watchbell 1.2.1 → 1.2.2

package/server/.next/server/chunks/src_1wzm081p6qyre._.js

@@ -1,6 +1,9 @@
-(()=>{"use strict";module.exports=[825895,e=>{var t=e.i(875225),r=e.i(924924),a=e.i(618916),n=e.i(620511),i=e.i(267841);let o="deps.lockfileDispatched";async function s(){let[e]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,n.h)).limit(1);return(0,n.g)(e?.value).repo}async function l(e,u,d=new Date){try{let l=await s();if(!l)return{sent:!1,why:"no actions repository"};let c=(0,n.C)(u);if(!c)return{sent:!1,why:"invalid"};let p=await (0,i.B)(e,l,c);if(!p.ok)return{sent:!1,why:p.error};let[f]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,o)).limit(1),m=f?.value&&"object"==typeof f.value?f.value:{},g={...Object.fromEntries(Object.entries(m).filter(([,e])=>d.getTime()-Date.parse(e)<864e5)),[`${u.repo}#${u.branch}`]:d.toISOString()};return await (0,r.f)().insert(a.settings).values({key:o,value:g}).onConflictDoUpdate({target:a.settings.key,set:{value:g,updatedAt:d}}),{sent:!0}}catch(e){return console.warn("deps: lockfile dispatch failed:",e instanceof Error?e.name:"error"),{sent:!1,why:"error"}}}async function u(e,i,s=new Date){try{let[l]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,o)).limit(1),u=l?.value?.[`${e}#${i}`];return!!u&&s.getTime()-Date.parse(u)<n.w}catch{return!1}}e.s(["W",0,u,"U",0,l])},582931,e=>{var t=e.i(875225),r=e.i(349129),a=e.i(924924),n=e.i(618916),i=e.i(921991),o=e.i(90801),s=e.i(975912),l=e.i(618127),u=e.i(581321),d=e.i(32391),c=e.i(256662),p=e.i(413230),f=e.i(547499),m=e.i(479301),g=e.i(502240),h=e.i(267841),k=e.i(628448),y=e.i(472832),w=e.i(825895);let b=e=>({done:!1,message:e});async function v(){let[e]=await (0,a.f)().select().from(n.accounts).where((0,t.u)(n.accounts.provider,"github_write")).orderBy((0,r.M)(n.accounts.createdAt)).limit(1);if(!e)return null;let o=(0,i.V)({ciphertext:e.credentialCiphertext,iv:e.credentialIv},(0,f.f)().OPS_ENCRYPTION_KEY);return o?{id:e.id,token:o}:"unreadable"}let $={severity:"no package at the selected severity",major:"an update jumps a major version",nothing:"nothing can be updated"};async function I(e){let[r]=await (0,a.f)().select({version:n.appSecurity.version,status:n.appSecurity.status,findings:n.appSecurity.findings}).from(n.appSecurity).where((0,t.u)(n.appSecurity.resourceId,e)).limit(1);return r?(0,l.p)({version:r.version,status:r.status,findings:Array.isArray(r.findings)?r.findings:[]}):null}async function A(e){let r=await (0,a.f)().select({package:n.dependencyVulns.package,installedVersion:n.dependencyVulns.installedVersion,fixedVersion:n.dependencyVulns.fixedVersion,vulnId:n.dependencyVulns.vulnId,aliases:n.dependencyVulns.aliases,severity:n.dependencyVulns.severity,direct:n.dependencyVulns.direct,dev:n.dependencyVulns.dev}).from(n.dependencyVulns).where((0,t.b)((0,t.u)(n.dependencyVulns.repoId,e),(0,t.M)(n.dependencyVulns.resolvedAt))).limit(2e3);return{upgrades:(0,p.B)(r),installed:(0,o.D)(r)}}async function R(e,t,r,a,n){let i=(0,g.f)(a,r);if(i){let r=await (0,h.M)(e,t,i,n);if(!r.ok)return r;if(r.data)return{ok:!0,data:{base:i,head:r}}}return{ok:!0,data:{base:r,head:await (0,h.M)(e,t,r,n)}}}async function x(r,i,p,f=y.W,g={}){let _;if(!(0,m.f)(i)||!(0,m.f)(p))return f(b("Something in that request wasn't valid."),r,"");let j=await (0,y.q)(r.id,"github_bump_pr",i);if(j)return f(b(j),r,"");let O=await v();if(null===O)return f(b('A GitHub PR-write token is needed: connect "GitHub (PR write)" on Connections (fine-grained, this repository only, Contents and Pull requests: Read and write; Commit statuses: Read for automatic merges), then ask again.'),r,"");if("unreadable"===O)return f(b("Can't read the stored GitHub PR-write credential. Replace it on Connections."),r,"");let[S]=await (0,a.f)().select({app:n.resources.name,meta:n.resources.meta,fullName:n.githubRepos.fullName,owner:n.githubRepos.owner,goneAt:n.githubRepos.goneAt,lockfilePath:n.dependencyScans.lockfilePath}).from(n.appRepos).innerJoin(n.githubRepos,(0,t.u)(n.githubRepos.id,n.appRepos.repoId)).innerJoin(n.resources,(0,t.u)(n.resources.id,n.appRepos.appId)).leftJoin(n.dependencyScans,(0,t.u)(n.dependencyScans.repoId,n.appRepos.repoId)).where((0,t.b)((0,t.u)(n.appRepos.appId,i),(0,t.u)(n.appRepos.repoId,p))).limit(1);if(!S||S.goneAt)return f(b(k.G),r,O.id);let P=S.meta??{},T=(0,u.l)(P.rootDirectoryUnsupported);if(T)return f(b(`The Vercel Root Directory "${T}" of ${S.app} couldn't be used (Watchbell reads plain folder names, at most 4 deep). Update its package.json yourself.`),r,O.id);let M=(0,u.Q)(P.rootDirectory),D=(0,u.H)(M,"package.json"),z=M?`in ${M}`:"at the repository root";if(g.framework){let e=await I(i);if(!e)return f(b(`Nothing to update in ${S.app}: its Next.js check shows no advisory with a fixed version.`),r,O.id);_=e}else if(!(_=await A(p)).upgrades.length)return f(b(`Nothing to update in ${S.app}: no direct package has a fixed version for its open advisories.`),r,O.id);let N=_.upgrades;if(g.auto){let e=(0,o.a)(N,_.installed,g.auto.severities);if(!e.ok)return f(b(`Automatic PR not opened: ${$[e.why]}. The proposal waits for your approval.`),r,O.id);N=e.upgrades}N=(0,l.F)(N);let{auto:E,proposalId:C,framework:K,...H}=g,B={timeoutMs:8e3,...H},L=await (0,h.H)(O.token,S.fullName,B);if(!L.ok)return f({done:!1,failed:L,audit:{message:`Package update PR failed \xb7 ${S.app}`,resourceId:i}},r,O.id);let V=await R(O.token,S.fullName,L.data.defaultBranch,P.productionBranch,B);if(!V.ok)return f({done:!1,failed:V,audit:{message:`Package update PR failed \xb7 ${S.app}`,resourceId:i}},r,O.id);let U=V.data.base,W=V.data.head;if(!W.ok)return f({done:!1,failed:W,audit:{message:`Package update PR failed \xb7 ${S.app}`,resourceId:i}},r,O.id);if(!W.data)return f(b(`The default branch ${U} wasn't found.`),r,O.id);let G=await (0,h.E)(O.token,S.fullName,W.data,B,D);if(!G.ok)return f({done:!1,failed:G,audit:{message:`Package update PR failed \xb7 ${S.app}`,resourceId:i}},r,O.id);if(!G.data)return f(b(`There is no package.json ${z}.`),r,O.id);let q=(0,s.k)(G.data.text,N);if(!q?.length||K&&!q.some(e=>"next"===e.package))return f(b(`${D} in ${S.app} already allows the fixed versions (or its ranges can't be rewritten). Run npm install there.`),r,O.id);if(E){let e=q.find(e=>{let t=(0,d.Y)(e.from);return!t||!(0,o.J)(t,e.fixed)});if(e)return f(b(`Automatic PR not opened: ${e.package} ${e.from} → ${e.to} jumps a major version. The proposal waits for your approval.`),r,O.id)}let F=(0,s.M)(G.data.text,q);if(!F)return f(b("package.json couldn't be edited safely."),r,O.id);let J=(0,s.U)(q,M);if(!(0,s.c)(J,U))return f(b("Refused: the PR branch would be the default branch."),r,O.id);let X=await (0,h.x)(O.token,S.fullName,S.owner,J,U,B);if(X.ok&&X.data)return{ok:!0,message:`Pull request #${X.data.number} for these updates is already open.`};let Z=await (0,h.e)(O.token,S.fullName,B);if(!Z.ok)return f({done:!1,failed:Z,audit:{message:`Package update PR failed \xb7 ${S.app}`,resourceId:i}},r,O.id);if(Z.data.length){let e=new Map((await (0,a.f)().select({number:n.dependencyPrs.number,packages:n.dependencyPrs.packages}).from(n.dependencyPrs).where((0,t.b)((0,t.u)(n.dependencyPrs.repoId,p),(0,t.y)(n.dependencyPrs.number,Z.data.map(e=>e.number))))).map(e=>[e.number,e.packages])),i=(0,o.U)(q.map(e=>e.package),Z.data.map(t=>({number:t.number,branch:t.branch,title:t.title,packages:e.get(t.number)??null})),M);if(i)return f(b(`Pull request #${i.number} for the same package is already open in ${S.app}. Merge or close it first.`),r,O.id)}let Y=await (0,h.M)(O.token,S.fullName,J,B);if(Y.ok&&Y.data)return f(b(`Branch ${J} already exists without an open pull request. Delete it on GitHub, then ask again.`),r,O.id);let Q=S.lockfilePath??(M?(0,u.H)(M,"package-lock.json"):null),ee=d.a.find(e=>e.path===Q?.split("/").pop())?.kind??null,et=e=>f({done:!1,failed:e,audit:{message:`Package update PR failed \xb7 ${S.app} \xb7 ${J}`,resourceId:i}},r,O.id),er=await (0,h.k)(O.token,S.fullName,J,W.data,U,B);if(!er.ok)return et(er);let ea=await (0,h.D)(O.token,S.fullName,J,U,F,G.data.sha,(0,s.G)(q),B,D);if(!ea.ok)return et(ea);let en=(0,s.f)(q,M),ei=await (0,h.y)(O.token,S.fullName,J,U,en,(0,s.y)(q,ee,!!E,M),B);if(!ei.ok)return et(ei);let eo=q.map(e=>`${e.package} ${e.from} → ${e.to}`).join(", "),es=await (0,h.M)(O.token,S.fullName,J,B).catch(()=>null);if(es?.ok&&es.data){await (0,a.f)().insert(n.dependencyPrs).values({repoId:p,appId:i,proposalId:C??null,number:ei.data.number,branch:J,baseBranch:U,headSha:es.data,title:en.slice(0,200),packages:q.map(e=>e.package),auto:!!E,stage:"checks",stageText:(0,c.m)(ei.data.number,"checks")}).onConflictDoNothing().catch(()=>console.warn("deps: recording the PR failed"));let{extensions:t}=await e.A(774810);await t.runner?.queueLockfileJob({repoId:p,branch:J,headSha:es.data,prNumber:ei.data.number,lockfilePath:Q,targets:q.map(e=>({name:e.package,version:e.fixed}))}).catch(()=>console.warn("deps: queueing the lockfile job failed")),await (0,w.U)(O.token,{repo:S.fullName,branch:J,lockfilePath:Q,prNumber:ei.data.number})}return f({done:!0,message:`Pull request #${ei.data.number} opened for ${S.app}: ${eo}. Run npm install${M?` in ${M}`:""} on the branch before merging.`,audit:{message:`Package update PR opened \xb7 ${S.app} \xb7 #${ei.data.number}`,resourceId:i,detail:eo}},r,O.id)}async function _(e,t,r){if(!(0,m.f)(e)||r&&!(0,m.f)(r.appId))return{ok:!1,why:"target"};let a=await v();if(!a||"unreadable"===a)return{ok:!1,why:"no write token"};let n=r?await I(r.appId):await A(e);if(!n)return{ok:!1,why:"nothing"};let i=(0,o.a)(n.upgrades,n.installed,t);return i.ok?{ok:!0}:{ok:!1,why:i.why}}async function j(e,r=[]){let i=e.filter(m.f),o=new Map;if(!i.length)return o;let s=await (0,a.f)().select({appId:n.appRepos.appId,repoId:n.appRepos.repoId,version:n.appSecurity.version,status:n.appSecurity.status,findings:n.appSecurity.findings}).from(n.appRepos).innerJoin(n.githubRepos,(0,t.u)(n.githubRepos.id,n.appRepos.repoId)).innerJoin(n.appSecurity,(0,t.u)(n.appSecurity.resourceId,n.appRepos.appId)).where((0,t.b)((0,t.y)(n.appRepos.appId,i),(0,t.M)(n.githubRepos.goneAt),(0,t.u)(n.appSecurity.status,"vulnerable"))).limit(i.length),u=new Set(r),d=s.filter(e=>u.has(e.appId)),c=d.length?new Set((await (0,a.f)().selectDistinct({repoId:n.dependencyVulns.repoId}).from(n.dependencyVulns).where((0,t.b)((0,t.y)(n.dependencyVulns.repoId,[...new Set(d.map(e=>e.repoId))]),(0,t.M)(n.dependencyVulns.resolvedAt),(0,t.u)(n.dependencyVulns.package,"next"),(0,t.u)(n.dependencyVulns.direct,!0),(0,t.E)(n.dependencyVulns.fixedVersion))).limit(d.length)).map(e=>e.repoId)):new Set;for(let e of s){if(u.has(e.appId)&&c.has(e.repoId))continue;let t=(0,l.p)({version:e.version,status:e.status,findings:Array.isArray(e.findings)?e.findings:[]});t&&o.set(e.appId,{repoId:e.repoId,from:t.from,to:t.to})}return o}e.s(["J",0,_,"W",0,x,"h",0,j,"G",0,v])},983128,860320,e=>{var t=e.i(875225),r=e.i(924924),a=e.i(618916),n=e.i(921991),i=e.i(547499),o=e.i(666680),s=e.i(140561),l=e.i(206033),u=e.i(105954),d=e.i(971724),c=e.i(180473),p=e.i(76012);let f={inline_keyboard:[]},m=0,g=e=>(0,o.createHash)("sha256").update(`watchpost:telegram-link:${e.trim().toUpperCase()}`,"utf8").digest("hex"),h=s.z.union([l.z.number().int(),u.z.string().regex(/^-?\d{1,20}$/)]).transform(e=>String(e)),k=d.z.object({id:h,type:u.z.string().max(32).optional(),title:u.z.string().max(256).optional(),first_name:u.z.string().max(256).optional(),username:u.z.string().max(64).optional()}),y=d.z.object({id:h,is_bot:c.z.boolean().optional()}),w=d.z.object({message_id:l.z.number().int(),chat:k,from:y.optional(),text:u.z.string().max(4096).optional()}),b=d.z.object({update_id:l.z.number().int(),message:w.optional(),callback_query:d.z.object({id:u.z.string().min(1).max(128),from:y,message:w.optional(),data:u.z.string().max(64).optional()}).optional()});e.s(["i",0,8,"y",0,function(e,t={}){let r=t.fetch??fetch,a=async(t,a)=>{let n=await (0,p.z)(e,t,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(a)},r);n.ok||/not modified/i.test(n.description)||console.warn(`telegram ${t} failed (${n.code??"network"})`)};return{answer:(e,t)=>a("answerCallbackQuery",{callback_query_id:e,text:t.slice(0,200)}),editText:(e,t,r,n)=>a("editMessageText",{chat_id:e,message_id:t,text:r,parse_mode:"HTML",link_preview_options:{is_disabled:!0},reply_markup:n??f}),editKeyboard:(e,t,r)=>a("editMessageReplyMarkup",{chat_id:e,message_id:t,reply_markup:r}),send:(e,t)=>a("sendMessage",{chat_id:e,text:t,parse_mode:"HTML",link_preview_options:{is_disabled:!0}})}},"v",0,e=>`${(e.title??e.first_name??e.username??"Chat").slice(0,50)} (${e.type??"chat"})`,"F",0,g,"z",0,()=>{m++},"j",0,function(e){let t=/^\/link(?:@[A-Za-z0-9_]{3,64})?\s+([A-Za-z0-9]{4,16})\s*$/.exec(e??"");return t?t[1].toUpperCase():null},"c",0,function(e){let t=b.safeParse(e);return t.success?t.data:null},"p",0,function(e,t){if("string"!=typeof e||"string"!=typeof t||!e||!t)return!1;let r=(0,o.createHash)("sha256").update(e,"utf8").digest(),a=(0,o.createHash)("sha256").update(t,"utf8").digest();return(0,o.timingSafeEqual)(r,a)}],860320);let v="telegram.owner",$="telegram.linkCode",I="telegram.seenChats",A=()=>(0,i.f)().OPS_ENCRYPTION_KEY;async function R(e){let[n]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,e)).limit(1);return n?.value??null}async function x(e,t){await (0,r.f)().insert(a.settings).values({key:e,value:t}).onConflictDoUpdate({target:a.settings.key,set:{value:t,updatedAt:new Date}})}async function _(e){await (0,r.f)().delete(a.settings).where((0,t.u)(a.settings.key,e))}function j(e){let t=e?.sealed;if(!t||"string"!=typeof t.ciphertext||"string"!=typeof t.iv)return null;try{return(0,n.K)(t,A())}catch{return null}}let O=(e,t)=>({sealed:(0,n.l)(e,A()),at:t.toISOString()}),S=null;async function P(e=Date.now()){if(S&&S.until>e)return S.secret;let t=j(await R("telegram.webhook"));return S={secret:t,until:e+3e4},t}let T=async()=>await P()!==null;async function M(){let e,n=j(await R(v));if(!n)return null;try{e=JSON.parse(n)}catch{return null}if("string"!=typeof e.tg||"string"!=typeof e.member)return null;let[i]=await (0,r.f)().select({id:a.members.id,userId:a.members.userId}).from(a.members).where((0,t.b)((0,t.u)(a.members.id,e.member),(0,t.u)(a.members.role,"owner"))).limit(1);return i?{telegramUserId:e.tg,memberId:i.id,userId:i.userId}:null}let D=async()=>await M()!==null;async function z(e,n,i){let o=await R($);if(!o||"string"!=typeof o.hash||"string"!=typeof o.member||"string"!=typeof o.expiresAt)return"expired";if(Date.parse(o.expiresAt)<=i.getTime())return await _($),"expired";let s="number"==typeof o.tries?o.tries:0;if(!function(e,t){if(e.length!==t.length||!e)return!1;let r=0;for(let a=0;a<e.length;a++)r|=e.charCodeAt(a)^t.charCodeAt(a);return 0===r}(8===e.length?g(e):"",o.hash))return s+1>=5?await _($):await x($,{...o,tries:s+1}),"wrong";let[l]=await (0,r.f)().select({id:a.members.id}).from(a.members).where((0,t.b)((0,t.u)(a.members.id,o.member),(0,t.u)(a.members.role,"owner"))).limit(1);return(await _($),l)?(await x(v,O(JSON.stringify({tg:n,member:l.id}),i)),"linked"):"expired"}async function N(){let e=j(await R(I));if(!e)return[];try{let t=JSON.parse(e);return Array.isArray(t)?t.filter(e=>!!e&&"string"==typeof e.id&&"string"==typeof e.label&&"string"==typeof e.at).slice(0,10):[]}catch{return[]}}async function E(e,t){var r;let a,n=(r=await N(),(a=r.find(t=>t.id===e.id))&&a.label===e.label&&t.getTime()-Date.parse(a.at)<36e5&&r[0]?.id===e.id?null:[{id:e.id,label:e.label,at:t.toISOString()},...r.filter(t=>t.id!==e.id)].slice(0,10));n&&await x(I,O(JSON.stringify(n),t))}e.s(["E",0,M,"I",0,D,"P",0,E,"f",0,z,"v",0,T,"g",0,P],983128)},620511,e=>{let t=/^[A-Za-z0-9-]{1,39}\/[A-Za-z0-9._-]{1,100}$/,r=/^watchpost\/deps-[0-9a-f]{8}$/,a=/^(?:[A-Za-z0-9._-]+\/){0,4}package-lock\.json$/,n=e=>"string"==typeof e&&t.test(e)&&!e.includes("..");e.s(["h",0,"deps.lockfileActions","w",0,6e5,"C",0,function(e){let t=e.lockfilePath??"package-lock.json";return!n(e.repo)||!r.test(e.branch)||!a.test(t)||t.includes("..")||!Number.isInteger(e.prNumber)||e.prNumber<1?null:{repo:e.repo,branch:e.branch,lockfile:t,pr:e.prNumber}},"g",0,function(e){let t=e&&"object"==typeof e&&!Array.isArray(e)?e.repo:null;return{repo:n(t)?t:null}}])},975912,e=>{var t=e.i(250474),r=e.i(32391),a=e.i(313931);let n=["dependencies","devDependencies","optionalDependencies"],i="watchpost/deps-",o=e=>"object"==typeof e&&null!==e&&!Array.isArray(e),s=e=>{let t=e.filter(e=>!e.companionOf);return t.length?t:e},l={npm:"npm install",pnpm:"pnpm install",yarn:"yarn install",bun:"bun install","package-json":"npm install"};e.s(["M",0,function(e,t){let r;try{r=JSON.parse(e)}catch{return null}if(!o(r))return null;for(let e of t){let t=r[e.group];if(!o(t)||t[e.package]!==e.from)return null;t[e.package]=e.to}let a=/^[{[]\r?\n([ \t]+)\S/.exec(e),n=a?a[1]:"  ",i=e.includes("\r\n")?"\r\n":"\n",s=JSON.stringify(r,null,n);return"\r\n"===i&&(s=s.replace(/\n/g,"\r\n")),/\r?\n$/.test(e)?s+i:s},"U",0,function(e,t=null){let r=e.map(e=>`${e.package}@${e.to}`).sort().join(",");return`${i}${function(e){let t=0x811c9dc5;for(let r=0;r<e.length;r++)t^=e.charCodeAt(r),t=Math.imul(t,0x1000193)>>>0;return t.toString(16).padStart(8,"0")}(t?`${t}|${r}`:r)}`},"G",0,function(e){let t=s(e);return 1===t.length?`chore(deps): update ${t[0].package} to ${t[0].fixed} (security fix)`:`chore(deps): update ${t.length} packages for security fixes`},"c",0,(e,t)=>e.startsWith(i)&&/^watchpost\/deps-[0-9a-f]{8}$/.test(e)&&e!==t,"k",0,function(e,a){let i;try{i=JSON.parse(e)}catch{return null}if(!o(i))return null;let s=[];for(let e of a)if((0,r.L)(e.package)&&(0,r.C)(e.to))for(let a of n){let n=i[a];if(!o(n)||"string"!=typeof n[e.package])continue;let l=n[e.package],u=(0,r.Y)(l),d=function(e,t){let a=/^\s*(\^|~|>=|=)?\s*v?\d+(?:\.(?:\d+|x|\*))?(?:\.(?:\d+|x|\*))?(?:-[0-9A-Za-z.-]+)?\s*$/.exec(e);return a&&(0,r.C)(t)?`${a[1]??""}${t}`:null}(l,e.to);!u||!d||(0,t.f)(u,e.to)>=0||s.push({package:e.package,group:a,from:l,to:d,fixed:e.to,vulnIds:e.vulnIds,cves:e.cves,...e.companionOf?{companionOf:e.companionOf}:{}})}return s},"y",0,function(e,t,r=!1,n=null){let i=l[t??"npm"]??"npm install",o=`run \`${i}\`${n?` in \`${n}\``:""}`,s=e.filter(e=>!e.companionOf),u=e.filter(e=>e.companionOf),d=s.map(e=>{let t=[...e.cves,...e.vulnIds.filter(t=>!e.cves.includes(t))].slice(0,4).map(e=>`[${e}](https://osv.dev/vulnerability/${encodeURIComponent(e)})`).join(", ");return`| \`${e.package}\` | \`${e.from}\` | \`${e.to}\` | ${t||"-"} |`});return[r?"This PR was opened **automatically** by Watchbell (Automatic security fixes). Watchbell merges it itself when CI is green, the Vercel preview is READY and passes the smoke test, and auto-rollback is on; if anything fails, the PR stays open for you to check.":a.J.prApproved,"","These packages have known vulnerabilities (source: OSV.dev / GitHub Advisory) and a fixed version exists:","","| Package | Current version | New version | Advisory |","| --- | --- | --- | --- |",...d,"",...u.map(e=>`Updated to match ${e.companionOf} (no advisory of its own): \`${e.package}\` \`${e.from}\` → \`${e.to}\`.`),...u.length?[""]:[],"### Important: the lockfile is not updated","",r?`Watchbell only changes \`package.json\`; it can't regenerate the lockfile on the server. Vercel installs the new version at build time, so production is safe after the merge. Afterwards ${o} on the main branch and commit the lockfile to bring it up to date.`:`Watchbell only changes \`package.json\`; it can't regenerate the lockfile on the server. Before merging, check out this branch, ${o}, then commit the changed lockfile. Then make sure the build and tests still pass.`,"","Vulnerable packages that are only installed through other packages (transitive) are not changed here; check with `npm audit` after installing.","","_Nothing is pushed to the main branch: all changes are on this PR branch._"].join("\n")},"f",0,function(e,t=null){let r=s(e),a=t?` in ${t}`:"",n=1===r.length?`Watchbell: update ${r[0].package} to ${r[0].fixed}${a} (security fix)`:`Watchbell: update ${r.length} vulnerable packages${a} (${r.slice(0,2).map(e=>e.package).join(", ")}${r.length>2?", …":""})`;return n.length>200?`${n.slice(0,199)}…`:n}])},256662,e=>{let t={checks:"waiting for CI",preview:"waiting for preview",smoke:"smoke test",merging:"merging…",merged:"merged ✅","ready-manual":"ready to merge (manual)",failed:"needs a look ⚠️",timeout:"needs a look ⚠️",closed:"closed"},r=new Set(["success","neutral","skipped"]),a=e=>"completed"!==e.status?"pending":r.has(e.conclusion??"")?"success":"failure",n={name:"watchbell[bot]",email:"watchbell-bot@users.noreply.github.com",message:"chore(deps): update package-lock.json (Watchbell)"},i={name:"watchpost[bot]",email:"watchpost-bot@users.noreply.github.com",message:"chore(deps): update package-lock.json (Watchpost)"},o=e=>[n,i].some(t=>e.name===t.name&&e.email.toLowerCase()===t.email&&e.message.trim()===t.message),s=/^[\^~]?[0-9][0-9A-Za-z.+-]*$/,l=e=>Array.isArray(e)?e.map(l):e&&"object"==typeof e?Object.fromEntries(Object.keys(e).sort().map(t=>[t,l(e[t])])):e,u=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,d=/^sha512-[A-Za-z0-9+/]{86}==$/,c="(?:@[a-z0-9][a-z0-9._~-]*/)?[a-z0-9][a-z0-9._~-]*",p=RegExp(`^(?:[A-Za-z0-9_-][A-Za-z0-9._-]*/)*?node_modules/${c}(?:/node_modules/${c})*$`,"i"),f=new Set(["dev","optional","devOptional","peer"]),m=e=>!!e&&"object"==typeof e&&!Array.isArray(e),g=e=>e.slice(e.lastIndexOf("node_modules/")+13),h=(e,t,r)=>`${e}/${t}/-/${t.split("/").pop()}-${r}.tgz`,k=(e,t)=>JSON.stringify(l(e))===JSON.stringify(l(t)),y=e=>Object.fromEntries(Object.entries(e).filter(([e])=>!f.has(e))),w=e=>{try{let t=JSON.parse(e);return m(t)&&m(t.packages)?t:null}catch{return null}};e.s(["y",0,20,"X",0,["checks","preview","smoke","merging"],"w",0,15e3,"R",0,27e5,"j",0,function(e){let t=(e.checkRuns??e.actionRuns??[]).map(a);return(e.combined&&e.combined.total>0&&t.push("success"===e.combined.state?"success":"pending"===e.combined.state?"pending":"failure"),t.includes("failure"))?"failure":t.includes("pending")?"pending":"success"},"L",0,function(e){if(!e.length||e.some(e=>e.authWall))return null;let t=e.find(e=>null===e.status||e.status<200||e.status>399);return t?{mode:"http",result:"fail",reason:null===t.status?`${t.path} didn't answer within 15 seconds`:`${t.path} answered ${t.status}`}:{mode:"http",result:"pass",reason:null}},"S",0,function(e,t,r){return(401===e||403===e)&&(/vercel\.com\/(sso|login)|Authentication Required|_vercel_sso|vercel-authentication/i.test(t)||/_vercel_sso/i.test(r.get("set-cookie")??"")||"vercel"===(r.get("server")??"").toLowerCase())},"T",0,function(e,t,r){if([e,t].some(e=>null!==e&&(e=>{if(e.length>0x1900000)return!0;if(3*e.length<=0x1900000)return!1;let t=0;for(let r=0;r<e.length;r++){let a=e.charCodeAt(r);a<128?t+=1:a<2048?t+=2:a>=55296&&a<56320&&(64512&e.charCodeAt(r+1))==56320?(t+=4,r++):t+=3}return t>0x1900000})(e)))return`lockfile too large to check (over 25 MB): ${r}`.slice(0,150);try{return function(e,t,r){let a=e=>`unexpected lockfile change ${e}`.slice(0,150),n=null===t?null:w(t),i=null===e?{packages:{}}:w(e);if(!n||!i)return a(r);if(2!==n.lockfileVersion&&3!==n.lockfileVersion||null!==e&&n.lockfileVersion!==i.lockfileVersion)return a("lockfileVersion");let o=new Set;for(let[e,t]of Object.entries(i.packages)){if(!p.test(e)||!m(t)||"string"!=typeof t.resolved||"string"!=typeof t.version)continue;let r=h("","string"==typeof t.name?t.name:g(e),t.version);t.resolved.startsWith("https://")&&t.resolved.endsWith(r)&&o.add(t.resolved.slice(0,-r.length))}for(let[e,t]of(o.size||o.add("https://registry.npmjs.org"),Object.entries(n.packages))){let n=Object.hasOwn(i.packages,e)?i.packages[e]:void 0;if(void 0!==n&&k(n,t))continue;let s=m(n)?n:null;if(""===e||!e.includes("node_modules/")){let n=""===e?m(t)&&"string"==typeof t.name?t.name:r:e;if(!m(t)||""!==e&&!s||"resolved"in t||"link"in t)return a(n);continue}if(!p.test(e)||!m(t))return a(p.test(e)?g(e):e);let l=g(e);if(void 0!==t.name&&t.name!==l&&(!s||s.name!==t.name))return a(l);let c="string"==typeof t.name?t.name:l,f=t.version;if(void 0!==t.link||"string"!=typeof f||!u.test(f)||"string"!=typeof t.integrity||!d.test(t.integrity)||"string"!=typeof t.resolved||![...o].some(e=>t.resolved===h(e,c,f))||s&&s.version===f&&!k(y(s),y(t)))return a(l)}return null}(e,t,r)}catch{return`unexpected lockfile change ${r} (couldn't be checked)`.slice(0,150)}},"H",0,e=>!!e.lockfileRequired&&!!e.lockfile&&!e.files.some(t=>t.filename===e.lockfile),"n",0,function(e,t,r){return null!==r&&r>0?{mode:"logs",result:"fail",reason:`${r} errors in the preview logs`}:t.getTime()-e.getTime()<18e4||null===r?{mode:"logs",result:"wait",reason:null}:{mode:"logs",result:"pass",reason:null}},"C",0,function(e,t,r){let a,n;try{a=JSON.parse(e),n=JSON.parse(t)}catch{return"unexpected change: package.json isn't valid JSON"}if(!a||!n||"object"!=typeof a||"object"!=typeof n)return"unexpected change: package.json isn't an object";let i=e=>{let t=structuredClone(e);for(let e of["dependencies","devDependencies"]){let a=t[e];if(a&&"object"==typeof a)for(let e of r)delete a[e]}return t};if(JSON.stringify(l(i(a)))!==JSON.stringify(l(i(n))))return"unexpected change in package.json beyond the bumped versions";for(let e of["dependencies","devDependencies"]){let t=a[e]??{},i=n[e]??{};for(let e of r){if(e in t!=e in i)return`unexpected change in package.json: ${e} added or removed`;if(e in i&&i[e]!==t[e]&&("string"!=typeof i[e]||!s.test(i[e])))return`unexpected change in package.json: ${e} isn't a plain version`}}return null},"E",0,function(e){let t=["/"];for(let r of e){let e;try{e=new URL(r).pathname||"/"}catch{continue}!t.includes(e)&&t.length<4&&t.push(e)}return t},"m",0,(e,r,a)=>{let n=`PR #${e}: ${t[r]}${a?` — ${a}`:""}`;return n.length>200?`${n.slice(0,199)}…`:n},"k",0,function(e){let t=new Set([e.manifest,...e.lockfile?[e.lockfile]:[]]);for(let r of e.files)for(let e of[r.filename,r.previous])if(e&&!t.has(e))return`unexpected change in ${e}`.slice(0,150);if(!e.files.some(t=>t.filename===e.manifest))return`unexpected change: ${e.manifest} isn't changed`.slice(0,150);if(e.manifestProblem)return e.manifestProblem.slice(0,150);if(e.lockfileProblem)return e.lockfileProblem.slice(0,150);if(!e.tokenLogin||!e.commits.length||e.commits.length>20)return"couldn't confirm who wrote the PR's commits";if(e.headSha&&e.commits[e.commits.length-1].sha!==e.headSha)return"the PR's head moved while it was checked";for(let t of e.commits){if(null!==t.login&&t.login.toLowerCase()===e.tokenLogin.toLowerCase())continue;let r=t.sha.slice(0,7);if(!o(t)||!t.files||!e.lockfile)return`unexpected commit ${r} by ${t.login??t.name}`.slice(0,150);let a=t.files.find(t=>t!==e.lockfile);if(a)return`unexpected change in ${a} by commit ${r}`.slice(0,150)}return null},"f",0,function(e,t){let r=e.getTime();return(null===t||!(r-t<1e5))&&(Math.floor(r/6e4)%2==0||null!==t&&r-t>=24e4)},"M",0,function(e){if(e.pr.merged)return{kind:"done",stage:"merged"};if("closed"===e.pr.state)return{kind:"done",stage:"closed"};if(void 0!==e.pr.base&&void 0!==e.recordedBase&&e.pr.base!==e.recordedBase)return{kind:"stop",stage:"failed",reason:`the PR's base changed to ${e.pr.base}`};if(e.pr.headSha!==e.recordedSha)return{kind:"wait",stage:"checks",reason:"new commit on the PR branch, checking again",resetSha:e.pr.headSha};let t=e.now.getTime()-e.openedAt.getTime()>27e5;return"failure"===e.checks?{kind:"stop",stage:"failed",reason:"CI failed"}:!1===e.pr.mergeable?{kind:"stop",stage:"failed",reason:"conflicts with the main branch"}:"error"===e.preview.state||"canceled"===e.preview.state?{kind:"stop",stage:"failed",reason:"Vercel preview failed"}:"pending"===e.checks||null===e.pr.mergeable?t?{kind:"stop",stage:"timeout",reason:"CI not finished within 45 minutes"}:{kind:"wait",stage:"checks",reason:null}:"ready"!==e.preview.state?t?{kind:"stop",stage:"timeout",reason:"preview not ready within 45 minutes"}:{kind:"wait",stage:"preview",reason:null}:e.smoke&&"wait"!==e.smoke.result?"fail"===e.smoke.result?{kind:"stop",stage:"failed",reason:`preview smoke test failed: ${e.smoke.reason??"?"}`}:e.autoRollbackOn?{kind:"merge"}:{kind:"stop",stage:"ready-manual",reason:"PR is ready to merge, but auto-rollback is off; merge it manually"}:t?{kind:"stop",stage:"timeout",reason:"preview smoke test not finished within 45 minutes"}:{kind:"wait",stage:"smoke",reason:null}}])},267841,e=>{var t=e.i(971724),r=e.i(105954),a=e.i(180473),n=e.i(600205),i=e.i(206033),o=e.i(455744),s=e.i(604147),l=e.i(975912),u=e.i(455037);async function d(e,t,r,a,n,i=!1){let o,s=n.timeoutMs??8e3;try{o=await (n.fetch??fetch)(`https://api.github.com${t}`,{method:e,headers:{Authorization:`Bearer ${r}`,Accept:i?"application/vnd.github.raw+json":"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28","User-Agent":"Watchbell",...void 0!==a?{"Content-Type":"application/json"}:{}},body:void 0!==a?JSON.stringify(a):void 0,signal:AbortSignal.timeout(s),cache:"no-store",redirect:"error"})}catch(e){return{ok:!1,kind:"transient",error:e instanceof DOMException&&("TimeoutError"===e.name||"AbortError"===e.name)?`GitHub didn't answer within ${Math.round(s/1e3)} seconds.`:"Couldn't reach GitHub."}}let l=await o.text().catch(()=>"");if(i&&o.ok)return{ok:!0,status:o.status,data:l};let u=null;try{u=l?JSON.parse(l):null}catch{u=null}if(o.ok)return{ok:!0,status:o.status,data:u};let c=o.status;return 401===c?{ok:!1,kind:"auth",status:c,error:"GitHub rejected the PR-write token (401). It may have expired or been revoked."}:429===c||403===c&&"0"===o.headers.get("x-ratelimit-remaining")?{ok:!1,kind:"transient",status:c,error:"GitHub's rate limit is used up for now. Try again later."}:403===c?{ok:!1,kind:"scope",status:c,error:"The GitHub PR-write token can't do this (403). It needs Contents and Pull requests: Read and write on this repository."}:404===c?{ok:!1,kind:"missing",status:c,error:"The PR-write token doesn't see this repository (404). Give it access to the repository."}:409===c||422===c?{ok:!1,kind:"format",status:c,error:`GitHub refused the change (${c}).`}:{ok:!1,kind:"transient",status:c,error:`GitHub returned an error (${c}).`}}let c=e=>({ok:!1,kind:"format",error:`GitHub answered ${e} in a format the console doesn't recognise.`}),p={ok:!1,kind:"format",error:"That isn't a repository or branch the console may write."};async function f(e,n,i={}){if(!(0,u.M)(n))return p;let o=await d("GET",`/repos/${(0,u.f)(n)}`,e,void 0,i);if(!o.ok)return o;let s=t.z.object({default_branch:r.z.string(),permissions:t.z.object({push:a.z.boolean()}).partial().optional()}).safeParse(o.data);return s.success&&(0,u.c)(s.data.default_branch)?{ok:!0,data:{defaultBranch:s.data.default_branch,canPush:s.data.permissions?.push??null}}:c("the repository")}async function m(e,a,n,i={}){if(!(0,u.M)(a)||!(0,u.c)(n))return p;let o=await d("GET",`/repos/${(0,u.f)(a)}/git/ref/heads/${n.split("/").map(encodeURIComponent).join("/")}`,e,void 0,i);if(!o.ok)return"missing"===o.kind?{ok:!0,data:null}:o;let s=t.z.object({object:t.z.object({sha:r.z.string().regex(/^[0-9a-f]{40}$/)})}).safeParse(o.data);return s.success?{ok:!0,data:s.data.object.sha}:c("the branch")}let g=/^(?:[A-Za-z0-9._-]{1,100}\/){0,6}package\.json$/,h=e=>g.test(e)&&!e.split("/").some(e=>"."===e||".."===e),k=(e,t)=>`/repos/${(0,u.f)(e)}/contents/${t.split("/").map(encodeURIComponent).join("/")}`;async function y(e,a,i,o={},s="package.json"){if(!(0,u.M)(a)||!(0,u.c)(i)||!h(s))return p;let l=await d("GET",`${k(a,s)}?ref=${encodeURIComponent(i)}`,e,void 0,o);if(!l.ok)return"missing"===l.kind?{ok:!0,data:null}:l;let f=t.z.object({sha:r.z.string(),encoding:n.z.literal("base64"),content:r.z.string()}).safeParse(l.data);return f.success?{ok:!0,data:{sha:f.data.sha,text:Buffer.from(f.data.content.replace(/\s/g,""),"base64").toString("utf8")}}:c("package.json")}let w=/^(?:[A-Za-z0-9._-]{1,100}\/){0,6}(?:package-lock|npm-shrinkwrap)\.json$/,b=e=>w.test(e)&&!e.split("/").some(e=>"."===e||".."===e);async function v(e,t,r,a,n={}){if(!(0,u.M)(t)||!(0,u.c)(r)||!b(a))return p;let i=await d("GET",`${k(t,a)}?ref=${encodeURIComponent(r)}`,e,void 0,{timeoutMs:2e4,...n},!0);return i.ok?"string"==typeof i.data?{ok:!0,data:i.data}:c("the lockfile"):"missing"===i.kind?{ok:!0,data:null}:i}async function $(e,t,r,a,n,i={}){if(!(0,u.M)(t)||!(0,l.c)(r,n)||!/^[0-9a-f]{40}$/.test(a))return p;let o=await d("POST",`/repos/${(0,u.f)(t)}/git/refs`,e,{ref:`refs/heads/${r}`,sha:a},i);return o.ok?{ok:!0,data:!0}:o}async function I(e,t,r,a,n,i,o,s={},c="package.json"){if(!(0,u.M)(t)||!(0,l.c)(r,a)||!h(c))return p;let f=await d("PUT",k(t,c),e,{message:o,content:Buffer.from(n,"utf8").toString("base64"),sha:i,branch:r},s);return f.ok?{ok:!0,data:!0}:f}let A=t.z.object({number:i.z.number(),html_url:r.z.string().startsWith("https://github.com/")});async function R(e,t,r,a,n,i={}){if(!(0,u.M)(t)||!(0,l.c)(a,n))return p;let s=new URLSearchParams({state:"open",head:`${r}:${a}`,per_page:"1"}),f=await d("GET",`/repos/${(0,u.f)(t)}/pulls?${s}`,e,void 0,i);if(!f.ok)return f;let m=o.z.array(A).safeParse(f.data);if(!m.success)return c("the pull requests");let g=m.data[0];return{ok:!0,data:g?{number:g.number,url:g.html_url}:null}}async function x(e,t,r,a,n,i,o={}){if(!(0,u.M)(t)||!(0,l.c)(r,a)||!(0,u.c)(a))return p;let s=await d("POST",`/repos/${(0,u.f)(t)}/pulls`,e,{title:n,head:r,base:a,body:i,maintainer_can_modify:!0},o);if(!s.ok)return s;let f=A.safeParse(s.data);return f.success?{ok:!0,data:{number:f.data.number,url:f.data.html_url}}:c("the new pull request")}let _=o.z.array(t.z.object({number:i.z.number(),title:r.z.string(),head:t.z.object({ref:r.z.string(),sha:r.z.string(),repo:t.z.object({full_name:r.z.string()}).nullable()}),base:t.z.object({ref:r.z.string()})}));async function j(e,t,r={}){if(!(0,u.M)(t))return p;let a=await d("GET",`/repos/${(0,u.f)(t)}/pulls?state=open&per_page=100`,e,void 0,r);if(!a.ok)return a;let n=_.safeParse(a.data);return n.success?{ok:!0,data:n.data.filter(e=>/^watchpost\/deps-[0-9a-f]{8}$/.test(e.head.ref)&&e.head.repo?.full_name===t).map(e=>({number:e.number,branch:e.head.ref,title:e.title,headSha:e.head.sha,base:e.base.ref}))}:c("the pull requests")}async function O(e,n,i,o={}){if(!(0,u.M)(n)||!Number.isInteger(i)||i<=0)return p;let l=await d("GET",`/repos/${(0,u.f)(n)}/pulls/${i}`,e,void 0,o);if(!l.ok)return l;let f=t.z.object({state:s.z.enum(["open","closed"]),merged:a.z.boolean().optional(),mergeable:a.z.boolean().nullable().optional(),head:t.z.object({ref:r.z.string(),sha:r.z.string().regex(/^[0-9a-f]{40}$/)}),base:t.z.object({ref:r.z.string()})}).safeParse(l.data);return f.success?{ok:!0,data:{state:f.data.state,merged:!0===f.data.merged,mergeable:f.data.mergeable??null,headSha:f.data.head.sha,branch:f.data.head.ref,base:f.data.base.ref}}:c("the pull request")}async function S(e,a,n,s={}){if(!(0,u.M)(a)||!/^[0-9a-f]{40}$/.test(n))return p;let[l,c]=await Promise.all([d("GET",`/repos/${(0,u.f)(a)}/commits/${n}/check-runs?per_page=100`,e,void 0,s),d("GET",`/repos/${(0,u.f)(a)}/commits/${n}/status`,e,void 0,s)]),f=e=>!e.ok&&("scope"===e.kind||"missing"===e.kind);if(!l.ok&&!f(l))return l;if(!c.ok&&!f(c))return c;let m=l.ok?t.z.object({check_runs:o.z.array(t.z.object({status:r.z.string(),conclusion:r.z.string().nullable()}))}).safeParse(l.data):null,g=c.ok?t.z.object({state:r.z.string(),total_count:i.z.number()}).safeParse(c.data):null;return{ok:!0,data:{checkRuns:m?.success?m.data.check_runs.map(e=>({status:e.status,conclusion:e.conclusion})):null,combined:g?.success?{state:g.data.state,total:g.data.total_count}:null}}}async function P(e,n,i,o,s,f,m,g={}){if(!(0,u.M)(n)||!(0,l.c)(o,s)||!/^[0-9a-f]{40}$/.test(f)||!Number.isInteger(i)||i<=0)return p;let h=await d("PUT",`/repos/${(0,u.f)(n)}/pulls/${i}/merge`,e,{merge_method:"squash",sha:f,commit_title:`Watchbell: ${m.replace(/^Watch(?:bell|post):\s*/,"")}`.slice(0,250)},g);if(!h.ok)return 405===h.status?{ok:!1,kind:"format",status:405,error:"GitHub says the PR can't be merged now (405)."}:409===h.status?{ok:!1,kind:"format",status:409,error:"The PR's head moved since the checks were read (409)."}:h;let k=t.z.object({merged:a.z.boolean(),sha:r.z.string()}).safeParse(h.data);return k.success&&k.data.merged?{ok:!0,data:{sha:k.data.sha}}:c("the merge")}async function T(e,a,n,i={}){if(!(0,u.M)(a)||!Number.isInteger(n)||n<=0)return p;let s=await d("GET",`/repos/${(0,u.f)(a)}/pulls/${n}/files?per_page=100`,e,void 0,i);if(!s.ok)return s;let l=o.z.array(t.z.object({filename:r.z.string(),previous_filename:r.z.string().optional()})).safeParse(s.data);return l.success?{ok:!0,data:l.data.map(e=>({filename:e.filename,previous:e.previous_filename??null}))}:c("the PR's files")}let M=t.z.object({name:r.z.string().optional(),email:r.z.string().optional()}).nullable().optional();async function D(e,a,n,i={}){if(!(0,u.M)(a)||!Number.isInteger(n)||n<=0)return p;let s=await d("GET",`/repos/${(0,u.f)(a)}/pulls/${n}/commits?per_page=100`,e,void 0,i);if(!s.ok)return s;let l=o.z.array(t.z.object({sha:r.z.string().regex(/^[0-9a-f]{40}$/),author:t.z.object({login:r.z.string()}).nullable().optional(),commit:t.z.object({message:r.z.string(),author:M})})).safeParse(s.data);return l.success?{ok:!0,data:l.data.map(e=>({sha:e.sha,login:e.author?.login??null,name:e.commit.author?.name??"",email:e.commit.author?.email??"",message:e.commit.message}))}:c("the PR's commits")}async function z(e,a,n,i={}){if(!(0,u.M)(a)||!/^[0-9a-f]{40}$/.test(n))return p;let s=await d("GET",`/repos/${(0,u.f)(a)}/commits/${n}`,e,void 0,i);if(!s.ok)return s;let l=t.z.object({files:o.z.array(t.z.object({filename:r.z.string(),previous_filename:r.z.string().optional()}))}).safeParse(s.data);return l.success?{ok:!0,data:l.data.files.flatMap(e=>[e.filename,...e.previous_filename?[e.previous_filename]:[]])}:c("the commit")}async function N(e,a={}){let n=await d("GET","/user",e,void 0,a);if(!n.ok)return n;let i=t.z.object({login:r.z.string().min(1)}).safeParse(n.data);return i.success?{ok:!0,data:i.data.login}:c("the token's user")}async function E(e,t,r,a={}){if(!/^[A-Za-z0-9-]{1,39}\/[A-Za-z0-9._-]{1,100}$/.test(t))return p;let n=await d("POST",`/repos/${t}/dispatches`,e,{event_type:"watchpost-lockfile",client_payload:r},a);return n.ok?{ok:!0,data:!0}:n}e.s(["M",0,m,"s",0,S,"h",0,z,"k",0,$,"y",0,x,"B",0,E,"$",0,b,"l",0,v,"E",0,y,"C",0,P,"x",0,R,"e",0,j,"P",0,D,"O",0,T,"b",0,O,"D",0,I,"H",0,f,"z",0,N])},154586,e=>{var t=e.i(278619),r=e.i(313931);let a={workloads:"Workloads",databases:"Databases",network:"Network",observe:"Observe",ai:"AI & API",admin:"Administration"},n={MonitorDown:"workloads",HighLatency:"workloads",DeploymentFailed:"workloads",DatabasePaused:"databases",StorageAlmostFull:"databases",NeonComputeHigh:"databases",FirestoreQuotaHigh:"databases",AutoPauseRisk:"databases",ComputeHigh:"databases",DbQuotaHigh:"databases",CertExpiringSoon:"network",DomainExpiringSoon:"network",DnsProxiedToVercel:"network",CollectorStale:"observe",CredentialExpiring:"admin",VulnerableDependency:"workloads",FrameworkVulnerable:"workloads",MonitorDomainMoved:"workloads"},i=new Set(["MonitorDown","HighLatency","DeploymentFailed","VulnerableDependency","FrameworkVulnerable","MonitorDomainMoved"]);e.s(["p",0,function(e){if((0,t.h)(e.ruleKey))return i.has(e.ruleKey)&&null!==e.resourceKind&&"app"!==e.resourceKind?"observe":n[e.ruleKey];let r=new Set(e.ruleKey.replace(/([a-z0-9])([A-Z])/g,"$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g,"$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean)),a=(...e)=>e.some(e=>r.has(e));return a("ai","router","gateway","model","models","provider","quota","llm","gemini")?"ai":a("key","keys","member","members","security","audit","credential","credentials","mfa","token")?"admin":a("database","db","storage","compute","neon","supabase","firestore","firebase")?"databases":a("domain","domains","dns","cert","certificate","tls","zone")?"network":"app"===e.resourceKind?"workloads":"observe"},"y",0,e=>r.X.proposedBy(a[e])])},549419,143926,e=>{var t=e.i(635982),r=e.i(377489),a=e.i(154586),n=e.i(365156);let i=["LogErrorSpike","LogErrors","LogDbErrors"],o="timeout|ECONNREFUSED|too many connections|terminating connection|connection terminated|endpoint is disabled|compute.*suspend";RegExp(o,"i");let s=/^dpl_[A-Za-z0-9]{8,40}$/,l=/^ep-[a-z0-9-]{3,60}$/,u=/^[a-z0-9]{8,40}$/;function d(e,a,n){let i=a?(0,t.f)(a,n,120):"";return(0,r.l)((0,t.f)(i?`${e}. Most common: ${i}`:e,n,r.j)||e,r.j)}let c=e=>`${e.ruleKey}:${e.resourceId??""}:${e.action}`,p=new Set(["pending","approved","running"]);e.s(["s",0,864e5,"b",0,72e5,"V",0,3,"N",0,o,"G",0,20,"T",0,i,"v",0,72e5,"H",0,18e5,"w",0,10,"I",0,72e5,"x",0,function(e,t,r){let a=new Set(t.filter(e=>p.has(e.status)||null!==e.closedAt&&r.getTime()-e.closedAt.getTime()<72e5).map(c)),n=new Set;return e.filter(e=>{let t=c(e);return!(a.has(t)||n.has(t))&&(n.add(t),!0)})},"t",0,function(e,t,i){return(function(e,t,r){let a=[],n=r.getTime();if(null!==e.liveAt&&n-e.liveAt.getTime()<72e5&&e.liveAt.getTime()<=n&&e.errorsSinceLive>=Math.max(10,Math.ceil(5*e.baselineErrors/24))&&e.currentId&&e.previousId&&s.test(e.previousId)&&e.previousId!==e.currentId){let r=`${e.errorsSinceLive} errors since the deploy went live ${Math.max(1,Math.round((n-e.liveAt.getTime())/6e4))} min ago (${e.baselineErrors} in the 24 h before)`;a.push({ruleKey:"LogErrorSpike",room:"workloads",action:"vercel_rollback",resourceKind:"app",resourceId:e.appId,targetRef:e.previousId,reason:d(r,e.topSinceLive,t)})}let i=null!==e.lastDeployAt&&n-e.lastDeployAt.getTime()<72e5;if(e.errors30>=20&&!i&&e.httpMonitorId&&a.push({ruleKey:"LogErrors",room:"workloads",action:"recheck",resourceKind:"app",resourceId:e.appId,targetRef:e.httpMonitorId,reason:d(`${e.errors30} errors in the last 30 min`,e.top30,t)}),e.dbErrors30>=3&&e.db){let r=d(`${e.dbErrors30} database connection errors in the last 30 min`,e.topDb,t),n=e.db;("neon_project"===n.kind||"neon_branch"===n.kind)&&n.wakeEndpoint&&l.test(n.wakeEndpoint)?a.push({ruleKey:"LogDbErrors",room:"databases",action:"neon_wake",resourceKind:n.kind,resourceId:n.resourceId,targetRef:n.wakeEndpoint,reason:r}):"supabase_project"===n.kind&&n.supabasePaused&&n.supabaseRef&&u.test(n.supabaseRef)&&a.push({ruleKey:"LogDbErrors",room:"databases",action:"supabase_restore",resourceKind:n.kind,resourceId:n.resourceId,targetRef:n.supabaseRef,reason:r})}return a})(e,t,i).map(o=>{let s="app"===o.resourceKind?(0,r.J)("app",e.appId,e.appName,t):(0,r.J)(o.resourceKind,o.resourceId,null,t);return{alertId:null,ruleKey:o.ruleKey,room:o.room,action:o.action,risk:n.H[o.action].risk,title:(0,r.M)(o.action,s),reason:o.reason,resourceKind:o.resourceKind,resourceId:o.resourceId,resourceName:s,targetRef:o.targetRef,proposedBy:(0,a.y)(o.room),expiresAt:new Date(i.getTime()+n.V)}})},"D",0,function(e,t){let r=e.getTime();return(null===t||!(r-t<27e4))&&(Math.floor(r/6e4)%5==0||null!==t&&r-t>=6e5)},"W",0,function(e,t){let r=new Set(t.map(c));return e.filter(e=>{let t;return"pending"===e.status&&(t=e.ruleKey,i.includes(t))&&!r.has(c(e))}).map(e=>e.id)}],549419);let f=new Set(["MonitorDown","LogErrorSpike"]);e.s(["r",0,72e5,"M",0,f,"s",0,function(e,t){let r=e=>({ok:!1,why:e});if(!e.setting.enabled)return r("off");if(!e.ruleKey||!f.has(e.ruleKey))return r("rule");let a=e.deploy;if(!a||!a.liveAt)return r("no live deploy");let n=t.getTime()-a.liveAt.getTime();return n<0||n>6e4*e.setting.windowMin?r("outside the window"):a.previousId&&e.targetRef===a.previousId&&a.previousId!==a.currentId?a.newestProdCreatedAt&&a.currentCreatedAt.getTime()<a.newestProdCreatedAt.getTime()?r("live deploy is a rollback"):e.rolledOrPromotedLately?r("live deploy came from a rollback or promote"):"ready"!==(a.previousState??"").toLowerCase()?r("previous not ready"):!a.previousCreatedAt||t.getTime()-a.previousCreatedAt.getTime()>2592e6?r("previous too old"):e.autoLately?r("auto-rollback within 2 h"):e.sameDeployBefore?r("already rolled back once"):e.inFlight?r("another auto-rollback is running"):{ok:!0}:r("target changed")},"u",0,(e,t,a)=>(0,r.l)(`Automatic: the new deploy ${e} errored in the first ${t} minutes. ${a}`),"E",0,e=>e.currentSha&&/^[0-9a-f]{7,40}$/i.test(e.currentSha)?e.currentSha.slice(0,7):e.currentId.slice(0,16)],143926)},447933,e=>{let t;var r,a=e.i(875225),n=e.i(518899),i=e.i(924924),o=e.i(313931),s=e.i(618916),l=e.i(209576),u=e.i(532148),d=e.i(433609),c=e.i(111970),p=e.i(154491),f=e.i(125160),m=e.i(984125),g=e.i(764766),h=e.i(326003),k=e.i(298397),y=e.i(291029),w=e.i(377489),b=e.i(549419),v=e.i(143926),$=e.i(442565),I=e.i(349129),A=e.i(895625),R=e.i(547499),x=e.i(407602),_=e.i(582931),j=e.i(629955),O=e.i(309055),S=e.i(195191);async function P(e,t=O.q){let r,[n]=await (0,i.f)().select({m:s.monitors,appName:s.resources.name,appMeta:s.resources.meta}).from(s.monitors).innerJoin(s.resources,(0,a.u)(s.resources.id,s.monitors.resourceId)).where((0,a.u)(s.monitors.id,e)).limit(1);if(!n)return{ok:!1,error:"That monitor no longer exists."};if("heartbeat"===n.m.kind)return{ok:!1,error:"That monitor is a heartbeat; it has no address to update."};let o=await (0,i.f)().select({id:s.resources.id,name:s.resources.name,meta:s.resources.meta}).from(s.resources).where((0,a.b)((0,a.u)(s.resources.kind,"app"),(0,a.u)(s.resources.monitored,!0),(0,a.M)(s.resources.goneAt),(0,a.c)(s.resources.id,n.m.resourceId))).limit(500),l=(0,g.u)(n.m.url,{name:n.appName,meta:n.appMeta},o,{lastError:n.m.lastError});if(!l)return{ok:!1,error:"Nothing shows this monitor's domain moved (it is still the app's, or never was), so there is nothing to update."};try{r=(0,g.w)(n.m.url,l.to)}catch{return{ok:!1,error:"The app's domain isn't a valid host name, so the monitor was left as it is."}}let u=await t(e,{url:r,expectedStatus:n.m.expectedStatus,timeoutMs:n.m.timeoutMs,bodyContains:n.m.bodyContains,jsonPath:n.m.jsonPath,jsonEquals:n.m.jsonEquals});return u.ok?{ok:!0,message:`Monitor now checks ${r}.`,audit:{message:`Monitor moved to the app's new domain: ${(0,S.F)(r)}`,detail:`was ${(0,S.F)(n.m.url)}`,resourceId:n.m.resourceId}}:u}var T=e.i(145647),M=e.i(479301);async function D(e){if(!(0,M.f)(e))return null;let[t]=await (0,i.f)().select({id:s.resources.id,kind:s.resources.kind,externalId:s.resources.externalId,parentId:s.resources.parentId}).from(s.resources).where((0,a.b)((0,a.u)(s.resources.id,e),(0,a.y)(s.resources.kind,["neon_project","neon_branch"]),(0,a.M)(s.resources.goneAt))).limit(1);if(!t)return null;let r="neon_branch"===t.kind?t.parentId:t.id;if(!r)return null;let[n]=await (0,i.f)().select({data:s.snapshots.data}).from(s.snapshots).where((0,a.u)(s.snapshots.resourceId,r)).limit(1),o=(0,h.k)(h.s,n?.data);return{projectResourceId:r,branchExternalId:"neon_branch"===t.kind?t.externalId:null,computeSeconds:o.computeSeconds??null,periodEnd:o.periodEnd??null}}var z=e.i(472832),N=e.i(800366),E=e.i(628448),C=e.i(443917);let K=`This project used its ${N.a.cuHours} CU-hours; the compute won't start until the quota resets.`;async function H(e,t,r){var a;if(a=new Date,!((t.computeSeconds??0)<3600*N.a.cuHours)&&(!t.periodEnd||new Date(t.periodEnd).getTime()>a.getTime()))return{done:!1,message:K};let n=e.resource.externalId,i=await (0,C.c)(e.token,n,r);if(!i.ok)return{done:!1,message:"missing"===i.kind?E.G:i.error};if(i.data.id!==r||t.branchExternalId&&i.data.branchId!==t.branchExternalId)return{done:!1,message:E.G};if(i.data.disabled)return{done:!1,message:"Neon has disabled this compute, so it can't be started from here."};if("active"===i.data.state)return{done:!1,message:"Already running."};if("init"===i.data.state||"active"===i.data.pendingState)return{done:!1,message:"Already starting."};let o=await (0,C.d)(e.token,n,r);if(o.ok)return{done:!0,message:`Waking ${r}. Ready in a few seconds.`,audit:{message:`Wake requested \xb7 ${r}`,resourceId:e.resource.id}};let s="scope"===o.kind?(0,E.b)("neon",{project:e.resource.name}):"missing"===o.kind?E.G:o.error;return{done:!1,failed:{ok:!1,kind:o.kind,error:s,...o.status?{status:o.status}:{}},audit:{message:`Wake failed \xb7 ${r}`,resourceId:e.resource.id}}}async function B(e,t){let r=t.resource.name;if(e.ok||r.trim().length<2||!e.error.includes(r))return e;let a=await (0,l.f)().catch(()=>null);return{...e,error:a?(0,k.J)(e.error,a,t.resource.id):e.error.split(r).join("db-?")}}async function L(e,t,r,a=z.W){let n=await (0,z.q)(e.id,"wake",r);if(n)return{ok:!1,error:n};let i=await D(t),o=i?await (0,z.p)(i.projectResourceId,"neon_project"):null;return i&&o?B(await a(await H(o,i,r),e,o.account.id),o):{ok:!1,error:E.G}}var V=e.i(11827),U=e.i(843448),W=e.i(342833);let G=e=>`Supabase is busy with this project (${(0,U.P)(e).label.toLowerCase()}). Try again in a few minutes.`,q=(e,t,r)=>({done:!1,failed:{ok:!1,kind:e.kind,error:"scope"===e.kind?(0,E.b)("supabase",{}):e.error,...e.status?{status:e.status}:{}},audit:{message:t,resourceId:r}});async function F(e,t,r,a,n=z.W){let i,o=await (0,z.q)(t.id,e,r);if(o)return{ok:!1,error:o};let s=await (0,z.p)(r,"supabase_project");if(!s)return{ok:!1,error:"This project isn't watched any more, or its credential can't be read."};if(s.resource.externalId!==a)return{ok:!1,error:E.G};let l=s.resource.externalId,u=s.resource.name,d=await (0,W.e)(s.token,l);if(!d.ok)return n({done:!1,message:"scope"===d.kind||"auth"===d.kind?d.error:`Couldn't read this project's status at Supabase: ${d.error}`},t,s.account.id);let c=d.data.status;if("pause"===e){if("INACTIVE"===c||"PAUSING"===c||"GOING_DOWN"===c)return n({done:!1,message:"Already paused."},t,s.account.id);if(!c.startsWith("ACTIVE_"))return n({done:!1,message:G(c)},t,s.account.id);let e=await (0,W.c)(s.token,l);i=e.ok?{done:!0,message:`Pausing ${u}. It takes about 2 minutes.`,audit:{message:`${V.B}${u}`,resourceId:r}}:"transient"===e.kind&&void 0===e.status?{done:!1,failed:{ok:!1,kind:"transient",error:`${e.error} The pause may still have happened; check the project in a few minutes before restoring it.`},audit:{message:`${V.B}${u}`,resourceId:r}}:q(e,`Pause failed \xb7 ${u}`,r)}else{if(c.startsWith("ACTIVE_")||"RESTORING"===c||"COMING_UP"===c)return n({done:!1,message:"Already active or restoring."},t,s.account.id);if("INACTIVE"!==c)return n({done:!1,message:G(c)},t,s.account.id);let e=await (0,W.W)(s.token);if(!e.ok)return n({done:!1,message:`Couldn't count this account's free slots just now: ${e.error}`},t,s.account.id);let a=await (0,j.m)(s.account.id);if(0>=(0,j.G)(e.data,a,d.data.orgSlug))return n({done:!1,message:"This account already uses both free slots. Pause one of its active projects first; Restore stays blocked until it shows Paused."},t,s.account.id);let o=await (0,W.G)(s.token,l);i=o.ok?{done:!0,message:`Restoring ${u}. It takes about 2 minutes.`,audit:{message:`Restore requested \xb7 ${u}`,resourceId:r}}:q(o,`Restore failed \xb7 ${u}`,r)}return n(i,t,s.account.id)}var J=e.i(177706);function X(e,t,r){if("building"===e.state)return"building";if(null!==t&&e.id===t)return"current";if("error"===e.state)return"failed";if("preview"===e.target)return"ready"===e.state?"preview":"other";if("ready"!==e.state||null===t)return"other";let a=r.find(e=>e.id===t);if(!a)return"other";if(e.createdAt.getTime()>a.createdAt.getTime())return"staged";let n=r.filter(e=>"ready"===e.state&&e.id!==t&&e.createdAt.getTime()<a.createdAt.getTime()).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0];return n?.id===e.id?"previous":"other"}let Z=e=>({done:!1,message:e}),Y=(e,t)=>e?.sha?e.sha.slice(0,7):t;async function Q(e,t,r){let a=await (0,z.q)(e.id,t,r);if(a)return a;let n=await (0,z.p)(r,"app"),i=n?.resource.meta.teamId;if(!n||"string"!=typeof i||!i||!n.resource.externalId)return"This app or its Vercel credential isn't available any more. Reload the page.";let o=n.resource.meta.teamSlug;return{member:e,t:n,appId:r,app:n.resource.name,teamId:i,teamSlug:"string"==typeof o?o:"",projectId:n.resource.externalId}}async function ee(e){let[t,r]=await Promise.all([(0,J.c)(e.t.token,e.teamId,e.projectId),(0,J.r)(e.t.token,e.teamId,e.projectId)]);return t.ok?r.ok?{ok:!0,data:{name:t.data.name,currentId:t.data.currentId??r.data[0]?.id??null,production:r.data}}:r:t}async function et(e,t,r,a,n=z.W){return n(t.ok?{done:!0,message:r.message,audit:{message:r.audit,resourceId:e.appId}}:{done:!1,failed:"scope"===t.kind?{ok:!1,kind:"scope",status:t.status,error:(0,E.b)("vercel",{team:e.teamSlug})}:404===t.status?{ok:!1,kind:"missing",status:404,error:"Vercel can't find that deployment any more. Reload and try again."}:{ok:!1,kind:"auth"===t.kind?"auth":"format"===t.kind?"format":"transient",...t.status?{status:t.status}:{},error:t.error},audit:{message:a,resourceId:e.appId}},e.member,e.t.account.id)}async function er(e,t,r,a=z.W){{let n=await Q(e,"redeploy",t);if("string"==typeof n)return a(Z(n),e,"");let i=await ee(n);if(!i.ok)return a(Z(i.error),e,n.t.account.id);if(i.data.currentId!==r)return a(Z(E.G),e,n.t.account.id);if(i.data.production.some(e=>"staged"===X(e,i.data.currentId,i.data.production)))return a(Z("Rolled back: promote a deployment first. A redeploy would stay staged and not go live."),e,n.t.account.id);let o=await (0,J.N)(n.t.token,n.teamId,n.projectId);if(!o.ok)return a(Z(o.error),e,n.t.account.id);if(o.data)return a(Z(`A production build of ${n.app} is already running.`),e,n.t.account.id);let s=Y(i.data.production.find(e=>e.id===r),r),l=await (0,J.L)(n.t.token,n.teamId,{projectId:n.projectId,name:i.data.name,deploymentId:r});return et(n,l,{message:`Redeploy requested. Vercel is building ${n.app} again.`,audit:`Redeploy requested \xb7 ${n.app} \xb7 ${s}`},`Redeploy failed \xb7 ${n.app} \xb7 ${s}`,a)}}async function ea(e,t,r,a=z.W){{let n=await Q(e,"rollback",t);if("string"==typeof n)return a(Z(n),e,"");let i=await ee(n);if(!i.ok)return a(Z(i.error),e,n.t.account.id);if(i.data.currentId===r)return a(Z("Already live."),e,n.t.account.id);let o=i.data.production.find(e=>e.id===r);if(!o||"previous"!==X(o,i.data.currentId,i.data.production))return a(Z("Hobby can only roll back to the previous production deployment."),e,n.t.account.id);let s=Y(o,r),l=await (0,J.E)(n.t.token,n.teamId,n.projectId,r);return et(n,l,{message:`Rolled back ${n.app} to ${s}. New pushes don't go live until you promote one.`,audit:`Rolled back \xb7 ${n.app} → ${s}`},`Roll back failed \xb7 ${n.app} → ${s}`,a)}}var en=e.i(189104),ei=e.i(593111),eo=e.i(425498),es=e.i(77193),el=e.i(570191),eu=e.i(365156);let ed={checkMonitorNow:O.X,keepAliveNow:j.v,wakeAs:L,supabaseAct:F,redeployAs:er,rollbackAs:ea,finish:z.W,recordAction:x.f,limit:ei.f,bumpPrAs:_.W,autoSecurity:()=>(0,el.X)(),recheckDomain:T._,moveMonitorToDomain:P};async function ec(){let[e]=await (0,i.f)().select({at:s.collectorRuns.startedAt}).from(s.collectorRuns).where(n.B`(${s.collectorRuns.trigger} = 'vercel_cron' or (${s.collectorRuns.trigger} = 'manual' and ${s.collectorRuns.tasks} ? 'rollups'))`).orderBy((0,I.A)(s.collectorRuns.startedAt)).limit(1);return e?.at??null}async function ep(e){let t=await (e.lastDailyRunAt??ec)(),r=(e.now??(()=>new Date))();if(t&&r.getTime()-t.getTime()<216e5)return{ok:!1,error:"The daily job ran less than 6 hours ago."};let a=(e.dailyTarget??function(){let e=(0,A.f)();return e?{url:`${(0,R.f)().SITE_URL.replace(/\/+$/,"")}/api/daily`,secret:e.CRON_SECRET}:null})();if(!a)return{ok:!1,error:"The scheduler settings are missing, so the daily job can't be started."};try{let t=await (e.fetch??fetch)(a.url,{headers:{Authorization:`Bearer ${a.secret}`},signal:AbortSignal.timeout(4e4),redirect:"manual"});if(!t.ok||t.status>=300)return{ok:!1,error:`The daily job route answered ${t.status}.`};return{ok:!0,message:`Daily job ran again (${t.status}).`}}catch(e){if(e instanceof Error&&("TimeoutError"===e.name||"AbortError"===e.name))return{ok:!0,message:"Daily job started; it's still running — the heartbeat turns Up when it finishes."};throw e}}let ef="The proposal's target is missing, so it can't run.";async function em(e,t,r=ed){let a="auto"===t,n=a?{id:w.e,userId:null}:{id:t.id,userId:t.userId},i=(e,t,n)=>r.finish(e,t,n,{refresh:!1,...a?{auditPrefix:w.v}:{}});try{if(!e.resourceId||!e.targetRef)return{ok:!1,error:ef};if((0,es.W)()&&"recheck"!==e.action)return await r.recordAction({kind:"ok",message:`${a?w.v:""}${eu.H[e.action].label} (simulated)`,detail:"Simulated in the demo",resourceId:e.resourceId,actorUserId:n.userId}).catch(()=>console.warn("audit event failed")),{ok:!0,message:eo.r};switch(e.action){case"recheck":{let t=await r.limit(en.t.check,n.id);if(!t.allowed)return{ok:!1,error:`Too many checks. Try again in ${(0,en.H)(t.retryAfter)}.`};let i=await r.checkMonitorNow(e.targetRef);if(!i.ok)return{ok:!1,error:i.error};if(i.audit)try{await r.recordAction({kind:!1===i.passed?"err":"ok",...i.audit,message:`${a?w.v:""}${i.audit.message}`,actorUserId:n.userId})}catch{console.warn("audit event failed")}return{ok:!0,message:i.message}}case"domain_recheck":{let t=await r.limit(en.t.domainCheck,n.id);if(!t.allowed)return{ok:!1,error:`Too many checks. Try again in ${(0,en.H)(t.retryAfter)}.`};let i=await (r.recheckDomain??T._)(e.targetRef);if(!i.ok)return i;return await r.recordAction({kind:"ok",...i.audit,message:`${a?w.v:""}${i.audit.message}`,actorUserId:n.userId}).catch(()=>console.warn("audit event failed")),{ok:!0,message:i.message}}case"monitor_update_url":{let t=await r.limit(en.t.monitorWrite,n.id);if(!t.allowed)return{ok:!1,error:`Too many changes. Try again in ${(0,en.H)(t.retryAfter)}.`};let i=await (r.moveMonitorToDomain??P)(e.targetRef);if(!i.ok)return i;return i.audit&&await r.recordAction({kind:"ok",...i.audit,message:`${a?w.v:""}${i.audit.message}`,actorUserId:n.userId}).catch(()=>console.warn("audit event failed")),{ok:!0,message:i.message}}case"daily_rerun":return await ep(r);case"neon_wake":return await r.wakeAs(n,e.resourceId,e.targetRef,i);case"supabase_keepalive":return await r.keepAliveNow(n,e.resourceId,i);case"supabase_restore":return await r.supabaseAct("restore",n,e.resourceId,e.targetRef,i);case"vercel_redeploy":return await r.redeployAs(n,e.resourceId,e.targetRef,i);case"vercel_rollback":return await r.rollbackAs(n,e.resourceId,e.targetRef,i);case"github_bump_pr":{let t=a?await (r.autoSecurity??el.X)():null;if(a&&!t?.enabled)return{ok:!1,error:"Automatic security fixes is off."};return await (r.bumpPrAs??_.W)(n,e.resourceId,e.targetRef,i,{proposalId:e.proposalId??null,...t?{auto:{severities:t.severities}}:{},..."FrameworkVulnerable"===e.ruleKey?{framework:!0}:{}})}default:return{ok:!1,error:ef}}}catch(e){return console.warn(`${o.X.logTag}/proposals run failed:`,e instanceof Error?e.name:"error"),{ok:!1,error:"Something went wrong while running it. Check the console page before trying again."}}}let eg={id:y.O.id,room:y.O.room,action:y.O.action,risk:y.O.risk,title:y.O.title,reason:y.O.reason,resourceName:y.O.resourceName,proposedBy:y.O.proposedBy,status:y.O.status,auto:y.O.auto,result:y.O.result,createdAt:y.O.createdAt,decidedAt:y.O.decidedAt,expiresAt:y.O.expiresAt},eh={...eg,resourceId:y.O.resourceId,targetRef:y.O.targetRef,ruleKey:y.O.ruleKey};async function ek(e,t,r){let o=(0,w.z)(e,t),[l,u,c,p,f,m,h]=await Promise.all([o.monitorIds.length?(0,i.f)().select({id:s.monitors.id,kind:s.monitors.kind,url:s.monitors.url,lastError:s.monitors.lastError,appId:s.monitors.resourceId,appName:s.resources.name,appMeta:s.resources.meta}).from(s.monitors).innerJoin(s.resources,(0,a.u)(s.resources.id,s.monitors.resourceId)).where((0,a.y)(s.monitors.id,o.monitorIds)):[],o.deployApps.length?(0,i.f)().select({app:s.deployments.resourceId,id:s.deployments.externalId,isCurrent:s.deployments.isCurrent,isPrevious:s.deployments.isPreviousProduction,readyAt:s.deployments.readyAt,createdAt:s.deployments.createdAtProvider}).from(s.deployments).where((0,a.b)((0,a.y)(s.deployments.resourceId,o.deployApps),(0,a.F)((0,a.u)(s.deployments.isCurrent,!0),(0,a.u)(s.deployments.isPreviousProduction,!0)))):[],o.supabaseIds.length?(0,i.f)().select({id:s.resources.id,ref:s.resources.externalId}).from(s.resources).where((0,a.b)((0,a.y)(s.resources.id,o.supabaseIds),(0,a.u)(s.resources.kind,"supabase_project"),n.B`${s.resources.goneAt} is null`)):[],o.monitorApps.length?eb(o.monitorApps):new Map,o.depApps.length?ey(e,o.depApps).catch(()=>new Set).then(e=>(0,d.C)(o.depApps,e)).catch(()=>new Map):new Map,o.monitorIds.length?ew(o.monitorIds):null,o.frameworkApps.length?(0,_.h)(o.frameworkApps,o.depApps).catch(()=>new Map):new Map]),k=l.some(e=>null!==(0,g.Y)(e.appMeta)),y=k?await (0,i.f)().select({id:s.resources.id,name:s.resources.name,meta:s.resources.meta}).from(s.resources).where((0,a.b)((0,a.u)(s.resources.kind,"app"),(0,a.u)(s.resources.monitored,!0),(0,a.M)(s.resources.goneAt))).limit(500):[],b=k?(0,g.P)(l,y):new Map,v=new Map;for(let e of u){let t=v.get(e.app)??{currentId:null,previousId:null,liveAt:null};e.isCurrent?(t.currentId=e.id,t.liveAt=e.readyAt??e.createdAt??null):e.isPrevious&&(t.previousId=e.id),v.set(e.app,t)}return{monitorKinds:new Map(l.map(e=>[e.id,String(e.kind)])),deploys:v,...void 0!==r?{rollbackWindowMs:r}:{},supabaseRefs:new Map(c.map(e=>[e.id,e.ref])),neonSuspended:p,fixableRepos:f,dailyHeartbeatId:m,frameworkFixes:h,monitorMoves:b}}async function ey(e,t){let r=new Set(t),n=e.filter(e=>"FrameworkVulnerable"===e.ruleKey&&"app"===e.resourceKind&&e.resourceId&&r.has(e.resourceId)).map(e=>e.id);return n.length?new Set((await (0,i.f)().selectDistinct({resourceId:y.O.resourceId}).from(y.O).where((0,a.b)((0,a.u)(y.O.ruleKey,"FrameworkVulnerable"),(0,a.u)(y.O.action,"github_bump_pr"),(0,a.y)(y.O.status,["pending","approved","running","done"]),(0,a.y)(y.O.alertId,n),(0,a.y)(y.O.resourceId,[...r]))).limit(n.length)).flatMap(e=>e.resourceId?[e.resourceId]:[])):new Set}async function ew(e){let t=(0,f.i)(process.env.DAILY_HEARTBEAT_TOKEN);if(!t)return null;let[r]=await (0,i.f)().select({id:s.monitors.id}).from(s.monitors).where((0,a.b)((0,a.y)(s.monitors.id,e),(0,a.u)(s.monitors.kind,"heartbeat"),(0,a.u)(s.monitors.tokenHash,(0,m.f)(t)))).limit(1).catch(()=>[]);return r?.id??null}async function eb(e){let t=await (0,i.f)().select({app:s.links.fromResourceId,id:s.resources.id,kind:s.resources.kind,externalId:s.resources.externalId,parentId:s.resources.parentId}).from(s.links).innerJoin(s.resources,(0,a.u)(s.resources.id,s.links.toResourceId)).where((0,a.b)((0,a.y)(s.links.fromResourceId,e),(0,a.u)(s.links.kind,"uses_db"),(0,a.y)(s.resources.kind,["neon_project","neon_branch"]),n.B`${s.resources.goneAt} is null`)),r=new Map;if(!t.length)return r;let o=e=>"neon_branch"===e.kind?e.parentId:e.id,l=[...new Set(t.map(o).filter(e=>!!e))];if(!l.length)return r;let u=new Map((await (0,i.f)().select({id:s.snapshots.resourceId,data:s.snapshots.data}).from(s.snapshots).where((0,a.y)(s.snapshots.resourceId,l))).map(e=>[e.id,(0,h.k)(h.s,e.data)]));for(let e of t){let t=o(e),a=t?u.get(t):void 0,n=a?(0,w.Z)(a.endpoints,a.branches,"neon_branch"===e.kind?e.externalId:null):null;n&&r.set(e.app,{resourceId:e.id,resourceKind:e.kind,endpointId:n})}return r}async function ev(e){if(!e.length)return[];let t=new Set((await (0,i.f)().select({alertId:y.O.alertId,action:y.O.action}).from(y.O).where((0,a.y)(y.O.alertId,[...new Set(e.map(e=>e.alertId))]))).map(e=>`${e.alertId}:${e.action}`)),r=e.filter(e=>!t.has(`${e.alertId}:${e.action}`));return r.length?(0,i.f)().insert(y.O).values(r.map(e=>({...e,status:"pending"}))).onConflictDoNothing().returning(eh):[]}async function e$(e,t,r,o){let[s]=await (0,i.f)().update(y.O).set({status:"approve"===t?"approved":"rejected",decidedBy:r,decidedAt:o}).where((0,a.b)((0,a.u)(y.O.id,e),(0,a.u)(y.O.status,"pending"),n.B`${y.O.expiresAt} > ${o.toISOString()}::timestamptz`)).returning(eh);if(s)return{status:"ok",proposal:(0,w.E)(s),row:s};let[l]=await (0,i.f)().select(eg).from(y.O).where((0,a.u)(y.O.id,e)).limit(1);return l?{status:"conflict",proposal:(0,w.E)(l)}:{status:"missing"}}async function eI(e,t){let[r]=await (0,i.f)().update(y.O).set({status:"running",claimedAt:t}).where((0,a.b)((0,a.u)(y.O.id,e),(0,a.u)(y.O.status,"approved"))).returning(eh);return r??null}async function eA(e,t,r,n){let[o]=await (0,i.f)().update(y.O).set({status:t?"done":"failed",result:r,finishedAt:n}).where((0,a.b)((0,a.u)(y.O.id,e),(0,a.u)(y.O.status,"running"))).returning(eh);return o??null}let eR={run:(e,t)=>em(e,t),book:()=>(0,l.f)()};async function ex(e,t,r,a=eR){let n=await eI(e,r);if(!n)return null;let i=await a.run({action:n.action,resourceId:n.resourceId,targetRef:n.targetRef,proposalId:n.id,ruleKey:n.ruleKey??null},t),o=await a.book().catch(()=>k.a),s=await eA(e,i.ok,(0,w.x)(i,o),new Date);return s?(0,w.E)(s):null}async function e_(e,t){let r=await (0,i.f)().update(y.O).set({status:"expired",result:"Expired: nobody decided in time, or the alert stopped firing."}).where((0,a.b)((0,a.u)(y.O.status,"pending"),(0,a.F)((0,a.S)(y.O.expiresAt,new Date(t.getTime()+1)),(0,a.b)((0,a.E)(y.O.alertId),e.length?(0,a.$)(y.O.alertId,e):n.B`true`)))).returning({id:y.O.id});return await (0,i.f)().update(y.O).set({status:"failed",result:"The run was interrupted. Check the console page before trying again.",finishedAt:t}).where((0,a.b)((0,a.u)(y.O.status,"running"),(0,a.S)(y.O.claimedAt,new Date(t.getTime()-w.L)))),r.length}async function ej(e){await (0,i.f)().delete(y.O).where((0,a.b)((0,a.S)(y.O.createdAt,new Date(e.getTime()-2592e6)),(0,a.$)(y.O.status,["pending","approved","running"])))}let eO=n.B`(${s.storedLogs.level} in ('error', 'fatal') or coalesce(${s.storedLogs.statusCode}, 0) >= 500)`,eS=n.B`coalesce(${s.deployments.readyAt}, ${s.deployments.createdAtProvider})`;async function eP(e){let t=await (0,i.f)().select({app:s.links.fromResourceId,id:s.resources.id,kind:s.resources.kind,externalId:s.resources.externalId,parentId:s.resources.parentId}).from(s.links).innerJoin(s.resources,(0,a.u)(s.resources.id,s.links.toResourceId)).where((0,a.b)((0,a.y)(s.links.fromResourceId,e),(0,a.u)(s.links.kind,"uses_db"),(0,a.y)(s.resources.kind,["neon_project","neon_branch","supabase_project"]),(0,a.M)(s.resources.goneAt))),r=new Map;if(!t.length)return r;let n=e=>"neon_branch"===e.kind?e.parentId:e.id,o=[...new Set(t.map(n).filter(e=>!!e))],l=new Map((o.length?await (0,i.f)().select({id:s.snapshots.resourceId,data:s.snapshots.data}).from(s.snapshots).where((0,a.y)(s.snapshots.resourceId,o)):[]).map(e=>[e.id,e.data]));for(let e of t){let t=l.get(n(e)??"");if("supabase_project"===e.kind){let a=(0,h.k)(h.B,t);r.set(e.app,{resourceId:e.id,kind:e.kind,wakeEndpoint:null,supabaseRef:e.externalId,supabasePaused:"INACTIVE"===a.status})}else{let a=(0,h.k)(h.s,t);r.set(e.app,{resourceId:e.id,kind:e.kind,wakeEndpoint:(0,w.Z)(a.endpoints,a.branches,"neon_branch"===e.kind?e.externalId:null),supabaseRef:null,supabasePaused:!1})}}return r}let eT={apps:async function(e){let t=new Date(e.getTime()-b.I-b.s),r=n.B`${s.storedLogs.at} >= ${new Date(e.getTime()-b.H).toISOString()}::timestamptz`,o=n.B`${s.storedLogs.message} ~* ${b.N}`,l=n.B`left(${s.storedLogs.message}, 200)`,u=(await (0,i.f)().select({appId:s.storedLogs.resourceId,appName:n.B`max(${s.resources.name})`,liveAt:n.B`max(${eS})`.mapWith(s.deployments.readyAt),currentId:n.B`max(${s.deployments.externalId})`,errorsSinceLive:n.B`count(*) filter (where ${eO} and ${s.storedLogs.at} >= ${eS})`.mapWith(Number),baselineErrors:n.B`count(*) filter (where ${eO} and ${s.storedLogs.at} >= ${eS} - interval '24 hours' and ${s.storedLogs.at} < ${eS})`.mapWith(Number),topSinceLive:n.B`mode() within group (order by ${l}) filter (where ${eO} and ${s.storedLogs.at} >= ${eS})`,errors30:n.B`count(*) filter (where ${eO} and ${r})`.mapWith(Number),top30:n.B`mode() within group (order by ${l}) filter (where ${eO} and ${r})`,dbErrors30:n.B`count(*) filter (where ${r} and ${o})`.mapWith(Number),topDb:n.B`mode() within group (order by ${l}) filter (where ${r} and ${o})`}).from(s.storedLogs).innerJoin(s.resources,(0,a.u)(s.resources.id,s.storedLogs.resourceId)).leftJoin(s.deployments,(0,a.b)((0,a.u)(s.deployments.resourceId,s.storedLogs.resourceId),(0,a.u)(s.deployments.isCurrent,!0))).where((0,a.b)((0,a.B)(s.storedLogs.at,t),(0,a.u)(s.resources.kind,"app"),(0,a.M)(s.resources.goneAt))).groupBy(s.storedLogs.resourceId)).filter(e=>e.errorsSinceLive>=b.w||e.errors30>=b.G||e.dbErrors30>=b.V);if(!u.length)return[];let d=u.map(e=>e.appId),[c,p,f]=await Promise.all([(0,i.f)().select({app:s.deployments.resourceId,previousId:n.B`max(${s.deployments.externalId}) filter (where ${s.deployments.isPreviousProduction})`,lastDeployAt:n.B`max(${s.deployments.createdAtProvider}) filter (where ${s.deployments.target} = 'production')`.mapWith(s.deployments.createdAtProvider)}).from(s.deployments).where((0,a.b)((0,a.y)(s.deployments.resourceId,d),(0,a.F)((0,a.u)(s.deployments.isPreviousProduction,!0),(0,a.B)(s.deployments.createdAtProvider,new Date(e.getTime()-b.v))))).groupBy(s.deployments.resourceId),(0,i.f)().select({app:s.monitors.resourceId,id:s.monitors.id}).from(s.monitors).where((0,a.b)((0,a.y)(s.monitors.resourceId,d),(0,a.u)(s.monitors.kind,"http"),(0,a.u)(s.monitors.paused,!1),(0,a.u)(s.monitors.ownerPaused,!1))).orderBy(s.monitors.createdAt),eP(d)]),m=new Map(c.map(e=>[e.app,e])),g=new Map;for(let e of p)g.has(e.app)||g.set(e.app,e.id);return u.map(e=>({...e,appName:e.appName??"",previousId:m.get(e.appId)?.previousId??null,lastDeployAt:m.get(e.appId)?.lastDeployAt??null,httpMonitorId:g.get(e.appId)??null,db:f.get(e.appId)??null}))},rows:async function(e){let t=n.B`coalesce(${y.O.finishedAt}, ${y.O.decidedAt}, ${y.O.expiresAt})`;return(0,i.f)().select({id:y.O.id,ruleKey:y.O.ruleKey,resourceId:y.O.resourceId,action:y.O.action,status:y.O.status,closedAt:t.mapWith(y.O.finishedAt)}).from(y.O).where((0,a.b)((0,a.M)(y.O.alertId),(0,a.y)(y.O.ruleKey,[...b.T]),(0,a.F)((0,a.y)(y.O.status,["pending","approved","running"]),n.B`${t} > ${new Date(e.getTime()-b.b).toISOString()}::timestamptz`)))}};async function eM(e,t,r=eT){let[n,o]=await Promise.all([r.apps(e),r.rows(e)]),s=n.flatMap(r=>(0,b.t)(r,t,e)),l=(0,b.W)(o,s),u=0;l.length&&(u=(await (0,i.f)().update(y.O).set({status:"expired",result:"Expired: the logs no longer show it.",finishedAt:e}).where((0,a.b)((0,a.y)(y.O.id,l),(0,a.u)(y.O.status,"pending"))).returning({id:y.O.id})).length);let d=(0,b.x)(s,o,e);return d.length?{created:await (0,i.f)().insert(y.O).values(d.map(e=>({...e,status:"pending"}))).onConflictDoNothing().returning(eh),expired:u}:{created:[],expired:u}}let eD=null;async function ez(e,t){return(0,b.D)(e,eD)?(eD=e.getTime(),eM(e,await t())):{created:[],expired:0}}async function eN(e,t){return(await (0,i.f)().update(y.O).set({status:"approved",auto:!0,decidedAt:t}).where((0,a.b)((0,a.u)(y.O.id,e),(0,a.u)(y.O.status,"pending"),(0,a.u)(y.O.risk,"safe"))).returning({id:y.O.id})).length>0}async function eE(e,t){let r=new Date(t.getTime()-v.r),[o,l,u,d]=await Promise.all([(0,i.f)().select({app:s.deployments.resourceId,id:s.deployments.externalId,sha:s.deployments.commitSha,state:s.deployments.state,isCurrent:s.deployments.isCurrent,isPrevious:s.deployments.isPreviousProduction,readyAt:s.deployments.readyAt,createdAt:s.deployments.createdAtProvider}).from(s.deployments).where((0,a.b)((0,a.y)(s.deployments.resourceId,e),(0,a.F)((0,a.u)(s.deployments.isCurrent,!0),(0,a.u)(s.deployments.isPreviousProduction,!0)))),(0,i.f)().select({app:s.deployments.resourceId,at:n.B`max(${s.deployments.createdAtProvider})`.mapWith(s.deployments.createdAtProvider)}).from(s.deployments).where((0,a.b)((0,a.y)(s.deployments.resourceId,e),(0,a.u)(s.deployments.target,"production"),(0,a.u)(s.deployments.state,"ready"))).groupBy(s.deployments.resourceId),(0,i.f)().select({app:s.events.resourceId}).from(s.events).where((0,a.b)((0,a.u)(s.events.type,"action"),(0,a.y)(s.events.resourceId,e),(0,a.B)(s.events.at,r),n.B`${s.events.message} ~ ${eC}`)),(0,i.f)().select({app:y.O.resourceId,targetRef:y.O.targetRef,status:y.O.status,decidedAt:y.O.decidedAt}).from(y.O).where((0,a.b)((0,a.u)(y.O.action,"vercel_rollback"),(0,a.u)(y.O.auto,!0),(0,a.B)(y.O.createdAt,new Date(t.getTime()-26784e5))))]),c=new Map;for(let t of e){let e=o.find(e=>e.app===t&&e.isCurrent),a=o.find(e=>e.app===t&&e.isPrevious&&!e.isCurrent),n=d.filter(e=>e.app===t);c.set(t,{deploy:e?{currentId:e.id,currentSha:e.sha,liveAt:e.readyAt??e.createdAt,currentCreatedAt:e.createdAt,newestProdCreatedAt:l.find(e=>e.app===t)?.at??null,previousId:a?.id??null,previousState:a?.state??null,previousCreatedAt:a?.createdAt??null}:null,rolledOrPromotedLately:u.some(e=>e.app===t),autoLately:n.some(e=>null!==e.decidedAt&&e.decidedAt.getTime()>=r.getTime()),sameDeployBefore:!!a&&n.some(e=>e.targetRef===a.id)})}return{apps:c,inFlight:d.some(e=>"approved"===e.status||"running"===e.status)}}let eC="(Rolled back|Promoted|Preview promoted) ·";async function eK(e,t,r){return(await (0,i.f)().update(y.O).set({status:"approved",auto:!0,decidedAt:r,reason:t}).where((0,a.b)((0,a.u)(y.O.id,e),(0,a.u)(y.O.status,"pending"),(0,a.u)(y.O.action,"vercel_rollback"),n.B`not exists (select 1 from ops.action_proposals x where x.action = 'vercel_rollback' and x.auto and x.status in ('approved', 'running'))`)).returning({id:y.O.id})).length>0}async function eH(e,t,r,a){let n=e.filter(e=>"vercel_rollback"===e.action&&e.ruleKey&&v.M.has(e.ruleKey)&&e.resourceId);if(!n.length||!a.autoRollback||!a.rollbackContext||!a.approveAutoRollback)return[];let i=await a.autoRollback().catch(()=>null);if(!i?.enabled||15e3>r())return[];let s=[];try{let e=await a.rollbackContext([...new Set(n.map(e=>e.resourceId))],t),l=e.inFlight;for(let u of n){let n=e.apps.get(u.resourceId);if(!n||12e3>r())continue;let d=(0,v.s)({setting:i,ruleKey:u.ruleKey??null,targetRef:u.targetRef,inFlight:l,...n},t);if(!d.ok){console.log(`${o.X.logTag}/auto-rollback: skipped (${d.why})`);continue}let c=(0,v.E)(n.deploy);if(!await a.approveAutoRollback(u.id,(0,v.u)(c,i.windowMin,u.reason),new Date))continue;l=!0;let p=await a.execute(u.id,new Date);if(p){s.push(p),await (a.notifyRollback??$.q)(p,{reason:u.reason,newRef:c}).catch(()=>void 0);break}}}catch(e){console.warn(`${o.X.logTag}/auto-rollback failed:`,e instanceof Error?e.name:"error")}return s}async function eB(e,t){return(await (0,i.f)().update(y.O).set({status:"approved",auto:!0,decidedAt:t}).where((0,a.b)((0,a.u)(y.O.id,e),(0,a.u)(y.O.status,"pending"),(0,a.u)(y.O.action,"github_bump_pr"))).returning({id:y.O.id})).length>0}async function eL(e,t,r){let a=e.filter(e=>"github_bump_pr"===e.action&&e.targetRef);if(!a.length||!r.autoSecurity||!r.bumpReady||!r.approveAutoBump)return[];let n=await r.autoSecurity().catch(()=>null);if(!n?.enabled||!n.severities.length)return[];let i=[];for(let e of a){if(15e3>t())break;try{let t="FrameworkVulnerable"===e.ruleKey&&e.resourceId?await r.bumpReady(e.targetRef,n.severities,{appId:e.resourceId}):await r.bumpReady(e.targetRef,n.severities);if(!t.ok){console.log(`${o.X.logTag}/auto-security: waits for the owner (${t.why})`);continue}if(!await r.approveAutoBump(e.id,new Date))continue;let a=await r.execute(e.id,new Date);a&&i.push(a)}catch(e){console.warn(`${o.X.logTag}/auto-security failed:`,e instanceof Error?e.name:"error")}}return i}async function eV(e){return new Map((await (0,i.f)().select({id:s.accounts.id,provider:s.accounts.provider}).from(s.accounts).where((0,a.y)(s.accounts.id,e))).map(e=>[e.id,e.provider]))}let eU={firing:()=>(0,u.q)(),book:()=>(0,l.f)(),facts:ek,create:ev,expire:e_,autoRun:el.I,approveAuto:eN,execute:(e,t)=>ex(e,"auto",t),notifyNew:$.i,notifyResult:$.b,logs:ez,autoRollback:()=>(0,el.K)(),rollbackContext:eE,approveAutoRollback:eK,notifyRollback:$.q,autoSecurity:()=>(0,el.X)(),bumpReady:_.J,approveAutoBump:eB,paused:c.I,providers:eV};async function eW(e,t={},r=eU){let a={created:0,expired:0,autoRan:0},n=()=>(t.deadline??1/0)-Date.now(),i=await r.firing();a.expired=await r.expire(i.map(e=>e.id),e);let s=r.paused?await r.paused().catch(()=>new Set):new Set,l=[...new Set(i.flatMap(e=>e.accountId?[e.accountId]:[]))],u=s.size&&l.length&&r.providers?await r.providers(l).catch(()=>new Map):new Map,d=i.filter(e=>!(0,p.O)(s,e.ruleKey,e.accountId?u.get(e.accountId):null)),c=null,f=()=>c??=r.book().catch(()=>k.a),m=[],g=(0,w.z)(d,e);if(Object.values(g).some(e=>e.length>0)){let t=g.deployApps.length&&r.autoRollback?await r.autoRollback().catch(()=>null):null,a=await r.facts(d,e,t?6e4*t.windowMin:void 0),n=await f(),i=d.flatMap(t=>(0,w.t)(t,a,n,e)).filter(e=>!("github_bump_pr"===e.action&&s.has("devops")));m.push(...await r.create(i))}if(n()>1e4&&!s.has("hosting"))try{let t=await r.logs(e,f);m.push(...t.created),a.expired+=t.expired}catch(e){console.warn(`${o.X.logTag}/proposals logs failed:`,e instanceof Error?e.name:"error")}if(a.created=m.length,!m.length)return a;let h=await r.autoRun().catch(()=>null),y=await eH(m,e,n,r);a.autoRan+=y.length;let b=await eL(m.filter(e=>!y.some(t=>t.id===e.id)),n,r),v=new Set(y.map(e=>e.id)),$=[...b];for(let e of(a.autoRan+=b.length,b))v.add(e.id);for(let e of m){if(v.has(e.id)||!h||!(0,w.I)(e.action,h)||8e3>n()||!await r.approveAuto(e.id,new Date))continue;let t=await r.execute(e.id,new Date);t&&($.push(t),a.autoRan++)}let I=new Set([...$.map(e=>e.id),...v]),A=m.filter(e=>"LogErrorSpike"===e.ruleKey&&e.resourceId).map(e=>({proposalId:e.id,appId:e.resourceId})),R=A.length&&r.queueDev?await r.queueDev(A,e).catch(()=>new Set):new Set;for(let e of(await r.notifyNew(m.filter(e=>!I.has(e.id)).map(w.E),{},{devQueued:R}).catch(()=>void 0),$))await r.notifyResult(e).catch(()=>void 0);return a}let eG=(r={},t={...eU,queueDev:r.queueDev},async(e,r)=>{try{let a=await eW(e,r??{},t);(a.created||a.expired||a.autoRan)&&console.log(`${o.X.logTag}/proposals: ${a.created} new, ${a.expired} expired, ${a.autoRan} auto-ran`)}catch(e){console.warn(`${o.X.logTag}/proposals failed:`,e instanceof Error?e.name:"error")}});e.s(["V",0,e$,"N",0,ex,"Z",0,eG,"t",0,ej],447933)},442565,e=>{var t=e.i(313931),r=e.i(872281),a=e.i(483100),n=e.i(224382),i=e.i(220642),o=e.i(547499),s=e.i(695811),l=e.i(76012),u=e.i(298397),d=e.i(635982),c=e.i(570191),p=e.i(365156);let f={target:a.Q,book:()=>(0,r.f)(),siteUrl:()=>(0,o.f)().SITE_URL,autoRun:()=>(0,c.I)(),send:(e,t,r,a)=>(0,l.I)(e,t,r,a?{replyMarkup:a}:{}),record:(e,t)=>(0,a.P)("telegram",e,t),lang:()=>(0,s.H)("telegram"),discord:()=>(0,a.G)(),sendDiscord:(e,t)=>(0,n.f)(e,t,{timeoutMs:v}),recordDiscord:(e,t)=>(0,a.P)("discord",e,t),discordLang:()=>(0,s.H)("discord"),buttons:()=>e.A(106025).then(e=>e.approvalButtons())},m={en:{pending:"Status: ⏳ waiting",dev:"🧑‍💻 Dev is checking the code",proposer:t.X.notifyFallback.en,app:"app",safe:"safe",risky:"needs care",proposes:"proposes",why:"Why",risk:"Risk",open:"Open in Auto-actions",waitingN:"new proposals waiting for approval:",moreN:"more proposals",automatic:"Automatic",rollbackWhy:"the app errored after the new deploy",succeeded:"Succeeded",failed:"Failed",stopFallback:"something failed"},id:{pending:"Status: ⏳ menunggu",dev:"🧑‍💻 Dev lagi cek kodenya",proposer:t.X.notifyFallback.id,app:"aplikasi",safe:"aman",risky:"perlu hati-hati",proposes:"usul",why:"Kenapa",risk:"Risiko",open:"Buka di Auto-actions",waitingN:"usulan baru menunggu persetujuan:",moreN:"usulan lagi",automatic:"Otomatis",rollbackWhy:"app-nya error setelah deploy baru",succeeded:"Berhasil",failed:"Gagal",stopFallback:"ada yang gagal"}},g={recheck:"Cek ulang sekarang",neon_wake:"Bangunin Neon",supabase_keepalive:"Kirim keep-alive Supabase",supabase_restore:"Restore project Supabase",vercel_redeploy:"Redeploy production",vercel_rollback:"Rollback ke deploy sebelumnya",github_bump_pr:"Bikin PR update paket",domain_recheck:"Cek ulang sertifikat domain",daily_rerun:"Jalanin ulang daily job",monitor_update_url:"Arahin monitor ke domain baru"},h=(e="en")=>(0,s.t)(m,e,"dev"),k=(e,t)=>("id"===t?g[e.action]:void 0)??p.H[e.action]?.label??e.actionLabel,y=(e,t)=>(0,s.t)(m,t,"risky"===e.risk||p.H[e.action]?.risk==="risky"?"risky":"safe"),w=(e,t)=>`${e.replace(/\/+$/,"")}/auto-actions${t?`?proposal=${encodeURIComponent(t)}`:""}`;function b(e,t,r,a=!1,n="en"){let o=e=>(0,s.t)(m,n,e),l=(0,d.f)(e.proposedBy,t,60)||o("proposer"),u=(0,d.f)(e.title,t,120),c=(0,d.f)(e.reason,t,200)||"-";return[`🧑‍✈️ ${(0,i.H)(l)} ${o("proposes")}: ${(0,i.H)(k(e,n))} — ${(0,i.H)(u)}`,`${o("why")}: ${(0,i.H)(c)}`,`${o("risk")}: ${y(e,n)}`,...a?[h(n)]:[],`${o("open")}: ${(0,i.H)(w(r,e.id))}`].join("\n")}let v=3e3,$={en:{proposed:"📝 Proposed",approved:"✅ Approved by the owner",rejected:"🚫 Rejected by the owner",done:"⚙️ Ran",failed:"❌ Failed",waiting:"waiting for approval on Telegram.",newN:"new proposals"},id:{proposed:"📝 Usulan",approved:"✅ Disetujui owner",rejected:"🚫 Ditolak owner",done:"⚙️ Dijalankan",failed:"❌ Gagal",waiting:"nunggu persetujuan di Telegram.",newN:"usulan baru"}};function I(e,t,r,a="en"){let n=e=>(0,s.t)($,a,e);if(Array.isArray(t))return`📝 ${t.length} ${n("newN")} — ${n("waiting")}`;let i=((0,d.f)(t.title,r,120)||k(t,a)).replace(/[*_`~|\[\]<>]/g,"");if("proposed"===e)return`${n("proposed")}: ${i} — ${n("waiting")}`;if("approved"===e||"rejected"===e)return`${n(e)}: ${i}`;let o=t.result?(0,d.f)(t.result,r,200).replace(/[*_`~|\[\]<>]/g,""):"";return`${n(e)}: ${i}${o?` — ${o}`:""}`}async function A(e,r,a){try{let n,i=await r.discord();if(!i)return;let o=await r.book().catch(()=>u.a),s=await r.discordLang().catch(()=>"en"),l=e(o,s);if(!l.length)return;try{n=await r.sendDiscord(i.url,l.join("\n"))}catch{n={ok:!1,kind:"transient",error:"Discord didn't answer."}}await r.recordDiscord(n,a).catch(()=>console.warn(`${t.X.logTag}/discord: recording the result failed`))}catch{console.warn(`${t.X.logTag}/discord: sending the action history failed`)}}async function R(e,t,r={},a={}){let n={...f,...r};await _(()=>A((r,a)=>[I(e,t,r,a)],n,a.now??new Date),a.timeoutMs??v)}async function x(e,r,a){let n=await r.target();if(!n)return;let i=await r.book().catch(()=>u.a),o=await r.lang().catch(()=>"en");for(let s of(await e(i,o))){let e;try{e="string"==typeof s?await r.send(n.token,n.chatId,s):await r.send(n.token,n.chatId,s.text,s.keyboard)}catch{e={ok:!1,kind:"transient",error:"Telegram didn't answer."}}await r.record(e,a).catch(()=>console.warn(`${t.X.logTag}/telegram: recording the result failed`))}}async function _(e,r){try{var a;let t;await (a=e(),Promise.race([a,new Promise((e,a)=>{t=setTimeout(()=>a(Object.assign(Error("timeout"),{name:"TimeoutError"})),r)})]).finally(()=>clearTimeout(t)))}catch(e){console.warn(`${t.X.logTag}/telegram: sending the proposal notice failed:`,e instanceof Error?e.name:"error")}}async function j(e,t={},r={}){if(!e.length)return;let a={...f,...t};await _(async()=>{let t=await a.autoRun().catch(()=>null),n=e.filter(e=>{var r;return r=t??{},"pending"===e.status&&!e.auto&&(p.H[e.action]?.risk!=="safe"||"risky"===e.risk||!r[e.action])});if(!n.length)return;let o=n.length>3||!a.buttons?null:await a.buttons().catch(()=>null),l=r.now??new Date;await Promise.all([x((e,t)=>n.length>3?[function(e,t,r,a=new Set,n="en"){let o=e=>(0,s.t)(m,n,e),l=e.slice(0,10).map(e=>{let s=(0,d.f)(e.proposedBy,t,60)||o("proposer");return`• ${(0,i.H)(s)}: ${(0,i.H)(k(e,n))} — ${(0,i.H)((0,d.f)(e.title,t,120))} (${y(e,n)})${a.has(e.id)?` \xb7 ${h(n)}`:""}
-  ${(0,i.H)(w(r,e.id))}`}),u=e.length>10?[`+${e.length-10} ${o("moreN")}`]:[];return[`🧑‍✈️ ${e.length} ${o("waitingN")}`,...l,...u,`${o("open")}: ${(0,i.H)(w(r))}`].join("\n")}(n,e,a.siteUrl(),r.devQueued,t)]:n.map(n=>{let i=b(n,e,a.siteUrl(),r.devQueued?.has(n.id)??!1,t);return o?{text:`${i}
-${((e="en")=>(0,s.t)(m,e,"pending"))(t)}`,keyboard:o(n)}:i}),a,l),A((e,t)=>n.length>3?[I("proposed",n,e,t)]:n.map(r=>I("proposed",r,e,t)),a,l)])},r.timeoutMs??8e3)}async function O(e,t={},r={}){if(!e.auto||"done"!==e.status&&"failed"!==e.status)return;let a={...f,...t},n=r.now??new Date;await _(()=>Promise.all([x((t,r)=>{let a=function(e,t,r="en"){if(!e.auto||"done"!==e.status&&"failed"!==e.status)return null;let a="done"===e.status?"✅":"❌",n=e.result?(0,d.f)(e.result,t,200):"";return`${a} ${(0,s.t)(m,r,"automatic")}: ${(0,i.H)(k(e,r))} — ${(0,i.H)((0,d.f)(e.title,t,120))}${n?`: ${(0,i.H)(n)}`:""}`}(e,t,r);return a?[a]:[]},a,n),A((t,r)=>[I("done"===e.status?"done":"failed",e,t,r)],a,n)]).then(()=>void 0),r.timeoutMs??8e3)}async function S(e,t,r={},a={}){if("done"!==e.status&&"failed"!==e.status)return;let n={...f,...r},o=a.now??new Date;await _(()=>Promise.all([x((r,a)=>[function(e,t,r,a="en"){let n=e=>(0,s.t)(m,a,e),o=(0,d.f)(e.resourceName??n("app"),r,60)||n("app"),l=(0,d.f)(t.reason,r,200).replace(/[.!?…]+$/,"")||n("rollbackWhy"),u=e.result?(0,d.f)(e.result,r,200):"";return["id"===a?`⏪ Otomatis rollback ${(0,i.H)(o)}: ${(0,i.H)(l)}. Deploy baru ${(0,i.H)((0,d.f)(t.newRef,r,40))} dibalikin ke deploy sebelumnya. Benerin dulu, terus deploy ulang.`:`⏪ Automatic rollback of ${(0,i.H)(o)}: ${(0,i.H)(l)}. The new deploy ${(0,i.H)((0,d.f)(t.newRef,r,40))} was rolled back to the previous one. Fix it first, then deploy again.`,`${"done"===e.status?"✅":"❌"} ${n("done"===e.status?"succeeded":"failed")}${u?`: ${(0,i.H)(u)}`:""}`].join("\n")}(e,t,r,a)],n,o),A((t,r)=>[I("done"===e.status?"done":"failed",e,t,r)],n,o)]).then(()=>void 0),a.timeoutMs??8e3)}async function P(e,t={},r={}){let a={...f,...t};await _(()=>x((t,r)=>[function(e,t,r="en"){let a="id"===r,n=(0,d.f)(e.app,t,60)||(0,s.t)(m,r,"app"),o=e.packages.slice(0,4).join(", ")+(e.packages.length>4?`, +${e.packages.length-4}`:"");if("merged"===e.kind)return a?`✅ PR #${e.number} di ${(0,i.H)(n)} di-merge otomatis (${(0,i.H)(o)}). Deploy production jalan lewat Vercel; auto-rollback jaga ${e.windowMin??30} menit pertama.`:`✅ PR #${e.number} in ${(0,i.H)(n)} was merged automatically (${(0,i.H)(o)}). The production deploy runs through Vercel; auto-rollback watches the first ${e.windowMin??30} minutes.`;if("ready-manual"===e.kind)return a?`🔐 PR #${e.number} di ${(0,i.H)(n)} siap di-merge, tapi auto-rollback mati — merge manual ya.`:`🔐 PR #${e.number} in ${(0,i.H)(n)} is ready to merge, but auto-rollback is off — please merge it manually.`;let l=(0,d.f)(e.reason??"",t,200)||(0,s.t)(m,r,"stopFallback");return a?`⚠️ PR #${e.number} di ${(0,i.H)(n)} butuh dicek: ${(0,i.H)(l)}. PR-nya dibiarin terbuka.`:`⚠️ PR #${e.number} in ${(0,i.H)(n)} needs a look: ${(0,i.H)(l)}. The PR was left open.`}(e,t,r)],a,r.now??new Date),r.timeoutMs??8e3)}e.s(["h",0,v,"q",0,S,"y",0,P,"v",0,R,"i",0,j,"b",0,O,"a",0,b])},570191,e=>{var t=e.i(875225),r=e.i(924924),a=e.i(618916),n=e.i(407602),i=e.i(365156);let o="office.autoRun",s=Object.keys(i.H);s.filter(e=>"safe"===i.H[e].risk),Object.fromEntries(s.map(e=>[e,!1]));let l={read:async()=>{let[e]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,o)).limit(1);return e?.value??null},write:async e=>{await (0,r.f)().insert(a.settings).values({key:o,value:e}).onConflictDoUpdate({target:a.settings.key,set:{value:e,updatedAt:new Date}})},audit:e=>(0,n.f)({kind:"ok",message:e.message,detail:e.detail.slice(0,500),resourceId:null,actorUserId:e.actorUserId})};async function u(e={}){var t;let r;return r=(t=await ({...l,...e}).read())&&"object"==typeof t&&!Array.isArray(t)?t:{},Object.fromEntries(s.map(e=>[e,"safe"===i.H[e].risk&&!0===r[e]]))}let d="office.autoRollback",c={...l,read:async()=>{let[e]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,d)).limit(1);return e?.value??null},write:async e=>{await (0,r.f)().insert(a.settings).values({key:d,value:e}).onConflictDoUpdate({target:a.settings.key,set:{value:e,updatedAt:new Date}})}};async function p(e={}){var t;let r,a;return{enabled:!0===(r=(t=await ({...c,...e}).read())&&"object"==typeof t&&!Array.isArray(t)?t:{}).enabled,windowMin:"number"==typeof(a=r.windowMin)&&Number.isInteger(a)&&a>=10&&a<=120?r.windowMin:30}}let f="office.autoSecurity",m=["critical","high","moderate"],g={enabled:!0,severities:["critical","high","moderate"],sameMajorOnly:!0},h={...l,read:async()=>{let[e]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,f)).limit(1);return e?.value??null},write:async e=>{await (0,r.f)().insert(a.settings).values({key:f,value:e}).onConflictDoUpdate({target:a.settings.key,set:{value:e,updatedAt:new Date}})}};async function k(e={}){return function(e){let t;if(null==e)return{...g,severities:[...g.severities]};let r="object"!=typeof e||Array.isArray(e)?{}:e,a=(Array.isArray(t=r.severities)&&t.every(e=>m.includes(e))?m.filter(e=>t.includes(e)):null)??["critical","high"],n="boolean"==typeof r.moderate?r.moderate:a.includes("high");return{enabled:!0===r.enabled,severities:m.filter(e=>"moderate"===e?n:a.includes(e)),sameMajorOnly:!0}}(await ({...h,...e}).read())}e.s(["r",0,s,"n",0,120,"l",0,10,"K",0,p,"I",0,u,"X",0,k])},365156,e=>{e.s(["H",0,{recheck:{risk:"safe",label:"Check again now",uses:"monitor-actions checkNow"},neon_wake:{risk:"safe",label:"Wake Neon",uses:"Stage 6 Neon wake"},supabase_keepalive:{risk:"safe",label:"Send Supabase keep-alive",uses:"Stage 6 Keep active"},supabase_restore:{risk:"risky",label:"Restore Supabase project",uses:"Stage 6 Supabase restore"},vercel_redeploy:{risk:"risky",label:"Redeploy production",uses:"vercel-actions redeployAction"},vercel_rollback:{risk:"risky",label:"Roll back to previous deployment",uses:"vercel-actions rollbackAction"},github_bump_pr:{risk:"risky",label:"Open package update PR",uses:"lib/data/deps-pr.ts bumpPrAs (GitHub PR-write token)"},domain_recheck:{risk:"safe",label:"Re-check domain certificate",uses:"domains actions recheck (network-db recheckDomain)"},daily_rerun:{risk:"risky",label:"Rerun daily job",uses:"GET /api/daily with the cron secret (collector runDailyAll)"},monitor_update_url:{risk:"safe",label:"Update monitor",uses:"Uptime Update monitor (monitor-move-db moveMonitorToDomain)"}},"V",0,72e5])},377489,e=>{var t=e.i(298397),r=e.i(154586),a=e.i(313931),n=e.i(635982),i=e.i(365156);let o=200,s=a.X.auditPrefix,l=/^dpl_[A-Za-z0-9]{8,40}$/,u=/^ep-[a-z0-9-]{3,60}$/,d=/^[a-z0-9]{8,40}$/,c=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,p=(e,t=o)=>e.length>t?`${e.slice(0,t-1).trimEnd()}…`:e,f=e=>/[.!?…]$/.test(e)?e:`${e}.`;function m(e,r,a,i){return"app"===e&&a?(0,t.r)(i,a):("supabase_project"===e||"neon_project"===e||"neon_branch"===e||"firestore"===e)&&r?(0,t.X)(i,r):a&&(0,n.f)(a,i,120)||null}let g={recheck:e=>`Check ${e} again now`,neon_wake:e=>`Wake the Neon compute of ${e}`,supabase_keepalive:e=>`Send a keep-alive to ${e}`,supabase_restore:e=>`Restore Supabase project ${e}`,vercel_redeploy:e=>`Redeploy production ${e}`,vercel_rollback:e=>`Roll ${e} back to the previous deployment`,github_bump_pr:e=>`Open a PR updating vulnerable packages in ${e}`,domain_recheck:e=>`Re-check the certificate of ${e}`,daily_rerun:()=>"Rerun the daily job",monitor_update_url:e=>`Point the ${e} monitor at its new domain`},h=(e,t)=>p(g[e](t??"this resource")),k=(e,t)=>e.silencedUntilResolved||null!==e.silencedUntil&&e.silencedUntil.getTime()>t.getTime();e.s(["e",0,"office-auto","v",0,s,"L",0,6e5,"j",0,o,"I",0,(e,t)=>"safe"===i.H[e].risk&&!0===t[e],"l",0,p,"z",0,function(e,t){let r=e.filter(e=>!k(e,t)),a=e=>[...new Set(e.filter(e=>!!e&&c.test(e)))],n=r.filter(e=>("MonitorDown"===e.ruleKey||"HighLatency"===e.ruleKey)&&"app"===e.resourceKind);return{monitorIds:a([...n,...r.filter(e=>"MonitorDomainMoved"===e.ruleKey&&"app"===e.resourceKind)].map(e=>e.subject)),monitorApps:a(n.map(e=>e.resourceId)),deployApps:a(r.filter(e=>("DeploymentFailed"===e.ruleKey||"MonitorDown"===e.ruleKey||"HighLatency"===e.ruleKey)&&"app"===e.resourceKind).map(e=>e.resourceId)),supabaseIds:a(r.filter(e=>("DatabasePaused"===e.ruleKey||"AutoPauseRisk"===e.ruleKey)&&"supabase_project"===e.resourceKind).map(e=>e.resourceId)),depApps:a(r.filter(e=>"VulnerableDependency"===e.ruleKey&&"app"===e.resourceKind).map(e=>e.resourceId)),frameworkApps:a(r.filter(e=>"FrameworkVulnerable"===e.ruleKey&&"app"===e.resourceKind).map(e=>e.resourceId))}},"M",0,h,"t",0,function(e,a,s,g){let y,w,b;if(k(e,g))return[];let v=(y=(0,t.o)(e,s),w=(0,n.f)(y.title,s,80),b=(0,n.f)(y.message,s,o),p([w&&f(w),b&&f(b)].filter(Boolean).join(" ")||`${e.ruleKey}.`));return(function(e,t,r){let a="app"===e.resourceKind&&e.resourceId?e.resourceId:null;switch(e.ruleKey){case"DeploymentFailed":{let e=a?t.deploys.get(a):void 0;if(!a||!e?.currentId||!l.test(e.currentId))return[];let r=[{action:"vercel_redeploy",resourceKind:"app",resourceId:a,targetRef:e.currentId}];return e.previousId&&l.test(e.previousId)&&e.previousId!==e.currentId&&r.push({action:"vercel_rollback",resourceKind:"app",resourceId:a,targetRef:e.previousId}),r}case"DatabasePaused":case"AutoPauseRisk":{if("supabase_project"!==e.resourceKind||!e.resourceId)return[];let r=t.supabaseRefs.get(e.resourceId);if(!r||!d.test(r))return[];return[{action:"DatabasePaused"===e.ruleKey?"supabase_restore":"supabase_keepalive",resourceKind:"supabase_project",resourceId:e.resourceId,targetRef:r}]}case"VulnerableDependency":{let e=a?t.fixableRepos?.get(a):void 0;return a&&e&&c.test(e)?[{action:"github_bump_pr",resourceKind:"app",resourceId:a,targetRef:e}]:[]}case"FrameworkVulnerable":{let e=a?t.frameworkFixes?.get(a):void 0;return a&&e&&c.test(e.repoId)?[{action:"github_bump_pr",resourceKind:"app",resourceId:a,targetRef:e.repoId}]:[]}case"MonitorDomainMoved":return a&&c.test(e.subject)&&t.monitorMoves?.has(e.subject)?[{action:"monitor_update_url",resourceKind:"app",resourceId:a,targetRef:e.subject}]:[];case"MonitorDown":case"HighLatency":{let n=[];a&&c.test(e.subject)&&"http"===t.monitorKinds.get(e.subject)&&n.push({action:"recheck",resourceKind:"app",resourceId:a,targetRef:e.subject}),"MonitorDown"===e.ruleKey&&e.resourceId&&c.test(e.subject)&&t.dailyHeartbeatId===e.subject&&n.push({action:"daily_rerun",room:"observe",resourceKind:e.resourceKind,resourceId:e.resourceId,targetRef:e.subject});let i=a?t.neonSuspended.get(a):void 0;if(i&&u.test(i.endpointId)&&n.push({action:"neon_wake",room:"databases",resourceKind:i.resourceKind,resourceId:i.resourceId,targetRef:i.endpointId}),t.monitorMoves?.has(e.subject))return n;let o=a?t.deploys.get(a):void 0;return a&&function(e,t,r){if(!e?.currentId||!e.previousId||!e.liveAt||!l.test(e.previousId)||e.previousId===e.currentId)return!1;let a=r.getTime()-e.liveAt.getTime();return a>=0&&a<=t}(o,t.rollbackWindowMs??18e5,r)?n.push({action:"vercel_rollback",resourceKind:"app",resourceId:a,targetRef:o.previousId}):"MonitorDown"===e.ruleKey&&a&&o?.currentId&&l.test(o.currentId)&&"http"===t.monitorKinds.get(e.subject)&&(n.push({action:"vercel_redeploy",resourceKind:"app",resourceId:a,targetRef:o.currentId}),o.previousId&&l.test(o.previousId)&&o.previousId!==o.currentId&&n.push({action:"vercel_rollback",resourceKind:"app",resourceId:a,targetRef:o.previousId})),n}case"CertExpiringSoon":return"domain"===e.resourceKind&&e.resourceId&&c.test(e.resourceId)?[{action:"domain_recheck",resourceKind:"domain",resourceId:e.resourceId,targetRef:e.resourceId}]:[];default:return[]}})(e,a,g).map(l=>{var u;let d,c,f,k,y=l.room??(0,r.p)(e),w="neon_wake"===l.action?m(l.resourceKind,l.resourceId,null,s):m(e.resourceKind,e.resourceId,e.resourceName,s),b="FrameworkVulnerable"===e.ruleKey&&"github_bump_pr"===l.action,$="monitor_update_url"===l.action?a.monitorMoves?.get(l.targetRef):void 0;return{alertId:e.id,ruleKey:e.ruleKey,room:y,action:l.action,risk:i.H[l.action].risk,title:b?p(`Open a PR updating Next.js in ${w??"this app"}`):$?p(`Point the ${w??"app's"} monitor at ${$.to}`):h(l.action,w),reason:b?(u=l.resourceId?a.frameworkFixes?.get(l.resourceId):void 0,d=w??"this app",p(u?`Next.js ${u.from} in ${d} has known vulnerabilities: the PR updates next (and eslint-config-next when listed) to ${u.to}.`:`Next.js in ${d} has known vulnerabilities with a fixed version.`)):"github_bump_pr"===l.action?(f=(c=(0,n.f)((0,t.o)(e,s).message,s,o)).includes(": ")?c.slice(c.indexOf(": ")+2):"",k=`Vulnerable packages in ${w??"this app"} have a fix`,p(f?`${k}: ${f}`:`${k}.`)):v,resourceKind:l.resourceKind,resourceId:l.resourceId,resourceName:w,targetRef:l.targetRef,proposedBy:(0,r.y)(y),expiresAt:new Date(g.getTime()+i.V)}})},"x",0,function(e,t){let r=e.ok?e.message||"Done.":e.error||"It didn't run.";return p((0,n.f)(r,t,o)||(e.ok?"Done.":"It didn't run."))},"J",0,m,"E",0,function(e){return{id:e.id,room:e.room,action:e.action,actionLabel:i.H[e.action].label,risk:i.H[e.action].risk,title:e.title,reason:e.reason,resourceName:e.resourceName,proposedBy:e.proposedBy,status:e.status,auto:e.auto,result:e.result,createdAt:e.createdAt.toISOString(),decidedAt:e.decidedAt?e.decidedAt.toISOString():null,expiresAt:e.expiresAt.toISOString()}},"Z",0,function(e,t,r){let a=r??t?.find(e=>e.isDefault)?.id??null,n=(e??[]).find(e=>!a||e.branchId===a);return n&&!n.disabled&&"idle"===n.state&&"active"!==n.pendingState&&u.test(n.id)?n.id:null}])},610514,e=>{var t=e.i(666680),r=e.i(875225),a=e.i(924924),n=e.i(220642),i=e.i(313931),o=e.i(407602),s=e.i(209576),l=e.i(983128),u=e.i(547499),d=e.i(695811),c=e.i(298397),p=e.i(291029),f=e.i(635982),m=e.i(377489),g=e.i(447933),h=e.i(442565);let k={decide:g.V,execute:(e,t,r)=>(0,g.N)(e,t,r),history:(e,t)=>(0,h.v)(e,t)};async function y(e,t,r,a,n={},i=k){let o=await i.decide(e,t,r.id,a);if("ok"!==o.status)return"missing"===o.status?{status:"missing"}:{status:"conflict",proposal:o.proposal};let s=[],l=async()=>{let e,t=i.history;if(!t||!s.length)return;let r=s.splice(0),a=new Promise(t=>{e=setTimeout(t,h.h)}),n=(async()=>{for(let[e,a]of r)await t(e,a).catch(()=>void 0)})();await Promise.race([n,a]).finally(()=>clearTimeout(e))};if("reject"===t)return s.push(["rejected",o.proposal]),{status:"ok",proposal:o.proposal,flushHistory:l};s.push(["approved",o.proposal]),n.onApproved&&await n.onApproved(o.proposal).catch(()=>void 0);let u=await i.execute(e,{id:r.id,userId:r.userId},new Date);return u&&("done"===u.status||"failed"===u.status)&&s.push([u.status,u]),{status:"ok",proposal:u??o.proposal,flushHistory:l}}var w=e.i(365156);let b=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,v={en:{approve:"✅ Approve",reject:"❌ Reject",sure:"⚠️ Sure? Approve",cancel:"Cancel",invalid:"This button is not valid.",gone:"This proposal is already decided / expired",confirmFirst:"This action is risky. Tap ⚠️ Sure? Approve within 2 minutes.",confirmLate:"The confirmation expired. Tap ✅ Approve again.",cancelled:"Cancelled. The proposal is still waiting.",running:"Approved. Running…",rejected:"Rejected.",failed:"Could not process it. Try again from Auto-actions."},id:{approve:"✅ Setujui",reject:"❌ Tolak",sure:"⚠️ Yakin? Setujui",cancel:"Batal",invalid:"Tombol ini nggak valid.",gone:"Usulan ini udah diputuskan / kedaluwarsa",confirmFirst:"Aksi ini berisiko. Tap ⚠️ Yakin? Setujui dalam 2 menit.",confirmLate:"Konfirmasinya kedaluwarsa. Tap ✅ Setujui lagi.",cancelled:"Dibatalkan. Usulannya masih menunggu.",running:"Disetujui. Lagi jalan…",rejected:"Ditolak.",failed:"Gagal memproses. Coba lagi dari Auto-actions."}},$=e=>(0,t.createHmac)("sha256",Buffer.from(e,"base64")).update("watchpost:telegram-callback:v1").digest(),I=(e,r)=>(0,t.createHmac)("sha256",e).update(r,"utf8").digest("base64url").slice(0,16);function A(e,t,r,a=null){let n=`p:${t}:${r}${"c"===r?`:${(a??0).toString(36)}`:""}`;return`${n}:${I(e,n)}`}function R(e,r){if("string"!=typeof r||r.length>64)return null;let a=r.lastIndexOf(":");if(a<0)return null;let n=r.slice(0,a),i=Buffer.from(r.slice(a+1),"utf8"),o=Buffer.from(I(e,n),"utf8");if(i.length!==o.length||!(0,t.timingSafeEqual)(i,o))return null;let s=n.split(":");if("p"!==s[0]||!b.test(s[1]??""))return null;let l=s[2];return"c"===l?4===s.length&&/^[0-9a-z]{1,10}$/.test(s[3])?{id:s[1],op:l,exp:parseInt(s[3],36)}:null:3===s.length&&["a","r","x"].includes(l)?{id:s[1],op:l,exp:null}:null}let x=(e,t,r="en")=>({inline_keyboard:[[{text:v[r].approve,callback_data:A(e,t,"a")},{text:v[r].reject,callback_data:A(e,t,"r")}]]}),_=(e,t,r,a="en")=>({inline_keyboard:[[{text:v[a].sure,callback_data:A(e,t,"c",r)},{text:v[a].cancel,callback_data:A(e,t,"x")}]]}),j={en:{pending:"⏳ waiting",approved:"⚙️ running",running:"⚙️ running",done:"✅ done",failed:"❌ failed",rejected:"🚫 rejected",expired:"⌛ expired"},id:{pending:"⏳ menunggu",approved:"⚙️ jalan",running:"⚙️ jalan",done:"✅ selesai",failed:"❌ gagal",rejected:"🚫 ditolak",expired:"⌛ kedaluwarsa"}};function O(e,t,r="en"){let a=e.result&&("done"===e.status||"failed"===e.status||"expired"===e.status)?(0,f.f)(e.result,t,200):"";return`Status: ${j[r][e.status]}${a?` — ${(0,n.H)(a)}`:""}`}let S=(e,t,r,a="en")=>`${(0,h.a)(e,t,r,!1,a)}
-${O(e,t,a)}`,P={key:()=>$((0,u.f)().OPS_ENCRYPTION_KEY),get:async function(e){let[t]=await (0,a.f)().select({id:p.O.id,room:p.O.room,action:p.O.action,risk:p.O.risk,title:p.O.title,reason:p.O.reason,resourceName:p.O.resourceName,proposedBy:p.O.proposedBy,status:p.O.status,auto:p.O.auto,result:p.O.result,createdAt:p.O.createdAt,decidedAt:p.O.decidedAt,expiresAt:p.O.expiresAt}).from(p.O).where((0,r.u)(p.O.id,e)).limit(1);return t?(0,m.E)(t):null},decide:y,book:()=>(0,s.f)(),siteUrl:()=>(0,u.f)().SITE_URL,lang:()=>(0,d.H)("telegram"),audit:e=>(0,o.f)({...e,resourceId:null})};async function T(e,t,r=P){let{client:a,owner:n,now:o}=t,s=r.key(),l=await r.lang().catch(()=>"en"),u=v[l],d=R(s,e.data);if(!d)return void await a.answer(e.queryId,u.invalid);let p=null,f=async(t,n)=>a.editText(e.chatId,e.messageId,S(t,await (p??=r.book().catch(()=>c.a)),r.siteUrl(),l),n),m=async t=>{await a.answer(e.queryId,u.gone),t?await f(t,null):await a.editKeyboard(e.chatId,e.messageId,{inline_keyboard:[]})},g=await r.get(d.id);if(!g||!("pending"===g.status&&Date.parse(g.expiresAt)>o.getTime()))return m(g);if("x"===d.op){await a.editKeyboard(e.chatId,e.messageId,x(s,g.id,l)),await a.answer(e.queryId,u.cancelled);return}if("a"===d.op&&("risky"===g.risk||w.H[g.action]?.risk==="risky")){await a.editKeyboard(e.chatId,e.messageId,_(s,g.id,Math.floor((o.getTime()+12e4)/1e3),l)),await a.answer(e.queryId,u.confirmFirst);return}if("c"===d.op&&(d.exp??0)*1e3<o.getTime()){await a.editKeyboard(e.chatId,e.messageId,x(s,g.id,l)),await a.answer(e.queryId,u.confirmLate);return}let h="r"===d.op?"reject":"approve",k=!1;try{let t=await r.decide(g.id,h,{id:n.memberId,userId:n.userId},o,{onApproved:async t=>{k=!0,await a.answer(e.queryId,u.running),await f(t,null)}});if("missing"===t.status)return m(null);if("conflict"===t.status)return m(t.proposal);await r.audit({kind:"ok",message:i.X.telegramDecided("approve"===h?"approved":"rejected",t.proposal.title.slice(0,120)),actorUserId:n.userId}).catch(()=>console.warn("audit event failed")),k||await a.answer(e.queryId,"reject"===h?u.rejected:u.running),await f(t.proposal,null),await t.flushHistory?.()}catch(t){console.warn("telegram approvals: deciding failed:",t instanceof Error?t.name:"error"),k||await a.answer(e.queryId,u.failed)}}async function M(){if(!await (0,l.v)()||!await (0,l.I)())return null;let e=$((0,u.f)().OPS_ENCRYPTION_KEY),t=await (0,d.H)("telegram");return r=>x(e,r.id,t)}e.s(["CONFIRM_MS",0,12e4,"TEXT",0,v,"approvalButtons",0,M,"approvalKeyboard",0,x,"callbackKey",0,$,"confirmKeyboard",0,_,"noticeText",0,S,"proposalCallback",0,T,"signCallback",0,A,"statusLine",0,O,"verifyCallback",0,R],610514)},635982,e=>{var t=e.i(298397),r=e.i(76067),a=e.i(753783);let n="[\\p{L}\\p{N}_./-]",i=e=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),o=/(?<![\p{L}\p{N}_.@-])(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,24}(?![\p{L}\p{N}_-]|\.[\p{L}\p{N}])/giu,s=new WeakMap;e.s(["f",0,(e,l,u)=>{var d;let c;return c=(d=String(e??"").replace(/\s+/g," "),String(d??"").replace(/\r\n?/g,"\n").split("\n").map(e=>{var u;let d,c=(0,a.F)((0,r.F)(e,l),l);return c=c.replace(o,e=>/\.example$/i.test(e)?e:"site.example"),(0,t.G)((u=c,(d=function(e){if(s.has(e))return s.get(e);let t=new Map(e.app.filter(e=>e.name.trim().length>=2).map(e=>[e.name.toLowerCase(),e.alias])),r=[...t.keys()].sort((e,t)=>t.length-e.length),a=r.length?{re:RegExp(`(?<!${n})(?:${r.map(i).join("|")})(?!${n})`,"giu"),alias:t}:null;return s.set(e,a),a}(l))?u.replace(d.re,e=>d.alias.get(e.toLowerCase())??e):u))}).join("\n")).replace(/\s+/g," ").trim(),c.length>u?`${c.slice(0,u-1).trimEnd()}…`:c}])}]})();
+(()=>{"use strict";module.exports=[825895,e=>{var t=e.i(875225),r=e.i(924924),a=e.i(618916),n=e.i(620511),i=e.i(267841);let o="deps.lockfileDispatched";async function s(){let[e]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,n.h)).limit(1);return(0,n.g)(e?.value).repo}async function l(e,u,d=new Date){try{let l=await s();if(!l)return{sent:!1,why:"no actions repository"};let c=(0,n.C)(u);if(!c)return{sent:!1,why:"invalid"};let p=await (0,i.B)(e,l,c);if(!p.ok)return{sent:!1,why:p.error};let[f]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,o)).limit(1),m=f?.value&&"object"==typeof f.value?f.value:{},g={...Object.fromEntries(Object.entries(m).filter(([,e])=>d.getTime()-Date.parse(e)<864e5)),[`${u.repo}#${u.branch}`]:d.toISOString()};return await (0,r.f)().insert(a.settings).values({key:o,value:g}).onConflictDoUpdate({target:a.settings.key,set:{value:g,updatedAt:d}}),{sent:!0}}catch(e){return console.warn("deps: lockfile dispatch failed:",e instanceof Error?e.name:"error"),{sent:!1,why:"error"}}}async function u(e,i,s=new Date){try{let[l]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,o)).limit(1),u=l?.value?.[`${e}#${i}`];return!!u&&s.getTime()-Date.parse(u)<n.w}catch{return!1}}e.s(["W",0,u,"U",0,l])},582931,e=>{var t=e.i(875225),r=e.i(349129),a=e.i(924924),n=e.i(618916),i=e.i(921991),o=e.i(90801),s=e.i(975912),l=e.i(618127),u=e.i(581321),d=e.i(32391),c=e.i(256662),p=e.i(413230),f=e.i(547499),m=e.i(479301),g=e.i(502240),h=e.i(267841),k=e.i(628448),y=e.i(472832),w=e.i(825895);let b=e=>({done:!1,message:e});async function v(){let[e]=await (0,a.f)().select().from(n.accounts).where((0,t.u)(n.accounts.provider,"github_write")).orderBy((0,r.M)(n.accounts.createdAt)).limit(1);if(!e)return null;let o=(0,i.V)({ciphertext:e.credentialCiphertext,iv:e.credentialIv},(0,f.f)().OPS_ENCRYPTION_KEY);return o?{id:e.id,token:o}:"unreadable"}let $={severity:"no package at the selected severity",major:"an update jumps a major version",nothing:"nothing can be updated"};async function I(e){let[r]=await (0,a.f)().select({version:n.appSecurity.version,status:n.appSecurity.status,findings:n.appSecurity.findings}).from(n.appSecurity).where((0,t.u)(n.appSecurity.resourceId,e)).limit(1);return r?(0,l.p)({version:r.version,status:r.status,findings:Array.isArray(r.findings)?r.findings:[]}):null}async function A(e){let r=await (0,a.f)().select({package:n.dependencyVulns.package,installedVersion:n.dependencyVulns.installedVersion,fixedVersion:n.dependencyVulns.fixedVersion,vulnId:n.dependencyVulns.vulnId,aliases:n.dependencyVulns.aliases,severity:n.dependencyVulns.severity,direct:n.dependencyVulns.direct,dev:n.dependencyVulns.dev}).from(n.dependencyVulns).where((0,t.b)((0,t.u)(n.dependencyVulns.repoId,e),(0,t.M)(n.dependencyVulns.resolvedAt))).limit(2e3);return{upgrades:(0,p.B)(r),installed:(0,o.D)(r)}}async function R(e,t,r,a,n){for(let i of(0,g.a)(a,r)){if(i===r)break;let a=await (0,h.M)(e,t,i,n);if(!a.ok)return a;if(a.data)return{ok:!0,data:{base:i,head:a}}}return{ok:!0,data:{base:r,head:await (0,h.M)(e,t,r,n)}}}async function x(r,i,p,f=y.W,j={}){let _;if(!(0,m.f)(i)||!(0,m.f)(p))return f(b("Something in that request wasn't valid."),r,"");let S=await (0,y.q)(r.id,"github_bump_pr",i);if(S)return f(b(S),r,"");let T=await v();if(null===T)return f(b('A GitHub PR-write token is needed: connect "GitHub (PR write)" on Connections (fine-grained, this repository only, Contents and Pull requests: Read and write; Commit statuses: Read for automatic merges), then ask again.'),r,"");if("unreadable"===T)return f(b("Can't read the stored GitHub PR-write credential. Replace it on Connections."),r,"");let[O]=await (0,a.f)().select({app:n.resources.name,meta:n.resources.meta,fullName:n.githubRepos.fullName,owner:n.githubRepos.owner,goneAt:n.githubRepos.goneAt,lockfilePath:n.dependencyScans.lockfilePath,lockfileSha:n.dependencyScans.lockfileSha}).from(n.appRepos).innerJoin(n.githubRepos,(0,t.u)(n.githubRepos.id,n.appRepos.repoId)).innerJoin(n.resources,(0,t.u)(n.resources.id,n.appRepos.appId)).leftJoin(n.dependencyScans,(0,t.u)(n.dependencyScans.repoId,n.appRepos.repoId)).where((0,t.b)((0,t.u)(n.appRepos.appId,i),(0,t.u)(n.appRepos.repoId,p))).limit(1);if(!O||O.goneAt)return f(b(k.G),r,T.id);let P=O.meta??{},M=(0,u.l)(P.rootDirectoryUnsupported);if(M)return f(b(`The Vercel Root Directory "${M}" of ${O.app} couldn't be used (Watchbell reads plain folder names, at most 4 deep). Update its package.json yourself.`),r,T.id);let N=(0,u.Q)(P.rootDirectory),D=(0,u.H)(N,"package.json"),z=N?`in ${N}`:"at the repository root";if(j.framework){let e=await I(i);if(!e)return f(b(`Nothing to update in ${O.app}: its Next.js check shows no advisory with a fixed version.`),r,T.id);_=e}else if(!(_=await A(p)).upgrades.length)return f(b(`Nothing to update in ${O.app}: no direct package has a fixed version for its open advisories.`),r,T.id);let E=_.upgrades;if(j.auto){let e=(0,o.a)(E,_.installed,j.auto.severities);if(!e.ok)return f(b(`Automatic PR not opened: ${$[e.why]}. The proposal waits for your approval.`),r,T.id);E=e.upgrades}E=(0,l.F)(E);let{auto:C,proposalId:K,framework:H,...B}=j,L={timeoutMs:8e3,...B},V=await (0,h.H)(T.token,O.fullName,L);if(!V.ok)return f({done:!1,failed:V,audit:{message:`Package update PR failed \xb7 ${O.app}`,resourceId:i}},r,T.id);let W=await R(T.token,O.fullName,V.data.defaultBranch,P,L);if(!W.ok)return f({done:!1,failed:W,audit:{message:`Package update PR failed \xb7 ${O.app}`,resourceId:i}},r,T.id);let U=W.data.base,G=(0,g.B)(P.productionSource,U,new Date);if(G&&C)return f(b(`Automatic PR not opened: ${G} The proposal waits for your approval.`),r,T.id);let q=H?null:(0,g.y)(O.lockfileSha,V.data.defaultBranch,N);if(q&&q!==U)return f(b(`The dependency scan of ${O.app} read ${q}, but this pull request would go to ${U}. Scan again (Dependencies › Scan now on the app page), then ask again.`),r,T.id);let F=W.data.head;if(!F.ok)return f({done:!1,failed:F,audit:{message:`Package update PR failed \xb7 ${O.app}`,resourceId:i}},r,T.id);if(!F.data)return f(b(`The default branch ${U} wasn't found.`),r,T.id);let J=await (0,h.E)(T.token,O.fullName,F.data,L,D);if(!J.ok)return f({done:!1,failed:J,audit:{message:`Package update PR failed \xb7 ${O.app}`,resourceId:i}},r,T.id);if(!J.data)return f(b(`There is no package.json ${z}.`),r,T.id);let X=(0,s.k)(J.data.text,E);if(!X?.length||H&&!X.some(e=>"next"===e.package))return f(b(`${D} in ${O.app} already allows the fixed versions (or its ranges can't be rewritten). Run npm install there.`),r,T.id);if(C){let e=X.find(e=>{let t=(0,d.Y)(e.from);return!t||!(0,o.J)(t,e.fixed)});if(e)return f(b(`Automatic PR not opened: ${e.package} ${e.from} → ${e.to} jumps a major version. The proposal waits for your approval.`),r,T.id)}let Z=(0,s.M)(J.data.text,X);if(!Z)return f(b("package.json couldn't be edited safely."),r,T.id);let Y=(0,s.U)(X,N);if(!(0,s.c)(Y,U))return f(b("Refused: the PR branch would be the default branch."),r,T.id);let Q=await (0,h.x)(T.token,O.fullName,O.owner,Y,U,L);if(Q.ok&&Q.data)return{ok:!0,message:`Pull request #${Q.data.number} for these updates is already open.`};let ee=await (0,h.e)(T.token,O.fullName,L);if(!ee.ok)return f({done:!1,failed:ee,audit:{message:`Package update PR failed \xb7 ${O.app}`,resourceId:i}},r,T.id);if(ee.data.length){let e=new Map((await (0,a.f)().select({number:n.dependencyPrs.number,packages:n.dependencyPrs.packages}).from(n.dependencyPrs).where((0,t.b)((0,t.u)(n.dependencyPrs.repoId,p),(0,t.y)(n.dependencyPrs.number,ee.data.map(e=>e.number))))).map(e=>[e.number,e.packages])),i=(0,o.U)(X.map(e=>e.package),ee.data.map(t=>({number:t.number,branch:t.branch,title:t.title,packages:e.get(t.number)??null})),N);if(i)return f(b(`Pull request #${i.number} for the same package is already open in ${O.app}. Merge or close it first.`),r,T.id)}let et=await (0,h.M)(T.token,O.fullName,Y,L);if(et.ok&&et.data)return f(b(`Branch ${Y} already exists without an open pull request. Delete it on GitHub, then ask again.`),r,T.id);let er=O.lockfilePath??(N?(0,u.H)(N,"package-lock.json"):null),ea=d.a.find(e=>e.path===er?.split("/").pop())?.kind??null,en=e=>f({done:!1,failed:e,audit:{message:`Package update PR failed \xb7 ${O.app} \xb7 ${Y}`,resourceId:i}},r,T.id),ei=await (0,h.k)(T.token,O.fullName,Y,F.data,U,L);if(!ei.ok)return en(ei);let eo=await (0,h.D)(T.token,O.fullName,Y,U,Z,J.data.sha,(0,s.G)(X),L,D);if(!eo.ok)return en(eo);let es=(0,s.f)(X,N),el=(G?`> [!WARNING]
+> ${G} Check where production is built from before you merge; Watchbell won't merge this pull request itself.
+
+`:"")+(0,s.y)(X,ea,!!C,N),eu=await (0,h.y)(T.token,O.fullName,Y,U,es,el,L,{draft:!!G}),ed=!!G;if(G&&!eu.ok&&422===eu.status&&(eu=await (0,h.y)(T.token,O.fullName,Y,U,es,el,L),ed=!1),!eu.ok)return en(eu);let ec=G?ed?` Opened as a draft: ${G}`:` Opened as a normal pull request (this repository can't have drafts), with the warning on top: ${G}`:"",ep=X.map(e=>`${e.package} ${e.from} → ${e.to}`).join(", "),ef=await (0,h.M)(T.token,O.fullName,Y,L).catch(()=>null),em=!1;if(ef?.ok&&ef.data){await (0,a.f)().insert(n.dependencyPrs).values({repoId:p,appId:i,proposalId:K??null,number:eu.data.number,branch:Y,baseBranch:U,headSha:ef.data,title:es.slice(0,200),packages:X.map(e=>e.package),auto:!!C,stage:"checks",stageText:(0,c.m)(eu.data.number,"checks")}).onConflictDoNothing().catch(()=>console.warn("deps: recording the PR failed"));let{extensions:t}=await e.A(774810),r=await t.runner?.queueLockfileJob({repoId:p,branch:Y,headSha:ef.data,prNumber:eu.data.number,lockfilePath:er,targets:X.map(e=>({name:e.package,version:e.fixed}))}).catch(()=>(console.warn("deps: queueing the lockfile job failed"),null)),o=await (0,w.U)(T.token,{repo:O.fullName,branch:Y,lockfilePath:er,prNumber:eu.data.number});em=r?.queued===!0||o.sent}return f({done:!0,message:`Pull request #${eu.data.number} opened for ${O.app}: ${ep}.${em?"":` Run npm install${N?` in ${N}`:""} on the branch before merging.`}${ec}`,audit:{message:`Package update PR opened \xb7 ${O.app} \xb7 #${eu.data.number}`,resourceId:i,detail:ep}},r,T.id)}async function j(e,t,r){if(!(0,m.f)(e)||r&&!(0,m.f)(r.appId))return{ok:!1,why:"target"};let a=await v();if(!a||"unreadable"===a)return{ok:!1,why:"no write token"};let n=r?await I(r.appId):await A(e);if(!n)return{ok:!1,why:"nothing"};let i=(0,o.a)(n.upgrades,n.installed,t);return i.ok?{ok:!0}:{ok:!1,why:i.why}}async function _(e,r){let i=e.filter(e=>(0,m.f)(e.appId)&&(0,m.f)(e.repoId)),o=new Map;if(!i.length)return o;let s=await (0,a.f)().select({appId:n.appRepos.appId,repoId:n.appRepos.repoId,meta:n.resources.meta,defaultBranch:n.githubRepos.defaultBranch}).from(n.appRepos).innerJoin(n.resources,(0,t.u)(n.resources.id,n.appRepos.appId)).innerJoin(n.githubRepos,(0,t.u)(n.githubRepos.id,n.appRepos.repoId)).where((0,t.y)(n.appRepos.appId,[...new Set(i.map(e=>e.appId))])).limit(4*i.length);for(let e of i){let t=s.find(t=>t.appId===e.appId&&t.repoId===e.repoId),a=t?.meta??{},n=t?(0,g.B)(a.productionSource,(0,g.q)(a,t.defaultBranch??null),r):null;n&&o.set(e.appId,n)}return o}async function S(e,r=[]){let i=e.filter(m.f),o=new Map;if(!i.length)return o;let s=await (0,a.f)().select({appId:n.appRepos.appId,repoId:n.appRepos.repoId,version:n.appSecurity.version,status:n.appSecurity.status,findings:n.appSecurity.findings}).from(n.appRepos).innerJoin(n.githubRepos,(0,t.u)(n.githubRepos.id,n.appRepos.repoId)).innerJoin(n.appSecurity,(0,t.u)(n.appSecurity.resourceId,n.appRepos.appId)).where((0,t.b)((0,t.y)(n.appRepos.appId,i),(0,t.M)(n.githubRepos.goneAt),(0,t.u)(n.appSecurity.status,"vulnerable"))).limit(i.length),u=new Set(r),d=s.filter(e=>u.has(e.appId)),c=d.length?new Set((await (0,a.f)().selectDistinct({repoId:n.dependencyVulns.repoId}).from(n.dependencyVulns).where((0,t.b)((0,t.y)(n.dependencyVulns.repoId,[...new Set(d.map(e=>e.repoId))]),(0,t.M)(n.dependencyVulns.resolvedAt),(0,t.u)(n.dependencyVulns.package,"next"),(0,t.u)(n.dependencyVulns.direct,!0),(0,t.E)(n.dependencyVulns.fixedVersion))).limit(d.length)).map(e=>e.repoId)):new Set;for(let e of s){if(u.has(e.appId)&&c.has(e.repoId))continue;let t=(0,l.p)({version:e.version,status:e.status,findings:Array.isArray(e.findings)?e.findings:[]});t&&o.set(e.appId,{repoId:e.repoId,from:t.from,to:t.to})}return o}e.s(["J",0,j,"W",0,x,"h",0,S,"H",0,_,"G",0,v])},983128,860320,e=>{var t=e.i(875225),r=e.i(924924),a=e.i(618916),n=e.i(921991),i=e.i(547499),o=e.i(666680),s=e.i(140561),l=e.i(206033),u=e.i(105954),d=e.i(971724),c=e.i(180473),p=e.i(76012);let f={inline_keyboard:[]},m=0,g=e=>(0,o.createHash)("sha256").update(`watchpost:telegram-link:${e.trim().toUpperCase()}`,"utf8").digest("hex"),h=s.z.union([l.z.number().int(),u.z.string().regex(/^-?\d{1,20}$/)]).transform(e=>String(e)),k=d.z.object({id:h,type:u.z.string().max(32).optional(),title:u.z.string().max(256).optional(),first_name:u.z.string().max(256).optional(),username:u.z.string().max(64).optional()}),y=d.z.object({id:h,is_bot:c.z.boolean().optional()}),w=d.z.object({message_id:l.z.number().int(),chat:k,from:y.optional(),text:u.z.string().max(4096).optional()}),b=d.z.object({update_id:l.z.number().int(),message:w.optional(),callback_query:d.z.object({id:u.z.string().min(1).max(128),from:y,message:w.optional(),data:u.z.string().max(64).optional()}).optional()});e.s(["i",0,8,"y",0,function(e,t={}){let r=t.fetch??fetch,a=async(t,a)=>{let n=await (0,p.z)(e,t,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(a)},r);n.ok||/not modified/i.test(n.description)||console.warn(`telegram ${t} failed (${n.code??"network"})`)};return{answer:(e,t)=>a("answerCallbackQuery",{callback_query_id:e,text:t.slice(0,200)}),editText:(e,t,r,n)=>a("editMessageText",{chat_id:e,message_id:t,text:r,parse_mode:"HTML",link_preview_options:{is_disabled:!0},reply_markup:n??f}),editKeyboard:(e,t,r)=>a("editMessageReplyMarkup",{chat_id:e,message_id:t,reply_markup:r}),send:(e,t)=>a("sendMessage",{chat_id:e,text:t,parse_mode:"HTML",link_preview_options:{is_disabled:!0}})}},"v",0,e=>`${(e.title??e.first_name??e.username??"Chat").slice(0,50)} (${e.type??"chat"})`,"F",0,g,"z",0,()=>{m++},"j",0,function(e){let t=/^\/link(?:@[A-Za-z0-9_]{3,64})?\s+([A-Za-z0-9]{4,16})\s*$/.exec(e??"");return t?t[1].toUpperCase():null},"c",0,function(e){let t=b.safeParse(e);return t.success?t.data:null},"p",0,function(e,t){if("string"!=typeof e||"string"!=typeof t||!e||!t)return!1;let r=(0,o.createHash)("sha256").update(e,"utf8").digest(),a=(0,o.createHash)("sha256").update(t,"utf8").digest();return(0,o.timingSafeEqual)(r,a)}],860320);let v="telegram.owner",$="telegram.linkCode",I="telegram.seenChats",A=()=>(0,i.f)().OPS_ENCRYPTION_KEY;async function R(e){let[n]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,e)).limit(1);return n?.value??null}async function x(e,t){await (0,r.f)().insert(a.settings).values({key:e,value:t}).onConflictDoUpdate({target:a.settings.key,set:{value:t,updatedAt:new Date}})}async function j(e){await (0,r.f)().delete(a.settings).where((0,t.u)(a.settings.key,e))}function _(e){let t=e?.sealed;if(!t||"string"!=typeof t.ciphertext||"string"!=typeof t.iv)return null;try{return(0,n.K)(t,A())}catch{return null}}let S=(e,t)=>({sealed:(0,n.l)(e,A()),at:t.toISOString()}),T=null;async function O(e=Date.now()){if(T&&T.until>e)return T.secret;let t=_(await R("telegram.webhook"));return T={secret:t,until:e+3e4},t}let P=async()=>await O()!==null;async function M(){let e,n=_(await R(v));if(!n)return null;try{e=JSON.parse(n)}catch{return null}if("string"!=typeof e.tg||"string"!=typeof e.member)return null;let[i]=await (0,r.f)().select({id:a.members.id,userId:a.members.userId}).from(a.members).where((0,t.b)((0,t.u)(a.members.id,e.member),(0,t.u)(a.members.role,"owner"))).limit(1);return i?{telegramUserId:e.tg,memberId:i.id,userId:i.userId}:null}let N=async()=>await M()!==null;async function D(e,n,i){let o=await R($);if(!o||"string"!=typeof o.hash||"string"!=typeof o.member||"string"!=typeof o.expiresAt)return"expired";if(Date.parse(o.expiresAt)<=i.getTime())return await j($),"expired";let s="number"==typeof o.tries?o.tries:0;if(!function(e,t){if(e.length!==t.length||!e)return!1;let r=0;for(let a=0;a<e.length;a++)r|=e.charCodeAt(a)^t.charCodeAt(a);return 0===r}(8===e.length?g(e):"",o.hash))return s+1>=5?await j($):await x($,{...o,tries:s+1}),"wrong";let[l]=await (0,r.f)().select({id:a.members.id}).from(a.members).where((0,t.b)((0,t.u)(a.members.id,o.member),(0,t.u)(a.members.role,"owner"))).limit(1);return(await j($),l)?(await x(v,S(JSON.stringify({tg:n,member:l.id}),i)),"linked"):"expired"}async function z(){let e=_(await R(I));if(!e)return[];try{let t=JSON.parse(e);return Array.isArray(t)?t.filter(e=>!!e&&"string"==typeof e.id&&"string"==typeof e.label&&"string"==typeof e.at).slice(0,10):[]}catch{return[]}}async function E(e,t){var r;let a,n=(r=await z(),(a=r.find(t=>t.id===e.id))&&a.label===e.label&&t.getTime()-Date.parse(a.at)<36e5&&r[0]?.id===e.id?null:[{id:e.id,label:e.label,at:t.toISOString()},...r.filter(t=>t.id!==e.id)].slice(0,10));n&&await x(I,S(JSON.stringify(n),t))}e.s(["E",0,M,"I",0,N,"P",0,E,"f",0,D,"v",0,P,"g",0,O],983128)},620511,e=>{let t=/^[A-Za-z0-9-]{1,39}\/[A-Za-z0-9._-]{1,100}$/,r=/^watchpost\/deps-[0-9a-f]{8}$/,a=/^(?:[A-Za-z0-9._-]+\/){0,4}package-lock\.json$/,n=e=>"string"==typeof e&&t.test(e)&&!e.includes("..");e.s(["h",0,"deps.lockfileActions","w",0,6e5,"C",0,function(e){let t=e.lockfilePath??"package-lock.json";return!n(e.repo)||!r.test(e.branch)||!a.test(t)||t.includes("..")||!Number.isInteger(e.prNumber)||e.prNumber<1?null:{repo:e.repo,branch:e.branch,lockfile:t,pr:e.prNumber}},"g",0,function(e){let t=e&&"object"==typeof e&&!Array.isArray(e)?e.repo:null;return{repo:n(t)?t:null}}])},975912,e=>{var t=e.i(250474),r=e.i(32391),a=e.i(313931);let n=["dependencies","devDependencies","optionalDependencies"],i="watchpost/deps-",o=e=>"object"==typeof e&&null!==e&&!Array.isArray(e),s=e=>{let t=e.filter(e=>!e.companionOf);return t.length?t:e},l={npm:"npm install",pnpm:"pnpm install",yarn:"yarn install",bun:"bun install","package-json":"npm install"};e.s(["M",0,function(e,t){let r;try{r=JSON.parse(e)}catch{return null}if(!o(r))return null;for(let e of t){let t=r[e.group];if(!o(t)||t[e.package]!==e.from)return null;t[e.package]=e.to}let a=/^[{[]\r?\n([ \t]+)\S/.exec(e),n=a?a[1]:"  ",i=e.includes("\r\n")?"\r\n":"\n",s=JSON.stringify(r,null,n);return"\r\n"===i&&(s=s.replace(/\n/g,"\r\n")),/\r?\n$/.test(e)?s+i:s},"U",0,function(e,t=null){let r=e.map(e=>`${e.package}@${e.to}`).sort().join(",");return`${i}${function(e){let t=0x811c9dc5;for(let r=0;r<e.length;r++)t^=e.charCodeAt(r),t=Math.imul(t,0x1000193)>>>0;return t.toString(16).padStart(8,"0")}(t?`${t}|${r}`:r)}`},"G",0,function(e){let t=s(e);return 1===t.length?`chore(deps): update ${t[0].package} to ${t[0].fixed} (security fix)`:`chore(deps): update ${t.length} packages for security fixes`},"c",0,(e,t)=>e.startsWith(i)&&/^watchpost\/deps-[0-9a-f]{8}$/.test(e)&&e!==t,"k",0,function(e,a){let i;try{i=JSON.parse(e)}catch{return null}if(!o(i))return null;let s=[];for(let e of a)if((0,r.L)(e.package)&&(0,r.C)(e.to))for(let a of n){let n=i[a];if(!o(n)||"string"!=typeof n[e.package])continue;let l=n[e.package],u=(0,r.Y)(l),d=function(e,t){let a=/^\s*(\^|~|>=|=)?\s*v?\d+(?:\.(?:\d+|x|\*))?(?:\.(?:\d+|x|\*))?(?:-[0-9A-Za-z.-]+)?\s*$/.exec(e);return a&&(0,r.C)(t)?`${a[1]??""}${t}`:null}(l,e.to);!u||!d||(0,t.f)(u,e.to)>=0||s.push({package:e.package,group:a,from:l,to:d,fixed:e.to,vulnIds:e.vulnIds,cves:e.cves,...e.companionOf?{companionOf:e.companionOf}:{}})}return s},"y",0,function(e,t,r=!1,n=null){let i=l[t??"npm"]??"npm install",o=`run \`${i}\`${n?` in \`${n}\``:""}`,s=e.filter(e=>!e.companionOf),u=e.filter(e=>e.companionOf),d=s.map(e=>{let t=[...e.cves,...e.vulnIds.filter(t=>!e.cves.includes(t))].slice(0,4).map(e=>`[${e}](https://osv.dev/vulnerability/${encodeURIComponent(e)})`).join(", ");return`| \`${e.package}\` | \`${e.from}\` | \`${e.to}\` | ${t||"-"} |`});return[r?"This PR was opened **automatically** by Watchbell (Automatic security fixes). Watchbell merges it itself when CI is green, the Vercel preview is READY and passes the smoke test, and auto-rollback is on; if anything fails, the PR stays open for you to check.":a.J.prApproved,"","These packages have known vulnerabilities (source: OSV.dev / GitHub Advisory) and a fixed version exists:","","| Package | Current version | New version | Advisory |","| --- | --- | --- | --- |",...d,"",...u.map(e=>`Updated to match ${e.companionOf} (no advisory of its own): \`${e.package}\` \`${e.from}\` → \`${e.to}\`.`),...u.length?[""]:[],"### Important: the lockfile is not updated","",r?`Watchbell only changes \`package.json\`; it can't regenerate the lockfile on the server. Vercel installs the new version at build time, so production is safe after the merge. Afterwards ${o} on the main branch and commit the lockfile to bring it up to date.`:`Watchbell only changes \`package.json\`; it can't regenerate the lockfile on the server. Before merging, check out this branch, ${o}, then commit the changed lockfile. Then make sure the build and tests still pass.`,"","Vulnerable packages that are only installed through other packages (transitive) are not changed here; check with `npm audit` after installing.","","_Nothing is pushed to the main branch: all changes are on this PR branch._"].join("\n")},"f",0,function(e,t=null){let r=s(e),a=t?` in ${t}`:"",n=1===r.length?`Watchbell: update ${r[0].package} to ${r[0].fixed}${a} (security fix)`:`Watchbell: update ${r.length} vulnerable packages${a} (${r.slice(0,2).map(e=>e.package).join(", ")}${r.length>2?", …":""})`;return n.length>200?`${n.slice(0,199)}…`:n}])},256662,e=>{let t={checks:"waiting for CI",preview:"waiting for preview",smoke:"smoke test",merging:"merging…",merged:"merged ✅","ready-manual":"ready to merge (manual)",failed:"needs a look ⚠️",timeout:"needs a look ⚠️",closed:"closed"},r=new Set(["success","neutral","skipped"]),a=e=>"completed"!==e.status?"pending":r.has(e.conclusion??"")?"success":"failure",n={name:"watchbell[bot]",email:"watchbell-bot@users.noreply.github.com",message:"chore(deps): update package-lock.json (Watchbell)"},i={name:"watchpost[bot]",email:"watchpost-bot@users.noreply.github.com",message:"chore(deps): update package-lock.json (Watchpost)"},o=e=>[n,i].some(t=>e.name===t.name&&e.email.toLowerCase()===t.email&&e.message.trim()===t.message),s=/^[\^~]?[0-9][0-9A-Za-z.+-]*$/,l=e=>Array.isArray(e)?e.map(l):e&&"object"==typeof e?Object.fromEntries(Object.keys(e).sort().map(t=>[t,l(e[t])])):e,u=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,d=/^sha512-[A-Za-z0-9+/]{86}==$/,c="(?:@[a-z0-9][a-z0-9._~-]*/)?[a-z0-9][a-z0-9._~-]*",p=RegExp(`^(?:[A-Za-z0-9_-][A-Za-z0-9._-]*/)*?node_modules/${c}(?:/node_modules/${c})*$`,"i"),f=new Set(["dev","optional","devOptional","peer"]),m=e=>!!e&&"object"==typeof e&&!Array.isArray(e),g=e=>e.slice(e.lastIndexOf("node_modules/")+13),h=(e,t,r)=>`${e}/${t}/-/${t.split("/").pop()}-${r}.tgz`,k=(e,t)=>JSON.stringify(l(e))===JSON.stringify(l(t)),y=e=>Object.fromEntries(Object.entries(e).filter(([e])=>!f.has(e))),w=e=>{try{let t=JSON.parse(e);return m(t)&&m(t.packages)?t:null}catch{return null}};e.s(["y",0,20,"X",0,["checks","preview","smoke","merging"],"w",0,15e3,"R",0,27e5,"j",0,function(e){let t=(e.checkRuns??e.actionRuns??[]).map(a);return(e.combined&&e.combined.total>0&&t.push("success"===e.combined.state?"success":"pending"===e.combined.state?"pending":"failure"),t.includes("failure"))?"failure":t.includes("pending")?"pending":"success"},"L",0,function(e){if(!e.length||e.some(e=>e.authWall))return null;let t=e.find(e=>null===e.status||e.status<200||e.status>399);return t?{mode:"http",result:"fail",reason:null===t.status?`${t.path} didn't answer within 15 seconds`:`${t.path} answered ${t.status}`}:{mode:"http",result:"pass",reason:null}},"S",0,function(e,t,r){return(401===e||403===e)&&(/vercel\.com\/(sso|login)|Authentication Required|_vercel_sso|vercel-authentication/i.test(t)||/_vercel_sso/i.test(r.get("set-cookie")??"")||"vercel"===(r.get("server")??"").toLowerCase())},"T",0,function(e,t,r){if([e,t].some(e=>null!==e&&(e=>{if(e.length>0x1900000)return!0;if(3*e.length<=0x1900000)return!1;let t=0;for(let r=0;r<e.length;r++){let a=e.charCodeAt(r);a<128?t+=1:a<2048?t+=2:a>=55296&&a<56320&&(64512&e.charCodeAt(r+1))==56320?(t+=4,r++):t+=3}return t>0x1900000})(e)))return`lockfile too large to check (over 25 MB): ${r}`.slice(0,150);try{return function(e,t,r){let a=e=>`unexpected lockfile change ${e}`.slice(0,150),n=null===t?null:w(t),i=null===e?{packages:{}}:w(e);if(!n||!i)return a(r);if(2!==n.lockfileVersion&&3!==n.lockfileVersion||null!==e&&n.lockfileVersion!==i.lockfileVersion)return a("lockfileVersion");let o=new Set;for(let[e,t]of Object.entries(i.packages)){if(!p.test(e)||!m(t)||"string"!=typeof t.resolved||"string"!=typeof t.version)continue;let r=h("","string"==typeof t.name?t.name:g(e),t.version);t.resolved.startsWith("https://")&&t.resolved.endsWith(r)&&o.add(t.resolved.slice(0,-r.length))}for(let[e,t]of(o.size||o.add("https://registry.npmjs.org"),Object.entries(n.packages))){let n=Object.hasOwn(i.packages,e)?i.packages[e]:void 0;if(void 0!==n&&k(n,t))continue;let s=m(n)?n:null;if(""===e||!e.includes("node_modules/")){let n=""===e?m(t)&&"string"==typeof t.name?t.name:r:e;if(!m(t)||""!==e&&!s||"resolved"in t||"link"in t)return a(n);continue}if(!p.test(e)||!m(t))return a(p.test(e)?g(e):e);let l=g(e);if(void 0!==t.name&&t.name!==l&&(!s||s.name!==t.name))return a(l);let c="string"==typeof t.name?t.name:l,f=t.version;if(void 0!==t.link||"string"!=typeof f||!u.test(f)||"string"!=typeof t.integrity||!d.test(t.integrity)||"string"!=typeof t.resolved||![...o].some(e=>t.resolved===h(e,c,f))||s&&s.version===f&&!k(y(s),y(t)))return a(l)}return null}(e,t,r)}catch{return`unexpected lockfile change ${r} (couldn't be checked)`.slice(0,150)}},"H",0,e=>!!e.lockfileRequired&&!!e.lockfile&&!e.files.some(t=>t.filename===e.lockfile),"n",0,function(e,t,r){return null!==r&&r>0?{mode:"logs",result:"fail",reason:`${r} errors in the preview logs`}:t.getTime()-e.getTime()<18e4||null===r?{mode:"logs",result:"wait",reason:null}:{mode:"logs",result:"pass",reason:null}},"C",0,function(e,t,r){let a,n;try{a=JSON.parse(e),n=JSON.parse(t)}catch{return"unexpected change: package.json isn't valid JSON"}if(!a||!n||"object"!=typeof a||"object"!=typeof n)return"unexpected change: package.json isn't an object";let i=e=>{let t=structuredClone(e);for(let e of["dependencies","devDependencies"]){let a=t[e];if(a&&"object"==typeof a)for(let e of r)delete a[e]}return t};if(JSON.stringify(l(i(a)))!==JSON.stringify(l(i(n))))return"unexpected change in package.json beyond the bumped versions";for(let e of["dependencies","devDependencies"]){let t=a[e]??{},i=n[e]??{};for(let e of r){if(e in t!=e in i)return`unexpected change in package.json: ${e} added or removed`;if(e in i&&i[e]!==t[e]&&("string"!=typeof i[e]||!s.test(i[e])))return`unexpected change in package.json: ${e} isn't a plain version`}}return null},"E",0,function(e){let t=["/"];for(let r of e){let e;try{e=new URL(r).pathname||"/"}catch{continue}!t.includes(e)&&t.length<4&&t.push(e)}return t},"m",0,(e,r,a)=>{let n=`PR #${e}: ${t[r]}${a?` — ${a}`:""}`;return n.length>200?`${n.slice(0,199)}…`:n},"k",0,function(e){let t=new Set([e.manifest,...e.lockfile?[e.lockfile]:[]]);for(let r of e.files)for(let e of[r.filename,r.previous])if(e&&!t.has(e))return`unexpected change in ${e}`.slice(0,150);if(!e.files.some(t=>t.filename===e.manifest))return`unexpected change: ${e.manifest} isn't changed`.slice(0,150);if(e.manifestProblem)return e.manifestProblem.slice(0,150);if(e.lockfileProblem)return e.lockfileProblem.slice(0,150);if(!e.tokenLogin||!e.commits.length||e.commits.length>20)return"couldn't confirm who wrote the PR's commits";if(e.headSha&&e.commits[e.commits.length-1].sha!==e.headSha)return"the PR's head moved while it was checked";for(let t of e.commits){if(null!==t.login&&t.login.toLowerCase()===e.tokenLogin.toLowerCase())continue;let r=t.sha.slice(0,7);if(!o(t)||!t.files||!e.lockfile)return`unexpected commit ${r} by ${t.login??t.name}`.slice(0,150);let a=t.files.find(t=>t!==e.lockfile);if(a)return`unexpected change in ${a} by commit ${r}`.slice(0,150)}return null},"f",0,function(e,t){let r=e.getTime();return(null===t||!(r-t<1e5))&&(Math.floor(r/6e4)%2==0||null!==t&&r-t>=24e4)},"M",0,function(e){if(e.pr.merged)return{kind:"done",stage:"merged"};if("closed"===e.pr.state)return{kind:"done",stage:"closed"};if(void 0!==e.pr.base&&void 0!==e.recordedBase&&e.pr.base!==e.recordedBase)return{kind:"stop",stage:"failed",reason:`the PR's base changed to ${e.pr.base}`};if(e.pr.headSha!==e.recordedSha)return{kind:"wait",stage:"checks",reason:"new commit on the PR branch, checking again",resetSha:e.pr.headSha};let t=e.now.getTime()-e.openedAt.getTime()>27e5;return"failure"===e.checks?{kind:"stop",stage:"failed",reason:"CI failed"}:!1===e.pr.mergeable?{kind:"stop",stage:"failed",reason:"conflicts with the main branch"}:"error"===e.preview.state||"canceled"===e.preview.state?{kind:"stop",stage:"failed",reason:"Vercel preview failed"}:"pending"===e.checks||null===e.pr.mergeable?t?{kind:"stop",stage:"timeout",reason:"CI not finished within 45 minutes"}:{kind:"wait",stage:"checks",reason:null}:"ready"!==e.preview.state?t?{kind:"stop",stage:"timeout",reason:"preview not ready within 45 minutes"}:{kind:"wait",stage:"preview",reason:null}:e.smoke&&"wait"!==e.smoke.result?"fail"===e.smoke.result?{kind:"stop",stage:"failed",reason:`preview smoke test failed: ${e.smoke.reason??"?"}`}:e.autoRollbackOn?{kind:"merge"}:{kind:"stop",stage:"ready-manual",reason:"PR is ready to merge, but auto-rollback is off; merge it manually"}:t?{kind:"stop",stage:"timeout",reason:"preview smoke test not finished within 45 minutes"}:{kind:"wait",stage:"smoke",reason:null}}])},267841,e=>{var t=e.i(971724),r=e.i(105954),a=e.i(180473),n=e.i(600205),i=e.i(206033),o=e.i(455744),s=e.i(604147),l=e.i(975912),u=e.i(455037);async function d(e,t,r,a,n,i=!1){let o,s=n.timeoutMs??8e3;try{o=await (n.fetch??fetch)(`https://api.github.com${t}`,{method:e,headers:{Authorization:`Bearer ${r}`,Accept:i?"application/vnd.github.raw+json":"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28","User-Agent":"Watchbell",...void 0!==a?{"Content-Type":"application/json"}:{}},body:void 0!==a?JSON.stringify(a):void 0,signal:AbortSignal.timeout(s),cache:"no-store",redirect:"error"})}catch(e){return{ok:!1,kind:"transient",error:e instanceof DOMException&&("TimeoutError"===e.name||"AbortError"===e.name)?`GitHub didn't answer within ${Math.round(s/1e3)} seconds.`:"Couldn't reach GitHub."}}let l=await o.text().catch(()=>"");if(i&&o.ok)return{ok:!0,status:o.status,data:l};let u=null;try{u=l?JSON.parse(l):null}catch{u=null}if(o.ok)return{ok:!0,status:o.status,data:u};let c=o.status;return 401===c?{ok:!1,kind:"auth",status:c,error:"GitHub rejected the PR-write token (401). It may have expired or been revoked."}:429===c||403===c&&"0"===o.headers.get("x-ratelimit-remaining")?{ok:!1,kind:"transient",status:c,error:"GitHub's rate limit is used up for now. Try again later."}:403===c?{ok:!1,kind:"scope",status:c,error:"The GitHub PR-write token can't do this (403). It needs Contents and Pull requests: Read and write on this repository."}:404===c?{ok:!1,kind:"missing",status:c,error:"The PR-write token doesn't see this repository (404). Give it access to the repository."}:409===c||422===c?{ok:!1,kind:"format",status:c,error:`GitHub refused the change (${c}).`}:{ok:!1,kind:"transient",status:c,error:`GitHub returned an error (${c}).`}}let c=e=>({ok:!1,kind:"format",error:`GitHub answered ${e} in a format the console doesn't recognise.`}),p={ok:!1,kind:"format",error:"That isn't a repository or branch the console may write."};async function f(e,n,i={}){if(!(0,u.M)(n))return p;let o=await d("GET",`/repos/${(0,u.f)(n)}`,e,void 0,i);if(!o.ok)return o;let s=t.z.object({default_branch:r.z.string(),permissions:t.z.object({push:a.z.boolean()}).partial().optional()}).safeParse(o.data);return s.success&&(0,u.c)(s.data.default_branch)?{ok:!0,data:{defaultBranch:s.data.default_branch,canPush:s.data.permissions?.push??null}}:c("the repository")}async function m(e,a,n,i={}){if(!(0,u.M)(a)||!(0,u.c)(n))return p;let o=await d("GET",`/repos/${(0,u.f)(a)}/git/ref/heads/${n.split("/").map(encodeURIComponent).join("/")}`,e,void 0,i);if(!o.ok)return"missing"===o.kind?{ok:!0,data:null}:o;let s=t.z.object({object:t.z.object({sha:r.z.string().regex(/^[0-9a-f]{40}$/)})}).safeParse(o.data);return s.success?{ok:!0,data:s.data.object.sha}:c("the branch")}let g=/^(?:[A-Za-z0-9._-]{1,100}\/){0,6}package\.json$/,h=e=>g.test(e)&&!e.split("/").some(e=>"."===e||".."===e),k=(e,t)=>`/repos/${(0,u.f)(e)}/contents/${t.split("/").map(encodeURIComponent).join("/")}`;async function y(e,a,i,o={},s="package.json"){if(!(0,u.M)(a)||!(0,u.c)(i)||!h(s))return p;let l=await d("GET",`${k(a,s)}?ref=${encodeURIComponent(i)}`,e,void 0,o);if(!l.ok)return"missing"===l.kind?{ok:!0,data:null}:l;let f=t.z.object({sha:r.z.string(),encoding:n.z.literal("base64"),content:r.z.string()}).safeParse(l.data);return f.success?{ok:!0,data:{sha:f.data.sha,text:Buffer.from(f.data.content.replace(/\s/g,""),"base64").toString("utf8")}}:c("package.json")}let w=/^(?:[A-Za-z0-9._-]{1,100}\/){0,6}(?:package-lock|npm-shrinkwrap)\.json$/,b=e=>w.test(e)&&!e.split("/").some(e=>"."===e||".."===e);async function v(e,t,r,a,n={}){if(!(0,u.M)(t)||!(0,u.c)(r)||!b(a))return p;let i=await d("GET",`${k(t,a)}?ref=${encodeURIComponent(r)}`,e,void 0,{timeoutMs:2e4,...n},!0);return i.ok?"string"==typeof i.data?{ok:!0,data:i.data}:c("the lockfile"):"missing"===i.kind?{ok:!0,data:null}:i}async function $(e,t,r,a,n,i={}){if(!(0,u.M)(t)||!(0,l.c)(r,n)||!/^[0-9a-f]{40}$/.test(a))return p;let o=await d("POST",`/repos/${(0,u.f)(t)}/git/refs`,e,{ref:`refs/heads/${r}`,sha:a},i);return o.ok?{ok:!0,data:!0}:o}async function I(e,t,r,a,n,i,o,s={},c="package.json"){if(!(0,u.M)(t)||!(0,l.c)(r,a)||!h(c))return p;let f=await d("PUT",k(t,c),e,{message:o,content:Buffer.from(n,"utf8").toString("base64"),sha:i,branch:r},s);return f.ok?{ok:!0,data:!0}:f}let A=t.z.object({number:i.z.number(),html_url:r.z.string().startsWith("https://github.com/")});async function R(e,t,r,a,n,i={}){if(!(0,u.M)(t)||!(0,l.c)(a,n))return p;let s=new URLSearchParams({state:"open",head:`${r}:${a}`,per_page:"1"}),f=await d("GET",`/repos/${(0,u.f)(t)}/pulls?${s}`,e,void 0,i);if(!f.ok)return f;let m=o.z.array(A).safeParse(f.data);if(!m.success)return c("the pull requests");let g=m.data[0];return{ok:!0,data:g?{number:g.number,url:g.html_url}:null}}async function x(e,t,r,a,n,i,o={},s={}){if(!(0,u.M)(t)||!(0,l.c)(r,a)||!(0,u.c)(a))return p;let f=await d("POST",`/repos/${(0,u.f)(t)}/pulls`,e,{title:n,head:r,base:a,body:i,maintainer_can_modify:!0,...s.draft?{draft:!0}:{}},o);if(!f.ok)return f;let m=A.safeParse(f.data);return m.success?{ok:!0,data:{number:m.data.number,url:m.data.html_url}}:c("the new pull request")}let j=o.z.array(t.z.object({number:i.z.number(),title:r.z.string(),head:t.z.object({ref:r.z.string(),sha:r.z.string(),repo:t.z.object({full_name:r.z.string()}).nullable()}),base:t.z.object({ref:r.z.string()})}));async function _(e,t,r={}){if(!(0,u.M)(t))return p;let a=await d("GET",`/repos/${(0,u.f)(t)}/pulls?state=open&per_page=100`,e,void 0,r);if(!a.ok)return a;let n=j.safeParse(a.data);return n.success?{ok:!0,data:n.data.filter(e=>/^watchpost\/deps-[0-9a-f]{8}$/.test(e.head.ref)&&e.head.repo?.full_name===t).map(e=>({number:e.number,branch:e.head.ref,title:e.title,headSha:e.head.sha,base:e.base.ref}))}:c("the pull requests")}async function S(e,n,i,o={}){if(!(0,u.M)(n)||!Number.isInteger(i)||i<=0)return p;let l=await d("GET",`/repos/${(0,u.f)(n)}/pulls/${i}`,e,void 0,o);if(!l.ok)return l;let f=t.z.object({state:s.z.enum(["open","closed"]),merged:a.z.boolean().optional(),mergeable:a.z.boolean().nullable().optional(),head:t.z.object({ref:r.z.string(),sha:r.z.string().regex(/^[0-9a-f]{40}$/)}),base:t.z.object({ref:r.z.string()})}).safeParse(l.data);return f.success?{ok:!0,data:{state:f.data.state,merged:!0===f.data.merged,mergeable:f.data.mergeable??null,headSha:f.data.head.sha,branch:f.data.head.ref,base:f.data.base.ref}}:c("the pull request")}async function T(e,a,n,s={}){if(!(0,u.M)(a)||!/^[0-9a-f]{40}$/.test(n))return p;let[l,c]=await Promise.all([d("GET",`/repos/${(0,u.f)(a)}/commits/${n}/check-runs?per_page=100`,e,void 0,s),d("GET",`/repos/${(0,u.f)(a)}/commits/${n}/status`,e,void 0,s)]),f=e=>!e.ok&&("scope"===e.kind||"missing"===e.kind);if(!l.ok&&!f(l))return l;if(!c.ok&&!f(c))return c;let m=l.ok?t.z.object({check_runs:o.z.array(t.z.object({status:r.z.string(),conclusion:r.z.string().nullable()}))}).safeParse(l.data):null,g=c.ok?t.z.object({state:r.z.string(),total_count:i.z.number()}).safeParse(c.data):null;return{ok:!0,data:{checkRuns:m?.success?m.data.check_runs.map(e=>({status:e.status,conclusion:e.conclusion})):null,combined:g?.success?{state:g.data.state,total:g.data.total_count}:null}}}async function O(e,n,i,o,s,f,m,g={}){if(!(0,u.M)(n)||!(0,l.c)(o,s)||!/^[0-9a-f]{40}$/.test(f)||!Number.isInteger(i)||i<=0)return p;let h=await d("PUT",`/repos/${(0,u.f)(n)}/pulls/${i}/merge`,e,{merge_method:"squash",sha:f,commit_title:`Watchbell: ${m.replace(/^Watch(?:bell|post):\s*/,"")}`.slice(0,250)},g);if(!h.ok)return 405===h.status?{ok:!1,kind:"format",status:405,error:"GitHub says the PR can't be merged now (405)."}:409===h.status?{ok:!1,kind:"format",status:409,error:"The PR's head moved since the checks were read (409)."}:h;let k=t.z.object({merged:a.z.boolean(),sha:r.z.string()}).safeParse(h.data);return k.success&&k.data.merged?{ok:!0,data:{sha:k.data.sha}}:c("the merge")}async function P(e,a,n,i={}){if(!(0,u.M)(a)||!Number.isInteger(n)||n<=0)return p;let s=await d("GET",`/repos/${(0,u.f)(a)}/pulls/${n}/files?per_page=100`,e,void 0,i);if(!s.ok)return s;let l=o.z.array(t.z.object({filename:r.z.string(),previous_filename:r.z.string().optional()})).safeParse(s.data);return l.success?{ok:!0,data:l.data.map(e=>({filename:e.filename,previous:e.previous_filename??null}))}:c("the PR's files")}let M=t.z.object({name:r.z.string().optional(),email:r.z.string().optional()}).nullable().optional();async function N(e,a,n,i={}){if(!(0,u.M)(a)||!Number.isInteger(n)||n<=0)return p;let s=await d("GET",`/repos/${(0,u.f)(a)}/pulls/${n}/commits?per_page=100`,e,void 0,i);if(!s.ok)return s;let l=o.z.array(t.z.object({sha:r.z.string().regex(/^[0-9a-f]{40}$/),author:t.z.object({login:r.z.string()}).nullable().optional(),commit:t.z.object({message:r.z.string(),author:M})})).safeParse(s.data);return l.success?{ok:!0,data:l.data.map(e=>({sha:e.sha,login:e.author?.login??null,name:e.commit.author?.name??"",email:e.commit.author?.email??"",message:e.commit.message}))}:c("the PR's commits")}async function D(e,a,n,i={}){if(!(0,u.M)(a)||!/^[0-9a-f]{40}$/.test(n))return p;let s=await d("GET",`/repos/${(0,u.f)(a)}/commits/${n}`,e,void 0,i);if(!s.ok)return s;let l=t.z.object({files:o.z.array(t.z.object({filename:r.z.string(),previous_filename:r.z.string().optional()}))}).safeParse(s.data);return l.success?{ok:!0,data:l.data.files.flatMap(e=>[e.filename,...e.previous_filename?[e.previous_filename]:[]])}:c("the commit")}async function z(e,a={}){let n=await d("GET","/user",e,void 0,a);if(!n.ok)return n;let i=t.z.object({login:r.z.string().min(1)}).safeParse(n.data);return i.success?{ok:!0,data:i.data.login}:c("the token's user")}async function E(e,t,r,a={}){if(!/^[A-Za-z0-9-]{1,39}\/[A-Za-z0-9._-]{1,100}$/.test(t))return p;let n=await d("POST",`/repos/${t}/dispatches`,e,{event_type:"watchpost-lockfile",client_payload:r},a);return n.ok?{ok:!0,data:!0}:n}e.s(["M",0,m,"s",0,T,"h",0,D,"k",0,$,"y",0,x,"B",0,E,"$",0,b,"l",0,v,"E",0,y,"C",0,O,"x",0,R,"e",0,_,"P",0,N,"O",0,P,"b",0,S,"D",0,I,"H",0,f,"z",0,z])},154586,e=>{var t=e.i(278619),r=e.i(313931);let a={workloads:"Workloads",databases:"Databases",network:"Network",observe:"Observe",ai:"AI & API",admin:"Administration"},n={MonitorDown:"workloads",HighLatency:"workloads",DeploymentFailed:"workloads",DatabasePaused:"databases",StorageAlmostFull:"databases",NeonComputeHigh:"databases",FirestoreQuotaHigh:"databases",AutoPauseRisk:"databases",ComputeHigh:"databases",DbQuotaHigh:"databases",CertExpiringSoon:"network",DomainExpiringSoon:"network",DnsProxiedToVercel:"network",CollectorStale:"observe",CredentialExpiring:"admin",VulnerableDependency:"workloads",FrameworkVulnerable:"workloads",MonitorDomainMoved:"workloads"},i=new Set(["MonitorDown","HighLatency","DeploymentFailed","VulnerableDependency","FrameworkVulnerable","MonitorDomainMoved"]);e.s(["p",0,function(e){if((0,t.h)(e.ruleKey))return i.has(e.ruleKey)&&null!==e.resourceKind&&"app"!==e.resourceKind?"observe":n[e.ruleKey];let r=new Set(e.ruleKey.replace(/([a-z0-9])([A-Z])/g,"$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g,"$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean)),a=(...e)=>e.some(e=>r.has(e));return a("ai","router","gateway","model","models","provider","quota","llm","gemini")?"ai":a("key","keys","member","members","security","audit","credential","credentials","mfa","token")?"admin":a("database","db","storage","compute","neon","supabase","firestore","firebase")?"databases":a("domain","domains","dns","cert","certificate","tls","zone")?"network":"app"===e.resourceKind?"workloads":"observe"},"y",0,e=>r.X.proposedBy(a[e])])},549419,143926,e=>{var t=e.i(635982),r=e.i(377489),a=e.i(154586),n=e.i(365156),i=e.i(588492);let o=["LogErrorSpike","LogErrors","LogDbErrors"],s="timeout|ECONNREFUSED|too many connections|terminating connection|connection terminated|endpoint is disabled|compute.*suspend";RegExp(s,"i");let l=/^dpl_[A-Za-z0-9]{8,40}$/,u=/^ep-[a-z0-9-]{3,60}$/,d=/^[a-z0-9]{8,40}$/;function c(e,a,n){let i=a?(0,t.g)(a,n,120):"";return(0,r.l)((0,t.g)(i?`${e}. Most common: ${i}`:e,n,r.j)||e,r.j)}let p=e=>`${e.ruleKey}:${e.resourceId??""}:${e.action}`,f=new Set(["pending","approved","running"]);e.s(["s",0,864e5,"b",0,72e5,"V",0,3,"N",0,s,"G",0,20,"T",0,o,"v",0,72e5,"H",0,18e5,"w",0,10,"I",0,72e5,"x",0,function(e,t,r){let a=new Set(t.filter(e=>f.has(e.status)||null!==e.closedAt&&r.getTime()-e.closedAt.getTime()<72e5).map(p)),n=new Set;return e.filter(e=>{let t=p(e);return!(a.has(t)||n.has(t))&&(n.add(t),!0)})},"t",0,function(e,t,o){return(function(e,t,a){let n=[],o=a.getTime(),s=null!==e.liveAt&&o-e.liveAt.getTime()<72e5&&e.liveAt.getTime()<=o,p=e.previousNext?.status??"unknown";if(s&&e.errorsSinceLive>=Math.max(10,Math.ceil(5*e.baselineErrors/24))&&e.currentId&&e.previousId&&l.test(e.previousId)&&e.previousId!==e.currentId&&"vulnerable"!==p){let a=c(`${e.errorsSinceLive} errors since the deploy went live ${Math.max(1,Math.round((o-e.liveAt.getTime())/6e4))} min ago (${e.baselineErrors} in the 24 h before)`,e.topSinceLive,t);n.push({ruleKey:"LogErrorSpike",room:"workloads",action:"vercel_rollback",resourceKind:"app",resourceId:e.appId,targetRef:e.previousId,reason:"ok"===p?a:(0,r.l)(`${i.B} ${a}`)})}let f=null!==e.lastDeployAt&&o-e.lastDeployAt.getTime()<72e5;if(e.errors30>=20&&!f&&e.httpMonitorId&&n.push({ruleKey:"LogErrors",room:"workloads",action:"recheck",resourceKind:"app",resourceId:e.appId,targetRef:e.httpMonitorId,reason:c(`${e.errors30} errors in the last 30 min`,e.top30,t)}),e.dbErrors30>=3&&e.db){let r=c(`${e.dbErrors30} database connection errors in the last 30 min`,e.topDb,t),a=e.db;("neon_project"===a.kind||"neon_branch"===a.kind)&&a.wakeEndpoint&&u.test(a.wakeEndpoint)?n.push({ruleKey:"LogDbErrors",room:"databases",action:"neon_wake",resourceKind:a.kind,resourceId:a.resourceId,targetRef:a.wakeEndpoint,reason:r}):"supabase_project"===a.kind&&a.supabasePaused&&a.supabaseRef&&d.test(a.supabaseRef)&&n.push({ruleKey:"LogDbErrors",room:"databases",action:"supabase_restore",resourceKind:a.kind,resourceId:a.resourceId,targetRef:a.supabaseRef,reason:r})}return n})(e,t,o).map(i=>{let s="app"===i.resourceKind?(0,r.J)("app",e.appId,e.appName,t):(0,r.J)(i.resourceKind,i.resourceId,null,t);return{alertId:null,ruleKey:i.ruleKey,room:i.room,action:i.action,risk:n.H[i.action].risk,title:(0,r.M)(i.action,s),reason:i.reason,resourceKind:i.resourceKind,resourceId:i.resourceId,resourceName:s,targetRef:i.targetRef,proposedBy:(0,a.y)(i.room),expiresAt:new Date(o.getTime()+n.V)}})},"D",0,function(e,t){let r=e.getTime();return(null===t||!(r-t<27e4))&&(Math.floor(r/6e4)%5==0||null!==t&&r-t>=6e5)},"W",0,function(e,t){let r=new Set(t.map(p));return e.filter(e=>{let t;return"pending"===e.status&&(t=e.ruleKey,o.includes(t))&&!r.has(p(e))}).map(e=>e.id)}],549419);let m=new Set(["MonitorDown","LogErrorSpike"]);e.s(["r",0,72e5,"M",0,m,"s",0,function(e,t){let r=e=>({ok:!1,why:e});if(!e.setting.enabled)return r("off");if(!e.ruleKey||!m.has(e.ruleKey))return r("rule");let a=e.deploy;if(!a||!a.liveAt)return r("no live deploy");let n=t.getTime()-a.liveAt.getTime();return n<0||n>6e4*e.setting.windowMin?r("outside the window"):a.previousId&&e.targetRef===a.previousId&&a.previousId!==a.currentId?a.newestProdCreatedAt&&a.currentCreatedAt.getTime()<a.newestProdCreatedAt.getTime()?r("live deploy is a rollback"):e.rolledOrPromotedLately?r("live deploy came from a rollback or promote"):"ready"!==(a.previousState??"").toLowerCase()?r("previous not ready"):!a.previousCreatedAt||t.getTime()-a.previousCreatedAt.getTime()>2592e6?r("previous too old"):"vulnerable"===e.previousNext?r("previous Next.js has advisories"):"ok"!==e.previousNext?r("previous Next.js unknown"):e.autoLately?r("auto-rollback within 2 h"):e.sameDeployBefore?r("already rolled back once"):e.inFlight?r("another auto-rollback is running"):{ok:!0}:r("target changed")},"u",0,(e,t,a)=>(0,r.l)(`Automatic: the new deploy ${e} errored in the first ${t} minutes. ${a}`),"E",0,e=>e.currentSha&&/^[0-9a-f]{7,40}$/i.test(e.currentSha)?e.currentSha.slice(0,7):e.currentId.slice(0,16)],143926)},447933,e=>{let t;var r,a=e.i(875225),n=e.i(349129),i=e.i(518899),o=e.i(924924),s=e.i(313931),l=e.i(618916),u=e.i(209576),d=e.i(532148),c=e.i(433609),p=e.i(111970),f=e.i(154491),m=e.i(125160),g=e.i(984125),h=e.i(764766),k=e.i(326003),y=e.i(298397),w=e.i(291029),b=e.i(377489),v=e.i(549419),$=e.i(143926),I=e.i(442565),A=e.i(895625),R=e.i(547499),x=e.i(407602),j=e.i(582931),_=e.i(629955),S=e.i(309055),T=e.i(195191);async function O(e,t=S.q){let r,[n]=await (0,o.f)().select({m:l.monitors,appName:l.resources.name,appMeta:l.resources.meta}).from(l.monitors).innerJoin(l.resources,(0,a.u)(l.resources.id,l.monitors.resourceId)).where((0,a.u)(l.monitors.id,e)).limit(1);if(!n)return{ok:!1,error:"That monitor no longer exists."};if("heartbeat"===n.m.kind)return{ok:!1,error:"That monitor is a heartbeat; it has no address to update."};let i=await (0,o.f)().select({id:l.resources.id,name:l.resources.name,meta:l.resources.meta}).from(l.resources).where((0,a.b)((0,a.u)(l.resources.kind,"app"),(0,a.u)(l.resources.monitored,!0),(0,a.M)(l.resources.goneAt),(0,a.c)(l.resources.id,n.m.resourceId))).limit(500),s=(0,h.u)(n.m.url,{name:n.appName,meta:n.appMeta},i,{lastError:n.m.lastError});if(!s)return{ok:!1,error:"Nothing shows this monitor's domain moved (it is still the app's, or never was), so there is nothing to update."};try{r=(0,h.w)(n.m.url,s.to)}catch{return{ok:!1,error:"The app's domain isn't a valid host name, so the monitor was left as it is."}}let u=await t(e,{url:r,expectedStatus:n.m.expectedStatus,timeoutMs:n.m.timeoutMs,bodyContains:n.m.bodyContains,jsonPath:n.m.jsonPath,jsonEquals:n.m.jsonEquals});return u.ok?{ok:!0,message:`Monitor now checks ${r}.`,audit:{message:`Monitor moved to the app's new domain: ${(0,T.F)(r)}`,detail:`was ${(0,T.F)(n.m.url)}`,resourceId:n.m.resourceId}}:u}var P=e.i(145647),M=e.i(479301);async function N(e){if(!(0,M.f)(e))return null;let[t]=await (0,o.f)().select({id:l.resources.id,kind:l.resources.kind,externalId:l.resources.externalId,parentId:l.resources.parentId}).from(l.resources).where((0,a.b)((0,a.u)(l.resources.id,e),(0,a.y)(l.resources.kind,["neon_project","neon_branch"]),(0,a.M)(l.resources.goneAt))).limit(1);if(!t)return null;let r="neon_branch"===t.kind?t.parentId:t.id;if(!r)return null;let[n]=await (0,o.f)().select({data:l.snapshots.data}).from(l.snapshots).where((0,a.u)(l.snapshots.resourceId,r)).limit(1),i=(0,k.k)(k.s,n?.data);return{projectResourceId:r,branchExternalId:"neon_branch"===t.kind?t.externalId:null,computeSeconds:i.computeSeconds??null,periodEnd:i.periodEnd??null}}var D=e.i(472832),z=e.i(800366),E=e.i(628448),C=e.i(443917);let K=`This project used its ${z.a.cuHours} CU-hours; the compute won't start until the quota resets.`;async function H(e,t,r){var a;if(a=new Date,!((t.computeSeconds??0)<3600*z.a.cuHours)&&(!t.periodEnd||new Date(t.periodEnd).getTime()>a.getTime()))return{done:!1,message:K};let n=e.resource.externalId,i=await (0,C.c)(e.token,n,r);if(!i.ok)return{done:!1,message:"missing"===i.kind?E.G:i.error};if(i.data.id!==r||t.branchExternalId&&i.data.branchId!==t.branchExternalId)return{done:!1,message:E.G};if(i.data.disabled)return{done:!1,message:"Neon has disabled this compute, so it can't be started from here."};if("active"===i.data.state)return{done:!1,message:"Already running."};if("init"===i.data.state||"active"===i.data.pendingState)return{done:!1,message:"Already starting."};let o=await (0,C.d)(e.token,n,r);if(o.ok)return{done:!0,message:`Waking ${r}. Ready in a few seconds.`,audit:{message:`Wake requested \xb7 ${r}`,resourceId:e.resource.id}};let s="scope"===o.kind?(0,E.b)("neon",{project:e.resource.name}):"missing"===o.kind?E.G:o.error;return{done:!1,failed:{ok:!1,kind:o.kind,error:s,...o.status?{status:o.status}:{}},audit:{message:`Wake failed \xb7 ${r}`,resourceId:e.resource.id}}}async function B(e,t){let r=t.resource.name;if(e.ok||r.trim().length<2||!e.error.includes(r))return e;let a=await (0,u.f)().catch(()=>null);return{...e,error:a?(0,y.J)(e.error,a,t.resource.id):e.error.split(r).join("db-?")}}async function L(e,t,r,a=D.W){let n=await (0,D.q)(e.id,"wake",r);if(n)return{ok:!1,error:n};let i=await N(t),o=i?await (0,D.p)(i.projectResourceId,"neon_project"):null;return i&&o?B(await a(await H(o,i,r),e,o.account.id),o):{ok:!1,error:E.G}}var V=e.i(11827),W=e.i(843448),U=e.i(342833);let G=e=>`Supabase is busy with this project (${(0,W.P)(e).label.toLowerCase()}). Try again in a few minutes.`,q=(e,t,r)=>({done:!1,failed:{ok:!1,kind:e.kind,error:"scope"===e.kind?(0,E.b)("supabase",{}):e.error,...e.status?{status:e.status}:{}},audit:{message:t,resourceId:r}});async function F(e,t,r,a,n=D.W){let i,o=await (0,D.q)(t.id,e,r);if(o)return{ok:!1,error:o};let s=await (0,D.p)(r,"supabase_project");if(!s)return{ok:!1,error:"This project isn't watched any more, or its credential can't be read."};if(s.resource.externalId!==a)return{ok:!1,error:E.G};let l=s.resource.externalId,u=s.resource.name,d=await (0,U.e)(s.token,l);if(!d.ok)return n({done:!1,message:"scope"===d.kind||"auth"===d.kind?d.error:`Couldn't read this project's status at Supabase: ${d.error}`},t,s.account.id);let c=d.data.status;if("pause"===e){if("INACTIVE"===c||"PAUSING"===c||"GOING_DOWN"===c)return n({done:!1,message:"Already paused."},t,s.account.id);if(!c.startsWith("ACTIVE_"))return n({done:!1,message:G(c)},t,s.account.id);let e=await (0,U.c)(s.token,l);i=e.ok?{done:!0,message:`Pausing ${u}. It takes about 2 minutes.`,audit:{message:`${V.B}${u}`,resourceId:r}}:"transient"===e.kind&&void 0===e.status?{done:!1,failed:{ok:!1,kind:"transient",error:`${e.error} The pause may still have happened; check the project in a few minutes before restoring it.`},audit:{message:`${V.B}${u}`,resourceId:r}}:q(e,`Pause failed \xb7 ${u}`,r)}else{if(c.startsWith("ACTIVE_")||"RESTORING"===c||"COMING_UP"===c)return n({done:!1,message:"Already active or restoring."},t,s.account.id);if("INACTIVE"!==c)return n({done:!1,message:G(c)},t,s.account.id);let e=await (0,U.W)(s.token);if(!e.ok)return n({done:!1,message:`Couldn't count this account's free slots just now: ${e.error}`},t,s.account.id);let a=await (0,_.m)(s.account.id);if(0>=(0,_.G)(e.data,a,d.data.orgSlug))return n({done:!1,message:"This account already uses both free slots. Pause one of its active projects first; Restore stays blocked until it shows Paused."},t,s.account.id);let o=await (0,U.G)(s.token,l);i=o.ok?{done:!0,message:`Restoring ${u}. It takes about 2 minutes.`,audit:{message:`Restore requested \xb7 ${u}`,resourceId:r}}:q(o,`Restore failed \xb7 ${u}`,r)}return n(i,t,s.account.id)}var J=e.i(177706);function X(e,t,r){if("building"===e.state)return"building";if(null!==t&&e.id===t)return"current";if("error"===e.state)return"failed";if("preview"===e.target)return"ready"===e.state?"preview":"other";if("ready"!==e.state||null===t)return"other";let a=r.find(e=>e.id===t);if(!a)return"other";if(e.createdAt.getTime()>a.createdAt.getTime())return"staged";let n=r.filter(e=>"ready"===e.state&&e.id!==t&&e.createdAt.getTime()<a.createdAt.getTime()).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0];return n?.id===e.id?"previous":"other"}let Z=e=>({done:!1,message:e}),Y=(e,t)=>e?.sha?e.sha.slice(0,7):t;async function Q(e,t,r){let a=await (0,D.q)(e.id,t,r);if(a)return a;let n=await (0,D.p)(r,"app"),i=n?.resource.meta.teamId;if(!n||"string"!=typeof i||!i||!n.resource.externalId)return"This app or its Vercel credential isn't available any more. Reload the page.";let o=n.resource.meta.teamSlug;return{member:e,t:n,appId:r,app:n.resource.name,teamId:i,teamSlug:"string"==typeof o?o:"",projectId:n.resource.externalId}}async function ee(e){let[t,r]=await Promise.all([(0,J.c)(e.t.token,e.teamId,e.projectId),(0,J.r)(e.t.token,e.teamId,e.projectId)]);return t.ok?r.ok?{ok:!0,data:{name:t.data.name,currentId:t.data.currentId??r.data[0]?.id??null,production:r.data}}:r:t}async function et(e,t,r,a,n=D.W){return n(t.ok?{done:!0,message:r.message,audit:{message:r.audit,resourceId:e.appId}}:{done:!1,failed:"scope"===t.kind?{ok:!1,kind:"scope",status:t.status,error:(0,E.b)("vercel",{team:e.teamSlug})}:404===t.status?{ok:!1,kind:"missing",status:404,error:"Vercel can't find that deployment any more. Reload and try again."}:{ok:!1,kind:"auth"===t.kind?"auth":"format"===t.kind?"format":"transient",...t.status?{status:t.status}:{},error:t.error},audit:{message:a,resourceId:e.appId}},e.member,e.t.account.id)}async function er(e,t,r,a=D.W){{let n=await Q(e,"redeploy",t);if("string"==typeof n)return a(Z(n),e,"");let i=await ee(n);if(!i.ok)return a(Z(i.error),e,n.t.account.id);if(i.data.currentId!==r)return a(Z(E.G),e,n.t.account.id);if(i.data.production.some(e=>"staged"===X(e,i.data.currentId,i.data.production)))return a(Z("Rolled back: promote a deployment first. A redeploy would stay staged and not go live."),e,n.t.account.id);let o=await (0,J.N)(n.t.token,n.teamId,n.projectId);if(!o.ok)return a(Z(o.error),e,n.t.account.id);if(o.data)return a(Z(`A production build of ${n.app} is already running.`),e,n.t.account.id);let s=Y(i.data.production.find(e=>e.id===r),r),l=await (0,J.L)(n.t.token,n.teamId,{projectId:n.projectId,name:i.data.name,deploymentId:r});return et(n,l,{message:`Redeploy requested. Vercel is building ${n.app} again.`,audit:`Redeploy requested \xb7 ${n.app} \xb7 ${s}`},`Redeploy failed \xb7 ${n.app} \xb7 ${s}`,a)}}async function ea(e,t,r,a=D.W){{let n=await Q(e,"rollback",t);if("string"==typeof n)return a(Z(n),e,"");let i=await ee(n);if(!i.ok)return a(Z(i.error),e,n.t.account.id);if(i.data.currentId===r)return a(Z("Already live."),e,n.t.account.id);let o=i.data.production.find(e=>e.id===r);if(!o||"previous"!==X(o,i.data.currentId,i.data.production))return a(Z("Hobby can only roll back to the previous production deployment."),e,n.t.account.id);let s=Y(o,r),l=await (0,J.E)(n.t.token,n.teamId,n.projectId,r);return et(n,l,{message:`Rolled back ${n.app} to ${s}. New pushes don't go live until you promote one.`,audit:`Rolled back \xb7 ${n.app} → ${s}`},`Roll back failed \xb7 ${n.app} → ${s}`,a)}}var en=e.i(189104),ei=e.i(593111),eo=e.i(425498),es=e.i(77193),el=e.i(570191),eu=e.i(365156);let ed={checkMonitorNow:S.X,keepAliveNow:_.v,wakeAs:L,supabaseAct:F,redeployAs:er,rollbackAs:ea,finish:D.W,recordAction:x.f,limit:ei.f,bumpPrAs:j.W,autoSecurity:()=>(0,el.X)(),recheckDomain:P._,moveMonitorToDomain:O};async function ec(){let[e]=await (0,o.f)().select({at:l.collectorRuns.startedAt}).from(l.collectorRuns).where(i.B`(${l.collectorRuns.trigger} = 'vercel_cron' or (${l.collectorRuns.trigger} = 'manual' and ${l.collectorRuns.tasks} ? 'rollups'))`).orderBy((0,n.A)(l.collectorRuns.startedAt)).limit(1);return e?.at??null}async function ep(e){let t=await (e.lastDailyRunAt??ec)(),r=(e.now??(()=>new Date))();if(t&&r.getTime()-t.getTime()<216e5)return{ok:!1,error:"The daily job ran less than 6 hours ago."};let a=(e.dailyTarget??function(){let e=(0,A.f)();return e?{url:`${(0,R.f)().SITE_URL.replace(/\/+$/,"")}/api/daily`,secret:e.CRON_SECRET}:null})();if(!a)return{ok:!1,error:"The scheduler settings are missing, so the daily job can't be started."};try{let t=await (e.fetch??fetch)(a.url,{headers:{Authorization:`Bearer ${a.secret}`},signal:AbortSignal.timeout(4e4),redirect:"manual"});if(!t.ok||t.status>=300)return{ok:!1,error:`The daily job route answered ${t.status}.`};return{ok:!0,message:`Daily job ran again (${t.status}).`}}catch(e){if(e instanceof Error&&("TimeoutError"===e.name||"AbortError"===e.name))return{ok:!0,message:"Daily job started; it's still running — the heartbeat turns Up when it finishes."};throw e}}let ef="The proposal's target is missing, so it can't run.";async function em(e,t,r=ed){let a="auto"===t,n=a?{id:b.e,userId:null}:{id:t.id,userId:t.userId},i=(e,t,n)=>r.finish(e,t,n,{refresh:!1,...a?{auditPrefix:b.v}:{}});try{if(!e.resourceId||!e.targetRef)return{ok:!1,error:ef};if((0,es.W)()&&"recheck"!==e.action)return await r.recordAction({kind:"ok",message:`${a?b.v:""}${eu.H[e.action].label} (simulated)`,detail:"Simulated in the demo",resourceId:e.resourceId,actorUserId:n.userId}).catch(()=>console.warn("audit event failed")),{ok:!0,message:eo.r};switch(e.action){case"recheck":{let t=await r.limit(en.t.check,n.id);if(!t.allowed)return{ok:!1,error:`Too many checks. Try again in ${(0,en.H)(t.retryAfter)}.`};let i=await r.checkMonitorNow(e.targetRef);if(!i.ok)return{ok:!1,error:i.error};if(i.audit)try{await r.recordAction({kind:!1===i.passed?"err":"ok",...i.audit,message:`${a?b.v:""}${i.audit.message}`,actorUserId:n.userId})}catch{console.warn("audit event failed")}return{ok:!0,message:i.message}}case"domain_recheck":{let t=await r.limit(en.t.domainCheck,n.id);if(!t.allowed)return{ok:!1,error:`Too many checks. Try again in ${(0,en.H)(t.retryAfter)}.`};let i=await (r.recheckDomain??P._)(e.targetRef);if(!i.ok)return i;return await r.recordAction({kind:"ok",...i.audit,message:`${a?b.v:""}${i.audit.message}`,actorUserId:n.userId}).catch(()=>console.warn("audit event failed")),{ok:!0,message:i.message}}case"monitor_update_url":{let t=await r.limit(en.t.monitorWrite,n.id);if(!t.allowed)return{ok:!1,error:`Too many changes. Try again in ${(0,en.H)(t.retryAfter)}.`};let i=await (r.moveMonitorToDomain??O)(e.targetRef);if(!i.ok)return i;return i.audit&&await r.recordAction({kind:"ok",...i.audit,message:`${a?b.v:""}${i.audit.message}`,actorUserId:n.userId}).catch(()=>console.warn("audit event failed")),{ok:!0,message:i.message}}case"daily_rerun":return await ep(r);case"neon_wake":return await r.wakeAs(n,e.resourceId,e.targetRef,i);case"supabase_keepalive":return await r.keepAliveNow(n,e.resourceId,i);case"supabase_restore":return await r.supabaseAct("restore",n,e.resourceId,e.targetRef,i);case"vercel_redeploy":return await r.redeployAs(n,e.resourceId,e.targetRef,i);case"vercel_rollback":return await r.rollbackAs(n,e.resourceId,e.targetRef,i);case"github_bump_pr":{let t=a?await (r.autoSecurity??el.X)():null;if(a&&!t?.enabled)return{ok:!1,error:"Automatic security fixes is off."};return await (r.bumpPrAs??j.W)(n,e.resourceId,e.targetRef,i,{proposalId:e.proposalId??null,...t?{auto:{severities:t.severities}}:{},..."FrameworkVulnerable"===e.ruleKey?{framework:!0}:{}})}default:return{ok:!1,error:ef}}}catch(e){return console.warn(`${s.X.logTag}/proposals run failed:`,e instanceof Error?e.name:"error"),{ok:!1,error:"Something went wrong while running it. Check the console page before trying again."}}}var eg=e.i(588492);let eh={id:w.O.id,room:w.O.room,action:w.O.action,risk:w.O.risk,title:w.O.title,reason:w.O.reason,resourceName:w.O.resourceName,proposedBy:w.O.proposedBy,status:w.O.status,auto:w.O.auto,result:w.O.result,createdAt:w.O.createdAt,decidedAt:w.O.decidedAt,expiresAt:w.O.expiresAt},ek={...eh,resourceId:w.O.resourceId,targetRef:w.O.targetRef,ruleKey:w.O.ruleKey,alertId:w.O.alertId};async function ey(e,t,r){let n=(0,b.z)(e,t),s=new Set(n.deployApps),u=e.filter(e=>("MonitorDown"===e.ruleKey||"HighLatency"===e.ruleKey)&&e.resourceId&&s.has(e.resourceId)&&e.startedAt),[d,p,f,m,g,k,y,w,v]=await Promise.all([n.monitorIds.length?(0,o.f)().select({id:l.monitors.id,kind:l.monitors.kind,url:l.monitors.url,lastError:l.monitors.lastError,appId:l.monitors.resourceId,appName:l.resources.name,appMeta:l.resources.meta}).from(l.monitors).innerJoin(l.resources,(0,a.u)(l.resources.id,l.monitors.resourceId)).where((0,a.y)(l.monitors.id,n.monitorIds)):[],n.deployApps.length?(0,o.f)().select({app:l.deployments.resourceId,id:l.deployments.externalId,isCurrent:l.deployments.isCurrent,isPrevious:l.deployments.isPreviousProduction,readyAt:l.deployments.readyAt,createdAt:l.deployments.createdAtProvider}).from(l.deployments).where((0,a.b)((0,a.y)(l.deployments.resourceId,n.deployApps),(0,a.F)((0,a.u)(l.deployments.isCurrent,!0),(0,a.u)(l.deployments.isPreviousProduction,!0)))):[],n.supabaseIds.length?(0,o.f)().select({id:l.resources.id,ref:l.resources.externalId}).from(l.resources).where((0,a.b)((0,a.y)(l.resources.id,n.supabaseIds),(0,a.u)(l.resources.kind,"supabase_project"),i.B`${l.resources.goneAt} is null`)):[],n.monitorApps.length?eA(n.monitorApps):new Map,n.depApps.length?e$(e,n.depApps).catch(()=>new Set).then(e=>(0,c.C)(n.depApps,e)).catch(()=>new Map):new Map,n.monitorIds.length?eI(n.monitorIds):null,n.frameworkApps.length?(0,j.h)(n.frameworkApps,n.depApps).catch(()=>new Map):new Map,u.length?ew(u.map(e=>e.subject),t).catch(()=>[]):[],eb(n.deployApps)]),$=d.some(e=>null!==(0,h.Y)(e.appMeta)),I=$?await (0,o.f)().select({id:l.resources.id,name:l.resources.name,meta:l.resources.meta}).from(l.resources).where((0,a.b)((0,a.u)(l.resources.kind,"app"),(0,a.u)(l.resources.monitored,!0),(0,a.M)(l.resources.goneAt))).limit(500):[],A=$?(0,h.P)(d,I):new Map,R=[...[...g].map(([e,t])=>({appId:e,repoId:t})),...[...y].map(([e,t])=>({appId:e,repoId:t.repoId}))],x=R.length?await Promise.resolve().then(()=>(0,j.H)(R,t)).catch(()=>new Map):new Map,_=new Map,S=new Map;for(let e of p){let t=_.get(e.app)??{currentId:null,previousId:null,liveAt:null};e.isCurrent?(t.currentId=e.id,t.liveAt=e.readyAt??e.createdAt??null):e.isPrevious&&(t.previousId=e.id,S.set(e.app,e.readyAt??e.createdAt??null)),_.set(e.app,t)}let T=new Map;for(let[e,t]of _)t.previousId&&T.set(e,ev(v,e,t.liveAt,S.get(e)??null));let O=new Map(u.map(e=>[e.id,(0,eg.g)(e.startedAt,w.filter(t=>t.ruleKey===e.ruleKey&&t.subject===e.subject),{ruleKey:e.ruleKey,liveAt:_.get(e.resourceId)?.liveAt??null})]));return{monitorKinds:new Map(d.map(e=>[e.id,String(e.kind)])),deploys:_,...void 0!==r?{rollbackWindowMs:r}:{},supabaseRefs:new Map(f.map(e=>[e.id,e.ref])),neonSuspended:m,fixableRepos:g,dailyHeartbeatId:k,frameworkFixes:y,monitorMoves:A,problemSince:O,previousNext:T,...x.size?{productionMismatch:x}:{}}}async function ew(e,t){return(0,o.f)().select({ruleKey:l.alerts.ruleKey,subject:l.alerts.subject,startedAt:l.alerts.startedAt,resolvedAt:l.alerts.resolvedAt}).from(l.alerts).where((0,a.b)((0,a.y)(l.alerts.ruleKey,["MonitorDown","HighLatency"]),(0,a.y)(l.alerts.subject,[...new Set(e)]),(0,a.E)(l.alerts.resolvedAt),(0,a.B)(l.alerts.resolvedAt,new Date(t.getTime()-eg.A)))).orderBy((0,n.A)(l.alerts.startedAt)).limit(500)}async function eb(e){let t={checks:new Map,events:new Map,frameworks:new Map};if(!e.length)return t;try{let[r,i,s]=await Promise.all([(0,o.f)().select({app:l.appSecurity.resourceId,version:l.appSecurity.version,status:l.appSecurity.status,findings:l.appSecurity.findings,checkedAt:l.appSecurity.checkedAt,reason:l.appSecurity.reason}).from(l.appSecurity).where((0,a.y)(l.appSecurity.resourceId,e)).limit(e.length),(0,o.f)().select({app:l.events.resourceId,at:l.events.at,reason:l.events.reason,message:l.events.message}).from(l.events).where((0,a.b)((0,a.y)(l.events.reason,[...eg.Y]),(0,a.y)(l.events.resourceId,e))).orderBy((0,n.A)(l.events.at)).limit(Math.min(500,50*e.length)),(0,o.f)().select({app:l.resources.id,meta:l.resources.meta}).from(l.resources).where((0,a.y)(l.resources.id,e)).limit(e.length)]);for(let e of r)t.checks.set(e.app,{version:e.version,status:e.status,findings:Array.isArray(e.findings)?e.findings:[],checkedAt:e.checkedAt,reason:e.reason});for(let e of i)e.app&&t.events.set(e.app,[...t.events.get(e.app)??[],{at:e.at,reason:e.reason,message:e.message}]);for(let e of s){let r=e.meta&&"object"==typeof e.meta?e.meta.framework:null;t.frameworks.set(e.app,"string"==typeof r?r:null)}}catch{return{checks:new Map,events:new Map,frameworks:new Map}}return t}let ev=(e,t,r,a)=>(0,eg.Q)({currentLiveAt:r,previousLiveAt:a,check:e.checks.get(t)??null,events:e.events.get(t)??[],framework:e.frameworks.get(t)??null});async function e$(e,t){let r=new Set(t),n=e.filter(e=>"FrameworkVulnerable"===e.ruleKey&&"app"===e.resourceKind&&e.resourceId&&r.has(e.resourceId)).map(e=>e.id);return n.length?new Set((await (0,o.f)().selectDistinct({resourceId:w.O.resourceId}).from(w.O).where((0,a.b)((0,a.u)(w.O.ruleKey,"FrameworkVulnerable"),(0,a.u)(w.O.action,"github_bump_pr"),(0,a.y)(w.O.status,["pending","approved","running","done"]),(0,a.y)(w.O.alertId,n),(0,a.y)(w.O.resourceId,[...r]))).limit(n.length)).flatMap(e=>e.resourceId?[e.resourceId]:[])):new Set}async function eI(e){let t=(0,m.i)(process.env.DAILY_HEARTBEAT_TOKEN);if(!t)return null;let[r]=await (0,o.f)().select({id:l.monitors.id}).from(l.monitors).where((0,a.b)((0,a.y)(l.monitors.id,e),(0,a.u)(l.monitors.kind,"heartbeat"),(0,a.u)(l.monitors.tokenHash,(0,g.f)(t)))).limit(1).catch(()=>[]);return r?.id??null}async function eA(e){let t=await (0,o.f)().select({app:l.links.fromResourceId,id:l.resources.id,kind:l.resources.kind,externalId:l.resources.externalId,parentId:l.resources.parentId}).from(l.links).innerJoin(l.resources,(0,a.u)(l.resources.id,l.links.toResourceId)).where((0,a.b)((0,a.y)(l.links.fromResourceId,e),(0,a.u)(l.links.kind,"uses_db"),(0,a.y)(l.resources.kind,["neon_project","neon_branch"]),i.B`${l.resources.goneAt} is null`)),r=new Map;if(!t.length)return r;let n=e=>"neon_branch"===e.kind?e.parentId:e.id,s=[...new Set(t.map(n).filter(e=>!!e))];if(!s.length)return r;let u=new Map((await (0,o.f)().select({id:l.snapshots.resourceId,data:l.snapshots.data}).from(l.snapshots).where((0,a.y)(l.snapshots.resourceId,s))).map(e=>[e.id,(0,k.k)(k.s,e.data)]));for(let e of t){let t=n(e),a=t?u.get(t):void 0,i=a?(0,b.Z)(a.endpoints,a.branches,"neon_branch"===e.kind?e.externalId:null):null;i&&r.set(e.app,{resourceId:e.id,resourceKind:e.kind,endpointId:i})}return r}async function eR(e){if(!e.length)return[];let t=new Set((await (0,o.f)().select({alertId:w.O.alertId,action:w.O.action}).from(w.O).where((0,a.y)(w.O.alertId,[...new Set(e.map(e=>e.alertId))]))).map(e=>`${e.alertId}:${e.action}`)),r=e.filter(e=>!t.has(`${e.alertId}:${e.action}`));return r.length?(0,o.f)().insert(w.O).values(r.map(e=>({...e,status:"pending"}))).onConflictDoNothing().returning(ek):[]}async function ex(e,t,r,n){let[s]=await (0,o.f)().update(w.O).set({status:"approve"===t?"approved":"rejected",decidedBy:r,decidedAt:n}).where((0,a.b)((0,a.u)(w.O.id,e),(0,a.u)(w.O.status,"pending"),i.B`${w.O.expiresAt} > ${n.toISOString()}::timestamptz`)).returning(ek);if(s)return{status:"ok",proposal:(0,b.E)(s),row:s};let[l]=await (0,o.f)().select(eh).from(w.O).where((0,a.u)(w.O.id,e)).limit(1);return l?{status:"conflict",proposal:(0,b.E)(l)}:{status:"missing"}}async function ej(e,t){let[r]=await (0,o.f)().update(w.O).set({status:"running",claimedAt:t}).where((0,a.b)((0,a.u)(w.O.id,e),(0,a.u)(w.O.status,"approved"))).returning(ek);return r??null}async function e_(e,t,r,n){let[i]=await (0,o.f)().update(w.O).set({status:t?"done":"failed",result:r,finishedAt:n}).where((0,a.b)((0,a.u)(w.O.id,e),(0,a.u)(w.O.status,"running"))).returning(ek);return i??null}let eS={run:(e,t)=>em(e,t),book:()=>(0,u.f)()};async function eT(e,t,r,a=eS){let n=await ej(e,r);if(!n)return null;let i=await a.run({action:n.action,resourceId:n.resourceId,targetRef:n.targetRef,proposalId:n.id,ruleKey:n.ruleKey??null},t),o=await a.book().catch(()=>y.a),s=await e_(e,i.ok,(0,b.x)(i,o),new Date);return s?(0,b.E)(s):null}async function eO(e,t){let r=await (0,o.f)().update(w.O).set({status:"expired",result:"Expired: nobody decided in time, or the alert stopped firing."}).where((0,a.b)((0,a.u)(w.O.status,"pending"),(0,a.F)((0,a.S)(w.O.expiresAt,new Date(t.getTime()+1)),(0,a.b)((0,a.E)(w.O.alertId),e.length?(0,a.$)(w.O.alertId,e):i.B`true`)))).returning({id:w.O.id});return await (0,o.f)().update(w.O).set({status:"failed",result:"The run was interrupted. Check the console page before trying again.",finishedAt:t}).where((0,a.b)((0,a.u)(w.O.status,"running"),(0,a.S)(w.O.claimedAt,new Date(t.getTime()-b.L)))),r.length}async function eP(e){await (0,o.f)().delete(w.O).where((0,a.b)((0,a.S)(w.O.createdAt,new Date(e.getTime()-2592e6)),(0,a.$)(w.O.status,["pending","approved","running"])))}let eM=i.B`(${l.storedLogs.level} in ('error', 'fatal') or coalesce(${l.storedLogs.statusCode}, 0) >= 500)`,eN=i.B`coalesce(${l.deployments.readyAt}, ${l.deployments.createdAtProvider})`;async function eD(e){let t=await (0,o.f)().select({app:l.links.fromResourceId,id:l.resources.id,kind:l.resources.kind,externalId:l.resources.externalId,parentId:l.resources.parentId}).from(l.links).innerJoin(l.resources,(0,a.u)(l.resources.id,l.links.toResourceId)).where((0,a.b)((0,a.y)(l.links.fromResourceId,e),(0,a.u)(l.links.kind,"uses_db"),(0,a.y)(l.resources.kind,["neon_project","neon_branch","supabase_project"]),(0,a.M)(l.resources.goneAt))),r=new Map;if(!t.length)return r;let n=e=>"neon_branch"===e.kind?e.parentId:e.id,i=[...new Set(t.map(n).filter(e=>!!e))],s=new Map((i.length?await (0,o.f)().select({id:l.snapshots.resourceId,data:l.snapshots.data}).from(l.snapshots).where((0,a.y)(l.snapshots.resourceId,i)):[]).map(e=>[e.id,e.data]));for(let e of t){let t=s.get(n(e)??"");if("supabase_project"===e.kind){let a=(0,k.k)(k.B,t);r.set(e.app,{resourceId:e.id,kind:e.kind,wakeEndpoint:null,supabaseRef:e.externalId,supabasePaused:"INACTIVE"===a.status})}else{let a=(0,k.k)(k.s,t);r.set(e.app,{resourceId:e.id,kind:e.kind,wakeEndpoint:(0,b.Z)(a.endpoints,a.branches,"neon_branch"===e.kind?e.externalId:null),supabaseRef:null,supabasePaused:!1})}}return r}let ez={apps:async function(e){let t=new Date(e.getTime()-v.I-v.s),r=i.B`${l.storedLogs.at} >= ${new Date(e.getTime()-v.H).toISOString()}::timestamptz`,n=i.B`${l.storedLogs.message} ~* ${v.N}`,s=i.B`left(${l.storedLogs.message}, 200)`,u=(await (0,o.f)().select({appId:l.storedLogs.resourceId,appName:i.B`max(${l.resources.name})`,liveAt:i.B`max(${eN})`.mapWith(l.deployments.readyAt),currentId:i.B`max(${l.deployments.externalId})`,errorsSinceLive:i.B`count(*) filter (where ${eM} and ${l.storedLogs.at} >= ${eN})`.mapWith(Number),baselineErrors:i.B`count(*) filter (where ${eM} and ${l.storedLogs.at} >= ${eN} - interval '24 hours' and ${l.storedLogs.at} < ${eN})`.mapWith(Number),topSinceLive:i.B`mode() within group (order by ${s}) filter (where ${eM} and ${l.storedLogs.at} >= ${eN})`,errors30:i.B`count(*) filter (where ${eM} and ${r})`.mapWith(Number),top30:i.B`mode() within group (order by ${s}) filter (where ${eM} and ${r})`,dbErrors30:i.B`count(*) filter (where ${r} and ${n})`.mapWith(Number),topDb:i.B`mode() within group (order by ${s}) filter (where ${r} and ${n})`}).from(l.storedLogs).innerJoin(l.resources,(0,a.u)(l.resources.id,l.storedLogs.resourceId)).leftJoin(l.deployments,(0,a.b)((0,a.u)(l.deployments.resourceId,l.storedLogs.resourceId),(0,a.u)(l.deployments.isCurrent,!0))).where((0,a.b)((0,a.B)(l.storedLogs.at,t),(0,a.u)(l.resources.kind,"app"),(0,a.M)(l.resources.goneAt))).groupBy(l.storedLogs.resourceId)).filter(e=>e.errorsSinceLive>=v.w||e.errors30>=v.G||e.dbErrors30>=v.V);if(!u.length)return[];let d=u.map(e=>e.appId),[c,p,f]=await Promise.all([(0,o.f)().select({app:l.deployments.resourceId,previousId:i.B`max(${l.deployments.externalId}) filter (where ${l.deployments.isPreviousProduction})`,previousLiveAt:i.B`max(${eN}) filter (where ${l.deployments.isPreviousProduction})`.mapWith(l.deployments.readyAt),lastDeployAt:i.B`max(${l.deployments.createdAtProvider}) filter (where ${l.deployments.target} = 'production')`.mapWith(l.deployments.createdAtProvider)}).from(l.deployments).where((0,a.b)((0,a.y)(l.deployments.resourceId,d),(0,a.F)((0,a.u)(l.deployments.isPreviousProduction,!0),(0,a.B)(l.deployments.createdAtProvider,new Date(e.getTime()-v.v))))).groupBy(l.deployments.resourceId),(0,o.f)().select({app:l.monitors.resourceId,id:l.monitors.id}).from(l.monitors).where((0,a.b)((0,a.y)(l.monitors.resourceId,d),(0,a.u)(l.monitors.kind,"http"),(0,a.u)(l.monitors.paused,!1),(0,a.u)(l.monitors.ownerPaused,!1))).orderBy(l.monitors.createdAt),eD(d)]),m=new Map(c.map(e=>[e.app,e])),g=new Map;for(let e of p)g.has(e.app)||g.set(e.app,e.id);let h=u.filter(e=>e.errorsSinceLive>=v.w&&e.liveAt&&m.get(e.appId)?.previousId).map(e=>e.appId),k=h.length?await eb(h):null;return u.map(e=>({...e,appName:e.appName??"",previousId:m.get(e.appId)?.previousId??null,lastDeployAt:m.get(e.appId)?.lastDeployAt??null,httpMonitorId:g.get(e.appId)??null,db:f.get(e.appId)??null,...k&&h.includes(e.appId)?{previousNext:ev(k,e.appId,e.liveAt,m.get(e.appId)?.previousLiveAt??null)}:{}}))},rows:async function(e){let t=i.B`coalesce(${w.O.finishedAt}, ${w.O.decidedAt}, ${w.O.expiresAt})`;return(0,o.f)().select({id:w.O.id,ruleKey:w.O.ruleKey,resourceId:w.O.resourceId,action:w.O.action,status:w.O.status,closedAt:t.mapWith(w.O.finishedAt)}).from(w.O).where((0,a.b)((0,a.M)(w.O.alertId),(0,a.y)(w.O.ruleKey,[...v.T]),(0,a.F)((0,a.y)(w.O.status,["pending","approved","running"]),i.B`${t} > ${new Date(e.getTime()-v.b).toISOString()}::timestamptz`)))}};async function eE(e,t,r=ez){let[n,i]=await Promise.all([r.apps(e),r.rows(e)]),s=n.flatMap(r=>(0,v.t)(r,t,e)),l=(0,v.W)(i,s),u=0;l.length&&(u=(await (0,o.f)().update(w.O).set({status:"expired",result:"Expired: the logs no longer show it.",finishedAt:e}).where((0,a.b)((0,a.y)(w.O.id,l),(0,a.u)(w.O.status,"pending"))).returning({id:w.O.id})).length);let d=(0,v.x)(s,i,e);return d.length?{created:await (0,o.f)().insert(w.O).values(d.map(e=>({...e,status:"pending"}))).onConflictDoNothing().returning(ek),expired:u}:{created:[],expired:u}}let eC=null;async function eK(e,t){return(0,v.D)(e,eC)?(eC=e.getTime(),eE(e,await t())):{created:[],expired:0}}async function eH(e,t){return(await (0,o.f)().update(w.O).set({status:"approved",auto:!0,decidedAt:t}).where((0,a.b)((0,a.u)(w.O.id,e),(0,a.u)(w.O.status,"pending"),(0,a.u)(w.O.risk,"safe"))).returning({id:w.O.id})).length>0}async function eB(e,t){let r=new Date(t.getTime()-$.r),[n,s,u,d,c]=await Promise.all([(0,o.f)().select({app:l.deployments.resourceId,id:l.deployments.externalId,sha:l.deployments.commitSha,state:l.deployments.state,isCurrent:l.deployments.isCurrent,isPrevious:l.deployments.isPreviousProduction,readyAt:l.deployments.readyAt,createdAt:l.deployments.createdAtProvider}).from(l.deployments).where((0,a.b)((0,a.y)(l.deployments.resourceId,e),(0,a.F)((0,a.u)(l.deployments.isCurrent,!0),(0,a.u)(l.deployments.isPreviousProduction,!0)))),(0,o.f)().select({app:l.deployments.resourceId,at:i.B`max(${l.deployments.createdAtProvider})`.mapWith(l.deployments.createdAtProvider)}).from(l.deployments).where((0,a.b)((0,a.y)(l.deployments.resourceId,e),(0,a.u)(l.deployments.target,"production"),(0,a.u)(l.deployments.state,"ready"))).groupBy(l.deployments.resourceId),(0,o.f)().select({app:l.events.resourceId}).from(l.events).where((0,a.b)((0,a.u)(l.events.type,"action"),(0,a.y)(l.events.resourceId,e),(0,a.B)(l.events.at,r),i.B`${l.events.message} ~ ${eL}`)),(0,o.f)().select({app:w.O.resourceId,targetRef:w.O.targetRef,status:w.O.status,decidedAt:w.O.decidedAt}).from(w.O).where((0,a.b)((0,a.u)(w.O.action,"vercel_rollback"),(0,a.u)(w.O.auto,!0),(0,a.B)(w.O.createdAt,new Date(t.getTime()-26784e5)))),eb(e)]),p=new Map;for(let t of e){let e=n.find(e=>e.app===t&&e.isCurrent),a=n.find(e=>e.app===t&&e.isPrevious&&!e.isCurrent),i=d.filter(e=>e.app===t);p.set(t,{deploy:e?{currentId:e.id,currentSha:e.sha,liveAt:e.readyAt??e.createdAt,currentCreatedAt:e.createdAt,newestProdCreatedAt:s.find(e=>e.app===t)?.at??null,previousId:a?.id??null,previousState:a?.state??null,previousCreatedAt:a?.createdAt??null}:null,rolledOrPromotedLately:u.some(e=>e.app===t),autoLately:i.some(e=>null!==e.decidedAt&&e.decidedAt.getTime()>=r.getTime()),sameDeployBefore:!!a&&i.some(e=>e.targetRef===a.id),previousNext:e&&a?ev(c,t,e.readyAt??e.createdAt,a.readyAt??a.createdAt).status:"unknown"})}return{apps:p,inFlight:d.some(e=>"approved"===e.status||"running"===e.status)}}let eL="(Rolled back|Promoted|Preview promoted) ·";async function eV(e,t,r){return(await (0,o.f)().update(w.O).set({status:"approved",auto:!0,decidedAt:r,reason:t}).where((0,a.b)((0,a.u)(w.O.id,e),(0,a.u)(w.O.status,"pending"),(0,a.u)(w.O.action,"vercel_rollback"),i.B`not exists (select 1 from ops.action_proposals x where x.action = 'vercel_rollback' and x.auto and x.status in ('approved', 'running'))`)).returning({id:w.O.id})).length>0}async function eW(e,t,r,a){let n=e.filter(e=>"vercel_rollback"===e.action&&e.ruleKey&&$.M.has(e.ruleKey)&&e.resourceId);if(!n.length||!a.autoRollback||!a.rollbackContext||!a.approveAutoRollback)return[];let i=await a.autoRollback().catch(()=>null);if(!i?.enabled||15e3>r())return[];let o=[];try{let e=await a.rollbackContext([...new Set(n.map(e=>e.resourceId))],t),l=e.inFlight;for(let u of n){let n=e.apps.get(u.resourceId);if(!n||12e3>r())continue;let d=(0,$.s)({setting:i,ruleKey:u.ruleKey??null,targetRef:u.targetRef,inFlight:l,...n},t);if(!d.ok){console.log(`${s.X.logTag}/auto-rollback: skipped (${d.why})`);continue}let c=(0,$.E)(n.deploy);if(!await a.approveAutoRollback(u.id,(0,$.u)(c,i.windowMin,u.reason),new Date))continue;l=!0;let p=await a.execute(u.id,new Date);if(p){o.push(p),await (a.notifyRollback??I.q)(p,{reason:u.reason,newRef:c},{},{alertId:u.alertId??null}).catch(()=>void 0);break}}}catch(e){console.warn(`${s.X.logTag}/auto-rollback failed:`,e instanceof Error?e.name:"error")}return o}async function eU(e,t){return(await (0,o.f)().update(w.O).set({status:"approved",auto:!0,decidedAt:t}).where((0,a.b)((0,a.u)(w.O.id,e),(0,a.u)(w.O.status,"pending"),(0,a.u)(w.O.action,"github_bump_pr"))).returning({id:w.O.id})).length>0}async function eG(e,t,r){let a=e.filter(e=>"github_bump_pr"===e.action&&e.targetRef);if(!a.length||!r.autoSecurity||!r.bumpReady||!r.approveAutoBump)return[];let n=await r.autoSecurity().catch(()=>null);if(!n?.enabled||!n.severities.length)return[];let i=[];for(let e of a){if(15e3>t())break;try{if(e.resourceId&&r.prodMismatch?await r.prodMismatch(e.resourceId,e.targetRef).catch(()=>"unknown"):null){console.log(`${s.X.logTag}/auto-security: waits for the owner (production source)`);continue}let t="FrameworkVulnerable"===e.ruleKey&&e.resourceId?await r.bumpReady(e.targetRef,n.severities,{appId:e.resourceId}):await r.bumpReady(e.targetRef,n.severities);if(!t.ok){console.log(`${s.X.logTag}/auto-security: waits for the owner (${t.why})`);continue}if(!await r.approveAutoBump(e.id,new Date))continue;let a=await r.execute(e.id,new Date);a&&i.push(a)}catch(e){console.warn(`${s.X.logTag}/auto-security failed:`,e instanceof Error?e.name:"error")}}return i}async function eq(e,t){return(await (0,j.H)([{appId:e,repoId:t}],new Date)).get(e)??null}async function eF(e){return new Map((await (0,o.f)().select({id:l.accounts.id,provider:l.accounts.provider}).from(l.accounts).where((0,a.y)(l.accounts.id,e))).map(e=>[e.id,e.provider]))}let eJ={firing:()=>(0,d.q)(),book:()=>(0,u.f)(),facts:ey,create:eR,expire:eO,autoRun:el.I,approveAuto:eH,execute:(e,t)=>eT(e,"auto",t),notifyNew:I.i,notifyResult:I.b,logs:eK,autoRollback:()=>(0,el.K)(),rollbackContext:eB,approveAutoRollback:eV,notifyRollback:I.q,autoSecurity:()=>(0,el.X)(),bumpReady:j.J,approveAutoBump:eU,paused:p.I,providers:eF,prodMismatch:eq};async function eX(e,t={},r=eJ){let a={created:0,expired:0,autoRan:0},n=()=>(t.deadline??1/0)-Date.now(),i=await r.firing();a.expired=await r.expire(i.map(e=>e.id),e);let o=r.paused?await r.paused().catch(()=>new Set):new Set,l=[...new Set(i.flatMap(e=>e.accountId?[e.accountId]:[]))],u=o.size&&l.length&&r.providers?await r.providers(l).catch(()=>new Map):new Map,d=i.filter(e=>!(0,f.O)(o,e.ruleKey,e.accountId?u.get(e.accountId):null)),c=null,p=()=>c??=r.book().catch(()=>y.a),m=[],g=(0,b.z)(d,e);if(Object.values(g).some(e=>e.length>0)){let t=g.deployApps.length&&r.autoRollback?await r.autoRollback().catch(()=>null):null,a=await r.facts(d,e,t?6e4*t.windowMin:void 0),n=await p(),i=d.flatMap(t=>(0,b.t)(t,a,n,e)).filter(e=>!("github_bump_pr"===e.action&&o.has("devops")));m.push(...await r.create(i))}if(n()>1e4&&!o.has("hosting"))try{let t=await r.logs(e,p);m.push(...t.created),a.expired+=t.expired}catch(e){console.warn(`${s.X.logTag}/proposals logs failed:`,e instanceof Error?e.name:"error")}if(a.created=m.length,!m.length)return a;let h=await r.autoRun().catch(()=>null),k=await eW(m,e,n,r);a.autoRan+=k.length;let w=await eG(m.filter(e=>!k.some(t=>t.id===e.id)),n,r),v=new Set(k.map(e=>e.id)),$=[...w];for(let e of(a.autoRan+=w.length,w))v.add(e.id);for(let e of m){if(v.has(e.id)||!h||!(0,b.I)(e.action,h)||8e3>n()||!await r.approveAuto(e.id,new Date))continue;let t=await r.execute(e.id,new Date);t&&($.push(t),a.autoRan++)}let I=new Set([...$.map(e=>e.id),...v]),A=m.filter(e=>"LogErrorSpike"===e.ruleKey&&e.resourceId).map(e=>({proposalId:e.id,appId:e.resourceId})),R=A.length&&r.queueDev?await r.queueDev(A,e).catch(()=>new Set):new Set,x=new Map(m.map(e=>[e.id,e.alertId??null]));for(let e of(await r.notifyNew(m.filter(e=>!I.has(e.id)).map(b.E),{},{devQueued:R,alertIds:x}).catch(()=>void 0),$))await r.notifyResult(e,{},{alertId:x.get(e.id)??null}).catch(()=>void 0);return a}let eZ=(r={},t={...eJ,queueDev:r.queueDev},async(e,r)=>{try{let a=await eX(e,r??{},t);(a.created||a.expired||a.autoRan)&&console.log(`${s.X.logTag}/proposals: ${a.created} new, ${a.expired} expired, ${a.autoRan} auto-ran`)}catch(e){console.warn(`${s.X.logTag}/proposals failed:`,e instanceof Error?e.name:"error")}});e.s(["V",0,ex,"N",0,eT,"Z",0,eZ,"t",0,eP],447933)},442565,e=>{var t=e.i(313931),r=e.i(872281),a=e.i(483100),n=e.i(224382),i=e.i(220642),o=e.i(547499),s=e.i(695811),l=e.i(76012),u=e.i(298397),d=e.i(635982),c=e.i(570191),p=e.i(365156);let f={target:a.Q,book:()=>(0,r.f)(),siteUrl:()=>(0,o.f)().SITE_URL,autoRun:()=>(0,c.I)(),send:(e,t,r,a,n)=>(0,l.I)(e,t,r,{...a?{replyMarkup:a}:{},...n?{replyTo:n}:{}}),record:(e,t)=>(0,a.P)("telegram",e,t),lang:()=>(0,s.H)("telegram"),discord:()=>(0,a.G)(),sendDiscord:(e,t)=>(0,n.f)(e,t,{timeoutMs:$}),recordDiscord:(e,t)=>(0,a.P)("discord",e,t),discordLang:()=>(0,s.H)("discord"),buttons:()=>e.A(106025).then(e=>e.approvalButtons()),thread:e=>(0,a.M)(e)},m={en:{pending:"Status: ⏳ waiting",dev:"🧑‍💻 Dev is checking the code",proposer:t.X.notifyFallback.en,app:"app",safe:"safe",risky:"needs care",proposes:"proposes",why:"Why",risk:"Risk",open:"Open in Auto-actions",waitingN:"new proposals waiting for approval:",moreN:"more proposals",automatic:"Automatic",rollbackWhy:"the app errored after the new deploy",succeeded:"Succeeded",failed:"Failed",stopFallback:"something failed"},id:{pending:"Status: ⏳ menunggu",dev:"🧑‍💻 Dev lagi cek kodenya",proposer:t.X.notifyFallback.id,app:"aplikasi",safe:"aman",risky:"perlu hati-hati",proposes:"usul",why:"Kenapa",risk:"Risiko",open:"Buka di Auto-actions",waitingN:"usulan baru menunggu persetujuan:",moreN:"usulan lagi",automatic:"Otomatis",rollbackWhy:"app-nya error setelah deploy baru",succeeded:"Berhasil",failed:"Gagal",stopFallback:"ada yang gagal"}},g={recheck:"Cek ulang sekarang",neon_wake:"Bangunin Neon",supabase_keepalive:"Kirim keep-alive Supabase",supabase_restore:"Restore project Supabase",vercel_redeploy:"Redeploy production",vercel_rollback:"Rollback ke deploy sebelumnya",github_bump_pr:"Bikin PR update paket",domain_recheck:"Cek ulang sertifikat domain",daily_rerun:"Jalanin ulang daily job",monitor_update_url:"Arahin monitor ke domain baru"},h=(e="en")=>(0,s.t)(m,e,"dev"),k=(e,t)=>("id"===t?g[e.action]:void 0)??p.H[e.action]?.label??e.actionLabel,y=(e,t)=>(0,s.t)(m,t,"risky"===e.risk||p.H[e.action]?.risk==="risky"?"risky":"safe"),w=(e,t)=>`${e.replace(/\/+$/,"")}/auto-actions${t?`?proposal=${encodeURIComponent(t)}`:""}`;function b(e,t,r,a=!1,n="en"){let o=e=>(0,s.t)(m,n,e),l=(0,d.R)(e.proposedBy,t,60)||o("proposer"),u=(0,d.R)(e.title,t,120),c=(0,d.R)(e.reason,t,200)||"-";return[`🧑‍✈️ ${(0,i.H)(l)} ${o("proposes")}: ${(0,i.H)(k(e,n))} — ${(0,i.H)(u)}`,`${o("why")}: ${(0,i.H)(c)}`,`${o("risk")}: ${y(e,n)}`,...a?[h(n)]:[],`${o("open")}: ${(0,i.H)(w(r,e.id))}`].join("\n")}let v=new Set(["recheck","domain_recheck"]),$=3e3,I={en:{proposed:"📝 Proposed",approved:"✅ Approved by the owner",rejected:"🚫 Rejected by the owner",done:"⚙️ Ran",failed:"❌ Failed",waiting:"waiting for approval on Telegram.",newN:"new proposals"},id:{proposed:"📝 Usulan",approved:"✅ Disetujui owner",rejected:"🚫 Ditolak owner",done:"⚙️ Dijalankan",failed:"❌ Gagal",waiting:"nunggu persetujuan di Telegram.",newN:"usulan baru"}};function A(e,t,r,a="en"){let n=e=>(0,s.t)(I,a,e);if(Array.isArray(t))return`📝 ${t.length} ${n("newN")} — ${n("waiting")}`;let i=((0,d.g)(t.title,r,120)||k(t,a)).replace(/[*_`~|\[\]<>]/g,"");if("proposed"===e)return`${n("proposed")}: ${i} — ${n("waiting")}`;if("approved"===e||"rejected"===e)return`${n(e)}: ${i}`;let o=t.result?(0,d.g)(t.result,r,200).replace(/[*_`~|\[\]<>]/g,""):"";return`${n(e)}: ${i}${o?` — ${o}`:""}`}async function R(e,r,a){try{let n,i=await r.discord();if(!i)return;let o=await r.book().catch(()=>u.a),s=await r.discordLang().catch(()=>"en"),l=e(o,s);if(!l.length)return;try{n=await r.sendDiscord(i.url,l.join("\n"))}catch{n={ok:!1,kind:"transient",error:"Discord didn't answer."}}await r.recordDiscord(n,a).catch(()=>console.warn(`${t.X.logTag}/discord: recording the result failed`))}catch{console.warn(`${t.X.logTag}/discord: sending the action history failed`)}}async function x(e,t,r={},a={}){let n={...f,...r};await _(()=>R((r,a)=>[A(e,t,r,a)],n,a.now??new Date),a.timeoutMs??$)}async function j(e,r,a){let n=await r.target();if(!n)return;let i=await r.book().catch(()=>u.a),o=await r.lang().catch(()=>"en");for(let s of(await e(i,o))){let e;try{e="string"==typeof s?await r.send(n.token,n.chatId,s):await r.send(n.token,n.chatId,s.text,s.keyboard,s.replyTo??void 0)}catch{e={ok:!1,kind:"transient",error:"Telegram didn't answer."}}await r.record(e,a).catch(()=>console.warn(`${t.X.logTag}/telegram: recording the result failed`))}}async function _(e,r){try{var a;let t;await (a=e(),Promise.race([a,new Promise((e,a)=>{t=setTimeout(()=>a(Object.assign(Error("timeout"),{name:"TimeoutError"})),r)})]).finally(()=>clearTimeout(t)))}catch(e){console.warn(`${t.X.logTag}/telegram: sending the proposal notice failed:`,e instanceof Error?e.name:"error")}}let S=async(e,t)=>t&&e.thread?e.thread(t).catch(()=>null):null;async function T(e,t={},r={}){if(!e.length)return;let a={...f,...t};await _(async()=>{let t=await a.autoRun().catch(()=>null),n=e.filter(e=>{var r;return r=t??{},"pending"===e.status&&!e.auto&&(p.H[e.action]?.risk!=="safe"||"risky"===e.risk||!r[e.action])});if(!n.length)return;let o=n.length>3||!a.buttons?null:await a.buttons().catch(()=>null),l=r.now??new Date;await Promise.all([j(async(e,t)=>n.length>3?[function(e,t,r,a=new Set,n="en"){let o=e=>(0,s.t)(m,n,e),l=e.slice(0,10).map(e=>{let s=(0,d.R)(e.proposedBy,t,60)||o("proposer");return`• ${(0,i.H)(s)}: ${(0,i.H)(k(e,n))} — ${(0,i.H)((0,d.R)(e.title,t,120))} (${y(e,n)})${a.has(e.id)?` \xb7 ${h(n)}`:""}
+  ${(0,i.H)(w(r,e.id))}`}),u=e.length>10?[`+${e.length-10} ${o("moreN")}`]:[];return[`🧑‍✈️ ${e.length} ${o("waitingN")}`,...l,...u,`${o("open")}: ${(0,i.H)(w(r))}`].join("\n")}(n,e,a.siteUrl(),r.devQueued,t)]:Promise.all(n.map(async n=>{let i=b(n,e,a.siteUrl(),r.devQueued?.has(n.id)??!1,t),l=await S(a,r.alertIds?.get(n.id));return o?{text:`${i}
+${((e="en")=>(0,s.t)(m,e,"pending"))(t)}`,keyboard:o(n),replyTo:l}:{text:i,replyTo:l}})),a,l),R((e,t)=>n.length>3?[A("proposed",n,e,t)]:n.map(r=>A("proposed",r,e,t)),a,l)])},r.timeoutMs??8e3)}async function O(e,t={},r={}){if(!e.auto||"done"!==e.status&&"failed"!==e.status)return;let a={...f,...t},n=r.now??new Date;await _(()=>Promise.all([j(async(t,n)=>{let o=function(e,t,r="en"){if(!e.auto||"done"!==e.status&&"failed"!==e.status||e.auto&&"done"===e.status&&v.has(e.action))return null;let a="done"===e.status?"✅":"❌",n=e.result?(0,d.R)(e.result,t,200):"";return`${a} ${(0,s.t)(m,r,"automatic")}: ${(0,i.H)(k(e,r))} — ${(0,i.H)((0,d.R)(e.title,t,120))}${n?`: ${(0,i.H)(n)}`:""}`}(e,t,n);return o?[{text:o,replyTo:await S(a,r.alertId)}]:[]},a,n),R((t,r)=>[A("done"===e.status?"done":"failed",e,t,r)],a,n)]).then(()=>void 0),r.timeoutMs??8e3)}async function P(e,t,r={},a={}){if("done"!==e.status&&"failed"!==e.status)return;let n={...f,...r},o=a.now??new Date;await _(()=>Promise.all([j(async(r,o)=>[{text:function(e,t,r,a="en"){let n=e=>(0,s.t)(m,a,e),o=(0,d.R)(e.resourceName??n("app"),r,60)||n("app"),l=(0,d.R)(t.reason,r,200).replace(/[.!?…]+$/,"")||n("rollbackWhy"),u=e.result?(0,d.R)(e.result,r,200):"";return["id"===a?`⏪ Otomatis rollback ${(0,i.H)(o)}: ${(0,i.H)(l)}. Deploy baru ${(0,i.H)((0,d.R)(t.newRef,r,40))} dibalikin ke deploy sebelumnya. Benerin dulu, terus deploy ulang.`:`⏪ Automatic rollback of ${(0,i.H)(o)}: ${(0,i.H)(l)}. The new deploy ${(0,i.H)((0,d.R)(t.newRef,r,40))} was rolled back to the previous one. Fix it first, then deploy again.`,`${"done"===e.status?"✅":"❌"} ${n("done"===e.status?"succeeded":"failed")}${u?`: ${(0,i.H)(u)}`:""}`].join("\n")}(e,t,r,o),replyTo:await S(n,a.alertId)}],n,o),R((t,r)=>[A("done"===e.status?"done":"failed",e,t,r)],n,o)]).then(()=>void 0),a.timeoutMs??8e3)}async function M(e,t={},r={}){let a={...f,...t};await _(()=>j((t,r)=>[function(e,t,r="en"){let a="id"===r,n=(0,d.R)(e.app,t,60)||(0,s.t)(m,r,"app"),o=e.packages.slice(0,4).join(", ")+(e.packages.length>4?`, +${e.packages.length-4}`:"");if("merged"===e.kind)return a?`✅ PR #${e.number} di ${(0,i.H)(n)} di-merge otomatis (${(0,i.H)(o)}). Deploy production jalan lewat Vercel; auto-rollback jaga ${e.windowMin??30} menit pertama.`:`✅ PR #${e.number} in ${(0,i.H)(n)} was merged automatically (${(0,i.H)(o)}). The production deploy runs through Vercel; auto-rollback watches the first ${e.windowMin??30} minutes.`;if("ready-manual"===e.kind)return a?`🔐 PR #${e.number} di ${(0,i.H)(n)} siap di-merge, tapi auto-rollback mati — merge manual ya.`:`🔐 PR #${e.number} in ${(0,i.H)(n)} is ready to merge, but auto-rollback is off — please merge it manually.`;let l=(0,d.R)(e.reason??"",t,200)||(0,s.t)(m,r,"stopFallback");return a?`⚠️ PR #${e.number} di ${(0,i.H)(n)} butuh dicek: ${(0,i.H)(l)}. PR-nya dibiarin terbuka.`:`⚠️ PR #${e.number} in ${(0,i.H)(n)} needs a look: ${(0,i.H)(l)}. The PR was left open.`}(e,t,r)],a,r.now??new Date),r.timeoutMs??8e3)}e.s(["h",0,$,"q",0,P,"y",0,M,"v",0,x,"i",0,T,"b",0,O,"a",0,b])},570191,e=>{var t=e.i(875225),r=e.i(924924),a=e.i(618916),n=e.i(407602),i=e.i(365156);let o="office.autoRun",s=Object.keys(i.H);s.filter(e=>"safe"===i.H[e].risk),Object.fromEntries(s.map(e=>[e,!1]));let l={read:async()=>{let[e]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,o)).limit(1);return e?.value??null},write:async e=>{await (0,r.f)().insert(a.settings).values({key:o,value:e}).onConflictDoUpdate({target:a.settings.key,set:{value:e,updatedAt:new Date}})},audit:e=>(0,n.f)({kind:"ok",message:e.message,detail:e.detail.slice(0,500),resourceId:null,actorUserId:e.actorUserId})};async function u(e={}){var t;let r;return r=(t=await ({...l,...e}).read())&&"object"==typeof t&&!Array.isArray(t)?t:{},Object.fromEntries(s.map(e=>[e,"safe"===i.H[e].risk&&!0===r[e]]))}let d="office.autoRollback",c={...l,read:async()=>{let[e]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,d)).limit(1);return e?.value??null},write:async e=>{await (0,r.f)().insert(a.settings).values({key:d,value:e}).onConflictDoUpdate({target:a.settings.key,set:{value:e,updatedAt:new Date}})}};async function p(e={}){var t;let r,a;return{enabled:!0===(r=(t=await ({...c,...e}).read())&&"object"==typeof t&&!Array.isArray(t)?t:{}).enabled,windowMin:"number"==typeof(a=r.windowMin)&&Number.isInteger(a)&&a>=10&&a<=120?r.windowMin:30}}let f="office.autoSecurity",m=["critical","high","moderate"],g={enabled:!0,severities:["critical","high","moderate"],sameMajorOnly:!0},h={...l,read:async()=>{let[e]=await (0,r.f)().select({value:a.settings.value}).from(a.settings).where((0,t.u)(a.settings.key,f)).limit(1);return e?.value??null},write:async e=>{await (0,r.f)().insert(a.settings).values({key:f,value:e}).onConflictDoUpdate({target:a.settings.key,set:{value:e,updatedAt:new Date}})}};async function k(e={}){return function(e){let t;if(null==e)return{...g,severities:[...g.severities]};let r="object"!=typeof e||Array.isArray(e)?{}:e,a=(Array.isArray(t=r.severities)&&t.every(e=>m.includes(e))?m.filter(e=>t.includes(e)):null)??["critical","high"],n="boolean"==typeof r.moderate?r.moderate:a.includes("high");return{enabled:!0===r.enabled,severities:m.filter(e=>"moderate"===e?n:a.includes(e)),sameMajorOnly:!0}}(await ({...h,...e}).read())}e.s(["r",0,s,"n",0,120,"l",0,10,"K",0,p,"I",0,u,"X",0,k])},365156,e=>{e.s(["H",0,{recheck:{risk:"safe",label:"Check again now",uses:"monitor-actions checkNow"},neon_wake:{risk:"safe",label:"Wake Neon",uses:"Stage 6 Neon wake"},supabase_keepalive:{risk:"safe",label:"Send Supabase keep-alive",uses:"Stage 6 Keep active"},supabase_restore:{risk:"risky",label:"Restore Supabase project",uses:"Stage 6 Supabase restore"},vercel_redeploy:{risk:"risky",label:"Redeploy production",uses:"vercel-actions redeployAction"},vercel_rollback:{risk:"risky",label:"Roll back to previous deployment",uses:"vercel-actions rollbackAction"},github_bump_pr:{risk:"risky",label:"Open package update PR",uses:"lib/data/deps-pr.ts bumpPrAs (GitHub PR-write token)"},domain_recheck:{risk:"safe",label:"Re-check domain certificate",uses:"domains actions recheck (network-db recheckDomain)"},daily_rerun:{risk:"risky",label:"Rerun daily job",uses:"GET /api/daily with the cron secret (collector runDailyAll)"},monitor_update_url:{risk:"safe",label:"Update monitor",uses:"Uptime Update monitor (monitor-move-db moveMonitorToDomain)"}},"V",0,72e5])},377489,588492,e=>{var t=e.i(298397),r=e.i(154586),a=e.i(313931),n=e.i(635982),i=e.i(365156),o=e.i(32391),s=e.i(250474),l=e.i(218331);let u=new Set(["nextjs","blitzjs"]),d={status:"unknown",version:null},c={status:"ok",version:null},p=/(?:Next\.js|\(now) (\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/,f=e=>!!e&&!u.has(e),m=(e,t)=>null===e.version&&!e.findings.length&&"vulnerable"!==e.status&&("not a Next.js site"===e.reason||f(t));function g(e,t){return"vulnerable"===e.status||e.findings.length?{status:"vulnerable",version:e.version}:"ok"===e.status||e.version?{status:"ok",version:e.version}:m(e,t)?c:d}let h=e=>`${(0,l.L)(e)} ${(0,l.U)(e)} ${(0,l.J)(e)}`,k=e=>"HighLatency"===e?"Slow":"Down",y=(e,t,r,a=!1)=>{let n;if(!r||t.getTime()<r.getTime())return`${k(e)} since ${h(t)}, not tied to a deploy${r?` (live since ${h(r)})`:""}: check the app.`;let i=(n=Math.max(1,Math.round((t.getTime()-r.getTime())/6e4)))<120?`${n} min`:n<2880?`${Math.round(n/60)} h`:`${Math.round(n/1440)} days`;return a?`${k(e)} since ${h(t)}, ${i} after the deploy went live, outside the rollback window: check the app or roll back by hand.`:`${k(e)} since ${h(t)}, started ${i} after the deploy went live: check the app.`},w=e=>e?`No rollback: the previous deployment runs Next.js ${e}, which has known advisories.`:"No rollback: the previous deployment's Next.js has known advisories.",b="Previous deployment's Next.js version is unknown: check it has no known advisories before approving.";e.s(["A",0,6048e5,"Y",0,["NextVulnerable","NextClean"],"B",0,b,"D",0,y,"Q",0,function(e){let t,r=e.currentLiveAt?.getTime(),a=e.previousLiveAt?.getTime(),n=e.check;if(!n)return f(e.framework)?c:d;if(m(n,e.framework))return c;if(void 0===r||void 0===a||a>=r)return d;let i=n.checkedAt.getTime();if(i>=a&&i<r)return g(n,e.framework);if(i<a||r-a<36e5)return d;let l=e.events.filter(e=>"NextVulnerable"===e.reason||"NextClean"===e.reason),u=l.filter(e=>e.at.getTime()<r).sort((e,t)=>t.at.getTime()-e.at.getTime())[0],h=l.filter(e=>e.at.getTime()>=r).sort((e,t)=>e.at.getTime()-t.at.getTime())[0];if(u){var k;let e;t={status:"NextVulnerable"===u.reason?"vulnerable":"ok",version:u.at.getTime()>=a?(k=u.message,(e=p.exec(k)?.[1]??null)&&(0,o.C)(e)?e:null):null}}else t=h?"NextClean"===h.reason?{status:"vulnerable",version:null}:d:{status:g(n,e.framework).status,version:null};if("ok"===t.status&&"ok"!==n.status&&n.findings.length){let e;if(!t.version)return d;if(e=t.version,n.findings.some(t=>!!t.fixed&&(0,o.C)(t.fixed)&&0>(0,s.f)(e,t.fixed)))return{status:"vulnerable",version:t.version}}return t},"g",0,function(e,t,r={}){let a=e.getTime(),n="MonitorDown"===r.ruleKey;if(n&&!r.liveAt)return e;let i=r.liveAt?r.liveAt.getTime()-9e5:0,o=r.gapMs??864e5;for(let e of[...t].sort((e,t)=>t.startedAt.getTime()-e.startedAt.getTime()))!(e.startedAt.getTime()>=a)&&(n?null===e.resolvedAt||e.resolvedAt.getTime()>=i:null===e.resolvedAt||e.resolvedAt.getTime()>=a-o)&&(a=e.startedAt.getTime());return new Date(a)},"e",0,w],588492);let v=200,$=a.X.auditPrefix,I=/^dpl_[A-Za-z0-9]{8,40}$/,A=/^ep-[a-z0-9-]{3,60}$/,R=/^[a-z0-9]{8,40}$/,x=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,j=(e,t=v)=>e.length>t?`${e.slice(0,t-1).trimEnd()}…`:e,_=e=>/[.!?…]$/.test(e)?e:`${e}.`;function S(e,r,a,i){return"app"===e&&a?(0,t.r)(i,a):("supabase_project"===e||"neon_project"===e||"neon_branch"===e||"firestore"===e)&&r?(0,t.X)(i,r):a&&(0,n.g)(a,i,120)||null}let T={recheck:e=>`Check ${e} again now`,neon_wake:e=>`Wake the Neon compute of ${e}`,supabase_keepalive:e=>`Send a keep-alive to ${e}`,supabase_restore:e=>`Restore Supabase project ${e}`,vercel_redeploy:e=>`Redeploy production ${e}`,vercel_rollback:e=>`Roll ${e} back to the previous deployment`,github_bump_pr:e=>`Open a PR updating vulnerable packages in ${e}`,domain_recheck:e=>`Re-check the certificate of ${e}`,daily_rerun:()=>"Rerun the daily job",monitor_update_url:e=>`Point the ${e} monitor at its new domain`},O=(e,t)=>j(T[e](t??"this resource")),P=(e,t)=>e.silencedUntilResolved||null!==e.silencedUntil&&e.silencedUntil.getTime()>t.getTime(),M={status:"unknown",version:null};e.s(["e",0,"office-auto","v",0,$,"L",0,6e5,"j",0,v,"I",0,(e,t)=>"safe"===i.H[e].risk&&!0===t[e],"l",0,j,"z",0,function(e,t){let r=e.filter(e=>!P(e,t)),a=e=>[...new Set(e.filter(e=>!!e&&x.test(e)))],n=r.filter(e=>("MonitorDown"===e.ruleKey||"HighLatency"===e.ruleKey)&&"app"===e.resourceKind);return{monitorIds:a([...n,...r.filter(e=>"MonitorDomainMoved"===e.ruleKey&&"app"===e.resourceKind)].map(e=>e.subject)),monitorApps:a(n.map(e=>e.resourceId)),deployApps:a(r.filter(e=>("DeploymentFailed"===e.ruleKey||"MonitorDown"===e.ruleKey||"HighLatency"===e.ruleKey)&&"app"===e.resourceKind).map(e=>e.resourceId)),supabaseIds:a(r.filter(e=>("DatabasePaused"===e.ruleKey||"AutoPauseRisk"===e.ruleKey)&&"supabase_project"===e.resourceKind).map(e=>e.resourceId)),depApps:a(r.filter(e=>"VulnerableDependency"===e.ruleKey&&"app"===e.resourceKind).map(e=>e.resourceId)),frameworkApps:a(r.filter(e=>"FrameworkVulnerable"===e.ruleKey&&"app"===e.resourceKind).map(e=>e.resourceId))}},"M",0,O,"t",0,function(e,a,o,s){let l,u,d;if(P(e,s))return[];let c=(l=(0,t.o)(e,o),u=(0,n.g)(l.title,o,80),d=(0,n.g)(l.message,o,v),j([u&&_(u),d&&_(d)].filter(Boolean).join(" ")||`${e.ruleKey}.`));return(function(e,t,r){let a="app"===e.resourceKind&&e.resourceId?e.resourceId:null;switch(e.ruleKey){case"DeploymentFailed":{let e=a?t.deploys.get(a):void 0;if(!a||!e?.currentId||!I.test(e.currentId))return[];let r=[{action:"vercel_redeploy",resourceKind:"app",resourceId:a,targetRef:e.currentId}],n=t.previousNext?.get(a)??M;return e.previousId&&I.test(e.previousId)&&e.previousId!==e.currentId&&("vulnerable"===n.status?r[0].note=w(n.version):r.push({action:"vercel_rollback",resourceKind:"app",resourceId:a,targetRef:e.previousId,..."unknown"===n.status?{note:b}:{}})),r}case"DatabasePaused":case"AutoPauseRisk":{if("supabase_project"!==e.resourceKind||!e.resourceId)return[];let r=t.supabaseRefs.get(e.resourceId);if(!r||!R.test(r))return[];return[{action:"DatabasePaused"===e.ruleKey?"supabase_restore":"supabase_keepalive",resourceKind:"supabase_project",resourceId:e.resourceId,targetRef:r}]}case"VulnerableDependency":{let e=a?t.fixableRepos?.get(a):void 0;return a&&e&&x.test(e)?[{action:"github_bump_pr",resourceKind:"app",resourceId:a,targetRef:e}]:[]}case"FrameworkVulnerable":{let e=a?t.frameworkFixes?.get(a):void 0;return a&&e&&x.test(e.repoId)?[{action:"github_bump_pr",resourceKind:"app",resourceId:a,targetRef:e.repoId}]:[]}case"MonitorDomainMoved":return a&&x.test(e.subject)&&t.monitorMoves?.has(e.subject)?[{action:"monitor_update_url",resourceKind:"app",resourceId:a,targetRef:e.subject}]:[];case"MonitorDown":case"HighLatency":{let n=[];a&&x.test(e.subject)&&"http"===t.monitorKinds.get(e.subject)&&n.push({action:"recheck",resourceKind:"app",resourceId:a,targetRef:e.subject}),"MonitorDown"===e.ruleKey&&e.resourceId&&x.test(e.subject)&&t.dailyHeartbeatId===e.subject&&n.push({action:"daily_rerun",room:"observe",resourceKind:e.resourceKind,resourceId:e.resourceId,targetRef:e.subject});let i=a?t.neonSuspended.get(a):void 0;if(i&&A.test(i.endpointId)&&n.push({action:"neon_wake",room:"databases",resourceKind:i.resourceKind,resourceId:i.resourceId,targetRef:i.endpointId}),t.monitorMoves?.has(e.subject))return n;let o=a?t.deploys.get(a):void 0,s=t.problemSince?.get(e.id)??e.startedAt??null,l=o?.liveAt??null,u=s&&l?s.getTime()>=l.getTime():null,d=a&&t.previousNext?.get(a)||M,c=t.rollbackWindowMs??18e5,p=!!a&&!0===u&&function(e,t,r){if(!e?.currentId||!e.previousId||!e.liveAt||!I.test(e.previousId)||e.previousId===e.currentId)return!1;let a=r.getTime()-e.liveAt.getTime();return a>=0&&a<=t}(o,c,r);if(p&&"vulnerable"!==d.status)return n.push({action:"vercel_rollback",resourceKind:"app",resourceId:a,targetRef:o.previousId,..."unknown"===d.status?{note:b}:{}}),n;let f=p?w(d.version):void 0;if("MonitorDown"===e.ruleKey&&a&&o?.currentId&&I.test(o.currentId)&&"http"===t.monitorKinds.get(e.subject)&&!1!==u)return n.push({action:"vercel_redeploy",resourceKind:"app",resourceId:a,targetRef:o.currentId,...f?{note:f}:{}}),n;let m=!!l&&r.getTime()-l.getTime()>c,g=f??(s&&l&&o?.currentId?y(e.ruleKey,s,l,m):void 0),h=n.find(e=>"recheck"===e.action);return h&&g&&(h.note=g),n}case"CertExpiringSoon":return"domain"===e.resourceKind&&e.resourceId&&x.test(e.resourceId)?[{action:"domain_recheck",resourceKind:"domain",resourceId:e.resourceId,targetRef:e.resourceId}]:[];default:return[]}})(e,a,s).map(l=>{var u;let d,p,f,m,g=l.room??(0,r.p)(e),h="neon_wake"===l.action?S(l.resourceKind,l.resourceId,null,o):S(e.resourceKind,e.resourceId,e.resourceName,o),k="FrameworkVulnerable"===e.ruleKey&&"github_bump_pr"===l.action,y="monitor_update_url"===l.action?a.monitorMoves?.get(l.targetRef):void 0,w=k?(u=l.resourceId?a.frameworkFixes?.get(l.resourceId):void 0,d=h??"this app",j(u?`Next.js ${u.from} in ${d} has known vulnerabilities: the PR updates next (and eslint-config-next when listed) to ${u.to}.`:`Next.js in ${d} has known vulnerabilities with a fixed version.`)):"github_bump_pr"===l.action?(f=(p=(0,n.g)((0,t.o)(e,o).message,o,v)).includes(": ")?p.slice(p.indexOf(": ")+2):"",m=`Vulnerable packages in ${h??"this app"} have a fix`,j(f?`${m}: ${f}`:`${m}.`)):l.note?j(`${l.note} ${c}`):c,b="github_bump_pr"===l.action&&l.resourceId?a.productionMismatch?.get(l.resourceId):void 0;return{alertId:e.id,ruleKey:e.ruleKey,room:g,action:l.action,risk:i.H[l.action].risk,title:k?j(`Open a PR updating Next.js in ${h??"this app"}`):y?j(`Point the ${h??"app's"} monitor at ${y.to}`):O(l.action,h),reason:b?j(`${(0,n.g)(b,o,v)} ${w}`):w,resourceKind:l.resourceKind,resourceId:l.resourceId,resourceName:h,targetRef:l.targetRef,proposedBy:(0,r.y)(g),expiresAt:new Date(s.getTime()+i.V)}})},"x",0,function(e,t){let r=e.ok?e.message||"Done.":e.error||"It didn't run.";return j((0,n.g)(r,t,v)||(e.ok?"Done.":"It didn't run."))},"J",0,S,"E",0,function(e){return{id:e.id,room:e.room,action:e.action,actionLabel:i.H[e.action].label,risk:i.H[e.action].risk,title:e.title,reason:e.reason,resourceName:e.resourceName,proposedBy:e.proposedBy,status:e.status,auto:e.auto,result:e.result,createdAt:e.createdAt.toISOString(),decidedAt:e.decidedAt?e.decidedAt.toISOString():null,expiresAt:e.expiresAt.toISOString()}},"Z",0,function(e,t,r){let a=r??t?.find(e=>e.isDefault)?.id??null,n=(e??[]).find(e=>!a||e.branchId===a);return n&&!n.disabled&&"idle"===n.state&&"active"!==n.pendingState&&A.test(n.id)?n.id:null}],377489)},610514,e=>{var t=e.i(666680),r=e.i(875225),a=e.i(924924),n=e.i(220642),i=e.i(313931),o=e.i(407602),s=e.i(209576),l=e.i(983128),u=e.i(547499),d=e.i(695811),c=e.i(298397),p=e.i(291029),f=e.i(635982),m=e.i(377489),g=e.i(447933),h=e.i(442565);let k={decide:g.V,execute:(e,t,r)=>(0,g.N)(e,t,r),history:(e,t)=>(0,h.v)(e,t)};async function y(e,t,r,a,n={},i=k){let o=await i.decide(e,t,r.id,a);if("ok"!==o.status)return"missing"===o.status?{status:"missing"}:{status:"conflict",proposal:o.proposal};let s=[],l=async()=>{let e,t=i.history;if(!t||!s.length)return;let r=s.splice(0),a=new Promise(t=>{e=setTimeout(t,h.h)}),n=(async()=>{for(let[e,a]of r)await t(e,a).catch(()=>void 0)})();await Promise.race([n,a]).finally(()=>clearTimeout(e))};if("reject"===t)return s.push(["rejected",o.proposal]),{status:"ok",proposal:o.proposal,flushHistory:l};s.push(["approved",o.proposal]),n.onApproved&&await n.onApproved(o.proposal).catch(()=>void 0);let u=await i.execute(e,{id:r.id,userId:r.userId},new Date);return u&&("done"===u.status||"failed"===u.status)&&s.push([u.status,u]),{status:"ok",proposal:u??o.proposal,flushHistory:l}}var w=e.i(365156);let b=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,v={en:{approve:"✅ Approve",reject:"❌ Reject",sure:"⚠️ Sure? Approve",cancel:"Cancel",invalid:"This button is not valid.",gone:"This proposal is already decided / expired",confirmFirst:"This action is risky. Tap ⚠️ Sure? Approve within 2 minutes.",confirmLate:"The confirmation expired. Tap ✅ Approve again.",cancelled:"Cancelled. The proposal is still waiting.",running:"Approved. Running…",rejected:"Rejected.",failed:"Could not process it. Try again from Auto-actions."},id:{approve:"✅ Setujui",reject:"❌ Tolak",sure:"⚠️ Yakin? Setujui",cancel:"Batal",invalid:"Tombol ini nggak valid.",gone:"Usulan ini udah diputuskan / kedaluwarsa",confirmFirst:"Aksi ini berisiko. Tap ⚠️ Yakin? Setujui dalam 2 menit.",confirmLate:"Konfirmasinya kedaluwarsa. Tap ✅ Setujui lagi.",cancelled:"Dibatalkan. Usulannya masih menunggu.",running:"Disetujui. Lagi jalan…",rejected:"Ditolak.",failed:"Gagal memproses. Coba lagi dari Auto-actions."}},$=e=>(0,t.createHmac)("sha256",Buffer.from(e,"base64")).update("watchpost:telegram-callback:v1").digest(),I=(e,r)=>(0,t.createHmac)("sha256",e).update(r,"utf8").digest("base64url").slice(0,16);function A(e,t,r,a=null){let n=`p:${t}:${r}${"c"===r?`:${(a??0).toString(36)}`:""}`;return`${n}:${I(e,n)}`}function R(e,r){if("string"!=typeof r||r.length>64)return null;let a=r.lastIndexOf(":");if(a<0)return null;let n=r.slice(0,a),i=Buffer.from(r.slice(a+1),"utf8"),o=Buffer.from(I(e,n),"utf8");if(i.length!==o.length||!(0,t.timingSafeEqual)(i,o))return null;let s=n.split(":");if("p"!==s[0]||!b.test(s[1]??""))return null;let l=s[2];return"c"===l?4===s.length&&/^[0-9a-z]{1,10}$/.test(s[3])?{id:s[1],op:l,exp:parseInt(s[3],36)}:null:3===s.length&&["a","r","x"].includes(l)?{id:s[1],op:l,exp:null}:null}let x=(e,t,r="en")=>({inline_keyboard:[[{text:v[r].approve,callback_data:A(e,t,"a")},{text:v[r].reject,callback_data:A(e,t,"r")}]]}),j=(e,t,r,a="en")=>({inline_keyboard:[[{text:v[a].sure,callback_data:A(e,t,"c",r)},{text:v[a].cancel,callback_data:A(e,t,"x")}]]}),_={en:{pending:"⏳ waiting",approved:"⚙️ running",running:"⚙️ running",done:"✅ done",failed:"❌ failed",rejected:"🚫 rejected",expired:"⌛ expired"},id:{pending:"⏳ menunggu",approved:"⚙️ jalan",running:"⚙️ jalan",done:"✅ selesai",failed:"❌ gagal",rejected:"🚫 ditolak",expired:"⌛ kedaluwarsa"}};function S(e,t,r="en"){let a=e.result&&("done"===e.status||"failed"===e.status||"expired"===e.status)?(0,f.R)(e.result,t,200):"";return`Status: ${_[r][e.status]}${a?` — ${(0,n.H)(a)}`:""}`}let T=(e,t,r,a="en")=>`${(0,h.a)(e,t,r,!1,a)}
+${S(e,t,a)}`,O={key:()=>$((0,u.f)().OPS_ENCRYPTION_KEY),get:async function(e){let[t]=await (0,a.f)().select({id:p.O.id,room:p.O.room,action:p.O.action,risk:p.O.risk,title:p.O.title,reason:p.O.reason,resourceName:p.O.resourceName,proposedBy:p.O.proposedBy,status:p.O.status,auto:p.O.auto,result:p.O.result,createdAt:p.O.createdAt,decidedAt:p.O.decidedAt,expiresAt:p.O.expiresAt}).from(p.O).where((0,r.u)(p.O.id,e)).limit(1);return t?(0,m.E)(t):null},decide:y,book:()=>(0,s.f)(),siteUrl:()=>(0,u.f)().SITE_URL,lang:()=>(0,d.H)("telegram"),audit:e=>(0,o.f)({...e,resourceId:null})};async function P(e,t,r=O){let{client:a,owner:n,now:o}=t,s=r.key(),l=await r.lang().catch(()=>"en"),u=v[l],d=R(s,e.data);if(!d)return void await a.answer(e.queryId,u.invalid);let p=null,f=async(t,n)=>a.editText(e.chatId,e.messageId,T(t,await (p??=r.book().catch(()=>c.a)),r.siteUrl(),l),n),m=async t=>{await a.answer(e.queryId,u.gone),t?await f(t,null):await a.editKeyboard(e.chatId,e.messageId,{inline_keyboard:[]})},g=await r.get(d.id);if(!g||!("pending"===g.status&&Date.parse(g.expiresAt)>o.getTime()))return m(g);if("x"===d.op){await a.editKeyboard(e.chatId,e.messageId,x(s,g.id,l)),await a.answer(e.queryId,u.cancelled);return}if("a"===d.op&&("risky"===g.risk||w.H[g.action]?.risk==="risky")){await a.editKeyboard(e.chatId,e.messageId,j(s,g.id,Math.floor((o.getTime()+12e4)/1e3),l)),await a.answer(e.queryId,u.confirmFirst);return}if("c"===d.op&&(d.exp??0)*1e3<o.getTime()){await a.editKeyboard(e.chatId,e.messageId,x(s,g.id,l)),await a.answer(e.queryId,u.confirmLate);return}let h="r"===d.op?"reject":"approve",k=!1;try{let t=await r.decide(g.id,h,{id:n.memberId,userId:n.userId},o,{onApproved:async t=>{k=!0,await a.answer(e.queryId,u.running),await f(t,null)}});if("missing"===t.status)return m(null);if("conflict"===t.status)return m(t.proposal);await r.audit({kind:"ok",message:i.X.telegramDecided("approve"===h?"approved":"rejected",t.proposal.title.slice(0,120)),actorUserId:n.userId}).catch(()=>console.warn("audit event failed")),k||await a.answer(e.queryId,"reject"===h?u.rejected:u.running),await f(t.proposal,null),await t.flushHistory?.()}catch(t){console.warn("telegram approvals: deciding failed:",t instanceof Error?t.name:"error"),k||await a.answer(e.queryId,u.failed)}}async function M(){if(!await (0,l.v)()||!await (0,l.I)())return null;let e=$((0,u.f)().OPS_ENCRYPTION_KEY),t=await (0,d.H)("telegram");return r=>x(e,r.id,t)}e.s(["CONFIRM_MS",0,12e4,"TEXT",0,v,"approvalButtons",0,M,"approvalKeyboard",0,x,"callbackKey",0,$,"confirmKeyboard",0,j,"noticeText",0,T,"proposalCallback",0,P,"signCallback",0,A,"statusLine",0,S,"verifyCallback",0,R],610514)},635982,e=>{var t=e.i(298397),r=e.i(76067),a=e.i(753783);let n="[\\p{L}\\p{N}_./-]",i=e=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),o=/(?<![\p{L}\p{N}_.@-])(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,24}(?![\p{L}\p{N}_-]|\.[\p{L}\p{N}])/giu,s=new WeakMap;function l(e,l){return String(e??"").replace(/\r\n?/g,"\n").split("\n").map(e=>{var u;let d,c=(0,a.F)((0,r.F)(e,l),l);return c=c.replace(o,e=>/\.example$/i.test(e)?e:"site.example"),(0,t.G)((u=c,(d=function(e){if(s.has(e))return s.get(e);let t=new Map(e.app.filter(e=>e.name.trim().length>=2).map(e=>[e.name.toLowerCase(),e.alias])),r=[...t.keys()].sort((e,t)=>t.length-e.length),a=r.length?{re:RegExp(`(?<!${n})(?:${r.map(i).join("|")})(?!${n})`,"giu"),alias:t}:null;return s.set(e,a),a}(l))?u.replace(d.re,e=>d.alias.get(e.toLowerCase())??e):u))}).join("\n")}let u=(e,t)=>e.length>t?`${e.slice(0,t-1).trimEnd()}…`:e;e.s(["g",0,(e,t,r)=>u(l(String(e??"").replace(/\s+/g," "),t).replace(/\s+/g," ").trim(),r),"R",0,(e,r,a)=>{let n;return u((n=String(e??"").replace(/\s+/g," "),(0,t.q)(l(n,r),r)).replace(/\s+/g," ").trim(),a)}])}]})();
 
 //# sourceMappingURL=src_1wzm081p6qyre._.js.map