@awsless/awsless 0.0.250 → 0.0.251

package/dist/bin.js

@@ -1686,7 +1686,7 @@ var bootstrap = (program2) => {
 // src/app.ts
 import { App, Stack } from "@awsless/formation";
 
-// src/feature/cache/index.ts
+// src/feature/auth/index.ts
 import { constantCase as constantCase2 } from "change-case";
 
 // src/feature.ts
@@ -1819,76 +1819,11 @@ var formatLocalResourceName = (appName, stackName, ns, id, seperator = "--") =>
   ].map((v) => paramCase3(v)).join(seperator);
 };
 
-// src/feature/cache/index.ts
-import { Node, aws } from "@awsless/formation";
-var typeGenCode = `
-import { Cluster, CommandOptions } from '@awsless/redis'
-
-type Callback<T> = (redis: Cluster) => T
-
-type Command = {
-	readonly host: string
-	readonly port: number
-	<T>(callback: Callback<T>): T
-	<T>(options:Omit<CommandOptions, 'cluster'>, callback: Callback<T>): T
-}`;
-var cacheFeature = defineFeature({
-  name: "cache",
-  async onTypeGen(ctx) {
-    const gen = new TypeFile("@awsless/awsless");
-    const resources = new TypeObject(1);
-    for (const stack of ctx.stackConfigs) {
-      const resource2 = new TypeObject(2);
-      for (const name of Object.keys(stack.caches || {})) {
-        resource2.addType(name, `Command`);
-      }
-      resources.addType(stack.name, resource2);
-    }
-    gen.addCode(typeGenCode);
-    gen.addInterface("CacheResources", resources);
-    await ctx.write("cache.d.ts", gen, true);
-  },
-  onStack(ctx) {
-    for (const [id, props] of Object.entries(ctx.stackConfig.caches ?? {})) {
-      const group = new Node(ctx.stack, this.name, id);
-      const name = formatLocalResourceName(ctx.appConfig.name, ctx.stack.name, this.name, id, "-");
-      const subnetGroup = new aws.memorydb.SubnetGroup(group, "subnets", {
-        name,
-        subnetIds: [
-          //
-          ctx.shared.get("vpc-private-subnet-id-1"),
-          ctx.shared.get("vpc-private-subnet-id-2")
-        ]
-      });
-      const securityGroup = new aws.ec2.SecurityGroup(group, "security", {
-        name,
-        vpcId: ctx.shared.get(`vpc-id`),
-        description: name
-      });
-      const port = aws.ec2.Port.tcp(props.port);
-      securityGroup.addIngressRule({ port, peer: aws.ec2.Peer.anyIpv4() });
-      securityGroup.addIngressRule({ port, peer: aws.ec2.Peer.anyIpv6() });
-      const cluster = new aws.memorydb.Cluster(group, "cluster", {
-        name,
-        aclName: "open-access",
-        securityGroupIds: [securityGroup.id],
-        subnetGroupName: subnetGroup.name,
-        ...props
-      });
-      ctx.onFunction(({ lambda }) => {
-        const prefix = `CACHE_${constantCase2(ctx.stack.name)}_${constantCase2(id)}`;
-        lambda.addEnvironment(`${prefix}_HOST`, cluster.address);
-        lambda.addEnvironment(`${prefix}_PORT`, props.port.toString());
-      });
-    }
-  }
-});
-
-// src/feature/cron/index.ts
-import { Node as Node3, aws as aws3 } from "@awsless/formation";
+// src/feature/auth/index.ts
+import { Node as Node2, aws as aws2 } from "@awsless/formation";
 
 // src/feature/function/util.ts
-import { Asset, aws as aws2 } from "@awsless/formation";
+import { Asset, aws } from "@awsless/formation";
 import deepmerge from "deepmerge";
 import { basename as basename4, dirname as dirname6, extname as extname3 } from "path";
 import { exec } from "promisify-child-process";
@@ -2163,7 +2098,7 @@ var createLambdaFunction = (group, ctx, ns, id, local2) => {
         };
       });
     });
-    code = new aws2.s3.BucketObject(group, "code", {
+    code = new aws.s3.BucketObject(group, "code", {
       bucket: ctx.shared.get("function-bucket-name"),
       key: `/lambda/${name}.zip`,
       body: Asset.fromFile(getBuildPath("function", name, "bundle.zip"))
@@ -2184,7 +2119,7 @@ var createLambdaFunction = (group, ctx, ns, id, local2) => {
         );
       });
     });
-    const image = new aws2.ecr.Image(group, "image", {
+    const image = new aws.ecr.Image(group, "image", {
       repository: ctx.shared.get("function-repository-name"),
       name,
       tag: name
@@ -2195,12 +2130,12 @@ var createLambdaFunction = (group, ctx, ns, id, local2) => {
   } else {
     throw new Error("Unknown Lambda Function type.");
   }
-  const role = new aws2.iam.Role(group, "role", {
+  const role = new aws.iam.Role(group, "role", {
     name,
     assumedBy: "lambda.amazonaws.com"
     // policies: inlinePolicies,
   });
-  const policy = new aws2.iam.RolePolicy(group, "policy", {
+  const policy = new aws.iam.RolePolicy(group, "policy", {
     role: role.name,
     name: "lambda-policy",
     version: "2012-10-17",
@@ -2212,7 +2147,7 @@ var createLambdaFunction = (group, ctx, ns, id, local2) => {
       }
     ]
   });
-  const lambda = new aws2.lambda.Function(group, `function`, {
+  const lambda = new aws.lambda.Function(group, `function`, {
     ...props,
     name,
     role: role.arn,
@@ -2227,7 +2162,7 @@ var createLambdaFunction = (group, ctx, ns, id, local2) => {
     lambda.addEnvironment("STACK", ctx.stackConfig.name);
   }
   if (props.log.retention.value > 0n) {
-    const logGroup = new aws2.cloudWatch.LogGroup(group, "log", {
+    const logGroup = new aws.cloudWatch.LogGroup(group, "log", {
       name: lambda.name.apply((name2) => `/aws/lambda/${name2}`),
       retention: props.log.retention
     });
@@ -2249,7 +2184,7 @@ var createLambdaFunction = (group, ctx, ns, id, local2) => {
     policy.addStatement(...local2.permissions);
   }
   if (props.warm) {
-    const rule = new aws2.events.Rule(group, "warm", {
+    const rule = new aws.events.Rule(group, "warm", {
       name: `${name}--warm`,
       schedule: "rate(5 minutes)",
       enabled: true,
@@ -2264,7 +2199,7 @@ var createLambdaFunction = (group, ctx, ns, id, local2) => {
         }
       ]
     });
-    new aws2.lambda.Permission(group, `warm`, {
+    new aws.lambda.Permission(group, `warm`, {
       action: "lambda:InvokeFunction",
       principal: "events.amazonaws.com",
       functionArn: lambda.arn,
@@ -2279,7 +2214,7 @@ var createLambdaFunction = (group, ctx, ns, id, local2) => {
         ctx.shared.get(`vpc-public-subnet-id-2`)
       ]
     });
-    const vpcPolicy = new aws2.iam.RolePolicy(group, "vpc-policy", {
+    const vpcPolicy = new aws.iam.RolePolicy(group, "vpc-policy", {
       role: role.name,
       name: "lambda-vpc-policy",
       version: "2012-10-17",
@@ -2308,7 +2243,7 @@ var createAsyncLambdaFunction = (group, ctx, ns, id, local2) => {
   const result = createLambdaFunction(group, ctx, ns, id, local2);
   const props = deepmerge(ctx.appConfig.defaults.function, local2);
   result.lambda.addEnvironment("LOG_VIEWABLE_ERROR", "1");
-  const invokeConfig = new aws2.lambda.EventInvokeConfig(group, "async", {
+  const invokeConfig = new aws.lambda.EventInvokeConfig(group, "async", {
     functionArn: result.lambda.arn,
     retryAttempts: props.retryAttempts,
     onFailure: getGlobalOnFailure(ctx)
@@ -2323,139 +2258,180 @@ var createAsyncLambdaFunction = (group, ctx, ns, id, local2) => {
   return result;
 };
 
-// src/feature/cron/index.ts
-var cronFeature = defineFeature({
-  name: "cron",
-  onStack(ctx) {
-    for (const [id, props] of Object.entries(ctx.stackConfig.crons ?? {})) {
-      const group = new Node3(ctx.stack, "cron", id);
-      const { lambda } = createAsyncLambdaFunction(group, ctx, "cron", id, props.consumer);
-      const rule = new aws3.events.Rule(group, "rule", {
-        name: formatLocalResourceName(ctx.app.name, ctx.stack.name, this.name, id),
-        schedule: props.schedule,
-        enabled: props.enabled,
-        targets: [
-          {
-            id: "default",
-            arn: lambda.arn,
-            input: props.payload
-          }
-        ]
-      });
-      new aws3.lambda.Permission(group, "permission", {
-        action: "lambda:InvokeFunction",
-        principal: "events.amazonaws.com",
-        functionArn: lambda.arn,
-        sourceArn: rule.arn
-      });
-    }
-  }
-});
-
-// src/feature/domain/index.ts
-import { Node as Node4, aws as aws4 } from "@awsless/formation";
-import { minutes as minutes3 } from "@awsless/duration";
-var domainFeature = defineFeature({
-  name: "domain",
-  onApp(ctx) {
-    const domains = Object.entries(ctx.appConfig.defaults.domains ?? {});
-    if (domains.length === 0) {
-      return;
+// src/feature/auth/index.ts
+var authFeature = defineFeature({
+  name: "auth",
+  async onTypeGen(ctx) {
+    const gen = new TypeFile("@awsless/awsless");
+    const resources = new TypeObject(1);
+    for (const name of Object.keys(ctx.appConfig.defaults.auth)) {
+      const authName = formatGlobalResourceName(ctx.appConfig.name, "auth", name);
+      resources.addType(
+        name,
+        `{ readonly name: '${authName}', readonly userPoolId: string, readonly clientId: string }`
+      );
     }
-    const group = new Node4(ctx.base, "domain", "mail");
-    const configurationSet = new aws4.ses.ConfigurationSet(group, "config", {
-      name: ctx.app.name,
-      engagementMetrics: true,
-      reputationMetrics: true
-    });
-    ctx.shared.set(`mail-configuration-set`, configurationSet.name);
-    for (const [id, props] of domains) {
-      const group2 = new Node4(ctx.base, "domain", id);
-      const hostedZone = new aws4.route53.HostedZone(group2, "zone", {
-        name: props.domain
-      });
-      ctx.shared.set(`hosted-zone-${id}-id`, hostedZone.id);
-      const certificate = new aws4.acm.Certificate(group2, "local", {
-        domainName: props.domain,
-        alternativeNames: [`*.${props.domain}`]
-      });
-      hostedZone.addRecord("local-cert-1", certificate.validationRecord(0));
-      hostedZone.addRecord("local-cert-2", certificate.validationRecord(1));
-      const validation = new aws4.acm.CertificateValidation(group2, "local", {
-        certificateArn: certificate.arn
+    gen.addInterface("AuthResources", resources);
+    await ctx.write("auth.d.ts", gen, true);
+  },
+  onStack(ctx) {
+    for (const [id, props] of Object.entries(ctx.stackConfig.auth ?? {})) {
+      const group = new Node2(ctx.stack, "auth", id);
+      const userPoolId = ctx.shared.get(`auth-${id}-user-pool-id`);
+      const userPoolArn = ctx.shared.get(`auth-${id}-user-pool-arn`);
+      const clientId = ctx.shared.get(`auth-${id}-client-id`);
+      const triggers = {};
+      const list4 = {};
+      for (const [trigger, triggerProps] of Object.entries(props.triggers ?? {})) {
+        const triggerGroup = new Node2(group, "trigger", trigger);
+        const { lambda, policy } = createAsyncLambdaFunction(
+          triggerGroup,
+          ctx,
+          "auth",
+          `${id}-${trigger}`,
+          triggerProps
+        );
+        triggers[trigger] = lambda.arn;
+        list4[trigger] = {
+          trigger,
+          group: triggerGroup,
+          lambda,
+          policy
+        };
+      }
+      new aws2.cognito.LambdaTriggers(group, "lambda-triggers", {
+        userPoolId,
+        triggers
       });
-      ctx.shared.set(`local-certificate-${id}-arn`, validation.arn);
-      if (ctx.appConfig.region !== "us-east-1") {
-        const globalCertificate = new aws4.acm.Certificate(group2, "global", {
-          domainName: props.domain,
-          alternativeNames: [`*.${props.domain}`],
-          region: "us-east-1"
+      for (const item of Object.values(list4)) {
+        new aws2.lambda.Permission(item.group, `permission`, {
+          action: "lambda:InvokeFunction",
+          principal: "cognito-idp.amazonaws.com",
+          functionArn: item.lambda.arn,
+          sourceArn: userPoolArn
         });
-        hostedZone.addRecord("global-cert-1", globalCertificate.validationRecord(0));
-        hostedZone.addRecord("global-cert-2", globalCertificate.validationRecord(1));
-        const globalValidation = new aws4.acm.CertificateValidation(group2, "global", {
-          certificateArn: globalCertificate.arn,
-          region: "us-east-1"
+        item.lambda.addEnvironment(`AUTH_${constantCase2(id)}_USER_POOL_ID`, userPoolId);
+        item.lambda.addEnvironment(`AUTH_${constantCase2(id)}_CLIENT_ID`, clientId);
+        item.policy.addStatement({
+          actions: ["cognito:*"],
+          resources: [
+            // Not yet known if this is correct way to grant access to all resources
+            userPoolArn
+            // userPoolId.apply<aws.ARN>(
+            // 	id => `arn:aws:cognito-idp:${ctx.appConfig.region}:${ctx.accountId}:userpool/${id}`
+            // ),
+            // userPoolId.apply<aws.ARN>(
+            // 	id => `arn:aws:cognito-idp:${ctx.appConfig.region}:${ctx.accountId}:userpool/${id}*`
+            // ),
+          ]
         });
-        ctx.shared.set(`global-certificate-${id}-arn`, globalValidation.arn);
-      } else {
-        ctx.shared.set(`global-certificate-${id}-arn`, validation.arn);
       }
-      const emailIdentity = new aws4.ses.EmailIdentity(group2, "mail", {
-        emailIdentity: props.domain,
-        mailFromDomain: `mail.${props.domain}`,
-        configurationSetName: configurationSet.name,
-        feedback: true,
-        rejectOnMxFailure: true
-      });
-      let i = 0;
-      for (const record of emailIdentity.dkimRecords) {
-        new aws4.route53.RecordSet(group2, `dkim-${++i}`, {
-          hostedZoneId: hostedZone.id,
-          ...record
-        });
+    }
+  },
+  onApp(ctx) {
+    for (const [id, props] of Object.entries(ctx.appConfig.defaults.auth ?? {})) {
+      const group = new Node2(ctx.base, "auth", id);
+      let emailConfig;
+      if (props.messaging) {
+        const [_, domainName] = props.messaging.fromEmail.split("@");
+        emailConfig = {
+          type: "developer",
+          replyTo: props.messaging.replyTo,
+          sourceArn: ctx.shared.get(`mail-${domainName}-arn`),
+          configurationSet: ctx.shared.get("mail-configuration-set"),
+          from: props.messaging.fromName ? `${props.messaging.fromName} <${props.messaging.fromEmail}>` : props.messaging.fromEmail
+        };
       }
-      new aws4.route53.RecordSet(group2, `MX`, {
-        hostedZoneId: hostedZone.id,
-        name: `mail.${props.domain}`,
-        type: "MX",
-        ttl: minutes3(5),
-        records: [`10 feedback-smtp.${ctx.appConfig.region}.amazonses.com`]
-      });
-      new aws4.route53.RecordSet(group2, `SPF`, {
-        hostedZoneId: hostedZone.id,
-        name: `mail.${props.domain}`,
-        type: "TXT",
-        ttl: minutes3(5),
-        records: ['"v=spf1 include:amazonses.com -all"']
-      });
-      new aws4.route53.RecordSet(group2, `DMARC`, {
-        hostedZoneId: hostedZone.id,
-        name: `_dmarc.${props.domain}`,
-        type: "TXT",
-        ttl: minutes3(5),
-        records: ['"v=DMARC1; p=none;"']
+      const name = formatGlobalResourceName(ctx.appConfig.name, "auth", id);
+      const userPool = new aws2.cognito.UserPool(group, "user-pool", {
+        name,
+        // deletionProtection: true,
+        allowUserRegistration: props.allowUserRegistration,
+        username: props.username,
+        password: props.password,
+        email: emailConfig
       });
-      const mailIdentityArn = emailIdentity.output(() => {
-        return `arn:aws:ses:${ctx.appConfig.region}:${ctx.accountId}:identity/${props.domain}`;
+      const client = new aws2.cognito.UserPoolClient(group, "client", {
+        userPoolId: userPool.id,
+        name,
+        validity: props.validity,
+        supportedIdentityProviders: ["cognito"],
+        authFlows: {
+          userSrp: true
+        }
+      });
+      ctx.bindEnv(`AUTH_${constantCase2(id)}_USER_POOL_ID`, userPool.id);
+      ctx.bindEnv(`AUTH_${constantCase2(id)}_CLIENT_ID`, client.id);
+      ctx.shared.set(`auth-${id}-user-pool-arn`, userPool.arn);
+      ctx.shared.set(`auth-${id}-user-pool-id`, userPool.id);
+      ctx.shared.set(`auth-${id}-client-id`, client.id);
+    }
+  }
+});
+
+// src/feature/cache/index.ts
+import { constantCase as constantCase3 } from "change-case";
+import { Node as Node3, aws as aws3 } from "@awsless/formation";
+var typeGenCode = `
+import { Cluster, CommandOptions } from '@awsless/redis'
+
+type Callback<T> = (redis: Cluster) => T
+
+type Command = {
+	readonly host: string
+	readonly port: number
+	<T>(callback: Callback<T>): T
+	<T>(options:Omit<CommandOptions, 'cluster'>, callback: Callback<T>): T
+}`;
+var cacheFeature = defineFeature({
+  name: "cache",
+  async onTypeGen(ctx) {
+    const gen = new TypeFile("@awsless/awsless");
+    const resources = new TypeObject(1);
+    for (const stack of ctx.stackConfigs) {
+      const resource2 = new TypeObject(2);
+      for (const name of Object.keys(stack.caches || {})) {
+        resource2.addType(name, `Command`);
+      }
+      resources.addType(stack.name, resource2);
+    }
+    gen.addCode(typeGenCode);
+    gen.addInterface("CacheResources", resources);
+    await ctx.write("cache.d.ts", gen, true);
+  },
+  onStack(ctx) {
+    for (const [id, props] of Object.entries(ctx.stackConfig.caches ?? {})) {
+      const group = new Node3(ctx.stack, this.name, id);
+      const name = formatLocalResourceName(ctx.appConfig.name, ctx.stack.name, this.name, id, "-");
+      const subnetGroup = new aws3.memorydb.SubnetGroup(group, "subnets", {
+        name,
+        subnetIds: [
+          //
+          ctx.shared.get("vpc-private-subnet-id-1"),
+          ctx.shared.get("vpc-private-subnet-id-2")
+        ]
+      });
+      const securityGroup = new aws3.ec2.SecurityGroup(group, "security", {
+        name,
+        vpcId: ctx.shared.get(`vpc-id`),
+        description: name
+      });
+      const port = aws3.ec2.Port.tcp(props.port);
+      securityGroup.addIngressRule({ port, peer: aws3.ec2.Peer.anyIpv4() });
+      securityGroup.addIngressRule({ port, peer: aws3.ec2.Peer.anyIpv6() });
+      const cluster = new aws3.memorydb.Cluster(group, "cluster", {
+        name,
+        aclName: "open-access",
+        securityGroupIds: [securityGroup.id],
+        subnetGroupName: subnetGroup.name,
+        ...props
+      });
+      ctx.onFunction(({ lambda }) => {
+        const prefix = `CACHE_${constantCase3(ctx.stack.name)}_${constantCase3(id)}`;
+        lambda.addEnvironment(`${prefix}_HOST`, cluster.address);
+        lambda.addEnvironment(`${prefix}_PORT`, props.port.toString());
       });
-      ctx.shared.set(`mail-${id}-arn`, mailIdentityArn);
-      ctx.shared.set(`mail-${props.domain}-arn`, mailIdentityArn);
-      for (const record of props.dns ?? []) {
-        const name = record.name ?? props.domain;
-        new aws4.route53.RecordSet(group2, `${name}-${record.type}`, {
-          hostedZoneId: hostedZone.id,
-          name,
-          ...record
-        });
-      }
     }
-    ctx.onFunction(
-      ({ policy }) => policy.addStatement({
-        actions: ["ses:*"],
-        resources: [`arn:aws:ses:${ctx.appConfig.region}:${ctx.accountId}:identity/*`]
-      })
-    );
   }
 });
 
@@ -2601,8 +2577,145 @@ var configFeature = defineFeature({
   }
 });
 
+// src/feature/cron/index.ts
+import { Node as Node4, aws as aws4 } from "@awsless/formation";
+var cronFeature = defineFeature({
+  name: "cron",
+  onStack(ctx) {
+    for (const [id, props] of Object.entries(ctx.stackConfig.crons ?? {})) {
+      const group = new Node4(ctx.stack, "cron", id);
+      const { lambda } = createAsyncLambdaFunction(group, ctx, "cron", id, props.consumer);
+      const rule = new aws4.events.Rule(group, "rule", {
+        name: formatLocalResourceName(ctx.app.name, ctx.stack.name, this.name, id),
+        schedule: props.schedule,
+        enabled: props.enabled,
+        targets: [
+          {
+            id: "default",
+            arn: lambda.arn,
+            input: props.payload
+          }
+        ]
+      });
+      new aws4.lambda.Permission(group, "permission", {
+        action: "lambda:InvokeFunction",
+        principal: "events.amazonaws.com",
+        functionArn: lambda.arn,
+        sourceArn: rule.arn
+      });
+    }
+  }
+});
+
+// src/feature/domain/index.ts
+import { Node as Node5, aws as aws5 } from "@awsless/formation";
+import { minutes as minutes3 } from "@awsless/duration";
+var domainFeature = defineFeature({
+  name: "domain",
+  onApp(ctx) {
+    const domains = Object.entries(ctx.appConfig.defaults.domains ?? {});
+    if (domains.length === 0) {
+      return;
+    }
+    const group = new Node5(ctx.base, "domain", "mail");
+    const configurationSet = new aws5.ses.ConfigurationSet(group, "config", {
+      name: ctx.app.name,
+      engagementMetrics: true,
+      reputationMetrics: true
+    });
+    ctx.shared.set(`mail-configuration-set`, configurationSet.name);
+    for (const [id, props] of domains) {
+      const group2 = new Node5(ctx.base, "domain", id);
+      const hostedZone = new aws5.route53.HostedZone(group2, "zone", {
+        name: props.domain
+      });
+      ctx.shared.set(`hosted-zone-${id}-id`, hostedZone.id);
+      const certificate = new aws5.acm.Certificate(group2, "local", {
+        domainName: props.domain,
+        alternativeNames: [`*.${props.domain}`]
+      });
+      hostedZone.addRecord("local-cert-1", certificate.validationRecord(0));
+      hostedZone.addRecord("local-cert-2", certificate.validationRecord(1));
+      const validation = new aws5.acm.CertificateValidation(group2, "local", {
+        certificateArn: certificate.arn
+      });
+      ctx.shared.set(`local-certificate-${id}-arn`, validation.arn);
+      if (ctx.appConfig.region !== "us-east-1") {
+        const globalCertificate = new aws5.acm.Certificate(group2, "global", {
+          domainName: props.domain,
+          alternativeNames: [`*.${props.domain}`],
+          region: "us-east-1"
+        });
+        hostedZone.addRecord("global-cert-1", globalCertificate.validationRecord(0));
+        hostedZone.addRecord("global-cert-2", globalCertificate.validationRecord(1));
+        const globalValidation = new aws5.acm.CertificateValidation(group2, "global", {
+          certificateArn: globalCertificate.arn,
+          region: "us-east-1"
+        });
+        ctx.shared.set(`global-certificate-${id}-arn`, globalValidation.arn);
+      } else {
+        ctx.shared.set(`global-certificate-${id}-arn`, validation.arn);
+      }
+      const emailIdentity = new aws5.ses.EmailIdentity(group2, "mail", {
+        emailIdentity: props.domain,
+        mailFromDomain: `mail.${props.domain}`,
+        configurationSetName: configurationSet.name,
+        feedback: true,
+        rejectOnMxFailure: true
+      });
+      let i = 0;
+      for (const record of emailIdentity.dkimRecords) {
+        new aws5.route53.RecordSet(group2, `dkim-${++i}`, {
+          hostedZoneId: hostedZone.id,
+          ...record
+        });
+      }
+      new aws5.route53.RecordSet(group2, `MX`, {
+        hostedZoneId: hostedZone.id,
+        name: `mail.${props.domain}`,
+        type: "MX",
+        ttl: minutes3(5),
+        records: [`10 feedback-smtp.${ctx.appConfig.region}.amazonses.com`]
+      });
+      new aws5.route53.RecordSet(group2, `SPF`, {
+        hostedZoneId: hostedZone.id,
+        name: `mail.${props.domain}`,
+        type: "TXT",
+        ttl: minutes3(5),
+        records: ['"v=spf1 include:amazonses.com -all"']
+      });
+      new aws5.route53.RecordSet(group2, `DMARC`, {
+        hostedZoneId: hostedZone.id,
+        name: `_dmarc.${props.domain}`,
+        type: "TXT",
+        ttl: minutes3(5),
+        records: ['"v=DMARC1; p=none;"']
+      });
+      const mailIdentityArn = emailIdentity.output(() => {
+        return `arn:aws:ses:${ctx.appConfig.region}:${ctx.accountId}:identity/${props.domain}`;
+      });
+      ctx.shared.set(`mail-${id}-arn`, mailIdentityArn);
+      ctx.shared.set(`mail-${props.domain}-arn`, mailIdentityArn);
+      for (const record of props.dns ?? []) {
+        const name = record.name ?? props.domain;
+        new aws5.route53.RecordSet(group2, `${name}-${record.type}`, {
+          hostedZoneId: hostedZone.id,
+          name,
+          ...record
+        });
+      }
+    }
+    ctx.onFunction(
+      ({ policy }) => policy.addStatement({
+        actions: ["ses:*"],
+        resources: [`arn:aws:ses:${ctx.appConfig.region}:${ctx.accountId}:identity/*`]
+      })
+    );
+  }
+});
+
 // src/feature/function/index.ts
-import { aws as aws5, Node as Node5 } from "@awsless/formation";
+import { aws as aws6, Node as Node6 } from "@awsless/formation";
 import { camelCase as camelCase3 } from "change-case";
 import { relative } from "path";
 var typeGenCode2 = `
@@ -2655,14 +2768,14 @@ var functionFeature = defineFeature({
     await ctx.write("function.d.ts", types2, true);
   },
   onApp(ctx) {
-    const group = new Node5(ctx.base, "function", "asset");
-    const bucket = new aws5.s3.Bucket(group, "bucket", {
+    const group = new Node6(ctx.base, "function", "asset");
+    const bucket = new aws6.s3.Bucket(group, "bucket", {
       name: formatGlobalResourceName(ctx.appConfig.name, "function", "assets"),
       versioning: true,
       forceDelete: true
     });
     ctx.shared.set("function-bucket-name", bucket.name);
-    const repository = new aws5.ecr.Repository(group, "repository", {
+    const repository = new aws6.ecr.Repository(group, "repository", {
       name: formatGlobalResourceName(ctx.appConfig.name, "function", "repository", "-")
     });
     ctx.shared.set("function-repository-name", repository.name);
@@ -2670,19 +2783,19 @@ var functionFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.functions || {})) {
-      const group = new Node5(ctx.stack, "function", id);
+      const group = new Node6(ctx.stack, "function", id);
       createLambdaFunction(group, ctx, "function", id, props);
     }
   }
 });
 
 // src/feature/graphql/index.ts
-import { constantCase as constantCase3, paramCase as paramCase5 } from "change-case";
+import { constantCase as constantCase4, paramCase as paramCase5 } from "change-case";
 import { mergeTypeDefs } from "@graphql-tools/merge";
 import { generate } from "@awsless/graphql";
 import { buildSchema, print } from "graphql";
 import { readFile as readFile5 } from "fs/promises";
-import { Asset as Asset2, Node as Node6, aws as aws6 } from "@awsless/formation";
+import { Asset as Asset2, Node as Node7, aws as aws7 } from "@awsless/formation";
 
 // src/feature/domain/util.ts
 var getDomainNameById = (config2, id) => {
@@ -2922,14 +3035,14 @@ var graphqlFeature = defineFeature({
   },
   onApp(ctx) {
     for (const [id, props] of Object.entries(ctx.appConfig.defaults.graphql ?? {})) {
-      const group = new Node6(ctx.base, "graphql", id);
+      const group = new Node7(ctx.base, "graphql", id);
       let authorizer;
       if (typeof props.auth === "object") {
         const { lambda } = createLambdaFunction(group, ctx, "graphql-auth", id, props.auth.authorizer);
         authorizer = lambda;
       }
       const name = formatGlobalResourceName(ctx.app.name, "graphql", id);
-      const api = new aws6.appsync.GraphQLApi(group, "api", {
+      const api = new aws7.appsync.GraphQLApi(group, "api", {
         name,
         type: "graphql",
         auth: {
@@ -2947,7 +3060,7 @@ var graphqlFeature = defineFeature({
         }
       });
       if (typeof props.auth === "object") {
-        new aws6.lambda.Permission(group, "authorizer", {
+        new aws7.lambda.Permission(group, "authorizer", {
           functionArn: authorizer.arn,
           principal: "appsync.amazonaws.com",
           action: "lambda:InvokeFunction"
@@ -2976,7 +3089,7 @@ var graphqlFeature = defineFeature({
           };
         });
       });
-      new aws6.appsync.GraphQLSchema(group, "schema", {
+      new aws7.appsync.GraphQLSchema(group, "schema", {
         apiId: api.id,
         definition: Asset2.fromFile(getBuildPath("graphql-schema", name, "schema.gql"))
       });
@@ -2998,16 +3111,16 @@ var graphqlFeature = defineFeature({
       }
       if (props.domain) {
         const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
-        const domainGroup = new Node6(group, "domain", domainName);
-        const domain = new aws6.appsync.DomainName(domainGroup, "domain", {
+        const domainGroup = new Node7(group, "domain", domainName);
+        const domain = new aws7.appsync.DomainName(domainGroup, "domain", {
           domainName,
           certificateArn: ctx.shared.get(`global-certificate-${props.domain}-arn`)
         });
-        new aws6.appsync.DomainNameApiAssociation(domainGroup, "association", {
+        new aws7.appsync.DomainNameApiAssociation(domainGroup, "association", {
           apiId: api.id,
           domainName: domain.domainName
         });
-        new aws6.route53.RecordSet(domainGroup, "record", {
+        new aws7.route53.RecordSet(domainGroup, "record", {
           hostedZoneId: ctx.shared.get(`hosted-zone-${props.domain}-id`),
           type: "A",
           name: domainName,
@@ -3017,7 +3130,7 @@ var graphqlFeature = defineFeature({
             evaluateTargetHealth: false
           }
         });
-        ctx.bindEnv(`GRAPHQL_${constantCase3(id)}_ENDPOINT`, domainName);
+        ctx.bindEnv(`GRAPHQL_${constantCase4(id)}_ENDPOINT`, domainName);
       }
     }
   },
@@ -3030,18 +3143,18 @@ var graphqlFeature = defineFeature({
           `GraphQL definition is not defined on app level for "${id}"`
         );
       }
-      const group = new Node6(ctx.stack, "graphql", id);
+      const group = new Node7(ctx.stack, "graphql", id);
       const apiId = ctx.shared.get(`graphql-${id}-id`);
       for (const [typeName, fields] of Object.entries(props.resolvers ?? {})) {
         for (const [fieldName, props2] of Object.entries(fields ?? {})) {
           const name = `${typeName}__${fieldName}`;
-          const resolverGroup = new Node6(group, "resolver", name);
+          const resolverGroup = new Node7(group, "resolver", name);
           const entryId = paramCase5(`${id}-${shortId(`${typeName}-${fieldName}`)}`);
           const { lambda } = createLambdaFunction(resolverGroup, ctx, `graphql`, entryId, {
             ...props2.consumer,
             description: `${id} ${typeName}.${fieldName}`
           });
-          const role = new aws6.iam.Role(resolverGroup, "source-role", {
+          const role = new aws7.iam.Role(resolverGroup, "source-role", {
             assumedBy: "appsync.amazonaws.com",
             policies: [
               {
@@ -3055,7 +3168,7 @@ var graphqlFeature = defineFeature({
               }
             ]
           });
-          const source = new aws6.appsync.DataSource(resolverGroup, "source", {
+          const source = new aws7.appsync.DataSource(resolverGroup, "source", {
             apiId,
             name,
             role: role.arn,
@@ -3068,13 +3181,13 @@ var graphqlFeature = defineFeature({
           } else if (defaultProps.resolver) {
             code = Asset2.fromFile(getBuildPath("graphql-resolver", id, "resolver.js"));
           }
-          const config2 = new aws6.appsync.FunctionConfiguration(resolverGroup, "config", {
+          const config2 = new aws7.appsync.FunctionConfiguration(resolverGroup, "config", {
             apiId,
             name,
             code,
             dataSourceName: source.name
           });
-          new aws6.appsync.Resolver(resolverGroup, "resolver", {
+          new aws7.appsync.Resolver(resolverGroup, "resolver", {
             apiId,
             typeName,
             fieldName,
@@ -3087,32 +3200,200 @@ var graphqlFeature = defineFeature({
   }
 });
 
-// src/feature/on-failure/index.ts
-import { Node as Node7, aws as aws7 } from "@awsless/formation";
-var onFailureFeature = defineFeature({
-  name: "on-failure",
-  onApp(ctx) {
-    if (!hasOnFailure(ctx.stackConfigs)) {
-      return;
+// src/feature/http/index.ts
+import { Node as Node8, aws as aws8 } from "@awsless/formation";
+import { camelCase as camelCase4, constantCase as constantCase5 } from "change-case";
+import { relative as relative2 } from "path";
+var parseRoute = (route) => {
+  const [method, ...paths] = route.split(" ");
+  const path = paths.join(" ");
+  return { method, path };
+};
+var strToInt = (str) => {
+  return parseInt(Buffer.from(str, "utf8").toString("hex"), 16);
+};
+var generatePriority = (stackName, route) => {
+  const start = strToInt(stackName) % 500 + 1;
+  const end = strToInt(route) % 100;
+  const priority = start + "" + end;
+  return parseInt(priority, 10);
+};
+var httpFeature = defineFeature({
+  name: "http",
+  async onTypeGen(ctx) {
+    const types2 = new TypeFile("@awsless/awsless");
+    const resources = new TypeObject(1);
+    const api = {};
+    for (const stack of ctx.stackConfigs) {
+      for (const [id, routes] of Object.entries(stack.http ?? {})) {
+        if (!(id in api))
+          api[id] = {};
+        for (const [route, props] of Object.entries(routes)) {
+          const { path, method } = parseRoute(route);
+          const file = typeof props === "string" ? props : props.file;
+          if (!(method in api[id])) {
+            api[id][method] = {};
+          }
+          api[id][method][path] = file;
+        }
+      }
     }
-    const count = ctx.stackConfigs.filter((s) => s.onFailure).length;
-    if (count > 1) {
-      throw new TypeError("Only 1 onFailure configuration is allowed in your app.");
+    for (const [id, routes] of Object.entries(api)) {
+      const idType = new TypeObject(2);
+      for (const [method, paths] of Object.entries(routes)) {
+        const methodType = new TypeObject(3);
+        for (const [path, file] of Object.entries(paths)) {
+          const paramType = new TypeObject(4);
+          for (const param of path.matchAll(/{([a-z0-9]+)}/g)) {
+            paramType.addType(param[0], "string | number");
+          }
+          const varName = camelCase4(`${id}-${path}-${method}`);
+          const relFile = relative2(directories.types, file);
+          types2.addImport(varName, relFile);
+          methodType.add(`'${path}'`, `Route<typeof ${varName}, ${paramType.toString() || "never"}>`);
+        }
+        idType.addConst(method, methodType);
+      }
+      resources.addType(id, idType);
     }
-    const queue2 = new aws7.sqs.Queue(ctx.base, "on-failure", {
-      name: formatGlobalResourceName(ctx.appConfig.name, "on-failure", "failure")
-    });
-    ctx.shared.set("on-failure-queue-arn", queue2.arn);
+    const code = [
+      `import { InvokeResponse } from '@awsless/lambda'`,
+      `type Function = (...args: any) => any`,
+      `type Event<F extends Function> = Parameters<F>[0]`,
+      `type RequestWithQuery = { request: { queryStringParameters: any } }`,
+      `type RequestWithBody = { request: { body: any } }`,
+      `type ResponseWithBody = { statusCode: number, body: any }`,
+      `type Query<F extends Function> = Event<F> extends RequestWithQuery ? Event<F>['request']['queryStringParameters'] : never`,
+      `type Body<F extends Function> = Event<F> extends RequestWithBody ? Exclude<Event<F>['request']['body'], string> : never`,
+      `type Response<F extends Function> = Awaited<InvokeResponse<F>> extends ResponseWithBody ? Promise<Awaited<InvokeResponse<F>>['body']> : Promise<never>`,
+      `type Route<F extends Function, P> = { param: P; query: Query<F>; body: Body<F>; response: Response<F> }`
+    ];
+    code.map((code2) => types2.addCode(code2));
+    types2.addInterface("HTTP", resources);
+    await ctx.write("http.d.ts", types2, true);
   },
-  onStack(ctx) {
-    const onFailure = ctx.stackConfig.onFailure;
+  onApp(ctx) {
+    if (Object.keys(ctx.appConfig.defaults?.http ?? {}).length === 0) {
+      return;
+    }
+    const group = new Node8(ctx.base, "http", "main");
+    const securityGroup = new aws8.ec2.SecurityGroup(group, "http", {
+      vpcId: ctx.shared.get(`vpc-id`),
+      name: formatGlobalResourceName(ctx.app.name, "http", "http"),
+      description: `Global security group for HTTP api.`
+    });
+    const port = aws8.ec2.Port.tcp(443);
+    securityGroup.addIngressRule({ port, peer: aws8.ec2.Peer.anyIpv4() });
+    securityGroup.addIngressRule({ port, peer: aws8.ec2.Peer.anyIpv6() });
+    for (const [id, props] of Object.entries(ctx.appConfig.defaults?.http ?? {})) {
+      const group2 = new Node8(ctx.base, "http", id);
+      const loadBalancer = new aws8.elb.LoadBalancer(group2, "balancer", {
+        name: formatGlobalResourceName(ctx.app.name, "http", id),
+        type: "application",
+        securityGroups: [securityGroup.id],
+        subnets: [
+          //
+          ctx.shared.get(`vpc-public-subnet-id-1`),
+          ctx.shared.get(`vpc-public-subnet-id-2`)
+        ]
+      });
+      const listener = new aws8.elb.Listener(group2, "listener", {
+        loadBalancerArn: loadBalancer.arn,
+        port: 443,
+        protocol: "https",
+        certificates: [ctx.shared.get(`local-certificate-${props.domain}-arn`)],
+        defaultActions: [
+          aws8.elb.ListenerAction.fixedResponse({
+            statusCode: 404,
+            contentType: "application/json",
+            messageBody: JSON.stringify({
+              message: "Route not found"
+            })
+          })
+        ]
+      });
+      ctx.shared.set(`http-${id}-listener-arn`, listener.arn);
+      const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
+      new aws8.route53.RecordSet(group2, domainName, {
+        hostedZoneId: ctx.shared.get(`hosted-zone-${props.domain}-id`),
+        name: domainName,
+        type: "A",
+        alias: {
+          evaluateTargetHealth: false,
+          hostedZoneId: loadBalancer.hostedZoneId,
+          dnsName: loadBalancer.dnsName
+        }
+      });
+      ctx.bindEnv(`HTTP_${constantCase5(id)}_ENDPOINT`, domainName);
+    }
+  },
+  onStack(ctx) {
+    for (const [id, routes] of Object.entries(ctx.stackConfig.http ?? {})) {
+      const props = ctx.appConfig.defaults.http?.[id];
+      if (!props) {
+        throw new Error(`Http definition is not defined on app level for "${id}"`);
+      }
+      const group = new Node8(ctx.stack, "http", id);
+      for (const [routeKey, routeProps] of Object.entries(routes)) {
+        const routeGroup = new Node8(group, "route", routeKey);
+        const { method, path } = parseRoute(routeKey);
+        const routeId = shortId(routeKey);
+        const { lambda } = createLambdaFunction(routeGroup, ctx, "http", `${id}-${routeId}`, {
+          ...routeProps,
+          description: routeKey
+        });
+        const name = formatLocalResourceName(ctx.app.name, ctx.stack.name, "http", routeId);
+        const permission = new aws8.lambda.Permission(routeGroup, id, {
+          action: "lambda:InvokeFunction",
+          principal: "elasticloadbalancing.amazonaws.com",
+          functionArn: lambda.arn
+          // sourceArn: `arn:aws:elasticloadbalancing:${ctx.appConfig.region}:*:targetgroup/${name}/*`,
+        });
+        const target = new aws8.elb.TargetGroup(routeGroup, id, {
+          name,
+          type: "lambda",
+          targets: [lambda.arn]
+        }).dependsOn(permission);
+        new aws8.elb.ListenerRule(routeGroup, id, {
+          listenerArn: ctx.shared.get(`http-${id}-listener-arn`),
+          priority: generatePriority(ctx.stackConfig.name, routeKey),
+          conditions: [
+            aws8.elb.ListenerCondition.httpRequestMethods([method]),
+            aws8.elb.ListenerCondition.pathPatterns([path])
+          ],
+          actions: [aws8.elb.ListenerAction.forward([target.arn])]
+        }).dependsOn(target);
+      }
+    }
+  }
+});
+
+// src/feature/on-failure/index.ts
+import { Node as Node9, aws as aws9 } from "@awsless/formation";
+var onFailureFeature = defineFeature({
+  name: "on-failure",
+  onApp(ctx) {
+    if (!hasOnFailure(ctx.stackConfigs)) {
+      return;
+    }
+    const count = ctx.stackConfigs.filter((s) => s.onFailure).length;
+    if (count > 1) {
+      throw new TypeError("Only 1 onFailure configuration is allowed in your app.");
+    }
+    const queue2 = new aws9.sqs.Queue(ctx.base, "on-failure", {
+      name: formatGlobalResourceName(ctx.appConfig.name, "on-failure", "failure")
+    });
+    ctx.shared.set("on-failure-queue-arn", queue2.arn);
+  },
+  onStack(ctx) {
+    const onFailure = ctx.stackConfig.onFailure;
     if (!onFailure) {
       return;
     }
     const queueArn = ctx.shared.get("on-failure-queue-arn");
-    const group = new Node7(ctx.stack, "on-failure", "failure");
+    const group = new Node9(ctx.stack, "on-failure", "failure");
     const { lambda, policy } = createLambdaFunction(group, ctx, "on-failure", "failure", onFailure);
-    const source = new aws7.lambda.EventSourceMapping(group, "on-failure", {
+    const source = new aws9.lambda.EventSourceMapping(group, "on-failure", {
       functionArn: lambda.arn,
       sourceArn: queueArn,
       batchSize: 10
@@ -3132,7 +3413,7 @@ var onFailureFeature = defineFeature({
 });
 
 // src/feature/pubsub/index.ts
-import { Node as Node8, aws as aws8 } from "@awsless/formation";
+import { Node as Node10, aws as aws10 } from "@awsless/formation";
 var pubsubFeature = defineFeature({
   name: "pubsub",
   onApp(ctx) {
@@ -3145,16 +3426,16 @@ var pubsubFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.pubsub ?? {})) {
-      const group = new Node8(ctx.stack, "pubsub", id);
+      const group = new Node10(ctx.stack, "pubsub", id);
       const { lambda } = createAsyncLambdaFunction(group, ctx, `pubsub`, id, props.consumer);
       const name = formatLocalResourceName(ctx.app.name, ctx.stack.name, "pubsub", id);
-      const topic = new aws8.iot.TopicRule(group, "rule", {
+      const topic = new aws10.iot.TopicRule(group, "rule", {
         name: name.replaceAll("-", "_"),
         sql: props.sql,
         sqlVersion: props.sqlVersion,
         actions: [{ lambda: { functionArn: lambda.arn } }]
       });
-      new aws8.lambda.Permission(group, "permission", {
+      new aws10.lambda.Permission(group, "permission", {
         action: "lambda:InvokeFunction",
         principal: "iot.amazonaws.com",
         functionArn: lambda.arn,
@@ -3165,10 +3446,10 @@ var pubsubFeature = defineFeature({
 });
 
 // src/feature/queue/index.ts
-import { camelCase as camelCase4, constantCase as constantCase4 } from "change-case";
-import { relative as relative2 } from "path";
+import { camelCase as camelCase5, constantCase as constantCase6 } from "change-case";
+import { relative as relative3 } from "path";
 import deepmerge2 from "deepmerge";
-import { Node as Node9, aws as aws9 } from "@awsless/formation";
+import { Node as Node11, aws as aws11 } from "@awsless/formation";
 var typeGenCode3 = `
 import { SendMessageOptions, SendMessageBatchOptions, BatchItem } from '@awsless/sqs'
 import type { Mock } from 'vitest'
@@ -3198,10 +3479,10 @@ var queueFeature = defineFeature({
       const mock = new TypeObject(2);
       const mockResponse = new TypeObject(2);
       for (const [name, fileOrProps] of Object.entries(stack.queues || {})) {
-        const varName = camelCase4(`${stack.name}-${name}`);
+        const varName = camelCase5(`${stack.name}-${name}`);
         const queueName = formatLocalResourceName(ctx.appConfig.name, stack.name, "queue", name);
         const file = typeof fileOrProps === "string" ? fileOrProps : typeof fileOrProps.consumer === "string" ? fileOrProps.consumer : fileOrProps.consumer.file;
-        const relFile = relative2(directories.types, file);
+        const relFile = relative3(directories.types, file);
         gen.addImport(varName, relFile);
         mock.addType(name, `MockBuilder<typeof ${varName}>`);
         resource2.addType(name, `Send<'${queueName}', typeof ${varName}>`);
@@ -3220,15 +3501,15 @@ var queueFeature = defineFeature({
   onStack(ctx) {
     for (const [id, local2] of Object.entries(ctx.stackConfig.queues || {})) {
       const props = deepmerge2(ctx.appConfig.defaults.queue, local2);
-      const group = new Node9(ctx.stack, "queue", id);
-      const queue2 = new aws9.sqs.Queue(group, "queue", {
+      const group = new Node11(ctx.stack, "queue", id);
+      const queue2 = new aws11.sqs.Queue(group, "queue", {
         name: formatLocalResourceName(ctx.appConfig.name, ctx.stack.name, "queue", id),
         deadLetterArn: getGlobalOnFailure(ctx),
         ...props
       });
       const { lambda, policy } = createLambdaFunction(group, ctx, `queue`, id, props.consumer);
       lambda.addEnvironment("LOG_VIEWABLE_ERROR", "1");
-      new aws9.lambda.EventSourceMapping(group, "event", {
+      new aws11.lambda.EventSourceMapping(group, "event", {
         functionArn: lambda.arn,
         sourceArn: queue2.arn,
         batchSize: props.batchSize,
@@ -3241,612 +3522,129 @@ var queueFeature = defineFeature({
       });
       ctx.onFunction(({ lambda: lambda2, policy: policy2 }) => {
         policy2.addStatement(queue2.permissions);
-        lambda2.addEnvironment(`QUEUE_${constantCase4(ctx.stack.name)}_${constantCase4(id)}_URL`, queue2.url);
+        lambda2.addEnvironment(`QUEUE_${constantCase6(ctx.stack.name)}_${constantCase6(id)}_URL`, queue2.url);
       });
     }
   }
 });
 
-// src/feature/store/index.ts
-import { aws as aws10, Node as Node10 } from "@awsless/formation";
-var typeGenCode4 = `
-import { Body, PutObjectProps, BodyStream, createPresignedPost } from '@awsless/s3'
-import { Size } from '@awsless/size'
-import { Duration } from '@awsless/duration'
-import { PresignedPost } from '@aws-sdk/s3-presigned-post'
-
-type Store<Name extends string> = {
-	readonly name: Name
-	readonly put: (key: string, body: Body, options?: Pick<PutObjectProps, 'metadata' | 'storageClass'>) => Promise<void>
-	readonly get: (key: string) => Promise<BodyStream | undefined>
-	readonly delete: (key: string) => Promise<void>
-	readonly createPresignedPost: (key: string, contentLengthRange: [Size, Size], expires?: Duration, fields?: Record<string, string>) => Promise<PresignedPost>
-}
-`;
-var storeFeature = defineFeature({
-  name: "store",
-  async onTypeGen(ctx) {
-    const gen = new TypeFile("@awsless/awsless");
-    const resources = new TypeObject(1);
-    for (const stack of ctx.stackConfigs) {
-      const list4 = new TypeObject(2);
-      for (const id of Object.keys(stack.stores ?? {})) {
-        const storeName = formatLocalResourceName(ctx.appConfig.name, stack.name, "store", id);
-        list4.addType(id, `Store<'${storeName}'>`);
+// src/feature/rest/index.ts
+import { Node as Node12, aws as aws12 } from "@awsless/formation";
+import { constantCase as constantCase7 } from "change-case";
+var restFeature = defineFeature({
+  name: "rest",
+  onApp(ctx) {
+    for (const [id, props] of Object.entries(ctx.appConfig.defaults?.rest ?? {})) {
+      const group = new Node12(ctx.base, "rest", id);
+      const api = new aws12.apiGatewayV2.Api(group, "api", {
+        name: formatGlobalResourceName(ctx.app.name, "rest", id),
+        protocolType: "HTTP"
+      });
+      const stage = new aws12.apiGatewayV2.Stage(group, "stage", {
+        name: "v1",
+        apiId: api.id
+      });
+      ctx.shared.set(`rest-${id}-id`, api.id);
+      if (props.domain) {
+        const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
+        const hostedZoneId = ctx.shared.get(`hosted-zone-${props.domain}-id`);
+        const certificateArn = ctx.shared.get(`certificate-${props.domain}-arn`);
+        const domain = new aws12.apiGatewayV2.DomainName(group, "domain", {
+          name: domainName,
+          certificates: [
+            {
+              certificateArn
+            }
+          ]
+        });
+        const mapping = new aws12.apiGatewayV2.ApiMapping(group, "mapping", {
+          apiId: api.id,
+          domainName: domain.name,
+          stage: stage.name
+        });
+        const record = new aws12.route53.RecordSet(group, "record", {
+          hostedZoneId,
+          type: "A",
+          name: domainName,
+          alias: {
+            dnsName: domain.regionalDomainName,
+            hostedZoneId: domain.regionalHostedZoneId,
+            evaluateTargetHealth: false
+          }
+        });
+        record.dependsOn(domain, mapping);
+        ctx.bindEnv(`REST_${constantCase7(id)}_ENDPOINT`, domainName);
       }
-      resources.addType(stack.name, list4);
     }
-    gen.addCode(typeGenCode4);
-    gen.addInterface("StoreResources", resources);
-    await ctx.write("store.d.ts", gen, true);
   },
   onStack(ctx) {
-    for (const [id, props] of Object.entries(ctx.stackConfig.stores ?? {})) {
-      const group = new Node10(ctx.stack, "store", id);
-      const bucketName = formatLocalResourceName(ctx.appConfig.name, ctx.stack.name, "store", id);
-      const lambdaConfigs = [];
-      const eventMap = {
-        "created:*": "s3:ObjectCreated:*",
-        "created:put": "s3:ObjectCreated:Put",
-        "created:post": "s3:ObjectCreated:Post",
-        "created:copy": "s3:ObjectCreated:Copy",
-        "created:upload": "s3:ObjectCreated:CompleteMultipartUpload",
-        "removed:*": "s3:ObjectRemoved:*",
-        "removed:delete": "s3:ObjectRemoved:Delete",
-        "removed:marker": "s3:ObjectRemoved:DeleteMarkerCreated"
-      };
-      for (const [event, funcProps] of Object.entries(props.events ?? {})) {
-        const eventGroup = new Node10(group, "event", event);
-        const { lambda } = createAsyncLambdaFunction(eventGroup, ctx, `store`, id, funcProps);
-        new aws10.lambda.Permission(eventGroup, "permission", {
+    for (const [id, routes] of Object.entries(ctx.stackConfig.rest ?? {})) {
+      const restGroup = new Node12(ctx.stack, "rest", id);
+      for (const [routeKey, props] of Object.entries(routes)) {
+        const group = new Node12(restGroup, "route", routeKey);
+        const apiId = ctx.shared.get(`rest-${id}-id`);
+        const routeId = shortId(routeKey);
+        const { lambda } = createLambdaFunction(group, ctx, "rest", `${id}-${routeId}`, {
+          ...props,
+          description: `${id} ${routeKey}`
+        });
+        const permission = new aws12.lambda.Permission(group, "permission", {
           action: "lambda:InvokeFunction",
-          principal: "s3.amazonaws.com",
-          functionArn: lambda.arn,
-          sourceArn: `arn:aws:s3:::${bucketName}`
+          principal: "apigateway.amazonaws.com",
+          functionArn: lambda.arn
         });
-        lambdaConfigs.push({
-          event: eventMap[event],
-          function: lambda.arn
+        const integration = new aws12.apiGatewayV2.Integration(group, "integration", {
+          apiId,
+          description: `${id} ${routeKey}`,
+          method: "POST",
+          payloadFormatVersion: "2.0",
+          type: "AWS_PROXY",
+          uri: lambda.arn.apply((arn) => {
+            return `arn:aws:apigateway:${ctx.appConfig.region}:lambda:path/2015-03-31/functions/${arn}/invocations`;
+          })
         });
+        const route = new aws12.apiGatewayV2.Route(group, "route", {
+          apiId,
+          routeKey,
+          target: integration.id.apply((id2) => `integrations/${id2}`)
+        });
+        route.dependsOn(lambda, permission);
       }
-      const bucket = new aws10.s3.Bucket(group, "store", {
-        name: bucketName,
-        versioning: props.versioning,
-        lambdaConfigs,
-        cors: [
-          // ---------------------------------------------
-          // Support for presigned post requests
-          // ---------------------------------------------
-          {
-            origins: ["*"],
-            methods: ["POST"]
-          }
-          // ---------------------------------------------
-        ]
-      });
-      ctx.onFunction(({ policy }) => {
-        policy.addStatement(bucket.permissions);
-      });
     }
   }
 });
 
-// src/feature/table/index.ts
-import { Node as Node11, aws as aws11 } from "@awsless/formation";
-var tableFeature = defineFeature({
-  name: "table",
+// src/feature/search/index.ts
+import { Node as Node13, aws as aws13 } from "@awsless/formation";
+import { constantCase as constantCase8 } from "change-case";
+var typeGenCode4 = `
+import { AnyStruct, Table } from '@awsless/open-search'
+
+type Search = {
+	readonly domain: string
+	readonly defineTable: <N extends stringm S extends AnyStruct>(tableName: N, schema: S) => Table<N, S>
+}
+`;
+var searchFeature = defineFeature({
+  name: "search",
   async onTypeGen(ctx) {
     const gen = new TypeFile("@awsless/awsless");
     const resources = new TypeObject(1);
     for (const stack of ctx.stackConfigs) {
       const list4 = new TypeObject(2);
-      for (const name of Object.keys(stack.tables || {})) {
-        const tableName = formatLocalResourceName(ctx.appConfig.name, stack.name, "table", name);
-        list4.addType(name, `'${tableName}'`);
+      for (const id of Object.keys(stack.searchs ?? {})) {
+        list4.addType(id, `Search`);
       }
       resources.addType(stack.name, list4);
     }
-    gen.addInterface("TableResources", resources);
-    await ctx.write("table.d.ts", gen, true);
-  },
-  onStack(ctx) {
-    for (const [id, props] of Object.entries(ctx.stackConfig.tables ?? {})) {
-      const group = new Node11(ctx.stack, "table", id);
-      const table2 = new aws11.dynamodb.Table(group, "table", {
-        ...props,
-        name: formatLocalResourceName(ctx.appConfig.name, ctx.stackConfig.name, "table", id),
-        stream: props.stream?.type
-      });
-      if (props.stream) {
-        const { lambda, policy } = createLambdaFunction(group, ctx, "table", id, props.stream.consumer);
-        lambda.addEnvironment("LOG_VIEWABLE_ERROR", "1");
-        const onFailure = getGlobalOnFailure(ctx);
-        const source = new aws11.lambda.EventSourceMapping(group, id, {
-          functionArn: lambda.arn,
-          sourceArn: table2.streamArn,
-          batchSize: 100,
-          bisectBatchOnError: true,
-          // retryAttempts: props.stream.consumer.retryAttempts ?? -1,
-          parallelizationFactor: 1,
-          startingPosition: "latest",
-          onFailure
-        });
-        policy.addStatement(table2.streamPermissions);
-        source.dependsOn(policy);
-        if (onFailure) {
-          policy.addStatement({
-            actions: ["sqs:SendMessage", "sqs:GetQueueUrl"],
-            resources: [onFailure]
-          });
-        }
-      }
-      ctx.onFunction(({ policy }) => {
-        policy.addStatement(...table2.permissions);
-      });
-    }
-  }
-});
-
-// src/feature/test/index.ts
-var testFeature = defineFeature({
-  name: "test",
-  onStack(ctx) {
-    if (ctx.stackConfig.tests) {
-      ctx.registerTest(ctx.stackConfig.name, ctx.stackConfig.tests);
-    }
-  }
-});
-
-// src/feature/topic/index.ts
-import { Node as Node12, aws as aws12 } from "@awsless/formation";
-var typeGenCode5 = `
-import type { PublishOptions } from '@awsless/sns'
-import type { Mock } from 'vitest'
-
-type Publish<Name extends string> = {
-	readonly name: Name
-	(payload: unknown, options?: Omit<PublishOptions, 'topic' | 'payload'>): Promise<void>
-}
-
-type MockHandle = (payload: unknown) => void
-type MockBuilder = (handle?: MockHandle) => void
-`;
-var topicFeature = defineFeature({
-  name: "topic",
-  async onTypeGen(ctx) {
-    const gen = new TypeFile("@awsless/awsless");
-    const resources = new TypeObject(1);
-    const mocks = new TypeObject(1);
-    const mockResponses = new TypeObject(1);
-    for (const stack of ctx.stackConfigs) {
-      for (const topic of stack.topics || []) {
-        const name = formatGlobalResourceName(ctx.appConfig.name, "topic", topic);
-        mockResponses.addType(topic, "Mock");
-        resources.addType(topic, `Publish<'${name}'>`);
-        mocks.addType(topic, `MockBuilder`);
-      }
-    }
-    gen.addCode(typeGenCode5);
-    gen.addInterface("TopicResources", resources);
-    gen.addInterface("TopicMock", mocks);
-    gen.addInterface("TopicMockResponse", mockResponses);
-    await ctx.write("topic.d.ts", gen, true);
-  },
-  onApp(ctx) {
-    for (const stack of ctx.stackConfigs) {
-      for (const id of stack.topics ?? []) {
-        const group = new Node12(ctx.base, "topic", id);
-        const topic = new aws12.sns.Topic(group, "topic", {
-          name: formatGlobalResourceName(ctx.appConfig.name, "topic", id)
-        });
-        ctx.shared.set(`topic-${id}-arn`, topic.arn);
-      }
-    }
-  },
-  onStack(ctx) {
-    for (const id of ctx.stackConfig.topics ?? []) {
-      ctx.onFunction(({ policy }) => {
-        policy.addStatement({
-          actions: ["sns:Publish"],
-          resources: [ctx.shared.get(`topic-${id}-arn`)]
-        });
-      });
-    }
-    for (const [id, props] of Object.entries(ctx.stackConfig.subscribers ?? {})) {
-      const group = new Node12(ctx.stack, "topic", id);
-      const topicArn = ctx.shared.get(`topic-${id}-arn`);
-      if (typeof props === "string" && isEmail(props)) {
-        new aws12.sns.Subscription(group, id, {
-          topicArn,
-          protocol: "email",
-          endpoint: props
-        });
-      } else if (typeof props === "object") {
-        const { lambda } = createAsyncLambdaFunction(group, ctx, `topic`, id, props);
-        new aws12.sns.Subscription(group, id, {
-          topicArn,
-          protocol: "lambda",
-          endpoint: lambda.arn
-        });
-        new aws12.lambda.Permission(group, id, {
-          action: "lambda:InvokeFunction",
-          principal: "sns.amazonaws.com",
-          functionArn: lambda.arn,
-          sourceArn: topicArn
-        });
-      }
-    }
-  }
-});
-
-// src/feature/vpc/index.ts
-import { Node as Node13, all, aws as aws13 } from "@awsless/formation";
-var vpcFeature = defineFeature({
-  name: "vpc",
-  onApp(ctx) {
-    const group = new Node13(ctx.base, "vpc", "main");
-    const vpc = new aws13.ec2.Vpc(group, "vpc", {
-      name: ctx.app.name,
-      cidrBlock: aws13.ec2.Peer.ipv4("10.0.0.0/16")
-    });
-    const privateRouteTable = new aws13.ec2.RouteTable(group, "private", {
-      vpcId: vpc.id,
-      name: "private"
-    });
-    const publicRouteTable = new aws13.ec2.RouteTable(group, "public", {
-      vpcId: vpc.id,
-      name: "public"
-    });
-    const gateway = new aws13.ec2.InternetGateway(group, "gateway");
-    const attachment = new aws13.ec2.VPCGatewayAttachment(group, "attachment", {
-      vpcId: vpc.id,
-      internetGatewayId: gateway.id
-    });
-    new aws13.ec2.Route(group, "route", {
-      gatewayId: gateway.id,
-      routeTableId: publicRouteTable.id,
-      destination: aws13.ec2.Peer.anyIpv4()
-    });
-    ctx.shared.set(
-      "vpc-id",
-      // Some resources require the internet gateway to be attached.
-      all([vpc.id, attachment.internetGatewayId]).apply(([id]) => id)
-    );
-    ctx.shared.set("vpc-security-group-id", vpc.defaultSecurityGroup);
-    const zones = ["a", "b"];
-    const tables = [privateRouteTable, publicRouteTable];
-    let block = 0;
-    for (const table2 of tables) {
-      for (const i in zones) {
-        const index = Number(i) + 1;
-        const id = `${table2.identifier}-${index}`;
-        const subnet = new aws13.ec2.Subnet(group, id, {
-          vpcId: vpc.id,
-          cidrBlock: aws13.ec2.Peer.ipv4(`10.0.${block++}.0/24`),
-          availabilityZone: ctx.appConfig.region + zones[i]
-        });
-        new aws13.ec2.SubnetRouteTableAssociation(group, id, {
-          routeTableId: table2.id,
-          subnetId: subnet.id
-        });
-        ctx.shared.set(`vpc-${table2.identifier}-subnet-id-${index}`, subnet.id);
-      }
-    }
-  }
-});
-
-// src/feature/auth/index.ts
-import { constantCase as constantCase5 } from "change-case";
-import { Node as Node14, aws as aws14 } from "@awsless/formation";
-var authFeature = defineFeature({
-  name: "auth",
-  async onTypeGen(ctx) {
-    const gen = new TypeFile("@awsless/awsless");
-    const resources = new TypeObject(1);
-    for (const name of Object.keys(ctx.appConfig.defaults.auth)) {
-      const authName = formatGlobalResourceName(ctx.appConfig.name, "auth", name);
-      resources.addType(
-        name,
-        `{ readonly name: '${authName}', readonly userPoolId: string, readonly clientId: string }`
-      );
-    }
-    gen.addInterface("AuthResources", resources);
-    await ctx.write("auth.d.ts", gen, true);
-  },
-  onStack(ctx) {
-    for (const [id, props] of Object.entries(ctx.stackConfig.auth ?? {})) {
-      const group = new Node14(ctx.stack, "auth", id);
-      const userPoolId = ctx.shared.get(`auth-${id}-user-pool-id`);
-      const userPoolArn = ctx.shared.get(`auth-${id}-user-pool-arn`);
-      const clientId = ctx.shared.get(`auth-${id}-client-id`);
-      const triggers = {};
-      const list4 = {};
-      for (const [trigger, triggerProps] of Object.entries(props.triggers ?? {})) {
-        const triggerGroup = new Node14(group, "trigger", trigger);
-        const { lambda, policy } = createAsyncLambdaFunction(
-          triggerGroup,
-          ctx,
-          "auth",
-          `${id}-${trigger}`,
-          triggerProps
-        );
-        triggers[trigger] = lambda.arn;
-        list4[trigger] = {
-          trigger,
-          group: triggerGroup,
-          lambda,
-          policy
-        };
-      }
-      new aws14.cognito.LambdaTriggers(group, "lambda-triggers", {
-        userPoolId,
-        triggers
-      });
-      for (const item of Object.values(list4)) {
-        new aws14.lambda.Permission(item.group, `permission`, {
-          action: "lambda:InvokeFunction",
-          principal: "cognito-idp.amazonaws.com",
-          functionArn: item.lambda.arn,
-          sourceArn: userPoolArn
-        });
-        item.lambda.addEnvironment(`AUTH_${constantCase5(id)}_USER_POOL_ID`, userPoolId);
-        item.lambda.addEnvironment(`AUTH_${constantCase5(id)}_CLIENT_ID`, clientId);
-        item.policy.addStatement({
-          actions: ["cognito:*"],
-          resources: [
-            // Not yet known if this is correct way to grant access to all resources
-            userPoolArn
-            // userPoolId.apply<aws.ARN>(
-            // 	id => `arn:aws:cognito-idp:${ctx.appConfig.region}:${ctx.accountId}:userpool/${id}`
-            // ),
-            // userPoolId.apply<aws.ARN>(
-            // 	id => `arn:aws:cognito-idp:${ctx.appConfig.region}:${ctx.accountId}:userpool/${id}*`
-            // ),
-          ]
-        });
-      }
-    }
-  },
-  onApp(ctx) {
-    for (const [id, props] of Object.entries(ctx.appConfig.defaults.auth ?? {})) {
-      const group = new Node14(ctx.base, "auth", id);
-      let emailConfig;
-      if (props.messaging) {
-        const [_, domainName] = props.messaging.fromEmail.split("@");
-        emailConfig = {
-          type: "developer",
-          replyTo: props.messaging.replyTo,
-          sourceArn: ctx.shared.get(`mail-${domainName}-arn`),
-          configurationSet: ctx.shared.get("mail-configuration-set"),
-          from: props.messaging.fromName ? `${props.messaging.fromName} <${props.messaging.fromEmail}>` : props.messaging.fromEmail
-        };
-      }
-      const name = formatGlobalResourceName(ctx.appConfig.name, "auth", id);
-      const userPool = new aws14.cognito.UserPool(group, "user-pool", {
-        name,
-        // deletionProtection: true,
-        allowUserRegistration: props.allowUserRegistration,
-        username: props.username,
-        password: props.password,
-        email: emailConfig
-      });
-      const client = new aws14.cognito.UserPoolClient(group, "client", {
-        userPoolId: userPool.id,
-        name,
-        validity: props.validity,
-        supportedIdentityProviders: ["cognito"],
-        authFlows: {
-          userSrp: true
-        }
-      });
-      ctx.bindEnv(`AUTH_${constantCase5(id)}_USER_POOL_ID`, userPool.id);
-      ctx.bindEnv(`AUTH_${constantCase5(id)}_CLIENT_ID`, client.id);
-      ctx.shared.set(`auth-${id}-user-pool-arn`, userPool.arn);
-      ctx.shared.set(`auth-${id}-user-pool-id`, userPool.id);
-      ctx.shared.set(`auth-${id}-client-id`, client.id);
-    }
-  }
-});
-
-// src/feature/http/index.ts
-import { Node as Node15, aws as aws15 } from "@awsless/formation";
-import { camelCase as camelCase5, constantCase as constantCase6 } from "change-case";
-import { relative as relative3 } from "path";
-var parseRoute = (route) => {
-  const [method, ...paths] = route.split(" ");
-  const path = paths.join(" ");
-  return { method, path };
-};
-var strToInt = (str) => {
-  return parseInt(Buffer.from(str, "utf8").toString("hex"), 16);
-};
-var generatePriority = (stackName, route) => {
-  const start = strToInt(stackName) % 500 + 1;
-  const end = strToInt(route) % 100;
-  const priority = start + "" + end;
-  return parseInt(priority, 10);
-};
-var httpFeature = defineFeature({
-  name: "http",
-  async onTypeGen(ctx) {
-    const types2 = new TypeFile("@awsless/awsless");
-    const resources = new TypeObject(1);
-    const api = {};
-    for (const stack of ctx.stackConfigs) {
-      for (const [id, routes] of Object.entries(stack.http ?? {})) {
-        if (!(id in api))
-          api[id] = {};
-        for (const [route, props] of Object.entries(routes)) {
-          const { path, method } = parseRoute(route);
-          const file = typeof props === "string" ? props : props.file;
-          if (!(method in api[id])) {
-            api[id][method] = {};
-          }
-          api[id][method][path] = file;
-        }
-      }
-    }
-    for (const [id, routes] of Object.entries(api)) {
-      const idType = new TypeObject(2);
-      for (const [method, paths] of Object.entries(routes)) {
-        const methodType = new TypeObject(3);
-        for (const [path, file] of Object.entries(paths)) {
-          const paramType = new TypeObject(4);
-          for (const param of path.matchAll(/{([a-z0-9]+)}/g)) {
-            paramType.addType(param[0], "string | number");
-          }
-          const varName = camelCase5(`${id}-${path}-${method}`);
-          const relFile = relative3(directories.types, file);
-          types2.addImport(varName, relFile);
-          methodType.add(`'${path}'`, `Route<typeof ${varName}, ${paramType.toString() || "never"}>`);
-        }
-        idType.addConst(method, methodType);
-      }
-      resources.addType(id, idType);
-    }
-    const code = [
-      `import { InvokeResponse } from '@awsless/lambda'`,
-      `type Function = (...args: any) => any`,
-      `type Event<F extends Function> = Parameters<F>[0]`,
-      `type RequestWithQuery = { request: { queryStringParameters: any } }`,
-      `type RequestWithBody = { request: { body: any } }`,
-      `type ResponseWithBody = { statusCode: number, body: any }`,
-      `type Query<F extends Function> = Event<F> extends RequestWithQuery ? Event<F>['request']['queryStringParameters'] : never`,
-      `type Body<F extends Function> = Event<F> extends RequestWithBody ? Exclude<Event<F>['request']['body'], string> : never`,
-      `type Response<F extends Function> = Awaited<InvokeResponse<F>> extends ResponseWithBody ? Promise<Awaited<InvokeResponse<F>>['body']> : Promise<never>`,
-      `type Route<F extends Function, P> = { param: P; query: Query<F>; body: Body<F>; response: Response<F> }`
-    ];
-    code.map((code2) => types2.addCode(code2));
-    types2.addInterface("HTTP", resources);
-    await ctx.write("http.d.ts", types2, true);
-  },
-  onApp(ctx) {
-    if (Object.keys(ctx.appConfig.defaults?.http ?? {}).length === 0) {
-      return;
-    }
-    const group = new Node15(ctx.base, "http", "main");
-    const securityGroup = new aws15.ec2.SecurityGroup(group, "http", {
-      vpcId: ctx.shared.get(`vpc-id`),
-      name: formatGlobalResourceName(ctx.app.name, "http", "http"),
-      description: `Global security group for HTTP api.`
-    });
-    const port = aws15.ec2.Port.tcp(443);
-    securityGroup.addIngressRule({ port, peer: aws15.ec2.Peer.anyIpv4() });
-    securityGroup.addIngressRule({ port, peer: aws15.ec2.Peer.anyIpv6() });
-    for (const [id, props] of Object.entries(ctx.appConfig.defaults?.http ?? {})) {
-      const group2 = new Node15(ctx.base, "http", id);
-      const loadBalancer = new aws15.elb.LoadBalancer(group2, "balancer", {
-        name: formatGlobalResourceName(ctx.app.name, "http", id),
-        type: "application",
-        securityGroups: [securityGroup.id],
-        subnets: [
-          //
-          ctx.shared.get(`vpc-public-subnet-id-1`),
-          ctx.shared.get(`vpc-public-subnet-id-2`)
-        ]
-      });
-      const listener = new aws15.elb.Listener(group2, "listener", {
-        loadBalancerArn: loadBalancer.arn,
-        port: 443,
-        protocol: "https",
-        certificates: [ctx.shared.get(`local-certificate-${props.domain}-arn`)],
-        defaultActions: [
-          aws15.elb.ListenerAction.fixedResponse({
-            statusCode: 404,
-            contentType: "application/json",
-            messageBody: JSON.stringify({
-              message: "Route not found"
-            })
-          })
-        ]
-      });
-      ctx.shared.set(`http-${id}-listener-arn`, listener.arn);
-      const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
-      new aws15.route53.RecordSet(group2, domainName, {
-        hostedZoneId: ctx.shared.get(`hosted-zone-${props.domain}-id`),
-        name: domainName,
-        type: "A",
-        alias: {
-          evaluateTargetHealth: false,
-          hostedZoneId: loadBalancer.hostedZoneId,
-          dnsName: loadBalancer.dnsName
-        }
-      });
-      ctx.bindEnv(`HTTP_${constantCase6(id)}_ENDPOINT`, domainName);
-    }
-  },
-  onStack(ctx) {
-    for (const [id, routes] of Object.entries(ctx.stackConfig.http ?? {})) {
-      const props = ctx.appConfig.defaults.http?.[id];
-      if (!props) {
-        throw new Error(`Http definition is not defined on app level for "${id}"`);
-      }
-      const group = new Node15(ctx.stack, "http", id);
-      for (const [routeKey, routeProps] of Object.entries(routes)) {
-        const routeGroup = new Node15(group, "route", routeKey);
-        const { method, path } = parseRoute(routeKey);
-        const routeId = shortId(routeKey);
-        const { lambda } = createLambdaFunction(routeGroup, ctx, "http", `${id}-${routeId}`, {
-          ...routeProps,
-          description: routeKey
-        });
-        const name = formatLocalResourceName(ctx.app.name, ctx.stack.name, "http", routeId);
-        const permission = new aws15.lambda.Permission(routeGroup, id, {
-          action: "lambda:InvokeFunction",
-          principal: "elasticloadbalancing.amazonaws.com",
-          functionArn: lambda.arn
-          // sourceArn: `arn:aws:elasticloadbalancing:${ctx.appConfig.region}:*:targetgroup/${name}/*`,
-        });
-        const target = new aws15.elb.TargetGroup(routeGroup, id, {
-          name,
-          type: "lambda",
-          targets: [lambda.arn]
-        }).dependsOn(permission);
-        new aws15.elb.ListenerRule(routeGroup, id, {
-          listenerArn: ctx.shared.get(`http-${id}-listener-arn`),
-          priority: generatePriority(ctx.stackConfig.name, routeKey),
-          conditions: [
-            aws15.elb.ListenerCondition.httpRequestMethods([method]),
-            aws15.elb.ListenerCondition.pathPatterns([path])
-          ],
-          actions: [aws15.elb.ListenerAction.forward([target.arn])]
-        }).dependsOn(target);
-      }
-    }
-  }
-});
-
-// src/feature/search/index.ts
-import { Node as Node16, aws as aws16 } from "@awsless/formation";
-import { constantCase as constantCase7 } from "change-case";
-var typeGenCode6 = `
-import { AnyStruct, Table } from '@awsless/open-search'
-
-type Search = {
-	readonly domain: string
-	readonly defineTable: <N extends stringm S extends AnyStruct>(tableName: N, schema: S) => Table<N, S>
-}
-`;
-var searchFeature = defineFeature({
-  name: "search",
-  async onTypeGen(ctx) {
-    const gen = new TypeFile("@awsless/awsless");
-    const resources = new TypeObject(1);
-    for (const stack of ctx.stackConfigs) {
-      const list4 = new TypeObject(2);
-      for (const id of Object.keys(stack.searchs ?? {})) {
-        list4.addType(id, `Search`);
-      }
-      resources.addType(stack.name, list4);
-    }
-    gen.addCode(typeGenCode6);
-    gen.addInterface("SearchResources", resources);
-    await ctx.write("search.d.ts", gen, true);
+    gen.addCode(typeGenCode4);
+    gen.addInterface("SearchResources", resources);
+    await ctx.write("search.d.ts", gen, true);
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.searchs ?? {})) {
-      const group = new Node16(ctx.stack, "search", id);
-      const openSearch = new aws16.openSearch.Domain(group, "domain", {
+      const group = new Node13(ctx.stack, "search", id);
+      const openSearch = new aws13.openSearch.Domain(group, "domain", {
         // name: formatLocalResourceName(ctx.app.name, ctx.stack.name, this.name, id),
         version: props.version,
         storageSize: props.storage,
@@ -3874,7 +3672,7 @@ var searchFeature = defineFeature({
       }
       ctx.onFunction(({ lambda, policy }) => {
         lambda.addEnvironment(
-          `SEARCH_${constantCase7(ctx.stack.name)}_${constantCase7(id)}_DOMAIN`,
+          `SEARCH_${constantCase8(ctx.stack.name)}_${constantCase8(id)}_DOMAIN`,
           openSearch.domainEndpoint
         );
         policy.addStatement({
@@ -3887,7 +3685,7 @@ var searchFeature = defineFeature({
 });
 
 // src/feature/site/index.ts
-import { Asset as Asset3, Node as Node17, aws as aws17 } from "@awsless/formation";
+import { Asset as Asset3, Node as Node14, aws as aws14 } from "@awsless/formation";
 import { days as days3, seconds as seconds3 } from "@awsless/duration";
 import { glob as glob2 } from "glob";
 import { join as join8 } from "path";
@@ -3917,7 +3715,7 @@ var siteFeature = defineFeature({
   name: "site",
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.sites ?? {})) {
-      const group = new Node17(ctx.stack, "site", id);
+      const group = new Node14(ctx.stack, "site", id);
       const name = formatLocalResourceName(ctx.app.name, ctx.stack.name, "site", id);
       const origins = [];
       const originGroups = [];
@@ -3927,7 +3725,7 @@ var siteFeature = defineFeature({
         const { lambda, code } = createLambdaFunction(group, ctx, `site`, id, props.ssr);
         versions.push(code.version);
         ctx.registerSiteFunction(lambda);
-        new aws17.lambda.Permission(group, "permission", {
+        new aws14.lambda.Permission(group, "permission", {
           principal: "*",
           // principal: 'cloudfront.amazonaws.com',
           action: "lambda:InvokeFunctionUrl",
@@ -3936,7 +3734,7 @@ var siteFeature = defineFeature({
           // urlAuthType: 'aws-iam',
           // sourceArn: distribution.arn,
         });
-        const url = new aws17.lambda.Url(group, "url", {
+        const url = new aws14.lambda.Url(group, "url", {
           targetArn: lambda.arn,
           authType: "none"
           // authType: 'aws-iam',
@@ -3948,7 +3746,7 @@ var siteFeature = defineFeature({
         });
       }
       if (props.static) {
-        bucket = new aws17.s3.Bucket(group, "bucket", {
+        bucket = new aws14.s3.Bucket(group, "bucket", {
           name,
           forceDelete: true,
           website: {
@@ -3965,7 +3763,7 @@ var siteFeature = defineFeature({
           ]
         });
         bucket.deletionPolicy = "after-deployment";
-        const accessControl = new aws17.cloudFront.OriginAccessControl(group, `access`, {
+        const accessControl = new aws14.cloudFront.OriginAccessControl(group, `access`, {
           name,
           type: "s3",
           behavior: "always",
@@ -3977,7 +3775,7 @@ var siteFeature = defineFeature({
           nodir: true
         });
         for (const file of files) {
-          const object = new aws17.s3.BucketObject(group, file, {
+          const object = new aws14.s3.BucketObject(group, file, {
             bucket: bucket.name,
             key: file,
             body: Asset3.fromFile(join8(props.static, file)),
@@ -4000,14 +3798,14 @@ var siteFeature = defineFeature({
           statusCodes: [403, 404]
         });
       }
-      const cache = new aws17.cloudFront.CachePolicy(group, "cache", {
+      const cache = new aws14.cloudFront.CachePolicy(group, "cache", {
         name,
         minTtl: seconds3(1),
         maxTtl: days3(365),
         defaultTtl: days3(1),
         ...props.cache
       });
-      const originRequest = new aws17.cloudFront.OriginRequestPolicy(group, "request", {
+      const originRequest = new aws14.cloudFront.OriginRequestPolicy(group, "request", {
         name,
         header: {
           behavior: "all-except",
@@ -4015,7 +3813,7 @@ var siteFeature = defineFeature({
         }
       });
       const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
-      const responseHeaders = new aws17.cloudFront.ResponseHeadersPolicy(group, "response", {
+      const responseHeaders = new aws14.cloudFront.ResponseHeadersPolicy(group, "response", {
         name,
         cors: props.cors,
         remove: ["server"]
@@ -4023,7 +3821,7 @@ var siteFeature = defineFeature({
         // 	override: true,
         // },
       });
-      const distribution = new aws17.cloudFront.Distribution(group, "distribution", {
+      const distribution = new aws14.cloudFront.Distribution(group, "distribution", {
         name,
         certificateArn: ctx.shared.get(`global-certificate-${props.domain}-arn`),
         compress: true,
@@ -4051,13 +3849,13 @@ var siteFeature = defineFeature({
           };
         })
       });
-      new aws17.cloudFront.InvalidateCache(group, "invalidate", {
+      new aws14.cloudFront.InvalidateCache(group, "invalidate", {
         distributionId: distribution.id,
         paths: ["/*"],
         versions
       });
       if (props.static) {
-        new aws17.s3.BucketPolicy(group, `policy`, {
+        new aws14.s3.BucketPolicy(group, `policy`, {
           bucketName: bucket.name,
           statements: [
             {
@@ -4083,7 +3881,7 @@ var siteFeature = defineFeature({
           ]
         });
       }
-      new aws17.route53.RecordSet(group, `record`, {
+      new aws14.route53.RecordSet(group, `record`, {
         hostedZoneId: ctx.shared.get(`hosted-zone-${props.domain}-id`),
         type: "A",
         name: domainName,
@@ -4097,88 +3895,142 @@ var siteFeature = defineFeature({
   }
 });
 
-// src/feature/rest/index.ts
-import { Node as Node18, aws as aws18 } from "@awsless/formation";
-import { constantCase as constantCase8 } from "change-case";
-var restFeature = defineFeature({
-  name: "rest",
-  onApp(ctx) {
-    for (const [id, props] of Object.entries(ctx.appConfig.defaults?.rest ?? {})) {
-      const group = new Node18(ctx.base, "rest", id);
-      const api = new aws18.apiGatewayV2.Api(group, "api", {
-        name: formatGlobalResourceName(ctx.app.name, "rest", id),
-        protocolType: "HTTP"
-      });
-      const stage = new aws18.apiGatewayV2.Stage(group, "stage", {
-        name: "v1",
-        apiId: api.id
-      });
-      ctx.shared.set(`rest-${id}-id`, api.id);
-      if (props.domain) {
-        const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
-        const hostedZoneId = ctx.shared.get(`hosted-zone-${props.domain}-id`);
-        const certificateArn = ctx.shared.get(`certificate-${props.domain}-arn`);
-        const domain = new aws18.apiGatewayV2.DomainName(group, "domain", {
-          name: domainName,
-          certificates: [
-            {
-              certificateArn
-            }
-          ]
-        });
-        const mapping = new aws18.apiGatewayV2.ApiMapping(group, "mapping", {
-          apiId: api.id,
-          domainName: domain.name,
-          stage: stage.name
-        });
-        const record = new aws18.route53.RecordSet(group, "record", {
-          hostedZoneId,
-          type: "A",
-          name: domainName,
-          alias: {
-            dnsName: domain.regionalDomainName,
-            hostedZoneId: domain.regionalHostedZoneId,
-            evaluateTargetHealth: false
-          }
-        });
-        record.dependsOn(domain, mapping);
-        ctx.bindEnv(`REST_${constantCase8(id)}_ENDPOINT`, domainName);
+// src/feature/store/index.ts
+import { aws as aws15, Node as Node15 } from "@awsless/formation";
+var typeGenCode5 = `
+import { Body, PutObjectProps, BodyStream, createPresignedPost } from '@awsless/s3'
+import { Size } from '@awsless/size'
+import { Duration } from '@awsless/duration'
+import { PresignedPost } from '@aws-sdk/s3-presigned-post'
+
+type Store<Name extends string> = {
+	readonly name: Name
+	readonly put: (key: string, body: Body, options?: Pick<PutObjectProps, 'metadata' | 'storageClass'>) => Promise<void>
+	readonly get: (key: string) => Promise<BodyStream | undefined>
+	readonly delete: (key: string) => Promise<void>
+	readonly createPresignedPost: (key: string, contentLengthRange: [Size, Size], expires?: Duration, fields?: Record<string, string>) => Promise<PresignedPost>
+}
+`;
+var storeFeature = defineFeature({
+  name: "store",
+  async onTypeGen(ctx) {
+    const gen = new TypeFile("@awsless/awsless");
+    const resources = new TypeObject(1);
+    for (const stack of ctx.stackConfigs) {
+      const list4 = new TypeObject(2);
+      for (const id of Object.keys(stack.stores ?? {})) {
+        const storeName = formatLocalResourceName(ctx.appConfig.name, stack.name, "store", id);
+        list4.addType(id, `Store<'${storeName}'>`);
+      }
+      resources.addType(stack.name, list4);
+    }
+    gen.addCode(typeGenCode5);
+    gen.addInterface("StoreResources", resources);
+    await ctx.write("store.d.ts", gen, true);
+  },
+  onStack(ctx) {
+    for (const [id, props] of Object.entries(ctx.stackConfig.stores ?? {})) {
+      const group = new Node15(ctx.stack, "store", id);
+      const bucketName = formatLocalResourceName(ctx.appConfig.name, ctx.stack.name, "store", id);
+      const lambdaConfigs = [];
+      const eventMap = {
+        "created:*": "s3:ObjectCreated:*",
+        "created:put": "s3:ObjectCreated:Put",
+        "created:post": "s3:ObjectCreated:Post",
+        "created:copy": "s3:ObjectCreated:Copy",
+        "created:upload": "s3:ObjectCreated:CompleteMultipartUpload",
+        "removed:*": "s3:ObjectRemoved:*",
+        "removed:delete": "s3:ObjectRemoved:Delete",
+        "removed:marker": "s3:ObjectRemoved:DeleteMarkerCreated"
+      };
+      for (const [event, funcProps] of Object.entries(props.events ?? {})) {
+        const eventGroup = new Node15(group, "event", event);
+        const { lambda } = createAsyncLambdaFunction(eventGroup, ctx, `store`, id, funcProps);
+        new aws15.lambda.Permission(eventGroup, "permission", {
+          action: "lambda:InvokeFunction",
+          principal: "s3.amazonaws.com",
+          functionArn: lambda.arn,
+          sourceArn: `arn:aws:s3:::${bucketName}`
+        });
+        lambdaConfigs.push({
+          event: eventMap[event],
+          function: lambda.arn
+        });
+      }
+      const bucket = new aws15.s3.Bucket(group, "store", {
+        name: bucketName,
+        versioning: props.versioning,
+        lambdaConfigs,
+        cors: [
+          // ---------------------------------------------
+          // Support for presigned post requests
+          // ---------------------------------------------
+          {
+            origins: ["*"],
+            methods: ["POST"]
+          }
+          // ---------------------------------------------
+        ]
+      });
+      ctx.onFunction(({ policy }) => {
+        policy.addStatement(bucket.permissions);
+      });
+    }
+  }
+});
+
+// src/feature/table/index.ts
+import { Node as Node16, aws as aws16 } from "@awsless/formation";
+var tableFeature = defineFeature({
+  name: "table",
+  async onTypeGen(ctx) {
+    const gen = new TypeFile("@awsless/awsless");
+    const resources = new TypeObject(1);
+    for (const stack of ctx.stackConfigs) {
+      const list4 = new TypeObject(2);
+      for (const name of Object.keys(stack.tables || {})) {
+        const tableName = formatLocalResourceName(ctx.appConfig.name, stack.name, "table", name);
+        list4.addType(name, `'${tableName}'`);
       }
+      resources.addType(stack.name, list4);
     }
+    gen.addInterface("TableResources", resources);
+    await ctx.write("table.d.ts", gen, true);
   },
   onStack(ctx) {
-    for (const [id, routes] of Object.entries(ctx.stackConfig.rest ?? {})) {
-      const restGroup = new Node18(ctx.stack, "rest", id);
-      for (const [routeKey, props] of Object.entries(routes)) {
-        const group = new Node18(restGroup, "route", routeKey);
-        const apiId = ctx.shared.get(`rest-${id}-id`);
-        const routeId = shortId(routeKey);
-        const { lambda } = createLambdaFunction(group, ctx, "rest", `${id}-${routeId}`, {
-          ...props,
-          description: `${id} ${routeKey}`
-        });
-        const permission = new aws18.lambda.Permission(group, "permission", {
-          action: "lambda:InvokeFunction",
-          principal: "apigateway.amazonaws.com",
-          functionArn: lambda.arn
-        });
-        const integration = new aws18.apiGatewayV2.Integration(group, "integration", {
-          apiId,
-          description: `${id} ${routeKey}`,
-          method: "POST",
-          payloadFormatVersion: "2.0",
-          type: "AWS_PROXY",
-          uri: lambda.arn.apply((arn) => {
-            return `arn:aws:apigateway:${ctx.appConfig.region}:lambda:path/2015-03-31/functions/${arn}/invocations`;
-          })
-        });
-        const route = new aws18.apiGatewayV2.Route(group, "route", {
-          apiId,
-          routeKey,
-          target: integration.id.apply((id2) => `integrations/${id2}`)
+    for (const [id, props] of Object.entries(ctx.stackConfig.tables ?? {})) {
+      const group = new Node16(ctx.stack, "table", id);
+      const table2 = new aws16.dynamodb.Table(group, "table", {
+        ...props,
+        name: formatLocalResourceName(ctx.appConfig.name, ctx.stackConfig.name, "table", id),
+        stream: props.stream?.type
+      });
+      if (props.stream) {
+        const { lambda, policy } = createLambdaFunction(group, ctx, "table", id, props.stream.consumer);
+        lambda.addEnvironment("LOG_VIEWABLE_ERROR", "1");
+        const onFailure = getGlobalOnFailure(ctx);
+        const source = new aws16.lambda.EventSourceMapping(group, id, {
+          functionArn: lambda.arn,
+          sourceArn: table2.streamArn,
+          batchSize: 100,
+          bisectBatchOnError: true,
+          // retryAttempts: props.stream.consumer.retryAttempts ?? -1,
+          parallelizationFactor: 1,
+          startingPosition: "latest",
+          onFailure
         });
-        route.dependsOn(lambda, permission);
+        policy.addStatement(table2.streamPermissions);
+        source.dependsOn(policy);
+        if (onFailure) {
+          policy.addStatement({
+            actions: ["sqs:SendMessage", "sqs:GetQueueUrl"],
+            resources: [onFailure]
+          });
+        }
       }
+      ctx.onFunction(({ policy }) => {
+        policy.addStatement(...table2.permissions);
+      });
     }
   }
 });
@@ -4186,8 +4038,8 @@ var restFeature = defineFeature({
 // src/feature/task/index.ts
 import { camelCase as camelCase6 } from "change-case";
 import { relative as relative4 } from "path";
-import { Node as Node19 } from "@awsless/formation";
-var typeGenCode7 = `
+import { Node as Node17 } from "@awsless/formation";
+var typeGenCode6 = `
 import { InvokeOptions } from '@awsless/lambda'
 import type { Mock } from 'vitest'
 
@@ -4226,7 +4078,7 @@ var taskFeature = defineFeature({
       resources.addType(stack.name, resource2);
       mockResponses.addType(stack.name, mockResponse);
     }
-    types2.addCode(typeGenCode7);
+    types2.addCode(typeGenCode6);
     types2.addInterface("TaskResources", resources);
     types2.addInterface("TaskMock", mocks);
     types2.addInterface("TaskMockResponse", mockResponses);
@@ -4234,12 +4086,160 @@ var taskFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.tasks ?? {})) {
-      const group = new Node19(ctx.stack, "task", id);
+      const group = new Node17(ctx.stack, "task", id);
       createAsyncLambdaFunction(group, ctx, "task", id, props.consumer);
     }
   }
 });
 
+// src/feature/test/index.ts
+var testFeature = defineFeature({
+  name: "test",
+  onStack(ctx) {
+    if (ctx.stackConfig.tests) {
+      ctx.registerTest(ctx.stackConfig.name, ctx.stackConfig.tests);
+    }
+  }
+});
+
+// src/feature/topic/index.ts
+import { Node as Node18, aws as aws17 } from "@awsless/formation";
+var typeGenCode7 = `
+import type { PublishOptions } from '@awsless/sns'
+import type { Mock } from 'vitest'
+
+type Publish<Name extends string> = {
+	readonly name: Name
+	(payload: unknown, options?: Omit<PublishOptions, 'topic' | 'payload'>): Promise<void>
+}
+
+type MockHandle = (payload: unknown) => void
+type MockBuilder = (handle?: MockHandle) => void
+`;
+var topicFeature = defineFeature({
+  name: "topic",
+  async onTypeGen(ctx) {
+    const gen = new TypeFile("@awsless/awsless");
+    const resources = new TypeObject(1);
+    const mocks = new TypeObject(1);
+    const mockResponses = new TypeObject(1);
+    for (const stack of ctx.stackConfigs) {
+      for (const topic of stack.topics || []) {
+        const name = formatGlobalResourceName(ctx.appConfig.name, "topic", topic);
+        mockResponses.addType(topic, "Mock");
+        resources.addType(topic, `Publish<'${name}'>`);
+        mocks.addType(topic, `MockBuilder`);
+      }
+    }
+    gen.addCode(typeGenCode7);
+    gen.addInterface("TopicResources", resources);
+    gen.addInterface("TopicMock", mocks);
+    gen.addInterface("TopicMockResponse", mockResponses);
+    await ctx.write("topic.d.ts", gen, true);
+  },
+  onApp(ctx) {
+    for (const stack of ctx.stackConfigs) {
+      for (const id of stack.topics ?? []) {
+        const group = new Node18(ctx.base, "topic", id);
+        const topic = new aws17.sns.Topic(group, "topic", {
+          name: formatGlobalResourceName(ctx.appConfig.name, "topic", id)
+        });
+        ctx.shared.set(`topic-${id}-arn`, topic.arn);
+      }
+    }
+  },
+  onStack(ctx) {
+    for (const id of ctx.stackConfig.topics ?? []) {
+      ctx.onFunction(({ policy }) => {
+        policy.addStatement({
+          actions: ["sns:Publish"],
+          resources: [ctx.shared.get(`topic-${id}-arn`)]
+        });
+      });
+    }
+    for (const [id, props] of Object.entries(ctx.stackConfig.subscribers ?? {})) {
+      const group = new Node18(ctx.stack, "topic", id);
+      const topicArn = ctx.shared.get(`topic-${id}-arn`);
+      if (typeof props === "string" && isEmail(props)) {
+        new aws17.sns.Subscription(group, id, {
+          topicArn,
+          protocol: "email",
+          endpoint: props
+        });
+      } else if (typeof props === "object") {
+        const { lambda } = createAsyncLambdaFunction(group, ctx, `topic`, id, props);
+        new aws17.sns.Subscription(group, id, {
+          topicArn,
+          protocol: "lambda",
+          endpoint: lambda.arn
+        });
+        new aws17.lambda.Permission(group, id, {
+          action: "lambda:InvokeFunction",
+          principal: "sns.amazonaws.com",
+          functionArn: lambda.arn,
+          sourceArn: topicArn
+        });
+      }
+    }
+  }
+});
+
+// src/feature/vpc/index.ts
+import { Node as Node19, all, aws as aws18 } from "@awsless/formation";
+var vpcFeature = defineFeature({
+  name: "vpc",
+  onApp(ctx) {
+    const group = new Node19(ctx.base, "vpc", "main");
+    const vpc = new aws18.ec2.Vpc(group, "vpc", {
+      name: ctx.app.name,
+      cidrBlock: aws18.ec2.Peer.ipv4("10.0.0.0/16")
+    });
+    const privateRouteTable = new aws18.ec2.RouteTable(group, "private", {
+      vpcId: vpc.id,
+      name: "private"
+    });
+    const publicRouteTable = new aws18.ec2.RouteTable(group, "public", {
+      vpcId: vpc.id,
+      name: "public"
+    });
+    const gateway = new aws18.ec2.InternetGateway(group, "gateway");
+    const attachment = new aws18.ec2.VPCGatewayAttachment(group, "attachment", {
+      vpcId: vpc.id,
+      internetGatewayId: gateway.id
+    });
+    new aws18.ec2.Route(group, "route", {
+      gatewayId: gateway.id,
+      routeTableId: publicRouteTable.id,
+      destination: aws18.ec2.Peer.anyIpv4()
+    });
+    ctx.shared.set(
+      "vpc-id",
+      // Some resources require the internet gateway to be attached.
+      all([vpc.id, attachment.internetGatewayId]).apply(([id]) => id)
+    );
+    ctx.shared.set("vpc-security-group-id", vpc.defaultSecurityGroup);
+    const zones = ["a", "b"];
+    const tables = [privateRouteTable, publicRouteTable];
+    let block = 0;
+    for (const table2 of tables) {
+      for (const i in zones) {
+        const index = Number(i) + 1;
+        const id = `${table2.identifier}-${index}`;
+        const subnet = new aws18.ec2.Subnet(group, id, {
+          vpcId: vpc.id,
+          cidrBlock: aws18.ec2.Peer.ipv4(`10.0.${block++}.0/24`),
+          availabilityZone: ctx.appConfig.region + zones[i]
+        });
+        new aws18.ec2.SubnetRouteTableAssociation(group, id, {
+          routeTableId: table2.id,
+          subnetId: subnet.id
+        });
+        ctx.shared.set(`vpc-${table2.identifier}-subnet-id-${index}`, subnet.id);
+      }
+    }
+  }
+});
+
 // src/feature/index.ts
 var features = [
   // 1