@awsless/awsless 0.0.665 → 0.0.667

package/dist/bin.js

@@ -943,7 +943,7 @@ var debug = (...parts) => {
 };
 
 // src/config/app.ts
-import { z as z29 } from "zod";
+import { z as z30 } from "zod";
 
 // src/feature/alert/schema.ts
 import { kebabCase } from "change-case";
@@ -1175,7 +1175,7 @@ var LogRetentionSchema = DurationSchema.refine(
   (duration) => {
     return validLogRetentionDays.includes(toDays(duration));
   },
-  `Invalid log retention. Valid days are: ${validLogRetentionDays.map((days9) => `${days9}`).join(", ")}`
+  `Invalid log retention. Valid days are: ${validLogRetentionDays.map((days10) => `${days10}`).join(", ")}`
 ).describe("The log retention duration.");
 var LogSchema = z15.union([
   z15.boolean().transform((enabled) => ({ retention: enabled ? days(7) : days(0) })),
@@ -1715,13 +1715,11 @@ var RpcSchema = z25.record(
   ).describe("The queries for your global RPC API.")
 ).describe("Define the schema in your stack for your global RPC API.").optional();
 
-// src/feature/instance/schema.ts
-import { days as days4, toDays as toDays2 } from "@awsless/duration";
+// src/feature/job/schema.ts
+import { days as days4, hours as hours2, minutes as minutes5, toDays as toDays2 } from "@awsless/duration";
 import { toMebibytes } from "@awsless/size";
 import { z as z26 } from "zod";
-var CpuSchema = z26.union([z26.literal(0.25), z26.literal(0.5), z26.literal(1), z26.literal(2), z26.literal(4), z26.literal(8), z26.literal(16)]).transform((v) => `${v} vCPU`).describe(
-  "The number of virtual CPU units (vCPU) used by the instance. Valid values: 0.25, 0.5, 1, 2, 4, 8, 16 vCPU."
-);
+var CpuSchema = z26.union([z26.literal(0.25), z26.literal(0.5), z26.literal(1), z26.literal(2), z26.literal(4), z26.literal(8), z26.literal(16)]).transform((v) => `${v} vCPU`).describe("The number of virtual CPU units (vCPU) used by the job. Valid values: 0.25, 0.5, 1, 2, 4, 8, 16 vCPU.");
 var validMemorySize = [
   // 0.25 vCPU
   512,
@@ -1758,22 +1756,9 @@ var validMemorySize = [
 var MemorySizeSchema2 = SizeSchema.refine(
   (s) => validMemorySize.includes(toMebibytes(s)),
   `Invalid memory size. Allowed sizes: ${validMemorySize.join(", ")} MiB`
-).describe("The amount of memory (in MiB) used by the instance. Valid memory values depend on the CPU configuration.");
-var HealthCheckSchema = z26.object({
-  path: z26.string().describe("The path that the container runs to determine if it is healthy."),
-  interval: DurationSchema.describe("The time period in seconds between each health check execution."),
-  retries: z26.number().int().min(1).max(10).describe(
-    "The number of times to retry a failed health check before the container is considered unhealthy."
-  ),
-  startPeriod: DurationSchema.describe(
-    "The optional grace period to provide containers time to bootstrap before failed health checks count towards the maximum number of retries."
-  ),
-  timeout: DurationSchema.describe(
-    "The time period in seconds to wait for a health check to succeed before it is considered a failure."
-  )
-}).describe("The health check command and associated configuration parameters for the container.");
+).describe("The amount of memory (in MiB) used by the job. Valid memory values depend on the CPU configuration.");
 var EnvironmentSchema2 = z26.record(z26.string(), z26.string()).optional().describe("Environment variable key-value pairs.");
-var ArchitectureSchema3 = z26.enum(["x86_64", "arm64"]).describe("The instruction set architecture that the instance supports.");
+var ArchitectureSchema3 = z26.enum(["x86_64", "arm64"]).describe("The instruction set architecture that the job supports.");
 var ActionSchema2 = z26.string();
 var ActionsSchema2 = z26.union([ActionSchema2.transform((v) => [v]), ActionSchema2.array()]);
 var ArnSchema2 = z26.string().startsWith("arn:");
@@ -1785,9 +1770,7 @@ var PermissionSchema2 = z26.object({
   actions: ActionsSchema2,
   resources: ResourcesSchema2
 });
-var PermissionsSchema2 = z26.union([PermissionSchema2.transform((v) => [v]), PermissionSchema2.array()]).describe("Add IAM permissions to your instance.");
-var DescriptionSchema2 = z26.string().describe("A description of the instance.");
-var ImageSchema = z26.string().optional().describe("The URL of the container image to use.");
+var PermissionsSchema2 = z26.union([PermissionSchema2.transform((v) => [v]), PermissionSchema2.array()]).describe("Add IAM permissions to your job.");
 var validLogRetentionDays2 = [
   ...[1, 3, 5, 7, 14, 30, 60, 90, 120, 150],
   ...[180, 365, 400, 545, 731, 1096, 1827, 2192],
@@ -1800,7 +1783,7 @@ var LogRetentionSchema2 = DurationSchema.refine(
   (duration) => {
     return validLogRetentionDays2.includes(toDays2(duration));
   },
-  `Invalid log retention. Valid days are: ${validLogRetentionDays2.map((days9) => `${days9}`).join(", ")}`
+  `Invalid log retention. Valid days are: ${validLogRetentionDays2.map((days10) => `${days10}`).join(", ")}`
 ).describe("The log retention duration.");
 var LogSchema2 = z26.union([
   z26.boolean().transform((enabled) => ({ retention: enabled ? days4(7) : days4(0) })),
@@ -1810,59 +1793,199 @@ var LogSchema2 = z26.union([
   })
 ]).describe("Enable logging to a CloudWatch log group. Providing a duration value will set the log retention time.");
 var FileCodeSchema2 = z26.object({
-  file: LocalFileSchema.describe("The file path of the instance code.")
+  file: LocalFileSchema.describe("The file path of the job code.")
 });
 var CodeSchema2 = z26.union([
   LocalFileSchema.transform((file) => ({
     file
   })).pipe(FileCodeSchema2),
   FileCodeSchema2
-]).describe("Specify the code of your instance.");
-var ISchema = z26.object({
+]).describe("Specify the code of your job.");
+var TimeoutSchema3 = DurationSchema.refine(durationMin(minutes5(1)), "Minimum timeout is 1 minute.").refine(durationMax(hours2(4)), "Maximum timeout is 4 hours.").describe("The maximum time the job is allowed to run before being stopped.");
+var ImageSchema = z26.string().describe("The URL of the container image to use.");
+var StartupCommandSchema = z26.union([z26.string().transform((v) => [v]), z26.string().array()]).describe("Optional shell commands to run before the job program starts.");
+var ASchema = z26.object({
   code: CodeSchema2,
-  description: DescriptionSchema2.optional(),
   image: ImageSchema.optional(),
+  startupCommand: StartupCommandSchema.optional(),
   log: LogSchema2.optional(),
   cpu: CpuSchema.optional(),
   memorySize: MemorySizeSchema2.optional(),
   architecture: ArchitectureSchema3.optional(),
   environment: EnvironmentSchema2.optional(),
   permissions: PermissionsSchema2.optional(),
-  healthCheck: HealthCheckSchema.optional()
-  // restartPolicy: RestartPolicySchema.optional(),
+  timeout: TimeoutSchema3.default("30 minutes").describe("The maximum time the job is allowed to run before being stopped. Default: 30 minutes.")
 });
-var InstanceSchema = z26.union([
+var JobSchema = z26.union([
   LocalFileSchema.transform((code) => ({
     code
-  })).pipe(ISchema),
-  ISchema
+  })).pipe(ASchema),
+  ASchema
 ]);
-var InstancesSchema = z26.record(ResourceIdSchema, InstanceSchema).optional().describe("Define the instances in your stack.");
-var InstanceDefaultSchema = z26.object({
+var JobsSchema = z26.record(ResourceIdSchema, JobSchema).optional().describe("Define the jobs in your stack.");
+var JobDefaultSchema = z26.object({
   image: ImageSchema.optional(),
   cpu: CpuSchema.default(0.25),
   memorySize: MemorySizeSchema2.default("512 MB"),
   architecture: ArchitectureSchema3.default("arm64"),
   environment: EnvironmentSchema2.optional(),
   permissions: PermissionsSchema2.optional(),
-  healthCheck: HealthCheckSchema.optional(),
-  // restartPolicy: RestartPolicySchema.default({ enabled: true }),
+  timeout: TimeoutSchema3.optional(),
   log: LogSchema2.default(true).transform((log35) => ({
     retention: log35.retention ?? days4(7)
   }))
 }).default({});
 
+// src/feature/instance/schema.ts
+import { days as days5, toDays as toDays3 } from "@awsless/duration";
+import { toMebibytes as toMebibytes2 } from "@awsless/size";
+import { z as z27 } from "zod";
+var CpuSchema2 = z27.union([z27.literal(0.25), z27.literal(0.5), z27.literal(1), z27.literal(2), z27.literal(4), z27.literal(8), z27.literal(16)]).transform((v) => `${v} vCPU`).describe(
+  "The number of virtual CPU units (vCPU) used by the instance. Valid values: 0.25, 0.5, 1, 2, 4, 8, 16 vCPU."
+);
+var validMemorySize2 = [
+  // 0.25 vCPU
+  512,
+  1024,
+  2048,
+  // 0.5 vCPU
+  1024,
+  2048,
+  3072,
+  4096,
+  // 1 vCPU
+  2048,
+  3072,
+  4096,
+  5120,
+  6144,
+  7168,
+  8192,
+  // 2 vCPU
+  4096,
+  5120,
+  6144,
+  7168,
+  8192,
+  9216,
+  10240,
+  11264,
+  12288,
+  13312,
+  14336,
+  15360,
+  16384
+];
+var MemorySizeSchema3 = SizeSchema.refine(
+  (s) => validMemorySize2.includes(toMebibytes2(s)),
+  `Invalid memory size. Allowed sizes: ${validMemorySize2.join(", ")} MiB`
+).describe("The amount of memory (in MiB) used by the instance. Valid memory values depend on the CPU configuration.");
+var HealthCheckSchema = z27.object({
+  path: z27.string().describe("The path that the container runs to determine if it is healthy."),
+  interval: DurationSchema.describe("The time period in seconds between each health check execution."),
+  retries: z27.number().int().min(1).max(10).describe(
+    "The number of times to retry a failed health check before the container is considered unhealthy."
+  ),
+  startPeriod: DurationSchema.describe(
+    "The optional grace period to provide containers time to bootstrap before failed health checks count towards the maximum number of retries."
+  ),
+  timeout: DurationSchema.describe(
+    "The time period in seconds to wait for a health check to succeed before it is considered a failure."
+  )
+}).describe("The health check command and associated configuration parameters for the container.");
+var EnvironmentSchema3 = z27.record(z27.string(), z27.string()).optional().describe("Environment variable key-value pairs.");
+var ArchitectureSchema4 = z27.enum(["x86_64", "arm64"]).describe("The instruction set architecture that the instance supports.");
+var ActionSchema3 = z27.string();
+var ActionsSchema3 = z27.union([ActionSchema3.transform((v) => [v]), ActionSchema3.array()]);
+var ArnSchema3 = z27.string().startsWith("arn:");
+var WildcardSchema3 = z27.literal("*");
+var ResourceSchema3 = z27.union([ArnSchema3, WildcardSchema3]);
+var ResourcesSchema3 = z27.union([ResourceSchema3.transform((v) => [v]), ResourceSchema3.array()]);
+var PermissionSchema3 = z27.object({
+  effect: z27.enum(["allow", "deny"]).default("allow"),
+  actions: ActionsSchema3,
+  resources: ResourcesSchema3
+});
+var PermissionsSchema3 = z27.union([PermissionSchema3.transform((v) => [v]), PermissionSchema3.array()]).describe("Add IAM permissions to your instance.");
+var DescriptionSchema2 = z27.string().describe("A description of the instance.");
+var ImageSchema2 = z27.string().optional().describe("The URL of the container image to use.");
+var validLogRetentionDays3 = [
+  ...[1, 3, 5, 7, 14, 30, 60, 90, 120, 150],
+  ...[180, 365, 400, 545, 731, 1096, 1827, 2192],
+  ...[2557, 2922, 3288, 3653]
+];
+var LogRetentionSchema3 = DurationSchema.refine(
+  durationMin(days5(0)),
+  "Minimum log retention is 0 day, which will disable logging."
+).refine(
+  (duration) => {
+    return validLogRetentionDays3.includes(toDays3(duration));
+  },
+  `Invalid log retention. Valid days are: ${validLogRetentionDays3.map((days10) => `${days10}`).join(", ")}`
+).describe("The log retention duration.");
+var LogSchema3 = z27.union([
+  z27.boolean().transform((enabled) => ({ retention: enabled ? days5(7) : days5(0) })),
+  LogRetentionSchema3.transform((retention) => ({ retention })),
+  z27.object({
+    retention: LogRetentionSchema3.optional()
+  })
+]).describe("Enable logging to a CloudWatch log group. Providing a duration value will set the log retention time.");
+var FileCodeSchema3 = z27.object({
+  file: LocalFileSchema.describe("The file path of the instance code.")
+});
+var CodeSchema3 = z27.union([
+  LocalFileSchema.transform((file) => ({
+    file
+  })).pipe(FileCodeSchema3),
+  FileCodeSchema3
+]).describe("Specify the code of your instance.");
+var StartupCommandSchema2 = z27.union([z27.string().transform((v) => [v]), z27.string().array()]).describe("Optional shell commands to run before the instance program starts.");
+var ISchema = z27.object({
+  code: CodeSchema3,
+  description: DescriptionSchema2.optional(),
+  image: ImageSchema2.optional(),
+  startupCommand: StartupCommandSchema2.optional(),
+  log: LogSchema3.optional(),
+  cpu: CpuSchema2.optional(),
+  memorySize: MemorySizeSchema3.optional(),
+  architecture: ArchitectureSchema4.optional(),
+  environment: EnvironmentSchema3.optional(),
+  permissions: PermissionsSchema3.optional(),
+  healthCheck: HealthCheckSchema.optional()
+  // restartPolicy: RestartPolicySchema.optional(),
+});
+var InstanceSchema = z27.union([
+  LocalFileSchema.transform((code) => ({
+    code
+  })).pipe(ISchema),
+  ISchema
+]);
+var InstancesSchema = z27.record(ResourceIdSchema, InstanceSchema).optional().describe("Define the instances in your stack.");
+var InstanceDefaultSchema = z27.object({
+  image: ImageSchema2.optional(),
+  cpu: CpuSchema2.default(0.25),
+  memorySize: MemorySizeSchema3.default("512 MB"),
+  architecture: ArchitectureSchema4.default("arm64"),
+  environment: EnvironmentSchema3.optional(),
+  permissions: PermissionsSchema3.optional(),
+  healthCheck: HealthCheckSchema.optional(),
+  // restartPolicy: RestartPolicySchema.default({ enabled: true }),
+  log: LogSchema3.default(true).transform((log35) => ({
+    retention: log35.retention ?? days5(7)
+  }))
+}).default({});
+
 // src/feature/topic/schema.ts
 import { kebabCase as kebabCase3 } from "change-case";
-import { z as z27 } from "zod";
-var TopicNameSchema = z27.string().min(3).max(256).regex(/^[a-z0-9\-]+$/i, "Invalid topic name").transform((value) => kebabCase3(value)).describe("Define event topic name.");
-var TopicsDefaultSchema = z27.array(TopicNameSchema).refine((topics) => {
+import { z as z28 } from "zod";
+var TopicNameSchema = z28.string().min(3).max(256).regex(/^[a-z0-9\-]+$/i, "Invalid topic name").transform((value) => kebabCase3(value)).describe("Define event topic name.");
+var TopicsDefaultSchema = z28.array(TopicNameSchema).refine((topics) => {
   return topics.length === new Set(topics).size;
 }, "Must be a list of unique topic names").optional().describe("Define the event topics for your app.");
-var SubscribersSchema = z27.record(TopicNameSchema, TaskSchema).optional().describe("Define the event topics to subscribe too in your stack.");
+var SubscribersSchema = z28.record(TopicNameSchema, TaskSchema).optional().describe("Define the event topics to subscribe too in your stack.");
 
 // src/config/schema/region.ts
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 var US = ["us-east-2", "us-east-1", "us-west-1", "us-west-2"];
 var AF = ["af-south-1"];
 var AP = [
@@ -1891,16 +2014,16 @@ var EU = [
 var ME = ["me-south-1", "me-central-1"];
 var SA = ["sa-east-1"];
 var regions = [...US, ...AF, ...AP, ...CA, ...EU, ...ME, ...SA];
-var RegionSchema = z28.enum(regions);
+var RegionSchema = z29.enum(regions);
 
 // src/config/app.ts
-var AppSchema = z29.object({
-  $schema: z29.string().optional(),
+var AppSchema = z30.object({
+  $schema: z30.string().optional(),
   name: ResourceIdSchema.describe("App name."),
   region: RegionSchema.describe("The AWS region to deploy to."),
-  profile: z29.string().describe("The AWS profile to deploy to."),
-  protect: z29.boolean().default(false).describe("Protect your app & stacks from being deleted."),
-  removal: z29.enum(["remove", "retain"]).default("remove").describe(
+  profile: z30.string().describe("The AWS profile to deploy to."),
+  protect: z30.boolean().default(false).describe("Protect your app & stacks from being deleted."),
+  removal: z30.enum(["remove", "retain"]).default("remove").describe(
     [
       "Configure how your resources are handled when they have to be removed.",
       "",
@@ -1914,13 +2037,14 @@ var AppSchema = z29.object({
   // 	.default('prod')
   // 	.describe('The deployment stage.'),
   // onFailure: OnFailureSchema,
-  defaults: z29.object({
+  defaults: z30.object({
     onFailure: OnFailureDefaultSchema,
     onErrorLog: OnErrorLogDefaultSchema,
     auth: AuthDefaultSchema,
     domains: DomainsDefaultSchema,
     function: FunctionDefaultSchema,
     instance: InstanceDefaultSchema,
+    job: JobDefaultSchema,
     queue: QueueDefaultSchema,
     // graphql: GraphQLDefaultSchema,
     // http: HttpDefaultSchema,
@@ -1938,11 +2062,11 @@ var AppSchema = z29.object({
 });
 
 // src/config/stack.ts
-import { z as z44 } from "zod";
+import { z as z45 } from "zod";
 
 // src/feature/cache/schema.ts
 import { gibibytes as gibibytes2 } from "@awsless/size";
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 var StorageSchema = SizeSchema.refine(sizeMin(gibibytes2(1)), "Minimum storage size is 1 GB").refine(
   sizeMax(gibibytes2(5e3)),
   "Maximum storage size is 5000 GB"
@@ -1953,31 +2077,31 @@ var MinimumStorageSchema = StorageSchema.describe(
 var MaximumStorageSchema = StorageSchema.describe(
   "The upper limit for data storage the cache is set to use. You can specify a size value from 1 GB to 5000 GB."
 );
-var EcpuSchema = z30.number().int().min(1e3).max(15e6);
+var EcpuSchema = z31.number().int().min(1e3).max(15e6);
 var MinimumEcpuSchema = EcpuSchema.describe(
   "The minimum number of ECPUs the cache can consume per second. You can specify a integer from 1,000 to 15,000,000."
 );
 var MaximumEcpuSchema = EcpuSchema.describe(
   "The maximum number of ECPUs the cache can consume per second. You can specify a integer from 1,000 to 15,000,000."
 );
-var CachesSchema = z30.record(
+var CachesSchema = z31.record(
   ResourceIdSchema,
-  z30.object({
+  z31.object({
     minStorage: MinimumStorageSchema.optional(),
     maxStorage: MaximumStorageSchema.optional(),
     minECPU: MinimumEcpuSchema.optional(),
     maxECPU: MaximumEcpuSchema.optional(),
-    snapshotRetentionLimit: z30.number().int().positive().default(1)
+    snapshotRetentionLimit: z31.number().int().positive().default(1)
   })
 ).optional().describe("Define the caches in your stack. For access to the cache put your functions inside the global VPC.");
 
 // src/feature/command/schema.ts
-import { z as z31 } from "zod";
-var CommandSchema = z31.union([
-  z31.object({
+import { z as z32 } from "zod";
+var CommandSchema = z32.union([
+  z32.object({
     file: LocalFileSchema,
-    handler: z31.string().default("default").describe("The name of the handler that needs to run"),
-    description: z31.string().optional().describe("A description of the command")
+    handler: z32.string().default("default").describe("The name of the handler that needs to run"),
+    description: z32.string().optional().describe("A description of the command")
     // options: z.record(ResourceIdSchema, OptionSchema).optional(),
     // arguments: z.record(ResourceIdSchema, ArgumentSchema).optional(),
   }),
@@ -1987,22 +2111,22 @@ var CommandSchema = z31.union([
     description: void 0
   }))
 ]);
-var CommandsSchema = z31.record(ResourceIdSchema, CommandSchema).optional().describe("Define the custom commands for your stack.");
+var CommandsSchema = z32.record(ResourceIdSchema, CommandSchema).optional().describe("Define the custom commands for your stack.");
 
 // src/feature/config/schema.ts
-import { z as z32 } from "zod";
-var ConfigNameSchema = z32.string().regex(/[a-z0-9\-]/g, "Invalid config name");
-var ConfigsSchema = z32.array(ConfigNameSchema).optional().describe("Define the config values for your stack.");
+import { z as z33 } from "zod";
+var ConfigNameSchema = z33.string().regex(/[a-z0-9\-]/g, "Invalid config name");
+var ConfigsSchema = z33.array(ConfigNameSchema).optional().describe("Define the config values for your stack.");
 
 // src/feature/cron/schema/index.ts
-import { z as z34 } from "zod";
+import { z as z35 } from "zod";
 
 // src/feature/cron/schema/schedule.ts
-import { z as z33 } from "zod";
+import { z as z34 } from "zod";
 import { awsCronExpressionValidator } from "aws-cron-expression-validator";
-var RateExpressionSchema = z33.custom(
+var RateExpressionSchema = z34.custom(
   (value) => {
-    return z33.string().regex(/^[0-9]+ (seconds?|minutes?|hours?|days?)$/).refine((rate) => {
+    return z34.string().regex(/^[0-9]+ (seconds?|minutes?|hours?|days?)$/).refine((rate) => {
       const [str] = rate.split(" ");
       const number = parseInt(str);
       return number > 0;
@@ -2018,9 +2142,9 @@ var RateExpressionSchema = z33.custom(
   }
   return `rate(${rate})`;
 });
-var CronExpressionSchema = z33.custom(
+var CronExpressionSchema = z34.custom(
   (value) => {
-    return z33.string().safeParse(value).success;
+    return z34.string().safeParse(value).success;
   },
   { message: "Invalid cron expression" }
 ).superRefine((value, ctx) => {
@@ -2029,12 +2153,12 @@ var CronExpressionSchema = z33.custom(
   } catch (error) {
     if (error instanceof Error) {
       ctx.addIssue({
-        code: z33.ZodIssueCode.custom,
+        code: z34.ZodIssueCode.custom,
         message: `Invalid cron expression: ${error.message}`
       });
     } else {
       ctx.addIssue({
-        code: z33.ZodIssueCode.custom,
+        code: z34.ZodIssueCode.custom,
         message: "Invalid cron expression"
       });
     }
@@ -2045,32 +2169,32 @@ var CronExpressionSchema = z33.custom(
 var ScheduleExpressionSchema = RateExpressionSchema.or(CronExpressionSchema);
 
 // src/feature/cron/schema/index.ts
-var RetryAttemptsSchema4 = z34.number().int().min(0).max(2).describe(
+var RetryAttemptsSchema4 = z35.number().int().min(0).max(2).describe(
   "The maximum number of times to retry when the function returns an error. You can specify a number from 0 to 2."
 );
-var CronsSchema = z34.record(
+var CronsSchema = z35.record(
   ResourceIdSchema,
-  z34.object({
-    enabled: z34.boolean().default(true).describe("If the cron is enabled."),
+  z35.object({
+    enabled: z35.boolean().default(true).describe("If the cron is enabled."),
     consumer: FunctionSchema.describe("The consuming lambda function properties."),
     schedule: ScheduleExpressionSchema.describe(
       'The scheduling expression.\n\nexample: "0 20 * * ? *"\nexample: "5 minutes"'
     ),
-    payload: z34.unknown().optional().describe("The JSON payload that will be passed to the consumer."),
+    payload: z35.unknown().optional().describe("The JSON payload that will be passed to the consumer."),
     retryAttempts: RetryAttemptsSchema4.default(2)
   })
 ).optional().describe(`Define the cron jobs in your stack.`);
 
 // src/feature/search/schema.ts
 import { gibibytes as gibibytes3 } from "@awsless/size";
-import { z as z35 } from "zod";
-var VersionSchema = z35.union([
+import { z as z36 } from "zod";
+var VersionSchema = z36.union([
   //
-  z35.enum(["2.13", "2.11", "2.9", "2.7", "2.5", "2.3", "1.3"]),
-  z35.string()
+  z36.enum(["2.13", "2.11", "2.9", "2.7", "2.5", "2.3", "1.3"]),
+  z36.string()
 ]).describe("Specify the OpenSearch engine version.");
-var TypeSchema = z35.union([
-  z35.enum([
+var TypeSchema = z36.union([
+  z36.enum([
     "t3.small",
     "t3.medium",
     "m3.medium",
@@ -2144,13 +2268,13 @@ var TypeSchema = z35.union([
     "r6gd.12xlarge",
     "r6gd.16xlarge"
   ]),
-  z35.string()
+  z36.string()
 ]).describe("Instance type of data nodes in the cluster.");
-var CountSchema = z35.number().int().min(1).describe("Number of instances in the cluster.");
+var CountSchema = z36.number().int().min(1).describe("Number of instances in the cluster.");
 var StorageSizeSchema = SizeSchema.refine(sizeMin(gibibytes3(10)), "Minimum storage size is 10 GB").refine(sizeMax(gibibytes3(100)), "Maximum storage size is 100 GB").describe("The size of the function's /tmp directory. You can specify a size value from 512 MB to 10 GiB.");
-var SearchsSchema = z35.record(
+var SearchsSchema = z36.record(
   ResourceIdSchema,
-  z35.object({
+  z36.object({
     type: TypeSchema.default("t3.small"),
     count: CountSchema.default(1),
     version: VersionSchema.default("2.13"),
@@ -2161,12 +2285,12 @@ var SearchsSchema = z35.record(
 ).optional().describe("Define the search instances in your stack. Backed by OpenSearch.");
 
 // src/feature/site/schema.ts
-import { z as z37 } from "zod";
+import { z as z38 } from "zod";
 
 // src/config/schema/local-entry.ts
 import { stat as stat3 } from "fs/promises";
-import { z as z36 } from "zod";
-var LocalEntrySchema = z36.union([
+import { z as z37 } from "zod";
+var LocalEntrySchema = z37.union([
   RelativePathSchema.refine(async (path) => {
     try {
       const s = await stat3(path);
@@ -2175,7 +2299,7 @@ var LocalEntrySchema = z36.union([
       return false;
     }
   }, `File or directory doesn't exist`),
-  z36.object({
+  z37.object({
     nocheck: RelativePathSchema.describe(
       "Specifies a local file or directory without checking if the file or directory exists."
     )
@@ -2183,21 +2307,21 @@ var LocalEntrySchema = z36.union([
 ]);
 
 // src/feature/site/schema.ts
-var SitesSchema = z37.record(
+var SitesSchema = z38.record(
   ResourceIdSchema,
-  z37.object({
+  z38.object({
     router: ResourceIdSchema.describe("The router id to link your site with."),
     path: RouteSchema2.describe("The path inside the router to link your site to."),
-    build: z37.object({
-      command: z37.string().describe(
+    build: z38.object({
+      command: z38.string().describe(
         `Specifies the files and directories to generate the cache key for your custom build command.`
       ),
-      cacheKey: z37.union([LocalEntrySchema.transform((v) => [v]), LocalEntrySchema.array()]).describe(
+      cacheKey: z38.union([LocalEntrySchema.transform((v) => [v]), LocalEntrySchema.array()]).describe(
         `Specifies the files and directories to generate the cache key for your custom build command.`
       ),
-      configs: z37.string().array().optional().describe("Define the config values for your build command.")
+      configs: z38.string().array().optional().describe("Define the config values for your build command.")
     }).optional().describe(`Specifies the build process for sites that need a build step.`),
-    static: z37.union([LocalDirectorySchema, z37.boolean()]).optional().describe(
+    static: z38.union([LocalDirectorySchema, z38.boolean()]).optional().describe(
       "Specifies the path to the static files directory. Additionally you can also pass `true` when you don't have local static files, but still want to make an S3 bucket."
     ),
     ssr: FunctionSchema.optional().describe("Specifies the file that will render the site on the server.")
@@ -2205,21 +2329,21 @@ var SitesSchema = z37.record(
 ).optional().describe("Define the sites in your stack.");
 
 // src/feature/store/schema.ts
-import { z as z38 } from "zod";
-var StoresSchema = z38.union([
-  z38.array(ResourceIdSchema).transform((list3) => {
+import { z as z39 } from "zod";
+var StoresSchema = z39.union([
+  z39.array(ResourceIdSchema).transform((list3) => {
     const stores = {};
     for (const key of list3) {
       stores[key] = {};
     }
     return stores;
   }),
-  z38.record(
+  z39.record(
     ResourceIdSchema,
-    z38.object({
+    z39.object({
       static: LocalDirectorySchema.optional().describe("Specifies the path to the static files directory."),
-      versioning: z38.boolean().default(false).describe("Enable versioning of your store."),
-      events: z38.object({
+      versioning: z39.boolean().default(false).describe("Enable versioning of your store."),
+      events: z39.object({
         // create
         "created:*": TaskSchema.optional().describe(
           "Subscribe to notifications regardless of the API that was used to create an object."
@@ -2252,30 +2376,30 @@ var StoresSchema = z38.union([
 ]).optional().describe("Define the stores in your stack.");
 
 // src/feature/icon/schema.ts
-import { z as z39 } from "zod";
+import { z as z40 } from "zod";
 var staticOriginSchema = LocalDirectorySchema.describe(
   "Specifies the path to a local image directory that will be uploaded in S3."
 );
 var functionOriginSchema = FunctionSchema.describe(
   "Specifies the file that will be called when an image isn't found in the (cache) bucket."
 );
-var IconsSchema = z39.record(
+var IconsSchema = z40.record(
   ResourceIdSchema,
-  z39.object({
+  z40.object({
     // domain: ResourceIdSchema.describe('The domain id to link your site with.').optional(),
     // subDomain: z.string().optional(),
     router: ResourceIdSchema.describe("The router id to link your icon proxy."),
     path: RouteSchema2.describe("The path inside the router to link your icon proxy to."),
     log: LogSchema.optional(),
     cacheDuration: DurationSchema.optional().describe("The cache duration of the cached icons."),
-    preserveIds: z39.boolean().optional().default(false).describe("Preserve the IDs of the icons."),
-    symbols: z39.boolean().optional().default(false).describe(`Convert the SVG's to SVG symbols.`),
-    origin: z39.union([
-      z39.object({
+    preserveIds: z40.boolean().optional().default(false).describe("Preserve the IDs of the icons."),
+    symbols: z40.boolean().optional().default(false).describe(`Convert the SVG's to SVG symbols.`),
+    origin: z40.union([
+      z40.object({
         static: staticOriginSchema,
         function: functionOriginSchema.optional()
       }),
-      z39.object({
+      z40.object({
         static: staticOriginSchema.optional(),
         function: functionOriginSchema
       })
@@ -2302,13 +2426,13 @@ var IconsSchema = z39.record(
 ).optional().describe("Define an svg icon proxy in your stack. Store, optimize, and deliver svg icons at scale.");
 
 // src/feature/image/schema.ts
-import { z as z40 } from "zod";
-var transformationOptionsSchema = z40.object({
-  width: z40.number().int().positive().optional(),
-  height: z40.number().int().positive().optional(),
-  fit: z40.enum(["cover", "contain", "fill", "inside", "outside"]).optional(),
-  position: z40.enum(["top", "right top", "right", "right bottom", "bottom", "left bottom", "left", "left top", "center"]).optional(),
-  quality: z40.number().int().min(1).max(100).optional()
+import { z as z41 } from "zod";
+var transformationOptionsSchema = z41.object({
+  width: z41.number().int().positive().optional(),
+  height: z41.number().int().positive().optional(),
+  fit: z41.enum(["cover", "contain", "fill", "inside", "outside"]).optional(),
+  position: z41.enum(["top", "right top", "right", "right bottom", "bottom", "left bottom", "left", "left top", "center"]).optional(),
+  quality: z41.number().int().min(1).max(100).optional()
 });
 var staticOriginSchema2 = LocalDirectorySchema.describe(
   "Specifies the path to a local image directory that will be uploaded in S3."
@@ -2316,38 +2440,38 @@ var staticOriginSchema2 = LocalDirectorySchema.describe(
 var functionOriginSchema2 = FunctionSchema.describe(
   "Specifies the file that will be called when an image isn't found in the (cache) bucket."
 );
-var ImagesSchema = z40.record(
+var ImagesSchema = z41.record(
   ResourceIdSchema,
-  z40.object({
+  z41.object({
     // domain: ResourceIdSchema.describe('The domain id to link your site with.').optional(),
     // subDomain: z.string().optional(),
     router: ResourceIdSchema.describe("The router id to link your image proxy."),
     path: RouteSchema2.describe("The path inside the router to link your image proxy to."),
     log: LogSchema.optional(),
     cacheDuration: DurationSchema.optional().describe("Cache duration of the cached images."),
-    presets: z40.record(z40.string(), transformationOptionsSchema).describe("Named presets for image transformations"),
-    extensions: z40.object({
-      jpg: z40.object({
-        mozjpeg: z40.boolean().optional(),
-        progressive: z40.boolean().optional()
+    presets: z41.record(z41.string(), transformationOptionsSchema).describe("Named presets for image transformations"),
+    extensions: z41.object({
+      jpg: z41.object({
+        mozjpeg: z41.boolean().optional(),
+        progressive: z41.boolean().optional()
       }).optional(),
-      webp: z40.object({
-        effort: z40.number().int().min(1).max(10).default(7).optional(),
-        lossless: z40.boolean().optional(),
-        nearLossless: z40.boolean().optional()
+      webp: z41.object({
+        effort: z41.number().int().min(1).max(10).default(7).optional(),
+        lossless: z41.boolean().optional(),
+        nearLossless: z41.boolean().optional()
       }).optional(),
-      png: z40.object({
-        compressionLevel: z40.number().int().min(0).max(9).default(6).optional()
+      png: z41.object({
+        compressionLevel: z41.number().int().min(0).max(9).default(6).optional()
       }).optional()
     }).refine((data) => {
       return Object.keys(data).length > 0;
     }, "At least one extension must be defined.").describe("Specify the allowed extensions."),
-    origin: z40.union([
-      z40.object({
+    origin: z41.union([
+      z41.object({
         static: staticOriginSchema2,
         function: functionOriginSchema2.optional()
       }),
-      z40.object({
+      z41.object({
         static: staticOriginSchema2.optional(),
         function: functionOriginSchema2
       })
@@ -2362,7 +2486,7 @@ var ImagesSchema = z40.record(
 ).optional().describe("Define an image proxy in your stack. Store, transform, optimize, and deliver images at scale.");
 
 // src/feature/metric/schema.ts
-import { z as z41 } from "zod";
+import { z as z42 } from "zod";
 var ops = {
   ">": "GreaterThanThreshold",
   ">=": "GreaterThanOrEqualToThreshold",
@@ -2376,15 +2500,15 @@ var stats = {
   min: "Minimum",
   max: "Maximum"
 };
-var WhereSchema = z41.union([
-  z41.string().regex(/(count|avg|sum|min|max) (>|>=|<|<=) (\d)/, "Invalid where query").transform((where) => {
+var WhereSchema = z42.union([
+  z42.string().regex(/(count|avg|sum|min|max) (>|>=|<|<=) (\d)/, "Invalid where query").transform((where) => {
     const [stat4, op, value] = where.split(" ");
     return { stat: stat4, op, value: parseFloat(value) };
   }),
-  z41.object({
-    stat: z41.enum(["count", "avg", "sum", "min", "max"]),
-    op: z41.enum([">", ">=", "<", "<="]),
-    value: z41.number()
+  z42.object({
+    stat: z42.enum(["count", "avg", "sum", "min", "max"]),
+    op: z42.enum([">", ">=", "<", "<="]),
+    value: z42.number()
   })
 ]).transform((where) => {
   return {
@@ -2393,39 +2517,39 @@ var WhereSchema = z41.union([
     value: where.value
   };
 });
-var AlarmSchema = z41.object({
-  description: z41.string().optional(),
+var AlarmSchema = z42.object({
+  description: z42.string().optional(),
   where: WhereSchema,
   period: DurationSchema,
-  minDataPoints: z41.number().int().default(1),
-  trigger: z41.union([EmailSchema.transform((v) => [v]), EmailSchema.array(), FunctionSchema])
+  minDataPoints: z42.number().int().default(1),
+  trigger: z42.union([EmailSchema.transform((v) => [v]), EmailSchema.array(), FunctionSchema])
 });
-var MetricsSchema = z41.record(
+var MetricsSchema = z42.record(
   ResourceIdSchema,
-  z41.object({
-    type: z41.enum(["number", "size", "duration"]),
+  z42.object({
+    type: z42.enum(["number", "size", "duration"]),
     alarms: AlarmSchema.array().optional()
   })
 ).optional().describe("Define the metrics in your stack.");
 
 // src/feature/table/schema.ts
-import { minutes as minutes5, seconds as seconds4 } from "@awsless/duration";
-import { z as z42 } from "zod";
-var KeySchema = z42.string().min(1).max(255);
-var TablesSchema = z42.record(
+import { minutes as minutes6, seconds as seconds4 } from "@awsless/duration";
+import { z as z43 } from "zod";
+var KeySchema = z43.string().min(1).max(255);
+var TablesSchema = z43.record(
   ResourceIdSchema,
-  z42.object({
+  z43.object({
     hash: KeySchema.describe(
       "Specifies the name of the partition / hash key that makes up the primary key for the table."
     ),
     sort: KeySchema.optional().describe(
       "Specifies the name of the range / sort key that makes up the primary key for the table."
     ),
-    fields: z42.record(z42.string(), z42.enum(["string", "number", "binary"])).optional().describe(
+    fields: z43.record(z43.string(), z43.enum(["string", "number", "binary"])).optional().describe(
       'A list of attributes that describe the key schema for the table and indexes. If no attribute field is defined we default to "string".'
     ),
-    class: z42.enum(["standard", "standard-infrequent-access"]).default("standard").describe("The table class of the table."),
-    pointInTimeRecovery: z42.boolean().default(false).describe("Indicates whether point in time recovery is enabled on the table."),
+    class: z43.enum(["standard", "standard-infrequent-access"]).default("standard").describe("The table class of the table."),
+    pointInTimeRecovery: z43.boolean().default(false).describe("Indicates whether point in time recovery is enabled on the table."),
     ttl: KeySchema.optional().describe(
       [
         "The name of the TTL attribute used to store the expiration time for items in the table.",
@@ -2433,8 +2557,8 @@ var TablesSchema = z42.record(
       ].join("\n")
     ),
     // deletionProtection: DeletionProtectionSchema.optional(),
-    stream: z42.object({
-      type: z42.enum(["keys-only", "new-image", "old-image", "new-and-old-images"]).describe(
+    stream: z43.object({
+      type: z43.enum(["keys-only", "new-image", "old-image", "new-and-old-images"]).describe(
         [
           "When an item in the table is modified, you can determines what information is written to the stream for this table.",
           "Valid values are:",
@@ -2444,7 +2568,7 @@ var TablesSchema = z42.record(
           "- new-and-old-images - Both the new and the old item images of the item are written to the stream."
         ].join("\n")
       ),
-      batchSize: z42.number().min(1).max(1e4).default(1).describe(
+      batchSize: z43.number().min(1).max(1e4).default(1).describe(
         [
           "The maximum number of records in each batch that Lambda pulls from your stream and sends to your function.",
           "Lambda passes all of the records in the batch to the function in a single call, up to the payload limit for synchronous invocation (6 MB).",
@@ -2454,7 +2578,7 @@ var TablesSchema = z42.record(
       batchWindow: DurationSchema.refine(
         durationMin(seconds4(1)),
         "Minimum batch window duration is 1 second"
-      ).refine(durationMax(minutes5(5)), "Maximum batch window duration is 5 minutes").optional().describe(
+      ).refine(durationMax(minutes6(5)), "Maximum batch window duration is 5 minutes").optional().describe(
         [
           "The maximum amount of time that is spend gathering records before invoking the function.",
           "You can specify a duration from 1 seconds to 5 minutes."
@@ -2473,7 +2597,7 @@ var TablesSchema = z42.record(
       // 			'The default value is 60s',
       // 		].join('\n')
       // 	),
-      retryAttempts: z42.number().min(-1).max(1e4).default(2).describe(
+      retryAttempts: z43.number().min(-1).max(1e4).default(2).describe(
         [
           "Discard records after the specified number of retries.",
           "-1 will sets the maximum number of retries to infinite.",
@@ -2482,7 +2606,7 @@ var TablesSchema = z42.record(
           "The default value is 2"
         ].join("\n")
       ),
-      concurrencyPerShard: z42.number().min(1).max(10).default(1).describe(
+      concurrencyPerShard: z43.number().min(1).max(10).default(1).describe(
         [
           "The number of batches to process concurrently from each shard.",
           "You can specify a number from 1 to 10."
@@ -2492,16 +2616,16 @@ var TablesSchema = z42.record(
     }).optional().describe(
       "The settings for the DynamoDB table stream, which capture changes to items stored in the table."
     ),
-    indexes: z42.record(
-      z42.string(),
-      z42.object({
-        hash: z42.union([KeySchema.transform((v) => [v]), KeySchema.array()]).describe(
+    indexes: z43.record(
+      z43.string(),
+      z43.object({
+        hash: z43.union([KeySchema.transform((v) => [v]), KeySchema.array()]).describe(
           "Specifies the name of the partition / hash key that makes up the primary key for the global secondary index."
         ),
-        sort: z42.union([KeySchema.transform((v) => [v]), KeySchema.array()]).optional().describe(
+        sort: z43.union([KeySchema.transform((v) => [v]), KeySchema.array()]).optional().describe(
           "Specifies the name of the range / sort key that makes up the primary key for the global secondary index."
         ),
-        projection: z42.enum(["all", "keys-only"]).default("all").describe(
+        projection: z43.enum(["all", "keys-only"]).default("all").describe(
           [
             "The set of attributes that are projected into the index:",
             "- all - All of the table attributes are projected into the index.",
@@ -2515,12 +2639,12 @@ var TablesSchema = z42.record(
 ).optional().describe("Define the tables in your stack.");
 
 // src/feature/test/schema.ts
-import { z as z43 } from "zod";
-var TestsSchema = z43.union([
+import { z as z44 } from "zod";
+var TestsSchema = z44.union([
   //
   LocalDirectorySchema.transform((v) => [v]),
   LocalDirectorySchema.array(),
-  z43.literal(false)
+  z44.literal(false)
 ]).describe("Define the location of your tests for your stack.").optional();
 
 // src/config/stack.ts
@@ -2528,8 +2652,8 @@ var DependsSchema = ResourceIdSchema.array().optional().describe("Define the sta
 var NameSchema = ResourceIdSchema.refine((name) => !["base", "hostedzones"].includes(name), {
   message: `Stack name can't be a reserved name.`
 }).describe("Stack name.");
-var StackSchema = z44.object({
-  $schema: z44.string().optional(),
+var StackSchema = z45.object({
+  $schema: z45.string().optional(),
   name: NameSchema,
   depends: DependsSchema,
   commands: CommandsSchema,
@@ -2546,6 +2670,7 @@ var StackSchema = z44.object({
   subscribers: SubscribersSchema,
   functions: FunctionsSchema,
   instances: InstancesSchema,
+  jobs: JobsSchema,
   tasks: TasksSchema,
   tables: TablesSchema,
   stores: StoresSchema,
@@ -2566,37 +2691,37 @@ import { basename, dirname as dirname2, extname, join as join4 } from "path";
 
 // src/config/stage-patch.ts
 import jsonPatch from "fast-json-patch";
-import { z as z45 } from "zod";
-var AddOperationSchema = z45.object({
-  op: z45.literal("add"),
-  path: z45.string(),
-  value: z45.unknown()
+import { z as z46 } from "zod";
+var AddOperationSchema = z46.object({
+  op: z46.literal("add"),
+  path: z46.string(),
+  value: z46.unknown()
 }).strict();
-var RemoveOperationSchema = z45.object({
-  op: z45.literal("remove"),
-  path: z45.string()
+var RemoveOperationSchema = z46.object({
+  op: z46.literal("remove"),
+  path: z46.string()
 }).strict();
-var ReplaceOperationSchema = z45.object({
-  op: z45.literal("replace"),
-  path: z45.string(),
-  value: z45.unknown()
+var ReplaceOperationSchema = z46.object({
+  op: z46.literal("replace"),
+  path: z46.string(),
+  value: z46.unknown()
 }).strict();
-var MoveOperationSchema = z45.object({
-  op: z45.literal("move"),
-  from: z45.string(),
-  path: z45.string()
+var MoveOperationSchema = z46.object({
+  op: z46.literal("move"),
+  from: z46.string(),
+  path: z46.string()
 }).strict();
-var CopyOperationSchema = z45.object({
-  op: z45.literal("copy"),
-  from: z45.string(),
-  path: z45.string()
+var CopyOperationSchema = z46.object({
+  op: z46.literal("copy"),
+  from: z46.string(),
+  path: z46.string()
 }).strict();
-var TestOperationSchema = z45.object({
-  op: z45.literal("test"),
-  path: z45.string(),
-  value: z45.unknown()
+var TestOperationSchema = z46.object({
+  op: z46.literal("test"),
+  path: z46.string(),
+  value: z46.unknown()
 }).strict();
-var JsonPatchOperationSchema = z45.discriminatedUnion("op", [
+var JsonPatchOperationSchema = z46.discriminatedUnion("op", [
   AddOperationSchema,
   RemoveOperationSchema,
   ReplaceOperationSchema,
@@ -2604,8 +2729,8 @@ var JsonPatchOperationSchema = z45.discriminatedUnion("op", [
   CopyOperationSchema,
   TestOperationSchema
 ]);
-var StagePatchSchema = z45.object({
-  $schema: z45.string().optional(),
+var StagePatchSchema = z46.object({
+  $schema: z46.string().optional(),
   operations: JsonPatchOperationSchema.array()
 }).strict();
 var applyStagePatch = (source, patch, file) => {
@@ -2621,13 +2746,13 @@ var applyStagePatch = (source, patch, file) => {
 };
 
 // src/config/load/validate.ts
-import { z as z46 } from "zod";
+import { z as z47 } from "zod";
 var validateConfig = async (schema, file, data) => {
   try {
     const result = await schema.parseAsync(data);
     return result;
   } catch (error) {
-    if (error instanceof z46.ZodError) {
+    if (error instanceof z47.ZodError) {
       throw new ConfigError(file, error, data);
     }
     throw error;
@@ -2862,7 +2987,7 @@ var generateGlobalAppId = (opt) => {
 };
 
 // src/feature/auth/index.ts
-import { toDays as toDays3, toHours } from "@awsless/duration";
+import { toDays as toDays4, toHours } from "@awsless/duration";
 var authFeature = defineFeature({
   name: "auth",
   async onTypeGen(ctx) {
@@ -2995,7 +3120,7 @@ var authFeature = defineFeature({
             requireUppercase: props.password.uppercase,
             requireNumbers: props.password.numbers,
             requireSymbols: props.password.symbols,
-            temporaryPasswordValidityDays: toDays3(props.password.temporaryPasswordValidity)
+            temporaryPasswordValidityDays: toDays4(props.password.temporaryPasswordValidity)
           },
           deletionProtection: ctx.appConfig.removal === "retain" ? "ACTIVE" : "INACTIVE"
         },
@@ -3009,7 +3134,7 @@ var authFeature = defineFeature({
         name,
         idTokenValidity: toHours(props.validity.idToken),
         accessTokenValidity: toHours(props.validity.accessToken),
-        refreshTokenValidity: toDays3(props.validity.refreshToken),
+        refreshTokenValidity: toDays4(props.validity.refreshToken),
         tokenValidityUnits: [
           {
             idToken: "hours",
@@ -3467,8 +3592,8 @@ var zipFiles = (files) => {
 };
 
 // src/feature/function/util.ts
-import { toDays as toDays4, toSeconds } from "@awsless/duration";
-import { toMebibytes as toMebibytes2 } from "@awsless/size";
+import { toDays as toDays5, toSeconds } from "@awsless/duration";
+import { toMebibytes as toMebibytes3 } from "@awsless/size";
 import { pascalCase } from "change-case";
 
 // src/util/cache.ts
@@ -3763,9 +3888,9 @@ var createLambdaFunction = (parentGroup, ctx, ns, id, local) => {
   const policy = new aws4.iam.RolePolicy(group, "policy", {
     role: role.name,
     name: "lambda-policy",
-    policy: new Output3(statementDeps, async (resolve) => {
+    policy: new Output3(statementDeps, async (resolve2) => {
       const list3 = await resolveInputs(statements);
-      resolve(
+      resolve2(
         JSON.stringify({
           Version: "2012-10-17",
           Statement: list3.map((statement) => ({
@@ -3827,7 +3952,7 @@ var createLambdaFunction = (parentGroup, ctx, ns, id, local) => {
       runtime: props.runtime,
       handler: props.handler,
       timeout: toSeconds(props.timeout),
-      memorySize: toMebibytes2(props.memorySize),
+      memorySize: toMebibytes3(props.memorySize),
       architectures: [props.architecture],
       timeouts: {
         create: "30s",
@@ -3882,7 +4007,7 @@ var createLambdaFunction = (parentGroup, ctx, ns, id, local) => {
     const logGroup = new aws4.cloudwatch.LogGroup(group, "log", {
       // name: lambda.functionName.pipe(name => `/aws/lambda/${name}`),
       name: `/aws/lambda/${name}`,
-      retentionInDays: toDays4(props.log.retention)
+      retentionInDays: toDays5(props.log.retention)
     });
     addPermission({
       actions: ["logs:PutLogEvents", "logs:CreateLogStream"],
@@ -4129,7 +4254,7 @@ var cronFeature = defineFeature({
 });
 
 // src/feature/domain/index.ts
-import { minutes as minutes6, toSeconds as toSeconds2 } from "@awsless/duration";
+import { minutes as minutes7, toSeconds as toSeconds2 } from "@awsless/duration";
 import { Group as Group5 } from "@terraforge/core";
 import { aws as aws6 } from "@terraforge/aws";
 var domainFeature = defineFeature({
@@ -4171,7 +4296,7 @@ var domainFeature = defineFeature({
         zoneId: zone.id,
         name: option(certificate, 0).pipe((r) => r.resourceRecordName),
         type: option(certificate, 0).pipe((r) => r.resourceRecordType),
-        ttl: toSeconds2(minutes6(5)),
+        ttl: toSeconds2(minutes7(5)),
         records: [option(certificate, 0).pipe((r) => r.resourceRecordValue)],
         allowOverwrite: true
       });
@@ -4179,7 +4304,7 @@ var domainFeature = defineFeature({
         zoneId: zone.id,
         name: option(certificate, 1).pipe((r) => r.resourceRecordName),
         type: option(certificate, 1).pipe((r) => r.resourceRecordType),
-        ttl: toSeconds2(minutes6(5)),
+        ttl: toSeconds2(minutes7(5)),
         records: [option(certificate, 1).pipe((r) => r.resourceRecordValue)],
         allowOverwrite: true
       });
@@ -4214,7 +4339,7 @@ var domainFeature = defineFeature({
           zoneId: zone.id,
           name: option(globalCertificate, 0).pipe((r) => r.resourceRecordName),
           type: option(globalCertificate, 0).pipe((r) => r.resourceRecordType),
-          ttl: toSeconds2(minutes6(5)),
+          ttl: toSeconds2(minutes7(5)),
           records: [option(globalCertificate, 0).pipe((r) => r.resourceRecordValue)],
           allowOverwrite: true
         });
@@ -4222,7 +4347,7 @@ var domainFeature = defineFeature({
           zoneId: zone.id,
           name: option(globalCertificate, 1).pipe((r) => r.resourceRecordName),
           type: option(globalCertificate, 1).pipe((r) => r.resourceRecordType),
-          ttl: toSeconds2(minutes6(5)),
+          ttl: toSeconds2(minutes7(5)),
           records: [option(globalCertificate, 1).pipe((r) => r.resourceRecordValue)],
           allowOverwrite: true
         });
@@ -4248,7 +4373,7 @@ var domainFeature = defineFeature({
         zoneId: zone.id,
         name: `_amazonses.${props.domain}`,
         type: "TXT",
-        ttl: toSeconds2(minutes6(5)),
+        ttl: toSeconds2(minutes7(5)),
         records: [identity.verificationToken]
       });
       const dkim = new aws6.ses.DomainDkim(group2, "dkim", {
@@ -4259,7 +4384,7 @@ var domainFeature = defineFeature({
           zoneId: zone.id,
           type: "CNAME",
           name: dkim.dkimTokens.pipe((t) => `${t.at(i)}._domainkey`),
-          ttl: toSeconds2(minutes6(5)),
+          ttl: toSeconds2(minutes7(5)),
           records: [dkim.dkimTokens.pipe((t) => `${t.at(i)}.dkim.amazonses.com`)]
         });
       }
@@ -4272,21 +4397,21 @@ var domainFeature = defineFeature({
         zoneId: zone.id,
         name: mailFrom.mailFromDomain,
         type: "MX",
-        ttl: toSeconds2(minutes6(5)),
+        ttl: toSeconds2(minutes7(5)),
         records: [`10 feedback-smtp.${ctx.appConfig.region}.amazonses.com`]
       });
       new aws6.route53.Record(group2, `SPF`, {
         zoneId: zone.id,
         name: mailFrom.mailFromDomain,
         type: "TXT",
-        ttl: toSeconds2(minutes6(5)),
+        ttl: toSeconds2(minutes7(5)),
         records: ["v=spf1 include:amazonses.com -all"]
       });
       new aws6.route53.Record(group2, `DMARC`, {
         zoneId: zone.id,
         name: `_dmarc.${props.domain}`,
         type: "TXT",
-        ttl: toSeconds2(minutes6(5)),
+        ttl: toSeconds2(minutes7(5)),
         records: ["v=DMARC1; p=none;"]
       });
       const verification = new aws6.ses.DomainIdentityVerification(
@@ -4443,8 +4568,8 @@ var functionFeature = defineFeature({
 });
 
 // src/feature/function/prebuild.ts
-import { days as days5, seconds as seconds5, toDays as toDays5, toSeconds as toSeconds3 } from "@awsless/duration";
-import { mebibytes as mebibytes2, toMebibytes as toMebibytes3 } from "@awsless/size";
+import { days as days6, seconds as seconds5, toDays as toDays6, toSeconds as toSeconds3 } from "@awsless/duration";
+import { mebibytes as mebibytes2, toMebibytes as toMebibytes4 } from "@awsless/size";
 import { aws as aws8 } from "@terraforge/aws";
 import { Output as Output4, findInputDeps as findInputDeps2, resolveInputs as resolveInputs2 } from "@terraforge/core";
 import { pascalCase as pascalCase2 } from "change-case";
@@ -4514,9 +4639,9 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, props) => {
   const policy = new aws8.iam.RolePolicy(group, "policy", {
     role: role.name,
     name: "lambda-policy",
-    policy: new Output4(statementDeps, async (resolve) => {
+    policy: new Output4(statementDeps, async (resolve2) => {
       const list3 = await resolveInputs2(statements);
-      resolve(
+      resolve2(
         JSON.stringify({
           Version: "2012-10-17",
           Statement: list3.map((statement) => ({
@@ -4541,7 +4666,7 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, props) => {
     runtime: props.runtime,
     handler: props.handler,
     timeout: toSeconds3(props.timeout ?? seconds5(10)),
-    memorySize: toMebibytes3(props.memorySize ?? mebibytes2(128)),
+    memorySize: toMebibytes4(props.memorySize ?? mebibytes2(128)),
     architectures: [props.architecture ?? "arm64"],
     layers: props.layers?.map((id2) => ctx.shared.entry("layer", "arn", id2)),
     s3Bucket: code.bucket,
@@ -4575,7 +4700,7 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, props) => {
   if (props.log?.retention && props.log?.retention?.value > 0n) {
     const logGroup = new aws8.cloudwatch.LogGroup(group, "log", {
       name: `/aws/lambda/${name}`,
-      retentionInDays: toDays5(props.log.retention ?? days5(7))
+      retentionInDays: toDays6(props.log.retention ?? days6(7))
     });
     addPermission({
       actions: ["logs:PutLogEvents", "logs:CreateLogStream"],
@@ -4632,7 +4757,7 @@ import { Group as Group8 } from "@terraforge/core";
 import { aws as aws9 } from "@terraforge/aws";
 import { join as join10 } from "path";
 import { mebibytes as mebibytes3 } from "@awsless/size";
-import { days as days6, seconds as seconds6 } from "@awsless/duration";
+import { days as days7, seconds as seconds6 } from "@awsless/duration";
 var onErrorLogFeature = defineFeature({
   name: "on-error-log",
   onApp(ctx) {
@@ -4647,7 +4772,7 @@ var onErrorLogFeature = defineFeature({
       log: {
         format: "json",
         level: "warn",
-        retention: days6(3),
+        retention: days7(3),
         system: "warn"
       }
     });
@@ -4704,7 +4829,7 @@ import { Group as Group9 } from "@terraforge/core";
 import { aws as aws10 } from "@terraforge/aws";
 import { join as join11 } from "path";
 import { mebibytes as mebibytes4 } from "@awsless/size";
-import { days as days7, toSeconds as toSeconds4 } from "@awsless/duration";
+import { days as days8, toSeconds as toSeconds4 } from "@awsless/duration";
 var onFailureFeature = defineFeature({
   name: "on-failure",
   onApp(ctx) {
@@ -4715,7 +4840,7 @@ var onFailureFeature = defineFeature({
         resourceType: "on-failure",
         resourceName: "deadletter"
       }),
-      messageRetentionSeconds: toSeconds4(days7(14))
+      messageRetentionSeconds: toSeconds4(days8(14))
     });
     const queue2 = new aws10.sqs.Queue(group, "on-failure", {
       name: formatGlobalResourceName({
@@ -4863,7 +4988,7 @@ var onFailureFeature = defineFeature({
         log: {
           format: "json",
           level: "warn",
-          retention: days7(3),
+          retention: days8(3),
           system: "warn"
         }
       });
@@ -4961,7 +5086,7 @@ var formatFullDomainName = (config2, id, subDomain) => {
 };
 
 // src/feature/pubsub/index.ts
-import { minutes as minutes7, toSeconds as toSeconds5 } from "@awsless/duration";
+import { minutes as minutes8, toSeconds as toSeconds5 } from "@awsless/duration";
 var pubsubFeature = defineFeature({
   name: "pubsub",
   onApp(ctx) {
@@ -5012,7 +5137,7 @@ var pubsubFeature = defineFeature({
           zoneId: ctx.shared.entry("domain", `zone-id`, props.domain),
           name: domainName,
           type: "CNAME",
-          ttl: toSeconds5(minutes7(5)),
+          ttl: toSeconds5(minutes8(5)),
           records: [endpoint.endpointAddress]
         });
         ctx.bind(`PUBSUB_${constantCase5(id)}_ENDPOINT`, domainName);
@@ -6762,7 +6887,7 @@ import { Group as Group23 } from "@terraforge/core";
 import { aws as aws24 } from "@terraforge/aws";
 import { join as join15, dirname as dirname7 } from "path";
 import { mebibytes as mebibytes6 } from "@awsless/size";
-import { seconds as seconds8, toDays as toDays6 } from "@awsless/duration";
+import { seconds as seconds8, toDays as toDays7 } from "@awsless/duration";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { glob as glob4 } from "glob";
 var __dirname3 = dirname7(fileURLToPath2(import.meta.url));
@@ -6853,7 +6978,7 @@ var imageFeature = defineFeature({
               enabled: true,
               id: "image-cache-duration",
               expiration: {
-                days: toDays6(props.cacheDuration)
+                days: toDays7(props.cacheDuration)
               }
             }
           ]
@@ -6959,7 +7084,7 @@ import { Group as Group24 } from "@terraforge/core";
 import { aws as aws25 } from "@terraforge/aws";
 import { join as join16, dirname as dirname8 } from "path";
 import { mebibytes as mebibytes7 } from "@awsless/size";
-import { seconds as seconds9, toDays as toDays7 } from "@awsless/duration";
+import { seconds as seconds9, toDays as toDays8 } from "@awsless/duration";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { glob as glob5 } from "glob";
 var __dirname4 = dirname8(fileURLToPath3(import.meta.url));
@@ -7004,7 +7129,7 @@ var iconFeature = defineFeature({
               enabled: true,
               id: "icon-cache-duration",
               expiration: {
-                days: toDays7(props.cacheDuration)
+                days: toDays8(props.cacheDuration)
               }
             }
           ]
@@ -7102,31 +7227,42 @@ var iconFeature = defineFeature({
   }
 });
 
-// src/feature/instance/index.ts
-import { Group as Group26 } from "@terraforge/core";
+// src/feature/job/index.ts
+import { Group as Group26, Output as Output7, resolveInputs as resolveInputs4, findInputDeps as findInputDeps4 } from "@terraforge/core";
 import { aws as aws27 } from "@terraforge/aws";
+import { camelCase as camelCase8 } from "change-case";
+import { relative as relative8 } from "path";
 
-// src/feature/instance/util.ts
-import { toDays as toDays8, toSeconds as toSeconds9 } from "@awsless/duration";
-import { toMebibytes as toMebibytes4 } from "@awsless/size";
+// src/feature/job/util.ts
+import { toDays as toDays9, toSeconds as toSeconds9 } from "@awsless/duration";
+import { toMebibytes as toMebibytes5 } from "@awsless/size";
 import { generateFileHash as generateFileHash2 } from "@awsless/ts-file-cache";
 import { aws as aws26 } from "@terraforge/aws";
 import { Group as Group25, Output as Output6, findInputDeps as findInputDeps3, resolveInputs as resolveInputs3 } from "@terraforge/core";
 import { constantCase as constantCase12, pascalCase as pascalCase3 } from "change-case";
 import deepmerge4 from "deepmerge";
-import { join as join18 } from "path";
 
-// src/feature/instance/build/executable.ts
+// src/feature/job/build/executable.ts
 import { createHash as createHash3 } from "crypto";
-import { readFile as readFile4 } from "fs/promises";
-import { join as join17 } from "path";
-var buildExecutable = async (input, outputPath, architecture) => {
+import { readFile as readFile4, writeFile as writeFile3 } from "fs/promises";
+import { join as join17, resolve } from "path";
+var buildJobExecutable = async (input, outputPath, architecture) => {
   const filePath = join17(outputPath, "program");
+  const wrapperPath = join17(outputPath, "wrapper.ts");
+  const handlerPath = resolve(input);
+  await writeFile3(
+    wrapperPath,
+    [
+      `import handler from '${handlerPath}'`,
+      `const payload = JSON.parse(process.env.PAYLOAD || '{}')`,
+      `await handler(payload)`
+    ].join("\n")
+  );
   const target = architecture === "x86_64" ? "bun-linux-x64" : "bun-linux-arm64";
   let result;
   try {
     result = await Bun.build({
-      entrypoints: [input],
+      entrypoints: [wrapperPath],
       compile: {
         target,
         outfile: filePath
@@ -7135,23 +7271,23 @@ var buildExecutable = async (input, outputPath, architecture) => {
     });
   } catch (error) {
     throw new ExpectedError(
-      `Executable build failed: ${error instanceof Error ? error.message : JSON.stringify(error)}`
+      `Job executable build failed: ${error instanceof Error ? error.message : JSON.stringify(error)}`
     );
   }
   if (!result.success) {
-    throw new ExpectedError(`Executable build failed:
+    throw new ExpectedError(`Job executable build failed:
 ${result.logs?.map((log35) => log35.message).join("\n")}`);
   }
   const file = await readFile4(filePath);
   return {
-    hash: createHash3("sha1").update(file).update("x86_64").digest("hex"),
+    hash: createHash3("sha1").update(file).update(architecture).digest("hex"),
     file
   };
 };
 
-// src/feature/instance/util.ts
-var createFargateTask = (parentGroup, ctx, ns, id, local) => {
-  const group = new Group25(parentGroup, "instance", ns);
+// src/feature/job/util.ts
+var createFargateJob = (parentGroup, ctx, ns, id, local) => {
+  const group = new Group25(parentGroup, "job", ns);
   const name = formatLocalResourceName({
     appName: ctx.app.name,
     stackName: ctx.stack.name,
@@ -7159,13 +7295,13 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
     resourceName: id
   });
   const shortName = shortId(`${ctx.app.name}:${ctx.stack.name}:${ns}:${id}:${ctx.appId}`);
-  const props = deepmerge4(ctx.appConfig.defaults.instance, local);
+  const props = deepmerge4(ctx.appConfig.defaults.job, local);
   const image2 = props.image || (props.architecture === "arm64" ? "public.ecr.aws/aws-cli/aws-cli:arm64" : "public.ecr.aws/aws-cli/aws-cli:amd64");
-  ctx.registerBuild("instance", name, async (build3, { workspace }) => {
+  ctx.registerBuild("job", name, async (build3, { workspace }) => {
     const fingerprint = await generateFileHash2(workspace, local.code.file);
     return build3(fingerprint, async (write) => {
-      const temp = await createTempFolder(`instance--${name}`);
-      const executable = await buildExecutable(local.code.file, temp.path, props.architecture);
+      const temp = await createTempFolder(`job--${name}`);
+      const executable = await buildJobExecutable(local.code.file, temp.path, props.architecture);
       await Promise.all([
         //
         write("HASH", executable.hash),
@@ -7178,10 +7314,10 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
     });
   });
   const code = new aws26.s3.BucketObject(group, "code", {
-    bucket: ctx.shared.get("instance", "bucket-name"),
+    bucket: ctx.shared.get("job", "bucket-name"),
     key: name,
-    source: relativePath(getBuildPath("instance", name, "program")),
-    sourceHash: $file(getBuildPath("instance", name, "HASH"))
+    source: relativePath(getBuildPath("job", name, "program")),
+    sourceHash: $file(getBuildPath("job", name, "HASH"))
   });
   const executionRole = new aws26.iam.Role(group, "execution-role", {
     name: shortId(`${shortName}:execution-role`),
@@ -7245,9 +7381,9 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   const policy = new aws26.iam.RolePolicy(group, "policy", {
     role: role.name,
     name: "task-policy",
-    policy: new Output6(statementDeps, async (resolve) => {
+    policy: new Output6(statementDeps, async (resolve2) => {
       const list3 = await resolveInputs3(statements);
-      resolve(
+      resolve2(
         JSON.stringify({
           Version: "2012-10-17",
           Statement: list3.map((statement) => ({
@@ -7272,8 +7408,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   if (props.log.retention && props.log.retention.value > 0n) {
     logGroup = new aws26.cloudwatch.LogGroup(group, "log", {
       name: `/aws/ecs/${name}`,
-      // name: `/aws/lambda/${name}`,
-      retentionInDays: toDays8(props.log.retention)
+      retentionInDays: toDays9(props.log.retention)
     });
     if (ctx.shared.has("on-error-log", "subscriber-arn")) {
       new aws26.cloudwatch.LogSubscriptionFilter(group, "on-error-log", {
@@ -7298,7 +7433,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
       family: name,
       networkMode: "awsvpc",
       cpu: props.cpu,
-      memory: toMebibytes4(props.memorySize).toString(),
+      memory: toMebibytes5(props.memorySize).toString(),
       requiresCompatibilities: ["FARGATE"],
       executionRoleArn: executionRole.arn,
       taskRoleArn: role.arn,
@@ -7307,13 +7442,13 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
         operatingSystemFamily: "LINUX"
       },
       trackLatest: true,
-      containerDefinitions: new Output6(variableDeps, async (resolve) => {
+      containerDefinitions: new Output6(variableDeps, async (resolve2) => {
         const data = await resolveInputs3(variables);
         const { s3Bucket, s3Key } = await resolveInputs3({
           s3Bucket: code.bucket,
           s3Key: code.key
         });
-        resolve(
+        resolve2(
           JSON.stringify([
             {
               name: `container-${id}`,
@@ -7326,50 +7461,25 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
                 [
                   `aws s3 cp s3://${s3Bucket}/${s3Key} /usr/app/program`,
                   `chmod +x /usr/app/program`,
-                  `/usr/app/program`
+                  ...props.startupCommand ?? [],
+                  `exec timeout ${toSeconds9(props.timeout)} /usr/app/program`
                 ].join(" && ")
               ],
               environment: Object.entries(data).map(([name2, value]) => ({
                 name: name2,
                 value
               })),
-              portMappings: [
-                {
-                  name: "http",
-                  protocol: "tcp",
-                  appProtocol: "http",
-                  containerPort: 80,
-                  hostPort: 80
-                }
-              ],
-              restartPolicy: {
-                enabled: true,
-                restartAttemptPeriod: 60
-              },
               ...logGroup && {
                 logConfiguration: {
                   logDriver: "awslogs",
                   options: {
-                    // 'awslogs-group': `/aws/ecs/${name}`,
-                    "awslogs-group": `/aws/lambda/${name}`,
+                    "awslogs-group": `/aws/ecs/${name}`,
                     "awslogs-region": ctx.appConfig.region,
                     "awslogs-stream-prefix": "ecs",
                     mode: "non-blocking"
-                    // 'awslogs-multiline-pattern': '',
-                    // 'max-buffer-size': '100m',
                   }
                 }
-              },
-              healthCheck: props.healthCheck ? {
-                command: [
-                  "CMD-SHELL",
-                  `curl -f http://${join18("localhost", props.healthCheck.path)} || exit 1`
-                ],
-                interval: toSeconds9(props.healthCheck.interval),
-                retries: props.healthCheck.retries,
-                startPeriod: toSeconds9(props.healthCheck.startPeriod),
-                timeout: toSeconds9(props.healthCheck.timeout)
-              } : void 0
+              }
             }
           ])
         );
@@ -7388,52 +7498,506 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
       dependsOn: [code]
     }
   );
-  const securityGroup = new aws26.security.Group(group, "security-group", {
-    name,
-    description: "Security group for the instance",
-    vpcId: ctx.shared.get("vpc", "id"),
-    revokeRulesOnDelete: true,
-    tags
-  });
-  new aws26.vpc.SecurityGroupEgressRule(group, "egress-rule", {
-    securityGroupId: securityGroup.id,
-    description: `Allow all outbound traffic from the ${name} instance`,
-    ipProtocol: "-1",
-    cidrIpv4: "0.0.0.0/0",
-    tags
+  ctx.onEnv((name2, value) => {
+    variables[name2] = value;
+    for (const dep of findInputDeps3([value])) {
+      variableDeps.add(dep);
+    }
   });
-  const clusterName = ctx.shared.get("instance", "cluster-name");
-  const clusterArn = ctx.shared.get("instance", "cluster-arn");
-  const service = new aws26.ecs.Service(group, "service", {
-    name,
-    cluster: clusterArn,
-    taskDefinition: task2.arn,
-    desiredCount: 1,
-    launchType: "FARGATE",
-    networkConfiguration: {
-      subnets: ctx.shared.get("vpc", "public-subnets"),
-      securityGroups: [securityGroup.id],
-      assignPublicIp: true
-      // https://stackoverflow.com/questions/76398247/cannotpullcontainererror-pull-image-manifest-has-been-retried-5-times-failed
-    },
-    forceNewDeployment: true,
-    forceDelete: true,
-    tags,
-    // ------------------------------------------------------------
-    // Deployment safeguards: keep the service pinned to one running task.
-    schedulingStrategy: "REPLICA",
-    deploymentMaximumPercent: 100,
-    deploymentMinimumHealthyPercent: 0,
-    deploymentCircuitBreaker: {
-      enable: true,
-      rollback: true
-    },
-    // ------------------------------------------------------------
-    // Tag hygiene: let ECS manage and propagate runtime tags automatically.
+  variables.APP = ctx.appConfig.name;
+  variables.APP_ID = ctx.appId;
+  variables.AWS_ACCOUNT_ID = ctx.accountId;
+  variables.STACK = ctx.stackConfig.name;
+  variables.CODE_HASH = code.sourceHash;
+  variables.TIMEOUT = toSeconds9(props.timeout).toString();
+  if (props.environment) {
+    for (const [key, value] of Object.entries(props.environment)) {
+      variables[key] = value;
+    }
+  }
+  if (ctx.appConfig.defaults.job.permissions) {
+    statements.push(...ctx.appConfig.defaults.job.permissions);
+  }
+  if ("permissions" in local && local.permissions) {
+    statements.push(...local.permissions);
+  }
+  return { name, task: task2, policy, code, group };
+};
+
+// src/feature/job/index.ts
+var typeGenCode10 = `
+import type { Mock } from 'vitest'
+
+type Func = (...args: any[]) => any
+
+type Invoke<N extends string, F extends Func> = unknown extends Parameters<F>[0] ? InvokeWithoutPayload<N, F> : InvokeWithPayload<N, F>
+
+type InvokeWithPayload<Name extends string, F extends Func> = {
+	readonly name: Name
+	(payload: Parameters<F>[0]): Promise<{ taskArn: string | undefined }>
+}
+
+type InvokeWithoutPayload<Name extends string, F extends Func> = {
+	readonly name: Name
+	(payload?: Parameters<F>[0]): Promise<{ taskArn: string | undefined }>
+}
+
+type MockHandle<F extends Func> = (payload: Parameters<F>[0]) => void | Promise<void>
+type MockBuilder<F extends Func> = (handle?: MockHandle<F>) => void
+type MockObject<F extends Func> = Mock<Parameters<F>, ReturnType<F>>
+`;
+var jobFeature = defineFeature({
+  name: "job",
+  onBefore(ctx) {
+    const group = new Group26(ctx.base, "job", "asset");
+    const bucket = new aws27.s3.Bucket(group, "bucket", {
+      bucket: formatGlobalResourceName({
+        appName: ctx.app.name,
+        resourceType: "job",
+        resourceName: "assets",
+        postfix: ctx.appId
+      }),
+      forceDestroy: true
+    });
+    ctx.shared.set("job", "bucket-name", bucket.bucket);
+  },
+  onApp(ctx) {
+    const found = ctx.stackConfigs.filter((stack) => {
+      return Object.keys(stack.jobs ?? {}).length > 0;
+    });
+    if (found.length === 0) {
+      return;
+    }
+    const group = new Group26(ctx.base, "job", "cluster");
+    const cluster = new aws27.ecs.Cluster(group, "cluster", {
+      name: `${ctx.app.name}-job`
+    });
+    new aws27.ecs.ClusterCapacityProviders(group, "capacity-providers", {
+      clusterName: cluster.name,
+      capacityProviders: ["FARGATE", "FARGATE_SPOT"],
+      defaultCapacityProviderStrategy: [
+        {
+          capacityProvider: "FARGATE_SPOT",
+          weight: 1
+        }
+      ]
+    });
+    ctx.shared.set("job", "cluster-name", cluster.name);
+    ctx.shared.set("job", "cluster-arn", cluster.arn);
+    const securityGroup = new aws27.security.Group(group, "security-group", {
+      name: `${ctx.app.name}-job`,
+      description: "Shared security group for jobs",
+      vpcId: ctx.shared.get("vpc", "id"),
+      revokeRulesOnDelete: true,
+      tags: {
+        APP: ctx.appConfig.name
+      }
+    });
+    new aws27.vpc.SecurityGroupEgressRule(group, "egress-rule", {
+      securityGroupId: securityGroup.id,
+      description: "Allow all outbound traffic from jobs",
+      ipProtocol: "-1",
+      cidrIpv4: "0.0.0.0/0",
+      tags: {
+        APP: ctx.appConfig.name
+      }
+    });
+    ctx.shared.set("job", "security-group-id", securityGroup.id);
+    ctx.addGlobalPermission({
+      actions: ["ecs:RunTask", "ecs:DescribeTasks", "ecs:StopTask"],
+      resources: ["*"]
+    });
+    ctx.addGlobalPermission({
+      actions: ["iam:PassRole"],
+      resources: ["*"]
+    });
+  },
+  onStack(ctx) {
+    if (!ctx.shared.has("job", "security-group-id")) return;
+    const subnets = ctx.shared.get("vpc", "public-subnets");
+    ctx.addEnv(
+      "JOB_SUBNETS",
+      new Output7(new Set(findInputDeps4(subnets)), async (resolve2) => {
+        const resolved = await resolveInputs4(subnets);
+        resolve2(JSON.stringify(resolved));
+      })
+    );
+    ctx.addEnv("JOB_SECURITY_GROUP", ctx.shared.get("job", "security-group-id"));
+    for (const [id, props] of Object.entries(ctx.stackConfig.jobs ?? {})) {
+      const group = new Group26(ctx.stack, "job", id);
+      createFargateJob(group, ctx, "job", id, props);
+    }
+  },
+  async onTypeGen(ctx) {
+    const types2 = new TypeFile("@awsless/awsless");
+    const resources2 = new TypeObject(1);
+    const mocks = new TypeObject(1);
+    const mockResponses = new TypeObject(1);
+    for (const stack of ctx.stackConfigs) {
+      const resource = new TypeObject(2);
+      const mock = new TypeObject(2);
+      const mockResponse = new TypeObject(2);
+      for (const [name, props] of Object.entries(stack.jobs || {})) {
+        const varName = camelCase8(`${stack.name}-${name}`);
+        const funcName = formatLocalResourceName({
+          appName: ctx.appConfig.name,
+          stackName: stack.name,
+          resourceType: "job",
+          resourceName: name
+        });
+        if ("file" in props.code) {
+          const relFile = relative8(directories.types, props.code.file);
+          types2.addImport(varName, relFile);
+          resource.addType(name, `Invoke<'${funcName}', typeof ${varName}>`);
+          mock.addType(name, `MockBuilder<typeof ${varName}>`);
+          mockResponse.addType(name, `MockObject<typeof ${varName}>`);
+        }
+      }
+      mocks.addType(stack.name, mock);
+      resources2.addType(stack.name, resource);
+      mockResponses.addType(stack.name, mockResponse);
+    }
+    types2.addCode(typeGenCode10);
+    types2.addInterface("JobResources", resources2);
+    types2.addInterface("JobMock", mocks);
+    types2.addInterface("JobMockResponse", mockResponses);
+    await ctx.write("job.d.ts", types2, true);
+  }
+});
+
+// src/feature/instance/index.ts
+import { Group as Group28 } from "@terraforge/core";
+import { aws as aws29 } from "@terraforge/aws";
+
+// src/feature/instance/util.ts
+import { toDays as toDays10, toSeconds as toSeconds10 } from "@awsless/duration";
+import { toMebibytes as toMebibytes6 } from "@awsless/size";
+import { generateFileHash as generateFileHash3 } from "@awsless/ts-file-cache";
+import { aws as aws28 } from "@terraforge/aws";
+import { Group as Group27, Output as Output8, findInputDeps as findInputDeps5, resolveInputs as resolveInputs5 } from "@terraforge/core";
+import { constantCase as constantCase13, pascalCase as pascalCase4 } from "change-case";
+import deepmerge5 from "deepmerge";
+import { join as join19 } from "path";
+
+// src/feature/instance/build/executable.ts
+import { createHash as createHash4 } from "crypto";
+import { readFile as readFile5 } from "fs/promises";
+import { join as join18 } from "path";
+var buildExecutable = async (input, outputPath, architecture) => {
+  const filePath = join18(outputPath, "program");
+  const target = architecture === "x86_64" ? "bun-linux-x64" : "bun-linux-arm64";
+  let result;
+  try {
+    result = await Bun.build({
+      entrypoints: [input],
+      compile: {
+        target,
+        outfile: filePath
+      },
+      target: "bun"
+    });
+  } catch (error) {
+    throw new ExpectedError(
+      `Executable build failed: ${error instanceof Error ? error.message : JSON.stringify(error)}`
+    );
+  }
+  if (!result.success) {
+    throw new ExpectedError(`Executable build failed:
+${result.logs?.map((log35) => log35.message).join("\n")}`);
+  }
+  const file = await readFile5(filePath);
+  return {
+    hash: createHash4("sha1").update(file).update("x86_64").digest("hex"),
+    file
+  };
+};
+
+// src/feature/instance/util.ts
+var createFargateTask = (parentGroup, ctx, ns, id, local) => {
+  const group = new Group27(parentGroup, "instance", ns);
+  const name = formatLocalResourceName({
+    appName: ctx.app.name,
+    stackName: ctx.stack.name,
+    resourceType: ns,
+    resourceName: id
+  });
+  const shortName = shortId(`${ctx.app.name}:${ctx.stack.name}:${ns}:${id}:${ctx.appId}`);
+  const props = deepmerge5(ctx.appConfig.defaults.instance, local);
+  const image2 = props.image || (props.architecture === "arm64" ? "public.ecr.aws/aws-cli/aws-cli:arm64" : "public.ecr.aws/aws-cli/aws-cli:amd64");
+  ctx.registerBuild("instance", name, async (build3, { workspace }) => {
+    const fingerprint = await generateFileHash3(workspace, local.code.file);
+    return build3(fingerprint, async (write) => {
+      const temp = await createTempFolder(`instance--${name}`);
+      const executable = await buildExecutable(local.code.file, temp.path, props.architecture);
+      await Promise.all([
+        //
+        write("HASH", executable.hash),
+        write("program", executable.file),
+        temp.delete()
+      ]);
+      return {
+        size: formatByteSize(executable.file.byteLength)
+      };
+    });
+  });
+  const code = new aws28.s3.BucketObject(group, "code", {
+    bucket: ctx.shared.get("instance", "bucket-name"),
+    key: name,
+    source: relativePath(getBuildPath("instance", name, "program")),
+    sourceHash: $file(getBuildPath("instance", name, "HASH"))
+  });
+  const executionRole = new aws28.iam.Role(group, "execution-role", {
+    name: shortId(`${shortName}:execution-role`),
+    description: name,
+    assumeRolePolicy: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Action: "sts:AssumeRole",
+          Principal: {
+            Service: ["ecs-tasks.amazonaws.com"]
+          }
+        }
+      ]
+    }),
+    managedPolicyArns: ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
+  });
+  const role = new aws28.iam.Role(
+    group,
+    "task-role",
+    {
+      name: shortId(`${shortName}:task-role`),
+      description: name,
+      assumeRolePolicy: JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Action: "sts:AssumeRole",
+            Principal: {
+              Service: ["ecs-tasks.amazonaws.com"]
+            }
+          }
+        ]
+      }),
+      inlinePolicy: [
+        {
+          name: "s3-code-access",
+          policy: $resolve([code.bucket, code.key], (bucket, key) => {
+            return JSON.stringify({
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: pascalCase4("allow"),
+                  Action: ["s3:getObject", "s3:HeadObject"],
+                  Resource: `arn:aws:s3:::${bucket}/${key}`
+                }
+              ]
+            });
+          })
+        }
+      ]
+    },
+    {
+      dependsOn: [code]
+    }
+  );
+  const statements = [];
+  const statementDeps = /* @__PURE__ */ new Set();
+  const policy = new aws28.iam.RolePolicy(group, "policy", {
+    role: role.name,
+    name: "task-policy",
+    policy: new Output8(statementDeps, async (resolve2) => {
+      const list3 = await resolveInputs5(statements);
+      resolve2(
+        JSON.stringify({
+          Version: "2012-10-17",
+          Statement: list3.map((statement) => ({
+            Effect: pascalCase4(statement.effect ?? "allow"),
+            Action: statement.actions,
+            Resource: statement.resources
+          }))
+        })
+      );
+    })
+  });
+  const addPermission = (...permissions) => {
+    statements.push(...permissions);
+    for (const dep of findInputDeps5(permissions)) {
+      statementDeps.add(dep);
+    }
+  };
+  ctx.onPermission((statement) => {
+    addPermission(statement);
+  });
+  let logGroup;
+  if (props.log.retention && props.log.retention.value > 0n) {
+    logGroup = new aws28.cloudwatch.LogGroup(group, "log", {
+      name: `/aws/ecs/${name}`,
+      // name: `/aws/lambda/${name}`,
+      retentionInDays: toDays10(props.log.retention)
+    });
+    if (ctx.shared.has("on-error-log", "subscriber-arn")) {
+      new aws28.cloudwatch.LogSubscriptionFilter(group, "on-error-log", {
+        name: "error-log-subscription",
+        destinationArn: ctx.shared.get("on-error-log", "subscriber-arn"),
+        logGroupName: logGroup.name,
+        filterPattern
+      });
+    }
+  }
+  const tags = {
+    APP: ctx.appConfig.name,
+    APP_ID: ctx.appId,
+    STACK: ctx.stackConfig.name
+  };
+  const variables = {};
+  const variableDeps = /* @__PURE__ */ new Set();
+  const task2 = new aws28.ecs.TaskDefinition(
+    group,
+    "task",
+    {
+      family: name,
+      networkMode: "awsvpc",
+      cpu: props.cpu,
+      memory: toMebibytes6(props.memorySize).toString(),
+      requiresCompatibilities: ["FARGATE"],
+      executionRoleArn: executionRole.arn,
+      taskRoleArn: role.arn,
+      runtimePlatform: {
+        cpuArchitecture: constantCase13(props.architecture),
+        operatingSystemFamily: "LINUX"
+      },
+      trackLatest: true,
+      containerDefinitions: new Output8(variableDeps, async (resolve2) => {
+        const data = await resolveInputs5(variables);
+        const { s3Bucket, s3Key } = await resolveInputs5({
+          s3Bucket: code.bucket,
+          s3Key: code.key
+        });
+        resolve2(
+          JSON.stringify([
+            {
+              name: `container-${id}`,
+              essential: true,
+              image: image2,
+              protocol: "tcp",
+              workingDirectory: "/usr/app",
+              entryPoint: ["sh", "-c"],
+              command: [
+                [
+                  `aws s3 cp s3://${s3Bucket}/${s3Key} /usr/app/program`,
+                  `chmod +x /usr/app/program`,
+                  ...props.startupCommand ?? [],
+                  `exec /usr/app/program`
+                ].join(" && ")
+              ],
+              environment: Object.entries(data).map(([name2, value]) => ({
+                name: name2,
+                value
+              })),
+              portMappings: [
+                {
+                  name: "http",
+                  protocol: "tcp",
+                  appProtocol: "http",
+                  containerPort: 80,
+                  hostPort: 80
+                }
+              ],
+              restartPolicy: {
+                enabled: true,
+                restartAttemptPeriod: 60
+              },
+              ...logGroup && {
+                logConfiguration: {
+                  logDriver: "awslogs",
+                  options: {
+                    // 'awslogs-group': `/aws/ecs/${name}`,
+                    "awslogs-group": `/aws/ecs/${name}`,
+                    "awslogs-region": ctx.appConfig.region,
+                    "awslogs-stream-prefix": "ecs",
+                    mode: "non-blocking"
+                    // 'awslogs-multiline-pattern': '',
+                    // 'max-buffer-size': '100m',
+                  }
+                }
+              },
+              healthCheck: props.healthCheck ? {
+                command: [
+                  "CMD-SHELL",
+                  `curl -f http://${join19("localhost", props.healthCheck.path)} || exit 1`
+                ],
+                interval: toSeconds10(props.healthCheck.interval),
+                retries: props.healthCheck.retries,
+                startPeriod: toSeconds10(props.healthCheck.startPeriod),
+                timeout: toSeconds10(props.healthCheck.timeout)
+              } : void 0
+            }
+          ])
+        );
+      }),
+      tags
+    },
+    {
+      replaceOnChanges: [
+        "containerDefinitions",
+        "cpu",
+        "memory",
+        "runtimePlatform",
+        "executionRoleArn",
+        "taskRoleArn"
+      ],
+      dependsOn: [code]
+    }
+  );
+  const securityGroup = new aws28.security.Group(group, "security-group", {
+    name,
+    description: "Security group for the instance",
+    vpcId: ctx.shared.get("vpc", "id"),
+    revokeRulesOnDelete: true,
+    tags
+  });
+  new aws28.vpc.SecurityGroupEgressRule(group, "egress-rule", {
+    securityGroupId: securityGroup.id,
+    description: `Allow all outbound traffic from the ${name} instance`,
+    ipProtocol: "-1",
+    cidrIpv4: "0.0.0.0/0",
+    tags
+  });
+  const clusterName = ctx.shared.get("instance", "cluster-name");
+  const clusterArn = ctx.shared.get("instance", "cluster-arn");
+  const service = new aws28.ecs.Service(group, "service", {
+    name,
+    cluster: clusterArn,
+    taskDefinition: task2.arn,
+    desiredCount: 1,
+    launchType: "FARGATE",
+    networkConfiguration: {
+      subnets: ctx.shared.get("vpc", "public-subnets"),
+      securityGroups: [securityGroup.id],
+      assignPublicIp: true
+      // https://stackoverflow.com/questions/76398247/cannotpullcontainererror-pull-image-manifest-has-been-retried-5-times-failed
+    },
+    forceNewDeployment: true,
+    forceDelete: true,
+    tags,
+    // ------------------------------------------------------------
+    // Deployment safeguards: keep the service pinned to one running task.
+    schedulingStrategy: "REPLICA",
+    deploymentMaximumPercent: 100,
+    deploymentMinimumHealthyPercent: 0,
+    deploymentCircuitBreaker: {
+      enable: true,
+      rollback: true
+    },
+    // ------------------------------------------------------------
+    // Tag hygiene: let ECS manage and propagate runtime tags automatically.
     enableEcsManagedTags: true,
     propagateTags: "SERVICE"
   });
-  new aws26.appautoscaling.Target(
+  new aws28.appautoscaling.Target(
     group,
     "autoscaling-target",
     {
@@ -7452,7 +8016,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   );
   ctx.onEnv((name2, value) => {
     variables[name2] = value;
-    for (const dep of findInputDeps3([value])) {
+    for (const dep of findInputDeps5([value])) {
       variableDeps.add(dep);
     }
   });
@@ -7461,6 +8025,11 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   variables.AWS_ACCOUNT_ID = ctx.accountId;
   variables.STACK = ctx.stackConfig.name;
   variables.CODE_HASH = code.sourceHash;
+  if (props.environment) {
+    for (const [key, value] of Object.entries(props.environment)) {
+      variables[key] = value;
+    }
+  }
   if (ctx.appConfig.defaults.instance.permissions) {
     statements.push(...ctx.appConfig.defaults.instance.permissions);
   }
@@ -7474,8 +8043,8 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
 var instanceFeature = defineFeature({
   name: "instance",
   onBefore(ctx) {
-    const group = new Group26(ctx.base, "instance", "asset");
-    const bucket = new aws27.s3.Bucket(group, "bucket", {
+    const group = new Group28(ctx.base, "instance", "asset");
+    const bucket = new aws29.s3.Bucket(group, "bucket", {
       bucket: formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "instance",
@@ -7493,8 +8062,8 @@ var instanceFeature = defineFeature({
     if (found.length === 0) {
       return;
     }
-    const group = new Group26(ctx.base, "instance", "cluster");
-    const cluster = new aws27.ecs.Cluster(group, "cluster", {
+    const group = new Group28(ctx.base, "instance", "cluster");
+    const cluster = new aws29.ecs.Cluster(group, "cluster", {
       name: ctx.app.name
     });
     ctx.shared.set("instance", "cluster-name", cluster.name);
@@ -7502,18 +8071,18 @@ var instanceFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.instances ?? {})) {
-      const group = new Group26(ctx.stack, "instance", id);
+      const group = new Group28(ctx.stack, "instance", id);
       createFargateTask(group, ctx, "instance", id, props);
     }
   }
 });
 
 // src/feature/metric/index.ts
-import { Group as Group27 } from "@terraforge/core";
-import { aws as aws28 } from "@terraforge/aws";
-import { kebabCase as kebabCase8, constantCase as constantCase13 } from "change-case";
-import { toSeconds as toSeconds10 } from "@awsless/duration";
-var typeGenCode10 = `
+import { Group as Group29 } from "@terraforge/core";
+import { aws as aws30 } from "@terraforge/aws";
+import { kebabCase as kebabCase8, constantCase as constantCase14 } from "change-case";
+import { toSeconds as toSeconds11 } from "@awsless/duration";
+var typeGenCode11 = `
 import { type PutDataProps, putData, batchPutData } from '@awsless/cloudwatch'
 import { type Duration } from '@awsless/duration'
 import { type Size } from '@awsless/size'
@@ -7561,7 +8130,7 @@ var metricFeature = defineFeature({
       resources2.addType(stack.name, stackResources);
     }
     resources2.addType("batch", "Batch");
-    gen.addCode(typeGenCode10);
+    gen.addCode(typeGenCode11);
     gen.addInterface("MetricResources", resources2);
     await ctx.write("metric.d.ts", gen, true);
   },
@@ -7578,16 +8147,16 @@ var metricFeature = defineFeature({
       }
     });
     for (const [id, props] of Object.entries(ctx.stackConfig.metrics ?? {})) {
-      const group = new Group27(ctx.stack, "metric", id);
-      ctx.addEnv(`METRIC_${constantCase13(id)}`, props.type);
+      const group = new Group29(ctx.stack, "metric", id);
+      ctx.addEnv(`METRIC_${constantCase14(id)}`, props.type);
       for (const alarmId in props.alarms ?? []) {
-        const alarmGroup = new Group27(group, "alarm", alarmId);
+        const alarmGroup = new Group29(group, "alarm", alarmId);
         const alarmName = kebabCase8(`${id}-${alarmId}`);
         const alarmProps = props.alarms[alarmId];
         let alarmAction;
         let alarmLambda;
         if (Array.isArray(alarmProps.trigger)) {
-          const topic = new aws28.sns.Topic(alarmGroup, "alarm-trigger", {
+          const topic = new aws30.sns.Topic(alarmGroup, "alarm-trigger", {
             name: formatLocalResourceName({
               appName: ctx.app.name,
               stackName: ctx.stack.name,
@@ -7597,7 +8166,7 @@ var metricFeature = defineFeature({
           });
           alarmAction = topic.arn;
           for (const email of alarmProps.trigger) {
-            new aws28.sns.TopicSubscription(alarmGroup, email, {
+            new aws30.sns.TopicSubscription(alarmGroup, email, {
               topicArn: topic.arn,
               protocol: "email",
               endpoint: email
@@ -7608,7 +8177,7 @@ var metricFeature = defineFeature({
           alarmLambda = lambda;
           alarmAction = lambda.arn;
         }
-        const alarm = new aws28.cloudwatch.MetricAlarm(alarmGroup, "alarm", {
+        const alarm = new aws30.cloudwatch.MetricAlarm(alarmGroup, "alarm", {
           namespace,
           metricName: kebabCase8(id),
           alarmName: formatLocalResourceName({
@@ -7620,13 +8189,13 @@ var metricFeature = defineFeature({
           alarmDescription: alarmProps.description,
           statistic: alarmProps.where.stat,
           threshold: alarmProps.where.value,
-          period: toSeconds10(alarmProps.period),
+          period: toSeconds11(alarmProps.period),
           evaluationPeriods: alarmProps.minDataPoints,
           comparisonOperator: alarmProps.where.op,
           alarmActions: [alarmAction]
         });
         if (alarmLambda) {
-          new aws28.lambda.Permission(alarmGroup, "permission", {
+          new aws30.lambda.Permission(alarmGroup, "permission", {
             action: "lambda:InvokeFunction",
             principal: "lambda.alarms.cloudwatch.amazonaws.com",
             functionName: alarmLambda.functionName,
@@ -7639,10 +8208,10 @@ var metricFeature = defineFeature({
 });
 
 // src/feature/router/index.ts
-import { days as days8, seconds as seconds10, toSeconds as toSeconds11, years } from "@awsless/duration";
-import { Future, Group as Group28 } from "@terraforge/core";
-import { aws as aws29 } from "@terraforge/aws";
-import { camelCase as camelCase8, constantCase as constantCase14 } from "change-case";
+import { days as days9, seconds as seconds10, toSeconds as toSeconds12, years } from "@awsless/duration";
+import { Future, Group as Group30 } from "@terraforge/core";
+import { aws as aws31 } from "@terraforge/aws";
+import { camelCase as camelCase9, constantCase as constantCase15 } from "change-case";
 
 // src/feature/router/router-code.ts
 var getViewerRequestFunctionCode = (props) => {
@@ -7875,18 +8444,18 @@ async function handler(event) {
 `;
 
 // src/feature/router/index.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 var routerFeature = defineFeature({
   name: "router",
   onApp(ctx) {
     for (const [id, props] of Object.entries(ctx.appConfig.defaults.router ?? {})) {
-      const group = new Group28(ctx.base, "router", id);
+      const group = new Group30(ctx.base, "router", id);
       const name = formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "router",
         resourceName: id
       });
-      const routeStore = new aws29.cloudfront.KeyValueStore(group, "routes", {
+      const routeStore = new aws31.cloudfront.KeyValueStore(group, "routes", {
         name,
         comment: "Store for routes"
       });
@@ -7916,11 +8485,11 @@ var routerFeature = defineFeature({
         );
         importedRoutes.push(importKeys);
       });
-      const cache = new aws29.cloudfront.CachePolicy(group, "cache", {
+      const cache = new aws31.cloudfront.CachePolicy(group, "cache", {
         name,
-        minTtl: toSeconds11(seconds10(0)),
-        maxTtl: toSeconds11(days8(365)),
-        defaultTtl: toSeconds11(days8(0)),
+        minTtl: toSeconds12(seconds10(0)),
+        maxTtl: toSeconds12(days9(365)),
+        defaultTtl: toSeconds12(days9(0)),
         parametersInCacheKeyAndForwardedToOrigin: {
           enableAcceptEncodingBrotli: true,
           enableAcceptEncodingGzip: true,
@@ -7948,10 +8517,10 @@ var routerFeature = defineFeature({
           }
         }
       });
-      const originRequest = new aws29.cloudfront.OriginRequestPolicy(group, "request", {
+      const originRequest = new aws31.cloudfront.OriginRequestPolicy(group, "request", {
         name,
         headersConfig: {
-          headerBehavior: camelCase8("all-except"),
+          headerBehavior: camelCase9("all-except"),
           headers: {
             items: [
               "host"
@@ -7966,11 +8535,11 @@ var routerFeature = defineFeature({
           queryStringBehavior: "all"
         }
       });
-      const responseHeaders = new aws29.cloudfront.ResponseHeadersPolicy(group, "response", {
+      const responseHeaders = new aws31.cloudfront.ResponseHeadersPolicy(group, "response", {
         name,
         corsConfig: {
           originOverride: props.cors?.override ?? true,
-          accessControlMaxAgeSec: toSeconds11(props.cors?.maxAge ?? years(1)),
+          accessControlMaxAgeSec: toSeconds12(props.cors?.maxAge ?? years(1)),
           accessControlAllowHeaders: { items: props.cors?.headers ?? ["*"] },
           accessControlAllowMethods: { items: props.cors?.methods ?? ["ALL"] },
           accessControlAllowOrigins: { items: props.cors?.origins ?? ["*"] },
@@ -7995,7 +8564,7 @@ var routerFeature = defineFeature({
           strictTransportSecurity: {
             override: true,
             preload: true,
-            accessControlMaxAgeSec: toSeconds11(years(1)),
+            accessControlMaxAgeSec: toSeconds12(years(1)),
             includeSubdomains: true
           },
           xssProtection: {
@@ -8005,7 +8574,7 @@ var routerFeature = defineFeature({
           }
         }
       });
-      const viewerRequest = new aws29.cloudfront.Function(group, "viewer-request", {
+      const viewerRequest = new aws31.cloudfront.Function(group, "viewer-request", {
         name,
         runtime: `cloudfront-js-2.0`,
         comment: `Viewer Request - ${name}`,
@@ -8027,7 +8596,7 @@ var routerFeature = defineFeature({
             rateBasedStatement: {
               limit: wafSettingsConfig.rateLimiter.limit,
               aggregateKeyType: "IP",
-              evaluationWindowSec: toSeconds11(wafSettingsConfig.rateLimiter.window)
+              evaluationWindowSec: toSeconds12(wafSettingsConfig.rateLimiter.window)
             }
           },
           action: {
@@ -8107,7 +8676,7 @@ var routerFeature = defineFeature({
       }
       let waf;
       if (wafRules.length && wafSettingsConfig) {
-        waf = new aws29.wafv2.WebAcl(group, "waf", {
+        waf = new aws31.wafv2.WebAcl(group, "waf", {
           name: `${name}-wafv2`,
           scope: "CLOUDFRONT",
           defaultAction: {
@@ -8117,12 +8686,12 @@ var routerFeature = defineFeature({
           rule: wafRules,
           captchaConfig: {
             immunityTimeProperty: {
-              immunityTime: toSeconds11(wafSettingsConfig.captchaImmunityTime)
+              immunityTime: toSeconds12(wafSettingsConfig.captchaImmunityTime)
             }
           },
           challengeConfig: {
             immunityTimeProperty: {
-              immunityTime: toSeconds11(wafSettingsConfig.challengeImmunityTime)
+              immunityTime: toSeconds12(wafSettingsConfig.challengeImmunityTime)
             }
           },
           visibilityConfig: {
@@ -8132,7 +8701,7 @@ var routerFeature = defineFeature({
           }
         });
       }
-      const distribution = new aws29.cloudfront.MultitenantDistribution(group, "distribution", {
+      const distribution = new aws31.cloudfront.MultitenantDistribution(group, "distribution", {
         tags: {
           name
         },
@@ -8178,7 +8747,7 @@ var routerFeature = defineFeature({
           }
           return {
             errorCode: Number(errorCode),
-            errorCachingMinTtl: item.minTTL ? toSeconds11(item.minTTL) : void 0,
+            errorCachingMinTtl: item.minTTL ? toSeconds12(item.minTTL) : void 0,
             responseCode: item.statusCode?.toString() ?? errorCode,
             responsePagePath: item.path
           };
@@ -8226,11 +8795,11 @@ var routerFeature = defineFeature({
             {
               distributionId: distribution.id,
               paths,
-              version: new Future((resolve) => {
+              version: new Future((resolve2) => {
                 $combine(...versions).then((versions2) => {
                   const combined = versions2.filter((v) => !!v).sort().join(",");
-                  const version = createHash4("sha1").update(combined).digest("hex");
-                  resolve(version);
+                  const version = createHash5("sha1").update(combined).digest("hex");
+                  resolve2(version);
                 });
               })
             },
@@ -8244,10 +8813,10 @@ var routerFeature = defineFeature({
         const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
         const certificateArn = ctx.shared.entry("domain", `global-certificate-arn`, props.domain);
         const zoneId = ctx.shared.entry("domain", "zone-id", props.domain);
-        const connectionGroup = new aws29.cloudfront.ConnectionGroup(group, "connection-group", {
+        const connectionGroup = new aws31.cloudfront.ConnectionGroup(group, "connection-group", {
           name
         });
-        new aws29.cloudfront.DistributionTenant(group, `tenant`, {
+        new aws31.cloudfront.DistributionTenant(group, `tenant`, {
           name,
           enabled: true,
           distributionId: distribution.id,
@@ -8255,7 +8824,7 @@ var routerFeature = defineFeature({
           domain: [{ domain: domainName }],
           customizations: [{ certificate: [{ arn: certificateArn }] }]
         });
-        new aws29.route53.Record(group, `record`, {
+        new aws31.route53.Record(group, `record`, {
           zoneId,
           type: "A",
           name: domainName,
@@ -8265,7 +8834,7 @@ var routerFeature = defineFeature({
             evaluateTargetHealth: false
           }
         });
-        ctx.bind(`ROUTER_${constantCase14(id)}_ENDPOINT`, domainName);
+        ctx.bind(`ROUTER_${constantCase15(id)}_ENDPOINT`, domainName);
       }
     }
   }
@@ -8288,6 +8857,7 @@ var features = [
   // 5
   functionFeature,
   instanceFeature,
+  jobFeature,
   // graphqlFeature,
   configFeature,
   searchFeature,
@@ -9376,14 +9946,14 @@ import wildstring4 from "wildstring";
 
 // src/cli/ui/complex/run-tests.ts
 import { log as log18 } from "@awsless/clui";
-import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile3 } from "fs/promises";
-import { join as join20 } from "path";
+import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
+import { join as join21 } from "path";
 import wildstring3 from "wildstring";
 import { parse as parse4, stringify } from "@awsless/json";
 import { generateFolderHash, loadWorkspace as loadWorkspace2 } from "@awsless/ts-file-cache";
 
 // src/test/start.ts
-import { dirname as dirname9, join as join19 } from "path";
+import { dirname as dirname9, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { configDefaults } from "vitest/config";
 import { startVitest } from "vitest/node";
@@ -9421,7 +9991,7 @@ var startTest = async (props) => {
       // },
       setupFiles: [
         //
-        join19(__dirname5, "test-global-setup.js")
+        join20(__dirname5, "test-global-setup.js")
       ]
       // globalSetup: [
       // 	//
@@ -9615,12 +10185,12 @@ var logTestErrors = (event) => {
 };
 var runTest = async (stack, dir, filters, workspace, opts) => {
   await mkdir4(directories.test, { recursive: true });
-  const file = join20(directories.test, `${stack}.json`);
+  const file = join21(directories.test, `${stack}.json`);
   const fingerprint = await generateFolderHash(workspace, dir);
   if (!process.env.NO_CACHE) {
     const exists = await fileExist(file);
     if (exists) {
-      const raw = await readFile5(file, { encoding: "utf8" });
+      const raw = await readFile6(file, { encoding: "utf8" });
       const data = parse4(raw);
       if (data.fingerprint === fingerprint) {
         log18.step(
@@ -9663,7 +10233,7 @@ var runTest = async (stack, dir, filters, workspace, opts) => {
     logTestLogs(result);
   }
   logTestErrors(result);
-  await writeFile3(
+  await writeFile4(
     file,
     stringify({
       ...result,
@@ -10203,7 +10773,7 @@ var auth = (program2) => {
 // src/cli/command/bind.ts
 import { log as log24 } from "@awsless/clui";
 import chalk4 from "chalk";
-import { constantCase as constantCase15 } from "change-case";
+import { constantCase as constantCase16 } from "change-case";
 var bind = (program2) => {
   program2.command("bind").argument("[command...]", "The command to execute").option("--config <string...>", "List of config values that will be accessable", (v) => v.split(",")).description(`Bind your site environment variables to a command`).action(async (commands11 = [], opts) => {
     await layout("bind", async ({ appConfig, stackConfigs }) => {
@@ -10230,10 +10800,10 @@ var bind = (program2) => {
       const configList = opts.config ?? [];
       const configs = {};
       for (const name of configList) {
-        configs[`CONFIG_${constantCase15(name)}`] = name;
+        configs[`CONFIG_${constantCase16(name)}`] = name;
       }
       if (configList.length ?? 0 > 0) {
-        log24.note("Bind Config", configList.map((v) => color.label(constantCase15(v))).join("\n"));
+        log24.note("Bind Config", configList.map((v) => color.label(constantCase16(v))).join("\n"));
       }
       if (commands11.length === 0) {
         return "No command to execute.";
@@ -10272,7 +10842,7 @@ var bind = (program2) => {
 
 // src/config/load/watch.ts
 import { watch } from "chokidar";
-var watchConfig = async (options, resolve, reject) => {
+var watchConfig = async (options, resolve2, reject) => {
   await loadAppConfig(options);
   debug("Start watching...");
   const ext = "{json,jsonc,json5}";
@@ -10287,7 +10857,7 @@ var watchConfig = async (options, resolve, reject) => {
       const appConfig = await loadAppConfig(options);
       const stackConfigs = await loadStackConfigs(options);
       validateFeatures({ appConfig, stackConfigs });
-      resolve({ appConfig, stackConfigs });
+      resolve2({ appConfig, stackConfigs });
     } catch (error) {
       reject(error);
     }
@@ -10299,8 +10869,8 @@ var watchConfig = async (options, resolve, reject) => {
 import { log as log25 } from "@awsless/clui";
 
 // src/type-gen/generate.ts
-import { mkdir as mkdir5, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname10, join as join21, relative as relative8 } from "path";
+import { mkdir as mkdir5, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname10, join as join22, relative as relative9 } from "path";
 var generateTypes = async (props) => {
   const files = [];
   await Promise.all(
@@ -10309,13 +10879,13 @@ var generateTypes = async (props) => {
         ...props,
         async write(file, data, include = false) {
           const code = data?.toString("utf8");
-          const path = join21(directories.types, file);
+          const path = join22(directories.types, file);
           if (code) {
             if (include) {
-              files.push(relative8(directories.root, path));
+              files.push(relative9(directories.root, path));
             }
             await mkdir5(dirname10(path), { recursive: true });
-            await writeFile4(path, code);
+            await writeFile5(path, code);
           }
         }
       });
@@ -10323,7 +10893,7 @@ var generateTypes = async (props) => {
   );
   if (files.length) {
     const code = files.map((file) => `/// <reference path='${file}' />`).join("\n");
-    await writeFile4(join21(directories.root, `awsless.d.ts`), code);
+    await writeFile5(join22(directories.root, `awsless.d.ts`), code);
   }
 };
 
@@ -10347,9 +10917,9 @@ var dev = (program2) => {
           logError(error);
         }
       );
-      await new Promise((resolve) => {
-        process.once("exit", resolve);
-        process.once("SIGINT", resolve);
+      await new Promise((resolve2) => {
+        process.once("exit", resolve2);
+        process.once("SIGINT", resolve2);
       });
     });
   });
@@ -10749,7 +11319,7 @@ var domain = (program2) => {
 // src/cli/command/logs.ts
 import { CloudWatchLogsClient, StartLiveTailCommand } from "@aws-sdk/client-cloudwatch-logs";
 import { log as log30 } from "@awsless/clui";
-import { aws as aws30 } from "@terraforge/aws";
+import { aws as aws32 } from "@terraforge/aws";
 import chalk6 from "chalk";
 import chunk2 from "chunk";
 import { formatDate } from "date-fns";
@@ -10772,7 +11342,7 @@ var logs = (program2) => {
       for (const stack of app.stacks) {
         if (filters.find((f) => wildstring7.match(f, stack.name))) {
           for (const resource of stack.resources) {
-            if (resource instanceof aws30.cloudwatch.LogGroup) {
+            if (resource instanceof aws32.cloudwatch.LogGroup) {
               logGroupArns.push(await resource.arn);
             }
           }