@awsless/cli 0.0.5 → 0.0.6

package/dist/bin.js

@@ -3894,9 +3894,9 @@ var createLambdaFunction = (parentGroup, ctx, ns, id, local) => {
   const policy = new aws4.iam.RolePolicy(group, "policy", {
     role: role.name,
     name: "lambda-policy",
-    policy: new Output3(statementDeps, async (resolve) => {
+    policy: new Output3(statementDeps, async (resolve2) => {
       const list3 = await resolveInputs(statements);
-      resolve(
+      resolve2(
         JSON.stringify({
           Version: "2012-10-17",
           Statement: list3.map((statement) => ({
@@ -4645,9 +4645,9 @@ var createPrebuildLambdaFunction = (group, ctx, ns, id, props) => {
   const policy = new aws8.iam.RolePolicy(group, "policy", {
     role: role.name,
     name: "lambda-policy",
-    policy: new Output4(statementDeps, async (resolve) => {
+    policy: new Output4(statementDeps, async (resolve2) => {
       const list3 = await resolveInputs2(statements);
-      resolve(
+      resolve2(
         JSON.stringify({
           Version: "2012-10-17",
           Statement: list3.map((statement) => ({
@@ -7233,11 +7233,14 @@ var iconFeature = defineFeature({
   }
 });
 
-// src/feature/instance/index.ts
-import { Group as Group26 } from "@terraforge/core";
+// src/feature/job/index.ts
+import { Group as Group26, Output as Output7, resolveInputs as resolveInputs4, findInputDeps as findInputDeps4 } from "@terraforge/core";
 import { aws as aws27 } from "@terraforge/aws";
+import { camelCase as camelCase8 } from "change-case";
+import { relative as relative8 } from "path";
 
-// src/feature/instance/util.ts
+// src/feature/job/util.ts
+import { createHash as createHash4 } from "crypto";
 import { toDays as toDays9, toSeconds as toSeconds9 } from "@awsless/duration";
 import { stringify } from "@awsless/json";
 import { toMebibytes as toMebibytes5 } from "@awsless/size";
@@ -7245,21 +7248,37 @@ import { generateFileHash as generateFileHash2 } from "@awsless/ts-file-cache";
 import { aws as aws26 } from "@terraforge/aws";
 import { Group as Group25, Output as Output6, findInputDeps as findInputDeps3, resolveInputs as resolveInputs3 } from "@terraforge/core";
 import { constantCase as constantCase12, pascalCase as pascalCase3 } from "change-case";
-import { createHash as createHash4 } from "crypto";
 import deepmerge4 from "deepmerge";
-import { join as join18 } from "path";
 
-// src/feature/instance/build/executable.ts
+// src/feature/job/build/executable.ts
 import { createHash as createHash3 } from "crypto";
-import { readFile as readFile4 } from "fs/promises";
-import { join as join17 } from "path";
-var buildExecutable = async (input, outputPath, architecture) => {
+import { readFile as readFile4, writeFile as writeFile3 } from "fs/promises";
+import { join as join17, resolve } from "path";
+var buildJobExecutable = async (input, outputPath, architecture) => {
   const filePath = join17(outputPath, "program");
+  const wrapperPath = join17(outputPath, "wrapper.ts");
+  const handlerPath = resolve(input);
+  await writeFile3(
+    wrapperPath,
+    `import { parse } from '@awsless/json'
+import { getObject } from '@awsless/s3'
+import handler from '${handlerPath}'
+
+let payload = process.env.PAYLOAD ? parse(process.env.PAYLOAD) : undefined
+if (typeof payload === 'string' && payload.startsWith('s3://')) {
+	const url = new URL(payload)
+	const response = await getObject({ bucket: url.hostname, key: url.pathname.slice(1) })
+	if (!response) throw new Error('Failed to fetch payload from S3: ' + payload)
+	payload = parse(await response.body.transformToString())
+}
+await handler(payload)
+	`
+  );
   const target = architecture === "x86_64" ? "bun-linux-x64" : "bun-linux-arm64";
   let result;
   try {
     result = await Bun.build({
-      entrypoints: [input],
+      entrypoints: [wrapperPath],
       compile: {
         target,
         outfile: filePath
@@ -7268,23 +7287,23 @@ var buildExecutable = async (input, outputPath, architecture) => {
     });
   } catch (error) {
     throw new ExpectedError(
-      `Executable build failed: ${error instanceof Error ? error.message : JSON.stringify(error)}`
+      `Job executable build failed: ${error instanceof Error ? error.message : JSON.stringify(error)}`
     );
   }
   if (!result.success) {
-    throw new ExpectedError(`Executable build failed:
+    throw new ExpectedError(`Job executable build failed:
 ${result.logs?.map((log35) => log35.message).join("\n")}`);
   }
   const file = await readFile4(filePath);
   return {
-    hash: createHash3("sha1").update(file).update("x86_64").digest("hex"),
+    hash: createHash3("sha1").update(file).update(target).digest("hex"),
     file
   };
 };
 
-// src/feature/instance/util.ts
-var createFargateTask = (parentGroup, ctx, ns, id, local) => {
-  const group = new Group25(parentGroup, "instance", ns);
+// src/feature/job/util.ts
+var createFargateJob = (parentGroup, ctx, ns, id, local) => {
+  const group = new Group25(parentGroup, "job", ns);
   const name = formatLocalResourceName({
     appName: ctx.app.name,
     stackName: ctx.stack.name,
@@ -7292,13 +7311,13 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
     resourceName: id
   });
   const shortName = shortId(`${ctx.app.name}:${ctx.stack.name}:${ns}:${id}:${ctx.appId}`);
-  const props = deepmerge4(ctx.appConfig.defaults.instance, local);
-  const image2 = props.image || (props.architecture === "arm64" ? "public.ecr.aws/aws-cli/aws-cli:arm64" : "public.ecr.aws/aws-cli/aws-cli:amd64");
-  ctx.registerBuild("instance", name, async (build3, { workspace }) => {
-    const fingerprint = await generateFileHash2(workspace, local.code.file);
+  const props = deepmerge4(ctx.appConfig.defaults.job, local);
+  const image2 = props.image || "public.ecr.aws/amazonlinux/amazonlinux:2023-minimal";
+  ctx.registerBuild("job", name, async (build3, { workspace }) => {
+    const fingerprint = [await generateFileHash2(workspace, local.code.file), props.architecture].join(":");
     return build3(fingerprint, async (write) => {
-      const temp = await createTempFolder(`instance--${name}`);
-      const executable = await buildExecutable(local.code.file, temp.path, props.architecture);
+      const temp = await createTempFolder(`job--${name}`);
+      const executable = await buildJobExecutable(local.code.file, temp.path, props.architecture);
       await Promise.all([
         //
         write("HASH", executable.hash),
@@ -7311,10 +7330,10 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
     });
   });
   const code = new aws26.s3.BucketObject(group, "code", {
-    bucket: ctx.shared.get("instance", "bucket-name"),
+    bucket: ctx.shared.get("job", "bucket-name"),
     key: name,
-    source: relativePath(getBuildPath("instance", name, "program")),
-    sourceHash: $file(getBuildPath("instance", name, "HASH"))
+    source: relativePath(getBuildPath("job", name, "program")),
+    sourceHash: $file(getBuildPath("job", name, "HASH"))
   });
   const executionRole = new aws26.iam.Role(group, "execution-role", {
     name: shortId(`${shortName}:execution-role`),
@@ -7360,8 +7379,8 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
               Statement: [
                 {
                   Effect: pascalCase3("allow"),
-                  Action: ["s3:getObject", "s3:HeadObject"],
-                  Resource: `arn:aws:s3:::${bucket}/${key}`
+                  Action: ["s3:GetObject", "s3:HeadObject"],
+                  Resource: [`arn:aws:s3:::${bucket}/${key}`, `arn:aws:s3:::${bucket}/payloads/*`]
                 }
               ]
             });
@@ -7378,9 +7397,9 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   const policy = new aws26.iam.RolePolicy(group, "policy", {
     role: role.name,
     name: "task-policy",
-    policy: new Output6(statementDeps, async (resolve) => {
+    policy: new Output6(statementDeps, async (resolve2) => {
       const list3 = await resolveInputs3(statements);
-      resolve(
+      resolve2(
         JSON.stringify({
           Version: "2012-10-17",
           Statement: list3.map((statement) => ({
@@ -7405,7 +7424,6 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   if (props.log.retention && props.log.retention.value > 0n) {
     logGroup = new aws26.cloudwatch.LogGroup(group, "log", {
       name: `/aws/ecs/${name}`,
-      // name: `/aws/lambda/${name}`,
       retentionInDays: toDays9(props.log.retention)
     });
     if (ctx.shared.has("on-error-log", "subscriber-arn")) {
@@ -7424,6 +7442,63 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   };
   const variables = {};
   const variableDeps = /* @__PURE__ */ new Set();
+  const taskDependsOn = [code];
+  const accessPoint = props.persistentStorage ? (() => {
+    const persistentStorageSecurityGroup = new aws26.security.Group(
+      group,
+      "persistent-storage-security-group",
+      {
+        name: shortId(`${shortName}:storage-sg`),
+        description: name,
+        vpcId: ctx.shared.get("vpc", "id"),
+        revokeRulesOnDelete: true,
+        tags
+      }
+    );
+    new aws26.vpc.SecurityGroupIngressRule(group, "persistent-storage-ingress-rule", {
+      securityGroupId: persistentStorageSecurityGroup.id,
+      referencedSecurityGroupId: ctx.shared.get("job", "security-group-id"),
+      description: "Allow NFS traffic from this job",
+      ipProtocol: "tcp",
+      fromPort: 2049,
+      toPort: 2049,
+      tags
+    });
+    const fileSystem = new aws26.efs.FileSystem(group, "persistent-storage-file-system", {
+      encrypted: true,
+      performanceMode: "generalPurpose",
+      throughputMode: "elastic",
+      tags: {
+        ...tags,
+        Name: `${name}-storage`
+      }
+    });
+    for (const [index, subnetId] of ctx.shared.get("vpc", "public-subnets").entries()) {
+      const mountTarget = new aws26.efs.MountTarget(group, `mount-target-${index + 1}`, {
+        fileSystemId: fileSystem.id,
+        subnetId,
+        securityGroups: [persistentStorageSecurityGroup.id]
+      });
+      taskDependsOn.push(mountTarget);
+    }
+    const accessPoint2 = new aws26.efs.AccessPoint(group, "access-point", {
+      fileSystemId: fileSystem.id,
+      rootDirectory: {
+        path: `/jobs/${name}`,
+        creationInfo: {
+          ownerUid: 0,
+          ownerGid: 0,
+          permissions: "755"
+        }
+      },
+      tags
+    });
+    taskDependsOn.push(fileSystem, accessPoint2);
+    return {
+      accessPoint: accessPoint2,
+      fileSystem
+    };
+  })() : void 0;
   const task2 = new aws26.ecs.TaskDefinition(
     group,
     "task",
@@ -7440,13 +7515,495 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
         operatingSystemFamily: "LINUX"
       },
       trackLatest: true,
-      containerDefinitions: new Output6(variableDeps, async (resolve) => {
+      ...accessPoint && {
+        volume: [
+          {
+            name: "persistent-storage",
+            efsVolumeConfiguration: {
+              fileSystemId: accessPoint.fileSystem.id,
+              transitEncryption: "ENABLED",
+              authorizationConfig: {
+                accessPointId: accessPoint.accessPoint.id
+              }
+            }
+          }
+        ]
+      },
+      containerDefinitions: new Output6(variableDeps, async (resolve2) => {
         const data = await resolveInputs3(variables);
         const { s3Bucket, s3Key } = await resolveInputs3({
           s3Bucket: code.bucket,
           s3Key: code.key
         });
-        resolve(
+        resolve2(
+          JSON.stringify([
+            {
+              name: `container-${id}`,
+              essential: true,
+              image: image2,
+              workingDirectory: "/usr/app",
+              entryPoint: ["sh", "-c"],
+              command: [
+                [
+                  ...props.startupCommand?.length ? (() => {
+                    const setupHash = createHash4("sha1").update(props.startupCommand.join(" && ")).digest("hex").slice(0, 8);
+                    return [`if [ ! -f /root/.setup-done-${setupHash} ]; then ${props.startupCommand.join(" && ")} && touch /root/.setup-done-${setupHash}; fi`];
+                  })() : [],
+                  `if [ "$(cat /root/.code-hash 2>/dev/null)" != "$CODE_HASH" ]; then command -v aws >/dev/null 2>&1 || dnf install -y awscli && aws s3 cp s3://${s3Bucket}/${s3Key} /root/program.tmp && mv /root/program.tmp /root/program && chmod +x /root/program && echo "$CODE_HASH" > /root/.code-hash; fi`,
+                  `exec timeout --kill-after=10 ${toSeconds9(props.timeout)} /root/program`
+                ].join(" && ")
+              ],
+              environment: Object.entries(data).map(([name2, value]) => ({
+                name: name2,
+                value
+              })),
+              ...accessPoint && {
+                mountPoints: [
+                  {
+                    sourceVolume: "persistent-storage",
+                    containerPath: "/root"
+                  }
+                ]
+              },
+              ...logGroup && {
+                logConfiguration: {
+                  logDriver: "awslogs",
+                  options: {
+                    "awslogs-group": `/aws/ecs/${name}`,
+                    "awslogs-region": ctx.appConfig.region,
+                    "awslogs-stream-prefix": "ecs",
+                    mode: "non-blocking"
+                  }
+                }
+              }
+            }
+          ])
+        );
+      }),
+      tags
+    },
+    {
+      replaceOnChanges: [
+        "containerDefinitions",
+        "cpu",
+        "memory",
+        "runtimePlatform",
+        "executionRoleArn",
+        "taskRoleArn"
+      ],
+      dependsOn: taskDependsOn
+    }
+  );
+  ctx.onEnv((name2, value) => {
+    variables[name2] = value;
+    for (const dep of findInputDeps3([value])) {
+      variableDeps.add(dep);
+    }
+  });
+  variables.APP = ctx.appConfig.name;
+  variables.APP_ID = ctx.appId;
+  variables.AWS_ACCOUNT_ID = ctx.accountId;
+  variables.STACK = ctx.stackConfig.name;
+  variables.CODE_HASH = code.sourceHash;
+  variables.JOB_CONFIG_HASH = createHash4("sha1").update(stringify(props)).digest("hex");
+  if (props.environment) {
+    for (const [key, value] of Object.entries(props.environment)) {
+      variables[key] = value;
+    }
+  }
+  if (ctx.appConfig.defaults.job.permissions) {
+    statements.push(...ctx.appConfig.defaults.job.permissions);
+  }
+  if ("permissions" in local && local.permissions) {
+    statements.push(...local.permissions);
+  }
+  return { name, task: task2, policy, code, group };
+};
+
+// src/feature/job/index.ts
+var typeGenCode10 = `
+import type { Mock } from 'vitest'
+
+type Func = (...args: any[]) => any
+
+type Invoke<N extends string, F extends Func> = Parameters<F> extends []
+	? InvokeWithoutPayload<N, F>
+	: unknown extends Parameters<F>[0]
+		? InvokeWithoutPayload<N, F>
+		: InvokeWithPayload<N, F>
+
+type InvokeWithPayload<Name extends string, F extends Func> = {
+	readonly name: Name
+	(payload: Parameters<F>[0]): Promise<{ taskArn: string | undefined }>
+}
+
+type InvokeWithoutPayload<Name extends string, F extends Func> = {
+	readonly name: Name
+	(payload?: Parameters<F>[0]): Promise<{ taskArn: string | undefined }>
+}
+
+type MockHandle<F extends Func> = (payload: Parameters<F>[0]) => void | Promise<void>
+type MockBuilder<F extends Func> = (handle?: MockHandle<F>) => void
+type MockObject<F extends Func> = Mock<Parameters<F>, ReturnType<F>>
+`;
+var jobFeature = defineFeature({
+  name: "job",
+  async onTypeGen(ctx) {
+    const types2 = new TypeFile("awsless");
+    const resources2 = new TypeObject(1);
+    const mocks = new TypeObject(1);
+    const mockResponses = new TypeObject(1);
+    for (const stack of ctx.stackConfigs) {
+      const resource = new TypeObject(2);
+      const mock = new TypeObject(2);
+      const mockResponse = new TypeObject(2);
+      for (const [name, props] of Object.entries(stack.jobs || {})) {
+        const varName = camelCase8(`${stack.name}-${name}`);
+        const funcName = formatLocalResourceName({
+          appName: ctx.appConfig.name,
+          stackName: stack.name,
+          resourceType: "job",
+          resourceName: name
+        });
+        if ("file" in props.code) {
+          const relFile = relative8(directories.types, props.code.file);
+          types2.addImport(varName, relFile);
+          resource.addType(name, `Invoke<'${funcName}', typeof ${varName}>`);
+          mock.addType(name, `MockBuilder<typeof ${varName}>`);
+          mockResponse.addType(name, `MockObject<typeof ${varName}>`);
+        }
+      }
+      mocks.addType(stack.name, mock);
+      resources2.addType(stack.name, resource);
+      mockResponses.addType(stack.name, mockResponse);
+    }
+    types2.addCode(typeGenCode10);
+    types2.addInterface("JobResources", resources2);
+    types2.addInterface("JobMock", mocks);
+    types2.addInterface("JobMockResponse", mockResponses);
+    await ctx.write("job.d.ts", types2, true);
+  },
+  onBefore(ctx) {
+    const group = new Group26(ctx.base, "job", "asset");
+    const bucket = new aws27.s3.Bucket(group, "bucket", {
+      bucket: formatGlobalResourceName({
+        appName: ctx.app.name,
+        resourceType: "job",
+        resourceName: "assets",
+        postfix: ctx.appId
+      }),
+      forceDestroy: true,
+      lifecycleRule: [
+        {
+          id: "expire-payloads",
+          enabled: true,
+          prefix: "payloads/",
+          expiration: { days: 1 }
+        }
+      ]
+    });
+    ctx.shared.set("job", "bucket-name", bucket.bucket);
+  },
+  onApp(ctx) {
+    const found = ctx.stackConfigs.filter((stack) => {
+      return Object.keys(stack.jobs ?? {}).length > 0;
+    });
+    if (found.length === 0) {
+      return;
+    }
+    const group = new Group26(ctx.base, "job", "cluster");
+    const cluster = new aws27.ecs.Cluster(
+      group,
+      "cluster",
+      {
+        name: `${ctx.app.name}-job`
+      },
+      {
+        replaceOnChanges: ["name"]
+      }
+    );
+    ctx.shared.set("job", "cluster-name", cluster.name);
+    ctx.shared.set("job", "cluster-arn", cluster.arn);
+    const securityGroup = new aws27.security.Group(group, "security-group", {
+      name: `${ctx.app.name}-job`,
+      description: "Shared security group for jobs",
+      vpcId: ctx.shared.get("vpc", "id"),
+      revokeRulesOnDelete: true,
+      tags: {
+        APP: ctx.appConfig.name
+      }
+    });
+    new aws27.vpc.SecurityGroupEgressRule(group, "egress-rule", {
+      securityGroupId: securityGroup.id,
+      description: "Allow all outbound traffic from jobs",
+      ipProtocol: "-1",
+      cidrIpv4: "0.0.0.0/0",
+      tags: {
+        APP: ctx.appConfig.name
+      }
+    });
+    ctx.shared.set("job", "security-group-id", securityGroup.id);
+  },
+  onStack(ctx) {
+    const subnets = ctx.shared.get("vpc", "public-subnets");
+    ctx.addEnv(
+      "JOB_SUBNETS",
+      new Output7(new Set(findInputDeps4(subnets)), async (resolve2) => {
+        const resolved = await resolveInputs4(subnets);
+        resolve2(JSON.stringify(resolved));
+      })
+    );
+    ctx.addEnv("JOB_SECURITY_GROUP", ctx.shared.get("job", "security-group-id"));
+    ctx.addEnv("JOB_PAYLOAD_BUCKET", ctx.shared.get("job", "bucket-name"));
+    const jobs = Object.entries(ctx.stackConfig.jobs ?? {});
+    if (jobs.length === 0) return;
+    for (const [id, props] of jobs) {
+      const group = new Group26(ctx.stack, "job", id);
+      createFargateJob(group, ctx, "job", id, props);
+    }
+    ctx.addStackPermission({
+      actions: ["ecs:RunTask"],
+      resources: [
+        `arn:aws:ecs:${ctx.appConfig.region}:*:task-definition/${ctx.app.name}--${ctx.stackConfig.name}--*`
+      ]
+    });
+    ctx.addStackPermission({
+      actions: ["iam:PassRole"],
+      resources: ["*"],
+      conditions: {
+        StringEquals: {
+          "iam:PassedToService": "ecs-tasks.amazonaws.com"
+        }
+      }
+    });
+    ctx.addStackPermission({
+      actions: ["s3:PutObject"],
+      resources: [
+        `arn:aws:s3:::${formatGlobalResourceName({
+          appName: ctx.app.name,
+          resourceType: "job",
+          resourceName: "assets",
+          postfix: ctx.appId
+        })}/payloads/*`
+      ]
+    });
+  }
+});
+
+// src/feature/instance/index.ts
+import { Group as Group28 } from "@terraforge/core";
+import { aws as aws29 } from "@terraforge/aws";
+
+// src/feature/instance/util.ts
+import { toDays as toDays10, toSeconds as toSeconds10 } from "@awsless/duration";
+import { stringify as stringify2 } from "@awsless/json";
+import { toMebibytes as toMebibytes6 } from "@awsless/size";
+import { generateFileHash as generateFileHash3 } from "@awsless/ts-file-cache";
+import { aws as aws28 } from "@terraforge/aws";
+import { Group as Group27, Output as Output8, findInputDeps as findInputDeps5, resolveInputs as resolveInputs5 } from "@terraforge/core";
+import { constantCase as constantCase13, pascalCase as pascalCase4 } from "change-case";
+import { createHash as createHash6 } from "crypto";
+import deepmerge5 from "deepmerge";
+import { join as join19 } from "path";
+
+// src/feature/instance/build/executable.ts
+import { createHash as createHash5 } from "crypto";
+import { readFile as readFile5 } from "fs/promises";
+import { join as join18 } from "path";
+var buildExecutable = async (input, outputPath, architecture) => {
+  const filePath = join18(outputPath, "program");
+  const target = architecture === "x86_64" ? "bun-linux-x64" : "bun-linux-arm64";
+  let result;
+  try {
+    result = await Bun.build({
+      entrypoints: [input],
+      compile: {
+        target,
+        outfile: filePath
+      },
+      target: "bun"
+    });
+  } catch (error) {
+    throw new ExpectedError(
+      `Executable build failed: ${error instanceof Error ? error.message : JSON.stringify(error)}`
+    );
+  }
+  if (!result.success) {
+    throw new ExpectedError(`Executable build failed:
+${result.logs?.map((log35) => log35.message).join("\n")}`);
+  }
+  const file = await readFile5(filePath);
+  return {
+    hash: createHash5("sha1").update(file).update("x86_64").digest("hex"),
+    file
+  };
+};
+
+// src/feature/instance/util.ts
+var createFargateTask = (parentGroup, ctx, ns, id, local) => {
+  const group = new Group27(parentGroup, "instance", ns);
+  const name = formatLocalResourceName({
+    appName: ctx.app.name,
+    stackName: ctx.stack.name,
+    resourceType: ns,
+    resourceName: id
+  });
+  const shortName = shortId(`${ctx.app.name}:${ctx.stack.name}:${ns}:${id}:${ctx.appId}`);
+  const props = deepmerge5(ctx.appConfig.defaults.instance, local);
+  const image2 = props.image || (props.architecture === "arm64" ? "public.ecr.aws/aws-cli/aws-cli:arm64" : "public.ecr.aws/aws-cli/aws-cli:amd64");
+  ctx.registerBuild("instance", name, async (build3, { workspace }) => {
+    const fingerprint = await generateFileHash3(workspace, local.code.file);
+    return build3(fingerprint, async (write) => {
+      const temp = await createTempFolder(`instance--${name}`);
+      const executable = await buildExecutable(local.code.file, temp.path, props.architecture);
+      await Promise.all([
+        //
+        write("HASH", executable.hash),
+        write("program", executable.file),
+        temp.delete()
+      ]);
+      return {
+        size: formatByteSize(executable.file.byteLength)
+      };
+    });
+  });
+  const code = new aws28.s3.BucketObject(group, "code", {
+    bucket: ctx.shared.get("instance", "bucket-name"),
+    key: name,
+    source: relativePath(getBuildPath("instance", name, "program")),
+    sourceHash: $file(getBuildPath("instance", name, "HASH"))
+  });
+  const executionRole = new aws28.iam.Role(group, "execution-role", {
+    name: shortId(`${shortName}:execution-role`),
+    description: name,
+    assumeRolePolicy: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Action: "sts:AssumeRole",
+          Principal: {
+            Service: ["ecs-tasks.amazonaws.com"]
+          }
+        }
+      ]
+    }),
+    managedPolicyArns: ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
+  });
+  const role = new aws28.iam.Role(
+    group,
+    "task-role",
+    {
+      name: shortId(`${shortName}:task-role`),
+      description: name,
+      assumeRolePolicy: JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Action: "sts:AssumeRole",
+            Principal: {
+              Service: ["ecs-tasks.amazonaws.com"]
+            }
+          }
+        ]
+      }),
+      inlinePolicy: [
+        {
+          name: "s3-code-access",
+          policy: $resolve([code.bucket, code.key], (bucket, key) => {
+            return JSON.stringify({
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: pascalCase4("allow"),
+                  Action: ["s3:getObject", "s3:HeadObject"],
+                  Resource: `arn:aws:s3:::${bucket}/${key}`
+                }
+              ]
+            });
+          })
+        }
+      ]
+    },
+    {
+      dependsOn: [code]
+    }
+  );
+  const statements = [];
+  const statementDeps = /* @__PURE__ */ new Set();
+  const policy = new aws28.iam.RolePolicy(group, "policy", {
+    role: role.name,
+    name: "task-policy",
+    policy: new Output8(statementDeps, async (resolve2) => {
+      const list3 = await resolveInputs5(statements);
+      resolve2(
+        JSON.stringify({
+          Version: "2012-10-17",
+          Statement: list3.map((statement) => ({
+            Effect: pascalCase4(statement.effect ?? "allow"),
+            Action: statement.actions,
+            Resource: statement.resources
+          }))
+        })
+      );
+    })
+  });
+  const addPermission = (...permissions) => {
+    statements.push(...permissions);
+    for (const dep of findInputDeps5(permissions)) {
+      statementDeps.add(dep);
+    }
+  };
+  ctx.onPermission((statement) => {
+    addPermission(statement);
+  });
+  let logGroup;
+  if (props.log.retention && props.log.retention.value > 0n) {
+    logGroup = new aws28.cloudwatch.LogGroup(group, "log", {
+      name: `/aws/ecs/${name}`,
+      // name: `/aws/lambda/${name}`,
+      retentionInDays: toDays10(props.log.retention)
+    });
+    if (ctx.shared.has("on-error-log", "subscriber-arn")) {
+      new aws28.cloudwatch.LogSubscriptionFilter(group, "on-error-log", {
+        name: "error-log-subscription",
+        destinationArn: ctx.shared.get("on-error-log", "subscriber-arn"),
+        logGroupName: logGroup.name,
+        filterPattern
+      });
+    }
+  }
+  const tags = {
+    APP: ctx.appConfig.name,
+    APP_ID: ctx.appId,
+    STACK: ctx.stackConfig.name
+  };
+  const variables = {};
+  const variableDeps = /* @__PURE__ */ new Set();
+  const task2 = new aws28.ecs.TaskDefinition(
+    group,
+    "task",
+    {
+      family: name,
+      networkMode: "awsvpc",
+      cpu: props.cpu,
+      memory: toMebibytes6(props.memorySize).toString(),
+      requiresCompatibilities: ["FARGATE"],
+      executionRoleArn: executionRole.arn,
+      taskRoleArn: role.arn,
+      runtimePlatform: {
+        cpuArchitecture: constantCase13(props.architecture),
+        operatingSystemFamily: "LINUX"
+      },
+      trackLatest: true,
+      containerDefinitions: new Output8(variableDeps, async (resolve2) => {
+        const data = await resolveInputs5(variables);
+        const { s3Bucket, s3Key } = await resolveInputs5({
+          s3Bucket: code.bucket,
+          s3Key: code.key
+        });
+        resolve2(
           JSON.stringify([
             {
               name: `container-${id}`,
@@ -7497,12 +8054,12 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
               healthCheck: props.healthCheck ? {
                 command: [
                   "CMD-SHELL",
-                  `curl -f http://${join18("localhost", props.healthCheck.path)} || exit 1`
+                  `curl -f http://${join19("localhost", props.healthCheck.path)} || exit 1`
                 ],
-                interval: toSeconds9(props.healthCheck.interval),
+                interval: toSeconds10(props.healthCheck.interval),
                 retries: props.healthCheck.retries,
-                startPeriod: toSeconds9(props.healthCheck.startPeriod),
-                timeout: toSeconds9(props.healthCheck.timeout)
+                startPeriod: toSeconds10(props.healthCheck.startPeriod),
+                timeout: toSeconds10(props.healthCheck.timeout)
               } : void 0
             }
           ])
@@ -7522,14 +8079,14 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
       dependsOn: [code]
     }
   );
-  const securityGroup = new aws26.security.Group(group, "security-group", {
+  const securityGroup = new aws28.security.Group(group, "security-group", {
     name,
     description: "Security group for the instance",
     vpcId: ctx.shared.get("vpc", "id"),
     revokeRulesOnDelete: true,
     tags
   });
-  new aws26.vpc.SecurityGroupEgressRule(group, "egress-rule", {
+  new aws28.vpc.SecurityGroupEgressRule(group, "egress-rule", {
     securityGroupId: securityGroup.id,
     description: `Allow all outbound traffic from the ${name} instance`,
     ipProtocol: "-1",
@@ -7538,7 +8095,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   });
   const clusterName = ctx.shared.get("instance", "cluster-name");
   const clusterArn = ctx.shared.get("instance", "cluster-arn");
-  const service = new aws26.ecs.Service(
+  const service = new aws28.ecs.Service(
     group,
     "service",
     {
@@ -7574,7 +8131,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
       replaceOnChanges: ["cluster"]
     }
   );
-  new aws26.appautoscaling.Target(
+  new aws28.appautoscaling.Target(
     group,
     "autoscaling-target",
     {
@@ -7593,7 +8150,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   );
   ctx.onEnv((name2, value) => {
     variables[name2] = value;
-    for (const dep of findInputDeps3([value])) {
+    for (const dep of findInputDeps5([value])) {
       variableDeps.add(dep);
     }
   });
@@ -7602,7 +8159,7 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
   variables.AWS_ACCOUNT_ID = ctx.accountId;
   variables.STACK = ctx.stackConfig.name;
   variables.CODE_HASH = code.sourceHash;
-  variables.INSTANCE_CONFIG_HASH = createHash4("sha1").update(stringify(props)).digest("hex");
+  variables.INSTANCE_CONFIG_HASH = createHash6("sha1").update(stringify2(props)).digest("hex");
   if (props.environment) {
     for (const [key, value] of Object.entries(props.environment)) {
       variables[key] = value;
@@ -7621,8 +8178,8 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
 var instanceFeature = defineFeature({
   name: "instance",
   onBefore(ctx) {
-    const group = new Group26(ctx.base, "instance", "asset");
-    const bucket = new aws27.s3.Bucket(group, "bucket", {
+    const group = new Group28(ctx.base, "instance", "asset");
+    const bucket = new aws29.s3.Bucket(group, "bucket", {
       bucket: formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "instance",
@@ -7640,8 +8197,8 @@ var instanceFeature = defineFeature({
     if (found.length === 0) {
       return;
     }
-    const group = new Group26(ctx.base, "instance", "cluster");
-    const cluster = new aws27.ecs.Cluster(
+    const group = new Group28(ctx.base, "instance", "cluster");
+    const cluster = new aws29.ecs.Cluster(
       group,
       "cluster",
       {
@@ -7656,18 +8213,18 @@ var instanceFeature = defineFeature({
   },
   onStack(ctx) {
     for (const [id, props] of Object.entries(ctx.stackConfig.instances ?? {})) {
-      const group = new Group26(ctx.stack, "instance", id);
+      const group = new Group28(ctx.stack, "instance", id);
       createFargateTask(group, ctx, "instance", id, props);
     }
   }
 });
 
 // src/feature/metric/index.ts
-import { Group as Group27 } from "@terraforge/core";
-import { aws as aws28 } from "@terraforge/aws";
-import { kebabCase as kebabCase8, constantCase as constantCase13 } from "change-case";
-import { toSeconds as toSeconds10 } from "@awsless/duration";
-var typeGenCode10 = `
+import { Group as Group29 } from "@terraforge/core";
+import { aws as aws30 } from "@terraforge/aws";
+import { kebabCase as kebabCase8, constantCase as constantCase14 } from "change-case";
+import { toSeconds as toSeconds11 } from "@awsless/duration";
+var typeGenCode11 = `
 import { type PutDataProps, putData, batchPutData } from '@awsless/cloudwatch'
 import { type Duration } from '@awsless/duration'
 import { type Size } from '@awsless/size'
@@ -7715,7 +8272,7 @@ var metricFeature = defineFeature({
       resources2.addType(stack.name, stackResources);
     }
     resources2.addType("batch", "Batch");
-    gen.addCode(typeGenCode10);
+    gen.addCode(typeGenCode11);
     gen.addInterface("MetricResources", resources2);
     await ctx.write("metric.d.ts", gen, true);
   },
@@ -7732,16 +8289,16 @@ var metricFeature = defineFeature({
       }
     });
     for (const [id, props] of Object.entries(ctx.stackConfig.metrics ?? {})) {
-      const group = new Group27(ctx.stack, "metric", id);
-      ctx.addEnv(`METRIC_${constantCase13(id)}`, props.type);
+      const group = new Group29(ctx.stack, "metric", id);
+      ctx.addEnv(`METRIC_${constantCase14(id)}`, props.type);
       for (const alarmId in props.alarms ?? []) {
-        const alarmGroup = new Group27(group, "alarm", alarmId);
+        const alarmGroup = new Group29(group, "alarm", alarmId);
         const alarmName = kebabCase8(`${id}-${alarmId}`);
         const alarmProps = props.alarms[alarmId];
         let alarmAction;
         let alarmLambda;
         if (Array.isArray(alarmProps.trigger)) {
-          const topic = new aws28.sns.Topic(alarmGroup, "alarm-trigger", {
+          const topic = new aws30.sns.Topic(alarmGroup, "alarm-trigger", {
             name: formatLocalResourceName({
               appName: ctx.app.name,
               stackName: ctx.stack.name,
@@ -7751,7 +8308,7 @@ var metricFeature = defineFeature({
           });
           alarmAction = topic.arn;
           for (const email of alarmProps.trigger) {
-            new aws28.sns.TopicSubscription(alarmGroup, email, {
+            new aws30.sns.TopicSubscription(alarmGroup, email, {
               topicArn: topic.arn,
               protocol: "email",
               endpoint: email
@@ -7762,7 +8319,7 @@ var metricFeature = defineFeature({
           alarmLambda = lambda;
           alarmAction = lambda.arn;
         }
-        const alarm = new aws28.cloudwatch.MetricAlarm(alarmGroup, "alarm", {
+        const alarm = new aws30.cloudwatch.MetricAlarm(alarmGroup, "alarm", {
           namespace,
           metricName: kebabCase8(id),
           alarmName: formatLocalResourceName({
@@ -7774,13 +8331,13 @@ var metricFeature = defineFeature({
           alarmDescription: alarmProps.description,
           statistic: alarmProps.where.stat,
           threshold: alarmProps.where.value,
-          period: toSeconds10(alarmProps.period),
+          period: toSeconds11(alarmProps.period),
           evaluationPeriods: alarmProps.minDataPoints,
           comparisonOperator: alarmProps.where.op,
           alarmActions: [alarmAction]
         });
         if (alarmLambda) {
-          new aws28.lambda.Permission(alarmGroup, "permission", {
+          new aws30.lambda.Permission(alarmGroup, "permission", {
             action: "lambda:InvokeFunction",
             principal: "lambda.alarms.cloudwatch.amazonaws.com",
             functionName: alarmLambda.functionName,
@@ -7793,10 +8350,10 @@ var metricFeature = defineFeature({
 });
 
 // src/feature/router/index.ts
-import { days as days9, seconds as seconds10, toSeconds as toSeconds11, years } from "@awsless/duration";
-import { Future, Group as Group28 } from "@terraforge/core";
-import { aws as aws29 } from "@terraforge/aws";
-import { camelCase as camelCase8, constantCase as constantCase14 } from "change-case";
+import { days as days9, seconds as seconds10, toSeconds as toSeconds12, years } from "@awsless/duration";
+import { Future, Group as Group30 } from "@terraforge/core";
+import { aws as aws31 } from "@terraforge/aws";
+import { camelCase as camelCase9, constantCase as constantCase15 } from "change-case";
 
 // src/feature/router/router-code.ts
 var getViewerRequestFunctionCode = (props) => {
@@ -8044,18 +8601,18 @@ async function handler(event) {
 `;
 
 // src/feature/router/index.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 var routerFeature = defineFeature({
   name: "router",
   onApp(ctx) {
     for (const [id, props] of Object.entries(ctx.appConfig.defaults.router ?? {})) {
-      const group = new Group28(ctx.base, "router", id);
+      const group = new Group30(ctx.base, "router", id);
       const name = formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "router",
         resourceName: id
       });
-      const routeStore = new aws29.cloudfront.KeyValueStore(group, "routes", {
+      const routeStore = new aws31.cloudfront.KeyValueStore(group, "routes", {
         name,
         comment: "Store for routes"
       });
@@ -8085,11 +8642,11 @@ var routerFeature = defineFeature({
         );
         importedRoutes.push(importKeys);
       });
-      const cache = new aws29.cloudfront.CachePolicy(group, "cache", {
+      const cache = new aws31.cloudfront.CachePolicy(group, "cache", {
         name,
-        minTtl: toSeconds11(seconds10(0)),
-        maxTtl: toSeconds11(days9(365)),
-        defaultTtl: toSeconds11(days9(0)),
+        minTtl: toSeconds12(seconds10(0)),
+        maxTtl: toSeconds12(days9(365)),
+        defaultTtl: toSeconds12(days9(0)),
         parametersInCacheKeyAndForwardedToOrigin: {
           enableAcceptEncodingBrotli: true,
           enableAcceptEncodingGzip: true,
@@ -8117,10 +8674,10 @@ var routerFeature = defineFeature({
           }
         }
       });
-      const originRequest = new aws29.cloudfront.OriginRequestPolicy(group, "request", {
+      const originRequest = new aws31.cloudfront.OriginRequestPolicy(group, "request", {
         name,
         headersConfig: {
-          headerBehavior: camelCase8("all-except"),
+          headerBehavior: camelCase9("all-except"),
           headers: {
             items: [
               "host"
@@ -8135,11 +8692,11 @@ var routerFeature = defineFeature({
           queryStringBehavior: "all"
         }
       });
-      const responseHeaders = new aws29.cloudfront.ResponseHeadersPolicy(group, "response", {
+      const responseHeaders = new aws31.cloudfront.ResponseHeadersPolicy(group, "response", {
         name,
         corsConfig: {
           originOverride: props.cors?.override ?? true,
-          accessControlMaxAgeSec: toSeconds11(props.cors?.maxAge ?? years(1)),
+          accessControlMaxAgeSec: toSeconds12(props.cors?.maxAge ?? years(1)),
           accessControlAllowHeaders: { items: props.cors?.headers ?? ["*"] },
           accessControlAllowMethods: { items: props.cors?.methods ?? ["ALL"] },
           accessControlAllowOrigins: { items: props.cors?.origins ?? ["*"] },
@@ -8164,7 +8721,7 @@ var routerFeature = defineFeature({
           strictTransportSecurity: {
             override: true,
             preload: true,
-            accessControlMaxAgeSec: toSeconds11(years(1)),
+            accessControlMaxAgeSec: toSeconds12(years(1)),
             includeSubdomains: true
           },
           xssProtection: {
@@ -8174,7 +8731,7 @@ var routerFeature = defineFeature({
           }
         }
       });
-      const viewerRequest = new aws29.cloudfront.Function(group, "viewer-request", {
+      const viewerRequest = new aws31.cloudfront.Function(group, "viewer-request", {
         name,
         runtime: `cloudfront-js-2.0`,
         comment: `Viewer Request - ${name}`,
@@ -8196,7 +8753,7 @@ var routerFeature = defineFeature({
             rateBasedStatement: {
               limit: wafSettingsConfig.rateLimiter.limit,
               aggregateKeyType: "IP",
-              evaluationWindowSec: toSeconds11(wafSettingsConfig.rateLimiter.window)
+              evaluationWindowSec: toSeconds12(wafSettingsConfig.rateLimiter.window)
             }
           },
           action: {
@@ -8276,7 +8833,7 @@ var routerFeature = defineFeature({
       }
       let waf;
       if (wafRules.length && wafSettingsConfig) {
-        waf = new aws29.wafv2.WebAcl(group, "waf", {
+        waf = new aws31.wafv2.WebAcl(group, "waf", {
           name: `${name}-wafv2`,
           scope: "CLOUDFRONT",
           defaultAction: {
@@ -8286,12 +8843,12 @@ var routerFeature = defineFeature({
           rule: wafRules,
           captchaConfig: {
             immunityTimeProperty: {
-              immunityTime: toSeconds11(wafSettingsConfig.captchaImmunityTime)
+              immunityTime: toSeconds12(wafSettingsConfig.captchaImmunityTime)
             }
           },
           challengeConfig: {
             immunityTimeProperty: {
-              immunityTime: toSeconds11(wafSettingsConfig.challengeImmunityTime)
+              immunityTime: toSeconds12(wafSettingsConfig.challengeImmunityTime)
             }
           },
           visibilityConfig: {
@@ -8301,7 +8858,7 @@ var routerFeature = defineFeature({
           }
         });
       }
-      const distribution = new aws29.cloudfront.MultitenantDistribution(group, "distribution", {
+      const distribution = new aws31.cloudfront.MultitenantDistribution(group, "distribution", {
         tags: {
           name
         },
@@ -8347,7 +8904,7 @@ var routerFeature = defineFeature({
           }
           return {
             errorCode: Number(errorCode),
-            errorCachingMinTtl: item.minTTL ? toSeconds11(item.minTTL) : void 0,
+            errorCachingMinTtl: item.minTTL ? toSeconds12(item.minTTL) : void 0,
             responseCode: item.statusCode?.toString() ?? errorCode,
             responsePagePath: item.path
           };
@@ -8395,11 +8952,11 @@ var routerFeature = defineFeature({
             {
               distributionId: distribution.id,
               paths,
-              version: new Future((resolve) => {
+              version: new Future((resolve2) => {
                 $combine(...versions).then((versions2) => {
                   const combined = versions2.filter((v) => !!v).sort().join(",");
-                  const version = createHash5("sha1").update(combined).digest("hex");
-                  resolve(version);
+                  const version = createHash7("sha1").update(combined).digest("hex");
+                  resolve2(version);
                 });
               })
             },
@@ -8413,10 +8970,10 @@ var routerFeature = defineFeature({
         const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
         const certificateArn = ctx.shared.entry("domain", `global-certificate-arn`, props.domain);
         const zoneId = ctx.shared.entry("domain", "zone-id", props.domain);
-        const connectionGroup = new aws29.cloudfront.ConnectionGroup(group, "connection-group", {
+        const connectionGroup = new aws31.cloudfront.ConnectionGroup(group, "connection-group", {
           name
         });
-        new aws29.cloudfront.DistributionTenant(group, `tenant`, {
+        new aws31.cloudfront.DistributionTenant(group, `tenant`, {
           name,
           enabled: true,
           distributionId: distribution.id,
@@ -8424,7 +8981,7 @@ var routerFeature = defineFeature({
           domain: [{ domain: domainName }],
           customizations: [{ certificate: [{ arn: certificateArn }] }]
         });
-        new aws29.route53.Record(group, `record`, {
+        new aws31.route53.Record(group, `record`, {
           zoneId,
           type: "A",
           name: domainName,
@@ -8434,7 +8991,7 @@ var routerFeature = defineFeature({
             evaluateTargetHealth: false
           }
         });
-        ctx.bind(`ROUTER_${constantCase14(id)}_ENDPOINT`, domainName);
+        ctx.bind(`ROUTER_${constantCase15(id)}_ENDPOINT`, domainName);
       }
     }
   }
@@ -8457,7 +9014,7 @@ var features = [
   // 5
   functionFeature,
   instanceFeature,
-  // jobFeature,
+  jobFeature,
   // graphqlFeature,
   configFeature,
   searchFeature,
@@ -9546,14 +10103,14 @@ import wildstring4 from "wildstring";
 
 // src/cli/ui/complex/run-tests.ts
 import { log as log18 } from "@awsless/clui";
-import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile3 } from "fs/promises";
-import { join as join20 } from "path";
+import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
+import { join as join21 } from "path";
 import wildstring3 from "wildstring";
-import { parse as parse4, stringify as stringify2 } from "@awsless/json";
+import { parse as parse4, stringify as stringify3 } from "@awsless/json";
 import { generateFolderHash, loadWorkspace as loadWorkspace2 } from "@awsless/ts-file-cache";
 
 // src/test/start.ts
-import { dirname as dirname9, join as join19 } from "path";
+import { dirname as dirname9, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { configDefaults } from "vitest/config";
 import { startVitest } from "vitest/node";
@@ -9591,7 +10148,7 @@ var startTest = async (props) => {
       // },
       setupFiles: [
         //
-        join19(__dirname5, "test-global-setup.js")
+        join20(__dirname5, "test-global-setup.js")
       ]
       // globalSetup: [
       // 	//
@@ -9785,12 +10342,12 @@ var logTestErrors = (event) => {
 };
 var runTest = async (stack, dir, filters, workspace, opts) => {
   await mkdir4(directories.test, { recursive: true });
-  const file = join20(directories.test, `${stack}.json`);
+  const file = join21(directories.test, `${stack}.json`);
   const fingerprint = await generateFolderHash(workspace, dir);
   if (!process.env.NO_CACHE) {
     const exists = await fileExist(file);
     if (exists) {
-      const raw = await readFile5(file, { encoding: "utf8" });
+      const raw = await readFile6(file, { encoding: "utf8" });
       const data = parse4(raw);
       if (data.fingerprint === fingerprint) {
         log18.step(
@@ -9833,9 +10390,9 @@ var runTest = async (stack, dir, filters, workspace, opts) => {
     logTestLogs(result);
   }
   logTestErrors(result);
-  await writeFile3(
+  await writeFile4(
     file,
-    stringify2({
+    stringify3({
       ...result,
       fingerprint
     })
@@ -10373,7 +10930,7 @@ var auth = (program2) => {
 // src/cli/command/bind.ts
 import { log as log24 } from "@awsless/clui";
 import chalk4 from "chalk";
-import { constantCase as constantCase15 } from "change-case";
+import { constantCase as constantCase16 } from "change-case";
 var bind = (program2) => {
   program2.command("bind").argument("[command...]", "The command to execute").option("--config <string...>", "List of config values that will be accessable", (v) => v.split(",")).description(`Bind your site environment variables to a command`).action(async (commands11 = [], opts) => {
     await layout("bind", async ({ appConfig, stackConfigs }) => {
@@ -10400,10 +10957,10 @@ var bind = (program2) => {
       const configList = opts.config ?? [];
       const configs = {};
       for (const name of configList) {
-        configs[`CONFIG_${constantCase15(name)}`] = name;
+        configs[`CONFIG_${constantCase16(name)}`] = name;
       }
       if (configList.length ?? 0 > 0) {
-        log24.note("Bind Config", configList.map((v) => color.label(constantCase15(v))).join("\n"));
+        log24.note("Bind Config", configList.map((v) => color.label(constantCase16(v))).join("\n"));
       }
       if (commands11.length === 0) {
         return "No command to execute.";
@@ -10442,7 +10999,7 @@ var bind = (program2) => {
 
 // src/config/load/watch.ts
 import { watch } from "chokidar";
-var watchConfig = async (options, resolve, reject) => {
+var watchConfig = async (options, resolve2, reject) => {
   await loadAppConfig(options);
   debug("Start watching...");
   const ext = "{json,jsonc,json5}";
@@ -10457,7 +11014,7 @@ var watchConfig = async (options, resolve, reject) => {
       const appConfig = await loadAppConfig(options);
       const stackConfigs = await loadStackConfigs(options);
       validateFeatures({ appConfig, stackConfigs });
-      resolve({ appConfig, stackConfigs });
+      resolve2({ appConfig, stackConfigs });
     } catch (error) {
       reject(error);
     }
@@ -10469,8 +11026,8 @@ var watchConfig = async (options, resolve, reject) => {
 import { log as log25 } from "@awsless/clui";
 
 // src/type-gen/generate.ts
-import { mkdir as mkdir5, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname10, join as join21, relative as relative8 } from "path";
+import { mkdir as mkdir5, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname10, join as join22, relative as relative9 } from "path";
 var generateTypes = async (props) => {
   const files = [];
   await Promise.all(
@@ -10479,13 +11036,13 @@ var generateTypes = async (props) => {
         ...props,
         async write(file, data, include = false) {
           const code = data?.toString("utf8");
-          const path = join21(directories.types, file);
+          const path = join22(directories.types, file);
           if (code) {
             if (include) {
-              files.push(relative8(directories.root, path));
+              files.push(relative9(directories.root, path));
             }
             await mkdir5(dirname10(path), { recursive: true });
-            await writeFile4(path, code);
+            await writeFile5(path, code);
           }
         }
       });
@@ -10493,7 +11050,7 @@ var generateTypes = async (props) => {
   );
   if (files.length) {
     const code = files.map((file) => `/// <reference path='${file}' />`).join("\n");
-    await writeFile4(join21(directories.root, `awsless.d.ts`), code);
+    await writeFile5(join22(directories.root, `awsless.d.ts`), code);
   }
 };
 
@@ -10517,9 +11074,9 @@ var dev = (program2) => {
           logError(error);
         }
       );
-      await new Promise((resolve) => {
-        process.once("exit", resolve);
-        process.once("SIGINT", resolve);
+      await new Promise((resolve2) => {
+        process.once("exit", resolve2);
+        process.once("SIGINT", resolve2);
       });
     });
   });
@@ -10919,7 +11476,7 @@ var domain = (program2) => {
 // src/cli/command/logs.ts
 import { CloudWatchLogsClient, StartLiveTailCommand } from "@aws-sdk/client-cloudwatch-logs";
 import { log as log30 } from "@awsless/clui";
-import { aws as aws30 } from "@terraforge/aws";
+import { aws as aws32 } from "@terraforge/aws";
 import chalk6 from "chalk";
 import chunk2 from "chunk";
 import { formatDate } from "date-fns";
@@ -10942,7 +11499,7 @@ var logs = (program2) => {
       for (const stack of app.stacks) {
         if (filters.find((f) => wildstring7.match(f, stack.name))) {
           for (const resource of stack.resources) {
-            if (resource instanceof aws30.cloudwatch.LogGroup) {
+            if (resource instanceof aws32.cloudwatch.LogGroup) {
               logGroupArns.push(await resource.arn);
             }
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awsless/cli",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "license": "MIT",
   "type": "module",
   "sideEffects": false,
@@ -87,23 +87,23 @@
     "zod": "^3.24.2",
     "zod-to-json-schema": "^3.24.3",
     "@awsless/big-float": "^0.1.6",
-    "@awsless/clui": "^0.0.8",
     "@awsless/cloudwatch": "^0.0.1",
-    "@awsless/json": "^0.0.11",
+    "@awsless/clui": "^0.0.8",
     "@awsless/duration": "^0.0.4",
-    "@awsless/iot": "^0.0.5",
-    "@awsless/lambda": "^0.0.42",
     "@awsless/dynamodb": "^0.3.20",
+    "@awsless/iot": "^0.0.5",
+    "@awsless/json": "^0.0.11",
     "@awsless/s3": "^0.0.21",
-    "@awsless/redis": "^0.0.16",
+    "@awsless/scheduler": "^0.0.4",
     "@awsless/size": "^0.0.2",
+    "@awsless/lambda": "^0.0.42",
     "@awsless/sns": "^0.0.10",
-    "@awsless/ts-file-cache": "^0.0.12",
-    "@awsless/validate": "^0.1.7",
-    "awsless": "^0.0.3",
+    "@awsless/redis": "^0.0.16",
     "@awsless/weak-cache": "^0.0.1",
+    "awsless": "^0.0.3",
+    "@awsless/ts-file-cache": "^0.0.12",
     "@awsless/sqs": "^0.0.21",
-    "@awsless/scheduler": "^0.0.4"
+    "@awsless/validate": "^0.1.7"
   },
   "devDependencies": {
     "@hono/node-server": "1.19.9",