openship 0.4.8 → 0.6.0

package/dist/server/migrations/0085_resource_usage.sql

@@ -0,0 +1,68 @@
+-- Resource usage history: the persisted series behind the Monitoring tab's
+-- CPU/memory chart.
+--
+-- Usage existed only as a live 5-second SSE stream, so closing the tab discarded
+-- everything. "Was memory climbing before the OOM at 3am" was unanswerable, which is
+-- the question the data exists to answer.
+--
+-- ── Why this is a SAMPLED series, not a counter series like server_analytics ──
+--
+-- Traffic is counted for free: the edge increments a shared-dict key on every
+-- request, so per-minute granularity costs nothing and is exact. Resource usage has
+-- to be PROBED, and `docker stats` occupies the daemon for roughly a second per
+-- container because it must collect two CPU samples to compute a delta — about 500x
+-- a `docker inspect`. The sampling cadence therefore IS the resolution, and the cost
+-- scales with container count. 5-minute buckets are the compromise between catching
+-- a spike and not pinning every daemon on the estate; ~288 rows/day/service.
+--
+-- ── serviceKey is NOT NULL text, not a nullable service_id FK ────────────────
+--
+-- Postgres treats NULLs as DISTINCT in a unique index, so a nullable column cannot
+-- carry the "this row is the project itself" case without the partial-index
+-- workaround migration 0083 needed for service_incident. A sentinel ('__app__',
+-- matching the health watch's own constant so both features name the same workload
+-- identically) keeps one plain unique index correct.
+--
+-- Accepted consequence: deleting a service leaves its samples behind until retention
+-- prunes them. That is the right trade — history should outlive the thing it
+-- describes — and the project cascade still bounds the growth.
+--
+-- ── What is deliberately absent ─────────────────────────────────────────────
+--
+-- No project-total row. For a compose project the total is the per-bucket SUM of its
+-- services, computed at read. Storing it too would duplicate rows that are free to
+-- drift from their own sources, and would be wrong the moment a service is added or
+-- removed mid-window.
+CREATE TABLE IF NOT EXISTS "resource_usage" (
+  "id" text PRIMARY KEY NOT NULL,
+  "project_id" text NOT NULL REFERENCES "project"("id") ON DELETE CASCADE,
+  -- service.id, or '__app__' for a single-container project.
+  "service_key" text NOT NULL,
+  -- Bucket start in epoch MINUTES (not a timestamp), floored to a multiple of 5 —
+  -- same integer-bucket convention as server_analytics.
+  "minute" integer NOT NULL,
+  -- Per-CORE percent, as the runtimes report it: >100 is correct on a multi-core box
+  -- and must not be clamped. Readers divide by core count for "share of this host".
+  "cpu_percent" real DEFAULT 0 NOT NULL,
+  "memory_mb" real DEFAULT 0 NOT NULL,
+  -- CUMULATIVE since container start, not per-bucket deltas — that is what the
+  -- runtimes expose. Readers difference consecutive buckets and clamp negatives to
+  -- zero, because a restart resets the counter and would otherwise plot as a large
+  -- negative spike. bigint: a long-lived busy container passes int4 in days.
+  -- Always 0 for bare deploys (per-process accounting needs eBPF or a netns), so a
+  -- reader must not present 0 here as "no network traffic".
+  "network_rx_bytes" bigint DEFAULT 0 NOT NULL,
+  "network_tx_bytes" bigint DEFAULT 0 NOT NULL,
+  "created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+
+-- Makes a repeated sample for the same bucket a no-op (insert ... on conflict do
+-- nothing) rather than a double count, so the whole sweep is safely re-runnable.
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_resource_usage_project_service_minute"
+  ON "resource_usage" ("project_id", "service_key", "minute");
+--> statement-breakpoint
+
+-- Every read is "this project over this window".
+CREATE INDEX IF NOT EXISTS "idx_resource_usage_project_minute"
+  ON "resource_usage" ("project_id", "minute");

package/dist/server/migrations/0086_remote_infra_updates.sql

@@ -0,0 +1,41 @@
+-- Remote infra (edge / mail container) update tracking.
+--
+-- When the control plane's APP_VERSION moves forward, the edge/mail containers
+-- already deployed on remote servers stay on their old image tag. Two additions
+-- drive the "monitor → advise → apply" loop for that drift:
+--
+--   instance_settings.auto_update_infra / last_seen_version — the instance-wide
+--     auto-update toggle and the version the infra reconcile last ran for (so the
+--     boot hook fires exactly once per upgrade). Both additive: the boolean
+--     carries a DEFAULT, last_seen_version is nullable.
+--
+--   server_container_status — the container sibling of server_module_status.
+--     One row per (server, component); "behind" is a plain tag comparison
+--     (running image ref != pinned image ref), since infra images are pinned to
+--     APP_VERSION. Mirrors the module table's org+behind index and unique key.
+ALTER TABLE "instance_settings" ADD COLUMN IF NOT EXISTS "auto_update_infra" boolean DEFAULT false NOT NULL;
+--> statement-breakpoint
+ALTER TABLE "instance_settings" ADD COLUMN IF NOT EXISTS "last_seen_version" text;
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "server_container_status" (
+  "id" text PRIMARY KEY NOT NULL,
+  "organization_id" text REFERENCES "organization"("id") ON DELETE CASCADE,
+  "server_id" text NOT NULL REFERENCES "servers"("id") ON DELETE CASCADE,
+  "component" text NOT NULL,
+  "running_label" text,
+  "pinned_label" text,
+  "running_version" text,
+  "pinned_version" text,
+  "behind" boolean DEFAULT false NOT NULL,
+  "latest_in_progress" boolean DEFAULT false NOT NULL,
+  "detail" jsonb,
+  "checked_at" timestamp DEFAULT now() NOT NULL,
+  "created_at" timestamp DEFAULT now() NOT NULL,
+  "updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_server_container_status"
+  ON "server_container_status" ("server_id", "component");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_server_container_status_org_behind"
+  ON "server_container_status" ("organization_id", "behind");

package/dist/server/migrations/0087_server_container_version_columns.sql

@@ -0,0 +1,17 @@
+-- Repair: add `server_container_status.running_version` / `pinned_version` on a
+-- database that ran an earlier form of 0086.
+--
+-- 0086 was edited in place after it had already been applied: the version columns
+-- were added to its CREATE TABLE, but that create is `IF NOT EXISTS`, so on any
+-- database that had already run the older 0086 the table exists and the amended
+-- create is a silent no-op — the columns never appear. drizzle's migrator then
+-- refuses to re-run 0086 (its `when` equals the last-applied stamp, and the
+-- comparison is strict `<`; see 0081_project_readiness_repair for the same trap),
+-- so nothing else patches it either. Every `listByOrg` then dies with
+-- `column "running_version" does not exist` (42703).
+--
+-- Idempotent and stamped after 0086, so it sorts as a fresh migration: a database
+-- created cleanly gets the columns at 0086 and this is a no-op; a database that
+-- ran the stale 0086 gets them here. Safe to keep in history permanently.
+ALTER TABLE "server_container_status" ADD COLUMN IF NOT EXISTS "running_version" text;--> statement-breakpoint
+ALTER TABLE "server_container_status" ADD COLUMN IF NOT EXISTS "pinned_version" text;

package/dist/server/migrations/0088_audit_source_and_settings.sql

@@ -0,0 +1,27 @@
+-- Audit log: call source + per-org recording switch.
+--
+--   audit_event.source — WHERE the action came in from: "dashboard", "mcp",
+--     "cli", "api", "webhook", "system". Nullable on purpose: rows written
+--     before this migration have no knowable source and must not be
+--     mislabelled as any particular one, so they render as "Unknown". This is
+--     what makes "show me only what the AI assistant did" answerable at all —
+--     MCP tool calls re-enter the app through app.fetch() with nothing but an
+--     Authorization header, so until now an MCP-driven write and a CLI write
+--     produced identical rows.
+--
+--   audit_settings — recording on/off + retention, PER ORGANIZATION. Not
+--     instance_settings (one row would let a single tenant disable auditing for
+--     every org on a CLOUD_MODE instance) and not organization.metadata (Better
+--     Auth owns those writes, which is why the auditRetentionDays documented
+--     there never got a writer). Default enabled = true: auditing stays on
+--     unless an admin turns it off.
+ALTER TABLE "audit_event" ADD COLUMN IF NOT EXISTS "source" text;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "audit_event_org_source_idx" ON "audit_event" ("organization_id","source","created_at" DESC);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "audit_settings" (
+  "organization_id" text PRIMARY KEY NOT NULL REFERENCES "organization"("id") ON DELETE CASCADE,
+  "enabled" boolean DEFAULT true NOT NULL,
+  "retention_days" integer DEFAULT 90 NOT NULL,
+  "updated_at" timestamp DEFAULT now() NOT NULL
+);

package/dist/server/migrations/0089_auto_scan_infra.sql

@@ -0,0 +1,7 @@
+-- instance_settings.auto_scan_infra — when on (default), the dashboard runs one
+-- detect-only container scan on a relevant surface load (Infrastructure tab /
+-- home) if the cached drift state is stale, so the attention dot + issue list
+-- stay fresh without a manual Scan. Detect-only; auto-APPLY stays the separate
+-- auto_update_infra. Idempotent ADD COLUMN IF NOT EXISTS + DEFAULT true so both
+-- a clean create and an existing settings row converge on "on".
+ALTER TABLE "instance_settings" ADD COLUMN IF NOT EXISTS "auto_scan_infra" boolean DEFAULT true NOT NULL;

package/dist/server/migrations/0090_project_collect_paths.sql

@@ -0,0 +1,18 @@
+-- Top Paths becomes opt-in.
+--
+-- The per-path aggregation is the one analytics dimension that isn't effectively free.
+-- Measured on the shipped edge image, per request:
+--
+--   paths (whole block)     1.72 us   <- 57% of the log handler's counter path
+--     of which string work  1.38 us   normalize_path + is_static_asset
+--   minute buckets          0.61 us
+--   country                 0.24 us
+--   status                  0.14 us
+--
+-- It is also the highest-cardinality dimension (up to 2000 keys per domain per day) and
+-- the largest column in the daily rollup. So it is now a per-project switch, read on the
+-- hot path from the edge's `rules` shared dict and pushed there on every route apply.
+--
+-- DEFAULT false, which turns it off for existing projects as well. Deliberate: no one
+-- opted into the cost, so no one should keep paying it without asking.
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "collect_paths" boolean DEFAULT false NOT NULL;

package/dist/server/migrations/0091_project_server_id.sql

@@ -0,0 +1,26 @@
+-- Durable server ownership on the project.
+--
+-- A project's deploy target lived ONLY in the active deployment's volatile
+-- meta.serverId. When resolveSnapshotTarget couldn't re-derive that binding from
+-- a fresh/partial snapshot, the deploy fell back to "local", which then nulled
+-- the project's verified custom-domain ports and regressed the Access URL to
+-- localhost:3000. This makes the server binding a durable, first-class column.
+--
+-- cloudWorkspaceId still owns "is this a cloud project", so we deliberately do
+-- NOT add a deployTarget column (that would be a second source of truth for the
+-- same fact); the effective target is derived — cloudWorkspaceId ? "cloud" :
+-- server_id ? "server" : "local".
+--
+-- ON DELETE SET NULL: removing a server unbinds its projects rather than
+-- cascade-deleting them.
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "server_id" text REFERENCES "servers"("id") ON DELETE SET NULL;
+--> statement-breakpoint
+-- Backfill the binding from each project's active-deployment meta so existing
+-- server-hosted projects survive the next redeploy without regressing to local.
+UPDATE "project" SET "server_id" = (
+  SELECT d."meta"->>'serverId'
+  FROM "deployment" d
+  WHERE d."id" = "project"."active_deployment_id"
+)
+WHERE "server_id" IS NULL
+  AND "active_deployment_id" IS NOT NULL;

package/dist/server/migrations/0092_project_internal_alias.sql

@@ -0,0 +1,13 @@
+-- User-chosen internal DNS alias for a single-app native project.
+--
+-- Single-app containers now join their own `openship-<slug>` network with a
+-- stable default alias (`<slug>`), the same east-west reachability compose
+-- services already have. This column lets an operator add a custom hostname
+-- that resolves ALONGSIDE the default (both point at the container) — it never
+-- replaces the default and never changes public exposure (the edge stays the
+-- sole public ingress; publishing is loopback-only).
+--
+-- Nullable, no default: absence means "default alias only" and existing rows
+-- need no backfill. Compose services store the equivalent in the zero-migration
+-- `service.advanced.alias` JSONB, so only single-app needs a column.
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "internal_alias" text;

package/dist/server/migrations/0093_service_incident_org_index.sql

@@ -0,0 +1,13 @@
+-- Org-wide incident reads for the global issue tracker.
+--
+-- The existing indexes on this table are project-keyed (`idx_service_incident_project`)
+-- or exist to enforce the one-open-incident invariant. Both are wrong shapes for the
+-- new question: "every incident in THIS organization, newest first" — the Issues feed's
+-- Open tab and its Resolved tab, which sorts org-wide across up to 30 days of retained
+-- history. Without this the feed sequentially scans the whole table and filters, which
+-- gets slower exactly as an instance accumulates the history that makes the tab useful.
+--
+-- Covers both scopes: server-scoped rows have `project_id IS NULL`, so a project-keyed
+-- index can't serve them at all.
+CREATE INDEX IF NOT EXISTS "idx_service_incident_org"
+  ON "service_incident" ("organization_id", "opened_at" DESC);

package/dist/server/migrations/0094_backup_restore_meta.sql

@@ -0,0 +1,15 @@
+-- Record WHICH integrity check a restore actually performed.
+--
+-- Prepare used to comment that it verified every artifact's sha256 while
+-- comparing only byte sizes. Now that it really re-hashes the archive, the row
+-- has to say so — because the check is downgradeable (a run with no recorded
+-- digest falls back to size-only, and a policy can defer verification to apply
+-- time), and "restore succeeded" means something different in each case. An
+-- operator reading a month-old restore has no other way to tell a re-hashed
+-- archive from a length-matched one.
+--
+-- Keys written today: `integrity` ("sha256" | "size-only" | "deferred"),
+-- `verifiedBytes`, `verifyMs`, `manifest` ("verified" | "missing").
+-- JSONB rather than columns so the cancel/partial-write facts that follow need
+-- no further migration.
+ALTER TABLE "backup_restore" ADD COLUMN IF NOT EXISTS "meta" jsonb DEFAULT '{}'::jsonb;

package/dist/server/migrations/0095_backup_restore_cancel.sql

@@ -0,0 +1,19 @@
+-- Make "cancel a restore" durable.
+--
+-- Cancel used to be advisory at best: it refused `applying` outright, and for
+-- `preparing` it wrote the row while the running phase carried on and
+-- overwrote it with `prepared` — so the operator saw a cancel that never
+-- happened. Cancelling has to survive the phase it interrupts, and the node
+-- receiving the request is not guaranteed to be the node running the apply, so
+-- the in-process AbortController cannot be the only signal.
+--
+-- `cancel_requested_at` is also the force-terminal window: an `applying` row
+-- whose request is older than a couple of minutes (operator pressed cancel,
+-- waited, pressed again) can be force-terminaled without a second endpoint,
+-- which is the only escape from a wedged row that otherwise blocks project
+-- deletion.
+ALTER TABLE "backup_restore" ADD COLUMN IF NOT EXISTS "cancel_requested" boolean DEFAULT false NOT NULL;
+--> statement-breakpoint
+ALTER TABLE "backup_restore" ADD COLUMN IF NOT EXISTS "cancel_requested_at" timestamp;
+--> statement-breakpoint
+ALTER TABLE "backup_restore" ADD COLUMN IF NOT EXISTS "cancelled_at" timestamp;

package/dist/server/migrations/0096_backup_policy_retention_defaults.sql

@@ -0,0 +1,20 @@
+-- Turn retention on for policies that never said anything about it.
+--
+-- `retain_count` and `retain_days` were the only two fields on the policy
+-- insert with neither an API default nor a column default, so every policy
+-- created through the API or MCP stored NULL for both. `prunePolicy`
+-- short-circuits on "no retention configured", so retention silently never ran
+-- for those policies and their runs accumulated until the destination filled.
+-- The dashboard's form defaults to 7, so a human creating a policy in the UI
+-- got retention and the same policy created over the API did not.
+--
+-- 7 = the dashboard's own default (PolicyEditor), now shared as
+-- DEFAULT_RETAIN_COUNT so the column, the API fallback, and the form agree.
+--
+-- The backfill is what actually fixes instances running today, and it is
+-- narrowed to rows where BOTH fields are null: a policy with only `retain_days`
+-- set has retention configured deliberately, and writing a count there would
+-- silently tighten a window the operator chose.
+ALTER TABLE "backup_policy" ALTER COLUMN "retain_count" SET DEFAULT 7;
+--> statement-breakpoint
+UPDATE "backup_policy" SET "retain_count" = 7 WHERE "retain_count" IS NULL AND "retain_days" IS NULL;

package/dist/server/migrations/0097_update_status_upstream_only.sql

@@ -0,0 +1,35 @@
+-- update_status becomes an UPSTREAM-only cache.
+--
+-- The table used to cache both halves of the drift answer: what the source offers
+-- (upstream) and what is currently deployed. Only the first half is expensive and
+-- poll-only. The second half — `behind`, `latest_in_progress`, `current_label` —
+-- is derived from the project's ACTIVE deployment, which seven separate code paths
+-- write (deploy success, rollback, reconcile, activate, clear, self-deploy,
+-- migrate). Caching it meant each of those needed an invalidation hook; only one
+-- ever had it, so rows froze mid-window and the dashboard advertised updates for
+-- commits the operator had already shipped.
+--
+-- Those columns are now computed on read, so keeping them would leave a copy that
+-- looks authoritative while describing a superseded release. `latest_label` goes
+-- too: it's rendered from `detail` alongside the live current label, in one code
+-- path, so the two can never disagree.
+--
+-- Existing rows keep `detail`, but rows written before this migration carry only
+-- the 7-char sha prefix in the dropped `latest_label` — never a full `latestSha`
+-- in `detail` — so a commit row cannot be compared until it is re-polled. Clear
+-- them and let `updates:scan` (or the dashboard's explicit check) repopulate;
+-- until then those projects simply report no update, which is the conservative
+-- direction.
+DELETE FROM "update_status";
+--> statement-breakpoint
+DROP INDEX IF EXISTS "idx_update_status_org_behind";
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_update_status_org" ON "update_status" ("organization_id");
+--> statement-breakpoint
+ALTER TABLE "update_status" DROP COLUMN IF EXISTS "behind";
+--> statement-breakpoint
+ALTER TABLE "update_status" DROP COLUMN IF EXISTS "latest_in_progress";
+--> statement-breakpoint
+ALTER TABLE "update_status" DROP COLUMN IF EXISTS "current_label";
+--> statement-breakpoint
+ALTER TABLE "update_status" DROP COLUMN IF EXISTS "latest_label";

package/dist/server/migrations/meta/_journal.json

@@ -512,6 +512,181 @@
       "when": 1785358400651,
       "tag": "0072_gh_device_token_method",
       "breakpoints": true
+    },
+    {
+      "idx": 73,
+      "version": "7",
+      "when": 1785358401651,
+      "tag": "0073_project_volumes_object_storage",
+      "breakpoints": true
+    },
+    {
+      "idx": 74,
+      "version": "7",
+      "when": 1785450107324,
+      "tag": "0074_project_compose_path",
+      "breakpoints": true
+    },
+    {
+      "idx": 75,
+      "version": "7",
+      "when": 1785536507324,
+      "tag": "0075_service_command_argv",
+      "breakpoints": true
+    },
+    {
+      "idx": 76,
+      "version": "7",
+      "when": 1785622907324,
+      "tag": "0076_rollback_retention",
+      "breakpoints": true
+    },
+    {
+      "idx": 77,
+      "version": "7",
+      "when": 1785709307324,
+      "tag": "0077_domain_redirect",
+      "breakpoints": true
+    },
+    {
+      "idx": 78,
+      "version": "7",
+      "when": 1785795707324,
+      "tag": "0078_grant_source_scope",
+      "breakpoints": true
+    },
+    {
+      "idx": 79,
+      "version": "7",
+      "when": 1785882107324,
+      "tag": "0079_project_readiness",
+      "breakpoints": true
+    },
+    {
+      "idx": 80,
+      "version": "7",
+      "when": 1785968507324,
+      "tag": "0080_deployment_error_classification",
+      "breakpoints": true
+    },
+    {
+      "idx": 81,
+      "version": "7",
+      "when": 1786054907324,
+      "tag": "0081_project_readiness_repair",
+      "breakpoints": true
+    },
+    {
+      "idx": 82,
+      "version": "7",
+      "when": 1786141307324,
+      "tag": "0082_edge_target_verification",
+      "breakpoints": true
+    },
+    {
+      "idx": 83,
+      "version": "7",
+      "when": 1786227707324,
+      "tag": "0083_service_incident",
+      "breakpoints": true
+    },
+    {
+      "idx": 84,
+      "version": "7",
+      "when": 1786314107324,
+      "tag": "0084_analytics_daily_rollup",
+      "breakpoints": true
+    },
+    {
+      "idx": 85,
+      "version": "7",
+      "when": 1786400507324,
+      "tag": "0085_resource_usage",
+      "breakpoints": true
+    },
+    {
+      "idx": 86,
+      "version": "7",
+      "when": 1786486907324,
+      "tag": "0086_remote_infra_updates",
+      "breakpoints": true
+    },
+    {
+      "idx": 87,
+      "version": "7",
+      "when": 1786573307324,
+      "tag": "0087_server_container_version_columns",
+      "breakpoints": true
+    },
+    {
+      "idx": 88,
+      "version": "7",
+      "when": 1786659707324,
+      "tag": "0088_audit_source_and_settings",
+      "breakpoints": true
+    },
+    {
+      "idx": 89,
+      "version": "7",
+      "when": 1786746107324,
+      "tag": "0089_auto_scan_infra",
+      "breakpoints": true
+    },
+    {
+      "idx": 90,
+      "version": "7",
+      "when": 1786746107325,
+      "tag": "0090_project_collect_paths",
+      "breakpoints": true
+    },
+    {
+      "idx": 91,
+      "version": "7",
+      "when": 1786832507325,
+      "tag": "0091_project_server_id",
+      "breakpoints": true
+    },
+    {
+      "idx": 92,
+      "version": "7",
+      "when": 1786918907325,
+      "tag": "0092_project_internal_alias",
+      "breakpoints": true
+    },
+    {
+      "idx": 93,
+      "version": "7",
+      "when": 1787005307325,
+      "tag": "0093_service_incident_org_index",
+      "breakpoints": true
+    },
+    {
+      "idx": 94,
+      "version": "7",
+      "when": 1787091707325,
+      "tag": "0094_backup_restore_meta",
+      "breakpoints": true
+    },
+    {
+      "idx": 95,
+      "version": "7",
+      "when": 1787178107325,
+      "tag": "0095_backup_restore_cancel",
+      "breakpoints": true
+    },
+    {
+      "idx": 96,
+      "version": "7",
+      "when": 1787264507325,
+      "tag": "0096_backup_policy_retention_defaults",
+      "breakpoints": true
+    },
+    {
+      "idx": 97,
+      "version": "7",
+      "when": 1787350907325,
+      "tag": "0097_update_status_upstream_only",
+      "breakpoints": true
     }
   ]
 }

package/dist/setup-FA4PW4NU.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  SystemManager
+} from "./chunk-EP2TNALB.js";
+import "./chunk-GUQ3QCJ7.js";
+import "./chunk-IW2UKBVF.js";
+import "./chunk-ZCFVHA25.js";
+import "./chunk-QEH4QUBX.js";
+import "./chunk-I3DPMTSF.js";
+import "./chunk-VZ2ZHPS2.js";
+import "./chunk-3LDWWY7U.js";
+import "./chunk-OGY63DGD.js";
+import "./chunk-ZFJXPCQP.js";
+import "./chunk-OTLSJYAC.js";
+import "./chunk-PXKCZB2I.js";
+export {
+  SystemManager
+};

package/dist/{signin-ITOPKKUB.js → signin-3M3UPB6K.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   AwsRestJsonProtocol
-} from "./chunk-6B5YCFFV.js";
+} from "./chunk-RVER2EOO.js";
 import {
   NoAuthSigner,
   package_default
-} from "./chunk-DYPH4HCI.js";
-import "./chunk-EI575GHN.js";
+} from "./chunk-AO252K7Z.js";
+import "./chunk-PDW4L3NV.js";
 import {
   AwsSdkSigV4Signer,
   DefaultIdentityProviderConfig,
@@ -19,10 +19,10 @@ import {
   getSchemaSerdePlugin,
   resolveAwsSdkSigV4Config,
   streamCollector
-} from "./chunk-IXCHURVK.js";
+} from "./chunk-DOD2BXHQ.js";
 import {
   NodeHttpHandler
-} from "./chunk-OWED2GRM.js";
+} from "./chunk-42WQABXM.js";
 import {
   BinaryDecisionDiagram,
   Client,
@@ -56,7 +56,7 @@ import {
   resolveHostHeaderConfig,
   resolveRetryConfig,
   resolveUserAgentConfig
-} from "./chunk-VWPEKOH6.js";
+} from "./chunk-DRK3MEDS.js";
 import {
   NODE_REGION_CONFIG_FILE_OPTIONS,
   NODE_REGION_CONFIG_OPTIONS,
@@ -72,7 +72,7 @@ import {
   resolveDefaultsModeConfig,
   resolveHttpHandlerRuntimeConfig,
   resolveRegionConfig
-} from "./chunk-W73X43R7.js";
+} from "./chunk-3NQQXMDR.js";
 import {
   Hash,
   calculateBodyLength,
@@ -80,8 +80,8 @@ import {
   fromUtf8,
   toBase64,
   toUtf8
-} from "./chunk-JYGD5WSN.js";
-import "./chunk-KI2EY3WB.js";
+} from "./chunk-ZWLDLTJP.js";
+import "./chunk-PXKCZB2I.js";
 
 // ../../node_modules/@aws-sdk/nested-clients/dist-es/submodules/signin/auth/httpAuthSchemeProvider.js
 var defaultSigninHttpAuthSchemeParametersProvider = async (config, context, input) => {

package/dist/{sso-oidc-NON2PD7Y.js → sso-oidc-3VDIYOEJ.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   AwsRestJsonProtocol
-} from "./chunk-6B5YCFFV.js";
+} from "./chunk-RVER2EOO.js";
 import {
   NoAuthSigner,
   package_default
-} from "./chunk-DYPH4HCI.js";
-import "./chunk-EI575GHN.js";
+} from "./chunk-AO252K7Z.js";
+import "./chunk-PDW4L3NV.js";
 import {
   AwsSdkSigV4Signer,
   DefaultIdentityProviderConfig,
@@ -19,10 +19,10 @@ import {
   getSchemaSerdePlugin,
   resolveAwsSdkSigV4Config,
   streamCollector
-} from "./chunk-IXCHURVK.js";
+} from "./chunk-DOD2BXHQ.js";
 import {
   NodeHttpHandler
-} from "./chunk-OWED2GRM.js";
+} from "./chunk-42WQABXM.js";
 import {
   BinaryDecisionDiagram,
   Client,
@@ -56,7 +56,7 @@ import {
   resolveHostHeaderConfig,
   resolveRetryConfig,
   resolveUserAgentConfig
-} from "./chunk-VWPEKOH6.js";
+} from "./chunk-DRK3MEDS.js";
 import {
   NODE_REGION_CONFIG_FILE_OPTIONS,
   NODE_REGION_CONFIG_OPTIONS,
@@ -72,7 +72,7 @@ import {
   resolveDefaultsModeConfig,
   resolveHttpHandlerRuntimeConfig,
   resolveRegionConfig
-} from "./chunk-W73X43R7.js";
+} from "./chunk-3NQQXMDR.js";
 import {
   Hash,
   calculateBodyLength,
@@ -80,8 +80,8 @@ import {
   fromUtf8,
   toBase64,
   toUtf8
-} from "./chunk-JYGD5WSN.js";
-import "./chunk-KI2EY3WB.js";
+} from "./chunk-ZWLDLTJP.js";
+import "./chunk-PXKCZB2I.js";
 
 // ../../node_modules/@aws-sdk/nested-clients/dist-es/submodules/sso-oidc/auth/httpAuthSchemeProvider.js
 var defaultSSOOIDCHttpAuthSchemeParametersProvider = async (config, context, input) => {