@awsless/awsless 0.0.367 → 0.0.369

package/dist/bin.js

@@ -596,9 +596,9 @@ var require_Alias = __commonJS({
     var anchors = require_anchors();
     var visit = require_visit();
     var identity = require_identity();
-    var Node24 = require_Node();
+    var Node25 = require_Node();
     var toJS = require_toJS();
-    var Alias = class extends Node24.NodeBase {
+    var Alias = class extends Node25.NodeBase {
       constructor(source) {
         super(identity.ALIAS);
         this.source = source;
@@ -696,10 +696,10 @@ var require_Scalar = __commonJS({
   "../../node_modules/.pnpm/yaml@2.5.0/node_modules/yaml/dist/nodes/Scalar.js"(exports) {
     "use strict";
     var identity = require_identity();
-    var Node24 = require_Node();
+    var Node25 = require_Node();
     var toJS = require_toJS();
     var isScalarValue = (value) => !value || typeof value !== "function" && typeof value !== "object";
-    var Scalar = class extends Node24.NodeBase {
+    var Scalar = class extends Node25.NodeBase {
       constructor(value) {
         super(identity.SCALAR);
         this.value = value;
@@ -803,7 +803,7 @@ var require_Collection = __commonJS({
     "use strict";
     var createNode = require_createNode();
     var identity = require_identity();
-    var Node24 = require_Node();
+    var Node25 = require_Node();
     function collectionFromPath(schema, path, value) {
       let v = value;
       for (let i = path.length - 1; i >= 0; --i) {
@@ -827,7 +827,7 @@ var require_Collection = __commonJS({
       });
     }
     var isEmptyPath = (path) => path == null || typeof path === "object" && !!path[Symbol.iterator]().next().done;
-    var Collection = class extends Node24.NodeBase {
+    var Collection = class extends Node25.NodeBase {
       constructor(type, schema) {
         super(type);
         Object.defineProperty(this, "schema", {
@@ -7680,10 +7680,22 @@ var LogRetentionSchema = DurationSchema.refine(
   },
   `Invalid log retention. Valid days are: ${validLogRetentionDays.map((days7) => `${days7}`).join(", ")}`
 ).describe("The log retention duration.");
+var LogSubscriptionSchema = z5.union([
+  LocalFileSchema.transform((file) => ({
+    file
+  })),
+  z5.object({
+    subscriber: LocalFileSchema,
+    filter: z5.string().optional()
+  })
+]).describe(
+  "Log Subscription allow you to subscribe to a real-time stream of log events and have them delivered to a specific destination"
+);
 var LogSchema = z5.union([
   z5.boolean().transform((enabled) => ({ retention: enabled ? days(7) : days(0) })),
   LogRetentionSchema.transform((retention) => ({ retention })),
   z5.object({
+    subscription: LogSubscriptionSchema.optional(),
     retention: LogRetentionSchema.optional(),
     format: z5.enum(["text", "json"]).describe(
       `The format in which Lambda sends your function's application and system logs to CloudWatch. Select between plain text and structured JSON.`
@@ -7981,6 +7993,11 @@ var InstancesSchema = z12.record(
   })
 ).optional().describe("Define the instances in your stack.");
 
+// src/feature/log-subscription/schema.ts
+var LogSubscriptionSchema2 = FunctionSchema.optional().describe(
+  "Log Subscription allow you to subscribe to a real-time stream of log events and have them delivered to a specific destination."
+);
+
 // src/feature/pubsub/schema.ts
 import { z as z13 } from "zod";
 var DomainSchema = ResourceIdSchema.describe("The domain id to link your Pubsub API with.");
@@ -8012,9 +8029,9 @@ var PubSubSchema = z13.record(
 ).optional().describe("Define the pubsub subscriber in your stack.");
 
 // src/feature/queue/schema.ts
-import { z as z14 } from "zod";
 import { days as days2, hours, minutes as minutes3, seconds as seconds2 } from "@awsless/duration";
 import { kibibytes } from "@awsless/size";
+import { z as z14 } from "zod";
 var RetentionPeriodSchema = DurationSchema.refine(
   durationMin(minutes3(1)),
   "Minimum retention period is 1 minute"
@@ -8073,7 +8090,7 @@ var QueuesSchema = z14.record(
       }
     })),
     z14.object({
-      consumer: FunctionSchema.describe("he consuming lambda function properties."),
+      consumer: FunctionSchema.describe("The consuming lambda function properties."),
       retentionPeriod: RetentionPeriodSchema.optional(),
       visibilityTimeout: VisibilityTimeoutSchema.optional(),
       deliveryDelay: DeliveryDelaySchema.optional(),
@@ -8264,6 +8281,8 @@ var AppSchema = z21.object({
   // 	.regex(/^[a-z]+$/)
   // 	.default('prod')
   // 	.describe('The deployment stage.'),
+  // onFailure: OnFailureSchema,
+  logSubscription: LogSubscriptionSchema2,
   defaults: z21.object({
     auth: AuthDefaultSchema,
     domains: DomainsDefaultSchema,
@@ -8797,411 +8816,143 @@ var loadStackConfigs = async (options) => {
   return stacks;
 };
 
-// src/cli/ui/app.ts
-import { note } from "@clack/prompts";
-var logApp = (app, opt) => {
-  const data = {
-    App: app.name,
-    Region: app.region,
-    Profile: app.profile
-  };
-  if (opt.stage) {
-    data.Stage = color.warning(opt.stage);
-  }
-  note(wrap(list(data)), "App Config");
-};
-
-// src/cli/ui/error/error.ts
-import { AppError as AppError2, StackError as StackError3 } from "@awsless/formation";
-import { log as log6 } from "@clack/prompts";
+// src/feature/auth/index.ts
+import { aws as aws3, Node as Node2 } from "@awsless/formation";
+import { constantCase as constantCase2 } from "change-case";
 
-// src/cli/ui/error/app-error.ts
-import { StackError as StackError2 } from "@awsless/formation";
-import { log as log3 } from "@clack/prompts";
+// src/feature.ts
+var defineFeature = (feature) => feature;
 
-// src/cli/ui/error/stack-error.ts
-import { ResourceError } from "@awsless/formation";
-import { log as log2 } from "@clack/prompts";
-import { capitalCase as capitalCase2 } from "change-case";
-var formatOperation = (operation) => {
-  const value = ` ${capitalCase2(operation)} `;
-  switch (operation) {
-    case "create":
-      return color.success.bold.inverse(value);
-    case "update":
-      return color.warning.bold.inverse(value);
-    case "delete":
-      return color.error.bold.inverse(value);
-    case "heal":
-      return color.warning.bold.inverse(value);
-    case "get":
-      return color.info.bold.inverse(value);
+// src/type-gen/file.ts
+import { camelCase } from "change-case";
+var TypeFile = class {
+  constructor(module) {
+    this.module = module;
   }
-};
-var logStackError = (error) => {
-  log2.message(
-    wrap([color.error(error.message), `Stack: ${error.stack}`].join("\n"), {
-      hard: true
-    }),
-    { symbol: color.error(icon.error) }
-  );
-  for (const issue of error.issues) {
-    if (issue instanceof ResourceError) {
-      log2.message(
-        [
-          formatOperation(issue.operation),
-          "\n",
-          wrap("URN: " + issue.urn, { hard: true }),
-          "\n",
-          wrap("ID: " + issue.id, { hard: true }),
-          "\n\n",
-          wrap(color.error(issue.message), { hard: true })
-          // , '\n', color.error(issue.message)
-        ].join(""),
-        { symbol: color.error(icon.error) }
+  codes = /* @__PURE__ */ new Set();
+  interfaces = /* @__PURE__ */ new Map();
+  imports = /* @__PURE__ */ new Map();
+  addImport(varName, path) {
+    this.imports.set(varName, path);
+    return this;
+  }
+  addCode(code) {
+    this.codes.add(code);
+    return this;
+  }
+  addInterface(name, type) {
+    const value = type.toString();
+    if (value) {
+      this.interfaces.set(name, value);
+    }
+    return this;
+  }
+  toString() {
+    if (this.interfaces.size === 0) {
+      return;
+    }
+    const lines = [];
+    if (this.imports.size > 0) {
+      lines.push(
+        ...[
+          "// Imports",
+          ...Array.from(this.imports.entries()).map(([varName, path]) => {
+            if (typeof varName === "string") {
+              return `import ${camelCase(varName)} from '${path}'`;
+            }
+            return `import { ${Object.entries(varName).map(([key, alias]) => `${key} as ${camelCase(alias)}`).join(", ")} } from '${path}'`;
+          }),
+          ""
+        ]
       );
-    } else if (issue instanceof Error) {
-      log2.message(wrap(color.error(issue.message), { hard: true }), {
-        symbol: color.error(icon.error)
-      });
     }
+    if (this.codes.size > 0) {
+      lines.push(...["// Types", ...Array.from(this.codes).map((v) => v.trim()), ""]);
+    }
+    return [
+      ...lines,
+      "// Extend module",
+      `declare module '${this.module}' {`,
+      Array.from(this.interfaces).map(([name, type]) => {
+        return `	interface ${name} ${type}`;
+      }).join("\n\n"),
+      // ...Array.from(this.types.entries()).map(([propName, type]) => { // `\tinterface ${this.interfaceName} {`,
+      // 	return `\t\t${this.readonly ? 'readonly ' : ''}${propName}: ${type}`
+      // }),
+      // `\t}`,
+      `}`,
+      "",
+      "// Export fix",
+      `export {}`
+    ].join("\n");
   }
 };
 
-// src/cli/ui/error/app-error.ts
-var logAppError = (error) => {
-  log3.message(
-    wrap([color.error(error.message), `App: ${error.app}`].join("\n"), {
-      hard: true
-    }),
-    { symbol: color.error(icon.error) }
-  );
-  for (const issue of error.issues) {
-    if (issue instanceof StackError2) {
-      logStackError(issue);
-    } else if (issue instanceof Error) {
-      log3.message(wrap(color.error(issue.message), { hard: true }), {
-        symbol: color.error(icon.error)
-      });
+// src/type-gen/object.ts
+import { camelCase as camelCase2, constantCase } from "change-case";
+var TypeObject = class {
+  constructor(level, readonly = true) {
+    this.level = level;
+    this.readonly = readonly;
+  }
+  types = /* @__PURE__ */ new Map();
+  add(name, type) {
+    const value = type.toString();
+    if (value) {
+      this.types.set(name, value);
+    }
+    return this;
+  }
+  addType(name, type) {
+    return this.add(camelCase2(name), type);
+  }
+  addConst(name, type) {
+    return this.add(constantCase(name), type);
+  }
+  toString() {
+    if (!this.types.size) {
+      return "";
     }
+    return [
+      "{",
+      ...Array.from(this.types.entries()).map(([propName, type]) => {
+        return [
+          "	".repeat(this.level + 1),
+          this.readonly ? "readonly" : "",
+          " ",
+          propName,
+          ": ",
+          type
+        ].join("");
+      }),
+      `${"	".repeat(this.level)}}`
+    ].join("\n");
   }
 };
 
-// src/cli/ui/error/config-error.ts
-import * as p from "@clack/prompts";
-var codeLine = (value, level = 0) => {
+// src/util/name.ts
+import { paramCase as paramCase3 } from "change-case";
+import { createHmac } from "crypto";
+var formatGlobalResourceName = (opt) => {
   return [
     //
-    "  ".repeat(level),
-    value
-  ].join("");
+    opt.prefix,
+    opt.appName,
+    opt.resourceType,
+    opt.resourceName,
+    opt.postfix
+  ].filter((v) => typeof v === "string").map((v) => paramCase3(v)).join(opt.seperator ?? "--");
 };
-var format = (value) => {
-  if (Array.isArray(value)) {
-    return "[ ... ]";
-  }
-  if (value === null) {
-    return "null";
-  }
-  switch (typeof value) {
-    case "function":
-      return "() => { ... }";
-    case "bigint":
-      return `${value}n`;
-    case "symbol":
-      return "Symbol()";
-    case "object":
-      return "{ ... }";
-    case "undefined":
-      return "undefined";
-    case "string":
-    case "number":
-    case "boolean":
-      return JSON.stringify(value);
-  }
-  return "";
-};
-var logConfigError = (error) => {
-  for (const issue of error.error.errors) {
-    const message = [color.error(issue.message), color.dim(error.file), "\n{"];
-    let context = error.data;
-    const inStack = issue.path[0] === "stacks" && typeof issue.path[1] === "number";
-    const length = issue.path.length;
-    const end = ["}"];
-    issue.path.forEach((path, i) => {
-      const index = i + 1;
-      context = context[path];
-      if (typeof path === "string") {
-        const key = path + `: `;
-        if (index === length) {
-          const space = " ".repeat(key.length);
-          const value = format(context);
-          const error2 = icon.arrow.top.repeat(value.length);
-          message.push(codeLine(key + color.warning(value), index));
-          message.push(codeLine(space + color.error(error2), index));
-        } else if (Array.isArray(context)) {
-          message.push(codeLine(key + "[", index));
-          end.unshift(codeLine("]", index));
-        } else if (typeof context === "object") {
-          if (inStack && index === 3) {
-            const name = error.data.stacks[issue.path[1]].name;
-            message.push(codeLine("name: " + color.info(`"${name}"`) + ",", index));
-          }
-          message.push(codeLine(key + "{", index));
-          end.unshift(codeLine("}", index));
-        }
-      } else if (typeof context === "object") {
-        message.push(codeLine("{", index));
-        end.unshift(codeLine("}", index));
-      } else if (typeof context === "string") {
-        message.push(codeLine(color.warning(`"${context}"`), index));
-        const error2 = icon.arrow.top.repeat(context.length + 2);
-        message.push(codeLine(color.error(error2), index));
-      }
-    });
-    p.log.message(
-      wrap([...message, ...end], {
-        trim: false
-      }),
-      {
-        symbol: color.error`×`
-      }
-    );
-  }
-};
-
-// src/cli/ui/error/file-error.ts
-import { log as log5 } from "@clack/prompts";
-var logFileError = (error) => {
-  log5.message(
-    wrap([color.error(error.message), color.dim(error.file)].join("\n"), {
-      hard: true
-    }),
-    { symbol: color.error(icon.error) }
-  );
-};
-
-// src/cli/ui/error/error.ts
-var logError = (error) => {
-  if (error instanceof ConfigError) {
-    logConfigError(error);
-  } else if (error instanceof Cancelled) {
-    log6.message(color.error("Cancelled."), {
-      symbol: color.error(icon.error)
-    });
-  } else if (error instanceof ExpectedError) {
-    log6.message(color.error(error.message), {
-      symbol: color.error(icon.error)
-    });
-  } else if (error instanceof AppError2) {
-    logAppError(error);
-  } else if (error instanceof StackError3) {
-    logStackError(error);
-  } else if (error instanceof FileError) {
-    logFileError(error);
-  } else if (error instanceof Error) {
-    const message = `${error.name}: ${error.message}`;
-    const stack = error.stack ? color.dim(error.stack.replace(message, "")) : "";
-    log6.message(
-      wrap([color.error(message), stack], {
-        hard: true
-      }),
-      { symbol: color.error(icon.error) }
-    );
-  } else if (typeof error === "string") {
-    log6.message(wrap(color.error(error)), {
-      symbol: color.error(icon.error)
-    });
-  } else {
-    log6.message(wrap(color.error("Unknown error!")), {
-      symbol: color.error(icon.error)
-    });
-  }
-};
-
-// src/cli/ui/logo.ts
-var logo = () => {
-  return `${color.primary`AWS`}${color.primary.dim`LESS`}`;
-};
-
-// src/cli/ui/complex/layout.ts
-var layout = async (command, cb) => {
-  console.log();
-  intro(`${logo()} ${color.dim(command)}`);
-  try {
-    const options = program.optsWithGlobals();
-    const appConfig = await loadAppConfig(options);
-    logApp(appConfig, options);
-    const stackConfigs = await loadStackConfigs(options);
-    const result = await cb({
-      options,
-      appConfig,
-      stackConfigs
-    });
-    outro(result ?? void 0);
-  } catch (error) {
-    logError(error);
-    outro();
-    process.exit(1);
-  }
-};
-
-// src/cli/command/bootstrap.ts
-var bootstrap = (program2) => {
-  program2.command("bootstrap").description("Create the awsless bootstrap stack").action(async () => {
-    await layout("bootstrap", async ({ appConfig }) => {
-      const credentials = getCredentials(appConfig.profile);
-      const accountId = await getAccountId(credentials, appConfig.region);
-      await bootstrapAwsless({
-        credentials,
-        region: appConfig.region,
-        accountId
-      });
-      return "Ready to go!";
-    });
-  });
-};
-
-// src/app.ts
-import { App as App2, Stack } from "@awsless/formation";
-
-// src/feature/auth/index.ts
-import { aws as aws3, Node as Node2 } from "@awsless/formation";
-import { constantCase as constantCase2 } from "change-case";
-
-// src/feature.ts
-var defineFeature = (feature) => feature;
-
-// src/type-gen/file.ts
-import { camelCase } from "change-case";
-var TypeFile = class {
-  constructor(module) {
-    this.module = module;
-  }
-  codes = /* @__PURE__ */ new Set();
-  interfaces = /* @__PURE__ */ new Map();
-  imports = /* @__PURE__ */ new Map();
-  addImport(varName, path) {
-    this.imports.set(varName, path);
-    return this;
-  }
-  addCode(code) {
-    this.codes.add(code);
-    return this;
-  }
-  addInterface(name, type) {
-    const value = type.toString();
-    if (value) {
-      this.interfaces.set(name, value);
-    }
-    return this;
-  }
-  toString() {
-    if (this.interfaces.size === 0) {
-      return;
-    }
-    const lines = [];
-    if (this.imports.size > 0) {
-      lines.push(
-        ...[
-          "// Imports",
-          ...Array.from(this.imports.entries()).map(([varName, path]) => {
-            if (typeof varName === "string") {
-              return `import ${camelCase(varName)} from '${path}'`;
-            }
-            return `import { ${Object.entries(varName).map(([key, alias]) => `${key} as ${camelCase(alias)}`).join(", ")} } from '${path}'`;
-          }),
-          ""
-        ]
-      );
-    }
-    if (this.codes.size > 0) {
-      lines.push(...["// Types", ...Array.from(this.codes).map((v) => v.trim()), ""]);
-    }
-    return [
-      ...lines,
-      "// Extend module",
-      `declare module '${this.module}' {`,
-      Array.from(this.interfaces).map(([name, type]) => {
-        return `	interface ${name} ${type}`;
-      }).join("\n\n"),
-      // ...Array.from(this.types.entries()).map(([propName, type]) => { // `\tinterface ${this.interfaceName} {`,
-      // 	return `\t\t${this.readonly ? 'readonly ' : ''}${propName}: ${type}`
-      // }),
-      // `\t}`,
-      `}`,
-      "",
-      "// Export fix",
-      `export {}`
-    ].join("\n");
-  }
-};
-
-// src/type-gen/object.ts
-import { camelCase as camelCase2, constantCase } from "change-case";
-var TypeObject = class {
-  constructor(level, readonly = true) {
-    this.level = level;
-    this.readonly = readonly;
-  }
-  types = /* @__PURE__ */ new Map();
-  add(name, type) {
-    const value = type.toString();
-    if (value) {
-      this.types.set(name, value);
-    }
-    return this;
-  }
-  addType(name, type) {
-    return this.add(camelCase2(name), type);
-  }
-  addConst(name, type) {
-    return this.add(constantCase(name), type);
-  }
-  toString() {
-    if (!this.types.size) {
-      return "";
-    }
-    return [
-      "{",
-      ...Array.from(this.types.entries()).map(([propName, type]) => {
-        return [
-          "	".repeat(this.level + 1),
-          this.readonly ? "readonly" : "",
-          " ",
-          propName,
-          ": ",
-          type
-        ].join("");
-      }),
-      `${"	".repeat(this.level)}}`
-    ].join("\n");
-  }
-};
-
-// src/util/name.ts
-import { paramCase as paramCase3 } from "change-case";
-import { createHmac } from "crypto";
-var formatGlobalResourceName = (opt) => {
-  return [
-    //
-    opt.prefix,
-    opt.appName,
-    opt.resourceType,
-    opt.resourceName,
-    opt.postfix
-  ].filter((v) => typeof v === "string").map((v) => paramCase3(v)).join(opt.seperator ?? "--");
-};
-var formatLocalResourceName = (opt) => {
-  return [
-    //
-    opt.prefix,
-    opt.appName,
-    opt.stackName,
-    opt.resourceType,
-    opt.resourceName,
-    opt.postfix
-  ].filter((v) => typeof v === "string").map((v) => paramCase3(v)).join(opt.seperator ?? "--");
+var formatLocalResourceName = (opt) => {
+  return [
+    //
+    opt.prefix,
+    opt.appName,
+    opt.stackName,
+    opt.resourceType,
+    opt.resourceName,
+    opt.postfix
+  ].filter((v) => typeof v === "string").map((v) => paramCase3(v)).join(opt.seperator ?? "--");
 };
 var generateGlobalAppId = (opt) => {
   return createHmac("sha1", "awsless").update(opt.accountId).update(opt.region).update(opt.appName).digest("hex").substring(0, 8);
@@ -10929,6 +10680,14 @@ var createLambdaFunction = (group, ctx, ns, id, local2) => {
         resources: [logGroup.arn.apply((arn) => `${arn}:*`)]
       }
     );
+    const logSubscriptionArn = ctx.shared.get("log-subscription-destination-arn");
+    if (logSubscriptionArn) {
+      new aws2.cloudWatch.SubscriptionFilter(group, `log-subscription`, {
+        destinationArn: logSubscriptionArn,
+        logGroupName: logGroup.name,
+        filterPattern: "{$.level = ERROR}"
+      });
+    }
   }
   if (ctx.appConfig.defaults.function.permissions) {
     policy.addStatement(...ctx.appConfig.defaults.function.permissions);
@@ -11196,14 +10955,20 @@ var cacheFeature = defineFeature({
 // src/feature/command/index.ts
 var commandFeature = defineFeature({
   name: "command",
-  onStack(ctx) {
+  onValidate(ctx) {
     const names = /* @__PURE__ */ new Set();
-    for (const [name, props] of Object.entries(ctx.stackConfig.commands ?? {})) {
-      if (!names.has(name)) {
-        names.add(name);
-      } else {
-        throw new FileError(ctx.stackConfig.file, `Duplicate command names aren't allowed: ${name}`);
+    for (const stack of ctx.stackConfigs) {
+      for (const name of Object.keys(stack.commands ?? {})) {
+        if (!names.has(name)) {
+          names.add(name);
+        } else {
+          throw new FileError(stack.file, `Duplicate command names aren't allowed: ${name}`);
+        }
       }
+    }
+  },
+  onStack(ctx) {
+    for (const [name, props] of Object.entries(ctx.stackConfig.commands ?? {})) {
       ctx.registerCommand({ name, ...props });
     }
   }
@@ -12302,8 +12067,75 @@ var instanceFeature = defineFeature({
   }
 });
 
-// src/feature/on-failure/index.ts
+// src/feature/log-subscription/index.ts
 import { Node as Node10, aws as aws11 } from "@awsless/formation";
+var logSubscriptionFeature = defineFeature({
+  name: "log-subscription",
+  onApp(ctx) {
+    if (!ctx.appConfig.logSubscription) {
+      return;
+    }
+    const group = new Node10(ctx.base, "log-subscription", "main");
+    const { lambda, policy } = createLambdaFunction(
+      group,
+      ctx,
+      "log-subscription",
+      "main",
+      ctx.appConfig.logSubscription
+    );
+    new aws11.lambda.Permission(group, "log-subscription-permission", {
+      action: "lambda:InvokeFunction",
+      principal: "logs.amazonaws.com",
+      functionArn: lambda.arn,
+      sourceArn: `arn:aws:logs:${ctx.appConfig.region}:${ctx.accountId}:log-group:/aws/lambda/app-kennedy--*`
+    });
+    ctx.shared.set("log-subscription-destination-arn", lambda.arn);
+    for (const stack of ctx.stackConfigs) {
+      for (const id of stack.topics ?? []) {
+        policy.addStatement({
+          actions: ["sns:Publish"],
+          resources: [ctx.shared.get(`topic-${id}-arn`)]
+        });
+      }
+      for (const [id, props] of Object.entries(stack.tables ?? {})) {
+        const tableName = formatLocalResourceName({
+          appName: ctx.app.name,
+          stackName: stack.name,
+          resourceType: "table",
+          resourceName: id
+        });
+        policy.addStatement({
+          actions: [
+            "dynamodb:DescribeTable",
+            "dynamodb:PutItem",
+            "dynamodb:GetItem",
+            "dynamodb:UpdateItem",
+            "dynamodb:DeleteItem",
+            "dynamodb:TransactWrite",
+            "dynamodb:BatchWriteItem",
+            "dynamodb:BatchGetItem",
+            "dynamodb:ConditionCheckItem",
+            "dynamodb:Query",
+            "dynamodb:Scan"
+          ],
+          resources: [`arn:aws:dynamodb:${ctx.appConfig.region}:${ctx.accountId}:table/${tableName}`]
+        });
+        const indexes = Object.keys(props.indexes ?? {});
+        if (indexes.length) {
+          policy.addStatement({
+            actions: ["dynamodb:Query"],
+            resources: indexes.map(
+              (indexName) => `arn:aws:dynamodb:${ctx.appConfig.region}:${ctx.accountId}:table/${tableName}/index/${indexName}`
+            )
+          });
+        }
+      }
+    }
+  }
+});
+
+// src/feature/on-failure/index.ts
+import { Node as Node11, aws as aws12 } from "@awsless/formation";
 var onFailureFeature = defineFeature({
   name: "on-failure",
   onApp(ctx) {
@@ -12314,7 +12146,7 @@ var onFailureFeature = defineFeature({
     if (count > 1) {
       throw new TypeError("Only 1 onFailure configuration is allowed in your app.");
     }
-    const queue2 = new aws11.sqs.Queue(ctx.base, "on-failure", {
+    const queue2 = new aws12.sqs.Queue(ctx.base, "on-failure", {
       name: formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "on-failure",
@@ -12329,9 +12161,9 @@ var onFailureFeature = defineFeature({
       return;
     }
     const queueArn = ctx.shared.get("on-failure-queue-arn");
-    const group = new Node10(ctx.stack, "on-failure", "failure");
+    const group = new Node11(ctx.stack, "on-failure", "failure");
     const { lambda, policy } = createLambdaFunction(group, ctx, "on-failure", "failure", onFailure);
-    const source = new aws11.lambda.EventSourceMapping(group, "on-failure", {
+    const source = new aws12.lambda.EventSourceMapping(group, "on-failure", {
       functionArn: lambda.arn,
       sourceArn: queueArn,
       batchSize: 10
@@ -12351,13 +12183,13 @@ var onFailureFeature = defineFeature({
 });
 
 // src/feature/pubsub/index.ts
-import { aws as aws12, Node as Node11 } from "@awsless/formation";
+import { aws as aws13, Node as Node12 } from "@awsless/formation";
 import { constantCase as constantCase6 } from "change-case";
 var pubsubFeature = defineFeature({
   name: "pubsub",
   onApp(ctx) {
     for (const [id, props] of Object.entries(ctx.appConfig.defaults.pubsub ?? {})) {
-      const group = new Node11(ctx.base, "pubsub", id);
+      const group = new Node12(ctx.base, "pubsub", id);
       const functionProps = typeof props.auth === "string" ? { file: "" } : props.auth.authorizer;
       const { lambda } = createLambdaFunction(group, ctx, "pubsub-authorizer", id, functionProps);
       lambda.addEnvironment("PUBSUB_POLICY", JSON.stringify(props.policy));
@@ -12367,23 +12199,23 @@ var pubsubFeature = defineFeature({
         resourceType: "pubsub",
         resourceName: id
       });
-      const authorizer = new aws12.iot.Authorizer(group, "authorizer", {
+      const authorizer = new aws13.iot.Authorizer(group, "authorizer", {
         name,
         functionArn: lambda.arn
       });
-      new aws12.lambda.Permission(group, "permission", {
+      new aws13.lambda.Permission(group, "permission", {
         functionArn: lambda.arn,
         principal: "iot.amazonaws.com",
         sourceArn: authorizer.arn,
         action: "lambda:InvokeFunction"
       });
       ctx.bind(`PUBSUB_${constantCase6(id)}_AUTHORIZER`, name);
-      const endpoint = new aws12.iot.Endpoint(group, "endpoint", {
+      const endpoint = new aws13.iot.Endpoint(group, "endpoint", {
         type: "data-ats"
       });
       if (props.domain) {
         const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
-        new aws12.iot.DomainConfiguration(group, "domain", {
+        new aws13.iot.DomainConfiguration(group, "domain", {
           name,
           domainName,
           certificates: [ctx.shared.get(`local-certificate-${props.domain}-arn`)],
@@ -12392,7 +12224,7 @@ var pubsubFeature = defineFeature({
           }
           // validationCertificate: ctx.shared.get(`global-certificate-${props.domain}-arn`),
         });
-        new aws12.route53.RecordSet(group, "record", {
+        new aws13.route53.RecordSet(group, "record", {
           hostedZoneId: ctx.shared.get(`hosted-zone-${props.domain}-id`),
           name: domainName,
           type: "CNAME",
@@ -12413,7 +12245,7 @@ var pubsubFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.pubsub ?? {})) {
-      const group = new Node11(ctx.stack, "pubsub", id);
+      const group = new Node12(ctx.stack, "pubsub", id);
       const { lambda } = createAsyncLambdaFunction(group, ctx, `pubsub`, id, props.consumer);
       const name = formatLocalResourceName({
         appName: ctx.app.name,
@@ -12421,13 +12253,13 @@ var pubsubFeature = defineFeature({
         resourceType: "pubsub",
         resourceName: id
       });
-      const topic = new aws12.iot.TopicRule(group, "rule", {
+      const topic = new aws13.iot.TopicRule(group, "rule", {
         name: name.replaceAll("-", "_"),
         sql: props.sql,
         sqlVersion: props.sqlVersion,
         actions: [{ lambda: { functionArn: lambda.arn } }]
       });
-      new aws12.lambda.Permission(group, "permission", {
+      new aws13.lambda.Permission(group, "permission", {
         action: "lambda:InvokeFunction",
         principal: "iot.amazonaws.com",
         functionArn: lambda.arn,
@@ -12438,7 +12270,7 @@ var pubsubFeature = defineFeature({
 });
 
 // src/feature/queue/index.ts
-import { aws as aws13, Node as Node12 } from "@awsless/formation";
+import { aws as aws14, Node as Node13 } from "@awsless/formation";
 import { camelCase as camelCase5, constantCase as constantCase7 } from "change-case";
 import deepmerge3 from "deepmerge";
 import { relative as relative4 } from "path";
@@ -12498,21 +12330,21 @@ var queueFeature = defineFeature({
   onStack(ctx) {
     for (const [id, local2] of Object.entries(ctx.stackConfig.queues || {})) {
       const props = deepmerge3(ctx.appConfig.defaults.queue, local2);
-      const group = new Node12(ctx.stack, "queue", id);
+      const group = new Node13(ctx.stack, "queue", id);
       const name = formatLocalResourceName({
         appName: ctx.app.name,
         stackName: ctx.stack.name,
         resourceType: "queue",
         resourceName: id
       });
-      const queue2 = new aws13.sqs.Queue(group, "queue", {
+      const queue2 = new aws14.sqs.Queue(group, "queue", {
         name,
         deadLetterArn: getGlobalOnFailure(ctx),
         ...props
       });
       const { lambda, policy } = createLambdaFunction(group, ctx, `queue`, id, props.consumer);
       lambda.addEnvironment("LOG_VIEWABLE_ERROR", "1");
-      new aws13.lambda.EventSourceMapping(group, "event", {
+      new aws14.lambda.EventSourceMapping(group, "event", {
         functionArn: lambda.arn,
         sourceArn: queue2.arn,
         batchSize: props.batchSize,
@@ -12532,23 +12364,23 @@ var queueFeature = defineFeature({
 });
 
 // src/feature/rest/index.ts
-import { aws as aws14, Node as Node13 } from "@awsless/formation";
+import { aws as aws15, Node as Node14 } from "@awsless/formation";
 import { constantCase as constantCase8 } from "change-case";
 var restFeature = defineFeature({
   name: "rest",
   onApp(ctx) {
     for (const [id, props] of Object.entries(ctx.appConfig.defaults?.rest ?? {})) {
-      const group = new Node13(ctx.base, "rest", id);
+      const group = new Node14(ctx.base, "rest", id);
       const name = formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "rest",
         resourceName: id
       });
-      const api = new aws14.apiGatewayV2.Api(group, "api", {
+      const api = new aws15.apiGatewayV2.Api(group, "api", {
         name,
         protocolType: "HTTP"
       });
-      const stage = new aws14.apiGatewayV2.Stage(group, "stage", {
+      const stage = new aws15.apiGatewayV2.Stage(group, "stage", {
         name: "v1",
         apiId: api.id
       });
@@ -12557,7 +12389,7 @@ var restFeature = defineFeature({
         const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
         const hostedZoneId = ctx.shared.get(`hosted-zone-${props.domain}-id`);
         const certificateArn = ctx.shared.get(`certificate-${props.domain}-arn`);
-        const domain = new aws14.apiGatewayV2.DomainName(group, "domain", {
+        const domain = new aws15.apiGatewayV2.DomainName(group, "domain", {
           name: domainName,
           certificates: [
             {
@@ -12565,12 +12397,12 @@ var restFeature = defineFeature({
             }
           ]
         });
-        const mapping = new aws14.apiGatewayV2.ApiMapping(group, "mapping", {
+        const mapping = new aws15.apiGatewayV2.ApiMapping(group, "mapping", {
           apiId: api.id,
           domainName: domain.name,
           stage: stage.name
         });
-        const record = new aws14.route53.RecordSet(group, "record", {
+        const record = new aws15.route53.RecordSet(group, "record", {
           hostedZoneId,
           type: "A",
           name: domainName,
@@ -12588,21 +12420,21 @@ var restFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, routes] of Object.entries(ctx.stackConfig.rest ?? {})) {
-      const restGroup = new Node13(ctx.stack, "rest", id);
+      const restGroup = new Node14(ctx.stack, "rest", id);
       for (const [routeKey, props] of Object.entries(routes)) {
-        const group = new Node13(restGroup, "route", routeKey);
+        const group = new Node14(restGroup, "route", routeKey);
         const apiId = ctx.shared.get(`rest-${id}-id`);
         const routeId = shortId(routeKey);
         const { lambda } = createLambdaFunction(group, ctx, "rest", `${id}-${routeId}`, {
           ...props,
           description: `${id} ${routeKey}`
         });
-        const permission = new aws14.lambda.Permission(group, "permission", {
+        const permission = new aws15.lambda.Permission(group, "permission", {
           action: "lambda:InvokeFunction",
           principal: "apigateway.amazonaws.com",
           functionArn: lambda.arn
         });
-        const integration = new aws14.apiGatewayV2.Integration(group, "integration", {
+        const integration = new aws15.apiGatewayV2.Integration(group, "integration", {
           apiId,
           description: `${id} ${routeKey}`,
           method: "POST",
@@ -12612,7 +12444,7 @@ var restFeature = defineFeature({
             return `arn:aws:apigateway:${ctx.appConfig.region}:lambda:path/2015-03-31/functions/${arn}/invocations`;
           })
         });
-        const route = new aws14.apiGatewayV2.Route(group, "route", {
+        const route = new aws15.apiGatewayV2.Route(group, "route", {
           apiId,
           routeKey,
           target: integration.id.apply((id2) => `integrations/${id2}`)
@@ -12625,13 +12457,13 @@ var restFeature = defineFeature({
 
 // src/feature/rpc/index.ts
 import { camelCase as camelCase6, constantCase as constantCase9, paramCase as paramCase6 } from "change-case";
-import { aws as aws16, Node as Node15, Output as Output3 } from "@awsless/formation";
+import { aws as aws17, Node as Node16, Output as Output3 } from "@awsless/formation";
 import { mebibytes as mebibytes2 } from "@awsless/size";
 import { dirname as dirname10, join as join8, relative as relative5 } from "path";
 import { fileURLToPath } from "node:url";
 
 // src/feature/function/prebuild.ts
-import { Asset as Asset4, aws as aws15 } from "@awsless/formation";
+import { Asset as Asset4, aws as aws16 } from "@awsless/formation";
 var createPrebuildLambdaFunction = (group, ctx, ns, id, local2) => {
   let name;
   if ("stack" in ctx) {
@@ -12653,21 +12485,21 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, local2) => {
     runtime: "nodejs20.x",
     ...local2
   };
-  const code = new aws15.s3.BucketObject(group, "code", {
+  const code = new aws16.s3.BucketObject(group, "code", {
     bucket: ctx.shared.get("function-bucket-name"),
     key: `/lambda/${name}.zip`,
     body: Asset4.fromFile(props.bundleFile)
   });
-  const role = new aws15.iam.Role(group, "role", {
+  const role = new aws16.iam.Role(group, "role", {
     name,
     assumedBy: "lambda.amazonaws.com"
   });
-  const policy = new aws15.iam.RolePolicy(group, "policy", {
+  const policy = new aws16.iam.RolePolicy(group, "policy", {
     role: role.name,
     name: "lambda-policy",
     version: "2012-10-17"
   });
-  const lambda = new aws15.lambda.Function(group, `function`, {
+  const lambda = new aws16.lambda.Function(group, `function`, {
     ...props,
     name,
     role: role.arn,
@@ -12677,7 +12509,7 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, local2) => {
     vpc: void 0,
     log: props.log
   });
-  new aws15.lambda.SourceCodeUpdate(group, "update", {
+  new aws16.lambda.SourceCodeUpdate(group, "update", {
     functionName: lambda.name,
     version: Asset4.fromFile(props.bundleHash),
     architecture: props.architecture,
@@ -12693,7 +12525,7 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, local2) => {
     lambda.addEnvironment("STACK", ctx.stackConfig.name);
   }
   if (props.log?.retention && props.log?.retention?.value > 0n) {
-    const logGroup = new aws15.cloudWatch.LogGroup(group, "log", {
+    const logGroup = new aws16.cloudWatch.LogGroup(group, "log", {
       name: lambda.name.apply((name2) => `/aws/lambda/${name2}`),
       retention: props.log.retention
     });
@@ -12712,7 +12544,7 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, local2) => {
     policy.addStatement(...local2.permissions);
   }
   if (props.warm) {
-    const rule = new aws15.events.Rule(group, "warm", {
+    const rule = new aws16.events.Rule(group, "warm", {
       name: `${name}--warm`,
       schedule: "rate(5 minutes)",
       enabled: true,
@@ -12727,7 +12559,7 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, local2) => {
         }
       ]
     });
-    new aws15.lambda.Permission(group, `warm`, {
+    new aws16.lambda.Permission(group, `warm`, {
       action: "lambda:InvokeFunction",
       principal: "events.amazonaws.com",
       functionArn: lambda.arn,
@@ -12742,7 +12574,7 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, local2) => {
         ctx.shared.get(`vpc-public-subnet-id-2`)
       ]
     });
-    const vpcPolicy = new aws15.iam.RolePolicy(group, "vpc-policy", {
+    const vpcPolicy = new aws16.iam.RolePolicy(group, "vpc-policy", {
       role: role.name,
       name: "lambda-vpc-policy",
       version: "2012-10-17",
@@ -12776,6 +12608,9 @@ var rpcFeature = defineFeature({
   name: "rpc",
   async onTypeGen(ctx) {
     const types2 = new TypeFile("@awsless/awsless/client");
+    types2.addCode(`type Input<T> = Parameters<T>[0]`);
+    types2.addCode(`type Output<T> = Promise<ReturnType<T>>`);
+    types2.addCode(`type Handle<T> = (input:Input<T>) => Output<T>`);
     const schemas = new TypeObject(1);
     for (const id of Object.keys(ctx.appConfig.defaults.rpc ?? {})) {
       const schema = new TypeObject(2);
@@ -12784,7 +12619,7 @@ var rpcFeature = defineFeature({
           const relFile = relative5(directories.types, props.file);
           const varName = camelCase6(`${stack.name}-${name}`);
           types2.addImport(varName, relFile);
-          schema.addType(name, `Infer<typeof ${varName}>`);
+          schema.addType(name, `Handle<typeof ${varName}>`);
         }
       }
       schemas.addType(id, schema);
@@ -12792,9 +12627,27 @@ var rpcFeature = defineFeature({
     types2.addInterface("RpcSchema", schemas);
     await ctx.write("rpc.d.ts", types2, true);
   },
+  onValidate(ctx) {
+    const names = {};
+    for (const id of Object.keys(ctx.appConfig.defaults.rpc ?? {})) {
+      names[id] = /* @__PURE__ */ new Set();
+    }
+    for (const stack of ctx.stackConfigs) {
+      for (const [id, queries] of Object.entries(stack.rpc ?? {})) {
+        const list4 = names[id];
+        for (const name of Object.keys(queries ?? {})) {
+          if (list4.has(name)) {
+            throw new FileError(stack.file, `Double RPC API function "${id}.${name}"`);
+          } else {
+            list4.add(name);
+          }
+        }
+      }
+    }
+  },
   onApp(ctx) {
     for (const [id, props] of Object.entries(ctx.appConfig.defaults.rpc ?? {})) {
-      const group = new Node15(ctx.base, "rpc", id);
+      const group = new Node16(ctx.base, "rpc", id);
       const name = formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "rpc",
@@ -12803,7 +12656,8 @@ var rpcFeature = defineFeature({
       const { lambda } = createPrebuildLambdaFunction(group, ctx, "rpc", id, {
         bundleFile: join8(__dirname, "/prebuild/rpc/bundle.zip"),
         bundleHash: join8(__dirname, "/prebuild/rpc/HASH"),
-        memorySize: mebibytes2(256)
+        memorySize: mebibytes2(256),
+        warm: 3
       });
       const schema = {};
       lambda.addEnvironment(
@@ -12816,40 +12670,49 @@ var rpcFeature = defineFeature({
       );
       ctx.shared.set(`rpc-${id}-schema`, schema);
       if (props.auth) {
-        const authGroup = new Node15(group, "auth", "authorizer");
+        const authGroup = new Node16(group, "auth", "authorizer");
         const auth2 = createLambdaFunction(authGroup, ctx, "rpc", `${id}-auth`, props.auth);
         lambda.addEnvironment("AUTH", auth2.lambda.name);
       }
-      const permission = new aws16.lambda.Permission(group, "permission", {
+      const permission = new aws17.lambda.Permission(group, "permission", {
         principal: "*",
         action: "lambda:InvokeFunctionUrl",
         functionArn: lambda.arn,
         urlAuthType: "none"
       });
-      const url = new aws16.lambda.Url(group, "url", {
+      const url = new aws17.lambda.Url(group, "url-2", {
         targetArn: lambda.arn,
-        authType: "none"
+        authType: "none",
+        cors: {
+          allow: {
+            origins: ["*"],
+            methods: ["*"],
+            headers: ["Authentication", "Content-Type"]
+            // credentials: true,
+          }
+        }
       }).dependsOn(permission);
       const domainName = props.domain ? formatFullDomainName(ctx.appConfig, props.domain, props.subDomain) : void 0;
       const certificateArn = props.domain ? ctx.shared.get(`global-certificate-${props.domain}-arn`) : void 0;
-      const cache = new aws16.cloudFront.CachePolicy(group, "cache", {
+      const cache = new aws17.cloudFront.CachePolicy(group, "cache", {
         name,
         minTtl: seconds3(1),
         maxTtl: days5(365),
         defaultTtl: days5(1)
       });
-      const originRequest = new aws16.cloudFront.OriginRequestPolicy(group, "request", {
+      const originRequest = new aws17.cloudFront.OriginRequestPolicy(group, "request", {
         name,
         header: {
           behavior: "all-except",
-          values: ["host", "authentication"]
+          values: ["Host"]
         }
       });
-      const cdn = new aws16.cloudFront.Distribution(group, "cdn", {
+      const cdn = new aws17.cloudFront.Distribution(group, "cdn-2", {
         name,
         compress: true,
         certificateArn,
         viewerProtocol: "https-only",
+        allowMethod: ["GET", "HEAD", "OPTIONS", "PUT", "PATCH", "POST", "DELETE"],
         aliases: domainName ? [domainName] : void 0,
         origins: [
           {
@@ -12861,11 +12724,10 @@ var rpcFeature = defineFeature({
         targetOriginId: "default",
         cachePolicyId: cache.id,
         originRequestPolicyId: originRequest.id
-        // responseHeadersPolicyId: responseHeaders.id,
       });
       if (props.domain) {
         const fullDomainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
-        new aws16.route53.RecordSet(group, "record", {
+        new aws17.route53.RecordSet(group, "record", {
           hostedZoneId: ctx.shared.get(`hosted-zone-${props.domain}-id`),
           type: "A",
           name: fullDomainName,
@@ -12884,9 +12746,9 @@ var rpcFeature = defineFeature({
         throw new FileError(ctx.stackConfig.file, `RPC definition is not defined on app level for "${id}"`);
       }
       const schema = ctx.shared.get(`rpc-${id}-schema`);
-      const group = new Node15(ctx.stack, "rpc", id);
+      const group = new Node16(ctx.stack, "rpc", id);
       for (const [name, props] of Object.entries(queries ?? {})) {
-        const queryGroup = new Node15(group, "query", name);
+        const queryGroup = new Node16(group, "query", name);
         const entryId = paramCase6(`${id}-${shortId(name)}`);
         const lambda = createLambdaFunction(queryGroup, ctx, `rpc`, entryId, {
           ...props,
@@ -12899,7 +12761,7 @@ var rpcFeature = defineFeature({
 });
 
 // src/feature/search/index.ts
-import { aws as aws17, Node as Node16 } from "@awsless/formation";
+import { aws as aws18, Node as Node17 } from "@awsless/formation";
 import { constantCase as constantCase10 } from "change-case";
 var typeGenCode4 = `
 import { AnyStruct, Table } from '@awsless/open-search'
@@ -12927,9 +12789,9 @@ var searchFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.searchs ?? {})) {
-      const group = new Node16(ctx.stack, "search", id);
+      const group = new Node17(ctx.stack, "search", id);
       const name = `${id}-${shortId([ctx.app.name, ctx.stack.name, this.name, id].join("--"))}`;
-      const openSearch = new aws17.openSearch.Domain(group, "domain", {
+      const openSearch = new aws18.openSearch.Domain(group, "domain", {
         name,
         version: props.version,
         storageSize: props.storage,
@@ -12969,7 +12831,7 @@ var searchFeature = defineFeature({
 
 // src/feature/site/index.ts
 import { days as days6, seconds as seconds4 } from "@awsless/duration";
-import { Asset as Asset5, aws as aws18, Node as Node17 } from "@awsless/formation";
+import { Asset as Asset5, aws as aws19, Node as Node18 } from "@awsless/formation";
 import { glob as glob2 } from "glob";
 import { join as join9 } from "path";
 
@@ -12999,7 +12861,7 @@ var siteFeature = defineFeature({
   name: "site",
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.sites ?? {})) {
-      const group = new Node17(ctx.stack, "site", id);
+      const group = new Node18(ctx.stack, "site", id);
       const name = formatLocalResourceName({
         appName: ctx.app.name,
         stackName: ctx.stack.name,
@@ -13018,7 +12880,7 @@ var siteFeature = defineFeature({
         ctx.onBind((name2, value) => {
           lambda.addEnvironment(name2, value);
         });
-        new aws18.lambda.Permission(group, "permission", {
+        new aws19.lambda.Permission(group, "permission", {
           principal: "*",
           // principal: 'cloudfront.amazonaws.com',
           action: "lambda:InvokeFunctionUrl",
@@ -13027,7 +12889,7 @@ var siteFeature = defineFeature({
           // urlAuthType: 'aws-iam',
           // sourceArn: distribution.arn,
         });
-        const url = new aws18.lambda.Url(group, "url", {
+        const url = new aws19.lambda.Url(group, "url", {
           targetArn: lambda.arn,
           authType: "none"
           // authType: 'aws-iam',
@@ -13039,7 +12901,7 @@ var siteFeature = defineFeature({
         });
       }
       if (props.static) {
-        bucket = new aws18.s3.Bucket(group, "bucket", {
+        bucket = new aws19.s3.Bucket(group, "bucket", {
           name: formatLocalResourceName({
             appName: ctx.app.name,
             stackName: ctx.stack.name,
@@ -13065,7 +12927,7 @@ var siteFeature = defineFeature({
           policy.addStatement(bucket.permissions);
         });
         bucket.deletionPolicy = "after-deployment";
-        const accessControl = new aws18.cloudFront.OriginAccessControl(group, `access`, {
+        const accessControl = new aws19.cloudFront.OriginAccessControl(group, `access`, {
           name,
           type: "s3",
           behavior: "always",
@@ -13077,7 +12939,7 @@ var siteFeature = defineFeature({
           nodir: true
         });
         for (const file of files) {
-          const object = new aws18.s3.BucketObject(group, file, {
+          const object = new aws19.s3.BucketObject(group, file, {
             bucket: bucket.name,
             key: file,
             body: Asset5.fromFile(join9(props.static, file)),
@@ -13100,21 +12962,21 @@ var siteFeature = defineFeature({
           statusCodes: [403, 404]
         });
       }
-      const cache = new aws18.cloudFront.CachePolicy(group, "cache", {
+      const cache = new aws19.cloudFront.CachePolicy(group, "cache", {
         name,
         minTtl: seconds4(1),
         maxTtl: days6(365),
         defaultTtl: days6(1),
         ...props.cache
       });
-      const originRequest = new aws18.cloudFront.OriginRequestPolicy(group, "request", {
+      const originRequest = new aws19.cloudFront.OriginRequestPolicy(group, "request", {
         name,
         header: {
           behavior: "all-except",
           values: ["host", "authorization"]
         }
       });
-      const responseHeaders = new aws18.cloudFront.ResponseHeadersPolicy(group, "response", {
+      const responseHeaders = new aws19.cloudFront.ResponseHeadersPolicy(group, "response", {
         name,
         cors: props.cors,
         remove: ["server"]
@@ -13124,7 +12986,7 @@ var siteFeature = defineFeature({
       });
       const domainName = props.domain ? formatFullDomainName(ctx.appConfig, props.domain, props.subDomain) : void 0;
       const certificateArn = props.domain ? ctx.shared.get(`global-certificate-${props.domain}-arn`) : void 0;
-      const distribution = new aws18.cloudFront.Distribution(group, "distribution", {
+      const distribution = new aws19.cloudFront.Distribution(group, "distribution", {
         name,
         compress: true,
         certificateArn,
@@ -13152,13 +13014,13 @@ var siteFeature = defineFeature({
           };
         })
       });
-      new aws18.cloudFront.InvalidateCache(group, "invalidate", {
+      new aws19.cloudFront.InvalidateCache(group, "invalidate", {
         distributionId: distribution.id,
         paths: ["/*"],
         versions
       });
       if (props.static) {
-        new aws18.s3.BucketPolicy(group, `policy`, {
+        new aws19.s3.BucketPolicy(group, `policy`, {
           bucketName: bucket.name,
           statements: [
             {
@@ -13185,7 +13047,7 @@ var siteFeature = defineFeature({
         });
       }
       if (domainName) {
-        new aws18.route53.RecordSet(group, `record`, {
+        new aws19.route53.RecordSet(group, `record`, {
           hostedZoneId: ctx.shared.get(`hosted-zone-${props.domain}-id`),
           type: "A",
           name: domainName,
@@ -13201,7 +13063,7 @@ var siteFeature = defineFeature({
 });
 
 // src/feature/store/index.ts
-import { aws as aws19, Node as Node18 } from "@awsless/formation";
+import { aws as aws20, Node as Node19 } from "@awsless/formation";
 import { paramCase as paramCase7 } from "change-case";
 var typeGenCode5 = `
 import { Body, PutObjectProps, BodyStream } from '@awsless/s3'
@@ -13238,7 +13100,7 @@ var storeFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.stores ?? {})) {
-      const group = new Node18(ctx.stack, "store", id);
+      const group = new Node19(ctx.stack, "store", id);
       const name = formatLocalResourceName({
         appName: ctx.app.name,
         stackName: ctx.stack.name,
@@ -13258,13 +13120,13 @@ var storeFeature = defineFeature({
         "removed:marker": "s3:ObjectRemoved:DeleteMarkerCreated"
       };
       for (const [event, funcProps] of Object.entries(props.events ?? {})) {
-        const eventGroup = new Node18(group, "event", event);
+        const eventGroup = new Node19(group, "event", event);
         const eventId = paramCase7(`${id}-${shortId(event)}`);
         const { lambda } = createAsyncLambdaFunction(eventGroup, ctx, `store`, eventId, {
           ...funcProps,
           description: `${id} event "${event}"`
         });
-        new aws19.lambda.Permission(eventGroup, "permission", {
+        new aws20.lambda.Permission(eventGroup, "permission", {
           action: "lambda:InvokeFunction",
           principal: "s3.amazonaws.com",
           functionArn: lambda.arn,
@@ -13275,7 +13137,7 @@ var storeFeature = defineFeature({
           function: lambda.arn
         });
       }
-      const bucket = new aws19.s3.Bucket(group, "store", {
+      const bucket = new aws20.s3.Bucket(group, "store", {
         name,
         versioning: props.versioning,
         forceDelete: true,
@@ -13303,24 +13165,24 @@ var storeFeature = defineFeature({
 });
 
 // src/feature/stream/index.ts
-import { aws as aws20, Node as Node19 } from "@awsless/formation";
+import { aws as aws21, Node as Node20 } from "@awsless/formation";
 import { constantCase as constantCase12 } from "change-case";
 var streamFeature = defineFeature({
   name: "stream",
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.streams ?? {})) {
-      const group = new Node19(ctx.stack, "stream", id);
+      const group = new Node20(ctx.stack, "stream", id);
       const name = formatLocalResourceName({
         appName: ctx.app.name,
         stackName: ctx.stack.name,
         resourceType: "stream",
         resourceName: id
       });
-      const channel = new aws20.ivs.Channel(group, "channel", {
+      const channel = new aws21.ivs.Channel(group, "channel", {
         name,
         ...props
       });
-      const streamKey = new aws20.ivs.StreamKey(group, "key", {
+      const streamKey = new aws21.ivs.StreamKey(group, "key", {
         channel: channel.arn
       });
       const prefix = `STREAM_${constantCase12(ctx.stack.name)}_${constantCase12(id)}`;
@@ -13332,7 +13194,7 @@ var streamFeature = defineFeature({
 });
 
 // src/feature/table/index.ts
-import { aws as aws21, Node as Node20 } from "@awsless/formation";
+import { aws as aws22, Node as Node21 } from "@awsless/formation";
 var tableFeature = defineFeature({
   name: "table",
   async onTypeGen(ctx) {
@@ -13356,7 +13218,7 @@ var tableFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.tables ?? {})) {
-      const group = new Node20(ctx.stack, "table", id);
+      const group = new Node21(ctx.stack, "table", id);
       const name = formatLocalResourceName({
         appName: ctx.app.name,
         stackName: ctx.stack.name,
@@ -13364,7 +13226,7 @@ var tableFeature = defineFeature({
         resourceName: id
       });
       const deletionProtection = props.deletionProtection ?? ctx.appConfig.defaults.table?.deletionProtection;
-      const table2 = new aws21.dynamodb.Table(group, "table", {
+      const table2 = new aws22.dynamodb.Table(group, "table", {
         ...props,
         name,
         stream: props.stream?.type,
@@ -13377,7 +13239,7 @@ var tableFeature = defineFeature({
         const { lambda, policy } = createLambdaFunction(group, ctx, "table", id, props.stream.consumer);
         lambda.addEnvironment("LOG_VIEWABLE_ERROR", "1");
         const onFailure = getGlobalOnFailure(ctx);
-        const source = new aws21.lambda.EventSourceMapping(group, id, {
+        const source = new aws22.lambda.EventSourceMapping(group, id, {
           functionArn: lambda.arn,
           sourceArn: table2.streamArn,
           batchSize: 100,
@@ -13404,7 +13266,7 @@ var tableFeature = defineFeature({
 });
 
 // src/feature/task/index.ts
-import { Node as Node21 } from "@awsless/formation";
+import { Node as Node22 } from "@awsless/formation";
 import { camelCase as camelCase7 } from "change-case";
 import { relative as relative6 } from "path";
 var typeGenCode6 = `
@@ -13466,7 +13328,7 @@ var taskFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.tasks ?? {})) {
-      const group = new Node21(ctx.stack, "task", id);
+      const group = new Node22(ctx.stack, "task", id);
       createAsyncLambdaFunction(group, ctx, "task", id, props.consumer);
     }
   }
@@ -13483,7 +13345,7 @@ var testFeature = defineFeature({
 });
 
 // src/feature/topic/index.ts
-import { aws as aws22, Node as Node22 } from "@awsless/formation";
+import { aws as aws23, Node as Node23 } from "@awsless/formation";
 var typeGenCode7 = `
 import type { PublishOptions } from '@awsless/sns'
 import type { Mock } from 'vitest'
@@ -13524,154 +13386,436 @@ var topicFeature = defineFeature({
   onApp(ctx) {
     for (const stack of ctx.stackConfigs) {
       for (const id of stack.topics ?? []) {
-        const group = new Node22(ctx.base, "topic", id);
+        const group = new Node23(ctx.base, "topic", id);
         const name = formatGlobalResourceName({
           appName: ctx.appConfig.name,
           resourceType: "topic",
           resourceName: id
         });
-        const topic = new aws22.sns.Topic(group, "topic", {
+        const topic = new aws23.sns.Topic(group, "topic", {
           name
         });
         ctx.shared.set(`topic-${id}-arn`, topic.arn);
       }
-    }
-  },
-  onStack(ctx) {
-    for (const id of ctx.stackConfig.topics ?? []) {
-      ctx.onPolicy((policy) => {
-        policy.addStatement({
-          actions: ["sns:Publish"],
-          resources: [ctx.shared.get(`topic-${id}-arn`)]
-        });
-      });
-    }
-    for (const [id, props] of Object.entries(ctx.stackConfig.subscribers ?? {})) {
-      const group = new Node22(ctx.stack, "topic", id);
-      const topicArn = ctx.shared.get(`topic-${id}-arn`);
-      if (typeof props === "string" && isEmail(props)) {
-        new aws22.sns.Subscription(group, id, {
-          topicArn,
-          protocol: "email",
-          endpoint: props
-        });
-      } else if (typeof props === "object") {
-        const { lambda } = createAsyncLambdaFunction(group, ctx, `topic`, id, props);
-        new aws22.sns.Subscription(group, id, {
-          topicArn,
-          protocol: "lambda",
-          endpoint: lambda.arn
-        });
-        new aws22.lambda.Permission(group, id, {
-          action: "lambda:InvokeFunction",
-          principal: "sns.amazonaws.com",
-          functionArn: lambda.arn,
-          sourceArn: topicArn
-        });
+    }
+  },
+  onStack(ctx) {
+    for (const id of ctx.stackConfig.topics ?? []) {
+      ctx.onPolicy((policy) => {
+        policy.addStatement({
+          actions: ["sns:Publish"],
+          resources: [ctx.shared.get(`topic-${id}-arn`)]
+        });
+      });
+    }
+    for (const [id, props] of Object.entries(ctx.stackConfig.subscribers ?? {})) {
+      const group = new Node23(ctx.stack, "topic", id);
+      const topicArn = ctx.shared.get(`topic-${id}-arn`);
+      if (typeof props === "string" && isEmail(props)) {
+        new aws23.sns.Subscription(group, id, {
+          topicArn,
+          protocol: "email",
+          endpoint: props
+        });
+      } else if (typeof props === "object") {
+        const { lambda } = createAsyncLambdaFunction(group, ctx, `topic`, id, props);
+        new aws23.sns.Subscription(group, id, {
+          topicArn,
+          protocol: "lambda",
+          endpoint: lambda.arn
+        });
+        new aws23.lambda.Permission(group, id, {
+          action: "lambda:InvokeFunction",
+          principal: "sns.amazonaws.com",
+          functionArn: lambda.arn,
+          sourceArn: topicArn
+        });
+      }
+    }
+  }
+});
+
+// src/feature/vpc/index.ts
+import { aws as aws24, combine as combine2, Node as Node24 } from "@awsless/formation";
+var vpcFeature = defineFeature({
+  name: "vpc",
+  onApp(ctx) {
+    const group = new Node24(ctx.base, "vpc", "main");
+    const vpc = new aws24.ec2.Vpc(group, "vpc", {
+      name: ctx.app.name,
+      cidrBlock: aws24.ec2.Peer.ipv4("10.0.0.0/16")
+      // cidrBlock: aws.ec2.Peer.ipv6('fd00:10:20::/48'),
+      // cidrBlock: aws.ec2.Peer.ipv6('2a05:d018:c69:6600::/56'),
+      // enableDnsSupport: true,
+      // enableDnsHostnames: true,
+    });
+    const privateRouteTable = new aws24.ec2.RouteTable(group, "private", {
+      vpcId: vpc.id,
+      name: "private"
+    });
+    const publicRouteTable = new aws24.ec2.RouteTable(group, "public", {
+      vpcId: vpc.id,
+      name: "public"
+    });
+    const gateway = new aws24.ec2.InternetGateway(group, "gateway");
+    const attachment = new aws24.ec2.VPCGatewayAttachment(group, "attachment", {
+      vpcId: vpc.id,
+      internetGatewayId: gateway.id
+    });
+    new aws24.ec2.Route(group, "route", {
+      gatewayId: gateway.id,
+      routeTableId: publicRouteTable.id,
+      destination: aws24.ec2.Peer.anyIpv4()
+      // destination: aws.ec2.Peer.anyIpv6(),
+    });
+    ctx.shared.set(
+      "vpc-id",
+      // Some resources require the internet gateway to be attached.
+      combine2([vpc.id, attachment.internetGatewayId]).apply(([id]) => id)
+    );
+    ctx.shared.set("vpc-security-group-id", vpc.defaultSecurityGroup);
+    const zones = ["a", "b"];
+    const tables = [privateRouteTable, publicRouteTable];
+    let block = 0n;
+    for (const table2 of tables) {
+      for (const i in zones) {
+        const index = Number(i) + 1;
+        const id = `${table2.identifier}-${index}`;
+        const subnet = new aws24.ec2.Subnet(group, id, {
+          name: `${ctx.app.name}--${table2.identifier}-${index}`,
+          vpcId: vpc.id,
+          cidrBlock: aws24.ec2.Peer.ipv4(`10.0.${block++}.0/24`),
+          // ipv6CidrBlock: aws.ec2.Peer.ipv6(`fd00:10:20:${++block}::/64`),
+          // ipv6CidrBlock: aws.ec2.Peer.ipv6(`2a05:d018:c69:660${++block}::/64`),
+          // ipv6CidrBlock: ipv6CidrBlock.ipv6CidrBlock.apply(ip => ),
+          // ipv6CidrBlock: slices.apply(list => aws.ec2.Peer.ipv6(list.get(block++).toString())),
+          // assignIpv6AddressOnCreation: true,
+          // ipv6Native: true,
+          mapPublicIpOnLaunch: table2.identifier === "public",
+          availabilityZone: ctx.appConfig.region + zones[i]
+        });
+        new aws24.ec2.SubnetRouteTableAssociation(group, id, {
+          routeTableId: table2.id,
+          subnetId: subnet.id
+        });
+        ctx.shared.set(`vpc-${table2.identifier}-subnet-id-${index}`, subnet.id);
+      }
+    }
+  }
+});
+
+// src/feature/index.ts
+var features = [
+  // 1
+  vpcFeature,
+  domainFeature,
+  commandFeature,
+  onFailureFeature,
+  // 2
+  authFeature,
+  // 3
+  functionFeature,
+  instanceFeature,
+  graphqlFeature,
+  configFeature,
+  searchFeature,
+  pubsubFeature,
+  streamFeature,
+  tableFeature,
+  topicFeature,
+  queueFeature,
+  storeFeature,
+  cacheFeature,
+  taskFeature,
+  testFeature,
+  cronFeature,
+  httpFeature,
+  restFeature,
+  siteFeature,
+  // 4
+  logSubscriptionFeature,
+  // I think needs to be after s3 feature
+  rpcFeature
+];
+
+// src/feature/validate.ts
+var validateFeatures = (props) => {
+  for (const feature of features) {
+    feature.onValidate?.(props);
+  }
+};
+
+// src/cli/ui/app.ts
+import { note } from "@clack/prompts";
+var logApp = (app, opt) => {
+  const data = {
+    App: app.name,
+    Region: app.region,
+    Profile: app.profile
+  };
+  if (opt.stage) {
+    data.Stage = color.warning(opt.stage);
+  }
+  note(wrap(list(data)), "App Config");
+};
+
+// src/cli/ui/error/error.ts
+import { AppError as AppError2, StackError as StackError3 } from "@awsless/formation";
+import { log as log6 } from "@clack/prompts";
+
+// src/cli/ui/error/app-error.ts
+import { StackError as StackError2 } from "@awsless/formation";
+import { log as log3 } from "@clack/prompts";
+
+// src/cli/ui/error/stack-error.ts
+import { ResourceError } from "@awsless/formation";
+import { log as log2 } from "@clack/prompts";
+import { capitalCase as capitalCase2 } from "change-case";
+var formatOperation = (operation) => {
+  const value = ` ${capitalCase2(operation)} `;
+  switch (operation) {
+    case "create":
+      return color.success.bold.inverse(value);
+    case "update":
+      return color.warning.bold.inverse(value);
+    case "delete":
+      return color.error.bold.inverse(value);
+    case "heal":
+      return color.warning.bold.inverse(value);
+    case "get":
+      return color.info.bold.inverse(value);
+  }
+};
+var logStackError = (error) => {
+  log2.message(
+    wrap([color.error(error.message), `Stack: ${error.stack}`].join("\n"), {
+      hard: true
+    }),
+    { symbol: color.error(icon.error) }
+  );
+  for (const issue of error.issues) {
+    if (issue instanceof ResourceError) {
+      log2.message(
+        [
+          formatOperation(issue.operation),
+          "\n",
+          wrap("URN: " + issue.urn, { hard: true }),
+          "\n",
+          wrap("ID: " + issue.id, { hard: true }),
+          "\n\n",
+          wrap(color.error(issue.message), { hard: true })
+          // , '\n', color.error(issue.message)
+        ].join(""),
+        { symbol: color.error(icon.error) }
+      );
+    } else if (issue instanceof Error) {
+      log2.message(wrap(color.error(issue.message), { hard: true }), {
+        symbol: color.error(icon.error)
+      });
+    }
+  }
+};
+
+// src/cli/ui/error/app-error.ts
+var logAppError = (error) => {
+  log3.message(
+    wrap([color.error(error.message), `App: ${error.app}`].join("\n"), {
+      hard: true
+    }),
+    { symbol: color.error(icon.error) }
+  );
+  for (const issue of error.issues) {
+    if (issue instanceof StackError2) {
+      logStackError(issue);
+    } else if (issue instanceof Error) {
+      log3.message(wrap(color.error(issue.message), { hard: true }), {
+        symbol: color.error(icon.error)
+      });
+    }
+  }
+};
+
+// src/cli/ui/error/config-error.ts
+import * as p from "@clack/prompts";
+var codeLine = (value, level = 0) => {
+  return [
+    //
+    "  ".repeat(level),
+    value
+  ].join("");
+};
+var format = (value) => {
+  if (Array.isArray(value)) {
+    return "[ ... ]";
+  }
+  if (value === null) {
+    return "null";
+  }
+  switch (typeof value) {
+    case "function":
+      return "() => { ... }";
+    case "bigint":
+      return `${value}n`;
+    case "symbol":
+      return "Symbol()";
+    case "object":
+      return "{ ... }";
+    case "undefined":
+      return "undefined";
+    case "string":
+    case "number":
+    case "boolean":
+      return JSON.stringify(value);
+  }
+  return "";
+};
+var logConfigError = (error) => {
+  for (const issue of error.error.errors) {
+    const message = [color.error(issue.message), color.dim(error.file), "\n{"];
+    let context = error.data;
+    const inStack = issue.path[0] === "stacks" && typeof issue.path[1] === "number";
+    const length = issue.path.length;
+    const end = ["}"];
+    issue.path.forEach((path, i) => {
+      const index = i + 1;
+      context = context[path];
+      if (typeof path === "string") {
+        const key = path + `: `;
+        if (index === length) {
+          const space = " ".repeat(key.length);
+          const value = format(context);
+          const error2 = icon.arrow.top.repeat(value.length);
+          message.push(codeLine(key + color.warning(value), index));
+          message.push(codeLine(space + color.error(error2), index));
+        } else if (Array.isArray(context)) {
+          message.push(codeLine(key + "[", index));
+          end.unshift(codeLine("]", index));
+        } else if (typeof context === "object") {
+          if (inStack && index === 3) {
+            const name = error.data.stacks[issue.path[1]].name;
+            message.push(codeLine("name: " + color.info(`"${name}"`) + ",", index));
+          }
+          message.push(codeLine(key + "{", index));
+          end.unshift(codeLine("}", index));
+        }
+      } else if (typeof context === "object") {
+        message.push(codeLine("{", index));
+        end.unshift(codeLine("}", index));
+      } else if (typeof context === "string") {
+        message.push(codeLine(color.warning(`"${context}"`), index));
+        const error2 = icon.arrow.top.repeat(context.length + 2);
+        message.push(codeLine(color.error(error2), index));
+      }
+    });
+    p.log.message(
+      wrap([...message, ...end], {
+        trim: false
+      }),
+      {
+        symbol: color.error`×`
       }
-    }
+    );
   }
-});
+};
 
-// src/feature/vpc/index.ts
-import { aws as aws23, combine as combine2, Node as Node23 } from "@awsless/formation";
-var vpcFeature = defineFeature({
-  name: "vpc",
-  onApp(ctx) {
-    const group = new Node23(ctx.base, "vpc", "main");
-    const vpc = new aws23.ec2.Vpc(group, "vpc", {
-      name: ctx.app.name,
-      cidrBlock: aws23.ec2.Peer.ipv4("10.0.0.0/16")
-      // cidrBlock: aws.ec2.Peer.ipv6('fd00:10:20::/48'),
-      // cidrBlock: aws.ec2.Peer.ipv6('2a05:d018:c69:6600::/56'),
-      // enableDnsSupport: true,
-      // enableDnsHostnames: true,
+// src/cli/ui/error/file-error.ts
+import { log as log5 } from "@clack/prompts";
+var logFileError = (error) => {
+  log5.message(
+    wrap([color.error(error.message), color.dim(error.file)].join("\n"), {
+      hard: true
+    }),
+    { symbol: color.error(icon.error) }
+  );
+};
+
+// src/cli/ui/error/error.ts
+var logError = (error) => {
+  if (error instanceof ConfigError) {
+    logConfigError(error);
+  } else if (error instanceof Cancelled) {
+    log6.message(color.error("Cancelled."), {
+      symbol: color.error(icon.error)
     });
-    const privateRouteTable = new aws23.ec2.RouteTable(group, "private", {
-      vpcId: vpc.id,
-      name: "private"
+  } else if (error instanceof ExpectedError) {
+    log6.message(color.error(error.message), {
+      symbol: color.error(icon.error)
     });
-    const publicRouteTable = new aws23.ec2.RouteTable(group, "public", {
-      vpcId: vpc.id,
-      name: "public"
+  } else if (error instanceof AppError2) {
+    logAppError(error);
+  } else if (error instanceof StackError3) {
+    logStackError(error);
+  } else if (error instanceof FileError) {
+    logFileError(error);
+  } else if (error instanceof Error) {
+    const message = `${error.name}: ${error.message}`;
+    const stack = error.stack ? color.dim(error.stack.replace(message, "")) : "";
+    log6.message(
+      wrap([color.error(message), stack], {
+        hard: true
+      }),
+      { symbol: color.error(icon.error) }
+    );
+  } else if (typeof error === "string") {
+    log6.message(wrap(color.error(error)), {
+      symbol: color.error(icon.error)
     });
-    const gateway = new aws23.ec2.InternetGateway(group, "gateway");
-    const attachment = new aws23.ec2.VPCGatewayAttachment(group, "attachment", {
-      vpcId: vpc.id,
-      internetGatewayId: gateway.id
+  } else {
+    log6.message(wrap(color.error("Unknown error!")), {
+      symbol: color.error(icon.error)
     });
-    new aws23.ec2.Route(group, "route", {
-      gatewayId: gateway.id,
-      routeTableId: publicRouteTable.id,
-      destination: aws23.ec2.Peer.anyIpv4()
-      // destination: aws.ec2.Peer.anyIpv6(),
+  }
+};
+
+// src/cli/ui/logo.ts
+var logo = () => {
+  return `${color.primary`AWS`}${color.primary.dim`LESS`}`;
+};
+
+// src/cli/ui/complex/layout.ts
+var layout = async (command, cb) => {
+  console.log();
+  intro(`${logo()} ${color.dim(command)}`);
+  try {
+    const options = program.optsWithGlobals();
+    const appConfig = await loadAppConfig(options);
+    logApp(appConfig, options);
+    const stackConfigs = await loadStackConfigs(options);
+    validateFeatures({
+      appConfig,
+      stackConfigs
     });
-    ctx.shared.set(
-      "vpc-id",
-      // Some resources require the internet gateway to be attached.
-      combine2([vpc.id, attachment.internetGatewayId]).apply(([id]) => id)
-    );
-    ctx.shared.set("vpc-security-group-id", vpc.defaultSecurityGroup);
-    const zones = ["a", "b"];
-    const tables = [privateRouteTable, publicRouteTable];
-    let block = 0n;
-    for (const table2 of tables) {
-      for (const i in zones) {
-        const index = Number(i) + 1;
-        const id = `${table2.identifier}-${index}`;
-        const subnet = new aws23.ec2.Subnet(group, id, {
-          name: `${ctx.app.name}--${table2.identifier}-${index}`,
-          vpcId: vpc.id,
-          cidrBlock: aws23.ec2.Peer.ipv4(`10.0.${block++}.0/24`),
-          // ipv6CidrBlock: aws.ec2.Peer.ipv6(`fd00:10:20:${++block}::/64`),
-          // ipv6CidrBlock: aws.ec2.Peer.ipv6(`2a05:d018:c69:660${++block}::/64`),
-          // ipv6CidrBlock: ipv6CidrBlock.ipv6CidrBlock.apply(ip => ),
-          // ipv6CidrBlock: slices.apply(list => aws.ec2.Peer.ipv6(list.get(block++).toString())),
-          // assignIpv6AddressOnCreation: true,
-          // ipv6Native: true,
-          mapPublicIpOnLaunch: table2.identifier === "public",
-          availabilityZone: ctx.appConfig.region + zones[i]
-        });
-        new aws23.ec2.SubnetRouteTableAssociation(group, id, {
-          routeTableId: table2.id,
-          subnetId: subnet.id
-        });
-        ctx.shared.set(`vpc-${table2.identifier}-subnet-id-${index}`, subnet.id);
-      }
-    }
+    const result = await cb({
+      options,
+      appConfig,
+      stackConfigs
+    });
+    outro(result ?? void 0);
+  } catch (error) {
+    logError(error);
+    outro();
+    process.exit(1);
   }
-});
+};
 
-// src/feature/index.ts
-var features = [
-  // 1
-  vpcFeature,
-  domainFeature,
-  commandFeature,
-  onFailureFeature,
-  // 2
-  authFeature,
-  // 3
-  functionFeature,
-  instanceFeature,
-  graphqlFeature,
-  configFeature,
-  searchFeature,
-  pubsubFeature,
-  streamFeature,
-  tableFeature,
-  topicFeature,
-  queueFeature,
-  storeFeature,
-  cacheFeature,
-  taskFeature,
-  testFeature,
-  cronFeature,
-  httpFeature,
-  restFeature,
-  siteFeature,
-  rpcFeature
-];
+// src/cli/command/bootstrap.ts
+var bootstrap = (program2) => {
+  program2.command("bootstrap").description("Create the awsless bootstrap stack").action(async () => {
+    await layout("bootstrap", async ({ appConfig }) => {
+      const credentials = getCredentials(appConfig.profile);
+      const accountId = await getAccountId(credentials, appConfig.region);
+      await bootstrapAwsless({
+        credentials,
+        region: appConfig.region,
+        accountId
+      });
+      return "Ready to go!";
+    });
+  });
+};
+
+// src/app.ts
+import { App as App2, Stack } from "@awsless/formation";
 
 // src/shared.ts
 var SharedData = class {
@@ -14694,10 +14838,8 @@ var watchConfig = async (options, resolve2, reject) => {
     try {
       const appConfig = await loadAppConfig(options);
       const stackConfigs = await loadStackConfigs(options);
-      resolve2({
-        appConfig,
-        stackConfigs
-      });
+      validateFeatures({ appConfig, stackConfigs });
+      resolve2({ appConfig, stackConfigs });
     } catch (error) {
       reject(error);
     }