@continuous-excellence/ze-great-dashboard-aws 0.13.7 → 0.14.0

package/dist/cli.js

@@ -11,136 +11,495 @@ import { readFile as readFile4 } from "node:fs/promises";
 import { promisify as promisify2 } from "node:util";
 import { parse as parse2 } from "yaml";
 
-// packages/aws/src/index.ts
-import { execFile } from "node:child_process";
-import { cp, mkdir as mkdir2, readFile as readFile3, rm, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join2, resolve as resolve2 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { promisify } from "node:util";
+// packages/aws/src/bootstrap.ts
+import { readFile as readFile2 } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
 
-// node_modules/fflate/esm/index.mjs
-import { createRequire } from "module";
-var require2 = createRequire("/");
-var _a;
-var Worker;
-var isMarkedAsUntransferable;
-try {
-  _a = require2("worker_threads"), Worker = _a.Worker, isMarkedAsUntransferable = _a.isMarkedAsUntransferable;
-} catch (e) {
+// packages/aws/src/compute-mode.ts
+function valid(value2, label) {
+  if (value2 !== "lambda" && value2 !== "ecs")
+    throw new Error(`${label} must be lambda or ecs (received ${value2})`);
+  return value2;
 }
-var u8 = Uint8Array;
-var u16 = Uint16Array;
-var i32 = Int32Array;
-var fleb = new u8([
-  0,
-  0,
-  0,
-  0,
-  0,
-  0,
-  0,
-  0,
-  1,
-  1,
-  1,
-  1,
-  2,
-  2,
-  2,
-  2,
-  3,
-  3,
-  3,
-  3,
-  4,
-  4,
-  4,
-  4,
-  5,
-  5,
-  5,
-  5,
-  0,
-  /* unused */
-  0,
-  0,
-  /* impossible */
-  0
-]);
-var fdeb = new u8([
-  0,
-  0,
-  0,
-  0,
-  1,
-  1,
-  2,
-  2,
-  3,
-  3,
-  4,
-  4,
-  5,
-  5,
-  6,
-  6,
-  7,
-  7,
-  8,
-  8,
-  9,
-  9,
-  10,
-  10,
-  11,
-  11,
-  12,
-  12,
-  13,
-  13,
-  /* unused */
-  0,
-  0
+function resolveComputeMode(input = {}) {
+  const persisted = input.persisted === void 0 ? void 0 : valid(input.persisted, "persisted mode");
+  const artifact = input.artifact === void 0 ? void 0 : valid(input.artifact, "ComputeMode");
+  const explicit = input.explicit === void 0 ? void 0 : valid(input.explicit, "mode");
+  const selected = persisted ?? explicit ?? artifact ?? "lambda";
+  if (artifact !== void 0 && artifact !== selected)
+    throw new Error(
+      `ComputeMode ${artifact} disagrees with persisted mode ${selected}; regenerate the bootstrap and parameter artifacts to change deployment mode`
+    );
+  if (explicit !== void 0 && explicit !== selected)
+    throw new Error(
+      `explicit mode ${explicit} disagrees with persisted mode ${selected}; regenerate the bootstrap and parameter artifacts to change deployment mode`
+    );
+  return selected;
+}
+function computeMode(config) {
+  return resolveComputeMode({ persisted: config.mode });
+}
+
+// packages/aws/src/release.ts
+import { createHash } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { parse, stringify } from "yaml";
+import { z as z2 } from "zod";
+
+// packages/aws/src/internal-board.ts
+import { z } from "zod";
+var durationSchema = z.string().regex(/^\d+(?:ms|s|m|h)$/).refine((value2) => Number.parseInt(value2, 10) > 0).brand();
+var positionSchema = z.union([
+  z.object({
+    x: z.number().int().min(0),
+    y: z.number().int().min(0),
+    w: z.number().int().min(1).max(12),
+    h: z.number().int().min(1)
+  }),
+  z.object({ x: z.literal(0), y: z.literal(0), w: z.literal(0), h: z.literal(0) })
 ]);
-var clim = new u8([16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15]);
-var freb = function(eb, start) {
-  var b = new u16(31);
-  for (var i2 = 0; i2 < 31; ++i2) {
-    b[i2] = start += 1 << eb[i2 - 1];
-  }
-  var r = new i32(b[30]);
-  for (var i2 = 1; i2 < 30; ++i2) {
-    for (var j = b[i2]; j < b[i2 + 1]; ++j) {
-      r[j] = j - b[i2] << 5 | i2;
-    }
+var panelSchema = z.looseObject({
+  // Presentation-only; ids still address proxy calls and the generated allowlist.
+  label: z.string().min(1).optional(),
+  id: z.string().min(1),
+  type: z.string().min(1),
+  source: z.string().min(1).optional(),
+  // Cosmetic roles remain open so newer board files can safely fall back on older runtimes.
+  display: z.string().min(1).optional(),
+  position: positionSchema.optional(),
+  refresh: durationSchema.optional(),
+  link: z.url().optional(),
+  url: z.url().optional(),
+  json_path: z.string().regex(/^\$(?:\.[A-Za-z_][A-Za-z0-9_]*|\[\d+\])*$/).optional()
+});
+var sourceSchema = z.looseObject({
+  type: z.string().min(1),
+  token_env: z.string().min(1).optional()
+});
+var boardSchema = z.object({
+  refresh: durationSchema.optional(),
+  panels: z.array(panelSchema).min(1).superRefine((panels, ctx) => {
+    const seen = /* @__PURE__ */ new Map();
+    panels.forEach((panel, index) => {
+      const firstIndex = seen.get(panel.id);
+      if (firstIndex === void 0) seen.set(panel.id, index);
+      else
+        ctx.addIssue({
+          code: "custom",
+          path: [index, "id"],
+          message: `duplicate panel id "${panel.id}" (already used by panel at index ${firstIndex})`
+        });
+    });
+  })
+});
+var boardConfigSchema = z.object({
+  sources: z.record(z.string().min(1), sourceSchema).default({}),
+  boards: z.record(z.string().min(1), boardSchema),
+  auth: z.object({
+    issuer: z.url(),
+    client_id: z.string().min(1).optional(),
+    allow: z.object({
+      groups: z.array(z.string().min(1)).optional(),
+      subjects: z.array(z.string().min(1)).optional()
+    }).optional()
+  }).optional()
+});
+
+// packages/aws/src/release.ts
+var CORE_RUNTIME_VERSION = "1.0.0";
+var CANONICAL_ASSET_DOMAIN = "https://public-assets.zegreatrob.com";
+function clientAssetUrl(version, domain = CANONICAL_ASSET_DOMAIN) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(version))
+    throw new Error(`Invalid dashboard version: ${version}`);
+  return `${domain.replace(/\/+$/, "")}/dashboard/${version}`;
+}
+async function validateBoardConfig(path) {
+  const source = await readFile(resolve(path), "utf8");
+  const result = boardConfigSchema.safeParse(parse(source));
+  if (!result.success)
+    throw new Error(`Invalid board configuration:
+${z2.prettifyError(result.error)}`);
+  const yaml = stringify(result.data, { sortMapEntries: true });
+  return {
+    yaml,
+    sha256: sha256(yaml),
+    usesCredentials: Object.values(result.data.sources).some((source2) => Boolean(source2.token_env))
+  };
+}
+async function assembleRelease(input) {
+  const board = await validateBoardConfig(input.boardConfigPath);
+  if (board.usesCredentials && !input.secretReference)
+    throw new Error(
+      "Board config uses token_env; SecretReference must name a Secrets Manager credential-map or Parameter Store SecureString ARN"
+    );
+  const outputDir = resolve(input.outputDir);
+  await mkdir(outputDir, { recursive: true });
+  await writeFile(join(outputDir, "board.yaml"), board.yaml);
+  const metadata = {
+    dashboardVersion: input.version,
+    clientAssetUrl: clientAssetUrl(input.version, input.assetDomain),
+    serverRuntimeVersion: CORE_RUNTIME_VERSION,
+    supportedProviders: input.providers ?? ["aws-lambda"],
+    artifactChecksums: { "board.yaml": board.sha256 },
+    runtimeCompatibility: { node: ">=22" }
+  };
+  const metadataText = `${JSON.stringify(metadata, null, 2)}
+`;
+  await writeFile(join(outputDir, "release.json"), metadataText);
+  const files = { "board.yaml": board.sha256, "release.json": sha256(metadataText) };
+  await writeFile(
+    join(outputDir, "SHA256SUMS"),
+    `${Object.entries(files).map(([name, digest]) => `${digest}  ${name}`).join("\n")}
+`
+  );
+  return { metadata, files };
+}
+function sha256(value2) {
+  return createHash("sha256").update(value2).digest("hex");
+}
+
+// packages/aws/src/bootstrap.ts
+var templates = {
+  core: {
+    lambda: "../bootstrap/core-v1.yml",
+    ecs: "../bootstrap/core-ecs-v1.yml"
+  },
+  "github-oidc": {
+    lambda: "../bootstrap/github-oidc-v2.yml",
+    ecs: "../bootstrap/github-oidc-ecs-v1.yml"
   }
-  return { b, r };
 };
-var _a = freb(fleb, 2);
-var fl = _a.b;
-var revfl = _a.r;
-fl[28] = 258, revfl[258] = 28;
-var _b = freb(fdeb, 0);
-var fd = _b.b;
-var revfd = _b.r;
-var rev = new u16(32768);
-for (i = 0; i < 32768; ++i) {
-  x = (i & 43690) >> 1 | (i & 21845) << 1;
-  x = (x & 52428) >> 2 | (x & 13107) << 2;
-  x = (x & 61680) >> 4 | (x & 3855) << 4;
-  rev[i] = ((x & 65280) >> 8 | (x & 255) << 8) >> 1;
+function requireComputeMode(persisted, explicit) {
+  return resolveComputeMode({ persisted: persisted.mode, explicit });
 }
-var x;
-var i;
-var hMap = (function(cd, mb, r) {
-  var s = cd.length;
-  var i2 = 0;
-  var l = new u16(mb);
-  for (; i2 < s; ++i2) {
-    if (cd[i2])
-      ++l[cd[i2] - 1];
-  }
-  var le = new u16(mb);
+async function bootstrapTemplatePath(kind, mode = "lambda") {
+  if (!Object.hasOwn(templates, kind)) throw new Error(`Unknown bootstrap template: ${kind}`);
+  return fileURLToPath(new URL(templates[kind][mode], import.meta.url));
+}
+async function bootstrapTemplate(kind, mode = "lambda") {
+  return readFile2(await bootstrapTemplatePath(kind, mode), "utf8");
+}
+function bootstrapContractVersion(template) {
+  const version = template.match(/BootstrapContractVersion:\s*\{\s*Value:\s*'([^']+)'\s*}/)?.[1];
+  if (!version) throw new Error("Bootstrap template has no BootstrapContractVersion output");
+  return version;
+}
+function bootstrapTemplateRevision(template) {
+  const revision = template.match(/BootstrapTemplateRevision:\s*\{\s*Value:\s*'([^']+)'\s*}/)?.[1];
+  if (!revision) throw new Error("Bootstrap template has no BootstrapTemplateRevision output");
+  return revision;
+}
+function templateRevisionIfPresent(template) {
+  return template.match(/BootstrapTemplateRevision:\s*\{\s*Value:\s*'([^']+)'\s*}/)?.[1];
+}
+function inspectTemplate(kind, path, template) {
+  const resourcesBlock = template.match(/^Resources:\n([\s\S]*?)(?=^[A-Za-z][A-Za-z0-9]*:\s*$)/m)?.[1] ?? "";
+  const resources = [
+    ...resourcesBlock.matchAll(/^ {2}([A-Za-z][A-Za-z0-9]+):\n {4}Type: ([^\n]+)$/gm)
+  ].map((match) => ({ logicalId: match[1], type: match[2] }));
+  const iamActions = [...template.matchAll(/^\s+Action: (?:\[([^\]]+)\]|([^\n]+))$/gm)].flatMap(([, list, scalar]) => (list ?? scalar ?? "").split(",").map((action) => action.trim())).filter(Boolean);
+  return {
+    kind,
+    path,
+    contractVersion: bootstrapContractVersion(template),
+    templateRevision: templateRevisionIfPresent(template),
+    sha256: sha256(template),
+    resources,
+    iamActions: [...new Set(iamActions)]
+  };
+}
+async function bootstrapPlan(config) {
+  const packageManifest = JSON.parse(
+    await readFile2(new URL("../package.json", import.meta.url), "utf8")
+  );
+  const packageTemplates = await Promise.all(
+    ["core", "github-oidc"].map(async (kind) => {
+      const mode = computeMode(config);
+      const [path, template] = await Promise.all([
+        bootstrapTemplatePath(kind, mode),
+        bootstrapTemplate(kind, mode)
+      ]);
+      return inspectTemplate(kind, path, template);
+    })
+  );
+  return {
+    packageVersion: typeof packageManifest.version === "string" ? packageManifest.version : "unknown",
+    packageTemplates,
+    configuration: config,
+    notes: [
+      "Templates are owned by the installed npm package; package.json and package-lock.json pin the source version.",
+      "Generated CloudFormation parameter files and describe-stacks captures are deployment artifacts, not source configuration.",
+      "This plan performs no AWS or GitHub mutations."
+    ]
+  };
+}
+function capturedStack(input) {
+  const stack = input && typeof input === "object" && "Stacks" in input ? input.Stacks?.[0] : input;
+  return stack && typeof stack === "object" ? stack : {};
+}
+function outputValues(stack) {
+  return Object.fromEntries(
+    (stack.Outputs ?? []).map(({ OutputKey, OutputValue }) => [OutputKey, OutputValue])
+  );
+}
+function bootstrapConsistency(kind, config, stackInput, expectedContract, expectedRevision, coreOutputs = {}) {
+  const stack = capturedStack(stackInput);
+  const mismatches = [];
+  const expectedStackName = kind === "core" ? config.core?.stackName : config.githubOidc?.stackName;
+  if (stack.StackName !== expectedStackName)
+    mismatches.push(
+      `stack name is ${stack.StackName ?? "missing"}; expected ${expectedStackName ?? "missing"}`
+    );
+  const observedRegion = stack.StackId?.match(/^arn:[^:]+:cloudformation:([^:]+):/)?.[1];
+  if (observedRegion !== config.region)
+    mismatches.push(
+      `Region is ${observedRegion ?? "missing"}; expected ${config.region ?? "missing"}`
+    );
+  if (!["CREATE_COMPLETE", "UPDATE_COMPLETE"].includes(stack.StackStatus ?? ""))
+    mismatches.push(
+      `stack status is ${stack.StackStatus ?? "missing"}; expected a successful stable status`
+    );
+  const outputs2 = outputValues(stack);
+  if (outputs2.BootstrapContractVersion !== expectedContract)
+    mismatches.push(
+      `contract is ${outputs2.BootstrapContractVersion ?? "missing"}; expected ${expectedContract}`
+    );
+  if (expectedRevision && outputs2.BootstrapTemplateRevision !== expectedRevision)
+    mismatches.push(
+      `template revision is ${outputs2.BootstrapTemplateRevision ?? "missing"}; expected ${expectedRevision}`
+    );
+  const requiredOutputs = kind === "core" ? ["ArtifactBucketName", "ApplicationStackName", "CloudFormationExecutionRoleArn"] : ["GitHubDeployRoleArn"];
+  for (const key of requiredOutputs) if (!outputs2[key]) mismatches.push(`${key} output is missing`);
+  if (kind === "core") {
+    if (outputs2.ArtifactBucketName !== config.core?.artifactBucketName)
+      mismatches.push(
+        `ArtifactBucketName output is ${outputs2.ArtifactBucketName ?? "missing"}; expected ${config.core?.artifactBucketName ?? "missing"}`
+      );
+    if (outputs2.ApplicationStackName !== config.core?.applicationStackName)
+      mismatches.push(
+        `ApplicationStackName output is ${outputs2.ApplicationStackName ?? "missing"}; expected ${config.core?.applicationStackName ?? "missing"}`
+      );
+  }
+  const parameters = Object.fromEntries(
+    (stack.Parameters ?? []).map(({ ParameterKey, ParameterValue }) => [
+      ParameterKey,
+      ParameterValue
+    ])
+  );
+  const expectedParameters = kind === "core" ? {
+    ArtifactBucketName: config.core?.artifactBucketName,
+    ApplicationStackName: config.core?.applicationStackName,
+    DashboardFunctionName: config.core?.dashboardFunctionName,
+    ComputeMode: config.mode,
+    RuntimeSecretArn: config.core?.runtimeSecretArn ?? "",
+    ArtifactKmsKeyArn: config.core?.artifactKmsKeyArn ?? ""
+  } : {
+    GitHubOidcProviderArn: config.githubOidc?.providerArn,
+    GitHubRepository: config.githubOidc?.repository,
+    GitHubOwnerId: config.githubOidc?.ownerId,
+    GitHubRepositoryId: config.githubOidc?.repositoryId,
+    GitHubEnvironment: config.githubOidc?.environment,
+    CoreBootstrapStackName: config.core?.stackName,
+    ApplicationStackName: config.core?.applicationStackName,
+    ArtifactBucketName: config.core?.artifactBucketName,
+    ComputeMode: config.mode,
+    CloudFormationExecutionRoleArn: coreOutputs.CloudFormationExecutionRoleArn,
+    ConsumerGatewayStackName: config.githubOidc?.consumerGatewayStackName ?? ""
+  };
+  for (const [key, expected] of Object.entries(expectedParameters))
+    if (expected !== void 0 && parameters[key] !== expected)
+      mismatches.push(`${key} is ${parameters[key] ?? "missing"}; expected ${expected}`);
+  return { ok: mismatches.length === 0, mismatches };
+}
+function mergeBootstrapParameters(requested, deployed) {
+  const supplied = new Map(requested.map((entry) => [entry.ParameterKey, entry.ParameterValue]));
+  const duplicates = requested.map((entry) => entry.ParameterKey);
+  if (new Set(duplicates).size !== duplicates.length)
+    throw new Error("Bootstrap parameter file contains duplicate parameters");
+  return deployed.map(({ ParameterKey, ParameterValue }) => ({
+    ParameterKey,
+    ParameterValue: supplied.get(ParameterKey) ?? ParameterValue
+  })).concat(
+    requested.filter(
+      ({ ParameterKey }) => !deployed.some((entry) => entry.ParameterKey === ParameterKey)
+    )
+  );
+}
+function deployedBootstrapStack(input, expectedContractVersion) {
+  const stack = input && typeof input === "object" && "Stacks" in input ? input.Stacks?.[0] : input;
+  if (!stack || typeof stack !== "object") throw new Error("Deployed stack JSON contains no stack");
+  const deployed = stack;
+  const contract = deployed.Outputs?.find(
+    (output) => output.OutputKey === "BootstrapContractVersion"
+  )?.OutputValue;
+  if (contract !== expectedContractVersion)
+    throw new Error(
+      `Bootstrap contract mismatch (deployed: ${contract ?? "missing"}; expected: ${expectedContractVersion}); follow the documented migration procedure`
+    );
+  if (deployed.Parameters && !Array.isArray(deployed.Parameters))
+    throw new Error("Deployed stack JSON has invalid Parameters");
+  return deployed;
+}
+function coreBootstrapOutputs(stack) {
+  const values = Object.fromEntries(
+    (stack.Outputs ?? []).filter(
+      (output) => Boolean(output.OutputValue)
+    ).map((output) => [output.OutputKey, output.OutputValue])
+  );
+  const required2 = ["ArtifactBucketName", "ApplicationStackName", "CloudFormationExecutionRoleArn"];
+  const missing = required2.filter((key) => !values[key]);
+  if (missing.length) throw new Error(`Core stack JSON is missing outputs: ${missing.join(", ")}`);
+  return values;
+}
+function requiredBootstrapParameters(kind, values) {
+  const keys = kind === "core" ? ["ArtifactBucketName", "ApplicationStackName", "DashboardFunctionName"] : [
+    "GitHubOidcProviderArn",
+    "GitHubRepository",
+    "GitHubOwnerId",
+    "GitHubRepositoryId",
+    "GitHubEnvironment",
+    "CoreBootstrapStackName",
+    "ApplicationStackName",
+    "ArtifactBucketName",
+    "CloudFormationExecutionRoleArn"
+  ];
+  const missing = keys.filter((key) => !values[key]);
+  if (missing.length) throw new Error(`Missing required bootstrap values: ${missing.join(", ")}`);
+  const optional2 = kind === "core" ? ["RuntimeSecretArn", "ArtifactKmsKeyArn", "ComputeMode"] : ["ConsumerGatewayStackName", "ComputeMode"];
+  return [...keys, ...optional2].filter((key) => values[key] !== void 0).map((ParameterKey) => ({ ParameterKey, ParameterValue: values[ParameterKey] ?? "" }));
+}
+
+// packages/aws/src/index.ts
+import { execFile } from "node:child_process";
+import { cp, mkdir as mkdir2, readFile as readFile3, rm, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join2, resolve as resolve2 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { promisify } from "node:util";
+
+// node_modules/fflate/esm/index.mjs
+import { createRequire } from "module";
+var require2 = createRequire("/");
+var _a;
+var Worker;
+var isMarkedAsUntransferable;
+try {
+  _a = require2("worker_threads"), Worker = _a.Worker, isMarkedAsUntransferable = _a.isMarkedAsUntransferable;
+} catch (e) {
+}
+var u8 = Uint8Array;
+var u16 = Uint16Array;
+var i32 = Int32Array;
+var fleb = new u8([
+  0,
+  0,
+  0,
+  0,
+  0,
+  0,
+  0,
+  0,
+  1,
+  1,
+  1,
+  1,
+  2,
+  2,
+  2,
+  2,
+  3,
+  3,
+  3,
+  3,
+  4,
+  4,
+  4,
+  4,
+  5,
+  5,
+  5,
+  5,
+  0,
+  /* unused */
+  0,
+  0,
+  /* impossible */
+  0
+]);
+var fdeb = new u8([
+  0,
+  0,
+  0,
+  0,
+  1,
+  1,
+  2,
+  2,
+  3,
+  3,
+  4,
+  4,
+  5,
+  5,
+  6,
+  6,
+  7,
+  7,
+  8,
+  8,
+  9,
+  9,
+  10,
+  10,
+  11,
+  11,
+  12,
+  12,
+  13,
+  13,
+  /* unused */
+  0,
+  0
+]);
+var clim = new u8([16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15]);
+var freb = function(eb, start) {
+  var b = new u16(31);
+  for (var i2 = 0; i2 < 31; ++i2) {
+    b[i2] = start += 1 << eb[i2 - 1];
+  }
+  var r = new i32(b[30]);
+  for (var i2 = 1; i2 < 30; ++i2) {
+    for (var j = b[i2]; j < b[i2 + 1]; ++j) {
+      r[j] = j - b[i2] << 5 | i2;
+    }
+  }
+  return { b, r };
+};
+var _a = freb(fleb, 2);
+var fl = _a.b;
+var revfl = _a.r;
+fl[28] = 258, revfl[258] = 28;
+var _b = freb(fdeb, 0);
+var fd = _b.b;
+var revfd = _b.r;
+var rev = new u16(32768);
+for (i = 0; i < 32768; ++i) {
+  x = (i & 43690) >> 1 | (i & 21845) << 1;
+  x = (x & 52428) >> 2 | (x & 13107) << 2;
+  x = (x & 61680) >> 4 | (x & 3855) << 4;
+  rev[i] = ((x & 65280) >> 8 | (x & 255) << 8) >> 1;
+}
+var x;
+var i;
+var hMap = (function(cd, mb, r) {
+  var s = cd.length;
+  var i2 = 0;
+  var l = new u16(mb);
+  for (; i2 < s; ++i2) {
+    if (cd[i2])
+      ++l[cd[i2] - 1];
+  }
+  var le = new u16(mb);
   for (i2 = 1; i2 < mb; ++i2) {
     le[i2] = le[i2 - 1] + l[i2 - 1] << 1;
   }
@@ -401,659 +760,342 @@ var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
           wbits(out, p, clct[i2] >> 5 & 127), p += clct[i2] >> 12;
       }
     }
-  } else {
-    lm = flm, ll = flt, dm = fdm, dl = fdt;
-  }
-  for (var i2 = 0; i2 < li; ++i2) {
-    var sym = syms[i2];
-    if (sym > 255) {
-      var len = sym >> 18 & 31;
-      wbits16(out, p, lm[len + 257]), p += ll[len + 257];
-      if (len > 7)
-        wbits(out, p, sym >> 23 & 31), p += fleb[len];
-      var dst = sym & 31;
-      wbits16(out, p, dm[dst]), p += dl[dst];
-      if (dst > 3)
-        wbits16(out, p, sym >> 5 & 8191), p += fdeb[dst];
-    } else {
-      wbits16(out, p, lm[sym]), p += ll[sym];
-    }
-  }
-  wbits16(out, p, lm[256]);
-  return p + ll[256];
-};
-var deo = /* @__PURE__ */ new i32([65540, 131080, 131088, 131104, 262176, 1048704, 1048832, 2114560, 2117632]);
-var et = /* @__PURE__ */ new u8(0);
-var dflt = function(dat, lvl, plvl, pre, post, st) {
-  var s = st.z || dat.length;
-  var o = new u8(pre + s + 5 * (1 + Math.ceil(s / 7e3)) + post);
-  var w = o.subarray(pre, o.length - post);
-  var lst = st.l;
-  var pos = (st.r || 0) & 7;
-  if (lvl) {
-    if (pos)
-      w[0] = st.r >> 3;
-    var opt = deo[lvl - 1];
-    var n = opt >> 13, c = opt & 8191;
-    var msk_1 = (1 << plvl) - 1;
-    var prev = st.p || new u16(32768), head = st.h || new u16(msk_1 + 1);
-    var bs1_1 = Math.ceil(plvl / 3), bs2_1 = 2 * bs1_1;
-    var hsh = function(i3) {
-      return (dat[i3] ^ dat[i3 + 1] << bs1_1 ^ dat[i3 + 2] << bs2_1) & msk_1;
-    };
-    var syms = new i32(25e3);
-    var lf = new u16(288), df = new u16(32);
-    var lc_1 = 0, eb = 0, i2 = st.i || 0, li = 0, wi = st.w || 0, bs = 0;
-    for (; i2 + 2 < s; ++i2) {
-      var hv = hsh(i2);
-      var imod = i2 & 32767, pimod = head[hv];
-      prev[imod] = pimod;
-      head[hv] = imod;
-      if (wi <= i2) {
-        var rem = s - i2;
-        if ((lc_1 > 7e3 || li > 24576) && (rem > 423 || !lst)) {
-          pos = wblk(dat, w, 0, syms, lf, df, eb, li, bs, i2 - bs, pos);
-          li = lc_1 = eb = 0, bs = i2;
-          for (var j = 0; j < 286; ++j)
-            lf[j] = 0;
-          for (var j = 0; j < 30; ++j)
-            df[j] = 0;
-        }
-        var l = 2, d = 0, ch_1 = c, dif = imod - pimod & 32767;
-        if (rem > 2 && hv == hsh(i2 - dif)) {
-          var maxn = Math.min(n, rem) - 1;
-          var maxd = Math.min(32767, i2);
-          var ml = Math.min(258, rem);
-          while (dif <= maxd && --ch_1 && imod != pimod) {
-            if (dat[i2 + l] == dat[i2 + l - dif]) {
-              var nl = 0;
-              for (; nl < ml && dat[i2 + nl] == dat[i2 + nl - dif]; ++nl)
-                ;
-              if (nl > l) {
-                l = nl, d = dif;
-                if (nl > maxn)
-                  break;
-                var mmd = Math.min(dif, nl - 2);
-                var md = 0;
-                for (var j = 0; j < mmd; ++j) {
-                  var ti = i2 - dif + j & 32767;
-                  var pti = prev[ti];
-                  var cd = ti - pti & 32767;
-                  if (cd > md)
-                    md = cd, pimod = ti;
-                }
-              }
-            }
-            imod = pimod, pimod = prev[imod];
-            dif += imod - pimod & 32767;
-          }
-        }
-        if (d) {
-          syms[li++] = 268435456 | revfl[l] << 18 | revfd[d];
-          var lin = revfl[l] & 31, din = revfd[d] & 31;
-          eb += fleb[lin] + fdeb[din];
-          ++lf[257 + lin];
-          ++df[din];
-          wi = i2 + l;
-          ++lc_1;
-        } else {
-          syms[li++] = dat[i2];
-          ++lf[dat[i2]];
-        }
-      }
-    }
-    for (i2 = Math.max(i2, wi); i2 < s; ++i2) {
-      syms[li++] = dat[i2];
-      ++lf[dat[i2]];
-    }
-    pos = wblk(dat, w, lst, syms, lf, df, eb, li, bs, i2 - bs, pos);
-    if (!lst) {
-      st.r = pos & 7 | w[pos / 8 | 0] << 3;
-      pos -= 7;
-      st.h = head, st.p = prev, st.i = i2, st.w = wi;
-    }
-  } else {
-    for (var i2 = st.w || 0; i2 < s + lst; i2 += 65535) {
-      var e = i2 + 65535;
-      if (e >= s) {
-        w[pos / 8 | 0] = lst;
-        e = s;
-      }
-      pos = wfblk(w, pos + 1, dat.subarray(i2, e));
-    }
-    st.i = s;
-  }
-  return slc(o, 0, pre + shft(pos) + post);
-};
-var crct = /* @__PURE__ */ (function() {
-  var t = new Int32Array(256);
-  for (var i2 = 0; i2 < 256; ++i2) {
-    var c = i2, k = 9;
-    while (--k)
-      c = (c & 1 && -306674912) ^ c >>> 1;
-    t[i2] = c;
-  }
-  return t;
-})();
-var crc = function() {
-  var c = -1;
-  return {
-    p: function(d) {
-      var cr = c;
-      for (var i2 = 0; i2 < d.length; ++i2)
-        cr = crct[cr & 255 ^ d[i2]] ^ cr >>> 8;
-      c = cr;
-    },
-    d: function() {
-      return ~c;
-    }
-  };
-};
-var dopt = function(dat, opt, pre, post, st) {
-  if (!st) {
-    st = { l: 1 };
-    if (opt.dictionary) {
-      var dict = opt.dictionary.subarray(-32768);
-      var newDat = new u8(dict.length + dat.length);
-      newDat.set(dict);
-      newDat.set(dat, dict.length);
-      dat = newDat;
-      st.w = dict.length;
-    }
-  }
-  return dflt(dat, opt.level == null ? 6 : opt.level, opt.mem == null ? st.l ? Math.ceil(Math.max(8, Math.min(13, Math.log(dat.length))) * 1.5) : 20 : 12 + opt.mem, pre, post, st);
-};
-var mrg = function(a, b) {
-  var o = {};
-  for (var k in a)
-    o[k] = a[k];
-  for (var k in b)
-    o[k] = b[k];
-  return o;
-};
-var wbytes = function(d, b, v) {
-  for (; v; ++b)
-    d[b] = v, v >>>= 8;
-};
-function deflateSync(data, opts) {
-  return dopt(data, opts || {}, 0, 0);
-}
-var fltn = function(d, p, t, o) {
-  for (var k in d) {
-    var val = d[k], n = p + k, op = o;
-    if (Array.isArray(val))
-      op = mrg(o, val[1]), val = val[0];
-    if (ArrayBuffer.isView(val))
-      t[n] = [val, op];
-    else {
-      t[n += "/"] = [new u8(0), op];
-      fltn(val, n, t, o);
-    }
-  }
-};
-var te = typeof TextEncoder != "undefined" && /* @__PURE__ */ new TextEncoder();
-var td = typeof TextDecoder != "undefined" && /* @__PURE__ */ new TextDecoder();
-var tds = 0;
-try {
-  td.decode(et, { stream: true });
-  tds = 1;
-} catch (e) {
-}
-function strToU8(str, latin1) {
-  if (latin1) {
-    var ar_1 = new u8(str.length);
-    for (var i2 = 0; i2 < str.length; ++i2)
-      ar_1[i2] = str.charCodeAt(i2);
-    return ar_1;
-  }
-  if (te)
-    return te.encode(str);
-  var l = str.length;
-  var ar = new u8(str.length + (str.length >> 1));
-  var ai = 0;
-  var w = function(v) {
-    ar[ai++] = v;
-  };
-  for (var i2 = 0; i2 < l; ++i2) {
-    if (ai + 5 > ar.length) {
-      var n = new u8(ai + 8 + (l - i2 << 1));
-      n.set(ar);
-      ar = n;
-    }
-    var c = str.charCodeAt(i2);
-    if (c < 128 || latin1)
-      w(c);
-    else if (c < 2048)
-      w(192 | c >> 6), w(128 | c & 63);
-    else if (c > 55295 && c < 57344)
-      c = 65536 + (c & 1023 << 10) | str.charCodeAt(++i2) & 1023, w(240 | c >> 18), w(128 | c >> 12 & 63), w(128 | c >> 6 & 63), w(128 | c & 63);
-    else
-      w(224 | c >> 12), w(128 | c >> 6 & 63), w(128 | c & 63);
-  }
-  return slc(ar, 0, ai);
-}
-var exfl = function(ex) {
-  var le = 0;
-  if (ex) {
-    for (var k in ex) {
-      var l = ex[k].length;
-      if (l > 65535)
-        err(9);
-      le += l + 4;
-    }
-  }
-  return le;
-};
-var wzh = function(d, b, f, fn, u, c, ce, co) {
-  var fl2 = fn.length, ex = f.extra, col = co && co.length;
-  var exl = exfl(ex);
-  wbytes(d, b, ce != null ? 33639248 : 67324752), b += 4;
-  if (ce != null)
-    d[b++] = 20, d[b++] = f.os;
-  d[b] = 20, b += 2;
-  d[b++] = f.flag << 1 | (c < 0 && 8), d[b++] = u && 8;
-  d[b++] = f.compression & 255, d[b++] = f.compression >> 8;
-  var dt = new Date(f.mtime == null ? Date.now() : f.mtime), y = dt.getFullYear() - 1980;
-  if (y < 0 || y > 119)
-    err(10);
-  wbytes(d, b, y << 25 | dt.getMonth() + 1 << 21 | dt.getDate() << 16 | dt.getHours() << 11 | dt.getMinutes() << 5 | dt.getSeconds() >> 1), b += 4;
-  if (c != -1) {
-    wbytes(d, b, f.crc);
-    wbytes(d, b + 4, c < 0 ? -c - 2 : c);
-    wbytes(d, b + 8, f.size);
-  }
-  wbytes(d, b + 12, fl2);
-  wbytes(d, b + 14, exl), b += 16;
-  if (ce != null) {
-    wbytes(d, b, col);
-    wbytes(d, b + 6, f.attrs);
-    wbytes(d, b + 10, ce), b += 14;
+  } else {
+    lm = flm, ll = flt, dm = fdm, dl = fdt;
   }
-  d.set(fn, b);
-  b += fl2;
-  if (exl) {
-    for (var k in ex) {
-      var exf = ex[k], l = exf.length;
-      wbytes(d, b, +k);
-      wbytes(d, b + 2, l);
-      d.set(exf, b + 4), b += 4 + l;
+  for (var i2 = 0; i2 < li; ++i2) {
+    var sym = syms[i2];
+    if (sym > 255) {
+      var len = sym >> 18 & 31;
+      wbits16(out, p, lm[len + 257]), p += ll[len + 257];
+      if (len > 7)
+        wbits(out, p, sym >> 23 & 31), p += fleb[len];
+      var dst = sym & 31;
+      wbits16(out, p, dm[dst]), p += dl[dst];
+      if (dst > 3)
+        wbits16(out, p, sym >> 5 & 8191), p += fdeb[dst];
+    } else {
+      wbits16(out, p, lm[sym]), p += ll[sym];
     }
   }
-  if (col)
-    d.set(co, b), b += col;
-  return b;
-};
-var wzf = function(o, b, c, d, e) {
-  wbytes(o, b, 101010256);
-  wbytes(o, b + 8, c);
-  wbytes(o, b + 10, c);
-  wbytes(o, b + 12, d);
-  wbytes(o, b + 16, e);
+  wbits16(out, p, lm[256]);
+  return p + ll[256];
 };
-function zipSync(data, opts) {
-  if (!opts)
-    opts = {};
-  var r = {};
-  var files = [];
-  fltn(data, "", r, opts);
-  var o = 0;
-  var tot = 0;
-  for (var fn in r) {
-    var _a2 = r[fn], file = _a2[0], p = _a2[1];
-    var compression = p.level == 0 ? 0 : 8;
-    var f = strToU8(fn), s = f.length;
-    var com = p.comment, m = com && strToU8(com), ms = m && m.length;
-    var exl = exfl(p.extra);
-    if (s > 65535)
-      err(11);
-    var d = compression ? deflateSync(file, p) : file, l = d.length;
-    var c = crc();
-    c.p(file);
-    files.push(mrg(p, {
-      size: file.length,
-      crc: c.d(),
-      c: d,
-      f,
-      m,
-      u: s != fn.length || m && com.length != ms,
-      o,
-      compression
-    }));
-    o += 30 + s + exl + l;
-    tot += 76 + 2 * (s + exl) + (ms || 0) + l;
-  }
-  var out = new u8(tot + 22), oe = o, cdl = tot - o;
-  for (var i2 = 0; i2 < files.length; ++i2) {
-    var f = files[i2];
-    wzh(out, f.o, f, f.f, f.u, f.c.length);
-    var badd = 30 + f.f.length + exfl(f.extra);
-    out.set(f.c, f.o + badd);
-    wzh(out, o, f, f.f, f.u, f.c.length, f.o, f.m), o += 16 + badd + (f.m ? f.m.length : 0);
-  }
-  wzf(out, o, files.length, cdl, oe);
-  return out;
-}
-
-// packages/aws/src/release.ts
-import { createHash } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { join, resolve } from "node:path";
-import { parse, stringify } from "yaml";
-import { z as z2 } from "zod";
-
-// packages/aws/src/internal-board.ts
-import { z } from "zod";
-var durationSchema = z.string().regex(/^\d+(?:ms|s|m|h)$/).refine((value2) => Number.parseInt(value2, 10) > 0).brand();
-var positionSchema = z.union([
-  z.object({
-    x: z.number().int().min(0),
-    y: z.number().int().min(0),
-    w: z.number().int().min(1).max(12),
-    h: z.number().int().min(1)
-  }),
-  z.object({ x: z.literal(0), y: z.literal(0), w: z.literal(0), h: z.literal(0) })
-]);
-var panelSchema = z.looseObject({
-  // Presentation-only; ids still address proxy calls and the generated allowlist.
-  label: z.string().min(1).optional(),
-  id: z.string().min(1),
-  type: z.string().min(1),
-  source: z.string().min(1).optional(),
-  // Cosmetic roles remain open so newer board files can safely fall back on older runtimes.
-  display: z.string().min(1).optional(),
-  position: positionSchema.optional(),
-  refresh: durationSchema.optional(),
-  link: z.url().optional(),
-  url: z.url().optional(),
-  json_path: z.string().regex(/^\$(?:\.[A-Za-z_][A-Za-z0-9_]*|\[\d+\])*$/).optional()
-});
-var sourceSchema = z.looseObject({
-  type: z.string().min(1),
-  token_env: z.string().min(1).optional()
-});
-var boardSchema = z.object({
-  refresh: durationSchema.optional(),
-  panels: z.array(panelSchema).min(1).superRefine((panels, ctx) => {
-    const seen = /* @__PURE__ */ new Map();
-    panels.forEach((panel, index) => {
-      const firstIndex = seen.get(panel.id);
-      if (firstIndex === void 0) seen.set(panel.id, index);
-      else
-        ctx.addIssue({
-          code: "custom",
-          path: [index, "id"],
-          message: `duplicate panel id "${panel.id}" (already used by panel at index ${firstIndex})`
-        });
-    });
-  })
-});
-var boardConfigSchema = z.object({
-  sources: z.record(z.string().min(1), sourceSchema).default({}),
-  boards: z.record(z.string().min(1), boardSchema),
-  auth: z.object({
-    issuer: z.url(),
-    client_id: z.string().min(1).optional(),
-    allow: z.object({
-      groups: z.array(z.string().min(1)).optional(),
-      subjects: z.array(z.string().min(1)).optional()
-    }).optional()
-  }).optional()
-});
-
-// packages/aws/src/release.ts
-var CORE_RUNTIME_VERSION = "1.0.0";
-var CANONICAL_ASSET_DOMAIN = "https://public-assets.zegreatrob.com";
-function clientAssetUrl(version, domain = CANONICAL_ASSET_DOMAIN) {
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(version))
-    throw new Error(`Invalid dashboard version: ${version}`);
-  return `${domain.replace(/\/+$/, "")}/dashboard/${version}`;
-}
-async function validateBoardConfig(path) {
-  const source = await readFile(resolve(path), "utf8");
-  const result = boardConfigSchema.safeParse(parse(source));
-  if (!result.success)
-    throw new Error(`Invalid board configuration:
-${z2.prettifyError(result.error)}`);
-  const yaml = stringify(result.data, { sortMapEntries: true });
-  return {
-    yaml,
-    sha256: sha256(yaml),
-    usesCredentials: Object.values(result.data.sources).some((source2) => Boolean(source2.token_env))
-  };
-}
-async function assembleRelease(input) {
-  const board = await validateBoardConfig(input.boardConfigPath);
-  if (board.usesCredentials && !input.secretReference)
-    throw new Error(
-      "Board config uses token_env; SecretReference must name a Secrets Manager credential-map or Parameter Store SecureString ARN"
-    );
-  const outputDir = resolve(input.outputDir);
-  await mkdir(outputDir, { recursive: true });
-  await writeFile(join(outputDir, "board.yaml"), board.yaml);
-  const metadata = {
-    dashboardVersion: input.version,
-    clientAssetUrl: clientAssetUrl(input.version, input.assetDomain),
-    serverRuntimeVersion: CORE_RUNTIME_VERSION,
-    supportedProviders: input.providers ?? ["aws-lambda"],
-    artifactChecksums: { "board.yaml": board.sha256 },
-    runtimeCompatibility: { node: ">=22" }
-  };
-  const metadataText = `${JSON.stringify(metadata, null, 2)}
-`;
-  await writeFile(join(outputDir, "release.json"), metadataText);
-  const files = { "board.yaml": board.sha256, "release.json": sha256(metadataText) };
-  await writeFile(
-    join(outputDir, "SHA256SUMS"),
-    `${Object.entries(files).map(([name, digest]) => `${digest}  ${name}`).join("\n")}
-`
-  );
-  return { metadata, files };
-}
-function sha256(value2) {
-  return createHash("sha256").update(value2).digest("hex");
-}
-
-// packages/aws/src/bootstrap.ts
-import { readFile as readFile2 } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
-var templates = {
-  core: "../bootstrap/core-v1.yml",
-  "github-oidc": "../bootstrap/github-oidc-v2.yml"
+var deo = /* @__PURE__ */ new i32([65540, 131080, 131088, 131104, 262176, 1048704, 1048832, 2114560, 2117632]);
+var et = /* @__PURE__ */ new u8(0);
+var dflt = function(dat, lvl, plvl, pre, post, st) {
+  var s = st.z || dat.length;
+  var o = new u8(pre + s + 5 * (1 + Math.ceil(s / 7e3)) + post);
+  var w = o.subarray(pre, o.length - post);
+  var lst = st.l;
+  var pos = (st.r || 0) & 7;
+  if (lvl) {
+    if (pos)
+      w[0] = st.r >> 3;
+    var opt = deo[lvl - 1];
+    var n = opt >> 13, c = opt & 8191;
+    var msk_1 = (1 << plvl) - 1;
+    var prev = st.p || new u16(32768), head = st.h || new u16(msk_1 + 1);
+    var bs1_1 = Math.ceil(plvl / 3), bs2_1 = 2 * bs1_1;
+    var hsh = function(i3) {
+      return (dat[i3] ^ dat[i3 + 1] << bs1_1 ^ dat[i3 + 2] << bs2_1) & msk_1;
+    };
+    var syms = new i32(25e3);
+    var lf = new u16(288), df = new u16(32);
+    var lc_1 = 0, eb = 0, i2 = st.i || 0, li = 0, wi = st.w || 0, bs = 0;
+    for (; i2 + 2 < s; ++i2) {
+      var hv = hsh(i2);
+      var imod = i2 & 32767, pimod = head[hv];
+      prev[imod] = pimod;
+      head[hv] = imod;
+      if (wi <= i2) {
+        var rem = s - i2;
+        if ((lc_1 > 7e3 || li > 24576) && (rem > 423 || !lst)) {
+          pos = wblk(dat, w, 0, syms, lf, df, eb, li, bs, i2 - bs, pos);
+          li = lc_1 = eb = 0, bs = i2;
+          for (var j = 0; j < 286; ++j)
+            lf[j] = 0;
+          for (var j = 0; j < 30; ++j)
+            df[j] = 0;
+        }
+        var l = 2, d = 0, ch_1 = c, dif = imod - pimod & 32767;
+        if (rem > 2 && hv == hsh(i2 - dif)) {
+          var maxn = Math.min(n, rem) - 1;
+          var maxd = Math.min(32767, i2);
+          var ml = Math.min(258, rem);
+          while (dif <= maxd && --ch_1 && imod != pimod) {
+            if (dat[i2 + l] == dat[i2 + l - dif]) {
+              var nl = 0;
+              for (; nl < ml && dat[i2 + nl] == dat[i2 + nl - dif]; ++nl)
+                ;
+              if (nl > l) {
+                l = nl, d = dif;
+                if (nl > maxn)
+                  break;
+                var mmd = Math.min(dif, nl - 2);
+                var md = 0;
+                for (var j = 0; j < mmd; ++j) {
+                  var ti = i2 - dif + j & 32767;
+                  var pti = prev[ti];
+                  var cd = ti - pti & 32767;
+                  if (cd > md)
+                    md = cd, pimod = ti;
+                }
+              }
+            }
+            imod = pimod, pimod = prev[imod];
+            dif += imod - pimod & 32767;
+          }
+        }
+        if (d) {
+          syms[li++] = 268435456 | revfl[l] << 18 | revfd[d];
+          var lin = revfl[l] & 31, din = revfd[d] & 31;
+          eb += fleb[lin] + fdeb[din];
+          ++lf[257 + lin];
+          ++df[din];
+          wi = i2 + l;
+          ++lc_1;
+        } else {
+          syms[li++] = dat[i2];
+          ++lf[dat[i2]];
+        }
+      }
+    }
+    for (i2 = Math.max(i2, wi); i2 < s; ++i2) {
+      syms[li++] = dat[i2];
+      ++lf[dat[i2]];
+    }
+    pos = wblk(dat, w, lst, syms, lf, df, eb, li, bs, i2 - bs, pos);
+    if (!lst) {
+      st.r = pos & 7 | w[pos / 8 | 0] << 3;
+      pos -= 7;
+      st.h = head, st.p = prev, st.i = i2, st.w = wi;
+    }
+  } else {
+    for (var i2 = st.w || 0; i2 < s + lst; i2 += 65535) {
+      var e = i2 + 65535;
+      if (e >= s) {
+        w[pos / 8 | 0] = lst;
+        e = s;
+      }
+      pos = wfblk(w, pos + 1, dat.subarray(i2, e));
+    }
+    st.i = s;
+  }
+  return slc(o, 0, pre + shft(pos) + post);
 };
-async function bootstrapTemplatePath(kind) {
-  if (!Object.hasOwn(templates, kind)) throw new Error(`Unknown bootstrap template: ${kind}`);
-  return fileURLToPath(new URL(templates[kind], import.meta.url));
-}
-async function bootstrapTemplate(kind) {
-  return readFile2(await bootstrapTemplatePath(kind), "utf8");
-}
-function bootstrapContractVersion(template) {
-  const version = template.match(/BootstrapContractVersion:\s*\{\s*Value:\s*'([^']+)'\s*}/)?.[1];
-  if (!version) throw new Error("Bootstrap template has no BootstrapContractVersion output");
-  return version;
-}
-function bootstrapTemplateRevision(template) {
-  const revision = template.match(/BootstrapTemplateRevision:\s*\{\s*Value:\s*'([^']+)'\s*}/)?.[1];
-  if (!revision) throw new Error("Bootstrap template has no BootstrapTemplateRevision output");
-  return revision;
-}
-function templateRevisionIfPresent(template) {
-  return template.match(/BootstrapTemplateRevision:\s*\{\s*Value:\s*'([^']+)'\s*}/)?.[1];
-}
-function inspectTemplate(kind, path, template) {
-  const resourcesBlock = template.match(/^Resources:\n([\s\S]*?)(?=^[A-Za-z][A-Za-z0-9]*:\s*$)/m)?.[1] ?? "";
-  const resources = [
-    ...resourcesBlock.matchAll(/^ {2}([A-Za-z][A-Za-z0-9]+):\n {4}Type: ([^\n]+)$/gm)
-  ].map((match) => ({ logicalId: match[1], type: match[2] }));
-  const iamActions = [...template.matchAll(/^\s+Action: (?:\[([^\]]+)\]|([^\n]+))$/gm)].flatMap(([, list, scalar]) => (list ?? scalar ?? "").split(",").map((action) => action.trim())).filter(Boolean);
-  return {
-    kind,
-    path,
-    contractVersion: bootstrapContractVersion(template),
-    templateRevision: templateRevisionIfPresent(template),
-    sha256: sha256(template),
-    resources,
-    iamActions: [...new Set(iamActions)]
-  };
-}
-async function bootstrapPlan(config) {
-  const packageManifest = JSON.parse(
-    await readFile2(new URL("../package.json", import.meta.url), "utf8")
-  );
-  const packageTemplates = await Promise.all(
-    ["core", "github-oidc"].map(async (kind) => {
-      const [path, template] = await Promise.all([
-        bootstrapTemplatePath(kind),
-        bootstrapTemplate(kind)
-      ]);
-      return inspectTemplate(kind, path, template);
-    })
-  );
+var crct = /* @__PURE__ */ (function() {
+  var t = new Int32Array(256);
+  for (var i2 = 0; i2 < 256; ++i2) {
+    var c = i2, k = 9;
+    while (--k)
+      c = (c & 1 && -306674912) ^ c >>> 1;
+    t[i2] = c;
+  }
+  return t;
+})();
+var crc = function() {
+  var c = -1;
   return {
-    packageVersion: typeof packageManifest.version === "string" ? packageManifest.version : "unknown",
-    packageTemplates,
-    configuration: config,
-    notes: [
-      "Templates are owned by the installed npm package; package.json and package-lock.json pin the source version.",
-      "Generated CloudFormation parameter files and describe-stacks captures are deployment artifacts, not source configuration.",
-      "This plan performs no AWS or GitHub mutations."
-    ]
+    p: function(d) {
+      var cr = c;
+      for (var i2 = 0; i2 < d.length; ++i2)
+        cr = crct[cr & 255 ^ d[i2]] ^ cr >>> 8;
+      c = cr;
+    },
+    d: function() {
+      return ~c;
+    }
   };
-}
-function capturedStack(input) {
-  const stack = input && typeof input === "object" && "Stacks" in input ? input.Stacks?.[0] : input;
-  return stack && typeof stack === "object" ? stack : {};
-}
-function outputValues(stack) {
-  return Object.fromEntries(
-    (stack.Outputs ?? []).map(({ OutputKey, OutputValue }) => [OutputKey, OutputValue])
-  );
-}
-function bootstrapConsistency(kind, config, stackInput, expectedContract, expectedRevision, coreOutputs = {}) {
-  const stack = capturedStack(stackInput);
-  const mismatches = [];
-  const expectedStackName = kind === "core" ? config.core?.stackName : config.githubOidc?.stackName;
-  if (stack.StackName !== expectedStackName)
-    mismatches.push(
-      `stack name is ${stack.StackName ?? "missing"}; expected ${expectedStackName ?? "missing"}`
-    );
-  const observedRegion = stack.StackId?.match(/^arn:[^:]+:cloudformation:([^:]+):/)?.[1];
-  if (observedRegion !== config.region)
-    mismatches.push(
-      `Region is ${observedRegion ?? "missing"}; expected ${config.region ?? "missing"}`
-    );
-  if (!["CREATE_COMPLETE", "UPDATE_COMPLETE"].includes(stack.StackStatus ?? ""))
-    mismatches.push(
-      `stack status is ${stack.StackStatus ?? "missing"}; expected a successful stable status`
-    );
-  const outputs2 = outputValues(stack);
-  if (outputs2.BootstrapContractVersion !== expectedContract)
-    mismatches.push(
-      `contract is ${outputs2.BootstrapContractVersion ?? "missing"}; expected ${expectedContract}`
-    );
-  if (expectedRevision && outputs2.BootstrapTemplateRevision !== expectedRevision)
-    mismatches.push(
-      `template revision is ${outputs2.BootstrapTemplateRevision ?? "missing"}; expected ${expectedRevision}`
-    );
-  const requiredOutputs = kind === "core" ? ["ArtifactBucketName", "ApplicationStackName", "CloudFormationExecutionRoleArn"] : ["GitHubDeployRoleArn"];
-  for (const key of requiredOutputs) if (!outputs2[key]) mismatches.push(`${key} output is missing`);
-  if (kind === "core") {
-    if (outputs2.ArtifactBucketName !== config.core?.artifactBucketName)
-      mismatches.push(
-        `ArtifactBucketName output is ${outputs2.ArtifactBucketName ?? "missing"}; expected ${config.core?.artifactBucketName ?? "missing"}`
-      );
-    if (outputs2.ApplicationStackName !== config.core?.applicationStackName)
-      mismatches.push(
-        `ApplicationStackName output is ${outputs2.ApplicationStackName ?? "missing"}; expected ${config.core?.applicationStackName ?? "missing"}`
-      );
+};
+var dopt = function(dat, opt, pre, post, st) {
+  if (!st) {
+    st = { l: 1 };
+    if (opt.dictionary) {
+      var dict = opt.dictionary.subarray(-32768);
+      var newDat = new u8(dict.length + dat.length);
+      newDat.set(dict);
+      newDat.set(dat, dict.length);
+      dat = newDat;
+      st.w = dict.length;
+    }
   }
-  const parameters = Object.fromEntries(
-    (stack.Parameters ?? []).map(({ ParameterKey, ParameterValue }) => [
-      ParameterKey,
-      ParameterValue
-    ])
-  );
-  const expectedParameters = kind === "core" ? {
-    ArtifactBucketName: config.core?.artifactBucketName,
-    ApplicationStackName: config.core?.applicationStackName,
-    DashboardFunctionName: config.core?.dashboardFunctionName,
-    RuntimeSecretArn: config.core?.runtimeSecretArn ?? "",
-    ArtifactKmsKeyArn: config.core?.artifactKmsKeyArn ?? ""
-  } : {
-    GitHubOidcProviderArn: config.githubOidc?.providerArn,
-    GitHubRepository: config.githubOidc?.repository,
-    GitHubOwnerId: config.githubOidc?.ownerId,
-    GitHubRepositoryId: config.githubOidc?.repositoryId,
-    GitHubEnvironment: config.githubOidc?.environment,
-    CoreBootstrapStackName: config.core?.stackName,
-    ApplicationStackName: config.core?.applicationStackName,
-    ArtifactBucketName: config.core?.artifactBucketName,
-    CloudFormationExecutionRoleArn: coreOutputs.CloudFormationExecutionRoleArn,
-    ConsumerGatewayStackName: config.githubOidc?.consumerGatewayStackName ?? ""
-  };
-  for (const [key, expected] of Object.entries(expectedParameters))
-    if (expected !== void 0 && parameters[key] !== expected)
-      mismatches.push(`${key} is ${parameters[key] ?? "missing"}; expected ${expected}`);
-  return { ok: mismatches.length === 0, mismatches };
-}
-function mergeBootstrapParameters(requested, deployed) {
-  const supplied = new Map(requested.map((entry) => [entry.ParameterKey, entry.ParameterValue]));
-  const duplicates = requested.map((entry) => entry.ParameterKey);
-  if (new Set(duplicates).size !== duplicates.length)
-    throw new Error("Bootstrap parameter file contains duplicate parameters");
-  return deployed.map(({ ParameterKey, ParameterValue }) => ({
-    ParameterKey,
-    ParameterValue: supplied.get(ParameterKey) ?? ParameterValue
-  })).concat(
-    requested.filter(
-      ({ ParameterKey }) => !deployed.some((entry) => entry.ParameterKey === ParameterKey)
-    )
-  );
+  return dflt(dat, opt.level == null ? 6 : opt.level, opt.mem == null ? st.l ? Math.ceil(Math.max(8, Math.min(13, Math.log(dat.length))) * 1.5) : 20 : 12 + opt.mem, pre, post, st);
+};
+var mrg = function(a, b) {
+  var o = {};
+  for (var k in a)
+    o[k] = a[k];
+  for (var k in b)
+    o[k] = b[k];
+  return o;
+};
+var wbytes = function(d, b, v) {
+  for (; v; ++b)
+    d[b] = v, v >>>= 8;
+};
+function deflateSync(data, opts) {
+  return dopt(data, opts || {}, 0, 0);
 }
-function deployedBootstrapStack(input, expectedContractVersion) {
-  const stack = input && typeof input === "object" && "Stacks" in input ? input.Stacks?.[0] : input;
-  if (!stack || typeof stack !== "object") throw new Error("Deployed stack JSON contains no stack");
-  const deployed = stack;
-  const contract = deployed.Outputs?.find(
-    (output) => output.OutputKey === "BootstrapContractVersion"
-  )?.OutputValue;
-  if (contract !== expectedContractVersion)
-    throw new Error(
-      `Bootstrap contract mismatch (deployed: ${contract ?? "missing"}; expected: ${expectedContractVersion}); follow the documented migration procedure`
-    );
-  if (deployed.Parameters && !Array.isArray(deployed.Parameters))
-    throw new Error("Deployed stack JSON has invalid Parameters");
-  return deployed;
+var fltn = function(d, p, t, o) {
+  for (var k in d) {
+    var val = d[k], n = p + k, op = o;
+    if (Array.isArray(val))
+      op = mrg(o, val[1]), val = val[0];
+    if (ArrayBuffer.isView(val))
+      t[n] = [val, op];
+    else {
+      t[n += "/"] = [new u8(0), op];
+      fltn(val, n, t, o);
+    }
+  }
+};
+var te = typeof TextEncoder != "undefined" && /* @__PURE__ */ new TextEncoder();
+var td = typeof TextDecoder != "undefined" && /* @__PURE__ */ new TextDecoder();
+var tds = 0;
+try {
+  td.decode(et, { stream: true });
+  tds = 1;
+} catch (e) {
 }
-function coreBootstrapOutputs(stack) {
-  const values = Object.fromEntries(
-    (stack.Outputs ?? []).filter(
-      (output) => Boolean(output.OutputValue)
-    ).map((output) => [output.OutputKey, output.OutputValue])
-  );
-  const required2 = ["ArtifactBucketName", "ApplicationStackName", "CloudFormationExecutionRoleArn"];
-  const missing = required2.filter((key) => !values[key]);
-  if (missing.length) throw new Error(`Core stack JSON is missing outputs: ${missing.join(", ")}`);
-  return values;
+function strToU8(str, latin1) {
+  if (latin1) {
+    var ar_1 = new u8(str.length);
+    for (var i2 = 0; i2 < str.length; ++i2)
+      ar_1[i2] = str.charCodeAt(i2);
+    return ar_1;
+  }
+  if (te)
+    return te.encode(str);
+  var l = str.length;
+  var ar = new u8(str.length + (str.length >> 1));
+  var ai = 0;
+  var w = function(v) {
+    ar[ai++] = v;
+  };
+  for (var i2 = 0; i2 < l; ++i2) {
+    if (ai + 5 > ar.length) {
+      var n = new u8(ai + 8 + (l - i2 << 1));
+      n.set(ar);
+      ar = n;
+    }
+    var c = str.charCodeAt(i2);
+    if (c < 128 || latin1)
+      w(c);
+    else if (c < 2048)
+      w(192 | c >> 6), w(128 | c & 63);
+    else if (c > 55295 && c < 57344)
+      c = 65536 + (c & 1023 << 10) | str.charCodeAt(++i2) & 1023, w(240 | c >> 18), w(128 | c >> 12 & 63), w(128 | c >> 6 & 63), w(128 | c & 63);
+    else
+      w(224 | c >> 12), w(128 | c >> 6 & 63), w(128 | c & 63);
+  }
+  return slc(ar, 0, ai);
 }
-function requiredBootstrapParameters(kind, values) {
-  const keys = kind === "core" ? ["ArtifactBucketName", "ApplicationStackName", "DashboardFunctionName"] : [
-    "GitHubOidcProviderArn",
-    "GitHubRepository",
-    "GitHubOwnerId",
-    "GitHubRepositoryId",
-    "GitHubEnvironment",
-    "CoreBootstrapStackName",
-    "ApplicationStackName",
-    "ArtifactBucketName",
-    "CloudFormationExecutionRoleArn"
-  ];
-  const missing = keys.filter((key) => !values[key]);
-  if (missing.length) throw new Error(`Missing required bootstrap values: ${missing.join(", ")}`);
-  const optional2 = kind === "core" ? ["RuntimeSecretArn", "ArtifactKmsKeyArn"] : ["ConsumerGatewayStackName"];
-  return [...keys, ...optional2].filter((key) => values[key] !== void 0).map((ParameterKey) => ({ ParameterKey, ParameterValue: values[ParameterKey] ?? "" }));
+var exfl = function(ex) {
+  var le = 0;
+  if (ex) {
+    for (var k in ex) {
+      var l = ex[k].length;
+      if (l > 65535)
+        err(9);
+      le += l + 4;
+    }
+  }
+  return le;
+};
+var wzh = function(d, b, f, fn, u, c, ce, co) {
+  var fl2 = fn.length, ex = f.extra, col = co && co.length;
+  var exl = exfl(ex);
+  wbytes(d, b, ce != null ? 33639248 : 67324752), b += 4;
+  if (ce != null)
+    d[b++] = 20, d[b++] = f.os;
+  d[b] = 20, b += 2;
+  d[b++] = f.flag << 1 | (c < 0 && 8), d[b++] = u && 8;
+  d[b++] = f.compression & 255, d[b++] = f.compression >> 8;
+  var dt = new Date(f.mtime == null ? Date.now() : f.mtime), y = dt.getFullYear() - 1980;
+  if (y < 0 || y > 119)
+    err(10);
+  wbytes(d, b, y << 25 | dt.getMonth() + 1 << 21 | dt.getDate() << 16 | dt.getHours() << 11 | dt.getMinutes() << 5 | dt.getSeconds() >> 1), b += 4;
+  if (c != -1) {
+    wbytes(d, b, f.crc);
+    wbytes(d, b + 4, c < 0 ? -c - 2 : c);
+    wbytes(d, b + 8, f.size);
+  }
+  wbytes(d, b + 12, fl2);
+  wbytes(d, b + 14, exl), b += 16;
+  if (ce != null) {
+    wbytes(d, b, col);
+    wbytes(d, b + 6, f.attrs);
+    wbytes(d, b + 10, ce), b += 14;
+  }
+  d.set(fn, b);
+  b += fl2;
+  if (exl) {
+    for (var k in ex) {
+      var exf = ex[k], l = exf.length;
+      wbytes(d, b, +k);
+      wbytes(d, b + 2, l);
+      d.set(exf, b + 4), b += 4 + l;
+    }
+  }
+  if (col)
+    d.set(co, b), b += col;
+  return b;
+};
+var wzf = function(o, b, c, d, e) {
+  wbytes(o, b, 101010256);
+  wbytes(o, b + 8, c);
+  wbytes(o, b + 10, c);
+  wbytes(o, b + 12, d);
+  wbytes(o, b + 16, e);
+};
+function zipSync(data, opts) {
+  if (!opts)
+    opts = {};
+  var r = {};
+  var files = [];
+  fltn(data, "", r, opts);
+  var o = 0;
+  var tot = 0;
+  for (var fn in r) {
+    var _a2 = r[fn], file = _a2[0], p = _a2[1];
+    var compression = p.level == 0 ? 0 : 8;
+    var f = strToU8(fn), s = f.length;
+    var com = p.comment, m = com && strToU8(com), ms = m && m.length;
+    var exl = exfl(p.extra);
+    if (s > 65535)
+      err(11);
+    var d = compression ? deflateSync(file, p) : file, l = d.length;
+    var c = crc();
+    c.p(file);
+    files.push(mrg(p, {
+      size: file.length,
+      crc: c.d(),
+      c: d,
+      f,
+      m,
+      u: s != fn.length || m && com.length != ms,
+      o,
+      compression
+    }));
+    o += 30 + s + exl + l;
+    tot += 76 + 2 * (s + exl) + (ms || 0) + l;
+  }
+  var out = new u8(tot + 22), oe = o, cdl = tot - o;
+  for (var i2 = 0; i2 < files.length; ++i2) {
+    var f = files[i2];
+    wzh(out, f.o, f, f.f, f.u, f.c.length);
+    var badd = 30 + f.f.length + exfl(f.extra);
+    out.set(f.c, f.o + badd);
+    wzh(out, o, f, f.f, f.u, f.c.length, f.o, f.m), o += 16 + badd + (f.m ? f.m.length : 0);
+  }
+  wzf(out, o, files.length, cdl, oe);
+  return out;
 }
 
+// packages/aws/src/index.ts
+import { parseDocument, Scalar } from "yaml";
+
 // packages/aws/src/bootstrap-check.ts
 function formatBootstrapCheckText(result) {
   const lines = [`AWS bootstrap consistency (${result.packageVersion})`];
@@ -1473,14 +1515,16 @@ var githubOidcProvider = {
     }
   }
 };
-async function contracts() {
+async function contracts(config) {
   return {
-    core: bootstrapContractVersion(await bootstrapTemplate("core")),
-    githubOidc: bootstrapContractVersion(await bootstrapTemplate("github-oidc"))
+    core: bootstrapContractVersion(await bootstrapTemplate("core", computeMode(config))),
+    githubOidc: bootstrapContractVersion(
+      await bootstrapTemplate("github-oidc", computeMode(config))
+    )
   };
 }
 async function bootstrapHandoff(input) {
-  const expectedContracts = await contracts();
+  const expectedContracts = await contracts(input.config);
   const coreCapturePath = input.coreStackPath ?? workFile(input.workDir, "core-deployed-stack.json");
   const core = input.coreStack === void 0 ? void 0 : deployedBootstrapStack(input.coreStack, expectedContracts.core);
   const oidc = input.githubOidcStack === void 0 ? void 0 : deployedBootstrapStack(input.githubOidcStack, expectedContracts.githubOidc);
@@ -1490,7 +1534,7 @@ async function bootstrapHandoff(input) {
       ApplicationStackName: input.config.core?.applicationStackName,
       DashboardFunctionName: input.config.core?.dashboardFunctionName
     });
-    const templatePath = await bootstrapTemplatePath("core");
+    const templatePath = await bootstrapTemplatePath("core", computeMode(input.config));
     return {
       phase: "core",
       expectedContracts,
@@ -1530,7 +1574,7 @@ async function bootstrapHandoff(input) {
       ConsumerGatewayStackName: input.config.githubOidc?.consumerGatewayStackName,
       ...coreBootstrapOutputs(core)
     });
-    const templatePath = await bootstrapTemplatePath("github-oidc");
+    const templatePath = await bootstrapTemplatePath("github-oidc", computeMode(input.config));
     return {
       phase: "github-oidc",
       expectedContracts,
@@ -1597,7 +1641,7 @@ function assertEqual(actual, expected, label) {
     );
 }
 async function verifyBootstrap(input) {
-  const expected = await contracts();
+  const expected = await contracts(input.config);
   const core = deployedBootstrapStack(input.coreStack, expected.core);
   const oidc = deployedBootstrapStack(input.githubOidcStack, expected.githubOidc);
   for (const [kind, capture] of [
@@ -1745,6 +1789,7 @@ async function discovered(input) {
   const repo = await optional(input.runner, "gh", ["api", `repos/${input.repository}`]);
   const github = parseOrUnavailable(repo) ?? {};
   return {
+    ...input.mode ? { mode: input.mode } : {},
     accountId,
     region: region2?.trim() || void 0,
     ownerId: typeof github.owner?.id === "number" || typeof github.owner?.id === "string" ? String(github.owner.id) : void 0,
@@ -1760,6 +1805,8 @@ async function scaffoldBootstrapManifest(input) {
   const environment = value(input.environment, "environment");
   const providerArn = value(input.providerArn, "github OIDC provider ARN");
   if (!accountFromArn(providerArn)) throw new Error("github OIDC provider ARN is invalid");
+  if (input.mode && input.mode !== "lambda" && input.mode !== "ecs")
+    throw new Error("mode must be lambda or ecs");
   const found = await discovered(input);
   const accountId = input.accountId ?? found.accountId;
   const region2 = input.region ?? found.region;
@@ -1983,27 +2030,45 @@ async function bootstrapGuide(input) {
 
 // packages/aws/src/index.ts
 var run = promisify(execFile);
+function requireImageDigest(image) {
+  if (!/^[^\s@]+@sha256:[a-f0-9]{64}$/.test(image))
+    throw new Error(
+      "ECS imageReference must be an immutable registry digest (image@sha256:<64 hex>)"
+    );
+  return image;
+}
 function deploymentTemplate(template, values) {
-  const listed = template.match(/^ {2}PackageManagedParameters: \[([^\]]*)\]\s*$/m)?.[1];
-  if (listed === void 0)
+  const document = parseDocument(template);
+  if (document.errors.length)
+    throw new Error(`Invalid CloudFormation template: ${document.errors[0]}`);
+  const managedValue = document.toJS().Metadata?.PackageManagedParameters;
+  if (!Array.isArray(managedValue))
     throw new Error("CloudFormation template has no PackageManagedParameters metadata");
-  const managed = listed.split(",").map((key) => key.trim()).filter(Boolean);
+  const managed = managedValue.filter((key) => typeof key === "string");
+  if (managed.length !== managedValue.length)
+    throw new Error("CloudFormation template has invalid PackageManagedParameters metadata");
   const missing = managed.filter((key) => !Object.hasOwn(values, key));
   const unknown = Object.keys(values).filter((key) => !managed.includes(key));
   if (missing.length || unknown.length)
     throw new Error(
       `Package-managed CloudFormation parameters are out of sync (missing: ${missing.join(", ") || "none"}; unknown: ${unknown.join(", ") || "none"})`
     );
-  return managed.reduce((rendered, key) => {
-    const pattern = new RegExp(`^  ${key}: \\{[^\\n]+\\}\\s*$`, "m");
-    const declaration = rendered.match(pattern)?.[0];
-    if (!declaration || /\bDefault:/.test(declaration))
-      throw new Error(`Unable to set the CloudFormation default for ${key}`);
-    return rendered.replace(
-      pattern,
-      declaration.replace(/\s*}\s*$/, `, Default: ${JSON.stringify(values[key])} }`)
-    );
-  }, template);
+  for (const key of managed) {
+    const path = ["Parameters", key];
+    const parameter2 = document.getIn(path);
+    if (!parameter2 || typeof parameter2 !== "object")
+      throw new Error(`CloudFormation template has no declaration for ${key}`);
+    const current = document.getIn([...path, "Default"], true);
+    if (current !== void 0) {
+      if (String(current) !== values[key])
+        throw new Error(`Package-managed CloudFormation parameter ${key} has a conflicting default`);
+    } else {
+      const scalar = new Scalar(values[key]);
+      scalar.type = "QUOTE_DOUBLE";
+      document.setIn([...path, "Default"], scalar);
+    }
+  }
+  return document.toString({ lineWidth: 0 });
 }
 async function packageLambda(options) {
   const outputDir = resolve2(options.outputDir);
@@ -2022,6 +2087,7 @@ async function packageLambda(options) {
   });
   const runtimeMetadata = {
     ...release.metadata,
+    computeMode: "lambda",
     artifactChecksums: {
       ...release.metadata.artifactChecksums,
       "index.mjs": sha256(await readFile3(join2(runtimeDir, "index.mjs")))
@@ -2058,13 +2124,49 @@ async function packageLambda(options) {
 `);
   await writeFile2(
     join2(outputDir, "template.yml"),
-    deploymentTemplate(await cloudFormationTemplate(), {
+    deploymentTemplate(await cloudFormationTemplate("lambda"), {
+      ComputeMode: "lambda",
       LambdaArtifactKey: packagedRelease.artifactKey,
       DashboardVersion: packagedRelease.dashboardVersion
     })
   );
   return packagedRelease;
 }
+async function packageEcs(options) {
+  const outputDir = resolve2(options.outputDir);
+  await mkdir2(outputDir, { recursive: true });
+  const imageReference = requireImageDigest(options.imageReference ?? "");
+  const release = await assembleRelease({
+    boardConfigPath: options.boardConfigPath,
+    outputDir,
+    version: options.version,
+    providers: ["aws-ecs-fargate"],
+    assetDomain: options.assetDomain,
+    secretReference: options.secretReference
+  });
+  const packagedRelease = {
+    ...release.metadata,
+    computeMode: "ecs",
+    image: imageReference,
+    artifactKey: `ecs/${sha256(JSON.stringify({ ...release.metadata, image: imageReference }))}`
+  };
+  await writeFile2(join2(outputDir, "release.json"), `${JSON.stringify(packagedRelease, null, 2)}
+`);
+  await writeFile2(
+    join2(outputDir, "template.yml"),
+    deploymentTemplate(await cloudFormationTemplate("ecs"), {
+      ComputeMode: "ecs",
+      Image: imageReference,
+      DashboardVersion: packagedRelease.dashboardVersion
+    })
+  );
+  await writeFile2(
+    join2(outputDir, "SHA256SUMS"),
+    `${sha256(await readFile3(join2(outputDir, "release.json")))}  release.json
+`
+  );
+  return packagedRelease;
+}
 async function publishClientAssets(options) {
   const assetsDir = resolve2(options.assetsDir);
   await readFile3(join2(assetsDir, "index.html"));
@@ -2089,8 +2191,13 @@ async function publishClientAssets(options) {
   ]);
   return assetPath;
 }
-async function cloudFormationTemplate() {
-  return readFile3(fileURLToPath2(new URL("../template.yml", import.meta.url)), "utf8");
+async function cloudFormationTemplate(mode = "lambda") {
+  return readFile3(
+    fileURLToPath2(
+      new URL(mode === "ecs" ? "../template-ecs.yml" : "../template.yml", import.meta.url)
+    ),
+    "utf8"
+  );
 }
 
 // packages/aws/src/doctor.ts
@@ -2117,7 +2224,11 @@ function readParameterValues(value2) {
   return parameters;
 }
 async function templateContract(parameters) {
-  const template = await cloudFormationTemplate();
+  const values = Object.fromEntries(
+    parameters.map((item) => [item.ParameterKey, item.ParameterValue])
+  );
+  const mode = computeMode({ mode: values.ComputeMode });
+  const template = await cloudFormationTemplate(mode);
   const parametersBlock = template.match(
     /^Parameters:\n[\s\S]*?(?=^[A-Za-z][A-Za-z0-9]*:\s*$)/m
   )?.[0];
@@ -2130,9 +2241,6 @@ async function templateContract(parameters) {
   if (!Array.isArray(managedValue) || !managedValue.every((key) => typeof key === "string"))
     throw new Error("template has invalid PackageManagedParameters metadata");
   const managed = new Set(managedValue);
-  const values = Object.fromEntries(
-    parameters.map((item) => [item.ParameterKey, item.ParameterValue])
-  );
   const stale = Object.keys(values).filter((key) => !Object.hasOwn(definitions, key));
   const missing = Object.entries(definitions).filter(
     ([key, definition]) => !Object.hasOwn(definition, "Default") && !managed.has(key) && !Object.hasOwn(values, key)
@@ -2192,9 +2300,11 @@ async function runDoctor(options, dependencies = actualDependencies) {
       JSON.parse(await readFile4(options.parametersPath, "utf8"))
     );
     parameterData = await templateContract(parameters);
-    return `${options.parametersPath} is compatible`;
+    return `${options.parametersPath} is compatible (${computeMode({ mode: parameterData.values.ComputeMode })})`;
   });
   await check("Artifact bucket", async () => {
+    if (computeMode({ mode: parameterData?.values.ComputeMode }) === "ecs")
+      return "not required for ECS image deployments";
     const bucket = parameterData?.values.LambdaArtifactBucket;
     if (!bucket) throw new Error("skipped because parameters do not provide LambdaArtifactBucket");
     if (!awsAvailable) throw new Error("skipped because the AWS CLI is unavailable");
@@ -2318,6 +2428,7 @@ function bootstrapValues(config, coreOutputs = {}) {
     DashboardFunctionName: option("--function-name", config.core?.dashboardFunctionName),
     RuntimeSecretArn: option("--runtime-secret-arn", config.core?.runtimeSecretArn ?? ""),
     ArtifactKmsKeyArn: option("--artifact-kms-key-arn", config.core?.artifactKmsKeyArn ?? ""),
+    ComputeMode: computeMode(config),
     GitHubOidcProviderArn: option("--github-oidc-provider-arn", config.githubOidc?.providerArn),
     GitHubRepository: option("--github-repository", config.githubOidc?.repository),
     GitHubOwnerId: option("--github-owner-id", config.githubOidc?.ownerId),
@@ -2340,8 +2451,8 @@ function bootstrapStackName(kind, config) {
 function shellCommand(command) {
   return command.map((argument) => `'${argument.replaceAll("'", `'\\"'\\"'`)}'`).join(" ");
 }
-async function templateParameters() {
-  const template = await cloudFormationTemplate();
+async function templateParameters(mode = "lambda") {
+  const template = await cloudFormationTemplate(mode);
   const block = template.match(/^Parameters:\n[\s\S]*?(?=^[A-Za-z][A-Za-z0-9]*:\s*$)/m)?.[0];
   if (!block) throw new Error("Unable to read Parameters from the CloudFormation template");
   const parsed = parse3(block);
@@ -2368,7 +2479,9 @@ function validateConsumerParameters(supplied, template) {
   const unknown = Object.keys(values).filter((key) => !templateKeys.includes(key));
   if (unknown.length)
     throw new Error(`Parameter file contains unknown parameters: ${unknown.join(", ")}`);
-  const overridden = [...template.packageManaged].filter((key) => Object.hasOwn(values, key));
+  const overridden = [...template.packageManaged].filter(
+    (key) => key !== "ComputeMode" && Object.hasOwn(values, key)
+  );
   if (overridden.length)
     throw new Error(
       `Parameter file must not set package-managed parameters: ${overridden.join(", ")}`
@@ -2392,23 +2505,26 @@ function deploymentHandoff(input) {
   const prefix = input.outputDir.replace(/\/+$/, "");
   const path = (name) => `${prefix}/${name}`;
   const parameterFile = path("parameters.json");
+  const mode = input.release.computeMode;
+  const upload = mode === "lambda" ? [
+    "aws",
+    "s3",
+    "cp",
+    path("lambda.zip"),
+    `s3://${input.artifactBucket}/${input.artifactKey}`,
+    "--region",
+    "$AWS_REGION"
+  ] : [];
   return {
+    mode,
     template: "template.yml",
-    lambdaZip: "lambda.zip",
+    ...mode === "lambda" ? { lambdaZip: "lambda.zip" } : { image: input.release.image },
     releaseFile: "release.json",
     artifact: { bucket: input.artifactBucket, key: input.artifactKey },
     release: input.release,
     parameters: "parameters.json",
     commands: {
-      upload: [
-        "aws",
-        "s3",
-        "cp",
-        path("lambda.zip"),
-        `s3://${input.artifactBucket}/${input.artifactKey}`,
-        "--region",
-        "$AWS_REGION"
-      ],
+      upload,
       deploy: [
         "aws",
         "cloudformation",
@@ -2483,12 +2599,17 @@ try {
     const existingValues = Object.fromEntries(
       existing.map(({ ParameterKey, ParameterValue }) => [ParameterKey, ParameterValue])
     );
+    const mode = resolveComputeMode({
+      persisted: consumerConfig?.mode,
+      artifact: existingValues.ComputeMode,
+      explicit: option("--mode")
+    });
     const artifactBucket = option(
       "--artifact-bucket",
       existingValues.LambdaArtifactBucket ?? consumerConfig?.core?.artifactBucketName
     );
-    if (!artifactBucket) throw new Error("--artifact-bucket is required");
-    const { definitions, packageManaged } = await templateParameters();
+    if (mode === "lambda" && !artifactBucket) throw new Error("--artifact-bucket is required");
+    const { definitions, packageManaged } = await templateParameters(mode);
     const templateKeys = Object.keys(definitions);
     const hasDefault = (key) => Object.hasOwn(definitions[key] ?? {}, "Default");
     const hasValue = (key) => key === "LambdaArtifactBucket" || Object.hasOwn(existingValues, key);
@@ -2506,10 +2627,10 @@ try {
     const includeDefaults = args.includes("--include-defaults");
     const functionName = option("--function-name", consumerConfig?.core?.dashboardFunctionName);
     const parameters = templateKeys.filter(
-      (key) => !packageManaged.has(key) && (includeDefaults || !hasDefault(key) || Object.hasOwn(existingValues, key) || key === "Name" && Boolean(functionName))
+      (key) => (!packageManaged.has(key) || key === "ComputeMode") && (includeDefaults || !hasDefault(key) || Object.hasOwn(existingValues, key) || key === "Name" && Boolean(functionName))
     ).map((key) => {
       const definition = definitions[key];
-      const value2 = key === "LambdaArtifactBucket" ? artifactBucket : key === "Name" && functionName ? functionName : existingValues[key] ?? definition?.Default;
+      const value2 = key === "LambdaArtifactBucket" ? artifactBucket ?? "" : key === "ComputeMode" ? mode : key === "Name" && functionName ? functionName : existingValues[key] ?? definition?.Default;
       if (value2 === void 0) throw new Error(`No value for CloudFormation parameter ${key}`);
       return parameter(key, String(value2));
     });
@@ -2544,6 +2665,7 @@ try {
         ownerId: option("--github-owner-id"),
         repositoryId: option("--github-repository-id"),
         consumerGatewayStackName: option("--consumer-gateway-stack"),
+        mode: option("--mode", "lambda") ?? "lambda",
         runner
       });
       await writeFile3(output, `${JSON.stringify(manifest, null, 2)}
@@ -2638,11 +2760,13 @@ try {
         );
       } else if (action === "template") {
         const kind = bootstrapKind();
+        const mode = requireComputeMode(config, option("--mode"));
         console.log(
           JSON.stringify({
             kind,
-            template: await bootstrapTemplatePath(kind),
-            contractVersion: bootstrapContractVersion(await bootstrapTemplate(kind))
+            mode,
+            template: await bootstrapTemplatePath(kind, mode),
+            contractVersion: bootstrapContractVersion(await bootstrapTemplate(kind, mode))
           })
         );
       } else if (action === "plan") {
@@ -2683,6 +2807,7 @@ ${plan.notes.join("\n")}`);
         if (!result.ok) process.exitCode = 1;
       } else if (action === "parameters") {
         const kind = bootstrapKind();
+        const mode = requireComputeMode(config, option("--mode"));
         const output = option("--output", `aws-dashboard-bootstrap-${kind}.json`) ?? `aws-dashboard-bootstrap-${kind}.json`;
         let coreOutputs = {};
         const coreStackPath = option("--core-stack-json");
@@ -2690,17 +2815,20 @@ ${plan.notes.join("\n")}`);
           coreOutputs = coreBootstrapOutputs(
             deployedBootstrapStack(
               JSON.parse(await readFile5(coreStackPath, "utf8")),
-              bootstrapContractVersion(await bootstrapTemplate("core"))
+              bootstrapContractVersion(await bootstrapTemplate("core", mode))
             )
           );
         }
-        const supplied = requiredBootstrapParameters(kind, bootstrapValues(config, coreOutputs));
+        const supplied = requiredBootstrapParameters(
+          kind,
+          bootstrapValues({ ...config, mode }, coreOutputs)
+        );
         let parameters = supplied;
         const deployedStackPath = option("--deployed-stack-json");
         if (deployedStackPath) {
           const stack = deployedBootstrapStack(
             JSON.parse(await readFile5(deployedStackPath, "utf8")),
-            bootstrapContractVersion(await bootstrapTemplate(kind))
+            bootstrapContractVersion(await bootstrapTemplate(kind, mode))
           );
           if (kind === "github-oidc" && !(stack.Parameters ?? []).some(
             ({ ParameterKey }) => ParameterKey === "ConsumerGatewayStackName"
@@ -2773,23 +2901,39 @@ ${plan.notes.join("\n")}`);
       throw new Error("Unable to determine the package version; pass --version explicitly");
     const outputDir = option("--output", "aws-dashboard-release") ?? "aws-dashboard-release";
     const parametersPath = option("--parameters", "aws-dashboard-parameters.json") ?? "aws-dashboard-parameters.json";
-    const template = await templateParameters();
-    const consumerParameters = validateConsumerParameters(
-      await existingParameters(parametersPath),
-      template
-    );
+    const rawParameters = await existingParameters(parametersPath);
+    const rawMode = rawParameters.find(
+      ({ ParameterKey }) => ParameterKey === "ComputeMode"
+    )?.ParameterValue;
+    const mode = resolveComputeMode({ artifact: rawMode, explicit: option("--mode") });
+    const template = await templateParameters(mode);
+    const consumerParameters = validateConsumerParameters(rawParameters, template);
     const secretReference = consumerParameters.SecretReference ?? String(template.definitions.SecretReference?.Default ?? "");
-    const metadata = await packageLambda({
+    const metadata = mode === "lambda" ? await packageLambda({
       boardConfigPath: boardConfig,
       outputDir,
       version,
       assetDomain: option("--asset-domain"),
       secretReference
+    }) : await packageEcs({
+      boardConfigPath: boardConfig,
+      outputDir,
+      version,
+      assetDomain: option("--asset-domain"),
+      secretReference,
+      imageReference: option("--image")
     });
     const resolvedParameters = resolvedReleaseParameters(consumerParameters, template, {
+      ComputeMode: mode,
       LambdaArtifactKey: metadata.artifactKey,
+      Image: metadata.image ?? "",
       DashboardVersion: metadata.dashboardVersion
     });
+    if (mode === "lambda" && !rawParameters.some(({ ParameterKey }) => ParameterKey === "ComputeMode"))
+      resolvedParameters.splice(
+        resolvedParameters.findIndex(({ ParameterKey }) => ParameterKey === "ComputeMode"),
+        1
+      );
     await writeFile3(
       `${outputDir}/parameters.json`,
       `${JSON.stringify(resolvedParameters, null, 2)}
@@ -2803,7 +2947,9 @@ ${plan.notes.join("\n")}`);
     });
     await writeFile3(`${outputDir}/deployment.json`, `${JSON.stringify(handoff, null, 2)}
 `);
-    console.log(`Packaged ${outputDir}/lambda.zip and ${outputDir}/template.yml`);
+    console.log(
+      `Packaged ${mode === "lambda" ? `${outputDir}/lambda.zip` : metadata.image} and ${outputDir}/template.yml`
+    );
     console.log(`Complete parameters: ${outputDir}/parameters.json`);
     console.log(`Deployment handoff: ${outputDir}/deployment.json`);
     console.log(`Upload: ${copyableCommand(handoff.commands.upload)}`);