@infoxchange/make-it-so 2.13.0 → 2.14.0-internal-testing-add-sst-3-support.2

package/dist/components/ix/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../node_modules/sst3/platform/src/components/naming.ts", "../../../src/components/ix/dns.ts", "../../../node_modules/sst3/platform/src/components/component.ts", "../../../node_modules/sst3/platform/src/components/error.ts", "../../../node_modules/sst3/platform/src/components/aws/helpers/provider.ts", "../../../node_modules/sst3/platform/src/util/lazy.ts", "../../../src/components/ix/InternalNetwork.ts", "../../../src/deployConfig.ts"],
+  "sourcesContent": ["import crypto from \"crypto\";\n\nexport function logicalName(name: string) {\n  name = name.replace(/[^a-zA-Z0-9]/g, \"\");\n  return name.charAt(0).toUpperCase() + name.slice(1);\n}\n\nexport function physicalName(max: number, name: string, suffix: string = \"\") {\n  // This function does the following:\n  // - Removes all non-alphanumeric characters\n  // - Prefixes the name with the app name and stage\n  // - Truncates the name if it's too long\n  // - Adds a random suffix\n  // - Adds a suffix if provided\n  const main = prefixName(max - 9 - suffix.length, name);\n  const random = hashStringToPrettyString(\n    crypto.randomBytes(8).toString(\"hex\"),\n    8,\n  );\n  return `${main}-${random}${suffix}`;\n}\n\nexport function prefixName(max: number, name: string) {\n  // This function does the following:\n  // - Removes all non-alphanumeric characters\n  // - Prefixes the name with the app name and stage\n  // - Truncates the name if it's too long\n  // ie. foo => app-stage-foo\n\n  name = name.replace(/[^a-zA-Z0-9]/g, \"\");\n\n  const stageLen = $app.stage.length;\n  const nameLen = name.length;\n  const strategy =\n    nameLen + 1 >= max\n      ? (\"name\" as const)\n      : nameLen + stageLen + 2 >= max\n        ? (\"stage+name\" as const)\n        : (\"app+stage+name\" as const);\n\n  if (strategy === \"name\") return `${name.substring(0, max)}`;\n  if (strategy === \"stage+name\")\n    return `${$app.stage.substring(0, max - nameLen - 1)}-${name}`;\n  return `${$app.name.substring(0, max - stageLen - nameLen - 2)}-${\n    $app.stage\n  }-${name}`;\n}\n\nexport function hashNumberToPrettyString(number: number, length: number) {\n  const charLength = PRETTY_CHARS.length;\n  let hash = \"\";\n  while (number > 0) {\n    hash = PRETTY_CHARS[number % charLength] + hash;\n    number = Math.floor(number / charLength);\n  }\n\n  // Padding with 's'\n  hash = hash.slice(0, length);\n  while (hash.length < length) {\n    hash = \"s\" + hash;\n  }\n\n  return hash;\n}\n\nexport function hashStringToPrettyString(str: string, length: number) {\n  const hash = crypto.createHash(\"sha256\");\n  hash.update(str);\n  const num = Number(\"0x\" + hash.digest(\"hex\").substring(0, 16));\n  return hashNumberToPrettyString(num, length);\n}\n\nexport const PRETTY_CHARS = \"abcdefhkmnorstuvwxz\";\n", "// Based on https://github.com/anomalyco/sst/blob/3407c32b2cf97b85ea96a92361c6f4a0a8d55200/platform/src/components/aws/dns.ts\n/**\n * The AWS DNS Adapter is used to create DNS records to manage domains hosted on\n * [Route 53](https://aws.amazon.com/route53/).\n *\n * This adapter is passed in as `domain.dns` when setting a custom domain.\n *\n * @example\n *\n * ```ts\n * {\n *   domain: {\n *     name: \"example.com\",\n *     dns: sst.aws.dns()\n *   }\n * }\n * ```\n *\n * You can also specify a hosted zone ID if you have multiple hosted zones with the same domain.\n *\n * ```ts\n * {\n *   domain: {\n *     name: \"example.com\",\n *     dns: sst.aws.dns({\n *       zone: \"Z2FDTNDATAQYW2\"\n *     })\n *   }\n * }\n * ```\n *\n * @packageDocumentation\n */\n\nimport {\n  AliasRecord,\n  Dns,\n  Record as DnsRecord,\n} from \"sst3/platform/src/components/dns\";\nimport { logicalName } from \"sst3/platform/src/components/naming\";\nimport { ComponentResourceOptions, output } from \"@pulumi/pulumi\";\nimport { Transform, transform } from \"sst3/platform/src/components/component\";\nimport { Input } from \"sst3/platform/src/components/input\";\nimport { useProvider } from \"sst3/platform/src/components/aws/helpers/provider\";\nimport { route53 } from \"@pulumi/aws\";\nimport { VisibleError } from \"sst3/platform/src/components/error\";\nimport * as aws from \"@pulumi/aws\";\n\nexport interface DnsArgs {\n  /**\n   * Set the hosted zone ID if you have multiple hosted zones that have the same\n   * domain in Route 53.\n   *\n   * The 14 letter ID of the [Route 53 hosted zone](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-working-with.html) that contains the `domainName`. You can find the hosted zone ID in the Route 53 part of the AWS Console.\n   *\n   * @example\n   * ```js\n   * {\n   *   zone: \"Z2FDTNDATAQYW2\"\n   * }\n   * ```\n   */\n  zone?: Input<string>;\n  /**\n   * Set to `true` if you want to let the new DNS records replace the existing ones.\n   *\n   * :::tip\n   * Use this to migrate over your domain without any downtime.\n   * :::\n   *\n   * This is useful if your domain is currently used by another app and you want to switch it\n   * to your current app. Without setting this, you'll first have to remove the existing DNS\n   * records and then add the new one. This can cause downtime.\n   *\n   * You can avoid this by setting this to `true` and the existing DNS records will be replaced\n   * without any downtime. Just make sure that when you remove your old app, you don't remove\n   * the DNS records.\n   *\n   * @default `false`\n   * @example\n   * ```js\n   * {\n   *   override: true\n   * }\n   * ```\n   */\n  override?: Input<boolean>;\n  /**\n   * [Transform](/docs/components#transform) how this component creates its underlying\n   * resources.\n   */\n  transform?: {\n    /**\n     * Transform the AWS Route 53 record resource.\n     */\n    record?: Transform<\n      route53.RecordArgs & {\n        aliasIpType?: \"IPv4\" | \"IPv6\";\n        // Can be used to override the raw input to the IX DNS lambda\n        lambdaInput?: Record<string, unknown>;\n      }\n    >;\n  };\n}\n\nexport function dns(args: DnsArgs = {}) {\n  return {\n    provider: \"aws\",\n    createAlias,\n    createCaa,\n    createRecord,\n  } satisfies Dns;\n\n  /**\n   * Creates alias records in the hosted zone.\n   *\n   * @param namePrefix The prefix to use for the resource names.\n   * @param record The alias record to create.\n   * @param opts The component resource options.\n   */\n  function createAlias(\n    namePrefix: string,\n    record: AliasRecord,\n    opts: ComponentResourceOptions,\n  ) {\n    return [\"A\", \"AAAA\"].map((type) =>\n      _createRecord(\n        namePrefix,\n        {\n          type,\n          name: record.name,\n          aliases: [\n            {\n              name: record.aliasName,\n              zoneId: record.aliasZone,\n              evaluateTargetHealth: true,\n            },\n          ],\n        },\n        opts,\n      ),\n    );\n  }\n\n  function createCaa(\n    /* eslint-disable @typescript-eslint/no-unused-vars -- Kept for typing even though it's not used for this\n    implementation of Dns */\n    namePrefix: string,\n    recordName: string,\n    opts: ComponentResourceOptions,\n    /* eslint-enable @typescript-eslint/no-unused-vars */\n  ) {\n    // placeholder\n    return undefined;\n  }\n\n  /**\n   * Creates a DNS record in the hosted zone.\n   *\n   * @param namePrefix The prefix to use for the resource names.\n   * @param record The DNS record to create.\n   * @param opts The component resource options.\n   */\n  function createRecord(\n    namePrefix: string,\n    record: DnsRecord,\n    opts: ComponentResourceOptions,\n  ) {\n    return _createRecord(\n      namePrefix,\n      {\n        type: record.type,\n        name: record.name,\n        ttl: 60,\n        records: [record.value],\n      },\n      opts,\n    );\n  }\n\n  function _createRecord(\n    namePrefix: string,\n    partial: Omit<route53.RecordArgs, \"zoneId\">,\n    opts: ComponentResourceOptions,\n  ) {\n    return output(partial).apply((partial) => {\n      const nameSuffix = logicalName(partial.name);\n      const zoneId = \"\"; // The IX dns lambda will determine the zone ID based on the domain name\n      const dnsRecord = createRecord();\n      return dnsRecord;\n\n      function createRecord() {\n        const [name, mergedArgs, mergedOpts] = transform(\n          args.transform?.record,\n          `${namePrefix}${partial.type}Record${nameSuffix}`,\n          {\n            zoneId,\n            allowOverwrite: args.override,\n            ...partial,\n          },\n          opts,\n        );\n        const lambdaInput = output(mergedArgs).apply((mergedArgs) => {\n          const { aliases } = mergedArgs;\n          let { aliasIpType } = mergedArgs;\n          if (aliases && aliases.length > 1) {\n            throw new VisibleError(\n              \"Aliases with multiple targets are not supported\",\n            );\n          }\n          const [alias] = aliases || [];\n          if (alias) {\n            if (mergedArgs.type === \"A\") {\n              aliasIpType = \"IPv4\";\n            } else if (mergedArgs.type === \"AAAA\") {\n              aliasIpType = \"IPv6\";\n            } else {\n              throw new VisibleError(\n                \"Alias records can only be created for A or AAAA record types\",\n              );\n            }\n          }\n          return {\n            RecordType: mergedArgs.type,\n            // Even though a trailing dot is valid a bug in the IX dns lambda means that an error occurs\n            // when trying to find the hosted zone if there is a trailing dot.\n            RecordFQDN: mergedArgs.name.replace(/\\.$/, \"\"),\n            // If giving the IX dns lambda multiple values we need to wrap in 'Value' objects\n            // unlike for single values where the lambda does it for us\n            // https://github.com/InfoxchangeTS/aws-gov/blob/213609c2e91b021375b93290efdaf38936ee98e1/components/xaccount-route53/dns-record-updater-lambda/src/index.py#L133\n            RecordValue: mergedArgs.records?.map((value) => ({ Value: value })),\n            ...(mergedArgs.zoneId ? { HostedZoneId: mergedArgs.zoneId } : {}),\n            ...(mergedArgs.ttl ? { RecordTTL: mergedArgs.ttl } : {}),\n            ...(alias\n              ? {\n                  RecordType: \"ALIAS\",\n                  // https://github.com/InfoxchangeTS/aws-gov/blob/213609c2e91b021375b93290efdaf38936ee98e1/components/xaccount-route53/dns-record-updater-lambda/src/index.py#L145\n                  RecordValue: alias.name,\n                  // https://github.com/InfoxchangeTS/aws-gov/blob/213609c2e91b021375b93290efdaf38936ee98e1/components/xaccount-route53/dns-record-updater-lambda/src/index.py#L144\n                  AliasZoneId: alias.zoneId,\n                  // alias.evaluateTargetHealth can't be set by the lambda\n                  IpAddressType: aliasIpType?.toLowerCase(),\n                }\n              : {}),\n            ...mergedArgs.lambdaInput,\n          };\n        });\n        // output([mergedArgs, lambdaInput]).apply(([mergedArgs, lambdaInput]) => console.log('________ BEFORE', mergedArgs, '___________ AFTER', lambdaInput));\n        return new aws.lambda.Invocation(\n          name,\n          {\n            input: output(lambdaInput).apply((lambdaInput) =>\n              JSON.stringify({\n                RequestType: \"Create\",\n                ResourceProperties: lambdaInput,\n                // We need some value so that the lambda doesn't throw an error but we don't want the lambda to actually\n                // send a response to this url (the response is for CloudFormation which we're not using). Setting an\n                // invalid domain will cause it to log an error but not throw so the lambda is considered successful.\n                ResponseURL: \"invalid://make-it-so-dns\",\n                StackId: \"\",\n                RequestId: \"\",\n                LogicalResourceId: \"\",\n              }),\n            ),\n            functionName: aws.ssm\n              .getParameter({\n                name: \"/shared-services/route53/lambdaArn\",\n              })\n              .then((param) => param.value),\n          },\n          {\n            ...mergedOpts,\n            // Function can only be invoked from within the same region it is deployed\n            provider: useProvider(\"ap-southeast-2\"),\n          },\n        );\n      }\n    });\n  }\n}\n", "import {\n  ComponentResource,\n  ComponentResourceOptions,\n  Inputs,\n  runtime,\n  output,\n  asset as pulumiAsset,\n  Input,\n  all,\n  Output,\n} from \"@pulumi/pulumi\";\nimport { prefixName, physicalName } from \"./naming.js\";\nimport { VisibleError } from \"./error.js\";\nimport path from \"path\";\nimport { statSync } from \"fs\";\n\n// Previously, `this.api.id` was used as the ID. `this.api.id` was of type Output<string>\n// the value evaluates to the mistake id.\n// In the future version, we will release a breaking change to fix this.\nexport const outputId =\n  \"Calling [toString] on an [Output<T>] is not supported.\\n\\nTo get the value of an Output<T> as an Output<string> consider either:\\n1: o.apply(v => `prefix${v}suffix`)\\n2: pulumi.interpolate `prefix${v}suffix`\\n\\nSee https://www.pulumi.com/docs/concepts/inputs-outputs for more details.\\nThis function may throw in a future version of @pulumi/pulumi.\";\n\n/**\n * Helper type to inline nested types\n */\nexport type Prettify<T> = {\n  [K in keyof T]: T[K];\n} & {};\n\nexport type Transform<T> =\n  | Partial<T>\n  | ((args: T, opts: $util.CustomResourceOptions, name: string) => undefined);\n\nexport function transform<T extends object>(\n  transform: Transform<T> | undefined,\n  name: string,\n  args: T,\n  opts: $util.CustomResourceOptions,\n) {\n  // Case: transform is a function\n  if (typeof transform === \"function\") {\n    transform(args, opts, name);\n    return [name, args, opts] as const;\n  }\n\n  // Case: no transform\n  // Case: transform is an argument\n  return [name, { ...args, ...transform }, opts] as const;\n}\n\nexport class Component extends ComponentResource {\n  private componentType: string;\n  private componentName: string;\n\n  constructor(\n    type: string,\n    name: string,\n    args?: Inputs,\n    opts?: ComponentResourceOptions,\n  ) {\n    const transforms = ComponentTransforms.get(type) ?? [];\n    for (const transform of transforms) {\n      transform({ name, props: args, opts });\n    }\n    super(type, name, args, {\n      transformations: [\n        // Ensure logical and physical names are prefixed\n        (args) => {\n          // Ensure component names do not contain spaces\n          if (name.includes(\" \"))\n            throw new Error(\n              `Invalid component name \"${name}\" (${args.type}). Component names cannot contain spaces.`,\n            );\n\n          // Ensure names are prefixed with parent's name\n          if (\n            args.type !== type &&\n            // @ts-expect-error\n            !args.name.startsWith(args.opts.parent!.__name)\n          ) {\n            throw new Error(\n              `In \"${name}\" component, the logical name of \"${args.name}\" (${\n                args.type\n              }) is not prefixed with parent's name ${\n                // @ts-expect-error\n                args.opts.parent!.__name\n              }`,\n            );\n          }\n\n          // Ensure physical names are prefixed with app/stage\n          // note: We are setting the default names here instead of inline when creating\n          //       the resource is b/c the physical name is inferred from the logical name.\n          //       And it's convenient to access the logical name here.\n          if (args.type.startsWith(\"sst:\")) return;\n          if (\n            [\n              // resources manually named\n              \"aws:cloudwatch/logGroup:LogGroup\",\n              \"aws:ecs/service:Service\",\n              \"aws:ecs/taskDefinition:TaskDefinition\",\n              \"aws:lb/targetGroup:TargetGroup\",\n              \"aws:servicediscovery/privateDnsNamespace:PrivateDnsNamespace\",\n              \"aws:servicediscovery/service:Service\",\n              // resources not prefixed\n              \"pulumi-nodejs:dynamic:Resource\",\n              \"random:index/randomId:RandomId\",\n              \"random:index/randomPassword:RandomPassword\",\n              \"command:local:Command\",\n              \"tls:index/privateKey:PrivateKey\",\n              \"aws:acm/certificate:Certificate\",\n              \"aws:acm/certificateValidation:CertificateValidation\",\n              \"aws:apigateway/basePathMapping:BasePathMapping\",\n              \"aws:apigateway/deployment:Deployment\",\n              \"aws:apigateway/domainName:DomainName\",\n              \"aws:apigateway/integration:Integration\",\n              \"aws:apigateway/integrationResponse:IntegrationResponse\",\n              \"aws:apigateway/method:Method\",\n              \"aws:apigateway/methodResponse:MethodResponse\",\n              \"aws:apigateway/resource:Resource\",\n              \"aws:apigateway/response:Response\",\n              \"aws:apigateway/stage:Stage\",\n              \"aws:apigateway/usagePlanKey:UsagePlanKey\",\n              \"aws:apigatewayv2/apiMapping:ApiMapping\",\n              \"aws:apigatewayv2/domainName:DomainName\",\n              \"aws:apigatewayv2/integration:Integration\",\n              \"aws:apigatewayv2/route:Route\",\n              \"aws:apigatewayv2/stage:Stage\",\n              \"aws:appautoscaling/target:Target\",\n              \"aws:appsync/dataSource:DataSource\",\n              \"aws:appsync/domainName:DomainName\",\n              \"aws:appsync/domainNameApiAssociation:DomainNameApiAssociation\",\n              \"aws:appsync/function:Function\",\n              \"aws:appsync/resolver:Resolver\",\n              \"aws:ec2/routeTableAssociation:RouteTableAssociation\",\n              \"aws:ec2/eipAssociation:EipAssociation\",\n              \"aws:ecs/clusterCapacityProviders:ClusterCapacityProviders\",\n              \"aws:efs/fileSystem:FileSystem\",\n              \"aws:efs/mountTarget:MountTarget\",\n              \"aws:efs/accessPoint:AccessPoint\",\n              \"aws:iam/accessKey:AccessKey\",\n              \"aws:iam/instanceProfile:InstanceProfile\",\n              \"aws:iam/policy:Policy\",\n              \"aws:iam/userPolicy:UserPolicy\",\n              \"aws:cloudfront/cachePolicy:CachePolicy\",\n              \"aws:cloudfront/distribution:Distribution\",\n              \"aws:cognito/identityPoolRoleAttachment:IdentityPoolRoleAttachment\",\n              \"aws:cognito/identityProvider:IdentityProvider\",\n              \"aws:cognito/userPoolClient:UserPoolClient\",\n              \"aws:lambda/eventSourceMapping:EventSourceMapping\",\n              \"aws:lambda/functionEventInvokeConfig:FunctionEventInvokeConfig\",\n              \"aws:lambda/functionUrl:FunctionUrl\",\n              \"aws:lambda/invocation:Invocation\",\n              \"aws:lambda/permission:Permission\",\n              \"aws:lambda/provisionedConcurrencyConfig:ProvisionedConcurrencyConfig\",\n              \"aws:lb/listener:Listener\",\n              \"aws:lb/listenerRule:ListenerRule\",\n              \"aws:opensearch/domainPolicy:DomainPolicy\",\n              \"aws:rds/proxyDefaultTargetGroup:ProxyDefaultTargetGroup\",\n              \"aws:rds/proxyTarget:ProxyTarget\",\n              \"aws:route53/record:Record\",\n              \"aws:s3/bucketCorsConfigurationV2:BucketCorsConfigurationV2\",\n              \"aws:s3/bucketNotification:BucketNotification\",\n              \"aws:s3/bucketObject:BucketObject\",\n              \"aws:s3/bucketObjectv2:BucketObjectv2\",\n              \"aws:s3/bucketPolicy:BucketPolicy\",\n              \"aws:s3/bucketPublicAccessBlock:BucketPublicAccessBlock\",\n              \"aws:s3/bucketVersioningV2:BucketVersioningV2\",\n              \"aws:s3/bucketLifecycleConfigurationV2:BucketLifecycleConfigurationV2\",\n              \"aws:s3/bucketWebsiteConfigurationV2:BucketWebsiteConfigurationV2\",\n              \"aws:secretsmanager/secretVersion:SecretVersion\",\n              \"aws:ses/domainIdentityVerification:DomainIdentityVerification\",\n              \"aws:sesv2/configurationSetEventDestination:ConfigurationSetEventDestination\",\n              \"aws:sesv2/emailIdentity:EmailIdentity\",\n              \"aws:sns/topicPolicy:TopicPolicy\",\n              \"aws:sns/topicSubscription:TopicSubscription\",\n              \"aws:sqs/queuePolicy:QueuePolicy\",\n              \"aws:ssm/parameter:Parameter\",\n              \"cloudflare:index/dnsRecord:DnsRecord\",\n              \"cloudflare:index/workersCronTrigger:WorkersCronTrigger\",\n              \"cloudflare:index/workersCustomDomain:WorkersCustomDomain\",\n              \"docker-build:index:Image\",\n              \"vercel:index/dnsRecord:DnsRecord\",\n            ].includes(args.type)\n          )\n            return;\n\n          const namingRules: Record<\n            string,\n            [\n              string,\n              number,\n              {\n                lower?: boolean;\n                replace?: (name: string) => string;\n                suffix?: () => Output<string>;\n              }?,\n            ]\n          > = {\n            \"aws:apigateway/apiKey:ApiKey\": [\"name\", 1024],\n            \"aws:apigateway/authorizer:Authorizer\": [\"name\", 128],\n            \"aws:apigateway/restApi:RestApi\": [\"name\", 128],\n            \"aws:apigateway/usagePlan:UsagePlan\": [\"name\", 65536], // no length limit\n            \"aws:apigatewayv2/api:Api\": [\"name\", 128],\n            \"aws:apigatewayv2/authorizer:Authorizer\": [\"name\", 128],\n            \"aws:apigatewayv2/vpcLink:VpcLink\": [\"name\", 128],\n            \"aws:appautoscaling/policy:Policy\": [\"name\", 255],\n            \"aws:appsync/graphQLApi:GraphQLApi\": [\"name\", 65536],\n            \"aws:cloudwatch/eventBus:EventBus\": [\"name\", 256],\n            \"aws:cloudwatch/eventTarget:EventTarget\": [\"targetId\", 64],\n            \"aws:cloudwatch/eventRule:EventRule\": [\"name\", 64],\n            \"aws:cloudfront/function:Function\": [\"name\", 64],\n            \"aws:cloudfront/keyValueStore:KeyValueStore\": [\"name\", 64],\n            \"aws:cognito/identityPool:IdentityPool\": [\"identityPoolName\", 128],\n            \"aws:cognito/userPool:UserPool\": [\"name\", 128],\n            \"aws:dynamodb/table:Table\": [\"name\", 255],\n            \"aws:ec2/keyPair:KeyPair\": [\"keyName\", 255],\n            \"aws:ec2/eip:Eip\": [\"tags\", 255],\n            \"aws:ec2/instance:Instance\": [\"tags\", 255],\n            \"aws:ec2/internetGateway:InternetGateway\": [\"tags\", 255],\n            \"aws:ec2/natGateway:NatGateway\": [\"tags\", 255],\n            \"aws:ec2/routeTable:RouteTable\": [\"tags\", 255],\n            \"aws:ec2/securityGroup:SecurityGroup\": [\"tags\", 255],\n            \"aws:ec2/defaultSecurityGroup:DefaultSecurityGroup\": [\"tags\", 255],\n            \"aws:ec2/subnet:Subnet\": [\"tags\", 255],\n            \"aws:ec2/vpc:Vpc\": [\"tags\", 255],\n            \"aws:ecs/cluster:Cluster\": [\"name\", 255],\n            \"aws:elasticache/parameterGroup:ParameterGroup\": [\n              \"name\",\n              255,\n              { lower: true },\n            ],\n            \"aws:elasticache/replicationGroup:ReplicationGroup\": [\n              \"replicationGroupId\",\n              40,\n              { lower: true, replace: (name) => name.replaceAll(/-+/g, \"-\") },\n            ],\n            \"aws:elasticache/subnetGroup:SubnetGroup\": [\n              \"name\",\n              255,\n              { lower: true },\n            ],\n            \"aws:iam/role:Role\": [\"name\", 64],\n            \"aws:iam/user:User\": [\"name\", 64],\n            \"aws:iot/authorizer:Authorizer\": [\"name\", 128],\n            \"aws:iot/topicRule:TopicRule\": [\n              \"name\",\n              128,\n              { replace: (name) => name.replaceAll(\"-\", \"_\") },\n            ],\n            \"aws:kinesis/stream:Stream\": [\"name\", 255],\n            // AWS Load Balancer name allows 32 chars, but an 8 char suffix\n            // ie. \"-1234567\" is automatically added\n            \"aws:lb/loadBalancer:LoadBalancer\": [\"name\", 24],\n            \"aws:lambda/function:Function\": [\"name\", 64],\n            \"aws:opensearch/domain:Domain\": [\"domainName\", 28, { lower: true }],\n            \"aws:rds/cluster:Cluster\": [\n              \"clusterIdentifier\",\n              63,\n              { lower: true },\n            ],\n            \"aws:rds/clusterInstance:ClusterInstance\": [\n              \"identifier\",\n              63,\n              { lower: true },\n            ],\n            \"aws:rds/instance:Instance\": [\"identifier\", 63, { lower: true }],\n            \"aws:rds/proxy:Proxy\": [\"name\", 60, { lower: true }],\n            \"aws:rds/clusterParameterGroup:ClusterParameterGroup\": [\n              \"name\",\n              255,\n              { lower: true },\n            ],\n            \"aws:rds/parameterGroup:ParameterGroup\": [\n              \"name\",\n              255,\n              { lower: true },\n            ],\n            \"aws:rds/subnetGroup:SubnetGroup\": [\"name\", 255, { lower: true }],\n            \"aws:s3/bucketV2:BucketV2\": [\"bucket\", 63, { lower: true }],\n            \"aws:secretsmanager/secret:Secret\": [\"name\", 512],\n            \"aws:sesv2/configurationSet:ConfigurationSet\": [\n              \"configurationSetName\",\n              64,\n              { lower: true },\n            ],\n            \"aws:sfn/stateMachine:StateMachine\": [\"name\", 80],\n            \"aws:sns/topic:Topic\": [\n              \"name\",\n              256,\n              {\n                suffix: () =>\n                  output(args.props.fifoTopic).apply((fifo) =>\n                    fifo ? \".fifo\" : \"\",\n                  ),\n              },\n            ],\n            \"aws:sqs/queue:Queue\": [\n              \"name\",\n              80,\n              {\n                suffix: () =>\n                  output(args.props.fifoQueue).apply((fifo) =>\n                    fifo ? \".fifo\" : \"\",\n                  ),\n              },\n            ],\n            \"cloudflare:index/d1Database:D1Database\": [\n              \"name\",\n              64,\n              { lower: true },\n            ],\n            \"cloudflare:index/r2Bucket:R2Bucket\": [\"name\", 64, { lower: true }],\n            \"cloudflare:index/workersScript:WorkersScript\": [\n              \"scriptName\",\n              64,\n              { lower: true },\n            ],\n            \"cloudflare:index/queue:Queue\": [\"queueName\", 64, { lower: true }],\n            \"cloudflare:index/workersKvNamespace:WorkersKvNamespace\": [\n              \"title\",\n              64,\n              { lower: true },\n            ],\n          };\n\n          const rule = namingRules[args.type];\n          if (!rule)\n            throw new VisibleError(\n              `In \"${name}\" component, the physical name of \"${args.name}\" (${args.type}) is not prefixed`,\n            );\n\n          // name is already set\n          const nameField = rule[0];\n          const length = rule[1];\n          const options = rule[2];\n          if (args.props[nameField] && args.props[nameField] !== \"\") return;\n\n          // Handle prefix field is tags\n          if (nameField === \"tags\") {\n            return {\n              props: {\n                ...args.props,\n                tags: {\n                  // @ts-expect-error\n                  ...args.tags,\n                  Name: prefixName(length, args.name),\n                },\n              },\n              opts: args.opts,\n            };\n          }\n\n          // Handle prefix field is name\n          const suffix = options?.suffix ? options.suffix() : output(\"\");\n          return {\n            props: {\n              ...args.props,\n              [nameField]: suffix.apply((suffix) => {\n                let v = options?.lower\n                  ? physicalName(length, args.name, suffix).toLowerCase()\n                  : physicalName(length, args.name, suffix);\n                if (options?.replace) v = options.replace(v);\n                return v;\n              }),\n            },\n            opts: {\n              ...args.opts,\n              ignoreChanges: [...(args.opts.ignoreChanges ?? []), nameField],\n            },\n          };\n        },\n        // Set child resources `retainOnDelete` if set on component\n        (args) => ({\n          props: args.props,\n          opts: {\n            ...args.opts,\n            retainOnDelete: args.opts.retainOnDelete ?? opts?.retainOnDelete,\n          },\n        }),\n        ...(opts?.transformations ?? []),\n      ],\n      ...opts,\n    });\n\n    this.componentType = type;\n    this.componentName = name;\n  }\n\n  /** @internal */\n  protected registerVersion(input: {\n    new: number;\n    old?: number;\n    message?: string;\n    forceUpgrade?: `v${number}`;\n  }) {\n    // Check component version\n    const oldVersion = input.old;\n    const newVersion = input.new ?? 1;\n    if (oldVersion) {\n      const className = this.componentType.replaceAll(\":\", \".\");\n      // Invalid forceUpgrade value\n      if (input.forceUpgrade && input.forceUpgrade !== `v${newVersion}`) {\n        throw new VisibleError(\n          [\n            `The value of \"forceUpgrade\" does not match the version of \"${className}\" component.`,\n            `Set \"forceUpgrade\" to \"v${newVersion}\" to upgrade to the new version.`,\n          ].join(\"\\n\"),\n        );\n      }\n      // Version upgraded without forceUpgrade\n      if (oldVersion < newVersion && !input.forceUpgrade) {\n        throw new VisibleError(input.message ?? \"\");\n      }\n      // Version downgraded\n      if (oldVersion > newVersion) {\n        throw new VisibleError(\n          [\n            `It seems you are trying to use an older version of \"${className}\".`,\n            `You need to recreate this component to rollback - https://sst.dev/docs/components/#versioning`,\n          ].join(\"\\n\"),\n        );\n      }\n    }\n\n    // Set version\n    if (newVersion > 1) {\n      new Version(this.componentName, newVersion, { parent: this });\n    }\n  }\n}\n\nconst ComponentTransforms = new Map<string, any[]>();\nexport function $transform<T, Args, Options>(\n  resource: { new (name: string, args: Args, opts?: Options): T },\n  cb: (args: Args, opts: Options, name: string) => void,\n) {\n  // @ts-expect-error\n  const type = resource.__pulumiType;\n  if (type.startsWith(\"sst:\")) {\n    let transforms = ComponentTransforms.get(type);\n    if (!transforms) {\n      transforms = [];\n      ComponentTransforms.set(type, transforms);\n    }\n    transforms.push((input: any) => {\n      cb(input.props, input.opts, input.name);\n      return input;\n    });\n    return;\n  }\n  runtime.registerStackTransformation((input) => {\n    if (input.type !== type) return;\n    cb(input.props as any, input.opts as any, input.name);\n    return input;\n  });\n}\n\nexport function $asset(assetPath: string) {\n  const fullPath = path.isAbsolute(assetPath)\n    ? assetPath\n    : path.join($cli.paths.root, assetPath);\n\n  try {\n    return statSync(fullPath).isDirectory()\n      ? new pulumiAsset.FileArchive(fullPath)\n      : new pulumiAsset.FileAsset(fullPath);\n  } catch (e) {\n    throw new VisibleError(`Asset not found: ${fullPath}`);\n  }\n}\n\nexport function $lazy<T>(fn: () => T) {\n  return output(undefined)\n    .apply(async () => output(fn()))\n    .apply((x) => x);\n}\n\nexport function $print(...msg: Input<any>[]) {\n  return all(msg).apply((msg) => console.log(...msg));\n}\n\nexport class Version extends ComponentResource {\n  constructor(target: string, version: number, opts: ComponentResourceOptions) {\n    super(\"sst:sst:Version\", target + \"Version\", {}, opts);\n    this.registerOutputs({ target, version });\n  }\n}\n\nexport type ComponentVersion = { major: number; minor: number };\nexport function parseComponentVersion(version: string): ComponentVersion {\n  const [major, minor] = version.split(\".\");\n  return { major: parseInt(major), minor: parseInt(minor) };\n}\n", "export class VisibleError extends Error {\n  constructor(...message: string[]) {\n    super(message.join(\"\\n\"));\n  }\n}\n", "import { runtime } from \"@pulumi/pulumi\";\nimport { Provider, Region } from \"@pulumi/aws\";\nimport { lazy } from \"../../../util/lazy\";\n\nconst useProviderCache = lazy(() => new Map<string, Provider>());\n\nexport const useProvider = (region: Region) => {\n  const cache = useProviderCache();\n  const existing = cache.get(region);\n  if (existing) return existing;\n  const config = runtime.allConfig();\n  for (const key in config) {\n    const value = config[key];\n    delete config[key];\n    const [prefix, real] = key.split(\":\");\n    if (prefix !== \"aws\") continue;\n\n    // Array and Object values are JSON encoded, ie.\n    // {\n    //   allowedAccountIds: '[\"112245769880\"]',\n    //   defaultTags: '{\"tags\":{\"sst:app\":\"playground\",\"sst:stage\":\"frank\"}}',\n    //   region: 'us-east-1'\n    // }\n    try {\n      config[real] = JSON.parse(value);\n    } catch (e) {\n      config[real] = value;\n    }\n  }\n  const provider = new Provider(`AwsProvider.sst.${region}`, {\n    ...config,\n    region,\n  });\n  cache.set(region, provider);\n  return provider;\n};\n", "export function lazy<T>(callback: () => T) {\n  let loaded = false;\n  let result: T;\n\n  return () => {\n    if (!loaded) {\n      loaded = true;\n      result = callback();\n    }\n    return result;\n  };\n}\n", "import * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\nimport ixDeployConfig from \"@/deployConfig\";\nimport { Transform, transform } from \"sst3/platform/src/components/component\";\n\nexport interface InternalNetworkArgs {\n  name?: string;\n  transform?: {\n    securityGroup?: Transform<aws.ec2.SecurityGroupArgs>;\n  };\n}\n\nexport class InternalNetwork extends pulumi.ComponentResource {\n  public readonly vpc: pulumi.Output<aws.ec2.GetVpcResult>;\n  public readonly subnetIds: pulumi.Output<string[]>;\n  public readonly securityGroup: pulumi.Output<aws.ec2.SecurityGroup>;\n\n  constructor(\n    name: string,\n    args: InternalNetworkArgs = {},\n    opts?: pulumi.ComponentResourceOptions,\n  ) {\n    super(\"ix:aws:InternalNetwork\", name, args, opts);\n\n    // Get VPC ID from SSM parameter\n    const vpcIdParam = aws.ssm.getParameterOutput(\n      {\n        name: \"/vpc/id\",\n      },\n      { parent: this },\n    );\n\n    const vpcId = vpcIdParam.value;\n\n    // Get VPC details\n    this.vpc = vpcId.apply(\n      async (vpcId) => await aws.ec2.getVpc({ id: vpcId }),\n    );\n\n    // Get subnet IDs\n    this.subnetIds = InternalNetwork.getVpcSubnetIds();\n\n    this.securityGroup = this.vpc.apply((vpc) =>\n      this.createSecurityGroup({\n        parentName: name,\n        vpc: vpc,\n        args: args.transform?.securityGroup,\n        opts: { parent: this },\n      }),\n    );\n\n    this.registerOutputs({\n      vpc: this.vpc,\n      subnetIds: this.subnetIds,\n    });\n  }\n\n  public get securityGroupIds(): pulumi.Output<pulumi.Output<string>[]> {\n    return pulumi.output(this.securityGroup).apply((sg) => [sg.id]);\n  }\n\n  static getVpcSubnetIds(): pulumi.Output<string[]> {\n    const { workloadGroup, appName } = ixDeployConfig;\n    let suffix = \"\";\n    if (workloadGroup === \"ds\") {\n      const possibleSuffixes = [\"\", \"-2\"];\n      // Randomly select a suffix to spread workload's IP usage across both sets of subnets. Use the app name as a seed\n      // to ensure consistent selection on redeploys.\n      const hash = appName\n        .split(\"\")\n        .reduce((acc, char) => acc + char.charCodeAt(0), 0);\n      suffix = possibleSuffixes[hash % possibleSuffixes.length];\n    }\n\n    const subnetOutputs = [1, 2, 3].map(\n      (subnetNum) =>\n        aws.ssm.getParameterOutput({\n          name: `/vpc/subnet/private-${workloadGroup}${suffix}/${subnetNum}/id`,\n        }).value,\n    );\n\n    return pulumi.all(subnetOutputs);\n  }\n\n  // Based on https://github.com/anomalyco/sst/blob/3407c32b2cf97b85ea96a92361c6f4a0a8d55200/platform/src/components/aws/vpc.ts#L840\n  createSecurityGroup({\n    parentName,\n    vpc,\n    args,\n    opts,\n  }: {\n    parentName: string;\n    vpc: aws.ec2.GetVpcResult;\n    args?: Transform<aws.ec2.SecurityGroupArgs>;\n    opts: pulumi.ComponentResourceOptions;\n  }) {\n    return new aws.ec2.SecurityGroup(\n      ...transform(\n        args,\n        `${parentName}SecurityGroup`,\n        {\n          description: \"Managed by make-it-so\",\n          vpcId: vpc.id,\n          egress: [\n            {\n              fromPort: 0,\n              toPort: 0,\n              protocol: \"-1\",\n              cidrBlocks: [\"0.0.0.0/0\"],\n            },\n          ],\n          ingress: [\n            {\n              fromPort: 0,\n              toPort: 0,\n              protocol: \"-1\",\n              // Restricts inbound traffic to only within the VPC\n              cidrBlocks: [vpc.cidrBlock],\n            },\n          ],\n        },\n        opts,\n      ),\n    );\n  }\n}\n", "import { z } from \"zod\";\n\nconst getEnvVars = () =>\n  ({\n    isIxDeploy: process.env.IX_DEPLOYMENT?.toLowerCase() === \"true\", // This needs to start as a bool for the discriminated union\n    appName: process.env.IX_APP_NAME ?? \"\",\n    environment: process.env.IX_ENVIRONMENT ?? \"\",\n    workloadGroup: process.env.IX_WORKLOAD_GROUP ?? \"\",\n    primaryAwsRegion: process.env.IX_PRIMARY_AWS_REGION ?? \"\",\n    siteDomains: process.env.IX_SITE_DOMAINS ?? \"\",\n    siteDomainAliases: process.env.IX_SITE_DOMAIN_ALIASES ?? \"\",\n    isInternalApp: process.env.IX_INTERNAL_APP ?? \"\",\n    deploymentType: process.env.IX_DEPLOYMENT_TYPE ?? \"\",\n    sourceCommitRef: process.env.IX_SOURCE_COMMIT_REF ?? \"\",\n    sourceCommitHash: process.env.IX_SOURCE_COMMIT_HASH ?? \"\",\n    deployTriggeredBy: process.env.IX_DEPLOY_TRIGGERED_BY ?? \"\",\n    smtpHost: process.env.SMTP_HOST ?? \"\",\n    smtpPort: process.env.SMTP_PORT ?? \"\",\n    clamAVUrl: process.env.CLAMAV_URL ?? \"\",\n    vpcHttpProxy: process.env.VPC_HTTP_PROXY ?? \"\",\n  }) satisfies Record<string, string | boolean>;\n\nconst ixDeployConfigSchema = z\n  .object({\n    isIxDeploy: z.literal(true),\n    appName: z.string().min(1),\n    environment: z.enum([\"dev\", \"test\", \"uat\", \"prod\"]),\n    workloadGroup: z.enum([\"ds\", \"srs\"]),\n    primaryAwsRegion: z.literal(\"ap-southeast-2\"),\n    siteDomains: z.string().transform((val) =>\n      val\n        .split(\",\")\n        .map((domain) => domain.trim())\n        .filter(Boolean),\n    ),\n    siteDomainAliases: z.string().transform((val) =>\n      val\n        .split(\",\")\n        .map((domain) => domain.trim())\n        .filter(Boolean),\n    ),\n    isInternalApp: z.coerce.boolean(),\n    deploymentType: z.enum([\"docker\", \"serverless\"]),\n    sourceCommitRef: z.string().min(1),\n    sourceCommitHash: z.string().min(1),\n    deployTriggeredBy: z.string().min(1),\n    smtpHost: z.string().min(1),\n    smtpPort: z.coerce.number().int(),\n    clamAVUrl: z.string().url(),\n    vpcHttpProxy: z.string().url(),\n  } satisfies Record<keyof ReturnType<typeof getEnvVars>, unknown>)\n  .strip();\n\nconst nonIxDeployConfigSchema = z\n  .object({\n    isIxDeploy: z.literal(false),\n    appName: z.string(),\n    environment: z.string(),\n    workloadGroup: z.string(),\n    primaryAwsRegion: z.string(),\n    siteDomains: z\n      .string()\n      .transform((val) => val.split(\",\").map((domain) => domain.trim())),\n    siteDomainAliases: z\n      .string()\n      .transform((val) => val.split(\",\").map((domain) => domain.trim())),\n    isInternalApp: z\n      .string()\n      .transform((val) => (val ? val.toLowerCase() === \"true\" : undefined)),\n    deploymentType: z.string(),\n    sourceCommitRef: z.string(),\n    sourceCommitHash: z.string(),\n    deployTriggeredBy: z.string(),\n    smtpHost: z.string(),\n    smtpPort: z\n      .string()\n      .transform((val) =>\n        isNaN(parseInt(val, 10)) ? undefined : parseInt(val, 10),\n      ),\n    clamAVUrl: z.string(),\n    vpcHttpProxy: z.string(),\n  } satisfies Record<keyof ReturnType<typeof getEnvVars>, unknown>)\n  .strip();\n\nconst schema = z.discriminatedUnion(\"isIxDeploy\", [\n  ixDeployConfigSchema,\n  nonIxDeployConfigSchema,\n]);\n\nexport default schema.parse(getEnvVars());\n\n// process.env values can change at runtime so we provide a way to re-parse the config as needed\nexport const getDeployConfig = () => schema.parse(getEnvVars());\n"],
+  "mappings": ";AAEO,SAAS,YAAY,MAAc;AACxC,SAAO,KAAK,QAAQ,iBAAiB,EAAE;AACvC,SAAO,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC;AACpD;;;ACmCA,SAAmC,UAAAA,eAAc;;;ACxCjD;AAAA,EACE;AAAA,EAGA;AAAA,EACA;AAAA,EACA,SAAS;AAAA,EAET;AAAA,OAEK;;;ACVA,IAAM,eAAN,cAA2B,MAAM;AAAA,EACtC,eAAe,SAAmB;AAChC,UAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC1B;AACF;;;AD6BO,SAAS,UACdC,YACA,MACA,MACA,MACA;AAEA,MAAI,OAAOA,eAAc,YAAY;AACnC,IAAAA,WAAU,MAAM,MAAM,IAAI;AAC1B,WAAO,CAAC,MAAM,MAAM,IAAI;AAAA,EAC1B;AAIA,SAAO,CAAC,MAAM,EAAE,GAAG,MAAM,GAAGA,WAAU,GAAG,IAAI;AAC/C;;;AEhDA,SAAS,WAAAC,gBAAe;AACxB,SAAS,gBAAwB;;;ACD1B,SAAS,KAAQ,UAAmB;AACzC,MAAI,SAAS;AACb,MAAI;AAEJ,SAAO,MAAM;AACX,QAAI,CAAC,QAAQ;AACX,eAAS;AACT,eAAS,SAAS;AAAA,IACpB;AACA,WAAO;AAAA,EACT;AACF;;;ADPA,IAAM,mBAAmB,KAAK,MAAM,oBAAI,IAAsB,CAAC;AAExD,IAAM,cAAc,CAAC,WAAmB;AAC7C,QAAM,QAAQ,iBAAiB;AAC/B,QAAM,WAAW,MAAM,IAAI,MAAM;AACjC,MAAI,SAAU,QAAO;AACrB,QAAM,SAASC,SAAQ,UAAU;AACjC,aAAW,OAAO,QAAQ;AACxB,UAAM,QAAQ,OAAO,GAAG;AACxB,WAAO,OAAO,GAAG;AACjB,UAAM,CAAC,QAAQ,IAAI,IAAI,IAAI,MAAM,GAAG;AACpC,QAAI,WAAW,MAAO;AAQtB,QAAI;AACF,aAAO,IAAI,IAAI,KAAK,MAAM,KAAK;AAAA,IACjC,SAAS,GAAG;AACV,aAAO,IAAI,IAAI;AAAA,IACjB;AAAA,EACF;AACA,QAAM,WAAW,IAAI,SAAS,mBAAmB,MAAM,IAAI;AAAA,IACzD,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AACD,QAAM,IAAI,QAAQ,QAAQ;AAC1B,SAAO;AACT;;;AHWA,YAAY,SAAS;AA2Dd,SAAS,IAAI,OAAgB,CAAC,GAAG;AACtC,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,EACF;AASA,WAAS,YACP,YACA,QACA,MACA;AACA,WAAO,CAAC,KAAK,MAAM,EAAE;AAAA,MAAI,CAAC,SACxB;AAAA,QACE;AAAA,QACA;AAAA,UACE;AAAA,UACA,MAAM,OAAO;AAAA,UACb,SAAS;AAAA,YACP;AAAA,cACE,MAAM,OAAO;AAAA,cACb,QAAQ,OAAO;AAAA,cACf,sBAAsB;AAAA,YACxB;AAAA,UACF;AAAA,QACF;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,WAAS,UAGP,YACA,YACA,MAEA;AAEA,WAAO;AAAA,EACT;AASA,WAAS,aACP,YACA,QACA,MACA;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,QACE,MAAM,OAAO;AAAA,QACb,MAAM,OAAO;AAAA,QACb,KAAK;AAAA,QACL,SAAS,CAAC,OAAO,KAAK;AAAA,MACxB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,WAAS,cACP,YACA,SACA,MACA;AACA,WAAOC,QAAO,OAAO,EAAE,MAAM,CAACC,aAAY;AACxC,YAAM,aAAa,YAAYA,SAAQ,IAAI;AAC3C,YAAM,SAAS;AACf,YAAM,YAAYC,cAAa;AAC/B,aAAO;AAEP,eAASA,gBAAe;AACtB,cAAM,CAAC,MAAM,YAAY,UAAU,IAAI;AAAA,UACrC,KAAK,WAAW;AAAA,UAChB,GAAG,UAAU,GAAGD,SAAQ,IAAI,SAAS,UAAU;AAAA,UAC/C;AAAA,YACE;AAAA,YACA,gBAAgB,KAAK;AAAA,YACrB,GAAGA;AAAA,UACL;AAAA,UACA;AAAA,QACF;AACA,cAAM,cAAcD,QAAO,UAAU,EAAE,MAAM,CAACG,gBAAe;AAC3D,gBAAM,EAAE,QAAQ,IAAIA;AACpB,cAAI,EAAE,YAAY,IAAIA;AACtB,cAAI,WAAW,QAAQ,SAAS,GAAG;AACjC,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAM,CAAC,KAAK,IAAI,WAAW,CAAC;AAC5B,cAAI,OAAO;AACT,gBAAIA,YAAW,SAAS,KAAK;AAC3B,4BAAc;AAAA,YAChB,WAAWA,YAAW,SAAS,QAAQ;AACrC,4BAAc;AAAA,YAChB,OAAO;AACL,oBAAM,IAAI;AAAA,gBACR;AAAA,cACF;AAAA,YACF;AAAA,UACF;AACA,iBAAO;AAAA,YACL,YAAYA,YAAW;AAAA;AAAA;AAAA,YAGvB,YAAYA,YAAW,KAAK,QAAQ,OAAO,EAAE;AAAA;AAAA;AAAA;AAAA,YAI7C,aAAaA,YAAW,SAAS,IAAI,CAAC,WAAW,EAAE,OAAO,MAAM,EAAE;AAAA,YAClE,GAAIA,YAAW,SAAS,EAAE,cAAcA,YAAW,OAAO,IAAI,CAAC;AAAA,YAC/D,GAAIA,YAAW,MAAM,EAAE,WAAWA,YAAW,IAAI,IAAI,CAAC;AAAA,YACtD,GAAI,QACA;AAAA,cACE,YAAY;AAAA;AAAA,cAEZ,aAAa,MAAM;AAAA;AAAA,cAEnB,aAAa,MAAM;AAAA;AAAA,cAEnB,eAAe,aAAa,YAAY;AAAA,YAC1C,IACA,CAAC;AAAA,YACL,GAAGA,YAAW;AAAA,UAChB;AAAA,QACF,CAAC;AAED,eAAO,IAAQ,WAAO;AAAA,UACpB;AAAA,UACA;AAAA,YACE,OAAOH,QAAO,WAAW,EAAE;AAAA,cAAM,CAACI,iBAChC,KAAK,UAAU;AAAA,gBACb,aAAa;AAAA,gBACb,oBAAoBA;AAAA;AAAA;AAAA;AAAA,gBAIpB,aAAa;AAAA,gBACb,SAAS;AAAA,gBACT,WAAW;AAAA,gBACX,mBAAmB;AAAA,cACrB,CAAC;AAAA,YACH;AAAA,YACA,cAAkB,QACf,aAAa;AAAA,cACZ,MAAM;AAAA,YACR,CAAC,EACA,KAAK,CAAC,UAAU,MAAM,KAAK;AAAA,UAChC;AAAA,UACA;AAAA,YACE,GAAG;AAAA;AAAA,YAEH,UAAU,YAAY,gBAAgB;AAAA,UACxC;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;AKvRA,YAAY,YAAY;AACxB,YAAYC,UAAS;;;ACDrB,SAAS,SAAS;AAElB,IAAM,aAAa,OAChB;AAAA,EACC,YAAY,QAAQ,IAAI,eAAe,YAAY,MAAM;AAAA;AAAA,EACzD,SAAS,QAAQ,IAAI,eAAe;AAAA,EACpC,aAAa,QAAQ,IAAI,kBAAkB;AAAA,EAC3C,eAAe,QAAQ,IAAI,qBAAqB;AAAA,EAChD,kBAAkB,QAAQ,IAAI,yBAAyB;AAAA,EACvD,aAAa,QAAQ,IAAI,mBAAmB;AAAA,EAC5C,mBAAmB,QAAQ,IAAI,0BAA0B;AAAA,EACzD,eAAe,QAAQ,IAAI,mBAAmB;AAAA,EAC9C,gBAAgB,QAAQ,IAAI,sBAAsB;AAAA,EAClD,iBAAiB,QAAQ,IAAI,wBAAwB;AAAA,EACrD,kBAAkB,QAAQ,IAAI,yBAAyB;AAAA,EACvD,mBAAmB,QAAQ,IAAI,0BAA0B;AAAA,EACzD,UAAU,QAAQ,IAAI,aAAa;AAAA,EACnC,UAAU,QAAQ,IAAI,aAAa;AAAA,EACnC,WAAW,QAAQ,IAAI,cAAc;AAAA,EACrC,cAAc,QAAQ,IAAI,kBAAkB;AAC9C;AAEF,IAAM,uBAAuB,EAC1B,OAAO;AAAA,EACN,YAAY,EAAE,QAAQ,IAAI;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,aAAa,EAAE,KAAK,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAAA,EAClD,eAAe,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC;AAAA,EACnC,kBAAkB,EAAE,QAAQ,gBAAgB;AAAA,EAC5C,aAAa,EAAE,OAAO,EAAE;AAAA,IAAU,CAAC,QACjC,IACG,MAAM,GAAG,EACT,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AAAA,EACnB;AAAA,EACA,mBAAmB,EAAE,OAAO,EAAE;AAAA,IAAU,CAAC,QACvC,IACG,MAAM,GAAG,EACT,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AAAA,EACnB;AAAA,EACA,eAAe,EAAE,OAAO,QAAQ;AAAA,EAChC,gBAAgB,EAAE,KAAK,CAAC,UAAU,YAAY,CAAC;AAAA,EAC/C,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACjC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAClC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI;AAAA,EAChC,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,cAAc,EAAE,OAAO,EAAE,IAAI;AAC/B,CAAgE,EAC/D,MAAM;AAET,IAAM,0BAA0B,EAC7B,OAAO;AAAA,EACN,YAAY,EAAE,QAAQ,KAAK;AAAA,EAC3B,SAAS,EAAE,OAAO;AAAA,EAClB,aAAa,EAAE,OAAO;AAAA,EACtB,eAAe,EAAE,OAAO;AAAA,EACxB,kBAAkB,EAAE,OAAO;AAAA,EAC3B,aAAa,EACV,OAAO,EACP,UAAU,CAAC,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,CAAC;AAAA,EACnE,mBAAmB,EAChB,OAAO,EACP,UAAU,CAAC,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,CAAC;AAAA,EACnE,eAAe,EACZ,OAAO,EACP,UAAU,CAAC,QAAS,MAAM,IAAI,YAAY,MAAM,SAAS,MAAU;AAAA,EACtE,gBAAgB,EAAE,OAAO;AAAA,EACzB,iBAAiB,EAAE,OAAO;AAAA,EAC1B,kBAAkB,EAAE,OAAO;AAAA,EAC3B,mBAAmB,EAAE,OAAO;AAAA,EAC5B,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EACP,OAAO,EACP;AAAA,IAAU,CAAC,QACV,MAAM,SAAS,KAAK,EAAE,CAAC,IAAI,SAAY,SAAS,KAAK,EAAE;AAAA,EACzD;AAAA,EACF,WAAW,EAAE,OAAO;AAAA,EACpB,cAAc,EAAE,OAAO;AACzB,CAAgE,EAC/D,MAAM;AAET,IAAM,SAAS,EAAE,mBAAmB,cAAc;AAAA,EAChD;AAAA,EACA;AACF,CAAC;AAED,IAAO,uBAAQ,OAAO,MAAM,WAAW,CAAC;;;AD7EjC,IAAM,kBAAN,MAAM,yBAA+B,yBAAkB;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EAEhB,YACE,MACA,OAA4B,CAAC,GAC7B,MACA;AACA,UAAM,0BAA0B,MAAM,MAAM,IAAI;AAGhD,UAAM,aAAiB,SAAI;AAAA,MACzB;AAAA,QACE,MAAM;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,KAAK;AAAA,IACjB;AAEA,UAAM,QAAQ,WAAW;AAGzB,SAAK,MAAM,MAAM;AAAA,MACf,OAAOC,WAAU,MAAU,SAAI,OAAO,EAAE,IAAIA,OAAM,CAAC;AAAA,IACrD;AAGA,SAAK,YAAY,iBAAgB,gBAAgB;AAEjD,SAAK,gBAAgB,KAAK,IAAI;AAAA,MAAM,CAAC,QACnC,KAAK,oBAAoB;AAAA,QACvB,YAAY;AAAA,QACZ;AAAA,QACA,MAAM,KAAK,WAAW;AAAA,QACtB,MAAM,EAAE,QAAQ,KAAK;AAAA,MACvB,CAAC;AAAA,IACH;AAEA,SAAK,gBAAgB;AAAA,MACnB,KAAK,KAAK;AAAA,MACV,WAAW,KAAK;AAAA,IAClB,CAAC;AAAA,EACH;AAAA,EAEA,IAAW,mBAA2D;AACpE,WAAc,cAAO,KAAK,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;AAAA,EAChE;AAAA,EAEA,OAAO,kBAA2C;AAChD,UAAM,EAAE,eAAe,QAAQ,IAAI;AACnC,QAAI,SAAS;AACb,QAAI,kBAAkB,MAAM;AAC1B,YAAM,mBAAmB,CAAC,IAAI,IAAI;AAGlC,YAAM,OAAO,QACV,MAAM,EAAE,EACR,OAAO,CAAC,KAAK,SAAS,MAAM,KAAK,WAAW,CAAC,GAAG,CAAC;AACpD,eAAS,iBAAiB,OAAO,iBAAiB,MAAM;AAAA,IAC1D;AAEA,UAAM,gBAAgB,CAAC,GAAG,GAAG,CAAC,EAAE;AAAA,MAC9B,CAAC,cACK,SAAI,mBAAmB;AAAA,QACzB,MAAM,uBAAuB,aAAa,GAAG,MAAM,IAAI,SAAS;AAAA,MAClE,CAAC,EAAE;AAAA,IACP;AAEA,WAAc,WAAI,aAAa;AAAA,EACjC;AAAA;AAAA,EAGA,oBAAoB;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAKG;AACD,WAAO,IAAQ,SAAI;AAAA,MACjB,GAAG;AAAA,QACD;AAAA,QACA,GAAG,UAAU;AAAA,QACb;AAAA,UACE,aAAa;AAAA,UACb,OAAO,IAAI;AAAA,UACX,QAAQ;AAAA,YACN;AAAA,cACE,UAAU;AAAA,cACV,QAAQ;AAAA,cACR,UAAU;AAAA,cACV,YAAY,CAAC,WAAW;AAAA,YAC1B;AAAA,UACF;AAAA,UACA,SAAS;AAAA,YACP;AAAA,cACE,UAAU;AAAA,cACV,QAAQ;AAAA,cACR,UAAU;AAAA;AAAA,cAEV,YAAY,CAAC,IAAI,SAAS;AAAA,YAC5B;AAAA,UACF;AAAA,QACF;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": ["output", "transform", "runtime", "runtime", "output", "partial", "createRecord", "mergedArgs", "lambdaInput", "aws", "vpcId"]
+}

package/dist/deployConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployConfig.d.ts","sourceRoot":"","sources":["../src/deployConfig.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmFA,wBAA0C;AAG1C,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAmC,CAAC"}
+{"version":3,"file":"deployConfig.d.ts","sourceRoot":"","sources":["../src/deployConfig.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyFA,wBAA0C;AAG1C,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAmC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./deployConfig.js";
+export * from "./lib/sst/component-defaults.js";
+export * from "./lib/proxy/fetch.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iCAAiC,CAAC;AAChD,cAAc,sBAAsB,CAAC"}

package/dist/index.js

@@ -0,0 +1,114 @@
+// src/deployConfig.ts
+import { z } from "zod";
+var getEnvVars = () => ({
+  isIxDeploy: process.env.IX_DEPLOYMENT?.toLowerCase() === "true",
+  // This needs to start as a bool for the discriminated union
+  appName: process.env.IX_APP_NAME ?? "",
+  environment: process.env.IX_ENVIRONMENT ?? "",
+  workloadGroup: process.env.IX_WORKLOAD_GROUP ?? "",
+  primaryAwsRegion: process.env.IX_PRIMARY_AWS_REGION ?? "",
+  siteDomains: process.env.IX_SITE_DOMAINS ?? "",
+  siteDomainAliases: process.env.IX_SITE_DOMAIN_ALIASES ?? "",
+  isInternalApp: process.env.IX_INTERNAL_APP ?? "",
+  deploymentType: process.env.IX_DEPLOYMENT_TYPE ?? "",
+  sourceCommitRef: process.env.IX_SOURCE_COMMIT_REF ?? "",
+  sourceCommitHash: process.env.IX_SOURCE_COMMIT_HASH ?? "",
+  deployTriggeredBy: process.env.IX_DEPLOY_TRIGGERED_BY ?? "",
+  smtpHost: process.env.SMTP_HOST ?? "",
+  smtpPort: process.env.SMTP_PORT ?? "",
+  clamAVUrl: process.env.CLAMAV_URL ?? "",
+  vpcHttpProxy: process.env.VPC_HTTP_PROXY ?? ""
+});
+var ixDeployConfigSchema = z.object({
+  isIxDeploy: z.literal(true),
+  appName: z.string().min(1),
+  environment: z.enum(["dev", "test", "uat", "prod"]),
+  workloadGroup: z.enum(["ds", "srs"]),
+  primaryAwsRegion: z.literal("ap-southeast-2"),
+  siteDomains: z.string().transform(
+    (val) => val.split(",").map((domain) => domain.trim()).filter(Boolean)
+  ),
+  siteDomainAliases: z.string().transform(
+    (val) => val.split(",").map((domain) => domain.trim()).filter(Boolean)
+  ),
+  isInternalApp: z.coerce.boolean(),
+  deploymentType: z.enum(["docker", "serverless"]),
+  sourceCommitRef: z.string().min(1),
+  sourceCommitHash: z.string().min(1),
+  deployTriggeredBy: z.string().min(1),
+  smtpHost: z.string().min(1),
+  smtpPort: z.coerce.number().int(),
+  clamAVUrl: z.string().url(),
+  vpcHttpProxy: z.string().url()
+}).strip();
+var nonIxDeployConfigSchema = z.object({
+  isIxDeploy: z.literal(false),
+  appName: z.string(),
+  environment: z.string(),
+  workloadGroup: z.string(),
+  primaryAwsRegion: z.string(),
+  siteDomains: z.string().transform((val) => val.split(",").map((domain) => domain.trim())),
+  siteDomainAliases: z.string().transform((val) => val.split(",").map((domain) => domain.trim())),
+  isInternalApp: z.string().transform((val) => val ? val.toLowerCase() === "true" : void 0),
+  deploymentType: z.string(),
+  sourceCommitRef: z.string(),
+  sourceCommitHash: z.string(),
+  deployTriggeredBy: z.string(),
+  smtpHost: z.string(),
+  smtpPort: z.string().transform(
+    (val) => isNaN(parseInt(val, 10)) ? void 0 : parseInt(val, 10)
+  ),
+  clamAVUrl: z.string(),
+  vpcHttpProxy: z.string()
+}).strip();
+var schema = z.discriminatedUnion("isIxDeploy", [
+  ixDeployConfigSchema,
+  nonIxDeployConfigSchema
+]);
+var deployConfig_default = schema.parse(getEnvVars());
+var getDeployConfig = () => schema.parse(getEnvVars());
+
+// src/components/ix/dns.ts
+import { output } from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+
+// src/lib/sst/component-defaults.ts
+import { output as output2 } from "@pulumi/pulumi";
+
+// src/lib/proxy/fetch.ts
+import {
+  setGlobalDispatcher,
+  getGlobalDispatcher,
+  EnvHttpProxyAgent,
+  fetch as undiciFetch
+} from "undici";
+import { bootstrap } from "global-agent";
+function setupProxyGlobally() {
+  if (getGlobalDispatcher() instanceof EnvHttpProxyAgent) return;
+  if (!process.env.HTTP_PROXY || !process.env.HTTPS_PROXY) return;
+  const envHttpProxyAgent = new EnvHttpProxyAgent();
+  setGlobalDispatcher(envHttpProxyAgent);
+  if (!process.env.GLOBAL_AGENT_HTTP_PROXY) {
+    process.env.GLOBAL_AGENT_HTTP_PROXY = process.env.HTTP_PROXY;
+    process.env.GLOBAL_AGENT_HTTPS_PROXY = process.env.HTTPS_PROXY ?? process.env.HTTP_PROXY;
+  }
+  bootstrap();
+}
+function getProxiedFetch() {
+  const fetch = (input, init = {}) => {
+    if (init.dispatcher) {
+      console.warn(
+        "A custom dispatcher was provided to fetch but this is ignored as a proxy agent is being used."
+      );
+    }
+    const envHttpProxyAgent = new EnvHttpProxyAgent();
+    return undiciFetch(input, { ...init, dispatcher: envHttpProxyAgent });
+  };
+  return fetch;
+}
+export {
+  getDeployConfig,
+  getProxiedFetch,
+  setupProxyGlobally
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/deployConfig.ts", "../src/components/ix/dns.ts", "../src/lib/sst/component-defaults.ts", "../src/lib/proxy/fetch.ts"],
+  "sourcesContent": ["import { z } from \"zod\";\n\nconst getEnvVars = () =>\n  ({\n    isIxDeploy: process.env.IX_DEPLOYMENT?.toLowerCase() === \"true\", // This needs to start as a bool for the discriminated union\n    appName: process.env.IX_APP_NAME ?? \"\",\n    environment: process.env.IX_ENVIRONMENT ?? \"\",\n    workloadGroup: process.env.IX_WORKLOAD_GROUP ?? \"\",\n    primaryAwsRegion: process.env.IX_PRIMARY_AWS_REGION ?? \"\",\n    siteDomains: process.env.IX_SITE_DOMAINS ?? \"\",\n    siteDomainAliases: process.env.IX_SITE_DOMAIN_ALIASES ?? \"\",\n    isInternalApp: process.env.IX_INTERNAL_APP ?? \"\",\n    deploymentType: process.env.IX_DEPLOYMENT_TYPE ?? \"\",\n    sourceCommitRef: process.env.IX_SOURCE_COMMIT_REF ?? \"\",\n    sourceCommitHash: process.env.IX_SOURCE_COMMIT_HASH ?? \"\",\n    deployTriggeredBy: process.env.IX_DEPLOY_TRIGGERED_BY ?? \"\",\n    smtpHost: process.env.SMTP_HOST ?? \"\",\n    smtpPort: process.env.SMTP_PORT ?? \"\",\n    clamAVUrl: process.env.CLAMAV_URL ?? \"\",\n    vpcHttpProxy: process.env.VPC_HTTP_PROXY ?? \"\",\n  }) satisfies Record<string, string | boolean>;\n\nconst ixDeployConfigSchema = z\n  .object({\n    isIxDeploy: z.literal(true),\n    appName: z.string().min(1),\n    environment: z.enum([\"dev\", \"test\", \"uat\", \"prod\"]),\n    workloadGroup: z.enum([\"ds\", \"srs\"]),\n    primaryAwsRegion: z.literal(\"ap-southeast-2\"),\n    siteDomains: z.string().transform((val) =>\n      val\n        .split(\",\")\n        .map((domain) => domain.trim())\n        .filter(Boolean),\n    ),\n    siteDomainAliases: z.string().transform((val) =>\n      val\n        .split(\",\")\n        .map((domain) => domain.trim())\n        .filter(Boolean),\n    ),\n    isInternalApp: z.coerce.boolean(),\n    deploymentType: z.enum([\"docker\", \"serverless\"]),\n    sourceCommitRef: z.string().min(1),\n    sourceCommitHash: z.string().min(1),\n    deployTriggeredBy: z.string().min(1),\n    smtpHost: z.string().min(1),\n    smtpPort: z.coerce.number().int(),\n    clamAVUrl: z.string().url(),\n    vpcHttpProxy: z.string().url(),\n  } satisfies Record<keyof ReturnType<typeof getEnvVars>, unknown>)\n  .strip();\n\nconst nonIxDeployConfigSchema = z\n  .object({\n    isIxDeploy: z.literal(false),\n    appName: z.string(),\n    environment: z.string(),\n    workloadGroup: z.string(),\n    primaryAwsRegion: z.string(),\n    siteDomains: z\n      .string()\n      .transform((val) => val.split(\",\").map((domain) => domain.trim())),\n    siteDomainAliases: z\n      .string()\n      .transform((val) => val.split(\",\").map((domain) => domain.trim())),\n    isInternalApp: z\n      .string()\n      .transform((val) => (val ? val.toLowerCase() === \"true\" : undefined)),\n    deploymentType: z.string(),\n    sourceCommitRef: z.string(),\n    sourceCommitHash: z.string(),\n    deployTriggeredBy: z.string(),\n    smtpHost: z.string(),\n    smtpPort: z\n      .string()\n      .transform((val) =>\n        isNaN(parseInt(val, 10)) ? undefined : parseInt(val, 10),\n      ),\n    clamAVUrl: z.string(),\n    vpcHttpProxy: z.string(),\n  } satisfies Record<keyof ReturnType<typeof getEnvVars>, unknown>)\n  .strip();\n\nconst schema = z.discriminatedUnion(\"isIxDeploy\", [\n  ixDeployConfigSchema,\n  nonIxDeployConfigSchema,\n]);\n\nexport default schema.parse(getEnvVars());\n\n// process.env values can change at runtime so we provide a way to re-parse the config as needed\nexport const getDeployConfig = () => schema.parse(getEnvVars());\n", "// Based on https://github.com/anomalyco/sst/blob/3407c32b2cf97b85ea96a92361c6f4a0a8d55200/platform/src/components/aws/dns.ts\n/**\n * The AWS DNS Adapter is used to create DNS records to manage domains hosted on\n * [Route 53](https://aws.amazon.com/route53/).\n *\n * This adapter is passed in as `domain.dns` when setting a custom domain.\n *\n * @example\n *\n * ```ts\n * {\n *   domain: {\n *     name: \"example.com\",\n *     dns: sst.aws.dns()\n *   }\n * }\n * ```\n *\n * You can also specify a hosted zone ID if you have multiple hosted zones with the same domain.\n *\n * ```ts\n * {\n *   domain: {\n *     name: \"example.com\",\n *     dns: sst.aws.dns({\n *       zone: \"Z2FDTNDATAQYW2\"\n *     })\n *   }\n * }\n * ```\n *\n * @packageDocumentation\n */\n\nimport {\n  AliasRecord,\n  Dns,\n  Record as DnsRecord,\n} from \"sst3/platform/src/components/dns\";\nimport { logicalName } from \"sst3/platform/src/components/naming\";\nimport { ComponentResourceOptions, output } from \"@pulumi/pulumi\";\nimport { Transform, transform } from \"sst3/platform/src/components/component\";\nimport { Input } from \"sst3/platform/src/components/input\";\nimport { useProvider } from \"sst3/platform/src/components/aws/helpers/provider\";\nimport { route53 } from \"@pulumi/aws\";\nimport { VisibleError } from \"sst3/platform/src/components/error\";\nimport * as aws from \"@pulumi/aws\";\n\nexport interface DnsArgs {\n  /**\n   * Set the hosted zone ID if you have multiple hosted zones that have the same\n   * domain in Route 53.\n   *\n   * The 14 letter ID of the [Route 53 hosted zone](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-working-with.html) that contains the `domainName`. You can find the hosted zone ID in the Route 53 part of the AWS Console.\n   *\n   * @example\n   * ```js\n   * {\n   *   zone: \"Z2FDTNDATAQYW2\"\n   * }\n   * ```\n   */\n  zone?: Input<string>;\n  /**\n   * Set to `true` if you want to let the new DNS records replace the existing ones.\n   *\n   * :::tip\n   * Use this to migrate over your domain without any downtime.\n   * :::\n   *\n   * This is useful if your domain is currently used by another app and you want to switch it\n   * to your current app. Without setting this, you'll first have to remove the existing DNS\n   * records and then add the new one. This can cause downtime.\n   *\n   * You can avoid this by setting this to `true` and the existing DNS records will be replaced\n   * without any downtime. Just make sure that when you remove your old app, you don't remove\n   * the DNS records.\n   *\n   * @default `false`\n   * @example\n   * ```js\n   * {\n   *   override: true\n   * }\n   * ```\n   */\n  override?: Input<boolean>;\n  /**\n   * [Transform](/docs/components#transform) how this component creates its underlying\n   * resources.\n   */\n  transform?: {\n    /**\n     * Transform the AWS Route 53 record resource.\n     */\n    record?: Transform<\n      route53.RecordArgs & {\n        aliasIpType?: \"IPv4\" | \"IPv6\";\n        // Can be used to override the raw input to the IX DNS lambda\n        lambdaInput?: Record<string, unknown>;\n      }\n    >;\n  };\n}\n\nexport function dns(args: DnsArgs = {}) {\n  return {\n    provider: \"aws\",\n    createAlias,\n    createCaa,\n    createRecord,\n  } satisfies Dns;\n\n  /**\n   * Creates alias records in the hosted zone.\n   *\n   * @param namePrefix The prefix to use for the resource names.\n   * @param record The alias record to create.\n   * @param opts The component resource options.\n   */\n  function createAlias(\n    namePrefix: string,\n    record: AliasRecord,\n    opts: ComponentResourceOptions,\n  ) {\n    return [\"A\", \"AAAA\"].map((type) =>\n      _createRecord(\n        namePrefix,\n        {\n          type,\n          name: record.name,\n          aliases: [\n            {\n              name: record.aliasName,\n              zoneId: record.aliasZone,\n              evaluateTargetHealth: true,\n            },\n          ],\n        },\n        opts,\n      ),\n    );\n  }\n\n  function createCaa(\n    /* eslint-disable @typescript-eslint/no-unused-vars -- Kept for typing even though it's not used for this\n    implementation of Dns */\n    namePrefix: string,\n    recordName: string,\n    opts: ComponentResourceOptions,\n    /* eslint-enable @typescript-eslint/no-unused-vars */\n  ) {\n    // placeholder\n    return undefined;\n  }\n\n  /**\n   * Creates a DNS record in the hosted zone.\n   *\n   * @param namePrefix The prefix to use for the resource names.\n   * @param record The DNS record to create.\n   * @param opts The component resource options.\n   */\n  function createRecord(\n    namePrefix: string,\n    record: DnsRecord,\n    opts: ComponentResourceOptions,\n  ) {\n    return _createRecord(\n      namePrefix,\n      {\n        type: record.type,\n        name: record.name,\n        ttl: 60,\n        records: [record.value],\n      },\n      opts,\n    );\n  }\n\n  function _createRecord(\n    namePrefix: string,\n    partial: Omit<route53.RecordArgs, \"zoneId\">,\n    opts: ComponentResourceOptions,\n  ) {\n    return output(partial).apply((partial) => {\n      const nameSuffix = logicalName(partial.name);\n      const zoneId = \"\"; // The IX dns lambda will determine the zone ID based on the domain name\n      const dnsRecord = createRecord();\n      return dnsRecord;\n\n      function createRecord() {\n        const [name, mergedArgs, mergedOpts] = transform(\n          args.transform?.record,\n          `${namePrefix}${partial.type}Record${nameSuffix}`,\n          {\n            zoneId,\n            allowOverwrite: args.override,\n            ...partial,\n          },\n          opts,\n        );\n        const lambdaInput = output(mergedArgs).apply((mergedArgs) => {\n          const { aliases } = mergedArgs;\n          let { aliasIpType } = mergedArgs;\n          if (aliases && aliases.length > 1) {\n            throw new VisibleError(\n              \"Aliases with multiple targets are not supported\",\n            );\n          }\n          const [alias] = aliases || [];\n          if (alias) {\n            if (mergedArgs.type === \"A\") {\n              aliasIpType = \"IPv4\";\n            } else if (mergedArgs.type === \"AAAA\") {\n              aliasIpType = \"IPv6\";\n            } else {\n              throw new VisibleError(\n                \"Alias records can only be created for A or AAAA record types\",\n              );\n            }\n          }\n          return {\n            RecordType: mergedArgs.type,\n            // Even though a trailing dot is valid a bug in the IX dns lambda means that an error occurs\n            // when trying to find the hosted zone if there is a trailing dot.\n            RecordFQDN: mergedArgs.name.replace(/\\.$/, \"\"),\n            // If giving the IX dns lambda multiple values we need to wrap in 'Value' objects\n            // unlike for single values where the lambda does it for us\n            // https://github.com/InfoxchangeTS/aws-gov/blob/213609c2e91b021375b93290efdaf38936ee98e1/components/xaccount-route53/dns-record-updater-lambda/src/index.py#L133\n            RecordValue: mergedArgs.records?.map((value) => ({ Value: value })),\n            ...(mergedArgs.zoneId ? { HostedZoneId: mergedArgs.zoneId } : {}),\n            ...(mergedArgs.ttl ? { RecordTTL: mergedArgs.ttl } : {}),\n            ...(alias\n              ? {\n                  RecordType: \"ALIAS\",\n                  // https://github.com/InfoxchangeTS/aws-gov/blob/213609c2e91b021375b93290efdaf38936ee98e1/components/xaccount-route53/dns-record-updater-lambda/src/index.py#L145\n                  RecordValue: alias.name,\n                  // https://github.com/InfoxchangeTS/aws-gov/blob/213609c2e91b021375b93290efdaf38936ee98e1/components/xaccount-route53/dns-record-updater-lambda/src/index.py#L144\n                  AliasZoneId: alias.zoneId,\n                  // alias.evaluateTargetHealth can't be set by the lambda\n                  IpAddressType: aliasIpType?.toLowerCase(),\n                }\n              : {}),\n            ...mergedArgs.lambdaInput,\n          };\n        });\n        // output([mergedArgs, lambdaInput]).apply(([mergedArgs, lambdaInput]) => console.log('________ BEFORE', mergedArgs, '___________ AFTER', lambdaInput));\n        return new aws.lambda.Invocation(\n          name,\n          {\n            input: output(lambdaInput).apply((lambdaInput) =>\n              JSON.stringify({\n                RequestType: \"Create\",\n                ResourceProperties: lambdaInput,\n                // We need some value so that the lambda doesn't throw an error but we don't want the lambda to actually\n                // send a response to this url (the response is for CloudFormation which we're not using). Setting an\n                // invalid domain will cause it to log an error but not throw so the lambda is considered successful.\n                ResponseURL: \"invalid://make-it-so-dns\",\n                StackId: \"\",\n                RequestId: \"\",\n                LogicalResourceId: \"\",\n              }),\n            ),\n            functionName: aws.ssm\n              .getParameter({\n                name: \"/shared-services/route53/lambdaArn\",\n              })\n              .then((param) => param.value),\n          },\n          {\n            ...mergedOpts,\n            // Function can only be invoked from within the same region it is deployed\n            provider: useProvider(\"ap-southeast-2\"),\n          },\n        );\n      }\n    });\n  }\n}\n", "import { $transform as sst3$transform } from \"sst3/platform/src/components/component\";\nimport type * as aws from \"sst3/platform/src/components/aws\";\nimport type * as cloudflare from \"sst3/platform/src/components/cloudflare\";\nimport { dns } from \"@/components/ix/dns\";\nimport { output } from \"@pulumi/pulumi\";\nimport { getDeployConfig } from \"@/deployConfig\";\n\nexport default function setupComponentDefaults({\n  $transform,\n  sst: partiallyTypedSst,\n}: {\n  $transform: typeof sst3$transform;\n  sst: {\n    /* eslint-disable @typescript-eslint/no-explicit-any -- SST works by creating types dynamically in the\n            project where it's used. Therefore we can't import them in this library. For the sake of ensuring the\n            correctness of this code we cast to equivalent classes from the \"sst3\" module we download directly from\n            GitHub since we can't guarantee the whole type will exactly match.\n             */\n    aws: {\n      StaticSite: any;\n      Nextjs: any;\n    };\n    cloudflare: {\n      StaticSite: any;\n    };\n    /* eslint-enable @typescript-eslint/no-explicit-any */\n  };\n}) {\n  const sst: {\n    aws: {\n      StaticSite: typeof aws.StaticSite;\n      Nextjs: typeof aws.Nextjs;\n    };\n    cloudflare: {\n      StaticSite: typeof cloudflare.StaticSite;\n    };\n  } = partiallyTypedSst;\n\n  $transform(sst.aws.StaticSite, (args, opts, name) => {\n    addDefaultDomain(args, name);\n  });\n  $transform(sst.aws.Nextjs, (args, opts, name) => {\n    addDefaultDomain(args, name);\n  });\n  $transform(sst.cloudflare.StaticSite, (args, opts, name) => {\n    addDefaultDomain(args, name);\n  });\n}\n\nfunction addDefaultDomain(\n  args:\n    | aws.StaticSiteArgs\n    | aws.NextjsArgs\n    | cloudflare.StaticSiteArgs\n    | undefined,\n  name: string,\n) {\n  if (!args) {\n    throw new Error(`No args provided to ${name}`);\n  }\n  const domainArgs = {\n    name: getDeployConfig().siteDomains[0],\n    dns: dns(),\n  };\n  if (!(\"domain\" in args)) {\n    args.domain = domainArgs;\n  } else if (args.domain) {\n    args.domain = output(args.domain).apply((domain) => {\n      if (typeof domain === \"string\") {\n        return {\n          name: domain,\n          dns: domainArgs.dns,\n        };\n      } else if (!(\"dns\" in domain)) {\n        domain.dns = domainArgs.dns;\n      }\n      return domain;\n    });\n  }\n}\n", "import {\n  setGlobalDispatcher,\n  getGlobalDispatcher,\n  EnvHttpProxyAgent,\n  fetch as undiciFetch,\n} from \"undici\";\nimport { bootstrap } from \"global-agent\";\n\nexport function setupProxyGlobally() {\n  // Make operation idempotent\n  if (getGlobalDispatcher() instanceof EnvHttpProxyAgent) return;\n\n  if (!process.env.HTTP_PROXY || !process.env.HTTPS_PROXY) return;\n\n  // To cover libraries that use fetch\n  // See https://nodejs.org/api/globals.html#custom-dispatcher\n  // This might stop being needed at some point: https://github.com/actions/create-github-app-token/pull/143#discussion_r1747641337\n  const envHttpProxyAgent = new EnvHttpProxyAgent();\n  setGlobalDispatcher(envHttpProxyAgent);\n\n  // To cover libraries that use the http/https object\n  if (!process.env.GLOBAL_AGENT_HTTP_PROXY) {\n    process.env.GLOBAL_AGENT_HTTP_PROXY = process.env.HTTP_PROXY;\n    process.env.GLOBAL_AGENT_HTTPS_PROXY =\n      process.env.HTTPS_PROXY ?? process.env.HTTP_PROXY;\n  }\n  bootstrap();\n}\n\nexport function getProxiedFetch() {\n  const fetch: typeof undiciFetch = (input, init = {}) => {\n    if (init.dispatcher) {\n      console.warn(\n        \"A custom dispatcher was provided to fetch but this is ignored as a proxy agent is being used.\",\n      );\n    }\n    const envHttpProxyAgent = new EnvHttpProxyAgent();\n    return undiciFetch(input, { ...init, dispatcher: envHttpProxyAgent });\n  };\n  return fetch;\n}\n"],
+  "mappings": ";AAAA,SAAS,SAAS;AAElB,IAAM,aAAa,OAChB;AAAA,EACC,YAAY,QAAQ,IAAI,eAAe,YAAY,MAAM;AAAA;AAAA,EACzD,SAAS,QAAQ,IAAI,eAAe;AAAA,EACpC,aAAa,QAAQ,IAAI,kBAAkB;AAAA,EAC3C,eAAe,QAAQ,IAAI,qBAAqB;AAAA,EAChD,kBAAkB,QAAQ,IAAI,yBAAyB;AAAA,EACvD,aAAa,QAAQ,IAAI,mBAAmB;AAAA,EAC5C,mBAAmB,QAAQ,IAAI,0BAA0B;AAAA,EACzD,eAAe,QAAQ,IAAI,mBAAmB;AAAA,EAC9C,gBAAgB,QAAQ,IAAI,sBAAsB;AAAA,EAClD,iBAAiB,QAAQ,IAAI,wBAAwB;AAAA,EACrD,kBAAkB,QAAQ,IAAI,yBAAyB;AAAA,EACvD,mBAAmB,QAAQ,IAAI,0BAA0B;AAAA,EACzD,UAAU,QAAQ,IAAI,aAAa;AAAA,EACnC,UAAU,QAAQ,IAAI,aAAa;AAAA,EACnC,WAAW,QAAQ,IAAI,cAAc;AAAA,EACrC,cAAc,QAAQ,IAAI,kBAAkB;AAC9C;AAEF,IAAM,uBAAuB,EAC1B,OAAO;AAAA,EACN,YAAY,EAAE,QAAQ,IAAI;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,aAAa,EAAE,KAAK,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAAA,EAClD,eAAe,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC;AAAA,EACnC,kBAAkB,EAAE,QAAQ,gBAAgB;AAAA,EAC5C,aAAa,EAAE,OAAO,EAAE;AAAA,IAAU,CAAC,QACjC,IACG,MAAM,GAAG,EACT,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AAAA,EACnB;AAAA,EACA,mBAAmB,EAAE,OAAO,EAAE;AAAA,IAAU,CAAC,QACvC,IACG,MAAM,GAAG,EACT,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AAAA,EACnB;AAAA,EACA,eAAe,EAAE,OAAO,QAAQ;AAAA,EAChC,gBAAgB,EAAE,KAAK,CAAC,UAAU,YAAY,CAAC;AAAA,EAC/C,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACjC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAClC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI;AAAA,EAChC,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,cAAc,EAAE,OAAO,EAAE,IAAI;AAC/B,CAAgE,EAC/D,MAAM;AAET,IAAM,0BAA0B,EAC7B,OAAO;AAAA,EACN,YAAY,EAAE,QAAQ,KAAK;AAAA,EAC3B,SAAS,EAAE,OAAO;AAAA,EAClB,aAAa,EAAE,OAAO;AAAA,EACtB,eAAe,EAAE,OAAO;AAAA,EACxB,kBAAkB,EAAE,OAAO;AAAA,EAC3B,aAAa,EACV,OAAO,EACP,UAAU,CAAC,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,CAAC;AAAA,EACnE,mBAAmB,EAChB,OAAO,EACP,UAAU,CAAC,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,CAAC;AAAA,EACnE,eAAe,EACZ,OAAO,EACP,UAAU,CAAC,QAAS,MAAM,IAAI,YAAY,MAAM,SAAS,MAAU;AAAA,EACtE,gBAAgB,EAAE,OAAO;AAAA,EACzB,iBAAiB,EAAE,OAAO;AAAA,EAC1B,kBAAkB,EAAE,OAAO;AAAA,EAC3B,mBAAmB,EAAE,OAAO;AAAA,EAC5B,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EACP,OAAO,EACP;AAAA,IAAU,CAAC,QACV,MAAM,SAAS,KAAK,EAAE,CAAC,IAAI,SAAY,SAAS,KAAK,EAAE;AAAA,EACzD;AAAA,EACF,WAAW,EAAE,OAAO;AAAA,EACpB,cAAc,EAAE,OAAO;AACzB,CAAgE,EAC/D,MAAM;AAET,IAAM,SAAS,EAAE,mBAAmB,cAAc;AAAA,EAChD;AAAA,EACA;AACF,CAAC;AAED,IAAO,uBAAQ,OAAO,MAAM,WAAW,CAAC;AAGjC,IAAM,kBAAkB,MAAM,OAAO,MAAM,WAAW,CAAC;;;ACpD9D,SAAmC,cAAc;AAMjD,YAAY,SAAS;;;AC1CrB,SAAS,UAAAA,eAAc;;;ACJvB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,SAAS;AAAA,OACJ;AACP,SAAS,iBAAiB;AAEnB,SAAS,qBAAqB;AAEnC,MAAI,oBAAoB,aAAa,kBAAmB;AAExD,MAAI,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,IAAI,YAAa;AAKzD,QAAM,oBAAoB,IAAI,kBAAkB;AAChD,sBAAoB,iBAAiB;AAGrC,MAAI,CAAC,QAAQ,IAAI,yBAAyB;AACxC,YAAQ,IAAI,0BAA0B,QAAQ,IAAI;AAClD,YAAQ,IAAI,2BACV,QAAQ,IAAI,eAAe,QAAQ,IAAI;AAAA,EAC3C;AACA,YAAU;AACZ;AAEO,SAAS,kBAAkB;AAChC,QAAM,QAA4B,CAAC,OAAO,OAAO,CAAC,MAAM;AACtD,QAAI,KAAK,YAAY;AACnB,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF;AACA,UAAM,oBAAoB,IAAI,kBAAkB;AAChD,WAAO,YAAY,OAAO,EAAE,GAAG,MAAM,YAAY,kBAAkB,CAAC;AAAA,EACtE;AACA,SAAO;AACT;",
+  "names": ["output"]
+}

package/dist/lib/sst/component-defaults.d.ts

@@ -0,0 +1,14 @@
+import { $transform as sst3$transform } from "sst3/platform/src/components/component";
+export default function setupComponentDefaults({ $transform, sst: partiallyTypedSst, }: {
+    $transform: typeof sst3$transform;
+    sst: {
+        aws: {
+            StaticSite: any;
+            Nextjs: any;
+        };
+        cloudflare: {
+            StaticSite: any;
+        };
+    };
+}): void;
+//# sourceMappingURL=component-defaults.d.ts.map

package/dist/lib/sst/component-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"component-defaults.d.ts","sourceRoot":"","sources":["../../../src/lib/sst/component-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAOtF,MAAM,CAAC,OAAO,UAAU,sBAAsB,CAAC,EAC7C,UAAU,EACV,GAAG,EAAE,iBAAiB,GACvB,EAAE;IACD,UAAU,EAAE,OAAO,cAAc,CAAC;IAClC,GAAG,EAAE;QAMH,GAAG,EAAE;YACH,UAAU,EAAE,GAAG,CAAC;YAChB,MAAM,EAAE,GAAG,CAAC;SACb,CAAC;QACF,UAAU,EAAE;YACV,UAAU,EAAE,GAAG,CAAC;SACjB,CAAC;KAEH,CAAC;CACH,QAoBA"}

package/eslint.config.js

@@ -4,6 +4,7 @@ import tseslint from "typescript-eslint";
 import eslintConfigPrettier from "eslint-config-prettier";
 
 export default [
+  { ignores: ["dist/**"] },
   { languageOptions: { globals: globals.node } },
   pluginJs.configs.recommended,
   ...tseslint.configs.recommended,

package/package.json

@@ -1,24 +1,24 @@
 {
   "name": "@infoxchange/make-it-so",
-  "version": "2.13.0",
+  "version": "2.14.0-internal-testing-add-sst-3-support.2",
   "description": "Makes deploying services to IX infra easy",
   "repository": "github:infoxchange/make-it-so",
   "type": "module",
   "scripts": {
-    "build": "tsc",
-    "test": "vitest",
-    "lint": "eslint . --fix && prettier . --write && tsc --noEmit",
-    "lint:check": "eslint . && prettier . --check && tsc --noEmit",
+    "build": "tsx build.ts",
+    "commit": "lint-staged && commit",
+    "lint": "eslint . --fix && prettier . --write && tsc --noEmit --emitDeclarationOnly false",
+    "lint:check": "eslint . && prettier . --check && tsc --noEmit --emitDeclarationOnly false",
     "prepare": "husky",
-    "commit": "lint-staged && commit"
+    "test": "vitest",
+    "//fix-signature-issue-with-pulumiverse-vercel": "The sed command below patches the version of @pulumiverse/vercel in the sst3 platform package to a version that has the fix for the Pulumi signature issue.",
+    "postinstall": "cd node_modules/sst3/platform && sed -i.bak 's/\"@pulumiverse\\/vercel\": \"1.11.0\"/\"@pulumiverse\\/vercel\": \"3.1.1\"/' package.json && test -f package-lock.json && rm package-lock.json; npm install"
   },
   "author": "Infoxchange Vic Dev Team <vicdevs@infoxchange.org>",
   "license": "MIT",
   "exports": {
-    "./cdk-constructs": "./dist/cdk-constructs/index.js",
-    "./deployConfig": "./dist/deployConfig.js",
-    "./auth": "./dist/lib/auth/index.js",
-    "./proxy": "./dist/lib/proxy/index.js"
+    ".": "./dist/index.js",
+    "./components/ix": "./dist/components/ix/index.js"
   },
   "lint-staged": {
     "**/*": [
@@ -33,10 +33,10 @@
     "@eslint/js": "^9.3.0",
     "@tsconfig/node21": "^21.0.3",
     "@types/aws-cloudfront-function": "^1.0.6",
+    "@types/aws-lambda": "8.10.159",
     "@types/global-agent": "^3.0.0",
     "@types/jsonwebtoken": "^9.0.10",
-    "aws-cdk-lib": "2.142.1",
-    "constructs": "^10.3.0",
+    "esbuild": "^0.27.2",
     "eslint": "^8.57.0",
     "eslint-config-prettier": "^9.1.0",
     "globals": "^15.3.0",
@@ -44,15 +44,15 @@
     "lint-staged": "^15.2.5",
     "prettier": "3.2.5",
     "semantic-release": "^23.1.1",
-    "sst": "2.42.0",
+    "sst3": "github:anomalyco/sst",
+    "tsx": "^4.7.0",
     "typescript": "^5.4.5",
     "typescript-eslint": "^7.11.0",
     "vitest": "^1.6.0"
   },
   "peerDependencies": {
-    "aws-cdk-lib": "^2.0.0",
-    "constructs": "^10.0.0",
-    "sst": "^2.0.0"
+    "@pulumi/aws": "^7.16.0",
+    "@pulumi/pulumi": "^3.216.0"
   },
   "dependencies": {
     "global-agent": "^3.0.0",

package/src/components/ix/InternalNetwork.ts

@@ -0,0 +1,126 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import ixDeployConfig from "@/deployConfig";
+import { Transform, transform } from "sst3/platform/src/components/component";
+
+export interface InternalNetworkArgs {
+  name?: string;
+  transform?: {
+    securityGroup?: Transform<aws.ec2.SecurityGroupArgs>;
+  };
+}
+
+export class InternalNetwork extends pulumi.ComponentResource {
+  public readonly vpc: pulumi.Output<aws.ec2.GetVpcResult>;
+  public readonly subnetIds: pulumi.Output<string[]>;
+  public readonly securityGroup: pulumi.Output<aws.ec2.SecurityGroup>;
+
+  constructor(
+    name: string,
+    args: InternalNetworkArgs = {},
+    opts?: pulumi.ComponentResourceOptions,
+  ) {
+    super("ix:aws:InternalNetwork", name, args, opts);
+
+    // Get VPC ID from SSM parameter
+    const vpcIdParam = aws.ssm.getParameterOutput(
+      {
+        name: "/vpc/id",
+      },
+      { parent: this },
+    );
+
+    const vpcId = vpcIdParam.value;
+
+    // Get VPC details
+    this.vpc = vpcId.apply(
+      async (vpcId) => await aws.ec2.getVpc({ id: vpcId }),
+    );
+
+    // Get subnet IDs
+    this.subnetIds = InternalNetwork.getVpcSubnetIds();
+
+    this.securityGroup = this.vpc.apply((vpc) =>
+      this.createSecurityGroup({
+        parentName: name,
+        vpc: vpc,
+        args: args.transform?.securityGroup,
+        opts: { parent: this },
+      }),
+    );
+
+    this.registerOutputs({
+      vpc: this.vpc,
+      subnetIds: this.subnetIds,
+    });
+  }
+
+  public get securityGroupIds(): pulumi.Output<pulumi.Output<string>[]> {
+    return pulumi.output(this.securityGroup).apply((sg) => [sg.id]);
+  }
+
+  static getVpcSubnetIds(): pulumi.Output<string[]> {
+    const { workloadGroup, appName } = ixDeployConfig;
+    let suffix = "";
+    if (workloadGroup === "ds") {
+      const possibleSuffixes = ["", "-2"];
+      // Randomly select a suffix to spread workload's IP usage across both sets of subnets. Use the app name as a seed
+      // to ensure consistent selection on redeploys.
+      const hash = appName
+        .split("")
+        .reduce((acc, char) => acc + char.charCodeAt(0), 0);
+      suffix = possibleSuffixes[hash % possibleSuffixes.length];
+    }
+
+    const subnetOutputs = [1, 2, 3].map(
+      (subnetNum) =>
+        aws.ssm.getParameterOutput({
+          name: `/vpc/subnet/private-${workloadGroup}${suffix}/${subnetNum}/id`,
+        }).value,
+    );
+
+    return pulumi.all(subnetOutputs);
+  }
+
+  // Based on https://github.com/anomalyco/sst/blob/3407c32b2cf97b85ea96a92361c6f4a0a8d55200/platform/src/components/aws/vpc.ts#L840
+  createSecurityGroup({
+    parentName,
+    vpc,
+    args,
+    opts,
+  }: {
+    parentName: string;
+    vpc: aws.ec2.GetVpcResult;
+    args?: Transform<aws.ec2.SecurityGroupArgs>;
+    opts: pulumi.ComponentResourceOptions;
+  }) {
+    return new aws.ec2.SecurityGroup(
+      ...transform(
+        args,
+        `${parentName}SecurityGroup`,
+        {
+          description: "Managed by make-it-so",
+          vpcId: vpc.id,
+          egress: [
+            {
+              fromPort: 0,
+              toPort: 0,
+              protocol: "-1",
+              cidrBlocks: ["0.0.0.0/0"],
+            },
+          ],
+          ingress: [
+            {
+              fromPort: 0,
+              toPort: 0,
+              protocol: "-1",
+              // Restricts inbound traffic to only within the VPC
+              cidrBlocks: [vpc.cidrBlock],
+            },
+          ],
+        },
+        opts,
+      ),
+    );
+  }
+}