@awsless/cli 0.0.30 → 0.0.32

package/dist/bin.js

@@ -1179,7 +1179,7 @@ var LogRetentionSchema = DurationSchema.refine(
   (duration) => {
     return validLogRetentionDays.includes(toDays(duration));
   },
-  `Invalid log retention. Valid days are: ${validLogRetentionDays.map((days12) => `${days12}`).join(", ")}`
+  `Invalid log retention. Valid days are: ${validLogRetentionDays.map((days13) => `${days13}`).join(", ")}`
 ).describe("The log retention duration.");
 var LogSchema = z15.union([
   z15.boolean().transform((enabled) => ({ retention: enabled ? days(7) : days(0) })),
@@ -1359,140 +1359,159 @@ var OnFailureDefaultSchema = z19.union([
 );
 
 // src/feature/pubsub/schema.ts
+import { days as days4 } from "@awsless/duration";
+import { z as z22 } from "zod";
+
+// src/feature/instance/schema.ts
+import { days as days2, toDays as toDays2 } from "@awsless/duration";
+import { toMebibytes } from "@awsless/size";
 import { z as z20 } from "zod";
-var DomainSchema = ResourceIdSchema.describe("The domain id to link your Pubsub API with.");
-var PubSubDefaultSchema = z20.record(
-  ResourceIdSchema,
-  z20.object({
-    auth: FunctionSchema,
-    domain: DomainSchema.optional(),
-    subDomain: z20.string().optional()
-    // auth: z.union([
-    // 	ResourceIdSchema,
-    // 	z.object({
-    // 		authorizer: FunctionSchema,
-    // 		// ttl: AuthorizerTtl.default('1 hour'),
-    // 	}),
-    // ]),
-    // policy: z
-    // 	.object({
-    // 		publish: z.array(z.string()).optional(),
-    // 		subscribe: z.array(z.string()).optional(),
-    // 	})
-    // 	.optional(),
-  })
-).optional().describe("Define the pubsub subscriber in your stack.");
-var RetryAttemptsSchema2 = z20.number().int().min(0).max(2).describe(
-  "The maximum number of times to retry when the function returns an error. You can specify a number from 0 to 2."
+var CpuSchema = z20.union([z20.literal(0.25), z20.literal(0.5), z20.literal(1), z20.literal(2), z20.literal(4), z20.literal(8), z20.literal(16)]).transform((v) => `${v} vCPU`).describe(
+  "The number of virtual CPU units (vCPU) used by the instance. Valid values: 0.25, 0.5, 1, 2, 4, 8, 16 vCPU."
 );
-var PubSubSchema = z20.record(
-  ResourceIdSchema,
+var validMemorySize = [
+  // 0.25 vCPU
+  512,
+  1024,
+  2048,
+  // 0.5 vCPU
+  1024,
+  2048,
+  3072,
+  4096,
+  // 1 vCPU
+  2048,
+  3072,
+  4096,
+  5120,
+  6144,
+  7168,
+  8192,
+  // 2 vCPU
+  4096,
+  5120,
+  6144,
+  7168,
+  8192,
+  9216,
+  10240,
+  11264,
+  12288,
+  13312,
+  14336,
+  15360,
+  16384
+];
+var MemorySizeSchema2 = SizeSchema.refine(
+  (s) => validMemorySize.includes(toMebibytes(s)),
+  `Invalid memory size. Allowed sizes: ${validMemorySize.join(", ")} MiB`
+).describe("The amount of memory (in MiB) used by the instance. Valid memory values depend on the CPU configuration.");
+var HealthCheckSchema = z20.object({
+  path: z20.string().describe("The path that the container runs to determine if it is healthy."),
+  interval: DurationSchema.describe("The time period in seconds between each health check execution."),
+  retries: z20.number().int().min(1).max(10).describe(
+    "The number of times to retry a failed health check before the container is considered unhealthy."
+  ),
+  startPeriod: DurationSchema.describe(
+    "The optional grace period to provide containers time to bootstrap before failed health checks count towards the maximum number of retries."
+  ),
+  timeout: DurationSchema.describe(
+    "The time period in seconds to wait for a health check to succeed before it is considered a failure."
+  )
+}).describe("The health check command and associated configuration parameters for the container.");
+var EnvironmentSchema2 = z20.record(z20.string(), z20.string()).optional().describe("Environment variable key-value pairs.");
+var ArchitectureSchema3 = z20.enum(["x86_64", "arm64"]).describe("The instruction set architecture that the instance supports.");
+var ActionSchema2 = z20.string();
+var ActionsSchema2 = z20.union([ActionSchema2.transform((v) => [v]), ActionSchema2.array()]);
+var ArnSchema2 = z20.string().startsWith("arn:");
+var WildcardSchema2 = z20.literal("*");
+var ResourceSchema2 = z20.union([ArnSchema2, WildcardSchema2]);
+var ResourcesSchema2 = z20.union([ResourceSchema2.transform((v) => [v]), ResourceSchema2.array()]);
+var PermissionSchema2 = z20.object({
+  effect: z20.enum(["allow", "deny"]).default("allow"),
+  actions: ActionsSchema2,
+  resources: ResourcesSchema2
+});
+var PermissionsSchema2 = z20.union([PermissionSchema2.transform((v) => [v]), PermissionSchema2.array()]).describe("Add IAM permissions to your instance.");
+var DescriptionSchema2 = z20.string().describe("A description of the instance.");
+var ImageSchema = z20.string().optional().describe("The URL of the container image to use. Default: public.ecr.aws/aws-cli/aws-cli:{architecture}");
+var validLogRetentionDays2 = [
+  ...[1, 3, 5, 7, 14, 30, 60, 90, 120, 150],
+  ...[180, 365, 400, 545, 731, 1096, 1827, 2192],
+  ...[2557, 2922, 3288, 3653]
+];
+var LogRetentionSchema2 = DurationSchema.refine(
+  durationMin(days2(0)),
+  "Minimum log retention is 0 day, which will disable logging."
+).refine(
+  (duration) => {
+    return validLogRetentionDays2.includes(toDays2(duration));
+  },
+  `Invalid log retention. Valid days are: ${validLogRetentionDays2.map((days13) => `${days13}`).join(", ")}`
+).describe("The log retention duration.");
+var LogSchema2 = z20.union([
+  z20.boolean().transform((enabled) => ({ retention: enabled ? days2(7) : days2(0) })),
+  LogRetentionSchema2.transform((retention) => ({ retention })),
   z20.object({
-    sql: z20.string().describe("The SQL statement used to query the IOT topic."),
-    sqlVersion: z20.enum(["2015-10-08", "2016-03-23", "beta"]).default("2016-03-23").describe("The version of the SQL rules engine to use when evaluating the rule."),
-    consumer: FunctionSchema.describe("The consuming lambda function properties."),
-    retryAttempts: RetryAttemptsSchema2.default(2)
+    retention: LogRetentionSchema2.optional()
   })
-).optional().describe("Define the pubsub subscriber in your stack.");
-
-// src/feature/queue/schema.ts
-import { days as days2, hours, minutes as minutes2, seconds as seconds2 } from "@awsless/duration";
-import { kibibytes } from "@awsless/size";
-import { z as z21 } from "zod";
-var RetentionPeriodSchema = DurationSchema.refine(durationMin(minutes2(1)), "Minimum retention period is 1 minute").refine(durationMax(days2(14)), "Maximum retention period is 14 days").describe(
-  "The number of seconds that Amazon SQS retains a message. You can specify a duration from 1 minute to 14 days."
-);
-var VisibilityTimeoutSchema = DurationSchema.refine(
-  durationMax(hours(12)),
-  "Maximum visibility timeout is 12 hours"
-).describe(
-  "The length of time during which a message will be unavailable after a message is delivered from the queue. You can specify a duration from 0 to 12 hours."
-);
-var ReceiveMessageWaitTimeSchema = DurationSchema.refine(
-  durationMin(seconds2(1)),
-  "Minimum receive message wait time is 1 second"
-).refine(durationMax(seconds2(20)), "Maximum receive message wait time is 20 seconds").describe("Long-polling wait time. You can specify a duration from 1 to 20 seconds.");
-var MaxMessageSizeSchema = SizeSchema.refine(sizeMin(kibibytes(1)), "Minimum max message size is 1 KB").refine(sizeMax(kibibytes(256)), "Maximum max message size is 256 KB").describe("Message size limit. You can specify a size from 1 KB to 256 KB.");
-var BatchSizeSchema = z21.number().int().min(1, "Minimum batch size is 1").max(10, "FIFO queues support a maximum batch size of 10").describe("The maximum number of records per batch. FIFO queues are capped at 10.");
-var RetryAttemptsSchema3 = z21.number().int().min(0).max(999).describe(
-  "The maximum number of times to retry when the function returns an error. You can specify a number from 0 to 999."
-);
-var QueueDefaultSchema = z21.object({
-  retentionPeriod: RetentionPeriodSchema.default("7 days"),
-  visibilityTimeout: VisibilityTimeoutSchema.default("2 minutes"),
-  receiveMessageWaitTime: ReceiveMessageWaitTimeSchema.optional(),
-  maxMessageSize: MaxMessageSizeSchema.default("256 KB"),
-  batchSize: BatchSizeSchema.default(10),
-  retryAttempts: RetryAttemptsSchema3.default(2)
-}).default({});
-var QueueSchema = z21.object({
-  consumer: FunctionSchema.optional().describe("The consuming lambda function properties."),
-  retentionPeriod: RetentionPeriodSchema.optional(),
-  visibilityTimeout: VisibilityTimeoutSchema.optional(),
-  receiveMessageWaitTime: ReceiveMessageWaitTimeSchema.optional(),
-  maxMessageSize: MaxMessageSizeSchema.optional(),
-  batchSize: BatchSizeSchema.optional(),
-  retryAttempts: RetryAttemptsSchema3.optional()
+]).describe("Enable logging to a CloudWatch log group. Providing a duration value will set the log retention time.");
+var FileCodeSchema2 = z20.object({
+  file: LocalFileSchema.describe("The file path of the instance code.")
 });
-var QueuesSchema = z21.record(
-  ResourceIdSchema,
-  z21.union([
-    LocalFileSchema.transform((consumer) => ({
-      consumer
-    })).pipe(QueueSchema),
-    QueueSchema
-  ])
-).optional().describe(
-  "Define the queues in your stack. Queues are FIFO with required per-message groupId: messages with the same groupId are processed strictly in order; different groupIds parallelize."
-);
-
-// src/feature/rest/schema.ts
-import { z as z23 } from "zod";
-
-// src/config/schema/route.ts
-import { z as z22 } from "zod";
-var RouteSchema = z22.union([
-  z22.string().regex(/^(POST|GET|PUT|DELETE|HEAD|OPTIONS|ANY)(\s\/[a-z0-9\+\_\-\/\{\}]*)$/gi, "Invalid route"),
-  z22.literal("$default")
+var CodeSchema2 = z20.union([
+  LocalFileSchema.transform((file) => ({
+    file
+  })).pipe(FileCodeSchema2),
+  FileCodeSchema2
+]).describe("Specify the code of your instance.");
+var StartupCommandSchema = z20.union([z20.string().transform((v) => [v]), z20.string().array()]).describe("Optional shell commands to run before the instance program starts.");
+var ISchema = z20.object({
+  code: CodeSchema2,
+  description: DescriptionSchema2.optional(),
+  image: ImageSchema.optional(),
+  startupCommand: StartupCommandSchema.optional(),
+  log: LogSchema2.optional(),
+  cpu: CpuSchema.optional(),
+  memorySize: MemorySizeSchema2.optional(),
+  architecture: ArchitectureSchema3.optional(),
+  environment: EnvironmentSchema2.optional(),
+  permissions: PermissionsSchema2.optional(),
+  healthCheck: HealthCheckSchema.optional()
+  // restartPolicy: RestartPolicySchema.optional(),
+});
+var InstanceSchema = z20.union([
+  LocalFileSchema.transform((code) => ({
+    code
+  })).pipe(ISchema),
+  ISchema
 ]);
-
-// src/feature/rest/schema.ts
-var RestDefaultSchema = z23.record(
-  ResourceIdSchema,
-  z23.object({
-    domain: ResourceIdSchema.describe("The domain id to link your API with.").optional(),
-    subDomain: z23.string().optional()
-  })
-).optional().describe("Define your global REST API's.");
-var RestSchema = z23.record(
-  ResourceIdSchema,
-  z23.record(
-    RouteSchema.describe(
-      [
-        "The REST API route that is comprised by the http method and http path.",
-        "The possible http methods are POST, GET,PUT, DELETE, HEAD, OPTIONS, ANY.",
-        "Example: GET /posts/{id}"
-      ].join("\n")
-    ),
-    FunctionSchema
-  )
-).optional().describe("Define routes in your stack for your global REST API.");
-
-// src/feature/rpc/schema.ts
-import { minutes as minutes4, seconds as seconds3 } from "@awsless/duration";
-import { z as z25 } from "zod";
+var InstancesSchema = z20.record(ResourceIdSchema, InstanceSchema).optional().describe("Define the instances in your stack.");
+var InstanceDefaultSchema = z20.object({
+  image: ImageSchema.optional(),
+  cpu: CpuSchema.default(0.25),
+  memorySize: MemorySizeSchema2.default("512 MB"),
+  architecture: ArchitectureSchema3.default("arm64"),
+  environment: EnvironmentSchema2.optional(),
+  permissions: PermissionsSchema2.optional(),
+  healthCheck: HealthCheckSchema.optional(),
+  // restartPolicy: RestartPolicySchema.default({ enabled: true }),
+  log: LogSchema2.default(true).transform((log35) => ({
+    retention: log35.retention ?? days2(7)
+  }))
+}).default({});
 
 // src/feature/router/schema.ts
-import { days as days3, minutes as minutes3, parse as parse3 } from "@awsless/duration";
-import { z as z24 } from "zod";
-var ErrorResponsePathSchema = z24.string().describe(
+import { days as days3, minutes as minutes2, parse as parse3 } from "@awsless/duration";
+import { z as z21 } from "zod";
+var ErrorResponsePathSchema = z21.string().describe(
   [
     "The path to the custom error page that you want to return to the viewer when your origin returns the HTTP status code specified.",
     "- We recommend that you store custom error pages in an Amazon S3 bucket.",
     "If you store custom error pages on an HTTP server and the server starts to return 5xx errors, CloudFront can't get the files that you want to return to viewers because the origin server is unavailable."
   ].join("\n")
 );
-var StatusCodeSchema = z24.number().int().positive().optional().describe(
+var StatusCodeSchema = z21.number().int().positive().optional().describe(
   [
     "The HTTP status code that you want CloudFront to return to the viewer along with the custom error page.",
     "There are a variety of reasons that you might want CloudFront to return a status code different from the status code that your origin returned to CloudFront, for example:",
@@ -1505,26 +1524,26 @@ var StatusCodeSchema = z24.number().int().positive().optional().describe(
 var MinTTLSchema = DurationSchema.describe(
   "The minimum amount of time, that you want to cache the error response. When this time period has elapsed, CloudFront queries your origin to see whether the problem that caused the error has been resolved and the requested object is now available."
 );
-var ErrorResponseSchema = z24.union([
+var ErrorResponseSchema = z21.union([
   ErrorResponsePathSchema,
-  z24.object({
+  z21.object({
     path: ErrorResponsePathSchema,
     statusCode: StatusCodeSchema.optional(),
     minTTL: MinTTLSchema.optional()
   })
 ]).optional();
-var RouteSchema2 = z24.string().regex(/^\//, "Route must start with a slash (/)");
-var VisibilitySchema = z24.boolean().default(false).describe("Whether to enable CloudWatch metrics for the WAF rule.");
-var WafSettingsSchema = z24.object({
-  rateLimiter: z24.object({
-    limit: z24.number().min(10).max(2e9).default(10).describe(
+var RouteSchema = z21.string().regex(/^\//, "Route must start with a slash (/)");
+var VisibilitySchema = z21.boolean().default(false).describe("Whether to enable CloudWatch metrics for the WAF rule.");
+var WafSettingsSchema = z21.object({
+  rateLimiter: z21.object({
+    limit: z21.number().min(10).max(2e9).default(10).describe(
       "The limit on requests during the specified evaluation window for a single aggregation instance for the rate-based rule."
     ),
-    window: z24.union([
-      z24.literal("1 minute"),
-      z24.literal("2 minutes"),
-      z24.literal("5 minutes"),
-      z24.literal("10 minutes")
+    window: z21.union([
+      z21.literal("1 minute"),
+      z21.literal("2 minutes"),
+      z21.literal("5 minutes"),
+      z21.literal("10 minutes")
     ]).default("5 minutes").transform((v) => parse3(v)).describe(
       "The amount of time, in seconds, that AWS WAF should include in its request counts, looking back from the current time."
     ),
@@ -1532,39 +1551,39 @@ var WafSettingsSchema = z24.object({
   }).optional().describe(
     "A rate-based rule counts incoming requests and rate limits requests when they are coming at too fast a rate."
   ),
-  ddosProtection: z24.object({
-    sensitivity: z24.object({
-      challenge: z24.enum(["low", "medium", "high"]).default("low").transform((v) => v.toUpperCase()).describe("The sensitivity level for challenge requests."),
-      block: z24.enum(["low", "medium", "high"]).default("low").transform((v) => v.toUpperCase()).describe("The sensitivity level for block requests.")
+  ddosProtection: z21.object({
+    sensitivity: z21.object({
+      challenge: z21.enum(["low", "medium", "high"]).default("low").transform((v) => v.toUpperCase()).describe("The sensitivity level for challenge requests."),
+      block: z21.enum(["low", "medium", "high"]).default("low").transform((v) => v.toUpperCase()).describe("The sensitivity level for block requests.")
     }),
-    exemptUriRegex: z24.string().default("^$"),
+    exemptUriRegex: z21.string().default("^$"),
     visibility: VisibilitySchema
   }).optional().describe(
     "Provides protection against DDoS attacks targeting the application layer, also known as Layer 7 attacks. Uses 50 WCU."
   ),
-  botProtection: z24.object({
-    inspectionLevel: z24.enum(["common", "targeted"]).default("common").transform((v) => v.toUpperCase()),
+  botProtection: z21.object({
+    inspectionLevel: z21.enum(["common", "targeted"]).default("common").transform((v) => v.toUpperCase()),
     visibility: VisibilitySchema
   }).optional().describe(
     "Provides protection against automated bots that can consume excess resources, skew business metrics, cause downtime, or perform malicious activities. Bot Control provides additional visibility through Amazon CloudWatch and generates labels that you can use to control bot traffic to your applications. Uses 50 WCU."
   ),
-  captchaImmunityTime: DurationSchema.refine(durationMin(minutes3(1)), "Minimum timeout duration is 1 minute").refine(durationMax(days3(3)), "Maximum timeout duration is 3 days").default("5 minutes").describe(
+  captchaImmunityTime: DurationSchema.refine(durationMin(minutes2(1)), "Minimum timeout duration is 1 minute").refine(durationMax(days3(3)), "Maximum timeout duration is 3 days").default("5 minutes").describe(
     "The amount of time that a CAPTCHA timestamp is considered valid by AWS WAF. The default setting is 5 minutes."
   ),
-  challengeImmunityTime: DurationSchema.refine(durationMin(minutes3(1)), "Minimum timeout duration is 1 minute").refine(durationMax(days3(3)), "Maximum timeout duration is 3 days").default("5 minutes").describe(
+  challengeImmunityTime: DurationSchema.refine(durationMin(minutes2(1)), "Minimum timeout duration is 1 minute").refine(durationMax(days3(3)), "Maximum timeout duration is 3 days").default("5 minutes").describe(
     "The amount of time that a challenge timestamp is considered valid by AWS WAF. The default setting is 5 minutes."
   )
 }).describe(
   "WAF settings for the router. Each rule consumes Web ACL capacity units (WCUs). The total WCUs for a web ACL can't exceed 5000. Using over 1500 WCUs affects your costs."
 );
-var RouterDefaultSchema = z24.record(
+var RouterDefaultSchema = z21.record(
   ResourceIdSchema,
-  z24.object({
+  z21.object({
     domain: ResourceIdSchema.describe("The domain id to link your Router.").optional(),
-    subDomain: z24.string().optional(),
+    subDomain: z21.string().optional(),
     waf: WafSettingsSchema.optional(),
-    geoRestrictions: z24.array(z24.string().length(2).toUpperCase()).default([]).describe("Specifies a blacklist of countries that should be blocked."),
-    errors: z24.object({
+    geoRestrictions: z21.array(z21.string().length(2).toUpperCase()).default([]).describe("Specifies a blacklist of countries that should be blocked."),
+    errors: z21.object({
       400: ErrorResponseSchema.describe("Customize a `400 Bad Request` response."),
       403: ErrorResponseSchema.describe("Customize a `403 Forbidden` response."),
       404: ErrorResponseSchema.describe("Customize a `404 Not Found` response."),
@@ -1577,26 +1596,26 @@ var RouterDefaultSchema = z24.record(
       503: ErrorResponseSchema.describe("Customize a `503 Service Unavailable` response."),
       504: ErrorResponseSchema.describe("Customize a `504 Gateway Timeout` response.")
     }).optional().describe("Customize the error responses for specific HTTP status codes."),
-    cors: z24.object({
-      override: z24.boolean().default(false),
+    cors: z21.object({
+      override: z21.boolean().default(false),
       maxAge: DurationSchema.default("365 days"),
-      exposeHeaders: z24.string().array().optional(),
-      credentials: z24.boolean().default(false),
-      headers: z24.string().array().default(["*"]),
-      origins: z24.string().array().default(["*"]),
-      methods: z24.enum(["GET", "DELETE", "HEAD", "OPTIONS", "PATCH", "POST", "PUT", "ALL"]).array().default(["ALL"])
+      exposeHeaders: z21.string().array().optional(),
+      credentials: z21.boolean().default(false),
+      headers: z21.string().array().default(["*"]),
+      origins: z21.string().array().default(["*"]),
+      methods: z21.enum(["GET", "DELETE", "HEAD", "OPTIONS", "PATCH", "POST", "PUT", "ALL"]).array().default(["ALL"])
     }).optional().describe("Specify the cors headers."),
-    passwordAuth: z24.object({
-      password: z24.string().describe("Password.")
+    passwordAuth: z21.object({
+      password: z21.string().describe("Password.")
     }).optional().describe(
       [
         "Enable password authentication for the router.",
         'You can authenicate by adding a "authorization" header with the value "Password [YOUR_PASSWORD]".'
       ].join("\n")
     ),
-    basicAuth: z24.object({
-      username: z24.string().describe("Basic auth username."),
-      password: z24.string().describe("Basic auth password.")
+    basicAuth: z21.object({
+      username: z21.string().describe("Basic auth username."),
+      password: z21.string().describe("Basic auth password.")
     }).optional().describe("Enable basic authentication for the router."),
     // security: z
     // 	.object({
@@ -1643,49 +1662,163 @@ var RouterDefaultSchema = z24.record(
     // 	})
     // 	.optional()
     // 	.describe('Specify the security policy.'),
-    cache: z24.object({
-      cookies: z24.string().array().optional().describe("Specifies the cookies that CloudFront includes in the cache key."),
-      headers: z24.string().array().optional().describe("Specifies the headers that CloudFront includes in the cache key."),
-      queries: z24.string().array().optional().describe("Specifies the query values that CloudFront includes in the cache key.")
+    cache: z21.object({
+      cookies: z21.string().array().optional().describe("Specifies the cookies that CloudFront includes in the cache key."),
+      headers: z21.string().array().optional().describe("Specifies the headers that CloudFront includes in the cache key."),
+      queries: z21.string().array().optional().describe("Specifies the query values that CloudFront includes in the cache key.")
     }).optional().describe(
       "Specifies the cookies, headers, and query values that CloudFront includes in the cache key."
     )
   })
 ).optional().describe(`Define the global Router. Backed by AWS CloudFront.`);
 
-// src/feature/rpc/schema.ts
-var TimeoutSchema2 = DurationSchema.refine(durationMin(seconds3(10)), "Minimum timeout duration is 10 seconds").refine(durationMax(minutes4(5)), "Maximum timeout duration is 5 minutes").describe(
-  [
-    "The amount of time that the RPC lambda is allowed run before stopping it.",
-    "You can specify a timeout from 10 second to 5 minutes.",
-    "The timeouts of all inner RPC functions will be capped at 80% of this timeout."
-  ].join(" ")
+// src/feature/pubsub/schema.ts
+var PubSubDefaultSchema = z22.record(
+  ResourceIdSchema,
+  z22.object({
+    auth: FunctionSchema.describe(
+      "The authorizer that validates the client auth token and returns the allowed topics."
+    ),
+    router: ResourceIdSchema.describe("The router id to route pubsub traffic through."),
+    path: RouteSchema.default("/ws").describe("The base path on the router that exposes the pubsub endpoint."),
+    log: LogSchema2.default(true).transform((log35) => ({
+      retention: log35.retention ?? days4(7)
+    }))
+  })
+).optional().describe("Define the pubsub API for your app. Backed by a websocket server on AWS Fargate.");
+var PubSubSchema = z22.record(
+  ResourceIdSchema,
+  z22.object({
+    connected: FunctionSchema.optional().describe("Subscribe to the event when a client connects."),
+    disconnected: FunctionSchema.optional().describe("Subscribe to the event when a client disconnects."),
+    subscribed: FunctionSchema.optional().describe(
+      "Subscribe to the event when a client subscribes to topics."
+    ),
+    unsubscribed: FunctionSchema.optional().describe(
+      "Subscribe to the event when a client unsubscribes from topics."
+    )
+  })
+).optional().describe("Define the pubsub event listeners in your stack.");
+var pubsubEventTypes = ["connected", "disconnected", "subscribed", "unsubscribed"];
+
+// src/feature/queue/schema.ts
+import { days as days5, hours, minutes as minutes3, seconds as seconds2 } from "@awsless/duration";
+import { kibibytes } from "@awsless/size";
+import { z as z23 } from "zod";
+var RetentionPeriodSchema = DurationSchema.refine(durationMin(minutes3(1)), "Minimum retention period is 1 minute").refine(durationMax(days5(14)), "Maximum retention period is 14 days").describe(
+  "The number of seconds that Amazon SQS retains a message. You can specify a duration from 1 minute to 14 days."
+);
+var VisibilityTimeoutSchema = DurationSchema.refine(
+  durationMax(hours(12)),
+  "Maximum visibility timeout is 12 hours"
+).describe(
+  "The length of time during which a message will be unavailable after a message is delivered from the queue. You can specify a duration from 0 to 12 hours."
+);
+var ReceiveMessageWaitTimeSchema = DurationSchema.refine(
+  durationMin(seconds2(1)),
+  "Minimum receive message wait time is 1 second"
+).refine(durationMax(seconds2(20)), "Maximum receive message wait time is 20 seconds").describe("Long-polling wait time. You can specify a duration from 1 to 20 seconds.");
+var MaxMessageSizeSchema = SizeSchema.refine(sizeMin(kibibytes(1)), "Minimum max message size is 1 KB").refine(sizeMax(kibibytes(256)), "Maximum max message size is 256 KB").describe("Message size limit. You can specify a size from 1 KB to 256 KB.");
+var BatchSizeSchema = z23.number().int().min(1, "Minimum batch size is 1").max(10, "FIFO queues support a maximum batch size of 10").describe("The maximum number of records per batch. FIFO queues are capped at 10.");
+var RetryAttemptsSchema2 = z23.number().int().min(0).max(999).describe(
+  "The maximum number of times to retry when the function returns an error. You can specify a number from 0 to 999."
+);
+var QueueDefaultSchema = z23.object({
+  retentionPeriod: RetentionPeriodSchema.default("7 days"),
+  visibilityTimeout: VisibilityTimeoutSchema.default("2 minutes"),
+  receiveMessageWaitTime: ReceiveMessageWaitTimeSchema.optional(),
+  maxMessageSize: MaxMessageSizeSchema.default("256 KB"),
+  batchSize: BatchSizeSchema.default(10),
+  retryAttempts: RetryAttemptsSchema2.default(2)
+}).default({});
+var QueueSchema = z23.object({
+  consumer: FunctionSchema.optional().describe("The consuming lambda function properties."),
+  retentionPeriod: RetentionPeriodSchema.optional(),
+  visibilityTimeout: VisibilityTimeoutSchema.optional(),
+  receiveMessageWaitTime: ReceiveMessageWaitTimeSchema.optional(),
+  maxMessageSize: MaxMessageSizeSchema.optional(),
+  batchSize: BatchSizeSchema.optional(),
+  retryAttempts: RetryAttemptsSchema2.optional()
+});
+var QueuesSchema = z23.record(
+  ResourceIdSchema,
+  z23.union([
+    LocalFileSchema.transform((consumer) => ({
+      consumer
+    })).pipe(QueueSchema),
+    QueueSchema
+  ])
+).optional().describe(
+  "Define the queues in your stack. Queues are FIFO with required per-message groupId: messages with the same groupId are processed strictly in order; different groupIds parallelize."
 );
-var RpcDefaultSchema = z25.record(
+
+// src/feature/rest/schema.ts
+import { z as z25 } from "zod";
+
+// src/config/schema/route.ts
+import { z as z24 } from "zod";
+var RouteSchema2 = z24.union([
+  z24.string().regex(/^(POST|GET|PUT|DELETE|HEAD|OPTIONS|ANY)(\s\/[a-z0-9\+\_\-\/\{\}]*)$/gi, "Invalid route"),
+  z24.literal("$default")
+]);
+
+// src/feature/rest/schema.ts
+var RestDefaultSchema = z25.record(
   ResourceIdSchema,
   z25.object({
-    // domain: ResourceIdSchema.describe('The domain id to link your RPC API with.').optional(),
-    // subDomain: z.string().optional(),
-    //
-    router: ResourceIdSchema.describe("The router id to link your RPC API with."),
-    path: RouteSchema2.describe("The path inside the router to link your RPC API to."),
-    auth: FunctionSchema.optional().describe("The authentication handler for your RPC API."),
-    log: LogSchema.optional(),
-    timeout: TimeoutSchema2.default("1 minutes")
+    domain: ResourceIdSchema.describe("The domain id to link your API with.").optional(),
+    subDomain: z25.string().optional()
   })
-).describe(`Define the global RPC API's.`).optional();
-var RpcSchema = z25.record(
+).optional().describe("Define your global REST API's.");
+var RestSchema = z25.record(
   ResourceIdSchema,
   z25.record(
-    z25.string(),
-    z25.union([
-      FunctionSchema.transform((f) => ({
-        function: f,
+    RouteSchema2.describe(
+      [
+        "The REST API route that is comprised by the http method and http path.",
+        "The possible http methods are POST, GET,PUT, DELETE, HEAD, OPTIONS, ANY.",
+        "Example: GET /posts/{id}"
+      ].join("\n")
+    ),
+    FunctionSchema
+  )
+).optional().describe("Define routes in your stack for your global REST API.");
+
+// src/feature/rpc/schema.ts
+import { minutes as minutes4, seconds as seconds3 } from "@awsless/duration";
+import { z as z26 } from "zod";
+var TimeoutSchema2 = DurationSchema.refine(durationMin(seconds3(10)), "Minimum timeout duration is 10 seconds").refine(durationMax(minutes4(5)), "Maximum timeout duration is 5 minutes").describe(
+  [
+    "The amount of time that the RPC lambda is allowed run before stopping it.",
+    "You can specify a timeout from 10 second to 5 minutes.",
+    "The timeouts of all inner RPC functions will be capped at 80% of this timeout."
+  ].join(" ")
+);
+var RpcDefaultSchema = z26.record(
+  ResourceIdSchema,
+  z26.object({
+    // domain: ResourceIdSchema.describe('The domain id to link your RPC API with.').optional(),
+    // subDomain: z.string().optional(),
+    //
+    router: ResourceIdSchema.describe("The router id to link your RPC API with."),
+    path: RouteSchema.describe("The path inside the router to link your RPC API to."),
+    auth: FunctionSchema.optional().describe("The authentication handler for your RPC API."),
+    log: LogSchema.optional(),
+    timeout: TimeoutSchema2.default("1 minutes")
+  })
+).describe(`Define the global RPC API's.`).optional();
+var RpcSchema = z26.record(
+  ResourceIdSchema,
+  z26.record(
+    z26.string(),
+    z26.union([
+      FunctionSchema.transform((f) => ({
+        function: f,
         lock: false
       })),
-      z25.object({
+      z26.object({
         function: FunctionSchema.describe("The RPC function to execute."),
-        lock: z25.boolean().describe(
+        lock: z26.boolean().describe(
           [
             "Specify if the function should be locked on the `lockKey` returned from the auth function.",
             "An example would be returning the user ID as `lockKey`."
@@ -1697,136 +1830,10 @@ var RpcSchema = z25.record(
 ).describe("Define the schema in your stack for your global RPC API.").optional();
 
 // src/feature/job/schema.ts
-import { days as days4, toDays as toDays2 } from "@awsless/duration";
-import { toMebibytes } from "@awsless/size";
-import { z as z26 } from "zod";
-var CpuSchema = z26.union([z26.literal(0.25), z26.literal(0.5), z26.literal(1), z26.literal(2), z26.literal(4), z26.literal(8), z26.literal(16)]).transform((v) => `${v} vCPU`).describe("The number of virtual CPU units (vCPU) used by the job. Valid values: 0.25, 0.5, 1, 2, 4, 8, 16 vCPU.");
-var validMemorySize = [
-  // 0.25 vCPU
-  512,
-  1024,
-  2048,
-  // 0.5 vCPU
-  1024,
-  2048,
-  3072,
-  4096,
-  // 1 vCPU
-  2048,
-  3072,
-  4096,
-  5120,
-  6144,
-  7168,
-  8192,
-  // 2 vCPU
-  4096,
-  5120,
-  6144,
-  7168,
-  8192,
-  9216,
-  10240,
-  11264,
-  12288,
-  13312,
-  14336,
-  15360,
-  16384
-];
-var MemorySizeSchema2 = SizeSchema.refine(
-  (s) => validMemorySize.includes(toMebibytes(s)),
-  `Invalid memory size. Allowed sizes: ${validMemorySize.join(", ")} MiB`
-).describe("The amount of memory (in MiB) used by the job. Valid memory values depend on the CPU configuration.");
-var EnvironmentSchema2 = z26.record(z26.string(), z26.string()).optional().describe("Environment variable key-value pairs.");
-var ArchitectureSchema3 = z26.enum(["x86_64", "arm64"]).describe("The instruction set architecture that the job supports.");
-var ActionSchema2 = z26.string();
-var ActionsSchema2 = z26.union([ActionSchema2.transform((v) => [v]), ActionSchema2.array()]);
-var ArnSchema2 = z26.string().startsWith("arn:");
-var WildcardSchema2 = z26.literal("*");
-var ResourceSchema2 = z26.union([ArnSchema2, WildcardSchema2]);
-var ResourcesSchema2 = z26.union([ResourceSchema2.transform((v) => [v]), ResourceSchema2.array()]);
-var PermissionSchema2 = z26.object({
-  effect: z26.enum(["allow", "deny"]).default("allow"),
-  actions: ActionsSchema2,
-  resources: ResourcesSchema2
-});
-var PermissionsSchema2 = z26.union([PermissionSchema2.transform((v) => [v]), PermissionSchema2.array()]).describe("Add IAM permissions to your job.");
-var validLogRetentionDays2 = [
-  ...[1, 3, 5, 7, 14, 30, 60, 90, 120, 150],
-  ...[180, 365, 400, 545, 731, 1096, 1827, 2192],
-  ...[2557, 2922, 3288, 3653]
-];
-var LogRetentionSchema2 = DurationSchema.refine(
-  durationMin(days4(0)),
-  "Minimum log retention is 0 day, which will disable logging."
-).refine(
-  (duration) => {
-    return validLogRetentionDays2.includes(toDays2(duration));
-  },
-  `Invalid log retention. Valid days are: ${validLogRetentionDays2.map((days12) => `${days12}`).join(", ")}`
-).describe("The log retention duration.");
-var LogSchema2 = z26.union([
-  z26.boolean().transform((enabled) => ({ retention: enabled ? days4(7) : days4(0) })),
-  LogRetentionSchema2.transform((retention) => ({ retention })),
-  z26.object({
-    retention: LogRetentionSchema2.optional()
-  })
-]).describe("Enable logging to a CloudWatch log group. Providing a duration value will set the log retention time.");
-var FileCodeSchema2 = z26.object({
-  file: LocalFileSchema.describe("The file path of the job code.")
-});
-var CodeSchema2 = z26.union([
-  LocalFileSchema.transform((file) => ({
-    file
-  })).pipe(FileCodeSchema2),
-  FileCodeSchema2
-]).describe("Specify the code of your job.");
-var TimeoutSchema3 = DurationSchema.describe("The maximum time the job is allowed to run before being stopped.");
-var ImageSchema = z26.string().describe("The URL of the container image to use. Default: public.ecr.aws/aws-cli/aws-cli:{architecture}");
-var PersistentStorageSchema = z26.boolean().describe("Mount persistent storage for the job at a fixed internal path.");
-var StartupCommandSchema = z26.union([z26.string().transform((v) => [v]), z26.string().array()]).describe("Optional shell commands to run before the job executable is downloaded and started.");
-var ASchema = z26.object({
-  code: CodeSchema2,
-  image: ImageSchema.optional(),
-  persistentStorage: PersistentStorageSchema.optional(),
-  startupCommand: StartupCommandSchema.optional(),
-  log: LogSchema2.optional(),
-  cpu: CpuSchema.optional(),
-  memorySize: MemorySizeSchema2.optional(),
-  architecture: ArchitectureSchema3.optional(),
-  environment: EnvironmentSchema2.optional(),
-  permissions: PermissionsSchema2.optional(),
-  timeout: TimeoutSchema3.default("30 minutes").describe("The maximum time the job is allowed to run before being stopped. Default: 30 minutes.")
-});
-var JobSchema = z26.union([
-  LocalFileSchema.transform((code) => ({
-    code
-  })).pipe(ASchema),
-  ASchema
-]);
-var JobsSchema = z26.record(ResourceIdSchema, JobSchema).optional().describe("Define the jobs in your stack.");
-var JobDefaultSchema = z26.object({
-  image: ImageSchema.optional(),
-  persistentStorage: PersistentStorageSchema.optional(),
-  cpu: CpuSchema.default(0.25),
-  memorySize: MemorySizeSchema2.default("512 MB"),
-  architecture: ArchitectureSchema3.default("arm64"),
-  environment: EnvironmentSchema2.optional(),
-  permissions: PermissionsSchema2.optional(),
-  timeout: TimeoutSchema3.optional(),
-  log: LogSchema2.default(true).transform((log35) => ({
-    retention: log35.retention ?? days4(7)
-  }))
-}).default({});
-
-// src/feature/instance/schema.ts
-import { days as days5, toDays as toDays3 } from "@awsless/duration";
+import { days as days6, toDays as toDays3 } from "@awsless/duration";
 import { toMebibytes as toMebibytes2 } from "@awsless/size";
 import { z as z27 } from "zod";
-var CpuSchema2 = z27.union([z27.literal(0.25), z27.literal(0.5), z27.literal(1), z27.literal(2), z27.literal(4), z27.literal(8), z27.literal(16)]).transform((v) => `${v} vCPU`).describe(
-  "The number of virtual CPU units (vCPU) used by the instance. Valid values: 0.25, 0.5, 1, 2, 4, 8, 16 vCPU."
-);
+var CpuSchema2 = z27.union([z27.literal(0.25), z27.literal(0.5), z27.literal(1), z27.literal(2), z27.literal(4), z27.literal(8), z27.literal(16)]).transform((v) => `${v} vCPU`).describe("The number of virtual CPU units (vCPU) used by the job. Valid values: 0.25, 0.5, 1, 2, 4, 8, 16 vCPU.");
 var validMemorySize2 = [
   // 0.25 vCPU
   512,
@@ -1863,22 +1870,9 @@ var validMemorySize2 = [
 var MemorySizeSchema3 = SizeSchema.refine(
   (s) => validMemorySize2.includes(toMebibytes2(s)),
   `Invalid memory size. Allowed sizes: ${validMemorySize2.join(", ")} MiB`
-).describe("The amount of memory (in MiB) used by the instance. Valid memory values depend on the CPU configuration.");
-var HealthCheckSchema = z27.object({
-  path: z27.string().describe("The path that the container runs to determine if it is healthy."),
-  interval: DurationSchema.describe("The time period in seconds between each health check execution."),
-  retries: z27.number().int().min(1).max(10).describe(
-    "The number of times to retry a failed health check before the container is considered unhealthy."
-  ),
-  startPeriod: DurationSchema.describe(
-    "The optional grace period to provide containers time to bootstrap before failed health checks count towards the maximum number of retries."
-  ),
-  timeout: DurationSchema.describe(
-    "The time period in seconds to wait for a health check to succeed before it is considered a failure."
-  )
-}).describe("The health check command and associated configuration parameters for the container.");
+).describe("The amount of memory (in MiB) used by the job. Valid memory values depend on the CPU configuration.");
 var EnvironmentSchema3 = z27.record(z27.string(), z27.string()).optional().describe("Environment variable key-value pairs.");
-var ArchitectureSchema4 = z27.enum(["x86_64", "arm64"]).describe("The instruction set architecture that the instance supports.");
+var ArchitectureSchema4 = z27.enum(["x86_64", "arm64"]).describe("The instruction set architecture that the job supports.");
 var ActionSchema3 = z27.string();
 var ActionsSchema3 = z27.union([ActionSchema3.transform((v) => [v]), ActionSchema3.array()]);
 var ArnSchema3 = z27.string().startsWith("arn:");
@@ -1890,44 +1884,45 @@ var PermissionSchema3 = z27.object({
   actions: ActionsSchema3,
   resources: ResourcesSchema3
 });
-var PermissionsSchema3 = z27.union([PermissionSchema3.transform((v) => [v]), PermissionSchema3.array()]).describe("Add IAM permissions to your instance.");
-var DescriptionSchema2 = z27.string().describe("A description of the instance.");
-var ImageSchema2 = z27.string().optional().describe("The URL of the container image to use. Default: public.ecr.aws/aws-cli/aws-cli:{architecture}");
+var PermissionsSchema3 = z27.union([PermissionSchema3.transform((v) => [v]), PermissionSchema3.array()]).describe("Add IAM permissions to your job.");
 var validLogRetentionDays3 = [
   ...[1, 3, 5, 7, 14, 30, 60, 90, 120, 150],
   ...[180, 365, 400, 545, 731, 1096, 1827, 2192],
   ...[2557, 2922, 3288, 3653]
 ];
 var LogRetentionSchema3 = DurationSchema.refine(
-  durationMin(days5(0)),
+  durationMin(days6(0)),
   "Minimum log retention is 0 day, which will disable logging."
 ).refine(
   (duration) => {
     return validLogRetentionDays3.includes(toDays3(duration));
   },
-  `Invalid log retention. Valid days are: ${validLogRetentionDays3.map((days12) => `${days12}`).join(", ")}`
+  `Invalid log retention. Valid days are: ${validLogRetentionDays3.map((days13) => `${days13}`).join(", ")}`
 ).describe("The log retention duration.");
 var LogSchema3 = z27.union([
-  z27.boolean().transform((enabled) => ({ retention: enabled ? days5(7) : days5(0) })),
+  z27.boolean().transform((enabled) => ({ retention: enabled ? days6(7) : days6(0) })),
   LogRetentionSchema3.transform((retention) => ({ retention })),
   z27.object({
     retention: LogRetentionSchema3.optional()
   })
 ]).describe("Enable logging to a CloudWatch log group. Providing a duration value will set the log retention time.");
 var FileCodeSchema3 = z27.object({
-  file: LocalFileSchema.describe("The file path of the instance code.")
+  file: LocalFileSchema.describe("The file path of the job code.")
 });
 var CodeSchema3 = z27.union([
   LocalFileSchema.transform((file) => ({
     file
   })).pipe(FileCodeSchema3),
   FileCodeSchema3
-]).describe("Specify the code of your instance.");
-var StartupCommandSchema2 = z27.union([z27.string().transform((v) => [v]), z27.string().array()]).describe("Optional shell commands to run before the instance program starts.");
-var ISchema = z27.object({
+]).describe("Specify the code of your job.");
+var TimeoutSchema3 = DurationSchema.describe("The maximum time the job is allowed to run before being stopped.");
+var ImageSchema2 = z27.string().describe("The URL of the container image to use. Default: public.ecr.aws/aws-cli/aws-cli:{architecture}");
+var PersistentStorageSchema = z27.boolean().describe("Mount persistent storage for the job at a fixed internal path.");
+var StartupCommandSchema2 = z27.union([z27.string().transform((v) => [v]), z27.string().array()]).describe("Optional shell commands to run before the job executable is downloaded and started.");
+var ASchema = z27.object({
   code: CodeSchema3,
-  description: DescriptionSchema2.optional(),
   image: ImageSchema2.optional(),
+  persistentStorage: PersistentStorageSchema.optional(),
   startupCommand: StartupCommandSchema2.optional(),
   log: LogSchema3.optional(),
   cpu: CpuSchema2.optional(),
@@ -1935,27 +1930,26 @@ var ISchema = z27.object({
   architecture: ArchitectureSchema4.optional(),
   environment: EnvironmentSchema3.optional(),
   permissions: PermissionsSchema3.optional(),
-  healthCheck: HealthCheckSchema.optional()
-  // restartPolicy: RestartPolicySchema.optional(),
+  timeout: TimeoutSchema3.default("30 minutes").describe("The maximum time the job is allowed to run before being stopped. Default: 30 minutes.")
 });
-var InstanceSchema = z27.union([
+var JobSchema = z27.union([
   LocalFileSchema.transform((code) => ({
     code
-  })).pipe(ISchema),
-  ISchema
+  })).pipe(ASchema),
+  ASchema
 ]);
-var InstancesSchema = z27.record(ResourceIdSchema, InstanceSchema).optional().describe("Define the instances in your stack.");
-var InstanceDefaultSchema = z27.object({
+var JobsSchema = z27.record(ResourceIdSchema, JobSchema).optional().describe("Define the jobs in your stack.");
+var JobDefaultSchema = z27.object({
   image: ImageSchema2.optional(),
+  persistentStorage: PersistentStorageSchema.optional(),
   cpu: CpuSchema2.default(0.25),
   memorySize: MemorySizeSchema3.default("512 MB"),
   architecture: ArchitectureSchema4.default("arm64"),
   environment: EnvironmentSchema3.optional(),
   permissions: PermissionsSchema3.optional(),
-  healthCheck: HealthCheckSchema.optional(),
-  // restartPolicy: RestartPolicySchema.default({ enabled: true }),
+  timeout: TimeoutSchema3.optional(),
   log: LogSchema3.default(true).transform((log35) => ({
-    retention: log35.retention ?? days5(7)
+    retention: log35.retention ?? days6(7)
   }))
 }).default({});
 
@@ -2153,7 +2147,7 @@ var CronExpressionSchema = z34.custom(
 var ScheduleExpressionSchema = RateExpressionSchema.or(CronExpressionSchema);
 
 // src/feature/cron/schema/index.ts
-var RetryAttemptsSchema4 = z35.number().int().min(0).max(2).describe(
+var RetryAttemptsSchema3 = z35.number().int().min(0).max(2).describe(
   "The maximum number of times to retry when the function returns an error. You can specify a number from 0 to 2."
 );
 var CronsSchema = z35.record(
@@ -2165,7 +2159,7 @@ var CronsSchema = z35.record(
       'The scheduling expression.\n\nexample: "0 20 * * ? *"\nexample: "5 minutes"'
     ),
     payload: z35.unknown().optional().describe("The JSON payload that will be passed to the consumer."),
-    retryAttempts: RetryAttemptsSchema4.default(2)
+    retryAttempts: RetryAttemptsSchema3.default(2)
   })
 ).optional().describe(`Define the cron jobs in your stack.`);
 
@@ -2295,7 +2289,7 @@ var SitesSchema = z38.record(
   ResourceIdSchema,
   z38.object({
     router: ResourceIdSchema.describe("The router id to link your site with."),
-    path: RouteSchema2.describe("The path inside the router to link your site to."),
+    path: RouteSchema.describe("The path inside the router to link your site to."),
     build: z38.object({
       command: z38.string().describe(
         `Specifies the files and directories to generate the cache key for your custom build command.`
@@ -2313,11 +2307,11 @@ var SitesSchema = z38.record(
 ).optional().describe("Define the sites in your stack.");
 
 // src/feature/store/schema.ts
-import { days as days6 } from "@awsless/duration";
+import { days as days7 } from "@awsless/duration";
 import { z as z39 } from "zod";
 var LifecycleRuleSchema = z39.object({
   prefix: z39.string().optional().describe("Object-key prefix this rule applies to. Omit to apply bucket-wide."),
-  expiration: DurationSchema.refine(durationMin(days6(1)), "Minimum expiration is 1 day").describe(
+  expiration: DurationSchema.refine(durationMin(days7(1)), "Minimum expiration is 1 day").describe(
     "How long objects matching this rule live before S3 deletes them."
   )
 });
@@ -2381,7 +2375,7 @@ var IconsSchema = z40.record(
     // domain: ResourceIdSchema.describe('The domain id to link your site with.').optional(),
     // subDomain: z.string().optional(),
     router: ResourceIdSchema.describe("The router id to link your icon proxy."),
-    path: RouteSchema2.describe("The path inside the router to link your icon proxy to."),
+    path: RouteSchema.describe("The path inside the router to link your icon proxy to."),
     log: LogSchema.optional(),
     cacheDuration: DurationSchema.optional().describe("The cache duration of the cached icons."),
     preserveIds: z40.boolean().optional().default(false).describe("Preserve the IDs of the icons."),
@@ -2438,7 +2432,7 @@ var ImagesSchema = z41.record(
     // domain: ResourceIdSchema.describe('The domain id to link your site with.').optional(),
     // subDomain: z.string().optional(),
     router: ResourceIdSchema.describe("The router id to link your image proxy."),
-    path: RouteSchema2.describe("The path inside the router to link your image proxy to."),
+    path: RouteSchema.describe("The path inside the router to link your image proxy to."),
     log: LogSchema.optional(),
     cacheDuration: DurationSchema.optional().describe("Cache duration of the cached images."),
     presets: z41.record(z41.string(), transformationOptionsSchema).describe("Named presets for image transformations"),
@@ -3690,13 +3684,15 @@ var bundleTypeScriptWithRolldown = async ({
   file,
   nativeDir,
   external,
+  externalAwsSdk = true,
+  codeSplitting = true,
   importAsString: importAsStringList
 }) => {
   const bundle = await rolldown({
     input: file,
     platform: "node",
     external: (importee) => {
-      return importee.startsWith("@aws-sdk") || importee.startsWith("aws-sdk") || external?.includes(importee);
+      return externalAwsSdk && (importee.startsWith("@aws-sdk") || importee.startsWith("aws-sdk")) || external?.includes(importee);
     },
     onwarn: (error) => {
       debugError(error.message);
@@ -3725,6 +3721,7 @@ var bundleTypeScriptWithRolldown = async ({
     exports: "auto",
     entryFileNames: `index.${ext}`,
     chunkFileNames: `[name].${ext}`,
+    codeSplitting,
     minify
   });
   const hash = createHash2("sha1");
@@ -4549,7 +4546,7 @@ var functionFeature = defineFeature({
 });
 
 // src/feature/function/prebuild.ts
-import { days as days7, seconds as seconds5, toDays as toDays6, toSeconds as toSeconds3 } from "@awsless/duration";
+import { days as days8, seconds as seconds5, toDays as toDays6, toSeconds as toSeconds3 } from "@awsless/duration";
 import { mebibytes as mebibytes2, toMebibytes as toMebibytes4 } from "@awsless/size";
 import { aws as aws8 } from "@terraforge/aws";
 import { Output as Output4, findInputDeps as findInputDeps2, resolveInputs as resolveInputs2 } from "@terraforge/core";
@@ -4614,6 +4611,28 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, props) => {
       statementDeps.add(dep);
     }
   };
+  if (props.vpc) {
+    new aws8.iam.RolePolicy(group, "vpc-policy", {
+      role: role.name,
+      name: "lambda-vpc-policy",
+      policy: JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Action: [
+              "ec2:CreateNetworkInterface",
+              "ec2:DescribeNetworkInterfaces",
+              "ec2:DeleteNetworkInterface",
+              "ec2:AssignPrivateIpAddresses",
+              "ec2:UnassignPrivateIpAddresses"
+            ],
+            Resource: ["*"]
+          }
+        ]
+      })
+    });
+  }
   ctx.onPermission((statement) => {
     addPermission(statement);
   });
@@ -4662,6 +4681,11 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, props) => {
     environment: {
       variables
     },
+    vpcConfig: props.vpc ? {
+      securityGroupIds: [ctx.shared.get("vpc", "security-group-id")],
+      subnetIds: ctx.shared.get("vpc", "private-subnets"),
+      ipv6AllowedForDualStack: true
+    } : void 0,
     loggingConfig: {
       logGroup: `/aws/lambda/${name}`,
       logFormat: logFormats[props.log && "format" in props.log && props.log.format || "json"],
@@ -4678,10 +4702,13 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, props) => {
   if ("stackConfig" in ctx) {
     variables.STACK = ctx.stackConfig.name;
   }
+  if (props.vpc) {
+    variables.AWS_USE_DUALSTACK_ENDPOINT = "true";
+  }
   if (props.log?.retention && props.log?.retention?.value > 0n) {
     const logGroup = new aws8.cloudwatch.LogGroup(group, "log", {
       name: `/aws/lambda/${name}`,
-      retentionInDays: toDays6(props.log.retention ?? days7(7))
+      retentionInDays: toDays6(props.log.retention ?? days8(7))
     });
     addPermission({
       actions: ["logs:PutLogEvents", "logs:CreateLogStream"],
@@ -4738,7 +4765,7 @@ import { Group as Group8 } from "@terraforge/core";
 import { aws as aws9 } from "@terraforge/aws";
 import { join as join10 } from "path";
 import { mebibytes as mebibytes3 } from "@awsless/size";
-import { days as days8, seconds as seconds6 } from "@awsless/duration";
+import { days as days9, seconds as seconds6 } from "@awsless/duration";
 var onErrorLogFeature = defineFeature({
   name: "on-error-log",
   onApp(ctx) {
@@ -4753,7 +4780,7 @@ var onErrorLogFeature = defineFeature({
       log: {
         format: "json",
         level: "warn",
-        retention: days8(3),
+        retention: days9(3),
         system: "warn"
       }
     });
@@ -4810,7 +4837,7 @@ import { Group as Group9 } from "@terraforge/core";
 import { aws as aws10 } from "@terraforge/aws";
 import { join as join11 } from "path";
 import { mebibytes as mebibytes4 } from "@awsless/size";
-import { days as days9, toSeconds as toSeconds4 } from "@awsless/duration";
+import { days as days10, toSeconds as toSeconds4 } from "@awsless/duration";
 var onFailureFeature = defineFeature({
   name: "on-failure",
   onApp(ctx) {
@@ -4821,7 +4848,7 @@ var onFailureFeature = defineFeature({
         resourceType: "on-failure",
         resourceName: "deadletter"
       }),
-      messageRetentionSeconds: toSeconds4(days9(14))
+      messageRetentionSeconds: toSeconds4(days10(14))
     });
     const queue2 = new aws10.sqs.Queue(group, "on-failure", {
       name: formatGlobalResourceName({
@@ -4969,7 +4996,7 @@ var onFailureFeature = defineFeature({
         log: {
           format: "json",
           level: "warn",
-          retention: days9(3),
+          retention: days10(3),
           system: "warn"
         }
       });
@@ -5044,9 +5071,14 @@ var onFailureFeature = defineFeature({
 });
 
 // src/feature/pubsub/index.ts
-import { Group as Group10 } from "@terraforge/core";
-import { aws as aws11 } from "@terraforge/aws";
+import { seconds as seconds7 } from "@awsless/duration";
+import { mebibytes as mebibytes5 } from "@awsless/size";
+import { aws as aws12 } from "@terraforge/aws";
+import { Group as Group11 } from "@terraforge/core";
 import { constantCase as constantCase5 } from "change-case";
+import { createHmac as createHmac2 } from "crypto";
+import { dirname as dirname6, join as join14 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/feature/domain/util.ts
 var getDomainNameById = (config2, id) => {
@@ -5066,103 +5098,739 @@ var formatFullDomainName = (config2, id, subDomain) => {
   return domain2;
 };
 
-// src/feature/pubsub/index.ts
-import { minutes as minutes7, toSeconds as toSeconds5 } from "@awsless/duration";
-var pubsubFeature = defineFeature({
-  name: "pubsub",
-  onApp(ctx) {
-    ctx.addGlobalPermission({
-      actions: ["iot:Publish"],
-      resources: [
-        // `arn:aws:iot:${ctx.appConfig.region}:${ctx.accountId}:topic/*`,
-        `arn:aws:iot:${ctx.appConfig.region}:${ctx.accountId}:topic/${ctx.app.name}/pubsub/*`
-      ]
+// src/feature/pubsub/util.ts
+import { toDays as toDays7 } from "@awsless/duration";
+import { stringify } from "@awsless/json";
+import { aws as aws11 } from "@terraforge/aws";
+import { Group as Group10, Output as Output5, findInputDeps as findInputDeps3, resolveInputs as resolveInputs3 } from "@terraforge/core";
+import { pascalCase as pascalCase3 } from "change-case";
+import { createHash as createHash4 } from "crypto";
+import { readFile as readFile5 } from "fs/promises";
+import { fileURLToPath } from "url";
+import { dirname as dirname5, join as join13 } from "path";
+
+// src/feature/instance/build/executable.ts
+import { createHash as createHash3 } from "crypto";
+import { readFile as readFile4 } from "fs/promises";
+import { join as join12 } from "path";
+var buildExecutable = async (input, outputPath, architecture) => {
+  const filePath = join12(outputPath, "program");
+  const target = architecture === "x86_64" ? "bun-linux-x64" : "bun-linux-arm64";
+  let result;
+  try {
+    result = await Bun.build({
+      entrypoints: [input],
+      compile: {
+        target,
+        outfile: filePath
+      },
+      target: "bun",
+      loader: {
+        ".md": "text",
+        ".txt": "text",
+        ".html": "text",
+        ".css": "text",
+        ".yaml": "text",
+        ".yml": "text",
+        ".xml": "text",
+        ".csv": "text",
+        ".svg": "text",
+        ".png": "file",
+        ".jpg": "file",
+        ".jpeg": "file",
+        ".gif": "file",
+        ".webp": "file",
+        ".wasm": "file"
+      }
     });
-    for (const [id, props] of Object.entries(ctx.appConfig.defaults.pubsub ?? {})) {
-      const group = new Group10(ctx.base, "pubsub", id);
-      const { lambda } = createLambdaFunction(group, ctx, "pubsub-authorizer", id, props.auth);
-      const name = formatGlobalResourceName({
-        appName: ctx.app.name,
-        resourceType: "pubsub",
-        resourceName: id
-      });
-      const authorizer = new aws11.iot.Authorizer(group, "authorizer", {
-        name,
-        authorizerFunctionArn: lambda.arn,
-        status: "ACTIVE",
-        signingDisabled: true,
-        enableCachingForHttp: false
-      });
-      new aws11.lambda.Permission(group, "permission", {
-        functionName: lambda.functionName,
-        action: "lambda:InvokeFunction",
-        principal: "iot.amazonaws.com",
-        sourceArn: authorizer.arn
+  } catch (error) {
+    throw new ExpectedError(
+      `Executable build failed: ${error instanceof Error ? error.message : JSON.stringify(error)}`
+    );
+  }
+  if (!result.success) {
+    throw new ExpectedError(`Executable build failed:
+${result.logs?.map((log35) => log35.message).join("\n")}`);
+  }
+  const file = await readFile4(filePath);
+  return {
+    hash: createHash3("sha1").update(file).update("x86_64").digest("hex"),
+    file
+  };
+};
+
+// src/feature/pubsub/util.ts
+var __dirname2 = dirname5(fileURLToPath(import.meta.url));
+var WS_PORT = 3e3;
+var ARCHITECTURE = "arm64";
+var CPU = "0.25 vCPU";
+var MEMORY = "512";
+var MIN_CAPACITY = 1;
+var MAX_CAPACITY = 10;
+var createPubSubService = (parentGroup, ctx, id, props, inputs) => {
+  const group = new Group10(parentGroup, "service", id);
+  const name = formatGlobalResourceName({
+    appName: ctx.app.name,
+    resourceType: "pubsub",
+    resourceName: id
+  });
+  const shortName = shortId(`${ctx.app.name}:pubsub:${id}:${ctx.appId}`);
+  const image2 = "public.ecr.aws/aws-cli/aws-cli:arm64";
+  const bundleFile = join13(__dirname2, "prebuild/pubsub-server/index.mjs");
+  const bundleHash = join13(__dirname2, "prebuild/pubsub-server/HASH");
+  ctx.registerBuild("pubsub", name, async (build3) => {
+    const hash = await readFile5(bundleHash, "utf8");
+    const fingerprint = `${hash.trim()}-${ARCHITECTURE}`;
+    return build3(fingerprint, async (write) => {
+      const temp = await createTempFolder(`pubsub--${name}`);
+      const executable = await buildExecutable(bundleFile, temp.path, ARCHITECTURE);
+      await Promise.all([
+        //
+        write("HASH", executable.hash),
+        write("program", executable.file),
+        temp.delete()
+      ]);
+      return {
+        size: formatByteSize(executable.file.byteLength)
+      };
+    });
+  });
+  const code = new aws11.s3.BucketObject(group, "code", {
+    bucket: ctx.shared.get("pubsub", "bucket-name"),
+    key: name,
+    source: relativePath(getBuildPath("pubsub", name, "program")),
+    sourceHash: $file(getBuildPath("pubsub", name, "HASH"))
+  });
+  const executionRole = new aws11.iam.Role(group, "execution-role", {
+    name: shortId(`${shortName}:execution-role`),
+    description: name,
+    assumeRolePolicy: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Action: "sts:AssumeRole",
+          Principal: {
+            Service: ["ecs-tasks.amazonaws.com"]
+          }
+        }
+      ]
+    }),
+    managedPolicyArns: ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
+  });
+  const role = new aws11.iam.Role(
+    group,
+    "task-role",
+    {
+      name: shortId(`${shortName}:task-role`),
+      description: name,
+      assumeRolePolicy: JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Action: "sts:AssumeRole",
+            Principal: {
+              Service: ["ecs-tasks.amazonaws.com"]
+            }
+          }
+        ]
+      }),
+      inlinePolicy: [
+        {
+          name: "s3-code-access",
+          policy: $resolve([code.bucket, code.key], (bucket, key) => {
+            return JSON.stringify({
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: pascalCase3("allow"),
+                  Action: ["s3:getObject", "s3:HeadObject"],
+                  Resource: `arn:aws:s3:::${bucket}/${key}`
+                }
+              ]
+            });
+          })
+        }
+      ]
+    },
+    {
+      dependsOn: [code]
+    }
+  );
+  const statements = [];
+  const statementDeps = /* @__PURE__ */ new Set();
+  const policy = new aws11.iam.RolePolicy(group, "policy", {
+    role: role.name,
+    name: "task-policy",
+    policy: new Output5(statementDeps, async (resolve2) => {
+      const list3 = await resolveInputs3(statements);
+      resolve2(
+        JSON.stringify({
+          Version: "2012-10-17",
+          Statement: list3.map((statement) => ({
+            Effect: pascalCase3(statement.effect ?? "allow"),
+            Action: statement.actions,
+            Resource: statement.resources
+          }))
+        })
+      );
+    })
+  });
+  const addPermission = (...permissions) => {
+    statements.push(...permissions);
+    for (const dep of findInputDeps3(permissions)) {
+      statementDeps.add(dep);
+    }
+  };
+  ctx.onPermission((statement) => {
+    addPermission(statement);
+  });
+  let logGroup;
+  if (props.log.retention && props.log.retention.value > 0n) {
+    logGroup = new aws11.cloudwatch.LogGroup(group, "log", {
+      name: `/aws/ecs/${name}`,
+      retentionInDays: toDays7(props.log.retention)
+    });
+    if (ctx.shared.has("on-error-log", "subscriber-arn")) {
+      new aws11.cloudwatch.LogSubscriptionFilter(group, "on-error-log", {
+        name: "error-log-subscription",
+        destinationArn: ctx.shared.get("on-error-log", "subscriber-arn"),
+        logGroupName: logGroup.name,
+        filterPattern
+      });
+    }
+  }
+  const tags = {
+    APP: ctx.appConfig.name,
+    APP_ID: ctx.appId
+  };
+  const variables = {};
+  const variableDeps = /* @__PURE__ */ new Set();
+  const task2 = new aws11.ecs.TaskDefinition(
+    group,
+    "task",
+    {
+      family: name,
+      networkMode: "awsvpc",
+      cpu: CPU,
+      memory: MEMORY,
+      requiresCompatibilities: ["FARGATE"],
+      executionRoleArn: executionRole.arn,
+      taskRoleArn: role.arn,
+      runtimePlatform: {
+        cpuArchitecture: "ARM64",
+        operatingSystemFamily: "LINUX"
+      },
+      trackLatest: true,
+      containerDefinitions: new Output5(variableDeps, async (resolve2) => {
+        const data = await resolveInputs3(variables);
+        const { s3Bucket, s3Key } = await resolveInputs3({
+          s3Bucket: code.bucket,
+          s3Key: code.key
+        });
+        resolve2(
+          JSON.stringify([
+            {
+              name: `container-${id}`,
+              essential: true,
+              image: image2,
+              protocol: "tcp",
+              workingDirectory: "/usr/app",
+              entryPoint: ["sh", "-c"],
+              command: [
+                [
+                  `aws s3 cp s3://${s3Bucket}/${s3Key} /usr/app/program`,
+                  `chmod +x /usr/app/program`,
+                  `exec /usr/app/program`
+                ].join(" && ")
+              ],
+              environment: Object.entries(data).map(([name2, value]) => ({
+                name: name2,
+                value
+              })),
+              portMappings: [
+                {
+                  name: "ws",
+                  protocol: "tcp",
+                  appProtocol: "http",
+                  containerPort: WS_PORT,
+                  hostPort: WS_PORT
+                }
+              ],
+              restartPolicy: {
+                enabled: true,
+                restartAttemptPeriod: 60
+              },
+              ...logGroup && {
+                logConfiguration: {
+                  logDriver: "awslogs",
+                  options: {
+                    "awslogs-group": `/aws/ecs/${name}`,
+                    "awslogs-region": ctx.appConfig.region,
+                    "awslogs-stream-prefix": "ecs",
+                    mode: "non-blocking"
+                  }
+                }
+              }
+            }
+          ])
+        );
+      }),
+      tags
+    },
+    {
+      replaceOnChanges: [
+        "containerDefinitions",
+        "cpu",
+        "memory",
+        "runtimePlatform",
+        "executionRoleArn",
+        "taskRoleArn"
+      ],
+      dependsOn: [code]
+    }
+  );
+  const service = new aws11.ecs.Service(
+    group,
+    "service",
+    {
+      name,
+      cluster: inputs.clusterArn,
+      taskDefinition: task2.arn,
+      launchType: "FARGATE",
+      networkConfiguration: {
+        subnets: ctx.shared.get("vpc", "public-subnets"),
+        securityGroups: [inputs.securityGroupId],
+        assignPublicIp: true
+        // https://stackoverflow.com/questions/76398247/cannotpullcontainererror-pull-image-manifest-has-been-retried-5-times-failed
+      },
+      loadBalancer: [
+        {
+          containerName: `container-${id}`,
+          containerPort: WS_PORT,
+          targetGroupArn: inputs.targetGroupArn
+        }
+      ],
+      healthCheckGracePeriodSeconds: 30,
+      forceNewDeployment: true,
+      forceDelete: true,
+      tags,
+      // ------------------------------------------------------------
+      // Zero-downtime deploys: spin up the new tasks before the old
+      // ones are drained.
+      // The desired count is intentionally not set, so that deploys
+      // never reset the capacity the autoscaler picked.
+      schedulingStrategy: "REPLICA",
+      deploymentMaximumPercent: 200,
+      deploymentMinimumHealthyPercent: 100,
+      deploymentCircuitBreaker: {
+        enable: true,
+        rollback: true
+      },
+      // ------------------------------------------------------------
+      // Tag hygiene: let ECS manage and propagate runtime tags automatically.
+      enableEcsManagedTags: true,
+      propagateTags: "SERVICE"
+    },
+    {
+      replaceOnChanges: ["cluster"]
+    }
+  );
+  const target = new aws11.appautoscaling.Target(
+    group,
+    "autoscaling-target",
+    {
+      serviceNamespace: "ecs",
+      scalableDimension: "ecs:service:DesiredCount",
+      minCapacity: MIN_CAPACITY,
+      maxCapacity: MAX_CAPACITY,
+      resourceId: $resolve([inputs.clusterName, service.name], (clusterName, serviceName) => {
+        return `service/${clusterName}/${serviceName}`;
+      }),
+      tags
+    },
+    {
+      dependsOn: [service]
+    }
+  );
+  new aws11.appautoscaling.Policy(
+    group,
+    "autoscaling-policy",
+    {
+      name: `${name}-cpu`,
+      policyType: "TargetTrackingScaling",
+      serviceNamespace: target.serviceNamespace,
+      scalableDimension: target.scalableDimension,
+      resourceId: target.resourceId,
+      targetTrackingScalingPolicyConfiguration: {
+        predefinedMetricSpecification: {
+          predefinedMetricType: "ECSServiceAverageCPUUtilization"
+        },
+        targetValue: 70,
+        scaleInCooldown: 300,
+        scaleOutCooldown: 60
+      }
+    },
+    {
+      dependsOn: [target]
+    }
+  );
+  ctx.onEnv((name2, value) => {
+    variables[name2] = value;
+    for (const dep of findInputDeps3([value])) {
+      variableDeps.add(dep);
+    }
+  });
+  variables.APP = ctx.appConfig.name;
+  variables.APP_ID = ctx.appId;
+  variables.AWS_ACCOUNT_ID = ctx.accountId;
+  variables.CODE_HASH = code.sourceHash;
+  variables.PUBSUB_CONFIG_HASH = createHash4("sha1").update(stringify(props)).digest("hex");
+  for (const [key, value] of Object.entries(inputs.environment)) {
+    variables[key] = value;
+    for (const dep of findInputDeps3([value])) {
+      variableDeps.add(dep);
+    }
+  }
+  return { name, task: task2, service, policy, code, group, addPermission };
+};
+
+// src/feature/pubsub/index.ts
+var __dirname3 = dirname6(fileURLToPath2(import.meta.url));
+var typeGenCode4 = `
+import type { Mock } from 'vitest'
+
+type Publish = (topic: string, event: string, payload?: unknown) => Promise<void>
+type PubSubInstance = {
+	readonly publish: Publish
+}
+
+type MockHandle = (payload: { topic: string; event: string; payload?: unknown }) => void
+type MockBuilder = (handle?: MockHandle) => void
+type MockObject = Mock<[unknown], unknown>
+`;
+var pubsubFeature = defineFeature({
+  name: "pubsub",
+  async onTypeGen(ctx) {
+    const gen = new TypeFile("awsless");
+    const resources2 = new TypeObject(1);
+    const mocks = new TypeObject(1);
+    const mockResponses = new TypeObject(1);
+    for (const id of Object.keys(ctx.appConfig.defaults.pubsub ?? {})) {
+      resources2.addType(id, `PubSubInstance`);
+      mocks.addType(id, `MockBuilder`);
+      mockResponses.addType(id, `MockObject`);
+    }
+    gen.addCode(typeGenCode4);
+    gen.addInterface("PubSubResources", resources2);
+    gen.addInterface("PubSubMock", mocks);
+    gen.addInterface("PubSubMockResponse", mockResponses);
+    await ctx.write("pubsub.d.ts", gen, true);
+  },
+  onValidate(ctx) {
+    const pubsubs = ctx.appConfig.defaults.pubsub ?? {};
+    for (const [id, props] of Object.entries(pubsubs)) {
+      if (!(props.router in (ctx.appConfig.defaults.router ?? {}))) {
+        throw new FileError("app.json", `The pubsub "${id}" points to a non existent router "${props.router}"`);
+      }
+    }
+    for (const stack of ctx.stackConfigs) {
+      for (const id of Object.keys(stack.pubsub ?? {})) {
+        if (!(id in pubsubs)) {
+          throw new FileError(stack.file, `Listening to a non existent pubsub "${id}"`);
+        }
+      }
+    }
+  },
+  onBefore(ctx) {
+    const found = Object.keys(ctx.appConfig.defaults.pubsub ?? {}).length > 0;
+    if (!found) {
+      return;
+    }
+    const group = new Group11(ctx.base, "pubsub", "asset");
+    const bucket = new aws12.s3.Bucket(group, "bucket", {
+      bucket: formatGlobalResourceName({
+        appName: ctx.app.name,
+        resourceType: "pubsub",
+        resourceName: "assets",
+        postfix: ctx.appId
+      }),
+      forceDestroy: true
+    });
+    ctx.shared.set("pubsub", "bucket-name", bucket.bucket);
+  },
+  onApp(ctx) {
+    const pubsubs = Object.entries(ctx.appConfig.defaults.pubsub ?? {});
+    if (pubsubs.length === 0) {
+      return;
+    }
+    const clusterGroup = new Group11(ctx.base, "pubsub", "cluster");
+    const cluster = new aws12.ecs.Cluster(
+      clusterGroup,
+      "cluster",
+      {
+        name: `${ctx.app.name}-pubsub`
+      },
+      {
+        replaceOnChanges: ["name"]
+      }
+    );
+    for (const [id, props] of pubsubs) {
+      const group = new Group11(ctx.base, "pubsub", id);
+      const name = formatGlobalResourceName({
+        appName: ctx.app.name,
+        resourceType: "pubsub",
+        resourceName: id
+      });
+      const vpcId = ctx.shared.get("vpc", "id");
+      const auth2 = createLambdaFunction(group, ctx, "pubsub-auth", id, props.auth);
+      const topicName = formatGlobalResourceName({
+        appName: ctx.app.name,
+        resourceType: "pubsub-events",
+        resourceName: id
+      });
+      const topic = new aws12.sns.Topic(group, "events", {
+        name: topicName
+      });
+      ctx.shared.add("pubsub", "events-topic-arn", id, topic.arn);
+      const cacheName = formatGlobalResourceName({
+        appName: ctx.app.name,
+        resourceType: "pubsub-cache",
+        resourceName: id,
+        seperator: "-"
+      });
+      const cacheSecurityGroup = new aws12.security.Group(group, "cache-security", {
+        name: cacheName,
+        vpcId,
+        description: cacheName
+      });
+      const cache = new aws12.elasticache.ServerlessCache(
+        group,
+        "cache",
+        {
+          name: cacheName,
+          engine: "valkey",
+          majorEngineVersion: "8",
+          securityGroupIds: [cacheSecurityGroup.id],
+          subnetIds: ctx.shared.get("vpc", "private-subnets")
+        },
+        {
+          import: ctx.import ? cacheName : void 0
+        }
+      );
+      const redisHost = cache.endpoint.pipe((v) => v.at(0).address);
+      const redisPort = cache.endpoint.pipe((v) => v.at(0).port);
+      new aws12.vpc.SecurityGroupIngressRule(group, "cache-rule-ip-v4", {
+        securityGroupId: cacheSecurityGroup.id,
+        description: redisPort.pipe((port) => `Allow ipv4 on port: ${port}`),
+        ipProtocol: "tcp",
+        cidrIpv4: "0.0.0.0/0",
+        fromPort: redisPort,
+        toPort: redisPort
+      });
+      new aws12.vpc.SecurityGroupIngressRule(group, "cache-rule-ip-v6", {
+        securityGroupId: cacheSecurityGroup.id,
+        description: redisPort.pipe((port) => `Allow ipv6 on port: ${port}`),
+        ipProtocol: "tcp",
+        cidrIpv6: "::/0",
+        fromPort: redisPort,
+        toPort: redisPort
+      });
+      const channel = `pubsub:${id}`;
+      const cloudfrontPrefixList = aws12.ec2.getManagedPrefixList(group, "cloudfront-prefix-list", {
+        name: "com.amazonaws.global.cloudfront.origin-facing"
+      });
+      const lbSecurityGroup = new aws12.security.Group(group, "lb-security", {
+        name: `${name}-lb`,
+        vpcId,
+        description: `${name}-lb`
+      });
+      new aws12.vpc.SecurityGroupIngressRule(group, "lb-ingress", {
+        securityGroupId: lbSecurityGroup.id,
+        description: "Allow http traffic from CloudFront",
+        ipProtocol: "tcp",
+        prefixListId: cloudfrontPrefixList.id,
+        fromPort: 80,
+        toPort: 80
+      });
+      new aws12.vpc.SecurityGroupEgressRule(group, "lb-egress", {
+        securityGroupId: lbSecurityGroup.id,
+        description: "Allow all outbound traffic",
+        ipProtocol: "-1",
+        cidrIpv4: "0.0.0.0/0"
+      });
+      const taskSecurityGroup = new aws12.security.Group(group, "task-security", {
+        name: `${name}-task`,
+        vpcId,
+        description: `${name}-task`
+      });
+      new aws12.vpc.SecurityGroupIngressRule(group, "task-ingress", {
+        securityGroupId: taskSecurityGroup.id,
+        description: "Allow websocket traffic from the load balancer",
+        ipProtocol: "tcp",
+        referencedSecurityGroupId: lbSecurityGroup.id,
+        fromPort: WS_PORT,
+        toPort: WS_PORT
+      });
+      new aws12.vpc.SecurityGroupEgressRule(group, "task-egress", {
+        securityGroupId: taskSecurityGroup.id,
+        description: "Allow all outbound traffic",
+        ipProtocol: "-1",
+        cidrIpv4: "0.0.0.0/0"
+      });
+      const lb = new aws12.Lb(group, "lb", {
+        name: shortId(`${name}:lb:${ctx.appId}`),
+        internal: false,
+        loadBalancerType: "application",
+        subnets: ctx.shared.get("vpc", "public-subnets"),
+        securityGroups: [lbSecurityGroup.id],
+        idleTimeout: 120
+      });
+      const targetGroup = new aws12.lb.TargetGroup(group, "target", {
+        name: shortId(`${name}:target:${ctx.appId}`),
+        targetType: "ip",
+        port: WS_PORT,
+        protocol: "HTTP",
+        vpcId,
+        deregistrationDelay: "30",
+        healthCheck: {
+          enabled: true,
+          path: "/health",
+          interval: 10,
+          timeout: 5,
+          healthyThreshold: 2,
+          unhealthyThreshold: 2,
+          matcher: "200"
+        }
+      });
+      new aws12.lb.Listener(group, "listener", {
+        loadBalancerArn: lb.arn,
+        port: 80,
+        protocol: "HTTP",
+        defaultAction: [
+          {
+            type: "forward",
+            targetGroupArn: targetGroup.arn
+          }
+        ]
+      });
+      const secret = createHmac2("sha1", ctx.appId).update(name).digest("hex");
+      const service = createPubSubService(group, ctx, id, props, {
+        clusterName: cluster.name,
+        clusterArn: cluster.arn,
+        targetGroupArn: targetGroup.arn,
+        securityGroupId: taskSecurityGroup.id,
+        environment: {
+          AUTH: auth2.name,
+          EVENTS_TOPIC: topicName,
+          PORT: WS_PORT.toString(),
+          REDIS_HOST: redisHost,
+          REDIS_PORT: redisPort.pipe((port) => port.toString()),
+          CHANNEL: channel,
+          ORIGIN_SECRET: secret
+        }
+      });
+      service.addPermission(
+        {
+          actions: ["lambda:InvokeFunction"],
+          resources: [auth2.lambda.arn]
+        },
+        {
+          actions: ["sns:Publish"],
+          resources: [topic.arn]
+        }
+      );
+      const publisher = createPrebuildLambdaFunction(group, ctx, "pubsub-publisher", id, {
+        bundleFile: join14(__dirname3, "/prebuild/pubsub-publisher/bundle.zip"),
+        bundleHash: join14(__dirname3, "/prebuild/pubsub-publisher/HASH"),
+        memorySize: mebibytes5(256),
+        timeout: seconds7(10),
+        handler: "index.default",
+        runtime: "nodejs24.x",
+        vpc: true,
+        log: props.log
       });
-      ctx.bind(`PUBSUB_${constantCase5(id)}_AUTHORIZER`, name);
-      const endpoint = aws11.iot.getEndpoint(group, "endpoint", {
-        endpointType: "iot:Data-ATS"
+      publisher.setEnvironment("REDIS_HOST", redisHost);
+      publisher.setEnvironment(
+        "REDIS_PORT",
+        redisPort.pipe((port) => port.toString())
+      );
+      publisher.setEnvironment("CHANNEL", channel);
+      ctx.addGlobalPermission({
+        actions: ["lambda:InvokeFunction"],
+        resources: [publisher.lambda.arn]
       });
-      if (props.domain) {
-        const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
-        new aws11.iot.DomainConfiguration(group, "domain", {
-          name,
-          domainName,
-          serverCertificateArns: [ctx.shared.entry("domain", `certificate-arn`, props.domain)],
-          authorizerConfig: {
-            defaultAuthorizerName: authorizer.name
-          }
-          // validationCertificate: ctx.shared.get(`global-certificate-${props.domain}-arn`),
-        });
-        new aws11.route53.Record(group, "record", {
-          zoneId: ctx.shared.entry("domain", `zone-id`, props.domain),
-          name: domainName,
-          type: "CNAME",
-          ttl: toSeconds5(minutes7(5)),
-          records: [endpoint.endpointAddress]
-        });
-        ctx.bind(`PUBSUB_${constantCase5(id)}_ENDPOINT`, domainName);
-      } else {
-        ctx.bind(`PUBSUB_${constantCase5(id)}_ENDPOINT`, endpoint.endpointAddress);
+      const routerProps = ctx.appConfig.defaults.router?.[props.router];
+      if (!routerProps?.domain) {
+        throw new FileError(
+          "app.json",
+          `The pubsub "${id}" requires the "${props.router}" router to have a domain configured.`
+        );
       }
+      const addRoutes = ctx.shared.entry("router", "addRoutes", props.router);
+      addRoutes(group, `pubsub-${id}`, {
+        [`${props.path}/*`]: {
+          type: "url",
+          domainName: lb.dnsName,
+          readTimeout: 60,
+          customHeaders: {
+            "x-origin-secret": secret
+          },
+          rewrite: {
+            regex: `^${props.path}/(.*)$`,
+            to: "/$1"
+          }
+        }
+      });
+      const domainName = formatFullDomainName(ctx.appConfig, routerProps.domain, routerProps.subDomain);
+      ctx.bind(`PUBSUB_${constantCase5(id)}_ENDPOINT`, `wss://${domainName}${props.path}/ws`);
+      ctx.bind(`PUBSUB_${constantCase5(id)}_PUBLISHER`, publisher.name);
     }
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.pubsub ?? {})) {
-      const group = new Group10(ctx.stack, "pubsub", id);
-      const { lambda } = createAsyncLambdaFunction(group, ctx, `pubsub`, id, props);
-      const name = formatLocalResourceName({
-        appName: ctx.app.name,
-        stackName: ctx.stack.name,
-        resourceType: "pubsub",
-        resourceName: id
-      });
-      const topic = new aws11.iot.TopicRule(group, "rule", {
-        name: name.replaceAll("-", "_"),
-        enabled: true,
-        sql: props.sql,
-        sqlVersion: props.sqlVersion,
-        lambda: [{ functionArn: lambda.arn }]
-      });
-      new aws11.lambda.Permission(group, "permission", {
-        action: "lambda:InvokeFunction",
-        principal: "iot.amazonaws.com",
-        functionName: lambda.functionName,
-        sourceArn: topic.arn
-      });
+      const group = new Group11(ctx.stack, "pubsub", id);
+      const topicArn = ctx.shared.entry("pubsub", "events-topic-arn", id);
+      for (const event of pubsubEventTypes) {
+        const consumer = props[event];
+        if (!consumer) {
+          continue;
+        }
+        const eventGroup = new Group11(group, "event", event);
+        const { lambda } = createAsyncLambdaFunction(eventGroup, ctx, `pubsub`, `${id}-${event}`, {
+          consumer,
+          retryAttempts: 2
+        });
+        new aws12.sns.TopicSubscription(eventGroup, "subscription", {
+          topicArn,
+          protocol: "lambda",
+          endpoint: lambda.arn,
+          filterPolicyScope: "MessageAttributes",
+          filterPolicy: JSON.stringify({
+            event: [event]
+          })
+        });
+        new aws12.lambda.Permission(eventGroup, "permission", {
+          action: "lambda:InvokeFunction",
+          principal: "sns.amazonaws.com",
+          functionName: lambda.functionName,
+          sourceArn: topicArn
+        });
+      }
     }
   }
 });
 
 // src/feature/queue/index.ts
-import { Group as Group11 } from "@terraforge/core";
-import { aws as aws12 } from "@terraforge/aws";
+import { Group as Group12 } from "@terraforge/core";
+import { aws as aws13 } from "@terraforge/aws";
 import { camelCase as camelCase5, constantCase as constantCase6 } from "change-case";
 import deepmerge3 from "deepmerge";
 import { relative as relative5 } from "path";
-import { seconds as seconds7, toSeconds as toSeconds6 } from "@awsless/duration";
+import { seconds as seconds8, toSeconds as toSeconds5 } from "@awsless/duration";
 import { toBytes } from "@awsless/size";
-var typeGenCode4 = `
+var typeGenCode5 = `
 import {
 	SendMessageOptions,
 	SendMessageBatchOptions,
@@ -5220,7 +5888,7 @@ var queueFeature = defineFeature({
       resources2.addType(stack.name, resource);
       mockResponses.addType(stack.name, mockResponse);
     }
-    gen.addCode(typeGenCode4);
+    gen.addCode(typeGenCode5);
     gen.addInterface("QueueResources", resources2);
     gen.addInterface("QueueMock", mocks);
     gen.addInterface("QueueMockResponse", mockResponses);
@@ -5229,34 +5897,33 @@ var queueFeature = defineFeature({
   onStack(ctx) {
     for (const [id, local] of Object.entries(ctx.stackConfig.queues || {})) {
       const props = deepmerge3(ctx.appConfig.defaults.queue, typeof local === "object" ? local : {});
-      const group = new Group11(ctx.stack, "queue", id);
+      const group = new Group12(ctx.stack, "queue", id);
       const baseName = formatLocalResourceName({
         appName: ctx.app.name,
         stackName: ctx.stack.name,
         resourceType: "queue",
         resourceName: id
       });
-      const onFailure = ctx.shared.get("on-failure", "queue-arn");
-      const queue2 = new aws12.sqs.Queue(group, "queue", {
+      const queue2 = new aws13.sqs.Queue(group, "queue", {
         name: `${baseName}.fifo`,
-        visibilityTimeoutSeconds: toSeconds6(props.visibilityTimeout),
-        receiveWaitTimeSeconds: toSeconds6(props.receiveMessageWaitTime ?? seconds7(0)),
-        messageRetentionSeconds: toSeconds6(props.retentionPeriod),
+        visibilityTimeoutSeconds: toSeconds5(props.visibilityTimeout),
+        receiveWaitTimeSeconds: toSeconds5(props.receiveMessageWaitTime ?? seconds8(0)),
+        messageRetentionSeconds: toSeconds5(props.retentionPeriod),
         maxMessageSize: toBytes(props.maxMessageSize),
         fifoQueue: true,
         deduplicationScope: "messageGroup",
-        fifoThroughputLimit: "perMessageGroupId",
-        redrivePolicy: onFailure.pipe(
-          (arn) => JSON.stringify({
-            deadLetterTargetArn: arn,
-            maxReceiveCount: props.retryAttempts + 1
-          })
-        )
+        fifoThroughputLimit: "perMessageGroupId"
+        // redrivePolicy: onFailure.pipe(arn =>
+        // 	JSON.stringify({
+        // 		deadLetterTargetArn: arn,
+        // 		maxReceiveCount: props.retryAttempts + 1,
+        // 	})
+        // ),
       });
       if (local.consumer) {
         const lambdaConsumer = createLambdaFunction(group, ctx, `queue`, id, local.consumer);
         lambdaConsumer.setEnvironment("THROW_EXPECTED_ERRORS", "1");
-        new aws12.lambda.EventSourceMapping(
+        new aws13.lambda.EventSourceMapping(
           group,
           "event",
           {
@@ -5290,24 +5957,24 @@ var queueFeature = defineFeature({
 });
 
 // src/feature/rest/index.ts
-import { Group as Group12 } from "@terraforge/core";
-import { aws as aws13 } from "@terraforge/aws";
+import { Group as Group13 } from "@terraforge/core";
+import { aws as aws14 } from "@terraforge/aws";
 import { constantCase as constantCase7 } from "change-case";
 var restFeature = defineFeature({
   name: "rest",
   onApp(ctx) {
     for (const [id, props] of Object.entries(ctx.appConfig.defaults?.rest ?? {})) {
-      const group = new Group12(ctx.base, "rest", id);
+      const group = new Group13(ctx.base, "rest", id);
       const name = formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "rest",
         resourceName: id
       });
-      const api = new aws13.apigatewayv2.Api(group, "api", {
+      const api = new aws14.apigatewayv2.Api(group, "api", {
         name,
         protocolType: "HTTP"
       });
-      const stage = new aws13.apigatewayv2.Stage(group, "stage", {
+      const stage = new aws14.apigatewayv2.Stage(group, "stage", {
         name: "v1",
         apiId: api.id,
         autoDeploy: true
@@ -5317,7 +5984,7 @@ var restFeature = defineFeature({
         const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
         const zoneId = ctx.shared.entry("domain", `zone-id`, props.domain);
         const certificateArn = ctx.shared.entry("domain", `certificate-arn`, props.domain);
-        const domain2 = new aws13.apigatewayv2.DomainName(group, "domain", {
+        const domain2 = new aws14.apigatewayv2.DomainName(group, "domain", {
           domainName,
           domainNameConfiguration: {
             certificateArn,
@@ -5325,12 +5992,12 @@ var restFeature = defineFeature({
             securityPolicy: "TLS_1_2"
           }
         });
-        const mapping = new aws13.apigatewayv2.ApiMapping(group, "mapping", {
+        const mapping = new aws14.apigatewayv2.ApiMapping(group, "mapping", {
           apiId: api.id,
           domainName: domain2.domainName,
           stage: stage.name
         });
-        new aws13.route53.Record(
+        new aws14.route53.Record(
           group,
           "record",
           {
@@ -5358,21 +6025,21 @@ var restFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, routes] of Object.entries(ctx.stackConfig.rest ?? {})) {
-      const restGroup = new Group12(ctx.stack, "rest", id);
+      const restGroup = new Group13(ctx.stack, "rest", id);
       for (const [routeKey, props] of Object.entries(routes)) {
-        const group = new Group12(restGroup, "route", routeKey);
+        const group = new Group13(restGroup, "route", routeKey);
         const apiId = ctx.shared.entry("rest", "id", id);
         const routeId = shortId(routeKey);
         const { lambda } = createLambdaFunction(group, ctx, "rest", `${id}-${routeId}`, {
           ...props,
           description: `${id} ${routeKey}`
         });
-        const permission = new aws13.lambda.Permission(group, "permission", {
+        const permission = new aws14.lambda.Permission(group, "permission", {
           action: "lambda:InvokeFunction",
           principal: "apigateway.amazonaws.com",
           functionName: lambda.functionName
         });
-        const integration = new aws13.apigatewayv2.Integration(group, "integration", {
+        const integration = new aws14.apigatewayv2.Integration(group, "integration", {
           apiId,
           description: `${id} ${routeKey}`,
           integrationType: "AWS_PROXY",
@@ -5382,7 +6049,7 @@ var restFeature = defineFeature({
             return `arn:aws:apigateway:${ctx.appConfig.region}:lambda:path/2015-03-31/functions/${arn}/invocations`;
           })
         });
-        new aws13.apigatewayv2.Route(
+        new aws14.apigatewayv2.Route(
           group,
           "route",
           {
@@ -5401,13 +6068,13 @@ var restFeature = defineFeature({
 
 // src/feature/rpc/index.ts
 import { camelCase as camelCase6, constantCase as constantCase8, kebabCase as kebabCase6 } from "change-case";
-import { Group as Group13 } from "@terraforge/core";
-import { aws as aws14 } from "@terraforge/aws";
-import { mebibytes as mebibytes5 } from "@awsless/size";
-import { dirname as dirname5, join as join12, relative as relative6 } from "path";
-import { fileURLToPath } from "url";
-import { toSeconds as toSeconds7 } from "@awsless/duration";
-var __dirname2 = dirname5(fileURLToPath(import.meta.url));
+import { Group as Group14 } from "@terraforge/core";
+import { aws as aws15 } from "@terraforge/aws";
+import { mebibytes as mebibytes6 } from "@awsless/size";
+import { dirname as dirname7, join as join15, relative as relative6 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { toSeconds as toSeconds6 } from "@awsless/duration";
+var __dirname4 = dirname7(fileURLToPath3(import.meta.url));
 var rpcFeature = defineFeature({
   name: "rpc",
   async onTypeGen(ctx) {
@@ -5451,8 +6118,8 @@ var rpcFeature = defineFeature({
           } else {
             list3.add(name);
           }
-          const timeout = toSeconds7(props.function.timeout ?? ctx.appConfig.defaults.function.timeout);
-          const maxTimeout = toSeconds7(ctx.appConfig.defaults.rpc[id].timeout) * 0.8;
+          const timeout = toSeconds6(props.function.timeout ?? ctx.appConfig.defaults.function.timeout);
+          const maxTimeout = toSeconds6(ctx.appConfig.defaults.rpc[id].timeout) * 0.8;
           if (timeout > maxTimeout) {
             throw new FileError(
               stack.file,
@@ -5465,19 +6132,19 @@ var rpcFeature = defineFeature({
   },
   onApp(ctx) {
     for (const [id, props] of Object.entries(ctx.appConfig.defaults.rpc ?? {})) {
-      const group = new Group13(ctx.base, "rpc", id);
+      const group = new Group14(ctx.base, "rpc", id);
       const result = createPrebuildLambdaFunction(group, ctx, "rpc", id, {
-        bundleFile: join12(__dirname2, "/prebuild/rpc/bundle.zip"),
-        bundleHash: join12(__dirname2, "/prebuild/rpc/HASH"),
-        memorySize: mebibytes5(256),
+        bundleFile: join15(__dirname4, "/prebuild/rpc/bundle.zip"),
+        bundleHash: join15(__dirname4, "/prebuild/rpc/HASH"),
+        memorySize: mebibytes6(256),
         timeout: props.timeout,
         handler: "index.default",
         runtime: "nodejs24.x",
         warm: 3,
         log: props.log
       });
-      result.setEnvironment("TIMEOUT", toSeconds7(props.timeout).toString());
-      const schemaTable = new aws14.dynamodb.Table(group, "schema", {
+      result.setEnvironment("TIMEOUT", toSeconds6(props.timeout).toString());
+      const schemaTable = new aws15.dynamodb.Table(group, "schema", {
         name: formatGlobalResourceName({
           appName: ctx.app.name,
           resourceType: "rpc-schema",
@@ -5499,7 +6166,7 @@ var rpcFeature = defineFeature({
         resources: [schemaTable.arn]
       });
       ctx.shared.add("rpc", `schema-table`, id, schemaTable);
-      const lockTable = new aws14.dynamodb.Table(group, "lock", {
+      const lockTable = new aws15.dynamodb.Table(group, "lock", {
         name: formatGlobalResourceName({
           appName: ctx.app.name,
           resourceType: "rpc-lock",
@@ -5525,7 +6192,7 @@ var rpcFeature = defineFeature({
         resources: [lockTable.arn]
       });
       if (props.auth) {
-        const authGroup = new Group13(group, "auth", "authorizer");
+        const authGroup = new Group14(group, "auth", "authorizer");
         const auth2 = createLambdaFunction(authGroup, ctx, "rpc", `${id}-auth`, props.auth);
         result.setEnvironment("AUTH", auth2.name);
         for (const [authId, userPoolId] of ctx.shared.list("auth", "user-pool-id")) {
@@ -5544,14 +6211,14 @@ var rpcFeature = defineFeature({
           imageUri: result.lambda.imageUri
         });
       }
-      const permission = new aws14.lambda.Permission(group, "permission", {
+      const permission = new aws15.lambda.Permission(group, "permission", {
         principal: "cloudfront.amazonaws.com",
         action: "lambda:InvokeFunctionUrl",
         functionName: result.lambda.functionName,
         functionUrlAuthType: "AWS_IAM",
         sourceArn: `arn:aws:cloudfront::${ctx.accountId}:distribution/*`
       });
-      const url = new aws14.lambda.FunctionUrl(
+      const url = new aws15.lambda.FunctionUrl(
         group,
         "url",
         {
@@ -5586,15 +6253,15 @@ var rpcFeature = defineFeature({
         throw new FileError(ctx.stackConfig.file, `RPC definition is not defined on app level for "${id}"`);
       }
       const table = ctx.shared.entry("rpc", "schema-table", id);
-      const group = new Group13(ctx.stack, "rpc", id);
+      const group = new Group14(ctx.stack, "rpc", id);
       for (const [name, props] of Object.entries(queries ?? {})) {
-        const queryGroup = new Group13(group, "query", name);
+        const queryGroup = new Group14(group, "query", name);
         const entryId = kebabCase6(`${id}-${shortId(name)}`);
         createLambdaFunction(queryGroup, ctx, `rpc`, entryId, {
           ...props.function,
           description: `${id} ${name}`
         });
-        new aws14.dynamodb.TableItem(queryGroup, "query", {
+        new aws15.dynamodb.TableItem(queryGroup, "query", {
           tableName: table.name,
           hashKey: table.hashKey,
           rangeKey: table.rangeKey,
@@ -5626,11 +6293,11 @@ var rpcFeature = defineFeature({
 });
 
 // src/feature/search/index.ts
-import { Group as Group14 } from "@terraforge/core";
-import { aws as aws15 } from "@terraforge/aws";
+import { Group as Group15 } from "@terraforge/core";
+import { aws as aws16 } from "@terraforge/aws";
 import { constantCase as constantCase9 } from "change-case";
 import { toGibibytes as toGibibytes2 } from "@awsless/size";
-var typeGenCode5 = `
+var typeGenCode6 = `
 import { AnyStruct, Table } from '@awsless/open-search'
 
 type Search = {
@@ -5650,15 +6317,15 @@ var searchFeature = defineFeature({
       }
       resources2.addType(stack.name, list3);
     }
-    gen.addCode(typeGenCode5);
+    gen.addCode(typeGenCode6);
     gen.addInterface("SearchResources", resources2);
     await ctx.write("search.d.ts", gen, true);
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.searchs ?? {})) {
-      const group = new Group14(ctx.stack, "search", id);
+      const group = new Group15(ctx.stack, "search", id);
       const name = `${ctx.app.name}-${shortId([ctx.app.name, ctx.stack.name, "search", id].join("--"))}`;
-      const openSearch = new aws15.opensearch.Domain(
+      const openSearch = new aws16.opensearch.Domain(
         group,
         "domain",
         {
@@ -5733,10 +6400,10 @@ var searchFeature = defineFeature({
 });
 
 // src/feature/site/index.ts
-import { Group as Group15 } from "@terraforge/core";
-import { aws as aws16 } from "@terraforge/aws";
+import { Group as Group16 } from "@terraforge/core";
+import { aws as aws17 } from "@terraforge/aws";
 import { glob as glob2 } from "glob";
-import { dirname as dirname6, join as join13 } from "path";
+import { dirname as dirname8, join as join16 } from "path";
 
 // src/feature/site/util.ts
 import { contentType, lookup } from "mime-types";
@@ -5764,7 +6431,7 @@ var siteFeature = defineFeature({
   name: "site",
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.sites ?? {})) {
-      const group = new Group15(ctx.stack, "site", id);
+      const group = new Group16(ctx.stack, "site", id);
       const name = formatLocalResourceName({
         appName: ctx.app.name,
         stackName: ctx.stack.name,
@@ -5782,7 +6449,7 @@ var siteFeature = defineFeature({
           return build3(fingerprint, async (write) => {
             const credentialProvider = await getCredentials(ctx.appConfig.profile);
             const credentials = await credentialProvider();
-            const cwd = join13(directories.root, dirname6(ctx.stackConfig.file));
+            const cwd = join16(directories.root, dirname8(ctx.stackConfig.file));
             const env = {
               ...process.env,
               // Pass the app config name
@@ -5829,14 +6496,14 @@ var siteFeature = defineFeature({
         ctx.onBind((name2, value) => {
           result.setEnvironment(name2, value);
         });
-        new aws16.lambda.Permission(group, "ssr-permission", {
+        new aws17.lambda.Permission(group, "ssr-permission", {
           principal: "cloudfront.amazonaws.com",
           action: "lambda:InvokeFunctionUrl",
           functionName: result.lambda.functionName,
           functionUrlAuthType: "AWS_IAM",
           sourceArn: `arn:aws:cloudfront::${ctx.accountId}:distribution/*`
         });
-        const functionUrl = new aws16.lambda.FunctionUrl(group, "url", {
+        const functionUrl = new aws17.lambda.FunctionUrl(group, "url", {
           functionName: result.lambda.functionName,
           authorizationType: "AWS_IAM"
         });
@@ -5850,7 +6517,7 @@ var siteFeature = defineFeature({
         });
       }
       if (props.static) {
-        const bucket = new aws16.s3.Bucket(group, "bucket", {
+        const bucket = new aws17.s3.Bucket(group, "bucket", {
           bucket: formatLocalResourceName({
             appName: ctx.app.name,
             stackName: ctx.stack.name,
@@ -5872,7 +6539,7 @@ var siteFeature = defineFeature({
             }
           ]
         });
-        new aws16.s3.BucketPolicy(
+        new aws17.s3.BucketPolicy(
           group,
           `policy`,
           {
@@ -5927,20 +6594,20 @@ var siteFeature = defineFeature({
             });
             const staticRoutes = {};
             for (const file of files) {
-              const prefixedFile = join13("/", file);
-              const object = new aws16.s3.BucketObject(group, prefixedFile, {
+              const prefixedFile = join16("/", file);
+              const object = new aws17.s3.BucketObject(group, prefixedFile, {
                 bucket: bucket.bucket,
                 key: prefixedFile,
                 cacheControl: getCacheControl(file),
                 contentType: getContentType(file),
-                source: join13(props.static, file),
-                sourceHash: $hash(join13(props.static, file))
+                source: join16(props.static, file),
+                sourceHash: $hash(join16(props.static, file))
               });
               versions.push(object.key);
               versions.push(object.sourceHash);
               const strippedHtmlFile = file.endsWith("index.html") ? file.slice(0, -11) : file.endsWith(".html") ? file.slice(0, -5) : file;
               const urlFriendlyFile = strippedHtmlFile.endsWith("/") ? strippedHtmlFile.slice(0, -1) : strippedHtmlFile;
-              const routeFileKey = join13(props.path, urlFriendlyFile);
+              const routeFileKey = join16(props.path, urlFriendlyFile);
               staticRoutes[routeFileKey] = {
                 type: "s3",
                 domainName: bucket.bucketRegionalDomainName,
@@ -5957,10 +6624,10 @@ var siteFeature = defineFeature({
 });
 
 // src/feature/store/index.ts
-import { Group as Group16 } from "@terraforge/core";
-import { toDays as toDays7 } from "@awsless/duration";
+import { Group as Group17 } from "@terraforge/core";
+import { toDays as toDays8 } from "@awsless/duration";
 import { kebabCase as kebabCase7 } from "change-case";
-import { aws as aws17 } from "@terraforge/aws";
+import { aws as aws18 } from "@terraforge/aws";
 import { glob as glob3 } from "glob";
 
 // src/feature/store/util.ts
@@ -5984,8 +6651,8 @@ var getContentType2 = (file) => {
 };
 
 // src/feature/store/index.ts
-import { join as join14 } from "path";
-var typeGenCode6 = `
+import { join as join17 } from "path";
+var typeGenCode7 = `
 import { Body, PutObjectProps, BodyStream } from '@awsless/s3'
 
 type Store<Name extends string> = {
@@ -6014,7 +6681,7 @@ var storeFeature = defineFeature({
       }
       resources2.addType(stack.name, list3);
     }
-    gen.addCode(typeGenCode6);
+    gen.addCode(typeGenCode7);
     gen.addInterface("StoreResources", resources2);
     await ctx.write("store.d.ts", gen, true);
   },
@@ -6052,7 +6719,7 @@ var storeFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.stores ?? {})) {
-      const group = new Group16(ctx.stack, "store", id);
+      const group = new Group17(ctx.stack, "store", id);
       const name = formatLocalResourceName({
         appName: ctx.app.name,
         stackName: ctx.stack.name,
@@ -6064,9 +6731,9 @@ var storeFeature = defineFeature({
         id: rule.prefix ? `expire-${kebabCase7(rule.prefix)}` : `expire-rule-${index}`,
         enabled: true,
         ...rule.prefix ? { prefix: rule.prefix } : {},
-        expiration: { days: toDays7(rule.expiration) }
+        expiration: { days: toDays8(rule.expiration) }
       }));
-      const bucket = new aws17.s3.Bucket(
+      const bucket = new aws18.s3.Bucket(
         group,
         "store",
         {
@@ -6098,13 +6765,13 @@ var storeFeature = defineFeature({
             nodir: true
           });
           for (const file of files) {
-            new aws17.s3.BucketObject(group, file, {
+            new aws18.s3.BucketObject(group, file, {
               bucket: bucket.bucket,
               key: file,
               cacheControl: getCacheControl2(file),
               contentType: getContentType2(file),
-              source: join14(props.static, file),
-              sourceHash: $hash(join14(props.static, file))
+              source: join17(props.static, file),
+              sourceHash: $hash(join17(props.static, file))
             });
           }
         }
@@ -6120,7 +6787,7 @@ var storeFeature = defineFeature({
         "removed:marker": "s3:ObjectRemoved:DeleteMarkerCreated"
       };
       for (const [event, taskProps] of Object.entries(props.events ?? {})) {
-        const eventGroup = new Group16(group, "event", event);
+        const eventGroup = new Group17(group, "event", event);
         const eventId = kebabCase7(`${id}-${shortId(event)}`);
         const { lambda } = createAsyncLambdaFunction(eventGroup, ctx, `store`, eventId, {
           ...taskProps,
@@ -6129,13 +6796,13 @@ var storeFeature = defineFeature({
             description: `${id} event "${event}"`
           }
         });
-        new aws17.lambda.Permission(eventGroup, "permission", {
+        new aws18.lambda.Permission(eventGroup, "permission", {
           action: "lambda:InvokeFunction",
           principal: "s3.amazonaws.com",
           functionName: lambda.functionName,
           sourceArn: `arn:aws:s3:::${name}`
         });
-        new aws17.s3.BucketNotification(eventGroup, "notification", {
+        new aws18.s3.BucketNotification(eventGroup, "notification", {
           bucket: bucket.bucket,
           lambdaFunction: [
             {
@@ -6174,10 +6841,10 @@ var storeFeature = defineFeature({
 });
 
 // src/feature/table/index.ts
-import { Group as Group17 } from "@terraforge/core";
-import { aws as aws18 } from "@terraforge/aws";
+import { Group as Group18 } from "@terraforge/core";
+import { aws as aws19 } from "@terraforge/aws";
 import { constantCase as constantCase11 } from "change-case";
-import { toSeconds as toSeconds8 } from "@awsless/duration";
+import { toSeconds as toSeconds7 } from "@awsless/duration";
 var tableFeature = defineFeature({
   name: "table",
   async onTypeGen(ctx) {
@@ -6226,7 +6893,7 @@ var tableFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.tables ?? {})) {
-      const group = new Group17(ctx.stack, "table", id);
+      const group = new Group18(ctx.stack, "table", id);
       const name = formatLocalResourceName({
         appName: ctx.app.name,
         stackName: ctx.stack.name,
@@ -6255,7 +6922,7 @@ var tableFeature = defineFeature({
           type: types2[props.fields?.[name2] ?? "string"]
         }));
       };
-      const table = new aws18.dynamodb.Table(
+      const table = new aws19.dynamodb.Table(
         group,
         "table",
         {
@@ -6299,7 +6966,7 @@ var tableFeature = defineFeature({
         const result = createLambdaFunction(group, ctx, "table", id, props.stream.consumer);
         result.setEnvironment("THROW_EXPECTED_ERRORS", "1");
         const onFailure = getGlobalOnFailure(ctx);
-        new aws18.lambda.EventSourceMapping(
+        new aws19.lambda.EventSourceMapping(
           group,
           id,
           {
@@ -6309,7 +6976,7 @@ var tableFeature = defineFeature({
             // maximumRecordAgeInSeconds: toSeconds(props.stream.maxRecordAge),
             // bisectBatchOnFunctionError: true,
             batchSize: props.stream.batchSize,
-            maximumBatchingWindowInSeconds: props.stream.batchWindow ? toSeconds8(props.stream.batchWindow) : void 0,
+            maximumBatchingWindowInSeconds: props.stream.batchWindow ? toSeconds7(props.stream.batchWindow) : void 0,
             maximumRetryAttempts: props.stream.retryAttempts,
             parallelizationFactor: props.stream.concurrencyPerShard,
             functionResponseTypes: ["ReportBatchItemFailures"],
@@ -6375,11 +7042,11 @@ var tableFeature = defineFeature({
 });
 
 // src/feature/task/index.ts
-import { Group as Group18 } from "@terraforge/core";
-import { aws as aws19 } from "@terraforge/aws";
+import { Group as Group19 } from "@terraforge/core";
+import { aws as aws20 } from "@terraforge/aws";
 import { camelCase as camelCase7 } from "change-case";
 import { relative as relative7 } from "path";
-var typeGenCode7 = `
+var typeGenCode8 = `
 import { Duration } from '@awsless/duration'
 import { InvokeOptions } from '@awsless/lambda'
 import type { Mock } from 'vitest'
@@ -6437,26 +7104,26 @@ var taskFeature = defineFeature({
       resources2.addType(stack.name, resource);
       mockResponses.addType(stack.name, mockResponse);
     }
-    types2.addCode(typeGenCode7);
+    types2.addCode(typeGenCode8);
     types2.addInterface("TaskResources", resources2);
     types2.addInterface("TaskMock", mocks);
     types2.addInterface("TaskMockResponse", mockResponses);
     await ctx.write("task.d.ts", types2, true);
   },
   onApp(ctx) {
-    const group = new Group18(ctx.base, "task", "main");
+    const group = new Group19(ctx.base, "task", "main");
     const scheduleGroupName = formatGlobalResourceName({
       appName: ctx.app.name,
       resourceType: "task",
       resourceName: "group"
     });
-    new aws19.scheduler.ScheduleGroup(group, "group", {
+    new aws20.scheduler.ScheduleGroup(group, "group", {
       name: scheduleGroupName,
       tags: {
         app: ctx.app.name
       }
     });
-    const role = new aws19.iam.Role(group, "schedule", {
+    const role = new aws20.iam.Role(group, "schedule", {
       name: formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "task",
@@ -6503,7 +7170,7 @@ var taskFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.tasks ?? {})) {
-      const group = new Group18(ctx.stack, "task", id);
+      const group = new Group19(ctx.stack, "task", id);
       createAsyncLambdaFunction(group, ctx, "task", id, props);
     }
   }
@@ -6528,9 +7195,9 @@ var testFeature = defineFeature({
 });
 
 // src/feature/topic/index.ts
-import { Group as Group19 } from "@terraforge/core";
-import { aws as aws20 } from "@terraforge/aws";
-var typeGenCode8 = `
+import { Group as Group20 } from "@terraforge/core";
+import { aws as aws21 } from "@terraforge/aws";
+var typeGenCode9 = `
 import type { PublishOptions } from '@awsless/sns'
 
 type Publish<Name extends string> = {
@@ -6558,7 +7225,7 @@ var topicFeature = defineFeature({
       resources2.addType(topic, `Publish<'${name}'>`);
       mocks.addType(topic, `MockBuilder`);
     }
-    gen.addCode(typeGenCode8);
+    gen.addCode(typeGenCode9);
     gen.addInterface("TopicResources", resources2);
     gen.addInterface("TopicMock", mocks);
     gen.addInterface("TopicMockResponse", mockResponses);
@@ -6576,13 +7243,13 @@ var topicFeature = defineFeature({
   },
   onApp(ctx) {
     for (const id of ctx.appConfig.defaults.topics ?? []) {
-      const group = new Group19(ctx.base, "topic", id);
+      const group = new Group20(ctx.base, "topic", id);
       const name = formatGlobalResourceName({
         appName: ctx.appConfig.name,
         resourceType: "topic",
         resourceName: id
       });
-      const topic = new aws20.sns.Topic(group, "topic", {
+      const topic = new aws21.sns.Topic(group, "topic", {
         name
       });
       ctx.shared.add("topic", `arn`, id, topic.arn);
@@ -6600,15 +7267,15 @@ var topicFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.subscribers ?? {})) {
-      const group = new Group19(ctx.stack, "topic", id);
+      const group = new Group20(ctx.stack, "topic", id);
       const topicArn = ctx.shared.entry("topic", "arn", id);
       const { lambda } = createAsyncLambdaFunction(group, ctx, `topic`, id, props);
-      new aws20.sns.TopicSubscription(group, id, {
+      new aws21.sns.TopicSubscription(group, id, {
         topicArn,
         protocol: "lambda",
         endpoint: lambda.arn
       });
-      new aws20.lambda.Permission(group, id, {
+      new aws21.lambda.Permission(group, id, {
         action: "lambda:InvokeFunction",
         principal: "sns.amazonaws.com",
         functionName: lambda.functionName,
@@ -6619,13 +7286,13 @@ var topicFeature = defineFeature({
 });
 
 // src/feature/vpc/index.ts
-import { Group as Group20 } from "@terraforge/core";
-import { aws as aws21 } from "@terraforge/aws";
+import { Group as Group21 } from "@terraforge/core";
+import { aws as aws22 } from "@terraforge/aws";
 var vpcFeature = defineFeature({
   name: "vpc",
   onApp(ctx) {
-    const group = new Group20(ctx.base, "vpc", "main");
-    const vpc = new aws21.Vpc(group, "vpc", {
+    const group = new Group21(ctx.base, "vpc", "main");
+    const vpc = new aws22.Vpc(group, "vpc", {
       tags: {
         Name: ctx.app.name
       },
@@ -6635,39 +7302,39 @@ var vpcFeature = defineFeature({
       ipv6CidrBlockNetworkBorderGroup: ctx.appConfig.region,
       assignGeneratedIpv6CidrBlock: true
     });
-    const privateRouteTable = new aws21.route.Table(group, "private", {
+    const privateRouteTable = new aws22.route.Table(group, "private", {
       vpcId: vpc.id,
       tags: {
         Name: "private"
       }
     });
-    const publicRouteTable = new aws21.route.Table(group, "public", {
+    const publicRouteTable = new aws22.route.Table(group, "public", {
       vpcId: vpc.id,
       tags: {
         Name: "public"
       }
     });
-    const gateway = new aws21.internet.Gateway(group, "gateway", {
+    const gateway = new aws22.internet.Gateway(group, "gateway", {
       tags: {
         Name: ctx.app.name
       }
     });
-    const egressOnlyInternetGateway = new aws21.egress.OnlyInternetGateway(group, "gateway", {
+    const egressOnlyInternetGateway = new aws22.egress.OnlyInternetGateway(group, "gateway", {
       vpcId: vpc.id,
       tags: {
         Name: ctx.app.name
       }
     });
-    const attachment = new aws21.internet.GatewayAttachment(group, "attachment", {
+    const attachment = new aws22.internet.GatewayAttachment(group, "attachment", {
       vpcId: vpc.id,
       internetGatewayId: gateway.id
     });
-    new aws21.Route(group, "ipv4", {
+    new aws22.Route(group, "ipv4", {
       routeTableId: publicRouteTable.id,
       destinationCidrBlock: "0.0.0.0/0",
       gatewayId: gateway.id
     });
-    new aws21.Route(group, "ipv6", {
+    new aws22.Route(group, "ipv6", {
       routeTableId: privateRouteTable.id,
       destinationIpv6CidrBlock: "::/0",
       egressOnlyGatewayId: egressOnlyInternetGateway.id
@@ -6692,7 +7359,7 @@ var vpcFeature = defineFeature({
       for (const i in zones) {
         const index = Number(i) + 1;
         const id = `${type}-${index}`;
-        const subnet = new aws21.Subnet(group, id, {
+        const subnet = new aws22.Subnet(group, id, {
           tags: {
             Name: `${ctx.app.name}--${type}-${index}`
           },
@@ -6706,7 +7373,7 @@ var vpcFeature = defineFeature({
             return `${cidrBlock}${ipv6Identifier++}::/64`;
           })
         });
-        new aws21.route.TableAssociation(group, id, {
+        new aws22.route.TableAssociation(group, id, {
           routeTableId: table.id,
           subnetId: subnet.id
         });
@@ -6719,9 +7386,9 @@ var vpcFeature = defineFeature({
 });
 
 // src/feature/alert/index.ts
-import { Group as Group21 } from "@terraforge/core";
-import { aws as aws22 } from "@terraforge/aws";
-var typeGenCode9 = `
+import { Group as Group22 } from "@terraforge/core";
+import { aws as aws23 } from "@terraforge/aws";
+var typeGenCode10 = `
 import type { PublishOptions } from '@awsless/sns'
 
 type Alert<Name extends string> = {
@@ -6749,7 +7416,7 @@ var alertFeature = defineFeature({
       mockResponses.addType(alert, "Mock");
       mocks.addType(alert, `MockBuilder`);
     }
-    gen.addCode(typeGenCode9);
+    gen.addCode(typeGenCode10);
     gen.addInterface("AlertResources", resources2);
     gen.addInterface("AlertMock", mocks);
     gen.addInterface("AlertMockResponse", mockResponses);
@@ -6757,17 +7424,17 @@ var alertFeature = defineFeature({
   },
   onApp(ctx) {
     for (const [id, emails] of Object.entries(ctx.appConfig.defaults.alerts ?? {})) {
-      const group = new Group21(ctx.base, "alert", id);
+      const group = new Group22(ctx.base, "alert", id);
       const name = formatGlobalResourceName({
         appName: ctx.appConfig.name,
         resourceType: "alert",
         resourceName: id
       });
-      const topic = new aws22.sns.Topic(group, "topic", {
+      const topic = new aws23.sns.Topic(group, "topic", {
         name
       });
       for (const email of emails) {
-        new aws22.sns.TopicSubscription(group, email, {
+        new aws23.sns.TopicSubscription(group, email, {
           topicArn: topic.arn,
           protocol: "email",
           endpoint: email
@@ -6788,13 +7455,13 @@ var alertFeature = defineFeature({
 });
 
 // src/feature/layer/index.ts
-import { Group as Group22 } from "@terraforge/core";
-import { aws as aws23 } from "@terraforge/aws";
+import { Group as Group23 } from "@terraforge/core";
+import { aws as aws24 } from "@terraforge/aws";
 var layerFeature = defineFeature({
   name: "layer",
   onBefore(ctx) {
-    const group = new Group22(ctx.base, "layer", "asset");
-    const bucket = new aws23.s3.Bucket(group, "bucket", {
+    const group = new Group23(ctx.base, "layer", "asset");
+    const bucket = new aws24.s3.Bucket(group, "bucket", {
       bucket: formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "layer",
@@ -6826,15 +7493,15 @@ var layerFeature = defineFeature({
     }
     for (const [id, _props] of layers) {
       const props = _props;
-      const group = new Group22(ctx.base, "layer", id);
-      const zip = new aws23.s3.BucketObject(group, "zip", {
+      const group = new Group23(ctx.base, "layer", id);
+      const zip = new aws24.s3.BucketObject(group, "zip", {
         bucket: ctx.shared.get("layer", "bucket-name"),
         key: `/layer/${id}.zip`,
         contentType: "application/zip",
         source: props.file,
         sourceHash: $hash(props.file)
       });
-      const layer = new aws23.lambda.LayerVersion(
+      const layer = new aws24.lambda.LayerVersion(
         group,
         "layer",
         {
@@ -6869,14 +7536,14 @@ var layerFeature = defineFeature({
 });
 
 // src/feature/image/index.ts
-import { Group as Group23 } from "@terraforge/core";
-import { aws as aws24 } from "@terraforge/aws";
-import { join as join15, dirname as dirname7 } from "path";
-import { mebibytes as mebibytes6 } from "@awsless/size";
-import { seconds as seconds8, toDays as toDays8 } from "@awsless/duration";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { Group as Group24 } from "@terraforge/core";
+import { aws as aws25 } from "@terraforge/aws";
+import { join as join18, dirname as dirname9 } from "path";
+import { mebibytes as mebibytes7 } from "@awsless/size";
+import { seconds as seconds9, toDays as toDays9 } from "@awsless/duration";
+import { fileURLToPath as fileURLToPath4 } from "url";
 import { glob as glob4 } from "glob";
-var __dirname3 = dirname7(fileURLToPath2(import.meta.url));
+var __dirname5 = dirname9(fileURLToPath4(import.meta.url));
 var imageFeature = defineFeature({
   name: "image",
   onApp(ctx) {
@@ -6886,21 +7553,21 @@ var imageFeature = defineFeature({
     if (found.length === 0) {
       return;
     }
-    const group = new Group23(ctx.base, "image", "layer");
-    const path = join15(__dirname3, "/layers/sharp-arm.zip");
+    const group = new Group24(ctx.base, "image", "layer");
+    const path = join18(__dirname5, "/layers/sharp-arm.zip");
     const layerId = formatGlobalResourceName({
       appName: ctx.appConfig.name,
       resourceType: "layer",
       resourceName: "sharp"
     });
-    const zipFile = new aws24.s3.BucketObject(group, "layer", {
+    const zipFile = new aws25.s3.BucketObject(group, "layer", {
       bucket: ctx.shared.get("layer", "bucket-name"),
       key: `/layer/${layerId}.zip`,
       contentType: "application/zip",
       source: path,
       sourceHash: $hash(path)
     });
-    const layer = new aws24.lambda.LayerVersion(
+    const layer = new aws25.lambda.LayerVersion(
       group,
       "layer",
       {
@@ -6927,7 +7594,7 @@ var imageFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.images ?? {})) {
-      const group = new Group23(ctx.stack, "image", id);
+      const group = new Group24(ctx.stack, "image", id);
       const routerId = ctx.shared.entry("router", "id", props.router);
       const addRoutes = ctx.shared.entry("router", "addRoutes", props.router);
       const routeKey = props.path.endsWith("/") ? `${props.path}*` : `${props.path}/*`;
@@ -6937,7 +7604,7 @@ var imageFeature = defineFeature({
       }
       let s3Origin;
       if (props.origin.static) {
-        s3Origin = new aws24.s3.Bucket(group, "origin", {
+        s3Origin = new aws25.s3.Bucket(group, "origin", {
           bucket: formatLocalResourceName({
             appName: ctx.app.name,
             stackName: ctx.stack.name,
@@ -6947,7 +7614,7 @@ var imageFeature = defineFeature({
           forceDestroy: true
         });
       }
-      const cacheBucket = new aws24.s3.Bucket(group, "cache", {
+      const cacheBucket = new aws25.s3.Bucket(group, "cache", {
         bucket: formatLocalResourceName({
           appName: ctx.app.name,
           stackName: ctx.stack.name,
@@ -6964,7 +7631,7 @@ var imageFeature = defineFeature({
               enabled: true,
               id: "image-cache-duration",
               expiration: {
-                days: toDays8(props.cacheDuration)
+                days: toDays9(props.cacheDuration)
               }
             }
           ]
@@ -6976,23 +7643,23 @@ var imageFeature = defineFeature({
         resourceName: "sharp"
       });
       const serverLambda = createPrebuildLambdaFunction(group, ctx, "image", id, {
-        bundleFile: join15(__dirname3, "/prebuild/image/bundle.zip"),
-        bundleHash: join15(__dirname3, "/prebuild/image/HASH"),
-        memorySize: mebibytes6(512),
-        timeout: seconds8(10),
+        bundleFile: join18(__dirname5, "/prebuild/image/bundle.zip"),
+        bundleHash: join18(__dirname5, "/prebuild/image/HASH"),
+        memorySize: mebibytes7(512),
+        timeout: seconds9(10),
         handler: "index.default",
         runtime: "nodejs24.x",
         log: props.log,
         layers: [sharpLayerId]
       });
-      const permission = new aws24.lambda.Permission(group, "permission", {
+      const permission = new aws25.lambda.Permission(group, "permission", {
         principal: "cloudfront.amazonaws.com",
         action: "lambda:InvokeFunctionUrl",
         functionName: serverLambda.lambda.functionName,
         functionUrlAuthType: "AWS_IAM",
         sourceArn: `arn:aws:cloudfront::${ctx.accountId}:distribution/*`
       });
-      const serverLambdaUrl = new aws24.lambda.FunctionUrl(
+      const serverLambdaUrl = new aws25.lambda.FunctionUrl(
         group,
         "url",
         {
@@ -7049,11 +7716,11 @@ var imageFeature = defineFeature({
             nodir: true
           });
           for (const file of files) {
-            new aws24.s3.BucketObject(group, `static-${file}`, {
+            new aws25.s3.BucketObject(group, `static-${file}`, {
               bucket: s3Origin.bucket,
               key: file,
-              source: join15(props.origin.static, file),
-              sourceHash: $hash(join15(props.origin.static, file))
+              source: join18(props.origin.static, file),
+              sourceHash: $hash(join18(props.origin.static, file))
             });
           }
         }
@@ -7066,19 +7733,19 @@ var imageFeature = defineFeature({
 });
 
 // src/feature/icon/index.ts
-import { Group as Group24 } from "@terraforge/core";
-import { aws as aws25 } from "@terraforge/aws";
-import { join as join16, dirname as dirname8 } from "path";
-import { mebibytes as mebibytes7 } from "@awsless/size";
-import { seconds as seconds9, toDays as toDays9 } from "@awsless/duration";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { Group as Group25 } from "@terraforge/core";
+import { aws as aws26 } from "@terraforge/aws";
+import { join as join19, dirname as dirname10 } from "path";
+import { mebibytes as mebibytes8 } from "@awsless/size";
+import { seconds as seconds10, toDays as toDays10 } from "@awsless/duration";
+import { fileURLToPath as fileURLToPath5 } from "url";
 import { glob as glob5 } from "glob";
-var __dirname4 = dirname8(fileURLToPath3(import.meta.url));
+var __dirname6 = dirname10(fileURLToPath5(import.meta.url));
 var iconFeature = defineFeature({
   name: "icon",
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.icons ?? {})) {
-      const group = new Group24(ctx.stack, "icon", id);
+      const group = new Group25(ctx.stack, "icon", id);
       const routerId = ctx.shared.entry("router", "id", props.router);
       const addRoutes = ctx.shared.entry("router", "addRoutes", props.router);
       const routeKey = props.path.endsWith("/") ? `${props.path}*` : `${props.path}/*`;
@@ -7088,7 +7755,7 @@ var iconFeature = defineFeature({
       }
       let s3Origin;
       if (props.origin.static) {
-        s3Origin = new aws25.s3.Bucket(group, "origin", {
+        s3Origin = new aws26.s3.Bucket(group, "origin", {
           bucket: formatLocalResourceName({
             appName: ctx.app.name,
             stackName: ctx.stack.name,
@@ -7098,7 +7765,7 @@ var iconFeature = defineFeature({
           forceDestroy: true
         });
       }
-      const cacheBucket = new aws25.s3.Bucket(group, "cache", {
+      const cacheBucket = new aws26.s3.Bucket(group, "cache", {
         bucket: formatLocalResourceName({
           appName: ctx.app.name,
           stackName: ctx.stack.name,
@@ -7115,29 +7782,29 @@ var iconFeature = defineFeature({
               enabled: true,
               id: "icon-cache-duration",
               expiration: {
-                days: toDays9(props.cacheDuration)
+                days: toDays10(props.cacheDuration)
               }
             }
           ]
         } : {}
       });
       const serverLambda = createPrebuildLambdaFunction(group, ctx, "icon", id, {
-        bundleFile: join16(__dirname4, "/prebuild/icon/bundle.zip"),
-        bundleHash: join16(__dirname4, "/prebuild/icon/HASH"),
-        memorySize: mebibytes7(512),
-        timeout: seconds9(10),
+        bundleFile: join19(__dirname6, "/prebuild/icon/bundle.zip"),
+        bundleHash: join19(__dirname6, "/prebuild/icon/HASH"),
+        memorySize: mebibytes8(512),
+        timeout: seconds10(10),
         handler: "index.default",
         runtime: "nodejs24.x",
         log: props.log
       });
-      const permission = new aws25.lambda.Permission(group, "permission", {
+      const permission = new aws26.lambda.Permission(group, "permission", {
         principal: "cloudfront.amazonaws.com",
         action: "lambda:InvokeFunctionUrl",
         functionName: serverLambda.lambda.functionName,
         functionUrlAuthType: "AWS_IAM",
         sourceArn: `arn:aws:cloudfront::${ctx.accountId}:distribution/*`
       });
-      const serverLambdaUrl = new aws25.lambda.FunctionUrl(
+      const serverLambdaUrl = new aws26.lambda.FunctionUrl(
         group,
         "url",
         {
@@ -7197,11 +7864,11 @@ var iconFeature = defineFeature({
             if (!file.endsWith(".svg")) {
               throw new Error(`Icon file "${file}" in "${props.origin.static}" is not an SVG file.`);
             }
-            new aws25.s3.BucketObject(group, `static-${file}`, {
+            new aws26.s3.BucketObject(group, `static-${file}`, {
               bucket: s3Origin.bucket,
               key: file,
-              source: join16(props.origin.static, file),
-              sourceHash: $hash(join16(props.origin.static, file))
+              source: join19(props.origin.static, file),
+              sourceHash: $hash(join19(props.origin.static, file))
             });
           }
         }
@@ -7214,30 +7881,30 @@ var iconFeature = defineFeature({
 });
 
 // src/feature/job/index.ts
-import { Group as Group26, Output as Output7, resolveInputs as resolveInputs4, findInputDeps as findInputDeps4 } from "@terraforge/core";
-import { aws as aws27 } from "@terraforge/aws";
+import { Group as Group27, Output as Output8, resolveInputs as resolveInputs5, findInputDeps as findInputDeps5 } from "@terraforge/core";
+import { aws as aws28 } from "@terraforge/aws";
 import { camelCase as camelCase8 } from "change-case";
 import deepmerge5 from "deepmerge";
 import { relative as relative8 } from "path";
 
 // src/feature/job/util.ts
-import { createHash as createHash4 } from "crypto";
-import { toDays as toDays10, toSeconds as toSeconds9 } from "@awsless/duration";
-import { stringify } from "@awsless/json";
+import { createHash as createHash6 } from "crypto";
+import { toDays as toDays11, toSeconds as toSeconds8 } from "@awsless/duration";
+import { stringify as stringify2 } from "@awsless/json";
 import { toMebibytes as toMebibytes5 } from "@awsless/size";
 import { generateFileHash as generateFileHash2 } from "@awsless/ts-file-cache";
-import { aws as aws26 } from "@terraforge/aws";
-import { Group as Group25, Output as Output6, findInputDeps as findInputDeps3, resolveInputs as resolveInputs3 } from "@terraforge/core";
-import { constantCase as constantCase12, pascalCase as pascalCase3 } from "change-case";
+import { aws as aws27 } from "@terraforge/aws";
+import { Group as Group26, Output as Output7, findInputDeps as findInputDeps4, resolveInputs as resolveInputs4 } from "@terraforge/core";
+import { constantCase as constantCase12, pascalCase as pascalCase4 } from "change-case";
 import deepmerge4 from "deepmerge";
 
 // src/feature/job/build/executable.ts
-import { createHash as createHash3 } from "crypto";
-import { readFile as readFile4, writeFile as writeFile3 } from "fs/promises";
-import { join as join17, resolve } from "path";
+import { createHash as createHash5 } from "crypto";
+import { readFile as readFile6, writeFile as writeFile3 } from "fs/promises";
+import { join as join20, resolve } from "path";
 var buildJobExecutable = async (input, outputPath, architecture) => {
-  const filePath = join17(outputPath, "program");
-  const wrapperPath = join17(outputPath, "wrapper.ts");
+  const filePath = join20(outputPath, "program");
+  const wrapperPath = join20(outputPath, "wrapper.ts");
   const handlerPath = resolve(input);
   await writeFile3(
     wrapperPath,
@@ -7292,16 +7959,16 @@ await handler(payload)
     throw new ExpectedError(`Job executable build failed:
 ${result.logs?.map((log35) => log35.message).join("\n")}`);
   }
-  const file = await readFile4(filePath);
+  const file = await readFile6(filePath);
   return {
-    hash: createHash3("sha1").update(file).update(target).digest("hex"),
+    hash: createHash5("sha1").update(file).update(target).digest("hex"),
     file
   };
 };
 
 // src/feature/job/util.ts
 var createFargateJob = (parentGroup, ctx, ns, id, local) => {
-  const group = new Group25(parentGroup, "job", ns);
+  const group = new Group26(parentGroup, "job", ns);
   const name = formatLocalResourceName({
     appName: ctx.app.name,
     stackName: ctx.stack.name,
@@ -7327,13 +7994,13 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
       };
     });
   });
-  const code = new aws26.s3.BucketObject(group, "code", {
+  const code = new aws27.s3.BucketObject(group, "code", {
     bucket: ctx.shared.get("job", "bucket-name"),
     key: name,
     source: relativePath(getBuildPath("job", name, "program")),
     sourceHash: $file(getBuildPath("job", name, "HASH"))
   });
-  const executionRole = new aws26.iam.Role(group, "execution-role", {
+  const executionRole = new aws27.iam.Role(group, "execution-role", {
     name: shortId(`${shortName}:execution-role`),
     description: name,
     assumeRolePolicy: JSON.stringify({
@@ -7350,7 +8017,7 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
     }),
     managedPolicyArns: ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
   });
-  const role = new aws26.iam.Role(
+  const role = new aws27.iam.Role(
     group,
     "task-role",
     {
@@ -7376,7 +8043,7 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
               Version: "2012-10-17",
               Statement: [
                 {
-                  Effect: pascalCase3("allow"),
+                  Effect: pascalCase4("allow"),
                   Action: ["s3:GetObject", "s3:HeadObject"],
                   Resource: [`arn:aws:s3:::${bucket}/${key}`, `arn:aws:s3:::${bucket}/payloads/*`]
                 }
@@ -7392,16 +8059,16 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
   );
   const statements = [];
   const statementDeps = /* @__PURE__ */ new Set();
-  const policy = new aws26.iam.RolePolicy(group, "policy", {
+  const policy = new aws27.iam.RolePolicy(group, "policy", {
     role: role.name,
     name: "task-policy",
-    policy: new Output6(statementDeps, async (resolve2) => {
-      const list3 = await resolveInputs3(statements);
+    policy: new Output7(statementDeps, async (resolve2) => {
+      const list3 = await resolveInputs4(statements);
       resolve2(
         JSON.stringify({
           Version: "2012-10-17",
           Statement: list3.map((statement) => ({
-            Effect: pascalCase3(statement.effect ?? "allow"),
+            Effect: pascalCase4(statement.effect ?? "allow"),
             Action: statement.actions,
             Resource: statement.resources
           }))
@@ -7411,7 +8078,7 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
   });
   const addPermission = (...permissions) => {
     statements.push(...permissions);
-    for (const dep of findInputDeps3(permissions)) {
+    for (const dep of findInputDeps4(permissions)) {
       statementDeps.add(dep);
     }
   };
@@ -7420,12 +8087,12 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
   });
   let logGroup;
   if (props.log.retention && props.log.retention.value > 0n) {
-    logGroup = new aws26.cloudwatch.LogGroup(group, "log", {
+    logGroup = new aws27.cloudwatch.LogGroup(group, "log", {
       name: `/aws/ecs/${name}`,
-      retentionInDays: toDays10(props.log.retention)
+      retentionInDays: toDays11(props.log.retention)
     });
     if (ctx.shared.has("on-error-log", "subscriber-arn")) {
-      new aws26.cloudwatch.LogSubscriptionFilter(group, "on-error-log", {
+      new aws27.cloudwatch.LogSubscriptionFilter(group, "on-error-log", {
         name: "error-log-subscription",
         destinationArn: ctx.shared.get("on-error-log", "subscriber-arn"),
         logGroupName: logGroup.name,
@@ -7443,7 +8110,7 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
   const taskDependsOn = [code];
   const accessPoint = props.persistentStorage ? (() => {
     const fileSystemId = ctx.shared.get("job", "persistent-storage-file-system-id");
-    const accessPoint2 = new aws26.efs.AccessPoint(
+    const accessPoint2 = new aws27.efs.AccessPoint(
       group,
       "access-point",
       {
@@ -7468,7 +8135,7 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
       fileSystemId
     };
   })() : void 0;
-  const task2 = new aws26.ecs.TaskDefinition(
+  const task2 = new aws27.ecs.TaskDefinition(
     group,
     "task",
     {
@@ -7498,9 +8165,9 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
           }
         ]
       },
-      containerDefinitions: new Output6(variableDeps, async (resolve2) => {
-        const data = await resolveInputs3(variables);
-        const { s3Bucket, s3Key } = await resolveInputs3({
+      containerDefinitions: new Output7(variableDeps, async (resolve2) => {
+        const data = await resolveInputs4(variables);
+        const { s3Bucket, s3Key } = await resolveInputs4({
           s3Bucket: code.bucket,
           s3Key: code.key
         });
@@ -7516,7 +8183,7 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
                 [
                   ...props.startupCommand?.length ? [props.startupCommand.join(" && ")] : [],
                   `if [ "$(cat /root/.code-hash 2>/dev/null)" != "$CODE_HASH" ]; then command -v aws >/dev/null 2>&1 || dnf install -y awscli && aws s3 cp s3://${s3Bucket}/${s3Key} /root/program.tmp && mv /root/program.tmp /root/program && chmod +x /root/program && echo "$CODE_HASH" > /root/.code-hash; fi`,
-                  `exec timeout --kill-after=10 ${toSeconds9(props.timeout)} /root/program`
+                  `exec timeout --kill-after=10 ${toSeconds8(props.timeout)} /root/program`
                 ].join(" && ")
               ],
               environment: Object.entries(data).map(([name2, value]) => ({
@@ -7562,7 +8229,7 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
   );
   ctx.onEnv((name2, value) => {
     variables[name2] = value;
-    for (const dep of findInputDeps3([value])) {
+    for (const dep of findInputDeps4([value])) {
       variableDeps.add(dep);
     }
   });
@@ -7571,7 +8238,7 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
   variables.AWS_ACCOUNT_ID = ctx.accountId;
   variables.STACK = ctx.stackConfig.name;
   variables.CODE_HASH = code.sourceHash;
-  variables.JOB_CONFIG_HASH = createHash4("sha1").update(stringify(props)).digest("hex");
+  variables.JOB_CONFIG_HASH = createHash6("sha1").update(stringify2(props)).digest("hex");
   if (props.environment) {
     for (const [key, value] of Object.entries(props.environment)) {
       variables[key] = value;
@@ -7587,7 +8254,7 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
 };
 
 // src/feature/job/index.ts
-var typeGenCode10 = `
+var typeGenCode11 = `
 import type { Mock } from 'vitest'
 
 type Func = (...args: any[]) => any
@@ -7643,15 +8310,15 @@ var jobFeature = defineFeature({
       resources2.addType(stack.name, resource);
       mockResponses.addType(stack.name, mockResponse);
     }
-    types2.addCode(typeGenCode10);
+    types2.addCode(typeGenCode11);
     types2.addInterface("JobResources", resources2);
     types2.addInterface("JobMock", mocks);
     types2.addInterface("JobMockResponse", mockResponses);
     await ctx.write("job.d.ts", types2, true);
   },
   onBefore(ctx) {
-    const group = new Group26(ctx.base, "job", "asset");
-    const bucket = new aws27.s3.Bucket(group, "bucket", {
+    const group = new Group27(ctx.base, "job", "asset");
+    const bucket = new aws28.s3.Bucket(group, "bucket", {
       bucket: formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "job",
@@ -7677,8 +8344,8 @@ var jobFeature = defineFeature({
     if (found.length === 0) {
       return;
     }
-    const group = new Group26(ctx.base, "job", "cluster");
-    const cluster = new aws27.ecs.Cluster(
+    const group = new Group27(ctx.base, "job", "cluster");
+    const cluster = new aws28.ecs.Cluster(
       group,
       "cluster",
       {
@@ -7690,7 +8357,7 @@ var jobFeature = defineFeature({
     );
     ctx.shared.set("job", "cluster-name", cluster.name);
     ctx.shared.set("job", "cluster-arn", cluster.arn);
-    const securityGroup = new aws27.security.Group(group, "security-group", {
+    const securityGroup = new aws28.security.Group(group, "security-group", {
       name: `${ctx.app.name}-job`,
       description: "Shared security group for jobs",
       vpcId: ctx.shared.get("vpc", "id"),
@@ -7699,7 +8366,7 @@ var jobFeature = defineFeature({
         APP: ctx.appConfig.name
       }
     });
-    new aws27.vpc.SecurityGroupEgressRule(group, "egress-rule", {
+    new aws28.vpc.SecurityGroupEgressRule(group, "egress-rule", {
       securityGroupId: securityGroup.id,
       description: "Allow all outbound traffic from jobs",
       ipProtocol: "-1",
@@ -7716,8 +8383,8 @@ var jobFeature = defineFeature({
       })
     );
     if (needsPersistentStorage) {
-      const storageGroup = new Group26(ctx.base, "job", "persistent-storage");
-      new aws27.vpc.SecurityGroupIngressRule(storageGroup, "ingress-rule", {
+      const storageGroup = new Group27(ctx.base, "job", "persistent-storage");
+      new aws28.vpc.SecurityGroupIngressRule(storageGroup, "ingress-rule", {
         securityGroupId: securityGroup.id,
         referencedSecurityGroupId: securityGroup.id,
         description: "Allow NFS traffic from jobs",
@@ -7728,7 +8395,7 @@ var jobFeature = defineFeature({
           APP: ctx.appConfig.name
         }
       });
-      const fileSystem = new aws27.efs.FileSystem(storageGroup, "file-system", {
+      const fileSystem = new aws28.efs.FileSystem(storageGroup, "file-system", {
         encrypted: true,
         performanceMode: "generalPurpose",
         throughputMode: "elastic",
@@ -7738,7 +8405,7 @@ var jobFeature = defineFeature({
         }
       });
       for (const [index, subnetId] of ctx.shared.get("vpc", "public-subnets").entries()) {
-        new aws27.efs.MountTarget(storageGroup, `mount-target-${index + 1}`, {
+        new aws28.efs.MountTarget(storageGroup, `mount-target-${index + 1}`, {
           fileSystemId: fileSystem.id,
           subnetId,
           securityGroups: [securityGroup.id]
@@ -7753,15 +8420,15 @@ var jobFeature = defineFeature({
     const subnets = ctx.shared.get("vpc", "public-subnets");
     ctx.addEnv(
       "JOB_SUBNETS",
-      new Output7(new Set(findInputDeps4(subnets)), async (resolve2) => {
-        const resolved = await resolveInputs4(subnets);
+      new Output8(new Set(findInputDeps5(subnets)), async (resolve2) => {
+        const resolved = await resolveInputs5(subnets);
         resolve2(JSON.stringify(resolved));
       })
     );
     ctx.addEnv("JOB_SECURITY_GROUP", ctx.shared.get("job", "security-group-id"));
     ctx.addEnv("JOB_PAYLOAD_BUCKET", ctx.shared.get("job", "bucket-name"));
     for (const [id, props] of jobs) {
-      const group = new Group26(ctx.stack, "job", id);
+      const group = new Group27(ctx.stack, "job", id);
       createFargateJob(group, ctx, "job", id, props);
     }
     ctx.addStackPermission({
@@ -7794,77 +8461,25 @@ var jobFeature = defineFeature({
 });
 
 // src/feature/instance/index.ts
-import { days as days10, seconds as seconds10, toSeconds as toSeconds11 } from "@awsless/duration";
+import { days as days11, seconds as seconds11, toSeconds as toSeconds10 } from "@awsless/duration";
 import { kibibytes as kibibytes2, toBytes as toBytes2 } from "@awsless/size";
-import { Group as Group28 } from "@terraforge/core";
-import { aws as aws29 } from "@terraforge/aws";
+import { Group as Group29 } from "@terraforge/core";
+import { aws as aws30 } from "@terraforge/aws";
 import { constantCase as constantCase14 } from "change-case";
 
 // src/feature/instance/util.ts
-import { toDays as toDays11, toSeconds as toSeconds10 } from "@awsless/duration";
-import { stringify as stringify2 } from "@awsless/json";
+import { toDays as toDays12, toSeconds as toSeconds9 } from "@awsless/duration";
+import { stringify as stringify3 } from "@awsless/json";
 import { toMebibytes as toMebibytes6 } from "@awsless/size";
 import { generateFileHash as generateFileHash3 } from "@awsless/ts-file-cache";
-import { aws as aws28 } from "@terraforge/aws";
-import { Group as Group27, Output as Output8, findInputDeps as findInputDeps5, resolveInputs as resolveInputs5 } from "@terraforge/core";
-import { constantCase as constantCase13, pascalCase as pascalCase4 } from "change-case";
-import { createHash as createHash6 } from "crypto";
+import { aws as aws29 } from "@terraforge/aws";
+import { Group as Group28, Output as Output9, findInputDeps as findInputDeps6, resolveInputs as resolveInputs6 } from "@terraforge/core";
+import { constantCase as constantCase13, pascalCase as pascalCase5 } from "change-case";
+import { createHash as createHash7 } from "crypto";
 import deepmerge6 from "deepmerge";
-import { join as join19 } from "path";
-
-// src/feature/instance/build/executable.ts
-import { createHash as createHash5 } from "crypto";
-import { readFile as readFile5 } from "fs/promises";
-import { join as join18 } from "path";
-var buildExecutable = async (input, outputPath, architecture) => {
-  const filePath = join18(outputPath, "program");
-  const target = architecture === "x86_64" ? "bun-linux-x64" : "bun-linux-arm64";
-  let result;
-  try {
-    result = await Bun.build({
-      entrypoints: [input],
-      compile: {
-        target,
-        outfile: filePath
-      },
-      target: "bun",
-      loader: {
-        ".md": "text",
-        ".txt": "text",
-        ".html": "text",
-        ".css": "text",
-        ".yaml": "text",
-        ".yml": "text",
-        ".xml": "text",
-        ".csv": "text",
-        ".svg": "text",
-        ".png": "file",
-        ".jpg": "file",
-        ".jpeg": "file",
-        ".gif": "file",
-        ".webp": "file",
-        ".wasm": "file"
-      }
-    });
-  } catch (error) {
-    throw new ExpectedError(
-      `Executable build failed: ${error instanceof Error ? error.message : JSON.stringify(error)}`
-    );
-  }
-  if (!result.success) {
-    throw new ExpectedError(`Executable build failed:
-${result.logs?.map((log35) => log35.message).join("\n")}`);
-  }
-  const file = await readFile5(filePath);
-  return {
-    hash: createHash5("sha1").update(file).update("x86_64").digest("hex"),
-    file
-  };
-};
-
-// src/feature/instance/util.ts
+import { join as join21 } from "path";
 var createFargateTask = (parentGroup, ctx, ns, id, local) => {
-  const group = new Group27(parentGroup, "instance", ns);
+  const group = new Group28(parentGroup, "instance", ns);
   const name = formatLocalResourceName({
     appName: ctx.app.name,
     stackName: ctx.stack.name,
@@ -7890,13 +8505,13 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
       };
     });
   });
-  const code = new aws28.s3.BucketObject(group, "code", {
+  const code = new aws29.s3.BucketObject(group, "code", {
     bucket: ctx.shared.get("instance", "bucket-name"),
     key: name,
     source: relativePath(getBuildPath("instance", name, "program")),
     sourceHash: $file(getBuildPath("instance", name, "HASH"))
   });
-  const executionRole = new aws28.iam.Role(group, "execution-role", {
+  const executionRole = new aws29.iam.Role(group, "execution-role", {
     name: shortId(`${shortName}:execution-role`),
     description: name,
     assumeRolePolicy: JSON.stringify({
@@ -7913,7 +8528,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
     }),
     managedPolicyArns: ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
   });
-  const role = new aws28.iam.Role(
+  const role = new aws29.iam.Role(
     group,
     "task-role",
     {
@@ -7939,7 +8554,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
               Version: "2012-10-17",
               Statement: [
                 {
-                  Effect: pascalCase4("allow"),
+                  Effect: pascalCase5("allow"),
                   Action: ["s3:getObject", "s3:HeadObject"],
                   Resource: `arn:aws:s3:::${bucket}/${key}`
                 }
@@ -7955,16 +8570,16 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   );
   const statements = [];
   const statementDeps = /* @__PURE__ */ new Set();
-  const policy = new aws28.iam.RolePolicy(group, "policy", {
+  const policy = new aws29.iam.RolePolicy(group, "policy", {
     role: role.name,
     name: "task-policy",
-    policy: new Output8(statementDeps, async (resolve2) => {
-      const list3 = await resolveInputs5(statements);
+    policy: new Output9(statementDeps, async (resolve2) => {
+      const list3 = await resolveInputs6(statements);
       resolve2(
         JSON.stringify({
           Version: "2012-10-17",
           Statement: list3.map((statement) => ({
-            Effect: pascalCase4(statement.effect ?? "allow"),
+            Effect: pascalCase5(statement.effect ?? "allow"),
             Action: statement.actions,
             Resource: statement.resources
           }))
@@ -7974,7 +8589,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   });
   const addPermission = (...permissions) => {
     statements.push(...permissions);
-    for (const dep of findInputDeps5(permissions)) {
+    for (const dep of findInputDeps6(permissions)) {
       statementDeps.add(dep);
     }
   };
@@ -7983,13 +8598,13 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   });
   let logGroup;
   if (props.log.retention && props.log.retention.value > 0n) {
-    logGroup = new aws28.cloudwatch.LogGroup(group, "log", {
+    logGroup = new aws29.cloudwatch.LogGroup(group, "log", {
       name: `/aws/ecs/${name}`,
       // name: `/aws/lambda/${name}`,
-      retentionInDays: toDays11(props.log.retention)
+      retentionInDays: toDays12(props.log.retention)
     });
     if (ctx.shared.has("on-error-log", "subscriber-arn")) {
-      new aws28.cloudwatch.LogSubscriptionFilter(group, "on-error-log", {
+      new aws29.cloudwatch.LogSubscriptionFilter(group, "on-error-log", {
         name: "error-log-subscription",
         destinationArn: ctx.shared.get("on-error-log", "subscriber-arn"),
         logGroupName: logGroup.name,
@@ -8004,7 +8619,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   };
   const variables = {};
   const variableDeps = /* @__PURE__ */ new Set();
-  const task2 = new aws28.ecs.TaskDefinition(
+  const task2 = new aws29.ecs.TaskDefinition(
     group,
     "task",
     {
@@ -8020,9 +8635,9 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
         operatingSystemFamily: "LINUX"
       },
       trackLatest: true,
-      containerDefinitions: new Output8(variableDeps, async (resolve2) => {
-        const data = await resolveInputs5(variables);
-        const { s3Bucket, s3Key } = await resolveInputs5({
+      containerDefinitions: new Output9(variableDeps, async (resolve2) => {
+        const data = await resolveInputs6(variables);
+        const { s3Bucket, s3Key } = await resolveInputs6({
           s3Bucket: code.bucket,
           s3Key: code.key
         });
@@ -8077,12 +8692,12 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
               healthCheck: props.healthCheck ? {
                 command: [
                   "CMD-SHELL",
-                  `curl -f http://${join19("localhost", props.healthCheck.path)} || exit 1`
+                  `curl -f http://${join21("localhost", props.healthCheck.path)} || exit 1`
                 ],
-                interval: toSeconds10(props.healthCheck.interval),
+                interval: toSeconds9(props.healthCheck.interval),
                 retries: props.healthCheck.retries,
-                startPeriod: toSeconds10(props.healthCheck.startPeriod),
-                timeout: toSeconds10(props.healthCheck.timeout)
+                startPeriod: toSeconds9(props.healthCheck.startPeriod),
+                timeout: toSeconds9(props.healthCheck.timeout)
               } : void 0
             }
           ])
@@ -8102,14 +8717,14 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
       dependsOn: [code]
     }
   );
-  const securityGroup = new aws28.security.Group(group, "security-group", {
+  const securityGroup = new aws29.security.Group(group, "security-group", {
     name,
     description: "Security group for the instance",
     vpcId: ctx.shared.get("vpc", "id"),
     revokeRulesOnDelete: true,
     tags
   });
-  new aws28.vpc.SecurityGroupEgressRule(group, "egress-rule", {
+  new aws29.vpc.SecurityGroupEgressRule(group, "egress-rule", {
     securityGroupId: securityGroup.id,
     description: `Allow all outbound traffic from the ${name} instance`,
     ipProtocol: "-1",
@@ -8118,7 +8733,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   });
   const clusterName = ctx.shared.get("instance", "cluster-name");
   const clusterArn = ctx.shared.get("instance", "cluster-arn");
-  const service = new aws28.ecs.Service(
+  const service = new aws29.ecs.Service(
     group,
     "service",
     {
@@ -8154,7 +8769,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
       replaceOnChanges: ["cluster"]
     }
   );
-  new aws28.appautoscaling.Target(
+  new aws29.appautoscaling.Target(
     group,
     "autoscaling-target",
     {
@@ -8173,7 +8788,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   );
   ctx.onEnv((name2, value) => {
     variables[name2] = value;
-    for (const dep of findInputDeps5([value])) {
+    for (const dep of findInputDeps6([value])) {
       variableDeps.add(dep);
     }
   });
@@ -8182,7 +8797,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   variables.AWS_ACCOUNT_ID = ctx.accountId;
   variables.STACK = ctx.stackConfig.name;
   variables.CODE_HASH = code.sourceHash;
-  variables.INSTANCE_CONFIG_HASH = createHash6("sha1").update(stringify2(props)).digest("hex");
+  variables.INSTANCE_CONFIG_HASH = createHash7("sha1").update(stringify3(props)).digest("hex");
   if (props.environment) {
     for (const [key, value] of Object.entries(props.environment)) {
       variables[key] = value;
@@ -8198,7 +8813,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
 };
 
 // src/feature/instance/index.ts
-var typeGenCode11 = `
+var typeGenCode12 = `
 import { SendMessageOptions } from '@awsless/sqs'
 import type { Mock } from 'vitest'
 
@@ -8237,15 +8852,15 @@ var instanceFeature = defineFeature({
       mocks.addType(stack.name, mock);
       mockResponses.addType(stack.name, mockResponse);
     }
-    gen.addCode(typeGenCode11);
+    gen.addCode(typeGenCode12);
     gen.addInterface("InstanceResources", resources2);
     gen.addInterface("InstanceMock", mocks);
     gen.addInterface("InstanceMockResponse", mockResponses);
     await ctx.write("instance.d.ts", gen, true);
   },
   onBefore(ctx) {
-    const group = new Group28(ctx.base, "instance", "asset");
-    const bucket = new aws29.s3.Bucket(group, "bucket", {
+    const group = new Group29(ctx.base, "instance", "asset");
+    const bucket = new aws30.s3.Bucket(group, "bucket", {
       bucket: formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "instance",
@@ -8263,8 +8878,8 @@ var instanceFeature = defineFeature({
     if (found.length === 0) {
       return;
     }
-    const group = new Group28(ctx.base, "instance", "cluster");
-    const cluster = new aws29.ecs.Cluster(
+    const group = new Group29(ctx.base, "instance", "cluster");
+    const cluster = new aws30.ecs.Cluster(
       group,
       "cluster",
       {
@@ -8279,14 +8894,14 @@ var instanceFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.instances ?? {})) {
-      const group = new Group28(ctx.stack, "instance", id);
+      const group = new Group29(ctx.stack, "instance", id);
       const task2 = createFargateTask(group, ctx, "instance", id, props);
-      const queue2 = new aws29.sqs.Queue(group, "queue", {
+      const queue2 = new aws30.sqs.Queue(group, "queue", {
         name: task2.name,
-        visibilityTimeoutSeconds: toSeconds11(seconds10(30)),
-        messageRetentionSeconds: toSeconds11(days10(4)),
+        visibilityTimeoutSeconds: toSeconds10(seconds11(30)),
+        messageRetentionSeconds: toSeconds10(days11(4)),
         maxMessageSize: toBytes2(kibibytes2(256)),
-        receiveWaitTimeSeconds: toSeconds11(seconds10(20))
+        receiveWaitTimeSeconds: toSeconds10(seconds11(20))
       });
       task2.addPermission({
         actions: [
@@ -8308,11 +8923,11 @@ var instanceFeature = defineFeature({
 });
 
 // src/feature/metric/index.ts
-import { Group as Group29 } from "@terraforge/core";
-import { aws as aws30 } from "@terraforge/aws";
+import { Group as Group30 } from "@terraforge/core";
+import { aws as aws31 } from "@terraforge/aws";
 import { kebabCase as kebabCase8, constantCase as constantCase15 } from "change-case";
-import { toSeconds as toSeconds12 } from "@awsless/duration";
-var typeGenCode12 = `
+import { toSeconds as toSeconds11 } from "@awsless/duration";
+var typeGenCode13 = `
 import { type PutDataProps, putData, batchPutData } from '@awsless/cloudwatch'
 import { type Duration } from '@awsless/duration'
 import { type Size } from '@awsless/size'
@@ -8360,7 +8975,7 @@ var metricFeature = defineFeature({
       resources2.addType(stack.name, stackResources);
     }
     resources2.addType("batch", "Batch");
-    gen.addCode(typeGenCode12);
+    gen.addCode(typeGenCode13);
     gen.addInterface("MetricResources", resources2);
     await ctx.write("metric.d.ts", gen, true);
   },
@@ -8377,16 +8992,16 @@ var metricFeature = defineFeature({
       }
     });
     for (const [id, props] of Object.entries(ctx.stackConfig.metrics ?? {})) {
-      const group = new Group29(ctx.stack, "metric", id);
+      const group = new Group30(ctx.stack, "metric", id);
       ctx.addEnv(`METRIC_${constantCase15(id)}`, props.type);
       for (const alarmId in props.alarms ?? []) {
-        const alarmGroup = new Group29(group, "alarm", alarmId);
+        const alarmGroup = new Group30(group, "alarm", alarmId);
         const alarmName = kebabCase8(`${id}-${alarmId}`);
         const alarmProps = props.alarms[alarmId];
         let alarmAction;
         let alarmLambda;
         if (Array.isArray(alarmProps.trigger)) {
-          const topic = new aws30.sns.Topic(alarmGroup, "alarm-trigger", {
+          const topic = new aws31.sns.Topic(alarmGroup, "alarm-trigger", {
             name: formatLocalResourceName({
               appName: ctx.app.name,
               stackName: ctx.stack.name,
@@ -8396,7 +9011,7 @@ var metricFeature = defineFeature({
           });
           alarmAction = topic.arn;
           for (const email of alarmProps.trigger) {
-            new aws30.sns.TopicSubscription(alarmGroup, email, {
+            new aws31.sns.TopicSubscription(alarmGroup, email, {
               topicArn: topic.arn,
               protocol: "email",
               endpoint: email
@@ -8407,7 +9022,7 @@ var metricFeature = defineFeature({
           alarmLambda = lambda;
           alarmAction = lambda.arn;
         }
-        const alarm = new aws30.cloudwatch.MetricAlarm(alarmGroup, "alarm", {
+        const alarm = new aws31.cloudwatch.MetricAlarm(alarmGroup, "alarm", {
           namespace,
           metricName: kebabCase8(id),
           alarmName: formatLocalResourceName({
@@ -8419,13 +9034,13 @@ var metricFeature = defineFeature({
           alarmDescription: alarmProps.description,
           statistic: alarmProps.where.stat,
           threshold: alarmProps.where.value,
-          period: toSeconds12(alarmProps.period),
+          period: toSeconds11(alarmProps.period),
           evaluationPeriods: alarmProps.minDataPoints,
           comparisonOperator: alarmProps.where.op,
           alarmActions: [alarmAction]
         });
         if (alarmLambda) {
-          new aws30.lambda.Permission(alarmGroup, "permission", {
+          new aws31.lambda.Permission(alarmGroup, "permission", {
             action: "lambda:InvokeFunction",
             principal: "lambda.alarms.cloudwatch.amazonaws.com",
             functionName: alarmLambda.functionName,
@@ -8438,9 +9053,9 @@ var metricFeature = defineFeature({
 });
 
 // src/feature/router/index.ts
-import { days as days11, seconds as seconds11, toSeconds as toSeconds13, years } from "@awsless/duration";
-import { Future, Group as Group30 } from "@terraforge/core";
-import { aws as aws31 } from "@terraforge/aws";
+import { days as days12, seconds as seconds12, toSeconds as toSeconds12, years } from "@awsless/duration";
+import { Future, Group as Group31 } from "@terraforge/core";
+import { aws as aws32 } from "@terraforge/aws";
 import { camelCase as camelCase9, constantCase as constantCase16 } from "change-case";
 
 // src/feature/router/router-code.ts
@@ -8689,18 +9304,18 @@ async function handler(event) {
 `;
 
 // src/feature/router/index.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 var routerFeature = defineFeature({
   name: "router",
   onApp(ctx) {
     for (const [id, props] of Object.entries(ctx.appConfig.defaults.router ?? {})) {
-      const group = new Group30(ctx.base, "router", id);
+      const group = new Group31(ctx.base, "router", id);
       const name = formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "router",
         resourceName: id
       });
-      const routeStore = new aws31.cloudfront.KeyValueStore(group, "routes", {
+      const routeStore = new aws32.cloudfront.KeyValueStore(group, "routes", {
         name,
         comment: "Store for routes"
       });
@@ -8730,11 +9345,11 @@ var routerFeature = defineFeature({
         );
         importedRoutes.push(importKeys);
       });
-      const cache = new aws31.cloudfront.CachePolicy(group, "cache", {
+      const cache = new aws32.cloudfront.CachePolicy(group, "cache", {
         name,
-        minTtl: toSeconds13(seconds11(0)),
-        maxTtl: toSeconds13(days11(365)),
-        defaultTtl: toSeconds13(days11(0)),
+        minTtl: toSeconds12(seconds12(0)),
+        maxTtl: toSeconds12(days12(365)),
+        defaultTtl: toSeconds12(days12(0)),
         parametersInCacheKeyAndForwardedToOrigin: {
           enableAcceptEncodingBrotli: true,
           enableAcceptEncodingGzip: true,
@@ -8762,7 +9377,7 @@ var routerFeature = defineFeature({
           }
         }
       });
-      const originRequest = new aws31.cloudfront.OriginRequestPolicy(group, "request", {
+      const originRequest = new aws32.cloudfront.OriginRequestPolicy(group, "request", {
         name,
         headersConfig: {
           headerBehavior: camelCase9("all-except"),
@@ -8780,11 +9395,11 @@ var routerFeature = defineFeature({
           queryStringBehavior: "all"
         }
       });
-      const responseHeaders = new aws31.cloudfront.ResponseHeadersPolicy(group, "response", {
+      const responseHeaders = new aws32.cloudfront.ResponseHeadersPolicy(group, "response", {
         name,
         corsConfig: {
           originOverride: props.cors?.override ?? true,
-          accessControlMaxAgeSec: toSeconds13(props.cors?.maxAge ?? years(1)),
+          accessControlMaxAgeSec: toSeconds12(props.cors?.maxAge ?? years(1)),
           accessControlAllowHeaders: { items: props.cors?.headers ?? ["*"] },
           accessControlAllowMethods: { items: props.cors?.methods ?? ["ALL"] },
           accessControlAllowOrigins: { items: props.cors?.origins ?? ["*"] },
@@ -8809,7 +9424,7 @@ var routerFeature = defineFeature({
           strictTransportSecurity: {
             override: true,
             preload: true,
-            accessControlMaxAgeSec: toSeconds13(years(1)),
+            accessControlMaxAgeSec: toSeconds12(years(1)),
             includeSubdomains: true
           },
           xssProtection: {
@@ -8819,7 +9434,7 @@ var routerFeature = defineFeature({
           }
         }
       });
-      const viewerRequest = new aws31.cloudfront.Function(group, "viewer-request", {
+      const viewerRequest = new aws32.cloudfront.Function(group, "viewer-request", {
         name,
         runtime: `cloudfront-js-2.0`,
         comment: `Viewer Request - ${name}`,
@@ -8841,7 +9456,7 @@ var routerFeature = defineFeature({
             rateBasedStatement: {
               limit: wafSettingsConfig.rateLimiter.limit,
               aggregateKeyType: "IP",
-              evaluationWindowSec: toSeconds13(wafSettingsConfig.rateLimiter.window)
+              evaluationWindowSec: toSeconds12(wafSettingsConfig.rateLimiter.window)
             }
           },
           action: {
@@ -8921,7 +9536,7 @@ var routerFeature = defineFeature({
       }
       let waf;
       if (wafRules.length && wafSettingsConfig) {
-        waf = new aws31.wafv2.WebAcl(group, "waf", {
+        waf = new aws32.wafv2.WebAcl(group, "waf", {
           name: `${name}-wafv2`,
           scope: "CLOUDFRONT",
           defaultAction: {
@@ -8931,12 +9546,12 @@ var routerFeature = defineFeature({
           rule: wafRules,
           captchaConfig: {
             immunityTimeProperty: {
-              immunityTime: toSeconds13(wafSettingsConfig.captchaImmunityTime)
+              immunityTime: toSeconds12(wafSettingsConfig.captchaImmunityTime)
             }
           },
           challengeConfig: {
             immunityTimeProperty: {
-              immunityTime: toSeconds13(wafSettingsConfig.challengeImmunityTime)
+              immunityTime: toSeconds12(wafSettingsConfig.challengeImmunityTime)
             }
           },
           visibilityConfig: {
@@ -8946,7 +9561,7 @@ var routerFeature = defineFeature({
           }
         });
       }
-      const distribution = new aws31.cloudfront.MultitenantDistribution(group, "distribution", {
+      const distribution = new aws32.cloudfront.MultitenantDistribution(group, "distribution", {
         tags: {
           name
         },
@@ -8992,7 +9607,7 @@ var routerFeature = defineFeature({
           }
           return {
             errorCode: Number(errorCode),
-            errorCachingMinTtl: item.minTTL ? toSeconds13(item.minTTL) : void 0,
+            errorCachingMinTtl: item.minTTL ? toSeconds12(item.minTTL) : void 0,
             responseCode: item.statusCode?.toString() ?? errorCode,
             responsePagePath: item.path
           };
@@ -9043,7 +9658,7 @@ var routerFeature = defineFeature({
               version: new Future((resolve2) => {
                 $combine(...versions).then((versions2) => {
                   const combined = versions2.filter((v) => !!v).sort().join(",");
-                  const version = createHash7("sha1").update(combined).digest("hex");
+                  const version = createHash8("sha1").update(combined).digest("hex");
                   resolve2(version);
                 });
               })
@@ -9058,10 +9673,10 @@ var routerFeature = defineFeature({
         const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
         const certificateArn = ctx.shared.entry("domain", `global-certificate-arn`, props.domain);
         const zoneId = ctx.shared.entry("domain", "zone-id", props.domain);
-        const connectionGroup = new aws31.cloudfront.ConnectionGroup(group, "connection-group", {
+        const connectionGroup = new aws32.cloudfront.ConnectionGroup(group, "connection-group", {
           name
         });
-        new aws31.cloudfront.DistributionTenant(group, `tenant`, {
+        new aws32.cloudfront.DistributionTenant(group, `tenant`, {
           name,
           enabled: true,
           distributionId: distribution.id,
@@ -9069,7 +9684,7 @@ var routerFeature = defineFeature({
           domain: [{ domain: domainName }],
           customizations: [{ certificate: [{ arn: certificateArn }] }]
         });
-        new aws31.route53.Record(group, `record`, {
+        new aws32.route53.Record(group, `record`, {
           zoneId,
           type: "A",
           name: domainName,
@@ -10192,21 +10807,21 @@ import wildstring4 from "wildstring";
 
 // src/cli/ui/complex/run-tests.ts
 import { log as log18 } from "@awsless/clui";
-import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
-import { join as join21 } from "path";
+import { mkdir as mkdir4, readFile as readFile7, writeFile as writeFile4 } from "fs/promises";
+import { join as join23 } from "path";
 import wildstring3 from "wildstring";
-import { parse as parse4, stringify as stringify3 } from "@awsless/json";
+import { parse as parse4, stringify as stringify4 } from "@awsless/json";
 import { generateFolderHash, loadWorkspace as loadWorkspace2 } from "@awsless/ts-file-cache";
 
 // src/test/start.ts
-import { dirname as dirname9, join as join20 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { dirname as dirname11, join as join22 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
 import { configDefaults } from "vitest/config";
 import { startVitest } from "vitest/node";
 var NullReporter = class {
 };
 var startTest = async (props) => {
-  const __dirname5 = dirname9(fileURLToPath4(import.meta.url));
+  const __dirname7 = dirname11(fileURLToPath6(import.meta.url));
   const startTime = process.hrtime.bigint();
   process.noDeprecation = true;
   const vitest = await startVitest(
@@ -10237,7 +10852,7 @@ var startTest = async (props) => {
       // },
       setupFiles: [
         //
-        join20(__dirname5, "test-global-setup.js")
+        join22(__dirname7, "test-global-setup.js")
       ]
       // globalSetup: [
       // 	//
@@ -10431,12 +11046,12 @@ var logTestErrors = (event) => {
 };
 var runTest = async (stack, dir, filters, workspace, opts) => {
   await mkdir4(directories.test, { recursive: true });
-  const file = join21(directories.test, `${stack}.json`);
+  const file = join23(directories.test, `${stack}.json`);
   const fingerprint = await generateFolderHash(workspace, dir);
   if (!process.env.NO_CACHE) {
     const exists = await fileExist(file);
     if (exists) {
-      const raw = await readFile6(file, { encoding: "utf8" });
+      const raw = await readFile7(file, { encoding: "utf8" });
       const data = parse4(raw);
       if (data.fingerprint === fingerprint) {
         log18.step(
@@ -10481,7 +11096,7 @@ var runTest = async (stack, dir, filters, workspace, opts) => {
   logTestErrors(result);
   await writeFile4(
     file,
-    stringify3({
+    stringify4({
       ...result,
       fingerprint
     })
@@ -11116,7 +11731,7 @@ import { log as log25 } from "@awsless/clui";
 
 // src/type-gen/generate.ts
 import { mkdir as mkdir5, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname10, join as join22, relative as relative9 } from "path";
+import { dirname as dirname12, join as join24, relative as relative9 } from "path";
 var generateTypes = async (props) => {
   const files = [];
   await Promise.all(
@@ -11125,12 +11740,12 @@ var generateTypes = async (props) => {
         ...props,
         async write(file, data, include = false) {
           const code = data?.toString("utf8");
-          const path = join22(directories.types, file);
+          const path = join24(directories.types, file);
           if (code) {
             if (include) {
               files.push(relative9(directories.root, path));
             }
-            await mkdir5(dirname10(path), { recursive: true });
+            await mkdir5(dirname12(path), { recursive: true });
             await writeFile5(path, code);
           }
         }
@@ -11139,7 +11754,7 @@ var generateTypes = async (props) => {
   );
   if (files.length) {
     const code = files.map((file) => `/// <reference path='${file}' />`).join("\n");
-    await writeFile5(join22(directories.root, `awsless.d.ts`), code);
+    await writeFile5(join24(directories.root, `awsless.d.ts`), code);
   }
 };
 
@@ -11565,7 +12180,7 @@ var domain = (program2) => {
 // src/cli/command/logs.ts
 import { CloudWatchLogsClient, StartLiveTailCommand } from "@aws-sdk/client-cloudwatch-logs";
 import { log as log30 } from "@awsless/clui";
-import { aws as aws32 } from "@terraforge/aws";
+import { aws as aws33 } from "@terraforge/aws";
 import chalk6 from "chalk";
 import chunk2 from "chunk";
 import { formatDate } from "date-fns";
@@ -11588,7 +12203,7 @@ var logs = (program2) => {
       for (const stack of app.stacks) {
         if (filters.find((f) => wildstring7.match(f, stack.name))) {
           for (const resource of stack.resources) {
-            if (resource instanceof aws32.cloudwatch.LogGroup) {
+            if (resource instanceof aws33.cloudwatch.LogGroup) {
               logGroupArns.push(await resource.arn);
             }
           }