@awsless/awsless 0.0.539 → 0.0.541

package/dist/bin.js

@@ -606,7 +606,7 @@ var debug = (...parts) => {
 };
 
 // src/config/app.ts
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 
 // src/feature/alert/schema.ts
 import { kebabCase } from "change-case";
@@ -840,7 +840,7 @@ var LogRetentionSchema = DurationSchema.refine(
   (duration) => {
     return validLogRetentionDays.includes(toDays(duration));
   },
-  `Invalid log retention. Valid days are: ${validLogRetentionDays.map((days8) => `${days8}`).join(", ")}`
+  `Invalid log retention. Valid days are: ${validLogRetentionDays.map((days9) => `${days9}`).join(", ")}`
 ).describe("The log retention duration.");
 var LogSchema = z14.union([
   z14.boolean().transform((enabled) => ({ retention: enabled ? days(7) : days(0) })),
@@ -1145,8 +1145,159 @@ var RpcDefaultSchema = z22.record(
 ).describe(`Define the global RPC API's.`).optional();
 var RpcSchema = z22.record(ResourceIdSchema, z22.record(z22.string(), FunctionSchema).describe("The queries for your global RPC API.")).describe("Define the schema in your stack for your global RPC API.").optional();
 
-// src/config/schema/region.ts
+// src/feature/instance/schema.ts
+import { days as days3, toDays as toDays2 } from "@awsless/duration";
 import { z as z23 } from "zod";
+var CpuSizeSchema = z23.union([
+  z23.literal("0.25 vCPU"),
+  z23.literal("0.5 vCPU"),
+  z23.literal("1 vCPU"),
+  z23.literal("2 vCPU"),
+  z23.literal("4 vCPU"),
+  z23.literal("8 vCPU"),
+  z23.literal("16 vCPU")
+]).describe(
+  "The number of vCPU units used by the task. For tasks using the Fargate launch type, this field is required. Valid values: 0.25, 0.5, 1, 2, 4, 8, 16 vCPU."
+);
+var MemorySizeSchema2 = z23.union([
+  // 0.25 vCPU
+  z23.literal(512),
+  z23.literal(1024),
+  z23.literal(2048),
+  // 0.5 vCPU
+  z23.literal(1024),
+  z23.literal(2048),
+  z23.literal(3072),
+  z23.literal(4096),
+  // 1 vCPU
+  z23.literal(2048),
+  z23.literal(3072),
+  z23.literal(4096),
+  z23.literal(5120),
+  z23.literal(6144),
+  z23.literal(7168),
+  z23.literal(8192),
+  // 2 vCPU
+  z23.literal(4096),
+  z23.literal(5120),
+  z23.literal(6144),
+  z23.literal(7168),
+  z23.literal(8192),
+  z23.literal(9216),
+  z23.literal(10240),
+  z23.literal(11264),
+  z23.literal(12288),
+  z23.literal(13312),
+  z23.literal(14336),
+  z23.literal(15360),
+  z23.literal(16384)
+]).describe(
+  "The amount of memory (in MiB) used by the task. For tasks using the Fargate launch type, this field is required and must be compatible with the CPU value. Valid memory values depend on the CPU configuration."
+);
+var HealthCheckSchema = z23.object({
+  command: z23.union([z23.string(), z23.string().array()]).describe("The command that the container runs to determine if it is healthy."),
+  interval: DurationSchema.describe("The time period in seconds between each health check execution."),
+  retries: z23.number().int().min(1).max(10).describe(
+    "The number of times to retry a failed health check before the container is considered unhealthy."
+  ),
+  startPeriod: DurationSchema.describe(
+    "The optional grace period to provide containers time to bootstrap before failed health checks count towards the maximum number of retries."
+  ),
+  timeout: DurationSchema.describe(
+    "The time period in seconds to wait for a health check to succeed before it is considered a failure."
+  )
+}).describe("The health check command and associated configuration parameters for the container.");
+var RestartPolicySchema = z23.object({
+  enabled: z23.boolean().describe("Whether to enable the restart policy for the container."),
+  ignoredExitCodes: z23.number().int().array().optional().describe("A list of exit codes that Amazon ECS will ignore and not attempt a restart against."),
+  restartAttemptPeriod: z23.number().int().min(0).max(1800).optional().describe(
+    "A period of time (in seconds) that the container must run for before a restart can be attempted. A container can be restarted only once every restartAttemptPeriod seconds. If a container isn't able to run for this time period and exits early, it will not be restarted. You can set a minimum restartAttemptPeriod of 60 seconds and a maximum restartAttemptPeriod of 1800 seconds."
+  )
+}).describe("The restart policy for the container. This parameter maps to the --restart option to docker run.");
+var EnvironmentSchema2 = z23.record(z23.string(), z23.string()).optional().describe("Environment variable key-value pairs.");
+var ArchitectureSchema3 = z23.enum(["x86_64", "arm64"]).describe("The instruction set architecture that the function supports.");
+var ActionSchema2 = z23.string();
+var ActionsSchema2 = z23.union([ActionSchema2.transform((v) => [v]), ActionSchema2.array()]);
+var ArnSchema2 = z23.string().startsWith("arn:");
+var WildcardSchema2 = z23.literal("*");
+var ResourceSchema2 = z23.union([ArnSchema2, WildcardSchema2]);
+var ResourcesSchema2 = z23.union([ResourceSchema2.transform((v) => [v]), ResourceSchema2.array()]);
+var PermissionSchema2 = z23.object({
+  effect: z23.enum(["allow", "deny"]).default("allow"),
+  actions: ActionsSchema2,
+  resources: ResourcesSchema2
+});
+var PermissionsSchema2 = z23.union([PermissionSchema2.transform((v) => [v]), PermissionSchema2.array()]).describe("Add IAM permissions to your function.");
+var MinifySchema2 = z23.boolean().describe("Minify the function code.");
+var DescriptionSchema2 = z23.string().describe("A description of the function.");
+var ImageSchema = z23.string().optional().describe("The URL of the container image to use.");
+var validLogRetentionDays2 = [
+  ...[1, 3, 5, 7, 14, 30, 60, 90, 120, 150],
+  ...[180, 365, 400, 545, 731, 1096, 1827, 2192],
+  ...[2557, 2922, 3288, 3653]
+];
+var LogRetentionSchema2 = DurationSchema.refine(
+  durationMin(days3(0)),
+  "Minimum log retention is 0 day, which will disable logging."
+).refine(
+  (duration) => {
+    return validLogRetentionDays2.includes(toDays2(duration));
+  },
+  `Invalid log retention. Valid days are: ${validLogRetentionDays2.map((days9) => `${days9}`).join(", ")}`
+).describe("The log retention duration.");
+var LogSchema2 = z23.union([
+  z23.boolean().transform((enabled) => ({ retention: enabled ? days3(7) : days3(0) })),
+  LogRetentionSchema2.transform((retention) => ({ retention })),
+  z23.object({
+    retention: LogRetentionSchema2.optional()
+  })
+]).describe("Enable logging to a CloudWatch log group. Providing a duration value will set the log retention time.");
+var FileCodeSchema2 = z23.object({
+  file: LocalFileSchema.describe("The file path of the function code."),
+  minify: MinifySchema2.optional().default(true)
+});
+var CodeSchema2 = z23.union([
+  LocalFileSchema.transform((file) => ({
+    file
+  })).pipe(FileCodeSchema2),
+  FileCodeSchema2
+]).describe("Specify the code of your instance.");
+var ISchema = z23.object({
+  code: CodeSchema2,
+  description: DescriptionSchema2.optional(),
+  image: ImageSchema.optional(),
+  log: LogSchema2.optional(),
+  memorySize: MemorySizeSchema2.optional(),
+  cpuSize: CpuSizeSchema.optional(),
+  architecture: ArchitectureSchema3.optional(),
+  environment: EnvironmentSchema2.optional(),
+  permissions: PermissionsSchema2.optional(),
+  healthCheck: HealthCheckSchema.optional(),
+  restartPolicy: RestartPolicySchema.optional()
+});
+var InstanceSchema = z23.union([
+  LocalFileSchema.transform((code) => ({
+    code
+  })).pipe(ISchema),
+  ISchema
+]);
+var InstancesSchema = z23.record(ResourceIdSchema, InstanceSchema).optional().describe("Define the instances in your stack.");
+var InstanceDefaultSchema = z23.object({
+  image: ImageSchema.default("public.ecr.aws/aws-cli/aws-cli:amd64"),
+  memorySize: MemorySizeSchema2.default(512),
+  cpuSize: CpuSizeSchema.default("0.25 vCPU"),
+  architecture: ArchitectureSchema3.default("arm64"),
+  environment: EnvironmentSchema2.optional(),
+  permissions: PermissionsSchema2.optional(),
+  healthCheck: HealthCheckSchema.optional(),
+  restartPolicy: RestartPolicySchema.default({ enabled: true }),
+  log: LogSchema2.default(true).transform((log25) => ({
+    retention: log25.retention ?? days3(7)
+  }))
+}).default({});
+
+// src/config/schema/region.ts
+import { z as z24 } from "zod";
 var US = ["us-east-2", "us-east-1", "us-west-1", "us-west-2"];
 var AF = ["af-south-1"];
 var AP = [
@@ -1175,16 +1326,16 @@ var EU = [
 var ME = ["me-south-1", "me-central-1"];
 var SA = ["sa-east-1"];
 var regions = [...US, ...AF, ...AP, ...CA, ...EU, ...ME, ...SA];
-var RegionSchema = z23.enum(regions);
+var RegionSchema = z24.enum(regions);
 
 // src/config/app.ts
-var AppSchema = z24.object({
-  $schema: z24.string().optional(),
+var AppSchema = z25.object({
+  $schema: z25.string().optional(),
   name: ResourceIdSchema.describe("App name."),
   region: RegionSchema.describe("The AWS region to deploy to."),
-  profile: z24.string().describe("The AWS profile to deploy to."),
-  protect: z24.boolean().default(false).describe("Protect your app & stacks from being deleted."),
-  removal: z24.enum(["remove", "retain"]).default("remove").describe(
+  profile: z25.string().describe("The AWS profile to deploy to."),
+  protect: z25.boolean().default(false).describe("Protect your app & stacks from being deleted."),
+  removal: z25.enum(["remove", "retain"]).default("remove").describe(
     [
       "Configure how your resources are handled when they have to be removed.",
       "",
@@ -1198,13 +1349,13 @@ var AppSchema = z24.object({
   // 	.default('prod')
   // 	.describe('The deployment stage.'),
   // onFailure: OnFailureSchema,
-  defaults: z24.object({
+  defaults: z25.object({
     onFailure: OnFailureDefaultSchema,
     onLog: OnLogDefaultSchema,
     auth: AuthDefaultSchema,
     domains: DomainsDefaultSchema,
     function: FunctionDefaultSchema,
-    // instance: InstanceDefaultSchema,
+    instance: InstanceDefaultSchema,
     queue: QueueDefaultSchema,
     // graphql: GraphQLDefaultSchema,
     // http: HttpDefaultSchema,
@@ -1220,11 +1371,11 @@ var AppSchema = z24.object({
 });
 
 // src/config/stack.ts
-import { z as z40 } from "zod";
+import { z as z41 } from "zod";
 
 // src/feature/cache/schema.ts
 import { gibibytes as gibibytes2 } from "@awsless/size";
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 var StorageSchema = SizeSchema.refine(sizeMin(gibibytes2(1)), "Minimum storage size is 1 GB").refine(
   sizeMax(gibibytes2(5e3)),
   "Maximum storage size is 5000 GB"
@@ -1235,31 +1386,31 @@ var MinimumStorageSchema = StorageSchema.describe(
 var MaximumStorageSchema = StorageSchema.describe(
   "The upper limit for data storage the cache is set to use. You can specify a size value from 1 GB to 5000 GB."
 );
-var EcpuSchema = z25.number().int().min(1e3).max(15e6);
+var EcpuSchema = z26.number().int().min(1e3).max(15e6);
 var MinimumEcpuSchema = EcpuSchema.describe(
   "The minimum number of ECPUs the cache can consume per second. You can specify a integer from 1,000 to 15,000,000."
 );
 var MaximumEcpuSchema = EcpuSchema.describe(
   "The maximum number of ECPUs the cache can consume per second. You can specify a integer from 1,000 to 15,000,000."
 );
-var CachesSchema = z25.record(
+var CachesSchema = z26.record(
   ResourceIdSchema,
-  z25.object({
+  z26.object({
     minStorage: MinimumStorageSchema.optional(),
     maxStorage: MaximumStorageSchema.optional(),
     minECPU: MinimumEcpuSchema.optional(),
     maxECPU: MaximumEcpuSchema.optional(),
-    snapshotRetentionLimit: z25.number().int().positive().default(1)
+    snapshotRetentionLimit: z26.number().int().positive().default(1)
   })
 ).optional().describe("Define the caches in your stack. For access to the cache put your functions inside the global VPC.");
 
 // src/feature/command/schema.ts
-import { z as z26 } from "zod";
-var CommandSchema = z26.union([
-  z26.object({
+import { z as z27 } from "zod";
+var CommandSchema = z27.union([
+  z27.object({
     file: LocalFileSchema,
-    handler: z26.string().default("default").describe("The name of the handler that needs to run"),
-    description: z26.string().optional().describe("A description of the command")
+    handler: z27.string().default("default").describe("The name of the handler that needs to run"),
+    description: z27.string().optional().describe("A description of the command")
     // options: z.record(ResourceIdSchema, OptionSchema).optional(),
     // arguments: z.record(ResourceIdSchema, ArgumentSchema).optional(),
   }),
@@ -1269,22 +1420,22 @@ var CommandSchema = z26.union([
     description: void 0
   }))
 ]);
-var CommandsSchema = z26.record(ResourceIdSchema, CommandSchema).optional().describe("Define the custom commands for your stack.");
+var CommandsSchema = z27.record(ResourceIdSchema, CommandSchema).optional().describe("Define the custom commands for your stack.");
 
 // src/feature/config/schema.ts
-import { z as z27 } from "zod";
-var ConfigNameSchema = z27.string().regex(/[a-z0-9\-]/g, "Invalid config name");
-var ConfigsSchema = z27.array(ConfigNameSchema).optional().describe("Define the config values for your stack.");
+import { z as z28 } from "zod";
+var ConfigNameSchema = z28.string().regex(/[a-z0-9\-]/g, "Invalid config name");
+var ConfigsSchema = z28.array(ConfigNameSchema).optional().describe("Define the config values for your stack.");
 
 // src/feature/cron/schema/index.ts
-import { z as z29 } from "zod";
+import { z as z30 } from "zod";
 
 // src/feature/cron/schema/schedule.ts
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 import { awsCronExpressionValidator } from "aws-cron-expression-validator";
-var RateExpressionSchema = z28.custom(
+var RateExpressionSchema = z29.custom(
   (value) => {
-    return z28.string().regex(/^[0-9]+ (seconds?|minutes?|hours?|days?)$/).refine((rate) => {
+    return z29.string().regex(/^[0-9]+ (seconds?|minutes?|hours?|days?)$/).refine((rate) => {
       const [str] = rate.split(" ");
       const number = parseInt(str);
       return number > 0;
@@ -1300,9 +1451,9 @@ var RateExpressionSchema = z28.custom(
   }
   return `rate(${rate})`;
 });
-var CronExpressionSchema = z28.custom(
+var CronExpressionSchema = z29.custom(
   (value) => {
-    return z28.string().safeParse(value).success;
+    return z29.string().safeParse(value).success;
   },
   { message: "Invalid cron expression" }
 ).superRefine((value, ctx) => {
@@ -1311,12 +1462,12 @@ var CronExpressionSchema = z28.custom(
   } catch (error) {
     if (error instanceof Error) {
       ctx.addIssue({
-        code: z28.ZodIssueCode.custom,
+        code: z29.ZodIssueCode.custom,
         message: `Invalid cron expression: ${error.message}`
       });
     } else {
       ctx.addIssue({
-        code: z28.ZodIssueCode.custom,
+        code: z29.ZodIssueCode.custom,
         message: "Invalid cron expression"
       });
     }
@@ -1327,28 +1478,28 @@ var CronExpressionSchema = z28.custom(
 var ScheduleExpressionSchema = RateExpressionSchema.or(CronExpressionSchema);
 
 // src/feature/cron/schema/index.ts
-var CronsSchema = z29.record(
+var CronsSchema = z30.record(
   ResourceIdSchema,
-  z29.object({
-    enabled: z29.boolean().default(true).describe("If the cron is enabled."),
+  z30.object({
+    enabled: z30.boolean().default(true).describe("If the cron is enabled."),
     consumer: FunctionSchema.describe("The consuming lambda function properties."),
     schedule: ScheduleExpressionSchema.describe(
       'The scheduling expression.\n\nexample: "0 20 * * ? *"\nexample: "5 minutes"'
     ),
-    payload: z29.unknown().optional().describe("The JSON payload that will be passed to the consumer.")
+    payload: z30.unknown().optional().describe("The JSON payload that will be passed to the consumer.")
   })
 ).optional().describe(`Define the cron jobs in your stack.`);
 
 // src/feature/search/schema.ts
 import { gibibytes as gibibytes3 } from "@awsless/size";
-import { z as z30 } from "zod";
-var VersionSchema = z30.union([
+import { z as z31 } from "zod";
+var VersionSchema = z31.union([
   //
-  z30.enum(["2.13", "2.11", "2.9", "2.7", "2.5", "2.3", "1.3"]),
-  z30.string()
+  z31.enum(["2.13", "2.11", "2.9", "2.7", "2.5", "2.3", "1.3"]),
+  z31.string()
 ]).describe("Specify the OpenSearch engine version.");
-var TypeSchema = z30.union([
-  z30.enum([
+var TypeSchema = z31.union([
+  z31.enum([
     "t3.small",
     "t3.medium",
     "m3.medium",
@@ -1422,13 +1573,13 @@ var TypeSchema = z30.union([
     "r6gd.12xlarge",
     "r6gd.16xlarge"
   ]),
-  z30.string()
+  z31.string()
 ]).describe("Instance type of data nodes in the cluster.");
-var CountSchema = z30.number().int().min(1).describe("Number of instances in the cluster.");
+var CountSchema = z31.number().int().min(1).describe("Number of instances in the cluster.");
 var StorageSizeSchema = SizeSchema.refine(sizeMin(gibibytes3(10)), "Minimum storage size is 10 GB").refine(sizeMax(gibibytes3(100)), "Maximum storage size is 100 GB").describe("The size of the function's /tmp directory. You can specify a size value from 512 MB to 10 GiB.");
-var SearchsSchema = z30.record(
+var SearchsSchema = z31.record(
   ResourceIdSchema,
-  z30.object({
+  z31.object({
     type: TypeSchema.default("t3.small"),
     count: CountSchema.default(1),
     version: VersionSchema.default("2.13"),
@@ -1439,12 +1590,12 @@ var SearchsSchema = z30.record(
 ).optional().describe("Define the search instances in your stack. Backed by OpenSearch.");
 
 // src/feature/site/schema.ts
-import { z as z32 } from "zod";
+import { z as z33 } from "zod";
 
 // src/config/schema/local-entry.ts
 import { stat as stat3 } from "fs/promises";
-import { z as z31 } from "zod";
-var LocalEntrySchema = z31.union([
+import { z as z32 } from "zod";
+var LocalEntrySchema = z32.union([
   RelativePathSchema.refine(async (path) => {
     try {
       const s = await stat3(path);
@@ -1453,7 +1604,7 @@ var LocalEntrySchema = z31.union([
       return false;
     }
   }, `File or directory doesn't exist`),
-  z31.object({
+  z32.object({
     nocheck: RelativePathSchema.describe(
       "Specifies a local file or directory without checking if the file or directory exists."
     )
@@ -1461,14 +1612,14 @@ var LocalEntrySchema = z31.union([
 ]);
 
 // src/feature/site/schema.ts
-var ErrorResponsePathSchema = z32.string().describe(
+var ErrorResponsePathSchema = z33.string().describe(
   [
     "The path to the custom error page that you want to return to the viewer when your origin returns the HTTP status code specified.",
     "- We recommend that you store custom error pages in an Amazon S3 bucket.",
     "If you store custom error pages on an HTTP server and the server starts to return 5xx errors, CloudFront can't get the files that you want to return to viewers because the origin server is unavailable."
   ].join("\n")
 );
-var StatusCodeSchema = z32.number().int().positive().optional().describe(
+var StatusCodeSchema = z33.number().int().positive().optional().describe(
   [
     "The HTTP status code that you want CloudFront to return to the viewer along with the custom error page.",
     "There are a variety of reasons that you might want CloudFront to return a status code different from the status code that your origin returned to CloudFront, for example:",
@@ -1481,19 +1632,19 @@ var StatusCodeSchema = z32.number().int().positive().optional().describe(
 var MinTTLSchema = DurationSchema.describe(
   "The minimum amount of time, that you want to cache the error response. When this time period has elapsed, CloudFront queries your origin to see whether the problem that caused the error has been resolved and the requested object is now available."
 );
-var ErrorResponseSchema = z32.union([
+var ErrorResponseSchema = z33.union([
   ErrorResponsePathSchema,
-  z32.object({
+  z33.object({
     path: ErrorResponsePathSchema,
     statusCode: StatusCodeSchema.optional(),
     minTTL: MinTTLSchema.optional()
   })
 ]).optional();
-var SitesSchema = z32.record(
+var SitesSchema = z33.record(
   ResourceIdSchema,
-  z32.object({
+  z33.object({
     domain: ResourceIdSchema.describe("The domain id to link your site with.").optional(),
-    subDomain: z32.string().optional(),
+    subDomain: z33.string().optional(),
     // bind: z
     // 	.object({
     // 		auth: z.array(ResourceIdSchema),
@@ -1502,16 +1653,16 @@ var SitesSchema = z32.record(
     // 		// rest: z.array(ResourceIdSchema),
     // 	})
     // 	.optional(),
-    build: z32.object({
-      command: z32.string().describe(
+    build: z33.object({
+      command: z33.string().describe(
         `Specifies the files and directories to generate the cache key for your custom build command.`
       ),
-      cacheKey: z32.union([LocalEntrySchema.transform((v) => [v]), LocalEntrySchema.array()]).describe(
+      cacheKey: z33.union([LocalEntrySchema.transform((v) => [v]), LocalEntrySchema.array()]).describe(
         `Specifies the files and directories to generate the cache key for your custom build command.`
       ),
-      configs: z32.string().array().describe("Define the config values for your build command.")
+      configs: z33.string().array().describe("Define the config values for your build command.")
     }).optional().describe(`Specifies the build process for sites that need a build step.`),
-    static: z32.union([LocalDirectorySchema, z32.boolean()]).optional().describe(
+    static: z33.union([LocalDirectorySchema, z33.boolean()]).optional().describe(
       "Specifies the path to the static files directory. Additionally you can also pass `true` when you don't have local static files, but still want to make an S3 bucket."
     ),
     ssr: FunctionSchema.optional().describe("Specifies the file that will render the site on the server."),
@@ -1532,7 +1683,7 @@ var SitesSchema = z32.record(
     // 		build: z.string().optional(),
     // 	}),
     // ]),
-    geoRestrictions: z32.array(z32.string().length(2).toUpperCase()).default([]).describe("Specifies a blacklist of countries that should be blocked."),
+    geoRestrictions: z33.array(z33.string().length(2).toUpperCase()).default([]).describe("Specifies a blacklist of countries that should be blocked."),
     // forwardHost: z
     // 	.boolean()
     // 	.default(false)
@@ -1543,7 +1694,7 @@ var SitesSchema = z32.record(
     // 			'Keep in mind that this requires an extra CloudFront Function.',
     // 		].join('\n')
     // 	),
-    errors: z32.object({
+    errors: z33.object({
       400: ErrorResponseSchema.describe("Customize a `400 Bad Request` response."),
       403: ErrorResponseSchema.describe("Customize a `403 Forbidden` response."),
       404: ErrorResponseSchema.describe("Customize a `404 Not Found` response."),
@@ -1556,20 +1707,20 @@ var SitesSchema = z32.record(
       503: ErrorResponseSchema.describe("Customize a `503 Service Unavailable` response."),
       504: ErrorResponseSchema.describe("Customize a `504 Gateway Timeout` response.")
     }).optional().describe("Customize the error responses for specific HTTP status codes."),
-    cors: z32.object({
-      override: z32.boolean().default(false),
+    cors: z33.object({
+      override: z33.boolean().default(false),
       maxAge: DurationSchema.default("365 days"),
-      exposeHeaders: z32.string().array().optional(),
-      credentials: z32.boolean().default(false),
-      headers: z32.string().array().default(["*"]),
-      origins: z32.string().array().default(["*"]),
-      methods: z32.enum(["GET", "DELETE", "HEAD", "OPTIONS", "PATCH", "POST", "PUT", "ALL"]).array().default(["ALL"])
+      exposeHeaders: z33.string().array().optional(),
+      credentials: z33.boolean().default(false),
+      headers: z33.string().array().default(["*"]),
+      origins: z33.string().array().default(["*"]),
+      methods: z33.enum(["GET", "DELETE", "HEAD", "OPTIONS", "PATCH", "POST", "PUT", "ALL"]).array().default(["ALL"])
     }).optional().describe("Specify the cors headers."),
-    auth: z32.object({
-      username: z32.string().describe("Basic auth username"),
-      password: z32.string().describe("Basic auth password")
+    auth: z33.object({
+      username: z33.string().describe("Basic auth username"),
+      password: z33.string().describe("Basic auth password")
     }).optional().describe("Enable basic authentication for the site"),
-    security: z32.object({
+    security: z33.object({
       // contentSecurityPolicy: z.object({
       // 	override: z.boolean().default(false),
       // 	policy: z.string(),
@@ -1611,10 +1762,10 @@ var SitesSchema = z32.record(
       // 	reportUri?: string
       // }
     }).optional().describe("Specify the security policy."),
-    cache: z32.object({
-      cookies: z32.string().array().optional().describe("Specifies the cookies that CloudFront includes in the cache key."),
-      headers: z32.string().array().optional().describe("Specifies the headers that CloudFront includes in the cache key."),
-      queries: z32.string().array().optional().describe("Specifies the query values that CloudFront includes in the cache key.")
+    cache: z33.object({
+      cookies: z33.string().array().optional().describe("Specifies the cookies that CloudFront includes in the cache key."),
+      headers: z33.string().array().optional().describe("Specifies the headers that CloudFront includes in the cache key."),
+      queries: z33.string().array().optional().describe("Specifies the query values that CloudFront includes in the cache key.")
     }).optional().describe(
       "Specifies the cookies, headers, and query values that CloudFront includes in the cache key."
     )
@@ -1622,22 +1773,22 @@ var SitesSchema = z32.record(
 ).optional().describe("Define the sites in your stack.");
 
 // src/feature/store/schema.ts
-import { z as z33 } from "zod";
-var StoresSchema = z33.union([
-  z33.array(ResourceIdSchema).transform((list3) => {
+import { z as z34 } from "zod";
+var StoresSchema = z34.union([
+  z34.array(ResourceIdSchema).transform((list3) => {
     const stores = {};
     for (const key of list3) {
       stores[key] = {};
     }
     return stores;
   }),
-  z33.record(
+  z34.record(
     ResourceIdSchema,
-    z33.object({
+    z34.object({
       // cors: CorsSchema,
       // deletionProtection: DeletionProtectionSchema.optional(),
-      versioning: z33.boolean().default(false).describe("Enable versioning of your store."),
-      events: z33.object({
+      versioning: z34.boolean().default(false).describe("Enable versioning of your store."),
+      events: z34.object({
         // create
         "created:*": FunctionSchema.optional().describe(
           "Subscribe to notifications regardless of the API that was used to create an object."
@@ -1670,58 +1821,58 @@ var StoresSchema = z33.union([
 ]).optional().describe("Define the stores in your stack.");
 
 // src/feature/icon/schema.ts
-import { z as z34 } from "zod";
+import { z as z35 } from "zod";
 var staticOriginSchema = LocalDirectorySchema.describe(
   "Specifies the path to a local image directory that will be uploaded in S3."
 );
 var functionOriginSchema = FunctionSchema.describe(
   "Specifies the file that will be called when an image isn't found in the (cache) bucket."
 );
-var IconsSchema = z34.record(
+var IconsSchema = z35.record(
   ResourceIdSchema,
-  z34.object({
+  z35.object({
     domain: ResourceIdSchema.describe("The domain id to link your site with.").optional(),
-    subDomain: z34.string().optional(),
+    subDomain: z35.string().optional(),
     log: LogSchema.optional(),
     cacheDuration: DurationSchema.optional().describe("The cache duration of the cached icons."),
-    preserveId: z34.boolean().optional().default(false).describe("Preserve the IDs of the icons."),
-    symbols: z34.boolean().optional().default(false).describe("Use SVG symbols for icons."),
-    origin: z34.union([
-      z34.object({
+    preserveId: z35.boolean().optional().default(false).describe("Preserve the IDs of the icons."),
+    symbols: z35.boolean().optional().default(false).describe("Use SVG symbols for icons."),
+    origin: z35.union([
+      z35.object({
         static: staticOriginSchema,
         function: functionOriginSchema.optional()
       }),
-      z34.object({
+      z35.object({
         static: staticOriginSchema.optional(),
         function: functionOriginSchema
       }),
-      z34.object({
+      z35.object({
         static: staticOriginSchema,
         function: functionOriginSchema
       })
     ]).describe(
       "Image transformation will be applied from a base image. Base images orginates from a local directory that will be uploaded to S3 or from a lambda function."
     ),
-    cors: z34.object({
-      override: z34.boolean().default(true),
+    cors: z35.object({
+      override: z35.boolean().default(true),
       maxAge: DurationSchema.default("365 days"),
-      exposeHeaders: z34.string().array().optional(),
-      credentials: z34.boolean().default(false),
-      headers: z34.string().array().default(["*"]),
-      origins: z34.string().array().default(["*"])
+      exposeHeaders: z35.string().array().optional(),
+      credentials: z35.boolean().default(false),
+      headers: z35.string().array().default(["*"]),
+      origins: z35.string().array().default(["*"])
     }).optional().describe("Specify the cors headers.")
     // version: z.number().int().min(1).optional().describe('Version of the icon configuration.'),
   })
 ).optional().describe("Define an icon proxy in your stack. Store, optimize, and deliver icons at scale.");
 
 // src/feature/image/schema.ts
-import { z as z35 } from "zod";
-var transformationOptionsSchema = z35.object({
-  width: z35.number().int().positive().optional(),
-  height: z35.number().int().positive().optional(),
-  fit: z35.enum(["cover", "contain", "fill", "inside", "outside"]).optional(),
-  position: z35.enum(["top", "right top", "right", "right bottom", "bottom", "left bottom", "left", "left top", "center"]).optional(),
-  quality: z35.number().int().min(1).max(100).optional()
+import { z as z36 } from "zod";
+var transformationOptionsSchema = z36.object({
+  width: z36.number().int().positive().optional(),
+  height: z36.number().int().positive().optional(),
+  fit: z36.enum(["cover", "contain", "fill", "inside", "outside"]).optional(),
+  position: z36.enum(["top", "right top", "right", "right bottom", "bottom", "left bottom", "left", "left top", "center"]).optional(),
+  quality: z36.number().int().min(1).max(100).optional()
 });
 var staticOriginSchema2 = LocalDirectorySchema.describe(
   "Specifies the path to a local image directory that will be uploaded in S3."
@@ -1729,68 +1880,68 @@ var staticOriginSchema2 = LocalDirectorySchema.describe(
 var functionOriginSchema2 = FunctionSchema.describe(
   "Specifies the file that will be called when an image isn't found in the (cache) bucket."
 );
-var ImagesSchema = z35.record(
+var ImagesSchema = z36.record(
   ResourceIdSchema,
-  z35.object({
+  z36.object({
     domain: ResourceIdSchema.describe("The domain id to link your site with.").optional(),
-    subDomain: z35.string().optional(),
+    subDomain: z36.string().optional(),
     log: LogSchema.optional(),
     cacheDuration: DurationSchema.optional().describe("Cache duration of the cached images."),
-    presets: z35.record(z35.string(), transformationOptionsSchema).describe("Named presets for image transformations"),
-    extensions: z35.object({
-      jpeg: z35.object({
-        mozjpeg: z35.boolean().optional(),
-        progressive: z35.boolean().optional()
+    presets: z36.record(z36.string(), transformationOptionsSchema).describe("Named presets for image transformations"),
+    extensions: z36.object({
+      jpeg: z36.object({
+        mozjpeg: z36.boolean().optional(),
+        progressive: z36.boolean().optional()
       }).optional(),
-      webp: z35.object({
-        effort: z35.number().int().min(1).max(10).default(7).optional(),
-        lossless: z35.boolean().optional(),
-        nearLossless: z35.boolean().optional()
+      webp: z36.object({
+        effort: z36.number().int().min(1).max(10).default(7).optional(),
+        lossless: z36.boolean().optional(),
+        nearLossless: z36.boolean().optional()
       }).optional(),
-      png: z35.object({
-        compressionLevel: z35.number().int().min(0).max(9).default(6).optional()
+      png: z36.object({
+        compressionLevel: z36.number().int().min(0).max(9).default(6).optional()
       }).optional()
     }).refine((data) => {
       return Object.keys(data).length > 0;
     }, "At least one extension must be defined.").describe("Specify the allowed extensions."),
-    origin: z35.union([
-      z35.object({
+    origin: z36.union([
+      z36.object({
         static: staticOriginSchema2,
         function: functionOriginSchema2.optional()
       }),
-      z35.object({
+      z36.object({
         static: staticOriginSchema2.optional(),
         function: functionOriginSchema2
       }),
-      z35.object({
+      z36.object({
         static: staticOriginSchema2,
         function: functionOriginSchema2
       })
     ]).describe(
       "Specify the origin of your images. Image transformation will be applied from a base image. Base images can be loaded from a S3 bucket (that is synced from a local directory) or dynamicly from a lambda function."
     ),
-    version: z35.number().int().min(1).optional().describe("Version of the image configuration.")
+    version: z36.number().int().min(1).optional().describe("Version of the image configuration.")
   })
 ).optional().describe("Define an image proxy in your stack. Store, transform, optimize, and deliver images at scale.");
 
 // src/feature/table/schema.ts
 import { minutes as minutes4, seconds as seconds4 } from "@awsless/duration";
-import { z as z36 } from "zod";
-var KeySchema = z36.string().min(1).max(255);
-var TablesSchema = z36.record(
+import { z as z37 } from "zod";
+var KeySchema = z37.string().min(1).max(255);
+var TablesSchema = z37.record(
   ResourceIdSchema,
-  z36.object({
+  z37.object({
     hash: KeySchema.describe(
       "Specifies the name of the partition / hash key that makes up the primary key for the table."
     ),
     sort: KeySchema.optional().describe(
       "Specifies the name of the range / sort key that makes up the primary key for the table."
     ),
-    fields: z36.record(z36.string(), z36.enum(["string", "number", "binary"])).optional().describe(
+    fields: z37.record(z37.string(), z37.enum(["string", "number", "binary"])).optional().describe(
       'A list of attributes that describe the key schema for the table and indexes. If no attribute field is defined we default to "string".'
     ),
-    class: z36.enum(["standard", "standard-infrequent-access"]).default("standard").describe("The table class of the table."),
-    pointInTimeRecovery: z36.boolean().default(false).describe("Indicates whether point in time recovery is enabled on the table."),
+    class: z37.enum(["standard", "standard-infrequent-access"]).default("standard").describe("The table class of the table."),
+    pointInTimeRecovery: z37.boolean().default(false).describe("Indicates whether point in time recovery is enabled on the table."),
     ttl: KeySchema.optional().describe(
       [
         "The name of the TTL attribute used to store the expiration time for items in the table.",
@@ -1798,8 +1949,8 @@ var TablesSchema = z36.record(
       ].join("\n")
     ),
     // deletionProtection: DeletionProtectionSchema.optional(),
-    stream: z36.object({
-      type: z36.enum(["keys-only", "new-image", "old-image", "new-and-old-images"]).describe(
+    stream: z37.object({
+      type: z37.enum(["keys-only", "new-image", "old-image", "new-and-old-images"]).describe(
         [
           "When an item in the table is modified, you can determines what information is written to the stream for this table.",
           "Valid values are:",
@@ -1809,7 +1960,7 @@ var TablesSchema = z36.record(
           "- new-and-old-images - Both the new and the old item images of the item are written to the stream."
         ].join("\n")
       ),
-      batchSize: z36.number().min(1).max(1e4).default(1).describe(
+      batchSize: z37.number().min(1).max(1e4).default(1).describe(
         [
           "The maximum number of records in each batch that Lambda pulls from your stream and sends to your function.",
           "Lambda passes all of the records in the batch to the function in a single call, up to the payload limit for synchronous invocation (6 MB).",
@@ -1839,7 +1990,7 @@ var TablesSchema = z36.record(
       // 			'You can specify a number from -1 to 10000.',
       // 		].join('\n')
       // 	),
-      retryAttempts: z36.number().min(-1).max(1e4).default(-1).describe(
+      retryAttempts: z37.number().min(-1).max(1e4).default(-1).describe(
         [
           "Discard records after the specified number of retries.",
           "The default value is -1, which sets the maximum number of retries to infinite.",
@@ -1847,7 +1998,7 @@ var TablesSchema = z36.record(
           "You can specify a number from -1 to 10000."
         ].join("\n")
       ),
-      concurrencyPerShard: z36.number().min(1).max(10).default(1).describe(
+      concurrencyPerShard: z37.number().min(1).max(10).default(1).describe(
         [
           "The number of batches to process concurrently from each shard.",
           "You can specify a number from 1 to 10."
@@ -1857,16 +2008,16 @@ var TablesSchema = z36.record(
     }).optional().describe(
       "The settings for the DynamoDB table stream, which capture changes to items stored in the table."
     ),
-    indexes: z36.record(
-      z36.string(),
-      z36.object({
+    indexes: z37.record(
+      z37.string(),
+      z37.object({
         hash: KeySchema.describe(
           "Specifies the name of the partition / hash key that makes up the primary key for the global secondary index."
         ),
         sort: KeySchema.optional().describe(
           "Specifies the name of the range / sort key that makes up the primary key for the global secondary index."
         ),
-        projection: z36.enum(["all", "keys-only"]).default("all").describe(
+        projection: z37.enum(["all", "keys-only"]).default("all").describe(
           [
             "The set of attributes that are projected into the index:",
             "- all - All of the table attributes are projected into the index.",
@@ -1880,11 +2031,11 @@ var TablesSchema = z36.record(
 ).optional().describe("Define the tables in your stack.");
 
 // src/feature/task/schema.ts
-import { z as z37 } from "zod";
-var RetryAttemptsSchema2 = z37.number().int().min(0).max(2).describe(
+import { z as z38 } from "zod";
+var RetryAttemptsSchema2 = z38.number().int().min(0).max(2).describe(
   "The maximum number of times to retry when the function returns an error. You can specify a number from 0 to 2."
 );
-var TaskSchema = z37.union([
+var TaskSchema = z38.union([
   LocalFileSchema.transform((file) => ({
     consumer: {
       code: {
@@ -1895,33 +2046,33 @@ var TaskSchema = z37.union([
     },
     retryAttempts: void 0
   })),
-  z37.object({
+  z38.object({
     consumer: FunctionSchema,
     retryAttempts: RetryAttemptsSchema2.optional()
   })
 ]);
-var TasksSchema = z37.record(ResourceIdSchema, TaskSchema).optional().describe("Define the tasks in your stack.");
+var TasksSchema = z38.record(ResourceIdSchema, TaskSchema).optional().describe("Define the tasks in your stack.");
 
 // src/feature/test/schema.ts
-import { z as z38 } from "zod";
-var TestsSchema = z38.union([LocalDirectorySchema.transform((v) => [v]), LocalDirectorySchema.array()]).describe("Define the location of your tests for your stack.").optional();
+import { z as z39 } from "zod";
+var TestsSchema = z39.union([LocalDirectorySchema.transform((v) => [v]), LocalDirectorySchema.array()]).describe("Define the location of your tests for your stack.").optional();
 
 // src/feature/topic/schema.ts
 import { kebabCase as kebabCase3 } from "change-case";
-import { z as z39 } from "zod";
-var TopicNameSchema = z39.string().min(3).max(256).regex(/^[a-z0-9\-]+$/i, "Invalid topic name").transform((value) => kebabCase3(value)).describe("Define event topic name.");
-var TopicsSchema = z39.array(TopicNameSchema).refine((topics) => {
+import { z as z40 } from "zod";
+var TopicNameSchema = z40.string().min(3).max(256).regex(/^[a-z0-9\-]+$/i, "Invalid topic name").transform((value) => kebabCase3(value)).describe("Define event topic name.");
+var TopicsSchema = z40.array(TopicNameSchema).refine((topics) => {
   return topics.length === new Set(topics).size;
 }, "Must be a list of unique topic names").optional().describe("Define the event topics to publish too in your stack.");
-var SubscribersSchema = z39.record(TopicNameSchema, FunctionSchema).optional().describe("Define the event topics to subscribe too in your stack.");
+var SubscribersSchema = z40.record(TopicNameSchema, FunctionSchema).optional().describe("Define the event topics to subscribe too in your stack.");
 
 // src/config/stack.ts
 var DependsSchema = ResourceIdSchema.array().optional().describe("Define the stacks that this stack is depended on.");
 var NameSchema = ResourceIdSchema.refine((name) => !["base", "hostedzones"].includes(name), {
   message: `Stack name can't be a reserved name.`
 }).describe("Stack name.");
-var StackSchema = z40.object({
-  $schema: z40.string().optional(),
+var StackSchema = z41.object({
+  $schema: z41.string().optional(),
   name: NameSchema,
   depends: DependsSchema,
   commands: CommandsSchema,
@@ -1937,7 +2088,7 @@ var StackSchema = z40.object({
   topics: TopicsSchema,
   subscribers: SubscribersSchema,
   functions: FunctionsSchema,
-  // instances: InstancesSchema,
+  instances: InstancesSchema,
   tasks: TasksSchema,
   tables: TablesSchema,
   stores: StoresSchema,
@@ -1990,13 +2141,13 @@ var readConfigWithStage = async (file, stage) => {
 };
 
 // src/config/load/validate.ts
-import { z as z41 } from "zod";
+import { z as z42 } from "zod";
 var validateConfig = async (schema, file, data) => {
   try {
     const result = await schema.parseAsync(data);
     return result;
   } catch (error) {
-    if (error instanceof z41.ZodError) {
+    if (error instanceof z42.ZodError) {
       throw new ConfigError(file, error, data);
     }
     throw error;
@@ -2186,7 +2337,7 @@ var generateGlobalAppId = (opt) => {
 };
 
 // src/feature/auth/index.ts
-import { toDays as toDays2, toHours } from "@awsless/duration";
+import { toDays as toDays3, toHours } from "@awsless/duration";
 var authFeature = defineFeature({
   name: "auth",
   async onTypeGen(ctx) {
@@ -2320,9 +2471,9 @@ var authFeature = defineFeature({
             requireUppercase: props.password.uppercase,
             requireNumbers: props.password.numbers,
             requireSymbols: props.password.symbols,
-            temporaryPasswordValidityDays: toDays2(props.password.temporaryPasswordValidity)
+            temporaryPasswordValidityDays: toDays3(props.password.temporaryPasswordValidity)
           },
-          deletionProtection: "ACTIVE"
+          deletionProtection: ctx.appConfig.protect ? "ACTIVE" : "INACTIVE"
         },
         {
           retainOnDelete: ctx.appConfig.removal === "retain",
@@ -2334,7 +2485,7 @@ var authFeature = defineFeature({
         name,
         idTokenValidity: toHours(props.validity.idToken),
         accessTokenValidity: toHours(props.validity.accessToken),
-        refreshTokenValidity: toDays2(props.validity.refreshToken),
+        refreshTokenValidity: toDays3(props.validity.refreshToken),
         tokenValidityUnits: [
           {
             idToken: "hours",
@@ -2858,7 +3009,7 @@ var zipFiles = (files) => {
 };
 
 // src/feature/function/util.ts
-import { toDays as toDays3, toSeconds } from "@awsless/duration";
+import { toDays as toDays4, toSeconds } from "@awsless/duration";
 import { toMebibytes } from "@awsless/size";
 import { pascalCase } from "change-case";
 
@@ -3199,7 +3350,7 @@ var createLambdaFunction = (parentGroup, ctx, ns, id, local) => {
     const logGroup = new $3.aws.cloudwatch.LogGroup(group, "log", {
       // name: lambda.functionName.pipe(name => `/aws/lambda/${name}`),
       name: `/aws/lambda/${name}`,
-      retentionInDays: toDays3(props.log.retention)
+      retentionInDays: toDays4(props.log.retention)
     });
     addPermission({
       actions: ["logs:PutLogEvents", "logs:CreateLogStream"],
@@ -3735,6 +3886,7 @@ var onFailureFeature = defineFeature({
         resourceName: "failure"
       })
     });
+    ctx.addEnv("ON_FAILURE_QUEUE_ARN", queue2.arn);
     ctx.shared.set("on-failure", "queue-arn", queue2.arn);
     const result = createLambdaFunction(group, ctx, "on-failure", "consumer", ctx.appConfig.defaults.onFailure);
     new $8.aws.lambda.EventSourceMapping(
@@ -4136,7 +4288,7 @@ import { dirname as dirname6, join as join10, relative as relative5 } from "path
 import { fileURLToPath } from "node:url";
 
 // src/feature/function/prebuild.ts
-import { days as days3, seconds as seconds6, toDays as toDays4, toSeconds as toSeconds4 } from "@awsless/duration";
+import { days as days4, seconds as seconds6, toDays as toDays5, toSeconds as toSeconds4 } from "@awsless/duration";
 import { $ as $12, Future as Future2, resolveInputs as resolveInputs2 } from "@awsless/formation";
 import { mebibytes as mebibytes2, toMebibytes as toMebibytes2 } from "@awsless/size";
 import { pascalCase as pascalCase2 } from "change-case";
@@ -4264,7 +4416,7 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, props) => {
   if (props.log?.retention && props.log?.retention?.value > 0n) {
     const logGroup = new $12.aws.cloudwatch.LogGroup(group, "log", {
       name: `/aws/lambda/${name}`,
-      retentionInDays: toDays4(props.log.retention ?? days3(7))
+      retentionInDays: toDays5(props.log.retention ?? days4(7))
     });
     addPermission({
       actions: ["logs:PutLogEvents", "logs:CreateLogStream"],
@@ -4319,7 +4471,7 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, props) => {
 };
 
 // src/feature/rpc/index.ts
-import { days as days4, seconds as seconds7, toSeconds as toSeconds5 } from "@awsless/duration";
+import { days as days5, seconds as seconds7, toSeconds as toSeconds5 } from "@awsless/duration";
 var __dirname = dirname6(fileURLToPath(import.meta.url));
 var rpcFeature = defineFeature({
   name: "rpc",
@@ -4494,8 +4646,8 @@ var rpcFeature = defineFeature({
       const cache = new $13.aws.cloudfront.CachePolicy(group, "cache", {
         name,
         minTtl: toSeconds5(seconds7(1)),
-        maxTtl: toSeconds5(days4(365)),
-        defaultTtl: toSeconds5(days4(1))
+        maxTtl: toSeconds5(days5(365)),
+        defaultTtl: toSeconds5(days5(1))
       });
       const originRequest = new $13.aws.cloudfront.OriginRequestPolicy(group, "request", {
         name,
@@ -4722,7 +4874,7 @@ var searchFeature = defineFeature({
 });
 
 // src/feature/site/index.ts
-import { days as days5, seconds as seconds8, toSeconds as toSeconds6 } from "@awsless/duration";
+import { days as days6, seconds as seconds8, toSeconds as toSeconds6 } from "@awsless/duration";
 import { $ as $15, Group as Group15 } from "@awsless/formation";
 import { glob as glob2 } from "glob";
 import { dirname as dirname7, join as join11 } from "path";
@@ -5047,8 +5199,8 @@ var siteFeature = defineFeature({
       const cache = new $15.aws.cloudfront.CachePolicy(group, "cache", {
         name,
         minTtl: toSeconds6(seconds8(1)),
-        maxTtl: toSeconds6(days5(365)),
-        defaultTtl: toSeconds6(days5(1)),
+        maxTtl: toSeconds6(days6(365)),
+        defaultTtl: toSeconds6(days6(1)),
         parametersInCacheKeyAndForwardedToOrigin: {
           cookiesConfig: {
             cookieBehavior: props.cache?.cookies ? "whitelist" : "none",
@@ -5089,7 +5241,7 @@ var siteFeature = defineFeature({
         name,
         corsConfig: {
           originOverride: props.cors?.override ?? false,
-          accessControlMaxAgeSec: toSeconds6(props.cors?.maxAge ?? days5(365)),
+          accessControlMaxAgeSec: toSeconds6(props.cors?.maxAge ?? days6(365)),
           accessControlAllowHeaders: { items: props.cors?.headers ?? ["*"] },
           accessControlAllowMethods: { items: props.cors?.methods ?? ["ALL"] },
           accessControlAllowOrigins: { items: props.cors?.origins ?? ["*"] },
@@ -5114,7 +5266,7 @@ var siteFeature = defineFeature({
           strictTransportSecurity: {
             override: false,
             preload: true,
-            accessControlMaxAgeSec: toSeconds6(days5(365)),
+            accessControlMaxAgeSec: toSeconds6(days6(365)),
             includeSubdomains: true
           },
           xssProtection: {
@@ -5594,6 +5746,7 @@ var tableFeature = defineFeature({
 import { Group as Group18 } from "@awsless/formation";
 import { camelCase as camelCase7 } from "change-case";
 import { relative as relative6 } from "path";
+import { $ as $18 } from "@awsless/formation";
 var typeGenCode6 = `
 import { InvokeOptions } from '@awsless/lambda'
 import type { Mock } from 'vitest'
@@ -5653,49 +5806,64 @@ var taskFeature = defineFeature({
     types2.addInterface("TaskMockResponse", mockResponses);
     await ctx.write("task.d.ts", types2, true);
   },
-  // onApp(ctx) {
-  // 	const group = new Group(ctx.base, 'task', 'main')
-  // 	const scheduleRole = new $.aws.iam.Role(group, 'schedule', {
-  // 		name: formatGlobalResourceName({
-  // 			appName: ctx.app.name,
-  // 			resourceType: 'task',
-  // 			resourceName: 'schedule',
-  // 		}),
-  // 		description: `Task schedule ${ctx.app.name}`,
-  // 		assumeRolePolicy: JSON.stringify({
-  // 			Version: '2012-10-17',
-  // 			Statement: [
-  // 				{
-  // 					Action: 'sts:AssumeRole',
-  // 					Effect: 'Allow',
-  // 					Principal: {
-  // 						Service: 'scheduler.amazonaws.com',
-  // 					},
-  // 				},
-  // 			],
-  // 		}),
-  // 		inlinePolicy: [
-  // 			{
-  // 				name: 'Invoke function',
-  // 				policy: JSON.stringify({
-  // 					Version: '2012-10-17',
-  // 					Statement: [
-  // 						{
-  // 							Action: ['lambda:InvokeFunction'],
-  // 							Effect: 'Allow',
-  // 							Resource: [`arn:aws:lambda:*:*:function:${ctx.appConfig.name}--*--task--*`],
-  // 						},
-  // 					],
-  // 				}),
-  // 			},
-  // 		],
-  // 	})
-  // 	ctx.addGlobalPermission({
-  // 		actions: ['schedule:CreateSchedule'],
-  // 		resources: [`arn:aws:schedule:*:*:schedule:${ctx.appConfig.name}--*`],
-  // 	})
-  // 	ctx.addEnv('TASK_SCHEDULE_ROLE', scheduleRole.arn)
-  // },
+  onApp(ctx) {
+    const group = new Group18(ctx.base, "task", "main");
+    const scheduleGroupName = formatGlobalResourceName({
+      appName: ctx.app.name,
+      resourceType: "task",
+      resourceName: "group"
+    });
+    new $18.aws.scheduler.ScheduleGroup(group, "group", {
+      name: scheduleGroupName,
+      tags: {
+        app: ctx.app.name
+      }
+    });
+    const role = new $18.aws.iam.Role(group, "schedule", {
+      name: formatGlobalResourceName({
+        appName: ctx.app.name,
+        resourceType: "task",
+        resourceName: "schedule"
+      }),
+      description: `Task schedule ${ctx.app.name}`,
+      assumeRolePolicy: JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Action: "sts:AssumeRole",
+            Effect: "Allow",
+            Principal: {
+              Service: "scheduler.amazonaws.com"
+            }
+          }
+        ]
+      }),
+      inlinePolicy: [
+        {
+          name: "InvokeFunction",
+          policy: JSON.stringify({
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Action: ["lambda:InvokeFunction"],
+                Effect: "Allow",
+                Resource: [`arn:aws:lambda:*:*:function:${ctx.appConfig.name}--*--task--*`]
+              }
+            ]
+          })
+        }
+      ]
+    });
+    ctx.addGlobalPermission({
+      actions: ["scheduler:CreateSchedule"],
+      // resources: [`arn:aws:scheduler:*:*:schedule:${ctx.appConfig.name}--*`],
+      resources: [`arn:aws:scheduler:*:*:schedule/${scheduleGroupName}/*`]
+    });
+    ctx.addGlobalPermission({
+      actions: ["iam:PassRole"],
+      resources: [role.arn]
+    });
+  },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.tasks ?? {})) {
       const group = new Group18(ctx.stack, "task", id);
@@ -5715,7 +5883,7 @@ var testFeature = defineFeature({
 });
 
 // src/feature/topic/index.ts
-import { $ as $18, Group as Group19 } from "@awsless/formation";
+import { $ as $19, Group as Group19 } from "@awsless/formation";
 var typeGenCode7 = `
 import type { PublishOptions } from '@awsless/sns'
 
@@ -5780,7 +5948,7 @@ var topicFeature = defineFeature({
           resourceType: "topic",
           resourceName: id
         });
-        const topic = new $18.aws.sns.Topic(group, "topic", {
+        const topic = new $19.aws.sns.Topic(group, "topic", {
           name
         });
         ctx.shared.add("topic", `arn`, id, topic.arn);
@@ -5808,12 +5976,12 @@ var topicFeature = defineFeature({
       const group = new Group19(ctx.stack, "topic", id);
       const topicArn = ctx.shared.entry("topic", "arn", id);
       const { lambda } = createAsyncLambdaFunction(group, ctx, `topic`, id, props);
-      new $18.aws.sns.TopicSubscription(group, id, {
+      new $19.aws.sns.TopicSubscription(group, id, {
         topicArn,
         protocol: "lambda",
         endpoint: lambda.arn
       });
-      new $18.aws.lambda.Permission(group, id, {
+      new $19.aws.lambda.Permission(group, id, {
         action: "lambda:InvokeFunction",
         principal: "sns.amazonaws.com",
         functionName: lambda.functionName,
@@ -5824,39 +5992,39 @@ var topicFeature = defineFeature({
 });
 
 // src/feature/vpc/index.ts
-import { $ as $19, Group as Group20 } from "@awsless/formation";
+import { $ as $20, Group as Group20 } from "@awsless/formation";
 var vpcFeature = defineFeature({
   name: "vpc",
   onApp(ctx) {
     const group = new Group20(ctx.base, "vpc", "main");
-    const vpc = new $19.aws.Vpc(group, "vpc", {
+    const vpc = new $20.aws.Vpc(group, "vpc", {
       tags: {
         Name: ctx.app.name
       },
       cidrBlock: "10.0.0.0/16"
     });
-    const privateRouteTable = new $19.aws.route.Table(group, "private", {
+    const privateRouteTable = new $20.aws.route.Table(group, "private", {
       vpcId: vpc.id,
       tags: {
         Name: "private"
       }
     });
-    const publicRouteTable = new $19.aws.route.Table(group, "public", {
+    const publicRouteTable = new $20.aws.route.Table(group, "public", {
       vpcId: vpc.id,
       tags: {
         Name: "public"
       }
     });
-    const gateway = new $19.aws.internet.Gateway(group, "gateway", {
+    const gateway = new $20.aws.internet.Gateway(group, "gateway", {
       tags: {
         Name: ctx.app.name
       }
     });
-    const attachment = new $19.aws.internet.GatewayAttachment(group, "attachment", {
+    const attachment = new $20.aws.internet.GatewayAttachment(group, "attachment", {
       vpcId: vpc.id,
       internetGatewayId: gateway.id
     });
-    new $19.aws.Route(group, "route", {
+    new $20.aws.Route(group, "route", {
       gatewayId: gateway.id,
       routeTableId: publicRouteTable.id,
       destinationCidrBlock: "0.0.0.0/0"
@@ -5880,7 +6048,7 @@ var vpcFeature = defineFeature({
       for (const i in zones) {
         const index = Number(i) + 1;
         const id = `${type}-${index}`;
-        const subnet = new $19.aws.Subnet(group, id, {
+        const subnet = new $20.aws.Subnet(group, id, {
           tags: {
             Name: `${ctx.app.name}--${type}-${index}`
           },
@@ -5889,7 +6057,7 @@ var vpcFeature = defineFeature({
           mapPublicIpOnLaunch: type === "public",
           availabilityZone: ctx.appConfig.region + zones[i]
         });
-        new $19.aws.route.TableAssociation(group, id, {
+        new $20.aws.route.TableAssociation(group, id, {
           routeTableId: table.id,
           subnetId: subnet.id
         });
@@ -5901,7 +6069,7 @@ var vpcFeature = defineFeature({
 });
 
 // src/feature/alert/index.ts
-import { $ as $20, Group as Group21 } from "@awsless/formation";
+import { $ as $21, Group as Group21 } from "@awsless/formation";
 var typeGenCode8 = `
 import type { PublishOptions } from '@awsless/sns'
 
@@ -5944,11 +6112,11 @@ var alertFeature = defineFeature({
         resourceType: "alert",
         resourceName: id
       });
-      const topic = new $20.aws.sns.Topic(group, "topic", {
+      const topic = new $21.aws.sns.Topic(group, "topic", {
         name
       });
       for (const email of emails) {
-        new $20.aws.sns.TopicSubscription(group, id, {
+        new $21.aws.sns.TopicSubscription(group, id, {
           topicArn: topic.arn,
           protocol: "email",
           endpoint: email
@@ -5969,12 +6137,12 @@ var alertFeature = defineFeature({
 });
 
 // src/feature/layer/index.ts
-import { $ as $21, Group as Group22 } from "@awsless/formation";
+import { $ as $22, Group as Group22 } from "@awsless/formation";
 var layerFeature = defineFeature({
   name: "layer",
   onBefore(ctx) {
     const group = new Group22(ctx.base, "layer", "asset");
-    const bucket = new $21.aws.s3.Bucket(group, "bucket", {
+    const bucket = new $22.aws.s3.Bucket(group, "bucket", {
       bucket: formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "layer",
@@ -6004,14 +6172,14 @@ var layerFeature = defineFeature({
     for (const [id, _props] of layers) {
       const props = _props;
       const group = new Group22(ctx.base, "layer", id);
-      const zip = new $21.aws.s3.BucketObject(group, "zip", {
+      const zip = new $22.aws.s3.BucketObject(group, "zip", {
         bucket: ctx.shared.get("layer", "bucket-name"),
         key: `/layer/${id}.zip`,
         contentType: "application/zip",
         source: props.file,
         sourceHash: $hash(props.file)
       });
-      const layer = new $21.aws.lambda.LayerVersion(
+      const layer = new $22.aws.lambda.LayerVersion(
         group,
         "layer",
         {
@@ -6044,10 +6212,10 @@ var layerFeature = defineFeature({
 });
 
 // src/feature/image/index.ts
-import { $ as $22, Group as Group23 } from "@awsless/formation";
+import { $ as $23, Group as Group23 } from "@awsless/formation";
 import { join as join12, dirname as dirname8 } from "path";
 import { mebibytes as mebibytes4 } from "@awsless/size";
-import { days as days6, seconds as seconds9, toDays as toDays5, toSeconds as toSeconds8 } from "@awsless/duration";
+import { days as days7, seconds as seconds9, toDays as toDays6, toSeconds as toSeconds8 } from "@awsless/duration";
 import { constantCase as constantCase12 } from "change-case";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { glob as glob3 } from "glob";
@@ -6068,14 +6236,14 @@ var imageFeature = defineFeature({
       resourceType: "layer",
       resourceName: "sharp"
     });
-    const zipFile = new $22.aws.s3.BucketObject(group, "layer", {
+    const zipFile = new $23.aws.s3.BucketObject(group, "layer", {
       bucket: ctx.shared.get("layer", "bucket-name"),
       key: `/layer/${layerId}.zip`,
       contentType: "application/zip",
       source: path,
       sourceHash: $hash(path)
     });
-    const layer = new $22.aws.lambda.LayerVersion(group, "layer", {
+    const layer = new $23.aws.lambda.LayerVersion(group, "layer", {
       layerName: layerId,
       description: "sharp-arm.zip for the awsless image feature.",
       compatibleArchitectures: ["arm64"],
@@ -6106,7 +6274,7 @@ var imageFeature = defineFeature({
       }
       let s3Origin;
       if (props.origin.static) {
-        s3Origin = new $22.aws.s3.Bucket(group, "origin", {
+        s3Origin = new $23.aws.s3.Bucket(group, "origin", {
           bucket: formatLocalResourceName({
             appName: ctx.app.name,
             stackName: ctx.stack.name,
@@ -6116,7 +6284,7 @@ var imageFeature = defineFeature({
           forceDestroy: true
         });
       }
-      const cacheBucket = new $22.aws.s3.Bucket(group, "cache", {
+      const cacheBucket = new $23.aws.s3.Bucket(group, "cache", {
         bucket: formatLocalResourceName({
           appName: ctx.app.name,
           stackName: ctx.stack.name,
@@ -6133,7 +6301,7 @@ var imageFeature = defineFeature({
               enabled: true,
               id: "image-cache-duration",
               expiration: {
-                days: toDays5(props.cacheDuration)
+                days: toDays6(props.cacheDuration)
               }
             }
           ]
@@ -6154,14 +6322,14 @@ var imageFeature = defineFeature({
         log: props.log,
         layers: [sharpLayerId]
       });
-      const permission = new $22.aws.lambda.Permission(group, "permission", {
+      const permission = new $23.aws.lambda.Permission(group, "permission", {
         principal: "cloudfront.amazonaws.com",
         action: "lambda:InvokeFunctionUrl",
         functionName: serverLambda.lambda.functionName,
         functionUrlAuthType: "AWS_IAM",
         sourceArn: `arn:aws:cloudfront::${ctx.accountId}:distribution/*`
       });
-      const serverLambdaUrl = new $22.aws.lambda.FunctionUrl(
+      const serverLambdaUrl = new $23.aws.lambda.FunctionUrl(
         group,
         "url",
         {
@@ -6209,7 +6377,7 @@ var imageFeature = defineFeature({
             nodir: true
           });
           for (const file of files) {
-            new $22.aws.s3.BucketObject(group, `static-${file}`, {
+            new $23.aws.s3.BucketObject(group, `static-${file}`, {
               bucket: s3Origin.bucket,
               key: file,
               source: join12(props.origin.static, file),
@@ -6220,25 +6388,25 @@ var imageFeature = defineFeature({
       });
       const domainName = props.domain ? formatFullDomainName(ctx.appConfig, props.domain, props.subDomain) : void 0;
       const certificateArn = props.domain ? ctx.shared.entry("domain", `global-certificate-arn`, props.domain) : void 0;
-      const s3AccessControl = new $22.aws.cloudfront.OriginAccessControl(group, `s3`, {
+      const s3AccessControl = new $23.aws.cloudfront.OriginAccessControl(group, `s3`, {
         name: `${name}-s3`,
         description: `Policy for the ${id} image cache in S3`,
         originAccessControlOriginType: "s3",
         signingBehavior: "always",
         signingProtocol: "sigv4"
       });
-      const lambdaAccessControl = new $22.aws.cloudfront.OriginAccessControl(group, "lambda", {
+      const lambdaAccessControl = new $23.aws.cloudfront.OriginAccessControl(group, "lambda", {
         name: `${name}-lambda`,
         description: `Policy for the ${id} image lambda server function URL`,
         originAccessControlOriginType: "lambda",
         signingBehavior: "always",
         signingProtocol: "sigv4"
       });
-      const cache = new $22.aws.cloudfront.CachePolicy(group, "cache", {
+      const cache = new $23.aws.cloudfront.CachePolicy(group, "cache", {
         name,
-        defaultTtl: toSeconds8(days6(365))
+        defaultTtl: toSeconds8(days7(365))
       });
-      const distribution = new $22.aws.cloudfront.Distribution(group, "distribution", {
+      const distribution = new $23.aws.cloudfront.Distribution(group, "distribution", {
         comment: name,
         enabled: true,
         aliases: domainName ? [domainName] : void 0,
@@ -6298,7 +6466,7 @@ var imageFeature = defineFeature({
           cachedMethods: ["GET", "HEAD"]
         }
       });
-      new $22.aws.s3.BucketPolicy(
+      new $23.aws.s3.BucketPolicy(
         group,
         `policy`,
         {
@@ -6329,7 +6497,7 @@ var imageFeature = defineFeature({
         }
       );
       if (domainName) {
-        new $22.aws.route53.Record(group, `record`, {
+        new $23.aws.route53.Record(group, `record`, {
           zoneId: ctx.shared.entry("domain", "zone-id", props.domain),
           type: "A",
           name: domainName,
@@ -6351,10 +6519,10 @@ var imageFeature = defineFeature({
 });
 
 // src/feature/icon/index.ts
-import { $ as $23, Group as Group24 } from "@awsless/formation";
+import { $ as $24, Group as Group24 } from "@awsless/formation";
 import { join as join13, dirname as dirname9 } from "path";
 import { mebibytes as mebibytes5 } from "@awsless/size";
-import { days as days7, seconds as seconds10, toDays as toDays6, toSeconds as toSeconds9 } from "@awsless/duration";
+import { days as days8, seconds as seconds10, toDays as toDays7, toSeconds as toSeconds9 } from "@awsless/duration";
 import { constantCase as constantCase13 } from "change-case";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { glob as glob4 } from "glob";
@@ -6376,7 +6544,7 @@ var iconFeature = defineFeature({
       }
       let s3Origin;
       if (props.origin.static) {
-        s3Origin = new $23.aws.s3.Bucket(group, "origin", {
+        s3Origin = new $24.aws.s3.Bucket(group, "origin", {
           bucket: formatLocalResourceName({
             appName: ctx.app.name,
             stackName: ctx.stack.name,
@@ -6386,7 +6554,7 @@ var iconFeature = defineFeature({
           forceDestroy: true
         });
       }
-      const cacheBucket = new $23.aws.s3.Bucket(group, "cache", {
+      const cacheBucket = new $24.aws.s3.Bucket(group, "cache", {
         bucket: formatLocalResourceName({
           appName: ctx.app.name,
           stackName: ctx.stack.name,
@@ -6403,7 +6571,7 @@ var iconFeature = defineFeature({
               enabled: true,
               id: "icon-cache-duration",
               expiration: {
-                days: toDays6(props.cacheDuration)
+                days: toDays7(props.cacheDuration)
               }
             }
           ]
@@ -6418,14 +6586,14 @@ var iconFeature = defineFeature({
         runtime: "nodejs22.x",
         log: props.log
       });
-      const permission = new $23.aws.lambda.Permission(group, "permission", {
+      const permission = new $24.aws.lambda.Permission(group, "permission", {
         principal: "cloudfront.amazonaws.com",
         action: "lambda:InvokeFunctionUrl",
         functionName: serverLambda.lambda.functionName,
         functionUrlAuthType: "AWS_IAM",
         sourceArn: `arn:aws:cloudfront::${ctx.accountId}:distribution/*`
       });
-      const serverLambdaUrl = new $23.aws.lambda.FunctionUrl(
+      const serverLambdaUrl = new $24.aws.lambda.FunctionUrl(
         group,
         "url",
         {
@@ -6475,7 +6643,7 @@ var iconFeature = defineFeature({
             if (!file.endsWith(".svg")) {
               throw new Error(`Icon file "${file}" in "${props.origin.static}" is not an SVG file.`);
             }
-            new $23.aws.s3.BucketObject(group, `static-${file}`, {
+            new $24.aws.s3.BucketObject(group, `static-${file}`, {
               bucket: s3Origin.bucket,
               key: file,
               source: join13(props.origin.static, file),
@@ -6486,29 +6654,29 @@ var iconFeature = defineFeature({
       });
       const domainName = props.domain ? formatFullDomainName(ctx.appConfig, props.domain, props.subDomain) : void 0;
       const certificateArn = props.domain ? ctx.shared.entry("domain", `global-certificate-arn`, props.domain) : void 0;
-      const s3AccessControl = new $23.aws.cloudfront.OriginAccessControl(group, `s3`, {
+      const s3AccessControl = new $24.aws.cloudfront.OriginAccessControl(group, `s3`, {
         name: `${name}-s3`,
         description: `Policy for the ${id} icon cache in S3`,
         originAccessControlOriginType: "s3",
         signingBehavior: "always",
         signingProtocol: "sigv4"
       });
-      const lambdaAccessControl = new $23.aws.cloudfront.OriginAccessControl(group, "lambda", {
+      const lambdaAccessControl = new $24.aws.cloudfront.OriginAccessControl(group, "lambda", {
         name: `${name}-lambda`,
         description: `Policy for the ${id} icon lambda server function URL`,
         originAccessControlOriginType: "lambda",
         signingBehavior: "always",
         signingProtocol: "sigv4"
       });
-      const cache = new $23.aws.cloudfront.CachePolicy(group, "cache", {
+      const cache = new $24.aws.cloudfront.CachePolicy(group, "cache", {
         name,
-        defaultTtl: toSeconds9(days7(365))
+        defaultTtl: toSeconds9(days8(365))
       });
-      const responseHeaders = new $23.aws.cloudfront.ResponseHeadersPolicy(group, "response", {
+      const responseHeaders = new $24.aws.cloudfront.ResponseHeadersPolicy(group, "response", {
         name,
         corsConfig: {
           originOverride: true,
-          accessControlMaxAgeSec: toSeconds9(days7(365)),
+          accessControlMaxAgeSec: toSeconds9(days8(365)),
           accessControlAllowHeaders: { items: ["*"] },
           accessControlAllowMethods: { items: ["ALL"] },
           accessControlAllowOrigins: { items: ["*"] },
@@ -6516,7 +6684,7 @@ var iconFeature = defineFeature({
           accessControlAllowCredentials: false
         }
       });
-      const distribution = new $23.aws.cloudfront.Distribution(group, "distribution", {
+      const distribution = new $24.aws.cloudfront.Distribution(group, "distribution", {
         waitForDeployment: false,
         comment: name,
         enabled: true,
@@ -6577,7 +6745,7 @@ var iconFeature = defineFeature({
           responseHeadersPolicyId: responseHeaders.id
         }
       });
-      new $23.aws.s3.BucketPolicy(
+      new $24.aws.s3.BucketPolicy(
         group,
         `policy`,
         {
@@ -6608,7 +6776,7 @@ var iconFeature = defineFeature({
         }
       );
       if (domainName) {
-        new $23.aws.route53.Record(group, `record`, {
+        new $24.aws.route53.Record(group, `record`, {
           zoneId: ctx.shared.entry("domain", "zone-id", props.domain),
           type: "A",
           name: domainName,
@@ -6629,6 +6797,395 @@ var iconFeature = defineFeature({
   }
 });
 
+// src/feature/instance/index.ts
+import { $ as $26, Group as Group26 } from "@awsless/formation";
+
+// src/feature/instance/util.ts
+import { toDays as toDays8, toSeconds as toSeconds10 } from "@awsless/duration";
+import { $ as $25, Future as Future4, Group as Group25, resolveInputs as resolveInputs3 } from "@awsless/formation";
+import { generateFileHash as generateFileHash2 } from "@awsless/ts-file-cache";
+import { constantCase as constantCase14, pascalCase as pascalCase3 } from "change-case";
+import deepmerge4 from "deepmerge";
+
+// src/feature/instance/build/executable.ts
+import { execSync } from "child_process";
+import { createHash as createHash5 } from "crypto";
+import { readFile as readFile4 } from "fs/promises";
+import { join as join14 } from "path";
+var buildExecutable = async (input, outputPath) => {
+  const filePath = join14(outputPath, "program");
+  const args = ["build", input, "--compile", "--target", "bun-linux-x64-modern", "--outfile", filePath];
+  try {
+    execSync(`bun ${args.join(" ")}`, { encoding: "utf8" });
+  } catch (error) {
+    throw new Error(`Executable build failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const file = await readFile4(filePath);
+  return {
+    hash: createHash5("sha1").update(file).digest("hex"),
+    file
+  };
+};
+
+// src/feature/instance/util.ts
+var createFargateTask = (parentGroup, ctx, ns, id, local) => {
+  const group = new Group25(parentGroup, "instance", ns);
+  const name = formatLocalResourceName({
+    appName: ctx.app.name,
+    stackName: ctx.stack.name,
+    resourceType: ns,
+    resourceName: id
+  });
+  const shortName = shortId(`${ctx.app.name}:${ctx.stack.name}:${ns}:${id}:${ctx.appId}`);
+  const props = deepmerge4(ctx.appConfig.defaults.instance, local);
+  ctx.registerBuild("instance", name, async (build3, { workspace }) => {
+    const fingerprint = await generateFileHash2(workspace, local.code.file);
+    return build3(fingerprint, async (write) => {
+      const temp = await createTempFolder(`instance--${name}`);
+      const executable = await buildExecutable(local.code.file, temp.path);
+      await Promise.all([
+        //
+        write("HASH", executable.hash),
+        write("program", executable.file),
+        temp.delete()
+      ]);
+      return {
+        size: formatByteSize(executable.file.byteLength)
+      };
+    });
+  });
+  const code = new $25.aws.s3.BucketObject(group, "code", {
+    bucket: ctx.shared.get("instance", "bucket-name"),
+    key: `fargate/${name}`,
+    source: relativePath(getBuildPath("instance", name, "program")),
+    sourceHash: $hash(getBuildPath("instance", name, "HASH"))
+  });
+  const executionRole = new $25.aws.iam.Role(group, "execution-role", {
+    name: shortId(`${shortName}:execution-role`),
+    description: name,
+    assumeRolePolicy: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Action: "sts:AssumeRole",
+          Principal: {
+            Service: ["ecs-tasks.amazonaws.com"]
+          }
+        }
+      ]
+    }),
+    managedPolicyArns: ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
+  });
+  const role = new $25.aws.iam.Role(
+    group,
+    "task-role",
+    {
+      name: shortId(`${shortName}:task-role`),
+      description: name,
+      assumeRolePolicy: JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Action: "sts:AssumeRole",
+            Principal: {
+              Service: ["ecs-tasks.amazonaws.com"]
+            }
+          }
+        ]
+      }),
+      inlinePolicy: [
+        {
+          name: "s3-code-access",
+          policy: $resolve([code.bucket, code.key], (bucket, key) => {
+            return JSON.stringify({
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: pascalCase3("allow"),
+                  Action: ["s3:getObject", "s3:HeadObject"],
+                  Resource: `arn:aws:s3:::${bucket}/${key}`
+                }
+              ]
+            });
+          })
+        }
+      ]
+    },
+    {
+      dependsOn: [code]
+    }
+  );
+  const statements = [];
+  const policy = new $25.aws.iam.RolePolicy(group, "policy", {
+    role: role.name,
+    name: "task-policy",
+    policy: new Future4(async (resolve) => {
+      const list3 = await resolveInputs3(statements);
+      resolve(
+        JSON.stringify({
+          Version: "2012-10-17",
+          Statement: list3.map((statement) => ({
+            Effect: pascalCase3(statement.effect ?? "allow"),
+            Action: statement.actions,
+            Resource: statement.resources
+          }))
+        })
+      );
+    })
+  });
+  const addPermission = (...permissions) => {
+    statements.push(...permissions);
+    policy.$.attachDependencies(permissions);
+  };
+  ctx.onPermission((statement) => {
+    addPermission(statement);
+  });
+  let logGroup;
+  if (props.log.retention.value > 0n) {
+    logGroup = new $25.aws.cloudwatch.LogGroup(group, "log", {
+      name: `/aws/ecs/${name}`,
+      retentionInDays: toDays8(props.log.retention)
+    });
+    const onLogArn = getGlobalOnLog(ctx);
+    if (onLogArn && ctx.appConfig.defaults.onLog) {
+      const logFilter = ctx.appConfig.defaults.onLog.filter;
+      new $25.aws.cloudwatch.LogSubscriptionFilter(group, `on-log`, {
+        name: "log-subscription",
+        destinationArn: onLogArn,
+        logGroupName: logGroup.name,
+        filterPattern: formatFilterPattern(logFilter)
+      });
+    }
+  }
+  const tags = {
+    APP: ctx.appConfig.name,
+    APP_ID: ctx.appId,
+    STACK: ctx.stackConfig.name
+  };
+  const variables = {};
+  const task2 = new $25.aws.ecs.TaskDefinition(
+    group,
+    "task",
+    {
+      family: name,
+      networkMode: "awsvpc",
+      cpu: props.cpuSize,
+      memory: props.memorySize.toString(),
+      requiresCompatibilities: ["FARGATE"],
+      executionRoleArn: executionRole.arn,
+      taskRoleArn: role.arn,
+      trackLatest: true,
+      runtimePlatform: {
+        cpuArchitecture: constantCase14(props.architecture),
+        operatingSystemFamily: "LINUX"
+      },
+      containerDefinitions: new Future4(async (resolve) => {
+        const data = await resolveInputs3(variables);
+        const { s3Bucket, s3Key } = await resolveInputs3({
+          s3Bucket: code.bucket,
+          s3Key: code.key
+        });
+        resolve(
+          JSON.stringify([
+            {
+              name: `container-${id}`,
+              image: props.image,
+              protocol: "tcp",
+              workingDirectory: "/usr/app",
+              entryPoint: ["sh", "-c"],
+              command: [
+                `aws s3 cp s3://${s3Bucket}/${s3Key} /usr/app/program && chmod +x /usr/app/program && /usr/app/program`
+                // can only run a single command
+              ],
+              environment: Object.entries(data).map(([name2, value]) => ({
+                name: name2,
+                value
+              })),
+              portMappings: [
+                {
+                  name: "http",
+                  protocol: "tcp",
+                  appProtocol: "http",
+                  containerPort: 80,
+                  hostPort: 80
+                },
+                {
+                  name: "https",
+                  protocol: "tcp",
+                  appProtocol: "http",
+                  containerPort: 443,
+                  hostPort: 443
+                }
+              ],
+              ...props.restartPolicy && {
+                restartPolicy: {
+                  enabled: props.restartPolicy.enabled,
+                  ...props.restartPolicy.ignoredExitCodes && {
+                    ignoredExitCodes: props.restartPolicy.ignoredExitCodes
+                  },
+                  ...props.restartPolicy.restartAttemptPeriod && {
+                    restartAttemptPeriod: props.restartPolicy.restartAttemptPeriod
+                  }
+                }
+              },
+              ...logGroup && {
+                logConfiguration: {
+                  logDriver: "awslogs",
+                  options: {
+                    "awslogs-group": `/aws/ecs/${name}`,
+                    "awslogs-region": ctx.appConfig.region,
+                    "awslogs-stream-prefix": "ecs"
+                    // mode: 'non-blocking',
+                    // 'max-buffer-size': '1m',
+                  }
+                }
+              },
+              healthCheck: props.healthCheck ? {
+                command: props.healthCheck.command,
+                interval: toSeconds10(props.healthCheck.interval),
+                retries: props.healthCheck.retries,
+                startPeriod: toSeconds10(props.healthCheck.startPeriod),
+                timeout: toSeconds10(props.healthCheck.timeout)
+              } : void 0
+            }
+          ])
+        );
+      }),
+      tags
+    },
+    {
+      dependsOn: [code]
+    }
+  );
+  const securityGroup = new $25.aws.security.Group(group, "security-group", {
+    name,
+    description: "Security group for the instance",
+    vpcId: ctx.shared.get("vpc", "id"),
+    tags
+  });
+  new $25.aws.vpc.SecurityGroupIngressRule(group, "ingress-rule-http", {
+    securityGroupId: securityGroup.id,
+    description: `Allow HTTP traffic on port 80 to the ${name} instance`,
+    fromPort: 80,
+    toPort: 80,
+    ipProtocol: "tcp",
+    cidrIpv4: "0.0.0.0/0",
+    tags
+  });
+  new $25.aws.vpc.SecurityGroupIngressRule(group, "ingress-rule-https", {
+    securityGroupId: securityGroup.id,
+    description: `Allow HTTP traffic on port 443 to the ${name} instance`,
+    fromPort: 443,
+    toPort: 443,
+    ipProtocol: "tcp",
+    cidrIpv4: "0.0.0.0/0",
+    tags
+  });
+  new $25.aws.vpc.SecurityGroupEgressRule(group, "egress-rule", {
+    securityGroupId: securityGroup.id,
+    description: `Allow all outbound traffic from the ${name} instance`,
+    ipProtocol: "-1",
+    cidrIpv4: "0.0.0.0/0",
+    tags
+  });
+  const service = new $25.aws.ecs.Service(group, "service", {
+    cluster: ctx.shared.get("instance", "cluster-arn"),
+    name,
+    taskDefinition: task2.arn,
+    desiredCount: 1,
+    launchType: "FARGATE",
+    networkConfiguration: {
+      subnets: ctx.shared.get("vpc", "public-subnets"),
+      securityGroups: [securityGroup.id],
+      assignPublicIp: true
+    },
+    forceNewDeployment: true,
+    // serviceRegistries: {
+    // 	registryArn: ctx.shared.get('instance', 'namespace'),
+    // },
+    tags
+    // forceDelete: true,
+    // deploymentCircuitBreaker: {
+    // 	enable: true,
+    // 	rollback: true,
+    // },
+    // deploymentController: { type: 'ECS' },
+    // The internal url (dnsName) doesn't work for ldambda's
+    // https://github.com/aws/containers-roadmap/issues/1960
+    // serviceConnectConfiguration: {
+    // 	enabled: true,
+    // 	namespace: ctx.shared.get('instance', 'namespace'),
+    // 	service: [
+    // 		{
+    // 			clientAlias: {
+    // 				port: 80,
+    // 				dnsName: `${id}.${ctx.app.name}.internal`,
+    // 			},
+    // 			discoveryName: name,
+    // 			portName: 'http',
+    // 		},
+    // 	],
+    // },
+  });
+  variables.APP = ctx.appConfig.name;
+  variables.APP_ID = ctx.appId;
+  variables.AWS_ACCOUNT_ID = ctx.accountId;
+  variables.STACK = ctx.stackConfig.name;
+  variables.CODE_HASH = code.sourceHash;
+  if (ctx.appConfig.defaults.instance.permissions) {
+    statements.push(...ctx.appConfig.defaults.instance.permissions);
+  }
+  if ("permissions" in local && local.permissions) {
+    statements.push(...local.permissions);
+  }
+  return { name, task: task2, service, policy, code, group };
+};
+
+// src/feature/instance/index.ts
+var instanceFeature = defineFeature({
+  name: "instance",
+  onBefore(ctx) {
+    const group = new Group26(ctx.base, "instance", "asset");
+    const bucket = new $26.aws.s3.Bucket(group, "bucket", {
+      bucket: formatGlobalResourceName({
+        appName: ctx.app.name,
+        resourceType: "instance",
+        resourceName: "assets",
+        postfix: ctx.appId
+      }),
+      forceDestroy: true
+    });
+    ctx.shared.set("instance", "bucket-name", bucket.bucket);
+  },
+  onApp(ctx) {
+    const found = ctx.stackConfigs.filter((stack) => {
+      return Object.keys(stack.instances ?? {}).length > 0;
+    });
+    if (found.length === 0) {
+      return;
+    }
+    const group = new Group26(ctx.base, "instance", "cluster");
+    const cluster = new $26.aws.ecs.Cluster(group, "cluster", {
+      name: ctx.app.name
+    });
+    ctx.shared.set("instance", "cluster-arn", cluster.arn);
+    const namespace = new $26.aws.service.DiscoveryPrivateDnsNamespace(group, "namespace", {
+      name: ctx.app.name,
+      vpc: ctx.shared.get("vpc", "id"),
+      description: `Private DNS namespace for ${ctx.app.name}`
+    });
+    ctx.shared.set("instance", "namespace", namespace.name);
+  },
+  onStack(ctx) {
+    for (const [id, props] of Object.entries(ctx.stackConfig.instances ?? {})) {
+      const group = new Group26(ctx.stack, "instance", id);
+      createFargateTask(group, ctx, "instance", id, props);
+    }
+  }
+});
+
 // src/feature/index.ts
 var features = [
   // 1
@@ -6643,7 +7200,7 @@ var features = [
   authFeature,
   // 3
   functionFeature,
-  // instanceFeature,
+  instanceFeature,
   // graphqlFeature,
   configFeature,
   searchFeature,
@@ -7526,14 +8083,14 @@ import wildstring4 from "wildstring";
 // src/cli/ui/complex/run-tests.ts
 import { log as log15 } from "@awsless/clui";
 import chalk4 from "chalk";
-import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile3 } from "fs/promises";
-import { join as join16 } from "path";
+import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile3 } from "fs/promises";
+import { join as join17 } from "path";
 import wildstring3 from "wildstring";
 
 // src/build/__fingerprint.ts
-import { createHash as createHash5 } from "crypto";
-import { readdir as readdir4, readFile as readFile4, stat as stat4 } from "fs/promises";
-import { basename as basename4, dirname as dirname10, extname as extname3, join as join14 } from "path";
+import { createHash as createHash6 } from "crypto";
+import { readdir as readdir4, readFile as readFile5, stat as stat4 } from "fs/promises";
+import { basename as basename4, dirname as dirname10, extname as extname3, join as join15 } from "path";
 import parseStaticImports from "parse-static-imports";
 var extensions = ["js", "mjs", "jsx", "ts", "mts", "tsx"];
 var generateFileHashes = async (file, hashes) => {
@@ -7542,7 +8099,7 @@ var generateFileHashes = async (file, hashes) => {
   }
   const code = await readModuleFile(file);
   const deps = await findDependencies(file, code);
-  const hash = createHash5("sha1").update(code).digest();
+  const hash = createHash6("sha1").update(code).digest();
   hashes.set(file, hash);
   for (const dep of deps) {
     if (dep.startsWith("/")) {
@@ -7555,11 +8112,11 @@ var fingerprintFromDirectory = async (dir) => {
   const files = await readdir4(dir, { recursive: true });
   for (const file of files) {
     if (extensions.includes(extname3(file).substring(1)) && file.at(0) !== "_") {
-      await generateFileHashes(join14(dir, file), hashes);
+      await generateFileHashes(join15(dir, file), hashes);
     }
   }
   const merge2 = Buffer.concat(Array.from(hashes.values()).sort());
-  return createHash5("sha1").update(merge2).digest("hex");
+  return createHash6("sha1").update(merge2).digest("hex");
 };
 var readModuleFile = (file) => {
   if (file.endsWith(".js")) {
@@ -7569,17 +8126,17 @@ var readModuleFile = (file) => {
     return readFiles([
       file,
       ...extensions.map((exp) => `${file}.${exp}`),
-      ...extensions.map((exp) => join14(file, `/index.${exp}`))
+      ...extensions.map((exp) => join15(file, `/index.${exp}`))
     ]);
   }
-  return readFile4(file, "utf8");
+  return readFile5(file, "utf8");
 };
 var readFiles = async (files) => {
   for (const file of files) {
     try {
       const s = await stat4(file);
       if (s.isFile()) {
-        return readFile4(file, "utf8");
+        return readFile5(file, "utf8");
       }
     } catch (_) {
       continue;
@@ -7589,7 +8146,7 @@ var readFiles = async (files) => {
 };
 var findDependencies = async (file, code) => {
   const imports = await parseStaticImports(code);
-  return imports.map((entry) => entry.moduleName).filter(Boolean).map((value) => value?.startsWith(".") ? join14(dirname10(file), value) : value);
+  return imports.map((entry) => entry.moduleName).filter(Boolean).map((value) => value?.startsWith(".") ? join15(dirname10(file), value) : value);
 };
 
 // src/test/reporter.ts
@@ -7669,7 +8226,7 @@ var CustomReporter = class {
 import commonjs2 from "@rollup/plugin-commonjs";
 import json2 from "@rollup/plugin-json";
 import nodeResolve2 from "@rollup/plugin-node-resolve";
-import { dirname as dirname11, join as join15 } from "path";
+import { dirname as dirname11, join as join16 } from "path";
 import { swc as swc2 } from "rollup-plugin-swc3";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { configDefaults } from "vitest/config";
@@ -7691,7 +8248,7 @@ var startTest = async (props) => {
       reporters: props.reporter,
       setupFiles: [
         //
-        join15(__dirname4, "test-global-setup.js")
+        join16(__dirname4, "test-global-setup.js")
       ]
       // globalSetup: [
       // 	//
@@ -7781,10 +8338,10 @@ var logTestErrors = (event) => {
 var runTest = async (stack, dir, filters, opts) => {
   await mkdir4(directories.test, { recursive: true });
   const fingerprint = await fingerprintFromDirectory(dir);
-  const file = join16(directories.test, `${stack}.json`);
+  const file = join17(directories.test, `${stack}.json`);
   const exists = await fileExist(file);
   if (exists && !process.env.NO_CACHE) {
-    const raw = await readFile5(file, { encoding: "utf8" });
+    const raw = await readFile6(file, { encoding: "utf8" });
     const data = JSON.parse(raw);
     if (data.fingerprint === fingerprint) {
       log15.step(
@@ -8024,7 +8581,7 @@ var auth = (program2) => {
 
 // src/cli/command/bind.ts
 import { log as log17 } from "@awsless/clui";
-import { constantCase as constantCase14 } from "change-case";
+import { constantCase as constantCase15 } from "change-case";
 import { spawn } from "child_process";
 var bind = (program2) => {
   program2.command("bind").argument("[command...]", "The command to execute").option("--config <string...>", "List of config values that will be accessable", (v) => v.split(",")).description(`Bind your site environment variables to a command`).action(async (commands9 = [], opts) => {
@@ -8053,10 +8610,10 @@ var bind = (program2) => {
       const configList = opts.config ?? [];
       const configs = {};
       for (const name of configList) {
-        configs[`CONFIG_${constantCase14(name)}`] = name;
+        configs[`CONFIG_${constantCase15(name)}`] = name;
       }
       if (configList.length ?? 0 > 0) {
-        log17.note("Bind Config", configList.map((v) => color.label(constantCase14(v))).join("\n"));
+        log17.note("Bind Config", configList.map((v) => color.label(constantCase15(v))).join("\n"));
       }
       if (commands9.length === 0) {
         return "No command to execute.";
@@ -8119,7 +8676,7 @@ import { log as log18 } from "@awsless/clui";
 
 // src/type-gen/generate.ts
 import { mkdir as mkdir5, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname12, join as join17, relative as relative7 } from "path";
+import { dirname as dirname12, join as join18, relative as relative7 } from "path";
 var generateTypes = async (props) => {
   const files = [];
   await Promise.all(
@@ -8128,7 +8685,7 @@ var generateTypes = async (props) => {
         ...props,
         async write(file, data, include = false) {
           const code = data?.toString("utf8");
-          const path = join17(directories.types, file);
+          const path = join18(directories.types, file);
           if (code) {
             if (include) {
               files.push(relative7(directories.root, path));
@@ -8142,7 +8699,7 @@ var generateTypes = async (props) => {
   );
   if (files.length) {
     const code = files.map((file) => `/// <reference path='${file}' />`).join("\n");
-    await writeFile4(join17(directories.root, `awsless.d.ts`), code);
+    await writeFile4(join18(directories.root, `awsless.d.ts`), code);
   }
 };