@stacksjs/ts-cloud 0.9.4 → 0.10.0

package/dist/bin/chunk-gs40j75w.js

@@ -0,0 +1 @@
+import{Wa as a}from"./chunk-41yqpdv7.js";import"./chunk-b2ymh8k0.js";export{a as encodeDashboardPayload};

package/dist/bin/chunk-jjjts1vt.js

@@ -0,0 +1 @@
+import{qd as a,rd as b}from"./chunk-nb0yjkv5.js";import"./chunk-b35989e3.js";import"./chunk-ey9fagrr.js";import"./chunk-b2ymh8k0.js";export{a as ACMClient,b as ACMDnsValidator};

package/dist/bin/{chunk-etrb03mt.js → chunk-jnsbzqzz.js}

@@ -1,4 +1,4 @@
-import{kh as TE}from"./chunk-rxcvf10f.js";var X=["project:read","config:read","config:write","deployments:read","deployments:create","deployments:cancel","deployments:rollback","runtime:read","runtime:restart","runtime:logs","runtime:terminal","data:read","data:write","data:admin","backups:read","backups:create","backups:restore","secrets:read","secrets:write","fleet:read","fleet:manage","users:read","users:manage","users:transfer-ownership","audit:read","billing:read","billing:manage","security:read","security:manage","security:waive","sources:read","sources:manage","applications:read","applications:manage","automation:read","automation:manage","tags:manage"],Y=["project:read","config:read","deployments:read","runtime:read","runtime:logs","data:read","backups:read","security:read","sources:read","applications:read","billing:read"],_E={owner:new Set(X),admin:new Set(X.filter((E)=>E!=="users:transfer-ownership")),deployer:new Set([...Y,"deployments:create","deployments:cancel","deployments:rollback","sources:manage","applications:manage"]),operator:new Set([...Y,"runtime:restart","backups:create","security:manage","sources:manage","applications:manage"]),viewer:new Set(Y),auditor:new Set(["project:read","config:read","deployments:read","runtime:read","data:read","backups:read","audit:read","security:read","sources:read","applications:read"])};function u(E){return _E[E]}function x(E,T){if(E.type==="organization")return E.id===void 0||E.id===T.organizationId;if(!E.id)return!1;if(E.type==="project")return E.id===T.projectId;if(E.type==="environment")return E.id===T.environmentId;return E.id===T.resourceId}function V(E){let{membership:T,capability:N,target:e}=E;if(!T||T.status!=="active"||T.organizationId!==e.organizationId)return{allowed:!1,reason:"inactive-membership"};let L=E.grants.filter((s)=>s.organizationId===e.organizationId&&s.membershipId===T.id&&s.capability===N&&x(s.scope,e)),t=L.find((s)=>s.effect==="deny");if(t)return{allowed:!1,reason:"explicit-deny",inheritedFrom:{kind:"grant",id:t.id,scope:t.scope}};let _=L.find((s)=>s.effect==="allow");if(_)return{allowed:!0,reason:"explicit-allow",inheritedFrom:{kind:"grant",id:_.id,scope:_.scope}};if(!x(T.scope,e))return{allowed:!1,reason:"scope-mismatch"};if(u(T.roleTemplate).has(N))return{allowed:!0,reason:"role-template",inheritedFrom:{kind:"membership",id:T.id,scope:T.scope}};return{allowed:!1,reason:"missing-capability"}}function sE(E){return X.filter((T)=>V({...E,capability:T}).allowed)}import{createHash as g,randomBytes as dE}from"node:crypto";import{chmodSync as B,existsSync as w,mkdirSync as rE,statSync as nE}from"node:fs";import{dirname as EE}from"node:path";import{Database as oE}from"bun:sqlite";var C=40,G=[{version:1,name:"core_control_plane",sql:`
+import{zh as ie}from"./chunk-anm3ae6z.js";var C=["project:read","config:read","config:write","deployments:read","deployments:create","deployments:cancel","deployments:rollback","runtime:read","runtime:restart","runtime:logs","runtime:terminal","data:read","data:write","data:admin","backups:read","backups:create","backups:restore","secrets:read","secrets:write","fleet:read","fleet:manage","users:read","users:manage","users:transfer-ownership","audit:read","billing:read","billing:manage","security:read","security:manage","security:waive","sources:read","sources:manage","applications:read","applications:manage","automation:read","automation:manage","tags:manage"],K=["project:read","config:read","deployments:read","runtime:read","runtime:logs","data:read","backups:read","security:read","sources:read","applications:read","billing:read"],se={owner:new Set(C),admin:new Set(C.filter((e)=>e!=="users:transfer-ownership")),deployer:new Set([...K,"deployments:create","deployments:cancel","deployments:rollback","sources:manage","applications:manage"]),operator:new Set([...K,"runtime:restart","backups:create","security:manage","sources:manage","applications:manage"]),viewer:new Set(K),auditor:new Set(["project:read","config:read","deployments:read","runtime:read","data:read","backups:read","audit:read","security:read","sources:read","applications:read"])};function I(e){return se[e]}function P(e,t){if(e.type==="organization")return e.id===void 0||e.id===t.organizationId;if(!e.id)return!1;if(e.type==="project")return e.id===t.projectId;if(e.type==="environment")return e.id===t.environmentId;return e.id===t.resourceId}function Z(e){let{membership:t,capability:r,target:i}=e;if(!t||t.status!=="active"||t.organizationId!==i.organizationId)return{allowed:!1,reason:"inactive-membership"};let a=e.grants.filter((s)=>s.organizationId===i.organizationId&&s.membershipId===t.id&&s.capability===r&&P(s.scope,i)),E=a.find((s)=>s.effect==="deny");if(E)return{allowed:!1,reason:"explicit-deny",inheritedFrom:{kind:"grant",id:E.id,scope:E.scope}};let T=a.find((s)=>s.effect==="allow");if(T)return{allowed:!0,reason:"explicit-allow",inheritedFrom:{kind:"grant",id:T.id,scope:T.scope}};if(!P(t.scope,i))return{allowed:!1,reason:"scope-mismatch"};if(I(t.roleTemplate).has(r))return{allowed:!0,reason:"role-template",inheritedFrom:{kind:"membership",id:t.id,scope:t.scope}};return{allowed:!1,reason:"missing-capability"}}function de(e){return C.filter((t)=>Z({...e,capability:t}).allowed)}import{createHash as h,randomBytes as Ne}from"node:crypto";import{chmodSync as H,existsSync as ee,mkdirSync as ce,statSync as Le}from"node:fs";import{dirname as te}from"node:path";import{Database as _e}from"bun:sqlite";var l=40,j=[{version:1,name:"core_control_plane",sql:`
       CREATE TABLE projects (
         id TEXT PRIMARY KEY,
         slug TEXT NOT NULL UNIQUE,
@@ -1475,33 +1475,33 @@ import{kh as TE}from"./chunk-rxcvf10f.js";var X=["project:read","config:read","c
       -- once a minute, forever.
       CREATE INDEX telemetry_kind_scope_time_idx
         ON telemetry_records(project_id, kind, timestamp);
-    `}];class U extends Error{constructor(E,T,N){super(`${E} ${T} changed since version ${N}`);this.name="OptimisticConcurrencyError"}}class j extends Error{constructor(E,T){super(`Operation cannot transition from ${E} to ${T}`);this.name="InvalidOperationTransitionError"}}class v extends Error{constructor(E,T){super(`Control-plane schema version ${E} is newer than supported version ${T}`);this.name="UnsupportedSchemaVersionError"}}var eE=65536,q=16384,cE=["succeeded","failed","cancelled","timed_out"],CE={queued:["running","cancelled","timed_out"],running:["queued","succeeded","failed","cancelled","timed_out"],succeeded:[],failed:["queued"],cancelled:["queued"],timed_out:["queued"]},UE=/(?:^|_)(?:authorization|cookie|credential|password|passwd|secret|token|api_?key|private_?key|access_?key)(?:$|_)/i,NE=/(?:authorization|password|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)\s*[=:]\s*[^\s,;]+/gi;function c(E){if(typeof E!=="string")return{};try{return JSON.parse(E)}catch{return{}}}function d(E){return typeof E==="string"?E:void 0}function P(E,T){if(T&&UE.test(T))return"[REDACTED]";if(E===null||typeof E==="boolean"||typeof E==="number")return E;if(typeof E==="string")return E.replace(NE,"[REDACTED]");if(Array.isArray(E))return E.map((N)=>P(N));if(E&&typeof E==="object"){let N={};for(let[e,L]of Object.entries(E))N[e]=P(L,e);return N}return String(E??"")}function LE(E,T=eE){let N=P(E),e=JSON.stringify(N);if(Buffer.byteLength(e)<=T)return N;return{truncated:!0,originalBytes:Buffer.byteLength(e),preview:e.slice(0,Math.max(0,T-128))}}function r(E){return JSON.stringify(LE(E))}function z(E){if(!E)return;let T=E.replace(NE,"[REDACTED]");return Buffer.byteLength(T)<=q?T:`${T.slice(0,q-24)}
-[output truncated]`}function F(E){return{id:String(E.id),slug:String(E.slug),name:String(E.name),description:d(E.description),organizationId:d(E.organization_id),desiredConfigHash:d(E.desired_config_hash),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function y(E){return{id:String(E.id),projectId:String(E.project_id),slug:String(E.slug),name:String(E.name),kind:String(E.kind),region:d(E.region),desiredState:c(E.desired_state),discoveredState:c(E.discovered_state),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function m(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:d(E.environment_id),kind:String(E.kind),slug:String(E.slug),name:String(E.name),provider:d(E.provider),providerId:d(E.provider_id),desiredState:c(E.desired_state),discoveredState:c(E.discovered_state),metadata:c(E.metadata),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function f(E){return{id:String(E.id),kind:String(E.kind),externalId:d(E.external_id),displayName:String(E.display_name),metadata:c(E.metadata),disabledAt:d(E.disabled_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function O(E){return{id:String(E.id),projectId:d(E.project_id),environmentId:d(E.environment_id),resourceId:d(E.resource_id),actorId:d(E.actor_id),kind:String(E.kind),state:String(E.state),correlationId:String(E.correlation_id),idempotencyKey:d(E.idempotency_key),input:c(E.input),output:c(E.output),error:d(E.error),attempt:Number(E.attempt),priority:Number(E.priority),leaseOwner:d(E.lease_owner),leaseExpiresAt:d(E.lease_expires_at),cancelRequestedAt:d(E.cancel_requested_at),startedAt:d(E.started_at),finishedAt:d(E.finished_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function M(E){return{id:String(E.id),sequence:Number(E.sequence),organizationId:d(E.organization_id),projectId:d(E.project_id),operationId:d(E.operation_id),resourceId:d(E.resource_id),actorId:d(E.actor_id),correlationId:String(E.correlation_id),type:String(E.type),level:String(E.level),payload:c(E.payload),createdAt:String(E.created_at)}}function l(E){return{id:String(E.id),projectId:String(E.project_id),name:String(E.name),normalizedName:String(E.normalized_name),color:String(E.color),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function h(E){return{id:String(E.id),actorKey:String(E.actor_key),name:String(E.name),routeId:String(E.route_id),query:c(E.query),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function K(E){return{actorKey:String(E.actor_key),entityType:String(E.entity_type),entityId:String(E.entity_id),favorite:Number(E.favorite)===1,lastVisitedAt:String(E.last_visited_at),visitCount:Number(E.visit_count)}}function b(E){return{id:String(E.id),slug:String(E.slug),name:String(E.name),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Q(E){let T=String(E.scope_type);return{type:T,...T==="organization"?{}:{id:String(E.scope_id)}}}function k(E){return{id:String(E.id),organizationId:String(E.organization_id),actorId:String(E.actor_id),roleTemplate:String(E.role_template),scope:Q(E),source:String(E.source??"manual"),status:String(E.status),sessionVersion:Number(E.session_version),lastActiveAt:d(E.last_active_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function A(E,T){let N=d(E.accepted_at),e=d(E.revoked_at),L=String(E.expires_at),t=e?"revoked":N?"accepted":L<=T?"expired":"pending";return{id:String(E.id),organizationId:String(E.organization_id),email:String(E.email),roleTemplate:String(E.role_template),scope:Q(E),invitedByActorId:d(E.invited_by_actor_id),acceptedByActorId:d(E.accepted_by_actor_id),expiresAt:L,acceptedAt:N,revokedAt:e,state:t,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function H(E){return{id:String(E.id),organizationId:String(E.organization_id),membershipId:String(E.membership_id),effect:String(E.effect),capability:String(E.capability),scope:Q(E),source:String(E.source??"manual"),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function D(E){return{type:E.type,id:E.id??null}}function OE(E){return Array.from({length:E},()=>"?").join(", ")}function a(E,T,N){return E.run(T,N)}class iE{path;database;nowFn;idFn;constructor(E={}){this.path=E.path??TE(E.cwd??process.cwd(),"control-plane.sqlite"),this.nowFn=E.now??(()=>new Date),this.idFn=E.id??(()=>crypto.randomUUID());let T=this.path===":memory:";if(!T){rE(EE(this.path),{recursive:!0,mode:448});try{B(EE(this.path),448)}catch{}}if(this.database=new oE(this.path,{create:!0,strict:!0}),this.database.run("PRAGMA foreign_keys = ON"),this.database.run(`PRAGMA busy_timeout = ${Math.max(100,E.busyTimeoutMs??5000)}`),!T)this.database.run("PRAGMA journal_mode = WAL"),this.database.run("PRAGMA synchronous = NORMAL");if(this.migrate(),!T)this.secureDatabaseFiles()}now(){return this.nowFn().toISOString()}secureDatabaseFiles(){for(let E of[this.path,`${this.path}-wal`,`${this.path}-shm`]){if(!w(E))continue;try{B(E,384)}catch{}}}backupTo(E){this.database.run("VACUUM INTO ?",[E]);try{B(E,384)}catch{}}migrate(){let E=this.database.query("PRAGMA user_version").get(),T=Number(E?.user_version??0);if(T>C)throw new v(T,C);if(T===C)return;let N;if(T>0&&this.path!==":memory:")N=`${this.path}.v${T}.${Date.now()}.bak`,this.backupTo(N);try{if(this.database.transaction(()=>{for(let L of G){if(L.version<=T)continue;this.database.run(L.sql),a(this.database,"INSERT INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)",[L.version,L.name,this.now()]),this.database.run(`PRAGMA user_version = ${L.version}`)}}).exclusive(),N)this.setSetting("storage.last_backup",{path:N,createdAt:this.now(),reason:"pre-migration"})}catch(e){let L=N?` Restore from ${N}.`:"";throw Error(`Control-plane migration from schema ${T} failed.${L} ${e instanceof Error?e.message:String(e)}`)}}close(){if(this.path!==":memory:")this.secureDatabaseFiles();this.database.close()}transaction(E){return this.database.transaction(E).immediate()}createProject(E){let T=E.id??this.idFn(),N=this.now();return a(this.database,"INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",[T,E.slug,E.name,E.description??null,E.organizationId??null,E.desiredConfigHash??null,N,N]),this.getProject(T)}getProject(E){let T=this.database.query("SELECT * FROM projects WHERE id = ?").get(E);return T?F(T):void 0}getProjectBySlug(E){let T=this.database.query("SELECT * FROM projects WHERE slug = ?").get(E);return T?F(T):void 0}listProjects(){return this.database.query("SELECT * FROM projects ORDER BY name COLLATE NOCASE, id").all().map(F)}updateProject(E,T,N){let e=this.getProject(E);if(!e||e.version!==T)throw new U("Project",E,T);if(a(this.database,`UPDATE projects SET name = ?, description = ?, organization_id = ?, desired_config_hash = ?, version = version + 1, updated_at = ?
-      WHERE id = ? AND version = ?`,[N.name??e.name,N.description===null?null:N.description??e.description??null,N.organizationId===null?null:N.organizationId??e.organizationId??null,N.desiredConfigHash===null?null:N.desiredConfigHash??e.desiredConfigHash??null,this.now(),E,T]).changes!==1)throw new U("Project",E,T);return this.getProject(E)}createEnvironment(E){let T=E.id??this.idFn(),N=this.now();return a(this.database,`INSERT INTO environments (id, project_id, slug, name, kind, region, desired_state, discovered_state, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,E.projectId,E.slug,E.name,E.kind,E.region??null,r(E.desiredState??{}),r(E.discoveredState??{}),N,N]),y(this.database.query("SELECT * FROM environments WHERE id = ?").get(T))}listEnvironments(E){return this.database.query("SELECT * FROM environments WHERE project_id = ? ORDER BY name COLLATE NOCASE, id").all(E).map(y)}getEnvironmentBySlug(E,T){let N=this.database.query("SELECT * FROM environments WHERE project_id = ? AND slug = ?").get(E,T);return N?y(N):void 0}createResource(E){let T=E.id??this.idFn(),N=this.now();return a(this.database,`INSERT INTO resources (id, project_id, environment_id, kind, slug, name, provider, provider_id, desired_state, discovered_state, metadata, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,E.projectId,E.environmentId??null,E.kind,E.slug,E.name,E.provider??null,E.providerId??null,r(E.desiredState??{}),r(E.discoveredState??{}),r(E.metadata??{}),N,N]),m(this.database.query("SELECT * FROM resources WHERE id = ?").get(T))}listResources(E,T){return(T?this.database.query("SELECT * FROM resources WHERE project_id = ? AND environment_id = ? ORDER BY kind, name COLLATE NOCASE").all(E,T):this.database.query("SELECT * FROM resources WHERE project_id = ? ORDER BY kind, name COLLATE NOCASE").all(E)).map(m)}getResource(E){let T=this.database.query("SELECT * FROM resources WHERE id = ?").get(E);return T?m(T):void 0}updateResource(E,T,N){let e=this.getResource(E);if(!e||e.version!==T)throw new U("Resource",E,T);if(a(this.database,`UPDATE resources SET name = ?, provider = ?, provider_id = ?, desired_state = ?, discovered_state = ?, metadata = ?,
-      version = version + 1, updated_at = ? WHERE id = ? AND version = ?`,[N.name??e.name,N.provider===null?null:N.provider??e.provider??null,N.providerId===null?null:N.providerId??e.providerId??null,r(N.desiredState??e.desiredState),r(N.discoveredState??e.discoveredState),r(N.metadata??e.metadata),this.now(),E,T]).changes!==1)throw new U("Resource",E,T);return this.getResource(E)}createActor(E){let T=E.id??this.idFn(),N=this.now();return a(this.database,"INSERT INTO actors (id, kind, external_id, display_name, metadata, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[T,E.kind,E.externalId??null,E.displayName,r(E.metadata??{}),N,N]),f(this.database.query("SELECT * FROM actors WHERE id = ?").get(T))}getActorByExternalId(E,T){let N=this.database.query("SELECT * FROM actors WHERE kind = ? AND external_id = ?").get(E,T);return N?f(N):void 0}getActor(E){let T=this.database.query("SELECT * FROM actors WHERE id = ?").get(E);return T?f(T):void 0}createOrganization(E){let T=E.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/.test(T))throw Error("Organization slugs must contain 3-64 lowercase letters, numbers, or dashes");let N=E.name.trim();if(!N||N.length>100)throw Error("Organization names must contain 1-100 characters");let e=E.id??this.idFn(),L=this.now();return a(this.database,"INSERT INTO organizations (id, slug, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",[e,T,N,L,L]),this.getOrganization(e)}getOrganization(E){let T=this.database.query("SELECT * FROM organizations WHERE id = ?").get(E);return T?b(T):void 0}getOrganizationBySlug(E){let T=this.database.query("SELECT * FROM organizations WHERE slug = ?").get(E.trim().toLowerCase());return T?b(T):void 0}listOrganizations(E){return(E?this.database.query(`SELECT organizations.* FROM organizations JOIN organization_memberships ON organization_memberships.organization_id = organizations.id
-          WHERE organization_memberships.actor_id = ? AND organization_memberships.status = 'active' ORDER BY organizations.name COLLATE NOCASE`).all(E):this.database.query("SELECT * FROM organizations ORDER BY name COLLATE NOCASE").all()).map(b)}normalizeAuthorizationScope(E,T={type:"organization"}){if(T.type==="organization"){if(T.id&&T.id!==E)throw Error("Organization scope does not match the requested organization");return{type:"organization"}}if(!T.id)throw Error(`${T.type} scopes require an ID`);if(!this.resolveAuthorizationTarget(E,T))throw Error("Authorization scope was not found in this organization");return{type:T.type,id:T.id}}resolveAuthorizationTarget(E,T){if(!this.getOrganization(E))return;if(T.type==="organization")return{organizationId:E};if(!T.id)return;if(T.type==="project"){let e=this.database.query("SELECT id FROM projects WHERE id = ? AND organization_id = ?").get(T.id,E);return e?{organizationId:E,projectId:String(e.id)}:void 0}if(T.type==="environment"){let e=this.database.query("SELECT environments.id, environments.project_id FROM environments JOIN projects ON projects.id = environments.project_id WHERE environments.id = ? AND projects.organization_id = ?").get(T.id,E);return e?{organizationId:E,projectId:String(e.project_id),environmentId:String(e.id)}:void 0}let N=this.database.query(`SELECT resources.id, resources.project_id, resources.environment_id FROM resources
-      JOIN projects ON projects.id = resources.project_id WHERE resources.id = ? AND projects.organization_id = ?`).get(T.id,E);return N?{organizationId:E,projectId:String(N.project_id),environmentId:d(N.environment_id),resourceId:String(N.id)}:void 0}createMembership(E){if(!this.getActor(E.actorId))throw Error("Membership actor was not found");let T=this.normalizeAuthorizationScope(E.organizationId,E.scope);if(E.roleTemplate==="owner"&&T.type!=="organization")throw Error("Owners must be scoped to the organization");let N=E.id??this.idFn(),e=this.now();a(this.database,`INSERT INTO organization_memberships (id, organization_id, actor_id, role_template, scope_type, scope_id, source, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[N,E.organizationId,E.actorId,E.roleTemplate,T.type,T.id??null,E.source??"manual",e,e]);let L=this.getMembership(N);return this.appendEvent({organizationId:E.organizationId,actorId:E.performedByActorId,type:"organization.membership.created",payload:{membershipId:N,actorId:E.actorId,roleTemplate:E.roleTemplate,scope:D(T)}}),L}getMembership(E){let T=this.database.query("SELECT * FROM organization_memberships WHERE id = ?").get(E);return T?k(T):void 0}getMembershipForActor(E,T){let N=this.database.query("SELECT * FROM organization_memberships WHERE organization_id = ? AND actor_id = ?").get(E,T);return N?k(N):void 0}listMemberships(E,T={}){let N=T.includeRevoked?"":"AND status = 'active'";return this.database.query(`SELECT * FROM organization_memberships WHERE organization_id = ? ${N} ORDER BY created_at, id`).all(E).map(k)}updateMembership(E){let T=this.getMembership(E.id);if(!T)throw Error("Membership was not found");let N=this.normalizeAuthorizationScope(T.organizationId,E.scope??T.scope);if(E.roleTemplate==="owner"&&N.type!=="organization")throw Error("Owners must be scoped to the organization");if(T.roleTemplate==="owner"&&T.status==="active"&&(E.roleTemplate!=="owner"||N.type!=="organization"))this.assertAnotherOwner(T);return a(this.database,"UPDATE organization_memberships SET role_template = ?, scope_type = ?, scope_id = ?, session_version = session_version + 1, updated_at = ? WHERE id = ?",[E.roleTemplate,N.type,N.id??null,this.now(),T.id]),this.appendEvent({organizationId:T.organizationId,actorId:E.actorId,type:"organization.membership.updated",payload:{membershipId:T.id,from:{roleTemplate:T.roleTemplate,scope:D(T.scope)},to:{roleTemplate:E.roleTemplate,scope:D(N)}}}),this.getMembership(T.id)}revokeMembership(E,T){let N=this.getMembership(E);if(!N)throw Error("Membership was not found");if(N.status==="revoked")return N;if(N.roleTemplate==="owner")this.assertAnotherOwner(N);return a(this.database,"UPDATE organization_memberships SET status = 'revoked', session_version = session_version + 1, updated_at = ? WHERE id = ?",[this.now(),E]),this.appendEvent({organizationId:N.organizationId,actorId:T,type:"organization.membership.revoked",payload:{membershipId:E}}),this.getMembership(E)}touchMembership(E){let T=this.now();a(this.database,"UPDATE organization_memberships SET last_active_at = ?, updated_at = ? WHERE id = ? AND status = ?",[T,T,E,"active"]);let N=this.getMembership(E);if(!N)throw Error("Membership was not found");return N}assertAnotherOwner(E){if(Number(this.database.query("SELECT COUNT(*) AS count FROM organization_memberships WHERE organization_id = ? AND status = ? AND role_template = 'owner'").get(E.organizationId,"active")?.count??0)<=1)throw Error("Cannot remove or demote the last organization owner")}createInvitation(E){let T=E.email.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(T)||T.length>254)throw Error("A valid invitation email is required");let N=this.normalizeAuthorizationScope(E.organizationId,E.scope);if(E.roleTemplate==="owner"&&N.type!=="organization")throw Error("Owners must be scoped to the organization");let e=dE(32).toString("base64url"),L=g("sha256").update(e).digest("hex"),t=E.id??this.idFn(),_=this.now(),s=new Date(this.nowFn().getTime()+Math.min(2592000000,Math.max(60000,E.expiresInMs??604800000))).toISOString();return a(this.database,`INSERT INTO organization_invitations (id, organization_id, email, role_template, scope_type, scope_id, token_hash, invited_by_actor_id, expires_at, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,E.organizationId,T,E.roleTemplate,N.type,N.id??null,L,E.invitedByActorId??null,s,_,_]),this.appendEvent({organizationId:E.organizationId,actorId:E.invitedByActorId,type:"organization.invitation.created",payload:{invitationId:t,email:T,roleTemplate:E.roleTemplate,scope:D(N),expiresAt:s}}),{invitation:this.getInvitation(t),token:e}}getInvitation(E){let T=this.database.query("SELECT * FROM organization_invitations WHERE id = ?").get(E);return T?A(T,this.now()):void 0}listInvitations(E){return this.database.query("SELECT * FROM organization_invitations WHERE organization_id = ? ORDER BY created_at DESC").all(E).map((T)=>A(T,this.now()))}inspectInvitationToken(E){let T=g("sha256").update(E).digest("hex"),N=this.database.query("SELECT * FROM organization_invitations WHERE token_hash = ?").get(T);return N?A(N,this.now()):void 0}acceptInvitation(E,T){let N=g("sha256").update(E).digest("hex");return this.transaction(()=>{let e=this.database.query("SELECT * FROM organization_invitations WHERE token_hash = ?").get(N);if(!e)throw Error("Invitation is invalid");let L=A(e,this.now());if(L.state!=="pending")throw Error(`Invitation is ${L.state}`);if(!this.getActor(T))throw Error("Invitation actor was not found");if(a(this.database,"UPDATE organization_invitations SET accepted_by_actor_id = ?, accepted_at = ?, updated_at = ? WHERE id = ? AND accepted_at IS NULL AND revoked_at IS NULL AND expires_at > ?",[T,this.now(),this.now(),L.id,this.now()]).changes!==1)throw Error("Invitation is no longer available");let _=this.getMembershipForActor(L.organizationId,T),s=_??this.createMembership({organizationId:L.organizationId,actorId:T,roleTemplate:L.roleTemplate,scope:L.scope,source:"invitation"});if(_&&L.roleTemplate==="owner"&&_.roleTemplate!=="owner")s=this.updateMembership({id:_.id,roleTemplate:"owner",scope:{type:"organization"},actorId:T});else if(_)for(let n of u(L.roleTemplate))this.upsertGrant({organizationId:L.organizationId,membershipId:_.id,effect:"allow",capability:n,scope:L.scope,source:"invitation"});return this.appendEvent({organizationId:L.organizationId,actorId:T,type:"organization.invitation.accepted",payload:{invitationId:L.id,membershipId:s.id}}),{invitation:this.getInvitation(L.id),membership:this.getMembership(s.id)}})}revokeInvitation(E,T){let N=this.getInvitation(E);if(!N)throw Error("Invitation was not found");if(N.acceptedAt)throw Error("Accepted invitations cannot be revoked");if(!N.revokedAt)a(this.database,"UPDATE organization_invitations SET revoked_at = ?, updated_at = ? WHERE id = ?",[this.now(),this.now(),E]);return this.appendEvent({organizationId:N.organizationId,actorId:T,type:"organization.invitation.revoked",payload:{invitationId:E}}),this.getInvitation(E)}reissueInvitation(E,T){let N=this.getInvitation(E);if(!N)throw Error("Invitation was not found");if(N.state==="accepted")throw Error("Accepted invitations cannot be reissued");return this.revokeInvitation(E,T),this.createInvitation({organizationId:N.organizationId,email:N.email,roleTemplate:N.roleTemplate,scope:N.scope,invitedByActorId:T})}upsertGrant(E){if(!X.includes(E.capability))throw Error("Unknown authorization capability");let T=this.getMembership(E.membershipId);if(!T||T.organizationId!==E.organizationId)throw Error("Grant membership was not found in this organization");let N=this.normalizeAuthorizationScope(E.organizationId,E.scope),e=this.now(),L=this.database.query("SELECT * FROM authorization_grants WHERE membership_id = ? AND effect = ? AND capability = ? AND scope_type = ? AND scope_id IS ?").get(E.membershipId,E.effect,E.capability,N.type,N.id??null);if(L)return H(L);let t=E.id??this.idFn();return a(this.database,`INSERT INTO authorization_grants (id, organization_id, membership_id, effect, capability, scope_type, scope_id, source, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,E.organizationId,E.membershipId,E.effect,E.capability,N.type,N.id??null,E.source??"manual",e,e]),a(this.database,"UPDATE organization_memberships SET session_version = session_version + 1, updated_at = ? WHERE id = ?",[e,E.membershipId]),this.appendEvent({organizationId:E.organizationId,actorId:E.actorId,type:"organization.grant.created",payload:{grantId:t,membershipId:E.membershipId,effect:E.effect,capability:E.capability,scope:D(N)}}),this.getGrant(t)}getGrant(E){let T=this.database.query("SELECT * FROM authorization_grants WHERE id = ?").get(E);return T?H(T):void 0}listGrants(E){return this.database.query("SELECT * FROM authorization_grants WHERE membership_id = ? ORDER BY effect DESC, capability, scope_type, scope_id").all(E).map(H)}removeGrant(E,T){let N=this.getGrant(E);if(!N)return!1;let e=a(this.database,"DELETE FROM authorization_grants WHERE id = ?",[E]).changes===1;if(e)a(this.database,"UPDATE organization_memberships SET session_version = session_version + 1, updated_at = ? WHERE id = ?",[this.now(),N.membershipId]),this.appendEvent({organizationId:N.organizationId,actorId:T,type:"organization.grant.removed",payload:{grantId:E,membershipId:N.membershipId}});return e}createOperation(E){if(E.idempotencyKey){let L=this.database.query("SELECT * FROM operations WHERE idempotency_key = ?").get(E.idempotencyKey);if(L)return O(L)}let T=E.id??this.idFn(),N=E.correlationId??this.idFn(),e=this.now();try{return this.transaction(()=>{return a(this.database,`INSERT INTO operations (id, project_id, environment_id, resource_id, actor_id, kind, state, correlation_id, idempotency_key, input, output, priority, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, '{}', ?, ?, ?)`,[T,E.projectId??null,E.environmentId??null,E.resourceId??null,E.actorId??null,E.kind,N,E.idempotencyKey??null,r(E.input??{}),E.priority??0,e,e]),this.appendEvent({projectId:E.projectId,operationId:T,resourceId:E.resourceId,actorId:E.actorId,correlationId:N,type:"operation.queued",payload:{kind:E.kind}}),this.getOperation(T)})}catch(L){if(E.idempotencyKey){let t=this.database.query("SELECT * FROM operations WHERE idempotency_key = ?").get(E.idempotencyKey);if(t)return O(t)}throw L}}getOperation(E){let T=this.database.query("SELECT * FROM operations WHERE id = ?").get(E);return T?O(T):void 0}listOperations(E={}){let T=[],N=[];if(E.projectId)T.push("project_id = ?"),N.push(E.projectId);if(E.state)T.push("state = ?"),N.push(E.state);if(E.kind)T.push("kind = ?"),N.push(E.kind);if(E.before)T.push("created_at < ?"),N.push(E.before);let e=Math.min(500,Math.max(1,E.limit??100));N.push(e);let L=T.length?`WHERE ${T.join(" AND ")}`:"";return this.database.query(`SELECT * FROM operations ${L} ORDER BY created_at DESC, id DESC LIMIT ?`).all(...N).map(O)}claimNextOperation(E,T=60000,N){let e=this.now(),L=new Date(this.nowFn().getTime()+T).toISOString();return this.transaction(()=>{let t=N?.length?`AND kind IN (${OE(N.length)})`:"",_=N?[...N]:[],s=this.database.query(`SELECT * FROM operations WHERE state = 'queued' ${t} ORDER BY priority DESC, created_at ASC, id ASC LIMIT 1`).get(..._);if(!s)return;let n=O(s);if(a(this.database,`UPDATE operations SET state = 'running', attempt = attempt + 1, lease_owner = ?, lease_expires_at = ?,
-        started_at = COALESCE(started_at, ?), updated_at = ?, version = version + 1 WHERE id = ? AND state = 'queued' AND version = ?`,[E,L,e,e,n.id,n.version]).changes!==1)return;return this.appendEvent({projectId:n.projectId,operationId:n.id,resourceId:n.resourceId,actorId:n.actorId,correlationId:n.correlationId,type:"operation.running",payload:{attempt:n.attempt+1,workerId:E}}),this.getOperation(n.id)})}claimOperation(E,T,N=60000){let e=this.now(),L=new Date(this.nowFn().getTime()+N).toISOString();return this.transaction(()=>{let t=this.getOperation(E);if(!t||t.state!=="queued")return;if(a(this.database,`UPDATE operations SET state = 'running', attempt = attempt + 1, lease_owner = ?, lease_expires_at = ?,
-        started_at = COALESCE(started_at, ?), updated_at = ?, version = version + 1 WHERE id = ? AND state = 'queued' AND version = ?`,[T,L,e,e,t.id,t.version]).changes!==1)return;return this.appendEvent({projectId:t.projectId,operationId:t.id,resourceId:t.resourceId,actorId:t.actorId,correlationId:t.correlationId,type:"operation.running",payload:{attempt:t.attempt+1,workerId:T}}),this.getOperation(t.id)})}transitionOperation(E,T){return this.transaction(()=>{let N=this.getOperation(E);if(!N)throw Error(`Operation ${E} was not found`);let e=T.expectedVersion??N.version;if(N.version!==e)throw new U("Operation",E,e);if(!CE[N.state].includes(T.to))throw new j(N.state,T.to);let L=this.now(),t=cE.includes(T.to),_=T.to==="queued";if(a(this.database,`UPDATE operations SET state = ?, output = ?, error = ?, lease_owner = ?, lease_expires_at = ?,
-        finished_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND version = ?`,[T.to,r(T.output??N.output),z(T.error)??null,_||t?null:T.leaseOwner??N.leaseOwner??null,_||t?null:T.leaseExpiresAt??N.leaseExpiresAt??null,t?L:null,L,E,e]).changes!==1)throw new U("Operation",E,e);return this.appendEvent({projectId:N.projectId,operationId:E,resourceId:N.resourceId,actorId:N.actorId,correlationId:N.correlationId,type:`operation.${T.to}`,level:T.to==="failed"?"error":"info",payload:{from:N.state,to:T.to,error:z(T.error)??null}}),this.getOperation(E)})}requestCancellation(E){let T=this.now();a(this.database,"UPDATE operations SET cancel_requested_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND state IN ('queued', 'running')",[T,T,E]);let N=this.getOperation(E);if(!N)throw Error(`Operation ${E} was not found`);return N}reconcileOrphanedOperations(E={}){let T=(E.now??this.nowFn()).toISOString(),N=E.policy??"fail",e=this.database.query("SELECT * FROM operations WHERE state = 'running' AND (lease_expires_at IS NULL OR lease_expires_at <= ?)").all(T).map(O),L=0,t=0;for(let _ of e)if(N==="requeue")this.transitionOperation(_.id,{to:"queued",expectedVersion:_.version,error:"Worker lease expired; operation requeued after restart."}),L++;else this.transitionOperation(_.id,{to:"failed",expectedVersion:_.version,error:"Worker lease expired or dashboard restarted before completion."}),t++;return{requeued:L,failed:t}}appendEvent(E){let T=E.id??this.idFn(),N=E.correlationId??this.idFn(),e=E.organizationId??(E.projectId?d(this.database.query("SELECT organization_id FROM projects WHERE id = ?").get(E.projectId)?.organization_id):void 0);return a(this.database,`INSERT INTO events (id, organization_id, project_id, operation_id, resource_id, actor_id, correlation_id, type, level, payload, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,e??null,E.projectId??null,E.operationId??null,E.resourceId??null,E.actorId??null,N,E.type,E.level??"info",r(E.payload??{}),this.now()]),M(this.database.query("SELECT * FROM events WHERE id = ?").get(T))}listEvents(E={}){let T=[],N=[];if(E.organizationId)T.push("organization_id = ?"),N.push(E.organizationId);if(E.projectId)T.push("project_id = ?"),N.push(E.projectId);if(E.operationId)T.push("operation_id = ?"),N.push(E.operationId);if(E.resourceId)T.push("resource_id = ?"),N.push(E.resourceId);if(E.correlationId)T.push("correlation_id = ?"),N.push(E.correlationId);if(E.afterSequence!==void 0)T.push("sequence > ?"),N.push(E.afterSequence);let e=Math.min(1000,Math.max(1,E.limit??200));N.push(e);let L=T.length?`WHERE ${T.join(" AND ")}`:"";return this.database.query(`SELECT * FROM events ${L} ORDER BY sequence ASC LIMIT ?`).all(...N).map(M)}setSetting(E,T){a(this.database,`INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)
-      ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`,[E,r(T),this.now()])}getSetting(E){let T=this.database.query("SELECT value FROM settings WHERE key = ?").get(E);return T?c(T.value):void 0}upsertTag(E,T,N="#5a8be0"){let e=T.trim().toLowerCase().replace(/\s+/g,"-");if(!/^[a-z0-9][a-z0-9-]{0,31}$/.test(e))throw Error("Tag names must contain 1-32 letters, numbers, or dashes");if(!/^#[0-9a-f]{6}$/i.test(N))throw Error("Tag colors must be six-digit hex colors");let L=this.now(),t=this.database.query("SELECT * FROM tags WHERE project_id = ? AND normalized_name = ?").get(E,e);if(t)return a(this.database,"UPDATE tags SET name = ?, color = ?, updated_at = ? WHERE id = ?",[T.trim(),N.toLowerCase(),L,String(t.id)]),l(this.database.query("SELECT * FROM tags WHERE id = ?").get(String(t.id)));let _=this.idFn();return a(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[_,E,T.trim(),e,N.toLowerCase(),L,L]),l(this.database.query("SELECT * FROM tags WHERE id = ?").get(_))}listTags(E){return this.database.query("SELECT * FROM tags WHERE project_id = ? ORDER BY normalized_name").all(E).map(l)}assignTag(E,T){if(!this.database.query("SELECT tags.id FROM tags JOIN resources ON resources.project_id = tags.project_id WHERE tags.id = ? AND resources.id = ?").get(T,E))throw Error("The tag and resource must belong to the same project");a(this.database,"INSERT OR IGNORE INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[E,T,this.now()])}removeTag(E,T){a(this.database,"DELETE FROM resource_tags WHERE resource_id = ? AND tag_id = ?",[E,T])}listResourceTags(E){return this.database.query(`SELECT resource_tags.resource_id, tags.* FROM resource_tags JOIN tags ON tags.id = resource_tags.tag_id
-      WHERE tags.project_id = ? ORDER BY tags.normalized_name`).all(E).map((N)=>({resourceId:String(N.resource_id),tag:l(N)}))}saveFilter(E,T,N,e){let L=T.trim();if(!L||L.length>64)throw Error("Saved filter names must contain 1-64 characters");if(!N||N.length>160||/^[a-z][a-z0-9+.-]*:|^\/\//i.test(N))throw Error("Saved filter routes must be local route IDs or paths");let t=r(e);if(t.length>8192)throw Error("Saved filter queries must be smaller than 8 KB");let _=this.database.query("SELECT * FROM saved_filters WHERE actor_key = ? AND name = ?").get(E,L),s=this.now();if(_)return a(this.database,"UPDATE saved_filters SET route_id = ?, query = ?, updated_at = ? WHERE id = ?",[N,t,s,String(_.id)]),h(this.database.query("SELECT * FROM saved_filters WHERE id = ?").get(String(_.id)));let n=this.idFn();return a(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[n,E,L,N,t,s,s]),h(this.database.query("SELECT * FROM saved_filters WHERE id = ?").get(n))}listSavedFilters(E){return this.database.query("SELECT * FROM saved_filters WHERE actor_key = ? ORDER BY updated_at DESC, name").all(E).map(h)}deleteSavedFilter(E,T){return a(this.database,"DELETE FROM saved_filters WHERE actor_key = ? AND id = ?",[E,T]).changes===1}recordNavigation(E,T,N){let e=this.now();return a(this.database,`INSERT INTO navigation_items (actor_key, entity_type, entity_id, last_visited_at) VALUES (?, ?, ?, ?)
-      ON CONFLICT(actor_key, entity_type, entity_id) DO UPDATE SET last_visited_at = excluded.last_visited_at, visit_count = visit_count + 1`,[E,T,N,e]),K(this.database.query("SELECT * FROM navigation_items WHERE actor_key = ? AND entity_type = ? AND entity_id = ?").get(E,T,N))}setFavorite(E,T,N,e){let L=this.now();return a(this.database,`INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at) VALUES (?, ?, ?, ?, ?)
-      ON CONFLICT(actor_key, entity_type, entity_id) DO UPDATE SET favorite = excluded.favorite`,[E,T,N,e?1:0,L]),K(this.database.query("SELECT * FROM navigation_items WHERE actor_key = ? AND entity_type = ? AND entity_id = ?").get(E,T,N))}listNavigation(E,T={}){let N=T.favoritesOnly?"AND favorite = 1":"",e=Math.min(100,Math.max(1,T.limit??20));return this.database.query(`SELECT * FROM navigation_items WHERE actor_key = ? ${N} ORDER BY favorite DESC, last_visited_at DESC LIMIT ?`).all(E,e).map(K)}compact(E={}){let T=new Date(this.nowFn().getTime()-(E.eventRetentionDays??90)*86400000).toISOString(),N=new Date(this.nowFn().getTime()-(E.operationRetentionDays??365)*86400000).toISOString(),e=this.transaction(()=>{let L=a(this.database,"DELETE FROM events WHERE created_at < ?",[T]).changes,t=a(this.database,"DELETE FROM operations WHERE created_at < ? AND state IN ('succeeded', 'failed', 'cancelled', 'timed_out')",[N]).changes;return{events:L,operations:t}});if(E.vacuum!==!1)this.database.run("VACUUM");return{deletedEvents:e.events,deletedOperations:e.operations,vacuumed:E.vacuum!==!1}}createBackup(E="manual"){if(this.path===":memory:")throw Error("Cannot create a filesystem backup for an in-memory control plane");let T=`${this.path}.${Date.now()}.bak`;return this.backupTo(T),this.setSetting("storage.last_backup",{path:T,createdAt:this.now(),reason:E}),T}integrityCheck(){let E=this.database.query("PRAGMA integrity_check").all();return E.length===1&&Object.values(E[0])[0]==="ok"?"ok":"corrupt"}health(){let E=Object.fromEntries(["queued","running","succeeded","failed","cancelled","timed_out"].map((L)=>[L,0]));for(let L of this.database.query("SELECT state, COUNT(*) AS count FROM operations GROUP BY state").all())E[String(L.state)]=Number(L.count);let T=this.database.query("PRAGMA journal_mode").get(),N=this.getSetting("storage.last_backup"),e=N&&!Array.isArray(N)&&typeof N==="object"&&typeof N.createdAt==="string"?N.createdAt:void 0;return{path:this.path,schemaVersion:Number(this.database.query("PRAGMA user_version").get()?.user_version??0),supportedSchemaVersion:C,integrity:this.integrityCheck(),journalMode:String(T?.journal_mode??"unknown"),databaseBytes:this.path!==":memory:"&&w(this.path)?nE(this.path).size:this.database.serialize().byteLength,lastBackupAt:e,operations:E,pendingRetryableOperations:E.queued+E.failed+E.timed_out}}exportSnapshot(){let E={};for(let T of this.database.query("SELECT key, value FROM settings ORDER BY key").all())E[String(T.key)]=c(T.value);return{format:"ts-cloud-control-plane",schemaVersion:C,exportedAt:this.now(),organizations:this.database.query("SELECT * FROM organizations ORDER BY id").all().map(b),memberships:this.database.query("SELECT * FROM organization_memberships ORDER BY id").all().map(k),invitations:this.database.query("SELECT * FROM organization_invitations ORDER BY id").all().map((T)=>({...A(T,this.now()),tokenHash:String(T.token_hash)})),grants:this.database.query("SELECT * FROM authorization_grants ORDER BY id").all().map(H),projects:this.database.query("SELECT * FROM projects ORDER BY id").all().map(F),environments:this.database.query("SELECT * FROM environments ORDER BY id").all().map(y),resources:this.database.query("SELECT * FROM resources ORDER BY id").all().map(m),actors:this.database.query("SELECT * FROM actors ORDER BY id").all().map(f),operations:this.database.query("SELECT * FROM operations ORDER BY id").all().map(O),events:this.database.query("SELECT * FROM events ORDER BY sequence").all().map(M),settings:E,tags:this.database.query("SELECT * FROM tags ORDER BY id").all().map(l),resourceTags:this.database.query("SELECT * FROM resource_tags ORDER BY resource_id, tag_id").all().map((T)=>({resourceId:String(T.resource_id),tagId:String(T.tag_id),createdAt:String(T.created_at)})),savedFilters:this.database.query("SELECT * FROM saved_filters ORDER BY id").all().map(h),navigationItems:this.database.query("SELECT * FROM navigation_items ORDER BY actor_key, entity_type, entity_id").all().map(K)}}importSnapshot(E,T={}){if(E.format!=="ts-cloud-control-plane")throw Error("Unsupported control-plane snapshot format");if(E.schemaVersion>C)throw new v(E.schemaVersion,C);this.transaction(()=>{if((Number(this.database.query("SELECT COUNT(*) AS count FROM projects").get()?.count??0)>0||Number(this.database.query("SELECT COUNT(*) AS count FROM operations").get()?.count??0)>0)&&!T.replace)throw Error("Control plane is not empty; pass replace: true to import this snapshot");if(T.replace)this.database.run("DELETE FROM authorization_grants"),this.database.run("DELETE FROM organization_invitations"),this.database.run("DELETE FROM organization_memberships"),this.database.run("DELETE FROM resource_tags"),this.database.run("DELETE FROM tags"),this.database.run("DELETE FROM saved_filters"),this.database.run("DELETE FROM navigation_items"),this.database.run("DELETE FROM events"),this.database.run("DELETE FROM operations"),this.database.run("DELETE FROM resources"),this.database.run("DELETE FROM environments"),this.database.run("DELETE FROM projects"),this.database.run("DELETE FROM actors"),this.database.run("DELETE FROM organizations"),this.database.run("DELETE FROM settings");for(let e of E.organizations??[])a(this.database,"INSERT INTO organizations (id, slug, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",[e.id,e.slug,e.name,e.createdAt,e.updatedAt]);for(let e of E.projects)a(this.database,`INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, version, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.slug,e.name,e.description??null,e.organizationId??null,e.desiredConfigHash??null,e.version,e.createdAt,e.updatedAt]);for(let e of E.environments)a(this.database,`INSERT INTO environments (id, project_id, slug, name, kind, region, desired_state, discovered_state, version, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.projectId,e.slug,e.name,e.kind,e.region??null,r(e.desiredState),r(e.discoveredState),e.version,e.createdAt,e.updatedAt]);for(let e of E.resources)a(this.database,`INSERT INTO resources (id, project_id, environment_id, kind, slug, name, provider, provider_id, desired_state, discovered_state, metadata, version, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.projectId,e.environmentId??null,e.kind,e.slug,e.name,e.provider??null,e.providerId??null,r(e.desiredState),r(e.discoveredState),r(e.metadata),e.version,e.createdAt,e.updatedAt]);for(let e of E.actors)a(this.database,`INSERT INTO actors (id, kind, external_id, display_name, metadata, disabled_at, version, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.kind,e.externalId??null,e.displayName,r(e.metadata),e.disabledAt??null,e.version,e.createdAt,e.updatedAt]);for(let e of E.memberships??[])a(this.database,`INSERT INTO organization_memberships (id, organization_id, actor_id, role_template, scope_type, scope_id, status, session_version, last_active_at, source, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.organizationId,e.actorId,e.roleTemplate,e.scope.type,e.scope.id??null,e.status,e.sessionVersion,e.lastActiveAt??null,e.source??"manual",e.createdAt,e.updatedAt]);for(let e of E.invitations??[]){let L=e.tokenHash??g("sha256").update(`revoked:${e.id}:${this.idFn()}`).digest("hex");a(this.database,`INSERT INTO organization_invitations (id, organization_id, email, role_template, scope_type, scope_id, token_hash, invited_by_actor_id, accepted_by_actor_id, expires_at, accepted_at, revoked_at, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.organizationId,e.email,e.roleTemplate,e.scope.type,e.scope.id??null,L,e.invitedByActorId??null,e.acceptedByActorId??null,e.expiresAt,e.acceptedAt??null,e.tokenHash?e.revokedAt??null:e.revokedAt??this.now(),e.createdAt,e.updatedAt])}for(let e of E.grants??[])a(this.database,`INSERT INTO authorization_grants (id, organization_id, membership_id, effect, capability, scope_type, scope_id, source, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.organizationId,e.membershipId,e.effect,e.capability,e.scope.type,e.scope.id??null,e.source??"manual",e.createdAt,e.updatedAt]);for(let e of E.operations)a(this.database,`INSERT INTO operations (id, project_id, environment_id, resource_id, actor_id, kind, state, correlation_id, idempotency_key,
+    `}];class p extends Error{constructor(e,t,r){super(`${e} ${t} changed since version ${r}`);this.name="OptimisticConcurrencyError"}}class x extends Error{constructor(e,t){super(`Operation cannot transition from ${e} to ${t}`);this.name="InvalidOperationTransitionError"}}class S extends Error{constructor(e,t){super(`Control-plane schema version ${e} is newer than supported version ${t}`);this.name="UnsupportedSchemaVersionError"}}var re=65536,q=16384,le=["succeeded","failed","cancelled","timed_out"],pe={queued:["running","cancelled","timed_out"],running:["queued","succeeded","failed","cancelled","timed_out"],succeeded:[],failed:["queued"],cancelled:["queued"],timed_out:["queued"]},ue=/(?:^|_)(?:authorization|cookie|credential|password|passwd|secret|token|api_?key|private_?key|access_?key)(?:$|_)/i,ae=/(?:authorization|password|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)\s*[=:]\s*[^\s,;]+/gi;function _(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function d(e){return typeof e==="string"?e:void 0}function G(e,t){if(t&&ue.test(t))return"[REDACTED]";if(e===null||typeof e==="boolean"||typeof e==="number")return e;if(typeof e==="string")return e.replace(ae,"[REDACTED]");if(Array.isArray(e))return e.map((r)=>G(r));if(e&&typeof e==="object"){let r={};for(let[i,a]of Object.entries(e))r[i]=G(a,i);return r}return String(e??"")}function ne(e,t=re){let r=G(e),i=JSON.stringify(r);if(Buffer.byteLength(i)<=t)return r;return{truncated:!0,originalBytes:Buffer.byteLength(i),preview:i.slice(0,Math.max(0,t-128))}}function N(e){return JSON.stringify(ne(e))}function M(e){if(!e)return;let t=e.replace(ae,"[REDACTED]");return Buffer.byteLength(t)<=q?t:`${t.slice(0,q-24)}
+[output truncated]`}function v(e){return{id:String(e.id),slug:String(e.slug),name:String(e.name),description:d(e.description),organizationId:d(e.organization_id),desiredConfigHash:d(e.desired_config_hash),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function D(e){return{id:String(e.id),projectId:String(e.project_id),slug:String(e.slug),name:String(e.name),kind:String(e.kind),region:d(e.region),desiredState:_(e.desired_state),discoveredState:_(e.discovered_state),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function y(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:d(e.environment_id),kind:String(e.kind),slug:String(e.slug),name:String(e.name),provider:d(e.provider),providerId:d(e.provider_id),desiredState:_(e.desired_state),discoveredState:_(e.discovered_state),metadata:_(e.metadata),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function f(e){return{id:String(e.id),kind:String(e.kind),externalId:d(e.external_id),displayName:String(e.display_name),metadata:_(e.metadata),disabledAt:d(e.disabled_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function u(e){return{id:String(e.id),projectId:d(e.project_id),environmentId:d(e.environment_id),resourceId:d(e.resource_id),actorId:d(e.actor_id),kind:String(e.kind),state:String(e.state),correlationId:String(e.correlation_id),idempotencyKey:d(e.idempotency_key),input:_(e.input),output:_(e.output),error:d(e.error),attempt:Number(e.attempt),priority:Number(e.priority),leaseOwner:d(e.lease_owner),leaseExpiresAt:d(e.lease_expires_at),cancelRequestedAt:d(e.cancel_requested_at),startedAt:d(e.started_at),finishedAt:d(e.finished_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Y(e){return{id:String(e.id),sequence:Number(e.sequence),organizationId:d(e.organization_id),projectId:d(e.project_id),operationId:d(e.operation_id),resourceId:d(e.resource_id),actorId:d(e.actor_id),correlationId:String(e.correlation_id),type:String(e.type),level:String(e.level),payload:_(e.payload),createdAt:String(e.created_at)}}function R(e){return{id:String(e.id),projectId:String(e.project_id),name:String(e.name),normalizedName:String(e.normalized_name),color:String(e.color),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function b(e){return{id:String(e.id),actorKey:String(e.actor_key),name:String(e.name),routeId:String(e.route_id),query:_(e.query),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function F(e){return{actorKey:String(e.actor_key),entityType:String(e.entity_type),entityId:String(e.entity_id),favorite:Number(e.favorite)===1,lastVisitedAt:String(e.last_visited_at),visitCount:Number(e.visit_count)}}function z(e){return{id:String(e.id),slug:String(e.slug),name:String(e.name),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function B(e){let t=String(e.scope_type);return{type:t,...t==="organization"?{}:{id:String(e.scope_id)}}}function k(e){return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),roleTemplate:String(e.role_template),scope:B(e),source:String(e.source??"manual"),status:String(e.status),sessionVersion:Number(e.session_version),lastActiveAt:d(e.last_active_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function g(e,t){let r=d(e.accepted_at),i=d(e.revoked_at),a=String(e.expires_at),E=i?"revoked":r?"accepted":a<=t?"expired":"pending";return{id:String(e.id),organizationId:String(e.organization_id),email:String(e.email),roleTemplate:String(e.role_template),scope:B(e),invitedByActorId:d(e.invited_by_actor_id),acceptedByActorId:d(e.accepted_by_actor_id),expiresAt:a,acceptedAt:r,revokedAt:i,state:E,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function w(e){return{id:String(e.id),organizationId:String(e.organization_id),membershipId:String(e.membership_id),effect:String(e.effect),capability:String(e.capability),scope:B(e),source:String(e.source??"manual"),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function U(e){return{type:e.type,id:e.id??null}}function Ce(e){return Array.from({length:e},()=>"?").join(", ")}function o(e,t,r){return e.run(t,r)}class Ee{path;database;nowFn;idFn;constructor(e={}){this.path=e.path??ie(e.cwd??process.cwd(),"control-plane.sqlite"),this.nowFn=e.now??(()=>new Date),this.idFn=e.id??(()=>crypto.randomUUID());let t=this.path===":memory:";if(!t){ce(te(this.path),{recursive:!0,mode:448});try{H(te(this.path),448)}catch{}}if(this.database=new _e(this.path,{create:!0,strict:!0}),this.database.run("PRAGMA foreign_keys = ON"),this.database.run(`PRAGMA busy_timeout = ${Math.max(100,e.busyTimeoutMs??5000)}`),!t)this.database.run("PRAGMA journal_mode = WAL"),this.database.run("PRAGMA synchronous = NORMAL");if(this.migrate(),!t)this.secureDatabaseFiles()}now(){return this.nowFn().toISOString()}secureDatabaseFiles(){for(let e of[this.path,`${this.path}-wal`,`${this.path}-shm`]){if(!ee(e))continue;try{H(e,384)}catch{}}}backupTo(e){this.database.run("VACUUM INTO ?",[e]);try{H(e,384)}catch{}}migrate(){let e=this.database.query("PRAGMA user_version").get(),t=Number(e?.user_version??0);if(t>l)throw new S(t,l);if(t===l)return;let r;if(t>0&&this.path!==":memory:")r=`${this.path}.v${t}.${Date.now()}.bak`,this.backupTo(r);try{if(this.database.transaction(()=>{for(let a of j){if(a.version<=t)continue;this.database.run(a.sql),o(this.database,"INSERT INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)",[a.version,a.name,this.now()]),this.database.run(`PRAGMA user_version = ${a.version}`)}}).exclusive(),r)this.setSetting("storage.last_backup",{path:r,createdAt:this.now(),reason:"pre-migration"})}catch(i){let a=r?` Restore from ${r}.`:"";throw Error(`Control-plane migration from schema ${t} failed.${a} ${i instanceof Error?i.message:String(i)}`)}}close(){if(this.path!==":memory:")this.secureDatabaseFiles();this.database.close()}transaction(e){return this.database.transaction(e).immediate()}createProject(e){let t=e.id??this.idFn(),r=this.now();return o(this.database,"INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",[t,e.slug,e.name,e.description??null,e.organizationId??null,e.desiredConfigHash??null,r,r]),this.getProject(t)}getProject(e){let t=this.database.query("SELECT * FROM projects WHERE id = ?").get(e);return t?v(t):void 0}getProjectBySlug(e){let t=this.database.query("SELECT * FROM projects WHERE slug = ?").get(e);return t?v(t):void 0}listProjects(){return this.database.query("SELECT * FROM projects ORDER BY name COLLATE NOCASE, id").all().map(v)}updateProject(e,t,r){let i=this.getProject(e);if(!i||i.version!==t)throw new p("Project",e,t);if(o(this.database,`UPDATE projects SET name = ?, description = ?, organization_id = ?, desired_config_hash = ?, version = version + 1, updated_at = ?
+      WHERE id = ? AND version = ?`,[r.name??i.name,r.description===null?null:r.description??i.description??null,r.organizationId===null?null:r.organizationId??i.organizationId??null,r.desiredConfigHash===null?null:r.desiredConfigHash??i.desiredConfigHash??null,this.now(),e,t]).changes!==1)throw new p("Project",e,t);return this.getProject(e)}createEnvironment(e){let t=e.id??this.idFn(),r=this.now();return o(this.database,`INSERT INTO environments (id, project_id, slug, name, kind, region, desired_state, discovered_state, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,e.projectId,e.slug,e.name,e.kind,e.region??null,N(e.desiredState??{}),N(e.discoveredState??{}),r,r]),D(this.database.query("SELECT * FROM environments WHERE id = ?").get(t))}listEnvironments(e){return this.database.query("SELECT * FROM environments WHERE project_id = ? ORDER BY name COLLATE NOCASE, id").all(e).map(D)}getEnvironmentBySlug(e,t){let r=this.database.query("SELECT * FROM environments WHERE project_id = ? AND slug = ?").get(e,t);return r?D(r):void 0}createResource(e){let t=e.id??this.idFn(),r=this.now();return o(this.database,`INSERT INTO resources (id, project_id, environment_id, kind, slug, name, provider, provider_id, desired_state, discovered_state, metadata, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,e.projectId,e.environmentId??null,e.kind,e.slug,e.name,e.provider??null,e.providerId??null,N(e.desiredState??{}),N(e.discoveredState??{}),N(e.metadata??{}),r,r]),y(this.database.query("SELECT * FROM resources WHERE id = ?").get(t))}listResources(e,t){return(t?this.database.query("SELECT * FROM resources WHERE project_id = ? AND environment_id = ? ORDER BY kind, name COLLATE NOCASE").all(e,t):this.database.query("SELECT * FROM resources WHERE project_id = ? ORDER BY kind, name COLLATE NOCASE").all(e)).map(y)}getResource(e){let t=this.database.query("SELECT * FROM resources WHERE id = ?").get(e);return t?y(t):void 0}updateResource(e,t,r){let i=this.getResource(e);if(!i||i.version!==t)throw new p("Resource",e,t);if(o(this.database,`UPDATE resources SET name = ?, provider = ?, provider_id = ?, desired_state = ?, discovered_state = ?, metadata = ?,
+      version = version + 1, updated_at = ? WHERE id = ? AND version = ?`,[r.name??i.name,r.provider===null?null:r.provider??i.provider??null,r.providerId===null?null:r.providerId??i.providerId??null,N(r.desiredState??i.desiredState),N(r.discoveredState??i.discoveredState),N(r.metadata??i.metadata),this.now(),e,t]).changes!==1)throw new p("Resource",e,t);return this.getResource(e)}createActor(e){let t=e.id??this.idFn(),r=this.now();return o(this.database,"INSERT INTO actors (id, kind, external_id, display_name, metadata, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[t,e.kind,e.externalId??null,e.displayName,N(e.metadata??{}),r,r]),f(this.database.query("SELECT * FROM actors WHERE id = ?").get(t))}getActorByExternalId(e,t){let r=this.database.query("SELECT * FROM actors WHERE kind = ? AND external_id = ?").get(e,t);return r?f(r):void 0}getActor(e){let t=this.database.query("SELECT * FROM actors WHERE id = ?").get(e);return t?f(t):void 0}createOrganization(e){let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/.test(t))throw Error("Organization slugs must contain 3-64 lowercase letters, numbers, or dashes");let r=e.name.trim();if(!r||r.length>100)throw Error("Organization names must contain 1-100 characters");let i=e.id??this.idFn(),a=this.now();return o(this.database,"INSERT INTO organizations (id, slug, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",[i,t,r,a,a]),this.getOrganization(i)}getOrganization(e){let t=this.database.query("SELECT * FROM organizations WHERE id = ?").get(e);return t?z(t):void 0}getOrganizationBySlug(e){let t=this.database.query("SELECT * FROM organizations WHERE slug = ?").get(e.trim().toLowerCase());return t?z(t):void 0}listOrganizations(e){return(e?this.database.query(`SELECT organizations.* FROM organizations JOIN organization_memberships ON organization_memberships.organization_id = organizations.id
+          WHERE organization_memberships.actor_id = ? AND organization_memberships.status = 'active' ORDER BY organizations.name COLLATE NOCASE`).all(e):this.database.query("SELECT * FROM organizations ORDER BY name COLLATE NOCASE").all()).map(z)}normalizeAuthorizationScope(e,t={type:"organization"}){if(t.type==="organization"){if(t.id&&t.id!==e)throw Error("Organization scope does not match the requested organization");return{type:"organization"}}if(!t.id)throw Error(`${t.type} scopes require an ID`);if(!this.resolveAuthorizationTarget(e,t))throw Error("Authorization scope was not found in this organization");return{type:t.type,id:t.id}}resolveAuthorizationTarget(e,t){if(!this.getOrganization(e))return;if(t.type==="organization")return{organizationId:e};if(!t.id)return;if(t.type==="project"){let i=this.database.query("SELECT id FROM projects WHERE id = ? AND organization_id = ?").get(t.id,e);return i?{organizationId:e,projectId:String(i.id)}:void 0}if(t.type==="environment"){let i=this.database.query("SELECT environments.id, environments.project_id FROM environments JOIN projects ON projects.id = environments.project_id WHERE environments.id = ? AND projects.organization_id = ?").get(t.id,e);return i?{organizationId:e,projectId:String(i.project_id),environmentId:String(i.id)}:void 0}let r=this.database.query(`SELECT resources.id, resources.project_id, resources.environment_id FROM resources
+      JOIN projects ON projects.id = resources.project_id WHERE resources.id = ? AND projects.organization_id = ?`).get(t.id,e);return r?{organizationId:e,projectId:String(r.project_id),environmentId:d(r.environment_id),resourceId:String(r.id)}:void 0}createMembership(e){if(!this.getActor(e.actorId))throw Error("Membership actor was not found");let t=this.normalizeAuthorizationScope(e.organizationId,e.scope);if(e.roleTemplate==="owner"&&t.type!=="organization")throw Error("Owners must be scoped to the organization");let r=e.id??this.idFn(),i=this.now();o(this.database,`INSERT INTO organization_memberships (id, organization_id, actor_id, role_template, scope_type, scope_id, source, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,e.organizationId,e.actorId,e.roleTemplate,t.type,t.id??null,e.source??"manual",i,i]);let a=this.getMembership(r);return this.appendEvent({organizationId:e.organizationId,actorId:e.performedByActorId,type:"organization.membership.created",payload:{membershipId:r,actorId:e.actorId,roleTemplate:e.roleTemplate,scope:U(t)}}),a}getMembership(e){let t=this.database.query("SELECT * FROM organization_memberships WHERE id = ?").get(e);return t?k(t):void 0}getMembershipForActor(e,t){let r=this.database.query("SELECT * FROM organization_memberships WHERE organization_id = ? AND actor_id = ?").get(e,t);return r?k(r):void 0}listMemberships(e,t={}){let r=t.includeRevoked?"":"AND status = 'active'";return this.database.query(`SELECT * FROM organization_memberships WHERE organization_id = ? ${r} ORDER BY created_at, id`).all(e).map(k)}updateMembership(e){let t=this.getMembership(e.id);if(!t)throw Error("Membership was not found");let r=this.normalizeAuthorizationScope(t.organizationId,e.scope??t.scope);if(e.roleTemplate==="owner"&&r.type!=="organization")throw Error("Owners must be scoped to the organization");if(t.roleTemplate==="owner"&&t.status==="active"&&(e.roleTemplate!=="owner"||r.type!=="organization"))this.assertAnotherOwner(t);return o(this.database,"UPDATE organization_memberships SET role_template = ?, scope_type = ?, scope_id = ?, session_version = session_version + 1, updated_at = ? WHERE id = ?",[e.roleTemplate,r.type,r.id??null,this.now(),t.id]),this.appendEvent({organizationId:t.organizationId,actorId:e.actorId,type:"organization.membership.updated",payload:{membershipId:t.id,from:{roleTemplate:t.roleTemplate,scope:U(t.scope)},to:{roleTemplate:e.roleTemplate,scope:U(r)}}}),this.getMembership(t.id)}revokeMembership(e,t){let r=this.getMembership(e);if(!r)throw Error("Membership was not found");if(r.status==="revoked")return r;if(r.roleTemplate==="owner")this.assertAnotherOwner(r);return o(this.database,"UPDATE organization_memberships SET status = 'revoked', session_version = session_version + 1, updated_at = ? WHERE id = ?",[this.now(),e]),this.appendEvent({organizationId:r.organizationId,actorId:t,type:"organization.membership.revoked",payload:{membershipId:e}}),this.getMembership(e)}touchMembership(e){let t=this.now();o(this.database,"UPDATE organization_memberships SET last_active_at = ?, updated_at = ? WHERE id = ? AND status = ?",[t,t,e,"active"]);let r=this.getMembership(e);if(!r)throw Error("Membership was not found");return r}assertAnotherOwner(e){if(Number(this.database.query("SELECT COUNT(*) AS count FROM organization_memberships WHERE organization_id = ? AND status = ? AND role_template = 'owner'").get(e.organizationId,"active")?.count??0)<=1)throw Error("Cannot remove or demote the last organization owner")}createInvitation(e){let t=e.email.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)||t.length>254)throw Error("A valid invitation email is required");let r=this.normalizeAuthorizationScope(e.organizationId,e.scope);if(e.roleTemplate==="owner"&&r.type!=="organization")throw Error("Owners must be scoped to the organization");let i=Ne(32).toString("base64url"),a=h("sha256").update(i).digest("hex"),E=e.id??this.idFn(),T=this.now(),s=new Date(this.nowFn().getTime()+Math.min(2592000000,Math.max(60000,e.expiresInMs??604800000))).toISOString();return o(this.database,`INSERT INTO organization_invitations (id, organization_id, email, role_template, scope_type, scope_id, token_hash, invited_by_actor_id, expires_at, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[E,e.organizationId,t,e.roleTemplate,r.type,r.id??null,a,e.invitedByActorId??null,s,T,T]),this.appendEvent({organizationId:e.organizationId,actorId:e.invitedByActorId,type:"organization.invitation.created",payload:{invitationId:E,email:t,roleTemplate:e.roleTemplate,scope:U(r),expiresAt:s}}),{invitation:this.getInvitation(E),token:i}}getInvitation(e){let t=this.database.query("SELECT * FROM organization_invitations WHERE id = ?").get(e);return t?g(t,this.now()):void 0}listInvitations(e){return this.database.query("SELECT * FROM organization_invitations WHERE organization_id = ? ORDER BY created_at DESC").all(e).map((t)=>g(t,this.now()))}inspectInvitationToken(e){let t=h("sha256").update(e).digest("hex"),r=this.database.query("SELECT * FROM organization_invitations WHERE token_hash = ?").get(t);return r?g(r,this.now()):void 0}acceptInvitation(e,t){let r=h("sha256").update(e).digest("hex");return this.transaction(()=>{let i=this.database.query("SELECT * FROM organization_invitations WHERE token_hash = ?").get(r);if(!i)throw Error("Invitation is invalid");let a=g(i,this.now());if(a.state!=="pending")throw Error(`Invitation is ${a.state}`);if(!this.getActor(t))throw Error("Invitation actor was not found");if(o(this.database,"UPDATE organization_invitations SET accepted_by_actor_id = ?, accepted_at = ?, updated_at = ? WHERE id = ? AND accepted_at IS NULL AND revoked_at IS NULL AND expires_at > ?",[t,this.now(),this.now(),a.id,this.now()]).changes!==1)throw Error("Invitation is no longer available");let T=this.getMembershipForActor(a.organizationId,t),s=T??this.createMembership({organizationId:a.organizationId,actorId:t,roleTemplate:a.roleTemplate,scope:a.scope,source:"invitation"});if(T&&a.roleTemplate==="owner"&&T.roleTemplate!=="owner")s=this.updateMembership({id:T.id,roleTemplate:"owner",scope:{type:"organization"},actorId:t});else if(T)for(let c of I(a.roleTemplate))this.upsertGrant({organizationId:a.organizationId,membershipId:T.id,effect:"allow",capability:c,scope:a.scope,source:"invitation"});return this.appendEvent({organizationId:a.organizationId,actorId:t,type:"organization.invitation.accepted",payload:{invitationId:a.id,membershipId:s.id}}),{invitation:this.getInvitation(a.id),membership:this.getMembership(s.id)}})}revokeInvitation(e,t){let r=this.getInvitation(e);if(!r)throw Error("Invitation was not found");if(r.acceptedAt)throw Error("Accepted invitations cannot be revoked");if(!r.revokedAt)o(this.database,"UPDATE organization_invitations SET revoked_at = ?, updated_at = ? WHERE id = ?",[this.now(),this.now(),e]);return this.appendEvent({organizationId:r.organizationId,actorId:t,type:"organization.invitation.revoked",payload:{invitationId:e}}),this.getInvitation(e)}reissueInvitation(e,t){let r=this.getInvitation(e);if(!r)throw Error("Invitation was not found");if(r.state==="accepted")throw Error("Accepted invitations cannot be reissued");return this.revokeInvitation(e,t),this.createInvitation({organizationId:r.organizationId,email:r.email,roleTemplate:r.roleTemplate,scope:r.scope,invitedByActorId:t})}upsertGrant(e){if(!C.includes(e.capability))throw Error("Unknown authorization capability");let t=this.getMembership(e.membershipId);if(!t||t.organizationId!==e.organizationId)throw Error("Grant membership was not found in this organization");let r=this.normalizeAuthorizationScope(e.organizationId,e.scope),i=this.now(),a=this.database.query("SELECT * FROM authorization_grants WHERE membership_id = ? AND effect = ? AND capability = ? AND scope_type = ? AND scope_id IS ?").get(e.membershipId,e.effect,e.capability,r.type,r.id??null);if(a)return w(a);let E=e.id??this.idFn();return o(this.database,`INSERT INTO authorization_grants (id, organization_id, membership_id, effect, capability, scope_type, scope_id, source, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[E,e.organizationId,e.membershipId,e.effect,e.capability,r.type,r.id??null,e.source??"manual",i,i]),o(this.database,"UPDATE organization_memberships SET session_version = session_version + 1, updated_at = ? WHERE id = ?",[i,e.membershipId]),this.appendEvent({organizationId:e.organizationId,actorId:e.actorId,type:"organization.grant.created",payload:{grantId:E,membershipId:e.membershipId,effect:e.effect,capability:e.capability,scope:U(r)}}),this.getGrant(E)}getGrant(e){let t=this.database.query("SELECT * FROM authorization_grants WHERE id = ?").get(e);return t?w(t):void 0}listGrants(e){return this.database.query("SELECT * FROM authorization_grants WHERE membership_id = ? ORDER BY effect DESC, capability, scope_type, scope_id").all(e).map(w)}removeGrant(e,t){let r=this.getGrant(e);if(!r)return!1;let i=o(this.database,"DELETE FROM authorization_grants WHERE id = ?",[e]).changes===1;if(i)o(this.database,"UPDATE organization_memberships SET session_version = session_version + 1, updated_at = ? WHERE id = ?",[this.now(),r.membershipId]),this.appendEvent({organizationId:r.organizationId,actorId:t,type:"organization.grant.removed",payload:{grantId:e,membershipId:r.membershipId}});return i}createOperation(e){if(e.idempotencyKey){let a=this.database.query("SELECT * FROM operations WHERE idempotency_key = ?").get(e.idempotencyKey);if(a)return u(a)}let t=e.id??this.idFn(),r=e.correlationId??this.idFn(),i=this.now();try{return this.transaction(()=>(o(this.database,`INSERT INTO operations (id, project_id, environment_id, resource_id, actor_id, kind, state, correlation_id, idempotency_key, input, output, priority, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, '{}', ?, ?, ?)`,[t,e.projectId??null,e.environmentId??null,e.resourceId??null,e.actorId??null,e.kind,r,e.idempotencyKey??null,N(e.input??{}),e.priority??0,i,i]),this.appendEvent({projectId:e.projectId,operationId:t,resourceId:e.resourceId,actorId:e.actorId,correlationId:r,type:"operation.queued",payload:{kind:e.kind}}),this.getOperation(t)))}catch(a){if(e.idempotencyKey){let E=this.database.query("SELECT * FROM operations WHERE idempotency_key = ?").get(e.idempotencyKey);if(E)return u(E)}throw a}}getOperation(e){let t=this.database.query("SELECT * FROM operations WHERE id = ?").get(e);return t?u(t):void 0}listOperations(e={}){let t=[],r=[];if(e.projectId)t.push("project_id = ?"),r.push(e.projectId);if(e.state)t.push("state = ?"),r.push(e.state);if(e.kind)t.push("kind = ?"),r.push(e.kind);if(e.before)t.push("created_at < ?"),r.push(e.before);let i=Math.min(500,Math.max(1,e.limit??100));r.push(i);let a=t.length?`WHERE ${t.join(" AND ")}`:"";return this.database.query(`SELECT * FROM operations ${a} ORDER BY created_at DESC, id DESC LIMIT ?`).all(...r).map(u)}claimNextOperation(e,t=60000,r){let i=this.now(),a=new Date(this.nowFn().getTime()+t).toISOString();return this.transaction(()=>{let E=r?.length?`AND kind IN (${Ce(r.length)})`:"",T=r?[...r]:[],s=this.database.query(`SELECT * FROM operations WHERE state = 'queued' ${E} ORDER BY priority DESC, created_at ASC, id ASC LIMIT 1`).get(...T);if(!s)return;let c=u(s);if(o(this.database,`UPDATE operations SET state = 'running', attempt = attempt + 1, lease_owner = ?, lease_expires_at = ?,
+        started_at = COALESCE(started_at, ?), updated_at = ?, version = version + 1 WHERE id = ? AND state = 'queued' AND version = ?`,[e,a,i,i,c.id,c.version]).changes!==1)return;return this.appendEvent({projectId:c.projectId,operationId:c.id,resourceId:c.resourceId,actorId:c.actorId,correlationId:c.correlationId,type:"operation.running",payload:{attempt:c.attempt+1,workerId:e}}),this.getOperation(c.id)})}claimOperation(e,t,r=60000){let i=this.now(),a=new Date(this.nowFn().getTime()+r).toISOString();return this.transaction(()=>{let E=this.getOperation(e);if(!E||E.state!=="queued")return;if(o(this.database,`UPDATE operations SET state = 'running', attempt = attempt + 1, lease_owner = ?, lease_expires_at = ?,
+        started_at = COALESCE(started_at, ?), updated_at = ?, version = version + 1 WHERE id = ? AND state = 'queued' AND version = ?`,[t,a,i,i,E.id,E.version]).changes!==1)return;return this.appendEvent({projectId:E.projectId,operationId:E.id,resourceId:E.resourceId,actorId:E.actorId,correlationId:E.correlationId,type:"operation.running",payload:{attempt:E.attempt+1,workerId:t}}),this.getOperation(E.id)})}transitionOperation(e,t){return this.transaction(()=>{let r=this.getOperation(e);if(!r)throw Error(`Operation ${e} was not found`);let i=t.expectedVersion??r.version;if(r.version!==i)throw new p("Operation",e,i);if(!pe[r.state].includes(t.to))throw new x(r.state,t.to);let a=this.now(),E=le.includes(t.to),T=t.to==="queued";if(o(this.database,`UPDATE operations SET state = ?, output = ?, error = ?, lease_owner = ?, lease_expires_at = ?,
+        finished_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND version = ?`,[t.to,N(t.output??r.output),M(t.error)??null,T||E?null:t.leaseOwner??r.leaseOwner??null,T||E?null:t.leaseExpiresAt??r.leaseExpiresAt??null,E?a:null,a,e,i]).changes!==1)throw new p("Operation",e,i);return this.appendEvent({projectId:r.projectId,operationId:e,resourceId:r.resourceId,actorId:r.actorId,correlationId:r.correlationId,type:`operation.${t.to}`,level:t.to==="failed"?"error":"info",payload:{from:r.state,to:t.to,error:M(t.error)??null}}),this.getOperation(e)})}requestCancellation(e){let t=this.now();o(this.database,"UPDATE operations SET cancel_requested_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND state IN ('queued', 'running')",[t,t,e]);let r=this.getOperation(e);if(!r)throw Error(`Operation ${e} was not found`);return r}reconcileOrphanedOperations(e={}){let t=(e.now??this.nowFn()).toISOString(),r=e.policy??"fail",i=this.database.query("SELECT * FROM operations WHERE state = 'running' AND (lease_expires_at IS NULL OR lease_expires_at <= ?)").all(t).map(u),a=0,E=0;for(let T of i)if(r==="requeue")this.transitionOperation(T.id,{to:"queued",expectedVersion:T.version,error:"Worker lease expired; operation requeued after restart."}),a++;else this.transitionOperation(T.id,{to:"failed",expectedVersion:T.version,error:"Worker lease expired or dashboard restarted before completion."}),E++;return{requeued:a,failed:E}}appendEvent(e){let t=e.id??this.idFn(),r=e.correlationId??this.idFn(),i=e.organizationId??(e.projectId?d(this.database.query("SELECT organization_id FROM projects WHERE id = ?").get(e.projectId)?.organization_id):void 0);return o(this.database,`INSERT INTO events (id, organization_id, project_id, operation_id, resource_id, actor_id, correlation_id, type, level, payload, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,i??null,e.projectId??null,e.operationId??null,e.resourceId??null,e.actorId??null,r,e.type,e.level??"info",N(e.payload??{}),this.now()]),Y(this.database.query("SELECT * FROM events WHERE id = ?").get(t))}listEvents(e={}){let t=[],r=[];if(e.organizationId)t.push("organization_id = ?"),r.push(e.organizationId);if(e.projectId)t.push("project_id = ?"),r.push(e.projectId);if(e.operationId)t.push("operation_id = ?"),r.push(e.operationId);if(e.resourceId)t.push("resource_id = ?"),r.push(e.resourceId);if(e.correlationId)t.push("correlation_id = ?"),r.push(e.correlationId);if(e.afterSequence!==void 0)t.push("sequence > ?"),r.push(e.afterSequence);let i=Math.min(1000,Math.max(1,e.limit??200));r.push(i);let a=t.length?`WHERE ${t.join(" AND ")}`:"";return this.database.query(`SELECT * FROM events ${a} ORDER BY sequence ASC LIMIT ?`).all(...r).map(Y)}setSetting(e,t){o(this.database,`INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)
+      ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`,[e,N(t),this.now()])}getSetting(e){let t=this.database.query("SELECT value FROM settings WHERE key = ?").get(e);return t?_(t.value):void 0}upsertTag(e,t,r="#5a8be0"){let i=t.trim().toLowerCase().replace(/\s+/g,"-");if(!/^[a-z0-9][a-z0-9-]{0,31}$/.test(i))throw Error("Tag names must contain 1-32 letters, numbers, or dashes");if(!/^#[0-9a-f]{6}$/i.test(r))throw Error("Tag colors must be six-digit hex colors");let a=this.now(),E=this.database.query("SELECT * FROM tags WHERE project_id = ? AND normalized_name = ?").get(e,i);if(E)return o(this.database,"UPDATE tags SET name = ?, color = ?, updated_at = ? WHERE id = ?",[t.trim(),r.toLowerCase(),a,String(E.id)]),R(this.database.query("SELECT * FROM tags WHERE id = ?").get(String(E.id)));let T=this.idFn();return o(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[T,e,t.trim(),i,r.toLowerCase(),a,a]),R(this.database.query("SELECT * FROM tags WHERE id = ?").get(T))}listTags(e){return this.database.query("SELECT * FROM tags WHERE project_id = ? ORDER BY normalized_name").all(e).map(R)}assignTag(e,t){if(!this.database.query("SELECT tags.id FROM tags JOIN resources ON resources.project_id = tags.project_id WHERE tags.id = ? AND resources.id = ?").get(t,e))throw Error("The tag and resource must belong to the same project");o(this.database,"INSERT OR IGNORE INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[e,t,this.now()])}removeTag(e,t){o(this.database,"DELETE FROM resource_tags WHERE resource_id = ? AND tag_id = ?",[e,t])}listResourceTags(e){return this.database.query(`SELECT resource_tags.resource_id, tags.* FROM resource_tags JOIN tags ON tags.id = resource_tags.tag_id
+      WHERE tags.project_id = ? ORDER BY tags.normalized_name`).all(e).map((r)=>({resourceId:String(r.resource_id),tag:R(r)}))}saveFilter(e,t,r,i){let a=t.trim();if(!a||a.length>64)throw Error("Saved filter names must contain 1-64 characters");if(!r||r.length>160||/^[a-z][a-z0-9+.-]*:|^\/\//i.test(r))throw Error("Saved filter routes must be local route IDs or paths");let E=N(i);if(E.length>8192)throw Error("Saved filter queries must be smaller than 8 KB");let T=this.database.query("SELECT * FROM saved_filters WHERE actor_key = ? AND name = ?").get(e,a),s=this.now();if(T)return o(this.database,"UPDATE saved_filters SET route_id = ?, query = ?, updated_at = ? WHERE id = ?",[r,E,s,String(T.id)]),b(this.database.query("SELECT * FROM saved_filters WHERE id = ?").get(String(T.id)));let c=this.idFn();return o(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[c,e,a,r,E,s,s]),b(this.database.query("SELECT * FROM saved_filters WHERE id = ?").get(c))}listSavedFilters(e){return this.database.query("SELECT * FROM saved_filters WHERE actor_key = ? ORDER BY updated_at DESC, name").all(e).map(b)}deleteSavedFilter(e,t){return o(this.database,"DELETE FROM saved_filters WHERE actor_key = ? AND id = ?",[e,t]).changes===1}recordNavigation(e,t,r){let i=this.now();return o(this.database,`INSERT INTO navigation_items (actor_key, entity_type, entity_id, last_visited_at) VALUES (?, ?, ?, ?)
+      ON CONFLICT(actor_key, entity_type, entity_id) DO UPDATE SET last_visited_at = excluded.last_visited_at, visit_count = visit_count + 1`,[e,t,r,i]),F(this.database.query("SELECT * FROM navigation_items WHERE actor_key = ? AND entity_type = ? AND entity_id = ?").get(e,t,r))}setFavorite(e,t,r,i){let a=this.now();return o(this.database,`INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at) VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(actor_key, entity_type, entity_id) DO UPDATE SET favorite = excluded.favorite`,[e,t,r,i?1:0,a]),F(this.database.query("SELECT * FROM navigation_items WHERE actor_key = ? AND entity_type = ? AND entity_id = ?").get(e,t,r))}listNavigation(e,t={}){let r=t.favoritesOnly?"AND favorite = 1":"",i=Math.min(100,Math.max(1,t.limit??20));return this.database.query(`SELECT * FROM navigation_items WHERE actor_key = ? ${r} ORDER BY favorite DESC, last_visited_at DESC LIMIT ?`).all(e,i).map(F)}compact(e={}){let t=new Date(this.nowFn().getTime()-(e.eventRetentionDays??90)*86400000).toISOString(),r=new Date(this.nowFn().getTime()-(e.operationRetentionDays??365)*86400000).toISOString(),i=this.transaction(()=>{let a=o(this.database,"DELETE FROM events WHERE created_at < ?",[t]).changes,E=o(this.database,"DELETE FROM operations WHERE created_at < ? AND state IN ('succeeded', 'failed', 'cancelled', 'timed_out')",[r]).changes;return{events:a,operations:E}});if(e.vacuum!==!1)this.database.run("VACUUM");return{deletedEvents:i.events,deletedOperations:i.operations,vacuumed:e.vacuum!==!1}}createBackup(e="manual"){if(this.path===":memory:")throw Error("Cannot create a filesystem backup for an in-memory control plane");let t=`${this.path}.${Date.now()}.bak`;return this.backupTo(t),this.setSetting("storage.last_backup",{path:t,createdAt:this.now(),reason:e}),t}integrityCheck(){let e=this.database.query("PRAGMA integrity_check").all();return e.length===1&&Object.values(e[0])[0]==="ok"?"ok":"corrupt"}health(){let e=Object.fromEntries(["queued","running","succeeded","failed","cancelled","timed_out"].map((a)=>[a,0]));for(let a of this.database.query("SELECT state, COUNT(*) AS count FROM operations GROUP BY state").all())e[String(a.state)]=Number(a.count);let t=this.database.query("PRAGMA journal_mode").get(),r=this.getSetting("storage.last_backup"),i=r&&!Array.isArray(r)&&typeof r==="object"&&typeof r.createdAt==="string"?r.createdAt:void 0;return{path:this.path,schemaVersion:Number(this.database.query("PRAGMA user_version").get()?.user_version??0),supportedSchemaVersion:l,integrity:this.integrityCheck(),journalMode:String(t?.journal_mode??"unknown"),databaseBytes:this.path!==":memory:"&&ee(this.path)?Le(this.path).size:this.database.serialize().byteLength,lastBackupAt:i,operations:e,pendingRetryableOperations:e.queued+e.failed+e.timed_out}}exportSnapshot(){let e={};for(let t of this.database.query("SELECT key, value FROM settings ORDER BY key").all())e[String(t.key)]=_(t.value);return{format:"ts-cloud-control-plane",schemaVersion:l,exportedAt:this.now(),organizations:this.database.query("SELECT * FROM organizations ORDER BY id").all().map(z),memberships:this.database.query("SELECT * FROM organization_memberships ORDER BY id").all().map(k),invitations:this.database.query("SELECT * FROM organization_invitations ORDER BY id").all().map((t)=>({...g(t,this.now()),tokenHash:String(t.token_hash)})),grants:this.database.query("SELECT * FROM authorization_grants ORDER BY id").all().map(w),projects:this.database.query("SELECT * FROM projects ORDER BY id").all().map(v),environments:this.database.query("SELECT * FROM environments ORDER BY id").all().map(D),resources:this.database.query("SELECT * FROM resources ORDER BY id").all().map(y),actors:this.database.query("SELECT * FROM actors ORDER BY id").all().map(f),operations:this.database.query("SELECT * FROM operations ORDER BY id").all().map(u),events:this.database.query("SELECT * FROM events ORDER BY sequence").all().map(Y),settings:e,tags:this.database.query("SELECT * FROM tags ORDER BY id").all().map(R),resourceTags:this.database.query("SELECT * FROM resource_tags ORDER BY resource_id, tag_id").all().map((t)=>({resourceId:String(t.resource_id),tagId:String(t.tag_id),createdAt:String(t.created_at)})),savedFilters:this.database.query("SELECT * FROM saved_filters ORDER BY id").all().map(b),navigationItems:this.database.query("SELECT * FROM navigation_items ORDER BY actor_key, entity_type, entity_id").all().map(F)}}importSnapshot(e,t={}){if(e.format!=="ts-cloud-control-plane")throw Error("Unsupported control-plane snapshot format");if(e.schemaVersion>l)throw new S(e.schemaVersion,l);this.transaction(()=>{if((Number(this.database.query("SELECT COUNT(*) AS count FROM projects").get()?.count??0)>0||Number(this.database.query("SELECT COUNT(*) AS count FROM operations").get()?.count??0)>0)&&!t.replace)throw Error("Control plane is not empty; pass replace: true to import this snapshot");if(t.replace)this.database.run("DELETE FROM authorization_grants"),this.database.run("DELETE FROM organization_invitations"),this.database.run("DELETE FROM organization_memberships"),this.database.run("DELETE FROM resource_tags"),this.database.run("DELETE FROM tags"),this.database.run("DELETE FROM saved_filters"),this.database.run("DELETE FROM navigation_items"),this.database.run("DELETE FROM events"),this.database.run("DELETE FROM operations"),this.database.run("DELETE FROM resources"),this.database.run("DELETE FROM environments"),this.database.run("DELETE FROM projects"),this.database.run("DELETE FROM actors"),this.database.run("DELETE FROM organizations"),this.database.run("DELETE FROM settings");for(let i of e.organizations??[])o(this.database,"INSERT INTO organizations (id, slug, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",[i.id,i.slug,i.name,i.createdAt,i.updatedAt]);for(let i of e.projects)o(this.database,`INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, version, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.slug,i.name,i.description??null,i.organizationId??null,i.desiredConfigHash??null,i.version,i.createdAt,i.updatedAt]);for(let i of e.environments)o(this.database,`INSERT INTO environments (id, project_id, slug, name, kind, region, desired_state, discovered_state, version, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.projectId,i.slug,i.name,i.kind,i.region??null,N(i.desiredState),N(i.discoveredState),i.version,i.createdAt,i.updatedAt]);for(let i of e.resources)o(this.database,`INSERT INTO resources (id, project_id, environment_id, kind, slug, name, provider, provider_id, desired_state, discovered_state, metadata, version, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.projectId,i.environmentId??null,i.kind,i.slug,i.name,i.provider??null,i.providerId??null,N(i.desiredState),N(i.discoveredState),N(i.metadata),i.version,i.createdAt,i.updatedAt]);for(let i of e.actors)o(this.database,`INSERT INTO actors (id, kind, external_id, display_name, metadata, disabled_at, version, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.kind,i.externalId??null,i.displayName,N(i.metadata),i.disabledAt??null,i.version,i.createdAt,i.updatedAt]);for(let i of e.memberships??[])o(this.database,`INSERT INTO organization_memberships (id, organization_id, actor_id, role_template, scope_type, scope_id, status, session_version, last_active_at, source, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.organizationId,i.actorId,i.roleTemplate,i.scope.type,i.scope.id??null,i.status,i.sessionVersion,i.lastActiveAt??null,i.source??"manual",i.createdAt,i.updatedAt]);for(let i of e.invitations??[]){let a=i.tokenHash??h("sha256").update(`revoked:${i.id}:${this.idFn()}`).digest("hex");o(this.database,`INSERT INTO organization_invitations (id, organization_id, email, role_template, scope_type, scope_id, token_hash, invited_by_actor_id, accepted_by_actor_id, expires_at, accepted_at, revoked_at, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.organizationId,i.email,i.roleTemplate,i.scope.type,i.scope.id??null,a,i.invitedByActorId??null,i.acceptedByActorId??null,i.expiresAt,i.acceptedAt??null,i.tokenHash?i.revokedAt??null:i.revokedAt??this.now(),i.createdAt,i.updatedAt])}for(let i of e.grants??[])o(this.database,`INSERT INTO authorization_grants (id, organization_id, membership_id, effect, capability, scope_type, scope_id, source, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.organizationId,i.membershipId,i.effect,i.capability,i.scope.type,i.scope.id??null,i.source??"manual",i.createdAt,i.updatedAt]);for(let i of e.operations)o(this.database,`INSERT INTO operations (id, project_id, environment_id, resource_id, actor_id, kind, state, correlation_id, idempotency_key,
           input, output, error, attempt, priority, lease_owner, lease_expires_at, cancel_requested_at, started_at, finished_at, version, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.projectId??null,e.environmentId??null,e.resourceId??null,e.actorId??null,e.kind,e.state,e.correlationId,e.idempotencyKey??null,r(e.input),r(e.output),z(e.error)??null,e.attempt,e.priority,e.leaseOwner??null,e.leaseExpiresAt??null,e.cancelRequestedAt??null,e.startedAt??null,e.finishedAt??null,e.version,e.createdAt,e.updatedAt]);for(let e of E.events)a(this.database,`INSERT INTO events (sequence, id, organization_id, project_id, operation_id, resource_id, actor_id, correlation_id, type, level, payload, created_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.sequence,e.id,e.organizationId??null,e.projectId??null,e.operationId??null,e.resourceId??null,e.actorId??null,e.correlationId,e.type,e.level,r(e.payload),e.createdAt]);for(let[e,L]of Object.entries(E.settings))a(this.database,"INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)",[e,r(L),this.now()]);for(let e of E.tags??[])a(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[e.id,e.projectId,e.name,e.normalizedName,e.color,e.createdAt,e.updatedAt]);for(let e of E.resourceTags??[])a(this.database,"INSERT INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[e.resourceId,e.tagId,e.createdAt]);for(let e of E.savedFilters??[])a(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[e.id,e.actorKey,e.name,e.routeId,r(e.query),e.createdAt,e.updatedAt]);for(let e of E.navigationItems??[])a(this.database,"INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at, visit_count) VALUES (?, ?, ?, ?, ?, ?)",[e.actorKey,e.entityType,e.entityId,e.favorite?1:0,e.lastVisitedAt,e.visitCount])})}}var XE=new Set(["domain","domains","hostname","hostnames","url","repository","repo","image","label","labels"]),RE=new Set(["sha","commit","commitsha","release","releaseid"]);function tE(E,T){if(!E||typeof E!=="object"||Array.isArray(E))return[];let N=[];for(let[e,L]of Object.entries(E)){if(!T.has(e.toLowerCase()))continue;if(typeof L==="string")N.push(L);else if(Array.isArray(L))N.push(...L.filter((t)=>typeof t==="string"))}return N}function W(E){return E.toLowerCase().trim().replace(/[^a-z0-9._:/@-]+/g," ")}function $(E,T,N){let e=W(E),L=W(T),t=W(N);if(!e)return 0;if(L===e)return 1000;if(L.startsWith(e))return 800-Math.min(100,L.length-e.length);if(L.includes(e))return 650-Math.min(100,L.indexOf(e));let _=e.split(/\s+/).filter(Boolean);if(_.every((n)=>t.includes(n)))return 400+_.length*10;let s=0;for(let n of e){if(s=t.indexOf(n,s),s<0)return 0;s++}return Math.max(1,180-Math.floor(t.length/20))}function lE(E,T){let N=E.kind.toLowerCase();if(N==="server"||N==="compute")return{type:"server",href:`/server/metrics?env=${encodeURIComponent(T)}`};if(N.includes("database")||["mysql","postgres","postgresql","sqlite","redis"].includes(N))return{type:"database",href:`/server/database?env=${encodeURIComponent(T)}&database=${encodeURIComponent(E.slug)}`};return{type:"service",href:`/server/sites?env=${encodeURIComponent(T)}&service=${encodeURIComponent(E.slug)}`}}function AE(E,T){let N=E.getProject(T.projectId);if(!N)return[];let e=E.listEnvironments(N.id),L=new Map(e.map((i)=>[i.id,i])),t=E.listResourceTags(N.id),_=new Map;for(let i of t){let o=_.get(i.resourceId)??[];o.push({id:i.tag.id,name:i.tag.name,color:i.tag.color}),_.set(i.resourceId,o)}let s=[],n=T.allowedResourceSlugs!==void 0;if(!n){s.push({type:"project",id:N.id,title:N.name,subtitle:N.slug,href:`/?project=${encodeURIComponent(N.slug)}`,tags:[],score:0});for(let i of e)s.push({type:"environment",id:i.id,title:i.name,subtitle:`${N.name} · ${i.kind}`,href:`/?env=${encodeURIComponent(i.slug)}`,environment:i.slug,tags:[],score:0})}let Z=E.listResources(N.id).filter((i)=>!T.allowedResourceSlugs||T.allowedResourceSlugs.has(i.slug));for(let i of Z){let o=i.environmentId?L.get(i.environmentId):void 0,R=_.get(i.id)??[],S=tE(i.desiredState,XE),I=[i.name,i.slug,i.kind,i.provider,i.providerId,o?.slug,...S,...R.map((aE)=>aE.name)].filter(Boolean).join(" "),p=lE(i,o?.slug??e[0]?.slug??"");s.push({type:p.type,id:i.id,title:i.name,subtitle:[i.kind,...S.slice(0,2)].join(" · "),href:p.href,environment:o?.slug,provider:i.provider,tags:R,score:$(T.query,i.name,I)})}if(!n)for(let i of E.listOperations({projectId:N.id,limit:500})){let o=i.environmentId?L.get(i.environmentId):void 0,R=tE(i.input,RE),S=i.kind.includes("deploy"),I=R[0]??i.kind,p=[i.kind,i.id,i.correlationId,i.state,...R].join(" ");s.push({type:S?"deployment":"operation",id:i.id,title:I,subtitle:`${i.kind} · ${i.state}`,href:`/server/activity?env=${encodeURIComponent(o?.slug??e[0]?.slug??"")}&operation=${encodeURIComponent(i.id)}`,environment:o?.slug,status:i.state,tags:[],score:$(T.query,I,p)})}for(let i of s)if(i.score===0)i.score=$(T.query,i.title,`${i.title} ${i.subtitle} ${i.environment??""} ${i.provider??""}`);let J={service:0,server:1,database:2,deployment:3,environment:4,project:5,operation:6};return s.filter((i)=>i.score>0).sort((i,o)=>o.score-i.score||J[i.type]-J[o.type]||i.title.localeCompare(o.title)||i.id.localeCompare(o.id)).slice(0,Math.min(50,Math.max(1,T.limit??20)))}export{X as jg,u as kg,V as lg,sE as mg,LE as ng,iE as og,AE as pg};
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.projectId??null,i.environmentId??null,i.resourceId??null,i.actorId??null,i.kind,i.state,i.correlationId,i.idempotencyKey??null,N(i.input),N(i.output),M(i.error)??null,i.attempt,i.priority,i.leaseOwner??null,i.leaseExpiresAt??null,i.cancelRequestedAt??null,i.startedAt??null,i.finishedAt??null,i.version,i.createdAt,i.updatedAt]);for(let i of e.events)o(this.database,`INSERT INTO events (sequence, id, organization_id, project_id, operation_id, resource_id, actor_id, correlation_id, type, level, payload, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.sequence,i.id,i.organizationId??null,i.projectId??null,i.operationId??null,i.resourceId??null,i.actorId??null,i.correlationId,i.type,i.level,N(i.payload),i.createdAt]);for(let[i,a]of Object.entries(e.settings))o(this.database,"INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)",[i,N(a),this.now()]);for(let i of e.tags??[])o(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[i.id,i.projectId,i.name,i.normalizedName,i.color,i.createdAt,i.updatedAt]);for(let i of e.resourceTags??[])o(this.database,"INSERT INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[i.resourceId,i.tagId,i.createdAt]);for(let i of e.savedFilters??[])o(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[i.id,i.actorKey,i.name,i.routeId,N(i.query),i.createdAt,i.updatedAt]);for(let i of e.navigationItems??[])o(this.database,"INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at, visit_count) VALUES (?, ?, ?, ?, ?, ?)",[i.actorKey,i.entityType,i.entityId,i.favorite?1:0,i.lastVisitedAt,i.visitCount])})}}var Oe=new Set(["domain","domains","hostname","hostnames","url","repository","repo","image","label","labels"]),Re=new Set(["sha","commit","commitsha","release","releaseid"]);function oe(e,t){if(!e||typeof e!=="object"||Array.isArray(e))return[];let r=[];for(let[i,a]of Object.entries(e)){if(!t.has(i.toLowerCase()))continue;if(typeof a==="string")r.push(a);else if(Array.isArray(a))r.push(...a.filter((E)=>typeof E==="string"))}return r}function Q(e){return e.toLowerCase().trim().replace(/[^a-z0-9._:/@-]+/g," ")}function W(e,t,r){let i=Q(e),a=Q(t),E=Q(r);if(!i)return 0;if(a===i)return 1000;if(a.startsWith(i))return 800-Math.min(100,a.length-i.length);if(a.includes(i))return 650-Math.min(100,a.indexOf(i));let T=i.split(/\s+/).filter(Boolean);if(T.every((c)=>E.includes(c)))return 400+T.length*10;let s=0;for(let c of i){if(s=E.indexOf(c,s),s<0)return 0;s++}return Math.max(1,180-Math.floor(E.length/20))}function ge(e,t){let r=e.kind.toLowerCase();if(r==="server"||r==="compute")return{type:"server",href:`/server/metrics?env=${encodeURIComponent(t)}`};if(r.includes("database")||["mysql","postgres","postgresql","sqlite","redis"].includes(r))return{type:"database",href:`/server/database?env=${encodeURIComponent(t)}&database=${encodeURIComponent(e.slug)}`};return{type:"service",href:`/server/sites?env=${encodeURIComponent(t)}&service=${encodeURIComponent(e.slug)}`}}function Ue(e,t){let r=e.getProject(t.projectId);if(!r)return[];let i=e.listEnvironments(r.id),a=new Map(i.map((n)=>[n.id,n])),E=e.listResourceTags(r.id),T=new Map;for(let n of E){let L=T.get(n.resourceId)??[];L.push({id:n.tag.id,name:n.tag.name,color:n.tag.color}),T.set(n.resourceId,L)}let s=[],c=t.allowedResourceSlugs!==void 0;if(!c){s.push({type:"project",id:r.id,title:r.name,subtitle:r.slug,href:`/?project=${encodeURIComponent(r.slug)}`,tags:[],score:0});for(let n of i)s.push({type:"environment",id:n.id,title:n.name,subtitle:`${r.name} · ${n.kind}`,href:`/?env=${encodeURIComponent(n.slug)}`,environment:n.slug,tags:[],score:0})}let V=e.listResources(r.id).filter((n)=>!t.allowedResourceSlugs||t.allowedResourceSlugs.has(n.slug));for(let n of V){let L=n.environmentId?a.get(n.environmentId):void 0,O=T.get(n.id)??[],A=oe(n.desiredState,Oe),m=[n.name,n.slug,n.kind,n.provider,n.providerId,L?.slug,...A,...O.map((Te)=>Te.name)].filter(Boolean).join(" "),X=ge(n,L?.slug??i[0]?.slug??"");s.push({type:X.type,id:n.id,title:n.name,subtitle:[n.kind,...A.slice(0,2)].join(" · "),href:X.href,environment:L?.slug,provider:n.provider,tags:O,score:W(t.query,n.name,m)})}if(!c)for(let n of e.listOperations({projectId:r.id,limit:500})){let L=n.environmentId?a.get(n.environmentId):void 0,O=oe(n.input,Re),A=n.kind.includes("deploy"),m=O[0]??n.kind,X=[n.kind,n.id,n.correlationId,n.state,...O].join(" ");s.push({type:A?"deployment":"operation",id:n.id,title:m,subtitle:`${n.kind} · ${n.state}`,href:`/server/activity?env=${encodeURIComponent(L?.slug??i[0]?.slug??"")}&operation=${encodeURIComponent(n.id)}`,environment:L?.slug,status:n.state,tags:[],score:W(t.query,m,X)})}for(let n of s)if(n.score===0)n.score=W(t.query,n.title,`${n.title} ${n.subtitle} ${n.environment??""} ${n.provider??""}`);let J={service:0,server:1,database:2,deployment:3,environment:4,project:5,operation:6};return s.filter((n)=>n.score>0).sort((n,L)=>L.score-n.score||J[n.type]-J[L.type]||n.title.localeCompare(L.title)||n.id.localeCompare(L.id)).slice(0,Math.min(50,Math.max(1,t.limit??20)))}export{C as yg,I as zg,Z as Ag,de as Bg,ne as Cg,Ee as Dg,Ue as Eg};

package/dist/bin/chunk-jnx4jgw8.js

@@ -0,0 +1 @@
+import{Id as a,Jd as b,Kd as c,Ld as d,Md as e,Nd as f,Od as g,Pd as h,Qd as i,Rd as j,Sd as k,Td as l,Ud as m,Vd as n,Wd as o,Xd as p,Yd as q}from"./chunk-ckxpgwxw.js";import"./chunk-pjpa4x52.js";import"./chunk-6eat8ezk.js";import"./chunk-d6zzgvtn.js";import"./chunk-1v6bt68w.js";import"./chunk-ey9fagrr.js";import"./chunk-anm3ae6z.js";import"./chunk-b2ymh8k0.js";export{e as assertEnvWithinLimit,d as buildFunctionEnv,f as deployServerlessApp,m as getCommandRecord,c as infraEnvFromOutputs,l as listCommandHistory,g as redeployServerlessApp,b as resolveSecrets,a as resolveServerlessFunctions,q as restoreServerlessDatabase,h as rollbackServerlessApp,k as runAndRecordCommand,n as runDbQuery,j as runRemoteCommand,p as scaleServerlessDatabase,o as serverlessInfo,i as setMaintenance};

package/dist/bin/chunk-jt1tndm2.js

@@ -0,0 +1,3 @@
+import{Gd as he}from"./chunk-sbejksrh.js";import{Rd as ge,Wd as pe}from"./chunk-ckxpgwxw.js";import{Zd as de}from"./chunk-pjpa4x52.js";import{gg as ye}from"./chunk-7wzdaqh6.js";import{hg as le}from"./chunk-6eat8ezk.js";import{ng as V,og as Z}from"./chunk-d6zzgvtn.js";import{bh as N,ch as te}from"./chunk-ey9fagrr.js";import{Zh as ce,lo as ue}from"./chunk-anm3ae6z.js";class j{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new N(V(t))}async query(e){let t=new URLSearchParams(te({Version:"2010-08-01",...e})).toString();return this.client.request({service:"monitoring",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t})}async getMetricStatistics(e){let t={Action:"GetMetricStatistics",Namespace:e.Namespace,MetricName:e.MetricName,StartTime:e.StartTime.toISOString(),EndTime:e.EndTime.toISOString(),Period:e.Period};(e.Statistics??[]).forEach((o,h)=>{t[`Statistics.member.${h+1}`]=o}),(e.ExtendedStatistics??[]).forEach((o,h)=>{t[`ExtendedStatistics.member.${h+1}`]=o}),(e.Dimensions??[]).forEach((o,h)=>{t[`Dimensions.member.${h+1}.Name`]=o.Name,t[`Dimensions.member.${h+1}.Value`]=o.Value});let r=await this.query(t),s=(r.GetMetricStatisticsResult||r)?.Datapoints?.member??[];if(!Array.isArray(s))s=s?[s]:[];return s.map((o)=>{let h={},m=o.ExtendedStatistics?.entry;if(m){if(!Array.isArray(m))m=[m];for(let d of m)if(d?.key!=null)h[d.key]=Number(d.value)}return{Timestamp:o.Timestamp,Sum:o.Sum!=null?Number(o.Sum):void 0,Average:o.Average!=null?Number(o.Average):void 0,Maximum:o.Maximum!=null?Number(o.Maximum):void 0,Minimum:o.Minimum!=null?Number(o.Minimum):void 0,Percentiles:Object.keys(h).length?h:void 0,Unit:o.Unit}})}async getMetricSeries(e){let t=/^p\d/.test(e.Stat);return(await this.getMetricStatistics({Namespace:e.Namespace,MetricName:e.MetricName,Dimensions:e.Dimensions,StartTime:e.StartTime,EndTime:e.EndTime,Period:e.Period,Statistics:t?[]:[e.Stat],ExtendedStatistics:t?[e.Stat]:[]})).slice().sort((a,s)=>new Date(a.Timestamp??0).getTime()-new Date(s.Timestamp??0).getTime()).map((a)=>t?a.Percentiles?.[e.Stat]??0:a[e.Stat]??0)}async describeAlarms(e){let t={Action:"DescribeAlarms"};if(e?.AlarmNamePrefix)t.AlarmNamePrefix=e.AlarmNamePrefix;if(e?.MaxRecords)t.MaxRecords=e.MaxRecords;let r=await this.query(t),s=(r.DescribeAlarmsResult||r)?.MetricAlarms?.member??[];if(!Array.isArray(s))s=s?[s]:[];return s.map((o)=>({AlarmName:o.AlarmName,StateValue:o.StateValue,MetricName:o.MetricName,ComparisonOperator:o.ComparisonOperator,Threshold:o.Threshold!=null?Number(o.Threshold):void 0,Namespace:o.Namespace}))}async putMetricAlarm(e){let t={Action:"PutMetricAlarm",AlarmName:e.AlarmName,Namespace:e.Namespace,MetricName:e.MetricName,ComparisonOperator:e.ComparisonOperator,Threshold:e.Threshold,EvaluationPeriods:e.EvaluationPeriods,Period:e.Period,Statistic:e.Statistic};if(e.AlarmDescription)t.AlarmDescription=e.AlarmDescription;(e.Dimensions??[]).forEach((r,a)=>{t[`Dimensions.member.${a+1}.Name`]=r.Name,t[`Dimensions.member.${a+1}.Value`]=r.Value}),(e.AlarmActions??[]).forEach((r,a)=>{t[`AlarmActions.member.${a+1}`]=r}),await this.query(t)}async deleteAlarms(e){if(!e.length)return;let t={Action:"DeleteAlarms"};e.forEach((r,a)=>{t[`AlarmNames.member.${a+1}`]=r}),await this.query(t)}}class K{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new N(void 0,{profile:t})}async createLogGroup(e,t){await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.CreateLogGroup","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({logGroupName:e,...t?{tags:t}:{}})})}async putRetentionPolicy(e,t){if(![1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1096,1827,2192,2557,2922,3288,3653].includes(t))throw Error("Unsupported CloudWatch Logs retention period");await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.PutRetentionPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({logGroupName:e,retentionInDays:t})})}async describeLogStreams(e){let t={logGroupName:e.logGroupName};if(e.logStreamNamePrefix)t.logStreamNamePrefix=e.logStreamNamePrefix;if(e.orderBy)t.orderBy=e.orderBy;if(e.descending!==void 0)t.descending=e.descending;if(e.limit)t.limit=e.limit;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.DescribeLogStreams","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async getLogEvents(e){let t={logGroupName:e.logGroupName,logStreamName:e.logStreamName};if(e.startTime)t.startTime=e.startTime;if(e.endTime)t.endTime=e.endTime;if(e.limit)t.limit=e.limit;if(e.startFromHead!==void 0)t.startFromHead=e.startFromHead;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.GetLogEvents","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async describeLogGroups(e){let t={};if(e?.logGroupNamePrefix)t.logGroupNamePrefix=e.logGroupNamePrefix;if(e?.limit)t.limit=e.limit;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.DescribeLogGroups","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async deleteLogGroup(e){await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.DeleteLogGroup","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({logGroupName:e})})}async filterLogEvents(e){let t={logGroupName:e.logGroupName};if(e.logStreamNames)t.logStreamNames=e.logStreamNames;if(e.startTime)t.startTime=e.startTime;if(e.endTime)t.endTime=e.endTime;if(e.filterPattern)t.filterPattern=e.filterPattern;if(e.limit)t.limit=e.limit;return await this.client.request({service:"logs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"Logs_20140328.FilterLogEvents","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}}import{createHash as fe}from"node:crypto";import{existsSync as re,mkdirSync as Se,readdirSync as Ce,readFileSync as Te,rmSync as be,writeFileSync as Ne}from"node:fs";import{homedir as Ae}from"node:os";import{join as I}from"node:path";var se=1,ie=3600000,Me=24*ie,ve=ie,xe=30*Me;function H(){let e=process.env.XDG_CACHE_HOME;return I(e&&e.trim()?e:I(Ae(),".cache"),"ts-cloud","cost-explorer")}function B(e){return I(H(),e??"__default__")}function ae(e){let t={s:e.start,e:e.end,g:e.granularity,m:[...e.metrics].sort(),gb:[...e.groupBy].map((r)=>`${r.Type}:${r.Key}`).sort(),f:e.filter??null};return fe("sha256").update(JSON.stringify(t)).digest("hex").slice(0,24)}function De(e,t){let r=Date.parse(`${t}T00:00:00Z`);if(Number.isNaN(r))return!1;let a=new Date,s=Date.UTC(a.getUTCFullYear(),a.getUTCMonth(),1);return r<=s}function Pe(e){return De(e.start,e.end)?xe:ve}function ne(e,t){let r=I(B(e),`${ae(t)}.json`);if(!re(r))return null;let a;try{a=JSON.parse(Te(r,"utf-8"))}catch{return null}if(a.schema!==se)return null;let s=Date.now()-a.savedAt;if(s<0||s>Pe(t))return null;return{response:a.response,ageSeconds:Math.floor(s/1000)}}function oe(e,t,r){let a=B(e);Se(a,{recursive:!0});let s={schema:se,savedAt:Date.now(),key:t,response:r};Ne(I(a,`${ae(t)}.json`),JSON.stringify(s))}function We(e){let t=e===void 0?H():B(e);if(!re(t))return{deletedFiles:0,scope:e??"all profiles"};let r=0;function a(s){for(let o of Ce(s,{withFileTypes:!0})){let h=I(s,o.name);if(o.isDirectory())a(h);else if(o.isFile()&&o.name.endsWith(".json"))r++}}return a(t),be(t,{recursive:!0,force:!0}),{deletedFiles:r,scope:e??"all profiles"}}function Ge(e){return e===void 0?H():B(e)}class Y{client;profile;useCache;lastCacheAgeSeconds=null;constructor(e,t){this.profile=e,this.useCache=t?.useCache??!0,this.client=new N(V(e))}async getCostByService(e){return(await this.getCostByDimension({...e,dimension:"SERVICE"})).map((r)=>({service:r.key,amount:r.amount,unit:r.unit}))}async getCostByDimension(e){let{start:t,end:r,dimension:a,granularity:s="MONTHLY",filter:o}=e,h=["UnblendedCost"],m=[{Type:"DIMENSION",Key:a}],d={start:t,end:r,granularity:s,metrics:h,groupBy:m,filter:o};if(this.useCache){let C=ne(this.profile,d);if(C)return this.lastCacheAgeSeconds=C.ageSeconds,C.response}this.lastCacheAgeSeconds=null;let p=new Map,i;do{let C={TimePeriod:{Start:t,End:r},Granularity:s,Metrics:h,GroupBy:m};if(o)C.Filter=o;if(i)C.NextPageToken=i;let D=await this.client.request({service:"ce",region:"us-east-1",method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"AWSInsightsIndexService.GetCostAndUsage"},body:JSON.stringify(C)});for(let G of D?.ResultsByTime??[])for(let T of G?.Groups??[]){let O=T.Keys?.[0]??"Unknown",_=Number.parseFloat(T.Metrics?.UnblendedCost?.Amount??"0"),q=T.Metrics?.UnblendedCost?.Unit??"USD",P=p.get(O);p.set(O,{key:O,amount:(P?.amount??0)+_,unit:q})}i=D?.NextPageToken||void 0}while(i);let E=[...p.values()].filter((C)=>C.amount>0).sort((C,D)=>D.amount-C.amount);if(this.useCache)oe(this.profile,d,E);return E}async getDailyTotals(e){return((await this.client.request({service:"ce",region:"us-east-1",method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"AWSInsightsIndexService.GetCostAndUsage"},body:JSON.stringify({TimePeriod:{Start:e.start,End:e.end},Granularity:"DAILY",Metrics:["UnblendedCost"]})}))?.ResultsByTime??[]).map((a)=>Number.parseFloat(a.Total?.UnblendedCost?.Amount??"0"))}}class J{client;region;constructor(e="us-east-1"){this.region=e,this.client=new N}async describeFileSystems(e){let t=[];if(e?.FileSystemId)t.push(`FileSystemId=${encodeURIComponent(e.FileSystemId)}`);if(e?.CreationToken)t.push(`CreationToken=${encodeURIComponent(e.CreationToken)}`);let r=`/2015-02-01/file-systems${t.length>0?`?${t.join("&")}`:""}`;return{FileSystems:((await this.client.request({service:"elasticfilesystem",region:this.region,method:"GET",path:r,headers:{"Content-Type":"application/json"}})).FileSystems||[]).map((s)=>({FileSystemId:s.FileSystemId,Name:s.Name,CreationTime:s.CreationTime,LifeCycleState:s.LifeCycleState,NumberOfMountTargets:s.NumberOfMountTargets,SizeInBytes:s.SizeInBytes?{Value:s.SizeInBytes.Value,Timestamp:s.SizeInBytes.Timestamp}:void 0,PerformanceMode:s.PerformanceMode,Encrypted:s.Encrypted,ThroughputMode:s.ThroughputMode,Tags:s.Tags}))}}}class Q{client;region;constructor(e="us-east-1"){this.region=e,this.client=new N}async call(e,t){return this.client.request({service:"wafv2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSWAF_20190729.${e}`},body:JSON.stringify(t)})}async listWebACLs(e="REGIONAL"){return(await this.call("ListWebACLs",{Scope:e,Limit:100}))?.WebACLs??[]}async getWebACLRules(e,t,r="REGIONAL"){return((await this.call("GetWebACL",{Name:e,Id:t,Scope:r}))?.WebACL?.Rules??[]).map((o)=>({Name:o.Name,Priority:o.Priority,Action:o.Action?Object.keys(o.Action)[0]:o.OverrideAction?Object.keys(o.OverrideAction)[0]:"count"}))}}function me(e){return String(e).padStart(2,"0")}function F(e){return`${e.getUTCFullYear()}-${me(e.getUTCMonth()+1)}-${me(e.getUTCDate())}`}function we(e){let t=Math.max(0,Math.round((Date.now()-e)/1000));if(t<60)return`${t}s ago`;let r=Math.round(t/60);if(r<60)return`${r}m ago`;let a=Math.round(r/60);if(a<48)return`${a}h ago`;return`${Math.round(a/24)}d ago`}async function k(e,t,r,a,s,o){let h=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:r,Dimensions:[{Name:"FunctionName",Value:t}],StartTime:s,EndTime:o,Period:86400,Statistics:[a]}).catch(()=>[]);if(!h.length)return 0;if(a==="Sum")return h.reduce((m,d)=>m+(d.Sum??0),0);if(a==="Maximum")return Math.max(...h.map((m)=>m.Maximum??0));return h.reduce((m,d)=>m+(d.Average??0),0)/h.length}async function W(e,t,r,a,s,o,h){let m=await e.getMetricStatistics({Namespace:t,MetricName:r,Dimensions:a,StartTime:o,EndTime:h,Period:86400,Statistics:[s]}).catch(()=>[]);if(!m.length)return 0;if(s==="Sum")return m.reduce((d,p)=>d+(p.Sum??0),0);if(s==="Maximum")return Math.max(...m.map((d)=>d.Maximum??0));return m.reduce((d,p)=>d+(p.Average??0),0)/m.length}async function X(e,t,r,a,s){let o=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:[{Name:"FunctionName",Value:t}],StartTime:a,EndTime:s,Period:86400,ExtendedStatistics:[r]}).catch(()=>[]);return Math.round(o.reduce((h,m)=>h+(m.Percentiles?.[r]??0),0))}async function mt(e,t){let r=await pe(e,t),a=r.region,s=new j(a),o=new de(a),h=new K(a),m=new Date,d=new Date(m.getTime()-86400000),p=e.environments?.[t]?.app,i={};i.app={name:r.slug,env:t,region:a,runtime:p?.kind==="php"?`php-${p?.phpVersion??"8.3"} (fpm)`:p?.kind??"node",url:r.endpoint??"",build:r.lastRelease?.sha?.slice(0,7)??"—",deployedAt:r.lastRelease?.timestamp??"—"},i.maintenance={enabled:!1},i.scheduler={enabled:r.scheduler!=="off",expression:r.scheduler==="sub-minute"?"rate(1 minute) · sub-minute":"rate(1 minute)",lastRun:"—"};let E=0,C=0,D=0,G=[],T=[],O=[];for(let n of r.functions){let[u,l,c,f,g,S,b,A,w]=await Promise.all([k(s,n.name,"Invocations","Sum",d,m),k(s,n.name,"Errors","Sum",d,m),k(s,n.name,"Throttles","Sum",d,m),k(s,n.name,"Duration","Average",d,m),o.getFunction(n.name).catch(()=>null),X(s,n.name,"p50",d,m),X(s,n.name,"p95",d,m),X(s,n.name,"p99",d,m),s.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:n.name}],StartTime:new Date(m.getTime()-43200000),EndTime:m,Period:3600,Stat:"Sum"}).catch(()=>[])]);E+=u,C+=l,D=Math.max(D,f);let R=g?.Configuration?.MemorySize??0,M=Object.keys(g?.Configuration?.Environment?.Variables??{}),U=[],y=0;try{let{events:z=[]}=await h.filterLogEvents({logGroupName:`/aws/lambda/${n.name}`,startTime:d.getTime(),limit:120});for(let x of z){let L=(x.message??"").trim(),ee=/Max Memory Used:\s*(\d+)\s*MB/.exec(L);if(ee)y=Math.max(y,Number(ee[1]));if(L&&!/^(?:START|END|REPORT|INIT_START)/.test(L))O.push({source:n.mode||n.name,timestamp:new Date(x.timestamp??0).toISOString(),when:we(x.timestamp??0),message:L.slice(0,400),level:/error|exception|fatal|panic|traceback/i.test(L)?"error":/warn|warning|timeout|retr(?:y|ies)|throttl/i.test(L)?"warn":"info"})}U=z.filter((x)=>!/^(?:START|END|REPORT|INIT_START)/.test((x.message??"").trim())).slice(-6).map((x)=>({ts:new Date(x.timestamp??0).toISOString().slice(11,19),msg:(x.message??"").trim().slice(0,120),err:/error|exception|fatal/i.test(x.message??"")}))}catch{}let v=Math.max(1,...w);G.push({key:n.mode,name:n.name,version:n.version,memory:R,timeout:g?.Configuration?.Timeout??0,runtime:g?.Configuration?.Runtime??"provided.al2023",invocations:Math.round(u),errors:Math.round(l),p95:b||Math.round(f),status:"active",provisioned:n.provisioned?`${n.provisioned.allocated}/${n.provisioned.requested}`:void 0}),T.push({key:n.mode,name:n.name,runtime:g?.Configuration?.Runtime??"provided.al2023",arch:g?.Configuration?.Architectures?.[0]??"x86_64",memory:R,timeout:g?.Configuration?.Timeout??0,ephemeral:g?.Configuration?.EphemeralStorage?.Size??512,version:n.version,concurrency:p?.concurrency??"—",invocations:Math.round(u),errors:Math.round(l),throttles:Math.round(c),p50:S||Math.round(f),p95:b||Math.round(f),p99:A||Math.round(f),maxMem:y,spark:w.length?w.map((z)=>Math.round(z/v*100)):[0],env:M.length?M:["(none)"],recent:U.length?U:[{ts:"—",msg:"no recent events",err:!1}]})}i.functions=G,i.functionsDetail=T,i.serverlessLogs=O.sort((n,u)=>String(u.timestamp).localeCompare(String(n.timestamp))).slice(0,600),i.serverlessLogsEmptyReason=O.length?void 0:"No recent function logs were found in CloudWatch for this environment.";let _=E?Number((C/E*100).toFixed(2)):0,q=Math.round(await k(s,r.functions[0]?.name??"","ConcurrentExecutions","Maximum",d,m));i.metrics={invocations:Math.round(E),errorRatePct:_,p95Ms:Math.round(D),coldStartPct:void 0,concurrency:q,estCostUsd:void 0};try{let n=new he(a),u=[],l=[],c=0;try{let{QueueUrl:g}=await n.getQueueUrl(`${r.slug}-${t}-dlq`),{Attributes:S}=await n.getQueueAttributes(g);c=Number(S.ApproximateNumberOfMessages??0)}catch{}let f=p?ue(p,r.slug,t):[];for(let g of f){let S=g.name.replace(`${r.slug}-${t}-`,""),b=0,A=0;try{let{QueueUrl:R}=await n.getQueueUrl(g.name),{Attributes:M}=await n.getQueueAttributes(R);b=Number(M.ApproximateNumberOfMessages??0),A=Number(M.ApproximateNumberOfMessagesNotVisible??0)}catch{}let w=Math.round(await W(s,"AWS/SQS","NumberOfMessagesDeleted",[{Name:"QueueName",Value:g.name}],"Sum",d,m));u.push({name:S,visible:b,inFlight:A,processed:w,dlq:c}),l.push({name:g.name,short:S,visible:b,inFlight:A,delayed:0,processed:w,oldestSec:0,concurrency:g.concurrency??p?.queueConcurrency??"—",tries:p?.queueTries??3,visTimeout:(p?.queueTimeout??120)*6,dlq:c})}if(u.length)i.queues=u;if(l.length)i.queuesDetail=l;i.dlqItems=[]}catch{}try{let n=new le(a),{Stacks:u}=await n.describeStacks({stackName:ce(e,t)}),l={};for(let c of u?.[0]?.Outputs??[])if(c.OutputKey)l[c.OutputKey]=c.OutputValue??"";if(p?.database?.connection==="aurora-serverless"){let c=`${r.slug}-${t}-db`,f=[{Name:"DBClusterIdentifier",Value:c}],[g,S]=await Promise.all([W(s,"AWS/RDS","ServerlessDatabaseCapacity",f,"Average",d,m),W(s,"AWS/RDS","DatabaseConnections",f,"Maximum",d,m)]);if(i.aurora={id:c,engine:"aurora-mysql",minAcu:p?.database?.minCapacity??0.5,maxAcu:p?.database?.maxCapacity??4,currentAcu:g?Number(g.toFixed(1)):p?.database?.minCapacity??0.5,database:"app",connections:Math.round(S),status:l.DbEndpoint?"available":"creating"},p?.rdsProxy)i.proxy={name:`${r.slug}-${t}-proxy`,endpoint:l.DbProxyEndpoint??"—",pooledConns:Math.round(S),status:"available"}}if(p?.cache?.driver==="elasticache"){let c=`${r.slug}-${t}-cache`,f=[{Name:"CacheClusterId",Value:`${c}-001`}],[g,S]=await Promise.all([W(s,"AWS/ElastiCache","CacheHits",f,"Sum",d,m),W(s,"AWS/ElastiCache","CacheMisses",f,"Sum",d,m)]),b=g+S>0?Number((g/(g+S)*100).toFixed(1)):0;i.redis={id:c,node:"cache.t4g.micro",engine:"redis",hitRate:b,status:l.CacheEndpoint?"available":"creating"}}if(p?.efs){let c=0;try{if(l.EfsFileSystemId){let f=new J(a),{FileSystems:g}=await f.describeFileSystems({FileSystemId:l.EfsFileSystemId});c=Number(((g?.[0]?.SizeInBytes?.Value??0)/1048576).toFixed(1))}}catch{}i.efs={id:l.EfsFileSystemId??"efs",mount:"/mnt/local",sizeMb:c,status:"available"}}i.assetsInfo=l.AssetsCdnDomain?{bucket:l.AssetsBucketName??`${r.slug}-${t}-assets`,cdn:l.AssetsCdnDomain,customDomain:p?.assetDomain??"—",assetUrl:r.assetUrl??"—",files:0,sizeMb:0,cacheHitPct:0,build:i.app.build}:void 0}catch{}if(i.assetsInfo)try{let u=await new Z(a).list({bucket:i.assetsInfo.bucket,maxKeys:1000});i.assetsInfo.files=u.length,i.assetsInfo.sizeMb=Number((u.reduce((l,c)=>l+(c.Size??0),0)/1048576).toFixed(1)),i.assetsRecent=u.slice(0,8).map((l)=>({path:`/${l.Key}`,size:`${Math.max(1,Math.round((l.Size??0)/1024))} KB`,type:l.Key.split(".").pop()??""}))}catch{}try{if(p?.secrets){let n=Array.isArray(p.secrets)?p.secrets.map((u)=>({key:u.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),source:u})):Object.entries(p.secrets).map(([u,l])=>({key:u,source:String(l)}));i.secretsList=n.map((u)=>({...u,updated:"—"}))}}catch{}try{let n=new Z(a),u=`${r.slug}-${t}-deployments`,l=await n.getObjectJson(u,`deployments/${r.slug}/${t}/history.json`).catch(()=>null);if(l?.records?.length)i.deploymentsDetail=l.records.slice(-12).reverse().map((c)=>({sha:(c.sha??"").slice(0,7),status:c.status??"success",when:c.timestamp??"—",took:c.took??"—",by:c.by??"—",version:c.version??"—",hooks:c.hooks??[]}))}catch{}i.metricsTotals={invocations:i.metrics.invocations,errors:Math.round(C),errorRatePct:_,p95Ms:i.metrics.p95Ms,throttles:T.reduce((n,u)=>n+u.throttles,0),coldStartPct:void 0,estCostUsd:void 0,concurrency:q},i.metricsPerFn=T.map((n)=>({key:n.key,invocations:n.invocations,errors:n.errors,throttles:n.throttles,avgMs:n.p50,maxMs:n.p99,costUsd:void 0}));try{i.invSpark=await s.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:r.functions.find((n)=>n.mode==="http")?.name??""}],StartTime:new Date(m.getTime()-86400000),EndTime:m,Period:3600,Stat:"Sum"})}catch{}try{let n=new Y,u=m,l=new Date(Date.UTC(u.getUTCFullYear(),u.getUTCMonth(),1)),c=new Date(Date.UTC(u.getUTCFullYear(),u.getUTCMonth()-1,1)),[f,g]=await Promise.all([n.getCostByService({start:F(l),end:F(u),granularity:"MONTHLY"}).catch(()=>[]),n.getCostByService({start:F(c),end:F(l),granularity:"MONTHLY"}).catch(()=>[])]);if(f.length){let S=f.reduce((y,v)=>y+v.amount,0),b=g.reduce((y,v)=>y+v.amount,0),A=u.getUTCDate(),w=new Date(Date.UTC(u.getUTCFullYear(),u.getUTCMonth()+1,0)).getUTCDate();i.costSummary={monthToDateUsd:Number(S.toFixed(2)),projectedUsd:Number((S/A*w).toFixed(2)),lastMonthUsd:Number(b.toFixed(2)),dailyAvgUsd:Number((S/A).toFixed(2))},i.costServices=f.filter((y)=>y.amount>0).sort((y,v)=>v.amount-y.amount).slice(0,12).map((y)=>({name:y.service,usd:Number(y.amount.toFixed(2)),note:""})),i.metrics.estCostUsd=Number((S/A).toFixed(2)),i.metricsTotals.estCostUsd=i.metrics.estCostUsd,i.costTrend=await n.getDailyTotals({start:F(l),end:F(u)}).catch(()=>[]);let R=f.find((y)=>/lambda/i.test(y.service))?.amount??0,M=(y)=>y.invocations*(y.p50/1000)*(y.memory/1024),U=T.reduce((y,v)=>y+M(v),0)||1;i.costPerFn=T.map((y)=>({key:y.key,requests:y.invocations,gbSec:Math.round(M(y)),usd:Number((R*(M(y)/U)).toFixed(2))}))}}catch{}if(p?.firewall)try{let n=await s.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"BlockedRequests",StartTime:d,EndTime:m,Period:86400,Statistics:["Sum"]}).catch(()=>[]),u=await s.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"AllowedRequests",StartTime:d,EndTime:m,Period:86400,Statistics:["Sum"]}).catch(()=>[]);i.waf={enabled:!0,scope:"REGIONAL",acl:`${r.slug}-${t}-waf`,allowed24h:Math.round(u.reduce((l,c)=>l+(c.Sum??0),0)),blocked24h:Math.round(n.reduce((l,c)=>l+(c.Sum??0),0))};try{let l=new Q(a),c=await l.listWebACLs("REGIONAL"),f=c.find((g)=>g.Name?.includes(`${r.slug}-${t}`))??c[0];if(f?.Name&&f.Id){i.waf.acl=f.Name;let g=await l.getWebACLRules(f.Name,f.Id,"REGIONAL");if(g.length)i.wafRules=g.map((S)=>({name:S.Name??"—",detail:`priority ${S.Priority??0}`,action:S.Action??"count",blocked24h:0}))}}catch{}}catch{}let P=[];if(i.aurora)P.push({name:"Aurora Serverless v2",detail:`${i.aurora.id} · ${i.aurora.minAcu}-${i.aurora.maxAcu} ACU`,status:i.aurora.status});if(i.proxy)P.push({name:"RDS Proxy",detail:i.proxy.name,status:i.proxy.status});if(i.redis)P.push({name:`ElastiCache (${i.redis.engine})`,detail:`${i.redis.node} · ${i.redis.hitRate}% hit rate`,status:i.redis.status});if(i.efs)P.push({name:"EFS",detail:`${i.efs.mount} · ${i.efs.sizeMb} MB`,status:i.efs.status});if(P.length)i.dataServices=P;if(r.scheduler!=="off"&&p?.kind==="php")try{let n=await ge(e,t,"schedule:list"),u=[];for(let l of(n||"").split(`
+`)){let c=/^\s*([\d*/,\-\s]+?)\s{2,}(.+?)(?:\s{2,}Next Due.*)?$/.exec(l);if(c&&/[*\d]/.test(c[1])&&c[1].trim().split(/\s+/).length===5)u.push({command:c[2].trim().replace(/^php artisan /,""),cron:c[1].trim(),desc:"",lastRun:"—",lastStatus:"ok"})}if(u.length)i.schedulerTasks=u}catch{}return i.topology=ye(i,{project:e.project.name,environment:t}),i}
+export{K as Ad,j as Bd,We as Cd,Ge as Dd,Y as Ed,mt as Fd};

package/dist/bin/chunk-kybdb0ws.js

@@ -0,0 +1,2 @@
+import{bh as s}from"./chunk-ey9fagrr.js";class a{client;region;constructor(e="us-east-1",r){this.region=e,this.client=new s(void 0,{profile:r})}async createRepository(e){let r={repositoryName:e.repositoryName};if(e.imageTagMutability)r.imageTagMutability=e.imageTagMutability;if(e.imageScanningConfiguration)r.imageScanningConfiguration=e.imageScanningConfiguration;if(e.encryptionConfiguration)r.encryptionConfiguration=e.encryptionConfiguration;if(e.tags&&e.tags.length>0)r.tags=e.tags;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.CreateRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repository:t.repository?this.parseRepository(t.repository):void 0}}async describeRepositories(e){let r={};if(e?.repositoryNames&&e.repositoryNames.length>0)r.repositoryNames=e.repositoryNames;if(e?.registryId)r.registryId=e.registryId;if(e?.maxResults)r.maxResults=e.maxResults;if(e?.nextToken)r.nextToken=e.nextToken;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeRepositories","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repositories:t.repositories?.map((i)=>this.parseRepository(i)),nextToken:t.nextToken}}async getAuthorizationToken(e){let r={};if(e&&e.length>0)r.registryIds=e;return{authorizationData:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetAuthorizationToken","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).authorizationData?.map((i)=>({authorizationToken:i.authorizationToken,expiresAt:i.expiresAt,proxyEndpoint:i.proxyEndpoint}))}}async deleteRepository(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;if(e.force!==void 0)r.force=e.force;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DeleteRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repository:t.repository?this.parseRepository(t.repository):void 0}}async describeImages(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;if(e.imageIds&&e.imageIds.length>0)r.imageIds=e.imageIds;if(e.filter)r.filter=e.filter;if(e.maxResults)r.maxResults=e.maxResults;if(e.nextToken)r.nextToken=e.nextToken;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeImages","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{imageDetails:t.imageDetails?.map((i)=>this.parseImageDetail(i)),nextToken:t.nextToken}}async batchDeleteImage(e){let r={repositoryName:e.repositoryName,imageIds:e.imageIds};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.BatchDeleteImage","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{imageIds:t.imageIds,failures:t.failures}}async putLifecyclePolicy(e){let r={repositoryName:e.repositoryName,lifecyclePolicyText:e.lifecyclePolicyText};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.PutLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,lifecyclePolicyText:t.lifecyclePolicyText}}async getLifecyclePolicy(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,lifecyclePolicyText:t.lifecyclePolicyText,lastEvaluatedAt:t.lastEvaluatedAt}}async setRepositoryPolicy(e){let r={repositoryName:e.repositoryName,policyText:e.policyText};if(e.registryId)r.registryId=e.registryId;if(e.force!==void 0)r.force=e.force;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.SetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,policyText:t.policyText}}async getRepositoryPolicy(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,policyText:t.policyText}}async tagResource(e){let r={resourceArn:e.resourceArn,tags:e.tags};await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async listTagsForResource(e){let r={resourceArn:e};return{tags:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.ListTagsForResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).tags}}createLifecyclePolicyText(e){return JSON.stringify({rules:e.map((r)=>({rulePriority:r.rulePriority,description:r.description,selection:r.selection,action:r.action}))})}async getDockerLoginCommand(){let e=await this.getAuthorizationToken();if(!e.authorizationData?.[0])throw Error("Failed to get authorization token");let r=e.authorizationData[0],t=r.authorizationToken||"",i=r.proxyEndpoint||"";return`echo "${Buffer.from(t,"base64").toString("utf8").split(":")[1]}" | docker login --username AWS --password-stdin ${i}`}getRegistryUri(e){return`${e}.dkr.ecr.${this.region}.amazonaws.com`}parseRepository(e){return{repositoryArn:e.repositoryArn,registryId:e.registryId,repositoryName:e.repositoryName,repositoryUri:e.repositoryUri,createdAt:e.createdAt,imageTagMutability:e.imageTagMutability,imageScanningConfiguration:e.imageScanningConfiguration,encryptionConfiguration:e.encryptionConfiguration}}parseImageDetail(e){return{registryId:e.registryId,repositoryName:e.repositoryName,imageDigest:e.imageDigest,imageTags:e.imageTags,imageSizeInBytes:e.imageSizeInBytes,imagePushedAt:e.imagePushedAt,imageScanStatus:e.imageScanStatus,imageScanFindingsSummary:e.imageScanFindingsSummary}}}
+export{a as Gg};

package/dist/bin/chunk-m3nqw76h.js

@@ -0,0 +1,3 @@
+import{Cf as l,Pf as g,Sf as f,Tf as d,bg as C,tf as m}from"./chunk-dj9a67c3.js";function R(e){return`'${e.split("'").join("'\\''")}'`}function p(e){let r=e.user||"root",s=e.script.join(`
+`),t=r==="root"?'bash -l "$TS_CLOUD_RECIPE"':`runuser -l ${R(r)} -c "bash $TS_CLOUD_RECIPE"`;return["set -uo pipefail",`echo "__TS_CLOUD_RECIPE_BEGIN__ ${e.name} (user=${r})"`,"TS_CLOUD_RECIPE=$(mktemp)",`cat > "$TS_CLOUD_RECIPE" <<'TS_CLOUD_RECIPE_EOF'`,s,"TS_CLOUD_RECIPE_EOF",'chmod +r "$TS_CLOUD_RECIPE"',t,"TS_CLOUD_RC=$?",'rm -f "$TS_CLOUD_RECIPE"',`echo "__TS_CLOUD_RECIPE_END__ ${e.name} exit=$TS_CLOUD_RC"`,"exit $TS_CLOUD_RC"]}var c={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};async function i(e){return await e.driver.findComputeTargets({slug:e.slug,environment:e.environment,role:e.role||"app"})}async function y(e,r){let s=e.logger||c,t=await i(e);if(t.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};let n=m(e.slug,r.siteName),u=d(n,r.to||"unused"),o=["set -uo pipefail",...C(u,{...r.to?{to:r.to}:{},unitBase:`${e.slug}-${r.siteName}`}),`(cd ${l} && pantry restart php-fpm) 2>/dev/null || true`,`(cd ${u.current} && eval "$(cd ${l} && pantry env 2>/dev/null)" && php artisan queue:restart) 2>/dev/null || true`];s.step(`Rolling back ${r.siteName}${r.to?` to ${r.to}`:" to the previous release"} on ${t.length} server(s)...`);let a=await e.driver.runRemoteDeploy({targets:t,commands:o,comment:`ts-cloud rollback ${e.slug}/${r.siteName}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!a.success)s.error(`Rollback failed: ${a.error||"unknown error"}`);else s.success(`Rolled back ${r.siteName}.`);return{success:a.success,error:a.error,perInstance:a.perInstance}}async function h(e,r){let s=await i(e);if(s.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};let t=f(m(e.slug,r.siteName)),n=Math.max(1,r.limit??20),u=[`[ -f ${t} ] && tail -n ${n} ${t} || echo "no deploy history for ${r.siteName}"`],o=await e.driver.runRemoteDeploy({targets:s,commands:u,comment:`ts-cloud deploy:history ${e.slug}/${r.siteName}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});return{success:o.success,error:o.error,perInstance:o.perInstance}}async function I(e,r){let s=e.logger||c,t=await i(e);if(t.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};s.step(`Running recipe '${r.name}' as ${r.user||"root"} on ${t.length} server(s)...`);let n=await e.driver.runRemoteDeploy({targets:t,commands:p({name:r.name,script:r.script,user:r.user}),comment:`ts-cloud recipe ${r.name}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!n.success)s.error(`Recipe '${r.name}' failed: ${n.error||"unknown error"}`);else s.success(`Recipe '${r.name}' completed.`);return{success:n.success,error:n.error,perInstance:n.perInstance}}async function P(e,r){let s=e.logger||c;if(!r.database?.name)return{success:!1,error:"No appDatabase configured to restore."};let t=await i(e);if(t.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};s.step(`Restoring database '${r.database.name}'${r.from?` from ${r.from}`:" from the latest backup"} on ${t.length} server(s)...`);let n=await e.driver.runRemoteDeploy({targets:t,commands:g(r.database,{from:r.from}),comment:`ts-cloud db:restore ${e.slug}/${r.database.name}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!n.success)s.error(`Restore failed: ${n.error||"unknown error"}`);else s.success(`Restored ${r.database.name}.`);return{success:n.success,error:n.error,perInstance:n.perInstance}}
+export{y as wd,h as xd,I as yd,P as zd};

package/dist/bin/chunk-mn6j22zn.js

@@ -0,0 +1,6 @@
+import{lj as C,oj as I,pj as m,yh as S,zh as _}from"./chunk-anm3ae6z.js";import{execSync as O}from"node:child_process";import{randomBytes as P}from"node:crypto";import{chmodSync as B,copyFileSync as F,existsSync as u,mkdirSync as L,readFileSync as T,statSync as J,writeFileSync as b}from"node:fs";import{tmpdir as z}from"node:os";import{basename as V,dirname as y,isAbsolute as k,join as a,resolve as W}from"node:path";import{fileURLToPath as A}from"node:url";function h(e){if(!e||typeof e!=="object")return e;return Object.fromEntries(Object.keys(e).map((r)=>[r,""]))}function E(e){let r=JSON.parse(JSON.stringify(e??{}));if(r.hetzner)delete r.hetzner.apiToken;delete r.aws,delete r.stateDir;for(let t of Object.values(r.sites??{})){if(t?.env)t.env=h(t.env);if(t?.environment)t.environment=h(t.environment)}for(let t of Object.values(r.environments??{}))if(t?.variables)t.variables=h(t.variables);for(let t of Object.values(r.infrastructure?.databases??{}))if(t?.password)t.password="";if(r.infrastructure?.appDatabase?.password)r.infrastructure.appDatabase.password="";if(r.infrastructure?.compute?.database?.password)r.infrastructure.compute.database.password="";if(r.infrastructure?.compute?.managedServices?.vitess?.password)r.infrastructure.compute.managedServices.vitess.password="";return r}function U(e){let r=E(e);return["// Generated by ts-cloud for the management dashboard — do not edit.","//","// This is the project's resolved cloud config, inlined so it needs no","// imports on the box. Credentials are deliberately absent.",`export default ${JSON.stringify(r,null,2)}`,""].join(`
+`)}var G="dashboard";function M(){return S("dashboard-credentials.json")}function H(){return P(24).toString("base64url")}function q(e,r,t){let s=process.env.TS_CLOUD_UI_PASSWORD?.trim();if(s)return{password:s,source:"env"};if(v(process.env.TS_CLOUD_UI_PUBLIC))return{password:void 0,source:"public"};let n=M(),i=_(e,"dashboard-credentials.json");try{if(u(i)){let o=JSON.parse(T(i,"utf8"));if(o?.password)return{password:o.password,source:"generated"}}}catch{}let d=H();try{L(y(i),{recursive:!0}),b(i,`${JSON.stringify({username:r,password:d,generatedAt:new Date().toISOString()},null,2)}
+`),B(i,384),t.info(`Management dashboard: generated a password for '${r}' and saved it to ${n} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`)}catch(o){t.warn(`Management dashboard: could not persist the generated password (${o?.message??o}). Using it for this deploy only — pass: ${d}
+This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${n} is writable.`)}return{password:d,source:"generated"}}var R={info:()=>{},warn:()=>{}};function v(e){return e!=null&&e!==""&&e!=="0"&&e.toLowerCase()!=="false"}function K(){return S("dashboard-release")}function j(){let e=y(A(import.meta.url));for(let r of[a(e,"..","..","package.json"),a(e,"..","package.json")])try{let t=JSON.parse(T(r,"utf8"));if(t.name==="@stacksjs/ts-cloud"&&t.version)return`^${t.version}`}catch{}return"latest"}function Q(){return process.env.TS_CLOUD_UI_VERSION?.trim()||j()}function X(e,r,t){if(!e?.project?.slug)return t.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard."),null;let s=_(r,"dashboard-release");try{L(s,{recursive:!0}),b(a(s,"cloud.config.ts"),U(e));let n=Q();if(n.startsWith("file:")){let d=n.slice(5),o=k(d)?d:W(r,d);if(!u(o)||!J(o).isFile())n=j(),t.warn(`Management dashboard: TS_CLOUD_UI_VERSION points to a missing package file (${o}); using the deploying ts-cloud version ${n} instead.`);else{let c=V(o),l=a(s,c);if(o!==l)F(o,l);n=`file:./${c}`}}let i={name:"ts-cloud-dashboard",private:!0,type:"module",dependencies:{"@stacksjs/ts-cloud":n}};return b(a(s,"package.json"),`${JSON.stringify(i,null,2)}
+`),K()}catch(n){return t.warn(`Management dashboard: could not stage the live release (${n?.message??n}) — skipping.`),null}}function Y(e){if(u(a(e,"packages","ui","pages"))||u(a(e,"packages","ui","package.json")))return{uiRoot:"packages/ui/dist",build:"cd packages/ui && bun install && bun run build"};let r=y(A(import.meta.url)),t=[a(r,"ui"),a(r,"..","ui"),a(r,"..","..","ui"),a(r,"..","dist","ui")];for(let s of t)if(u(a(s,"index.html"))||u(a(s,"serverless.html")))return{uiRoot:s,build:!1};return null}function de(e,r={}){let t=r.logger??R,s=r.cwd??process.cwd();if(v(process.env.TS_CLOUD_UI_DISABLE))return t.info("Management dashboard: skipped (TS_CLOUD_UI_DISABLE set)."),e;if(e.cloud?.attachTo)return t.info(`Management dashboard: ${e.project.slug} is attached to ${e.cloud.attachTo}; the server owner's dashboard monitors every attached project.`),e;if(C(e))return e;let n=e.environments&&Object.keys(e.environments)[0],i=process.env.TS_CLOUD_UI_DOMAIN?.trim()||void 0,d=Number(process.env.TS_CLOUD_UI_PORT)||void 0,o={...e.sites??{}};if(!v(process.env.TS_CLOUD_UI_STATIC)){let g=X(e,s,t);if(!g)return e;let p=m(e,n??"production",{uiRoot:g,build:!1,domain:i,port:d,live:!0});if(p.length===0)return t.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;for(let{name:N,site:w}of p)o[N]=w,t.info(`Management dashboard → https://${w.domain} (sign in with your ts-cloud account; the first deploy prints an admin password once)`);return e.sites=o,e}let c=Y(s);if(!c)return t.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy."),e;let l=process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin",f=q(s,l,t),D=m(e,n??"production",{uiRoot:c.uiRoot,build:c.build,domain:i,username:l,password:f.password,realm:process.env.TS_CLOUD_UI_REALM?.trim()||void 0,live:!1,port:d});if(D.length===0)return t.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;let x=f.source==="public"?"NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)":f.source==="env"?"htpasswd-protected (TS_CLOUD_UI_PASSWORD)":`htpasswd-protected (auto-generated — see ${M()})`;t.warn("Management dashboard: static mode — one shared password, and no per-site collaborators. Unset TS_CLOUD_UI_STATIC for the live dashboard.");for(let{name:g,site:p}of D)o[g]=p,t.info(`Management dashboard → https://${p.domain} (${x})`);return e.sites=o,e}function ue(e){return Object.keys(e.sites??{}).filter(I)}function ce(e,r){if(!e?.root)return null;let t=r.cwd??process.cwd(),s=r.logger??R;try{if(typeof e.build==="string"&&e.build.trim())s.info(`Management dashboard: building UI (${e.build})`),O(e.build,{cwd:t,stdio:"inherit"});let n=k(e.root)?e.root:a(t,e.root);if(!u(n))return s.warn(`Management dashboard: build output not found at ${n} — skipping dashboard artifact.`),null;let i=a(z(),`${r.slug}-${r.siteName??G}-${r.sha}.tar.gz`);return O(`tar czf "${i}" -C "${n}" .`,{stdio:"inherit"}),i}catch(n){return s.warn(`Management dashboard: failed to build artifact — ${n?.message??n}. Skipping dashboard deploy.`),null}}
+export{G as jf,M as kf,q as lf,K as mf,Q as nf,X as of,Y as pf,de as qf,ue as rf,ce as sf};