Could not read history: ${z.error||"unknown error"}`),process.exitCode=1;return}for(let F of z.perInstance||[])W(`
 ${F.instanceId}:`),W(F.output?.trimEnd()||"(no output)")}catch(Y){K(`History lookup failed: ${Y.message}`),process.exitCode=1}}),G.command("deploy:recipe <name> <script>","Run a reusable server recipe (a local bash file) across servers").option("--env <environment>","Environment (production, staging, development)").option("--user <user>","User to run the recipe as",{default:"root"}).action(async($,J,Y)=>{R(`Running Recipe: ${$}`);try{if(!H$(J)){K(`Recipe script not found: ${J}`),process.exitCode=1;return}let X=await x(),Q=Y?.env||"production",Z=tJ(J,"utf8").split(`
-`),{runComputeRecipe:z}=await import("./chunk-92mea34a.js"),F=await z({driver:c$({config:X}),slug:X.project.slug,environment:Q,logger:v},{name:$,script:Z,user:Y?.user});for(let U of F.perInstance||[])W(`
-${U.instanceId}:`),W(U.output?.trimEnd()||"(no output)");if(!F.success)process.exitCode=1}catch(X){K(`Recipe failed: ${X.message}`),process.exitCode=1}}),G.command("db:restore-backup [from]","Restore the app database from an on-box ts-backups dump (latest, or a given file)").option("--env <environment>","Environment (production, staging, development)").action(async($,J)=>{R("Database Restore");try{let Y=await x(),X=J?.env||"production",{restoreDatabaseBackup:Q}=await import("./chunk-92mea34a.js"),Z=await Q({driver:c$({config:Y}),slug:Y.project.slug,environment:X,logger:v},{database:D2(Y),from:$});for(let z of Z.perInstance||[])W(`  ${z.instanceId}: ${z.output?.trim()||z.status}`);if(!Z.success)K(`Restore failed: ${Z.error||"unknown error"}`),process.exitCode=1}catch(Y){K(`Restore failed: ${Y.message}`),process.exitCode=1}}),G.command("quick-deploy","Generate a push-to-deploy CI pipeline for your git provider (Forge Quick Deploy)").option("--env <environment>","Environment to deploy on push",{default:"production"}).option("--provider <provider>","CI provider (github, gitlab, bitbucket); defaults to the origin remote").option("--site <site>","Deploy only this configured site").option("--skip-dns-verification","Generate a deploy that skips DNS verification and record creation").option("--ssh-key-secret <name>","CI secret/variable containing the Hetzner deployment SSH private key",{default:"SSH_PRIVATE_KEY"}).option("--force","Overwrite an existing pipeline file").action(async($)=>{R("Quick Deploy (push-to-deploy)");try{let J=await x(),{buildQuickDeployCi:Y,inferQuickDeployProvider:X}=await import("./chunk-14cwr6eh.js"),Q=$?.provider?.toLowerCase();if(Q&&!["github","gitlab","bitbucket"].includes(Q))throw Error(`Unsupported CI provider '${$?.provider}'. Use github, gitlab, or bitbucket.`);let Z=Q;if(!Z)try{let F=H5("git remote get-url origin",{stdio:["ignore","pipe","ignore"]}).toString().trim();Z=X(F)}catch{}let z=Y(J,$?.env||"production",{provider:Z,site:$?.site,skipDnsVerification:$?.skipDnsVerification,setup:H$("pantry.lock")?"pantry":"bun",sshPrivateKeySecret:$?.sshKeySecret});if(!z){N("Could not resolve a GitHub, GitLab, or Bitbucket provider from --provider, the origin remote, or a configured site repository."),process.exitCode=1;return}if(H$(z.path)&&!$?.force){N(`${z.path} already exists — re-run with --force to overwrite.`);return}C2(zX(z.path),{recursive:!0}),WX(z.path,z.content),B(`Wrote ${z.path} (${z.provider}, deploys on push to '${z.branch}').`),W("Next: commit it and add your provider credentials as CI secrets/variables.")}catch(J){K(`Quick deploy setup failed: ${J.message}`),process.exitCode=1}}),G.command("down","Put the serverless app into maintenance mode (503)").option("--env <environment>","Environment (production, staging, development)").option("--secret <secret>","Bypass secret (send as x-maintenance-bypass header)").action(async($)=>{try{let J=await x(),Y=$?.env||"production",{setMaintenance:X}=await import("./chunk-41x17hw1.js");await X(J,Y,!0,$?.secret)}catch(J){K(`Failed to enable maintenance mode: ${J.message}`),process.exitCode=1}}),G.command("up","Bring the serverless app out of maintenance mode").option("--env <environment>","Environment (production, staging, development)").action(async($)=>{try{let J=await x(),Y=$?.env||"production",{setMaintenance:X}=await import("./chunk-41x17hw1.js");await X(J,Y,!1)}catch(J){K(`Failed to disable maintenance mode: ${J.message}`),process.exitCode=1}}),G.command("command <cmd>","Run a command on the serverless CLI function (e.g. migrations)").option("--env <environment>","Environment (production, staging, development)").action(async($,J)=>{try{let Y=await x(),X=J?.env||"production",{runAndRecordCommand:Q}=await import("./chunk-41x17hw1.js"),{id:Z,output:z}=await Q(Y,X,$);if(W(z),Z>0)W(`
-(recorded as #${Z} — re-run with \`cloud command:again ${Z}\`)`)}catch(Y){K(`Command failed: ${Y.message}`),process.exitCode=1}}),G.command("command:history","List recorded CLI-function command invocations").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Show at most this many (most recent)",{default:"20"}).action(async($)=>{try{let J=await x(),Y=$?.env||"production",{listCommandHistory:X}=await import("./chunk-41x17hw1.js"),Q=await X(J,Y);if(!Q.length){W("No command history yet.");return}let Z=Number($?.limit??20);R(`Command history — ${J.project.slug} (${Y})`),w(["#","When","Status","Command"],Q.slice(-Z).reverse().map((z)=>[String(z.id),z.timestamp,z.status,z.command]))}catch(J){K(`Failed to read history: ${J.message}`),process.exitCode=1}}),G.command("command:again [id]","Re-run a recorded command (defaults to the most recent)").option("--env <environment>","Environment (production, staging, development)").action(async($,J)=>{try{let Y=await x(),X=J?.env||"production",{getCommandRecord:Q,runAndRecordCommand:Z}=await import("./chunk-41x17hw1.js"),z=await Q(Y,X,$?Number($):void 0);if(!z){K($?`No command #${$} in history.`:"No command history to re-run."),process.exitCode=1;return}W(`Re-running #${z.id}: ${z.command}`);let F=await Z(Y,X,z.command);if(W(F.output),F.id>0)W(`
-(recorded as #${F.id})`)}catch(Y){K(`Command failed: ${Y.message}`),process.exitCode=1}}),G.command("serverless:db-shell <sql>","Run a SQL statement against a private serverless database (via the CLI function)").option("--env <environment>","Environment (production, staging, development)").action(async($,J)=>{try{let Y=await x(),X=J?.env||"production",{runDbQuery:Q}=await import("./chunk-41x17hw1.js"),Z=await Q(Y,X,$);W(Z)}catch(Y){K(`Query failed: ${Y.message}`),process.exitCode=1}}),G.command("serverless:db-scale <min> <max>","Rescale the serverless Aurora cluster (min/max ACUs)").option("--env <environment>","Environment (production, staging, development)").action(async($,J,Y)=>{R("Scaling serverless database");try{let X=await x(),Q=Y?.env||"production",Z=Number($),z=Number(J);if(!(Z>0)||!(z>=Z)){K("Provide valid capacities: min > 0 and max >= min (e.g. `serverless:db-scale 0.5 8`)."),process.exitCode=1;return}let{scaleServerlessDatabase:F}=await import("./chunk-41x17hw1.js");await F(X,Q,Z,z)}catch(X){K(`Scale failed: ${X.message}`),process.exitCode=1}}),G.command("serverless:db-restore","Restore the serverless Aurora cluster to a point in time (as a new cluster)").option("--env <environment>","Environment (production, staging, development)").option("--to <timestamp>","Restore to this ISO-8601 time (UTC)").option("--latest","Restore to the latest restorable time").option("--target <id>","New cluster identifier (defaults to <cluster>-restore-<stamp>)").action(async($)=>{R("Restoring serverless database");try{let J=await x(),Y=$?.env||"production",X;if($?.to){if(X=new Date($.to),Number.isNaN(X.getTime())){K(`Invalid --to timestamp: ${$.to} (use ISO-8601, e.g. 2026-06-18T10:00:00Z).`),process.exitCode=1;return}}let{restoreServerlessDatabase:Q}=await import("./chunk-41x17hw1.js");await Q(J,Y,{toTime:X,latest:$?.latest,target:$?.target})}catch(J){K(`Restore failed: ${J.message}`),process.exitCode=1}}),G.command("serverless:info","Show an operational summary of a deployed serverless app").option("--env <environment>","Environment (production, staging, development)").action(async($)=>{try{let J=await x(),Y=$?.env||"production",{serverlessInfo:X}=await import("./chunk-41x17hw1.js"),Q=await X(J,Y);if(R(`${Q.slug} (${Q.environment})`),W(`Stack:    ${Q.stackStatus}`),W(`Region:   ${Q.region}`),Q.endpoint)W(`URL:      ${Q.endpoint}`);if(Q.assetUrl)W(`Assets:   ${Q.assetUrl}`);if(W(`Scheduler:${Q.scheduler==="off"?" off":` ${Q.scheduler}`}`),W(`Queues:   ${Q.queues.length?Q.queues.join(", "):"none"}`),W(`Warming:  ${Q.provisionedConcurrency>0?`provisioned concurrency ×${Q.provisionedConcurrency}`:"none / ping-warm"}`),Q.lastRelease)W(`Release:  ${Q.lastRelease.sha.slice(0,12)} @ ${Q.lastRelease.timestamp}`);w(["Function","Version","Provisioned"],Q.functions.map((Z)=>[Z.name,Z.version,Z.provisioned?`${Z.provisioned.status} ${Z.provisioned.allocated}/${Z.provisioned.requested}`:"—"]))}catch(J){K(`Failed to read info: ${J.message}`),process.exitCode=1}}),G.command("dashboard:build","Build the management dashboard with live data baked in").option("--env <environment>","Environment (production, staging, development)").option("--ui <dir>","UI directory (default ./ui)",{default:"ui"}).action(async($)=>{R("Building management dashboard (live data)");try{let{existsSync:J}=await import("node:fs"),Y=$?.ui||"ui";if(!J(`${Y}/package.json`)){K(`No UI project at ${Y}/ (expected ${Y}/package.json). Pass --ui <dir>.`),process.exitCode=1;return}let X=await x(),Q=$?.env||"production";y("Gathering live data from AWS");let Z=null;if(X.environments?.[Q]?.app){let{resolveDashboardData:M}=await import("./chunk-rtczra13.js"),H=await M(X,Q).catch((j)=>{return N(`Serverless data unavailable (${j.message}) — that view uses sample data.`),null});if(H)Z={...Z??{},...H}}if(X.infrastructure?.compute){let{resolveServerDashboardData:M}=await import("./chunk-8v7ddyvf.js"),H=await M(X,Q).catch(()=>null);if(H){if(H._serverReachable===!1)N("Server box not reachable over SSM — server view uses config + sample data.");Z={...Z??{},...H}}}y("Building dashboard");let{encodeDashboardPayload:z}=await import("./chunk-fz21b57w.js"),{execSync:F}=await import("node:child_process"),{rmSync:U}=await import("node:fs");for(let M of[".stx/ssg-cache",".stx/cache"])U(`${Y}/${M}`,{recursive:!0,force:!0});F("bun run build",{cwd:Y,stdio:"inherit",env:{...process.env,...Z?{TSCLOUD_DASHBOARD_DATA:z(Z)}:{}}}),B(`Dashboard built → ${Y}/dist${Z?" (live data)":" (sample data)"}`)}catch(J){K(`Dashboard build failed: ${J.message}`),process.exitCode=1}}),G.command("serverless:build-php-layer","Build + publish the ts-cloud PHP runtime layer (requires Docker)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--php <version>","PHP version",{default:"8.3"}).option("--name <name>","Layer name",{default:"tscloud-php"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async($)=>{R("Building PHP runtime layer");try{let J=await x().catch(()=>null),Y=$?.region||J?.project.region||"us-east-1",X=$?.arch||"x86_64",Q=$?.php||"8.3",Z=`${$?.name||"tscloud-php"}-${Q.replace(".","")}-${X}`,z=$?.bucket||`${J?.project.slug||"tscloud"}-layers`,{buildPhpRuntimeLayerZip:F}=await import("./chunk-p8q9bq9g.js"),{S3Client:U}=await import("./chunk-598yf4bs.js"),{LambdaClient:M}=await import("./chunk-9pvsff8g.js"),H=F({architecture:X,phpVersion:Q,onStep:(q)=>y(q)});W(`Layer: ${H.fileCount} files, ${(H.zip.length/1024/1024).toFixed(1)} MB`);let j=new U(Y);if(!await j.bucketExists(z))y(`Creating layer bucket ${z}`),await j.createBucket(z);let V=`layers/${Z}.zip`;y("Uploading layer zip"),await j.putObject({bucket:z,key:V,body:H.zip,contentType:"application/zip"}),y("Publishing layer version");let A=await new M(Y).publishLayerVersion({LayerName:Z,Description:`ts-cloud PHP ${Q} runtime (${X})`,Content:{S3Bucket:z,S3Key:V},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[X]});n$(["PHP runtime layer published","",`ARN: ${A.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'php', layers: ['${A.LayerVersionArn}'] }`,"or set TSCLOUD_PHP_LAYER_ARN before deploying."].join(`
-`),"green")}catch(J){K(`Layer build failed: ${J.message}`),process.exitCode=1}}),G.command("serverless:build-node-layer","Build + publish a ts-cloud Node custom runtime layer (any version, incl. 24)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--node <version>","Node version (e.g. 24)",{default:"24"}).option("--name <name>","Layer name",{default:"tscloud-node"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async($)=>{R("Building Node runtime layer");try{let J=await x().catch(()=>null),Y=$?.region||J?.project.region||"us-east-1",X=$?.arch||"x86_64",Q=$?.node||"24",{buildNodeRuntimeLayerZip:Z}=await import("./chunk-p8q9bq9g.js"),{S3Client:z}=await import("./chunk-598yf4bs.js"),{LambdaClient:F}=await import("./chunk-9pvsff8g.js"),U=Z({architecture:X,version:Q,onStep:(q)=>y(q)}),M=`${$?.name||"tscloud-node"}-${U.version.split(".")[0]}-${X}`,H=$?.bucket||`${J?.project.slug||"tscloud"}-layers`;W(`Layer: Node ${U.version}, ${(U.zip.length/1024/1024).toFixed(1)} MB`);let j=new z(Y);if(!await j.bucketExists(H))y(`Creating layer bucket ${H}`),await j.createBucket(H);let V=`layers/${M}.zip`;y("Uploading layer zip"),await j.putObject({bucket:H,key:V,body:U.zip,contentType:"application/zip"}),y("Publishing layer version");let A=await new F(Y).publishLayerVersion({LayerName:M,Description:`ts-cloud Node ${U.version} runtime (${X})`,Content:{S3Bucket:H,S3Key:V},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[X]});n$(["Node runtime layer published","",`ARN: ${A.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'node', runtimeVersion: '${U.version.split(".")[0]}', layers: ['${A.LayerVersionArn}'] }`,"or set TSCLOUD_NODE_LAYER_ARN before deploying."].join(`
-`),"green")}catch(J){K(`Layer build failed: ${J.message}`),process.exitCode=1}}),G.command("serverless:build-bun-layer","Build + publish a ts-cloud Bun custom runtime layer").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--bun <version>",'Bun version (e.g. 1.3.13, or "latest")',{default:"latest"}).option("--name <name>","Layer name",{default:"tscloud-bun"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async($)=>{R("Building Bun runtime layer");try{let J=await x().catch(()=>null),Y=$?.region||J?.project.region||"us-east-1",X=$?.arch||"x86_64",Q=$?.bun||"latest",{buildBunRuntimeLayerZip:Z}=await import("./chunk-p8q9bq9g.js"),{S3Client:z}=await import("./chunk-598yf4bs.js"),{LambdaClient:F}=await import("./chunk-9pvsff8g.js"),U=Z({architecture:X,version:Q,onStep:(q)=>y(q)}),M=`${$?.name||"tscloud-bun"}-${U.version.replace(/\./g,"")}-${X}`,H=$?.bucket||`${J?.project.slug||"tscloud"}-layers`;W(`Layer: Bun ${U.version}, ${(U.zip.length/1024/1024).toFixed(1)} MB`);let j=new z(Y);if(!await j.bucketExists(H))y(`Creating layer bucket ${H}`),await j.createBucket(H);let V=`layers/${M}.zip`;y("Uploading layer zip"),await j.putObject({bucket:H,key:V,body:U.zip,contentType:"application/zip"}),y("Publishing layer version");let A=await new F(Y).publishLayerVersion({LayerName:M,Description:`ts-cloud Bun ${U.version} runtime (${X})`,Content:{S3Bucket:H,S3Key:V},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[X]});n$(["Bun runtime layer published","",`ARN: ${A.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'bun', layers: ['${A.LayerVersionArn}'] }`,"or set TSCLOUD_BUN_LAYER_ARN before deploying."].join(`
+`),{runComputeRecipe:z}=await import("./chunk-m7dgskt1.js"),F=await z({driver:c$({config:X}),slug:X.project.slug,environment:Q,logger:v},{name:$,script:Z,user:Y?.user});for(let U of F.perInstance||[])W(`
+${U.instanceId}:`),W(U.output?.trimEnd()||"(no output)");if(!F.success)process.exitCode=1}catch(X){K(`Recipe failed: ${X.message}`),process.exitCode=1}}),G.command("db:restore-backup [from]","Restore the app database from an on-box ts-backups dump (latest, or a given file)").option("--env <environment>","Environment (production, staging, development)").action(async($,J)=>{R("Database Restore");try{let Y=await x(),X=J?.env||"production",{restoreDatabaseBackup:Q}=await import("./chunk-m7dgskt1.js"),Z=await Q({driver:c$({config:Y}),slug:Y.project.slug,environment:X,logger:v},{database:D2(Y),from:$});for(let z of Z.perInstance||[])W(`  ${z.instanceId}: ${z.output?.trim()||z.status}`);if(!Z.success)K(`Restore failed: ${Z.error||"unknown error"}`),process.exitCode=1}catch(Y){K(`Restore failed: ${Y.message}`),process.exitCode=1}}),G.command("quick-deploy","Generate a push-to-deploy CI pipeline for your git provider (Forge Quick Deploy)").option("--env <environment>","Environment to deploy on push",{default:"production"}).option("--provider <provider>","CI provider (github, gitlab, bitbucket); defaults to the origin remote").option("--site <site>","Deploy only this configured site").option("--skip-dns-verification","Generate a deploy that skips DNS verification and record creation").option("--ssh-key-secret <name>","CI secret/variable containing the Hetzner deployment SSH private key",{default:"SSH_PRIVATE_KEY"}).option("--force","Overwrite an existing pipeline file").action(async($)=>{R("Quick Deploy (push-to-deploy)");try{let J=await x(),{buildQuickDeployCi:Y,inferQuickDeployProvider:X}=await import("./chunk-3vqfexc4.js"),Q=$?.provider?.toLowerCase();if(Q&&!["github","gitlab","bitbucket"].includes(Q))throw Error(`Unsupported CI provider '${$?.provider}'. Use github, gitlab, or bitbucket.`);let Z=Q;if(!Z)try{let F=H5("git remote get-url origin",{stdio:["ignore","pipe","ignore"]}).toString().trim();Z=X(F)}catch{}let z=Y(J,$?.env||"production",{provider:Z,site:$?.site,skipDnsVerification:$?.skipDnsVerification,setup:H$("pantry.lock")?"pantry":"bun",sshPrivateKeySecret:$?.sshKeySecret});if(!z){N("Could not resolve a GitHub, GitLab, or Bitbucket provider from --provider, the origin remote, or a configured site repository."),process.exitCode=1;return}if(H$(z.path)&&!$?.force){N(`${z.path} already exists — re-run with --force to overwrite.`);return}C2(zX(z.path),{recursive:!0}),WX(z.path,z.content),B(`Wrote ${z.path} (${z.provider}, deploys on push to '${z.branch}').`),W("Next: commit it and add your provider credentials as CI secrets/variables.")}catch(J){K(`Quick deploy setup failed: ${J.message}`),process.exitCode=1}}),G.command("down","Put the serverless app into maintenance mode (503)").option("--env <environment>","Environment (production, staging, development)").option("--secret <secret>","Bypass secret (send as x-maintenance-bypass header)").action(async($)=>{try{let J=await x(),Y=$?.env||"production",{setMaintenance:X}=await import("./chunk-5mrtzemj.js");await X(J,Y,!0,$?.secret)}catch(J){K(`Failed to enable maintenance mode: ${J.message}`),process.exitCode=1}}),G.command("up","Bring the serverless app out of maintenance mode").option("--env <environment>","Environment (production, staging, development)").action(async($)=>{try{let J=await x(),Y=$?.env||"production",{setMaintenance:X}=await import("./chunk-5mrtzemj.js");await X(J,Y,!1)}catch(J){K(`Failed to disable maintenance mode: ${J.message}`),process.exitCode=1}}),G.command("command <cmd>","Run a command on the serverless CLI function (e.g. migrations)").option("--env <environment>","Environment (production, staging, development)").action(async($,J)=>{try{let Y=await x(),X=J?.env||"production",{runAndRecordCommand:Q}=await import("./chunk-5mrtzemj.js"),{id:Z,output:z}=await Q(Y,X,$);if(W(z),Z>0)W(`
+(recorded as #${Z} — re-run with \`cloud command:again ${Z}\`)`)}catch(Y){K(`Command failed: ${Y.message}`),process.exitCode=1}}),G.command("command:history","List recorded CLI-function command invocations").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Show at most this many (most recent)",{default:"20"}).action(async($)=>{try{let J=await x(),Y=$?.env||"production",{listCommandHistory:X}=await import("./chunk-5mrtzemj.js"),Q=await X(J,Y);if(!Q.length){W("No command history yet.");return}let Z=Number($?.limit??20);R(`Command history — ${J.project.slug} (${Y})`),w(["#","When","Status","Command"],Q.slice(-Z).reverse().map((z)=>[String(z.id),z.timestamp,z.status,z.command]))}catch(J){K(`Failed to read history: ${J.message}`),process.exitCode=1}}),G.command("command:again [id]","Re-run a recorded command (defaults to the most recent)").option("--env <environment>","Environment (production, staging, development)").action(async($,J)=>{try{let Y=await x(),X=J?.env||"production",{getCommandRecord:Q,runAndRecordCommand:Z}=await import("./chunk-5mrtzemj.js"),z=await Q(Y,X,$?Number($):void 0);if(!z){K($?`No command #${$} in history.`:"No command history to re-run."),process.exitCode=1;return}W(`Re-running #${z.id}: ${z.command}`);let F=await Z(Y,X,z.command);if(W(F.output),F.id>0)W(`
+(recorded as #${F.id})`)}catch(Y){K(`Command failed: ${Y.message}`),process.exitCode=1}}),G.command("serverless:db-shell <sql>","Run a SQL statement against a private serverless database (via the CLI function)").option("--env <environment>","Environment (production, staging, development)").action(async($,J)=>{try{let Y=await x(),X=J?.env||"production",{runDbQuery:Q}=await import("./chunk-5mrtzemj.js"),Z=await Q(Y,X,$);W(Z)}catch(Y){K(`Query failed: ${Y.message}`),process.exitCode=1}}),G.command("serverless:db-scale <min> <max>","Rescale the serverless Aurora cluster (min/max ACUs)").option("--env <environment>","Environment (production, staging, development)").action(async($,J,Y)=>{R("Scaling serverless database");try{let X=await x(),Q=Y?.env||"production",Z=Number($),z=Number(J);if(!(Z>0)||!(z>=Z)){K("Provide valid capacities: min > 0 and max >= min (e.g. `serverless:db-scale 0.5 8`)."),process.exitCode=1;return}let{scaleServerlessDatabase:F}=await import("./chunk-5mrtzemj.js");await F(X,Q,Z,z)}catch(X){K(`Scale failed: ${X.message}`),process.exitCode=1}}),G.command("serverless:db-restore","Restore the serverless Aurora cluster to a point in time (as a new cluster)").option("--env <environment>","Environment (production, staging, development)").option("--to <timestamp>","Restore to this ISO-8601 time (UTC)").option("--latest","Restore to the latest restorable time").option("--target <id>","New cluster identifier (defaults to <cluster>-restore-<stamp>)").action(async($)=>{R("Restoring serverless database");try{let J=await x(),Y=$?.env||"production",X;if($?.to){if(X=new Date($.to),Number.isNaN(X.getTime())){K(`Invalid --to timestamp: ${$.to} (use ISO-8601, e.g. 2026-06-18T10:00:00Z).`),process.exitCode=1;return}}let{restoreServerlessDatabase:Q}=await import("./chunk-5mrtzemj.js");await Q(J,Y,{toTime:X,latest:$?.latest,target:$?.target})}catch(J){K(`Restore failed: ${J.message}`),process.exitCode=1}}),G.command("serverless:info","Show an operational summary of a deployed serverless app").option("--env <environment>","Environment (production, staging, development)").action(async($)=>{try{let J=await x(),Y=$?.env||"production",{serverlessInfo:X}=await import("./chunk-5mrtzemj.js"),Q=await X(J,Y);if(R(`${Q.slug} (${Q.environment})`),W(`Stack:    ${Q.stackStatus}`),W(`Region:   ${Q.region}`),Q.endpoint)W(`URL:      ${Q.endpoint}`);if(Q.assetUrl)W(`Assets:   ${Q.assetUrl}`);if(W(`Scheduler:${Q.scheduler==="off"?" off":` ${Q.scheduler}`}`),W(`Queues:   ${Q.queues.length?Q.queues.join(", "):"none"}`),W(`Warming:  ${Q.provisionedConcurrency>0?`provisioned concurrency ×${Q.provisionedConcurrency}`:"none / ping-warm"}`),Q.lastRelease)W(`Release:  ${Q.lastRelease.sha.slice(0,12)} @ ${Q.lastRelease.timestamp}`);w(["Function","Version","Provisioned"],Q.functions.map((Z)=>[Z.name,Z.version,Z.provisioned?`${Z.provisioned.status} ${Z.provisioned.allocated}/${Z.provisioned.requested}`:"—"]))}catch(J){K(`Failed to read info: ${J.message}`),process.exitCode=1}}),G.command("dashboard:build","Build the management dashboard with live data baked in").option("--env <environment>","Environment (production, staging, development)").option("--ui <dir>","UI directory (default ./ui)",{default:"ui"}).action(async($)=>{R("Building management dashboard (live data)");try{let{existsSync:J}=await import("node:fs"),Y=$?.ui||"ui";if(!J(`${Y}/package.json`)){K(`No UI project at ${Y}/ (expected ${Y}/package.json). Pass --ui <dir>.`),process.exitCode=1;return}let X=await x(),Q=$?.env||"production";y("Gathering live data from AWS");let Z=null;if(X.environments?.[Q]?.app){let{resolveDashboardData:M}=await import("./chunk-5ectjq0b.js"),H=await M(X,Q).catch((j)=>{return N(`Serverless data unavailable (${j.message}) — that view uses sample data.`),null});if(H)Z={...Z??{},...H}}if(X.infrastructure?.compute){let{resolveServerDashboardData:M}=await import("./chunk-k9t9wvms.js"),H=await M(X,Q).catch(()=>null);if(H){if(H._serverReachable===!1)N("Server box not reachable over SSM — server view uses config + sample data.");Z={...Z??{},...H}}}y("Building dashboard");let{encodeDashboardPayload:z}=await import("./chunk-fz21b57w.js"),{execSync:F}=await import("node:child_process"),{rmSync:U}=await import("node:fs");for(let M of[".stx/ssg-cache",".stx/cache"])U(`${Y}/${M}`,{recursive:!0,force:!0});F("bun run build",{cwd:Y,stdio:"inherit",env:{...process.env,...Z?{TSCLOUD_DASHBOARD_DATA:z(Z)}:{}}}),B(`Dashboard built → ${Y}/dist${Z?" (live data)":" (sample data)"}`)}catch(J){K(`Dashboard build failed: ${J.message}`),process.exitCode=1}}),G.command("serverless:build-php-layer","Build + publish the ts-cloud PHP runtime layer (requires Docker)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--php <version>","PHP version",{default:"8.3"}).option("--name <name>","Layer name",{default:"tscloud-php"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async($)=>{R("Building PHP runtime layer");try{let J=await x().catch(()=>null),Y=$?.region||J?.project.region||"us-east-1",X=$?.arch||"x86_64",Q=$?.php||"8.3",Z=`${$?.name||"tscloud-php"}-${Q.replace(".","")}-${X}`,z=$?.bucket||`${J?.project.slug||"tscloud"}-layers`,{buildPhpRuntimeLayerZip:F}=await import("./chunk-5n9fmabb.js"),{S3Client:U}=await import("./chunk-598yf4bs.js"),{LambdaClient:M}=await import("./chunk-9pvsff8g.js"),H=F({architecture:X,phpVersion:Q,onStep:(q)=>y(q)});W(`Layer: ${H.fileCount} files, ${(H.zip.length/1024/1024).toFixed(1)} MB`);let j=new U(Y);if(!await j.bucketExists(z))y(`Creating layer bucket ${z}`),await j.createBucket(z);let V=`layers/${Z}.zip`;y("Uploading layer zip"),await j.putObject({bucket:z,key:V,body:H.zip,contentType:"application/zip"}),y("Publishing layer version");let A=await new M(Y).publishLayerVersion({LayerName:Z,Description:`ts-cloud PHP ${Q} runtime (${X})`,Content:{S3Bucket:z,S3Key:V},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[X]});n$(["PHP runtime layer published","",`ARN: ${A.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'php', layers: ['${A.LayerVersionArn}'] }`,"or set TSCLOUD_PHP_LAYER_ARN before deploying."].join(`
+`),"green")}catch(J){K(`Layer build failed: ${J.message}`),process.exitCode=1}}),G.command("serverless:build-node-layer","Build + publish a ts-cloud Node custom runtime layer (any version, incl. 24)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--node <version>","Node version (e.g. 24)",{default:"24"}).option("--name <name>","Layer name",{default:"tscloud-node"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async($)=>{R("Building Node runtime layer");try{let J=await x().catch(()=>null),Y=$?.region||J?.project.region||"us-east-1",X=$?.arch||"x86_64",Q=$?.node||"24",{buildNodeRuntimeLayerZip:Z}=await import("./chunk-5n9fmabb.js"),{S3Client:z}=await import("./chunk-598yf4bs.js"),{LambdaClient:F}=await import("./chunk-9pvsff8g.js"),U=Z({architecture:X,version:Q,onStep:(q)=>y(q)}),M=`${$?.name||"tscloud-node"}-${U.version.split(".")[0]}-${X}`,H=$?.bucket||`${J?.project.slug||"tscloud"}-layers`;W(`Layer: Node ${U.version}, ${(U.zip.length/1024/1024).toFixed(1)} MB`);let j=new z(Y);if(!await j.bucketExists(H))y(`Creating layer bucket ${H}`),await j.createBucket(H);let V=`layers/${M}.zip`;y("Uploading layer zip"),await j.putObject({bucket:H,key:V,body:U.zip,contentType:"application/zip"}),y("Publishing layer version");let A=await new F(Y).publishLayerVersion({LayerName:M,Description:`ts-cloud Node ${U.version} runtime (${X})`,Content:{S3Bucket:H,S3Key:V},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[X]});n$(["Node runtime layer published","",`ARN: ${A.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'node', runtimeVersion: '${U.version.split(".")[0]}', layers: ['${A.LayerVersionArn}'] }`,"or set TSCLOUD_NODE_LAYER_ARN before deploying."].join(`
+`),"green")}catch(J){K(`Layer build failed: ${J.message}`),process.exitCode=1}}),G.command("serverless:build-bun-layer","Build + publish a ts-cloud Bun custom runtime layer").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--bun <version>",'Bun version (e.g. 1.3.13, or "latest")',{default:"latest"}).option("--name <name>","Layer name",{default:"tscloud-bun"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async($)=>{R("Building Bun runtime layer");try{let J=await x().catch(()=>null),Y=$?.region||J?.project.region||"us-east-1",X=$?.arch||"x86_64",Q=$?.bun||"latest",{buildBunRuntimeLayerZip:Z}=await import("./chunk-5n9fmabb.js"),{S3Client:z}=await import("./chunk-598yf4bs.js"),{LambdaClient:F}=await import("./chunk-9pvsff8g.js"),U=Z({architecture:X,version:Q,onStep:(q)=>y(q)}),M=`${$?.name||"tscloud-bun"}-${U.version.replace(/\./g,"")}-${X}`,H=$?.bucket||`${J?.project.slug||"tscloud"}-layers`;W(`Layer: Bun ${U.version}, ${(U.zip.length/1024/1024).toFixed(1)} MB`);let j=new z(Y);if(!await j.bucketExists(H))y(`Creating layer bucket ${H}`),await j.createBucket(H);let V=`layers/${M}.zip`;y("Uploading layer zip"),await j.putObject({bucket:H,key:V,body:U.zip,contentType:"application/zip"}),y("Publishing layer version");let A=await new F(Y).publishLayerVersion({LayerName:M,Description:`ts-cloud Bun ${U.version} runtime (${X})`,Content:{S3Bucket:H,S3Key:V},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[X]});n$(["Bun runtime layer published","",`ARN: ${A.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'bun', layers: ['${A.LayerVersionArn}'] }`,"or set TSCLOUD_BUN_LAYER_ARN before deploying."].join(`
 `),"green")}catch(J){K(`Layer build failed: ${J.message}`),process.exitCode=1}}),G.command("deploy:status","Check deployment status").option("--stack <name>","Stack name").option("--env <environment>","Environment").action(async($)=>{R("Deployment Status");try{let J=await x(),Y=$?.env||"production",X=$?.stack||i$(J,Y),Q=J.project.region||"us-east-1";W(`Stack: ${X}`),W(`Region: ${Q}`);let Z=new E("Checking deployment status...");Z.start();let F=await new Y$(Q).describeStacks({stackName:X});if(F.Stacks.length===0){Z.fail("Stack not found"),X1("No deployment found for this environment");return}let U=F.Stacks[0];if(Z.succeed("Status retrieved"),W(`
 Status: ${U.StackStatus}`),W(`Created: ${U.CreationTime}`),U.LastUpdatedTime)W(`Last Updated: ${U.LastUpdatedTime}`);if(U.Outputs&&U.Outputs.length>0){W(`
 Outputs:`);for(let M of U.Outputs)W(`  ${M.OutputKey}: ${M.OutputValue}`)}}catch(J){K(`Failed to get status: ${J.message}`)}}),G.command("deploy:rollback","Rollback to previous version").option("--stack <name>","Stack name").option("--env <environment>","Environment").action(async($)=>{R("Rolling Back Deployment");try{let J=await x(),Y=$?.env||"production",X=$?.stack||i$(J,Y),Q=J.project.region||"us-east-1";if(W(`Stack: ${X}`),W(`Region: ${Q}`),!await k(`