@iacmp/cli 1.1.0

package/dist/commands/diff.js

@@ -0,0 +1,4420 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// ../providers/aws/dist/synth/cloudformation.js
+var require_cloudformation = __commonJS({
+  "../providers/aws/dist/synth/cloudformation.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.synthesize = synthesize;
+    var INSTANCE_TYPE_MAP = {
+      small: "t3.small",
+      medium: "t3.medium",
+      large: "t3.large"
+    };
+    var AMI_MAP = {
+      "ubuntu": "{{resolve:ssm:/aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id}}",
+      "ubuntu-22.04": "{{resolve:ssm:/aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id}}",
+      "ubuntu-20.04": "{{resolve:ssm:/aws/service/canonical/ubuntu/server/20.04/stable/current/amd64/hvm/ebs-gp2/ami-id}}",
+      "amazon-linux-2": "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}",
+      "amazon-linux-2023": "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64}}",
+      "windows-2022": "{{resolve:ssm:/aws/service/ami-windows-latest/Windows_Server-2022-English-Full-Base}}",
+      "windows-2019": "{{resolve:ssm:/aws/service/ami-windows-latest/Windows_Server-2019-English-Full-Base}}",
+      "windows-2016": "{{resolve:ssm:/aws/service/ami-windows-latest/Windows_Server-2016-English-Full-Base}}"
+    };
+    var CACHE_NODE_TYPE_MAP = {
+      small: "cache.t3.micro",
+      medium: "cache.t3.medium",
+      large: "cache.r6g.large"
+    };
+    var K8S_NODE_TYPE_MAP = {
+      small: "t3.medium",
+      medium: "m5.large",
+      large: "m5.2xlarge"
+    };
+    function synthesizeConstruct(construct) {
+      const logicalId = construct.id.replace(/[^a-zA-Z0-9]/g, "");
+      const props = construct.props;
+      switch (construct.type) {
+        // ── Compute ──────────────────────────────────────────────────────────
+        case "Compute.Instance":
+          return [[logicalId, {
+            Type: "AWS::EC2::Instance",
+            Properties: {
+              InstanceType: INSTANCE_TYPE_MAP[props.instanceType] ?? "t3.small",
+              ImageId: AMI_MAP[props.image] ?? props.image
+            }
+          }]];
+        case "Compute.AutoScaling": {
+          const lcId = `${logicalId}LC`;
+          const asgId = `${logicalId}ASG`;
+          const spId = `${logicalId}ScalingPolicy`;
+          const lc = {
+            Type: "AWS::AutoScaling::LaunchConfiguration",
+            Properties: {
+              ImageId: AMI_MAP[props.image] ?? props.image,
+              InstanceType: INSTANCE_TYPE_MAP[props.instanceType] ?? "t3.small",
+              ...props.securityGroupIds ? { SecurityGroups: props.securityGroupIds } : {}
+            }
+          };
+          const asg = {
+            Type: "AWS::AutoScaling::AutoScalingGroup",
+            Properties: {
+              LaunchConfigurationName: { Ref: lcId },
+              MinSize: String(props.minCapacity ?? 1),
+              MaxSize: String(props.maxCapacity ?? 3),
+              DesiredCapacity: String(props.desiredCapacity ?? props.minCapacity ?? 1),
+              ...props.subnetIds ? { VPCZoneIdentifier: props.subnetIds } : {},
+              Tags: [{ Key: "Name", Value: logicalId, PropagateAtLaunch: true }]
+            }
+          };
+          const entries = [[lcId, lc], [asgId, asg]];
+          if (props.targetCpuUtilization) {
+            entries.push([spId, {
+              Type: "AWS::AutoScaling::ScalingPolicy",
+              Properties: {
+                AutoScalingGroupName: { Ref: asgId },
+                PolicyType: "TargetTrackingScaling",
+                TargetTrackingConfiguration: {
+                  PredefinedMetricSpecification: { PredefinedMetricType: "ASGAverageCPUUtilization" },
+                  TargetValue: props.targetCpuUtilization
+                }
+              }
+            }]);
+          }
+          return entries;
+        }
+        case "Compute.Container": {
+          const clusterLogicalId = `${logicalId}Cluster`;
+          const tdLogicalId = `${logicalId}TaskDef`;
+          const svcLogicalId = `${logicalId}Service`;
+          const environment = props.environment;
+          return [
+            [clusterLogicalId, {
+              Type: "AWS::ECS::Cluster",
+              Properties: { ClusterName: construct.id }
+            }],
+            [tdLogicalId, {
+              Type: "AWS::ECS::TaskDefinition",
+              Properties: {
+                Family: construct.id,
+                NetworkMode: "awsvpc",
+                RequiresCompatibilities: ["FARGATE"],
+                Cpu: String(props.cpu ?? 256),
+                Memory: String(props.memory ?? 512),
+                ExecutionRoleArn: { "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/ecsTaskExecutionRole" },
+                ContainerDefinitions: [{
+                  Name: construct.id,
+                  Image: props.image,
+                  PortMappings: props.port ? [{ ContainerPort: props.port, Protocol: "tcp" }] : [],
+                  Environment: environment ? Object.entries(environment).map(([k, v]) => ({ Name: k, Value: v })) : [],
+                  LogConfiguration: {
+                    LogDriver: "awslogs",
+                    Options: {
+                      "awslogs-group": `/ecs/${construct.id}`,
+                      "awslogs-region": { Ref: "AWS::Region" },
+                      "awslogs-stream-prefix": "ecs"
+                    }
+                  }
+                }]
+              }
+            }],
+            [svcLogicalId, {
+              Type: "AWS::ECS::Service",
+              Properties: {
+                Cluster: { Ref: clusterLogicalId },
+                TaskDefinition: { Ref: tdLogicalId },
+                DesiredCount: props.desiredCount ?? 1,
+                LaunchType: "FARGATE",
+                NetworkConfiguration: {
+                  AwsvpcConfiguration: {
+                    AssignPublicIp: props.publicIp ? "ENABLED" : "DISABLED",
+                    Subnets: []
+                  }
+                }
+              }
+            }]
+          ];
+        }
+        case "Compute.Kubernetes": {
+          return [
+            [logicalId, {
+              Type: "AWS::EKS::Cluster",
+              Properties: {
+                Name: construct.id,
+                Version: props.version ?? "1.29",
+                ResourcesVpcConfig: {
+                  SubnetIds: [],
+                  EndpointPrivateAccess: props.privateCluster ?? false,
+                  EndpointPublicAccess: !props.privateCluster
+                },
+                RoleArn: { "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/EKSClusterRole" }
+              }
+            }],
+            [`${logicalId}NodeGroup`, {
+              Type: "AWS::EKS::Nodegroup",
+              Properties: {
+                ClusterName: { Ref: logicalId },
+                NodegroupName: `${construct.id}-ng`,
+                ScalingConfig: {
+                  MinSize: props.minNodes ?? 1,
+                  MaxSize: props.maxNodes ?? 3,
+                  DesiredSize: props.desiredNodes ?? 2
+                },
+                InstanceTypes: [K8S_NODE_TYPE_MAP[props.nodeInstanceType ?? "medium"] ?? "m5.large"],
+                NodeRole: { "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/EKSNodeRole" },
+                Subnets: []
+              }
+            }]
+          ];
+        }
+        // ── Storage ───────────────────────────────────────────────────────────
+        case "Storage.Bucket": {
+          const lifecycleRules = props.lifecycleRules ?? [];
+          return [[logicalId, {
+            Type: "AWS::S3::Bucket",
+            Properties: {
+              VersioningConfiguration: props.versioning ? { Status: "Enabled" } : { Status: "Suspended" },
+              PublicAccessBlockConfiguration: {
+                BlockPublicAcls: !props.publicAccess,
+                BlockPublicPolicy: !props.publicAccess,
+                IgnorePublicAcls: !props.publicAccess,
+                RestrictPublicBuckets: !props.publicAccess
+              },
+              ...lifecycleRules.length > 0 ? {
+                LifecycleConfiguration: {
+                  Rules: lifecycleRules.map((r, i) => ({
+                    Id: `rule-${i}`,
+                    Status: "Enabled",
+                    ...r.prefix ? { Prefix: r.prefix } : {},
+                    ...r.expireAfterDays ? { ExpirationInDays: r.expireAfterDays } : {},
+                    ...r.transitionToGlacierDays ? {
+                      Transitions: [{ TransitionInDays: r.transitionToGlacierDays, StorageClass: "GLACIER" }]
+                    } : {}
+                  }))
+                }
+              } : {}
+            }
+          }]];
+        }
+        case "Storage.FileSystem": {
+          const accessPoints = props.accessPoints ?? [];
+          const entries = [[logicalId, {
+            Type: "AWS::EFS::FileSystem",
+            Properties: {
+              PerformanceMode: props.performanceMode ?? "generalPurpose",
+              ThroughputMode: props.throughputMode ?? "bursting",
+              Encrypted: props.encrypted ?? true,
+              LifecyclePolicies: [{ TransitionToIA: "AFTER_30_DAYS" }],
+              FileSystemTags: [{ Key: "Name", Value: construct.id }]
+            }
+          }]];
+          for (const ap of accessPoints) {
+            const apId = `${logicalId}AP${ap.name.replace(/[^a-zA-Z0-9]/g, "")}`;
+            entries.push([apId, {
+              Type: "AWS::EFS::AccessPoint",
+              Properties: {
+                FileSystemId: { Ref: logicalId },
+                RootDirectory: { Path: ap.path },
+                ...ap.uid ? { PosixUser: { Uid: String(ap.uid), Gid: String(ap.gid ?? ap.uid) } } : {},
+                AccessPointTags: [{ Key: "Name", Value: ap.name }]
+              }
+            }]);
+          }
+          return entries;
+        }
+        case "Storage.Archive": {
+          return [[logicalId, {
+            Type: "AWS::S3::Bucket",
+            Properties: {
+              LifecycleConfiguration: {
+                Rules: [{
+                  Id: "archive-rule",
+                  Status: "Enabled",
+                  Transitions: [{ TransitionInDays: 0, StorageClass: "DEEP_ARCHIVE" }],
+                  ...props.retentionDays ? { ExpirationInDays: props.retentionDays } : {}
+                }]
+              },
+              ObjectLockEnabled: props.lockEnabled ?? false,
+              PublicAccessBlockConfiguration: {
+                BlockPublicAcls: true,
+                BlockPublicPolicy: true,
+                IgnorePublicAcls: true,
+                RestrictPublicBuckets: true
+              }
+            }
+          }]];
+        }
+        // ── Network ───────────────────────────────────────────────────────────
+        case "Network.VPC":
+          return [[logicalId, {
+            Type: "AWS::EC2::VPC",
+            Properties: {
+              CidrBlock: props.cidr ?? "10.0.0.0/16",
+              EnableDnsHostnames: true,
+              EnableDnsSupport: true,
+              Tags: [{ Key: "Name", Value: logicalId }]
+            }
+          }]];
+        case "Network.Subnet": {
+          const isPublic = props.public ?? false;
+          return [[logicalId, {
+            Type: "AWS::EC2::Subnet",
+            Properties: {
+              VpcId: props.vpcId,
+              CidrBlock: props.cidr,
+              ...props.availabilityZone ? { AvailabilityZone: props.availabilityZone } : {},
+              MapPublicIpOnLaunch: isPublic,
+              Tags: [{ Key: "Name", Value: logicalId }, { Key: "Type", Value: isPublic ? "public" : "private" }]
+            }
+          }]];
+        }
+        case "Network.SecurityGroup": {
+          const ingress = props.ingressRules ?? [];
+          const egress = props.egressRules ?? [];
+          return [[logicalId, {
+            Type: "AWS::EC2::SecurityGroup",
+            Properties: {
+              GroupDescription: props.description ?? `Security group ${logicalId}`,
+              VpcId: props.vpcId,
+              SecurityGroupIngress: ingress.map((r, i) => {
+                if (r.cidr === void 0) {
+                  console.warn(`[aws] Security group rule sem CIDR; usando 0.0.0.0/0 \u2014 defina props.cidr explicitamente (${construct.id} ingress[${i}])`);
+                }
+                return {
+                  IpProtocol: r.protocol,
+                  FromPort: r.fromPort,
+                  ToPort: r.toPort,
+                  CidrIp: r.cidr ?? "0.0.0.0/0",
+                  ...r.description ? { Description: r.description } : {}
+                };
+              }),
+              SecurityGroupEgress: egress.length > 0 ? egress.map((r) => ({
+                IpProtocol: r.protocol,
+                FromPort: r.fromPort,
+                ToPort: r.toPort,
+                CidrIp: r.cidr ?? "0.0.0.0/0",
+                ...r.description ? { Description: r.description } : {}
+              })) : [{ IpProtocol: "-1", CidrIp: "0.0.0.0/0", Description: "Allow all egress" }],
+              Tags: [{ Key: "Name", Value: logicalId }]
+            }
+          }]];
+        }
+        case "Network.WAF": {
+          const rules = props.rules ?? [];
+          const defaultAction = props.defaultAction ?? "allow";
+          return [[logicalId, {
+            Type: "AWS::WAFv2::WebACL",
+            Properties: {
+              Name: logicalId,
+              Scope: props.scope ?? "REGIONAL",
+              DefaultAction: { [defaultAction === "block" ? "Block" : "Allow"]: {} },
+              Description: props.description ?? `WAF ${logicalId}`,
+              Rules: rules.map((r, i) => ({
+                Name: r.name ?? `rule-${i}`,
+                Priority: r.priority ?? i + 1,
+                Action: { [r.action === "block" ? "Block" : r.action === "count" ? "Count" : "Allow"]: {} },
+                VisibilityConfig: {
+                  SampledRequestsEnabled: true,
+                  CloudWatchMetricsEnabled: true,
+                  MetricName: (r.name ?? `rule${i}`).replace(/[^a-zA-Z0-9]/g, "")
+                },
+                Statement: r.managedGroup ? { ManagedRuleGroupStatement: { VendorName: "AWS", Name: r.managedGroup } } : {
+                  ByteMatchStatement: {
+                    SearchString: (r.matchValues ?? ["BadBot"])[0],
+                    FieldToMatch: { SingleHeader: { Name: "user-agent" } },
+                    TextTransformations: [{ Priority: 0, Type: "NONE" }],
+                    PositionalConstraint: "CONTAINS"
+                  }
+                }
+              })),
+              VisibilityConfig: {
+                SampledRequestsEnabled: true,
+                CloudWatchMetricsEnabled: true,
+                MetricName: logicalId
+              }
+            }
+          }]];
+        }
+        case "Network.LoadBalancer": {
+          const lbType = props.type ?? "application";
+          const listeners = props.listeners ?? [];
+          const targetGroups = props.targetGroups ?? [];
+          const entries = [[logicalId, {
+            Type: "AWS::ElasticLoadBalancingV2::LoadBalancer",
+            Properties: {
+              Name: construct.id,
+              Type: lbType,
+              Scheme: props.scheme ?? "internet-facing",
+              Subnets: props.subnetIds ?? [],
+              ...lbType === "application" && props.securityGroupIds ? { SecurityGroups: props.securityGroupIds } : {},
+              LoadBalancerAttributes: [
+                { Key: "deletion_protection.enabled", Value: String(props.deletionProtection ?? false) }
+              ]
+            }
+          }]];
+          for (const tg of targetGroups) {
+            const tgId = `${logicalId}TG${tg.name.replace(/[^a-zA-Z0-9]/g, "")}`;
+            entries.push([tgId, {
+              Type: "AWS::ElasticLoadBalancingV2::TargetGroup",
+              Properties: {
+                Name: tg.name,
+                Port: tg.port,
+                Protocol: tg.protocol,
+                VpcId: "",
+                HealthCheckPath: tg.healthCheckPath ?? "/",
+                HealthCheckPort: String(tg.healthCheckPort ?? tg.port),
+                TargetType: "ip"
+              }
+            }]);
+          }
+          for (let i = 0; i < listeners.length; i++) {
+            const l = listeners[i];
+            entries.push([`${logicalId}Listener${i + 1}`, {
+              Type: "AWS::ElasticLoadBalancingV2::Listener",
+              Properties: {
+                LoadBalancerArn: { Ref: logicalId },
+                Port: l.port,
+                Protocol: l.protocol,
+                ...l.certificateArn ? { Certificates: [{ CertificateArn: l.certificateArn }] } : {},
+                DefaultActions: l.redirectToHttps ? [{ Type: "redirect", RedirectConfig: { Protocol: "HTTPS", Port: "443", StatusCode: "HTTP_301" } }] : [{ Type: "fixed-response", FixedResponseConfig: { StatusCode: "404", MessageBody: "Not found", ContentType: "text/plain" } }]
+              }
+            }]);
+          }
+          return entries;
+        }
+        case "Network.CDN": {
+          const origins = props.origins ?? [];
+          const cachePolicies = props.cachePolicies ?? [];
+          return [[logicalId, {
+            Type: "AWS::CloudFront::Distribution",
+            Properties: {
+              DistributionConfig: {
+                Enabled: true,
+                HttpVersion: props.httpVersion ?? "http2",
+                PriceClass: props.priceClass ?? "PriceClass_100",
+                DefaultRootObject: props.defaultRootObject ?? "index.html",
+                ...props.aliases ? { Aliases: props.aliases } : {},
+                ...props.certificateArn ? { ViewerCertificate: { AcmCertificateArn: props.certificateArn, SslSupportMethod: "sni-only", MinimumProtocolVersion: "TLSv1.2_2021" } } : { ViewerCertificate: { CloudFrontDefaultCertificate: true } },
+                ...props.wafAclId ? { WebACLId: props.wafAclId } : {},
+                Origins: origins.map((o) => ({
+                  Id: o.id,
+                  DomainName: o.domainName,
+                  OriginPath: o.path ?? "",
+                  CustomOriginConfig: { HTTPSPort: 443, OriginProtocolPolicy: o.protocol ?? "https-only" }
+                })),
+                DefaultCacheBehavior: {
+                  TargetOriginId: origins[0].id,
+                  ViewerProtocolPolicy: "redirect-to-https",
+                  AllowedMethods: ["GET", "HEAD", "OPTIONS"],
+                  CachedMethods: ["GET", "HEAD"],
+                  Compress: true,
+                  ForwardedValues: { QueryString: false, Cookies: { Forward: "none" } }
+                },
+                CacheBehaviors: cachePolicies.map((cp) => ({
+                  PathPattern: cp.pathPattern,
+                  TargetOriginId: origins[0].id,
+                  ViewerProtocolPolicy: "redirect-to-https",
+                  DefaultTTL: cp.ttlSeconds ?? 86400,
+                  MaxTTL: (cp.ttlSeconds ?? 86400) * 2,
+                  Compress: cp.compress ?? true,
+                  ForwardedValues: { QueryString: true, Cookies: { Forward: "all" } },
+                  AllowedMethods: ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"],
+                  CachedMethods: ["GET", "HEAD"]
+                }))
+              }
+            }
+          }]];
+        }
+        case "Network.Dns": {
+          const records = props.records ?? [];
+          const hostedZoneId = `${logicalId}Zone`;
+          const entries = [[hostedZoneId, {
+            Type: "AWS::Route53::HostedZone",
+            Properties: {
+              Name: props.zoneName,
+              HostedZoneConfig: { Comment: `Zone for ${props.zoneName}` }
+            }
+          }]];
+          for (const r of records) {
+            const recId = `${logicalId}${r.name.replace(/[^a-zA-Z0-9]/g, "")}${r.type}`;
+            entries.push([recId, {
+              Type: "AWS::Route53::RecordSet",
+              Properties: {
+                HostedZoneId: { Ref: hostedZoneId },
+                Name: r.name,
+                Type: r.type,
+                TTL: String(r.ttl ?? 300),
+                ...r.aliasTarget ? { AliasTarget: { DNSName: r.aliasTarget, HostedZoneId: "Z35SXDOTRQ7X7K" } } : { ResourceRecords: r.values }
+              }
+            }]);
+          }
+          return entries;
+        }
+        // ── Database ──────────────────────────────────────────────────────────
+        case "Database.SQL": {
+          const engine = props.engine;
+          const edition = props.edition ?? "";
+          const engineMap = {
+            mysql: { Engine: "mysql", EngineVersion: "8.0.36" },
+            postgres: { Engine: "postgres", EngineVersion: "15.4" },
+            mariadb: { Engine: "mariadb", EngineVersion: "10.11.6" },
+            oracle: { Engine: `oracle-${edition || "se2"}`, EngineVersion: "19.0.0.0.ru-2024-01.rur-2024-01.r1" },
+            sqlserver: { Engine: `sqlserver-${edition || "ex"}`, EngineVersion: "15.00.4365.2.v1" }
+          };
+          const mapped = engineMap[engine] ?? engineMap["mysql"];
+          const isOracle = engine === "oracle";
+          const isSqlServer = engine === "sqlserver";
+          const licenseModel = props.licenseModel ?? (isOracle || isSqlServer ? "license-included" : void 0);
+          const masterUser = isSqlServer ? "sqladmin" : "dbadmin";
+          const defaultInstance = isOracle || isSqlServer ? "db.t3.small" : "db.t3.micro";
+          const rdsProps = {
+            DBInstanceClass: props.instanceType ?? defaultInstance,
+            Engine: mapped.Engine,
+            EngineVersion: mapped.EngineVersion,
+            AllocatedStorage: String(props.storageGb ?? 20),
+            MultiAZ: props.multiAz ?? false,
+            MasterUsername: masterUser,
+            MasterUserPassword: { "Fn::Sub": "{{resolve:ssm:/iacmp/${AWS::StackName}/db-password}}" },
+            StorageEncrypted: true,
+            BackupRetentionPeriod: props.backupRetentionDays ?? 7,
+            DeletionProtection: props.deletionProtection ?? false
+          };
+          if (licenseModel)
+            rdsProps["LicenseModel"] = licenseModel;
+          return [[logicalId, {
+            Type: "AWS::RDS::DBInstance",
+            DeletionPolicy: props.deletionProtection ? "Retain" : "Snapshot",
+            Properties: rdsProps
+          }]];
+        }
+        case "Database.DocumentDB": {
+          const instances = props.instances ?? 1;
+          const clusterLogicalId = `${logicalId}Cluster`;
+          const entries = [[clusterLogicalId, {
+            Type: "AWS::DocDB::DBCluster",
+            DeletionPolicy: props.deletionProtection ? "Retain" : "Snapshot",
+            Properties: {
+              DBClusterIdentifier: construct.id.toLowerCase(),
+              MasterUsername: "docdbadmin",
+              MasterUserPassword: { "Fn::Sub": "{{resolve:ssm:/iacmp/${AWS::StackName}/docdb-password}}" },
+              StorageEncrypted: true,
+              BackupRetentionPeriod: 7,
+              DeletionProtection: props.deletionProtection ?? false
+            }
+          }]];
+          for (let i = 0; i < instances; i++) {
+            entries.push([`${logicalId}Instance${i + 1}`, {
+              Type: "AWS::DocDB::DBInstance",
+              Properties: {
+                DBClusterIdentifier: { Ref: clusterLogicalId },
+                DBInstanceClass: props.instanceType ?? "db.t3.medium",
+                DBInstanceIdentifier: `${construct.id.toLowerCase()}-${i + 1}`
+              }
+            }]);
+          }
+          return entries;
+        }
+        case "Database.DynamoDB": {
+          const billingMode = props.billingMode ?? "PAY_PER_REQUEST";
+          const gsis = props.globalSecondaryIndexes ?? [];
+          const attrDefs = [
+            { AttributeName: props.partitionKey, AttributeType: "S" },
+            ...props.sortKey ? [{ AttributeName: props.sortKey, AttributeType: "S" }] : [],
+            ...gsis.map((g) => ({ AttributeName: g.partitionKey, AttributeType: "S" })),
+            ...gsis.filter((g) => g.sortKey).map((g) => ({ AttributeName: g.sortKey, AttributeType: "S" }))
+          ].filter((v, i, a) => a.findIndex((x) => x.AttributeName === v.AttributeName) === i);
+          return [[logicalId, {
+            Type: "AWS::DynamoDB::Table",
+            DeletionPolicy: "Retain",
+            Properties: {
+              TableName: construct.id,
+              BillingMode: billingMode,
+              ...billingMode === "PROVISIONED" ? {
+                ProvisionedThroughput: { ReadCapacityUnits: props.readCapacity ?? 5, WriteCapacityUnits: props.writeCapacity ?? 5 }
+              } : {},
+              AttributeDefinitions: attrDefs,
+              KeySchema: [
+                { AttributeName: props.partitionKey, KeyType: "HASH" },
+                ...props.sortKey ? [{ AttributeName: props.sortKey, KeyType: "RANGE" }] : []
+              ],
+              ...gsis.length > 0 ? {
+                GlobalSecondaryIndexes: gsis.map((g) => ({
+                  IndexName: g.name,
+                  KeySchema: [
+                    { AttributeName: g.partitionKey, KeyType: "HASH" },
+                    ...g.sortKey ? [{ AttributeName: g.sortKey, KeyType: "RANGE" }] : []
+                  ],
+                  Projection: { ProjectionType: "ALL" },
+                  ...billingMode === "PROVISIONED" ? {
+                    ProvisionedThroughput: { ReadCapacityUnits: 5, WriteCapacityUnits: 5 }
+                  } : {}
+                }))
+              } : {},
+              ...props.ttlAttribute ? { TimeToLiveSpecification: { AttributeName: props.ttlAttribute, Enabled: true } } : {},
+              PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: props.pointInTimeRecovery ?? true },
+              ...props.streamEnabled ? { StreamSpecification: { StreamViewType: "NEW_AND_OLD_IMAGES" } } : {}
+            }
+          }]];
+        }
+        // ── Cache ─────────────────────────────────────────────────────────────
+        case "Cache.Redis": {
+          const numNodes = props.numCacheNodes ?? 1;
+          const autoFailover = props.automaticFailoverEnabled ?? false;
+          return [[logicalId, {
+            Type: "AWS::ElastiCache::ReplicationGroup",
+            Properties: {
+              ReplicationGroupDescription: `Redis ${construct.id}`,
+              ReplicationGroupId: construct.id.toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 40),
+              CacheNodeType: CACHE_NODE_TYPE_MAP[props.nodeType ?? "small"] ?? "cache.t3.micro",
+              Engine: "redis",
+              EngineVersion: props.version ?? "7.0",
+              NumCacheClusters: numNodes,
+              AutomaticFailoverEnabled: autoFailover && numNodes > 1,
+              AtRestEncryptionEnabled: props.atRestEncryptionEnabled ?? true,
+              TransitEncryptionEnabled: props.transitEncryptionEnabled ?? true,
+              ...props.subnetGroupName ? { CacheSubnetGroupName: props.subnetGroupName } : {},
+              ...props.securityGroupIds ? { SecurityGroupIds: props.securityGroupIds } : {}
+            }
+          }]];
+        }
+        case "Cache.Memcached": {
+          return [[logicalId, {
+            Type: "AWS::ElastiCache::CacheCluster",
+            Properties: {
+              ClusterName: construct.id.toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 40),
+              Engine: "memcached",
+              CacheNodeType: CACHE_NODE_TYPE_MAP[props.nodeType ?? "small"] ?? "cache.t3.micro",
+              NumCacheNodes: props.numCacheNodes ?? 2,
+              ...props.subnetGroupName ? { CacheSubnetGroupName: props.subnetGroupName } : {}
+            }
+          }]];
+        }
+        // ── Function ──────────────────────────────────────────────────────────
+        case "Function.Lambda": {
+          const environment = props.environment;
+          const runtimeMap = {
+            "nodejs20": "nodejs20.x",
+            "nodejs18": "nodejs18.x",
+            "python3.12": "python3.12",
+            "python3.11": "python3.11",
+            "java21": "java21",
+            "go1.x": "go1.x",
+            "dotnet8": "dotnet8"
+          };
+          return [[logicalId, {
+            Type: "AWS::Lambda::Function",
+            Properties: {
+              FunctionName: construct.id,
+              Runtime: runtimeMap[props.runtime ?? "nodejs20"] ?? "nodejs20.x",
+              Handler: props.handler,
+              Code: { ZipFile: props.code },
+              MemorySize: props.memory ?? 128,
+              Timeout: props.timeout ?? 30,
+              Role: { "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/LambdaExecutionRole" },
+              ...props.reservedConcurrency !== void 0 ? { ReservedConcurrentExecutions: props.reservedConcurrency } : {},
+              ...environment && Object.keys(environment).length > 0 ? { Environment: { Variables: environment } } : {},
+              ...props.vpcId ? {
+                VpcConfig: {
+                  SubnetIds: props.subnetIds ?? [],
+                  SecurityGroupIds: props.securityGroupIds ?? []
+                }
+              } : {}
+            }
+          }]];
+        }
+        case "Function.ApiGateway": {
+          const apigwType = props.type ?? "HTTP";
+          const routes = props.routes ?? [];
+          const stageName = props.stageName ?? "$default";
+          const entries = [[logicalId, {
+            Type: apigwType === "REST" ? "AWS::ApiGateway::RestApi" : "AWS::ApiGatewayV2::Api",
+            Properties: {
+              Name: props.name,
+              Description: props.description ?? "",
+              ...apigwType !== "REST" ? { ProtocolType: apigwType } : {},
+              ...props.cors ? { CorsConfiguration: { AllowOrigins: ["*"], AllowMethods: ["*"], AllowHeaders: ["*"] } } : {}
+            }
+          }]];
+          entries.push([`${logicalId}Stage`, {
+            Type: apigwType === "REST" ? "AWS::ApiGateway::Stage" : "AWS::ApiGatewayV2::Stage",
+            Properties: {
+              ...apigwType === "REST" ? { RestApiId: { Ref: logicalId } } : { ApiId: { Ref: logicalId } },
+              StageName: stageName,
+              AutoDeploy: apigwType !== "REST",
+              ...props.throttlingBurstLimit ? {
+                DefaultRouteSettings: {
+                  ThrottlingBurstLimit: props.throttlingBurstLimit,
+                  ThrottlingRateLimit: props.throttlingRateLimit ?? 1e3
+                }
+              } : {}
+            }
+          }]);
+          const authorizerLambdaId = props.authorizerLambdaId;
+          const authorizerId = authorizerLambdaId ? `${logicalId}Authorizer` : void 0;
+          if (authorizerLambdaId) {
+            entries.push([authorizerId, {
+              Type: "AWS::ApiGatewayV2::Authorizer",
+              Properties: {
+                ApiId: { Ref: logicalId },
+                AuthorizerType: "REQUEST",
+                Name: `${props.name}-authorizer`,
+                AuthorizerUri: { "Fn::Sub": `arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${authorizerLambdaId}.Arn}/invocations` },
+                AuthorizerPayloadFormatVersion: "2.0",
+                IdentitySource: ["$request.header.Authorization"]
+              }
+            }]);
+          }
+          for (const r of routes) {
+            const routeId = `${logicalId}${r.method}${r.path.replace(/[^a-zA-Z0-9]/g, "")}Route`;
+            entries.push([routeId, {
+              Type: "AWS::ApiGatewayV2::Route",
+              Properties: {
+                ApiId: { Ref: logicalId },
+                RouteKey: `${r.method} ${r.path}`,
+                ...r.lambdaId ? { Target: { "Fn::Sub": `integrations/\${${routeId}Integration}` } } : {},
+                ...authorizerId ? { AuthorizationType: "CUSTOM", AuthorizerId: { Ref: authorizerId } } : {}
+              }
+            }]);
+            if (r.lambdaId) {
+              entries.push([`${routeId}Integration`, {
+                Type: "AWS::ApiGatewayV2::Integration",
+                Properties: {
+                  ApiId: { Ref: logicalId },
+                  IntegrationType: "AWS_PROXY",
+                  IntegrationUri: { "Fn::Sub": `arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${r.lambdaId}.Arn}/invocations` },
+                  PayloadFormatVersion: "2.0"
+                }
+              }]);
+            }
+          }
+          return entries;
+        }
+        // ── Policy ────────────────────────────────────────────────────────────
+        case "Policy.IAM": {
+          const statements = props.statements ?? [];
+          const attachType = props.attachType;
+          const attachTo = props.attachTo.replace(/[^a-zA-Z0-9]/g, "");
+          const principalService = attachType === "lambda" ? "lambda.amazonaws.com" : "ec2.amazonaws.com";
+          const managedPolicies = attachType === "lambda" ? ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"] : attachType === "compute" ? ["arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"] : [];
+          const roleLogicalId = `${logicalId}Role`;
+          const roleResource = {
+            Type: "AWS::IAM::Role",
+            Properties: {
+              RoleName: { "Fn::Sub": `${attachTo}-role-\${AWS::StackName}` },
+              AssumeRolePolicyDocument: {
+                Version: "2012-10-17",
+                Statement: [{ Effect: "Allow", Principal: { Service: principalService }, Action: "sts:AssumeRole" }]
+              },
+              ManagedPolicyArns: managedPolicies,
+              Policies: [{
+                PolicyName: logicalId,
+                PolicyDocument: {
+                  Version: "2012-10-17",
+                  Statement: statements.map((s) => ({
+                    Effect: s.effect,
+                    Action: s.actions,
+                    Resource: s.resources ?? ["*"],
+                    ...s.conditions ? { Condition: s.conditions } : {}
+                  }))
+                }
+              }],
+              Tags: [{ Key: "Name", Value: roleLogicalId }]
+            }
+          };
+          if (attachType === "compute") {
+            return [[roleLogicalId, roleResource], [`${logicalId}InstanceProfile`, {
+              Type: "AWS::IAM::InstanceProfile",
+              Properties: {
+                InstanceProfileName: { "Fn::Sub": `${attachTo}-profile-\${AWS::StackName}` },
+                Roles: [{ Ref: roleLogicalId }]
+              }
+            }]];
+          }
+          return [[roleLogicalId, roleResource]];
+        }
+        // ── Events ────────────────────────────────────────────────────────────
+        case "Events.EventBridge": {
+          const rules = props.rules ?? [];
+          const busName = props.busName ?? "default";
+          const entries = [];
+          if (busName !== "default") {
+            entries.push([`${logicalId}Bus`, { Type: "AWS::Events::EventBus", Properties: { Name: busName } }]);
+          }
+          for (const r of rules) {
+            const ruleName = (r.name ?? "rule").replace(/[^a-zA-Z0-9]/g, "");
+            const pattern = {};
+            if (r.source)
+              pattern["source"] = r.source;
+            if (r.detailTypes)
+              pattern["detail-type"] = r.detailTypes;
+            entries.push([`${logicalId}${ruleName}Rule`, {
+              Type: "AWS::Events::Rule",
+              Properties: {
+                Name: r.name,
+                EventBusName: busName,
+                EventPattern: pattern,
+                State: "ENABLED",
+                ...r.targetArn ? { Targets: [{ Id: `${ruleName}Target`, Arn: r.targetArn }] } : {}
+              }
+            }]);
+          }
+          return entries;
+        }
+        // ── Workflow ──────────────────────────────────────────────────────────
+        case "Workflow.StepFunctions": {
+          const steps = props.steps ?? [];
+          const definition = {
+            Comment: props.description ?? `Workflow ${construct.id}`,
+            StartAt: steps[0]?.name ?? "Start",
+            States: Object.fromEntries(steps.map((s, i) => [s.name, {
+              Type: s.type ?? "Task",
+              Resource: s.resource ?? "",
+              ...s.description ? { Comment: s.description } : {},
+              ...i < steps.length - 1 ? { Next: steps[i + 1].name } : { End: true }
+            }]))
+          };
+          return [[logicalId, {
+            Type: "AWS::StepFunctions::StateMachine",
+            Properties: {
+              StateMachineName: construct.id,
+              StateMachineType: props.type ?? "STANDARD",
+              DefinitionString: { "Fn::Sub": JSON.stringify(definition) },
+              RoleArn: { "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/StepFunctionsExecutionRole" },
+              LoggingConfiguration: { Level: "ERROR", IncludeExecutionData: false }
+            }
+          }]];
+        }
+        // ── Messaging ─────────────────────────────────────────────────────────
+        case "Messaging.Queue": {
+          const fifo = props.fifo ?? false;
+          return [[logicalId, {
+            Type: "AWS::SQS::Queue",
+            Properties: {
+              QueueName: fifo ? `${construct.id}.fifo` : construct.id,
+              VisibilityTimeout: props.visibilityTimeoutSeconds ?? 30,
+              MessageRetentionPeriod: props.messageRetentionSeconds ?? 345600,
+              DelaySeconds: props.delaySeconds ?? 0,
+              FifoQueue: fifo,
+              SqsManagedSseEnabled: props.encrypted ?? true,
+              ...props.dlqArn ? { RedrivePolicy: { deadLetterTargetArn: props.dlqArn, maxReceiveCount: props.maxReceiveCount ?? 3 } } : {}
+            }
+          }]];
+        }
+        case "Messaging.Topic": {
+          const fifo = props.fifo ?? false;
+          const subscriptions = props.subscriptions ?? [];
+          return [[logicalId, {
+            Type: "AWS::SNS::Topic",
+            Properties: {
+              TopicName: fifo ? `${construct.id}.fifo` : construct.id,
+              DisplayName: props.displayName ?? construct.id,
+              FifoTopic: fifo,
+              ...props.encrypted ? { KmsMasterKeyId: "alias/aws/sns" } : {},
+              Subscription: subscriptions.map((s) => ({ Protocol: s.protocol, Endpoint: s.endpoint }))
+            }
+          }]];
+        }
+        // ── Secret / Certificate ──────────────────────────────────────────────
+        case "Secret.Vault": {
+          return [[logicalId, {
+            Type: "AWS::SecretsManager::Secret",
+            Properties: {
+              Name: construct.id,
+              Description: props.description ?? `Secret ${construct.id}`,
+              ...props.kmsKeyId ? { KmsKeyId: props.kmsKeyId } : {},
+              ...props.replicaRegions ? { ReplicaRegions: props.replicaRegions.map((r) => ({ Region: r })) } : {}
+            }
+          }]];
+        }
+        case "Certificate.TLS": {
+          const sans = props.subjectAlternativeNames ?? [];
+          return [[logicalId, {
+            Type: "AWS::CertificateManager::Certificate",
+            Properties: {
+              DomainName: props.domainName,
+              ValidationMethod: props.validationMethod ?? "DNS",
+              ...sans.length > 0 ? { SubjectAlternativeNames: sans } : {},
+              Tags: [{ Key: "Name", Value: construct.id }]
+            }
+          }]];
+        }
+        // ── Monitoring ────────────────────────────────────────────────────────
+        case "Monitoring.Alarm": {
+          const dimensions = props.dimensions;
+          return [[logicalId, {
+            Type: "AWS::CloudWatch::Alarm",
+            Properties: {
+              AlarmName: construct.id,
+              MetricName: props.metricName,
+              Namespace: props.namespace ?? "AWS/Lambda",
+              Threshold: props.threshold,
+              EvaluationPeriods: props.evaluationPeriods ?? 2,
+              Period: props.periodSeconds ?? 60,
+              ComparisonOperator: props.comparisonOperator ?? "GreaterThanThreshold",
+              Statistic: props.statistic ?? "Average",
+              TreatMissingData: props.treatMissingData ?? "notBreaching",
+              ...props.alarmActions ? { AlarmActions: props.alarmActions } : {},
+              ...props.okActions ? { OKActions: props.okActions } : {},
+              ...dimensions ? { Dimensions: Object.entries(dimensions).map(([k, v]) => ({ Name: k, Value: v })) } : {}
+            }
+          }]];
+        }
+        case "Monitoring.Dashboard": {
+          const widgets = props.widgets ?? [];
+          const dashBody = {
+            widgets: widgets.map((w, i) => ({
+              type: w.type === "text" ? "text" : "metric",
+              x: i % 3 * 8,
+              y: Math.floor(i / 3) * 6,
+              width: 8,
+              height: 6,
+              properties: w.type === "text" ? { markdown: w.markdown ?? w.title } : {
+                title: w.title,
+                metrics: [[
+                  w.namespace ?? "AWS/Lambda",
+                  w.metricName,
+                  ...w.dimensions ? Object.entries(w.dimensions).flat() : []
+                ]],
+                period: w.period ?? 60,
+                stat: w.stat ?? "Average",
+                view: "timeSeries"
+              }
+            }))
+          };
+          return [[logicalId, {
+            Type: "AWS::CloudWatch::Dashboard",
+            Properties: {
+              DashboardName: construct.id,
+              DashboardBody: JSON.stringify(dashBody)
+            }
+          }]];
+        }
+        case "Logging.Stream": {
+          const filters = props.subscriptionFilters ?? [];
+          const entries = [[logicalId, {
+            Type: "AWS::Logs::LogGroup",
+            Properties: {
+              LogGroupName: `/iacmp/${construct.id}`,
+              RetentionInDays: props.retentionDays ?? 30,
+              ...props.kmsKeyId ? { KmsKeyId: props.kmsKeyId } : {}
+            }
+          }]];
+          for (const f of filters) {
+            entries.push([`${logicalId}${f.name.replace(/[^a-zA-Z0-9]/g, "")}Filter`, {
+              Type: "AWS::Logs::SubscriptionFilter",
+              Properties: {
+                LogGroupName: { Ref: logicalId },
+                FilterName: f.name,
+                FilterPattern: f.filterPattern,
+                DestinationArn: f.destinationArn
+              }
+            }]);
+          }
+          return entries;
+        }
+        case "Custom.Resource": {
+          const cfn = props.cloudformation;
+          if (!cfn)
+            return [];
+          return [[logicalId, { Type: cfn.type, Properties: cfn.properties }]];
+        }
+        default:
+          console.warn(`[aws] Construct type '${construct.type}' nao suportado \u2014 descartado.`);
+          return [];
+      }
+    }
+    function synthesizeVPCChildren(logicalId, cidr, maxAzs, resources) {
+      if (!maxAzs || maxAzs <= 0)
+        return;
+      const azLetters = ["a", "b", "c", "d", "e", "f"].slice(0, maxAzs);
+      const cidrBase = cidr.split(".").slice(0, 2).join(".");
+      const igwId = `${logicalId}IGW`;
+      resources[igwId] = { Type: "AWS::EC2::InternetGateway", Properties: { Tags: [{ Key: "Name", Value: igwId }] } };
+      resources[`${igwId}Attachment`] = {
+        Type: "AWS::EC2::VPCGatewayAttachment",
+        Properties: { VpcId: { Ref: logicalId }, InternetGatewayId: { Ref: igwId } }
+      };
+      const pubRTId = `${logicalId}PublicRT`;
+      resources[pubRTId] = { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: logicalId }, Tags: [{ Key: "Name", Value: pubRTId }] } };
+      resources[`${pubRTId}DefaultRoute`] = {
+        Type: "AWS::EC2::Route",
+        Properties: { RouteTableId: { Ref: pubRTId }, DestinationCidrBlock: "0.0.0.0/0", GatewayId: { Ref: igwId } }
+      };
+      azLetters.forEach((az, i) => {
+        const pubSubnetId = `${logicalId}PublicSubnet${az.toUpperCase()}`;
+        const privSubnetId = `${logicalId}PrivateSubnet${az.toUpperCase()}`;
+        resources[pubSubnetId] = {
+          Type: "AWS::EC2::Subnet",
+          Properties: {
+            VpcId: { Ref: logicalId },
+            CidrBlock: `${cidrBase}.${i * 2}.0/24`,
+            AvailabilityZone: { "Fn::Select": [i, { "Fn::GetAZs": "" }] },
+            MapPublicIpOnLaunch: true,
+            Tags: [{ Key: "Name", Value: pubSubnetId }]
+          }
+        };
+        resources[`${pubSubnetId}RTAssoc`] = {
+          Type: "AWS::EC2::SubnetRouteTableAssociation",
+          Properties: { SubnetId: { Ref: pubSubnetId }, RouteTableId: { Ref: pubRTId } }
+        };
+        resources[privSubnetId] = {
+          Type: "AWS::EC2::Subnet",
+          Properties: {
+            VpcId: { Ref: logicalId },
+            CidrBlock: `${cidrBase}.${i * 2 + 1}.0/24`,
+            AvailabilityZone: { "Fn::Select": [i, { "Fn::GetAZs": "" }] },
+            Tags: [{ Key: "Name", Value: privSubnetId }]
+          }
+        };
+      });
+    }
+    function synthesize(stack) {
+      const resources = {};
+      for (const construct of stack.constructs) {
+        const entries = synthesizeConstruct(construct);
+        for (const [id, resource] of entries) {
+          resources[id] = resource;
+        }
+        if (construct.type === "Network.VPC") {
+          const p = construct.props;
+          const logicalId = construct.id.replace(/[^a-zA-Z0-9]/g, "");
+          synthesizeVPCChildren(logicalId, p.cidr ?? "10.0.0.0/16", p.maxAzs ?? 0, resources);
+        }
+      }
+      return {
+        AWSTemplateFormatVersion: "2010-09-09",
+        Description: `Stack ${stack.name} \u2014 gerada pelo iacmp`,
+        Resources: resources
+      };
+    }
+  }
+});
+
+// ../providers/aws/dist/provider.js
+var require_provider = __commonJS({
+  "../providers/aws/dist/provider.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.AWSProvider = void 0;
+    var cloudformation_1 = require_cloudformation();
+    var AWSProvider2 = class {
+      name = "aws";
+      synthesize(stack) {
+        return (0, cloudformation_1.synthesize)(stack);
+      }
+    };
+    exports2.AWSProvider = AWSProvider2;
+  }
+});
+
+// ../providers/aws/dist/index.js
+var require_dist = __commonJS({
+  "../providers/aws/dist/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.synthesize = exports2.AWSProvider = void 0;
+    var provider_1 = require_provider();
+    Object.defineProperty(exports2, "AWSProvider", { enumerable: true, get: function() {
+      return provider_1.AWSProvider;
+    } });
+    var cloudformation_1 = require_cloudformation();
+    Object.defineProperty(exports2, "synthesize", { enumerable: true, get: function() {
+      return cloudformation_1.synthesize;
+    } });
+  }
+});
+
+// ../providers/azure/dist/synth/arm.js
+var require_arm = __commonJS({
+  "../providers/azure/dist/synth/arm.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.synthesize = synthesize;
+    var INSTANCE_TYPE_MAP = {
+      small: "Standard_B1s",
+      medium: "Standard_B2s",
+      large: "Standard_B4ms"
+    };
+    var IMAGE_MAP = {
+      "ubuntu": { publisher: "Canonical", offer: "UbuntuServer", sku: "22_04-lts", version: "latest", isWindows: false },
+      "ubuntu-22.04": { publisher: "Canonical", offer: "UbuntuServer", sku: "22_04-lts", version: "latest", isWindows: false },
+      "ubuntu-20.04": { publisher: "Canonical", offer: "UbuntuServer", sku: "20_04-lts", version: "latest", isWindows: false },
+      "windows-2022": { publisher: "MicrosoftWindowsServer", offer: "WindowsServer", sku: "2022-Datacenter", version: "latest", isWindows: true },
+      "windows-2019": { publisher: "MicrosoftWindowsServer", offer: "WindowsServer", sku: "2019-Datacenter", version: "latest", isWindows: true },
+      "windows-2016": { publisher: "MicrosoftWindowsServer", offer: "WindowsServer", sku: "2016-Datacenter", version: "latest", isWindows: true }
+    };
+    function resolveAzureImage(image) {
+      const mapped = IMAGE_MAP[image];
+      if (mapped) {
+        const { isWindows, ...ref } = mapped;
+        return { imageReference: ref, isWindows };
+      }
+      return { imageReference: { offer: image }, isWindows: false };
+    }
+    var CACHE_SKU_MAP = {
+      small: { name: "Standard", family: "C", capacity: 1 },
+      medium: { name: "Standard", family: "C", capacity: 2 },
+      large: { name: "Premium", family: "P", capacity: 1 }
+    };
+    function tag(name) {
+      return { Name: name };
+    }
+    function synthesizeConstruct(construct) {
+      const props = construct.props;
+      const location = props.region ?? "[resourceGroup().location]";
+      switch (construct.type) {
+        // ── Compute ──────────────────────────────────────────────────────────
+        case "Compute.Instance": {
+          const { imageReference, isWindows } = resolveAzureImage(props.image ?? "ubuntu");
+          return [{
+            type: "Microsoft.Compute/virtualMachines",
+            apiVersion: "2023-03-01",
+            name: construct.id,
+            location,
+            tags: tag(construct.id),
+            properties: {
+              hardwareProfile: { vmSize: INSTANCE_TYPE_MAP[props.instanceType] ?? "Standard_B1s" },
+              storageProfile: { imageReference },
+              osProfile: {
+                computerName: construct.id,
+                adminUsername: isWindows ? "adminuser" : "azureuser",
+                ...isWindows ? { windowsConfiguration: { provisionVMAgent: true, enableAutomaticUpdates: true } } : { linuxConfiguration: { disablePasswordAuthentication: true } }
+              }
+            }
+          }];
+        }
+        case "Compute.AutoScaling": {
+          const { imageReference: asImageRef, isWindows: asIsWindows } = resolveAzureImage(props.image ?? "ubuntu");
+          const vmssBody = {
+            type: "Microsoft.Compute/virtualMachineScaleSets",
+            apiVersion: "2023-03-01",
+            name: construct.id,
+            location,
+            tags: tag(construct.id),
+            sku: {
+              name: INSTANCE_TYPE_MAP[props.instanceType] ?? "Standard_B1s",
+              tier: "Standard",
+              capacity: props.desiredCapacity ?? props.minCapacity
+            },
+            properties: {
+              overprovision: true,
+              upgradePolicy: { mode: "Automatic" },
+              virtualMachineProfile: {
+                storageProfile: { imageReference: asImageRef },
+                osProfile: {
+                  computerNamePrefix: construct.id.slice(0, 9),
+                  adminUsername: asIsWindows ? "adminuser" : "azureuser",
+                  ...asIsWindows ? { windowsConfiguration: { provisionVMAgent: true, enableAutomaticUpdates: true } } : { linuxConfiguration: { disablePasswordAuthentication: true } }
+                }
+              }
+            }
+          };
+          const autoscaleBody = {
+            type: "Microsoft.Insights/autoscaleSettings",
+            apiVersion: "2022-10-01",
+            name: `${construct.id}-autoscale`,
+            location,
+            properties: {
+              enabled: true,
+              targetResourceUri: `[resourceId('Microsoft.Compute/virtualMachineScaleSets', '${construct.id}')]`,
+              profiles: [{
+                name: "default",
+                capacity: {
+                  minimum: String(props.minCapacity ?? 1),
+                  maximum: String(props.maxCapacity ?? 10),
+                  default: String(props.desiredCapacity ?? props.minCapacity ?? 1)
+                },
+                rules: props.targetCpuUtilization ? [{
+                  metricTrigger: {
+                    metricName: "Percentage CPU",
+                    metricResourceUri: `[resourceId('Microsoft.Compute/virtualMachineScaleSets', '${construct.id}')]`,
+                    timeGrain: "PT1M",
+                    statistic: "Average",
+                    timeWindow: "PT5M",
+                    timeAggregation: "Average",
+                    operator: "GreaterThan",
+                    threshold: props.targetCpuUtilization
+                  },
+                  scaleAction: { direction: "Increase", type: "ChangeCount", value: "1", cooldown: "PT5M" }
+                }] : []
+              }]
+            }
+          };
+          return [vmssBody, autoscaleBody];
+        }
+        case "Compute.Container": {
+          const environment = props.environment ?? {};
+          const envVars = Object.entries(environment).map(([k, v]) => ({ name: k, value: v }));
+          return [{
+            type: "Microsoft.ContainerInstance/containerGroups",
+            apiVersion: "2023-05-01",
+            name: construct.id,
+            location,
+            tags: tag(construct.id),
+            properties: {
+              containers: [{
+                name: construct.id,
+                properties: {
+                  image: props.image,
+                  resources: {
+                    requests: {
+                      cpu: Math.round((props.cpu ?? 256) / 1024 * 10) / 10,
+                      memoryInGB: Math.round((props.memory ?? 512) / 1024 * 10) / 10
+                    }
+                  },
+                  ports: props.port ? [{ port: props.port, protocol: "TCP" }] : [],
+                  environmentVariables: envVars
+                }
+              }],
+              osType: "Linux",
+              ipAddress: {
+                type: "Public",
+                ports: props.port ? [{ port: props.port, protocol: "TCP" }] : []
+              },
+              restartPolicy: "OnFailure"
+            }
+          }];
+        }
+        case "Compute.Kubernetes": {
+          const nodeType = INSTANCE_TYPE_MAP[props.nodeInstanceType] ?? "Standard_B2s";
+          return [{
+            type: "Microsoft.ContainerService/managedClusters",
+            apiVersion: "2023-05-01",
+            name: construct.id,
+            location,
+            tags: tag(construct.id),
+            identity: { type: "SystemAssigned" },
+            properties: {
+              kubernetesVersion: props.version ?? "1.29",
+              dnsPrefix: construct.id,
+              enableRBAC: true,
+              agentPoolProfiles: [{
+                name: "nodepool1",
+                count: props.desiredNodes ?? 2,
+                minCount: props.minNodes ?? 1,
+                maxCount: props.maxNodes ?? 3,
+                enableAutoScaling: true,
+                vmSize: nodeType,
+                mode: "System"
+              }],
+              apiServerAccessProfile: {
+                enablePrivateCluster: props.privateCluster ?? false
+              },
+              networkProfile: { networkPlugin: "kubenet", loadBalancerSku: "standard" }
+            }
+          }];
+        }
+        // ── Storage ───────────────────────────────────────────────────────────
+        case "Storage.Bucket": {
+          const resources = [{
+            type: "Microsoft.Storage/storageAccounts",
+            apiVersion: "2023-01-01",
+            name: construct.id.toLowerCase().replace(/[^a-z0-9]/g, ""),
+            location,
+            kind: "StorageV2",
+            sku: { name: "Standard_LRS" },
+            tags: tag(construct.id),
+            properties: {
+              allowBlobPublicAccess: props.publicAccess ?? false,
+              supportsHttpsTrafficOnly: true,
+              minimumTlsVersion: "TLS1_2"
+            }
+          }];
+          if (props.versioning) {
+            resources.push({
+              type: "Microsoft.Storage/storageAccounts/blobServices",
+              apiVersion: "2023-01-01",
+              name: `${construct.id.toLowerCase().replace(/[^a-z0-9]/g, "")}/default`,
+              location,
+              properties: { isVersioningEnabled: true }
+            });
+          }
+          return resources;
+        }
+        case "Storage.FileSystem":
+          return [{
+            type: "Microsoft.Storage/storageAccounts/fileServices/shares",
+            apiVersion: "2023-01-01",
+            name: `${construct.id.toLowerCase().replace(/[^a-z0-9]/g, "")}share/default/${construct.id}`,
+            location,
+            properties: {
+              shareQuota: 100,
+              enabledProtocols: "SMB",
+              accessTier: "Hot"
+            }
+          }];
+        case "Storage.Archive":
+          return [{
+            type: "Microsoft.Storage/storageAccounts",
+            apiVersion: "2023-01-01",
+            name: `${construct.id.toLowerCase().replace(/[^a-z0-9]/g, "")}arc`,
+            location,
+            kind: "BlobStorage",
+            sku: { name: "Standard_LRS" },
+            tags: tag(construct.id),
+            properties: {
+              accessTier: "Archive",
+              allowBlobPublicAccess: false,
+              supportsHttpsTrafficOnly: true,
+              minimumTlsVersion: "TLS1_2"
+            }
+          }];
+        // ── Network ───────────────────────────────────────────────────────────
+        case "Network.VPC":
+          return [{
+            type: "Microsoft.Network/virtualNetworks",
+            apiVersion: "2023-04-01",
+            name: construct.id,
+            location,
+            tags: tag(construct.id),
+            properties: {
+              addressSpace: { addressPrefixes: [props.cidr ?? "10.0.0.0/16"] },
+              dhcpOptions: { dnsServers: [] }
+            }
+          }];
+        case "Network.Subnet": {
+          const vnetName = props.vpcId;
+          return [{
+            type: "Microsoft.Network/virtualNetworks/subnets",
+            apiVersion: "2023-04-01",
+            name: `${vnetName}/${construct.id}`,
+            location,
+            dependsOn: [`[resourceId('Microsoft.Network/virtualNetworks', '${vnetName}')]`],
+            properties: {
+              addressPrefix: props.cidr,
+              privateEndpointNetworkPolicies: props.public ? "Disabled" : "Enabled"
+            }
+          }];
+        }
+        case "Network.SecurityGroup": {
+          const ingress = props.ingressRules ?? [];
+          const egress = props.egressRules ?? [];
+          const protocolMap = {
+            tcp: "Tcp",
+            udp: "Udp",
+            icmp: "Icmp",
+            "-1": "*"
+          };
+          const mapProtocol = (raw) => {
+            if (raw === void 0 || raw === null)
+              return "*";
+            const key = String(raw).toLowerCase();
+            return protocolMap[key] ?? "*";
+          };
+          const secRules = [
+            ...ingress.map((r, i) => {
+              if (r.cidr === void 0) {
+                console.warn(`[azure] Security group rule sem CIDR; usando * \u2014 defina props.cidr explicitamente (${construct.id} ingress[${i}])`);
+              }
+              return {
+                name: `ingress-rule-${i}`,
+                properties: {
+                  priority: 100 + i,
+                  direction: "Inbound",
+                  access: "Allow",
+                  protocol: mapProtocol(r.protocol),
+                  sourcePortRange: "*",
+                  destinationPortRange: r.fromPort === r.toPort ? String(r.fromPort) : `${r.fromPort}-${r.toPort}`,
+                  sourceAddressPrefix: r.cidr ?? "*",
+                  destinationAddressPrefix: "*",
+                  description: r.description ?? ""
+                }
+              };
+            }),
+            ...egress.map((r, i) => ({
+              name: `egress-rule-${i}`,
+              properties: {
+                priority: 200 + i,
+                direction: "Outbound",
+                access: "Allow",
+                protocol: mapProtocol(r.protocol),
+                sourcePortRange: "*",
+                destinationPortRange: r.fromPort === r.toPort ? String(r.fromPort) : `${r.fromPort}-${r.toPort}`,
+                sourceAddressPrefix: "*",
+                destinationAddressPrefix: r.cidr ?? "*",
+                description: r.description ?? ""
+              }
+            }))
+          ];
+          return [{
+            type: "Microsoft.Network/networkSecurityGroups",
+            apiVersion: "2023-04-01",
+            name: construct.id,
+            location,
+            tags: tag(construct.id),
+            properties: { securityRules: secRules }
+          }];
+        }
+        case "Network.WAF": {
+          const rules = props.rules ?? [];
+          const customRules = rules.filter((r) => !r.managedGroup).map((r, i) => ({
+            name: r.name ?? `custom-rule-${i}`,
+            priority: r.priority ?? i + 1,
+            ruleType: "MatchRule",
+            action: r.action ?? "Block",
+            matchConditions: [{
+              matchVariables: [{ variableName: "RequestHeaders", selector: "User-Agent" }],
+              operator: "Contains",
+              matchValues: r.matchValues ?? ["BadBot"]
+            }]
+          }));
+          const managedRules = rules.filter((r) => r.managedGroup).map((r) => ({
+            ruleSetType: r.managedGroup ?? "OWASP",
+            ruleSetVersion: "3.2"
+          }));
+          return [{
+            type: "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies",
+            apiVersion: "2023-04-01",
+            name: construct.id,
+            location,
+            tags: tag(construct.id),
+            properties: {
+              policySettings: {
+                requestBodyCheck: true,
+                maxRequestBodySizeInKb: 128,
+                fileUploadLimitInMb: 100,
+                state: "Enabled",
+                mode: props.mode ?? "Prevention"
+              },
+              customRules,
+              managedRules: {
+                managedRuleSets: managedRules.length > 0 ? managedRules : [{ ruleSetType: "OWASP", ruleSetVersion: "3.2" }]
+              }
+            }
+          }];
+        }
+        case "Network.LoadBalancer": {
+          const lbType = props.type ?? "application";
+          const isInternal = props.scheme === "internal";
+          const listeners = props.listeners ?? [];
+          const targetGroups = props.targetGroups ?? [];
+          if (lbType === "application") {
+            return [{
+              type: "Microsoft.Network/applicationGateways",
+              apiVersion: "2023-04-01",
+              name: construct.id,
+              location,
+              tags: tag(construct.id),
+              properties: {
+                sku: { name: "Standard_v2", tier: "Standard_v2", capacity: 2 },
+                frontendIPConfigurations: [{ name: "appGatewayFrontendIP", properties: { publicIPAddress: null } }],
+                frontendPorts: listeners.map((l, i) => ({ name: `port${i}`, properties: { port: l.port } })),
+                backendAddressPools: targetGroups.map((tg) => ({ name: tg.name, properties: {} })),
+                httpListeners: listeners.map((l, i) => ({
+                  name: `listener${i}`,
+                  properties: {
+                    frontendPort: { id: `port${i}` },
+                    protocol: l.protocol.toLowerCase() === "https" ? "Https" : "Http"
+                  }
+                })),
+                requestRoutingRules: [{
+                  name: "rule1",
+                  properties: { ruleType: "Basic", priority: 100 }
+                }]
+              }
+            }];
+          }
+          return [{
+            type: "Microsoft.Network/loadBalancers",
+            apiVersion: "2023-04-01",
+            name: construct.id,
+            location,
+            tags: tag(construct.id),
+            sku: { name: "Standard" },
+            properties: {
+              frontendIPConfigurations: [{ name: "loadBalancerFrontEnd", properties: {} }],
+              backendAddressPools: targetGroups.map((tg) => ({ name: tg.name })),
+              loadBalancingRules: listeners.map((l, i) => ({
+                name: `rule${i}`,
+                properties: {
+                  frontendPort: l.port,
+                  backendPort: l.port,
+                  protocol: l.protocol.toLowerCase() === "tcp" ? "Tcp" : "Udp",
+                  enableFloatingIP: false
+                }
+              }))
+            }
+          }];
+        }
+        case "Network.CDN": {
+          const origins = props.origins ?? [];
+          return [{
+            type: "Microsoft.Cdn/profiles/endpoints",
+            apiVersion: "2023-05-01",
+            name: `${construct.id}-profile/${construct.id}`,
+            location,
+            tags: tag(construct.id),
+            properties: {
+              originHostHeader: origins[0]?.domainName ?? "",
+              isHttpAllowed: false,
+              isHttpsAllowed: true,
+              origins: origins.map((o) => ({
+                name: o.id ?? "origin1",
+                properties: { hostName: o.domainName, httpPort: 80, httpsPort: 443 }
+              })),
+              deliveryPolicy: {
+                rules: [{
+                  name: "enforceHttps",
+                  order: 1,
+                  conditions: [{ name: "RequestScheme", parameters: { operator: "Equal", matchValues: ["HTTP"] } }],
+                  actions: [{ name: "UrlRedirect", parameters: { redirectType: "Moved", destinationProtocol: "Https" } }]
+                }]
+              }
+            }
+          }];
+        }
+        case "Network.Dns": {
+          const records = props.records ?? [];
+          const zoneName = props.zoneName;
+          const resources = [{
+            type: "Microsoft.Network/dnsZones",
+            apiVersion: "2018-05-01",
+            name: zoneName,
+            location: "global",
+            tags: tag(construct.id),
+            properties: {}
+          }];
+          for (const r of records) {
+            const recordType = r.type.toLowerCase();
+            resources.push({
+              type: `Microsoft.Network/dnsZones/${recordType}`,
+              apiVersion: "2018-05-01",
+              name: `${zoneName}/${r.name}`,
+              location: "global",
+              dependsOn: [`[resourceId('Microsoft.Network/dnsZones', '${zoneName}')]`],
+              properties: {
+                TTL: r.ttl ?? 300,
+                [`${recordType.toUpperCase()}Records`]: r.values.map((v) => ({ value: v }))
+              }
+            });
+          }
+          return resources;
+        }
+        // ── Database ──────────────────────────────────────────────────────────
+        case "Database.SQL": {
+          const engine = props.engine ?? "mysql";
+          const serverName = `${construct.id.toLowerCase()}-server`;
+          const storageBytes = (props.storageGb ?? 20) * 1024 * 1024 * 1024;
+          const zoneRedundant = props.multiAz ?? false;
+          if (engine === "mysql") {
+            return [
+              {
+                type: "Microsoft.DBforMySQL/flexibleServers",
+                apiVersion: "2023-06-30",
+                name: serverName,
+                location,
+                tags: tag(construct.id),
+                sku: { name: "Standard_D2ds_v4", tier: "GeneralPurpose" },
+                properties: {
+                  administratorLogin: "mysqladmin",
+                  administratorLoginPassword: "[parameters('adminPassword')]",
+                  version: "8.0.21",
+                  storage: { storageSizeGB: props.storageGb ?? 20, autoGrow: "Enabled" },
+                  backup: { backupRetentionDays: props.backupRetentionDays ?? 7, geoRedundantBackup: "Disabled" },
+                  highAvailability: { mode: zoneRedundant ? "ZoneRedundant" : "Disabled" }
+                }
+              }
+            ];
+          }
+          if (engine === "postgres") {
+            return [
+              {
+                type: "Microsoft.DBforPostgreSQL/flexibleServers",
+                apiVersion: "2023-06-01-preview",
+                name: serverName,
+                location,
+                tags: tag(construct.id),
+                sku: { name: "Standard_D2ds_v5", tier: "GeneralPurpose" },
+                properties: {
+                  administratorLogin: "pgadmin",
+                  administratorLoginPassword: "[parameters('adminPassword')]",
+                  version: "15",
+                  storage: { storageSizeGB: props.storageGb ?? 32 },
+                  backup: { backupRetentionDays: props.backupRetentionDays ?? 7, geoRedundantBackup: "Disabled" },
+                  highAvailability: { mode: zoneRedundant ? "ZoneRedundant" : "Disabled" }
+                }
+              }
+            ];
+          }
+          if (engine === "mariadb") {
+            return [
+              {
+                type: "Microsoft.DBforMariaDB/servers",
+                apiVersion: "2018-06-01",
+                name: serverName,
+                location,
+                tags: tag(construct.id),
+                sku: { name: "GP_Gen5_2", tier: "GeneralPurpose", capacity: 2, family: "Gen5" },
+                properties: {
+                  administratorLogin: "mariadbadmin",
+                  administratorLoginPassword: "[parameters('adminPassword')]",
+                  version: "10.3",
+                  storageProfile: {
+                    storageMB: (props.storageGb ?? 20) * 1024,
+                    backupRetentionDays: props.backupRetentionDays ?? 7,
+                    geoRedundantBackup: "Disabled"
+                  }
+                }
+              }
+            ];
+          }
+          if (engine === "oracle") {
+            return [
+              {
+                type: "Oracle.Database/cloudExadataInfrastructures",
+                apiVersion: "2023-09-01",
+                name: serverName,
+                location,
+                tags: tag(construct.id),
+                properties: {
+                  displayName: construct.id,
+                  shape: "Exadata.X9M",
+                  computeCount: 2,
+                  storageCount: 3
+                }
+              }
+            ];
+          }
+          const edition = props.edition ?? "Standard";
+          return [
+            {
+              type: "Microsoft.Sql/servers",
+              apiVersion: "2023-02-01-preview",
+              name: serverName,
+              location,
+              tags: tag(construct.id),
+              properties: {
+                administratorLogin: "sqladmin",
+                administratorLoginPassword: "[parameters('adminPassword')]",
+                version: "12.0"
+              }
+            },
+            {
+              type: "Microsoft.Sql/servers/databases",
+              apiVersion: "2023-02-01-preview",
+              name: `${serverName}/${construct.id}`,
+              location,
+              dependsOn: [`[resourceId('Microsoft.Sql/servers', '${serverName}')]`],
+              sku: { name: edition === "ee" ? "BusinessCritical" : "Standard", tier: edition === "ee" ? "BusinessCritical" : "Standard" },
+              properties: {
+                collation: "SQL_Latin1_General_CP1_CI_AS",
+                maxSizeBytes: storageBytes,
+                zoneRedundant
+              }
+            }
+          ];
+        }
+        case "Database.DocumentDB":
+          return [{
+            type: "Microsoft.DocumentDB/databaseAccounts",
+            apiVersion: "2023-04-15",
+            name: construct.id.toLowerCase(),
+            location,
+            tags: tag(construct.id),
+            properties: {
+              databaseAccountOfferType: "Standard",
+              kind: "MongoDB",
+              locations: [{ locationName: location, failoverPriority: 0, isZoneRedundant: false }],
+              backupPolicy: { type: "Periodic", periodicModeProperties: { backupIntervalInMinutes: 1440, backupRetentionIntervalInHours: 168 } },
+              enableAutomaticFailover: props.deletionProtection ?? false
+            }
+          }];
+        case "Database.DynamoDB":
+          return [{
+            type: "Microsoft.DocumentDB/databaseAccounts",
+            apiVersion: "2023-04-15",
+            name: construct.id.toLowerCase(),
+            location,
+            tags: tag(construct.id),
+            properties: {
+              databaseAccountOfferType: "Standard",
+              kind: "GlobalDocumentDB",
+              capabilities: [{ name: "EnableTable" }],
+              locations: [{ locationName: location, failoverPriority: 0, isZoneRedundant: false }],
+              backupPolicy: { type: "Continuous", continuousModeProperties: { tier: "Continuous30Days" } }
+            }
+          }];
+        // ── Cache ─────────────────────────────────────────────────────────────
+        case "Cache.Redis": {
+          const skuInfo = CACHE_SKU_MAP[props.nodeType ?? "small"];
+          return [{
+            type: "Microsoft.Cache/redis",
+            apiVersion: "2023-08-01",
+            name: construct.id,
+            location,
+            tags: tag(construct.id),
+            sku: { name: skuInfo.name, family: skuInfo.family, capacity: skuInfo.capacity },
+            properties: {
+              enableNonSslPort: false,
+              minimumTlsVersion: "1.2",
+              redisVersion: props.version ?? "7.0",
+              redisConfiguration: {
+                "maxmemory-policy": "volatile-lru"
+              }
+            }
+          }];
+        }
+        case "Cache.Memcached":
+          return [{
+            type: "Microsoft.Cache/redis",
+            apiVersion: "2023-08-01",
+            name: `${construct.id}-cache`,
+            location,
+            tags: tag(construct.id),
+            sku: { name: "Standard", family: "C", capacity: props.numCacheNodes ?? 2 },
+            properties: {
+              enableNonSslPort: false,
+              minimumTlsVersion: "1.2",
+              redisConfiguration: {}
+            }
+          }];
+        // ── Function ──────────────────────────────────────────────────────────
+        case "Function.Lambda": {
+          const environment = props.environment ?? {};
+          const runtimeMap = {
+            "nodejs20": "node|20",
+            "nodejs18": "node|18",
+            "python3.12": "python|3.12",
+            "python3.11": "python|3.11",
+            "java21": "java|21",
+            "go1.x": "go|1",
+            "dotnet8": "dotnet|8"
+          };
+          const baseSettings = [
+            { name: "FUNCTIONS_EXTENSION_VERSION", value: "~4" },
+            { name: "FUNCTIONS_WORKER_RUNTIME", value: props.runtime?.startsWith("nodejs") ? "node" : props.runtime?.startsWith("python") ? "python" : "dotnet" }
+          ];
+          const envSettings = Object.entries(environment).map(([k, v]) => ({ name: k, value: v }));
+          return [{
+            type: "Microsoft.Web/sites",
+            apiVersion: "2023-01-01",
+            name: construct.id,
+            location,
+            kind: "functionapp",
+            tags: tag(construct.id),
+            properties: {
+              siteConfig: {
+                linuxFxVersion: runtimeMap[props.runtime ?? "nodejs20"] ?? "node|20",
+                appSettings: [...baseSettings, ...envSettings],
+                ...props.memory ? { memoryAllocation: props.memory } : {}
+              },
+              httpsOnly: true
+            }
+          }];
+        }
+        case "Function.ApiGateway": {
+          const apimName = props.name ?? construct.id;
+          const authorizerLambdaId = props.authorizerLambdaId;
+          const resources = [{
+            type: "Microsoft.ApiManagement/service",
+            apiVersion: "2023-05-01-preview",
+            name: apimName,
+            location,
+            tags: tag(construct.id),
+            sku: { name: "Consumption", capacity: 0 },
+            properties: {
+              publisherEmail: "admin@example.com",
+              publisherName: construct.id,
+              virtualNetworkType: "None",
+              customProperties: {
+                "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10": "false",
+                "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls11": "false"
+              }
+            }
+          }];
+          if (authorizerLambdaId) {
+            resources.push({
+              type: "Microsoft.ApiManagement/service/backends",
+              apiVersion: "2023-05-01-preview",
+              name: `${apimName}/authorizer-backend`,
+              location,
+              properties: {
+                description: `Lambda authorizer backend (${authorizerLambdaId})`,
+                url: `[reference(resourceId('Microsoft.Web/sites', '${authorizerLambdaId}')).defaultHostName]`,
+                protocol: "http"
+              },
+              dependsOn: [
+                `[resourceId('Microsoft.ApiManagement/service', '${apimName}')]`,
+                `[resourceId('Microsoft.Web/sites', '${authorizerLambdaId}')]`
+              ]
+            });
+          }
+          return resources;
+        }
+        // ── Policy ────────────────────────────────────────────────────────────
+        case "Policy.IAM": {
+          const statements = props.statements ?? [];
+          const attachType = props.attachType;
+          const attachTo = props.attachTo;
+          const actions = [];
+          const notActions = [];
+          for (const s of statements) {
+            const stmtActions = s.actions;
+            if (s.effect === "Allow")
+              actions.push(...stmtActions);
+            else
+              notActions.push(...stmtActions);
+          }
+          const principalType = attachType === "lambda" ? "FunctionApp" : "VirtualMachine";
+          return [
+            {
+              type: "Microsoft.Authorization/roleDefinitions",
+              apiVersion: "2022-04-01",
+              name: `[guid(resourceGroup().id, '${construct.id}')]`,
+              location,
+              properties: {
+                roleName: `${construct.id}-role`,
+                description: props.description ?? `Custom role for ${attachTo}`,
+                type: "CustomRole",
+                permissions: [{
+                  actions,
+                  notActions,
+                  dataActions: [],
+                  notDataActions: []
+                }],
+                assignableScopes: [`[resourceGroup().id]`]
+              }
+            },
+            {
+              type: "Microsoft.Authorization/roleAssignments",
+              apiVersion: "2022-04-01",
+              name: `[guid(resourceGroup().id, '${attachTo}', '${construct.id}')]`,
+              location,
+              dependsOn: [`[resourceId('Microsoft.Authorization/roleDefinitions', guid(resourceGroup().id, '${construct.id}'))]`],
+              properties: {
+                roleDefinitionId: `[resourceId('Microsoft.Authorization/roleDefinitions', guid(resourceGroup().id, '${construct.id}'))]`,
+                principalType,
+                description: `Role assignment for ${attachTo} (${principalType})`
+              }
+            }
+          ];
+        }
+        // ── Events ────────────────────────────────────────────────────────────
+        case "Events.EventBridge": {
+          const rules = props.rules ?? [];
+          return [{
+            type: "Microsoft.EventGrid/namespaces",
+            apiVersion: "2023-06-01-preview",
+            name: props.busName ?? construct.id,
+            location,
+            tags: tag(construct.id),
+            sku: { name: "Standard", capacity: 1 },
+            properties: {
+              topicsConfiguration: {},
+              topicSpacesConfiguration: {
+                state: "Enabled"
+              }
+            }
+          }, ...rules.map((r) => ({
+            type: "Microsoft.EventGrid/eventSubscriptions",
+            apiVersion: "2022-06-15",
+            name: r.name ?? construct.id,
+            location,
+            properties: {
+              destination: {
+                endpointType: "WebHook",
+                properties: { endpointUrl: r.targetArn ?? "" }
+              },
+              filter: {
+                includedEventTypes: r.detailTypes ?? ["*"]
+              }
+            }
+          }))];
+        }
+        // ── Workflow ──────────────────────────────────────────────────────────
+        case "Workflow.StepFunctions": {
+          const steps = props.steps ?? [];
+          const definition = {
+            definition: {
+              "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+              contentVersion: "1.0.0.0",
+              triggers: {},
+              actions: Object.fromEntries(steps.map((s, i) => [s.name, {
+                type: "Http",
+                inputs: { method: "POST", uri: s.resource ?? "" },
+                runAfter: i > 0 ? { [steps[i - 1].name]: ["Succeeded"] } : {}
+              }]))
+            }
+          };
+          return [{
+            type: "Microsoft.Logic/workflows",
+            apiVersion: "2019-05-01",
+            name: construct.id,
+            location,
+            tags: tag(construct.id),
+            properties: definition
+          }];
+        }
+        // ── Messaging ─────────────────────────────────────────────────────────
+        case "Messaging.Queue": {
+          const nsName = `${construct.id}-ns`;
+          return [
+            {
+              type: "Microsoft.ServiceBus/namespaces",
+              apiVersion: "2022-10-01-preview",
+              name: nsName,
+              location,
+              tags: tag(construct.id),
+              sku: { name: "Standard", tier: "Standard" },
+              properties: {}
+            },
+            {
+              type: "Microsoft.ServiceBus/namespaces/queues",
+              apiVersion: "2022-10-01-preview",
+              name: `${nsName}/${construct.id}`,
+              location,
+              dependsOn: [`[resourceId('Microsoft.ServiceBus/namespaces', '${nsName}')]`],
+              properties: {
+                lockDuration: `PT${props.visibilityTimeoutSeconds ?? 30}S`,
+                maxSizeInMegabytes: 1024,
+                requiresDuplicateDetection: false,
+                requiresSession: false,
+                defaultMessageTimeToLive: `P${Math.floor((props.messageRetentionSeconds ?? 345600) / 86400)}D`,
+                deadLetteringOnMessageExpiration: false
+              }
+            }
+          ];
+        }
+        case "Messaging.Topic": {
+          const nsName = `${construct.id}-ns`;
+          const subscriptions = props.subscriptions ?? [];
+          const resources = [
+            {
+              type: "Microsoft.ServiceBus/namespaces",
+              apiVersion: "2022-10-01-preview",
+              name: nsName,
+              location,
+              tags: tag(construct.id),
+              sku: { name: "Standard", tier: "Standard" },
+              properties: {}
+            },
+            {
+              type: "Microsoft.ServiceBus/namespaces/topics",
+              apiVersion: "2022-10-01-preview",
+              name: `${nsName}/${construct.id}`,
+              location,
+              dependsOn: [`[resourceId('Microsoft.ServiceBus/namespaces', '${nsName}')]`],
+              properties: {
+                defaultMessageTimeToLive: "P14D",
+                requiresDuplicateDetection: false
+              }
+            }
+          ];
+          subscriptions.forEach((s, i) => {
+            resources.push({
+              type: "Microsoft.ServiceBus/namespaces/topics/subscriptions",
+              apiVersion: "2022-10-01-preview",
+              name: `${nsName}/${construct.id}/sub-${i}`,
+              location,
+              dependsOn: [`[resourceId('Microsoft.ServiceBus/namespaces/topics', '${nsName}', '${construct.id}')]`],
+              properties: {
+                lockDuration: "PT30S",
+                deadLetteringOnMessageExpiration: false,
+                forwardTo: s.endpoint
+              }
+            });
+          });
+          return resources;
+        }
+        // ── Secret / Certificate ──────────────────────────────────────────────
+        case "Secret.Vault": {
+          const kvName = `${construct.id.toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 24)}-kv`;
+          return [{
+            type: "Microsoft.KeyVault/vaults",
+            apiVersion: "2023-02-01",
+            name: kvName,
+            location,
+            tags: tag(construct.id),
+            properties: {
+              sku: { family: "A", name: "standard" },
+              tenantId: "[subscription().tenantId]",
+              enableSoftDelete: true,
+              softDeleteRetentionInDays: 90,
+              enablePurgeProtection: true,
+              enabledForDeployment: false,
+              accessPolicies: []
+            }
+          }];
+        }
+        case "Certificate.TLS": {
+          const kvName = `${construct.id.toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 20)}-kv`;
+          return [{
+            type: "Microsoft.KeyVault/vaults/certificates",
+            apiVersion: "2023-02-01",
+            name: `${kvName}/${construct.id.replace(/[^a-zA-Z0-9-]/g, "-")}`,
+            location,
+            properties: {
+              properties: {
+                x509CertificateProperties: {
+                  subject: `CN=${props.domainName}`,
+                  subjectAlternativeNames: {
+                    dnsNames: [props.domainName, ...props.subjectAlternativeNames ?? []]
+                  },
+                  validityInMonths: 12
+                },
+                issuerParameters: { name: "Self", issuerName: "Self" },
+                keyProperties: { keyType: "RSA", keySize: 2048, exportable: true }
+              }
+            }
+          }];
+        }
+        // ── Monitoring ────────────────────────────────────────────────────────
+        case "Monitoring.Alarm": {
+          const dimensions = props.dimensions;
+          const operatorMap = {
+            GreaterThanThreshold: "GreaterThan",
+            LessThanThreshold: "LessThan",
+            GreaterThanOrEqualToThreshold: "GreaterThanOrEqual",
+            LessThanOrEqualToThreshold: "LessThanOrEqual"
+          };
+          return [{
+            type: "Microsoft.Insights/metricAlerts",
+            apiVersion: "2018-03-01",
+            name: construct.id,
+            location: "global",
+            tags: tag(construct.id),
+            properties: {
+              description: `Alarm for ${props.metricName}`,
+              severity: 2,
+              enabled: true,
+              evaluationFrequency: `PT${props.periodSeconds ?? 60}S`,
+              windowSize: `PT${(props.periodSeconds ?? 60) * (props.evaluationPeriods ?? 2)}S`,
+              criteria: {
+                "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria",
+                allOf: [{
+                  name: "criterion1",
+                  metricName: props.metricName,
+                  metricNamespace: props.namespace ?? "Microsoft.Web/sites",
+                  operator: operatorMap[props.comparisonOperator ?? "GreaterThanThreshold"] ?? "GreaterThan",
+                  threshold: props.threshold,
+                  timeAggregation: props.statistic ?? "Average",
+                  dimensions: dimensions ? Object.entries(dimensions).map(([k, v]) => ({ name: k, operator: "Include", values: [v] })) : []
+                }]
+              },
+              actions: (props.alarmActions ?? []).map((a) => ({ actionGroupId: a }))
+            }
+          }];
+        }
+        case "Monitoring.Dashboard": {
+          const widgets = props.widgets ?? [];
+          return [{
+            type: "Microsoft.Portal/dashboards",
+            apiVersion: "2020-09-01-preview",
+            name: construct.id,
+            location,
+            tags: {
+              "hidden-title": construct.id
+            },
+            properties: {
+              lenses: [{
+                order: 0,
+                parts: widgets.map((w, i) => ({
+                  position: { x: i % 3 * 4, y: Math.floor(i / 3) * 4, colSpan: 4, rowSpan: 4 },
+                  metadata: {
+                    type: "Extension/Microsoft_Azure_Monitoring/PartType/MetricsChartPart",
+                    settings: {
+                      content: {
+                        options: { chart: { metrics: [{ name: w.metricName, resourceMetadata: {} }] } },
+                        title: w.title
+                      }
+                    }
+                  }
+                }))
+              }]
+            }
+          }];
+        }
+        case "Logging.Stream": {
+          const wsName = `${construct.id}-law`;
+          return [{
+            type: "Microsoft.OperationalInsights/workspaces",
+            apiVersion: "2022-10-01",
+            name: wsName,
+            location,
+            tags: tag(construct.id),
+            properties: {
+              sku: { name: "PerGB2018" },
+              retentionInDays: props.retentionDays ?? 30,
+              features: { enableLogAccessUsingOnlyResourcePermissions: true }
+            }
+          }];
+        }
+        case "Custom.Resource": {
+          const arm = props.arm;
+          if (!arm)
+            return [];
+          return [{
+            type: arm.type,
+            apiVersion: arm.apiVersion,
+            name: props.name ?? construct.id,
+            location,
+            tags: tag(construct.id),
+            properties: arm.properties,
+            ...arm.sku ? { sku: arm.sku } : {},
+            ...arm.kind ? { kind: arm.kind } : {}
+          }];
+        }
+        default:
+          console.warn(`[azure] Construct type '${construct.type}' nao suportado \u2014 descartado.`);
+          return [];
+      }
+    }
+    function synthesize(stack) {
+      const resources = [];
+      for (const construct of stack.constructs) {
+        const result = synthesizeConstruct(construct);
+        resources.push(...result);
+      }
+      return {
+        $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+        contentVersion: "1.0.0.0",
+        resources
+      };
+    }
+  }
+});
+
+// ../providers/azure/dist/provider.js
+var require_provider2 = __commonJS({
+  "../providers/azure/dist/provider.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.AzureProvider = void 0;
+    var arm_1 = require_arm();
+    var AzureProvider2 = class {
+      name = "azure";
+      synthesize(stack) {
+        return (0, arm_1.synthesize)(stack);
+      }
+    };
+    exports2.AzureProvider = AzureProvider2;
+  }
+});
+
+// ../providers/azure/dist/index.js
+var require_dist2 = __commonJS({
+  "../providers/azure/dist/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.synthesize = exports2.AzureProvider = void 0;
+    var provider_1 = require_provider2();
+    Object.defineProperty(exports2, "AzureProvider", { enumerable: true, get: function() {
+      return provider_1.AzureProvider;
+    } });
+    var arm_1 = require_arm();
+    Object.defineProperty(exports2, "synthesize", { enumerable: true, get: function() {
+      return arm_1.synthesize;
+    } });
+  }
+});
+
+// ../providers/gcp/dist/synth/deployment-manager.js
+var require_deployment_manager = __commonJS({
+  "../providers/gcp/dist/synth/deployment-manager.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.synthesize = synthesize;
+    var INSTANCE_TYPE_MAP = {
+      small: "e2-small",
+      medium: "e2-medium",
+      large: "e2-standard-4"
+    };
+    var GCP_IMAGE_MAP = {
+      "ubuntu": "projects/ubuntu-os-cloud/global/images/family/ubuntu-2204-lts",
+      "ubuntu-22.04": "projects/ubuntu-os-cloud/global/images/family/ubuntu-2204-lts",
+      "ubuntu-20.04": "projects/ubuntu-os-cloud/global/images/family/ubuntu-2004-lts",
+      "windows-2022": "projects/windows-cloud/global/images/family/windows-2022",
+      "windows-2019": "projects/windows-cloud/global/images/family/windows-2019",
+      "windows-2016": "projects/windows-cloud/global/images/family/windows-2016"
+    };
+    function resolveGcpImage(image) {
+      if (!image)
+        return "projects/ubuntu-os-cloud/global/images/family/ubuntu-2204-lts";
+      return GCP_IMAGE_MAP[image] ?? `global/images/${image}`;
+    }
+    var CACHE_TIER_MAP = {
+      small: "BASIC",
+      medium: "STANDARD_HA",
+      large: "STANDARD_HA"
+    };
+    var CACHE_CAPACITY_MAP = {
+      small: 1,
+      medium: 5,
+      large: 16
+    };
+    var K8S_MACHINE_MAP = {
+      small: "e2-medium",
+      medium: "e2-standard-4",
+      large: "n2-standard-8"
+    };
+    function gcpRegion(regionOrZone) {
+      if (!regionOrZone)
+        return "us-central1";
+      const parts = regionOrZone.split("-");
+      if (parts.length >= 3 && parts[parts.length - 1].match(/^[a-z]$/)) {
+        return parts.slice(0, -1).join("-");
+      }
+      return regionOrZone;
+    }
+    function synthesizeConstruct(construct) {
+      const props = construct.props;
+      const zone = props.region ?? "us-central1-a";
+      const region = gcpRegion(props.region);
+      switch (construct.type) {
+        // ── Compute ──────────────────────────────────────────────────────────
+        case "Compute.Instance":
+          return [{
+            name: construct.id,
+            type: "compute.v1.instance",
+            properties: {
+              zone,
+              machineType: `zones/${zone}/machineTypes/${INSTANCE_TYPE_MAP[props.instanceType] ?? "e2-small"}`,
+              disks: [{
+                boot: true,
+                autoDelete: true,
+                initializeParams: {
+                  sourceImage: resolveGcpImage(props.image)
+                }
+              }],
+              networkInterfaces: [{ network: "global/networks/default" }]
+            }
+          }];
+        case "Compute.AutoScaling": {
+          const machineType = INSTANCE_TYPE_MAP[props.instanceType] ?? "e2-small";
+          const templateName = `${construct.id}-template`;
+          const resources = [
+            {
+              name: templateName,
+              type: "compute.v1.instanceTemplate",
+              properties: {
+                properties: {
+                  machineType,
+                  disks: [{
+                    boot: true,
+                    autoDelete: true,
+                    initializeParams: {
+                      sourceImage: resolveGcpImage(props.image)
+                    }
+                  }],
+                  networkInterfaces: [{ network: "global/networks/default" }]
+                }
+              }
+            },
+            {
+              name: construct.id,
+              type: "compute.v1.regionInstanceGroupManager",
+              properties: {
+                region,
+                baseInstanceName: construct.id,
+                instanceTemplate: `global/instanceTemplates/${templateName}`,
+                targetSize: props.desiredCapacity ?? props.minCapacity ?? 1
+              }
+            }
+          ];
+          if (props.minCapacity !== void 0 || props.targetCpuUtilization) {
+            resources.push({
+              name: `${construct.id}-autoscaler`,
+              type: "compute.v1.regionAutoscaler",
+              properties: {
+                region,
+                target: `regions/${region}/instanceGroupManagers/${construct.id}`,
+                autoscalingPolicy: {
+                  minNumReplicas: props.minCapacity ?? 1,
+                  maxNumReplicas: props.maxCapacity ?? 10,
+                  coolDownPeriodSec: 60,
+                  ...props.targetCpuUtilization ? {
+                    cpuUtilization: { utilizationTarget: props.targetCpuUtilization / 100 }
+                  } : {}
+                }
+              }
+            });
+          }
+          return resources;
+        }
+        case "Compute.Container": {
+          const environment = props.environment ?? {};
+          const envVars = Object.entries(environment).map(([k, v]) => ({ name: k, value: v }));
+          return [{
+            name: construct.id,
+            type: "run.v2.service",
+            properties: {
+              location: region,
+              template: {
+                containers: [{
+                  image: props.image,
+                  resources: {
+                    limits: {
+                      cpu: String(Math.round((props.cpu ?? 256) / 1e3)),
+                      memory: `${props.memory ?? 512}Mi`
+                    }
+                  },
+                  ports: props.port ? [{ containerPort: props.port }] : [],
+                  env: envVars
+                }],
+                scaling: {
+                  minInstanceCount: props.minInstances ?? 0,
+                  maxInstanceCount: props.desiredCount ?? 10
+                }
+              },
+              ingress: props.publicIp ? "INGRESS_TRAFFIC_ALL" : "INGRESS_TRAFFIC_INTERNAL_ONLY"
+            }
+          }];
+        }
+        case "Compute.Kubernetes": {
+          const machineType = K8S_MACHINE_MAP[props.nodeInstanceType ?? "medium"] ?? "e2-standard-4";
+          return [{
+            name: construct.id,
+            type: "container.v1.cluster",
+            properties: {
+              location: region,
+              cluster: {
+                name: construct.id,
+                currentMasterVersion: props.version ?? "1.29",
+                initialNodeCount: props.desiredNodes ?? 2,
+                nodePools: [{
+                  name: "default-pool",
+                  config: {
+                    machineType,
+                    diskSizeGb: 100,
+                    oauthScopes: ["https://www.googleapis.com/auth/cloud-platform"]
+                  },
+                  autoscaling: {
+                    enabled: true,
+                    minNodeCount: props.minNodes ?? 1,
+                    maxNodeCount: props.maxNodes ?? 3
+                  },
+                  initialNodeCount: props.desiredNodes ?? 2
+                }],
+                masterAuth: { clientCertificateConfig: { issueClientCertificate: false } },
+                networkConfig: {
+                  enableIntraNodeVisibility: true,
+                  datapathProvider: "ADVANCED_DATAPATH"
+                },
+                privateClusterConfig: props.privateCluster ? {
+                  enablePrivateNodes: true,
+                  enablePrivateEndpoint: true,
+                  masterIpv4CidrBlock: "172.16.0.32/28"
+                } : {}
+              }
+            }
+          }];
+        }
+        // ── Storage ───────────────────────────────────────────────────────────
+        case "Storage.Bucket": {
+          const lifecycleRules = props.lifecycleRules ?? [];
+          const gcsRules = [];
+          for (const r of lifecycleRules) {
+            const prefixCond = r.prefix ? { matchesPrefix: [r.prefix] } : {};
+            if (r.transitionToGlacierDays) {
+              gcsRules.push({
+                action: { type: "SetStorageClass", storageClass: "ARCHIVE" },
+                condition: { age: r.transitionToGlacierDays, ...prefixCond }
+              });
+            }
+            if (r.expireAfterDays) {
+              gcsRules.push({
+                action: { type: "Delete" },
+                condition: { age: r.expireAfterDays, ...prefixCond }
+              });
+            }
+          }
+          return [{
+            name: construct.id.toLowerCase().replace(/[^a-z0-9-]/g, "-"),
+            type: "storage.v1.bucket",
+            properties: {
+              location: props.location ?? "US",
+              versioning: { enabled: props.versioning ?? false },
+              iamConfiguration: {
+                uniformBucketLevelAccess: { enabled: !props.publicAccess }
+              },
+              ...gcsRules.length > 0 ? { lifecycle: { rule: gcsRules } } : {}
+            }
+          }];
+        }
+        case "Storage.FileSystem":
+          return [{
+            name: construct.id.toLowerCase(),
+            type: "file.v1.instance",
+            properties: {
+              location: `${region}-a`,
+              tier: props.performanceMode === "maxIO" ? "HIGH_SCALE_SSD" : "STANDARD",
+              networks: [{ network: "default", modes: ["MODE_IPV4"] }],
+              fileShares: [{
+                name: construct.id,
+                capacityGb: 1024
+              }]
+            }
+          }];
+        case "Storage.Archive":
+          return [{
+            name: `${construct.id.toLowerCase().replace(/[^a-z0-9-]/g, "-")}-archive`,
+            type: "storage.v1.bucket",
+            properties: {
+              location: props.location ?? "US",
+              storageClass: "ARCHIVE",
+              iamConfiguration: { uniformBucketLevelAccess: { enabled: true } },
+              lifecycle: {
+                rule: props.retentionDays ? [{
+                  action: { type: "Delete" },
+                  condition: { age: props.retentionDays }
+                }] : []
+              }
+            }
+          }];
+        // ── Network ───────────────────────────────────────────────────────────
+        case "Network.VPC":
+          return [{
+            name: construct.id,
+            type: "compute.v1.network",
+            properties: {
+              autoCreateSubnetworks: false,
+              routingConfig: { routingMode: "REGIONAL" },
+              description: `VPC ${construct.id}`
+            }
+          }];
+        case "Network.Subnet":
+          return [{
+            name: construct.id,
+            type: "compute.v1.subnetwork",
+            properties: {
+              network: `global/networks/${props.vpcId}`,
+              ipCidrRange: props.cidr,
+              region,
+              privateIpGoogleAccess: !props.public,
+              ...props.availabilityZone ? { description: `AZ: ${props.availabilityZone}` } : {}
+            }
+          }];
+        case "Network.SecurityGroup": {
+          const ingress = props.ingressRules ?? [];
+          const egress = props.egressRules ?? [];
+          const ingressResources = ingress.map((r, i) => {
+            if (r.cidr === void 0) {
+              console.warn(`[gcp] Security group rule sem CIDR; usando 0.0.0.0/0 \u2014 defina props.cidr explicitamente (${construct.id} ingress[${i}])`);
+            }
+            return {
+              name: `${construct.id}-ingress-${i}`,
+              type: "compute.v1.firewall",
+              properties: {
+                network: `global/networks/${props.vpcId}`,
+                direction: "INGRESS",
+                priority: 1e3 + i,
+                allowed: [{
+                  IPProtocol: r.protocol === "-1" ? "all" : r.protocol,
+                  ...r.protocol !== "-1" ? {
+                    ports: r.fromPort === r.toPort ? [`${r.fromPort}`] : [`${r.fromPort}-${r.toPort}`]
+                  } : {}
+                }],
+                sourceRanges: [r.cidr ?? "0.0.0.0/0"],
+                description: r.description ?? ""
+              }
+            };
+          });
+          const egressList = egress.length > 0 ? egress : [{
+            protocol: "-1",
+            fromPort: 0,
+            toPort: 0,
+            cidr: "0.0.0.0/0",
+            description: "Allow all egress"
+          }];
+          const egressResources = egressList.map((r, i) => ({
+            name: `${construct.id}-egress-${i}`,
+            type: "compute.v1.firewall",
+            properties: {
+              network: `global/networks/${props.vpcId}`,
+              direction: "EGRESS",
+              priority: 1e3 + i,
+              allowed: [{
+                IPProtocol: r.protocol === "-1" ? "all" : r.protocol,
+                ...r.protocol !== "-1" && r.fromPort !== 0 ? {
+                  ports: r.fromPort === r.toPort ? [`${r.fromPort}`] : [`${r.fromPort}-${r.toPort}`]
+                } : {}
+              }],
+              destinationRanges: [r.cidr ?? "0.0.0.0/0"],
+              description: r.description ?? ""
+            }
+          }));
+          return [...ingressResources, ...egressResources];
+        }
+        case "Network.WAF": {
+          const rules = props.rules ?? [];
+          const securityRules = rules.map((r, i) => ({
+            priority: r.priority ?? i + 1,
+            action: r.action ?? "allow",
+            match: r.managedGroup ? { expr: { expression: 'evaluatePreconfiguredExpr("sqli-stable")' } } : {
+              versionedExpr: "SRC_IPS_V1",
+              config: { srcIpRanges: r.sourceIps ?? ["*"] }
+            },
+            description: r.description ?? ""
+          }));
+          return [{
+            name: construct.id,
+            type: "compute.v1.securityPolicy",
+            properties: {
+              description: props.description ?? `WAF ${construct.id}`,
+              rules: [
+                ...securityRules,
+                {
+                  priority: 2147483647,
+                  action: props.defaultAction ?? "allow",
+                  match: { versionedExpr: "SRC_IPS_V1", config: { srcIpRanges: ["*"] } },
+                  description: "Default rule"
+                }
+              ]
+            }
+          }];
+        }
+        case "Network.LoadBalancer": {
+          const targetGroups = props.targetGroups ?? [];
+          const lbType = props.type ?? "application";
+          const resources = [{
+            name: `${construct.id}-backend`,
+            type: "compute.v1.backendService",
+            properties: {
+              backends: [],
+              healthChecks: [],
+              protocol: lbType === "network" ? "TCP" : "HTTP",
+              loadBalancingScheme: props.scheme === "internal" ? "INTERNAL" : "EXTERNAL"
+            }
+          }];
+          if (lbType === "application") {
+            resources.push({
+              name: `${construct.id}-url-map`,
+              type: "compute.v1.urlMap",
+              properties: {
+                defaultService: `global/backendServices/${construct.id}-backend`
+              }
+            });
+            resources.push({
+              name: `${construct.id}-http-proxy`,
+              type: "compute.v1.targetHttpProxy",
+              properties: {
+                urlMap: `global/urlMaps/${construct.id}-url-map`
+              }
+            });
+            resources.push({
+              name: `${construct.id}-forwarding-rule`,
+              type: "compute.v1.globalForwardingRule",
+              properties: {
+                target: `global/targetHttpProxies/${construct.id}-http-proxy`,
+                portRange: "80",
+                loadBalancingScheme: "EXTERNAL"
+              }
+            });
+          }
+          return resources;
+        }
+        case "Network.CDN": {
+          const origins = props.origins ?? [];
+          return [
+            {
+              name: `${construct.id}-backend-bucket`,
+              type: "compute.v1.backendBucket",
+              properties: {
+                bucketName: origins[0]?.bucketName ?? origins[0]?.domainName ?? construct.id,
+                enableCdn: true,
+                cdnPolicy: {
+                  cacheMode: "CACHE_ALL_STATIC",
+                  defaultTtl: 3600,
+                  maxTtl: 86400
+                }
+              }
+            },
+            {
+              name: `${construct.id}-url-map`,
+              type: "compute.v1.urlMap",
+              properties: {
+                defaultService: `global/backendBuckets/${construct.id}-backend-bucket`
+              }
+            }
+          ];
+        }
+        case "Network.Dns": {
+          const records = props.records ?? [];
+          const zoneName = props.zoneName.replace(/\./g, "-").replace(/-+$/, "");
+          const resources = [{
+            name: `${zoneName}-zone`,
+            type: "dns.v1.managedZone",
+            properties: {
+              dnsName: `${props.zoneName}.`,
+              description: `DNS zone for ${props.zoneName}`,
+              visibility: "public"
+            }
+          }];
+          if (records.length > 0) {
+            resources.push({
+              name: `${zoneName}-records`,
+              type: "dns.v1.resourceRecordSet",
+              properties: {
+                managedZone: `${zoneName}-zone`,
+                name: `${records[0].name}.`,
+                type: records[0].type,
+                ttl: records[0].ttl ?? 300,
+                rrdatas: records[0].values
+              }
+            });
+          }
+          return resources;
+        }
+        // ── Database ──────────────────────────────────────────────────────────
+        case "Database.SQL": {
+          const engine = props.engine ?? "mysql";
+          const edition = props.edition ?? "";
+          const dbVersionMap = {
+            mysql: "MYSQL_8_0",
+            postgres: "POSTGRES_15",
+            mariadb: "MYSQL_8_0",
+            // MariaDB → MySQL no Cloud SQL (mais compatível)
+            sqlserver: `SQLSERVER_2019_${(edition || "EXPRESS").toUpperCase()}`,
+            oracle: "POSTGRES_15"
+            // Oracle → AlloyDB/PostgreSQL (postgres-compatible)
+          };
+          const dbVersion = dbVersionMap[engine] ?? "MYSQL_8_0";
+          const defaultTier = engine === "sqlserver" ? "db-custom-2-4096" : "db-f1-micro";
+          return [{
+            name: construct.id,
+            type: "sqladmin.v1beta4.instance",
+            properties: {
+              databaseVersion: dbVersion,
+              region,
+              settings: {
+                tier: props.instanceType ?? defaultTier,
+                backupConfiguration: {
+                  enabled: true,
+                  binaryLogEnabled: engine === "mysql" || engine === "mariadb"
+                },
+                storageAutoResize: true,
+                storageAutoResizeLimit: props.storageGb ?? 20,
+                availabilityType: props.multiAz ? "REGIONAL" : "ZONAL"
+              }
+            }
+          }];
+        }
+        case "Database.DocumentDB":
+          return [{
+            name: construct.id,
+            type: "firestore.v1.database",
+            properties: {
+              locationId: region,
+              type: "FIRESTORE_NATIVE",
+              concurrencyMode: "PESSIMISTIC",
+              appEngineIntegrationMode: "DISABLED",
+              deleteProtectionState: props.deletionProtection ? "DELETE_PROTECTION_ENABLED" : "DELETE_PROTECTION_DISABLED"
+            }
+          }];
+        case "Database.DynamoDB":
+          return [{
+            name: construct.id.toLowerCase(),
+            type: "bigtableadmin.v2.instance",
+            properties: {
+              parent: "projects/PROJECT_ID",
+              instanceId: construct.id.toLowerCase(),
+              instance: {
+                displayName: construct.id,
+                type: "PRODUCTION"
+              },
+              clusters: {
+                "cluster-1": {
+                  location: `projects/PROJECT_ID/locations/${region}-a`,
+                  serveNodes: 1,
+                  defaultStorageType: "SSD"
+                }
+              }
+            }
+          }];
+        // ── Cache ─────────────────────────────────────────────────────────────
+        case "Cache.Redis": {
+          const nodeType = props.nodeType ?? "small";
+          return [{
+            name: construct.id.toLowerCase().replace(/[^a-z0-9-]/g, "-"),
+            type: "redis.v1.instance",
+            properties: {
+              region,
+              tier: CACHE_TIER_MAP[nodeType] ?? "BASIC",
+              memorySizeGb: CACHE_CAPACITY_MAP[nodeType] ?? 1,
+              redisVersion: `REDIS_${(props.version ?? "7.0").replace(".", "_")}`,
+              authEnabled: props.transitEncryptionEnabled ?? true,
+              transitEncryptionMode: props.transitEncryptionEnabled ? "SERVER_AUTHENTICATION" : "DISABLED",
+              ...props.subnetGroupName ? { authorizedNetwork: `projects/PROJECT_ID/global/networks/${props.subnetGroupName}` } : {}
+            }
+          }];
+        }
+        case "Cache.Memcached": {
+          const numNodes = props.numCacheNodes ?? 2;
+          return [{
+            name: construct.id.toLowerCase().replace(/[^a-z0-9-]/g, "-"),
+            type: "memcache.v1.instance",
+            properties: {
+              region,
+              nodeCount: numNodes,
+              nodeConfig: {
+                cpuCount: 1,
+                memorySizeMb: 1024
+              },
+              ...props.subnetGroupName ? { authorizedNetwork: `projects/PROJECT_ID/global/networks/${props.subnetGroupName}` } : {}
+            }
+          }];
+        }
+        // ── Function ──────────────────────────────────────────────────────────
+        case "Function.Lambda": {
+          const environment = props.environment ?? {};
+          const runtimeMap = {
+            "nodejs20": "nodejs20",
+            "nodejs18": "nodejs18",
+            "python3.12": "python312",
+            "python3.11": "python311",
+            "java21": "java21",
+            "go1.x": "go121",
+            "dotnet8": "dotnet8"
+          };
+          return [{
+            name: construct.id,
+            type: "cloudfunctions.v2.function",
+            properties: {
+              location: region,
+              description: `Function ${construct.id}`,
+              buildConfig: {
+                runtime: runtimeMap[props.runtime ?? "nodejs20"] ?? "nodejs20",
+                entryPoint: props.handler ?? "handler"
+              },
+              serviceConfig: {
+                availableMemory: `${props.memory ?? 128}Mi`,
+                timeoutSeconds: props.timeout ?? 30,
+                ...props.reservedConcurrency ? { maxInstanceCount: props.reservedConcurrency } : {},
+                ...Object.keys(environment).length > 0 ? { environmentVariables: environment } : {}
+              }
+            }
+          }];
+        }
+        case "Function.ApiGateway": {
+          const routes = props.routes ?? [];
+          const authorizerLambdaId = props.authorizerLambdaId;
+          const securityDefinitions = authorizerLambdaId ? {
+            lambdaAuthorizer: {
+              type: "apiKey",
+              name: "Authorization",
+              in: "header",
+              "x-google-authorizer-backend": { address: `https://${region}-PROJECT_ID.cloudfunctions.net/${authorizerLambdaId}` }
+            }
+          } : void 0;
+          return [
+            {
+              name: props.name ?? construct.id,
+              type: "apigateway.v1.api",
+              properties: {
+                displayName: props.name ?? construct.id
+              }
+            },
+            {
+              name: `${construct.id}-config`,
+              type: "apigateway.v1.apiConfig",
+              properties: {
+                api: props.name ?? construct.id,
+                displayName: `${construct.id} config`,
+                openapiDocuments: [{
+                  document: {
+                    path: "openapi.yaml",
+                    contents: Buffer.from(JSON.stringify({
+                      openapi: "3.0.0",
+                      info: { title: props.name ?? construct.id, version: "1.0" },
+                      ...securityDefinitions ? { securityDefinitions } : {},
+                      paths: Object.fromEntries(routes.map((r) => [r.path, {
+                        [r.method.toLowerCase()]: {
+                          "x-google-backend": { address: `https://${region}-PROJECT_ID.cloudfunctions.net/${r.lambdaId ?? "function"}` },
+                          ...securityDefinitions ? { security: [{ lambdaAuthorizer: [] }] } : {},
+                          responses: { "200": { description: "OK" } }
+                        }
+                      }]))
+                    })).toString("base64")
+                  }
+                }]
+              }
+            }
+          ];
+        }
+        // ── Policy ────────────────────────────────────────────────────────────
+        case "Policy.IAM": {
+          const statements = props.statements ?? [];
+          const attachTo = props.attachTo;
+          const serviceAccount = `${attachTo.toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 30)}@PROJECT_ID.iam.gserviceaccount.com`;
+          return [
+            {
+              name: `${construct.id}-sa`,
+              type: "iam.v1.serviceAccount",
+              properties: {
+                accountId: attachTo.toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 30),
+                displayName: `Service Account for ${attachTo}`,
+                description: props.description ?? ""
+              }
+            },
+            ...statements.map((s, i) => ({
+              name: `${construct.id}-binding-${i}`,
+              type: "gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding",
+              properties: {
+                resource: "PROJECT_ID",
+                role: s.actions[0]?.startsWith("roles/") ? s.actions[0] : `roles/custom.${construct.id.replace(/[^a-zA-Z0-9]/g, "")}`,
+                member: `serviceAccount:${serviceAccount}`
+              }
+            }))
+          ];
+        }
+        // ── Events ────────────────────────────────────────────────────────────
+        case "Events.EventBridge": {
+          const rules = props.rules ?? [];
+          const resources = [];
+          if (props.busName && props.busName !== "default") {
+            resources.push({
+              name: props.busName,
+              type: "pubsub.v1.topic",
+              properties: {
+                messageStoragePolicy: {
+                  allowedPersistenceRegions: [region]
+                }
+              }
+            });
+          }
+          for (const r of rules) {
+            const topicName = `${construct.id}-${r.name ?? "rule"}`;
+            resources.push({
+              name: topicName,
+              type: "pubsub.v1.topic",
+              properties: {
+                messageStoragePolicy: {
+                  allowedPersistenceRegions: [region]
+                }
+              }
+            });
+            if (r.targetArn) {
+              resources.push({
+                name: `${topicName}-sub`,
+                type: "pubsub.v1.subscription",
+                properties: {
+                  topic: topicName,
+                  pushConfig: { pushEndpoint: r.targetArn },
+                  ackDeadlineSeconds: 30
+                }
+              });
+            }
+          }
+          return resources;
+        }
+        // ── Workflow ──────────────────────────────────────────────────────────
+        case "Workflow.StepFunctions": {
+          const steps = props.steps ?? [];
+          const definition = {
+            main: {
+              steps: steps.map((s, i) => ({
+                [s.name]: {
+                  call: "http.post",
+                  args: { url: s.resource ?? "" },
+                  ...i < steps.length - 1 ? { next: steps[i + 1].name } : {}
+                }
+              }))
+            }
+          };
+          return [{
+            name: construct.id,
+            type: "workflows.v1.workflow",
+            properties: {
+              region,
+              description: props.description ?? "",
+              sourceContents: JSON.stringify(definition, null, 2)
+            }
+          }];
+        }
+        // ── Messaging ─────────────────────────────────────────────────────────
+        case "Messaging.Queue": {
+          const topicName = construct.id;
+          const subName = `${construct.id}-sub`;
+          return [
+            {
+              name: topicName,
+              type: "pubsub.v1.topic",
+              properties: {
+                messageStoragePolicy: { allowedPersistenceRegions: [region] },
+                ...props.encrypted ? { kmsKeyName: `projects/PROJECT_ID/locations/${region}/keyRings/default/cryptoKeys/default` } : {}
+              }
+            },
+            {
+              name: subName,
+              type: "pubsub.v1.subscription",
+              properties: {
+                topic: topicName,
+                ackDeadlineSeconds: props.visibilityTimeoutSeconds ?? 30,
+                messageRetentionDuration: `${props.messageRetentionSeconds ?? 345600}s`,
+                retainAckedMessages: false,
+                ...props.dlqArn ? {
+                  deadLetterPolicy: {
+                    deadLetterTopic: props.dlqArn,
+                    maxDeliveryAttempts: props.maxReceiveCount ?? 5
+                  }
+                } : {}
+              }
+            }
+          ];
+        }
+        case "Messaging.Topic": {
+          const subscriptions = props.subscriptions ?? [];
+          const resources = [{
+            name: construct.id,
+            type: "pubsub.v1.topic",
+            properties: {
+              messageStoragePolicy: { allowedPersistenceRegions: [region] },
+              ...props.encrypted ? { kmsKeyName: `projects/PROJECT_ID/locations/${region}/keyRings/default/cryptoKeys/default` } : {}
+            }
+          }];
+          subscriptions.forEach((s, i) => {
+            resources.push({
+              name: `${construct.id}-sub-${i}`,
+              type: "pubsub.v1.subscription",
+              properties: {
+                topic: construct.id,
+                ackDeadlineSeconds: 30,
+                ...s.protocol === "https" || s.protocol === "http" ? { pushConfig: { pushEndpoint: s.endpoint } } : {}
+              }
+            });
+          });
+          return resources;
+        }
+        // ── Secret / Certificate ──────────────────────────────────────────────
+        case "Secret.Vault": {
+          const resources = [{
+            name: construct.id.replace(/[^a-zA-Z0-9_-]/g, "-"),
+            type: "secretmanager.v1.secret",
+            properties: {
+              parent: "projects/PROJECT_ID",
+              secretId: construct.id.replace(/[^a-zA-Z0-9_-]/g, "-"),
+              secret: {
+                replication: {
+                  automatic: {}
+                },
+                ...props.kmsKeyId ? { customerManagedEncryption: { kmsKeyName: props.kmsKeyId } } : {},
+                ...props.rotationDays ? {
+                  rotation: {
+                    nextRotationTime: new Date(Date.now() + props.rotationDays * 864e5).toISOString(),
+                    rotationPeriod: `${props.rotationDays * 86400}s`
+                  }
+                } : {}
+              }
+            }
+          }];
+          return resources;
+        }
+        case "Certificate.TLS": {
+          const sans = props.subjectAlternativeNames ?? [];
+          return [{
+            name: construct.id.replace(/[^a-zA-Z0-9-]/g, "-"),
+            type: "certificatemanager.v1.certificate",
+            properties: {
+              name: construct.id.replace(/[^a-zA-Z0-9-]/g, "-"),
+              managed: {
+                domains: [props.domainName, ...sans]
+              },
+              scope: props.region ? "REGIONAL" : "DEFAULT"
+            }
+          }];
+        }
+        // ── Monitoring ────────────────────────────────────────────────────────
+        case "Monitoring.Alarm": {
+          const dimensions = props.dimensions;
+          const operatorMap = {
+            GreaterThanThreshold: "COMPARISON_GT",
+            LessThanThreshold: "COMPARISON_LT",
+            GreaterThanOrEqualToThreshold: "COMPARISON_GE",
+            LessThanOrEqualToThreshold: "COMPARISON_LE"
+          };
+          const dimFilter = dimensions ? Object.entries(dimensions).map(([k, v]) => `metric.labels.${k}="${v}"`).join(" AND ") : "";
+          return [{
+            name: construct.id,
+            type: "monitoring.v3.alertPolicy",
+            properties: {
+              displayName: construct.id,
+              conditions: [{
+                displayName: `${props.metricName} condition`,
+                conditionThreshold: {
+                  filter: [
+                    `metric.type="${props.namespace ?? "cloudfunctions.googleapis.com/function"}/${props.metricName}"`,
+                    dimFilter
+                  ].filter(Boolean).join(" AND "),
+                  comparison: operatorMap[props.comparisonOperator ?? "GreaterThanThreshold"] ?? "COMPARISON_GT",
+                  thresholdValue: props.threshold,
+                  duration: `${(props.periodSeconds ?? 60) * (props.evaluationPeriods ?? 2)}s`,
+                  aggregations: [{
+                    alignmentPeriod: `${props.periodSeconds ?? 60}s`,
+                    perSeriesAligner: "ALIGN_MEAN"
+                  }]
+                }
+              }],
+              alertStrategy: { notificationRateLimit: { period: "300s" } },
+              combiner: "OR",
+              enabled: true,
+              notificationChannels: props.alarmActions ?? []
+            }
+          }];
+        }
+        case "Monitoring.Dashboard": {
+          const widgets = props.widgets ?? [];
+          return [{
+            name: construct.id,
+            type: "monitoring.v1.dashboard",
+            properties: {
+              displayName: construct.id,
+              gridLayout: {
+                columns: 3,
+                widgets: widgets.map((w) => ({
+                  title: w.title,
+                  ...w.type === "text" ? {
+                    text: { content: w.markdown ?? w.title, format: "MARKDOWN" }
+                  } : {
+                    xyChart: {
+                      dataSets: [{
+                        timeSeriesQuery: {
+                          timeSeriesFilter: {
+                            filter: `metric.type="${w.namespace ?? "cloudfunctions.googleapis.com"}/${w.metricName}"`,
+                            aggregation: { alignmentPeriod: `${w.period ?? 60}s`, perSeriesAligner: "ALIGN_MEAN" }
+                          }
+                        }
+                      }]
+                    }
+                  }
+                }))
+              }
+            }
+          }];
+        }
+        case "Logging.Stream": {
+          const filters = props.subscriptionFilters ?? [];
+          const resources = [{
+            name: construct.id.replace(/[^a-zA-Z0-9_-]/g, "-"),
+            type: "logging.v2.logBucket",
+            properties: {
+              parent: `projects/PROJECT_ID/locations/${region}`,
+              bucketId: construct.id.replace(/[^a-zA-Z0-9_-]/g, "-"),
+              retentionDays: props.retentionDays ?? 30
+            }
+          }];
+          for (const f of filters) {
+            resources.push({
+              name: `${construct.id}-sink-${f.name.replace(/[^a-zA-Z0-9-]/g, "-")}`,
+              type: "logging.v2.sink",
+              properties: {
+                parent: `projects/PROJECT_ID`,
+                uniqueWriterIdentity: true,
+                filter: f.filterPattern,
+                destination: f.destinationArn
+              }
+            });
+          }
+          return resources;
+        }
+        case "Custom.Resource": {
+          const dm = props.deploymentManager;
+          if (!dm)
+            return [];
+          return [{ name: props.name ?? construct.id, type: dm.type, properties: dm.properties }];
+        }
+        default:
+          console.warn(`[gcp] Construct type '${construct.type}' nao suportado \u2014 descartado.`);
+          return [];
+      }
+    }
+    function synthesize(stack) {
+      const resources = [];
+      for (const construct of stack.constructs) {
+        const result = synthesizeConstruct(construct);
+        resources.push(...result);
+      }
+      return { resources };
+    }
+  }
+});
+
+// ../providers/gcp/dist/provider.js
+var require_provider3 = __commonJS({
+  "../providers/gcp/dist/provider.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.GCPProvider = void 0;
+    var deployment_manager_1 = require_deployment_manager();
+    var GCPProvider2 = class {
+      name = "gcp";
+      synthesize(stack) {
+        return (0, deployment_manager_1.synthesize)(stack);
+      }
+    };
+    exports2.GCPProvider = GCPProvider2;
+  }
+});
+
+// ../providers/gcp/dist/index.js
+var require_dist3 = __commonJS({
+  "../providers/gcp/dist/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.synthesize = exports2.GCPProvider = void 0;
+    var provider_1 = require_provider3();
+    Object.defineProperty(exports2, "GCPProvider", { enumerable: true, get: function() {
+      return provider_1.GCPProvider;
+    } });
+    var deployment_manager_1 = require_deployment_manager();
+    Object.defineProperty(exports2, "synthesize", { enumerable: true, get: function() {
+      return deployment_manager_1.synthesize;
+    } });
+  }
+});
+
+// ../providers/terraform/dist/synth/hcl.js
+var require_hcl = __commonJS({
+  "../providers/terraform/dist/synth/hcl.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.hclString = hclString;
+    exports2.synthesize = synthesize;
+    var INSTANCE_TYPE_MAP = {
+      small: "t3.small",
+      medium: "t3.medium",
+      large: "t3.large"
+    };
+    var AMI_MAP = {
+      "ubuntu": "data.aws_ami.ubuntu.id",
+      "ubuntu-22.04": "data.aws_ami.ubuntu.id",
+      "amazon-linux-2": "data.aws_ami.amazon_linux.id",
+      "amazon-linux-2023": "data.aws_ami.amazon_linux_2023.id",
+      "windows-2022": "data.aws_ami.windows_2022.id",
+      "windows-2019": "data.aws_ami.windows_2019.id",
+      "windows-2016": "data.aws_ami.windows_2016.id"
+    };
+    var CACHE_NODE_TYPE_MAP = {
+      small: "cache.t3.micro",
+      medium: "cache.t3.medium",
+      large: "cache.r6g.large"
+    };
+    var K8S_NODE_TYPE_MAP = {
+      small: "t3.medium",
+      medium: "m5.large",
+      large: "m5.2xlarge"
+    };
+    function indent(text, spaces = 2) {
+      return text.split("\n").map((l) => l.trim() ? " ".repeat(spaces) + l : l).join("\n");
+    }
+    function block(type, labels, body) {
+      const labelStr = labels.map((l) => ` "${l}"`).join("");
+      return `${type}${labelStr} {
+${body}
+}
+`;
+    }
+    function hclString(value) {
+      return String(value ?? "").replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\$\{/g, "$$$${").replace(/%\{/g, "%%{");
+    }
+    function attr(key, value) {
+      if (typeof value === "string")
+        return `${key} = "${hclString(value)}"`;
+      return `${key} = ${value}`;
+    }
+    function tagsBlock(name) {
+      return indent(`tags = {
+${indent(`Name = "${hclString(name)}"`)}
+}`);
+    }
+    function hclValue(value) {
+      if (typeof value === "string") {
+        if (/^[a-zA-Z_][a-zA-Z0-9_.\[\]]*$/.test(value) && /\./.test(value))
+          return value;
+        return `"${hclString(value)}"`;
+      }
+      if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+      if (Array.isArray(value))
+        return `[${value.map(hclValue).join(", ")}]`;
+      if (value && typeof value === "object")
+        return hclBody(value);
+      return "null";
+    }
+    function hclBody(obj) {
+      const lines = Object.entries(obj).map(([k, v]) => `${k} = ${hclValue(v)}`);
+      return `{
+${indent(lines.join("\n"))}
+}`;
+    }
+    function synthesizeConstruct(construct) {
+      const props = construct.props;
+      const id = construct.id.replace(/[^a-zA-Z0-9_]/g, "_");
+      switch (construct.type) {
+        // ── Compute ──────────────────────────────────────────────────────────
+        case "Compute.Instance": {
+          const instanceType = INSTANCE_TYPE_MAP[props.instanceType] ?? "t3.small";
+          const ami = AMI_MAP[props.image];
+          const body = indent([
+            `ami           = ${ami ? ami : `"${hclString(props.image)}"`}`,
+            attr("instance_type", instanceType),
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          return block("resource", ["aws_instance", id], body);
+        }
+        case "Compute.AutoScaling": {
+          const instanceType = INSTANCE_TYPE_MAP[props.instanceType] ?? "t3.small";
+          const image = props.image;
+          const lcBody = indent([
+            `image_id      = "${hclString(image)}"`,
+            attr("instance_type", instanceType)
+          ].join("\n"));
+          const asgBody = indent([
+            `launch_configuration = aws_launch_configuration.${id}_lc.name`,
+            attr("min_size", props.minCapacity),
+            attr("max_size", props.maxCapacity),
+            attr("desired_capacity", props.desiredCapacity ?? props.minCapacity),
+            ...props.subnetIds ? [`vpc_zone_identifier = ${JSON.stringify(props.subnetIds)}`] : [],
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          const parts = [
+            block("resource", ["aws_launch_configuration", `${id}_lc`], lcBody),
+            block("resource", ["aws_autoscaling_group", id], asgBody)
+          ];
+          if (props.targetCpuUtilization) {
+            const spBody = indent([
+              `autoscaling_group_name = aws_autoscaling_group.${id}.name`,
+              attr("policy_type", "TargetTrackingScaling"),
+              `target_tracking_configuration {
+  predefined_metric_specification {
+    predefined_metric_type = "ASGAverageCPUUtilization"
+  }
+  target_value = ${props.targetCpuUtilization}
+}`
+            ].join("\n"));
+            parts.push(block("resource", ["aws_autoscaling_policy", `${id}_sp`], spBody));
+          }
+          return parts.join("\n");
+        }
+        case "Compute.Container": {
+          const environment = props.environment;
+          const containerDef = JSON.stringify([{
+            name: construct.id,
+            image: props.image,
+            cpu: props.cpu ?? 256,
+            memory: props.memory ?? 512,
+            portMappings: props.port ? [{ containerPort: props.port, protocol: "tcp" }] : [],
+            environment: environment ? Object.entries(environment).map(([k, v]) => ({ name: k, value: v })) : []
+          }]);
+          const clusterBody = indent([attr("name", construct.id)].join("\n"));
+          const tdBody = indent([
+            attr("family", construct.id),
+            attr("network_mode", "awsvpc"),
+            `requires_compatibilities = ["FARGATE"]`,
+            attr("cpu", String(props.cpu ?? 256)),
+            attr("memory", String(props.memory ?? 512)),
+            `execution_role_arn = "arn:aws:iam::ACCOUNT_ID:role/ecsTaskExecutionRole"`,
+            `container_definitions = jsonencode(${containerDef})`
+          ].join("\n"));
+          const svcBody = indent([
+            `cluster         = aws_ecs_cluster.${id}.id`,
+            `task_definition = aws_ecs_task_definition.${id}.arn`,
+            attr("desired_count", props.desiredCount ?? 1),
+            attr("launch_type", "FARGATE"),
+            `network_configuration {
+  assign_public_ip = ${props.publicIp ?? false}
+  subnets         = []
+}`
+          ].join("\n"));
+          return [
+            block("resource", ["aws_ecs_cluster", id], clusterBody),
+            block("resource", ["aws_ecs_task_definition", id], tdBody),
+            block("resource", ["aws_ecs_service", id], svcBody)
+          ].join("\n");
+        }
+        case "Compute.Kubernetes": {
+          const nodeType = K8S_NODE_TYPE_MAP[props.nodeInstanceType ?? "medium"] ?? "m5.large";
+          const clusterBody = indent([
+            attr("name", construct.id),
+            attr("version", props.version ?? "1.29"),
+            `role_arn = "arn:aws:iam::ACCOUNT_ID:role/EKSClusterRole"`,
+            `vpc_config {
+  subnet_ids              = []
+  endpoint_private_access = ${props.privateCluster ?? false}
+  endpoint_public_access  = ${!props.privateCluster}
+}`,
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          const ngBody = indent([
+            `cluster_name    = aws_eks_cluster.${id}.name`,
+            attr("node_group_name", `${construct.id}-ng`),
+            `node_role_arn   = "arn:aws:iam::ACCOUNT_ID:role/EKSNodeRole"`,
+            `subnet_ids      = []`,
+            `scaling_config {
+  desired_size = ${props.desiredNodes ?? 2}
+  max_size     = ${props.maxNodes ?? 3}
+  min_size     = ${props.minNodes ?? 1}
+}`,
+            `instance_types = ["${nodeType}"]`
+          ].join("\n"));
+          return [
+            block("resource", ["aws_eks_cluster", id], clusterBody),
+            block("resource", ["aws_eks_node_group", `${id}_ng`], ngBody)
+          ].join("\n");
+        }
+        // ── Storage ───────────────────────────────────────────────────────────
+        case "Storage.Bucket": {
+          const versioning = props.versioning ?? false;
+          const blockPublic = !props.publicAccess;
+          const lifecycleRules = props.lifecycleRules ?? [];
+          const bucketBody = indent([
+            attr("bucket", construct.id.toLowerCase()),
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          const versioningBody = indent([
+            `bucket = aws_s3_bucket.${id}.id`,
+            `versioning_configuration {
+  status = "${versioning ? "Enabled" : "Suspended"}"
+}`
+          ].join("\n"));
+          const pabBody = indent([
+            `bucket                  = aws_s3_bucket.${id}.id`,
+            attr("block_public_acls", blockPublic),
+            attr("block_public_policy", blockPublic),
+            attr("ignore_public_acls", blockPublic),
+            attr("restrict_public_buckets", blockPublic)
+          ].join("\n"));
+          const parts = [
+            block("resource", ["aws_s3_bucket", id], bucketBody),
+            block("resource", ["aws_s3_bucket_versioning", `${id}_versioning`], versioningBody),
+            block("resource", ["aws_s3_bucket_public_access_block", `${id}_pab`], pabBody)
+          ];
+          if (lifecycleRules.length > 0) {
+            const lcLines = lifecycleRules.map((r, i) => {
+              return [
+                `  rule {`,
+                `    id     = "rule-${i}"`,
+                `    status = "Enabled"`,
+                r.prefix ? `    filter {
+      prefix = "${hclString(r.prefix)}"
+    }` : "",
+                r.expireAfterDays ? `    expiration {
+      days = ${r.expireAfterDays}
+    }` : "",
+                r.transitionToGlacierDays ? `    transition {
+      days          = ${r.transitionToGlacierDays}
+      storage_class = "GLACIER"
+    }` : "",
+                `  }`
+              ].filter(Boolean).join("\n");
+            }).join("\n");
+            parts.push(block("resource", ["aws_s3_bucket_lifecycle_configuration", `${id}_lc`], indent(`bucket = aws_s3_bucket.${id}.id
+${lcLines}`)));
+          }
+          return parts.join("\n");
+        }
+        case "Storage.FileSystem": {
+          const fsBody = indent([
+            attr("performance_mode", props.performanceMode ?? "generalPurpose"),
+            attr("throughput_mode", props.throughputMode ?? "bursting"),
+            attr("encrypted", props.encrypted ?? true),
+            `lifecycle_policy {
+  transition_to_ia = "AFTER_30_DAYS"
+}`,
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          const parts = [block("resource", ["aws_efs_file_system", id], fsBody)];
+          const accessPoints = props.accessPoints ?? [];
+          for (const ap of accessPoints) {
+            const apId = `${id}_ap_${ap.name.replace(/[^a-zA-Z0-9_]/g, "_")}`;
+            const apBody = indent([
+              `file_system_id = aws_efs_file_system.${id}.id`,
+              `root_directory {
+  path = "${hclString(ap.path)}"
+}`,
+              ap.uid ? `posix_user {
+  uid = ${ap.uid}
+  gid = ${ap.gid ?? ap.uid}
+}` : ""
+            ].filter(Boolean).join("\n"));
+            parts.push(block("resource", ["aws_efs_access_point", apId], apBody));
+          }
+          return parts.join("\n");
+        }
+        case "Storage.Archive": {
+          const body = indent([
+            attr("bucket", `${construct.id.toLowerCase()}-archive`),
+            `lifecycle_rule {
+  id      = "archive-rule"
+  enabled = true
+  transition {
+    days          = 0
+    storage_class = "DEEP_ARCHIVE"
+  }
+${props.retentionDays ? `  expiration {
+    days = ${props.retentionDays}
+  }
+` : ""}}`,
+            `object_lock_enabled = ${props.lockEnabled ?? false}`,
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          return block("resource", ["aws_s3_bucket", id], body);
+        }
+        // ── Network ───────────────────────────────────────────────────────────
+        case "Network.VPC": {
+          const body = indent([
+            attr("cidr_block", props.cidr ?? "10.0.0.0/16"),
+            attr("enable_dns_hostnames", true),
+            attr("enable_dns_support", true),
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          return block("resource", ["aws_vpc", id], body);
+        }
+        case "Network.Subnet": {
+          const isPublic = props.public ?? false;
+          const lines = [
+            `vpc_id = "${hclString(props.vpcId)}"`,
+            attr("cidr_block", props.cidr),
+            attr("map_public_ip_on_launch", isPublic),
+            ...props.availabilityZone ? [attr("availability_zone", props.availabilityZone)] : [],
+            "",
+            tagsBlock(construct.id)
+          ];
+          return block("resource", ["aws_subnet", id], indent(lines.join("\n")));
+        }
+        case "Network.SecurityGroup": {
+          const ingress = props.ingressRules ?? [];
+          const egress = props.egressRules ?? [];
+          const ingressBlocks = ingress.map((r, i) => {
+            if (r.cidr === void 0) {
+              console.warn(`[terraform] Security group rule sem CIDR; usando 0.0.0.0/0 \u2014 defina props.cidr explicitamente (${construct.id} ingress[${i}])`);
+            }
+            return indent([
+              "ingress {",
+              indent([
+                attr("protocol", r.protocol),
+                attr("from_port", r.fromPort),
+                attr("to_port", r.toPort),
+                `cidr_blocks = ["${hclString(r.cidr ?? "0.0.0.0/0")}"]`,
+                r.description ? attr("description", r.description) : ""
+              ].filter(Boolean).join("\n")),
+              "}"
+            ].join("\n"));
+          }).join("\n");
+          const egressList = egress.length > 0 ? egress : [{ protocol: "-1", fromPort: 0, toPort: 0, cidr: "0.0.0.0/0" }];
+          const egressBlocks = egressList.map((r) => indent([
+            "egress {",
+            indent([
+              attr("protocol", r.protocol),
+              attr("from_port", r.fromPort),
+              attr("to_port", r.toPort),
+              `cidr_blocks = ["${hclString(r.cidr ?? "0.0.0.0/0")}"]`
+            ].join("\n")),
+            "}"
+          ].join("\n"))).join("\n");
+          const body = indent([
+            `vpc_id      = "${hclString(props.vpcId)}"`,
+            attr("description", props.description ?? `Security group ${id}`),
+            "",
+            ingressBlocks,
+            "",
+            egressBlocks,
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          return block("resource", ["aws_security_group", id], body);
+        }
+        case "Network.WAF": {
+          const rules = props.rules ?? [];
+          const scope = props.scope ?? "REGIONAL";
+          const defaultAction = props.defaultAction ?? "allow";
+          const ruleBlocks = rules.map((r, i) => {
+            const action = r.action ?? "allow";
+            const ruleId = (r.name ?? `rule${i}`).replace(/[^a-zA-Z0-9_]/g, "_");
+            const statement = r.managedGroup ? `statement {
+    managed_rule_group_statement {
+      name        = "${hclString(r.managedGroup)}"
+      vendor_name = "AWS"
+    }
+  }` : `statement {
+    byte_match_statement {
+      search_string = "${hclString((r.matchValues ?? ["BadBot"])[0])}"
+      field_to_match { single_header { name = "user-agent" } }
+      text_transformation { priority = 0 type = "NONE" }
+      positional_constraint = "CONTAINS"
+    }
+  }`;
+            return indent([
+              "rule {",
+              indent([
+                attr("name", r.name ?? `rule-${i}`),
+                attr("priority", r.priority ?? i + 1),
+                `action {
+  ${action === "block" ? "block" : action === "count" ? "count" : "allow"} {}
+}`,
+                statement,
+                `visibility_config {
+  cloudwatch_metrics_enabled = true
+  metric_name                = "${ruleId}"
+  sampled_requests_enabled   = true
+}`
+              ].join("\n")),
+              "}"
+            ].join("\n"));
+          }).join("\n");
+          const body = indent([
+            attr("name", id),
+            attr("scope", scope),
+            `default_action {
+  ${defaultAction === "block" ? "block" : "allow"} {}
+}`,
+            ruleBlocks,
+            `visibility_config {
+  cloudwatch_metrics_enabled = true
+  metric_name                = "${id}"
+  sampled_requests_enabled   = true
+}`,
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          return block("resource", ["aws_wafv2_web_acl", id], body);
+        }
+        case "Network.LoadBalancer": {
+          const lbType = props.type ?? "application";
+          const listeners = props.listeners ?? [];
+          const targetGroups = props.targetGroups ?? [];
+          const lbBody = indent([
+            attr("name", construct.id),
+            attr("load_balancer_type", lbType),
+            attr("internal", props.scheme === "internal"),
+            `subnets = ${JSON.stringify(props.subnetIds ?? [])}`,
+            ...lbType === "application" && props.securityGroupIds ? [`security_groups = ${JSON.stringify(props.securityGroupIds)}`] : [],
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          const parts = [block("resource", ["aws_lb", id], lbBody)];
+          for (const tg of targetGroups) {
+            const tgId = `${id}_tg_${tg.name.replace(/[^a-zA-Z0-9_]/g, "_")}`;
+            const tgBody = indent([
+              attr("name", tg.name),
+              attr("port", tg.port),
+              attr("protocol", tg.protocol),
+              `vpc_id      = ""`,
+              `target_type = "ip"`,
+              `health_check {
+  path = "${hclString(tg.healthCheckPath ?? "/")}"
+}`
+            ].join("\n"));
+            parts.push(block("resource", ["aws_lb_target_group", tgId], tgBody));
+          }
+          for (let i = 0; i < listeners.length; i++) {
+            const l = listeners[i];
+            const listenerId = `${id}_listener_${i + 1}`;
+            const redirectAction = `redirect {
+    port        = "443"
+    protocol    = "HTTPS"
+    status_code = "HTTP_301"
+  }`;
+            const fixedAction = `fixed_response {
+    content_type = "text/plain"
+    message_body = "Not found"
+    status_code  = "404"
+  }`;
+            const listenerBody = indent([
+              `load_balancer_arn = aws_lb.${id}.arn`,
+              attr("port", l.port),
+              attr("protocol", l.protocol),
+              ...l.certificateArn ? [attr("certificate_arn", l.certificateArn)] : [],
+              `default_action {
+  type = "${l.redirectToHttps ? "redirect" : "fixed-response"}"
+  ${l.redirectToHttps ? redirectAction : fixedAction}
+}`
+            ].join("\n"));
+            parts.push(block("resource", ["aws_lb_listener", listenerId], listenerBody));
+          }
+          return parts.join("\n");
+        }
+        case "Network.CDN": {
+          const origins = props.origins ?? [];
+          const body = indent([
+            `origin {
+  domain_name = "${hclString(origins[0]?.domainName ?? "")}"
+  origin_id   = "${hclString(origins[0]?.id ?? "default")}"
+}`,
+            `enabled             = true`,
+            attr("default_root_object", props.defaultRootObject ?? "index.html"),
+            attr("price_class", props.priceClass ?? "PriceClass_100"),
+            `default_cache_behavior {
+  target_origin_id       = "${hclString(origins[0]?.id ?? "default")}"
+  viewer_protocol_policy = "redirect-to-https"
+  allowed_methods        = ["GET", "HEAD"]
+  cached_methods         = ["GET", "HEAD"]
+  compress               = true
+  forwarded_values {
+    query_string = false
+    cookies { forward = "none" }
+  }
+}`,
+            ...props.certificateArn ? [`viewer_certificate {
+  acm_certificate_arn = "${hclString(props.certificateArn)}"
+  ssl_support_method  = "sni-only"
+}`] : [`viewer_certificate {
+  cloudfront_default_certificate = true
+}`],
+            `restrictions {
+  geo_restriction {
+    restriction_type = "none"
+  }
+}`,
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          return block("resource", ["aws_cloudfront_distribution", id], body);
+        }
+        case "Network.Dns": {
+          const records = props.records ?? [];
+          const zoneBody = indent([
+            attr("name", props.zoneName),
+            tagsBlock(construct.id)
+          ].join("\n"));
+          const parts = [block("resource", ["aws_route53_zone", id], zoneBody)];
+          for (const r of records) {
+            const recId = `${id}_${r.name.replace(/[^a-zA-Z0-9_]/g, "_")}_${r.type}`;
+            const recBody = indent([
+              `zone_id = aws_route53_zone.${id}.zone_id`,
+              attr("name", r.name),
+              attr("type", r.type),
+              attr("ttl", r.ttl ?? 300),
+              `records = ${JSON.stringify(r.values)}`
+            ].join("\n"));
+            parts.push(block("resource", ["aws_route53_record", recId], recBody));
+          }
+          return parts.join("\n");
+        }
+        // ── Database ──────────────────────────────────────────────────────────
+        case "Database.SQL": {
+          const engine = props.engine ?? "mysql";
+          const edition = props.edition ?? "";
+          const licenseModel = props.licenseModel ?? "";
+          const engineVersionMap = {
+            mysql: "8.0.36",
+            postgres: "15.4",
+            mariadb: "10.11.6",
+            oracle: "19.0.0.0.ru-2024-01.rur-2024-01.r1",
+            sqlserver: "15.00.4365.2.v1"
+          };
+          const engineIdentMap = {
+            mysql: "mysql",
+            postgres: "postgres",
+            mariadb: "mariadb",
+            oracle: `oracle-${edition || "se2"}`,
+            sqlserver: `sqlserver-${edition || "ex"}`
+          };
+          const defaultInstanceMap = {
+            mysql: "db.t3.micro",
+            postgres: "db.t3.micro",
+            mariadb: "db.t3.micro",
+            oracle: "db.t3.small",
+            sqlserver: "db.t3.small"
+          };
+          const usernameMap = {
+            mysql: "dbadmin",
+            postgres: "dbadmin",
+            mariadb: "dbadmin",
+            oracle: "dbadmin",
+            sqlserver: "sqladmin"
+          };
+          const attrs = [
+            attr("identifier", construct.id.toLowerCase()),
+            attr("engine", engineIdentMap[engine] ?? engine),
+            attr("engine_version", engineVersionMap[engine] ?? "8.0.36"),
+            attr("instance_class", props.instanceType ?? defaultInstanceMap[engine] ?? "db.t3.micro"),
+            attr("allocated_storage", props.storageGb ?? 20),
+            attr("username", usernameMap[engine] ?? "dbadmin"),
+            `password = var.db_password`,
+            attr("multi_az", props.multiAz ?? false),
+            attr("skip_final_snapshot", false),
+            attr("storage_encrypted", true),
+            attr("backup_retention_period", props.backupRetentionDays ?? 7),
+            attr("deletion_protection", props.deletionProtection ?? false)
+          ];
+          if (licenseModel)
+            attrs.push(attr("license_model", licenseModel));
+          attrs.push("", tagsBlock(construct.id));
+          return block("resource", ["aws_db_instance", id], indent(attrs.join("\n")));
+        }
+        case "Database.DocumentDB": {
+          const instances = props.instances ?? 1;
+          const clusterBody = indent([
+            attr("cluster_identifier", construct.id.toLowerCase()),
+            attr("engine", "docdb"),
+            attr("master_username", "docdbadmin"),
+            `master_password = var.db_password`,
+            attr("backup_retention_period", 7),
+            attr("skip_final_snapshot", false),
+            attr("storage_encrypted", true),
+            attr("deletion_protection", props.deletionProtection ?? false),
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          const instanceBlocks = Array.from({ length: instances }, (_, i) => block("resource", ["aws_docdb_cluster_instance", `${id}_instance_${i + 1}`], indent([
+            attr("identifier", `${construct.id.toLowerCase()}-${i + 1}`),
+            `cluster_id     = aws_docdb_cluster.${id}.id`,
+            attr("instance_class", props.instanceType ?? "db.t3.medium")
+          ].join("\n")))).join("\n");
+          return [block("resource", ["aws_docdb_cluster", id], clusterBody), instanceBlocks].join("\n");
+        }
+        case "Database.DynamoDB": {
+          const billingMode = props.billingMode ?? "PAY_PER_REQUEST";
+          const gsis = props.globalSecondaryIndexes ?? [];
+          const gsiBlocks = gsis.map((g) => indent([
+            "global_secondary_index {",
+            indent([
+              attr("name", g.name),
+              attr("hash_key", g.partitionKey),
+              ...g.sortKey ? [attr("range_key", g.sortKey)] : [],
+              attr("projection_type", "ALL")
+            ].join("\n")),
+            "}"
+          ].join("\n"))).join("\n");
+          const body = indent([
+            attr("name", construct.id),
+            attr("billing_mode", billingMode),
+            ...billingMode === "PROVISIONED" ? [
+              attr("read_capacity", props.readCapacity ?? 5),
+              attr("write_capacity", props.writeCapacity ?? 5)
+            ] : [],
+            attr("hash_key", props.partitionKey),
+            ...props.sortKey ? [attr("range_key", props.sortKey)] : [],
+            `attribute {
+  name = "${hclString(props.partitionKey)}"
+  type = "S"
+}`,
+            ...props.sortKey ? [`attribute {
+  name = "${hclString(props.sortKey)}"
+  type = "S"
+}`] : [],
+            ...gsis.map((g) => `attribute {
+  name = "${hclString(g.partitionKey)}"
+  type = "S"
+}`),
+            gsiBlocks,
+            ...props.ttlAttribute ? [`ttl {
+  attribute_name = "${hclString(props.ttlAttribute)}"
+  enabled        = true
+}`] : [],
+            `point_in_time_recovery {
+  enabled = ${props.pointInTimeRecovery ?? true}
+}`,
+            ...props.streamEnabled ? [`stream_enabled   = true`, `stream_view_type = "NEW_AND_OLD_IMAGES"`] : [],
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          return block("resource", ["aws_dynamodb_table", id], body);
+        }
+        // ── Cache ─────────────────────────────────────────────────────────────
+        case "Cache.Redis": {
+          const numNodes = props.numCacheNodes ?? 1;
+          const autoFailover = props.automaticFailoverEnabled ?? false;
+          const body = indent([
+            attr("replication_group_id", construct.id.toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 40)),
+            attr("description", `Redis ${construct.id}`),
+            attr("node_type", CACHE_NODE_TYPE_MAP[props.nodeType ?? "small"] ?? "cache.t3.micro"),
+            attr("num_cache_clusters", numNodes),
+            attr("automatic_failover_enabled", autoFailover && numNodes > 1),
+            attr("at_rest_encryption_enabled", props.atRestEncryptionEnabled ?? true),
+            attr("transit_encryption_enabled", props.transitEncryptionEnabled ?? true),
+            attr("engine_version", props.version ?? "7.0"),
+            ...props.subnetGroupName ? [attr("subnet_group_name", props.subnetGroupName)] : [],
+            ...props.securityGroupIds ? [`security_group_ids = ${JSON.stringify(props.securityGroupIds)}`] : [],
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          return block("resource", ["aws_elasticache_replication_group", id], body);
+        }
+        case "Cache.Memcached": {
+          const body = indent([
+            attr("cluster_id", construct.id.toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 40)),
+            attr("engine", "memcached"),
+            attr("node_type", CACHE_NODE_TYPE_MAP[props.nodeType ?? "small"] ?? "cache.t3.micro"),
+            attr("num_cache_nodes", props.numCacheNodes ?? 2),
+            ...props.subnetGroupName ? [attr("subnet_group_name", props.subnetGroupName)] : [],
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          return block("resource", ["aws_elasticache_cluster", id], body);
+        }
+        // ── Function ──────────────────────────────────────────────────────────
+        case "Function.Lambda": {
+          const environment = props.environment;
+          const runtimeMap = {
+            "nodejs20": "nodejs20.x",
+            "nodejs18": "nodejs18.x",
+            "python3.12": "python3.12",
+            "python3.11": "python3.11",
+            "java21": "java21",
+            "go1.x": "go1.x",
+            "dotnet8": "dotnet8"
+          };
+          const envBlock = environment && Object.keys(environment).length > 0 ? "\n" + indent([
+            "environment {",
+            indent(`variables = {
+${Object.entries(environment).map(([k, v]) => `  ${k} = "${hclString(v)}"`).join("\n")}
+}`),
+            "}"
+          ].join("\n")) : "";
+          const body = indent([
+            attr("function_name", construct.id),
+            attr("runtime", runtimeMap[props.runtime ?? "nodejs20"] ?? "nodejs20.x"),
+            attr("handler", props.handler ?? "index.handler"),
+            attr("role", "arn:aws:iam::ACCOUNT_ID:role/lambda-role"),
+            `filename         = "function.zip"`,
+            `source_code_hash = filebase64sha256("function.zip")`,
+            ...props.memory ? [attr("memory_size", props.memory)] : [],
+            ...props.timeout ? [attr("timeout", props.timeout)] : [],
+            ...props.reservedConcurrency !== void 0 ? [attr("reserved_concurrent_executions", props.reservedConcurrency)] : [],
+            envBlock,
+            ...props.vpcId ? [`vpc_config {
+  subnet_ids         = ${JSON.stringify(props.subnetIds ?? [])}
+  security_group_ids = ${JSON.stringify(props.securityGroupIds ?? [])}
+}`] : [],
+            "",
+            tagsBlock(construct.id)
+          ].filter((l) => l !== "").join("\n"));
+          return block("resource", ["aws_lambda_function", id], body);
+        }
+        case "Function.ApiGateway": {
+          const apigwType = props.type ?? "HTTP";
+          const routes = props.routes ?? [];
+          const stageName = props.stageName ?? "$default";
+          const apiBody = indent([
+            attr("name", props.name),
+            attr("protocol_type", apigwType),
+            ...props.cors ? [`cors_configuration {
+  allow_origins = ["*"]
+  allow_methods = ["*"]
+  allow_headers = ["*"]
+}`] : [],
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          const stageBody = indent([
+            `api_id      = aws_apigatewayv2_api.${id}.id`,
+            attr("name", stageName),
+            attr("auto_deploy", true)
+          ].join("\n"));
+          const parts = [
+            block("resource", ["aws_apigatewayv2_api", id], apiBody),
+            block("resource", ["aws_apigatewayv2_stage", `${id}_stage`], stageBody)
+          ];
+          const authorizerLambdaId = props.authorizerLambdaId;
+          if (authorizerLambdaId) {
+            const authorizerBody = indent([
+              `api_id           = aws_apigatewayv2_api.${id}.id`,
+              attr("authorizer_type", "REQUEST"),
+              attr("name", `${props.name}-authorizer`),
+              `authorizer_uri                    = aws_lambda_function.${authorizerLambdaId}.invoke_arn`,
+              attr("authorizer_payload_format_version", "2.0"),
+              `identity_sources = ["$request.header.Authorization"]`
+            ].join("\n"));
+            parts.push(block("resource", ["aws_apigatewayv2_authorizer", `${id}_authorizer`], authorizerBody));
+          }
+          for (const r of routes) {
+            const routeId = `${id}_${r.method.toLowerCase()}_${r.path.replace(/[^a-zA-Z0-9]/g, "_")}`;
+            const routeBody = indent([
+              `api_id    = aws_apigatewayv2_api.${id}.id`,
+              attr("route_key", `${r.method} ${r.path}`),
+              ...r.lambdaId ? [`target    = "integrations/\${aws_apigatewayv2_integration.${routeId}_integ.id}"`] : [],
+              ...authorizerLambdaId ? [
+                attr("authorization_type", "CUSTOM"),
+                `authorizer_id      = aws_apigatewayv2_authorizer.${id}_authorizer.id`
+              ] : []
+            ].join("\n"));
+            parts.push(block("resource", ["aws_apigatewayv2_route", routeId], routeBody));
+            if (r.lambdaId) {
+              const integBody = indent([
+                `api_id             = aws_apigatewayv2_api.${id}.id`,
+                attr("integration_type", "AWS_PROXY"),
+                `integration_uri    = aws_lambda_function.${r.lambdaId}.invoke_arn`,
+                attr("payload_format_version", "2.0")
+              ].join("\n"));
+              parts.push(block("resource", ["aws_apigatewayv2_integration", `${routeId}_integ`], integBody));
+            }
+          }
+          return parts.join("\n");
+        }
+        // ── Policy ────────────────────────────────────────────────────────────
+        case "Policy.IAM": {
+          const statements = props.statements ?? [];
+          const attachType = props.attachType;
+          const attachTo = props.attachTo.replace(/[^a-zA-Z0-9_]/g, "_");
+          const principalService = attachType === "lambda" ? "lambda.amazonaws.com" : "ec2.amazonaws.com";
+          const policyStmts = statements.map((s) => {
+            const actions = s.actions.map((a) => `"${hclString(a)}"`).join(", ");
+            const resources = (s.resources ?? ["*"]).map((r) => `"${hclString(r)}"`).join(", ");
+            return `    {
+      "Effect": "${hclString(s.effect)}",
+      "Action": [${actions}],
+      "Resource": [${resources}]
+    }`;
+          }).join(",\n");
+          const roleBody = indent([
+            attr("name", `${attachTo}-role`),
+            `assume_role_policy = jsonencode({
+  Version = "2012-10-17"
+  Statement = [{
+    Effect    = "Allow"
+    Principal = { Service = "${principalService}" }
+    Action    = "sts:AssumeRole"
+  }]
+})`,
+            "",
+            tagsBlock(`${attachTo}-role`)
+          ].join("\n"));
+          const policyBody = indent([
+            attr("name", `${id}-policy`),
+            `policy = jsonencode({
+  Version = "2012-10-17"
+  Statement = [
+${policyStmts}
+  ]
+})`
+          ].join("\n"));
+          const attachBody = indent([
+            `role       = aws_iam_role.${id}_role.name`,
+            `policy_arn = aws_iam_policy.${id}_policy.arn`
+          ].join("\n"));
+          const parts = [
+            block("resource", ["aws_iam_role", `${id}_role`], roleBody),
+            block("resource", ["aws_iam_policy", `${id}_policy`], policyBody),
+            block("resource", ["aws_iam_role_policy_attachment", `${id}_attach`], attachBody)
+          ];
+          if (attachType === "compute") {
+            parts.push(block("resource", ["aws_iam_instance_profile", `${id}_profile`], indent([
+              attr("name", `${attachTo}-profile`),
+              `role = aws_iam_role.${id}_role.name`
+            ].join("\n"))));
+          }
+          return parts.join("\n");
+        }
+        // ── Events ────────────────────────────────────────────────────────────
+        case "Events.EventBridge": {
+          const rules = props.rules ?? [];
+          const busName = props.busName ?? "default";
+          const parts = [];
+          if (busName !== "default") {
+            parts.push(block("resource", ["aws_cloudwatch_event_bus", id], indent(attr("name", busName))));
+          }
+          for (const r of rules) {
+            const ruleId = (r.name ?? "rule").replace(/[^a-zA-Z0-9_]/g, "_");
+            const pattern = {};
+            if (r.source)
+              pattern["source"] = r.source;
+            if (r.detailTypes)
+              pattern["detail-type"] = r.detailTypes;
+            const ruleBody = indent([
+              attr("name", r.name),
+              `event_bus_name = "${hclString(busName)}"`,
+              `event_pattern  = jsonencode(${JSON.stringify(pattern)})`,
+              attr("state", "ENABLED")
+            ].join("\n"));
+            parts.push(block("resource", ["aws_cloudwatch_event_rule", `${id}_${ruleId}`], ruleBody));
+            if (r.targetArn) {
+              const targetBody = indent([
+                `rule      = aws_cloudwatch_event_rule.${id}_${ruleId}.name`,
+                attr("target_id", `${ruleId}Target`),
+                attr("arn", r.targetArn)
+              ].join("\n"));
+              parts.push(block("resource", ["aws_cloudwatch_event_target", `${id}_${ruleId}_target`], targetBody));
+            }
+          }
+          return parts.join("\n");
+        }
+        // ── Workflow ──────────────────────────────────────────────────────────
+        case "Workflow.StepFunctions": {
+          const steps = props.steps ?? [];
+          const definition = {
+            Comment: props.description ?? `Workflow ${construct.id}`,
+            StartAt: steps[0]?.name ?? "Start",
+            States: Object.fromEntries(steps.map((s, i) => [s.name, {
+              Type: s.type ?? "Task",
+              Resource: s.resource ?? "",
+              ...i < steps.length - 1 ? { Next: steps[i + 1].name } : { End: true }
+            }]))
+          };
+          const body = indent([
+            attr("name", construct.id),
+            attr("type", props.type ?? "STANDARD"),
+            `definition   = jsonencode(${JSON.stringify(definition)})`,
+            attr("role_arn", "arn:aws:iam::ACCOUNT_ID:role/StepFunctionsExecutionRole"),
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          return block("resource", ["aws_sfn_state_machine", id], body);
+        }
+        // ── Messaging ─────────────────────────────────────────────────────────
+        case "Messaging.Queue": {
+          const fifo = props.fifo ?? false;
+          const body = indent([
+            attr("name", fifo ? `${construct.id}.fifo` : construct.id),
+            attr("visibility_timeout_seconds", props.visibilityTimeoutSeconds ?? 30),
+            attr("message_retention_seconds", props.messageRetentionSeconds ?? 345600),
+            attr("delay_seconds", props.delaySeconds ?? 0),
+            attr("fifo_queue", fifo),
+            attr("sqs_managed_sse_enabled", props.encrypted ?? true),
+            ...props.dlqArn ? [`redrive_policy = jsonencode({
+  deadLetterTargetArn = "${hclString(props.dlqArn)}"
+  maxReceiveCount     = ${props.maxReceiveCount ?? 3}
+})`] : [],
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          return block("resource", ["aws_sqs_queue", id], body);
+        }
+        case "Messaging.Topic": {
+          const fifo = props.fifo ?? false;
+          const subscriptions = props.subscriptions ?? [];
+          const topicBody = indent([
+            attr("name", fifo ? `${construct.id}.fifo` : construct.id),
+            attr("display_name", props.displayName ?? construct.id),
+            attr("fifo_topic", fifo),
+            ...props.encrypted ? [attr("kms_master_key_id", "alias/aws/sns")] : [],
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          const subBlocks = subscriptions.map((s, i) => block("resource", ["aws_sns_topic_subscription", `${id}_sub_${i}`], indent([
+            `topic_arn = aws_sns_topic.${id}.arn`,
+            attr("protocol", s.protocol),
+            attr("endpoint", s.endpoint)
+          ].join("\n")))).join("\n");
+          return [block("resource", ["aws_sns_topic", id], topicBody), subBlocks].filter(Boolean).join("\n");
+        }
+        // ── Secret / Certificate ──────────────────────────────────────────────
+        case "Secret.Vault": {
+          const body = indent([
+            attr("name", construct.id),
+            attr("description", props.description ?? `Secret ${construct.id}`),
+            ...props.kmsKeyId ? [attr("kms_key_id", props.kmsKeyId)] : [],
+            ...props.rotationDays ? [`rotation_rules {
+  automatically_after_days = ${props.rotationDays}
+}`] : [],
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          return block("resource", ["aws_secretsmanager_secret", id], body);
+        }
+        case "Certificate.TLS": {
+          const sans = props.subjectAlternativeNames ?? [];
+          const body = indent([
+            attr("domain_name", props.domainName),
+            attr("validation_method", props.validationMethod ?? "DNS"),
+            ...sans.length > 0 ? [`subject_alternative_names = ${JSON.stringify(sans)}`] : [],
+            `lifecycle {
+  create_before_destroy = true
+}`,
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          return block("resource", ["aws_acm_certificate", id], body);
+        }
+        // ── Monitoring ────────────────────────────────────────────────────────
+        case "Monitoring.Alarm": {
+          const dimensions = props.dimensions;
+          const dimBlock = dimensions ? `dimensions = {
+${Object.entries(dimensions).map(([k, v]) => `  ${k} = "${hclString(v)}"`).join("\n")}
+}` : "";
+          const body = indent([
+            attr("alarm_name", construct.id),
+            attr("metric_name", props.metricName),
+            attr("namespace", props.namespace ?? "AWS/Lambda"),
+            attr("threshold", props.threshold),
+            attr("evaluation_periods", props.evaluationPeriods ?? 2),
+            attr("period", props.periodSeconds ?? 60),
+            attr("comparison_operator", props.comparisonOperator ?? "GreaterThanThreshold"),
+            attr("statistic", props.statistic ?? "Average"),
+            attr("treat_missing_data", props.treatMissingData ?? "notBreaching"),
+            ...props.alarmActions ? [`alarm_actions = ${JSON.stringify(props.alarmActions)}`] : [],
+            ...props.okActions ? [`ok_actions = ${JSON.stringify(props.okActions)}`] : [],
+            dimBlock
+          ].filter(Boolean).join("\n"));
+          return block("resource", ["aws_cloudwatch_metric_alarm", id], body);
+        }
+        case "Monitoring.Dashboard": {
+          const widgets = props.widgets ?? [];
+          const dashBody = {
+            widgets: widgets.map((w, i) => ({
+              type: w.type === "text" ? "text" : "metric",
+              x: i % 3 * 8,
+              y: Math.floor(i / 3) * 6,
+              width: 8,
+              height: 6,
+              properties: w.type === "text" ? { markdown: w.markdown ?? w.title } : { title: w.title, metrics: [[w.namespace ?? "AWS/Lambda", w.metricName]], period: w.period ?? 60, stat: w.stat ?? "Average", view: "timeSeries" }
+            }))
+          };
+          const body = indent([
+            attr("dashboard_name", construct.id),
+            `dashboard_body = jsonencode(${JSON.stringify(dashBody)})`
+          ].join("\n"));
+          return block("resource", ["aws_cloudwatch_dashboard", id], body);
+        }
+        case "Logging.Stream": {
+          const filters = props.subscriptionFilters ?? [];
+          const lgBody = indent([
+            attr("name", `/iacmp/${construct.id}`),
+            attr("retention_in_days", props.retentionDays ?? 30),
+            ...props.kmsKeyId ? [attr("kms_key_id", props.kmsKeyId)] : [],
+            "",
+            tagsBlock(construct.id)
+          ].join("\n"));
+          const parts = [block("resource", ["aws_cloudwatch_log_group", id], lgBody)];
+          for (const f of filters) {
+            const filterId = `${id}_${f.name.replace(/[^a-zA-Z0-9_]/g, "_")}_filter`;
+            const filterBody = indent([
+              `log_group_name  = aws_cloudwatch_log_group.${id}.name`,
+              attr("name", f.name),
+              attr("filter_pattern", f.filterPattern),
+              attr("destination_arn", f.destinationArn)
+            ].join("\n"));
+            parts.push(block("resource", ["aws_cloudwatch_log_subscription_filter", filterId], filterBody));
+          }
+          return parts.join("\n");
+        }
+        case "Custom.Resource": {
+          const tf = props.terraform;
+          if (!tf)
+            return "";
+          const body = indent(Object.entries(tf.body).map(([k, v]) => `${k} = ${hclValue(v)}`).join("\n"));
+          return block("resource", [tf.type, id], body);
+        }
+        default:
+          console.warn(`[terraform] Construct type '${construct.type}' nao suportado \u2014 descartado.`);
+          return "";
+      }
+    }
+    function synthesize(stack) {
+      const awsBlock = block("aws", [], indent(`source  = "hashicorp/aws"
+version = "~> 5.0"`));
+      const requiredProvidersBlock = block("required_providers", [], indent(awsBlock));
+      const terraformBlock = block("terraform", [], indent(requiredProvidersBlock));
+      const providerBlock = block("provider", ["aws"], indent(attr("region", "us-east-1")));
+      const needsDbPassword = stack.constructs.some((c) => c.type === "Database.SQL" || c.type === "Database.DocumentDB");
+      const dbPasswordVar = needsDbPassword ? block("variable", ["db_password"], indent([
+        "type        = string",
+        "sensitive   = true",
+        attr("description", "Senha do administrador do banco de dados (Database.SQL/DocumentDB). Forneca via TF_VAR_db_password ou tfvars.")
+      ].join("\n"))) : "";
+      const header = [terraformBlock, providerBlock, dbPasswordVar].filter(Boolean).join("\n");
+      const resources = stack.constructs.map((c) => synthesizeConstruct(c)).filter(Boolean).join("\n");
+      return [header, resources].filter(Boolean).join("\n");
+    }
+  }
+});
+
+// ../providers/terraform/dist/provider.js
+var require_provider4 = __commonJS({
+  "../providers/terraform/dist/provider.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.TerraformProvider = void 0;
+    var hcl_1 = require_hcl();
+    var TerraformProvider2 = class {
+      name = "terraform";
+      synthesize(stack) {
+        return (0, hcl_1.synthesize)(stack);
+      }
+    };
+    exports2.TerraformProvider = TerraformProvider2;
+  }
+});
+
+// ../providers/terraform/dist/index.js
+var require_dist4 = __commonJS({
+  "../providers/terraform/dist/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.synthesize = exports2.TerraformProvider = void 0;
+    var provider_1 = require_provider4();
+    Object.defineProperty(exports2, "TerraformProvider", { enumerable: true, get: function() {
+      return provider_1.TerraformProvider;
+    } });
+    var hcl_1 = require_hcl();
+    Object.defineProperty(exports2, "synthesize", { enumerable: true, get: function() {
+      return hcl_1.synthesize;
+    } });
+  }
+});
+
+// src/commands/diff.ts
+var diff_exports = {};
+__export(diff_exports, {
+  default: () => Diff
+});
+module.exports = __toCommonJS(diff_exports);
+var import_core = require("@oclif/core");
+var fs4 = __toESM(require("fs"));
+var path3 = __toESM(require("path"));
+var import_chalk = __toESM(require("chalk"));
+var DiffLib = __toESM(require("diff"));
+var import_provider_aws = __toESM(require_dist());
+var import_provider_azure = __toESM(require_dist2());
+var import_provider_gcp = __toESM(require_dist3());
+var import_provider_terraform = __toESM(require_dist4());
+
+// src/synth-out.ts
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+function templateExt(provider) {
+  return provider === "terraform" ? ".tf" : ".json";
+}
+function synthRoot(cwd) {
+  return path.join(cwd, "synth-out");
+}
+function providerOutDir(cwd, provider) {
+  return path.join(synthRoot(cwd), provider);
+}
+function hasTemplates(dir, provider) {
+  const ext = templateExt(provider);
+  try {
+    return fs.readdirSync(dir).some((f) => f.endsWith(ext) && fs.statSync(path.join(dir, f)).isFile());
+  } catch {
+    return false;
+  }
+}
+function resolveTemplateDir(cwd, provider) {
+  const dir = providerOutDir(cwd, provider);
+  if (fs.existsSync(dir)) return dir;
+  const root = synthRoot(cwd);
+  if (fs.existsSync(root) && hasTemplates(root, provider)) return root;
+  return null;
+}
+
+// src/load-stacks.ts
+var fs2 = __toESM(require("fs"));
+var path2 = __toESM(require("path"));
+function findStackFiles(dir) {
+  const entries = fs2.readdirSync(dir, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const full = path2.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...findStackFiles(full));
+    } else if (entry.name.endsWith(".ts") || entry.name.endsWith(".js")) {
+      files.push(full);
+    }
+  }
+  return files;
+}
+
+// src/utils.ts
+var fs3 = __toESM(require("fs"));
+function readJsonFile(filePath) {
+  let content;
+  try {
+    content = fs3.readFileSync(filePath, "utf-8");
+  } catch (e) {
+    throw new Error(`Falha ao ler '${filePath}': ${errMessage(e)}`);
+  }
+  try {
+    return JSON.parse(content);
+  } catch (e) {
+    throw new Error(`JSON inv\xE1lido em '${filePath}': ${errMessage(e)}`);
+  }
+}
+function errMessage(e) {
+  if (e instanceof Error) return e.message;
+  if (typeof e === "string") return e;
+  try {
+    return JSON.stringify(e);
+  } catch {
+    return String(e);
+  }
+}
+
+// src/commands/diff.ts
+var CONTEXT_LINES = 2;
+function renderDiff(oldText, newText) {
+  const changes = DiffLib.diffLines(oldText, newText);
+  let hasChanges = false;
+  const buffer = [];
+  for (const change of changes) {
+    const lines = change.value.split("\n");
+    if (lines[lines.length - 1] === "") lines.pop();
+    for (const line of lines) {
+      if (change.added) {
+        buffer.push({ type: "add", line });
+        hasChanges = true;
+      } else if (change.removed) {
+        buffer.push({ type: "remove", line });
+        hasChanges = true;
+      } else {
+        buffer.push({ type: "same", line });
+      }
+    }
+  }
+  if (!hasChanges) return false;
+  const changedIndexes = /* @__PURE__ */ new Set();
+  buffer.forEach((entry, i) => {
+    if (entry.type !== "same") {
+      for (let c = Math.max(0, i - CONTEXT_LINES); c <= Math.min(buffer.length - 1, i + CONTEXT_LINES); c++) {
+        changedIndexes.add(c);
+      }
+    }
+  });
+  let lastPrinted = -1;
+  for (let i = 0; i < buffer.length; i++) {
+    if (!changedIndexes.has(i)) continue;
+    if (lastPrinted !== -1 && i > lastPrinted + 1) {
+      process.stdout.write(import_chalk.default.dim("...\n"));
+    }
+    const { type, line } = buffer[i];
+    if (type === "add") {
+      process.stdout.write(import_chalk.default.green(`+ ${line}
+`));
+    } else if (type === "remove") {
+      process.stdout.write(import_chalk.default.red(`- ${line}
+`));
+    } else {
+      process.stdout.write(`  ${line}
+`);
+    }
+    lastPrinted = i;
+  }
+  return true;
+}
+function synthStack(stack, provider) {
+  switch (provider) {
+    case "aws": {
+      const p = new import_provider_aws.AWSProvider();
+      return JSON.stringify(p.synthesize(stack), null, 2) + "\n";
+    }
+    case "azure": {
+      const p = new import_provider_azure.AzureProvider();
+      return JSON.stringify(p.synthesize(stack), null, 2) + "\n";
+    }
+    case "gcp": {
+      const p = new import_provider_gcp.GCPProvider();
+      return JSON.stringify(p.synthesize(stack), null, 2) + "\n";
+    }
+    case "terraform": {
+      const p = new import_provider_terraform.TerraformProvider();
+      return p.synthesize(stack);
+    }
+    default:
+      throw new Error(`Provider '${provider}' n\xE3o suportado.`);
+  }
+}
+var Diff = class _Diff extends import_core.Command {
+  static description = "Compara o \xFAltimo synth salvo com o synth atual";
+  static flags = {
+    provider: import_core.Flags.string({ char: "p", description: "Provider alvo (aws, azure, gcp, terraform)" }),
+    stack: import_core.Flags.string({ char: "s", description: "Stack espec\xEDfica" })
+  };
+  static examples = [
+    "$ iacmp diff",
+    "$ iacmp diff --provider aws",
+    "$ iacmp diff --stack minha-stack"
+  ];
+  async run() {
+    const { flags } = await this.parse(_Diff);
+    const cwd = process.cwd();
+    const configPath = path3.join(cwd, "iacmp.json");
+    if (!fs4.existsSync(configPath)) {
+      this.error("Projeto n\xE3o inicializado. Rode: iacmp init");
+    }
+    let config;
+    try {
+      config = readJsonFile(configPath);
+    } catch (err) {
+      this.error(errMessage(err));
+    }
+    const provider = flags.provider ?? config.provider ?? "aws";
+    const outDir = resolveTemplateDir(cwd, provider);
+    if (!outDir) {
+      this.log("Nenhum synth anterior encontrado. Rode: iacmp synth");
+      return;
+    }
+    const ext = templateExt(provider);
+    const existingFiles = fs4.readdirSync(outDir).filter((f) => f.endsWith(ext));
+    if (existingFiles.length === 0) {
+      this.log("Nenhum synth anterior encontrado. Rode: iacmp synth");
+      return;
+    }
+    const stacksDir = path3.join(cwd, "stacks");
+    if (!fs4.existsSync(stacksDir)) {
+      this.error("Diret\xF3rio stacks/ n\xE3o encontrado.");
+    }
+    const stackFiles = findStackFiles(stacksDir).filter((f) => !flags.stack || path3.basename(f).replace(/\.(ts|js)$/, "") === flags.stack);
+    if (stackFiles.length === 0) {
+      this.error("Nenhuma stack encontrada em stacks/");
+    }
+    let anyDiff = false;
+    for (const stackPath of stackFiles) {
+      const file = path3.basename(stackPath);
+      const stackName = file.replace(/\.(ts|js)$/, "");
+      const savedPath = path3.join(outDir, `${stackName}${ext}`);
+      if (!fs4.existsSync(savedPath)) {
+        this.log(`Stack nova (sem synth anterior): ${stackName}`);
+        anyDiff = true;
+        continue;
+      }
+      let stackModule;
+      try {
+        stackModule = require(stackPath);
+      } catch (err) {
+        this.warn(`N\xE3o foi poss\xEDvel carregar ${file}: ${errMessage(err)}`);
+        continue;
+      }
+      const stack = stackModule.default ?? stackModule.stack ?? stackModule;
+      if (!stack || typeof stack !== "object" || !("constructs" in stack)) {
+        this.warn(`${file} n\xE3o exporta uma Stack v\xE1lida.`);
+        continue;
+      }
+      const oldText = fs4.readFileSync(savedPath, "utf-8");
+      let newText;
+      try {
+        newText = synthStack(stack, provider);
+      } catch (err) {
+        this.warn(`Erro ao sintetizar ${stackName}: ${errMessage(err)}`);
+        continue;
+      }
+      this.log(`
+${import_chalk.default.bold(stackName)}${ext}`);
+      this.log(import_chalk.default.dim("\u2500".repeat(50)));
+      const hasDiff = renderDiff(oldText, newText);
+      if (hasDiff) {
+        anyDiff = true;
+      } else {
+        this.log(import_chalk.default.dim("  (sem altera\xE7\xF5es)"));
+      }
+    }
+    if (!anyDiff) {
+      this.log("\nNenhuma altera\xE7\xE3o detectada.");
+    }
+  }
+};